From cc43f811adfb9fb1a660ff045c142f6c4331fe5c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 14 Jan 2019 18:51:53 +0100
Subject: [PATCH 001/460] Made RAND_status check optional (broke
 --disable-crypto-rand)

dhclient can terminate if not enough entropy, but it never requires
random data. On a new virtual machine, lack of entropy can be common.
Ensure it does not prevent DHCP client assigning an IP address.
---
 bind-rh1663318.patch | 32 ++++++++++++++++++++++++++++++++
 bind.spec            |  9 ++++++++-
 2 files changed, 40 insertions(+), 1 deletion(-)
 create mode 100644 bind-rh1663318.patch

diff --git a/bind-rh1663318.patch b/bind-rh1663318.patch
new file mode 100644
index 0000000..79487b0
--- /dev/null
+++ b/bind-rh1663318.patch
@@ -0,0 +1,32 @@
+From 48d86dd3d834bcedd0c977d193c36b12e8398b4e Mon Sep 17 00:00:00 2001
+From: Francis Dupont <fdupont@isc.org>
+Date: Sun, 17 Sep 2017 12:02:09 +0200
+Subject: [PATCH] Made RAND_status check optional (broke --disable-crypto-rand)
+
+---
+ lib/dns/openssl_link.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/lib/dns/openssl_link.c b/lib/dns/openssl_link.c
+index 91e87d0..3cddaa9 100644
+--- a/lib/dns/openssl_link.c
++++ b/lib/dns/openssl_link.c
+@@ -289,6 +289,7 @@ dst__openssl_init(const char *engine) {
+ #endif
+ #endif /* !defined(OPENSSL_NO_ENGINE) */
+ 
++#ifdef ISC_PLATFORM_CRYPTORANDOM
+ 	/* Protect ourselves against unseeded PRNG */
+ 	if (RAND_status() != 1) {
+ 		FATAL_ERROR(__FILE__, __LINE__,
+@@ -296,6 +297,7 @@ dst__openssl_init(const char *engine) {
+ 			    "cannot be initialized (see the `PRNG not "
+ 			    "seeded' message in the OpenSSL FAQ)");
+ 	}
++#endif
+ 
+ 	return (ISC_R_SUCCESS);
+ 
+-- 
+2.20.1
+
diff --git a/bind.spec b/bind.spec
index 2b22c57..372bf59 100644
--- a/bind.spec
+++ b/bind.spec
@@ -52,7 +52,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.11.4
-Release:  12%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  13%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      http://www.isc.org/products/BIND/
 #
@@ -124,6 +124,8 @@ Patch159:bind-9.11-rt46047.patch
 # commit 083461d3329ff6f2410745848a926090586a9846
 Patch160:bind-9.11-rh1624100.patch
 Patch161:bind-9.11-host-idn-disable.patch
+# https://gitlab.isc.org/isc-projects/bind9/commit/8a98277811e
+Patch163:bind-rh1663318.patch
 
 # SDB patches
 Patch11: bind-9.3.2b2-sdbsrc.patch
@@ -468,6 +470,7 @@ are used for building ISC DHCP.
 %patch159 -p1 -b .rt46047
 %patch160 -p1 -b .rh1624100
 %patch161 -p1 -b .host-idn-disable
+%patch163 -p1 -b .rh1663318
 
 mkdir lib/dns/tests/testdata/dstrandom
 cp -a %{SOURCE50} lib/dns/tests/testdata/dstrandom/random.data
@@ -679,6 +682,7 @@ export LIBDIR_SUFFIX
         --without-libjson \
         --without-zlib \
         --without-dlopen \
+        --disable-crypto-rand \
         --enable-full-report
 
 ## We don't want to build other libs than -export twice
@@ -1446,6 +1450,9 @@ rm -rf ${RPM_BUILD_ROOT}
 
 
 %changelog
+* Mon Jan 14 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.4-13.P2
+- Disable crypto rand for DHCP (#1663318)
+
 * Tue Oct 02 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.4-12.P2
 - Add Requires to devel packages referenced by bind-devel
 

From bb9dac4e90f3b82a69572bc68f017bc83b96f0da Mon Sep 17 00:00:00 2001
From: Adam Williamson <awilliam@redhat.com>
Date: Fri, 11 Jan 2019 23:35:03 -0800
Subject: [PATCH 002/460] Correct a backport inconsistency in
 bind-9.11-rt46047.patch

The patch seems to have been generated from a more recent bind
tree in which `ns_g_lctx` was renamed `named_g_lctx`. So the
patch uses the `named_g_lctx` name, but the rest of server.c
in bind-9.11 still uses the name `ns_g_lctx`, so if you compile
with --disable-crypto-rand, the build actually fails with an
undeclared name error.
---
 bind-9.11-rt46047.patch | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bind-9.11-rt46047.patch b/bind-9.11-rt46047.patch
index 915b0ab..78b3b1c 100644
--- a/bind-9.11-rt46047.patch
+++ b/bind-9.11-rt46047.patch
@@ -299,7 +299,7 @@ index ca789e5..1413e85 100644
 -							      randomdev);
 +			if ((obj != NULL) && !cfg_obj_isvoid(obj))
 +				level = ISC_LOG_INFO;
-+			isc_log_write(named_g_lctx, NS_LOGCATEGORY_GENERAL,
++			isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
 +				      NS_LOGMODULE_SERVER, level,
 +				      "no source of entropy found");
 +			if ((obj == NULL) || cfg_obj_isvoid(obj)) {

From e5a4a14d543723d078985b1867131dbca07ea504 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 19 Oct 2018 17:52:10 +0200
Subject: [PATCH 003/460] Update to 9.11.5

Bump to higher version, update sources.

More fixes to rebased BIND. Many patches are affected by stdbool change.
Update libraries so versions.

(cherry picked from commit ad7b3b8f1284fb8077c24233c4172e2174a6d90e)
---
 .gitignore                         |   1 +
 bind-9.10-dist-native-pkcs11.patch |  38 +--
 bind-9.11-fips-code.patch          | 399 +++++++++++++----------------
 bind-9.11-fips-tests.patch         | 136 +++++-----
 bind-9.11-host-idn-disable.patch   |  22 +-
 bind-9.11-kyua-pkcs11.patch        |  48 ++--
 bind-9.11-oot-manual.patch         |  34 +--
 bind-9.11-rh1624100.patch          |  58 +++--
 bind-9.11-rt31459.patch            | 365 +++++++++++++-------------
 bind-9.11-rt46047.patch            | 172 ++++++-------
 bind-95-rh452060.patch             |  12 +-
 bind.spec                          |  25 +-
 bind93-rh490837.patch              |  74 +++---
 sources                            |   2 +-
 14 files changed, 662 insertions(+), 724 deletions(-)

diff --git a/.gitignore b/.gitignore
index 774f56c..f656e89 100644
--- a/.gitignore
+++ b/.gitignore
@@ -86,3 +86,4 @@ bind-9.7.2b1.tar.gz
 /bind-9.11.4.tar.gz
 /bind-9.11.4-P1.tar.gz
 /bind-9.11.4-P2.tar.gz
+/bind-9.11.5.tar.gz
diff --git a/bind-9.10-dist-native-pkcs11.patch b/bind-9.10-dist-native-pkcs11.patch
index 6f66dc1..aa95e33 100644
--- a/bind-9.10-dist-native-pkcs11.patch
+++ b/bind-9.10-dist-native-pkcs11.patch
@@ -14,7 +14,7 @@ index f0c504a..ce7a2da 100644
  
  @BIND9_MAKE_RULES@
 diff --git a/bin/dnssec-pkcs11/Makefile.in b/bin/dnssec-pkcs11/Makefile.in
-index 1d0c4ce..7b7f89b 100644
+index ce0a177..f8370cf 100644
 --- a/bin/dnssec-pkcs11/Makefile.in
 +++ b/bin/dnssec-pkcs11/Makefile.in
 @@ -17,18 +17,18 @@ VERSION=@BIND9_VERSION@
@@ -121,15 +121,15 @@ index 1d0c4ce..7b7f89b 100644
  
 -install:: ${TARGETS} installdirs install-man8
 +install:: ${TARGETS} installdirs
- 	for t in ${TARGETS}; do ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} $$t ${DESTDIR}${sbindir}; done
+ 	for t in ${TARGETS}; do ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} $$t ${DESTDIR}${sbindir} || exit 1; done
  
  uninstall::
--	for m in ${MANPAGES}; do rm -f ${DESTDIR}${mandir}/man8/$$m ; done
- 	for t in ${TARGETS}; do ${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/$$t ; done
+-	for m in ${MANPAGES}; do rm -f ${DESTDIR}${mandir}/man8/$$m || exit 1; done
+ 	for t in ${TARGETS}; do ${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/$$t || exit 1; done
  
  clean distclean::
 diff --git a/bin/dnssec/Makefile.in b/bin/dnssec/Makefile.in
-index 1d0c4ce..11538cf 100644
+index ce0a177..7cede84 100644
 --- a/bin/dnssec/Makefile.in
 +++ b/bin/dnssec/Makefile.in
 @@ -19,7 +19,7 @@ VERSION=@BIND9_VERSION@
@@ -291,10 +291,10 @@ index a058c91..d4b689a 100644
  DEPLIBS =	${ISCDEPLIBS}
  
 diff --git a/configure.in b/configure.in
-index 849fa94..69e6373 100644
+index 898b4ac..1edafd1 100644
 --- a/configure.in
 +++ b/configure.in
-@@ -1164,12 +1164,14 @@ AC_SUBST(USE_GSSAPI)
+@@ -1109,12 +1109,14 @@ AC_SUBST(USE_GSSAPI)
  AC_SUBST(DST_GSSAPI_INC)
  AC_SUBST(DNS_GSSAPI_LIBS)
  DNS_CRYPTO_LIBS="$DNS_GSSAPI_LIBS $DNS_CRYPTO_LIBS"
@@ -309,7 +309,7 @@ index 849fa94..69e6373 100644
  
  #
  # was --with-randomdev specified?
-@@ -1554,11 +1556,11 @@ fi
+@@ -1499,11 +1501,11 @@ fi
  AC_MSG_CHECKING(for OpenSSL library)
  OPENSSL_WARNING=
  openssldirs="/usr /usr/local /usr/local/ssl /usr/pkg /usr/sfw"
@@ -326,7 +326,7 @@ index 849fa94..69e6373 100644
  
  if test "auto" = "$use_openssl"
  then
-@@ -1571,6 +1573,7 @@ then
+@@ -1516,6 +1518,7 @@ then
  		fi
  	done
  fi
@@ -334,7 +334,7 @@ index 849fa94..69e6373 100644
  OPENSSL_ECDSA=""
  OPENSSL_GOST=""
  OPENSSL_ED25519=""
-@@ -1592,11 +1595,10 @@ case "$with_gost" in
+@@ -1537,11 +1540,10 @@ case "$with_gost" in
  		;;
  esac
  
@@ -349,7 +349,7 @@ index 849fa94..69e6373 100644
  		CRYPTOLIB="pkcs11"
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
-@@ -1606,7 +1608,9 @@ case "$use_openssl" in
+@@ -1551,7 +1553,9 @@ case "$use_openssl" in
  		OPENSSLGOSTLINKSRCS=""
  		OPENSSLLINKOBJS=""
  		OPENSSLLINKSRCS=""
@@ -360,7 +360,7 @@ index 849fa94..69e6373 100644
  	no)
  		AC_MSG_RESULT(no)
  		DST_OPENSSL_INC=""
-@@ -1638,7 +1642,7 @@ case "$use_openssl" in
+@@ -1583,7 +1587,7 @@ case "$use_openssl" in
  If you do not want OpenSSL, use --without-openssl])
  		;;
  	*)
@@ -369,7 +369,7 @@ index 849fa94..69e6373 100644
  		then
  			AC_MSG_RESULT()
  			AC_MSG_ERROR([OpenSSL and native PKCS11 cannot be used together.])
-@@ -2066,6 +2070,7 @@ AC_SUBST(OPENSSL_ED25519)
+@@ -2011,6 +2015,7 @@ AC_SUBST(OPENSSL_ED25519)
  AC_SUBST(OPENSSL_GOST)
  
  DNS_CRYPTO_LIBS="$DNS_CRYPTO_LIBS $DST_OPENSSL_LIBS"
@@ -377,7 +377,7 @@ index 849fa94..69e6373 100644
  
  ISC_PLATFORM_WANTAES="#undef ISC_PLATFORM_WANTAES"
  if test "yes" = "$with_aes"
-@@ -2384,6 +2389,7 @@ esac
+@@ -2329,6 +2334,7 @@ esac
  AC_SUBST(PKCS11LINKOBJS)
  AC_SUBST(PKCS11LINKSRCS)
  AC_SUBST(CRYPTO)
@@ -385,7 +385,7 @@ index 849fa94..69e6373 100644
  AC_SUBST(PKCS11_ECDSA)
  AC_SUBST(PKCS11_GOST)
  AC_SUBST(PKCS11_ED25519)
-@@ -5497,8 +5503,11 @@ AC_CONFIG_FILES([
+@@ -5401,8 +5407,11 @@ AC_CONFIG_FILES([
  	bin/delv/Makefile
  	bin/dig/Makefile
  	bin/dnssec/Makefile
@@ -397,7 +397,7 @@ index 849fa94..69e6373 100644
  	bin/nsupdate/Makefile
  	bin/pkcs11/Makefile
  	bin/python/Makefile
-@@ -5572,6 +5581,10 @@ AC_CONFIG_FILES([
+@@ -5476,6 +5485,10 @@ AC_CONFIG_FILES([
  	lib/dns/include/dns/Makefile
  	lib/dns/include/dst/Makefile
  	lib/dns/tests/Makefile
@@ -408,7 +408,7 @@ index 849fa94..69e6373 100644
  	lib/irs/Makefile
  	lib/irs/include/Makefile
  	lib/irs/include/irs/Makefile
-@@ -5596,6 +5609,24 @@ AC_CONFIG_FILES([
+@@ -5500,6 +5513,24 @@ AC_CONFIG_FILES([
  	lib/isc/unix/include/Makefile
  	lib/isc/unix/include/isc/Makefile
  	lib/isc/unix/include/pkcs11/Makefile
@@ -525,7 +525,7 @@ index 4a8549e..6a19906 100644
  	rm -f include/dns/rdatastruct.h
  	rm -f dnstap.pb-c.c dnstap.pb-c.h include/dns/dnstap.pb-c.h
 diff --git a/lib/isc-pkcs11/Makefile.in b/lib/isc-pkcs11/Makefile.in
-index ba53ef1..d1f1771 100644
+index 98acfff..2fd6981 100644
 --- a/lib/isc-pkcs11/Makefile.in
 +++ b/lib/isc-pkcs11/Makefile.in
 @@ -23,8 +23,8 @@ CINCLUDES =	-I${srcdir}/unix/include \
@@ -539,7 +539,7 @@ index ba53ef1..d1f1771 100644
  CWARNINGS =
  
  # Alphabetically
-@@ -107,40 +107,40 @@ version.@O@: version.c
+@@ -103,40 +103,40 @@ version.@O@: version.c
  		-DLIBAGE=${LIBAGE} \
  		-c ${srcdir}/version.c
  
diff --git a/bind-9.11-fips-code.patch b/bind-9.11-fips-code.patch
index 2dccdea..f4973a6 100644
--- a/bind-9.11-fips-code.patch
+++ b/bind-9.11-fips-code.patch
@@ -1,11 +1,13 @@
-From fb8665aebd79ea33cb255f578544e1738f5bbb58 Mon Sep 17 00:00:00 2001
+From 9fa0831af989818eb6f908815967590e56a19ab1 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 2 Aug 2018 23:34:45 +0200
-Subject: [PATCH 1/2] Squashed commit of the following:
+Subject: [PATCH] FIPS code changes
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 
+Squashed commit of the following:
+
 commit b49f70ce0575b6b52a71b90fe0376dbf16f92c6b
 Author: Petr Menšík <pemensik@redhat.com>
 Date:   Mon Jan 22 14:12:37 2018 +0100
@@ -95,7 +97,7 @@ Date:   Mon Jan 22 07:21:04 2018 +0100
     Add runtime detection whether MD5 is useable.
 ---
  bin/confgen/keygen.c              | 10 ++++-
- bin/confgen/rndc-confgen.c        | 36 +++++-------------
+ bin/confgen/rndc-confgen.c        | 32 ++++------------
  bin/dig/dig.c                     |  7 ++--
  bin/dig/dighost.c                 | 14 +++++--
  bin/dnssec/dnssec-keygen.c        | 14 +++++++
@@ -104,12 +106,12 @@ Date:   Mon Jan 22 07:21:04 2018 +0100
  bin/rndc/rndc.c                   |  3 +-
  bin/tests/optional/hash_test.c    | 78 ++++++++++++++++++++-------------------
  bin/tests/system/tkey/keycreate.c |  3 ++
- bin/tests/system/tkey/keydelete.c | 18 ++++++---
+ bin/tests/system/tkey/keydelete.c | 17 ++++++---
  lib/bind9/check.c                 | 10 +++++
  lib/dns/dst_api.c                 | 23 ++++++++----
  lib/dns/dst_internal.h            |  3 +-
  lib/dns/dst_parse.c               | 18 +++++++--
- lib/dns/hmac_link.c               | 20 +++-------
+ lib/dns/hmac_link.c               | 18 ++-------
  lib/dns/opensslrsa_link.c         |  6 +++
  lib/dns/pkcs11rsa_link.c          | 33 +++++++++++++++--
  lib/dns/rcode.c                   | 21 ++++++++++-
@@ -120,13 +122,13 @@ Date:   Mon Jan 22 07:21:04 2018 +0100
  lib/dns/tsig.c                    | 17 +++++----
  lib/isc/include/isc/md5.h         |  3 ++
  lib/isc/md5.c                     | 59 +++++++++++++++++++++++++++++
- lib/isc/pk11.c                    | 58 ++++++++++++++++++++---------
+ lib/isc/pk11.c                    | 44 +++++++++++++++-------
  lib/isc/tests/hash_test.c         |  9 +++--
  lib/isccc/cc.c                    | 42 +++++++++++++--------
- 29 files changed, 424 insertions(+), 177 deletions(-)
+ 29 files changed, 409 insertions(+), 171 deletions(-)
 
 diff --git a/bin/confgen/keygen.c b/bin/confgen/keygen.c
-index 453c641dba..11cc54dd46 100644
+index 8931ad5..5015abb 100644
 --- a/bin/confgen/keygen.c
 +++ b/bin/confgen/keygen.c
 @@ -22,6 +22,7 @@
@@ -150,7 +152,7 @@ index 453c641dba..11cc54dd46 100644
  	switch (alg) {
  #ifndef PK11_MD5_DISABLE
  	    case DST_ALG_HMACMD5:
-+		if (isc_md5_available() == ISC_FALSE) {
++		if (!isc_md5_available()) {
 +			fatal("unsupported algorithm %d\n", alg);
 +		} else if (keysize < 1 || keysize > 512) {
 +			fatal("keysize %d out of range (must be 1-512)\n",
@@ -161,10 +163,10 @@ index 453c641dba..11cc54dd46 100644
  	    case DST_ALG_HMACSHA1:
  	    case DST_ALG_HMACSHA224:
 diff --git a/bin/confgen/rndc-confgen.c b/bin/confgen/rndc-confgen.c
-index 2925baf32f..d7d8418073 100644
+index 5ca3d76..6b7790a 100644
 --- a/bin/confgen/rndc-confgen.c
 +++ b/bin/confgen/rndc-confgen.c
-@@ -35,6 +35,7 @@
+@@ -36,6 +36,7 @@
  #include <isc/file.h>
  #include <isc/keyboard.h>
  #include <isc/mem.h>
@@ -172,16 +174,16 @@ index 2925baf32f..d7d8418073 100644
  #include <isc/net.h>
  #include <isc/print.h>
  #include <isc/result.h>
-@@ -62,7 +63,7 @@ const char *progname;
+@@ -63,7 +64,7 @@ const char *progname;
  
- isc_boolean_t verbose = ISC_FALSE;
+ bool verbose = false;
  
 -const char *keyfile, *keydef;
 +const char *keyfile, *keydef, *algdef;
  
  ISC_PLATFORM_NORETURN_PRE static void
  usage(int status) ISC_PLATFORM_NORETURN_POST;
-@@ -70,13 +71,12 @@ usage(int status) ISC_PLATFORM_NORETURN_POST;
+@@ -71,13 +72,12 @@ usage(int status) ISC_PLATFORM_NORETURN_POST;
  static void
  usage(int status) {
  
@@ -196,7 +198,7 @@ index 2925baf32f..d7d8418073 100644
    -b bits:	 from 1 through 512, default 256; total length of the secret\n\
    -c keyfile:	 specify an alternate key file (requires -a)\n\
    -k keyname:	 the name as it will be used  in named.conf and rndc.conf\n\
-@@ -85,24 +85,7 @@ Usage:\n\
+@@ -86,24 +86,7 @@ Usage:\n\
    -s addr:	 the address to which rndc should connect\n\
    -t chrootdir:	 write a keyfile in chrootdir as well (requires -a)\n\
    -u user:	 set the keyfile owner to \"user\" (requires -a)\n",
@@ -222,31 +224,27 @@ index 2925baf32f..d7d8418073 100644
  
  	exit (status);
  }
-@@ -138,13 +121,14 @@ main(int argc, char **argv) {
+@@ -139,11 +122,12 @@ main(int argc, char **argv) {
  	progname = program;
  
  	keyname = DEFAULT_KEYNAME;
 -#ifndef PK11_MD5_DISABLE
 -	alg = DST_ALG_HMACMD5;
 -#else
--	alg = DST_ALG_HMACSHA256;
--#endif
- 	serveraddr = DEFAULT_SERVER;
- 	port = DEFAULT_PORT;
-+	alg = DST_ALG_HMACSHA256;
+ 	alg = DST_ALG_HMACSHA256;
 +#ifndef PK11_MD5_DISABLE
 +	if (isc_md5_available())
 +		alg = DST_ALG_HMACMD5;
-+#endif
+ #endif
 +	algdef = alg_totext(alg);
- 
- 	isc_commandline_errprint = ISC_FALSE;
+ 	serveraddr = DEFAULT_SERVER;
+ 	port = DEFAULT_PORT;
  
 diff --git a/bin/dig/dig.c b/bin/dig/dig.c
-index d4808ada67..9dff7c8ecd 100644
+index 39f74be..597e830 100644
 --- a/bin/dig/dig.c
 +++ b/bin/dig/dig.c
-@@ -17,6 +17,7 @@
+@@ -20,6 +20,7 @@
  #include <ctype.h>
  
  #include <isc/app.h>
@@ -254,7 +252,7 @@ index d4808ada67..9dff7c8ecd 100644
  #include <isc/netaddr.h>
  #include <isc/parseint.h>
  #include <isc/platform.h>
-@@ -1757,10 +1758,10 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
+@@ -1760,10 +1761,10 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
  			ptr = ptr2;
  			ptr2 = ptr3;
  		} else  {
@@ -269,10 +267,10 @@ index d4808ada67..9dff7c8ecd 100644
  			digestbits = 0;
  		}
 diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
-index ecefc98453..94c428ed30 100644
+index 1fa711a..341ed80 100644
 --- a/bin/dig/dighost.c
 +++ b/bin/dig/dighost.c
-@@ -77,6 +77,7 @@
+@@ -80,6 +80,7 @@
  #include <isc/hex.h>
  #include <isc/lang.h>
  #include <isc/log.h>
@@ -280,7 +278,7 @@ index ecefc98453..94c428ed30 100644
  #include <isc/netaddr.h>
  #include <isc/netdb.h>
  #include <isc/parseint.h>
-@@ -1243,9 +1244,10 @@ parse_hmac(const char *hmac) {
+@@ -1246,9 +1247,10 @@ parse_hmac(const char *hmac) {
  	digestbits = 0;
  
  #ifndef PK11_MD5_DISABLE
@@ -293,7 +291,7 @@ index ecefc98453..94c428ed30 100644
  		hmacname = DNS_TSIG_HMACMD5_NAME;
  		digestbits = parse_bits(&buf[9], "digest-bits [0..128]", 128);
  	} else
-@@ -1365,7 +1367,13 @@ setup_file_key(void) {
+@@ -1368,7 +1370,13 @@ setup_file_key(void) {
  	switch (dst_key_alg(dstkey)) {
  #ifndef PK11_MD5_DISABLE
  	case DST_ALG_HMACMD5:
@@ -309,10 +307,10 @@ index ecefc98453..94c428ed30 100644
  #endif
  	case DST_ALG_HMACSHA1:
 diff --git a/bin/dnssec/dnssec-keygen.c b/bin/dnssec/dnssec-keygen.c
-index 6fc3ab0979..fc04356ed4 100644
+index 1476d0d..f5c9316 100644
 --- a/bin/dnssec/dnssec-keygen.c
 +++ b/bin/dnssec/dnssec-keygen.c
-@@ -34,6 +34,7 @@
+@@ -36,6 +36,7 @@
  #include <isc/buffer.h>
  #include <isc/commandline.h>
  #include <isc/entropy.h>
@@ -320,7 +318,7 @@ index 6fc3ab0979..fc04356ed4 100644
  #include <isc/mem.h>
  #include <isc/print.h>
  #include <isc/region.h>
-@@ -560,6 +561,19 @@ main(int argc, char **argv) {
+@@ -562,6 +563,19 @@ main(int argc, char **argv) {
  					"\"-a RSAMD5\"\n");
  			INSIST(freeit == NULL);
  			return (1);
@@ -333,7 +331,7 @@ index 6fc3ab0979..fc04356ed4 100644
 +				return (1);
 +			}
 +		} else if (strcasecmp(algname, "RSAMD5") == 0 &&
-+			   isc_md5_available() == ISC_FALSE) {
++			   !isc_md5_available()) {
 +			fprintf(stderr, "The use of RSAMD5 was disabled\n");
 +			INSIST(freeit == NULL);
 +			return (1);
@@ -341,10 +339,10 @@ index 6fc3ab0979..fc04356ed4 100644
  			alg = DST_ALG_HMACMD5;
  #else
 diff --git a/bin/named/config.c b/bin/named/config.c
-index 54bc37fff7..c50f759ddd 100644
+index 2732a8f..2c4c93c 100644
 --- a/bin/named/config.c
 +++ b/bin/named/config.c
-@@ -17,6 +17,7 @@
+@@ -18,6 +18,7 @@
  
  #include <isc/buffer.h>
  #include <isc/log.h>
@@ -352,14 +350,14 @@ index 54bc37fff7..c50f759ddd 100644
  #include <isc/mem.h>
  #include <isc/parseint.h>
  #include <isc/region.h>
-@@ -966,6 +967,21 @@ ns_config_getkeyalgorithm(const char *str, dns_name_t **name,
+@@ -967,6 +968,21 @@ ns_config_getkeyalgorithm(const char *str, dns_name_t **name,
  	return (ns_config_getkeyalgorithm2(str, name, NULL, digestbits));
  }
  
 +static inline int
 +algorithms_start() {
 +#ifndef PK11_MD5_DISABLE
-+	if (isc_md5_available() == ISC_FALSE) {
++	if (!isc_md5_available()) {
 +		int i = 0;
 +		while (algorithms[i].str != NULL &&
 +			algorithms[i].hmac == hmacmd5) {
@@ -373,9 +371,9 @@ index 54bc37fff7..c50f759ddd 100644
 +
  isc_result_t
  ns_config_getkeyalgorithm2(const char *str, dns_name_t **name,
- 			   unsigned int *typep, isc_uint16_t *digestbits)
-@@ -975,7 +991,7 @@ ns_config_getkeyalgorithm2(const char *str, dns_name_t **name,
- 	isc_uint16_t bits;
+ 			   unsigned int *typep, uint16_t *digestbits)
+@@ -976,7 +992,7 @@ ns_config_getkeyalgorithm2(const char *str, dns_name_t **name,
+ 	uint16_t bits;
  	isc_result_t result;
  
 -	for (i = 0; algorithms[i].str != NULL; i++) {
@@ -383,7 +381,7 @@ index 54bc37fff7..c50f759ddd 100644
  		len = strlen(algorithms[i].str);
  		if (strncasecmp(algorithms[i].str, str, len) == 0 &&
  		    (str[len] == '\0' ||
-@@ -998,7 +1014,12 @@ ns_config_getkeyalgorithm2(const char *str, dns_name_t **name,
+@@ -999,7 +1015,12 @@ ns_config_getkeyalgorithm2(const char *str, dns_name_t **name,
  	if (name != NULL) {
  		switch (algorithms[i].hmac) {
  #ifndef PK11_MD5_DISABLE
@@ -398,10 +396,10 @@ index 54bc37fff7..c50f759ddd 100644
  		case hmacsha1: *name = dns_tsig_hmacsha1_name; break;
  		case hmacsha224: *name = dns_tsig_hmacsha224_name; break;
 diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
-index 6967b49754..bb5d50038f 100644
+index 8d1da3b..5eefc57 100644
 --- a/bin/nsupdate/nsupdate.c
 +++ b/bin/nsupdate/nsupdate.c
-@@ -29,6 +29,7 @@
+@@ -31,6 +31,7 @@
  #include <isc/hash.h>
  #include <isc/lex.h>
  #include <isc/log.h>
@@ -409,7 +407,7 @@ index 6967b49754..bb5d50038f 100644
  #include <isc/mem.h>
  #include <isc/parseint.h>
  #include <isc/print.h>
-@@ -474,9 +475,10 @@ parse_hmac(dns_name_t **hmac, const char *hmacstr, size_t len,
+@@ -476,9 +477,10 @@ parse_hmac(dns_name_t **hmac, const char *hmacstr, size_t len,
  	strlcpy(buf, hmacstr, ISC_MIN(len + 1, sizeof(buf)));
  
  #ifndef PK11_MD5_DISABLE
@@ -422,7 +420,7 @@ index 6967b49754..bb5d50038f 100644
  		*hmac = DNS_TSIG_HMACMD5_NAME;
  		result = isc_parse_uint16(&digestbits, &buf[9], 10);
  		if (result != ISC_R_SUCCESS || digestbits > 128) {
-@@ -589,10 +591,10 @@ setup_keystr(void) {
+@@ -591,10 +593,10 @@ setup_keystr(void) {
  			exit(1);
  		}
  	} else {
@@ -436,7 +434,7 @@ index 6967b49754..bb5d50038f 100644
  #endif
  		name = keystr;
  		n = s;
-@@ -729,7 +731,8 @@ setup_keyfile(isc_mem_t *mctx, isc_log_t *lctx) {
+@@ -731,7 +733,8 @@ setup_keyfile(isc_mem_t *mctx, isc_log_t *lctx) {
  	switch (dst_key_alg(dstkey)) {
  #ifndef PK11_MD5_DISABLE
  	case DST_ALG_HMACMD5:
@@ -446,7 +444,7 @@ index 6967b49754..bb5d50038f 100644
  		break;
  #endif
  	case DST_ALG_HMACSHA1:
-@@ -1604,12 +1607,13 @@ evaluate_key(char *cmdline) {
+@@ -1606,12 +1609,13 @@ evaluate_key(char *cmdline) {
  			return (STATUS_SYNTAX);
  		}
  		namestr = n + 1;
@@ -465,10 +463,10 @@ index 6967b49754..bb5d50038f 100644
  	isc_buffer_init(&b, namestr, strlen(namestr));
  	isc_buffer_add(&b, strlen(namestr));
 diff --git a/bin/rndc/rndc.c b/bin/rndc/rndc.c
-index 5c29caf86b..617b06b4a1 100644
+index 9eb0ce0..8083654 100644
 --- a/bin/rndc/rndc.c
 +++ b/bin/rndc/rndc.c
-@@ -21,6 +21,7 @@
+@@ -23,6 +23,7 @@
  #include <isc/file.h>
  #include <isc/log.h>
  #include <isc/net.h>
@@ -476,7 +474,7 @@ index 5c29caf86b..617b06b4a1 100644
  #include <isc/mem.h>
  #include <isc/print.h>
  #include <isc/random.h>
-@@ -634,7 +635,7 @@ parse_config(isc_mem_t *mctx, isc_log_t *log, const char *keyname,
+@@ -636,7 +637,7 @@ parse_config(isc_mem_t *mctx, isc_log_t *log, const char *keyname,
  	algorithmstr = cfg_obj_asstring(algorithmobj);
  
  #ifndef PK11_MD5_DISABLE
@@ -486,7 +484,7 @@ index 5c29caf86b..617b06b4a1 100644
  	else
  #endif
 diff --git a/bin/tests/optional/hash_test.c b/bin/tests/optional/hash_test.c
-index bf2891ad4c..b5f0a1c5f5 100644
+index bf2891a..b5f0a1c 100644
 --- a/bin/tests/optional/hash_test.c
 +++ b/bin/tests/optional/hash_test.c
 @@ -90,43 +90,47 @@ main(int argc, char **argv) {
@@ -575,7 +573,7 @@ index bf2891ad4c..b5f0a1c5f5 100644
  
  	/*
 diff --git a/bin/tests/system/tkey/keycreate.c b/bin/tests/system/tkey/keycreate.c
-index 2a0ee94888..489f4390dc 100644
+index 5a00f86..653c951 100644
 --- a/bin/tests/system/tkey/keycreate.c
 +++ b/bin/tests/system/tkey/keycreate.c
 @@ -20,6 +20,7 @@
@@ -590,30 +588,29 @@ index 2a0ee94888..489f4390dc 100644
  	static char keystr[] = "0123456789ab";
  
  	isc_event_free(&event);
-+	if (isc_md5_available() == ISC_FALSE)
++	if (!isc_md5_available())
 +		CHECK("MD5 was disabled", ISC_R_NOTIMPLEMENTED);
  
  	result = ISC_R_FAILURE;
  	if (inet_pton(AF_INET, "10.53.0.1", &inaddr) != 1)
 diff --git a/bin/tests/system/tkey/keydelete.c b/bin/tests/system/tkey/keydelete.c
-index 7057c318e4..36ee6c7d21 100644
+index bde66a4..70a40c3 100644
 --- a/bin/tests/system/tkey/keydelete.c
 +++ b/bin/tests/system/tkey/keydelete.c
-@@ -225,12 +225,18 @@ main(int argc, char **argv) {
+@@ -225,12 +225,17 @@ main(int argc, char **argv) {
  	result = dst_key_fromnamedfile(keyname, NULL, type, mctx, &dstkey);
  	CHECK("dst_key_fromnamedfile", result);
  #ifndef PK11_MD5_DISABLE
 -	result = dns_tsigkey_createfromkey(dst_key_name(dstkey),
 -					   DNS_TSIG_HMACMD5_NAME,
--					   dstkey, ISC_TRUE, NULL, 0, 0,
+-					   dstkey, true, NULL, 0, 0,
 -					   mctx, ring, &tsigkey);
 -	dst_key_free(&dstkey);
 -	CHECK("dns_tsigkey_createfromkey", result);
 +	if (isc_md5_available()) {
 +		result = dns_tsigkey_createfromkey(dst_key_name(dstkey),
 +						   DNS_TSIG_HMACMD5_NAME,
-+						   dstkey, ISC_TRUE,
-+						   NULL, 0, 0,
++						   dstkey, true, NULL, 0, 0,
 +						   mctx, ring, &tsigkey);
 +		dst_key_free(&dstkey);
 +		CHECK("dns_tsigkey_createfromkey", result);
@@ -625,10 +622,10 @@ index 7057c318e4..36ee6c7d21 100644
  	dst_key_free(&dstkey);
  	CHECK("MD5 was disabled", ISC_R_NOTIMPLEMENTED);
 diff --git a/lib/bind9/check.c b/lib/bind9/check.c
-index 3da83a7ae2..1a3d534799 100644
+index d32a5a1..c749c27 100644
 --- a/lib/bind9/check.c
 +++ b/lib/bind9/check.c
-@@ -21,6 +21,7 @@
+@@ -23,6 +23,7 @@
  #include <isc/file.h>
  #include <isc/hex.h>
  #include <isc/log.h>
@@ -636,13 +633,13 @@ index 3da83a7ae2..1a3d534799 100644
  #include <isc/mem.h>
  #include <isc/netaddr.h>
  #include <isc/parseint.h>
-@@ -2572,6 +2573,15 @@ bind9_check_key(const cfg_obj_t *key, isc_log_t *logctx) {
+@@ -2592,6 +2593,15 @@ bind9_check_key(const cfg_obj_t *key, isc_log_t *logctx) {
  	}
  
  	algorithm = cfg_obj_asstring(algobj);
 +#ifndef PK11_MD5_DISABLE
 +	/* Skip hmac-md5* algorithms */
-+	if (isc_md5_available() == ISC_FALSE &&
++	if (!isc_md5_available() &&
 +	    strncasecmp(algorithm, "hmac-md5", 8) == 0) {
 +		cfg_obj_log(algobj, logctx, ISC_LOG_ERROR,
 +			    "disabled algorithm '%s'", algorithm);
@@ -653,10 +650,10 @@ index 3da83a7ae2..1a3d534799 100644
  		len = strlen(algorithms[i].name);
  		if (strncasecmp(algorithms[i].name, algorithm, len) == 0 &&
 diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c
-index 4f3d6ac55c..dbece0ac56 100644
+index 97fee68..5703f9c 100644
 --- a/lib/dns/dst_api.c
 +++ b/lib/dns/dst_api.c
-@@ -190,6 +190,12 @@ dst_lib_init2(isc_mem_t *mctx, isc_entropy_t *ectx,
+@@ -192,6 +192,12 @@ dst_lib_init2(isc_mem_t *mctx, isc_entropy_t *ectx,
  	dst_result_register();
  
  	memset(dst_t_func, 0, sizeof(dst_t_func));
@@ -669,7 +666,7 @@ index 4f3d6ac55c..dbece0ac56 100644
  #ifndef PK11_MD5_DISABLE
  	RETERR(dst__hmacmd5_init(&dst_t_func[DST_ALG_HMACMD5]));
  #endif
-@@ -199,7 +205,6 @@ dst_lib_init2(isc_mem_t *mctx, isc_entropy_t *ectx,
+@@ -201,7 +207,6 @@ dst_lib_init2(isc_mem_t *mctx, isc_entropy_t *ectx,
  	RETERR(dst__hmacsha384_init(&dst_t_func[DST_ALG_HMACSHA384]));
  	RETERR(dst__hmacsha512_init(&dst_t_func[DST_ALG_HMACSHA512]));
  #ifdef OPENSSL
@@ -677,7 +674,7 @@ index 4f3d6ac55c..dbece0ac56 100644
  #ifndef PK11_MD5_DISABLE
  	RETERR(dst__opensslrsa_init(&dst_t_func[DST_ALG_RSAMD5],
  				    DST_ALG_RSAMD5));
-@@ -233,14 +238,18 @@ dst_lib_init2(isc_mem_t *mctx, isc_entropy_t *ectx,
+@@ -235,14 +240,18 @@ dst_lib_init2(isc_mem_t *mctx, isc_entropy_t *ectx,
  	RETERR(dst__openssleddsa_init(&dst_t_func[DST_ALG_ED448]));
  #endif
  #elif PKCS11CRYPTO
@@ -703,10 +700,10 @@ index 4f3d6ac55c..dbece0ac56 100644
  	RETERR(dst__pkcs11dsa_init(&dst_t_func[DST_ALG_DSA]));
  	RETERR(dst__pkcs11dsa_init(&dst_t_func[DST_ALG_NSEC3DSA]));
 diff --git a/lib/dns/dst_internal.h b/lib/dns/dst_internal.h
-index 640519a5ba..deb7ed4e13 100644
+index 6ee796c..3e55d44 100644
 --- a/lib/dns/dst_internal.h
 +++ b/lib/dns/dst_internal.h
-@@ -245,7 +245,8 @@ isc_result_t dst__hmacsha384_init(struct dst_func **funcp);
+@@ -250,7 +250,8 @@ isc_result_t dst__hmacsha384_init(struct dst_func **funcp);
  isc_result_t dst__hmacsha512_init(struct dst_func **funcp);
  isc_result_t dst__opensslrsa_init(struct dst_func **funcp,
  				  unsigned char algorithm);
@@ -717,10 +714,10 @@ index 640519a5ba..deb7ed4e13 100644
  isc_result_t dst__openssldsa_init(struct dst_func **funcp);
  isc_result_t dst__pkcs11dsa_init(struct dst_func **funcp);
 diff --git a/lib/dns/dst_parse.c b/lib/dns/dst_parse.c
-index b0e5c895c6..03f2b8ace8 100644
+index f31c33d..87023a6 100644
 --- a/lib/dns/dst_parse.c
 +++ b/lib/dns/dst_parse.c
-@@ -30,6 +30,7 @@
+@@ -33,6 +33,7 @@
  #include <isc/file.h>
  #include <isc/fsaccess.h>
  #include <isc/lex.h>
@@ -728,7 +725,7 @@ index b0e5c895c6..03f2b8ace8 100644
  #include <isc/mem.h>
  #include <isc/print.h>
  #include <isc/stdtime.h>
-@@ -393,6 +394,10 @@ check_data(const dst_private_t *priv, const unsigned int alg,
+@@ -396,6 +397,10 @@ check_data(const dst_private_t *priv, const unsigned int alg,
  	switch (alg) {
  #ifndef PK11_MD5_DISABLE
  	case DST_ALG_RSAMD5:
@@ -739,7 +736,7 @@ index b0e5c895c6..03f2b8ace8 100644
  #endif
  	case DST_ALG_RSASHA1:
  	case DST_ALG_NSEC3RSASHA1:
-@@ -418,7 +423,10 @@ check_data(const dst_private_t *priv, const unsigned int alg,
+@@ -421,7 +426,10 @@ check_data(const dst_private_t *priv, const unsigned int alg,
  		return (check_eddsa(priv, external));
  #ifndef PK11_MD5_DISABLE
  	case DST_ALG_HMACMD5:
@@ -751,36 +748,35 @@ index b0e5c895c6..03f2b8ace8 100644
  #endif
  	case DST_ALG_HMACSHA1:
  		return (check_hmac_sha(priv, HMACSHA1_NTAGS, alg));
-@@ -637,11 +645,13 @@ dst__privstruct_parse(dst_key_t *key, unsigned int alg, isc_lex_t *lex,
+@@ -640,11 +648,13 @@ dst__privstruct_parse(dst_key_t *key, unsigned int alg, isc_lex_t *lex,
  	}
  
  #ifdef PK11_MD5_DISABLE
 -	check = check_data(priv, alg == DST_ALG_RSA ? DST_ALG_RSASHA1 : alg,
--			   ISC_TRUE, external);
+-			   true, external);
 +	if (alg == DST_ALG_RSA)
 +		alg = DST_ALG_RSASHA1;
  #else
--	check = check_data(priv, alg, ISC_TRUE, external);
-+	if (isc_md5_available() == ISC_FALSE && alg == DST_ALG_RSA)
+-	check = check_data(priv, alg, true, external);
++	if (!isc_md5_available() && alg == DST_ALG_RSA)
 +		alg = DST_ALG_RSASHA1;
  #endif
-+	check = check_data(priv, alg, ISC_TRUE, external);
++	check = check_data(priv, alg, true, external);
  	if (check < 0) {
  		ret = DST_R_INVALIDPRIVATEKEY;
  		goto fail;
 diff --git a/lib/dns/hmac_link.c b/lib/dns/hmac_link.c
-index 59aa4705e5..21bfa44450 100644
+index 94e73b1..d904075 100644
 --- a/lib/dns/hmac_link.c
 +++ b/lib/dns/hmac_link.c
-@@ -338,25 +338,17 @@ static dst_func_t hmacmd5_functions = {
+@@ -340,20 +340,10 @@ static dst_func_t hmacmd5_functions = {
  
  isc_result_t
  dst__hmacmd5_init(dst_func_t **funcp) {
 -#ifdef HAVE_FIPS_MODE
- 	/*
+-	/*
 -	 * Problems from OpenSSL are likely from FIPS mode
-+	 * Prevent use of incorrect crypto
- 	 */
+-	 */
 -	int fips_mode = FIPS_mode();
 -
 -	if (fips_mode != 0) {
@@ -789,26 +785,20 @@ index 59aa4705e5..21bfa44450 100644
 -				 "if the value is 0.\n"
 -				 "Please disable either FIPS mode or MD5.",
 -				 fips_mode);
+-	}
+-#endif
 +
-+#ifndef PK11_MD5_DISABLE
-+	if (isc_md5_available() == ISC_FALSE) {
-+		/* Intentionally skip initialization */
++	/* Intentionally skip initialization */
++	if (!isc_md5_available())
 +		return (ISC_R_SUCCESS);
- 	}
- #endif
- 
--	/*
--	 * Prevent use of incorrect crypto
--	 */
--
- 	RUNTIME_CHECK(isc_md5_check(ISC_FALSE));
- 	RUNTIME_CHECK(isc_hmacmd5_check(0));
  
+ 	/*
+ 	 * Prevent use of incorrect crypto
 diff --git a/lib/dns/opensslrsa_link.c b/lib/dns/opensslrsa_link.c
-index f4847bbe74..126cebca19 100644
+index c03fd72..49b66fc 100644
 --- a/lib/dns/opensslrsa_link.c
 +++ b/lib/dns/opensslrsa_link.c
-@@ -1801,6 +1801,12 @@ dst__opensslrsa_init(dst_func_t **funcp, unsigned char algorithm) {
+@@ -1802,6 +1802,12 @@ dst__opensslrsa_init(dst_func_t **funcp, unsigned char algorithm) {
  
  	if (*funcp == NULL) {
  		switch (algorithm) {
@@ -822,10 +812,10 @@ index f4847bbe74..126cebca19 100644
  #if defined(HAVE_EVP_SHA256) || !USE_EVP
  			*funcp = &opensslrsa_functions;
 diff --git a/lib/dns/pkcs11rsa_link.c b/lib/dns/pkcs11rsa_link.c
-index 56955203e9..af6008d4dd 100644
+index eb782c8..46fd844 100644
 --- a/lib/dns/pkcs11rsa_link.c
 +++ b/lib/dns/pkcs11rsa_link.c
-@@ -94,10 +94,15 @@ pkcs11rsa_createctx_sign(dst_key_t *key, dst_context_t *dctx) {
+@@ -96,10 +96,15 @@ pkcs11rsa_createctx_sign(dst_key_t *key, dst_context_t *dctx) {
  #endif
  
  	/*
@@ -835,44 +825,44 @@ index 56955203e9..af6008d4dd 100644
  	switch (dctx->key->key_alg) {
  	case DST_ALG_RSAMD5:
 +#ifndef PK11_MD5_DISABLE
-+		if (isc_md5_available() == ISC_FALSE)
++		if (!isc_md5_available())
 +			return (ISC_R_FAILURE);
 +#endif
 +		/* FALLTHROUGH */
  	case DST_ALG_RSASHA1:
  	case DST_ALG_NSEC3RSASHA1:
  		/* From RFC 3110 */
-@@ -634,6 +639,9 @@ pkcs11rsa_createctx(dst_key_t *key, dst_context_t *dctx) {
+@@ -636,6 +641,9 @@ pkcs11rsa_createctx(dst_key_t *key, dst_context_t *dctx) {
  	switch (key->key_alg) {
  #ifndef PK11_MD5_DISABLE
  	case DST_ALG_RSAMD5:
-+		if (isc_md5_available() == ISC_FALSE)
++		if (!isc_md5_available())
 +			return (ISC_R_FAILURE);
 +	
  		mech.mechanism = CKM_MD5;
  		break;
  #endif
-@@ -790,6 +798,9 @@ pkcs11rsa_sign(dst_context_t *dctx, isc_buffer_t *sig) {
+@@ -792,6 +800,9 @@ pkcs11rsa_sign(dst_context_t *dctx, isc_buffer_t *sig) {
  	switch (key->key_alg) {
  #ifndef PK11_MD5_DISABLE
  	case DST_ALG_RSAMD5:
-+		if (isc_md5_available() == ISC_FALSE)
++		if (!isc_md5_available())
 +			return (ISC_R_FAILURE);
 +
  		der = md5_der;
  		derlen = sizeof(md5_der);
  		hashlen = ISC_MD5_DIGESTLENGTH;
-@@ -1014,6 +1025,9 @@ pkcs11rsa_verify(dst_context_t *dctx, const isc_region_t *sig) {
+@@ -1016,6 +1027,9 @@ pkcs11rsa_verify(dst_context_t *dctx, const isc_region_t *sig) {
  	switch (key->key_alg) {
  #ifndef PK11_MD5_DISABLE
  	case DST_ALG_RSAMD5:
-+		if (isc_md5_available() == ISC_FALSE)
++		if (!isc_md5_available())
 +			return (ISC_R_FAILURE);
 +
  		der = md5_der;
  		derlen = sizeof(md5_der);
  		hashlen = ISC_MD5_DIGESTLENGTH;
-@@ -2217,11 +2231,22 @@ static dst_func_t pkcs11rsa_functions = {
+@@ -2219,11 +2233,22 @@ static dst_func_t pkcs11rsa_functions = {
  };
  
  isc_result_t
@@ -899,18 +889,18 @@ index 56955203e9..af6008d4dd 100644
  }
  
 diff --git a/lib/dns/rcode.c b/lib/dns/rcode.c
-index 937d8fc1ec..d1fa8d5870 100644
+index 6a5948e..010dd1b 100644
 --- a/lib/dns/rcode.c
 +++ b/lib/dns/rcode.c
-@@ -14,6 +14,7 @@
- #include <ctype.h>
+@@ -16,6 +16,7 @@
+ #include <stdbool.h>
  
  #include <isc/buffer.h>
 +#include <isc/md5.h>
  #include <isc/parseint.h>
  #include <isc/print.h>
  #include <isc/region.h>
-@@ -347,17 +348,33 @@ dns_cert_totext(dns_cert_t cert, isc_buffer_t *target) {
+@@ -349,17 +350,33 @@ dns_cert_totext(dns_cert_t cert, isc_buffer_t *target) {
  	return (dns_mnemonic_totext(cert, target, certs));
  }
  
@@ -919,7 +909,7 @@ index 937d8fc1ec..d1fa8d5870 100644
 +	struct tbl *algs = secalgs;
 +
 +#ifndef PK11_MD5_DISABLE
-+	if (isc_md5_available() == ISC_FALSE) {
++	if (!isc_md5_available()) {
 +		while (algs->name != NULL &&
 +		       algs->value == DNS_KEYALG_RSAMD5)
 +			++algs;
@@ -947,7 +937,7 @@ index 937d8fc1ec..d1fa8d5870 100644
  
  void
 diff --git a/lib/dns/tests/rsa_test.c b/lib/dns/tests/rsa_test.c
-index 224cf5b475..44040dd8b7 100644
+index fb207ef..3ef0a4e 100644
 --- a/lib/dns/tests/rsa_test.c
 +++ b/lib/dns/tests/rsa_test.c
 @@ -19,6 +19,7 @@
@@ -967,10 +957,10 @@ index 224cf5b475..44040dd8b7 100644
 +		key->key_alg = DST_ALG_RSAMD5;
  
 -	ret = dst_context_create3(key, mctx, DNS_LOGCATEGORY_DNSSEC,
--				  ISC_FALSE, &ctx);
+-				  false, &ctx);
 -	ATF_REQUIRE_EQ(ret, ISC_R_SUCCESS);
 +		ret = dst_context_create3(key, mctx, DNS_LOGCATEGORY_DNSSEC,
-+					  ISC_FALSE, &ctx);
++					  false, &ctx);
 +		ATF_REQUIRE_EQ(ret, ISC_R_SUCCESS);
  
 -	r.base = d;
@@ -998,7 +988,7 @@ index 224cf5b475..44040dd8b7 100644
  
  	/* RSASHA256 */
 diff --git a/lib/dns/tests/tsig_test.c b/lib/dns/tests/tsig_test.c
-index ee025c2387..c403d9954d 100644
+index 443fb36..f003ff3 100644
 --- a/lib/dns/tests/tsig_test.c
 +++ b/lib/dns/tests/tsig_test.c
 @@ -14,6 +14,7 @@
@@ -1010,24 +1000,24 @@ index ee025c2387..c403d9954d 100644
  #include <isc/print.h>
  
 diff --git a/lib/dns/tkey.c b/lib/dns/tkey.c
-index d9f68e50b1..a8edde47b5 100644
+index 5b4ffd9..cc3469d 100644
 --- a/lib/dns/tkey.c
 +++ b/lib/dns/tkey.c
-@@ -242,6 +242,9 @@ compute_secret(isc_buffer_t *shared, isc_region_t *queryrandomness,
+@@ -245,6 +245,9 @@ compute_secret(isc_buffer_t *shared, isc_region_t *queryrandomness,
  	unsigned char digests[32];
  	unsigned int i;
  
-+	if (isc_md5_available() == ISC_FALSE)
++	if (!isc_md5_available())
 +		return (ISC_R_NOTIMPLEMENTED);
 +
  	isc_buffer_usedregion(shared, &r);
  
  	/*
-@@ -318,6 +321,12 @@ process_dhtkey(dns_message_t *msg, dns_name_t *signer, dns_name_t *name,
+@@ -321,6 +324,12 @@ process_dhtkey(dns_message_t *msg, dns_name_t *signer, dns_name_t *name,
  	}
  
  #ifndef PK11_MD5_DISABLE
-+	if (isc_md5_available() == ISC_FALSE) {
++	if (!isc_md5_available()) {
 +		tkey_log("process_dhtkey: MD5 was disabled");
 +		tkeyout->error = dns_tsigerror_badalg;
 +		return (ISC_R_SUCCESS);
@@ -1037,7 +1027,7 @@ index d9f68e50b1..a8edde47b5 100644
  		tkey_log("process_dhtkey: algorithms other than "
  			 "hmac-md5 are not supported");
 diff --git a/lib/dns/tsec.c b/lib/dns/tsec.c
-index a367291f23..37baad7437 100644
+index c5eca0e..19b9002 100644
 --- a/lib/dns/tsec.c
 +++ b/lib/dns/tsec.c
 @@ -11,6 +11,7 @@
@@ -1063,10 +1053,10 @@ index a367291f23..37baad7437 100644
  #endif
  		case DST_ALG_HMACSHA1:
 diff --git a/lib/dns/tsig.c b/lib/dns/tsig.c
-index bdcc581bc3..70805bb709 100644
+index a94ec69..f74c831 100644
 --- a/lib/dns/tsig.c
 +++ b/lib/dns/tsig.c
-@@ -270,7 +270,8 @@ dns_tsigkey_createfromkey(dns_name_t *name, dns_name_t *algorithm,
+@@ -273,7 +273,8 @@ dns_tsigkey_createfromkey(dns_name_t *name, dns_name_t *algorithm,
  	(void)dns_name_downcase(&tkey->name, &tkey->name, NULL);
  
  #ifndef PK11_MD5_DISABLE
@@ -1076,7 +1066,7 @@ index bdcc581bc3..70805bb709 100644
  		tkey->algorithm = DNS_TSIG_HMACMD5_NAME;
  		if (dstkey != NULL && dst_key_alg(dstkey) != DST_ALG_HMACMD5) {
  			ret = DNS_R_BADALG;
-@@ -496,7 +497,8 @@ destroyring(dns_tsig_keyring_t *ring) {
+@@ -499,7 +500,8 @@ destroyring(dns_tsig_keyring_t *ring) {
  static unsigned int
  dst_alg_fromname(dns_name_t *algorithm) {
  #ifndef PK11_MD5_DISABLE
@@ -1086,7 +1076,7 @@ index bdcc581bc3..70805bb709 100644
  		return (DST_ALG_HMACMD5);
  	} else
  #endif
-@@ -680,7 +682,8 @@ dns_tsigkey_create(dns_name_t *name, dns_name_t *algorithm,
+@@ -683,7 +685,8 @@ dns_tsigkey_create(dns_name_t *name, dns_name_t *algorithm,
  		REQUIRE(secret != NULL);
  
  #ifndef PK11_MD5_DISABLE
@@ -1096,7 +1086,7 @@ index bdcc581bc3..70805bb709 100644
  		if (secret != NULL) {
  			isc_buffer_t b;
  
-@@ -1280,7 +1283,7 @@ dns_tsig_verify(isc_buffer_t *source, dns_message_t *msg,
+@@ -1283,7 +1286,7 @@ dns_tsig_verify(isc_buffer_t *source, dns_message_t *msg,
  		return (ret);
  	if (
  #ifndef PK11_MD5_DISABLE
@@ -1105,7 +1095,7 @@ index bdcc581bc3..70805bb709 100644
  #endif
  	    alg == DST_ALG_HMACSHA1 ||
  	    alg == DST_ALG_HMACSHA224 || alg == DST_ALG_HMACSHA256 ||
-@@ -1449,7 +1452,7 @@ dns_tsig_verify(isc_buffer_t *source, dns_message_t *msg,
+@@ -1452,7 +1455,7 @@ dns_tsig_verify(isc_buffer_t *source, dns_message_t *msg,
  
  	if (
  #ifndef PK11_MD5_DISABLE
@@ -1114,7 +1104,7 @@ index bdcc581bc3..70805bb709 100644
  #endif
  	    alg == DST_ALG_HMACSHA1 ||
  	    alg == DST_ALG_HMACSHA224 || alg == DST_ALG_HMACSHA256 ||
-@@ -1590,7 +1593,7 @@ tsig_verify_tcp(isc_buffer_t *source, dns_message_t *msg) {
+@@ -1593,7 +1596,7 @@ tsig_verify_tcp(isc_buffer_t *source, dns_message_t *msg) {
  			goto cleanup_querystruct;
  		if (
  #ifndef PK11_MD5_DISABLE
@@ -1123,7 +1113,7 @@ index bdcc581bc3..70805bb709 100644
  #endif
  			alg == DST_ALG_HMACSHA1 ||
  			alg == DST_ALG_HMACSHA224 ||
-@@ -1769,7 +1772,7 @@ tsig_verify_tcp(isc_buffer_t *source, dns_message_t *msg) {
+@@ -1772,7 +1775,7 @@ tsig_verify_tcp(isc_buffer_t *source, dns_message_t *msg) {
  			goto cleanup_context;
  		if (
  #ifndef PK11_MD5_DISABLE
@@ -1133,24 +1123,24 @@ index bdcc581bc3..70805bb709 100644
  			alg == DST_ALG_HMACSHA1 ||
  			alg == DST_ALG_HMACSHA224 ||
 diff --git a/lib/isc/include/isc/md5.h b/lib/isc/include/isc/md5.h
-index e5f46dd9c7..9d11f9f8b6 100644
+index 4d29398..e3f5cec 100644
 --- a/lib/isc/include/isc/md5.h
 +++ b/lib/isc/include/isc/md5.h
-@@ -89,6 +89,9 @@ isc_md5_final(isc_md5_t *ctx, unsigned char *digest);
- isc_boolean_t
- isc_md5_check(isc_boolean_t testing);
+@@ -91,6 +91,9 @@ isc_md5_final(isc_md5_t *ctx, unsigned char *digest);
+ bool
+ isc_md5_check(bool testing);
  
-+isc_boolean_t
++bool
 +isc_md5_available(void);
 +
  ISC_LANG_ENDDECLS
  
  #endif /* !PK11_MD5_DISABLE */
 diff --git a/lib/isc/md5.c b/lib/isc/md5.c
-index 740d863b1b..aefd16478f 100644
+index 25c71a2..934a70c 100644
 --- a/lib/isc/md5.c
 +++ b/lib/isc/md5.c
-@@ -35,6 +35,7 @@
+@@ -37,6 +37,7 @@
  
  #include <isc/assertions.h>
  #include <isc/md5.h>
@@ -1158,17 +1148,17 @@ index 740d863b1b..aefd16478f 100644
  #include <isc/platform.h>
  #include <isc/safe.h>
  #include <isc/string.h>
-@@ -53,6 +54,9 @@
+@@ -55,6 +56,9 @@
  #define EVP_MD_CTX_free(ptr) EVP_MD_CTX_cleanup(ptr)
  #endif
  
 +static isc_once_t available_once = ISC_ONCE_INIT;
-+static isc_boolean_t available = ISC_FALSE;
++static bool available = false;
 +
  void
  isc_md5_init(isc_md5_t *ctx) {
  	ctx->ctx = EVP_MD_CTX_new();
-@@ -84,8 +88,33 @@ isc_md5_final(isc_md5_t *ctx, unsigned char *digest) {
+@@ -86,8 +90,33 @@ isc_md5_final(isc_md5_t *ctx, unsigned char *digest) {
  	ctx->ctx = NULL;
  }
  
@@ -1180,14 +1170,14 @@ index 740d863b1b..aefd16478f 100644
 +
 +	ctx->ctx = EVP_MD_CTX_new();
 +	RUNTIME_CHECK(ctx->ctx != NULL);
-+	available = ISC_TF(EVP_DigestInit(ctx->ctx, EVP_md5()) == 1);
++	available = (EVP_DigestInit(ctx->ctx, EVP_md5()) == 1);
 +	if (available)
 +		(void)EVP_DigestFinal(ctx->ctx, digest, NULL);
 +	EVP_MD_CTX_free(ctx->ctx);
 +	ctx->ctx = NULL;
 +}
 +
-+isc_boolean_t
++bool
 +isc_md5_available() {
 +	RUNTIME_CHECK(isc_once_do(&available_once, do_detect_available)
 +		      == ISC_R_SUCCESS);
@@ -1197,12 +1187,12 @@ index 740d863b1b..aefd16478f 100644
  #elif PKCS11CRYPTO
  
 +static isc_once_t available_once = ISC_ONCE_INIT;
-+static isc_boolean_t available = ISC_FALSE;
++static bool available = false;
 +
  void
  isc_md5_init(isc_md5_t *ctx) {
  	CK_RV rv;
-@@ -128,6 +157,31 @@ isc_md5_final(isc_md5_t *ctx, unsigned char *digest) {
+@@ -130,6 +159,31 @@ isc_md5_final(isc_md5_t *ctx, unsigned char *digest) {
  	pk11_return_session(ctx);
  }
  
@@ -1213,18 +1203,18 @@ index 740d863b1b..aefd16478f 100644
 +	CK_RV rv;
 +	CK_MECHANISM mech = { CKM_MD5, NULL, 0 };
 +
-+	if (pk11_get_session(ctx, OP_DIGEST, ISC_TRUE, ISC_FALSE,
-+				       ISC_FALSE, NULL, 0) == ISC_R_SUCCESS)
++	if (pk11_get_session(ctx, OP_DIGEST, true, false,
++				       false, NULL, 0) == ISC_R_SUCCESS)
 +	{
 +		rv = pkcs_C_DigestInit(ctx->session, &mech);
 +		isc_md5_invalidate(ctx);
-+		available = (ISC_TF(rv == CKR_OK));
++		available = (rv == CKR_OK);
 +	} else {
-+		available = ISC_FALSE;
++		available = false;
 +	}
 +}
 +
-+isc_boolean_t
++bool
 +isc_md5_available() {
 +	RUNTIME_CHECK(isc_once_do(&available_once, do_detect_available)
 +		      == ISC_R_SUCCESS);
@@ -1234,74 +1224,49 @@ index 740d863b1b..aefd16478f 100644
  #else
  
  static void
-@@ -337,6 +391,11 @@ isc_md5_final(isc_md5_t *ctx, unsigned char *digest) {
+@@ -339,6 +393,11 @@ isc_md5_final(isc_md5_t *ctx, unsigned char *digest) {
  	memmove(digest, ctx->buf, 16);
  	isc_safe_memwipe(ctx, sizeof(*ctx));	/* In case it's sensitive */
  }
 +
-+isc_boolean_t
++bool
 +isc_md5_available() {
-+	return ISC_TRUE;
++	return true;
 +}
  #endif
  
  /*
 diff --git a/lib/isc/pk11.c b/lib/isc/pk11.c
-index fc75a46154..48e1031974 100644
+index c5d2310..a01e698 100644
 --- a/lib/isc/pk11.c
 +++ b/lib/isc/pk11.c
-@@ -191,13 +191,12 @@ pk11_initialize(isc_mem_t *mctx, const char *engine) {
- 	LOCK(&alloclock);
- 	if ((mctx != NULL) && (pk11_mctx == NULL) && (allocsize == 0))
- 		isc_mem_attach(mctx, &pk11_mctx);
-+	UNLOCK(&alloclock);
-+
-+	LOCK(&sessionlock);
+@@ -197,8 +197,6 @@ pk11_initialize(isc_mem_t *mctx, const char *engine) {
+ 	UNLOCK(&alloclock);
  	if (initialized) {
--		UNLOCK(&alloclock);
--		return (ISC_R_SUCCESS);
+ 		goto unlock;
 -	} else {
--		LOCK(&sessionlock);
--		initialized = ISC_TRUE;
--		UNLOCK(&alloclock);
-+		result = ISC_R_SUCCESS;
-+		goto unlock;
+-		initialized = true;
  	}
  
  	ISC_LIST_INIT(tokens);
-@@ -237,6 +236,7 @@ pk11_initialize(isc_mem_t *mctx, const char *engine) {
+@@ -236,6 +234,7 @@ pk11_initialize(isc_mem_t *mctx, const char *engine) {
+ 		result = PK11_R_NOAESSERVICE;
+ 		goto unlock;
  	}
++	initialized = true;
  #endif
  #endif /* PKCS11CRYPTO */
-+	initialized = ISC_TRUE;
- 	result = ISC_R_SUCCESS;
   unlock:
- 	UNLOCK(&sessionlock);
-@@ -273,9 +273,14 @@ pk11_finalize(void) {
- 		pk11_mem_put(token, sizeof(*token));
- 		token = next;
- 	}
-+	LOCK(&alloclock);
- 	if (pk11_mctx != NULL)
- 		isc_mem_detach(&pk11_mctx);
-+	UNLOCK(&alloclock);
-+
-+	LOCK(&sessionlock);
- 	initialized = ISC_FALSE;
-+	UNLOCK(&sessionlock);
- 	return (ret);
- }
- 
-@@ -589,6 +594,8 @@ scan_slots(void) {
+@@ -589,6 +588,8 @@ scan_slots(void) {
  	pk11_token_t *token;
  	unsigned int i;
- 	isc_boolean_t bad;
+ 	bool bad;
 +	unsigned int best_rsa_algorithms = 0;
 +	unsigned int best_digest_algorithms = 0;
  
  	slotCount = 0;
  	PK11_FATALCHECK(pkcs_C_GetSlotList, (CK_FALSE, NULL_PTR, &slotCount));
-@@ -601,6 +608,8 @@ scan_slots(void) {
+@@ -601,6 +602,8 @@ scan_slots(void) {
  	PK11_FATALCHECK(pkcs_C_GetSlotList, (CK_FALSE, slotList, &slotCount));
  
  	for (i = 0; i < slotCount; i++) {
@@ -1310,12 +1275,12 @@ index fc75a46154..48e1031974 100644
  		slot = slotList[i];
  		PK11_TRACE2("slot#%u=0x%lx\n", i, slot);
  
-@@ -640,11 +649,12 @@ scan_slots(void) {
+@@ -640,11 +643,12 @@ scan_slots(void) {
  		if ((rv != CKR_OK) ||
  		    ((mechInfo.flags & CKF_SIGN) == 0) ||
  		    ((mechInfo.flags & CKF_VERIFY) == 0)) {
 -#if !defined(PK11_MD5_DISABLE) && !defined(PK11_RSA_PKCS_REPLACE)
--			bad = ISC_TRUE;
+-			bad = true;
 -#endif
  			PK11_TRACEM(CKM_MD5_RSA_PKCS);
  		}
@@ -1326,28 +1291,28 @@ index fc75a46154..48e1031974 100644
  		rv = pkcs_C_GetMechanismInfo(slot, CKM_SHA1_RSA_PKCS,
  					     &mechInfo);
  		if ((rv != CKR_OK) ||
-@@ -687,8 +697,14 @@ scan_slots(void) {
+@@ -687,8 +691,14 @@ scan_slots(void) {
  		if (bad)
  			goto try_dsa;
  		token->operations |= 1 << OP_RSA;
 -		if (best_rsa_token == NULL)
 +		if (best_rsa_token == NULL) {
-+			best_rsa_token = token;
+ 			best_rsa_token = token;
 +			best_rsa_algorithms = rsa_algorithms;
 +		} else if (rsa_algorithms > best_rsa_algorithms) {
 +			pk11_mem_put(best_rsa_token, sizeof(*best_rsa_token));
- 			best_rsa_token = token;
++			best_rsa_token = token;
 +			best_rsa_algorithms = rsa_algorithms;
 +		}
  
  	try_dsa:
- 		bad = ISC_FALSE;
-@@ -756,11 +772,12 @@ scan_slots(void) {
- 		bad = ISC_FALSE;
+ 		bad = false;
+@@ -756,11 +766,12 @@ scan_slots(void) {
+ 		bad = false;
  		rv = pkcs_C_GetMechanismInfo(slot, CKM_MD5, &mechInfo);
  		if ((rv != CKR_OK) || ((mechInfo.flags & CKF_DIGEST) == 0)) {
 -#ifndef PK11_MD5_DISABLE
--			bad = ISC_TRUE;
+-			bad = true;
 -#endif
  			PK11_TRACEM(CKM_MD5);
  		}
@@ -1357,13 +1322,13 @@ index fc75a46154..48e1031974 100644
 +#endif
  		rv = pkcs_C_GetMechanismInfo(slot, CKM_SHA_1, &mechInfo);
  		if ((rv != CKR_OK) || ((mechInfo.flags & CKF_DIGEST) == 0)) {
- 			bad = ISC_TRUE;
-@@ -788,11 +805,12 @@ scan_slots(void) {
+ 			bad = true;
+@@ -788,11 +799,12 @@ scan_slots(void) {
  		}
  		rv = pkcs_C_GetMechanismInfo(slot, CKM_MD5_HMAC, &mechInfo);
  		if ((rv != CKR_OK) || ((mechInfo.flags & CKF_SIGN) == 0)) {
 -#if !defined(PK11_MD5_DISABLE) && !defined(PK11_MD5_HMAC_REPLACE)
--			bad = ISC_TRUE;
+-			bad = true;
 -#endif
  			PK11_TRACEM(CKM_MD5_HMAC);
  		}
@@ -1374,27 +1339,27 @@ index fc75a46154..48e1031974 100644
  		rv = pkcs_C_GetMechanismInfo(slot, CKM_SHA_1_HMAC, &mechInfo);
  		if ((rv != CKR_OK) || ((mechInfo.flags & CKF_SIGN) == 0)) {
  #ifndef PK11_SHA_1_HMAC_REPLACE
-@@ -830,8 +848,14 @@ scan_slots(void) {
+@@ -830,8 +842,14 @@ scan_slots(void) {
  		}
  		if (!bad) {
  			token->operations |= 1 << OP_DIGEST;
 -			if (digest_token == NULL)
 +			if (digest_token == NULL) {
-+				digest_token = token;
+ 				digest_token = token;
 +				best_digest_algorithms = digest_algorithms;
 +			} else if (digest_algorithms > best_digest_algorithms) {
 +				pk11_mem_put(digest_token, sizeof(*digest_token));
- 				digest_token = token;
++				digest_token = token;
 +				best_digest_algorithms = digest_algorithms;
 +			}
  		}
  
  		/* ECDSA requires digest */
 diff --git a/lib/isc/tests/hash_test.c b/lib/isc/tests/hash_test.c
-index 18759903be..6bc45b1ad3 100644
+index 8f12342..7eb1552 100644
 --- a/lib/isc/tests/hash_test.c
 +++ b/lib/isc/tests/hash_test.c
-@@ -2008,7 +2008,8 @@ ATF_TP_ADD_TCS(tp) {
+@@ -2009,7 +2009,8 @@ ATF_TP_ADD_TCS(tp) {
  	 * various cryptographic hashes.
  	 */
  #ifndef PK11_MD5_DISABLE
@@ -1404,7 +1369,7 @@ index 18759903be..6bc45b1ad3 100644
  #endif
  	ATF_TP_ADD_TC(tp, sha1_check);
  
-@@ -2016,7 +2017,8 @@ ATF_TP_ADD_TCS(tp) {
+@@ -2017,7 +2018,8 @@ ATF_TP_ADD_TCS(tp) {
  	ATF_TP_ADD_TC(tp, isc_hash_function_reverse);
  	ATF_TP_ADD_TC(tp, isc_hash_initializer);
  #ifndef PK11_MD5_DISABLE
@@ -1414,7 +1379,7 @@ index 18759903be..6bc45b1ad3 100644
  #endif
  	ATF_TP_ADD_TC(tp, isc_hmacsha1);
  	ATF_TP_ADD_TC(tp, isc_hmacsha224);
-@@ -2024,7 +2026,8 @@ ATF_TP_ADD_TCS(tp) {
+@@ -2025,7 +2027,8 @@ ATF_TP_ADD_TCS(tp) {
  	ATF_TP_ADD_TC(tp, isc_hmacsha384);
  	ATF_TP_ADD_TC(tp, isc_hmacsha512);
  #ifndef PK11_MD5_DISABLE
@@ -1425,10 +1390,10 @@ index 18759903be..6bc45b1ad3 100644
  	ATF_TP_ADD_TC(tp, isc_sha1);
  	ATF_TP_ADD_TC(tp, isc_sha224);
 diff --git a/lib/isccc/cc.c b/lib/isccc/cc.c
-index 7225ab4a37..42b30466be 100644
+index c2740cb..c314d76 100644
 --- a/lib/isccc/cc.c
 +++ b/lib/isccc/cc.c
-@@ -270,11 +270,15 @@ sign(unsigned char *data, unsigned int length, unsigned char *hmac,
+@@ -272,11 +272,15 @@ sign(unsigned char *data, unsigned int length, unsigned char *hmac,
  	switch (algorithm) {
  #ifndef PK11_MD5_DISABLE
  	case ISCCC_ALG_HMACMD5:
@@ -1449,14 +1414,14 @@ index 7225ab4a37..42b30466be 100644
  		break;
  #endif
  
-@@ -348,14 +352,18 @@ isccc_cc_towire(isccc_sexpr_t *alist, isc_buffer_t **buffer,
+@@ -350,14 +354,18 @@ isccc_cc_towire(isccc_sexpr_t *alist, isc_buffer_t **buffer,
  {
  	unsigned int hmac_base, signed_base;
  	isc_result_t result;
-+	const isc_boolean_t md5 = ISC_TF(algorithm == ISCCC_ALG_HMACMD5);
++	const bool md5 = (algorithm == ISCCC_ALG_HMACMD5);
  
  #ifndef PK11_MD5_DISABLE
-+	if (md5 && isc_md5_available() == ISC_FALSE)
++	if (md5 && !isc_md5_available())
 +		return (ISC_R_NOTIMPLEMENTED);
 +
  	result = isc_buffer_reserve(buffer,
@@ -1470,7 +1435,7 @@ index 7225ab4a37..42b30466be 100644
  		return (ISC_R_NOTIMPLEMENTED);
  	result = isc_buffer_reserve(buffer, 4 + sizeof(auth_hsha));
  #endif
-@@ -374,7 +382,7 @@ isccc_cc_towire(isccc_sexpr_t *alist, isc_buffer_t **buffer,
+@@ -376,7 +384,7 @@ isccc_cc_towire(isccc_sexpr_t *alist, isc_buffer_t **buffer,
  		 * we know what it is.
  		 */
  #ifndef PK11_MD5_DISABLE
@@ -1479,7 +1444,7 @@ index 7225ab4a37..42b30466be 100644
  			hmac_base = (*buffer)->used + HMD5_OFFSET;
  			isc_buffer_putmem(*buffer,
  					  auth_hmd5, sizeof(auth_hmd5));
-@@ -440,7 +448,7 @@ verify(isccc_sexpr_t *alist, unsigned char *data, unsigned int length,
+@@ -442,7 +450,7 @@ verify(isccc_sexpr_t *alist, unsigned char *data, unsigned int length,
  	if (!isccc_alist_alistp(_auth))
  		return (ISC_R_FAILURE);
  #ifndef PK11_MD5_DISABLE
@@ -1488,7 +1453,7 @@ index 7225ab4a37..42b30466be 100644
  		hmac = isccc_alist_lookup(_auth, "hmd5");
  	else
  #endif
-@@ -455,12 +463,16 @@ verify(isccc_sexpr_t *alist, unsigned char *data, unsigned int length,
+@@ -457,12 +465,16 @@ verify(isccc_sexpr_t *alist, unsigned char *data, unsigned int length,
  	switch (algorithm) {
  #ifndef PK11_MD5_DISABLE
  	case ISCCC_ALG_HMACMD5:
diff --git a/bind-9.11-fips-tests.patch b/bind-9.11-fips-tests.patch
index f7a998d..16d3b33 100644
--- a/bind-9.11-fips-tests.patch
+++ b/bind-9.11-fips-tests.patch
@@ -1,11 +1,13 @@
-From 35b53607724ec4b5d4060385218c39ccd0d78a4d Mon Sep 17 00:00:00 2001
+From 07876a60a9c2537f536901b214349d67f6b25666 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 2 Aug 2018 23:46:45 +0200
-Subject: [PATCH 2/2] Squashed commit of the following:
+Subject: [PATCH] FIPS tests changes
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 
+Squashed commit of the following:
+
 commit 09e5eb48698d4fef2fc1031870de86c553b6bfaa
 Author: Petr Menšík <pemensik@redhat.com>
 Date:   Wed Mar 7 20:35:13 2018 +0100
@@ -108,7 +110,7 @@ Date:   Wed Mar 7 10:44:23 2018 +0100
  create mode 100644 bin/tests/system/tsig/ns1/rndc5.conf.in
 
 diff --git a/bin/tests/system/acl/ns2/named1.conf.in b/bin/tests/system/acl/ns2/named1.conf.in
-index 0ea6502708..026db3f134 100644
+index 0ea6502..026db3f 100644
 --- a/bin/tests/system/acl/ns2/named1.conf.in
 +++ b/bin/tests/system/acl/ns2/named1.conf.in
 @@ -33,12 +33,12 @@ options {
@@ -127,7 +129,7 @@ index 0ea6502708..026db3f134 100644
  };
  
 diff --git a/bin/tests/system/acl/ns2/named2.conf.in b/bin/tests/system/acl/ns2/named2.conf.in
-index b877880554..d8f50be255 100644
+index b877880..d8f50be 100644
 --- a/bin/tests/system/acl/ns2/named2.conf.in
 +++ b/bin/tests/system/acl/ns2/named2.conf.in
 @@ -33,12 +33,12 @@ options {
@@ -146,7 +148,7 @@ index b877880554..d8f50be255 100644
  };
  
 diff --git a/bin/tests/system/acl/ns2/named3.conf.in b/bin/tests/system/acl/ns2/named3.conf.in
-index 0a950622a2..aa54088138 100644
+index 0a95062..aa54088 100644
 --- a/bin/tests/system/acl/ns2/named3.conf.in
 +++ b/bin/tests/system/acl/ns2/named3.conf.in
 @@ -33,17 +33,17 @@ options {
@@ -171,7 +173,7 @@ index 0a950622a2..aa54088138 100644
  };
  
 diff --git a/bin/tests/system/acl/ns2/named4.conf.in b/bin/tests/system/acl/ns2/named4.conf.in
-index 7cdcb6e341..606a3452d8 100644
+index 7cdcb6e..606a345 100644
 --- a/bin/tests/system/acl/ns2/named4.conf.in
 +++ b/bin/tests/system/acl/ns2/named4.conf.in
 @@ -33,12 +33,12 @@ options {
@@ -190,7 +192,7 @@ index 7cdcb6e341..606a3452d8 100644
  };
  
 diff --git a/bin/tests/system/acl/ns2/named5.conf.in b/bin/tests/system/acl/ns2/named5.conf.in
-index 4b4e05027a..0e679a821d 100644
+index 4b4e050..0e679a8 100644
 --- a/bin/tests/system/acl/ns2/named5.conf.in
 +++ b/bin/tests/system/acl/ns2/named5.conf.in
 @@ -34,12 +34,12 @@ options {
@@ -209,7 +211,7 @@ index 4b4e05027a..0e679a821d 100644
  };
  
 diff --git a/bin/tests/system/acl/tests.sh b/bin/tests/system/acl/tests.sh
-index 09f31f2bb9..f88f0d4430 100644
+index 09f31f2..f88f0d4 100644
 --- a/bin/tests/system/acl/tests.sh
 +++ b/bin/tests/system/acl/tests.sh
 @@ -22,14 +22,14 @@ echo_i "testing basic ACL processing"
@@ -335,7 +337,7 @@ index 09f31f2bb9..f88f0d4430 100644
  
  echo_i "testing allow-query-on ACL processing"
 diff --git a/bin/tests/system/allow-query/ns2/named10.conf.in b/bin/tests/system/allow-query/ns2/named10.conf.in
-index 1569913b37..e9c5c2d574 100644
+index 1569913..e9c5c2d 100644
 --- a/bin/tests/system/allow-query/ns2/named10.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named10.conf.in
 @@ -12,7 +12,7 @@
@@ -348,7 +350,7 @@ index 1569913b37..e9c5c2d574 100644
  };
  
 diff --git a/bin/tests/system/allow-query/ns2/named11.conf.in b/bin/tests/system/allow-query/ns2/named11.conf.in
-index 18ac91c6e7..2b1c8739d8 100644
+index 18ac91c..2b1c873 100644
 --- a/bin/tests/system/allow-query/ns2/named11.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named11.conf.in
 @@ -12,12 +12,12 @@
@@ -367,7 +369,7 @@ index 18ac91c6e7..2b1c8739d8 100644
  };
  
 diff --git a/bin/tests/system/allow-query/ns2/named12.conf.in b/bin/tests/system/allow-query/ns2/named12.conf.in
-index b8248444dd..dd48945bf8 100644
+index b824844..dd48945 100644
 --- a/bin/tests/system/allow-query/ns2/named12.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named12.conf.in
 @@ -12,7 +12,7 @@
@@ -380,7 +382,7 @@ index b8248444dd..dd48945bf8 100644
  };
  
 diff --git a/bin/tests/system/allow-query/ns2/named30.conf.in b/bin/tests/system/allow-query/ns2/named30.conf.in
-index aeb1540e95..bfce58bddd 100644
+index aeb1540..bfce58b 100644
 --- a/bin/tests/system/allow-query/ns2/named30.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named30.conf.in
 @@ -12,7 +12,7 @@
@@ -393,7 +395,7 @@ index aeb1540e95..bfce58bddd 100644
  };
  
 diff --git a/bin/tests/system/allow-query/ns2/named31.conf.in b/bin/tests/system/allow-query/ns2/named31.conf.in
-index d4b743281a..e0f52526ba 100644
+index d4b7432..e0f5252 100644
 --- a/bin/tests/system/allow-query/ns2/named31.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named31.conf.in
 @@ -12,12 +12,12 @@
@@ -412,7 +414,7 @@ index d4b743281a..e0f52526ba 100644
  };
  
 diff --git a/bin/tests/system/allow-query/ns2/named32.conf.in b/bin/tests/system/allow-query/ns2/named32.conf.in
-index c0259387e7..87afb3fa3a 100644
+index c025938..87afb3f 100644
 --- a/bin/tests/system/allow-query/ns2/named32.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named32.conf.in
 @@ -12,7 +12,7 @@
@@ -425,7 +427,7 @@ index c0259387e7..87afb3fa3a 100644
  };
  
 diff --git a/bin/tests/system/allow-query/ns2/named40.conf.in b/bin/tests/system/allow-query/ns2/named40.conf.in
-index d83b376cfd..d726b9480b 100644
+index d83b376..d726b94 100644
 --- a/bin/tests/system/allow-query/ns2/named40.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named40.conf.in
 @@ -16,12 +16,12 @@ acl accept { 10.53.0.2; };
@@ -444,7 +446,7 @@ index d83b376cfd..d726b9480b 100644
  };
  
 diff --git a/bin/tests/system/allow-query/tests.sh b/bin/tests/system/allow-query/tests.sh
-index fb6059d5b8..f9601564a2 100644
+index fb6059d..f960156 100644
 --- a/bin/tests/system/allow-query/tests.sh
 +++ b/bin/tests/system/allow-query/tests.sh
 @@ -190,7 +190,7 @@ rndc_reload
@@ -529,7 +531,7 @@ index fb6059d5b8..f9601564a2 100644
  grep '^a.keydisallow.example' dig.out.ns2.$n > /dev/null && ret=1
  if [ $ret != 0 ]; then echo_i "failed"; fi
 diff --git a/bin/tests/system/catz/ns1/named.conf.in b/bin/tests/system/catz/ns1/named.conf.in
-index 74b7d371b7..c35376640d 100644
+index 74b7d37..c353766 100644
 --- a/bin/tests/system/catz/ns1/named.conf.in
 +++ b/bin/tests/system/catz/ns1/named.conf.in
 @@ -61,5 +61,5 @@ zone "catalog4.example" {
@@ -540,7 +542,7 @@ index 74b7d371b7..c35376640d 100644
 +	algorithm hmac-sha256;
  };
 diff --git a/bin/tests/system/catz/ns2/named.conf.in b/bin/tests/system/catz/ns2/named.conf.in
-index ee83efbee4..35ced08842 100644
+index ee83efb..35ced08 100644
 --- a/bin/tests/system/catz/ns2/named.conf.in
 +++ b/bin/tests/system/catz/ns2/named.conf.in
 @@ -70,5 +70,5 @@ zone "catalog4.example" {
@@ -551,7 +553,7 @@ index ee83efbee4..35ced08842 100644
 +	algorithm hmac-sha256;
  };
 diff --git a/bin/tests/system/checkconf/bad-tsig.conf b/bin/tests/system/checkconf/bad-tsig.conf
-index 21be03e9d2..e57c30875c 100644
+index 21be03e..e57c308 100644
 --- a/bin/tests/system/checkconf/bad-tsig.conf
 +++ b/bin/tests/system/checkconf/bad-tsig.conf
 @@ -11,7 +11,7 @@
@@ -564,7 +566,7 @@ index 21be03e9d2..e57c30875c 100644
  };
  
 diff --git a/bin/tests/system/checkconf/good.conf b/bin/tests/system/checkconf/good.conf
-index 9ab35b38a5..486551ae64 100644
+index 9ab35b3..486551a 100644
 --- a/bin/tests/system/checkconf/good.conf
 +++ b/bin/tests/system/checkconf/good.conf
 @@ -153,6 +153,6 @@ dyndb "name" "library.so" {
@@ -576,7 +578,7 @@ index 9ab35b38a5..486551ae64 100644
  	secret "qwertyuiopasdfgh";
  };
 diff --git a/bin/tests/system/digdelv/ns2/example.db b/bin/tests/system/digdelv/ns2/example.db
-index f4e30f51e5..9f53e31c97 100644
+index f4e30f5..9f53e31 100644
 --- a/bin/tests/system/digdelv/ns2/example.db
 +++ b/bin/tests/system/digdelv/ns2/example.db
 @@ -38,12 +38,15 @@ foo			SSHFP	2 1 123456789abcdef67890123456789abcdef67890
@@ -602,10 +604,10 @@ index f4e30f51e5..9f53e31c97 100644
  ; TTL of 3 weeks
  weeks		1814400	A	10.53.0.2
 diff --git a/bin/tests/system/digdelv/tests.sh b/bin/tests/system/digdelv/tests.sh
-index 1b25c4ddfc..5dbf20a3e1 100644
+index 95bd074..b566ecb 100644
 --- a/bin/tests/system/digdelv/tests.sh
 +++ b/bin/tests/system/digdelv/tests.sh
-@@ -62,7 +62,7 @@ if [ -x ${DIG} ] ; then
+@@ -61,7 +61,7 @@ if [ -x ${DIG} ] ; then
    echo_i "checking dig +multi +norrcomments works for dnskey (when default is rrcomments)($n)"
    ret=0
    $DIG $DIGOPTS +tcp @10.53.0.3 +multi +norrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1
@@ -614,7 +616,7 @@ index 1b25c4ddfc..5dbf20a3e1 100644
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
  
-@@ -70,7 +70,7 @@ if [ -x ${DIG} ] ; then
+@@ -69,7 +69,7 @@ if [ -x ${DIG} ] ; then
    echo_i "checking dig +multi +norrcomments works for soa (when default is rrcomments)($n)"
    ret=0
    $DIG $DIGOPTS +tcp @10.53.0.3 +multi +norrcomments SOA example > dig.out.test$n || ret=1
@@ -623,7 +625,7 @@ index 1b25c4ddfc..5dbf20a3e1 100644
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
  
-@@ -78,7 +78,7 @@ if [ -x ${DIG} ] ; then
+@@ -77,7 +77,7 @@ if [ -x ${DIG} ] ; then
    echo_i "checking dig +rrcomments works for DNSKEY($n)"
    ret=0
    $DIG $DIGOPTS +tcp @10.53.0.3 +rrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1
@@ -632,7 +634,7 @@ index 1b25c4ddfc..5dbf20a3e1 100644
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
  
-@@ -86,7 +86,7 @@ if [ -x ${DIG} ] ; then
+@@ -85,7 +85,7 @@ if [ -x ${DIG} ] ; then
    echo_i "checking dig +short +rrcomments works for DNSKEY ($n)"
    ret=0
    $DIG $DIGOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1
@@ -641,7 +643,7 @@ index 1b25c4ddfc..5dbf20a3e1 100644
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
  
-@@ -94,7 +94,7 @@ if [ -x ${DIG} ] ; then
+@@ -93,7 +93,7 @@ if [ -x ${DIG} ] ; then
    echo_i "checking dig +short +nosplit works($n)"
    ret=0
    $DIG $DIGOPTS +tcp @10.53.0.3 +short +nosplit DNSKEY dnskey.example > dig.out.test$n || ret=1
@@ -650,7 +652,7 @@ index 1b25c4ddfc..5dbf20a3e1 100644
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
  
-@@ -102,7 +102,7 @@ if [ -x ${DIG} ] ; then
+@@ -101,7 +101,7 @@ if [ -x ${DIG} ] ; then
    echo_i "checking dig +short +rrcomments works($n)"
    ret=0
    $DIG $DIGOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1
@@ -659,7 +661,7 @@ index 1b25c4ddfc..5dbf20a3e1 100644
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
  
-@@ -118,7 +118,7 @@ if [ -x ${DIG} ] ; then
+@@ -117,7 +117,7 @@ if [ -x ${DIG} ] ; then
    echo_i "checking dig +short +rrcomments works($n)"
    ret=0
    $DIG $DIGOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1
@@ -668,7 +670,7 @@ index 1b25c4ddfc..5dbf20a3e1 100644
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
  
-@@ -543,7 +543,7 @@ if [ -x ${DELV} ] ; then
+@@ -555,7 +555,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +multi +norrcomments works for dnskey (when default is rrcomments)($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +multi +norrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
@@ -677,7 +679,7 @@ index 1b25c4ddfc..5dbf20a3e1 100644
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
  
-@@ -551,7 +551,7 @@ if [ -x ${DELV} ] ; then
+@@ -563,7 +563,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +multi +norrcomments works for soa (when default is rrcomments)($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +multi +norrcomments SOA example > delv.out.test$n || ret=1
@@ -686,7 +688,7 @@ index 1b25c4ddfc..5dbf20a3e1 100644
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
  
-@@ -559,7 +559,7 @@ if [ -x ${DELV} ] ; then
+@@ -571,7 +571,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +rrcomments works for DNSKEY($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +rrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
@@ -695,7 +697,7 @@ index 1b25c4ddfc..5dbf20a3e1 100644
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
  
-@@ -567,7 +567,7 @@ if [ -x ${DELV} ] ; then
+@@ -579,7 +579,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +short +rrcomments works for DNSKEY ($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
@@ -704,7 +706,7 @@ index 1b25c4ddfc..5dbf20a3e1 100644
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
  
-@@ -575,7 +575,7 @@ if [ -x ${DELV} ] ; then
+@@ -587,7 +587,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +short +rrcomments works ($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
@@ -713,7 +715,7 @@ index 1b25c4ddfc..5dbf20a3e1 100644
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
  
-@@ -583,7 +583,7 @@ if [ -x ${DELV} ] ; then
+@@ -595,7 +595,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +short +nosplit works ($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +short +nosplit DNSKEY dnskey.example > delv.out.test$n || ret=1
@@ -722,7 +724,7 @@ index 1b25c4ddfc..5dbf20a3e1 100644
    if test `wc -l < delv.out.test$n` != 1 ; then ret=1 ; fi
    f=`awk '{print NF}' < delv.out.test$n`
    test "${f:-0}" -eq 14 || ret=1
-@@ -594,7 +594,7 @@ if [ -x ${DELV} ] ; then
+@@ -606,7 +606,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +short +nosplit +norrcomments works ($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +short +nosplit +norrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
@@ -732,7 +734,7 @@ index 1b25c4ddfc..5dbf20a3e1 100644
    f=`awk '{print NF}' < delv.out.test$n`
    test "${f:-0}" -eq 4 || ret=1
 diff --git a/bin/tests/system/dlv/ns1/sign.sh b/bin/tests/system/dlv/ns1/sign.sh
-index b8151620cc..2a62e583b8 100755
+index b815162..2a62e58 100755
 --- a/bin/tests/system/dlv/ns1/sign.sh
 +++ b/bin/tests/system/dlv/ns1/sign.sh
 @@ -23,8 +23,8 @@ infile=root.db.in
@@ -747,7 +749,7 @@ index b8151620cc..2a62e583b8 100755
  cat $infile $keyname1.key $keyname2.key >$zonefile
  
 diff --git a/bin/tests/system/dlv/ns2/sign.sh b/bin/tests/system/dlv/ns2/sign.sh
-index 6f84d7a525..e128303a22 100755
+index 6f84d7a..e128303 100755
 --- a/bin/tests/system/dlv/ns2/sign.sh
 +++ b/bin/tests/system/dlv/ns2/sign.sh
 @@ -24,8 +24,8 @@ zonefile=druz.db
@@ -762,7 +764,7 @@ index 6f84d7a525..e128303a22 100755
  cat $infile $keyname1.key $keyname2.key >$zonefile
  
 diff --git a/bin/tests/system/dlv/ns3/sign.sh b/bin/tests/system/dlv/ns3/sign.sh
-index bcc9922e26..846dbcc0df 100755
+index bcc9922..846dbcc 100755
 --- a/bin/tests/system/dlv/ns3/sign.sh
 +++ b/bin/tests/system/dlv/ns3/sign.sh
 @@ -19,6 +19,7 @@ echo_i "dlv/ns3/sign.sh"
@@ -961,7 +963,7 @@ index bcc9922e26..846dbcc0df 100755
  cat $infile $dlvsets $keyname1.key $keyname2.key >$zonefile
  
 diff --git a/bin/tests/system/dlv/ns6/sign.sh b/bin/tests/system/dlv/ns6/sign.sh
-index 1e398625f1..4ed19acd1f 100755
+index 1e39862..4ed19ac 100755
 --- a/bin/tests/system/dlv/ns6/sign.sh
 +++ b/bin/tests/system/dlv/ns6/sign.sh
 @@ -16,13 +16,15 @@ SYSTESTDIR=dlv
@@ -1148,7 +1150,7 @@ index 1e398625f1..4ed19acd1f 100755
  cat $infile $keyname1.key $keyname2.key >$zonefile
  
 diff --git a/bin/tests/system/dnssec/ns1/sign.sh b/bin/tests/system/dnssec/ns1/sign.sh
-index 198d60ae15..d89a539ffd 100644
+index 198d60a..d89a539 100644
 --- a/bin/tests/system/dnssec/ns1/sign.sh
 +++ b/bin/tests/system/dnssec/ns1/sign.sh
 @@ -27,7 +27,7 @@ cp ../ns2/dsset-in-addr.arpa$TP .
@@ -1169,7 +1171,7 @@ index 198d60ae15..d89a539ffd 100644
  keyid=`expr $keyid + 0`
  echo "$keyid" > managed.key.id
 diff --git a/bin/tests/system/dnssec/ns2/sign.sh b/bin/tests/system/dnssec/ns2/sign.sh
-index 9078459ac8..9dcd028eb5 100644
+index 9078459..9dcd028 100644
 --- a/bin/tests/system/dnssec/ns2/sign.sh
 +++ b/bin/tests/system/dnssec/ns2/sign.sh
 @@ -29,8 +29,8 @@ do
@@ -1213,7 +1215,7 @@ index 9078459ac8..9dcd028eb5 100644
  cat $dlvinfile $dlvkeyname.key $dlvsetfile > $dlvzonefile
  
 diff --git a/bin/tests/system/dnssec/ns3/sign.sh b/bin/tests/system/dnssec/ns3/sign.sh
-index 330abf7feb..f95a6b7ea8 100644
+index 330abf7..f95a6b7 100644
 --- a/bin/tests/system/dnssec/ns3/sign.sh
 +++ b/bin/tests/system/dnssec/ns3/sign.sh
 @@ -28,7 +28,7 @@ zone=bogus.example.
@@ -1300,7 +1302,7 @@ index 330abf7feb..f95a6b7ea8 100644
  cat $infile $keyname.key >$zonefile
  
 diff --git a/bin/tests/system/dnssec/ns5/trusted.conf.bad b/bin/tests/system/dnssec/ns5/trusted.conf.bad
-index ed30460bda..e6b112630e 100644
+index ed30460..e6b1126 100644
 --- a/bin/tests/system/dnssec/ns5/trusted.conf.bad
 +++ b/bin/tests/system/dnssec/ns5/trusted.conf.bad
 @@ -10,5 +10,5 @@
@@ -1311,7 +1313,7 @@ index ed30460bda..e6b112630e 100644
 +    "." 256 3 8 "AwEAAarwAdjV4gIhpBCjXVAScRFEx3co7k8smJdxrnqoGsl5NB7EZ9jRdgvCXbJn6v8y9jlNWVHvaC8ilhfhLh0A1vLWiWv4ijd/12xcnrY7xpG7Cu3YkxUxaXJ7Jdg/Iw1+9mGgXF1v4UbCIcw/3U3cxyk7OxYg+VSb5KBAQSR0upxV";
  };
 diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh
-index bb2315fbf3..315666825e 100644
+index bb2315f..3156668 100644
 --- a/bin/tests/system/dnssec/tests.sh
 +++ b/bin/tests/system/dnssec/tests.sh
 @@ -1690,7 +1690,7 @@ ret=0
@@ -1344,7 +1346,7 @@ index bb2315fbf3..315666825e 100644
  	8) size="-b 512";;
  	10) size="-b 1024";;
 diff --git a/bin/tests/system/feature-test.c b/bin/tests/system/feature-test.c
-index 9612450ab4..5eee6aa4f8 100644
+index 9612450..5eee6aa 100644
 --- a/bin/tests/system/feature-test.c
 +++ b/bin/tests/system/feature-test.c
 @@ -19,6 +19,7 @@
@@ -1383,7 +1385,7 @@ index 9612450ab4..5eee6aa4f8 100644
  #ifdef ENABLE_RPZ_NSIP
  		return (0);
 diff --git a/bin/tests/system/filter-aaaa/ns1/sign.sh b/bin/tests/system/filter-aaaa/ns1/sign.sh
-index f7555810a0..4a7d89004a 100755
+index f755581..4a7d890 100755
 --- a/bin/tests/system/filter-aaaa/ns1/sign.sh
 +++ b/bin/tests/system/filter-aaaa/ns1/sign.sh
 @@ -21,8 +21,8 @@ infile=signed.db.in
@@ -1398,7 +1400,7 @@ index f7555810a0..4a7d89004a 100755
  cat $infile $keyname1.key $keyname2.key >$zonefile
  
 diff --git a/bin/tests/system/filter-aaaa/ns4/sign.sh b/bin/tests/system/filter-aaaa/ns4/sign.sh
-index f7555810a0..4a7d89004a 100755
+index f755581..4a7d890 100755
 --- a/bin/tests/system/filter-aaaa/ns4/sign.sh
 +++ b/bin/tests/system/filter-aaaa/ns4/sign.sh
 @@ -21,8 +21,8 @@ infile=signed.db.in
@@ -1413,7 +1415,7 @@ index f7555810a0..4a7d89004a 100755
  cat $infile $keyname1.key $keyname2.key >$zonefile
  
 diff --git a/bin/tests/system/notify/ns5/named.conf.in b/bin/tests/system/notify/ns5/named.conf.in
-index cfcfe8fa2f..0a1614d527 100644
+index cfcfe8f..0a1614d 100644
 --- a/bin/tests/system/notify/ns5/named.conf.in
 +++ b/bin/tests/system/notify/ns5/named.conf.in
 @@ -10,17 +10,17 @@
@@ -1438,7 +1440,7 @@ index cfcfe8fa2f..0a1614d527 100644
  };
  
 diff --git a/bin/tests/system/notify/tests.sh b/bin/tests/system/notify/tests.sh
-index ad20e3eaca..5a9ce4688a 100644
+index ad20e3e..5a9ce46 100644
 --- a/bin/tests/system/notify/tests.sh
 +++ b/bin/tests/system/notify/tests.sh
 @@ -186,16 +186,16 @@ ret=0
@@ -1462,7 +1464,7 @@ index ad20e3eaca..5a9ce4688a 100644
  	grep "test string" dig.out.b.ns5.test$n > /dev/null &&
  	grep "test string" dig.out.c.ns5.test$n > /dev/null &&
 diff --git a/bin/tests/system/nsupdate/ns1/named.conf.in b/bin/tests/system/nsupdate/ns1/named.conf.in
-index 1d999adc39..26b6b7c9ab 100644
+index 1d999ad..26b6b7c 100644
 --- a/bin/tests/system/nsupdate/ns1/named.conf.in
 +++ b/bin/tests/system/nsupdate/ns1/named.conf.in
 @@ -32,7 +32,7 @@ controls {
@@ -1475,7 +1477,7 @@ index 1d999adc39..26b6b7c9ab 100644
  };
  
 diff --git a/bin/tests/system/nsupdate/ns2/named.conf.in b/bin/tests/system/nsupdate/ns2/named.conf.in
-index b4ecf96668..1adb33eb0b 100644
+index b4ecf96..1adb33e 100644
 --- a/bin/tests/system/nsupdate/ns2/named.conf.in
 +++ b/bin/tests/system/nsupdate/ns2/named.conf.in
 @@ -24,7 +24,7 @@ options {
@@ -1488,10 +1490,10 @@ index b4ecf96668..1adb33eb0b 100644
  };
  
 diff --git a/bin/tests/system/nsupdate/setup.sh b/bin/tests/system/nsupdate/setup.sh
-index 32674eb382..2331b30b00 100644
+index d6647fa..715314b 100644
 --- a/bin/tests/system/nsupdate/setup.sh
 +++ b/bin/tests/system/nsupdate/setup.sh
-@@ -59,7 +59,12 @@ EOF
+@@ -63,7 +63,12 @@ EOF
  
  $DDNSCONFGEN -q -r $RANDFILE -z example.nil > ns1/ddns.key
  
@@ -1506,10 +1508,10 @@ index 32674eb382..2331b30b00 100644
  $DDNSCONFGEN -q -r $RANDFILE -a hmac-sha224 -k sha224-key -z keytests.nil > ns1/sha224.key
  $DDNSCONFGEN -q -r $RANDFILE -a hmac-sha256 -k sha256-key -z keytests.nil > ns1/sha256.key
 diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh
-index 2a01d1e46d..e8659587c3 100755
+index 9f26572..fd0383f 100755
 --- a/bin/tests/system/nsupdate/tests.sh
 +++ b/bin/tests/system/nsupdate/tests.sh
-@@ -680,7 +680,14 @@ fi
+@@ -700,7 +700,14 @@ fi
  n=`expr $n + 1`
  ret=0
  echo_i "check TSIG key algorithms ($n)"
@@ -1525,7 +1527,7 @@ index 2a01d1e46d..e8659587c3 100755
      $NSUPDATE -k ns1/${alg}.key <<END > /dev/null || ret=1
  server 10.53.0.1 ${PORT}
  update add ${alg}.keytests.nil. 600 A 10.10.10.3
-@@ -688,7 +695,7 @@ send
+@@ -708,7 +715,7 @@ send
  END
  done
  sleep 2
@@ -1535,7 +1537,7 @@ index 2a01d1e46d..e8659587c3 100755
  done
  if [ $ret -ne 0 ]; then
 diff --git a/bin/tests/system/rndc/setup.sh b/bin/tests/system/rndc/setup.sh
-index 850c4d2744..09a3e0f9ad 100644
+index 850c4d2..09a3e0f 100644
 --- a/bin/tests/system/rndc/setup.sh
 +++ b/bin/tests/system/rndc/setup.sh
 @@ -37,7 +37,7 @@ make_key () {
@@ -1548,7 +1550,7 @@ index 850c4d2744..09a3e0f9ad 100644
  make_key 3 ${EXTRAPORT3} hmac-sha224
  make_key 4 ${EXTRAPORT4} hmac-sha256
 diff --git a/bin/tests/system/rndc/tests.sh b/bin/tests/system/rndc/tests.sh
-index d364e6fea0..dbf3bc6780 100644
+index 647730e..7df752d 100644
 --- a/bin/tests/system/rndc/tests.sh
 +++ b/bin/tests/system/rndc/tests.sh
 @@ -356,15 +356,20 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -1582,7 +1584,7 @@ index d364e6fea0..dbf3bc6780 100644
  n=`expr $n + 1`
  echo_i "testing rndc with hmac-sha1 ($n)"
 diff --git a/bin/tests/system/tsig/clean.sh b/bin/tests/system/tsig/clean.sh
-index 576ec70f76..cb7a852189 100644
+index 576ec70..cb7a852 100644
 --- a/bin/tests/system/tsig/clean.sh
 +++ b/bin/tests/system/tsig/clean.sh
 @@ -20,3 +20,4 @@ rm -f */named.run
@@ -1591,7 +1593,7 @@ index 576ec70f76..cb7a852189 100644
  rm -f keygen.out?
 +rm -f ns1/named.conf
 diff --git a/bin/tests/system/tsig/ns1/named.conf.in b/bin/tests/system/tsig/ns1/named.conf.in
-index fbf30c6dc4..f61657d7cf 100644
+index fbf30c6..f61657d 100644
 --- a/bin/tests/system/tsig/ns1/named.conf.in
 +++ b/bin/tests/system/tsig/ns1/named.conf.in
 @@ -21,10 +21,7 @@ options {
@@ -1620,7 +1622,7 @@ index fbf30c6dc4..f61657d7cf 100644
  	secret "FrSt77yPTFx6hTs4i2tKLB9LmE0=";
 diff --git a/bin/tests/system/tsig/ns1/rndc5.conf.in b/bin/tests/system/tsig/ns1/rndc5.conf.in
 new file mode 100644
-index 0000000000..4117830adb
+index 0000000..4117830
 --- /dev/null
 +++ b/bin/tests/system/tsig/ns1/rndc5.conf.in
 @@ -0,0 +1,11 @@
@@ -1636,7 +1638,7 @@ index 0000000000..4117830adb
 +};
 +
 diff --git a/bin/tests/system/tsig/setup.sh b/bin/tests/system/tsig/setup.sh
-index 656e9bbcd8..628c5bbac1 100644
+index 656e9bb..628c5bb 100644
 --- a/bin/tests/system/tsig/setup.sh
 +++ b/bin/tests/system/tsig/setup.sh
 @@ -17,3 +17,7 @@ $SHELL clean.sh
@@ -1648,7 +1650,7 @@ index 656e9bbcd8..628c5bbac1 100644
 +	cat ns1/rndc5.conf.in >> ns1/named.conf
 +fi
 diff --git a/bin/tests/system/tsig/tests.sh b/bin/tests/system/tsig/tests.sh
-index f731fa604c..cade35bc1d 100644
+index f731fa6..cade35b 100644
 --- a/bin/tests/system/tsig/tests.sh
 +++ b/bin/tests/system/tsig/tests.sh
 @@ -26,20 +26,25 @@ sha512="jI/Pa4qRu96t76Pns5Z/Ndxbn3QCkwcxLOgt9vgvnJw5wqTRvNyk3FtD6yIMd1dWVlqZ+Y4f
@@ -1740,7 +1742,7 @@ index f731fa604c..cade35bc1d 100644
  
  echo_i "fetching using hmac-sha1-80 (BADTRUNC)"
 diff --git a/bin/tests/system/tsiggss/setup.sh b/bin/tests/system/tsiggss/setup.sh
-index 5da33cfde0..fb108b02bd 100644
+index 5da33cf..fb108b0 100644
 --- a/bin/tests/system/tsiggss/setup.sh
 +++ b/bin/tests/system/tsiggss/setup.sh
 @@ -18,5 +18,5 @@ test -r $RANDFILE || $GENRANDOM 400 $RANDFILE
@@ -1751,7 +1753,7 @@ index 5da33cfde0..fb108b02bd 100644
 +key=`$KEYGEN -Cq -K ns1 -a DSA -b 1024 -r $RANDFILE -n HOST -T KEY key.example.nil.`
  cat ns1/example.nil.db.in ns1/${key}.key > ns1/example.nil.db
 diff --git a/bin/tests/system/upforwd/ns1/named.conf.in b/bin/tests/system/upforwd/ns1/named.conf.in
-index e0a30cda15..6a77b1ce52 100644
+index e0a30cd..6a77b1c 100644
 --- a/bin/tests/system/upforwd/ns1/named.conf.in
 +++ b/bin/tests/system/upforwd/ns1/named.conf.in
 @@ -10,7 +10,7 @@
@@ -1764,7 +1766,7 @@ index e0a30cda15..6a77b1ce52 100644
  };
  
 diff --git a/bin/tests/system/upforwd/tests.sh b/bin/tests/system/upforwd/tests.sh
-index b0694bbd5c..9adae8228e 100644
+index b0694bb..9adae82 100644
 --- a/bin/tests/system/upforwd/tests.sh
 +++ b/bin/tests/system/upforwd/tests.sh
 @@ -68,7 +68,7 @@ if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
diff --git a/bind-9.11-host-idn-disable.patch b/bind-9.11-host-idn-disable.patch
index 434c596..7d52964 100644
--- a/bind-9.11-host-idn-disable.patch
+++ b/bind-9.11-host-idn-disable.patch
@@ -1,4 +1,4 @@
-From 145fac914bf47128307aea702fed7eb74b65cadd Mon Sep 17 00:00:00 2001
+From ed26f0f0eb4242706d2012e4abe0152071bb305b Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Tue, 25 Sep 2018 18:08:46 +0200
 Subject: [PATCH] Disable IDN from environment as documented
@@ -18,7 +18,7 @@ RH patch since RHEL 5.
  4 files changed, 26 insertions(+), 4 deletions(-)
 
 diff --git a/bin/dig/dig.docbook b/bin/dig/dig.docbook
-index fedd288..d5dba72 100644
+index bd7510e..5cc696f 100644
 --- a/bin/dig/dig.docbook
 +++ b/bin/dig/dig.docbook
 @@ -1288,7 +1288,9 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
@@ -33,28 +33,28 @@ index fedd288..d5dba72 100644
    </refsection>
  
 diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
-index 7408193..d46379d 100644
+index 341ed80..bb8702c 100644
 --- a/bin/dig/dighost.c
 +++ b/bin/dig/dighost.c
-@@ -822,12 +822,17 @@ make_empty_lookup(void) {
- 	looknew->seenbadcookie = ISC_FALSE;
- 	looknew->badcookie = ISC_TRUE;
+@@ -825,12 +825,17 @@ make_empty_lookup(void) {
+ 	looknew->seenbadcookie = false;
+ 	looknew->badcookie = true;
  #ifdef WITH_IDN_SUPPORT
--	looknew->idnin = ISC_TRUE;
+-	looknew->idnin = true;
 +	looknew->idnin = (getenv("IDN_DISABLE") == NULL);
 +	if (looknew->idnin) {
 +		const char *charset = getenv("CHARSET");
 +		if (charset && !strcmp(charset, "ASCII"))
-+			looknew->idnin = ISC_FALSE;
++			looknew->idnin = false;
 +	}
  #else
- 	looknew->idnin = ISC_FALSE;
+ 	looknew->idnin = false;
  #endif
  #ifdef WITH_IDN_OUT_SUPPORT
--	looknew->idnout = ISC_TRUE;
+-	looknew->idnout = true;
 +	looknew->idnout = looknew->idnin;
  #else
- 	looknew->idnout = ISC_FALSE;
+ 	looknew->idnout = false;
  #endif
 diff --git a/bin/dig/host.docbook b/bin/dig/host.docbook
 index 9c3aeaa..42cbbf9 100644
diff --git a/bind-9.11-kyua-pkcs11.patch b/bind-9.11-kyua-pkcs11.patch
index ab21828..1b83800 100644
--- a/bind-9.11-kyua-pkcs11.patch
+++ b/bind-9.11-kyua-pkcs11.patch
@@ -1,4 +1,4 @@
-From d0433a314534e104f52acf2a0a96a68dd84305ae Mon Sep 17 00:00:00 2001
+From 3474d13bbf08c441783bd72afbc8cec8857baf46 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Tue, 2 Jan 2018 18:13:07 +0100
 Subject: [PATCH] Fix pkcs11 variants atf tests
@@ -17,10 +17,10 @@ Add pkcs11 Kyuafile, fix dh_test to pass in pkcs11 mode
  7 files changed, 40 insertions(+), 16 deletions(-)
 
 diff --git a/configure.in b/configure.in
-index 67b3aab..4767eeb 100644
+index 1edafd1..5466de1 100644
 --- a/configure.in
 +++ b/configure.in
-@@ -5579,6 +5579,7 @@ AC_CONFIG_FILES([
+@@ -5489,6 +5489,7 @@ AC_CONFIG_FILES([
  	lib/dns-pkcs11/include/Makefile
  	lib/dns-pkcs11/include/dns/Makefile
  	lib/dns-pkcs11/include/dst/Makefile
@@ -57,10 +57,10 @@ index ff9fc56..eaaf0dc 100644
  include('isccfg/Kyuafile')
  include('lwres/Kyuafile')
 diff --git a/lib/dns-pkcs11/tests/Makefile.in b/lib/dns-pkcs11/tests/Makefile.in
-index 2a6571b..f25a784 100644
+index 625e809..6fd4e36 100644
 --- a/lib/dns-pkcs11/tests/Makefile.in
 +++ b/lib/dns-pkcs11/tests/Makefile.in
-@@ -20,12 +20,12 @@ VERSION=@BIND9_VERSION@
+@@ -21,12 +21,12 @@ VERSION=@BIND9_VERSION@
  
  CINCLUDES =	-I. -Iinclude ${DNS_INCLUDES} ${ISC_INCLUDES} \
  		@DST_OPENSSL_INC@
@@ -79,10 +79,10 @@ index 2a6571b..f25a784 100644
  LIBS =		@LIBS@ @ATFLIBS@
  
 diff --git a/lib/dns-pkcs11/tests/dh_test.c b/lib/dns-pkcs11/tests/dh_test.c
-index 036d27a..eb6554f 100644
+index 6216b4e..dd74e58 100644
 --- a/lib/dns-pkcs11/tests/dh_test.c
 +++ b/lib/dns-pkcs11/tests/dh_test.c
-@@ -63,7 +63,8 @@ ATF_TC_BODY(isc_dh_computesecret, tc) {
+@@ -64,7 +64,8 @@ ATF_TC_BODY(isc_dh_computesecret, tc) {
  	ret = dst_key_computesecret(key, key, &buf);
  	ATF_REQUIRE_EQ(ret, DST_R_NOTPRIVATEKEY);
  	ret = key->func->computesecret(key, key, &buf);
@@ -93,10 +93,10 @@ index 036d27a..eb6554f 100644
  	dst_key_free(&key);
  	dns_test_end();
 diff --git a/lib/isc-pkcs11/tests/Makefile.in b/lib/isc-pkcs11/tests/Makefile.in
-index f7fa538..818dae4 100644
+index add8068..a928dcf 100644
 --- a/lib/isc-pkcs11/tests/Makefile.in
 +++ b/lib/isc-pkcs11/tests/Makefile.in
-@@ -17,10 +17,10 @@ VERSION=@BIND9_VERSION@
+@@ -20,10 +20,10 @@ VERSION=@BIND9_VERSION@
  @BIND9_MAKE_INCLUDES@
  
  CINCLUDES =	-I. -Iinclude ${ISC_INCLUDES} @ISC_OPENSSL_INC@
@@ -111,10 +111,10 @@ index f7fa538..818dae4 100644
  LIBS =		@LIBS@ @ATFLIBS@
  
 diff --git a/lib/isc-pkcs11/tests/hash_test.c b/lib/isc-pkcs11/tests/hash_test.c
-index 5b8a374..c1891c2 100644
+index 7eb1552..048ae9d 100644
 --- a/lib/isc-pkcs11/tests/hash_test.c
 +++ b/lib/isc-pkcs11/tests/hash_test.c
-@@ -74,7 +74,7 @@ typedef struct hash_testcase {
+@@ -78,7 +78,7 @@ typedef struct hash_testcase {
  
  typedef struct hash_test_key {
  	const char *key;
@@ -123,7 +123,7 @@ index 5b8a374..c1891c2 100644
  } hash_test_key_t;
  
  /* non-hmac tests */
-@@ -957,8 +957,11 @@ ATF_TC_BODY(isc_hmacsha1, tc) {
+@@ -961,8 +961,11 @@ ATF_TC_BODY(isc_hmacsha1, tc) {
  	hash_test_key_t *test_key = test_keys;
  
  	while (testcase->input != NULL && testcase->result != NULL) {
@@ -134,9 +134,9 @@ index 5b8a374..c1891c2 100644
 -		isc_hmacsha1_init(&hmacsha1, buffer, test_key->len);
 +		isc_hmacsha1_init(&hmacsha1, buffer, len);
  		isc_hmacsha1_update(&hmacsha1,
- 				    (const isc_uint8_t *) testcase->input,
+ 				    (const uint8_t *) testcase->input,
  				    testcase->input_len);
-@@ -1120,8 +1123,11 @@ ATF_TC_BODY(isc_hmacsha224, tc) {
+@@ -1124,8 +1127,11 @@ ATF_TC_BODY(isc_hmacsha224, tc) {
  	hash_test_key_t *test_key = test_keys;
  
  	while (testcase->input != NULL && testcase->result != NULL) {
@@ -147,9 +147,9 @@ index 5b8a374..c1891c2 100644
 -		isc_hmacsha224_init(&hmacsha224, buffer, test_key->len);
 +		isc_hmacsha224_init(&hmacsha224, buffer, len);
  		isc_hmacsha224_update(&hmacsha224,
- 				      (const isc_uint8_t *) testcase->input,
+ 				      (const uint8_t *) testcase->input,
  				      testcase->input_len);
-@@ -1283,8 +1289,11 @@ ATF_TC_BODY(isc_hmacsha256, tc) {
+@@ -1287,8 +1293,11 @@ ATF_TC_BODY(isc_hmacsha256, tc) {
  	hash_test_key_t *test_key = test_keys;
  
  	while (testcase->input != NULL && testcase->result != NULL) {
@@ -160,9 +160,9 @@ index 5b8a374..c1891c2 100644
 -		isc_hmacsha256_init(&hmacsha256, buffer, test_key->len);
 +		isc_hmacsha256_init(&hmacsha256, buffer, len);
  		isc_hmacsha256_update(&hmacsha256,
- 				      (const isc_uint8_t *) testcase->input,
+ 				      (const uint8_t *) testcase->input,
  				      testcase->input_len);
-@@ -1452,8 +1461,11 @@ ATF_TC_BODY(isc_hmacsha384, tc) {
+@@ -1456,8 +1465,11 @@ ATF_TC_BODY(isc_hmacsha384, tc) {
  	hash_test_key_t *test_key = test_keys;
  
  	while (testcase->input != NULL && testcase->result != NULL) {
@@ -173,9 +173,9 @@ index 5b8a374..c1891c2 100644
 -		isc_hmacsha384_init(&hmacsha384, buffer, test_key->len);
 +		isc_hmacsha384_init(&hmacsha384, buffer, len);
  		isc_hmacsha384_update(&hmacsha384,
- 				      (const isc_uint8_t *) testcase->input,
+ 				      (const uint8_t *) testcase->input,
  				      testcase->input_len);
-@@ -1621,8 +1633,11 @@ ATF_TC_BODY(isc_hmacsha512, tc) {
+@@ -1625,8 +1637,11 @@ ATF_TC_BODY(isc_hmacsha512, tc) {
  	hash_test_key_t *test_key = test_keys;
  
  	while (testcase->input != NULL && testcase->result != NULL) {
@@ -186,9 +186,9 @@ index 5b8a374..c1891c2 100644
 -		isc_hmacsha512_init(&hmacsha512, buffer, test_key->len);
 +		isc_hmacsha512_init(&hmacsha512, buffer, len);
  		isc_hmacsha512_update(&hmacsha512,
- 				      (const isc_uint8_t *) testcase->input,
+ 				      (const uint8_t *) testcase->input,
  				      testcase->input_len);
-@@ -1765,8 +1780,11 @@ ATF_TC_BODY(isc_hmacmd5, tc) {
+@@ -1769,8 +1784,11 @@ ATF_TC_BODY(isc_hmacmd5, tc) {
  	hash_test_key_t *test_key = test_keys;
  
  	while (testcase->input != NULL && testcase->result != NULL) {
@@ -199,8 +199,8 @@ index 5b8a374..c1891c2 100644
 -		isc_hmacmd5_init(&hmacmd5, buffer, test_key->len);
 +		isc_hmacmd5_init(&hmacmd5, buffer, len);
  		isc_hmacmd5_update(&hmacmd5,
- 				   (const isc_uint8_t *) testcase->input,
+ 				   (const uint8_t *) testcase->input,
  				   testcase->input_len);
 -- 
-2.14.3
+2.14.4
 
diff --git a/bind-9.11-oot-manual.patch b/bind-9.11-oot-manual.patch
index b090b9f..84e9d25 100644
--- a/bind-9.11-oot-manual.patch
+++ b/bind-9.11-oot-manual.patch
@@ -1,4 +1,4 @@
-From e462d022a9dc52c40aece6f8ba3123ff3ffa59ed Mon Sep 17 00:00:00 2001
+From 8ca95f47231822df2b9c171a4da1e93ca5b748eb Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Wed, 25 Jul 2018 12:24:16 +0200
 Subject: [PATCH] Use make automatic variables to install updated manuals
@@ -19,7 +19,7 @@ Install all files in single command instead of iterating on each of them.
  9 files changed, 54 insertions(+), 38 deletions(-)
 
 diff --git a/bin/check/Makefile.in b/bin/check/Makefile.in
-index 12f48d2d23..d8eac4c714 100644
+index c124e80..1174f8d 100644
 --- a/bin/check/Makefile.in
 +++ b/bin/check/Makefile.in
 @@ -83,12 +83,14 @@ installdirs:
@@ -35,13 +35,13 @@ index 12f48d2d23..d8eac4c714 100644
  	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named-checkconf@EXEEXT@ ${DESTDIR}${sbindir}
  	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named-checkzone@EXEEXT@ ${DESTDIR}${sbindir}
  	(cd ${DESTDIR}${sbindir}; rm -f named-compilezone@EXEEXT@; ${LINK_PROGRAM} named-checkzone@EXEEXT@ named-compilezone@EXEEXT@)
--	for m in ${MANPAGES}; do ${INSTALL_DATA} ${srcdir}/$$m ${DESTDIR}${mandir}/man8; done
+-	for m in ${MANPAGES}; do ${INSTALL_DATA} ${srcdir}/$$m ${DESTDIR}${mandir}/man8 || exit 1; done
 -	(cd ${DESTDIR}${mandir}/man8; rm -f named-compilezone.8; ${LINK_PROGRAM} named-checkzone.8 named-compilezone.8)
  
  uninstall::
  	rm -f ${DESTDIR}${mandir}/man8/named-compilezone.8
 diff --git a/bin/confgen/Makefile.in b/bin/confgen/Makefile.in
-index 87f13dda4b..7865c0c73e 100644
+index 87f13dd..7865c0c 100644
 --- a/bin/confgen/Makefile.in
 +++ b/bin/confgen/Makefile.in
 @@ -95,13 +95,14 @@ installdirs:
@@ -64,7 +64,7 @@ index 87f13dda4b..7865c0c73e 100644
  uninstall::
  	rm -f ${DESTDIR}${mandir}/man8/tsig-keygen.8
 diff --git a/bin/delv/Makefile.in b/bin/delv/Makefile.in
-index e2d2802262..19361a83ea 100644
+index e2d2802..19361a8 100644
 --- a/bin/delv/Makefile.in
 +++ b/bin/delv/Makefile.in
 @@ -63,10 +63,12 @@ installdirs:
@@ -83,7 +83,7 @@ index e2d2802262..19361a83ea 100644
  uninstall::
  	rm -f ${DESTDIR}${mandir}/man1/delv.1
 diff --git a/bin/dig/Makefile.in b/bin/dig/Makefile.in
-index 773ac46395..3edd951e7e 100644
+index a9830a9..d7ac0b6 100644
 --- a/bin/dig/Makefile.in
 +++ b/bin/dig/Makefile.in
 @@ -91,16 +91,16 @@ installdirs:
@@ -102,13 +102,13 @@ index 773ac46395..3edd951e7e 100644
  	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} \
  		nslookup@EXEEXT@ ${DESTDIR}${bindir}
 -	for m in ${MANPAGES}; do \
--		${INSTALL_DATA} ${srcdir}/$$m ${DESTDIR}${mandir}/man1; \
--		done
+-		${INSTALL_DATA} ${srcdir}/$$m ${DESTDIR}${mandir}/man1 || exit 1; \
+-	done
  
  uninstall::
  	for m in ${MANPAGES}; do \
 diff --git a/bin/dnssec/Makefile.in b/bin/dnssec/Makefile.in
-index 1be1d5ffc6..1d0c4ce5c1 100644
+index 2239ad1..ce0a177 100644
 --- a/bin/dnssec/Makefile.in
 +++ b/bin/dnssec/Makefile.in
 @@ -110,9 +110,11 @@ installdirs:
@@ -120,16 +120,16 @@ index 1be1d5ffc6..1d0c4ce5c1 100644
 +	${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man8
 +
 +install:: ${TARGETS} installdirs install-man8
- 	for t in ${TARGETS}; do ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} $$t ${DESTDIR}${sbindir}; done
--	for m in ${MANPAGES}; do ${INSTALL_DATA} ${srcdir}/$$m ${DESTDIR}${mandir}/man8; done
+ 	for t in ${TARGETS}; do ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} $$t ${DESTDIR}${sbindir} || exit 1; done
+-	for m in ${MANPAGES}; do ${INSTALL_DATA} ${srcdir}/$$m ${DESTDIR}${mandir}/man8 || exit 1; done
  
  uninstall::
- 	for m in ${MANPAGES}; do rm -f ${DESTDIR}${mandir}/man8/$$m ; done
+ 	for m in ${MANPAGES}; do rm -f ${DESTDIR}${mandir}/man8/$$m || exit 1; done
 diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
-index 1c413973d0..03e4cb849b 100644
+index e1f85a9..d92bc9a 100644
 --- a/bin/named/Makefile.in
 +++ b/bin/named/Makefile.in
-@@ -172,12 +172,17 @@ installdirs:
+@@ -176,12 +176,17 @@ installdirs:
  	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man5
  	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
  
@@ -152,7 +152,7 @@ index 1c413973d0..03e4cb849b 100644
  uninstall::
  	rm -f ${DESTDIR}${mandir}/man5/named.conf.5
 diff --git a/bin/pkcs11/Makefile.in b/bin/pkcs11/Makefile.in
-index ae9061626c..a058c91214 100644
+index ae90616..a058c91 100644
 --- a/bin/pkcs11/Makefile.in
 +++ b/bin/pkcs11/Makefile.in
 @@ -71,7 +71,10 @@ installdirs:
@@ -179,7 +179,7 @@ index ae9061626c..a058c91214 100644
  uninstall::
  	rm -f ${DESTDIR}${mandir}/man8/pkcs11-tokens.8
 diff --git a/bin/python/Makefile.in b/bin/python/Makefile.in
-index aa678d47ab..064c404e2f 100644
+index aa678d4..064c404 100644
 --- a/bin/python/Makefile.in
 +++ b/bin/python/Makefile.in
 @@ -47,13 +47,13 @@ installdirs:
@@ -201,7 +201,7 @@ index aa678d47ab..064c404e2f 100644
  		if test -n "${DESTDIR}" ; then \
  			${PYTHON} ${srcdir}/setup.py install --root=${DESTDIR} --prefix=${prefix} @PYTHON_INSTALL_LIB@ ; \
 diff --git a/bin/tools/Makefile.in b/bin/tools/Makefile.in
-index 7bf2af4cea..c395bc7462 100644
+index 7bf2af4..c395bc7 100644
 --- a/bin/tools/Makefile.in
 +++ b/bin/tools/Makefile.in
 @@ -119,17 +119,27 @@ installdirs:
diff --git a/bind-9.11-rh1624100.patch b/bind-9.11-rh1624100.patch
index 954661c..b17a6ca 100644
--- a/bind-9.11-rh1624100.patch
+++ b/bind-9.11-rh1624100.patch
@@ -1,4 +1,4 @@
-From 25ff8ab2b0772262d358272a3ed70a24fc6e4887 Mon Sep 17 00:00:00 2001
+From 4fc49ad102fd00343665273caf4349d4edb5e5ac Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@sury.org>
 Date: Wed, 25 Apr 2018 14:04:31 +0200
 Subject: [PATCH] Replace isc_safe routines with their OpenSSL counter parts
@@ -17,17 +17,17 @@ Fix the isc_safe_memwipe() usage with (NULL, >0)
  lib/dns/nsec3.c              |  4 +--
  lib/dns/spnego.c             |  4 +--
  lib/isc/Makefile.in          |  8 ++---
- lib/isc/include/isc/safe.h   | 18 ++++------
- lib/isc/safe.c               | 81 --------------------------------------------
+ lib/isc/include/isc/safe.h   | 18 +++-------
+ lib/isc/safe.c               | 83 --------------------------------------------
  lib/isc/tests/safe_test.c    | 20 -----------
- 7 files changed, 13 insertions(+), 124 deletions(-)
+ 7 files changed, 11 insertions(+), 128 deletions(-)
  delete mode 100644 lib/isc/safe.c
 
 diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c
-index 53be1f5c60..351296a356 100644
+index 6ddaebe..d921870 100644
 --- a/bin/dnssec/dnssec-signzone.c
 +++ b/bin/dnssec/dnssec-signzone.c
-@@ -786,7 +786,7 @@ hashlist_add_dns_name(hashlist_t *l, /*const*/ dns_name_t *name,
+@@ -787,7 +787,7 @@ hashlist_add_dns_name(hashlist_t *l, /*const*/ dns_name_t *name,
  
  static int
  hashlist_comp(const void *a, const void *b) {
@@ -37,10 +37,10 @@ index 53be1f5c60..351296a356 100644
  
  static void
 diff --git a/lib/dns/nsec3.c b/lib/dns/nsec3.c
-index d364308aaf..37b6a8a7fe 100644
+index e127893..895519e 100644
 --- a/lib/dns/nsec3.c
 +++ b/lib/dns/nsec3.c
-@@ -1950,7 +1950,7 @@ dns_nsec3_noexistnodata(dns_rdatatype_t type, dns_name_t* name,
+@@ -1953,7 +1953,7 @@ dns_nsec3_noexistnodata(dns_rdatatype_t type, dns_name_t* name,
  	 * Work out what this NSEC3 covers.
  	 * Inside (<0) or outside (>=0).
  	 */
@@ -49,7 +49,7 @@ index d364308aaf..37b6a8a7fe 100644
  
  	/*
  	 * Prepare to compute all the hashes.
-@@ -1974,7 +1974,7 @@ dns_nsec3_noexistnodata(dns_rdatatype_t type, dns_name_t* name,
+@@ -1977,7 +1977,7 @@ dns_nsec3_noexistnodata(dns_rdatatype_t type, dns_name_t* name,
  			return (ISC_R_IGNORE);
  		}
  
@@ -59,10 +59,10 @@ index d364308aaf..37b6a8a7fe 100644
  			/*
  			 * The hashes are the same.
 diff --git a/lib/dns/spnego.c b/lib/dns/spnego.c
-index ce3e42d650..079d4c1b4a 100644
+index ad77f24..670982a 100644
 --- a/lib/dns/spnego.c
 +++ b/lib/dns/spnego.c
-@@ -369,7 +369,7 @@ gssapi_spnego_decapsulate(OM_uint32 *,
+@@ -371,7 +371,7 @@ gssapi_spnego_decapsulate(OM_uint32 *,
  
  /* mod_auth_kerb.c */
  
@@ -71,7 +71,7 @@ index ce3e42d650..079d4c1b4a 100644
  cmp_gss_type(gss_buffer_t token, gss_OID gssoid)
  {
  	unsigned char *p;
-@@ -393,7 +393,7 @@ cmp_gss_type(gss_buffer_t token, gss_OID gssoid)
+@@ -395,7 +395,7 @@ cmp_gss_type(gss_buffer_t token, gss_OID gssoid)
  	if (((OM_uint32) *p++) != gssoid->length)
  		return (GSS_S_DEFECTIVE_TOKEN);
  
@@ -81,7 +81,7 @@ index ce3e42d650..079d4c1b4a 100644
  
  /* accept_sec_context.c */
 diff --git a/lib/isc/Makefile.in b/lib/isc/Makefile.in
-index ba53ef1091..98acffffc9 100644
+index ba53ef1..98acfff 100644
 --- a/lib/isc/Makefile.in
 +++ b/lib/isc/Makefile.in
 @@ -60,7 +60,7 @@ OBJS =		@ISC_EXTRA_OBJS@ @ISC_PK11_O@ @ISC_PK11_RESULT_O@ \
@@ -114,28 +114,28 @@ index ba53ef1091..98acffffc9 100644
  	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} \
  		-DVERSION=\"${VERSION}\" \
 diff --git a/lib/isc/include/isc/safe.h b/lib/isc/include/isc/safe.h
-index f29f00bac6..b8a0b2290c 100644
+index 66ed08b..88b8f47 100644
 --- a/lib/isc/include/isc/safe.h
 +++ b/lib/isc/include/isc/safe.h
-@@ -15,27 +15,21 @@
+@@ -15,29 +15,19 @@
  
  /*! \file isc/safe.h */
  
+-#include <stdbool.h>
+-
 -#include <isc/types.h>
 -#include <stdlib.h>
-+#include <isc/boolean.h>
 +#include <isc/lang.h>
-+
 +#include <openssl/crypto.h>
  
  ISC_LANG_BEGINDECLS
  
--isc_boolean_t
+-bool
 -isc_safe_memequal(const void *s1, const void *s2, size_t n);
-+#define isc_safe_memequal(s1, s2, n) ISC_TF(!CRYPTO_memcmp(s1, s2, n))
++#define isc_safe_memequal(s1, s2, n) !CRYPTO_memcmp(s1, s2, n)
  /*%<
-  * Returns ISC_TRUE iff. two blocks of memory are equal, otherwise
-  * ISC_FALSE.
+  * Returns true iff. two blocks of memory are equal, otherwise
+  * false.
   *
   */
  
@@ -153,10 +153,10 @@ index f29f00bac6..b8a0b2290c 100644
   *
 diff --git a/lib/isc/safe.c b/lib/isc/safe.c
 deleted file mode 100644
-index 5c9e1e2d13..0000000000
+index 7a464b6..0000000
 --- a/lib/isc/safe.c
 +++ /dev/null
-@@ -1,81 +0,0 @@
+@@ -1,83 +0,0 @@
 -/*
 - * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 - *
@@ -172,6 +172,8 @@ index 5c9e1e2d13..0000000000
 -
 -#include <config.h>
 -
+-#include <stdbool.h>
+-
 -#include <isc/safe.h>
 -#include <isc/string.h>
 -#include <isc/util.h>
@@ -184,18 +186,18 @@ index 5c9e1e2d13..0000000000
 -#pragma optimize("", off)
 -#endif
 -
--isc_boolean_t
+-bool
 -isc_safe_memequal(const void *s1, const void *s2, size_t n) {
--	isc_uint8_t acc = 0;
+-	uint8_t acc = 0;
 -
 -	if (n != 0U) {
--		const isc_uint8_t *p1 = s1, *p2 = s2;
+-		const uint8_t *p1 = s1, *p2 = s2;
 -
 -		do {
 -			acc |= *p1++ ^ *p2++;
 -		} while (--n != 0U);
 -	}
--	return (ISC_TF(acc == 0));
+-	return (acc == 0);
 -}
 -
 -
@@ -239,7 +241,7 @@ index 5c9e1e2d13..0000000000
 -#endif
 -}
 diff --git a/lib/isc/tests/safe_test.c b/lib/isc/tests/safe_test.c
-index f721cd1096..ea3e61f98d 100644
+index f721cd1..ea3e61f 100644
 --- a/lib/isc/tests/safe_test.c
 +++ b/lib/isc/tests/safe_test.c
 @@ -39,24 +39,6 @@ ATF_TC_BODY(isc_safe_memequal, tc) {
diff --git a/bind-9.11-rt31459.patch b/bind-9.11-rt31459.patch
index 6208ef2..06847bf 100644
--- a/bind-9.11-rt31459.patch
+++ b/bind-9.11-rt31459.patch
@@ -1,4 +1,4 @@
-From ae9c9ef5a5ba06cf57b5a87b5f2bbc71649ba41b Mon Sep 17 00:00:00 2001
+From 45209f5153693339c4582795714b6859693673fc Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Tue, 12 Sep 2017 19:05:46 -0700
 Subject: [PATCH] rebased rt31459c
@@ -24,7 +24,7 @@ Include new unit test
  bin/named/server.c                       |   6 +
  bin/nsupdate/nsupdate.c                  |  18 ++-
  bin/tests/makejournal.c                  |   6 +-
- bin/tests/system/pipelined/pipequeries.c |  20 ++-
+ bin/tests/system/pipelined/pipequeries.c |  21 ++-
  bin/tests/system/pipelined/tests.sh      |   4 +-
  bin/tests/system/rsabigexponent/bigkey.c |   4 +
  bin/tests/system/tkey/keycreate.c        |  26 +++-
@@ -35,14 +35,14 @@ Include new unit test
  configure.in                             |  77 +++++++++-
  lib/dns/dst_api.c                        |  21 ++-
  lib/dns/include/dst/dst.h                |   8 +
- lib/dns/lib.c                            |  17 ++-
+ lib/dns/lib.c                            |  15 +-
  lib/dns/openssl_link.c                   |  72 ++++++++-
  lib/dns/pkcs11.c                         |  29 +++-
  lib/dns/tests/Atffile                    |   1 +
  lib/dns/tests/Kyuafile                   |   1 +
  lib/dns/tests/Makefile.in                |   7 +
  lib/dns/tests/dnstest.c                  |  14 +-
- lib/dns/tests/dstrandom_test.c           | 105 +++++++++++++
+ lib/dns/tests/dstrandom_test.c           |  99 ++++++++++++
  lib/dns/win32/libdns.def.in              |   7 +
  lib/isc/entropy.c                        |  24 +++
  lib/isc/include/isc/entropy.h            |  12 ++
@@ -51,11 +51,11 @@ Include new unit test
  lib/isc/pk11.c                           |  12 +-
  lib/isc/win32/include/isc/platform.h.in  |   5 +
  win32utils/Configure                     |  29 +++-
- 38 files changed, 704 insertions(+), 184 deletions(-)
+ 38 files changed, 699 insertions(+), 182 deletions(-)
  create mode 100644 lib/dns/tests/dstrandom_test.c
 
 diff --git a/bin/confgen/keygen.c b/bin/confgen/keygen.c
-index 11cc54d..fa439cc 100644
+index 5015abb..295e16f 100644
 --- a/bin/confgen/keygen.c
 +++ b/bin/confgen/keygen.c
 @@ -165,6 +165,13 @@ generate_key(isc_mem_t *mctx, const char *randomfile, dns_secalg_t alg,
@@ -66,17 +66,17 @@ index 11cc54d..fa439cc 100644
 +	if (randomfile != NULL &&
 +	    strcmp(randomfile, ISC_PLATFORM_CRYPTORANDOM) == 0) {
 +		randomfile = NULL;
-+		isc_entropy_usehook(ectx, ISC_TRUE);
++		isc_entropy_usehook(ectx, true);
 +	}
 +#endif
  	DO("start entropy source", isc_entropy_usebestsource(ectx,
  							     &entropy_source,
  							     randomfile,
 diff --git a/bin/dnssec/dnssec-dsfromkey.c b/bin/dnssec/dnssec-dsfromkey.c
-index 94a982c..897c497 100644
+index 65fdaaa..6612189 100644
 --- a/bin/dnssec/dnssec-dsfromkey.c
 +++ b/bin/dnssec/dnssec-dsfromkey.c
-@@ -495,14 +495,14 @@ main(int argc, char **argv) {
+@@ -497,14 +497,14 @@ main(int argc, char **argv) {
  
  	if (ectx == NULL)
  		setup_entropy(mctx, NULL, &ectx);
@@ -94,7 +94,7 @@ index 94a982c..897c497 100644
  	isc_entropy_stopcallbacksources(ectx);
  
  	setup_logging(mctx, &log);
-@@ -564,8 +564,8 @@ main(int argc, char **argv) {
+@@ -566,8 +566,8 @@ main(int argc, char **argv) {
  	if (dns_rdataset_isassociated(&rdataset))
  		dns_rdataset_disassociate(&rdataset);
  	cleanup_logging(&log);
@@ -105,10 +105,10 @@ index 94a982c..897c497 100644
  	dns_name_destroy();
  	if (verbose > 10)
 diff --git a/bin/dnssec/dnssec-importkey.c b/bin/dnssec/dnssec-importkey.c
-index 2edf614..840316c 100644
+index 0d1e7f8..79c4d74 100644
 --- a/bin/dnssec/dnssec-importkey.c
 +++ b/bin/dnssec/dnssec-importkey.c
-@@ -406,14 +406,14 @@ main(int argc, char **argv) {
+@@ -407,14 +407,14 @@ main(int argc, char **argv) {
  
  	if (ectx == NULL)
  		setup_entropy(mctx, NULL, &ectx);
@@ -126,7 +126,7 @@ index 2edf614..840316c 100644
  	isc_entropy_stopcallbacksources(ectx);
  
  	setup_logging(mctx, &log);
-@@ -457,8 +457,8 @@ main(int argc, char **argv) {
+@@ -458,8 +458,8 @@ main(int argc, char **argv) {
  	if (dns_rdataset_isassociated(&rdataset))
  		dns_rdataset_disassociate(&rdataset);
  	cleanup_logging(&log);
@@ -137,10 +137,10 @@ index 2edf614..840316c 100644
  	dns_name_destroy();
  	if (verbose > 10)
 diff --git a/bin/dnssec/dnssec-revoke.c b/bin/dnssec/dnssec-revoke.c
-index 10fad0b..0b68e99 100644
+index 1a2b545..e33cb8b 100644
 --- a/bin/dnssec/dnssec-revoke.c
 +++ b/bin/dnssec/dnssec-revoke.c
-@@ -182,14 +182,14 @@ main(int argc, char **argv) {
+@@ -184,14 +184,14 @@ main(int argc, char **argv) {
  
  	if (ectx == NULL)
  		setup_entropy(mctx, NULL, &ectx);
@@ -158,7 +158,7 @@ index 10fad0b..0b68e99 100644
  	isc_entropy_stopcallbacksources(ectx);
  
  	result = dst_key_fromnamedfile(filename, dir,
-@@ -271,8 +271,8 @@ main(int argc, char **argv) {
+@@ -273,8 +273,8 @@ main(int argc, char **argv) {
  
  cleanup:
  	dst_key_free(&key);
@@ -169,10 +169,10 @@ index 10fad0b..0b68e99 100644
  	if (verbose > 10)
  		isc_mem_stats(mctx, stdout);
 diff --git a/bin/dnssec/dnssec-settime.c b/bin/dnssec/dnssec-settime.c
-index 360cdb9..b7bf171 100644
+index f355903..6a2ca59 100644
 --- a/bin/dnssec/dnssec-settime.c
 +++ b/bin/dnssec/dnssec-settime.c
-@@ -380,14 +380,14 @@ main(int argc, char **argv) {
+@@ -382,14 +382,14 @@ main(int argc, char **argv) {
  
  	if (ectx == NULL)
  		setup_entropy(mctx, NULL, &ectx);
@@ -190,7 +190,7 @@ index 360cdb9..b7bf171 100644
  	isc_entropy_stopcallbacksources(ectx);
  
  	if (predecessor != NULL) {
-@@ -672,8 +672,8 @@ main(int argc, char **argv) {
+@@ -674,8 +674,8 @@ main(int argc, char **argv) {
  	if (prevkey != NULL)
  		dst_key_free(&prevkey);
  	dst_key_free(&key);
@@ -201,10 +201,10 @@ index 360cdb9..b7bf171 100644
  	if (verbose > 10)
  		isc_mem_stats(mctx, stdout);
 diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c
-index 1bea357..53be1f5 100644
+index c6a0313..6ddaebe 100644
 --- a/bin/dnssec/dnssec-signzone.c
 +++ b/bin/dnssec/dnssec-signzone.c
-@@ -3459,14 +3459,15 @@ main(int argc, char *argv[]) {
+@@ -3460,14 +3460,15 @@ main(int argc, char *argv[]) {
  	if (!pseudorandom)
  		eflags |= ISC_ENTROPY_GOODONLY;
  
@@ -224,7 +224,7 @@ index 1bea357..53be1f5 100644
  	isc_stdtime_get(&now);
  
  	if (startstr != NULL) {
-@@ -3878,8 +3879,8 @@ main(int argc, char *argv[]) {
+@@ -3879,8 +3880,8 @@ main(int argc, char *argv[]) {
  	dns_master_styledestroy(&dsstyle, mctx);
  
  	cleanup_logging(&log);
@@ -235,10 +235,10 @@ index 1bea357..53be1f5 100644
  	dns_name_destroy();
  	if (verbose > 10)
 diff --git a/bin/dnssec/dnssec-verify.c b/bin/dnssec/dnssec-verify.c
-index 792510a..dc32765 100644
+index 4c293bf..3263cbc 100644
 --- a/bin/dnssec/dnssec-verify.c
 +++ b/bin/dnssec/dnssec-verify.c
-@@ -280,15 +280,15 @@ main(int argc, char *argv[]) {
+@@ -281,15 +281,15 @@ main(int argc, char *argv[]) {
  	if (ectx == NULL)
  		setup_entropy(mctx, NULL, &ectx);
  
@@ -259,10 +259,10 @@ index 792510a..dc32765 100644
  
  	rdclass = strtoclass(classname);
 diff --git a/bin/dnssec/dnssectool.c b/bin/dnssec/dnssectool.c
-index dc32c90..4ea9eaf 100644
+index fbc7ece..31a99e7 100644
 --- a/bin/dnssec/dnssectool.c
 +++ b/bin/dnssec/dnssectool.c
-@@ -32,6 +32,7 @@
+@@ -34,6 +34,7 @@
  #include <isc/heap.h>
  #include <isc/list.h>
  #include <isc/mem.h>
@@ -270,7 +270,7 @@ index dc32c90..4ea9eaf 100644
  #include <isc/print.h>
  #include <isc/string.h>
  #include <isc/time.h>
-@@ -233,7 +234,8 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
+@@ -235,7 +236,8 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
  	if (*ectx == NULL) {
  		result = isc_entropy_create(mctx, ectx);
  		if (result != ISC_R_SUCCESS)
@@ -280,7 +280,7 @@ index dc32c90..4ea9eaf 100644
  		ISC_LIST_INIT(sources);
  	}
  
-@@ -242,6 +244,13 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
+@@ -244,6 +246,13 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
  		randomfile = NULL;
  	}
  
@@ -288,17 +288,17 @@ index dc32c90..4ea9eaf 100644
 +	if (randomfile != NULL &&
 +	    strcmp(randomfile, ISC_PLATFORM_CRYPTORANDOM) == 0) {
 +		randomfile = NULL;
-+		isc_entropy_usehook(*ectx, ISC_TRUE);
++		isc_entropy_usehook(*ectx, true);
 +	}
 +#endif
  	result = isc_entropy_usebestsource(*ectx, &source, randomfile,
  					   usekeyboard);
  
 diff --git a/bin/named/server.c b/bin/named/server.c
-index 59a8998..ee5186c 100644
+index 7f87ccf..9258e7f 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
-@@ -34,6 +34,7 @@
+@@ -36,6 +36,7 @@
  #include <isc/lex.h>
  #include <isc/meminfo.h>
  #include <isc/parseint.h>
@@ -306,18 +306,18 @@ index 59a8998..ee5186c 100644
  #include <isc/portset.h>
  #include <isc/print.h>
  #include <isc/random.h>
-@@ -8083,6 +8084,10 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8171,6 +8172,10 @@ load_configuration(const char *filename, ns_server_t *server,
  				      "no source of entropy found");
  		} else {
  			const char *randomdev = cfg_obj_asstring(obj);
 +#ifdef ISC_PLATFORM_CRYPTORANDOM
 +			if (strcmp(randomdev, ISC_PLATFORM_CRYPTORANDOM) == 0)
-+				isc_entropy_usehook(ns_g_entropy, ISC_TRUE);
++				isc_entropy_usehook(ns_g_entropy, true);
 +#else
  			int level = ISC_LOG_ERROR;
  			result = isc_entropy_createfilesource(ns_g_entropy,
  							      randomdev);
-@@ -8117,6 +8122,7 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8205,6 +8210,7 @@ load_configuration(const char *filename, ns_server_t *server,
  				}
  				isc_entropy_detach(&ns_g_fallbackentropy);
  			}
@@ -326,10 +326,10 @@ index 59a8998..ee5186c 100644
  		}
  	}
 diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
-index bb5d500..46c7acf 100644
+index 5eefc57..1559a33 100644
 --- a/bin/nsupdate/nsupdate.c
 +++ b/bin/nsupdate/nsupdate.c
-@@ -33,6 +33,7 @@
+@@ -35,6 +35,7 @@
  #include <isc/mem.h>
  #include <isc/parseint.h>
  #include <isc/print.h>
@@ -337,7 +337,7 @@ index bb5d500..46c7acf 100644
  #include <isc/random.h>
  #include <isc/region.h>
  #include <isc/sockaddr.h>
-@@ -269,7 +270,8 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
+@@ -271,7 +272,8 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
  	if (*ectx == NULL) {
  		result = isc_entropy_create(mctx, ectx);
  		if (result != ISC_R_SUCCESS)
@@ -347,7 +347,7 @@ index bb5d500..46c7acf 100644
  		ISC_LIST_INIT(sources);
  	}
  
-@@ -278,6 +280,13 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
+@@ -280,6 +282,13 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
  		randomfile = NULL;
  	}
  
@@ -355,13 +355,13 @@ index bb5d500..46c7acf 100644
 +	if (randomfile != NULL &&
 +	    strcmp(randomfile, ISC_PLATFORM_CRYPTORANDOM) == 0) {
 +		randomfile = NULL;
-+		isc_entropy_usehook(*ectx, ISC_TRUE);
++		isc_entropy_usehook(*ectx, true);
 +	}
 +#endif
  	result = isc_entropy_usebestsource(*ectx, &source, randomfile,
  					   usekeyboard);
  
-@@ -948,11 +957,11 @@ setup_system(void) {
+@@ -950,11 +959,11 @@ setup_system(void) {
  		}
  	}
  
@@ -375,9 +375,9 @@ index bb5d500..46c7acf 100644
  
  	result = dns_dispatchmgr_create(gmctx, entropy, &dispatchmgr);
  	check_result(result, "dns_dispatchmgr_create");
-@@ -976,6 +985,9 @@ setup_system(void) {
+@@ -978,6 +987,9 @@ setup_system(void) {
  	check_result(result, "dst_lib_init");
- 	is_dst_up = ISC_TRUE;
+ 	is_dst_up = true;
  
 +	/* moved after dst_lib_init() */
 +	isc_hash_init();
@@ -386,30 +386,30 @@ index bb5d500..46c7acf 100644
  	attrmask |= DNS_DISPATCHATTR_IPV4 | DNS_DISPATCHATTR_IPV6;
  
 diff --git a/bin/tests/makejournal.c b/bin/tests/makejournal.c
-index fed59be..9f125da 100644
+index 61a41b0..acc71a1 100644
 --- a/bin/tests/makejournal.c
 +++ b/bin/tests/makejournal.c
-@@ -100,12 +100,12 @@ main(int argc, char **argv) {
+@@ -102,12 +102,12 @@ main(int argc, char **argv) {
  	CHECK(isc_mem_create(0, 0, &mctx));
  	CHECK(isc_entropy_create(mctx, &ectx));
  
 -	CHECK(isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE));
--	hash_active = ISC_TRUE;
+-	hash_active = true;
 -
  	CHECK(dst_lib_init(mctx, ectx, ISC_ENTROPY_BLOCKING));
- 	dst_active = ISC_TRUE;
+ 	dst_active = true;
  
 +	CHECK(isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE));
-+	hash_active = ISC_TRUE;
++	hash_active = true;
 +
  	CHECK(isc_log_create(mctx, &lctx, &logconfig));
  	isc_log_registercategories(lctx, categories);
  	isc_log_setcontext(lctx);
 diff --git a/bin/tests/system/pipelined/pipequeries.c b/bin/tests/system/pipelined/pipequeries.c
-index 379b6a3..810d99e 100644
+index 2fcc064..7b4f617 100644
 --- a/bin/tests/system/pipelined/pipequeries.c
 +++ b/bin/tests/system/pipelined/pipequeries.c
-@@ -202,6 +202,7 @@ sendqueries(isc_task_t *task, isc_event_t *event) {
+@@ -204,6 +204,7 @@ sendqueries(isc_task_t *task, isc_event_t *event) {
  
  int
  main(int argc, char *argv[]) {
@@ -417,16 +417,17 @@ index 379b6a3..810d99e 100644
  	isc_sockaddr_t bind_any;
  	struct in_addr inaddr;
  	isc_result_t result;
-@@ -222,7 +223,7 @@ main(int argc, char *argv[]) {
+@@ -224,7 +225,8 @@ main(int argc, char *argv[]) {
  	UNUSED(argv);
  
- 	isc_commandline_errprint = ISC_FALSE;
+ 	isc_commandline_errprint = false;
 -	while ((c = isc_commandline_parse(argc, argv, "p:")) != -1) {
-+	while ((c = isc_commandline_parse(argc, argv, "p:r:")) != -1) {
++	while ((c = isc_commandline_parse(argc, argv, "p:r:")) != -1)
++	{
  		switch (c) {
  		case 'p':
  			result = isc_parse_uint16(&port,
-@@ -233,6 +234,9 @@ main(int argc, char *argv[]) {
+@@ -235,6 +237,9 @@ main(int argc, char *argv[]) {
  				exit(1);
  			}
  			break;
@@ -436,7 +437,7 @@ index 379b6a3..810d99e 100644
  		case '?':
  			fprintf(stderr, "%s: invalid argument '%c'",
  				argv[0], c);
-@@ -274,10 +278,18 @@ main(int argc, char *argv[]) {
+@@ -276,10 +281,18 @@ main(int argc, char *argv[]) {
  
  	ectx = NULL;
  	RUNCHECK(isc_entropy_create(mctx, &ectx));
@@ -446,7 +447,7 @@ index 379b6a3..810d99e 100644
 +	if (randomfile != NULL &&
 +	    strcmp(randomfile, ISC_PLATFORM_CRYPTORANDOM) == 0) {
 +		randomfile = NULL;
-+		isc_entropy_usehook(ectx, ISC_TRUE);
++		isc_entropy_usehook(ectx, true);
 +	}
 +#endif
 +	if (randomfile != NULL)
@@ -457,7 +458,7 @@ index 379b6a3..810d99e 100644
  
  	taskmgr = NULL;
  	RUNCHECK(isc_taskmgr_create(mctx, 1, 0, &taskmgr));
-@@ -330,8 +342,8 @@ main(int argc, char *argv[]) {
+@@ -332,8 +345,8 @@ main(int argc, char *argv[]) {
  	isc_task_detach(&task);
  	isc_taskmgr_destroy(&taskmgr);
  
@@ -490,7 +491,7 @@ index a6720ce..9063b1f 100644
  diff refb outputb || ret=1
  if [ $ret != 0 ]; then echo_i "failed"; fi
 diff --git a/bin/tests/system/rsabigexponent/bigkey.c b/bin/tests/system/rsabigexponent/bigkey.c
-index 4462f2e..f1230d8 100644
+index 4462f2e..f06268d 100644
 --- a/bin/tests/system/rsabigexponent/bigkey.c
 +++ b/bin/tests/system/rsabigexponent/bigkey.c
 @@ -20,6 +20,7 @@
@@ -506,13 +507,13 @@ index 4462f2e..f1230d8 100644
  	CHECK(isc_mem_create(0, 0, &mctx), "isc_mem_create()");
  	CHECK(isc_entropy_create(mctx, &ectx), "isc_entropy_create()");
 +#ifdef ISC_PLATFORM_CRYPTORANDOM
-+	isc_entropy_usehook(ectx, ISC_TRUE);
++	isc_entropy_usehook(ectx, true);
 +#endif
  	CHECK(isc_entropy_usebestsource(ectx, &source,
  					"../random.data",
  					ISC_ENTROPY_KEYBOARDNO),
 diff --git a/bin/tests/system/tkey/keycreate.c b/bin/tests/system/tkey/keycreate.c
-index 489f439..4f2f5b4 100644
+index 653c951..fe8698e 100644
 --- a/bin/tests/system/tkey/keycreate.c
 +++ b/bin/tests/system/tkey/keycreate.c
 @@ -206,6 +206,7 @@ sendquery(isc_task_t *task, isc_event_t *event) {
@@ -555,7 +556,7 @@ index 489f439..4f2f5b4 100644
 +	if (randomfile != NULL &&
 +	    strcmp(randomfile, ISC_PLATFORM_CRYPTORANDOM) == 0) {
 +		randomfile = NULL;
-+		isc_entropy_usehook(ectx, ISC_TRUE);
++		isc_entropy_usehook(ectx, true);
 +	}
 +#endif
 +	if (randomfile != NULL)
@@ -581,7 +582,7 @@ index 489f439..4f2f5b4 100644
  
  	isc_mem_destroy(&mctx);
 diff --git a/bin/tests/system/tkey/keydelete.c b/bin/tests/system/tkey/keydelete.c
-index 36ee6c7..0975bbe 100644
+index 70a40c3..2146f9b 100644
 --- a/bin/tests/system/tkey/keydelete.c
 +++ b/bin/tests/system/tkey/keydelete.c
 @@ -136,6 +136,7 @@ sendquery(isc_task_t *task, isc_event_t *event) {
@@ -624,7 +625,7 @@ index 36ee6c7..0975bbe 100644
 +	if (randomfile != NULL &&
 +	    strcmp(randomfile, ISC_PLATFORM_CRYPTORANDOM) == 0) {
 +		randomfile = NULL;
-+		isc_entropy_usehook(ectx, ISC_TRUE);
++		isc_entropy_usehook(ectx, true);
 +	}
 +#endif
 +	if (randomfile != NULL)
@@ -639,7 +640,7 @@ index 36ee6c7..0975bbe 100644
  
  	taskmgr = NULL;
  	RUNCHECK(isc_taskmgr_create(mctx, 1, 0, &taskmgr));
-@@ -265,8 +285,8 @@ main(int argc, char **argv) {
+@@ -264,8 +284,8 @@ main(int argc, char **argv) {
  
  	isc_log_destroy(&log);
  
@@ -690,10 +691,10 @@ index 9f90dd7..fad6c83 100644
          echo "I:failed"
  	status=`expr $status + $ret`
 diff --git a/bin/tools/mdig.c b/bin/tools/mdig.c
-index 1f5dd4c..4e3bfa5 100644
+index 4876875..e46653a 100644
 --- a/bin/tools/mdig.c
 +++ b/bin/tools/mdig.c
-@@ -1933,12 +1933,11 @@ main(int argc, char *argv[]) {
+@@ -1955,12 +1955,11 @@ main(int argc, char *argv[]) {
  
  	ectx = NULL;
  	RUNCHECK(isc_entropy_create(mctx, &ectx));
@@ -705,10 +706,10 @@ index 1f5dd4c..4e3bfa5 100644
 -	RUNCHECK(dst_lib_init(mctx, ectx, ISC_ENTROPY_GOODONLY));
 -
  	ISC_LIST_INIT(queries);
- 	parse_args(ISC_FALSE, argc, argv);
+ 	parse_args(false, argc, argv);
  	if (server == NULL)
 diff --git a/configure b/configure
-index c83773a..ac1ea3f 100755
+index 4394755..2e0af33 100755
 --- a/configure
 +++ b/configure
 @@ -640,6 +640,7 @@ ac_includes_default="\
@@ -719,7 +720,7 @@ index c83773a..ac1ea3f 100755
  BUILD_LIBS
  BUILD_LDFLAGS
  BUILD_CPPFLAGS
-@@ -825,6 +826,7 @@ XMLSTATS
+@@ -823,6 +824,7 @@ XMLSTATS
  NZDTARGETS
  NZDSRCS
  NZD_TOOLS
@@ -727,7 +728,7 @@ index c83773a..ac1ea3f 100755
  PKCS11_TEST
  PKCS11_ED25519
  PKCS11_GOST
-@@ -1037,6 +1039,7 @@ with_eddsa
+@@ -1035,6 +1037,7 @@ with_eddsa
  with_aes
  enable_openssl_hash
  with_cc_alg
@@ -735,7 +736,7 @@ index c83773a..ac1ea3f 100755
  with_lmdb
  with_libxml2
  with_libjson
-@@ -1730,6 +1733,7 @@ Optional Features:
+@@ -1728,6 +1731,7 @@ Optional Features:
    --enable-threads        enable multithreading
    --enable-native-pkcs11  use native PKCS11 for all crypto [default=no]
    --enable-openssl-hash   use OpenSSL for hash functions [default=no]
@@ -743,7 +744,7 @@ index c83773a..ac1ea3f 100755
    --enable-largefile      64-bit file support
    --enable-backtrace      log stack backtrace on abort [default=yes]
    --enable-symtable       use internal symbol table for backtrace
-@@ -16486,6 +16490,7 @@ case "$use_openssl" in
+@@ -16631,6 +16635,7 @@ case "$use_openssl" in
  $as_echo "disabled because of native PKCS11" >&6; }
  		DST_OPENSSL_INC=""
  		CRYPTO="-DPKCS11CRYPTO"
@@ -751,7 +752,7 @@ index c83773a..ac1ea3f 100755
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -16500,6 +16505,7 @@ $as_echo "disabled because of native PKCS11" >&6; }
+@@ -16645,6 +16650,7 @@ $as_echo "disabled because of native PKCS11" >&6; }
  $as_echo "no" >&6; }
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -759,7 +760,7 @@ index c83773a..ac1ea3f 100755
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -16512,6 +16518,7 @@ $as_echo "no" >&6; }
+@@ -16657,6 +16663,7 @@ $as_echo "no" >&6; }
  	auto)
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -767,7 +768,7 @@ index c83773a..ac1ea3f 100755
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -16521,7 +16528,7 @@ $as_echo "no" >&6; }
+@@ -16666,7 +16673,7 @@ $as_echo "no" >&6; }
  		OPENSSLLINKOBJS=""
  		OPENSSLLINKSRCS=""
  		as_fn_error $? "OpenSSL was not found in any of $openssldirs; use --with-openssl=/path
@@ -776,7 +777,7 @@ index c83773a..ac1ea3f 100755
  		;;
  	*)
  		if test "yes" = "$want_native_pkcs11"
-@@ -16552,6 +16559,7 @@ $as_echo "not found" >&6; }
+@@ -16697,6 +16704,7 @@ $as_echo "not found" >&6; }
  			as_fn_error $? "\"$use_openssl/include/openssl/opensslv.h\" not found" "$LINENO" 5
  		fi
  		CRYPTO='-DOPENSSL'
@@ -784,7 +785,7 @@ index c83773a..ac1ea3f 100755
  		if test "/usr" = "$use_openssl"
  		then
  			DST_OPENSSL_INC=""
-@@ -17213,8 +17221,6 @@ fi
+@@ -17358,8 +17366,6 @@ fi
  # Use OpenSSL for hash functions
  #
  
@@ -793,7 +794,7 @@ index c83773a..ac1ea3f 100755
  ISC_PLATFORM_OPENSSLHASH="#undef ISC_PLATFORM_OPENSSLHASH"
  case $want_openssl_hash in
  	yes)
-@@ -17583,6 +17589,86 @@ if test "rt" = "$have_clock_gt"; then
+@@ -17728,6 +17734,86 @@ if test "rt" = "$have_clock_gt"; then
  	LIBS="-lrt $LIBS"
  fi
  
@@ -880,7 +881,7 @@ index c83773a..ac1ea3f 100755
  #
  # was --with-lmdb specified?
  #
-@@ -19665,9 +19751,12 @@ _ACEOF
+@@ -19810,9 +19896,12 @@ _ACEOF
  if ac_fn_c_try_compile "$LINENO"; then :
    { $as_echo "$as_me:${as_lineno-$LINENO}: result: size_t for buflen; int for flags" >&5
  $as_echo "size_t for buflen; int for flags" >&6; }
@@ -895,7 +896,7 @@ index c83773a..ac1ea3f 100755
  
  	 $as_echo "#define IRS_GETNAMEINFO_FLAGS_T int" >>confdefs.h
  
-@@ -21032,12 +21121,7 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
+@@ -21123,12 +21212,7 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
  ISC_PLATFORM_USESTDASM="#undef ISC_PLATFORM_USESTDASM"
  ISC_PLATFORM_USEMACASM="#undef ISC_PLATFORM_USEMACASM"
  if test "yes" = "$use_atomic"; then
@@ -909,7 +910,7 @@ index c83773a..ac1ea3f 100755
  # version HP92453-01 B.11.11.23709.GP, which incorrectly rejects
  # declarations like `int a3[[(sizeof (unsigned char)) >= 0]];'.
  # This bug is HP SR number 8606223364.
-@@ -21070,6 +21154,11 @@ cat >>confdefs.h <<_ACEOF
+@@ -21161,6 +21245,11 @@ cat >>confdefs.h <<_ACEOF
  _ACEOF
  
  
@@ -921,7 +922,7 @@ index c83773a..ac1ea3f 100755
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -21078,39 +21167,6 @@ _ACEOF
+@@ -21169,39 +21258,6 @@ _ACEOF
  		fi
  	;;
  	x86_64-*|amd64-*)
@@ -961,7 +962,7 @@ index c83773a..ac1ea3f 100755
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -21141,6 +21197,10 @@ $as_echo_n "checking architecture type for atomic operations... " >&6; }
+@@ -21232,6 +21288,10 @@ $as_echo_n "checking architecture type for atomic operations... " >&6; }
  $as_echo "$arch" >&6; }
  fi
  
@@ -972,7 +973,7 @@ index c83773a..ac1ea3f 100755
  if test "yes" = "$have_atomic"; then
  	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking compiler support for inline assembly code" >&5
  $as_echo_n "checking compiler support for inline assembly code... " >&6; }
-@@ -23428,6 +23488,30 @@ CFLAGS="$CFLAGS $SO_CFLAGS"
+@@ -23519,6 +23579,30 @@ CFLAGS="$CFLAGS $SO_CFLAGS"
  #
  dlzdir='${DLZ_DRIVER_DIR}'
  
@@ -1003,7 +1004,7 @@ index c83773a..ac1ea3f 100755
  #
  # Private autoconf macro to simplify configuring drivers:
  #
-@@ -23758,11 +23842,11 @@ $as_echo "no" >&6; }
+@@ -23849,11 +23933,11 @@ $as_echo "no" >&6; }
  $as_echo "using mysql with libs ${mysql_lib} and includes ${mysql_include}" >&6; }
  		;;
  	*)
@@ -1018,7 +1019,7 @@ index c83773a..ac1ea3f 100755
  		fi
  
  	CONTRIB_DLZ="$CONTRIB_DLZ -DDLZ_MYSQL"
-@@ -23847,7 +23931,7 @@ $as_echo "" >&6; }
+@@ -23938,7 +24022,7 @@ $as_echo "" >&6; }
  			# Check other locations for includes.
  			# Order is important (sigh).
  
@@ -1027,13 +1028,12 @@ index c83773a..ac1ea3f 100755
  			# include a blank element first
  			for d in "" $bdb_incdirs
  			do
-@@ -23872,57 +23956,9 @@ $as_echo "" >&6; }
+@@ -23963,57 +24047,9 @@ $as_echo "" >&6; }
  			bdb_libnames="db53 db-5.3 db51 db-5.1 db48 db-4.8 db47 db-4.7 db46 db-4.6 db45 db-4.5 db44 db-4.4 db43 db-4.3 db42 db-4.2 db41 db-4.1 db"
  			for d in $bdb_libnames
  			do
 -				if test "$dd" = "/usr"
-+				if test -f "$dd/${target_lib}/lib${d}.so"
- 				then
+-				then
 -					as_ac_Lib=`$as_echo "ac_cv_lib_$d''_db_create" | $as_tr_sh`
 -{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for db_create in -l$d" >&5
 -$as_echo_n "checking for db_create in -l$d... " >&6; }
@@ -1081,13 +1081,14 @@ index c83773a..ac1ea3f 100755
 -						break
 -					fi
 -				elif test -f "$dd/lib/lib${d}.so"
--				then
++				if test -f "$dd/${target_lib}/lib${d}.so"
+ 				then
 -					dlz_bdb_libs="-L${dd}/lib -l${d}"
 +					dlz_bdb_libs="-L${dd}/${target_lib}/libdb -l${d}"
  					break
  				fi
  			done
-@@ -24081,10 +24117,10 @@ $as_echo "no" >&6; }
+@@ -24172,10 +24208,10 @@ $as_echo "no" >&6; }
  		DLZ_DRIVER_INCLUDES="$DLZ_DRIVER_INCLUDES -I$use_dlz_ldap/include"
  		DLZ_DRIVER_LDAP_INCLUDES="-I$use_dlz_ldap/include"
  	fi
@@ -1101,7 +1102,7 @@ index c83773a..ac1ea3f 100755
  	fi
  
  
-@@ -24170,11 +24206,11 @@ fi
+@@ -24261,11 +24297,11 @@ fi
  		odbcdirs="/usr /usr/local /usr/pkg"
  		for d in $odbcdirs
  		do
@@ -1115,7 +1116,7 @@ index c83773a..ac1ea3f 100755
  				break
  			fi
  		done
-@@ -24449,6 +24485,8 @@ DNS_CRYPTO_LIBS="$NEWFLAGS"
+@@ -24540,6 +24576,8 @@ DNS_CRYPTO_LIBS="$NEWFLAGS"
  
  
  
@@ -1124,7 +1125,7 @@ index c83773a..ac1ea3f 100755
  #
  # Commands to run at the end of config.status.
  # Don't just put these into configure, it won't work right if somebody
-@@ -26839,6 +26877,8 @@ report() {
+@@ -26930,6 +26968,8 @@ report() {
  	    echo "    IPv6 support (--enable-ipv6)"
  	test "X$CRYPTO" = "X" -o "yes" = "$want_native_pkcs11" || \
  		echo "    OpenSSL cryptography/DNSSEC (--with-openssl)"
@@ -1133,7 +1134,7 @@ index c83773a..ac1ea3f 100755
  	test "X$PYTHON" = "X" || echo "    Python tools (--with-python)"
  	test "X$XMLSTATS" = "X" || echo "    XML statistics (--with-libxml2)"
  	test "X$JSONSTATS" = "X" || echo "    JSON statistics (--with-libjson)"
-@@ -26879,6 +26919,8 @@ report() {
+@@ -26970,6 +27010,8 @@ report() {
  	echo "    Very verbose query trace logging (--enable-querytrace)"
      test "no" = "$atf" || echo "    Automated Testing Framework (--with-atf)"
  
@@ -1142,7 +1143,7 @@ index c83773a..ac1ea3f 100755
      echo "    Dynamically loadable zone (DLZ) drivers:"
      test "no" = "$use_dlz_bdb" || \
  	echo "        Berkeley DB (--with-dlz-bdb)"
-@@ -26926,6 +26968,8 @@ report() {
+@@ -27017,6 +27059,8 @@ report() {
  	echo "    ECDSA algorithm support (--with-ecdsa)"
      test "X$CRYPTO" = "X" -o "yes" = "$OPENSSL_ED25519" -o "yes" = "$PKCS11_ED25519" || \
  	echo "    EDDSA algorithm support (--with-eddsa)"
@@ -1152,10 +1153,10 @@ index c83773a..ac1ea3f 100755
      test "yes" = "$enable_seccomp" || \
  	echo "    Use libseccomp system call filtering (--enable-seccomp)"
 diff --git a/configure.in b/configure.in
-index 9a1d16d..849fa94 100644
+index b07895f..898b4ac 100644
 --- a/configure.in
 +++ b/configure.in
-@@ -1597,6 +1597,7 @@ case "$use_openssl" in
+@@ -1542,6 +1542,7 @@ case "$use_openssl" in
  		AC_MSG_RESULT(disabled because of native PKCS11)
  		DST_OPENSSL_INC=""
  		CRYPTO="-DPKCS11CRYPTO"
@@ -1163,7 +1164,7 @@ index 9a1d16d..849fa94 100644
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -1610,6 +1611,7 @@ case "$use_openssl" in
+@@ -1555,6 +1556,7 @@ case "$use_openssl" in
  		AC_MSG_RESULT(no)
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -1171,7 +1172,7 @@ index 9a1d16d..849fa94 100644
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -1622,6 +1624,7 @@ case "$use_openssl" in
+@@ -1567,6 +1569,7 @@ case "$use_openssl" in
  	auto)
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -1179,7 +1180,7 @@ index 9a1d16d..849fa94 100644
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -1632,7 +1635,7 @@ case "$use_openssl" in
+@@ -1577,7 +1580,7 @@ case "$use_openssl" in
  		OPENSSLLINKSRCS=""
  		AC_MSG_ERROR(
  [OpenSSL was not found in any of $openssldirs; use --with-openssl=/path
@@ -1188,7 +1189,7 @@ index 9a1d16d..849fa94 100644
  		;;
  	*)
  		if test "yes" = "$want_native_pkcs11"
-@@ -1662,6 +1665,7 @@ If you don't want OpenSSL, use --without-openssl])
+@@ -1607,6 +1610,7 @@ If you don't want OpenSSL, use --without-openssl])
  			AC_MSG_ERROR(["$use_openssl/include/openssl/opensslv.h" not found])
  		fi
  		CRYPTO='-DOPENSSL'
@@ -1196,7 +1197,7 @@ index 9a1d16d..849fa94 100644
  		if test "/usr" = "$use_openssl"
  		then
  			DST_OPENSSL_INC=""
-@@ -2135,7 +2139,6 @@ fi
+@@ -2080,7 +2084,6 @@ fi
  # Use OpenSSL for hash functions
  #
  
@@ -1204,7 +1205,7 @@ index 9a1d16d..849fa94 100644
  ISC_PLATFORM_OPENSSLHASH="#undef ISC_PLATFORM_OPENSSLHASH"
  case $want_openssl_hash in
  	yes)
-@@ -2402,6 +2405,67 @@ if test "rt" = "$have_clock_gt"; then
+@@ -2347,6 +2350,67 @@ if test "rt" = "$have_clock_gt"; then
  	LIBS="-lrt $LIBS"
  fi
  
@@ -1272,7 +1273,7 @@ index 9a1d16d..849fa94 100644
  #
  # was --with-lmdb specified?
  #
-@@ -4235,12 +4299,12 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
+@@ -4139,12 +4203,12 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
  ISC_PLATFORM_USESTDASM="#undef ISC_PLATFORM_USESTDASM"
  ISC_PLATFORM_USEMACASM="#undef ISC_PLATFORM_USEMACASM"
  if test "yes" = "$use_atomic"; then
@@ -1286,7 +1287,7 @@ index 9a1d16d..849fa94 100644
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -4249,7 +4313,6 @@ if test "yes" = "$use_atomic"; then
+@@ -4153,7 +4217,6 @@ if test "yes" = "$use_atomic"; then
  		fi
  	;;
  	x86_64-*|amd64-*)
@@ -1294,7 +1295,7 @@ index 9a1d16d..849fa94 100644
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -5613,6 +5676,8 @@ report() {
+@@ -5517,6 +5580,8 @@ report() {
  	    echo "    IPv6 support (--enable-ipv6)"
  	test "X$CRYPTO" = "X" -o "yes" = "$want_native_pkcs11" || \
  		echo "    OpenSSL cryptography/DNSSEC (--with-openssl)"
@@ -1303,7 +1304,7 @@ index 9a1d16d..849fa94 100644
  	test "X$PYTHON" = "X" || echo "    Python tools (--with-python)"
  	test "X$XMLSTATS" = "X" || echo "    XML statistics (--with-libxml2)"
  	test "X$JSONSTATS" = "X" || echo "    JSON statistics (--with-libjson)"
-@@ -5653,6 +5718,8 @@ report() {
+@@ -5557,6 +5622,8 @@ report() {
  	echo "    Very verbose query trace logging (--enable-querytrace)"
      test "no" = "$atf" || echo "    Automated Testing Framework (--with-atf)"
  
@@ -1312,7 +1313,7 @@ index 9a1d16d..849fa94 100644
      echo "    Dynamically loadable zone (DLZ) drivers:"
      test "no" = "$use_dlz_bdb" || \
  	echo "        Berkeley DB (--with-dlz-bdb)"
-@@ -5700,6 +5767,8 @@ report() {
+@@ -5604,6 +5671,8 @@ report() {
  	echo "    ECDSA algorithm support (--with-ecdsa)"
      test "X$CRYPTO" = "X" -o "yes" = "$OPENSSL_ED25519" -o "yes" = "$PKCS11_ED25519" || \
  	echo "    EDDSA algorithm support (--with-eddsa)"
@@ -1322,10 +1323,10 @@ index 9a1d16d..849fa94 100644
      test "yes" = "$enable_seccomp" || \
  	echo "    Use libseccomp system call filtering (--enable-seccomp)"
 diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c
-index dbece0a..803e7b3 100644
+index 5703f9c..afb4d80 100644
 --- a/lib/dns/dst_api.c
 +++ b/lib/dns/dst_api.c
-@@ -274,6 +274,12 @@ dst_lib_init2(isc_mem_t *mctx, isc_entropy_t *ectx,
+@@ -276,6 +276,12 @@ dst_lib_init2(isc_mem_t *mctx, isc_entropy_t *ectx,
  #ifdef GSSAPI
  	RETERR(dst__gssapi_init(&dst_t_func[DST_ALG_GSSAPI]));
  #endif
@@ -1335,17 +1336,17 @@ index dbece0a..803e7b3 100644
 +		isc_entropy_sethook(dst_random_getdata);
 +#endif
 +#endif /* defined(OPENSSL) || defined(PKCS11CRYPTO) */
- 	dst_initialized = ISC_TRUE;
+ 	dst_initialized = true;
  	return (ISC_R_SUCCESS);
  
-@@ -293,11 +299,19 @@ dst_lib_destroy(void) {
+@@ -295,11 +301,19 @@ dst_lib_destroy(void) {
  	for (i = 0; i < DST_MAX_ALGS; i++)
  		if (dst_t_func[i] != NULL && dst_t_func[i]->cleanup != NULL)
  			dst_t_func[i]->cleanup();
 +#if defined(OPENSSL) || defined(PKCS11CRYPTO)
 +#ifdef ISC_PLATFORM_CRYPTORANDOM
 +	if (dst_entropy_pool != NULL) {
-+		isc_entropy_usehook(dst_entropy_pool, ISC_FALSE);
++		isc_entropy_usehook(dst_entropy_pool, false);
 +		isc_entropy_sethook(NULL);
 +	}
 +#endif
@@ -1358,7 +1359,7 @@ index dbece0a..803e7b3 100644
  	if (dst__memory_pool != NULL)
  		isc_mem_detach(&dst__memory_pool);
  	if (dst_entropy_pool != NULL)
-@@ -2000,13 +2014,17 @@ dst__entropy_getdata(void *buf, unsigned int len, isc_boolean_t pseudo) {
+@@ -1998,13 +2012,17 @@ dst__entropy_getdata(void *buf, unsigned int len, bool pseudo) {
  		flags &= ~ISC_ENTROPY_GOODONLY;
  	else
  		flags |= ISC_ENTROPY_BLOCKING;
@@ -1377,7 +1378,7 @@ index dbece0a..803e7b3 100644
  #ifdef GSSAPI
  	unsigned int flags = dst_entropy_flags;
  	isc_result_t ret;
-@@ -2029,6 +2047,7 @@ dst__entropy_status(void) {
+@@ -2027,6 +2045,7 @@ dst__entropy_status(void) {
  #endif
  	return (isc_entropy_status(dst_entropy_pool));
  #else
@@ -1386,10 +1387,10 @@ index dbece0a..803e7b3 100644
  #endif
  }
 diff --git a/lib/dns/include/dst/dst.h b/lib/dns/include/dst/dst.h
-index fcc7b47..d9b6ab6 100644
+index 32b0742..78e1277 100644
 --- a/lib/dns/include/dst/dst.h
 +++ b/lib/dns/include/dst/dst.h
-@@ -157,6 +157,14 @@ dst_lib_destroy(void);
+@@ -160,6 +160,14 @@ dst_lib_destroy(void);
   * Releases all resources allocated by DST.
   */
  
@@ -1401,38 +1402,30 @@ index fcc7b47..d9b6ab6 100644
 + * Specialization of isc_entropy_getdata().
 + */
 +
- isc_boolean_t
+ bool
  dst_algorithm_supported(unsigned int alg);
  /*%<
 diff --git a/lib/dns/lib.c b/lib/dns/lib.c
-index 53237d5..c6d83e9 100644
+index 304814b..60543c4 100644
 --- a/lib/dns/lib.c
 +++ b/lib/dns/lib.c
-@@ -9,14 +9,13 @@
-  * information regarding copyright ownership.
-  */
- 
--/* $Id: lib.c,v 1.19 2009/09/03 00:12:23 each Exp $ */
--
- /*! \file */
- 
- #include <config.h>
- 
+@@ -18,6 +18,7 @@
+ #include <stdbool.h>
  #include <stddef.h>
  
 +#include <isc/entropy.h>
  #include <isc/hash.h>
  #include <isc/mem.h>
  #include <isc/msgcat.h>
-@@ -77,6 +76,7 @@ static unsigned int references = 0;
+@@ -78,6 +79,7 @@ static unsigned int references = 0;
  static void
  initialize(void) {
  	isc_result_t result;
 +	isc_entropy_t *ectx = NULL;
  
- 	REQUIRE(initialize_done == ISC_FALSE);
+ 	REQUIRE(initialize_done == false);
  
-@@ -87,11 +87,14 @@ initialize(void) {
+@@ -88,11 +90,14 @@ initialize(void) {
  	result = dns_ecdb_register(dns_g_mctx, &dbimp);
  	if (result != ISC_R_SUCCESS)
  		goto cleanup_mctx;
@@ -1449,14 +1442,14 @@ index 53237d5..c6d83e9 100644
  	if (result != ISC_R_SUCCESS)
  		goto cleanup_hash;
  
-@@ -99,11 +102,17 @@ initialize(void) {
+@@ -100,11 +105,17 @@ initialize(void) {
  	if (result != ISC_R_SUCCESS)
  		goto cleanup_dst;
  
 +	isc_hash_init();
 +	isc_entropy_detach(&ectx);
 +
- 	initialize_done = ISC_TRUE;
+ 	initialize_done = true;
  	return;
  
    cleanup_dst:
@@ -1468,7 +1461,7 @@ index 53237d5..c6d83e9 100644
  	isc_hash_destroy();
    cleanup_db:
 diff --git a/lib/dns/openssl_link.c b/lib/dns/openssl_link.c
-index ec6dc7f..c1e1bde 100644
+index a30a2ab..d88d643 100644
 --- a/lib/dns/openssl_link.c
 +++ b/lib/dns/openssl_link.c
 @@ -31,6 +31,7 @@
@@ -1764,68 +1757,61 @@ index 58fa872..625e809 100644
  	sh ${top_builddir}/unit/unittest.sh
  
 diff --git a/lib/dns/tests/dnstest.c b/lib/dns/tests/dnstest.c
-index fb9ef53..344a7c2 100644
+index 51bb90b..1b25b90 100644
 --- a/lib/dns/tests/dnstest.c
 +++ b/lib/dns/tests/dnstest.c
-@@ -120,12 +120,12 @@ dns_test_begin(FILE *logfile, isc_boolean_t start_managers) {
+@@ -122,12 +122,12 @@ dns_test_begin(FILE *logfile, bool start_managers) {
  	CHECK(isc_mem_create(0, 0, &mctx));
  	CHECK(isc_entropy_create(mctx, &ectx));
  
 -	CHECK(isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE));
--	hash_active = ISC_TRUE;
+-	hash_active = true;
 -
  	CHECK(dst_lib_init(mctx, ectx, ISC_ENTROPY_BLOCKING));
- 	dst_active = ISC_TRUE;
+ 	dst_active = true;
  
 +	CHECK(isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE));
-+	hash_active = ISC_TRUE;
++	hash_active = true;
 +
  	if (logfile != NULL) {
  		isc_logdestination_t destination;
  		isc_logconfig_t *logconfig = NULL;
-@@ -169,14 +169,14 @@ dns_test_begin(FILE *logfile, isc_boolean_t start_managers) {
+@@ -171,14 +171,14 @@ dns_test_begin(FILE *logfile, bool start_managers) {
  
  void
  dns_test_end(void) {
 -	if (dst_active) {
 -		dst_lib_destroy();
--		dst_active = ISC_FALSE;
+-		dst_active = false;
 -	}
  	if (hash_active) {
  		isc_hash_destroy();
- 		hash_active = ISC_FALSE;
+ 		hash_active = false;
  	}
 +	if (dst_active) {
 +		dst_lib_destroy();
-+		dst_active = ISC_FALSE;
++		dst_active = false;
 +	}
  	if (ectx != NULL)
  		isc_entropy_detach(&ectx);
  
 diff --git a/lib/dns/tests/dstrandom_test.c b/lib/dns/tests/dstrandom_test.c
 new file mode 100644
-index 0000000..d2c72e7
+index 0000000..b980d8a
 --- /dev/null
 +++ b/lib/dns/tests/dstrandom_test.c
-@@ -0,0 +1,105 @@
+@@ -0,0 +1,99 @@
 +/*
-+ * Copyright (C) 2014  Internet Systems Consortium, Inc. ("ISC")
++ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 + *
-+ * Permission to use, copy, modify, and/or distribute this software for any
-+ * purpose with or without fee is hereby granted, provided that the above
-+ * copyright notice and this permission notice appear in all copies.
++ * This Source Code Form is subject to the terms of the Mozilla Public
++ * License, v. 2.0. If a copy of the MPL was not distributed with this
++ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
 + *
-+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
-+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
-+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
-+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
-+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
-+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
-+ * PERFORMANCE OF THIS SOFTWARE.
++ * See the COPYRIGHT file distributed with this work for additional
++ * information regarding copyright ownership.
 + */
 +
-+/* $Id$ */
-+
 +/*! \file */
 +
 +#include <config.h>
@@ -1834,6 +1820,7 @@ index 0000000..d2c72e7
 +
 +#include <stdio.h>
 +#include <string.h>
++#include <unistd.h>
 +
 +#include <isc/entropy.h>
 +#include <isc/mem.h>
@@ -1868,7 +1855,7 @@ index 0000000..d2c72e7
 +	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
 +
 +#ifdef ISC_PLATFORM_CRYPTORANDOM
-+	isc_entropy_usehook(ectx, ISC_TRUE);
++	isc_entropy_usehook(ectx, true);
 +
 +	returned = 0;
 +	result = isc_entropy_getdata(ectx, buffer, sizeof(buffer),
@@ -1879,7 +1866,7 @@ index 0000000..d2c72e7
 +	status = isc_entropy_status(ectx);
 +	ATF_REQUIRE_EQ(status, 0);
 +
-+	isc_entropy_usehook(ectx, ISC_FALSE);
++	isc_entropy_usehook(ectx, false);
 +#endif
 +
 +	ret = chdir(TESTS);
@@ -1914,10 +1901,10 @@ index 0000000..d2c72e7
 +}
 +
 diff --git a/lib/dns/win32/libdns.def.in b/lib/dns/win32/libdns.def.in
-index d48eeb2..213e9d9 100644
+index 62a156c..bf83fe5 100644
 --- a/lib/dns/win32/libdns.def.in
 +++ b/lib/dns/win32/libdns.def.in
-@@ -1480,6 +1480,13 @@ dst_lib_destroy
+@@ -1483,6 +1483,13 @@ dst_lib_destroy
  dst_lib_init
  dst_lib_init2
  dst_lib_initmsgcat
@@ -1932,14 +1919,14 @@ index d48eeb2..213e9d9 100644
  dst_region_computerid
  dst_result_register
 diff --git a/lib/isc/entropy.c b/lib/isc/entropy.c
-index 232094a..a85650b 100644
+index ab2f617..ed05ed6 100644
 --- a/lib/isc/entropy.c
 +++ b/lib/isc/entropy.c
-@@ -103,11 +103,15 @@ struct isc_entropy {
- 	isc_uint32_t			initialized;
- 	isc_uint32_t			initcount;
+@@ -104,11 +104,15 @@ struct isc_entropy {
+ 	uint32_t			initialized;
+ 	uint32_t			initcount;
  	isc_entropypool_t		pool;
-+	isc_boolean_t			usehook;
++	bool				usehook;
  	unsigned int			nsources;
  	isc_entropysource_t	       *nextsource;
  	ISC_LIST(isc_entropysource_t)	sources;
@@ -1950,8 +1937,8 @@ index 232094a..a85650b 100644
 +
  /*% Sample Queue */
  typedef struct {
- 	isc_uint32_t	last_time;	/*%< last time recorded */
-@@ -556,6 +560,11 @@ isc_entropy_getdata(isc_entropy_t *ent, void *data, unsigned int length,
+ 	uint32_t	last_time;	/*%< last time recorded */
+@@ -557,6 +561,11 @@ isc_entropy_getdata(isc_entropy_t *ent, void *data, unsigned int length,
  
  	LOCK(&ent->lock);
  
@@ -1963,11 +1950,11 @@ index 232094a..a85650b 100644
  	remain = length;
  	buf = data;
  	total = 0;
-@@ -707,6 +716,7 @@ isc_entropy_create(isc_mem_t *mctx, isc_entropy_t **entp) {
+@@ -708,6 +717,7 @@ isc_entropy_create(isc_mem_t *mctx, isc_entropy_t **entp) {
  	ent->refcnt = 1;
  	ent->initialized = 0;
  	ent->initcount = 0;
-+	ent->usehook = ISC_FALSE;
++	ent->usehook = false;
  	ent->magic = ENTROPY_MAGIC;
  
  	isc_entropypool_init(&ent->pool);
@@ -1977,7 +1964,7 @@ index 232094a..a85650b 100644
  }
 +
 +void
-+isc_entropy_usehook(isc_entropy_t *ectx, isc_boolean_t onoff) {
++isc_entropy_usehook(isc_entropy_t *ectx, bool onoff) {
 +	REQUIRE(VALID_ENTROPY(ectx));
 +
 +	LOCK(&ectx->lock);
@@ -1990,15 +1977,15 @@ index 232094a..a85650b 100644
 +	hook = myhook;
 +}
 diff --git a/lib/isc/include/isc/entropy.h b/lib/isc/include/isc/entropy.h
-index d52c43e..d9deb8a 100644
+index 4bba8e1..632166a 100644
 --- a/lib/isc/include/isc/entropy.h
 +++ b/lib/isc/include/isc/entropy.h
-@@ -303,6 +303,18 @@ isc_entropy_usebestsource(isc_entropy_t *ectx, isc_entropysource_t **source,
+@@ -304,6 +304,18 @@ isc_entropy_usebestsource(isc_entropy_t *ectx, isc_entropysource_t **source,
   *	isc_entropy_createcallbacksource().
   */
  
 +void
-+isc_entropy_usehook(isc_entropy_t *ectx, isc_boolean_t onoff);
++isc_entropy_usehook(isc_entropy_t *ectx, bool onoff);
 +/*!<
 + * \brief Mark/unmark the given entropy structure as being hooked.
 + */
@@ -2013,10 +2000,10 @@ index d52c43e..d9deb8a 100644
  
  #endif /* ISC_ENTROPY_H */
 diff --git a/lib/isc/include/isc/platform.h.in b/lib/isc/include/isc/platform.h.in
-index d7a5bec..0166b79 100644
+index 9c7c342..ee8dc3e 100644
 --- a/lib/isc/include/isc/platform.h.in
 +++ b/lib/isc/include/isc/platform.h.in
-@@ -344,6 +344,11 @@
+@@ -341,6 +341,11 @@
   */
  @ISC_PLATFORM_HAVESTRINGSH@
  
@@ -2029,7 +2016,7 @@ index d7a5bec..0166b79 100644
   * Define if the hash functions must be provided by OpenSSL.
   */
 diff --git a/lib/isc/include/isc/types.h b/lib/isc/include/isc/types.h
-index f161faf..dec577e 100644
+index 42ff7e0..8d87c44 100644
 --- a/lib/isc/include/isc/types.h
 +++ b/lib/isc/include/isc/types.h
 @@ -93,6 +93,8 @@ typedef struct isc_time			isc_time_t;		/*%< Time */
@@ -2042,10 +2029,10 @@ index f161faf..dec577e 100644
  typedef int (*isc_sockfdwatch_t)(isc_task_t *, isc_socket_t *, void *, int);
  
 diff --git a/lib/isc/pk11.c b/lib/isc/pk11.c
-index 48e1031..74566c9 100644
+index a01e698..875c232 100644
 --- a/lib/isc/pk11.c
 +++ b/lib/isc/pk11.c
-@@ -327,14 +327,16 @@ pk11_rand_seed_fromfile(const char *randomfile) {
+@@ -321,14 +321,16 @@ pk11_rand_seed_fromfile(const char *randomfile) {
  	ret = isc_stdio_open(randomfile, "r", &stream);
  	if (ret != ISC_R_SUCCESS)
  		goto cleanup;
@@ -2068,10 +2055,10 @@ index 48e1031..74566c9 100644
      cleanup:
  	if (stream != NULL)
 diff --git a/lib/isc/win32/include/isc/platform.h.in b/lib/isc/win32/include/isc/platform.h.in
-index de6a434..2c32782 100644
+index 5b8a2c9..913a2ce 100644
 --- a/lib/isc/win32/include/isc/platform.h.in
 +++ b/lib/isc/win32/include/isc/platform.h.in
-@@ -74,6 +74,11 @@
+@@ -69,6 +69,11 @@
  #define ISC_PLATFORM_NORETURN_PRE __declspec(noreturn)
  #define ISC_PLATFORM_NORETURN_POST
  
@@ -2084,7 +2071,7 @@ index de6a434..2c32782 100644
   * Define if the hash functions must be provided by OpenSSL.
   */
 diff --git a/win32utils/Configure b/win32utils/Configure
-index e9f4680..79bb178 100644
+index ff596b7..09b476f 100644
 --- a/win32utils/Configure
 +++ b/win32utils/Configure
 @@ -381,6 +381,7 @@ my @substdefh = ("AES_CC",
@@ -2146,7 +2133,7 @@ index e9f4680..79bb178 100644
      if ($enable_openssl_hash eq "yes") {
          print "openssl-hash: enabled\n";
      } else {
-@@ -1449,6 +1463,7 @@ if ($enable_intrinsics eq "yes") {
+@@ -1454,6 +1468,7 @@ if ($enable_intrinsics eq "yes") {
  
  # enable-native-pkcs11
  if ($enable_native_pkcs11 eq "yes") {
@@ -2154,7 +2141,7 @@ index e9f4680..79bb178 100644
      if ($use_openssl eq "auto") {
          $use_openssl = "no";
      }
-@@ -1658,6 +1673,7 @@ if ($use_openssl eq "yes") {
+@@ -1663,6 +1678,7 @@ if ($use_openssl eq "yes") {
          $openssl_dll = File::Spec->catdir($openssl_path, "@dirlist[0]");
      }   
  
@@ -2162,7 +2149,7 @@ index e9f4680..79bb178 100644
      $configcond{"OPENSSL"} = 1;
      $configdefd{"CRYPTO"} = "OPENSSL";
      $configvar{"OPENSSL_PATH"} = "$openssl_path";
-@@ -2209,6 +2225,15 @@ if ($cookie_algorithm eq "sha1") {
+@@ -2214,6 +2230,15 @@ if ($cookie_algorithm eq "sha1") {
      die "Unrecognized cookie algorithm: $cookie_algorithm\n";
  }
  
@@ -2178,7 +2165,7 @@ index e9f4680..79bb178 100644
  # enable-openssl-hash
  if ($enable_openssl_hash eq "yes") {
      if ($use_openssl eq "no") {
-@@ -3531,6 +3556,7 @@ exit 0;
+@@ -3536,6 +3561,7 @@ exit 0;
  #  --enable-developer partially supported
  #  --enable-newstats (9.9/9.9sub only)
  #  --enable-native-pkcs11 supported
@@ -2186,7 +2173,7 @@ index e9f4680..79bb178 100644
  #  --enable-openssl-version-check included without a way to disable it
  #  --enable-openssl-hash supported
  #  --enable-threads included without a way to disable it
-@@ -3556,6 +3582,7 @@ exit 0;
+@@ -3561,6 +3587,7 @@ exit 0;
  #  --with-gost supported
  #  --with-aes supported
  #  --with-cc-alg supported
diff --git a/bind-9.11-rt46047.patch b/bind-9.11-rt46047.patch
index 78b3b1c..3cb3c0f 100644
--- a/bind-9.11-rt46047.patch
+++ b/bind-9.11-rt46047.patch
@@ -1,4 +1,4 @@
-From 1ab1aabcf9b2b8de144bab7a3ff5d9f7e6ec9ad4 Mon Sep 17 00:00:00 2001
+From 9a074d5cd6c6276d95bc1cce3a14afaabc88c6c5 Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Thu, 28 Sep 2017 10:09:22 -0700
 Subject: [PATCH] completed and corrected the crypto-random change
@@ -39,17 +39,17 @@ Subject: [PATCH] completed and corrected the crypto-random change
  bin/tests/system/tkey/keycreate.c        |  4 +--
  bin/tests/system/tkey/keydelete.c        |  4 +--
  doc/arm/Bv9ARM-book.xml                  | 55 ++++++++++++++++++++++----------
- doc/arm/notes.xml                        | 23 ++++++++++++-
- lib/dns/dst_api.c                        |  7 ++--
+ doc/arm/notes.xml                        | 26 +++++++++++++++
+ lib/dns/dst_api.c                        |  4 ++-
  lib/dns/include/dst/dst.h                | 14 ++++++--
  lib/dns/openssl_link.c                   |  3 +-
  lib/isc/include/isc/entropy.h            | 50 +++++++++++++++++++++--------
  lib/isc/include/isc/random.h             | 28 ++++++++++------
  lib/isccfg/namedconf.c                   |  2 +-
- 22 files changed, 219 insertions(+), 110 deletions(-)
+ 22 files changed, 221 insertions(+), 108 deletions(-)
 
 diff --git a/bin/confgen/keygen.c b/bin/confgen/keygen.c
-index fa439cc..a7ad417 100644
+index 295e16f..0f79aa8 100644
 --- a/bin/confgen/keygen.c
 +++ b/bin/confgen/keygen.c
 @@ -161,17 +161,15 @@ generate_key(isc_mem_t *mctx, const char *randomfile, dns_secalg_t alg,
@@ -65,7 +65,7 @@ index fa439cc..a7ad417 100644
 -	    strcmp(randomfile, ISC_PLATFORM_CRYPTORANDOM) == 0) {
 -		randomfile = NULL;
 +	if (randomfile == NULL) {
- 		isc_entropy_usehook(ectx, ISC_TRUE);
+ 		isc_entropy_usehook(ectx, true);
  	}
  #endif
 +	if (randomfile != NULL && strcmp(randomfile, "keyboard") == 0) {
@@ -112,16 +112,16 @@ index 96dfef6..1c84b06 100644
  	</listitem>
        </varlistentry>
 diff --git a/bin/dnssec/dnssectool.c b/bin/dnssec/dnssectool.c
-index 4ea9eaf..5dd9475 100644
+index 31a99e7..38c83ed 100644
 --- a/bin/dnssec/dnssectool.c
 +++ b/bin/dnssec/dnssectool.c
-@@ -239,18 +239,16 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
+@@ -241,18 +241,16 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
  		ISC_LIST_INIT(sources);
  	}
  
 +#ifdef ISC_PLATFORM_CRYPTORANDOM
 +	if (randomfile == NULL) {
-+		isc_entropy_usehook(*ectx, ISC_TRUE);
++		isc_entropy_usehook(*ectx, true);
 +	}
 +#endif
  	if (randomfile != NULL && strcmp(randomfile, "keyboard") == 0) {
@@ -133,17 +133,17 @@ index 4ea9eaf..5dd9475 100644
 -	if (randomfile != NULL &&
 -	    strcmp(randomfile, ISC_PLATFORM_CRYPTORANDOM) == 0) {
 -		randomfile = NULL;
--		isc_entropy_usehook(*ectx, ISC_TRUE);
+-		isc_entropy_usehook(*ectx, true);
 -	}
 -#endif
  	result = isc_entropy_usebestsource(*ectx, &source, randomfile,
  					   usekeyboard);
  
 diff --git a/bin/named/client.c b/bin/named/client.c
-index b9ebc93..20e5f39 100644
+index 0f6e162..5e39b82 100644
 --- a/bin/named/client.c
 +++ b/bin/named/client.c
-@@ -1605,7 +1605,8 @@ ns_client_addopt(ns_client_t *client, dns_message_t *message,
+@@ -1608,7 +1608,8 @@ ns_client_addopt(ns_client_t *client, dns_message_t *message,
  
  		isc_buffer_init(&buf, cookie, sizeof(cookie));
  		isc_stdtime_get(&now);
@@ -154,10 +154,10 @@ index b9ebc93..20e5f39 100644
  		compute_cookie(client, now, nonce, ns_g_server->secret, &buf);
  
 diff --git a/bin/named/config.c b/bin/named/config.c
-index c50f759..c1e72ef 100644
+index 2c4c93c..16ed248 100644
 --- a/bin/named/config.c
 +++ b/bin/named/config.c
-@@ -92,7 +92,9 @@ options {\n\
+@@ -93,7 +93,9 @@ options {\n\
  #	pid-file \"" NS_LOCALSTATEDIR "/run/named/named.pid\"; /* or /lwresd.pid */\n\
  	port 53;\n\
  	prefetch 2 9;\n"
@@ -169,10 +169,10 @@ index c50f759..c1e72ef 100644
  #endif
  "	recursing-file \"named.recursing\";\n\
 diff --git a/bin/named/controlconf.c b/bin/named/controlconf.c
-index 237e8dc..b905475 100644
+index d955c2f..40621f2 100644
 --- a/bin/named/controlconf.c
 +++ b/bin/named/controlconf.c
-@@ -322,9 +322,10 @@ log_invalid(isccc_ccmsg_t *ccmsg, isc_result_t result) {
+@@ -325,9 +325,10 @@ log_invalid(isccc_ccmsg_t *ccmsg, isc_result_t result) {
  
  static void
  control_recvmessage(isc_task_t *task, isc_event_t *event) {
@@ -185,8 +185,8 @@ index 237e8dc..b905475 100644
 +	controlkey_t *key = NULL;
  	isccc_sexpr_t *request = NULL;
  	isccc_sexpr_t *response = NULL;
- 	isc_uint32_t algorithm;
-@@ -335,16 +336,17 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
+ 	uint32_t algorithm;
+@@ -338,16 +339,17 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
  	isc_buffer_t *text;
  	isc_result_t result;
  	isc_result_t eresult;
@@ -194,7 +194,7 @@ index 237e8dc..b905475 100644
 +	isccc_sexpr_t *_ctrl = NULL;
  	isccc_time_t sent;
  	isccc_time_t exp;
- 	isc_uint32_t nonce;
+ 	uint32_t nonce;
 -	isccc_sexpr_t *data;
 +	isccc_sexpr_t *data = NULL;
  
@@ -206,25 +206,25 @@ index 237e8dc..b905475 100644
  	algorithm = DST_ALG_UNKNOWN;
  	secret.rstart = NULL;
  	text = NULL;
-@@ -455,8 +457,11 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
+@@ -458,8 +460,11 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
  	 * Establish nonce.
  	 */
  	if (conn->nonce == 0) {
 -		while (conn->nonce == 0)
 -			isc_random_get(&conn->nonce);
 +		while (conn->nonce == 0) {
-+			isc_uint16_t r1 = isc_rng_random(server->rngctx);
-+			isc_uint16_t r2 = isc_rng_random(server->rngctx);
++			uint16_t r1 = isc_rng_random(server->rngctx);
++			uint16_t r2 = isc_rng_random(server->rngctx);
 +			conn->nonce = (r1 << 16) | r2;
 +		}
  		eresult = ISC_R_SUCCESS;
  	} else
  		eresult = ns_control_docommand(request, listener->readonly, &text);
 diff --git a/bin/named/include/named/server.h b/bin/named/include/named/server.h
-index d8179a6..e03d24d 100644
+index f5ed2b7..b2c1d05 100644
 --- a/bin/named/include/named/server.h
 +++ b/bin/named/include/named/server.h
-@@ -17,6 +17,7 @@
+@@ -20,6 +20,7 @@
  #include <isc/log.h>
  #include <isc/magic.h>
  #include <isc/quota.h>
@@ -232,19 +232,19 @@ index d8179a6..e03d24d 100644
  #include <isc/sockaddr.h>
  #include <isc/types.h>
  #include <isc/xml.h>
-@@ -131,6 +132,7 @@ struct ns_server {
+@@ -134,6 +135,7 @@ struct ns_server {
  	char *			lockfile;
  
- 	isc_uint16_t		transfer_tcp_message_size;
+ 	uint16_t		transfer_tcp_message_size;
 +	isc_rng_t *		rngctx;
  };
  
  struct ns_altsecret {
 diff --git a/bin/named/interfacemgr.c b/bin/named/interfacemgr.c
-index d8c7188..50f924e 100644
+index 419927b..d721f47 100644
 --- a/bin/named/interfacemgr.c
 +++ b/bin/named/interfacemgr.c
-@@ -15,6 +15,7 @@
+@@ -17,6 +17,7 @@
  
  #include <isc/interfaceiter.h>
  #include <isc/os.h>
@@ -253,10 +253,10 @@ index d8c7188..50f924e 100644
  #include <isc/task.h>
  #include <isc/util.h>
 diff --git a/bin/named/query.c b/bin/named/query.c
-index accbf3b..d89622d 100644
+index f8dbef2..2f3c0ca 100644
 --- a/bin/named/query.c
 +++ b/bin/named/query.c
-@@ -18,6 +18,7 @@
+@@ -19,6 +19,7 @@
  #include <isc/hex.h>
  #include <isc/mem.h>
  #include <isc/print.h>
@@ -265,10 +265,10 @@ index accbf3b..d89622d 100644
  #include <isc/serial.h>
  #include <isc/stats.h>
 diff --git a/bin/named/server.c b/bin/named/server.c
-index ca789e5..1413e85 100644
+index 9258e7f..f4320df 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
-@@ -8076,21 +8076,30 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8164,21 +8164,30 @@ load_configuration(const char *filename, ns_server_t *server,
  	 * Open the source of entropy.
  	 */
  	if (first_time) {
@@ -291,8 +291,8 @@ index ca789e5..1413e85 100644
 +		if (randomdev == NULL) {
  #ifdef ISC_PLATFORM_CRYPTORANDOM
 -			if (strcmp(randomdev, ISC_PLATFORM_CRYPTORANDOM) == 0)
--				isc_entropy_usehook(ns_g_entropy, ISC_TRUE);
-+			isc_entropy_usehook(ns_g_entropy, ISC_TRUE);
+-				isc_entropy_usehook(ns_g_entropy, true);
++			isc_entropy_usehook(ns_g_entropy, true);
  #else
 -			int level = ISC_LOG_ERROR;
 -			result = isc_entropy_createfilesource(ns_g_entropy,
@@ -310,7 +310,7 @@ index ca789e5..1413e85 100644
  #ifdef PATH_RANDOMDEV
  			if (ns_g_fallbackentropy != NULL) {
  				level = ISC_LOG_INFO;
-@@ -8101,8 +8110,8 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8189,8 +8198,8 @@ load_configuration(const char *filename, ns_server_t *server,
  					      NS_LOGCATEGORY_GENERAL,
  					      NS_LOGMODULE_SERVER,
  					      level,
@@ -321,7 +321,7 @@ index ca789e5..1413e85 100644
  					      randomdev,
  					      isc_result_totext(result));
  			}
-@@ -8122,7 +8131,6 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8210,7 +8219,6 @@ load_configuration(const char *filename, ns_server_t *server,
  				}
  				isc_entropy_detach(&ns_g_fallbackentropy);
  			}
@@ -329,7 +329,7 @@ index ca789e5..1413e85 100644
  #endif
  		}
  	}
-@@ -8911,6 +8919,9 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
+@@ -8998,6 +9006,9 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
  	CHECKFATAL(dns_tkeyctx_create(ns_g_mctx, ns_g_entropy,
  				      &server->tkeyctx),
  		   "creating TKEY context");
@@ -339,7 +339,7 @@ index ca789e5..1413e85 100644
  
  	/*
  	 * Setup the server task, which is responsible for coordinating
-@@ -9117,7 +9128,8 @@ ns_server_destroy(ns_server_t **serverp) {
+@@ -9204,7 +9215,8 @@ ns_server_destroy(ns_server_t **serverp) {
  
  	if (server->zonemgr != NULL)
  		dns_zonemgr_detach(&server->zonemgr);
@@ -349,7 +349,7 @@ index ca789e5..1413e85 100644
  	if (server->tkeyctx != NULL)
  		dns_tkeyctx_destroy(&server->tkeyctx);
  
-@@ -13018,10 +13030,10 @@ newzone_cfgctx_destroy(void **cfgp) {
+@@ -13105,10 +13117,10 @@ newzone_cfgctx_destroy(void **cfgp) {
  
  static isc_result_t
  generate_salt(unsigned char *salt, size_t saltlen) {
@@ -357,19 +357,19 @@ index ca789e5..1413e85 100644
 +	size_t i, n;
  	union {
  		unsigned char rnd[256];
--		isc_uint32_t rnd32[64];
-+		isc_uint16_t rnd16[128];
+-		uint32_t rnd32[64];
++		uint16_t rnd16[128];
  	} rnd;
  	unsigned char text[512 + 1];
  	isc_region_t r;
-@@ -13031,9 +13043,10 @@ generate_salt(unsigned char *salt, size_t saltlen) {
+@@ -13118,9 +13130,10 @@ generate_salt(unsigned char *salt, size_t saltlen) {
  	if (saltlen > 256U)
  		return (ISC_R_RANGE);
  
--	n = (int) (saltlen + sizeof(isc_uint32_t) - 1) / sizeof(isc_uint32_t);
+-	n = (int) (saltlen + sizeof(uint32_t) - 1) / sizeof(uint32_t);
 -	for (i = 0; i < n; i++)
 -		isc_random_get(&rnd.rnd32[i]);
-+	n = (saltlen + sizeof(isc_uint16_t) - 1) / sizeof(isc_uint16_t);
++	n = (saltlen + sizeof(uint16_t) - 1) / sizeof(uint16_t);
 +	for (i = 0; i < n; i++) {
 +		rnd.rnd16[i] = isc_rng_random(ns_g_server->rngctx);
 +	}
@@ -377,10 +377,10 @@ index ca789e5..1413e85 100644
  	memmove(salt, rnd.rnd, saltlen);
  
 diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
-index 46c7acf..a0d0278 100644
+index 1559a33..68b9a99 100644
 --- a/bin/nsupdate/nsupdate.c
 +++ b/bin/nsupdate/nsupdate.c
-@@ -281,9 +281,7 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
+@@ -283,9 +283,7 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
  	}
  
  #ifdef ISC_PLATFORM_CRYPTORANDOM
@@ -388,14 +388,14 @@ index 46c7acf..a0d0278 100644
 -	    strcmp(randomfile, ISC_PLATFORM_CRYPTORANDOM) == 0) {
 -		randomfile = NULL;
 +	if (randomfile == NULL) {
- 		isc_entropy_usehook(*ectx, ISC_TRUE);
+ 		isc_entropy_usehook(*ectx, true);
  	}
  #endif
 diff --git a/bin/tests/system/pipelined/pipequeries.c b/bin/tests/system/pipelined/pipequeries.c
-index 810d99e..d7d10e2 100644
+index 7b4f617..507bf0a 100644
 --- a/bin/tests/system/pipelined/pipequeries.c
 +++ b/bin/tests/system/pipelined/pipequeries.c
-@@ -279,9 +279,7 @@ main(int argc, char *argv[]) {
+@@ -282,9 +282,7 @@ main(int argc, char *argv[]) {
  	ectx = NULL;
  	RUNCHECK(isc_entropy_create(mctx, &ectx));
  #ifdef ISC_PLATFORM_CRYPTORANDOM
@@ -403,11 +403,11 @@ index 810d99e..d7d10e2 100644
 -	    strcmp(randomfile, ISC_PLATFORM_CRYPTORANDOM) == 0) {
 -		randomfile = NULL;
 +	if (randomfile == NULL) {
- 		isc_entropy_usehook(ectx, ISC_TRUE);
+ 		isc_entropy_usehook(ectx, true);
  	}
  #endif
 diff --git a/bin/tests/system/tkey/keycreate.c b/bin/tests/system/tkey/keycreate.c
-index 4f2f5b4..0894db7 100644
+index fe8698e..937fcc3 100644
 --- a/bin/tests/system/tkey/keycreate.c
 +++ b/bin/tests/system/tkey/keycreate.c
 @@ -255,9 +255,7 @@ main(int argc, char *argv[]) {
@@ -418,11 +418,11 @@ index 4f2f5b4..0894db7 100644
 -	    strcmp(randomfile, ISC_PLATFORM_CRYPTORANDOM) == 0) {
 -		randomfile = NULL;
 +	if (randomfile == NULL) {
- 		isc_entropy_usehook(ectx, ISC_TRUE);
+ 		isc_entropy_usehook(ectx, true);
  	}
  #endif
 diff --git a/bin/tests/system/tkey/keydelete.c b/bin/tests/system/tkey/keydelete.c
-index 0975bbe..5b8a470 100644
+index 2146f9b..ac2c311 100644
 --- a/bin/tests/system/tkey/keydelete.c
 +++ b/bin/tests/system/tkey/keydelete.c
 @@ -182,9 +182,7 @@ main(int argc, char **argv) {
@@ -433,11 +433,11 @@ index 0975bbe..5b8a470 100644
 -	    strcmp(randomfile, ISC_PLATFORM_CRYPTORANDOM) == 0) {
 -		randomfile = NULL;
 +	if (randomfile == NULL) {
- 		isc_entropy_usehook(ectx, ISC_TRUE);
+ 		isc_entropy_usehook(ectx, true);
  	}
  #endif
 diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
-index a5d9e2e..2a96f71 100644
+index baff8d3..00a50e4 100644
 --- a/doc/arm/Bv9ARM-book.xml
 +++ b/doc/arm/Bv9ARM-book.xml
 @@ -5070,22 +5070,45 @@ badresp:1,adberr:0,findfail:0,valfail:0]
@@ -503,14 +503,15 @@ index a5d9e2e..2a96f71 100644
  	    </listitem>
  	  </varlistentry>
 diff --git a/doc/arm/notes.xml b/doc/arm/notes.xml
-index d3fdb5e..a8ad92d 100644
+index d9537a3..5c2cc13 100644
 --- a/doc/arm/notes.xml
 +++ b/doc/arm/notes.xml
-@@ -105,7 +105,28 @@
-     <itemizedlist>
-       <listitem>
- 	<para>
--	  None.
+@@ -180,6 +180,32 @@
+ 	  option. [GL #105]
+ 	</para>
+       </listitem>
++       <listitem>
++	<para>
 +	  By default, BIND now uses the random number generation functions
 +	  in the cryptographic library (i.e., OpenSSL or a PKCS#11
 +	  provider) as a source of high-quality randomness rather than
@@ -533,25 +534,16 @@ index d3fdb5e..a8ad92d 100644
 +	  <command>configure --disable-crypto-rand</command>, in which
 +	  case <filename>/dev/random</filename> will be the default
 +	  entropy source.  [RT #31459] [RT #46047]
- 	</para>
-       </listitem>
++	</para>
++       </listitem>
      </itemizedlist>
+   </section>
+ 
 diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c
-index 803e7b3..29a4fef 100644
+index afb4d80..4e62a97 100644
 --- a/lib/dns/dst_api.c
 +++ b/lib/dns/dst_api.c
-@@ -276,8 +276,9 @@ dst_lib_init2(isc_mem_t *mctx, isc_entropy_t *ectx,
- #endif
- #if defined(OPENSSL) || defined(PKCS11CRYPTO)
- #ifdef ISC_PLATFORM_CRYPTORANDOM
--	if (dst_entropy_pool != NULL)
-+	if (dst_entropy_pool != NULL) {
- 		isc_entropy_sethook(dst_random_getdata);
-+	}
- #endif
- #endif /* defined(OPENSSL) || defined(PKCS11CRYPTO) */
- 	dst_initialized = ISC_TRUE;
-@@ -2015,10 +2016,12 @@ dst__entropy_getdata(void *buf, unsigned int len, isc_boolean_t pseudo) {
+@@ -2013,10 +2013,12 @@ dst__entropy_getdata(void *buf, unsigned int len, bool pseudo) {
  	else
  		flags |= ISC_ENTROPY_BLOCKING;
  #ifdef ISC_PLATFORM_CRYPTORANDOM
@@ -566,10 +558,10 @@ index 803e7b3..29a4fef 100644
  }
  
 diff --git a/lib/dns/include/dst/dst.h b/lib/dns/include/dst/dst.h
-index d9b6ab6..e8c1a3c 100644
+index 78e1277..10293d0 100644
 --- a/lib/dns/include/dst/dst.h
 +++ b/lib/dns/include/dst/dst.h
-@@ -161,8 +161,18 @@ isc_result_t
+@@ -164,8 +164,18 @@ isc_result_t
  dst_random_getdata(void *data, unsigned int length,
  		   unsigned int *returned, unsigned int flags);
  /*%<
@@ -589,9 +581,9 @@ index d9b6ab6..e8c1a3c 100644
 + * \li	DST_R_OPENSSLFAILURE, DST_R_CRYPTOFAILURE, or other codes on error
   */
  
- isc_boolean_t
+ bool
 diff --git a/lib/dns/openssl_link.c b/lib/dns/openssl_link.c
-index c1e1bde..91e87d0 100644
+index d88d643..7a233dd 100644
 --- a/lib/dns/openssl_link.c
 +++ b/lib/dns/openssl_link.c
 @@ -482,7 +482,8 @@ dst__openssl_getengine(const char *engine) {
@@ -605,7 +597,7 @@ index c1e1bde..91e87d0 100644
  #ifndef DONT_REQUIRE_DST_LIB_INIT
  	INSIST(dst__memory_pool != NULL);
 diff --git a/lib/isc/include/isc/entropy.h b/lib/isc/include/isc/entropy.h
-index d9deb8a..2d37363 100644
+index 632166a..c7cb17d 100644
 --- a/lib/isc/include/isc/entropy.h
 +++ b/lib/isc/include/isc/entropy.h
 @@ -9,8 +9,6 @@
@@ -617,7 +609,7 @@ index d9deb8a..2d37363 100644
  #ifndef ISC_ENTROPY_H
  #define ISC_ENTROPY_H 1
  
-@@ -190,9 +188,8 @@ isc_entropy_createcallbacksource(isc_entropy_t *ent,
+@@ -191,9 +189,8 @@ isc_entropy_createcallbacksource(isc_entropy_t *ent,
  /*!<
   * \brief Create an entropy source that is polled via a callback.
   *
@@ -629,7 +621,7 @@ index d9deb8a..2d37363 100644
   *
   * Samples are added via isc_entropy_addcallbacksample(), below.
   * _addcallbacksample() is the only function which may be called from
-@@ -233,15 +230,32 @@ isc_result_t
+@@ -234,15 +231,32 @@ isc_result_t
  isc_entropy_getdata(isc_entropy_t *ent, void *data, unsigned int length,
  		    unsigned int *returned, unsigned int flags);
  /*!<
@@ -669,9 +661,9 @@ index d9deb8a..2d37363 100644
   */
  
  void
-@@ -306,13 +320,21 @@ isc_entropy_usebestsource(isc_entropy_t *ectx, isc_entropysource_t **source,
+@@ -307,13 +321,21 @@ isc_entropy_usebestsource(isc_entropy_t *ectx, isc_entropysource_t **source,
  void
- isc_entropy_usehook(isc_entropy_t *ectx, isc_boolean_t onoff);
+ isc_entropy_usehook(isc_entropy_t *ectx, bool onoff);
  /*!<
 - * \brief Mark/unmark the given entropy structure as being hooked.
 + * \brief Configure entropy context 'ectx' to use the hook function
@@ -694,7 +686,7 @@ index d9deb8a..2d37363 100644
  
  ISC_LANG_ENDDECLS
 diff --git a/lib/isc/include/isc/random.h b/lib/isc/include/isc/random.h
-index ba53ebf..b575728 100644
+index f8aed34..17c551b 100644
 --- a/lib/isc/include/isc/random.h
 +++ b/lib/isc/include/isc/random.h
 @@ -9,8 +9,6 @@
@@ -737,8 +729,8 @@ index ba53ebf..b575728 100644
  
  ISC_LANG_BEGINDECLS
 @@ -115,8 +123,8 @@ isc_rng_random(isc_rng_t *rngctx);
- isc_uint16_t
- isc_rng_uniformrandom(isc_rng_t *rngctx, isc_uint16_t upper_bound);
+ uint16_t
+ isc_rng_uniformrandom(isc_rng_t *rngctx, uint16_t upper_bound);
  /*%<
 - * Returns a uniformly distributed pseudo random 16-bit unsigned
 - * integer.
@@ -748,10 +740,10 @@ index ba53ebf..b575728 100644
  
  ISC_LANG_ENDDECLS
 diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
-index 8d496ff..dd08187 100644
+index cd797a6..589da07 100644
 --- a/lib/isccfg/namedconf.c
 +++ b/lib/isccfg/namedconf.c
-@@ -1106,7 +1106,7 @@ options_clauses[] = {
+@@ -1109,7 +1109,7 @@ options_clauses[] = {
  	{ "pid-file", &cfg_type_qstringornone, 0 },
  	{ "port", &cfg_type_uint32, 0 },
  	{ "querylog", &cfg_type_boolean, 0 },
diff --git a/bind-95-rh452060.patch b/bind-95-rh452060.patch
index dac3a8d..c57ccab 100644
--- a/bind-95-rh452060.patch
+++ b/bind-95-rh452060.patch
@@ -1,34 +1,34 @@
 diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
-index f657c30..ff9a2d2 100644
+index aa5315d..1fa711a 100644
 --- a/bin/dig/dighost.c
 +++ b/bin/dig/dighost.c
-@@ -1694,6 +1694,13 @@ clear_query(dig_query_t *query) {
+@@ -1814,6 +1814,13 @@ clear_query(dig_query_t *query) {
  
  	if (query->timer != NULL)
  		isc_timer_detach(&query->timer);
 +
 +	if (query->waiting_senddone) {
 +		debug("send_done not yet called");
-+		query->pending_free = ISC_TRUE;
++		query->pending_free = true;
 +		return;
 +	}
 +
  	lookup = query->lookup;
  
  	if (lookup->current_query == query)
-@@ -1719,10 +1726,7 @@ clear_query(dig_query_t *query) {
+@@ -1839,10 +1846,7 @@ clear_query(dig_query_t *query) {
  	isc_mempool_put(commctx, query->recvspace);
  	isc_buffer_invalidate(&query->recvbuf);
  	isc_buffer_invalidate(&query->lengthbuf);
 -	if (query->waiting_senddone)
--		query->pending_free = ISC_TRUE;
+-		query->pending_free = true;
 -	else
 -		isc_mem_free(mctx, query);
 +	isc_mem_free(mctx, query);
  }
  
  /*%
-@@ -2811,9 +2815,9 @@ send_done(isc_task_t *_task, isc_event_t *event) {
+@@ -2892,9 +2896,9 @@ send_done(isc_task_t *_task, isc_event_t *event) {
  	isc_event_free(&event);
  
  	if (query->pending_free)
diff --git a/bind.spec b/bind.spec
index 372bf59..fef8b91 100644
--- a/bind.spec
+++ b/bind.spec
@@ -2,7 +2,7 @@
 # Red Hat BIND package .spec file
 #
 
-%global PATCHVER P2
+#%%global PATCHVER P2
 #%%global PREVER rc1
 %global BINDVERSION %{version}%{?PREVER}%{?PATCHVER:-%{PATCHVER}}
 
@@ -43,16 +43,16 @@
 #
 
 # lib*.so.X versions of selected libraries
-%global sover_dns 1102
-%global sover_isc 169
-%global sover_irs 160
-%global sover_isccfg 160
+%global sover_dns 1104
+%global sover_isc 1100
+%global sover_irs 161
+%global sover_isccfg 163
 
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.11.4
-Release:  13%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Version:  9.11.5
+Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      http://www.isc.org/products/BIND/
 #
@@ -454,7 +454,7 @@ are used for building ISC DHCP.
 %patch72 -p1 -b .64bit
 %endif
 %patch102 -p1 -b .rh452060
-%patch106 -p0 -b .rh490837
+%patch106 -p1 -b .rh490837
 %patch109 -p1 -b .rh478718
 %patch112 -p1 -b .rh645544
 %patch130 -p1 -b .libdb
@@ -1197,9 +1197,9 @@ rm -rf ${RPM_BUILD_ROOT}
 %endif
 
 %files libs
-%{_libdir}/libbind9.so.160*
-%{_libdir}/libisccc.so.160*
-%{_libdir}/liblwres.so.160*
+%{_libdir}/libbind9.so.161*
+%{_libdir}/libisccc.so.161*
+%{_libdir}/liblwres.so.161*
 
 %files libs-lite
 %{_libdir}/libdns.so.%{sover_dns}*
@@ -1450,6 +1450,9 @@ rm -rf ${RPM_BUILD_ROOT}
 
 
 %changelog
+* Sun Jan 27 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.5-1
+- Update to 9.11.5
+
 * Mon Jan 14 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.4-13.P2
 - Disable crypto rand for DHCP (#1663318)
 
diff --git a/bind93-rh490837.patch b/bind93-rh490837.patch
index 230d7a7..6ea55ba 100644
--- a/bind93-rh490837.patch
+++ b/bind93-rh490837.patch
@@ -1,13 +1,22 @@
-? patch
-? lib/isc/lex.c.rh490837
-Index: lib/isc/lex.c
-===================================================================
-RCS file: /var/snap/bind9/lib/isc/lex.c,v
-retrieving revision 1.86
-diff -p -u -r1.86 lex.c
---- lib/isc/lex.c	17 Sep 2007 09:56:29 -0000	1.86
-+++ lib/isc/lex.c	6 Apr 2009 13:24:15 -0000
-@@ -425,17 +425,14 @@ isc_lex_gettoken(isc_lex_t *lex, unsigne
+diff --git a/lib/isc/include/isc/stdio.h b/lib/isc/include/isc/stdio.h
+index 1f44b5a..a3625f9 100644
+--- a/lib/isc/include/isc/stdio.h
++++ b/lib/isc/include/isc/stdio.h
+@@ -69,6 +69,9 @@ isc_stdio_sync(FILE *f);
+  * direct counterpart in the stdio library.
+  */
+ 
++isc_result_t
++isc_stdio_fgetc(FILE *f, int *ret);
++
+ ISC_LANG_ENDDECLS
+ 
+ #endif /* ISC_STDIO_H */
+diff --git a/lib/isc/lex.c b/lib/isc/lex.c
+index a8955bc..fc6103b 100644
+--- a/lib/isc/lex.c
++++ b/lib/isc/lex.c
+@@ -434,17 +434,14 @@ isc_lex_gettoken(isc_lex_t *lex, unsigned int options, isc_token_t *tokenp) {
  			if (source->is_file) {
  				stream = source->input;
  
@@ -28,34 +37,14 @@ diff -p -u -r1.86 lex.c
  						goto done;
  					}
 +
- 					source->at_eof = ISC_TRUE;
+ 					source->at_eof = true;
  				}
  			} else {
-Index: lib/isc/include/isc/stdio.h
-===================================================================
-RCS file: /var/snap/bind9/lib/isc/include/isc/stdio.h,v
-retrieving revision 1.13
-diff -p -u -r1.13 stdio.h
---- lib/isc/include/isc/stdio.h	19 Jun 2007 23:47:18 -0000	1.13
-+++ lib/isc/include/isc/stdio.h	6 Apr 2009 13:24:15 -0000
-@@ -72,6 +72,9 @@ isc_stdio_sync(FILE *f);
-  * direct counterpart in the stdio library.
-  */
- 
-+isc_result_t
-+isc_stdio_fgetc(FILE *f, int *ret);
-+
- ISC_LANG_ENDDECLS
- 
- #endif /* ISC_STDIO_H */
-Index: lib/isc/unix/errno2result.c
-===================================================================
-RCS file: /var/snap/bind9/lib/isc/unix/errno2result.c,v
-retrieving revision 1.17
-diff -p -u -r1.17 errno2result.c
---- lib/isc/unix/errno2result.c	19 Jun 2007 23:47:18 -0000	1.17
-+++ lib/isc/unix/errno2result.c	6 Apr 2009 13:24:15 -0000
-@@ -43,6 +43,7 @@ isc__errno2result(int posixerrno) {
+diff --git a/lib/isc/unix/errno2result.c b/lib/isc/unix/errno2result.c
+index 2f12bcc..5bfd648 100644
+--- a/lib/isc/unix/errno2result.c
++++ b/lib/isc/unix/errno2result.c
+@@ -40,6 +40,7 @@ isc___errno2result(int posixerrno, bool dolog,
  	case EINVAL:		/* XXX sometimes this is not for files */
  	case ENAMETOOLONG:
  	case EBADF:
@@ -63,14 +52,11 @@ diff -p -u -r1.17 errno2result.c
  		return (ISC_R_INVALIDFILE);
  	case ENOENT:
  		return (ISC_R_FILENOTFOUND);
-Index: lib/isc/unix/stdio.c
-===================================================================
-RCS file: /var/snap/bind9/lib/isc/unix/stdio.c,v
-retrieving revision 1.8
-diff -p -u -r1.8 stdio.c
---- lib/isc/unix/stdio.c	19 Jun 2007 23:47:18 -0000	1.8
-+++ lib/isc/unix/stdio.c	6 Apr 2009 13:24:15 -0000
-@@ -115,3 +115,22 @@ isc_stdio_sync(FILE *f) {
+diff --git a/lib/isc/unix/stdio.c b/lib/isc/unix/stdio.c
+index e60fa65..77f0b13 100644
+--- a/lib/isc/unix/stdio.c
++++ b/lib/isc/unix/stdio.c
+@@ -149,3 +149,22 @@ isc_stdio_sync(FILE *f) {
  		return (isc__errno2result(errno));
  }
  
diff --git a/sources b/sources
index 43558ac..f7e1978 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.11.4-P2.tar.gz) = 6c01810526fc40485a6c0403d1ddc3b76d2e59b3426b5789436bd671f158d2fa0ea7c0aef2de81998ec715dabd06683fed7b17224d5c794c61e7100a69d4cb60
+SHA512 (bind-9.11.5.tar.gz) = 7e34c8033dabaed232479b1dc2849d1247c0137bcb2b63f08f8f72ff2cca0f73e0f05d0b9b8959f8c4db8ee36a700af30fe869be186c7bab7c81a25843384b8d
 SHA512 (config-18.tar.bz2) = c0a0a1fd58a7e2c09fe69915b9a4c682d1b6c96e78583f63ce5355f663c9509d28facfd3aa078b228b69954d0af4bfa484ef661a9568aaafe6eade97dda3c3d9

From 899c629af565a792eb42d4f1042d7b0613222198 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 23 Jan 2019 21:15:03 +0100
Subject: [PATCH 004/460] Made RAND_status check optional (broke
 --disable-crypto-rand)

Unlike upstream, skip it also for DHCP.

Disable RAND_status also in non-threaded builds. DHCP is built without
threads and should not check RAND_status on dns library initialization.
Lack of entropy is possible state for dhclient, but it must not fail
even in this case. Because DHCP itself does not require custom random
generator, leave default RAND_OpenSSL configured. It should help TLS
connection to LDAP in single DHCP binary, while keeping secure random
data if needed.

Resolves: #1663318

(modified upstream commit 8a98277811ea50035ff37b744fa3dc5b75bee099)

(cherry picked from commit 32d91f12ca83ef8ec46df091fc0fe72cd05f91d9)
---
 bind-rh1663318.patch | 26 +++++++++++++++++++++-----
 bind.spec            |  2 +-
 2 files changed, 22 insertions(+), 6 deletions(-)

diff --git a/bind-rh1663318.patch b/bind-rh1663318.patch
index 79487b0..1af7efb 100644
--- a/bind-rh1663318.patch
+++ b/bind-rh1663318.patch
@@ -1,21 +1,37 @@
-From 48d86dd3d834bcedd0c977d193c36b12e8398b4e Mon Sep 17 00:00:00 2001
-From: Francis Dupont <fdupont@isc.org>
-Date: Sun, 17 Sep 2017 12:02:09 +0200
+From b16a1ff25644bb075f454afe68ee63f6f385ca9c Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
+Date: Wed, 23 Jan 2019 21:11:07 +0100
 Subject: [PATCH] Made RAND_status check optional (broke --disable-crypto-rand)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
 
+Unlike upstream, skip it also for DHCP.
+
+Disable RAND_status also in non-threaded builds. DHCP is built without
+threads and should not check RAND_status on dns library initialization.
+Lack of entropy is possible state for dhclient, but it must not fail
+even in this case. Because DHCP itself does not require custom random
+generator, leave default RAND_OpenSSL configured. It should help TLS
+connection to LDAP in single DHCP binary, while keeping secure random
+data if needed.
+
+(modified upstream commit 8a98277811ea50035ff37b744fa3dc5b75bee099)
+
+Signed-off-by: Petr Menšík <pemensik@redhat.com>
 ---
  lib/dns/openssl_link.c | 2 ++
  1 file changed, 2 insertions(+)
 
 diff --git a/lib/dns/openssl_link.c b/lib/dns/openssl_link.c
-index 91e87d0..3cddaa9 100644
+index 7a233dd..941eb17 100644
 --- a/lib/dns/openssl_link.c
 +++ b/lib/dns/openssl_link.c
 @@ -289,6 +289,7 @@ dst__openssl_init(const char *engine) {
  #endif
  #endif /* !defined(OPENSSL_NO_ENGINE) */
  
-+#ifdef ISC_PLATFORM_CRYPTORANDOM
++#if defined(ISC_PLATFORM_CRYPTORANDOM) && defined(ISC_PLATFORM_USETHREADS)
  	/* Protect ourselves against unseeded PRNG */
  	if (RAND_status() != 1) {
  		FATAL_ERROR(__FILE__, __LINE__,
diff --git a/bind.spec b/bind.spec
index fef8b91..80876a5 100644
--- a/bind.spec
+++ b/bind.spec
@@ -682,7 +682,6 @@ export LIBDIR_SUFFIX
         --without-libjson \
         --without-zlib \
         --without-dlopen \
-        --disable-crypto-rand \
         --enable-full-report
 
 ## We don't want to build other libs than -export twice
@@ -1452,6 +1451,7 @@ rm -rf ${RPM_BUILD_ROOT}
 %changelog
 * Sun Jan 27 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.5-1
 - Update to 9.11.5
+- Reenable crypto rand for DHCP, disable just entropy check (#1663318)
 
 * Mon Jan 14 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.4-13.P2
 - Disable crypto rand for DHCP (#1663318)

From 3533e401fa5c4c84a2237f7f7c9be0ca6c51f9cd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 28 Jan 2019 00:47:11 +0100
Subject: [PATCH 005/460] Update to 9.11.5-P1

(cherry picked from commit 13f8f23ec518ca7ecd2bb2c9ed231955c670079b)
---
 .gitignore | 1 +
 bind.spec  | 7 +++++--
 sources    | 2 +-
 3 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/.gitignore b/.gitignore
index f656e89..eb450f2 100644
--- a/.gitignore
+++ b/.gitignore
@@ -87,3 +87,4 @@ bind-9.7.2b1.tar.gz
 /bind-9.11.4-P1.tar.gz
 /bind-9.11.4-P2.tar.gz
 /bind-9.11.5.tar.gz
+/bind-9.11.5-P1.tar.gz
diff --git a/bind.spec b/bind.spec
index 80876a5..071ea1a 100644
--- a/bind.spec
+++ b/bind.spec
@@ -2,7 +2,7 @@
 # Red Hat BIND package .spec file
 #
 
-#%%global PATCHVER P2
+%global PATCHVER P1
 #%%global PREVER rc1
 %global BINDVERSION %{version}%{?PREVER}%{?PATCHVER:-%{PATCHVER}}
 
@@ -52,7 +52,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.11.5
-Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      http://www.isc.org/products/BIND/
 #
@@ -1449,6 +1449,9 @@ rm -rf ${RPM_BUILD_ROOT}
 
 
 %changelog
+* Sun Jan 27 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.5-2.P1
+- Update to 9.11.5-P1
+
 * Sun Jan 27 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.5-1
 - Update to 9.11.5
 - Reenable crypto rand for DHCP, disable just entropy check (#1663318)
diff --git a/sources b/sources
index f7e1978..37dc9dc 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.11.5.tar.gz) = 7e34c8033dabaed232479b1dc2849d1247c0137bcb2b63f08f8f72ff2cca0f73e0f05d0b9b8959f8c4db8ee36a700af30fe869be186c7bab7c81a25843384b8d
+SHA512 (bind-9.11.5-P1.tar.gz) = cf0e511342affc81fc89656417a6d74a8ee4c3ffcc242e3aad76864f34d8ff7b0b52ada422385b5becafb7ef3a81dddfb28ba1488c8bee168f16842e2c617069
 SHA512 (config-18.tar.bz2) = c0a0a1fd58a7e2c09fe69915b9a4c682d1b6c96e78583f63ce5355f663c9509d28facfd3aa078b228b69954d0af4bfa484ef661a9568aaafe6eade97dda3c3d9

From 5edcf115f465c3c2db723c22d5a5f55a1718bae8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 29 Jan 2019 19:41:22 +0100
Subject: [PATCH 006/460] dig prints ASCII name instead of failure (#1647829)

(cherry picked from commit a699858667627bb95545c41fca123366a9c4e7ce)
---
 bind-9.11-rh1647829.patch | 86 +++++++++++++++++++++++++++++++++++++++
 bind.spec                 |  4 ++
 2 files changed, 90 insertions(+)
 create mode 100644 bind-9.11-rh1647829.patch

diff --git a/bind-9.11-rh1647829.patch b/bind-9.11-rh1647829.patch
new file mode 100644
index 0000000..ceec7fc
--- /dev/null
+++ b/bind-9.11-rh1647829.patch
@@ -0,0 +1,86 @@
+From 2eca7f5fa97a24997e4d8f900460ba43ae167e97 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
+Date: Tue, 29 Jan 2019 18:07:44 +0100
+Subject: [PATCH] Fallback to ASCII on output IDN conversion error
+
+It is possible dig used ACE encoded name in locale, which does not
+support converting it to unicode. Instead of fatal error, fallback to
+ACE name on output.
+
+(cherry picked from commit 7f4cb8f9584597fea16de6557124ac8b1bd47440)
+
+Modify idna test to fallback to ACE
+
+Test valid A-label on input would be displayed as A-label on output if
+locale does not allow U-label.
+
+(cherry picked from commit 4ce232f8605bdbe0594ebe5a71383c9d4e6f263b)
+
+Emit warning on IDN output failure
+
+Warning is emitted before any dig headers.
+
+(cherry picked from commit 4b410038c531fbb902cd5fb83174eed1f06cb7d7)
+---
+ bin/dig/dighost.c              | 15 +++++++++++++--
+ bin/tests/system/idna/tests.sh | 17 +++++++++++++++++
+ 2 files changed, 30 insertions(+), 2 deletions(-)
+
+diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
+index bb8702c..d7cfc33 100644
+--- a/bin/dig/dighost.c
++++ b/bin/dig/dighost.c
+@@ -4860,9 +4860,20 @@ idn_ace_to_locale(const char *from, char *to, size_t tolen) {
+ 	 */
+ 	res = idn2_to_unicode_8zlz(utf8_src, &tmp_str, 0);
+ 	if (res != IDN2_OK) {
+-		fatal("Cannot represent '%s' in the current locale (%s), "
+-		      "use +noidnout or a different locale",
++		static bool warned = false;
++
++		res = idn2_to_ascii_8z(utf8_src, &tmp_str, 0);
++		if (res != IDN2_OK) {
++			fatal("Cannot represent '%s' "
++			      "in the current locale nor ascii (%s), "
++			      "use +noidnout or a different locale",
+ 		      from, idn2_strerror(res));
++		} else if (!warned) {
++			fprintf(stderr, ";; Warning: cannot represent '%s' "
++			      "in the current locale",
++			      tmp_str);
++			warned = true;
++		}
+ 	}
+ 
+ 	/*
+diff --git a/bin/tests/system/idna/tests.sh b/bin/tests/system/idna/tests.sh
+index 6637bf6..215a9d5 100644
+--- a/bin/tests/system/idna/tests.sh
++++ b/bin/tests/system/idna/tests.sh
+@@ -244,6 +244,23 @@ idna_enabled_test() {
+     idna_test "$text" "+idnin +noidnout"   "xn--nxasmq6b.com" "xn--nxasmq6b.com."
+     idna_test "$text" "+idnin +idnout"     "xn--nxasmq6b.com" "βόλοσ.com."
+ 
++    # Test of valid A-label in locale that cannot display it
++    #
++    # +noidnout: The string is sent as-is to the server and the returned qname
++    #            is displayed in the same form.
++    # +idnout:   The string is sent as-is to the server and the returned qname
++    #            is displayed as the corresponding A-label.
++    #
++    # The "+[no]idnout" flag has no effect in these cases.
++    text="Checking valid A-label in C locale"
++    label="xn--nxasmq6b.com"
++    LC_ALL=C idna_test "$text" ""                   "$label" "$label."
++    LC_ALL=C idna_test "$text" "+noidnin +noidnout" "$label" "$label."
++    LC_ALL=C idna_test "$text" "+noidnin +idnout"   "$label" "$label."
++    LC_ALL=C idna_test "$text" "+idnin +noidnout"   "$label" "$label."
++    LC_ALL=C idna_test "$text" "+idnin +idnout"     "$label" "$label."
++    LC_ALL=C idna_test "$text" "+noidnin +idnout"   "$label" "$label."
++
+ 
+ 
+     # Tests of invalid A-labels
+-- 
+2.20.1
+
diff --git a/bind.spec b/bind.spec
index 071ea1a..00c3ad1 100644
--- a/bind.spec
+++ b/bind.spec
@@ -126,6 +126,8 @@ Patch160:bind-9.11-rh1624100.patch
 Patch161:bind-9.11-host-idn-disable.patch
 # https://gitlab.isc.org/isc-projects/bind9/commit/8a98277811e
 Patch163:bind-rh1663318.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=1647829
+Patch165:bind-9.11-rh1647829.patch
 
 # SDB patches
 Patch11: bind-9.3.2b2-sdbsrc.patch
@@ -471,6 +473,7 @@ are used for building ISC DHCP.
 %patch160 -p1 -b .rh1624100
 %patch161 -p1 -b .host-idn-disable
 %patch163 -p1 -b .rh1663318
+%patch165 -p1 -b .rh1647829
 
 mkdir lib/dns/tests/testdata/dstrandom
 cp -a %{SOURCE50} lib/dns/tests/testdata/dstrandom/random.data
@@ -1451,6 +1454,7 @@ rm -rf ${RPM_BUILD_ROOT}
 %changelog
 * Sun Jan 27 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.5-2.P1
 - Update to 9.11.5-P1
+- dig prints ASCII name instead of failure (#1647829)
 
 * Sun Jan 27 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.5-1
 - Update to 9.11.5

From 2ac739ed731838b803079a86c4ca9b93904b88f9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 29 Jan 2019 19:54:36 +0100
Subject: [PATCH 007/460] Disable dig IDN output into scripts

Dig could be used to receive zone via AXFR. If IDN data are inside and
are decoded, it cannot be used as named zone file. Disable +idnout if
stdin is not a tty.

(cherry picked from commit 7a958a2a9f9461e4d789cf15fd0bfac005a8e491)
---
 bind-9.11-rh1647829-2.patch | 28 ++++++++++++++++++++++++++++
 bind.spec                   |  4 ++++
 2 files changed, 32 insertions(+)
 create mode 100644 bind-9.11-rh1647829-2.patch

diff --git a/bind-9.11-rh1647829-2.patch b/bind-9.11-rh1647829-2.patch
new file mode 100644
index 0000000..bb8b3e9
--- /dev/null
+++ b/bind-9.11-rh1647829-2.patch
@@ -0,0 +1,28 @@
+From 58e1af6ca75d035b6391708be2c2272bb8d04620 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@sury.org>
+Date: Sun, 4 Nov 2018 02:20:41 +0700
+Subject: [PATCH] Enable IDN processing (both idnin and idnout) only on tty,
+ disable it when the stdout is not a tty
+
+(cherry picked from commit 0e1bf7d017e4f6d787cbeb72cc2aa74e7f30122e)
+(cherry picked from commit 8e1cc95c943b7dfaaaaf2d9a4971861735cc3fb2)
+---
+ bin/dig/dighost.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
+index 74791d671e..3b722ba0ff 100644
+--- a/bin/dig/dighost.c
++++ b/bin/dig/dighost.c
+@@ -825,7 +825,7 @@ make_empty_lookup(void) {
+ 	looknew->seenbadcookie = false;
+ 	looknew->badcookie = true;
+ #ifdef WITH_IDN_SUPPORT
+-	looknew->idnin = (getenv("IDN_DISABLE") == NULL);
++	looknew->idnin = isatty(1)?(getenv("IDN_DISABLE") == NULL):false;
+ 	if (looknew->idnin) {
+ 		const char *charset = getenv("CHARSET");
+ 		if (charset && !strcmp(charset, "ASCII"))
+-- 
+2.20.1
+
diff --git a/bind.spec b/bind.spec
index 00c3ad1..cd6a861 100644
--- a/bind.spec
+++ b/bind.spec
@@ -128,6 +128,8 @@ Patch161:bind-9.11-host-idn-disable.patch
 Patch163:bind-rh1663318.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=1647829
 Patch165:bind-9.11-rh1647829.patch
+# commit 8e1cc95c943b7dfaaaaf2d9a4971861735cc3fb2
+Patch166:bind-9.11-rh1647829-2.patch
 
 # SDB patches
 Patch11: bind-9.3.2b2-sdbsrc.patch
@@ -474,6 +476,7 @@ are used for building ISC DHCP.
 %patch161 -p1 -b .host-idn-disable
 %patch163 -p1 -b .rh1663318
 %patch165 -p1 -b .rh1647829
+%patch166 -p1 -b .rh1647829-2
 
 mkdir lib/dns/tests/testdata/dstrandom
 cp -a %{SOURCE50} lib/dns/tests/testdata/dstrandom/random.data
@@ -1455,6 +1458,7 @@ rm -rf ${RPM_BUILD_ROOT}
 * Sun Jan 27 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.5-2.P1
 - Update to 9.11.5-P1
 - dig prints ASCII name instead of failure (#1647829)
+- disable IDN output from scripts
 
 * Sun Jan 27 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.5-1
 - Update to 9.11.5

From 66c20407d2ce4cfe943027090067292b6838e78b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 15 Feb 2019 10:10:44 +0100
Subject: [PATCH 008/460] Update project URL

(cherry picked from commit 6ecd16d4585bafcc4fae224c16d6d0f059955492)
---
 bind.spec | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index cd6a861..d0ef0c5 100644
--- a/bind.spec
+++ b/bind.spec
@@ -54,7 +54,7 @@ License:  MPLv2.0
 Version:  9.11.5
 Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
-Url:      http://www.isc.org/products/BIND/
+Url:      https://www.isc.org/downloads/bind/
 #
 Source:   https://ftp.isc.org/isc/bind9/%{BINDVERSION}/bind-%{BINDVERSION}.tar.gz
 Source1:  named.sysconfig
@@ -1459,6 +1459,7 @@ rm -rf ${RPM_BUILD_ROOT}
 - Update to 9.11.5-P1
 - dig prints ASCII name instead of failure (#1647829)
 - disable IDN output from scripts
+- Update project URL
 
 * Sun Jan 27 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.5-1
 - Update to 9.11.5

From d494ea8a4105ab1936062c5ee91c24f7cffd65db Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 15 Feb 2019 19:49:27 +0100
Subject: [PATCH 009/460] Remove revoked KSK 19164 from trusted root keys

(cherry picked from commit 6fee3d63e97cc86062b9fedb5d9294455cf522b6)
---
 .gitignore      | 1 +
 bind.spec       | 3 ++-
 sources         | 2 +-
 trusted-key.key | 1 -
 4 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/.gitignore b/.gitignore
index eb450f2..854f798 100644
--- a/.gitignore
+++ b/.gitignore
@@ -88,3 +88,4 @@ bind-9.7.2b1.tar.gz
 /bind-9.11.4-P2.tar.gz
 /bind-9.11.5.tar.gz
 /bind-9.11.5-P1.tar.gz
+/config-19.tar.bz2
diff --git a/bind.spec b/bind.spec
index d0ef0c5..d094e6a 100644
--- a/bind.spec
+++ b/bind.spec
@@ -64,7 +64,7 @@ Source8:  dnszone.schema
 Source12: README.sdb_pgsql
 Source25: named.conf.sample
 Source26: named.conf
-Source28: config-18.tar.bz2
+Source28: config-19.tar.bz2
 Source30: ldap2zone.c
 Source31: ldap2zone.1
 Source32: named-sdb.8
@@ -1460,6 +1460,7 @@ rm -rf ${RPM_BUILD_ROOT}
 - dig prints ASCII name instead of failure (#1647829)
 - disable IDN output from scripts
 - Update project URL
+- Removed revoked KSK 19164 from trusted keys
 
 * Sun Jan 27 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.5-1
 - Update to 9.11.5
diff --git a/sources b/sources
index 37dc9dc..e4f563b 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
 SHA512 (bind-9.11.5-P1.tar.gz) = cf0e511342affc81fc89656417a6d74a8ee4c3ffcc242e3aad76864f34d8ff7b0b52ada422385b5becafb7ef3a81dddfb28ba1488c8bee168f16842e2c617069
-SHA512 (config-18.tar.bz2) = c0a0a1fd58a7e2c09fe69915b9a4c682d1b6c96e78583f63ce5355f663c9509d28facfd3aa078b228b69954d0af4bfa484ef661a9568aaafe6eade97dda3c3d9
+SHA512 (config-19.tar.bz2) = 36aa38a0c7c33267ae594b31c81681290ac58dde7ca6749bd599da531380b5b1428330813dbe983e01071ccaed83e83f6a9cd92179a53b7d0ccbb6851a0b017c
diff --git a/trusted-key.key b/trusted-key.key
index df2fd0d..7b845f3 100644
--- a/trusted-key.key
+++ b/trusted-key.key
@@ -1,2 +1 @@
-. 3600 IN DNSKEY 257 3 8 AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjFFVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoXbfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaDX6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpzW5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relSQageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulqQxA+Uk1ihz0=
 . 3600 IN DNSKEY 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU=

From 6a0d9a2e1db5cfe1a5634d69e75d34f7bdf9ee5a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 20 Feb 2019 18:53:13 +0100
Subject: [PATCH 010/460] Simplify pkcs11 token generation

Make default secure enough, no predefined pins are used. Generate pin
and save it into file protected by unix rights. HSM tools will probably
require it anyway. Use smart defaults.
---
 bind.spec              |  3 +-
 setup-named-softhsm.sh | 80 ++++++++++++++++++++++++++++++++++++++----
 2 files changed, 75 insertions(+), 8 deletions(-)

diff --git a/bind.spec b/bind.spec
index d094e6a..0a28ad6 100644
--- a/bind.spec
+++ b/bind.spec
@@ -735,8 +735,7 @@ sed -e '/^tp:.*-pkcs11/ d' -e '/^tp:\s*lwres/ d' \
 %check
 %if %{with PKCS11}
   # Tests require initialization of pkcs11 token
-  export SOFTHSM2_CONF="`pwd`/softhsm2.conf"
-  sh %{SOURCE48} "${SOFTHSM2_CONF}" "`pwd`/softhsm-tokens"
+  eval $(bash %{SOURCE48} -A "`pwd`/softhsm-tokens")
 %endif
 
 %if %{with UNITTEST}
diff --git a/setup-named-softhsm.sh b/setup-named-softhsm.sh
index 7ae0a6d..a13c91e 100755
--- a/setup-named-softhsm.sh
+++ b/setup-named-softhsm.sh
@@ -2,6 +2,11 @@
 #
 # This script will initialise token storage of softhsm PKCS11 provider
 # in custom location. Is useful to store tokens in non-standard location.
+#
+# Output can be evaluated from bash, it will prepare it for usage of temporary tokens.
+# Recommended use:
+# eval $(bash setup-named-softhsm.sh -A)
+#
 
 SOFTHSM2_CONF="$1"
 TOKENPATH="$2"
@@ -10,14 +15,55 @@ GROUPNAME="$3"
 # This is intended for crypto accelerators using PKCS11 interface.
 # Uninitialized token would fail any crypto operation.
 PIN=1234
+SO_PIN=1234
+LABEL=rpm
 
 set -e
 
+echo_i()
+{
+	echo "#" $@
+}
+
+random()
+{
+	if [ -x "$(which openssl 2>/dev/null)" ]; then
+		openssl rand -base64 $1
+	else
+		dd if=/dev/urandom bs=1c count=$1 | base64
+	fi
+}
+
+usage()
+{
+	echo "Usage: $0 -A [token directory] [group]"
+	echo "   or: $0 <config file> <token directory> [group]"
+}
+
+if [ "$SOFTHSM2_CONF" = "-A" -a -z "$TOKENPATH" ]; then
+	TOKENPATH=$(mktemp -d /var/tmp/softhsm-XXXXXX)
+fi
+
 if [ -z "$SOFTHSM2_CONF" -o -z "$TOKENPATH" ]; then
-	echo "Usage: $0 <config file> <token directory> [group]" >&2
+	usage >&2
 	exit 1
 fi
 
+if [ "$SOFTHSM2_CONF" = "-A" ]; then
+	# Automagic mode instead
+	MODE=secure
+	SOFTHSM2_CONF="$TOKENPATH/softhsm2.conf"
+	PIN_SOURCE="$TOKENPATH/pin"
+	SOPIN_SOURCE="$TOKENPATH/so-pin"
+	TOKENPATH="$TOKENPATH/tokens"
+else
+	MODE=legacy
+fi
+
+[ -d "$TOKENPATH" ] || mkdir -p "$TOKENPATH"
+
+umask 0022
+
 if ! [ -f "$SOFTHSM2_CONF" ]; then
 cat  << SED > "$SOFTHSM2_CONF"
 # SoftHSM v2 configuration file
@@ -32,19 +78,36 @@ log.level = ERROR
 slots.removable = false
 SED
 else
-	echo "Config file $SOFTHSM2_CONF already exists" >&2
+	echo_i "Config file $SOFTHSM2_CONF already exists" >&2
 fi
 
-[ -d "$TOKENPATH" ] || mkdir -p "$TOKENPATH"
+if [ -n "$PIN_SOURCE" ]; then
+	touch "$PIN_SOURCE" "$SOPIN_SOURCE"
+	chmod 0600 "$PIN_SOURCE" "$SOPIN_SOURCE"
+	if [ -n "$GROUPNAME" ]; then
+		chgrp "$GROUPNAME" "$PIN_SOURCE" "$SOPIN_SOURCE"
+		chmod g+r "$PIN_SOURCE" "$SOPIN_SOURCE"
+	fi
+fi
 
 export SOFTHSM2_CONF
 
 if softhsm2-util --show-slots | grep 'Initialized:[[:space:]]*yes' > /dev/null
 then
-	echo "Token in ${TOKENPATH} is already initialized" >&2
+	echo_i "Token in ${TOKENPATH} is already initialized" >&2
+
+	[ -f "$PIN_SOURCE" ] && PIN=$(cat "$PIN_SOURCE")
+	[ -f "$SOPIN_SOURCE" ] && SO_PIN=$(cat "$SOPIN_SOURCE")
 else
-	echo "Initializing tokens to ${TOKENPATH}..."
-	softhsm2-util --init-token --free --label rpm --pin $PIN --so-pin $PIN
+	PIN=$(random 6)
+	SO_PIN=$(random 18)
+	if [ -n "$PIN_SOURCE" ]; then
+		echo -n "$PIN" > "$PIN_SOURCE"
+		echo -n "$SO_PIN" > "$SOPIN_SOURCE"
+	fi
+
+	echo_i "Initializing tokens to ${TOKENPATH}..."
+	softhsm2-util --init-token --free --label "$LABEL" --pin "$PIN" --so-pin "$SO_PIN" | sed -e 's/^/# /'
 
 	if [ -n "$GROUPNAME" ]; then
 		chgrp -R -- "$GROUPNAME" "$TOKENPATH"
@@ -53,3 +116,8 @@ else
 fi
 
 echo "export SOFTHSM2_CONF=\"$SOFTHSM2_CONF\""
+echo "export PIN_SOURCE=\"$PIN_SOURCE\""
+echo "export SOPIN_SOURCE=\"$SOPIN_SOURCE\""
+# These are intentionaly not exported
+echo "PIN=\"$PIN\""
+echo "SO_PIN=\"$SO_PIN\""

From 53d26d27a42c275de08da9a9b2184b092965a739 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 21 Feb 2019 15:36:27 +0100
Subject: [PATCH 011/460] Disable ED448

It is breaking dnssec system test. Its implementation in BIND is broken.
---
 bind-9.11-ed448-disable.patch | 41 +++++++++++++++++++++++++++++++++++
 bind.spec                     |  8 ++++++-
 2 files changed, 48 insertions(+), 1 deletion(-)
 create mode 100644 bind-9.11-ed448-disable.patch

diff --git a/bind-9.11-ed448-disable.patch b/bind-9.11-ed448-disable.patch
new file mode 100644
index 0000000..179f32f
--- /dev/null
+++ b/bind-9.11-ed448-disable.patch
@@ -0,0 +1,41 @@
+From e6bad0789c731f06de781997e33e864c71510ff2 Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Thu, 21 Feb 2019 12:36:17 +0100
+Subject: [PATCH] Disable autodetected ED448 algorithm support
+
+Implementation is broken in bind, disabled also in more recent versions.
+Makes bin/tests/system/dnssec fail.
+---
+ configure.in | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/configure.in b/configure.in
+index ca84ff3239..da4dd5f249 100644
+--- a/configure.in
++++ b/configure.in
+@@ -1917,6 +1917,9 @@ int main() {
+ }
+ ],
+ 		[AC_MSG_RESULT(yes)
++		# ED448 support is broken in BIND
++		# https://gitlab.isc.org/isc-projects/bind9/issues/225
++		# disable if autodetected, can be enabled by --with-eddsa=all
+ 		have_ed448="yes"],
+ 		[AC_MSG_RESULT(no)
+ 		have_ed448="no"],
+@@ -1929,8 +1932,10 @@ int main() {
+ 		esac
+ 		case $have_ed448 in
+ 		yes)
+-			AC_DEFINE(HAVE_OPENSSL_ED448, 1,
+-				  [Define if your OpenSSL version supports Ed448.])
++		# ED448 support is broken in BIND
++		# https://gitlab.isc.org/isc-projects/bind9/issues/225
++		#	AC_DEFINE(HAVE_OPENSSL_ED448, 1,
++		#		  [Define if your OpenSSL version supports Ed448.])
+ 			;;
+ 		*)
+ 			;;
+-- 
+2.20.1
+
diff --git a/bind.spec b/bind.spec
index 0a28ad6..d750e63 100644
--- a/bind.spec
+++ b/bind.spec
@@ -52,7 +52,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.11.5
-Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  3%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -130,6 +130,8 @@ Patch163:bind-rh1663318.patch
 Patch165:bind-9.11-rh1647829.patch
 # commit 8e1cc95c943b7dfaaaaf2d9a4971861735cc3fb2
 Patch166:bind-9.11-rh1647829-2.patch
+# https://gitlab.isc.org/isc-projects/bind9/issues/225
+Patch167:bind-9.11-ed448-disable.patch
 
 # SDB patches
 Patch11: bind-9.3.2b2-sdbsrc.patch
@@ -477,6 +479,7 @@ are used for building ISC DHCP.
 %patch163 -p1 -b .rh1663318
 %patch165 -p1 -b .rh1647829
 %patch166 -p1 -b .rh1647829-2
+%patch167 -p1 -b .noed448
 
 mkdir lib/dns/tests/testdata/dstrandom
 cp -a %{SOURCE50} lib/dns/tests/testdata/dstrandom/random.data
@@ -1454,6 +1457,9 @@ rm -rf ${RPM_BUILD_ROOT}
 
 
 %changelog
+* Thu Feb 21 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.5-3.P1
+- Disable autodetected eddsa algorithm ED448
+
 * Sun Jan 27 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.5-2.P1
 - Update to 9.11.5-P1
 - dig prints ASCII name instead of failure (#1647829)

From d9ce22f975b40d3b0cfc6588e3e8b58d60997072 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 21 Feb 2019 22:50:12 +0100
Subject: [PATCH 012/460] Disable random_test in unit tests

It fails sometimes, but aborts whole build just because some fail. Keep
it disabled until fixed.
---
 bind-9.11-unit-disable-random.patch | 45 +++++++++++++++++++++++++++++
 bind.spec                           |  4 +++
 2 files changed, 49 insertions(+)
 create mode 100644 bind-9.11-unit-disable-random.patch

diff --git a/bind-9.11-unit-disable-random.patch b/bind-9.11-unit-disable-random.patch
new file mode 100644
index 0000000..5658d12
--- /dev/null
+++ b/bind-9.11-unit-disable-random.patch
@@ -0,0 +1,45 @@
+From c89b0e288f923af69b97e8acc29250b262be7d1e Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Thu, 21 Feb 2019 22:42:27 +0100
+Subject: [PATCH] Disable random_test
+
+It fails too often on some architecture, failing the whole build along.
+Because it runs two times for pkcs11 and normal build and any of
+subtests can occasionally fail, stop it.
+
+It can be used again by defining 'unstable' variable in Kyuafile.
+---
+ lib/isc/tests/Atffile  | 3 ++-
+ lib/isc/tests/Kyuafile | 2 +-
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/lib/isc/tests/Atffile b/lib/isc/tests/Atffile
+index 8681844..74a4a77 100644
+--- a/lib/isc/tests/Atffile
++++ b/lib/isc/tests/Atffile
+@@ -20,7 +20,8 @@ tp: pool_test
+ tp: print_test
+ tp: queue_test
+ tp: radix_test
+-tp: random_test
++# random test fails too often
++#tp: random_test
+ tp: regex_test
+ tp: result_test
+ tp: safe_test
+diff --git a/lib/isc/tests/Kyuafile b/lib/isc/tests/Kyuafile
+index 1c510c1..a86824a 100644
+--- a/lib/isc/tests/Kyuafile
++++ b/lib/isc/tests/Kyuafile
+@@ -19,7 +19,7 @@ atf_test_program{name='pool_test'}
+ atf_test_program{name='print_test'}
+ atf_test_program{name='queue_test'}
+ atf_test_program{name='radix_test'}
+-atf_test_program{name='random_test'}
++atf_test_program{name='random_test', required_configs='unstable'}
+ atf_test_program{name='regex_test'}
+ atf_test_program{name='result_test'}
+ atf_test_program{name='safe_test'}
+-- 
+2.20.1
+
diff --git a/bind.spec b/bind.spec
index d750e63..7a38c81 100644
--- a/bind.spec
+++ b/bind.spec
@@ -132,6 +132,8 @@ Patch165:bind-9.11-rh1647829.patch
 Patch166:bind-9.11-rh1647829-2.patch
 # https://gitlab.isc.org/isc-projects/bind9/issues/225
 Patch167:bind-9.11-ed448-disable.patch
+# random_test fails too often by random, disable it
+Patch168:bind-9.11-unit-disable-random.patch
 
 # SDB patches
 Patch11: bind-9.3.2b2-sdbsrc.patch
@@ -480,6 +482,7 @@ are used for building ISC DHCP.
 %patch165 -p1 -b .rh1647829
 %patch166 -p1 -b .rh1647829-2
 %patch167 -p1 -b .noed448
+%patch168 -p1 -b .random_test-disable
 
 mkdir lib/dns/tests/testdata/dstrandom
 cp -a %{SOURCE50} lib/dns/tests/testdata/dstrandom/random.data
@@ -1459,6 +1462,7 @@ rm -rf ${RPM_BUILD_ROOT}
 %changelog
 * Thu Feb 21 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.5-3.P1
 - Disable autodetected eddsa algorithm ED448
+- Disable often failing unit test random_test
 
 * Sun Jan 27 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.5-2.P1
 - Update to 9.11.5-P1

From edb5faaa4f65c348629bb9d1baa272eceb60fa69 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 22 Feb 2019 19:40:00 +0100
Subject: [PATCH 013/460] Update to BIND 9.11.5-P4

Add also PGP signature as part of repository.
---
 .gitignore                |  1 +
 bind-9.11.5-P4.tar.gz.asc | 29 +++++++++++++++++++++++++++++
 bind.spec                 |  8 ++++++--
 sources                   |  2 +-
 4 files changed, 37 insertions(+), 3 deletions(-)
 create mode 100644 bind-9.11.5-P4.tar.gz.asc

diff --git a/.gitignore b/.gitignore
index 854f798..858d487 100644
--- a/.gitignore
+++ b/.gitignore
@@ -89,3 +89,4 @@ bind-9.7.2b1.tar.gz
 /bind-9.11.5.tar.gz
 /bind-9.11.5-P1.tar.gz
 /config-19.tar.bz2
+/bind-9.11.5-P4.tar.gz
diff --git a/bind-9.11.5-P4.tar.gz.asc b/bind-9.11.5-P4.tar.gz.asc
new file mode 100644
index 0000000..d7b138e
--- /dev/null
+++ b/bind-9.11.5-P4.tar.gz.asc
@@ -0,0 +1,29 @@
+-----BEGIN PGP SIGNATURE-----
+Comment: GPGTools - http://gpgtools.org
+
+iQIzBAABAgAdFiEEvg6XSLcYJToou4n/8bEb8FzwLlcFAlxks5sACgkQ8bEb8Fzw
+Lld2iA//SfqtuHZGjTKVk35vLEjpK52Xs/rmawtTI1aMApk8jEXgD7yASa5dkgM1
+xRcU7H/8omkf16Oi1m1fdamnMYhW6AvbfX4hdRY9EDn3JepXGdO0ft9G2KzmvZBt
+mU8bcqOfPHzEG0mu/oWMtL9eh9Edh5dFWxHkSGUnadXFTWH0NXRiyQwwmY6VexV4
+CQ7VkfP1fkuyZpq5tjyg9Z/umOmmwuwjkoaTbHxtfRLWVwMNgw24Pt6hUqjjJmCz
+auDlBuGXKjBgRqRmAQR3klmcvNCna3+4e1+W9w/pgRxeEr9YD1JLVyhsAvLZ9FUc
+Dpxz/MKfRkM71Lv3wvxrIODUrmSSecQ520lljxnNammnO0UuS6Og7LCpl6fSWm0c
+y3A51mq25TJ1AyOlaiSU2TPYc5XJOMjyBqIqAvJei1cV/R2gMTjbYGz3rU+b9LlG
+iRgdvAmUUhvBYAKXX7SmMUOFpXDiFv+Zbk0Gincok47VHihO4hksPx+RbL8BSOUJ
+PGsQytwVnSQJTrDGuELyQYSGJzN8l8fMLKckNiRecNWFHCOQFpkdbtlYp+C4yopR
+lGkx04ZVarlJBOPRkoN6mzZiXR17WaghHHXNq4gOP+HME6YAWJv3oLAAxeD8Tvyd
+p4M4xCHw3WZt6OiKwgCE02wnthn3aUyRv+oOGYCL3+eTtoUzdNKJAjMEAAECAB0W
+IQQVaJBoXqDfahNx7yAXzF2x8AiEBwUCXGSznAAKCRAXzF2x8AiEB3qgD/4qc2S3
+KcshK/BX10j75dmPVmNGdW1SH8V1h+nFKVIkvTzVXybBL3XeF7HP6/aJd460ku4n
+XZ5FXd78f+g+G2gJaMA+rprS0NfpclhUS64SVTSDY727dnmV49xDdRIpqmUB7B1w
+Nx9bLRHBxuPigE6S+Nmt78xrFmtS1cwegY2pz3ZD4HDDmtKMRuhZ9el71S7vLJyh
+60pvFCqQMPJX7r0OXFC4iYwgIHab0iHQu4AASvaXzi03dR2S058aRk6gBMoBlQcL
+Mcc/RzpHdJAKRx1bmU3h//HUAa5S6cKpRjDsFGj0GtFNY/ksdevTXTM3qB9k5GlR
+T4mEadsWP3ARL9qQHyW4eStTdkH1qzgJF2tKn2M+dXlfdRXNImZPrEDXOfzmyRfA
+ZoJLBeaJw5MaWeTtAcuPsppGDUuA9+hk9mpycmFZrxD21X4pr+NMrHa3TCFzAwgF
+qyc96uX1SiFMRyUmLJY2ZMBR2y8W7TdL+MWjWzsGxQg8Dj3IaAbvRg1XztxDP9XB
+RPYTniq7VOw4eEk3UgfjnIYfnEBQY+5d79MlSwxE4NBRg/h+ulZSHjP5HQ6BGzqu
+aPg+p/P+G2GfQ5x0RxchG0B/Ogj2PRIwXptgwOXVoEs1671odj3aEE5E8JKquYlO
+PRIIubc/EfYopZfyM2ryv2hAT+1z8ngeac1ycQ==
+=kFOo
+-----END PGP SIGNATURE-----
diff --git a/bind.spec b/bind.spec
index 7a38c81..42e9bba 100644
--- a/bind.spec
+++ b/bind.spec
@@ -2,7 +2,7 @@
 # Red Hat BIND package .spec file
 #
 
-%global PATCHVER P1
+%global PATCHVER P4
 #%%global PREVER rc1
 %global BINDVERSION %{version}%{?PREVER}%{?PATCHVER:-%{PATCHVER}}
 
@@ -52,12 +52,13 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.11.5
-Release:  3%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  4%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
 Source:   https://ftp.isc.org/isc/bind9/%{BINDVERSION}/bind-%{BINDVERSION}.tar.gz
 Source1:  named.sysconfig
+Source2:  https://ftp.isc.org/isc/bind9/%{BINDVERSION}/bind-%{BINDVERSION}.tar.gz.asc
 Source3:  named.logrotate
 Source7:  bind-9.3.1rc1-sdb_tools-Makefile.in
 Source8:  dnszone.schema
@@ -1460,6 +1461,9 @@ rm -rf ${RPM_BUILD_ROOT}
 
 
 %changelog
+* Fri Feb 22 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.5-4.P4
+- Update to 9.11.5-P4
+
 * Thu Feb 21 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.5-3.P1
 - Disable autodetected eddsa algorithm ED448
 - Disable often failing unit test random_test
diff --git a/sources b/sources
index e4f563b..8336c9d 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.11.5-P1.tar.gz) = cf0e511342affc81fc89656417a6d74a8ee4c3ffcc242e3aad76864f34d8ff7b0b52ada422385b5becafb7ef3a81dddfb28ba1488c8bee168f16842e2c617069
+SHA512 (bind-9.11.5-P4.tar.gz) = ba750ffd080a47309db8be3df3d80896c5872aadb1a14ac7effd1bb783c2a2ae1e82959d6999eecc3d694336887060a84ae8813a17836b9064515cdd96fcb573
 SHA512 (config-19.tar.bz2) = 36aa38a0c7c33267ae594b31c81681290ac58dde7ca6749bd599da531380b5b1428330813dbe983e01071ccaed83e83f6a9cd92179a53b7d0ccbb6851a0b017c

From 3a9a611c68c820b1e72d3a01a10638052de836bd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 22 Feb 2019 16:39:54 +0100
Subject: [PATCH 014/460] Fix spec usage of softhsm helper

Output produced by helper is multiline starting with comment. Unless it
is enclosed in quotes, it will be concatenated into single line.

Fixes commit fa1631eef77a827e0df168df837e84c2d8790ce5
---
 bind.spec              | 2 +-
 setup-named-softhsm.sh | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/bind.spec b/bind.spec
index 42e9bba..b5b836c 100644
--- a/bind.spec
+++ b/bind.spec
@@ -742,7 +742,7 @@ sed -e '/^tp:.*-pkcs11/ d' -e '/^tp:\s*lwres/ d' \
 %check
 %if %{with PKCS11}
   # Tests require initialization of pkcs11 token
-  eval $(bash %{SOURCE48} -A "`pwd`/softhsm-tokens")
+  eval "$(bash %{SOURCE48} -A "`pwd`/softhsm-tokens")"
 %endif
 
 %if %{with UNITTEST}
diff --git a/setup-named-softhsm.sh b/setup-named-softhsm.sh
index a13c91e..c0f8445 100755
--- a/setup-named-softhsm.sh
+++ b/setup-named-softhsm.sh
@@ -4,8 +4,9 @@
 # in custom location. Is useful to store tokens in non-standard location.
 #
 # Output can be evaluated from bash, it will prepare it for usage of temporary tokens.
+# Quotes around eval are mandatory!
 # Recommended use:
-# eval $(bash setup-named-softhsm.sh -A)
+# eval "$(bash setup-named-softhsm.sh -A)"
 #
 
 SOFTHSM2_CONF="$1"

From 36d37531c94aae8f885e664b03aacd5a4d9ecb6d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 3 May 2019 12:51:18 +0200
Subject: [PATCH 015/460] Revert "Enable optional features by default"

This reverts commit ae423dfbebbd150c56df1c7c1954ac6ba3090bc8.
---
 bind.spec | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/bind.spec b/bind.spec
index d80a7e0..f5ba390 100644
--- a/bind.spec
+++ b/bind.spec
@@ -18,7 +18,7 @@
 %bcond_without LMDB
 %bcond_without JSON
 %bcond_without DNSTAP
-%bcond_without DLZ
+%bcond_with    DLZ
 %bcond_without EXPORT_LIBS
 %if 0%{?fedora} >= 28
 %bcond_without UNITTEST
@@ -1524,7 +1524,6 @@ fi;
 
 * Thu Mar 14 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.6-2
 - Fix dnstap and timer issues in unit test
-- Enable DLZ modules
 
 * Tue Mar 05 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.6-1
 - Update to 9.11.6

From 65cf5aa6e0ffd5fb7522162a0c0eef6604cbca60 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 3 May 2019 15:35:58 +0200
Subject: [PATCH 016/460] Revert "Enable DNSTAP (#1564776)"

This reverts commit f0b6f15ced5af5f309ccbfe35c6ec38ddca7b619.
---
 bind.spec | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/bind.spec b/bind.spec
index ff220d7..24c1bf6 100644
--- a/bind.spec
+++ b/bind.spec
@@ -17,7 +17,7 @@
 %bcond_without DEVEL
 %bcond_without LMDB
 %bcond_without JSON
-%bcond_without DNSTAP
+%bcond_with    DNSTAP
 %bcond_with    DLZ
 %bcond_without EXPORT_LIBS
 %if 0%{?fedora} >= 28
@@ -1532,7 +1532,6 @@ fi;
 - disable IDN output from scripts
 - Update project URL
 - Removed revoked KSK 19164 from trusted keys
-
 * Thu Feb 21 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.5-11.P1
 - Disable often failing unit test random_test
 

From 9b172b6d29ef6ab30497e12c9537cbfa698a8f77 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 3 May 2019 15:37:44 +0200
Subject: [PATCH 017/460] Revert "Enable json statistics format"

This reverts commit d3fe8d6248ba08cb0c343f81f25d815bba173190.
---
 bind.spec | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/bind.spec b/bind.spec
index 24c1bf6..7f77ba8 100644
--- a/bind.spec
+++ b/bind.spec
@@ -15,8 +15,8 @@
 # due to extensive changes to Makefiles
 %bcond_without PKCS11
 %bcond_without DEVEL
+%bcond_with    JSON
 %bcond_without LMDB
-%bcond_without JSON
 %bcond_with    DNSTAP
 %bcond_with    DLZ
 %bcond_without EXPORT_LIBS
@@ -1571,8 +1571,6 @@ fi;
 
 * Mon Jan 14 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.4-13.P2
 - Disable crypto rand for DHCP (#1663318)
-- Enable json format in statistics-channel
-
 * Tue Oct 02 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.4-12.P2
 - Add Requires to devel packages referenced by bind-devel
 

From 3e06916fb7d69295eb19b2e7d0d3238c4dc8300b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 3 May 2019 15:39:13 +0200
Subject: [PATCH 018/460] Revert "Enable LMDB support"

This reverts commit ec6f94669ad65412d41dfefc0f43e8bec2da7994.
---
 bind.spec | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index 7f77ba8..5b40270 100644
--- a/bind.spec
+++ b/bind.spec
@@ -15,8 +15,8 @@
 # due to extensive changes to Makefiles
 %bcond_without PKCS11
 %bcond_without DEVEL
+%bcond_with    LMDB
 %bcond_with    JSON
-%bcond_without LMDB
 %bcond_with    DNSTAP
 %bcond_with    DLZ
 %bcond_without EXPORT_LIBS

From f6f181d9d55ccc62c08001c6d30f9c7a3a5412d1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 3 May 2019 15:53:27 +0200
Subject: [PATCH 019/460] Update to 9.11.6-P1

Finish merge from more recent branches, cleanup changelog changes not
relevant to this branch.
---
 bind.spec | 40 ++++------------------------------------
 1 file changed, 4 insertions(+), 36 deletions(-)

diff --git a/bind.spec b/bind.spec
index 5b40270..34c6c31 100644
--- a/bind.spec
+++ b/bind.spec
@@ -53,7 +53,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.11.6
-Release:  0%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1519,6 +1519,9 @@ fi;
 
 
 %changelog
+* Fri May 03 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.6-1.P1
+- Update to 9.11.6-P1 (#1702881)
+
 * Fri Feb 22 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.5-4.P4
 - Update to 9.11.5-P4
 
@@ -1532,45 +1535,10 @@ fi;
 - disable IDN output from scripts
 - Update project URL
 - Removed revoked KSK 19164 from trusted keys
-* Thu Feb 21 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.5-11.P1
-- Disable often failing unit test random_test
-
-* Thu Feb 21 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.5-10.P1
-- Disable autodetected eddsa algorithm ED448
-
-* Thu Jan 31 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.5-9.P1
-- dig prints ASCII name instead of failure (#1647829)
-- disable IDN output from scripts
-- Update project URL
-- Removed revoked KSK 19164 from trusted keys
-
-* Thu Jan 31 2019 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.11.5-8.P1
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
-
-* Sun Jan 27 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.5-7.P1
-- Update to 9.11.5-P1
-
-* Wed Jan 23 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.5-6
-- Reenable crypto rand for DHCP, disable just entropy check (#1663318)
-
-* Thu Jan 17 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.5-5
-- Move dnssec related tools from bind-utils to bind-dnssec-utils (#1649398)
-
-* Wed Jan 16 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.5-4
-- Reject invalid binary file (#1666814)
-
-* Mon Jan 14 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.5-3
-- Disable crypto rand for DHCP (#1663318)
-
-* Thu Oct 25 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.5-2
-- Add optional support for JSON statistics
-- Add optional DNSTAP support (#1564776), new dnstap-read tool
 
 * Wed Oct 24 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.5-1
 - Update to 9.11.5
 
-* Mon Jan 14 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.4-13.P2
-- Disable crypto rand for DHCP (#1663318)
 * Tue Oct 02 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.4-12.P2
 - Add Requires to devel packages referenced by bind-devel
 

From fd11bcc212a10ae3ce6ec9eb0f10553c4454d63a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 3 May 2019 15:55:24 +0200
Subject: [PATCH 020/460] Revert "Move dnssec related tools to
 bind-dnssec-utils"

This reverts commit 2830e00b88ea8bb956e0cdeb6f205fc72741b167.
---
 bind.spec | 48 +++++++++++++-----------------------------------
 1 file changed, 13 insertions(+), 35 deletions(-)

diff --git a/bind.spec b/bind.spec
index 34c6c31..9da1b90 100644
--- a/bind.spec
+++ b/bind.spec
@@ -169,7 +169,6 @@ Provides:       dnssec-conf = 1.27-2
 # in case it needs to be used
 Requires(post): ((policycoreutils-python-utils and libselinux-utils) if (selinux-policy-targeted or selinux-policy-mls))
 Requires(post): ((selinux-policy and selinux-policy-base) if (selinux-policy-targeted or selinux-policy-mls))
-Recommends:     bind-utils bind-dnssec-utils
 BuildRequires:  gcc, make
 BuildRequires:  openssl-devel, libtool, autoconf, pkgconfig, libcap-devel
 BuildRequires:  libidn2-devel, libxml2-devel, GeoIP-devel
@@ -307,14 +306,9 @@ Contains license of the BIND DNS suite.
 
 %package utils
 Summary: Utilities for querying DNS name servers
-Requires: bind-libs-lite%{?_isa} = %{epoch}:%{version}-%{release}
 Requires: bind-libs%{?_isa} = %{epoch}:%{version}-%{release}
-# TODO: this is just temporary workaround until all packages depending on
-# bind-utils can be satisfied without dnssec-utils
-# It will be removed after some time, or changed to Recommends
-Suggests: bind-dnssec-utils
-# For compatibility with Debian package
-Provides: dnsutils = %{epoch}:%{version}-%{release}
+Requires: bind-libs-lite%{?_isa} = %{epoch}:%{version}-%{release}
+Requires: python3-bind = %{epoch}:%{version}-%{release}
 
 %description utils
 Bind-utils contains a collection of utilities for querying DNS (Domain
@@ -326,20 +320,6 @@ network addresses.
 You should install bind-utils if you need to get information from DNS name
 servers.
 
-%package dnssec-utils
-Summary: Utilities for DNSSEC keys and DNS zone files management
-Requires: bind-libs-lite%{?_isa} = %{epoch}:%{version}-%{release}
-Recommends: bind-utils
-Requires: python3-bind = %{epoch}:%{version}-%{release}
-
-%description dnssec-utils
-Bind-dnssec-utils contains a collection of utilities for editing
-DNSSEC keys and BIND zone files. These tools provide generation,
-revocation and verification of keys and DNSSEC signatures in zone files.
-
-You should install bind-dnssec-utils if you need to sign a DNS zone
-or maintain keys for it.
-
 %if %{with DEVEL}
 %package devel
 Summary:  Header files and libraries needed for BIND DNS development
@@ -1280,19 +1260,6 @@ fi;
 %{_bindir}/nslookup
 %{_bindir}/nsupdate
 %{_bindir}/arpaname
-%if %{with DNSTAP}
-%{_bindir}/dnstap-read
-%{_mandir}/man1/dnstap-read.1*
-%endif
-%{_mandir}/man1/host.1*
-%{_mandir}/man1/nsupdate.1*
-%{_mandir}/man1/dig.1*
-%{_mandir}/man1/delv.1*
-%{_mandir}/man1/nslookup.1*
-%{_mandir}/man1/arpaname.1*
-%{_sysconfdir}/trusted-key.key
-
-%files dnssec-utils
 %{_sbindir}/ddns-confgen
 %{_sbindir}/tsig-keygen
 %{_sbindir}/genrandom
@@ -1307,6 +1274,16 @@ fi;
 %if %{with LMDB}
 %{_sbindir}/named-nzd2nzf
 %endif
+%if %{with DNSTAP}
+%{_bindir}/dnstap-read
+%{_mandir}/man1/dnstap-read.1*
+%endif
+%{_mandir}/man1/host.1*
+%{_mandir}/man1/nsupdate.1*
+%{_mandir}/man1/dig.1*
+%{_mandir}/man1/delv.1*
+%{_mandir}/man1/nslookup.1*
+%{_mandir}/man1/arpaname.1*
 %{_mandir}/man8/ddns-confgen.8*
 %{_mandir}/man8/tsig-keygen.8*
 %{_mandir}/man8/genrandom.8*
@@ -1321,6 +1298,7 @@ fi;
 %if %{with LMDB}
 %{_mandir}/man8/named-nzd2nzf.8*
 %endif
+%{_sysconfdir}/trusted-key.key
 
 %if %{with DEVEL}
 %files devel

From 625ca235be126047d72daf36101ed0c932697954 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 10 Jun 2019 10:41:28 +0200
Subject: [PATCH 021/460] Update to BIND 9.11.7

Fixes trusted-keys and managed-keys using the same filename.

https://downloads.isc.org/isc/bind9/9.11.7/RELEASE-NOTES-bind-9.11.7.html
---
 .gitignore                |  1 +
 bind-9.11.6-P1.tar.gz.asc | 16 ----------------
 bind-9.11.7.tar.gz.asc    | 16 ++++++++++++++++
 bind.spec                 |  9 ++++++---
 sources                   |  2 +-
 5 files changed, 24 insertions(+), 20 deletions(-)
 delete mode 100644 bind-9.11.6-P1.tar.gz.asc
 create mode 100644 bind-9.11.7.tar.gz.asc

diff --git a/.gitignore b/.gitignore
index 9775b64..3f6b2b5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -92,3 +92,4 @@ bind-9.7.2b1.tar.gz
 /bind-9.11.5-P4.tar.gz
 /bind-9.11.6.tar.gz
 /bind-9.11.6-P1.tar.gz
+/bind-9.11.7.tar.gz
diff --git a/bind-9.11.6-P1.tar.gz.asc b/bind-9.11.6-P1.tar.gz.asc
deleted file mode 100644
index 53b9403..0000000
--- a/bind-9.11.6-P1.tar.gz.asc
+++ /dev/null
@@ -1,16 +0,0 @@
------BEGIN PGP SIGNATURE-----
-
-iQIzBAABAgAdFiEEFWiQaF6g32oTce8gF8xdsfAIhAcFAlysrg0ACgkQF8xdsfAI
-hAc4qQ/6A2odUTpjuaPQK/ziTD8UpJXyqFr5rZ+Qx3+wAA7XcFF6rviRwQ1dULu/
-AmQVhAWeXHa15ruFVFJZoovnRoKYUZLOtvTrcfJkHG0MwBivEpJ/rcOLlOWhAHeG
-N6q5teyOrG1kCXNcS8uGHqzm+QfMA3xCUqCpYHWOtZ60I9T3O+8Y6Xyzb+oc6+CY
-w1pXeq0doJa9tFnZpVvhCPTol4LPL8KkTLoMmpRA5dRMrVYH3f45fdixABn3HSFx
-Ea/CiMeGvIfZI0X119Txufw2Yi8/NMicf/iZBEmvvHUG49/tFX2Vmj4sxUkL4gY/
-qqXEkD7oQsVEUj3X12ITyOqj6CtfiJcOgJIzTVas3vD4QR51nRSY+IGYuH7zQUSf
-qVSCFKdLY2NlRwK6VSBVOxN5Ye31qwPEok6WgGgBy2+mWY+FvAm4Z4sIBeyX2QT/
-A0+42GuFErMne7Ppd9Pb+cCKhaIDC4i3vM/lA8kvMvhz+peqKux6MbD9Ab79hSuV
-HCZzAzFPsuaHxP1m6wRWYgeGUZWA89uTbwGa5iiAmiXXqhHswzxBCgfKXyUjuObn
-pH+XTeZ59qTgQZT3bdyj0QrmCM0JfvFEt2OkuBIDvAnoVcb0smyLrizYaZLo+0of
-6OLW76WW2GSjzvfT4RlDP5B3ns3PdjrCKaKji3aIUD7G/oYr7zA=
-=TsjB
------END PGP SIGNATURE-----
diff --git a/bind-9.11.7.tar.gz.asc b/bind-9.11.7.tar.gz.asc
new file mode 100644
index 0000000..09f58b8
--- /dev/null
+++ b/bind-9.11.7.tar.gz.asc
@@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABAgAdFiEEFWiQaF6g32oTce8gF8xdsfAIhAcFAlzbSNIACgkQF8xdsfAI
+hAdG9hAAijQlh+4kFBMwjXgHFWxUYXr8/JFWVgz5wqsbUb4iuD7fbJ//h7IB69qr
+rOAtwEEf0X1//+cQP5Zqn/8GMcXrOSlp8LoH2C9ougMcIzIe43mDMMZCiGYwNXsm
+9UGKznZyXBcgGGqzKC2pc6vThrzgWtapgztcl+WWb2k5gSDo9pAeC4xnRLLcrmcn
+EhU6uSbtN8ODcWZhAhboHzHrDZrWOm+7CzZZabf/pnZM70P7mm7OJUWdpKclE4ub
+v/Re0IcnNt9ow3pvB2BGgP0/wEIkqb7toysV3MEqdJ0HDysNzmvr0JZLVD2Dvak1
+oyQjUX2eGzgZ5phu6jjhOAWs/Bw8YtGLCJyBoxvpH6AXQqJII4S8ALqnrL6NEEHz
+0Qurk39Z0LrE73XRIsn/Y1Z9xmxYp+vfl9AWQelGYOXu8s6lw+gFqZAmPasa84XA
+iHSnZalqcZEuiPuVIGdSgBokOA8XXhjBtzRIAI2nns57qLTki+l+NzgRmxIEUiyM
+4JX20GM1R9afP5U97ti3Taqw7xr9OlIJqWT7LRhTOGJAv30pd/wfAI2fuP4OPiXg
+crXRuSd33TNnC6bd28Dx8mKoYxVoLfN2GXpRWy5jmTUQY/NchDFkAejXY4ilTvI/
+hZxf3Fgy20xlAFfk7w1HGPDEM7eqtDm8cAyIz3bD6J0ONFB0t5Y=
+=xIZJ
+-----END PGP SIGNATURE-----
diff --git a/bind.spec b/bind.spec
index 459e55c..55be4da 100644
--- a/bind.spec
+++ b/bind.spec
@@ -2,7 +2,7 @@
 # Red Hat BIND package .spec file
 #
 
-%global PATCHVER P1
+#%%global PATCHVER P1
 #%%global PREVER rc1
 %global BINDVERSION %{version}%{?PREVER}%{?PATCHVER:-%{PATCHVER}}
 
@@ -52,8 +52,8 @@
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.11.6
-Release:  5%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Version:  9.11.7
+Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1519,6 +1519,9 @@ fi;
 
 
 %changelog
+* Mon Jun 10 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.7-1
+- Update to 9.11.7
+
 * Mon May 06 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.6-5.P1
 - Fix also postun script
 
diff --git a/sources b/sources
index 413be45..7d68637 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.11.6-P1.tar.gz) = 419aeeddeab7aef818b9043db7b21a847993444f663dca04e58ee97a0ebee0610cbc5a9422d17a6f0ee5d44598a2cbb5651e3b4e8c56708eaf923dca0a5c4c03
+SHA512 (bind-9.11.7.tar.gz) = eecf731c55b04f56385cda013c9444ee69c1ea23621fa77fece4389fda12fe5fc3fa43aec0d6cc5a2947eb90fb16a6c4d366a30dfc80f5d222e11ae1f059e665
 SHA512 (config-19.tar.bz2) = 36aa38a0c7c33267ae594b31c81681290ac58dde7ca6749bd599da531380b5b1428330813dbe983e01071ccaed83e83f6a9cd92179a53b7d0ccbb6851a0b017c

From 2a466330c5379150b781709140e8c837d0a95328 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 11 Jun 2019 11:34:52 +0200
Subject: [PATCH 022/460] Update patches to new sources

Modify current and remove already merged patches.
Adjust versions of so libs.
---
 bind-9.10-dist-native-pkcs11.patch   |  36 +--
 bind-9.11-CVE-2018-5741-atomic.patch | 132 ---------
 bind-9.11-feature-test-dlz.patch     |  85 ------
 bind-9.11-fips-code.patch            |  32 +-
 bind-9.11-fips-tests.patch           | 429 +++------------------------
 bind-9.11-rt31459.patch              | 138 ++++-----
 bind-9.11-tests-variants.patch       |  14 +-
 bind-9.11-unit-dnstap-pkcs11.patch   |  38 ---
 bind-9.11-unit-timer-nothread.patch  |  49 ---
 bind-9.3.2b1-fix_sdb_ldap.patch      |  50 ++--
 bind.spec                            |  12 +-
 11 files changed, 171 insertions(+), 844 deletions(-)
 delete mode 100644 bind-9.11-CVE-2018-5741-atomic.patch
 delete mode 100644 bind-9.11-feature-test-dlz.patch
 delete mode 100644 bind-9.11-unit-dnstap-pkcs11.patch
 delete mode 100644 bind-9.11-unit-timer-nothread.patch

diff --git a/bind-9.10-dist-native-pkcs11.patch b/bind-9.10-dist-native-pkcs11.patch
index bd8e74d..65a2e83 100644
--- a/bind-9.10-dist-native-pkcs11.patch
+++ b/bind-9.10-dist-native-pkcs11.patch
@@ -300,10 +300,10 @@ index a058c91..d4b689a 100644
  DEPLIBS =	${ISCDEPLIBS}
  
 diff --git a/configure.ac b/configure.ac
-index 5e1ba8c..7aff0e6 100644
+index 5e4e839..0ef2c8f 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -1070,12 +1070,14 @@ AC_SUBST(USE_GSSAPI)
+@@ -1081,12 +1081,14 @@ AC_SUBST(USE_GSSAPI)
  AC_SUBST(DST_GSSAPI_INC)
  AC_SUBST(DNS_GSSAPI_LIBS)
  DNS_CRYPTO_LIBS="$DNS_GSSAPI_LIBS $DNS_CRYPTO_LIBS"
@@ -318,7 +318,7 @@ index 5e1ba8c..7aff0e6 100644
  
  #
  # was --with-randomdev specified?
-@@ -1460,11 +1462,11 @@ fi
+@@ -1471,11 +1473,11 @@ fi
  AC_MSG_CHECKING(for OpenSSL library)
  OPENSSL_WARNING=
  openssldirs="/usr /usr/local /usr/local/ssl /usr/pkg /usr/sfw"
@@ -335,7 +335,7 @@ index 5e1ba8c..7aff0e6 100644
  
  if test "auto" = "$use_openssl"
  then
-@@ -1477,6 +1479,7 @@ then
+@@ -1488,6 +1490,7 @@ then
  		fi
  	done
  fi
@@ -343,7 +343,7 @@ index 5e1ba8c..7aff0e6 100644
  OPENSSL_ECDSA=""
  OPENSSL_GOST=""
  OPENSSL_ED25519=""
-@@ -1498,11 +1501,10 @@ case "$with_gost" in
+@@ -1509,11 +1512,10 @@ case "$with_gost" in
  		;;
  esac
  
@@ -358,7 +358,7 @@ index 5e1ba8c..7aff0e6 100644
  		CRYPTOLIB="pkcs11"
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
-@@ -1512,7 +1514,9 @@ case "$use_openssl" in
+@@ -1523,7 +1525,9 @@ case "$use_openssl" in
  		OPENSSLGOSTLINKSRCS=""
  		OPENSSLLINKOBJS=""
  		OPENSSLLINKSRCS=""
@@ -369,7 +369,7 @@ index 5e1ba8c..7aff0e6 100644
  	no)
  		AC_MSG_RESULT(no)
  		DST_OPENSSL_INC=""
-@@ -1544,7 +1548,7 @@ case "$use_openssl" in
+@@ -1555,7 +1559,7 @@ case "$use_openssl" in
  If you do not want OpenSSL, use --without-openssl])
  		;;
  	*)
@@ -378,7 +378,7 @@ index 5e1ba8c..7aff0e6 100644
  		then
  			AC_MSG_RESULT()
  			AC_MSG_ERROR([OpenSSL and native PKCS11 cannot be used together.])
-@@ -1972,6 +1976,7 @@ AC_SUBST(OPENSSL_ED25519)
+@@ -1983,6 +1987,7 @@ AC_SUBST(OPENSSL_ED25519)
  AC_SUBST(OPENSSL_GOST)
  
  DNS_CRYPTO_LIBS="$DNS_CRYPTO_LIBS $DST_OPENSSL_LIBS"
@@ -386,7 +386,7 @@ index 5e1ba8c..7aff0e6 100644
  
  ISC_PLATFORM_WANTAES="#undef ISC_PLATFORM_WANTAES"
  if test "yes" = "$with_aes"
-@@ -2295,6 +2300,7 @@ esac
+@@ -2306,6 +2311,7 @@ esac
  AC_SUBST(PKCS11LINKOBJS)
  AC_SUBST(PKCS11LINKSRCS)
  AC_SUBST(CRYPTO)
@@ -394,7 +394,7 @@ index 5e1ba8c..7aff0e6 100644
  AC_SUBST(PKCS11_ECDSA)
  AC_SUBST(PKCS11_GOST)
  AC_SUBST(PKCS11_ED25519)
-@@ -5425,8 +5431,11 @@ AC_CONFIG_FILES([
+@@ -5428,8 +5434,11 @@ AC_CONFIG_FILES([
  	bin/delv/Makefile
  	bin/dig/Makefile
  	bin/dnssec/Makefile
@@ -406,7 +406,7 @@ index 5e1ba8c..7aff0e6 100644
  	bin/nsupdate/Makefile
  	bin/pkcs11/Makefile
  	bin/python/Makefile
-@@ -5499,6 +5508,10 @@ AC_CONFIG_FILES([
+@@ -5502,6 +5511,10 @@ AC_CONFIG_FILES([
  	lib/dns/include/dns/Makefile
  	lib/dns/include/dst/Makefile
  	lib/dns/tests/Makefile
@@ -417,7 +417,7 @@ index 5e1ba8c..7aff0e6 100644
  	lib/irs/Makefile
  	lib/irs/include/Makefile
  	lib/irs/include/irs/Makefile
-@@ -5523,6 +5536,24 @@ AC_CONFIG_FILES([
+@@ -5526,6 +5539,24 @@ AC_CONFIG_FILES([
  	lib/isc/unix/include/Makefile
  	lib/isc/unix/include/isc/Makefile
  	lib/isc/unix/include/pkcs11/Makefile
@@ -456,7 +456,7 @@ index 81270a0..bcb5312 100644
  
  @BIND9_MAKE_RULES@
 diff --git a/lib/dns-pkcs11/Makefile.in b/lib/dns-pkcs11/Makefile.in
-index 068bbac..d7f3d95 100644
+index 56dd259..f9aa782 100644
 --- a/lib/dns-pkcs11/Makefile.in
 +++ b/lib/dns-pkcs11/Makefile.in
 @@ -26,16 +26,16 @@ VERSION=@BIND9_VERSION@
@@ -501,12 +501,8 @@ index 068bbac..d7f3d95 100644
  
  include: gen
  	${MAKE} include/dns/enumtype.h
-@@ -180,25 +180,25 @@ code.h:	gen
- 	./gen -s ${srcdir} > code.h || { rm -f $@ ; exit 1; }
- 
- gen: gen.c
--	${BUILD_CC} ${BUILD_CFLAGS} -I${top_srcdir}/lib/isc/include \
-+	${BUILD_CC} ${BUILD_CFLAGS} -I${top_srcdir}/lib/isc-pkcs11/include \
+@@ -183,22 +183,22 @@ gen: gen.c
+ 	${BUILD_CC} ${BUILD_CFLAGS} -I${top_srcdir}/lib/isc/include \
  	${BUILD_CPPFLAGS} ${BUILD_LDFLAGS} -o $@ ${srcdir}/gen.c ${BUILD_LIBS}
  
 -timestamp: include libdns.@A@
@@ -532,7 +528,7 @@ index 068bbac..d7f3d95 100644
 +	rm -f libdns-pkcs11.@A@ timestamp
  	rm -f gen code.h include/dns/enumtype.h include/dns/enumclass.h
  	rm -f include/dns/rdatastruct.h
- 	rm -f dnstap.pb-c.c dnstap.pb-c.h include/dns/dnstap.pb-c.h
+ 	rm -f dnstap.pb-c.c dnstap.pb-c.h
 diff --git a/lib/isc-pkcs11/Makefile.in b/lib/isc-pkcs11/Makefile.in
 index 98acfff..2fd6981 100644
 --- a/lib/isc-pkcs11/Makefile.in
diff --git a/bind-9.11-CVE-2018-5741-atomic.patch b/bind-9.11-CVE-2018-5741-atomic.patch
deleted file mode 100644
index cfbded6..0000000
--- a/bind-9.11-CVE-2018-5741-atomic.patch
+++ /dev/null
@@ -1,132 +0,0 @@
-From ef49780d30d3ddc5735cfc32561b678a634fa72f Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@sury.org>
-Date: Wed, 17 Apr 2019 15:22:27 +0200
-Subject: [PATCH] Replace atomic operations in bin/named/client.c with
- isc_refcount reference counting
-
----
- bin/named/client.c                     | 18 +++++++-----------
- bin/named/include/named/interfacemgr.h |  5 +++--
- bin/named/interfacemgr.c               |  7 +++++--
- 3 files changed, 15 insertions(+), 15 deletions(-)
-
-diff --git a/bin/named/client.c b/bin/named/client.c
-index 845326abc0..29fecadca8 100644
---- a/bin/named/client.c
-+++ b/bin/named/client.c
-@@ -402,12 +402,10 @@ tcpconn_detach(ns_client_t *client) {
- static void
- mark_tcp_active(ns_client_t *client, bool active) {
- 	if (active && !client->tcpactive) {
--		isc_atomic_xadd(&client->interface->ntcpactive, 1);
-+		isc_refcount_increment0(&client->interface->ntcpactive, NULL);
- 		client->tcpactive = active;
- 	} else if (!active && client->tcpactive) {
--		uint32_t old =
--			isc_atomic_xadd(&client->interface->ntcpactive, -1);
--		INSIST(old > 0);
-+		isc_refcount_decrement(&client->interface->ntcpactive, NULL);
- 		client->tcpactive = active;
- 	}
- }
-@@ -554,7 +552,7 @@ exit_check(ns_client_t *client) {
- 		if (client->mortal && TCP_CLIENT(client) &&
- 		    client->newstate != NS_CLIENTSTATE_FREED &&
- 		    !ns_g_clienttest &&
--		    isc_atomic_xadd(&client->interface->ntcpaccepting, 0) == 0)
-+		    isc_refcount_current(&client->interface->ntcpaccepting) == 0)
- 		{
- 			/* Nobody else is accepting */
- 			client->mortal = false;
-@@ -3328,7 +3326,6 @@ client_newconn(isc_task_t *task, isc_event_t *event) {
- 	isc_result_t result;
- 	ns_client_t *client = event->ev_arg;
- 	isc_socket_newconnev_t *nevent = (isc_socket_newconnev_t *)event;
--	uint32_t old;
- 
- 	REQUIRE(event->ev_type == ISC_SOCKEVENT_NEWCONN);
- 	REQUIRE(NS_CLIENT_VALID(client));
-@@ -3348,8 +3345,7 @@ client_newconn(isc_task_t *task, isc_event_t *event) {
- 	INSIST(client->naccepts == 1);
- 	client->naccepts--;
- 
--	old = isc_atomic_xadd(&client->interface->ntcpaccepting, -1);
--	INSIST(old > 0);
-+	isc_refcount_decrement(&client->interface->ntcpaccepting, NULL);
- 
- 	/*
- 	 * We must take ownership of the new socket before the exit
-@@ -3480,8 +3476,8 @@ client_accept(ns_client_t *client) {
- 		 * quota is tcp-clients plus the number of listening
- 		 * interfaces plus 1.)
- 		 */
--		exit = (isc_atomic_xadd(&client->interface->ntcpactive, 0) >
--			(client->tcpactive ? 1 : 0));
-+		exit = (isc_refcount_current(&client->interface->ntcpactive) >
-+			(client->tcpactive ? 1U : 0U));
- 		if (exit) {
- 			client->newstate = NS_CLIENTSTATE_INACTIVE;
- 			(void)exit_check(client);
-@@ -3539,7 +3535,7 @@ client_accept(ns_client_t *client) {
- 	 * listening for connections itself to prevent the interface
- 	 * going dead.
- 	 */
--	isc_atomic_xadd(&client->interface->ntcpaccepting, 1);
-+	isc_refcount_increment0(&client->interface->ntcpaccepting, NULL);
- }
- 
- static void
-diff --git a/bin/named/include/named/interfacemgr.h b/bin/named/include/named/interfacemgr.h
-index 3535ef22a8..6e10f210fd 100644
---- a/bin/named/include/named/interfacemgr.h
-+++ b/bin/named/include/named/interfacemgr.h
-@@ -45,6 +45,7 @@
- #include <isc/magic.h>
- #include <isc/mem.h>
- #include <isc/socket.h>
-+#include <isc/refcount.h>
- 
- #include <dns/result.h>
- 
-@@ -75,11 +76,11 @@ struct ns_interface {
- 						/*%< UDP dispatchers. */
- 	isc_socket_t *		tcpsocket;	/*%< TCP socket. */
- 	isc_dscp_t		dscp;		/*%< "listen-on" DSCP value */
--	int32_t			ntcpaccepting;	/*%< Number of clients
-+	isc_refcount_t		ntcpaccepting;	/*%< Number of clients
- 						     ready to accept new
- 						     TCP connections on this
- 						     interface */
--	int32_t			ntcpactive;	/*%< Number of clients
-+	isc_refcount_t		ntcpactive;	/*%< Number of clients
- 						     servicing TCP queries
- 						     (whether accepting or
- 						     connected) */
-diff --git a/bin/named/interfacemgr.c b/bin/named/interfacemgr.c
-index d9f6df5802..135533be6b 100644
---- a/bin/named/interfacemgr.c
-+++ b/bin/named/interfacemgr.c
-@@ -386,8 +386,8 @@ ns_interface_create(ns_interfacemgr_t *mgr, isc_sockaddr_t *addr,
- 	 * connections will be handled in parallel even though there is
- 	 * only one client initially.
- 	 */
--	ifp->ntcpaccepting = 0;
--	ifp->ntcpactive = 0;
-+	isc_refcount_init(&ifp->ntcpaccepting, 0);
-+	isc_refcount_init(&ifp->ntcpactive, 0);
- 
- 	ifp->nudpdispatch = 0;
- 
-@@ -618,6 +618,9 @@ ns_interface_destroy(ns_interface_t *ifp) {
- 
- 	ns_interfacemgr_detach(&ifp->mgr);
- 
-+	isc_refcount_destroy(&ifp->ntcpactive);
-+	isc_refcount_destroy(&ifp->ntcpaccepting);
-+
- 	ifp->magic = 0;
- 	isc_mem_put(mctx, ifp, sizeof(*ifp));
- }
--- 
-2.18.1
-
diff --git a/bind-9.11-feature-test-dlz.patch b/bind-9.11-feature-test-dlz.patch
deleted file mode 100644
index 39e46c8..0000000
--- a/bind-9.11-feature-test-dlz.patch
+++ /dev/null
@@ -1,85 +0,0 @@
-From 71627db6c8852d7805ec559506f5f3cb8d89a131 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Wed, 30 Jan 2019 15:12:54 +0100
-Subject: [PATCH] Support DLZ filesystem detection in feature-test
-
-Do not use variable from configure to detect the feature.
----
- bin/tests/system/Makefile.in                     | 2 +-
- bin/tests/system/dlz/{prereq.sh.in => prereq.sh} | 2 +-
- bin/tests/system/feature-test.c                  | 9 +++++++++
- configure.ac                                     | 1 -
- 4 files changed, 11 insertions(+), 3 deletions(-)
- rename bin/tests/system/dlz/{prereq.sh.in => prereq.sh} (91%)
-
-diff --git a/bin/tests/system/Makefile.in b/bin/tests/system/Makefile.in
-index c18b4c5..dea2f75 100644
---- a/bin/tests/system/Makefile.in
-+++ b/bin/tests/system/Makefile.in
-@@ -19,7 +19,7 @@ SUBDIRS =	dlzexternal dyndb lwresd pipelined rndc rsabigexponent tkey
- 
- CINCLUDES =	${ISC_INCLUDES} ${DNS_INCLUDES}
- 
--CDEFINES =	@USE_GSSAPI@
-+CDEFINES =	@USE_GSSAPI@ @CONTRIB_DLZ@
- CWARNINGS =
- 
- DNSLIBS =
-diff --git a/bin/tests/system/dlz/prereq.sh.in b/bin/tests/system/dlz/prereq.sh
-similarity index 91%
-rename from bin/tests/system/dlz/prereq.sh.in
-rename to bin/tests/system/dlz/prereq.sh
-index afec653..fb3328e 100644
---- a/bin/tests/system/dlz/prereq.sh.in
-+++ b/bin/tests/system/dlz/prereq.sh
-@@ -12,7 +12,7 @@
- SYSTEMTESTTOP=..
- . $SYSTEMTESTTOP/conf.sh
- 
--if [ "@DLZ_SYSTEM_TEST@" != "filesystem" ]; then
-+if ! $FEATURETEST --with-dlz-filesystem; then
-         echo_i "DLZ filesystem driver not supported"
-         exit 255
- fi
-diff --git a/bin/tests/system/feature-test.c b/bin/tests/system/feature-test.c
-index 11863a3..428d107 100644
---- a/bin/tests/system/feature-test.c
-+++ b/bin/tests/system/feature-test.c
-@@ -51,6 +51,7 @@ usage() {
- 	fprintf(stderr, "	--rpz-nsip\n");
- 	fprintf(stderr, "	--with-idn\n");
- 	fprintf(stderr, "	--with-lmdb\n");
-+	fprintf(stderr, "	--with-dlz-filesystem\n");
- }
- 
- int
-@@ -182,6 +183,14 @@ main(int argc, char **argv) {
- #endif
- 	}
- 
-+	if (strcmp(argv[1], "--with-dlz-filesystem") == 0) {
-+#ifdef DLZ_FILESYSTEM
-+		return (0);
-+#else
-+		return (1);
-+#endif
-+	}
-+
- 	if (strcmp(argv[1], "--ipv6only=no") == 0) {
- #ifdef WIN32
- 		return (0);
-diff --git a/configure.ac b/configure.ac
-index fddc63a..5e1ba8c 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -5458,7 +5458,6 @@ AC_CONFIG_FILES([
- 	bin/tests/pkcs11/benchmarks/Makefile
- 	bin/tests/system/Makefile
- 	bin/tests/system/conf.sh
--	bin/tests/system/dlz/prereq.sh
- 	bin/tests/system/dlzexternal/Makefile
- 	bin/tests/system/dlzexternal/ns1/dlzs.conf
- 	bin/tests/system/dyndb/Makefile
--- 
-2.20.1
-
diff --git a/bind-9.11-fips-code.patch b/bind-9.11-fips-code.patch
index 1640b3e..74dbb05 100644
--- a/bind-9.11-fips-code.patch
+++ b/bind-9.11-fips-code.patch
@@ -1,4 +1,4 @@
-From 9ff202072b286ef57e0ffcd7c55777f2994d3985 Mon Sep 17 00:00:00 2001
+From b8485528f5098e3360560d5b85c9ffc592619c55 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 2 Aug 2018 23:34:45 +0200
 Subject: [PATCH] FIPS code changes
@@ -267,7 +267,7 @@ index 2063a3b..8e856c5 100644
  			digestbits = 0;
  		}
 diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
-index 011b118..5eabc1f 100644
+index e75b8b7..9234d35 100644
 --- a/bin/dig/dighost.c
 +++ b/bin/dig/dighost.c
 @@ -80,6 +80,7 @@
@@ -396,7 +396,7 @@ index 7584efb..a153172 100644
  		case hmacsha1: *name = dns_tsig_hmacsha1_name; break;
  		case hmacsha224: *name = dns_tsig_hmacsha224_name; break;
 diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
-index 548e0ce..509784c 100644
+index de60313..bbb3936 100644
 --- a/bin/nsupdate/nsupdate.c
 +++ b/bin/nsupdate/nsupdate.c
 @@ -31,6 +31,7 @@
@@ -406,8 +406,8 @@ index 548e0ce..509784c 100644
 +#include <isc/md5.h>
  #include <isc/mem.h>
  #include <isc/parseint.h>
- #include <isc/print.h>
-@@ -476,9 +477,10 @@ parse_hmac(dns_name_t **hmac, const char *hmacstr, size_t len,
+ #include <isc/portset.h>
+@@ -477,9 +478,10 @@ parse_hmac(dns_name_t **hmac, const char *hmacstr, size_t len,
  	strlcpy(buf, hmacstr, ISC_MIN(len + 1, sizeof(buf)));
  
  #ifndef PK11_MD5_DISABLE
@@ -420,7 +420,7 @@ index 548e0ce..509784c 100644
  		*hmac = DNS_TSIG_HMACMD5_NAME;
  		result = isc_parse_uint16(&digestbits, &buf[9], 10);
  		if (result != ISC_R_SUCCESS || digestbits > 128) {
-@@ -591,10 +593,10 @@ setup_keystr(void) {
+@@ -592,10 +594,10 @@ setup_keystr(void) {
  			exit(1);
  		}
  	} else {
@@ -434,7 +434,7 @@ index 548e0ce..509784c 100644
  #endif
  		name = keystr;
  		n = s;
-@@ -731,7 +733,8 @@ setup_keyfile(isc_mem_t *mctx, isc_log_t *lctx) {
+@@ -732,7 +734,8 @@ setup_keyfile(isc_mem_t *mctx, isc_log_t *lctx) {
  	switch (dst_key_alg(dstkey)) {
  #ifndef PK11_MD5_DISABLE
  	case DST_ALG_HMACMD5:
@@ -444,7 +444,7 @@ index 548e0ce..509784c 100644
  		break;
  #endif
  	case DST_ALG_HMACSHA1:
-@@ -1606,12 +1609,13 @@ evaluate_key(char *cmdline) {
+@@ -1637,12 +1640,13 @@ evaluate_key(char *cmdline) {
  			return (STATUS_SYNTAX);
  		}
  		namestr = n + 1;
@@ -622,7 +622,7 @@ index bde66a4..70a40c3 100644
  	dst_key_free(&dstkey);
  	CHECK("MD5 was disabled", ISC_R_NOTIMPLEMENTED);
 diff --git a/lib/bind9/check.c b/lib/bind9/check.c
-index d6fba22..ac60ba8 100644
+index 2a0e735..dc80018 100644
 --- a/lib/bind9/check.c
 +++ b/lib/bind9/check.c
 @@ -23,6 +23,7 @@
@@ -633,7 +633,7 @@ index d6fba22..ac60ba8 100644
  #include <isc/mem.h>
  #include <isc/netaddr.h>
  #include <isc/parseint.h>
-@@ -2589,6 +2590,15 @@ bind9_check_key(const cfg_obj_t *key, isc_log_t *logctx) {
+@@ -2590,6 +2591,15 @@ bind9_check_key(const cfg_obj_t *key, isc_log_t *logctx) {
  	}
  
  	algorithm = cfg_obj_asstring(algobj);
@@ -966,7 +966,7 @@ index 16214c6..9b235ba 100644
  
  	/* RSASHA256 */
 diff --git a/lib/dns/tests/tsig_test.c b/lib/dns/tests/tsig_test.c
-index 4d6847e..1a208b5 100644
+index 8e5250e..9accc53 100644
 --- a/lib/dns/tests/tsig_test.c
 +++ b/lib/dns/tests/tsig_test.c
 @@ -24,6 +24,7 @@
@@ -1115,7 +1115,7 @@ index 4d29398..e3f5cec 100644
  
  #endif /* !PK11_MD5_DISABLE */
 diff --git a/lib/isc/md5.c b/lib/isc/md5.c
-index 920aed5..a086a57 100644
+index 249f3da..628a414 100644
 --- a/lib/isc/md5.c
 +++ b/lib/isc/md5.c
 @@ -37,6 +37,7 @@
@@ -1126,7 +1126,7 @@ index 920aed5..a086a57 100644
  #include <isc/platform.h>
  #include <isc/safe.h>
  #include <isc/string.h>
-@@ -55,6 +56,9 @@
+@@ -54,6 +55,9 @@
  #define EVP_MD_CTX_free(ptr) EVP_MD_CTX_cleanup(ptr)
  #endif
  
@@ -1136,7 +1136,7 @@ index 920aed5..a086a57 100644
  void
  isc_md5_init(isc_md5_t *ctx) {
  	ctx->ctx = EVP_MD_CTX_new();
-@@ -86,8 +90,33 @@ isc_md5_final(isc_md5_t *ctx, unsigned char *digest) {
+@@ -85,8 +89,33 @@ isc_md5_final(isc_md5_t *ctx, unsigned char *digest) {
  	ctx->ctx = NULL;
  }
  
@@ -1170,7 +1170,7 @@ index 920aed5..a086a57 100644
  void
  isc_md5_init(isc_md5_t *ctx) {
  	CK_RV rv;
-@@ -130,6 +159,31 @@ isc_md5_final(isc_md5_t *ctx, unsigned char *digest) {
+@@ -129,6 +158,31 @@ isc_md5_final(isc_md5_t *ctx, unsigned char *digest) {
  	pk11_return_session(ctx);
  }
  
@@ -1202,7 +1202,7 @@ index 920aed5..a086a57 100644
  #else
  
  static void
-@@ -339,6 +393,11 @@ isc_md5_final(isc_md5_t *ctx, unsigned char *digest) {
+@@ -338,6 +392,11 @@ isc_md5_final(isc_md5_t *ctx, unsigned char *digest) {
  	memmove(digest, ctx->buf, 16);
  	isc_safe_memwipe(ctx, sizeof(*ctx));	/* In case it's sensitive */
  }
diff --git a/bind-9.11-fips-tests.patch b/bind-9.11-fips-tests.patch
index b86b783..b33e1bc 100644
--- a/bind-9.11-fips-tests.patch
+++ b/bind-9.11-fips-tests.patch
@@ -1,4 +1,4 @@
-From 4e6888c1d32071ead4b7faeeb0f1774a6d8a1120 Mon Sep 17 00:00:00 2001
+From 230ca0ddbc95a043933c36c1d182f85cf0dcc971 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 2 Aug 2018 23:46:45 +0200
 Subject: [PATCH] FIPS tests changes
@@ -76,17 +76,14 @@ Date:   Wed Mar 7 10:44:23 2018 +0100
  bin/tests/system/catz/ns2/named.conf.in       |  2 +-
  bin/tests/system/checkconf/bad-tsig.conf      |  2 +-
  bin/tests/system/checkconf/good.conf          |  2 +-
- bin/tests/system/digdelv/ns2/example.db       | 15 ++--
+ bin/tests/system/digdelv/ns2/example.db       | 15 +++--
  bin/tests/system/digdelv/tests.sh             | 28 ++++----
  bin/tests/system/dlv/ns1/sign.sh              |  4 +-
  bin/tests/system/dlv/ns2/sign.sh              |  4 +-
- bin/tests/system/dlv/ns3/sign.sh              | 69 ++++++++++---------
  bin/tests/system/dlv/ns6/sign.sh              | 66 +++++++++---------
- bin/tests/system/dnssec/ns1/sign.sh           |  4 +-
- bin/tests/system/dnssec/ns2/sign.sh           | 12 ++--
- bin/tests/system/dnssec/ns3/sign.sh           | 20 +++---
+ bin/tests/system/dnssec/ns2/sign.sh           |  8 +--
  bin/tests/system/dnssec/ns5/trusted.conf.bad  |  2 +-
- bin/tests/system/dnssec/tests.sh              |  8 +--
+ bin/tests/system/dnssec/tests.sh              |  4 +-
  bin/tests/system/feature-test.c               | 14 ++++
  bin/tests/system/filter-aaaa/ns1/sign.sh      |  4 +-
  bin/tests/system/filter-aaaa/ns4/sign.sh      |  4 +-
@@ -101,11 +98,11 @@ Date:   Wed Mar 7 10:44:23 2018 +0100
  bin/tests/system/tsig/clean.sh                |  1 +
  bin/tests/system/tsig/ns1/named.conf.in       | 10 +--
  bin/tests/system/tsig/setup.sh                |  5 ++
- bin/tests/system/tsig/tests.sh                | 67 +++++++++++-------
+ bin/tests/system/tsig/tests.sh                | 67 ++++++++++++-------
  bin/tests/system/tsiggss/setup.sh             |  2 +-
  bin/tests/system/upforwd/ns1/named.conf.in    |  2 +-
  bin/tests/system/upforwd/tests.sh             |  2 +-
- 47 files changed, 277 insertions(+), 225 deletions(-)
+ 44 files changed, 226 insertions(+), 175 deletions(-)
 
 diff --git a/bin/tests/system/acl/ns2/named1.conf.in b/bin/tests/system/acl/ns2/named1.conf.in
 index 0ea6502..026db3f 100644
@@ -602,37 +599,37 @@ index f4e30f5..9f53e31 100644
  ; TTL of 3 weeks
  weeks		1814400	A	10.53.0.2
 diff --git a/bin/tests/system/digdelv/tests.sh b/bin/tests/system/digdelv/tests.sh
-index 24aa7b3..54a3e2a 100644
+index 1657dfd..299ba94 100644
 --- a/bin/tests/system/digdelv/tests.sh
 +++ b/bin/tests/system/digdelv/tests.sh
-@@ -61,7 +61,7 @@ if [ -x ${DIG} ] ; then
+@@ -88,7 +88,7 @@ if [ -x "$DIG" ] ; then
    echo_i "checking dig +multi +norrcomments works for dnskey (when default is rrcomments)($n)"
    ret=0
    $DIG $DIGOPTS +tcp @10.53.0.3 +multi +norrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1
 -  grep "; ZSK; alg = RSAMD5 ; key id = 30795" < dig.out.test$n > /dev/null && ret=1
 +  grep "; ZSK; alg = RSASHA256 ; key id = 36895" < dig.out.test$n > /dev/null && ret=1
+   check_ttl_range dig.out.test$n "DNSKEY" 300 || ret=1
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
- 
-@@ -69,7 +69,7 @@ if [ -x ${DIG} ] ; then
+@@ -97,7 +97,7 @@ if [ -x "$DIG" ] ; then
    echo_i "checking dig +multi +norrcomments works for soa (when default is rrcomments)($n)"
    ret=0
    $DIG $DIGOPTS +tcp @10.53.0.3 +multi +norrcomments SOA example > dig.out.test$n || ret=1
 -  grep "; ZSK; alg = RSAMD5 ; key id = 30795" < dig.out.test$n > /dev/null && ret=1
 +  grep "; ZSK; alg = RSASHA256 ; key id = 36895" < dig.out.test$n > /dev/null && ret=1
+   check_ttl_range dig.out.test$n "SOA" 300 || ret=1
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
- 
-@@ -77,7 +77,7 @@ if [ -x ${DIG} ] ; then
+@@ -106,7 +106,7 @@ if [ -x "$DIG" ] ; then
    echo_i "checking dig +rrcomments works for DNSKEY($n)"
    ret=0
    $DIG $DIGOPTS +tcp @10.53.0.3 +rrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1
 -  grep "; ZSK; alg = RSAMD5 ; key id = 30795" < dig.out.test$n > /dev/null || ret=1
 +  grep "; ZSK; alg = RSASHA256 ; key id = 36895$" < dig.out.test$n > /dev/null || ret=1
+   check_ttl_range dig.out.test$n "DNSKEY" 300 || ret=1
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
- 
-@@ -85,7 +85,7 @@ if [ -x ${DIG} ] ; then
+@@ -115,7 +115,7 @@ if [ -x "$DIG" ] ; then
    echo_i "checking dig +short +rrcomments works for DNSKEY ($n)"
    ret=0
    $DIG $DIGOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1
@@ -641,7 +638,7 @@ index 24aa7b3..54a3e2a 100644
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
  
-@@ -93,7 +93,7 @@ if [ -x ${DIG} ] ; then
+@@ -123,7 +123,7 @@ if [ -x "$DIG" ] ; then
    echo_i "checking dig +short +nosplit works($n)"
    ret=0
    $DIG $DIGOPTS +tcp @10.53.0.3 +short +nosplit DNSKEY dnskey.example > dig.out.test$n || ret=1
@@ -650,7 +647,7 @@ index 24aa7b3..54a3e2a 100644
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
  
-@@ -101,7 +101,7 @@ if [ -x ${DIG} ] ; then
+@@ -131,7 +131,7 @@ if [ -x "$DIG" ] ; then
    echo_i "checking dig +short +rrcomments works($n)"
    ret=0
    $DIG $DIGOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1
@@ -659,7 +656,7 @@ index 24aa7b3..54a3e2a 100644
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
  
-@@ -117,7 +117,7 @@ if [ -x ${DIG} ] ; then
+@@ -148,7 +148,7 @@ if [ -x "$DIG" ] ; then
    echo_i "checking dig +short +rrcomments works($n)"
    ret=0
    $DIG $DIGOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1
@@ -668,34 +665,34 @@ index 24aa7b3..54a3e2a 100644
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
  
-@@ -564,7 +564,7 @@ if [ -x ${DELV} ] ; then
+@@ -661,7 +661,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +multi +norrcomments works for dnskey (when default is rrcomments)($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +multi +norrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
 -  grep "; ZSK; alg = RSAMD5 ; key id = 30795" < delv.out.test$n > /dev/null && ret=1
 +  grep "; ZSK; alg = RSASHA256 ; key id = 36895" < delv.out.test$n > /dev/null && ret=1
+   check_ttl_range delv.out.test$n "DNSKEY" 300 || ret=1
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
- 
-@@ -572,7 +572,7 @@ if [ -x ${DELV} ] ; then
+@@ -670,7 +670,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +multi +norrcomments works for soa (when default is rrcomments)($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +multi +norrcomments SOA example > delv.out.test$n || ret=1
 -  grep "; ZSK; alg = RSAMD5 ; key id = 30795" < delv.out.test$n > /dev/null && ret=1
 +  grep "; ZSK; alg = RSASHA256 ; key id = 36895" < delv.out.test$n > /dev/null && ret=1
+   check_ttl_range delv.out.test$n "SOA" 300 || ret=1
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
- 
-@@ -580,7 +580,7 @@ if [ -x ${DELV} ] ; then
+@@ -679,7 +679,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +rrcomments works for DNSKEY($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +rrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
 -  grep "; ZSK; alg = RSAMD5 ; key id = 30795" < delv.out.test$n > /dev/null || ret=1
 +  grep "; ZSK; alg = RSASHA256 ; key id = 36895" < delv.out.test$n > /dev/null || ret=1
+   check_ttl_range delv.out.test$n "DNSKEY" 300 || ret=1
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
- 
-@@ -588,7 +588,7 @@ if [ -x ${DELV} ] ; then
+@@ -688,7 +688,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +short +rrcomments works for DNSKEY ($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
@@ -704,7 +701,7 @@ index 24aa7b3..54a3e2a 100644
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
  
-@@ -596,7 +596,7 @@ if [ -x ${DELV} ] ; then
+@@ -696,7 +696,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +short +rrcomments works ($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
@@ -713,7 +710,7 @@ index 24aa7b3..54a3e2a 100644
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
  
-@@ -604,7 +604,7 @@ if [ -x ${DELV} ] ; then
+@@ -704,7 +704,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +short +nosplit works ($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +short +nosplit DNSKEY dnskey.example > delv.out.test$n || ret=1
@@ -722,7 +719,7 @@ index 24aa7b3..54a3e2a 100644
    if test `wc -l < delv.out.test$n` != 1 ; then ret=1 ; fi
    f=`awk '{print NF}' < delv.out.test$n`
    test "${f:-0}" -eq 14 || ret=1
-@@ -615,7 +615,7 @@ if [ -x ${DELV} ] ; then
+@@ -715,7 +715,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +short +nosplit +norrcomments works ($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +short +nosplit +norrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
@@ -732,22 +729,22 @@ index 24aa7b3..54a3e2a 100644
    f=`awk '{print NF}' < delv.out.test$n`
    test "${f:-0}" -eq 4 || ret=1
 diff --git a/bin/tests/system/dlv/ns1/sign.sh b/bin/tests/system/dlv/ns1/sign.sh
-index b815162..2a62e58 100755
+index 606e7cc..a3a0d60 100755
 --- a/bin/tests/system/dlv/ns1/sign.sh
 +++ b/bin/tests/system/dlv/ns1/sign.sh
 @@ -23,8 +23,8 @@ infile=root.db.in
  zonefile=root.db
  outfile=root.signed
  
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` 
+-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
 -keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 1024 -n zone $zone 2> /dev/null` 
++keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 1024 -n zone $zone 2> /dev/null`
 +keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 1024 -n zone $zone 2> /dev/null`
  
  cat $infile $keyname1.key $keyname2.key >$zonefile
  
 diff --git a/bin/tests/system/dlv/ns2/sign.sh b/bin/tests/system/dlv/ns2/sign.sh
-index 6f84d7a..e128303 100755
+index 9825c57..202c978 100755
 --- a/bin/tests/system/dlv/ns2/sign.sh
 +++ b/bin/tests/system/dlv/ns2/sign.sh
 @@ -24,8 +24,8 @@ zonefile=druz.db
@@ -761,205 +758,6 @@ index 6f84d7a..e128303 100755
  
  cat $infile $keyname1.key $keyname2.key >$zonefile
  
-diff --git a/bin/tests/system/dlv/ns3/sign.sh b/bin/tests/system/dlv/ns3/sign.sh
-index bcc9922..846dbcc 100755
---- a/bin/tests/system/dlv/ns3/sign.sh
-+++ b/bin/tests/system/dlv/ns3/sign.sh
-@@ -19,6 +19,7 @@ echo_i "dlv/ns3/sign.sh"
- dlvzone=dlv.utld.
- dlvsets=
- dssets=
-+bits=1024
- 
- zone=child1.utld.
- infile=child.db.in
-@@ -26,8 +27,8 @@ zonefile=child1.utld.db
- outfile=child1.signed
- dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` 
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null` 
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
- cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
-@@ -42,8 +43,8 @@ zonefile=child3.utld.db
- outfile=child3.signed
- dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
- cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
-@@ -58,8 +59,8 @@ zonefile=child4.utld.db
- outfile=child4.signed
- dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- 
-@@ -73,8 +74,8 @@ zonefile=child5.utld.db
- outfile=child5.signed
- dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
- cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
-@@ -88,8 +89,8 @@ infile=child.db.in
- zonefile=child7.utld.db
- outfile=child7.signed
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
- cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
-@@ -103,8 +104,8 @@ infile=child.db.in
- zonefile=child8.utld.db
- outfile=child8.signed
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- 
-@@ -118,8 +119,8 @@ zonefile=child9.utld.db
- outfile=child9.signed
- dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- 
-@@ -132,8 +133,8 @@ zonefile=child10.utld.db
- outfile=child10.signed
- dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- 
-@@ -147,8 +148,8 @@ outfile=child1.druz.signed
- dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
- dssets="$dssets dsset-`echo $zone |sed -e "s/.$//g"`$TP"
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` 
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null` 
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
- cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
-@@ -164,8 +165,8 @@ outfile=child3.druz.signed
- dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
- dssets="$dssets dsset-`echo $zone |sed -e "s/.$//g"`$TP"
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
- cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
-@@ -181,8 +182,8 @@ outfile=child4.druz.signed
- dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
- dssets="$dssets dsset-`echo $zone |sed -e "s/.$//g"`$TP"
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- 
-@@ -197,8 +198,8 @@ outfile=child5.druz.signed
- dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
- dssets="$dssets dsset-`echo $zone |sed -e "s/.$//g"`$TP"
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
- cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
-@@ -213,8 +214,8 @@ zonefile=child7.druz.db
- outfile=child7.druz.signed
- dssets="$dssets dsset-`echo $zone |sed -e "s/.$//g"`$TP"
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
- cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
-@@ -228,8 +229,8 @@ infile=child.db.in
- zonefile=child8.druz.db
- outfile=child8.druz.signed
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- 
-@@ -243,8 +244,8 @@ zonefile=child9.druz.db
- outfile=child9.druz.signed
- dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- 
-@@ -258,8 +259,8 @@ outfile=child10.druz.signed
- dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
- dssets="$dssets dsset-`echo $zone |sed -e "s/.$//g"`$TP"
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- 
-@@ -272,8 +273,8 @@ infile=dlv.db.in
- zonefile=dlv.utld.db
- outfile=dlv.signed
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- cat $infile $dlvsets $keyname1.key $keyname2.key >$zonefile
- 
 diff --git a/bin/tests/system/dlv/ns6/sign.sh b/bin/tests/system/dlv/ns6/sign.sh
 index 1e39862..4ed19ac 100755
 --- a/bin/tests/system/dlv/ns6/sign.sh
@@ -1147,43 +945,11 @@ index 1e39862..4ed19ac 100755
  
  cat $infile $keyname1.key $keyname2.key >$zonefile
  
-diff --git a/bin/tests/system/dnssec/ns1/sign.sh b/bin/tests/system/dnssec/ns1/sign.sh
-index 198d60a..d89a539 100644
---- a/bin/tests/system/dnssec/ns1/sign.sh
-+++ b/bin/tests/system/dnssec/ns1/sign.sh
-@@ -27,7 +27,7 @@ cp ../ns2/dsset-in-addr.arpa$TP .
- grep "8 [12] " ../ns2/dsset-algroll$TP > dsset-algroll$TP
- cp ../ns6/dsset-optout-tld$TP .
- 
--keyname=`$KEYGEN -q -r $RANDFILE -a RSAMD5 -b 768 -n zone $zone`
-+keyname=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 1024 -n zone $zone`
- 
- cat $infile $keyname.key > $zonefile
- 
-@@ -48,6 +48,6 @@ cp managed.conf ../ns4/managed.conf
- #
- #  Save keyid for managed key id test.
- #
--keyid=`expr $keyname : 'K.+001+\(.*\)'`
-+keyid=`expr $keyname : 'K.+008+\([0-9]*\)'`
- keyid=`expr $keyid + 0`
- echo "$keyid" > managed.key.id
 diff --git a/bin/tests/system/dnssec/ns2/sign.sh b/bin/tests/system/dnssec/ns2/sign.sh
-index ca18608..25b6cab 100644
+index b93651a..09b12ba 100644
 --- a/bin/tests/system/dnssec/ns2/sign.sh
 +++ b/bin/tests/system/dnssec/ns2/sign.sh
-@@ -30,8 +30,8 @@ do
- 	cp ../ns3/dsset-$subdomain.example$TP .
- done
- 
--keyname1=`$KEYGEN -q -r $RANDFILE -a DSA -b 768 -n zone $zone`
--keyname2=`$KEYGEN -q -r $RANDFILE -a DSA -b 768 -n zone $zone`
-+keyname1=`$KEYGEN -q -r $RANDFILE -a DSA -b 1024 -n zone $zone`
-+keyname2=`$KEYGEN -q -r $RANDFILE -a DSA -b 1024 -n zone $zone`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- 
-@@ -91,8 +91,8 @@ zone=in-addr.arpa.
+@@ -126,8 +126,8 @@ zone=in-addr.arpa.
  infile=in-addr.arpa.db.in
  zonefile=in-addr.arpa.db
  
@@ -1194,7 +960,7 @@ index ca18608..25b6cab 100644
  
  cat $infile $keyname1.key $keyname2.key >$zonefile
  $SIGNER -P -g -r $RANDFILE -o $zone -k $keyname1 $zonefile $keyname2 > /dev/null
-@@ -103,7 +103,7 @@ privzone=private.secure.example.
+@@ -138,7 +138,7 @@ privzone=private.secure.example
  privinfile=private.secure.example.db.in
  privzonefile=private.secure.example.db
  
@@ -1203,102 +969,15 @@ index ca18608..25b6cab 100644
  
  cat $privinfile $privkeyname.key >$privzonefile
  
-@@ -117,7 +117,7 @@ dlvinfile=dlv.db.in
+@@ -152,7 +152,7 @@ dlvinfile=dlv.db.in
  dlvzonefile=dlv.db
- dlvsetfile=dlvset-`echo $privzone |sed -e "s/\.$//g"`$TP
+ dlvsetfile=dlvset-${privzone}${TP}
  
 -dlvkeyname=`$KEYGEN -q -r $RANDFILE -a RSAMD5 -b 768 -n zone $dlvzone`
 +dlvkeyname=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 1024 -n zone $dlvzone`
  
  cat $dlvinfile $dlvkeyname.key $dlvsetfile > $dlvzonefile
  
-diff --git a/bin/tests/system/dnssec/ns3/sign.sh b/bin/tests/system/dnssec/ns3/sign.sh
-index ff55d84..4f6a251 100644
---- a/bin/tests/system/dnssec/ns3/sign.sh
-+++ b/bin/tests/system/dnssec/ns3/sign.sh
-@@ -28,7 +28,7 @@ zone=bogus.example.
- infile=bogus.example.db.in
- zonefile=bogus.example.db
- 
--keyname=`$KEYGEN -q -r $RANDFILE -a RSAMD5 -b 768 -n zone $zone`
-+keyname=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 2048 -n zone $zone`
- 
- cat $infile $keyname.key >$zonefile
- 
-@@ -38,8 +38,8 @@ zone=dynamic.example.
- infile=dynamic.example.db.in
- zonefile=dynamic.example.db
- 
--keyname1=`$KEYGEN -q -r $RANDFILE -a RSAMD5 -b 768 -n zone $zone`
--keyname2=`$KEYGEN -q -r $RANDFILE -a RSAMD5 -b 1024 -n zone -f KSK $zone`
-+keyname1=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 2048 -n zone $zone`
-+keyname2=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 2048 -n zone -f KSK $zone`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- 
-@@ -49,7 +49,7 @@ zone=keyless.example.
- infile=generic.example.db.in
- zonefile=keyless.example.db
- 
--keyname=`$KEYGEN -q -r $RANDFILE -a RSAMD5 -b 768 -n zone $zone`
-+keyname=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 2048 -n zone $zone`
- 
- cat $infile $keyname.key >$zonefile
- 
-@@ -69,7 +69,7 @@ zone=secure.nsec3.example.
- infile=secure.nsec3.example.db.in
- zonefile=secure.nsec3.example.db
- 
--keyname=`$KEYGEN -q -r $RANDFILE -a RSAMD5 -b 768 -n zone $zone`
-+keyname=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 2048 -n zone $zone`
- 
- cat $infile $keyname.key >$zonefile
- 
-@@ -82,7 +82,7 @@ zone=nsec3.nsec3.example.
- infile=nsec3.nsec3.example.db.in
- zonefile=nsec3.nsec3.example.db
- 
--keyname=`$KEYGEN -q -r $RANDFILE -a NSEC3RSASHA1 -b 768 -n zone $zone`
-+keyname=`$KEYGEN -q -r $RANDFILE -a NSEC3RSASHA1 -b 1024 -n zone $zone`
- 
- cat $infile $keyname.key >$zonefile
- 
-@@ -95,7 +95,7 @@ zone=optout.nsec3.example.
- infile=optout.nsec3.example.db.in
- zonefile=optout.nsec3.example.db
- 
--keyname=`$KEYGEN -q -r $RANDFILE -a NSEC3RSASHA1 -b 768 -n zone $zone`
-+keyname=`$KEYGEN -q -r $RANDFILE -a NSEC3RSASHA1 -b 1024 -n zone $zone`
- 
- cat $infile $keyname.key >$zonefile
- 
-@@ -108,7 +108,7 @@ zone=nsec3.example.
- infile=nsec3.example.db.in
- zonefile=nsec3.example.db
- 
--keyname=`$KEYGEN -q -r $RANDFILE -a NSEC3RSASHA1 -b 768 -n zone $zone`
-+keyname=`$KEYGEN -q -r $RANDFILE -a NSEC3RSASHA1 -b 1024 -n zone $zone`
- 
- cat $infile $keyname.key >$zonefile
- 
-@@ -121,7 +121,7 @@ zone=secure.optout.example.
- infile=secure.optout.example.db.in
- zonefile=secure.optout.example.db
- 
--keyname=`$KEYGEN -q -r $RANDFILE -a RSAMD5 -b 768 -n zone $zone`
-+keyname=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 2048 -n zone $zone`
- 
- cat $infile $keyname.key >$zonefile
- 
-@@ -533,7 +533,7 @@ zone=badds.example.
- infile=bogus.example.db.in
- zonefile=badds.example.db
- 
--keyname=`$KEYGEN -q -r $RANDFILE -a RSAMD5 -b 768 -n zone $zone`
-+keyname=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 2048 -n zone $zone`
- 
- cat $infile $keyname.key >$zonefile
- 
 diff --git a/bin/tests/system/dnssec/ns5/trusted.conf.bad b/bin/tests/system/dnssec/ns5/trusted.conf.bad
 index ed30460..e6b1126 100644
 --- a/bin/tests/system/dnssec/ns5/trusted.conf.bad
@@ -1311,28 +990,10 @@ index ed30460..e6b1126 100644
 +    "." 256 3 8 "AwEAAarwAdjV4gIhpBCjXVAScRFEx3co7k8smJdxrnqoGsl5NB7EZ9jRdgvCXbJn6v8y9jlNWVHvaC8ilhfhLh0A1vLWiWv4ijd/12xcnrY7xpG7Cu3YkxUxaXJ7Jdg/Iw1+9mGgXF1v4UbCIcw/3U3cxyk7OxYg+VSb5KBAQSR0upxV";
  };
 diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh
-index 646434f..9a10f9f 100644
+index 51dc117..48cb34b 100644
 --- a/bin/tests/system/dnssec/tests.sh
 +++ b/bin/tests/system/dnssec/tests.sh
-@@ -1688,7 +1688,7 @@ ret=0
- $RNDCCMD 10.53.0.4 secroots 2>&1 | sed 's/^/ns4 /' | cat_i
- keyid=`cat ns1/managed.key.id`
- cp ns4/named.secroots named.secroots.test$n
--linecount=`grep "./RSAMD5/$keyid ; trusted" named.secroots.test$n | wc -l`
-+linecount=`grep "./RSASHA256/$keyid ; trusted" named.secroots.test$n | wc -l`
- [ "$linecount" -eq 1 ] || ret=1
- linecount=`cat named.secroots.test$n | wc -l`
- [ "$linecount" -eq 10 ] || ret=1
-@@ -3016,7 +3016,7 @@ echo_i "check dig's +nocrypto flag ($n)"
- ret=0
- $DIG $DIGOPTS +norec +nocrypto DNSKEY . \
- 	@10.53.0.1 > dig.out.dnskey.ns1.test$n || ret=1
--grep '256 3 1 \[key id = [1-9][0-9]*]' dig.out.dnskey.ns1.test$n > /dev/null || ret=1
-+grep '256 3 8 \[key id = [1-9][0-9]*]' dig.out.dnskey.ns1.test$n > /dev/null || ret=1
- grep 'RRSIG.* \[omitted]' dig.out.dnskey.ns1.test$n > /dev/null || ret=1
- $DIG $DIGOPTS +norec +nocrypto DS example \
- 	@10.53.0.1 > dig.out.ds.ns1.test$n || ret=1
-@@ -3128,8 +3128,8 @@ do
+@@ -3227,8 +3227,8 @@ do
  	   alg=`expr $alg + 1`
  	   continue;;
  	3) size="-b 512";;
@@ -1344,7 +1005,7 @@ index 646434f..9a10f9f 100644
  	8) size="-b 512";;
  	10) size="-b 1024";;
 diff --git a/bin/tests/system/feature-test.c b/bin/tests/system/feature-test.c
-index f934b63..11863a3 100644
+index 3ac34e8..428d107 100644
 --- a/bin/tests/system/feature-test.c
 +++ b/bin/tests/system/feature-test.c
 @@ -19,6 +19,7 @@
@@ -1363,7 +1024,7 @@ index f934b63..11863a3 100644
  	fprintf(stderr, "	--rpz-nsdname\n");
  	fprintf(stderr, "	--rpz-nsip\n");
  	fprintf(stderr, "	--with-idn\n");
-@@ -136,6 +138,18 @@ main(int argc, char **argv) {
+@@ -137,6 +139,18 @@ main(int argc, char **argv) {
  #endif
  	}
  
@@ -1488,10 +1149,10 @@ index 4549184..cb7dccd 100644
  };
  
 diff --git a/bin/tests/system/nsupdate/setup.sh b/bin/tests/system/nsupdate/setup.sh
-index 45dfeeb..594db77 100644
+index 21805c5..0d3d85c 100644
 --- a/bin/tests/system/nsupdate/setup.sh
 +++ b/bin/tests/system/nsupdate/setup.sh
-@@ -63,7 +63,12 @@ EOF
+@@ -58,7 +58,12 @@ EOF
  
  $DDNSCONFGEN -q -r $RANDFILE -z example.nil > ns1/ddns.key
  
@@ -1506,10 +1167,10 @@ index 45dfeeb..594db77 100644
  $DDNSCONFGEN -q -r $RANDFILE -a hmac-sha224 -k sha224-key -z keytests.nil > ns1/sha224.key
  $DDNSCONFGEN -q -r $RANDFILE -a hmac-sha256 -k sha256-key -z keytests.nil > ns1/sha256.key
 diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh
-index 901cd22..b72b59c 100755
+index 4da4849..b3bc807 100755
 --- a/bin/tests/system/nsupdate/tests.sh
 +++ b/bin/tests/system/nsupdate/tests.sh
-@@ -700,7 +700,14 @@ fi
+@@ -708,7 +708,14 @@ fi
  n=`expr $n + 1`
  ret=0
  echo_i "check TSIG key algorithms ($n)"
@@ -1525,7 +1186,7 @@ index 901cd22..b72b59c 100755
      $NSUPDATE -k ns1/${alg}.key <<END > /dev/null || ret=1
  server 10.53.0.1 ${PORT}
  update add ${alg}.keytests.nil. 600 A 10.10.10.3
-@@ -708,7 +715,7 @@ send
+@@ -716,7 +723,7 @@ send
  END
  done
  sleep 2
diff --git a/bind-9.11-rt31459.patch b/bind-9.11-rt31459.patch
index e24aa8d..1eee414 100644
--- a/bind-9.11-rt31459.patch
+++ b/bind-9.11-rt31459.patch
@@ -1,4 +1,4 @@
-From 99fc89de7b96713a7c82ea9b98d5bc0c70ad1f6e Mon Sep 17 00:00:00 2001
+From 255fdf0b549ab2f138443ead0ac81bf864612217 Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Tue, 12 Sep 2017 19:05:46 -0700
 Subject: [PATCH] rebased rt31459c
@@ -22,7 +22,7 @@ Include new unit test
  bin/dnssec/dnssec-verify.c               |   8 +-
  bin/dnssec/dnssectool.c                  |  11 +-
  bin/named/server.c                       |   6 +
- bin/nsupdate/nsupdate.c                  |  18 +-
+ bin/nsupdate/nsupdate.c                  |  14 +-
  bin/tests/makejournal.c                  |   6 +-
  bin/tests/system/pipelined/pipequeries.c |  21 +-
  bin/tests/system/pipelined/tests.sh      |   4 +-
@@ -49,7 +49,7 @@ Include new unit test
  lib/isc/pk11.c                           |  12 +-
  lib/isc/win32/include/isc/platform.h.in  |   5 +
  win32utils/Configure                     |  29 ++-
- 36 files changed, 707 insertions(+), 175 deletions(-)
+ 36 files changed, 703 insertions(+), 175 deletions(-)
  create mode 100644 lib/dns/tests/dstrandom_test.c
 
 diff --git a/bin/confgen/keygen.c b/bin/confgen/keygen.c
@@ -71,7 +71,7 @@ index 5015abb..295e16f 100644
  							     &entropy_source,
  							     randomfile,
 diff --git a/bin/dnssec/dnssec-dsfromkey.c b/bin/dnssec/dnssec-dsfromkey.c
-index 931d5de..864f2ad 100644
+index 060892b..c2cc9c7 100644
 --- a/bin/dnssec/dnssec-dsfromkey.c
 +++ b/bin/dnssec/dnssec-dsfromkey.c
 @@ -494,14 +494,14 @@ main(int argc, char **argv) {
@@ -293,7 +293,7 @@ index fbc7ece..31a99e7 100644
  					   usekeyboard);
  
 diff --git a/bin/named/server.c b/bin/named/server.c
-index b63a386..30e7eac 100644
+index 0abbbed..405ff71 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
 @@ -36,6 +36,7 @@
@@ -324,18 +324,10 @@ index b63a386..30e7eac 100644
  		}
  	}
 diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
-index 509784c..6d7a02e 100644
+index bbb3936..0286987 100644
 --- a/bin/nsupdate/nsupdate.c
 +++ b/bin/nsupdate/nsupdate.c
-@@ -35,6 +35,7 @@
- #include <isc/mem.h>
- #include <isc/parseint.h>
- #include <isc/print.h>
-+#include <isc/platform.h>
- #include <isc/random.h>
- #include <isc/region.h>
- #include <isc/sockaddr.h>
-@@ -271,7 +272,8 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
+@@ -272,7 +272,8 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
  	if (*ectx == NULL) {
  		result = isc_entropy_create(mctx, ectx);
  		if (result != ISC_R_SUCCESS)
@@ -345,7 +337,7 @@ index 509784c..6d7a02e 100644
  		ISC_LIST_INIT(sources);
  	}
  
-@@ -280,6 +282,13 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
+@@ -281,6 +282,13 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
  		randomfile = NULL;
  	}
  
@@ -359,7 +351,7 @@ index 509784c..6d7a02e 100644
  	result = isc_entropy_usebestsource(*ectx, &source, randomfile,
  					   usekeyboard);
  
-@@ -950,11 +959,11 @@ setup_system(void) {
+@@ -979,11 +987,11 @@ setup_system(void) {
  		}
  	}
  
@@ -373,16 +365,6 @@ index 509784c..6d7a02e 100644
  
  	result = dns_dispatchmgr_create(gmctx, entropy, &dispatchmgr);
  	check_result(result, "dns_dispatchmgr_create");
-@@ -978,6 +987,9 @@ setup_system(void) {
- 	check_result(result, "dst_lib_init");
- 	is_dst_up = true;
- 
-+	/* moved after dst_lib_init() */
-+	isc_hash_init();
-+
- 	attrmask = DNS_DISPATCHATTR_UDP | DNS_DISPATCHATTR_TCP;
- 	attrmask |= DNS_DISPATCHATTR_IPV4 | DNS_DISPATCHATTR_IPV6;
- 
 diff --git a/bin/tests/makejournal.c b/bin/tests/makejournal.c
 index 61a41b0..acc71a1 100644
 --- a/bin/tests/makejournal.c
@@ -707,7 +689,7 @@ index b27fc1d..e28871b 100644
  	parse_args(false, argc, argv);
  	if (server == NULL)
 diff --git a/configure b/configure
-index e425720..4f09c96 100755
+index b219e16..4da30b9 100755
 --- a/configure
 +++ b/configure
 @@ -640,6 +640,7 @@ ac_includes_default="\
@@ -718,7 +700,7 @@ index e425720..4f09c96 100755
  BUILD_LIBS
  BUILD_LDFLAGS
  BUILD_CPPFLAGS
-@@ -824,6 +825,7 @@ XMLSTATS
+@@ -823,6 +824,7 @@ XMLSTATS
  NZDTARGETS
  NZDSRCS
  NZD_TOOLS
@@ -726,7 +708,7 @@ index e425720..4f09c96 100755
  PKCS11_TEST
  PKCS11_ED25519
  PKCS11_GOST
-@@ -1039,6 +1041,7 @@ with_eddsa
+@@ -1038,6 +1040,7 @@ with_eddsa
  with_aes
  enable_openssl_hash
  with_cc_alg
@@ -734,7 +716,7 @@ index e425720..4f09c96 100755
  with_lmdb
  with_libxml2
  with_libjson
-@@ -1735,6 +1738,7 @@ Optional Features:
+@@ -1734,6 +1737,7 @@ Optional Features:
    --enable-threads        enable multithreading
    --enable-native-pkcs11  use native PKCS11 for all crypto [default=no]
    --enable-openssl-hash   use OpenSSL for hash functions [default=no]
@@ -742,7 +724,7 @@ index e425720..4f09c96 100755
    --enable-largefile      64-bit file support
    --enable-backtrace      log stack backtrace on abort [default=yes]
    --enable-symtable       use internal symbol table for backtrace
-@@ -16684,6 +16688,7 @@ case "$use_openssl" in
+@@ -16686,6 +16690,7 @@ case "$use_openssl" in
  $as_echo "disabled because of native PKCS11" >&6; }
  		DST_OPENSSL_INC=""
  		CRYPTO="-DPKCS11CRYPTO"
@@ -750,7 +732,7 @@ index e425720..4f09c96 100755
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -16698,6 +16703,7 @@ $as_echo "disabled because of native PKCS11" >&6; }
+@@ -16700,6 +16705,7 @@ $as_echo "disabled because of native PKCS11" >&6; }
  $as_echo "no" >&6; }
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -758,7 +740,7 @@ index e425720..4f09c96 100755
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -16710,6 +16716,7 @@ $as_echo "no" >&6; }
+@@ -16712,6 +16718,7 @@ $as_echo "no" >&6; }
  	auto)
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -766,7 +748,7 @@ index e425720..4f09c96 100755
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -16719,7 +16726,7 @@ $as_echo "no" >&6; }
+@@ -16721,7 +16728,7 @@ $as_echo "no" >&6; }
  		OPENSSLLINKOBJS=""
  		OPENSSLLINKSRCS=""
  		as_fn_error $? "OpenSSL was not found in any of $openssldirs; use --with-openssl=/path
@@ -775,7 +757,7 @@ index e425720..4f09c96 100755
  		;;
  	*)
  		if test "yes" = "$want_native_pkcs11"
-@@ -16750,6 +16757,7 @@ $as_echo "not found" >&6; }
+@@ -16752,6 +16759,7 @@ $as_echo "not found" >&6; }
  			as_fn_error $? "\"$use_openssl/include/openssl/opensslv.h\" not found" "$LINENO" 5
  		fi
  		CRYPTO='-DOPENSSL'
@@ -783,7 +765,7 @@ index e425720..4f09c96 100755
  		if test "/usr" = "$use_openssl"
  		then
  			DST_OPENSSL_INC=""
-@@ -17411,8 +17419,6 @@ fi
+@@ -17413,8 +17421,6 @@ fi
  # Use OpenSSL for hash functions
  #
  
@@ -792,7 +774,7 @@ index e425720..4f09c96 100755
  ISC_PLATFORM_OPENSSLHASH="#undef ISC_PLATFORM_OPENSSLHASH"
  case $want_openssl_hash in
  	yes)
-@@ -17787,6 +17793,86 @@ if test "rt" = "$have_clock_gt"; then
+@@ -17789,6 +17795,86 @@ if test "rt" = "$have_clock_gt"; then
  	LIBS="-lrt $LIBS"
  fi
  
@@ -879,7 +861,7 @@ index e425720..4f09c96 100755
  #
  # was --with-lmdb specified?
  #
-@@ -19869,9 +19955,12 @@ _ACEOF
+@@ -19871,9 +19957,12 @@ _ACEOF
  if ac_fn_c_try_compile "$LINENO"; then :
    { $as_echo "$as_me:${as_lineno-$LINENO}: result: size_t for buflen; int for flags" >&5
  $as_echo "size_t for buflen; int for flags" >&6; }
@@ -894,7 +876,7 @@ index e425720..4f09c96 100755
  
  	 $as_echo "#define IRS_GETNAMEINFO_FLAGS_T int" >>confdefs.h
  
-@@ -21186,12 +21275,7 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
+@@ -21188,12 +21277,7 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
  ISC_PLATFORM_USESTDASM="#undef ISC_PLATFORM_USESTDASM"
  ISC_PLATFORM_USEMACASM="#undef ISC_PLATFORM_USEMACASM"
  if test "yes" = "$use_atomic"; then
@@ -908,7 +890,7 @@ index e425720..4f09c96 100755
  # version HP92453-01 B.11.11.23709.GP, which incorrectly rejects
  # declarations like `int a3[[(sizeof (unsigned char)) >= 0]];'.
  # This bug is HP SR number 8606223364.
-@@ -21224,6 +21308,11 @@ cat >>confdefs.h <<_ACEOF
+@@ -21226,6 +21310,11 @@ cat >>confdefs.h <<_ACEOF
  _ACEOF
  
  
@@ -920,7 +902,7 @@ index e425720..4f09c96 100755
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -21232,39 +21321,6 @@ _ACEOF
+@@ -21234,39 +21323,6 @@ _ACEOF
  		fi
  	;;
  	x86_64-*|amd64-*)
@@ -960,7 +942,7 @@ index e425720..4f09c96 100755
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -21295,6 +21351,10 @@ $as_echo_n "checking architecture type for atomic operations... " >&6; }
+@@ -21297,6 +21353,10 @@ $as_echo_n "checking architecture type for atomic operations... " >&6; }
  $as_echo "$arch" >&6; }
  fi
  
@@ -971,7 +953,7 @@ index e425720..4f09c96 100755
  if test "yes" = "$have_atomic"; then
  	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking compiler support for inline assembly code" >&5
  $as_echo_n "checking compiler support for inline assembly code... " >&6; }
-@@ -23848,6 +23908,30 @@ CFLAGS="$CFLAGS $SO_CFLAGS"
+@@ -23896,6 +23956,30 @@ CFLAGS="$CFLAGS $SO_CFLAGS"
  #
  dlzdir='${DLZ_DRIVER_DIR}'
  
@@ -1002,7 +984,7 @@ index e425720..4f09c96 100755
  #
  # Private autoconf macro to simplify configuring drivers:
  #
-@@ -24178,11 +24262,11 @@ $as_echo "no" >&6; }
+@@ -24226,11 +24310,11 @@ $as_echo "no" >&6; }
  $as_echo "using mysql with libs ${mysql_lib} and includes ${mysql_include}" >&6; }
  		;;
  	*)
@@ -1017,7 +999,7 @@ index e425720..4f09c96 100755
  		fi
  
  	CONTRIB_DLZ="$CONTRIB_DLZ -DDLZ_MYSQL"
-@@ -24267,7 +24351,7 @@ $as_echo "" >&6; }
+@@ -24315,7 +24399,7 @@ $as_echo "" >&6; }
  			# Check other locations for includes.
  			# Order is important (sigh).
  
@@ -1026,7 +1008,7 @@ index e425720..4f09c96 100755
  			# include a blank element first
  			for d in "" $bdb_incdirs
  			do
-@@ -24292,57 +24376,9 @@ $as_echo "" >&6; }
+@@ -24340,57 +24424,9 @@ $as_echo "" >&6; }
  			bdb_libnames="db53 db-5.3 db51 db-5.1 db48 db-4.8 db47 db-4.7 db46 db-4.6 db45 db-4.5 db44 db-4.4 db43 db-4.3 db42 db-4.2 db41 db-4.1 db"
  			for d in $bdb_libnames
  			do
@@ -1086,7 +1068,7 @@ index e425720..4f09c96 100755
  					break
  				fi
  			done
-@@ -24501,10 +24537,10 @@ $as_echo "no" >&6; }
+@@ -24549,10 +24585,10 @@ $as_echo "no" >&6; }
  		DLZ_DRIVER_INCLUDES="$DLZ_DRIVER_INCLUDES -I$use_dlz_ldap/include"
  		DLZ_DRIVER_LDAP_INCLUDES="-I$use_dlz_ldap/include"
  	fi
@@ -1100,7 +1082,7 @@ index e425720..4f09c96 100755
  	fi
  
  
-@@ -24590,11 +24626,11 @@ fi
+@@ -24638,11 +24674,11 @@ fi
  		odbcdirs="/usr /usr/local /usr/pkg"
  		for d in $odbcdirs
  		do
@@ -1114,7 +1096,7 @@ index e425720..4f09c96 100755
  				break
  			fi
  		done
-@@ -24869,6 +24905,8 @@ DNS_CRYPTO_LIBS="$NEWFLAGS"
+@@ -24917,6 +24953,8 @@ DNS_CRYPTO_LIBS="$NEWFLAGS"
  
  
  
@@ -1123,7 +1105,7 @@ index e425720..4f09c96 100755
  #
  # Commands to run at the end of config.status.
  # Don't just put these into configure, it won't work right if somebody
-@@ -27248,6 +27286,8 @@ report() {
+@@ -27295,6 +27333,8 @@ report() {
  	    echo "    IPv6 support (--enable-ipv6)"
  	test "X$CRYPTO" = "X" -o "yes" = "$want_native_pkcs11" || \
  		echo "    OpenSSL cryptography/DNSSEC (--with-openssl)"
@@ -1132,7 +1114,7 @@ index e425720..4f09c96 100755
  	test "X$PYTHON" = "X" || echo "    Python tools (--with-python)"
  	test "X$XMLSTATS" = "X" || echo "    XML statistics (--with-libxml2)"
  	test "X$JSONSTATS" = "X" || echo "    JSON statistics (--with-libjson)"
-@@ -27288,6 +27328,8 @@ report() {
+@@ -27335,6 +27375,8 @@ report() {
  	echo "    Very verbose query trace logging (--enable-querytrace)"
      test "no" = "$with_cmocka" || echo "    CMocka Unit Testing Framework (--with-cmocka)"
  
@@ -1141,7 +1123,7 @@ index e425720..4f09c96 100755
      echo "    Dynamically loadable zone (DLZ) drivers:"
      test "no" = "$use_dlz_bdb" || \
  	echo "        Berkeley DB (--with-dlz-bdb)"
-@@ -27335,6 +27377,8 @@ report() {
+@@ -27382,6 +27424,8 @@ report() {
  	echo "    ECDSA algorithm support (--with-ecdsa)"
      test "X$CRYPTO" = "X" -o "yes" = "$OPENSSL_ED25519" -o "yes" = "$PKCS11_ED25519" || \
  	echo "    EDDSA algorithm support (--with-eddsa)"
@@ -1151,10 +1133,10 @@ index e425720..4f09c96 100755
      test "yes" = "$enable_seccomp" || \
  	echo "    Use libseccomp system call filtering (--enable-seccomp)"
 diff --git a/configure.ac b/configure.ac
-index 7c5ad51..fddc63a 100644
+index 7fd192c..5e4e839 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -1503,6 +1503,7 @@ case "$use_openssl" in
+@@ -1514,6 +1514,7 @@ case "$use_openssl" in
  		AC_MSG_RESULT(disabled because of native PKCS11)
  		DST_OPENSSL_INC=""
  		CRYPTO="-DPKCS11CRYPTO"
@@ -1162,7 +1144,7 @@ index 7c5ad51..fddc63a 100644
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -1516,6 +1517,7 @@ case "$use_openssl" in
+@@ -1527,6 +1528,7 @@ case "$use_openssl" in
  		AC_MSG_RESULT(no)
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -1170,7 +1152,7 @@ index 7c5ad51..fddc63a 100644
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -1528,6 +1530,7 @@ case "$use_openssl" in
+@@ -1539,6 +1541,7 @@ case "$use_openssl" in
  	auto)
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -1178,7 +1160,7 @@ index 7c5ad51..fddc63a 100644
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -1538,7 +1541,7 @@ case "$use_openssl" in
+@@ -1549,7 +1552,7 @@ case "$use_openssl" in
  		OPENSSLLINKSRCS=""
  		AC_MSG_ERROR(
  [OpenSSL was not found in any of $openssldirs; use --with-openssl=/path
@@ -1187,7 +1169,7 @@ index 7c5ad51..fddc63a 100644
  		;;
  	*)
  		if test "yes" = "$want_native_pkcs11"
-@@ -1568,6 +1571,7 @@ If you don't want OpenSSL, use --without-openssl])
+@@ -1579,6 +1582,7 @@ If you don't want OpenSSL, use --without-openssl])
  			AC_MSG_ERROR(["$use_openssl/include/openssl/opensslv.h" not found])
  		fi
  		CRYPTO='-DOPENSSL'
@@ -1195,7 +1177,7 @@ index 7c5ad51..fddc63a 100644
  		if test "/usr" = "$use_openssl"
  		then
  			DST_OPENSSL_INC=""
-@@ -2041,7 +2045,6 @@ fi
+@@ -2052,7 +2056,6 @@ fi
  # Use OpenSSL for hash functions
  #
  
@@ -1203,7 +1185,7 @@ index 7c5ad51..fddc63a 100644
  ISC_PLATFORM_OPENSSLHASH="#undef ISC_PLATFORM_OPENSSLHASH"
  case $want_openssl_hash in
  	yes)
-@@ -2313,6 +2316,67 @@ if test "rt" = "$have_clock_gt"; then
+@@ -2324,6 +2327,67 @@ if test "rt" = "$have_clock_gt"; then
  	LIBS="-lrt $LIBS"
  fi
  
@@ -1271,7 +1253,7 @@ index 7c5ad51..fddc63a 100644
  #
  # was --with-lmdb specified?
  #
-@@ -4109,12 +4173,12 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
+@@ -4120,12 +4184,12 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
  ISC_PLATFORM_USESTDASM="#undef ISC_PLATFORM_USESTDASM"
  ISC_PLATFORM_USEMACASM="#undef ISC_PLATFORM_USEMACASM"
  if test "yes" = "$use_atomic"; then
@@ -1285,7 +1267,7 @@ index 7c5ad51..fddc63a 100644
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -4123,7 +4187,6 @@ if test "yes" = "$use_atomic"; then
+@@ -4134,7 +4198,6 @@ if test "yes" = "$use_atomic"; then
  		fi
  	;;
  	x86_64-*|amd64-*)
@@ -1293,7 +1275,7 @@ index 7c5ad51..fddc63a 100644
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -5541,6 +5604,8 @@ report() {
+@@ -5543,6 +5606,8 @@ report() {
  	    echo "    IPv6 support (--enable-ipv6)"
  	test "X$CRYPTO" = "X" -o "yes" = "$want_native_pkcs11" || \
  		echo "    OpenSSL cryptography/DNSSEC (--with-openssl)"
@@ -1302,7 +1284,7 @@ index 7c5ad51..fddc63a 100644
  	test "X$PYTHON" = "X" || echo "    Python tools (--with-python)"
  	test "X$XMLSTATS" = "X" || echo "    XML statistics (--with-libxml2)"
  	test "X$JSONSTATS" = "X" || echo "    JSON statistics (--with-libjson)"
-@@ -5581,6 +5646,8 @@ report() {
+@@ -5583,6 +5648,8 @@ report() {
  	echo "    Very verbose query trace logging (--enable-querytrace)"
      test "no" = "$with_cmocka" || echo "    CMocka Unit Testing Framework (--with-cmocka)"
  
@@ -1311,7 +1293,7 @@ index 7c5ad51..fddc63a 100644
      echo "    Dynamically loadable zone (DLZ) drivers:"
      test "no" = "$use_dlz_bdb" || \
  	echo "        Berkeley DB (--with-dlz-bdb)"
-@@ -5628,6 +5695,8 @@ report() {
+@@ -5630,6 +5697,8 @@ report() {
  	echo "    ECDSA algorithm support (--with-ecdsa)"
      test "X$CRYPTO" = "X" -o "yes" = "$OPENSSL_ED25519" -o "yes" = "$PKCS11_ED25519" || \
  	echo "    EDDSA algorithm support (--with-eddsa)"
@@ -2034,10 +2016,10 @@ index 5b8a2c9..913a2ce 100644
   * Define if the hash functions must be provided by OpenSSL.
   */
 diff --git a/win32utils/Configure b/win32utils/Configure
-index ad99f89..2c55946 100644
+index 27b00af..7e35d60 100644
 --- a/win32utils/Configure
 +++ b/win32utils/Configure
-@@ -381,6 +381,7 @@ my @substdefh = ("AES_CC",
+@@ -380,6 +380,7 @@ my @substdefh = ("AES_CC",
  my %configdefp;
  
  my @substdefp = ("ISC_PLATFORM_BUSYWAITNOP",
@@ -2045,7 +2027,7 @@ index ad99f89..2c55946 100644
                   "ISC_PLATFORM_HAVEATOMICSTORE",
                   "ISC_PLATFORM_HAVEATOMICSTOREQ",
                   "ISC_PLATFORM_HAVECMPXCHG",
-@@ -510,7 +511,8 @@ my @allcond = (@substcond, "NOTYET", "NOLONGER");
+@@ -509,7 +510,8 @@ my @allcond = (@substcond, "NOTYET", "NOLONGER");
  
  # enable-xxx/disable-xxx
  
@@ -2055,7 +2037,7 @@ index ad99f89..2c55946 100644
                    "fixed-rrset",
                    "intrinsics",
                    "isc-spnego",
-@@ -573,6 +575,7 @@ my @help = (
+@@ -572,6 +574,7 @@ my @help = (
  "\nOptional Features:\n",
  "  enable-intrinsics     enable instrinsic/atomic functions [default=yes]\n",
  "  enable-native-pkcs11  use native PKCS#11 for all crypto [default=no]\n",
@@ -2063,7 +2045,7 @@ index ad99f89..2c55946 100644
  "  enable-openssl-hash   use OpenSSL for hash functions [default=yes]\n",
  "  enable-isc-spnego     use SPNEGO from lib/dns [default=yes]\n",
  "  enable-filter-aaaa    enable filtering of AAAA records [default=yes]\n",
-@@ -617,7 +620,9 @@ my $want_clean = "no";
+@@ -616,7 +619,9 @@ my $want_clean = "no";
  my $want_unknown = "no";
  my $unknown_value;
  my $enable_intrinsics = "yes";
@@ -2073,7 +2055,7 @@ index ad99f89..2c55946 100644
  my $enable_openssl_hash = "auto";
  my $enable_filter_aaaa = "yes";
  my $enable_isc_spnego = "yes";
-@@ -828,6 +833,10 @@ sub myenable {
+@@ -834,6 +839,10 @@ sub myenable {
          if ($val =~ /^yes$/i) {
              $enable_native_pkcs11 = "yes";
          }
@@ -2084,7 +2066,7 @@ index ad99f89..2c55946 100644
      } elsif ($key =~ /^openssl-hash$/i) {
          if ($val =~ /^yes$/i) {
              $enable_openssl_hash = "yes";
-@@ -1119,6 +1128,11 @@ if ($verbose) {
+@@ -1125,6 +1134,11 @@ if ($verbose) {
      } else {
          print "native-pkcs11: disabled\n";
      }
@@ -2096,7 +2078,7 @@ index ad99f89..2c55946 100644
      if ($enable_openssl_hash eq "yes") {
          print "openssl-hash: enabled\n";
      } else {
-@@ -1472,6 +1486,7 @@ if ($enable_intrinsics eq "yes") {
+@@ -1478,6 +1492,7 @@ if ($enable_intrinsics eq "yes") {
  
  # enable-native-pkcs11
  if ($enable_native_pkcs11 eq "yes") {
@@ -2104,7 +2086,7 @@ index ad99f89..2c55946 100644
      if ($use_openssl eq "auto") {
          $use_openssl = "no";
      }
-@@ -1681,6 +1696,7 @@ if ($use_openssl eq "yes") {
+@@ -1687,6 +1702,7 @@ if ($use_openssl eq "yes") {
          $openssl_dll = File::Spec->catdir($openssl_path, "@dirlist[0]");
      }   
  
@@ -2112,7 +2094,7 @@ index ad99f89..2c55946 100644
      $configcond{"OPENSSL"} = 1;
      $configdefd{"CRYPTO"} = "OPENSSL";
      $configvar{"OPENSSL_PATH"} = "$openssl_path";
-@@ -2232,6 +2248,15 @@ if ($cookie_algorithm eq "sha1") {
+@@ -2238,6 +2254,15 @@ if ($cookie_algorithm eq "sha1") {
      die "Unrecognized cookie algorithm: $cookie_algorithm\n";
  }
  
@@ -2128,7 +2110,7 @@ index ad99f89..2c55946 100644
  # enable-openssl-hash
  if ($enable_openssl_hash eq "yes") {
      if ($use_openssl eq "no") {
-@@ -3558,6 +3583,7 @@ exit 0;
+@@ -3564,6 +3589,7 @@ exit 0;
  #  --enable-developer partially supported
  #  --enable-newstats (9.9/9.9sub only)
  #  --enable-native-pkcs11 supported
@@ -2136,7 +2118,7 @@ index ad99f89..2c55946 100644
  #  --enable-openssl-version-check included without a way to disable it
  #  --enable-openssl-hash supported
  #  --enable-threads included without a way to disable it
-@@ -3583,6 +3609,7 @@ exit 0;
+@@ -3589,6 +3615,7 @@ exit 0;
  #  --with-gost supported
  #  --with-aes supported
  #  --with-cc-alg supported
diff --git a/bind-9.11-tests-variants.patch b/bind-9.11-tests-variants.patch
index 55f4491..d983671 100644
--- a/bind-9.11-tests-variants.patch
+++ b/bind-9.11-tests-variants.patch
@@ -1,4 +1,4 @@
-From 7d689f77714430a4ef6cead040ec304dca0b8bd3 Mon Sep 17 00:00:00 2001
+From 06a22ff20ac3d68fa1f995c91068b43392425e43 Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Fri, 1 Mar 2019 15:48:20 +0100
 Subject: [PATCH] Make alternative named builds testable in system tests
@@ -17,19 +17,19 @@ export NAMED_VARIANT=-pkcs11 DNSSEC_VARIANT=-pkcs11
  1 file changed, 10 insertions(+), 9 deletions(-)
 
 diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
-index b072af8..d2cb8ed 100644
+index 4b0fe39..f135af6 100644
 --- a/bin/tests/system/conf.sh.in
 +++ b/bin/tests/system/conf.sh.in
-@@ -27,7 +27,7 @@ ALTERNATIVE_ALGORITHM=RSASHA1
- ALTERNATIVE_ALGORITHM_NUMBER=5
- ALTERNATIVE_BITS=1280
+@@ -34,7 +34,7 @@ DISABLED_ALGORITHM=ECDSAP384SHA384
+ DISABLED_ALGORITHM_NUMBER=14
+ DISABLED_BITS=384
  
 -NAMED=$TOP/bin/named/named
 +NAMED=$TOP/bin/named${NAMED_VARIANT}/named${NAMED_VARIANT}
  # We must use "named -l" instead of "lwresd" because argv[0] is lost
  # if the program is libtoolized.
  LWRESD="$TOP/bin/named/named -l"
-@@ -38,13 +38,14 @@ NSUPDATE=$TOP/bin/nsupdate/nsupdate
+@@ -45,13 +45,14 @@ NSUPDATE=$TOP/bin/nsupdate/nsupdate
  DDNSCONFGEN=$TOP/bin/confgen/ddns-confgen
  TSIGKEYGEN=$TOP/bin/confgen/tsig-keygen
  RNDCCONFGEN=$TOP/bin/confgen/rndc-confgen
@@ -51,7 +51,7 @@ index b072af8..d2cb8ed 100644
  CHECKDS=$TOP/bin/python/dnssec-checkds
  COVERAGE=$TOP/bin/python/dnssec-coverage
  KEYMGR=$TOP/bin/python/dnssec-keymgr
-@@ -64,7 +65,7 @@ DNSTAPREAD=$TOP/bin/tools/dnstap-read
+@@ -71,7 +72,7 @@ DNSTAPREAD=$TOP/bin/tools/dnstap-read
  MDIG=$TOP/bin/tools/mdig
  NZD2NZF=$TOP/bin/tools/named-nzd2nzf
  FSTRM_CAPTURE=@FSTRM_CAPTURE@
diff --git a/bind-9.11-unit-dnstap-pkcs11.patch b/bind-9.11-unit-dnstap-pkcs11.patch
deleted file mode 100644
index 60cc1cd..0000000
--- a/bind-9.11-unit-dnstap-pkcs11.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From dca9eea70cb33062905aefc389266da931e9d0d6 Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Thu, 14 Mar 2019 15:48:37 +0100
-Subject: [PATCH] Set TZ again before dns library is initialized
-
-PKCS11 uses it, initializes TZ offset from dst init. Setting environment
-in test is too late since use of cmocka.
----
- lib/dns/tests/dnstap_test.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/lib/dns/tests/dnstap_test.c b/lib/dns/tests/dnstap_test.c
-index 22d6dc3..5a60b12 100644
---- a/lib/dns/tests/dnstap_test.c
-+++ b/lib/dns/tests/dnstap_test.c
-@@ -309,9 +309,6 @@ totext_test(void **state) {
- 
- 	UNUSED(state);
- 
--	/* make sure text conversion gets the right local time */
--	setenv("TZ", "PST8", 1);
--
- 	result = dns_dt_open(TAPSAVED, dns_dtmode_file, mctx, &handle);
- 	assert_int_equal(result, ISC_R_SUCCESS);
- 
-@@ -378,6 +375,9 @@ main(void) {
- 		cmocka_unit_test_setup_teardown(totext_test, _setup, _teardown),
- 	};
- 
-+	/* make sure text conversion gets the right local time */
-+	setenv("TZ", "PST8", 1);
-+
- 	return (cmocka_run_group_tests(tests, dns_test_init, dns_test_final));
- #else
- 	print_message("1..0 # Skip dnstap not enabled\n");
--- 
-2.20.1
-
diff --git a/bind-9.11-unit-timer-nothread.patch b/bind-9.11-unit-timer-nothread.patch
deleted file mode 100644
index f913724..0000000
--- a/bind-9.11-unit-timer-nothread.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From c88ba11ced1311e91a73ffdf42114ed14a805725 Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Thu, 14 Mar 2019 21:05:34 +0100
-Subject: [PATCH] Workaround to kyua bug
-
-Kyua 0.13 is not able to correctly handle whole test skipping.
-Make workaround to it, include skipping message.
----
- lib/isc/tests/timer_test.c | 11 +++++++++--
- 1 file changed, 9 insertions(+), 2 deletions(-)
-
-diff --git a/lib/isc/tests/timer_test.c b/lib/isc/tests/timer_test.c
-index f69f2b3..050cf6d 100644
---- a/lib/isc/tests/timer_test.c
-+++ b/lib/isc/tests/timer_test.c
-@@ -573,14 +573,13 @@ purge(void **state) {
- 
- int
- main(int argc, char **argv) {
--	const struct CMUnitTest tests[] = {
- #ifdef ISC_PLATFORM_USETHREADS
-+	const struct CMUnitTest tests[] = {
- 		cmocka_unit_test_setup_teardown(ticker, _setup, _teardown),
- 		cmocka_unit_test_setup_teardown(once_life, _setup, _teardown),
- 		cmocka_unit_test_setup_teardown(once_idle, _setup, _teardown),
- 		cmocka_unit_test_setup_teardown(reset, _setup, _teardown),
- 		cmocka_unit_test_setup_teardown(purge, _setup, _teardown),
--#endif
- 	};
- 	int c;
- 
-@@ -595,6 +594,14 @@ main(int argc, char **argv) {
- 	}
- 
- 	return (cmocka_run_group_tests(tests, NULL, NULL));
-+#else
-+	UNUSED(argc);
-+	UNUSED(argv);
-+	UNUSED(verbose);
-+
-+	printf("1..0 # Skipped: threads disabled\n");
-+	return (0);
-+#endif
- }
- 
- #else /* HAVE_CMOCKA */
--- 
-2.20.1
-
diff --git a/bind-9.3.2b1-fix_sdb_ldap.patch b/bind-9.3.2b1-fix_sdb_ldap.patch
index d027bb9..35c8542 100644
--- a/bind-9.3.2b1-fix_sdb_ldap.patch
+++ b/bind-9.3.2b1-fix_sdb_ldap.patch
@@ -36,10 +36,10 @@ index 95ab742..6069f09 100644
  	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zone2sqlite@EXEEXT@ ${DESTDIR}${sbindir}
  	${INSTALL_DATA} ${srcdir}/zone2ldap.1 ${DESTDIR}${mandir}/man1/zone2ldap.1
 diff --git a/bin/sdb_tools/zone2ldap.c b/bin/sdb_tools/zone2ldap.c
-index 23dd873..d56bc56 100644
+index aa2c711..76186b5 100644
 --- a/bin/sdb_tools/zone2ldap.c
 +++ b/bin/sdb_tools/zone2ldap.c
-@@ -65,6 +66,9 @@ ldap_info;
+@@ -66,6 +66,9 @@ ldap_info;
  /* usage Info */
  void usage (void);
  
@@ -49,7 +49,7 @@ index 23dd873..d56bc56 100644
  /* Add to the ldap dit */
  void add_ldap_values (ldap_info * ldinfo);
  
-@@ -81,7 +85,7 @@ char **hostname_to_dn_list (char *hostname, char *zone, unsigned int flags);
+@@ -82,7 +85,7 @@ char **hostname_to_dn_list (char *hostname, char *zone, unsigned int flags);
  int get_attr_list_size (char **tmp);
  
  /* Get a DN */
@@ -58,7 +58,7 @@ index 23dd873..d56bc56 100644
  
  /* Add to RR list */
  void add_to_rr_list (char *dn, char *name, char *type, char *data,
-@@ -103,11 +107,27 @@ void
+@@ -104,11 +107,27 @@ void
  init_ldap_conn ();
  void usage();
  
@@ -91,7 +91,7 @@ index 23dd873..d56bc56 100644
  LDAP *conn;
  unsigned int debug = 0;
  
-@@ -131,12 +151,12 @@ main (int argc, char **argv)
+@@ -132,12 +151,12 @@ main (int argc, char **argv)
    isc_result_t result;
    char *basedn;
    ldap_info *tmp;
@@ -107,7 +107,7 @@ index 23dd873..d56bc56 100644
    dns_fixedname_t fixedzone, fixedname;
    dns_rdataset_t rdataset;
    char **dc_list;
-@@ -149,7 +169,7 @@ main (int argc, char **argv)
+@@ -150,7 +169,7 @@ main (int argc, char **argv)
    extern char *optarg;
    extern int optind, opterr, optopt;
    int create_base = 0;
@@ -116,7 +116,7 @@ index 23dd873..d56bc56 100644
  
    if (argc < 2)
      {
-@@ -157,7 +177,7 @@ main (int argc, char **argv)
+@@ -158,7 +177,7 @@ main (int argc, char **argv)
        exit (-1);
      }
  
@@ -125,7 +125,7 @@ index 23dd873..d56bc56 100644
      {
        switch (topt)
  	{
-@@ -180,6 +200,9 @@ main (int argc, char **argv)
+@@ -181,6 +200,9 @@ main (int argc, char **argv)
  	  if (bindpw == NULL)
  	    fatal("strdup");
  	  break;
@@ -135,7 +135,7 @@ index 23dd873..d56bc56 100644
  	case 'b':
  	  ldapbase = strdup (optarg);
  	  if (ldapbase == NULL)
-@@ -301,27 +324,62 @@ main (int argc, char **argv)
+@@ -300,27 +322,62 @@ main (int argc, char **argv)
      {
        if (debug)
  	printf ("Creating base zone DN %s\n", argzone);
@@ -208,7 +208,7 @@ index 23dd873..d56bc56 100644
  		}
  	      else
  		{
-@@ -330,8 +388,13 @@ main (int argc, char **argv)
+@@ -329,8 +386,13 @@ main (int argc, char **argv)
  		  else
  		    sprintf (fullbasedn, "%s", ctmp);
  		}
@@ -222,7 +222,7 @@ index 23dd873..d56bc56 100644
  	    }
  
  	}
-@@ -409,14 +472,14 @@ generate_ldap (dns_name_t * dnsname, dns_rdata_t * rdata, unsigned int ttl)
+@@ -408,14 +470,14 @@ generate_ldap (dns_name_t * dnsname, dns_rdata_t * rdata, unsigned int ttl)
    isc_result_check (result, "dns_rdata_totext");
    data[isc_buffer_usedlength (&buff)] = 0;
  
@@ -240,7 +240,7 @@ index 23dd873..d56bc56 100644
  }
  
  
-@@ -456,7 +519,8 @@ add_to_rr_list (char *dn, char *name, char *type,
+@@ -455,7 +517,8 @@ add_to_rr_list (char *dn, char *name, char *type,
    int attrlist;
    char ldap_type_buffer[128];
    char charttl[64];
@@ -250,7 +250,7 @@ index 23dd873..d56bc56 100644
  
    if ((tmp = locate_by_dn (dn)) == NULL)
      {
-@@ -483,13 +547,13 @@ add_to_rr_list (char *dn, char *name, char *type,
+@@ -482,13 +545,13 @@ add_to_rr_list (char *dn, char *name, char *type,
  	    fatal("malloc");
  	}
        tmp->attrs[0]->mod_op = LDAP_MOD_ADD;
@@ -267,7 +267,7 @@ index 23dd873..d56bc56 100644
  	  tmp->attrs[1] = NULL;
  	  tmp->attrcnt = 2;
  	  tmp->next = ldap_info_base;
-@@ -498,7 +562,7 @@ add_to_rr_list (char *dn, char *name, char *type,
+@@ -497,7 +560,7 @@ add_to_rr_list (char *dn, char *name, char *type,
  	}
  
        tmp->attrs[1]->mod_op = LDAP_MOD_ADD;
@@ -276,7 +276,7 @@ index 23dd873..d56bc56 100644
        tmp->attrs[1]->mod_values = (char **) calloc (sizeof (char *), 2);
  
        if (tmp->attrs[1]->mod_values == (char **)NULL)
-@@ -527,7 +591,7 @@ add_to_rr_list (char *dn, char *name, char *type,
+@@ -526,7 +589,7 @@ add_to_rr_list (char *dn, char *name, char *type,
  	 fatal("strdup");
  
        tmp->attrs[3]->mod_op = LDAP_MOD_ADD;
@@ -285,7 +285,7 @@ index 23dd873..d56bc56 100644
        tmp->attrs[3]->mod_values = (char **) calloc (sizeof (char *), 2);
  
        if (tmp->attrs[3]->mod_values == (char **)NULL)
-@@ -540,14 +604,25 @@ add_to_rr_list (char *dn, char *name, char *type,
+@@ -539,14 +602,25 @@ add_to_rr_list (char *dn, char *name, char *type,
        if (tmp->attrs[3]->mod_values[0] == NULL)
  	 fatal("strdup");
  
@@ -313,7 +313,7 @@ index 23dd873..d56bc56 100644
        tmp->attrs[4]->mod_values[1] = NULL;
  
        tmp->attrs[5] = NULL;
-@@ -558,7 +633,7 @@ add_to_rr_list (char *dn, char *name, char *type,
+@@ -557,7 +631,7 @@ add_to_rr_list (char *dn, char *name, char *type,
    else
      {
  
@@ -322,7 +322,7 @@ index 23dd873..d56bc56 100644
  	{
  	  sprintf (ldap_type_buffer, "%sRecord", type);
  	  if (!strncmp
-@@ -632,44 +707,70 @@ char **
+@@ -631,44 +705,70 @@ char **
  hostname_to_dn_list (char *hostname, char *zone, unsigned int flags)
  {
    char *tmp;
@@ -430,7 +430,7 @@ index 23dd873..d56bc56 100644
    dn_buffer[i] = NULL;
  
    return dn_buffer;
-@@ -681,24 +782,32 @@ hostname_to_dn_list (char *hostname, char *zone, unsigned int flags)
+@@ -680,24 +780,32 @@ hostname_to_dn_list (char *hostname, char *zone, unsigned int flags)
   * exception of "@"/SOA. */
  
  char *
@@ -459,7 +459,7 @@ index 23dd873..d56bc56 100644
      if (flag == WI_SPEC)
      {
        if (x == (size - 2) && (strncmp (dc_list[x], "@", 1) == 0) && (ttl))
--	sprintf (tmp, "relativeDomainName=%s + dNSTTL=%d,", dc_list[x], ttl);
+-	sprintf (tmp, "relativeDomainName=%s + dNSTTL=%u,", dc_list[x], ttl);
 +	sprintf (tmp, "zoneName=%s + relativeDomainName=%s,", zone, dc_list[x]);
        else if (x == (size - 2))
 -	      sprintf(tmp, "relativeDomainName=%s,",dc_list[x]);
@@ -467,7 +467,7 @@ index 23dd873..d56bc56 100644
        else
  	      sprintf(tmp,"dc=%s,", dc_list[x]);
      }
-@@ -724,6 +833,7 @@ void
+@@ -723,6 +831,7 @@ void
  init_ldap_conn ()
  {
    int result;
@@ -475,7 +475,7 @@ index 23dd873..d56bc56 100644
    conn = ldap_open (ldapsystem, LDAP_PORT);
    if (conn == NULL)
      {
-@@ -733,7 +843,7 @@ init_ldap_conn ()
+@@ -732,7 +841,7 @@ init_ldap_conn ()
      }
  
    result = ldap_simple_bind_s (conn, binddn, bindpw);
@@ -484,7 +484,7 @@ index 23dd873..d56bc56 100644
  }
  
  /* Like isc_result_check, only for LDAP */
-@@ -750,8 +860,6 @@ ldap_result_check (const char *msg, char *dn, int err)
+@@ -749,8 +858,6 @@ ldap_result_check (const char *msg, char *dn, int err)
      }
  }
  
@@ -493,7 +493,7 @@ index 23dd873..d56bc56 100644
  /* For running the ldap_info run queue. */
  void
  add_ldap_values (ldap_info * ldinfo)
-@@ -759,14 +867,14 @@ add_ldap_values (ldap_info * ldinfo)
+@@ -758,14 +865,14 @@ add_ldap_values (ldap_info * ldinfo)
    int result;
    char dnbuffer[1024];
  
@@ -510,7 +510,7 @@ index 23dd873..d56bc56 100644
  }
  
  
-@@ -777,5 +885,5 @@ void
+@@ -776,5 +883,5 @@ void
  usage ()
  {
    fprintf (stderr,
diff --git a/bind.spec b/bind.spec
index 55be4da..96b747b 100644
--- a/bind.spec
+++ b/bind.spec
@@ -44,8 +44,8 @@
 #
 
 # lib*.so.X versions of selected libraries
-%global sover_dns 1105
-%global sover_isc 1100
+%global sover_dns 1106
+%global sover_isc 1102
 %global sover_irs 161
 %global sover_isccfg 163
 
@@ -135,13 +135,9 @@ Patch164:bind-9.11-rh1666814.patch
 Patch165:bind-9.11-rh1647829.patch
 # random_test fails too often by random, disable it
 Patch168:bind-9.11-unit-disable-random.patch
-Patch169:bind-9.11-feature-test-dlz.patch
 Patch170:bind-9.11-feature-test-named.patch
 Patch171:bind-9.11-tests-variants.patch
 Patch172:bind-9.11-tests-pkcs11.patch
-Patch173: bind-9.11-unit-dnstap-pkcs11.patch
-Patch174: bind-9.11-unit-timer-nothread.patch
-Patch175: bind-9.11-CVE-2018-5741-atomic.patch
 
 # SDB patches
 Patch11: bind-9.3.2b2-sdbsrc.patch
@@ -518,13 +514,9 @@ are used for building ISC DHCP.
 %patch164 -p1 -b .rh1666814
 %patch165 -p1 -b .rh1647829
 %patch168 -p1 -b .random_test-disable
-%patch169 -p1 -b .featuretest-dlz
 %patch170 -p1 -b .featuretest-named
 %patch171 -p1 -b .test-variant
 %patch172 -p1 -b .test-pkcs11
-%patch173 -p1 -b .unit-dnstap
-%patch174 -p1 -b .unit-timer
-%patch175 -p1 -b .CVE-2018-5741-atomic
 
 mkdir lib/dns/tests/testdata/dstrandom
 cp -a %{SOURCE50} lib/dns/tests/testdata/dstrandom/random.data

From ecef966359edc5d7d4be95dae7ea520d470952e4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 11 Jun 2019 14:56:08 +0200
Subject: [PATCH 023/460] Fix libisc so version

---
 bind.spec | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index 96b747b..5bcff7f 100644
--- a/bind.spec
+++ b/bind.spec
@@ -45,7 +45,7 @@
 
 # lib*.so.X versions of selected libraries
 %global sover_dns 1106
-%global sover_isc 1102
+%global sover_isc 1100
 %global sover_irs 161
 %global sover_isccfg 163
 

From 564c143a1bf63ed12ee87783f7330c0fe9a279c8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 13 Jun 2019 22:39:01 +0200
Subject: [PATCH 024/460] Fix OpenSSL random generator initialization

Also fix warning in test.
---
 bind-9.11-rt46047.patch | 67 ++++++++++++++++++++++++++---------------
 bind.spec               |  5 ++-
 2 files changed, 46 insertions(+), 26 deletions(-)

diff --git a/bind-9.11-rt46047.patch b/bind-9.11-rt46047.patch
index c5725f7..4f8181d 100644
--- a/bind-9.11-rt46047.patch
+++ b/bind-9.11-rt46047.patch
@@ -1,4 +1,4 @@
-From 55e649d82a1adc5209738fb8402624f03287ca87 Mon Sep 17 00:00:00 2001
+From ab9ee91f596c14cfc55a67ba3523b42a54e3e244 Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Thu, 28 Sep 2017 10:09:22 -0700
 Subject: [PATCH] completed and corrected the crypto-random change
@@ -33,11 +33,11 @@ Subject: [PATCH] completed and corrected the crypto-random change
  bin/named/include/named/server.h         |  2 +
  bin/named/interfacemgr.c                 |  1 +
  bin/named/query.c                        |  1 +
- bin/named/server.c                       | 51 ++++++++++++++--------
+ bin/named/server.c                       | 52 ++++++++++++++--------
  bin/nsupdate/nsupdate.c                  |  4 +-
  bin/tests/system/pipelined/pipequeries.c |  4 +-
  bin/tests/system/tkey/keycreate.c        |  4 +-
- bin/tests/system/tkey/keydelete.c        |  4 +-
+ bin/tests/system/tkey/keydelete.c        |  5 +--
  doc/arm/Bv9ARM-book.xml                  | 55 +++++++++++++++++-------
  doc/arm/notes.xml                        | 31 +++++++++++++
  lib/dns/dst_api.c                        |  4 +-
@@ -46,7 +46,7 @@ Subject: [PATCH] completed and corrected the crypto-random change
  lib/isc/include/isc/entropy.h            | 50 +++++++++++++++------
  lib/isc/include/isc/random.h             | 28 +++++++-----
  lib/isccfg/namedconf.c                   |  2 +-
- 22 files changed, 225 insertions(+), 107 deletions(-)
+ 22 files changed, 228 insertions(+), 106 deletions(-)
 
 diff --git a/bin/confgen/keygen.c b/bin/confgen/keygen.c
 index 295e16f..0f79aa8 100644
@@ -76,10 +76,10 @@ index 295e16f..0f79aa8 100644
  							     &entropy_source,
  							     randomfile,
 diff --git a/bin/dnssec/dnssec-keygen.docbook b/bin/dnssec/dnssec-keygen.docbook
-index ee6a489..17dddb6 100644
+index 0ae6b41..4562430 100644
 --- a/bin/dnssec/dnssec-keygen.docbook
 +++ b/bin/dnssec/dnssec-keygen.docbook
-@@ -350,15 +350,23 @@
+@@ -348,15 +348,23 @@
  	<term>-r <replaceable class="parameter">randomdev</replaceable></term>
  	<listitem>
  	  <para>
@@ -140,10 +140,10 @@ index 31a99e7..38c83ed 100644
  					   usekeyboard);
  
 diff --git a/bin/named/client.c b/bin/named/client.c
-index ce24670..0ce02a9 100644
+index 29fecad..a12623a 100644
 --- a/bin/named/client.c
 +++ b/bin/named/client.c
-@@ -1754,7 +1754,8 @@ ns_client_addopt(ns_client_t *client, dns_message_t *message,
+@@ -1752,7 +1752,8 @@ ns_client_addopt(ns_client_t *client, dns_message_t *message,
  
  		isc_buffer_init(&buf, cookie, sizeof(cookie));
  		isc_stdtime_get(&now);
@@ -241,7 +241,7 @@ index f5ed2b7..b2c1d05 100644
  
  struct ns_altsecret {
 diff --git a/bin/named/interfacemgr.c b/bin/named/interfacemgr.c
-index d9f6df5..662eb6c 100644
+index 135533b..4546831 100644
 --- a/bin/named/interfacemgr.c
 +++ b/bin/named/interfacemgr.c
 @@ -17,6 +17,7 @@
@@ -253,7 +253,7 @@ index d9f6df5..662eb6c 100644
  #include <isc/task.h>
  #include <isc/util.h>
 diff --git a/bin/named/query.c b/bin/named/query.c
-index 1d3edbc..193efde 100644
+index f85cc76..43a3661 100644
 --- a/bin/named/query.c
 +++ b/bin/named/query.c
 @@ -19,6 +19,7 @@
@@ -265,10 +265,10 @@ index 1d3edbc..193efde 100644
  #include <isc/serial.h>
  #include <isc/stats.h>
 diff --git a/bin/named/server.c b/bin/named/server.c
-index 30e7eac..27ea3bf 100644
+index 405ff71..700f83d 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
-@@ -8203,21 +8203,30 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8203,21 +8203,32 @@ load_configuration(const char *filename, ns_server_t *server,
  	 * Open the source of entropy.
  	 */
  	if (first_time) {
@@ -304,12 +304,13 @@ index 30e7eac..27ea3bf 100644
 -				isc_entropy_usehook(ns_g_entropy, true);
 -#else
 -			int level = ISC_LOG_ERROR;
--			result = isc_entropy_createfilesource(ns_g_entropy,
+ 			result = isc_entropy_createfilesource(ns_g_entropy,
 -							      randomdev);
++			                                      randomdev);
  #ifdef PATH_RANDOMDEV
  			if (ns_g_fallbackentropy != NULL) {
  				level = ISC_LOG_INFO;
-@@ -8228,8 +8237,8 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8228,8 +8239,8 @@ load_configuration(const char *filename, ns_server_t *server,
  					      NS_LOGCATEGORY_GENERAL,
  					      NS_LOGMODULE_SERVER,
  					      level,
@@ -320,7 +321,7 @@ index 30e7eac..27ea3bf 100644
  					      randomdev,
  					      isc_result_totext(result));
  			}
-@@ -8249,7 +8258,6 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8249,7 +8260,6 @@ load_configuration(const char *filename, ns_server_t *server,
  				}
  				isc_entropy_detach(&ns_g_fallbackentropy);
  			}
@@ -328,7 +329,15 @@ index 30e7eac..27ea3bf 100644
  #endif
  		}
  	}
-@@ -9040,6 +9048,9 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
+@@ -9014,6 +9024,7 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
+ 	server->in_roothints = NULL;
+ 	server->blackholeacl = NULL;
+ 	server->keepresporder = NULL;
++	server->rngctx = NULL;
+ 
+ 	/* Must be first. */
+ 	CHECKFATAL(dst_lib_init2(ns_g_mctx, ns_g_entropy,
+@@ -9040,6 +9051,9 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
  	CHECKFATAL(dns_tkeyctx_create(ns_g_mctx, ns_g_entropy,
  				      &server->tkeyctx),
  		   "creating TKEY context");
@@ -338,7 +347,7 @@ index 30e7eac..27ea3bf 100644
  
  	/*
  	 * Setup the server task, which is responsible for coordinating
-@@ -9246,7 +9257,8 @@ ns_server_destroy(ns_server_t **serverp) {
+@@ -9246,7 +9260,8 @@ ns_server_destroy(ns_server_t **serverp) {
  
  	if (server->zonemgr != NULL)
  		dns_zonemgr_detach(&server->zonemgr);
@@ -348,7 +357,7 @@ index 30e7eac..27ea3bf 100644
  	if (server->tkeyctx != NULL)
  		dns_tkeyctx_destroy(&server->tkeyctx);
  
-@@ -13197,10 +13209,10 @@ newzone_cfgctx_destroy(void **cfgp) {
+@@ -13197,10 +13212,10 @@ newzone_cfgctx_destroy(void **cfgp) {
  
  static isc_result_t
  generate_salt(unsigned char *salt, size_t saltlen) {
@@ -361,7 +370,7 @@ index 30e7eac..27ea3bf 100644
  	} rnd;
  	unsigned char text[512 + 1];
  	isc_region_t r;
-@@ -13210,9 +13222,10 @@ generate_salt(unsigned char *salt, size_t saltlen) {
+@@ -13210,9 +13225,10 @@ generate_salt(unsigned char *salt, size_t saltlen) {
  	if (saltlen > 256U)
  		return (ISC_R_RANGE);
  
@@ -376,7 +385,7 @@ index 30e7eac..27ea3bf 100644
  	memmove(salt, rnd.rnd, saltlen);
  
 diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
-index 6d7a02e..626b1cf 100644
+index 0286987..0376377 100644
 --- a/bin/nsupdate/nsupdate.c
 +++ b/bin/nsupdate/nsupdate.c
 @@ -283,9 +283,7 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
@@ -421,10 +430,18 @@ index fe8698e..937fcc3 100644
  	}
  #endif
 diff --git a/bin/tests/system/tkey/keydelete.c b/bin/tests/system/tkey/keydelete.c
-index 2146f9b..ac2c311 100644
+index 2146f9b..64b8e74 100644
 --- a/bin/tests/system/tkey/keydelete.c
 +++ b/bin/tests/system/tkey/keydelete.c
-@@ -182,9 +182,7 @@ main(int argc, char **argv) {
+@@ -171,6 +171,7 @@ main(int argc, char **argv) {
+ 		randomfile = argv[2];
+ 		argv += 2;
+ 		argc -= 2;
++		POST(argc);
+ 	}
+ 	keyname = argv[1];
+ 
+@@ -182,9 +183,7 @@ main(int argc, char **argv) {
  	ectx = NULL;
  	RUNCHECK(isc_entropy_create(mctx, &ectx));
  #ifdef ISC_PLATFORM_CRYPTORANDOM
@@ -436,7 +453,7 @@ index 2146f9b..ac2c311 100644
  	}
  #endif
 diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
-index bb79723..888959c 100644
+index b40cb05..8a81438 100644
 --- a/doc/arm/Bv9ARM-book.xml
 +++ b/doc/arm/Bv9ARM-book.xml
 @@ -5071,22 +5071,45 @@ badresp:1,adberr:0,findfail:0,valfail:0]
@@ -502,10 +519,10 @@ index bb79723..888959c 100644
  	    </listitem>
  	  </varlistentry>
 diff --git a/doc/arm/notes.xml b/doc/arm/notes.xml
-index ba9a7cf..c0256f1 100644
+index 00ce8f1..527135a 100644
 --- a/doc/arm/notes.xml
 +++ b/doc/arm/notes.xml
-@@ -117,6 +117,37 @@
+@@ -124,6 +124,37 @@
      </itemizedlist>
    </section>
  
diff --git a/bind.spec b/bind.spec
index 5bcff7f..dea5440 100644
--- a/bind.spec
+++ b/bind.spec
@@ -53,7 +53,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.11.7
-Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1511,6 +1511,9 @@ fi;
 
 
 %changelog
+* Mon Jun 17 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.7-2
+- Fix OpenSSL random generator initialization
+
 * Mon Jun 10 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.7-1
 - Update to 9.11.7
 

From 16ecf0736f76dfb539d4422d363eff2178da88c3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 2 Jul 2019 11:10:03 +0200
Subject: [PATCH 025/460] Update to 9.11.8

Contains:
5244.	[security]	Fixed a race condition in dns_dispatch_getnext()
			that could cause an assertion failure if a
			significant number of incoming packets were
			rejected. (CVE-2019-6471) [GL #942]

5241.	[bug]		Fix Ed448 private and public key ASN.1 prefix blobs.
			[GL #225]

5237.	[bug]		Recurse to find the root server list with 'dig +trace'.
			[GL #1028]
---
 .gitignore                         |  1 +
 bind-9.10-dist-native-pkcs11.patch | 32 +++++++++++++++---------------
 bind-9.11.7.tar.gz.asc             | 16 ---------------
 bind-9.11.8.tar.gz.asc             | 16 +++++++++++++++
 bind.spec                          |  7 +++++--
 sources                            |  2 +-
 6 files changed, 39 insertions(+), 35 deletions(-)
 delete mode 100644 bind-9.11.7.tar.gz.asc
 create mode 100644 bind-9.11.8.tar.gz.asc

diff --git a/.gitignore b/.gitignore
index 3f6b2b5..e904915 100644
--- a/.gitignore
+++ b/.gitignore
@@ -93,3 +93,4 @@ bind-9.7.2b1.tar.gz
 /bind-9.11.6.tar.gz
 /bind-9.11.6-P1.tar.gz
 /bind-9.11.7.tar.gz
+/bind-9.11.8.tar.gz
diff --git a/bind-9.10-dist-native-pkcs11.patch b/bind-9.10-dist-native-pkcs11.patch
index 65a2e83..9468850 100644
--- a/bind-9.10-dist-native-pkcs11.patch
+++ b/bind-9.10-dist-native-pkcs11.patch
@@ -300,10 +300,10 @@ index a058c91..d4b689a 100644
  DEPLIBS =	${ISCDEPLIBS}
  
 diff --git a/configure.ac b/configure.ac
-index 5e4e839..0ef2c8f 100644
+index d48fd51..79c96f8 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -1081,12 +1081,14 @@ AC_SUBST(USE_GSSAPI)
+@@ -1089,12 +1089,14 @@ AC_SUBST(USE_GSSAPI)
  AC_SUBST(DST_GSSAPI_INC)
  AC_SUBST(DNS_GSSAPI_LIBS)
  DNS_CRYPTO_LIBS="$DNS_GSSAPI_LIBS $DNS_CRYPTO_LIBS"
@@ -318,7 +318,7 @@ index 5e4e839..0ef2c8f 100644
  
  #
  # was --with-randomdev specified?
-@@ -1471,11 +1473,11 @@ fi
+@@ -1479,11 +1481,11 @@ fi
  AC_MSG_CHECKING(for OpenSSL library)
  OPENSSL_WARNING=
  openssldirs="/usr /usr/local /usr/local/ssl /usr/pkg /usr/sfw"
@@ -335,7 +335,7 @@ index 5e4e839..0ef2c8f 100644
  
  if test "auto" = "$use_openssl"
  then
-@@ -1488,6 +1490,7 @@ then
+@@ -1496,6 +1498,7 @@ then
  		fi
  	done
  fi
@@ -343,7 +343,7 @@ index 5e4e839..0ef2c8f 100644
  OPENSSL_ECDSA=""
  OPENSSL_GOST=""
  OPENSSL_ED25519=""
-@@ -1509,11 +1512,10 @@ case "$with_gost" in
+@@ -1517,11 +1520,10 @@ case "$with_gost" in
  		;;
  esac
  
@@ -358,7 +358,7 @@ index 5e4e839..0ef2c8f 100644
  		CRYPTOLIB="pkcs11"
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
-@@ -1523,7 +1525,9 @@ case "$use_openssl" in
+@@ -1531,7 +1533,9 @@ case "$use_openssl" in
  		OPENSSLGOSTLINKSRCS=""
  		OPENSSLLINKOBJS=""
  		OPENSSLLINKSRCS=""
@@ -369,7 +369,7 @@ index 5e4e839..0ef2c8f 100644
  	no)
  		AC_MSG_RESULT(no)
  		DST_OPENSSL_INC=""
-@@ -1555,7 +1559,7 @@ case "$use_openssl" in
+@@ -1563,7 +1567,7 @@ case "$use_openssl" in
  If you do not want OpenSSL, use --without-openssl])
  		;;
  	*)
@@ -378,7 +378,7 @@ index 5e4e839..0ef2c8f 100644
  		then
  			AC_MSG_RESULT()
  			AC_MSG_ERROR([OpenSSL and native PKCS11 cannot be used together.])
-@@ -1983,6 +1987,7 @@ AC_SUBST(OPENSSL_ED25519)
+@@ -1991,6 +1995,7 @@ AC_SUBST(OPENSSL_ED25519)
  AC_SUBST(OPENSSL_GOST)
  
  DNS_CRYPTO_LIBS="$DNS_CRYPTO_LIBS $DST_OPENSSL_LIBS"
@@ -386,7 +386,7 @@ index 5e4e839..0ef2c8f 100644
  
  ISC_PLATFORM_WANTAES="#undef ISC_PLATFORM_WANTAES"
  if test "yes" = "$with_aes"
-@@ -2306,6 +2311,7 @@ esac
+@@ -2314,6 +2319,7 @@ esac
  AC_SUBST(PKCS11LINKOBJS)
  AC_SUBST(PKCS11LINKSRCS)
  AC_SUBST(CRYPTO)
@@ -394,7 +394,7 @@ index 5e4e839..0ef2c8f 100644
  AC_SUBST(PKCS11_ECDSA)
  AC_SUBST(PKCS11_GOST)
  AC_SUBST(PKCS11_ED25519)
-@@ -5428,8 +5434,11 @@ AC_CONFIG_FILES([
+@@ -5441,8 +5447,11 @@ AC_CONFIG_FILES([
  	bin/delv/Makefile
  	bin/dig/Makefile
  	bin/dnssec/Makefile
@@ -406,7 +406,7 @@ index 5e4e839..0ef2c8f 100644
  	bin/nsupdate/Makefile
  	bin/pkcs11/Makefile
  	bin/python/Makefile
-@@ -5502,6 +5511,10 @@ AC_CONFIG_FILES([
+@@ -5515,6 +5524,10 @@ AC_CONFIG_FILES([
  	lib/dns/include/dns/Makefile
  	lib/dns/include/dst/Makefile
  	lib/dns/tests/Makefile
@@ -417,7 +417,7 @@ index 5e4e839..0ef2c8f 100644
  	lib/irs/Makefile
  	lib/irs/include/Makefile
  	lib/irs/include/irs/Makefile
-@@ -5526,6 +5539,24 @@ AC_CONFIG_FILES([
+@@ -5539,6 +5552,24 @@ AC_CONFIG_FILES([
  	lib/isc/unix/include/Makefile
  	lib/isc/unix/include/isc/Makefile
  	lib/isc/unix/include/pkcs11/Makefile
@@ -456,7 +456,7 @@ index 81270a0..bcb5312 100644
  
  @BIND9_MAKE_RULES@
 diff --git a/lib/dns-pkcs11/Makefile.in b/lib/dns-pkcs11/Makefile.in
-index 56dd259..f9aa782 100644
+index f6868d1..ea6fd36 100644
 --- a/lib/dns-pkcs11/Makefile.in
 +++ b/lib/dns-pkcs11/Makefile.in
 @@ -26,16 +26,16 @@ VERSION=@BIND9_VERSION@
@@ -501,9 +501,9 @@ index 56dd259..f9aa782 100644
  
  include: gen
  	${MAKE} include/dns/enumtype.h
-@@ -183,22 +183,22 @@ gen: gen.c
- 	${BUILD_CC} ${BUILD_CFLAGS} -I${top_srcdir}/lib/isc/include \
- 	${BUILD_CPPFLAGS} ${BUILD_LDFLAGS} -o $@ ${srcdir}/gen.c ${BUILD_LIBS}
+@@ -185,22 +185,22 @@ gen: gen.c
+ 	${BUILD_CPPFLAGS} ${BUILD_LDFLAGS} -o $@ ${srcdir}/gen.c \
+ 	${BUILD_LIBS} ${LFS_LIBS}
  
 -timestamp: include libdns.@A@
 +timestamp: include libdns-pkcs11.@A@
diff --git a/bind-9.11.7.tar.gz.asc b/bind-9.11.7.tar.gz.asc
deleted file mode 100644
index 09f58b8..0000000
--- a/bind-9.11.7.tar.gz.asc
+++ /dev/null
@@ -1,16 +0,0 @@
------BEGIN PGP SIGNATURE-----
-
-iQIzBAABAgAdFiEEFWiQaF6g32oTce8gF8xdsfAIhAcFAlzbSNIACgkQF8xdsfAI
-hAdG9hAAijQlh+4kFBMwjXgHFWxUYXr8/JFWVgz5wqsbUb4iuD7fbJ//h7IB69qr
-rOAtwEEf0X1//+cQP5Zqn/8GMcXrOSlp8LoH2C9ougMcIzIe43mDMMZCiGYwNXsm
-9UGKznZyXBcgGGqzKC2pc6vThrzgWtapgztcl+WWb2k5gSDo9pAeC4xnRLLcrmcn
-EhU6uSbtN8ODcWZhAhboHzHrDZrWOm+7CzZZabf/pnZM70P7mm7OJUWdpKclE4ub
-v/Re0IcnNt9ow3pvB2BGgP0/wEIkqb7toysV3MEqdJ0HDysNzmvr0JZLVD2Dvak1
-oyQjUX2eGzgZ5phu6jjhOAWs/Bw8YtGLCJyBoxvpH6AXQqJII4S8ALqnrL6NEEHz
-0Qurk39Z0LrE73XRIsn/Y1Z9xmxYp+vfl9AWQelGYOXu8s6lw+gFqZAmPasa84XA
-iHSnZalqcZEuiPuVIGdSgBokOA8XXhjBtzRIAI2nns57qLTki+l+NzgRmxIEUiyM
-4JX20GM1R9afP5U97ti3Taqw7xr9OlIJqWT7LRhTOGJAv30pd/wfAI2fuP4OPiXg
-crXRuSd33TNnC6bd28Dx8mKoYxVoLfN2GXpRWy5jmTUQY/NchDFkAejXY4ilTvI/
-hZxf3Fgy20xlAFfk7w1HGPDEM7eqtDm8cAyIz3bD6J0ONFB0t5Y=
-=xIZJ
------END PGP SIGNATURE-----
diff --git a/bind-9.11.8.tar.gz.asc b/bind-9.11.8.tar.gz.asc
new file mode 100644
index 0000000..fb0ac3b
--- /dev/null
+++ b/bind-9.11.8.tar.gz.asc
@@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABAgAdFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAlz45qgACgkQdLtrmky7
+PThZoxAAuqUxL9JV1NsvODkJ049F8hRrrzhN8Vgx19D/w6oLWawaHuOahU67RYWh
+OGa3D72G0mClVFBABTV9YiAwkNnbkq3Nkclh6riWDjAO3RPKMo50yiAhLKSt2Z4N
+i0dMSIzZb8T9nq19T9JI1loyEG3oU+I97uWLyzrLe2WqCpSmdCTNd8PsD/0r+MxV
+QnBt1RFHda4z7r0fYLMw5oALXiNttPg6JdKByssgmYB6DYYw4f9ywMj1e8Jnn307
+6BXMweF0uOpGgy18HzgdfSjMNc3g9WKU86gTyAblAd1HALtdwe/VKgH1ZVJZoflT
+QnxzJDDjNbKE5OP7TOgzN9pLPCGwvQhpHDqGTTn+cTj5h9pQZcfq0vQQJ+MGzFWF
+kj0TUeLYs9FNnJt91Rpk+T96sOUypOrpPM9RdAEKp38qSMmZN8DJ83sga2b1OCqr
+zIcuQOBuXlKu9uD9g2cTquGGSG0vGvVSx0OXogUYEPS635AZbyZ9IqSntlDE+cnS
+mJt7jCQv+DVFVDUiyfLcdmPZk0U88hHdruKTbN3dc+a+OMddukPM4AepLKgdAWkQ
+F9et7SJ5VeiGiHgIwJaeu04VhD4DuQILo6xx7wxJIiPQ8H1sazdrikcn70hxMQwB
+yq1tBfQHTUfHmZBCytMVRR3sEQscv/7MBEhS9DXmNRYfIXrXKIE=
+=j1R3
+-----END PGP SIGNATURE-----
diff --git a/bind.spec b/bind.spec
index dea5440..fb4337c 100644
--- a/bind.spec
+++ b/bind.spec
@@ -52,8 +52,8 @@
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.11.7
-Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Version:  9.11.8
+Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1511,6 +1511,9 @@ fi;
 
 
 %changelog
+* Tue Jul 02 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.8-1
+- Update to 9.11.8
+
 * Mon Jun 17 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.7-2
 - Fix OpenSSL random generator initialization
 
diff --git a/sources b/sources
index 7d68637..a8b7813 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.11.7.tar.gz) = eecf731c55b04f56385cda013c9444ee69c1ea23621fa77fece4389fda12fe5fc3fa43aec0d6cc5a2947eb90fb16a6c4d366a30dfc80f5d222e11ae1f059e665
+SHA512 (bind-9.11.8.tar.gz) = 0192d6e087cdbdebec171869d908c4326c2575d65ee5367a78ed9da26de357e017b0306349d66a6016a7ec80ad27f5f7f9f2db25002c6d0c78589dc473a015fc
 SHA512 (config-19.tar.bz2) = 36aa38a0c7c33267ae594b31c81681290ac58dde7ca6749bd599da531380b5b1428330813dbe983e01071ccaed83e83f6a9cd92179a53b7d0ccbb6851a0b017c

From 6402a7906bc63d69d9139856efcf7cf21714fd18 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 11 Jun 2019 11:34:52 +0200
Subject: [PATCH 026/460] Update patches to new sources

Modify current and remove already merged patches.
Adjust versions of so libs.
---
 bind-9.10-dist-native-pkcs11.patch   |  36 +--
 bind-9.11-CVE-2018-5741-atomic.patch | 132 ---------
 bind-9.11-feature-test-dlz.patch     |  85 ------
 bind-9.11-fips-code.patch            |  32 +-
 bind-9.11-fips-tests.patch           | 429 +++------------------------
 bind-9.11-rt31459.patch              | 138 ++++-----
 bind-9.11-tests-variants.patch       |  14 +-
 bind-9.11-unit-dnstap-pkcs11.patch   |  38 ---
 bind-9.11-unit-timer-nothread.patch  |  49 ---
 bind-9.3.2b1-fix_sdb_ldap.patch      |  50 ++--
 bind.spec                            |  12 +-
 11 files changed, 171 insertions(+), 844 deletions(-)
 delete mode 100644 bind-9.11-CVE-2018-5741-atomic.patch
 delete mode 100644 bind-9.11-feature-test-dlz.patch
 delete mode 100644 bind-9.11-unit-dnstap-pkcs11.patch
 delete mode 100644 bind-9.11-unit-timer-nothread.patch

diff --git a/bind-9.10-dist-native-pkcs11.patch b/bind-9.10-dist-native-pkcs11.patch
index bd8e74d..65a2e83 100644
--- a/bind-9.10-dist-native-pkcs11.patch
+++ b/bind-9.10-dist-native-pkcs11.patch
@@ -300,10 +300,10 @@ index a058c91..d4b689a 100644
  DEPLIBS =	${ISCDEPLIBS}
  
 diff --git a/configure.ac b/configure.ac
-index 5e1ba8c..7aff0e6 100644
+index 5e4e839..0ef2c8f 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -1070,12 +1070,14 @@ AC_SUBST(USE_GSSAPI)
+@@ -1081,12 +1081,14 @@ AC_SUBST(USE_GSSAPI)
  AC_SUBST(DST_GSSAPI_INC)
  AC_SUBST(DNS_GSSAPI_LIBS)
  DNS_CRYPTO_LIBS="$DNS_GSSAPI_LIBS $DNS_CRYPTO_LIBS"
@@ -318,7 +318,7 @@ index 5e1ba8c..7aff0e6 100644
  
  #
  # was --with-randomdev specified?
-@@ -1460,11 +1462,11 @@ fi
+@@ -1471,11 +1473,11 @@ fi
  AC_MSG_CHECKING(for OpenSSL library)
  OPENSSL_WARNING=
  openssldirs="/usr /usr/local /usr/local/ssl /usr/pkg /usr/sfw"
@@ -335,7 +335,7 @@ index 5e1ba8c..7aff0e6 100644
  
  if test "auto" = "$use_openssl"
  then
-@@ -1477,6 +1479,7 @@ then
+@@ -1488,6 +1490,7 @@ then
  		fi
  	done
  fi
@@ -343,7 +343,7 @@ index 5e1ba8c..7aff0e6 100644
  OPENSSL_ECDSA=""
  OPENSSL_GOST=""
  OPENSSL_ED25519=""
-@@ -1498,11 +1501,10 @@ case "$with_gost" in
+@@ -1509,11 +1512,10 @@ case "$with_gost" in
  		;;
  esac
  
@@ -358,7 +358,7 @@ index 5e1ba8c..7aff0e6 100644
  		CRYPTOLIB="pkcs11"
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
-@@ -1512,7 +1514,9 @@ case "$use_openssl" in
+@@ -1523,7 +1525,9 @@ case "$use_openssl" in
  		OPENSSLGOSTLINKSRCS=""
  		OPENSSLLINKOBJS=""
  		OPENSSLLINKSRCS=""
@@ -369,7 +369,7 @@ index 5e1ba8c..7aff0e6 100644
  	no)
  		AC_MSG_RESULT(no)
  		DST_OPENSSL_INC=""
-@@ -1544,7 +1548,7 @@ case "$use_openssl" in
+@@ -1555,7 +1559,7 @@ case "$use_openssl" in
  If you do not want OpenSSL, use --without-openssl])
  		;;
  	*)
@@ -378,7 +378,7 @@ index 5e1ba8c..7aff0e6 100644
  		then
  			AC_MSG_RESULT()
  			AC_MSG_ERROR([OpenSSL and native PKCS11 cannot be used together.])
-@@ -1972,6 +1976,7 @@ AC_SUBST(OPENSSL_ED25519)
+@@ -1983,6 +1987,7 @@ AC_SUBST(OPENSSL_ED25519)
  AC_SUBST(OPENSSL_GOST)
  
  DNS_CRYPTO_LIBS="$DNS_CRYPTO_LIBS $DST_OPENSSL_LIBS"
@@ -386,7 +386,7 @@ index 5e1ba8c..7aff0e6 100644
  
  ISC_PLATFORM_WANTAES="#undef ISC_PLATFORM_WANTAES"
  if test "yes" = "$with_aes"
-@@ -2295,6 +2300,7 @@ esac
+@@ -2306,6 +2311,7 @@ esac
  AC_SUBST(PKCS11LINKOBJS)
  AC_SUBST(PKCS11LINKSRCS)
  AC_SUBST(CRYPTO)
@@ -394,7 +394,7 @@ index 5e1ba8c..7aff0e6 100644
  AC_SUBST(PKCS11_ECDSA)
  AC_SUBST(PKCS11_GOST)
  AC_SUBST(PKCS11_ED25519)
-@@ -5425,8 +5431,11 @@ AC_CONFIG_FILES([
+@@ -5428,8 +5434,11 @@ AC_CONFIG_FILES([
  	bin/delv/Makefile
  	bin/dig/Makefile
  	bin/dnssec/Makefile
@@ -406,7 +406,7 @@ index 5e1ba8c..7aff0e6 100644
  	bin/nsupdate/Makefile
  	bin/pkcs11/Makefile
  	bin/python/Makefile
-@@ -5499,6 +5508,10 @@ AC_CONFIG_FILES([
+@@ -5502,6 +5511,10 @@ AC_CONFIG_FILES([
  	lib/dns/include/dns/Makefile
  	lib/dns/include/dst/Makefile
  	lib/dns/tests/Makefile
@@ -417,7 +417,7 @@ index 5e1ba8c..7aff0e6 100644
  	lib/irs/Makefile
  	lib/irs/include/Makefile
  	lib/irs/include/irs/Makefile
-@@ -5523,6 +5536,24 @@ AC_CONFIG_FILES([
+@@ -5526,6 +5539,24 @@ AC_CONFIG_FILES([
  	lib/isc/unix/include/Makefile
  	lib/isc/unix/include/isc/Makefile
  	lib/isc/unix/include/pkcs11/Makefile
@@ -456,7 +456,7 @@ index 81270a0..bcb5312 100644
  
  @BIND9_MAKE_RULES@
 diff --git a/lib/dns-pkcs11/Makefile.in b/lib/dns-pkcs11/Makefile.in
-index 068bbac..d7f3d95 100644
+index 56dd259..f9aa782 100644
 --- a/lib/dns-pkcs11/Makefile.in
 +++ b/lib/dns-pkcs11/Makefile.in
 @@ -26,16 +26,16 @@ VERSION=@BIND9_VERSION@
@@ -501,12 +501,8 @@ index 068bbac..d7f3d95 100644
  
  include: gen
  	${MAKE} include/dns/enumtype.h
-@@ -180,25 +180,25 @@ code.h:	gen
- 	./gen -s ${srcdir} > code.h || { rm -f $@ ; exit 1; }
- 
- gen: gen.c
--	${BUILD_CC} ${BUILD_CFLAGS} -I${top_srcdir}/lib/isc/include \
-+	${BUILD_CC} ${BUILD_CFLAGS} -I${top_srcdir}/lib/isc-pkcs11/include \
+@@ -183,22 +183,22 @@ gen: gen.c
+ 	${BUILD_CC} ${BUILD_CFLAGS} -I${top_srcdir}/lib/isc/include \
  	${BUILD_CPPFLAGS} ${BUILD_LDFLAGS} -o $@ ${srcdir}/gen.c ${BUILD_LIBS}
  
 -timestamp: include libdns.@A@
@@ -532,7 +528,7 @@ index 068bbac..d7f3d95 100644
 +	rm -f libdns-pkcs11.@A@ timestamp
  	rm -f gen code.h include/dns/enumtype.h include/dns/enumclass.h
  	rm -f include/dns/rdatastruct.h
- 	rm -f dnstap.pb-c.c dnstap.pb-c.h include/dns/dnstap.pb-c.h
+ 	rm -f dnstap.pb-c.c dnstap.pb-c.h
 diff --git a/lib/isc-pkcs11/Makefile.in b/lib/isc-pkcs11/Makefile.in
 index 98acfff..2fd6981 100644
 --- a/lib/isc-pkcs11/Makefile.in
diff --git a/bind-9.11-CVE-2018-5741-atomic.patch b/bind-9.11-CVE-2018-5741-atomic.patch
deleted file mode 100644
index cfbded6..0000000
--- a/bind-9.11-CVE-2018-5741-atomic.patch
+++ /dev/null
@@ -1,132 +0,0 @@
-From ef49780d30d3ddc5735cfc32561b678a634fa72f Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@sury.org>
-Date: Wed, 17 Apr 2019 15:22:27 +0200
-Subject: [PATCH] Replace atomic operations in bin/named/client.c with
- isc_refcount reference counting
-
----
- bin/named/client.c                     | 18 +++++++-----------
- bin/named/include/named/interfacemgr.h |  5 +++--
- bin/named/interfacemgr.c               |  7 +++++--
- 3 files changed, 15 insertions(+), 15 deletions(-)
-
-diff --git a/bin/named/client.c b/bin/named/client.c
-index 845326abc0..29fecadca8 100644
---- a/bin/named/client.c
-+++ b/bin/named/client.c
-@@ -402,12 +402,10 @@ tcpconn_detach(ns_client_t *client) {
- static void
- mark_tcp_active(ns_client_t *client, bool active) {
- 	if (active && !client->tcpactive) {
--		isc_atomic_xadd(&client->interface->ntcpactive, 1);
-+		isc_refcount_increment0(&client->interface->ntcpactive, NULL);
- 		client->tcpactive = active;
- 	} else if (!active && client->tcpactive) {
--		uint32_t old =
--			isc_atomic_xadd(&client->interface->ntcpactive, -1);
--		INSIST(old > 0);
-+		isc_refcount_decrement(&client->interface->ntcpactive, NULL);
- 		client->tcpactive = active;
- 	}
- }
-@@ -554,7 +552,7 @@ exit_check(ns_client_t *client) {
- 		if (client->mortal && TCP_CLIENT(client) &&
- 		    client->newstate != NS_CLIENTSTATE_FREED &&
- 		    !ns_g_clienttest &&
--		    isc_atomic_xadd(&client->interface->ntcpaccepting, 0) == 0)
-+		    isc_refcount_current(&client->interface->ntcpaccepting) == 0)
- 		{
- 			/* Nobody else is accepting */
- 			client->mortal = false;
-@@ -3328,7 +3326,6 @@ client_newconn(isc_task_t *task, isc_event_t *event) {
- 	isc_result_t result;
- 	ns_client_t *client = event->ev_arg;
- 	isc_socket_newconnev_t *nevent = (isc_socket_newconnev_t *)event;
--	uint32_t old;
- 
- 	REQUIRE(event->ev_type == ISC_SOCKEVENT_NEWCONN);
- 	REQUIRE(NS_CLIENT_VALID(client));
-@@ -3348,8 +3345,7 @@ client_newconn(isc_task_t *task, isc_event_t *event) {
- 	INSIST(client->naccepts == 1);
- 	client->naccepts--;
- 
--	old = isc_atomic_xadd(&client->interface->ntcpaccepting, -1);
--	INSIST(old > 0);
-+	isc_refcount_decrement(&client->interface->ntcpaccepting, NULL);
- 
- 	/*
- 	 * We must take ownership of the new socket before the exit
-@@ -3480,8 +3476,8 @@ client_accept(ns_client_t *client) {
- 		 * quota is tcp-clients plus the number of listening
- 		 * interfaces plus 1.)
- 		 */
--		exit = (isc_atomic_xadd(&client->interface->ntcpactive, 0) >
--			(client->tcpactive ? 1 : 0));
-+		exit = (isc_refcount_current(&client->interface->ntcpactive) >
-+			(client->tcpactive ? 1U : 0U));
- 		if (exit) {
- 			client->newstate = NS_CLIENTSTATE_INACTIVE;
- 			(void)exit_check(client);
-@@ -3539,7 +3535,7 @@ client_accept(ns_client_t *client) {
- 	 * listening for connections itself to prevent the interface
- 	 * going dead.
- 	 */
--	isc_atomic_xadd(&client->interface->ntcpaccepting, 1);
-+	isc_refcount_increment0(&client->interface->ntcpaccepting, NULL);
- }
- 
- static void
-diff --git a/bin/named/include/named/interfacemgr.h b/bin/named/include/named/interfacemgr.h
-index 3535ef22a8..6e10f210fd 100644
---- a/bin/named/include/named/interfacemgr.h
-+++ b/bin/named/include/named/interfacemgr.h
-@@ -45,6 +45,7 @@
- #include <isc/magic.h>
- #include <isc/mem.h>
- #include <isc/socket.h>
-+#include <isc/refcount.h>
- 
- #include <dns/result.h>
- 
-@@ -75,11 +76,11 @@ struct ns_interface {
- 						/*%< UDP dispatchers. */
- 	isc_socket_t *		tcpsocket;	/*%< TCP socket. */
- 	isc_dscp_t		dscp;		/*%< "listen-on" DSCP value */
--	int32_t			ntcpaccepting;	/*%< Number of clients
-+	isc_refcount_t		ntcpaccepting;	/*%< Number of clients
- 						     ready to accept new
- 						     TCP connections on this
- 						     interface */
--	int32_t			ntcpactive;	/*%< Number of clients
-+	isc_refcount_t		ntcpactive;	/*%< Number of clients
- 						     servicing TCP queries
- 						     (whether accepting or
- 						     connected) */
-diff --git a/bin/named/interfacemgr.c b/bin/named/interfacemgr.c
-index d9f6df5802..135533be6b 100644
---- a/bin/named/interfacemgr.c
-+++ b/bin/named/interfacemgr.c
-@@ -386,8 +386,8 @@ ns_interface_create(ns_interfacemgr_t *mgr, isc_sockaddr_t *addr,
- 	 * connections will be handled in parallel even though there is
- 	 * only one client initially.
- 	 */
--	ifp->ntcpaccepting = 0;
--	ifp->ntcpactive = 0;
-+	isc_refcount_init(&ifp->ntcpaccepting, 0);
-+	isc_refcount_init(&ifp->ntcpactive, 0);
- 
- 	ifp->nudpdispatch = 0;
- 
-@@ -618,6 +618,9 @@ ns_interface_destroy(ns_interface_t *ifp) {
- 
- 	ns_interfacemgr_detach(&ifp->mgr);
- 
-+	isc_refcount_destroy(&ifp->ntcpactive);
-+	isc_refcount_destroy(&ifp->ntcpaccepting);
-+
- 	ifp->magic = 0;
- 	isc_mem_put(mctx, ifp, sizeof(*ifp));
- }
--- 
-2.18.1
-
diff --git a/bind-9.11-feature-test-dlz.patch b/bind-9.11-feature-test-dlz.patch
deleted file mode 100644
index 39e46c8..0000000
--- a/bind-9.11-feature-test-dlz.patch
+++ /dev/null
@@ -1,85 +0,0 @@
-From 71627db6c8852d7805ec559506f5f3cb8d89a131 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Wed, 30 Jan 2019 15:12:54 +0100
-Subject: [PATCH] Support DLZ filesystem detection in feature-test
-
-Do not use variable from configure to detect the feature.
----
- bin/tests/system/Makefile.in                     | 2 +-
- bin/tests/system/dlz/{prereq.sh.in => prereq.sh} | 2 +-
- bin/tests/system/feature-test.c                  | 9 +++++++++
- configure.ac                                     | 1 -
- 4 files changed, 11 insertions(+), 3 deletions(-)
- rename bin/tests/system/dlz/{prereq.sh.in => prereq.sh} (91%)
-
-diff --git a/bin/tests/system/Makefile.in b/bin/tests/system/Makefile.in
-index c18b4c5..dea2f75 100644
---- a/bin/tests/system/Makefile.in
-+++ b/bin/tests/system/Makefile.in
-@@ -19,7 +19,7 @@ SUBDIRS =	dlzexternal dyndb lwresd pipelined rndc rsabigexponent tkey
- 
- CINCLUDES =	${ISC_INCLUDES} ${DNS_INCLUDES}
- 
--CDEFINES =	@USE_GSSAPI@
-+CDEFINES =	@USE_GSSAPI@ @CONTRIB_DLZ@
- CWARNINGS =
- 
- DNSLIBS =
-diff --git a/bin/tests/system/dlz/prereq.sh.in b/bin/tests/system/dlz/prereq.sh
-similarity index 91%
-rename from bin/tests/system/dlz/prereq.sh.in
-rename to bin/tests/system/dlz/prereq.sh
-index afec653..fb3328e 100644
---- a/bin/tests/system/dlz/prereq.sh.in
-+++ b/bin/tests/system/dlz/prereq.sh
-@@ -12,7 +12,7 @@
- SYSTEMTESTTOP=..
- . $SYSTEMTESTTOP/conf.sh
- 
--if [ "@DLZ_SYSTEM_TEST@" != "filesystem" ]; then
-+if ! $FEATURETEST --with-dlz-filesystem; then
-         echo_i "DLZ filesystem driver not supported"
-         exit 255
- fi
-diff --git a/bin/tests/system/feature-test.c b/bin/tests/system/feature-test.c
-index 11863a3..428d107 100644
---- a/bin/tests/system/feature-test.c
-+++ b/bin/tests/system/feature-test.c
-@@ -51,6 +51,7 @@ usage() {
- 	fprintf(stderr, "	--rpz-nsip\n");
- 	fprintf(stderr, "	--with-idn\n");
- 	fprintf(stderr, "	--with-lmdb\n");
-+	fprintf(stderr, "	--with-dlz-filesystem\n");
- }
- 
- int
-@@ -182,6 +183,14 @@ main(int argc, char **argv) {
- #endif
- 	}
- 
-+	if (strcmp(argv[1], "--with-dlz-filesystem") == 0) {
-+#ifdef DLZ_FILESYSTEM
-+		return (0);
-+#else
-+		return (1);
-+#endif
-+	}
-+
- 	if (strcmp(argv[1], "--ipv6only=no") == 0) {
- #ifdef WIN32
- 		return (0);
-diff --git a/configure.ac b/configure.ac
-index fddc63a..5e1ba8c 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -5458,7 +5458,6 @@ AC_CONFIG_FILES([
- 	bin/tests/pkcs11/benchmarks/Makefile
- 	bin/tests/system/Makefile
- 	bin/tests/system/conf.sh
--	bin/tests/system/dlz/prereq.sh
- 	bin/tests/system/dlzexternal/Makefile
- 	bin/tests/system/dlzexternal/ns1/dlzs.conf
- 	bin/tests/system/dyndb/Makefile
--- 
-2.20.1
-
diff --git a/bind-9.11-fips-code.patch b/bind-9.11-fips-code.patch
index 1640b3e..74dbb05 100644
--- a/bind-9.11-fips-code.patch
+++ b/bind-9.11-fips-code.patch
@@ -1,4 +1,4 @@
-From 9ff202072b286ef57e0ffcd7c55777f2994d3985 Mon Sep 17 00:00:00 2001
+From b8485528f5098e3360560d5b85c9ffc592619c55 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 2 Aug 2018 23:34:45 +0200
 Subject: [PATCH] FIPS code changes
@@ -267,7 +267,7 @@ index 2063a3b..8e856c5 100644
  			digestbits = 0;
  		}
 diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
-index 011b118..5eabc1f 100644
+index e75b8b7..9234d35 100644
 --- a/bin/dig/dighost.c
 +++ b/bin/dig/dighost.c
 @@ -80,6 +80,7 @@
@@ -396,7 +396,7 @@ index 7584efb..a153172 100644
  		case hmacsha1: *name = dns_tsig_hmacsha1_name; break;
  		case hmacsha224: *name = dns_tsig_hmacsha224_name; break;
 diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
-index 548e0ce..509784c 100644
+index de60313..bbb3936 100644
 --- a/bin/nsupdate/nsupdate.c
 +++ b/bin/nsupdate/nsupdate.c
 @@ -31,6 +31,7 @@
@@ -406,8 +406,8 @@ index 548e0ce..509784c 100644
 +#include <isc/md5.h>
  #include <isc/mem.h>
  #include <isc/parseint.h>
- #include <isc/print.h>
-@@ -476,9 +477,10 @@ parse_hmac(dns_name_t **hmac, const char *hmacstr, size_t len,
+ #include <isc/portset.h>
+@@ -477,9 +478,10 @@ parse_hmac(dns_name_t **hmac, const char *hmacstr, size_t len,
  	strlcpy(buf, hmacstr, ISC_MIN(len + 1, sizeof(buf)));
  
  #ifndef PK11_MD5_DISABLE
@@ -420,7 +420,7 @@ index 548e0ce..509784c 100644
  		*hmac = DNS_TSIG_HMACMD5_NAME;
  		result = isc_parse_uint16(&digestbits, &buf[9], 10);
  		if (result != ISC_R_SUCCESS || digestbits > 128) {
-@@ -591,10 +593,10 @@ setup_keystr(void) {
+@@ -592,10 +594,10 @@ setup_keystr(void) {
  			exit(1);
  		}
  	} else {
@@ -434,7 +434,7 @@ index 548e0ce..509784c 100644
  #endif
  		name = keystr;
  		n = s;
-@@ -731,7 +733,8 @@ setup_keyfile(isc_mem_t *mctx, isc_log_t *lctx) {
+@@ -732,7 +734,8 @@ setup_keyfile(isc_mem_t *mctx, isc_log_t *lctx) {
  	switch (dst_key_alg(dstkey)) {
  #ifndef PK11_MD5_DISABLE
  	case DST_ALG_HMACMD5:
@@ -444,7 +444,7 @@ index 548e0ce..509784c 100644
  		break;
  #endif
  	case DST_ALG_HMACSHA1:
-@@ -1606,12 +1609,13 @@ evaluate_key(char *cmdline) {
+@@ -1637,12 +1640,13 @@ evaluate_key(char *cmdline) {
  			return (STATUS_SYNTAX);
  		}
  		namestr = n + 1;
@@ -622,7 +622,7 @@ index bde66a4..70a40c3 100644
  	dst_key_free(&dstkey);
  	CHECK("MD5 was disabled", ISC_R_NOTIMPLEMENTED);
 diff --git a/lib/bind9/check.c b/lib/bind9/check.c
-index d6fba22..ac60ba8 100644
+index 2a0e735..dc80018 100644
 --- a/lib/bind9/check.c
 +++ b/lib/bind9/check.c
 @@ -23,6 +23,7 @@
@@ -633,7 +633,7 @@ index d6fba22..ac60ba8 100644
  #include <isc/mem.h>
  #include <isc/netaddr.h>
  #include <isc/parseint.h>
-@@ -2589,6 +2590,15 @@ bind9_check_key(const cfg_obj_t *key, isc_log_t *logctx) {
+@@ -2590,6 +2591,15 @@ bind9_check_key(const cfg_obj_t *key, isc_log_t *logctx) {
  	}
  
  	algorithm = cfg_obj_asstring(algobj);
@@ -966,7 +966,7 @@ index 16214c6..9b235ba 100644
  
  	/* RSASHA256 */
 diff --git a/lib/dns/tests/tsig_test.c b/lib/dns/tests/tsig_test.c
-index 4d6847e..1a208b5 100644
+index 8e5250e..9accc53 100644
 --- a/lib/dns/tests/tsig_test.c
 +++ b/lib/dns/tests/tsig_test.c
 @@ -24,6 +24,7 @@
@@ -1115,7 +1115,7 @@ index 4d29398..e3f5cec 100644
  
  #endif /* !PK11_MD5_DISABLE */
 diff --git a/lib/isc/md5.c b/lib/isc/md5.c
-index 920aed5..a086a57 100644
+index 249f3da..628a414 100644
 --- a/lib/isc/md5.c
 +++ b/lib/isc/md5.c
 @@ -37,6 +37,7 @@
@@ -1126,7 +1126,7 @@ index 920aed5..a086a57 100644
  #include <isc/platform.h>
  #include <isc/safe.h>
  #include <isc/string.h>
-@@ -55,6 +56,9 @@
+@@ -54,6 +55,9 @@
  #define EVP_MD_CTX_free(ptr) EVP_MD_CTX_cleanup(ptr)
  #endif
  
@@ -1136,7 +1136,7 @@ index 920aed5..a086a57 100644
  void
  isc_md5_init(isc_md5_t *ctx) {
  	ctx->ctx = EVP_MD_CTX_new();
-@@ -86,8 +90,33 @@ isc_md5_final(isc_md5_t *ctx, unsigned char *digest) {
+@@ -85,8 +89,33 @@ isc_md5_final(isc_md5_t *ctx, unsigned char *digest) {
  	ctx->ctx = NULL;
  }
  
@@ -1170,7 +1170,7 @@ index 920aed5..a086a57 100644
  void
  isc_md5_init(isc_md5_t *ctx) {
  	CK_RV rv;
-@@ -130,6 +159,31 @@ isc_md5_final(isc_md5_t *ctx, unsigned char *digest) {
+@@ -129,6 +158,31 @@ isc_md5_final(isc_md5_t *ctx, unsigned char *digest) {
  	pk11_return_session(ctx);
  }
  
@@ -1202,7 +1202,7 @@ index 920aed5..a086a57 100644
  #else
  
  static void
-@@ -339,6 +393,11 @@ isc_md5_final(isc_md5_t *ctx, unsigned char *digest) {
+@@ -338,6 +392,11 @@ isc_md5_final(isc_md5_t *ctx, unsigned char *digest) {
  	memmove(digest, ctx->buf, 16);
  	isc_safe_memwipe(ctx, sizeof(*ctx));	/* In case it's sensitive */
  }
diff --git a/bind-9.11-fips-tests.patch b/bind-9.11-fips-tests.patch
index b86b783..b33e1bc 100644
--- a/bind-9.11-fips-tests.patch
+++ b/bind-9.11-fips-tests.patch
@@ -1,4 +1,4 @@
-From 4e6888c1d32071ead4b7faeeb0f1774a6d8a1120 Mon Sep 17 00:00:00 2001
+From 230ca0ddbc95a043933c36c1d182f85cf0dcc971 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 2 Aug 2018 23:46:45 +0200
 Subject: [PATCH] FIPS tests changes
@@ -76,17 +76,14 @@ Date:   Wed Mar 7 10:44:23 2018 +0100
  bin/tests/system/catz/ns2/named.conf.in       |  2 +-
  bin/tests/system/checkconf/bad-tsig.conf      |  2 +-
  bin/tests/system/checkconf/good.conf          |  2 +-
- bin/tests/system/digdelv/ns2/example.db       | 15 ++--
+ bin/tests/system/digdelv/ns2/example.db       | 15 +++--
  bin/tests/system/digdelv/tests.sh             | 28 ++++----
  bin/tests/system/dlv/ns1/sign.sh              |  4 +-
  bin/tests/system/dlv/ns2/sign.sh              |  4 +-
- bin/tests/system/dlv/ns3/sign.sh              | 69 ++++++++++---------
  bin/tests/system/dlv/ns6/sign.sh              | 66 +++++++++---------
- bin/tests/system/dnssec/ns1/sign.sh           |  4 +-
- bin/tests/system/dnssec/ns2/sign.sh           | 12 ++--
- bin/tests/system/dnssec/ns3/sign.sh           | 20 +++---
+ bin/tests/system/dnssec/ns2/sign.sh           |  8 +--
  bin/tests/system/dnssec/ns5/trusted.conf.bad  |  2 +-
- bin/tests/system/dnssec/tests.sh              |  8 +--
+ bin/tests/system/dnssec/tests.sh              |  4 +-
  bin/tests/system/feature-test.c               | 14 ++++
  bin/tests/system/filter-aaaa/ns1/sign.sh      |  4 +-
  bin/tests/system/filter-aaaa/ns4/sign.sh      |  4 +-
@@ -101,11 +98,11 @@ Date:   Wed Mar 7 10:44:23 2018 +0100
  bin/tests/system/tsig/clean.sh                |  1 +
  bin/tests/system/tsig/ns1/named.conf.in       | 10 +--
  bin/tests/system/tsig/setup.sh                |  5 ++
- bin/tests/system/tsig/tests.sh                | 67 +++++++++++-------
+ bin/tests/system/tsig/tests.sh                | 67 ++++++++++++-------
  bin/tests/system/tsiggss/setup.sh             |  2 +-
  bin/tests/system/upforwd/ns1/named.conf.in    |  2 +-
  bin/tests/system/upforwd/tests.sh             |  2 +-
- 47 files changed, 277 insertions(+), 225 deletions(-)
+ 44 files changed, 226 insertions(+), 175 deletions(-)
 
 diff --git a/bin/tests/system/acl/ns2/named1.conf.in b/bin/tests/system/acl/ns2/named1.conf.in
 index 0ea6502..026db3f 100644
@@ -602,37 +599,37 @@ index f4e30f5..9f53e31 100644
  ; TTL of 3 weeks
  weeks		1814400	A	10.53.0.2
 diff --git a/bin/tests/system/digdelv/tests.sh b/bin/tests/system/digdelv/tests.sh
-index 24aa7b3..54a3e2a 100644
+index 1657dfd..299ba94 100644
 --- a/bin/tests/system/digdelv/tests.sh
 +++ b/bin/tests/system/digdelv/tests.sh
-@@ -61,7 +61,7 @@ if [ -x ${DIG} ] ; then
+@@ -88,7 +88,7 @@ if [ -x "$DIG" ] ; then
    echo_i "checking dig +multi +norrcomments works for dnskey (when default is rrcomments)($n)"
    ret=0
    $DIG $DIGOPTS +tcp @10.53.0.3 +multi +norrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1
 -  grep "; ZSK; alg = RSAMD5 ; key id = 30795" < dig.out.test$n > /dev/null && ret=1
 +  grep "; ZSK; alg = RSASHA256 ; key id = 36895" < dig.out.test$n > /dev/null && ret=1
+   check_ttl_range dig.out.test$n "DNSKEY" 300 || ret=1
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
- 
-@@ -69,7 +69,7 @@ if [ -x ${DIG} ] ; then
+@@ -97,7 +97,7 @@ if [ -x "$DIG" ] ; then
    echo_i "checking dig +multi +norrcomments works for soa (when default is rrcomments)($n)"
    ret=0
    $DIG $DIGOPTS +tcp @10.53.0.3 +multi +norrcomments SOA example > dig.out.test$n || ret=1
 -  grep "; ZSK; alg = RSAMD5 ; key id = 30795" < dig.out.test$n > /dev/null && ret=1
 +  grep "; ZSK; alg = RSASHA256 ; key id = 36895" < dig.out.test$n > /dev/null && ret=1
+   check_ttl_range dig.out.test$n "SOA" 300 || ret=1
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
- 
-@@ -77,7 +77,7 @@ if [ -x ${DIG} ] ; then
+@@ -106,7 +106,7 @@ if [ -x "$DIG" ] ; then
    echo_i "checking dig +rrcomments works for DNSKEY($n)"
    ret=0
    $DIG $DIGOPTS +tcp @10.53.0.3 +rrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1
 -  grep "; ZSK; alg = RSAMD5 ; key id = 30795" < dig.out.test$n > /dev/null || ret=1
 +  grep "; ZSK; alg = RSASHA256 ; key id = 36895$" < dig.out.test$n > /dev/null || ret=1
+   check_ttl_range dig.out.test$n "DNSKEY" 300 || ret=1
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
- 
-@@ -85,7 +85,7 @@ if [ -x ${DIG} ] ; then
+@@ -115,7 +115,7 @@ if [ -x "$DIG" ] ; then
    echo_i "checking dig +short +rrcomments works for DNSKEY ($n)"
    ret=0
    $DIG $DIGOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1
@@ -641,7 +638,7 @@ index 24aa7b3..54a3e2a 100644
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
  
-@@ -93,7 +93,7 @@ if [ -x ${DIG} ] ; then
+@@ -123,7 +123,7 @@ if [ -x "$DIG" ] ; then
    echo_i "checking dig +short +nosplit works($n)"
    ret=0
    $DIG $DIGOPTS +tcp @10.53.0.3 +short +nosplit DNSKEY dnskey.example > dig.out.test$n || ret=1
@@ -650,7 +647,7 @@ index 24aa7b3..54a3e2a 100644
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
  
-@@ -101,7 +101,7 @@ if [ -x ${DIG} ] ; then
+@@ -131,7 +131,7 @@ if [ -x "$DIG" ] ; then
    echo_i "checking dig +short +rrcomments works($n)"
    ret=0
    $DIG $DIGOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1
@@ -659,7 +656,7 @@ index 24aa7b3..54a3e2a 100644
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
  
-@@ -117,7 +117,7 @@ if [ -x ${DIG} ] ; then
+@@ -148,7 +148,7 @@ if [ -x "$DIG" ] ; then
    echo_i "checking dig +short +rrcomments works($n)"
    ret=0
    $DIG $DIGOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1
@@ -668,34 +665,34 @@ index 24aa7b3..54a3e2a 100644
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
  
-@@ -564,7 +564,7 @@ if [ -x ${DELV} ] ; then
+@@ -661,7 +661,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +multi +norrcomments works for dnskey (when default is rrcomments)($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +multi +norrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
 -  grep "; ZSK; alg = RSAMD5 ; key id = 30795" < delv.out.test$n > /dev/null && ret=1
 +  grep "; ZSK; alg = RSASHA256 ; key id = 36895" < delv.out.test$n > /dev/null && ret=1
+   check_ttl_range delv.out.test$n "DNSKEY" 300 || ret=1
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
- 
-@@ -572,7 +572,7 @@ if [ -x ${DELV} ] ; then
+@@ -670,7 +670,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +multi +norrcomments works for soa (when default is rrcomments)($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +multi +norrcomments SOA example > delv.out.test$n || ret=1
 -  grep "; ZSK; alg = RSAMD5 ; key id = 30795" < delv.out.test$n > /dev/null && ret=1
 +  grep "; ZSK; alg = RSASHA256 ; key id = 36895" < delv.out.test$n > /dev/null && ret=1
+   check_ttl_range delv.out.test$n "SOA" 300 || ret=1
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
- 
-@@ -580,7 +580,7 @@ if [ -x ${DELV} ] ; then
+@@ -679,7 +679,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +rrcomments works for DNSKEY($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +rrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
 -  grep "; ZSK; alg = RSAMD5 ; key id = 30795" < delv.out.test$n > /dev/null || ret=1
 +  grep "; ZSK; alg = RSASHA256 ; key id = 36895" < delv.out.test$n > /dev/null || ret=1
+   check_ttl_range delv.out.test$n "DNSKEY" 300 || ret=1
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
- 
-@@ -588,7 +588,7 @@ if [ -x ${DELV} ] ; then
+@@ -688,7 +688,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +short +rrcomments works for DNSKEY ($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
@@ -704,7 +701,7 @@ index 24aa7b3..54a3e2a 100644
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
  
-@@ -596,7 +596,7 @@ if [ -x ${DELV} ] ; then
+@@ -696,7 +696,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +short +rrcomments works ($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
@@ -713,7 +710,7 @@ index 24aa7b3..54a3e2a 100644
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
  
-@@ -604,7 +604,7 @@ if [ -x ${DELV} ] ; then
+@@ -704,7 +704,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +short +nosplit works ($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +short +nosplit DNSKEY dnskey.example > delv.out.test$n || ret=1
@@ -722,7 +719,7 @@ index 24aa7b3..54a3e2a 100644
    if test `wc -l < delv.out.test$n` != 1 ; then ret=1 ; fi
    f=`awk '{print NF}' < delv.out.test$n`
    test "${f:-0}" -eq 14 || ret=1
-@@ -615,7 +615,7 @@ if [ -x ${DELV} ] ; then
+@@ -715,7 +715,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +short +nosplit +norrcomments works ($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +short +nosplit +norrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
@@ -732,22 +729,22 @@ index 24aa7b3..54a3e2a 100644
    f=`awk '{print NF}' < delv.out.test$n`
    test "${f:-0}" -eq 4 || ret=1
 diff --git a/bin/tests/system/dlv/ns1/sign.sh b/bin/tests/system/dlv/ns1/sign.sh
-index b815162..2a62e58 100755
+index 606e7cc..a3a0d60 100755
 --- a/bin/tests/system/dlv/ns1/sign.sh
 +++ b/bin/tests/system/dlv/ns1/sign.sh
 @@ -23,8 +23,8 @@ infile=root.db.in
  zonefile=root.db
  outfile=root.signed
  
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` 
+-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
 -keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 1024 -n zone $zone 2> /dev/null` 
++keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 1024 -n zone $zone 2> /dev/null`
 +keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 1024 -n zone $zone 2> /dev/null`
  
  cat $infile $keyname1.key $keyname2.key >$zonefile
  
 diff --git a/bin/tests/system/dlv/ns2/sign.sh b/bin/tests/system/dlv/ns2/sign.sh
-index 6f84d7a..e128303 100755
+index 9825c57..202c978 100755
 --- a/bin/tests/system/dlv/ns2/sign.sh
 +++ b/bin/tests/system/dlv/ns2/sign.sh
 @@ -24,8 +24,8 @@ zonefile=druz.db
@@ -761,205 +758,6 @@ index 6f84d7a..e128303 100755
  
  cat $infile $keyname1.key $keyname2.key >$zonefile
  
-diff --git a/bin/tests/system/dlv/ns3/sign.sh b/bin/tests/system/dlv/ns3/sign.sh
-index bcc9922..846dbcc 100755
---- a/bin/tests/system/dlv/ns3/sign.sh
-+++ b/bin/tests/system/dlv/ns3/sign.sh
-@@ -19,6 +19,7 @@ echo_i "dlv/ns3/sign.sh"
- dlvzone=dlv.utld.
- dlvsets=
- dssets=
-+bits=1024
- 
- zone=child1.utld.
- infile=child.db.in
-@@ -26,8 +27,8 @@ zonefile=child1.utld.db
- outfile=child1.signed
- dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` 
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null` 
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
- cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
-@@ -42,8 +43,8 @@ zonefile=child3.utld.db
- outfile=child3.signed
- dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
- cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
-@@ -58,8 +59,8 @@ zonefile=child4.utld.db
- outfile=child4.signed
- dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- 
-@@ -73,8 +74,8 @@ zonefile=child5.utld.db
- outfile=child5.signed
- dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
- cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
-@@ -88,8 +89,8 @@ infile=child.db.in
- zonefile=child7.utld.db
- outfile=child7.signed
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
- cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
-@@ -103,8 +104,8 @@ infile=child.db.in
- zonefile=child8.utld.db
- outfile=child8.signed
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- 
-@@ -118,8 +119,8 @@ zonefile=child9.utld.db
- outfile=child9.signed
- dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- 
-@@ -132,8 +133,8 @@ zonefile=child10.utld.db
- outfile=child10.signed
- dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- 
-@@ -147,8 +148,8 @@ outfile=child1.druz.signed
- dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
- dssets="$dssets dsset-`echo $zone |sed -e "s/.$//g"`$TP"
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` 
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null` 
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
- cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
-@@ -164,8 +165,8 @@ outfile=child3.druz.signed
- dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
- dssets="$dssets dsset-`echo $zone |sed -e "s/.$//g"`$TP"
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
- cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
-@@ -181,8 +182,8 @@ outfile=child4.druz.signed
- dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
- dssets="$dssets dsset-`echo $zone |sed -e "s/.$//g"`$TP"
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- 
-@@ -197,8 +198,8 @@ outfile=child5.druz.signed
- dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
- dssets="$dssets dsset-`echo $zone |sed -e "s/.$//g"`$TP"
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
- cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
-@@ -213,8 +214,8 @@ zonefile=child7.druz.db
- outfile=child7.druz.signed
- dssets="$dssets dsset-`echo $zone |sed -e "s/.$//g"`$TP"
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
- cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
-@@ -228,8 +229,8 @@ infile=child.db.in
- zonefile=child8.druz.db
- outfile=child8.druz.signed
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- 
-@@ -243,8 +244,8 @@ zonefile=child9.druz.db
- outfile=child9.druz.signed
- dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- 
-@@ -258,8 +259,8 @@ outfile=child10.druz.signed
- dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
- dssets="$dssets dsset-`echo $zone |sed -e "s/.$//g"`$TP"
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- 
-@@ -272,8 +273,8 @@ infile=dlv.db.in
- zonefile=dlv.utld.db
- outfile=dlv.signed
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- cat $infile $dlvsets $keyname1.key $keyname2.key >$zonefile
- 
 diff --git a/bin/tests/system/dlv/ns6/sign.sh b/bin/tests/system/dlv/ns6/sign.sh
 index 1e39862..4ed19ac 100755
 --- a/bin/tests/system/dlv/ns6/sign.sh
@@ -1147,43 +945,11 @@ index 1e39862..4ed19ac 100755
  
  cat $infile $keyname1.key $keyname2.key >$zonefile
  
-diff --git a/bin/tests/system/dnssec/ns1/sign.sh b/bin/tests/system/dnssec/ns1/sign.sh
-index 198d60a..d89a539 100644
---- a/bin/tests/system/dnssec/ns1/sign.sh
-+++ b/bin/tests/system/dnssec/ns1/sign.sh
-@@ -27,7 +27,7 @@ cp ../ns2/dsset-in-addr.arpa$TP .
- grep "8 [12] " ../ns2/dsset-algroll$TP > dsset-algroll$TP
- cp ../ns6/dsset-optout-tld$TP .
- 
--keyname=`$KEYGEN -q -r $RANDFILE -a RSAMD5 -b 768 -n zone $zone`
-+keyname=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 1024 -n zone $zone`
- 
- cat $infile $keyname.key > $zonefile
- 
-@@ -48,6 +48,6 @@ cp managed.conf ../ns4/managed.conf
- #
- #  Save keyid for managed key id test.
- #
--keyid=`expr $keyname : 'K.+001+\(.*\)'`
-+keyid=`expr $keyname : 'K.+008+\([0-9]*\)'`
- keyid=`expr $keyid + 0`
- echo "$keyid" > managed.key.id
 diff --git a/bin/tests/system/dnssec/ns2/sign.sh b/bin/tests/system/dnssec/ns2/sign.sh
-index ca18608..25b6cab 100644
+index b93651a..09b12ba 100644
 --- a/bin/tests/system/dnssec/ns2/sign.sh
 +++ b/bin/tests/system/dnssec/ns2/sign.sh
-@@ -30,8 +30,8 @@ do
- 	cp ../ns3/dsset-$subdomain.example$TP .
- done
- 
--keyname1=`$KEYGEN -q -r $RANDFILE -a DSA -b 768 -n zone $zone`
--keyname2=`$KEYGEN -q -r $RANDFILE -a DSA -b 768 -n zone $zone`
-+keyname1=`$KEYGEN -q -r $RANDFILE -a DSA -b 1024 -n zone $zone`
-+keyname2=`$KEYGEN -q -r $RANDFILE -a DSA -b 1024 -n zone $zone`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- 
-@@ -91,8 +91,8 @@ zone=in-addr.arpa.
+@@ -126,8 +126,8 @@ zone=in-addr.arpa.
  infile=in-addr.arpa.db.in
  zonefile=in-addr.arpa.db
  
@@ -1194,7 +960,7 @@ index ca18608..25b6cab 100644
  
  cat $infile $keyname1.key $keyname2.key >$zonefile
  $SIGNER -P -g -r $RANDFILE -o $zone -k $keyname1 $zonefile $keyname2 > /dev/null
-@@ -103,7 +103,7 @@ privzone=private.secure.example.
+@@ -138,7 +138,7 @@ privzone=private.secure.example
  privinfile=private.secure.example.db.in
  privzonefile=private.secure.example.db
  
@@ -1203,102 +969,15 @@ index ca18608..25b6cab 100644
  
  cat $privinfile $privkeyname.key >$privzonefile
  
-@@ -117,7 +117,7 @@ dlvinfile=dlv.db.in
+@@ -152,7 +152,7 @@ dlvinfile=dlv.db.in
  dlvzonefile=dlv.db
- dlvsetfile=dlvset-`echo $privzone |sed -e "s/\.$//g"`$TP
+ dlvsetfile=dlvset-${privzone}${TP}
  
 -dlvkeyname=`$KEYGEN -q -r $RANDFILE -a RSAMD5 -b 768 -n zone $dlvzone`
 +dlvkeyname=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 1024 -n zone $dlvzone`
  
  cat $dlvinfile $dlvkeyname.key $dlvsetfile > $dlvzonefile
  
-diff --git a/bin/tests/system/dnssec/ns3/sign.sh b/bin/tests/system/dnssec/ns3/sign.sh
-index ff55d84..4f6a251 100644
---- a/bin/tests/system/dnssec/ns3/sign.sh
-+++ b/bin/tests/system/dnssec/ns3/sign.sh
-@@ -28,7 +28,7 @@ zone=bogus.example.
- infile=bogus.example.db.in
- zonefile=bogus.example.db
- 
--keyname=`$KEYGEN -q -r $RANDFILE -a RSAMD5 -b 768 -n zone $zone`
-+keyname=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 2048 -n zone $zone`
- 
- cat $infile $keyname.key >$zonefile
- 
-@@ -38,8 +38,8 @@ zone=dynamic.example.
- infile=dynamic.example.db.in
- zonefile=dynamic.example.db
- 
--keyname1=`$KEYGEN -q -r $RANDFILE -a RSAMD5 -b 768 -n zone $zone`
--keyname2=`$KEYGEN -q -r $RANDFILE -a RSAMD5 -b 1024 -n zone -f KSK $zone`
-+keyname1=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 2048 -n zone $zone`
-+keyname2=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 2048 -n zone -f KSK $zone`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- 
-@@ -49,7 +49,7 @@ zone=keyless.example.
- infile=generic.example.db.in
- zonefile=keyless.example.db
- 
--keyname=`$KEYGEN -q -r $RANDFILE -a RSAMD5 -b 768 -n zone $zone`
-+keyname=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 2048 -n zone $zone`
- 
- cat $infile $keyname.key >$zonefile
- 
-@@ -69,7 +69,7 @@ zone=secure.nsec3.example.
- infile=secure.nsec3.example.db.in
- zonefile=secure.nsec3.example.db
- 
--keyname=`$KEYGEN -q -r $RANDFILE -a RSAMD5 -b 768 -n zone $zone`
-+keyname=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 2048 -n zone $zone`
- 
- cat $infile $keyname.key >$zonefile
- 
-@@ -82,7 +82,7 @@ zone=nsec3.nsec3.example.
- infile=nsec3.nsec3.example.db.in
- zonefile=nsec3.nsec3.example.db
- 
--keyname=`$KEYGEN -q -r $RANDFILE -a NSEC3RSASHA1 -b 768 -n zone $zone`
-+keyname=`$KEYGEN -q -r $RANDFILE -a NSEC3RSASHA1 -b 1024 -n zone $zone`
- 
- cat $infile $keyname.key >$zonefile
- 
-@@ -95,7 +95,7 @@ zone=optout.nsec3.example.
- infile=optout.nsec3.example.db.in
- zonefile=optout.nsec3.example.db
- 
--keyname=`$KEYGEN -q -r $RANDFILE -a NSEC3RSASHA1 -b 768 -n zone $zone`
-+keyname=`$KEYGEN -q -r $RANDFILE -a NSEC3RSASHA1 -b 1024 -n zone $zone`
- 
- cat $infile $keyname.key >$zonefile
- 
-@@ -108,7 +108,7 @@ zone=nsec3.example.
- infile=nsec3.example.db.in
- zonefile=nsec3.example.db
- 
--keyname=`$KEYGEN -q -r $RANDFILE -a NSEC3RSASHA1 -b 768 -n zone $zone`
-+keyname=`$KEYGEN -q -r $RANDFILE -a NSEC3RSASHA1 -b 1024 -n zone $zone`
- 
- cat $infile $keyname.key >$zonefile
- 
-@@ -121,7 +121,7 @@ zone=secure.optout.example.
- infile=secure.optout.example.db.in
- zonefile=secure.optout.example.db
- 
--keyname=`$KEYGEN -q -r $RANDFILE -a RSAMD5 -b 768 -n zone $zone`
-+keyname=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 2048 -n zone $zone`
- 
- cat $infile $keyname.key >$zonefile
- 
-@@ -533,7 +533,7 @@ zone=badds.example.
- infile=bogus.example.db.in
- zonefile=badds.example.db
- 
--keyname=`$KEYGEN -q -r $RANDFILE -a RSAMD5 -b 768 -n zone $zone`
-+keyname=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 2048 -n zone $zone`
- 
- cat $infile $keyname.key >$zonefile
- 
 diff --git a/bin/tests/system/dnssec/ns5/trusted.conf.bad b/bin/tests/system/dnssec/ns5/trusted.conf.bad
 index ed30460..e6b1126 100644
 --- a/bin/tests/system/dnssec/ns5/trusted.conf.bad
@@ -1311,28 +990,10 @@ index ed30460..e6b1126 100644
 +    "." 256 3 8 "AwEAAarwAdjV4gIhpBCjXVAScRFEx3co7k8smJdxrnqoGsl5NB7EZ9jRdgvCXbJn6v8y9jlNWVHvaC8ilhfhLh0A1vLWiWv4ijd/12xcnrY7xpG7Cu3YkxUxaXJ7Jdg/Iw1+9mGgXF1v4UbCIcw/3U3cxyk7OxYg+VSb5KBAQSR0upxV";
  };
 diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh
-index 646434f..9a10f9f 100644
+index 51dc117..48cb34b 100644
 --- a/bin/tests/system/dnssec/tests.sh
 +++ b/bin/tests/system/dnssec/tests.sh
-@@ -1688,7 +1688,7 @@ ret=0
- $RNDCCMD 10.53.0.4 secroots 2>&1 | sed 's/^/ns4 /' | cat_i
- keyid=`cat ns1/managed.key.id`
- cp ns4/named.secroots named.secroots.test$n
--linecount=`grep "./RSAMD5/$keyid ; trusted" named.secroots.test$n | wc -l`
-+linecount=`grep "./RSASHA256/$keyid ; trusted" named.secroots.test$n | wc -l`
- [ "$linecount" -eq 1 ] || ret=1
- linecount=`cat named.secroots.test$n | wc -l`
- [ "$linecount" -eq 10 ] || ret=1
-@@ -3016,7 +3016,7 @@ echo_i "check dig's +nocrypto flag ($n)"
- ret=0
- $DIG $DIGOPTS +norec +nocrypto DNSKEY . \
- 	@10.53.0.1 > dig.out.dnskey.ns1.test$n || ret=1
--grep '256 3 1 \[key id = [1-9][0-9]*]' dig.out.dnskey.ns1.test$n > /dev/null || ret=1
-+grep '256 3 8 \[key id = [1-9][0-9]*]' dig.out.dnskey.ns1.test$n > /dev/null || ret=1
- grep 'RRSIG.* \[omitted]' dig.out.dnskey.ns1.test$n > /dev/null || ret=1
- $DIG $DIGOPTS +norec +nocrypto DS example \
- 	@10.53.0.1 > dig.out.ds.ns1.test$n || ret=1
-@@ -3128,8 +3128,8 @@ do
+@@ -3227,8 +3227,8 @@ do
  	   alg=`expr $alg + 1`
  	   continue;;
  	3) size="-b 512";;
@@ -1344,7 +1005,7 @@ index 646434f..9a10f9f 100644
  	8) size="-b 512";;
  	10) size="-b 1024";;
 diff --git a/bin/tests/system/feature-test.c b/bin/tests/system/feature-test.c
-index f934b63..11863a3 100644
+index 3ac34e8..428d107 100644
 --- a/bin/tests/system/feature-test.c
 +++ b/bin/tests/system/feature-test.c
 @@ -19,6 +19,7 @@
@@ -1363,7 +1024,7 @@ index f934b63..11863a3 100644
  	fprintf(stderr, "	--rpz-nsdname\n");
  	fprintf(stderr, "	--rpz-nsip\n");
  	fprintf(stderr, "	--with-idn\n");
-@@ -136,6 +138,18 @@ main(int argc, char **argv) {
+@@ -137,6 +139,18 @@ main(int argc, char **argv) {
  #endif
  	}
  
@@ -1488,10 +1149,10 @@ index 4549184..cb7dccd 100644
  };
  
 diff --git a/bin/tests/system/nsupdate/setup.sh b/bin/tests/system/nsupdate/setup.sh
-index 45dfeeb..594db77 100644
+index 21805c5..0d3d85c 100644
 --- a/bin/tests/system/nsupdate/setup.sh
 +++ b/bin/tests/system/nsupdate/setup.sh
-@@ -63,7 +63,12 @@ EOF
+@@ -58,7 +58,12 @@ EOF
  
  $DDNSCONFGEN -q -r $RANDFILE -z example.nil > ns1/ddns.key
  
@@ -1506,10 +1167,10 @@ index 45dfeeb..594db77 100644
  $DDNSCONFGEN -q -r $RANDFILE -a hmac-sha224 -k sha224-key -z keytests.nil > ns1/sha224.key
  $DDNSCONFGEN -q -r $RANDFILE -a hmac-sha256 -k sha256-key -z keytests.nil > ns1/sha256.key
 diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh
-index 901cd22..b72b59c 100755
+index 4da4849..b3bc807 100755
 --- a/bin/tests/system/nsupdate/tests.sh
 +++ b/bin/tests/system/nsupdate/tests.sh
-@@ -700,7 +700,14 @@ fi
+@@ -708,7 +708,14 @@ fi
  n=`expr $n + 1`
  ret=0
  echo_i "check TSIG key algorithms ($n)"
@@ -1525,7 +1186,7 @@ index 901cd22..b72b59c 100755
      $NSUPDATE -k ns1/${alg}.key <<END > /dev/null || ret=1
  server 10.53.0.1 ${PORT}
  update add ${alg}.keytests.nil. 600 A 10.10.10.3
-@@ -708,7 +715,7 @@ send
+@@ -716,7 +723,7 @@ send
  END
  done
  sleep 2
diff --git a/bind-9.11-rt31459.patch b/bind-9.11-rt31459.patch
index e24aa8d..1eee414 100644
--- a/bind-9.11-rt31459.patch
+++ b/bind-9.11-rt31459.patch
@@ -1,4 +1,4 @@
-From 99fc89de7b96713a7c82ea9b98d5bc0c70ad1f6e Mon Sep 17 00:00:00 2001
+From 255fdf0b549ab2f138443ead0ac81bf864612217 Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Tue, 12 Sep 2017 19:05:46 -0700
 Subject: [PATCH] rebased rt31459c
@@ -22,7 +22,7 @@ Include new unit test
  bin/dnssec/dnssec-verify.c               |   8 +-
  bin/dnssec/dnssectool.c                  |  11 +-
  bin/named/server.c                       |   6 +
- bin/nsupdate/nsupdate.c                  |  18 +-
+ bin/nsupdate/nsupdate.c                  |  14 +-
  bin/tests/makejournal.c                  |   6 +-
  bin/tests/system/pipelined/pipequeries.c |  21 +-
  bin/tests/system/pipelined/tests.sh      |   4 +-
@@ -49,7 +49,7 @@ Include new unit test
  lib/isc/pk11.c                           |  12 +-
  lib/isc/win32/include/isc/platform.h.in  |   5 +
  win32utils/Configure                     |  29 ++-
- 36 files changed, 707 insertions(+), 175 deletions(-)
+ 36 files changed, 703 insertions(+), 175 deletions(-)
  create mode 100644 lib/dns/tests/dstrandom_test.c
 
 diff --git a/bin/confgen/keygen.c b/bin/confgen/keygen.c
@@ -71,7 +71,7 @@ index 5015abb..295e16f 100644
  							     &entropy_source,
  							     randomfile,
 diff --git a/bin/dnssec/dnssec-dsfromkey.c b/bin/dnssec/dnssec-dsfromkey.c
-index 931d5de..864f2ad 100644
+index 060892b..c2cc9c7 100644
 --- a/bin/dnssec/dnssec-dsfromkey.c
 +++ b/bin/dnssec/dnssec-dsfromkey.c
 @@ -494,14 +494,14 @@ main(int argc, char **argv) {
@@ -293,7 +293,7 @@ index fbc7ece..31a99e7 100644
  					   usekeyboard);
  
 diff --git a/bin/named/server.c b/bin/named/server.c
-index b63a386..30e7eac 100644
+index 0abbbed..405ff71 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
 @@ -36,6 +36,7 @@
@@ -324,18 +324,10 @@ index b63a386..30e7eac 100644
  		}
  	}
 diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
-index 509784c..6d7a02e 100644
+index bbb3936..0286987 100644
 --- a/bin/nsupdate/nsupdate.c
 +++ b/bin/nsupdate/nsupdate.c
-@@ -35,6 +35,7 @@
- #include <isc/mem.h>
- #include <isc/parseint.h>
- #include <isc/print.h>
-+#include <isc/platform.h>
- #include <isc/random.h>
- #include <isc/region.h>
- #include <isc/sockaddr.h>
-@@ -271,7 +272,8 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
+@@ -272,7 +272,8 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
  	if (*ectx == NULL) {
  		result = isc_entropy_create(mctx, ectx);
  		if (result != ISC_R_SUCCESS)
@@ -345,7 +337,7 @@ index 509784c..6d7a02e 100644
  		ISC_LIST_INIT(sources);
  	}
  
-@@ -280,6 +282,13 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
+@@ -281,6 +282,13 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
  		randomfile = NULL;
  	}
  
@@ -359,7 +351,7 @@ index 509784c..6d7a02e 100644
  	result = isc_entropy_usebestsource(*ectx, &source, randomfile,
  					   usekeyboard);
  
-@@ -950,11 +959,11 @@ setup_system(void) {
+@@ -979,11 +987,11 @@ setup_system(void) {
  		}
  	}
  
@@ -373,16 +365,6 @@ index 509784c..6d7a02e 100644
  
  	result = dns_dispatchmgr_create(gmctx, entropy, &dispatchmgr);
  	check_result(result, "dns_dispatchmgr_create");
-@@ -978,6 +987,9 @@ setup_system(void) {
- 	check_result(result, "dst_lib_init");
- 	is_dst_up = true;
- 
-+	/* moved after dst_lib_init() */
-+	isc_hash_init();
-+
- 	attrmask = DNS_DISPATCHATTR_UDP | DNS_DISPATCHATTR_TCP;
- 	attrmask |= DNS_DISPATCHATTR_IPV4 | DNS_DISPATCHATTR_IPV6;
- 
 diff --git a/bin/tests/makejournal.c b/bin/tests/makejournal.c
 index 61a41b0..acc71a1 100644
 --- a/bin/tests/makejournal.c
@@ -707,7 +689,7 @@ index b27fc1d..e28871b 100644
  	parse_args(false, argc, argv);
  	if (server == NULL)
 diff --git a/configure b/configure
-index e425720..4f09c96 100755
+index b219e16..4da30b9 100755
 --- a/configure
 +++ b/configure
 @@ -640,6 +640,7 @@ ac_includes_default="\
@@ -718,7 +700,7 @@ index e425720..4f09c96 100755
  BUILD_LIBS
  BUILD_LDFLAGS
  BUILD_CPPFLAGS
-@@ -824,6 +825,7 @@ XMLSTATS
+@@ -823,6 +824,7 @@ XMLSTATS
  NZDTARGETS
  NZDSRCS
  NZD_TOOLS
@@ -726,7 +708,7 @@ index e425720..4f09c96 100755
  PKCS11_TEST
  PKCS11_ED25519
  PKCS11_GOST
-@@ -1039,6 +1041,7 @@ with_eddsa
+@@ -1038,6 +1040,7 @@ with_eddsa
  with_aes
  enable_openssl_hash
  with_cc_alg
@@ -734,7 +716,7 @@ index e425720..4f09c96 100755
  with_lmdb
  with_libxml2
  with_libjson
-@@ -1735,6 +1738,7 @@ Optional Features:
+@@ -1734,6 +1737,7 @@ Optional Features:
    --enable-threads        enable multithreading
    --enable-native-pkcs11  use native PKCS11 for all crypto [default=no]
    --enable-openssl-hash   use OpenSSL for hash functions [default=no]
@@ -742,7 +724,7 @@ index e425720..4f09c96 100755
    --enable-largefile      64-bit file support
    --enable-backtrace      log stack backtrace on abort [default=yes]
    --enable-symtable       use internal symbol table for backtrace
-@@ -16684,6 +16688,7 @@ case "$use_openssl" in
+@@ -16686,6 +16690,7 @@ case "$use_openssl" in
  $as_echo "disabled because of native PKCS11" >&6; }
  		DST_OPENSSL_INC=""
  		CRYPTO="-DPKCS11CRYPTO"
@@ -750,7 +732,7 @@ index e425720..4f09c96 100755
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -16698,6 +16703,7 @@ $as_echo "disabled because of native PKCS11" >&6; }
+@@ -16700,6 +16705,7 @@ $as_echo "disabled because of native PKCS11" >&6; }
  $as_echo "no" >&6; }
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -758,7 +740,7 @@ index e425720..4f09c96 100755
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -16710,6 +16716,7 @@ $as_echo "no" >&6; }
+@@ -16712,6 +16718,7 @@ $as_echo "no" >&6; }
  	auto)
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -766,7 +748,7 @@ index e425720..4f09c96 100755
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -16719,7 +16726,7 @@ $as_echo "no" >&6; }
+@@ -16721,7 +16728,7 @@ $as_echo "no" >&6; }
  		OPENSSLLINKOBJS=""
  		OPENSSLLINKSRCS=""
  		as_fn_error $? "OpenSSL was not found in any of $openssldirs; use --with-openssl=/path
@@ -775,7 +757,7 @@ index e425720..4f09c96 100755
  		;;
  	*)
  		if test "yes" = "$want_native_pkcs11"
-@@ -16750,6 +16757,7 @@ $as_echo "not found" >&6; }
+@@ -16752,6 +16759,7 @@ $as_echo "not found" >&6; }
  			as_fn_error $? "\"$use_openssl/include/openssl/opensslv.h\" not found" "$LINENO" 5
  		fi
  		CRYPTO='-DOPENSSL'
@@ -783,7 +765,7 @@ index e425720..4f09c96 100755
  		if test "/usr" = "$use_openssl"
  		then
  			DST_OPENSSL_INC=""
-@@ -17411,8 +17419,6 @@ fi
+@@ -17413,8 +17421,6 @@ fi
  # Use OpenSSL for hash functions
  #
  
@@ -792,7 +774,7 @@ index e425720..4f09c96 100755
  ISC_PLATFORM_OPENSSLHASH="#undef ISC_PLATFORM_OPENSSLHASH"
  case $want_openssl_hash in
  	yes)
-@@ -17787,6 +17793,86 @@ if test "rt" = "$have_clock_gt"; then
+@@ -17789,6 +17795,86 @@ if test "rt" = "$have_clock_gt"; then
  	LIBS="-lrt $LIBS"
  fi
  
@@ -879,7 +861,7 @@ index e425720..4f09c96 100755
  #
  # was --with-lmdb specified?
  #
-@@ -19869,9 +19955,12 @@ _ACEOF
+@@ -19871,9 +19957,12 @@ _ACEOF
  if ac_fn_c_try_compile "$LINENO"; then :
    { $as_echo "$as_me:${as_lineno-$LINENO}: result: size_t for buflen; int for flags" >&5
  $as_echo "size_t for buflen; int for flags" >&6; }
@@ -894,7 +876,7 @@ index e425720..4f09c96 100755
  
  	 $as_echo "#define IRS_GETNAMEINFO_FLAGS_T int" >>confdefs.h
  
-@@ -21186,12 +21275,7 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
+@@ -21188,12 +21277,7 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
  ISC_PLATFORM_USESTDASM="#undef ISC_PLATFORM_USESTDASM"
  ISC_PLATFORM_USEMACASM="#undef ISC_PLATFORM_USEMACASM"
  if test "yes" = "$use_atomic"; then
@@ -908,7 +890,7 @@ index e425720..4f09c96 100755
  # version HP92453-01 B.11.11.23709.GP, which incorrectly rejects
  # declarations like `int a3[[(sizeof (unsigned char)) >= 0]];'.
  # This bug is HP SR number 8606223364.
-@@ -21224,6 +21308,11 @@ cat >>confdefs.h <<_ACEOF
+@@ -21226,6 +21310,11 @@ cat >>confdefs.h <<_ACEOF
  _ACEOF
  
  
@@ -920,7 +902,7 @@ index e425720..4f09c96 100755
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -21232,39 +21321,6 @@ _ACEOF
+@@ -21234,39 +21323,6 @@ _ACEOF
  		fi
  	;;
  	x86_64-*|amd64-*)
@@ -960,7 +942,7 @@ index e425720..4f09c96 100755
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -21295,6 +21351,10 @@ $as_echo_n "checking architecture type for atomic operations... " >&6; }
+@@ -21297,6 +21353,10 @@ $as_echo_n "checking architecture type for atomic operations... " >&6; }
  $as_echo "$arch" >&6; }
  fi
  
@@ -971,7 +953,7 @@ index e425720..4f09c96 100755
  if test "yes" = "$have_atomic"; then
  	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking compiler support for inline assembly code" >&5
  $as_echo_n "checking compiler support for inline assembly code... " >&6; }
-@@ -23848,6 +23908,30 @@ CFLAGS="$CFLAGS $SO_CFLAGS"
+@@ -23896,6 +23956,30 @@ CFLAGS="$CFLAGS $SO_CFLAGS"
  #
  dlzdir='${DLZ_DRIVER_DIR}'
  
@@ -1002,7 +984,7 @@ index e425720..4f09c96 100755
  #
  # Private autoconf macro to simplify configuring drivers:
  #
-@@ -24178,11 +24262,11 @@ $as_echo "no" >&6; }
+@@ -24226,11 +24310,11 @@ $as_echo "no" >&6; }
  $as_echo "using mysql with libs ${mysql_lib} and includes ${mysql_include}" >&6; }
  		;;
  	*)
@@ -1017,7 +999,7 @@ index e425720..4f09c96 100755
  		fi
  
  	CONTRIB_DLZ="$CONTRIB_DLZ -DDLZ_MYSQL"
-@@ -24267,7 +24351,7 @@ $as_echo "" >&6; }
+@@ -24315,7 +24399,7 @@ $as_echo "" >&6; }
  			# Check other locations for includes.
  			# Order is important (sigh).
  
@@ -1026,7 +1008,7 @@ index e425720..4f09c96 100755
  			# include a blank element first
  			for d in "" $bdb_incdirs
  			do
-@@ -24292,57 +24376,9 @@ $as_echo "" >&6; }
+@@ -24340,57 +24424,9 @@ $as_echo "" >&6; }
  			bdb_libnames="db53 db-5.3 db51 db-5.1 db48 db-4.8 db47 db-4.7 db46 db-4.6 db45 db-4.5 db44 db-4.4 db43 db-4.3 db42 db-4.2 db41 db-4.1 db"
  			for d in $bdb_libnames
  			do
@@ -1086,7 +1068,7 @@ index e425720..4f09c96 100755
  					break
  				fi
  			done
-@@ -24501,10 +24537,10 @@ $as_echo "no" >&6; }
+@@ -24549,10 +24585,10 @@ $as_echo "no" >&6; }
  		DLZ_DRIVER_INCLUDES="$DLZ_DRIVER_INCLUDES -I$use_dlz_ldap/include"
  		DLZ_DRIVER_LDAP_INCLUDES="-I$use_dlz_ldap/include"
  	fi
@@ -1100,7 +1082,7 @@ index e425720..4f09c96 100755
  	fi
  
  
-@@ -24590,11 +24626,11 @@ fi
+@@ -24638,11 +24674,11 @@ fi
  		odbcdirs="/usr /usr/local /usr/pkg"
  		for d in $odbcdirs
  		do
@@ -1114,7 +1096,7 @@ index e425720..4f09c96 100755
  				break
  			fi
  		done
-@@ -24869,6 +24905,8 @@ DNS_CRYPTO_LIBS="$NEWFLAGS"
+@@ -24917,6 +24953,8 @@ DNS_CRYPTO_LIBS="$NEWFLAGS"
  
  
  
@@ -1123,7 +1105,7 @@ index e425720..4f09c96 100755
  #
  # Commands to run at the end of config.status.
  # Don't just put these into configure, it won't work right if somebody
-@@ -27248,6 +27286,8 @@ report() {
+@@ -27295,6 +27333,8 @@ report() {
  	    echo "    IPv6 support (--enable-ipv6)"
  	test "X$CRYPTO" = "X" -o "yes" = "$want_native_pkcs11" || \
  		echo "    OpenSSL cryptography/DNSSEC (--with-openssl)"
@@ -1132,7 +1114,7 @@ index e425720..4f09c96 100755
  	test "X$PYTHON" = "X" || echo "    Python tools (--with-python)"
  	test "X$XMLSTATS" = "X" || echo "    XML statistics (--with-libxml2)"
  	test "X$JSONSTATS" = "X" || echo "    JSON statistics (--with-libjson)"
-@@ -27288,6 +27328,8 @@ report() {
+@@ -27335,6 +27375,8 @@ report() {
  	echo "    Very verbose query trace logging (--enable-querytrace)"
      test "no" = "$with_cmocka" || echo "    CMocka Unit Testing Framework (--with-cmocka)"
  
@@ -1141,7 +1123,7 @@ index e425720..4f09c96 100755
      echo "    Dynamically loadable zone (DLZ) drivers:"
      test "no" = "$use_dlz_bdb" || \
  	echo "        Berkeley DB (--with-dlz-bdb)"
-@@ -27335,6 +27377,8 @@ report() {
+@@ -27382,6 +27424,8 @@ report() {
  	echo "    ECDSA algorithm support (--with-ecdsa)"
      test "X$CRYPTO" = "X" -o "yes" = "$OPENSSL_ED25519" -o "yes" = "$PKCS11_ED25519" || \
  	echo "    EDDSA algorithm support (--with-eddsa)"
@@ -1151,10 +1133,10 @@ index e425720..4f09c96 100755
      test "yes" = "$enable_seccomp" || \
  	echo "    Use libseccomp system call filtering (--enable-seccomp)"
 diff --git a/configure.ac b/configure.ac
-index 7c5ad51..fddc63a 100644
+index 7fd192c..5e4e839 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -1503,6 +1503,7 @@ case "$use_openssl" in
+@@ -1514,6 +1514,7 @@ case "$use_openssl" in
  		AC_MSG_RESULT(disabled because of native PKCS11)
  		DST_OPENSSL_INC=""
  		CRYPTO="-DPKCS11CRYPTO"
@@ -1162,7 +1144,7 @@ index 7c5ad51..fddc63a 100644
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -1516,6 +1517,7 @@ case "$use_openssl" in
+@@ -1527,6 +1528,7 @@ case "$use_openssl" in
  		AC_MSG_RESULT(no)
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -1170,7 +1152,7 @@ index 7c5ad51..fddc63a 100644
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -1528,6 +1530,7 @@ case "$use_openssl" in
+@@ -1539,6 +1541,7 @@ case "$use_openssl" in
  	auto)
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -1178,7 +1160,7 @@ index 7c5ad51..fddc63a 100644
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -1538,7 +1541,7 @@ case "$use_openssl" in
+@@ -1549,7 +1552,7 @@ case "$use_openssl" in
  		OPENSSLLINKSRCS=""
  		AC_MSG_ERROR(
  [OpenSSL was not found in any of $openssldirs; use --with-openssl=/path
@@ -1187,7 +1169,7 @@ index 7c5ad51..fddc63a 100644
  		;;
  	*)
  		if test "yes" = "$want_native_pkcs11"
-@@ -1568,6 +1571,7 @@ If you don't want OpenSSL, use --without-openssl])
+@@ -1579,6 +1582,7 @@ If you don't want OpenSSL, use --without-openssl])
  			AC_MSG_ERROR(["$use_openssl/include/openssl/opensslv.h" not found])
  		fi
  		CRYPTO='-DOPENSSL'
@@ -1195,7 +1177,7 @@ index 7c5ad51..fddc63a 100644
  		if test "/usr" = "$use_openssl"
  		then
  			DST_OPENSSL_INC=""
-@@ -2041,7 +2045,6 @@ fi
+@@ -2052,7 +2056,6 @@ fi
  # Use OpenSSL for hash functions
  #
  
@@ -1203,7 +1185,7 @@ index 7c5ad51..fddc63a 100644
  ISC_PLATFORM_OPENSSLHASH="#undef ISC_PLATFORM_OPENSSLHASH"
  case $want_openssl_hash in
  	yes)
-@@ -2313,6 +2316,67 @@ if test "rt" = "$have_clock_gt"; then
+@@ -2324,6 +2327,67 @@ if test "rt" = "$have_clock_gt"; then
  	LIBS="-lrt $LIBS"
  fi
  
@@ -1271,7 +1253,7 @@ index 7c5ad51..fddc63a 100644
  #
  # was --with-lmdb specified?
  #
-@@ -4109,12 +4173,12 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
+@@ -4120,12 +4184,12 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
  ISC_PLATFORM_USESTDASM="#undef ISC_PLATFORM_USESTDASM"
  ISC_PLATFORM_USEMACASM="#undef ISC_PLATFORM_USEMACASM"
  if test "yes" = "$use_atomic"; then
@@ -1285,7 +1267,7 @@ index 7c5ad51..fddc63a 100644
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -4123,7 +4187,6 @@ if test "yes" = "$use_atomic"; then
+@@ -4134,7 +4198,6 @@ if test "yes" = "$use_atomic"; then
  		fi
  	;;
  	x86_64-*|amd64-*)
@@ -1293,7 +1275,7 @@ index 7c5ad51..fddc63a 100644
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -5541,6 +5604,8 @@ report() {
+@@ -5543,6 +5606,8 @@ report() {
  	    echo "    IPv6 support (--enable-ipv6)"
  	test "X$CRYPTO" = "X" -o "yes" = "$want_native_pkcs11" || \
  		echo "    OpenSSL cryptography/DNSSEC (--with-openssl)"
@@ -1302,7 +1284,7 @@ index 7c5ad51..fddc63a 100644
  	test "X$PYTHON" = "X" || echo "    Python tools (--with-python)"
  	test "X$XMLSTATS" = "X" || echo "    XML statistics (--with-libxml2)"
  	test "X$JSONSTATS" = "X" || echo "    JSON statistics (--with-libjson)"
-@@ -5581,6 +5646,8 @@ report() {
+@@ -5583,6 +5648,8 @@ report() {
  	echo "    Very verbose query trace logging (--enable-querytrace)"
      test "no" = "$with_cmocka" || echo "    CMocka Unit Testing Framework (--with-cmocka)"
  
@@ -1311,7 +1293,7 @@ index 7c5ad51..fddc63a 100644
      echo "    Dynamically loadable zone (DLZ) drivers:"
      test "no" = "$use_dlz_bdb" || \
  	echo "        Berkeley DB (--with-dlz-bdb)"
-@@ -5628,6 +5695,8 @@ report() {
+@@ -5630,6 +5697,8 @@ report() {
  	echo "    ECDSA algorithm support (--with-ecdsa)"
      test "X$CRYPTO" = "X" -o "yes" = "$OPENSSL_ED25519" -o "yes" = "$PKCS11_ED25519" || \
  	echo "    EDDSA algorithm support (--with-eddsa)"
@@ -2034,10 +2016,10 @@ index 5b8a2c9..913a2ce 100644
   * Define if the hash functions must be provided by OpenSSL.
   */
 diff --git a/win32utils/Configure b/win32utils/Configure
-index ad99f89..2c55946 100644
+index 27b00af..7e35d60 100644
 --- a/win32utils/Configure
 +++ b/win32utils/Configure
-@@ -381,6 +381,7 @@ my @substdefh = ("AES_CC",
+@@ -380,6 +380,7 @@ my @substdefh = ("AES_CC",
  my %configdefp;
  
  my @substdefp = ("ISC_PLATFORM_BUSYWAITNOP",
@@ -2045,7 +2027,7 @@ index ad99f89..2c55946 100644
                   "ISC_PLATFORM_HAVEATOMICSTORE",
                   "ISC_PLATFORM_HAVEATOMICSTOREQ",
                   "ISC_PLATFORM_HAVECMPXCHG",
-@@ -510,7 +511,8 @@ my @allcond = (@substcond, "NOTYET", "NOLONGER");
+@@ -509,7 +510,8 @@ my @allcond = (@substcond, "NOTYET", "NOLONGER");
  
  # enable-xxx/disable-xxx
  
@@ -2055,7 +2037,7 @@ index ad99f89..2c55946 100644
                    "fixed-rrset",
                    "intrinsics",
                    "isc-spnego",
-@@ -573,6 +575,7 @@ my @help = (
+@@ -572,6 +574,7 @@ my @help = (
  "\nOptional Features:\n",
  "  enable-intrinsics     enable instrinsic/atomic functions [default=yes]\n",
  "  enable-native-pkcs11  use native PKCS#11 for all crypto [default=no]\n",
@@ -2063,7 +2045,7 @@ index ad99f89..2c55946 100644
  "  enable-openssl-hash   use OpenSSL for hash functions [default=yes]\n",
  "  enable-isc-spnego     use SPNEGO from lib/dns [default=yes]\n",
  "  enable-filter-aaaa    enable filtering of AAAA records [default=yes]\n",
-@@ -617,7 +620,9 @@ my $want_clean = "no";
+@@ -616,7 +619,9 @@ my $want_clean = "no";
  my $want_unknown = "no";
  my $unknown_value;
  my $enable_intrinsics = "yes";
@@ -2073,7 +2055,7 @@ index ad99f89..2c55946 100644
  my $enable_openssl_hash = "auto";
  my $enable_filter_aaaa = "yes";
  my $enable_isc_spnego = "yes";
-@@ -828,6 +833,10 @@ sub myenable {
+@@ -834,6 +839,10 @@ sub myenable {
          if ($val =~ /^yes$/i) {
              $enable_native_pkcs11 = "yes";
          }
@@ -2084,7 +2066,7 @@ index ad99f89..2c55946 100644
      } elsif ($key =~ /^openssl-hash$/i) {
          if ($val =~ /^yes$/i) {
              $enable_openssl_hash = "yes";
-@@ -1119,6 +1128,11 @@ if ($verbose) {
+@@ -1125,6 +1134,11 @@ if ($verbose) {
      } else {
          print "native-pkcs11: disabled\n";
      }
@@ -2096,7 +2078,7 @@ index ad99f89..2c55946 100644
      if ($enable_openssl_hash eq "yes") {
          print "openssl-hash: enabled\n";
      } else {
-@@ -1472,6 +1486,7 @@ if ($enable_intrinsics eq "yes") {
+@@ -1478,6 +1492,7 @@ if ($enable_intrinsics eq "yes") {
  
  # enable-native-pkcs11
  if ($enable_native_pkcs11 eq "yes") {
@@ -2104,7 +2086,7 @@ index ad99f89..2c55946 100644
      if ($use_openssl eq "auto") {
          $use_openssl = "no";
      }
-@@ -1681,6 +1696,7 @@ if ($use_openssl eq "yes") {
+@@ -1687,6 +1702,7 @@ if ($use_openssl eq "yes") {
          $openssl_dll = File::Spec->catdir($openssl_path, "@dirlist[0]");
      }   
  
@@ -2112,7 +2094,7 @@ index ad99f89..2c55946 100644
      $configcond{"OPENSSL"} = 1;
      $configdefd{"CRYPTO"} = "OPENSSL";
      $configvar{"OPENSSL_PATH"} = "$openssl_path";
-@@ -2232,6 +2248,15 @@ if ($cookie_algorithm eq "sha1") {
+@@ -2238,6 +2254,15 @@ if ($cookie_algorithm eq "sha1") {
      die "Unrecognized cookie algorithm: $cookie_algorithm\n";
  }
  
@@ -2128,7 +2110,7 @@ index ad99f89..2c55946 100644
  # enable-openssl-hash
  if ($enable_openssl_hash eq "yes") {
      if ($use_openssl eq "no") {
-@@ -3558,6 +3583,7 @@ exit 0;
+@@ -3564,6 +3589,7 @@ exit 0;
  #  --enable-developer partially supported
  #  --enable-newstats (9.9/9.9sub only)
  #  --enable-native-pkcs11 supported
@@ -2136,7 +2118,7 @@ index ad99f89..2c55946 100644
  #  --enable-openssl-version-check included without a way to disable it
  #  --enable-openssl-hash supported
  #  --enable-threads included without a way to disable it
-@@ -3583,6 +3609,7 @@ exit 0;
+@@ -3589,6 +3615,7 @@ exit 0;
  #  --with-gost supported
  #  --with-aes supported
  #  --with-cc-alg supported
diff --git a/bind-9.11-tests-variants.patch b/bind-9.11-tests-variants.patch
index 55f4491..d983671 100644
--- a/bind-9.11-tests-variants.patch
+++ b/bind-9.11-tests-variants.patch
@@ -1,4 +1,4 @@
-From 7d689f77714430a4ef6cead040ec304dca0b8bd3 Mon Sep 17 00:00:00 2001
+From 06a22ff20ac3d68fa1f995c91068b43392425e43 Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Fri, 1 Mar 2019 15:48:20 +0100
 Subject: [PATCH] Make alternative named builds testable in system tests
@@ -17,19 +17,19 @@ export NAMED_VARIANT=-pkcs11 DNSSEC_VARIANT=-pkcs11
  1 file changed, 10 insertions(+), 9 deletions(-)
 
 diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
-index b072af8..d2cb8ed 100644
+index 4b0fe39..f135af6 100644
 --- a/bin/tests/system/conf.sh.in
 +++ b/bin/tests/system/conf.sh.in
-@@ -27,7 +27,7 @@ ALTERNATIVE_ALGORITHM=RSASHA1
- ALTERNATIVE_ALGORITHM_NUMBER=5
- ALTERNATIVE_BITS=1280
+@@ -34,7 +34,7 @@ DISABLED_ALGORITHM=ECDSAP384SHA384
+ DISABLED_ALGORITHM_NUMBER=14
+ DISABLED_BITS=384
  
 -NAMED=$TOP/bin/named/named
 +NAMED=$TOP/bin/named${NAMED_VARIANT}/named${NAMED_VARIANT}
  # We must use "named -l" instead of "lwresd" because argv[0] is lost
  # if the program is libtoolized.
  LWRESD="$TOP/bin/named/named -l"
-@@ -38,13 +38,14 @@ NSUPDATE=$TOP/bin/nsupdate/nsupdate
+@@ -45,13 +45,14 @@ NSUPDATE=$TOP/bin/nsupdate/nsupdate
  DDNSCONFGEN=$TOP/bin/confgen/ddns-confgen
  TSIGKEYGEN=$TOP/bin/confgen/tsig-keygen
  RNDCCONFGEN=$TOP/bin/confgen/rndc-confgen
@@ -51,7 +51,7 @@ index b072af8..d2cb8ed 100644
  CHECKDS=$TOP/bin/python/dnssec-checkds
  COVERAGE=$TOP/bin/python/dnssec-coverage
  KEYMGR=$TOP/bin/python/dnssec-keymgr
-@@ -64,7 +65,7 @@ DNSTAPREAD=$TOP/bin/tools/dnstap-read
+@@ -71,7 +72,7 @@ DNSTAPREAD=$TOP/bin/tools/dnstap-read
  MDIG=$TOP/bin/tools/mdig
  NZD2NZF=$TOP/bin/tools/named-nzd2nzf
  FSTRM_CAPTURE=@FSTRM_CAPTURE@
diff --git a/bind-9.11-unit-dnstap-pkcs11.patch b/bind-9.11-unit-dnstap-pkcs11.patch
deleted file mode 100644
index 60cc1cd..0000000
--- a/bind-9.11-unit-dnstap-pkcs11.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From dca9eea70cb33062905aefc389266da931e9d0d6 Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Thu, 14 Mar 2019 15:48:37 +0100
-Subject: [PATCH] Set TZ again before dns library is initialized
-
-PKCS11 uses it, initializes TZ offset from dst init. Setting environment
-in test is too late since use of cmocka.
----
- lib/dns/tests/dnstap_test.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/lib/dns/tests/dnstap_test.c b/lib/dns/tests/dnstap_test.c
-index 22d6dc3..5a60b12 100644
---- a/lib/dns/tests/dnstap_test.c
-+++ b/lib/dns/tests/dnstap_test.c
-@@ -309,9 +309,6 @@ totext_test(void **state) {
- 
- 	UNUSED(state);
- 
--	/* make sure text conversion gets the right local time */
--	setenv("TZ", "PST8", 1);
--
- 	result = dns_dt_open(TAPSAVED, dns_dtmode_file, mctx, &handle);
- 	assert_int_equal(result, ISC_R_SUCCESS);
- 
-@@ -378,6 +375,9 @@ main(void) {
- 		cmocka_unit_test_setup_teardown(totext_test, _setup, _teardown),
- 	};
- 
-+	/* make sure text conversion gets the right local time */
-+	setenv("TZ", "PST8", 1);
-+
- 	return (cmocka_run_group_tests(tests, dns_test_init, dns_test_final));
- #else
- 	print_message("1..0 # Skip dnstap not enabled\n");
--- 
-2.20.1
-
diff --git a/bind-9.11-unit-timer-nothread.patch b/bind-9.11-unit-timer-nothread.patch
deleted file mode 100644
index f913724..0000000
--- a/bind-9.11-unit-timer-nothread.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From c88ba11ced1311e91a73ffdf42114ed14a805725 Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Thu, 14 Mar 2019 21:05:34 +0100
-Subject: [PATCH] Workaround to kyua bug
-
-Kyua 0.13 is not able to correctly handle whole test skipping.
-Make workaround to it, include skipping message.
----
- lib/isc/tests/timer_test.c | 11 +++++++++--
- 1 file changed, 9 insertions(+), 2 deletions(-)
-
-diff --git a/lib/isc/tests/timer_test.c b/lib/isc/tests/timer_test.c
-index f69f2b3..050cf6d 100644
---- a/lib/isc/tests/timer_test.c
-+++ b/lib/isc/tests/timer_test.c
-@@ -573,14 +573,13 @@ purge(void **state) {
- 
- int
- main(int argc, char **argv) {
--	const struct CMUnitTest tests[] = {
- #ifdef ISC_PLATFORM_USETHREADS
-+	const struct CMUnitTest tests[] = {
- 		cmocka_unit_test_setup_teardown(ticker, _setup, _teardown),
- 		cmocka_unit_test_setup_teardown(once_life, _setup, _teardown),
- 		cmocka_unit_test_setup_teardown(once_idle, _setup, _teardown),
- 		cmocka_unit_test_setup_teardown(reset, _setup, _teardown),
- 		cmocka_unit_test_setup_teardown(purge, _setup, _teardown),
--#endif
- 	};
- 	int c;
- 
-@@ -595,6 +594,14 @@ main(int argc, char **argv) {
- 	}
- 
- 	return (cmocka_run_group_tests(tests, NULL, NULL));
-+#else
-+	UNUSED(argc);
-+	UNUSED(argv);
-+	UNUSED(verbose);
-+
-+	printf("1..0 # Skipped: threads disabled\n");
-+	return (0);
-+#endif
- }
- 
- #else /* HAVE_CMOCKA */
--- 
-2.20.1
-
diff --git a/bind-9.3.2b1-fix_sdb_ldap.patch b/bind-9.3.2b1-fix_sdb_ldap.patch
index d027bb9..35c8542 100644
--- a/bind-9.3.2b1-fix_sdb_ldap.patch
+++ b/bind-9.3.2b1-fix_sdb_ldap.patch
@@ -36,10 +36,10 @@ index 95ab742..6069f09 100644
  	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zone2sqlite@EXEEXT@ ${DESTDIR}${sbindir}
  	${INSTALL_DATA} ${srcdir}/zone2ldap.1 ${DESTDIR}${mandir}/man1/zone2ldap.1
 diff --git a/bin/sdb_tools/zone2ldap.c b/bin/sdb_tools/zone2ldap.c
-index 23dd873..d56bc56 100644
+index aa2c711..76186b5 100644
 --- a/bin/sdb_tools/zone2ldap.c
 +++ b/bin/sdb_tools/zone2ldap.c
-@@ -65,6 +66,9 @@ ldap_info;
+@@ -66,6 +66,9 @@ ldap_info;
  /* usage Info */
  void usage (void);
  
@@ -49,7 +49,7 @@ index 23dd873..d56bc56 100644
  /* Add to the ldap dit */
  void add_ldap_values (ldap_info * ldinfo);
  
-@@ -81,7 +85,7 @@ char **hostname_to_dn_list (char *hostname, char *zone, unsigned int flags);
+@@ -82,7 +85,7 @@ char **hostname_to_dn_list (char *hostname, char *zone, unsigned int flags);
  int get_attr_list_size (char **tmp);
  
  /* Get a DN */
@@ -58,7 +58,7 @@ index 23dd873..d56bc56 100644
  
  /* Add to RR list */
  void add_to_rr_list (char *dn, char *name, char *type, char *data,
-@@ -103,11 +107,27 @@ void
+@@ -104,11 +107,27 @@ void
  init_ldap_conn ();
  void usage();
  
@@ -91,7 +91,7 @@ index 23dd873..d56bc56 100644
  LDAP *conn;
  unsigned int debug = 0;
  
-@@ -131,12 +151,12 @@ main (int argc, char **argv)
+@@ -132,12 +151,12 @@ main (int argc, char **argv)
    isc_result_t result;
    char *basedn;
    ldap_info *tmp;
@@ -107,7 +107,7 @@ index 23dd873..d56bc56 100644
    dns_fixedname_t fixedzone, fixedname;
    dns_rdataset_t rdataset;
    char **dc_list;
-@@ -149,7 +169,7 @@ main (int argc, char **argv)
+@@ -150,7 +169,7 @@ main (int argc, char **argv)
    extern char *optarg;
    extern int optind, opterr, optopt;
    int create_base = 0;
@@ -116,7 +116,7 @@ index 23dd873..d56bc56 100644
  
    if (argc < 2)
      {
-@@ -157,7 +177,7 @@ main (int argc, char **argv)
+@@ -158,7 +177,7 @@ main (int argc, char **argv)
        exit (-1);
      }
  
@@ -125,7 +125,7 @@ index 23dd873..d56bc56 100644
      {
        switch (topt)
  	{
-@@ -180,6 +200,9 @@ main (int argc, char **argv)
+@@ -181,6 +200,9 @@ main (int argc, char **argv)
  	  if (bindpw == NULL)
  	    fatal("strdup");
  	  break;
@@ -135,7 +135,7 @@ index 23dd873..d56bc56 100644
  	case 'b':
  	  ldapbase = strdup (optarg);
  	  if (ldapbase == NULL)
-@@ -301,27 +324,62 @@ main (int argc, char **argv)
+@@ -300,27 +322,62 @@ main (int argc, char **argv)
      {
        if (debug)
  	printf ("Creating base zone DN %s\n", argzone);
@@ -208,7 +208,7 @@ index 23dd873..d56bc56 100644
  		}
  	      else
  		{
-@@ -330,8 +388,13 @@ main (int argc, char **argv)
+@@ -329,8 +386,13 @@ main (int argc, char **argv)
  		  else
  		    sprintf (fullbasedn, "%s", ctmp);
  		}
@@ -222,7 +222,7 @@ index 23dd873..d56bc56 100644
  	    }
  
  	}
-@@ -409,14 +472,14 @@ generate_ldap (dns_name_t * dnsname, dns_rdata_t * rdata, unsigned int ttl)
+@@ -408,14 +470,14 @@ generate_ldap (dns_name_t * dnsname, dns_rdata_t * rdata, unsigned int ttl)
    isc_result_check (result, "dns_rdata_totext");
    data[isc_buffer_usedlength (&buff)] = 0;
  
@@ -240,7 +240,7 @@ index 23dd873..d56bc56 100644
  }
  
  
-@@ -456,7 +519,8 @@ add_to_rr_list (char *dn, char *name, char *type,
+@@ -455,7 +517,8 @@ add_to_rr_list (char *dn, char *name, char *type,
    int attrlist;
    char ldap_type_buffer[128];
    char charttl[64];
@@ -250,7 +250,7 @@ index 23dd873..d56bc56 100644
  
    if ((tmp = locate_by_dn (dn)) == NULL)
      {
-@@ -483,13 +547,13 @@ add_to_rr_list (char *dn, char *name, char *type,
+@@ -482,13 +545,13 @@ add_to_rr_list (char *dn, char *name, char *type,
  	    fatal("malloc");
  	}
        tmp->attrs[0]->mod_op = LDAP_MOD_ADD;
@@ -267,7 +267,7 @@ index 23dd873..d56bc56 100644
  	  tmp->attrs[1] = NULL;
  	  tmp->attrcnt = 2;
  	  tmp->next = ldap_info_base;
-@@ -498,7 +562,7 @@ add_to_rr_list (char *dn, char *name, char *type,
+@@ -497,7 +560,7 @@ add_to_rr_list (char *dn, char *name, char *type,
  	}
  
        tmp->attrs[1]->mod_op = LDAP_MOD_ADD;
@@ -276,7 +276,7 @@ index 23dd873..d56bc56 100644
        tmp->attrs[1]->mod_values = (char **) calloc (sizeof (char *), 2);
  
        if (tmp->attrs[1]->mod_values == (char **)NULL)
-@@ -527,7 +591,7 @@ add_to_rr_list (char *dn, char *name, char *type,
+@@ -526,7 +589,7 @@ add_to_rr_list (char *dn, char *name, char *type,
  	 fatal("strdup");
  
        tmp->attrs[3]->mod_op = LDAP_MOD_ADD;
@@ -285,7 +285,7 @@ index 23dd873..d56bc56 100644
        tmp->attrs[3]->mod_values = (char **) calloc (sizeof (char *), 2);
  
        if (tmp->attrs[3]->mod_values == (char **)NULL)
-@@ -540,14 +604,25 @@ add_to_rr_list (char *dn, char *name, char *type,
+@@ -539,14 +602,25 @@ add_to_rr_list (char *dn, char *name, char *type,
        if (tmp->attrs[3]->mod_values[0] == NULL)
  	 fatal("strdup");
  
@@ -313,7 +313,7 @@ index 23dd873..d56bc56 100644
        tmp->attrs[4]->mod_values[1] = NULL;
  
        tmp->attrs[5] = NULL;
-@@ -558,7 +633,7 @@ add_to_rr_list (char *dn, char *name, char *type,
+@@ -557,7 +631,7 @@ add_to_rr_list (char *dn, char *name, char *type,
    else
      {
  
@@ -322,7 +322,7 @@ index 23dd873..d56bc56 100644
  	{
  	  sprintf (ldap_type_buffer, "%sRecord", type);
  	  if (!strncmp
-@@ -632,44 +707,70 @@ char **
+@@ -631,44 +705,70 @@ char **
  hostname_to_dn_list (char *hostname, char *zone, unsigned int flags)
  {
    char *tmp;
@@ -430,7 +430,7 @@ index 23dd873..d56bc56 100644
    dn_buffer[i] = NULL;
  
    return dn_buffer;
-@@ -681,24 +782,32 @@ hostname_to_dn_list (char *hostname, char *zone, unsigned int flags)
+@@ -680,24 +780,32 @@ hostname_to_dn_list (char *hostname, char *zone, unsigned int flags)
   * exception of "@"/SOA. */
  
  char *
@@ -459,7 +459,7 @@ index 23dd873..d56bc56 100644
      if (flag == WI_SPEC)
      {
        if (x == (size - 2) && (strncmp (dc_list[x], "@", 1) == 0) && (ttl))
--	sprintf (tmp, "relativeDomainName=%s + dNSTTL=%d,", dc_list[x], ttl);
+-	sprintf (tmp, "relativeDomainName=%s + dNSTTL=%u,", dc_list[x], ttl);
 +	sprintf (tmp, "zoneName=%s + relativeDomainName=%s,", zone, dc_list[x]);
        else if (x == (size - 2))
 -	      sprintf(tmp, "relativeDomainName=%s,",dc_list[x]);
@@ -467,7 +467,7 @@ index 23dd873..d56bc56 100644
        else
  	      sprintf(tmp,"dc=%s,", dc_list[x]);
      }
-@@ -724,6 +833,7 @@ void
+@@ -723,6 +831,7 @@ void
  init_ldap_conn ()
  {
    int result;
@@ -475,7 +475,7 @@ index 23dd873..d56bc56 100644
    conn = ldap_open (ldapsystem, LDAP_PORT);
    if (conn == NULL)
      {
-@@ -733,7 +843,7 @@ init_ldap_conn ()
+@@ -732,7 +841,7 @@ init_ldap_conn ()
      }
  
    result = ldap_simple_bind_s (conn, binddn, bindpw);
@@ -484,7 +484,7 @@ index 23dd873..d56bc56 100644
  }
  
  /* Like isc_result_check, only for LDAP */
-@@ -750,8 +860,6 @@ ldap_result_check (const char *msg, char *dn, int err)
+@@ -749,8 +858,6 @@ ldap_result_check (const char *msg, char *dn, int err)
      }
  }
  
@@ -493,7 +493,7 @@ index 23dd873..d56bc56 100644
  /* For running the ldap_info run queue. */
  void
  add_ldap_values (ldap_info * ldinfo)
-@@ -759,14 +867,14 @@ add_ldap_values (ldap_info * ldinfo)
+@@ -758,14 +865,14 @@ add_ldap_values (ldap_info * ldinfo)
    int result;
    char dnbuffer[1024];
  
@@ -510,7 +510,7 @@ index 23dd873..d56bc56 100644
  }
  
  
-@@ -777,5 +885,5 @@ void
+@@ -776,5 +883,5 @@ void
  usage ()
  {
    fprintf (stderr,
diff --git a/bind.spec b/bind.spec
index d9b8314..26277cc 100644
--- a/bind.spec
+++ b/bind.spec
@@ -44,8 +44,8 @@
 #
 
 # lib*.so.X versions of selected libraries
-%global sover_dns 1105
-%global sover_isc 1100
+%global sover_dns 1106
+%global sover_isc 1102
 %global sover_irs 161
 %global sover_isccfg 163
 
@@ -135,13 +135,9 @@ Patch164:bind-9.11-rh1666814.patch
 Patch165:bind-9.11-rh1647829.patch
 # random_test fails too often by random, disable it
 Patch168:bind-9.11-unit-disable-random.patch
-Patch169:bind-9.11-feature-test-dlz.patch
 Patch170:bind-9.11-feature-test-named.patch
 Patch171:bind-9.11-tests-variants.patch
 Patch172:bind-9.11-tests-pkcs11.patch
-Patch173: bind-9.11-unit-dnstap-pkcs11.patch
-Patch174: bind-9.11-unit-timer-nothread.patch
-Patch175: bind-9.11-CVE-2018-5741-atomic.patch
 
 # SDB patches
 Patch11: bind-9.3.2b2-sdbsrc.patch
@@ -518,13 +514,9 @@ are used for building ISC DHCP.
 %patch164 -p1 -b .rh1666814
 %patch165 -p1 -b .rh1647829
 %patch168 -p1 -b .random_test-disable
-%patch169 -p1 -b .featuretest-dlz
 %patch170 -p1 -b .featuretest-named
 %patch171 -p1 -b .test-variant
 %patch172 -p1 -b .test-pkcs11
-%patch173 -p1 -b .unit-dnstap
-%patch174 -p1 -b .unit-timer
-%patch175 -p1 -b .CVE-2018-5741-atomic
 
 mkdir lib/dns/tests/testdata/dstrandom
 cp -a %{SOURCE50} lib/dns/tests/testdata/dstrandom/random.data

From 7729230caf2d6dd626a994e42a8987d542e7a3a4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 13 Jun 2019 22:39:01 +0200
Subject: [PATCH 027/460] Fix OpenSSL random generator initialization

Also fix warning in test.
---
 bind-9.11-rt46047.patch | 67 ++++++++++++++++++++++++++---------------
 bind.spec               |  5 ++-
 2 files changed, 46 insertions(+), 26 deletions(-)

diff --git a/bind-9.11-rt46047.patch b/bind-9.11-rt46047.patch
index c5725f7..4f8181d 100644
--- a/bind-9.11-rt46047.patch
+++ b/bind-9.11-rt46047.patch
@@ -1,4 +1,4 @@
-From 55e649d82a1adc5209738fb8402624f03287ca87 Mon Sep 17 00:00:00 2001
+From ab9ee91f596c14cfc55a67ba3523b42a54e3e244 Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Thu, 28 Sep 2017 10:09:22 -0700
 Subject: [PATCH] completed and corrected the crypto-random change
@@ -33,11 +33,11 @@ Subject: [PATCH] completed and corrected the crypto-random change
  bin/named/include/named/server.h         |  2 +
  bin/named/interfacemgr.c                 |  1 +
  bin/named/query.c                        |  1 +
- bin/named/server.c                       | 51 ++++++++++++++--------
+ bin/named/server.c                       | 52 ++++++++++++++--------
  bin/nsupdate/nsupdate.c                  |  4 +-
  bin/tests/system/pipelined/pipequeries.c |  4 +-
  bin/tests/system/tkey/keycreate.c        |  4 +-
- bin/tests/system/tkey/keydelete.c        |  4 +-
+ bin/tests/system/tkey/keydelete.c        |  5 +--
  doc/arm/Bv9ARM-book.xml                  | 55 +++++++++++++++++-------
  doc/arm/notes.xml                        | 31 +++++++++++++
  lib/dns/dst_api.c                        |  4 +-
@@ -46,7 +46,7 @@ Subject: [PATCH] completed and corrected the crypto-random change
  lib/isc/include/isc/entropy.h            | 50 +++++++++++++++------
  lib/isc/include/isc/random.h             | 28 +++++++-----
  lib/isccfg/namedconf.c                   |  2 +-
- 22 files changed, 225 insertions(+), 107 deletions(-)
+ 22 files changed, 228 insertions(+), 106 deletions(-)
 
 diff --git a/bin/confgen/keygen.c b/bin/confgen/keygen.c
 index 295e16f..0f79aa8 100644
@@ -76,10 +76,10 @@ index 295e16f..0f79aa8 100644
  							     &entropy_source,
  							     randomfile,
 diff --git a/bin/dnssec/dnssec-keygen.docbook b/bin/dnssec/dnssec-keygen.docbook
-index ee6a489..17dddb6 100644
+index 0ae6b41..4562430 100644
 --- a/bin/dnssec/dnssec-keygen.docbook
 +++ b/bin/dnssec/dnssec-keygen.docbook
-@@ -350,15 +350,23 @@
+@@ -348,15 +348,23 @@
  	<term>-r <replaceable class="parameter">randomdev</replaceable></term>
  	<listitem>
  	  <para>
@@ -140,10 +140,10 @@ index 31a99e7..38c83ed 100644
  					   usekeyboard);
  
 diff --git a/bin/named/client.c b/bin/named/client.c
-index ce24670..0ce02a9 100644
+index 29fecad..a12623a 100644
 --- a/bin/named/client.c
 +++ b/bin/named/client.c
-@@ -1754,7 +1754,8 @@ ns_client_addopt(ns_client_t *client, dns_message_t *message,
+@@ -1752,7 +1752,8 @@ ns_client_addopt(ns_client_t *client, dns_message_t *message,
  
  		isc_buffer_init(&buf, cookie, sizeof(cookie));
  		isc_stdtime_get(&now);
@@ -241,7 +241,7 @@ index f5ed2b7..b2c1d05 100644
  
  struct ns_altsecret {
 diff --git a/bin/named/interfacemgr.c b/bin/named/interfacemgr.c
-index d9f6df5..662eb6c 100644
+index 135533b..4546831 100644
 --- a/bin/named/interfacemgr.c
 +++ b/bin/named/interfacemgr.c
 @@ -17,6 +17,7 @@
@@ -253,7 +253,7 @@ index d9f6df5..662eb6c 100644
  #include <isc/task.h>
  #include <isc/util.h>
 diff --git a/bin/named/query.c b/bin/named/query.c
-index 1d3edbc..193efde 100644
+index f85cc76..43a3661 100644
 --- a/bin/named/query.c
 +++ b/bin/named/query.c
 @@ -19,6 +19,7 @@
@@ -265,10 +265,10 @@ index 1d3edbc..193efde 100644
  #include <isc/serial.h>
  #include <isc/stats.h>
 diff --git a/bin/named/server.c b/bin/named/server.c
-index 30e7eac..27ea3bf 100644
+index 405ff71..700f83d 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
-@@ -8203,21 +8203,30 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8203,21 +8203,32 @@ load_configuration(const char *filename, ns_server_t *server,
  	 * Open the source of entropy.
  	 */
  	if (first_time) {
@@ -304,12 +304,13 @@ index 30e7eac..27ea3bf 100644
 -				isc_entropy_usehook(ns_g_entropy, true);
 -#else
 -			int level = ISC_LOG_ERROR;
--			result = isc_entropy_createfilesource(ns_g_entropy,
+ 			result = isc_entropy_createfilesource(ns_g_entropy,
 -							      randomdev);
++			                                      randomdev);
  #ifdef PATH_RANDOMDEV
  			if (ns_g_fallbackentropy != NULL) {
  				level = ISC_LOG_INFO;
-@@ -8228,8 +8237,8 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8228,8 +8239,8 @@ load_configuration(const char *filename, ns_server_t *server,
  					      NS_LOGCATEGORY_GENERAL,
  					      NS_LOGMODULE_SERVER,
  					      level,
@@ -320,7 +321,7 @@ index 30e7eac..27ea3bf 100644
  					      randomdev,
  					      isc_result_totext(result));
  			}
-@@ -8249,7 +8258,6 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8249,7 +8260,6 @@ load_configuration(const char *filename, ns_server_t *server,
  				}
  				isc_entropy_detach(&ns_g_fallbackentropy);
  			}
@@ -328,7 +329,15 @@ index 30e7eac..27ea3bf 100644
  #endif
  		}
  	}
-@@ -9040,6 +9048,9 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
+@@ -9014,6 +9024,7 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
+ 	server->in_roothints = NULL;
+ 	server->blackholeacl = NULL;
+ 	server->keepresporder = NULL;
++	server->rngctx = NULL;
+ 
+ 	/* Must be first. */
+ 	CHECKFATAL(dst_lib_init2(ns_g_mctx, ns_g_entropy,
+@@ -9040,6 +9051,9 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
  	CHECKFATAL(dns_tkeyctx_create(ns_g_mctx, ns_g_entropy,
  				      &server->tkeyctx),
  		   "creating TKEY context");
@@ -338,7 +347,7 @@ index 30e7eac..27ea3bf 100644
  
  	/*
  	 * Setup the server task, which is responsible for coordinating
-@@ -9246,7 +9257,8 @@ ns_server_destroy(ns_server_t **serverp) {
+@@ -9246,7 +9260,8 @@ ns_server_destroy(ns_server_t **serverp) {
  
  	if (server->zonemgr != NULL)
  		dns_zonemgr_detach(&server->zonemgr);
@@ -348,7 +357,7 @@ index 30e7eac..27ea3bf 100644
  	if (server->tkeyctx != NULL)
  		dns_tkeyctx_destroy(&server->tkeyctx);
  
-@@ -13197,10 +13209,10 @@ newzone_cfgctx_destroy(void **cfgp) {
+@@ -13197,10 +13212,10 @@ newzone_cfgctx_destroy(void **cfgp) {
  
  static isc_result_t
  generate_salt(unsigned char *salt, size_t saltlen) {
@@ -361,7 +370,7 @@ index 30e7eac..27ea3bf 100644
  	} rnd;
  	unsigned char text[512 + 1];
  	isc_region_t r;
-@@ -13210,9 +13222,10 @@ generate_salt(unsigned char *salt, size_t saltlen) {
+@@ -13210,9 +13225,10 @@ generate_salt(unsigned char *salt, size_t saltlen) {
  	if (saltlen > 256U)
  		return (ISC_R_RANGE);
  
@@ -376,7 +385,7 @@ index 30e7eac..27ea3bf 100644
  	memmove(salt, rnd.rnd, saltlen);
  
 diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
-index 6d7a02e..626b1cf 100644
+index 0286987..0376377 100644
 --- a/bin/nsupdate/nsupdate.c
 +++ b/bin/nsupdate/nsupdate.c
 @@ -283,9 +283,7 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
@@ -421,10 +430,18 @@ index fe8698e..937fcc3 100644
  	}
  #endif
 diff --git a/bin/tests/system/tkey/keydelete.c b/bin/tests/system/tkey/keydelete.c
-index 2146f9b..ac2c311 100644
+index 2146f9b..64b8e74 100644
 --- a/bin/tests/system/tkey/keydelete.c
 +++ b/bin/tests/system/tkey/keydelete.c
-@@ -182,9 +182,7 @@ main(int argc, char **argv) {
+@@ -171,6 +171,7 @@ main(int argc, char **argv) {
+ 		randomfile = argv[2];
+ 		argv += 2;
+ 		argc -= 2;
++		POST(argc);
+ 	}
+ 	keyname = argv[1];
+ 
+@@ -182,9 +183,7 @@ main(int argc, char **argv) {
  	ectx = NULL;
  	RUNCHECK(isc_entropy_create(mctx, &ectx));
  #ifdef ISC_PLATFORM_CRYPTORANDOM
@@ -436,7 +453,7 @@ index 2146f9b..ac2c311 100644
  	}
  #endif
 diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
-index bb79723..888959c 100644
+index b40cb05..8a81438 100644
 --- a/doc/arm/Bv9ARM-book.xml
 +++ b/doc/arm/Bv9ARM-book.xml
 @@ -5071,22 +5071,45 @@ badresp:1,adberr:0,findfail:0,valfail:0]
@@ -502,10 +519,10 @@ index bb79723..888959c 100644
  	    </listitem>
  	  </varlistentry>
 diff --git a/doc/arm/notes.xml b/doc/arm/notes.xml
-index ba9a7cf..c0256f1 100644
+index 00ce8f1..527135a 100644
 --- a/doc/arm/notes.xml
 +++ b/doc/arm/notes.xml
-@@ -117,6 +117,37 @@
+@@ -124,6 +124,37 @@
      </itemizedlist>
    </section>
  
diff --git a/bind.spec b/bind.spec
index 26277cc..f7a6b6d 100644
--- a/bind.spec
+++ b/bind.spec
@@ -53,7 +53,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.11.6
-Release:  5%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1511,6 +1511,9 @@ fi;
 
 
 %changelog
+* Mon Jun 17 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.7-2
+- Fix OpenSSL random generator initialization
+
 * Mon May 06 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.6-5.P1
 - Fix also postun script
 

From d032099ab8edaef71d7a41e14a3e0df6acff56f9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 11 Jun 2019 14:56:08 +0200
Subject: [PATCH 028/460] Fix libisc so version

---
 bind.spec | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index f7a6b6d..737c418 100644
--- a/bind.spec
+++ b/bind.spec
@@ -45,7 +45,7 @@
 
 # lib*.so.X versions of selected libraries
 %global sover_dns 1106
-%global sover_isc 1102
+%global sover_isc 1100
 %global sover_irs 161
 %global sover_isccfg 163
 

From aea68014445fd1b2c75c3a9c63c03cf48f1fbdbc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 2 Jul 2019 11:10:03 +0200
Subject: [PATCH 029/460] Update to 9.11.8

Contains:
5244.	[security]	Fixed a race condition in dns_dispatch_getnext()
			that could cause an assertion failure if a
			significant number of incoming packets were
			rejected. (CVE-2019-6471) [GL #942]

5241.	[bug]		Fix Ed448 private and public key ASN.1 prefix blobs.
			[GL #225]

5237.	[bug]		Recurse to find the root server list with 'dig +trace'.
			[GL #1028]
---
 .gitignore                         |  1 +
 bind-9.10-dist-native-pkcs11.patch | 32 +++++++++++++++---------------
 bind-9.11.8.tar.gz.asc             | 16 +++++++++++++++
 bind.spec                          |  9 ++++++---
 sources                            |  2 +-
 5 files changed, 40 insertions(+), 20 deletions(-)
 create mode 100644 bind-9.11.8.tar.gz.asc

diff --git a/.gitignore b/.gitignore
index 9775b64..ecd31fd 100644
--- a/.gitignore
+++ b/.gitignore
@@ -92,3 +92,4 @@ bind-9.7.2b1.tar.gz
 /bind-9.11.5-P4.tar.gz
 /bind-9.11.6.tar.gz
 /bind-9.11.6-P1.tar.gz
+/bind-9.11.8.tar.gz
diff --git a/bind-9.10-dist-native-pkcs11.patch b/bind-9.10-dist-native-pkcs11.patch
index 65a2e83..9468850 100644
--- a/bind-9.10-dist-native-pkcs11.patch
+++ b/bind-9.10-dist-native-pkcs11.patch
@@ -300,10 +300,10 @@ index a058c91..d4b689a 100644
  DEPLIBS =	${ISCDEPLIBS}
  
 diff --git a/configure.ac b/configure.ac
-index 5e4e839..0ef2c8f 100644
+index d48fd51..79c96f8 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -1081,12 +1081,14 @@ AC_SUBST(USE_GSSAPI)
+@@ -1089,12 +1089,14 @@ AC_SUBST(USE_GSSAPI)
  AC_SUBST(DST_GSSAPI_INC)
  AC_SUBST(DNS_GSSAPI_LIBS)
  DNS_CRYPTO_LIBS="$DNS_GSSAPI_LIBS $DNS_CRYPTO_LIBS"
@@ -318,7 +318,7 @@ index 5e4e839..0ef2c8f 100644
  
  #
  # was --with-randomdev specified?
-@@ -1471,11 +1473,11 @@ fi
+@@ -1479,11 +1481,11 @@ fi
  AC_MSG_CHECKING(for OpenSSL library)
  OPENSSL_WARNING=
  openssldirs="/usr /usr/local /usr/local/ssl /usr/pkg /usr/sfw"
@@ -335,7 +335,7 @@ index 5e4e839..0ef2c8f 100644
  
  if test "auto" = "$use_openssl"
  then
-@@ -1488,6 +1490,7 @@ then
+@@ -1496,6 +1498,7 @@ then
  		fi
  	done
  fi
@@ -343,7 +343,7 @@ index 5e4e839..0ef2c8f 100644
  OPENSSL_ECDSA=""
  OPENSSL_GOST=""
  OPENSSL_ED25519=""
-@@ -1509,11 +1512,10 @@ case "$with_gost" in
+@@ -1517,11 +1520,10 @@ case "$with_gost" in
  		;;
  esac
  
@@ -358,7 +358,7 @@ index 5e4e839..0ef2c8f 100644
  		CRYPTOLIB="pkcs11"
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
-@@ -1523,7 +1525,9 @@ case "$use_openssl" in
+@@ -1531,7 +1533,9 @@ case "$use_openssl" in
  		OPENSSLGOSTLINKSRCS=""
  		OPENSSLLINKOBJS=""
  		OPENSSLLINKSRCS=""
@@ -369,7 +369,7 @@ index 5e4e839..0ef2c8f 100644
  	no)
  		AC_MSG_RESULT(no)
  		DST_OPENSSL_INC=""
-@@ -1555,7 +1559,7 @@ case "$use_openssl" in
+@@ -1563,7 +1567,7 @@ case "$use_openssl" in
  If you do not want OpenSSL, use --without-openssl])
  		;;
  	*)
@@ -378,7 +378,7 @@ index 5e4e839..0ef2c8f 100644
  		then
  			AC_MSG_RESULT()
  			AC_MSG_ERROR([OpenSSL and native PKCS11 cannot be used together.])
-@@ -1983,6 +1987,7 @@ AC_SUBST(OPENSSL_ED25519)
+@@ -1991,6 +1995,7 @@ AC_SUBST(OPENSSL_ED25519)
  AC_SUBST(OPENSSL_GOST)
  
  DNS_CRYPTO_LIBS="$DNS_CRYPTO_LIBS $DST_OPENSSL_LIBS"
@@ -386,7 +386,7 @@ index 5e4e839..0ef2c8f 100644
  
  ISC_PLATFORM_WANTAES="#undef ISC_PLATFORM_WANTAES"
  if test "yes" = "$with_aes"
-@@ -2306,6 +2311,7 @@ esac
+@@ -2314,6 +2319,7 @@ esac
  AC_SUBST(PKCS11LINKOBJS)
  AC_SUBST(PKCS11LINKSRCS)
  AC_SUBST(CRYPTO)
@@ -394,7 +394,7 @@ index 5e4e839..0ef2c8f 100644
  AC_SUBST(PKCS11_ECDSA)
  AC_SUBST(PKCS11_GOST)
  AC_SUBST(PKCS11_ED25519)
-@@ -5428,8 +5434,11 @@ AC_CONFIG_FILES([
+@@ -5441,8 +5447,11 @@ AC_CONFIG_FILES([
  	bin/delv/Makefile
  	bin/dig/Makefile
  	bin/dnssec/Makefile
@@ -406,7 +406,7 @@ index 5e4e839..0ef2c8f 100644
  	bin/nsupdate/Makefile
  	bin/pkcs11/Makefile
  	bin/python/Makefile
-@@ -5502,6 +5511,10 @@ AC_CONFIG_FILES([
+@@ -5515,6 +5524,10 @@ AC_CONFIG_FILES([
  	lib/dns/include/dns/Makefile
  	lib/dns/include/dst/Makefile
  	lib/dns/tests/Makefile
@@ -417,7 +417,7 @@ index 5e4e839..0ef2c8f 100644
  	lib/irs/Makefile
  	lib/irs/include/Makefile
  	lib/irs/include/irs/Makefile
-@@ -5526,6 +5539,24 @@ AC_CONFIG_FILES([
+@@ -5539,6 +5552,24 @@ AC_CONFIG_FILES([
  	lib/isc/unix/include/Makefile
  	lib/isc/unix/include/isc/Makefile
  	lib/isc/unix/include/pkcs11/Makefile
@@ -456,7 +456,7 @@ index 81270a0..bcb5312 100644
  
  @BIND9_MAKE_RULES@
 diff --git a/lib/dns-pkcs11/Makefile.in b/lib/dns-pkcs11/Makefile.in
-index 56dd259..f9aa782 100644
+index f6868d1..ea6fd36 100644
 --- a/lib/dns-pkcs11/Makefile.in
 +++ b/lib/dns-pkcs11/Makefile.in
 @@ -26,16 +26,16 @@ VERSION=@BIND9_VERSION@
@@ -501,9 +501,9 @@ index 56dd259..f9aa782 100644
  
  include: gen
  	${MAKE} include/dns/enumtype.h
-@@ -183,22 +183,22 @@ gen: gen.c
- 	${BUILD_CC} ${BUILD_CFLAGS} -I${top_srcdir}/lib/isc/include \
- 	${BUILD_CPPFLAGS} ${BUILD_LDFLAGS} -o $@ ${srcdir}/gen.c ${BUILD_LIBS}
+@@ -185,22 +185,22 @@ gen: gen.c
+ 	${BUILD_CPPFLAGS} ${BUILD_LDFLAGS} -o $@ ${srcdir}/gen.c \
+ 	${BUILD_LIBS} ${LFS_LIBS}
  
 -timestamp: include libdns.@A@
 +timestamp: include libdns-pkcs11.@A@
diff --git a/bind-9.11.8.tar.gz.asc b/bind-9.11.8.tar.gz.asc
new file mode 100644
index 0000000..fb0ac3b
--- /dev/null
+++ b/bind-9.11.8.tar.gz.asc
@@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABAgAdFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAlz45qgACgkQdLtrmky7
+PThZoxAAuqUxL9JV1NsvODkJ049F8hRrrzhN8Vgx19D/w6oLWawaHuOahU67RYWh
+OGa3D72G0mClVFBABTV9YiAwkNnbkq3Nkclh6riWDjAO3RPKMo50yiAhLKSt2Z4N
+i0dMSIzZb8T9nq19T9JI1loyEG3oU+I97uWLyzrLe2WqCpSmdCTNd8PsD/0r+MxV
+QnBt1RFHda4z7r0fYLMw5oALXiNttPg6JdKByssgmYB6DYYw4f9ywMj1e8Jnn307
+6BXMweF0uOpGgy18HzgdfSjMNc3g9WKU86gTyAblAd1HALtdwe/VKgH1ZVJZoflT
+QnxzJDDjNbKE5OP7TOgzN9pLPCGwvQhpHDqGTTn+cTj5h9pQZcfq0vQQJ+MGzFWF
+kj0TUeLYs9FNnJt91Rpk+T96sOUypOrpPM9RdAEKp38qSMmZN8DJ83sga2b1OCqr
+zIcuQOBuXlKu9uD9g2cTquGGSG0vGvVSx0OXogUYEPS635AZbyZ9IqSntlDE+cnS
+mJt7jCQv+DVFVDUiyfLcdmPZk0U88hHdruKTbN3dc+a+OMddukPM4AepLKgdAWkQ
+F9et7SJ5VeiGiHgIwJaeu04VhD4DuQILo6xx7wxJIiPQ8H1sazdrikcn70hxMQwB
+yq1tBfQHTUfHmZBCytMVRR3sEQscv/7MBEhS9DXmNRYfIXrXKIE=
+=j1R3
+-----END PGP SIGNATURE-----
diff --git a/bind.spec b/bind.spec
index 737c418..6d3ac25 100644
--- a/bind.spec
+++ b/bind.spec
@@ -2,7 +2,7 @@
 # Red Hat BIND package .spec file
 #
 
-%global PATCHVER P1
+#%%global PATCHVER P1
 #%%global PREVER rc1
 %global BINDVERSION %{version}%{?PREVER}%{?PATCHVER:-%{PATCHVER}}
 
@@ -52,8 +52,8 @@
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.11.6
-Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Version:  9.11.8
+Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1511,6 +1511,9 @@ fi;
 
 
 %changelog
+* Tue Jul 02 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.8-1
+- Update to 9.11.8
+
 * Mon Jun 17 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.7-2
 - Fix OpenSSL random generator initialization
 
diff --git a/sources b/sources
index 413be45..a8b7813 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.11.6-P1.tar.gz) = 419aeeddeab7aef818b9043db7b21a847993444f663dca04e58ee97a0ebee0610cbc5a9422d17a6f0ee5d44598a2cbb5651e3b4e8c56708eaf923dca0a5c4c03
+SHA512 (bind-9.11.8.tar.gz) = 0192d6e087cdbdebec171869d908c4326c2575d65ee5367a78ed9da26de357e017b0306349d66a6016a7ec80ad27f5f7f9f2db25002c6d0c78589dc473a015fc
 SHA512 (config-19.tar.bz2) = 36aa38a0c7c33267ae594b31c81681290ac58dde7ca6749bd599da531380b5b1428330813dbe983e01071ccaed83e83f6a9cd92179a53b7d0ccbb6851a0b017c

From cf411e66ff9261ad2c1d049c776f3131a01893b9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 24 Jul 2019 17:30:34 +0200
Subject: [PATCH 030/460] Use monotonic time in export library (#1732883)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Petr Menšík <pemensik@redhat.com>
---
 bind-9.11-rh1732883.patch | 202 ++++++++++++++++++++++++++++++++++++++
 bind.spec                 |   7 +-
 2 files changed, 208 insertions(+), 1 deletion(-)
 create mode 100644 bind-9.11-rh1732883.patch

diff --git a/bind-9.11-rh1732883.patch b/bind-9.11-rh1732883.patch
new file mode 100644
index 0000000..b312e63
--- /dev/null
+++ b/bind-9.11-rh1732883.patch
@@ -0,0 +1,202 @@
+From 9ac315c16bf8441145f5b4b8a3308ae9f03582ab Mon Sep 17 00:00:00 2001
+From: Pavel Zhukov <pzhukov@redhat.com>
+Date: Wed, 24 Jul 2019 17:15:55 +0200
+Subject: [PATCH] Detect system time jumps
+
+In case if system time was changed backward it's possible to have ip
+address dropped by the kernel due to lifetime expirity. Try to detect
+this situation using either monotonic time or saved timestamp and execute
+go_reboot() procedure to request lease extention
+---
+ lib/isc/include/isc/result.h    |  4 ++--
+ lib/isc/include/isc/util.h      |  4 ++++
+ lib/isc/result.c                |  2 ++
+ lib/isc/unix/app.c              | 41 +++++++++++++++++++++++++++++++--
+ lib/isc/unix/include/isc/time.h | 20 ++++++++++++++++
+ lib/isc/unix/time.c             | 22 ++++++++++++++++++
+ 6 files changed, 89 insertions(+), 4 deletions(-)
+
+diff --git a/lib/isc/include/isc/result.h b/lib/isc/include/isc/result.h
+index 246aefb..70d4b64 100644
+--- a/lib/isc/include/isc/result.h
++++ b/lib/isc/include/isc/result.h
+@@ -83,9 +83,9 @@
+ #define ISC_R_UNSET			61	/*%< unset */
+ #define ISC_R_MULTIPLE			62	/*%< multiple */
+ #define ISC_R_WOULDBLOCK		63	/*%< would block */
+-
++#define ISC_R_TIMESHIFTED               64      /*%< system time changed */
+ /*% Not a result code: the number of results. */
+-#define ISC_R_NRESULTS 			64
++#define ISC_R_NRESULTS 			65
+ 
+ ISC_LANG_BEGINDECLS
+ 
+diff --git a/lib/isc/include/isc/util.h b/lib/isc/include/isc/util.h
+index 332dc0c..f81967d 100644
+--- a/lib/isc/include/isc/util.h
++++ b/lib/isc/include/isc/util.h
+@@ -233,6 +233,10 @@
+  * Time
+  */
+ #define TIME_NOW(tp) 	RUNTIME_CHECK(isc_time_now((tp)) == ISC_R_SUCCESS)
++#ifdef CLOCK_BOOTTIME
++#define TIME_MONOTONIC(tp) 	RUNTIME_CHECK(isc_time_boottime((tp)) == ISC_R_SUCCESS)
++#endif
++
+ 
+ /*%
+  * Misc
+diff --git a/lib/isc/result.c b/lib/isc/result.c
+index a707c32..6776fc6 100644
+--- a/lib/isc/result.c
++++ b/lib/isc/result.c
+@@ -99,6 +99,7 @@ static const char *description[ISC_R_NRESULTS] = {
+ 	"unset",				/*%< 61 */
+ 	"multiple",				/*%< 62 */
+ 	"would block",				/*%< 63 */
++        "time changed",                         /*%< 64 */
+ };
+ 
+ static const char *identifier[ISC_R_NRESULTS] = {
+@@ -166,6 +167,7 @@ static const char *identifier[ISC_R_NRESULTS] = {
+ 	"ISC_R_UNSET",
+ 	"ISC_R_MULTIPLE",
+ 	"ISC_R_WOULDBLOCK",
++        "ISC_R_TIMESHIFTED",
+ };
+ 
+ #define ISC_RESULT_RESULTSET			2
+diff --git a/lib/isc/unix/app.c b/lib/isc/unix/app.c
+index bace2bd..e9814d2 100644
+--- a/lib/isc/unix/app.c
++++ b/lib/isc/unix/app.c
+@@ -441,15 +441,51 @@ isc__app_ctxonrun(isc_appctx_t *ctx0, isc_mem_t *mctx, isc_task_t *task,
+ static isc_result_t
+ evloop(isc__appctx_t *ctx) {
+ 	isc_result_t result;
++        isc_time_t now;
++#ifdef CLOCK_BOOTTIME
++        isc_time_t monotonic;
++        isc_uint64_t diff  = 0;
++#else
++        isc_time_t prev;
++        TIME_NOW(&prev);
++#endif
++
++
++
+ 
+ 	while (!ctx->want_shutdown) {
+ 		int n;
+-		isc_time_t when, now;
++		isc_time_t when;
++                
+ 		struct timeval tv, *tvp;
+ 		isc_socketwait_t *swait;
+ 		isc_boolean_t readytasks;
+ 		isc_boolean_t call_timer_dispatch = ISC_FALSE;
+ 
++                isc_uint64_t us; 
++
++#ifdef CLOCK_BOOTTIME
++                // TBD macros for following three lines
++                TIME_NOW(&now);
++                TIME_MONOTONIC(&monotonic);
++                INSIST(now.seconds > monotonic.seconds)
++                us = isc_time_microdiff (&now, &monotonic);
++                if (us < diff){ 
++                  us = diff - us;
++                  if (us > 1000000){ // ignoring shifts less than one second
++                    return ISC_R_TIMESHIFTED;
++                  };
++                  diff = isc_time_microdiff (&now, &monotonic);
++                } else {
++                  diff = isc_time_microdiff (&now, &monotonic);
++                  // not implemented
++                }
++#else
++                TIME_NOW(&now);
++                if (isc_time_compare (&now, &prev) < 0)
++                  return ISC_R_TIMESHIFTED;
++                TIME_NOW(&prev);
++#endif                
+ 		/*
+ 		 * Check the reload (or suspend) case first for exiting the
+ 		 * loop as fast as possible in case:
+@@ -474,9 +510,10 @@ evloop(isc__appctx_t *ctx) {
+ 			if (result != ISC_R_SUCCESS)
+ 				tvp = NULL;
+ 			else {
+-				isc_uint64_t us;
++
+ 
+ 				TIME_NOW(&now);
++
+ 				us = isc_time_microdiff(&when, &now);
+ 				if (us == 0)
+ 					call_timer_dispatch = ISC_TRUE;
+diff --git a/lib/isc/unix/include/isc/time.h b/lib/isc/unix/include/isc/time.h
+index 75e24b9..de8b399 100644
+--- a/lib/isc/unix/include/isc/time.h
++++ b/lib/isc/unix/include/isc/time.h
+@@ -129,6 +129,26 @@ isc_time_isepoch(const isc_time_t *t);
+  *\li	't' is a valid pointer.
+  */
+ 
++#ifdef CLOCK_BOOTTIME
++isc_result_t
++isc_time_boottime(isc_time_t *t);
++/*%<
++ * Set 't' to monotonic time from previous boot
++ * it's not affected by system time change. It also
++ * includes the time system was suspended
++ *
++ * Requires:
++ *\li	't' is a valid pointer.
++ *
++ * Returns:
++ *
++ *\li	Success
++ *\li	Unexpected error
++ *		Getting the time from the system failed.
++ */
++#endif /* CLOCK_BOOTTIME */
++ 
++
+ isc_result_t
+ isc_time_now(isc_time_t *t);
+ /*%<
+diff --git a/lib/isc/unix/time.c b/lib/isc/unix/time.c
+index 2210240..d7613b8 100644
+--- a/lib/isc/unix/time.c
++++ b/lib/isc/unix/time.c
+@@ -496,3 +496,25 @@ isc_time_formatISO8601ms(const isc_time_t *t, char *buf, unsigned int len) {
+ 			 t->nanoseconds / NS_PER_MS);
+ 	}
+ }
++
++
++#ifdef CLOCK_BOOTTIME
++isc_result_t
++isc_time_boottime(isc_time_t *t) {
++  struct timespec ts;
++  
++  char strbuf[ISC_STRERRORSIZE];
++
++  if (clock_gettime (CLOCK_BOOTTIME, &ts) != 0){
++    isc__strerror(errno, strbuf, sizeof(strbuf));
++    UNEXPECTED_ERROR(__FILE__, __LINE__, "%s", strbuf);
++    return (ISC_R_UNEXPECTED);    
++  }
++
++  t->seconds = ts.tv_sec;
++  t->nanoseconds = ts.tv_nsec;
++
++  return (ISC_R_SUCCESS);
++  
++};
++#endif
+-- 
+2.20.1
+
diff --git a/bind.spec b/bind.spec
index 6d3ac25..f15db2b 100644
--- a/bind.spec
+++ b/bind.spec
@@ -53,7 +53,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.11.8
-Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -138,6 +138,7 @@ Patch168:bind-9.11-unit-disable-random.patch
 Patch170:bind-9.11-feature-test-named.patch
 Patch171:bind-9.11-tests-variants.patch
 Patch172:bind-9.11-tests-pkcs11.patch
+Patch173:bind-9.11-rh1732883.patch
 
 # SDB patches
 Patch11: bind-9.3.2b2-sdbsrc.patch
@@ -517,6 +518,7 @@ are used for building ISC DHCP.
 %patch170 -p1 -b .featuretest-named
 %patch171 -p1 -b .test-variant
 %patch172 -p1 -b .test-pkcs11
+%patch173 -p1 -b .rh1732883
 
 mkdir lib/dns/tests/testdata/dstrandom
 cp -a %{SOURCE50} lib/dns/tests/testdata/dstrandom/random.data
@@ -1511,6 +1513,9 @@ fi;
 
 
 %changelog
+* Wed Jul 24 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.8-2
+- Use monotonic time in export library (#1732883)
+
 * Tue Jul 02 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.8-1
 - Update to 9.11.8
 

From 3a67af20ad1be7cce7ef6d80a66daae2fa8d3f52 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Wed, 24 Jul 2019 19:16:14 +0000
Subject: [PATCH 031/460] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
---
 bind.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index fb4337c..a2bc402 100644
--- a/bind.spec
+++ b/bind.spec
@@ -53,7 +53,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.11.8
-Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1511,6 +1511,9 @@ fi;
 
 
 %changelog
+* Wed Jul 24 2019 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.11.8-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
+
 * Tue Jul 02 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.8-1
 - Update to 9.11.8
 

From 30676f9c5fe7c07429609e42f11ca32261f72b2a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 24 Jul 2019 17:37:04 +0200
Subject: [PATCH 032/460] Update to 9.11.9

---
 .gitignore             |  1 +
 bind-9.11.8.tar.gz.asc | 16 ----------------
 bind-9.11.9.tar.gz.asc | 16 ++++++++++++++++
 bind.spec              |  7 +++++--
 sources                |  2 +-
 5 files changed, 23 insertions(+), 19 deletions(-)
 delete mode 100644 bind-9.11.8.tar.gz.asc
 create mode 100644 bind-9.11.9.tar.gz.asc

diff --git a/.gitignore b/.gitignore
index ecd31fd..08ffa36 100644
--- a/.gitignore
+++ b/.gitignore
@@ -93,3 +93,4 @@ bind-9.7.2b1.tar.gz
 /bind-9.11.6.tar.gz
 /bind-9.11.6-P1.tar.gz
 /bind-9.11.8.tar.gz
+/bind-9.11.9.tar.gz
diff --git a/bind-9.11.8.tar.gz.asc b/bind-9.11.8.tar.gz.asc
deleted file mode 100644
index fb0ac3b..0000000
--- a/bind-9.11.8.tar.gz.asc
+++ /dev/null
@@ -1,16 +0,0 @@
------BEGIN PGP SIGNATURE-----
-
-iQIzBAABAgAdFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAlz45qgACgkQdLtrmky7
-PThZoxAAuqUxL9JV1NsvODkJ049F8hRrrzhN8Vgx19D/w6oLWawaHuOahU67RYWh
-OGa3D72G0mClVFBABTV9YiAwkNnbkq3Nkclh6riWDjAO3RPKMo50yiAhLKSt2Z4N
-i0dMSIzZb8T9nq19T9JI1loyEG3oU+I97uWLyzrLe2WqCpSmdCTNd8PsD/0r+MxV
-QnBt1RFHda4z7r0fYLMw5oALXiNttPg6JdKByssgmYB6DYYw4f9ywMj1e8Jnn307
-6BXMweF0uOpGgy18HzgdfSjMNc3g9WKU86gTyAblAd1HALtdwe/VKgH1ZVJZoflT
-QnxzJDDjNbKE5OP7TOgzN9pLPCGwvQhpHDqGTTn+cTj5h9pQZcfq0vQQJ+MGzFWF
-kj0TUeLYs9FNnJt91Rpk+T96sOUypOrpPM9RdAEKp38qSMmZN8DJ83sga2b1OCqr
-zIcuQOBuXlKu9uD9g2cTquGGSG0vGvVSx0OXogUYEPS635AZbyZ9IqSntlDE+cnS
-mJt7jCQv+DVFVDUiyfLcdmPZk0U88hHdruKTbN3dc+a+OMddukPM4AepLKgdAWkQ
-F9et7SJ5VeiGiHgIwJaeu04VhD4DuQILo6xx7wxJIiPQ8H1sazdrikcn70hxMQwB
-yq1tBfQHTUfHmZBCytMVRR3sEQscv/7MBEhS9DXmNRYfIXrXKIE=
-=j1R3
------END PGP SIGNATURE-----
diff --git a/bind-9.11.9.tar.gz.asc b/bind-9.11.9.tar.gz.asc
new file mode 100644
index 0000000..9e9ad71
--- /dev/null
+++ b/bind-9.11.9.tar.gz.asc
@@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABAgAdFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAl0u4wIACgkQdLtrmky7
+PTgO+A/8DtA5xbbJZx6ifx/AXS+0TBwnyRt1qkDplCRMq4/G+/r9iHh2Z3JYiznV
+NKHkV7JV+d4p9pygOo0s563DsFTg3A6OtzhU7n8QxFS4e3T6S+vKBX1s0Iixu/hN
+q9pxhhefeGejVUjhKqAHbNvoCO2stMAgZi02qhqECJPvu8YtyOPEPNW/K+2aWLH3
+P3gNwIbj1+NjNBWAAhiSEK+px7do4499AxGOZcCPUUmhEAWckcQ1wyC94tDC3uQi
+XY3asr6Ph7WWXkM0qnUDx9+ZPKKDOMevX11W+5cNw1qioss8dWcs3l7mhUuRITVx
+u/yaQYt7F9BY5XjtbaBtTWBDRbpCrrt2YpMhNJ/aedSbCoRT/ZYiDqNwKCEes10s
+hJK4LG4pCtVWQnwi4xFeCxI+NJK5b5gRj5NZ/cwKqGMnEmO0hg3aiDtEUF424t1i
+IdJvDs+NaMjHqitpvc8hlJpTpiefCuGTYjrrJLjnAsA3r72z4aLb8M6ivBNmpEiJ
+x5LFyBZusHzuCSfFV23tBZvZ1VQf53Netz0PXbOCdnKKYlibUGzD3pC8LdoMoj5m
+/s4BYes5ET4xA867yZg7y/A0x0Ezuw+7NLXhpMSAQh/OZwWQ1CzspvYUxl8hHx67
+r1aH0dkAtN8BtaR5lTrXtFfRTJvEqNQ9lFQwljwEJqfwFN4dJBc=
+=m4su
+-----END PGP SIGNATURE-----
diff --git a/bind.spec b/bind.spec
index f15db2b..1819d65 100644
--- a/bind.spec
+++ b/bind.spec
@@ -52,8 +52,8 @@
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.11.8
-Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Version:  9.11.9
+Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1513,6 +1513,9 @@ fi;
 
 
 %changelog
+* Wed Jul 24 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.9-1
+- Update to 9.11.9
+
 * Wed Jul 24 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.8-2
 - Use monotonic time in export library (#1732883)
 
diff --git a/sources b/sources
index a8b7813..78dba7f 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.11.8.tar.gz) = 0192d6e087cdbdebec171869d908c4326c2575d65ee5367a78ed9da26de357e017b0306349d66a6016a7ec80ad27f5f7f9f2db25002c6d0c78589dc473a015fc
+SHA512 (bind-9.11.9.tar.gz) = 4fa975b83986480a12138a3cf7ccf3bcd2251d194e0c04e3fad0787fc8b2a5dee241179fbb25b0283fa6fcb749d7a15fad036039dbc81250defcba0108823ef8
 SHA512 (config-19.tar.bz2) = 36aa38a0c7c33267ae594b31c81681290ac58dde7ca6749bd599da531380b5b1428330813dbe983e01071ccaed83e83f6a9cd92179a53b7d0ccbb6851a0b017c

From af22b4c83676f722a3a0fd34734e30c548bfd1ee Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 24 Jul 2019 19:05:06 +0200
Subject: [PATCH 033/460] Update patches to 9.11.9

Maxmind library and defines modifies many patches changing flags.
Conflicts a lot especially with PKCS11 build.
---
 bind-9.10-dist-native-pkcs11.patch | 107 ++++++++++++-------------
 bind-9.10-sdb.patch                |  45 +++++------
 bind-9.11-feature-test-named.patch |  16 ++--
 bind-9.11-fips-tests.patch         |  14 ++--
 bind-9.11-kyua-pkcs11.patch        |  12 +--
 bind-9.11-rh1732883.patch          |  96 +++++++++++------------
 bind-9.11-rt31459.patch            | 120 ++++++++++++++---------------
 7 files changed, 200 insertions(+), 210 deletions(-)

diff --git a/bind-9.10-dist-native-pkcs11.patch b/bind-9.10-dist-native-pkcs11.patch
index 9468850..0ba7ccc 100644
--- a/bind-9.10-dist-native-pkcs11.patch
+++ b/bind-9.10-dist-native-pkcs11.patch
@@ -14,10 +14,10 @@ index f0c504a..ce7a2da 100644
  
  @BIND9_MAKE_RULES@
 diff --git a/bin/dnssec-pkcs11/Makefile.in b/bin/dnssec-pkcs11/Makefile.in
-index ce0a177..8908a45 100644
+index 4b8ca13..32f4470 100644
 --- a/bin/dnssec-pkcs11/Makefile.in
 +++ b/bin/dnssec-pkcs11/Makefile.in
-@@ -17,18 +17,18 @@ VERSION=@BIND9_VERSION@
+@@ -15,18 +15,18 @@ VERSION=@BIND9_VERSION@
  
  @BIND9_MAKE_INCLUDES@
  
@@ -30,10 +30,10 @@ index ce0a177..8908a45 100644
 +		@CRYPTO_PK11@ -DPK11_LIB_LOCATION=\"@PKCS11_PROVIDER@\"
  CWARNINGS =
  
--DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
+-DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
 -ISCLIBS =	../../lib/isc/libisc.@A@
 -ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@
-+DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ @DNS_CRYPTO_LIBS@
++DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
 +ISCLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
 +ISCNOSYMLIBS =	../../lib/isc-pkcs11/libisc-pkcs11-nosymtbl.@A@
  
@@ -44,7 +44,7 @@ index ce0a177..8908a45 100644
  
  DEPLIBS =	${DNSDEPLIBS} ${ISCDEPLIBS}
  
-@@ -37,10 +37,10 @@ LIBS =		${DNSLIBS} ${ISCLIBS} @LIBS@
+@@ -35,10 +35,10 @@ LIBS =		${DNSLIBS} ${ISCLIBS} @LIBS@
  NOSYMLIBS =	${DNSLIBS} ${ISCNOSYMLIBS} @LIBS@
  
  # Alphabetically
@@ -59,7 +59,7 @@ index ce0a177..8908a45 100644
  
  OBJS =		dnssectool.@O@
  
-@@ -61,15 +61,15 @@ MANOBJS =	${MANPAGES} ${HTMLPAGES}
+@@ -59,15 +59,15 @@ MANOBJS =	${MANPAGES} ${HTMLPAGES}
  
  @BIND9_MAKE_RULES@
  
@@ -78,7 +78,7 @@ index ce0a177..8908a45 100644
  	export BASEOBJS="dnssec-keygen.@O@ ${OBJS}"; \
  	${FINALBUILDCMD}
  
-@@ -77,7 +77,7 @@ dnssec-signzone.@O@: dnssec-signzone.c
+@@ -75,7 +75,7 @@ dnssec-signzone.@O@: dnssec-signzone.c
  	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} -DVERSION=\"${VERSION}\" \
  		-c ${srcdir}/dnssec-signzone.c
  
@@ -87,7 +87,7 @@ index ce0a177..8908a45 100644
  	export BASEOBJS="dnssec-signzone.@O@ ${OBJS}"; \
  	${FINALBUILDCMD}
  
-@@ -85,19 +85,19 @@ dnssec-verify.@O@: dnssec-verify.c
+@@ -83,19 +83,19 @@ dnssec-verify.@O@: dnssec-verify.c
  	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} -DVERSION=\"${VERSION}\" \
  		-c ${srcdir}/dnssec-verify.c
  
@@ -111,7 +111,7 @@ index ce0a177..8908a45 100644
  	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \
  	dnssec-importkey.@O@ ${OBJS} ${LIBS}
  
-@@ -108,16 +108,14 @@ docclean manclean maintainer-clean::
+@@ -106,16 +106,14 @@ docclean manclean maintainer-clean::
  
  installdirs:
  	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
@@ -130,10 +130,10 @@ index ce0a177..8908a45 100644
  
  clean distclean::
 diff --git a/bin/dnssec/Makefile.in b/bin/dnssec/Makefile.in
-index ce0a177..7cede84 100644
+index 4b8ca13..4175996 100644
 --- a/bin/dnssec/Makefile.in
 +++ b/bin/dnssec/Makefile.in
-@@ -19,7 +19,7 @@ VERSION=@BIND9_VERSION@
+@@ -17,7 +17,7 @@ VERSION=@BIND9_VERSION@
  
  CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} @DST_OPENSSL_INC@
  
@@ -143,44 +143,46 @@ index ce0a177..7cede84 100644
  CWARNINGS =
  
 diff --git a/bin/named-pkcs11/Makefile.in b/bin/named-pkcs11/Makefile.in
-index c0861f6..df80f81 100644
+index df1f7ee..f397ab0 100644
 --- a/bin/named-pkcs11/Makefile.in
 +++ b/bin/named-pkcs11/Makefile.in
-@@ -43,26 +43,26 @@ DLZDRIVER_INCLUDES =	@DLZ_DRIVER_INCLUDES@
+@@ -43,27 +43,28 @@ DLZDRIVER_INCLUDES =	@DLZ_DRIVER_INCLUDES@
  DLZDRIVER_LIBS =	@DLZ_DRIVER_LIBS@
  
  CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
 -		${LWRES_INCLUDES} ${DNS_INCLUDES} ${BIND9_INCLUDES} \
 -		${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} ${ISC_INCLUDES} \
-+        ${LWRES_INCLUDES} ${DNS_PKCS11_INCLUDES} ${BIND9_INCLUDES} \
-+        ${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} ${ISC_PKCS11_INCLUDES} \
- 		${DLZDRIVER_INCLUDES} ${DBDRIVER_INCLUDES} @DST_OPENSSL_INC@
++		${LWRES_INCLUDES} ${DNS_PKCS11_INCLUDES} ${BIND9_INCLUDES} \
++		${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} ${ISC_PKCS11_INCLUDES} \
+ 		${DLZDRIVER_INCLUDES} ${DBDRIVER_INCLUDES} ${MAXMINDDB_CFLAGS} \
+ 		@DST_OPENSSL_INC@
  
 -CDEFINES =      @CONTRIB_DLZ@ @USE_PKCS11@ @PKCS11_ENGINE@ @CRYPTO@
 +CDEFINES =      @USE_PKCS11@ @PKCS11_ENGINE@ @CRYPTO_PK11@
  
  CWARNINGS =
  
--DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
-+DNSLIBS =  ../../lib/dns-pkcs11/libdns-pkcs11.@A@ @DNS_CRYPTO_LIBS@
+ DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
++DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
  ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
  ISCCCLIBS =	../../lib/isccc/libisccc.@A@
 -ISCLIBS =	../../lib/isc/libisc.@A@
-+ISCLIBS =  ../../lib/isc-pkcs11/libisc-pkcs11.@A@
- ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@
+-ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@
++ISCLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
++ISCNOSYMLIBS =	../../lib/isc-pkcs11/libisc-pkcs11-nosymtbl.@A@
  LWRESLIBS =	../../lib/lwres/liblwres.@A@
  BIND9LIBS =	../../lib/bind9/libbind9.@A@
  
 -DNSDEPLIBS =	../../lib/dns/libdns.@A@
-+DNSDEPLIBS =   ../../lib/dns-pkcs11/libdns-pkcs11.@A@
++DNSDEPLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@
  ISCCFGDEPLIBS =	../../lib/isccfg/libisccfg.@A@
  ISCCCDEPLIBS =	../../lib/isccc/libisccc.@A@
 -ISCDEPLIBS =	../../lib/isc/libisc.@A@
-+ISCDEPLIBS =   ../../lib/isc-pkcs11/libisc-pkcs11.@A@
++ISCDEPLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
  LWRESDEPLIBS =	../../lib/lwres/liblwres.@A@
  BIND9DEPLIBS =	../../lib/bind9/libbind9.@A@
  
-@@ -71,15 +71,15 @@ DEPLIBS =	${LWRESDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
+@@ -72,15 +73,15 @@ DEPLIBS =	${LWRESDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
  
  LIBS =		${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
  		${ISCCFGLIBS} ${ISCCCLIBS} ${ISCLIBS} \
@@ -198,8 +200,8 @@ index c0861f6..df80f81 100644
 +TARGETS =	named-pkcs11@EXEEXT@ feature-test-pkcs11@EXEEXT@
  
  GEOIPLINKOBJS = geoip.@O@
- 
-@@ -90,8 +90,7 @@ OBJS =		builtin.@O@ client.@O@ config.@O@ control.@O@ \
+ GEOIP2LINKOBJS = geoip.@O@
+@@ -94,8 +95,7 @@ OBJS =		builtin.@O@ client.@O@ config.@O@ control.@O@ \
  		tkeyconf.@O@ tsigconf.@O@ update.@O@ xfrout.@O@ \
  		zoneconf.@O@ \
  		lwaddr.@O@ lwresd.@O@ lwdclient.@O@ lwderror.@O@ lwdgabn.@O@ \
@@ -209,7 +211,7 @@ index c0861f6..df80f81 100644
  
  UOBJS =		unix/os.@O@ unix/dlz_dlopen_driver.@O@
  
-@@ -106,8 +105,7 @@ SRCS =		builtin.c client.c config.c control.c \
+@@ -113,8 +113,7 @@ SRCS =		builtin.c client.c config.c control.c \
  		tkeyconf.c tsigconf.c update.c xfrout.c \
  		zoneconf.c \
  		lwaddr.c lwresd.c lwdclient.c lwderror.c lwdgabn.c \
@@ -219,7 +221,7 @@ index c0861f6..df80f81 100644
  
  MANPAGES =	named.8 lwresd.8 named.conf.5
  
-@@ -146,21 +144,21 @@ server.@O@: server.c
+@@ -154,21 +153,21 @@ server.@O@: server.c
  		-DPRODUCT=\"${PRODUCT}\" \
  		-DVERSION=\"${VERSION}\" -c ${srcdir}/server.c
  
@@ -245,7 +247,7 @@ index c0861f6..df80f81 100644
  	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} \
  		-o $@ feature-test.@O@ ${ISCLIBS} ${LIBS}
  
-@@ -193,16 +191,11 @@ install-man8: named.8 lwresd.8
+@@ -201,16 +200,11 @@ install-man8: named.8 lwresd.8
  
  install-man: install-man5 install-man8
  
@@ -266,12 +268,12 @@ index c0861f6..df80f81 100644
  @DLZ_DRIVER_RULES@
  
 diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
-index c0861f6..04dea99 100644
+index df1f7ee..9660965 100644
 --- a/bin/named/Makefile.in
 +++ b/bin/named/Makefile.in
-@@ -47,7 +47,7 @@ CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
- 		${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} ${ISC_INCLUDES} \
- 		${DLZDRIVER_INCLUDES} ${DBDRIVER_INCLUDES} @DST_OPENSSL_INC@
+@@ -48,7 +48,7 @@ CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
+ 		${DLZDRIVER_INCLUDES} ${DBDRIVER_INCLUDES} ${MAXMINDDB_CFLAGS} \
+ 		@DST_OPENSSL_INC@
  
 -CDEFINES =      @CONTRIB_DLZ@ @USE_PKCS11@ @PKCS11_ENGINE@ @CRYPTO@
 +CDEFINES =      @CONTRIB_DLZ@ @CRYPTO@
@@ -300,10 +302,10 @@ index a058c91..d4b689a 100644
  DEPLIBS =	${ISCDEPLIBS}
  
 diff --git a/configure.ac b/configure.ac
-index d48fd51..79c96f8 100644
+index 3b88105..0532feb 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -1089,12 +1089,14 @@ AC_SUBST(USE_GSSAPI)
+@@ -1139,12 +1139,14 @@ AC_SUBST(USE_GSSAPI)
  AC_SUBST(DST_GSSAPI_INC)
  AC_SUBST(DNS_GSSAPI_LIBS)
  DNS_CRYPTO_LIBS="$DNS_GSSAPI_LIBS $DNS_CRYPTO_LIBS"
@@ -318,10 +320,10 @@ index d48fd51..79c96f8 100644
  
  #
  # was --with-randomdev specified?
-@@ -1479,11 +1481,11 @@ fi
+@@ -1529,11 +1531,11 @@ fi
  AC_MSG_CHECKING(for OpenSSL library)
  OPENSSL_WARNING=
- openssldirs="/usr /usr/local /usr/local/ssl /usr/pkg /usr/sfw"
+ openssldirs="/usr /usr/local /usr/local/ssl /opt/local /usr/pkg /usr/sfw"
 -if test "yes" = "$want_native_pkcs11"
 -then
 -	use_openssl="native_pkcs11"
@@ -335,7 +337,7 @@ index d48fd51..79c96f8 100644
  
  if test "auto" = "$use_openssl"
  then
-@@ -1496,6 +1498,7 @@ then
+@@ -1546,6 +1548,7 @@ then
  		fi
  	done
  fi
@@ -343,7 +345,7 @@ index d48fd51..79c96f8 100644
  OPENSSL_ECDSA=""
  OPENSSL_GOST=""
  OPENSSL_ED25519=""
-@@ -1517,11 +1520,10 @@ case "$with_gost" in
+@@ -1567,11 +1570,10 @@ case "$with_gost" in
  		;;
  esac
  
@@ -358,7 +360,7 @@ index d48fd51..79c96f8 100644
  		CRYPTOLIB="pkcs11"
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
-@@ -1531,7 +1533,9 @@ case "$use_openssl" in
+@@ -1581,7 +1583,9 @@ case "$use_openssl" in
  		OPENSSLGOSTLINKSRCS=""
  		OPENSSLLINKOBJS=""
  		OPENSSLLINKSRCS=""
@@ -369,7 +371,7 @@ index d48fd51..79c96f8 100644
  	no)
  		AC_MSG_RESULT(no)
  		DST_OPENSSL_INC=""
-@@ -1563,7 +1567,7 @@ case "$use_openssl" in
+@@ -1613,7 +1617,7 @@ case "$use_openssl" in
  If you do not want OpenSSL, use --without-openssl])
  		;;
  	*)
@@ -378,7 +380,7 @@ index d48fd51..79c96f8 100644
  		then
  			AC_MSG_RESULT()
  			AC_MSG_ERROR([OpenSSL and native PKCS11 cannot be used together.])
-@@ -1991,6 +1995,7 @@ AC_SUBST(OPENSSL_ED25519)
+@@ -2041,6 +2045,7 @@ AC_SUBST(OPENSSL_ED25519)
  AC_SUBST(OPENSSL_GOST)
  
  DNS_CRYPTO_LIBS="$DNS_CRYPTO_LIBS $DST_OPENSSL_LIBS"
@@ -386,7 +388,7 @@ index d48fd51..79c96f8 100644
  
  ISC_PLATFORM_WANTAES="#undef ISC_PLATFORM_WANTAES"
  if test "yes" = "$with_aes"
-@@ -2314,6 +2319,7 @@ esac
+@@ -2364,6 +2369,7 @@ esac
  AC_SUBST(PKCS11LINKOBJS)
  AC_SUBST(PKCS11LINKSRCS)
  AC_SUBST(CRYPTO)
@@ -394,7 +396,7 @@ index d48fd51..79c96f8 100644
  AC_SUBST(PKCS11_ECDSA)
  AC_SUBST(PKCS11_GOST)
  AC_SUBST(PKCS11_ED25519)
-@@ -5441,8 +5447,11 @@ AC_CONFIG_FILES([
+@@ -5491,8 +5497,11 @@ AC_CONFIG_FILES([
  	bin/delv/Makefile
  	bin/dig/Makefile
  	bin/dnssec/Makefile
@@ -406,7 +408,7 @@ index d48fd51..79c96f8 100644
  	bin/nsupdate/Makefile
  	bin/pkcs11/Makefile
  	bin/python/Makefile
-@@ -5515,6 +5524,10 @@ AC_CONFIG_FILES([
+@@ -5565,6 +5574,10 @@ AC_CONFIG_FILES([
  	lib/dns/include/dns/Makefile
  	lib/dns/include/dst/Makefile
  	lib/dns/tests/Makefile
@@ -417,7 +419,7 @@ index d48fd51..79c96f8 100644
  	lib/irs/Makefile
  	lib/irs/include/Makefile
  	lib/irs/include/irs/Makefile
-@@ -5539,6 +5552,24 @@ AC_CONFIG_FILES([
+@@ -5589,6 +5602,24 @@ AC_CONFIG_FILES([
  	lib/isc/unix/include/Makefile
  	lib/isc/unix/include/isc/Makefile
  	lib/isc/unix/include/pkcs11/Makefile
@@ -456,17 +458,18 @@ index 81270a0..bcb5312 100644
  
  @BIND9_MAKE_RULES@
 diff --git a/lib/dns-pkcs11/Makefile.in b/lib/dns-pkcs11/Makefile.in
-index f6868d1..ea6fd36 100644
+index 7f09bd6..c388d9e 100644
 --- a/lib/dns-pkcs11/Makefile.in
 +++ b/lib/dns-pkcs11/Makefile.in
-@@ -26,16 +26,16 @@ VERSION=@BIND9_VERSION@
+@@ -26,17 +26,16 @@ VERSION=@BIND9_VERSION@
  
  USE_ISC_SPNEGO = @USE_ISC_SPNEGO@
  
 -CINCLUDES =	-I. -I${top_srcdir}/lib/dns -Iinclude ${DNS_INCLUDES} \
--		${ISC_INCLUDES} @DST_OPENSSL_INC@ @DST_GSSAPI_INC@
+-		${ISC_INCLUDES} ${MAXMINDDB_CFLAGS} \
+-		@DST_OPENSSL_INC@ @DST_GSSAPI_INC@
 +CINCLUDES =	-I. -I${top_srcdir}/lib/dns-pkcs11 -Iinclude ${DNS_PKCS11_INCLUDES} \
-+		${ISC_PKCS11_INCLUDES} @DST_OPENSSL_INC@ @DST_GSSAPI_INC@
++		${ISC_PKCS11_INCLUDES} ${MAXMINDDB_CFLAGS} @DST_OPENSSL_INC@ @DST_GSSAPI_INC@
  
 -CDEFINES =	-DUSE_MD5 @CRYPTO@ @USE_GSSAPI@ ${USE_ISC_SPNEGO}
 +CDEFINES =	-DUSE_MD5 @CRYPTO_PK11@ @USE_GSSAPI@ ${USE_ISC_SPNEGO}
@@ -479,9 +482,9 @@ index f6868d1..ea6fd36 100644
 -ISCDEPLIBS =	../../lib/isc/libisc.@A@
 +ISCDEPLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
  
- LIBS =		@LIBS@
+ LIBS =		${MAXMINDDB_LIBS} @LIBS@
  
-@@ -146,15 +146,15 @@ version.@O@: version.c
+@@ -150,15 +149,15 @@ version.@O@: version.c
  		-DLIBAGE=${LIBAGE} \
  		-c ${srcdir}/version.c
  
@@ -501,7 +504,7 @@ index f6868d1..ea6fd36 100644
  
  include: gen
  	${MAKE} include/dns/enumtype.h
-@@ -185,22 +185,22 @@ gen: gen.c
+@@ -189,22 +188,22 @@ gen: gen.c
  	${BUILD_CPPFLAGS} ${BUILD_LDFLAGS} -o $@ ${srcdir}/gen.c \
  	${BUILD_LIBS} ${LFS_LIBS}
  
diff --git a/bind-9.10-sdb.patch b/bind-9.10-sdb.patch
index 485e241..c72906c 100644
--- a/bind-9.10-sdb.patch
+++ b/bind-9.10-sdb.patch
@@ -14,7 +14,7 @@ index ce7a2da..4e6a824 100644
  
  @BIND9_MAKE_RULES@
 diff --git a/bin/named-sdb/Makefile.in b/bin/named-sdb/Makefile.in
-index 04dea99..4ff053e 100644
+index 9660965..184fbb2 100644
 --- a/bin/named-sdb/Makefile.in
 +++ b/bin/named-sdb/Makefile.in
 @@ -30,10 +30,10 @@ VERSION=@BIND9_VERSION@
@@ -31,7 +31,7 @@ index 04dea99..4ff053e 100644
  
  DLZ_DRIVER_DIR =	${top_srcdir}/contrib/dlz/drivers
  
-@@ -79,7 +79,7 @@ NOSYMLIBS =	${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
+@@ -80,7 +80,7 @@ NOSYMLIBS =	${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
  
  SUBDIRS =	unix
  
@@ -39,8 +39,8 @@ index 04dea99..4ff053e 100644
 +TARGETS =	named-sdb@EXEEXT@ feature-test-sdb@EXEEXT@
  
  GEOIPLINKOBJS = geoip.@O@
- 
-@@ -146,7 +146,7 @@ server.@O@: server.c
+ GEOIP2LINKOBJS = geoip.@O@
+@@ -154,7 +154,7 @@ server.@O@: server.c
  		-DPRODUCT=\"${PRODUCT}\" \
  		-DVERSION=\"${VERSION}\" -c ${srcdir}/server.c
  
@@ -49,7 +49,7 @@ index 04dea99..4ff053e 100644
  	export MAKE_SYMTABLE="yes"; \
  	export BASEOBJS="${OBJS} ${UOBJS}"; \
  	${FINALBUILDCMD}
-@@ -160,7 +160,7 @@ feature-test.@O@: ${top_srcdir}/bin/tests/system/feature-test.c
+@@ -168,7 +168,7 @@ feature-test.@O@: ${top_srcdir}/bin/tests/system/feature-test.c
  	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} \
  		-c ${top_srcdir}/bin/tests/system/feature-test.c
  
@@ -58,7 +58,7 @@ index 04dea99..4ff053e 100644
  	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} \
  		-o $@ feature-test.@O@ ${ISCLIBS} ${LIBS}
  
-@@ -182,8 +182,6 @@ statschannel.@O@: bind9.xsl.h
+@@ -190,8 +190,6 @@ statschannel.@O@: bind9.xsl.h
  
  installdirs:
  	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
@@ -67,7 +67,7 @@ index 04dea99..4ff053e 100644
  
  install-man5: named.conf.5
  	${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man5
-@@ -193,16 +191,11 @@ install-man8: named.8 lwresd.8
+@@ -201,16 +199,11 @@ install-man8: named.8 lwresd.8
  
  install-man: install-man5 install-man8
  
@@ -88,7 +88,7 @@ index 04dea99..4ff053e 100644
  @DLZ_DRIVER_RULES@
  
 diff --git a/bin/named-sdb/main.c b/bin/named-sdb/main.c
-index 17f2daa..1bb9d79 100644
+index 108b8d6..a943421 100644
 --- a/bin/named-sdb/main.c
 +++ b/bin/named-sdb/main.c
 @@ -93,6 +93,10 @@
@@ -102,7 +102,7 @@ index 17f2daa..1bb9d79 100644
  
  #ifdef CONTRIB_DLZ
  /*
-@@ -1063,6 +1067,11 @@ setup(void) {
+@@ -1069,6 +1073,11 @@ setup(void) {
  		ns_main_earlyfatal("isc_app_start() failed: %s",
  				   isc_result_totext(result));
  
@@ -114,7 +114,7 @@ index 17f2daa..1bb9d79 100644
  	isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
  		      ISC_LOG_NOTICE, "starting %s %s%s%s <id:%s>",
  		      ns_g_product, ns_g_version,
-@@ -1263,6 +1272,75 @@ setup(void) {
+@@ -1269,6 +1278,75 @@ setup(void) {
  				   isc_result_totext(result));
  #endif
  
@@ -190,7 +190,7 @@ index 17f2daa..1bb9d79 100644
  	ns_server_create(ns_g_mctx, &ns_g_server);
  
  #ifdef HAVE_LIBSECCOMP
-@@ -1305,6 +1383,11 @@ cleanup(void) {
+@@ -1311,6 +1389,11 @@ cleanup(void) {
  
  	dns_name_destroy();
  
@@ -203,22 +203,23 @@ index 17f2daa..1bb9d79 100644
  		      ISC_LOG_NOTICE, "exiting");
  	ns_log_shutdown();
 diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
-index 04dea99..9ed9637 100644
+index 9660965..03f7c05 100644
 --- a/bin/named/Makefile.in
 +++ b/bin/named/Makefile.in
-@@ -45,9 +45,9 @@ DLZDRIVER_LIBS =	@DLZ_DRIVER_LIBS@
+@@ -45,10 +45,10 @@ DLZDRIVER_LIBS =	@DLZ_DRIVER_LIBS@
  CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
  		${LWRES_INCLUDES} ${DNS_INCLUDES} ${BIND9_INCLUDES} \
  		${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} ${ISC_INCLUDES} \
--		${DLZDRIVER_INCLUDES} ${DBDRIVER_INCLUDES} @DST_OPENSSL_INC@
-+		@DST_OPENSSL_INC@
+-		${DLZDRIVER_INCLUDES} ${DBDRIVER_INCLUDES} ${MAXMINDDB_CFLAGS} \
++		${MAXMINDDB_CFLAGS} \
+ 		@DST_OPENSSL_INC@
  
 -CDEFINES =      @CONTRIB_DLZ@ @CRYPTO@
 +CDEFINES =      @CRYPTO@
  
  CWARNINGS =
  
-@@ -71,11 +71,11 @@ DEPLIBS =	${LWRESDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
+@@ -72,11 +72,11 @@ DEPLIBS =	${LWRESDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
  
  LIBS =		${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
  		${ISCCFGLIBS} ${ISCCCLIBS} ${ISCLIBS} \
@@ -232,7 +233,7 @@ index 04dea99..9ed9637 100644
  
  SUBDIRS =	unix
  
-@@ -90,8 +90,7 @@ OBJS =		builtin.@O@ client.@O@ config.@O@ control.@O@ \
+@@ -94,8 +94,7 @@ OBJS =		builtin.@O@ client.@O@ config.@O@ control.@O@ \
  		tkeyconf.@O@ tsigconf.@O@ update.@O@ xfrout.@O@ \
  		zoneconf.@O@ \
  		lwaddr.@O@ lwresd.@O@ lwdclient.@O@ lwderror.@O@ lwdgabn.@O@ \
@@ -242,7 +243,7 @@ index 04dea99..9ed9637 100644
  
  UOBJS =		unix/os.@O@ unix/dlz_dlopen_driver.@O@
  
-@@ -106,8 +105,7 @@ SRCS =		builtin.c client.c config.c control.c \
+@@ -113,8 +112,7 @@ SRCS =		builtin.c client.c config.c control.c \
  		tkeyconf.c tsigconf.c update.c xfrout.c \
  		zoneconf.c \
  		lwaddr.c lwresd.c lwdclient.c lwderror.c lwdgabn.c \
@@ -252,7 +253,7 @@ index 04dea99..9ed9637 100644
  
  MANPAGES =	named.8 lwresd.8 named.conf.5
  
-@@ -204,7 +202,5 @@ uninstall::
+@@ -212,7 +210,5 @@ uninstall::
  	rm -f ${DESTDIR}${sbindir}/lwresd@EXEEXT@
  	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/named@EXEEXT@
  
@@ -296,10 +297,10 @@ index c7e0868..95ab742 100644
 +	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zone2sqlite@EXEEXT@ ${DESTDIR}${sbindir}
  	${INSTALL_DATA} ${srcdir}/zone2ldap.1 ${DESTDIR}${mandir}/man1/zone2ldap.1
 diff --git a/configure.ac b/configure.ac
-index 8374385..0af9b71 100644
+index d8147ae..930cd1c 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -5436,6 +5436,8 @@ AC_CONFIG_FILES([
+@@ -5532,6 +5532,8 @@ AC_CONFIG_FILES([
  	bin/named/unix/Makefile
  	bin/named-pkcs11/Makefile
  	bin/named-pkcs11/unix/Makefile
@@ -308,7 +309,7 @@ index 8374385..0af9b71 100644
  	bin/nsupdate/Makefile
  	bin/pkcs11/Makefile
  	bin/python/Makefile
-@@ -5460,6 +5462,7 @@ AC_CONFIG_FILES([
+@@ -5556,6 +5558,7 @@ AC_CONFIG_FILES([
  	bin/python/isc/tests/dnskey_test.py
  	bin/python/isc/tests/policy_test.py
  	bin/rndc/Makefile
diff --git a/bind-9.11-feature-test-named.patch b/bind-9.11-feature-test-named.patch
index 9758c38..8d5ef9a 100644
--- a/bind-9.11-feature-test-named.patch
+++ b/bind-9.11-feature-test-named.patch
@@ -1,7 +1,7 @@
-From 4293078b294cbb766abe84d3b1618b1cb5413c82 Mon Sep 17 00:00:00 2001
+From d394129acaa40ec7fc68ab27802f0a01fcd50f3d Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Wed, 30 Jan 2019 14:37:17 +0100
-Subject: [PATCH 2/2] Create feature-test in source directory
+Subject: [PATCH] Create feature-test in source directory
 
 Feature-test tool is used in system tests to test compiled in changes.
 Because we build more variants of named with different configuration,
@@ -12,10 +12,10 @@ compile feature-test for each of them this way.
  2 files changed, 11 insertions(+), 2 deletions(-)
 
 diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
-index 1c413973d0..b31df9a718 100644
+index 3166368..df1f7ee 100644
 --- a/bin/named/Makefile.in
 +++ b/bin/named/Makefile.in
-@@ -79,7 +79,7 @@ NOSYMLIBS =	${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
+@@ -80,7 +80,7 @@ NOSYMLIBS =	${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
  
  SUBDIRS =	unix
  
@@ -23,8 +23,8 @@ index 1c413973d0..b31df9a718 100644
 +TARGETS =	named@EXEEXT@ lwresd@EXEEXT@ feature-test@EXEEXT@
  
  GEOIPLINKOBJS = geoip.@O@
- 
-@@ -151,6 +151,15 @@ lwresd@EXEEXT@: named@EXEEXT@
+ GEOIP2LINKOBJS = geoip.@O@
+@@ -163,6 +163,15 @@ lwresd@EXEEXT@: named@EXEEXT@
  	rm -f lwresd@EXEEXT@
  	@LN@ named@EXEEXT@ lwresd@EXEEXT@
  
@@ -41,10 +41,10 @@ index 1c413973d0..b31df9a718 100644
  
  docclean manclean maintainer-clean::
 diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
-index 2236f0a151..b072af8467 100644
+index 65c0c5a..117d6ec 100644
 --- a/bin/tests/system/conf.sh.in
 +++ b/bin/tests/system/conf.sh.in
-@@ -64,7 +64,7 @@ DNSTAPREAD=$TOP/bin/tools/dnstap-read
+@@ -71,7 +71,7 @@ DNSTAPREAD=$TOP/bin/tools/dnstap-read
  MDIG=$TOP/bin/tools/mdig
  NZD2NZF=$TOP/bin/tools/named-nzd2nzf
  FSTRM_CAPTURE=@FSTRM_CAPTURE@
diff --git a/bind-9.11-fips-tests.patch b/bind-9.11-fips-tests.patch
index b33e1bc..920440b 100644
--- a/bind-9.11-fips-tests.patch
+++ b/bind-9.11-fips-tests.patch
@@ -1,4 +1,4 @@
-From 230ca0ddbc95a043933c36c1d182f85cf0dcc971 Mon Sep 17 00:00:00 2001
+From d0e3f8be48c8031ebe3d7e1bf2a32cb03c79484e Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 2 Aug 2018 23:46:45 +0200
 Subject: [PATCH] FIPS tests changes
@@ -946,7 +946,7 @@ index 1e39862..4ed19ac 100755
  cat $infile $keyname1.key $keyname2.key >$zonefile
  
 diff --git a/bin/tests/system/dnssec/ns2/sign.sh b/bin/tests/system/dnssec/ns2/sign.sh
-index b93651a..09b12ba 100644
+index 13fb924..1ffa279 100644
 --- a/bin/tests/system/dnssec/ns2/sign.sh
 +++ b/bin/tests/system/dnssec/ns2/sign.sh
 @@ -126,8 +126,8 @@ zone=in-addr.arpa.
@@ -990,7 +990,7 @@ index ed30460..e6b1126 100644
 +    "." 256 3 8 "AwEAAarwAdjV4gIhpBCjXVAScRFEx3co7k8smJdxrnqoGsl5NB7EZ9jRdgvCXbJn6v8y9jlNWVHvaC8ilhfhLh0A1vLWiWv4ijd/12xcnrY7xpG7Cu3YkxUxaXJ7Jdg/Iw1+9mGgXF1v4UbCIcw/3U3cxyk7OxYg+VSb5KBAQSR0upxV";
  };
 diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh
-index 51dc117..48cb34b 100644
+index d07881d..17ad256 100644
 --- a/bin/tests/system/dnssec/tests.sh
 +++ b/bin/tests/system/dnssec/tests.sh
 @@ -3227,8 +3227,8 @@ do
@@ -1005,7 +1005,7 @@ index 51dc117..48cb34b 100644
  	8) size="-b 512";;
  	10) size="-b 1024";;
 diff --git a/bin/tests/system/feature-test.c b/bin/tests/system/feature-test.c
-index 3ac34e8..428d107 100644
+index 27a02d0..caf4166 100644
 --- a/bin/tests/system/feature-test.c
 +++ b/bin/tests/system/feature-test.c
 @@ -19,6 +19,7 @@
@@ -1016,15 +1016,15 @@ index 3ac34e8..428d107 100644
  #include <dns/edns.h>
  
  #ifdef WIN32
-@@ -45,6 +46,7 @@ usage() {
- 	fprintf(stderr, "	--have-geoip\n");
+@@ -46,6 +47,7 @@ usage() {
+ 	fprintf(stderr, "	--have-geoip2\n");
  	fprintf(stderr, "	--have-libxml2\n");
  	fprintf(stderr, "	--ipv6only=no\n");
 +	fprintf(stderr, "       --md5\n");
  	fprintf(stderr, "	--rpz-nsdname\n");
  	fprintf(stderr, "	--rpz-nsip\n");
  	fprintf(stderr, "	--with-idn\n");
-@@ -137,6 +139,18 @@ main(int argc, char **argv) {
+@@ -146,6 +148,18 @@ main(int argc, char **argv) {
  #endif
  	}
  
diff --git a/bind-9.11-kyua-pkcs11.patch b/bind-9.11-kyua-pkcs11.patch
index caf57bb..ac15d22 100644
--- a/bind-9.11-kyua-pkcs11.patch
+++ b/bind-9.11-kyua-pkcs11.patch
@@ -1,4 +1,4 @@
-From 17998f4feb9590522a0b50943075d9e8c97ec69d Mon Sep 17 00:00:00 2001
+From eb38d2278937ec3fe45d0af30cd080953bbb5b54 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Tue, 2 Jan 2018 18:13:07 +0100
 Subject: [PATCH] Fix pkcs11 variants atf tests
@@ -16,10 +16,10 @@ Add pkcs11 Kyuafile, fix dh_test to pass in pkcs11 mode
  6 files changed, 38 insertions(+), 16 deletions(-)
 
 diff --git a/configure.ac b/configure.ac
-index 7aff0e6..8374385 100644
+index 0532feb..a83ddd5 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -5512,6 +5512,7 @@ AC_CONFIG_FILES([
+@@ -5578,6 +5578,7 @@ AC_CONFIG_FILES([
  	lib/dns-pkcs11/include/Makefile
  	lib/dns-pkcs11/include/dns/Makefile
  	lib/dns-pkcs11/include/dst/Makefile
@@ -43,7 +43,7 @@ index 7c8bab0..eec9564 100644
  include('isccfg/Kyuafile')
  include('lwres/Kyuafile')
 diff --git a/lib/dns-pkcs11/tests/Makefile.in b/lib/dns-pkcs11/tests/Makefile.in
-index 9f1781a..e50463d 100644
+index 7671e1d..e237d5c 100644
 --- a/lib/dns-pkcs11/tests/Makefile.in
 +++ b/lib/dns-pkcs11/tests/Makefile.in
 @@ -17,12 +17,12 @@ VERSION=@BIND9_VERSION@
@@ -55,11 +55,11 @@ index 9f1781a..e50463d 100644
  
 -ISCLIBS =	../../isc/libisc.@A@
 -ISCDEPLIBS =	../../isc/libisc.@A@
--DNSLIBS =	../libdns.@A@ @DNS_CRYPTO_LIBS@
+-DNSLIBS =	../libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
 -DNSDEPLIBS =	../libdns.@A@
 +ISCLIBS =	../../isc-pkcs11/libisc-pkcs11.@A@
 +ISCDEPLIBS =	../../isc-pkcs11/libisc-pkcs11.@A@
-+DNSLIBS =	../libdns-pkcs11.@A@ @DNS_CRYPTO_LIBS@
++DNSLIBS =	../libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
 +DNSDEPLIBS =	../libdns-pkcs11.@A@
  
  LIBS =		@LIBS@ @CMOCKA_LIBS@
diff --git a/bind-9.11-rh1732883.patch b/bind-9.11-rh1732883.patch
index b312e63..80820b5 100644
--- a/bind-9.11-rh1732883.patch
+++ b/bind-9.11-rh1732883.patch
@@ -1,4 +1,4 @@
-From 9ac315c16bf8441145f5b4b8a3308ae9f03582ab Mon Sep 17 00:00:00 2001
+From 348947b3d573e2187db61fb43919d2260dcfc135 Mon Sep 17 00:00:00 2001
 From: Pavel Zhukov <pzhukov@redhat.com>
 Date: Wed, 24 Jul 2019 17:15:55 +0200
 Subject: [PATCH] Detect system time jumps
@@ -8,96 +8,93 @@ address dropped by the kernel due to lifetime expirity. Try to detect
 this situation using either monotonic time or saved timestamp and execute
 go_reboot() procedure to request lease extention
 ---
- lib/isc/include/isc/result.h    |  4 ++--
- lib/isc/include/isc/util.h      |  4 ++++
+ lib/isc/include/isc/result.h    |  3 ++-
+ lib/isc/include/isc/util.h      |  3 +++
  lib/isc/result.c                |  2 ++
- lib/isc/unix/app.c              | 41 +++++++++++++++++++++++++++++++--
- lib/isc/unix/include/isc/time.h | 20 ++++++++++++++++
- lib/isc/unix/time.c             | 22 ++++++++++++++++++
- 6 files changed, 89 insertions(+), 4 deletions(-)
+ lib/isc/unix/app.c              | 39 +++++++++++++++++++++++++++++----
+ lib/isc/unix/include/isc/time.h | 20 +++++++++++++++++
+ lib/isc/unix/time.c             | 22 +++++++++++++++++++
+ 6 files changed, 84 insertions(+), 5 deletions(-)
 
 diff --git a/lib/isc/include/isc/result.h b/lib/isc/include/isc/result.h
-index 246aefb..70d4b64 100644
+index 0fd4971..2add549 100644
 --- a/lib/isc/include/isc/result.h
 +++ b/lib/isc/include/isc/result.h
-@@ -83,9 +83,9 @@
- #define ISC_R_UNSET			61	/*%< unset */
- #define ISC_R_MULTIPLE			62	/*%< multiple */
- #define ISC_R_WOULDBLOCK		63	/*%< would block */
--
-+#define ISC_R_TIMESHIFTED               64      /*%< system time changed */
+@@ -87,9 +87,10 @@
+ #define ISC_R_CRYPTOFAILURE		65	/*%< cryptography library failure */
+ #define ISC_R_DISCQUOTA			66	/*%< disc quota */
+ #define ISC_R_DISCFULL			67	/*%< disc full */
++#define ISC_R_TIMESHIFTED               68      /*%< system time changed */
+ 
  /*% Not a result code: the number of results. */
--#define ISC_R_NRESULTS 			64
-+#define ISC_R_NRESULTS 			65
+-#define ISC_R_NRESULTS 			68
++#define ISC_R_NRESULTS 			69
  
  ISC_LANG_BEGINDECLS
  
 diff --git a/lib/isc/include/isc/util.h b/lib/isc/include/isc/util.h
-index 332dc0c..f81967d 100644
+index 973c348..8160dd3 100644
 --- a/lib/isc/include/isc/util.h
 +++ b/lib/isc/include/isc/util.h
-@@ -233,6 +233,10 @@
+@@ -289,6 +289,9 @@ extern void mock_assert(const int result, const char* const expression,
   * Time
   */
  #define TIME_NOW(tp) 	RUNTIME_CHECK(isc_time_now((tp)) == ISC_R_SUCCESS)
 +#ifdef CLOCK_BOOTTIME
 +#define TIME_MONOTONIC(tp) 	RUNTIME_CHECK(isc_time_boottime((tp)) == ISC_R_SUCCESS)
 +#endif
-+
  
  /*%
-  * Misc
+  * Alignment
 diff --git a/lib/isc/result.c b/lib/isc/result.c
-index a707c32..6776fc6 100644
+index abb6ed2..8c95a93 100644
 --- a/lib/isc/result.c
 +++ b/lib/isc/result.c
-@@ -99,6 +99,7 @@ static const char *description[ISC_R_NRESULTS] = {
- 	"unset",				/*%< 61 */
- 	"multiple",				/*%< 62 */
- 	"would block",				/*%< 63 */
-+        "time changed",                         /*%< 64 */
+@@ -103,6 +103,7 @@ static const char *description[ISC_R_NRESULTS] = {
+ 	"crypto failure",			/*%< 65 */
+ 	"disc quota",				/*%< 66 */
+ 	"disc full",				/*%< 67 */
++        "time changed",                         /*%< 68 */
  };
  
  static const char *identifier[ISC_R_NRESULTS] = {
-@@ -166,6 +167,7 @@ static const char *identifier[ISC_R_NRESULTS] = {
- 	"ISC_R_UNSET",
- 	"ISC_R_MULTIPLE",
- 	"ISC_R_WOULDBLOCK",
+@@ -174,6 +175,7 @@ static const char *identifier[ISC_R_NRESULTS] = {
+ 	"ISC_R_CRYPTOFAILURE",
+ 	"ISC_R_DISCQUOTA",
+ 	"ISC_R_DISCFULL",
 +        "ISC_R_TIMESHIFTED",
  };
  
  #define ISC_RESULT_RESULTSET			2
 diff --git a/lib/isc/unix/app.c b/lib/isc/unix/app.c
-index bace2bd..e9814d2 100644
+index 7e5a0ee..ceab74e 100644
 --- a/lib/isc/unix/app.c
 +++ b/lib/isc/unix/app.c
-@@ -441,15 +441,51 @@ isc__app_ctxonrun(isc_appctx_t *ctx0, isc_mem_t *mctx, isc_task_t *task,
+@@ -442,15 +442,48 @@ isc__app_ctxonrun(isc_appctx_t *ctx0, isc_mem_t *mctx, isc_task_t *task,
  static isc_result_t
  evloop(isc__appctx_t *ctx) {
  	isc_result_t result;
 +        isc_time_t now;
 +#ifdef CLOCK_BOOTTIME
 +        isc_time_t monotonic;
-+        isc_uint64_t diff  = 0;
++        uint64_t diff  = 0;
 +#else
 +        isc_time_t prev;
 +        TIME_NOW(&prev);
 +#endif
 +
-+
 +
  
  	while (!ctx->want_shutdown) {
  		int n;
 -		isc_time_t when, now;
 +		isc_time_t when;
-+                
  		struct timeval tv, *tvp;
  		isc_socketwait_t *swait;
- 		isc_boolean_t readytasks;
- 		isc_boolean_t call_timer_dispatch = ISC_FALSE;
- 
-+                isc_uint64_t us; 
+ 		bool readytasks;
+ 		bool call_timer_dispatch = false;
+-
++                uint64_t us;
 +
 +#ifdef CLOCK_BOOTTIME
 +                // TBD macros for following three lines
@@ -105,7 +102,7 @@ index bace2bd..e9814d2 100644
 +                TIME_MONOTONIC(&monotonic);
 +                INSIST(now.seconds > monotonic.seconds)
 +                us = isc_time_microdiff (&now, &monotonic);
-+                if (us < diff){ 
++                if (us < diff){
 +                  us = diff - us;
 +                  if (us > 1000000){ // ignoring shifts less than one second
 +                    return ISC_R_TIMESHIFTED;
@@ -120,27 +117,24 @@ index bace2bd..e9814d2 100644
 +                if (isc_time_compare (&now, &prev) < 0)
 +                  return ISC_R_TIMESHIFTED;
 +                TIME_NOW(&prev);
-+#endif                
++#endif
  		/*
  		 * Check the reload (or suspend) case first for exiting the
  		 * loop as fast as possible in case:
-@@ -474,9 +510,10 @@ evloop(isc__appctx_t *ctx) {
+@@ -475,8 +508,6 @@ evloop(isc__appctx_t *ctx) {
  			if (result != ISC_R_SUCCESS)
  				tvp = NULL;
  			else {
--				isc_uint64_t us;
-+
- 
+-				uint64_t us;
+-
  				TIME_NOW(&now);
-+
  				us = isc_time_microdiff(&when, &now);
  				if (us == 0)
- 					call_timer_dispatch = ISC_TRUE;
 diff --git a/lib/isc/unix/include/isc/time.h b/lib/isc/unix/include/isc/time.h
-index 75e24b9..de8b399 100644
+index b864c29..5dd43c9 100644
 --- a/lib/isc/unix/include/isc/time.h
 +++ b/lib/isc/unix/include/isc/time.h
-@@ -129,6 +129,26 @@ isc_time_isepoch(const isc_time_t *t);
+@@ -132,6 +132,26 @@ isc_time_isepoch(const isc_time_t *t);
   *\li	't' is a valid pointer.
   */
  
@@ -168,10 +162,10 @@ index 75e24b9..de8b399 100644
  isc_time_now(isc_time_t *t);
  /*%<
 diff --git a/lib/isc/unix/time.c b/lib/isc/unix/time.c
-index 2210240..d7613b8 100644
+index 8edc9df..fe0bb91 100644
 --- a/lib/isc/unix/time.c
 +++ b/lib/isc/unix/time.c
-@@ -496,3 +496,25 @@ isc_time_formatISO8601ms(const isc_time_t *t, char *buf, unsigned int len) {
+@@ -498,3 +498,25 @@ isc_time_formatISO8601ms(const isc_time_t *t, char *buf, unsigned int len) {
  			 t->nanoseconds / NS_PER_MS);
  	}
  }
diff --git a/bind-9.11-rt31459.patch b/bind-9.11-rt31459.patch
index 1eee414..bbb8948 100644
--- a/bind-9.11-rt31459.patch
+++ b/bind-9.11-rt31459.patch
@@ -1,4 +1,4 @@
-From 255fdf0b549ab2f138443ead0ac81bf864612217 Mon Sep 17 00:00:00 2001
+From f0eee3c150b9b913819ecd864581ba50dd4ae9cf Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Tue, 12 Sep 2017 19:05:46 -0700
 Subject: [PATCH] rebased rt31459c
@@ -48,8 +48,8 @@ Include new unit test
  lib/isc/include/isc/types.h              |   2 +
  lib/isc/pk11.c                           |  12 +-
  lib/isc/win32/include/isc/platform.h.in  |   5 +
- win32utils/Configure                     |  29 ++-
- 36 files changed, 703 insertions(+), 175 deletions(-)
+ win32utils/Configure                     |  28 ++-
+ 36 files changed, 702 insertions(+), 175 deletions(-)
  create mode 100644 lib/dns/tests/dstrandom_test.c
 
 diff --git a/bin/confgen/keygen.c b/bin/confgen/keygen.c
@@ -293,7 +293,7 @@ index fbc7ece..31a99e7 100644
  					   usekeyboard);
  
 diff --git a/bin/named/server.c b/bin/named/server.c
-index 0abbbed..405ff71 100644
+index 767d83f..d3c2f9d 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
 @@ -36,6 +36,7 @@
@@ -304,7 +304,7 @@ index 0abbbed..405ff71 100644
  #include <isc/portset.h>
  #include <isc/print.h>
  #include <isc/random.h>
-@@ -8210,6 +8211,10 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8208,6 +8209,10 @@ load_configuration(const char *filename, ns_server_t *server,
  				      "no source of entropy found");
  		} else {
  			const char *randomdev = cfg_obj_asstring(obj);
@@ -315,7 +315,7 @@ index 0abbbed..405ff71 100644
  			int level = ISC_LOG_ERROR;
  			result = isc_entropy_createfilesource(ns_g_entropy,
  							      randomdev);
-@@ -8244,6 +8249,7 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8242,6 +8247,7 @@ load_configuration(const char *filename, ns_server_t *server,
  				}
  				isc_entropy_detach(&ns_g_fallbackentropy);
  			}
@@ -689,7 +689,7 @@ index b27fc1d..e28871b 100644
  	parse_args(false, argc, argv);
  	if (server == NULL)
 diff --git a/configure b/configure
-index b219e16..4da30b9 100755
+index 4a5db6c..64aca10 100755
 --- a/configure
 +++ b/configure
 @@ -640,6 +640,7 @@ ac_includes_default="\
@@ -708,7 +708,7 @@ index b219e16..4da30b9 100755
  PKCS11_TEST
  PKCS11_ED25519
  PKCS11_GOST
-@@ -1038,6 +1040,7 @@ with_eddsa
+@@ -1047,6 +1049,7 @@ with_eddsa
  with_aes
  enable_openssl_hash
  with_cc_alg
@@ -716,7 +716,7 @@ index b219e16..4da30b9 100755
  with_lmdb
  with_libxml2
  with_libjson
-@@ -1734,6 +1737,7 @@ Optional Features:
+@@ -1746,6 +1749,7 @@ Optional Features:
    --enable-threads        enable multithreading
    --enable-native-pkcs11  use native PKCS11 for all crypto [default=no]
    --enable-openssl-hash   use OpenSSL for hash functions [default=no]
@@ -724,7 +724,7 @@ index b219e16..4da30b9 100755
    --enable-largefile      64-bit file support
    --enable-backtrace      log stack backtrace on abort [default=yes]
    --enable-symtable       use internal symbol table for backtrace
-@@ -16686,6 +16690,7 @@ case "$use_openssl" in
+@@ -17156,6 +17160,7 @@ case "$use_openssl" in
  $as_echo "disabled because of native PKCS11" >&6; }
  		DST_OPENSSL_INC=""
  		CRYPTO="-DPKCS11CRYPTO"
@@ -732,7 +732,7 @@ index b219e16..4da30b9 100755
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -16700,6 +16705,7 @@ $as_echo "disabled because of native PKCS11" >&6; }
+@@ -17170,6 +17175,7 @@ $as_echo "disabled because of native PKCS11" >&6; }
  $as_echo "no" >&6; }
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -740,7 +740,7 @@ index b219e16..4da30b9 100755
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -16712,6 +16718,7 @@ $as_echo "no" >&6; }
+@@ -17182,6 +17188,7 @@ $as_echo "no" >&6; }
  	auto)
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -748,7 +748,7 @@ index b219e16..4da30b9 100755
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -16721,7 +16728,7 @@ $as_echo "no" >&6; }
+@@ -17191,7 +17198,7 @@ $as_echo "no" >&6; }
  		OPENSSLLINKOBJS=""
  		OPENSSLLINKSRCS=""
  		as_fn_error $? "OpenSSL was not found in any of $openssldirs; use --with-openssl=/path
@@ -757,7 +757,7 @@ index b219e16..4da30b9 100755
  		;;
  	*)
  		if test "yes" = "$want_native_pkcs11"
-@@ -16752,6 +16759,7 @@ $as_echo "not found" >&6; }
+@@ -17222,6 +17229,7 @@ $as_echo "not found" >&6; }
  			as_fn_error $? "\"$use_openssl/include/openssl/opensslv.h\" not found" "$LINENO" 5
  		fi
  		CRYPTO='-DOPENSSL'
@@ -765,7 +765,7 @@ index b219e16..4da30b9 100755
  		if test "/usr" = "$use_openssl"
  		then
  			DST_OPENSSL_INC=""
-@@ -17413,8 +17421,6 @@ fi
+@@ -17883,8 +17891,6 @@ fi
  # Use OpenSSL for hash functions
  #
  
@@ -774,7 +774,7 @@ index b219e16..4da30b9 100755
  ISC_PLATFORM_OPENSSLHASH="#undef ISC_PLATFORM_OPENSSLHASH"
  case $want_openssl_hash in
  	yes)
-@@ -17789,6 +17795,86 @@ if test "rt" = "$have_clock_gt"; then
+@@ -18259,6 +18265,86 @@ if test "rt" = "$have_clock_gt"; then
  	LIBS="-lrt $LIBS"
  fi
  
@@ -861,7 +861,7 @@ index b219e16..4da30b9 100755
  #
  # was --with-lmdb specified?
  #
-@@ -19871,9 +19957,12 @@ _ACEOF
+@@ -20341,9 +20427,12 @@ _ACEOF
  if ac_fn_c_try_compile "$LINENO"; then :
    { $as_echo "$as_me:${as_lineno-$LINENO}: result: size_t for buflen; int for flags" >&5
  $as_echo "size_t for buflen; int for flags" >&6; }
@@ -876,7 +876,7 @@ index b219e16..4da30b9 100755
  
  	 $as_echo "#define IRS_GETNAMEINFO_FLAGS_T int" >>confdefs.h
  
-@@ -21188,12 +21277,7 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
+@@ -21658,12 +21747,7 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
  ISC_PLATFORM_USESTDASM="#undef ISC_PLATFORM_USESTDASM"
  ISC_PLATFORM_USEMACASM="#undef ISC_PLATFORM_USEMACASM"
  if test "yes" = "$use_atomic"; then
@@ -890,7 +890,7 @@ index b219e16..4da30b9 100755
  # version HP92453-01 B.11.11.23709.GP, which incorrectly rejects
  # declarations like `int a3[[(sizeof (unsigned char)) >= 0]];'.
  # This bug is HP SR number 8606223364.
-@@ -21226,6 +21310,11 @@ cat >>confdefs.h <<_ACEOF
+@@ -21696,6 +21780,11 @@ cat >>confdefs.h <<_ACEOF
  _ACEOF
  
  
@@ -902,7 +902,7 @@ index b219e16..4da30b9 100755
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -21234,39 +21323,6 @@ _ACEOF
+@@ -21704,39 +21793,6 @@ _ACEOF
  		fi
  	;;
  	x86_64-*|amd64-*)
@@ -942,7 +942,7 @@ index b219e16..4da30b9 100755
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -21297,6 +21353,10 @@ $as_echo_n "checking architecture type for atomic operations... " >&6; }
+@@ -21767,6 +21823,10 @@ $as_echo_n "checking architecture type for atomic operations... " >&6; }
  $as_echo "$arch" >&6; }
  fi
  
@@ -953,7 +953,7 @@ index b219e16..4da30b9 100755
  if test "yes" = "$have_atomic"; then
  	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking compiler support for inline assembly code" >&5
  $as_echo_n "checking compiler support for inline assembly code... " >&6; }
-@@ -23896,6 +23956,30 @@ CFLAGS="$CFLAGS $SO_CFLAGS"
+@@ -24372,6 +24432,30 @@ CFLAGS="$CFLAGS $SO_CFLAGS"
  #
  dlzdir='${DLZ_DRIVER_DIR}'
  
@@ -984,7 +984,7 @@ index b219e16..4da30b9 100755
  #
  # Private autoconf macro to simplify configuring drivers:
  #
-@@ -24226,11 +24310,11 @@ $as_echo "no" >&6; }
+@@ -24702,11 +24786,11 @@ $as_echo "no" >&6; }
  $as_echo "using mysql with libs ${mysql_lib} and includes ${mysql_include}" >&6; }
  		;;
  	*)
@@ -999,7 +999,7 @@ index b219e16..4da30b9 100755
  		fi
  
  	CONTRIB_DLZ="$CONTRIB_DLZ -DDLZ_MYSQL"
-@@ -24315,7 +24399,7 @@ $as_echo "" >&6; }
+@@ -24791,7 +24875,7 @@ $as_echo "" >&6; }
  			# Check other locations for includes.
  			# Order is important (sigh).
  
@@ -1008,7 +1008,7 @@ index b219e16..4da30b9 100755
  			# include a blank element first
  			for d in "" $bdb_incdirs
  			do
-@@ -24340,57 +24424,9 @@ $as_echo "" >&6; }
+@@ -24816,57 +24900,9 @@ $as_echo "" >&6; }
  			bdb_libnames="db53 db-5.3 db51 db-5.1 db48 db-4.8 db47 db-4.7 db46 db-4.6 db45 db-4.5 db44 db-4.4 db43 db-4.3 db42 db-4.2 db41 db-4.1 db"
  			for d in $bdb_libnames
  			do
@@ -1068,7 +1068,7 @@ index b219e16..4da30b9 100755
  					break
  				fi
  			done
-@@ -24549,10 +24585,10 @@ $as_echo "no" >&6; }
+@@ -25025,10 +25061,10 @@ $as_echo "no" >&6; }
  		DLZ_DRIVER_INCLUDES="$DLZ_DRIVER_INCLUDES -I$use_dlz_ldap/include"
  		DLZ_DRIVER_LDAP_INCLUDES="-I$use_dlz_ldap/include"
  	fi
@@ -1082,7 +1082,7 @@ index b219e16..4da30b9 100755
  	fi
  
  
-@@ -24638,11 +24674,11 @@ fi
+@@ -25114,11 +25150,11 @@ fi
  		odbcdirs="/usr /usr/local /usr/pkg"
  		for d in $odbcdirs
  		do
@@ -1096,7 +1096,7 @@ index b219e16..4da30b9 100755
  				break
  			fi
  		done
-@@ -24917,6 +24953,8 @@ DNS_CRYPTO_LIBS="$NEWFLAGS"
+@@ -25393,6 +25429,8 @@ DNS_CRYPTO_LIBS="$NEWFLAGS"
  
  
  
@@ -1105,7 +1105,7 @@ index b219e16..4da30b9 100755
  #
  # Commands to run at the end of config.status.
  # Don't just put these into configure, it won't work right if somebody
-@@ -27295,6 +27333,8 @@ report() {
+@@ -27772,6 +27810,8 @@ report() {
  	    echo "    IPv6 support (--enable-ipv6)"
  	test "X$CRYPTO" = "X" -o "yes" = "$want_native_pkcs11" || \
  		echo "    OpenSSL cryptography/DNSSEC (--with-openssl)"
@@ -1114,7 +1114,7 @@ index b219e16..4da30b9 100755
  	test "X$PYTHON" = "X" || echo "    Python tools (--with-python)"
  	test "X$XMLSTATS" = "X" || echo "    XML statistics (--with-libxml2)"
  	test "X$JSONSTATS" = "X" || echo "    JSON statistics (--with-libjson)"
-@@ -27335,6 +27375,8 @@ report() {
+@@ -27812,6 +27852,8 @@ report() {
  	echo "    Very verbose query trace logging (--enable-querytrace)"
      test "no" = "$with_cmocka" || echo "    CMocka Unit Testing Framework (--with-cmocka)"
  
@@ -1123,7 +1123,7 @@ index b219e16..4da30b9 100755
      echo "    Dynamically loadable zone (DLZ) drivers:"
      test "no" = "$use_dlz_bdb" || \
  	echo "        Berkeley DB (--with-dlz-bdb)"
-@@ -27382,6 +27424,8 @@ report() {
+@@ -27859,6 +27901,8 @@ report() {
  	echo "    ECDSA algorithm support (--with-ecdsa)"
      test "X$CRYPTO" = "X" -o "yes" = "$OPENSSL_ED25519" -o "yes" = "$PKCS11_ED25519" || \
  	echo "    EDDSA algorithm support (--with-eddsa)"
@@ -1133,10 +1133,10 @@ index b219e16..4da30b9 100755
      test "yes" = "$enable_seccomp" || \
  	echo "    Use libseccomp system call filtering (--enable-seccomp)"
 diff --git a/configure.ac b/configure.ac
-index 7fd192c..5e4e839 100644
+index 0dc552c..3b88105 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -1514,6 +1514,7 @@ case "$use_openssl" in
+@@ -1572,6 +1572,7 @@ case "$use_openssl" in
  		AC_MSG_RESULT(disabled because of native PKCS11)
  		DST_OPENSSL_INC=""
  		CRYPTO="-DPKCS11CRYPTO"
@@ -1144,7 +1144,7 @@ index 7fd192c..5e4e839 100644
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -1527,6 +1528,7 @@ case "$use_openssl" in
+@@ -1585,6 +1586,7 @@ case "$use_openssl" in
  		AC_MSG_RESULT(no)
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -1152,7 +1152,7 @@ index 7fd192c..5e4e839 100644
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -1539,6 +1541,7 @@ case "$use_openssl" in
+@@ -1597,6 +1599,7 @@ case "$use_openssl" in
  	auto)
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -1160,7 +1160,7 @@ index 7fd192c..5e4e839 100644
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -1549,7 +1552,7 @@ case "$use_openssl" in
+@@ -1607,7 +1610,7 @@ case "$use_openssl" in
  		OPENSSLLINKSRCS=""
  		AC_MSG_ERROR(
  [OpenSSL was not found in any of $openssldirs; use --with-openssl=/path
@@ -1169,7 +1169,7 @@ index 7fd192c..5e4e839 100644
  		;;
  	*)
  		if test "yes" = "$want_native_pkcs11"
-@@ -1579,6 +1582,7 @@ If you don't want OpenSSL, use --without-openssl])
+@@ -1637,6 +1640,7 @@ If you don't want OpenSSL, use --without-openssl])
  			AC_MSG_ERROR(["$use_openssl/include/openssl/opensslv.h" not found])
  		fi
  		CRYPTO='-DOPENSSL'
@@ -1177,7 +1177,7 @@ index 7fd192c..5e4e839 100644
  		if test "/usr" = "$use_openssl"
  		then
  			DST_OPENSSL_INC=""
-@@ -2052,7 +2056,6 @@ fi
+@@ -2110,7 +2114,6 @@ fi
  # Use OpenSSL for hash functions
  #
  
@@ -1185,7 +1185,7 @@ index 7fd192c..5e4e839 100644
  ISC_PLATFORM_OPENSSLHASH="#undef ISC_PLATFORM_OPENSSLHASH"
  case $want_openssl_hash in
  	yes)
-@@ -2324,6 +2327,67 @@ if test "rt" = "$have_clock_gt"; then
+@@ -2382,6 +2385,67 @@ if test "rt" = "$have_clock_gt"; then
  	LIBS="-lrt $LIBS"
  fi
  
@@ -1253,7 +1253,7 @@ index 7fd192c..5e4e839 100644
  #
  # was --with-lmdb specified?
  #
-@@ -4120,12 +4184,12 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
+@@ -4178,12 +4242,12 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
  ISC_PLATFORM_USESTDASM="#undef ISC_PLATFORM_USESTDASM"
  ISC_PLATFORM_USEMACASM="#undef ISC_PLATFORM_USEMACASM"
  if test "yes" = "$use_atomic"; then
@@ -1267,7 +1267,7 @@ index 7fd192c..5e4e839 100644
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -4134,7 +4198,6 @@ if test "yes" = "$use_atomic"; then
+@@ -4192,7 +4256,6 @@ if test "yes" = "$use_atomic"; then
  		fi
  	;;
  	x86_64-*|amd64-*)
@@ -1275,7 +1275,7 @@ index 7fd192c..5e4e839 100644
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -5543,6 +5606,8 @@ report() {
+@@ -5607,6 +5670,8 @@ report() {
  	    echo "    IPv6 support (--enable-ipv6)"
  	test "X$CRYPTO" = "X" -o "yes" = "$want_native_pkcs11" || \
  		echo "    OpenSSL cryptography/DNSSEC (--with-openssl)"
@@ -1284,7 +1284,7 @@ index 7fd192c..5e4e839 100644
  	test "X$PYTHON" = "X" || echo "    Python tools (--with-python)"
  	test "X$XMLSTATS" = "X" || echo "    XML statistics (--with-libxml2)"
  	test "X$JSONSTATS" = "X" || echo "    JSON statistics (--with-libjson)"
-@@ -5583,6 +5648,8 @@ report() {
+@@ -5647,6 +5712,8 @@ report() {
  	echo "    Very verbose query trace logging (--enable-querytrace)"
      test "no" = "$with_cmocka" || echo "    CMocka Unit Testing Framework (--with-cmocka)"
  
@@ -1293,7 +1293,7 @@ index 7fd192c..5e4e839 100644
      echo "    Dynamically loadable zone (DLZ) drivers:"
      test "no" = "$use_dlz_bdb" || \
  	echo "        Berkeley DB (--with-dlz-bdb)"
-@@ -5630,6 +5697,8 @@ report() {
+@@ -5694,6 +5761,8 @@ report() {
  	echo "    ECDSA algorithm support (--with-ecdsa)"
      test "X$CRYPTO" = "X" -o "yes" = "$OPENSSL_ED25519" -o "yes" = "$PKCS11_ED25519" || \
  	echo "    EDDSA algorithm support (--with-eddsa)"
@@ -1693,7 +1693,7 @@ index 937b548..f3c0e38 100644
  tap_test_program{name='gost_test'}
  tap_test_program{name='keytable_test'}
 diff --git a/lib/dns/tests/Makefile.in b/lib/dns/tests/Makefile.in
-index 0897579..9f1781a 100644
+index 90dc3a6..7671e1d 100644
 --- a/lib/dns/tests/Makefile.in
 +++ b/lib/dns/tests/Makefile.in
 @@ -37,6 +37,7 @@ SRCS =		acl_test.c \
@@ -2016,10 +2016,10 @@ index 5b8a2c9..913a2ce 100644
   * Define if the hash functions must be provided by OpenSSL.
   */
 diff --git a/win32utils/Configure b/win32utils/Configure
-index 27b00af..7e35d60 100644
+index 93939f3..8bacf54 100644
 --- a/win32utils/Configure
 +++ b/win32utils/Configure
-@@ -380,6 +380,7 @@ my @substdefh = ("AES_CC",
+@@ -381,6 +381,7 @@ my @substdefh = ("AES_CC",
  my %configdefp;
  
  my @substdefp = ("ISC_PLATFORM_BUSYWAITNOP",
@@ -2027,7 +2027,7 @@ index 27b00af..7e35d60 100644
                   "ISC_PLATFORM_HAVEATOMICSTORE",
                   "ISC_PLATFORM_HAVEATOMICSTOREQ",
                   "ISC_PLATFORM_HAVECMPXCHG",
-@@ -509,7 +510,8 @@ my @allcond = (@substcond, "NOTYET", "NOLONGER");
+@@ -511,7 +512,8 @@ my @allcond = (@substcond, "NOTYET", "NOLONGER");
  
  # enable-xxx/disable-xxx
  
@@ -2037,7 +2037,7 @@ index 27b00af..7e35d60 100644
                    "fixed-rrset",
                    "intrinsics",
                    "isc-spnego",
-@@ -572,6 +574,7 @@ my @help = (
+@@ -575,6 +577,7 @@ my @help = (
  "\nOptional Features:\n",
  "  enable-intrinsics     enable instrinsic/atomic functions [default=yes]\n",
  "  enable-native-pkcs11  use native PKCS#11 for all crypto [default=no]\n",
@@ -2045,7 +2045,7 @@ index 27b00af..7e35d60 100644
  "  enable-openssl-hash   use OpenSSL for hash functions [default=yes]\n",
  "  enable-isc-spnego     use SPNEGO from lib/dns [default=yes]\n",
  "  enable-filter-aaaa    enable filtering of AAAA records [default=yes]\n",
-@@ -616,7 +619,9 @@ my $want_clean = "no";
+@@ -620,7 +623,9 @@ my $want_clean = "no";
  my $want_unknown = "no";
  my $unknown_value;
  my $enable_intrinsics = "yes";
@@ -2055,7 +2055,7 @@ index 27b00af..7e35d60 100644
  my $enable_openssl_hash = "auto";
  my $enable_filter_aaaa = "yes";
  my $enable_isc_spnego = "yes";
-@@ -834,6 +839,10 @@ sub myenable {
+@@ -840,6 +845,10 @@ sub myenable {
          if ($val =~ /^yes$/i) {
              $enable_native_pkcs11 = "yes";
          }
@@ -2066,7 +2066,7 @@ index 27b00af..7e35d60 100644
      } elsif ($key =~ /^openssl-hash$/i) {
          if ($val =~ /^yes$/i) {
              $enable_openssl_hash = "yes";
-@@ -1125,6 +1134,11 @@ if ($verbose) {
+@@ -1142,6 +1151,11 @@ if ($verbose) {
      } else {
          print "native-pkcs11: disabled\n";
      }
@@ -2078,7 +2078,7 @@ index 27b00af..7e35d60 100644
      if ($enable_openssl_hash eq "yes") {
          print "openssl-hash: enabled\n";
      } else {
-@@ -1478,6 +1492,7 @@ if ($enable_intrinsics eq "yes") {
+@@ -1500,6 +1514,7 @@ if ($enable_intrinsics eq "yes") {
  
  # enable-native-pkcs11
  if ($enable_native_pkcs11 eq "yes") {
@@ -2086,7 +2086,7 @@ index 27b00af..7e35d60 100644
      if ($use_openssl eq "auto") {
          $use_openssl = "no";
      }
-@@ -1687,6 +1702,7 @@ if ($use_openssl eq "yes") {
+@@ -1709,6 +1724,7 @@ if ($use_openssl eq "yes") {
          $openssl_dll = File::Spec->catdir($openssl_path, "@dirlist[0]");
      }   
  
@@ -2094,7 +2094,7 @@ index 27b00af..7e35d60 100644
      $configcond{"OPENSSL"} = 1;
      $configdefd{"CRYPTO"} = "OPENSSL";
      $configvar{"OPENSSL_PATH"} = "$openssl_path";
-@@ -2238,6 +2254,15 @@ if ($cookie_algorithm eq "sha1") {
+@@ -2260,6 +2276,15 @@ if ($cookie_algorithm eq "sha1") {
      die "Unrecognized cookie algorithm: $cookie_algorithm\n";
  }
  
@@ -2110,7 +2110,7 @@ index 27b00af..7e35d60 100644
  # enable-openssl-hash
  if ($enable_openssl_hash eq "yes") {
      if ($use_openssl eq "no") {
-@@ -3564,6 +3589,7 @@ exit 0;
+@@ -3635,6 +3660,7 @@ exit 0;
  #  --enable-developer partially supported
  #  --enable-newstats (9.9/9.9sub only)
  #  --enable-native-pkcs11 supported
@@ -2118,14 +2118,6 @@ index 27b00af..7e35d60 100644
  #  --enable-openssl-version-check included without a way to disable it
  #  --enable-openssl-hash supported
  #  --enable-threads included without a way to disable it
-@@ -3589,6 +3615,7 @@ exit 0;
- #  --with-gost supported
- #  --with-aes supported
- #  --with-cc-alg supported
-+#  --with-randomdev not supported on WIN32 (makes no sense)
- #  --with-geoip supported
- #  --with-gssapi supported with MIT (K)erberos (f)or (W)indows
- #  --with-lmdb no supported on WIN32 (port is not reliable)
 -- 
 2.20.1
 

From ed5314b647c999725f00da26ba5c57885076d364 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 24 Jul 2019 19:20:21 +0200
Subject: [PATCH 034/460] Solve conflicting jsoncpp-devel and json-c-devel

---
 bind-9.11-json-c.patch | 50 ++++++++++++++++++++++++++++++++++++++++++
 bind.spec              |  3 +++
 2 files changed, 53 insertions(+)
 create mode 100644 bind-9.11-json-c.patch

diff --git a/bind-9.11-json-c.patch b/bind-9.11-json-c.patch
new file mode 100644
index 0000000..95e5597
--- /dev/null
+++ b/bind-9.11-json-c.patch
@@ -0,0 +1,50 @@
+From cb6d2019766a6c8c5516fd8859cedf0052f03293 Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Thu, 25 Jul 2019 11:37:57 +0200
+Subject: [PATCH] Skip support of jsoncpp
+
+Bind cannot be compiled when jsoncpp-devel is installed. Remove support
+for jsoncpp, use only json-c-devel. Bind 9.15 has already support for
+--with-json-c, do not yet introduce it.
+---
+ configure.ac | 17 ++---------------
+ 1 file changed, 2 insertions(+), 15 deletions(-)
+
+diff --git a/configure.ac b/configure.ac
+index 6d05337..5ce83b5 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -2594,15 +2594,7 @@ case "$use_libjson" in
+ 	auto|yes)
+ 		for d in /usr /usr/local /opt/local
+ 		do
+-			if test -f "${d}/include/json/json.h"
+-			then
+-				if test ${d} != /usr
+-				then
+-					libjson_cflags="-I ${d}/include"
+-					LIBS="$LIBS -L${d}/lib"
+-				fi
+-				have_libjson="yes"
+-			elif test -f "${d}/include/json-c/json.h"
++			if test -f "${d}/include/json-c/json.h"
+ 			then
+ 				if test ${d} != /usr
+ 				then
+@@ -2615,12 +2607,7 @@ case "$use_libjson" in
+ 		done
+ 		;;
+ 	*)
+-		if test -f "${use_libjson}/include/json/json.h"
+-		then
+-			libjson_cflags="-I${use_libjson}/include"
+-			LIBS="$LIBS -L${use_libjson}/lib"
+-			have_libjson="yes"
+-		elif test -f "${use_libjson}/include/json-c/json.h"
++		if test -f "${use_libjson}/include/json-c/json.h"
+ 		then
+ 			libjson_cflags="-I${use_libjson}/include"
+ 			LIBS="$LIBS -L${use_libjson}/lib"
+-- 
+2.20.1
+
diff --git a/bind.spec b/bind.spec
index 1819d65..0bfa7a3 100644
--- a/bind.spec
+++ b/bind.spec
@@ -139,6 +139,8 @@ Patch170:bind-9.11-feature-test-named.patch
 Patch171:bind-9.11-tests-variants.patch
 Patch172:bind-9.11-tests-pkcs11.patch
 Patch173:bind-9.11-rh1732883.patch
+# Make sure jsonccp-devel does not interfere
+Patch174:bind-9.11-json-c.patch
 
 # SDB patches
 Patch11: bind-9.3.2b2-sdbsrc.patch
@@ -519,6 +521,7 @@ are used for building ISC DHCP.
 %patch171 -p1 -b .test-variant
 %patch172 -p1 -b .test-pkcs11
 %patch173 -p1 -b .rh1732883
+%patch174 -p1 -b .json-c
 
 mkdir lib/dns/tests/testdata/dstrandom
 cp -a %{SOURCE50} lib/dns/tests/testdata/dstrandom/random.data

From 1050b1aed6b4c1a543a9d20d45a00a3d1f72ca5c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 24 Jul 2019 17:32:43 +0200
Subject: [PATCH 035/460] Use monotonic time in export library (#1732883)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Petr Menšík <pemensik@redhat.com>
---
 bind-9.11-rh1732883.patch | 202 ++++++++++++++++++++++++++++++++++++++
 bind.spec                 |   5 +
 2 files changed, 207 insertions(+)
 create mode 100644 bind-9.11-rh1732883.patch

diff --git a/bind-9.11-rh1732883.patch b/bind-9.11-rh1732883.patch
new file mode 100644
index 0000000..b312e63
--- /dev/null
+++ b/bind-9.11-rh1732883.patch
@@ -0,0 +1,202 @@
+From 9ac315c16bf8441145f5b4b8a3308ae9f03582ab Mon Sep 17 00:00:00 2001
+From: Pavel Zhukov <pzhukov@redhat.com>
+Date: Wed, 24 Jul 2019 17:15:55 +0200
+Subject: [PATCH] Detect system time jumps
+
+In case if system time was changed backward it's possible to have ip
+address dropped by the kernel due to lifetime expirity. Try to detect
+this situation using either monotonic time or saved timestamp and execute
+go_reboot() procedure to request lease extention
+---
+ lib/isc/include/isc/result.h    |  4 ++--
+ lib/isc/include/isc/util.h      |  4 ++++
+ lib/isc/result.c                |  2 ++
+ lib/isc/unix/app.c              | 41 +++++++++++++++++++++++++++++++--
+ lib/isc/unix/include/isc/time.h | 20 ++++++++++++++++
+ lib/isc/unix/time.c             | 22 ++++++++++++++++++
+ 6 files changed, 89 insertions(+), 4 deletions(-)
+
+diff --git a/lib/isc/include/isc/result.h b/lib/isc/include/isc/result.h
+index 246aefb..70d4b64 100644
+--- a/lib/isc/include/isc/result.h
++++ b/lib/isc/include/isc/result.h
+@@ -83,9 +83,9 @@
+ #define ISC_R_UNSET			61	/*%< unset */
+ #define ISC_R_MULTIPLE			62	/*%< multiple */
+ #define ISC_R_WOULDBLOCK		63	/*%< would block */
+-
++#define ISC_R_TIMESHIFTED               64      /*%< system time changed */
+ /*% Not a result code: the number of results. */
+-#define ISC_R_NRESULTS 			64
++#define ISC_R_NRESULTS 			65
+ 
+ ISC_LANG_BEGINDECLS
+ 
+diff --git a/lib/isc/include/isc/util.h b/lib/isc/include/isc/util.h
+index 332dc0c..f81967d 100644
+--- a/lib/isc/include/isc/util.h
++++ b/lib/isc/include/isc/util.h
+@@ -233,6 +233,10 @@
+  * Time
+  */
+ #define TIME_NOW(tp) 	RUNTIME_CHECK(isc_time_now((tp)) == ISC_R_SUCCESS)
++#ifdef CLOCK_BOOTTIME
++#define TIME_MONOTONIC(tp) 	RUNTIME_CHECK(isc_time_boottime((tp)) == ISC_R_SUCCESS)
++#endif
++
+ 
+ /*%
+  * Misc
+diff --git a/lib/isc/result.c b/lib/isc/result.c
+index a707c32..6776fc6 100644
+--- a/lib/isc/result.c
++++ b/lib/isc/result.c
+@@ -99,6 +99,7 @@ static const char *description[ISC_R_NRESULTS] = {
+ 	"unset",				/*%< 61 */
+ 	"multiple",				/*%< 62 */
+ 	"would block",				/*%< 63 */
++        "time changed",                         /*%< 64 */
+ };
+ 
+ static const char *identifier[ISC_R_NRESULTS] = {
+@@ -166,6 +167,7 @@ static const char *identifier[ISC_R_NRESULTS] = {
+ 	"ISC_R_UNSET",
+ 	"ISC_R_MULTIPLE",
+ 	"ISC_R_WOULDBLOCK",
++        "ISC_R_TIMESHIFTED",
+ };
+ 
+ #define ISC_RESULT_RESULTSET			2
+diff --git a/lib/isc/unix/app.c b/lib/isc/unix/app.c
+index bace2bd..e9814d2 100644
+--- a/lib/isc/unix/app.c
++++ b/lib/isc/unix/app.c
+@@ -441,15 +441,51 @@ isc__app_ctxonrun(isc_appctx_t *ctx0, isc_mem_t *mctx, isc_task_t *task,
+ static isc_result_t
+ evloop(isc__appctx_t *ctx) {
+ 	isc_result_t result;
++        isc_time_t now;
++#ifdef CLOCK_BOOTTIME
++        isc_time_t monotonic;
++        isc_uint64_t diff  = 0;
++#else
++        isc_time_t prev;
++        TIME_NOW(&prev);
++#endif
++
++
++
+ 
+ 	while (!ctx->want_shutdown) {
+ 		int n;
+-		isc_time_t when, now;
++		isc_time_t when;
++                
+ 		struct timeval tv, *tvp;
+ 		isc_socketwait_t *swait;
+ 		isc_boolean_t readytasks;
+ 		isc_boolean_t call_timer_dispatch = ISC_FALSE;
+ 
++                isc_uint64_t us; 
++
++#ifdef CLOCK_BOOTTIME
++                // TBD macros for following three lines
++                TIME_NOW(&now);
++                TIME_MONOTONIC(&monotonic);
++                INSIST(now.seconds > monotonic.seconds)
++                us = isc_time_microdiff (&now, &monotonic);
++                if (us < diff){ 
++                  us = diff - us;
++                  if (us > 1000000){ // ignoring shifts less than one second
++                    return ISC_R_TIMESHIFTED;
++                  };
++                  diff = isc_time_microdiff (&now, &monotonic);
++                } else {
++                  diff = isc_time_microdiff (&now, &monotonic);
++                  // not implemented
++                }
++#else
++                TIME_NOW(&now);
++                if (isc_time_compare (&now, &prev) < 0)
++                  return ISC_R_TIMESHIFTED;
++                TIME_NOW(&prev);
++#endif                
+ 		/*
+ 		 * Check the reload (or suspend) case first for exiting the
+ 		 * loop as fast as possible in case:
+@@ -474,9 +510,10 @@ evloop(isc__appctx_t *ctx) {
+ 			if (result != ISC_R_SUCCESS)
+ 				tvp = NULL;
+ 			else {
+-				isc_uint64_t us;
++
+ 
+ 				TIME_NOW(&now);
++
+ 				us = isc_time_microdiff(&when, &now);
+ 				if (us == 0)
+ 					call_timer_dispatch = ISC_TRUE;
+diff --git a/lib/isc/unix/include/isc/time.h b/lib/isc/unix/include/isc/time.h
+index 75e24b9..de8b399 100644
+--- a/lib/isc/unix/include/isc/time.h
++++ b/lib/isc/unix/include/isc/time.h
+@@ -129,6 +129,26 @@ isc_time_isepoch(const isc_time_t *t);
+  *\li	't' is a valid pointer.
+  */
+ 
++#ifdef CLOCK_BOOTTIME
++isc_result_t
++isc_time_boottime(isc_time_t *t);
++/*%<
++ * Set 't' to monotonic time from previous boot
++ * it's not affected by system time change. It also
++ * includes the time system was suspended
++ *
++ * Requires:
++ *\li	't' is a valid pointer.
++ *
++ * Returns:
++ *
++ *\li	Success
++ *\li	Unexpected error
++ *		Getting the time from the system failed.
++ */
++#endif /* CLOCK_BOOTTIME */
++ 
++
+ isc_result_t
+ isc_time_now(isc_time_t *t);
+ /*%<
+diff --git a/lib/isc/unix/time.c b/lib/isc/unix/time.c
+index 2210240..d7613b8 100644
+--- a/lib/isc/unix/time.c
++++ b/lib/isc/unix/time.c
+@@ -496,3 +496,25 @@ isc_time_formatISO8601ms(const isc_time_t *t, char *buf, unsigned int len) {
+ 			 t->nanoseconds / NS_PER_MS);
+ 	}
+ }
++
++
++#ifdef CLOCK_BOOTTIME
++isc_result_t
++isc_time_boottime(isc_time_t *t) {
++  struct timespec ts;
++  
++  char strbuf[ISC_STRERRORSIZE];
++
++  if (clock_gettime (CLOCK_BOOTTIME, &ts) != 0){
++    isc__strerror(errno, strbuf, sizeof(strbuf));
++    UNEXPECTED_ERROR(__FILE__, __LINE__, "%s", strbuf);
++    return (ISC_R_UNEXPECTED);    
++  }
++
++  t->seconds = ts.tv_sec;
++  t->nanoseconds = ts.tv_nsec;
++
++  return (ISC_R_SUCCESS);
++  
++};
++#endif
+-- 
+2.20.1
+
diff --git a/bind.spec b/bind.spec
index a2bc402..7cfe672 100644
--- a/bind.spec
+++ b/bind.spec
@@ -138,6 +138,7 @@ Patch168:bind-9.11-unit-disable-random.patch
 Patch170:bind-9.11-feature-test-named.patch
 Patch171:bind-9.11-tests-variants.patch
 Patch172:bind-9.11-tests-pkcs11.patch
+Patch173: bind-9.11-rh1732883.patch
 
 # SDB patches
 Patch11: bind-9.3.2b2-sdbsrc.patch
@@ -517,6 +518,7 @@ are used for building ISC DHCP.
 %patch170 -p1 -b .featuretest-named
 %patch171 -p1 -b .test-variant
 %patch172 -p1 -b .test-pkcs11
+%patch173 -p1 -b .rh1732883
 
 mkdir lib/dns/tests/testdata/dstrandom
 cp -a %{SOURCE50} lib/dns/tests/testdata/dstrandom/random.data
@@ -1511,6 +1513,9 @@ fi;
 
 
 %changelog
+* Wed Jul 24 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.8-2
+- Use monotonic time in export library (#1732883)
+
 * Wed Jul 24 2019 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.11.8-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
 

From afa1fa2af75ad04aa7ed6d8eb7e388bf5ace0ce7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 24 Jul 2019 17:37:04 +0200
Subject: [PATCH 036/460] Update to 9.11.9

---
 .gitignore             |  1 +
 bind-9.11.8.tar.gz.asc | 16 ----------------
 bind-9.11.9.tar.gz.asc | 16 ++++++++++++++++
 bind.spec              |  9 ++++++---
 sources                |  2 +-
 5 files changed, 24 insertions(+), 20 deletions(-)
 delete mode 100644 bind-9.11.8.tar.gz.asc
 create mode 100644 bind-9.11.9.tar.gz.asc

diff --git a/.gitignore b/.gitignore
index e904915..3067a7d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -94,3 +94,4 @@ bind-9.7.2b1.tar.gz
 /bind-9.11.6-P1.tar.gz
 /bind-9.11.7.tar.gz
 /bind-9.11.8.tar.gz
+/bind-9.11.9.tar.gz
diff --git a/bind-9.11.8.tar.gz.asc b/bind-9.11.8.tar.gz.asc
deleted file mode 100644
index fb0ac3b..0000000
--- a/bind-9.11.8.tar.gz.asc
+++ /dev/null
@@ -1,16 +0,0 @@
------BEGIN PGP SIGNATURE-----
-
-iQIzBAABAgAdFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAlz45qgACgkQdLtrmky7
-PThZoxAAuqUxL9JV1NsvODkJ049F8hRrrzhN8Vgx19D/w6oLWawaHuOahU67RYWh
-OGa3D72G0mClVFBABTV9YiAwkNnbkq3Nkclh6riWDjAO3RPKMo50yiAhLKSt2Z4N
-i0dMSIzZb8T9nq19T9JI1loyEG3oU+I97uWLyzrLe2WqCpSmdCTNd8PsD/0r+MxV
-QnBt1RFHda4z7r0fYLMw5oALXiNttPg6JdKByssgmYB6DYYw4f9ywMj1e8Jnn307
-6BXMweF0uOpGgy18HzgdfSjMNc3g9WKU86gTyAblAd1HALtdwe/VKgH1ZVJZoflT
-QnxzJDDjNbKE5OP7TOgzN9pLPCGwvQhpHDqGTTn+cTj5h9pQZcfq0vQQJ+MGzFWF
-kj0TUeLYs9FNnJt91Rpk+T96sOUypOrpPM9RdAEKp38qSMmZN8DJ83sga2b1OCqr
-zIcuQOBuXlKu9uD9g2cTquGGSG0vGvVSx0OXogUYEPS635AZbyZ9IqSntlDE+cnS
-mJt7jCQv+DVFVDUiyfLcdmPZk0U88hHdruKTbN3dc+a+OMddukPM4AepLKgdAWkQ
-F9et7SJ5VeiGiHgIwJaeu04VhD4DuQILo6xx7wxJIiPQ8H1sazdrikcn70hxMQwB
-yq1tBfQHTUfHmZBCytMVRR3sEQscv/7MBEhS9DXmNRYfIXrXKIE=
-=j1R3
------END PGP SIGNATURE-----
diff --git a/bind-9.11.9.tar.gz.asc b/bind-9.11.9.tar.gz.asc
new file mode 100644
index 0000000..9e9ad71
--- /dev/null
+++ b/bind-9.11.9.tar.gz.asc
@@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABAgAdFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAl0u4wIACgkQdLtrmky7
+PTgO+A/8DtA5xbbJZx6ifx/AXS+0TBwnyRt1qkDplCRMq4/G+/r9iHh2Z3JYiznV
+NKHkV7JV+d4p9pygOo0s563DsFTg3A6OtzhU7n8QxFS4e3T6S+vKBX1s0Iixu/hN
+q9pxhhefeGejVUjhKqAHbNvoCO2stMAgZi02qhqECJPvu8YtyOPEPNW/K+2aWLH3
+P3gNwIbj1+NjNBWAAhiSEK+px7do4499AxGOZcCPUUmhEAWckcQ1wyC94tDC3uQi
+XY3asr6Ph7WWXkM0qnUDx9+ZPKKDOMevX11W+5cNw1qioss8dWcs3l7mhUuRITVx
+u/yaQYt7F9BY5XjtbaBtTWBDRbpCrrt2YpMhNJ/aedSbCoRT/ZYiDqNwKCEes10s
+hJK4LG4pCtVWQnwi4xFeCxI+NJK5b5gRj5NZ/cwKqGMnEmO0hg3aiDtEUF424t1i
+IdJvDs+NaMjHqitpvc8hlJpTpiefCuGTYjrrJLjnAsA3r72z4aLb8M6ivBNmpEiJ
+x5LFyBZusHzuCSfFV23tBZvZ1VQf53Netz0PXbOCdnKKYlibUGzD3pC8LdoMoj5m
+/s4BYes5ET4xA867yZg7y/A0x0Ezuw+7NLXhpMSAQh/OZwWQ1CzspvYUxl8hHx67
+r1aH0dkAtN8BtaR5lTrXtFfRTJvEqNQ9lFQwljwEJqfwFN4dJBc=
+=m4su
+-----END PGP SIGNATURE-----
diff --git a/bind.spec b/bind.spec
index 7cfe672..6967958 100644
--- a/bind.spec
+++ b/bind.spec
@@ -52,8 +52,8 @@
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.11.8
-Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Version:  9.11.9
+Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -138,7 +138,7 @@ Patch168:bind-9.11-unit-disable-random.patch
 Patch170:bind-9.11-feature-test-named.patch
 Patch171:bind-9.11-tests-variants.patch
 Patch172:bind-9.11-tests-pkcs11.patch
-Patch173: bind-9.11-rh1732883.patch
+Patch173:bind-9.11-rh1732883.patch
 
 # SDB patches
 Patch11: bind-9.3.2b2-sdbsrc.patch
@@ -1513,6 +1513,9 @@ fi;
 
 
 %changelog
+* Wed Jul 24 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.9-1
+- Update to 9.11.9
+
 * Wed Jul 24 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.8-2
 - Use monotonic time in export library (#1732883)
 
diff --git a/sources b/sources
index a8b7813..78dba7f 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.11.8.tar.gz) = 0192d6e087cdbdebec171869d908c4326c2575d65ee5367a78ed9da26de357e017b0306349d66a6016a7ec80ad27f5f7f9f2db25002c6d0c78589dc473a015fc
+SHA512 (bind-9.11.9.tar.gz) = 4fa975b83986480a12138a3cf7ccf3bcd2251d194e0c04e3fad0787fc8b2a5dee241179fbb25b0283fa6fcb749d7a15fad036039dbc81250defcba0108823ef8
 SHA512 (config-19.tar.bz2) = 36aa38a0c7c33267ae594b31c81681290ac58dde7ca6749bd599da531380b5b1428330813dbe983e01071ccaed83e83f6a9cd92179a53b7d0ccbb6851a0b017c

From 371a1e3b7d5bb4fb290c9ec056a36b3cf07f1e1a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 24 Jul 2019 19:05:06 +0200
Subject: [PATCH 037/460] Update patches to 9.11.9

Maxmind library and defines modifies many patches changing flags.
Conflicts a lot especially with PKCS11 build.
---
 bind-9.10-dist-native-pkcs11.patch | 107 ++++++++++++-------------
 bind-9.10-sdb.patch                |  45 +++++------
 bind-9.11-feature-test-named.patch |  16 ++--
 bind-9.11-fips-tests.patch         |  14 ++--
 bind-9.11-kyua-pkcs11.patch        |  12 +--
 bind-9.11-rh1732883.patch          |  96 +++++++++++------------
 bind-9.11-rt31459.patch            | 120 ++++++++++++++---------------
 7 files changed, 200 insertions(+), 210 deletions(-)

diff --git a/bind-9.10-dist-native-pkcs11.patch b/bind-9.10-dist-native-pkcs11.patch
index 9468850..0ba7ccc 100644
--- a/bind-9.10-dist-native-pkcs11.patch
+++ b/bind-9.10-dist-native-pkcs11.patch
@@ -14,10 +14,10 @@ index f0c504a..ce7a2da 100644
  
  @BIND9_MAKE_RULES@
 diff --git a/bin/dnssec-pkcs11/Makefile.in b/bin/dnssec-pkcs11/Makefile.in
-index ce0a177..8908a45 100644
+index 4b8ca13..32f4470 100644
 --- a/bin/dnssec-pkcs11/Makefile.in
 +++ b/bin/dnssec-pkcs11/Makefile.in
-@@ -17,18 +17,18 @@ VERSION=@BIND9_VERSION@
+@@ -15,18 +15,18 @@ VERSION=@BIND9_VERSION@
  
  @BIND9_MAKE_INCLUDES@
  
@@ -30,10 +30,10 @@ index ce0a177..8908a45 100644
 +		@CRYPTO_PK11@ -DPK11_LIB_LOCATION=\"@PKCS11_PROVIDER@\"
  CWARNINGS =
  
--DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
+-DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
 -ISCLIBS =	../../lib/isc/libisc.@A@
 -ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@
-+DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ @DNS_CRYPTO_LIBS@
++DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
 +ISCLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
 +ISCNOSYMLIBS =	../../lib/isc-pkcs11/libisc-pkcs11-nosymtbl.@A@
  
@@ -44,7 +44,7 @@ index ce0a177..8908a45 100644
  
  DEPLIBS =	${DNSDEPLIBS} ${ISCDEPLIBS}
  
-@@ -37,10 +37,10 @@ LIBS =		${DNSLIBS} ${ISCLIBS} @LIBS@
+@@ -35,10 +35,10 @@ LIBS =		${DNSLIBS} ${ISCLIBS} @LIBS@
  NOSYMLIBS =	${DNSLIBS} ${ISCNOSYMLIBS} @LIBS@
  
  # Alphabetically
@@ -59,7 +59,7 @@ index ce0a177..8908a45 100644
  
  OBJS =		dnssectool.@O@
  
-@@ -61,15 +61,15 @@ MANOBJS =	${MANPAGES} ${HTMLPAGES}
+@@ -59,15 +59,15 @@ MANOBJS =	${MANPAGES} ${HTMLPAGES}
  
  @BIND9_MAKE_RULES@
  
@@ -78,7 +78,7 @@ index ce0a177..8908a45 100644
  	export BASEOBJS="dnssec-keygen.@O@ ${OBJS}"; \
  	${FINALBUILDCMD}
  
-@@ -77,7 +77,7 @@ dnssec-signzone.@O@: dnssec-signzone.c
+@@ -75,7 +75,7 @@ dnssec-signzone.@O@: dnssec-signzone.c
  	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} -DVERSION=\"${VERSION}\" \
  		-c ${srcdir}/dnssec-signzone.c
  
@@ -87,7 +87,7 @@ index ce0a177..8908a45 100644
  	export BASEOBJS="dnssec-signzone.@O@ ${OBJS}"; \
  	${FINALBUILDCMD}
  
-@@ -85,19 +85,19 @@ dnssec-verify.@O@: dnssec-verify.c
+@@ -83,19 +83,19 @@ dnssec-verify.@O@: dnssec-verify.c
  	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} -DVERSION=\"${VERSION}\" \
  		-c ${srcdir}/dnssec-verify.c
  
@@ -111,7 +111,7 @@ index ce0a177..8908a45 100644
  	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \
  	dnssec-importkey.@O@ ${OBJS} ${LIBS}
  
-@@ -108,16 +108,14 @@ docclean manclean maintainer-clean::
+@@ -106,16 +106,14 @@ docclean manclean maintainer-clean::
  
  installdirs:
  	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
@@ -130,10 +130,10 @@ index ce0a177..8908a45 100644
  
  clean distclean::
 diff --git a/bin/dnssec/Makefile.in b/bin/dnssec/Makefile.in
-index ce0a177..7cede84 100644
+index 4b8ca13..4175996 100644
 --- a/bin/dnssec/Makefile.in
 +++ b/bin/dnssec/Makefile.in
-@@ -19,7 +19,7 @@ VERSION=@BIND9_VERSION@
+@@ -17,7 +17,7 @@ VERSION=@BIND9_VERSION@
  
  CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} @DST_OPENSSL_INC@
  
@@ -143,44 +143,46 @@ index ce0a177..7cede84 100644
  CWARNINGS =
  
 diff --git a/bin/named-pkcs11/Makefile.in b/bin/named-pkcs11/Makefile.in
-index c0861f6..df80f81 100644
+index df1f7ee..f397ab0 100644
 --- a/bin/named-pkcs11/Makefile.in
 +++ b/bin/named-pkcs11/Makefile.in
-@@ -43,26 +43,26 @@ DLZDRIVER_INCLUDES =	@DLZ_DRIVER_INCLUDES@
+@@ -43,27 +43,28 @@ DLZDRIVER_INCLUDES =	@DLZ_DRIVER_INCLUDES@
  DLZDRIVER_LIBS =	@DLZ_DRIVER_LIBS@
  
  CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
 -		${LWRES_INCLUDES} ${DNS_INCLUDES} ${BIND9_INCLUDES} \
 -		${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} ${ISC_INCLUDES} \
-+        ${LWRES_INCLUDES} ${DNS_PKCS11_INCLUDES} ${BIND9_INCLUDES} \
-+        ${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} ${ISC_PKCS11_INCLUDES} \
- 		${DLZDRIVER_INCLUDES} ${DBDRIVER_INCLUDES} @DST_OPENSSL_INC@
++		${LWRES_INCLUDES} ${DNS_PKCS11_INCLUDES} ${BIND9_INCLUDES} \
++		${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} ${ISC_PKCS11_INCLUDES} \
+ 		${DLZDRIVER_INCLUDES} ${DBDRIVER_INCLUDES} ${MAXMINDDB_CFLAGS} \
+ 		@DST_OPENSSL_INC@
  
 -CDEFINES =      @CONTRIB_DLZ@ @USE_PKCS11@ @PKCS11_ENGINE@ @CRYPTO@
 +CDEFINES =      @USE_PKCS11@ @PKCS11_ENGINE@ @CRYPTO_PK11@
  
  CWARNINGS =
  
--DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
-+DNSLIBS =  ../../lib/dns-pkcs11/libdns-pkcs11.@A@ @DNS_CRYPTO_LIBS@
+ DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
++DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
  ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
  ISCCCLIBS =	../../lib/isccc/libisccc.@A@
 -ISCLIBS =	../../lib/isc/libisc.@A@
-+ISCLIBS =  ../../lib/isc-pkcs11/libisc-pkcs11.@A@
- ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@
+-ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@
++ISCLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
++ISCNOSYMLIBS =	../../lib/isc-pkcs11/libisc-pkcs11-nosymtbl.@A@
  LWRESLIBS =	../../lib/lwres/liblwres.@A@
  BIND9LIBS =	../../lib/bind9/libbind9.@A@
  
 -DNSDEPLIBS =	../../lib/dns/libdns.@A@
-+DNSDEPLIBS =   ../../lib/dns-pkcs11/libdns-pkcs11.@A@
++DNSDEPLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@
  ISCCFGDEPLIBS =	../../lib/isccfg/libisccfg.@A@
  ISCCCDEPLIBS =	../../lib/isccc/libisccc.@A@
 -ISCDEPLIBS =	../../lib/isc/libisc.@A@
-+ISCDEPLIBS =   ../../lib/isc-pkcs11/libisc-pkcs11.@A@
++ISCDEPLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
  LWRESDEPLIBS =	../../lib/lwres/liblwres.@A@
  BIND9DEPLIBS =	../../lib/bind9/libbind9.@A@
  
-@@ -71,15 +71,15 @@ DEPLIBS =	${LWRESDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
+@@ -72,15 +73,15 @@ DEPLIBS =	${LWRESDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
  
  LIBS =		${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
  		${ISCCFGLIBS} ${ISCCCLIBS} ${ISCLIBS} \
@@ -198,8 +200,8 @@ index c0861f6..df80f81 100644
 +TARGETS =	named-pkcs11@EXEEXT@ feature-test-pkcs11@EXEEXT@
  
  GEOIPLINKOBJS = geoip.@O@
- 
-@@ -90,8 +90,7 @@ OBJS =		builtin.@O@ client.@O@ config.@O@ control.@O@ \
+ GEOIP2LINKOBJS = geoip.@O@
+@@ -94,8 +95,7 @@ OBJS =		builtin.@O@ client.@O@ config.@O@ control.@O@ \
  		tkeyconf.@O@ tsigconf.@O@ update.@O@ xfrout.@O@ \
  		zoneconf.@O@ \
  		lwaddr.@O@ lwresd.@O@ lwdclient.@O@ lwderror.@O@ lwdgabn.@O@ \
@@ -209,7 +211,7 @@ index c0861f6..df80f81 100644
  
  UOBJS =		unix/os.@O@ unix/dlz_dlopen_driver.@O@
  
-@@ -106,8 +105,7 @@ SRCS =		builtin.c client.c config.c control.c \
+@@ -113,8 +113,7 @@ SRCS =		builtin.c client.c config.c control.c \
  		tkeyconf.c tsigconf.c update.c xfrout.c \
  		zoneconf.c \
  		lwaddr.c lwresd.c lwdclient.c lwderror.c lwdgabn.c \
@@ -219,7 +221,7 @@ index c0861f6..df80f81 100644
  
  MANPAGES =	named.8 lwresd.8 named.conf.5
  
-@@ -146,21 +144,21 @@ server.@O@: server.c
+@@ -154,21 +153,21 @@ server.@O@: server.c
  		-DPRODUCT=\"${PRODUCT}\" \
  		-DVERSION=\"${VERSION}\" -c ${srcdir}/server.c
  
@@ -245,7 +247,7 @@ index c0861f6..df80f81 100644
  	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} \
  		-o $@ feature-test.@O@ ${ISCLIBS} ${LIBS}
  
-@@ -193,16 +191,11 @@ install-man8: named.8 lwresd.8
+@@ -201,16 +200,11 @@ install-man8: named.8 lwresd.8
  
  install-man: install-man5 install-man8
  
@@ -266,12 +268,12 @@ index c0861f6..df80f81 100644
  @DLZ_DRIVER_RULES@
  
 diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
-index c0861f6..04dea99 100644
+index df1f7ee..9660965 100644
 --- a/bin/named/Makefile.in
 +++ b/bin/named/Makefile.in
-@@ -47,7 +47,7 @@ CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
- 		${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} ${ISC_INCLUDES} \
- 		${DLZDRIVER_INCLUDES} ${DBDRIVER_INCLUDES} @DST_OPENSSL_INC@
+@@ -48,7 +48,7 @@ CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
+ 		${DLZDRIVER_INCLUDES} ${DBDRIVER_INCLUDES} ${MAXMINDDB_CFLAGS} \
+ 		@DST_OPENSSL_INC@
  
 -CDEFINES =      @CONTRIB_DLZ@ @USE_PKCS11@ @PKCS11_ENGINE@ @CRYPTO@
 +CDEFINES =      @CONTRIB_DLZ@ @CRYPTO@
@@ -300,10 +302,10 @@ index a058c91..d4b689a 100644
  DEPLIBS =	${ISCDEPLIBS}
  
 diff --git a/configure.ac b/configure.ac
-index d48fd51..79c96f8 100644
+index 3b88105..0532feb 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -1089,12 +1089,14 @@ AC_SUBST(USE_GSSAPI)
+@@ -1139,12 +1139,14 @@ AC_SUBST(USE_GSSAPI)
  AC_SUBST(DST_GSSAPI_INC)
  AC_SUBST(DNS_GSSAPI_LIBS)
  DNS_CRYPTO_LIBS="$DNS_GSSAPI_LIBS $DNS_CRYPTO_LIBS"
@@ -318,10 +320,10 @@ index d48fd51..79c96f8 100644
  
  #
  # was --with-randomdev specified?
-@@ -1479,11 +1481,11 @@ fi
+@@ -1529,11 +1531,11 @@ fi
  AC_MSG_CHECKING(for OpenSSL library)
  OPENSSL_WARNING=
- openssldirs="/usr /usr/local /usr/local/ssl /usr/pkg /usr/sfw"
+ openssldirs="/usr /usr/local /usr/local/ssl /opt/local /usr/pkg /usr/sfw"
 -if test "yes" = "$want_native_pkcs11"
 -then
 -	use_openssl="native_pkcs11"
@@ -335,7 +337,7 @@ index d48fd51..79c96f8 100644
  
  if test "auto" = "$use_openssl"
  then
-@@ -1496,6 +1498,7 @@ then
+@@ -1546,6 +1548,7 @@ then
  		fi
  	done
  fi
@@ -343,7 +345,7 @@ index d48fd51..79c96f8 100644
  OPENSSL_ECDSA=""
  OPENSSL_GOST=""
  OPENSSL_ED25519=""
-@@ -1517,11 +1520,10 @@ case "$with_gost" in
+@@ -1567,11 +1570,10 @@ case "$with_gost" in
  		;;
  esac
  
@@ -358,7 +360,7 @@ index d48fd51..79c96f8 100644
  		CRYPTOLIB="pkcs11"
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
-@@ -1531,7 +1533,9 @@ case "$use_openssl" in
+@@ -1581,7 +1583,9 @@ case "$use_openssl" in
  		OPENSSLGOSTLINKSRCS=""
  		OPENSSLLINKOBJS=""
  		OPENSSLLINKSRCS=""
@@ -369,7 +371,7 @@ index d48fd51..79c96f8 100644
  	no)
  		AC_MSG_RESULT(no)
  		DST_OPENSSL_INC=""
-@@ -1563,7 +1567,7 @@ case "$use_openssl" in
+@@ -1613,7 +1617,7 @@ case "$use_openssl" in
  If you do not want OpenSSL, use --without-openssl])
  		;;
  	*)
@@ -378,7 +380,7 @@ index d48fd51..79c96f8 100644
  		then
  			AC_MSG_RESULT()
  			AC_MSG_ERROR([OpenSSL and native PKCS11 cannot be used together.])
-@@ -1991,6 +1995,7 @@ AC_SUBST(OPENSSL_ED25519)
+@@ -2041,6 +2045,7 @@ AC_SUBST(OPENSSL_ED25519)
  AC_SUBST(OPENSSL_GOST)
  
  DNS_CRYPTO_LIBS="$DNS_CRYPTO_LIBS $DST_OPENSSL_LIBS"
@@ -386,7 +388,7 @@ index d48fd51..79c96f8 100644
  
  ISC_PLATFORM_WANTAES="#undef ISC_PLATFORM_WANTAES"
  if test "yes" = "$with_aes"
-@@ -2314,6 +2319,7 @@ esac
+@@ -2364,6 +2369,7 @@ esac
  AC_SUBST(PKCS11LINKOBJS)
  AC_SUBST(PKCS11LINKSRCS)
  AC_SUBST(CRYPTO)
@@ -394,7 +396,7 @@ index d48fd51..79c96f8 100644
  AC_SUBST(PKCS11_ECDSA)
  AC_SUBST(PKCS11_GOST)
  AC_SUBST(PKCS11_ED25519)
-@@ -5441,8 +5447,11 @@ AC_CONFIG_FILES([
+@@ -5491,8 +5497,11 @@ AC_CONFIG_FILES([
  	bin/delv/Makefile
  	bin/dig/Makefile
  	bin/dnssec/Makefile
@@ -406,7 +408,7 @@ index d48fd51..79c96f8 100644
  	bin/nsupdate/Makefile
  	bin/pkcs11/Makefile
  	bin/python/Makefile
-@@ -5515,6 +5524,10 @@ AC_CONFIG_FILES([
+@@ -5565,6 +5574,10 @@ AC_CONFIG_FILES([
  	lib/dns/include/dns/Makefile
  	lib/dns/include/dst/Makefile
  	lib/dns/tests/Makefile
@@ -417,7 +419,7 @@ index d48fd51..79c96f8 100644
  	lib/irs/Makefile
  	lib/irs/include/Makefile
  	lib/irs/include/irs/Makefile
-@@ -5539,6 +5552,24 @@ AC_CONFIG_FILES([
+@@ -5589,6 +5602,24 @@ AC_CONFIG_FILES([
  	lib/isc/unix/include/Makefile
  	lib/isc/unix/include/isc/Makefile
  	lib/isc/unix/include/pkcs11/Makefile
@@ -456,17 +458,18 @@ index 81270a0..bcb5312 100644
  
  @BIND9_MAKE_RULES@
 diff --git a/lib/dns-pkcs11/Makefile.in b/lib/dns-pkcs11/Makefile.in
-index f6868d1..ea6fd36 100644
+index 7f09bd6..c388d9e 100644
 --- a/lib/dns-pkcs11/Makefile.in
 +++ b/lib/dns-pkcs11/Makefile.in
-@@ -26,16 +26,16 @@ VERSION=@BIND9_VERSION@
+@@ -26,17 +26,16 @@ VERSION=@BIND9_VERSION@
  
  USE_ISC_SPNEGO = @USE_ISC_SPNEGO@
  
 -CINCLUDES =	-I. -I${top_srcdir}/lib/dns -Iinclude ${DNS_INCLUDES} \
--		${ISC_INCLUDES} @DST_OPENSSL_INC@ @DST_GSSAPI_INC@
+-		${ISC_INCLUDES} ${MAXMINDDB_CFLAGS} \
+-		@DST_OPENSSL_INC@ @DST_GSSAPI_INC@
 +CINCLUDES =	-I. -I${top_srcdir}/lib/dns-pkcs11 -Iinclude ${DNS_PKCS11_INCLUDES} \
-+		${ISC_PKCS11_INCLUDES} @DST_OPENSSL_INC@ @DST_GSSAPI_INC@
++		${ISC_PKCS11_INCLUDES} ${MAXMINDDB_CFLAGS} @DST_OPENSSL_INC@ @DST_GSSAPI_INC@
  
 -CDEFINES =	-DUSE_MD5 @CRYPTO@ @USE_GSSAPI@ ${USE_ISC_SPNEGO}
 +CDEFINES =	-DUSE_MD5 @CRYPTO_PK11@ @USE_GSSAPI@ ${USE_ISC_SPNEGO}
@@ -479,9 +482,9 @@ index f6868d1..ea6fd36 100644
 -ISCDEPLIBS =	../../lib/isc/libisc.@A@
 +ISCDEPLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
  
- LIBS =		@LIBS@
+ LIBS =		${MAXMINDDB_LIBS} @LIBS@
  
-@@ -146,15 +146,15 @@ version.@O@: version.c
+@@ -150,15 +149,15 @@ version.@O@: version.c
  		-DLIBAGE=${LIBAGE} \
  		-c ${srcdir}/version.c
  
@@ -501,7 +504,7 @@ index f6868d1..ea6fd36 100644
  
  include: gen
  	${MAKE} include/dns/enumtype.h
-@@ -185,22 +185,22 @@ gen: gen.c
+@@ -189,22 +188,22 @@ gen: gen.c
  	${BUILD_CPPFLAGS} ${BUILD_LDFLAGS} -o $@ ${srcdir}/gen.c \
  	${BUILD_LIBS} ${LFS_LIBS}
  
diff --git a/bind-9.10-sdb.patch b/bind-9.10-sdb.patch
index 485e241..c72906c 100644
--- a/bind-9.10-sdb.patch
+++ b/bind-9.10-sdb.patch
@@ -14,7 +14,7 @@ index ce7a2da..4e6a824 100644
  
  @BIND9_MAKE_RULES@
 diff --git a/bin/named-sdb/Makefile.in b/bin/named-sdb/Makefile.in
-index 04dea99..4ff053e 100644
+index 9660965..184fbb2 100644
 --- a/bin/named-sdb/Makefile.in
 +++ b/bin/named-sdb/Makefile.in
 @@ -30,10 +30,10 @@ VERSION=@BIND9_VERSION@
@@ -31,7 +31,7 @@ index 04dea99..4ff053e 100644
  
  DLZ_DRIVER_DIR =	${top_srcdir}/contrib/dlz/drivers
  
-@@ -79,7 +79,7 @@ NOSYMLIBS =	${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
+@@ -80,7 +80,7 @@ NOSYMLIBS =	${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
  
  SUBDIRS =	unix
  
@@ -39,8 +39,8 @@ index 04dea99..4ff053e 100644
 +TARGETS =	named-sdb@EXEEXT@ feature-test-sdb@EXEEXT@
  
  GEOIPLINKOBJS = geoip.@O@
- 
-@@ -146,7 +146,7 @@ server.@O@: server.c
+ GEOIP2LINKOBJS = geoip.@O@
+@@ -154,7 +154,7 @@ server.@O@: server.c
  		-DPRODUCT=\"${PRODUCT}\" \
  		-DVERSION=\"${VERSION}\" -c ${srcdir}/server.c
  
@@ -49,7 +49,7 @@ index 04dea99..4ff053e 100644
  	export MAKE_SYMTABLE="yes"; \
  	export BASEOBJS="${OBJS} ${UOBJS}"; \
  	${FINALBUILDCMD}
-@@ -160,7 +160,7 @@ feature-test.@O@: ${top_srcdir}/bin/tests/system/feature-test.c
+@@ -168,7 +168,7 @@ feature-test.@O@: ${top_srcdir}/bin/tests/system/feature-test.c
  	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} \
  		-c ${top_srcdir}/bin/tests/system/feature-test.c
  
@@ -58,7 +58,7 @@ index 04dea99..4ff053e 100644
  	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} \
  		-o $@ feature-test.@O@ ${ISCLIBS} ${LIBS}
  
-@@ -182,8 +182,6 @@ statschannel.@O@: bind9.xsl.h
+@@ -190,8 +190,6 @@ statschannel.@O@: bind9.xsl.h
  
  installdirs:
  	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
@@ -67,7 +67,7 @@ index 04dea99..4ff053e 100644
  
  install-man5: named.conf.5
  	${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man5
-@@ -193,16 +191,11 @@ install-man8: named.8 lwresd.8
+@@ -201,16 +199,11 @@ install-man8: named.8 lwresd.8
  
  install-man: install-man5 install-man8
  
@@ -88,7 +88,7 @@ index 04dea99..4ff053e 100644
  @DLZ_DRIVER_RULES@
  
 diff --git a/bin/named-sdb/main.c b/bin/named-sdb/main.c
-index 17f2daa..1bb9d79 100644
+index 108b8d6..a943421 100644
 --- a/bin/named-sdb/main.c
 +++ b/bin/named-sdb/main.c
 @@ -93,6 +93,10 @@
@@ -102,7 +102,7 @@ index 17f2daa..1bb9d79 100644
  
  #ifdef CONTRIB_DLZ
  /*
-@@ -1063,6 +1067,11 @@ setup(void) {
+@@ -1069,6 +1073,11 @@ setup(void) {
  		ns_main_earlyfatal("isc_app_start() failed: %s",
  				   isc_result_totext(result));
  
@@ -114,7 +114,7 @@ index 17f2daa..1bb9d79 100644
  	isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
  		      ISC_LOG_NOTICE, "starting %s %s%s%s <id:%s>",
  		      ns_g_product, ns_g_version,
-@@ -1263,6 +1272,75 @@ setup(void) {
+@@ -1269,6 +1278,75 @@ setup(void) {
  				   isc_result_totext(result));
  #endif
  
@@ -190,7 +190,7 @@ index 17f2daa..1bb9d79 100644
  	ns_server_create(ns_g_mctx, &ns_g_server);
  
  #ifdef HAVE_LIBSECCOMP
-@@ -1305,6 +1383,11 @@ cleanup(void) {
+@@ -1311,6 +1389,11 @@ cleanup(void) {
  
  	dns_name_destroy();
  
@@ -203,22 +203,23 @@ index 17f2daa..1bb9d79 100644
  		      ISC_LOG_NOTICE, "exiting");
  	ns_log_shutdown();
 diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
-index 04dea99..9ed9637 100644
+index 9660965..03f7c05 100644
 --- a/bin/named/Makefile.in
 +++ b/bin/named/Makefile.in
-@@ -45,9 +45,9 @@ DLZDRIVER_LIBS =	@DLZ_DRIVER_LIBS@
+@@ -45,10 +45,10 @@ DLZDRIVER_LIBS =	@DLZ_DRIVER_LIBS@
  CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
  		${LWRES_INCLUDES} ${DNS_INCLUDES} ${BIND9_INCLUDES} \
  		${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} ${ISC_INCLUDES} \
--		${DLZDRIVER_INCLUDES} ${DBDRIVER_INCLUDES} @DST_OPENSSL_INC@
-+		@DST_OPENSSL_INC@
+-		${DLZDRIVER_INCLUDES} ${DBDRIVER_INCLUDES} ${MAXMINDDB_CFLAGS} \
++		${MAXMINDDB_CFLAGS} \
+ 		@DST_OPENSSL_INC@
  
 -CDEFINES =      @CONTRIB_DLZ@ @CRYPTO@
 +CDEFINES =      @CRYPTO@
  
  CWARNINGS =
  
-@@ -71,11 +71,11 @@ DEPLIBS =	${LWRESDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
+@@ -72,11 +72,11 @@ DEPLIBS =	${LWRESDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
  
  LIBS =		${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
  		${ISCCFGLIBS} ${ISCCCLIBS} ${ISCLIBS} \
@@ -232,7 +233,7 @@ index 04dea99..9ed9637 100644
  
  SUBDIRS =	unix
  
-@@ -90,8 +90,7 @@ OBJS =		builtin.@O@ client.@O@ config.@O@ control.@O@ \
+@@ -94,8 +94,7 @@ OBJS =		builtin.@O@ client.@O@ config.@O@ control.@O@ \
  		tkeyconf.@O@ tsigconf.@O@ update.@O@ xfrout.@O@ \
  		zoneconf.@O@ \
  		lwaddr.@O@ lwresd.@O@ lwdclient.@O@ lwderror.@O@ lwdgabn.@O@ \
@@ -242,7 +243,7 @@ index 04dea99..9ed9637 100644
  
  UOBJS =		unix/os.@O@ unix/dlz_dlopen_driver.@O@
  
-@@ -106,8 +105,7 @@ SRCS =		builtin.c client.c config.c control.c \
+@@ -113,8 +112,7 @@ SRCS =		builtin.c client.c config.c control.c \
  		tkeyconf.c tsigconf.c update.c xfrout.c \
  		zoneconf.c \
  		lwaddr.c lwresd.c lwdclient.c lwderror.c lwdgabn.c \
@@ -252,7 +253,7 @@ index 04dea99..9ed9637 100644
  
  MANPAGES =	named.8 lwresd.8 named.conf.5
  
-@@ -204,7 +202,5 @@ uninstall::
+@@ -212,7 +210,5 @@ uninstall::
  	rm -f ${DESTDIR}${sbindir}/lwresd@EXEEXT@
  	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/named@EXEEXT@
  
@@ -296,10 +297,10 @@ index c7e0868..95ab742 100644
 +	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zone2sqlite@EXEEXT@ ${DESTDIR}${sbindir}
  	${INSTALL_DATA} ${srcdir}/zone2ldap.1 ${DESTDIR}${mandir}/man1/zone2ldap.1
 diff --git a/configure.ac b/configure.ac
-index 8374385..0af9b71 100644
+index d8147ae..930cd1c 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -5436,6 +5436,8 @@ AC_CONFIG_FILES([
+@@ -5532,6 +5532,8 @@ AC_CONFIG_FILES([
  	bin/named/unix/Makefile
  	bin/named-pkcs11/Makefile
  	bin/named-pkcs11/unix/Makefile
@@ -308,7 +309,7 @@ index 8374385..0af9b71 100644
  	bin/nsupdate/Makefile
  	bin/pkcs11/Makefile
  	bin/python/Makefile
-@@ -5460,6 +5462,7 @@ AC_CONFIG_FILES([
+@@ -5556,6 +5558,7 @@ AC_CONFIG_FILES([
  	bin/python/isc/tests/dnskey_test.py
  	bin/python/isc/tests/policy_test.py
  	bin/rndc/Makefile
diff --git a/bind-9.11-feature-test-named.patch b/bind-9.11-feature-test-named.patch
index 9758c38..8d5ef9a 100644
--- a/bind-9.11-feature-test-named.patch
+++ b/bind-9.11-feature-test-named.patch
@@ -1,7 +1,7 @@
-From 4293078b294cbb766abe84d3b1618b1cb5413c82 Mon Sep 17 00:00:00 2001
+From d394129acaa40ec7fc68ab27802f0a01fcd50f3d Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Wed, 30 Jan 2019 14:37:17 +0100
-Subject: [PATCH 2/2] Create feature-test in source directory
+Subject: [PATCH] Create feature-test in source directory
 
 Feature-test tool is used in system tests to test compiled in changes.
 Because we build more variants of named with different configuration,
@@ -12,10 +12,10 @@ compile feature-test for each of them this way.
  2 files changed, 11 insertions(+), 2 deletions(-)
 
 diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
-index 1c413973d0..b31df9a718 100644
+index 3166368..df1f7ee 100644
 --- a/bin/named/Makefile.in
 +++ b/bin/named/Makefile.in
-@@ -79,7 +79,7 @@ NOSYMLIBS =	${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
+@@ -80,7 +80,7 @@ NOSYMLIBS =	${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
  
  SUBDIRS =	unix
  
@@ -23,8 +23,8 @@ index 1c413973d0..b31df9a718 100644
 +TARGETS =	named@EXEEXT@ lwresd@EXEEXT@ feature-test@EXEEXT@
  
  GEOIPLINKOBJS = geoip.@O@
- 
-@@ -151,6 +151,15 @@ lwresd@EXEEXT@: named@EXEEXT@
+ GEOIP2LINKOBJS = geoip.@O@
+@@ -163,6 +163,15 @@ lwresd@EXEEXT@: named@EXEEXT@
  	rm -f lwresd@EXEEXT@
  	@LN@ named@EXEEXT@ lwresd@EXEEXT@
  
@@ -41,10 +41,10 @@ index 1c413973d0..b31df9a718 100644
  
  docclean manclean maintainer-clean::
 diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
-index 2236f0a151..b072af8467 100644
+index 65c0c5a..117d6ec 100644
 --- a/bin/tests/system/conf.sh.in
 +++ b/bin/tests/system/conf.sh.in
-@@ -64,7 +64,7 @@ DNSTAPREAD=$TOP/bin/tools/dnstap-read
+@@ -71,7 +71,7 @@ DNSTAPREAD=$TOP/bin/tools/dnstap-read
  MDIG=$TOP/bin/tools/mdig
  NZD2NZF=$TOP/bin/tools/named-nzd2nzf
  FSTRM_CAPTURE=@FSTRM_CAPTURE@
diff --git a/bind-9.11-fips-tests.patch b/bind-9.11-fips-tests.patch
index b33e1bc..920440b 100644
--- a/bind-9.11-fips-tests.patch
+++ b/bind-9.11-fips-tests.patch
@@ -1,4 +1,4 @@
-From 230ca0ddbc95a043933c36c1d182f85cf0dcc971 Mon Sep 17 00:00:00 2001
+From d0e3f8be48c8031ebe3d7e1bf2a32cb03c79484e Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 2 Aug 2018 23:46:45 +0200
 Subject: [PATCH] FIPS tests changes
@@ -946,7 +946,7 @@ index 1e39862..4ed19ac 100755
  cat $infile $keyname1.key $keyname2.key >$zonefile
  
 diff --git a/bin/tests/system/dnssec/ns2/sign.sh b/bin/tests/system/dnssec/ns2/sign.sh
-index b93651a..09b12ba 100644
+index 13fb924..1ffa279 100644
 --- a/bin/tests/system/dnssec/ns2/sign.sh
 +++ b/bin/tests/system/dnssec/ns2/sign.sh
 @@ -126,8 +126,8 @@ zone=in-addr.arpa.
@@ -990,7 +990,7 @@ index ed30460..e6b1126 100644
 +    "." 256 3 8 "AwEAAarwAdjV4gIhpBCjXVAScRFEx3co7k8smJdxrnqoGsl5NB7EZ9jRdgvCXbJn6v8y9jlNWVHvaC8ilhfhLh0A1vLWiWv4ijd/12xcnrY7xpG7Cu3YkxUxaXJ7Jdg/Iw1+9mGgXF1v4UbCIcw/3U3cxyk7OxYg+VSb5KBAQSR0upxV";
  };
 diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh
-index 51dc117..48cb34b 100644
+index d07881d..17ad256 100644
 --- a/bin/tests/system/dnssec/tests.sh
 +++ b/bin/tests/system/dnssec/tests.sh
 @@ -3227,8 +3227,8 @@ do
@@ -1005,7 +1005,7 @@ index 51dc117..48cb34b 100644
  	8) size="-b 512";;
  	10) size="-b 1024";;
 diff --git a/bin/tests/system/feature-test.c b/bin/tests/system/feature-test.c
-index 3ac34e8..428d107 100644
+index 27a02d0..caf4166 100644
 --- a/bin/tests/system/feature-test.c
 +++ b/bin/tests/system/feature-test.c
 @@ -19,6 +19,7 @@
@@ -1016,15 +1016,15 @@ index 3ac34e8..428d107 100644
  #include <dns/edns.h>
  
  #ifdef WIN32
-@@ -45,6 +46,7 @@ usage() {
- 	fprintf(stderr, "	--have-geoip\n");
+@@ -46,6 +47,7 @@ usage() {
+ 	fprintf(stderr, "	--have-geoip2\n");
  	fprintf(stderr, "	--have-libxml2\n");
  	fprintf(stderr, "	--ipv6only=no\n");
 +	fprintf(stderr, "       --md5\n");
  	fprintf(stderr, "	--rpz-nsdname\n");
  	fprintf(stderr, "	--rpz-nsip\n");
  	fprintf(stderr, "	--with-idn\n");
-@@ -137,6 +139,18 @@ main(int argc, char **argv) {
+@@ -146,6 +148,18 @@ main(int argc, char **argv) {
  #endif
  	}
  
diff --git a/bind-9.11-kyua-pkcs11.patch b/bind-9.11-kyua-pkcs11.patch
index caf57bb..ac15d22 100644
--- a/bind-9.11-kyua-pkcs11.patch
+++ b/bind-9.11-kyua-pkcs11.patch
@@ -1,4 +1,4 @@
-From 17998f4feb9590522a0b50943075d9e8c97ec69d Mon Sep 17 00:00:00 2001
+From eb38d2278937ec3fe45d0af30cd080953bbb5b54 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Tue, 2 Jan 2018 18:13:07 +0100
 Subject: [PATCH] Fix pkcs11 variants atf tests
@@ -16,10 +16,10 @@ Add pkcs11 Kyuafile, fix dh_test to pass in pkcs11 mode
  6 files changed, 38 insertions(+), 16 deletions(-)
 
 diff --git a/configure.ac b/configure.ac
-index 7aff0e6..8374385 100644
+index 0532feb..a83ddd5 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -5512,6 +5512,7 @@ AC_CONFIG_FILES([
+@@ -5578,6 +5578,7 @@ AC_CONFIG_FILES([
  	lib/dns-pkcs11/include/Makefile
  	lib/dns-pkcs11/include/dns/Makefile
  	lib/dns-pkcs11/include/dst/Makefile
@@ -43,7 +43,7 @@ index 7c8bab0..eec9564 100644
  include('isccfg/Kyuafile')
  include('lwres/Kyuafile')
 diff --git a/lib/dns-pkcs11/tests/Makefile.in b/lib/dns-pkcs11/tests/Makefile.in
-index 9f1781a..e50463d 100644
+index 7671e1d..e237d5c 100644
 --- a/lib/dns-pkcs11/tests/Makefile.in
 +++ b/lib/dns-pkcs11/tests/Makefile.in
 @@ -17,12 +17,12 @@ VERSION=@BIND9_VERSION@
@@ -55,11 +55,11 @@ index 9f1781a..e50463d 100644
  
 -ISCLIBS =	../../isc/libisc.@A@
 -ISCDEPLIBS =	../../isc/libisc.@A@
--DNSLIBS =	../libdns.@A@ @DNS_CRYPTO_LIBS@
+-DNSLIBS =	../libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
 -DNSDEPLIBS =	../libdns.@A@
 +ISCLIBS =	../../isc-pkcs11/libisc-pkcs11.@A@
 +ISCDEPLIBS =	../../isc-pkcs11/libisc-pkcs11.@A@
-+DNSLIBS =	../libdns-pkcs11.@A@ @DNS_CRYPTO_LIBS@
++DNSLIBS =	../libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
 +DNSDEPLIBS =	../libdns-pkcs11.@A@
  
  LIBS =		@LIBS@ @CMOCKA_LIBS@
diff --git a/bind-9.11-rh1732883.patch b/bind-9.11-rh1732883.patch
index b312e63..80820b5 100644
--- a/bind-9.11-rh1732883.patch
+++ b/bind-9.11-rh1732883.patch
@@ -1,4 +1,4 @@
-From 9ac315c16bf8441145f5b4b8a3308ae9f03582ab Mon Sep 17 00:00:00 2001
+From 348947b3d573e2187db61fb43919d2260dcfc135 Mon Sep 17 00:00:00 2001
 From: Pavel Zhukov <pzhukov@redhat.com>
 Date: Wed, 24 Jul 2019 17:15:55 +0200
 Subject: [PATCH] Detect system time jumps
@@ -8,96 +8,93 @@ address dropped by the kernel due to lifetime expirity. Try to detect
 this situation using either monotonic time or saved timestamp and execute
 go_reboot() procedure to request lease extention
 ---
- lib/isc/include/isc/result.h    |  4 ++--
- lib/isc/include/isc/util.h      |  4 ++++
+ lib/isc/include/isc/result.h    |  3 ++-
+ lib/isc/include/isc/util.h      |  3 +++
  lib/isc/result.c                |  2 ++
- lib/isc/unix/app.c              | 41 +++++++++++++++++++++++++++++++--
- lib/isc/unix/include/isc/time.h | 20 ++++++++++++++++
- lib/isc/unix/time.c             | 22 ++++++++++++++++++
- 6 files changed, 89 insertions(+), 4 deletions(-)
+ lib/isc/unix/app.c              | 39 +++++++++++++++++++++++++++++----
+ lib/isc/unix/include/isc/time.h | 20 +++++++++++++++++
+ lib/isc/unix/time.c             | 22 +++++++++++++++++++
+ 6 files changed, 84 insertions(+), 5 deletions(-)
 
 diff --git a/lib/isc/include/isc/result.h b/lib/isc/include/isc/result.h
-index 246aefb..70d4b64 100644
+index 0fd4971..2add549 100644
 --- a/lib/isc/include/isc/result.h
 +++ b/lib/isc/include/isc/result.h
-@@ -83,9 +83,9 @@
- #define ISC_R_UNSET			61	/*%< unset */
- #define ISC_R_MULTIPLE			62	/*%< multiple */
- #define ISC_R_WOULDBLOCK		63	/*%< would block */
--
-+#define ISC_R_TIMESHIFTED               64      /*%< system time changed */
+@@ -87,9 +87,10 @@
+ #define ISC_R_CRYPTOFAILURE		65	/*%< cryptography library failure */
+ #define ISC_R_DISCQUOTA			66	/*%< disc quota */
+ #define ISC_R_DISCFULL			67	/*%< disc full */
++#define ISC_R_TIMESHIFTED               68      /*%< system time changed */
+ 
  /*% Not a result code: the number of results. */
--#define ISC_R_NRESULTS 			64
-+#define ISC_R_NRESULTS 			65
+-#define ISC_R_NRESULTS 			68
++#define ISC_R_NRESULTS 			69
  
  ISC_LANG_BEGINDECLS
  
 diff --git a/lib/isc/include/isc/util.h b/lib/isc/include/isc/util.h
-index 332dc0c..f81967d 100644
+index 973c348..8160dd3 100644
 --- a/lib/isc/include/isc/util.h
 +++ b/lib/isc/include/isc/util.h
-@@ -233,6 +233,10 @@
+@@ -289,6 +289,9 @@ extern void mock_assert(const int result, const char* const expression,
   * Time
   */
  #define TIME_NOW(tp) 	RUNTIME_CHECK(isc_time_now((tp)) == ISC_R_SUCCESS)
 +#ifdef CLOCK_BOOTTIME
 +#define TIME_MONOTONIC(tp) 	RUNTIME_CHECK(isc_time_boottime((tp)) == ISC_R_SUCCESS)
 +#endif
-+
  
  /*%
-  * Misc
+  * Alignment
 diff --git a/lib/isc/result.c b/lib/isc/result.c
-index a707c32..6776fc6 100644
+index abb6ed2..8c95a93 100644
 --- a/lib/isc/result.c
 +++ b/lib/isc/result.c
-@@ -99,6 +99,7 @@ static const char *description[ISC_R_NRESULTS] = {
- 	"unset",				/*%< 61 */
- 	"multiple",				/*%< 62 */
- 	"would block",				/*%< 63 */
-+        "time changed",                         /*%< 64 */
+@@ -103,6 +103,7 @@ static const char *description[ISC_R_NRESULTS] = {
+ 	"crypto failure",			/*%< 65 */
+ 	"disc quota",				/*%< 66 */
+ 	"disc full",				/*%< 67 */
++        "time changed",                         /*%< 68 */
  };
  
  static const char *identifier[ISC_R_NRESULTS] = {
-@@ -166,6 +167,7 @@ static const char *identifier[ISC_R_NRESULTS] = {
- 	"ISC_R_UNSET",
- 	"ISC_R_MULTIPLE",
- 	"ISC_R_WOULDBLOCK",
+@@ -174,6 +175,7 @@ static const char *identifier[ISC_R_NRESULTS] = {
+ 	"ISC_R_CRYPTOFAILURE",
+ 	"ISC_R_DISCQUOTA",
+ 	"ISC_R_DISCFULL",
 +        "ISC_R_TIMESHIFTED",
  };
  
  #define ISC_RESULT_RESULTSET			2
 diff --git a/lib/isc/unix/app.c b/lib/isc/unix/app.c
-index bace2bd..e9814d2 100644
+index 7e5a0ee..ceab74e 100644
 --- a/lib/isc/unix/app.c
 +++ b/lib/isc/unix/app.c
-@@ -441,15 +441,51 @@ isc__app_ctxonrun(isc_appctx_t *ctx0, isc_mem_t *mctx, isc_task_t *task,
+@@ -442,15 +442,48 @@ isc__app_ctxonrun(isc_appctx_t *ctx0, isc_mem_t *mctx, isc_task_t *task,
  static isc_result_t
  evloop(isc__appctx_t *ctx) {
  	isc_result_t result;
 +        isc_time_t now;
 +#ifdef CLOCK_BOOTTIME
 +        isc_time_t monotonic;
-+        isc_uint64_t diff  = 0;
++        uint64_t diff  = 0;
 +#else
 +        isc_time_t prev;
 +        TIME_NOW(&prev);
 +#endif
 +
-+
 +
  
  	while (!ctx->want_shutdown) {
  		int n;
 -		isc_time_t when, now;
 +		isc_time_t when;
-+                
  		struct timeval tv, *tvp;
  		isc_socketwait_t *swait;
- 		isc_boolean_t readytasks;
- 		isc_boolean_t call_timer_dispatch = ISC_FALSE;
- 
-+                isc_uint64_t us; 
+ 		bool readytasks;
+ 		bool call_timer_dispatch = false;
+-
++                uint64_t us;
 +
 +#ifdef CLOCK_BOOTTIME
 +                // TBD macros for following three lines
@@ -105,7 +102,7 @@ index bace2bd..e9814d2 100644
 +                TIME_MONOTONIC(&monotonic);
 +                INSIST(now.seconds > monotonic.seconds)
 +                us = isc_time_microdiff (&now, &monotonic);
-+                if (us < diff){ 
++                if (us < diff){
 +                  us = diff - us;
 +                  if (us > 1000000){ // ignoring shifts less than one second
 +                    return ISC_R_TIMESHIFTED;
@@ -120,27 +117,24 @@ index bace2bd..e9814d2 100644
 +                if (isc_time_compare (&now, &prev) < 0)
 +                  return ISC_R_TIMESHIFTED;
 +                TIME_NOW(&prev);
-+#endif                
++#endif
  		/*
  		 * Check the reload (or suspend) case first for exiting the
  		 * loop as fast as possible in case:
-@@ -474,9 +510,10 @@ evloop(isc__appctx_t *ctx) {
+@@ -475,8 +508,6 @@ evloop(isc__appctx_t *ctx) {
  			if (result != ISC_R_SUCCESS)
  				tvp = NULL;
  			else {
--				isc_uint64_t us;
-+
- 
+-				uint64_t us;
+-
  				TIME_NOW(&now);
-+
  				us = isc_time_microdiff(&when, &now);
  				if (us == 0)
- 					call_timer_dispatch = ISC_TRUE;
 diff --git a/lib/isc/unix/include/isc/time.h b/lib/isc/unix/include/isc/time.h
-index 75e24b9..de8b399 100644
+index b864c29..5dd43c9 100644
 --- a/lib/isc/unix/include/isc/time.h
 +++ b/lib/isc/unix/include/isc/time.h
-@@ -129,6 +129,26 @@ isc_time_isepoch(const isc_time_t *t);
+@@ -132,6 +132,26 @@ isc_time_isepoch(const isc_time_t *t);
   *\li	't' is a valid pointer.
   */
  
@@ -168,10 +162,10 @@ index 75e24b9..de8b399 100644
  isc_time_now(isc_time_t *t);
  /*%<
 diff --git a/lib/isc/unix/time.c b/lib/isc/unix/time.c
-index 2210240..d7613b8 100644
+index 8edc9df..fe0bb91 100644
 --- a/lib/isc/unix/time.c
 +++ b/lib/isc/unix/time.c
-@@ -496,3 +496,25 @@ isc_time_formatISO8601ms(const isc_time_t *t, char *buf, unsigned int len) {
+@@ -498,3 +498,25 @@ isc_time_formatISO8601ms(const isc_time_t *t, char *buf, unsigned int len) {
  			 t->nanoseconds / NS_PER_MS);
  	}
  }
diff --git a/bind-9.11-rt31459.patch b/bind-9.11-rt31459.patch
index 1eee414..bbb8948 100644
--- a/bind-9.11-rt31459.patch
+++ b/bind-9.11-rt31459.patch
@@ -1,4 +1,4 @@
-From 255fdf0b549ab2f138443ead0ac81bf864612217 Mon Sep 17 00:00:00 2001
+From f0eee3c150b9b913819ecd864581ba50dd4ae9cf Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Tue, 12 Sep 2017 19:05:46 -0700
 Subject: [PATCH] rebased rt31459c
@@ -48,8 +48,8 @@ Include new unit test
  lib/isc/include/isc/types.h              |   2 +
  lib/isc/pk11.c                           |  12 +-
  lib/isc/win32/include/isc/platform.h.in  |   5 +
- win32utils/Configure                     |  29 ++-
- 36 files changed, 703 insertions(+), 175 deletions(-)
+ win32utils/Configure                     |  28 ++-
+ 36 files changed, 702 insertions(+), 175 deletions(-)
  create mode 100644 lib/dns/tests/dstrandom_test.c
 
 diff --git a/bin/confgen/keygen.c b/bin/confgen/keygen.c
@@ -293,7 +293,7 @@ index fbc7ece..31a99e7 100644
  					   usekeyboard);
  
 diff --git a/bin/named/server.c b/bin/named/server.c
-index 0abbbed..405ff71 100644
+index 767d83f..d3c2f9d 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
 @@ -36,6 +36,7 @@
@@ -304,7 +304,7 @@ index 0abbbed..405ff71 100644
  #include <isc/portset.h>
  #include <isc/print.h>
  #include <isc/random.h>
-@@ -8210,6 +8211,10 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8208,6 +8209,10 @@ load_configuration(const char *filename, ns_server_t *server,
  				      "no source of entropy found");
  		} else {
  			const char *randomdev = cfg_obj_asstring(obj);
@@ -315,7 +315,7 @@ index 0abbbed..405ff71 100644
  			int level = ISC_LOG_ERROR;
  			result = isc_entropy_createfilesource(ns_g_entropy,
  							      randomdev);
-@@ -8244,6 +8249,7 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8242,6 +8247,7 @@ load_configuration(const char *filename, ns_server_t *server,
  				}
  				isc_entropy_detach(&ns_g_fallbackentropy);
  			}
@@ -689,7 +689,7 @@ index b27fc1d..e28871b 100644
  	parse_args(false, argc, argv);
  	if (server == NULL)
 diff --git a/configure b/configure
-index b219e16..4da30b9 100755
+index 4a5db6c..64aca10 100755
 --- a/configure
 +++ b/configure
 @@ -640,6 +640,7 @@ ac_includes_default="\
@@ -708,7 +708,7 @@ index b219e16..4da30b9 100755
  PKCS11_TEST
  PKCS11_ED25519
  PKCS11_GOST
-@@ -1038,6 +1040,7 @@ with_eddsa
+@@ -1047,6 +1049,7 @@ with_eddsa
  with_aes
  enable_openssl_hash
  with_cc_alg
@@ -716,7 +716,7 @@ index b219e16..4da30b9 100755
  with_lmdb
  with_libxml2
  with_libjson
-@@ -1734,6 +1737,7 @@ Optional Features:
+@@ -1746,6 +1749,7 @@ Optional Features:
    --enable-threads        enable multithreading
    --enable-native-pkcs11  use native PKCS11 for all crypto [default=no]
    --enable-openssl-hash   use OpenSSL for hash functions [default=no]
@@ -724,7 +724,7 @@ index b219e16..4da30b9 100755
    --enable-largefile      64-bit file support
    --enable-backtrace      log stack backtrace on abort [default=yes]
    --enable-symtable       use internal symbol table for backtrace
-@@ -16686,6 +16690,7 @@ case "$use_openssl" in
+@@ -17156,6 +17160,7 @@ case "$use_openssl" in
  $as_echo "disabled because of native PKCS11" >&6; }
  		DST_OPENSSL_INC=""
  		CRYPTO="-DPKCS11CRYPTO"
@@ -732,7 +732,7 @@ index b219e16..4da30b9 100755
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -16700,6 +16705,7 @@ $as_echo "disabled because of native PKCS11" >&6; }
+@@ -17170,6 +17175,7 @@ $as_echo "disabled because of native PKCS11" >&6; }
  $as_echo "no" >&6; }
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -740,7 +740,7 @@ index b219e16..4da30b9 100755
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -16712,6 +16718,7 @@ $as_echo "no" >&6; }
+@@ -17182,6 +17188,7 @@ $as_echo "no" >&6; }
  	auto)
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -748,7 +748,7 @@ index b219e16..4da30b9 100755
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -16721,7 +16728,7 @@ $as_echo "no" >&6; }
+@@ -17191,7 +17198,7 @@ $as_echo "no" >&6; }
  		OPENSSLLINKOBJS=""
  		OPENSSLLINKSRCS=""
  		as_fn_error $? "OpenSSL was not found in any of $openssldirs; use --with-openssl=/path
@@ -757,7 +757,7 @@ index b219e16..4da30b9 100755
  		;;
  	*)
  		if test "yes" = "$want_native_pkcs11"
-@@ -16752,6 +16759,7 @@ $as_echo "not found" >&6; }
+@@ -17222,6 +17229,7 @@ $as_echo "not found" >&6; }
  			as_fn_error $? "\"$use_openssl/include/openssl/opensslv.h\" not found" "$LINENO" 5
  		fi
  		CRYPTO='-DOPENSSL'
@@ -765,7 +765,7 @@ index b219e16..4da30b9 100755
  		if test "/usr" = "$use_openssl"
  		then
  			DST_OPENSSL_INC=""
-@@ -17413,8 +17421,6 @@ fi
+@@ -17883,8 +17891,6 @@ fi
  # Use OpenSSL for hash functions
  #
  
@@ -774,7 +774,7 @@ index b219e16..4da30b9 100755
  ISC_PLATFORM_OPENSSLHASH="#undef ISC_PLATFORM_OPENSSLHASH"
  case $want_openssl_hash in
  	yes)
-@@ -17789,6 +17795,86 @@ if test "rt" = "$have_clock_gt"; then
+@@ -18259,6 +18265,86 @@ if test "rt" = "$have_clock_gt"; then
  	LIBS="-lrt $LIBS"
  fi
  
@@ -861,7 +861,7 @@ index b219e16..4da30b9 100755
  #
  # was --with-lmdb specified?
  #
-@@ -19871,9 +19957,12 @@ _ACEOF
+@@ -20341,9 +20427,12 @@ _ACEOF
  if ac_fn_c_try_compile "$LINENO"; then :
    { $as_echo "$as_me:${as_lineno-$LINENO}: result: size_t for buflen; int for flags" >&5
  $as_echo "size_t for buflen; int for flags" >&6; }
@@ -876,7 +876,7 @@ index b219e16..4da30b9 100755
  
  	 $as_echo "#define IRS_GETNAMEINFO_FLAGS_T int" >>confdefs.h
  
-@@ -21188,12 +21277,7 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
+@@ -21658,12 +21747,7 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
  ISC_PLATFORM_USESTDASM="#undef ISC_PLATFORM_USESTDASM"
  ISC_PLATFORM_USEMACASM="#undef ISC_PLATFORM_USEMACASM"
  if test "yes" = "$use_atomic"; then
@@ -890,7 +890,7 @@ index b219e16..4da30b9 100755
  # version HP92453-01 B.11.11.23709.GP, which incorrectly rejects
  # declarations like `int a3[[(sizeof (unsigned char)) >= 0]];'.
  # This bug is HP SR number 8606223364.
-@@ -21226,6 +21310,11 @@ cat >>confdefs.h <<_ACEOF
+@@ -21696,6 +21780,11 @@ cat >>confdefs.h <<_ACEOF
  _ACEOF
  
  
@@ -902,7 +902,7 @@ index b219e16..4da30b9 100755
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -21234,39 +21323,6 @@ _ACEOF
+@@ -21704,39 +21793,6 @@ _ACEOF
  		fi
  	;;
  	x86_64-*|amd64-*)
@@ -942,7 +942,7 @@ index b219e16..4da30b9 100755
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -21297,6 +21353,10 @@ $as_echo_n "checking architecture type for atomic operations... " >&6; }
+@@ -21767,6 +21823,10 @@ $as_echo_n "checking architecture type for atomic operations... " >&6; }
  $as_echo "$arch" >&6; }
  fi
  
@@ -953,7 +953,7 @@ index b219e16..4da30b9 100755
  if test "yes" = "$have_atomic"; then
  	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking compiler support for inline assembly code" >&5
  $as_echo_n "checking compiler support for inline assembly code... " >&6; }
-@@ -23896,6 +23956,30 @@ CFLAGS="$CFLAGS $SO_CFLAGS"
+@@ -24372,6 +24432,30 @@ CFLAGS="$CFLAGS $SO_CFLAGS"
  #
  dlzdir='${DLZ_DRIVER_DIR}'
  
@@ -984,7 +984,7 @@ index b219e16..4da30b9 100755
  #
  # Private autoconf macro to simplify configuring drivers:
  #
-@@ -24226,11 +24310,11 @@ $as_echo "no" >&6; }
+@@ -24702,11 +24786,11 @@ $as_echo "no" >&6; }
  $as_echo "using mysql with libs ${mysql_lib} and includes ${mysql_include}" >&6; }
  		;;
  	*)
@@ -999,7 +999,7 @@ index b219e16..4da30b9 100755
  		fi
  
  	CONTRIB_DLZ="$CONTRIB_DLZ -DDLZ_MYSQL"
-@@ -24315,7 +24399,7 @@ $as_echo "" >&6; }
+@@ -24791,7 +24875,7 @@ $as_echo "" >&6; }
  			# Check other locations for includes.
  			# Order is important (sigh).
  
@@ -1008,7 +1008,7 @@ index b219e16..4da30b9 100755
  			# include a blank element first
  			for d in "" $bdb_incdirs
  			do
-@@ -24340,57 +24424,9 @@ $as_echo "" >&6; }
+@@ -24816,57 +24900,9 @@ $as_echo "" >&6; }
  			bdb_libnames="db53 db-5.3 db51 db-5.1 db48 db-4.8 db47 db-4.7 db46 db-4.6 db45 db-4.5 db44 db-4.4 db43 db-4.3 db42 db-4.2 db41 db-4.1 db"
  			for d in $bdb_libnames
  			do
@@ -1068,7 +1068,7 @@ index b219e16..4da30b9 100755
  					break
  				fi
  			done
-@@ -24549,10 +24585,10 @@ $as_echo "no" >&6; }
+@@ -25025,10 +25061,10 @@ $as_echo "no" >&6; }
  		DLZ_DRIVER_INCLUDES="$DLZ_DRIVER_INCLUDES -I$use_dlz_ldap/include"
  		DLZ_DRIVER_LDAP_INCLUDES="-I$use_dlz_ldap/include"
  	fi
@@ -1082,7 +1082,7 @@ index b219e16..4da30b9 100755
  	fi
  
  
-@@ -24638,11 +24674,11 @@ fi
+@@ -25114,11 +25150,11 @@ fi
  		odbcdirs="/usr /usr/local /usr/pkg"
  		for d in $odbcdirs
  		do
@@ -1096,7 +1096,7 @@ index b219e16..4da30b9 100755
  				break
  			fi
  		done
-@@ -24917,6 +24953,8 @@ DNS_CRYPTO_LIBS="$NEWFLAGS"
+@@ -25393,6 +25429,8 @@ DNS_CRYPTO_LIBS="$NEWFLAGS"
  
  
  
@@ -1105,7 +1105,7 @@ index b219e16..4da30b9 100755
  #
  # Commands to run at the end of config.status.
  # Don't just put these into configure, it won't work right if somebody
-@@ -27295,6 +27333,8 @@ report() {
+@@ -27772,6 +27810,8 @@ report() {
  	    echo "    IPv6 support (--enable-ipv6)"
  	test "X$CRYPTO" = "X" -o "yes" = "$want_native_pkcs11" || \
  		echo "    OpenSSL cryptography/DNSSEC (--with-openssl)"
@@ -1114,7 +1114,7 @@ index b219e16..4da30b9 100755
  	test "X$PYTHON" = "X" || echo "    Python tools (--with-python)"
  	test "X$XMLSTATS" = "X" || echo "    XML statistics (--with-libxml2)"
  	test "X$JSONSTATS" = "X" || echo "    JSON statistics (--with-libjson)"
-@@ -27335,6 +27375,8 @@ report() {
+@@ -27812,6 +27852,8 @@ report() {
  	echo "    Very verbose query trace logging (--enable-querytrace)"
      test "no" = "$with_cmocka" || echo "    CMocka Unit Testing Framework (--with-cmocka)"
  
@@ -1123,7 +1123,7 @@ index b219e16..4da30b9 100755
      echo "    Dynamically loadable zone (DLZ) drivers:"
      test "no" = "$use_dlz_bdb" || \
  	echo "        Berkeley DB (--with-dlz-bdb)"
-@@ -27382,6 +27424,8 @@ report() {
+@@ -27859,6 +27901,8 @@ report() {
  	echo "    ECDSA algorithm support (--with-ecdsa)"
      test "X$CRYPTO" = "X" -o "yes" = "$OPENSSL_ED25519" -o "yes" = "$PKCS11_ED25519" || \
  	echo "    EDDSA algorithm support (--with-eddsa)"
@@ -1133,10 +1133,10 @@ index b219e16..4da30b9 100755
      test "yes" = "$enable_seccomp" || \
  	echo "    Use libseccomp system call filtering (--enable-seccomp)"
 diff --git a/configure.ac b/configure.ac
-index 7fd192c..5e4e839 100644
+index 0dc552c..3b88105 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -1514,6 +1514,7 @@ case "$use_openssl" in
+@@ -1572,6 +1572,7 @@ case "$use_openssl" in
  		AC_MSG_RESULT(disabled because of native PKCS11)
  		DST_OPENSSL_INC=""
  		CRYPTO="-DPKCS11CRYPTO"
@@ -1144,7 +1144,7 @@ index 7fd192c..5e4e839 100644
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -1527,6 +1528,7 @@ case "$use_openssl" in
+@@ -1585,6 +1586,7 @@ case "$use_openssl" in
  		AC_MSG_RESULT(no)
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -1152,7 +1152,7 @@ index 7fd192c..5e4e839 100644
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -1539,6 +1541,7 @@ case "$use_openssl" in
+@@ -1597,6 +1599,7 @@ case "$use_openssl" in
  	auto)
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -1160,7 +1160,7 @@ index 7fd192c..5e4e839 100644
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -1549,7 +1552,7 @@ case "$use_openssl" in
+@@ -1607,7 +1610,7 @@ case "$use_openssl" in
  		OPENSSLLINKSRCS=""
  		AC_MSG_ERROR(
  [OpenSSL was not found in any of $openssldirs; use --with-openssl=/path
@@ -1169,7 +1169,7 @@ index 7fd192c..5e4e839 100644
  		;;
  	*)
  		if test "yes" = "$want_native_pkcs11"
-@@ -1579,6 +1582,7 @@ If you don't want OpenSSL, use --without-openssl])
+@@ -1637,6 +1640,7 @@ If you don't want OpenSSL, use --without-openssl])
  			AC_MSG_ERROR(["$use_openssl/include/openssl/opensslv.h" not found])
  		fi
  		CRYPTO='-DOPENSSL'
@@ -1177,7 +1177,7 @@ index 7fd192c..5e4e839 100644
  		if test "/usr" = "$use_openssl"
  		then
  			DST_OPENSSL_INC=""
-@@ -2052,7 +2056,6 @@ fi
+@@ -2110,7 +2114,6 @@ fi
  # Use OpenSSL for hash functions
  #
  
@@ -1185,7 +1185,7 @@ index 7fd192c..5e4e839 100644
  ISC_PLATFORM_OPENSSLHASH="#undef ISC_PLATFORM_OPENSSLHASH"
  case $want_openssl_hash in
  	yes)
-@@ -2324,6 +2327,67 @@ if test "rt" = "$have_clock_gt"; then
+@@ -2382,6 +2385,67 @@ if test "rt" = "$have_clock_gt"; then
  	LIBS="-lrt $LIBS"
  fi
  
@@ -1253,7 +1253,7 @@ index 7fd192c..5e4e839 100644
  #
  # was --with-lmdb specified?
  #
-@@ -4120,12 +4184,12 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
+@@ -4178,12 +4242,12 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
  ISC_PLATFORM_USESTDASM="#undef ISC_PLATFORM_USESTDASM"
  ISC_PLATFORM_USEMACASM="#undef ISC_PLATFORM_USEMACASM"
  if test "yes" = "$use_atomic"; then
@@ -1267,7 +1267,7 @@ index 7fd192c..5e4e839 100644
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -4134,7 +4198,6 @@ if test "yes" = "$use_atomic"; then
+@@ -4192,7 +4256,6 @@ if test "yes" = "$use_atomic"; then
  		fi
  	;;
  	x86_64-*|amd64-*)
@@ -1275,7 +1275,7 @@ index 7fd192c..5e4e839 100644
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -5543,6 +5606,8 @@ report() {
+@@ -5607,6 +5670,8 @@ report() {
  	    echo "    IPv6 support (--enable-ipv6)"
  	test "X$CRYPTO" = "X" -o "yes" = "$want_native_pkcs11" || \
  		echo "    OpenSSL cryptography/DNSSEC (--with-openssl)"
@@ -1284,7 +1284,7 @@ index 7fd192c..5e4e839 100644
  	test "X$PYTHON" = "X" || echo "    Python tools (--with-python)"
  	test "X$XMLSTATS" = "X" || echo "    XML statistics (--with-libxml2)"
  	test "X$JSONSTATS" = "X" || echo "    JSON statistics (--with-libjson)"
-@@ -5583,6 +5648,8 @@ report() {
+@@ -5647,6 +5712,8 @@ report() {
  	echo "    Very verbose query trace logging (--enable-querytrace)"
      test "no" = "$with_cmocka" || echo "    CMocka Unit Testing Framework (--with-cmocka)"
  
@@ -1293,7 +1293,7 @@ index 7fd192c..5e4e839 100644
      echo "    Dynamically loadable zone (DLZ) drivers:"
      test "no" = "$use_dlz_bdb" || \
  	echo "        Berkeley DB (--with-dlz-bdb)"
-@@ -5630,6 +5697,8 @@ report() {
+@@ -5694,6 +5761,8 @@ report() {
  	echo "    ECDSA algorithm support (--with-ecdsa)"
      test "X$CRYPTO" = "X" -o "yes" = "$OPENSSL_ED25519" -o "yes" = "$PKCS11_ED25519" || \
  	echo "    EDDSA algorithm support (--with-eddsa)"
@@ -1693,7 +1693,7 @@ index 937b548..f3c0e38 100644
  tap_test_program{name='gost_test'}
  tap_test_program{name='keytable_test'}
 diff --git a/lib/dns/tests/Makefile.in b/lib/dns/tests/Makefile.in
-index 0897579..9f1781a 100644
+index 90dc3a6..7671e1d 100644
 --- a/lib/dns/tests/Makefile.in
 +++ b/lib/dns/tests/Makefile.in
 @@ -37,6 +37,7 @@ SRCS =		acl_test.c \
@@ -2016,10 +2016,10 @@ index 5b8a2c9..913a2ce 100644
   * Define if the hash functions must be provided by OpenSSL.
   */
 diff --git a/win32utils/Configure b/win32utils/Configure
-index 27b00af..7e35d60 100644
+index 93939f3..8bacf54 100644
 --- a/win32utils/Configure
 +++ b/win32utils/Configure
-@@ -380,6 +380,7 @@ my @substdefh = ("AES_CC",
+@@ -381,6 +381,7 @@ my @substdefh = ("AES_CC",
  my %configdefp;
  
  my @substdefp = ("ISC_PLATFORM_BUSYWAITNOP",
@@ -2027,7 +2027,7 @@ index 27b00af..7e35d60 100644
                   "ISC_PLATFORM_HAVEATOMICSTORE",
                   "ISC_PLATFORM_HAVEATOMICSTOREQ",
                   "ISC_PLATFORM_HAVECMPXCHG",
-@@ -509,7 +510,8 @@ my @allcond = (@substcond, "NOTYET", "NOLONGER");
+@@ -511,7 +512,8 @@ my @allcond = (@substcond, "NOTYET", "NOLONGER");
  
  # enable-xxx/disable-xxx
  
@@ -2037,7 +2037,7 @@ index 27b00af..7e35d60 100644
                    "fixed-rrset",
                    "intrinsics",
                    "isc-spnego",
-@@ -572,6 +574,7 @@ my @help = (
+@@ -575,6 +577,7 @@ my @help = (
  "\nOptional Features:\n",
  "  enable-intrinsics     enable instrinsic/atomic functions [default=yes]\n",
  "  enable-native-pkcs11  use native PKCS#11 for all crypto [default=no]\n",
@@ -2045,7 +2045,7 @@ index 27b00af..7e35d60 100644
  "  enable-openssl-hash   use OpenSSL for hash functions [default=yes]\n",
  "  enable-isc-spnego     use SPNEGO from lib/dns [default=yes]\n",
  "  enable-filter-aaaa    enable filtering of AAAA records [default=yes]\n",
-@@ -616,7 +619,9 @@ my $want_clean = "no";
+@@ -620,7 +623,9 @@ my $want_clean = "no";
  my $want_unknown = "no";
  my $unknown_value;
  my $enable_intrinsics = "yes";
@@ -2055,7 +2055,7 @@ index 27b00af..7e35d60 100644
  my $enable_openssl_hash = "auto";
  my $enable_filter_aaaa = "yes";
  my $enable_isc_spnego = "yes";
-@@ -834,6 +839,10 @@ sub myenable {
+@@ -840,6 +845,10 @@ sub myenable {
          if ($val =~ /^yes$/i) {
              $enable_native_pkcs11 = "yes";
          }
@@ -2066,7 +2066,7 @@ index 27b00af..7e35d60 100644
      } elsif ($key =~ /^openssl-hash$/i) {
          if ($val =~ /^yes$/i) {
              $enable_openssl_hash = "yes";
-@@ -1125,6 +1134,11 @@ if ($verbose) {
+@@ -1142,6 +1151,11 @@ if ($verbose) {
      } else {
          print "native-pkcs11: disabled\n";
      }
@@ -2078,7 +2078,7 @@ index 27b00af..7e35d60 100644
      if ($enable_openssl_hash eq "yes") {
          print "openssl-hash: enabled\n";
      } else {
-@@ -1478,6 +1492,7 @@ if ($enable_intrinsics eq "yes") {
+@@ -1500,6 +1514,7 @@ if ($enable_intrinsics eq "yes") {
  
  # enable-native-pkcs11
  if ($enable_native_pkcs11 eq "yes") {
@@ -2086,7 +2086,7 @@ index 27b00af..7e35d60 100644
      if ($use_openssl eq "auto") {
          $use_openssl = "no";
      }
-@@ -1687,6 +1702,7 @@ if ($use_openssl eq "yes") {
+@@ -1709,6 +1724,7 @@ if ($use_openssl eq "yes") {
          $openssl_dll = File::Spec->catdir($openssl_path, "@dirlist[0]");
      }   
  
@@ -2094,7 +2094,7 @@ index 27b00af..7e35d60 100644
      $configcond{"OPENSSL"} = 1;
      $configdefd{"CRYPTO"} = "OPENSSL";
      $configvar{"OPENSSL_PATH"} = "$openssl_path";
-@@ -2238,6 +2254,15 @@ if ($cookie_algorithm eq "sha1") {
+@@ -2260,6 +2276,15 @@ if ($cookie_algorithm eq "sha1") {
      die "Unrecognized cookie algorithm: $cookie_algorithm\n";
  }
  
@@ -2110,7 +2110,7 @@ index 27b00af..7e35d60 100644
  # enable-openssl-hash
  if ($enable_openssl_hash eq "yes") {
      if ($use_openssl eq "no") {
-@@ -3564,6 +3589,7 @@ exit 0;
+@@ -3635,6 +3660,7 @@ exit 0;
  #  --enable-developer partially supported
  #  --enable-newstats (9.9/9.9sub only)
  #  --enable-native-pkcs11 supported
@@ -2118,14 +2118,6 @@ index 27b00af..7e35d60 100644
  #  --enable-openssl-version-check included without a way to disable it
  #  --enable-openssl-hash supported
  #  --enable-threads included without a way to disable it
-@@ -3589,6 +3615,7 @@ exit 0;
- #  --with-gost supported
- #  --with-aes supported
- #  --with-cc-alg supported
-+#  --with-randomdev not supported on WIN32 (makes no sense)
- #  --with-geoip supported
- #  --with-gssapi supported with MIT (K)erberos (f)or (W)indows
- #  --with-lmdb no supported on WIN32 (port is not reliable)
 -- 
 2.20.1
 

From 448b6647dce4f9a8cc5c7c09b17faa5efb9196da Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 24 Jul 2019 19:20:21 +0200
Subject: [PATCH 038/460] Solve conflicting jsoncpp-devel and json-c-devel

---
 bind-9.11-json-c.patch | 50 ++++++++++++++++++++++++++++++++++++++++++
 bind.spec              |  3 +++
 2 files changed, 53 insertions(+)
 create mode 100644 bind-9.11-json-c.patch

diff --git a/bind-9.11-json-c.patch b/bind-9.11-json-c.patch
new file mode 100644
index 0000000..95e5597
--- /dev/null
+++ b/bind-9.11-json-c.patch
@@ -0,0 +1,50 @@
+From cb6d2019766a6c8c5516fd8859cedf0052f03293 Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Thu, 25 Jul 2019 11:37:57 +0200
+Subject: [PATCH] Skip support of jsoncpp
+
+Bind cannot be compiled when jsoncpp-devel is installed. Remove support
+for jsoncpp, use only json-c-devel. Bind 9.15 has already support for
+--with-json-c, do not yet introduce it.
+---
+ configure.ac | 17 ++---------------
+ 1 file changed, 2 insertions(+), 15 deletions(-)
+
+diff --git a/configure.ac b/configure.ac
+index 6d05337..5ce83b5 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -2594,15 +2594,7 @@ case "$use_libjson" in
+ 	auto|yes)
+ 		for d in /usr /usr/local /opt/local
+ 		do
+-			if test -f "${d}/include/json/json.h"
+-			then
+-				if test ${d} != /usr
+-				then
+-					libjson_cflags="-I ${d}/include"
+-					LIBS="$LIBS -L${d}/lib"
+-				fi
+-				have_libjson="yes"
+-			elif test -f "${d}/include/json-c/json.h"
++			if test -f "${d}/include/json-c/json.h"
+ 			then
+ 				if test ${d} != /usr
+ 				then
+@@ -2615,12 +2607,7 @@ case "$use_libjson" in
+ 		done
+ 		;;
+ 	*)
+-		if test -f "${use_libjson}/include/json/json.h"
+-		then
+-			libjson_cflags="-I${use_libjson}/include"
+-			LIBS="$LIBS -L${use_libjson}/lib"
+-			have_libjson="yes"
+-		elif test -f "${use_libjson}/include/json-c/json.h"
++		if test -f "${use_libjson}/include/json-c/json.h"
+ 		then
+ 			libjson_cflags="-I${use_libjson}/include"
+ 			LIBS="$LIBS -L${use_libjson}/lib"
+-- 
+2.20.1
+
diff --git a/bind.spec b/bind.spec
index 6967958..eb71b48 100644
--- a/bind.spec
+++ b/bind.spec
@@ -139,6 +139,8 @@ Patch170:bind-9.11-feature-test-named.patch
 Patch171:bind-9.11-tests-variants.patch
 Patch172:bind-9.11-tests-pkcs11.patch
 Patch173:bind-9.11-rh1732883.patch
+# Make sure jsonccp-devel does not interfere
+Patch174:bind-9.11-json-c.patch
 
 # SDB patches
 Patch11: bind-9.3.2b2-sdbsrc.patch
@@ -519,6 +521,7 @@ are used for building ISC DHCP.
 %patch171 -p1 -b .test-variant
 %patch172 -p1 -b .test-pkcs11
 %patch173 -p1 -b .rh1732883
+%patch174 -p1 -b .json-c
 
 mkdir lib/dns/tests/testdata/dstrandom
 cp -a %{SOURCE50} lib/dns/tests/testdata/dstrandom/random.data

From b4e74efbf2d3f53bfbd8fa252d3618efa70eaf51 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 24 Jul 2019 14:28:06 +0200
Subject: [PATCH 039/460] Enable GeoLite2 support

Make GeoIP support controlled by bcond, defaults to off now.
Instead enable GeoLite2 support.
---
 bind.spec | 28 +++++++++++++++++++++++++---
 1 file changed, 25 insertions(+), 3 deletions(-)

diff --git a/bind.spec b/bind.spec
index eb71b48..c41b426 100644
--- a/bind.spec
+++ b/bind.spec
@@ -20,6 +20,10 @@
 %bcond_without DNSTAP
 %bcond_without DLZ
 %bcond_without EXPORT_LIBS
+# Legacy GeoIP support
+%bcond_with    GEOIP
+# New MaxMind GeoLite support
+%bcond_without GEOIP2
 %if 0%{?fedora} >= 28
 %bcond_without UNITTEST
 %else
@@ -171,7 +175,7 @@ Requires(post): ((selinux-policy and selinux-policy-base) if (selinux-policy-tar
 Recommends:     bind-utils bind-dnssec-utils
 BuildRequires:  gcc, make
 BuildRequires:  openssl-devel, libtool, autoconf, pkgconfig, libcap-devel
-BuildRequires:  libidn2-devel, libxml2-devel, GeoIP-devel
+BuildRequires:  libidn2-devel, libxml2-devel
 BuildRequires:  systemd
 BuildRequires:  selinux-policy
 # needed for %%{__python3} macro
@@ -202,6 +206,12 @@ BuildRequires:  lmdb-devel
 %if %{with JSON}
 BuildRequires:  json-c-devel
 %endif
+%if %{with GEOIP}
+BuildRequires:  GeoIP-devel
+%endif
+%if %{with GEOIP2}
+BuildRequires:  libmaxminddb-devel
+%endif
 %if %{with DNSTAP}
 BuildRequires:  fstrm-devel protobuf-c-devel
 %endif
@@ -355,7 +365,7 @@ required for development with ISC BIND 9
 %package lite-devel
 Summary:  Lite version of header files and libraries needed for BIND DNS development
 Requires: bind-libs-lite%{?_isa} = %{epoch}:%{version}-%{release}
-Requires: openssl-devel%{?_isa} GeoIP-devel%{?_isa} libxml2-devel%{?_isa}
+Requires: openssl-devel%{?_isa} libxml2-devel%{?_isa}
 %if %{with GSSTSIG}
 Requires: krb5-devel%{?_isa}
 %endif
@@ -368,6 +378,12 @@ Requires:  json-c-devel%{?_isa}
 %if %{with DNSTAP}
 Requires:  fstrm-devel%{?_isa} protobuf-c-devel%{?_isa}
 %endif
+%if %{with GEOIP}
+Requires:  GeoIP-devel%{?_isa}
+%endif
+%if %{with GEOIP2}
+Requires:  libmaxminddb-devel%{?_isa}
+%endif
 
 %description lite-devel
 The bind-lite-devel package contains lite version of the header
@@ -623,9 +639,14 @@ export LIBDIR_SUFFIX
   --disable-static \
   --includedir=%{_includedir}/bind9 \
   --with-tuning=large \
-  --with-geoip \
   --with-libidn2 \
   --enable-openssl-hash \
+%if %{with GEOIP}
+  --with-geoip \
+%endif
+%if %{with GEOIP2}
+  --with-geoip2 \
+%endif
 %if %{with PKCS11}
   --enable-native-pkcs11 \
   --with-pkcs11=%{_libdir}/pkcs11/libsofthsm2.so \
@@ -1518,6 +1539,7 @@ fi;
 %changelog
 * Wed Jul 24 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.9-1
 - Update to 9.11.9
+- Add GeoLite2 support
 
 * Wed Jul 24 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.8-2
 - Use monotonic time in export library (#1732883)

From fac5ed036c0e601da3d1f40c1cfa78f401220cf8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 31 Jul 2019 16:46:11 +0200
Subject: [PATCH 040/460] Disable building of export-libs

DHCP no longer needs export libs, stop building them.
---
 bind.spec | 21 ++++++++++++---------
 1 file changed, 12 insertions(+), 9 deletions(-)

diff --git a/bind.spec b/bind.spec
index c41b426..6db85bf 100644
--- a/bind.spec
+++ b/bind.spec
@@ -19,7 +19,7 @@
 %bcond_without JSON
 %bcond_without DNSTAP
 %bcond_without DLZ
-%bcond_without EXPORT_LIBS
+%bcond_with    EXPORT_LIBS
 # Legacy GeoIP support
 %bcond_with    GEOIP
 # New MaxMind GeoLite support
@@ -820,14 +820,16 @@ sed -e "/^\s*include(/ d" -e 's/^-- use //' \
   fi;
   popd
 
-  pushd export-libs
-  make unit
-  e=$?
-  if [ "$e" -ne 0 ]; then
-    echo "ERROR: this build of BIND export-libs failed 'make unit'. Aborting."
-    exit $e;
-  fi;
-  popd
+  %if %{with EXPORT_LIBS}
+    pushd export-libs
+    make unit
+    e=$?
+    if [ "$e" -ne 0 ]; then
+      echo "ERROR: this build of BIND export-libs failed 'make unit'. Aborting."
+      exit $e;
+    fi;
+    popd
+  %endif
 
 %endif
 
@@ -1540,6 +1542,7 @@ fi;
 * Wed Jul 24 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.9-1
 - Update to 9.11.9
 - Add GeoLite2 support
+- Disable export-libs
 
 * Wed Jul 24 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.8-2
 - Use monotonic time in export library (#1732883)

From dab22dd2c2d8b72f1cfa31af9e716b392a978912 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 8 Aug 2019 13:51:16 +0200
Subject: [PATCH 041/460] Permit explicit disabling of RSAMD5 in FIPS mode
 (#1709553)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When MD5 is disabled in library, it behaved like RSAMD5 were unknown.
But security-policy disables it explicitly. It failed to even start in
FIPS mode, because such algorithm were unknown. Fix disabled algorithm
to return disabled result code. Accept such algorithm only when
disabling it.

Signed-off-by: Petr Menšík <pemensik@redhat.com>
---
 bind-9.11-fips-disable.patch | 97 ++++++++++++++++++++++++++++++++++++
 bind.spec                    |  7 ++-
 2 files changed, 103 insertions(+), 1 deletion(-)
 create mode 100644 bind-9.11-fips-disable.patch

diff --git a/bind-9.11-fips-disable.patch b/bind-9.11-fips-disable.patch
new file mode 100644
index 0000000..525316a
--- /dev/null
+++ b/bind-9.11-fips-disable.patch
@@ -0,0 +1,97 @@
+From df23c869f8973bc9494dcdc86ef46070d8194897 Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Mon, 5 Aug 2019 11:54:03 +0200
+Subject: [PATCH] Allow explicit disabling of autodisabled MD5
+
+Default security policy might include explicitly disabled RSAMD5
+algorithm. Current FIPS code automatically disables in FIPS mode. But if
+RSAMD5 is included in security policy, it fails to start, because that
+algorithm is not recognized. Allow it disabled, but fail on any
+other usage.
+---
+ bin/named/server.c |  2 +-
+ lib/dns/rcode.c    | 31 +++++++++++++------------------
+ 2 files changed, 14 insertions(+), 19 deletions(-)
+
+diff --git a/bin/named/server.c b/bin/named/server.c
+index 3cd49a9..ef82d89 100644
+--- a/bin/named/server.c
++++ b/bin/named/server.c
+@@ -1551,7 +1551,7 @@ disable_algorithms(const cfg_obj_t *disabled, dns_resolver_t *resolver) {
+ 			result = isc_parse_uint8(&ui, r.base, 10);
+ 			alg = ui;
+ 		}
+-		if (result != ISC_R_SUCCESS) {
++		if (result != ISC_R_SUCCESS && result != ISC_R_DISABLED) {
+ 			cfg_obj_log(cfg_listelt_value(element),
+ 				    ns_g_lctx, ISC_LOG_ERROR,
+ 				    "invalid algorithm");
+diff --git a/lib/dns/rcode.c b/lib/dns/rcode.c
+index f51d548..8dbb12d 100644
+--- a/lib/dns/rcode.c
++++ b/lib/dns/rcode.c
+@@ -126,7 +126,6 @@
+ #endif
+ 
+ #define SECALGNAMES \
+-	MD5_SECALGNAMES \
+ 	DH_SECALGNAMES \
+ 	DSA_SECALGNAMES \
+ 	{ DNS_KEYALG_ECC, "ECC", 0 }, \
+@@ -178,6 +177,7 @@ static struct tbl rcodes[] = { RCODENAMES ERCODENAMES };
+ static struct tbl tsigrcodes[] = { RCODENAMES TSIGRCODENAMES };
+ static struct tbl certs[] = { CERTNAMES };
+ static struct tbl secalgs[] = { SECALGNAMES };
++static struct tbl md5_secalgs[] = { MD5_SECALGNAMES };
+ static struct tbl secprotos[] = { SECPROTONAMES };
+ static struct tbl hashalgs[] = { HASHALGNAMES };
+ static struct tbl dsdigests[] = { DSDIGESTNAMES };
+@@ -358,33 +358,28 @@ dns_cert_totext(dns_cert_t cert, isc_buffer_t *target) {
+ 	return (dns_mnemonic_totext(cert, target, certs));
+ }
+ 
+-static inline struct tbl *
+-secalgs_tbl_start() {
+-	struct tbl *algs = secalgs;
+-
+-#ifndef PK11_MD5_DISABLE
+-	if (!isc_md5_available()) {
+-		while (algs->name != NULL &&
+-		       algs->value == DNS_KEYALG_RSAMD5)
+-			++algs;
+-	}
+-#endif
+-	return algs;
+-}
+-
+ isc_result_t
+ dns_secalg_fromtext(dns_secalg_t *secalgp, isc_textregion_t *source) {
+ 	unsigned int value;
++	isc_result_t result;
+ 
+-	RETERR(dns_mnemonic_fromtext(&value, source,
+-	                             secalgs_tbl_start(), 0xff));
++	result = dns_mnemonic_fromtext(&value, source,
++	                             secalgs, 0xff);
++	if (result != ISC_R_SUCCESS) {
++		result = dns_mnemonic_fromtext(&value, source,
++		                               md5_secalgs, 0xff);
++		if (result != ISC_R_SUCCESS) {
++			return (result);
++		} else if (!isc_md5_available())
++			return (ISC_R_DISABLED);
++	}
+ 	*secalgp = value;
+ 	return (ISC_R_SUCCESS);
+ }
+ 
+ isc_result_t
+ dns_secalg_totext(dns_secalg_t secalg, isc_buffer_t *target) {
+-	return (dns_mnemonic_totext(secalg, target, secalgs_tbl_start()));
++	return (dns_mnemonic_totext(secalg, target, secalgs));
+ }
+ 
+ void
+-- 
+2.20.1
+
diff --git a/bind.spec b/bind.spec
index 6db85bf..4e24616 100644
--- a/bind.spec
+++ b/bind.spec
@@ -57,7 +57,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.11.9
-Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -145,6 +145,7 @@ Patch172:bind-9.11-tests-pkcs11.patch
 Patch173:bind-9.11-rh1732883.patch
 # Make sure jsonccp-devel does not interfere
 Patch174:bind-9.11-json-c.patch
+Patch175:bind-9.11-fips-disable.patch
 
 # SDB patches
 Patch11: bind-9.3.2b2-sdbsrc.patch
@@ -538,6 +539,7 @@ are used for building ISC DHCP.
 %patch172 -p1 -b .test-pkcs11
 %patch173 -p1 -b .rh1732883
 %patch174 -p1 -b .json-c
+%patch175 -p1 -b .rh1709553
 
 mkdir lib/dns/tests/testdata/dstrandom
 cp -a %{SOURCE50} lib/dns/tests/testdata/dstrandom/random.data
@@ -1539,6 +1541,9 @@ fi;
 
 
 %changelog
+* Thu Aug 08 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.9-2
+- Permit explicit disabling of RSAMD5 in FIPS mode (#1709553)
+
 * Wed Jul 24 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.9-1
 - Update to 9.11.9
 - Add GeoLite2 support

From 963c4b916b9469e2c198f875d2ce87baf03f9015 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 8 Aug 2019 15:06:43 +0200
Subject: [PATCH 042/460] Fix rpmlint warnings

Clean whitespace to satisfy rpmlint
---
 bind.spec | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/bind.spec b/bind.spec
index 4e24616..ea727cb 100644
--- a/bind.spec
+++ b/bind.spec
@@ -169,7 +169,7 @@ Obsoletes:      caching-nameserver < 31:9.4.1-7.fc8
 Provides:       caching-nameserver = 31:9.4.1-7.fc8
 Obsoletes:      dnssec-conf < 1.27-2
 Provides:       dnssec-conf = 1.27-2
-# This wild require should satisfy %selinux_set_boolean macro only
+# This wild require should satisfy %%selinux_set_boolean macro only
 # in case it needs to be used
 Requires(post): ((policycoreutils-python-utils and libselinux-utils) if (selinux-policy-targeted or selinux-policy-mls))
 Requires(post): ((selinux-policy and selinux-policy-base) if (selinux-policy-targeted or selinux-policy-mls))
@@ -796,12 +796,12 @@ popd
 # Test just compiled libraries
 for lib in %{bind_export_libs}
 do
-	sed -e "s,^\s*include(.*${lib}/.*,-- use &," \
-        	-i export-libs/lib/Kyuafile
+  sed -e "s,^\s*include(.*${lib}/.*,-- use &," \
+      -i export-libs/lib/Kyuafile
 done
 
 sed -e "/^\s*include(/ d" -e 's/^-- use //' \
-       	-i export-libs/lib/Kyuafile
+    -i export-libs/lib/Kyuafile
 
 ## End of export libs
 %endif

From 23eefd97985efdc306ccd8df7b03cf6ff4319f82 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 9 Aug 2019 12:32:48 +0200
Subject: [PATCH 043/460] Report errors from rndc reload (#1739441)

Success status has to be ignored until systemd is fixed. Now it would
kill service on reload failure, which is far worse than reload error.
---
 named-chroot.service     | 3 ++-
 named-pkcs11.service     | 3 ++-
 named-sdb-chroot.service | 3 ++-
 named-sdb.service        | 3 ++-
 named.service            | 4 ++--
 5 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/named-chroot.service b/named-chroot.service
index 5732b1c..ed9aa51 100644
--- a/named-chroot.service
+++ b/named-chroot.service
@@ -20,7 +20,8 @@ PIDFile=/var/named/chroot/run/named/named.pid
 ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf -t /var/named/chroot -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
 ExecStart=/usr/sbin/named -u named -c ${NAMEDCONF} -t /var/named/chroot $OPTIONS
 
-ExecReload=/bin/sh -c '/usr/sbin/rndc reload > /dev/null 2>&1 || /bin/kill -HUP $MAINPID'
+; until https://github.com/systemd/systemd/pull/13098 is present, ignore return value
+ExecReload=-/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
 
 ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'
 
diff --git a/named-pkcs11.service b/named-pkcs11.service
index c1a19d1..f0e8913 100644
--- a/named-pkcs11.service
+++ b/named-pkcs11.service
@@ -16,7 +16,8 @@ PIDFile=/run/named/named.pid
 ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
 ExecStart=/usr/sbin/named-pkcs11 -u named -c ${NAMEDCONF} $OPTIONS
 
-ExecReload=/bin/sh -c '/usr/sbin/rndc reload > /dev/null 2>&1 || /bin/kill -HUP $MAINPID'
+; until https://github.com/systemd/systemd/pull/13098 is present, ignore return value
+ExecReload=-/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
 
 ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'
 
diff --git a/named-sdb-chroot.service b/named-sdb-chroot.service
index 5294f47..16a080f 100644
--- a/named-sdb-chroot.service
+++ b/named-sdb-chroot.service
@@ -20,7 +20,8 @@ PIDFile=/var/named/chroot_sdb/run/named/named.pid
 ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf -t /var/named/chroot_sdb -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
 ExecStart=/usr/sbin/named-sdb -u named -c ${NAMEDCONF} -t /var/named/chroot_sdb $OPTIONS
 
-ExecReload=/bin/sh -c '/usr/sbin/rndc reload > /dev/null 2>&1 || /bin/kill -HUP $MAINPID'
+; until https://github.com/systemd/systemd/pull/13098 is present, ignore return value
+ExecReload=-/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
 
 ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'
 
diff --git a/named-sdb.service b/named-sdb.service
index b80ec17..d3ef6e5 100644
--- a/named-sdb.service
+++ b/named-sdb.service
@@ -16,7 +16,8 @@ PIDFile=/run/named/named.pid
 ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
 ExecStart=/usr/sbin/named-sdb -u named -c ${NAMEDCONF} $OPTIONS
 
-ExecReload=/bin/sh -c '/usr/sbin/rndc reload > /dev/null 2>&1 || /bin/kill -HUP $MAINPID'
+; until https://github.com/systemd/systemd/pull/13098 is present, ignore return value
+ExecReload=-/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
 
 ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'
 
diff --git a/named.service b/named.service
index 6a162ad..86737ea 100644
--- a/named.service
+++ b/named.service
@@ -15,8 +15,8 @@ PIDFile=/run/named/named.pid
 
 ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
 ExecStart=/usr/sbin/named -u named -c ${NAMEDCONF} $OPTIONS
-
-ExecReload=/bin/sh -c '/usr/sbin/rndc reload > /dev/null 2>&1 || /bin/kill -HUP $MAINPID'
+; until https://github.com/systemd/systemd/pull/13098 is present, ignore return value
+ExecReload=-/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
 
 ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'
 

From b75571c4df49a6f476af72a0c50d720e9b83c058 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 9 Aug 2019 12:39:58 +0200
Subject: [PATCH 044/460] Add changelog and bump spec

---
 bind.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index ea727cb..b17a5f0 100644
--- a/bind.spec
+++ b/bind.spec
@@ -57,7 +57,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.11.9
-Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  3%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1541,6 +1541,9 @@ fi;
 
 
 %changelog
+* Fri Aug 09 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.9-3
+- Display errors from rndc reload (#1739441)
+
 * Thu Aug 08 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.9-2
 - Permit explicit disabling of RSAMD5 in FIPS mode (#1709553)
 

From c92fe260ae9bed8e13f03b053de64015f165aa2c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
Date: Mon, 19 Aug 2019 10:10:45 +0200
Subject: [PATCH 045/460] Rebuilt for Python 3.8

---
 bind.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index b17a5f0..04a85f6 100644
--- a/bind.spec
+++ b/bind.spec
@@ -57,7 +57,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.11.9
-Release:  3%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  4%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1541,6 +1541,9 @@ fi;
 
 
 %changelog
+* Mon Aug 19 2019 Miro Hrončok <mhroncok@redhat.com> - 32:9.11.9-4
+- Rebuilt for Python 3.8
+
 * Fri Aug 09 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.9-3
 - Display errors from rndc reload (#1739441)
 

From 72f1dad84502d5be0aa66b0561fe0101a22f166c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 27 Aug 2019 10:07:09 +0200
Subject: [PATCH 046/460] Update to BIND 9.11.10

---
 .gitignore              |  1 +
 bind-9.11.10.tar.gz.asc | 16 ++++++++++++++++
 bind-9.11.9.tar.gz.asc  | 16 ----------------
 bind.spec               |  9 ++++++---
 sources                 |  2 +-
 5 files changed, 24 insertions(+), 20 deletions(-)
 create mode 100644 bind-9.11.10.tar.gz.asc
 delete mode 100644 bind-9.11.9.tar.gz.asc

diff --git a/.gitignore b/.gitignore
index 3067a7d..58e8142 100644
--- a/.gitignore
+++ b/.gitignore
@@ -95,3 +95,4 @@ bind-9.7.2b1.tar.gz
 /bind-9.11.7.tar.gz
 /bind-9.11.8.tar.gz
 /bind-9.11.9.tar.gz
+/bind-9.11.10.tar.gz
diff --git a/bind-9.11.10.tar.gz.asc b/bind-9.11.10.tar.gz.asc
new file mode 100644
index 0000000..8ea66c9
--- /dev/null
+++ b/bind-9.11.10.tar.gz.asc
@@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABAgAdFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAl1VKuIACgkQdLtrmky7
+PThvHg/+O+c3U/k/3wYB5XAmT2HSCIqIp8gdu4+0B4rsIJAN+aR1HDIsCTuJqyjw
+jw9fI61d5skxeJljbNChAMTC2Ps1W7bXHFC8B25WQvQAcL/FDJQrLtgRXCJKB9sd
+/hss07hGrrZbE5wRePJJtn4R1d6WLoA/hz1da7IcoZJpFPmlkHE9kZUd9mPAHnMv
+QYCqpl821m53UMENufyrwNMDTaIwqPM4fJ8OVBam/743ZIOP/imwMVnJws6HjRz1
+n4JPoKsMkLOTV0hDotgTl7V1qm4EXKG5xPM882frpfRkk/V/qOvEzLkgVLDF6xHR
+iuZsMvKfrc/VyrKRcQNHs2kA0EqbKfskLoSenj7B/WrvVCeQ+MA4MSg/81Rzzs6P
+gDDCMcWY3X2VlYUA521Z9DagoC49DpfKf+rfeCH/HTNjdWkfClnQoGb9n5Ggy/sM
+NP/ApLN2TOHqMIMU0RGr2U3OY8TNmpq7xfggnr3qL5Of1ez4HYlyLdmma3HPJjvY
+uYdJwVRcJ7rq510QBSf8VGK9/qERkhklh4MZvIzS5htnn+94Gk3gT8p3aZGQ5z2d
+W2RVl+4HQ7aRtQMeQeX79uccVF9vcTBTiAJhILYcp7Q6NBOVMTCabSAnRk3f0GfS
+1x+Ojt+7yVCB3pym8N+mHM3q8l7VvIw1As7QAGi6mdVAaTN8zxc=
+=ZIsR
+-----END PGP SIGNATURE-----
diff --git a/bind-9.11.9.tar.gz.asc b/bind-9.11.9.tar.gz.asc
deleted file mode 100644
index 9e9ad71..0000000
--- a/bind-9.11.9.tar.gz.asc
+++ /dev/null
@@ -1,16 +0,0 @@
------BEGIN PGP SIGNATURE-----
-
-iQIzBAABAgAdFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAl0u4wIACgkQdLtrmky7
-PTgO+A/8DtA5xbbJZx6ifx/AXS+0TBwnyRt1qkDplCRMq4/G+/r9iHh2Z3JYiznV
-NKHkV7JV+d4p9pygOo0s563DsFTg3A6OtzhU7n8QxFS4e3T6S+vKBX1s0Iixu/hN
-q9pxhhefeGejVUjhKqAHbNvoCO2stMAgZi02qhqECJPvu8YtyOPEPNW/K+2aWLH3
-P3gNwIbj1+NjNBWAAhiSEK+px7do4499AxGOZcCPUUmhEAWckcQ1wyC94tDC3uQi
-XY3asr6Ph7WWXkM0qnUDx9+ZPKKDOMevX11W+5cNw1qioss8dWcs3l7mhUuRITVx
-u/yaQYt7F9BY5XjtbaBtTWBDRbpCrrt2YpMhNJ/aedSbCoRT/ZYiDqNwKCEes10s
-hJK4LG4pCtVWQnwi4xFeCxI+NJK5b5gRj5NZ/cwKqGMnEmO0hg3aiDtEUF424t1i
-IdJvDs+NaMjHqitpvc8hlJpTpiefCuGTYjrrJLjnAsA3r72z4aLb8M6ivBNmpEiJ
-x5LFyBZusHzuCSfFV23tBZvZ1VQf53Netz0PXbOCdnKKYlibUGzD3pC8LdoMoj5m
-/s4BYes5ET4xA867yZg7y/A0x0Ezuw+7NLXhpMSAQh/OZwWQ1CzspvYUxl8hHx67
-r1aH0dkAtN8BtaR5lTrXtFfRTJvEqNQ9lFQwljwEJqfwFN4dJBc=
-=m4su
------END PGP SIGNATURE-----
diff --git a/bind.spec b/bind.spec
index 04a85f6..9208af7 100644
--- a/bind.spec
+++ b/bind.spec
@@ -48,7 +48,7 @@
 #
 
 # lib*.so.X versions of selected libraries
-%global sover_dns 1106
+%global sover_dns 1107
 %global sover_isc 1100
 %global sover_irs 161
 %global sover_isccfg 163
@@ -56,8 +56,8 @@
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.11.9
-Release:  4%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Version:  9.11.10
+Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1541,6 +1541,9 @@ fi;
 
 
 %changelog
+* Tue Aug 27 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.10-1
+- Update to 9.11.10
+
 * Mon Aug 19 2019 Miro Hrončok <mhroncok@redhat.com> - 32:9.11.9-4
 - Rebuilt for Python 3.8
 
diff --git a/sources b/sources
index 78dba7f..c992ba3 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.11.9.tar.gz) = 4fa975b83986480a12138a3cf7ccf3bcd2251d194e0c04e3fad0787fc8b2a5dee241179fbb25b0283fa6fcb749d7a15fad036039dbc81250defcba0108823ef8
+SHA512 (bind-9.11.10.tar.gz) = b560cd6b88df0ffe0008d0559b49c28fbe4ed49da1a81e61c373faa5368ad1570c4cf945d224b451634f7506e52d9effb9aee3966c5ff66d95215fffea494f4e
 SHA512 (config-19.tar.bz2) = 36aa38a0c7c33267ae594b31c81681290ac58dde7ca6749bd599da531380b5b1428330813dbe983e01071ccaed83e83f6a9cd92179a53b7d0ccbb6851a0b017c

From 843e5f5094e88557f9276840f5b9f10d86c5ae5f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 27 Aug 2019 10:52:49 +0200
Subject: [PATCH 047/460] Update patches to 9.11.10

---
 bind-9.11-fips-tests.patch |  68 ++++++-----------------
 bind-9.11-rh1624100.patch  |  20 +++----
 bind-9.11-rt31459.patch    | 108 ++++++++++++++++++-------------------
 3 files changed, 80 insertions(+), 116 deletions(-)

diff --git a/bind-9.11-fips-tests.patch b/bind-9.11-fips-tests.patch
index 920440b..539cdcb 100644
--- a/bind-9.11-fips-tests.patch
+++ b/bind-9.11-fips-tests.patch
@@ -1,4 +1,4 @@
-From d0e3f8be48c8031ebe3d7e1bf2a32cb03c79484e Mon Sep 17 00:00:00 2001
+From f32eb98f81b33abd5b0d3c77f8f75cc3e77425ff Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 2 Aug 2018 23:46:45 +0200
 Subject: [PATCH] FIPS tests changes
@@ -77,7 +77,7 @@ Date:   Wed Mar 7 10:44:23 2018 +0100
  bin/tests/system/checkconf/bad-tsig.conf      |  2 +-
  bin/tests/system/checkconf/good.conf          |  2 +-
  bin/tests/system/digdelv/ns2/example.db       | 15 +++--
- bin/tests/system/digdelv/tests.sh             | 28 ++++----
+ bin/tests/system/digdelv/tests.sh             | 20 +++---
  bin/tests/system/dlv/ns1/sign.sh              |  4 +-
  bin/tests/system/dlv/ns2/sign.sh              |  4 +-
  bin/tests/system/dlv/ns6/sign.sh              | 66 +++++++++---------
@@ -102,7 +102,7 @@ Date:   Wed Mar 7 10:44:23 2018 +0100
  bin/tests/system/tsiggss/setup.sh             |  2 +-
  bin/tests/system/upforwd/ns1/named.conf.in    |  2 +-
  bin/tests/system/upforwd/tests.sh             |  2 +-
- 44 files changed, 226 insertions(+), 175 deletions(-)
+ 44 files changed, 222 insertions(+), 171 deletions(-)
 
 diff --git a/bin/tests/system/acl/ns2/named1.conf.in b/bin/tests/system/acl/ns2/named1.conf.in
 index 0ea6502..026db3f 100644
@@ -599,27 +599,9 @@ index f4e30f5..9f53e31 100644
  ; TTL of 3 weeks
  weeks		1814400	A	10.53.0.2
 diff --git a/bin/tests/system/digdelv/tests.sh b/bin/tests/system/digdelv/tests.sh
-index 1657dfd..299ba94 100644
+index ade45ce..d3aff24 100644
 --- a/bin/tests/system/digdelv/tests.sh
 +++ b/bin/tests/system/digdelv/tests.sh
-@@ -88,7 +88,7 @@ if [ -x "$DIG" ] ; then
-   echo_i "checking dig +multi +norrcomments works for dnskey (when default is rrcomments)($n)"
-   ret=0
-   $DIG $DIGOPTS +tcp @10.53.0.3 +multi +norrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1
--  grep "; ZSK; alg = RSAMD5 ; key id = 30795" < dig.out.test$n > /dev/null && ret=1
-+  grep "; ZSK; alg = RSASHA256 ; key id = 36895" < dig.out.test$n > /dev/null && ret=1
-   check_ttl_range dig.out.test$n "DNSKEY" 300 || ret=1
-   if [ $ret != 0 ]; then echo_i "failed"; fi
-   status=`expr $status + $ret`
-@@ -97,7 +97,7 @@ if [ -x "$DIG" ] ; then
-   echo_i "checking dig +multi +norrcomments works for soa (when default is rrcomments)($n)"
-   ret=0
-   $DIG $DIGOPTS +tcp @10.53.0.3 +multi +norrcomments SOA example > dig.out.test$n || ret=1
--  grep "; ZSK; alg = RSAMD5 ; key id = 30795" < dig.out.test$n > /dev/null && ret=1
-+  grep "; ZSK; alg = RSASHA256 ; key id = 36895" < dig.out.test$n > /dev/null && ret=1
-   check_ttl_range dig.out.test$n "SOA" 300 || ret=1
-   if [ $ret != 0 ]; then echo_i "failed"; fi
-   status=`expr $status + $ret`
 @@ -106,7 +106,7 @@ if [ -x "$DIG" ] ; then
    echo_i "checking dig +rrcomments works for DNSKEY($n)"
    ret=0
@@ -665,25 +647,7 @@ index 1657dfd..299ba94 100644
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
  
-@@ -661,7 +661,7 @@ if [ -x ${DELV} ] ; then
-   echo_i "checking delv +multi +norrcomments works for dnskey (when default is rrcomments)($n)"
-   ret=0
-   $DELV $DELVOPTS +tcp @10.53.0.3 +multi +norrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
--  grep "; ZSK; alg = RSAMD5 ; key id = 30795" < delv.out.test$n > /dev/null && ret=1
-+  grep "; ZSK; alg = RSASHA256 ; key id = 36895" < delv.out.test$n > /dev/null && ret=1
-   check_ttl_range delv.out.test$n "DNSKEY" 300 || ret=1
-   if [ $ret != 0 ]; then echo_i "failed"; fi
-   status=`expr $status + $ret`
-@@ -670,7 +670,7 @@ if [ -x ${DELV} ] ; then
-   echo_i "checking delv +multi +norrcomments works for soa (when default is rrcomments)($n)"
-   ret=0
-   $DELV $DELVOPTS +tcp @10.53.0.3 +multi +norrcomments SOA example > delv.out.test$n || ret=1
--  grep "; ZSK; alg = RSAMD5 ; key id = 30795" < delv.out.test$n > /dev/null && ret=1
-+  grep "; ZSK; alg = RSASHA256 ; key id = 36895" < delv.out.test$n > /dev/null && ret=1
-   check_ttl_range delv.out.test$n "SOA" 300 || ret=1
-   if [ $ret != 0 ]; then echo_i "failed"; fi
-   status=`expr $status + $ret`
-@@ -679,7 +679,7 @@ if [ -x ${DELV} ] ; then
+@@ -695,7 +695,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +rrcomments works for DNSKEY($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +rrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
@@ -692,7 +656,7 @@ index 1657dfd..299ba94 100644
    check_ttl_range delv.out.test$n "DNSKEY" 300 || ret=1
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
-@@ -688,7 +688,7 @@ if [ -x ${DELV} ] ; then
+@@ -704,7 +704,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +short +rrcomments works for DNSKEY ($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
@@ -701,7 +665,7 @@ index 1657dfd..299ba94 100644
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
  
-@@ -696,7 +696,7 @@ if [ -x ${DELV} ] ; then
+@@ -712,7 +712,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +short +rrcomments works ($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
@@ -710,7 +674,7 @@ index 1657dfd..299ba94 100644
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
  
-@@ -704,7 +704,7 @@ if [ -x ${DELV} ] ; then
+@@ -720,7 +720,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +short +nosplit works ($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +short +nosplit DNSKEY dnskey.example > delv.out.test$n || ret=1
@@ -719,7 +683,7 @@ index 1657dfd..299ba94 100644
    if test `wc -l < delv.out.test$n` != 1 ; then ret=1 ; fi
    f=`awk '{print NF}' < delv.out.test$n`
    test "${f:-0}" -eq 14 || ret=1
-@@ -715,7 +715,7 @@ if [ -x ${DELV} ] ; then
+@@ -731,7 +731,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +short +nosplit +norrcomments works ($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +short +nosplit +norrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
@@ -990,10 +954,10 @@ index ed30460..e6b1126 100644
 +    "." 256 3 8 "AwEAAarwAdjV4gIhpBCjXVAScRFEx3co7k8smJdxrnqoGsl5NB7EZ9jRdgvCXbJn6v8y9jlNWVHvaC8ilhfhLh0A1vLWiWv4ijd/12xcnrY7xpG7Cu3YkxUxaXJ7Jdg/Iw1+9mGgXF1v4UbCIcw/3U3cxyk7OxYg+VSb5KBAQSR0upxV";
  };
 diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh
-index d07881d..17ad256 100644
+index b31c1b4..a5e237b 100644
 --- a/bin/tests/system/dnssec/tests.sh
 +++ b/bin/tests/system/dnssec/tests.sh
-@@ -3227,8 +3227,8 @@ do
+@@ -3235,8 +3235,8 @@ do
  	   alg=`expr $alg + 1`
  	   continue;;
  	3) size="-b 512";;
@@ -1005,7 +969,7 @@ index d07881d..17ad256 100644
  	8) size="-b 512";;
  	10) size="-b 1024";;
 diff --git a/bin/tests/system/feature-test.c b/bin/tests/system/feature-test.c
-index 27a02d0..caf4166 100644
+index c1249ed..20a3139 100644
 --- a/bin/tests/system/feature-test.c
 +++ b/bin/tests/system/feature-test.c
 @@ -19,6 +19,7 @@
@@ -1016,7 +980,7 @@ index 27a02d0..caf4166 100644
  #include <dns/edns.h>
  
  #ifdef WIN32
-@@ -46,6 +47,7 @@ usage() {
+@@ -47,6 +48,7 @@ usage() {
  	fprintf(stderr, "	--have-geoip2\n");
  	fprintf(stderr, "	--have-libxml2\n");
  	fprintf(stderr, "	--ipv6only=no\n");
@@ -1024,7 +988,7 @@ index 27a02d0..caf4166 100644
  	fprintf(stderr, "	--rpz-nsdname\n");
  	fprintf(stderr, "	--rpz-nsip\n");
  	fprintf(stderr, "	--with-idn\n");
-@@ -146,6 +148,18 @@ main(int argc, char **argv) {
+@@ -155,6 +157,18 @@ main(int argc, char **argv) {
  #endif
  	}
  
@@ -1209,10 +1173,10 @@ index 343869e..c30efb0 100644
  make_key 3 ${EXTRAPORT3} hmac-sha224
  make_key 4 ${EXTRAPORT4} hmac-sha256
 diff --git a/bin/tests/system/rndc/tests.sh b/bin/tests/system/rndc/tests.sh
-index b00056c..f7fad91 100644
+index 57e066d..186a723 100644
 --- a/bin/tests/system/rndc/tests.sh
 +++ b/bin/tests/system/rndc/tests.sh
-@@ -356,15 +356,20 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
+@@ -348,15 +348,20 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
  status=`expr $status + $ret`
  
  n=`expr $n + 1`
diff --git a/bind-9.11-rh1624100.patch b/bind-9.11-rh1624100.patch
index 00030cc..5764ed7 100644
--- a/bind-9.11-rh1624100.patch
+++ b/bind-9.11-rh1624100.patch
@@ -1,4 +1,4 @@
-From 292a0ca28f2e8a49f8c7e62c39ad7160234ce23d Mon Sep 17 00:00:00 2001
+From 76594cba9a1e910bb36160d96fc3872349341799 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@sury.org>
 Date: Wed, 25 Apr 2018 14:04:31 +0200
 Subject: [PATCH] Replace isc_safe routines with their OpenSSL counter parts
@@ -81,15 +81,15 @@ index ad77f24..670982a 100644
  
  /* accept_sec_context.c */
 diff --git a/lib/isc/Makefile.in b/lib/isc/Makefile.in
-index ba53ef1..98acfff 100644
+index 0fd0837..8ad54bb 100644
 --- a/lib/isc/Makefile.in
 +++ b/lib/isc/Makefile.in
 @@ -60,7 +60,7 @@ OBJS =		@ISC_EXTRA_OBJS@ @ISC_PK11_O@ @ISC_PK11_RESULT_O@ \
  		parseint.@O@ portset.@O@ quota.@O@ radix.@O@ random.@O@ \
  		ratelimiter.@O@ refcount.@O@ region.@O@ regex.@O@ result.@O@ \
  		rwlock.@O@ \
--		safe.@O@ serial.@O@ sha1.@O@ sha2.@O@ sockaddr.@O@ stats.@O@ \
-+		serial.@O@ sha1.@O@ sha2.@O@ sockaddr.@O@ stats.@O@ \
+-		safe.@O@ serial.@O@ siphash.@O@ sha1.@O@ sha2.@O@ sockaddr.@O@ stats.@O@ \
++		serial.@O@ siphash.@O@ sha1.@O@ sha2.@O@ sockaddr.@O@ stats.@O@ \
  		string.@O@ strtoul.@O@ symtab.@O@ task.@O@ taskpool.@O@ \
  		tm.@O@ timer.@O@ version.@O@ \
  		${UNIXOBJS} ${NLSOBJS} ${THREADOBJS}
@@ -97,8 +97,8 @@ index ba53ef1..98acfff 100644
  		netaddr.c netscope.c pool.c ondestroy.c \
  		parseint.c portset.c quota.c radix.c random.c ${CHACHASRCS} \
  		ratelimiter.c refcount.c region.c regex.c result.c rwlock.c \
--		safe.c serial.c sha1.c sha2.c sockaddr.c stats.c string.c \
-+		serial.c sha1.c sha2.c sockaddr.c stats.c string.c \
+-		safe.c serial.c siphash.c sha1.c sha2.c sockaddr.c stats.c string.c \
++		serial.c siphash.c sha1.c sha2.c sockaddr.c stats.c string.c \
  		strtoul.c symtab.c task.c taskpool.c timer.c \
  		tm.c version.c
  
@@ -241,10 +241,10 @@ index 7a464b6..0000000
 -#endif
 -}
 diff --git a/lib/isc/tests/safe_test.c b/lib/isc/tests/safe_test.c
-index 5775b6e..3451b5d 100644
+index 266ac75..60e9181 100644
 --- a/lib/isc/tests/safe_test.c
 +++ b/lib/isc/tests/safe_test.c
-@@ -44,22 +44,6 @@ isc_safe_memequal_test(void **state) {
+@@ -45,22 +45,6 @@ isc_safe_memequal_test(void **state) {
  				       "\x00\x00\x00\x00", 4));
  }
  
@@ -267,7 +267,7 @@ index 5775b6e..3451b5d 100644
  /* test isc_safe_memwipe() */
  static void
  isc_safe_memwipe_test(void **state) {
-@@ -68,7 +52,6 @@ isc_safe_memwipe_test(void **state) {
+@@ -69,7 +53,6 @@ isc_safe_memwipe_test(void **state) {
  	/* These should pass. */
  	isc_safe_memwipe(NULL, 0);
  	isc_safe_memwipe((void *) -1, 0);
@@ -275,7 +275,7 @@ index 5775b6e..3451b5d 100644
  
  	/*
  	 * isc_safe_memwipe(ptr, size) should function same as
-@@ -107,7 +90,6 @@ main(void) {
+@@ -108,7 +91,6 @@ main(void) {
  	const struct CMUnitTest tests[] = {
  		cmocka_unit_test(isc_safe_memequal_test),
  		cmocka_unit_test(isc_safe_memwipe_test),
diff --git a/bind-9.11-rt31459.patch b/bind-9.11-rt31459.patch
index bbb8948..27d8273 100644
--- a/bind-9.11-rt31459.patch
+++ b/bind-9.11-rt31459.patch
@@ -1,4 +1,4 @@
-From f0eee3c150b9b913819ecd864581ba50dd4ae9cf Mon Sep 17 00:00:00 2001
+From 9f62d68da08d21a8b35e27aeebd00afe6e5fb7be Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Tue, 12 Sep 2017 19:05:46 -0700
 Subject: [PATCH] rebased rt31459c
@@ -293,7 +293,7 @@ index fbc7ece..31a99e7 100644
  					   usekeyboard);
  
 diff --git a/bin/named/server.c b/bin/named/server.c
-index 767d83f..d3c2f9d 100644
+index c917cad..436a93a 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
 @@ -36,6 +36,7 @@
@@ -304,7 +304,7 @@ index 767d83f..d3c2f9d 100644
  #include <isc/portset.h>
  #include <isc/print.h>
  #include <isc/random.h>
-@@ -8208,6 +8209,10 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8209,6 +8210,10 @@ load_configuration(const char *filename, ns_server_t *server,
  				      "no source of entropy found");
  		} else {
  			const char *randomdev = cfg_obj_asstring(obj);
@@ -315,7 +315,7 @@ index 767d83f..d3c2f9d 100644
  			int level = ISC_LOG_ERROR;
  			result = isc_entropy_createfilesource(ns_g_entropy,
  							      randomdev);
-@@ -8242,6 +8247,7 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8243,6 +8248,7 @@ load_configuration(const char *filename, ns_server_t *server,
  				}
  				isc_entropy_detach(&ns_g_fallbackentropy);
  			}
@@ -671,10 +671,10 @@ index 9f90dd7..fad6c83 100644
          echo "I:failed"
  	status=`expr $status + $ret`
 diff --git a/bin/tools/mdig.c b/bin/tools/mdig.c
-index b27fc1d..e28871b 100644
+index 53579d4..e2f6810 100644
 --- a/bin/tools/mdig.c
 +++ b/bin/tools/mdig.c
-@@ -1969,12 +1969,11 @@ main(int argc, char *argv[]) {
+@@ -1972,12 +1972,11 @@ main(int argc, char *argv[]) {
  
  	ectx = NULL;
  	RUNCHECK(isc_entropy_create(mctx, &ectx));
@@ -689,7 +689,7 @@ index b27fc1d..e28871b 100644
  	parse_args(false, argc, argv);
  	if (server == NULL)
 diff --git a/configure b/configure
-index 4a5db6c..64aca10 100755
+index 2a4d9ed..e4e8ea6 100755
 --- a/configure
 +++ b/configure
 @@ -640,6 +640,7 @@ ac_includes_default="\
@@ -724,7 +724,7 @@ index 4a5db6c..64aca10 100755
    --enable-largefile      64-bit file support
    --enable-backtrace      log stack backtrace on abort [default=yes]
    --enable-symtable       use internal symbol table for backtrace
-@@ -17156,6 +17160,7 @@ case "$use_openssl" in
+@@ -17117,6 +17121,7 @@ case "$use_openssl" in
  $as_echo "disabled because of native PKCS11" >&6; }
  		DST_OPENSSL_INC=""
  		CRYPTO="-DPKCS11CRYPTO"
@@ -732,7 +732,7 @@ index 4a5db6c..64aca10 100755
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -17170,6 +17175,7 @@ $as_echo "disabled because of native PKCS11" >&6; }
+@@ -17131,6 +17136,7 @@ $as_echo "disabled because of native PKCS11" >&6; }
  $as_echo "no" >&6; }
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -740,7 +740,7 @@ index 4a5db6c..64aca10 100755
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -17182,6 +17188,7 @@ $as_echo "no" >&6; }
+@@ -17143,6 +17149,7 @@ $as_echo "no" >&6; }
  	auto)
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -748,7 +748,7 @@ index 4a5db6c..64aca10 100755
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -17191,7 +17198,7 @@ $as_echo "no" >&6; }
+@@ -17152,7 +17159,7 @@ $as_echo "no" >&6; }
  		OPENSSLLINKOBJS=""
  		OPENSSLLINKSRCS=""
  		as_fn_error $? "OpenSSL was not found in any of $openssldirs; use --with-openssl=/path
@@ -757,7 +757,7 @@ index 4a5db6c..64aca10 100755
  		;;
  	*)
  		if test "yes" = "$want_native_pkcs11"
-@@ -17222,6 +17229,7 @@ $as_echo "not found" >&6; }
+@@ -17183,6 +17190,7 @@ $as_echo "not found" >&6; }
  			as_fn_error $? "\"$use_openssl/include/openssl/opensslv.h\" not found" "$LINENO" 5
  		fi
  		CRYPTO='-DOPENSSL'
@@ -765,7 +765,7 @@ index 4a5db6c..64aca10 100755
  		if test "/usr" = "$use_openssl"
  		then
  			DST_OPENSSL_INC=""
-@@ -17883,8 +17891,6 @@ fi
+@@ -17808,8 +17816,6 @@ fi
  # Use OpenSSL for hash functions
  #
  
@@ -774,7 +774,7 @@ index 4a5db6c..64aca10 100755
  ISC_PLATFORM_OPENSSLHASH="#undef ISC_PLATFORM_OPENSSLHASH"
  case $want_openssl_hash in
  	yes)
-@@ -18259,6 +18265,86 @@ if test "rt" = "$have_clock_gt"; then
+@@ -18184,6 +18190,86 @@ if test "rt" = "$have_clock_gt"; then
  	LIBS="-lrt $LIBS"
  fi
  
@@ -861,7 +861,7 @@ index 4a5db6c..64aca10 100755
  #
  # was --with-lmdb specified?
  #
-@@ -20341,9 +20427,12 @@ _ACEOF
+@@ -20266,9 +20352,12 @@ _ACEOF
  if ac_fn_c_try_compile "$LINENO"; then :
    { $as_echo "$as_me:${as_lineno-$LINENO}: result: size_t for buflen; int for flags" >&5
  $as_echo "size_t for buflen; int for flags" >&6; }
@@ -876,7 +876,7 @@ index 4a5db6c..64aca10 100755
  
  	 $as_echo "#define IRS_GETNAMEINFO_FLAGS_T int" >>confdefs.h
  
-@@ -21658,12 +21747,7 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
+@@ -21583,12 +21672,7 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
  ISC_PLATFORM_USESTDASM="#undef ISC_PLATFORM_USESTDASM"
  ISC_PLATFORM_USEMACASM="#undef ISC_PLATFORM_USEMACASM"
  if test "yes" = "$use_atomic"; then
@@ -890,7 +890,7 @@ index 4a5db6c..64aca10 100755
  # version HP92453-01 B.11.11.23709.GP, which incorrectly rejects
  # declarations like `int a3[[(sizeof (unsigned char)) >= 0]];'.
  # This bug is HP SR number 8606223364.
-@@ -21696,6 +21780,11 @@ cat >>confdefs.h <<_ACEOF
+@@ -21621,6 +21705,11 @@ cat >>confdefs.h <<_ACEOF
  _ACEOF
  
  
@@ -902,7 +902,7 @@ index 4a5db6c..64aca10 100755
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -21704,39 +21793,6 @@ _ACEOF
+@@ -21629,39 +21718,6 @@ _ACEOF
  		fi
  	;;
  	x86_64-*|amd64-*)
@@ -942,7 +942,7 @@ index 4a5db6c..64aca10 100755
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -21767,6 +21823,10 @@ $as_echo_n "checking architecture type for atomic operations... " >&6; }
+@@ -21692,6 +21748,10 @@ $as_echo_n "checking architecture type for atomic operations... " >&6; }
  $as_echo "$arch" >&6; }
  fi
  
@@ -953,7 +953,7 @@ index 4a5db6c..64aca10 100755
  if test "yes" = "$have_atomic"; then
  	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking compiler support for inline assembly code" >&5
  $as_echo_n "checking compiler support for inline assembly code... " >&6; }
-@@ -24372,6 +24432,30 @@ CFLAGS="$CFLAGS $SO_CFLAGS"
+@@ -24297,6 +24357,30 @@ CFLAGS="$CFLAGS $SO_CFLAGS"
  #
  dlzdir='${DLZ_DRIVER_DIR}'
  
@@ -984,7 +984,7 @@ index 4a5db6c..64aca10 100755
  #
  # Private autoconf macro to simplify configuring drivers:
  #
-@@ -24702,11 +24786,11 @@ $as_echo "no" >&6; }
+@@ -24627,11 +24711,11 @@ $as_echo "no" >&6; }
  $as_echo "using mysql with libs ${mysql_lib} and includes ${mysql_include}" >&6; }
  		;;
  	*)
@@ -999,7 +999,7 @@ index 4a5db6c..64aca10 100755
  		fi
  
  	CONTRIB_DLZ="$CONTRIB_DLZ -DDLZ_MYSQL"
-@@ -24791,7 +24875,7 @@ $as_echo "" >&6; }
+@@ -24716,7 +24800,7 @@ $as_echo "" >&6; }
  			# Check other locations for includes.
  			# Order is important (sigh).
  
@@ -1008,7 +1008,7 @@ index 4a5db6c..64aca10 100755
  			# include a blank element first
  			for d in "" $bdb_incdirs
  			do
-@@ -24816,57 +24900,9 @@ $as_echo "" >&6; }
+@@ -24741,57 +24825,9 @@ $as_echo "" >&6; }
  			bdb_libnames="db53 db-5.3 db51 db-5.1 db48 db-4.8 db47 db-4.7 db46 db-4.6 db45 db-4.5 db44 db-4.4 db43 db-4.3 db42 db-4.2 db41 db-4.1 db"
  			for d in $bdb_libnames
  			do
@@ -1068,7 +1068,7 @@ index 4a5db6c..64aca10 100755
  					break
  				fi
  			done
-@@ -25025,10 +25061,10 @@ $as_echo "no" >&6; }
+@@ -24950,10 +24986,10 @@ $as_echo "no" >&6; }
  		DLZ_DRIVER_INCLUDES="$DLZ_DRIVER_INCLUDES -I$use_dlz_ldap/include"
  		DLZ_DRIVER_LDAP_INCLUDES="-I$use_dlz_ldap/include"
  	fi
@@ -1082,7 +1082,7 @@ index 4a5db6c..64aca10 100755
  	fi
  
  
-@@ -25114,11 +25150,11 @@ fi
+@@ -25039,11 +25075,11 @@ fi
  		odbcdirs="/usr /usr/local /usr/pkg"
  		for d in $odbcdirs
  		do
@@ -1096,7 +1096,7 @@ index 4a5db6c..64aca10 100755
  				break
  			fi
  		done
-@@ -25393,6 +25429,8 @@ DNS_CRYPTO_LIBS="$NEWFLAGS"
+@@ -25318,6 +25354,8 @@ DNS_CRYPTO_LIBS="$NEWFLAGS"
  
  
  
@@ -1105,7 +1105,7 @@ index 4a5db6c..64aca10 100755
  #
  # Commands to run at the end of config.status.
  # Don't just put these into configure, it won't work right if somebody
-@@ -27772,6 +27810,8 @@ report() {
+@@ -27697,6 +27735,8 @@ report() {
  	    echo "    IPv6 support (--enable-ipv6)"
  	test "X$CRYPTO" = "X" -o "yes" = "$want_native_pkcs11" || \
  		echo "    OpenSSL cryptography/DNSSEC (--with-openssl)"
@@ -1114,7 +1114,7 @@ index 4a5db6c..64aca10 100755
  	test "X$PYTHON" = "X" || echo "    Python tools (--with-python)"
  	test "X$XMLSTATS" = "X" || echo "    XML statistics (--with-libxml2)"
  	test "X$JSONSTATS" = "X" || echo "    JSON statistics (--with-libjson)"
-@@ -27812,6 +27852,8 @@ report() {
+@@ -27737,6 +27777,8 @@ report() {
  	echo "    Very verbose query trace logging (--enable-querytrace)"
      test "no" = "$with_cmocka" || echo "    CMocka Unit Testing Framework (--with-cmocka)"
  
@@ -1123,7 +1123,7 @@ index 4a5db6c..64aca10 100755
      echo "    Dynamically loadable zone (DLZ) drivers:"
      test "no" = "$use_dlz_bdb" || \
  	echo "        Berkeley DB (--with-dlz-bdb)"
-@@ -27859,6 +27901,8 @@ report() {
+@@ -27784,6 +27826,8 @@ report() {
  	echo "    ECDSA algorithm support (--with-ecdsa)"
      test "X$CRYPTO" = "X" -o "yes" = "$OPENSSL_ED25519" -o "yes" = "$PKCS11_ED25519" || \
  	echo "    EDDSA algorithm support (--with-eddsa)"
@@ -1133,10 +1133,10 @@ index 4a5db6c..64aca10 100755
      test "yes" = "$enable_seccomp" || \
  	echo "    Use libseccomp system call filtering (--enable-seccomp)"
 diff --git a/configure.ac b/configure.ac
-index 0dc552c..3b88105 100644
+index 0e22d02..828581e 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -1572,6 +1572,7 @@ case "$use_openssl" in
+@@ -1537,6 +1537,7 @@ case "$use_openssl" in
  		AC_MSG_RESULT(disabled because of native PKCS11)
  		DST_OPENSSL_INC=""
  		CRYPTO="-DPKCS11CRYPTO"
@@ -1144,7 +1144,7 @@ index 0dc552c..3b88105 100644
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -1585,6 +1586,7 @@ case "$use_openssl" in
+@@ -1550,6 +1551,7 @@ case "$use_openssl" in
  		AC_MSG_RESULT(no)
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -1152,7 +1152,7 @@ index 0dc552c..3b88105 100644
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -1597,6 +1599,7 @@ case "$use_openssl" in
+@@ -1562,6 +1564,7 @@ case "$use_openssl" in
  	auto)
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -1160,7 +1160,7 @@ index 0dc552c..3b88105 100644
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -1607,7 +1610,7 @@ case "$use_openssl" in
+@@ -1572,7 +1575,7 @@ case "$use_openssl" in
  		OPENSSLLINKSRCS=""
  		AC_MSG_ERROR(
  [OpenSSL was not found in any of $openssldirs; use --with-openssl=/path
@@ -1169,7 +1169,7 @@ index 0dc552c..3b88105 100644
  		;;
  	*)
  		if test "yes" = "$want_native_pkcs11"
-@@ -1637,6 +1640,7 @@ If you don't want OpenSSL, use --without-openssl])
+@@ -1602,6 +1605,7 @@ If you don't want OpenSSL, use --without-openssl])
  			AC_MSG_ERROR(["$use_openssl/include/openssl/opensslv.h" not found])
  		fi
  		CRYPTO='-DOPENSSL'
@@ -1177,7 +1177,7 @@ index 0dc552c..3b88105 100644
  		if test "/usr" = "$use_openssl"
  		then
  			DST_OPENSSL_INC=""
-@@ -2110,7 +2114,6 @@ fi
+@@ -2037,7 +2041,6 @@ fi
  # Use OpenSSL for hash functions
  #
  
@@ -1185,7 +1185,7 @@ index 0dc552c..3b88105 100644
  ISC_PLATFORM_OPENSSLHASH="#undef ISC_PLATFORM_OPENSSLHASH"
  case $want_openssl_hash in
  	yes)
-@@ -2382,6 +2385,67 @@ if test "rt" = "$have_clock_gt"; then
+@@ -2309,6 +2312,67 @@ if test "rt" = "$have_clock_gt"; then
  	LIBS="-lrt $LIBS"
  fi
  
@@ -1253,7 +1253,7 @@ index 0dc552c..3b88105 100644
  #
  # was --with-lmdb specified?
  #
-@@ -4178,12 +4242,12 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
+@@ -4105,12 +4169,12 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
  ISC_PLATFORM_USESTDASM="#undef ISC_PLATFORM_USESTDASM"
  ISC_PLATFORM_USEMACASM="#undef ISC_PLATFORM_USEMACASM"
  if test "yes" = "$use_atomic"; then
@@ -1267,7 +1267,7 @@ index 0dc552c..3b88105 100644
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -4192,7 +4256,6 @@ if test "yes" = "$use_atomic"; then
+@@ -4119,7 +4183,6 @@ if test "yes" = "$use_atomic"; then
  		fi
  	;;
  	x86_64-*|amd64-*)
@@ -1275,7 +1275,7 @@ index 0dc552c..3b88105 100644
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -5607,6 +5670,8 @@ report() {
+@@ -5534,6 +5597,8 @@ report() {
  	    echo "    IPv6 support (--enable-ipv6)"
  	test "X$CRYPTO" = "X" -o "yes" = "$want_native_pkcs11" || \
  		echo "    OpenSSL cryptography/DNSSEC (--with-openssl)"
@@ -1284,7 +1284,7 @@ index 0dc552c..3b88105 100644
  	test "X$PYTHON" = "X" || echo "    Python tools (--with-python)"
  	test "X$XMLSTATS" = "X" || echo "    XML statistics (--with-libxml2)"
  	test "X$JSONSTATS" = "X" || echo "    JSON statistics (--with-libjson)"
-@@ -5647,6 +5712,8 @@ report() {
+@@ -5574,6 +5639,8 @@ report() {
  	echo "    Very verbose query trace logging (--enable-querytrace)"
      test "no" = "$with_cmocka" || echo "    CMocka Unit Testing Framework (--with-cmocka)"
  
@@ -1293,7 +1293,7 @@ index 0dc552c..3b88105 100644
      echo "    Dynamically loadable zone (DLZ) drivers:"
      test "no" = "$use_dlz_bdb" || \
  	echo "        Berkeley DB (--with-dlz-bdb)"
-@@ -5694,6 +5761,8 @@ report() {
+@@ -5621,6 +5688,8 @@ report() {
  	echo "    ECDSA algorithm support (--with-ecdsa)"
      test "X$CRYPTO" = "X" -o "yes" = "$OPENSSL_ED25519" -o "yes" = "$PKCS11_ED25519" || \
  	echo "    EDDSA algorithm support (--with-eddsa)"
@@ -2016,10 +2016,10 @@ index 5b8a2c9..913a2ce 100644
   * Define if the hash functions must be provided by OpenSSL.
   */
 diff --git a/win32utils/Configure b/win32utils/Configure
-index 93939f3..8bacf54 100644
+index 6f93814..4286baf 100644
 --- a/win32utils/Configure
 +++ b/win32utils/Configure
-@@ -381,6 +381,7 @@ my @substdefh = ("AES_CC",
+@@ -378,6 +378,7 @@ my @substdefh = ("ALLOW_FILTER_AAAA",
  my %configdefp;
  
  my @substdefp = ("ISC_PLATFORM_BUSYWAITNOP",
@@ -2027,7 +2027,7 @@ index 93939f3..8bacf54 100644
                   "ISC_PLATFORM_HAVEATOMICSTORE",
                   "ISC_PLATFORM_HAVEATOMICSTOREQ",
                   "ISC_PLATFORM_HAVECMPXCHG",
-@@ -511,7 +512,8 @@ my @allcond = (@substcond, "NOTYET", "NOLONGER");
+@@ -508,7 +509,8 @@ my @allcond = (@substcond, "NOTYET", "NOLONGER");
  
  # enable-xxx/disable-xxx
  
@@ -2037,7 +2037,7 @@ index 93939f3..8bacf54 100644
                    "fixed-rrset",
                    "intrinsics",
                    "isc-spnego",
-@@ -575,6 +577,7 @@ my @help = (
+@@ -572,6 +574,7 @@ my @help = (
  "\nOptional Features:\n",
  "  enable-intrinsics     enable instrinsic/atomic functions [default=yes]\n",
  "  enable-native-pkcs11  use native PKCS#11 for all crypto [default=no]\n",
@@ -2045,7 +2045,7 @@ index 93939f3..8bacf54 100644
  "  enable-openssl-hash   use OpenSSL for hash functions [default=yes]\n",
  "  enable-isc-spnego     use SPNEGO from lib/dns [default=yes]\n",
  "  enable-filter-aaaa    enable filtering of AAAA records [default=yes]\n",
-@@ -620,7 +623,9 @@ my $want_clean = "no";
+@@ -617,7 +620,9 @@ my $want_clean = "no";
  my $want_unknown = "no";
  my $unknown_value;
  my $enable_intrinsics = "yes";
@@ -2055,7 +2055,7 @@ index 93939f3..8bacf54 100644
  my $enable_openssl_hash = "auto";
  my $enable_filter_aaaa = "yes";
  my $enable_isc_spnego = "yes";
-@@ -840,6 +845,10 @@ sub myenable {
+@@ -837,6 +842,10 @@ sub myenable {
          if ($val =~ /^yes$/i) {
              $enable_native_pkcs11 = "yes";
          }
@@ -2066,7 +2066,7 @@ index 93939f3..8bacf54 100644
      } elsif ($key =~ /^openssl-hash$/i) {
          if ($val =~ /^yes$/i) {
              $enable_openssl_hash = "yes";
-@@ -1142,6 +1151,11 @@ if ($verbose) {
+@@ -1139,6 +1148,11 @@ if ($verbose) {
      } else {
          print "native-pkcs11: disabled\n";
      }
@@ -2078,7 +2078,7 @@ index 93939f3..8bacf54 100644
      if ($enable_openssl_hash eq "yes") {
          print "openssl-hash: enabled\n";
      } else {
-@@ -1500,6 +1514,7 @@ if ($enable_intrinsics eq "yes") {
+@@ -1497,6 +1511,7 @@ if ($enable_intrinsics eq "yes") {
  
  # enable-native-pkcs11
  if ($enable_native_pkcs11 eq "yes") {
@@ -2086,7 +2086,7 @@ index 93939f3..8bacf54 100644
      if ($use_openssl eq "auto") {
          $use_openssl = "no";
      }
-@@ -1709,6 +1724,7 @@ if ($use_openssl eq "yes") {
+@@ -1706,6 +1721,7 @@ if ($use_openssl eq "yes") {
          $openssl_dll = File::Spec->catdir($openssl_path, "@dirlist[0]");
      }   
  
@@ -2094,10 +2094,10 @@ index 93939f3..8bacf54 100644
      $configcond{"OPENSSL"} = 1;
      $configdefd{"CRYPTO"} = "OPENSSL";
      $configvar{"OPENSSL_PATH"} = "$openssl_path";
-@@ -2260,6 +2276,15 @@ if ($cookie_algorithm eq "sha1") {
-     die "Unrecognized cookie algorithm: $cookie_algorithm\n";
+@@ -2242,6 +2258,15 @@ if ($use_aes eq "yes") {
  }
  
+ 
 +# enable-crypto-rand
 +if ($enable_crypto_rand eq "yes") {
 +    if (($use_openssl eq "no") && ($enable_native_pkcs11 eq "no")) {
@@ -2110,7 +2110,7 @@ index 93939f3..8bacf54 100644
  # enable-openssl-hash
  if ($enable_openssl_hash eq "yes") {
      if ($use_openssl eq "no") {
-@@ -3635,6 +3660,7 @@ exit 0;
+@@ -3617,6 +3642,7 @@ exit 0;
  #  --enable-developer partially supported
  #  --enable-newstats (9.9/9.9sub only)
  #  --enable-native-pkcs11 supported

From 1b89e615464b850f77db8d4ec000479bba60dc33 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 27 Aug 2019 10:53:03 +0200
Subject: [PATCH 048/460] Fix broken system/tsig test

On rebases, md5 keys were accidentally dropped. Put them back.
---
 bind-9.11-fips-tests.patch | 22 ++++++++++++++++++++--
 1 file changed, 20 insertions(+), 2 deletions(-)

diff --git a/bind-9.11-fips-tests.patch b/bind-9.11-fips-tests.patch
index 539cdcb..29dda07 100644
--- a/bind-9.11-fips-tests.patch
+++ b/bind-9.11-fips-tests.patch
@@ -1,4 +1,4 @@
-From f32eb98f81b33abd5b0d3c77f8f75cc3e77425ff Mon Sep 17 00:00:00 2001
+From c23daf334d5487fa53fef88c82312e439a2d8523 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 2 Aug 2018 23:46:45 +0200
 Subject: [PATCH] FIPS tests changes
@@ -102,7 +102,9 @@ Date:   Wed Mar 7 10:44:23 2018 +0100
  bin/tests/system/tsiggss/setup.sh             |  2 +-
  bin/tests/system/upforwd/ns1/named.conf.in    |  2 +-
  bin/tests/system/upforwd/tests.sh             |  2 +-
- 44 files changed, 222 insertions(+), 171 deletions(-)
+ bin/tests/system/tsig/ns1/rndc5.conf.in | 10 +++
+ 45 files changed, 232 insertions(+), 171 deletions(-)
+ create mode 100644 bin/tests/system/tsig/ns1/rndc5.conf.in
 
 diff --git a/bin/tests/system/acl/ns2/named1.conf.in b/bin/tests/system/acl/ns2/named1.conf.in
 index 0ea6502..026db3f 100644
@@ -1385,6 +1387,22 @@ index b0694bb..9adae82 100644
  server 10.53.0.3 ${PORT}
  update add updated.example. 600 A 10.10.10.1
  update add updated.example. 600 TXT Foo
+diff --git a/bin/tests/system/tsig/ns1/rndc5.conf.in b/bin/tests/system/tsig/ns1/rndc5.conf.in
+new file mode 100644
+index 0000000..0682194
+--- /dev/null
++++ b/bin/tests/system/tsig/ns1/rndc5.conf.in
+@@ -0,0 +1,10 @@
++# Conditionally included when support for MD5 is available
++key "md5" {
++	secret "97rnFx24Tfna4mHPfgnerA==";
++	algorithm hmac-md5;
++};
++
++key "md5-trunc" {
++	secret "97rnFx24Tfna4mHPfgnerA==";
++	algorithm hmac-md5-80;
++};
 -- 
 2.20.1
 

From 01dd585828bc899b867fbfcc59d91a5cb9c9475d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 27 Aug 2019 15:49:57 +0200
Subject: [PATCH 049/460] Fix broken pkcs11 initialization

Broken by commit 2a466330c5379150b781709140e8c837d0a95328
---
 bind-9.11-fips-code.patch | 50 +++++++++++++++++++--------------------
 1 file changed, 25 insertions(+), 25 deletions(-)

diff --git a/bind-9.11-fips-code.patch b/bind-9.11-fips-code.patch
index 74dbb05..cf00104 100644
--- a/bind-9.11-fips-code.patch
+++ b/bind-9.11-fips-code.patch
@@ -1,4 +1,4 @@
-From b8485528f5098e3360560d5b85c9ffc592619c55 Mon Sep 17 00:00:00 2001
+From eff6dcb62f3cea6df0a848c2220a49bc02cb4a0e Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 2 Aug 2018 23:34:45 +0200
 Subject: [PATCH] FIPS code changes
@@ -241,7 +241,7 @@ index 5ca3d76..6b7790a 100644
  	port = DEFAULT_PORT;
  
 diff --git a/bin/dig/dig.c b/bin/dig/dig.c
-index 2063a3b..8e856c5 100644
+index 706299e..aaf22e7 100644
 --- a/bin/dig/dig.c
 +++ b/bin/dig/dig.c
 @@ -20,6 +20,7 @@
@@ -252,7 +252,7 @@ index 2063a3b..8e856c5 100644
  #include <isc/netaddr.h>
  #include <isc/parseint.h>
  #include <isc/platform.h>
-@@ -1767,10 +1768,10 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
+@@ -1774,10 +1775,10 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
  			ptr = ptr2;
  			ptr2 = ptr3;
  		} else  {
@@ -267,7 +267,7 @@ index 2063a3b..8e856c5 100644
  			digestbits = 0;
  		}
 diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
-index e75b8b7..9234d35 100644
+index 93e5b40..afd2700 100644
 --- a/bin/dig/dighost.c
 +++ b/bin/dig/dighost.c
 @@ -80,6 +80,7 @@
@@ -339,7 +339,7 @@ index 1476d0d..f5c9316 100644
  			alg = DST_ALG_HMACMD5;
  #else
 diff --git a/bin/named/config.c b/bin/named/config.c
-index 7584efb..a153172 100644
+index 32c454a..dff826b 100644
 --- a/bin/named/config.c
 +++ b/bin/named/config.c
 @@ -18,6 +18,7 @@
@@ -350,7 +350,7 @@ index 7584efb..a153172 100644
  #include <isc/mem.h>
  #include <isc/parseint.h>
  #include <isc/region.h>
-@@ -969,6 +970,21 @@ ns_config_getkeyalgorithm(const char *str, dns_name_t **name,
+@@ -974,6 +975,21 @@ ns_config_getkeyalgorithm(const char *str, dns_name_t **name,
  	return (ns_config_getkeyalgorithm2(str, name, NULL, digestbits));
  }
  
@@ -372,7 +372,7 @@ index 7584efb..a153172 100644
  isc_result_t
  ns_config_getkeyalgorithm2(const char *str, dns_name_t **name,
  			   unsigned int *typep, uint16_t *digestbits)
-@@ -978,7 +994,7 @@ ns_config_getkeyalgorithm2(const char *str, dns_name_t **name,
+@@ -983,7 +999,7 @@ ns_config_getkeyalgorithm2(const char *str, dns_name_t **name,
  	uint16_t bits;
  	isc_result_t result;
  
@@ -381,7 +381,7 @@ index 7584efb..a153172 100644
  		len = strlen(algorithms[i].str);
  		if (strncasecmp(algorithms[i].str, str, len) == 0 &&
  		    (str[len] == '\0' ||
-@@ -1001,7 +1017,12 @@ ns_config_getkeyalgorithm2(const char *str, dns_name_t **name,
+@@ -1006,7 +1022,12 @@ ns_config_getkeyalgorithm2(const char *str, dns_name_t **name,
  	if (name != NULL) {
  		switch (algorithms[i].hmac) {
  #ifndef PK11_MD5_DISABLE
@@ -622,7 +622,7 @@ index bde66a4..70a40c3 100644
  	dst_key_free(&dstkey);
  	CHECK("MD5 was disabled", ISC_R_NOTIMPLEMENTED);
 diff --git a/lib/bind9/check.c b/lib/bind9/check.c
-index 2a0e735..dc80018 100644
+index ec0ab6d..e0803d4 100644
 --- a/lib/bind9/check.c
 +++ b/lib/bind9/check.c
 @@ -23,6 +23,7 @@
@@ -633,7 +633,7 @@ index 2a0e735..dc80018 100644
  #include <isc/mem.h>
  #include <isc/netaddr.h>
  #include <isc/parseint.h>
-@@ -2590,6 +2591,15 @@ bind9_check_key(const cfg_obj_t *key, isc_log_t *logctx) {
+@@ -2618,6 +2619,15 @@ bind9_check_key(const cfg_obj_t *key, isc_log_t *logctx) {
  	}
  
  	algorithm = cfg_obj_asstring(algobj);
@@ -937,10 +937,10 @@ index 9c42c50..f51d548 100644
  
  void
 diff --git a/lib/dns/tests/rsa_test.c b/lib/dns/tests/rsa_test.c
-index 16214c6..9b235ba 100644
+index f9ac6d0..241e17e 100644
 --- a/lib/dns/tests/rsa_test.c
 +++ b/lib/dns/tests/rsa_test.c
-@@ -26,6 +26,7 @@
+@@ -27,6 +27,7 @@
  #define UNIT_TESTING
  #include <cmocka.h>
  
@@ -948,7 +948,7 @@ index 16214c6..9b235ba 100644
  #include <isc/util.h>
  #include <isc/print.h>
  
-@@ -247,6 +248,8 @@ isc_rsa_verify_test(void **state) {
+@@ -248,6 +249,8 @@ isc_rsa_verify_test(void **state) {
  	/* RSAMD5 */
  
  #ifndef PK11_MD5_DISABLE
@@ -957,7 +957,7 @@ index 16214c6..9b235ba 100644
  	key->key_alg = DST_ALG_RSAMD5;
  
  	ret = dst_context_create3(key, mctx, DNS_LOGCATEGORY_DNSSEC,
-@@ -264,6 +267,7 @@ isc_rsa_verify_test(void **state) {
+@@ -265,6 +268,7 @@ isc_rsa_verify_test(void **state) {
  	assert_int_equal(ret, ISC_R_SUCCESS);
  
  	dst_context_destroy(&ctx);
@@ -966,10 +966,10 @@ index 16214c6..9b235ba 100644
  
  	/* RSASHA256 */
 diff --git a/lib/dns/tests/tsig_test.c b/lib/dns/tests/tsig_test.c
-index 8e5250e..9accc53 100644
+index 11d011a..feb2068 100644
 --- a/lib/dns/tests/tsig_test.c
 +++ b/lib/dns/tests/tsig_test.c
-@@ -24,6 +24,7 @@
+@@ -25,6 +25,7 @@
  #define UNIT_TESTING
  #include <cmocka.h>
  
@@ -1215,7 +1215,7 @@ index 249f3da..628a414 100644
  
  /*
 diff --git a/lib/isc/pk11.c b/lib/isc/pk11.c
-index 0d5b009..bb9912b 100644
+index 0d5b009..7809e7b 100644
 --- a/lib/isc/pk11.c
 +++ b/lib/isc/pk11.c
 @@ -197,8 +197,6 @@ pk11_initialize(isc_mem_t *mctx, const char *engine) {
@@ -1227,14 +1227,14 @@ index 0d5b009..bb9912b 100644
  	}
  
  	ISC_LIST_INIT(tokens);
-@@ -236,6 +234,7 @@ pk11_initialize(isc_mem_t *mctx, const char *engine) {
- 		result = PK11_R_NOAESSERVICE;
- 		goto unlock;
+@@ -238,6 +236,7 @@ pk11_initialize(isc_mem_t *mctx, const char *engine) {
  	}
-+	initialized = true;
  #endif
  #endif /* PKCS11CRYPTO */
++	initialized = true;
   unlock:
+ 	UNLOCK(&sessionlock);
+ 	return (result);
 @@ -589,6 +588,8 @@ scan_slots(void) {
  	pk11_token_t *token;
  	unsigned int i;
@@ -1334,10 +1334,10 @@ index 0d5b009..bb9912b 100644
  
  		/* ECDSA requires digest */
 diff --git a/lib/isc/tests/hash_test.c b/lib/isc/tests/hash_test.c
-index 8ddfe70..9c4d299 100644
+index 31ced94..421131e 100644
 --- a/lib/isc/tests/hash_test.c
 +++ b/lib/isc/tests/hash_test.c
-@@ -776,6 +776,9 @@ isc_md5_test(void **state) {
+@@ -775,6 +775,9 @@ isc_md5_test(void **state) {
  
  	UNUSED(state);
  
@@ -1347,7 +1347,7 @@ index 8ddfe70..9c4d299 100644
  	/*
  	 * These are the various test vectors.  All of these are passed
  	 * through the hash function and the results are compared to the
-@@ -1631,6 +1634,9 @@ isc_hmacmd5_test(void **state) {
+@@ -1630,6 +1633,9 @@ isc_hmacmd5_test(void **state) {
  
  	UNUSED(state);
  
@@ -1357,7 +1357,7 @@ index 8ddfe70..9c4d299 100644
  	/*
  	 * These are the various test vectors.  All of these are passed
  	 * through the hash function and the results are compared to the
-@@ -1941,6 +1947,9 @@ static void
+@@ -1940,6 +1946,9 @@ static void
  md5_check_test(void **state) {
  	UNUSED(state);
  

From c5d9a5c66a3da36ec5fe544b06da57ac56bf79ab Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 27 Aug 2019 20:46:46 +0200
Subject: [PATCH 050/460] Avoid conflicts between OpenSSL and native PKCS#11

Do not set default engine when native module should be used.
---
 bind-9.11-engine-pkcs11.patch | 27 +++++++++++++++++++++++++++
 bind.spec                     |  3 +++
 2 files changed, 30 insertions(+)
 create mode 100644 bind-9.11-engine-pkcs11.patch

diff --git a/bind-9.11-engine-pkcs11.patch b/bind-9.11-engine-pkcs11.patch
new file mode 100644
index 0000000..4a6290d
--- /dev/null
+++ b/bind-9.11-engine-pkcs11.patch
@@ -0,0 +1,27 @@
+From 37f89ccfc439f8d86c401d9ae10e94e53b924961 Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Tue, 27 Aug 2019 20:39:59 +0200
+Subject: [PATCH] Do not set engine for native PKCS11
+
+It resets already set lib_path to pkcs11, which is invalid in native
+pkcs11 crypto. Engine has to be path to PKCS#11 module.
+---
+ bin/named/include/named/globals.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/bin/named/include/named/globals.h b/bin/named/include/named/globals.h
+index eda2214..2a611d5 100644
+--- a/bin/named/include/named/globals.h
++++ b/bin/named/include/named/globals.h
+@@ -160,7 +160,7 @@ EXTERN const char *		ns_g_defaultdnstap	INIT(NULL);
+ 
+ EXTERN const char *		ns_g_username		INIT(NULL);
+ 
+-#if defined(USE_PKCS11)
++#if defined(USE_PKCS11) && !defined(PKCS11CRYPTO)
+ EXTERN const char *		ns_g_engine		INIT(PKCS11_ENGINE);
+ #else
+ EXTERN const char *		ns_g_engine		INIT(NULL);
+-- 
+2.20.1
+
diff --git a/bind.spec b/bind.spec
index 9208af7..97be60f 100644
--- a/bind.spec
+++ b/bind.spec
@@ -116,6 +116,8 @@ Patch140:bind-9.11-rh1410433.patch
 Patch145:bind-9.11-rh1205168.patch
 # [ISC-Bugs #46853] commit cb616c6d5c2ece1fac37fa6e0bca2b53d4043098 ISC 4851
 Patch149:bind-9.11-kyua-pkcs11.patch
+# Avoid conflicts with OpenSSL PKCS11 engine
+Patch150:bind-9.11-engine-pkcs11.patch
 Patch153:bind-9.11-export-suffix.patch
 Patch154:bind-9.11-oot-manual.patch
 Patch155:bind-9.11-pk11.patch
@@ -551,6 +553,7 @@ cp -r lib/isc{,-pkcs11}
 cp -r lib/dns{,-pkcs11}
 %patch136 -p1 -b .dist_pkcs11
 %patch149 -p1 -b .kyua-pkcs11
+%patch150 -p1 -b .engine-pkcs11
 %endif
 
 %if %{with SDB}

From b40bc8c8c4afeb07bdcac899fcb9d2cb2e59fb51 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 8 Aug 2019 13:51:16 +0200
Subject: [PATCH 051/460] Permit explicit disabling of RSAMD5 in FIPS mode
 (#1709553)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When MD5 is disabled in library, it behaved like RSAMD5 were unknown.
But security-policy disables it explicitly. It failed to even start in
FIPS mode, because such algorithm were unknown. Fix disabled algorithm
to return disabled result code. Accept such algorithm only when
disabling it.

Signed-off-by: Petr Menšík <pemensik@redhat.com>
---
 bind-9.11-fips-disable.patch | 97 ++++++++++++++++++++++++++++++++++++
 bind.spec                    |  7 ++-
 2 files changed, 103 insertions(+), 1 deletion(-)
 create mode 100644 bind-9.11-fips-disable.patch

diff --git a/bind-9.11-fips-disable.patch b/bind-9.11-fips-disable.patch
new file mode 100644
index 0000000..525316a
--- /dev/null
+++ b/bind-9.11-fips-disable.patch
@@ -0,0 +1,97 @@
+From df23c869f8973bc9494dcdc86ef46070d8194897 Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Mon, 5 Aug 2019 11:54:03 +0200
+Subject: [PATCH] Allow explicit disabling of autodisabled MD5
+
+Default security policy might include explicitly disabled RSAMD5
+algorithm. Current FIPS code automatically disables in FIPS mode. But if
+RSAMD5 is included in security policy, it fails to start, because that
+algorithm is not recognized. Allow it disabled, but fail on any
+other usage.
+---
+ bin/named/server.c |  2 +-
+ lib/dns/rcode.c    | 31 +++++++++++++------------------
+ 2 files changed, 14 insertions(+), 19 deletions(-)
+
+diff --git a/bin/named/server.c b/bin/named/server.c
+index 3cd49a9..ef82d89 100644
+--- a/bin/named/server.c
++++ b/bin/named/server.c
+@@ -1551,7 +1551,7 @@ disable_algorithms(const cfg_obj_t *disabled, dns_resolver_t *resolver) {
+ 			result = isc_parse_uint8(&ui, r.base, 10);
+ 			alg = ui;
+ 		}
+-		if (result != ISC_R_SUCCESS) {
++		if (result != ISC_R_SUCCESS && result != ISC_R_DISABLED) {
+ 			cfg_obj_log(cfg_listelt_value(element),
+ 				    ns_g_lctx, ISC_LOG_ERROR,
+ 				    "invalid algorithm");
+diff --git a/lib/dns/rcode.c b/lib/dns/rcode.c
+index f51d548..8dbb12d 100644
+--- a/lib/dns/rcode.c
++++ b/lib/dns/rcode.c
+@@ -126,7 +126,6 @@
+ #endif
+ 
+ #define SECALGNAMES \
+-	MD5_SECALGNAMES \
+ 	DH_SECALGNAMES \
+ 	DSA_SECALGNAMES \
+ 	{ DNS_KEYALG_ECC, "ECC", 0 }, \
+@@ -178,6 +177,7 @@ static struct tbl rcodes[] = { RCODENAMES ERCODENAMES };
+ static struct tbl tsigrcodes[] = { RCODENAMES TSIGRCODENAMES };
+ static struct tbl certs[] = { CERTNAMES };
+ static struct tbl secalgs[] = { SECALGNAMES };
++static struct tbl md5_secalgs[] = { MD5_SECALGNAMES };
+ static struct tbl secprotos[] = { SECPROTONAMES };
+ static struct tbl hashalgs[] = { HASHALGNAMES };
+ static struct tbl dsdigests[] = { DSDIGESTNAMES };
+@@ -358,33 +358,28 @@ dns_cert_totext(dns_cert_t cert, isc_buffer_t *target) {
+ 	return (dns_mnemonic_totext(cert, target, certs));
+ }
+ 
+-static inline struct tbl *
+-secalgs_tbl_start() {
+-	struct tbl *algs = secalgs;
+-
+-#ifndef PK11_MD5_DISABLE
+-	if (!isc_md5_available()) {
+-		while (algs->name != NULL &&
+-		       algs->value == DNS_KEYALG_RSAMD5)
+-			++algs;
+-	}
+-#endif
+-	return algs;
+-}
+-
+ isc_result_t
+ dns_secalg_fromtext(dns_secalg_t *secalgp, isc_textregion_t *source) {
+ 	unsigned int value;
++	isc_result_t result;
+ 
+-	RETERR(dns_mnemonic_fromtext(&value, source,
+-	                             secalgs_tbl_start(), 0xff));
++	result = dns_mnemonic_fromtext(&value, source,
++	                             secalgs, 0xff);
++	if (result != ISC_R_SUCCESS) {
++		result = dns_mnemonic_fromtext(&value, source,
++		                               md5_secalgs, 0xff);
++		if (result != ISC_R_SUCCESS) {
++			return (result);
++		} else if (!isc_md5_available())
++			return (ISC_R_DISABLED);
++	}
+ 	*secalgp = value;
+ 	return (ISC_R_SUCCESS);
+ }
+ 
+ isc_result_t
+ dns_secalg_totext(dns_secalg_t secalg, isc_buffer_t *target) {
+-	return (dns_mnemonic_totext(secalg, target, secalgs_tbl_start()));
++	return (dns_mnemonic_totext(secalg, target, secalgs));
+ }
+ 
+ void
+-- 
+2.20.1
+
diff --git a/bind.spec b/bind.spec
index 0bfa7a3..0151e05 100644
--- a/bind.spec
+++ b/bind.spec
@@ -53,7 +53,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.11.9
-Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -141,6 +141,7 @@ Patch172:bind-9.11-tests-pkcs11.patch
 Patch173:bind-9.11-rh1732883.patch
 # Make sure jsonccp-devel does not interfere
 Patch174:bind-9.11-json-c.patch
+Patch175:bind-9.11-fips-disable.patch
 
 # SDB patches
 Patch11: bind-9.3.2b2-sdbsrc.patch
@@ -522,6 +523,7 @@ are used for building ISC DHCP.
 %patch172 -p1 -b .test-pkcs11
 %patch173 -p1 -b .rh1732883
 %patch174 -p1 -b .json-c
+%patch175 -p1 -b .rh1709553
 
 mkdir lib/dns/tests/testdata/dstrandom
 cp -a %{SOURCE50} lib/dns/tests/testdata/dstrandom/random.data
@@ -1516,6 +1518,9 @@ fi;
 
 
 %changelog
+* Thu Aug 08 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.9-2
+- Permit explicit disabling of RSAMD5 in FIPS mode (#1709553)
+
 * Wed Jul 24 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.9-1
 - Update to 9.11.9
 

From ff25a45a41c1232ded2139d7895b54729e240762 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 8 Aug 2019 15:06:43 +0200
Subject: [PATCH 052/460] Fix rpmlint warnings

Clean whitespace to satisfy rpmlint
---
 bind.spec | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/bind.spec b/bind.spec
index 0151e05..4ce8b43 100644
--- a/bind.spec
+++ b/bind.spec
@@ -165,7 +165,7 @@ Obsoletes:      caching-nameserver < 31:9.4.1-7.fc8
 Provides:       caching-nameserver = 31:9.4.1-7.fc8
 Obsoletes:      dnssec-conf < 1.27-2
 Provides:       dnssec-conf = 1.27-2
-# This wild require should satisfy %selinux_set_boolean macro only
+# This wild require should satisfy %%selinux_set_boolean macro only
 # in case it needs to be used
 Requires(post): ((policycoreutils-python-utils and libselinux-utils) if (selinux-policy-targeted or selinux-policy-mls))
 Requires(post): ((selinux-policy and selinux-policy-base) if (selinux-policy-targeted or selinux-policy-mls))
@@ -775,12 +775,12 @@ popd
 # Test just compiled libraries
 for lib in %{bind_export_libs}
 do
-	sed -e "s,^\s*include(.*${lib}/.*,-- use &," \
-        	-i export-libs/lib/Kyuafile
+  sed -e "s,^\s*include(.*${lib}/.*,-- use &," \
+      -i export-libs/lib/Kyuafile
 done
 
 sed -e "/^\s*include(/ d" -e 's/^-- use //' \
-       	-i export-libs/lib/Kyuafile
+    -i export-libs/lib/Kyuafile
 
 ## End of export libs
 %endif

From 4378f987b491a2b360af7638534a7f482d6646d2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 9 Aug 2019 12:32:48 +0200
Subject: [PATCH 053/460] Report errors from rndc reload (#1739441)

Success status has to be ignored until systemd is fixed. Now it would
kill service on reload failure, which is far worse than reload error.
---
 named-chroot.service     | 3 ++-
 named-pkcs11.service     | 3 ++-
 named-sdb-chroot.service | 3 ++-
 named-sdb.service        | 3 ++-
 named.service            | 4 ++--
 5 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/named-chroot.service b/named-chroot.service
index 5732b1c..ed9aa51 100644
--- a/named-chroot.service
+++ b/named-chroot.service
@@ -20,7 +20,8 @@ PIDFile=/var/named/chroot/run/named/named.pid
 ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf -t /var/named/chroot -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
 ExecStart=/usr/sbin/named -u named -c ${NAMEDCONF} -t /var/named/chroot $OPTIONS
 
-ExecReload=/bin/sh -c '/usr/sbin/rndc reload > /dev/null 2>&1 || /bin/kill -HUP $MAINPID'
+; until https://github.com/systemd/systemd/pull/13098 is present, ignore return value
+ExecReload=-/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
 
 ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'
 
diff --git a/named-pkcs11.service b/named-pkcs11.service
index c1a19d1..f0e8913 100644
--- a/named-pkcs11.service
+++ b/named-pkcs11.service
@@ -16,7 +16,8 @@ PIDFile=/run/named/named.pid
 ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
 ExecStart=/usr/sbin/named-pkcs11 -u named -c ${NAMEDCONF} $OPTIONS
 
-ExecReload=/bin/sh -c '/usr/sbin/rndc reload > /dev/null 2>&1 || /bin/kill -HUP $MAINPID'
+; until https://github.com/systemd/systemd/pull/13098 is present, ignore return value
+ExecReload=-/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
 
 ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'
 
diff --git a/named-sdb-chroot.service b/named-sdb-chroot.service
index 5294f47..16a080f 100644
--- a/named-sdb-chroot.service
+++ b/named-sdb-chroot.service
@@ -20,7 +20,8 @@ PIDFile=/var/named/chroot_sdb/run/named/named.pid
 ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf -t /var/named/chroot_sdb -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
 ExecStart=/usr/sbin/named-sdb -u named -c ${NAMEDCONF} -t /var/named/chroot_sdb $OPTIONS
 
-ExecReload=/bin/sh -c '/usr/sbin/rndc reload > /dev/null 2>&1 || /bin/kill -HUP $MAINPID'
+; until https://github.com/systemd/systemd/pull/13098 is present, ignore return value
+ExecReload=-/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
 
 ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'
 
diff --git a/named-sdb.service b/named-sdb.service
index b80ec17..d3ef6e5 100644
--- a/named-sdb.service
+++ b/named-sdb.service
@@ -16,7 +16,8 @@ PIDFile=/run/named/named.pid
 ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
 ExecStart=/usr/sbin/named-sdb -u named -c ${NAMEDCONF} $OPTIONS
 
-ExecReload=/bin/sh -c '/usr/sbin/rndc reload > /dev/null 2>&1 || /bin/kill -HUP $MAINPID'
+; until https://github.com/systemd/systemd/pull/13098 is present, ignore return value
+ExecReload=-/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
 
 ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'
 
diff --git a/named.service b/named.service
index 6a162ad..86737ea 100644
--- a/named.service
+++ b/named.service
@@ -15,8 +15,8 @@ PIDFile=/run/named/named.pid
 
 ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
 ExecStart=/usr/sbin/named -u named -c ${NAMEDCONF} $OPTIONS
-
-ExecReload=/bin/sh -c '/usr/sbin/rndc reload > /dev/null 2>&1 || /bin/kill -HUP $MAINPID'
+; until https://github.com/systemd/systemd/pull/13098 is present, ignore return value
+ExecReload=-/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
 
 ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'
 

From a815d5ceb5da290628bb384f777c291b706b4784 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 9 Aug 2019 12:39:58 +0200
Subject: [PATCH 054/460] Add changelog and bump spec

---
 bind.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index 4ce8b43..6393021 100644
--- a/bind.spec
+++ b/bind.spec
@@ -53,7 +53,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.11.9
-Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  3%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1518,6 +1518,9 @@ fi;
 
 
 %changelog
+* Fri Aug 09 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.9-3
+- Display errors from rndc reload (#1739441)
+
 * Thu Aug 08 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.9-2
 - Permit explicit disabling of RSAMD5 in FIPS mode (#1709553)
 

From aca3c550fd3f1e29feb4f5e85baa0e0a358905bb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 27 Aug 2019 10:07:09 +0200
Subject: [PATCH 055/460] Update to BIND 9.11.10

---
 .gitignore              |  1 +
 bind-9.11.10.tar.gz.asc | 16 ++++++++++++++++
 bind-9.11.9.tar.gz.asc  | 16 ----------------
 bind.spec               |  9 ++++++---
 sources                 |  2 +-
 5 files changed, 24 insertions(+), 20 deletions(-)
 create mode 100644 bind-9.11.10.tar.gz.asc
 delete mode 100644 bind-9.11.9.tar.gz.asc

diff --git a/.gitignore b/.gitignore
index 08ffa36..b64b4e5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -94,3 +94,4 @@ bind-9.7.2b1.tar.gz
 /bind-9.11.6-P1.tar.gz
 /bind-9.11.8.tar.gz
 /bind-9.11.9.tar.gz
+/bind-9.11.10.tar.gz
diff --git a/bind-9.11.10.tar.gz.asc b/bind-9.11.10.tar.gz.asc
new file mode 100644
index 0000000..8ea66c9
--- /dev/null
+++ b/bind-9.11.10.tar.gz.asc
@@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABAgAdFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAl1VKuIACgkQdLtrmky7
+PThvHg/+O+c3U/k/3wYB5XAmT2HSCIqIp8gdu4+0B4rsIJAN+aR1HDIsCTuJqyjw
+jw9fI61d5skxeJljbNChAMTC2Ps1W7bXHFC8B25WQvQAcL/FDJQrLtgRXCJKB9sd
+/hss07hGrrZbE5wRePJJtn4R1d6WLoA/hz1da7IcoZJpFPmlkHE9kZUd9mPAHnMv
+QYCqpl821m53UMENufyrwNMDTaIwqPM4fJ8OVBam/743ZIOP/imwMVnJws6HjRz1
+n4JPoKsMkLOTV0hDotgTl7V1qm4EXKG5xPM882frpfRkk/V/qOvEzLkgVLDF6xHR
+iuZsMvKfrc/VyrKRcQNHs2kA0EqbKfskLoSenj7B/WrvVCeQ+MA4MSg/81Rzzs6P
+gDDCMcWY3X2VlYUA521Z9DagoC49DpfKf+rfeCH/HTNjdWkfClnQoGb9n5Ggy/sM
+NP/ApLN2TOHqMIMU0RGr2U3OY8TNmpq7xfggnr3qL5Of1ez4HYlyLdmma3HPJjvY
+uYdJwVRcJ7rq510QBSf8VGK9/qERkhklh4MZvIzS5htnn+94Gk3gT8p3aZGQ5z2d
+W2RVl+4HQ7aRtQMeQeX79uccVF9vcTBTiAJhILYcp7Q6NBOVMTCabSAnRk3f0GfS
+1x+Ojt+7yVCB3pym8N+mHM3q8l7VvIw1As7QAGi6mdVAaTN8zxc=
+=ZIsR
+-----END PGP SIGNATURE-----
diff --git a/bind-9.11.9.tar.gz.asc b/bind-9.11.9.tar.gz.asc
deleted file mode 100644
index 9e9ad71..0000000
--- a/bind-9.11.9.tar.gz.asc
+++ /dev/null
@@ -1,16 +0,0 @@
------BEGIN PGP SIGNATURE-----
-
-iQIzBAABAgAdFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAl0u4wIACgkQdLtrmky7
-PTgO+A/8DtA5xbbJZx6ifx/AXS+0TBwnyRt1qkDplCRMq4/G+/r9iHh2Z3JYiznV
-NKHkV7JV+d4p9pygOo0s563DsFTg3A6OtzhU7n8QxFS4e3T6S+vKBX1s0Iixu/hN
-q9pxhhefeGejVUjhKqAHbNvoCO2stMAgZi02qhqECJPvu8YtyOPEPNW/K+2aWLH3
-P3gNwIbj1+NjNBWAAhiSEK+px7do4499AxGOZcCPUUmhEAWckcQ1wyC94tDC3uQi
-XY3asr6Ph7WWXkM0qnUDx9+ZPKKDOMevX11W+5cNw1qioss8dWcs3l7mhUuRITVx
-u/yaQYt7F9BY5XjtbaBtTWBDRbpCrrt2YpMhNJ/aedSbCoRT/ZYiDqNwKCEes10s
-hJK4LG4pCtVWQnwi4xFeCxI+NJK5b5gRj5NZ/cwKqGMnEmO0hg3aiDtEUF424t1i
-IdJvDs+NaMjHqitpvc8hlJpTpiefCuGTYjrrJLjnAsA3r72z4aLb8M6ivBNmpEiJ
-x5LFyBZusHzuCSfFV23tBZvZ1VQf53Netz0PXbOCdnKKYlibUGzD3pC8LdoMoj5m
-/s4BYes5ET4xA867yZg7y/A0x0Ezuw+7NLXhpMSAQh/OZwWQ1CzspvYUxl8hHx67
-r1aH0dkAtN8BtaR5lTrXtFfRTJvEqNQ9lFQwljwEJqfwFN4dJBc=
-=m4su
------END PGP SIGNATURE-----
diff --git a/bind.spec b/bind.spec
index 6393021..b60b2a8 100644
--- a/bind.spec
+++ b/bind.spec
@@ -44,7 +44,7 @@
 #
 
 # lib*.so.X versions of selected libraries
-%global sover_dns 1106
+%global sover_dns 1107
 %global sover_isc 1100
 %global sover_irs 161
 %global sover_isccfg 163
@@ -52,8 +52,8 @@
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.11.9
-Release:  3%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Version:  9.11.10
+Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1518,6 +1518,9 @@ fi;
 
 
 %changelog
+* Tue Aug 27 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.10-1
+- Update to 9.11.10
+
 * Fri Aug 09 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.9-3
 - Display errors from rndc reload (#1739441)
 
diff --git a/sources b/sources
index 78dba7f..c992ba3 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.11.9.tar.gz) = 4fa975b83986480a12138a3cf7ccf3bcd2251d194e0c04e3fad0787fc8b2a5dee241179fbb25b0283fa6fcb749d7a15fad036039dbc81250defcba0108823ef8
+SHA512 (bind-9.11.10.tar.gz) = b560cd6b88df0ffe0008d0559b49c28fbe4ed49da1a81e61c373faa5368ad1570c4cf945d224b451634f7506e52d9effb9aee3966c5ff66d95215fffea494f4e
 SHA512 (config-19.tar.bz2) = 36aa38a0c7c33267ae594b31c81681290ac58dde7ca6749bd599da531380b5b1428330813dbe983e01071ccaed83e83f6a9cd92179a53b7d0ccbb6851a0b017c

From 00db7f45fdafcb44486919f80b144009f071fd70 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 27 Aug 2019 10:52:49 +0200
Subject: [PATCH 056/460] Update patches to 9.11.10

---
 bind-9.11-fips-tests.patch |  68 ++++++-----------------
 bind-9.11-rh1624100.patch  |  20 +++----
 bind-9.11-rt31459.patch    | 108 ++++++++++++++++++-------------------
 3 files changed, 80 insertions(+), 116 deletions(-)

diff --git a/bind-9.11-fips-tests.patch b/bind-9.11-fips-tests.patch
index 920440b..539cdcb 100644
--- a/bind-9.11-fips-tests.patch
+++ b/bind-9.11-fips-tests.patch
@@ -1,4 +1,4 @@
-From d0e3f8be48c8031ebe3d7e1bf2a32cb03c79484e Mon Sep 17 00:00:00 2001
+From f32eb98f81b33abd5b0d3c77f8f75cc3e77425ff Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 2 Aug 2018 23:46:45 +0200
 Subject: [PATCH] FIPS tests changes
@@ -77,7 +77,7 @@ Date:   Wed Mar 7 10:44:23 2018 +0100
  bin/tests/system/checkconf/bad-tsig.conf      |  2 +-
  bin/tests/system/checkconf/good.conf          |  2 +-
  bin/tests/system/digdelv/ns2/example.db       | 15 +++--
- bin/tests/system/digdelv/tests.sh             | 28 ++++----
+ bin/tests/system/digdelv/tests.sh             | 20 +++---
  bin/tests/system/dlv/ns1/sign.sh              |  4 +-
  bin/tests/system/dlv/ns2/sign.sh              |  4 +-
  bin/tests/system/dlv/ns6/sign.sh              | 66 +++++++++---------
@@ -102,7 +102,7 @@ Date:   Wed Mar 7 10:44:23 2018 +0100
  bin/tests/system/tsiggss/setup.sh             |  2 +-
  bin/tests/system/upforwd/ns1/named.conf.in    |  2 +-
  bin/tests/system/upforwd/tests.sh             |  2 +-
- 44 files changed, 226 insertions(+), 175 deletions(-)
+ 44 files changed, 222 insertions(+), 171 deletions(-)
 
 diff --git a/bin/tests/system/acl/ns2/named1.conf.in b/bin/tests/system/acl/ns2/named1.conf.in
 index 0ea6502..026db3f 100644
@@ -599,27 +599,9 @@ index f4e30f5..9f53e31 100644
  ; TTL of 3 weeks
  weeks		1814400	A	10.53.0.2
 diff --git a/bin/tests/system/digdelv/tests.sh b/bin/tests/system/digdelv/tests.sh
-index 1657dfd..299ba94 100644
+index ade45ce..d3aff24 100644
 --- a/bin/tests/system/digdelv/tests.sh
 +++ b/bin/tests/system/digdelv/tests.sh
-@@ -88,7 +88,7 @@ if [ -x "$DIG" ] ; then
-   echo_i "checking dig +multi +norrcomments works for dnskey (when default is rrcomments)($n)"
-   ret=0
-   $DIG $DIGOPTS +tcp @10.53.0.3 +multi +norrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1
--  grep "; ZSK; alg = RSAMD5 ; key id = 30795" < dig.out.test$n > /dev/null && ret=1
-+  grep "; ZSK; alg = RSASHA256 ; key id = 36895" < dig.out.test$n > /dev/null && ret=1
-   check_ttl_range dig.out.test$n "DNSKEY" 300 || ret=1
-   if [ $ret != 0 ]; then echo_i "failed"; fi
-   status=`expr $status + $ret`
-@@ -97,7 +97,7 @@ if [ -x "$DIG" ] ; then
-   echo_i "checking dig +multi +norrcomments works for soa (when default is rrcomments)($n)"
-   ret=0
-   $DIG $DIGOPTS +tcp @10.53.0.3 +multi +norrcomments SOA example > dig.out.test$n || ret=1
--  grep "; ZSK; alg = RSAMD5 ; key id = 30795" < dig.out.test$n > /dev/null && ret=1
-+  grep "; ZSK; alg = RSASHA256 ; key id = 36895" < dig.out.test$n > /dev/null && ret=1
-   check_ttl_range dig.out.test$n "SOA" 300 || ret=1
-   if [ $ret != 0 ]; then echo_i "failed"; fi
-   status=`expr $status + $ret`
 @@ -106,7 +106,7 @@ if [ -x "$DIG" ] ; then
    echo_i "checking dig +rrcomments works for DNSKEY($n)"
    ret=0
@@ -665,25 +647,7 @@ index 1657dfd..299ba94 100644
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
  
-@@ -661,7 +661,7 @@ if [ -x ${DELV} ] ; then
-   echo_i "checking delv +multi +norrcomments works for dnskey (when default is rrcomments)($n)"
-   ret=0
-   $DELV $DELVOPTS +tcp @10.53.0.3 +multi +norrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
--  grep "; ZSK; alg = RSAMD5 ; key id = 30795" < delv.out.test$n > /dev/null && ret=1
-+  grep "; ZSK; alg = RSASHA256 ; key id = 36895" < delv.out.test$n > /dev/null && ret=1
-   check_ttl_range delv.out.test$n "DNSKEY" 300 || ret=1
-   if [ $ret != 0 ]; then echo_i "failed"; fi
-   status=`expr $status + $ret`
-@@ -670,7 +670,7 @@ if [ -x ${DELV} ] ; then
-   echo_i "checking delv +multi +norrcomments works for soa (when default is rrcomments)($n)"
-   ret=0
-   $DELV $DELVOPTS +tcp @10.53.0.3 +multi +norrcomments SOA example > delv.out.test$n || ret=1
--  grep "; ZSK; alg = RSAMD5 ; key id = 30795" < delv.out.test$n > /dev/null && ret=1
-+  grep "; ZSK; alg = RSASHA256 ; key id = 36895" < delv.out.test$n > /dev/null && ret=1
-   check_ttl_range delv.out.test$n "SOA" 300 || ret=1
-   if [ $ret != 0 ]; then echo_i "failed"; fi
-   status=`expr $status + $ret`
-@@ -679,7 +679,7 @@ if [ -x ${DELV} ] ; then
+@@ -695,7 +695,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +rrcomments works for DNSKEY($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +rrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
@@ -692,7 +656,7 @@ index 1657dfd..299ba94 100644
    check_ttl_range delv.out.test$n "DNSKEY" 300 || ret=1
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
-@@ -688,7 +688,7 @@ if [ -x ${DELV} ] ; then
+@@ -704,7 +704,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +short +rrcomments works for DNSKEY ($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
@@ -701,7 +665,7 @@ index 1657dfd..299ba94 100644
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
  
-@@ -696,7 +696,7 @@ if [ -x ${DELV} ] ; then
+@@ -712,7 +712,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +short +rrcomments works ($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
@@ -710,7 +674,7 @@ index 1657dfd..299ba94 100644
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
  
-@@ -704,7 +704,7 @@ if [ -x ${DELV} ] ; then
+@@ -720,7 +720,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +short +nosplit works ($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +short +nosplit DNSKEY dnskey.example > delv.out.test$n || ret=1
@@ -719,7 +683,7 @@ index 1657dfd..299ba94 100644
    if test `wc -l < delv.out.test$n` != 1 ; then ret=1 ; fi
    f=`awk '{print NF}' < delv.out.test$n`
    test "${f:-0}" -eq 14 || ret=1
-@@ -715,7 +715,7 @@ if [ -x ${DELV} ] ; then
+@@ -731,7 +731,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +short +nosplit +norrcomments works ($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +short +nosplit +norrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
@@ -990,10 +954,10 @@ index ed30460..e6b1126 100644
 +    "." 256 3 8 "AwEAAarwAdjV4gIhpBCjXVAScRFEx3co7k8smJdxrnqoGsl5NB7EZ9jRdgvCXbJn6v8y9jlNWVHvaC8ilhfhLh0A1vLWiWv4ijd/12xcnrY7xpG7Cu3YkxUxaXJ7Jdg/Iw1+9mGgXF1v4UbCIcw/3U3cxyk7OxYg+VSb5KBAQSR0upxV";
  };
 diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh
-index d07881d..17ad256 100644
+index b31c1b4..a5e237b 100644
 --- a/bin/tests/system/dnssec/tests.sh
 +++ b/bin/tests/system/dnssec/tests.sh
-@@ -3227,8 +3227,8 @@ do
+@@ -3235,8 +3235,8 @@ do
  	   alg=`expr $alg + 1`
  	   continue;;
  	3) size="-b 512";;
@@ -1005,7 +969,7 @@ index d07881d..17ad256 100644
  	8) size="-b 512";;
  	10) size="-b 1024";;
 diff --git a/bin/tests/system/feature-test.c b/bin/tests/system/feature-test.c
-index 27a02d0..caf4166 100644
+index c1249ed..20a3139 100644
 --- a/bin/tests/system/feature-test.c
 +++ b/bin/tests/system/feature-test.c
 @@ -19,6 +19,7 @@
@@ -1016,7 +980,7 @@ index 27a02d0..caf4166 100644
  #include <dns/edns.h>
  
  #ifdef WIN32
-@@ -46,6 +47,7 @@ usage() {
+@@ -47,6 +48,7 @@ usage() {
  	fprintf(stderr, "	--have-geoip2\n");
  	fprintf(stderr, "	--have-libxml2\n");
  	fprintf(stderr, "	--ipv6only=no\n");
@@ -1024,7 +988,7 @@ index 27a02d0..caf4166 100644
  	fprintf(stderr, "	--rpz-nsdname\n");
  	fprintf(stderr, "	--rpz-nsip\n");
  	fprintf(stderr, "	--with-idn\n");
-@@ -146,6 +148,18 @@ main(int argc, char **argv) {
+@@ -155,6 +157,18 @@ main(int argc, char **argv) {
  #endif
  	}
  
@@ -1209,10 +1173,10 @@ index 343869e..c30efb0 100644
  make_key 3 ${EXTRAPORT3} hmac-sha224
  make_key 4 ${EXTRAPORT4} hmac-sha256
 diff --git a/bin/tests/system/rndc/tests.sh b/bin/tests/system/rndc/tests.sh
-index b00056c..f7fad91 100644
+index 57e066d..186a723 100644
 --- a/bin/tests/system/rndc/tests.sh
 +++ b/bin/tests/system/rndc/tests.sh
-@@ -356,15 +356,20 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
+@@ -348,15 +348,20 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
  status=`expr $status + $ret`
  
  n=`expr $n + 1`
diff --git a/bind-9.11-rh1624100.patch b/bind-9.11-rh1624100.patch
index 00030cc..5764ed7 100644
--- a/bind-9.11-rh1624100.patch
+++ b/bind-9.11-rh1624100.patch
@@ -1,4 +1,4 @@
-From 292a0ca28f2e8a49f8c7e62c39ad7160234ce23d Mon Sep 17 00:00:00 2001
+From 76594cba9a1e910bb36160d96fc3872349341799 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@sury.org>
 Date: Wed, 25 Apr 2018 14:04:31 +0200
 Subject: [PATCH] Replace isc_safe routines with their OpenSSL counter parts
@@ -81,15 +81,15 @@ index ad77f24..670982a 100644
  
  /* accept_sec_context.c */
 diff --git a/lib/isc/Makefile.in b/lib/isc/Makefile.in
-index ba53ef1..98acfff 100644
+index 0fd0837..8ad54bb 100644
 --- a/lib/isc/Makefile.in
 +++ b/lib/isc/Makefile.in
 @@ -60,7 +60,7 @@ OBJS =		@ISC_EXTRA_OBJS@ @ISC_PK11_O@ @ISC_PK11_RESULT_O@ \
  		parseint.@O@ portset.@O@ quota.@O@ radix.@O@ random.@O@ \
  		ratelimiter.@O@ refcount.@O@ region.@O@ regex.@O@ result.@O@ \
  		rwlock.@O@ \
--		safe.@O@ serial.@O@ sha1.@O@ sha2.@O@ sockaddr.@O@ stats.@O@ \
-+		serial.@O@ sha1.@O@ sha2.@O@ sockaddr.@O@ stats.@O@ \
+-		safe.@O@ serial.@O@ siphash.@O@ sha1.@O@ sha2.@O@ sockaddr.@O@ stats.@O@ \
++		serial.@O@ siphash.@O@ sha1.@O@ sha2.@O@ sockaddr.@O@ stats.@O@ \
  		string.@O@ strtoul.@O@ symtab.@O@ task.@O@ taskpool.@O@ \
  		tm.@O@ timer.@O@ version.@O@ \
  		${UNIXOBJS} ${NLSOBJS} ${THREADOBJS}
@@ -97,8 +97,8 @@ index ba53ef1..98acfff 100644
  		netaddr.c netscope.c pool.c ondestroy.c \
  		parseint.c portset.c quota.c radix.c random.c ${CHACHASRCS} \
  		ratelimiter.c refcount.c region.c regex.c result.c rwlock.c \
--		safe.c serial.c sha1.c sha2.c sockaddr.c stats.c string.c \
-+		serial.c sha1.c sha2.c sockaddr.c stats.c string.c \
+-		safe.c serial.c siphash.c sha1.c sha2.c sockaddr.c stats.c string.c \
++		serial.c siphash.c sha1.c sha2.c sockaddr.c stats.c string.c \
  		strtoul.c symtab.c task.c taskpool.c timer.c \
  		tm.c version.c
  
@@ -241,10 +241,10 @@ index 7a464b6..0000000
 -#endif
 -}
 diff --git a/lib/isc/tests/safe_test.c b/lib/isc/tests/safe_test.c
-index 5775b6e..3451b5d 100644
+index 266ac75..60e9181 100644
 --- a/lib/isc/tests/safe_test.c
 +++ b/lib/isc/tests/safe_test.c
-@@ -44,22 +44,6 @@ isc_safe_memequal_test(void **state) {
+@@ -45,22 +45,6 @@ isc_safe_memequal_test(void **state) {
  				       "\x00\x00\x00\x00", 4));
  }
  
@@ -267,7 +267,7 @@ index 5775b6e..3451b5d 100644
  /* test isc_safe_memwipe() */
  static void
  isc_safe_memwipe_test(void **state) {
-@@ -68,7 +52,6 @@ isc_safe_memwipe_test(void **state) {
+@@ -69,7 +53,6 @@ isc_safe_memwipe_test(void **state) {
  	/* These should pass. */
  	isc_safe_memwipe(NULL, 0);
  	isc_safe_memwipe((void *) -1, 0);
@@ -275,7 +275,7 @@ index 5775b6e..3451b5d 100644
  
  	/*
  	 * isc_safe_memwipe(ptr, size) should function same as
-@@ -107,7 +90,6 @@ main(void) {
+@@ -108,7 +91,6 @@ main(void) {
  	const struct CMUnitTest tests[] = {
  		cmocka_unit_test(isc_safe_memequal_test),
  		cmocka_unit_test(isc_safe_memwipe_test),
diff --git a/bind-9.11-rt31459.patch b/bind-9.11-rt31459.patch
index bbb8948..27d8273 100644
--- a/bind-9.11-rt31459.patch
+++ b/bind-9.11-rt31459.patch
@@ -1,4 +1,4 @@
-From f0eee3c150b9b913819ecd864581ba50dd4ae9cf Mon Sep 17 00:00:00 2001
+From 9f62d68da08d21a8b35e27aeebd00afe6e5fb7be Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Tue, 12 Sep 2017 19:05:46 -0700
 Subject: [PATCH] rebased rt31459c
@@ -293,7 +293,7 @@ index fbc7ece..31a99e7 100644
  					   usekeyboard);
  
 diff --git a/bin/named/server.c b/bin/named/server.c
-index 767d83f..d3c2f9d 100644
+index c917cad..436a93a 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
 @@ -36,6 +36,7 @@
@@ -304,7 +304,7 @@ index 767d83f..d3c2f9d 100644
  #include <isc/portset.h>
  #include <isc/print.h>
  #include <isc/random.h>
-@@ -8208,6 +8209,10 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8209,6 +8210,10 @@ load_configuration(const char *filename, ns_server_t *server,
  				      "no source of entropy found");
  		} else {
  			const char *randomdev = cfg_obj_asstring(obj);
@@ -315,7 +315,7 @@ index 767d83f..d3c2f9d 100644
  			int level = ISC_LOG_ERROR;
  			result = isc_entropy_createfilesource(ns_g_entropy,
  							      randomdev);
-@@ -8242,6 +8247,7 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8243,6 +8248,7 @@ load_configuration(const char *filename, ns_server_t *server,
  				}
  				isc_entropy_detach(&ns_g_fallbackentropy);
  			}
@@ -671,10 +671,10 @@ index 9f90dd7..fad6c83 100644
          echo "I:failed"
  	status=`expr $status + $ret`
 diff --git a/bin/tools/mdig.c b/bin/tools/mdig.c
-index b27fc1d..e28871b 100644
+index 53579d4..e2f6810 100644
 --- a/bin/tools/mdig.c
 +++ b/bin/tools/mdig.c
-@@ -1969,12 +1969,11 @@ main(int argc, char *argv[]) {
+@@ -1972,12 +1972,11 @@ main(int argc, char *argv[]) {
  
  	ectx = NULL;
  	RUNCHECK(isc_entropy_create(mctx, &ectx));
@@ -689,7 +689,7 @@ index b27fc1d..e28871b 100644
  	parse_args(false, argc, argv);
  	if (server == NULL)
 diff --git a/configure b/configure
-index 4a5db6c..64aca10 100755
+index 2a4d9ed..e4e8ea6 100755
 --- a/configure
 +++ b/configure
 @@ -640,6 +640,7 @@ ac_includes_default="\
@@ -724,7 +724,7 @@ index 4a5db6c..64aca10 100755
    --enable-largefile      64-bit file support
    --enable-backtrace      log stack backtrace on abort [default=yes]
    --enable-symtable       use internal symbol table for backtrace
-@@ -17156,6 +17160,7 @@ case "$use_openssl" in
+@@ -17117,6 +17121,7 @@ case "$use_openssl" in
  $as_echo "disabled because of native PKCS11" >&6; }
  		DST_OPENSSL_INC=""
  		CRYPTO="-DPKCS11CRYPTO"
@@ -732,7 +732,7 @@ index 4a5db6c..64aca10 100755
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -17170,6 +17175,7 @@ $as_echo "disabled because of native PKCS11" >&6; }
+@@ -17131,6 +17136,7 @@ $as_echo "disabled because of native PKCS11" >&6; }
  $as_echo "no" >&6; }
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -740,7 +740,7 @@ index 4a5db6c..64aca10 100755
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -17182,6 +17188,7 @@ $as_echo "no" >&6; }
+@@ -17143,6 +17149,7 @@ $as_echo "no" >&6; }
  	auto)
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -748,7 +748,7 @@ index 4a5db6c..64aca10 100755
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -17191,7 +17198,7 @@ $as_echo "no" >&6; }
+@@ -17152,7 +17159,7 @@ $as_echo "no" >&6; }
  		OPENSSLLINKOBJS=""
  		OPENSSLLINKSRCS=""
  		as_fn_error $? "OpenSSL was not found in any of $openssldirs; use --with-openssl=/path
@@ -757,7 +757,7 @@ index 4a5db6c..64aca10 100755
  		;;
  	*)
  		if test "yes" = "$want_native_pkcs11"
-@@ -17222,6 +17229,7 @@ $as_echo "not found" >&6; }
+@@ -17183,6 +17190,7 @@ $as_echo "not found" >&6; }
  			as_fn_error $? "\"$use_openssl/include/openssl/opensslv.h\" not found" "$LINENO" 5
  		fi
  		CRYPTO='-DOPENSSL'
@@ -765,7 +765,7 @@ index 4a5db6c..64aca10 100755
  		if test "/usr" = "$use_openssl"
  		then
  			DST_OPENSSL_INC=""
-@@ -17883,8 +17891,6 @@ fi
+@@ -17808,8 +17816,6 @@ fi
  # Use OpenSSL for hash functions
  #
  
@@ -774,7 +774,7 @@ index 4a5db6c..64aca10 100755
  ISC_PLATFORM_OPENSSLHASH="#undef ISC_PLATFORM_OPENSSLHASH"
  case $want_openssl_hash in
  	yes)
-@@ -18259,6 +18265,86 @@ if test "rt" = "$have_clock_gt"; then
+@@ -18184,6 +18190,86 @@ if test "rt" = "$have_clock_gt"; then
  	LIBS="-lrt $LIBS"
  fi
  
@@ -861,7 +861,7 @@ index 4a5db6c..64aca10 100755
  #
  # was --with-lmdb specified?
  #
-@@ -20341,9 +20427,12 @@ _ACEOF
+@@ -20266,9 +20352,12 @@ _ACEOF
  if ac_fn_c_try_compile "$LINENO"; then :
    { $as_echo "$as_me:${as_lineno-$LINENO}: result: size_t for buflen; int for flags" >&5
  $as_echo "size_t for buflen; int for flags" >&6; }
@@ -876,7 +876,7 @@ index 4a5db6c..64aca10 100755
  
  	 $as_echo "#define IRS_GETNAMEINFO_FLAGS_T int" >>confdefs.h
  
-@@ -21658,12 +21747,7 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
+@@ -21583,12 +21672,7 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
  ISC_PLATFORM_USESTDASM="#undef ISC_PLATFORM_USESTDASM"
  ISC_PLATFORM_USEMACASM="#undef ISC_PLATFORM_USEMACASM"
  if test "yes" = "$use_atomic"; then
@@ -890,7 +890,7 @@ index 4a5db6c..64aca10 100755
  # version HP92453-01 B.11.11.23709.GP, which incorrectly rejects
  # declarations like `int a3[[(sizeof (unsigned char)) >= 0]];'.
  # This bug is HP SR number 8606223364.
-@@ -21696,6 +21780,11 @@ cat >>confdefs.h <<_ACEOF
+@@ -21621,6 +21705,11 @@ cat >>confdefs.h <<_ACEOF
  _ACEOF
  
  
@@ -902,7 +902,7 @@ index 4a5db6c..64aca10 100755
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -21704,39 +21793,6 @@ _ACEOF
+@@ -21629,39 +21718,6 @@ _ACEOF
  		fi
  	;;
  	x86_64-*|amd64-*)
@@ -942,7 +942,7 @@ index 4a5db6c..64aca10 100755
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -21767,6 +21823,10 @@ $as_echo_n "checking architecture type for atomic operations... " >&6; }
+@@ -21692,6 +21748,10 @@ $as_echo_n "checking architecture type for atomic operations... " >&6; }
  $as_echo "$arch" >&6; }
  fi
  
@@ -953,7 +953,7 @@ index 4a5db6c..64aca10 100755
  if test "yes" = "$have_atomic"; then
  	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking compiler support for inline assembly code" >&5
  $as_echo_n "checking compiler support for inline assembly code... " >&6; }
-@@ -24372,6 +24432,30 @@ CFLAGS="$CFLAGS $SO_CFLAGS"
+@@ -24297,6 +24357,30 @@ CFLAGS="$CFLAGS $SO_CFLAGS"
  #
  dlzdir='${DLZ_DRIVER_DIR}'
  
@@ -984,7 +984,7 @@ index 4a5db6c..64aca10 100755
  #
  # Private autoconf macro to simplify configuring drivers:
  #
-@@ -24702,11 +24786,11 @@ $as_echo "no" >&6; }
+@@ -24627,11 +24711,11 @@ $as_echo "no" >&6; }
  $as_echo "using mysql with libs ${mysql_lib} and includes ${mysql_include}" >&6; }
  		;;
  	*)
@@ -999,7 +999,7 @@ index 4a5db6c..64aca10 100755
  		fi
  
  	CONTRIB_DLZ="$CONTRIB_DLZ -DDLZ_MYSQL"
-@@ -24791,7 +24875,7 @@ $as_echo "" >&6; }
+@@ -24716,7 +24800,7 @@ $as_echo "" >&6; }
  			# Check other locations for includes.
  			# Order is important (sigh).
  
@@ -1008,7 +1008,7 @@ index 4a5db6c..64aca10 100755
  			# include a blank element first
  			for d in "" $bdb_incdirs
  			do
-@@ -24816,57 +24900,9 @@ $as_echo "" >&6; }
+@@ -24741,57 +24825,9 @@ $as_echo "" >&6; }
  			bdb_libnames="db53 db-5.3 db51 db-5.1 db48 db-4.8 db47 db-4.7 db46 db-4.6 db45 db-4.5 db44 db-4.4 db43 db-4.3 db42 db-4.2 db41 db-4.1 db"
  			for d in $bdb_libnames
  			do
@@ -1068,7 +1068,7 @@ index 4a5db6c..64aca10 100755
  					break
  				fi
  			done
-@@ -25025,10 +25061,10 @@ $as_echo "no" >&6; }
+@@ -24950,10 +24986,10 @@ $as_echo "no" >&6; }
  		DLZ_DRIVER_INCLUDES="$DLZ_DRIVER_INCLUDES -I$use_dlz_ldap/include"
  		DLZ_DRIVER_LDAP_INCLUDES="-I$use_dlz_ldap/include"
  	fi
@@ -1082,7 +1082,7 @@ index 4a5db6c..64aca10 100755
  	fi
  
  
-@@ -25114,11 +25150,11 @@ fi
+@@ -25039,11 +25075,11 @@ fi
  		odbcdirs="/usr /usr/local /usr/pkg"
  		for d in $odbcdirs
  		do
@@ -1096,7 +1096,7 @@ index 4a5db6c..64aca10 100755
  				break
  			fi
  		done
-@@ -25393,6 +25429,8 @@ DNS_CRYPTO_LIBS="$NEWFLAGS"
+@@ -25318,6 +25354,8 @@ DNS_CRYPTO_LIBS="$NEWFLAGS"
  
  
  
@@ -1105,7 +1105,7 @@ index 4a5db6c..64aca10 100755
  #
  # Commands to run at the end of config.status.
  # Don't just put these into configure, it won't work right if somebody
-@@ -27772,6 +27810,8 @@ report() {
+@@ -27697,6 +27735,8 @@ report() {
  	    echo "    IPv6 support (--enable-ipv6)"
  	test "X$CRYPTO" = "X" -o "yes" = "$want_native_pkcs11" || \
  		echo "    OpenSSL cryptography/DNSSEC (--with-openssl)"
@@ -1114,7 +1114,7 @@ index 4a5db6c..64aca10 100755
  	test "X$PYTHON" = "X" || echo "    Python tools (--with-python)"
  	test "X$XMLSTATS" = "X" || echo "    XML statistics (--with-libxml2)"
  	test "X$JSONSTATS" = "X" || echo "    JSON statistics (--with-libjson)"
-@@ -27812,6 +27852,8 @@ report() {
+@@ -27737,6 +27777,8 @@ report() {
  	echo "    Very verbose query trace logging (--enable-querytrace)"
      test "no" = "$with_cmocka" || echo "    CMocka Unit Testing Framework (--with-cmocka)"
  
@@ -1123,7 +1123,7 @@ index 4a5db6c..64aca10 100755
      echo "    Dynamically loadable zone (DLZ) drivers:"
      test "no" = "$use_dlz_bdb" || \
  	echo "        Berkeley DB (--with-dlz-bdb)"
-@@ -27859,6 +27901,8 @@ report() {
+@@ -27784,6 +27826,8 @@ report() {
  	echo "    ECDSA algorithm support (--with-ecdsa)"
      test "X$CRYPTO" = "X" -o "yes" = "$OPENSSL_ED25519" -o "yes" = "$PKCS11_ED25519" || \
  	echo "    EDDSA algorithm support (--with-eddsa)"
@@ -1133,10 +1133,10 @@ index 4a5db6c..64aca10 100755
      test "yes" = "$enable_seccomp" || \
  	echo "    Use libseccomp system call filtering (--enable-seccomp)"
 diff --git a/configure.ac b/configure.ac
-index 0dc552c..3b88105 100644
+index 0e22d02..828581e 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -1572,6 +1572,7 @@ case "$use_openssl" in
+@@ -1537,6 +1537,7 @@ case "$use_openssl" in
  		AC_MSG_RESULT(disabled because of native PKCS11)
  		DST_OPENSSL_INC=""
  		CRYPTO="-DPKCS11CRYPTO"
@@ -1144,7 +1144,7 @@ index 0dc552c..3b88105 100644
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -1585,6 +1586,7 @@ case "$use_openssl" in
+@@ -1550,6 +1551,7 @@ case "$use_openssl" in
  		AC_MSG_RESULT(no)
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -1152,7 +1152,7 @@ index 0dc552c..3b88105 100644
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -1597,6 +1599,7 @@ case "$use_openssl" in
+@@ -1562,6 +1564,7 @@ case "$use_openssl" in
  	auto)
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -1160,7 +1160,7 @@ index 0dc552c..3b88105 100644
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -1607,7 +1610,7 @@ case "$use_openssl" in
+@@ -1572,7 +1575,7 @@ case "$use_openssl" in
  		OPENSSLLINKSRCS=""
  		AC_MSG_ERROR(
  [OpenSSL was not found in any of $openssldirs; use --with-openssl=/path
@@ -1169,7 +1169,7 @@ index 0dc552c..3b88105 100644
  		;;
  	*)
  		if test "yes" = "$want_native_pkcs11"
-@@ -1637,6 +1640,7 @@ If you don't want OpenSSL, use --without-openssl])
+@@ -1602,6 +1605,7 @@ If you don't want OpenSSL, use --without-openssl])
  			AC_MSG_ERROR(["$use_openssl/include/openssl/opensslv.h" not found])
  		fi
  		CRYPTO='-DOPENSSL'
@@ -1177,7 +1177,7 @@ index 0dc552c..3b88105 100644
  		if test "/usr" = "$use_openssl"
  		then
  			DST_OPENSSL_INC=""
-@@ -2110,7 +2114,6 @@ fi
+@@ -2037,7 +2041,6 @@ fi
  # Use OpenSSL for hash functions
  #
  
@@ -1185,7 +1185,7 @@ index 0dc552c..3b88105 100644
  ISC_PLATFORM_OPENSSLHASH="#undef ISC_PLATFORM_OPENSSLHASH"
  case $want_openssl_hash in
  	yes)
-@@ -2382,6 +2385,67 @@ if test "rt" = "$have_clock_gt"; then
+@@ -2309,6 +2312,67 @@ if test "rt" = "$have_clock_gt"; then
  	LIBS="-lrt $LIBS"
  fi
  
@@ -1253,7 +1253,7 @@ index 0dc552c..3b88105 100644
  #
  # was --with-lmdb specified?
  #
-@@ -4178,12 +4242,12 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
+@@ -4105,12 +4169,12 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
  ISC_PLATFORM_USESTDASM="#undef ISC_PLATFORM_USESTDASM"
  ISC_PLATFORM_USEMACASM="#undef ISC_PLATFORM_USEMACASM"
  if test "yes" = "$use_atomic"; then
@@ -1267,7 +1267,7 @@ index 0dc552c..3b88105 100644
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -4192,7 +4256,6 @@ if test "yes" = "$use_atomic"; then
+@@ -4119,7 +4183,6 @@ if test "yes" = "$use_atomic"; then
  		fi
  	;;
  	x86_64-*|amd64-*)
@@ -1275,7 +1275,7 @@ index 0dc552c..3b88105 100644
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -5607,6 +5670,8 @@ report() {
+@@ -5534,6 +5597,8 @@ report() {
  	    echo "    IPv6 support (--enable-ipv6)"
  	test "X$CRYPTO" = "X" -o "yes" = "$want_native_pkcs11" || \
  		echo "    OpenSSL cryptography/DNSSEC (--with-openssl)"
@@ -1284,7 +1284,7 @@ index 0dc552c..3b88105 100644
  	test "X$PYTHON" = "X" || echo "    Python tools (--with-python)"
  	test "X$XMLSTATS" = "X" || echo "    XML statistics (--with-libxml2)"
  	test "X$JSONSTATS" = "X" || echo "    JSON statistics (--with-libjson)"
-@@ -5647,6 +5712,8 @@ report() {
+@@ -5574,6 +5639,8 @@ report() {
  	echo "    Very verbose query trace logging (--enable-querytrace)"
      test "no" = "$with_cmocka" || echo "    CMocka Unit Testing Framework (--with-cmocka)"
  
@@ -1293,7 +1293,7 @@ index 0dc552c..3b88105 100644
      echo "    Dynamically loadable zone (DLZ) drivers:"
      test "no" = "$use_dlz_bdb" || \
  	echo "        Berkeley DB (--with-dlz-bdb)"
-@@ -5694,6 +5761,8 @@ report() {
+@@ -5621,6 +5688,8 @@ report() {
  	echo "    ECDSA algorithm support (--with-ecdsa)"
      test "X$CRYPTO" = "X" -o "yes" = "$OPENSSL_ED25519" -o "yes" = "$PKCS11_ED25519" || \
  	echo "    EDDSA algorithm support (--with-eddsa)"
@@ -2016,10 +2016,10 @@ index 5b8a2c9..913a2ce 100644
   * Define if the hash functions must be provided by OpenSSL.
   */
 diff --git a/win32utils/Configure b/win32utils/Configure
-index 93939f3..8bacf54 100644
+index 6f93814..4286baf 100644
 --- a/win32utils/Configure
 +++ b/win32utils/Configure
-@@ -381,6 +381,7 @@ my @substdefh = ("AES_CC",
+@@ -378,6 +378,7 @@ my @substdefh = ("ALLOW_FILTER_AAAA",
  my %configdefp;
  
  my @substdefp = ("ISC_PLATFORM_BUSYWAITNOP",
@@ -2027,7 +2027,7 @@ index 93939f3..8bacf54 100644
                   "ISC_PLATFORM_HAVEATOMICSTORE",
                   "ISC_PLATFORM_HAVEATOMICSTOREQ",
                   "ISC_PLATFORM_HAVECMPXCHG",
-@@ -511,7 +512,8 @@ my @allcond = (@substcond, "NOTYET", "NOLONGER");
+@@ -508,7 +509,8 @@ my @allcond = (@substcond, "NOTYET", "NOLONGER");
  
  # enable-xxx/disable-xxx
  
@@ -2037,7 +2037,7 @@ index 93939f3..8bacf54 100644
                    "fixed-rrset",
                    "intrinsics",
                    "isc-spnego",
-@@ -575,6 +577,7 @@ my @help = (
+@@ -572,6 +574,7 @@ my @help = (
  "\nOptional Features:\n",
  "  enable-intrinsics     enable instrinsic/atomic functions [default=yes]\n",
  "  enable-native-pkcs11  use native PKCS#11 for all crypto [default=no]\n",
@@ -2045,7 +2045,7 @@ index 93939f3..8bacf54 100644
  "  enable-openssl-hash   use OpenSSL for hash functions [default=yes]\n",
  "  enable-isc-spnego     use SPNEGO from lib/dns [default=yes]\n",
  "  enable-filter-aaaa    enable filtering of AAAA records [default=yes]\n",
-@@ -620,7 +623,9 @@ my $want_clean = "no";
+@@ -617,7 +620,9 @@ my $want_clean = "no";
  my $want_unknown = "no";
  my $unknown_value;
  my $enable_intrinsics = "yes";
@@ -2055,7 +2055,7 @@ index 93939f3..8bacf54 100644
  my $enable_openssl_hash = "auto";
  my $enable_filter_aaaa = "yes";
  my $enable_isc_spnego = "yes";
-@@ -840,6 +845,10 @@ sub myenable {
+@@ -837,6 +842,10 @@ sub myenable {
          if ($val =~ /^yes$/i) {
              $enable_native_pkcs11 = "yes";
          }
@@ -2066,7 +2066,7 @@ index 93939f3..8bacf54 100644
      } elsif ($key =~ /^openssl-hash$/i) {
          if ($val =~ /^yes$/i) {
              $enable_openssl_hash = "yes";
-@@ -1142,6 +1151,11 @@ if ($verbose) {
+@@ -1139,6 +1148,11 @@ if ($verbose) {
      } else {
          print "native-pkcs11: disabled\n";
      }
@@ -2078,7 +2078,7 @@ index 93939f3..8bacf54 100644
      if ($enable_openssl_hash eq "yes") {
          print "openssl-hash: enabled\n";
      } else {
-@@ -1500,6 +1514,7 @@ if ($enable_intrinsics eq "yes") {
+@@ -1497,6 +1511,7 @@ if ($enable_intrinsics eq "yes") {
  
  # enable-native-pkcs11
  if ($enable_native_pkcs11 eq "yes") {
@@ -2086,7 +2086,7 @@ index 93939f3..8bacf54 100644
      if ($use_openssl eq "auto") {
          $use_openssl = "no";
      }
-@@ -1709,6 +1724,7 @@ if ($use_openssl eq "yes") {
+@@ -1706,6 +1721,7 @@ if ($use_openssl eq "yes") {
          $openssl_dll = File::Spec->catdir($openssl_path, "@dirlist[0]");
      }   
  
@@ -2094,10 +2094,10 @@ index 93939f3..8bacf54 100644
      $configcond{"OPENSSL"} = 1;
      $configdefd{"CRYPTO"} = "OPENSSL";
      $configvar{"OPENSSL_PATH"} = "$openssl_path";
-@@ -2260,6 +2276,15 @@ if ($cookie_algorithm eq "sha1") {
-     die "Unrecognized cookie algorithm: $cookie_algorithm\n";
+@@ -2242,6 +2258,15 @@ if ($use_aes eq "yes") {
  }
  
+ 
 +# enable-crypto-rand
 +if ($enable_crypto_rand eq "yes") {
 +    if (($use_openssl eq "no") && ($enable_native_pkcs11 eq "no")) {
@@ -2110,7 +2110,7 @@ index 93939f3..8bacf54 100644
  # enable-openssl-hash
  if ($enable_openssl_hash eq "yes") {
      if ($use_openssl eq "no") {
-@@ -3635,6 +3660,7 @@ exit 0;
+@@ -3617,6 +3642,7 @@ exit 0;
  #  --enable-developer partially supported
  #  --enable-newstats (9.9/9.9sub only)
  #  --enable-native-pkcs11 supported

From 4e4f8c8518d7dcbab3ad18ae86e79e2952378d54 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 27 Aug 2019 10:53:03 +0200
Subject: [PATCH 057/460] Fix broken system/tsig test

On rebases, md5 keys were accidentally dropped. Put them back.
---
 bind-9.11-fips-tests.patch | 22 ++++++++++++++++++++--
 1 file changed, 20 insertions(+), 2 deletions(-)

diff --git a/bind-9.11-fips-tests.patch b/bind-9.11-fips-tests.patch
index 539cdcb..29dda07 100644
--- a/bind-9.11-fips-tests.patch
+++ b/bind-9.11-fips-tests.patch
@@ -1,4 +1,4 @@
-From f32eb98f81b33abd5b0d3c77f8f75cc3e77425ff Mon Sep 17 00:00:00 2001
+From c23daf334d5487fa53fef88c82312e439a2d8523 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 2 Aug 2018 23:46:45 +0200
 Subject: [PATCH] FIPS tests changes
@@ -102,7 +102,9 @@ Date:   Wed Mar 7 10:44:23 2018 +0100
  bin/tests/system/tsiggss/setup.sh             |  2 +-
  bin/tests/system/upforwd/ns1/named.conf.in    |  2 +-
  bin/tests/system/upforwd/tests.sh             |  2 +-
- 44 files changed, 222 insertions(+), 171 deletions(-)
+ bin/tests/system/tsig/ns1/rndc5.conf.in | 10 +++
+ 45 files changed, 232 insertions(+), 171 deletions(-)
+ create mode 100644 bin/tests/system/tsig/ns1/rndc5.conf.in
 
 diff --git a/bin/tests/system/acl/ns2/named1.conf.in b/bin/tests/system/acl/ns2/named1.conf.in
 index 0ea6502..026db3f 100644
@@ -1385,6 +1387,22 @@ index b0694bb..9adae82 100644
  server 10.53.0.3 ${PORT}
  update add updated.example. 600 A 10.10.10.1
  update add updated.example. 600 TXT Foo
+diff --git a/bin/tests/system/tsig/ns1/rndc5.conf.in b/bin/tests/system/tsig/ns1/rndc5.conf.in
+new file mode 100644
+index 0000000..0682194
+--- /dev/null
++++ b/bin/tests/system/tsig/ns1/rndc5.conf.in
+@@ -0,0 +1,10 @@
++# Conditionally included when support for MD5 is available
++key "md5" {
++	secret "97rnFx24Tfna4mHPfgnerA==";
++	algorithm hmac-md5;
++};
++
++key "md5-trunc" {
++	secret "97rnFx24Tfna4mHPfgnerA==";
++	algorithm hmac-md5-80;
++};
 -- 
 2.20.1
 

From 290a5eb9ab92470db9c0f1016ec14c84e42a8868 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 27 Aug 2019 15:49:57 +0200
Subject: [PATCH 058/460] Fix broken pkcs11 initialization

Broken by commit 2a466330c5379150b781709140e8c837d0a95328
---
 bind-9.11-fips-code.patch | 50 +++++++++++++++++++--------------------
 1 file changed, 25 insertions(+), 25 deletions(-)

diff --git a/bind-9.11-fips-code.patch b/bind-9.11-fips-code.patch
index 74dbb05..cf00104 100644
--- a/bind-9.11-fips-code.patch
+++ b/bind-9.11-fips-code.patch
@@ -1,4 +1,4 @@
-From b8485528f5098e3360560d5b85c9ffc592619c55 Mon Sep 17 00:00:00 2001
+From eff6dcb62f3cea6df0a848c2220a49bc02cb4a0e Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 2 Aug 2018 23:34:45 +0200
 Subject: [PATCH] FIPS code changes
@@ -241,7 +241,7 @@ index 5ca3d76..6b7790a 100644
  	port = DEFAULT_PORT;
  
 diff --git a/bin/dig/dig.c b/bin/dig/dig.c
-index 2063a3b..8e856c5 100644
+index 706299e..aaf22e7 100644
 --- a/bin/dig/dig.c
 +++ b/bin/dig/dig.c
 @@ -20,6 +20,7 @@
@@ -252,7 +252,7 @@ index 2063a3b..8e856c5 100644
  #include <isc/netaddr.h>
  #include <isc/parseint.h>
  #include <isc/platform.h>
-@@ -1767,10 +1768,10 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
+@@ -1774,10 +1775,10 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
  			ptr = ptr2;
  			ptr2 = ptr3;
  		} else  {
@@ -267,7 +267,7 @@ index 2063a3b..8e856c5 100644
  			digestbits = 0;
  		}
 diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
-index e75b8b7..9234d35 100644
+index 93e5b40..afd2700 100644
 --- a/bin/dig/dighost.c
 +++ b/bin/dig/dighost.c
 @@ -80,6 +80,7 @@
@@ -339,7 +339,7 @@ index 1476d0d..f5c9316 100644
  			alg = DST_ALG_HMACMD5;
  #else
 diff --git a/bin/named/config.c b/bin/named/config.c
-index 7584efb..a153172 100644
+index 32c454a..dff826b 100644
 --- a/bin/named/config.c
 +++ b/bin/named/config.c
 @@ -18,6 +18,7 @@
@@ -350,7 +350,7 @@ index 7584efb..a153172 100644
  #include <isc/mem.h>
  #include <isc/parseint.h>
  #include <isc/region.h>
-@@ -969,6 +970,21 @@ ns_config_getkeyalgorithm(const char *str, dns_name_t **name,
+@@ -974,6 +975,21 @@ ns_config_getkeyalgorithm(const char *str, dns_name_t **name,
  	return (ns_config_getkeyalgorithm2(str, name, NULL, digestbits));
  }
  
@@ -372,7 +372,7 @@ index 7584efb..a153172 100644
  isc_result_t
  ns_config_getkeyalgorithm2(const char *str, dns_name_t **name,
  			   unsigned int *typep, uint16_t *digestbits)
-@@ -978,7 +994,7 @@ ns_config_getkeyalgorithm2(const char *str, dns_name_t **name,
+@@ -983,7 +999,7 @@ ns_config_getkeyalgorithm2(const char *str, dns_name_t **name,
  	uint16_t bits;
  	isc_result_t result;
  
@@ -381,7 +381,7 @@ index 7584efb..a153172 100644
  		len = strlen(algorithms[i].str);
  		if (strncasecmp(algorithms[i].str, str, len) == 0 &&
  		    (str[len] == '\0' ||
-@@ -1001,7 +1017,12 @@ ns_config_getkeyalgorithm2(const char *str, dns_name_t **name,
+@@ -1006,7 +1022,12 @@ ns_config_getkeyalgorithm2(const char *str, dns_name_t **name,
  	if (name != NULL) {
  		switch (algorithms[i].hmac) {
  #ifndef PK11_MD5_DISABLE
@@ -622,7 +622,7 @@ index bde66a4..70a40c3 100644
  	dst_key_free(&dstkey);
  	CHECK("MD5 was disabled", ISC_R_NOTIMPLEMENTED);
 diff --git a/lib/bind9/check.c b/lib/bind9/check.c
-index 2a0e735..dc80018 100644
+index ec0ab6d..e0803d4 100644
 --- a/lib/bind9/check.c
 +++ b/lib/bind9/check.c
 @@ -23,6 +23,7 @@
@@ -633,7 +633,7 @@ index 2a0e735..dc80018 100644
  #include <isc/mem.h>
  #include <isc/netaddr.h>
  #include <isc/parseint.h>
-@@ -2590,6 +2591,15 @@ bind9_check_key(const cfg_obj_t *key, isc_log_t *logctx) {
+@@ -2618,6 +2619,15 @@ bind9_check_key(const cfg_obj_t *key, isc_log_t *logctx) {
  	}
  
  	algorithm = cfg_obj_asstring(algobj);
@@ -937,10 +937,10 @@ index 9c42c50..f51d548 100644
  
  void
 diff --git a/lib/dns/tests/rsa_test.c b/lib/dns/tests/rsa_test.c
-index 16214c6..9b235ba 100644
+index f9ac6d0..241e17e 100644
 --- a/lib/dns/tests/rsa_test.c
 +++ b/lib/dns/tests/rsa_test.c
-@@ -26,6 +26,7 @@
+@@ -27,6 +27,7 @@
  #define UNIT_TESTING
  #include <cmocka.h>
  
@@ -948,7 +948,7 @@ index 16214c6..9b235ba 100644
  #include <isc/util.h>
  #include <isc/print.h>
  
-@@ -247,6 +248,8 @@ isc_rsa_verify_test(void **state) {
+@@ -248,6 +249,8 @@ isc_rsa_verify_test(void **state) {
  	/* RSAMD5 */
  
  #ifndef PK11_MD5_DISABLE
@@ -957,7 +957,7 @@ index 16214c6..9b235ba 100644
  	key->key_alg = DST_ALG_RSAMD5;
  
  	ret = dst_context_create3(key, mctx, DNS_LOGCATEGORY_DNSSEC,
-@@ -264,6 +267,7 @@ isc_rsa_verify_test(void **state) {
+@@ -265,6 +268,7 @@ isc_rsa_verify_test(void **state) {
  	assert_int_equal(ret, ISC_R_SUCCESS);
  
  	dst_context_destroy(&ctx);
@@ -966,10 +966,10 @@ index 16214c6..9b235ba 100644
  
  	/* RSASHA256 */
 diff --git a/lib/dns/tests/tsig_test.c b/lib/dns/tests/tsig_test.c
-index 8e5250e..9accc53 100644
+index 11d011a..feb2068 100644
 --- a/lib/dns/tests/tsig_test.c
 +++ b/lib/dns/tests/tsig_test.c
-@@ -24,6 +24,7 @@
+@@ -25,6 +25,7 @@
  #define UNIT_TESTING
  #include <cmocka.h>
  
@@ -1215,7 +1215,7 @@ index 249f3da..628a414 100644
  
  /*
 diff --git a/lib/isc/pk11.c b/lib/isc/pk11.c
-index 0d5b009..bb9912b 100644
+index 0d5b009..7809e7b 100644
 --- a/lib/isc/pk11.c
 +++ b/lib/isc/pk11.c
 @@ -197,8 +197,6 @@ pk11_initialize(isc_mem_t *mctx, const char *engine) {
@@ -1227,14 +1227,14 @@ index 0d5b009..bb9912b 100644
  	}
  
  	ISC_LIST_INIT(tokens);
-@@ -236,6 +234,7 @@ pk11_initialize(isc_mem_t *mctx, const char *engine) {
- 		result = PK11_R_NOAESSERVICE;
- 		goto unlock;
+@@ -238,6 +236,7 @@ pk11_initialize(isc_mem_t *mctx, const char *engine) {
  	}
-+	initialized = true;
  #endif
  #endif /* PKCS11CRYPTO */
++	initialized = true;
   unlock:
+ 	UNLOCK(&sessionlock);
+ 	return (result);
 @@ -589,6 +588,8 @@ scan_slots(void) {
  	pk11_token_t *token;
  	unsigned int i;
@@ -1334,10 +1334,10 @@ index 0d5b009..bb9912b 100644
  
  		/* ECDSA requires digest */
 diff --git a/lib/isc/tests/hash_test.c b/lib/isc/tests/hash_test.c
-index 8ddfe70..9c4d299 100644
+index 31ced94..421131e 100644
 --- a/lib/isc/tests/hash_test.c
 +++ b/lib/isc/tests/hash_test.c
-@@ -776,6 +776,9 @@ isc_md5_test(void **state) {
+@@ -775,6 +775,9 @@ isc_md5_test(void **state) {
  
  	UNUSED(state);
  
@@ -1347,7 +1347,7 @@ index 8ddfe70..9c4d299 100644
  	/*
  	 * These are the various test vectors.  All of these are passed
  	 * through the hash function and the results are compared to the
-@@ -1631,6 +1634,9 @@ isc_hmacmd5_test(void **state) {
+@@ -1630,6 +1633,9 @@ isc_hmacmd5_test(void **state) {
  
  	UNUSED(state);
  
@@ -1357,7 +1357,7 @@ index 8ddfe70..9c4d299 100644
  	/*
  	 * These are the various test vectors.  All of these are passed
  	 * through the hash function and the results are compared to the
-@@ -1941,6 +1947,9 @@ static void
+@@ -1940,6 +1946,9 @@ static void
  md5_check_test(void **state) {
  	UNUSED(state);
  

From 8b8b3e97d61ab3a4286d796bd0159dd6ea268717 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 27 Aug 2019 20:46:46 +0200
Subject: [PATCH 059/460] Avoid conflicts between OpenSSL and native PKCS#11

Do not set default engine when native module should be used.
---
 bind-9.11-engine-pkcs11.patch | 27 +++++++++++++++++++++++++++
 bind.spec                     |  3 +++
 2 files changed, 30 insertions(+)
 create mode 100644 bind-9.11-engine-pkcs11.patch

diff --git a/bind-9.11-engine-pkcs11.patch b/bind-9.11-engine-pkcs11.patch
new file mode 100644
index 0000000..4a6290d
--- /dev/null
+++ b/bind-9.11-engine-pkcs11.patch
@@ -0,0 +1,27 @@
+From 37f89ccfc439f8d86c401d9ae10e94e53b924961 Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Tue, 27 Aug 2019 20:39:59 +0200
+Subject: [PATCH] Do not set engine for native PKCS11
+
+It resets already set lib_path to pkcs11, which is invalid in native
+pkcs11 crypto. Engine has to be path to PKCS#11 module.
+---
+ bin/named/include/named/globals.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/bin/named/include/named/globals.h b/bin/named/include/named/globals.h
+index eda2214..2a611d5 100644
+--- a/bin/named/include/named/globals.h
++++ b/bin/named/include/named/globals.h
+@@ -160,7 +160,7 @@ EXTERN const char *		ns_g_defaultdnstap	INIT(NULL);
+ 
+ EXTERN const char *		ns_g_username		INIT(NULL);
+ 
+-#if defined(USE_PKCS11)
++#if defined(USE_PKCS11) && !defined(PKCS11CRYPTO)
+ EXTERN const char *		ns_g_engine		INIT(PKCS11_ENGINE);
+ #else
+ EXTERN const char *		ns_g_engine		INIT(NULL);
+-- 
+2.20.1
+
diff --git a/bind.spec b/bind.spec
index b60b2a8..847fdcc 100644
--- a/bind.spec
+++ b/bind.spec
@@ -112,6 +112,8 @@ Patch140:bind-9.11-rh1410433.patch
 Patch145:bind-9.11-rh1205168.patch
 # [ISC-Bugs #46853] commit cb616c6d5c2ece1fac37fa6e0bca2b53d4043098 ISC 4851
 Patch149:bind-9.11-kyua-pkcs11.patch
+# Avoid conflicts with OpenSSL PKCS11 engine
+Patch150:bind-9.11-engine-pkcs11.patch
 Patch153:bind-9.11-export-suffix.patch
 Patch154:bind-9.11-oot-manual.patch
 Patch155:bind-9.11-pk11.patch
@@ -535,6 +537,7 @@ cp -r lib/isc{,-pkcs11}
 cp -r lib/dns{,-pkcs11}
 %patch136 -p1 -b .dist_pkcs11
 %patch149 -p1 -b .kyua-pkcs11
+%patch150 -p1 -b .engine-pkcs11
 %endif
 
 %if %{with SDB}

From 8cd5c11f0db378f98629f346de54da9093a647aa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 3 Sep 2019 11:30:50 +0200
Subject: [PATCH 060/460] Move some administration utilities back to utils
 (#1720380)

Some utilities are not related DNSSEC at all, but are just bind related
tools. Because they do not require additional dependencies, they do not
save any space in containers.
---
 bind.spec | 51 +++++++++++++++++++++++----------------------------
 1 file changed, 23 insertions(+), 28 deletions(-)

diff --git a/bind.spec b/bind.spec
index 97be60f..a35699e 100644
--- a/bind.spec
+++ b/bind.spec
@@ -57,7 +57,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.11.10
-Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -321,10 +321,6 @@ Contains license of the BIND DNS suite.
 Summary: Utilities for querying DNS name servers
 Requires: bind-libs-lite%{?_isa} = %{epoch}:%{version}-%{release}
 Requires: bind-libs%{?_isa} = %{epoch}:%{version}-%{release}
-# TODO: this is just temporary workaround until all packages depending on
-# bind-utils can be satisfied without dnssec-utils
-# It will be removed after some time, or changed to Recommends
-Suggests: bind-dnssec-utils
 # For compatibility with Debian package
 Provides: dnsutils = %{epoch}:%{version}-%{release}
 
@@ -1305,46 +1301,42 @@ fi;
 %{_bindir}/nslookup
 %{_bindir}/nsupdate
 %{_bindir}/arpaname
+%{_sbindir}/ddns-confgen
+%{_sbindir}/tsig-keygen
+%{_sbindir}/genrandom
+%{_sbindir}/nsec3hash
+%{_sbindir}/isc-hmac-fixup
+%{_sbindir}/named-checkzone
+%{_sbindir}/named-compilezone
 %if %{with DNSTAP}
 %{_bindir}/dnstap-read
 %{_mandir}/man1/dnstap-read.1*
 %endif
+%if %{with LMDB}
+%{_sbindir}/named-nzd2nzf
+%{_mandir}/man8/named-nzd2nzf.8*
+%endif
 %{_mandir}/man1/host.1*
 %{_mandir}/man1/nsupdate.1*
 %{_mandir}/man1/dig.1*
 %{_mandir}/man1/delv.1*
 %{_mandir}/man1/nslookup.1*
 %{_mandir}/man1/arpaname.1*
-%{_sysconfdir}/trusted-key.key
-
-%files dnssec-utils
-%{_sbindir}/ddns-confgen
-%{_sbindir}/tsig-keygen
-%{_sbindir}/genrandom
-%{_sbindir}/nsec3hash
-%{_sbindir}/dnssec*
-%if %{with PKCS11}
-%exclude %{_sbindir}/dnssec*pkcs11
-%endif
-%{_sbindir}/isc-hmac-fixup
-%{_sbindir}/named-checkzone
-%{_sbindir}/named-compilezone
-%if %{with LMDB}
-%{_sbindir}/named-nzd2nzf
-%endif
 %{_mandir}/man8/ddns-confgen.8*
 %{_mandir}/man8/tsig-keygen.8*
 %{_mandir}/man8/genrandom.8*
 %{_mandir}/man8/nsec3hash.8*
-%{_mandir}/man8/dnssec*.8*
-%if %{with PKCS11}
-%exclude %{_mandir}/man8/dnssec*-pkcs11.8*
-%endif
 %{_mandir}/man8/isc-hmac-fixup.8*
 %{_mandir}/man8/named-checkzone.8*
 %{_mandir}/man8/named-compilezone.8*
-%if %{with LMDB}
-%{_mandir}/man8/named-nzd2nzf.8*
+%{_sysconfdir}/trusted-key.key
+
+%files dnssec-utils
+%{_sbindir}/dnssec*
+%{_mandir}/man8/dnssec*.8*
+%if %{with PKCS11}
+%exclude %{_sbindir}/dnssec*pkcs11
+%exclude %{_mandir}/man8/dnssec*-pkcs11.8*
 %endif
 
 %if %{with DEVEL}
@@ -1544,6 +1536,9 @@ fi;
 
 
 %changelog
+* Tue Sep 03 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.10-2
+- Move some administration utilities back to bind-utils (#1720380)
+
 * Tue Aug 27 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.10-1
 - Update to 9.11.10
 

From 0fa39c28ad2fb58d16b3f9c921621bdda3af3f32 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 3 Sep 2019 13:07:57 +0200
Subject: [PATCH 061/460] Move created empty directories to single define

Make it easier to manage list of used directories in chroot. Use
appropriate macros for system directories everywhere in chroot package.
Share common variable with -sdb-chroot and -chroot packages.
---
 bind.spec | 82 ++++++++++++++++++++++++++++---------------------------
 1 file changed, 42 insertions(+), 40 deletions(-)

diff --git a/bind.spec b/bind.spec
index a35699e..e8b5e29 100644
--- a/bind.spec
+++ b/bind.spec
@@ -37,6 +37,10 @@
 %if %{with SDB}
 %global        chroot_sdb_prefix %{bind_dir}/chroot_sdb
 %endif
+%global        chroot_create_directories /dev /run/named %{_localstatedir}/{log,named,tmp} \\\
+                                         %{_sysconfdir}/{crypto-policies/back-ends,pki/dnssec-keys,named} \\\
+                                         %{_libdir}/bind
+
 %global        selinuxbooleans   named_write_master_zones=1
 ## The order of libs is important. See lib/Makefile.in for details
 %define bind_export_libs isc dns isccfg irs
@@ -859,44 +863,42 @@ else
 
 %install
 # Build directory hierarchy
-mkdir -p ${RPM_BUILD_ROOT}/etc/logrotate.d
+mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/logrotate.d
 mkdir -p ${RPM_BUILD_ROOT}%{_libdir}/bind
-mkdir -p ${RPM_BUILD_ROOT}/var/named/{slaves,data,dynamic}
+mkdir -p ${RPM_BUILD_ROOT}%{_localstatedir}/named/{slaves,data,dynamic}
 mkdir -p ${RPM_BUILD_ROOT}%{_mandir}/{man1,man5,man8}
 mkdir -p ${RPM_BUILD_ROOT}/run/named
-mkdir -p ${RPM_BUILD_ROOT}/var/log
+mkdir -p ${RPM_BUILD_ROOT}%{_localstatedir}/log
 
 #chroot
-mkdir -p ${RPM_BUILD_ROOT}/%{chroot_prefix}/{dev,etc,var,run/named}
-mkdir -p ${RPM_BUILD_ROOT}/%{chroot_prefix}/var/{log,named,tmp}
-mkdir -p ${RPM_BUILD_ROOT}/%{chroot_prefix}/etc/crypto-policies/back-ends
+for D in %{chroot_create_directories}
+do
+  mkdir -p ${RPM_BUILD_ROOT}/%{chroot_prefix}${D}
+done
 
 # create symlink as it is on real filesystem
 pushd ${RPM_BUILD_ROOT}/%{chroot_prefix}/var
 ln -s ../run run
 popd
 
-mkdir -p ${RPM_BUILD_ROOT}/%{chroot_prefix}/etc/{pki/dnssec-keys,named}
-mkdir -p ${RPM_BUILD_ROOT}/%{chroot_prefix}/%{_libdir}/bind
 # these are required to prevent them being erased during upgrade of previous
-touch ${RPM_BUILD_ROOT}/%{chroot_prefix}/etc/named.conf
+touch ${RPM_BUILD_ROOT}/%{chroot_prefix}%{_sysconfdir}/named.conf
 #end chroot
 
 #sdb-chroot
 %if %{with SDB}
-mkdir -p ${RPM_BUILD_ROOT}/%{chroot_sdb_prefix}/{dev,etc,var,run/named}
-mkdir -p ${RPM_BUILD_ROOT}/%{chroot_sdb_prefix}/var/{log,named,tmp}
-mkdir -p ${RPM_BUILD_ROOT}/%{chroot_sdb_prefix}/etc/crypto-policies/back-ends
+for D in %{chroot_create_directories}
+do
+  mkdir -p ${RPM_BUILD_ROOT}/%{chroot_sdb_prefix}${D}
+done
 
 # create symlink as it is on real filesystem
-pushd ${RPM_BUILD_ROOT}/%{chroot_sdb_prefix}/var
+pushd ${RPM_BUILD_ROOT}/%{chroot_sdb_prefix}%{_localstatedir}
 ln -s ../run run
 popd
 
-mkdir -p ${RPM_BUILD_ROOT}/%{chroot_sdb_prefix}/etc/{pki/dnssec-keys,named}
-mkdir -p ${RPM_BUILD_ROOT}/%{chroot_sdb_prefix}/%{_libdir}/bind
 # these are required to prevent them being erased during upgrade of previous
-touch ${RPM_BUILD_ROOT}/%{chroot_sdb_prefix}/etc/named.conf
+touch ${RPM_BUILD_ROOT}/%{chroot_sdb_prefix}%{_sysconfdir}/named.conf
 %endif
 #end sdb-chroot
 
@@ -1382,27 +1384,27 @@ fi;
 %defattr(0640,root,named,0750)
 %dir %{chroot_prefix}
 %dir %{chroot_prefix}/dev
-%dir %{chroot_prefix}/etc
-%dir %{chroot_prefix}/etc/named
-%dir %{chroot_prefix}/etc/pki
-%dir %{chroot_prefix}/etc/pki/dnssec-keys
-%dir %{chroot_prefix}/etc/crypto-policies
-%dir %{chroot_prefix}/etc/crypto-policies/back-ends
-%dir %{chroot_prefix}/var
+%dir %{chroot_prefix}%{_sysconfdir}
+%dir %{chroot_prefix}%{_sysconfdir}/named
+%dir %{chroot_prefix}%{_sysconfdir}/pki
+%dir %{chroot_prefix}%{_sysconfdir}/pki/dnssec-keys
+%dir %{chroot_prefix}%{_sysconfdir}/crypto-policies
+%dir %{chroot_prefix}%{_sysconfdir}/crypto-policies/back-ends
+%dir %{chroot_prefix}%{_localstatedir}
 %dir %{chroot_prefix}/run
-%ghost %config(noreplace) %{chroot_prefix}/etc/named.conf
+%ghost %config(noreplace) %{chroot_prefix}%{_sysconfdir}/named.conf
 %defattr(-,root,root,-)
 %dir %{chroot_prefix}/usr
 %dir %{chroot_prefix}/%{_libdir}
 %dir %{chroot_prefix}/%{_libdir}/bind
 %defattr(0660,root,named,01770)
-%dir %{chroot_prefix}/var/named
+%dir %{chroot_prefix}%{_localstatedir}/named
 %defattr(0660,named,named,0770)
-%dir %{chroot_prefix}/var/tmp
-%dir %{chroot_prefix}/var/log
+%dir %{chroot_prefix}%{_localstatedir}/tmp
+%dir %{chroot_prefix}%{_localstatedir}/log
 %defattr(-,named,named,-)
 %dir %{chroot_prefix}/run/named
-%{chroot_prefix}/var/run
+%{chroot_prefix}%{_localstatedir}/run
 
 %if %{with SDB}
 %files sdb-chroot
@@ -1418,27 +1420,27 @@ fi;
 %defattr(0640,root,named,0750)
 %dir %{chroot_sdb_prefix}
 %dir %{chroot_sdb_prefix}/dev
-%dir %{chroot_sdb_prefix}/etc
-%dir %{chroot_sdb_prefix}/etc/named
-%dir %{chroot_sdb_prefix}/etc/pki
-%dir %{chroot_sdb_prefix}/etc/pki/dnssec-keys
-%dir %{chroot_sdb_prefix}/etc/crypto-policies
-%dir %{chroot_sdb_prefix}/etc/crypto-policies/back-ends
-%dir %{chroot_sdb_prefix}/var
+%dir %{chroot_sdb_prefix}%{_sysconfdir}
+%dir %{chroot_sdb_prefix}%{_sysconfdir}/named
+%dir %{chroot_sdb_prefix}%{_sysconfdir}/pki
+%dir %{chroot_sdb_prefix}%{_sysconfdir}/pki/dnssec-keys
+%dir %{chroot_sdb_prefix}%{_sysconfdir}/crypto-policies
+%dir %{chroot_sdb_prefix}%{_sysconfdir}/crypto-policies/back-ends
+%dir %{chroot_sdb_prefix}%{_localstatedir}
 %dir %{chroot_sdb_prefix}/run
-%ghost %config(noreplace) %{chroot_sdb_prefix}/etc/named.conf
+%ghost %config(noreplace) %{chroot_sdb_prefix}%{_sysconfdir}/named.conf
 %defattr(0660,root,named,01770)
-%dir %{chroot_sdb_prefix}/var/named
+%dir %{chroot_sdb_prefix}%{_localstatedir}/named
 %defattr(-,root,root,-)
 %dir %{chroot_sdb_prefix}/usr
 %dir %{chroot_sdb_prefix}/%{_libdir}
 %dir %{chroot_sdb_prefix}/%{_libdir}/bind
 %defattr(0660,named,named,0770)
-%dir %{chroot_sdb_prefix}/var/tmp
-%dir %{chroot_sdb_prefix}/var/log
+%dir %{chroot_sdb_prefix}%{_localstatedir}/tmp
+%dir %{chroot_sdb_prefix}%{_localstatedir}/log
 %defattr(-,named,named,-)
 %dir %{chroot_sdb_prefix}/run/named
-%{chroot_sdb_prefix}/var/run
+%{chroot_sdb_prefix}%{_localstatedir}/run
 %endif
 
 %if %{with PKCS11}

From bf5bc99f8162790ef3fc7a53d990c58797965725 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 3 Sep 2019 13:12:13 +0200
Subject: [PATCH 062/460] Add GeoIP to bind-chroot (#1497646)

named can use ACLs defined by GeoIP of request. Such information is not
available by default under named-chroot service. Enable GeoIP databases
under chroot without explicit configuration.
---
 bind.spec          | 5 ++++-
 named-chroot.files | 1 +
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index e8b5e29..8f0a2c3 100644
--- a/bind.spec
+++ b/bind.spec
@@ -39,7 +39,7 @@
 %endif
 %global        chroot_create_directories /dev /run/named %{_localstatedir}/{log,named,tmp} \\\
                                          %{_sysconfdir}/{crypto-policies/back-ends,pki/dnssec-keys,named} \\\
-                                         %{_libdir}/bind
+                                         %{_libdir}/bind %{_datadir}/GeoIP
 
 %global        selinuxbooleans   named_write_master_zones=1
 ## The order of libs is important. See lib/Makefile.in for details
@@ -1397,6 +1397,7 @@ fi;
 %dir %{chroot_prefix}/usr
 %dir %{chroot_prefix}/%{_libdir}
 %dir %{chroot_prefix}/%{_libdir}/bind
+%dir %{chroot_prefix}/%{_datadir}/GeoIP
 %defattr(0660,root,named,01770)
 %dir %{chroot_prefix}%{_localstatedir}/named
 %defattr(0660,named,named,0770)
@@ -1435,6 +1436,7 @@ fi;
 %dir %{chroot_sdb_prefix}/usr
 %dir %{chroot_sdb_prefix}/%{_libdir}
 %dir %{chroot_sdb_prefix}/%{_libdir}/bind
+%dir %{chroot_sdb_prefix}/%{_datadir}/GeoIP
 %defattr(0660,named,named,0770)
 %dir %{chroot_sdb_prefix}%{_localstatedir}/tmp
 %dir %{chroot_sdb_prefix}%{_localstatedir}/log
@@ -1540,6 +1542,7 @@ fi;
 %changelog
 * Tue Sep 03 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.10-2
 - Move some administration utilities back to bind-utils (#1720380)
+- Add GeoIP to bind-chroot (#1497646)
 
 * Tue Aug 27 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.10-1
 - Update to 9.11.10
diff --git a/named-chroot.files b/named-chroot.files
index b38cbe6..43c559a 100644
--- a/named-chroot.files
+++ b/named-chroot.files
@@ -16,6 +16,7 @@
 /etc/named
 /usr/lib64/bind
 /usr/lib/bind
+/usr/share/GeoIP
 /run/named
 # Warning: the order is important
 # If a directory containing $ROOTDIR is listed here,

From 9d1aaa502b2a3a2f8ca5b8bf1c5b0d3f67ddda0e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 3 Sep 2019 18:34:04 +0200
Subject: [PATCH 063/460] Recommend bind-dnssec-utils from bind-pkcs11-utils

Manual pages are just links to pages in bind-dnssec-utils. Do not copy
them, but suggest them for installation is possible. It would be handy
to have them available, but are not required for any function.
---
 bind.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index 8f0a2c3..a3a1af3 100644
--- a/bind.spec
+++ b/bind.spec
@@ -250,7 +250,9 @@ For other supported HSM modules please check the BIND documentation.
 %package pkcs11-utils
 Summary: Bind tools with native PKCS#11 for using DNSSEC
 Requires: bind-pkcs11-libs%{?_isa} = %{epoch}:%{version}-%{release}
-Obsoletes: bind-pkcs11 < 32:9.9.4-16.P2 
+Obsoletes: bind-pkcs11 < 32:9.9.4-16.P2
+# Used manual pages are just links to dnssec-utils. Propose it to installation
+Recommends: bind-dnssec-utils
 
 %description pkcs11-utils
 This is a set of PKCS#11 utilities that when used together create rsa
@@ -1543,6 +1545,7 @@ fi;
 * Tue Sep 03 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.10-2
 - Move some administration utilities back to bind-utils (#1720380)
 - Add GeoIP to bind-chroot (#1497646)
+- Recommend bind-dnssec-utils from bind-pkcs11-utils
 
 * Tue Aug 27 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.10-1
 - Update to 9.11.10

From d568c54c25d19fd31c561caf192e230ba8886d73 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 4 Sep 2019 19:12:36 +0200
Subject: [PATCH 064/460] Share pkcs11-utils and dnssec-utils manuals

Previous build recommended bind-dnssec-utils just to provide manual for
pkcs11 variants. Instead, share the same files between pkcs11-utils and
dnssec-utils. Skip unnecessary manual of non-existent dnssec-coverage-pkcs11 tool.
---
 bind.spec | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/bind.spec b/bind.spec
index a3a1af3..367e679 100644
--- a/bind.spec
+++ b/bind.spec
@@ -61,7 +61,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.11.10
-Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  3%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -251,8 +251,6 @@ For other supported HSM modules please check the BIND documentation.
 Summary: Bind tools with native PKCS#11 for using DNSSEC
 Requires: bind-pkcs11-libs%{?_isa} = %{epoch}:%{version}-%{release}
 Obsoletes: bind-pkcs11 < 32:9.9.4-16.P2
-# Used manual pages are just links to dnssec-utils. Propose it to installation
-Recommends: bind-dnssec-utils
 
 %description pkcs11-utils
 This is a set of PKCS#11 utilities that when used together create rsa
@@ -1006,7 +1004,6 @@ install -m 644 %{SOURCE34} ${RPM_BUILD_ROOT}%{_mandir}/man1/zone2sqlite.1
 pushd ${RPM_BUILD_ROOT}%{_mandir}/man8
 ln -s named.8.gz named-pkcs11.8.gz
 ln -s dnssec-checkds.8.gz dnssec-checkds-pkcs11.8.gz
-ln -s dnssec-coverage.8.gz dnssec-coverage-pkcs11.8.gz
 ln -s dnssec-dsfromkey.8.gz dnssec-dsfromkey-pkcs11.8.gz
 ln -s dnssec-importkey.8.gz dnssec-importkey-pkcs11.8.gz
 ln -s dnssec-keyfromlabel.8.gz dnssec-keyfromlabel-pkcs11.8.gz
@@ -1462,6 +1459,9 @@ fi;
 %{_sbindir}/pkcs11-tokens
 %{_mandir}/man8/pkcs11*.8*
 %{_mandir}/man8/dnssec*-pkcs11.8*
+%{_mandir}/man8/dnssec*.8*
+%exclude %{_mandir}/man8/dnssec-coverage.8*
+%exclude %{_mandir}/man8/dnssec-keymgr.8*
 
 %files pkcs11-libs
 %{_libdir}/libdns-pkcs11.so.%{sover_dns}*
@@ -1542,6 +1542,9 @@ fi;
 
 
 %changelog
+* Wed Sep 04 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.10-3
+- Share pkcs11-utils and dnssec-utils manuals instead of recommend
+
 * Tue Sep 03 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.10-2
 - Move some administration utilities back to bind-utils (#1720380)
 - Add GeoIP to bind-chroot (#1497646)

From 841d8832b4215771668e1ec7ca938166ad40f8f9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 5 Sep 2019 11:17:26 +0200
Subject: [PATCH 065/460] Do not skip gsstsig test in any named variants

Feature was skipped by mistake when moving feature-test into separate
directory.
---
 bind-9.10-dist-native-pkcs11.patch | 50 +++++++++++++++---------------
 bind-9.10-sdb.patch                | 14 ++++-----
 bind-9.11-feature-test-named.patch | 23 +++++++++++---
 3 files changed, 50 insertions(+), 37 deletions(-)

diff --git a/bind-9.10-dist-native-pkcs11.patch b/bind-9.10-dist-native-pkcs11.patch
index 0ba7ccc..df0d896 100644
--- a/bind-9.10-dist-native-pkcs11.patch
+++ b/bind-9.10-dist-native-pkcs11.patch
@@ -143,10 +143,10 @@ index 4b8ca13..4175996 100644
  CWARNINGS =
  
 diff --git a/bin/named-pkcs11/Makefile.in b/bin/named-pkcs11/Makefile.in
-index df1f7ee..f397ab0 100644
+index 70e5571..b5a4a6b 100644
 --- a/bin/named-pkcs11/Makefile.in
 +++ b/bin/named-pkcs11/Makefile.in
-@@ -43,27 +43,28 @@ DLZDRIVER_INCLUDES =	@DLZ_DRIVER_INCLUDES@
+@@ -43,27 +43,27 @@ DLZDRIVER_INCLUDES =	@DLZ_DRIVER_INCLUDES@
  DLZDRIVER_LIBS =	@DLZ_DRIVER_LIBS@
  
  CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
@@ -157,12 +157,12 @@ index df1f7ee..f397ab0 100644
  		${DLZDRIVER_INCLUDES} ${DBDRIVER_INCLUDES} ${MAXMINDDB_CFLAGS} \
  		@DST_OPENSSL_INC@
  
--CDEFINES =      @CONTRIB_DLZ@ @USE_PKCS11@ @PKCS11_ENGINE@ @CRYPTO@
-+CDEFINES =      @USE_PKCS11@ @PKCS11_ENGINE@ @CRYPTO_PK11@
+-CDEFINES =      @CONTRIB_DLZ@ @USE_PKCS11@ @PKCS11_ENGINE@ @USE_GSSAPI@ @CRYPTO@
++CDEFINES =      @USE_PKCS11@ @PKCS11_ENGINE@ @CRYPTO_PK11@ @USE_GSSAPI@
  
  CWARNINGS =
  
- DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
+-DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
 +DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
  ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
  ISCCCLIBS =	../../lib/isccc/libisccc.@A@
@@ -182,7 +182,7 @@ index df1f7ee..f397ab0 100644
  LWRESDEPLIBS =	../../lib/lwres/liblwres.@A@
  BIND9DEPLIBS =	../../lib/bind9/libbind9.@A@
  
-@@ -72,15 +73,15 @@ DEPLIBS =	${LWRESDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
+@@ -72,15 +72,15 @@ DEPLIBS =	${LWRESDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
  
  LIBS =		${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
  		${ISCCFGLIBS} ${ISCCCLIBS} ${ISCLIBS} \
@@ -201,7 +201,7 @@ index df1f7ee..f397ab0 100644
  
  GEOIPLINKOBJS = geoip.@O@
  GEOIP2LINKOBJS = geoip.@O@
-@@ -94,8 +95,7 @@ OBJS =		builtin.@O@ client.@O@ config.@O@ control.@O@ \
+@@ -94,8 +94,7 @@ OBJS =		builtin.@O@ client.@O@ config.@O@ control.@O@ \
  		tkeyconf.@O@ tsigconf.@O@ update.@O@ xfrout.@O@ \
  		zoneconf.@O@ \
  		lwaddr.@O@ lwresd.@O@ lwdclient.@O@ lwderror.@O@ lwdgabn.@O@ \
@@ -211,7 +211,7 @@ index df1f7ee..f397ab0 100644
  
  UOBJS =		unix/os.@O@ unix/dlz_dlopen_driver.@O@
  
-@@ -113,8 +113,7 @@ SRCS =		builtin.c client.c config.c control.c \
+@@ -113,8 +112,7 @@ SRCS =		builtin.c client.c config.c control.c \
  		tkeyconf.c tsigconf.c update.c xfrout.c \
  		zoneconf.c \
  		lwaddr.c lwresd.c lwdclient.c lwderror.c lwdgabn.c \
@@ -221,7 +221,7 @@ index df1f7ee..f397ab0 100644
  
  MANPAGES =	named.8 lwresd.8 named.conf.5
  
-@@ -154,21 +153,21 @@ server.@O@: server.c
+@@ -154,21 +152,21 @@ server.@O@: server.c
  		-DPRODUCT=\"${PRODUCT}\" \
  		-DVERSION=\"${VERSION}\" -c ${srcdir}/server.c
  
@@ -247,7 +247,7 @@ index df1f7ee..f397ab0 100644
  	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} \
  		-o $@ feature-test.@O@ ${ISCLIBS} ${LIBS}
  
-@@ -201,16 +200,11 @@ install-man8: named.8 lwresd.8
+@@ -201,16 +199,11 @@ install-man8: named.8 lwresd.8
  
  install-man: install-man5 install-man8
  
@@ -268,15 +268,15 @@ index df1f7ee..f397ab0 100644
  @DLZ_DRIVER_RULES@
  
 diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
-index df1f7ee..9660965 100644
+index 70e5571..4cfed4d 100644
 --- a/bin/named/Makefile.in
 +++ b/bin/named/Makefile.in
 @@ -48,7 +48,7 @@ CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
  		${DLZDRIVER_INCLUDES} ${DBDRIVER_INCLUDES} ${MAXMINDDB_CFLAGS} \
  		@DST_OPENSSL_INC@
  
--CDEFINES =      @CONTRIB_DLZ@ @USE_PKCS11@ @PKCS11_ENGINE@ @CRYPTO@
-+CDEFINES =      @CONTRIB_DLZ@ @CRYPTO@
+-CDEFINES =      @CONTRIB_DLZ@ @USE_PKCS11@ @PKCS11_ENGINE@ @USE_GSSAPI@ @CRYPTO@
++CDEFINES =      @CONTRIB_DLZ@ @USE_GSSAPI@ @CRYPTO@
  
  CWARNINGS =
  
@@ -302,7 +302,7 @@ index a058c91..d4b689a 100644
  DEPLIBS =	${ISCDEPLIBS}
  
 diff --git a/configure.ac b/configure.ac
-index 3b88105..0532feb 100644
+index 9b7d778..59ba20b 100644
 --- a/configure.ac
 +++ b/configure.ac
 @@ -1139,12 +1139,14 @@ AC_SUBST(USE_GSSAPI)
@@ -320,7 +320,7 @@ index 3b88105..0532feb 100644
  
  #
  # was --with-randomdev specified?
-@@ -1529,11 +1531,11 @@ fi
+@@ -1494,11 +1496,11 @@ AC_ARG_ENABLE(openssl-hash,
  AC_MSG_CHECKING(for OpenSSL library)
  OPENSSL_WARNING=
  openssldirs="/usr /usr/local /usr/local/ssl /opt/local /usr/pkg /usr/sfw"
@@ -337,7 +337,7 @@ index 3b88105..0532feb 100644
  
  if test "auto" = "$use_openssl"
  then
-@@ -1546,6 +1548,7 @@ then
+@@ -1511,6 +1513,7 @@ then
  		fi
  	done
  fi
@@ -345,7 +345,7 @@ index 3b88105..0532feb 100644
  OPENSSL_ECDSA=""
  OPENSSL_GOST=""
  OPENSSL_ED25519=""
-@@ -1567,11 +1570,10 @@ case "$with_gost" in
+@@ -1532,11 +1535,10 @@ case "$with_gost" in
  		;;
  esac
  
@@ -360,7 +360,7 @@ index 3b88105..0532feb 100644
  		CRYPTOLIB="pkcs11"
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
-@@ -1581,7 +1583,9 @@ case "$use_openssl" in
+@@ -1546,7 +1548,9 @@ case "$use_openssl" in
  		OPENSSLGOSTLINKSRCS=""
  		OPENSSLLINKOBJS=""
  		OPENSSLLINKSRCS=""
@@ -371,7 +371,7 @@ index 3b88105..0532feb 100644
  	no)
  		AC_MSG_RESULT(no)
  		DST_OPENSSL_INC=""
-@@ -1613,7 +1617,7 @@ case "$use_openssl" in
+@@ -1578,7 +1582,7 @@ case "$use_openssl" in
  If you do not want OpenSSL, use --without-openssl])
  		;;
  	*)
@@ -380,7 +380,7 @@ index 3b88105..0532feb 100644
  		then
  			AC_MSG_RESULT()
  			AC_MSG_ERROR([OpenSSL and native PKCS11 cannot be used together.])
-@@ -2041,6 +2045,7 @@ AC_SUBST(OPENSSL_ED25519)
+@@ -2006,6 +2010,7 @@ AC_SUBST(OPENSSL_ED25519)
  AC_SUBST(OPENSSL_GOST)
  
  DNS_CRYPTO_LIBS="$DNS_CRYPTO_LIBS $DST_OPENSSL_LIBS"
@@ -388,7 +388,7 @@ index 3b88105..0532feb 100644
  
  ISC_PLATFORM_WANTAES="#undef ISC_PLATFORM_WANTAES"
  if test "yes" = "$with_aes"
-@@ -2364,6 +2369,7 @@ esac
+@@ -2291,6 +2296,7 @@ esac
  AC_SUBST(PKCS11LINKOBJS)
  AC_SUBST(PKCS11LINKSRCS)
  AC_SUBST(CRYPTO)
@@ -396,7 +396,7 @@ index 3b88105..0532feb 100644
  AC_SUBST(PKCS11_ECDSA)
  AC_SUBST(PKCS11_GOST)
  AC_SUBST(PKCS11_ED25519)
-@@ -5491,8 +5497,11 @@ AC_CONFIG_FILES([
+@@ -5405,8 +5411,11 @@ AC_CONFIG_FILES([
  	bin/delv/Makefile
  	bin/dig/Makefile
  	bin/dnssec/Makefile
@@ -408,7 +408,7 @@ index 3b88105..0532feb 100644
  	bin/nsupdate/Makefile
  	bin/pkcs11/Makefile
  	bin/python/Makefile
-@@ -5565,6 +5574,10 @@ AC_CONFIG_FILES([
+@@ -5479,6 +5488,10 @@ AC_CONFIG_FILES([
  	lib/dns/include/dns/Makefile
  	lib/dns/include/dst/Makefile
  	lib/dns/tests/Makefile
@@ -419,7 +419,7 @@ index 3b88105..0532feb 100644
  	lib/irs/Makefile
  	lib/irs/include/Makefile
  	lib/irs/include/irs/Makefile
-@@ -5589,6 +5602,24 @@ AC_CONFIG_FILES([
+@@ -5503,6 +5516,24 @@ AC_CONFIG_FILES([
  	lib/isc/unix/include/Makefile
  	lib/isc/unix/include/isc/Makefile
  	lib/isc/unix/include/pkcs11/Makefile
@@ -533,7 +533,7 @@ index 7f09bd6..c388d9e 100644
  	rm -f include/dns/rdatastruct.h
  	rm -f dnstap.pb-c.c dnstap.pb-c.h
 diff --git a/lib/isc-pkcs11/Makefile.in b/lib/isc-pkcs11/Makefile.in
-index 98acfff..2fd6981 100644
+index 8ad54bb..a3ecdfb 100644
 --- a/lib/isc-pkcs11/Makefile.in
 +++ b/lib/isc-pkcs11/Makefile.in
 @@ -23,8 +23,8 @@ CINCLUDES =	-I${srcdir}/unix/include \
diff --git a/bind-9.10-sdb.patch b/bind-9.10-sdb.patch
index c72906c..ef9a8dc 100644
--- a/bind-9.10-sdb.patch
+++ b/bind-9.10-sdb.patch
@@ -14,7 +14,7 @@ index ce7a2da..4e6a824 100644
  
  @BIND9_MAKE_RULES@
 diff --git a/bin/named-sdb/Makefile.in b/bin/named-sdb/Makefile.in
-index 9660965..184fbb2 100644
+index 4cfed4d..c6b42b2 100644
 --- a/bin/named-sdb/Makefile.in
 +++ b/bin/named-sdb/Makefile.in
 @@ -30,10 +30,10 @@ VERSION=@BIND9_VERSION@
@@ -203,7 +203,7 @@ index 108b8d6..a943421 100644
  		      ISC_LOG_NOTICE, "exiting");
  	ns_log_shutdown();
 diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
-index 9660965..03f7c05 100644
+index 4cfed4d..f4bce7b 100644
 --- a/bin/named/Makefile.in
 +++ b/bin/named/Makefile.in
 @@ -45,10 +45,10 @@ DLZDRIVER_LIBS =	@DLZ_DRIVER_LIBS@
@@ -214,8 +214,8 @@ index 9660965..03f7c05 100644
 +		${MAXMINDDB_CFLAGS} \
  		@DST_OPENSSL_INC@
  
--CDEFINES =      @CONTRIB_DLZ@ @CRYPTO@
-+CDEFINES =      @CRYPTO@
+-CDEFINES =      @CONTRIB_DLZ@ @USE_GSSAPI@ @CRYPTO@
++CDEFINES =      @USE_GSSAPI@ @CRYPTO@
  
  CWARNINGS =
  
@@ -297,10 +297,10 @@ index c7e0868..95ab742 100644
 +	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zone2sqlite@EXEEXT@ ${DESTDIR}${sbindir}
  	${INSTALL_DATA} ${srcdir}/zone2ldap.1 ${DESTDIR}${mandir}/man1/zone2ldap.1
 diff --git a/configure.ac b/configure.ac
-index d8147ae..930cd1c 100644
+index f6380b1..318e533 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -5532,6 +5532,8 @@ AC_CONFIG_FILES([
+@@ -5416,6 +5416,8 @@ AC_CONFIG_FILES([
  	bin/named/unix/Makefile
  	bin/named-pkcs11/Makefile
  	bin/named-pkcs11/unix/Makefile
@@ -309,7 +309,7 @@ index d8147ae..930cd1c 100644
  	bin/nsupdate/Makefile
  	bin/pkcs11/Makefile
  	bin/python/Makefile
-@@ -5556,6 +5558,7 @@ AC_CONFIG_FILES([
+@@ -5440,6 +5442,7 @@ AC_CONFIG_FILES([
  	bin/python/isc/tests/dnskey_test.py
  	bin/python/isc/tests/policy_test.py
  	bin/rndc/Makefile
diff --git a/bind-9.11-feature-test-named.patch b/bind-9.11-feature-test-named.patch
index 8d5ef9a..c8e6d57 100644
--- a/bind-9.11-feature-test-named.patch
+++ b/bind-9.11-feature-test-named.patch
@@ -1,4 +1,4 @@
-From d394129acaa40ec7fc68ab27802f0a01fcd50f3d Mon Sep 17 00:00:00 2001
+From 3f2fafe5368655225eddf0537e58e425bbc297be Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Wed, 30 Jan 2019 14:37:17 +0100
 Subject: [PATCH] Create feature-test in source directory
@@ -6,15 +6,28 @@ Subject: [PATCH] Create feature-test in source directory
 Feature-test tool is used in system tests to test compiled in changes.
 Because we build more variants of named with different configuration,
 compile feature-test for each of them this way.
+
+Named variant specific feature-test does not have defined gss support,
+even when it was enabled by configure. bin/tests/system Makefile defines
+it, so define it also in named variants.
 ---
- bin/named/Makefile.in       | 11 ++++++++++-
+ bin/named/Makefile.in       | 13 +++++++++++--
  bin/tests/system/conf.sh.in |  2 +-
- 2 files changed, 11 insertions(+), 2 deletions(-)
+ 2 files changed, 12 insertions(+), 3 deletions(-)
 
 diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
-index 3166368..df1f7ee 100644
+index 3166368..70e5571 100644
 --- a/bin/named/Makefile.in
 +++ b/bin/named/Makefile.in
+@@ -48,7 +48,7 @@ CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
+ 		${DLZDRIVER_INCLUDES} ${DBDRIVER_INCLUDES} ${MAXMINDDB_CFLAGS} \
+ 		@DST_OPENSSL_INC@
+ 
+-CDEFINES =      @CONTRIB_DLZ@ @USE_PKCS11@ @PKCS11_ENGINE@ @CRYPTO@
++CDEFINES =      @CONTRIB_DLZ@ @USE_PKCS11@ @PKCS11_ENGINE@ @USE_GSSAPI@ @CRYPTO@
+ 
+ CWARNINGS =
+ 
 @@ -80,7 +80,7 @@ NOSYMLIBS =	${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
  
  SUBDIRS =	unix
@@ -41,7 +54,7 @@ index 3166368..df1f7ee 100644
  
  docclean manclean maintainer-clean::
 diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
-index 65c0c5a..117d6ec 100644
+index cedabbe..e1bf5da 100644
 --- a/bin/tests/system/conf.sh.in
 +++ b/bin/tests/system/conf.sh.in
 @@ -71,7 +71,7 @@ DNSTAPREAD=$TOP/bin/tools/dnstap-read

From 5691e04b76642e7c9a9f7597c5e01839dd4058c1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 27 Aug 2019 22:40:23 +0200
Subject: [PATCH 066/460] Fix source fetching

---
 tests/Run-internal-BIND-test-suite/runtest.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/Run-internal-BIND-test-suite/runtest.sh b/tests/Run-internal-BIND-test-suite/runtest.sh
index 7f4d212..123c321 100755
--- a/tests/Run-internal-BIND-test-suite/runtest.sh
+++ b/tests/Run-internal-BIND-test-suite/runtest.sh
@@ -70,7 +70,7 @@ rlJournalStart
 
         # download src rpm
 	if ! ls bind*.src.rpm; then
-		rlRun "dnf --enablerepo='*-source' download bind.src" 0 "Fetch source from repository"
+		rlRun "dnf --enablerepo='*-source' download --source bind" 0 "Fetch source from repository"
 		rlRun "rpm -i bind*.src.rpm"
 	fi
 	

From 5aee3f1742489f8245b05068db10a1b18a78c833 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 27 Aug 2019 23:30:55 +0200
Subject: [PATCH 067/460] Precise timing perl package is required

---
 tests/Run-internal-BIND-test-suite/Makefile | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tests/Run-internal-BIND-test-suite/Makefile b/tests/Run-internal-BIND-test-suite/Makefile
index 2343d3d..401971c 100644
--- a/tests/Run-internal-BIND-test-suite/Makefile
+++ b/tests/Run-internal-BIND-test-suite/Makefile
@@ -57,6 +57,7 @@ $(METADATA): Makefile
 	@echo "RunFor:          bind" >> $(METADATA)
 	@echo "Requires:        bind rpm-build bind-utils" >> $(METADATA)
 	@echo "Requires:        perl-Net-DNS perl-Net-DNS-Nameserver" >> $(METADATA)
+	@echo "Requires:        perl-Time-HiRes" >> $(METADATA)
 	@echo "Requires:        bind-pkcs11 bind-pkcs11-utils softhsm" >> $(METADATA)
 	@echo "Requires:        openssl-devel libtool autoconf" >> $(METADATA)
 	@echo "Requires:        libcap-devel libidn-devel libxml2-devel" >> $(METADATA) 

From 0983c90fb029861bb70bcfb4b341e612727994a4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 27 Aug 2019 21:27:47 +0200
Subject: [PATCH 068/460] Modify test suite to include also variants

Run system tests for each variants.
---
 tests/Run-internal-BIND-test-suite/runtest.sh | 77 ++++++++++++-------
 1 file changed, 50 insertions(+), 27 deletions(-)

diff --git a/tests/Run-internal-BIND-test-suite/runtest.sh b/tests/Run-internal-BIND-test-suite/runtest.sh
index 123c321..92d96a2 100755
--- a/tests/Run-internal-BIND-test-suite/runtest.sh
+++ b/tests/Run-internal-BIND-test-suite/runtest.sh
@@ -32,6 +32,40 @@
 
 PACKAGE="bind"
 
+#
+# Runs test suite and checks known errors
+# Prepared to be repeated with another variants
+run_testsuite()
+{
+	local RESULT_TEXT="$TMPDIR/test${NAMED_VARIANT}.txt"
+	local FOUNDERROR=`mktemp found-XXXXXXXX.err`
+	local KNOWNERROR
+
+	if [ -f "$ORIG/knownerror${NAMED_VARIANT}.$TAG" ]; then
+		KNOWNERROR=`readlink -f $ORIG/knownerror.$TAG`
+	elif [ -f "$ORIG/knownerror${NAMED_VARIANT}" ]; then
+		KNOWNERROR=`readlink -f $ORIG/knownerror`
+	fi
+
+	# Sometime it can fail. Report just failures that are not known
+        rlRun "make test -j${CORES:-1} &> $RESULT_TEXT" 0-255 "Perform the test."
+        rlRun "grep -C 10 FAIL $RESULT_TEXT" 0-255 "Quickly show the test error (if any)."
+
+	rlRun "$FILTER $RESULT_TEXT" 0 "Showing unsuccessful tests"
+	rlRun "$FILTER -s $RESULT_TEXT > $FOUNDERROR" 0
+	rlRun "ls $KNOWNERROR $FOUNDERROR $RESULT_TEXT" 0 'check if there is needed files'
+	rlLog "`cat $FOUNDERROR`"
+
+	rlAssertLesserOrEqual "Checking number of found errors is in limits" "$(grep '^FAIL' $FOUNDERROR | wc -l)" "$(wc -l <$KNOWNERROR)"
+        cat $FOUNDERROR | while read STATUS TEST ; do
+		if [ "$STATUS" = FAIL ]; then
+			rlRun "grep '$TEST' $KNOWNERROR" 0 "Check $TEST failure is expected"
+		else
+			rlLog "$STATUS $TEST"
+		fi
+        done
+}
+
 rlJournalStart
     rlPhaseStartSetup
         # package assertions
@@ -41,9 +75,9 @@ rlJournalStart
 
 	#pwd
 	ORIG=`pwd`
-	FOUNDERROR=`mktemp`
 	SETUP_SOFTHSM=`readlink -f setup-named-softhsm.sh`
 	FILTER=`readlink -f bind-systest-filter.sh`
+	CORES=`grep 'processor\s*:' /proc/cpuinfo | wc -l`
 
 	TAG=generic
 	if [ -f /etc/os-release ]; then
@@ -51,12 +85,6 @@ rlJournalStart
 		TAG=`(source /etc/os-release && echo ${PLATFORM_ID#platform:})`
 	fi
 
-	if [ -f "knownerror.$TAG" ]; then
-		KNOWNERROR=`readlink -f knownerror.$TAG`
-	elif [ -f "knownerror" ]; then
-		KNOWNERROR=`readlink -f knownerror`
-	fi
-
         #tempdir
         rlRun "TMPDIR=\`mktemp -d\`" 0 "Creating tmp directory"
         rlRun "pushd $TMPDIR"
@@ -113,34 +141,29 @@ rlJournalStart
 	export LC_ALL=en_US.UTF-8
 
         rlRun "pushd $BUILD"
-        rlRun "make test &> $TMPDIR/test.txt" 0-255 "Perform the test."
-        rlRun "popd"
 
-        rlRun "grep -C 10 FAIL $TMPDIR/test.txt" 0-255 "Quickly show the test error (if any)."
+	rlLog "Running normal variant"
+	export NAMED_VARIANT= DNSSEC_VARIANT=
+	run_testsuite
+
+	rlLog "Running pkcs11 variant"
+	export NAMED_VARIANT=-pkcs11 DNSSEC_VARIANT=-pkcs11
+	run_testsuite
+
+	rlLog "Running sdb variant"
+	export NAMED_VARIANT=-sdb DNSSEC_VARIANT=
+	run_testsuite
+
+        rlRun "popd"
 
         rlRun "./bin/tests/system/ifconfig.sh down" 0 "Remove fake network interfaces."
 
-
-	#list of failures:
-	rlRun "$FILTER $TMPDIR/test.txt" 0 "Showing unsuccessful tests"
-	rlRun "$FILTER -s $TMPDIR/test.txt > $FOUNDERROR" 0
-	rlRun "ls $KNOWNERROR $FOUNDERROR $TMPDIR/test.txt" 0 'check if there is needed files'
-	rlLog "`cat $FOUNDERROR`"
-
-	rlAssertLesserOrEqual "Checking number of found errors is in limits" "$(grep '^FAIL' $FOUNDERROR | wc -l)" "$(wc -l <$KNOWNERROR)"
-        cat $FOUNDERROR | while read STATUS TEST ; do
-		if [ "$STATUS" = FAIL ]; then
-			rlRun "grep '$TEST' $KNOWNERROR" 0 "Check $TEST failure is expected"
-		else
-			rlLog "$STATUS $TEST"
-		fi
-        done
     rlPhaseEnd
 
     rlPhaseStartCleanup
-        rlBundleLogs "TEST_LOGS" "$TMPDIR/install.txt" "$TMPDIR/builddeps.txt" "$TMPDIR/build.txt" "$TMPDIR/test.txt"
+        rlBundleLogs "BUILD_LOGS" "$TMPDIR/install.txt" "$TMPDIR/builddeps.txt" "$TMPDIR/build.txt"
+        rlBundleLogs "TEST_LOGS" "$TMPDIR"/test*.txt
         rlRun "popd"
         rlRun "rm -r $TMPDIR" 0 "Removing tmp directory"
-	rlRun "rm -rf $FOUNDERROR"
     rlPhaseEnd
 rlJournalEnd

From 545e2cb4bce7b60c702f40d699fe2faaed160881 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 28 Aug 2019 00:16:40 +0200
Subject: [PATCH 069/460] Make tests optional

Make it possible to skip some test using parameter. In some cases, just
single pass is required.
Also fix case when no known defects are specified for a variant.
---
 tests/Run-internal-BIND-test-suite/runtest.sh | 32 +++++++++++++------
 1 file changed, 22 insertions(+), 10 deletions(-)

diff --git a/tests/Run-internal-BIND-test-suite/runtest.sh b/tests/Run-internal-BIND-test-suite/runtest.sh
index 92d96a2..be5ef5b 100755
--- a/tests/Run-internal-BIND-test-suite/runtest.sh
+++ b/tests/Run-internal-BIND-test-suite/runtest.sh
@@ -32,6 +32,10 @@
 
 PACKAGE="bind"
 
+# Set those variables to n to skip tests on variants
+DEFAULT_VARIANTS="normal pkcs11 sdb"
+#TEST_VARIANTS="normal"
+
 #
 # Runs test suite and checks known errors
 # Prepared to be repeated with another variants
@@ -39,7 +43,7 @@ run_testsuite()
 {
 	local RESULT_TEXT="$TMPDIR/test${NAMED_VARIANT}.txt"
 	local FOUNDERROR=`mktemp found-XXXXXXXX.err`
-	local KNOWNERROR
+	local KNOWNERROR=/dev/null
 
 	if [ -f "$ORIG/knownerror${NAMED_VARIANT}.$TAG" ]; then
 		KNOWNERROR=`readlink -f $ORIG/knownerror.$TAG`
@@ -142,17 +146,25 @@ rlJournalStart
 
         rlRun "pushd $BUILD"
 
-	rlLog "Running normal variant"
-	export NAMED_VARIANT= DNSSEC_VARIANT=
-	run_testsuite
+	if echo "${TEST_VARIANTS:-$DEFAULT_VARIANTS}" | grep -q normal; then
+		rlLog "Running normal variant"
+		export NAMED_VARIANT= DNSSEC_VARIANT=
+		run_testsuite
+	fi
 
-	rlLog "Running pkcs11 variant"
-	export NAMED_VARIANT=-pkcs11 DNSSEC_VARIANT=-pkcs11
-	run_testsuite
+	if echo "${TEST_VARIANTS:-$DEFAULT_VARIANTS}" | grep -q sdb; then
+		rlLog "Running sdb variant"
+		export NAMED_VARIANT=-sdb DNSSEC_VARIANT=
+		run_testsuite
+	fi
 
-	rlLog "Running sdb variant"
-	export NAMED_VARIANT=-sdb DNSSEC_VARIANT=
-	run_testsuite
+	if echo "${TEST_VARIANTS:-$DEFAULT_VARIANTS}" | grep -q pkcs11; then
+		rlLog "Running pkcs11 variant"
+		# Unfortunately, PKCS11 variant uses shared key storage
+		# It cannot use more threads for that reason
+		export NAMED_VARIANT=-pkcs11 DNSSEC_VARIANT=-pkcs11
+		CORES=1 run_testsuite
+	fi
 
         rlRun "popd"
 

From 54fa84a38734ae33672ff0c751063c7b634c2a44 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 28 Aug 2019 00:42:54 +0200
Subject: [PATCH 070/460] Use also termination logs to measure time

Might use different approach to display grouped results.
---
 tests/Run-internal-BIND-test-suite/runtest.sh | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/tests/Run-internal-BIND-test-suite/runtest.sh b/tests/Run-internal-BIND-test-suite/runtest.sh
index be5ef5b..0286d6c 100755
--- a/tests/Run-internal-BIND-test-suite/runtest.sh
+++ b/tests/Run-internal-BIND-test-suite/runtest.sh
@@ -150,12 +150,14 @@ rlJournalStart
 		rlLog "Running normal variant"
 		export NAMED_VARIANT= DNSSEC_VARIANT=
 		run_testsuite
+		rlLog "Finished normal variant"
 	fi
 
 	if echo "${TEST_VARIANTS:-$DEFAULT_VARIANTS}" | grep -q sdb; then
 		rlLog "Running sdb variant"
 		export NAMED_VARIANT=-sdb DNSSEC_VARIANT=
 		run_testsuite
+		rlLog "Finished sdb variant"
 	fi
 
 	if echo "${TEST_VARIANTS:-$DEFAULT_VARIANTS}" | grep -q pkcs11; then
@@ -164,6 +166,7 @@ rlJournalStart
 		# It cannot use more threads for that reason
 		export NAMED_VARIANT=-pkcs11 DNSSEC_VARIANT=-pkcs11
 		CORES=1 run_testsuite
+		rlLog "Finished pkcs11 variant"
 	fi
 
         rlRun "popd"

From 7eb2cf5e7b4bcf9ad7168d27cbd40b600579f5cd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 28 Aug 2019 09:50:44 +0200
Subject: [PATCH 071/460] Update and simplify package requirements

bind-devel should now provide all dependencies required. Omit explicitl
requirements for building. Drop atf building support, since upstream
moved to cmocka.
---
 tests/Run-internal-BIND-test-suite/Makefile | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/tests/Run-internal-BIND-test-suite/Makefile b/tests/Run-internal-BIND-test-suite/Makefile
index 401971c..0b90930 100644
--- a/tests/Run-internal-BIND-test-suite/Makefile
+++ b/tests/Run-internal-BIND-test-suite/Makefile
@@ -60,12 +60,14 @@ $(METADATA): Makefile
 	@echo "Requires:        perl-Time-HiRes" >> $(METADATA)
 	@echo "Requires:        bind-pkcs11 bind-pkcs11-utils softhsm" >> $(METADATA)
 	@echo "Requires:        openssl-devel libtool autoconf" >> $(METADATA)
-	@echo "Requires:        libcap-devel libidn-devel libxml2-devel" >> $(METADATA) 
-	@echo "Requires:        openldap-devel postgresql-devel" >> $(METADATA)
-	@echo "Requires:        sqlite-devel krb5-devel net-tools" >> $(METADATA)
+# Try to satisfy all build dependencies from here
+	@echo "Requires:        bind-devel" >> $(METADATA)
+	@echo "Requires:        net-tools" >> $(METADATA)
 	@echo "Requires:        dnf-utils" >> $(METADATA)
-	@echo "Requires:        kyua libatf-c" >> $(METADATA)
-	@echo "Requires:        gcc-c++" >> $(METADATA)
+	@echo "Requires:        kyua" >> $(METADATA)
+	@echo "Requires:        libcmocka-devel" >> $(METADATA)
+# Obsolete, uses cmocka
+#	@echo "Requires:        libatf-c gcc-c++" >> $(METADATA)
 	@echo "Priority:        Normal" >> $(METADATA)
 	@echo "License:         GPLv2" >> $(METADATA)
 	@echo "Confidential:    no" >> $(METADATA)

From 339db1a4829f802a96ebb9323f61134071050e79 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 28 Aug 2019 09:52:49 +0200
Subject: [PATCH 072/460] Add internal test suite to set of tests

---
 tests/tests.yml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/tests/tests.yml b/tests/tests.yml
index cc363a0..15360ed 100644
--- a/tests/tests.yml
+++ b/tests/tests.yml
@@ -8,9 +8,19 @@
     tests:
     - Master-server-chrooted
     - Master-server-not-chrooted
+    - Run-internal-BIND-test-suite
     required_packages:
     - bind
     - bind-chroot
     - bind-sdb-chroot
     - redhat-lsb
     - bind-utils
+    - dnf-utils
+    - kyua
+    - bind-devel
+    - perl-Net-DNS
+    - perl-Net-DNS-Nameserver
+    - perl-Time-HiRes
+    - softhsm
+    - bind-pkcs11
+    - bind-pkcs11-utils

From 277938ec6c6e5d5de3ff4943b8773ad2d5fd3dff Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 25 Sep 2019 20:33:26 +0200
Subject: [PATCH 073/460] Use just normal variant by default

Testing takes quite long. For now, use by default only normal variant.
SDB variant is not much used and pkcs11 variant is failing now. Keep
ability to enable variants by parameter:
   TEST_VARIANTS="normal sdb pkcs11"
---
 tests/Run-internal-BIND-test-suite/runtest.sh | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tests/Run-internal-BIND-test-suite/runtest.sh b/tests/Run-internal-BIND-test-suite/runtest.sh
index 0286d6c..7066344 100755
--- a/tests/Run-internal-BIND-test-suite/runtest.sh
+++ b/tests/Run-internal-BIND-test-suite/runtest.sh
@@ -33,7 +33,8 @@
 PACKAGE="bind"
 
 # Set those variables to n to skip tests on variants
-DEFAULT_VARIANTS="normal pkcs11 sdb"
+#DEFAULT_VARIANTS="normal pkcs11 sdb"
+DEFAULT_VARIANTS="normal"
 #TEST_VARIANTS="normal"
 
 #

From 69b861316f0613748e080cb3ffdea824479b1537 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 25 Sep 2019 21:24:23 +0200
Subject: [PATCH 074/460] Update to 9.11.11

- Interaction between DNS64 and RPZ No Data rule (CNAME *.) could
  cause unexpected results; this has been fixed. [GL #1106]

- named-checkconf now checks DNS64 prefixes
  to ensure bits 64-71 are zero. [GL #1159]

- named-checkconf could crash during configuration
  if configured to use "geoip continent" ACLs with
  legacy GeoIP. [GL #1163]

- named-checkconf now correctly reports missing
  dnstap-output option when
  dnstap is set. [GL #1136

- Handle ETIMEDOUT error on connect() with a non-blocking
  socket. [GL #1133]
---
 .gitignore              |  1 +
 bind-9.11.10.tar.gz.asc | 16 ----------------
 bind-9.11.11.tar.gz.asc | 16 ++++++++++++++++
 sources                 |  2 +-
 4 files changed, 18 insertions(+), 17 deletions(-)
 delete mode 100644 bind-9.11.10.tar.gz.asc
 create mode 100644 bind-9.11.11.tar.gz.asc

diff --git a/.gitignore b/.gitignore
index 58e8142..d49dc25 100644
--- a/.gitignore
+++ b/.gitignore
@@ -96,3 +96,4 @@ bind-9.7.2b1.tar.gz
 /bind-9.11.8.tar.gz
 /bind-9.11.9.tar.gz
 /bind-9.11.10.tar.gz
+/bind-9.11.11.tar.gz
diff --git a/bind-9.11.10.tar.gz.asc b/bind-9.11.10.tar.gz.asc
deleted file mode 100644
index 8ea66c9..0000000
--- a/bind-9.11.10.tar.gz.asc
+++ /dev/null
@@ -1,16 +0,0 @@
------BEGIN PGP SIGNATURE-----
-
-iQIzBAABAgAdFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAl1VKuIACgkQdLtrmky7
-PThvHg/+O+c3U/k/3wYB5XAmT2HSCIqIp8gdu4+0B4rsIJAN+aR1HDIsCTuJqyjw
-jw9fI61d5skxeJljbNChAMTC2Ps1W7bXHFC8B25WQvQAcL/FDJQrLtgRXCJKB9sd
-/hss07hGrrZbE5wRePJJtn4R1d6WLoA/hz1da7IcoZJpFPmlkHE9kZUd9mPAHnMv
-QYCqpl821m53UMENufyrwNMDTaIwqPM4fJ8OVBam/743ZIOP/imwMVnJws6HjRz1
-n4JPoKsMkLOTV0hDotgTl7V1qm4EXKG5xPM882frpfRkk/V/qOvEzLkgVLDF6xHR
-iuZsMvKfrc/VyrKRcQNHs2kA0EqbKfskLoSenj7B/WrvVCeQ+MA4MSg/81Rzzs6P
-gDDCMcWY3X2VlYUA521Z9DagoC49DpfKf+rfeCH/HTNjdWkfClnQoGb9n5Ggy/sM
-NP/ApLN2TOHqMIMU0RGr2U3OY8TNmpq7xfggnr3qL5Of1ez4HYlyLdmma3HPJjvY
-uYdJwVRcJ7rq510QBSf8VGK9/qERkhklh4MZvIzS5htnn+94Gk3gT8p3aZGQ5z2d
-W2RVl+4HQ7aRtQMeQeX79uccVF9vcTBTiAJhILYcp7Q6NBOVMTCabSAnRk3f0GfS
-1x+Ojt+7yVCB3pym8N+mHM3q8l7VvIw1As7QAGi6mdVAaTN8zxc=
-=ZIsR
------END PGP SIGNATURE-----
diff --git a/bind-9.11.11.tar.gz.asc b/bind-9.11.11.tar.gz.asc
new file mode 100644
index 0000000..1ad0c7b
--- /dev/null
+++ b/bind-9.11.11.tar.gz.asc
@@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABAgAdFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAl16E/oACgkQdLtrmky7
+PTj5wQ//ZzItGqypNVGqYlocyQZRjvzjqJiPwIfgp7qpvDxQp7CPNuPqx35G0Xu6
+UJNKGZfJRKCoIrnN1QdBCXe+6ggl2O7iB3LJAeOiWz7oPj4DI2xTDu2oKKBkqLwF
+OimFr5B3F8wn59Bn2WgBpqjM3rv+kW2sQpahfBaYSYhqg0hmgOtn3Ksiopy+32l9
+0SNVhXtI+s1x2MCEdGweb24FJ663VC2rx5PJaD/59VPW3tXanemmTq6rLvdht+OE
+8zmTTQDPTu3CJFBnOwxBLvuvQDHvbVqiaU0o6nVHBow5D3FxL2R9ybNGBETY5af0
+7NqH9XEoeKFFRRdsEcTIRuLVQMdPl3dHWjCW0LeGjdOOwN5H8Yc1DGhfAaS3cD26
+d6L3cr6X9M7zTbKPTCYeNh/ydA3o4HRZV2LW3txac4qz2wxNaXytfsIGKb0Ag08U
+5MdGBdBbavDsX8aaRUHB0uiLL2U6rIm9dHeXWeed4B45YWMQ/kyEWqV5LYCHLq4F
+Hl2Tnjmp3YeE5qJHJtyXpOhhMYTVm6xACe72djyifxlJZlagBZihEc1D7xy/+Dmg
+JsBoA/X9C8RYGR/uAfxFiTQRNJtRdbPg168m/fV3cqo7m9mZGUdJOF51TSEOzfxx
+6RFuOl+R0YvyTtjBZaY2eeKRLdSc0uLHETRh+NmBHDx8bxSm8DM=
+=/ZDI
+-----END PGP SIGNATURE-----
diff --git a/sources b/sources
index c992ba3..31c6abf 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.11.10.tar.gz) = b560cd6b88df0ffe0008d0559b49c28fbe4ed49da1a81e61c373faa5368ad1570c4cf945d224b451634f7506e52d9effb9aee3966c5ff66d95215fffea494f4e
+SHA512 (bind-9.11.11.tar.gz) = 52a3e94b686bb8a9c5ec327bb9a23c6f94762a9c6f2080bfe06feb07ec432ece5f6554bdd4f5e9f39cc77e7da4c8330449d89e3dc92716e133c5be41a867d7a0
 SHA512 (config-19.tar.bz2) = 36aa38a0c7c33267ae594b31c81681290ac58dde7ca6749bd599da531380b5b1428330813dbe983e01071ccaed83e83f6a9cd92179a53b7d0ccbb6851a0b017c

From 833ef7b7b4be3faf82b68a24068c9520e7ccaba7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 25 Sep 2019 21:30:47 +0200
Subject: [PATCH 075/460] Adjust downstream patches to 9.11.11

---
 bind-9.11-rt31459.patch | 23 +++++++++++------------
 bind.spec               |  7 +++++--
 2 files changed, 16 insertions(+), 14 deletions(-)

diff --git a/bind-9.11-rt31459.patch b/bind-9.11-rt31459.patch
index 27d8273..8413061 100644
--- a/bind-9.11-rt31459.patch
+++ b/bind-9.11-rt31459.patch
@@ -1,4 +1,4 @@
-From 9f62d68da08d21a8b35e27aeebd00afe6e5fb7be Mon Sep 17 00:00:00 2001
+From 108a0f57f423a27995ac96272832278f4aa3a612 Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Tue, 12 Sep 2017 19:05:46 -0700
 Subject: [PATCH] rebased rt31459c
@@ -24,7 +24,7 @@ Include new unit test
  bin/named/server.c                       |   6 +
  bin/nsupdate/nsupdate.c                  |  14 +-
  bin/tests/makejournal.c                  |   6 +-
- bin/tests/system/pipelined/pipequeries.c |  21 +-
+ bin/tests/system/pipelined/pipequeries.c |  20 +-
  bin/tests/system/pipelined/tests.sh      |   4 +-
  bin/tests/system/rsabigexponent/bigkey.c |   4 +
  bin/tests/system/tkey/keycreate.c        |  26 ++-
@@ -49,7 +49,7 @@ Include new unit test
  lib/isc/pk11.c                           |  12 +-
  lib/isc/win32/include/isc/platform.h.in  |   5 +
  win32utils/Configure                     |  28 ++-
- 36 files changed, 702 insertions(+), 175 deletions(-)
+ 36 files changed, 701 insertions(+), 175 deletions(-)
  create mode 100644 lib/dns/tests/dstrandom_test.c
 
 diff --git a/bin/confgen/keygen.c b/bin/confgen/keygen.c
@@ -386,7 +386,7 @@ index 61a41b0..acc71a1 100644
  	isc_log_registercategories(lctx, categories);
  	isc_log_setcontext(lctx);
 diff --git a/bin/tests/system/pipelined/pipequeries.c b/bin/tests/system/pipelined/pipequeries.c
-index 2fcc064..7b4f617 100644
+index c6ab7f8..f0a6ff2 100644
 --- a/bin/tests/system/pipelined/pipequeries.c
 +++ b/bin/tests/system/pipelined/pipequeries.c
 @@ -204,6 +204,7 @@ sendqueries(isc_task_t *task, isc_event_t *event) {
@@ -397,17 +397,16 @@ index 2fcc064..7b4f617 100644
  	isc_sockaddr_t bind_any;
  	struct in_addr inaddr;
  	isc_result_t result;
-@@ -224,7 +225,8 @@ main(int argc, char *argv[]) {
- 	UNUSED(argv);
+@@ -222,7 +223,7 @@ main(int argc, char *argv[]) {
+ 	int c;
  
  	isc_commandline_errprint = false;
 -	while ((c = isc_commandline_parse(argc, argv, "p:")) != -1) {
-+	while ((c = isc_commandline_parse(argc, argv, "p:r:")) != -1)
-+	{
++	while ((c = isc_commandline_parse(argc, argv, "p:r:")) != -1) {
  		switch (c) {
  		case 'p':
  			result = isc_parse_uint16(&port,
-@@ -235,6 +237,9 @@ main(int argc, char *argv[]) {
+@@ -233,6 +234,9 @@ main(int argc, char *argv[]) {
  				exit(1);
  			}
  			break;
@@ -417,7 +416,7 @@ index 2fcc064..7b4f617 100644
  		case '?':
  			fprintf(stderr, "%s: invalid argument '%c'",
  				argv[0], c);
-@@ -276,10 +281,18 @@ main(int argc, char *argv[]) {
+@@ -275,10 +279,18 @@ main(int argc, char *argv[]) {
  
  	ectx = NULL;
  	RUNCHECK(isc_entropy_create(mctx, &ectx));
@@ -438,7 +437,7 @@ index 2fcc064..7b4f617 100644
  
  	taskmgr = NULL;
  	RUNCHECK(isc_taskmgr_create(mctx, 1, 0, &taskmgr));
-@@ -332,8 +345,8 @@ main(int argc, char *argv[]) {
+@@ -331,8 +343,8 @@ main(int argc, char *argv[]) {
  	isc_task_detach(&task);
  	isc_taskmgr_destroy(&taskmgr);
  
@@ -1974,7 +1973,7 @@ index 42ff7e0..8d87c44 100644
  typedef int (*isc_sockfdwatch_t)(isc_task_t *, isc_socket_t *, void *, int);
  
 diff --git a/lib/isc/pk11.c b/lib/isc/pk11.c
-index bb9912b..1f583a3 100644
+index 7809e7b..c43357a 100644
 --- a/lib/isc/pk11.c
 +++ b/lib/isc/pk11.c
 @@ -321,14 +321,16 @@ pk11_rand_seed_fromfile(const char *randomfile) {
diff --git a/bind.spec b/bind.spec
index 367e679..1d349af 100644
--- a/bind.spec
+++ b/bind.spec
@@ -60,8 +60,8 @@
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.11.10
-Release:  3%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Version:  9.11.11
+Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1542,6 +1542,9 @@ fi;
 
 
 %changelog
+* Wed Sep 25 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.11-1
+- Update to 9.11.11
+
 * Wed Sep 04 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.10-3
 - Share pkcs11-utils and dnssec-utils manuals instead of recommend
 

From d0053ae5300d8c51d6c3bf81cf7393a4fba30acd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 21 Oct 2019 14:25:02 +0200
Subject: [PATCH 076/460] Update to 9.11.12 (#1557762)

---
 .gitignore | 1 +
 bind.spec  | 5 ++++-
 sources    | 2 +-
 3 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/.gitignore b/.gitignore
index d49dc25..f7c73a1 100644
--- a/.gitignore
+++ b/.gitignore
@@ -97,3 +97,4 @@ bind-9.7.2b1.tar.gz
 /bind-9.11.9.tar.gz
 /bind-9.11.10.tar.gz
 /bind-9.11.11.tar.gz
+/bind-9.11.12.tar.gz
diff --git a/bind.spec b/bind.spec
index 1d349af..152c5be 100644
--- a/bind.spec
+++ b/bind.spec
@@ -60,7 +60,7 @@
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.11.11
+Version:  9.11.12
 Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
@@ -1542,6 +1542,9 @@ fi;
 
 
 %changelog
+* Mon Oct 21 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.12-1
+- Update to 9.11.12 (#1557762)
+
 * Wed Sep 25 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.11-1
 - Update to 9.11.11
 
diff --git a/sources b/sources
index 31c6abf..592049d 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.11.11.tar.gz) = 52a3e94b686bb8a9c5ec327bb9a23c6f94762a9c6f2080bfe06feb07ec432ece5f6554bdd4f5e9f39cc77e7da4c8330449d89e3dc92716e133c5be41a867d7a0
+SHA512 (bind-9.11.12.tar.gz) = 7e2b9ef4ed5a00c2e5310c932c177887aed330d94eefc87d732dda010f2b71477e2f9d6ea89422ccbc8f6f04ceb83419b758218bcc02f25b34751bad974174e8
 SHA512 (config-19.tar.bz2) = 36aa38a0c7c33267ae594b31c81681290ac58dde7ca6749bd599da531380b5b1428330813dbe983e01071ccaed83e83f6a9cd92179a53b7d0ccbb6851a0b017c

From 176d144f325856f3edf3b27d6114fd81f330e7fa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 21 Oct 2019 14:40:42 +0200
Subject: [PATCH 077/460] Adjust patches to 9.11.12

Few changes occured, remove one upstream applied patch.
---
 bind-9.11-rh1647829.patch |  86 ----------------------
 bind-9.11-rt31459.patch   | 110 +++++++++++++--------------
 bind-9.11-rt46047.patch   | 151 ++++++++++++++++++++++----------------
 bind.spec                 |   3 -
 4 files changed, 141 insertions(+), 209 deletions(-)
 delete mode 100644 bind-9.11-rh1647829.patch

diff --git a/bind-9.11-rh1647829.patch b/bind-9.11-rh1647829.patch
deleted file mode 100644
index ceec7fc..0000000
--- a/bind-9.11-rh1647829.patch
+++ /dev/null
@@ -1,86 +0,0 @@
-From 2eca7f5fa97a24997e4d8f900460ba43ae167e97 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Tue, 29 Jan 2019 18:07:44 +0100
-Subject: [PATCH] Fallback to ASCII on output IDN conversion error
-
-It is possible dig used ACE encoded name in locale, which does not
-support converting it to unicode. Instead of fatal error, fallback to
-ACE name on output.
-
-(cherry picked from commit 7f4cb8f9584597fea16de6557124ac8b1bd47440)
-
-Modify idna test to fallback to ACE
-
-Test valid A-label on input would be displayed as A-label on output if
-locale does not allow U-label.
-
-(cherry picked from commit 4ce232f8605bdbe0594ebe5a71383c9d4e6f263b)
-
-Emit warning on IDN output failure
-
-Warning is emitted before any dig headers.
-
-(cherry picked from commit 4b410038c531fbb902cd5fb83174eed1f06cb7d7)
----
- bin/dig/dighost.c              | 15 +++++++++++++--
- bin/tests/system/idna/tests.sh | 17 +++++++++++++++++
- 2 files changed, 30 insertions(+), 2 deletions(-)
-
-diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
-index bb8702c..d7cfc33 100644
---- a/bin/dig/dighost.c
-+++ b/bin/dig/dighost.c
-@@ -4860,9 +4860,20 @@ idn_ace_to_locale(const char *from, char *to, size_t tolen) {
- 	 */
- 	res = idn2_to_unicode_8zlz(utf8_src, &tmp_str, 0);
- 	if (res != IDN2_OK) {
--		fatal("Cannot represent '%s' in the current locale (%s), "
--		      "use +noidnout or a different locale",
-+		static bool warned = false;
-+
-+		res = idn2_to_ascii_8z(utf8_src, &tmp_str, 0);
-+		if (res != IDN2_OK) {
-+			fatal("Cannot represent '%s' "
-+			      "in the current locale nor ascii (%s), "
-+			      "use +noidnout or a different locale",
- 		      from, idn2_strerror(res));
-+		} else if (!warned) {
-+			fprintf(stderr, ";; Warning: cannot represent '%s' "
-+			      "in the current locale",
-+			      tmp_str);
-+			warned = true;
-+		}
- 	}
- 
- 	/*
-diff --git a/bin/tests/system/idna/tests.sh b/bin/tests/system/idna/tests.sh
-index 6637bf6..215a9d5 100644
---- a/bin/tests/system/idna/tests.sh
-+++ b/bin/tests/system/idna/tests.sh
-@@ -244,6 +244,23 @@ idna_enabled_test() {
-     idna_test "$text" "+idnin +noidnout"   "xn--nxasmq6b.com" "xn--nxasmq6b.com."
-     idna_test "$text" "+idnin +idnout"     "xn--nxasmq6b.com" "βόλοσ.com."
- 
-+    # Test of valid A-label in locale that cannot display it
-+    #
-+    # +noidnout: The string is sent as-is to the server and the returned qname
-+    #            is displayed in the same form.
-+    # +idnout:   The string is sent as-is to the server and the returned qname
-+    #            is displayed as the corresponding A-label.
-+    #
-+    # The "+[no]idnout" flag has no effect in these cases.
-+    text="Checking valid A-label in C locale"
-+    label="xn--nxasmq6b.com"
-+    LC_ALL=C idna_test "$text" ""                   "$label" "$label."
-+    LC_ALL=C idna_test "$text" "+noidnin +noidnout" "$label" "$label."
-+    LC_ALL=C idna_test "$text" "+noidnin +idnout"   "$label" "$label."
-+    LC_ALL=C idna_test "$text" "+idnin +noidnout"   "$label" "$label."
-+    LC_ALL=C idna_test "$text" "+idnin +idnout"     "$label" "$label."
-+    LC_ALL=C idna_test "$text" "+noidnin +idnout"   "$label" "$label."
-+
- 
- 
-     # Tests of invalid A-labels
--- 
-2.20.1
-
diff --git a/bind-9.11-rt31459.patch b/bind-9.11-rt31459.patch
index 8413061..ea25abe 100644
--- a/bind-9.11-rt31459.patch
+++ b/bind-9.11-rt31459.patch
@@ -1,4 +1,4 @@
-From 108a0f57f423a27995ac96272832278f4aa3a612 Mon Sep 17 00:00:00 2001
+From 7e61714a5d1509ec79af42391e41eb1afc53063a Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Tue, 12 Sep 2017 19:05:46 -0700
 Subject: [PATCH] rebased rt31459c
@@ -71,7 +71,7 @@ index 5015abb..295e16f 100644
  							     &entropy_source,
  							     randomfile,
 diff --git a/bin/dnssec/dnssec-dsfromkey.c b/bin/dnssec/dnssec-dsfromkey.c
-index 060892b..c2cc9c7 100644
+index 2c0c308..3e585af 100644
 --- a/bin/dnssec/dnssec-dsfromkey.c
 +++ b/bin/dnssec/dnssec-dsfromkey.c
 @@ -494,14 +494,14 @@ main(int argc, char **argv) {
@@ -92,7 +92,7 @@ index 060892b..c2cc9c7 100644
  	isc_entropy_stopcallbacksources(ectx);
  
  	setup_logging(mctx, &log);
-@@ -563,8 +563,8 @@ main(int argc, char **argv) {
+@@ -571,8 +571,8 @@ main(int argc, char **argv) {
  	if (dns_rdataset_isassociated(&rdataset))
  		dns_rdataset_disassociate(&rdataset);
  	cleanup_logging(&log);
@@ -293,7 +293,7 @@ index fbc7ece..31a99e7 100644
  					   usekeyboard);
  
 diff --git a/bin/named/server.c b/bin/named/server.c
-index c917cad..436a93a 100644
+index 7d85d3b..c782073 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
 @@ -36,6 +36,7 @@
@@ -304,7 +304,7 @@ index c917cad..436a93a 100644
  #include <isc/portset.h>
  #include <isc/print.h>
  #include <isc/random.h>
-@@ -8209,6 +8210,10 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8211,6 +8212,10 @@ load_configuration(const char *filename, ns_server_t *server,
  				      "no source of entropy found");
  		} else {
  			const char *randomdev = cfg_obj_asstring(obj);
@@ -315,14 +315,14 @@ index c917cad..436a93a 100644
  			int level = ISC_LOG_ERROR;
  			result = isc_entropy_createfilesource(ns_g_entropy,
  							      randomdev);
-@@ -8243,6 +8248,7 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8245,6 +8250,7 @@ load_configuration(const char *filename, ns_server_t *server,
  				}
  				isc_entropy_detach(&ns_g_fallbackentropy);
  			}
 +#endif
  #endif
  		}
- 	}
+ 
 diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
 index bbb3936..0286987 100644
 --- a/bin/nsupdate/nsupdate.c
@@ -670,7 +670,7 @@ index 9f90dd7..fad6c83 100644
          echo "I:failed"
  	status=`expr $status + $ret`
 diff --git a/bin/tools/mdig.c b/bin/tools/mdig.c
-index 53579d4..e2f6810 100644
+index bf6dbb6..0416b21 100644
 --- a/bin/tools/mdig.c
 +++ b/bin/tools/mdig.c
 @@ -1972,12 +1972,11 @@ main(int argc, char *argv[]) {
@@ -688,7 +688,7 @@ index 53579d4..e2f6810 100644
  	parse_args(false, argc, argv);
  	if (server == NULL)
 diff --git a/configure b/configure
-index 2a4d9ed..e4e8ea6 100755
+index ed002e0..a578874 100755
 --- a/configure
 +++ b/configure
 @@ -640,6 +640,7 @@ ac_includes_default="\
@@ -699,7 +699,7 @@ index 2a4d9ed..e4e8ea6 100755
  BUILD_LIBS
  BUILD_LDFLAGS
  BUILD_CPPFLAGS
-@@ -823,6 +824,7 @@ XMLSTATS
+@@ -821,6 +822,7 @@ XMLSTATS
  NZDTARGETS
  NZDSRCS
  NZD_TOOLS
@@ -707,7 +707,7 @@ index 2a4d9ed..e4e8ea6 100755
  PKCS11_TEST
  PKCS11_ED25519
  PKCS11_GOST
-@@ -1047,6 +1049,7 @@ with_eddsa
+@@ -1045,6 +1047,7 @@ with_eddsa
  with_aes
  enable_openssl_hash
  with_cc_alg
@@ -715,7 +715,7 @@ index 2a4d9ed..e4e8ea6 100755
  with_lmdb
  with_libxml2
  with_libjson
-@@ -1746,6 +1749,7 @@ Optional Features:
+@@ -1744,6 +1747,7 @@ Optional Features:
    --enable-threads        enable multithreading
    --enable-native-pkcs11  use native PKCS11 for all crypto [default=no]
    --enable-openssl-hash   use OpenSSL for hash functions [default=no]
@@ -723,7 +723,7 @@ index 2a4d9ed..e4e8ea6 100755
    --enable-largefile      64-bit file support
    --enable-backtrace      log stack backtrace on abort [default=yes]
    --enable-symtable       use internal symbol table for backtrace
-@@ -17117,6 +17121,7 @@ case "$use_openssl" in
+@@ -17115,6 +17119,7 @@ case "$use_openssl" in
  $as_echo "disabled because of native PKCS11" >&6; }
  		DST_OPENSSL_INC=""
  		CRYPTO="-DPKCS11CRYPTO"
@@ -731,7 +731,7 @@ index 2a4d9ed..e4e8ea6 100755
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -17131,6 +17136,7 @@ $as_echo "disabled because of native PKCS11" >&6; }
+@@ -17129,6 +17134,7 @@ $as_echo "disabled because of native PKCS11" >&6; }
  $as_echo "no" >&6; }
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -739,7 +739,7 @@ index 2a4d9ed..e4e8ea6 100755
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -17143,6 +17149,7 @@ $as_echo "no" >&6; }
+@@ -17141,6 +17147,7 @@ $as_echo "no" >&6; }
  	auto)
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -747,7 +747,7 @@ index 2a4d9ed..e4e8ea6 100755
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -17152,7 +17159,7 @@ $as_echo "no" >&6; }
+@@ -17150,7 +17157,7 @@ $as_echo "no" >&6; }
  		OPENSSLLINKOBJS=""
  		OPENSSLLINKSRCS=""
  		as_fn_error $? "OpenSSL was not found in any of $openssldirs; use --with-openssl=/path
@@ -756,7 +756,7 @@ index 2a4d9ed..e4e8ea6 100755
  		;;
  	*)
  		if test "yes" = "$want_native_pkcs11"
-@@ -17183,6 +17190,7 @@ $as_echo "not found" >&6; }
+@@ -17181,6 +17188,7 @@ $as_echo "not found" >&6; }
  			as_fn_error $? "\"$use_openssl/include/openssl/opensslv.h\" not found" "$LINENO" 5
  		fi
  		CRYPTO='-DOPENSSL'
@@ -764,7 +764,7 @@ index 2a4d9ed..e4e8ea6 100755
  		if test "/usr" = "$use_openssl"
  		then
  			DST_OPENSSL_INC=""
-@@ -17808,8 +17816,6 @@ fi
+@@ -17806,8 +17814,6 @@ fi
  # Use OpenSSL for hash functions
  #
  
@@ -773,7 +773,7 @@ index 2a4d9ed..e4e8ea6 100755
  ISC_PLATFORM_OPENSSLHASH="#undef ISC_PLATFORM_OPENSSLHASH"
  case $want_openssl_hash in
  	yes)
-@@ -18184,6 +18190,86 @@ if test "rt" = "$have_clock_gt"; then
+@@ -18182,6 +18188,86 @@ if test "rt" = "$have_clock_gt"; then
  	LIBS="-lrt $LIBS"
  fi
  
@@ -860,7 +860,7 @@ index 2a4d9ed..e4e8ea6 100755
  #
  # was --with-lmdb specified?
  #
-@@ -20266,9 +20352,12 @@ _ACEOF
+@@ -20264,9 +20350,12 @@ _ACEOF
  if ac_fn_c_try_compile "$LINENO"; then :
    { $as_echo "$as_me:${as_lineno-$LINENO}: result: size_t for buflen; int for flags" >&5
  $as_echo "size_t for buflen; int for flags" >&6; }
@@ -875,7 +875,7 @@ index 2a4d9ed..e4e8ea6 100755
  
  	 $as_echo "#define IRS_GETNAMEINFO_FLAGS_T int" >>confdefs.h
  
-@@ -21583,12 +21672,7 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
+@@ -21581,12 +21670,7 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
  ISC_PLATFORM_USESTDASM="#undef ISC_PLATFORM_USESTDASM"
  ISC_PLATFORM_USEMACASM="#undef ISC_PLATFORM_USEMACASM"
  if test "yes" = "$use_atomic"; then
@@ -889,7 +889,7 @@ index 2a4d9ed..e4e8ea6 100755
  # version HP92453-01 B.11.11.23709.GP, which incorrectly rejects
  # declarations like `int a3[[(sizeof (unsigned char)) >= 0]];'.
  # This bug is HP SR number 8606223364.
-@@ -21621,6 +21705,11 @@ cat >>confdefs.h <<_ACEOF
+@@ -21619,6 +21703,11 @@ cat >>confdefs.h <<_ACEOF
  _ACEOF
  
  
@@ -901,7 +901,7 @@ index 2a4d9ed..e4e8ea6 100755
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -21629,39 +21718,6 @@ _ACEOF
+@@ -21627,39 +21716,6 @@ _ACEOF
  		fi
  	;;
  	x86_64-*|amd64-*)
@@ -941,7 +941,7 @@ index 2a4d9ed..e4e8ea6 100755
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -21692,6 +21748,10 @@ $as_echo_n "checking architecture type for atomic operations... " >&6; }
+@@ -21690,6 +21746,10 @@ $as_echo_n "checking architecture type for atomic operations... " >&6; }
  $as_echo "$arch" >&6; }
  fi
  
@@ -952,7 +952,7 @@ index 2a4d9ed..e4e8ea6 100755
  if test "yes" = "$have_atomic"; then
  	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking compiler support for inline assembly code" >&5
  $as_echo_n "checking compiler support for inline assembly code... " >&6; }
-@@ -24297,6 +24357,30 @@ CFLAGS="$CFLAGS $SO_CFLAGS"
+@@ -24244,6 +24304,30 @@ CFLAGS="$CFLAGS $SO_CFLAGS"
  #
  dlzdir='${DLZ_DRIVER_DIR}'
  
@@ -983,7 +983,7 @@ index 2a4d9ed..e4e8ea6 100755
  #
  # Private autoconf macro to simplify configuring drivers:
  #
-@@ -24627,11 +24711,11 @@ $as_echo "no" >&6; }
+@@ -24574,11 +24658,11 @@ $as_echo "no" >&6; }
  $as_echo "using mysql with libs ${mysql_lib} and includes ${mysql_include}" >&6; }
  		;;
  	*)
@@ -998,7 +998,7 @@ index 2a4d9ed..e4e8ea6 100755
  		fi
  
  	CONTRIB_DLZ="$CONTRIB_DLZ -DDLZ_MYSQL"
-@@ -24716,7 +24800,7 @@ $as_echo "" >&6; }
+@@ -24663,7 +24747,7 @@ $as_echo "" >&6; }
  			# Check other locations for includes.
  			# Order is important (sigh).
  
@@ -1007,7 +1007,7 @@ index 2a4d9ed..e4e8ea6 100755
  			# include a blank element first
  			for d in "" $bdb_incdirs
  			do
-@@ -24741,57 +24825,9 @@ $as_echo "" >&6; }
+@@ -24688,57 +24772,9 @@ $as_echo "" >&6; }
  			bdb_libnames="db53 db-5.3 db51 db-5.1 db48 db-4.8 db47 db-4.7 db46 db-4.6 db45 db-4.5 db44 db-4.4 db43 db-4.3 db42 db-4.2 db41 db-4.1 db"
  			for d in $bdb_libnames
  			do
@@ -1067,7 +1067,7 @@ index 2a4d9ed..e4e8ea6 100755
  					break
  				fi
  			done
-@@ -24950,10 +24986,10 @@ $as_echo "no" >&6; }
+@@ -24897,10 +24933,10 @@ $as_echo "no" >&6; }
  		DLZ_DRIVER_INCLUDES="$DLZ_DRIVER_INCLUDES -I$use_dlz_ldap/include"
  		DLZ_DRIVER_LDAP_INCLUDES="-I$use_dlz_ldap/include"
  	fi
@@ -1081,7 +1081,7 @@ index 2a4d9ed..e4e8ea6 100755
  	fi
  
  
-@@ -25039,11 +25075,11 @@ fi
+@@ -24986,11 +25022,11 @@ fi
  		odbcdirs="/usr /usr/local /usr/pkg"
  		for d in $odbcdirs
  		do
@@ -1095,7 +1095,7 @@ index 2a4d9ed..e4e8ea6 100755
  				break
  			fi
  		done
-@@ -25318,6 +25354,8 @@ DNS_CRYPTO_LIBS="$NEWFLAGS"
+@@ -25265,6 +25301,8 @@ DNS_CRYPTO_LIBS="$NEWFLAGS"
  
  
  
@@ -1104,7 +1104,7 @@ index 2a4d9ed..e4e8ea6 100755
  #
  # Commands to run at the end of config.status.
  # Don't just put these into configure, it won't work right if somebody
-@@ -27697,6 +27735,8 @@ report() {
+@@ -27644,6 +27682,8 @@ report() {
  	    echo "    IPv6 support (--enable-ipv6)"
  	test "X$CRYPTO" = "X" -o "yes" = "$want_native_pkcs11" || \
  		echo "    OpenSSL cryptography/DNSSEC (--with-openssl)"
@@ -1113,7 +1113,7 @@ index 2a4d9ed..e4e8ea6 100755
  	test "X$PYTHON" = "X" || echo "    Python tools (--with-python)"
  	test "X$XMLSTATS" = "X" || echo "    XML statistics (--with-libxml2)"
  	test "X$JSONSTATS" = "X" || echo "    JSON statistics (--with-libjson)"
-@@ -27737,6 +27777,8 @@ report() {
+@@ -27684,6 +27724,8 @@ report() {
  	echo "    Very verbose query trace logging (--enable-querytrace)"
      test "no" = "$with_cmocka" || echo "    CMocka Unit Testing Framework (--with-cmocka)"
  
@@ -1122,7 +1122,7 @@ index 2a4d9ed..e4e8ea6 100755
      echo "    Dynamically loadable zone (DLZ) drivers:"
      test "no" = "$use_dlz_bdb" || \
  	echo "        Berkeley DB (--with-dlz-bdb)"
-@@ -27784,6 +27826,8 @@ report() {
+@@ -27731,6 +27773,8 @@ report() {
  	echo "    ECDSA algorithm support (--with-ecdsa)"
      test "X$CRYPTO" = "X" -o "yes" = "$OPENSSL_ED25519" -o "yes" = "$PKCS11_ED25519" || \
  	echo "    EDDSA algorithm support (--with-eddsa)"
@@ -1132,7 +1132,7 @@ index 2a4d9ed..e4e8ea6 100755
      test "yes" = "$enable_seccomp" || \
  	echo "    Use libseccomp system call filtering (--enable-seccomp)"
 diff --git a/configure.ac b/configure.ac
-index 0e22d02..828581e 100644
+index 45a8126..bb1345b 100644
 --- a/configure.ac
 +++ b/configure.ac
 @@ -1537,6 +1537,7 @@ case "$use_openssl" in
@@ -1274,7 +1274,7 @@ index 0e22d02..828581e 100644
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -5534,6 +5597,8 @@ report() {
+@@ -5527,6 +5590,8 @@ report() {
  	    echo "    IPv6 support (--enable-ipv6)"
  	test "X$CRYPTO" = "X" -o "yes" = "$want_native_pkcs11" || \
  		echo "    OpenSSL cryptography/DNSSEC (--with-openssl)"
@@ -1283,7 +1283,7 @@ index 0e22d02..828581e 100644
  	test "X$PYTHON" = "X" || echo "    Python tools (--with-python)"
  	test "X$XMLSTATS" = "X" || echo "    XML statistics (--with-libxml2)"
  	test "X$JSONSTATS" = "X" || echo "    JSON statistics (--with-libjson)"
-@@ -5574,6 +5639,8 @@ report() {
+@@ -5567,6 +5632,8 @@ report() {
  	echo "    Very verbose query trace logging (--enable-querytrace)"
      test "no" = "$with_cmocka" || echo "    CMocka Unit Testing Framework (--with-cmocka)"
  
@@ -1292,7 +1292,7 @@ index 0e22d02..828581e 100644
      echo "    Dynamically loadable zone (DLZ) drivers:"
      test "no" = "$use_dlz_bdb" || \
  	echo "        Berkeley DB (--with-dlz-bdb)"
-@@ -5621,6 +5688,8 @@ report() {
+@@ -5614,6 +5681,8 @@ report() {
  	echo "    ECDSA algorithm support (--with-ecdsa)"
      test "X$CRYPTO" = "X" -o "yes" = "$OPENSSL_ED25519" -o "yes" = "$PKCS11_ED25519" || \
  	echo "    EDDSA algorithm support (--with-eddsa)"
@@ -1302,10 +1302,10 @@ index 0e22d02..828581e 100644
      test "yes" = "$enable_seccomp" || \
  	echo "    Use libseccomp system call filtering (--enable-seccomp)"
 diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c
-index 320c0f8..b55ebe0 100644
+index ec6e00e..1614afa 100644
 --- a/lib/dns/dst_api.c
 +++ b/lib/dns/dst_api.c
-@@ -276,6 +276,12 @@ dst_lib_init2(isc_mem_t *mctx, isc_entropy_t *ectx,
+@@ -277,6 +277,12 @@ dst_lib_init2(isc_mem_t *mctx, isc_entropy_t *ectx,
  #ifdef GSSAPI
  	RETERR(dst__gssapi_init(&dst_t_func[DST_ALG_GSSAPI]));
  #endif
@@ -1318,7 +1318,7 @@ index 320c0f8..b55ebe0 100644
  	dst_initialized = true;
  	return (ISC_R_SUCCESS);
  
-@@ -295,11 +301,19 @@ dst_lib_destroy(void) {
+@@ -296,11 +302,19 @@ dst_lib_destroy(void) {
  	for (i = 0; i < DST_MAX_ALGS; i++)
  		if (dst_t_func[i] != NULL && dst_t_func[i]->cleanup != NULL)
  			dst_t_func[i]->cleanup();
@@ -1338,7 +1338,7 @@ index 320c0f8..b55ebe0 100644
  	if (dst__memory_pool != NULL)
  		isc_mem_detach(&dst__memory_pool);
  	if (dst_entropy_pool != NULL)
-@@ -2001,13 +2015,17 @@ dst__entropy_getdata(void *buf, unsigned int len, bool pseudo) {
+@@ -2002,13 +2016,17 @@ dst__entropy_getdata(void *buf, unsigned int len, bool pseudo) {
  		flags &= ~ISC_ENTROPY_GOODONLY;
  	else
  		flags |= ISC_ENTROPY_BLOCKING;
@@ -1357,7 +1357,7 @@ index 320c0f8..b55ebe0 100644
  #ifdef GSSAPI
  	unsigned int flags = dst_entropy_flags;
  	isc_result_t ret;
-@@ -2030,6 +2048,7 @@ dst__entropy_status(void) {
+@@ -2031,6 +2049,7 @@ dst__entropy_status(void) {
  #endif
  	return (isc_entropy_status(dst_entropy_pool));
  #else
@@ -1973,7 +1973,7 @@ index 42ff7e0..8d87c44 100644
  typedef int (*isc_sockfdwatch_t)(isc_task_t *, isc_socket_t *, void *, int);
  
 diff --git a/lib/isc/pk11.c b/lib/isc/pk11.c
-index 7809e7b..c43357a 100644
+index 8e6ed93..ceb5a2c 100644
 --- a/lib/isc/pk11.c
 +++ b/lib/isc/pk11.c
 @@ -321,14 +321,16 @@ pk11_rand_seed_fromfile(const char *randomfile) {
@@ -2015,10 +2015,10 @@ index 5b8a2c9..913a2ce 100644
   * Define if the hash functions must be provided by OpenSSL.
   */
 diff --git a/win32utils/Configure b/win32utils/Configure
-index 6f93814..4286baf 100644
+index ccaf067..240fb80 100644
 --- a/win32utils/Configure
 +++ b/win32utils/Configure
-@@ -378,6 +378,7 @@ my @substdefh = ("ALLOW_FILTER_AAAA",
+@@ -382,6 +382,7 @@ my @substdefh = ("ALLOW_FILTER_AAAA",
  my %configdefp;
  
  my @substdefp = ("ISC_PLATFORM_BUSYWAITNOP",
@@ -2026,7 +2026,7 @@ index 6f93814..4286baf 100644
                   "ISC_PLATFORM_HAVEATOMICSTORE",
                   "ISC_PLATFORM_HAVEATOMICSTOREQ",
                   "ISC_PLATFORM_HAVECMPXCHG",
-@@ -508,7 +509,8 @@ my @allcond = (@substcond, "NOTYET", "NOLONGER");
+@@ -517,7 +518,8 @@ my @allcond = (@substcond, "NOTYET", "NOLONGER");
  
  # enable-xxx/disable-xxx
  
@@ -2036,7 +2036,7 @@ index 6f93814..4286baf 100644
                    "fixed-rrset",
                    "intrinsics",
                    "isc-spnego",
-@@ -572,6 +574,7 @@ my @help = (
+@@ -581,6 +583,7 @@ my @help = (
  "\nOptional Features:\n",
  "  enable-intrinsics     enable instrinsic/atomic functions [default=yes]\n",
  "  enable-native-pkcs11  use native PKCS#11 for all crypto [default=no]\n",
@@ -2044,7 +2044,7 @@ index 6f93814..4286baf 100644
  "  enable-openssl-hash   use OpenSSL for hash functions [default=yes]\n",
  "  enable-isc-spnego     use SPNEGO from lib/dns [default=yes]\n",
  "  enable-filter-aaaa    enable filtering of AAAA records [default=yes]\n",
-@@ -617,7 +620,9 @@ my $want_clean = "no";
+@@ -630,7 +633,9 @@ my $want_clean = "no";
  my $want_unknown = "no";
  my $unknown_value;
  my $enable_intrinsics = "yes";
@@ -2054,7 +2054,7 @@ index 6f93814..4286baf 100644
  my $enable_openssl_hash = "auto";
  my $enable_filter_aaaa = "yes";
  my $enable_isc_spnego = "yes";
-@@ -837,6 +842,10 @@ sub myenable {
+@@ -850,6 +855,10 @@ sub myenable {
          if ($val =~ /^yes$/i) {
              $enable_native_pkcs11 = "yes";
          }
@@ -2065,7 +2065,7 @@ index 6f93814..4286baf 100644
      } elsif ($key =~ /^openssl-hash$/i) {
          if ($val =~ /^yes$/i) {
              $enable_openssl_hash = "yes";
-@@ -1139,6 +1148,11 @@ if ($verbose) {
+@@ -1158,6 +1167,11 @@ if ($verbose) {
      } else {
          print "native-pkcs11: disabled\n";
      }
@@ -2077,7 +2077,7 @@ index 6f93814..4286baf 100644
      if ($enable_openssl_hash eq "yes") {
          print "openssl-hash: enabled\n";
      } else {
-@@ -1497,6 +1511,7 @@ if ($enable_intrinsics eq "yes") {
+@@ -1516,6 +1530,7 @@ if ($enable_intrinsics eq "yes") {
  
  # enable-native-pkcs11
  if ($enable_native_pkcs11 eq "yes") {
@@ -2085,7 +2085,7 @@ index 6f93814..4286baf 100644
      if ($use_openssl eq "auto") {
          $use_openssl = "no";
      }
-@@ -1706,6 +1721,7 @@ if ($use_openssl eq "yes") {
+@@ -1725,6 +1740,7 @@ if ($use_openssl eq "yes") {
          $openssl_dll = File::Spec->catdir($openssl_path, "@dirlist[0]");
      }   
  
@@ -2093,7 +2093,7 @@ index 6f93814..4286baf 100644
      $configcond{"OPENSSL"} = 1;
      $configdefd{"CRYPTO"} = "OPENSSL";
      $configvar{"OPENSSL_PATH"} = "$openssl_path";
-@@ -2242,6 +2258,15 @@ if ($use_aes eq "yes") {
+@@ -2296,6 +2312,15 @@ if ($use_aes eq "yes") {
  }
  
  
@@ -2109,7 +2109,7 @@ index 6f93814..4286baf 100644
  # enable-openssl-hash
  if ($enable_openssl_hash eq "yes") {
      if ($use_openssl eq "no") {
-@@ -3617,6 +3642,7 @@ exit 0;
+@@ -3671,6 +3696,7 @@ exit 0;
  #  --enable-developer partially supported
  #  --enable-newstats (9.9/9.9sub only)
  #  --enable-native-pkcs11 supported
diff --git a/bind-9.11-rt46047.patch b/bind-9.11-rt46047.patch
index 4f8181d..4bb47e8 100644
--- a/bind-9.11-rt46047.patch
+++ b/bind-9.11-rt46047.patch
@@ -1,4 +1,4 @@
-From ab9ee91f596c14cfc55a67ba3523b42a54e3e244 Mon Sep 17 00:00:00 2001
+From 4c7b644910e21e690e5f51d5596a9fe46d9c7b7a Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Thu, 28 Sep 2017 10:09:22 -0700
 Subject: [PATCH] completed and corrected the crypto-random change
@@ -39,14 +39,16 @@ Subject: [PATCH] completed and corrected the crypto-random change
  bin/tests/system/tkey/keycreate.c        |  4 +-
  bin/tests/system/tkey/keydelete.c        |  5 +--
  doc/arm/Bv9ARM-book.xml                  | 55 +++++++++++++++++-------
- doc/arm/notes.xml                        | 31 +++++++++++++
+ doc/arm/notes-rh-changes.xml             | 43 ++++++++++++++++++
+ doc/arm/notes.xml                        |  1 +
  lib/dns/dst_api.c                        |  4 +-
  lib/dns/include/dst/dst.h                | 14 +++++-
  lib/dns/openssl_link.c                   |  3 +-
  lib/isc/include/isc/entropy.h            | 50 +++++++++++++++------
  lib/isc/include/isc/random.h             | 28 +++++++-----
  lib/isccfg/namedconf.c                   |  2 +-
- 22 files changed, 228 insertions(+), 106 deletions(-)
+ 23 files changed, 241 insertions(+), 106 deletions(-)
+ create mode 100644 doc/arm/notes-rh-changes.xml
 
 diff --git a/bin/confgen/keygen.c b/bin/confgen/keygen.c
 index 295e16f..0f79aa8 100644
@@ -140,10 +142,10 @@ index 31a99e7..38c83ed 100644
  					   usekeyboard);
  
 diff --git a/bin/named/client.c b/bin/named/client.c
-index 29fecad..a12623a 100644
+index 2169954..c6c59f7 100644
 --- a/bin/named/client.c
 +++ b/bin/named/client.c
-@@ -1752,7 +1752,8 @@ ns_client_addopt(ns_client_t *client, dns_message_t *message,
+@@ -1754,7 +1754,8 @@ ns_client_addopt(ns_client_t *client, dns_message_t *message,
  
  		isc_buffer_init(&buf, cookie, sizeof(cookie));
  		isc_stdtime_get(&now);
@@ -154,10 +156,10 @@ index 29fecad..a12623a 100644
  		compute_cookie(client, now, nonce, ns_g_server->secret, &buf);
  
 diff --git a/bin/named/config.c b/bin/named/config.c
-index a153172..8d46bc3 100644
+index de64ca5..833c1dc 100644
 --- a/bin/named/config.c
 +++ b/bin/named/config.c
-@@ -93,7 +93,9 @@ options {\n\
+@@ -98,7 +98,9 @@ options {\n\
  #	pid-file \"" NS_LOCALSTATEDIR "/run/named/named.pid\"; /* or /lwresd.pid */\n\
  	port 53;\n\
  	prefetch 2 9;\n"
@@ -241,7 +243,7 @@ index f5ed2b7..b2c1d05 100644
  
  struct ns_altsecret {
 diff --git a/bin/named/interfacemgr.c b/bin/named/interfacemgr.c
-index 135533b..4546831 100644
+index 9bd1f93..851d3c9 100644
 --- a/bin/named/interfacemgr.c
 +++ b/bin/named/interfacemgr.c
 @@ -17,6 +17,7 @@
@@ -253,7 +255,7 @@ index 135533b..4546831 100644
  #include <isc/task.h>
  #include <isc/util.h>
 diff --git a/bin/named/query.c b/bin/named/query.c
-index f85cc76..43a3661 100644
+index 86417c7..55b7b7c 100644
 --- a/bin/named/query.c
 +++ b/bin/named/query.c
 @@ -19,6 +19,7 @@
@@ -265,10 +267,10 @@ index f85cc76..43a3661 100644
  #include <isc/serial.h>
  #include <isc/stats.h>
 diff --git a/bin/named/server.c b/bin/named/server.c
-index 405ff71..700f83d 100644
+index c782073..bc59cbc 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
-@@ -8203,21 +8203,32 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8204,21 +8204,32 @@ load_configuration(const char *filename, ns_server_t *server,
  	 * Open the source of entropy.
  	 */
  	if (first_time) {
@@ -310,7 +312,7 @@ index 405ff71..700f83d 100644
  #ifdef PATH_RANDOMDEV
  			if (ns_g_fallbackentropy != NULL) {
  				level = ISC_LOG_INFO;
-@@ -8228,8 +8239,8 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8229,8 +8240,8 @@ load_configuration(const char *filename, ns_server_t *server,
  					      NS_LOGCATEGORY_GENERAL,
  					      NS_LOGMODULE_SERVER,
  					      level,
@@ -321,15 +323,15 @@ index 405ff71..700f83d 100644
  					      randomdev,
  					      isc_result_totext(result));
  			}
-@@ -8249,7 +8260,6 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8250,7 +8261,6 @@ load_configuration(const char *filename, ns_server_t *server,
  				}
  				isc_entropy_detach(&ns_g_fallbackentropy);
  			}
 -#endif
  #endif
  		}
- 	}
-@@ -9014,6 +9024,7 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
+ 
+@@ -9018,6 +9028,7 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
  	server->in_roothints = NULL;
  	server->blackholeacl = NULL;
  	server->keepresporder = NULL;
@@ -337,7 +339,7 @@ index 405ff71..700f83d 100644
  
  	/* Must be first. */
  	CHECKFATAL(dst_lib_init2(ns_g_mctx, ns_g_entropy,
-@@ -9040,6 +9051,9 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
+@@ -9044,6 +9055,9 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
  	CHECKFATAL(dns_tkeyctx_create(ns_g_mctx, ns_g_entropy,
  				      &server->tkeyctx),
  		   "creating TKEY context");
@@ -347,7 +349,7 @@ index 405ff71..700f83d 100644
  
  	/*
  	 * Setup the server task, which is responsible for coordinating
-@@ -9246,7 +9260,8 @@ ns_server_destroy(ns_server_t **serverp) {
+@@ -9250,7 +9264,8 @@ ns_server_destroy(ns_server_t **serverp) {
  
  	if (server->zonemgr != NULL)
  		dns_zonemgr_detach(&server->zonemgr);
@@ -357,7 +359,7 @@ index 405ff71..700f83d 100644
  	if (server->tkeyctx != NULL)
  		dns_tkeyctx_destroy(&server->tkeyctx);
  
-@@ -13197,10 +13212,10 @@ newzone_cfgctx_destroy(void **cfgp) {
+@@ -13221,10 +13236,10 @@ newzone_cfgctx_destroy(void **cfgp) {
  
  static isc_result_t
  generate_salt(unsigned char *salt, size_t saltlen) {
@@ -370,7 +372,7 @@ index 405ff71..700f83d 100644
  	} rnd;
  	unsigned char text[512 + 1];
  	isc_region_t r;
-@@ -13210,9 +13225,10 @@ generate_salt(unsigned char *salt, size_t saltlen) {
+@@ -13234,9 +13249,10 @@ generate_salt(unsigned char *salt, size_t saltlen) {
  	if (saltlen > 256U)
  		return (ISC_R_RANGE);
  
@@ -400,10 +402,10 @@ index 0286987..0376377 100644
  	}
  #endif
 diff --git a/bin/tests/system/pipelined/pipequeries.c b/bin/tests/system/pipelined/pipequeries.c
-index 7b4f617..507bf0a 100644
+index f0a6ff2..55064f6 100644
 --- a/bin/tests/system/pipelined/pipequeries.c
 +++ b/bin/tests/system/pipelined/pipequeries.c
-@@ -282,9 +282,7 @@ main(int argc, char *argv[]) {
+@@ -280,9 +280,7 @@ main(int argc, char *argv[]) {
  	ectx = NULL;
  	RUNCHECK(isc_entropy_create(mctx, &ectx));
  #ifdef ISC_PLATFORM_CRYPTORANDOM
@@ -453,10 +455,10 @@ index 2146f9b..64b8e74 100644
  	}
  #endif
 diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
-index b40cb05..8a81438 100644
+index 9bf100f..c161e71 100644
 --- a/doc/arm/Bv9ARM-book.xml
 +++ b/doc/arm/Bv9ARM-book.xml
-@@ -5071,22 +5071,45 @@ badresp:1,adberr:0,findfail:0,valfail:0]
+@@ -5076,22 +5076,45 @@ badresp:1,adberr:0,findfail:0,valfail:0]
  	    <term><command>random-device</command></term>
  	    <listitem>
  	      <para>
@@ -518,53 +520,72 @@ index b40cb05..8a81438 100644
  	      </para>
  	    </listitem>
  	  </varlistentry>
+diff --git a/doc/arm/notes-rh-changes.xml b/doc/arm/notes-rh-changes.xml
+new file mode 100644
+index 0000000..11c3a7c
+--- /dev/null
++++ b/doc/arm/notes-rh-changes.xml
+@@ -0,0 +1,43 @@
++
++<!--
++ - Copyright (C) Internet Systems Consortium, Inc. ("ISC")
++ -
++ - This Source Code Form is subject to the terms of the Mozilla Public
++ - License, v. 2.0. If a copy of the MPL was not distributed with this
++ - file, You can obtain one at http://mozilla.org/MPL/2.0/.
++ -
++ - See the COPYRIGHT file distributed with this work for additional
++ - information regarding copyright ownership.
++-->
++
++<section xml:id="relnotes_rh_changes"><info><title>Red Hat Specific Changes</title></info>
++  <itemizedlist>
++     <listitem>
++      <para>
++        By default, BIND now uses the random number generation functions
++        in the cryptographic library (i.e., OpenSSL or a PKCS#11
++        provider) as a source of high-quality randomness rather than
++        <filename>/dev/random</filename>.  This is suitable for virtual
++        machine environments, which may have limited entropy pools and
++        lack hardware random number generators.
++      </para>
++      <para>
++        This can be overridden by specifying another entropy source via
++        the <command>random-device</command> option in
++        <filename>named.conf</filename>, or via the <command>-r</command>
++        command line option.  However, for functions requiring full
++        cryptographic strength, such as DNSSEC key generation, this
++        <emphasis>cannot</emphasis> be overridden. In particular, the
++        <command>-r</command> command line option no longer has any
++        effect on <command>dnssec-keygen</command>.
++      </para>
++      <para>
++        This can be disabled by building with
++        <command>configure --disable-crypto-rand</command>, in which
++        case <filename>/dev/random</filename> will be the default
++        entropy source.  [RT #31459] [RT #46047]
++      </para>
++    </listitem>
++  </itemizedlist>
++</section>
++
 diff --git a/doc/arm/notes.xml b/doc/arm/notes.xml
-index 00ce8f1..527135a 100644
+index 3a9cfcf..ded2000 100644
 --- a/doc/arm/notes.xml
 +++ b/doc/arm/notes.xml
-@@ -124,6 +124,37 @@
-     </itemizedlist>
-   </section>
- 
-+  <section xml:id="relnotes_rh_changes"><info><title>Red Hat Specific Changes</title></info>
-+    <itemizedlist>
-+       <listitem>
-+	<para>
-+	  By default, BIND now uses the random number generation functions
-+	  in the cryptographic library (i.e., OpenSSL or a PKCS#11
-+	  provider) as a source of high-quality randomness rather than
-+	  <filename>/dev/random</filename>.  This is suitable for virtual
-+	  machine environments, which may have limited entropy pools and
-+	  lack hardware random number generators.
-+	</para>
-+	<para>
-+	  This can be overridden by specifying another entropy source via
-+	  the <command>random-device</command> option in
-+	  <filename>named.conf</filename>, or via the <command>-r</command>
-+	  command line option.  However, for functions requiring full
-+	  cryptographic strength, such as DNSSEC key generation, this
-+	  <emphasis>cannot</emphasis> be overridden. In particular, the
-+	  <command>-r</command> command line option no longer has any
-+	  effect on <command>dnssec-keygen</command>.
-+	</para>
-+	<para>
-+	  This can be disabled by building with
-+	  <command>configure --disable-crypto-rand</command>, in which
-+	  case <filename>/dev/random</filename> will be the default
-+	  entropy source.  [RT #31459] [RT #46047]
-+	</para>
-+      </listitem>
-+    </itemizedlist>
-+  </section>
-+
-   <section xml:id="end_of_life"><info><title>End of Life</title></info>
-     <para>
-       BIND 9.11 (Extended Support Version) will be supported until at
+@@ -23,6 +23,7 @@
+   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-sec-fixes.xml"/>
+   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-new-features.xml"/>
+   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-bug-fixes.xml"/>
++  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-rh-changes.xml"/>
+   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-eol.xml"/>
+   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-thankyou.xml"/>
+ </section>
 diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c
-index b55ebe0..d2b43d3 100644
+index 1614afa..0f52df9 100644
 --- a/lib/dns/dst_api.c
 +++ b/lib/dns/dst_api.c
-@@ -2016,10 +2016,12 @@ dst__entropy_getdata(void *buf, unsigned int len, bool pseudo) {
+@@ -2017,10 +2017,12 @@ dst__entropy_getdata(void *buf, unsigned int len, bool pseudo) {
  	else
  		flags |= ISC_ENTROPY_BLOCKING;
  #ifdef ISC_PLATFORM_CRYPTORANDOM
@@ -761,7 +782,7 @@ index f8aed34..17c551b 100644
  
  ISC_LANG_ENDDECLS
 diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
-index fbc62cc..9cad61d 100644
+index 03890a3..7bad989 100644
 --- a/lib/isccfg/namedconf.c
 +++ b/lib/isccfg/namedconf.c
 @@ -1109,7 +1109,7 @@ options_clauses[] = {
diff --git a/bind.spec b/bind.spec
index 152c5be..f6abb42 100644
--- a/bind.spec
+++ b/bind.spec
@@ -141,8 +141,6 @@ Patch161:bind-9.11-host-idn-disable.patch
 Patch163:bind-9.11-rh1663318.patch
 # https://gitlab.isc.org/isc-projects/bind9/issues/819
 Patch164:bind-9.11-rh1666814.patch
-# https://bugzilla.redhat.com/show_bug.cgi?id=1647829
-Patch165:bind-9.11-rh1647829.patch
 # random_test fails too often by random, disable it
 Patch168:bind-9.11-unit-disable-random.patch
 Patch170:bind-9.11-feature-test-named.patch
@@ -534,7 +532,6 @@ are used for building ISC DHCP.
 %patch161 -p1 -b .host-idn-disable
 %patch163 -p1 -b .rh1663318
 %patch164 -p1 -b .rh1666814
-%patch165 -p1 -b .rh1647829
 %patch168 -p1 -b .random_test-disable
 %patch170 -p1 -b .featuretest-named
 %patch171 -p1 -b .test-variant

From 2129c87815116b7fd143bb3453392af588e297c8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 21 Oct 2019 15:44:10 +0200
Subject: [PATCH 078/460] fixup! Update to 9.11.12 (#1557762)

---
 bind-9.11.11.tar.gz.asc | 16 ----------------
 bind-9.11.12.tar.gz.asc | 16 ++++++++++++++++
 2 files changed, 16 insertions(+), 16 deletions(-)
 delete mode 100644 bind-9.11.11.tar.gz.asc
 create mode 100644 bind-9.11.12.tar.gz.asc

diff --git a/bind-9.11.11.tar.gz.asc b/bind-9.11.11.tar.gz.asc
deleted file mode 100644
index 1ad0c7b..0000000
--- a/bind-9.11.11.tar.gz.asc
+++ /dev/null
@@ -1,16 +0,0 @@
------BEGIN PGP SIGNATURE-----
-
-iQIzBAABAgAdFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAl16E/oACgkQdLtrmky7
-PTj5wQ//ZzItGqypNVGqYlocyQZRjvzjqJiPwIfgp7qpvDxQp7CPNuPqx35G0Xu6
-UJNKGZfJRKCoIrnN1QdBCXe+6ggl2O7iB3LJAeOiWz7oPj4DI2xTDu2oKKBkqLwF
-OimFr5B3F8wn59Bn2WgBpqjM3rv+kW2sQpahfBaYSYhqg0hmgOtn3Ksiopy+32l9
-0SNVhXtI+s1x2MCEdGweb24FJ663VC2rx5PJaD/59VPW3tXanemmTq6rLvdht+OE
-8zmTTQDPTu3CJFBnOwxBLvuvQDHvbVqiaU0o6nVHBow5D3FxL2R9ybNGBETY5af0
-7NqH9XEoeKFFRRdsEcTIRuLVQMdPl3dHWjCW0LeGjdOOwN5H8Yc1DGhfAaS3cD26
-d6L3cr6X9M7zTbKPTCYeNh/ydA3o4HRZV2LW3txac4qz2wxNaXytfsIGKb0Ag08U
-5MdGBdBbavDsX8aaRUHB0uiLL2U6rIm9dHeXWeed4B45YWMQ/kyEWqV5LYCHLq4F
-Hl2Tnjmp3YeE5qJHJtyXpOhhMYTVm6xACe72djyifxlJZlagBZihEc1D7xy/+Dmg
-JsBoA/X9C8RYGR/uAfxFiTQRNJtRdbPg168m/fV3cqo7m9mZGUdJOF51TSEOzfxx
-6RFuOl+R0YvyTtjBZaY2eeKRLdSc0uLHETRh+NmBHDx8bxSm8DM=
-=/ZDI
------END PGP SIGNATURE-----
diff --git a/bind-9.11.12.tar.gz.asc b/bind-9.11.12.tar.gz.asc
new file mode 100644
index 0000000..6d7992f
--- /dev/null
+++ b/bind-9.11.12.tar.gz.asc
@@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABAgAdFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAl2WMooACgkQdLtrmky7
+PThv2RAAnXNLYTzXtH6ls29tRm5Hc+D6UaeqcWDNQ4BpkRVhrFxtukalGCi9mmB6
+NPJzFyXmaOW654pypCIuEgqJNFUpDtLzLzT7SUF+mhm+5plsaRSBnh4mq87l5KSp
+twODAPnfCJV+HBk5RmToLEstAbGQ7xEBTyQtZoFkY+V7zEFwENKiCvWsoSWOkYR3
+zXo3sKjc83HV9ShbW/mCtbZf5L0qlbrKOAzqJfAFMhNNJi8kMbmr/Zi2sIfN+Rhv
+g8HQo89Epv6r51yAdeED8idIX4rKjjcEtHrZeDmLdCcdHgSEj2sIlH92Joce6vL0
+S59A0rItIXm6fW8sz6WNpcj4tVtWYbIYjXZ4SPFNkaUrHv8cUekq+5vbI+v07Gh3
+2bhtDsDyTY5I1/AsY/EFmwkCAjUS00jZryBnuJpLB3v5JtUog4ek32yLBzPrqRBo
+1876j4nlXAia8mG0OgJNWZ0gHyUPe/TgfR8fQDLmHxHHlKrJNTEwY6bLW8jzFTX1
+zk510fI1K7J9tiQgf5wcBQ2h3EBlqzDNIJDovoATzLYIf0HKyVegh/vnQdtdEhUR
+1DzJAt3bsBfAP1AFfWPD/ACu5Zdm7SxY1wE/pjkwttDU3sRZqOfuwNBGeolu3cVN
+O9/h1zsyVeVS0ui2vu4+V4EvNitmXsVbG2doDq9L5yBiIKGO2Ew=
+=GCy6
+-----END PGP SIGNATURE-----

From 86712fc834bd258c4a5866b92aee565a9ef11364 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 4 Nov 2019 19:56:54 +0100
Subject: [PATCH 079/460] Remove config archive with zone files

Few configuration and zone files were moved into tarball by commit
55b04de09a6. It makes tracking of changes difficult, hardens rebases,
makes difficult building without proper lookaside cache. Those files are
tiny, no need to hold them inside compressed binary archive. Move them
out.

Replaces also few places with proper directory macros.
---
 bind.spec           | 37 +++++++++++++++++++--------
 named.empty         | 18 +++++++------
 named.localhost     | 10 ++++++++
 named.loopback      | 11 ++++++++
 named.rfc1912.zones | 45 +++++++++++++++++++++++++++++++++
 named.root          | 61 +++++++++++++++++++++++++++++++++++++++++++++
 named.root.key      | 19 ++++++++++++++
 sources             |  1 -
 8 files changed, 182 insertions(+), 20 deletions(-)
 create mode 100644 named.localhost
 create mode 100644 named.loopback
 create mode 100644 named.rfc1912.zones
 create mode 100644 named.root
 create mode 100644 named.root.key

diff --git a/bind.spec b/bind.spec
index f6abb42..de7d7be 100644
--- a/bind.spec
+++ b/bind.spec
@@ -72,9 +72,16 @@ Source3:  named.logrotate
 Source7:  bind-9.3.1rc1-sdb_tools-Makefile.in
 Source8:  dnszone.schema
 Source12: README.sdb_pgsql
+Source16: named.conf
+# Refresh by command: dig @a.root-servers.net. +tcp +norec
+# or from URL
+Source17: https://www.internic.net/domain/named.root
+Source18: named.localhost
+Source19: named.loopback
+Source20: named.empty
+Source23: named.rfc1912.zones
 Source25: named.conf.sample
-Source26: named.conf
-Source28: config-19.tar.bz2
+Source27: named.root.key
 Source30: ldap2zone.c
 Source31: ldap2zone.1
 Source32: named-sdb.8
@@ -1016,20 +1023,28 @@ popd
 touch ${RPM_BUILD_ROOT}%{_localstatedir}/log/named.log
 
 # configuration files:
-tar -C ${RPM_BUILD_ROOT} -xjf %{SOURCE28}
-install -m 640 %{SOURCE26} ${RPM_BUILD_ROOT}/etc/named.conf
-touch ${RPM_BUILD_ROOT}/etc/rndc.key
-touch ${RPM_BUILD_ROOT}/etc/rndc.conf
-mkdir ${RPM_BUILD_ROOT}/etc/named
-install -m 644 %{SOURCE36} ${RPM_BUILD_ROOT}/etc/trusted-key.key
+install -m 640 %{SOURCE16} ${RPM_BUILD_ROOT}%{_sysconfdir}/named.conf
+touch ${RPM_BUILD_ROOT}%{_sysconfdir}/rndc.{key,conf}
+install -m 644 %{SOURCE27} ${RPM_BUILD_ROOT}%{_sysconfdir}/named.root.key
+install -m 644 %{SOURCE36} ${RPM_BUILD_ROOT}%{_sysconfdir}/trusted-key.key
+mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/named
+
+# data files:
+mkdir -p ${RPM_BUILD_ROOT}%{_localstatedir}/named
+install -m 640 %{SOURCE17} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.ca
+install -m 640 %{SOURCE18} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.localhost
+install -m 640 %{SOURCE19} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.loopback
+install -m 640 %{SOURCE20} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.empty
+install -m 640 %{SOURCE23} ${RPM_BUILD_ROOT}%{_sysconfdir}/named.rfc1912.zones
 
 # sample bind configuration files for %%doc:
 mkdir -p sample/etc sample/var/named/{data,slaves}
 install -m 644 %{SOURCE25} sample/etc/named.conf
 # Copy default configuration to %%doc to make it usable from system-config-bind
-install -m 644 %{SOURCE26} named.conf.default
-install -m 644 ${RPM_BUILD_ROOT}/etc/named.rfc1912.zones sample/etc/named.rfc1912.zones
-install -m 644 ${RPM_BUILD_ROOT}/var/named/{named.ca,named.localhost,named.loopback,named.empty}  sample/var/named
+install -m 644 %{SOURCE16} named.conf.default
+install -m 640 %{SOURCE23} sample/etc/named.rfc1912.zones
+install -m 644 %{SOURCE18} %{SOURCE19} %{SOURCE20}  sample/var/named
+install -m 644 %{SOURCE17} sample/var/named/named.ca
 for f in my.internal.zone.db slaves/my.slave.internal.zone.db slaves/my.ddns.internal.zone.db my.external.zone.db; do 
   echo '@ in soa localhost. root 1 3H 15M 1W 1D
   ns localhost.' > sample/var/named/$f; 
diff --git a/named.empty b/named.empty
index fa858eb..8e271e7 100644
--- a/named.empty
+++ b/named.empty
@@ -1,8 +1,10 @@
-$TTL 1D
-@	IN SOA	localhost. root.localhost. (
-						0	; serial
-						3H	; refresh
-						1H	; retry
-						1W	; expire
-						3H )	; minimum
-	IN	NS	localhost.
+$TTL 3H
+@	IN SOA	@ rname.invalid. (
+					0	; serial
+					1D	; refresh
+					1H	; retry
+					1W	; expire
+					3H )	; minimum
+	NS	@
+	A	127.0.0.1
+	AAAA	::1
diff --git a/named.localhost b/named.localhost
new file mode 100644
index 0000000..6fe6a52
--- /dev/null
+++ b/named.localhost
@@ -0,0 +1,10 @@
+$TTL 1D
+@	IN SOA	@ rname.invalid. (
+					0	; serial
+					1D	; refresh
+					1H	; retry
+					1W	; expire
+					3H )	; minimum
+	NS	@
+	A	127.0.0.1
+	AAAA	::1
diff --git a/named.loopback b/named.loopback
new file mode 100644
index 0000000..7f3d862
--- /dev/null
+++ b/named.loopback
@@ -0,0 +1,11 @@
+$TTL 1D
+@	IN SOA	@ rname.invalid. (
+					0	; serial
+					1D	; refresh
+					1H	; retry
+					1W	; expire
+					3H )	; minimum
+	NS	@
+	A	127.0.0.1
+	AAAA	::1
+	PTR	localhost.
diff --git a/named.rfc1912.zones b/named.rfc1912.zones
new file mode 100644
index 0000000..fa8caf5
--- /dev/null
+++ b/named.rfc1912.zones
@@ -0,0 +1,45 @@
+// named.rfc1912.zones:
+//
+// Provided by Red Hat caching-nameserver package 
+//
+// ISC BIND named zone configuration for zones recommended by
+// RFC 1912 section 4.1 : localhost TLDs and address zones
+// and https://tools.ietf.org/html/rfc6303
+// (c)2007 R W Franks
+// 
+// See /usr/share/doc/bind*/sample/ for example named configuration files.
+//
+// Note: empty-zones-enable yes; option is default.
+// If private ranges should be forwarded, add 
+// disable-empty-zone "."; into options
+// 
+
+zone "localhost.localdomain" IN {
+	type master;
+	file "named.localhost";
+	allow-update { none; };
+};
+
+zone "localhost" IN {
+	type master;
+	file "named.localhost";
+	allow-update { none; };
+};
+
+zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" IN {
+	type master;
+	file "named.loopback";
+	allow-update { none; };
+};
+
+zone "1.0.0.127.in-addr.arpa" IN {
+	type master;
+	file "named.loopback";
+	allow-update { none; };
+};
+
+zone "0.in-addr.arpa" IN {
+	type master;
+	file "named.empty";
+	allow-update { none; };
+};
diff --git a/named.root b/named.root
new file mode 100644
index 0000000..532d4ff
--- /dev/null
+++ b/named.root
@@ -0,0 +1,61 @@
+
+; <<>> DiG 9.11.3-RedHat-9.11.3-3.fc27 <<>> +bufsize=1200 +norec @a.root-servers.net
+; (2 servers found)
+;; global options: +cmd
+;; Got answer:
+;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 46900
+;; flags: qr aa; QUERY: 1, ANSWER: 13, AUTHORITY: 0, ADDITIONAL: 27
+
+;; OPT PSEUDOSECTION:
+; EDNS: version: 0, flags:; udp: 1472
+;; QUESTION SECTION:
+;.				IN	NS
+
+;; ANSWER SECTION:
+.			518400	IN	NS	a.root-servers.net.
+.			518400	IN	NS	b.root-servers.net.
+.			518400	IN	NS	c.root-servers.net.
+.			518400	IN	NS	d.root-servers.net.
+.			518400	IN	NS	e.root-servers.net.
+.			518400	IN	NS	f.root-servers.net.
+.			518400	IN	NS	g.root-servers.net.
+.			518400	IN	NS	h.root-servers.net.
+.			518400	IN	NS	i.root-servers.net.
+.			518400	IN	NS	j.root-servers.net.
+.			518400	IN	NS	k.root-servers.net.
+.			518400	IN	NS	l.root-servers.net.
+.			518400	IN	NS	m.root-servers.net.
+
+;; ADDITIONAL SECTION:
+a.root-servers.net.	518400	IN	A	198.41.0.4
+b.root-servers.net.	518400	IN	A	199.9.14.201
+c.root-servers.net.	518400	IN	A	192.33.4.12
+d.root-servers.net.	518400	IN	A	199.7.91.13
+e.root-servers.net.	518400	IN	A	192.203.230.10
+f.root-servers.net.	518400	IN	A	192.5.5.241
+g.root-servers.net.	518400	IN	A	192.112.36.4
+h.root-servers.net.	518400	IN	A	198.97.190.53
+i.root-servers.net.	518400	IN	A	192.36.148.17
+j.root-servers.net.	518400	IN	A	192.58.128.30
+k.root-servers.net.	518400	IN	A	193.0.14.129
+l.root-servers.net.	518400	IN	A	199.7.83.42
+m.root-servers.net.	518400	IN	A	202.12.27.33
+a.root-servers.net.	518400	IN	AAAA	2001:503:ba3e::2:30
+b.root-servers.net.	518400	IN	AAAA	2001:500:200::b
+c.root-servers.net.	518400	IN	AAAA	2001:500:2::c
+d.root-servers.net.	518400	IN	AAAA	2001:500:2d::d
+e.root-servers.net.	518400	IN	AAAA	2001:500:a8::e
+f.root-servers.net.	518400	IN	AAAA	2001:500:2f::f
+g.root-servers.net.	518400	IN	AAAA	2001:500:12::d0d
+h.root-servers.net.	518400	IN	AAAA	2001:500:1::53
+i.root-servers.net.	518400	IN	AAAA	2001:7fe::53
+j.root-servers.net.	518400	IN	AAAA	2001:503:c27::2:30
+k.root-servers.net.	518400	IN	AAAA	2001:7fd::1
+l.root-servers.net.	518400	IN	AAAA	2001:500:9f::42
+m.root-servers.net.	518400	IN	AAAA	2001:dc3::35
+
+;; Query time: 24 msec
+;; SERVER: 198.41.0.4#53(198.41.0.4)
+;; WHEN: Thu Apr 05 15:57:34 CEST 2018
+;; MSG SIZE  rcvd: 811
+
diff --git a/named.root.key b/named.root.key
new file mode 100644
index 0000000..48449a8
--- /dev/null
+++ b/named.root.key
@@ -0,0 +1,19 @@
+managed-keys {
+        # ROOT KEYS: See https://data.iana.org/root-anchors/root-anchors.xml
+        # for current trust anchor information.
+        #
+        # This key (20326) was published in the root zone in 2017.
+        # Servers which were already using the old key (19036) should
+        # roll seamlessly to this new one via RFC 5011 rollover. Servers
+        # being set up for the first time can use the contents of this
+        # file as initializing keys; thereafter, the keys in the
+        # managed key database will be trusted and maintained
+        # automatically.
+        . initial-key 257 3 8 "AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3
+                +/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kv
+                ArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF
+                0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+e
+                oZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfd
+                RUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwN
+                R1AkUTV74bU=";
+};
diff --git a/sources b/sources
index 592049d..29d4646 100644
--- a/sources
+++ b/sources
@@ -1,2 +1 @@
 SHA512 (bind-9.11.12.tar.gz) = 7e2b9ef4ed5a00c2e5310c932c177887aed330d94eefc87d732dda010f2b71477e2f9d6ea89422ccbc8f6f04ceb83419b758218bcc02f25b34751bad974174e8
-SHA512 (config-19.tar.bz2) = 36aa38a0c7c33267ae594b31c81681290ac58dde7ca6749bd599da531380b5b1428330813dbe983e01071ccaed83e83f6a9cd92179a53b7d0ccbb6851a0b017c

From ed8f6043d755985519d10426cad68387919d4179 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 4 Nov 2019 20:01:12 +0100
Subject: [PATCH 080/460] Bump version

---
 bind.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index de7d7be..cd6c127 100644
--- a/bind.spec
+++ b/bind.spec
@@ -61,7 +61,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.11.12
-Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1554,6 +1554,9 @@ fi;
 
 
 %changelog
+* Mon Nov 04 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.12-2
+- Move data files outside config archive
+
 * Mon Oct 21 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.12-1
 - Update to 9.11.12 (#1557762)
 

From 63bb1cf127932a63c2366057faaf9d813ffa1b33 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 4 Nov 2019 21:46:55 +0100
Subject: [PATCH 081/460] Add GeoIP configuration into config file

Upstream has wrong default path of GeoIP2. Use it explicitly.
---
 bind.spec  | 1 +
 named.conf | 1 +
 2 files changed, 2 insertions(+)

diff --git a/bind.spec b/bind.spec
index cd6c127..56f028c 100644
--- a/bind.spec
+++ b/bind.spec
@@ -1556,6 +1556,7 @@ fi;
 %changelog
 * Mon Nov 04 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.12-2
 - Move data files outside config archive
+- Specify geoip data directory in config file (#1768258)
 
 * Mon Oct 21 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.12-1
 - Update to 9.11.12 (#1557762)
diff --git a/named.conf b/named.conf
index 1dc9d15..cea9782 100644
--- a/named.conf
+++ b/named.conf
@@ -34,6 +34,7 @@ options {
 	dnssec-validation yes;
 
 	managed-keys-directory "/var/named/dynamic";
+	geoip-directory "/usr/share/GeoIP";
 
 	pid-file "/run/named/named.pid";
 	session-keyfile "/run/named/session.key";

From cba49a643a8f634bcc178ac6c343d3a3c2ac73c0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 5 Nov 2019 12:15:58 +0100
Subject: [PATCH 082/460] Improve SYSTEMTEST running on build time

Use parallel execution on test run. Support already configured
interfaces without special permissions on build. It can either use
already present addresses or configure it on build time. If it has no
rights to configure it, just skip the test and continue.
---
 bind.spec | 33 +++++++++++++++++++++------------
 1 file changed, 21 insertions(+), 12 deletions(-)

diff --git a/bind.spec b/bind.spec
index 56f028c..de42151 100644
--- a/bind.spec
+++ b/bind.spec
@@ -207,7 +207,9 @@ BuildRequires:  softhsm
 %endif
 %if %{with SYSTEMTEST}
 # bin/tests/system dependencies
-BuildRequires:  net-tools perl(Net::DNS) perl(Net::DNS::Nameserver)
+BuildRequires:  perl(Net::DNS) perl(Net::DNS::Nameserver) perl(Time::HiRes) perl(Getopt::Long)
+# manual configuration requires this tool
+BuildRequires:  iproute
 %endif
 %if %{with GSSTSIG}
 BuildRequires:  krb5-devel
@@ -843,25 +845,32 @@ sed -e "/^\s*include(/ d" -e 's/^-- use //' \
 %endif
 
 %if %{with SYSTEMTEST}
-if [ "`whoami`" = 'root' ]; then
+# Runs system test if ip addresses are already configured
+# or it is able to configure them
+if perl bin/tests/system/testsock.pl
+then
+	CONFIGURED=already
+else
+	CONFIGURED=
+	sh bin/tests/system/ifconfig.sh up
+	perl bin/tests/system/testsock.pl && CONFIGURED=build
+fi
+if [ -n "$CONFIGURED" ]
+then
   set -e
-  chmod -R a+rwX .
-  pushd bin/tests
-  pushd system
-  ./ifconfig.sh up
-  popd
-  make test
+  pushd build/bin/tests
+  chown -R ${USER} . # Can be unknown user
+  make test %{?_smp_mflags} 2>&1 | tee test.log
   e=$?
-  pushd system
-  ./ifconfig.sh down
-  popd
   popd
+  [ "$CONFIGURED" = build ] && sh bin/tests/system/ifconfig.sh down
   if [ "$e" -ne 0 ]; then
     echo "ERROR: this build of BIND failed 'make test'. Aborting."
     exit $e;
   fi;
 else
-  echo 'only root can run the tests (they require an ifconfig).'
+  echo 'SKIPPED: tests require root, CAP_NET_ADMIN or already configured test addresses.'
+fi
 %endif
 :
 

From be8074fddc6d2aaf82bbf093057b64cdbc0cf6e4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 6 Nov 2019 13:33:49 +0100
Subject: [PATCH 083/460] Update chroot test to check RPM verify

In bug #1592873, error on chroot was reported. Ensure it does not
reappear.
---
 tests/Master-server-chrooted/PURPOSE    | 3 +++
 tests/Master-server-chrooted/runtest.sh | 9 ++++++---
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/tests/Master-server-chrooted/PURPOSE b/tests/Master-server-chrooted/PURPOSE
index 1d01992..c5468a4 100644
--- a/tests/Master-server-chrooted/PURPOSE
+++ b/tests/Master-server-chrooted/PURPOSE
@@ -1,3 +1,6 @@
 PURPOSE of /CoreOS/tests/Sanity/Master-server-chrooted
 Description: Run basic empty named-chroot service and try to resolve localhost on it
 Author: Petr Mensik <pemensik@redhat.com>
+
+Check also clean package both when running and finished.
+https://bugzilla.redhat.com/show_bug.cgi?id=1592873
diff --git a/tests/Master-server-chrooted/runtest.sh b/tests/Master-server-chrooted/runtest.sh
index 9ab80d2..15ebc12 100755
--- a/tests/Master-server-chrooted/runtest.sh
+++ b/tests/Master-server-chrooted/runtest.sh
@@ -34,10 +34,13 @@ PACKAGE="bind"
 test_service()
 {
     local SERVICE="$1"
+    local PACKAGE="$2"
 	rlRun "rlServiceStart $SERVICE"
 	rlRun "dig @localhost localhost | grep '^localhost'"
 	rlRun "dig @localhost -x 127.0.0.1 | grep 'PTR[[:space:]]\+localhost.$'" 0 "Reverse address works"
+	rlRun "rpm -V $PACKAGE" 0 "Checking $SERVICE package when running"
 	rlRun "rlServiceRestore $SERVICE"
+	rlRun "rpm -V $PACKAGE" 0 "Checking $SERVICE package when stopped"
 }
 
 rlJournalStart
@@ -48,16 +51,16 @@ rlJournalStart
     rlPhaseEnd
 
     rlPhaseStartTest "Testing named"
-    	test_service named
+	test_service named bind
     rlPhaseEnd
 
     rlPhaseStartTest "Testing named-chroot"
-    	test_service named-chroot
+	test_service named-chroot bind-chroot
     rlPhaseEnd
 
     rlPhaseStartTest "Testing named-sdb-chroot"
 	    if rpm -q bind-sdb-chroot; then
-		test_service named-sdb-chroot
+		test_service named-sdb-chroot bind-sdb-chroot
 	    else
 		rlLog "bind-sdb-chroot not installed, skipping it"
 	    fi

From dff9083e8c9ae9aadbe80f903b342378e1b9eb09 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 6 Nov 2019 21:31:14 +0100
Subject: [PATCH 084/460] Fix wrong default GeoIP directory (#1768258)

---
 bind-9.11-rh1768258.patch | 28 ++++++++++++++++++++++++++++
 bind.spec                 |  7 ++++++-
 2 files changed, 34 insertions(+), 1 deletion(-)
 create mode 100644 bind-9.11-rh1768258.patch

diff --git a/bind-9.11-rh1768258.patch b/bind-9.11-rh1768258.patch
new file mode 100644
index 0000000..71cd57f
--- /dev/null
+++ b/bind-9.11-rh1768258.patch
@@ -0,0 +1,28 @@
+From 3466dfd7d44940821f195a36fceb0f1100f77c4e Mon Sep 17 00:00:00 2001
+From: Mark Andrews <marka@isc.org>
+Date: Tue, 5 Nov 2019 12:56:18 +1100
+Subject: [PATCH] The default geoip-directory should be
+ <MAXMINDDB_PREFIX>/share/GeoIP
+
+(cherry picked from commit fcd765a59db9b9a2b187448a90f3dbe6aa72fb84)
+(cherry picked from commit 7e79ebeebada6bcca81e8368eef72efbaae3c8c7)
+---
+ bin/named/config.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/bin/named/config.c b/bin/named/config.c
+index 833c1dc9d3..63da4b03f6 100644
+--- a/bin/named/config.c
++++ b/bin/named/config.c
+@@ -72,7 +72,7 @@ options {\n\
+ "	files unlimited;\n"
+ #endif
+ #if defined(HAVE_GEOIP2) && !defined(WIN32)
+-"	geoip-directory \"" MAXMINDDB_PREFIX "/share/GeoIP2\";\n"
++"	geoip-directory \"" MAXMINDDB_PREFIX "/share/GeoIP\";\n"
+ #elif defined(HAVE_GEOIP2)
+ "	geoip-directory \".\";\n"
+ #endif
+-- 
+2.20.1
+
diff --git a/bind.spec b/bind.spec
index de42151..df712b5 100644
--- a/bind.spec
+++ b/bind.spec
@@ -61,7 +61,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.11.12
-Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  3%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -157,6 +157,7 @@ Patch173:bind-9.11-rh1732883.patch
 # Make sure jsonccp-devel does not interfere
 Patch174:bind-9.11-json-c.patch
 Patch175:bind-9.11-fips-disable.patch
+Patch176: bind-9.11-rh1768258.patch
 
 # SDB patches
 Patch11: bind-9.3.2b2-sdbsrc.patch
@@ -548,6 +549,7 @@ are used for building ISC DHCP.
 %patch173 -p1 -b .rh1732883
 %patch174 -p1 -b .json-c
 %patch175 -p1 -b .rh1709553
+%patch176 -p1 -b .rh1768258
 
 mkdir lib/dns/tests/testdata/dstrandom
 cp -a %{SOURCE50} lib/dns/tests/testdata/dstrandom/random.data
@@ -1563,6 +1565,9 @@ fi;
 
 
 %changelog
+* Wed Nov 06 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.12-3
+- Fix wrong default GeoIP directory (#1768258)
+
 * Mon Nov 04 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.12-2
 - Move data files outside config archive
 - Specify geoip data directory in config file (#1768258)

From 854458469185074f261c9ca2b89f8ceaefb1d770 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 6 Nov 2019 21:46:21 +0100
Subject: [PATCH 085/460] Add serve-stale feature

Backported from 9.12 version, adds support for stale-answer-enable
option, as well stale-answer-ttl and max-stale-ttl.
---
 bind-9.11-serve-stale.patch | 3858 +++++++++++++++++++++++++++++++++++
 bind.spec                   |    7 +-
 2 files changed, 3864 insertions(+), 1 deletion(-)
 create mode 100644 bind-9.11-serve-stale.patch

diff --git a/bind-9.11-serve-stale.patch b/bind-9.11-serve-stale.patch
new file mode 100644
index 0000000..ed03636
--- /dev/null
+++ b/bind-9.11-serve-stale.patch
@@ -0,0 +1,3858 @@
+From 1196b07e79e1d8d23afd1003a7a242ac06a2f2a2 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
+Date: Thu, 7 Nov 2019 14:31:03 +0100
+Subject: [PATCH] Implement serve-stale in 9.11
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Squashed commit of the following:
+
+commit 32f47f36e545223b2a4757588d7bd4af8c5f5760
+Author: Petr Menšík <pemensik@redhat.com>
+Date:   Tue Sep 3 18:45:54 2019 +0200
+
+    convert serve_stale to db_test
+
+    Manual checkout from commit e8f61dd315c5d1c88915bb79361182241e42e47a.
+    Use test modified for cmocka, including serve-stale tests.
+
+commit 071eb1fb0786f6d614955813d99c3caabff33383
+Author: Michał Kępień <michal@isc.org>
+Date:   Fri Apr 27 09:13:26 2018 +0200
+
+    Detect recursion loops during query processing
+
+    Interrupt query processing when query_recurse() attempts to ask the same
+    name servers for the same QNAME/QTYPE tuple for two times in a row as
+    this indicates that query processing may be stuck for an indeterminate
+    period of time, e.g. due to interactions between features able to
+    restart query_lookup().
+
+    (cherry picked from commit 46bb4dd124ed031d4c219d1e37a3c6322092e30c)
+
+commit c12090bc361c7fa4522ace73899e778e44e9b295
+Author: Petr Menšík <pemensik@redhat.com>
+Date:   Mon Sep 2 11:12:32 2019 +0200
+
+    Fix test name used in whole test-suite
+
+    Correct name is serve-stale
+
+commit ff4d826f295d268a248ca06941d65c903e1b405c
+Author: Petr Menšík <pemensik@redhat.com>
+Date:   Fri Aug 30 17:43:28 2019 +0200
+
+    Clean files in more generic rules
+
+commit 8d81ed15eda9a2a11e1433d1fdddacfc772708b6
+Author: Petr Menšík <pemensik@redhat.com>
+Date:   Thu Aug 29 21:27:57 2019 +0200
+
+    [rt46602] Pass port numbers to tests via environment variables
+
+    Manually applied commit f5d8f079008b648d2e343543e66dd728054c6101
+
+commit 94fafa477891576286def8c4041ad127734af2d1
+Author: Tony Finch <dot@dotat.at>
+Date:   Tue Apr 10 16:17:57 2018 +0100
+
+    Move serve-stale logging to its own category, so that its verbosity can be curtailed.
+
+    (cherry picked from commit 4b442c309dfb2c8880b19af4133047655bb734df)
+
+commit e0c884bee98c3d2533dfaa667f58c6a80d8a3a00
+Author: Michał Kępień <michal@isc.org>
+Date:   Fri Apr 27 09:13:26 2018 +0200
+
+    Prevent check_stale_header() from leaking rdataset headers
+
+    check_stale_header() fails to update the pointer to the previous header
+    while processing rdataset headers eligible for serve-stale, thus
+    enabling rdataset headers to be leaked (i.e. disassociated from a node
+    and left on the relevant TTL heap) while iterating through a node.  This
+    can lead to several different assertion failures.  Add the missing
+    pointer update.
+
+    (cherry picked from commit 391fac1fc8d2e470287b5cc4344b3adb90c6f54a)
+
+commit d724cc1d80ee8d46113eaf82549d49636739b67c
+Author: Matthijs Mekking <matthijs@isc.org>
+Date:   Thu Jan 24 10:24:44 2019 +0100
+
+    Print in dump-file stale ttl
+
+    This change makes rndc dumpdb correctly print the "; stale" line.
+    It also provides extra information on how long this data may still
+    be served to clients (in other words how long the stale RRset may
+    still be used).
+
+    (cherry picked from commit 924ebc605db798e2a383ee5eaaebad739e7c789c)
+
+commit 625da4bd4590ac6108bb30eddd23ceffb245ae49
+Author: Michał Kępień <michal@isc.org>
+Date:   Mon Oct 22 15:26:45 2018 +0200
+
+    Check serve-stale behavior with a cold cache
+
+    Ensure that serve-stale works as expected when returning stale answers
+    is enabled, the authoritative server does not respond, and there is no
+    cached answer available.
+
+    (cherry picked from commit 27cfe83a388147edfa0451b28c06c746912ea684)
+
+commit d67ae10461c409fdafdbbe64f857db2552b71059
+Author: Michał Kępień <michal@isc.org>
+Date:   Mon Oct 22 15:26:45 2018 +0200
+
+    Check TTL of stale answers
+
+    Make sure that stale answers returned when the serve-stale feature is
+    enabled have a TTL matching the value of the stale-answer-ttl setting.
+
+    (cherry picked from commit 893ab37ce78c658215bd3a019f25afe795b37d5a)
+
+commit 50459107805e68e4a63a8e497bf58ef3ce013ddb
+Author: Michał Kępień <michal@isc.org>
+Date:   Mon Jul 9 14:35:12 2018 +0200
+
+    Do not use Net::DNS::Nameserver in the "serve-stale" system test
+
+    Net::DNS versions older than 0.67 respond to queries sent to a
+    Net::DNS::Nameserver even if its ReplyHandler returns undef.  This makes
+    the "serve-stale" system test fail as it takes advantage of the newer
+    behavior.  Since the latest Net::DNS version available with stock
+    RHEL/CentOS 6 packages is 0.65 and we officially support that operating
+    system, bin/tests/system/serve-stale/ans2/ans.pl should behave
+    consistently for various Net::DNS versions.  Ensure that by reworking it
+    so that it does not use Net::DNS::Nameserver.
+
+    (cherry picked from commit c4209418a50c09142375f7edadca731c526f3d3a)
+
+commit 4b5befc714bb386bd245b1c14ce3bce5ae6fb5fa
+Author: Petr Menšík <pemensik@redhat.com>
+Date:   Tue Jun 5 21:38:29 2018 +0200
+
+    Fix server-stale requirement, skip without Time::HiRes
+
+    (cherry picked from commit 7a0c7bf9c8e6a724e52635eed213ad25b9504e66)
+
+commit 5ce51a3a7e5ef3087c4d022e3fca42fb2fd0c996
+Author: Ondřej Surý <ondrej@sury.org>
+Date:   Wed Oct 18 13:01:14 2017 +0200
+
+    [rt46602] Update server-stale test to run on port passed from run.sh script
+
+    (cherry picked from commit f83ebd34b9555a5a834c58146035173bcbd01dda)
+
+commit 3954a9bf3437f6fab050294a7f2f954a23d161ec
+Author: Ondřej Surý <ondrej@sury.org>
+Date:   Wed Oct 18 14:18:59 2017 +0200
+
+    [rt46602] Add serve-stale working files to .gitignore
+
+    (cherry picked from commit cba162e70e7fac43435a606106841a69ce468526)
+
+commit 112aa21f5fa875494820e4d1eb70e41e10e1aae7
+Author: Mark Andrews <marka@isc.org>
+Date:   Thu Oct 12 15:33:47 2017 +1100
+
+    test for Net::DNS::Nameserver
+
+    (cherry picked from commit 5b60d0608ac2852753180b762d1917163f9dc315)
+
+commit 9d610e46af8a636f44914cee4cf8b2016054db1e
+Author: Mark Andrews <marka@isc.org>
+Date:   Thu Oct 12 15:19:45 2017 +1100
+
+    add Net::DNS prerequiste test
+
+    (cherry picked from commit fa644181f51559da3e3913acd72dbc3f6d916e71)
+
+commit e4ea7ba88d9a9a0c79579400c68a5dabe03e8572
+Author: Mark Andrews <marka@isc.org>
+Date:   Wed Sep 6 19:26:10 2017 +1000
+
+    add quotes arount $send_response
+
+    (cherry picked from commit 023ab19634b287543169e9b7b5259f3126cd60ff)
+
+commit 0af0c5d33c2de34da164571288b650282c6be10a
+Author: Mark Andrews <marka@isc.org>
+Date:   Thu Nov 23 16:11:49 2017 +1100
+
+    initalise serve_stale_ttl
+
+    (cherry picked from commit 2f4e0e5a81278f59037bf06ae99ff52245cd57e9)
+
+commit fbadd90ee81863d617c4c319d5f0079b877fe102
+Author: Evan Hunt <each@isc.org>
+Date:   Thu Sep 14 11:48:21 2017 -0700
+
+    [master] add thanks to APNIC and add missing note for serve-stale
+
+commit deb8adaa59955970b9d2f2fe58060a3cbf08312b
+Author: Mark Andrews <marka@isc.org>
+Date:   Wed Sep 6 12:16:10 2017 +1000
+
+    silence 'staleanswersok' may be used uninitialized in this function warning. [RT #14147
+
+commit 0e2d03823768dc545015e6ce309777210f4a9f85
+Author: Petr Menšík <pemensik@redhat.com>
+Date:   Thu Aug 29 19:57:58 2019 +0200
+
+    More fixes to merge
+
+commit 360e25ffe7623ea0a2eec49395001f4940967776
+Author: Mark Andrews <marka@isc.org>
+Date:   Wed Sep 6 09:58:29 2017 +1000
+
+    4700.   [func]          Serving of stale answers is now supported. This
+                            allows named to provide stale cached answers when
+                            the authoritative server is under attack.
+                            See max-stale-ttl, stale-answer-enable,
+                            stale-answer-ttl. [RT #44790]
+
+Signed-off-by: Petr Menšík <pemensik@redhat.com>
+---
+ bin/named/config.c                            |   9 +-
+ bin/named/control.c                           |   2 +
+ bin/named/include/named/control.h             |   1 +
+ bin/named/include/named/log.h                 |   1 +
+ bin/named/include/named/query.h               |  15 +
+ bin/named/include/named/server.h              |  13 +-
+ bin/named/log.c                               |   1 +
+ bin/named/query.c                             | 164 +++++-
+ bin/named/server.c                            | 177 +++++-
+ bin/named/statschannel.c                      |   6 +
+ bin/rndc/rndc.c                               |   2 +
+ bin/rndc/rndc.docbook                         |  19 +
+ bin/tests/system/chain/prereq.sh              |   7 +
+ bin/tests/system/conf.sh.in                   |   2 +-
+ bin/tests/system/dyndb/driver/db.c            |   2 +
+ bin/tests/system/serve-stale/.gitignore       |  11 +
+ bin/tests/system/serve-stale/ans2/ans.pl.in   | 178 ++++++
+ bin/tests/system/serve-stale/clean.sh         |  15 +
+ .../system/serve-stale/ns1/named1.conf.in     |  35 ++
+ .../system/serve-stale/ns1/named2.conf.in     |  35 ++
+ bin/tests/system/serve-stale/ns1/root.db      |   5 +
+ .../system/serve-stale/ns3/named.conf.in      |  35 ++
+ bin/tests/system/serve-stale/prereq.sh        |  38 ++
+ bin/tests/system/serve-stale/setup.sh         |  13 +
+ bin/tests/system/serve-stale/tests.sh         | 536 ++++++++++++++++++
+ doc/arm/Bv9ARM-book.xml                       |  69 ++-
+ doc/arm/logging-categories.xml                |  11 +
+ doc/arm/notes-rh-changes.xml                  |  14 +-
+ doc/misc/options                              |  10 +
+ lib/bind9/check.c                             |  78 ++-
+ lib/dns/cache.c                               |  38 +-
+ lib/dns/db.c                                  |  22 +
+ lib/dns/ecdb.c                                |   4 +-
+ lib/dns/include/dns/cache.h                   |  21 +
+ lib/dns/include/dns/db.h                      |  35 ++
+ lib/dns/include/dns/rdataset.h                |  11 +
+ lib/dns/include/dns/resolver.h                |  43 +-
+ lib/dns/include/dns/types.h                   |   6 +
+ lib/dns/include/dns/view.h                    |   3 +
+ lib/dns/master.c                              |  14 +-
+ lib/dns/masterdump.c                          |  23 +
+ lib/dns/rbtdb.c                               | 207 ++++++-
+ lib/dns/resolver.c                            |  78 ++-
+ lib/dns/sdb.c                                 |   4 +-
+ lib/dns/sdlz.c                                |   4 +-
+ lib/dns/tests/db_test.c                       | 198 ++++++-
+ lib/dns/view.c                                |   3 +
+ lib/isccfg/namedconf.c                        |   5 +
+ 48 files changed, 2121 insertions(+), 102 deletions(-)
+ create mode 100644 bin/tests/system/serve-stale/.gitignore
+ create mode 100644 bin/tests/system/serve-stale/ans2/ans.pl.in
+ create mode 100644 bin/tests/system/serve-stale/clean.sh
+ create mode 100644 bin/tests/system/serve-stale/ns1/named1.conf.in
+ create mode 100644 bin/tests/system/serve-stale/ns1/named2.conf.in
+ create mode 100644 bin/tests/system/serve-stale/ns1/root.db
+ create mode 100644 bin/tests/system/serve-stale/ns3/named.conf.in
+ create mode 100644 bin/tests/system/serve-stale/prereq.sh
+ create mode 100644 bin/tests/system/serve-stale/setup.sh
+ create mode 100755 bin/tests/system/serve-stale/tests.sh
+
+diff --git a/bin/named/config.c b/bin/named/config.c
+index 63da4b03f6..b598f9bfe3 100644
+--- a/bin/named/config.c
++++ b/bin/named/config.c
+@@ -182,13 +182,14 @@ options {\n\
+ #ifdef HAVE_LMDB
+ "	lmdb-mapsize 32M;\n"
+ #endif
+-"	max-acache-size 16M;\n\
+-	max-cache-size 90%;\n\
++"	max-cache-size 90%;\n\
++	max-acache-size 16M;\n\
+ 	max-cache-ttl 604800; /* 1 week */\n\
+ 	max-clients-per-query 100;\n\
+ 	max-ncache-ttl 10800; /* 3 hours */\n\
+ 	max-recursion-depth 7;\n\
+ 	max-recursion-queries 75;\n\
++	max-stale-ttl 604800; /* 1 week */\n\
+ 	message-compression yes;\n\
+ #	min-roots <obsolete>;\n\
+ 	minimal-any false;\n\
+@@ -203,10 +204,14 @@ options {\n\
+ 	request-expire true;\n\
+ 	request-ixfr true;\n\
+ 	require-server-cookie no;\n\
++	resolver-nonbackoff-tries 3;\n\
++	resolver-retry-interval 800; /* in milliseconds */\n\
+ #	rfc2308-type1 <obsolete>;\n\
+ 	root-key-sentinel yes;\n\
+ 	servfail-ttl 1;\n\
+ #	sortlist <none>\n\
++	stale-answer-enable false;\n\
++	stale-answer-ttl 1; /* 1 second */\n\
+ #	topology <none>\n\
+ 	transfer-format many-answers;\n\
+ 	v6-bias 50;\n\
+diff --git a/bin/named/control.c b/bin/named/control.c
+index df23c26507..8b79850b3d 100644
+--- a/bin/named/control.c
++++ b/bin/named/control.c
+@@ -282,6 +282,8 @@ ns_control_docommand(isccc_sexpr_t *message, bool readonly,
+ 		result = ns_server_validation(ns_g_server, lex, text);
+ 	} else if (command_compare(command, NS_COMMAND_ZONESTATUS)) {
+ 		result = ns_server_zonestatus(ns_g_server, lex, text);
++	} else if (command_compare(command, NS_COMMAND_SERVESTALE)) {
++		result = ns_server_servestale(ns_g_server, lex, text);
+ 	} else {
+ 		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
+ 			      NS_LOGMODULE_CONTROL, ISC_LOG_WARNING,
+diff --git a/bin/named/include/named/control.h b/bin/named/include/named/control.h
+index 8705fdd68a..1634154c1c 100644
+--- a/bin/named/include/named/control.h
++++ b/bin/named/include/named/control.h
+@@ -69,6 +69,7 @@
+ #define NS_COMMAND_MKEYS	"managed-keys"
+ #define NS_COMMAND_DNSTAPREOPEN	"dnstap-reopen"
+ #define NS_COMMAND_DNSTAP	"dnstap"
++#define NS_COMMAND_SERVESTALE	"serve-stale"
+ 
+ isc_result_t
+ ns_controls_create(ns_server_t *server, ns_controls_t **ctrlsp);
+diff --git a/bin/named/include/named/log.h b/bin/named/include/named/log.h
+index 56bfcd4668..cd8db60ed4 100644
+--- a/bin/named/include/named/log.h
++++ b/bin/named/include/named/log.h
+@@ -32,6 +32,7 @@
+ #define NS_LOGCATEGORY_UPDATE_SECURITY	(&ns_g_categories[6])
+ #define NS_LOGCATEGORY_QUERY_ERRORS	(&ns_g_categories[7])
+ #define NS_LOGCATEGORY_TAT		(&ns_g_categories[8])
++#define NS_LOGCATEGORY_SERVE_STALE	(&ns_g_categories[9])
+ 
+ /*
+  * Backwards compatibility.
+diff --git a/bin/named/include/named/query.h b/bin/named/include/named/query.h
+index 9661f56b72..445b578c08 100644
+--- a/bin/named/include/named/query.h
++++ b/bin/named/include/named/query.h
+@@ -35,6 +35,18 @@ typedef struct ns_dbversion {
+ 	ISC_LINK(struct ns_dbversion)	link;
+ } ns_dbversion_t;
+ 
++/*%
++ * nameserver recursion parameters, to uniquely identify a recursion
++ * query; this is used to detect a recursion loop
++ */
++typedef struct ns_query_recparam {
++	dns_rdatatype_t			qtype;
++	dns_name_t *			qname;
++	dns_fixedname_t			fqname;
++	dns_name_t *			qdomain;
++	dns_fixedname_t			fqdomain;
++} ns_query_recparam_t;
++
+ /*% nameserver query structure */
+ struct ns_query {
+ 	unsigned int			attributes;
+@@ -63,6 +75,7 @@ struct ns_query {
+ 	unsigned int			dns64_aaaaoklen;
+ 	unsigned int			dns64_options;
+ 	unsigned int			dns64_ttl;
++
+ 	struct {
+ 		dns_db_t *      	db;
+ 		dns_zone_t *      	zone;
+@@ -76,6 +89,8 @@ struct ns_query {
+ 		bool		authoritative;
+ 		bool		is_zone;
+ 	} redirect;
++
++	ns_query_recparam_t		recparam;
+ 	dns_keytag_t root_key_sentinel_keyid;
+ 	bool root_key_sentinel_is_ta;
+ 	bool root_key_sentinel_not_ta;
+diff --git a/bin/named/include/named/server.h b/bin/named/include/named/server.h
+index b2c1d05497..86f0b2bfb7 100644
+--- a/bin/named/include/named/server.h
++++ b/bin/named/include/named/server.h
+@@ -222,7 +222,10 @@ enum {
+ 
+ 	dns_nsstatscounter_keytagopt = 56,
+ 
+-	dns_nsstatscounter_max = 57
++	dns_nsstatscounter_trystale = 57,
++	dns_nsstatscounter_usedstale = 58,
++
++	dns_nsstatscounter_max = 59
+ };
+ 
+ /*%
+@@ -761,4 +764,12 @@ ns_server_mkeys(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text);
+ isc_result_t
+ ns_server_dnstap(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text);
+ 
++
++/*%
++ * Control whether stale answers are served or not when configured in
++ * named.conf.
++ */
++isc_result_t
++ns_server_servestale(ns_server_t *server, isc_lex_t *lex,
++		     isc_buffer_t **text);
+ #endif /* NAMED_SERVER_H */
+diff --git a/bin/named/log.c b/bin/named/log.c
+index 3aa25e9a95..12f178b342 100644
+--- a/bin/named/log.c
++++ b/bin/named/log.c
+@@ -38,6 +38,7 @@ static isc_logcategory_t categories[] = {
+ 	{ "update-security",		0 },
+ 	{ "query-errors",		0 },
+ 	{ "trust-anchor-telemetry",	0 },
++	{ "serve-stale",                0 },
+ 	{ NULL, 			0 }
+ };
+ 
+diff --git a/bin/named/query.c b/bin/named/query.c
+index 55b7b7cbde..f872dfc842 100644
+--- a/bin/named/query.c
++++ b/bin/named/query.c
+@@ -125,10 +125,14 @@
+ #define REDIRECT(c)		(((c)->query.attributes & \
+ 				  NS_QUERYATTR_REDIRECT) != 0)
+ 
+-/*% No QNAME Proof? */
++/*% Does the rdataset 'r' have an attached 'No QNAME Proof'? */
+ #define NOQNAME(r)		(((r)->attributes & \
+ 				  DNS_RDATASETATTR_NOQNAME) != 0)
+ 
++/*% Does the rdataset 'r' contain a stale answer? */
++#define STALE(r)		(((r)->attributes & \
++				  DNS_RDATASETATTR_STALE) != 0)
++
+ #ifdef WANT_QUERYTRACE
+ static inline void
+ client_trace(ns_client_t *client, int level, const char *message) {
+@@ -217,6 +221,10 @@ static bool
+ rpz_ck_dnssec(ns_client_t *client, isc_result_t qresult,
+ 	      dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset);
+ 
++static void
++recparam_update(ns_query_recparam_t *param, dns_rdatatype_t qtype,
++		const dns_name_t *qname, const dns_name_t *qdomain);
++
+ /*%
+  * Increment query statistics counters.
+  */
+@@ -470,6 +478,7 @@ query_reset(ns_client_t *client, bool everything) {
+ 	client->query.isreferral = false;
+ 	client->query.dns64_options = 0;
+ 	client->query.dns64_ttl = UINT32_MAX;
++	recparam_update(&client->query.recparam, 0, NULL, NULL);
+ 	client->query.root_key_sentinel_keyid = 0;
+ 	client->query.root_key_sentinel_is_ta = false;
+ 	client->query.root_key_sentinel_not_ta = false;
+@@ -4254,6 +4263,54 @@ query_prefetch(ns_client_t *client, dns_name_t *qname,
+ 	dns_rdataset_clearprefetch(rdataset);
+ }
+ 
++/*%
++ * Check whether the recursion parameters in 'param' match the current query's
++ * recursion parameters provided in 'qtype', 'qname', and 'qdomain'.
++ */
++static bool
++recparam_match(const ns_query_recparam_t *param, dns_rdatatype_t qtype,
++	       const dns_name_t *qname, const dns_name_t *qdomain)
++{
++	REQUIRE(param != NULL);
++
++	return (param->qtype == qtype &&
++	        param->qname != NULL && qname != NULL &&
++	        param->qdomain != NULL && qdomain != NULL &&
++	        dns_name_equal(param->qname, qname) &&
++	        dns_name_equal(param->qdomain, qdomain));
++}
++
++/*%
++ * Update 'param' with current query's recursion parameters provided in
++ * 'qtype', 'qname', and 'qdomain'.
++ */
++static void
++recparam_update(ns_query_recparam_t *param, dns_rdatatype_t qtype,
++		const dns_name_t *qname, const dns_name_t *qdomain)
++{
++	isc_result_t result;
++
++	REQUIRE(param != NULL);
++
++	param->qtype = qtype;
++
++	if (qname == NULL) {
++		param->qname = NULL;
++	} else {
++		param->qname = dns_fixedname_initname(&param->fqname);
++		result = dns_name_copy(qname, param->qname, NULL);
++		RUNTIME_CHECK(result == ISC_R_SUCCESS);
++	}
++
++	if (qdomain == NULL) {
++		param->qdomain = NULL;
++	} else {
++		param->qdomain = dns_fixedname_initname(&param->fqdomain);
++		result = dns_name_copy(qdomain, param->qdomain, NULL);
++		RUNTIME_CHECK(result == ISC_R_SUCCESS);
++	}
++}
++
+ static isc_result_t
+ query_recurse(ns_client_t *client, dns_rdatatype_t qtype, dns_name_t *qname,
+ 	      dns_name_t *qdomain, dns_rdataset_t *nameservers,
+@@ -4263,6 +4320,19 @@ query_recurse(ns_client_t *client, dns_rdatatype_t qtype, dns_name_t *qname,
+ 	dns_rdataset_t *rdataset, *sigrdataset;
+ 	isc_sockaddr_t *peeraddr;
+ 
++	/*
++	 * Check recursion parameters from the previous query to see if they
++	 * match.  If not, update recursion parameters and proceed.
++	 */
++	if (recparam_match(&client->query.recparam, qtype, qname, qdomain)) {
++		ns_client_log(client, NS_LOGCATEGORY_CLIENT,
++			      NS_LOGMODULE_QUERY, ISC_LOG_INFO,
++			      "recursion loop detected");
++		return (ISC_R_FAILURE);
++	}
++
++	recparam_update(&client->query.recparam, qtype, qname, qdomain);
++
+ 	if (!resuming)
+ 		inc_stats(client, dns_nsstatscounter_recursion);
+ 
+@@ -6780,6 +6850,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
+ 	int line = -1;
+ 	bool dns64_exclude, dns64, rpz;
+ 	bool nxrewrite = false;
++	bool want_stale = false;
+ 	bool redirected = false;
+ 	dns_clientinfomethods_t cm;
+ 	dns_clientinfo_t ci;
+@@ -7089,6 +7160,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
+ 		type = qtype;
+ 
+  restart:
++	// query_start
+ 	CTRACE(ISC_LOG_DEBUG(3), "query_find: restart");
+ 	want_restart = false;
+ 	authoritative = false;
+@@ -7233,6 +7305,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
+ 	}
+ 
+  db_find:
++	// query_lookup
+ 	CTRACE(ISC_LOG_DEBUG(3), "query_find: db_find");
+ 	/*
+ 	 * We'll need some resources...
+@@ -7290,6 +7363,35 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
+ 	if (!is_zone)
+ 		dns_cache_updatestats(client->view->cache, result);
+ 
++	if (want_stale) {
++		char namebuf[DNS_NAME_FORMATSIZE];
++		bool success;
++
++		client->query.dboptions &= ~DNS_DBFIND_STALEOK;
++		want_stale = false;
++
++		if (dns_rdataset_isassociated(rdataset) &&
++		    dns_rdataset_count(rdataset) > 0 &&
++		    STALE(rdataset)) {
++			rdataset->ttl = client->view->staleanswerttl;
++			success = true;
++		} else {
++			success = false;
++		}
++
++		dns_name_format(client->query.qname,
++				namebuf, sizeof(namebuf));
++		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_SERVE_STALE,
++			      NS_LOGMODULE_QUERY, ISC_LOG_INFO,
++			      "%s resolver failure, stale answer %s",
++			      namebuf, success ? "used" : "unavailable");
++
++		if (!success) {
++			QUERY_ERROR(DNS_R_SERVFAIL);
++			goto cleanup;
++		}
++	}
++
+  resume:
+ 	CTRACE(ISC_LOG_DEBUG(3), "query_find: resume");
+ 
+@@ -7635,6 +7737,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
+ 		 * The cache doesn't even have the root NS.  Get them from
+ 		 * the hints DB.
+ 		 */
++		// query_notfound
+ 		INSIST(!is_zone);
+ 		if (db != NULL)
+ 			dns_db_detach(&db);
+@@ -7697,12 +7800,14 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
+ 		 */
+ 		/* FALLTHROUGH */
+ 	case DNS_R_DELEGATION:
++		// query_delegation
+ 		authoritative = false;
+ 		if (is_zone) {
+ 			/*
+ 			 * Look to see if we are authoritative for the
+ 			 * child zone if the query type is DS.
+ 			 */
++			// query_zone_delegation
+ 			if (!RECURSIONOK(client) &&
+ 			    (options & DNS_GETDB_NOEXACT) != 0 &&
+ 			    qtype == dns_rdatatype_ds) {
+@@ -8089,6 +8194,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
+ 						       false, true);
+ 			}
+ 		}
++		// query_nxdomain
+ 		if (dns_rdataset_isassociated(rdataset)) {
+ 			/*
+ 			 * If we've got a NSEC record, we need to save the
+@@ -8409,7 +8515,8 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
+ 		/*
+ 		 * If we have a zero ttl from the cache refetch it.
+ 		 */
+-		if (!is_zone && !resuming && rdataset->ttl == 0 &&
++		// query_cname
++		if (!is_zone && !resuming && !STALE(rdataset) && rdataset->ttl == 0 &&
+ 		    RECURSIONOK(client))
+ 		{
+ 			if (dns_rdataset_isassociated(rdataset))
+@@ -8627,7 +8734,11 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
+ 			 "query_find: unexpected error after resuming: %s",
+ 			 isc_result_totext(result));
+ 		CTRACE(ISC_LOG_ERROR, errmsg);
+-		QUERY_ERROR(DNS_R_SERVFAIL);
++		if (resuming) {
++			want_stale = true;
++		} else {
++			QUERY_ERROR(DNS_R_SERVFAIL);
++		}
+ 		goto cleanup;
+ 	}
+ 
+@@ -8883,7 +8994,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
+ 		/*
+ 		 * If we have a zero ttl from the cache refetch it.
+ 		 */
+-		if (!is_zone && !resuming && rdataset->ttl == 0 &&
++		if (!is_zone && !resuming && !STALE(rdataset) && rdataset->ttl == 0 &&
+ 		    RECURSIONOK(client))
+ 		{
+ 			if (dns_rdataset_isassociated(rdataset))
+@@ -8894,6 +9005,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
+ 			if (node != NULL)
+ 				dns_db_detachnode(db, &node);
+ 
++			// query_respond
+ 			INSIST(!REDIRECT(client));
+ 			result = query_recurse(client, qtype,
+ 					       client->query.qname,
+@@ -9174,6 +9286,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
+ 				       dns_fixedname_name(&wildcardname),
+ 				       true, false);
+  cleanup:
++	// query_done
+ 	CTRACE(ISC_LOG_DEBUG(3), "query_find: cleanup");
+ 	/*
+ 	 * General cleanup.
+@@ -9230,6 +9343,49 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
+ 		goto restart;
+ 	}
+ 
++	if (want_stale) {
++		dns_ttl_t stale_ttl = 0;
++		isc_result_t result;
++		bool staleanswersok = false;
++
++		/*
++		 * Stale answers only make sense if stale_ttl > 0 but
++		 * we want rndc to be able to control returning stale
++		 * answers if they are configured.
++		 */
++		dns_db_attach(client->view->cachedb, &db);
++		result = dns_db_getservestalettl(db, &stale_ttl);
++		if (result == ISC_R_SUCCESS && stale_ttl > 0)  {
++			switch (client->view->staleanswersok) {
++			case dns_stale_answer_yes:
++				staleanswersok = true;
++				break;
++			case dns_stale_answer_conf:
++				staleanswersok =
++					client->view->staleanswersenable;
++				break;
++			case dns_stale_answer_no:
++				staleanswersok = false;
++				break;
++			}
++		} else {
++			staleanswersok = false;
++		}
++
++		if (staleanswersok) {
++			client->query.dboptions |= DNS_DBFIND_STALEOK;
++			inc_stats(client, dns_nsstatscounter_trystale);
++			if (client->query.fetch != NULL)
++				dns_resolver_destroyfetch(
++						   &client->query.fetch);
++			goto db_find;
++		}
++		dns_db_detach(&db);
++		want_stale = false;
++		QUERY_ERROR(DNS_R_SERVFAIL);
++		goto cleanup;
++	}
++
+ 	if (eresult != ISC_R_SUCCESS &&
+ 	    (!PARTIALANSWER(client) || WANTRECURSION(client)
+ 	     || eresult == DNS_R_DROP)) {
+diff --git a/bin/named/server.c b/bin/named/server.c
+index 109f0dd09f..9580d9e095 100644
+--- a/bin/named/server.c
++++ b/bin/named/server.c
+@@ -1722,7 +1722,8 @@ static bool
+ cache_sharable(dns_view_t *originview, dns_view_t *view,
+ 	       bool new_zero_no_soattl,
+ 	       unsigned int new_cleaning_interval,
+-	       uint64_t new_max_cache_size)
++	       uint64_t new_max_cache_size,
++	       uint32_t new_stale_ttl)
+ {
+ 	/*
+ 	 * If the cache cannot even reused for the same view, it cannot be
+@@ -1737,6 +1738,7 @@ cache_sharable(dns_view_t *originview, dns_view_t *view,
+ 	 */
+ 	if (dns_cache_getcleaninginterval(originview->cache) !=
+ 	    new_cleaning_interval ||
++	    dns_cache_getservestalettl(originview->cache) != new_stale_ttl ||
+ 	    dns_cache_getcachesize(originview->cache) != new_max_cache_size) {
+ 		return (false);
+ 	}
+@@ -3289,6 +3291,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
+ 	size_t max_acache_size;
+ 	size_t max_adb_size;
+ 	uint32_t lame_ttl, fail_ttl;
++	uint32_t max_stale_ttl;
+ 	dns_tsig_keyring_t *ring = NULL;
+ 	dns_view_t *pview = NULL;	/* Production view */
+ 	isc_mem_t *cmctx = NULL, *hmctx = NULL;
+@@ -3317,6 +3320,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
+ 	bool old_rpz_ok = false;
+ 	isc_dscp_t dscp4 = -1, dscp6 = -1;
+ 	dns_dyndbctx_t *dctx = NULL;
++	unsigned int resolver_param;
+ 
+ 	REQUIRE(DNS_VIEW_VALID(view));
+ 
+@@ -3731,6 +3735,24 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
+ 	if (view->maxncachettl > 7 * 24 * 3600)
+ 		view->maxncachettl = 7 * 24 * 3600;
+ 
++	obj = NULL;
++	result = ns_config_get(maps, "max-stale-ttl", &obj);
++	INSIST(result == ISC_R_SUCCESS);
++	max_stale_ttl = cfg_obj_asuint32(obj);
++
++	obj = NULL;
++	result = ns_config_get(maps, "stale-answer-enable", &obj);
++	INSIST(result == ISC_R_SUCCESS);
++	view->staleanswersenable = cfg_obj_asboolean(obj);
++
++	result = dns_viewlist_find(&ns_g_server->viewlist, view->name,
++				   view->rdclass, &pview);
++	if (result == ISC_R_SUCCESS) {
++		view->staleanswersok = pview->staleanswersok;
++		dns_view_detach(&pview);
++	} else
++		view->staleanswersok = dns_stale_answer_conf;
++
+ 	/*
+ 	 * Configure the view's cache.
+ 	 *
+@@ -3764,7 +3786,8 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
+ 	nsc = cachelist_find(cachelist, cachename, view->rdclass);
+ 	if (nsc != NULL) {
+ 		if (!cache_sharable(nsc->primaryview, view, zero_no_soattl,
+-				    cleaning_interval, max_cache_size)) {
++				    cleaning_interval, max_cache_size,
++				    max_stale_ttl)) {
+ 			isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
+ 				      NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
+ 				      "views %s and %s can't share the cache "
+@@ -3863,9 +3886,15 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
+ 
+ 	dns_cache_setcleaninginterval(cache, cleaning_interval);
+ 	dns_cache_setcachesize(cache, max_cache_size);
++	dns_cache_setservestalettl(cache, max_stale_ttl);
+ 
+ 	dns_cache_detach(&cache);
+ 
++	obj = NULL;
++	result = ns_config_get(maps, "stale-answer-ttl", &obj);
++	INSIST(result == ISC_R_SUCCESS);
++	view->staleanswerttl = ISC_MAX(cfg_obj_asuint32(obj), 1);
++
+ 	/*
+ 	 * Resolver.
+ 	 *
+@@ -4054,6 +4083,21 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
+ 		maxbits = 4096;
+ 	view->maxbits = maxbits;
+ 
++	/*
++	 * Set resolver retry parameters.
++	 */
++	obj = NULL;
++	CHECK(ns_config_get(maps, "resolver-retry-interval", &obj));
++	resolver_param = cfg_obj_asuint32(obj);
++	if (resolver_param > 0)
++		dns_resolver_setretryinterval(view->resolver, resolver_param);
++
++	obj = NULL;
++	CHECK(ns_config_get(maps, "resolver-nonbackoff-tries", &obj));
++	resolver_param = cfg_obj_asuint32(obj);
++	if (resolver_param > 0)
++		dns_resolver_setnonbackofftries(view->resolver, resolver_param);
++
+ 	/*
+ 	 * Set supported DNSSEC algorithms.
+ 	 */
+@@ -14414,3 +14458,132 @@ ns_server_dnstap(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text) {
+ 	return (ISC_R_NOTIMPLEMENTED);
+ #endif
+ }
++
++isc_result_t
++ns_server_servestale(ns_server_t *server, isc_lex_t *lex,
++		     isc_buffer_t **text)
++{
++	char *ptr, *classtxt, *viewtxt = NULL;
++	char msg[128];
++	dns_rdataclass_t rdclass = dns_rdataclass_in;
++	dns_view_t *view;
++	bool found = false;
++	dns_stale_answer_t staleanswersok = dns_stale_answer_conf;
++	bool wantstatus = false;
++	isc_result_t result = ISC_R_SUCCESS;
++
++	/* Skip the command name. */
++	ptr = next_token(lex, text);
++	if (ptr == NULL)
++		return (ISC_R_UNEXPECTEDEND);
++
++	ptr = next_token(lex, NULL);
++	if (ptr == NULL)
++		return (ISC_R_UNEXPECTEDEND);
++
++	if (strcasecmp(ptr, "on") == 0 || strcasecmp(ptr, "yes") == 0) {
++		staleanswersok = dns_stale_answer_yes;
++	} else if (strcasecmp(ptr, "off") == 0 || strcasecmp(ptr, "no") == 0) {
++		staleanswersok = dns_stale_answer_no;
++	} else if (strcasecmp(ptr, "reset") == 0) {
++		staleanswersok = dns_stale_answer_conf;
++	} else if (strcasecmp(ptr, "status") == 0) {
++		wantstatus = true;
++	} else
++		return (DNS_R_SYNTAX);
++
++	/* Look for the optional class name. */
++	classtxt = next_token(lex, text);
++	if (classtxt != NULL) {
++		/* Look for the optional view name. */
++		viewtxt = next_token(lex, text);
++	}
++
++	if (classtxt != NULL) {
++		isc_textregion_t r;
++
++		r.base = classtxt;
++		r.length = strlen(classtxt);
++		result = dns_rdataclass_fromtext(&rdclass, &r);
++		if (result != ISC_R_SUCCESS) {
++			if (viewtxt == NULL) {
++				viewtxt = classtxt;
++				classtxt = NULL;
++				result = ISC_R_SUCCESS;
++			} else {
++				snprintf(msg, sizeof(msg),
++					 "unknown class '%s'", classtxt);
++				(void) putstr(text, msg);
++				goto cleanup;
++			}
++		}
++	}
++
++	result = isc_task_beginexclusive(server->task);
++	RUNTIME_CHECK(result == ISC_R_SUCCESS);
++
++	for (view = ISC_LIST_HEAD(server->viewlist);
++	     view != NULL;
++	     view = ISC_LIST_NEXT(view, link))
++	{
++		dns_ttl_t stale_ttl = 0;
++		dns_db_t *db = NULL;
++
++		if (classtxt != NULL && rdclass != view->rdclass)
++			continue;
++
++		if (viewtxt != NULL && strcmp(view->name, viewtxt) != 0)
++			continue;
++
++		if (!wantstatus) {
++			view->staleanswersok = staleanswersok;
++			found = true;
++			continue;
++		}
++
++		db = NULL;
++		dns_db_attach(view->cachedb, &db);
++		(void)dns_db_getservestalettl(db, &stale_ttl);
++		dns_db_detach(&db);
++		if (found)
++			CHECK(putstr(text, "\n"));
++		CHECK(putstr(text, view->name));
++		CHECK(putstr(text, ": "));
++		switch (view->staleanswersok) {
++		case dns_stale_answer_yes:
++			if (stale_ttl > 0)
++				CHECK(putstr(text, "on (rndc)"));
++			else
++				CHECK(putstr(text, "off (not-cached)"));
++			break;
++		case dns_stale_answer_no:
++			CHECK(putstr(text, "off (rndc)"));
++			break;
++		case dns_stale_answer_conf:
++			if (view->staleanswersenable && stale_ttl > 0)
++				CHECK(putstr(text, "on"));
++			else if (view->staleanswersenable)
++				CHECK(putstr(text, "off (not-cached)"));
++			else
++				CHECK(putstr(text, "off"));
++			break;
++		}
++		if (stale_ttl > 0) {
++			snprintf(msg, sizeof(msg),
++				 " (stale-answer-ttl=%u max-stale-ttl=%u)",
++				 view->staleanswerttl, stale_ttl);
++			CHECK(putstr(text, msg));
++		}
++		found = true;
++	}
++	isc_task_endexclusive(ns_g_server->task);
++
++	if (!found)
++		result = ISC_R_NOTFOUND;
++
++cleanup:
++	if (isc_buffer_usedlength(*text) > 0)
++		(void) putnull(text);
++
++	return (result);
++}
+diff --git a/bin/named/statschannel.c b/bin/named/statschannel.c
+index 7e9ba43a73..92cfcc5e07 100644
+--- a/bin/named/statschannel.c
++++ b/bin/named/statschannel.c
+@@ -295,6 +295,12 @@ init_desc(void) {
+ 		"QryNXRedirRLookup");
+ 	SET_NSSTATDESC(badcookie, "sent badcookie response", "QryBADCOOKIE");
+ 	SET_NSSTATDESC(keytagopt, "Keytag option received", "KeyTagOpt");
++	SET_NSSTATDESC(trystale,
++		       "attempts to use stale cache data after lookup failure",
++		       "QryTryStale");
++	SET_NSSTATDESC(usedstale,
++		       "successful uses of stale cache data after lookup failure",
++		       "QryUsedStale");
+ 	INSIST(i == dns_nsstatscounter_max);
+ 
+ 	/* Initialize resolver statistics */
+diff --git a/bin/rndc/rndc.c b/bin/rndc/rndc.c
+index 8083654ac7..d519983b88 100644
+--- a/bin/rndc/rndc.c
++++ b/bin/rndc/rndc.c
+@@ -160,6 +160,8 @@ command is one of the following:\n\
+   scan		Scan available network interfaces for changes.\n\
+   secroots [view ...]\n\
+ 		Write security roots to the secroots file.\n\
++  serve-stale	( yes | no | reset ) [class [view]]\n\
++		Control whether stale answers are returned\n\
+   showzone zone [class [view]]\n\
+ 		Print a zone's configuration.\n\
+   sign zone [class [view]]\n\
+diff --git a/bin/rndc/rndc.docbook b/bin/rndc/rndc.docbook
+index 06b073aaea..6ae8e5da6b 100644
+--- a/bin/rndc/rndc.docbook
++++ b/bin/rndc/rndc.docbook
+@@ -688,6 +688,25 @@
+ 	</listitem>
+       </varlistentry>
+ 
++      <varlistentry>
++	<term><userinput>serve-stale ( on | off | reset | status) <optional><replaceable>class</replaceable> <optional><replaceable>view</replaceable></optional></optional></userinput></term>
++	<listitem>
++	  <para>
++	    Enable, disable, or reset the serving of stale answers
++	    as configured in named.conf. Serving of stale answers
++	    will remain disabled across <filename>named.conf</filename>
++	    reloads if disabled via rndc until it is reset via rndc.
++	  </para>
++	  <para>
++	    Status will report whether serving of stale answers is
++	    currently enabled, disabled or not configured for a
++	    view.  If serving of stale records is configured then
++	    the values of stale-answer-ttl and max-stale-ttl are
++	    reported.
++	  </para>
++	</listitem>
++      </varlistentry>
++
+       <varlistentry>
+ 	<term><userinput>secroots <optional>-</optional> <optional><replaceable>view ...</replaceable></optional></userinput></term>
+ 	<listitem>
+diff --git a/bin/tests/system/chain/prereq.sh b/bin/tests/system/chain/prereq.sh
+index f3f1939b2a..9ff3f07941 100644
+--- a/bin/tests/system/chain/prereq.sh
++++ b/bin/tests/system/chain/prereq.sh
+@@ -48,3 +48,10 @@ else
+     echo_i "This test requires the Net::DNS::Nameserver library." >&2
+     exit 1
+ fi
++if $PERL -e 'use Net::DNS::Nameserver;' 2>/dev/null
++then
++	:
++else
++    echo "I:This test requires the Net::DNS::Nameserver library." >&2
++    exit 1
++fi
+diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
+index 81b8e30236..166f0e77f0 100644
+--- a/bin/tests/system/conf.sh.in
++++ b/bin/tests/system/conf.sh.in
+@@ -125,7 +125,7 @@ PARALLELDIRS="dnssec rpzrecurse \
+ 	reclimit redirect resolver rndc rootkeysentinel rpz \
+ 	rrchecker rrl rrsetorder rsabigexponent runtime \
+ 	sfcache smartsign sortlist \
+-	spf staticstub statistics statschannel stub \
++	spf serve-stale staticstub statistics statschannel stub \
+ 	tcp tsig tsiggss \
+ 	unknown upforwd verify views wildcard \
+ 	xfer xferquota zero zonechecks"
+diff --git a/bin/tests/system/dyndb/driver/db.c b/bin/tests/system/dyndb/driver/db.c
+index 02aa6ab2ef..a77c7de98f 100644
+--- a/bin/tests/system/dyndb/driver/db.c
++++ b/bin/tests/system/dyndb/driver/db.c
+@@ -629,6 +629,8 @@ static dns_dbmethods_t sampledb_methods = {
+ 	hashsize,
+ 	NULL,
+ 	NULL,
++	NULL,
++	NULL,
+ };
+ 
+ /* Auxiliary driver functions. */
+diff --git a/bin/tests/system/serve-stale/.gitignore b/bin/tests/system/serve-stale/.gitignore
+new file mode 100644
+index 0000000000..2272eef9ec
+--- /dev/null
++++ b/bin/tests/system/serve-stale/.gitignore
+@@ -0,0 +1,11 @@
++/ans2/ans.pid
++/ans2/ans.pl
++/dig.out*
++/ns1/named.conf
++/ns3/named.conf
++/ns3/root.bk
++/rndc.out*
++named.lock
++named.pid
++named.port
++named.run
+diff --git a/bin/tests/system/serve-stale/ans2/ans.pl.in b/bin/tests/system/serve-stale/ans2/ans.pl.in
+new file mode 100644
+index 0000000000..2b39eca916
+--- /dev/null
++++ b/bin/tests/system/serve-stale/ans2/ans.pl.in
+@@ -0,0 +1,178 @@
++#!/usr/bin/env perl
++#
++# Copyright (C) 2014-2016  Internet Systems Consortium, Inc. ("ISC")
++#
++# This Source Code Form is subject to the terms of the Mozilla Public
++# License, v. 2.0. If a copy of the MPL was not distributed with this
++# file, You can obtain one at http://mozilla.org/MPL/2.0/.
++
++use strict;
++use warnings;
++
++use IO::File;
++use IO::Socket;
++use Getopt::Long;
++use Net::DNS;
++use Time::HiRes qw(usleep nanosleep);
++
++my $pidf = new IO::File "ans.pid", "w" or die "cannot open pid file: $!";
++print $pidf "$$\n" or die "cannot write pid file: $!";
++$pidf->close or die "cannot close pid file: $!";
++sub rmpid { unlink "ans.pid"; exit 1; };
++
++$SIG{INT} = \&rmpid;
++$SIG{TERM} = \&rmpid;
++
++my $send_response = 1;
++
++my $localaddr = "10.53.0.2";
++my $localport = @PORT@;
++my $udpsock = IO::Socket::INET->new(LocalAddr => "$localaddr",
++   LocalPort => $localport, Proto => "udp", Reuse => 1) or die "$!";
++
++#
++# Delegation
++#
++my $SOA = "example 300 IN SOA . . 0 0 0 0 300";
++my $NS = "example 300 IN NS ns.example";
++my $A = "ns.example 300 IN A $localaddr";
++#
++# Records to be TTL stretched
++#
++my $TXT = "data.example 1 IN TXT \"A text record with a 1 second ttl\"";
++my $negSOA = "example 1 IN SOA . . 0 0 0 0 300";
++
++sub reply_handler {
++    my ($qname, $qclass, $qtype) = @_;
++    my ($rcode, @ans, @auth, @add);
++
++    print ("request: $qname/$qtype\n");
++    STDOUT->flush();
++
++    # Control whether we send a response or not.
++    # We always respond to control commands.
++    if ($qname eq "enable" ) {
++	if ($qtype eq "TXT") {
++	    $send_response = 1;
++            my $rr = new Net::DNS::RR("$qname 0 $qclass TXT \"$send_response\"");
++            push @ans, $rr;
++	}
++	$rcode = "NOERROR";
++        return ($rcode, \@ans, \@auth, \@add, { aa => 1 });
++    } elsif ($qname eq "disable" ) {
++	if ($qtype eq "TXT") {
++	    $send_response = 0;
++            my $rr = new Net::DNS::RR("$qname 0 $qclass TXT \"$send_response\"");
++            push @ans, $rr;
++	}
++	$rcode = "NOERROR";
++        return ($rcode, \@ans, \@auth, \@add, { aa => 1 });
++    }
++
++    # If we are not responding to queries we are done.
++    return if (!$send_response);
++
++    # Construct the response and send it.
++    if ($qname eq "ns.example" ) {
++	if ($qtype eq "A") {
++	    my $rr = new Net::DNS::RR($A);
++	    push @ans, $rr;
++	} else {
++	    my $rr = new Net::DNS::RR($SOA);
++	    push @auth, $rr;
++	}
++	$rcode = "NOERROR";
++    } elsif ($qname eq "example") {
++	if ($qtype eq "NS") {
++	    my $rr = new Net::DNS::RR($NS);
++	    push @auth, $rr;
++	    $rr = new Net::DNS::RR($A);
++	    push @add, $rr;
++	} elsif ($qtype eq "SOA") {
++	    my $rr = new Net::DNS::RR($SOA);
++	    push @ans, $rr;
++	} else {
++	    my $rr = new Net::DNS::RR($SOA);
++	    push @auth, $rr;
++	}
++	$rcode = "NOERROR";
++    } elsif ($qname eq "nodata.example") {
++	my $rr = new Net::DNS::RR($negSOA);
++	push @auth, $rr;
++	$rcode = "NOERROR";
++    } elsif ($qname eq "data.example") {
++	if ($qtype eq "TXT") {
++	    my $rr = new Net::DNS::RR($TXT);
++	    push @ans, $rr;
++	} else {
++	    my $rr = new Net::DNS::RR($negSOA);
++	    push @auth, $rr;
++	}
++	$rcode = "NOERROR";
++    } elsif ($qname eq "nxdomain.example") {
++	my $rr = new Net::DNS::RR($negSOA);
++	push @auth, $rr;
++	$rcode = "NXDOMAIN";
++    } else {
++        my $rr = new Net::DNS::RR($SOA);
++	push @auth, $rr;
++	$rcode = "NXDOMAIN";
++    }
++
++    # mark the answer as authoritive (by setting the 'aa' flag
++    return ($rcode, \@ans, \@auth, \@add, { aa => 1 });
++}
++
++GetOptions(
++    'port=i' => \$localport,
++);
++
++my $rin;
++my $rout;
++
++for (;;) {
++	$rin = '';
++	vec($rin, fileno($udpsock), 1) = 1;
++
++	select($rout = $rin, undef, undef, undef);
++
++	if (vec($rout, fileno($udpsock), 1)) {
++		my ($buf, $request, $err);
++		$udpsock->recv($buf, 512);
++
++		if ($Net::DNS::VERSION > 0.68) {
++			$request = new Net::DNS::Packet(\$buf, 0);
++			$@ and die $@;
++		} else {
++			my $err;
++			($request, $err) = new Net::DNS::Packet(\$buf, 0);
++			$err and die $err;
++		}
++
++		my @questions = $request->question;
++		my $qname = $questions[0]->qname;
++		my $qclass = $questions[0]->qclass;
++		my $qtype = $questions[0]->qtype;
++		my $id = $request->header->id;
++
++		my ($rcode, $ans, $auth, $add, $headermask) = reply_handler($qname, $qclass, $qtype);
++
++		if (!defined($rcode)) {
++			print "  Silently ignoring query\n";
++			next;
++		}
++
++		my $reply = Net::DNS::Packet->new();
++		$reply->header->qr(1);
++		$reply->header->aa(1) if $headermask->{'aa'};
++		$reply->header->id($id);
++		$reply->header->rcode($rcode);
++		$reply->push("question",   @questions);
++		$reply->push("answer",     @$ans)  if $ans;
++		$reply->push("authority",  @$auth) if $auth;
++		$reply->push("additional", @$add)  if $add;
++
++		my $num_chars = $udpsock->send($reply->data);
++		print "  Sent $num_chars bytes via UDP\n";
++	}
++}
+diff --git a/bin/tests/system/serve-stale/clean.sh b/bin/tests/system/serve-stale/clean.sh
+new file mode 100644
+index 0000000000..2397326374
+--- /dev/null
++++ b/bin/tests/system/serve-stale/clean.sh
+@@ -0,0 +1,15 @@
++# Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
++#
++# This Source Code Form is subject to the terms of the Mozilla Public
++# License, v. 2.0. If a copy of the MPL was not distributed with this
++# file, You can obtain one at http://mozilla.org/MPL/2.0/.
++
++rm -f test.output
++rm -f dig.out.test*
++rm -f ans2/ans.pl
++rm -f ns3/root.bk
++rm -f rndc.out.test*
++rm -f ns*/named.memstats
++rm -f ns*/managed-keys.bind
++rm -f ns*/named.conf
++rm -f ns*/named.run
+diff --git a/bin/tests/system/serve-stale/ns1/named1.conf.in b/bin/tests/system/serve-stale/ns1/named1.conf.in
+new file mode 100644
+index 0000000000..8a75a10753
+--- /dev/null
++++ b/bin/tests/system/serve-stale/ns1/named1.conf.in
+@@ -0,0 +1,35 @@
++/*
++ * Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
++ *
++ * This Source Code Form is subject to the terms of the Mozilla Public
++ * License, v. 2.0. If a copy of the MPL was not distributed with this
++ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
++ */
++
++key rndc_key {
++        secret "1234abcd8765";
++        algorithm hmac-sha256;
++};
++
++controls {
++	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
++};
++
++options {
++	query-source address 10.53.0.1;
++	notify-source 10.53.0.1;
++	transfer-source 10.53.0.1;
++	port @PORT@;
++	pid-file "named.pid";
++	listen-on { 10.53.0.1; };
++	listen-on-v6 { none; };
++	recursion yes;
++	max-stale-ttl 3600;
++	stale-answer-ttl 1;
++	stale-answer-enable yes;
++};
++
++zone "." {
++	type master;
++	file "root.db";
++};
+diff --git a/bin/tests/system/serve-stale/ns1/named2.conf.in b/bin/tests/system/serve-stale/ns1/named2.conf.in
+new file mode 100644
+index 0000000000..072e6ec40d
+--- /dev/null
++++ b/bin/tests/system/serve-stale/ns1/named2.conf.in
+@@ -0,0 +1,35 @@
++/*
++ * Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
++ *
++ * This Source Code Form is subject to the terms of the Mozilla Public
++ * License, v. 2.0. If a copy of the MPL was not distributed with this
++ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
++ */
++
++key rndc_key {
++        secret "1234abcd8765";
++        algorithm hmac-sha256;
++};
++
++controls {
++	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
++};
++
++options {
++	query-source address 10.53.0.1;
++	notify-source 10.53.0.1;
++	transfer-source 10.53.0.1;
++	port @PORT@;
++	pid-file "named.pid";
++	listen-on { 10.53.0.1; };
++	listen-on-v6 { none; };
++	recursion yes;
++	max-stale-ttl 7200;
++	stale-answer-ttl 2;
++	stale-answer-enable yes;
++};
++
++zone "." {
++	type master;
++	file "root.db";
++};
+diff --git a/bin/tests/system/serve-stale/ns1/root.db b/bin/tests/system/serve-stale/ns1/root.db
+new file mode 100644
+index 0000000000..eb9ad3ecf1
+--- /dev/null
++++ b/bin/tests/system/serve-stale/ns1/root.db
+@@ -0,0 +1,5 @@
++.		300	SOA	. . 0 0 0 0 0
++.		300	NS	ns.nil.
++ns.nil.		300	A	10.53.0.1
++example.	300	NS	ns.example.
++ns.example.	300	A	10.53.0.2
+diff --git a/bin/tests/system/serve-stale/ns3/named.conf.in b/bin/tests/system/serve-stale/ns3/named.conf.in
+new file mode 100644
+index 0000000000..24a3293fb9
+--- /dev/null
++++ b/bin/tests/system/serve-stale/ns3/named.conf.in
+@@ -0,0 +1,35 @@
++/*
++ * Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
++ *
++ * This Source Code Form is subject to the terms of the Mozilla Public
++ * License, v. 2.0. If a copy of the MPL was not distributed with this
++ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
++ */
++
++key rndc_key {
++        secret "1234abcd8765";
++        algorithm hmac-sha256;
++};
++
++controls {
++	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
++};
++
++options {
++	query-source address 10.53.0.3;
++	notify-source 10.53.0.3;
++	transfer-source 10.53.0.3;
++	port @PORT@;
++	pid-file "named.pid";
++	listen-on { 10.53.0.3; };
++	listen-on-v6 { none; };
++	recursion yes;
++	// max-stale-ttl 3600;
++	// stale-answer-ttl 3;
++};
++
++zone "." {
++	type slave;
++	masters { 10.53.0.1; };
++	file "root.bk";
++};
+diff --git a/bin/tests/system/serve-stale/prereq.sh b/bin/tests/system/serve-stale/prereq.sh
+new file mode 100644
+index 0000000000..a3bbef8f03
+--- /dev/null
++++ b/bin/tests/system/serve-stale/prereq.sh
+@@ -0,0 +1,38 @@
++#!/bin/sh
++#
++# Copyright (C) 2011, 2012, 2014, 2016  Internet Systems Consortium, Inc. ("ISC")
++#
++# This Source Code Form is subject to the terms of the Mozilla Public
++# License, v. 2.0. If a copy of the MPL was not distributed with this
++# file, You can obtain one at http://mozilla.org/MPL/2.0/.
++
++SYSTEMTESTTOP=..
++. $SYSTEMTESTTOP/conf.sh
++
++if $PERL -e 'use Net::DNS;' 2>/dev/null
++then
++    if $PERL -e 'use Net::DNS; die if ($Net::DNS::VERSION >= 0.69 && $Net::DNS::VERSION <= 0.74);' 2>/dev/null
++    then
++        :
++    else
++        echo "I:Net::DNS versions 0.69 to 0.74 have bugs that cause this test to fail: please update." >&2
++        exit 1
++    fi
++else
++    echo "I:This test requires the Net::DNS library." >&2
++    exit 1
++fi
++if $PERL -e 'use Net::DNS::Nameserver;' 2>/dev/null
++then
++	:
++else
++	echo "I:This test requires the Net::DNS::Nameserver library." >&2
++	exit 1
++fi
++if $PERL -e 'use Time::HiRes;' 2>/dev/null
++then
++	:
++else
++	echo "I:This test requires the Time::HiRes library." >&2
++	exit 1
++fi
+diff --git a/bin/tests/system/serve-stale/setup.sh b/bin/tests/system/serve-stale/setup.sh
+new file mode 100644
+index 0000000000..690f43c813
+--- /dev/null
++++ b/bin/tests/system/serve-stale/setup.sh
+@@ -0,0 +1,13 @@
++#!/bin/sh
++# Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
++#
++# This Source Code Form is subject to the terms of the Mozilla Public
++# License, v. 2.0. If a copy of the MPL was not distributed with this
++# file, You can obtain one at http://mozilla.org/MPL/2.0/.
++
++SYSTEMTESTTOP=..
++. $SYSTEMTESTTOP/conf.sh
++
++copy_setports ns1/named1.conf.in ns1/named.conf
++copy_setports ans2/ans.pl.in ans2/ans.pl
++copy_setports ns3/named.conf.in ns3/named.conf
+diff --git a/bin/tests/system/serve-stale/tests.sh b/bin/tests/system/serve-stale/tests.sh
+new file mode 100755
+index 0000000000..201c996921
+--- /dev/null
++++ b/bin/tests/system/serve-stale/tests.sh
+@@ -0,0 +1,536 @@
++#!/bin/sh
++#
++# Copyright (C) 2000, 2001, 2004, 2007, 2009-2016  Internet Systems Consortium, Inc. ("ISC")
++#
++# This Source Code Form is subject to the terms of the Mozilla Public
++# License, v. 2.0. If a copy of the MPL was not distributed with this
++# file, You can obtain one at http://mozilla.org/MPL/2.0/.
++
++SYSTEMTESTTOP=..
++. $SYSTEMTESTTOP/conf.sh
++
++while getopts "p:c:" flag; do
++    case "$flag" in
++	p) port=$OPTARG ;;
++	c) controlport=$OPTARG ;;
++	*) exit 1 ;;
++    esac
++done
++
++RNDCCMD="$RNDC -c $SYSTEMTESTTOP/common/rndc.conf -p ${CONTROLPORT} -s"
++
++echo "RNDCCMD: ${RNDCCMD}"
++
++status=0
++n=0
++
++#echo "I:check ans.pl server ($n)"
++#$DIG -p ${PORT} @10.53.0.2 example NS
++#$DIG -p ${PORT} @10.53.0.2 example SOA
++#$DIG -p ${PORT} @10.53.0.2 ns.example A
++#$DIG -p ${PORT} @10.53.0.2 ns.example AAAA
++#$DIG -p ${PORT} @10.53.0.2 txt enable
++#$DIG -p ${PORT} @10.53.0.2 txt disable
++#$DIG -p ${PORT} @10.53.0.2 ns.example AAAA
++#$DIG -p ${PORT} @10.53.0.2 txt enable
++#$DIG -p ${PORT} @10.53.0.2 ns.example AAAA
++##$DIG -p ${PORT} @10.53.0.2 data.example TXT
++#$DIG -p ${PORT} @10.53.0.2 nodata.example TXT
++#$DIG -p ${PORT} @10.53.0.2 nxdomain.example TXT
++
++n=`expr $n + 1`
++echo "I:prime cache data.example ($n)"
++ret=0
++$DIG -p ${PORT} @10.53.0.1 data.example TXT > dig.out.test$n
++grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
++grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
++if [ $ret != 0 ]; then echo "I:failed"; fi
++status=`expr $status + $ret`
++
++n=`expr $n + 1`
++echo "I:prime cache nodata.example ($n)"
++ret=0
++$DIG -p ${PORT} @10.53.0.1 nodata.example TXT > dig.out.test$n
++grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
++grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
++if [ $ret != 0 ]; then echo "I:failed"; fi
++status=`expr $status + $ret`
++
++n=`expr $n + 1`
++echo "I:prime cache nxdomain.example ($n)"
++ret=0
++$DIG -p ${PORT} @10.53.0.1 nxdomain.example TXT > dig.out.test$n
++grep "status: NXDOMAIN" dig.out.test$n > /dev/null || ret=1
++grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
++if [ $ret != 0 ]; then echo "I:failed"; fi
++status=`expr $status + $ret`
++
++n=`expr $n + 1`
++echo "I:disable responses from authoritative server ($n)"
++ret=0
++$DIG -p ${PORT} @10.53.0.2 txt disable  > dig.out.test$n
++grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
++grep "TXT.\"0\"" dig.out.test$n > /dev/null || ret=1
++if [ $ret != 0 ]; then echo "I:failed"; fi
++status=`expr $status + $ret`
++
++sleep 1
++
++n=`expr $n + 1`
++echo "I:check 'rndc serve-stale status' ($n)"
++ret=0
++$RNDCCMD 10.53.0.1 serve-stale status > rndc.out.test$n 2>&1 || ret=1
++grep '_default: on (stale-answer-ttl=1 max-stale-ttl=3600)' rndc.out.test$n > /dev/null || ret=1
++if [ $ret != 0 ]; then echo "I:failed"; fi
++status=`expr $status + $ret`
++
++n=`expr $n + 1`
++echo "I:check stale data.example ($n)"
++ret=0
++$DIG -p ${PORT} @10.53.0.1 data.example TXT > dig.out.test$n
++grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
++grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
++grep "example.*1.*IN" dig.out.test$n > /dev/null || ret=1
++if [ $ret != 0 ]; then echo "I:failed"; fi
++status=`expr $status + $ret`
++
++n=`expr $n + 1`
++echo "I:check stale nodata.example ($n)"
++ret=0
++$DIG -p ${PORT} @10.53.0.1 nodata.example TXT > dig.out.test$n
++grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
++grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
++grep "example.*1.*IN" dig.out.test$n > /dev/null || ret=1
++if [ $ret != 0 ]; then echo "I:failed"; fi
++status=`expr $status + $ret`
++
++n=`expr $n + 1`
++echo "I:check stale nxdomain.example ($n)"
++ret=0
++$DIG -p ${PORT} @10.53.0.1 nxdomain.example TXT > dig.out.test$n
++grep "status: NXDOMAIN" dig.out.test$n > /dev/null || ret=1
++grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
++grep "example.*1.*IN" dig.out.test$n > /dev/null || ret=1
++if [ $ret != 0 ]; then echo "I:failed"; fi
++status=`expr $status + $ret`
++
++n=`expr $n + 1`
++echo "I:running 'rndc serve-stale off' ($n)"
++ret=0
++$RNDCCMD 10.53.0.1 serve-stale off || ret=1
++if [ $ret != 0 ]; then echo "I:failed"; fi
++status=`expr $status + $ret`
++
++n=`expr $n + 1`
++echo "I:check 'rndc serve-stale status' ($n)"
++ret=0
++$RNDCCMD 10.53.0.1 serve-stale status > rndc.out.test$n 2>&1 || ret=1
++grep '_default: off (rndc) (stale-answer-ttl=1 max-stale-ttl=3600)' rndc.out.test$n > /dev/null || ret=1
++if [ $ret != 0 ]; then echo "I:failed"; fi
++status=`expr $status + $ret`
++
++n=`expr $n + 1`
++echo "I:check stale data.example (serve-stale off) ($n)"
++ret=0
++$DIG -p ${PORT} @10.53.0.1 data.example TXT > dig.out.test$n
++grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
++if [ $ret != 0 ]; then echo "I:failed"; fi
++status=`expr $status + $ret`
++if [ $ret != 0 ]; then echo "I:failed"; fi
++status=`expr $status + $ret`
++
++n=`expr $n + 1`
++echo "I:check stale nodata.example (serve-stale off) ($n)"
++ret=0
++$DIG -p ${PORT} @10.53.0.1 nodata.example TXT > dig.out.test$n
++grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
++if [ $ret != 0 ]; then echo "I:failed"; fi
++status=`expr $status + $ret`
++
++n=`expr $n + 1`
++echo "I:check stale nxdomain.example (serve-stale off) ($n)"
++ret=0
++$DIG -p ${PORT} @10.53.0.1 nxdomain.example TXT > dig.out.test$n
++grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
++if [ $ret != 0 ]; then echo "I:failed"; fi
++status=`expr $status + $ret`
++
++n=`expr $n + 1`
++echo "I:running 'rndc serve-stale on' ($n)"
++ret=0
++$RNDCCMD 10.53.0.1 serve-stale on || ret=1
++if [ $ret != 0 ]; then echo "I:failed"; fi
++status=`expr $status + $ret`
++
++n=`expr $n + 1`
++echo "I:check 'rndc serve-stale status' ($n)"
++ret=0
++$RNDCCMD 10.53.0.1 serve-stale status > rndc.out.test$n 2>&1 || ret=1
++grep '_default: on (rndc) (stale-answer-ttl=1 max-stale-ttl=3600)' rndc.out.test$n > /dev/null || ret=1
++if [ $ret != 0 ]; then echo "I:failed"; fi
++status=`expr $status + $ret`
++
++n=`expr $n + 1`
++echo "I:check stale data.example (serve-stale on) ($n)"
++ret=0
++$DIG -p ${PORT} @10.53.0.1 data.example TXT > dig.out.test$n
++grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
++grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
++grep "example.*1.*IN" dig.out.test$n > /dev/null || ret=1
++if [ $ret != 0 ]; then echo "I:failed"; fi
++status=`expr $status + $ret`
++
++n=`expr $n + 1`
++echo "I:check stale nodata.example (serve-stale on) ($n)"
++ret=0
++$DIG -p ${PORT} @10.53.0.1 nodata.example TXT > dig.out.test$n
++grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
++grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
++grep "example.*1.*IN" dig.out.test$n > /dev/null || ret=1
++if [ $ret != 0 ]; then echo "I:failed"; fi
++status=`expr $status + $ret`
++
++n=`expr $n + 1`
++echo "I:check stale nxdomain.example (serve-stale on) ($n)"
++ret=0
++$DIG -p ${PORT} @10.53.0.1 nxdomain.example TXT > dig.out.test$n
++grep "status: NXDOMAIN" dig.out.test$n > /dev/null || ret=1
++grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
++grep "example.*1.*IN" dig.out.test$n > /dev/null || ret=1
++if [ $ret != 0 ]; then echo "I:failed"; fi
++status=`expr $status + $ret`
++
++n=`expr $n + 1`
++echo "I:running 'rndc serve-stale no' ($n)"
++ret=0
++$RNDCCMD 10.53.0.1 serve-stale no || ret=1
++if [ $ret != 0 ]; then echo "I:failed"; fi
++status=`expr $status + $ret`
++
++n=`expr $n + 1`
++echo "I:check 'rndc serve-stale status' ($n)"
++ret=0
++$RNDCCMD 10.53.0.1 serve-stale status > rndc.out.test$n 2>&1 || ret=1
++grep '_default: off (rndc) (stale-answer-ttl=1 max-stale-ttl=3600)' rndc.out.test$n > /dev/null || ret=1
++if [ $ret != 0 ]; then echo "I:failed"; fi
++status=`expr $status + $ret`
++
++n=`expr $n + 1`
++echo "I:check stale data.example (serve-stale no) ($n)"
++ret=0
++$DIG -p ${PORT} @10.53.0.1 data.example TXT > dig.out.test$n
++grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
++if [ $ret != 0 ]; then echo "I:failed"; fi
++status=`expr $status + $ret`
++if [ $ret != 0 ]; then echo "I:failed"; fi
++status=`expr $status + $ret`
++
++n=`expr $n + 1`
++echo "I:check stale nodata.example (serve-stale no) ($n)"
++ret=0
++$DIG -p ${PORT} @10.53.0.1 nodata.example TXT > dig.out.test$n
++grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
++if [ $ret != 0 ]; then echo "I:failed"; fi
++status=`expr $status + $ret`
++
++n=`expr $n + 1`
++echo "I:check stale nxdomain.example (serve-stale no) ($n)"
++ret=0
++$DIG -p ${PORT} @10.53.0.1 nxdomain.example TXT > dig.out.test$n
++grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
++if [ $ret != 0 ]; then echo "I:failed"; fi
++status=`expr $status + $ret`
++
++n=`expr $n + 1`
++echo "I:running 'rndc serve-stale yes' ($n)"
++ret=0
++$RNDCCMD 10.53.0.1 serve-stale yes || ret=1
++if [ $ret != 0 ]; then echo "I:failed"; fi
++status=`expr $status + $ret`
++
++n=`expr $n + 1`
++echo "I:check 'rndc serve-stale status' ($n)"
++ret=0
++$RNDCCMD 10.53.0.1 serve-stale status > rndc.out.test$n 2>&1 || ret=1
++grep '_default: on (rndc) (stale-answer-ttl=1 max-stale-ttl=3600)' rndc.out.test$n > /dev/null || ret=1
++if [ $ret != 0 ]; then echo "I:failed"; fi
++status=`expr $status + $ret`
++
++n=`expr $n + 1`
++echo "I:check stale data.example (serve-stale yes) ($n)"
++ret=0
++$DIG -p ${PORT} @10.53.0.1 data.example TXT > dig.out.test$n
++grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
++grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
++grep "example.*1.*IN" dig.out.test$n > /dev/null || ret=1
++if [ $ret != 0 ]; then echo "I:failed"; fi
++status=`expr $status + $ret`
++
++n=`expr $n + 1`
++echo "I:check stale nodata.example (serve-stale yes) ($n)"
++ret=0
++$DIG -p ${PORT} @10.53.0.1 nodata.example TXT > dig.out.test$n
++grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
++grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
++grep "example.*1.*IN" dig.out.test$n > /dev/null || ret=1
++if [ $ret != 0 ]; then echo "I:failed"; fi
++status=`expr $status + $ret`
++
++n=`expr $n + 1`
++echo "I:check stale nxdomain.example (serve-stale yes) ($n)"
++ret=0
++$DIG -p ${PORT} @10.53.0.1 nxdomain.example TXT > dig.out.test$n
++grep "status: NXDOMAIN" dig.out.test$n > /dev/null || ret=1
++grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
++grep "example.*1.*IN" dig.out.test$n > /dev/null || ret=1
++if [ $ret != 0 ]; then echo "I:failed"; fi
++status=`expr $status + $ret`
++
++n=`expr $n + 1`
++echo "I:running 'rndc serve-stale off' ($n)"
++ret=0
++$RNDCCMD 10.53.0.1 serve-stale off || ret=1
++if [ $ret != 0 ]; then echo "I:failed"; fi
++status=`expr $status + $ret`
++
++n=`expr $n + 1`
++echo "I:running 'rndc serve-stale reset' ($n)"
++ret=0
++$RNDCCMD 10.53.0.1 serve-stale reset || ret=1
++if [ $ret != 0 ]; then echo "I:failed"; fi
++status=`expr $status + $ret`
++
++n=`expr $n + 1`
++echo "I:check 'rndc serve-stale status' ($n)"
++ret=0
++$RNDCCMD 10.53.0.1 serve-stale status > rndc.out.test$n 2>&1 || ret=1
++grep '_default: on (stale-answer-ttl=1 max-stale-ttl=3600)' rndc.out.test$n > /dev/null || ret=1
++if [ $ret != 0 ]; then echo "I:failed"; fi
++status=`expr $status + $ret`
++
++n=`expr $n + 1`
++echo "I:check stale data.example (serve-stale reset) ($n)"
++ret=0
++$DIG -p ${PORT} @10.53.0.1 data.example TXT > dig.out.test$n
++grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
++grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
++grep "example.*1.*IN" dig.out.test$n > /dev/null || ret=1
++if [ $ret != 0 ]; then echo "I:failed"; fi
++status=`expr $status + $ret`
++
++n=`expr $n + 1`
++echo "I:check stale nodata.example (serve-stale reset) ($n)"
++ret=0
++$DIG -p ${PORT} @10.53.0.1 nodata.example TXT > dig.out.test$n
++grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
++grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
++grep "example.*1.*IN" dig.out.test$n > /dev/null || ret=1
++if [ $ret != 0 ]; then echo "I:failed"; fi
++status=`expr $status + $ret`
++
++n=`expr $n + 1`
++echo "I:check stale nxdomain.example (serve-stale reset) ($n)"
++ret=0
++$DIG -p ${PORT} @10.53.0.1 nxdomain.example TXT > dig.out.test$n
++grep "status: NXDOMAIN" dig.out.test$n > /dev/null || ret=1
++grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
++grep "example.*1.*IN" dig.out.test$n > /dev/null || ret=1
++if [ $ret != 0 ]; then echo "I:failed"; fi
++status=`expr $status + $ret`
++
++n=`expr $n + 1`
++echo "I:running 'rndc serve-stale off' ($n)"
++ret=0
++$RNDCCMD 10.53.0.1 serve-stale off || ret=1
++if [ $ret != 0 ]; then echo "I:failed"; fi
++status=`expr $status + $ret`
++
++n=`expr $n + 1`
++echo "I:check 'rndc serve-stale status' ($n)"
++ret=0
++$RNDCCMD 10.53.0.1 serve-stale status > rndc.out.test$n 2>&1 || ret=1
++grep '_default: off (rndc) (stale-answer-ttl=1 max-stale-ttl=3600)' rndc.out.test$n > /dev/null || ret=1
++if [ $ret != 0 ]; then echo "I:failed"; fi
++status=`expr $status + $ret`
++
++n=`expr $n + 1`
++echo "I:updating ns1/named.conf ($n)"
++ret=0
++sed -e "s/@PORT@/${PORT}/g;s/@CONTROLPORT@/${CONTROLPORT}/g" < ns1/named2.conf.in > ns1/named.conf
++if [ $ret != 0 ]; then echo "I:failed"; fi
++status=`expr $status + $ret`
++
++n=`expr $n + 1`
++echo "I:running 'rndc reload' ($n)"
++ret=0
++$RNDCCMD 10.53.0.1 reload > rndc.out.test$n 2>&1 || ret=1
++grep "server reload successful" rndc.out.test$n > /dev/null || ret=1
++if [ $ret != 0 ]; then echo "I:failed"; fi
++status=`expr $status + $ret`
++
++n=`expr $n + 1`
++echo "I:check 'rndc serve-stale status' ($n)"
++ret=0
++$RNDCCMD 10.53.0.1 serve-stale status > rndc.out.test$n 2>&1 || ret=1
++grep '_default: off (rndc) (stale-answer-ttl=2 max-stale-ttl=7200)' rndc.out.test$n > /dev/null || ret=1
++if [ $ret != 0 ]; then echo "I:failed"; fi
++status=`expr $status + $ret`
++
++n=`expr $n + 1`
++echo "I:check 'rndc serve-stale' ($n)"
++ret=0
++$RNDCCMD 10.53.0.1 serve-stale > rndc.out.test$n 2>&1 && ret=1
++grep "unexpected end of input" rndc.out.test$n > /dev/null || ret=1
++if [ $ret != 0 ]; then echo "I:failed"; fi
++status=`expr $status + $ret`
++
++n=`expr $n + 1`
++echo "I:check 'rndc serve-stale unknown' ($n)"
++ret=0
++$RNDCCMD 10.53.0.1 serve-stale unknown > rndc.out.test$n 2>&1 && ret=1
++grep "syntax error" rndc.out.test$n > /dev/null || ret=1
++if [ $ret != 0 ]; then echo "I:failed"; fi
++status=`expr $status + $ret`
++
++n=`expr $n + 1`
++echo_i "flush cache, re-enable serve-stale and query again ($n)"
++ret=0
++$RNDCCMD 10.53.0.1 flushtree example > rndc.out.test$n.1 2>&1 || ret=1
++$RNDCCMD 10.53.0.1 serve-stale on > rndc.out.test$n.2 2>&1 || ret=1
++$DIG -p ${PORT} @10.53.0.1 data.example TXT > dig.out.test$n
++grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
++grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
++if [ $ret != 0 ]; then echo_i "failed"; fi
++status=`expr $status + $ret`
++
++n=`expr $n + 1`
++ret=0
++$DIG -p ${PORT} @10.53.0.2 txt enable  > dig.out.test$n
++grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
++grep "TXT.\"1\"" dig.out.test$n > /dev/null || ret=1
++if [ $ret != 0 ]; then echo "I:failed"; fi
++status=`expr $status + $ret`
++
++n=`expr $n + 1`
++echo "I:prime cache data.example (max-stale-ttl default) ($n)"
++ret=0
++$DIG -p ${PORT} @10.53.0.3 data.example TXT > dig.out.test$n
++grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
++grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
++grep "example.*1.*IN" dig.out.test$n > /dev/null || ret=1
++if [ $ret != 0 ]; then echo "I:failed"; fi
++status=`expr $status + $ret`
++
++n=`expr $n + 1`
++echo "I:prime cache nodata.example (max-stale-ttl default) ($n)"
++ret=0
++$DIG -p ${PORT} @10.53.0.3 nodata.example TXT > dig.out.test$n
++grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
++grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
++grep "example.*1.*IN" dig.out.test$n > /dev/null || ret=1
++if [ $ret != 0 ]; then echo "I:failed"; fi
++status=`expr $status + $ret`
++
++n=`expr $n + 1`
++echo "I:prime cache nxdomain.example (max-stale-ttl default) ($n)"
++ret=0
++$DIG -p ${PORT} @10.53.0.3 nxdomain.example TXT > dig.out.test$n
++grep "status: NXDOMAIN" dig.out.test$n > /dev/null || ret=1
++grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
++grep "example.*1.*IN" dig.out.test$n > /dev/null || ret=1
++if [ $ret != 0 ]; then echo "I:failed"; fi
++status=`expr $status + $ret`
++
++n=`expr $n + 1`
++echo "I:disable responses from authoritative server ($n)"
++ret=0
++$DIG -p ${PORT} @10.53.0.2 txt disable  > dig.out.test$n
++grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
++grep "TXT.\"0\"" dig.out.test$n > /dev/null || ret=1
++if [ $ret != 0 ]; then echo "I:failed"; fi
++status=`expr $status + $ret`
++
++sleep 1
++
++n=`expr $n + 1`
++echo "I:check 'rndc serve-stale status' ($n)"
++ret=0
++$RNDCCMD 10.53.0.3 serve-stale status > rndc.out.test$n 2>&1 || ret=1
++grep '_default: off (stale-answer-ttl=1 max-stale-ttl=604800)' rndc.out.test$n > /dev/null || ret=1
++if [ $ret != 0 ]; then echo "I:failed"; fi
++status=`expr $status + $ret`
++
++n=`expr $n + 1`
++echo "I:check fail of data.example (max-stale-ttl default) ($n)"
++ret=0
++$DIG -p ${PORT} @10.53.0.3 data.example TXT > dig.out.test$n
++grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
++grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
++if [ $ret != 0 ]; then echo "I:failed"; fi
++status=`expr $status + $ret`
++
++n=`expr $n + 1`
++echo "I:check fail of nodata.example (max-stale-ttl default) ($n)"
++ret=0
++$DIG -p ${PORT} @10.53.0.3 nodata.example TXT > dig.out.test$n
++grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
++grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
++if [ $ret != 0 ]; then echo "I:failed"; fi
++status=`expr $status + $ret`
++
++n=`expr $n + 1`
++echo "I:check fail of nxdomain.example (max-stale-ttl default) ($n)"
++ret=0
++$DIG -p ${PORT} @10.53.0.3 nxdomain.example TXT > dig.out.test$n
++grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
++grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
++if [ $ret != 0 ]; then echo "I:failed"; fi
++status=`expr $status + $ret`
++
++n=`expr $n + 1`
++echo "I:check 'rndc serve-stale on' ($n)"
++ret=0
++$RNDCCMD 10.53.0.3 serve-stale on > rndc.out.test$n 2>&1 || ret=1
++if [ $ret != 0 ]; then echo "I:failed"; fi
++status=`expr $status + $ret`
++
++n=`expr $n + 1`
++echo "I:check 'rndc serve-stale status' ($n)"
++ret=0
++$RNDCCMD 10.53.0.3 serve-stale status > rndc.out.test$n 2>&1 || ret=1
++grep '_default: on (rndc) (stale-answer-ttl=1 max-stale-ttl=604800)' rndc.out.test$n > /dev/null || ret=1
++if [ $ret != 0 ]; then echo "I:failed"; fi
++status=`expr $status + $ret`
++
++n=`expr $n + 1`
++echo "I:check data.example (max-stale-ttl default) ($n)"
++ret=0
++$DIG -p ${PORT} @10.53.0.3 data.example TXT > dig.out.test$n
++grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
++grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
++grep "example.*1.*IN" dig.out.test$n > /dev/null || ret=1
++if [ $ret != 0 ]; then echo "I:failed"; fi
++status=`expr $status + $ret`
++
++n=`expr $n + 1`
++echo "I:check nodata.example (max-stale-ttl default) ($n)"
++ret=0
++$DIG -p ${PORT} @10.53.0.3 nodata.example TXT > dig.out.test$n
++grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
++grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
++grep "example.*1.*IN" dig.out.test$n > /dev/null || ret=1
++if [ $ret != 0 ]; then echo "I:failed"; fi
++status=`expr $status + $ret`
++
++n=`expr $n + 1`
++echo "I:check nxdomain.example (max-stale-ttl default) ($n)"
++ret=0
++$DIG -p ${PORT} @10.53.0.3 nxdomain.example TXT > dig.out.test$n
++grep "status: NXDOMAIN" dig.out.test$n > /dev/null || ret=1
++grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
++grep "example.*1.*IN" dig.out.test$n > /dev/null || ret=1
++if [ $ret != 0 ]; then echo "I:failed"; fi
++status=`expr $status + $ret`
++
++echo "I:exit status: $status"
++[ $status -eq 0 ] || exit 1
+diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
+index c161e71058..ec1f6f591d 100644
+--- a/doc/arm/Bv9ARM-book.xml
++++ b/doc/arm/Bv9ARM-book.xml
+@@ -4376,6 +4376,9 @@ badresp:1,adberr:0,findfail:0,valfail:0]
+ 	  statement in the <filename>named.conf</filename> file:
+ 	</para>
+ 	<xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="options.grammar.xml"/>
++  [ <command>max-stale-ttl</command> <replaceable>number</replaceable> ; ]
++  [ <command>stale-answer-enable</command> <replaceable>yes_or_no</replaceable> ; ]
++  [ <command>stale-answer-ttl</command> <replaceable>number</replaceable> ; ]
+       </section>
+ 
+       <section xml:id="options"><info><title><command>options</command> Statement Definition and
+@@ -4469,6 +4472,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
+ 		  <command>dnssec-validation</command>,
+ 		  <command>max-cache-ttl</command>,
+ 		  <command>max-ncache-ttl</command>,
++		  <command>max-stale-ttl</command>,
+ 		  <command>max-cache-size</command>, and
+ 		  <command>zero-no-soa-ttl</command>.
+ 		</para>
+@@ -5480,7 +5484,6 @@ options {
+ 	    </listitem>
+ 	  </varlistentry>
+ 
+-
+ 	  <varlistentry>
+ 	    <term><command>max-zone-ttl</command></term>
+ 	    <listitem>
+@@ -5516,6 +5519,21 @@ options {
+ 	    </listitem>
+ 	  </varlistentry>
+ 
++	  <varlistentry>
++	    <term><command>stale-answer-ttl</command></term>
++	    <listitem>
++	      <para>
++		Specifies the TTL to be returned on stale answers.
++		The default is 1 second. The minimal allowed is
++		also 1 second; a value of 0 will be updated silently
++		to 1 second.  For stale answers to be returned
++		<option>max-stale-ttl</option> must be set to a
++		non zero value and they must not have been disabled
++		by <command>rndc</command>.
++	      </para>
++	    </listitem>
++	  </varlistentry>
++
+ 	  <varlistentry>
+ 	    <term><command>serial-update-method</command></term>
+ 	    <listitem>
+@@ -6257,6 +6275,22 @@ options {
+ 	      </listitem>
+ 	    </varlistentry>
+ 
++	    <varlistentry>
++	      <term><command>serve-stale-enable</command></term>
++	      <listitem>
++		<para>
++		  Enable the returning of stale answers when the
++		  nameservers for the zone are not answering.  This
++		  is off by default but can be enabled/disabled via
++		  <command>rndc server-stale on</command> and
++		  <command>rndc server-stale off</command> which
++		  override the named.conf setting.  <command>rndc
++		  server-stale reset</command> will restore control
++		  via named.conf.
++		</para>
++	      </listitem>
++	    </varlistentry>
++
+ 	    <varlistentry>
+ 	      <term><command>nocookie-udp-size</command></term>
+ 	      <listitem>
+@@ -7465,14 +7499,20 @@ options {
+ 	      <term><command>resolver-query-timeout</command></term>
+ 	      <listitem>
+ 		<para>
+-		  The amount of time in seconds that the resolver
++		  The amount of time in milliseconds that the resolver
+ 		  will spend attempting to resolve a recursive
+ 		  query before failing.  The default and minimum
+-		  is <literal>10</literal> and the maximum is
+-		  <literal>30</literal>.  Setting it to
++		  is <literal>10000</literal> and the maximum is
++		  <literal>30000</literal>.  Setting it to
+ 		  <literal>0</literal> will result in the default
+ 		  being used.
+ 		</para>
++		<para>
++		  This value was originally specified in seconds.
++		  Values less than or equal to 300 will be be treated
++		  as seconds and converted to milliseconds before
++		  applying the above limits.
++		</para>
+ 	      </listitem>
+ 	    </varlistentry>
+ 	  </variablelist>
+@@ -8956,6 +8996,27 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
+ 	      </listitem>
+ 	    </varlistentry>
+ 
++	    <varlistentry>
++	      <term><command>max-stale-ttl</command></term>
++	      <listitem>
++		<para>
++		  Sets the maximum time for which the server will
++		  retain records past their normal expiry to
++		  return them as stale records when the servers
++		  for those records are not reachable.  The default
++		  is to not retain the record.
++		</para>
++		<para>
++		  <command>rndc serve-stale</command> can be used
++		  to disable and re-enable the serving of stale
++		  records at runtime.  Reloading or reconfiguring
++		  <command>named</command> will not re-enable serving
++		  of stale records if they have been disabled via
++		  <command>rndc</command>.
++		</para>
++	      </listitem>
++	    </varlistentry>
++
+ 	    <varlistentry>
+ 	      <term><command>min-roots</command></term>
+ 	      <listitem>
+diff --git a/doc/arm/logging-categories.xml b/doc/arm/logging-categories.xml
+index 181def7077..59f6afb049 100644
+--- a/doc/arm/logging-categories.xml
++++ b/doc/arm/logging-categories.xml
+@@ -311,6 +311,17 @@
+ 	  </para>
+ 	</entry>
+       </row>
++      <row rowsep="0">
++	<entry colname="1">
++	  <para><command>serve-stale</command></para>
++	</entry>
++	<entry colname="2">
++	  <para>
++	    Whether or not a stale answer is used
++	    following a resolver failure.
++	  </para>
++	</entry>
++      </row>
+       <row rowsep="0">
+ 	<entry colname="1">
+ 	  <para><command>spill</command></para>
+diff --git a/doc/arm/notes-rh-changes.xml b/doc/arm/notes-rh-changes.xml
+index 11c3a7ccd5..ba3c2cce9c 100644
+--- a/doc/arm/notes-rh-changes.xml
++++ b/doc/arm/notes-rh-changes.xml
+@@ -13,6 +13,9 @@
+ <section xml:id="relnotes_rh_changes"><info><title>Red Hat Specific Changes</title></info>
+   <itemizedlist>
+      <listitem>
++      <para>
++        This version includes some features not present in releases by ISC.
++      </para>
+       <para>
+         By default, BIND now uses the random number generation functions
+         in the cryptographic library (i.e., OpenSSL or a PKCS#11
+@@ -37,7 +40,16 @@
+         case <filename>/dev/random</filename> will be the default
+         entropy source.  [RT #31459] [RT #46047]
+       </para>
+-    </listitem>
++      <para>
++        When acting as a recursive resolver, <command>named</command>
++        can now continue returning answers whose TTLs have expired
++        when the authoritative server is under attack and unable to
++        respond. This is controlled by the
++        <command>stale-answer-enable</command>,
++        <command>stale-answer-ttl</command> and
++        <command>max-stale-ttl</command> options. [RT #44790]
++      </para>
++     </listitem>
+   </itemizedlist>
+ </section>
+ 
+diff --git a/doc/misc/options b/doc/misc/options
+index e11beed292..fde93c7093 100644
+--- a/doc/misc/options
++++ b/doc/misc/options
+@@ -225,6 +225,7 @@ options {
+         max-refresh-time <integer>;
+         max-retry-time <integer>;
+         max-rsa-exponent-size <integer>;
++        max-stale-ttl <ttlval>;
+         max-transfer-idle-in <integer>;
+         max-transfer-idle-out <integer>;
+         max-transfer-time-in <integer>;
+@@ -298,7 +299,9 @@ options {
+         request-sit <boolean>; // obsolete
+         require-server-cookie <boolean>;
+         reserved-sockets <integer>;
++        resolver-nonbackoff-tries <integer>;
+         resolver-query-timeout <integer>;
++        resolver-retry-interval <integer>;
+         response-policy { zone <string> [ log <boolean> ] [ max-policy-ttl
+             <integer> ] [ policy ( cname | disabled | drop | given | no-op
+             | nodata | nxdomain | passthru | tcp-only <quoted_string> ) ] [
+@@ -328,6 +331,8 @@ options {
+         sit-secret <string>; // obsolete
+         sortlist { <address_match_element>; ... };
+         stacksize ( default | unlimited | <sizeval> );
++        stale-answer-enable <boolean>;
++        stale-answer-ttl <ttlval>;
+         startup-notify-rate <integer>;
+         statistics-file <quoted_string>;
+         statistics-interval <integer>; // not yet implemented
+@@ -539,6 +544,7 @@ view <string> [ <class> ] {
+         max-recursion-queries <integer>;
+         max-refresh-time <integer>;
+         max-retry-time <integer>;
++        max-stale-ttl <ttlval>;
+         max-transfer-idle-in <integer>;
+         max-transfer-idle-out <integer>;
+         max-transfer-time-in <integer>;
+@@ -600,7 +606,9 @@ view <string> [ <class> ] {
+         request-nsid <boolean>;
+         request-sit <boolean>; // obsolete
+         require-server-cookie <boolean>;
++        resolver-nonbackoff-tries <integer>;
+         resolver-query-timeout <integer>;
++        resolver-retry-interval <integer>;
+         response-policy { zone <string> [ log <boolean> ] [ max-policy-ttl
+             <integer> ] [ policy ( cname | disabled | drop | given | no-op
+             | nodata | nxdomain | passthru | tcp-only <quoted_string> ) ] [
+@@ -655,6 +663,8 @@ view <string> [ <class> ] {
+         sig-signing-type <integer>;
+         sig-validity-interval <integer> [ <integer> ];
+         sortlist { <address_match_element>; ... };
++        stale-answer-enable <boolean>;
++        stale-answer-ttl <ttlval>;
+         suppress-initial-notify <boolean>; // not yet implemented
+         topology { <address_match_element>; ... }; // not implemented
+         transfer-format ( many-answers | one-answer );
+diff --git a/lib/bind9/check.c b/lib/bind9/check.c
+index e0803d4fa6..296e364bd9 100644
+--- a/lib/bind9/check.c
++++ b/lib/bind9/check.c
+@@ -99,7 +99,8 @@ check_orderent(const cfg_obj_t *ent, isc_log_t *logctx) {
+ 			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
+ 				    "rrset-order: invalid class '%s'",
+ 				    r.base);
+-			result = ISC_R_FAILURE;
++			if (result == ISC_R_SUCCESS)
++				result = ISC_R_FAILURE;
+ 		}
+ 	}
+ 
+@@ -112,7 +113,8 @@ check_orderent(const cfg_obj_t *ent, isc_log_t *logctx) {
+ 			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
+ 				    "rrset-order: invalid type '%s'",
+ 				    r.base);
+-			result = ISC_R_FAILURE;
++			if (result == ISC_R_SUCCESS)
++				result = ISC_R_FAILURE;
+ 		}
+ 	}
+ 
+@@ -126,7 +128,8 @@ check_orderent(const cfg_obj_t *ent, isc_log_t *logctx) {
+ 		if (tresult != ISC_R_SUCCESS) {
+ 			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
+ 				    "rrset-order: invalid name '%s'", str);
+-			result = ISC_R_FAILURE;
++			if (result == ISC_R_SUCCESS)
++				result = ISC_R_FAILURE;
+ 		}
+ 	}
+ 
+@@ -135,14 +138,16 @@ check_orderent(const cfg_obj_t *ent, isc_log_t *logctx) {
+ 	    strcasecmp("order", cfg_obj_asstring(obj)) != 0) {
+ 		cfg_obj_log(ent, logctx, ISC_LOG_ERROR,
+ 			    "rrset-order: keyword 'order' missing");
+-		result = ISC_R_FAILURE;
++		if (result == ISC_R_SUCCESS)
++			result = ISC_R_FAILURE;
+ 	}
+ 
+ 	obj = cfg_tuple_get(ent, "ordering");
+ 	if (!cfg_obj_isstring(obj)) {
+ 	    cfg_obj_log(ent, logctx, ISC_LOG_ERROR,
+ 			"rrset-order: missing ordering");
+-		result = ISC_R_FAILURE;
++		if (result == ISC_R_SUCCESS)
++			result = ISC_R_FAILURE;
+ 	} else if (strcasecmp(cfg_obj_asstring(obj), "fixed") == 0) {
+ #if !DNS_RDATASET_FIXED
+ 		cfg_obj_log(obj, logctx, ISC_LOG_WARNING,
+@@ -154,7 +159,8 @@ check_orderent(const cfg_obj_t *ent, isc_log_t *logctx) {
+ 		cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
+ 			    "rrset-order: invalid order '%s'",
+ 			    cfg_obj_asstring(obj));
+-		result = ISC_R_FAILURE;
++		if (result == ISC_R_SUCCESS)
++			result = ISC_R_FAILURE;
+ 	}
+ 	return (result);
+ }
+@@ -174,7 +180,7 @@ check_order(const cfg_obj_t *options, isc_log_t *logctx) {
+ 	     element = cfg_list_next(element))
+ 	{
+ 		tresult = check_orderent(cfg_listelt_value(element), logctx);
+-		if (tresult != ISC_R_SUCCESS)
++		if (result == ISC_R_SUCCESS && tresult != ISC_R_SUCCESS)
+ 			result = tresult;
+ 	}
+ 	return (result);
+@@ -204,7 +210,8 @@ check_dual_stack(const cfg_obj_t *options, isc_log_t *logctx) {
+ 		if (val > UINT16_MAX) {
+ 			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
+ 				    "port '%u' out of range", val);
+-			result = ISC_R_FAILURE;
++			if (result == ISC_R_SUCCESS)
++				result = ISC_R_RANGE;
+ 		}
+ 	}
+ 	obj = cfg_tuple_get(alternates, "addresses");
+@@ -224,7 +231,8 @@ check_dual_stack(const cfg_obj_t *options, isc_log_t *logctx) {
+ 		if (tresult != ISC_R_SUCCESS) {
+ 			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
+ 				    "bad name '%s'", str);
+-			result = ISC_R_FAILURE;
++			if (result == ISC_R_SUCCESS)
++				result = tresult;
+ 		}
+ 		obj = cfg_tuple_get(value, "port");
+ 		if (cfg_obj_isuint32(obj)) {
+@@ -232,7 +240,8 @@ check_dual_stack(const cfg_obj_t *options, isc_log_t *logctx) {
+ 			if (val > UINT16_MAX) {
+ 				cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
+ 					    "port '%u' out of range", val);
+-				result = ISC_R_FAILURE;
++				if (result == ISC_R_SUCCESS)
++					result = ISC_R_RANGE;
+ 			}
+ 		}
+ 	}
+@@ -1267,7 +1276,8 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
+ 			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
+ 				    "auto-dnssec may only be activated at the "
+ 				    "zone level");
+-			result = ISC_R_FAILURE;
++			if (result == ISC_R_SUCCESS)
++				result = ISC_R_FAILURE;
+ 		}
+ 	}
+ 
+@@ -1287,7 +1297,7 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
+ 		{
+ 			obj = cfg_listelt_value(element);
+ 			tresult = mustbesecure(obj, symtab, logctx, mctx);
+-			if (tresult != ISC_R_SUCCESS)
++			if (result == ISC_R_SUCCESS && tresult != ISC_R_SUCCESS)
+ 				result = tresult;
+ 		}
+ 		if (symtab != NULL)
+@@ -1306,7 +1316,8 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
+ 				cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
+ 					    "%s: invalid name '%s'",
+ 					    server_contact[i], str);
+-				result = ISC_R_FAILURE;
++				if (result == ISC_R_SUCCESS)
++					result = ISC_R_FAILURE;
+ 			}
+ 		}
+ 	}
+@@ -1326,7 +1337,8 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
+ 			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
+ 				    "disable-empty-zone: invalid name '%s'",
+ 				    str);
+-			result = ISC_R_FAILURE;
++			if (result == ISC_R_SUCCESS)
++				result = ISC_R_FAILURE;
+ 		}
+ 	}
+ 
+@@ -1340,11 +1352,12 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
+ 	    strlen(cfg_obj_asstring(obj)) > 1024U) {
+ 		cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
+ 			    "'server-id' too big (>1024 bytes)");
+-		result = ISC_R_FAILURE;
++		if (result == ISC_R_SUCCESS)
++			result = ISC_R_FAILURE;
+ 	}
+ 
+ 	tresult = check_dscp(options, logctx);
+-	if (tresult != ISC_R_SUCCESS)
++	if (result == ISC_R_SUCCESS && tresult != ISC_R_SUCCESS)
+ 		result = tresult;
+ 
+ 	obj = NULL;
+@@ -1354,11 +1367,13 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
+ 		if (lifetime > 604800) {	/* 7 days */
+ 			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
+ 				    "'nta-lifetime' cannot exceed one week");
+-			result = ISC_R_RANGE;
++			if (result == ISC_R_SUCCESS)
++				result = ISC_R_RANGE;
+ 		} else if (lifetime == 0) {
+ 			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
+ 				    "'nta-lifetime' may not be zero");
+-			result = ISC_R_RANGE;
++			if (result == ISC_R_SUCCESS)
++				result = ISC_R_RANGE;
+ 		}
+ 	}
+ 
+@@ -1369,7 +1384,8 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
+ 		if (recheck > 604800) {		/* 7 days */
+ 			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
+ 				    "'nta-recheck' cannot exceed one week");
+-			result = ISC_R_RANGE;
++			if (result == ISC_R_SUCCESS)
++				result = ISC_R_RANGE;
+ 		}
+ 
+ 		if (recheck > lifetime)
+@@ -1387,7 +1403,8 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
+ 	if (strcasecmp(ccalg, "aes") == 0) {
+ 		cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
+ 			    "cookie-algorithm: '%s' not supported", ccalg);
+-		result = ISC_R_NOTIMPLEMENTED;
++		if (result == ISC_R_SUCCESS)
++			result = ISC_R_NOTIMPLEMENTED;
+ 	}
+ #endif
+ 
+@@ -1476,7 +1493,8 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
+ 				cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
+ 					    "%s out of range (%u < %u)",
+ 					    fstrm[i].name, value, fstrm[i].min);
+-			result = ISC_R_RANGE;
++			if (result == ISC_R_SUCCESS)
++				result = ISC_R_RANGE;
+ 		}
+ 
+ 		if (strcmp(fstrm[i].name, "fstrm-set-input-queue-size") == 0) {
+@@ -1490,7 +1508,8 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
+ 					    "%s '%u' not a power-of-2",
+ 					    fstrm[i].name,
+ 					    cfg_obj_asuint32(obj));
+-				result = ISC_R_RANGE;
++				if (result == ISC_R_SUCCESS)
++					result = ISC_R_RANGE;
+ 			}
+ 		}
+ 	}
+@@ -1523,7 +1542,8 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
+ 				    "%" PRId64 "' "
+ 				    "is too small",
+ 				    mapsize);
+-			return (ISC_R_RANGE);
++			if (result == ISC_R_SUCCESS)
++				result = ISC_R_RANGE;
+ 		} else if (mapsize > (1ULL << 40)) { /* 1 terabyte */
+ 			cfg_obj_log(obj, logctx,
+ 				    ISC_LOG_ERROR,
+@@ -1531,10 +1551,20 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
+ 				    "%" PRId64 "' "
+ 				    "is too large",
+ 				    mapsize);
+-			return (ISC_R_RANGE);
++			if (result == ISC_R_SUCCESS)
++				result = ISC_R_RANGE;
+ 		}
+ 	}
+ 
++	obj = NULL;
++	(void)cfg_map_get(options, "resolver-nonbackoff-tries", &obj);
++	if (obj != NULL && cfg_obj_asuint32(obj) == 0U) {
++		cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
++			    "'resolver-nonbackoff-tries' must be >= 1");
++		if (result == ISC_R_SUCCESS)
++			result = ISC_R_RANGE;
++	}
++
+ 	return (result);
+ }
+ 
+diff --git a/lib/dns/cache.c b/lib/dns/cache.c
+index 4701ff8574..97e427a53c 100644
+--- a/lib/dns/cache.c
++++ b/lib/dns/cache.c
+@@ -138,6 +138,7 @@ struct dns_cache {
+ 	int			db_argc;
+ 	char			**db_argv;
+ 	size_t			size;
++	dns_ttl_t		serve_stale_ttl;
+ 	isc_stats_t		*stats;
+ 
+ 	/* Locked by 'filelock'. */
+@@ -167,9 +168,13 @@ overmem_cleaning_action(isc_task_t *task, isc_event_t *event);
+ 
+ static inline isc_result_t
+ cache_create_db(dns_cache_t *cache, dns_db_t **db) {
+-	return (dns_db_create(cache->mctx, cache->db_type, dns_rootname,
+-			      dns_dbtype_cache, cache->rdclass,
+-			      cache->db_argc, cache->db_argv, db));
++	isc_result_t result;
++	result = dns_db_create(cache->mctx, cache->db_type, dns_rootname,
++			       dns_dbtype_cache, cache->rdclass,
++			       cache->db_argc, cache->db_argv, db);
++	if (result == ISC_R_SUCCESS)
++		dns_db_setservestalettl(*db, cache->serve_stale_ttl);
++	return (result);
+ }
+ 
+ isc_result_t
+@@ -238,6 +243,7 @@ dns_cache_create3(isc_mem_t *cmctx, isc_mem_t *hmctx, isc_taskmgr_t *taskmgr,
+ 	cache->references = 1;
+ 	cache->live_tasks = 0;
+ 	cache->rdclass = rdclass;
++	cache->serve_stale_ttl = 0;
+ 
+ 	cache->stats = NULL;
+ 	result = isc_stats_create(cmctx, &cache->stats,
+@@ -1092,6 +1098,32 @@ dns_cache_getcachesize(dns_cache_t *cache) {
+ 	return (size);
+ }
+ 
++void
++dns_cache_setservestalettl(dns_cache_t *cache, dns_ttl_t ttl) {
++	REQUIRE(VALID_CACHE(cache));
++
++	LOCK(&cache->lock);
++	cache->serve_stale_ttl = ttl;
++	UNLOCK(&cache->lock);
++
++	(void)dns_db_setservestalettl(cache->db, ttl);
++}
++
++dns_ttl_t
++dns_cache_getservestalettl(dns_cache_t *cache) {
++	dns_ttl_t ttl;
++	isc_result_t result;
++
++	REQUIRE(VALID_CACHE(cache));
++
++	/*
++	 * Could get it straight from the dns_cache_t, but use db
++	 * to confirm the value that the db is really using.
++	 */
++	result = dns_db_getservestalettl(cache->db, &ttl);
++	return result == ISC_R_SUCCESS ? ttl : 0;
++}
++
+ /*
+  * The cleaner task is shutting down; do the necessary cleanup.
+  */
+diff --git a/lib/dns/db.c b/lib/dns/db.c
+index ee3e00d53c..576aa65992 100644
+--- a/lib/dns/db.c
++++ b/lib/dns/db.c
+@@ -1130,3 +1130,25 @@ dns_db_nodefullname(dns_db_t *db, dns_dbnode_t *node, dns_name_t *name) {
+ 		return (ISC_R_NOTIMPLEMENTED);
+ 	return ((db->methods->nodefullname)(db, node, name));
+ }
++
++isc_result_t
++dns_db_setservestalettl(dns_db_t *db, dns_ttl_t ttl)
++{
++	REQUIRE(DNS_DB_VALID(db));
++	REQUIRE((db->attributes & DNS_DBATTR_CACHE) != 0);
++
++	if (db->methods->setservestalettl != NULL)
++		return ((db->methods->setservestalettl)(db, ttl));
++	return (ISC_R_NOTIMPLEMENTED);
++}
++
++isc_result_t
++dns_db_getservestalettl(dns_db_t *db, dns_ttl_t *ttl)
++{
++	REQUIRE(DNS_DB_VALID(db));
++	REQUIRE((db->attributes & DNS_DBATTR_CACHE) != 0);
++
++	if (db->methods->getservestalettl != NULL)
++		return ((db->methods->getservestalettl)(db, ttl));
++	return (ISC_R_NOTIMPLEMENTED);
++}
+diff --git a/lib/dns/ecdb.c b/lib/dns/ecdb.c
+index 6e5a4ae4e4..3aa0ac478d 100644
+--- a/lib/dns/ecdb.c
++++ b/lib/dns/ecdb.c
+@@ -588,7 +588,9 @@ static dns_dbmethods_t ecdb_methods = {
+ 	NULL,			/* setcachestats */
+ 	NULL,			/* hashsize */
+ 	NULL,			/* nodefullname */
+-	NULL			/* getsize */
++	NULL,			/* getsize */
++	NULL,			/* setservestalettl */
++	NULL			/* getservestalettl */
+ };
+ 
+ static isc_result_t
+diff --git a/lib/dns/include/dns/cache.h b/lib/dns/include/dns/cache.h
+index 62797dbbd4..714b78eb74 100644
+--- a/lib/dns/include/dns/cache.h
++++ b/lib/dns/include/dns/cache.h
+@@ -260,6 +260,27 @@ dns_cache_getcachesize(dns_cache_t *cache);
+  * Get the maximum cache size.
+  */
+ 
++void
++dns_cache_setservestalettl(dns_cache_t *cache, dns_ttl_t ttl);
++/*%<
++ * Sets the maximum length of time that cached answers may be retained
++ * past their normal TTL.  Default value for the library is 0, disabling
++ * the use of stale data.
++ *
++ * Requires:
++ *\li	'cache' to be valid.
++ */
++
++dns_ttl_t
++dns_cache_getservestalettl(dns_cache_t *cache);
++/*%<
++ * Gets the maximum length of time that cached answers may be kept past
++ * normal expiry.
++ *
++ * Requires:
++ *\li	'cache' to be valid.
++ */
++
+ isc_result_t
+ dns_cache_flush(dns_cache_t *cache);
+ /*%<
+diff --git a/lib/dns/include/dns/db.h b/lib/dns/include/dns/db.h
+index ae6ae36596..5079053d91 100644
+--- a/lib/dns/include/dns/db.h
++++ b/lib/dns/include/dns/db.h
+@@ -197,6 +197,8 @@ typedef struct dns_dbmethods {
+ 					dns_name_t *name);
+ 	isc_result_t	(*getsize)(dns_db_t *db, dns_dbversion_t *version,
+ 				   uint64_t *records, uint64_t *bytes);
++	isc_result_t	(*setservestalettl)(dns_db_t *db, dns_ttl_t ttl);
++	isc_result_t	(*getservestalettl)(dns_db_t *db, dns_ttl_t *ttl);
+ } dns_dbmethods_t;
+ 
+ typedef isc_result_t
+@@ -255,6 +257,7 @@ struct dns_dbonupdatelistener {
+ #define DNS_DBFIND_FORCENSEC3		0x0080
+ #define DNS_DBFIND_ADDITIONALOK		0x0100
+ #define DNS_DBFIND_NOZONECUT		0x0200
++#define DNS_DBFIND_STALEOK		0x0400
+ /*@}*/
+ 
+ /*@{*/
+@@ -1685,6 +1688,38 @@ dns_db_nodefullname(dns_db_t *db, dns_dbnode_t *node, dns_name_t *name);
+  * \li	'db' is a valid database
+  * \li	'node' and 'name' are not NULL
+  */
++
++isc_result_t
++dns_db_setservestalettl(dns_db_t *db, dns_ttl_t ttl);
++/*%<
++ * Sets the maximum length of time that cached answers may be retained
++ * past their normal TTL. Default value for the library is 0, disabling
++ * the use of stale data.
++ *
++ * Requires:
++ * \li	'db' is a valid cache database.
++ * \li	'ttl' is the number of seconds to retain data past its normal expiry.
++ *
++ * Returns:
++ * \li	#ISC_R_SUCCESS
++ * \li	#ISC_R_NOTIMPLEMENTED - Not supported by this DB implementation.
++ */
++
++isc_result_t
++dns_db_getservestalettl(dns_db_t *db, dns_ttl_t *ttl);
++/*%<
++ * Gets maximum length of time that cached answers may be kept past
++ * normal TTL expiration.
++ *
++ * Requires:
++ * \li	'db' is a valid cache database.
++ * \li	'ttl' is the number of seconds to retain data past its normal expiry.
++ *
++ * Returns:
++ * \li	#ISC_R_SUCCESS
++ * \li	#ISC_R_NOTIMPLEMENTED - Not supported by this DB implementation.
++ */
++
+ ISC_LANG_ENDDECLS
+ 
+ #endif /* DNS_DB_H */
+diff --git a/lib/dns/include/dns/rdataset.h b/lib/dns/include/dns/rdataset.h
+index 5295d8e4d7..97071ed496 100644
+--- a/lib/dns/include/dns/rdataset.h
++++ b/lib/dns/include/dns/rdataset.h
+@@ -128,6 +128,7 @@ struct dns_rdataset {
+ 	unsigned int			magic;		/* XXX ? */
+ 	dns_rdatasetmethods_t *		methods;
+ 	ISC_LINK(dns_rdataset_t)	link;
++
+ 	/*
+ 	 * XXX do we need these, or should they be retrieved by methods?
+ 	 * Leaning towards the latter, since they are not frequently required
+@@ -136,12 +137,19 @@ struct dns_rdataset {
+ 	dns_rdataclass_t		rdclass;
+ 	dns_rdatatype_t			type;
+ 	dns_ttl_t			ttl;
++	/*
++	 * Stale ttl is used to see how long this RRset can still be used
++	 * to serve to clients, after the TTL has expired.
++	 */
++	dns_ttl_t			stale_ttl;
+ 	dns_trust_t			trust;
+ 	dns_rdatatype_t			covers;
++
+ 	/*
+ 	 * attributes
+ 	 */
+ 	unsigned int			attributes;
++
+ 	/*%
+ 	 * the counter provides the starting point in the "cyclic" order.
+ 	 * The value UINT32_MAX has a special meaning of "picking up a
+@@ -149,11 +157,13 @@ struct dns_rdataset {
+ 	 * increment the counter.
+ 	 */
+ 	uint32_t			count;
++
+ 	/*
+ 	 * This RRSIG RRset should be re-generated around this time.
+ 	 * Only valid if DNS_RDATASETATTR_RESIGN is set in attributes.
+ 	 */
+ 	isc_stdtime_t			resign;
++
+ 	/*@{*/
+ 	/*%
+ 	 * These are for use by the rdataset implementation, and MUST NOT
+@@ -206,6 +216,7 @@ struct dns_rdataset {
+ #define DNS_RDATASETATTR_OPTOUT		0x00100000	/*%< OPTOUT proof */
+ #define DNS_RDATASETATTR_NEGATIVE	0x00200000
+ #define DNS_RDATASETATTR_PREFETCH	0x00400000
++#define DNS_RDATASETATTR_STALE		0x01000000
+ 
+ /*%
+  * _OMITDNSSEC:
+diff --git a/lib/dns/include/dns/resolver.h b/lib/dns/include/dns/resolver.h
+index 6da41b7a5a..7b397cb6d2 100644
+--- a/lib/dns/include/dns/resolver.h
++++ b/lib/dns/include/dns/resolver.h
+@@ -547,9 +547,12 @@ dns_resolver_getmustbesecure(dns_resolver_t *resolver, dns_name_t *name);
+ 
+ 
+ void
+-dns_resolver_settimeout(dns_resolver_t *resolver, unsigned int seconds);
++dns_resolver_settimeout(dns_resolver_t *resolver, unsigned int timeout);
+ /*%<
+- * Set the length of time the resolver will work on a query, in seconds.
++ * Set the length of time the resolver will work on a query, in milliseconds.
++ *
++ * 'timeout' was originally defined in seconds, and later redefined to be in
++ * milliseconds.  Values less than or equal to 300 are treated as seconds.
+  *
+  * If timeout is 0, the default timeout will be applied.
+  *
+@@ -560,7 +563,8 @@ dns_resolver_settimeout(dns_resolver_t *resolver, unsigned int seconds);
+ unsigned int
+ dns_resolver_gettimeout(dns_resolver_t *resolver);
+ /*%<
+- * Get the current length of time the resolver will work on a query, in seconds.
++ * Get the current length of time the resolver will work on a query,
++ * in milliseconds.
+  *
+  * Requires:
+  * \li  resolver to be valid.
+@@ -582,6 +586,39 @@ dns_resolver_getzeronosoattl(dns_resolver_t *resolver);
+ void
+ dns_resolver_setzeronosoattl(dns_resolver_t *resolver, bool state);
+ 
++unsigned int
++dns_resolver_getretryinterval(dns_resolver_t *resolver);
++
++void
++dns_resolver_setretryinterval(dns_resolver_t *resolver, unsigned int interval);
++/*%<
++ * Sets the amount of time, in millseconds, that is waited for a reply
++ * to a server before another server is tried.  Interacts with the
++ * value of dns_resolver_getnonbackofftries() by trying that number of times
++ * at this interval, before doing exponential backoff and doubling the interval
++ * on each subsequent try, to a maximum of 10 seconds.  Defaults to 800 ms;
++ * silently capped at 2000 ms.
++ *
++ * Requires:
++ * \li	resolver to be valid.
++ * \li  interval > 0.
++ */
++
++unsigned int
++dns_resolver_getnonbackofftries(dns_resolver_t *resolver);
++
++void
++dns_resolver_setnonbackofftries(dns_resolver_t *resolver, unsigned int tries);
++/*%<
++ * Sets the number of failures of getting a reply from remote servers for
++ * a query before backing off by doubling the retry interval for each
++ * subsequent request sent.  Defaults to 3.
++ *
++ * Requires:
++ * \li	resolver to be valid.
++ * \li  tries > 0.
++ */
++
+ unsigned int
+ dns_resolver_getoptions(dns_resolver_t *resolver);
+ 
+diff --git a/lib/dns/include/dns/types.h b/lib/dns/include/dns/types.h
+index 567e8a879e..7bf2b60d42 100644
+--- a/lib/dns/include/dns/types.h
++++ b/lib/dns/include/dns/types.h
+@@ -385,6 +385,12 @@ typedef enum {
+ 	dns_updatemethod_date
+ } dns_updatemethod_t;
+ 
++typedef enum {
++	dns_stale_answer_no,
++	dns_stale_answer_yes,
++	dns_stale_answer_conf
++} dns_stale_answer_t;
++
+ /*
+  * Functions.
+  */
+diff --git a/lib/dns/include/dns/view.h b/lib/dns/include/dns/view.h
+index c849dec154..647ca2ac08 100644
+--- a/lib/dns/include/dns/view.h
++++ b/lib/dns/include/dns/view.h
+@@ -229,6 +229,9 @@ struct dns_view {
+ 	dns_dtenv_t			*dtenv;		/* Dnstap environment */
+ 	dns_dtmsgtype_t			dttypes;	/* Dnstap message types
+ 							   to log */
++	dns_ttl_t			staleanswerttl;
++	dns_stale_answer_t		staleanswersok;		/* rndc setting */
++	bool				staleanswersenable;	/* named.conf setting */
+ };
+ 
+ #define DNS_VIEW_MAGIC			ISC_MAGIC('V','i','e','w')
+diff --git a/lib/dns/master.c b/lib/dns/master.c
+index 2a87bca3bc..ac4bb195ca 100644
+--- a/lib/dns/master.c
++++ b/lib/dns/master.c
+@@ -1948,12 +1948,18 @@ load_text(dns_loadctx_t *lctx) {
+ 
+ 		if ((lctx->options & DNS_MASTER_AGETTL) != 0) {
+ 			/*
+-			 * Adjust the TTL for $DATE.  If the RR has already
+-			 * expired, ignore it.
++			 * Adjust the TTL for $DATE. If the RR has
++			 * already expired, set its TTL to 0. This
++			 * should be okay even if the TTL stretching
++			 * feature is not in effect, because it will
++			 * just be quickly expired by the cache, and the
++			 * way this was written before the patch it
++			 * could potentially add 0 TTLs anyway.
+ 			 */
+ 			if (lctx->ttl < ttl_offset)
+-				continue;
+-			lctx->ttl -= ttl_offset;
++				lctx->ttl = 0;
++			else
++				lctx->ttl -= ttl_offset;
+ 		}
+ 
+ 		/*
+diff --git a/lib/dns/masterdump.c b/lib/dns/masterdump.c
+index 7edef6ad9b..daf355748b 100644
+--- a/lib/dns/masterdump.c
++++ b/lib/dns/masterdump.c
+@@ -81,6 +81,9 @@ struct dns_master_style {
+  */
+ #define DNS_TOTEXT_LINEBREAK_MAXLEN 100
+ 
++/*% Does the rdataset 'r' contain a stale answer? */
++#define STALE(r) (((r)->attributes & DNS_RDATASETATTR_STALE) != 0)
++
+ /*%
+  * Context structure for a masterfile dump in progress.
+  */
+@@ -94,6 +97,7 @@ typedef struct dns_totext_ctx {
+ 	dns_fixedname_t		origin_fixname;
+ 	uint32_t 		current_ttl;
+ 	bool 			current_ttl_valid;
++	dns_ttl_t		serve_stale_ttl;
+ } dns_totext_ctx_t;
+ 
+ LIBDNS_EXTERNAL_DATA const dns_master_style_t
+@@ -386,6 +390,7 @@ totext_ctx_init(const dns_master_style_t *style, dns_totext_ctx_t *ctx) {
+ 	ctx->neworigin = NULL;
+ 	ctx->current_ttl = 0;
+ 	ctx->current_ttl_valid = false;
++	ctx->serve_stale_ttl = 0;
+ 
+ 	return (ISC_R_SUCCESS);
+ }
+@@ -1036,6 +1041,11 @@ dump_rdatasets_text(isc_mem_t *mctx, dns_name_t *name,
+ 		    (ctx->style.flags & DNS_STYLEFLAG_NCACHE) == 0) {
+ 			/* Omit negative cache entries */
+ 		} else {
++			if (STALE(rds)) {
++				fprintf(f, "; stale (for %u more seconds)\n",
++					(rds->stale_ttl -
++					 ctx->serve_stale_ttl));
++			}
+ 			isc_result_t result =
+ 				dump_rdataset(mctx, name, rds, ctx,
+ 					       buffer, f);
+@@ -1504,6 +1514,16 @@ dumpctx_create(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version,
+ 	dns_db_attach(db, &dctx->db);
+ 
+ 	dctx->do_date = dns_db_iscache(dctx->db);
++	if (dctx->do_date) {
++		/*
++		 * Adjust the date backwards by the serve-stale TTL, if any.
++		 * This is so the TTL will be loaded correctly when next
++		 * started.
++		 */
++		(void)dns_db_getservestalettl(dctx->db,
++					      &dctx->tctx.serve_stale_ttl);
++		dctx->now -= dctx->tctx.serve_stale_ttl;
++	}
+ 
+ 	if (dctx->format == dns_masterformat_text &&
+ 	    (dctx->tctx.style.flags & DNS_STYLEFLAG_REL_OWNER) != 0) {
+@@ -1563,6 +1583,9 @@ writeheader(dns_dumpctx_t *dctx) {
+ 		 * it in the zone case.
+ 		 */
+ 		if (dctx->do_date) {
++			fprintf(dctx->f,
++				"; using a %d second stale ttl\n",
++				dctx->tctx.serve_stale_ttl);
+ 			result = dns_time32_totext(dctx->now, &buffer);
+ 			RUNTIME_CHECK(result == ISC_R_SUCCESS);
+ 			isc_buffer_usedregion(&buffer, &r);
+diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
+index ada888cff9..39499359c8 100644
+--- a/lib/dns/rbtdb.c
++++ b/lib/dns/rbtdb.c
+@@ -488,6 +488,7 @@ typedef ISC_LIST(rdatasetheader_t)      rdatasetheaderlist_t;
+ typedef ISC_LIST(dns_rbtnode_t)         rbtnodelist_t;
+ 
+ #define RDATASET_ATTR_NONEXISTENT       0x0001
++/*%< May be potentially served as stale data. */
+ #define RDATASET_ATTR_STALE             0x0002
+ #define RDATASET_ATTR_IGNORE            0x0004
+ #define RDATASET_ATTR_RETAIN            0x0008
+@@ -500,6 +501,8 @@ typedef ISC_LIST(dns_rbtnode_t)         rbtnodelist_t;
+ #define RDATASET_ATTR_CASESET           0x0400
+ #define RDATASET_ATTR_ZEROTTL           0x0800
+ #define RDATASET_ATTR_CASEFULLYLOWER    0x1000
++/*%< Ancient - awaiting cleanup. */
++#define RDATASET_ATTR_ANCIENT           0x2000
+ 
+ typedef struct acache_cbarg {
+ 	dns_rdatasetadditional_t        type;
+@@ -550,6 +553,8 @@ struct acachectl {
+ 	(((header)->attributes & RDATASET_ATTR_ZEROTTL) != 0)
+ #define CASEFULLYLOWER(header) \
+ 	(((header)->attributes & RDATASET_ATTR_CASEFULLYLOWER) != 0)
++#define ANCIENT(header) \
++	(((header)->attributes & RDATASET_ATTR_ANCIENT) != 0)
+ 
+ 
+ #define ACTIVE(header, now) \
+@@ -609,6 +614,12 @@ typedef enum {
+ 	expire_flush
+ } expire_t;
+ 
++typedef enum {
++	rdataset_ttl_fresh,
++	rdataset_ttl_stale,
++	rdataset_ttl_ancient
++} rdataset_ttl_t;
++
+ typedef struct rbtdb_version {
+ 	/* Not locked */
+ 	rbtdb_serial_t                  serial;
+@@ -676,6 +687,12 @@ struct dns_rbtdb {
+ 	dns_dbnode_t                    *soanode;
+ 	dns_dbnode_t                    *nsnode;
+ 
++	/*
++	 * Maximum length of time to keep using a stale answer past its
++	 * normal TTL expiry.
++	*/
++	dns_ttl_t			serve_stale_ttl;
++
+ 	/*
+ 	 * This is a linked list used to implement the LRU cache.  There will
+ 	 * be node_lock_count linked lists here.  Nodes in bucket 1 will be
+@@ -719,6 +736,8 @@ struct dns_rbtdb {
+ #define RBTDB_ATTR_LOADED               0x01
+ #define RBTDB_ATTR_LOADING              0x02
+ 
++#define KEEPSTALE(rbtdb) ((rbtdb)->serve_stale_ttl > 0)
++
+ /*%
+  * Search Context
+  */
+@@ -1784,15 +1803,15 @@ rollback_node(dns_rbtnode_t *node, rbtdb_serial_t serial) {
+ }
+ 
+ static inline void
+-mark_stale_header(dns_rbtdb_t *rbtdb, rdatasetheader_t *header) {
++mark_header_ancient(dns_rbtdb_t *rbtdb, rdatasetheader_t *header) {
+ 
+ 	/*
+-	 * If we are already stale there is nothing to do.
++	 * If we are already ancient there is nothing to do.
+ 	 */
+-	if ((header->attributes & RDATASET_ATTR_STALE) != 0)
++	if (ANCIENT(header))
+ 		return;
+ 
+-	header->attributes |= RDATASET_ATTR_STALE;
++	header->attributes |= RDATASET_ATTR_ANCIENT;
+ 	header->node->dirty = 1;
+ 
+ 	/*
+@@ -1833,8 +1852,8 @@ clean_cache_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node) {
+ 		/*
+ 		 * If current is nonexistent or stale, we can clean it up.
+ 		 */
+-		if ((current->attributes &
+-		     (RDATASET_ATTR_NONEXISTENT|RDATASET_ATTR_STALE)) != 0) {
++		if (NONEXISTENT(current) || ANCIENT(current) ||
++		    (STALE(current) && ! KEEPSTALE(rbtdb))) {
+ 			if (top_prev != NULL)
+ 				top_prev->next = current->next;
+ 			else
+@@ -2076,6 +2095,80 @@ delete_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node) {
+ 	}
+ }
+ 
++#if 0
++static void
++clean_now_or_later(dns_rbtnode_t *node, dns_rbtdb_t *rbtdb,
++		   rdatasetheader_t *header, rdatasetheader_t **header_prevp)
++{
++	if (dns_rbtnode_refcurrent(node) == 0) {
++		isc_mem_t *mctx;
++
++		/*
++		 * header->down can be non-NULL if the refcount has just
++		 * decremented to 0 but decrement_reference() has not performed
++		 * clean_cache_node(), in which case we need to purge the stale
++		 * headers first.
++		 */
++		mctx = rbtdb->common.mctx;
++		clean_stale_headers(rbtdb, mctx, header);
++		if (*header_prevp != NULL)
++			(*header_prevp)->next = header->next;
++		else
++			node->data = header->next;
++		free_rdataset(rbtdb, mctx, header);
++	} else {
++		header->attributes |= RDATASET_ATTR_STALE |
++		                      RDATASET_ATTR_ANCIENT;
++		node->dirty = 1;
++		*header_prevp = header;
++	}
++}
++
++static rdataset_ttl_t
++check_ttl(dns_rbtnode_t *node, rbtdb_search_t *search,
++	  rdatasetheader_t *header, rdatasetheader_t **header_prevp,
++	  nodelock_t *lock, isc_rwlocktype_t *locktype)
++{
++	dns_rbtdb_t *rbtdb = search->rbtdb;
++
++	if (header->rdh_ttl > search->now)
++		return rdataset_ttl_fresh;
++
++	/*
++	 * This rdataset is stale, but perhaps still usable.
++	 */
++	if (KEEPSTALE(rbtdb) &&
++	    header->rdh_ttl + rbtdb->serve_stale_ttl > search->now) {
++		header->attributes |= RDATASET_ATTR_STALE;
++		/* Doesn't set dirty because it doesn't need removal. */
++		return rdataset_ttl_stale;
++	}
++
++	/*
++	 * This rdataset is so stale it is no longer usable, even with
++	 * KEEPSTALE.  If no one else is using the node, we can clean it up
++	 * right now, otherwise we mark it as ancient, and the node as dirty,
++	 * so it will get cleaned up later.
++	 */
++	if ((header->rdh_ttl <= search->now - RBTDB_VIRTUAL) &&
++	    (*locktype == isc_rwlocktype_write ||
++	     NODE_TRYUPGRADE(lock) == ISC_R_SUCCESS)) {
++		/*
++		 * We update the node's status only when we can get write
++		 * access; otherwise, we leave others to this work.  Periodical
++		 * cleaning will eventually take the job as the last resort.
++		 * We won't downgrade the lock, since other rdatasets are
++		 * probably stale, too.
++		 */
++		*locktype = isc_rwlocktype_write;
++		clean_now_or_later(node, rbtdb, header, header_prevp);
++	} else
++		*header_prevp = header;
++
++	return rdataset_ttl_ancient;
++}
++#endif
++
+ /*
+  * Caller must be holding the node lock.
+  */
+@@ -3308,6 +3401,12 @@ bind_rdataset(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
+ 		rdataset->attributes |= DNS_RDATASETATTR_OPTOUT;
+ 	if (PREFETCH(header))
+ 		rdataset->attributes |= DNS_RDATASETATTR_PREFETCH;
++	if (STALE(header)) {
++		rdataset->attributes |= DNS_RDATASETATTR_STALE;
++		rdataset->stale_ttl =
++			(rbtdb->serve_stale_ttl + header->rdh_ttl) - now;
++		rdataset->ttl = 0;
++	}
+ 	rdataset->private1 = rbtdb;
+ 	rdataset->private2 = node;
+ 	raw = (unsigned char *)header + sizeof(*header);
+@@ -4648,6 +4747,19 @@ check_stale_header(dns_rbtnode_t *node, rdatasetheader_t *header,
+ #endif
+ 
+ 	if (!ACTIVE(header, search->now)) {
++		dns_ttl_t stale = header->rdh_ttl +
++				  search->rbtdb->serve_stale_ttl;
++		/*
++		 * If this data is in the stale window keep it and if
++		 * DNS_DBFIND_STALEOK is not set we tell the caller to
++		 * skip this record.
++		 */
++		if (KEEPSTALE(search->rbtdb) && stale > search->now) {
++			header->attributes |= RDATASET_ATTR_STALE;
++			*header_prev = header;
++			return ((search->options & DNS_DBFIND_STALEOK) == 0);
++		}
++
+ 		/*
+ 		 * This rdataset is stale.  If no one else is using the
+ 		 * node, we can clean it up right now, otherwise we mark
+@@ -4687,7 +4799,7 @@ check_stale_header(dns_rbtnode_t *node, rdatasetheader_t *header,
+ 					node->data = header->next;
+ 				free_rdataset(search->rbtdb, mctx, header);
+ 			} else {
+-				mark_stale_header(search->rbtdb, header);
++				mark_header_ancient(search->rbtdb, header);
+ 				*header_prev = header;
+ 			}
+ 		} else
+@@ -5125,7 +5237,7 @@ cache_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
+ 				       &locktype, lock, &search,
+ 				       &header_prev)) {
+ 			/* Do nothing. */
+-		} else if (EXISTS(header) && (!STALE(header))) {
++		} else if (EXISTS(header) && !ANCIENT(header)) {
+ 			/*
+ 			 * We now know that there is at least one active
+ 			 * non-stale rdataset at this node.
+@@ -5603,7 +5715,7 @@ expirenode(dns_db_t *db, dns_dbnode_t *node, isc_stdtime_t now) {
+ 			 * refcurrent(rbtnode) must be non-zero.  This is so
+ 			 * because 'node' is an argument to the function.
+ 			 */
+-			mark_stale_header(rbtdb, header);
++			mark_header_ancient(rbtdb, header);
+ 			if (log)
+ 				isc_log_write(dns_lctx, category, module,
+ 					      level, "overmem cache: stale %s",
+@@ -5611,7 +5723,7 @@ expirenode(dns_db_t *db, dns_dbnode_t *node, isc_stdtime_t now) {
+ 		} else if (force_expire) {
+ 			if (! RETAIN(header)) {
+ 				set_ttl(rbtdb, header, 0);
+-				mark_stale_header(rbtdb, header);
++				mark_header_ancient(rbtdb, header);
+ 			} else if (log) {
+ 				isc_log_write(dns_lctx, category, module,
+ 					      level, "overmem cache: "
+@@ -5868,9 +5980,9 @@ cache_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
+ 				 * non-zero.  This is so because 'node' is an
+ 				 * argument to the function.
+ 				 */
+-				mark_stale_header(rbtdb, header);
++				mark_header_ancient(rbtdb, header);
+ 			}
+-		} else if (EXISTS(header) && (!STALE(header))) {
++		} else if (EXISTS(header) && !ANCIENT(header)) {
+ 			if (header->type == matchtype)
+ 				found = header;
+ 			else if (header->type == RBTDB_RDATATYPE_NCACHEANY ||
+@@ -6160,7 +6272,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+ 				     topheader = topheader->next)
+ 				{
+ 					set_ttl(rbtdb, topheader, 0);
+-					mark_stale_header(rbtdb, topheader);
++					mark_header_ancient(rbtdb, topheader);
+ 				}
+ 				goto find_header;
+ 			}
+@@ -6218,7 +6330,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+ 				 * ncache entry.
+ 				 */
+ 				set_ttl(rbtdb, topheader, 0);
+-				mark_stale_header(rbtdb, topheader);
++				mark_header_ancient(rbtdb, topheader);
+ 				topheader = NULL;
+ 				goto find_header;
+ 			}
+@@ -6256,8 +6368,11 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+ 		}
+ 
+ 		/*
+-		 * Trying to add an rdataset with lower trust to a cache DB
+-		 * has no effect, provided that the cache data isn't stale.
++		 * Trying to add an rdataset with lower trust to a cache
++		 * DB has no effect, provided that the cache data isn't
++		 * stale. If the cache data is stale, new lower trust
++		 * data will supersede it below. Unclear what the best
++		 * policy is here.
+ 		 */
+ 		if (rbtversion == NULL && trust < header->trust &&
+ 		    (ACTIVE(header, now) || header_nx)) {
+@@ -6286,6 +6401,10 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+ 
+ 			if ((options & DNS_DBADD_EXACT) != 0)
+ 				flags |= DNS_RDATASLAB_EXACT;
++			/*
++			 * TTL use here is irrelevant to the cache;
++			 * merge is only done with zonedbs.
++			 */
+ 			if ((options & DNS_DBADD_EXACTTTL) != 0 &&
+ 			     newheader->rdh_ttl != header->rdh_ttl)
+ 					result = DNS_R_NOTEXACT;
+@@ -6329,11 +6448,12 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+ 			}
+ 		}
+ 		/*
+-		 * Don't replace existing NS, A and AAAA RRsets
+-		 * in the cache if they are already exist.  This
+-		 * prevents named being locked to old servers.
+-		 * Don't lower trust of existing record if the
+-		 * update is forced.
++		 * Don't replace existing NS, A and AAAA RRsets in the
++		 * cache if they are already exist. This prevents named
++		 * being locked to old servers. Don't lower trust of
++		 * existing record if the update is forced. Nothing
++		 * special to be done w.r.t stale data; it gets replaced
++		 * normally further down.
+ 		 */
+ 		if (IS_CACHE(rbtdb) && ACTIVE(header, now) &&
+ 		    header->type == dns_rdatatype_ns &&
+@@ -6508,10 +6628,10 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+ 				changed->dirty = true;
+ 			if (rbtversion == NULL) {
+ 				set_ttl(rbtdb, header, 0);
+-				mark_stale_header(rbtdb, header);
++				mark_header_ancient(rbtdb, header);
+ 				if (sigheader != NULL) {
+ 					set_ttl(rbtdb, sigheader, 0);
+-					mark_stale_header(rbtdb, sigheader);
++					mark_header_ancient(rbtdb, sigheader);
+ 				}
+ 			}
+ 			if (rbtversion != NULL && !header_nx) {
+@@ -8313,6 +8433,30 @@ nodefullname(dns_db_t *db, dns_dbnode_t *node, dns_name_t *name) {
+ 	return (result);
+ }
+ 
++static isc_result_t
++setservestalettl(dns_db_t *db, dns_ttl_t ttl) {
++	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
++
++	REQUIRE(VALID_RBTDB(rbtdb));
++	REQUIRE(IS_CACHE(rbtdb));
++
++	/* currently no bounds checking.  0 means disable. */
++	rbtdb->serve_stale_ttl = ttl;
++	return ISC_R_SUCCESS;
++}
++
++static isc_result_t
++getservestalettl(dns_db_t *db, dns_ttl_t *ttl) {
++	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
++
++	REQUIRE(VALID_RBTDB(rbtdb));
++	REQUIRE(IS_CACHE(rbtdb));
++
++	*ttl = rbtdb->serve_stale_ttl;
++	return ISC_R_SUCCESS;
++}
++
++
+ static dns_dbmethods_t zone_methods = {
+ 	attach,
+ 	detach,
+@@ -8358,7 +8502,9 @@ static dns_dbmethods_t zone_methods = {
+ 	NULL,
+ 	hashsize,
+ 	nodefullname,
+-	getsize
++	getsize,
++	NULL,
++	NULL
+ };
+ 
+ static dns_dbmethods_t cache_methods = {
+@@ -8406,7 +8552,9 @@ static dns_dbmethods_t cache_methods = {
+ 	setcachestats,
+ 	hashsize,
+ 	nodefullname,
+-	NULL
++	NULL,
++	setservestalettl,
++	getservestalettl
+ };
+ 
+ isc_result_t
+@@ -8677,7 +8825,7 @@ dns_rbtdb_create
+ 	rbtdb->rpzs = NULL;
+ 	rbtdb->load_rpzs = NULL;
+ 	rbtdb->rpz_num = DNS_RPZ_INVALID_NUM;
+-
++	rbtdb->serve_stale_ttl = 0;
+ 	/*
+ 	 * Version Initialization.
+ 	 */
+@@ -9095,7 +9243,8 @@ rdatasetiter_first(dns_rdatasetiter_t *iterator) {
+ 				 * rdatasets to work.
+ 				 */
+ 				if (NONEXISTENT(header) ||
+-				    (now != 0 && now > header->rdh_ttl))
++				    (now != 0 && now > header->rdh_ttl
++						     + rbtdb->serve_stale_ttl))
+ 					header = NULL;
+ 				break;
+ 			} else
+@@ -10283,7 +10432,7 @@ static inline bool
+ need_headerupdate(rdatasetheader_t *header, isc_stdtime_t now) {
+ 	if ((header->attributes &
+ 	     (RDATASET_ATTR_NONEXISTENT |
+-	      RDATASET_ATTR_STALE |
++	      RDATASET_ATTR_ANCIENT |
+ 	      RDATASET_ATTR_ZEROTTL)) != 0)
+ 		return (false);
+ 
+@@ -10389,7 +10538,7 @@ expire_header(dns_rbtdb_t *rbtdb, rdatasetheader_t *header,
+ 	      bool tree_locked, expire_t reason)
+ {
+ 	set_ttl(rbtdb, header, 0);
+-	mark_stale_header(rbtdb, header);
++	mark_header_ancient(rbtdb, header);
+ 
+ 	/*
+ 	 * Caller must hold the node (write) lock.
+diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
+index cefa53d904..54a624fc25 100644
+--- a/lib/dns/resolver.c
++++ b/lib/dns/resolver.c
+@@ -141,16 +141,17 @@
+ #endif /* WANT_QUERYTRACE */
+ 
+ #define US_PER_SEC 1000000U
++#define US_PER_MSEC 1000U
+ /*
+  * The maximum time we will wait for a single query.
+  */
+-#define MAX_SINGLE_QUERY_TIMEOUT 9U
+-#define MAX_SINGLE_QUERY_TIMEOUT_US (MAX_SINGLE_QUERY_TIMEOUT*US_PER_SEC)
++#define MAX_SINGLE_QUERY_TIMEOUT 9000U
++#define MAX_SINGLE_QUERY_TIMEOUT_US (MAX_SINGLE_QUERY_TIMEOUT*US_PER_MSEC)
+ 
+ /*
+  * We need to allow a individual query time to complete / timeout.
+  */
+-#define MINIMUM_QUERY_TIMEOUT (MAX_SINGLE_QUERY_TIMEOUT + 1U)
++#define MINIMUM_QUERY_TIMEOUT (MAX_SINGLE_QUERY_TIMEOUT + 1000U)
+ 
+ /* The default time in seconds for the whole query to live. */
+ #ifndef DEFAULT_QUERY_TIMEOUT
+@@ -159,7 +160,7 @@
+ 
+ /* The maximum time in seconds for the whole query to live. */
+ #ifndef MAXIMUM_QUERY_TIMEOUT
+-#define MAXIMUM_QUERY_TIMEOUT 30
++#define MAXIMUM_QUERY_TIMEOUT 30000
+ #endif
+ 
+ /* The default maximum number of recursions to follow before giving up. */
+@@ -496,6 +497,10 @@ struct dns_resolver {
+ 	unsigned int			maxqueries;
+ 	isc_result_t			quotaresp[2];
+ 
++	/* Additions for serve-stale feature. */
++	unsigned int			retryinterval; /* in milliseconds */
++	unsigned int			nonbackofftries;
++
+ 	/* Locked by lock. */
+ 	unsigned int			references;
+ 	bool			exiting;
+@@ -1602,14 +1607,12 @@ fctx_setretryinterval(fetchctx_t *fctx, unsigned int rtt) {
+ 	unsigned int seconds;
+ 	unsigned int us;
+ 
++	us = fctx->res->retryinterval * 1000;
+ 	/*
+-	 * We retry every .8 seconds the first two times through the address
+-	 * list, and then we do exponential back-off.
++	 * Exponential backoff after the first few tries.
+ 	 */
+-	if (fctx->restarts < 3)
+-		us = 800000;
+-	else
+-		us = (800000 << (fctx->restarts - 2));
++	if (fctx->restarts >= fctx->res->nonbackofftries)
++		us <<= (fctx->restarts - fctx->res->nonbackofftries - 1);
+ 
+ 	/*
+ 	 * Add a fudge factor to the expected rtt based on the current
+@@ -4453,7 +4456,8 @@ fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type,
+ 	/*
+ 	 * Compute an expiration time for the entire fetch.
+ 	 */
+-	isc_interval_set(&interval, res->query_timeout, 0);
++	isc_interval_set(&interval, res->query_timeout / 1000,
++			 res->query_timeout % 1000 * 1000000);
+ 	iresult = isc_time_nowplusinterval(&fctx->expires, &interval);
+ 	if (iresult != ISC_R_SUCCESS) {
+ 		UNEXPECTED_ERROR(__FILE__, __LINE__,
+@@ -8937,6 +8941,8 @@ dns_resolver_create(dns_view_t *view,
+ 	res->spillattimer = NULL;
+ 	res->zspill = 0;
+ 	res->zero_no_soa_ttl = false;
++	res->retryinterval = 30000;
++	res->nonbackofftries = 3;
+ 	res->query_timeout = DEFAULT_QUERY_TIMEOUT;
+ 	res->maxdepth = DEFAULT_RECURSION_DEPTH;
+ 	res->maxqueries = DEFAULT_MAX_QUERIES;
+@@ -10263,17 +10269,20 @@ dns_resolver_gettimeout(dns_resolver_t *resolver) {
+ }
+ 
+ void
+-dns_resolver_settimeout(dns_resolver_t *resolver, unsigned int seconds) {
++dns_resolver_settimeout(dns_resolver_t *resolver, unsigned int timeout) {
+ 	REQUIRE(VALID_RESOLVER(resolver));
+ 
+-	if (seconds == 0)
+-		seconds = DEFAULT_QUERY_TIMEOUT;
+-	if (seconds > MAXIMUM_QUERY_TIMEOUT)
+-		seconds = MAXIMUM_QUERY_TIMEOUT;
+-	if (seconds < MINIMUM_QUERY_TIMEOUT)
+-		seconds =  MINIMUM_QUERY_TIMEOUT;
++	if (timeout <= 300)
++		timeout *= 1000;
++
++	if (timeout == 0)
++		timeout = DEFAULT_QUERY_TIMEOUT;
++	if (timeout > MAXIMUM_QUERY_TIMEOUT)
++		timeout = MAXIMUM_QUERY_TIMEOUT;
++	if (timeout < MINIMUM_QUERY_TIMEOUT)
++		timeout =  MINIMUM_QUERY_TIMEOUT;
+ 
+-	resolver->query_timeout = seconds;
++	resolver->query_timeout = timeout;
+ }
+ 
+ void
+@@ -10370,3 +10379,34 @@ dns_resolver_getquotaresponse(dns_resolver_t *resolver, dns_quotatype_t which)
+ 
+ 	return (resolver->quotaresp[which]);
+ }
++
++unsigned int
++dns_resolver_getretryinterval(dns_resolver_t *resolver) {
++	REQUIRE(VALID_RESOLVER(resolver));
++
++	return (resolver->retryinterval);
++}
++
++void
++dns_resolver_setretryinterval(dns_resolver_t *resolver, unsigned int interval)
++{
++	REQUIRE(VALID_RESOLVER(resolver));
++	REQUIRE(interval > 0);
++
++	resolver->retryinterval = ISC_MIN(interval, 2000);
++}
++
++unsigned int
++dns_resolver_getnonbackofftries(dns_resolver_t *resolver) {
++	REQUIRE(VALID_RESOLVER(resolver));
++
++	return (resolver->nonbackofftries);
++}
++
++void
++dns_resolver_setnonbackofftries(dns_resolver_t *resolver, unsigned int tries) {
++	REQUIRE(VALID_RESOLVER(resolver));
++	REQUIRE(tries > 0);
++
++	resolver->nonbackofftries = tries;
++}
+diff --git a/lib/dns/sdb.c b/lib/dns/sdb.c
+index d4c8c673c8..ee9be79cb9 100644
+--- a/lib/dns/sdb.c
++++ b/lib/dns/sdb.c
+@@ -1368,7 +1368,9 @@ static dns_dbmethods_t sdb_methods = {
+ 	NULL,			/* setcachestats */
+ 	NULL,			/* hashsize */
+ 	NULL,			/* nodefullname */
+-	NULL			/* getsize */
++	NULL,			/* getsize */
++	NULL,			/* setservestalettl */
++	NULL			/* getservestalettl */
+ };
+ 
+ static isc_result_t
+diff --git a/lib/dns/sdlz.c b/lib/dns/sdlz.c
+index 0b9620c76c..331992ebdd 100644
+--- a/lib/dns/sdlz.c
++++ b/lib/dns/sdlz.c
+@@ -1336,7 +1336,9 @@ static dns_dbmethods_t sdlzdb_methods = {
+ 	NULL,			/* setcachestats */
+ 	NULL,			/* hashsize */
+ 	NULL,			/* nodefullname */
+-	NULL			/* getsize */
++	NULL,			/* getsize */
++	NULL,			/* setservestalettl */
++	NULL			/* getservestalettl */
+ };
+ 
+ /*
+diff --git a/lib/dns/tests/db_test.c b/lib/dns/tests/db_test.c
+index 35cf21d0f2..bf39545d4f 100644
+--- a/lib/dns/tests/db_test.c
++++ b/lib/dns/tests/db_test.c
+@@ -28,8 +28,9 @@
+ 
+ #include <dns/db.h>
+ #include <dns/dbiterator.h>
+-#include <dns/name.h>
+ #include <dns/journal.h>
++#include <dns/name.h>
++#include <dns/rdatalist.h>
+ 
+ #include "dnstest.h"
+ 
+@@ -76,7 +77,7 @@ getoriginnode_test(void **state) {
+ 	assert_int_equal(result, ISC_R_SUCCESS);
+ 
+ 	result = dns_db_create(mymctx, "rbt", dns_rootname, dns_dbtype_zone,
+-			    dns_rdataclass_in, 0, NULL, &db);
++			       dns_rdataclass_in, 0, NULL, &db);
+ 	assert_int_equal(result, ISC_R_SUCCESS);
+ 
+ 	result = dns_db_getoriginnode(db, &node);
+@@ -91,6 +92,197 @@ getoriginnode_test(void **state) {
+ 	isc_mem_detach(&mymctx);
+ }
+ 
++/* test getservestalettl and setservestalettl */
++static void
++getsetservestalettl_test(void **state) {
++	dns_db_t *db = NULL;
++	isc_mem_t *mymctx = NULL;
++	isc_result_t result;
++	dns_ttl_t ttl;
++
++	UNUSED(state);
++
++	result = isc_mem_create(0, 0, &mymctx);
++	assert_int_equal(result, ISC_R_SUCCESS);
++
++	result = dns_db_create(mymctx, "rbt", dns_rootname, dns_dbtype_cache,
++			       dns_rdataclass_in, 0, NULL, &db);
++	assert_int_equal(result, ISC_R_SUCCESS);
++
++	ttl = 5000;
++	result = dns_db_getservestalettl(db, &ttl);
++	assert_int_equal(result, ISC_R_SUCCESS);
++	assert_int_equal(ttl, 0);
++
++	ttl = 6 * 3600;
++	result = dns_db_setservestalettl(db, ttl);
++	assert_int_equal(result, ISC_R_SUCCESS);
++
++	ttl = 5000;
++	result = dns_db_getservestalettl(db, &ttl);
++	assert_int_equal(result, ISC_R_SUCCESS);
++	assert_int_equal(ttl, 6 * 3600);
++
++	dns_db_detach(&db);
++	isc_mem_detach(&mymctx);
++}
++
++/* check DNS_DBFIND_STALEOK works */
++static void
++dns_dbfind_staleok_test(void **state) {
++	dns_db_t *db = NULL;
++	dns_dbnode_t *node = NULL;
++	dns_fixedname_t example_fixed;
++	dns_fixedname_t found_fixed;
++	dns_name_t *example;
++	dns_name_t *found;
++	dns_rdatalist_t rdatalist;
++	dns_rdataset_t rdataset;
++	int count;
++	int pass;
++	isc_mem_t *mymctx = NULL;
++	isc_result_t result;
++	unsigned char data[] = { 0x0a, 0x00, 0x00, 0x01 };
++
++	UNUSED(state);
++
++	result = isc_mem_create(0, 0, &mymctx);
++	assert_int_equal(result, ISC_R_SUCCESS);
++
++	result = dns_db_create(mymctx, "rbt", dns_rootname, dns_dbtype_cache,
++			       dns_rdataclass_in, 0, NULL, &db);
++	assert_int_equal(result, ISC_R_SUCCESS);
++
++	example = dns_fixedname_initname(&example_fixed);
++	found = dns_fixedname_initname(&found_fixed);
++
++	result = dns_name_fromstring(example, "example", 0, NULL);
++	assert_int_equal(result, ISC_R_SUCCESS);
++
++	/*
++	 * Pass 0: default; no stale processing permitted.
++	 * Pass 1: stale processing for 1 second.
++	 * Pass 2: stale turned off after being on.
++	 */
++	for (pass = 0; pass < 3; pass++) {
++		dns_rdata_t rdata = DNS_RDATA_INIT;
++
++		/* 10.0.0.1 */
++		rdata.data = data;
++		rdata.length = 4;
++		rdata.rdclass = dns_rdataclass_in;
++		rdata.type = dns_rdatatype_a;
++
++		dns_rdatalist_init(&rdatalist);
++		rdatalist.ttl = 2;
++		rdatalist.type = dns_rdatatype_a;
++		rdatalist.rdclass = dns_rdataclass_in;
++		ISC_LIST_APPEND(rdatalist.rdata, &rdata, link);
++
++		switch (pass) {
++		case 0:
++			/* default: stale processing off */
++			break;
++		case 1:
++			/* turn on stale processing */
++			result = dns_db_setservestalettl(db, 1);
++			assert_int_equal(result, ISC_R_SUCCESS);
++			break;
++		case 2:
++			/* turn off stale processing */
++			result = dns_db_setservestalettl(db, 0);
++			assert_int_equal(result, ISC_R_SUCCESS);
++			break;
++		}
++
++		dns_rdataset_init(&rdataset);
++		result = dns_rdatalist_tordataset(&rdatalist, &rdataset);
++		assert_int_equal(result, ISC_R_SUCCESS);
++
++		result = dns_db_findnode(db, example, true, &node);
++		assert_int_equal(result, ISC_R_SUCCESS);
++
++		result = dns_db_addrdataset(db, node, NULL, 0, &rdataset, 0,
++					    NULL);
++		assert_int_equal(result, ISC_R_SUCCESS);
++
++		dns_db_detachnode(db, &node);
++		dns_rdataset_disassociate(&rdataset);
++
++		result = dns_db_find(db, example, NULL, dns_rdatatype_a,
++				     0, 0, &node, found, &rdataset, NULL);
++		assert_int_equal(result, ISC_R_SUCCESS);
++
++		/*
++		 * May loop for up to 2 seconds performing non stale lookups.
++		 */
++		count = 0;
++		do {
++			count++;
++			assert_in_range(count, 0, 20); /* loop sanity */
++			assert_int_equal(rdataset.attributes &
++				     DNS_RDATASETATTR_STALE, 0);
++			assert_true(rdataset.ttl > 0);
++			dns_db_detachnode(db, &node);
++			dns_rdataset_disassociate(&rdataset);
++
++			usleep(100000);	/* 100 ms */
++
++			result = dns_db_find(db, example, NULL,
++					     dns_rdatatype_a, 0, 0,
++					     &node, found, &rdataset, NULL);
++		} while (result == ISC_R_SUCCESS);
++
++		assert_int_equal(result, ISC_R_NOTFOUND);
++
++		/*
++		 * Check whether we can get stale data.
++		 */
++		result = dns_db_find(db, example, NULL, dns_rdatatype_a,
++				     DNS_DBFIND_STALEOK, 0,
++				     &node, found, &rdataset, NULL);
++		switch (pass) {
++		case 0:
++			assert_int_equal(result, ISC_R_NOTFOUND);
++			break;
++		case 1:
++			/*
++			 * Should loop for 1 second with stale lookups then
++			 * stop.
++			 */
++			count = 0;
++			do {
++				count++;
++				assert_in_range(count, 0, 49); /* loop sanity */
++				assert_int_equal(result, ISC_R_SUCCESS);
++				assert_int_equal(rdataset.ttl, 0);
++				assert_int_equal(rdataset.attributes &
++					     DNS_RDATASETATTR_STALE,
++					     DNS_RDATASETATTR_STALE);
++				dns_db_detachnode(db, &node);
++				dns_rdataset_disassociate(&rdataset);
++
++				usleep(100000);	/* 100 ms */
++
++				result = dns_db_find(db, example, NULL,
++						     dns_rdatatype_a,
++						     DNS_DBFIND_STALEOK,
++						     0, &node, found,
++						     &rdataset, NULL);
++			} while (result == ISC_R_SUCCESS);
++			assert_in_range(count, 1, 10);
++			assert_int_equal(result, ISC_R_NOTFOUND);
++			break;
++		case 2:
++			assert_int_equal(result, ISC_R_NOTFOUND);
++			break;
++		}
++	}
++
++	dns_db_detach(&db);
++	isc_mem_detach(&mymctx);
++}
++
+ /* database class */
+ static void
+ class_test(void **state) {
+@@ -213,6 +405,8 @@ int
+ main(void) {
+ 	const struct CMUnitTest tests[] = {
+ 		cmocka_unit_test(getoriginnode_test),
++		cmocka_unit_test(getsetservestalettl_test),
++		cmocka_unit_test(dns_dbfind_staleok_test),
+ 		cmocka_unit_test_setup_teardown(class_test,
+ 						_setup, _teardown),
+ 		cmocka_unit_test_setup_teardown(dbtype_test,
+diff --git a/lib/dns/view.c b/lib/dns/view.c
+index a1a4301b5d..abf6a4cce9 100644
+--- a/lib/dns/view.c
++++ b/lib/dns/view.c
+@@ -229,6 +229,9 @@ dns_view_create(isc_mem_t *mctx, dns_rdataclass_t rdclass,
+ 	view->flush = false;
+ 	view->dlv = NULL;
+ 	view->maxudp = 0;
++	view->staleanswerttl = 1;
++	view->staleanswersok = dns_stale_answer_conf;
++	view->staleanswersenable = false;
+ 	view->nocookieudp = 0;
+ 	view->maxbits = 0;
+ 	view->v4_aaaa = dns_aaaa_ok;
+diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
+index 7bad989be1..bbf4b45c10 100644
+--- a/lib/isccfg/namedconf.c
++++ b/lib/isccfg/namedconf.c
+@@ -1778,6 +1778,7 @@ view_clauses[] = {
+ 	{ "max-ncache-ttl", &cfg_type_uint32, 0 },
+ 	{ "max-recursion-depth", &cfg_type_uint32, 0 },
+ 	{ "max-recursion-queries", &cfg_type_uint32, 0 },
++	{ "max-stale-ttl", &cfg_type_ttlval, 0 },
+ 	{ "max-udp-size", &cfg_type_uint32, 0 },
+ 	{ "message-compression", &cfg_type_boolean, 0 },
+ 	{ "min-roots", &cfg_type_uint32, CFG_CLAUSEFLAG_NOTIMP },
+@@ -1806,7 +1807,9 @@ view_clauses[] = {
+ 	{ "request-nsid", &cfg_type_boolean, 0 },
+ 	{ "request-sit", &cfg_type_boolean, CFG_CLAUSEFLAG_OBSOLETE },
+ 	{ "require-server-cookie", &cfg_type_boolean, 0 },
++	{ "resolver-nonbackoff-tries", &cfg_type_uint32, 0 },
+ 	{ "resolver-query-timeout", &cfg_type_uint32, 0 },
++	{ "resolver-retry-interval", &cfg_type_uint32, 0 },
+ 	{ "response-policy", &cfg_type_rpz, 0 },
+ 	{ "rfc2308-type1", &cfg_type_boolean, CFG_CLAUSEFLAG_NYI },
+ 	{ "root-delegation-only",  &cfg_type_optional_exclude, 0 },
+@@ -1815,6 +1818,8 @@ view_clauses[] = {
+ 	{ "send-cookie", &cfg_type_boolean, 0 },
+ 	{ "servfail-ttl", &cfg_type_ttlval, 0 },
+ 	{ "sortlist", &cfg_type_bracketed_aml, 0 },
++	{ "stale-answer-enable", &cfg_type_boolean, 0 },
++	{ "stale-answer-ttl", &cfg_type_ttlval, 0 },
+ 	{ "suppress-initial-notify", &cfg_type_boolean, CFG_CLAUSEFLAG_NYI },
+ 	{ "topology", &cfg_type_bracketed_aml, CFG_CLAUSEFLAG_NOTIMP },
+ 	{ "transfer-format", &cfg_type_transferformat, 0 },
+-- 
+2.20.1
+
diff --git a/bind.spec b/bind.spec
index df712b5..4cdd3fa 100644
--- a/bind.spec
+++ b/bind.spec
@@ -61,7 +61,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.11.12
-Release:  3%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  4%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -158,6 +158,7 @@ Patch173:bind-9.11-rh1732883.patch
 Patch174:bind-9.11-json-c.patch
 Patch175:bind-9.11-fips-disable.patch
 Patch176: bind-9.11-rh1768258.patch
+Patch177: bind-9.11-serve-stale.patch
 
 # SDB patches
 Patch11: bind-9.3.2b2-sdbsrc.patch
@@ -550,6 +551,7 @@ are used for building ISC DHCP.
 %patch174 -p1 -b .json-c
 %patch175 -p1 -b .rh1709553
 %patch176 -p1 -b .rh1768258
+%patch177 -p1 -b .serve-stale
 
 mkdir lib/dns/tests/testdata/dstrandom
 cp -a %{SOURCE50} lib/dns/tests/testdata/dstrandom/random.data
@@ -1565,6 +1567,9 @@ fi;
 
 
 %changelog
+* Wed Nov 06 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.12-4
+- Backported serve-stale feature
+
 * Wed Nov 06 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.12-3
 - Fix wrong default GeoIP directory (#1768258)
 

From 8f4225c8a7f9c9d66cd3b9b2b449c4ac0131e6b7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 5 Nov 2019 21:41:12 +0100
Subject: [PATCH 086/460] Add helper for testing system daemons

Modifies already generated Makefiles to link against system libraries,
instead of static built artifacts.
---
 makefile-replace-libs.py | 143 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 143 insertions(+)
 create mode 100755 makefile-replace-libs.py

diff --git a/makefile-replace-libs.py b/makefile-replace-libs.py
new file mode 100755
index 0000000..90cb0de
--- /dev/null
+++ b/makefile-replace-libs.py
@@ -0,0 +1,143 @@
+#!/usr/bin/python3
+#
+# Makefile modificator
+#
+# Should help in building bin/tests/system tests standalone,
+# linked to libraries installed into the system.
+# TODO:
+# - Fix top_srcdir, because dyndb/driver/Makefile uses $TOPSRC/mkinstalldirs
+# - Fix conf.sh to contain paths to system tools
+# - Export $TOP/version somewhere, where it would be used
+# - system tests needs bin/tests code. Do not include just bin/tests/system
+#
+# Possible solution:
+#
+# sed -e 's/$TOP\/s\?bin\/\(delv\|confgen\|named\|nsupdate\|pkcs11\|python\|rndc\|check\|dig\|dnssec\|tools\)\/\([[:alnum:]-]\+\)/`type -p \2`/' conf.sh
+# sed -e 's,../../../../\(isc-config.sh\),\1,' builtin/tests.sh
+# or use: $NAMED -V | head -1 | cut -d ' ' -f 2
+
+import re
+import argparse
+
+"""
+Script for replacing Makefile ISC_INCLUDES with runtime flags.
+
+Should translate part of Makefile to use isc-config.sh instead static linked sources.
+ISC_INCLUDES = -I/home/pemensik/rhel/bind/bind-9.11.12/build/lib/isc/include \
+        -I${top_srcdir}/lib/isc \
+        -I${top_srcdir}/lib/isc/include \
+        -I${top_srcdir}/lib/isc/unix/include \
+        -I${top_srcdir}/lib/isc/pthreads/include \
+        -I${top_srcdir}/lib/isc/x86_32/include
+
+Should be translated to:
+ISC_INCLUDES = $(shell isc-config.sh --cflags isc)
+"""
+
+def isc_config(mode, lib):
+    if mode:
+        return '$(shell isc-config.sh {mode} {lib})'.format(mode=mode, lib=lib)
+    else:
+        return ''
+
+def check_match(match, debug=False):
+    """
+    Check this definition is handled by internal library
+    """
+    if not match:
+        return False
+    lib = match.group(2).lower()
+    ok = not lib_filter or lib in lib_filter
+    if debug:
+        print('{status} {lib}: {text}'.format(status=ok, lib=lib, text=match.group(1)))
+    return ok
+
+def fix_line(match, mode):
+    lib = match.group(2).lower()
+    return match.group(1)+isc_config(mode, lib)+"\n"
+
+def fix_file_lines(path, debug=False):
+    """
+    Opens file and scans fixes selected parameters
+
+    Returns list of lines if something should be changed,
+    None if no action is required
+    """
+    fixed = []
+    changed = False
+    with open(path, 'r') as fin:
+        fout = None
+
+        line = next(fin, None)
+        while line:
+            appended = False
+            while line.endswith("\\\n"):
+                line += next(fin, None)
+
+            inc = re_includes.match(line)
+            deplibs = re_deplibs.match(line)
+            libs = re_libs.match(line)
+            newline = None
+            if check_match(inc, debug=debug):
+                newline = fix_line(inc, '--cflags')
+            elif check_match(deplibs, debug=debug):
+                newline = fix_line(libs, None)
+            elif check_match(libs, debug=debug):
+                newline = fix_line(libs, '--libs')
+
+            if newline and line != newline:
+                changed = True
+                line = newline
+
+            fixed.append(line)
+            line = next(fin, None)
+
+    if not changed:
+        return None
+    else:
+        return fixed
+
+def write_lines(path, lines):
+    fout = open(path, 'w')
+    for line in lines:
+        fout.write(line)
+    fout.close()
+
+def print_lines(lines):
+    for line in lines:
+        print(line, end='')
+
+if __name__ == '__main__':
+    parser = argparse.ArgumentParser(description='Makefile multiline include replacer')
+    parser.add_argument('files', nargs='+')
+    parser.add_argument('--filter', type=str,
+            default='isc isccc isccfg dns lwres bind9 irs',
+            help='List of libraries supported by isc-config.sh')
+    parser.add_argument('--check', action='store_true',
+            help='Test file only')
+    parser.add_argument('--print', action='store_true',
+            help='Print changed file only')
+    parser.add_argument('--debug', action='store_true',
+            help='Enable debug outputs')
+
+    args = parser.parse_args()
+    lib_filter = None
+
+    re_includes = re.compile(r'^\s*((\w+)_INCLUDES\s+=\s*).*')
+    re_deplibs = re.compile(r'^\s*((\w+)DEPLIBS\s*=).*')
+    re_libs = re.compile(r'^\s*((\w+)LIBS\s*=).*')
+
+    if args.filter:
+        lib_filter = set(args.filter.split(' '))
+        pass
+
+    for path in args.files:
+        lines = fix_file_lines(path, debug=args.debug)
+        if lines:
+            if args.print:
+                print_lines(lines)
+            elif not args.check:
+                write_lines(path, lines)
+                print('File {path} was fixed'.format(path=path))
+        else:
+            print('File {path} does not need fixing'.format(path=path))

From 9bef003ee534faa26f5cb80ac1ed7786c781d3dd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 12 Nov 2019 11:17:43 +0100
Subject: [PATCH 087/460] Fix binary compatibility after serve-stale patch
 (#1770492)

Move new entry to the end. Do not break already compiled bind-dyndb-ldap
compatibility.
---
 bind-9.11-serve-stale-dbfix.patch | 42 +++++++++++++++++++++++++++++++
 bind.spec                         |  7 +++++-
 2 files changed, 48 insertions(+), 1 deletion(-)
 create mode 100644 bind-9.11-serve-stale-dbfix.patch

diff --git a/bind-9.11-serve-stale-dbfix.patch b/bind-9.11-serve-stale-dbfix.patch
new file mode 100644
index 0000000..7091871
--- /dev/null
+++ b/bind-9.11-serve-stale-dbfix.patch
@@ -0,0 +1,42 @@
+From 20848d8284951481051f6ebdeb8128c05c7e82e2 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
+Date: Mon, 11 Nov 2019 16:56:52 +0100
+Subject: [PATCH] Move stale_ttl from middle to the end
+
+bind-dyndb-ldap is using rdataset structure. Do not modify its body,
+move stale_ttl to the end. Make it binary compatible.
+---
+ lib/dns/include/dns/rdataset.h | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/lib/dns/include/dns/rdataset.h b/lib/dns/include/dns/rdataset.h
+index 97071ed496..a0c6afe624 100644
+--- a/lib/dns/include/dns/rdataset.h
++++ b/lib/dns/include/dns/rdataset.h
+@@ -137,11 +137,6 @@ struct dns_rdataset {
+ 	dns_rdataclass_t		rdclass;
+ 	dns_rdatatype_t			type;
+ 	dns_ttl_t			ttl;
+-	/*
+-	 * Stale ttl is used to see how long this RRset can still be used
+-	 * to serve to clients, after the TTL has expired.
+-	 */
+-	dns_ttl_t			stale_ttl;
+ 	dns_trust_t			trust;
+ 	dns_rdatatype_t			covers;
+ 
+@@ -178,6 +173,11 @@ struct dns_rdataset {
+ 	void *				private7;
+ 	/*@}*/
+ 
++	/*
++	 * Stale ttl is used to see how long this RRset can still be used
++	 * to serve to clients, after the TTL has expired.
++	 */
++	dns_ttl_t			stale_ttl;
+ };
+ 
+ /*!
+-- 
+2.20.1
+
diff --git a/bind.spec b/bind.spec
index 4cdd3fa..67736c0 100644
--- a/bind.spec
+++ b/bind.spec
@@ -61,7 +61,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.11.12
-Release:  4%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  5%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -159,6 +159,7 @@ Patch174:bind-9.11-json-c.patch
 Patch175:bind-9.11-fips-disable.patch
 Patch176: bind-9.11-rh1768258.patch
 Patch177: bind-9.11-serve-stale.patch
+Patch178: bind-9.11-serve-stale-dbfix.patch
 
 # SDB patches
 Patch11: bind-9.3.2b2-sdbsrc.patch
@@ -552,6 +553,7 @@ are used for building ISC DHCP.
 %patch175 -p1 -b .rh1709553
 %patch176 -p1 -b .rh1768258
 %patch177 -p1 -b .serve-stale
+%patch178 -p1 -b .rh1770492
 
 mkdir lib/dns/tests/testdata/dstrandom
 cp -a %{SOURCE50} lib/dns/tests/testdata/dstrandom/random.data
@@ -1567,6 +1569,9 @@ fi;
 
 
 %changelog
+* Tue Nov 12 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.12-5
+- Fix binary compatibility after serve-stale patch (#1770492)
+
 * Wed Nov 06 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.12-4
 - Backported serve-stale feature
 

From c45a218eef4b8238af4d05b2dbb9b1825e041154 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 19 Nov 2019 12:00:47 +0100
Subject: [PATCH 088/460] fixup! Remove config archive with zone files

---
 bind.spec | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index 67736c0..17ab8c9 100644
--- a/bind.spec
+++ b/bind.spec
@@ -1057,7 +1057,7 @@ mkdir -p sample/etc sample/var/named/{data,slaves}
 install -m 644 %{SOURCE25} sample/etc/named.conf
 # Copy default configuration to %%doc to make it usable from system-config-bind
 install -m 644 %{SOURCE16} named.conf.default
-install -m 640 %{SOURCE23} sample/etc/named.rfc1912.zones
+install -m 644 %{SOURCE23} sample/etc/named.rfc1912.zones
 install -m 644 %{SOURCE18} %{SOURCE19} %{SOURCE20}  sample/var/named
 install -m 644 %{SOURCE17} sample/var/named/named.ca
 for f in my.internal.zone.db slaves/my.slave.internal.zone.db slaves/my.ddns.internal.zone.db my.external.zone.db; do 

From b29a7e26db7116dbde8e6e59be3b569aca55c509 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 19 Nov 2019 13:37:14 +0100
Subject: [PATCH 089/460] Report error on reload failure

Return failed status code to command. Not only report error message to
the log, but also report reload success. Must not terminate running
service on failed reload.
---
 bind.spec                | 5 ++++-
 named-chroot.service     | 2 +-
 named-pkcs11.service     | 2 +-
 named-sdb-chroot.service | 2 +-
 named-sdb.service        | 2 +-
 named.service            | 2 +-
 6 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/bind.spec b/bind.spec
index 17ab8c9..f4f9f31 100644
--- a/bind.spec
+++ b/bind.spec
@@ -61,7 +61,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.11.12
-Release:  5%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  6%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1569,6 +1569,9 @@ fi;
 
 
 %changelog
+* Tue Nov 19 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.12-6
+- Report failures on systemctl reload
+
 * Tue Nov 12 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.12-5
 - Fix binary compatibility after serve-stale patch (#1770492)
 
diff --git a/named-chroot.service b/named-chroot.service
index ed9aa51..6898039 100644
--- a/named-chroot.service
+++ b/named-chroot.service
@@ -21,7 +21,7 @@ ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr
 ExecStart=/usr/sbin/named -u named -c ${NAMEDCONF} -t /var/named/chroot $OPTIONS
 
 ; until https://github.com/systemd/systemd/pull/13098 is present, ignore return value
-ExecReload=-/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
+ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
 
 ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'
 
diff --git a/named-pkcs11.service b/named-pkcs11.service
index f0e8913..895383a 100644
--- a/named-pkcs11.service
+++ b/named-pkcs11.service
@@ -17,7 +17,7 @@ ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr
 ExecStart=/usr/sbin/named-pkcs11 -u named -c ${NAMEDCONF} $OPTIONS
 
 ; until https://github.com/systemd/systemd/pull/13098 is present, ignore return value
-ExecReload=-/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
+ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
 
 ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'
 
diff --git a/named-sdb-chroot.service b/named-sdb-chroot.service
index 16a080f..112b835 100644
--- a/named-sdb-chroot.service
+++ b/named-sdb-chroot.service
@@ -21,7 +21,7 @@ ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr
 ExecStart=/usr/sbin/named-sdb -u named -c ${NAMEDCONF} -t /var/named/chroot_sdb $OPTIONS
 
 ; until https://github.com/systemd/systemd/pull/13098 is present, ignore return value
-ExecReload=-/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
+ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
 
 ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'
 
diff --git a/named-sdb.service b/named-sdb.service
index d3ef6e5..ced2b46 100644
--- a/named-sdb.service
+++ b/named-sdb.service
@@ -17,7 +17,7 @@ ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr
 ExecStart=/usr/sbin/named-sdb -u named -c ${NAMEDCONF} $OPTIONS
 
 ; until https://github.com/systemd/systemd/pull/13098 is present, ignore return value
-ExecReload=-/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
+ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
 
 ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'
 
diff --git a/named.service b/named.service
index 86737ea..dd753b5 100644
--- a/named.service
+++ b/named.service
@@ -16,7 +16,7 @@ PIDFile=/run/named/named.pid
 ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
 ExecStart=/usr/sbin/named -u named -c ${NAMEDCONF} $OPTIONS
 ; until https://github.com/systemd/systemd/pull/13098 is present, ignore return value
-ExecReload=-/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
+ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
 
 ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'
 

From 4f643ffc70f7e93ae8c480161776635ce34717bd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 19 Nov 2019 14:01:06 +0100
Subject: [PATCH 090/460] Remove reload related comments from services

Seems systemd already fixes reload return codes. Remove comment from
systemd service files.
---
 named-chroot.service     | 1 -
 named-pkcs11.service     | 1 -
 named-sdb-chroot.service | 1 -
 named-sdb.service        | 1 -
 named.service            | 1 -
 5 files changed, 5 deletions(-)

diff --git a/named-chroot.service b/named-chroot.service
index 6898039..a49df15 100644
--- a/named-chroot.service
+++ b/named-chroot.service
@@ -20,7 +20,6 @@ PIDFile=/var/named/chroot/run/named/named.pid
 ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf -t /var/named/chroot -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
 ExecStart=/usr/sbin/named -u named -c ${NAMEDCONF} -t /var/named/chroot $OPTIONS
 
-; until https://github.com/systemd/systemd/pull/13098 is present, ignore return value
 ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
 
 ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'
diff --git a/named-pkcs11.service b/named-pkcs11.service
index 895383a..27e0693 100644
--- a/named-pkcs11.service
+++ b/named-pkcs11.service
@@ -16,7 +16,6 @@ PIDFile=/run/named/named.pid
 ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
 ExecStart=/usr/sbin/named-pkcs11 -u named -c ${NAMEDCONF} $OPTIONS
 
-; until https://github.com/systemd/systemd/pull/13098 is present, ignore return value
 ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
 
 ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'
diff --git a/named-sdb-chroot.service b/named-sdb-chroot.service
index 112b835..acf88ba 100644
--- a/named-sdb-chroot.service
+++ b/named-sdb-chroot.service
@@ -20,7 +20,6 @@ PIDFile=/var/named/chroot_sdb/run/named/named.pid
 ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf -t /var/named/chroot_sdb -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
 ExecStart=/usr/sbin/named-sdb -u named -c ${NAMEDCONF} -t /var/named/chroot_sdb $OPTIONS
 
-; until https://github.com/systemd/systemd/pull/13098 is present, ignore return value
 ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
 
 ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'
diff --git a/named-sdb.service b/named-sdb.service
index ced2b46..cdf3a62 100644
--- a/named-sdb.service
+++ b/named-sdb.service
@@ -16,7 +16,6 @@ PIDFile=/run/named/named.pid
 ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
 ExecStart=/usr/sbin/named-sdb -u named -c ${NAMEDCONF} $OPTIONS
 
-; until https://github.com/systemd/systemd/pull/13098 is present, ignore return value
 ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
 
 ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'
diff --git a/named.service b/named.service
index dd753b5..7cd6d34 100644
--- a/named.service
+++ b/named.service
@@ -15,7 +15,6 @@ PIDFile=/run/named/named.pid
 
 ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
 ExecStart=/usr/sbin/named -u named -c ${NAMEDCONF} $OPTIONS
-; until https://github.com/systemd/systemd/pull/13098 is present, ignore return value
 ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
 
 ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'

From 74b53c3a5832f0d70da2ce75b0d8f3cf8bac8bc1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 18 Nov 2019 20:01:52 +0100
Subject: [PATCH 091/460] Update to 9.11.13

---
 .gitignore                  |   2 +
 bind-9.11-rh1732883.patch   |  36 ++++----
 bind-9.11-rt46047.patch     |  44 +++++-----
 bind-9.11-serve-stale.patch | 170 ++++++++++++++++++------------------
 bind.spec                   |  11 +--
 sources                     |   3 +-
 6 files changed, 134 insertions(+), 132 deletions(-)

diff --git a/.gitignore b/.gitignore
index f7c73a1..39aba1c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -98,3 +98,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.11.10.tar.gz
 /bind-9.11.11.tar.gz
 /bind-9.11.12.tar.gz
+/bind-9.11.13.tar.gz
+/bind-9.11.13.tar.gz.asc
diff --git a/bind-9.11-rh1732883.patch b/bind-9.11-rh1732883.patch
index 80820b5..14bf265 100644
--- a/bind-9.11-rh1732883.patch
+++ b/bind-9.11-rh1732883.patch
@@ -1,4 +1,4 @@
-From 348947b3d573e2187db61fb43919d2260dcfc135 Mon Sep 17 00:00:00 2001
+From 6010876e561b4345e569ffd11eaec9ea52725817 Mon Sep 17 00:00:00 2001
 From: Pavel Zhukov <pzhukov@redhat.com>
 Date: Wed, 24 Jul 2019 17:15:55 +0200
 Subject: [PATCH] Detect system time jumps
@@ -17,18 +17,16 @@ go_reboot() procedure to request lease extention
  6 files changed, 84 insertions(+), 5 deletions(-)
 
 diff --git a/lib/isc/include/isc/result.h b/lib/isc/include/isc/result.h
-index 0fd4971..2add549 100644
+index 0389efa..149cde5 100644
 --- a/lib/isc/include/isc/result.h
 +++ b/lib/isc/include/isc/result.h
-@@ -87,9 +87,10 @@
- #define ISC_R_CRYPTOFAILURE		65	/*%< cryptography library failure */
- #define ISC_R_DISCQUOTA			66	/*%< disc quota */
+@@ -89,7 +89,8 @@
  #define ISC_R_DISCFULL			67	/*%< disc full */
-+#define ISC_R_TIMESHIFTED               68      /*%< system time changed */
- 
- /*% Not a result code: the number of results. */
--#define ISC_R_NRESULTS 			68
-+#define ISC_R_NRESULTS 			69
+ #define ISC_R_DEFAULT			68	/*%< default */
+ #define ISC_R_IPV4PREFIX		69	/*%< IPv4 prefix */
+-#define ISC_R_NRESULTS 			70
++#define ISC_R_TIMESHIFTED               70      /*%< system time changed */
++#define ISC_R_NRESULTS 			71
  
  ISC_LANG_BEGINDECLS
  
@@ -47,27 +45,27 @@ index 973c348..8160dd3 100644
  /*%
   * Alignment
 diff --git a/lib/isc/result.c b/lib/isc/result.c
-index abb6ed2..8c95a93 100644
+index a9db132..7c04831 100644
 --- a/lib/isc/result.c
 +++ b/lib/isc/result.c
-@@ -103,6 +103,7 @@ static const char *description[ISC_R_NRESULTS] = {
- 	"crypto failure",			/*%< 65 */
- 	"disc quota",				/*%< 66 */
+@@ -105,6 +105,7 @@ static const char *description[ISC_R_NRESULTS] = {
  	"disc full",				/*%< 67 */
-+        "time changed",                         /*%< 68 */
+ 	"default",				/*%< 68 */
+ 	"IPv4 prefix",				/*%< 69 */
++        "time changed",                         /*%< 70 */
  };
  
  static const char *identifier[ISC_R_NRESULTS] = {
-@@ -174,6 +175,7 @@ static const char *identifier[ISC_R_NRESULTS] = {
- 	"ISC_R_CRYPTOFAILURE",
- 	"ISC_R_DISCQUOTA",
+@@ -178,6 +179,7 @@ static const char *identifier[ISC_R_NRESULTS] = {
  	"ISC_R_DISCFULL",
+ 	"ISC_R_DEFAULT",
+ 	"ISC_R_IPV4PREFIX",
 +        "ISC_R_TIMESHIFTED",
  };
  
  #define ISC_RESULT_RESULTSET			2
 diff --git a/lib/isc/unix/app.c b/lib/isc/unix/app.c
-index 7e5a0ee..ceab74e 100644
+index a6e9882..52eb3e0 100644
 --- a/lib/isc/unix/app.c
 +++ b/lib/isc/unix/app.c
 @@ -442,15 +442,48 @@ isc__app_ctxonrun(isc_appctx_t *ctx0, isc_mem_t *mctx, isc_task_t *task,
diff --git a/bind-9.11-rt46047.patch b/bind-9.11-rt46047.patch
index 4bb47e8..8f413f6 100644
--- a/bind-9.11-rt46047.patch
+++ b/bind-9.11-rt46047.patch
@@ -1,4 +1,4 @@
-From 4c7b644910e21e690e5f51d5596a9fe46d9c7b7a Mon Sep 17 00:00:00 2001
+From 5a465424f5249ceaf0547ab90361a16eb08f7a2b Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Thu, 28 Sep 2017 10:09:22 -0700
 Subject: [PATCH] completed and corrected the crypto-random change
@@ -142,10 +142,10 @@ index 31a99e7..38c83ed 100644
  					   usekeyboard);
  
 diff --git a/bin/named/client.c b/bin/named/client.c
-index 2169954..c6c59f7 100644
+index 50fa2cd..524d9a3 100644
 --- a/bin/named/client.c
 +++ b/bin/named/client.c
-@@ -1754,7 +1754,8 @@ ns_client_addopt(ns_client_t *client, dns_message_t *message,
+@@ -1762,7 +1762,8 @@ ns_client_addopt(ns_client_t *client, dns_message_t *message,
  
  		isc_buffer_init(&buf, cookie, sizeof(cookie));
  		isc_stdtime_get(&now);
@@ -156,7 +156,7 @@ index 2169954..c6c59f7 100644
  		compute_cookie(client, now, nonce, ns_g_server->secret, &buf);
  
 diff --git a/bin/named/config.c b/bin/named/config.c
-index de64ca5..833c1dc 100644
+index dbdff64..63da4b0 100644
 --- a/bin/named/config.c
 +++ b/bin/named/config.c
 @@ -98,7 +98,9 @@ options {\n\
@@ -223,7 +223,7 @@ index d955c2f..40621f2 100644
  	} else
  		eresult = ns_control_docommand(request, listener->readonly, &text);
 diff --git a/bin/named/include/named/server.h b/bin/named/include/named/server.h
-index f5ed2b7..b2c1d05 100644
+index 7ee8f66..8982d26 100644
 --- a/bin/named/include/named/server.h
 +++ b/bin/named/include/named/server.h
 @@ -20,6 +20,7 @@
@@ -243,7 +243,7 @@ index f5ed2b7..b2c1d05 100644
  
  struct ns_altsecret {
 diff --git a/bin/named/interfacemgr.c b/bin/named/interfacemgr.c
-index 9bd1f93..851d3c9 100644
+index 9dea7c1..272d300 100644
 --- a/bin/named/interfacemgr.c
 +++ b/bin/named/interfacemgr.c
 @@ -17,6 +17,7 @@
@@ -255,7 +255,7 @@ index 9bd1f93..851d3c9 100644
  #include <isc/task.h>
  #include <isc/util.h>
 diff --git a/bin/named/query.c b/bin/named/query.c
-index 86417c7..55b7b7c 100644
+index c9e5469..0940714 100644
 --- a/bin/named/query.c
 +++ b/bin/named/query.c
 @@ -19,6 +19,7 @@
@@ -267,10 +267,10 @@ index 86417c7..55b7b7c 100644
  #include <isc/serial.h>
  #include <isc/stats.h>
 diff --git a/bin/named/server.c b/bin/named/server.c
-index c782073..bc59cbc 100644
+index 36fc047..3c1eec0 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
-@@ -8204,21 +8204,32 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8208,21 +8208,32 @@ load_configuration(const char *filename, ns_server_t *server,
  	 * Open the source of entropy.
  	 */
  	if (first_time) {
@@ -312,7 +312,7 @@ index c782073..bc59cbc 100644
  #ifdef PATH_RANDOMDEV
  			if (ns_g_fallbackentropy != NULL) {
  				level = ISC_LOG_INFO;
-@@ -8229,8 +8240,8 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8233,8 +8244,8 @@ load_configuration(const char *filename, ns_server_t *server,
  					      NS_LOGCATEGORY_GENERAL,
  					      NS_LOGMODULE_SERVER,
  					      level,
@@ -323,7 +323,7 @@ index c782073..bc59cbc 100644
  					      randomdev,
  					      isc_result_totext(result));
  			}
-@@ -8250,7 +8261,6 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8254,7 +8265,6 @@ load_configuration(const char *filename, ns_server_t *server,
  				}
  				isc_entropy_detach(&ns_g_fallbackentropy);
  			}
@@ -331,7 +331,7 @@ index c782073..bc59cbc 100644
  #endif
  		}
  
-@@ -9018,6 +9028,7 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
+@@ -9022,6 +9032,7 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
  	server->in_roothints = NULL;
  	server->blackholeacl = NULL;
  	server->keepresporder = NULL;
@@ -339,7 +339,7 @@ index c782073..bc59cbc 100644
  
  	/* Must be first. */
  	CHECKFATAL(dst_lib_init2(ns_g_mctx, ns_g_entropy,
-@@ -9044,6 +9055,9 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
+@@ -9048,6 +9059,9 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
  	CHECKFATAL(dns_tkeyctx_create(ns_g_mctx, ns_g_entropy,
  				      &server->tkeyctx),
  		   "creating TKEY context");
@@ -349,7 +349,7 @@ index c782073..bc59cbc 100644
  
  	/*
  	 * Setup the server task, which is responsible for coordinating
-@@ -9250,7 +9264,8 @@ ns_server_destroy(ns_server_t **serverp) {
+@@ -9254,7 +9268,8 @@ ns_server_destroy(ns_server_t **serverp) {
  
  	if (server->zonemgr != NULL)
  		dns_zonemgr_detach(&server->zonemgr);
@@ -359,7 +359,7 @@ index c782073..bc59cbc 100644
  	if (server->tkeyctx != NULL)
  		dns_tkeyctx_destroy(&server->tkeyctx);
  
-@@ -13221,10 +13236,10 @@ newzone_cfgctx_destroy(void **cfgp) {
+@@ -13230,10 +13245,10 @@ newzone_cfgctx_destroy(void **cfgp) {
  
  static isc_result_t
  generate_salt(unsigned char *salt, size_t saltlen) {
@@ -372,7 +372,7 @@ index c782073..bc59cbc 100644
  	} rnd;
  	unsigned char text[512 + 1];
  	isc_region_t r;
-@@ -13234,9 +13249,10 @@ generate_salt(unsigned char *salt, size_t saltlen) {
+@@ -13243,9 +13258,10 @@ generate_salt(unsigned char *salt, size_t saltlen) {
  	if (saltlen > 256U)
  		return (ISC_R_RANGE);
  
@@ -455,7 +455,7 @@ index 2146f9b..64b8e74 100644
  	}
  #endif
 diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
-index 9bf100f..c161e71 100644
+index 33e06e6..539973c 100644
 --- a/doc/arm/Bv9ARM-book.xml
 +++ b/doc/arm/Bv9ARM-book.xml
 @@ -5076,22 +5076,45 @@ badresp:1,adberr:0,findfail:0,valfail:0]
@@ -570,13 +570,13 @@ index 0000000..11c3a7c
 +</section>
 +
 diff --git a/doc/arm/notes.xml b/doc/arm/notes.xml
-index 3a9cfcf..ded2000 100644
+index b16dab6..763ff7e 100644
 --- a/doc/arm/notes.xml
 +++ b/doc/arm/notes.xml
-@@ -23,6 +23,7 @@
-   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-sec-fixes.xml"/>
-   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-new-features.xml"/>
-   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-bug-fixes.xml"/>
+@@ -36,6 +36,7 @@
+   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-9.11.1.xml"/>
+   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-9.11.0.xml"/>
+ 
 +  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-rh-changes.xml"/>
    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-eol.xml"/>
    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-thankyou.xml"/>
diff --git a/bind-9.11-serve-stale.patch b/bind-9.11-serve-stale.patch
index ed03636..350fe62 100644
--- a/bind-9.11-serve-stale.patch
+++ b/bind-9.11-serve-stale.patch
@@ -1,4 +1,4 @@
-From 1196b07e79e1d8d23afd1003a7a242ac06a2f2a2 Mon Sep 17 00:00:00 2001
+From 2bdcb7159b1ac097355e95864e979b4f68bc1a4e Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 7 Nov 2019 14:31:03 +0100
 Subject: [PATCH] Implement serve-stale in 9.11
@@ -276,7 +276,7 @@ Signed-off-by: Petr Menšík <pemensik@redhat.com>
  create mode 100755 bin/tests/system/serve-stale/tests.sh
 
 diff --git a/bin/named/config.c b/bin/named/config.c
-index 63da4b03f6..b598f9bfe3 100644
+index 63da4b0..b598f9b 100644
 --- a/bin/named/config.c
 +++ b/bin/named/config.c
 @@ -182,13 +182,14 @@ options {\n\
@@ -312,7 +312,7 @@ index 63da4b03f6..b598f9bfe3 100644
  	transfer-format many-answers;\n\
  	v6-bias 50;\n\
 diff --git a/bin/named/control.c b/bin/named/control.c
-index df23c26507..8b79850b3d 100644
+index df23c26..8b79850 100644
 --- a/bin/named/control.c
 +++ b/bin/named/control.c
 @@ -282,6 +282,8 @@ ns_control_docommand(isccc_sexpr_t *message, bool readonly,
@@ -325,7 +325,7 @@ index df23c26507..8b79850b3d 100644
  		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
  			      NS_LOGMODULE_CONTROL, ISC_LOG_WARNING,
 diff --git a/bin/named/include/named/control.h b/bin/named/include/named/control.h
-index 8705fdd68a..1634154c1c 100644
+index 8705fdd..1634154 100644
 --- a/bin/named/include/named/control.h
 +++ b/bin/named/include/named/control.h
 @@ -69,6 +69,7 @@
@@ -337,7 +337,7 @@ index 8705fdd68a..1634154c1c 100644
  isc_result_t
  ns_controls_create(ns_server_t *server, ns_controls_t **ctrlsp);
 diff --git a/bin/named/include/named/log.h b/bin/named/include/named/log.h
-index 56bfcd4668..cd8db60ed4 100644
+index 56bfcd4..cd8db60 100644
 --- a/bin/named/include/named/log.h
 +++ b/bin/named/include/named/log.h
 @@ -32,6 +32,7 @@
@@ -349,7 +349,7 @@ index 56bfcd4668..cd8db60ed4 100644
  /*
   * Backwards compatibility.
 diff --git a/bin/named/include/named/query.h b/bin/named/include/named/query.h
-index 9661f56b72..445b578c08 100644
+index 9661f56..445b578 100644
 --- a/bin/named/include/named/query.h
 +++ b/bin/named/include/named/query.h
 @@ -35,6 +35,18 @@ typedef struct ns_dbversion {
@@ -389,22 +389,22 @@ index 9661f56b72..445b578c08 100644
  	bool root_key_sentinel_is_ta;
  	bool root_key_sentinel_not_ta;
 diff --git a/bin/named/include/named/server.h b/bin/named/include/named/server.h
-index b2c1d05497..86f0b2bfb7 100644
+index 8982d26..919ac28 100644
 --- a/bin/named/include/named/server.h
 +++ b/bin/named/include/named/server.h
-@@ -222,7 +222,10 @@ enum {
+@@ -224,7 +224,10 @@ enum {
  
- 	dns_nsstatscounter_keytagopt = 56,
+ 	dns_nsstatscounter_tcphighwater = 57,
  
--	dns_nsstatscounter_max = 57
-+	dns_nsstatscounter_trystale = 57,
-+	dns_nsstatscounter_usedstale = 58,
+-	dns_nsstatscounter_max = 58
++	dns_nsstatscounter_trystale = 58,
++	dns_nsstatscounter_usedstale = 59,
 +
-+	dns_nsstatscounter_max = 59
++	dns_nsstatscounter_max = 60
  };
  
  /*%
-@@ -761,4 +764,12 @@ ns_server_mkeys(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text);
+@@ -763,4 +766,12 @@ ns_server_mkeys(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text);
  isc_result_t
  ns_server_dnstap(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text);
  
@@ -418,7 +418,7 @@ index b2c1d05497..86f0b2bfb7 100644
 +		     isc_buffer_t **text);
  #endif /* NAMED_SERVER_H */
 diff --git a/bin/named/log.c b/bin/named/log.c
-index 3aa25e9a95..12f178b342 100644
+index 3aa25e9..12f178b 100644
 --- a/bin/named/log.c
 +++ b/bin/named/log.c
 @@ -38,6 +38,7 @@ static isc_logcategory_t categories[] = {
@@ -430,7 +430,7 @@ index 3aa25e9a95..12f178b342 100644
  };
  
 diff --git a/bin/named/query.c b/bin/named/query.c
-index 55b7b7cbde..f872dfc842 100644
+index 0940714..882d69c 100644
 --- a/bin/named/query.c
 +++ b/bin/named/query.c
 @@ -125,10 +125,14 @@
@@ -733,7 +733,7 @@ index 55b7b7cbde..f872dfc842 100644
  	    (!PARTIALANSWER(client) || WANTRECURSION(client)
  	     || eresult == DNS_R_DROP)) {
 diff --git a/bin/named/server.c b/bin/named/server.c
-index 109f0dd09f..9580d9e095 100644
+index 0c1f08b..d195bca 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
 @@ -1722,7 +1722,8 @@ static bool
@@ -754,7 +754,7 @@ index 109f0dd09f..9580d9e095 100644
  	    dns_cache_getcachesize(originview->cache) != new_max_cache_size) {
  		return (false);
  	}
-@@ -3289,6 +3291,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
+@@ -3292,6 +3294,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
  	size_t max_acache_size;
  	size_t max_adb_size;
  	uint32_t lame_ttl, fail_ttl;
@@ -762,7 +762,7 @@ index 109f0dd09f..9580d9e095 100644
  	dns_tsig_keyring_t *ring = NULL;
  	dns_view_t *pview = NULL;	/* Production view */
  	isc_mem_t *cmctx = NULL, *hmctx = NULL;
-@@ -3317,6 +3320,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
+@@ -3320,6 +3323,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
  	bool old_rpz_ok = false;
  	isc_dscp_t dscp4 = -1, dscp6 = -1;
  	dns_dyndbctx_t *dctx = NULL;
@@ -770,7 +770,7 @@ index 109f0dd09f..9580d9e095 100644
  
  	REQUIRE(DNS_VIEW_VALID(view));
  
-@@ -3731,6 +3735,24 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
+@@ -3734,6 +3738,24 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
  	if (view->maxncachettl > 7 * 24 * 3600)
  		view->maxncachettl = 7 * 24 * 3600;
  
@@ -795,7 +795,7 @@ index 109f0dd09f..9580d9e095 100644
  	/*
  	 * Configure the view's cache.
  	 *
-@@ -3764,7 +3786,8 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
+@@ -3767,7 +3789,8 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
  	nsc = cachelist_find(cachelist, cachename, view->rdclass);
  	if (nsc != NULL) {
  		if (!cache_sharable(nsc->primaryview, view, zero_no_soattl,
@@ -805,7 +805,7 @@ index 109f0dd09f..9580d9e095 100644
  			isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
  				      NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
  				      "views %s and %s can't share the cache "
-@@ -3863,9 +3886,15 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
+@@ -3866,9 +3889,15 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
  
  	dns_cache_setcleaninginterval(cache, cleaning_interval);
  	dns_cache_setcachesize(cache, max_cache_size);
@@ -821,7 +821,7 @@ index 109f0dd09f..9580d9e095 100644
  	/*
  	 * Resolver.
  	 *
-@@ -4054,6 +4083,21 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
+@@ -4057,6 +4086,21 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
  		maxbits = 4096;
  	view->maxbits = maxbits;
  
@@ -843,7 +843,7 @@ index 109f0dd09f..9580d9e095 100644
  	/*
  	 * Set supported DNSSEC algorithms.
  	 */
-@@ -14414,3 +14458,132 @@ ns_server_dnstap(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text) {
+@@ -14423,3 +14467,132 @@ ns_server_dnstap(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text) {
  	return (ISC_R_NOTIMPLEMENTED);
  #endif
  }
@@ -977,10 +977,10 @@ index 109f0dd09f..9580d9e095 100644
 +	return (result);
 +}
 diff --git a/bin/named/statschannel.c b/bin/named/statschannel.c
-index 7e9ba43a73..92cfcc5e07 100644
+index 4cdf7d6..5b413e7 100644
 --- a/bin/named/statschannel.c
 +++ b/bin/named/statschannel.c
-@@ -295,6 +295,12 @@ init_desc(void) {
+@@ -297,6 +297,12 @@ init_desc(void) {
  		"QryNXRedirRLookup");
  	SET_NSSTATDESC(badcookie, "sent badcookie response", "QryBADCOOKIE");
  	SET_NSSTATDESC(keytagopt, "Keytag option received", "KeyTagOpt");
@@ -994,7 +994,7 @@ index 7e9ba43a73..92cfcc5e07 100644
  
  	/* Initialize resolver statistics */
 diff --git a/bin/rndc/rndc.c b/bin/rndc/rndc.c
-index 8083654ac7..d519983b88 100644
+index 8083654..d519983 100644
 --- a/bin/rndc/rndc.c
 +++ b/bin/rndc/rndc.c
 @@ -160,6 +160,8 @@ command is one of the following:\n\
@@ -1007,7 +1007,7 @@ index 8083654ac7..d519983b88 100644
  		Print a zone's configuration.\n\
    sign zone [class [view]]\n\
 diff --git a/bin/rndc/rndc.docbook b/bin/rndc/rndc.docbook
-index 06b073aaea..6ae8e5da6b 100644
+index 06b073a..6ae8e5d 100644
 --- a/bin/rndc/rndc.docbook
 +++ b/bin/rndc/rndc.docbook
 @@ -688,6 +688,25 @@
@@ -1037,7 +1037,7 @@ index 06b073aaea..6ae8e5da6b 100644
  	<term><userinput>secroots <optional>-</optional> <optional><replaceable>view ...</replaceable></optional></userinput></term>
  	<listitem>
 diff --git a/bin/tests/system/chain/prereq.sh b/bin/tests/system/chain/prereq.sh
-index f3f1939b2a..9ff3f07941 100644
+index f3f1939..9ff3f07 100644
 --- a/bin/tests/system/chain/prereq.sh
 +++ b/bin/tests/system/chain/prereq.sh
 @@ -48,3 +48,10 @@ else
@@ -1052,7 +1052,7 @@ index f3f1939b2a..9ff3f07941 100644
 +    exit 1
 +fi
 diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
-index 81b8e30236..166f0e77f0 100644
+index f781966..d20a830 100644
 --- a/bin/tests/system/conf.sh.in
 +++ b/bin/tests/system/conf.sh.in
 @@ -125,7 +125,7 @@ PARALLELDIRS="dnssec rpzrecurse \
@@ -1065,7 +1065,7 @@ index 81b8e30236..166f0e77f0 100644
  	unknown upforwd verify views wildcard \
  	xfer xferquota zero zonechecks"
 diff --git a/bin/tests/system/dyndb/driver/db.c b/bin/tests/system/dyndb/driver/db.c
-index 02aa6ab2ef..a77c7de98f 100644
+index 02aa6ab..a77c7de 100644
 --- a/bin/tests/system/dyndb/driver/db.c
 +++ b/bin/tests/system/dyndb/driver/db.c
 @@ -629,6 +629,8 @@ static dns_dbmethods_t sampledb_methods = {
@@ -1079,7 +1079,7 @@ index 02aa6ab2ef..a77c7de98f 100644
  /* Auxiliary driver functions. */
 diff --git a/bin/tests/system/serve-stale/.gitignore b/bin/tests/system/serve-stale/.gitignore
 new file mode 100644
-index 0000000000..2272eef9ec
+index 0000000..2272eef
 --- /dev/null
 +++ b/bin/tests/system/serve-stale/.gitignore
 @@ -0,0 +1,11 @@
@@ -1096,7 +1096,7 @@ index 0000000000..2272eef9ec
 +named.run
 diff --git a/bin/tests/system/serve-stale/ans2/ans.pl.in b/bin/tests/system/serve-stale/ans2/ans.pl.in
 new file mode 100644
-index 0000000000..2b39eca916
+index 0000000..2b39eca
 --- /dev/null
 +++ b/bin/tests/system/serve-stale/ans2/ans.pl.in
 @@ -0,0 +1,178 @@
@@ -1280,7 +1280,7 @@ index 0000000000..2b39eca916
 +}
 diff --git a/bin/tests/system/serve-stale/clean.sh b/bin/tests/system/serve-stale/clean.sh
 new file mode 100644
-index 0000000000..2397326374
+index 0000000..2397326
 --- /dev/null
 +++ b/bin/tests/system/serve-stale/clean.sh
 @@ -0,0 +1,15 @@
@@ -1301,7 +1301,7 @@ index 0000000000..2397326374
 +rm -f ns*/named.run
 diff --git a/bin/tests/system/serve-stale/ns1/named1.conf.in b/bin/tests/system/serve-stale/ns1/named1.conf.in
 new file mode 100644
-index 0000000000..8a75a10753
+index 0000000..8a75a10
 --- /dev/null
 +++ b/bin/tests/system/serve-stale/ns1/named1.conf.in
 @@ -0,0 +1,35 @@
@@ -1342,7 +1342,7 @@ index 0000000000..8a75a10753
 +};
 diff --git a/bin/tests/system/serve-stale/ns1/named2.conf.in b/bin/tests/system/serve-stale/ns1/named2.conf.in
 new file mode 100644
-index 0000000000..072e6ec40d
+index 0000000..072e6ec
 --- /dev/null
 +++ b/bin/tests/system/serve-stale/ns1/named2.conf.in
 @@ -0,0 +1,35 @@
@@ -1383,7 +1383,7 @@ index 0000000000..072e6ec40d
 +};
 diff --git a/bin/tests/system/serve-stale/ns1/root.db b/bin/tests/system/serve-stale/ns1/root.db
 new file mode 100644
-index 0000000000..eb9ad3ecf1
+index 0000000..eb9ad3e
 --- /dev/null
 +++ b/bin/tests/system/serve-stale/ns1/root.db
 @@ -0,0 +1,5 @@
@@ -1394,7 +1394,7 @@ index 0000000000..eb9ad3ecf1
 +ns.example.	300	A	10.53.0.2
 diff --git a/bin/tests/system/serve-stale/ns3/named.conf.in b/bin/tests/system/serve-stale/ns3/named.conf.in
 new file mode 100644
-index 0000000000..24a3293fb9
+index 0000000..24a3293
 --- /dev/null
 +++ b/bin/tests/system/serve-stale/ns3/named.conf.in
 @@ -0,0 +1,35 @@
@@ -1435,7 +1435,7 @@ index 0000000000..24a3293fb9
 +};
 diff --git a/bin/tests/system/serve-stale/prereq.sh b/bin/tests/system/serve-stale/prereq.sh
 new file mode 100644
-index 0000000000..a3bbef8f03
+index 0000000..a3bbef8
 --- /dev/null
 +++ b/bin/tests/system/serve-stale/prereq.sh
 @@ -0,0 +1,38 @@
@@ -1479,7 +1479,7 @@ index 0000000000..a3bbef8f03
 +fi
 diff --git a/bin/tests/system/serve-stale/setup.sh b/bin/tests/system/serve-stale/setup.sh
 new file mode 100644
-index 0000000000..690f43c813
+index 0000000..690f43c
 --- /dev/null
 +++ b/bin/tests/system/serve-stale/setup.sh
 @@ -0,0 +1,13 @@
@@ -1498,7 +1498,7 @@ index 0000000000..690f43c813
 +copy_setports ns3/named.conf.in ns3/named.conf
 diff --git a/bin/tests/system/serve-stale/tests.sh b/bin/tests/system/serve-stale/tests.sh
 new file mode 100755
-index 0000000000..201c996921
+index 0000000..201c996
 --- /dev/null
 +++ b/bin/tests/system/serve-stale/tests.sh
 @@ -0,0 +1,536 @@
@@ -2039,7 +2039,7 @@ index 0000000000..201c996921
 +echo "I:exit status: $status"
 +[ $status -eq 0 ] || exit 1
 diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
-index c161e71058..ec1f6f591d 100644
+index 539973c..8528649 100644
 --- a/doc/arm/Bv9ARM-book.xml
 +++ b/doc/arm/Bv9ARM-book.xml
 @@ -4376,6 +4376,9 @@ badresp:1,adberr:0,findfail:0,valfail:0]
@@ -2090,7 +2090,7 @@ index c161e71058..ec1f6f591d 100644
  	  <varlistentry>
  	    <term><command>serial-update-method</command></term>
  	    <listitem>
-@@ -6257,6 +6275,22 @@ options {
+@@ -6275,6 +6293,22 @@ options {
  	      </listitem>
  	    </varlistentry>
  
@@ -2113,7 +2113,7 @@ index c161e71058..ec1f6f591d 100644
  	    <varlistentry>
  	      <term><command>nocookie-udp-size</command></term>
  	      <listitem>
-@@ -7465,14 +7499,20 @@ options {
+@@ -7483,14 +7517,20 @@ options {
  	      <term><command>resolver-query-timeout</command></term>
  	      <listitem>
  		<para>
@@ -2137,7 +2137,7 @@ index c161e71058..ec1f6f591d 100644
  	      </listitem>
  	    </varlistentry>
  	  </variablelist>
-@@ -8956,6 +8996,27 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
+@@ -8976,6 +9016,27 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
  	      </listitem>
  	    </varlistentry>
  
@@ -2166,7 +2166,7 @@ index c161e71058..ec1f6f591d 100644
  	      <term><command>min-roots</command></term>
  	      <listitem>
 diff --git a/doc/arm/logging-categories.xml b/doc/arm/logging-categories.xml
-index 181def7077..59f6afb049 100644
+index 181def7..59f6afb 100644
 --- a/doc/arm/logging-categories.xml
 +++ b/doc/arm/logging-categories.xml
 @@ -311,6 +311,17 @@
@@ -2188,7 +2188,7 @@ index 181def7077..59f6afb049 100644
  	<entry colname="1">
  	  <para><command>spill</command></para>
 diff --git a/doc/arm/notes-rh-changes.xml b/doc/arm/notes-rh-changes.xml
-index 11c3a7ccd5..ba3c2cce9c 100644
+index 11c3a7c..ba3c2cc 100644
 --- a/doc/arm/notes-rh-changes.xml
 +++ b/doc/arm/notes-rh-changes.xml
 @@ -13,6 +13,9 @@
@@ -2220,7 +2220,7 @@ index 11c3a7ccd5..ba3c2cce9c 100644
  </section>
  
 diff --git a/doc/misc/options b/doc/misc/options
-index e11beed292..fde93c7093 100644
+index e11beed..fde93c7 100644
 --- a/doc/misc/options
 +++ b/doc/misc/options
 @@ -225,6 +225,7 @@ options {
@@ -2278,7 +2278,7 @@ index e11beed292..fde93c7093 100644
          topology { <address_match_element>; ... }; // not implemented
          transfer-format ( many-answers | one-answer );
 diff --git a/lib/bind9/check.c b/lib/bind9/check.c
-index e0803d4fa6..296e364bd9 100644
+index 5c057a4..7b82618 100644
 --- a/lib/bind9/check.c
 +++ b/lib/bind9/check.c
 @@ -99,7 +99,8 @@ check_orderent(const cfg_obj_t *ent, isc_log_t *logctx) {
@@ -2489,7 +2489,7 @@ index e0803d4fa6..296e364bd9 100644
  			}
  		}
  	}
-@@ -1523,7 +1542,8 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
+@@ -1508,7 +1527,8 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
  				    "%" PRId64 "' "
  				    "is too small",
  				    mapsize);
@@ -2499,7 +2499,7 @@ index e0803d4fa6..296e364bd9 100644
  		} else if (mapsize > (1ULL << 40)) { /* 1 terabyte */
  			cfg_obj_log(obj, logctx,
  				    ISC_LOG_ERROR,
-@@ -1531,10 +1551,20 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
+@@ -1516,10 +1536,20 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
  				    "%" PRId64 "' "
  				    "is too large",
  				    mapsize);
@@ -2522,7 +2522,7 @@ index e0803d4fa6..296e364bd9 100644
  }
  
 diff --git a/lib/dns/cache.c b/lib/dns/cache.c
-index 4701ff8574..97e427a53c 100644
+index 4701ff8..97e427a 100644
 --- a/lib/dns/cache.c
 +++ b/lib/dns/cache.c
 @@ -138,6 +138,7 @@ struct dns_cache {
@@ -2592,7 +2592,7 @@ index 4701ff8574..97e427a53c 100644
   * The cleaner task is shutting down; do the necessary cleanup.
   */
 diff --git a/lib/dns/db.c b/lib/dns/db.c
-index ee3e00d53c..576aa65992 100644
+index ee3e00d..576aa65 100644
 --- a/lib/dns/db.c
 +++ b/lib/dns/db.c
 @@ -1130,3 +1130,25 @@ dns_db_nodefullname(dns_db_t *db, dns_dbnode_t *node, dns_name_t *name) {
@@ -2622,7 +2622,7 @@ index ee3e00d53c..576aa65992 100644
 +	return (ISC_R_NOTIMPLEMENTED);
 +}
 diff --git a/lib/dns/ecdb.c b/lib/dns/ecdb.c
-index 6e5a4ae4e4..3aa0ac478d 100644
+index 47994ea..23bfe7d 100644
 --- a/lib/dns/ecdb.c
 +++ b/lib/dns/ecdb.c
 @@ -588,7 +588,9 @@ static dns_dbmethods_t ecdb_methods = {
@@ -2637,7 +2637,7 @@ index 6e5a4ae4e4..3aa0ac478d 100644
  
  static isc_result_t
 diff --git a/lib/dns/include/dns/cache.h b/lib/dns/include/dns/cache.h
-index 62797dbbd4..714b78eb74 100644
+index 62797db..714b78e 100644
 --- a/lib/dns/include/dns/cache.h
 +++ b/lib/dns/include/dns/cache.h
 @@ -260,6 +260,27 @@ dns_cache_getcachesize(dns_cache_t *cache);
@@ -2669,7 +2669,7 @@ index 62797dbbd4..714b78eb74 100644
  dns_cache_flush(dns_cache_t *cache);
  /*%<
 diff --git a/lib/dns/include/dns/db.h b/lib/dns/include/dns/db.h
-index ae6ae36596..5079053d91 100644
+index ae6ae36..5079053 100644
 --- a/lib/dns/include/dns/db.h
 +++ b/lib/dns/include/dns/db.h
 @@ -197,6 +197,8 @@ typedef struct dns_dbmethods {
@@ -2729,7 +2729,7 @@ index ae6ae36596..5079053d91 100644
  
  #endif /* DNS_DB_H */
 diff --git a/lib/dns/include/dns/rdataset.h b/lib/dns/include/dns/rdataset.h
-index 5295d8e4d7..97071ed496 100644
+index 5295d8e..97071ed 100644
 --- a/lib/dns/include/dns/rdataset.h
 +++ b/lib/dns/include/dns/rdataset.h
 @@ -128,6 +128,7 @@ struct dns_rdataset {
@@ -2783,7 +2783,7 @@ index 5295d8e4d7..97071ed496 100644
  /*%
   * _OMITDNSSEC:
 diff --git a/lib/dns/include/dns/resolver.h b/lib/dns/include/dns/resolver.h
-index 6da41b7a5a..7b397cb6d2 100644
+index 6da41b7..7b397cb 100644
 --- a/lib/dns/include/dns/resolver.h
 +++ b/lib/dns/include/dns/resolver.h
 @@ -547,9 +547,12 @@ dns_resolver_getmustbesecure(dns_resolver_t *resolver, dns_name_t *name);
@@ -2852,7 +2852,7 @@ index 6da41b7a5a..7b397cb6d2 100644
  dns_resolver_getoptions(dns_resolver_t *resolver);
  
 diff --git a/lib/dns/include/dns/types.h b/lib/dns/include/dns/types.h
-index 567e8a879e..7bf2b60d42 100644
+index 567e8a8..7bf2b60 100644
 --- a/lib/dns/include/dns/types.h
 +++ b/lib/dns/include/dns/types.h
 @@ -385,6 +385,12 @@ typedef enum {
@@ -2869,7 +2869,7 @@ index 567e8a879e..7bf2b60d42 100644
   * Functions.
   */
 diff --git a/lib/dns/include/dns/view.h b/lib/dns/include/dns/view.h
-index c849dec154..647ca2ac08 100644
+index c849dec..647ca2a 100644
 --- a/lib/dns/include/dns/view.h
 +++ b/lib/dns/include/dns/view.h
 @@ -229,6 +229,9 @@ struct dns_view {
@@ -2883,7 +2883,7 @@ index c849dec154..647ca2ac08 100644
  
  #define DNS_VIEW_MAGIC			ISC_MAGIC('V','i','e','w')
 diff --git a/lib/dns/master.c b/lib/dns/master.c
-index 2a87bca3bc..ac4bb195ca 100644
+index 2a87bca..ac4bb19 100644
 --- a/lib/dns/master.c
 +++ b/lib/dns/master.c
 @@ -1948,12 +1948,18 @@ load_text(dns_loadctx_t *lctx) {
@@ -2910,7 +2910,7 @@ index 2a87bca3bc..ac4bb195ca 100644
  
  		/*
 diff --git a/lib/dns/masterdump.c b/lib/dns/masterdump.c
-index 7edef6ad9b..daf355748b 100644
+index 13d1a3e..873b694 100644
 --- a/lib/dns/masterdump.c
 +++ b/lib/dns/masterdump.c
 @@ -81,6 +81,9 @@ struct dns_master_style {
@@ -2931,7 +2931,7 @@ index 7edef6ad9b..daf355748b 100644
  } dns_totext_ctx_t;
  
  LIBDNS_EXTERNAL_DATA const dns_master_style_t
-@@ -386,6 +390,7 @@ totext_ctx_init(const dns_master_style_t *style, dns_totext_ctx_t *ctx) {
+@@ -382,6 +386,7 @@ totext_ctx_init(const dns_master_style_t *style, dns_totext_ctx_t *ctx) {
  	ctx->neworigin = NULL;
  	ctx->current_ttl = 0;
  	ctx->current_ttl_valid = false;
@@ -2939,7 +2939,7 @@ index 7edef6ad9b..daf355748b 100644
  
  	return (ISC_R_SUCCESS);
  }
-@@ -1036,6 +1041,11 @@ dump_rdatasets_text(isc_mem_t *mctx, dns_name_t *name,
+@@ -1028,6 +1033,11 @@ dump_rdatasets_text(isc_mem_t *mctx, dns_name_t *name,
  		    (ctx->style.flags & DNS_STYLEFLAG_NCACHE) == 0) {
  			/* Omit negative cache entries */
  		} else {
@@ -2951,7 +2951,7 @@ index 7edef6ad9b..daf355748b 100644
  			isc_result_t result =
  				dump_rdataset(mctx, name, rds, ctx,
  					       buffer, f);
-@@ -1504,6 +1514,16 @@ dumpctx_create(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version,
+@@ -1496,6 +1506,16 @@ dumpctx_create(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version,
  	dns_db_attach(db, &dctx->db);
  
  	dctx->do_date = dns_db_iscache(dctx->db);
@@ -2968,7 +2968,7 @@ index 7edef6ad9b..daf355748b 100644
  
  	if (dctx->format == dns_masterformat_text &&
  	    (dctx->tctx.style.flags & DNS_STYLEFLAG_REL_OWNER) != 0) {
-@@ -1563,6 +1583,9 @@ writeheader(dns_dumpctx_t *dctx) {
+@@ -1555,6 +1575,9 @@ writeheader(dns_dumpctx_t *dctx) {
  		 * it in the zone case.
  		 */
  		if (dctx->do_date) {
@@ -2979,7 +2979,7 @@ index 7edef6ad9b..daf355748b 100644
  			RUNTIME_CHECK(result == ISC_R_SUCCESS);
  			isc_buffer_usedregion(&buffer, &r);
 diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
-index ada888cff9..39499359c8 100644
+index 738aa20..5055fcb 100644
 --- a/lib/dns/rbtdb.c
 +++ b/lib/dns/rbtdb.c
 @@ -488,6 +488,7 @@ typedef ISC_LIST(rdatasetheader_t)      rdatasetheaderlist_t;
@@ -3310,7 +3310,7 @@ index ada888cff9..39499359c8 100644
  				}
  			}
  			if (rbtversion != NULL && !header_nx) {
-@@ -8313,6 +8433,30 @@ nodefullname(dns_db_t *db, dns_dbnode_t *node, dns_name_t *name) {
+@@ -8310,6 +8430,30 @@ nodefullname(dns_db_t *db, dns_dbnode_t *node, dns_name_t *name) {
  	return (result);
  }
  
@@ -3341,7 +3341,7 @@ index ada888cff9..39499359c8 100644
  static dns_dbmethods_t zone_methods = {
  	attach,
  	detach,
-@@ -8358,7 +8502,9 @@ static dns_dbmethods_t zone_methods = {
+@@ -8355,7 +8499,9 @@ static dns_dbmethods_t zone_methods = {
  	NULL,
  	hashsize,
  	nodefullname,
@@ -3352,7 +3352,7 @@ index ada888cff9..39499359c8 100644
  };
  
  static dns_dbmethods_t cache_methods = {
-@@ -8406,7 +8552,9 @@ static dns_dbmethods_t cache_methods = {
+@@ -8403,7 +8549,9 @@ static dns_dbmethods_t cache_methods = {
  	setcachestats,
  	hashsize,
  	nodefullname,
@@ -3363,7 +3363,7 @@ index ada888cff9..39499359c8 100644
  };
  
  isc_result_t
-@@ -8677,7 +8825,7 @@ dns_rbtdb_create
+@@ -8674,7 +8822,7 @@ dns_rbtdb_create
  	rbtdb->rpzs = NULL;
  	rbtdb->load_rpzs = NULL;
  	rbtdb->rpz_num = DNS_RPZ_INVALID_NUM;
@@ -3372,7 +3372,7 @@ index ada888cff9..39499359c8 100644
  	/*
  	 * Version Initialization.
  	 */
-@@ -9095,7 +9243,8 @@ rdatasetiter_first(dns_rdatasetiter_t *iterator) {
+@@ -9092,7 +9240,8 @@ rdatasetiter_first(dns_rdatasetiter_t *iterator) {
  				 * rdatasets to work.
  				 */
  				if (NONEXISTENT(header) ||
@@ -3382,7 +3382,7 @@ index ada888cff9..39499359c8 100644
  					header = NULL;
  				break;
  			} else
-@@ -10283,7 +10432,7 @@ static inline bool
+@@ -10280,7 +10429,7 @@ static inline bool
  need_headerupdate(rdatasetheader_t *header, isc_stdtime_t now) {
  	if ((header->attributes &
  	     (RDATASET_ATTR_NONEXISTENT |
@@ -3391,7 +3391,7 @@ index ada888cff9..39499359c8 100644
  	      RDATASET_ATTR_ZEROTTL)) != 0)
  		return (false);
  
-@@ -10389,7 +10538,7 @@ expire_header(dns_rbtdb_t *rbtdb, rdatasetheader_t *header,
+@@ -10386,7 +10535,7 @@ expire_header(dns_rbtdb_t *rbtdb, rdatasetheader_t *header,
  	      bool tree_locked, expire_t reason)
  {
  	set_ttl(rbtdb, header, 0);
@@ -3401,7 +3401,7 @@ index ada888cff9..39499359c8 100644
  	/*
  	 * Caller must hold the node (write) lock.
 diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
-index cefa53d904..54a624fc25 100644
+index 04a58c0..164fc01 100644
 --- a/lib/dns/resolver.c
 +++ b/lib/dns/resolver.c
 @@ -141,16 +141,17 @@
@@ -3445,7 +3445,7 @@ index cefa53d904..54a624fc25 100644
  	/* Locked by lock. */
  	unsigned int			references;
  	bool			exiting;
-@@ -1602,14 +1607,12 @@ fctx_setretryinterval(fetchctx_t *fctx, unsigned int rtt) {
+@@ -1617,14 +1622,12 @@ fctx_setretryinterval(fetchctx_t *fctx, unsigned int rtt) {
  	unsigned int seconds;
  	unsigned int us;
  
@@ -3464,7 +3464,7 @@ index cefa53d904..54a624fc25 100644
  
  	/*
  	 * Add a fudge factor to the expected rtt based on the current
-@@ -4453,7 +4456,8 @@ fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type,
+@@ -4481,7 +4484,8 @@ fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type,
  	/*
  	 * Compute an expiration time for the entire fetch.
  	 */
@@ -3474,7 +3474,7 @@ index cefa53d904..54a624fc25 100644
  	iresult = isc_time_nowplusinterval(&fctx->expires, &interval);
  	if (iresult != ISC_R_SUCCESS) {
  		UNEXPECTED_ERROR(__FILE__, __LINE__,
-@@ -8937,6 +8941,8 @@ dns_resolver_create(dns_view_t *view,
+@@ -8965,6 +8969,8 @@ dns_resolver_create(dns_view_t *view,
  	res->spillattimer = NULL;
  	res->zspill = 0;
  	res->zero_no_soa_ttl = false;
@@ -3483,7 +3483,7 @@ index cefa53d904..54a624fc25 100644
  	res->query_timeout = DEFAULT_QUERY_TIMEOUT;
  	res->maxdepth = DEFAULT_RECURSION_DEPTH;
  	res->maxqueries = DEFAULT_MAX_QUERIES;
-@@ -10263,17 +10269,20 @@ dns_resolver_gettimeout(dns_resolver_t *resolver) {
+@@ -10291,17 +10297,20 @@ dns_resolver_gettimeout(dns_resolver_t *resolver) {
  }
  
  void
@@ -3512,7 +3512,7 @@ index cefa53d904..54a624fc25 100644
  }
  
  void
-@@ -10370,3 +10379,34 @@ dns_resolver_getquotaresponse(dns_resolver_t *resolver, dns_quotatype_t which)
+@@ -10398,3 +10407,34 @@ dns_resolver_getquotaresponse(dns_resolver_t *resolver, dns_quotatype_t which)
  
  	return (resolver->quotaresp[which]);
  }
@@ -3548,7 +3548,7 @@ index cefa53d904..54a624fc25 100644
 +	resolver->nonbackofftries = tries;
 +}
 diff --git a/lib/dns/sdb.c b/lib/dns/sdb.c
-index d4c8c673c8..ee9be79cb9 100644
+index d4c8c67..ee9be79 100644
 --- a/lib/dns/sdb.c
 +++ b/lib/dns/sdb.c
 @@ -1368,7 +1368,9 @@ static dns_dbmethods_t sdb_methods = {
@@ -3563,7 +3563,7 @@ index d4c8c673c8..ee9be79cb9 100644
  
  static isc_result_t
 diff --git a/lib/dns/sdlz.c b/lib/dns/sdlz.c
-index 0b9620c76c..331992ebdd 100644
+index 0b9620c..331992e 100644
 --- a/lib/dns/sdlz.c
 +++ b/lib/dns/sdlz.c
 @@ -1336,7 +1336,9 @@ static dns_dbmethods_t sdlzdb_methods = {
@@ -3578,7 +3578,7 @@ index 0b9620c76c..331992ebdd 100644
  
  /*
 diff --git a/lib/dns/tests/db_test.c b/lib/dns/tests/db_test.c
-index 35cf21d0f2..bf39545d4f 100644
+index 35cf21d..bf39545 100644
 --- a/lib/dns/tests/db_test.c
 +++ b/lib/dns/tests/db_test.c
 @@ -28,8 +28,9 @@
@@ -3809,7 +3809,7 @@ index 35cf21d0f2..bf39545d4f 100644
  						_setup, _teardown),
  		cmocka_unit_test_setup_teardown(dbtype_test,
 diff --git a/lib/dns/view.c b/lib/dns/view.c
-index a1a4301b5d..abf6a4cce9 100644
+index a1a4301..abf6a4c 100644
 --- a/lib/dns/view.c
 +++ b/lib/dns/view.c
 @@ -229,6 +229,9 @@ dns_view_create(isc_mem_t *mctx, dns_rdataclass_t rdclass,
@@ -3823,7 +3823,7 @@ index a1a4301b5d..abf6a4cce9 100644
  	view->maxbits = 0;
  	view->v4_aaaa = dns_aaaa_ok;
 diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
-index 7bad989be1..bbf4b45c10 100644
+index 7bad989..bbf4b45 100644
 --- a/lib/isccfg/namedconf.c
 +++ b/lib/isccfg/namedconf.c
 @@ -1778,6 +1778,7 @@ view_clauses[] = {
diff --git a/bind.spec b/bind.spec
index f4f9f31..ee0a916 100644
--- a/bind.spec
+++ b/bind.spec
@@ -53,15 +53,15 @@
 
 # lib*.so.X versions of selected libraries
 %global sover_dns 1107
-%global sover_isc 1100
+%global sover_isc 1104
 %global sover_irs 161
 %global sover_isccfg 163
 
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.11.12
-Release:  6%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Version:  9.11.13
+Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -157,7 +157,6 @@ Patch173:bind-9.11-rh1732883.patch
 # Make sure jsonccp-devel does not interfere
 Patch174:bind-9.11-json-c.patch
 Patch175:bind-9.11-fips-disable.patch
-Patch176: bind-9.11-rh1768258.patch
 Patch177: bind-9.11-serve-stale.patch
 Patch178: bind-9.11-serve-stale-dbfix.patch
 
@@ -551,7 +550,6 @@ are used for building ISC DHCP.
 %patch173 -p1 -b .rh1732883
 %patch174 -p1 -b .json-c
 %patch175 -p1 -b .rh1709553
-%patch176 -p1 -b .rh1768258
 %patch177 -p1 -b .serve-stale
 %patch178 -p1 -b .rh1770492
 
@@ -1569,6 +1567,9 @@ fi;
 
 
 %changelog
+* Tue Nov 19 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.13-1
+- Update to 9.11.13
+
 * Tue Nov 19 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.12-6
 - Report failures on systemctl reload
 
diff --git a/sources b/sources
index 29d4646..d213c25 100644
--- a/sources
+++ b/sources
@@ -1 +1,2 @@
-SHA512 (bind-9.11.12.tar.gz) = 7e2b9ef4ed5a00c2e5310c932c177887aed330d94eefc87d732dda010f2b71477e2f9d6ea89422ccbc8f6f04ceb83419b758218bcc02f25b34751bad974174e8
+SHA512 (bind-9.11.13.tar.gz) = 6e5289ff231b8d7d2f02ae02a1cf43abff3e507e1d96d8ec002dc71097fc77dc5514762ff1ea5918159c88319b1d5eed78c6dc1a7835173db234d4ee887644bc
+SHA512 (bind-9.11.13.tar.gz.asc) = 5b32adee7d45cdd2921126e898824839f6a0a5574c0ae5a441fc7df78681ebf872a276d6e434e8043cf9ec504f57c2b8fdf79fdb141e32dac5c4fa57c18d52f4

From 547656b46966b38e600806da43d91c4fbac5f4ca Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 25 Nov 2019 21:00:46 +0100
Subject: [PATCH 092/460] Add source verification on build
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Include verification on build time, with link to GPG keys on upstream
site.

Signed-off-by: Petr Menšík <pemensik@redhat.com>
---
 bind.spec        |   3 +
 codesign2019.txt | 252 +++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 255 insertions(+)
 create mode 100644 codesign2019.txt

diff --git a/bind.spec b/bind.spec
index ee0a916..b32ab64 100644
--- a/bind.spec
+++ b/bind.spec
@@ -69,6 +69,7 @@ Source:   https://ftp.isc.org/isc/bind9/%{BINDVERSION}/bind-%{BINDVERSION}.tar.g
 Source1:  named.sysconfig
 Source2:  https://ftp.isc.org/isc/bind9/%{BINDVERSION}/bind-%{BINDVERSION}.tar.gz.asc
 Source3:  named.logrotate
+Source4:  https://downloads.isc.org/isc/pgpkeys/codesign2019.txt
 Source7:  bind-9.3.1rc1-sdb_tools-Makefile.in
 Source8:  dnszone.schema
 Source12: README.sdb_pgsql
@@ -196,6 +197,7 @@ BuildRequires:  selinux-policy
 BuildRequires:  python3-devel
 BuildRequires:  python3-ply
 BuildRequires:  findutils sed
+BuildRequires:  gnupg2
 %if %{with SDB}
 BuildRequires:  openldap-devel, libpq-devel, sqlite-devel, mariadb-connector-c-devel
 BuildRequires:  libdb-devel
@@ -518,6 +520,7 @@ are used for building ISC DHCP.
 %endif
 
 %prep
+%{gpgverify} --keyring='%{SOURCE4}' --signature='%{SOURCE2}' --data='%{SOURCE0}'
 %setup -q -n %{name}-%{BINDVERSION}
 
 # Common patches
diff --git a/codesign2019.txt b/codesign2019.txt
new file mode 100644
index 0000000..1807b58
--- /dev/null
+++ b/codesign2019.txt
@@ -0,0 +1,252 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Comment: GPGTools - http://gpgtools.org
+
+mQINBFwq9BQBEADHjPDCwsHVtxnMNilgu187W8a9rYTMLgLfQwioSbjsF7dUJu8m
+r1w2stcsatRs7HBk/j26RNJagY2Jt0QufOQLlTePpTl6UPU8EeiJ8c15DNf45TMk
+pa/3MdIVpDnBioyD1JNqsI4z+yCYZ7p/TRVCyh5vCcwmt5pdKjKMTcu7aD2PtTtI
+yhTIetJavy1HQmgOl4/t/nKL7Lll2xtZ56JFUt7epo0h69fiUvPewkhykzoEf4UG
+ZFHSLZKqdMNPs/Jr9n7zS+iOgEXJnKDkp8SoXpAcgJ5fncROMXpxgY2U+G5rB9n0
+/hvV1zG+EP6OLIGqekiDUga84LdmR/8Cyc7DimUmaoIZXrAo0Alpt0aZ8GimdKmh
+qirIguJOSrrsZTeZLilCWu37fRIjCQ3dSMNyhHJaOhRJQpQOEDG7jHxFak7627aF
+UnVwBAOK3NlFfbomapXQm64lYNoONGrpV0ctueD3VoPipxIyzNHHgcsXDZ6C00sv
+SbuuS9jlFEDonA6S8tApKgkEJuToBuopM4xqqwHNJ4e6QoXYjERIgIBTco3r/76D
+o22ZxSK1m2m2i+p0gnWTlFn6RH+r6gfLwZRj8iR4fa0yMn3DztyTO6H8AiaslONt
+LV2kvkhBar1/6dzlBvMdiRBejrVnw+Jg2bOmYTncFN00szPOXbEalps8wwARAQAB
+tE1JbnRlcm5ldCBTeXN0ZW1zIENvbnNvcnRpdW0sIEluYy4gKFNpZ25pbmcga2V5
+LCAyMDE5LTIwMjApIDxjb2Rlc2lnbkBpc2Mub3JnPokCVAQTAQgAPhYhBK4/rHln
+EexZ/AB6pHS7a5pMuz04BQJcKvQUAhsDBQkD7JcABQsJCAcCBhUKCQgLAgQWAgMB
+Ah4BAheAAAoJEHS7a5pMuz0476oP/1+UaSHfe4WVHV43QaQ/z1rw7vg2aHEwyWJA
+1D1tBr9+LvfohswwWBLIjcKRaoXZ4pLBFjuiYHBTsdaAQFeQQvQTXMmBx21ZyUZj
+tjim8f9T1JhmIrMx6tF14NbqFpjw82Mv0rc8y74pdRvkdnFigqLKUoN2tFQlKeG+
+5T24zNwrGrlR3S7gnM47nD1JqKwt4GnczLnMBW/0gbLscMUpAeNo/gY4g0GV/zkn
+Rt91bLpcEyDAv+ZhQZbkJ49dnNzl5cTK5+uQWnlAZAdPecdLkvBNRNgj/FKL41RF
+JGN6eqq3+jlPbyj9okeJoGQ64Ibv1ZHVTQIx5vT1+PuVX/Nm0GqSUZdLqR33daKI
+hjpgUdUK/D0AnN5ulVuE1NnZWjVDTXVEeU8DFvi4lxZVHnZixejxFIZ7vRMvyaHa
+xLwbevwEUuPLzWn3XhC5yQeqCe6zmzzaPhPlg6NTnM5wgzcKORqCXgxzmtnX+Pbd
+gXTwNKAJId/141vj1OtZQKJexG9QLufMjBg5rg/qdKooozremeM+FovIocbdFnmX
+pzP8it8r8FKi7FpXRE3fwxwba4Y9AS2/owtuixlJ2+7M2OXwZEtxyXTXw2v5GFOP
+vN64G/b71l9c3yKVlQ3BXD0jErv9XcieeFDR9PK0XGlsxykPcIXZYVy2KSWptkSf
+6f2op3tMiQEzBBABCAAdFiEEFcm6uMUTPAcGawLtlumWUDlMmawFAlwuSqAACgkQ
+lumWUDlMmaz+igf/ZW8OY5aWjRk7QiXp93jkWRIbMi8kB9jW5u6tfYXFjMADpqiQ
+yYdzEHFayRF92PQwj81UzIWzOWjErFWLDE2xol9sP5LdzeqoyED+XTqKggpVsIs+
+Lq672qnumQoZKp1YGb8MDocU2DNg/VsMdi7kCnEnPbcSuBxksmxGYomusXNrAF94
+1OJ2sqd9BuFamLIyn8XUCGGYlsvMoe4kTCg6Cc1sQvx0lDG8urKN57jBKWbP4alV
++JBV5KQcf74gzPmE3ypgY1tMEwxyH/WyS9ekDbai0qauX6eUAsM1bduH8fIcknLS
+Zl5hrJTrzWFF9/DKOth8QOwhJ9zoIF1fcAsx9okBMwQQAQgAHRYhBHpqR7X54SM6
+0lUrXL2X3GOe6MR7BQJcLktcAAoJEL2X3GOe6MR7jwEH/iaolMeno1oeWAgzN6Mg
+bx3maweh/9Vqty1fwk7Crq1G78X5i1OCkknEL2p0Bfle4ApwcC4HZVcqCgoYpRV3
+/EEXtwkMNy3plWdBbLCQSev/E1D39GzgAHiMnv7NUJnkoJbvMrvrAiUTXPTtARMM
+gjEpvgEs60wuJxS8ESomRhe/KW4myxDoBxF+K+e5bOkOvvWVcAYJHWZ1BIZs4n6b
++C2vO8q5aKTkQ/XvNT7utbTOqj1SGhItRaAQKXHBdzkQ1Et3wTA4+uRg4gK12624
+9LperYs26w9X9UzApl+qVxQhtWUw3tnUXMastDfQrRcvJgq1xpv++OqX5Uc93RTf
+SNWJAjMEEAEIAB0WIQS+DpdItxglOii7if/xsRvwXPAuVwUCXC5LlQAKCRDxsRvw
+XPAuV29KEACEwlTVVKe4gnBYHnlAD7csoQ0+gJ6C+Ofzlw+UItRIcFeVCAknSGBs
+NPxr9JStIvKpmsbSKpCNUEAYnRP2immh94y/C6BuTe1uUUmqBGr1f4OAUwZpmI29
+ixYeY/uUs9FZO3bS0/WtG46tdcJK41qtM0DYAGT3oeZhJMTW15dfvMGlFukauSOU
++BbR+6sZhqdbWl/AOTE/6x5otnAaW0GObY/BW240Xq/KTgBrzVdK5qNoYsMVsiTd
+0im0JKvFG08ED+ZfcILhlO6G9jRhoTkhtYuf8CKN1dPf2IoB5FrRFf0xqRr9hNlk
+X7ViNMP9OPb8i3BubWvRi5rNSquCwrFATSiAgaA9Yi1BNzQsmQxOql9lsh7eCH7m
++8zzUg9umWI6PkSv8vHBo2kPX73wmtEsF6vxJlk0yDBuQw7y0uuKh406tEEk4cP2
+8U4baq+ihpioupDhNuEII1h1Eh/RBE408RAOpcr+2F0m/fKOoJyz7u+AxyV81Ia6
+fyBnUfZnlfKo16w87c1HJRs9dKkRa5yGziBf9TcED3sru58Pftes2Nr80/iOh26i
+P2pRihcIyrmeAqDWnneErVCmPMDTe6zkMrm/0iZ25/Jfq+M8IHEzFEw3Y1FBOeFg
+9TyMDwYG2biJPTNTDO0BQ+Rrvs4SjFWEYSxgJSvG1jMfSPt5AR6MJrkCDQRcKvQU
+ARAAufZX5WzJr0lZAhxaGpHY6JMBr4jVOCP4TrDZhwC2K4CXNM/PLLNisWzquiWa
+FvUDhB89kCxrEhipwVFYhBr16CDQxrr8yhah3RIxrBMYhRTxgIAkANgkhGWfDJSE
+zXauA7krYtS3rYwhfXe4cNsTkLPbnMUlyLJcqj2wnZcZIt97aL+NFRPyfIw1KfUb
+9u3tB9seDYbvTEULeL07aTnHpWM5f3bTwJrJ2OFPzXseCCzPiVNh3Bv+YtJ1pMTr
+c/UHO5DoJuHLsF0wicPSrpD0twspFdR/0rT6eNycsaCtV4GQzBcMPvY7qai5XrZm
+Cqgluo1W6l6+F5YrKvRMtyyFkUNGcPywdjSlP44JyRrS2uzvFUViSsJArcmFG2TJ
+LCohnse8wqjw0dIUVbmDbE4zjaG56zkvu0k+04Wwp3XPgOZrbl6cbhX3yLhu/Gt0
+dzd9EReoNfKXk32hBzKas/vdeB5DZejbOOOWYftqyZC1LvDvvrYFhFK6VGozfZ6L
+Fml1hzn+xPahp5tRv93/T9zXeVPm9zilGMqm/gjRgh8ojWxNQoNzJyqTPWIvWmbu
+EIP3T3cTFq6lJpJsg3+sfzofGWZCGnBZQGqm8rEOoUWiaKe1BvQCX1x8p4/x8/tX
+TaVDpQCGoqxXt09plkDuGMuiDICxBlaHWUR2jLoHc2cLrB8AEQEAAYkCPAQYAQgA
+JhYhBK4/rHlnEexZ/AB6pHS7a5pMuz04BQJcKvQUAhsMBQkD7JcAAAoJEHS7a5pM
+uz04pB8P/Amfg54IFeALiPOrKbjC3bVAQzrsf09IL8sUln/LCZIx9HgGAJj/f35S
+Q35sK2ucjWiDX6qCxVrWmC6caQXFgXOFSKIlqladmmgj4sIdLM5wj4nbomHChpB5
+rqV/GgkFwWBQ3kPCatXvc8Bg+zKJ+wXgTuPFXefyE9R+SLuas2grQ9hAjvTGHYbq
+iYxSlNDFc1aHLAQ3bS76351MHuMHOpLzoB0OkZDCVNW4GNEqrLbINdr50RAK+Loo
+Z2UBIobEZjXYor9A2FWkSvdjyz6X1QKMdQMath6R91k/O0abBa7ly4/805eAGXM3
+w1Xf2eMlpiUs69BeYoJBklK8aNMntpDREunJjhiPU4JoDzSxl5Qv7LuXylyo0YJA
+9YmydKhTTcRdwsKc//nGr/ckg4BRl+VbtJBYvd3xGB7IQ+pT/TOakv9qCospAhr3
+EQjVP/XpnWJRd+x+dq8UXqwWmTenWDE42cNr7BDFJdOqS5ZWy4sIz4sdjpSxXMB9
+8iiRtKSpKRCJgXScB7SYebh835EgG2YyQGdhJMO7C6ok9POYQBqL8sBqRzImJKoT
+VDvOH42WArKwJWTHa4mPdiDHEIZlkONerec3JXtl4Mfv8cwZ5Lb8fSiB/x8AWvqs
+puc/7hQtkus4TcgutS1fwhAwpnFItpVF6+73CMQrJsblBdTjW0T+uQINBFxbVHwB
+EADebZOJbhPdhHeBPdlZYE3rRjB8scDpWdjrCupfmeTC9MM6JgCE4DEMBtBXk+h1
++7wfpblYYNFwGVFvytG5nvGRDtHWxwd1Z9O8Fx4Zqu0Fx/wAn7ZL3ryE+tdHR7JK
+7SLxOa2X49T/8LY0U8Q65I4ZRo/b4VMcXApCmncw3QSRqHT/mYdNnf+HHPvi3jza
+md3iVptCS4Iaisc079DFda+htWXspBc13lmPi2vGQkWjjS3B4yO8JackyQPVhpsg
+KYbRBzOH0Kii8bXmyA6O5uIJYEddp5Veged4FE/ej3CrgGP1D0Yk1epx8lLbi9RB
+kwFS7DA5rQ23UnbSy1WyV1ZgPrWqQAWuGpjMTVTWN0ElI3AGxAnE8lZlSXyE+XyV
+uHjjIVrayBjLKVqDuSLdKZeCvI4QsyHH6F0NKJQkngvXxLZYxO6s0c2EFFLzdVWT
+1V9GMP8UsDrrb+JsZjUVmPR1tTP4xqEQG6KjfFoQm5XWpGtFwh91OK1lwf/Bx2/C
+j+PquLLFcj7hEP79VDTUZPQAduTTxIeTzHXH+x1PCHFB10xxH3e82VSdJeBUrJxn
+riXzK50SKTTmF+uYpHqE8Jg1N2Y1n5ksuxeYUy8PFjhAeBCqZ6ZcldUDf4999e/z
+PT8bwfCDr8jRdqJHrq7RxTJiP5RsMudWpKeohzJGwQ5uZwARAQABiQRyBBgBCAAm
+FiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAlxbVHwCGwIFCQO9IQACQAkQdLtrmky7
+PTjBdCAEGQEIAB0WIQSVztolaxygoV8wL7WVIaftXazpGAUCXFtUfAAKCRCVIaft
+XazpGPeMEACm9nxA/VKf8RxDo2ZuTgyuSwlR8tCjAE4k3+UoiYUbamkW4pjx9Vgd
+1zC5bNxSWZ5vlJ4CH8ArKFqNK5LBVDZqhYureAo/1Af2b9vRJw0/QQHhuXz/jqeT
+wwrLuKpy796Gpt+aFfcmS0ZC4QXfxJERhAP6tu1p6YmAsSb+bjziQVkKrt9mhOrL
+dtz6WP0Fg1joRj33FgnnLtayHvtgQrNFI3ztCjk/B2FjYZxqbBGfk5gyo0cTE2Fi
+oLhG/XrxIoZepFMJkGYETnYQXrOt2KuJLvawV70YQmG8EqHYY8drKA0XDZs8TVdT
+5cvGvtm8ERz5znsssRBxQMI5Ml6O2ahrXp8Eq4htCzlvO8t2MOtzvqAJRiyAd6bA
+Uo+MGVRpnvePOR1SAgBXCd416rF0iCXc1utZxnqwdq9kJAZ+8mCLx4N4jk6AdGpX
+zcNkLg7QmUzXn75RxZ6GrIUYZJNMlswXq5XhSW4o8ePlaxWjh9+QTtU964AZhpA1
+uoHsKGTBxHJs0w6McZm14kb2PuaO2/rpf8s8IZyc93+Y5O/gHZ6/agBjA9qN6wkQ
+R1d5UhJC4QS/m35rBGBKK9X3fqQxaBCio6Qz+m4A3GchrztJpq+2P+ma5ylsTq5j
+V4njky26WNtrV7+N0C4Moj3I4Qn6YU/eSManTXzHzoiPZCEH/IOxgXIiD/9Zm3Zz
+I+h4NCfSGyP11/w1gEzlTHQ4at/FXIIDh0Y2ZNpWPffuFQLtcER2vyKPwhDYpGMy
+NNHXks4azfrXVCv0wmSNBbeS8pJrYtopZpCEBrAbg/YLv9m5lpDSRHaR3gv/qMZ7
+QxY+NwqciqTwGq68PuF4mDSvtfuFmbEES9Iybiie+eL/6DU2knfBjgshUe6vElR+
+LYoPQ45GY2IxRTJ1pMXaZw1+evwH3UvseRGkRygiaBgoU/qR4prynvjMQcacCa+C
+aRnXZJYp/usVBeY0xut9toc9/OcLGoBr5h9l5YjruO2vu8VHou8N0tarVQn3YbQR
+Fi+YtNtclWJa8Pq1AsKRTCFwDwP6eODv6mNOrEFydNRcpiQmzp47VWF/YHRfHzCq
+A1wHLxLUrpQTaVw6J4FqedAQ31aAO4faA7MS+ZMNBqZCZ7lTGC6TvojqqBAN2yX7
+AnnYpZHM+lGpi2/ukVzLqSkGmdNOgbu+UZvoej3YnHYig4yWP+z2xrlJl8bkhU/d
+r9IQE5aRCEPB/JWhHJ2/GqYl9qjshlB52+6X2KDarwptOtzT9ooArYhpMwKIYh34
+c7X8tlAKYk7V5j7txIRFDKKAftC7dM82PntXJxSkWyR70GYnYjiXyrqqerqT7xIC
+mDEQgFOPpy09zFW62paO9uiZw6qwybwqgGpoX7kCDQRcW1TbARAA3ERo2mPv2VVg
+ZUFr4MtPDm4UG00YJW/LYa3D3k0e9tdSScACXprk1sAoxUlQx/CSdErPKwXG4rax
+iN4t5nICUUNYSC0dh09G25jC7nwsWc0AYyZu+h/FzfvpOm3fBwmBlzILlGh0URwH
+Ffj9fHt6hos4C+3PFZZ/X24aMJF/cov1oYi9rqFwt/l0mgtPE88Iyj2/Vp3Lergg
+QMzKfEuyluj9fL2cgU0Qa7oAPXmaxhHtua4cvbM5SXGo3FXjIgzH9OfM+2orebeN
+wH1M3ec6w+nPmRmCJLvPKGOeS7GVXL5/aOyPlDWzSXYnpCKS2ntw4K4nt0IA8n8z
+1db109l/C2noDrDSJEqOo843ShNGTYOMVUrj3a+Y7o2ATc9pNZalf0PwnKas7NDb
+IJ152PEQw665iYXcv2awjLF6W0yuSq8kfiaAxIrsie2Dto0zgqOs0Ot9Y74u11Hh
+wBSHUO3mEZJScAAcI/yDF2PvjvCQSzu4mdXb77t6X2O6YHULz4A7bVQCMazcTDI9
+/S0W2+ixPnnJVnE3xgjK9zuizji8JDJw1hJCQM+yTLVqq9pfvcRfQ6uwpMRzz/O3
+S0zDRiA69/GyfNwkpgz5QaGpY02IK5WrQU1doRjIz4BHAYzoIOkMkRqTtjdElQZw
+/D3wSO2uwsEMNwRzibR/Lz1JF2aGn6EAEQEAAYkEcgQYAQgAJhYhBK4/rHlnEexZ
+/AB6pHS7a5pMuz04BQJcW1TbAhsCBQkDvSEAAkAJEHS7a5pMuz04wXQgBBkBCAAd
+FiEE1wyE5ktVjlvM7AchMuIXXx11eioFAlxbVNsACgkQMuIXXx11eiqCfQ//SFDf
+rOIEoslp6n6vlCuavOg02wvjskKQGP1P1Q4v40Fw1Gl87n9uXAoMpeF4H+pzUxOi
+BHYCQi+EemwocSThzaWfPzd3JG/0OcRymf+ZOcBb+58VJL7p88QdMFIAi5J+KMuA
+fEG0zLkc9anEnXoVMmQJX5K+6PyeVDvBbYGjLjQAsWTZTiVuQI0w3WxFtDGWqQII
+8e/qE0DA7c/auGn7j2hid308+FcdfpmLefW9YesWjE1yYvHoCRdFOJ/7Sft4MQCI
+Re7UET3TRMBvtisP2DcqyzGPp22s4ZYFCCJJNiB92bXdEl5zXe4Ff7JTfNE/QrR7
+Wg5R9hZHgHdbp8p8bA3f0y29YCx3puYg7BbmQWiMh3rXWE5b090pSpw0K9BQU3vO
+irr+5/2TaFOJXHl4VF03GrWsSncShCbdsdRIv4TB0lY2mN4q+e7bjlAzJJeoaS97
+GIqu3DBlAJyx/ZwWW23DXXwoQ4jNuJhpl2jaCE7rVQB0uLjbp0i9Zdd4SdYZxmO/
+Y+JfgoJz8eyx8wZi4eDz1ijN0WKsIGjxJH5VUK9STjijDMeG6ZZRLc6b1QCGhe97
+ZbDkEUTdQGoeu4L5Fiqoma13NEsf8ofBDv+myJm/O67Va9JI3gxhIrhmF7LMzQQp
+lYx2peZC1CmhEnn83dtt83mhXvX6Dth657BW/Qd+GQ//SVuTPuNkBXfrTi4dbnv+
+cU6IsoIBodTF/WsQ6h4kbtsPhO5DbrsLNuNumrqVEN8jw+HUsEeNvFNeMrTPdG2V
+87ShQ4BQGkCf+GFRBj0myxxXOFZYQx6RpY5fCe7yOcTzpkbnPWmm7V8HdOuZ0NnL
+JNQ5YogOI6UvXVKv35R9qBo+G9jkhhb0eaAu6BERzKVANKfsGN7545ElZ1qlffMh
+AQhXGb6TsvCeSg2cWGb2cnVL2d58uVukD4PDiq4qqwgClkF3bOO70SIgGrCteHbi
+4Hseopex5m6GqqjoUYXr7QQBwSaQdc+gKtEjMHCsHbUyHRk0qEHdEe+2RmL0d0ra
+QMJfKyYQjcCR7tnrgN4WD1h4NKRdC/KRW31MDmH9XVPrkOMQCUCnArXkOwdKWsKf
+h8af9HqweXOT1FHJN/M3tWaBpv6KoduF2f2pj1VhPZ2EqFUycJ26lrHyOpsynQR6
++TD+c1uXotDwKN5RW+YL1cydk6mhib64fdOyPUeTcHehjMAFgM2f5wi35Ujcj8id
+37cWOqRsggSbMnGO4AUA/YtcVNG8TjZbakson8ENK7e8q4sEiNFUZ7/CtzNokwHQ
+5uOG1+qB85Y4ImGnIZVeiBpjt73VVawg4Zvm/omtW50P9R+4rVhMJZZFAgrWg8BH
+H/KNznW0vUuShG8B+2FA/eu5Ag0EXFtVDAEQAL5ftI1GgVJEFgX5VsuFnfBnH95c
+zqmwEXaTP4s7Xm3O0Wy579EzRUD1eEw/UaD/q2OHScwvMP65cZYQ9w4hnCN6H96P
+96Teo7LOMCssvSXIO7gqP33LKTqDzsIoAFHwWE3dq1jbyP6T1Je85mr0Edvk8kOC
+B1hudswAARno/7X9zGulhhwuEHk5Iey7R59yRUQqBctdNcetGyaiFjjX0evuVADi
+/z/s07XhDLDt7+3Vglh1/7XGC64QhB9QjZ8j0u7+0xfmLLjhi+7EpkDlAHIJXX1H
+0wAsPOGKlYruQUmIsMNfBINZeulHEBZ4cAd30xsM296DzJ6QL9sAGfYMhRs0YHB/
+EJ10Zv0iw1pU2jCCUv/9Kf4F4nwgHQWQP7JAbfhOIUOUq/YlxjTLnkd25+7vD3KH
+NQ6UiRDROR9Jwetpd/zokpf5O5iTBpVL+sCq+NsTZyDOjITve2sY0V8v10M+Z+pL
+cp/cUZ4JEDS/WJ4/ovBNJP8b+YwN/RBgCjl8UBX/N+e7AA52eYP2H9GK9XPkzSCE
+VxEf5PyjGrwedpoLkzagrHsDuWo3uBquLyneT/ozihqKQAuInUy5B7rWU4mpKHe5
+Vto5o6Zuj+6MgHgIQzRK6Da2ziMNEmroxwZibcYCtUPdvcvxGh+byclnzBclKjOw
+kAalFPx0SxEbHmzPABEBAAGJBHIEGAEIACYWIQSuP6x5ZxHsWfwAeqR0u2uaTLs9
+OAUCXFtVDAIbAgUJA70hAAJACRB0u2uaTLs9OMF0IAQZAQgAHRYhBK7WIv4CB360
+tcFGwUKiedJIzcMQBQJcW1UMAAoJEEKiedJIzcMQH+cQAIQYXDnqi4Hl21LtAgky
+pZxug+x/LECVlwkrIfaQF337+fG+H9J7SdU87Sn1Xe/YUgQnF0XP/fjIVFM0e/Tb
+xVlmTFqiejLnIwJJDgUaHO3POT2sGEyO3tc0mqSzyRBxtMQ8yvApccBhL5QODv3h
+hlRWgk5MXU0IPeXw134IWm+o/PRiPBoXPawvVfEVIBlUFaiSZASf4BAiSad4aJQe
+P8PyP7FPvQB1xiib0iSetn6ZmNeN2OSUJPiPA8aE9JCKuFtomVQEDM0BqQDl5A7h
+5O2uyf0Li+/ArqBvfBjrH03e5zbID02dO3D2BjsV3jUeVPQ5WDgVg8LH+nfg/rRy
+wfCsx9zFp1mt3K4xN2v7IKwxGndApgCcx17gsjzMvLz0J7sSGov4MNjzqvGEDKCl
+uUvNKXqy7je9xcQLpoyvWtoWFXWTbQAcK5Vv+hC67r9bHpjI1KuqA8hYqNKxsv7s
+wiLZdd4SK9SIuwf0j8/XTZwmoFfGolJil0ZNxyqBF39+CMVpaHdLM1qKZz99TVzS
+h4obOOjkUjK458xSo0XCbJ4qXYp7PgxyWK6GIbTozbbG/1ldw+LUnqxt8Shf797L
+J9lbI3ICuR2P5PYlKJf3b6D9GyfqyrP387fKAKhHsYkZ1XD54/8wIgTrdfeNPtL0
+1mjWDjw5KvO9kuPBjcmzgt+NrtsQAJwKeZsiqLLcY8kJ9xP+/xtTlh2iVuZMfxwq
+hwlo4MMCzpobLDZ/JKU398m77eboTKJSBfeUYxQd4ATn1L8NLKjLxKAaBkjEk0nN
+8w9OUQbFlhQ/asLzzF7Z9IGGh9/SEgBZ8V67a0O3Qw9Xdi3ARK3bbZ8RIVJ0+P9G
+CGrfq9j4ZmGA2L4irLjsvDAv7CSMb4WBKW8j0Jz5LFMwOMJgG1TT5c6lNqFj6y09
+rZcVLnt8+lUv2Bw3LC0oI1TjFkrrCzIdfg++mPi3K/ZFc50bvnWF4eCOjgZ5U9Vb
+sxFZq3+vTRcIfI9z2lZ9CNDRA1O5jGvuVtEGLiSLF2aJ6kiNriLuuGTlXfg/Fpgh
+GTvyppOTzF7PtHzHBQ/ZjnhWojnc/jyJRwLK8cCl6+EOc887v8BDmqgFWtmycsE2
+5fDJ7UFGP13g/eDL3ZUgMDty5dQaUOTX145t2KT+lMqpY6ZK2EC+eoqrnIGJ+tYy
+0l4RRxi10mbNhuPIIDdph7X+mUHgCeA9gyF0Y+LqiB6CX+zFg7ovLvnCbMPxdGXq
+z7AjfwqZBKI+BVuBeDtyW4onmElCu5cXNKsg3W0IlQlZf9PMDU6Ht0XLUs7EPfbQ
+sH1Vqi1XE1W/tGnkmjcpG/qlt9Gx1uwFGLP6iomqUBc2c0GZ6R1xplXvd3w3yC8d
+8lAgPGImuQINBFxbVToBEADkuxhQx9gxlzzCc0nUu2v82XsD+GzONp9irt14gslx
+te96eKaTXTi0t5eya0X5TIY3wbREwjlfAeM9AfcAmWcsM4izrfPtANM6WOxB2Tbz
+EY2cqv7NBQii7Z5aqPyjcIiT0b0Gs2evlDkn3xEBBqTSrNcnGSA29bZPIkaUb7Qo
+p/Ani0S3/tgcR21gXsJwkgpfNKwvPT03Lz3/o5rXAyag0M/25adgk9SVKNcXc8h2
+HSGv5ENjwUKNNnowVbNLw4287mFUM2Vd6unGJ2MBj7aUwTrfBl7gNV96mMdDJWcB
+hGKYkxUvibuHCa2KH7gTrnV6X7sdrgD5CbJMPq6OZNSP6n6bUVg22eHxoETplFwT
+4NvV3clRMWIAG1XgXR1l99LAh7PPnPMM1pHQGPwYHQskoBFS4g5knzHpB9h9TfZ3
+MM4cDZR5NgWmE0fYVnWe5ax+wW0/IOklUoHv3qoL4yiN9wFJq2oLzUNQd9+tsqiy
+vxSTh8iYmHegyn5KuBPsrMPgvqiKOdalTZKkak9DOx4cGQL2qHspKxiBOb6uox2v
+fjMQ5bDeUn+4DYMdnZNHeywCUegJmDakUtlfvN+136IDHGwfdGcitqzswzd3+PI2
+qlwPE19gkrp9NUaD3Qj2ZtDP7sU2cThc6Gra5KRFW8f98bI77j1Wu6pCnYFLqPz4
+QQARAQABiQRyBBgBCAAmFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAlxbVToCGwIF
+CQO9IQACQAkQdLtrmky7PTjBdCAEGQEIAB0WIQR5HX64jryNAThDSqwz3zWa56YK
+eQUCXFtVOgAKCRAz3zWa56YKeSWOEADK8u03LESGSQlZQqnnCAI8iYs1s+XRMEnG
+2tAQ1OK7/4eNgr1yZckmaW4FBMgeEgYIBJ7v3SlW7Hf7dE10TYPNGbP6UxVW8HIP
+rA4CINcGZXWWwpS374JNMS6A5eb6viuEgEMEi00jx0MmLvCMZKypmwXQUl5YJ5nB
+ytpQ1681mCQxGBMhT1eKQt3B4nAsoEnP+HnqVM/nKxBemSBNXX+C0b/YeQoLC3sD
+L+Z0NRI8U6PZl9Rokod3uynH0vfBYCEJd6MvsjtnJlVVaseYIA3ESNrFG12tw95I
+wKNrVCANZ1DBSyK4ovmmWsDrH+uFTHSLNjlxIuVxUfmXcLfgcepVCmd/7Z7UrWYr
+SXSvP0VG4ZmEPE7tNb8bfyADftO1cVsmcHBQeSrgvpSrTv9L8MocojpR5vJc1f+a
+sBT7rAeGzZP9riz1GmryXawaZgdLfaaJfzRQkc1uTChb7kMN+UMhVUdCAXmho0XO
+SfcsW84u/LpjdYh2Ww41xQO6EWvbZDNgD/Fdmp8Uh1MqJ1Dejri6kjNn6wPImXJd
+Eu6nHqWDRdYsfT4XUB18tB+4aIpFzCyIgpf7p1uaVU7Oqip5sZkc/WXKr77lV23m
+PQvpGRNCzgU2TJY7ktR3LOvUVN6wNfLMHzeQk18NdmcEGUrJ0YYtl9vE5/Eg9L6x
+LBH9PKt17IQ8D/9DLwQX8pl3fuTM8ZbzIPLxiXhbgzBBTXKRE2u1888+RIq9xE7c
+aVFjwq4qpgqZ5SFonTcG4Pi5ck3mFAzyA5zLRF+ckpmBpwSPMpLwCpv10369D1jh
+AF3JsUwt6DIb2BISMhh2ThSUMSKO75q8GSotsKjJyjD6vl1x4L7WXubTWxEiNuwD
+3kAjFWS1Z1VWtA9SURWAbsDaCV4VmwCCpSIwRr9OTbyu9XuMdMxGNpl8SwW7MVQb
+x4aYNvR7Hl/wIR71AHAXoSfrKp3p12anXjYYASHmbm16ugP4H7HLMBfznKet2f76
+gIxJr1CsAMTSqypcC1UoVb6Gz8djeIR+GU+6efHI4TIUMy5uMIUx8tYbwSEeo/y6
+NnjpJFYYjJa671iSABInNxs4+X+1zrFa+wl45EnaFxziEet2Qzv/VsusoLvLwnYi
+BZckclAS5xoVGFW0WJ01OfLUDHxGMt9GSheL8c+GLMaMtaCWunpmmt9zZ9WdpBOu
+AGluMG1Cee50TrhXaGE8CdNr8nOdSeLNAveBAPmuVa0JDSe20/D/RuYJLKeG9Vsq
+BZvjuGlOUsfl6UjtiGRbgS9OWpxeez5ugc9yyV+rBGIpmnIb+9quz2HmGxE65eA2
+cRNsZRIjFLzeAx/0RMaT1nlLFTBbUuZ+tJ+fgFtRGMhifZn1pb2dMQo0N7kCDQRc
+W1VuARAAv4LYaNq2Zev/v7M5DnxLpgHRcMkG7TOQpycrlK5653llpZzTy3mh5peW
+vcq3IDmdeUIJxQ+WDh2f0vS+NIKDC/HAddfHrZPbhO7zLxLcMW5KmV05ancaRSP0
+s0+IyQmvVxUNrgPinZiphlvRGoLXS6pdgfc4jIR9B2umPecfvfu/6EWFPnXZgG8K
+yY3Z+mwrmEO0FaXHBQuu6nactiPe79N4bLe8hk9RW6yIxLBeJzIoOlIcJmuRHapt
+nS2lV3mfhZdFnkAp1o6a2TL5BwgMY0wZUKZr78HEMKh6LbPN9rPepf0neUeq/k1l
+NJU7V6XMS+rezF31vgSJ5KoNGYhxtWZ54uksH2rcw7+ltpSVtqY91G/vibpRCJG3
+LdX/kxHni1NEWyZlpS/6ntuH6HSoNYsR9IMsbESs3QVCH74ApK88CxYCRB0SEo0M
+yAElbQ3bfEKCKl/FwC4IzAYAJ2arWKwBHRSJlsrNCtczrjG7j3EyJrn8+Tm5yjO6
+0THQjvc/nBxrNE09r1Lzz7jrDWC9Rl+BH6wqdniymoYyUAQsX2rZ+Jhah1Zkf+Gu
+76qtY+EH494dPM+0FazcBlgBd6/J5mh3Wk9JuecXLTEUGtzd1GmI9CENPAklCauX
+tNOWeTop27djuKWsZxuP1GyV6UYixFVOSWteyAbA32cncVv/2ZUAEQEAAYkEcgQY
+AQgAJhYhBK4/rHlnEexZ/AB6pHS7a5pMuz04BQJcW1VuAhsCBQkDvSEAAkAJEHS7
+a5pMuz04wXQgBBkBCAAdFiEEFWiQaF6g32oTce8gF8xdsfAIhAcFAlxbVW4ACgkQ
+F8xdsfAIhAd4jxAAiO9+VRQQ3eBOsJRgANdgL/l51kq7qE3u8xnSqNkrmdYDdT2H
+TYH5W4n2AmGo50BDafdjd6tut0qtzA3/hGWCooydxKFOsnIYziUeoHvlICj3RkHO
+y7utcFhAgRWi+kzFwnnXGf13dMU9iG7yvKrCrCEw44gzoQ1KnY1Xsj18n5JkqxeT
+94bzcSbz20OpOSIMfSQPrpy18WrZYwHodcIZ3IUUACCpMZdfTa9c/qHRQ/rcwl+B
+0JlHx0V4AYiSAsiMVgflO1Eqi7apPuwxPPd5nnHkrdDM9CYC3LdBORBXwncG3oZ5
+eTSXmsvFxHXH41JHsm/1QFcVmFAYhu9qJFCGiD+8UeTFtT+nnHU69BszgtUskqX8
+k9PqLdK7Vxkp16wc6WOp1NeIQ6Fd4PxTGrPqs9bJk7TlYtTFWpA0X+EMj/San+Ku
+PxqLEa4Ab12R4vs1pCrn/g1z3C/6ujH4B70HOrRTIeTjULJ6xdwXGtwUA09hio0r
+pHhtyZhAh5irUJNto4ZOk/Qyd+dfMsNvRJfbVIK2mmeRaBnp902AsQNgYVdi2Aki
+0h4kz3bVLGw7iD/xV2hV69+JwLSijkkmOpz/EjMwj0hDDYrHH3Y3o0dV3dNdk/5i
+6lQgcxSVsl9kWlHcoEllKbf0Hb1muKVwoGGYxFYna2jsLFVjG29M7iPSgrHjmg/+
+I3fmsLZ0VI9kmxniUlZ6gz5NB5PJ3RXmwKO9LkBgE5C1wpuZbNEQ1NsR2bprlJPm
+++GNSo8HaheuTRJn42kkOgfIJwjuvXih3FE/NtRA/W8H2uF6YLDjBKGZJbxQcmsd
+CTEuCRCVP8X7C5n3rl1YqzfWfNr8QFxvH7ivG7KOlSxvyTKcYatWb9uDUPrnr74f
+ZaMljHGsNyKj70MzZcrrsmt61yWGR0h+02rmIKlskl4hkh+qF5ehI+Bkd7eblsBy
+rxEREHq/ij2Vd7l0Z606YCE8vj8WfcsJj8JjwR3A+nND/oNJTTbQ3b8OvasvqIey
+WqqmGg73nbHjd/VIAUsfvnsEYatDk4pAA/wQr9c4T4s5Q/QRwDrAsa4J89FrDjWC
+hQBPL7TaP8Af/3Y3/86jLCN4lnW1qjPXv5rhBFeI0EVi1k1qdV06qr5HOk7CwQTT
+uc4rCdFcEnw8kVKZa/yFnlJfRa0Z4IwSahdp5fdFEuad6LpOcFFnYxWtIWhcg4GT
+RcMha/OZnsfqOqiAt6In+1IwuJBz3uMM7xw2AMaxzAejGEL63F81C5iJ6Ld6kQK+
+XblDW0G643bVbzkBb46MAT+UnLuWQUs3NDtk1FEioJyWUgbO/srMH4MoWM7rG8ZT
+nQPohNmPBrqL2phmE27HQsQ0rTjH2Z2ol7iy9OFMtT0=
+=MkGo
+-----END PGP PUBLIC KEY BLOCK-----

From adcfd20cb2b9e0c40ec588456b497376cdc0401f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 25 Nov 2019 21:32:36 +0100
Subject: [PATCH 093/460] Remove tabs from spec

rpmlint complains about mixed spaces and tabs. Set vim mode and remove
tabs added by recent commit.
---
 bind.spec | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/bind.spec b/bind.spec
index b32ab64..e542efb 100644
--- a/bind.spec
+++ b/bind.spec
@@ -1,6 +1,7 @@
 #
 # Red Hat BIND package .spec file
 #
+# vim:expandtab ts=2:
 
 #%%global PATCHVER P1
 #%%global PREVER rc1
@@ -856,11 +857,11 @@ sed -e "/^\s*include(/ d" -e 's/^-- use //' \
 # or it is able to configure them
 if perl bin/tests/system/testsock.pl
 then
-	CONFIGURED=already
+  CONFIGURED=already
 else
-	CONFIGURED=
-	sh bin/tests/system/ifconfig.sh up
-	perl bin/tests/system/testsock.pl && CONFIGURED=build
+  CONFIGURED=
+  sh bin/tests/system/ifconfig.sh up
+  perl bin/tests/system/testsock.pl && CONFIGURED=build
 fi
 if [ -n "$CONFIGURED" ]
 then

From 6f27f8e4a774bd88907e0945cc1746a483b95f41 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 26 Nov 2019 18:42:25 +0100
Subject: [PATCH 094/460] Complete explicit disabling of RSAMD5 in FIPS mode
 (#1709553)

Previous fix included just part inside named. However, checking part
would check algorithm support also in check library. The code is almost
the same. Permit already disabled algoritms also in libbind9.

Use the same change as RHEL.
---
 bind-9.11-fips-disable.patch | 46 +++++++++++++++++++++++++++---------
 bind.spec                    |  5 +++-
 2 files changed, 39 insertions(+), 12 deletions(-)

diff --git a/bind-9.11-fips-disable.patch b/bind-9.11-fips-disable.patch
index 525316a..afe9564 100644
--- a/bind-9.11-fips-disable.patch
+++ b/bind-9.11-fips-disable.patch
@@ -1,4 +1,4 @@
-From df23c869f8973bc9494dcdc86ef46070d8194897 Mon Sep 17 00:00:00 2001
+From 83b889c238282b210f874a3ad81bb56299767495 Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Mon, 5 Aug 2019 11:54:03 +0200
 Subject: [PATCH] Allow explicit disabling of autodisabled MD5
@@ -9,15 +9,22 @@ RSAMD5 is included in security policy, it fails to start, because that
 algorithm is not recognized. Allow it disabled, but fail on any
 other usage.
 ---
- bin/named/server.c |  2 +-
- lib/dns/rcode.c    | 31 +++++++++++++------------------
- 2 files changed, 14 insertions(+), 19 deletions(-)
+ bin/named/server.c |  4 ++--
+ lib/bind9/check.c  |  4 ++++
+ lib/dns/rcode.c    | 33 +++++++++++++++------------------
+ 3 files changed, 21 insertions(+), 20 deletions(-)
 
 diff --git a/bin/named/server.c b/bin/named/server.c
-index 3cd49a9..ef82d89 100644
+index 5b57371..51702ab 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
-@@ -1551,7 +1551,7 @@ disable_algorithms(const cfg_obj_t *disabled, dns_resolver_t *resolver) {
+@@ -1547,12 +1547,12 @@ disable_algorithms(const cfg_obj_t *disabled, dns_resolver_t *resolver) {
+ 		r.length = strlen(r.base);
+ 
+ 		result = dns_secalg_fromtext(&alg, &r);
+-		if (result != ISC_R_SUCCESS) {
++		if (result != ISC_R_SUCCESS && result != ISC_R_DISABLED) {
+ 			uint8_t ui;
  			result = isc_parse_uint8(&ui, r.base, 10);
  			alg = ui;
  		}
@@ -26,8 +33,23 @@ index 3cd49a9..ef82d89 100644
  			cfg_obj_log(cfg_listelt_value(element),
  				    ns_g_lctx, ISC_LOG_ERROR,
  				    "invalid algorithm");
+diff --git a/lib/bind9/check.c b/lib/bind9/check.c
+index e0803d4..8023784 100644
+--- a/lib/bind9/check.c
++++ b/lib/bind9/check.c
+@@ -302,6 +302,10 @@ disabled_algorithms(const cfg_obj_t *disabled, isc_log_t *logctx) {
+ 		r.length = strlen(r.base);
+ 
+ 		tresult = dns_secalg_fromtext(&alg, &r);
++		if (tresult == ISC_R_DISABLED) {
++			// Recognize disabled algorithms, disable it explicitly
++			tresult = ISC_R_SUCCESS;
++		}
+ 		if (tresult != ISC_R_SUCCESS) {
+ 			cfg_obj_log(cfg_listelt_value(element), logctx,
+ 				    ISC_LOG_ERROR, "invalid algorithm '%s'",
 diff --git a/lib/dns/rcode.c b/lib/dns/rcode.c
-index f51d548..8dbb12d 100644
+index f51d548..c49b8d1 100644
 --- a/lib/dns/rcode.c
 +++ b/lib/dns/rcode.c
 @@ -126,7 +126,6 @@
@@ -46,7 +68,7 @@ index f51d548..8dbb12d 100644
  static struct tbl secprotos[] = { SECPROTONAMES };
  static struct tbl hashalgs[] = { HASHALGNAMES };
  static struct tbl dsdigests[] = { DSDIGESTNAMES };
-@@ -358,33 +358,28 @@ dns_cert_totext(dns_cert_t cert, isc_buffer_t *target) {
+@@ -358,33 +358,30 @@ dns_cert_totext(dns_cert_t cert, isc_buffer_t *target) {
  	return (dns_mnemonic_totext(cert, target, certs));
  }
  
@@ -72,14 +94,16 @@ index f51d548..8dbb12d 100644
 -	RETERR(dns_mnemonic_fromtext(&value, source,
 -	                             secalgs_tbl_start(), 0xff));
 +	result = dns_mnemonic_fromtext(&value, source,
-+	                             secalgs, 0xff);
++	                               secalgs, 0xff);
 +	if (result != ISC_R_SUCCESS) {
 +		result = dns_mnemonic_fromtext(&value, source,
-+		                               md5_secalgs, 0xff);
++	                                       md5_secalgs, 0xff);
 +		if (result != ISC_R_SUCCESS) {
 +			return (result);
-+		} else if (!isc_md5_available())
++		} else if (!isc_md5_available()) {
++			*secalgp = value;
 +			return (ISC_R_DISABLED);
++		}
 +	}
  	*secalgp = value;
  	return (ISC_R_SUCCESS);
diff --git a/bind.spec b/bind.spec
index e542efb..6473bea 100644
--- a/bind.spec
+++ b/bind.spec
@@ -62,7 +62,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.11.13
-Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1571,6 +1571,9 @@ fi;
 
 
 %changelog
+* Tue Nov 26 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.13-2
+- Complete explicit disabling of RSAMD5 in FIPS mode (#1709553)
+
 * Tue Nov 19 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.13-1
 - Update to 9.11.13
 

From 1a4de8b956e5f2d20c12a31f36ccfdbf09b13481 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 2 Dec 2019 20:34:08 +0100
Subject: [PATCH 095/460] Backport a few upstream thread safety fixes

It might not fix all issues, but was detected by upstream using
automated tool. Should not break anything new, but might fix issue
triggered usually on ppc64le platform.
---
 bind-9.11-rh1736762-1.patch |  56 ++++++++++++++++++
 bind-9.11-rh1736762-2.patch |  38 +++++++++++++
 bind-9.11-rh1736762-3.patch | 105 ++++++++++++++++++++++++++++++++++
 bind-9.11-rh1736762-4.patch | 110 ++++++++++++++++++++++++++++++++++++
 bind.spec                   |   9 +++
 5 files changed, 318 insertions(+)
 create mode 100644 bind-9.11-rh1736762-1.patch
 create mode 100644 bind-9.11-rh1736762-2.patch
 create mode 100644 bind-9.11-rh1736762-3.patch
 create mode 100644 bind-9.11-rh1736762-4.patch

diff --git a/bind-9.11-rh1736762-1.patch b/bind-9.11-rh1736762-1.patch
new file mode 100644
index 0000000..272177f
--- /dev/null
+++ b/bind-9.11-rh1736762-1.patch
@@ -0,0 +1,56 @@
+From 312bd133f75c54d51196060c573e29aabbb0b842 Mon Sep 17 00:00:00 2001
+From: Mark Andrews <marka@isc.org>
+Date: Tue, 26 Nov 2019 02:30:14 +0000
+Subject: [PATCH 1/4] Merge branch
+ '1367-threadsanitizer-data-race-dispatch-c-901-in-free_buffer-v9_11' into
+ 'v9_11'
+
+Resolve "ThreadSanitizer: data race dispatch.c:901 in free_buffer"
+
+See merge request isc-projects/bind9!2628
+
+(cherry picked from commit 0455351802cb915e7961dad9cf14977a19162d38)
+---
+ lib/dns/dispatch.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/lib/dns/dispatch.c b/lib/dns/dispatch.c
+index 3278db4a07..ea5cf102f2 100644
+--- a/lib/dns/dispatch.c
++++ b/lib/dns/dispatch.c
+@@ -927,6 +927,10 @@ allocate_udp_buffer(dns_dispatch_t *disp) {
+ 	void *temp;
+ 
+ 	LOCK(&disp->mgr->buffer_lock);
++	if (disp->mgr->buffers >= disp->mgr->maxbuffers) {
++		UNLOCK(&disp->mgr->buffer_lock);
++		return (NULL);
++	}
+ 	bpool = disp->mgr->bpool;
+ 	disp->mgr->buffers++;
+ 	UNLOCK(&disp->mgr->buffer_lock);
+@@ -1058,9 +1062,11 @@ udp_recv(isc_event_t *ev_in, dns_dispatch_t *disp, dispsocket_t *dispsock) {
+ 	mgr = disp->mgr;
+ 	qid = mgr->qid;
+ 
++	LOCK(&disp->mgr->buffer_lock);
+ 	dispatch_log(disp, LVL(90),
+ 		     "got packet: requests %d, buffers %d, recvs %d",
+ 		     disp->requests, disp->mgr->buffers, disp->recv_pending);
++	UNLOCK(&disp->mgr->buffer_lock);
+ 
+ 	if (dispsock == NULL && ev->ev_type == ISC_SOCKEVENT_RECVDONE) {
+ 		/*
+@@ -1511,9 +1517,6 @@ startrecv(dns_dispatch_t *disp, dispsocket_t *dispsock) {
+ 	if (disp->recv_pending != 0 && dispsock == NULL)
+ 		return (ISC_R_SUCCESS);
+ 
+-	if (disp->mgr->buffers >= disp->mgr->maxbuffers)
+-		return (ISC_R_NOMEMORY);
+-
+ 	if ((disp->attributes & DNS_DISPATCHATTR_EXCLUSIVE) != 0 &&
+ 	    dispsock == NULL)
+ 		return (ISC_R_SUCCESS);
+-- 
+2.21.0
+
diff --git a/bind-9.11-rh1736762-2.patch b/bind-9.11-rh1736762-2.patch
new file mode 100644
index 0000000..7d16138
--- /dev/null
+++ b/bind-9.11-rh1736762-2.patch
@@ -0,0 +1,38 @@
+From 8e1900b79d854e22ec6b5cea152ff363ce9a461c Mon Sep 17 00:00:00 2001
+From: Mark Andrews <marka@isc.org>
+Date: Fri, 22 Nov 2019 21:48:12 +0000
+Subject: [PATCH 2/4] Merge branch
+ '1334-threadsanitizer-data-race-dispatch-c-1339-in-tcp_recv-v9_11' into
+ 'v9_11'
+
+lock dispatch before reporting state
+
+See merge request isc-projects/bind9!2619
+
+(cherry picked from commit e36730076af3190fe5930a6406dd414b87e1e178)
+---
+ lib/dns/dispatch.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/lib/dns/dispatch.c b/lib/dns/dispatch.c
+index ea5cf102f2..94df6bab9a 100644
+--- a/lib/dns/dispatch.c
++++ b/lib/dns/dispatch.c
+@@ -1353,12 +1353,12 @@ tcp_recv(isc_task_t *task, isc_event_t *ev_in) {
+ 
+ 	qid = disp->qid;
+ 
++	LOCK(&disp->lock);
++
+ 	dispatch_log(disp, LVL(90),
+ 		     "got TCP packet: requests %d, buffers %d, recvs %d",
+ 		     disp->requests, disp->tcpbuffers, disp->recv_pending);
+ 
+-	LOCK(&disp->lock);
+-
+ 	INSIST(disp->recv_pending != 0);
+ 	disp->recv_pending = 0;
+ 
+-- 
+2.21.0
+
diff --git a/bind-9.11-rh1736762-3.patch b/bind-9.11-rh1736762-3.patch
new file mode 100644
index 0000000..ed4dc93
--- /dev/null
+++ b/bind-9.11-rh1736762-3.patch
@@ -0,0 +1,105 @@
+From 651fc773a6e154466998424e975bce3fdb8566d8 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
+Date: Wed, 27 Nov 2019 17:06:28 +0000
+Subject: [PATCH 3/4] Merge branch
+ '1350-threadsanitizer-data-race-rbt-c-1312-in-dns_rbt_addnode-v9_11' into
+ 'v9_11'
+
+Resolve "ThreadSanitizer: data race rbt.c:1312 in dns_rbt_addnode"
+
+See merge request isc-projects/bind9!2651
+
+(cherry picked from commit a5fb8c812728cb5fc923f60d6707d953d704719f)
+---
+ lib/dns/rbtdb.c | 24 +++++++++++++++++++++---
+ 1 file changed, 21 insertions(+), 3 deletions(-)
+
+diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
+index 738aa203ec..d3bb8d7fe7 100644
+--- a/lib/dns/rbtdb.c
++++ b/lib/dns/rbtdb.c
+@@ -1972,6 +1972,9 @@ clean_zone_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
+ 		node->dirty = 0;
+ }
+ 
++/*
++ * tree_lock(write) must be held.
++ */
+ static void
+ delete_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node) {
+ 	dns_rbtnode_t *nsecnode;
+@@ -2955,6 +2958,8 @@ closeversion(dns_db_t *db, dns_dbversion_t **versionp, bool commit) {
+  * E.g. if the wildcard name is "*.sub.example." then we
+  * must ensure that "sub.example." exists and is marked as
+  * a wildcard level.
++ *
++ * tree_lock(write) must be held.
+  */
+ static isc_result_t
+ add_wildcard_magic(dns_rbtdb_t *rbtdb, dns_name_t *name) {
+@@ -2979,6 +2984,9 @@ add_wildcard_magic(dns_rbtdb_t *rbtdb, dns_name_t *name) {
+ 	return (ISC_R_SUCCESS);
+ }
+ 
++/*
++ * tree_lock(write) must be held.
++ */
+ static isc_result_t
+ add_empty_wildcards(dns_rbtdb_t *rbtdb, dns_name_t *name) {
+ 	isc_result_t result;
+@@ -6756,13 +6764,16 @@ addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
+ 	REQUIRE(VALID_RBTDB(rbtdb));
+ 	INSIST(rbtversion == NULL || rbtversion->rbtdb == rbtdb);
+ 
+-	if (rbtdb->common.methods == &zone_methods)
++	if (rbtdb->common.methods == &zone_methods) {
++		RWLOCK(&rbtdb->tree_lock, isc_rwlocktype_read);
+ 		REQUIRE(((rbtnode->nsec == DNS_RBT_NSEC_NSEC3 &&
+ 			  (rdataset->type == dns_rdatatype_nsec3 ||
+ 			   rdataset->covers == dns_rdatatype_nsec3)) ||
+ 			 (rbtnode->nsec != DNS_RBT_NSEC_NSEC3 &&
+ 			   rdataset->type != dns_rdatatype_nsec3 &&
+ 			   rdataset->covers != dns_rdatatype_nsec3)));
++		RWUNLOCK(&rbtdb->tree_lock, isc_rwlocktype_read);
++	}
+ 
+ 	if (rbtversion == NULL) {
+ 		if (now == 0)
+@@ -6854,11 +6865,15 @@ addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
+ 	/*
+ 	 * Add to the auxiliary NSEC tree if we're adding an NSEC record.
+ 	 */
++	RWLOCK(&rbtdb->tree_lock, isc_rwlocktype_read);
+ 	if (rbtnode->nsec != DNS_RBT_NSEC_HAS_NSEC &&
+ 	    rdataset->type == dns_rdatatype_nsec)
++	{
+ 		newnsec = true;
+-	else
++	} else {
+ 		newnsec = false;
++	}
++	RWUNLOCK(&rbtdb->tree_lock, isc_rwlocktype_read);
+ 
+ 	/*
+ 	 * If we're adding a delegation type, adding to the auxiliary NSEC tree,
+@@ -6959,13 +6974,16 @@ subtractrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
+ 	REQUIRE(VALID_RBTDB(rbtdb));
+ 	REQUIRE(rbtversion != NULL && rbtversion->rbtdb == rbtdb);
+ 
+-	if (rbtdb->common.methods == &zone_methods)
++	if (rbtdb->common.methods == &zone_methods) {
++		RWLOCK(&rbtdb->tree_lock, isc_rwlocktype_read);
+ 		REQUIRE(((rbtnode->nsec == DNS_RBT_NSEC_NSEC3 &&
+ 			  (rdataset->type == dns_rdatatype_nsec3 ||
+ 			   rdataset->covers == dns_rdatatype_nsec3)) ||
+ 			 (rbtnode->nsec != DNS_RBT_NSEC_NSEC3 &&
+ 			   rdataset->type != dns_rdatatype_nsec3 &&
+ 			   rdataset->covers != dns_rdatatype_nsec3)));
++		RWUNLOCK(&rbtdb->tree_lock, isc_rwlocktype_read);
++	}
+ 
+ 	result = dns_rdataslab_fromrdataset(rdataset, rbtdb->common.mctx,
+ 					    &region, sizeof(rdatasetheader_t));
+-- 
+2.21.0
+
diff --git a/bind-9.11-rh1736762-4.patch b/bind-9.11-rh1736762-4.patch
new file mode 100644
index 0000000..61afe9d
--- /dev/null
+++ b/bind-9.11-rh1736762-4.patch
@@ -0,0 +1,110 @@
+From 9c1f74400c04267dea4f1bd7f62de8ba5e8d2b0e Mon Sep 17 00:00:00 2001
+From: Mark Andrews <marka@isc.org>
+Date: Thu, 28 Nov 2019 10:24:12 +1100
+Subject: [PATCH 4/4] rdataset_setownercase and rdataset_getownercase need to
+ obtain a node lock
+
+(cherry picked from commit 637b2c4e517b466900a8c00b52f7a15727e12ae9)
+(cherry picked from commit 1c61f129c3b12071723a2154d33f74628bf80998)
+---
+ lib/dns/rbtdb.c | 35 ++++++++++++++++++++++++++++-------
+ 1 file changed, 28 insertions(+), 7 deletions(-)
+
+diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
+index d3bb8d7fe7..199ff08011 100644
+--- a/lib/dns/rbtdb.c
++++ b/lib/dns/rbtdb.c
+@@ -10109,11 +10109,18 @@ setownercase(rdatasetheader_t *header, const dns_name_t *name) {
+ 
+ static void
+ rdataset_setownercase(dns_rdataset_t *rdataset, const dns_name_t *name) {
++	dns_rbtdb_t *rbtdb = rdataset->private1;
++	dns_rbtnode_t *rbtnode = rdataset->private2;
+ 	unsigned char *raw = rdataset->private3;        /* RDATASLAB */
+ 	rdatasetheader_t *header;
+ 
+ 	header = (struct rdatasetheader *)(raw - sizeof(*header));
++
++	NODE_LOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
++		  isc_rwlocktype_write);
+ 	setownercase(header, name);
++	NODE_UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
++		    isc_rwlocktype_write);
+ }
+ 
+ static const unsigned char charmask[] = {
+@@ -10188,6 +10195,8 @@ static unsigned char maptolower[] = {
+ 
+ static void
+ rdataset_getownercase(const dns_rdataset_t *rdataset, dns_name_t *name) {
++	dns_rbtdb_t *rbtdb = rdataset->private1;
++	dns_rbtnode_t *rbtnode = rdataset->private2;
+ 	const unsigned char *raw = rdataset->private3;        /* RDATASLAB */
+ 	const rdatasetheader_t *header;
+ 	unsigned int i, j;
+@@ -10196,8 +10205,12 @@ rdataset_getownercase(const dns_rdataset_t *rdataset, dns_name_t *name) {
+ 
+ 	header = (const struct rdatasetheader *)(raw - sizeof(*header));
+ 
+-	if (!CASESET(header))
+-		return;
++	NODE_LOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
++		  isc_rwlocktype_read);
++
++	if (!CASESET(header)) {
++		goto unlock;
++	}
+ 
+ #if 0
+ 	/*
+@@ -10210,10 +10223,13 @@ rdataset_getownercase(const dns_rdataset_t *rdataset, dns_name_t *name) {
+ 		 */
+ 		if (name->ndata[i] >= 0x61 && name->ndata[i] <= 0x7a &&
+ 		    (header->upper[i/8] & (1 << (i%8))) != 0)
++		{
+ 			name->ndata[i] &= ~0x20; /* clear the lower case bit */
+-		else if (name->ndata[i] >= 0x41 && name->ndata[i] <= 0x5a &&
+-			 (header->upper[i/8] & (1 << (i%8))) == 0)
++		} else if (name->ndata[i] >= 0x41 && name->ndata[i] <= 0x5a &&
++			   (header->upper[i/8] & (1 << (i%8))) == 0)
++		{
+ 			name->ndata[i] |= 0x20; /* set the lower case bit */
++		}
+ 	}
+ #else
+ 	if (ISC_LIKELY(CASEFULLYLOWER(header))) {
+@@ -10236,7 +10252,7 @@ rdataset_getownercase(const dns_rdataset_t *rdataset, dns_name_t *name) {
+ 			c = *bp;
+ 			*bp++ = maptolower[c];
+ 		}
+-		return;
++		goto unlock;
+ 	}
+ 
+ 	i = 0;
+@@ -10257,8 +10273,9 @@ rdataset_getownercase(const dns_rdataset_t *rdataset, dns_name_t *name) {
+ 		}
+ 	}
+ 
+-	if (ISC_UNLIKELY(i == name->length))
+-		return;
++	if (ISC_UNLIKELY(i == name->length)) {
++		goto unlock;
++	}
+ 
+ 	bits = ~(header->upper[j]);
+ 
+@@ -10272,6 +10289,10 @@ rdataset_getownercase(const dns_rdataset_t *rdataset, dns_name_t *name) {
+ 		bits >>= 1;
+ 	}
+ #endif
++
++ unlock:
++	NODE_UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
++		    isc_rwlocktype_read);
+ }
+ 
+ /*%
+-- 
+2.21.0
+
diff --git a/bind.spec b/bind.spec
index 6473bea..9d1042f 100644
--- a/bind.spec
+++ b/bind.spec
@@ -161,6 +161,11 @@ Patch174:bind-9.11-json-c.patch
 Patch175:bind-9.11-fips-disable.patch
 Patch177: bind-9.11-serve-stale.patch
 Patch178: bind-9.11-serve-stale-dbfix.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=1736762
+Patch179: bind-9.11-rh1736762-1.patch
+Patch180: bind-9.11-rh1736762-2.patch
+Patch181: bind-9.11-rh1736762-3.patch
+Patch182: bind-9.11-rh1736762-4.patch
 
 # SDB patches
 Patch11: bind-9.3.2b2-sdbsrc.patch
@@ -556,6 +561,10 @@ are used for building ISC DHCP.
 %patch175 -p1 -b .rh1709553
 %patch177 -p1 -b .serve-stale
 %patch178 -p1 -b .rh1770492
+%patch179 -p1 -b .rh1736762-1
+%patch180 -p1 -b .rh1736762-2
+%patch181 -p1 -b .rh1736762-3
+%patch182 -p1 -b .rh1736762-4
 
 mkdir lib/dns/tests/testdata/dstrandom
 cp -a %{SOURCE50} lib/dns/tests/testdata/dstrandom/random.data

From c44ebdeadecba5a658b7596baf7677e2d904077d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 2 Dec 2019 20:35:43 +0100
Subject: [PATCH 096/460] Bump spec for bug #1736762

---
 bind.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index 9d1042f..5444f8d 100644
--- a/bind.spec
+++ b/bind.spec
@@ -62,7 +62,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.11.13
-Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  3%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1580,6 +1580,9 @@ fi;
 
 
 %changelog
+* Mon Dec 02 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.13-3
+- Backport few thread safety related fixed from upstream (#1736762)
+
 * Tue Nov 26 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.13-2
 - Complete explicit disabling of RSAMD5 in FIPS mode (#1709553)
 

From ccf1b0373472695ac7f268e01c75d8b7604b135a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 3 Dec 2019 17:52:44 +0100
Subject: [PATCH 097/460] Disable Berkeley DB support (#1779190)

Allow enabling it by build --with BDB, but keep it disabled by default.
---
 bind.spec | 47 +++++++++++++++++++++++++++++++++++------------
 1 file changed, 35 insertions(+), 12 deletions(-)

diff --git a/bind.spec b/bind.spec
index 5444f8d..79e961e 100644
--- a/bind.spec
+++ b/bind.spec
@@ -20,6 +20,7 @@
 %bcond_without JSON
 %bcond_without DNSTAP
 %bcond_without DLZ
+%bcond_with    BDB
 %bcond_with    EXPORT_LIBS
 # Legacy GeoIP support
 %bcond_with    GEOIP
@@ -62,7 +63,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.11.13
-Release:  3%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  4%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -206,6 +207,8 @@ BuildRequires:  findutils sed
 BuildRequires:  gnupg2
 %if %{with SDB}
 BuildRequires:  openldap-devel, libpq-devel, sqlite-devel, mariadb-connector-c-devel
+%endif
+%if %{with BDB}
 BuildRequires:  libdb-devel
 %endif
 %if %{with UNITTEST}
@@ -437,6 +440,7 @@ Based on the code from Jan "Yenya" Kasprzak <kas@fi.muni.cz>
 
 
 %if %{with DLZ}
+%if %{with BDB}
 %package dlz-bdb
 Summary: BIND server bdb DLZ module
 Requires: bind%{?_isa} = %{epoch}:%{version}-%{release}
@@ -444,6 +448,10 @@ Requires: bind%{?_isa} = %{epoch}:%{version}-%{release}
 %description dlz-bdb
 Dynamic Loadable Zones Berkeley DB module for BIND server.
 
+%end
+
+%endif
+
 %package dlz-filesystem
 Summary: BIND server filesystem DLZ module
 Requires: bind%{?_isa} = %{epoch}:%{version}-%{release}
@@ -685,9 +693,8 @@ export LIBDIR_SUFFIX
   --with-dlz-postgres=yes \
   --with-dlz-mysql=yes \
   --with-dlz-filesystem=yes \
-  --with-dlz-bdb=yes \
 %endif
-%if %{with DLZ}
+%if %{with BDB}
   --with-dlz-bdb=yes \
 %endif
 %if %{with GSSTSIG}
@@ -740,14 +747,19 @@ popd
 
 %if %{with DLZ}
   pushd contrib/dlz
-  pushd bin/dlzbdb
-    make
-  popd
   pushd modules
-  for DIR in bdbhpt filesystem ldap mysql mysqldyn sqlite3; do
+  for DIR in filesystem ldap mysql mysqldyn sqlite3; do
     make -C $DIR CFLAGS="-fPIC -I../include $CFLAGS $LDFLAGS"
   done
   popd
+  %if %{with BDB}
+    pushd bin/dlzbdb
+      make
+    popd
+    pushd modules
+      make -C bdbhpt CFLAGS="-fPIC -I../include $CFLAGS $LDFLAGS"
+    popd
+  %endif
   popd
 %endif
 popd # build
@@ -988,15 +1000,20 @@ install -m 644 %{SOURCE12} contrib/sdb/pgsql/
 %if %{with DLZ}
   pushd build
   pushd contrib/dlz
-  pushd bin/dlzbdb
-    make DESTDIR=${RPM_BUILD_ROOT} install
-  popd
   pushd modules
-  for DIR in bdbhpt filesystem ldap mysql mysqldyn sqlite3; do
+  for DIR in filesystem ldap mysql mysqldyn sqlite3; do
     make -C $DIR DESTDIR=${RPM_BUILD_ROOT} libdir=%{_libdir}/bind install
   done
   mv mysqldyn/testing/README mysqldyn/testing/README.testing
+  %if %{with BDB}
+    make -C bdbhpt DESTDIR=${RPM_BUILD_ROOT} libdir=%{_libdir}/bind install
+  %endif
   popd
+  %if %{with BDB}
+    pushd bin/dlzbdb
+      make DESTDIR=${RPM_BUILD_ROOT} install
+    popd
+  %endif
   popd
   popd
 %endif
@@ -1545,13 +1562,16 @@ fi;
 %{_bindir}/bind9-export-config
 %endif
 
-%if %{with DLZ}
+%if %{with DLZ} && %{with BDB}
 %files dlz-bdb
 %{_sbindir}/dlzbdb
 %{_libdir}/bind/dlz_bdbhpt_dynamic.so
 %doc contrib/dlz/modules/bdbhpt/testing/*
 %doc contrib/dlz/modules/bdbhpt/README*
 
+%endif
+
+%if %{with DLZ}
 %files dlz-filesystem
 %{_libdir}/bind/dlz_filesystem_dynamic.so
 
@@ -1580,6 +1600,9 @@ fi;
 
 
 %changelog
+* Tue Dec 03 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.13-4
+- Disable Berkeley DB support (#1779190)
+
 * Mon Dec 02 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.13-3
 - Backport few thread safety related fixed from upstream (#1736762)
 

From 9cfd91a4738b36037968d9a9da65ed449a128346 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 4 Dec 2019 17:09:24 +0100
Subject: [PATCH 098/460] Add ThreadSanitizer support

Has to be enabled in build by --with TSAN.
Would make build fail unit tests and print many warnings about possible
race conditions. Not useful for production build, but useful for
debugging thread related problems in system tests.
---
 bind.spec | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index 79e961e..e0522c6 100644
--- a/bind.spec
+++ b/bind.spec
@@ -31,6 +31,7 @@
 %else
 %bcond_with    UNITTEST
 %endif
+%bcond_with    TSAN
 
 %{?!bind_uid:  %global bind_uid  25}
 %{?!bind_gid:  %global bind_gid  25}
@@ -244,6 +245,9 @@ BuildRequires:  fstrm-devel protobuf-c-devel
 %endif
 # Needed to regenerate dig.1 manpage
 BuildRequires: docbook-style-xsl, libxslt
+%if %{with TSAN}
+BuildRequires: libtsan
+%endif
 
 %description
 BIND (Berkeley Internet Name Domain) is an implementation of the DNS
@@ -643,10 +647,15 @@ done
   cp -Tuav bin/tests "%{1}/bin/tests/" \
   cp -uv version "%{1}" \
 
-export CFLAGS="$CFLAGS $RPM_OPT_FLAGS"
+CFLAGS="$CFLAGS $RPM_OPT_FLAGS"
+%if %{with TSAN}
+  CFLAGS+=" -O1 -fsanitize=thread -fPIE -pie"
+%endif
+export CFLAGS
 export CPPFLAGS="$CPPFLAGS -DDIG_SIGCHASE"
 export STD_CDEFINES="$CPPFLAGS"
 
+
 sed -i -e \
 's/RELEASEVER=\(.*\)/RELEASEVER=\1-RedHat-%{version}-%{release}/' \
 version
@@ -850,6 +859,10 @@ sed -e "/^\s*include(/ d" -e 's/^-- use //' \
   eval "$(bash %{SOURCE48} -A "`pwd`/softhsm-tokens")"
 %endif
 
+%if %{with TSAN}
+export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0"
+%endif
+
 %if %{with UNITTEST}
   pushd build
   make unit

From d5106d287e5d619dbf7e6f2dcfeff8cd41a8c178 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 9 Dec 2019 21:27:17 +0100
Subject: [PATCH 099/460] Add one more candidate for issue fixing

Imported from upstream commit 6eed12605154b8ce10e9be0f51253e6ec318550e
---
 bind-9.11-rh1736762-5.patch | 59 +++++++++++++++++++++++++++++++++++++
 bind.spec                   |  2 ++
 2 files changed, 61 insertions(+)
 create mode 100644 bind-9.11-rh1736762-5.patch

diff --git a/bind-9.11-rh1736762-5.patch b/bind-9.11-rh1736762-5.patch
new file mode 100644
index 0000000..e14efca
--- /dev/null
+++ b/bind-9.11-rh1736762-5.patch
@@ -0,0 +1,59 @@
+From 6257d829c9d7e71ac51bcdc6b5b981c7a19200e2 Mon Sep 17 00:00:00 2001
+From: Mark Andrews <marka@isc.org>
+Date: Mon, 25 Nov 2019 05:46:55 +0000
+Subject: [PATCH] Merge branch
+ '1373-threadsanitizer-data-race-rbtdb-c-5193-in-detachnode' into 'master'
+
+Resolve "ThreadSanitizer: data race rbtdb.c:5193 in detachnode"
+
+Closes #1373
+
+See merge request isc-projects/bind9!2598
+---
+ lib/dns/include/dns/rbt.h | 22 +++++++++-------------
+ 1 file changed, 9 insertions(+), 13 deletions(-)
+
+diff --git a/lib/dns/include/dns/rbt.h b/lib/dns/include/dns/rbt.h
+index 67ac3e4d8a..a084bd6193 100644
+--- a/lib/dns/include/dns/rbt.h
++++ b/lib/dns/include/dns/rbt.h
+@@ -49,10 +49,7 @@ ISC_LANG_BEGINDECLS
+ 
+ #define DNS_RBT_USEMAGIC 1
+ 
+-/*
+- * These should add up to 30.
+- */
+-#define DNS_RBT_LOCKLENGTH                      10
++#define DNS_RBT_LOCKLENGTH		(sizeof(((dns_rbtnode_t *)0)->locknum)*8)
+ #define DNS_RBT_REFLENGTH                       20
+ 
+ #define DNS_RBTNODE_MAGIC               ISC_MAGIC('R','B','N','O')
+@@ -159,16 +156,15 @@ struct dns_rbtnode {
+ 	 * separate region of memory.
+ 	 */
+ 	void *data;
+-	unsigned int :0;                /* start of bitfields c/o node lock */
+-	unsigned int dirty:1;
+-	unsigned int wild:1;
+-	unsigned int locknum:DNS_RBT_LOCKLENGTH;
+-#ifndef DNS_RBT_USEISCREFCOUNT
+-	unsigned int references:DNS_RBT_REFLENGTH;
+-#endif
+-	unsigned int :0;                /* end of bitfields c/o node lock */
++	uint8_t :0;                /* start of bitfields c/o node lock */
++	uint8_t dirty:1;
++	uint8_t wild:1;
++	uint8_t :0;                /* end of bitfields c/o node lock */
++	uint16_t locknum;	   /* note that this is not in the bitfield */
+ #ifdef DNS_RBT_USEISCREFCOUNT
+-	isc_refcount_t references; /* note that this is not in the bitfield */
++	isc_refcount_t references;
++#else
++	unsigned int references:DNS_RBT_REFLENGTH;
+ #endif
+ 	/*@}*/
+ };
+-- 
+2.21.0
+
diff --git a/bind.spec b/bind.spec
index e0522c6..e6659da 100644
--- a/bind.spec
+++ b/bind.spec
@@ -168,6 +168,7 @@ Patch179: bind-9.11-rh1736762-1.patch
 Patch180: bind-9.11-rh1736762-2.patch
 Patch181: bind-9.11-rh1736762-3.patch
 Patch182: bind-9.11-rh1736762-4.patch
+Patch183: bind-9.11-rh1736762-5.patch
 
 # SDB patches
 Patch11: bind-9.3.2b2-sdbsrc.patch
@@ -577,6 +578,7 @@ are used for building ISC DHCP.
 %patch180 -p1 -b .rh1736762-2
 %patch181 -p1 -b .rh1736762-3
 %patch182 -p1 -b .rh1736762-4
+%patch183 -p1 -b .rh1736762-5
 
 mkdir lib/dns/tests/testdata/dstrandom
 cp -a %{SOURCE50} lib/dns/tests/testdata/dstrandom/random.data

From 9406a85e898d76742de4c8bc42c2ef45c2d50564 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 11 Dec 2019 19:41:17 +0100
Subject: [PATCH 100/460] Fix dnf builddep when python3-devel is not installed

Build requirements fetch fail on clean system with just basic utils.
---
 bind.spec | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index e6659da..e076859 100644
--- a/bind.spec
+++ b/bind.spec
@@ -497,7 +497,7 @@ Dynamic Loadable Zones sqlite3 module for BIND server.
 %package -n python3-bind
 Summary:   A module allowing rndc commands to be sent from Python programs
 Requires:  bind-license = %{epoch}:%{version}-%{release}
-Requires:  python3 python3-ply %{py3_dist ply}
+Requires:  python3 python3-ply %{?py3_dist:%py3_dist ply}
 BuildArch: noarch
 %{?python_provide:%python_provide python3-bind}
 %{?python_provide:%python_provide python3-isc}

From 23657868e6bb83f937ac145c9576cbf618253d0a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 19 Dec 2019 18:39:21 +0100
Subject: [PATCH 101/460] Update to 9.11.14

Includes ThreadSanitizer fixes already included as downstream patches.
Adjusts serve-stale patch, one new statistics.
---
 .gitignore                  |   2 +
 bind-9.11-rh1736762-1.patch |  56 --------------
 bind-9.11-rh1736762-2.patch |  38 ---------
 bind-9.11-rh1736762-3.patch | 105 -------------------------
 bind-9.11-rh1736762-4.patch | 110 ---------------------------
 bind-9.11-rt31459.patch     | 148 ++++++++++++++++++------------------
 bind-9.11-serve-stale.patch | 138 ++++++++++++++++-----------------
 bind.spec                   |  15 ++--
 sources                     |   4 +-
 9 files changed, 152 insertions(+), 464 deletions(-)
 delete mode 100644 bind-9.11-rh1736762-1.patch
 delete mode 100644 bind-9.11-rh1736762-2.patch
 delete mode 100644 bind-9.11-rh1736762-3.patch
 delete mode 100644 bind-9.11-rh1736762-4.patch

diff --git a/.gitignore b/.gitignore
index 39aba1c..d72777d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -100,3 +100,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.11.12.tar.gz
 /bind-9.11.13.tar.gz
 /bind-9.11.13.tar.gz.asc
+/bind-9.11.14.tar.gz
+/bind-9.11.14.tar.gz.asc
diff --git a/bind-9.11-rh1736762-1.patch b/bind-9.11-rh1736762-1.patch
deleted file mode 100644
index 272177f..0000000
--- a/bind-9.11-rh1736762-1.patch
+++ /dev/null
@@ -1,56 +0,0 @@
-From 312bd133f75c54d51196060c573e29aabbb0b842 Mon Sep 17 00:00:00 2001
-From: Mark Andrews <marka@isc.org>
-Date: Tue, 26 Nov 2019 02:30:14 +0000
-Subject: [PATCH 1/4] Merge branch
- '1367-threadsanitizer-data-race-dispatch-c-901-in-free_buffer-v9_11' into
- 'v9_11'
-
-Resolve "ThreadSanitizer: data race dispatch.c:901 in free_buffer"
-
-See merge request isc-projects/bind9!2628
-
-(cherry picked from commit 0455351802cb915e7961dad9cf14977a19162d38)
----
- lib/dns/dispatch.c | 9 ++++++---
- 1 file changed, 6 insertions(+), 3 deletions(-)
-
-diff --git a/lib/dns/dispatch.c b/lib/dns/dispatch.c
-index 3278db4a07..ea5cf102f2 100644
---- a/lib/dns/dispatch.c
-+++ b/lib/dns/dispatch.c
-@@ -927,6 +927,10 @@ allocate_udp_buffer(dns_dispatch_t *disp) {
- 	void *temp;
- 
- 	LOCK(&disp->mgr->buffer_lock);
-+	if (disp->mgr->buffers >= disp->mgr->maxbuffers) {
-+		UNLOCK(&disp->mgr->buffer_lock);
-+		return (NULL);
-+	}
- 	bpool = disp->mgr->bpool;
- 	disp->mgr->buffers++;
- 	UNLOCK(&disp->mgr->buffer_lock);
-@@ -1058,9 +1062,11 @@ udp_recv(isc_event_t *ev_in, dns_dispatch_t *disp, dispsocket_t *dispsock) {
- 	mgr = disp->mgr;
- 	qid = mgr->qid;
- 
-+	LOCK(&disp->mgr->buffer_lock);
- 	dispatch_log(disp, LVL(90),
- 		     "got packet: requests %d, buffers %d, recvs %d",
- 		     disp->requests, disp->mgr->buffers, disp->recv_pending);
-+	UNLOCK(&disp->mgr->buffer_lock);
- 
- 	if (dispsock == NULL && ev->ev_type == ISC_SOCKEVENT_RECVDONE) {
- 		/*
-@@ -1511,9 +1517,6 @@ startrecv(dns_dispatch_t *disp, dispsocket_t *dispsock) {
- 	if (disp->recv_pending != 0 && dispsock == NULL)
- 		return (ISC_R_SUCCESS);
- 
--	if (disp->mgr->buffers >= disp->mgr->maxbuffers)
--		return (ISC_R_NOMEMORY);
--
- 	if ((disp->attributes & DNS_DISPATCHATTR_EXCLUSIVE) != 0 &&
- 	    dispsock == NULL)
- 		return (ISC_R_SUCCESS);
--- 
-2.21.0
-
diff --git a/bind-9.11-rh1736762-2.patch b/bind-9.11-rh1736762-2.patch
deleted file mode 100644
index 7d16138..0000000
--- a/bind-9.11-rh1736762-2.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From 8e1900b79d854e22ec6b5cea152ff363ce9a461c Mon Sep 17 00:00:00 2001
-From: Mark Andrews <marka@isc.org>
-Date: Fri, 22 Nov 2019 21:48:12 +0000
-Subject: [PATCH 2/4] Merge branch
- '1334-threadsanitizer-data-race-dispatch-c-1339-in-tcp_recv-v9_11' into
- 'v9_11'
-
-lock dispatch before reporting state
-
-See merge request isc-projects/bind9!2619
-
-(cherry picked from commit e36730076af3190fe5930a6406dd414b87e1e178)
----
- lib/dns/dispatch.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/lib/dns/dispatch.c b/lib/dns/dispatch.c
-index ea5cf102f2..94df6bab9a 100644
---- a/lib/dns/dispatch.c
-+++ b/lib/dns/dispatch.c
-@@ -1353,12 +1353,12 @@ tcp_recv(isc_task_t *task, isc_event_t *ev_in) {
- 
- 	qid = disp->qid;
- 
-+	LOCK(&disp->lock);
-+
- 	dispatch_log(disp, LVL(90),
- 		     "got TCP packet: requests %d, buffers %d, recvs %d",
- 		     disp->requests, disp->tcpbuffers, disp->recv_pending);
- 
--	LOCK(&disp->lock);
--
- 	INSIST(disp->recv_pending != 0);
- 	disp->recv_pending = 0;
- 
--- 
-2.21.0
-
diff --git a/bind-9.11-rh1736762-3.patch b/bind-9.11-rh1736762-3.patch
deleted file mode 100644
index ed4dc93..0000000
--- a/bind-9.11-rh1736762-3.patch
+++ /dev/null
@@ -1,105 +0,0 @@
-From 651fc773a6e154466998424e975bce3fdb8566d8 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
-Date: Wed, 27 Nov 2019 17:06:28 +0000
-Subject: [PATCH 3/4] Merge branch
- '1350-threadsanitizer-data-race-rbt-c-1312-in-dns_rbt_addnode-v9_11' into
- 'v9_11'
-
-Resolve "ThreadSanitizer: data race rbt.c:1312 in dns_rbt_addnode"
-
-See merge request isc-projects/bind9!2651
-
-(cherry picked from commit a5fb8c812728cb5fc923f60d6707d953d704719f)
----
- lib/dns/rbtdb.c | 24 +++++++++++++++++++++---
- 1 file changed, 21 insertions(+), 3 deletions(-)
-
-diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
-index 738aa203ec..d3bb8d7fe7 100644
---- a/lib/dns/rbtdb.c
-+++ b/lib/dns/rbtdb.c
-@@ -1972,6 +1972,9 @@ clean_zone_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
- 		node->dirty = 0;
- }
- 
-+/*
-+ * tree_lock(write) must be held.
-+ */
- static void
- delete_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node) {
- 	dns_rbtnode_t *nsecnode;
-@@ -2955,6 +2958,8 @@ closeversion(dns_db_t *db, dns_dbversion_t **versionp, bool commit) {
-  * E.g. if the wildcard name is "*.sub.example." then we
-  * must ensure that "sub.example." exists and is marked as
-  * a wildcard level.
-+ *
-+ * tree_lock(write) must be held.
-  */
- static isc_result_t
- add_wildcard_magic(dns_rbtdb_t *rbtdb, dns_name_t *name) {
-@@ -2979,6 +2984,9 @@ add_wildcard_magic(dns_rbtdb_t *rbtdb, dns_name_t *name) {
- 	return (ISC_R_SUCCESS);
- }
- 
-+/*
-+ * tree_lock(write) must be held.
-+ */
- static isc_result_t
- add_empty_wildcards(dns_rbtdb_t *rbtdb, dns_name_t *name) {
- 	isc_result_t result;
-@@ -6756,13 +6764,16 @@ addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
- 	REQUIRE(VALID_RBTDB(rbtdb));
- 	INSIST(rbtversion == NULL || rbtversion->rbtdb == rbtdb);
- 
--	if (rbtdb->common.methods == &zone_methods)
-+	if (rbtdb->common.methods == &zone_methods) {
-+		RWLOCK(&rbtdb->tree_lock, isc_rwlocktype_read);
- 		REQUIRE(((rbtnode->nsec == DNS_RBT_NSEC_NSEC3 &&
- 			  (rdataset->type == dns_rdatatype_nsec3 ||
- 			   rdataset->covers == dns_rdatatype_nsec3)) ||
- 			 (rbtnode->nsec != DNS_RBT_NSEC_NSEC3 &&
- 			   rdataset->type != dns_rdatatype_nsec3 &&
- 			   rdataset->covers != dns_rdatatype_nsec3)));
-+		RWUNLOCK(&rbtdb->tree_lock, isc_rwlocktype_read);
-+	}
- 
- 	if (rbtversion == NULL) {
- 		if (now == 0)
-@@ -6854,11 +6865,15 @@ addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
- 	/*
- 	 * Add to the auxiliary NSEC tree if we're adding an NSEC record.
- 	 */
-+	RWLOCK(&rbtdb->tree_lock, isc_rwlocktype_read);
- 	if (rbtnode->nsec != DNS_RBT_NSEC_HAS_NSEC &&
- 	    rdataset->type == dns_rdatatype_nsec)
-+	{
- 		newnsec = true;
--	else
-+	} else {
- 		newnsec = false;
-+	}
-+	RWUNLOCK(&rbtdb->tree_lock, isc_rwlocktype_read);
- 
- 	/*
- 	 * If we're adding a delegation type, adding to the auxiliary NSEC tree,
-@@ -6959,13 +6974,16 @@ subtractrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
- 	REQUIRE(VALID_RBTDB(rbtdb));
- 	REQUIRE(rbtversion != NULL && rbtversion->rbtdb == rbtdb);
- 
--	if (rbtdb->common.methods == &zone_methods)
-+	if (rbtdb->common.methods == &zone_methods) {
-+		RWLOCK(&rbtdb->tree_lock, isc_rwlocktype_read);
- 		REQUIRE(((rbtnode->nsec == DNS_RBT_NSEC_NSEC3 &&
- 			  (rdataset->type == dns_rdatatype_nsec3 ||
- 			   rdataset->covers == dns_rdatatype_nsec3)) ||
- 			 (rbtnode->nsec != DNS_RBT_NSEC_NSEC3 &&
- 			   rdataset->type != dns_rdatatype_nsec3 &&
- 			   rdataset->covers != dns_rdatatype_nsec3)));
-+		RWUNLOCK(&rbtdb->tree_lock, isc_rwlocktype_read);
-+	}
- 
- 	result = dns_rdataslab_fromrdataset(rdataset, rbtdb->common.mctx,
- 					    &region, sizeof(rdatasetheader_t));
--- 
-2.21.0
-
diff --git a/bind-9.11-rh1736762-4.patch b/bind-9.11-rh1736762-4.patch
deleted file mode 100644
index 61afe9d..0000000
--- a/bind-9.11-rh1736762-4.patch
+++ /dev/null
@@ -1,110 +0,0 @@
-From 9c1f74400c04267dea4f1bd7f62de8ba5e8d2b0e Mon Sep 17 00:00:00 2001
-From: Mark Andrews <marka@isc.org>
-Date: Thu, 28 Nov 2019 10:24:12 +1100
-Subject: [PATCH 4/4] rdataset_setownercase and rdataset_getownercase need to
- obtain a node lock
-
-(cherry picked from commit 637b2c4e517b466900a8c00b52f7a15727e12ae9)
-(cherry picked from commit 1c61f129c3b12071723a2154d33f74628bf80998)
----
- lib/dns/rbtdb.c | 35 ++++++++++++++++++++++++++++-------
- 1 file changed, 28 insertions(+), 7 deletions(-)
-
-diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
-index d3bb8d7fe7..199ff08011 100644
---- a/lib/dns/rbtdb.c
-+++ b/lib/dns/rbtdb.c
-@@ -10109,11 +10109,18 @@ setownercase(rdatasetheader_t *header, const dns_name_t *name) {
- 
- static void
- rdataset_setownercase(dns_rdataset_t *rdataset, const dns_name_t *name) {
-+	dns_rbtdb_t *rbtdb = rdataset->private1;
-+	dns_rbtnode_t *rbtnode = rdataset->private2;
- 	unsigned char *raw = rdataset->private3;        /* RDATASLAB */
- 	rdatasetheader_t *header;
- 
- 	header = (struct rdatasetheader *)(raw - sizeof(*header));
-+
-+	NODE_LOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
-+		  isc_rwlocktype_write);
- 	setownercase(header, name);
-+	NODE_UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
-+		    isc_rwlocktype_write);
- }
- 
- static const unsigned char charmask[] = {
-@@ -10188,6 +10195,8 @@ static unsigned char maptolower[] = {
- 
- static void
- rdataset_getownercase(const dns_rdataset_t *rdataset, dns_name_t *name) {
-+	dns_rbtdb_t *rbtdb = rdataset->private1;
-+	dns_rbtnode_t *rbtnode = rdataset->private2;
- 	const unsigned char *raw = rdataset->private3;        /* RDATASLAB */
- 	const rdatasetheader_t *header;
- 	unsigned int i, j;
-@@ -10196,8 +10205,12 @@ rdataset_getownercase(const dns_rdataset_t *rdataset, dns_name_t *name) {
- 
- 	header = (const struct rdatasetheader *)(raw - sizeof(*header));
- 
--	if (!CASESET(header))
--		return;
-+	NODE_LOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
-+		  isc_rwlocktype_read);
-+
-+	if (!CASESET(header)) {
-+		goto unlock;
-+	}
- 
- #if 0
- 	/*
-@@ -10210,10 +10223,13 @@ rdataset_getownercase(const dns_rdataset_t *rdataset, dns_name_t *name) {
- 		 */
- 		if (name->ndata[i] >= 0x61 && name->ndata[i] <= 0x7a &&
- 		    (header->upper[i/8] & (1 << (i%8))) != 0)
-+		{
- 			name->ndata[i] &= ~0x20; /* clear the lower case bit */
--		else if (name->ndata[i] >= 0x41 && name->ndata[i] <= 0x5a &&
--			 (header->upper[i/8] & (1 << (i%8))) == 0)
-+		} else if (name->ndata[i] >= 0x41 && name->ndata[i] <= 0x5a &&
-+			   (header->upper[i/8] & (1 << (i%8))) == 0)
-+		{
- 			name->ndata[i] |= 0x20; /* set the lower case bit */
-+		}
- 	}
- #else
- 	if (ISC_LIKELY(CASEFULLYLOWER(header))) {
-@@ -10236,7 +10252,7 @@ rdataset_getownercase(const dns_rdataset_t *rdataset, dns_name_t *name) {
- 			c = *bp;
- 			*bp++ = maptolower[c];
- 		}
--		return;
-+		goto unlock;
- 	}
- 
- 	i = 0;
-@@ -10257,8 +10273,9 @@ rdataset_getownercase(const dns_rdataset_t *rdataset, dns_name_t *name) {
- 		}
- 	}
- 
--	if (ISC_UNLIKELY(i == name->length))
--		return;
-+	if (ISC_UNLIKELY(i == name->length)) {
-+		goto unlock;
-+	}
- 
- 	bits = ~(header->upper[j]);
- 
-@@ -10272,6 +10289,10 @@ rdataset_getownercase(const dns_rdataset_t *rdataset, dns_name_t *name) {
- 		bits >>= 1;
- 	}
- #endif
-+
-+ unlock:
-+	NODE_UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
-+		    isc_rwlocktype_read);
- }
- 
- /*%
--- 
-2.21.0
-
diff --git a/bind-9.11-rt31459.patch b/bind-9.11-rt31459.patch
index ea25abe..efcc6fa 100644
--- a/bind-9.11-rt31459.patch
+++ b/bind-9.11-rt31459.patch
@@ -1,4 +1,4 @@
-From 7e61714a5d1509ec79af42391e41eb1afc53063a Mon Sep 17 00:00:00 2001
+From e83a6723d84e4c4400ca646077393a24b092c623 Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Tue, 12 Sep 2017 19:05:46 -0700
 Subject: [PATCH] rebased rt31459c
@@ -71,10 +71,10 @@ index 5015abb..295e16f 100644
  							     &entropy_source,
  							     randomfile,
 diff --git a/bin/dnssec/dnssec-dsfromkey.c b/bin/dnssec/dnssec-dsfromkey.c
-index 2c0c308..3e585af 100644
+index d9d6bb9..de4b15f 100644
 --- a/bin/dnssec/dnssec-dsfromkey.c
 +++ b/bin/dnssec/dnssec-dsfromkey.c
-@@ -494,14 +494,14 @@ main(int argc, char **argv) {
+@@ -498,14 +498,14 @@ main(int argc, char **argv) {
  
  	if (ectx == NULL)
  		setup_entropy(mctx, NULL, &ectx);
@@ -92,7 +92,7 @@ index 2c0c308..3e585af 100644
  	isc_entropy_stopcallbacksources(ectx);
  
  	setup_logging(mctx, &log);
-@@ -571,8 +571,8 @@ main(int argc, char **argv) {
+@@ -574,8 +574,8 @@ main(int argc, char **argv) {
  	if (dns_rdataset_isassociated(&rdataset))
  		dns_rdataset_disassociate(&rdataset);
  	cleanup_logging(&log);
@@ -103,10 +103,10 @@ index 2c0c308..3e585af 100644
  	dns_name_destroy();
  	if (verbose > 10)
 diff --git a/bin/dnssec/dnssec-importkey.c b/bin/dnssec/dnssec-importkey.c
-index 0d1e7f8..79c4d74 100644
+index d65a514..04b3094 100644
 --- a/bin/dnssec/dnssec-importkey.c
 +++ b/bin/dnssec/dnssec-importkey.c
-@@ -407,14 +407,14 @@ main(int argc, char **argv) {
+@@ -404,14 +404,14 @@ main(int argc, char **argv) {
  
  	if (ectx == NULL)
  		setup_entropy(mctx, NULL, &ectx);
@@ -124,7 +124,7 @@ index 0d1e7f8..79c4d74 100644
  	isc_entropy_stopcallbacksources(ectx);
  
  	setup_logging(mctx, &log);
-@@ -458,8 +458,8 @@ main(int argc, char **argv) {
+@@ -455,8 +455,8 @@ main(int argc, char **argv) {
  	if (dns_rdataset_isassociated(&rdataset))
  		dns_rdataset_disassociate(&rdataset);
  	cleanup_logging(&log);
@@ -167,10 +167,10 @@ index 7d82dbf..10f9359 100644
  	if (verbose > 10)
  		isc_mem_stats(mctx, stdout);
 diff --git a/bin/dnssec/dnssec-settime.c b/bin/dnssec/dnssec-settime.c
-index f355903..6a2ca59 100644
+index 7afcaee..1cfa511 100644
 --- a/bin/dnssec/dnssec-settime.c
 +++ b/bin/dnssec/dnssec-settime.c
-@@ -382,14 +382,14 @@ main(int argc, char **argv) {
+@@ -380,14 +380,14 @@ main(int argc, char **argv) {
  
  	if (ectx == NULL)
  		setup_entropy(mctx, NULL, &ectx);
@@ -188,7 +188,7 @@ index f355903..6a2ca59 100644
  	isc_entropy_stopcallbacksources(ectx);
  
  	if (predecessor != NULL) {
-@@ -674,8 +674,8 @@ main(int argc, char **argv) {
+@@ -672,8 +672,8 @@ main(int argc, char **argv) {
  	if (prevkey != NULL)
  		dst_key_free(&prevkey);
  	dst_key_free(&key);
@@ -199,7 +199,7 @@ index f355903..6a2ca59 100644
  	if (verbose > 10)
  		isc_mem_stats(mctx, stdout);
 diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c
-index c6a0313..6ddaebe 100644
+index 71f5672..9b100ca 100644
 --- a/bin/dnssec/dnssec-signzone.c
 +++ b/bin/dnssec/dnssec-signzone.c
 @@ -3460,14 +3460,15 @@ main(int argc, char *argv[]) {
@@ -257,7 +257,7 @@ index 4c293bf..3263cbc 100644
  
  	rdclass = strtoclass(classname);
 diff --git a/bin/dnssec/dnssectool.c b/bin/dnssec/dnssectool.c
-index fbc7ece..31a99e7 100644
+index 9d2a016..a9f90b6 100644
 --- a/bin/dnssec/dnssectool.c
 +++ b/bin/dnssec/dnssectool.c
 @@ -34,6 +34,7 @@
@@ -293,7 +293,7 @@ index fbc7ece..31a99e7 100644
  					   usekeyboard);
  
 diff --git a/bin/named/server.c b/bin/named/server.c
-index 7d85d3b..c782073 100644
+index 5a860e4..21c340c 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
 @@ -36,6 +36,7 @@
@@ -304,7 +304,7 @@ index 7d85d3b..c782073 100644
  #include <isc/portset.h>
  #include <isc/print.h>
  #include <isc/random.h>
-@@ -8211,6 +8212,10 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8217,6 +8218,10 @@ load_configuration(const char *filename, ns_server_t *server,
  				      "no source of entropy found");
  		} else {
  			const char *randomdev = cfg_obj_asstring(obj);
@@ -315,7 +315,7 @@ index 7d85d3b..c782073 100644
  			int level = ISC_LOG_ERROR;
  			result = isc_entropy_createfilesource(ns_g_entropy,
  							      randomdev);
-@@ -8245,6 +8250,7 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8251,6 +8256,7 @@ load_configuration(const char *filename, ns_server_t *server,
  				}
  				isc_entropy_detach(&ns_g_fallbackentropy);
  			}
@@ -688,7 +688,7 @@ index bf6dbb6..0416b21 100644
  	parse_args(false, argc, argv);
  	if (server == NULL)
 diff --git a/configure b/configure
-index ed002e0..a578874 100755
+index aab472a..b686178 100755
 --- a/configure
 +++ b/configure
 @@ -640,6 +640,7 @@ ac_includes_default="\
@@ -715,7 +715,7 @@ index ed002e0..a578874 100755
  with_lmdb
  with_libxml2
  with_libjson
-@@ -1744,6 +1747,7 @@ Optional Features:
+@@ -1745,6 +1748,7 @@ Optional Features:
    --enable-threads        enable multithreading
    --enable-native-pkcs11  use native PKCS11 for all crypto [default=no]
    --enable-openssl-hash   use OpenSSL for hash functions [default=no]
@@ -723,7 +723,7 @@ index ed002e0..a578874 100755
    --enable-largefile      64-bit file support
    --enable-backtrace      log stack backtrace on abort [default=yes]
    --enable-symtable       use internal symbol table for backtrace
-@@ -17115,6 +17119,7 @@ case "$use_openssl" in
+@@ -17135,6 +17139,7 @@ case "$use_openssl" in
  $as_echo "disabled because of native PKCS11" >&6; }
  		DST_OPENSSL_INC=""
  		CRYPTO="-DPKCS11CRYPTO"
@@ -731,7 +731,7 @@ index ed002e0..a578874 100755
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -17129,6 +17134,7 @@ $as_echo "disabled because of native PKCS11" >&6; }
+@@ -17149,6 +17154,7 @@ $as_echo "disabled because of native PKCS11" >&6; }
  $as_echo "no" >&6; }
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -739,7 +739,7 @@ index ed002e0..a578874 100755
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -17141,6 +17147,7 @@ $as_echo "no" >&6; }
+@@ -17161,6 +17167,7 @@ $as_echo "no" >&6; }
  	auto)
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -747,7 +747,7 @@ index ed002e0..a578874 100755
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -17150,7 +17157,7 @@ $as_echo "no" >&6; }
+@@ -17170,7 +17177,7 @@ $as_echo "no" >&6; }
  		OPENSSLLINKOBJS=""
  		OPENSSLLINKSRCS=""
  		as_fn_error $? "OpenSSL was not found in any of $openssldirs; use --with-openssl=/path
@@ -756,7 +756,7 @@ index ed002e0..a578874 100755
  		;;
  	*)
  		if test "yes" = "$want_native_pkcs11"
-@@ -17181,6 +17188,7 @@ $as_echo "not found" >&6; }
+@@ -17201,6 +17208,7 @@ $as_echo "not found" >&6; }
  			as_fn_error $? "\"$use_openssl/include/openssl/opensslv.h\" not found" "$LINENO" 5
  		fi
  		CRYPTO='-DOPENSSL'
@@ -764,7 +764,7 @@ index ed002e0..a578874 100755
  		if test "/usr" = "$use_openssl"
  		then
  			DST_OPENSSL_INC=""
-@@ -17806,8 +17814,6 @@ fi
+@@ -17826,8 +17834,6 @@ fi
  # Use OpenSSL for hash functions
  #
  
@@ -773,7 +773,7 @@ index ed002e0..a578874 100755
  ISC_PLATFORM_OPENSSLHASH="#undef ISC_PLATFORM_OPENSSLHASH"
  case $want_openssl_hash in
  	yes)
-@@ -18182,6 +18188,86 @@ if test "rt" = "$have_clock_gt"; then
+@@ -18202,6 +18208,86 @@ if test "rt" = "$have_clock_gt"; then
  	LIBS="-lrt $LIBS"
  fi
  
@@ -860,7 +860,7 @@ index ed002e0..a578874 100755
  #
  # was --with-lmdb specified?
  #
-@@ -20264,9 +20350,12 @@ _ACEOF
+@@ -20284,9 +20370,12 @@ _ACEOF
  if ac_fn_c_try_compile "$LINENO"; then :
    { $as_echo "$as_me:${as_lineno-$LINENO}: result: size_t for buflen; int for flags" >&5
  $as_echo "size_t for buflen; int for flags" >&6; }
@@ -875,7 +875,7 @@ index ed002e0..a578874 100755
  
  	 $as_echo "#define IRS_GETNAMEINFO_FLAGS_T int" >>confdefs.h
  
-@@ -21581,12 +21670,7 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
+@@ -21601,12 +21690,7 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
  ISC_PLATFORM_USESTDASM="#undef ISC_PLATFORM_USESTDASM"
  ISC_PLATFORM_USEMACASM="#undef ISC_PLATFORM_USEMACASM"
  if test "yes" = "$use_atomic"; then
@@ -889,7 +889,7 @@ index ed002e0..a578874 100755
  # version HP92453-01 B.11.11.23709.GP, which incorrectly rejects
  # declarations like `int a3[[(sizeof (unsigned char)) >= 0]];'.
  # This bug is HP SR number 8606223364.
-@@ -21619,6 +21703,11 @@ cat >>confdefs.h <<_ACEOF
+@@ -21639,6 +21723,11 @@ cat >>confdefs.h <<_ACEOF
  _ACEOF
  
  
@@ -901,7 +901,7 @@ index ed002e0..a578874 100755
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -21627,39 +21716,6 @@ _ACEOF
+@@ -21647,39 +21736,6 @@ _ACEOF
  		fi
  	;;
  	x86_64-*|amd64-*)
@@ -941,7 +941,7 @@ index ed002e0..a578874 100755
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -21690,6 +21746,10 @@ $as_echo_n "checking architecture type for atomic operations... " >&6; }
+@@ -21710,6 +21766,10 @@ $as_echo_n "checking architecture type for atomic operations... " >&6; }
  $as_echo "$arch" >&6; }
  fi
  
@@ -952,7 +952,7 @@ index ed002e0..a578874 100755
  if test "yes" = "$have_atomic"; then
  	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking compiler support for inline assembly code" >&5
  $as_echo_n "checking compiler support for inline assembly code... " >&6; }
-@@ -24244,6 +24304,30 @@ CFLAGS="$CFLAGS $SO_CFLAGS"
+@@ -24264,6 +24324,30 @@ CFLAGS="$CFLAGS $SO_CFLAGS"
  #
  dlzdir='${DLZ_DRIVER_DIR}'
  
@@ -983,7 +983,7 @@ index ed002e0..a578874 100755
  #
  # Private autoconf macro to simplify configuring drivers:
  #
-@@ -24574,11 +24658,11 @@ $as_echo "no" >&6; }
+@@ -24594,11 +24678,11 @@ $as_echo "no" >&6; }
  $as_echo "using mysql with libs ${mysql_lib} and includes ${mysql_include}" >&6; }
  		;;
  	*)
@@ -998,7 +998,7 @@ index ed002e0..a578874 100755
  		fi
  
  	CONTRIB_DLZ="$CONTRIB_DLZ -DDLZ_MYSQL"
-@@ -24663,7 +24747,7 @@ $as_echo "" >&6; }
+@@ -24683,7 +24767,7 @@ $as_echo "" >&6; }
  			# Check other locations for includes.
  			# Order is important (sigh).
  
@@ -1007,7 +1007,7 @@ index ed002e0..a578874 100755
  			# include a blank element first
  			for d in "" $bdb_incdirs
  			do
-@@ -24688,57 +24772,9 @@ $as_echo "" >&6; }
+@@ -24708,57 +24792,9 @@ $as_echo "" >&6; }
  			bdb_libnames="db53 db-5.3 db51 db-5.1 db48 db-4.8 db47 db-4.7 db46 db-4.6 db45 db-4.5 db44 db-4.4 db43 db-4.3 db42 db-4.2 db41 db-4.1 db"
  			for d in $bdb_libnames
  			do
@@ -1067,7 +1067,7 @@ index ed002e0..a578874 100755
  					break
  				fi
  			done
-@@ -24897,10 +24933,10 @@ $as_echo "no" >&6; }
+@@ -24917,10 +24953,10 @@ $as_echo "no" >&6; }
  		DLZ_DRIVER_INCLUDES="$DLZ_DRIVER_INCLUDES -I$use_dlz_ldap/include"
  		DLZ_DRIVER_LDAP_INCLUDES="-I$use_dlz_ldap/include"
  	fi
@@ -1081,7 +1081,7 @@ index ed002e0..a578874 100755
  	fi
  
  
-@@ -24986,11 +25022,11 @@ fi
+@@ -25006,11 +25042,11 @@ fi
  		odbcdirs="/usr /usr/local /usr/pkg"
  		for d in $odbcdirs
  		do
@@ -1095,7 +1095,7 @@ index ed002e0..a578874 100755
  				break
  			fi
  		done
-@@ -25265,6 +25301,8 @@ DNS_CRYPTO_LIBS="$NEWFLAGS"
+@@ -25285,6 +25321,8 @@ DNS_CRYPTO_LIBS="$NEWFLAGS"
  
  
  
@@ -1104,7 +1104,7 @@ index ed002e0..a578874 100755
  #
  # Commands to run at the end of config.status.
  # Don't just put these into configure, it won't work right if somebody
-@@ -27644,6 +27682,8 @@ report() {
+@@ -27661,6 +27699,8 @@ report() {
  	    echo "    IPv6 support (--enable-ipv6)"
  	test "X$CRYPTO" = "X" -o "yes" = "$want_native_pkcs11" || \
  		echo "    OpenSSL cryptography/DNSSEC (--with-openssl)"
@@ -1113,7 +1113,7 @@ index ed002e0..a578874 100755
  	test "X$PYTHON" = "X" || echo "    Python tools (--with-python)"
  	test "X$XMLSTATS" = "X" || echo "    XML statistics (--with-libxml2)"
  	test "X$JSONSTATS" = "X" || echo "    JSON statistics (--with-libjson)"
-@@ -27684,6 +27724,8 @@ report() {
+@@ -27701,6 +27741,8 @@ report() {
  	echo "    Very verbose query trace logging (--enable-querytrace)"
      test "no" = "$with_cmocka" || echo "    CMocka Unit Testing Framework (--with-cmocka)"
  
@@ -1122,7 +1122,7 @@ index ed002e0..a578874 100755
      echo "    Dynamically loadable zone (DLZ) drivers:"
      test "no" = "$use_dlz_bdb" || \
  	echo "        Berkeley DB (--with-dlz-bdb)"
-@@ -27731,6 +27773,8 @@ report() {
+@@ -27748,6 +27790,8 @@ report() {
  	echo "    ECDSA algorithm support (--with-ecdsa)"
      test "X$CRYPTO" = "X" -o "yes" = "$OPENSSL_ED25519" -o "yes" = "$PKCS11_ED25519" || \
  	echo "    EDDSA algorithm support (--with-eddsa)"
@@ -1132,10 +1132,10 @@ index ed002e0..a578874 100755
      test "yes" = "$enable_seccomp" || \
  	echo "    Use libseccomp system call filtering (--enable-seccomp)"
 diff --git a/configure.ac b/configure.ac
-index 45a8126..bb1345b 100644
+index 0e16cc8..dd0055d 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -1537,6 +1537,7 @@ case "$use_openssl" in
+@@ -1550,6 +1550,7 @@ case "$use_openssl" in
  		AC_MSG_RESULT(disabled because of native PKCS11)
  		DST_OPENSSL_INC=""
  		CRYPTO="-DPKCS11CRYPTO"
@@ -1143,7 +1143,7 @@ index 45a8126..bb1345b 100644
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -1550,6 +1551,7 @@ case "$use_openssl" in
+@@ -1563,6 +1564,7 @@ case "$use_openssl" in
  		AC_MSG_RESULT(no)
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -1151,7 +1151,7 @@ index 45a8126..bb1345b 100644
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -1562,6 +1564,7 @@ case "$use_openssl" in
+@@ -1575,6 +1577,7 @@ case "$use_openssl" in
  	auto)
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -1159,7 +1159,7 @@ index 45a8126..bb1345b 100644
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -1572,7 +1575,7 @@ case "$use_openssl" in
+@@ -1585,7 +1588,7 @@ case "$use_openssl" in
  		OPENSSLLINKSRCS=""
  		AC_MSG_ERROR(
  [OpenSSL was not found in any of $openssldirs; use --with-openssl=/path
@@ -1168,7 +1168,7 @@ index 45a8126..bb1345b 100644
  		;;
  	*)
  		if test "yes" = "$want_native_pkcs11"
-@@ -1602,6 +1605,7 @@ If you don't want OpenSSL, use --without-openssl])
+@@ -1615,6 +1618,7 @@ If you don't want OpenSSL, use --without-openssl])
  			AC_MSG_ERROR(["$use_openssl/include/openssl/opensslv.h" not found])
  		fi
  		CRYPTO='-DOPENSSL'
@@ -1176,7 +1176,7 @@ index 45a8126..bb1345b 100644
  		if test "/usr" = "$use_openssl"
  		then
  			DST_OPENSSL_INC=""
-@@ -2037,7 +2041,6 @@ fi
+@@ -2050,7 +2054,6 @@ fi
  # Use OpenSSL for hash functions
  #
  
@@ -1184,7 +1184,7 @@ index 45a8126..bb1345b 100644
  ISC_PLATFORM_OPENSSLHASH="#undef ISC_PLATFORM_OPENSSLHASH"
  case $want_openssl_hash in
  	yes)
-@@ -2309,6 +2312,67 @@ if test "rt" = "$have_clock_gt"; then
+@@ -2322,6 +2325,67 @@ if test "rt" = "$have_clock_gt"; then
  	LIBS="-lrt $LIBS"
  fi
  
@@ -1252,7 +1252,7 @@ index 45a8126..bb1345b 100644
  #
  # was --with-lmdb specified?
  #
-@@ -4105,12 +4169,12 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
+@@ -4118,12 +4182,12 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
  ISC_PLATFORM_USESTDASM="#undef ISC_PLATFORM_USESTDASM"
  ISC_PLATFORM_USEMACASM="#undef ISC_PLATFORM_USEMACASM"
  if test "yes" = "$use_atomic"; then
@@ -1266,7 +1266,7 @@ index 45a8126..bb1345b 100644
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -4119,7 +4183,6 @@ if test "yes" = "$use_atomic"; then
+@@ -4132,7 +4196,6 @@ if test "yes" = "$use_atomic"; then
  		fi
  	;;
  	x86_64-*|amd64-*)
@@ -1274,7 +1274,7 @@ index 45a8126..bb1345b 100644
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -5527,6 +5590,8 @@ report() {
+@@ -5537,6 +5600,8 @@ report() {
  	    echo "    IPv6 support (--enable-ipv6)"
  	test "X$CRYPTO" = "X" -o "yes" = "$want_native_pkcs11" || \
  		echo "    OpenSSL cryptography/DNSSEC (--with-openssl)"
@@ -1283,7 +1283,7 @@ index 45a8126..bb1345b 100644
  	test "X$PYTHON" = "X" || echo "    Python tools (--with-python)"
  	test "X$XMLSTATS" = "X" || echo "    XML statistics (--with-libxml2)"
  	test "X$JSONSTATS" = "X" || echo "    JSON statistics (--with-libjson)"
-@@ -5567,6 +5632,8 @@ report() {
+@@ -5577,6 +5642,8 @@ report() {
  	echo "    Very verbose query trace logging (--enable-querytrace)"
      test "no" = "$with_cmocka" || echo "    CMocka Unit Testing Framework (--with-cmocka)"
  
@@ -1292,7 +1292,7 @@ index 45a8126..bb1345b 100644
      echo "    Dynamically loadable zone (DLZ) drivers:"
      test "no" = "$use_dlz_bdb" || \
  	echo "        Berkeley DB (--with-dlz-bdb)"
-@@ -5614,6 +5681,8 @@ report() {
+@@ -5624,6 +5691,8 @@ report() {
  	echo "    ECDSA algorithm support (--with-ecdsa)"
      test "X$CRYPTO" = "X" -o "yes" = "$OPENSSL_ED25519" -o "yes" = "$PKCS11_ED25519" || \
  	echo "    EDDSA algorithm support (--with-eddsa)"
@@ -1302,7 +1302,7 @@ index 45a8126..bb1345b 100644
      test "yes" = "$enable_seccomp" || \
  	echo "    Use libseccomp system call filtering (--enable-seccomp)"
 diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c
-index ec6e00e..1614afa 100644
+index 65bf25d..1eccbe7 100644
 --- a/lib/dns/dst_api.c
 +++ b/lib/dns/dst_api.c
 @@ -277,6 +277,12 @@ dst_lib_init2(isc_mem_t *mctx, isc_entropy_t *ectx,
@@ -1440,7 +1440,7 @@ index 304814b..60543c4 100644
  	isc_hash_destroy();
    cleanup_db:
 diff --git a/lib/dns/openssl_link.c b/lib/dns/openssl_link.c
-index d65ce26..6849732 100644
+index 13e838f..ffe0a69 100644
 --- a/lib/dns/openssl_link.c
 +++ b/lib/dns/openssl_link.c
 @@ -31,6 +31,7 @@
@@ -1476,7 +1476,7 @@ index d65ce26..6849732 100644
  #endif
 +#endif /* !ISC_PLATFORM_CRYPTORANDOM */
  
- #if OPENSSL_VERSION_NUMBER >= 0x10000000L && OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
+ #if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
  static void
 @@ -192,7 +195,7 @@ _set_thread_id(CRYPTO_THREADID *id)
  isc_result_t
@@ -1845,10 +1845,10 @@ index 0000000..bd3d164
 +
 +#endif
 diff --git a/lib/dns/win32/libdns.def.in b/lib/dns/win32/libdns.def.in
-index 5c45d59..34b660c 100644
+index 63be973..40b21fa 100644
 --- a/lib/dns/win32/libdns.def.in
 +++ b/lib/dns/win32/libdns.def.in
-@@ -1484,6 +1484,13 @@ dst_lib_destroy
+@@ -1485,6 +1485,13 @@ dst_lib_destroy
  dst_lib_init
  dst_lib_init2
  dst_lib_initmsgcat
@@ -1944,10 +1944,10 @@ index 4bba8e1..632166a 100644
  
  #endif /* ISC_ENTROPY_H */
 diff --git a/lib/isc/include/isc/platform.h.in b/lib/isc/include/isc/platform.h.in
-index 9c7c342..ee8dc3e 100644
+index 4192946..dbd1560 100644
 --- a/lib/isc/include/isc/platform.h.in
 +++ b/lib/isc/include/isc/platform.h.in
-@@ -341,6 +341,11 @@
+@@ -359,6 +359,11 @@
   */
  @ISC_PLATFORM_HAVESTRINGSH@
  
@@ -1960,10 +1960,10 @@ index 9c7c342..ee8dc3e 100644
   * Define if the hash functions must be provided by OpenSSL.
   */
 diff --git a/lib/isc/include/isc/types.h b/lib/isc/include/isc/types.h
-index 42ff7e0..8d87c44 100644
+index da9d66f..4205400 100644
 --- a/lib/isc/include/isc/types.h
 +++ b/lib/isc/include/isc/types.h
-@@ -93,6 +93,8 @@ typedef struct isc_time			isc_time_t;		/*%< Time */
+@@ -97,6 +97,8 @@ typedef struct isc_time			isc_time_t;		/*%< Time */
  typedef struct isc_timer		isc_timer_t;		/*%< Timer */
  typedef struct isc_timermgr		isc_timermgr_t;		/*%< Timer Manager */
  
@@ -1973,7 +1973,7 @@ index 42ff7e0..8d87c44 100644
  typedef int (*isc_sockfdwatch_t)(isc_task_t *, isc_socket_t *, void *, int);
  
 diff --git a/lib/isc/pk11.c b/lib/isc/pk11.c
-index 8e6ed93..ceb5a2c 100644
+index 68aebdc..4b85527 100644
 --- a/lib/isc/pk11.c
 +++ b/lib/isc/pk11.c
 @@ -321,14 +321,16 @@ pk11_rand_seed_fromfile(const char *randomfile) {
@@ -1999,10 +1999,10 @@ index 8e6ed93..ceb5a2c 100644
      cleanup:
  	if (stream != NULL)
 diff --git a/lib/isc/win32/include/isc/platform.h.in b/lib/isc/win32/include/isc/platform.h.in
-index 5b8a2c9..913a2ce 100644
+index 8ade705..fa72f9d 100644
 --- a/lib/isc/win32/include/isc/platform.h.in
 +++ b/lib/isc/win32/include/isc/platform.h.in
-@@ -69,6 +69,11 @@
+@@ -73,6 +73,11 @@
  #define ISC_PLATFORM_NORETURN_PRE __declspec(noreturn)
  #define ISC_PLATFORM_NORETURN_POST
  
@@ -2015,7 +2015,7 @@ index 5b8a2c9..913a2ce 100644
   * Define if the hash functions must be provided by OpenSSL.
   */
 diff --git a/win32utils/Configure b/win32utils/Configure
-index ccaf067..240fb80 100644
+index 953f2aa..55cc929 100644
 --- a/win32utils/Configure
 +++ b/win32utils/Configure
 @@ -382,6 +382,7 @@ my @substdefh = ("ALLOW_FILTER_AAAA",
@@ -2036,7 +2036,7 @@ index ccaf067..240fb80 100644
                    "fixed-rrset",
                    "intrinsics",
                    "isc-spnego",
-@@ -581,6 +583,7 @@ my @help = (
+@@ -580,6 +582,7 @@ my @help = (
  "\nOptional Features:\n",
  "  enable-intrinsics     enable instrinsic/atomic functions [default=yes]\n",
  "  enable-native-pkcs11  use native PKCS#11 for all crypto [default=no]\n",
@@ -2044,7 +2044,7 @@ index ccaf067..240fb80 100644
  "  enable-openssl-hash   use OpenSSL for hash functions [default=yes]\n",
  "  enable-isc-spnego     use SPNEGO from lib/dns [default=yes]\n",
  "  enable-filter-aaaa    enable filtering of AAAA records [default=yes]\n",
-@@ -630,7 +633,9 @@ my $want_clean = "no";
+@@ -628,7 +631,9 @@ my $want_clean = "no";
  my $want_unknown = "no";
  my $unknown_value;
  my $enable_intrinsics = "yes";
@@ -2054,7 +2054,7 @@ index ccaf067..240fb80 100644
  my $enable_openssl_hash = "auto";
  my $enable_filter_aaaa = "yes";
  my $enable_isc_spnego = "yes";
-@@ -850,6 +855,10 @@ sub myenable {
+@@ -847,6 +852,10 @@ sub myenable {
          if ($val =~ /^yes$/i) {
              $enable_native_pkcs11 = "yes";
          }
@@ -2065,7 +2065,7 @@ index ccaf067..240fb80 100644
      } elsif ($key =~ /^openssl-hash$/i) {
          if ($val =~ /^yes$/i) {
              $enable_openssl_hash = "yes";
-@@ -1158,6 +1167,11 @@ if ($verbose) {
+@@ -1153,6 +1162,11 @@ if ($verbose) {
      } else {
          print "native-pkcs11: disabled\n";
      }
@@ -2077,7 +2077,7 @@ index ccaf067..240fb80 100644
      if ($enable_openssl_hash eq "yes") {
          print "openssl-hash: enabled\n";
      } else {
-@@ -1516,6 +1530,7 @@ if ($enable_intrinsics eq "yes") {
+@@ -1510,6 +1524,7 @@ if ($enable_intrinsics eq "yes") {
  
  # enable-native-pkcs11
  if ($enable_native_pkcs11 eq "yes") {
@@ -2085,7 +2085,7 @@ index ccaf067..240fb80 100644
      if ($use_openssl eq "auto") {
          $use_openssl = "no";
      }
-@@ -1725,6 +1740,7 @@ if ($use_openssl eq "yes") {
+@@ -1719,6 +1734,7 @@ if ($use_openssl eq "yes") {
          $openssl_dll = File::Spec->catdir($openssl_path, "@dirlist[0]");
      }   
  
@@ -2093,7 +2093,7 @@ index ccaf067..240fb80 100644
      $configcond{"OPENSSL"} = 1;
      $configdefd{"CRYPTO"} = "OPENSSL";
      $configvar{"OPENSSL_PATH"} = "$openssl_path";
-@@ -2296,6 +2312,15 @@ if ($use_aes eq "yes") {
+@@ -2290,6 +2306,15 @@ if ($use_aes eq "yes") {
  }
  
  
@@ -2109,7 +2109,7 @@ index ccaf067..240fb80 100644
  # enable-openssl-hash
  if ($enable_openssl_hash eq "yes") {
      if ($use_openssl eq "no") {
-@@ -3671,6 +3696,7 @@ exit 0;
+@@ -3665,6 +3690,7 @@ exit 0;
  #  --enable-developer partially supported
  #  --enable-newstats (9.9/9.9sub only)
  #  --enable-native-pkcs11 supported
@@ -2118,5 +2118,5 @@ index ccaf067..240fb80 100644
  #  --enable-openssl-hash supported
  #  --enable-threads included without a way to disable it
 -- 
-2.20.1
+2.21.0
 
diff --git a/bind-9.11-serve-stale.patch b/bind-9.11-serve-stale.patch
index 350fe62..6baa4a7 100644
--- a/bind-9.11-serve-stale.patch
+++ b/bind-9.11-serve-stale.patch
@@ -1,4 +1,4 @@
-From 2bdcb7159b1ac097355e95864e979b4f68bc1a4e Mon Sep 17 00:00:00 2001
+From 3829de3d5caba113d5a8560c5ff0d2a32b57a7fc Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 7 Nov 2019 14:31:03 +0100
 Subject: [PATCH] Implement serve-stale in 9.11
@@ -389,22 +389,22 @@ index 9661f56..445b578 100644
  	bool root_key_sentinel_is_ta;
  	bool root_key_sentinel_not_ta;
 diff --git a/bin/named/include/named/server.h b/bin/named/include/named/server.h
-index 8982d26..919ac28 100644
+index c92922e..588bf2d 100644
 --- a/bin/named/include/named/server.h
 +++ b/bin/named/include/named/server.h
-@@ -224,7 +224,10 @@ enum {
+@@ -226,7 +226,10 @@ enum {
  
- 	dns_nsstatscounter_tcphighwater = 57,
+ 	dns_nsstatscounter_reclimitdropped = 58,
  
--	dns_nsstatscounter_max = 58
-+	dns_nsstatscounter_trystale = 58,
-+	dns_nsstatscounter_usedstale = 59,
+-	dns_nsstatscounter_max = 59
++	dns_nsstatscounter_trystale = 59,
++	dns_nsstatscounter_usedstale = 60,
 +
-+	dns_nsstatscounter_max = 60
++	dns_nsstatscounter_max = 61
  };
  
  /*%
-@@ -763,4 +766,12 @@ ns_server_mkeys(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text);
+@@ -765,4 +768,12 @@ ns_server_mkeys(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text);
  isc_result_t
  ns_server_dnstap(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text);
  
@@ -733,10 +733,10 @@ index 0940714..882d69c 100644
  	    (!PARTIALANSWER(client) || WANTRECURSION(client)
  	     || eresult == DNS_R_DROP)) {
 diff --git a/bin/named/server.c b/bin/named/server.c
-index 0c1f08b..d195bca 100644
+index 36e0227..73c2b47 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
-@@ -1722,7 +1722,8 @@ static bool
+@@ -1720,7 +1720,8 @@ static bool
  cache_sharable(dns_view_t *originview, dns_view_t *view,
  	       bool new_zero_no_soattl,
  	       unsigned int new_cleaning_interval,
@@ -746,7 +746,7 @@ index 0c1f08b..d195bca 100644
  {
  	/*
  	 * If the cache cannot even reused for the same view, it cannot be
-@@ -1737,6 +1738,7 @@ cache_sharable(dns_view_t *originview, dns_view_t *view,
+@@ -1735,6 +1736,7 @@ cache_sharable(dns_view_t *originview, dns_view_t *view,
  	 */
  	if (dns_cache_getcleaninginterval(originview->cache) !=
  	    new_cleaning_interval ||
@@ -754,7 +754,7 @@ index 0c1f08b..d195bca 100644
  	    dns_cache_getcachesize(originview->cache) != new_max_cache_size) {
  		return (false);
  	}
-@@ -3292,6 +3294,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
+@@ -3290,6 +3292,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
  	size_t max_acache_size;
  	size_t max_adb_size;
  	uint32_t lame_ttl, fail_ttl;
@@ -762,7 +762,7 @@ index 0c1f08b..d195bca 100644
  	dns_tsig_keyring_t *ring = NULL;
  	dns_view_t *pview = NULL;	/* Production view */
  	isc_mem_t *cmctx = NULL, *hmctx = NULL;
-@@ -3320,6 +3323,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
+@@ -3318,6 +3321,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
  	bool old_rpz_ok = false;
  	isc_dscp_t dscp4 = -1, dscp6 = -1;
  	dns_dyndbctx_t *dctx = NULL;
@@ -770,7 +770,7 @@ index 0c1f08b..d195bca 100644
  
  	REQUIRE(DNS_VIEW_VALID(view));
  
-@@ -3734,6 +3738,24 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
+@@ -3732,6 +3736,24 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
  	if (view->maxncachettl > 7 * 24 * 3600)
  		view->maxncachettl = 7 * 24 * 3600;
  
@@ -795,7 +795,7 @@ index 0c1f08b..d195bca 100644
  	/*
  	 * Configure the view's cache.
  	 *
-@@ -3767,7 +3789,8 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
+@@ -3765,7 +3787,8 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
  	nsc = cachelist_find(cachelist, cachename, view->rdclass);
  	if (nsc != NULL) {
  		if (!cache_sharable(nsc->primaryview, view, zero_no_soattl,
@@ -805,7 +805,7 @@ index 0c1f08b..d195bca 100644
  			isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
  				      NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
  				      "views %s and %s can't share the cache "
-@@ -3866,9 +3889,15 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
+@@ -3864,9 +3887,15 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
  
  	dns_cache_setcleaninginterval(cache, cleaning_interval);
  	dns_cache_setcachesize(cache, max_cache_size);
@@ -821,7 +821,7 @@ index 0c1f08b..d195bca 100644
  	/*
  	 * Resolver.
  	 *
-@@ -4057,6 +4086,21 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
+@@ -4055,6 +4084,21 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
  		maxbits = 4096;
  	view->maxbits = maxbits;
  
@@ -843,7 +843,7 @@ index 0c1f08b..d195bca 100644
  	/*
  	 * Set supported DNSSEC algorithms.
  	 */
-@@ -14423,3 +14467,132 @@ ns_server_dnstap(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text) {
+@@ -14434,3 +14478,132 @@ ns_server_dnstap(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text) {
  	return (ISC_R_NOTIMPLEMENTED);
  #endif
  }
@@ -977,13 +977,13 @@ index 0c1f08b..d195bca 100644
 +	return (result);
 +}
 diff --git a/bin/named/statschannel.c b/bin/named/statschannel.c
-index 4cdf7d6..5b413e7 100644
+index 6292bcb..fb034a7 100644
 --- a/bin/named/statschannel.c
 +++ b/bin/named/statschannel.c
-@@ -297,6 +297,12 @@ init_desc(void) {
- 		"QryNXRedirRLookup");
- 	SET_NSSTATDESC(badcookie, "sent badcookie response", "QryBADCOOKIE");
- 	SET_NSSTATDESC(keytagopt, "Keytag option received", "KeyTagOpt");
+@@ -300,6 +300,12 @@ init_desc(void) {
+ 	SET_NSSTATDESC(reclimitdropped,
+ 		       "queries dropped due to recursive client limit",
+ 		       "RecLimitDropped");
 +	SET_NSSTATDESC(trystale,
 +		       "attempts to use stale cache data after lookup failure",
 +		       "QryTryStale");
@@ -1052,10 +1052,10 @@ index f3f1939..9ff3f07 100644
 +    exit 1
 +fi
 diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
-index f781966..d20a830 100644
+index 1e5f221..96ee63e 100644
 --- a/bin/tests/system/conf.sh.in
 +++ b/bin/tests/system/conf.sh.in
-@@ -125,7 +125,7 @@ PARALLELDIRS="dnssec rpzrecurse \
+@@ -128,7 +128,7 @@ PARALLELDIRS="dnssec rpzrecurse \
  	reclimit redirect resolver rndc rootkeysentinel rpz \
  	rrchecker rrl rrsetorder rsabigexponent runtime \
  	sfcache smartsign sortlist \
@@ -2278,7 +2278,7 @@ index e11beed..fde93c7 100644
          topology { <address_match_element>; ... }; // not implemented
          transfer-format ( many-answers | one-answer );
 diff --git a/lib/bind9/check.c b/lib/bind9/check.c
-index 5c057a4..7b82618 100644
+index bd16aec..91cedb7 100644
 --- a/lib/bind9/check.c
 +++ b/lib/bind9/check.c
 @@ -99,7 +99,8 @@ check_orderent(const cfg_obj_t *ent, isc_log_t *logctx) {
@@ -2379,7 +2379,7 @@ index 5c057a4..7b82618 100644
  			}
  		}
  	}
-@@ -1267,7 +1276,8 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
+@@ -1271,7 +1280,8 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
  			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
  				    "auto-dnssec may only be activated at the "
  				    "zone level");
@@ -2389,7 +2389,7 @@ index 5c057a4..7b82618 100644
  		}
  	}
  
-@@ -1287,7 +1297,7 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
+@@ -1291,7 +1301,7 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
  		{
  			obj = cfg_listelt_value(element);
  			tresult = mustbesecure(obj, symtab, logctx, mctx);
@@ -2398,7 +2398,7 @@ index 5c057a4..7b82618 100644
  				result = tresult;
  		}
  		if (symtab != NULL)
-@@ -1306,7 +1316,8 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
+@@ -1310,7 +1320,8 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
  				cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
  					    "%s: invalid name '%s'",
  					    server_contact[i], str);
@@ -2408,7 +2408,7 @@ index 5c057a4..7b82618 100644
  			}
  		}
  	}
-@@ -1326,7 +1337,8 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
+@@ -1330,7 +1341,8 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
  			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
  				    "disable-empty-zone: invalid name '%s'",
  				    str);
@@ -2418,7 +2418,7 @@ index 5c057a4..7b82618 100644
  		}
  	}
  
-@@ -1340,11 +1352,12 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
+@@ -1344,11 +1356,12 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
  	    strlen(cfg_obj_asstring(obj)) > 1024U) {
  		cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
  			    "'server-id' too big (>1024 bytes)");
@@ -2433,7 +2433,7 @@ index 5c057a4..7b82618 100644
  		result = tresult;
  
  	obj = NULL;
-@@ -1354,11 +1367,13 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
+@@ -1358,11 +1371,13 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
  		if (lifetime > 604800) {	/* 7 days */
  			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
  				    "'nta-lifetime' cannot exceed one week");
@@ -2449,7 +2449,7 @@ index 5c057a4..7b82618 100644
  		}
  	}
  
-@@ -1369,7 +1384,8 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
+@@ -1373,7 +1388,8 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
  		if (recheck > 604800) {		/* 7 days */
  			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
  				    "'nta-recheck' cannot exceed one week");
@@ -2459,7 +2459,7 @@ index 5c057a4..7b82618 100644
  		}
  
  		if (recheck > lifetime)
-@@ -1387,7 +1403,8 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
+@@ -1391,7 +1407,8 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
  	if (strcasecmp(ccalg, "aes") == 0) {
  		cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
  			    "cookie-algorithm: '%s' not supported", ccalg);
@@ -2469,7 +2469,7 @@ index 5c057a4..7b82618 100644
  	}
  #endif
  
-@@ -1476,7 +1493,8 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
+@@ -1480,7 +1497,8 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
  				cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
  					    "%s out of range (%u < %u)",
  					    fstrm[i].name, value, fstrm[i].min);
@@ -2479,7 +2479,7 @@ index 5c057a4..7b82618 100644
  		}
  
  		if (strcmp(fstrm[i].name, "fstrm-set-input-queue-size") == 0) {
-@@ -1490,7 +1508,8 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
+@@ -1494,7 +1512,8 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
  					    "%s '%u' not a power-of-2",
  					    fstrm[i].name,
  					    cfg_obj_asuint32(obj));
@@ -2489,7 +2489,7 @@ index 5c057a4..7b82618 100644
  			}
  		}
  	}
-@@ -1508,7 +1527,8 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
+@@ -1512,7 +1531,8 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
  				    "%" PRId64 "' "
  				    "is too small",
  				    mapsize);
@@ -2499,7 +2499,7 @@ index 5c057a4..7b82618 100644
  		} else if (mapsize > (1ULL << 40)) { /* 1 terabyte */
  			cfg_obj_log(obj, logctx,
  				    ISC_LOG_ERROR,
-@@ -1516,10 +1536,20 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
+@@ -1520,10 +1540,20 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
  				    "%" PRId64 "' "
  				    "is too large",
  				    mapsize);
@@ -2979,7 +2979,7 @@ index 13d1a3e..873b694 100644
  			RUNTIME_CHECK(result == ISC_R_SUCCESS);
  			isc_buffer_usedregion(&buffer, &r);
 diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
-index 738aa20..5055fcb 100644
+index 68e6a89..d8b5c60 100644
 --- a/lib/dns/rbtdb.c
 +++ b/lib/dns/rbtdb.c
 @@ -488,6 +488,7 @@ typedef ISC_LIST(rdatasetheader_t)      rdatasetheaderlist_t;
@@ -3074,7 +3074,7 @@ index 738aa20..5055fcb 100644
  			if (top_prev != NULL)
  				top_prev->next = current->next;
  			else
-@@ -2076,6 +2095,80 @@ delete_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node) {
+@@ -2079,6 +2098,80 @@ delete_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node) {
  	}
  }
  
@@ -3155,7 +3155,7 @@ index 738aa20..5055fcb 100644
  /*
   * Caller must be holding the node lock.
   */
-@@ -3308,6 +3401,12 @@ bind_rdataset(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
+@@ -3316,6 +3409,12 @@ bind_rdataset(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
  		rdataset->attributes |= DNS_RDATASETATTR_OPTOUT;
  	if (PREFETCH(header))
  		rdataset->attributes |= DNS_RDATASETATTR_PREFETCH;
@@ -3168,7 +3168,7 @@ index 738aa20..5055fcb 100644
  	rdataset->private1 = rbtdb;
  	rdataset->private2 = node;
  	raw = (unsigned char *)header + sizeof(*header);
-@@ -4648,6 +4747,19 @@ check_stale_header(dns_rbtnode_t *node, rdatasetheader_t *header,
+@@ -4656,6 +4755,19 @@ check_stale_header(dns_rbtnode_t *node, rdatasetheader_t *header,
  #endif
  
  	if (!ACTIVE(header, search->now)) {
@@ -3188,7 +3188,7 @@ index 738aa20..5055fcb 100644
  		/*
  		 * This rdataset is stale.  If no one else is using the
  		 * node, we can clean it up right now, otherwise we mark
-@@ -4687,7 +4799,7 @@ check_stale_header(dns_rbtnode_t *node, rdatasetheader_t *header,
+@@ -4695,7 +4807,7 @@ check_stale_header(dns_rbtnode_t *node, rdatasetheader_t *header,
  					node->data = header->next;
  				free_rdataset(search->rbtdb, mctx, header);
  			} else {
@@ -3197,7 +3197,7 @@ index 738aa20..5055fcb 100644
  				*header_prev = header;
  			}
  		} else
-@@ -5125,7 +5237,7 @@ cache_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
+@@ -5133,7 +5245,7 @@ cache_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
  				       &locktype, lock, &search,
  				       &header_prev)) {
  			/* Do nothing. */
@@ -3206,7 +3206,7 @@ index 738aa20..5055fcb 100644
  			/*
  			 * We now know that there is at least one active
  			 * non-stale rdataset at this node.
-@@ -5603,7 +5715,7 @@ expirenode(dns_db_t *db, dns_dbnode_t *node, isc_stdtime_t now) {
+@@ -5611,7 +5723,7 @@ expirenode(dns_db_t *db, dns_dbnode_t *node, isc_stdtime_t now) {
  			 * refcurrent(rbtnode) must be non-zero.  This is so
  			 * because 'node' is an argument to the function.
  			 */
@@ -3215,7 +3215,7 @@ index 738aa20..5055fcb 100644
  			if (log)
  				isc_log_write(dns_lctx, category, module,
  					      level, "overmem cache: stale %s",
-@@ -5611,7 +5723,7 @@ expirenode(dns_db_t *db, dns_dbnode_t *node, isc_stdtime_t now) {
+@@ -5619,7 +5731,7 @@ expirenode(dns_db_t *db, dns_dbnode_t *node, isc_stdtime_t now) {
  		} else if (force_expire) {
  			if (! RETAIN(header)) {
  				set_ttl(rbtdb, header, 0);
@@ -3224,7 +3224,7 @@ index 738aa20..5055fcb 100644
  			} else if (log) {
  				isc_log_write(dns_lctx, category, module,
  					      level, "overmem cache: "
-@@ -5868,9 +5980,9 @@ cache_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
+@@ -5876,9 +5988,9 @@ cache_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
  				 * non-zero.  This is so because 'node' is an
  				 * argument to the function.
  				 */
@@ -3236,7 +3236,7 @@ index 738aa20..5055fcb 100644
  			if (header->type == matchtype)
  				found = header;
  			else if (header->type == RBTDB_RDATATYPE_NCACHEANY ||
-@@ -6160,7 +6272,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+@@ -6170,7 +6282,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
  				     topheader = topheader->next)
  				{
  					set_ttl(rbtdb, topheader, 0);
@@ -3245,7 +3245,7 @@ index 738aa20..5055fcb 100644
  				}
  				goto find_header;
  			}
-@@ -6218,7 +6330,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+@@ -6228,7 +6340,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
  				 * ncache entry.
  				 */
  				set_ttl(rbtdb, topheader, 0);
@@ -3254,7 +3254,7 @@ index 738aa20..5055fcb 100644
  				topheader = NULL;
  				goto find_header;
  			}
-@@ -6256,8 +6368,11 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+@@ -6266,8 +6378,11 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
  		}
  
  		/*
@@ -3268,7 +3268,7 @@ index 738aa20..5055fcb 100644
  		 */
  		if (rbtversion == NULL && trust < header->trust &&
  		    (ACTIVE(header, now) || header_nx)) {
-@@ -6286,6 +6401,10 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+@@ -6296,6 +6411,10 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
  
  			if ((options & DNS_DBADD_EXACT) != 0)
  				flags |= DNS_RDATASLAB_EXACT;
@@ -3279,7 +3279,7 @@ index 738aa20..5055fcb 100644
  			if ((options & DNS_DBADD_EXACTTTL) != 0 &&
  			     newheader->rdh_ttl != header->rdh_ttl)
  					result = DNS_R_NOTEXACT;
-@@ -6329,11 +6448,12 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+@@ -6339,11 +6458,12 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
  			}
  		}
  		/*
@@ -3297,7 +3297,7 @@ index 738aa20..5055fcb 100644
  		 */
  		if (IS_CACHE(rbtdb) && ACTIVE(header, now) &&
  		    header->type == dns_rdatatype_ns &&
-@@ -6508,10 +6628,10 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+@@ -6514,10 +6634,10 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
  				changed->dirty = true;
  			if (rbtversion == NULL) {
  				set_ttl(rbtdb, header, 0);
@@ -3310,7 +3310,7 @@ index 738aa20..5055fcb 100644
  				}
  			}
  			if (rbtversion != NULL && !header_nx) {
-@@ -8310,6 +8430,30 @@ nodefullname(dns_db_t *db, dns_dbnode_t *node, dns_name_t *name) {
+@@ -8334,6 +8454,30 @@ nodefullname(dns_db_t *db, dns_dbnode_t *node, dns_name_t *name) {
  	return (result);
  }
  
@@ -3341,7 +3341,7 @@ index 738aa20..5055fcb 100644
  static dns_dbmethods_t zone_methods = {
  	attach,
  	detach,
-@@ -8355,7 +8499,9 @@ static dns_dbmethods_t zone_methods = {
+@@ -8379,7 +8523,9 @@ static dns_dbmethods_t zone_methods = {
  	NULL,
  	hashsize,
  	nodefullname,
@@ -3352,7 +3352,7 @@ index 738aa20..5055fcb 100644
  };
  
  static dns_dbmethods_t cache_methods = {
-@@ -8403,7 +8549,9 @@ static dns_dbmethods_t cache_methods = {
+@@ -8427,7 +8573,9 @@ static dns_dbmethods_t cache_methods = {
  	setcachestats,
  	hashsize,
  	nodefullname,
@@ -3363,7 +3363,7 @@ index 738aa20..5055fcb 100644
  };
  
  isc_result_t
-@@ -8674,7 +8822,7 @@ dns_rbtdb_create
+@@ -8698,7 +8846,7 @@ dns_rbtdb_create
  	rbtdb->rpzs = NULL;
  	rbtdb->load_rpzs = NULL;
  	rbtdb->rpz_num = DNS_RPZ_INVALID_NUM;
@@ -3372,7 +3372,7 @@ index 738aa20..5055fcb 100644
  	/*
  	 * Version Initialization.
  	 */
-@@ -9092,7 +9240,8 @@ rdatasetiter_first(dns_rdatasetiter_t *iterator) {
+@@ -9116,7 +9264,8 @@ rdatasetiter_first(dns_rdatasetiter_t *iterator) {
  				 * rdatasets to work.
  				 */
  				if (NONEXISTENT(header) ||
@@ -3382,7 +3382,7 @@ index 738aa20..5055fcb 100644
  					header = NULL;
  				break;
  			} else
-@@ -10280,7 +10429,7 @@ static inline bool
+@@ -10325,7 +10474,7 @@ static inline bool
  need_headerupdate(rdatasetheader_t *header, isc_stdtime_t now) {
  	if ((header->attributes &
  	     (RDATASET_ATTR_NONEXISTENT |
@@ -3391,7 +3391,7 @@ index 738aa20..5055fcb 100644
  	      RDATASET_ATTR_ZEROTTL)) != 0)
  		return (false);
  
-@@ -10386,7 +10535,7 @@ expire_header(dns_rbtdb_t *rbtdb, rdatasetheader_t *header,
+@@ -10431,7 +10580,7 @@ expire_header(dns_rbtdb_t *rbtdb, rdatasetheader_t *header,
  	      bool tree_locked, expire_t reason)
  {
  	set_ttl(rbtdb, header, 0);
@@ -3401,7 +3401,7 @@ index 738aa20..5055fcb 100644
  	/*
  	 * Caller must hold the node (write) lock.
 diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
-index 04a58c0..164fc01 100644
+index 8db9845..9f65c05 100644
 --- a/lib/dns/resolver.c
 +++ b/lib/dns/resolver.c
 @@ -141,16 +141,17 @@
@@ -3434,7 +3434,7 @@ index 04a58c0..164fc01 100644
  #endif
  
  /* The default maximum number of recursions to follow before giving up. */
-@@ -496,6 +497,10 @@ struct dns_resolver {
+@@ -497,6 +498,10 @@ struct dns_resolver {
  	unsigned int			maxqueries;
  	isc_result_t			quotaresp[2];
  
@@ -3445,7 +3445,7 @@ index 04a58c0..164fc01 100644
  	/* Locked by lock. */
  	unsigned int			references;
  	bool			exiting;
-@@ -1617,14 +1622,12 @@ fctx_setretryinterval(fetchctx_t *fctx, unsigned int rtt) {
+@@ -1620,14 +1625,12 @@ fctx_setretryinterval(fetchctx_t *fctx, unsigned int rtt) {
  	unsigned int seconds;
  	unsigned int us;
  
@@ -3464,7 +3464,7 @@ index 04a58c0..164fc01 100644
  
  	/*
  	 * Add a fudge factor to the expected rtt based on the current
-@@ -4481,7 +4484,8 @@ fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type,
+@@ -4489,7 +4492,8 @@ fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type,
  	/*
  	 * Compute an expiration time for the entire fetch.
  	 */
@@ -3474,7 +3474,7 @@ index 04a58c0..164fc01 100644
  	iresult = isc_time_nowplusinterval(&fctx->expires, &interval);
  	if (iresult != ISC_R_SUCCESS) {
  		UNEXPECTED_ERROR(__FILE__, __LINE__,
-@@ -8965,6 +8969,8 @@ dns_resolver_create(dns_view_t *view,
+@@ -8977,6 +8981,8 @@ dns_resolver_create(dns_view_t *view,
  	res->spillattimer = NULL;
  	res->zspill = 0;
  	res->zero_no_soa_ttl = false;
@@ -3483,7 +3483,7 @@ index 04a58c0..164fc01 100644
  	res->query_timeout = DEFAULT_QUERY_TIMEOUT;
  	res->maxdepth = DEFAULT_RECURSION_DEPTH;
  	res->maxqueries = DEFAULT_MAX_QUERIES;
-@@ -10291,17 +10297,20 @@ dns_resolver_gettimeout(dns_resolver_t *resolver) {
+@@ -10304,17 +10310,20 @@ dns_resolver_gettimeout(dns_resolver_t *resolver) {
  }
  
  void
@@ -3512,7 +3512,7 @@ index 04a58c0..164fc01 100644
  }
  
  void
-@@ -10398,3 +10407,34 @@ dns_resolver_getquotaresponse(dns_resolver_t *resolver, dns_quotatype_t which)
+@@ -10411,3 +10420,34 @@ dns_resolver_getquotaresponse(dns_resolver_t *resolver, dns_quotatype_t which)
  
  	return (resolver->quotaresp[which]);
  }
@@ -3854,5 +3854,5 @@ index 7bad989..bbf4b45 100644
  	{ "topology", &cfg_type_bracketed_aml, CFG_CLAUSEFLAG_NOTIMP },
  	{ "transfer-format", &cfg_type_transferformat, 0 },
 -- 
-2.20.1
+2.21.0
 
diff --git a/bind.spec b/bind.spec
index e076859..a88c81a 100644
--- a/bind.spec
+++ b/bind.spec
@@ -63,8 +63,8 @@
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.11.13
-Release:  4%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Version:  9.11.14
+Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -164,10 +164,6 @@ Patch175:bind-9.11-fips-disable.patch
 Patch177: bind-9.11-serve-stale.patch
 Patch178: bind-9.11-serve-stale-dbfix.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=1736762
-Patch179: bind-9.11-rh1736762-1.patch
-Patch180: bind-9.11-rh1736762-2.patch
-Patch181: bind-9.11-rh1736762-3.patch
-Patch182: bind-9.11-rh1736762-4.patch
 Patch183: bind-9.11-rh1736762-5.patch
 
 # SDB patches
@@ -574,10 +570,6 @@ are used for building ISC DHCP.
 %patch175 -p1 -b .rh1709553
 %patch177 -p1 -b .serve-stale
 %patch178 -p1 -b .rh1770492
-%patch179 -p1 -b .rh1736762-1
-%patch180 -p1 -b .rh1736762-2
-%patch181 -p1 -b .rh1736762-3
-%patch182 -p1 -b .rh1736762-4
 %patch183 -p1 -b .rh1736762-5
 
 mkdir lib/dns/tests/testdata/dstrandom
@@ -1615,6 +1607,9 @@ fi;
 
 
 %changelog
+* Thu Dec 19 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.14-1
+- Update to 9.11.14
+
 * Tue Dec 03 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.13-4
 - Disable Berkeley DB support (#1779190)
 
diff --git a/sources b/sources
index d213c25..d7c9b81 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.11.13.tar.gz) = 6e5289ff231b8d7d2f02ae02a1cf43abff3e507e1d96d8ec002dc71097fc77dc5514762ff1ea5918159c88319b1d5eed78c6dc1a7835173db234d4ee887644bc
-SHA512 (bind-9.11.13.tar.gz.asc) = 5b32adee7d45cdd2921126e898824839f6a0a5574c0ae5a441fc7df78681ebf872a276d6e434e8043cf9ec504f57c2b8fdf79fdb141e32dac5c4fa57c18d52f4
+SHA512 (bind-9.11.14.tar.gz) = fc7729e780e44c3c4e50059032fdae2af3d0e07b492b5088b2fefc15354829d3c9a83fab4f2ecaa9323cd7a37b1f7eb94890c149ba1df5c4fbea7a145095cbe9
+SHA512 (bind-9.11.14.tar.gz.asc) = fd28a1ebd4adf8c2854de434cc6f5f4d47d982eaad73fbb42dce8df97f7b069feb6e7c374178e203a07fff83f2cd021dfd10fb77dd6e8c5201ee4d299df98b89

From 43f4de9bf31f591bdf5bf9acd4f68c2978cd2800 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 19 Dec 2019 19:20:36 +0100
Subject: [PATCH 102/460] Include more Thread Sanitizer changes

Fix as much race conditions as possible.
---
 bind-9.11-rh1736762-6.patch | 159 ++++++++++++++++++++++++++++++++++++
 bind-9.11-rh1736762-7.patch |  77 +++++++++++++++++
 bind-9.11-rh1736762-8.patch |  38 +++++++++
 bind.spec                   |  11 ++-
 4 files changed, 284 insertions(+), 1 deletion(-)
 create mode 100644 bind-9.11-rh1736762-6.patch
 create mode 100644 bind-9.11-rh1736762-7.patch
 create mode 100644 bind-9.11-rh1736762-8.patch

diff --git a/bind-9.11-rh1736762-6.patch b/bind-9.11-rh1736762-6.patch
new file mode 100644
index 0000000..abc36f0
--- /dev/null
+++ b/bind-9.11-rh1736762-6.patch
@@ -0,0 +1,159 @@
+From 638561615c37e8eace986e268811335c12d1b6a1 Mon Sep 17 00:00:00 2001
+From: Mark Andrews <marka@isc.org>
+Date: Thu, 12 Dec 2019 20:41:44 +1100
+Subject: [PATCH] give zspill its own lock
+
+(cherry picked from commit a52189e8e67a20097539fe3e6f7da4e4c01dc340)
+---
+ lib/dns/resolver.c | 45 +++++++++++++++++++++++++++++----------------
+ 1 file changed, 29 insertions(+), 16 deletions(-)
+
+diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
+index 9f65c0596a..04367f82c6 100644
+--- a/lib/dns/resolver.c
++++ b/lib/dns/resolver.c
+@@ -460,20 +460,21 @@ struct dns_resolver {
+ 	isc_mutex_t			lock;
+ 	isc_mutex_t			nlock;
+ 	isc_mutex_t			primelock;
++	isc_mutex_t			zspill_lock;
+ 	dns_rdataclass_t		rdclass;
+ 	isc_socketmgr_t *		socketmgr;
+ 	isc_timermgr_t *		timermgr;
+ 	isc_taskmgr_t *			taskmgr;
+ 	dns_view_t *			view;
+-	bool			frozen;
++	bool				frozen;
+ 	unsigned int			options;
+ 	dns_dispatchmgr_t *		dispatchmgr;
+ 	dns_dispatchset_t *		dispatches4;
+-	bool			exclusivev4;
++	bool				exclusivev4;
+ 	dns_dispatchset_t *		dispatches6;
+ 	isc_dscp_t			querydscp4;
+ 	isc_dscp_t			querydscp6;
+-	bool			exclusivev6;
++	bool				exclusivev6;
+ 	unsigned int			nbuckets;
+ 	fctxbucket_t *			buckets;
+ 	zonebucket_t *			dbuckets;
+@@ -492,7 +493,7 @@ struct dns_resolver {
+ 	unsigned int			spillatmax;
+ 	unsigned int			spillatmin;
+ 	isc_timer_t *			spillattimer;
+-	bool			zero_no_soa_ttl;
++	bool				zero_no_soa_ttl;
+ 	unsigned int			query_timeout;
+ 	unsigned int			maxdepth;
+ 	unsigned int			maxqueries;
+@@ -502,14 +503,16 @@ struct dns_resolver {
+ 	unsigned int			retryinterval; /* in milliseconds */
+ 	unsigned int			nonbackofftries;
+ 
++	/* Locked by lock. */
++	unsigned int			zspill;		/* fetches-per-zone */
++
+ 	/* Locked by lock. */
+ 	unsigned int			references;
+-	bool			exiting;
++	bool				exiting;
+ 	isc_eventlist_t			whenshutdown;
+ 	unsigned int			activebuckets;
+-	bool			priming;
++	bool				priming;
+ 	unsigned int			spillat;	/* clients-per-query */
+-	unsigned int			zspill;		/* fetches-per-zone */
+ 
+ 	dns_badcache_t  * 		badcache;	 /* Bad cache. */
+ 
+@@ -1257,7 +1260,7 @@ fcount_incr(fetchctx_t *fctx, bool force) {
+ 	isc_result_t result = ISC_R_SUCCESS;
+ 	zonebucket_t *dbucket;
+ 	fctxcount_t *counter;
+-	unsigned int bucketnum, spill;
++	unsigned int bucketnum;
+ 
+ 	REQUIRE(fctx != NULL);
+ 	REQUIRE(fctx->res != NULL);
+@@ -1266,10 +1269,6 @@ fcount_incr(fetchctx_t *fctx, bool force) {
+ 	bucketnum = dns_name_fullhash(&fctx->domain, false)
+ 			% RES_DOMAIN_BUCKETS;
+ 
+-	LOCK(&fctx->res->lock);
+-	spill = fctx->res->zspill;
+-	UNLOCK(&fctx->res->lock);
+-
+ 	dbucket = &fctx->res->dbuckets[bucketnum];
+ 
+ 	LOCK(&dbucket->lock);
+@@ -1297,6 +1296,12 @@ fcount_incr(fetchctx_t *fctx, bool force) {
+ 			ISC_LIST_APPEND(dbucket->list, counter, link);
+ 		}
+ 	} else {
++		unsigned int spill;
++
++		LOCK(&fctx->res->zspill_lock);
++		spill = fctx->res->zspill;
++		UNLOCK(&fctx->res->zspill_lock);
++
+ 		if (!force && spill != 0 && counter->count >= spill) {
+ 			counter->dropped++;
+ 			fcount_logspill(fctx, counter);
+@@ -8811,6 +8816,7 @@ destroy(dns_resolver_t *res) {
+ 
+ 	INSIST(res->nfctx == 0);
+ 
++	DESTROYLOCK(&res->zspill_lock);
+ 	DESTROYLOCK(&res->primelock);
+ 	DESTROYLOCK(&res->nlock);
+ 	DESTROYLOCK(&res->lock);
+@@ -9089,10 +9095,14 @@ dns_resolver_create(dns_view_t *view,
+ 	if (result != ISC_R_SUCCESS)
+ 		goto cleanup_nlock;
+ 
++	result = isc_mutex_init(&res->zspill_lock);
++	if (result != ISC_R_SUCCESS)
++		goto cleanup_primelock;
++
+ 	task = NULL;
+ 	result = isc_task_create(taskmgr, 0, &task);
+ 	if (result != ISC_R_SUCCESS)
+-		goto cleanup_primelock;
++		goto cleanup_zspill_lock;
+ 	isc_task_setname(task, "resolver_task", NULL);
+ 
+ 	result = isc_timer_create(timermgr, isc_timertype_inactive, NULL, NULL,
+@@ -9100,7 +9110,7 @@ dns_resolver_create(dns_view_t *view,
+ 				  &res->spillattimer);
+ 	isc_task_detach(&task);
+ 	if (result != ISC_R_SUCCESS)
+-		goto cleanup_primelock;
++		goto cleanup_zspill_lock;
+ 
+ #if USE_ALGLOCK
+ 	result = isc_rwlock_init(&res->alglock, 0, 0);
+@@ -9133,6 +9143,9 @@ dns_resolver_create(dns_view_t *view,
+ 	isc_timer_detach(&res->spillattimer);
+ #endif
+ 
++ cleanup_zspill_lock:
++	DESTROYLOCK(&res->zspill_lock);
++
+  cleanup_primelock:
+ 	DESTROYLOCK(&res->primelock);
+ 
+@@ -10275,9 +10288,9 @@ dns_resolver_setfetchesperzone(dns_resolver_t *resolver, uint32_t clients)
+ {
+ 	REQUIRE(VALID_RESOLVER(resolver));
+ 
+-	LOCK(&resolver->lock);
++	LOCK(&resolver->zspill_lock);
+ 	resolver->zspill = clients;
+-	UNLOCK(&resolver->lock);
++	UNLOCK(&resolver->zspill_lock);
+ }
+ 
+ 
+-- 
+2.21.0
+
diff --git a/bind-9.11-rh1736762-7.patch b/bind-9.11-rh1736762-7.patch
new file mode 100644
index 0000000..38617a2
--- /dev/null
+++ b/bind-9.11-rh1736762-7.patch
@@ -0,0 +1,77 @@
+From 23a6775f62deeee63e9f7927be387fecf23a8074 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
+Date: Tue, 10 Dec 2019 10:02:09 +0100
+Subject: [PATCH] Ensure all zone_settimer() calls are done on locked zone
+
+(cherry picked from commit cf48e8eb326f824170f2069e5d5c33992b1783a4)
+(cherry picked from commit 3bac7e98074643ff62582545e5840e4195517b07)
+---
+ lib/dns/zone.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/lib/dns/zone.c b/lib/dns/zone.c
+index e8cff77588..db837aae50 100644
+--- a/lib/dns/zone.c
++++ b/lib/dns/zone.c
+@@ -10291,7 +10291,9 @@ zone_maintenance(dns_zone_t *zone) {
+ 	default:
+ 		break;
+ 	}
++	LOCK_ZONE(zone);
+ 	zone_settimer(zone, &now);
++	UNLOCK_ZONE(zone);
+ }
+ 
+ void
+@@ -13081,6 +13083,7 @@ zone_settimer(dns_zone_t *zone, isc_time_t *now) {
+ 	isc_result_t result;
+ 
+ 	REQUIRE(DNS_ZONE_VALID(zone));
++	REQUIRE(LOCKED_ZONE(zone));
+ 	ENTER;
+ 
+ 	if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_EXITING))
+@@ -18405,6 +18408,7 @@ zone_rekey(dns_zone_t *zone) {
+ 		UNLOCK_ZONE(zone);
+ 	}
+ 
++	LOCK_ZONE(zone);
+ 	isc_time_settoepoch(&zone->refreshkeytime);
+ 
+ 	/*
+@@ -18416,11 +18420,9 @@ zone_rekey(dns_zone_t *zone) {
+ 		isc_time_t timethen;
+ 		isc_stdtime_t then;
+ 
+-		LOCK_ZONE(zone);
+ 		DNS_ZONE_TIME_ADD(&timenow, zone->refreshkeyinterval,
+ 				  &timethen);
+ 		zone->refreshkeytime = timethen;
+-		UNLOCK_ZONE(zone);
+ 
+ 		for (key = ISC_LIST_HEAD(dnskeys);
+ 		     key != NULL;
+@@ -18431,12 +18433,10 @@ zone_rekey(dns_zone_t *zone) {
+ 				continue;
+ 
+ 			DNS_ZONE_TIME_ADD(&timenow, then - now, &timethen);
+-			LOCK_ZONE(zone);
+ 			if (isc_time_compare(&timethen,
+ 					     &zone->refreshkeytime) < 0) {
+ 				zone->refreshkeytime = timethen;
+ 			}
+-			UNLOCK_ZONE(zone);
+ 		}
+ 
+ 		zone_settimer(zone, &timenow);
+@@ -18444,6 +18444,7 @@ zone_rekey(dns_zone_t *zone) {
+ 		isc_time_formattimestamp(&zone->refreshkeytime, timebuf, 80);
+ 		dns_zone_log(zone, ISC_LOG_INFO, "next key event: %s", timebuf);
+ 	}
++	UNLOCK_ZONE(zone);
+ 
+  done:
+ 	dns_diff_clear(&diff);
+-- 
+2.21.0
+
diff --git a/bind-9.11-rh1736762-8.patch b/bind-9.11-rh1736762-8.patch
new file mode 100644
index 0000000..f04a98a
--- /dev/null
+++ b/bind-9.11-rh1736762-8.patch
@@ -0,0 +1,38 @@
+From 7e844b093b0442bdc5cdc5aefd56fdc05f9be88f Mon Sep 17 00:00:00 2001
+From: Mark Andrews <marka@isc.org>
+Date: Thu, 12 Dec 2019 19:17:39 +1100
+Subject: [PATCH] acquire task lock before calling push_readyq for task->flags
+ access
+
+(cherry picked from commit 7c94d2cd7dfaa3f04cd86ad9ed97e8366a774a4c)
+---
+ lib/isc/task.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/lib/isc/task.c b/lib/isc/task.c
+index 329604a465..f9c4354bd2 100644
+--- a/lib/isc/task.c
++++ b/lib/isc/task.c
+@@ -473,7 +473,9 @@ task_ready(isc__task_t *task) {
+ 	XTRACE("task_ready");
+ 
+ 	LOCK(&manager->lock);
++	LOCK(&task->lock);
+ 	push_readyq(manager, task);
++	UNLOCK(&task->lock);
+ #ifdef USE_WORKER_THREADS
+ 	if (manager->mode == isc_taskmgrmode_normal || has_privilege)
+ 		SIGNAL(&manager->work_available);
+@@ -1263,7 +1265,9 @@ dispatch(isc__taskmgr_t *manager) {
+ 				 * might even hurt rather than help.
+ 				 */
+ #ifdef USE_WORKER_THREADS
++				LOCK(&task->lock);
+ 				push_readyq(manager, task);
++				UNLOCK(&task->lock);
+ #else
+ 				ENQUEUE(new_ready_tasks, task, ready_link);
+ 				if ((task->flags & TASK_F_PRIVILEGED) != 0)
+-- 
+2.21.0
+
diff --git a/bind.spec b/bind.spec
index a88c81a..23cf476 100644
--- a/bind.spec
+++ b/bind.spec
@@ -64,7 +64,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.11.14
-Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -165,6 +165,9 @@ Patch177: bind-9.11-serve-stale.patch
 Patch178: bind-9.11-serve-stale-dbfix.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=1736762
 Patch183: bind-9.11-rh1736762-5.patch
+Patch184: bind-9.11-rh1736762-6.patch
+Patch185: bind-9.11-rh1736762-7.patch
+Patch186: bind-9.11-rh1736762-8.patch
 
 # SDB patches
 Patch11: bind-9.3.2b2-sdbsrc.patch
@@ -571,6 +574,9 @@ are used for building ISC DHCP.
 %patch177 -p1 -b .serve-stale
 %patch178 -p1 -b .rh1770492
 %patch183 -p1 -b .rh1736762-5
+%patch184 -p1 -b .rh1736762-6
+%patch185 -p1 -b .rh1736762-7
+%patch186 -p1 -b .rh1736762-8
 
 mkdir lib/dns/tests/testdata/dstrandom
 cp -a %{SOURCE50} lib/dns/tests/testdata/dstrandom/random.data
@@ -1607,6 +1613,9 @@ fi;
 
 
 %changelog
+* Thu Dec 19 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.14-2
+- Include more Thread Sanitizer detected changes (#1736762)
+
 * Thu Dec 19 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.14-1
 - Update to 9.11.14
 

From b4802c2e65106fed10ceb523d945bb81fe165627 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 19 Dec 2019 19:39:39 +0100
Subject: [PATCH 103/460] Fix oot build

gen would not compile under oot build
---
 bind-9.11-oot-gen.patch | 47 +++++++++++++++++++++++++++++++++++++++++
 bind.spec               |  2 ++
 2 files changed, 49 insertions(+)
 create mode 100644 bind-9.11-oot-gen.patch

diff --git a/bind-9.11-oot-gen.patch b/bind-9.11-oot-gen.patch
new file mode 100644
index 0000000..9a7f991
--- /dev/null
+++ b/bind-9.11-oot-gen.patch
@@ -0,0 +1,47 @@
+From cb654ddde5953cab9dfde7173ea1ed14b51c3727 Mon Sep 17 00:00:00 2001
+From: Mark Andrews <marka@isc.org>
+Date: Sun, 22 Dec 2019 21:51:21 +0000
+Subject: [PATCH] Merge branch
+ '1530-lib-dns-gen-c-29-26-fatal-error-isc-platform-h-no-such-file-or-directory-v9_11'
+ into 'v9_11'
+
+Resolve "lib/dns/gen.c:29:26: fatal error: isc/platform.h: No such file or directory"
+
+See merge request isc-projects/bind9!2794
+
+(cherry picked from commit 335ab375d6a0227fb362722acad22f2a5b75d8b7)
+---
+ lib/dns/gen.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/lib/dns/gen.c b/lib/dns/gen.c
+index 81bc7ada1d..5fbdc3bfd3 100644
+--- a/lib/dns/gen.c
++++ b/lib/dns/gen.c
+@@ -26,18 +26,18 @@
+ 
+ #include <sys/types.h>
+ 
+-#include <isc/platform.h>
+-
+ #include <ctype.h>
++#include <errno.h>
+ #include <limits.h>
+ #include <stdint.h>
+-#include <stdlib.h>
+ #include <stdio.h>
+ #include <stdlib.h>
+ #include <string.h>
+ #include <time.h>
+-#include <errno.h>
+-#include <limits.h>
++
++#ifndef PATH_MAX
++#define PATH_MAX 1024
++#endif
+ 
+ #ifdef WIN32
+ #include "gen-win32.h"
+-- 
+2.21.0
+
diff --git a/bind.spec b/bind.spec
index 23cf476..1816d6a 100644
--- a/bind.spec
+++ b/bind.spec
@@ -168,6 +168,7 @@ Patch183: bind-9.11-rh1736762-5.patch
 Patch184: bind-9.11-rh1736762-6.patch
 Patch185: bind-9.11-rh1736762-7.patch
 Patch186: bind-9.11-rh1736762-8.patch
+Patch187: bind-9.11-oot-gen.patch
 
 # SDB patches
 Patch11: bind-9.3.2b2-sdbsrc.patch
@@ -577,6 +578,7 @@ are used for building ISC DHCP.
 %patch184 -p1 -b .rh1736762-6
 %patch185 -p1 -b .rh1736762-7
 %patch186 -p1 -b .rh1736762-8
+%patch187 -p1 -b .oot-gen
 
 mkdir lib/dns/tests/testdata/dstrandom
 cp -a %{SOURCE50} lib/dns/tests/testdata/dstrandom/random.data

From 4fa84d9cccbf03a506aecb30dbc5d40f77598642 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 3 Jan 2020 20:26:39 +0100
Subject: [PATCH 104/460] Preserve symlinks to named.conf on iscdlv
 modification (#1786626)

---
 bind.spec | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/bind.spec b/bind.spec
index 1816d6a..cf0f499 100644
--- a/bind.spec
+++ b/bind.spec
@@ -64,7 +64,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.11.14
-Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  3%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1143,7 +1143,7 @@ else
   if /usr/sbin/named-checkconf -p /etc/named.conf 2>/dev/null | grep -q named.iscdlv.key
   then
     echo "Replacing obsolete named.iscdlv.key with named.root.key..."
-    if cp -af /etc/named.conf /etc/named.conf.rpmbackup; then
+    if cp -Rf --preserve=all --remove-destination /etc/named.conf /etc/named.conf.rpmbackup; then
       sed -e 's/named\.iscdlv\.key/named.root.key/' \
         /etc/named.conf.rpmbackup > /etc/named.conf || \
       mv /etc/named.conf.rpmbackup /etc/named.conf
@@ -1615,6 +1615,9 @@ fi;
 
 
 %changelog
+* Fri Jan 03 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.14-3
+- Preserve symlinks to named.conf on iscdlv modification (#1786626)
+
 * Thu Dec 19 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.14-2
 - Include more Thread Sanitizer detected changes (#1736762)
 

From c23c15d73b4f88af53ee2d014b3e832e37c5cdd4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 8 Jan 2020 16:36:11 +0100
Subject: [PATCH 105/460] Remove libmaxminddb-devel from devel dependencies

Unlike other build dependencies, no public headers include from
libmaxminddb any symbols. That means no build would ever fail
if libmaxminddb-devel package is not installed. Do not require it when
installing bind-lite-devel but keep the requirement when building from
sources.
---
 bind.spec | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/bind.spec b/bind.spec
index cf0f499..3e2de10 100644
--- a/bind.spec
+++ b/bind.spec
@@ -64,7 +64,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.11.14
-Release:  3%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  4%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -406,12 +406,6 @@ Requires:  json-c-devel%{?_isa}
 %if %{with DNSTAP}
 Requires:  fstrm-devel%{?_isa} protobuf-c-devel%{?_isa}
 %endif
-%if %{with GEOIP}
-Requires:  GeoIP-devel%{?_isa}
-%endif
-%if %{with GEOIP2}
-Requires:  libmaxminddb-devel%{?_isa}
-%endif
 
 %description lite-devel
 The bind-lite-devel package contains lite version of the header
@@ -1615,6 +1609,9 @@ fi;
 
 
 %changelog
+* Wed Jan 08 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.14-4
+- Remove libmaxminddb-devel from devel package dependencies
+
 * Fri Jan 03 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.14-3
 - Preserve symlinks to named.conf on iscdlv modification (#1786626)
 

From a1d448dbefd226e00133fa367a7138d5edc07d58 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Tue, 28 Jan 2020 12:57:50 +0000
Subject: [PATCH 106/460] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
---
 bind.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index 3e2de10..b99f546 100644
--- a/bind.spec
+++ b/bind.spec
@@ -64,7 +64,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.11.14
-Release:  4%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  5%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1609,6 +1609,9 @@ fi;
 
 
 %changelog
+* Tue Jan 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.11.14-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
+
 * Wed Jan 08 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.14-4
 - Remove libmaxminddb-devel from devel package dependencies
 

From 7726ce77a6022935f00c209bdd28ae3320a5560e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 9 Apr 2019 20:15:24 +0200
Subject: [PATCH 107/460] Some patches adapted to v9_14

---
 bind-9.11-oot-manual.patch           |  52 ++++++------
 bind-9.11-pk11.patch                 |  14 ----
 bind-9.11-rh1205168.patch            | 120 ---------------------------
 bind-9.9.1-P2-multlib-conflict.patch |  17 +---
 bind-95-rh452060.patch               |  42 ----------
 bind.spec                            |  10 +--
 bind93-rh490837.patch                |  19 ++---
 bind97-rh478718.patch                |  51 ------------
 bind97-rh645544.patch                |  15 ++--
 9 files changed, 44 insertions(+), 296 deletions(-)
 delete mode 100644 bind-9.11-rh1205168.patch
 delete mode 100644 bind-95-rh452060.patch
 delete mode 100644 bind97-rh478718.patch

diff --git a/bind-9.11-oot-manual.patch b/bind-9.11-oot-manual.patch
index 84e9d25..fe1788f 100644
--- a/bind-9.11-oot-manual.patch
+++ b/bind-9.11-oot-manual.patch
@@ -1,4 +1,4 @@
-From 8ca95f47231822df2b9c171a4da1e93ca5b748eb Mon Sep 17 00:00:00 2001
+From c5b39725cd4f3f30eac7eeafd7802005a1fad533 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Wed, 25 Jul 2018 12:24:16 +0200
 Subject: [PATCH] Use make automatic variables to install updated manuals
@@ -12,17 +12,17 @@ Install all files in single command instead of iterating on each of them.
  bin/delv/Makefile.in    |  6 ++++--
  bin/dig/Makefile.in     |  8 ++++----
  bin/dnssec/Makefile.in  |  6 ++++--
- bin/named/Makefile.in   | 13 +++++++++----
+ bin/named/Makefile.in   | 12 +++++++++---
  bin/pkcs11/Makefile.in  |  9 ++++-----
  bin/python/Makefile.in  |  8 ++++----
  bin/tools/Makefile.in   | 25 +++++++++++++++----------
- 9 files changed, 54 insertions(+), 38 deletions(-)
+ 9 files changed, 54 insertions(+), 37 deletions(-)
 
 diff --git a/bin/check/Makefile.in b/bin/check/Makefile.in
-index c124e80..1174f8d 100644
+index 8f009a4..de3c066 100644
 --- a/bin/check/Makefile.in
 +++ b/bin/check/Makefile.in
-@@ -83,12 +83,14 @@ installdirs:
+@@ -84,12 +84,14 @@ installdirs:
  	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
  	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
  
@@ -41,10 +41,10 @@ index c124e80..1174f8d 100644
  uninstall::
  	rm -f ${DESTDIR}${mandir}/man8/named-compilezone.8
 diff --git a/bin/confgen/Makefile.in b/bin/confgen/Makefile.in
-index 87f13dd..7865c0c 100644
+index 0588f8b..44d87fd 100644
 --- a/bin/confgen/Makefile.in
 +++ b/bin/confgen/Makefile.in
-@@ -95,13 +95,14 @@ installdirs:
+@@ -93,13 +93,14 @@ installdirs:
  	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
  	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
  
@@ -64,7 +64,7 @@ index 87f13dd..7865c0c 100644
  uninstall::
  	rm -f ${DESTDIR}${mandir}/man8/tsig-keygen.8
 diff --git a/bin/delv/Makefile.in b/bin/delv/Makefile.in
-index e2d2802..19361a8 100644
+index ea106f8..77adc91 100644
 --- a/bin/delv/Makefile.in
 +++ b/bin/delv/Makefile.in
 @@ -63,10 +63,12 @@ installdirs:
@@ -83,10 +83,10 @@ index e2d2802..19361a8 100644
  uninstall::
  	rm -f ${DESTDIR}${mandir}/man1/delv.1
 diff --git a/bin/dig/Makefile.in b/bin/dig/Makefile.in
-index a9830a9..d7ac0b6 100644
+index 8ea146f..3a97024 100644
 --- a/bin/dig/Makefile.in
 +++ b/bin/dig/Makefile.in
-@@ -91,16 +91,16 @@ installdirs:
+@@ -93,16 +93,16 @@ installdirs:
  	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${bindir}
  	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man1
  
@@ -108,10 +108,10 @@ index a9830a9..d7ac0b6 100644
  uninstall::
  	for m in ${MANPAGES}; do \
 diff --git a/bin/dnssec/Makefile.in b/bin/dnssec/Makefile.in
-index 2239ad1..ce0a177 100644
+index dfaad27..be1ac3b 100644
 --- a/bin/dnssec/Makefile.in
 +++ b/bin/dnssec/Makefile.in
-@@ -110,9 +110,11 @@ installdirs:
+@@ -114,9 +114,11 @@ installdirs:
  	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
  	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
  
@@ -126,36 +126,34 @@ index 2239ad1..ce0a177 100644
  uninstall::
  	for m in ${MANPAGES}; do rm -f ${DESTDIR}${mandir}/man8/$$m || exit 1; done
 diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
-index e1f85a9..d92bc9a 100644
+index 0485002..10d568f 100644
 --- a/bin/named/Makefile.in
 +++ b/bin/named/Makefile.in
-@@ -176,12 +176,17 @@ installdirs:
+@@ -169,10 +169,16 @@ installdirs:
  	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man5
  	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
  
--install:: named@EXEEXT@ lwresd@EXEEXT@ installdirs
+-install:: named@EXEEXT@ installdirs
 +install-man5: named.conf.5
 +	${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man5
 +
-+install-man8: named.8 lwresd.8
++install-man8: named.8
 +	${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man8
 +
 +install-man: install-man5 install-man8
 +
-+install:: named@EXEEXT@ lwresd@EXEEXT@ installdirs install-man
++install:: named@EXEEXT@ installdirs install-man
  	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named@EXEEXT@ ${DESTDIR}${sbindir}
- 	(cd ${DESTDIR}${sbindir}; rm -f lwresd@EXEEXT@; @LN@ named@EXEEXT@ lwresd@EXEEXT@)
 -	${INSTALL_DATA} ${srcdir}/named.8 ${DESTDIR}${mandir}/man8
--	${INSTALL_DATA} ${srcdir}/lwresd.8 ${DESTDIR}${mandir}/man8
 -	${INSTALL_DATA} ${srcdir}/named.conf.5 ${DESTDIR}${mandir}/man5
  
  uninstall::
  	rm -f ${DESTDIR}${mandir}/man5/named.conf.5
 diff --git a/bin/pkcs11/Makefile.in b/bin/pkcs11/Makefile.in
-index ae90616..a058c91 100644
+index 2fd9861..96aec05 100644
 --- a/bin/pkcs11/Makefile.in
 +++ b/bin/pkcs11/Makefile.in
-@@ -71,7 +71,10 @@ installdirs:
+@@ -69,7 +69,10 @@ installdirs:
  	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
  	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
  
@@ -167,7 +165,7 @@ index ae90616..a058c91 100644
  	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} pkcs11-list@EXEEXT@ \
  		${DESTDIR}${sbindir}
  	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} pkcs11-destroy@EXEEXT@ \
-@@ -80,10 +83,6 @@ install:: ${TARGETS} installdirs
+@@ -78,10 +81,6 @@ install:: ${TARGETS} installdirs
  		${DESTDIR}${sbindir}
  	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} pkcs11-tokens@EXEEXT@ \
  		${DESTDIR}${sbindir}
@@ -201,10 +199,10 @@ index aa678d4..064c404 100644
  		if test -n "${DESTDIR}" ; then \
  			${PYTHON} ${srcdir}/setup.py install --root=${DESTDIR} --prefix=${prefix} @PYTHON_INSTALL_LIB@ ; \
 diff --git a/bin/tools/Makefile.in b/bin/tools/Makefile.in
-index 7bf2af4..c395bc7 100644
+index 0fd2847..3c4f028 100644
 --- a/bin/tools/Makefile.in
 +++ b/bin/tools/Makefile.in
-@@ -119,17 +119,27 @@ installdirs:
+@@ -107,17 +107,27 @@ installdirs:
  	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man1
  	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
  
@@ -237,20 +235,18 @@ index 7bf2af4..c395bc7 100644
  	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} arpaname@EXEEXT@ \
  		${DESTDIR}${bindir}
  	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named-journalprint@EXEEXT@ \
-@@ -144,13 +154,8 @@ install:: ${TARGETS} installdirs @DNSTAP@ @NZD_TOOLS@
+@@ -128,11 +138,6 @@ install:: ${TARGETS} installdirs @DNSTAP@ @NZD_TOOLS@
  		${DESTDIR}${sbindir}
  	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} mdig@EXEEXT@ \
  		${DESTDIR}${bindir}
 -	${INSTALL_DATA} ${srcdir}/arpaname.1 ${DESTDIR}${mandir}/man1
- 	${INSTALL_DATA} ${srcdir}/isc-hmac-fixup.8 ${DESTDIR}${mandir}/man8
 -	${INSTALL_DATA} ${srcdir}/named-journalprint.8 ${DESTDIR}${mandir}/man8
 -	${INSTALL_DATA} ${srcdir}/named-rrchecker.1 ${DESTDIR}${mandir}/man1
 -	${INSTALL_DATA} ${srcdir}/nsec3hash.8 ${DESTDIR}${mandir}/man8
- 	${INSTALL_DATA} ${srcdir}/genrandom.8 ${DESTDIR}${mandir}/man8
 -	${INSTALL_DATA} ${srcdir}/mdig.1 ${DESTDIR}${mandir}/man1
  
  uninstall::
  	rm -f ${DESTDIR}${mandir}/man1/mdig.1
 -- 
-2.14.4
+2.20.1
 
diff --git a/bind-9.11-pk11.patch b/bind-9.11-pk11.patch
index d802314..fd75a6c 100644
--- a/bind-9.11-pk11.patch
+++ b/bind-9.11-pk11.patch
@@ -1,17 +1,3 @@
-diff --git a/lib/dns/dst_internal.h b/lib/dns/dst_internal.h
-index 640519a..fc40472 100644
---- a/lib/dns/dst_internal.h
-+++ b/lib/dns/dst_internal.h
-@@ -59,6 +59,9 @@
- #include <openssl/objects.h>
- #include <openssl/rsa.h>
- #endif
-+#if PKCS11CRYPTO
-+#include <pk11/pk11.h>
-+#endif
- 
- ISC_LANG_BEGINDECLS
- 
 diff --git a/lib/isc/include/pk11/internal.h b/lib/isc/include/pk11/internal.h
 index aa8907a..603712a 100644
 --- a/lib/isc/include/pk11/internal.h
diff --git a/bind-9.11-rh1205168.patch b/bind-9.11-rh1205168.patch
deleted file mode 100644
index 181cec9..0000000
--- a/bind-9.11-rh1205168.patch
+++ /dev/null
@@ -1,120 +0,0 @@
-From 90416594843a56550e40b11561807786219ce1c4 Mon Sep 17 00:00:00 2001
-From: Evan Hunt <each@isc.org>
-Date: Mon, 11 Sep 2017 15:01:36 -0700
-Subject: [PATCH] remap getaddrinfo() to irs_getgetaddrinfo()
-
-The libirs version of getaddrinfo() cannot be called from within BIND9.
-
-fix prototypes
----
- lib/irs/include/irs/netdb.h.in | 94 ++++++++++++++++++++++++++++++++++++++++++
- 1 file changed, 94 insertions(+)
-
-diff --git a/lib/irs/include/irs/netdb.h.in b/lib/irs/include/irs/netdb.h.in
-index 23dcd37..f36113d 100644
---- a/lib/irs/include/irs/netdb.h.in
-+++ b/lib/irs/include/irs/netdb.h.in
-@@ -150,6 +150,100 @@ struct addrinfo {
- #define	NI_DGRAM	0x00000010
- 
- /*
-+ * Define to map into irs_ namespace.
-+ */
-+
-+#define IRS_NAMESPACE
-+
-+#ifdef IRS_NAMESPACE
-+
-+/*
-+ * Use our versions not the ones from the C library.
-+ */
-+
-+#ifdef getnameinfo
-+#undef getnameinfo
-+#endif
-+#define getnameinfo irs_getnameinfo
-+
-+#ifdef getaddrinfo
-+#undef getaddrinfo
-+#endif
-+#define getaddrinfo irs_getaddrinfo
-+
-+#ifdef freeaddrinfo
-+#undef freeaddrinfo
-+#endif
-+#define freeaddrinfo irs_freeaddrinfo
-+
-+#ifdef gai_strerror
-+#undef gai_strerror
-+#endif
-+#define gai_strerror irs_gai_strerror
-+
-+#endif
-+
-+extern int getaddrinfo (const char *name,
-+			const char *service,
-+			const struct addrinfo *req,
-+			struct addrinfo **pai);
-+extern int getnameinfo (const struct sockaddr *sa,
-+			socklen_t salen, char *host,
-+			socklen_t hostlen, char *serv,
-+			socklen_t servlen, int flags);
-+extern void freeaddrinfo (struct addrinfo *ai);
-+extern const char *gai_strerror (int ecode);
-+
-+/*
-+ * Define to map into irs_ namespace.
-+ */
-+
-+#define IRS_NAMESPACE
-+
-+#ifdef IRS_NAMESPACE
-+
-+/*
-+ * Use our versions not the ones from the C library.
-+ */
-+
-+#ifdef getnameinfo
-+#undef getnameinfo
-+#endif
-+#define getnameinfo irs_getnameinfo
-+
-+#ifdef getaddrinfo
-+#undef getaddrinfo
-+#endif
-+#define getaddrinfo irs_getaddrinfo
-+
-+#ifdef freeaddrinfo
-+#undef freeaddrinfo
-+#endif
-+#define freeaddrinfo irs_freeaddrinfo
-+
-+#ifdef gai_strerror
-+#undef gai_strerror
-+#endif
-+#define gai_strerror irs_gai_strerror
-+
-+int
-+getaddrinfo(const char *hostname, const char *servname,
-+	    const struct addrinfo *hints, struct addrinfo **res);
-+
-+int
-+getnameinfo(const struct sockaddr *sa, IRS_GETNAMEINFO_SOCKLEN_T salen,
-+	    char *host, IRS_GETNAMEINFO_BUFLEN_T hostlen,
-+	    char *serv, IRS_GETNAMEINFO_BUFLEN_T servlen,
-+	    IRS_GETNAMEINFO_FLAGS_T flags);
-+
-+void freeaddrinfo (struct addrinfo *ai);
-+
-+IRS_GAISTRERROR_RETURN_T
-+gai_strerror(int ecode);
-+
-+#endif
-+
-+/*
-  * Tell Emacs to use C mode on this file.
-  * Local variables:
-  * mode: c
--- 
-2.9.5
-
diff --git a/bind-9.9.1-P2-multlib-conflict.patch b/bind-9.9.1-P2-multlib-conflict.patch
index 8768b86..1de1e04 100644
--- a/bind-9.9.1-P2-multlib-conflict.patch
+++ b/bind-9.9.1-P2-multlib-conflict.patch
@@ -1,18 +1,5 @@
-diff --git a/config.h.in b/config.h.in
-index 4ecaa8f..2f65ccc 100644
---- a/config.h.in
-+++ b/config.h.in
-@@ -600,7 +600,7 @@ int sigwait(const unsigned int *set, int *sig);
- #undef PREFER_GOSTASN1
- 
- /* The size of `void *', as computed by sizeof. */
--#undef SIZEOF_VOID_P
-+/* #undef SIZEOF_VOID_P */
- 
- /* Define to 1 if you have the ANSI C header files. */
- #undef STDC_HEADERS
 diff --git a/isc-config.sh.in b/isc-config.sh.in
-index a8a0a89..b5e94ed 100644
+index 40f9bba..e446da2 100644
 --- a/isc-config.sh.in
 +++ b/isc-config.sh.in
 @@ -13,7 +13,18 @@ prefix=@prefix@
@@ -35,7 +22,7 @@ index a8a0a89..b5e94ed 100644
  
  usage()
  {
-@@ -132,6 +143,16 @@ if test x"$echo_libs" = x"true"; then
+@@ -128,6 +139,16 @@ if test x"$echo_libs" = x"true"; then
  	if test x"${exec_prefix_set}" = x"true"; then
  		libs="-L${exec_prefix}/lib"
  	else
diff --git a/bind-95-rh452060.patch b/bind-95-rh452060.patch
deleted file mode 100644
index c57ccab..0000000
--- a/bind-95-rh452060.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
-index aa5315d..1fa711a 100644
---- a/bin/dig/dighost.c
-+++ b/bin/dig/dighost.c
-@@ -1814,6 +1814,13 @@ clear_query(dig_query_t *query) {
- 
- 	if (query->timer != NULL)
- 		isc_timer_detach(&query->timer);
-+
-+	if (query->waiting_senddone) {
-+		debug("send_done not yet called");
-+		query->pending_free = true;
-+		return;
-+	}
-+
- 	lookup = query->lookup;
- 
- 	if (lookup->current_query == query)
-@@ -1839,10 +1846,7 @@ clear_query(dig_query_t *query) {
- 	isc_mempool_put(commctx, query->recvspace);
- 	isc_buffer_invalidate(&query->recvbuf);
- 	isc_buffer_invalidate(&query->lengthbuf);
--	if (query->waiting_senddone)
--		query->pending_free = true;
--	else
--		isc_mem_free(mctx, query);
-+	isc_mem_free(mctx, query);
- }
- 
- /*%
-@@ -2892,9 +2896,9 @@ send_done(isc_task_t *_task, isc_event_t *event) {
- 	isc_event_free(&event);
- 
- 	if (query->pending_free)
--		isc_mem_free(mctx, query);
-+		clear_query(query);
- 
--	check_if_done();
-+	check_next_lookup(l);
- 	UNLOCK_LOOKUP;
- }
- 
diff --git a/bind.spec b/bind.spec
index 3e2de10..bf07be7 100644
--- a/bind.spec
+++ b/bind.spec
@@ -63,8 +63,8 @@
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.11.14
-Release:  4%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Version:  9.14.0
+Release:  0%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -113,9 +113,7 @@ Patch10: bind-9.5-PIE.patch
 Patch16: bind-9.3.2-redhat_doc.patch
 Patch72: bind-9.5-dlz-64bit.patch
 Patch101:bind-96-old-api.patch
-Patch102:bind-95-rh452060.patch
 Patch106:bind93-rh490837.patch
-Patch109:bind97-rh478718.patch
 Patch112:bind97-rh645544.patch
 Patch130:bind-9.9.1-P2-dlz-libdb.patch
 Patch131:bind-9.9.1-P2-multlib-conflict.patch
@@ -128,7 +126,6 @@ Patch136:bind-9.10-dist-native-pkcs11.patch
 # introduced by https://source.isc.org/cgi-bin/gitweb.cgi?p=bind9.git;a=commit;h=fc9f0ac5778f78003a7acc957a23711811fec122
 Patch137:bind-9.10-use-of-strlcat.patch
 Patch140:bind-9.11-rh1410433.patch
-Patch145:bind-9.11-rh1205168.patch
 # [ISC-Bugs #46853] commit cb616c6d5c2ece1fac37fa6e0bca2b53d4043098 ISC 4851
 Patch149:bind-9.11-kyua-pkcs11.patch
 # Avoid conflicts with OpenSSL PKCS11 engine
@@ -540,14 +537,11 @@ are used for building ISC DHCP.
 %patch10 -p1 -b .PIE
 %patch16 -p1 -b .redhat_doc
 %patch72 -p1 -b .64bit
-%patch102 -p1 -b .rh452060
 %patch106 -p1 -b .rh490837
-%patch109 -p1 -b .rh478718
 %patch112 -p1 -b .rh645544
 %patch130 -p1 -b .libdb
 %patch131 -p1 -b .multlib-conflict
 %patch140 -p1 -b .rh1410433
-%patch145 -p1 -b .rh1205168
 %patch153 -p1 -b .export_suffix
 %patch154 -p1 -b .oot-man
 %patch155 -p1 -b .pk11-internal
diff --git a/bind93-rh490837.patch b/bind93-rh490837.patch
index 6ea55ba..6390c2f 100644
--- a/bind93-rh490837.patch
+++ b/bind93-rh490837.patch
@@ -13,14 +13,14 @@ index 1f44b5a..a3625f9 100644
  
  #endif /* ISC_STDIO_H */
 diff --git a/lib/isc/lex.c b/lib/isc/lex.c
-index a8955bc..fc6103b 100644
+index ca5fe6d..b0152eb 100644
 --- a/lib/isc/lex.c
 +++ b/lib/isc/lex.c
-@@ -434,17 +434,14 @@ isc_lex_gettoken(isc_lex_t *lex, unsigned int options, isc_token_t *tokenp) {
+@@ -433,15 +433,11 @@ isc_lex_gettoken(isc_lex_t *lex, unsigned int options, isc_token_t *tokenp) {
  			if (source->is_file) {
  				stream = source->input;
  
--#if defined(HAVE_FLOCKFILE) && defined(HAVE_GETCUNLOCKED)
+-#if defined(HAVE_FLOCKFILE) && defined(HAVE_GETC_UNLOCKED)
 -				c = getc_unlocked(stream);
 -#else
 -				c = getc(stream);
@@ -36,15 +36,12 @@ index a8955bc..fc6103b 100644
 +						source->result = result;
  						goto done;
  					}
-+
  					source->at_eof = true;
- 				}
- 			} else {
 diff --git a/lib/isc/unix/errno2result.c b/lib/isc/unix/errno2result.c
-index 2f12bcc..5bfd648 100644
+index d72d56f..4287ff3 100644
 --- a/lib/isc/unix/errno2result.c
 +++ b/lib/isc/unix/errno2result.c
-@@ -40,6 +40,7 @@ isc___errno2result(int posixerrno, bool dolog,
+@@ -42,6 +42,7 @@ isc___errno2result(int posixerrno, bool dolog,
  	case EINVAL:		/* XXX sometimes this is not for files */
  	case ENAMETOOLONG:
  	case EBADF:
@@ -53,10 +50,10 @@ index 2f12bcc..5bfd648 100644
  	case ENOENT:
  		return (ISC_R_FILENOTFOUND);
 diff --git a/lib/isc/unix/stdio.c b/lib/isc/unix/stdio.c
-index e60fa65..77f0b13 100644
+index d2b1dda..79630b2 100644
 --- a/lib/isc/unix/stdio.c
 +++ b/lib/isc/unix/stdio.c
-@@ -149,3 +149,22 @@ isc_stdio_sync(FILE *f) {
+@@ -141,3 +141,22 @@ isc_stdio_sync(FILE *f) {
  		return (isc__errno2result(errno));
  }
  
@@ -68,7 +65,7 @@ index e60fa65..77f0b13 100644
 +#if defined(HAVE_FLOCKFILE) && defined(HAVE_GETCUNLOCKED)
 +	r = fgetc_unlocked(f);
 +#else
-+	r = fgets(f);
++	r = fgetc(f);
 +#endif
 +
 +	if (r == EOF)
diff --git a/bind97-rh478718.patch b/bind97-rh478718.patch
deleted file mode 100644
index dfc4165..0000000
--- a/bind97-rh478718.patch
+++ /dev/null
@@ -1,51 +0,0 @@
-diff --git a/configure.ac b/configure.ac
-index 26c509e..c1bfd62 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -4152,6 +4152,10 @@ if test "yes" = "$use_atomic"; then
- 	AC_MSG_RESULT($arch)
- fi
- 
-+if test ! "$arch" = "x86_64" -a "$have_xaddq" = "yes"; then
-+	AC_MSG_ERROR([XADDQ present but disabled by Fedora patch!])
-+fi
-+
- if test "yes" = "$have_atomic"; then
- 	AC_MSG_CHECKING([compiler support for inline assembly code])
- 
-diff --git a/lib/isc/include/isc/platform.h.in b/lib/isc/include/isc/platform.h.in
-index c902d46..9c7c342 100644
---- a/lib/isc/include/isc/platform.h.in
-+++ b/lib/isc/include/isc/platform.h.in
-@@ -284,19 +284,25 @@
-  * If the "xaddq" operation (64bit xadd) is available on this architecture,
-  * ISC_PLATFORM_HAVEXADDQ will be defined.
-  */
--@ISC_PLATFORM_HAVEXADDQ@
- 
- /*
-- * If the 32-bit "atomic swap" operation is available on this
-- * architecture, ISC_PLATFORM_HAVEATOMICSTORE" will be defined.
-+ * If the 64-bit "atomic swap" operation is available on this
-+ * architecture, ISC_PLATFORM_HAVEATOMICSTOREQ" will be defined.
-  */
--@ISC_PLATFORM_HAVEATOMICSTORE@
-+
-+#ifdef __x86_64__
-+#define ISC_PLATFORM_HAVEXADDQ 1
-+#define ISC_PLATFORM_HAVEATOMICSTOREQ 1
-+#else
-+#undef ISC_PLATFORM_HAVEXADDQ
-+#undef ISC_PLATFORM_HAVEATOMICSTOREQ
-+#endif
- 
- /*
-- * If the 64-bit "atomic swap" operation is available on this
-+ * If the 32-bit "atomic swap" operation is available on this
-  * architecture, ISC_PLATFORM_HAVEATOMICSTORE" will be defined.
-  */
--@ISC_PLATFORM_HAVEATOMICSTOREQ@
-+@ISC_PLATFORM_HAVEATOMICSTORE@
- 
- /*
-  * If the "compare-and-exchange" operation is available on this architecture,
diff --git a/bind97-rh645544.patch b/bind97-rh645544.patch
index d1d8429..282fa2f 100644
--- a/bind97-rh645544.patch
+++ b/bind97-rh645544.patch
@@ -1,7 +1,8 @@
-diff -up bind-9.9.4rc2/lib/dns/resolver.c.rh645544 bind-9.9.4rc2/lib/dns/resolver.c
---- bind-9.9.4rc2/lib/dns/resolver.c.rh645544	2013-08-19 10:30:52.000000000 +0200
-+++ bind-9.9.4rc2/lib/dns/resolver.c	2013-09-06 17:58:03.864165823 +0200
-@@ -1138,7 +1138,7 @@ log_edns(fetchctx_t *fctx) {
+diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
+index 2a6e69c..b2f8cec 100644
+--- a/lib/dns/resolver.c
++++ b/lib/dns/resolver.c
+@@ -1676,7 +1676,7 @@ log_edns(fetchctx_t *fctx) {
  	 */
  	dns_name_format(&fctx->domain, domainbuf, sizeof(domainbuf));
  	isc_log_write(dns_lctx, DNS_LOGCATEGORY_EDNS_DISABLED,
@@ -9,8 +10,8 @@ diff -up bind-9.9.4rc2/lib/dns/resolver.c.rh645544 bind-9.9.4rc2/lib/dns/resolve
 +		      DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(1),
  		      "success resolving '%s' (in '%s'?) after %s",
  		      fctx->info, domainbuf, fctx->reason);
- 
-@@ -3804,7 +3804,7 @@ log_lame(fetchctx_t *fctx, dns_adbaddrin
+ }
+@@ -5084,7 +5084,7 @@ log_lame(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo) {
  	dns_name_format(&fctx->domain, domainbuf, sizeof(domainbuf));
  	isc_sockaddr_format(&addrinfo->sockaddr, addrbuf, sizeof(addrbuf));
  	isc_log_write(dns_lctx, DNS_LOGCATEGORY_LAME_SERVERS,
@@ -19,7 +20,7 @@ diff -up bind-9.9.4rc2/lib/dns/resolver.c.rh645544 bind-9.9.4rc2/lib/dns/resolve
  		      "lame server resolving '%s' (in '%s'?): %s",
  		      namebuf, domainbuf, addrbuf);
  }
-@@ -3831,7 +3831,7 @@ log_formerr(fetchctx_t *fctx, const char
+@@ -5111,7 +5111,7 @@ log_formerr(fetchctx_t *fctx, const char *format, ...) {
  	}
  
  	isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,

From 0b18b1b5171698c51d9140742fb6e92cf46dd7d4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 23 Jul 2019 15:18:02 +0200
Subject: [PATCH 108/460] Initial steps towards buildable 9.14

---
 bind-9.11-fips-tests.patch          |  662 ++--------
 bind-9.11-host-idn-disable.patch    |   92 --
 bind-9.11-rh1624100.patch           |  288 -----
 bind-9.11-rh1663318.patch           |   48 -
 bind-9.11-rt31459.patch             | 1835 +--------------------------
 bind-9.11-unit-disable-random.patch |   15 +-
 bind.spec                           |   26 +-
 bind97-rh669163.patch               |   14 -
 random.data                         |  Bin 4096 -> 0 bytes
 9 files changed, 160 insertions(+), 2820 deletions(-)
 delete mode 100644 bind-9.11-host-idn-disable.patch
 delete mode 100644 bind-9.11-rh1624100.patch
 delete mode 100644 bind-9.11-rh1663318.patch
 delete mode 100644 bind97-rh669163.patch
 delete mode 100644 random.data

diff --git a/bind-9.11-fips-tests.patch b/bind-9.11-fips-tests.patch
index 29dda07..18e0433 100644
--- a/bind-9.11-fips-tests.patch
+++ b/bind-9.11-fips-tests.patch
@@ -1,4 +1,4 @@
-From c23daf334d5487fa53fef88c82312e439a2d8523 Mon Sep 17 00:00:00 2001
+From f37b26cb7c8f7351d22dfea79df33edb74d42e23 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 2 Aug 2018 23:46:45 +0200
 Subject: [PATCH] FIPS tests changes
@@ -76,35 +76,22 @@ Date:   Wed Mar 7 10:44:23 2018 +0100
  bin/tests/system/catz/ns2/named.conf.in       |  2 +-
  bin/tests/system/checkconf/bad-tsig.conf      |  2 +-
  bin/tests/system/checkconf/good.conf          |  2 +-
- bin/tests/system/digdelv/ns2/example.db       | 15 +++--
- bin/tests/system/digdelv/tests.sh             | 20 +++---
- bin/tests/system/dlv/ns1/sign.sh              |  4 +-
- bin/tests/system/dlv/ns2/sign.sh              |  4 +-
- bin/tests/system/dlv/ns6/sign.sh              | 66 +++++++++---------
- bin/tests/system/dnssec/ns2/sign.sh           |  8 +--
- bin/tests/system/dnssec/ns5/trusted.conf.bad  |  2 +-
- bin/tests/system/dnssec/tests.sh              |  4 +-
- bin/tests/system/feature-test.c               | 14 ++++
- bin/tests/system/filter-aaaa/ns1/sign.sh      |  4 +-
- bin/tests/system/filter-aaaa/ns4/sign.sh      |  4 +-
+ bin/tests/system/dlv/ns3/sign.sh              |  1 +
+ bin/tests/system/feature-test.c               | 13 ++++
  bin/tests/system/notify/ns5/named.conf.in     |  6 +-
  bin/tests/system/notify/tests.sh              |  6 +-
  bin/tests/system/nsupdate/ns1/named.conf.in   |  2 +-
  bin/tests/system/nsupdate/ns2/named.conf.in   |  2 +-
- bin/tests/system/nsupdate/setup.sh            |  7 +-
+ bin/tests/system/nsupdate/setup.sh            |  6 +-
  bin/tests/system/nsupdate/tests.sh            | 11 ++-
  bin/tests/system/rndc/setup.sh                |  2 +-
  bin/tests/system/rndc/tests.sh                | 23 ++++---
- bin/tests/system/tsig/clean.sh                |  1 +
  bin/tests/system/tsig/ns1/named.conf.in       | 10 +--
  bin/tests/system/tsig/setup.sh                |  5 ++
  bin/tests/system/tsig/tests.sh                | 67 ++++++++++++-------
- bin/tests/system/tsiggss/setup.sh             |  2 +-
  bin/tests/system/upforwd/ns1/named.conf.in    |  2 +-
  bin/tests/system/upforwd/tests.sh             |  2 +-
- bin/tests/system/tsig/ns1/rndc5.conf.in | 10 +++
- 45 files changed, 232 insertions(+), 171 deletions(-)
- create mode 100644 bin/tests/system/tsig/ns1/rndc5.conf.in
+ 33 files changed, 151 insertions(+), 107 deletions(-)
 
 diff --git a/bin/tests/system/acl/ns2/named1.conf.in b/bin/tests/system/acl/ns2/named1.conf.in
 index 0ea6502..026db3f 100644
@@ -208,7 +195,7 @@ index 4b4e050..0e679a8 100644
  };
  
 diff --git a/bin/tests/system/acl/tests.sh b/bin/tests/system/acl/tests.sh
-index 09f31f2..f88f0d4 100644
+index fe49a86..d7819f1 100644
 --- a/bin/tests/system/acl/tests.sh
 +++ b/bin/tests/system/acl/tests.sh
 @@ -22,14 +22,14 @@ echo_i "testing basic ACL processing"
@@ -334,11 +321,11 @@ index 09f31f2..f88f0d4 100644
  
  echo_i "testing allow-query-on ACL processing"
 diff --git a/bin/tests/system/allow-query/ns2/named10.conf.in b/bin/tests/system/allow-query/ns2/named10.conf.in
-index 1569913..e9c5c2d 100644
+index c5f38c9..00db0da 100644
 --- a/bin/tests/system/allow-query/ns2/named10.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named10.conf.in
-@@ -12,7 +12,7 @@
- controls { /* empty */ };
+@@ -10,7 +10,7 @@
+  */
  
  key one {
 -	algorithm hmac-md5;
@@ -347,11 +334,11 @@ index 1569913..e9c5c2d 100644
  };
  
 diff --git a/bin/tests/system/allow-query/ns2/named11.conf.in b/bin/tests/system/allow-query/ns2/named11.conf.in
-index 18ac91c..2b1c873 100644
+index 56e5cc4..2c32b71 100644
 --- a/bin/tests/system/allow-query/ns2/named11.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named11.conf.in
-@@ -12,12 +12,12 @@
- controls { /* empty */ };
+@@ -10,12 +10,12 @@
+  */
  
  key one {
 -	algorithm hmac-md5;
@@ -366,11 +353,11 @@ index 18ac91c..2b1c873 100644
  };
  
 diff --git a/bin/tests/system/allow-query/ns2/named12.conf.in b/bin/tests/system/allow-query/ns2/named12.conf.in
-index b824844..dd48945 100644
+index 8381950..21a6366 100644
 --- a/bin/tests/system/allow-query/ns2/named12.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named12.conf.in
-@@ -12,7 +12,7 @@
- controls { /* empty */ };
+@@ -10,7 +10,7 @@
+  */
  
  key one {
 -	algorithm hmac-md5;
@@ -379,11 +366,11 @@ index b824844..dd48945 100644
  };
  
 diff --git a/bin/tests/system/allow-query/ns2/named30.conf.in b/bin/tests/system/allow-query/ns2/named30.conf.in
-index aeb1540..bfce58b 100644
+index 0e5ff55..a90ed6a 100644
 --- a/bin/tests/system/allow-query/ns2/named30.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named30.conf.in
-@@ -12,7 +12,7 @@
- controls { /* empty */ };
+@@ -10,7 +10,7 @@
+  */
  
  key one {
 -	algorithm hmac-md5;
@@ -392,11 +379,11 @@ index aeb1540..bfce58b 100644
  };
  
 diff --git a/bin/tests/system/allow-query/ns2/named31.conf.in b/bin/tests/system/allow-query/ns2/named31.conf.in
-index d4b7432..e0f5252 100644
+index faadb3f..b99f337 100644
 --- a/bin/tests/system/allow-query/ns2/named31.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named31.conf.in
-@@ -12,12 +12,12 @@
- controls { /* empty */ };
+@@ -10,12 +10,12 @@
+  */
  
  key one {
 -	algorithm hmac-md5;
@@ -411,11 +398,11 @@ index d4b7432..e0f5252 100644
  };
  
 diff --git a/bin/tests/system/allow-query/ns2/named32.conf.in b/bin/tests/system/allow-query/ns2/named32.conf.in
-index c025938..87afb3f 100644
+index 9e78dd0..ea7a413 100644
 --- a/bin/tests/system/allow-query/ns2/named32.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named32.conf.in
-@@ -12,7 +12,7 @@
- controls { /* empty */ };
+@@ -10,7 +10,7 @@
+  */
  
  key one {
 -	algorithm hmac-md5;
@@ -424,10 +411,10 @@ index c025938..87afb3f 100644
  };
  
 diff --git a/bin/tests/system/allow-query/ns2/named40.conf.in b/bin/tests/system/allow-query/ns2/named40.conf.in
-index d83b376..d726b94 100644
+index f4bc399..e01f312 100644
 --- a/bin/tests/system/allow-query/ns2/named40.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named40.conf.in
-@@ -16,12 +16,12 @@ acl accept { 10.53.0.2; };
+@@ -14,12 +14,12 @@ acl accept { 10.53.0.2; };
  acl badaccept { 10.53.0.1; };
  
  key one {
@@ -443,10 +430,10 @@ index d83b376..d726b94 100644
  };
  
 diff --git a/bin/tests/system/allow-query/tests.sh b/bin/tests/system/allow-query/tests.sh
-index fb6059d..f960156 100644
+index 479910c..53b9e5c 100644
 --- a/bin/tests/system/allow-query/tests.sh
 +++ b/bin/tests/system/allow-query/tests.sh
-@@ -190,7 +190,7 @@ rndc_reload
+@@ -182,7 +182,7 @@ rndc_reload ns2 10.53.0.2
  
  echo_i "test $n: key allowed - query allowed"
  ret=0
@@ -455,7 +442,7 @@ index fb6059d..f960156 100644
  grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
  grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1
  if [ $ret != 0 ]; then echo_i "failed"; fi
-@@ -203,7 +203,7 @@ rndc_reload
+@@ -195,7 +195,7 @@ rndc_reload ns2 10.53.0.2
  
  echo_i "test $n: key not allowed - query refused"
  ret=0
@@ -464,7 +451,7 @@ index fb6059d..f960156 100644
  grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
  grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
  if [ $ret != 0 ]; then echo_i "failed"; fi
-@@ -216,7 +216,7 @@ rndc_reload
+@@ -208,7 +208,7 @@ rndc_reload ns2 10.53.0.2
  
  echo_i "test $n: key disallowed - query refused"
  ret=0
@@ -473,7 +460,7 @@ index fb6059d..f960156 100644
  grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
  grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
  if [ $ret != 0 ]; then echo_i "failed"; fi
-@@ -349,7 +349,7 @@ rndc_reload
+@@ -341,7 +341,7 @@ rndc_reload ns2 10.53.0.2
  
  echo_i "test $n: views key allowed - query allowed"
  ret=0
@@ -482,7 +469,7 @@ index fb6059d..f960156 100644
  grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
  grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1
  if [ $ret != 0 ]; then echo_i "failed"; fi
-@@ -362,7 +362,7 @@ rndc_reload
+@@ -354,7 +354,7 @@ rndc_reload ns2 10.53.0.2
  
  echo_i "test $n: views key not allowed - query refused"
  ret=0
@@ -491,7 +478,7 @@ index fb6059d..f960156 100644
  grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
  grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
  if [ $ret != 0 ]; then echo_i "failed"; fi
-@@ -375,7 +375,7 @@ rndc_reload
+@@ -367,7 +367,7 @@ rndc_reload ns2 10.53.0.2
  
  echo_i "test $n: views key disallowed - query refused"
  ret=0
@@ -500,7 +487,7 @@ index fb6059d..f960156 100644
  grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
  grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
  if [ $ret != 0 ]; then echo_i "failed"; fi
-@@ -508,7 +508,7 @@ status=`expr $status + $ret`
+@@ -500,7 +500,7 @@ status=`expr $status + $ret`
  n=`expr $n + 1`
  echo_i "test $n: zone key allowed - query allowed"
  ret=0
@@ -509,7 +496,7 @@ index fb6059d..f960156 100644
  grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
  grep '^a.keyallow.example' dig.out.ns2.$n > /dev/null || ret=1
  if [ $ret != 0 ]; then echo_i "failed"; fi
-@@ -518,7 +518,7 @@ status=`expr $status + $ret`
+@@ -510,7 +510,7 @@ status=`expr $status + $ret`
  n=`expr $n + 1`
  echo_i "test $n: zone key not allowed - query refused"
  ret=0
@@ -518,7 +505,7 @@ index fb6059d..f960156 100644
  grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
  grep '^a.keyallow.example' dig.out.ns2.$n > /dev/null && ret=1
  if [ $ret != 0 ]; then echo_i "failed"; fi
-@@ -528,7 +528,7 @@ status=`expr $status + $ret`
+@@ -520,7 +520,7 @@ status=`expr $status + $ret`
  n=`expr $n + 1`
  echo_i "test $n: zone key disallowed - query refused"
  ret=0
@@ -563,10 +550,10 @@ index 21be03e..e57c308 100644
  };
  
 diff --git a/bin/tests/system/checkconf/good.conf b/bin/tests/system/checkconf/good.conf
-index 9ab35b3..486551a 100644
+index d627d2a..9d0322a 100644
 --- a/bin/tests/system/checkconf/good.conf
 +++ b/bin/tests/system/checkconf/good.conf
-@@ -153,6 +153,6 @@ dyndb "name" "library.so" {
+@@ -157,6 +157,6 @@ dyndb "name" "library.so" {
  	system;
  };
  key "mykey" {
@@ -574,473 +561,51 @@ index 9ab35b3..486551a 100644
 +	algorithm "hmac-sha256";
  	secret "qwertyuiopasdfgh";
  };
-diff --git a/bin/tests/system/digdelv/ns2/example.db b/bin/tests/system/digdelv/ns2/example.db
-index f4e30f5..9f53e31 100644
---- a/bin/tests/system/digdelv/ns2/example.db
-+++ b/bin/tests/system/digdelv/ns2/example.db
-@@ -38,12 +38,15 @@ foo			SSHFP	2 1 123456789abcdef67890123456789abcdef67890
- ;;
- ;; we are not testing DNSSEC behavior, so we don't care about the semantics
- ;; of the following records.
--dnskey                  300     DNSKEY  256 3 1 (
--                                        AQPTpWyReB/e9Ii6mVGnakS8hX2zkh/iUYAg
--                                        +Ge4noWROpTWOIBvm76zeJPWs4Zfqa1IsswD
--                                        Ix5Mqeg0zwclz59uecKsKyx5w9IhtZ8plc4R
--                                        b9VIE5x7KNHAYTvTO5d4S8M=
--                                        )
-+dnskey                  300     DNSKEY 256 3 8 (
-+                    AwEAAaWmCoDpj2K59zcpqnmnQM7IC/XbjS6jIP7uTBR4X7p1bdQJzAeo
-+                    EnMhnpnxPp0j+20eZm4847DB2U+HuHy79Mvqd3aozTmfBJvzjKs9qyba
-+                    zY/ZHn6BDYxNJiFfjSS/VJ1KuQPDbpCzhm2hbvT5s9nSOaG0WyRk+d+R
-+                    qEca11E7ZKkmmNiGlyzMAgfmTTBwgxWBAAhvd9nU1GqD6eQ6Z63hpTc/
-+                    KDIHnFTo7pOcZ4z5urIKUMCMcFytedETlEoR5CIWGPdQq2eIEEMfn5ld
-+                    QqdEZRHVErD9og8aluJ2s767HZb8LzjCfYgBFoT9/n48T75oZLEKtSkG
-+                    /idCeeQlaLU=
-+                    )
- 
- ; TTL of 3 weeks
- weeks		1814400	A	10.53.0.2
-diff --git a/bin/tests/system/digdelv/tests.sh b/bin/tests/system/digdelv/tests.sh
-index ade45ce..d3aff24 100644
---- a/bin/tests/system/digdelv/tests.sh
-+++ b/bin/tests/system/digdelv/tests.sh
-@@ -106,7 +106,7 @@ if [ -x "$DIG" ] ; then
-   echo_i "checking dig +rrcomments works for DNSKEY($n)"
-   ret=0
-   $DIG $DIGOPTS +tcp @10.53.0.3 +rrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1
--  grep "; ZSK; alg = RSAMD5 ; key id = 30795" < dig.out.test$n > /dev/null || ret=1
-+  grep "; ZSK; alg = RSASHA256 ; key id = 36895$" < dig.out.test$n > /dev/null || ret=1
-   check_ttl_range dig.out.test$n "DNSKEY" 300 || ret=1
-   if [ $ret != 0 ]; then echo_i "failed"; fi
-   status=`expr $status + $ret`
-@@ -115,7 +115,7 @@ if [ -x "$DIG" ] ; then
-   echo_i "checking dig +short +rrcomments works for DNSKEY ($n)"
-   ret=0
-   $DIG $DIGOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1
--  grep "; ZSK; alg = RSAMD5 ; key id = 30795" < dig.out.test$n > /dev/null || ret=1
-+  grep "; ZSK; alg = RSASHA256 ; key id = 36895$" < dig.out.test$n > /dev/null || ret=1
-   if [ $ret != 0 ]; then echo_i "failed"; fi
-   status=`expr $status + $ret`
- 
-@@ -123,7 +123,7 @@ if [ -x "$DIG" ] ; then
-   echo_i "checking dig +short +nosplit works($n)"
-   ret=0
-   $DIG $DIGOPTS +tcp @10.53.0.3 +short +nosplit DNSKEY dnskey.example > dig.out.test$n || ret=1
--  grep "Z8plc4Rb9VIE5x7KNHAYTvTO5d4S8M=$" < dig.out.test$n > /dev/null || ret=1
-+  grep "T9/n48T75oZLEKtSkG/idCeeQlaLU=$" < dig.out.test$n > /dev/null || ret=1
-   if [ $ret != 0 ]; then echo_i "failed"; fi
-   status=`expr $status + $ret`
- 
-@@ -131,7 +131,7 @@ if [ -x "$DIG" ] ; then
-   echo_i "checking dig +short +rrcomments works($n)"
-   ret=0
-   $DIG $DIGOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1
--  grep "S8M=  ; ZSK; alg = RSAMD5 ; key id = 30795$" < dig.out.test$n > /dev/null || ret=1
-+  grep "aLU=  ; ZSK; alg = RSASHA256 ; key id = 36895$" < dig.out.test$n > /dev/null || ret=1
-   if [ $ret != 0 ]; then echo_i "failed"; fi
-   status=`expr $status + $ret`
- 
-@@ -148,7 +148,7 @@ if [ -x "$DIG" ] ; then
-   echo_i "checking dig +short +rrcomments works($n)"
-   ret=0
-   $DIG $DIGOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1
--  grep "S8M=  ; ZSK; alg = RSAMD5 ; key id = 30795$" < dig.out.test$n > /dev/null || ret=1
-+  grep "aLU=  ; ZSK; alg = RSASHA256 ; key id = 36895$" < dig.out.test$n > /dev/null || ret=1
-   if [ $ret != 0 ]; then echo_i "failed"; fi
-   status=`expr $status + $ret`
- 
-@@ -695,7 +695,7 @@ if [ -x ${DELV} ] ; then
-   echo_i "checking delv +rrcomments works for DNSKEY($n)"
-   ret=0
-   $DELV $DELVOPTS +tcp @10.53.0.3 +rrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
--  grep "; ZSK; alg = RSAMD5 ; key id = 30795" < delv.out.test$n > /dev/null || ret=1
-+  grep "; ZSK; alg = RSASHA256 ; key id = 36895" < delv.out.test$n > /dev/null || ret=1
-   check_ttl_range delv.out.test$n "DNSKEY" 300 || ret=1
-   if [ $ret != 0 ]; then echo_i "failed"; fi
-   status=`expr $status + $ret`
-@@ -704,7 +704,7 @@ if [ -x ${DELV} ] ; then
-   echo_i "checking delv +short +rrcomments works for DNSKEY ($n)"
-   ret=0
-   $DELV $DELVOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
--  grep "; ZSK; alg = RSAMD5 ; key id = 30795" < delv.out.test$n > /dev/null || ret=1
-+  grep "; ZSK; alg = RSASHA256 ; key id = 36895" < delv.out.test$n > /dev/null || ret=1
-   if [ $ret != 0 ]; then echo_i "failed"; fi
-   status=`expr $status + $ret`
- 
-@@ -712,7 +712,7 @@ if [ -x ${DELV} ] ; then
-   echo_i "checking delv +short +rrcomments works ($n)"
-   ret=0
-   $DELV $DELVOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
--  grep "S8M=  ; ZSK; alg = RSAMD5 ; key id = 30795$" < delv.out.test$n > /dev/null || ret=1
-+  grep "aLU=  ; ZSK; alg = RSASHA256 ; key id = 36895$" < delv.out.test$n > /dev/null || ret=1
-   if [ $ret != 0 ]; then echo_i "failed"; fi
-   status=`expr $status + $ret`
- 
-@@ -720,7 +720,7 @@ if [ -x ${DELV} ] ; then
-   echo_i "checking delv +short +nosplit works ($n)"
-   ret=0
-   $DELV $DELVOPTS +tcp @10.53.0.3 +short +nosplit DNSKEY dnskey.example > delv.out.test$n || ret=1
--  grep "Z8plc4Rb9VIE5x7KNHAYTvTO5d4S8M=" < delv.out.test$n > /dev/null || ret=1
-+  grep "T9/n48T75oZLEKtSkG/idCeeQlaLU=" < delv.out.test$n > /dev/null || ret=1
-   if test `wc -l < delv.out.test$n` != 1 ; then ret=1 ; fi
-   f=`awk '{print NF}' < delv.out.test$n`
-   test "${f:-0}" -eq 14 || ret=1
-@@ -731,7 +731,7 @@ if [ -x ${DELV} ] ; then
-   echo_i "checking delv +short +nosplit +norrcomments works ($n)"
-   ret=0
-   $DELV $DELVOPTS +tcp @10.53.0.3 +short +nosplit +norrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
--  grep "Z8plc4Rb9VIE5x7KNHAYTvTO5d4S8M=$" < delv.out.test$n > /dev/null || ret=1
-+  grep "T9/n48T75oZLEKtSkG/idCeeQlaLU=$" < delv.out.test$n > /dev/null || ret=1
-   if test `wc -l < delv.out.test$n` != 1 ; then ret=1 ; fi
-   f=`awk '{print NF}' < delv.out.test$n`
-   test "${f:-0}" -eq 4 || ret=1
-diff --git a/bin/tests/system/dlv/ns1/sign.sh b/bin/tests/system/dlv/ns1/sign.sh
-index 606e7cc..a3a0d60 100755
---- a/bin/tests/system/dlv/ns1/sign.sh
-+++ b/bin/tests/system/dlv/ns1/sign.sh
-@@ -23,8 +23,8 @@ infile=root.db.in
- zonefile=root.db
- outfile=root.signed
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 1024 -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 1024 -n zone $zone 2> /dev/null`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- 
-diff --git a/bin/tests/system/dlv/ns2/sign.sh b/bin/tests/system/dlv/ns2/sign.sh
-index 9825c57..202c978 100755
---- a/bin/tests/system/dlv/ns2/sign.sh
-+++ b/bin/tests/system/dlv/ns2/sign.sh
-@@ -24,8 +24,8 @@ zonefile=druz.db
- outfile=druz.pre
- dlvzone=utld.
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` 
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 1024 -n zone $zone 2> /dev/null` 
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 1024 -n zone $zone 2> /dev/null`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- 
-diff --git a/bin/tests/system/dlv/ns6/sign.sh b/bin/tests/system/dlv/ns6/sign.sh
-index 1e39862..4ed19ac 100755
---- a/bin/tests/system/dlv/ns6/sign.sh
-+++ b/bin/tests/system/dlv/ns6/sign.sh
-@@ -16,13 +16,15 @@ SYSTESTDIR=dlv
- 
- echo_i "dlv/ns6/sign.sh"
- 
+diff --git a/bin/tests/system/dlv/ns3/sign.sh b/bin/tests/system/dlv/ns3/sign.sh
+index fa51ae1..bc46942 100755
+--- a/bin/tests/system/dlv/ns3/sign.sh
++++ b/bin/tests/system/dlv/ns3/sign.sh
+@@ -19,6 +19,7 @@ echo_i "dlv/ns3/sign.sh"
+ dlvzone=dlv.utld.
+ dlvsets=
+ dssets=
 +bits=1024
-+
- zone=grand.child1.utld.
+ 
+ zone=child1.utld.
  infile=child.db.in
- zonefile=grand.child1.utld.db
- outfile=grand.child1.signed
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- 
-@@ -36,8 +38,8 @@ zonefile=grand.child3.utld.db
- outfile=grand.child3.signed
- dlvzone=dlv.utld.
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- 
-@@ -51,8 +53,8 @@ zonefile=grand.child4.utld.db
- outfile=grand.child4.signed
- dlvzone=dlv.utld.
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- 
-@@ -66,8 +68,8 @@ zonefile=grand.child5.utld.db
- outfile=grand.child5.signed
- dlvzone=dlv.utld.
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- 
-@@ -81,8 +83,8 @@ zonefile=grand.child7.utld.db
- outfile=grand.child7.signed
- dlvzone=dlv.utld.
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- 
-@@ -96,8 +98,8 @@ zonefile=grand.child8.utld.db
- outfile=grand.child8.signed
- dlvzone=dlv.utld.
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- 
-@@ -111,8 +113,8 @@ zonefile=grand.child9.utld.db
- outfile=grand.child9.signed
- dlvzone=dlv.utld.
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- 
-@@ -125,8 +127,8 @@ zonefile=grand.child10.utld.db
- outfile=grand.child10.signed
- dlvzone=dlv.utld.
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- 
-@@ -138,8 +140,8 @@ infile=child.db.in
- zonefile=grand.child1.druz.db
- outfile=grand.child1.druz.signed
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- 
-@@ -153,8 +155,8 @@ zonefile=grand.child3.druz.db
- outfile=grand.child3.druz.signed
- dlvzone=dlv.druz.
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- 
-@@ -168,8 +170,8 @@ zonefile=grand.child4.druz.db
- outfile=grand.child4.druz.signed
- dlvzone=dlv.druz.
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- 
-@@ -183,8 +185,8 @@ zonefile=grand.child5.druz.db
- outfile=grand.child5.druz.signed
- dlvzone=dlv.druz.
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- 
-@@ -198,8 +200,8 @@ zonefile=grand.child7.druz.db
- outfile=grand.child7.druz.signed
- dlvzone=dlv.druz.
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- 
-@@ -213,8 +215,8 @@ zonefile=grand.child8.druz.db
- outfile=grand.child8.druz.signed
- dlvzone=dlv.druz.
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- 
-@@ -228,8 +230,8 @@ zonefile=grand.child9.druz.db
- outfile=grand.child9.druz.signed
- dlvzone=dlv.druz.
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- 
-@@ -242,8 +244,8 @@ zonefile=grand.child10.druz.db
- outfile=grand.child10.druz.signed
- dlvzone=dlv.druz.
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- 
-diff --git a/bin/tests/system/dnssec/ns2/sign.sh b/bin/tests/system/dnssec/ns2/sign.sh
-index 13fb924..1ffa279 100644
---- a/bin/tests/system/dnssec/ns2/sign.sh
-+++ b/bin/tests/system/dnssec/ns2/sign.sh
-@@ -126,8 +126,8 @@ zone=in-addr.arpa.
- infile=in-addr.arpa.db.in
- zonefile=in-addr.arpa.db
- 
--keyname1=`$KEYGEN -q -r $RANDFILE -a DSA -b 768 -n zone $zone`
--keyname2=`$KEYGEN -q -r $RANDFILE -a DSA -b 768 -n zone $zone`
-+keyname1=`$KEYGEN -q -r $RANDFILE -a DSA -b 1024 -n zone $zone`
-+keyname2=`$KEYGEN -q -r $RANDFILE -a DSA -b 1024 -n zone $zone`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- $SIGNER -P -g -r $RANDFILE -o $zone -k $keyname1 $zonefile $keyname2 > /dev/null
-@@ -138,7 +138,7 @@ privzone=private.secure.example
- privinfile=private.secure.example.db.in
- privzonefile=private.secure.example.db
- 
--privkeyname=`$KEYGEN -q -r $RANDFILE -a RSAMD5 -b 768 -n zone $privzone`
-+privkeyname=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 1024 -n zone $privzone`
- 
- cat $privinfile $privkeyname.key >$privzonefile
- 
-@@ -152,7 +152,7 @@ dlvinfile=dlv.db.in
- dlvzonefile=dlv.db
- dlvsetfile=dlvset-${privzone}${TP}
- 
--dlvkeyname=`$KEYGEN -q -r $RANDFILE -a RSAMD5 -b 768 -n zone $dlvzone`
-+dlvkeyname=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 1024 -n zone $dlvzone`
- 
- cat $dlvinfile $dlvkeyname.key $dlvsetfile > $dlvzonefile
- 
-diff --git a/bin/tests/system/dnssec/ns5/trusted.conf.bad b/bin/tests/system/dnssec/ns5/trusted.conf.bad
-index ed30460..e6b1126 100644
---- a/bin/tests/system/dnssec/ns5/trusted.conf.bad
-+++ b/bin/tests/system/dnssec/ns5/trusted.conf.bad
-@@ -10,5 +10,5 @@
-  */
- 
- trusted-keys {
--    "." 256 3 1 "AQO6Cl+slAf+iuieDim9L3kujFHQD7s/IOj03ClMOpKYcTXtK4mRpuULVfvWxDi9Ew/gj0xLnnX7z9OJHIxLI+DSrAHd8Dm0XfBEAtVtJSn70GaPZgnLMw1rk5ap2DsEoWk=";
-+    "." 256 3 8 "AwEAAarwAdjV4gIhpBCjXVAScRFEx3co7k8smJdxrnqoGsl5NB7EZ9jRdgvCXbJn6v8y9jlNWVHvaC8ilhfhLh0A1vLWiWv4ijd/12xcnrY7xpG7Cu3YkxUxaXJ7Jdg/Iw1+9mGgXF1v4UbCIcw/3U3cxyk7OxYg+VSb5KBAQSR0upxV";
- };
-diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh
-index b31c1b4..a5e237b 100644
---- a/bin/tests/system/dnssec/tests.sh
-+++ b/bin/tests/system/dnssec/tests.sh
-@@ -3235,8 +3235,8 @@ do
- 	   alg=`expr $alg + 1`
- 	   continue;;
- 	3) size="-b 512";;
--	5) size="-b 512";;
--	6) size="-b 512";;
-+	5) size="-b 1024";;
-+	6) size="-b 1024";;
- 	7) size="-b 512";;
- 	8) size="-b 512";;
- 	10) size="-b 1024";;
 diff --git a/bin/tests/system/feature-test.c b/bin/tests/system/feature-test.c
-index c1249ed..20a3139 100644
+index 8b9deb6..ceb4fe8 100644
 --- a/bin/tests/system/feature-test.c
 +++ b/bin/tests/system/feature-test.c
 @@ -19,6 +19,7 @@
  #include <isc/print.h>
  #include <isc/util.h>
  #include <isc/net.h>
-+#include <isc/md5.h>
++#include <isc/md.h>
  #include <dns/edns.h>
  
  #ifdef WIN32
-@@ -47,6 +48,7 @@ usage() {
- 	fprintf(stderr, "	--have-geoip2\n");
- 	fprintf(stderr, "	--have-libxml2\n");
- 	fprintf(stderr, "	--ipv6only=no\n");
-+	fprintf(stderr, "       --md5\n");
- 	fprintf(stderr, "	--rpz-nsdname\n");
- 	fprintf(stderr, "	--rpz-nsip\n");
- 	fprintf(stderr, "	--with-idn\n");
-@@ -155,6 +157,18 @@ main(int argc, char **argv) {
+@@ -159,6 +160,18 @@ main(int argc, char **argv) {
  #endif
  	}
  
 +	if (strcmp(argv[1], "--md5") == 0) {
-+#ifdef PK11_MD5_DISABLE
-+		return (1);
-+#else
-+		if (isc_md5_available()) {
++		unsigned char digest[ISC_MAX_MD_SIZE];
++		const char test[] = test;
++
++		if (isc_md(ISC_MD_MD5, test, sizeof(test),
++		           digest, sizeof(digest)) == ISC_R_SUCCESS) {
 +			return (0);
 +		} else {
 +			return (1);
 +		}
-+#endif
 +	}
 +
- 	if (strcmp(argv[1], "--rpz-nsip") == 0) {
- #ifdef ENABLE_RPZ_NSIP
+ 	if (strcmp(argv[1], "--ipv6only=no") == 0) {
+ #ifdef WIN32
  		return (0);
-diff --git a/bin/tests/system/filter-aaaa/ns1/sign.sh b/bin/tests/system/filter-aaaa/ns1/sign.sh
-index f755581..4a7d890 100755
---- a/bin/tests/system/filter-aaaa/ns1/sign.sh
-+++ b/bin/tests/system/filter-aaaa/ns1/sign.sh
-@@ -21,8 +21,8 @@ infile=signed.db.in
- zonefile=signed.db.signed
- outfile=signed.db.signed
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 1024 -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 1024 -n zone $zone 2> /dev/null`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- 
-diff --git a/bin/tests/system/filter-aaaa/ns4/sign.sh b/bin/tests/system/filter-aaaa/ns4/sign.sh
-index f755581..4a7d890 100755
---- a/bin/tests/system/filter-aaaa/ns4/sign.sh
-+++ b/bin/tests/system/filter-aaaa/ns4/sign.sh
-@@ -21,8 +21,8 @@ infile=signed.db.in
- zonefile=signed.db.signed
- outfile=signed.db.signed
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 1024 -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 1024 -n zone $zone 2> /dev/null`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- 
 diff --git a/bin/tests/system/notify/ns5/named.conf.in b/bin/tests/system/notify/ns5/named.conf.in
-index cfcfe8f..0a1614d 100644
+index 2976bfc..256d846 100644
 --- a/bin/tests/system/notify/ns5/named.conf.in
 +++ b/bin/tests/system/notify/ns5/named.conf.in
 @@ -10,17 +10,17 @@
@@ -1065,7 +630,7 @@ index cfcfe8f..0a1614d 100644
  };
  
 diff --git a/bin/tests/system/notify/tests.sh b/bin/tests/system/notify/tests.sh
-index 1f6e6d0..c08bd25 100644
+index fb2eb74..0e45424 100644
 --- a/bin/tests/system/notify/tests.sh
 +++ b/bin/tests/system/notify/tests.sh
 @@ -212,16 +212,16 @@ ret=0
@@ -1089,22 +654,9 @@ index 1f6e6d0..c08bd25 100644
  	grep "test string" dig.out.b.ns5.test$n > /dev/null &&
  	grep "test string" dig.out.c.ns5.test$n > /dev/null &&
 diff --git a/bin/tests/system/nsupdate/ns1/named.conf.in b/bin/tests/system/nsupdate/ns1/named.conf.in
-index 1d999ad..26b6b7c 100644
+index e7b6adb..4ad5cc1 100644
 --- a/bin/tests/system/nsupdate/ns1/named.conf.in
 +++ b/bin/tests/system/nsupdate/ns1/named.conf.in
-@@ -32,7 +32,7 @@ controls {
- };
- 
- key altkey {
--	algorithm hmac-md5;
-+	algorithm hmac-sha512;
- 	secret "1234abcd8765";
- };
- 
-diff --git a/bin/tests/system/nsupdate/ns2/named.conf.in b/bin/tests/system/nsupdate/ns2/named.conf.in
-index 4549184..cb7dccd 100644
---- a/bin/tests/system/nsupdate/ns2/named.conf.in
-+++ b/bin/tests/system/nsupdate/ns2/named.conf.in
 @@ -33,7 +33,7 @@ controls {
  };
  
@@ -1114,29 +666,41 @@ index 4549184..cb7dccd 100644
  	secret "1234abcd8765";
  };
  
+diff --git a/bin/tests/system/nsupdate/ns2/named.conf.in b/bin/tests/system/nsupdate/ns2/named.conf.in
+index b703843..8bfe2b0 100644
+--- a/bin/tests/system/nsupdate/ns2/named.conf.in
++++ b/bin/tests/system/nsupdate/ns2/named.conf.in
+@@ -32,7 +32,7 @@ controls {
+ };
+ 
+ key altkey {
+-	algorithm hmac-md5;
++	algorithm hmac-sha512;
+ 	secret "1234abcd8765";
+ };
+ 
 diff --git a/bin/tests/system/nsupdate/setup.sh b/bin/tests/system/nsupdate/setup.sh
-index 21805c5..0d3d85c 100644
+index 5d70114..6c4b55a 100644
 --- a/bin/tests/system/nsupdate/setup.sh
 +++ b/bin/tests/system/nsupdate/setup.sh
-@@ -58,7 +58,12 @@ EOF
+@@ -56,7 +56,11 @@ EOF
  
- $DDNSCONFGEN -q -r $RANDFILE -z example.nil > ns1/ddns.key
+ $DDNSCONFGEN -q -z example.nil > ns1/ddns.key
  
--$DDNSCONFGEN -q -r $RANDFILE -a hmac-md5 -k md5-key -z keytests.nil > ns1/md5.key
+-$DDNSCONFGEN -q -a hmac-md5 -k md5-key -z keytests.nil > ns1/md5.key
 +if $FEATURETEST --md5; then
-+	$DDNSCONFGEN -q -r $RANDFILE -a hmac-md5 -k md5-key -z keytests.nil > ns1/md5.key
++	$DDNSCONFGEN -q -a hmac-md5 -k md5-key -z keytests.nil > ns1/md5.key
 +else
 +	echo -n > ns1/md5.key
 +fi
-+
- $DDNSCONFGEN -q -r $RANDFILE -a hmac-sha1 -k sha1-key -z keytests.nil > ns1/sha1.key
- $DDNSCONFGEN -q -r $RANDFILE -a hmac-sha224 -k sha224-key -z keytests.nil > ns1/sha224.key
- $DDNSCONFGEN -q -r $RANDFILE -a hmac-sha256 -k sha256-key -z keytests.nil > ns1/sha256.key
+ $DDNSCONFGEN -q -a hmac-sha1 -k sha1-key -z keytests.nil > ns1/sha1.key
+ $DDNSCONFGEN -q -a hmac-sha224 -k sha224-key -z keytests.nil > ns1/sha224.key
+ $DDNSCONFGEN -q -a hmac-sha256 -k sha256-key -z keytests.nil > ns1/sha256.key
 diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh
-index 4da4849..b3bc807 100755
+index dd0286f..906135c 100755
 --- a/bin/tests/system/nsupdate/tests.sh
 +++ b/bin/tests/system/nsupdate/tests.sh
-@@ -708,7 +708,14 @@ fi
+@@ -700,7 +700,14 @@ fi
  n=`expr $n + 1`
  ret=0
  echo_i "check TSIG key algorithms ($n)"
@@ -1152,7 +716,7 @@ index 4da4849..b3bc807 100755
      $NSUPDATE -k ns1/${alg}.key <<END > /dev/null || ret=1
  server 10.53.0.1 ${PORT}
  update add ${alg}.keytests.nil. 600 A 10.10.10.3
-@@ -716,7 +723,7 @@ send
+@@ -708,7 +715,7 @@ send
  END
  done
  sleep 2
@@ -1162,10 +726,10 @@ index 4da4849..b3bc807 100755
  done
  if [ $ret -ne 0 ]; then
 diff --git a/bin/tests/system/rndc/setup.sh b/bin/tests/system/rndc/setup.sh
-index 343869e..c30efb0 100644
+index cb64dd9..c9b2447 100644
 --- a/bin/tests/system/rndc/setup.sh
 +++ b/bin/tests/system/rndc/setup.sh
-@@ -37,7 +37,7 @@ make_key () {
+@@ -35,7 +35,7 @@ make_key () {
              sed 's/allow { 10.53.0.4/allow { any/' >> ns4/named.conf
  }
  
@@ -1175,10 +739,10 @@ index 343869e..c30efb0 100644
  make_key 3 ${EXTRAPORT3} hmac-sha224
  make_key 4 ${EXTRAPORT4} hmac-sha256
 diff --git a/bin/tests/system/rndc/tests.sh b/bin/tests/system/rndc/tests.sh
-index 57e066d..186a723 100644
+index 7cbe2c7..b8cc6a0 100644
 --- a/bin/tests/system/rndc/tests.sh
 +++ b/bin/tests/system/rndc/tests.sh
-@@ -348,15 +348,20 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
+@@ -356,15 +356,20 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
  status=`expr $status + $ret`
  
  n=`expr $n + 1`
@@ -1208,15 +772,6 @@ index 57e066d..186a723 100644
  
  n=`expr $n + 1`
  echo_i "testing rndc with hmac-sha1 ($n)"
-diff --git a/bin/tests/system/tsig/clean.sh b/bin/tests/system/tsig/clean.sh
-index 576ec70..cb7a852 100644
---- a/bin/tests/system/tsig/clean.sh
-+++ b/bin/tests/system/tsig/clean.sh
-@@ -20,3 +20,4 @@ rm -f */named.run
- rm -f ns*/named.lock
- rm -f Kexample.net.+163+*
- rm -f keygen.out?
-+rm -f ns1/named.conf
 diff --git a/bin/tests/system/tsig/ns1/named.conf.in b/bin/tests/system/tsig/ns1/named.conf.in
 index fbf30c6..f61657d 100644
 --- a/bin/tests/system/tsig/ns1/named.conf.in
@@ -1246,20 +801,20 @@ index fbf30c6..f61657d 100644
  key "sha1-trunc" {
  	secret "FrSt77yPTFx6hTs4i2tKLB9LmE0=";
 diff --git a/bin/tests/system/tsig/setup.sh b/bin/tests/system/tsig/setup.sh
-index 4dd4a25..aa0f966 100644
+index b3e0450..90a6ce4 100644
 --- a/bin/tests/system/tsig/setup.sh
 +++ b/bin/tests/system/tsig/setup.sh
-@@ -17,3 +17,8 @@ $SHELL clean.sh
- copy_setports ns1/named.conf.in ns1/named.conf
+@@ -15,3 +15,8 @@ SYSTEMTESTTOP=..
+ $SHELL clean.sh
  
- test -r $RANDFILE || $GENRANDOM $RANDOMSIZE $RANDFILE
+ copy_setports ns1/named.conf.in ns1/named.conf
 +
 +if $FEATURETEST --md5
 +then
 +	cat ns1/rndc5.conf.in >> ns1/named.conf
 +fi
 diff --git a/bin/tests/system/tsig/tests.sh b/bin/tests/system/tsig/tests.sh
-index f731fa6..cade35b 100644
+index 3a720de..e20e7f9 100644
 --- a/bin/tests/system/tsig/tests.sh
 +++ b/bin/tests/system/tsig/tests.sh
 @@ -26,20 +26,25 @@ sha512="jI/Pa4qRu96t76Pns5Z/Ndxbn3QCkwcxLOgt9vgvnJw5wqTRvNyk3FtD6yIMd1dWVlqZ+Y4f
@@ -1350,19 +905,8 @@ index f731fa6..cade35b 100644
  fi
  
  echo_i "fetching using hmac-sha1-80 (BADTRUNC)"
-diff --git a/bin/tests/system/tsiggss/setup.sh b/bin/tests/system/tsiggss/setup.sh
-index 0d21c7b..dbcb7b4 100644
---- a/bin/tests/system/tsiggss/setup.sh
-+++ b/bin/tests/system/tsiggss/setup.sh
-@@ -18,5 +18,5 @@ test -r $RANDFILE || $GENRANDOM $RANDOMSIZE $RANDFILE
- 
- copy_setports ns1/named.conf.in ns1/named.conf
- 
--key=`$KEYGEN -Cq -K ns1 -a DSA -b 512 -r $RANDFILE -n HOST -T KEY key.example.nil.`
-+key=`$KEYGEN -Cq -K ns1 -a DSA -b 1024 -r $RANDFILE -n HOST -T KEY key.example.nil.`
- cat ns1/example.nil.db.in ns1/${key}.key > ns1/example.nil.db
 diff --git a/bin/tests/system/upforwd/ns1/named.conf.in b/bin/tests/system/upforwd/ns1/named.conf.in
-index e0a30cd..6a77b1c 100644
+index ea42b4d..08676da 100644
 --- a/bin/tests/system/upforwd/ns1/named.conf.in
 +++ b/bin/tests/system/upforwd/ns1/named.conf.in
 @@ -10,7 +10,7 @@
@@ -1387,22 +931,6 @@ index b0694bb..9adae82 100644
  server 10.53.0.3 ${PORT}
  update add updated.example. 600 A 10.10.10.1
  update add updated.example. 600 TXT Foo
-diff --git a/bin/tests/system/tsig/ns1/rndc5.conf.in b/bin/tests/system/tsig/ns1/rndc5.conf.in
-new file mode 100644
-index 0000000..0682194
---- /dev/null
-+++ b/bin/tests/system/tsig/ns1/rndc5.conf.in
-@@ -0,0 +1,10 @@
-+# Conditionally included when support for MD5 is available
-+key "md5" {
-+	secret "97rnFx24Tfna4mHPfgnerA==";
-+	algorithm hmac-md5;
-+};
-+
-+key "md5-trunc" {
-+	secret "97rnFx24Tfna4mHPfgnerA==";
-+	algorithm hmac-md5-80;
-+};
 -- 
 2.20.1
 
diff --git a/bind-9.11-host-idn-disable.patch b/bind-9.11-host-idn-disable.patch
deleted file mode 100644
index 7f02b4c..0000000
--- a/bind-9.11-host-idn-disable.patch
+++ /dev/null
@@ -1,92 +0,0 @@
-From ec50eff97c259b5bfbfa4e050d69fe7b39b0f15a Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Tue, 25 Sep 2018 18:08:46 +0200
-Subject: [PATCH] Disable IDN from environment as documented
-
-Manual page of host contained instructions to disable IDN processing
-when it was built with libidn2. When refactoring IDN support however,
-support for disabling IDN in host and nslookup was lost. Use also
-environment variable and document it for nslookup, host and dig.
-
-Support variable CHARSET=ASCII to disable IDN, supported in downstream
-RH patch since RHEL 5.
----
- bin/dig/dig.docbook      |  4 +++-
- bin/dig/dighost.c        |  5 +++++
- bin/dig/host.docbook     |  2 +-
- bin/dig/nslookup.docbook | 15 +++++++++++++++
- 4 files changed, 24 insertions(+), 2 deletions(-)
-
-diff --git a/bin/dig/dig.docbook b/bin/dig/dig.docbook
-index 5d19301..933af79 100644
---- a/bin/dig/dig.docbook
-+++ b/bin/dig/dig.docbook
-@@ -1312,7 +1312,9 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
-       reply from the server.
-       If you'd like to turn off the IDN support for some reason, use
-       parameters <parameter>+noidnin</parameter> and
--      <parameter>+noidnout</parameter>.
-+      <parameter>+noidnout</parameter> or define
-+      the <envar>IDN_DISABLE</envar> environment variable.
-+
-     </para>
-   </refsection>
- 
-diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
-index 5eabc1f..73aaab8 100644
---- a/bin/dig/dighost.c
-+++ b/bin/dig/dighost.c
-@@ -826,6 +826,11 @@ make_empty_lookup(void) {
- 	looknew->badcookie = true;
- #ifdef WITH_IDN_SUPPORT
- 	looknew->idnin = isatty(1)?(getenv("IDN_DISABLE") == NULL):false;
-+	if (looknew->idnin) {
-+		const char *charset = getenv("CHARSET");
-+		if (charset && !strcmp(charset, "ASCII"))
-+			looknew->idnin = false;
-+	}
- #else
- 	looknew->idnin = false;
- #endif
-diff --git a/bin/dig/host.docbook b/bin/dig/host.docbook
-index da0f8fb..9689b5a 100644
---- a/bin/dig/host.docbook
-+++ b/bin/dig/host.docbook
-@@ -379,7 +379,7 @@
-       <command>host</command> appropriately converts character encoding of
-       domain name before sending a request to DNS server or displaying a
-       reply from the server.
--      If you'd like to turn off the IDN support for some reason, defines
-+      If you'd like to turn off the IDN support for some reason, define
-       the <envar>IDN_DISABLE</envar> environment variable.
-       The IDN support is disabled if the variable is set when
-       <command>host</command> runs.
-diff --git a/bin/dig/nslookup.docbook b/bin/dig/nslookup.docbook
-index d46fc2d..6d7d181 100644
---- a/bin/dig/nslookup.docbook
-+++ b/bin/dig/nslookup.docbook
-@@ -495,6 +495,21 @@ nslookup -query=hinfo  -timeout=10
-     </para>
-   </refsection>
- 
-+  <refsection><info><title>IDN SUPPORT</title></info>
-+
-+    <para>
-+      If <command>nslookup</command> has been built with IDN (internationalized
-+      domain name) support, it can accept and display non-ASCII domain names.
-+      <command>nslookup</command> appropriately converts character encoding of
-+      domain name before sending a request to DNS server or displaying a
-+      reply from the server.
-+      If you'd like to turn off the IDN support for some reason, define
-+      the <envar>IDN_DISABLE</envar> environment variable.
-+      The IDN support is disabled if the variable is set when
-+      <command>nslookup</command> runs.
-+    </para>
-+  </refsection>
-+
-   <refsection><info><title>FILES</title></info>
- 
-     <para><filename>/etc/resolv.conf</filename>
--- 
-2.20.1
-
diff --git a/bind-9.11-rh1624100.patch b/bind-9.11-rh1624100.patch
deleted file mode 100644
index 5764ed7..0000000
--- a/bind-9.11-rh1624100.patch
+++ /dev/null
@@ -1,288 +0,0 @@
-From 76594cba9a1e910bb36160d96fc3872349341799 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@sury.org>
-Date: Wed, 25 Apr 2018 14:04:31 +0200
-Subject: [PATCH] Replace isc_safe routines with their OpenSSL counter parts
-
-(cherry picked from commit 66ba2fdad583d962a1f4971c85d58381f0849e4d)
-
-Remove isc_safe_memcompare, it's not needed anywhere and can't be replaced with CRYPTO_memcmp()
-
-(cherry picked from commit b105ccee68ccc3c18e6ea530063b3c8e5a42571c)
-
-Fix the isc_safe_memwipe() usage with (NULL, >0)
-
-(cherry picked from commit 083461d3329ff6f2410745848a926090586a9846)
----
- bin/dnssec/dnssec-signzone.c |  2 +-
- lib/dns/nsec3.c              |  4 +-
- lib/dns/spnego.c             |  4 +-
- lib/isc/Makefile.in          |  8 +---
- lib/isc/include/isc/safe.h   | 18 ++------
- lib/isc/safe.c               | 83 ------------------------------------
- lib/isc/tests/safe_test.c    | 18 --------
- 7 files changed, 11 insertions(+), 126 deletions(-)
- delete mode 100644 lib/isc/safe.c
-
-diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c
-index 6ddaebe..d921870 100644
---- a/bin/dnssec/dnssec-signzone.c
-+++ b/bin/dnssec/dnssec-signzone.c
-@@ -787,7 +787,7 @@ hashlist_add_dns_name(hashlist_t *l, /*const*/ dns_name_t *name,
- 
- static int
- hashlist_comp(const void *a, const void *b) {
--	return (isc_safe_memcompare(a, b, hash_length + 1));
-+	return (memcmp(a, b, hash_length + 1));
- }
- 
- static void
-diff --git a/lib/dns/nsec3.c b/lib/dns/nsec3.c
-index 6ae7ca8..01426d6 100644
---- a/lib/dns/nsec3.c
-+++ b/lib/dns/nsec3.c
-@@ -1963,7 +1963,7 @@ dns_nsec3_noexistnodata(dns_rdatatype_t type, dns_name_t* name,
- 	 * Work out what this NSEC3 covers.
- 	 * Inside (<0) or outside (>=0).
- 	 */
--	scope = isc_safe_memcompare(owner, nsec3.next, nsec3.next_length);
-+	scope = memcmp(owner, nsec3.next, nsec3.next_length);
- 
- 	/*
- 	 * Prepare to compute all the hashes.
-@@ -1987,7 +1987,7 @@ dns_nsec3_noexistnodata(dns_rdatatype_t type, dns_name_t* name,
- 			return (ISC_R_IGNORE);
- 		}
- 
--		order = isc_safe_memcompare(hash, owner, length);
-+		order = memcmp(hash, owner, length);
- 		if (first && order == 0) {
- 			/*
- 			 * The hashes are the same.
-diff --git a/lib/dns/spnego.c b/lib/dns/spnego.c
-index ad77f24..670982a 100644
---- a/lib/dns/spnego.c
-+++ b/lib/dns/spnego.c
-@@ -371,7 +371,7 @@ gssapi_spnego_decapsulate(OM_uint32 *,
- 
- /* mod_auth_kerb.c */
- 
--static int
-+static isc_boolean_t
- cmp_gss_type(gss_buffer_t token, gss_OID gssoid)
- {
- 	unsigned char *p;
-@@ -395,7 +395,7 @@ cmp_gss_type(gss_buffer_t token, gss_OID gssoid)
- 	if (((OM_uint32) *p++) != gssoid->length)
- 		return (GSS_S_DEFECTIVE_TOKEN);
- 
--	return (isc_safe_memcompare(p, gssoid->elements, gssoid->length));
-+	return (!isc_safe_memequal(p, gssoid->elements, gssoid->length));
- }
- 
- /* accept_sec_context.c */
-diff --git a/lib/isc/Makefile.in b/lib/isc/Makefile.in
-index 0fd0837..8ad54bb 100644
---- a/lib/isc/Makefile.in
-+++ b/lib/isc/Makefile.in
-@@ -60,7 +60,7 @@ OBJS =		@ISC_EXTRA_OBJS@ @ISC_PK11_O@ @ISC_PK11_RESULT_O@ \
- 		parseint.@O@ portset.@O@ quota.@O@ radix.@O@ random.@O@ \
- 		ratelimiter.@O@ refcount.@O@ region.@O@ regex.@O@ result.@O@ \
- 		rwlock.@O@ \
--		safe.@O@ serial.@O@ siphash.@O@ sha1.@O@ sha2.@O@ sockaddr.@O@ stats.@O@ \
-+		serial.@O@ siphash.@O@ sha1.@O@ sha2.@O@ sockaddr.@O@ stats.@O@ \
- 		string.@O@ strtoul.@O@ symtab.@O@ task.@O@ taskpool.@O@ \
- 		tm.@O@ timer.@O@ version.@O@ \
- 		${UNIXOBJS} ${NLSOBJS} ${THREADOBJS}
-@@ -79,7 +79,7 @@ SRCS =		@ISC_EXTRA_SRCS@ @ISC_PK11_C@ @ISC_PK11_RESULT_C@ \
- 		netaddr.c netscope.c pool.c ondestroy.c \
- 		parseint.c portset.c quota.c radix.c random.c ${CHACHASRCS} \
- 		ratelimiter.c refcount.c region.c regex.c result.c rwlock.c \
--		safe.c serial.c siphash.c sha1.c sha2.c sockaddr.c stats.c string.c \
-+		serial.c siphash.c sha1.c sha2.c sockaddr.c stats.c string.c \
- 		strtoul.c symtab.c task.c taskpool.c timer.c \
- 		tm.c version.c
- 
-@@ -95,10 +95,6 @@ TESTDIRS =	@UNITTESTS@
- 
- @BIND9_MAKE_RULES@
- 
--safe.@O@: safe.c
--	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} @CCNOOPT@ \
--		-c ${srcdir}/safe.c
--
- version.@O@: version.c
- 	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} \
- 		-DVERSION=\"${VERSION}\" \
-diff --git a/lib/isc/include/isc/safe.h b/lib/isc/include/isc/safe.h
-index 66ed08b..88b8f47 100644
---- a/lib/isc/include/isc/safe.h
-+++ b/lib/isc/include/isc/safe.h
-@@ -15,29 +15,19 @@
- 
- /*! \file isc/safe.h */
- 
--#include <stdbool.h>
--
--#include <isc/types.h>
--#include <stdlib.h>
-+#include <isc/lang.h>
-+#include <openssl/crypto.h>
- 
- ISC_LANG_BEGINDECLS
- 
--bool
--isc_safe_memequal(const void *s1, const void *s2, size_t n);
-+#define isc_safe_memequal(s1, s2, n) !CRYPTO_memcmp(s1, s2, n)
- /*%<
-  * Returns true iff. two blocks of memory are equal, otherwise
-  * false.
-  *
-  */
- 
--int
--isc_safe_memcompare(const void *b1, const void *b2, size_t len);
--/*%<
-- * Clone of libc memcmp() which is safe to differential timing attacks.
-- */
--
--void
--isc_safe_memwipe(void *ptr, size_t len);
-+#define isc_safe_memwipe(ptr, len) OPENSSL_cleanse(ptr, len)
- /*%<
-  * Clear the memory of length `len` pointed to by `ptr`.
-  *
-diff --git a/lib/isc/safe.c b/lib/isc/safe.c
-deleted file mode 100644
-index 7a464b6..0000000
---- a/lib/isc/safe.c
-+++ /dev/null
-@@ -1,83 +0,0 @@
--/*
-- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-- *
-- * This Source Code Form is subject to the terms of the Mozilla Public
-- * License, v. 2.0. If a copy of the MPL was not distributed with this
-- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
-- *
-- * See the COPYRIGHT file distributed with this work for additional
-- * information regarding copyright ownership.
-- */
--
--/*! \file */
--
--#include <config.h>
--
--#include <stdbool.h>
--
--#include <isc/safe.h>
--#include <isc/string.h>
--#include <isc/util.h>
--
--#ifdef WIN32
--#include <windows.h>
--#endif
--
--#ifdef _MSC_VER
--#pragma optimize("", off)
--#endif
--
--bool
--isc_safe_memequal(const void *s1, const void *s2, size_t n) {
--	uint8_t acc = 0;
--
--	if (n != 0U) {
--		const uint8_t *p1 = s1, *p2 = s2;
--
--		do {
--			acc |= *p1++ ^ *p2++;
--		} while (--n != 0U);
--	}
--	return (acc == 0);
--}
--
--
--int
--isc_safe_memcompare(const void *b1, const void *b2, size_t len) {
--	const unsigned char *p1 = b1, *p2 = b2;
--	size_t i;
--	int res = 0, done = 0;
--
--	for (i = 0; i < len; i++) {
--		/* lt is -1 if p1[i] < p2[i]; else 0. */
--		int lt = (p1[i] - p2[i]) >> CHAR_BIT;
--
--		/* gt is -1 if p1[i] > p2[i]; else 0. */
--		int gt = (p2[i] - p1[i]) >> CHAR_BIT;
--
--		/* cmp is 1 if p1[i] > p2[i]; -1 if p1[i] < p2[i]; else 0. */
--		int cmp = lt - gt;
--
--		/* set res = cmp if !done. */
--		res |= cmp & ~done;
--
--		/* set done if p1[i] != p2[i]. */
--		done |= lt | gt;
--	}
--
--	return (res);
--}
--
--void
--isc_safe_memwipe(void *ptr, size_t len) {
--	if (ISC_UNLIKELY(ptr == NULL || len == 0))
--		return;
--
--#ifdef WIN32
--	SecureZeroMemory(ptr, len);
--#elif HAVE_EXPLICIT_BZERO
--	explicit_bzero(ptr, len);
--#else
--	memset(ptr, 0, len);
--#endif
--}
-diff --git a/lib/isc/tests/safe_test.c b/lib/isc/tests/safe_test.c
-index 266ac75..60e9181 100644
---- a/lib/isc/tests/safe_test.c
-+++ b/lib/isc/tests/safe_test.c
-@@ -45,22 +45,6 @@ isc_safe_memequal_test(void **state) {
- 				       "\x00\x00\x00\x00", 4));
- }
- 
--/* test isc_safe_memcompare() */
--static void
--isc_safe_memcompare_test(void **state) {
--	UNUSED(state);
--
--	assert_int_equal(isc_safe_memcompare("test", "test", 4), 0);
--	assert_true(isc_safe_memcompare("test", "tesc", 4) > 0);
--	assert_true(isc_safe_memcompare("test", "tesy", 4) < 0);
--	assert_int_equal(isc_safe_memcompare("\x00\x00\x00\x00",
--					     "\x00\x00\x00\x00", 4), 0);
--	assert_true(isc_safe_memcompare("\x00\x00\x00\x00",
--					"\x00\x00\x00\x01", 4) < 0);
--	assert_true(isc_safe_memcompare("\x00\x00\x00\x02",
--					"\x00\x00\x00\x00", 4) > 0);
--}
--
- /* test isc_safe_memwipe() */
- static void
- isc_safe_memwipe_test(void **state) {
-@@ -69,7 +53,6 @@ isc_safe_memwipe_test(void **state) {
- 	/* These should pass. */
- 	isc_safe_memwipe(NULL, 0);
- 	isc_safe_memwipe((void *) -1, 0);
--	isc_safe_memwipe(NULL, 42);
- 
- 	/*
- 	 * isc_safe_memwipe(ptr, size) should function same as
-@@ -108,7 +91,6 @@ main(void) {
- 	const struct CMUnitTest tests[] = {
- 		cmocka_unit_test(isc_safe_memequal_test),
- 		cmocka_unit_test(isc_safe_memwipe_test),
--		cmocka_unit_test(isc_safe_memcompare_test),
- 	};
- 
- 	return (cmocka_run_group_tests(tests, NULL, NULL));
--- 
-2.20.1
-
diff --git a/bind-9.11-rh1663318.patch b/bind-9.11-rh1663318.patch
deleted file mode 100644
index 1af7efb..0000000
--- a/bind-9.11-rh1663318.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-From b16a1ff25644bb075f454afe68ee63f6f385ca9c Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Wed, 23 Jan 2019 21:11:07 +0100
-Subject: [PATCH] Made RAND_status check optional (broke --disable-crypto-rand)
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Unlike upstream, skip it also for DHCP.
-
-Disable RAND_status also in non-threaded builds. DHCP is built without
-threads and should not check RAND_status on dns library initialization.
-Lack of entropy is possible state for dhclient, but it must not fail
-even in this case. Because DHCP itself does not require custom random
-generator, leave default RAND_OpenSSL configured. It should help TLS
-connection to LDAP in single DHCP binary, while keeping secure random
-data if needed.
-
-(modified upstream commit 8a98277811ea50035ff37b744fa3dc5b75bee099)
-
-Signed-off-by: Petr Menšík <pemensik@redhat.com>
----
- lib/dns/openssl_link.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/lib/dns/openssl_link.c b/lib/dns/openssl_link.c
-index 7a233dd..941eb17 100644
---- a/lib/dns/openssl_link.c
-+++ b/lib/dns/openssl_link.c
-@@ -289,6 +289,7 @@ dst__openssl_init(const char *engine) {
- #endif
- #endif /* !defined(OPENSSL_NO_ENGINE) */
- 
-+#if defined(ISC_PLATFORM_CRYPTORANDOM) && defined(ISC_PLATFORM_USETHREADS)
- 	/* Protect ourselves against unseeded PRNG */
- 	if (RAND_status() != 1) {
- 		FATAL_ERROR(__FILE__, __LINE__,
-@@ -296,6 +297,7 @@ dst__openssl_init(const char *engine) {
- 			    "cannot be initialized (see the `PRNG not "
- 			    "seeded' message in the OpenSSL FAQ)");
- 	}
-+#endif
- 
- 	return (ISC_R_SUCCESS);
- 
--- 
-2.20.1
-
diff --git a/bind-9.11-rt31459.patch b/bind-9.11-rt31459.patch
index efcc6fa..587fc28 100644
--- a/bind-9.11-rt31459.patch
+++ b/bind-9.11-rt31459.patch
@@ -1,4 +1,4 @@
-From e83a6723d84e4c4400ca646077393a24b092c623 Mon Sep 17 00:00:00 2001
+From 31612e4f76eeb07d0fffa33814ce5edef04b286a Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Tue, 12 Sep 2017 19:05:46 -0700
 Subject: [PATCH] rebased rt31459c
@@ -13,383 +13,24 @@ DNS_OPENSSL_LIBS -> DST_OPENSSL_LIBS
 
 Include new unit test
 ---
- bin/confgen/keygen.c                     |   7 +
- bin/dnssec/dnssec-dsfromkey.c            |   8 +-
- bin/dnssec/dnssec-importkey.c            |   8 +-
- bin/dnssec/dnssec-revoke.c               |   8 +-
- bin/dnssec/dnssec-settime.c              |   8 +-
- bin/dnssec/dnssec-signzone.c             |  11 +-
- bin/dnssec/dnssec-verify.c               |   8 +-
- bin/dnssec/dnssectool.c                  |  11 +-
- bin/named/server.c                       |   6 +
- bin/nsupdate/nsupdate.c                  |  14 +-
- bin/tests/makejournal.c                  |   6 +-
- bin/tests/system/pipelined/pipequeries.c |  20 +-
- bin/tests/system/pipelined/tests.sh      |   4 +-
- bin/tests/system/rsabigexponent/bigkey.c |   4 +
- bin/tests/system/tkey/keycreate.c        |  26 ++-
- bin/tests/system/tkey/keydelete.c        |  26 ++-
- bin/tests/system/tkey/tests.sh           |   8 +-
- bin/tools/mdig.c                         |   3 +-
- configure                                | 250 +++++++++++++----------
- configure.ac                             |  77 ++++++-
- lib/dns/dst_api.c                        |  21 +-
- lib/dns/include/dst/dst.h                |   8 +
- lib/dns/lib.c                            |  15 +-
- lib/dns/openssl_link.c                   |  72 ++++++-
- lib/dns/pkcs11.c                         |  29 ++-
- lib/dns/tests/Kyuafile                   |   1 +
- lib/dns/tests/Makefile.in                |   7 +
- lib/dns/tests/dstrandom_test.c           | 115 +++++++++++
- lib/dns/win32/libdns.def.in              |   7 +
- lib/isc/entropy.c                        |  24 +++
- lib/isc/include/isc/entropy.h            |  12 ++
- lib/isc/include/isc/platform.h.in        |   5 +
- lib/isc/include/isc/types.h              |   2 +
- lib/isc/pk11.c                           |  12 +-
- lib/isc/win32/include/isc/platform.h.in  |   5 +
- win32utils/Configure                     |  28 ++-
- 36 files changed, 701 insertions(+), 175 deletions(-)
- create mode 100644 lib/dns/tests/dstrandom_test.c
+ bin/tests/system/pipelined/pipequeries.c |  1 +
+ bin/tests/system/pipelined/tests.sh      |  4 +-
+ bin/tests/system/tkey/keycreate.c        |  1 +
+ bin/tests/system/tkey/keydelete.c        |  1 +
+ bin/tests/system/tkey/tests.sh           |  8 +-
+ configure                                | 97 ++++++++++--------------
+ lib/dns/include/dst/dst.h                |  8 ++
+ lib/dns/lib.c                            |  1 +
+ lib/dns/tests/Makefile.in                |  5 ++
+ lib/isc/include/isc/types.h              |  2 +
+ win32utils/Configure                     |  4 +-
+ 11 files changed, 66 insertions(+), 66 deletions(-)
 
-diff --git a/bin/confgen/keygen.c b/bin/confgen/keygen.c
-index 5015abb..295e16f 100644
---- a/bin/confgen/keygen.c
-+++ b/bin/confgen/keygen.c
-@@ -165,6 +165,13 @@ generate_key(isc_mem_t *mctx, const char *randomfile, dns_secalg_t alg,
- 		randomfile = NULL;
- 		open_keyboard = ISC_ENTROPY_KEYBOARDYES;
- 	}
-+#ifdef ISC_PLATFORM_CRYPTORANDOM
-+	if (randomfile != NULL &&
-+	    strcmp(randomfile, ISC_PLATFORM_CRYPTORANDOM) == 0) {
-+		randomfile = NULL;
-+		isc_entropy_usehook(ectx, true);
-+	}
-+#endif
- 	DO("start entropy source", isc_entropy_usebestsource(ectx,
- 							     &entropy_source,
- 							     randomfile,
-diff --git a/bin/dnssec/dnssec-dsfromkey.c b/bin/dnssec/dnssec-dsfromkey.c
-index d9d6bb9..de4b15f 100644
---- a/bin/dnssec/dnssec-dsfromkey.c
-+++ b/bin/dnssec/dnssec-dsfromkey.c
-@@ -498,14 +498,14 @@ main(int argc, char **argv) {
- 
- 	if (ectx == NULL)
- 		setup_entropy(mctx, NULL, &ectx);
--	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
--	if (result != ISC_R_SUCCESS)
--		fatal("could not initialize hash");
- 	result = dst_lib_init(mctx, ectx,
- 			      ISC_ENTROPY_BLOCKING | ISC_ENTROPY_GOODONLY);
- 	if (result != ISC_R_SUCCESS)
- 		fatal("could not initialize dst: %s",
- 		      isc_result_totext(result));
-+	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
-+	if (result != ISC_R_SUCCESS)
-+		fatal("could not initialize hash");
- 	isc_entropy_stopcallbacksources(ectx);
- 
- 	setup_logging(mctx, &log);
-@@ -574,8 +574,8 @@ main(int argc, char **argv) {
- 	if (dns_rdataset_isassociated(&rdataset))
- 		dns_rdataset_disassociate(&rdataset);
- 	cleanup_logging(&log);
--	dst_lib_destroy();
- 	isc_hash_destroy();
-+	dst_lib_destroy();
- 	cleanup_entropy(&ectx);
- 	dns_name_destroy();
- 	if (verbose > 10)
-diff --git a/bin/dnssec/dnssec-importkey.c b/bin/dnssec/dnssec-importkey.c
-index d65a514..04b3094 100644
---- a/bin/dnssec/dnssec-importkey.c
-+++ b/bin/dnssec/dnssec-importkey.c
-@@ -404,14 +404,14 @@ main(int argc, char **argv) {
- 
- 	if (ectx == NULL)
- 		setup_entropy(mctx, NULL, &ectx);
--	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
--	if (result != ISC_R_SUCCESS)
--		fatal("could not initialize hash");
- 	result = dst_lib_init(mctx, ectx,
- 			      ISC_ENTROPY_BLOCKING | ISC_ENTROPY_GOODONLY);
- 	if (result != ISC_R_SUCCESS)
- 		fatal("could not initialize dst: %s",
- 		      isc_result_totext(result));
-+	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
-+	if (result != ISC_R_SUCCESS)
-+		fatal("could not initialize hash");
- 	isc_entropy_stopcallbacksources(ectx);
- 
- 	setup_logging(mctx, &log);
-@@ -455,8 +455,8 @@ main(int argc, char **argv) {
- 	if (dns_rdataset_isassociated(&rdataset))
- 		dns_rdataset_disassociate(&rdataset);
- 	cleanup_logging(&log);
--	dst_lib_destroy();
- 	isc_hash_destroy();
-+	dst_lib_destroy();
- 	cleanup_entropy(&ectx);
- 	dns_name_destroy();
- 	if (verbose > 10)
-diff --git a/bin/dnssec/dnssec-revoke.c b/bin/dnssec/dnssec-revoke.c
-index 7d82dbf..10f9359 100644
---- a/bin/dnssec/dnssec-revoke.c
-+++ b/bin/dnssec/dnssec-revoke.c
-@@ -184,14 +184,14 @@ main(int argc, char **argv) {
- 
- 	if (ectx == NULL)
- 		setup_entropy(mctx, NULL, &ectx);
--	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
--	if (result != ISC_R_SUCCESS)
--		fatal("Could not initialize hash");
- 	result = dst_lib_init2(mctx, ectx, engine,
- 			       ISC_ENTROPY_BLOCKING | ISC_ENTROPY_GOODONLY);
- 	if (result != ISC_R_SUCCESS)
- 		fatal("Could not initialize dst: %s",
- 		      isc_result_totext(result));
-+	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
-+	if (result != ISC_R_SUCCESS)
-+		fatal("Could not initialize hash");
- 	isc_entropy_stopcallbacksources(ectx);
- 
- 	result = dst_key_fromnamedfile(filename, dir,
-@@ -273,8 +273,8 @@ main(int argc, char **argv) {
- 
- cleanup:
- 	dst_key_free(&key);
--	dst_lib_destroy();
- 	isc_hash_destroy();
-+	dst_lib_destroy();
- 	cleanup_entropy(&ectx);
- 	if (verbose > 10)
- 		isc_mem_stats(mctx, stdout);
-diff --git a/bin/dnssec/dnssec-settime.c b/bin/dnssec/dnssec-settime.c
-index 7afcaee..1cfa511 100644
---- a/bin/dnssec/dnssec-settime.c
-+++ b/bin/dnssec/dnssec-settime.c
-@@ -380,14 +380,14 @@ main(int argc, char **argv) {
- 
- 	if (ectx == NULL)
- 		setup_entropy(mctx, NULL, &ectx);
--	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
--	if (result != ISC_R_SUCCESS)
--		fatal("Could not initialize hash");
- 	result = dst_lib_init2(mctx, ectx, engine,
- 			       ISC_ENTROPY_BLOCKING | ISC_ENTROPY_GOODONLY);
- 	if (result != ISC_R_SUCCESS)
- 		fatal("Could not initialize dst: %s",
- 		      isc_result_totext(result));
-+	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
-+	if (result != ISC_R_SUCCESS)
-+		fatal("Could not initialize hash");
- 	isc_entropy_stopcallbacksources(ectx);
- 
- 	if (predecessor != NULL) {
-@@ -672,8 +672,8 @@ main(int argc, char **argv) {
- 	if (prevkey != NULL)
- 		dst_key_free(&prevkey);
- 	dst_key_free(&key);
--	dst_lib_destroy();
- 	isc_hash_destroy();
-+	dst_lib_destroy();
- 	cleanup_entropy(&ectx);
- 	if (verbose > 10)
- 		isc_mem_stats(mctx, stdout);
-diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c
-index 71f5672..9b100ca 100644
---- a/bin/dnssec/dnssec-signzone.c
-+++ b/bin/dnssec/dnssec-signzone.c
-@@ -3460,14 +3460,15 @@ main(int argc, char *argv[]) {
- 	if (!pseudorandom)
- 		eflags |= ISC_ENTROPY_GOODONLY;
- 
--	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
--	if (result != ISC_R_SUCCESS)
--		fatal("could not create hash context");
--
- 	result = dst_lib_init2(mctx, ectx, engine, eflags);
- 	if (result != ISC_R_SUCCESS)
- 		fatal("could not initialize dst: %s",
- 		      isc_result_totext(result));
-+
-+	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
-+	if (result != ISC_R_SUCCESS)
-+		fatal("could not create hash context");
-+
- 	isc_stdtime_get(&now);
- 
- 	if (startstr != NULL) {
-@@ -3879,8 +3880,8 @@ main(int argc, char *argv[]) {
- 	dns_master_styledestroy(&dsstyle, mctx);
- 
- 	cleanup_logging(&log);
--	dst_lib_destroy();
- 	isc_hash_destroy();
-+	dst_lib_destroy();
- 	cleanup_entropy(&ectx);
- 	dns_name_destroy();
- 	if (verbose > 10)
-diff --git a/bin/dnssec/dnssec-verify.c b/bin/dnssec/dnssec-verify.c
-index 4c293bf..3263cbc 100644
---- a/bin/dnssec/dnssec-verify.c
-+++ b/bin/dnssec/dnssec-verify.c
-@@ -281,15 +281,15 @@ main(int argc, char *argv[]) {
- 	if (ectx == NULL)
- 		setup_entropy(mctx, NULL, &ectx);
- 
--	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
--	if (result != ISC_R_SUCCESS)
--		fatal("could not create hash context");
--
- 	result = dst_lib_init2(mctx, ectx, engine, ISC_ENTROPY_BLOCKING);
- 	if (result != ISC_R_SUCCESS)
- 		fatal("could not initialize dst: %s",
- 		      isc_result_totext(result));
- 
-+	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
-+	if (result != ISC_R_SUCCESS)
-+		fatal("could not create hash context");
-+
- 	isc_stdtime_get(&now);
- 
- 	rdclass = strtoclass(classname);
-diff --git a/bin/dnssec/dnssectool.c b/bin/dnssec/dnssectool.c
-index 9d2a016..a9f90b6 100644
---- a/bin/dnssec/dnssectool.c
-+++ b/bin/dnssec/dnssectool.c
-@@ -34,6 +34,7 @@
- #include <isc/heap.h>
- #include <isc/list.h>
- #include <isc/mem.h>
-+#include <isc/platform.h>
- #include <isc/print.h>
- #include <isc/string.h>
- #include <isc/time.h>
-@@ -235,7 +236,8 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
- 	if (*ectx == NULL) {
- 		result = isc_entropy_create(mctx, ectx);
- 		if (result != ISC_R_SUCCESS)
--			fatal("could not create entropy object");
-+			fatal("could not create entropy object: %s",
-+			      isc_result_totext(result));
- 		ISC_LIST_INIT(sources);
- 	}
- 
-@@ -244,6 +246,13 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
- 		randomfile = NULL;
- 	}
- 
-+#ifdef ISC_PLATFORM_CRYPTORANDOM
-+	if (randomfile != NULL &&
-+	    strcmp(randomfile, ISC_PLATFORM_CRYPTORANDOM) == 0) {
-+		randomfile = NULL;
-+		isc_entropy_usehook(*ectx, true);
-+	}
-+#endif
- 	result = isc_entropy_usebestsource(*ectx, &source, randomfile,
- 					   usekeyboard);
- 
-diff --git a/bin/named/server.c b/bin/named/server.c
-index 5a860e4..21c340c 100644
---- a/bin/named/server.c
-+++ b/bin/named/server.c
-@@ -36,6 +36,7 @@
- #include <isc/lex.h>
- #include <isc/meminfo.h>
- #include <isc/parseint.h>
-+#include <isc/platform.h>
- #include <isc/portset.h>
- #include <isc/print.h>
- #include <isc/random.h>
-@@ -8217,6 +8218,10 @@ load_configuration(const char *filename, ns_server_t *server,
- 				      "no source of entropy found");
- 		} else {
- 			const char *randomdev = cfg_obj_asstring(obj);
-+#ifdef ISC_PLATFORM_CRYPTORANDOM
-+			if (strcmp(randomdev, ISC_PLATFORM_CRYPTORANDOM) == 0)
-+				isc_entropy_usehook(ns_g_entropy, true);
-+#else
- 			int level = ISC_LOG_ERROR;
- 			result = isc_entropy_createfilesource(ns_g_entropy,
- 							      randomdev);
-@@ -8251,6 +8256,7 @@ load_configuration(const char *filename, ns_server_t *server,
- 				}
- 				isc_entropy_detach(&ns_g_fallbackentropy);
- 			}
-+#endif
- #endif
- 		}
- 
-diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
-index bbb3936..0286987 100644
---- a/bin/nsupdate/nsupdate.c
-+++ b/bin/nsupdate/nsupdate.c
-@@ -272,7 +272,8 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
- 	if (*ectx == NULL) {
- 		result = isc_entropy_create(mctx, ectx);
- 		if (result != ISC_R_SUCCESS)
--			fatal("could not create entropy object");
-+			fatal("could not create entropy object: %s",
-+			      isc_result_totext(result));
- 		ISC_LIST_INIT(sources);
- 	}
- 
-@@ -281,6 +282,13 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
- 		randomfile = NULL;
- 	}
- 
-+#ifdef ISC_PLATFORM_CRYPTORANDOM
-+	if (randomfile != NULL &&
-+	    strcmp(randomfile, ISC_PLATFORM_CRYPTORANDOM) == 0) {
-+		randomfile = NULL;
-+		isc_entropy_usehook(*ectx, true);
-+	}
-+#endif
- 	result = isc_entropy_usebestsource(*ectx, &source, randomfile,
- 					   usekeyboard);
- 
-@@ -979,11 +987,11 @@ setup_system(void) {
- 		}
- 	}
- 
--	setup_entropy(gmctx, NULL, &entropy);
-+	if (entropy == NULL)
-+		setup_entropy(gmctx, NULL, &entropy);
- 
- 	result = isc_hash_create(gmctx, entropy, DNS_NAME_MAXWIRE);
- 	check_result(result, "isc_hash_create");
--	isc_hash_init();
- 
- 	result = dns_dispatchmgr_create(gmctx, entropy, &dispatchmgr);
- 	check_result(result, "dns_dispatchmgr_create");
-diff --git a/bin/tests/makejournal.c b/bin/tests/makejournal.c
-index 61a41b0..acc71a1 100644
---- a/bin/tests/makejournal.c
-+++ b/bin/tests/makejournal.c
-@@ -102,12 +102,12 @@ main(int argc, char **argv) {
- 	CHECK(isc_mem_create(0, 0, &mctx));
- 	CHECK(isc_entropy_create(mctx, &ectx));
- 
--	CHECK(isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE));
--	hash_active = true;
--
- 	CHECK(dst_lib_init(mctx, ectx, ISC_ENTROPY_BLOCKING));
- 	dst_active = true;
- 
-+	CHECK(isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE));
-+	hash_active = true;
-+
- 	CHECK(isc_log_create(mctx, &lctx, &logconfig));
- 	isc_log_registercategories(lctx, categories);
- 	isc_log_setcontext(lctx);
 diff --git a/bin/tests/system/pipelined/pipequeries.c b/bin/tests/system/pipelined/pipequeries.c
-index c6ab7f8..f0a6ff2 100644
+index 74de833..4fac3cb 100644
 --- a/bin/tests/system/pipelined/pipequeries.c
 +++ b/bin/tests/system/pipelined/pipequeries.c
-@@ -204,6 +204,7 @@ sendqueries(isc_task_t *task, isc_event_t *event) {
+@@ -205,6 +205,7 @@ sendqueries(isc_task_t *task, isc_event_t *event) {
  
  int
  main(int argc, char *argv[]) {
@@ -397,56 +38,6 @@ index c6ab7f8..f0a6ff2 100644
  	isc_sockaddr_t bind_any;
  	struct in_addr inaddr;
  	isc_result_t result;
-@@ -222,7 +223,7 @@ main(int argc, char *argv[]) {
- 	int c;
- 
- 	isc_commandline_errprint = false;
--	while ((c = isc_commandline_parse(argc, argv, "p:")) != -1) {
-+	while ((c = isc_commandline_parse(argc, argv, "p:r:")) != -1) {
- 		switch (c) {
- 		case 'p':
- 			result = isc_parse_uint16(&port,
-@@ -233,6 +234,9 @@ main(int argc, char *argv[]) {
- 				exit(1);
- 			}
- 			break;
-+		case 'r':
-+			randomfile = isc_commandline_argument;
-+			break;
- 		case '?':
- 			fprintf(stderr, "%s: invalid argument '%c'",
- 				argv[0], c);
-@@ -275,10 +279,18 @@ main(int argc, char *argv[]) {
- 
- 	ectx = NULL;
- 	RUNCHECK(isc_entropy_create(mctx, &ectx));
--	RUNCHECK(isc_entropy_createfilesource(ectx, "../random.data"));
--	RUNCHECK(isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE));
-+#ifdef ISC_PLATFORM_CRYPTORANDOM
-+	if (randomfile != NULL &&
-+	    strcmp(randomfile, ISC_PLATFORM_CRYPTORANDOM) == 0) {
-+		randomfile = NULL;
-+		isc_entropy_usehook(ectx, true);
-+	}
-+#endif
-+	if (randomfile != NULL)
-+		RUNCHECK(isc_entropy_createfilesource(ectx, randomfile));
- 
- 	RUNCHECK(dst_lib_init(mctx, ectx, ISC_ENTROPY_GOODONLY));
-+	RUNCHECK(isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE));
- 
- 	taskmgr = NULL;
- 	RUNCHECK(isc_taskmgr_create(mctx, 1, 0, &taskmgr));
-@@ -331,8 +343,8 @@ main(int argc, char *argv[]) {
- 	isc_task_detach(&task);
- 	isc_taskmgr_destroy(&taskmgr);
- 
--	dst_lib_destroy();
- 	isc_hash_destroy();
-+	dst_lib_destroy();
- 	isc_entropy_detach(&ectx);
- 
- 	isc_log_destroy(&lctx);
 diff --git a/bin/tests/system/pipelined/tests.sh b/bin/tests/system/pipelined/tests.sh
 index 61f1ff7..ed1302a 100644
 --- a/bin/tests/system/pipelined/tests.sh
@@ -469,33 +60,11 @@ index 61f1ff7..ed1302a 100644
  awk '{ print $1 " " $5 }' < rawb > outputb
  $DIFF refb outputb || ret=1
  if [ $ret != 0 ]; then echo_i "failed"; fi
-diff --git a/bin/tests/system/rsabigexponent/bigkey.c b/bin/tests/system/rsabigexponent/bigkey.c
-index 4462f2e..f06268d 100644
---- a/bin/tests/system/rsabigexponent/bigkey.c
-+++ b/bin/tests/system/rsabigexponent/bigkey.c
-@@ -20,6 +20,7 @@
- #include <isc/buffer.h>
- #include <isc/entropy.h>
- #include <isc/mem.h>
-+#include <isc/platform.h>
- #include <isc/print.h>
- #include <isc/region.h>
- #include <isc/stdio.h>
-@@ -183,6 +184,9 @@ main(int argc, char **argv) {
- 
- 	CHECK(isc_mem_create(0, 0, &mctx), "isc_mem_create()");
- 	CHECK(isc_entropy_create(mctx, &ectx), "isc_entropy_create()");
-+#ifdef ISC_PLATFORM_CRYPTORANDOM
-+	isc_entropy_usehook(ectx, true);
-+#endif
- 	CHECK(isc_entropy_usebestsource(ectx, &source,
- 					"../random.data",
- 					ISC_ENTROPY_KEYBOARDNO),
 diff --git a/bin/tests/system/tkey/keycreate.c b/bin/tests/system/tkey/keycreate.c
-index 653c951..fe8698e 100644
+index c39f6a4..b29a3cb 100644
 --- a/bin/tests/system/tkey/keycreate.c
 +++ b/bin/tests/system/tkey/keycreate.c
-@@ -206,6 +206,7 @@ sendquery(isc_task_t *task, isc_event_t *event) {
+@@ -195,6 +195,7 @@ sendquery(isc_task_t *task, isc_event_t *event) {
  int
  main(int argc, char *argv[]) {
  	char *ourkeyname;
@@ -503,65 +72,8 @@ index 653c951..fe8698e 100644
  	isc_taskmgr_t *taskmgr;
  	isc_timermgr_t *timermgr;
  	isc_socketmgr_t *socketmgr;
-@@ -225,10 +226,21 @@ main(int argc, char *argv[]) {
- 
- 	RUNCHECK(isc_app_start());
- 
-+	randomfile = NULL;
-+
- 	if (argc < 2) {
- 		fprintf(stderr, "I:no DH key provided\n");
- 		exit(-1);
- 	}
-+	if (strcmp(argv[1], "-r") == 0) {
-+		if (argc < 4) {
-+			fprintf(stderr, "I:no DH key provided\n");
-+			exit(-1);
-+		}
-+		randomfile = argv[2];
-+		argv += 2;
-+		argc -= 2;
-+	}
- 	ourkeyname = argv[1];
- 
- 	if (argc >= 3)
-@@ -242,14 +254,22 @@ main(int argc, char *argv[]) {
- 
- 	ectx = NULL;
- 	RUNCHECK(isc_entropy_create(mctx, &ectx));
--	RUNCHECK(isc_entropy_createfilesource(ectx, "../random.data"));
--	RUNCHECK(isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE));
-+#ifdef ISC_PLATFORM_CRYPTORANDOM
-+	if (randomfile != NULL &&
-+	    strcmp(randomfile, ISC_PLATFORM_CRYPTORANDOM) == 0) {
-+		randomfile = NULL;
-+		isc_entropy_usehook(ectx, true);
-+	}
-+#endif
-+	if (randomfile != NULL)
-+		RUNCHECK(isc_entropy_createfilesource(ectx, randomfile));
- 
- 	log = NULL;
- 	logconfig = NULL;
- 	RUNCHECK(isc_log_create(mctx, &log, &logconfig));
- 
- 	RUNCHECK(dst_lib_init(mctx, ectx, ISC_ENTROPY_GOODONLY));
-+	RUNCHECK(isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE));
- 
- 	taskmgr = NULL;
- 	RUNCHECK(isc_taskmgr_create(mctx, 1, 0, &taskmgr));
-@@ -328,8 +348,8 @@ main(int argc, char *argv[]) {
- 
- 	isc_log_destroy(&log);
- 
--	dst_lib_destroy();
- 	isc_hash_destroy();
-+	dst_lib_destroy();
- 	isc_entropy_detach(&ectx);
- 
- 	isc_mem_destroy(&mctx);
 diff --git a/bin/tests/system/tkey/keydelete.c b/bin/tests/system/tkey/keydelete.c
-index 70a40c3..2146f9b 100644
+index 547e8d0..efcea1d 100644
 --- a/bin/tests/system/tkey/keydelete.c
 +++ b/bin/tests/system/tkey/keydelete.c
 @@ -136,6 +136,7 @@ sendquery(isc_task_t *task, isc_event_t *event) {
@@ -572,68 +84,11 @@ index 70a40c3..2146f9b 100644
  	isc_taskmgr_t *taskmgr;
  	isc_timermgr_t *timermgr;
  	isc_socketmgr_t *socketmgr;
-@@ -156,10 +157,21 @@ main(int argc, char **argv) {
- 
- 	RUNCHECK(isc_app_start());
- 
-+	randomfile = NULL;
-+
- 	if (argc < 2) {
- 		fprintf(stderr, "I:no key to delete\n");
- 		exit(-1);
- 	}
-+	if (strcmp(argv[1], "-r") == 0) {
-+		if (argc < 4) {
-+			fprintf(stderr, "I:no DH key provided\n");
-+			exit(-1);
-+		}
-+		randomfile = argv[2];
-+		argv += 2;
-+		argc -= 2;
-+	}
- 	keyname = argv[1];
- 
- 	dns_result_register();
-@@ -169,14 +181,22 @@ main(int argc, char **argv) {
- 
- 	ectx = NULL;
- 	RUNCHECK(isc_entropy_create(mctx, &ectx));
--	RUNCHECK(isc_entropy_createfilesource(ectx, "../random.data"));
--	RUNCHECK(isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE));
-+#ifdef ISC_PLATFORM_CRYPTORANDOM
-+	if (randomfile != NULL &&
-+	    strcmp(randomfile, ISC_PLATFORM_CRYPTORANDOM) == 0) {
-+		randomfile = NULL;
-+		isc_entropy_usehook(ectx, true);
-+	}
-+#endif
-+	if (randomfile != NULL)
-+		RUNCHECK(isc_entropy_createfilesource(ectx, randomfile));
- 
- 	log = NULL;
- 	logconfig = NULL;
- 	RUNCHECK(isc_log_create(mctx, &log, &logconfig));
- 
- 	RUNCHECK(dst_lib_init(mctx, ectx, ISC_ENTROPY_GOODONLY));
-+	RUNCHECK(isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE));
- 
- 	taskmgr = NULL;
- 	RUNCHECK(isc_taskmgr_create(mctx, 1, 0, &taskmgr));
-@@ -264,8 +284,8 @@ main(int argc, char **argv) {
- 
- 	isc_log_destroy(&log);
- 
--	dst_lib_destroy();
- 	isc_hash_destroy();
-+	dst_lib_destroy();
- 	isc_entropy_detach(&ectx);
- 
- 	isc_mem_destroy(&mctx);
 diff --git a/bin/tests/system/tkey/tests.sh b/bin/tests/system/tkey/tests.sh
-index 9f90dd7..fad6c83 100644
+index a293d32..51ed2cb 100644
 --- a/bin/tests/system/tkey/tests.sh
 +++ b/bin/tests/system/tkey/tests.sh
-@@ -33,7 +33,7 @@ for owner in . foo.example.
+@@ -31,7 +31,7 @@ for owner in . foo.example.
  do
  	echo "I:creating new key using owner name \"$owner\""
  	ret=0
@@ -642,7 +97,7 @@ index 9f90dd7..fad6c83 100644
  	if [ $ret != 0 ]; then
  		echo "I:failed"
  		status=`expr $status + $ret`
-@@ -55,7 +55,7 @@ do
+@@ -53,7 +53,7 @@ do
  
  	echo "I:deleting new key"
  	ret=0
@@ -651,7 +106,7 @@ index 9f90dd7..fad6c83 100644
  	if [ $ret != 0 ]; then
  		echo "I:failed"
  	fi
-@@ -75,7 +75,7 @@ done
+@@ -73,7 +73,7 @@ done
  
  echo "I:creating new key using owner name bar.example."
  ret=0
@@ -660,7 +115,7 @@ index 9f90dd7..fad6c83 100644
  if [ $ret != 0 ]; then
          echo "I:failed"
  	status=`expr $status + $ret`
-@@ -116,7 +116,7 @@ status=`expr $status + $ret`
+@@ -114,7 +114,7 @@ status=`expr $status + $ret`
  
  echo "I:recreating the bar.example. key"
  ret=0
@@ -669,29 +124,11 @@ index 9f90dd7..fad6c83 100644
  if [ $ret != 0 ]; then
          echo "I:failed"
  	status=`expr $status + $ret`
-diff --git a/bin/tools/mdig.c b/bin/tools/mdig.c
-index bf6dbb6..0416b21 100644
---- a/bin/tools/mdig.c
-+++ b/bin/tools/mdig.c
-@@ -1972,12 +1972,11 @@ main(int argc, char *argv[]) {
- 
- 	ectx = NULL;
- 	RUNCHECK(isc_entropy_create(mctx, &ectx));
-+	RUNCHECK(dst_lib_init(mctx, ectx, ISC_ENTROPY_GOODONLY));
- 	RUNCHECK(isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE));
- 	RUNCHECK(isc_entropy_getdata(ectx, cookie_secret,
- 				     sizeof(cookie_secret), NULL, 0));
- 
--	RUNCHECK(dst_lib_init(mctx, ectx, ISC_ENTROPY_GOODONLY));
--
- 	ISC_LIST_INIT(queries);
- 	parse_args(false, argc, argv);
- 	if (server == NULL)
 diff --git a/configure b/configure
-index aab472a..b686178 100755
+index 4c97c8c..1e047bd 100755
 --- a/configure
 +++ b/configure
-@@ -640,6 +640,7 @@ ac_includes_default="\
+@@ -632,6 +632,7 @@ ac_includes_default="\
  
  ac_subst_vars='LTLIBOBJS
  LIBOBJS
@@ -699,260 +136,7 @@ index aab472a..b686178 100755
  BUILD_LIBS
  BUILD_LDFLAGS
  BUILD_CPPFLAGS
-@@ -821,6 +822,7 @@ XMLSTATS
- NZDTARGETS
- NZDSRCS
- NZD_TOOLS
-+ISC_PLATFORM_CRYPTORANDOM
- PKCS11_TEST
- PKCS11_ED25519
- PKCS11_GOST
-@@ -1045,6 +1047,7 @@ with_eddsa
- with_aes
- enable_openssl_hash
- with_cc_alg
-+enable_crypto_rand
- with_lmdb
- with_libxml2
- with_libjson
-@@ -1745,6 +1748,7 @@ Optional Features:
-   --enable-threads        enable multithreading
-   --enable-native-pkcs11  use native PKCS11 for all crypto [default=no]
-   --enable-openssl-hash   use OpenSSL for hash functions [default=no]
-+  --enable-crypto-rand    use the crypto provider for random [default=yes]
-   --enable-largefile      64-bit file support
-   --enable-backtrace      log stack backtrace on abort [default=yes]
-   --enable-symtable       use internal symbol table for backtrace
-@@ -17135,6 +17139,7 @@ case "$use_openssl" in
- $as_echo "disabled because of native PKCS11" >&6; }
- 		DST_OPENSSL_INC=""
- 		CRYPTO="-DPKCS11CRYPTO"
-+		CRYPTOLIB="pkcs11"
- 		OPENSSLECDSALINKOBJS=""
- 		OPENSSLECDSALINKSRCS=""
- 		OPENSSLEDDSALINKOBJS=""
-@@ -17149,6 +17154,7 @@ $as_echo "disabled because of native PKCS11" >&6; }
- $as_echo "no" >&6; }
- 		DST_OPENSSL_INC=""
- 		CRYPTO=""
-+		CRYPTOLIB=""
- 		OPENSSLECDSALINKOBJS=""
- 		OPENSSLECDSALINKSRCS=""
- 		OPENSSLEDDSALINKOBJS=""
-@@ -17161,6 +17167,7 @@ $as_echo "no" >&6; }
- 	auto)
- 		DST_OPENSSL_INC=""
- 		CRYPTO=""
-+		CRYPTOLIB=""
- 		OPENSSLECDSALINKOBJS=""
- 		OPENSSLECDSALINKSRCS=""
- 		OPENSSLEDDSALINKOBJS=""
-@@ -17170,7 +17177,7 @@ $as_echo "no" >&6; }
- 		OPENSSLLINKOBJS=""
- 		OPENSSLLINKSRCS=""
- 		as_fn_error $? "OpenSSL was not found in any of $openssldirs; use --with-openssl=/path
--If you don't want OpenSSL, use --without-openssl" "$LINENO" 5
-+If you do not want OpenSSL, use --without-openssl" "$LINENO" 5
- 		;;
- 	*)
- 		if test "yes" = "$want_native_pkcs11"
-@@ -17201,6 +17208,7 @@ $as_echo "not found" >&6; }
- 			as_fn_error $? "\"$use_openssl/include/openssl/opensslv.h\" not found" "$LINENO" 5
- 		fi
- 		CRYPTO='-DOPENSSL'
-+		CRYPTOLIB="openssl"
- 		if test "/usr" = "$use_openssl"
- 		then
- 			DST_OPENSSL_INC=""
-@@ -17826,8 +17834,6 @@ fi
- # Use OpenSSL for hash functions
- #
- 
--{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for using OpenSSL for hash functions" >&5
--$as_echo_n "checking for using OpenSSL for hash functions... " >&6; }
- ISC_PLATFORM_OPENSSLHASH="#undef ISC_PLATFORM_OPENSSLHASH"
- case $want_openssl_hash in
- 	yes)
-@@ -18202,6 +18208,86 @@ if test "rt" = "$have_clock_gt"; then
- 	LIBS="-lrt $LIBS"
- fi
- 
-+#
-+# Use the crypto provider (OpenSSL/PKCS#11) for random functions
-+#
-+
-+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for using the crypto library (vs. builtin) for random functions" >&5
-+$as_echo_n "checking for using the crypto library (vs. builtin) for random functions... " >&6; }
-+# Check whether --enable-crypto-rand was given.
-+if test "${enable_crypto_rand+set}" = set; then :
-+  enableval=$enable_crypto_rand; want_crypto_rand="$enableval"
-+else
-+  want_crypto_rand="auto"
-+fi
-+
-+if test "$want_crypto_rand" = "auto"
-+then
-+	case "$CRYPTOLIB" in
-+	"")
-+		want_crypto_rand="no"
-+		;;
-+	pkcs11)
-+		want_crypto_rand="yes"
-+		;;
-+	openssl)
-+		saved_cflags="$CFLAGS"
-+		saved_libs="$LIBS"
-+		CFLAGS="$CFLAGS $DST_OPENSSL_INC"
-+		LIBS="$LIBS $DST_OPENSSL_LIBS"
-+		if test "$cross_compiling" = yes; then :
-+  want_crypto_rand="yes"
-+else
-+  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-+/* end confdefs.h.  */
-+
-+#include <openssl/rand.h>
-+
-+unsigned char buf[128];
-+
-+int main()
-+{
-+	if (RAND_bytes(buf, 128) != 1)
-+		return (1);
-+	return (0);
-+}
-+
-+_ACEOF
-+if ac_fn_c_try_run "$LINENO"; then :
-+  want_crypto_rand="yes"
-+else
-+  want_crypto_rand="no"
-+fi
-+rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
-+  conftest.$ac_objext conftest.beam conftest.$ac_ext
-+fi
-+
-+		CFLAGS="$saved_cflags"
-+		LIBS="$saved_libs"
-+		;;
-+	*)
-+		as_fn_error $? "Unknown crypto library define $CRYPTOLIB" "$LINENO" 5
-+		;;
-+	esac
-+fi
-+case $want_crypto_rand in
-+	yes)
-+		if test "$CRYPTOLIB" = ""
-+		then
-+			as_fn_error $? "No crypto library for random functions" "$LINENO" 5
-+		fi
-+		{ $as_echo "$as_me:${as_lineno-$LINENO}: result: \"$CRYPTOLIB\"" >&5
-+$as_echo "\"$CRYPTOLIB\"" >&6; }
-+		ISC_PLATFORM_CRYPTORANDOM="#define ISC_PLATFORM_CRYPTORANDOM \"$CRYPTOLIB\""
-+		;;
-+	no)
-+		{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-+$as_echo "no" >&6; }
-+		ISC_PLATFORM_CRYPTORANDOM="#undef ISC_PLATFORM_CRYPTORANDOM"
-+		;;
-+esac
-+
-+
- #
- # was --with-lmdb specified?
- #
-@@ -20284,9 +20370,12 @@ _ACEOF
- if ac_fn_c_try_compile "$LINENO"; then :
-   { $as_echo "$as_me:${as_lineno-$LINENO}: result: size_t for buflen; int for flags" >&5
- $as_echo "size_t for buflen; int for flags" >&6; }
--	 $as_echo "#define IRS_GETNAMEINFO_SOCKLEN_T size_t" >>confdefs.h
-+	# Changed to solve multilib conflict on Fedora
-+	# AC_DEFINE(IRS_GETNAMEINFO_SOCKLEN_T, size_t)
-+	# AC_DEFINE(IRS_GETNAMEINFO_BUFLEN_T, size_t)
-+	 $as_echo "#define IRS_GETNAMEINFO_SOCKLEN_T socklen_t" >>confdefs.h
- 
--	 $as_echo "#define IRS_GETNAMEINFO_BUFLEN_T size_t" >>confdefs.h
-+	 $as_echo "#define IRS_GETNAMEINFO_BUFLEN_T socklen_t" >>confdefs.h
- 
- 	 $as_echo "#define IRS_GETNAMEINFO_FLAGS_T int" >>confdefs.h
- 
-@@ -21601,12 +21690,7 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
- ISC_PLATFORM_USESTDASM="#undef ISC_PLATFORM_USESTDASM"
- ISC_PLATFORM_USEMACASM="#undef ISC_PLATFORM_USEMACASM"
- if test "yes" = "$use_atomic"; then
--	have_atomic=yes		# set default
--	case "$host" in
--	i[3456]86-*)
--		# XXX: some old x86 architectures actually do not support
--		#      (some of) these operations.  Do we need stricter checks?
--		# The cast to long int works around a bug in the HP C Compiler
-+	# The cast to long int works around a bug in the HP C Compiler
- # version HP92453-01 B.11.11.23709.GP, which incorrectly rejects
- # declarations like `int a3[[(sizeof (unsigned char)) >= 0]];'.
- # This bug is HP SR number 8606223364.
-@@ -21639,6 +21723,11 @@ cat >>confdefs.h <<_ACEOF
- _ACEOF
- 
- 
-+	have_atomic=yes		# set default
-+	case "$host" in
-+	i[3456]86-*)
-+		# XXX: some old x86 architectures actually do not support
-+		#      (some of) these operations.  Do we need stricter checks?
- 		if test $ac_cv_sizeof_void_p = 8; then
- 			arch=x86_64
- 			have_xaddq=yes
-@@ -21647,39 +21736,6 @@ _ACEOF
- 		fi
- 	;;
- 	x86_64-*|amd64-*)
--		# The cast to long int works around a bug in the HP C Compiler
--# version HP92453-01 B.11.11.23709.GP, which incorrectly rejects
--# declarations like `int a3[[(sizeof (unsigned char)) >= 0]];'.
--# This bug is HP SR number 8606223364.
--{ $as_echo "$as_me:${as_lineno-$LINENO}: checking size of void *" >&5
--$as_echo_n "checking size of void *... " >&6; }
--if ${ac_cv_sizeof_void_p+:} false; then :
--  $as_echo_n "(cached) " >&6
--else
--  if ac_fn_c_compute_int "$LINENO" "(long int) (sizeof (void *))" "ac_cv_sizeof_void_p"        "$ac_includes_default"; then :
--
--else
--  if test "$ac_cv_type_void_p" = yes; then
--     { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
--$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
--as_fn_error 77 "cannot compute sizeof (void *)
--See \`config.log' for more details" "$LINENO" 5; }
--   else
--     ac_cv_sizeof_void_p=0
--   fi
--fi
--
--fi
--{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_sizeof_void_p" >&5
--$as_echo "$ac_cv_sizeof_void_p" >&6; }
--
--
--
--cat >>confdefs.h <<_ACEOF
--#define SIZEOF_VOID_P $ac_cv_sizeof_void_p
--_ACEOF
--
--
- 		if test $ac_cv_sizeof_void_p = 8; then
- 			arch=x86_64
- 			have_xaddq=yes
-@@ -21710,6 +21766,10 @@ $as_echo_n "checking architecture type for atomic operations... " >&6; }
- $as_echo "$arch" >&6; }
- fi
- 
-+if test ! "$arch" = "x86_64" -a "$have_xaddq" = "yes"; then
-+	as_fn_error $? "XADDQ present but disabled by Fedora patch!" "$LINENO" 5
-+fi
-+
- if test "yes" = "$have_atomic"; then
- 	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking compiler support for inline assembly code" >&5
- $as_echo_n "checking compiler support for inline assembly code... " >&6; }
-@@ -24264,6 +24324,30 @@ CFLAGS="$CFLAGS $SO_CFLAGS"
+@@ -20509,6 +20510,30 @@ fi
  #
  dlzdir='${DLZ_DRIVER_DIR}'
  
@@ -983,7 +167,7 @@ index aab472a..b686178 100755
  #
  # Private autoconf macro to simplify configuring drivers:
  #
-@@ -24594,11 +24678,11 @@ $as_echo "no" >&6; }
+@@ -20839,11 +20864,11 @@ $as_echo "no" >&6; }
  $as_echo "using mysql with libs ${mysql_lib} and includes ${mysql_include}" >&6; }
  		;;
  	*)
@@ -998,7 +182,7 @@ index aab472a..b686178 100755
  		fi
  
  	CONTRIB_DLZ="$CONTRIB_DLZ -DDLZ_MYSQL"
-@@ -24683,7 +24767,7 @@ $as_echo "" >&6; }
+@@ -20928,7 +20953,7 @@ $as_echo "" >&6; }
  			# Check other locations for includes.
  			# Order is important (sigh).
  
@@ -1007,7 +191,7 @@ index aab472a..b686178 100755
  			# include a blank element first
  			for d in "" $bdb_incdirs
  			do
-@@ -24708,57 +24792,9 @@ $as_echo "" >&6; }
+@@ -20953,57 +20978,9 @@ $as_echo "" >&6; }
  			bdb_libnames="db53 db-5.3 db51 db-5.1 db48 db-4.8 db47 db-4.7 db46 db-4.6 db45 db-4.5 db44 db-4.4 db43 db-4.3 db42 db-4.2 db41 db-4.1 db"
  			for d in $bdb_libnames
  			do
@@ -1067,7 +251,7 @@ index aab472a..b686178 100755
  					break
  				fi
  			done
-@@ -24917,10 +24953,10 @@ $as_echo "no" >&6; }
+@@ -21162,10 +21139,10 @@ $as_echo "no" >&6; }
  		DLZ_DRIVER_INCLUDES="$DLZ_DRIVER_INCLUDES -I$use_dlz_ldap/include"
  		DLZ_DRIVER_LDAP_INCLUDES="-I$use_dlz_ldap/include"
  	fi
@@ -1081,7 +265,7 @@ index aab472a..b686178 100755
  	fi
  
  
-@@ -25006,11 +25042,11 @@ fi
+@@ -21251,11 +21228,11 @@ fi
  		odbcdirs="/usr /usr/local /usr/pkg"
  		for d in $odbcdirs
  		do
@@ -1095,7 +279,7 @@ index aab472a..b686178 100755
  				break
  			fi
  		done
-@@ -25285,6 +25321,8 @@ DNS_CRYPTO_LIBS="$NEWFLAGS"
+@@ -21530,6 +21507,8 @@ DNS_CRYPTO_LIBS="$NEWFLAGS"
  
  
  
@@ -1104,272 +288,11 @@ index aab472a..b686178 100755
  #
  # Commands to run at the end of config.status.
  # Don't just put these into configure, it won't work right if somebody
-@@ -27661,6 +27699,8 @@ report() {
- 	    echo "    IPv6 support (--enable-ipv6)"
- 	test "X$CRYPTO" = "X" -o "yes" = "$want_native_pkcs11" || \
- 		echo "    OpenSSL cryptography/DNSSEC (--with-openssl)"
-+        test "no" = "$want_crypto_rand" || \
-+                echo "    Crypto provider entropy source (--enable-crypto-rand)"
- 	test "X$PYTHON" = "X" || echo "    Python tools (--with-python)"
- 	test "X$XMLSTATS" = "X" || echo "    XML statistics (--with-libxml2)"
- 	test "X$JSONSTATS" = "X" || echo "    JSON statistics (--with-libjson)"
-@@ -27701,6 +27741,8 @@ report() {
- 	echo "    Very verbose query trace logging (--enable-querytrace)"
-     test "no" = "$with_cmocka" || echo "    CMocka Unit Testing Framework (--with-cmocka)"
- 
-+    echo "    Cryptographic library for DNSSEC: $CRYPTOLIB"
-+
-     echo "    Dynamically loadable zone (DLZ) drivers:"
-     test "no" = "$use_dlz_bdb" || \
- 	echo "        Berkeley DB (--with-dlz-bdb)"
-@@ -27748,6 +27790,8 @@ report() {
- 	echo "    ECDSA algorithm support (--with-ecdsa)"
-     test "X$CRYPTO" = "X" -o "yes" = "$OPENSSL_ED25519" -o "yes" = "$PKCS11_ED25519" || \
- 	echo "    EDDSA algorithm support (--with-eddsa)"
-+    test "yes" = "$want_crypto_rand" || \
-+        echo "    Crypto provider entropy source (--enable-crypto-rand)"
- 
-     test "yes" = "$enable_seccomp" || \
- 	echo "    Use libseccomp system call filtering (--enable-seccomp)"
-diff --git a/configure.ac b/configure.ac
-index 0e16cc8..dd0055d 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -1550,6 +1550,7 @@ case "$use_openssl" in
- 		AC_MSG_RESULT(disabled because of native PKCS11)
- 		DST_OPENSSL_INC=""
- 		CRYPTO="-DPKCS11CRYPTO"
-+		CRYPTOLIB="pkcs11"
- 		OPENSSLECDSALINKOBJS=""
- 		OPENSSLECDSALINKSRCS=""
- 		OPENSSLEDDSALINKOBJS=""
-@@ -1563,6 +1564,7 @@ case "$use_openssl" in
- 		AC_MSG_RESULT(no)
- 		DST_OPENSSL_INC=""
- 		CRYPTO=""
-+		CRYPTOLIB=""
- 		OPENSSLECDSALINKOBJS=""
- 		OPENSSLECDSALINKSRCS=""
- 		OPENSSLEDDSALINKOBJS=""
-@@ -1575,6 +1577,7 @@ case "$use_openssl" in
- 	auto)
- 		DST_OPENSSL_INC=""
- 		CRYPTO=""
-+		CRYPTOLIB=""
- 		OPENSSLECDSALINKOBJS=""
- 		OPENSSLECDSALINKSRCS=""
- 		OPENSSLEDDSALINKOBJS=""
-@@ -1585,7 +1588,7 @@ case "$use_openssl" in
- 		OPENSSLLINKSRCS=""
- 		AC_MSG_ERROR(
- [OpenSSL was not found in any of $openssldirs; use --with-openssl=/path
--If you don't want OpenSSL, use --without-openssl])
-+If you do not want OpenSSL, use --without-openssl])
- 		;;
- 	*)
- 		if test "yes" = "$want_native_pkcs11"
-@@ -1615,6 +1618,7 @@ If you don't want OpenSSL, use --without-openssl])
- 			AC_MSG_ERROR(["$use_openssl/include/openssl/opensslv.h" not found])
- 		fi
- 		CRYPTO='-DOPENSSL'
-+		CRYPTOLIB="openssl"
- 		if test "/usr" = "$use_openssl"
- 		then
- 			DST_OPENSSL_INC=""
-@@ -2050,7 +2054,6 @@ fi
- # Use OpenSSL for hash functions
- #
- 
--AC_MSG_CHECKING(for using OpenSSL for hash functions)
- ISC_PLATFORM_OPENSSLHASH="#undef ISC_PLATFORM_OPENSSLHASH"
- case $want_openssl_hash in
- 	yes)
-@@ -2322,6 +2325,67 @@ if test "rt" = "$have_clock_gt"; then
- 	LIBS="-lrt $LIBS"
- fi
- 
-+#
-+# Use the crypto provider (OpenSSL/PKCS#11) for random functions
-+#
-+
-+AC_MSG_CHECKING(for using the crypto library (vs. builtin) for random functions)
-+AC_ARG_ENABLE(crypto-rand,
-+	[  --enable-crypto-rand    use the crypto provider for random [[default=yes]]],
-+	want_crypto_rand="$enableval", want_crypto_rand="auto")
-+if test "$want_crypto_rand" = "auto"
-+then
-+	case "$CRYPTOLIB" in
-+	"")
-+		want_crypto_rand="no"
-+		;;
-+	pkcs11)
-+		want_crypto_rand="yes"
-+		;;
-+	openssl)
-+		saved_cflags="$CFLAGS"
-+		saved_libs="$LIBS"
-+		CFLAGS="$CFLAGS $DST_OPENSSL_INC"
-+		LIBS="$LIBS $DST_OPENSSL_LIBS"
-+		AC_TRY_RUN([
-+#include <openssl/rand.h>
-+
-+unsigned char buf[128];
-+
-+int main()
-+{
-+	if (RAND_bytes(buf, 128) != 1)
-+		return (1);
-+	return (0);
-+}
-+],
-+		[want_crypto_rand="yes"],
-+		[want_crypto_rand="no"],
-+		[want_crypto_rand="yes"])
-+		CFLAGS="$saved_cflags"
-+		LIBS="$saved_libs"
-+		;;
-+	*)
-+		AC_MSG_ERROR([Unknown crypto library define $CRYPTOLIB])
-+		;;
-+	esac
-+fi
-+case $want_crypto_rand in
-+	yes)
-+		if test "$CRYPTOLIB" = ""
-+		then
-+			AC_MSG_ERROR([No crypto library for random functions])
-+		fi
-+		AC_MSG_RESULT(["$CRYPTOLIB"])
-+		ISC_PLATFORM_CRYPTORANDOM="#define ISC_PLATFORM_CRYPTORANDOM \"$CRYPTOLIB\""
-+		;;
-+	no)
-+		AC_MSG_RESULT(no)
-+		ISC_PLATFORM_CRYPTORANDOM="#undef ISC_PLATFORM_CRYPTORANDOM"
-+		;;
-+esac
-+AC_SUBST(ISC_PLATFORM_CRYPTORANDOM)
-+
- #
- # was --with-lmdb specified?
- #
-@@ -4118,12 +4182,12 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
- ISC_PLATFORM_USESTDASM="#undef ISC_PLATFORM_USESTDASM"
- ISC_PLATFORM_USEMACASM="#undef ISC_PLATFORM_USEMACASM"
- if test "yes" = "$use_atomic"; then
-+	AC_CHECK_SIZEOF([void *])
- 	have_atomic=yes		# set default
- 	case "$host" in
- 	[i[3456]86-*])
- 		# XXX: some old x86 architectures actually do not support
- 		#      (some of) these operations.  Do we need stricter checks?
--		AC_CHECK_SIZEOF([void *])
- 		if test $ac_cv_sizeof_void_p = 8; then
- 			arch=x86_64
- 			have_xaddq=yes
-@@ -4132,7 +4196,6 @@ if test "yes" = "$use_atomic"; then
- 		fi
- 	;;
- 	x86_64-*|amd64-*)
--		AC_CHECK_SIZEOF([void *])
- 		if test $ac_cv_sizeof_void_p = 8; then
- 			arch=x86_64
- 			have_xaddq=yes
-@@ -5537,6 +5600,8 @@ report() {
- 	    echo "    IPv6 support (--enable-ipv6)"
- 	test "X$CRYPTO" = "X" -o "yes" = "$want_native_pkcs11" || \
- 		echo "    OpenSSL cryptography/DNSSEC (--with-openssl)"
-+        test "no" = "$want_crypto_rand" || \
-+                echo "    Crypto provider entropy source (--enable-crypto-rand)"
- 	test "X$PYTHON" = "X" || echo "    Python tools (--with-python)"
- 	test "X$XMLSTATS" = "X" || echo "    XML statistics (--with-libxml2)"
- 	test "X$JSONSTATS" = "X" || echo "    JSON statistics (--with-libjson)"
-@@ -5577,6 +5642,8 @@ report() {
- 	echo "    Very verbose query trace logging (--enable-querytrace)"
-     test "no" = "$with_cmocka" || echo "    CMocka Unit Testing Framework (--with-cmocka)"
- 
-+    echo "    Cryptographic library for DNSSEC: $CRYPTOLIB"
-+
-     echo "    Dynamically loadable zone (DLZ) drivers:"
-     test "no" = "$use_dlz_bdb" || \
- 	echo "        Berkeley DB (--with-dlz-bdb)"
-@@ -5624,6 +5691,8 @@ report() {
- 	echo "    ECDSA algorithm support (--with-ecdsa)"
-     test "X$CRYPTO" = "X" -o "yes" = "$OPENSSL_ED25519" -o "yes" = "$PKCS11_ED25519" || \
- 	echo "    EDDSA algorithm support (--with-eddsa)"
-+    test "yes" = "$want_crypto_rand" || \
-+        echo "    Crypto provider entropy source (--enable-crypto-rand)"
- 
-     test "yes" = "$enable_seccomp" || \
- 	echo "    Use libseccomp system call filtering (--enable-seccomp)"
-diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c
-index 65bf25d..1eccbe7 100644
---- a/lib/dns/dst_api.c
-+++ b/lib/dns/dst_api.c
-@@ -277,6 +277,12 @@ dst_lib_init2(isc_mem_t *mctx, isc_entropy_t *ectx,
- #ifdef GSSAPI
- 	RETERR(dst__gssapi_init(&dst_t_func[DST_ALG_GSSAPI]));
- #endif
-+#if defined(OPENSSL) || defined(PKCS11CRYPTO)
-+#ifdef ISC_PLATFORM_CRYPTORANDOM
-+	if (dst_entropy_pool != NULL)
-+		isc_entropy_sethook(dst_random_getdata);
-+#endif
-+#endif /* defined(OPENSSL) || defined(PKCS11CRYPTO) */
- 	dst_initialized = true;
- 	return (ISC_R_SUCCESS);
- 
-@@ -296,11 +302,19 @@ dst_lib_destroy(void) {
- 	for (i = 0; i < DST_MAX_ALGS; i++)
- 		if (dst_t_func[i] != NULL && dst_t_func[i]->cleanup != NULL)
- 			dst_t_func[i]->cleanup();
-+#if defined(OPENSSL) || defined(PKCS11CRYPTO)
-+#ifdef ISC_PLATFORM_CRYPTORANDOM
-+	if (dst_entropy_pool != NULL) {
-+		isc_entropy_usehook(dst_entropy_pool, false);
-+		isc_entropy_sethook(NULL);
-+	}
-+#endif
- #ifdef OPENSSL
- 	dst__openssl_destroy();
- #elif PKCS11CRYPTO
- 	(void) dst__pkcs11_destroy();
- #endif /* if OPENSSL, elif PKCS11CRYPTO */
-+#endif /* defined(OPENSSL) || defined(PKCS11CRYPTO) */
- 	if (dst__memory_pool != NULL)
- 		isc_mem_detach(&dst__memory_pool);
- 	if (dst_entropy_pool != NULL)
-@@ -2002,13 +2016,17 @@ dst__entropy_getdata(void *buf, unsigned int len, bool pseudo) {
- 		flags &= ~ISC_ENTROPY_GOODONLY;
- 	else
- 		flags |= ISC_ENTROPY_BLOCKING;
-+#ifdef ISC_PLATFORM_CRYPTORANDOM
-+	return (dst_random_getdata(buf, len, NULL, flags));
-+#else
- 	return (isc_entropy_getdata(dst_entropy_pool, buf, len, NULL, flags));
-+#endif
- #endif /* PKCS11CRYPTO */
- }
- 
- unsigned int
- dst__entropy_status(void) {
--#ifndef PKCS11CRYPTO
-+#if !defined(PKCS11CRYPTO) && !defined(ISC_PLATFORM_CRYPTORANDOM)
- #ifdef GSSAPI
- 	unsigned int flags = dst_entropy_flags;
- 	isc_result_t ret;
-@@ -2031,6 +2049,7 @@ dst__entropy_status(void) {
- #endif
- 	return (isc_entropy_status(dst_entropy_pool));
- #else
-+	/* Doesn't matter as it is not used in this case. */
- 	return (0);
- #endif
- }
 diff --git a/lib/dns/include/dst/dst.h b/lib/dns/include/dst/dst.h
-index 1924e74..6813c96 100644
+index 3146d88..3f7ac4d 100644
 --- a/lib/dns/include/dst/dst.h
 +++ b/lib/dns/include/dst/dst.h
-@@ -159,6 +159,14 @@ dst_lib_destroy(void);
+@@ -153,6 +153,14 @@ dst_lib_destroy(void);
   * Releases all resources allocated by DST.
   */
  
@@ -1385,18 +308,10 @@ index 1924e74..6813c96 100644
  dst_algorithm_supported(unsigned int alg);
  /*%<
 diff --git a/lib/dns/lib.c b/lib/dns/lib.c
-index 304814b..60543c4 100644
+index 5fccb57..1f627c4 100644
 --- a/lib/dns/lib.c
 +++ b/lib/dns/lib.c
-@@ -18,6 +18,7 @@
- #include <stdbool.h>
- #include <stddef.h>
- 
-+#include <isc/entropy.h>
- #include <isc/hash.h>
- #include <isc/mem.h>
- #include <isc/msgcat.h>
-@@ -78,6 +79,7 @@ static unsigned int references = 0;
+@@ -51,6 +51,7 @@ static unsigned int references = 0;
  static void
  initialize(void) {
  	isc_result_t result;
@@ -1404,314 +319,11 @@ index 304814b..60543c4 100644
  
  	REQUIRE(initialize_done == false);
  
-@@ -88,11 +90,14 @@ initialize(void) {
- 	result = dns_ecdb_register(dns_g_mctx, &dbimp);
- 	if (result != ISC_R_SUCCESS)
- 		goto cleanup_mctx;
--	result = isc_hash_create(dns_g_mctx, NULL, DNS_NAME_MAXWIRE);
-+	result = isc_entropy_create(dns_g_mctx, &ectx);
- 	if (result != ISC_R_SUCCESS)
- 		goto cleanup_db;
-+	result = isc_hash_create(dns_g_mctx, NULL, DNS_NAME_MAXWIRE);
-+	if (result != ISC_R_SUCCESS)
-+		goto cleanup_ectx;
- 
--	result = dst_lib_init(dns_g_mctx, NULL, 0);
-+	result = dst_lib_init(dns_g_mctx, ectx, 0);
- 	if (result != ISC_R_SUCCESS)
- 		goto cleanup_hash;
- 
-@@ -100,11 +105,17 @@ initialize(void) {
- 	if (result != ISC_R_SUCCESS)
- 		goto cleanup_dst;
- 
-+	isc_hash_init();
-+	isc_entropy_detach(&ectx);
-+
- 	initialize_done = true;
- 	return;
- 
-   cleanup_dst:
- 	dst_lib_destroy();
-+  cleanup_ectx:
-+	if (ectx != NULL)
-+		isc_entropy_detach(&ectx);
-   cleanup_hash:
- 	isc_hash_destroy();
-   cleanup_db:
-diff --git a/lib/dns/openssl_link.c b/lib/dns/openssl_link.c
-index 13e838f..ffe0a69 100644
---- a/lib/dns/openssl_link.c
-+++ b/lib/dns/openssl_link.c
-@@ -31,6 +31,7 @@
- #include <isc/mem.h>
- #include <isc/mutex.h>
- #include <isc/mutexblock.h>
-+#include <isc/platform.h>
- #include <isc/string.h>
- #include <isc/thread.h>
- #include <isc/util.h>
-@@ -46,8 +47,6 @@
- #include <openssl/engine.h>
- #endif
- 
--static RAND_METHOD *rm = NULL;
--
- #if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
- static isc_mutex_t *locks = NULL;
- static int nlocks;
-@@ -57,6 +56,9 @@ static int nlocks;
- static ENGINE *e = NULL;
- #endif
- 
-+#ifndef ISC_PLATFORM_CRYPTORANDOM
-+static RAND_METHOD *rm = NULL;
-+
- static int
- entropy_get(unsigned char *buf, int num) {
- 	isc_result_t result;
-@@ -102,6 +104,7 @@ entropy_add(const void *buf, int num, double entropy) {
- 	return (1);
- }
- #endif
-+#endif /* !ISC_PLATFORM_CRYPTORANDOM */
- 
- #if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
- static void
-@@ -192,7 +195,7 @@ _set_thread_id(CRYPTO_THREADID *id)
- isc_result_t
- dst__openssl_init(const char *engine) {
- 	isc_result_t result;
--#if !defined(OPENSSL_NO_ENGINE)
-+#if !defined(OPENSSL_NO_ENGINE) && !defined(ISC_PLATFORM_CRYPTORANDOM)
- 	ENGINE *re;
- #else
- 	UNUSED(engine);
-@@ -222,6 +225,7 @@ dst__openssl_init(const char *engine) {
- 	ERR_load_crypto_strings();
- #endif
- 
-+#ifndef ISC_PLATFORM_CRYPTORANDOM
- 	rm = mem_alloc(sizeof(RAND_METHOD) FILELINE);
- 	if (rm == NULL) {
- 		result = ISC_R_NOMEMORY;
-@@ -233,6 +237,7 @@ dst__openssl_init(const char *engine) {
- 	rm->add = entropy_add;
- 	rm->pseudorand = entropy_getpseudo;
- 	rm->status = entropy_status;
-+#endif
- 
- #if !defined(OPENSSL_NO_ENGINE)
- #if !defined(CONF_MFLAGS_DEFAULT_SECTION)
-@@ -266,6 +271,7 @@ dst__openssl_init(const char *engine) {
- 		}
- 	}
- 
-+#ifndef ISC_PLATFORM_CRYPTORANDOM
- 	re = ENGINE_get_default_RAND();
- 	if (re == NULL) {
- 		re = ENGINE_new();
-@@ -278,9 +284,21 @@ dst__openssl_init(const char *engine) {
- 		ENGINE_free(re);
- 	} else
- 		ENGINE_finish(re);
-+#endif
- #else
-+#ifndef ISC_PLATFORM_CRYPTORANDOM
- 	RAND_set_rand_method(rm);
-+#endif
- #endif /* !defined(OPENSSL_NO_ENGINE) */
-+
-+	/* Protect ourselves against unseeded PRNG */
-+	if (RAND_status() != 1) {
-+		FATAL_ERROR(__FILE__, __LINE__,
-+			    "OpenSSL pseudorandom number generator "
-+			    "cannot be initialized (see the `PRNG not "
-+			    "seeded' message in the OpenSSL FAQ)");
-+	}
-+
- 	return (ISC_R_SUCCESS);
- 
- #if !defined(OPENSSL_NO_ENGINE)
-@@ -288,10 +306,14 @@ dst__openssl_init(const char *engine) {
- 	if (e != NULL)
- 		ENGINE_free(e);
- 	e = NULL;
-+#ifndef ISC_PLATFORM_CRYPTORANDOM
- 	mem_free(rm FILELINE);
- 	rm = NULL;
- #endif
-+#endif
-+#ifndef ISC_PLATFORM_CRYPTORANDOM
-  cleanup_mutexinit:
-+#endif
- #if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
- 	CRYPTO_set_locking_callback(NULL);
- 	DESTROYMUTEXBLOCK(locks, nlocks);
-@@ -306,14 +328,17 @@ void
- dst__openssl_destroy(void) {
- #if !defined(LIBRESSL_VERSION_NUMBER) && (OPENSSL_VERSION_NUMBER >= 0x10100000L)
- 	OPENSSL_cleanup();
-+#ifndef ISC_PLATFORM_CRYPTORANDOM
- 	if (rm != NULL) {
- 		mem_free(rm FILELINE);
- 		rm = NULL;
- 	}
-+#endif
- #else
- 	/*
- 	 * Sequence taken from apps_shutdown() in <apps/apps.h>.
- 	 */
-+#ifndef ISC_PLATFORM_CRYPTORANDOM
- 	if (rm != NULL) {
- #if OPENSSL_VERSION_NUMBER >= 0x00907000L
- 		RAND_cleanup();
-@@ -321,6 +346,7 @@ dst__openssl_destroy(void) {
- 		mem_free(rm FILELINE);
- 		rm = NULL;
- 	}
-+#endif
- #if (OPENSSL_VERSION_NUMBER >= 0x00907000L)
- 	CONF_modules_free();
- #endif
-@@ -456,11 +482,45 @@ dst__openssl_getengine(const char *engine) {
- }
- #endif
- 
--#else /* OPENSSL */
-+isc_result_t
-+dst_random_getdata(void *data, unsigned int length,
-+		   unsigned int *returned, unsigned int flags) {
-+#ifdef ISC_PLATFORM_CRYPTORANDOM
-+#ifndef DONT_REQUIRE_DST_LIB_INIT
-+	INSIST(dst__memory_pool != NULL);
-+#endif
-+	REQUIRE(data != NULL);
-+	REQUIRE(length > 0);
- 
--#include <isc/util.h>
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
-+	if ((flags & ISC_ENTROPY_GOODONLY) == 0) {
-+		if (RAND_pseudo_bytes((unsigned char *)data, (int)length) < 0)
-+			return (dst__openssl_toresult2("RAND_pseudo_bytes",
-+						       DST_R_OPENSSLFAILURE));
-+	} else {
-+		if (RAND_bytes((unsigned char *)data, (int)length) != 1)
-+			return (dst__openssl_toresult2("RAND_bytes",
-+						       DST_R_OPENSSLFAILURE));
-+	}
-+#else
-+	UNUSED(flags);
- 
--EMPTY_TRANSLATION_UNIT
-+	if (RAND_bytes((unsigned char *)data, (int)length) != 1)
-+		return (dst__openssl_toresult2("RAND_bytes",
-+					       DST_R_OPENSSLFAILURE));
-+#endif
-+	if (returned != NULL)
-+		*returned = length;
-+	return (ISC_R_SUCCESS);
-+#else
-+	UNUSED(data);
-+	UNUSED(length);
-+	UNUSED(returned);
-+	UNUSED(flags);
-+
-+	return (ISC_R_NOTIMPLEMENTED);
-+#endif
-+}
- 
- #endif /* OPENSSL */
- /*! \file */
-diff --git a/lib/dns/pkcs11.c b/lib/dns/pkcs11.c
-index 5a2c502..8eaef53 100644
---- a/lib/dns/pkcs11.c
-+++ b/lib/dns/pkcs11.c
-@@ -13,12 +13,15 @@
- 
- #include <config.h>
- 
-+#include <isc/util.h>
-+
- #include <dns/log.h>
- #include <dns/result.h>
- 
- #include <pk11/pk11.h>
- #include <pk11/internal.h>
- 
-+#include "dst_internal.h"
- #include "dst_pkcs11.h"
- 
- isc_result_t
-@@ -34,12 +37,32 @@ dst__pkcs11_toresult(const char *funcname, const char *file, int line,
- 	return (fallback);
- }
- 
-+isc_result_t
-+dst_random_getdata(void *data, unsigned int length,
-+		   unsigned int *returned, unsigned int flags) {
-+#ifdef ISC_PLATFORM_CRYPTORANDOM
-+	isc_result_t ret;
- 
--#else /* PKCS11CRYPTO */
-+#ifndef DONT_REQUIRE_DST_LIB_INIT
-+	INSIST(dst__memory_pool != NULL);
-+#endif
-+	REQUIRE(data != NULL);
-+	REQUIRE(length > 0);
-+	UNUSED(flags);
- 
--#include <isc/util.h>
-+	ret = pk11_rand_bytes(data, (int) length);
-+	if ((ret == ISC_R_SUCCESS) && (returned != NULL))
-+		*returned = length;
-+	return (ret);
-+#else
-+	UNUSED(data);
-+	UNUSED(length);
-+	UNUSED(returned);
-+	UNUSED(flags);
- 
--EMPTY_TRANSLATION_UNIT
-+	return (ISC_R_NOTIMPLEMENTED);
-+#endif
-+}
- 
- #endif /* PKCS11CRYPTO */
- /*! \file */
-diff --git a/lib/dns/tests/Kyuafile b/lib/dns/tests/Kyuafile
-index 937b548..f3c0e38 100644
---- a/lib/dns/tests/Kyuafile
-+++ b/lib/dns/tests/Kyuafile
-@@ -10,6 +10,7 @@ tap_test_program{name='dh_test'}
- tap_test_program{name='dispatch_test'}
- tap_test_program{name='dnstap_test'}
- tap_test_program{name='dst_test'}
-+tap_test_program{name='dstrandom_test'}
- tap_test_program{name='geoip_test'}
- tap_test_program{name='gost_test'}
- tap_test_program{name='keytable_test'}
 diff --git a/lib/dns/tests/Makefile.in b/lib/dns/tests/Makefile.in
-index 90dc3a6..7671e1d 100644
+index 7b35b93..c5befff 100644
 --- a/lib/dns/tests/Makefile.in
 +++ b/lib/dns/tests/Makefile.in
-@@ -37,6 +37,7 @@ SRCS =		acl_test.c \
- 		dnstap_test.c \
- 		dst_test.c \
- 		dnstest.c \
-+		dstrandom_test.c \
- 		geoip_test.c \
- 		gost_test.c \
- 		keytable_test.c \
-@@ -69,6 +70,7 @@ TARGETS =	acl_test@EXEEXT@ \
- 		dh_test@EXEEXT@ \
- 		dispatch_test@EXEEXT@ \
- 		dnstap_test@EXEEXT@ \
-+		dstrandom_test@EXEEXT@ \
- 		dst_test@EXEEXT@ \
- 		geoip_test@EXEEXT@ \
- 		gost_test@EXEEXT@ \
-@@ -258,6 +260,11 @@ zt_test@EXEEXT@: zt_test.@O@ dnstest.@O@ ${ISCDEPLIBS} ${DNSDEPLIBS}
+@@ -259,6 +259,11 @@ zt_test@EXEEXT@: zt_test.@O@ dnstest.@O@ ${ISCDEPLIBS} ${DNSDEPLIBS}
  		${LDFLAGS} -o $@ zt_test.@O@ dnstest.@O@ \
  		${DNSLIBS} ${ISCLIBS} ${LIBS}
  
@@ -1723,247 +335,11 @@ index 90dc3a6..7671e1d 100644
  unit::
  	sh ${top_builddir}/unit/unittest.sh
  
-diff --git a/lib/dns/tests/dstrandom_test.c b/lib/dns/tests/dstrandom_test.c
-new file mode 100644
-index 0000000..bd3d164
---- /dev/null
-+++ b/lib/dns/tests/dstrandom_test.c
-@@ -0,0 +1,115 @@
-+/*
-+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-+ *
-+ * This Source Code Form is subject to the terms of the Mozilla Public
-+ * License, v. 2.0. If a copy of the MPL was not distributed with this
-+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
-+ *
-+ * See the COPYRIGHT file distributed with this work for additional
-+ * information regarding copyright ownership.
-+ */
-+
-+#include <config.h>
-+
-+#if HAVE_CMOCKA
-+
-+#include <stdarg.h>
-+#include <stddef.h>
-+#include <setjmp.h>
-+
-+#include <stdlib.h>
-+#include <stdio.h>
-+#include <string.h>
-+#include <unistd.h>
-+
-+#define UNIT_TESTING
-+#include <cmocka.h>
-+
-+#include <isc/entropy.h>
-+#include <isc/mem.h>
-+#include <isc/print.h>
-+#include <isc/platform.h>
-+#include <isc/util.h>
-+
-+#include <dst/dst.h>
-+
-+isc_mem_t *mctx = NULL;
-+isc_entropy_t *ectx = NULL;
-+unsigned char buffer[128];
-+
-+/* isc_entropy_getdata() examples */
-+static void
-+isc_entropy_getdata_test(void **state) {
-+	isc_result_t result;
-+	unsigned int returned, status;
-+	const char *randomfile = "testdata/dstrandom/random.data";
-+	int ret;
-+
-+	UNUSED(state);
-+
-+	isc_mem_debugging |= ISC_MEM_DEBUGRECORD;
-+	result = isc_mem_create(0, 0, &mctx);
-+	assert_int_equal(result, ISC_R_SUCCESS);
-+	result = isc_entropy_create(mctx, &ectx);
-+	assert_int_equal(result, ISC_R_SUCCESS);
-+	result = dst_lib_init(mctx, ectx, 0);
-+	assert_int_equal(result, ISC_R_SUCCESS);
-+
-+#ifdef ISC_PLATFORM_CRYPTORANDOM
-+	isc_entropy_usehook(ectx, true);
-+
-+	returned = 0;
-+	result = isc_entropy_getdata(ectx, buffer, sizeof(buffer),
-+				     &returned, 0);
-+	assert_int_equal(result, ISC_R_SUCCESS);
-+	assert_int_equal(returned, sizeof(buffer));
-+
-+	status = isc_entropy_status(ectx);
-+	assert_int_equal(status, 0);
-+
-+	isc_entropy_usehook(ectx, false);
-+#endif
-+
-+	ret = chdir(TESTS);
-+	assert_int_equal(ret, 0);
-+
-+	result = isc_entropy_createfilesource(ectx, randomfile);
-+	assert_int_equal(result, ISC_R_SUCCESS);
-+
-+	returned = 0;
-+	result = isc_entropy_getdata(ectx, buffer, sizeof(buffer),
-+				     &returned, 0);
-+	assert_int_equal(result, ISC_R_SUCCESS);
-+	assert_int_equal(returned, sizeof(buffer));
-+
-+	status = isc_entropy_status(ectx);
-+	assert_true(status > 0);
-+
-+	dst_lib_destroy();
-+	isc_entropy_detach(&ectx);
-+	assert_null(ectx);
-+
-+	isc_mem_destroy(&mctx);
-+	assert_null(mctx);
-+}
-+
-+int
-+main(void) {
-+	const struct CMUnitTest tests[] = {
-+		cmocka_unit_test(isc_entropy_getdata_test),
-+	};
-+
-+	return (cmocka_run_group_tests(tests, NULL, NULL));
-+}
-+
-+#else /* HAVE_CMOCKA */
-+
-+#include <stdio.h>
-+
-+int
-+main(void) {
-+	printf("1..0 # Skipped: cmocka not available\n");
-+	return (0);
-+}
-+
-+#endif
-diff --git a/lib/dns/win32/libdns.def.in b/lib/dns/win32/libdns.def.in
-index 63be973..40b21fa 100644
---- a/lib/dns/win32/libdns.def.in
-+++ b/lib/dns/win32/libdns.def.in
-@@ -1485,6 +1485,13 @@ dst_lib_destroy
- dst_lib_init
- dst_lib_init2
- dst_lib_initmsgcat
-+@IF PKCS11
-+dst_random_getdata
-+@ELSE PKCS11
-+@IF OPENSSL
-+dst_random_getdata
-+@END OPENSSL
-+@END PKCS11
- dst_region_computeid
- dst_region_computerid
- dst_result_register
-diff --git a/lib/isc/entropy.c b/lib/isc/entropy.c
-index ab2f617..ed05ed6 100644
---- a/lib/isc/entropy.c
-+++ b/lib/isc/entropy.c
-@@ -104,11 +104,15 @@ struct isc_entropy {
- 	uint32_t			initialized;
- 	uint32_t			initcount;
- 	isc_entropypool_t		pool;
-+	bool				usehook;
- 	unsigned int			nsources;
- 	isc_entropysource_t	       *nextsource;
- 	ISC_LIST(isc_entropysource_t)	sources;
- };
- 
-+/*% Global Hook */
-+static isc_entropy_getdata_t hook;
-+
- /*% Sample Queue */
- typedef struct {
- 	uint32_t	last_time;	/*%< last time recorded */
-@@ -557,6 +561,11 @@ isc_entropy_getdata(isc_entropy_t *ent, void *data, unsigned int length,
- 
- 	LOCK(&ent->lock);
- 
-+	if (ent->usehook && (hook != NULL)) {
-+		UNLOCK(&ent->lock);
-+		return (hook(data, length, returned, flags));
-+	}
-+
- 	remain = length;
- 	buf = data;
- 	total = 0;
-@@ -708,6 +717,7 @@ isc_entropy_create(isc_mem_t *mctx, isc_entropy_t **entp) {
- 	ent->refcnt = 1;
- 	ent->initialized = 0;
- 	ent->initcount = 0;
-+	ent->usehook = false;
- 	ent->magic = ENTROPY_MAGIC;
- 
- 	isc_entropypool_init(&ent->pool);
-@@ -1286,3 +1296,17 @@ isc_entropy_usebestsource(isc_entropy_t *ectx, isc_entropysource_t **source,
- 	 */
- 	return (final_result);
- }
-+
-+void
-+isc_entropy_usehook(isc_entropy_t *ectx, bool onoff) {
-+	REQUIRE(VALID_ENTROPY(ectx));
-+
-+	LOCK(&ectx->lock);
-+	ectx->usehook = onoff;
-+	UNLOCK(&ectx->lock);
-+}
-+
-+void
-+isc_entropy_sethook(isc_entropy_getdata_t myhook) {
-+	hook = myhook;
-+}
-diff --git a/lib/isc/include/isc/entropy.h b/lib/isc/include/isc/entropy.h
-index 4bba8e1..632166a 100644
---- a/lib/isc/include/isc/entropy.h
-+++ b/lib/isc/include/isc/entropy.h
-@@ -304,6 +304,18 @@ isc_entropy_usebestsource(isc_entropy_t *ectx, isc_entropysource_t **source,
-  *	isc_entropy_createcallbacksource().
-  */
- 
-+void
-+isc_entropy_usehook(isc_entropy_t *ectx, bool onoff);
-+/*!<
-+ * \brief Mark/unmark the given entropy structure as being hooked.
-+ */
-+
-+void
-+isc_entropy_sethook(isc_entropy_getdata_t myhook);
-+/*!<
-+ * \brief Set the getdata hook (e.g., for a crypto random generator).
-+ */
-+
- ISC_LANG_ENDDECLS
- 
- #endif /* ISC_ENTROPY_H */
-diff --git a/lib/isc/include/isc/platform.h.in b/lib/isc/include/isc/platform.h.in
-index 4192946..dbd1560 100644
---- a/lib/isc/include/isc/platform.h.in
-+++ b/lib/isc/include/isc/platform.h.in
-@@ -359,6 +359,11 @@
-  */
- @ISC_PLATFORM_HAVESTRINGSH@
- 
-+/*
-+ * Define if the random functions are provided by crypto.
-+ */
-+@ISC_PLATFORM_CRYPTORANDOM@
-+
- /*
-  * Define if the hash functions must be provided by OpenSSL.
-  */
 diff --git a/lib/isc/include/isc/types.h b/lib/isc/include/isc/types.h
-index da9d66f..4205400 100644
+index f8e5ae6..d0dc9b5 100644
 --- a/lib/isc/include/isc/types.h
 +++ b/lib/isc/include/isc/types.h
-@@ -97,6 +97,8 @@ typedef struct isc_time			isc_time_t;		/*%< Time */
+@@ -82,6 +82,8 @@ typedef struct isc_time			isc_time_t;		/*%< Time */
  typedef struct isc_timer		isc_timer_t;		/*%< Timer */
  typedef struct isc_timermgr		isc_timermgr_t;		/*%< Timer Manager */
  
@@ -1972,61 +348,11 @@ index da9d66f..4205400 100644
  typedef void (*isc_taskaction_t)(isc_task_t *, isc_event_t *);
  typedef int (*isc_sockfdwatch_t)(isc_task_t *, isc_socket_t *, void *, int);
  
-diff --git a/lib/isc/pk11.c b/lib/isc/pk11.c
-index 68aebdc..4b85527 100644
---- a/lib/isc/pk11.c
-+++ b/lib/isc/pk11.c
-@@ -321,14 +321,16 @@ pk11_rand_seed_fromfile(const char *randomfile) {
- 	ret = isc_stdio_open(randomfile, "r", &stream);
- 	if (ret != ISC_R_SUCCESS)
- 		goto cleanup;
--	ret = isc_stdio_read(seed, 1, SEEDSIZE, stream, &cc);
--	if (ret!= ISC_R_SUCCESS)
--		goto cleanup;
-+	while (ret == ISC_R_SUCCESS) {
-+		ret = isc_stdio_read(seed, 1, SEEDSIZE, stream, &cc);
-+		if ((ret != ISC_R_SUCCESS) && (ret != ISC_R_EOF))
-+			goto cleanup;
-+		(void) pkcs_C_SeedRandom(ctx.session, seed, (CK_ULONG) cc);
-+	} 
- 	ret = isc_stdio_close(stream);
- 	stream = NULL;
--	if (ret!= ISC_R_SUCCESS)
-+	if (ret != ISC_R_SUCCESS)
- 		goto cleanup;
--	(void) pkcs_C_SeedRandom(ctx.session, seed, (CK_ULONG) cc);
- 
-     cleanup:
- 	if (stream != NULL)
-diff --git a/lib/isc/win32/include/isc/platform.h.in b/lib/isc/win32/include/isc/platform.h.in
-index 8ade705..fa72f9d 100644
---- a/lib/isc/win32/include/isc/platform.h.in
-+++ b/lib/isc/win32/include/isc/platform.h.in
-@@ -73,6 +73,11 @@
- #define ISC_PLATFORM_NORETURN_PRE __declspec(noreturn)
- #define ISC_PLATFORM_NORETURN_POST
- 
-+/*
-+ * Define if the random functions are provided by crypto.
-+ */
-+@ISC_PLATFORM_CRYPTORANDOM@
-+
- /*
-  * Define if the hash functions must be provided by OpenSSL.
-  */
 diff --git a/win32utils/Configure b/win32utils/Configure
-index 953f2aa..55cc929 100644
+index 9731b0c..0b7bc6e 100644
 --- a/win32utils/Configure
 +++ b/win32utils/Configure
-@@ -382,6 +382,7 @@ my @substdefh = ("ALLOW_FILTER_AAAA",
- my %configdefp;
- 
- my @substdefp = ("ISC_PLATFORM_BUSYWAITNOP",
-+                 "ISC_PLATFORM_CRYPTORANDOM",
-                  "ISC_PLATFORM_HAVEATOMICSTORE",
-                  "ISC_PLATFORM_HAVEATOMICSTOREQ",
-                  "ISC_PLATFORM_HAVECMPXCHG",
-@@ -517,7 +518,8 @@ my @allcond = (@substcond, "NOTYET", "NOLONGER");
+@@ -353,7 +353,8 @@ my @allcond = (@substcond, "NOTYET", "NOLONGER");
  
  # enable-xxx/disable-xxx
  
@@ -2036,80 +362,7 @@ index 953f2aa..55cc929 100644
                    "fixed-rrset",
                    "intrinsics",
                    "isc-spnego",
-@@ -580,6 +582,7 @@ my @help = (
- "\nOptional Features:\n",
- "  enable-intrinsics     enable instrinsic/atomic functions [default=yes]\n",
- "  enable-native-pkcs11  use native PKCS#11 for all crypto [default=no]\n",
-+"  enable-crypto-rand    use crypto provider for random [default=yes]\n",
- "  enable-openssl-hash   use OpenSSL for hash functions [default=yes]\n",
- "  enable-isc-spnego     use SPNEGO from lib/dns [default=yes]\n",
- "  enable-filter-aaaa    enable filtering of AAAA records [default=yes]\n",
-@@ -628,7 +631,9 @@ my $want_clean = "no";
- my $want_unknown = "no";
- my $unknown_value;
- my $enable_intrinsics = "yes";
-+my $cryptolib = "";
- my $enable_native_pkcs11 = "no";
-+my $enable_crypto_rand = "yes";
- my $enable_openssl_hash = "auto";
- my $enable_filter_aaaa = "yes";
- my $enable_isc_spnego = "yes";
-@@ -847,6 +852,10 @@ sub myenable {
-         if ($val =~ /^yes$/i) {
-             $enable_native_pkcs11 = "yes";
-         }
-+    } elsif ($key =~ /^crypto-rand$/i) {
-+        if ($val =~ /^no$/i) {
-+            $enable_crypto_rand = "no";
-+        }
-     } elsif ($key =~ /^openssl-hash$/i) {
-         if ($val =~ /^yes$/i) {
-             $enable_openssl_hash = "yes";
-@@ -1153,6 +1162,11 @@ if ($verbose) {
-     } else {
-         print "native-pkcs11: disabled\n";
-     }
-+    if ($enable_crypto_rand eq "yes") {
-+        print "crypto-rand: enabled\n";
-+    } else {
-+        print "crypto-rand: disabled\n";
-+    }
-     if ($enable_openssl_hash eq "yes") {
-         print "openssl-hash: enabled\n";
-     } else {
-@@ -1510,6 +1524,7 @@ if ($enable_intrinsics eq "yes") {
- 
- # enable-native-pkcs11
- if ($enable_native_pkcs11 eq "yes") {
-+    $cryptolib = "pkcs11";
-     if ($use_openssl eq "auto") {
-         $use_openssl = "no";
-     }
-@@ -1719,6 +1734,7 @@ if ($use_openssl eq "yes") {
-         $openssl_dll = File::Spec->catdir($openssl_path, "@dirlist[0]");
-     }   
- 
-+    $cryptolib = "openssl";
-     $configcond{"OPENSSL"} = 1;
-     $configdefd{"CRYPTO"} = "OPENSSL";
-     $configvar{"OPENSSL_PATH"} = "$openssl_path";
-@@ -2290,6 +2306,15 @@ if ($use_aes eq "yes") {
- }
- 
- 
-+# enable-crypto-rand
-+if ($enable_crypto_rand eq "yes") {
-+    if (($use_openssl eq "no") && ($enable_native_pkcs11 eq "no")) {
-+        die "No crypto provider for random functions\n";
-+    }
-+    $configdefp{"ISC_PLATFORM_CRYPTORANDOM"} = "\"$cryptolib\"";
-+}
-+print "Cryptographic library for DNSSEC: $cryptolib";
-+
- # enable-openssl-hash
- if ($enable_openssl_hash eq "yes") {
-     if ($use_openssl eq "no") {
-@@ -3665,6 +3690,7 @@ exit 0;
+@@ -2929,6 +2930,7 @@ exit 0;
  #  --enable-developer partially supported
  #  --enable-newstats (9.9/9.9sub only)
  #  --enable-native-pkcs11 supported
@@ -2118,5 +371,5 @@ index 953f2aa..55cc929 100644
  #  --enable-openssl-hash supported
  #  --enable-threads included without a way to disable it
 -- 
-2.21.0
+2.20.1
 
diff --git a/bind-9.11-unit-disable-random.patch b/bind-9.11-unit-disable-random.patch
index 553f725..dbd0cb6 100644
--- a/bind-9.11-unit-disable-random.patch
+++ b/bind-9.11-unit-disable-random.patch
@@ -1,4 +1,4 @@
-From 373f07148217a8e70e33446f5108fb42d1079ba6 Mon Sep 17 00:00:00 2001
+From 605d1575414c67f5e7eefeaae9dd2d0820c082dc Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Thu, 21 Feb 2019 22:42:27 +0100
 Subject: [PATCH] Disable random_test
@@ -9,19 +9,18 @@ subtests can occasionally fail, stop it.
 
 It can be used again by defining 'unstable' variable in Kyuafile.
 ---
- lib/isc/tests/Kyuafile | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
+ lib/isc/tests/Kyuafile | 1 +
+ 1 file changed, 1 insertion(+)
 
 diff --git a/lib/isc/tests/Kyuafile b/lib/isc/tests/Kyuafile
-index 4cd2574..9df2340 100644
+index e2b2498..df2741e 100644
 --- a/lib/isc/tests/Kyuafile
 +++ b/lib/isc/tests/Kyuafile
-@@ -19,7 +19,7 @@ tap_test_program{name='pool_test'}
- tap_test_program{name='print_test'}
+@@ -18,6 +18,7 @@ tap_test_program{name='parse_test'}
+ tap_test_program{name='pool_test'}
  tap_test_program{name='queue_test'}
  tap_test_program{name='radix_test'}
--tap_test_program{name='random_test'}
-+tap_test_program{name='random_test', required_configs='unstable'}
++-- tap_test_program{name='random_test', required_configs='unstable'}
  tap_test_program{name='regex_test'}
  tap_test_program{name='result_test'}
  tap_test_program{name='safe_test'}
diff --git a/bind.spec b/bind.spec
index bf07be7..c35e15d 100644
--- a/bind.spec
+++ b/bind.spec
@@ -133,23 +133,25 @@ Patch150:bind-9.11-engine-pkcs11.patch
 Patch153:bind-9.11-export-suffix.patch
 Patch154:bind-9.11-oot-manual.patch
 Patch155:bind-9.11-pk11.patch
-Patch156:bind-9.11-fips-code.patch
+# FIXME: needs review. Should not be required
+#Patch156:bind-9.11-fips-code.patch
 Patch157:bind-9.11-fips-tests.patch
 # [RT #31459] commit 06a8051d2476fb526fe6960832209392c763a9af
-Patch158:bind-9.11-rt31459.patch
+#Patch158:bind-9.11-rt31459.patch
 # [RT #46047] commit 24172bd2eeba91441ab1c65d2717b0692309244a ISC 4724
-Patch159:bind-9.11-rt46047.patch
+#Patch159:bind-9.11-rt46047.patch
 # commit 66ba2fdad583d962a1f4971c85d58381f0849e4d
 # commit b105ccee68ccc3c18e6ea530063b3c8e5a42571c
 # commit 083461d3329ff6f2410745848a926090586a9846
-Patch160:bind-9.11-rh1624100.patch
+#Patch160:bind-9.11-rh1624100.patch
 # https://gitlab.isc.org/isc-projects/bind9/issues/555
-Patch161:bind-9.11-host-idn-disable.patch
+#Patch161:bind-9.11-host-idn-disable.patch
 # https://gitlab.isc.org/isc-projects/bind9/commit/8a98277811e
-Patch163:bind-9.11-rh1663318.patch
+#Patch163:bind-9.11-rh1663318.patch
 # https://gitlab.isc.org/isc-projects/bind9/issues/819
 Patch164:bind-9.11-rh1666814.patch
 # random_test fails too often by random, disable it
+# not present on 9.14.0
 Patch168:bind-9.11-unit-disable-random.patch
 Patch170:bind-9.11-feature-test-named.patch
 Patch171:bind-9.11-tests-variants.patch
@@ -545,13 +547,13 @@ are used for building ISC DHCP.
 %patch153 -p1 -b .export_suffix
 %patch154 -p1 -b .oot-man
 %patch155 -p1 -b .pk11-internal
-%patch156 -p1 -b .fips-code
+#%patch156 -p1 -b .fips-code
 %patch157 -p1 -b .fips-tests
-%patch158 -p1 -b .rt31459
-%patch159 -p1 -b .rt46047
-%patch160 -p1 -b .rh1624100
-%patch161 -p1 -b .host-idn-disable
-%patch163 -p1 -b .rh1663318
+#%patch158 -p1 -b .rt31459
+#%patch159 -p1 -b .rt46047
+#%patch160 -p1 -b .rh1624100
+#%patch161 -p1 -b .host-idn-disable
+#%patch163 -p1 -b .rh1663318
 %patch164 -p1 -b .rh1666814
 %patch168 -p1 -b .random_test-disable
 %patch170 -p1 -b .featuretest-named
diff --git a/bind97-rh669163.patch b/bind97-rh669163.patch
deleted file mode 100644
index 125049f..0000000
--- a/bind97-rh669163.patch
+++ /dev/null
@@ -1,14 +0,0 @@
-diff -up bind-9.7.2-P3/lib/lwres/lwconfig.c.rh669163 bind-9.7.2-P3/lib/lwres/lwconfig.c
---- bind-9.7.2-P3/lib/lwres/lwconfig.c.rh669163	2011-01-28 14:48:38.934472578 +0100
-+++ bind-9.7.2-P3/lib/lwres/lwconfig.c	2011-01-28 14:49:50.421326035 +0100
-@@ -612,6 +612,10 @@ lwres_conf_parse(lwres_context_t *ctx, c
- 			break;
- 		}
- 
-+		/* Ignore options with no parameters */
-+		if (stopchar == '\n')
-+			continue;
-+
- 		if (strlen(word) == 0U)
- 			rval = LWRES_R_SUCCESS;
- 		else if (strcmp(word, "nameserver") == 0)
diff --git a/random.data b/random.data
deleted file mode 100644
index 354add021c50385a89450e5babe1977007bb3352..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 4096
zcmV+b5dZJ`_p!jz`{<|bNV`oX5JC2Ga9@8qoo4f?l+-NC@8v5K1{=o$sJ(MXEOSVw
zGv^GbLd{mne_AVT3rzXm4X7NNLZi5Zek-Hl3(Qfwx;iSW6KHZ~nv7~XaFMAAeVh2x
zmPdsD1|Q_jqS@I1WO|rx;wy^@HC>QdzQ5`{G<TLzB%{l7D>QNzim|^M(%4-UFcO6|
z69yO>y1GA7kp>?Ik+sjkA<ECuUMSdngx%g?pKCRAPgwL=8E$d6F>=lx^BW?*JYfN0
z7q``&{ap9r3r}&Bp+}X}YKA_tT|sqwfj5|>adRw;q#XjlN+rIqS#`LAQ`g!TxKZU*
zQ}lyD3q(cmsjACTQ&&!@+tmkcdc#{LIz_-uzMSLnO7%l~ywQXi@iCweSn#0L8fNT9
zv+KT1+t^>WH)>sYQ6goHgfW)#{zb_+whDWiSY2_n*RuL^f*RBlIT`<J-q8=$V^(BE
zU%~l#Z*iAbE4?ph&#JHN`62+)a(5%B+5;!OoE)b~4>SC#oeFZ-x)UxNujigfa^>m8
zu;jewj{X6Og>TE3>}l?k7Ke%_89T^nq`hvrTya%U<-A+_o*My&LcG4c1rm<W5W_=(
zkJG81F7psuk8y&)e6(|G-6&H0FUwnf&Uo%OzA8zb^p?GJ6zV;>#XOd?V1SspI&}vN
z$pT{+f33B)5z1Q_E-y{5e1q$5FL?!{4O{7cQ#l7gDWN}O|LSrWntS;Us04k7h3HrL
zupfh={aG8I;u0Frfyep2sYnx54CDYl7e>~?0vmz$wqrKF{>sOFN*tWevM9XQ-RF5M
zWUm!pxGq^Oxpc2RkcSOh=$v7C`-DRAhB1AfY{A|6a%dlc@~0N!i*a&j)?9(^Yu$}d
zeG~`AL^w=NjK_agJS_t1@&pl_J#=E~Gmro<e7=&IyX9WmWG!kRcF(47R@+!G#%v%<
zC(J}s^*|SKm6E{pNgI#Ds)XOzc!<+_VD7ZKNS)cCqr8(xohg))I5DnbQ5ZvJ2Q@%Z
z{MmNqz>$3fD(?{4D8mT9eA*u+QfMLAFh+>+|Hfo3B&GT69>fT}Pt(ZSU1jk%MDJk2
z8{Z?%phPoWIvkNylm(l;<Bt#n)_+S8>^F89zrse;@p#szYNIl?SlIjUJ@M1<eOf&D
zqfs?dpo@{aD|x9XK(l{skAl3*zNHUEIw=xKiF`l9m#Sy|9ptcc35vRB--Z!##L1`V
z0qeyr(9)f@kr@J^g(rUy!{h*3`SNa7fcbZ=Wcz;9ChO>;E|Vl}rqVXB3+uDrZ`&^4
z^8KV@!3o@UD1_qE9O4ZC7tUu1vYV5rU@z@twA{Jo8@nEHv-G93-X8J2*%w6o!X9-~
zL_st`^+x1ta&sQJd}*eQT+6`plBoZ;fgE86)dCxOj&A9}7#tM>Ov|SfYxX?Xa2j*k
z`X9Pkr4vG)LU?m)%kuURPL1%vG3nzucmS~bZG5}$7*}-qlF<}vkJ#1(;R#MYdW8>8
zk0GB*$4(h{IZ&Wq=h(CN_`ph*VLTI9NNcV`&!>XUE49w*3lAI|r;gI|j&@7qAT!`x
z{VG6T(ViMDE(11J0Yj;^P8*gxWK;VDkS79Y3%@{O2I<5t&)uGwlyJgCPAv9V*^Ztw
z+peH{VDEyJ>h=_W&3_HTlhsD2&Le%vA--h1RvQA%D6|SxQ7kc^`eMq%mXYq$u!5hk
zGIW;<QGkGmLG2}0<_Z*Q<T~%OJrY6Yj$roN<ql}TGLBcS_li`)e!j}y4Jak;J6dp|
zy;YG1QXNNDx9mO{mo*<v@c^I#Y{*yhYA)AAX5ZBK`h+K&k(8zk{I11JUWn4p*#h9R
zlE8Y(_{zpcA$6=vgK7gp)L_7P2xJ(oy$+lqAAlFUwVK}xxWSWD8x)Dk3Gl2X1Rn<G
z5n6)xw9NIUDYATv;LkA}l^#%*S?BlH7gG*@d%WC02RpJ4coh?qa21FX5uk8&$vf;6
ztGbc1wdBce&C}13SR*N7XyO%iCWtK)J`Yb_WyLQpdYYy;jJ3*Y&R8M$ei)0BduGRQ
z=U!89ezK^aR-By*`O8cvfHN)7a@np&zYB(~y7IVL15S_^-4JBg#8NslOo21;WQSgy
zN#ZZVkAKqWN)#Zt1=DNu?y;PSd|xMDrnXD&pqW>s4-ZZ}&<>9Fprah=*D`K`z&8!W
zA1Z!OWZ*mreX>jv+Iryt*{($kvP335;79#nkx}OMai}p?s%0$qKttTPPp48DufuWx
zA^2j%DkSFDEHV%63(wp>H}xZ{hL0@e9>vJv;7KRA5QpSa!cJQ;2Bh`x@f>64x&D|4
z!Yql9Ym{87bV39PGn`_jkBN~6Z--FM+jDzz<J**#A@iS{W^=!VH}65P8{Kuw`CQpg
z2HQ|9=Hy>J^f&KF@DN|*>0*^FT=`6vSR4H@ae<tJ9WT?H5`N|#-tM4B?u(GtIx#)@
zM^V0qRLs;|%|1AZudf-5Rb|_pT}%G3@|v1h;1Wci{i0UJNp|M9${Vc%l`^J=x`z68
zck)9cyihT1=6@}vK=;;;Uj2F`&Il04;v1Df@Q{dC&$|kJ)WS7i-^o(@w9&dCoU~lW
z_y;&OJ^pWDZ^MkZP<piNH^N7vzwGwwX_l39+R~UR|H=g>01SWQJZJkKi7OQf`rwb^
zV=c1<ko-(6&A?%_$mWE*OF<WP*YLkJhWz6Lfk@gtJTqJp&#hArcoSQ6^^(jqNXY6Y
z#$M>7HJqQFe1JA*6wB$ZOHd!V)zx5Zw1UICc5>e<kU*!USH{+GPw7J9$*Q4AtjmC`
z*O6FU{W_H|=Ed62+q^11pRWK~RMwdO@)QF2fo%$M%>{$EvjY!0%r|VJLMcf+ySJWR
zrYO+1%!a~zH#>Krg2(bZ#N=sJ4Rx@&k+*K0^wPh;I}WJ6!7sXORYTCi_{>iAD5GZq
zq*r)F_M?)ldu%d8oQ7eC0;;K-OEqPs!K?WBt|WFrjh~UIB)q%Ou&pg<v?=Z*5s@7*
z=TmSMaWolknHxbS0Z$OI=haUX(8G4VizgyXR45qldz=^3R#8HLVM+cfJ?uF5%~3t%
zswiC6xLcohj&XcJ^CyPGt=(Rdf<%Xu^yF$&{>QPwnH3i>Xs>(=(9(FGAe3VwA__I@
zba@TaAf<;oCYq}36~aNJ$FRBjtRsas^@i68ein7>>^DaTM^n2c`Fnu$P%&ogp})8U
z``e|HRw^MM#N5uy66qV*iuKWep20R<vt)PG_D#K(n9AniV4Y~P@yo&6^{h!vp(%+I
z(=r^9Li}zAtLvV9Z9Ptb%Af}exBZyl1B|iMZs`1oK)=wKOm8CS+_j<>(65@KV%AFY
zcfTKqC=GN>D9Wm`FwSGY^<{<QQ2T;xTe6e=0c<1MgDpbymfVeJm{;Ixc1?r>q`5D|
zIx%;PiBQZShKEi?z;+LiTCar@NyLVGgMJJ7L157+Off<8-A)9(d|rg7+3gC!_{V3O
zpK+wU!mtYk)JQab>ks+Y0YgIy@vSz(13Fgq9h-((1A+>FIXxdD6%3hD7t+yWN1)1Y
zNnb1fmms4}Yw}eD$!qXa6rj7JboJZw8z9a6N>)?f24{`ZFl4cWG#699!tQuyQJR=L
zbfV;k-k=FgR0@#VkY0gemz-vXVx`?ezZA8)%ff%|-AP;$7bigrUd%OKTzQF$it<y`
zv!ngY^-bvrOmv?%5NSqa^QsXdYYgB(COjp1Vd1aADQ7?)$7Ph4kKe0QyPv*GcdR}Y
zI}{Df`FicujnZx+gTXSEh%vhkVX#p!3q#MjM5`CKKB@FSFhT}lHWc))2FVr<pt}0Z
zfgcFkS_6=I)Za|F21t<$jiO+8!qBx;?<fZ73Qz}yH1<P$^V(<|q0~om!6}VV7H-;Y
ze*s}ri?9Wg`tNw#MH0l~E`5oNm|$t5;%P3|`u-DLm*RS(qe>C&A(6h#(6&)xc2l^;
zwp<GT;#rJT*Xz^-xl{4y1Tq$$=pgTRD7d3Cg!HQj=;(KB=s3Gf2fd*Q@Wgp;l-z>6
zltll=^|U^)xuoJpMDe_$m<m?ncNn>37NDbvRUr|F<!V1;Y#3DkuwAh?TcnuEgfucD
z-hrIKY?0a-ExzL2^=SIiz57{oL!_LmrDz4NUv$C5=x}Z+sEOt%(6Njd$%;3P6F?zA
zXA6Eymxl_d7z^vYWY;le;RBzwV*hk3^8EwB9mKmXfa$AKmIFi)!EWGEewa~DEZKUT
z?$|7OXRZ^4#%rAKpyF`u1mD{a46?cSalU+pXfkT$YHK!-A`-^HO5R{3v!G`Q`&LW4
z^FJkbMhKh20xtiB5<?abU9+-$Bc43UU8V)++X>?f_WOWM4Y7cn?fNhsOzKzvrk=xV
zr~G(o`4e}dE5`|G7Olpy4r;$XlI@B0NY4KQTUGcPG9Q~KvXfE9UZiMq4!to-Zf;B0
z6vGO&4bF{^0n|9;|G+4zgiXy5C_bC2#)cl6;*u)o3~kctV=N(XZ>i1|?87kyr<OML
zG~qy(13J_S+@@(#tnFHI$vMb8v<G~H2zLTk#z|%!w3+V?StYXQQ|Jbb{5Aw$lG+T%
zY+2N3#TvY0dkgw^qtV9@J@O?{mA#4l(nBcF#568tT?i`U5YRxnJ)nS|XX^;Y>k(km
zuPmffVl4pM(nzdaa6G~k!-RE*c&O&_4U&U9RR2#YlauCPn>Fuabhg{d-_GSJIoq&u
zRQ(=mbShm=L-J(bj+AHBR3=R#m*Pdx`U`}Prwb4#kk{=2Cvk}{CqjzHuGVLRfdzTl
znVQ<YLUMk_o_XJGEQjF3$I6P;IW2&XflN&xk*V0htEB2!;H>0*OuFL7ef1}^=}s3u
zA2DlTMf6i5M{FmgC0;7_wo3BL_={G#AuMjwmKBe`YW=Qor+_-Y!GC_S52<t^fDj77
zrdS{}Zo2A^?1SB*y~9o6qhey34QJIkL%okqJ;8JRGhn8;$XwIKfI}ikdXPjDX;n?+
z*KGH|=zGl)t4zz1dwP23Hi)Ty(U)u3W%*Jb777d}rT=5duH+W4I_<@pd7%WZLBqz`
zt=mU1FX9zNOOW!W7Al>aSW<zX{X$*!y!r`139ulbY9;<4QBcr_U5XUNo1X1=5wjv5
z+x?1N$Sg&yvv*;^9b`b3{t2Uw<M5L@NpzJ}u6Jz>byDVt49~woS|*Bz1Wuph3+8xJ
zE7p>Pr65{$OK+TBd8fQ1dS28;2}S=YW*@YVwOY2I03Z_4+2&d*G1cRY0GYBqiuOgg
zikwo45~ouU+M&n+6|%0pz*8%{8WiZ9N_?-H=4SJqv1o`Z4lzc=S(Rxlnx;$ySUm_d
yq`in=81o&*MtO8Rkxhh|?G`=X203G{YJ27jd%{@?@P3y7HGnvR-h<8?=IS24*8b%H


From df81e828c7003aa1217810c80b0343f2e1418ba1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 23 Jul 2019 15:18:22 +0200
Subject: [PATCH 109/460] Update patches to build on 9.14

---
 bind-9.10-dist-native-pkcs11.patch | 419 ++++++++++++-----------------
 bind-9.11-feature-test-named.patch |  51 ++--
 bind-9.11-kyua-pkcs11.patch        | 143 ++--------
 bind-9.11-tests-pkcs11.patch       |  16 +-
 bind-9.11-tests-variants.patch     |  77 +++---
 bind.spec                          |  39 ++-
 6 files changed, 286 insertions(+), 459 deletions(-)

diff --git a/bind-9.10-dist-native-pkcs11.patch b/bind-9.10-dist-native-pkcs11.patch
index df0d896..a3ef6e4 100644
--- a/bind-9.10-dist-native-pkcs11.patch
+++ b/bind-9.10-dist-native-pkcs11.patch
@@ -1,41 +1,36 @@
 diff --git a/bin/Makefile.in b/bin/Makefile.in
-index f0c504a..ce7a2da 100644
+index 9ad7f62..094775a 100644
 --- a/bin/Makefile.in
 +++ b/bin/Makefile.in
-@@ -11,8 +11,8 @@ srcdir =	@srcdir@
+@@ -11,7 +11,7 @@ srcdir =	@srcdir@
  VPATH =		@srcdir@
  top_srcdir =	@top_srcdir@
  
 -SUBDIRS =	named rndc dig delv dnssec tools nsupdate check confgen \
--		@NZD_TOOLS@ @PYTHON_TOOLS@ @PKCS11_TOOLS@ tests
-+SUBDIRS =	named named-pkcs11 rndc dig delv dnssec dnssec-pkcs11 tools nsupdate \
-+		check confgen @NZD_TOOLS@ @PYTHON_TOOLS@ @PKCS11_TOOLS@ tests
++SUBDIRS =	named named-pkcs11 rndc dig delv dnssec dnssec-pkcs11 tools nsupdate check confgen \
+ 		@NZD_TOOLS@ @PYTHON_TOOLS@ @PKCS11_TOOLS@ plugins tests
  TARGETS =
  
- @BIND9_MAKE_RULES@
 diff --git a/bin/dnssec-pkcs11/Makefile.in b/bin/dnssec-pkcs11/Makefile.in
-index 4b8ca13..32f4470 100644
+index be1ac3b..c1ee27c 100644
 --- a/bin/dnssec-pkcs11/Makefile.in
 +++ b/bin/dnssec-pkcs11/Makefile.in
-@@ -15,18 +15,18 @@ VERSION=@BIND9_VERSION@
+@@ -15,17 +15,17 @@ VERSION=@BIND9_VERSION@
  
  @BIND9_MAKE_INCLUDES@
  
--CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} @DST_OPENSSL_INC@
-+CINCLUDES =	${DNS_PKCS11_INCLUDES} ${ISC_PKCS11_INCLUDES}
+-CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} @OPENSSL_INCLUDES@
++CINCLUDES =	${DNS_PKCS11_INCLUDES} ${ISC_PKCS11_INCLUDES} @OPENSSL_INCLUDES@
  
--CDEFINES =	-DVERSION=\"${VERSION}\" @USE_PKCS11@ @PKCS11_ENGINE@ \
--		@CRYPTO@ -DPK11_LIB_LOCATION=\"@PKCS11_PROVIDER@\"
-+CDEFINES =	-DVERSION=\"${VERSION}\" @PKCS11_ENGINE@ \
-+		@CRYPTO_PK11@ -DPK11_LIB_LOCATION=\"@PKCS11_PROVIDER@\"
+ CDEFINES =	-DVERSION=\"${VERSION}\"
  CWARNINGS =
  
--DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
--ISCLIBS =	../../lib/isc/libisc.@A@
--ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@
-+DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
-+ISCLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
-+ISCNOSYMLIBS =	../../lib/isc-pkcs11/libisc-pkcs11-nosymtbl.@A@
+-DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
+-ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
+-ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @OPENSSL_LIBS@
++DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ @DNS_CRYPTO_LIBS@
++ISCLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@ @OPENSSL_LIBS@
++ISCNOSYMLIBS =	../../lib/isc-pkcs11/libisc-pkcs11-nosymtbl.@A@ @OPENSSL_LIBS@
  
 -DNSDEPLIBS =	../../lib/dns/libdns.@A@
 -ISCDEPLIBS =	../../lib/isc/libisc.@A@
@@ -44,25 +39,32 @@ index 4b8ca13..32f4470 100644
  
  DEPLIBS =	${DNSDEPLIBS} ${ISCDEPLIBS}
  
-@@ -35,10 +35,10 @@ LIBS =		${DNSLIBS} ${ISCLIBS} @LIBS@
+@@ -34,11 +34,11 @@ LIBS =		${DNSLIBS} ${ISCLIBS} @LIBS@
  NOSYMLIBS =	${DNSLIBS} ${ISCNOSYMLIBS} @LIBS@
  
  # Alphabetically
--TARGETS =	dnssec-keygen@EXEEXT@ dnssec-signzone@EXEEXT@ \
--		dnssec-keyfromlabel@EXEEXT@ dnssec-dsfromkey@EXEEXT@ \
--		dnssec-revoke@EXEEXT@ dnssec-settime@EXEEXT@ \
--		dnssec-verify@EXEEXT@ dnssec-importkey@EXEEXT@
-+TARGETS =	dnssec-keygen-pkcs11@EXEEXT@ dnssec-signzone-pkcs11@EXEEXT@ \
-+		dnssec-keyfromlabel-pkcs11@EXEEXT@ dnssec-dsfromkey-pkcs11@EXEEXT@ \
-+		dnssec-revoke-pkcs11@EXEEXT@ dnssec-settime-pkcs11@EXEEXT@ \
-+		dnssec-verify-pkcs11@EXEEXT@ dnssec-importkey-pkcs11@EXEEXT@
+-TARGETS =	dnssec-cds@EXEEXT@ dnssec-dsfromkey@EXEEXT@ \
+-		dnssec-importkey@EXEEXT@ dnssec-keyfromlabel@EXEEXT@ \
+-		dnssec-keygen@EXEEXT@ dnssec-revoke@EXEEXT@ \
+-		dnssec-settime@EXEEXT@ dnssec-signzone@EXEEXT@ \
+-		dnssec-verify@EXEEXT@
++TARGETS =	dnssec-cds-pkcs11@EXEEXT@ dnssec-dsfromkey-pkcs11@EXEEXT@ \
++		dnssec-importkey-pkcs11@EXEEXT@ dnssec-keyfromlabel-pkcs11@EXEEXT@ \
++		dnssec-keygen-pkcs11@EXEEXT@ dnssec-revoke-pkcs11@EXEEXT@ \
++		dnssec-settime-pkcs11@EXEEXT@ dnssec-signzone-pkcs11@EXEEXT@ \
++		dnssec-verify-pkcs11@EXEEXT@
  
  OBJS =		dnssectool.@O@
  
-@@ -59,15 +59,15 @@ MANOBJS =	${MANPAGES} ${HTMLPAGES}
+@@ -61,19 +61,19 @@ MANOBJS =	${MANPAGES} ${HTMLPAGES}
  
  @BIND9_MAKE_RULES@
  
+-dnssec-cds@EXEEXT@: dnssec-cds.@O@ ${OBJS} ${DEPLIBS}
++dnssec-cds-pkcs11@EXEEXT@: dnssec-cds.@O@ ${OBJS} ${DEPLIBS}
+ 	export BASEOBJS="dnssec-cds.@O@ ${OBJS}"; \
+ 	${FINALBUILDCMD}
+ 
 -dnssec-dsfromkey@EXEEXT@: dnssec-dsfromkey.@O@ ${OBJS} ${DEPLIBS}
 +dnssec-dsfromkey-pkcs11@EXEEXT@: dnssec-dsfromkey.@O@ ${OBJS} ${DEPLIBS}
  	export BASEOBJS="dnssec-dsfromkey.@O@ ${OBJS}"; \
@@ -78,7 +80,7 @@ index 4b8ca13..32f4470 100644
  	export BASEOBJS="dnssec-keygen.@O@ ${OBJS}"; \
  	${FINALBUILDCMD}
  
-@@ -75,7 +75,7 @@ dnssec-signzone.@O@: dnssec-signzone.c
+@@ -81,7 +81,7 @@ dnssec-signzone.@O@: dnssec-signzone.c
  	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} -DVERSION=\"${VERSION}\" \
  		-c ${srcdir}/dnssec-signzone.c
  
@@ -87,7 +89,7 @@ index 4b8ca13..32f4470 100644
  	export BASEOBJS="dnssec-signzone.@O@ ${OBJS}"; \
  	${FINALBUILDCMD}
  
-@@ -83,19 +83,19 @@ dnssec-verify.@O@: dnssec-verify.c
+@@ -89,19 +89,19 @@ dnssec-verify.@O@: dnssec-verify.c
  	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} -DVERSION=\"${VERSION}\" \
  		-c ${srcdir}/dnssec-verify.c
  
@@ -111,7 +113,7 @@ index 4b8ca13..32f4470 100644
  	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \
  	dnssec-importkey.@O@ ${OBJS} ${LIBS}
  
-@@ -106,16 +106,14 @@ docclean manclean maintainer-clean::
+@@ -112,16 +112,14 @@ docclean manclean maintainer-clean::
  
  installdirs:
  	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
@@ -129,49 +131,35 @@ index 4b8ca13..32f4470 100644
  	for t in ${TARGETS}; do ${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/$$t || exit 1; done
  
  clean distclean::
-diff --git a/bin/dnssec/Makefile.in b/bin/dnssec/Makefile.in
-index 4b8ca13..4175996 100644
---- a/bin/dnssec/Makefile.in
-+++ b/bin/dnssec/Makefile.in
-@@ -17,7 +17,7 @@ VERSION=@BIND9_VERSION@
- 
- CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} @DST_OPENSSL_INC@
- 
--CDEFINES =	-DVERSION=\"${VERSION}\" @USE_PKCS11@ @PKCS11_ENGINE@ \
-+CDEFINES =	-DVERSION=\"${VERSION}\" \
- 		@CRYPTO@ -DPK11_LIB_LOCATION=\"@PKCS11_PROVIDER@\"
- CWARNINGS =
- 
 diff --git a/bin/named-pkcs11/Makefile.in b/bin/named-pkcs11/Makefile.in
-index 70e5571..b5a4a6b 100644
+index 856463f..dc826dd 100644
 --- a/bin/named-pkcs11/Makefile.in
 +++ b/bin/named-pkcs11/Makefile.in
 @@ -43,27 +43,27 @@ DLZDRIVER_INCLUDES =	@DLZ_DRIVER_INCLUDES@
  DLZDRIVER_LIBS =	@DLZ_DRIVER_LIBS@
  
  CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
--		${LWRES_INCLUDES} ${DNS_INCLUDES} ${BIND9_INCLUDES} \
--		${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} ${ISC_INCLUDES} \
-+		${LWRES_INCLUDES} ${DNS_PKCS11_INCLUDES} ${BIND9_INCLUDES} \
-+		${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} ${ISC_PKCS11_INCLUDES} \
- 		${DLZDRIVER_INCLUDES} ${DBDRIVER_INCLUDES} ${MAXMINDDB_CFLAGS} \
- 		@DST_OPENSSL_INC@
+-		${NS_INCLUDES} ${DNS_INCLUDES} \
++		${NS_INCLUDES} ${DNS_PKCS11_INCLUDES} \
+ 		${BIND9_INCLUDES} ${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} \
+-		${ISC_INCLUDES} ${DLZDRIVER_INCLUDES} \
++		${ISC_PKCS11_INCLUDES} ${DLZDRIVER_INCLUDES} \
+ 		${DBDRIVER_INCLUDES} @OPENSSL_INCLUDES@
  
--CDEFINES =      @CONTRIB_DLZ@ @USE_PKCS11@ @PKCS11_ENGINE@ @USE_GSSAPI@ @CRYPTO@
-+CDEFINES =      @USE_PKCS11@ @PKCS11_ENGINE@ @CRYPTO_PK11@ @USE_GSSAPI@
+ CDEFINES =      @CONTRIB_DLZ@
  
  CWARNINGS =
  
--DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
-+DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
+-DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
++DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ @DNS_CRYPTO_LIBS@
  ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
  ISCCCLIBS =	../../lib/isccc/libisccc.@A@
--ISCLIBS =	../../lib/isc/libisc.@A@
--ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@
-+ISCLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
-+ISCNOSYMLIBS =	../../lib/isc-pkcs11/libisc-pkcs11-nosymtbl.@A@
- LWRESLIBS =	../../lib/lwres/liblwres.@A@
+-ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
+-ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @OPENSSL_LIBS@
++ISCLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@ @OPENSSL_LIBS@
++ISCNOSYMLIBS =	../../lib/isc-pkcs11/libisc-pkcs11-nosymtbl.@A@ @OPENSSL_LIBS@
  BIND9LIBS =	../../lib/bind9/libbind9.@A@
+ NSLIBS =	../../lib/ns/libns.@A@
  
 -DNSDEPLIBS =	../../lib/dns/libdns.@A@
 +DNSDEPLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@
@@ -179,49 +167,51 @@ index 70e5571..b5a4a6b 100644
  ISCCCDEPLIBS =	../../lib/isccc/libisccc.@A@
 -ISCDEPLIBS =	../../lib/isc/libisc.@A@
 +ISCDEPLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
- LWRESDEPLIBS =	../../lib/lwres/liblwres.@A@
  BIND9DEPLIBS =	../../lib/bind9/libbind9.@A@
+ NSDEPLIBS =	../../lib/ns/libns.@A@
  
-@@ -72,15 +72,15 @@ DEPLIBS =	${LWRESDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
+@@ -72,17 +72,17 @@ DEPLIBS =	${NSDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
  
- LIBS =		${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
+ LIBS =		${NSLIBS} ${DNSLIBS} ${BIND9LIBS} \
  		${ISCCFGLIBS} ${ISCCCLIBS} ${ISCLIBS} \
--		${DLZDRIVER_LIBS} ${DBDRIVER_LIBS} @LIBS@
-+		@LIBS@
+-		${DLZDRIVER_LIBS} ${DBDRIVER_LIBS} @LIBCAP_LIBS@ \
++		@LIBCAP_LIBS@ \
+ 		@LIBS@
  
- NOSYMLIBS =	${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
+ NOSYMLIBS =	${NSLIBS} ${DNSLIBS} ${BIND9LIBS} \
  		${ISCCFGLIBS} ${ISCCCLIBS} ${ISCNOSYMLIBS} \
--		${DLZDRIVER_LIBS} ${DBDRIVER_LIBS} @LIBS@
-+		@LIBS@
+-		${DLZDRIVER_LIBS} ${DBDRIVER_LIBS} @LIBCAP_LIBS@ \
++		@LIBCAP_LIBS@ \
+ 		@LIBS@
  
  SUBDIRS =	unix
  
--TARGETS =	named@EXEEXT@ lwresd@EXEEXT@ feature-test@EXEEXT@
+-TARGETS =	named@EXEEXT@ feature-test@EXEEXT@
 +TARGETS =	named-pkcs11@EXEEXT@ feature-test-pkcs11@EXEEXT@
  
  GEOIPLINKOBJS = geoip.@O@
- GEOIP2LINKOBJS = geoip.@O@
-@@ -94,8 +94,7 @@ OBJS =		builtin.@O@ client.@O@ config.@O@ control.@O@ \
- 		tkeyconf.@O@ tsigconf.@O@ update.@O@ xfrout.@O@ \
- 		zoneconf.@O@ \
- 		lwaddr.@O@ lwresd.@O@ lwdclient.@O@ lwderror.@O@ lwdgabn.@O@ \
--		lwdgnba.@O@ lwdgrbn.@O@ lwdnoop.@O@ lwsearch.@O@ \
+ 
+@@ -90,8 +90,7 @@ OBJS =		builtin.@O@ config.@O@ control.@O@ \
+ 		controlconf.@O@ fuzz.@O@ @GEOIPLINKOBJS@ \
+ 		log.@O@ logconf.@O@ main.@O@ \
+ 		server.@O@ statschannel.@O@ \
+-		tkeyconf.@O@ tsigconf.@O@ zoneconf.@O@ \
 -		${DLZDRIVER_OBJS} ${DBDRIVER_OBJS}
-+        lwdgnba.@O@ lwdgrbn.@O@ lwdnoop.@O@ lwsearch.@O@
++		tkeyconf.@O@ tsigconf.@O@ zoneconf.@O@
  
  UOBJS =		unix/os.@O@ unix/dlz_dlopen_driver.@O@
  
-@@ -113,8 +112,7 @@ SRCS =		builtin.c client.c config.c control.c \
- 		tkeyconf.c tsigconf.c update.c xfrout.c \
- 		zoneconf.c \
- 		lwaddr.c lwresd.c lwdclient.c lwderror.c lwdgabn.c \
--		lwdgnba.c lwdgrbn.c lwdnoop.c lwsearch.c \
+@@ -103,8 +102,7 @@ SRCS =		builtin.c config.c control.c \
+ 		controlconf.c fuzz.c @GEOIPLINKSRCS@ \
+ 		log.c logconf.c main.c \
+ 		server.c statschannel.c \
+-		tkeyconf.c tsigconf.c zoneconf.c \
 -		${DLZDRIVER_SRCS} ${DBDRIVER_SRCS}
-+        lwdgnba.c lwdgrbn.c lwdnoop.c lwsearch.c
++		tkeyconf.c tsigconf.c zoneconf.c
  
- MANPAGES =	named.8 lwresd.8 named.conf.5
+ MANPAGES =	named.8 named.conf.5
  
-@@ -154,21 +152,21 @@ server.@O@: server.c
+@@ -143,7 +141,7 @@ server.@O@: server.c
  		-DPRODUCT=\"${PRODUCT}\" \
  		-DVERSION=\"${VERSION}\" -c ${srcdir}/server.c
  
@@ -230,15 +220,7 @@ index 70e5571..b5a4a6b 100644
  	export MAKE_SYMTABLE="yes"; \
  	export BASEOBJS="${OBJS} ${UOBJS}"; \
  	${FINALBUILDCMD}
- 
--lwresd@EXEEXT@: named@EXEEXT@
-+lwresd@EXEEXT@: named-pkcs11@EXEEXT@
- 	rm -f lwresd@EXEEXT@
--	@LN@ named@EXEEXT@ lwresd@EXEEXT@
-+	@LN@ named-pkcs11@EXEEXT@ lwresd@EXEEXT@
- 
- # Bit of hack, do not produce intermediate .o object for featuretest
- feature-test.@O@: ${top_srcdir}/bin/tests/system/feature-test.c
+@@ -153,7 +151,7 @@ feature-test.@O@: ${top_srcdir}/bin/tests/system/feature-test.c
  	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} \
  		-c ${top_srcdir}/bin/tests/system/feature-test.c
  
@@ -247,44 +229,28 @@ index 70e5571..b5a4a6b 100644
  	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} \
  		-o $@ feature-test.@O@ ${ISCLIBS} ${LIBS}
  
-@@ -201,16 +199,11 @@ install-man8: named.8 lwresd.8
+@@ -186,13 +184,13 @@ install-man8: named.8
  
  install-man: install-man5 install-man8
  
--install:: named@EXEEXT@ lwresd@EXEEXT@ installdirs install-man
+-install:: named@EXEEXT@ installdirs install-man
 -	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named@EXEEXT@ ${DESTDIR}${sbindir}
--	(cd ${DESTDIR}${sbindir}; rm -f lwresd@EXEEXT@; @LN@ named@EXEEXT@ lwresd@EXEEXT@)
-+install:: named-pkcs11@EXEEXT@ installdirs
++install:: named-pkcs11@EXEEXT@ installdirs install-man
 +	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named-pkcs11@EXEEXT@ ${DESTDIR}${sbindir}
  
  uninstall::
--	rm -f ${DESTDIR}${mandir}/man5/named.conf.5
--	rm -f ${DESTDIR}${mandir}/man8/lwresd.8
--	rm -f ${DESTDIR}${mandir}/man8/named.8
--	rm -f ${DESTDIR}${sbindir}/lwresd@EXEEXT@
+ 	rm -f ${DESTDIR}${mandir}/man5/named.conf.5
+ 	rm -f ${DESTDIR}${mandir}/man8/named.8
 -	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/named@EXEEXT@
 +	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/named-pkcs11@EXEEXT@
  
  @DLZ_DRIVER_RULES@
  
-diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
-index 70e5571..4cfed4d 100644
---- a/bin/named/Makefile.in
-+++ b/bin/named/Makefile.in
-@@ -48,7 +48,7 @@ CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
- 		${DLZDRIVER_INCLUDES} ${DBDRIVER_INCLUDES} ${MAXMINDDB_CFLAGS} \
- 		@DST_OPENSSL_INC@
- 
--CDEFINES =      @CONTRIB_DLZ@ @USE_PKCS11@ @PKCS11_ENGINE@ @USE_GSSAPI@ @CRYPTO@
-+CDEFINES =      @CONTRIB_DLZ@ @USE_GSSAPI@ @CRYPTO@
- 
- CWARNINGS =
- 
 diff --git a/bin/pkcs11/Makefile.in b/bin/pkcs11/Makefile.in
-index a058c91..d4b689a 100644
+index 454d145..0e542f3 100644
 --- a/bin/pkcs11/Makefile.in
 +++ b/bin/pkcs11/Makefile.in
-@@ -15,13 +15,13 @@ top_srcdir =	@top_srcdir@
+@@ -13,13 +13,13 @@ top_srcdir =	@top_srcdir@
  
  @BIND9_MAKE_INCLUDES@
  
@@ -293,8 +259,7 @@ index a058c91..d4b689a 100644
  
  CDEFINES =
  
--ISCLIBS =	../../lib/isc/libisc.@A@ @ISC_OPENSSL_LIBS@
-+ISCLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@ @ISC_OPENSSL_LIBS@
+ ISCLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@ @OPENSSL_LIBS@
  
 -ISCDEPLIBS =	../../lib/isc/libisc.@A@
 +ISCDEPLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
@@ -302,13 +267,13 @@ index a058c91..d4b689a 100644
  DEPLIBS =	${ISCDEPLIBS}
  
 diff --git a/configure.ac b/configure.ac
-index 9b7d778..59ba20b 100644
+index 6e17d3a..0f7c850 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -1139,12 +1139,14 @@ AC_SUBST(USE_GSSAPI)
+@@ -1188,12 +1188,14 @@ AC_SUBST(USE_GSSAPI)
  AC_SUBST(DST_GSSAPI_INC)
  AC_SUBST(DNS_GSSAPI_LIBS)
- DNS_CRYPTO_LIBS="$DNS_GSSAPI_LIBS $DNS_CRYPTO_LIBS"
+ DNS_CRYPTO_LIBS="$DNS_GSSAPI_LIBS"
 +DNS_CRYPTO_PK11_LIBS="$DNS_GSSAPI_LIBS $DNS_CRYPTO_PK11_LIBS"
  
  #
@@ -319,96 +284,50 @@ index 9b7d778..59ba20b 100644
 +AC_SUBST(DNS_CRYPTO_PK11_LIBS)
  
  #
- # was --with-randomdev specified?
-@@ -1494,11 +1496,11 @@ AC_ARG_ENABLE(openssl-hash,
- AC_MSG_CHECKING(for OpenSSL library)
- OPENSSL_WARNING=
- openssldirs="/usr /usr/local /usr/local/ssl /opt/local /usr/pkg /usr/sfw"
--if test "yes" = "$want_native_pkcs11"
--then
--	use_openssl="native_pkcs11"
--	AC_MSG_RESULT(use of native PKCS11 instead)
--fi
-+# if test "yes" = "$want_native_pkcs11"
-+# then
-+# 	use_openssl="native_pkcs11"
-+# 	AC_MSG_RESULT(use of native PKCS11 instead)
-+# fi
- 
- if test "auto" = "$use_openssl"
- then
-@@ -1511,6 +1513,7 @@ then
- 		fi
- 	done
+ # was --with-lmdb specified?
+@@ -2466,6 +2468,9 @@ AC_SUBST(BIND9_DNS_BUILDINCLUDE)
+ AC_SUBST(BIND9_NS_BUILDINCLUDE)
+ AC_SUBST(BIND9_BIND9_BUILDINCLUDE)
+ AC_SUBST(BIND9_IRS_BUILDINCLUDE)
++AC_SUBST(BIND9_ISC_PKCS11_BUILDINCLUDE)
++AC_SUBST(BIND9_DNS_PKCS11_BUILDINCLUDE)
++AC_SUBST(BIND9_NS_PKCS11_BUILDINCLUDE)
+ if test "X$srcdir" != "X"; then
+ 	BIND9_ISC_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/isc/include"
+ 	BIND9_ISCCC_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/isccc/include"
+@@ -2474,6 +2479,9 @@ if test "X$srcdir" != "X"; then
+ 	BIND9_NS_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/ns/include"
+ 	BIND9_BIND9_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/bind9/include"
+ 	BIND9_IRS_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/irs/include"
++	BIND9_ISC_PKCS11_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/isc-pkcs11/include"
++	BIND9_DNS_PKCS11_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/dns-pkcs11/include"
++	BIND9_NS_PKCS11_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/ns-pkcs11/include"
+ else
+ 	BIND9_ISC_BUILDINCLUDE=""
+ 	BIND9_ISCCC_BUILDINCLUDE=""
+@@ -2482,6 +2490,9 @@ else
+ 	BIND9_NS_BUILDINCLUDE=""
+ 	BIND9_BIND9_BUILDINCLUDE=""
+ 	BIND9_IRS_BUILDINCLUDE=""
++	BIND9_ISC_PKCS11_BUILDINCLUDE=""
++	BIND9_DNS_PKCS11_BUILDINCLUDE=""
++	BIND9_NS_PKCS11_BUILDINCLUDE=""
  fi
-+CRYPTO_PK11=""
- OPENSSL_ECDSA=""
- OPENSSL_GOST=""
- OPENSSL_ED25519=""
-@@ -1532,11 +1535,10 @@ case "$with_gost" in
- 		;;
- esac
  
--case "$use_openssl" in
--	native_pkcs11)
--		AC_MSG_RESULT(disabled because of native PKCS11)
-+if test "$want_native_pkcs11" = "yes"
-+then
- 		DST_OPENSSL_INC=""
--		CRYPTO="-DPKCS11CRYPTO"
-+		CRYPTO_PK11="-DPKCS11CRYPTO"
- 		CRYPTOLIB="pkcs11"
- 		OPENSSLECDSALINKOBJS=""
- 		OPENSSLECDSALINKSRCS=""
-@@ -1546,7 +1548,9 @@ case "$use_openssl" in
- 		OPENSSLGOSTLINKSRCS=""
- 		OPENSSLLINKOBJS=""
- 		OPENSSLLINKSRCS=""
--		;;
-+fi
-+
-+case "$use_openssl" in
- 	no)
- 		AC_MSG_RESULT(no)
- 		DST_OPENSSL_INC=""
-@@ -1578,7 +1582,7 @@ case "$use_openssl" in
- If you do not want OpenSSL, use --without-openssl])
- 		;;
- 	*)
--		if test "yes" = "$want_native_pkcs11"
-+		if false # test "yes" = "$want_native_pkcs11"
- 		then
- 			AC_MSG_RESULT()
- 			AC_MSG_ERROR([OpenSSL and native PKCS11 cannot be used together.])
-@@ -2006,6 +2010,7 @@ AC_SUBST(OPENSSL_ED25519)
- AC_SUBST(OPENSSL_GOST)
- 
- DNS_CRYPTO_LIBS="$DNS_CRYPTO_LIBS $DST_OPENSSL_LIBS"
-+DNS_CRYPTO_PK11_LIBS="$DNS_CRYPTO_LIBS"
- 
- ISC_PLATFORM_WANTAES="#undef ISC_PLATFORM_WANTAES"
- if test "yes" = "$with_aes"
-@@ -2291,6 +2296,7 @@ esac
- AC_SUBST(PKCS11LINKOBJS)
- AC_SUBST(PKCS11LINKSRCS)
- AC_SUBST(CRYPTO)
-+AC_SUBST(CRYPTO_PK11)
- AC_SUBST(PKCS11_ECDSA)
- AC_SUBST(PKCS11_GOST)
- AC_SUBST(PKCS11_ED25519)
-@@ -5405,8 +5411,11 @@ AC_CONFIG_FILES([
+ AC_SUBST_FILE(BIND9_MAKE_INCLUDES)
+@@ -2940,8 +2951,11 @@ AC_CONFIG_FILES([
  	bin/delv/Makefile
  	bin/dig/Makefile
  	bin/dnssec/Makefile
-+	bin/dnssec-pkcs11/Makefile	
++	bin/dnssec-pkcs11/Makefile
  	bin/named/Makefile
  	bin/named/unix/Makefile
 +	bin/named-pkcs11/Makefile
 +	bin/named-pkcs11/unix/Makefile
  	bin/nsupdate/Makefile
  	bin/pkcs11/Makefile
- 	bin/python/Makefile
-@@ -5479,6 +5488,10 @@ AC_CONFIG_FILES([
+ 	bin/plugins/Makefile
+@@ -3014,6 +3028,10 @@ AC_CONFIG_FILES([
  	lib/dns/include/dns/Makefile
  	lib/dns/include/dst/Makefile
  	lib/dns/tests/Makefile
@@ -419,16 +338,13 @@ index 9b7d778..59ba20b 100644
  	lib/irs/Makefile
  	lib/irs/include/Makefile
  	lib/irs/include/irs/Makefile
-@@ -5503,6 +5516,24 @@ AC_CONFIG_FILES([
+@@ -3034,6 +3052,20 @@ AC_CONFIG_FILES([
  	lib/isc/unix/include/Makefile
  	lib/isc/unix/include/isc/Makefile
  	lib/isc/unix/include/pkcs11/Makefile
-+	lib/isc-pkcs11/$arch/Makefile
-+	lib/isc-pkcs11/$arch/include/Makefile
-+	lib/isc-pkcs11/$arch/include/isc/Makefile
-+	lib/isc-pkcs11/$thread_dir/Makefile
-+	lib/isc-pkcs11/$thread_dir/include/Makefile
-+	lib/isc-pkcs11/$thread_dir/include/isc/Makefile
++	lib/isc-pkcs11/pthreads/Makefile
++	lib/isc-pkcs11/pthreads/include/Makefile
++	lib/isc-pkcs11/pthreads/include/isc/Makefile
 +	lib/isc-pkcs11/Makefile
 +	lib/isc-pkcs11/include/Makefile
 +	lib/isc-pkcs11/include/isc/Makefile
@@ -436,7 +352,6 @@ index 9b7d778..59ba20b 100644
 +	lib/isc-pkcs11/include/pk11/Makefile
 +	lib/isc-pkcs11/include/pkcs11/Makefile
 +	lib/isc-pkcs11/tests/Makefile
-+	lib/isc-pkcs11/nls/Makefile
 +	lib/isc-pkcs11/unix/Makefile
 +	lib/isc-pkcs11/unix/include/Makefile
 +	lib/isc-pkcs11/unix/include/isc/Makefile
@@ -445,46 +360,44 @@ index 9b7d778..59ba20b 100644
  	lib/isccc/include/Makefile
  	lib/isccc/include/isccc/Makefile
 diff --git a/lib/Makefile.in b/lib/Makefile.in
-index 81270a0..bcb5312 100644
+index ffa2d5a..439d748 100644
 --- a/lib/Makefile.in
 +++ b/lib/Makefile.in
 @@ -15,7 +15,7 @@ top_srcdir =	@top_srcdir@
  # Attempt to disable parallel processing.
  .NOTPARALLEL:
  .NO_PARALLEL:
--SUBDIRS =	isc isccc dns isccfg bind9 lwres irs samples
-+SUBDIRS =	isc isc-pkcs11 isccc dns dns-pkcs11 isccfg bind9 lwres irs samples
+-SUBDIRS =	isc isccc dns ns isccfg bind9 irs samples
++SUBDIRS =	isc isc-pkcs11 isccc dns dns-pkcs11 ns isccfg bind9 irs samples
  TARGETS =
  
  @BIND9_MAKE_RULES@
 diff --git a/lib/dns-pkcs11/Makefile.in b/lib/dns-pkcs11/Makefile.in
-index 7f09bd6..c388d9e 100644
+index eb3346a..c9e4960 100644
 --- a/lib/dns-pkcs11/Makefile.in
 +++ b/lib/dns-pkcs11/Makefile.in
-@@ -26,17 +26,16 @@ VERSION=@BIND9_VERSION@
+@@ -26,16 +26,16 @@ VERSION=@BIND9_VERSION@
  
  USE_ISC_SPNEGO = @USE_ISC_SPNEGO@
  
 -CINCLUDES =	-I. -I${top_srcdir}/lib/dns -Iinclude ${DNS_INCLUDES} \
--		${ISC_INCLUDES} ${MAXMINDDB_CFLAGS} \
--		@DST_OPENSSL_INC@ @DST_GSSAPI_INC@
+-		${ISC_INCLUDES} @OPENSSL_INCLUDES@ @DST_GSSAPI_INC@
 +CINCLUDES =	-I. -I${top_srcdir}/lib/dns-pkcs11 -Iinclude ${DNS_PKCS11_INCLUDES} \
-+		${ISC_PKCS11_INCLUDES} ${MAXMINDDB_CFLAGS} @DST_OPENSSL_INC@ @DST_GSSAPI_INC@
++		${ISC_PKCS11_INCLUDES} @OPENSSL_INCLUDES@ @DST_GSSAPI_INC@
  
--CDEFINES =	-DUSE_MD5 @CRYPTO@ @USE_GSSAPI@ ${USE_ISC_SPNEGO}
-+CDEFINES =	-DUSE_MD5 @CRYPTO_PK11@ @USE_GSSAPI@ ${USE_ISC_SPNEGO}
+ CDEFINES =	@USE_GSSAPI@ ${USE_ISC_SPNEGO}
  
  CWARNINGS =
  
--ISCLIBS =	../../lib/isc/libisc.@A@
-+ISCLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
+-ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
++ISCLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@ @OPENSSL_LIBS@
  
 -ISCDEPLIBS =	../../lib/isc/libisc.@A@
 +ISCDEPLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
  
- LIBS =		${MAXMINDDB_LIBS} @LIBS@
+ LIBS =		@LIBS@
  
-@@ -150,15 +149,15 @@ version.@O@: version.c
+@@ -134,15 +134,15 @@ version.@O@: version.c
  		-DLIBAGE=${LIBAGE} \
  		-c ${srcdir}/version.c
  
@@ -504,9 +417,13 @@ index 7f09bd6..c388d9e 100644
  
  include: gen
  	${MAKE} include/dns/enumtype.h
-@@ -189,22 +188,22 @@ gen: gen.c
- 	${BUILD_CPPFLAGS} ${BUILD_LDFLAGS} -o $@ ${srcdir}/gen.c \
- 	${BUILD_LIBS} ${LFS_LIBS}
+@@ -168,25 +168,25 @@ code.h:	gen
+ 	./gen -s ${srcdir} > code.h || { rm -f $@ ; exit 1; }
+ 
+ gen: gen.c
+-	${BUILD_CC} ${BUILD_CFLAGS} -I${top_srcdir}/lib/isc/include \
++	${BUILD_CC} ${BUILD_CFLAGS} -I${top_srcdir}/lib/isc-pkcs11/include \
+ 	${BUILD_CPPFLAGS} ${BUILD_LDFLAGS} -o $@ ${srcdir}/gen.c ${BUILD_LIBS}
  
 -timestamp: include libdns.@A@
 +timestamp: include libdns-pkcs11.@A@
@@ -531,23 +448,21 @@ index 7f09bd6..c388d9e 100644
 +	rm -f libdns-pkcs11.@A@ timestamp
  	rm -f gen code.h include/dns/enumtype.h include/dns/enumclass.h
  	rm -f include/dns/rdatastruct.h
- 	rm -f dnstap.pb-c.c dnstap.pb-c.h
+ 	rm -f dnstap.pb-c.c dnstap.pb-c.h include/dns/dnstap.pb-c.h
 diff --git a/lib/isc-pkcs11/Makefile.in b/lib/isc-pkcs11/Makefile.in
-index 8ad54bb..a3ecdfb 100644
+index ed87279..3171b48 100644
 --- a/lib/isc-pkcs11/Makefile.in
 +++ b/lib/isc-pkcs11/Makefile.in
-@@ -23,8 +23,8 @@ CINCLUDES =	-I${srcdir}/unix/include \
- 		-I${srcdir}/@ISC_THREAD_DIR@/include \
- 		-I${srcdir}/@ISC_ARCH_DIR@/include \
+@@ -20,7 +20,7 @@ VERSION=@BIND9_VERSION@
+ CINCLUDES =	-I${srcdir}/unix/include \
+ 		-I${srcdir}/pthreads/include \
  		-I./include \
--		-I${srcdir}/include ${DNS_INCLUDES} @ISC_OPENSSL_INC@
--CDEFINES =	@CRYPTO@ -DPK11_LIB_LOCATION=\"${PROVIDER}\"
-+		-I${srcdir}/include ${DNS_PKCS11_INCLUDES}
-+CDEFINES =	@CRYPTO_PK11@ -DPK11_LIB_LOCATION=\"${PROVIDER}\"
+-		-I${srcdir}/include ${DNS_INCLUDES} @OPENSSL_INCLUDES@
++		-I${srcdir}/include ${DNS_PKCS11_INCLUDES} @OPENSSL_INCLUDES@
+ CDEFINES =
  CWARNINGS =
  
- # Alphabetically
-@@ -103,40 +103,40 @@ version.@O@: version.c
+@@ -94,40 +94,40 @@ version.@O@: version.c
  		-DLIBAGE=${LIBAGE} \
  		-c ${srcdir}/version.c
  
@@ -600,21 +515,37 @@ index 8ad54bb..a3ecdfb 100644
 -	libisc-nosymtbl.la timestamp
 +	rm -f libisc-pkcs11.@A@ libisc-pkcs11-nosymtbl.@A@ libisc-pkcs11.la \
 +	libisc-pkcs11-nosymtbl.la timestamp
+diff --git a/lib/isc-pkcs11/tests/Makefile.in b/lib/isc-pkcs11/tests/Makefile.in
+index 5735829..7e62737 100644
+--- a/lib/isc-pkcs11/tests/Makefile.in
++++ b/lib/isc-pkcs11/tests/Makefile.in
+@@ -18,7 +18,7 @@ VERSION=@BIND9_VERSION@
+ CINCLUDES =	-I. -Iinclude ${ISC_INCLUDES} @OPENSSL_INCLUDES@ @CMOCKA_CFLAGS@
+ CDEFINES =	-DTESTS="\"${top_builddir}/lib/isc/tests/\""
+ 
+-ISCLIBS =	../libisc.@A@ @OPENSSL_LIBS@
++ISCLIBS =	../libisc-pkcs11.@A@ @OPENSSL_LIBS@
+ ISCDEPLIBS =	../libisc.@A@
+ 
+ LIBS =		@LIBS@ @CMOCKA_LIBS@
 diff --git a/make/includes.in b/make/includes.in
-index fa86ad1..3cfbe9f 100644
+index 48cdaf7..6e6572b 100644
 --- a/make/includes.in
 +++ b/make/includes.in
-@@ -43,3 +43,13 @@ BIND9_INCLUDES = @BIND9_BIND9_BUILDINCLUDE@ \
+@@ -39,3 +39,16 @@ BIND9_INCLUDES = @BIND9_BIND9_BUILDINCLUDE@ \
  
  TEST_INCLUDES = \
  	-I${top_srcdir}/lib/tests/include
 +
-+ISC_PKCS11_INCLUDES = @BIND9_ISC_BUILDINCLUDE@ \
++ISC_PKCS11_INCLUDES = @BIND9_ISC_PKCS11_BUILDINCLUDE@ \
 +	-I${top_srcdir}/lib/isc-pkcs11 \
 +	-I${top_srcdir}/lib/isc-pkcs11/include \
 +	-I${top_srcdir}/lib/isc-pkcs11/unix/include \
-+	-I${top_srcdir}/lib/isc-pkcs11/@ISC_THREAD_DIR@/include \
-+	-I${top_srcdir}/lib/isc-pkcs11/@ISC_ARCH_DIR@/include
++	-I${top_srcdir}/lib/isc-pkcs11/pthreads/include
 +
-+DNS_PKCS11_INCLUDES = @BIND9_DNS_BUILDINCLUDE@ \
++DNS_PKCS11_INCLUDES = @BIND9_DNS_PKCS11_BUILDINCLUDE@ \
 +	-I${top_srcdir}/lib/dns-pkcs11/include
++
++NS_PKCS11_INCLUDES = @BIND9_NS_PKCS11_BUILDINCLUDE@ \
++	-I${top_srcdir}/lib/ns-pkcs11/include
++
diff --git a/bind-9.11-feature-test-named.patch b/bind-9.11-feature-test-named.patch
index c8e6d57..1b89e1b 100644
--- a/bind-9.11-feature-test-named.patch
+++ b/bind-9.11-feature-test-named.patch
@@ -1,4 +1,4 @@
-From 3f2fafe5368655225eddf0537e58e425bbc297be Mon Sep 17 00:00:00 2001
+From b45cc1caf018d46753a03d59bb9e75cdeef1deeb Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Wed, 30 Jan 2019 14:37:17 +0100
 Subject: [PATCH] Create feature-test in source directory
@@ -6,40 +6,27 @@ Subject: [PATCH] Create feature-test in source directory
 Feature-test tool is used in system tests to test compiled in changes.
 Because we build more variants of named with different configuration,
 compile feature-test for each of them this way.
-
-Named variant specific feature-test does not have defined gss support,
-even when it was enabled by configure. bin/tests/system Makefile defines
-it, so define it also in named variants.
 ---
- bin/named/Makefile.in       | 13 +++++++++++--
+ bin/named/Makefile.in       | 11 ++++++++++-
  bin/tests/system/conf.sh.in |  2 +-
- 2 files changed, 12 insertions(+), 3 deletions(-)
+ 2 files changed, 11 insertions(+), 2 deletions(-)
 
 diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
-index 3166368..70e5571 100644
+index 10d568f..856463f 100644
 --- a/bin/named/Makefile.in
 +++ b/bin/named/Makefile.in
-@@ -48,7 +48,7 @@ CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
- 		${DLZDRIVER_INCLUDES} ${DBDRIVER_INCLUDES} ${MAXMINDDB_CFLAGS} \
- 		@DST_OPENSSL_INC@
- 
--CDEFINES =      @CONTRIB_DLZ@ @USE_PKCS11@ @PKCS11_ENGINE@ @CRYPTO@
-+CDEFINES =      @CONTRIB_DLZ@ @USE_PKCS11@ @PKCS11_ENGINE@ @USE_GSSAPI@ @CRYPTO@
- 
- CWARNINGS =
- 
-@@ -80,7 +80,7 @@ NOSYMLIBS =	${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
+@@ -82,7 +82,7 @@ NOSYMLIBS =	${NSLIBS} ${DNSLIBS} ${BIND9LIBS} \
  
  SUBDIRS =	unix
  
--TARGETS =	named@EXEEXT@ lwresd@EXEEXT@
-+TARGETS =	named@EXEEXT@ lwresd@EXEEXT@ feature-test@EXEEXT@
+-TARGETS =	named@EXEEXT@
++TARGETS =	named@EXEEXT@ feature-test@EXEEXT@
  
  GEOIPLINKOBJS = geoip.@O@
- GEOIP2LINKOBJS = geoip.@O@
-@@ -163,6 +163,15 @@ lwresd@EXEEXT@: named@EXEEXT@
- 	rm -f lwresd@EXEEXT@
- 	@LN@ named@EXEEXT@ lwresd@EXEEXT@
+ 
+@@ -148,6 +148,15 @@ named@EXEEXT@: ${OBJS} ${DEPLIBS}
+ 	export BASEOBJS="${OBJS} ${UOBJS}"; \
+ 	${FINALBUILDCMD}
  
 +# Bit of hack, do not produce intermediate .o object for featuretest
 +feature-test.@O@: ${top_srcdir}/bin/tests/system/feature-test.c
@@ -54,18 +41,18 @@ index 3166368..70e5571 100644
  
  docclean manclean maintainer-clean::
 diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
-index cedabbe..e1bf5da 100644
+index d9efc63..0f4ead0 100644
 --- a/bin/tests/system/conf.sh.in
 +++ b/bin/tests/system/conf.sh.in
-@@ -71,7 +71,7 @@ DNSTAPREAD=$TOP/bin/tools/dnstap-read
- MDIG=$TOP/bin/tools/mdig
- NZD2NZF=$TOP/bin/tools/named-nzd2nzf
- FSTRM_CAPTURE=@FSTRM_CAPTURE@
+@@ -38,7 +38,7 @@ DELV=$TOP/bin/delv/delv
+ DIG=$TOP/bin/dig/dig
+ DNSTAPREAD=$TOP/bin/tools/dnstap-read
+ DSFROMKEY=$TOP/bin/dnssec/dnssec-dsfromkey
 -FEATURETEST=$TOP/bin/tests/system/feature-test
 +FEATURETEST=$TOP/bin/named/feature-test
- 
- RANDFILE=$TOP/bin/tests/system/random.data
- 
+ FSTRM_CAPTURE=@FSTRM_CAPTURE@
+ IMPORTKEY=$TOP/bin/dnssec/dnssec-importkey
+ JOURNALPRINT=$TOP/bin/tools/named-journalprint
 -- 
 2.20.1
 
diff --git a/bind-9.11-kyua-pkcs11.patch b/bind-9.11-kyua-pkcs11.patch
index ac15d22..cb9fe4c 100644
--- a/bind-9.11-kyua-pkcs11.patch
+++ b/bind-9.11-kyua-pkcs11.patch
@@ -1,4 +1,4 @@
-From eb38d2278937ec3fe45d0af30cd080953bbb5b54 Mon Sep 17 00:00:00 2001
+From 9b9087cce00acd8f1fc2ce8e5c89d1dab1158683 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Tue, 2 Jan 2018 18:13:07 +0100
 Subject: [PATCH] Fix pkcs11 variants atf tests
@@ -9,17 +9,16 @@ Add pkcs11 Kyuafile, fix dh_test to pass in pkcs11 mode
 ---
  configure.ac                     |  1 +
  lib/Kyuafile                     |  2 ++
- lib/dns-pkcs11/tests/Makefile.in | 10 +++++-----
+ lib/dns-pkcs11/tests/Makefile.in | 12 ++++++------
  lib/dns-pkcs11/tests/dh_test.c   |  3 ++-
  lib/isc-pkcs11/tests/Makefile.in |  6 +++---
- lib/isc-pkcs11/tests/hash_test.c | 32 +++++++++++++++++++++++++-------
- 6 files changed, 38 insertions(+), 16 deletions(-)
+ 5 files changed, 14 insertions(+), 10 deletions(-)
 
 diff --git a/configure.ac b/configure.ac
-index 0532feb..a83ddd5 100644
+index b7dd8e5..e9dbbba 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -5578,6 +5578,7 @@ AC_CONFIG_FILES([
+@@ -3023,6 +3023,7 @@ AC_CONFIG_FILES([
  	lib/dns-pkcs11/include/Makefile
  	lib/dns-pkcs11/include/dns/Makefile
  	lib/dns-pkcs11/include/dst/Makefile
@@ -28,7 +27,7 @@ index 0532feb..a83ddd5 100644
  	lib/irs/include/Makefile
  	lib/irs/include/irs/Makefile
 diff --git a/lib/Kyuafile b/lib/Kyuafile
-index 7c8bab0..eec9564 100644
+index 39ce986..dcfb139 100644
 --- a/lib/Kyuafile
 +++ b/lib/Kyuafile
 @@ -2,8 +2,10 @@ syntax(2)
@@ -41,34 +40,37 @@ index 7c8bab0..eec9564 100644
 +include('isc-pkcs11/Kyuafile')
  include('isccc/Kyuafile')
  include('isccfg/Kyuafile')
- include('lwres/Kyuafile')
+ include('ns/Kyuafile')
 diff --git a/lib/dns-pkcs11/tests/Makefile.in b/lib/dns-pkcs11/tests/Makefile.in
-index 7671e1d..e237d5c 100644
+index 7b35b93..c95d1c8 100644
 --- a/lib/dns-pkcs11/tests/Makefile.in
 +++ b/lib/dns-pkcs11/tests/Makefile.in
-@@ -17,12 +17,12 @@ VERSION=@BIND9_VERSION@
+@@ -15,14 +15,14 @@ VERSION=@BIND9_VERSION@
  
- CINCLUDES =	-I. -Iinclude ${DNS_INCLUDES} ${ISC_INCLUDES} \
- 		@DST_OPENSSL_INC@
--CDEFINES =	@CRYPTO@ -DTESTS="\"${top_builddir}/lib/dns/tests/\""
-+CDEFINES =	@CRYPTO_PK11@ -DTESTS="\"${top_builddir}/lib/dns-pkcs11/tests/\""
+ @BIND9_MAKE_INCLUDES@
  
--ISCLIBS =	../../isc/libisc.@A@
+-CINCLUDES =	-I. -Iinclude ${DNS_INCLUDES} ${ISC_INCLUDES} \
++CINCLUDES =	-I. -Iinclude ${DNS_PKCS11_INCLUDES} ${ISC_PKCS11_INCLUDES} \
+ 		@OPENSSL_INCLUDES@ @CMOCKA_CFLAGS@
+-CDEFINES =	-DTESTS="\"${top_builddir}/lib/dns/tests/\""
++CDEFINES =	-DTESTS="\"${top_builddir}/lib/dns-pkcs11/tests/\""
+ 
+-ISCLIBS =	../../isc/libisc.@A@ @OPENSSL_LIBS@
 -ISCDEPLIBS =	../../isc/libisc.@A@
--DNSLIBS =	../libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
+-DNSLIBS =	../libdns.@A@ @DNS_CRYPTO_LIBS@
 -DNSDEPLIBS =	../libdns.@A@
 +ISCLIBS =	../../isc-pkcs11/libisc-pkcs11.@A@
 +ISCDEPLIBS =	../../isc-pkcs11/libisc-pkcs11.@A@
-+DNSLIBS =	../libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
++DNSLIBS =	../libdns-pkcs11.@A@ @DNS_CRYPTO_LIBS@
 +DNSDEPLIBS =	../libdns-pkcs11.@A@
  
  LIBS =		@LIBS@ @CMOCKA_LIBS@
- CFLAGS =	@CFLAGS@ @CMOCKA_CFLAGS@
+ 
 diff --git a/lib/dns-pkcs11/tests/dh_test.c b/lib/dns-pkcs11/tests/dh_test.c
-index 4dbfd82..a383b8e 100644
+index d83d9f5..d5bda29 100644
 --- a/lib/dns-pkcs11/tests/dh_test.c
 +++ b/lib/dns-pkcs11/tests/dh_test.c
-@@ -86,7 +86,8 @@ dh_computesecret(void **state) {
+@@ -85,7 +85,8 @@ dh_computesecret(void **state) {
  	result = dst_key_computesecret(key, key, &buf);
  	assert_int_equal(result, DST_R_NOTPRIVATEKEY);
  	result = key->func->computesecret(key, key, &buf);
@@ -79,114 +81,23 @@ index 4dbfd82..a383b8e 100644
  	dst_key_free(&key);
  }
 diff --git a/lib/isc-pkcs11/tests/Makefile.in b/lib/isc-pkcs11/tests/Makefile.in
-index 2fdee0b..a263b35 100644
+index 5735829..97b26c1 100644
 --- a/lib/isc-pkcs11/tests/Makefile.in
 +++ b/lib/isc-pkcs11/tests/Makefile.in
 @@ -16,10 +16,10 @@ VERSION=@BIND9_VERSION@
  @BIND9_MAKE_INCLUDES@
  
- CINCLUDES =	-I. -Iinclude ${ISC_INCLUDES} @ISC_OPENSSL_INC@
--CDEFINES =	@CRYPTO@ -DTESTS="\"${top_builddir}/lib/isc/tests/\""
-+CDEFINES =	@CRYPTO_PK11@ -DTESTS="\"${top_builddir}/lib/isc-pkcs11/tests/\""
+ CINCLUDES =	-I. -Iinclude ${ISC_INCLUDES} @OPENSSL_INCLUDES@ @CMOCKA_CFLAGS@
+-CDEFINES =	-DTESTS="\"${top_builddir}/lib/isc/tests/\""
++CDEFINES =	-DTESTS="\"${top_builddir}/lib/isc-pkcs11/tests/\""
  
--ISCLIBS =	../libisc.@A@ @ISC_OPENSSL_LIBS@
+-ISCLIBS =	../libisc.@A@ @OPENSSL_LIBS@
 -ISCDEPLIBS =	../libisc.@A@
 +ISCLIBS =	../libisc-pkcs11.@A@ @ISC_OPENSSL_LIBS@
 +ISCDEPLIBS =	../libisc-pkcs11.@A@
  
  LIBS =		@LIBS@ @CMOCKA_LIBS@
- CFLAGS =	@CFLAGS@ @CMOCKA_CFLAGS@
-diff --git a/lib/isc-pkcs11/tests/hash_test.c b/lib/isc-pkcs11/tests/hash_test.c
-index 9c4d299..d9deba2 100644
---- a/lib/isc-pkcs11/tests/hash_test.c
-+++ b/lib/isc-pkcs11/tests/hash_test.c
-@@ -85,7 +85,7 @@ typedef struct hash_testcase {
  
- typedef struct hash_test_key {
- 	const char *key;
--	const int len;
-+	const unsigned len;
- } hash_test_key_t;
- 
- /* non-hmac tests */
-@@ -956,8 +956,11 @@ isc_hmacsha1_test(void **state) {
- 	hash_test_key_t *test_key = test_keys;
- 
- 	while (testcase->input != NULL && testcase->result != NULL) {
-+		int len = ISC_MAX(test_key->len, ISC_SHA1_DIGESTLENGTH);
-+
-+		memset(buffer, 0, ISC_SHA1_DIGESTLENGTH);
- 		memmove(buffer, test_key->key, test_key->len);
--		isc_hmacsha1_init(&hmacsha1, buffer, test_key->len);
-+		isc_hmacsha1_init(&hmacsha1, buffer, len);
- 		isc_hmacsha1_update(&hmacsha1,
- 				    (const uint8_t *) testcase->input,
- 				    testcase->input_len);
-@@ -1116,8 +1119,11 @@ isc_hmacsha224_test(void **state) {
- 	hash_test_key_t *test_key = test_keys;
- 
- 	while (testcase->input != NULL && testcase->result != NULL) {
-+		int len = ISC_MAX(test_key->len, ISC_SHA224_DIGESTLENGTH);
-+
-+		memset(buffer, 0, ISC_SHA224_DIGESTLENGTH);
- 		memmove(buffer, test_key->key, test_key->len);
--		isc_hmacsha224_init(&hmacsha224, buffer, test_key->len);
-+		isc_hmacsha224_init(&hmacsha224, buffer, len);
- 		isc_hmacsha224_update(&hmacsha224,
- 				      (const uint8_t *) testcase->input,
- 				      testcase->input_len);
-@@ -1277,8 +1283,11 @@ isc_hmacsha256_test(void **state) {
- 	hash_test_key_t *test_key = test_keys;
- 
- 	while (testcase->input != NULL && testcase->result != NULL) {
-+		int len = ISC_MAX(test_key->len, ISC_SHA256_DIGESTLENGTH);
-+
-+		memset(buffer, 0, ISC_SHA256_DIGESTLENGTH);
- 		memmove(buffer, test_key->key, test_key->len);
--		isc_hmacsha256_init(&hmacsha256, buffer, test_key->len);
-+		isc_hmacsha256_init(&hmacsha256, buffer, len);
- 		isc_hmacsha256_update(&hmacsha256,
- 				      (const uint8_t *) testcase->input,
- 				      testcase->input_len);
-@@ -1444,8 +1453,11 @@ isc_hmacsha384_test(void **state) {
- 	hash_test_key_t *test_key = test_keys;
- 
- 	while (testcase->input != NULL && testcase->result != NULL) {
-+		int len = ISC_MAX(test_key->len, ISC_SHA384_DIGESTLENGTH);
-+
-+		memset(buffer, 0, ISC_SHA384_DIGESTLENGTH);
- 		memmove(buffer, test_key->key, test_key->len);
--		isc_hmacsha384_init(&hmacsha384, buffer, test_key->len);
-+		isc_hmacsha384_init(&hmacsha384, buffer, len);
- 		isc_hmacsha384_update(&hmacsha384,
- 				      (const uint8_t *) testcase->input,
- 				      testcase->input_len);
-@@ -1611,8 +1623,11 @@ isc_hmacsha512_test(void **state) {
- 	hash_test_key_t *test_key = test_keys;
- 
- 	while (testcase->input != NULL && testcase->result != NULL) {
-+		int len = ISC_MAX(test_key->len, ISC_SHA512_DIGESTLENGTH);
-+
-+		memset(buffer, 0, ISC_SHA512_DIGESTLENGTH);
- 		memmove(buffer, test_key->key, test_key->len);
--		isc_hmacsha512_init(&hmacsha512, buffer, test_key->len);
-+		isc_hmacsha512_init(&hmacsha512, buffer, len);
- 		isc_hmacsha512_update(&hmacsha512,
- 				      (const uint8_t *) testcase->input,
- 				      testcase->input_len);
-@@ -1755,8 +1770,11 @@ isc_hmacmd5_test(void **state) {
- 	hash_test_key_t *test_key = test_keys;
- 
- 	while (testcase->input != NULL && testcase->result != NULL) {
-+		int len = ISC_MAX(test_key->len, ISC_MD5_DIGESTLENGTH);
-+
-+		memset(buffer, 0, ISC_MD5_DIGESTLENGTH);
- 		memmove(buffer, test_key->key, test_key->len);
--		isc_hmacmd5_init(&hmacmd5, buffer, test_key->len);
-+		isc_hmacmd5_init(&hmacmd5, buffer, len);
- 		isc_hmacmd5_update(&hmacmd5,
- 				   (const uint8_t *) testcase->input,
- 				   testcase->input_len);
 -- 
 2.20.1
 
diff --git a/bind-9.11-tests-pkcs11.patch b/bind-9.11-tests-pkcs11.patch
index 79c55b2..cdba1b0 100644
--- a/bind-9.11-tests-pkcs11.patch
+++ b/bind-9.11-tests-pkcs11.patch
@@ -1,4 +1,4 @@
-From 66298a12b09784eab2c052ab22f87bb2b2f1267b Mon Sep 17 00:00:00 2001
+From 84fc64b556d5b5145eb7831393b856a26a818dc1 Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Fri, 1 Mar 2019 15:55:46 +0100
 Subject: [PATCH] Detect correctly pkcs11 support
@@ -23,17 +23,17 @@ index b974708..3bbef4c 100644
  
  $PK11DEL -w0 > /dev/null 2>&1
 diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
-index a446c18..ede1203 100644
+index e7831d8..aa2d841 100644
 --- a/bin/tests/system/conf.sh.in
 +++ b/bin/tests/system/conf.sh.in
-@@ -46,6 +46,7 @@ CHECKZONE=$TOP/bin/check/named-checkzone
- CHECKCONF=$TOP/bin/check/named-checkconf
+@@ -52,6 +52,7 @@ NSLOOKUP=$TOP/bin/dig/nslookup
+ NSUPDATE=$TOP/bin/nsupdate/nsupdate
+ NZD2NZF=$TOP/bin/tools/named-nzd2nzf
+ PK11DEL="$TOP/bin/pkcs11/pkcs11-destroy -s ${SLOT:-0} -p ${HSMPIN:-1234} -w 0"
++PK11DESTROY=$TOP/bin/pkcs11/pkcs11-destroy
  PK11GEN="$TOP/bin/pkcs11/pkcs11-keygen -q -s ${SLOT:-0} -p ${HSMPIN:-1234}"
  PK11LIST="$TOP/bin/pkcs11/pkcs11-list -s ${SLOT:-0} -p ${HSMPIN:-1234}"
-+PK11DESTROY=$TOP/bin/pkcs11/pkcs11-destroy
- PK11DEL="$TOP/bin/pkcs11/pkcs11-destroy -s ${SLOT:-0} -p ${HSMPIN:-1234} -w 0"
- JOURNALPRINT=$TOP/bin/tools/named-journalprint
- VERIFY=$TOP/bin/dnssec/dnssec-verify
+ RESOLVE=$TOP/lib/samples/resolve
 -- 
 2.20.1
 
diff --git a/bind-9.11-tests-variants.patch b/bind-9.11-tests-variants.patch
index d983671..275f3cb 100644
--- a/bind-9.11-tests-variants.patch
+++ b/bind-9.11-tests-variants.patch
@@ -1,4 +1,4 @@
-From 06a22ff20ac3d68fa1f995c91068b43392425e43 Mon Sep 17 00:00:00 2001
+From e706bb1dccf0b3492664c591f99f698a2a40fce7 Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Fri, 1 Mar 2019 15:48:20 +0100
 Subject: [PATCH] Make alternative named builds testable in system tests
@@ -13,53 +13,52 @@ export NAMED_VARIANT=-sdb DNSSEC_VARIANT=
 For pkcs variant use:
 export NAMED_VARIANT=-pkcs11 DNSSEC_VARIANT=-pkcs11
 ---
- bin/tests/system/conf.sh.in | 19 ++++++++++---------
- 1 file changed, 10 insertions(+), 9 deletions(-)
+ bin/tests/system/conf.sh.in | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
 
 diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
-index 4b0fe39..f135af6 100644
+index 0f4ead0..e7831d8 100644
 --- a/bin/tests/system/conf.sh.in
 +++ b/bin/tests/system/conf.sh.in
-@@ -34,7 +34,7 @@ DISABLED_ALGORITHM=ECDSAP384SHA384
- DISABLED_ALGORITHM_NUMBER=14
- DISABLED_BITS=384
- 
+@@ -37,16 +37,16 @@ DDNSCONFGEN=$TOP/bin/confgen/ddns-confgen
+ DELV=$TOP/bin/delv/delv
+ DIG=$TOP/bin/dig/dig
+ DNSTAPREAD=$TOP/bin/tools/dnstap-read
+-DSFROMKEY=$TOP/bin/dnssec/dnssec-dsfromkey
+-FEATURETEST=$TOP/bin/named/feature-test
++DSFROMKEY=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-dsfromkey${DNSSEC_VARIANT}
++FEATURETEST=$TOP/bin/named${NAMED_VARIANT}/feature-test${NAMED_VARIANT}
+ FSTRM_CAPTURE=@FSTRM_CAPTURE@
+-IMPORTKEY=$TOP/bin/dnssec/dnssec-importkey
++IMPORTKEY=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-importkey${DNSSEC_VARIANT}
+ JOURNALPRINT=$TOP/bin/tools/named-journalprint
+-KEYFRLAB=$TOP/bin/dnssec/dnssec-keyfromlabel
+-KEYGEN=$TOP/bin/dnssec/dnssec-keygen
++KEYFRLAB=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-keyfromlabel${DNSSEC_VARIANT}
++KEYGEN=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-keygen${DNSSEC_VARIANT}
+ KEYMGR=$TOP/bin/python/dnssec-keymgr
+ MDIG=$TOP/bin/tools/mdig
 -NAMED=$TOP/bin/named/named
 +NAMED=$TOP/bin/named${NAMED_VARIANT}/named${NAMED_VARIANT}
- # We must use "named -l" instead of "lwresd" because argv[0] is lost
- # if the program is libtoolized.
- LWRESD="$TOP/bin/named/named -l"
-@@ -45,13 +45,14 @@ NSUPDATE=$TOP/bin/nsupdate/nsupdate
- DDNSCONFGEN=$TOP/bin/confgen/ddns-confgen
- TSIGKEYGEN=$TOP/bin/confgen/tsig-keygen
- RNDCCONFGEN=$TOP/bin/confgen/rndc-confgen
--KEYGEN=$TOP/bin/dnssec/dnssec-keygen
--KEYFRLAB=$TOP/bin/dnssec/dnssec-keyfromlabel
--SIGNER=$TOP/bin/dnssec/dnssec-signzone
+ NSEC3HASH=$TOP/bin/tools/nsec3hash
+ NSLOOKUP=$TOP/bin/dig/nslookup
+ NSUPDATE=$TOP/bin/nsupdate/nsupdate
+@@ -55,12 +55,12 @@ PK11DEL="$TOP/bin/pkcs11/pkcs11-destroy -s ${SLOT:-0} -p ${HSMPIN:-1234} -w 0"
+ PK11GEN="$TOP/bin/pkcs11/pkcs11-keygen -q -s ${SLOT:-0} -p ${HSMPIN:-1234}"
+ PK11LIST="$TOP/bin/pkcs11/pkcs11-list -s ${SLOT:-0} -p ${HSMPIN:-1234}"
+ RESOLVE=$TOP/lib/samples/resolve
 -REVOKE=$TOP/bin/dnssec/dnssec-revoke
--SETTIME=$TOP/bin/dnssec/dnssec-settime
--DSFROMKEY=$TOP/bin/dnssec/dnssec-dsfromkey
--IMPORTKEY=$TOP/bin/dnssec/dnssec-importkey
-+KEYGEN=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-keygen${DNSSEC_VARIANT}
-+KEYFRLAB=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-keyfromlabel${DNSSEC_VARIANT}
-+SIGNER=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-signzone${DNSSEC_VARIANT}
 +REVOKE=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-revoke${DNSSEC_VARIANT}
+ RNDC=$TOP/bin/rndc/rndc
+ RNDCCONFGEN=$TOP/bin/confgen/rndc-confgen
+ RRCHECKER=$TOP/bin/tools/named-rrchecker
+-SETTIME=$TOP/bin/dnssec/dnssec-settime
+-SIGNER=$TOP/bin/dnssec/dnssec-signzone
 +SETTIME=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-settime${DNSSEC_VARIANT}
-+DSFROMKEY=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-dsfromkey${DNSSEC_VARIANT}
-+IMPORTKEY=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-importkey${DNSSEC_VARIANT}
-+CHECKDS=$TOP/bin/python/dnssec-checkds
- CHECKDS=$TOP/bin/python/dnssec-checkds
- COVERAGE=$TOP/bin/python/dnssec-coverage
- KEYMGR=$TOP/bin/python/dnssec-keymgr
-@@ -71,7 +72,7 @@ DNSTAPREAD=$TOP/bin/tools/dnstap-read
- MDIG=$TOP/bin/tools/mdig
- NZD2NZF=$TOP/bin/tools/named-nzd2nzf
- FSTRM_CAPTURE=@FSTRM_CAPTURE@
--FEATURETEST=$TOP/bin/named/feature-test
-+FEATURETEST=$TOP/bin/named${NAMED_VARIANT}/feature-test${NAMED_VARIANT}
- 
- RANDFILE=$TOP/bin/tests/system/random.data
- 
++SIGNER=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-signzone${DNSSEC_VARIANT}
+ TSIGKEYGEN=$TOP/bin/confgen/tsig-keygen
+ VERIFY=$TOP/bin/dnssec/dnssec-verify
+ WIRETEST=$TOP/bin/tests/wire_test
 -- 
 2.20.1
 
diff --git a/bind.spec b/bind.spec
index c35e15d..1e83ecd 100644
--- a/bind.spec
+++ b/bind.spec
@@ -10,7 +10,9 @@
 # bcond_without is built by default, unless --without X is passed
 # bcond_with is built only when --with X is passed to build
 %bcond_with    SYSTEMTEST
-%bcond_without SDB
+# TODO: sdb tools from contrib were removed.
+# Disable SDB for now
+%bcond_with SDB
 %bcond_without GSSTSIG
 # it is not possible to build the package without PKCS11 sub-package
 # due to extensive changes to Makefiles
@@ -55,10 +57,10 @@
 #
 
 # lib*.so.X versions of selected libraries
-%global sover_dns 1107
-%global sover_isc 1104
-%global sover_irs 161
-%global sover_isccfg 163
+%global sover_dns 1306
+%global sover_isc 1306
+%global sover_irs 1301
+%global sover_isccfg 1302
 
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
@@ -106,7 +108,6 @@ Source46: named-setup-rndc.service
 Source47: named-pkcs11.service
 Source48: setup-named-softhsm.sh
 Source49: named-chroot.files
-Source50: random.data
 
 # Common patches
 Patch10: bind-9.5-PIE.patch
@@ -118,7 +119,7 @@ Patch112:bind97-rh645544.patch
 Patch130:bind-9.9.1-P2-dlz-libdb.patch
 Patch131:bind-9.9.1-P2-multlib-conflict.patch
 Patch133:bind99-rh640538.patch
-Patch134:bind97-rh669163.patch
+#Patch134:bind97-rh669163.patch # lwres discontinued
 # Fedora specific patch to distribute native-pkcs#11 functionality
 Patch136:bind-9.10-dist-native-pkcs11.patch
 
@@ -153,10 +154,12 @@ Patch164:bind-9.11-rh1666814.patch
 # random_test fails too often by random, disable it
 # not present on 9.14.0
 Patch168:bind-9.11-unit-disable-random.patch
+#Patch169:bind-9.11-feature-test-dlz.patch
 Patch170:bind-9.11-feature-test-named.patch
 Patch171:bind-9.11-tests-variants.patch
 Patch172:bind-9.11-tests-pkcs11.patch
 Patch173:bind-9.11-rh1732883.patch
+#Patch174: bind-9.11-unit-timer-nothread.patch
 # Make sure jsonccp-devel does not interfere
 Patch174:bind-9.11-json-c.patch
 Patch175:bind-9.11-fips-disable.patch
@@ -556,10 +559,12 @@ are used for building ISC DHCP.
 #%patch163 -p1 -b .rh1663318
 %patch164 -p1 -b .rh1666814
 %patch168 -p1 -b .random_test-disable
+#%patch169 -p1 -b .featuretest-dlz
 %patch170 -p1 -b .featuretest-named
 %patch171 -p1 -b .test-variant
 %patch172 -p1 -b .test-pkcs11
 %patch173 -p1 -b .rh1732883
+#%patch174 -p1 -b .unit-timer
 %patch174 -p1 -b .json-c
 %patch175 -p1 -b .rh1709553
 %patch177 -p1 -b .serve-stale
@@ -570,9 +575,6 @@ are used for building ISC DHCP.
 %patch186 -p1 -b .rh1736762-8
 %patch187 -p1 -b .oot-gen
 
-mkdir lib/dns/tests/testdata/dstrandom
-cp -a %{SOURCE50} lib/dns/tests/testdata/dstrandom/random.data
-
 %if %{with PKCS11}
 cp -r bin/named{,-pkcs11}
 cp -r bin/dnssec{,-pkcs11}
@@ -612,7 +614,7 @@ cp -fp contrib/sdb/sqlite/zone2sqlite.c bin/sdb_tools
 %endif
 
 %patch133 -p1 -b .rh640538
-%patch134 -p1 -b .rh669163
+#%patch134 -p1 -b .rh669163
 
 # Sparc and s390 arches need to use -fPIE
 %ifarch sparcv9 sparc64 s390 s390x
@@ -669,15 +671,11 @@ export LIBDIR_SUFFIX
   --with-python=%{__python3} \
   --with-libtool \
   --localstatedir=/var \
-  --enable-threads \
-  --enable-ipv6 \
-  --enable-filter-aaaa \
   --with-pic \
   --disable-static \
   --includedir=%{_includedir}/bind9 \
   --with-tuning=large \
   --with-libidn2 \
-  --enable-openssl-hash \
 %if %{with GEOIP}
   --with-geoip \
 %endif
@@ -785,7 +783,6 @@ export LIBDIR_SUFFIX
         --libdir=%{_libdir}%{_export_dir} \
         --includedir=%{_includedir}%{_export_dir}/ \
         --disable-threads \
-        --enable-openssl-hash \
 %if %{with GSSTSIG}
         --with-gssapi=yes \
         --disable-isc-spnego \
@@ -1341,9 +1338,9 @@ fi;
 %endif
 
 %files libs
-%{_libdir}/libbind9.so.161*
-%{_libdir}/libisccc.so.161*
-%{_libdir}/liblwres.so.161*
+%{_libdir}/libbind9.so.1302*
+%{_libdir}/libisccc.so.1302*
+%{_libdir}/libns.so.1304*
 
 %files libs-lite
 %{_libdir}/libdns.so.%{sover_dns}*
@@ -1408,7 +1405,7 @@ fi;
 %{_includedir}/bind9/config.h
 %{_includedir}/bind9/bind9
 %{_includedir}/bind9/isccc
-%{_includedir}/bind9/lwres
+%{_includedir}/bind9/ns
 %{_mandir}/man1/isc-config.sh.1*
 %{_mandir}/man1/bind9-config.1*
 %{_mandir}/man3/lwres*
@@ -1569,7 +1566,9 @@ fi;
 
 %if %{with DLZ} && %{with BDB}
 %files dlz-bdb
+%if %{with SDB}
 %{_sbindir}/dlzbdb
+%endif
 %{_libdir}/bind/dlz_bdbhpt_dynamic.so
 %doc contrib/dlz/modules/bdbhpt/testing/*
 %doc contrib/dlz/modules/bdbhpt/README*

From aaee84a4fb5aaccf9cf8f93df32b626c1c82c2c5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 23 Jul 2019 16:18:58 +0200
Subject: [PATCH 110/460] First version compiling up to tests

Unfortunately, test fails.
---
 bind-9.10-dist-native-pkcs11.patch |  5 +-
 bind-9.11-fips-tests.patch         | 15 ++---
 bind-9.11-kyua-pkcs11.patch        | 17 +++---
 bind-9.14-json-c.patch             | 95 ++++++++++++++++++++++++++++++
 bind.spec                          | 12 ++--
 5 files changed, 123 insertions(+), 21 deletions(-)
 create mode 100644 bind-9.14-json-c.patch

diff --git a/bind-9.10-dist-native-pkcs11.patch b/bind-9.10-dist-native-pkcs11.patch
index a3ef6e4..dc18dc7 100644
--- a/bind-9.10-dist-native-pkcs11.patch
+++ b/bind-9.10-dist-native-pkcs11.patch
@@ -247,7 +247,7 @@ index 856463f..dc826dd 100644
  @DLZ_DRIVER_RULES@
  
 diff --git a/bin/pkcs11/Makefile.in b/bin/pkcs11/Makefile.in
-index 454d145..0e542f3 100644
+index 96aec05..0e542f3 100644
 --- a/bin/pkcs11/Makefile.in
 +++ b/bin/pkcs11/Makefile.in
 @@ -13,13 +13,13 @@ top_srcdir =	@top_srcdir@
@@ -259,7 +259,8 @@ index 454d145..0e542f3 100644
  
  CDEFINES =
  
- ISCLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@ @OPENSSL_LIBS@
+-ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
++ISCLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@ @OPENSSL_LIBS@
  
 -ISCDEPLIBS =	../../lib/isc/libisc.@A@
 +ISCDEPLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
diff --git a/bind-9.11-fips-tests.patch b/bind-9.11-fips-tests.patch
index 18e0433..09169ae 100644
--- a/bind-9.11-fips-tests.patch
+++ b/bind-9.11-fips-tests.patch
@@ -1,4 +1,4 @@
-From f37b26cb7c8f7351d22dfea79df33edb74d42e23 Mon Sep 17 00:00:00 2001
+From 0b1c2b11ccec87da88bcdceeda814c489163461b Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 2 Aug 2018 23:46:45 +0200
 Subject: [PATCH] FIPS tests changes
@@ -77,7 +77,7 @@ Date:   Wed Mar 7 10:44:23 2018 +0100
  bin/tests/system/checkconf/bad-tsig.conf      |  2 +-
  bin/tests/system/checkconf/good.conf          |  2 +-
  bin/tests/system/dlv/ns3/sign.sh              |  1 +
- bin/tests/system/feature-test.c               | 13 ++++
+ bin/tests/system/feature-test.c               | 14 ++++
  bin/tests/system/notify/ns5/named.conf.in     |  6 +-
  bin/tests/system/notify/tests.sh              |  6 +-
  bin/tests/system/nsupdate/ns1/named.conf.in   |  2 +-
@@ -91,7 +91,7 @@ Date:   Wed Mar 7 10:44:23 2018 +0100
  bin/tests/system/tsig/tests.sh                | 67 ++++++++++++-------
  bin/tests/system/upforwd/ns1/named.conf.in    |  2 +-
  bin/tests/system/upforwd/tests.sh             |  2 +-
- 33 files changed, 151 insertions(+), 107 deletions(-)
+ 33 files changed, 152 insertions(+), 107 deletions(-)
 
 diff --git a/bin/tests/system/acl/ns2/named1.conf.in b/bin/tests/system/acl/ns2/named1.conf.in
 index 0ea6502..026db3f 100644
@@ -574,7 +574,7 @@ index fa51ae1..bc46942 100755
  zone=child1.utld.
  infile=child.db.in
 diff --git a/bin/tests/system/feature-test.c b/bin/tests/system/feature-test.c
-index 8b9deb6..ceb4fe8 100644
+index 8b9deb6..e5d8997 100644
 --- a/bin/tests/system/feature-test.c
 +++ b/bin/tests/system/feature-test.c
 @@ -19,6 +19,7 @@
@@ -585,16 +585,17 @@ index 8b9deb6..ceb4fe8 100644
  #include <dns/edns.h>
  
  #ifdef WIN32
-@@ -159,6 +160,18 @@ main(int argc, char **argv) {
+@@ -159,6 +160,19 @@ main(int argc, char **argv) {
  #endif
  	}
  
 +	if (strcmp(argv[1], "--md5") == 0) {
 +		unsigned char digest[ISC_MAX_MD_SIZE];
-+		const char test[] = test;
++		const unsigned char test[] = "test";
++		unsigned int size = sizeof(digest);
 +
 +		if (isc_md(ISC_MD_MD5, test, sizeof(test),
-+		           digest, sizeof(digest)) == ISC_R_SUCCESS) {
++		           digest, &size) == ISC_R_SUCCESS) {
 +			return (0);
 +		} else {
 +			return (1);
diff --git a/bind-9.11-kyua-pkcs11.patch b/bind-9.11-kyua-pkcs11.patch
index cb9fe4c..87809b7 100644
--- a/bind-9.11-kyua-pkcs11.patch
+++ b/bind-9.11-kyua-pkcs11.patch
@@ -1,4 +1,4 @@
-From 9b9087cce00acd8f1fc2ce8e5c89d1dab1158683 Mon Sep 17 00:00:00 2001
+From c2e22d5b55fdc17cd51bf77980892e147c2b2ea1 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Tue, 2 Jan 2018 18:13:07 +0100
 Subject: [PATCH] Fix pkcs11 variants atf tests
@@ -15,10 +15,10 @@ Add pkcs11 Kyuafile, fix dh_test to pass in pkcs11 mode
  5 files changed, 14 insertions(+), 10 deletions(-)
 
 diff --git a/configure.ac b/configure.ac
-index b7dd8e5..e9dbbba 100644
+index 0f7c850..0532e5f 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -3023,6 +3023,7 @@ AC_CONFIG_FILES([
+@@ -3032,6 +3032,7 @@ AC_CONFIG_FILES([
  	lib/dns-pkcs11/include/Makefile
  	lib/dns-pkcs11/include/dns/Makefile
  	lib/dns-pkcs11/include/dst/Makefile
@@ -81,19 +81,20 @@ index d83d9f5..d5bda29 100644
  	dst_key_free(&key);
  }
 diff --git a/lib/isc-pkcs11/tests/Makefile.in b/lib/isc-pkcs11/tests/Makefile.in
-index 5735829..97b26c1 100644
+index 7e62737..e91cd67 100644
 --- a/lib/isc-pkcs11/tests/Makefile.in
 +++ b/lib/isc-pkcs11/tests/Makefile.in
-@@ -16,10 +16,10 @@ VERSION=@BIND9_VERSION@
+@@ -15,11 +15,11 @@ VERSION=@BIND9_VERSION@
+ 
  @BIND9_MAKE_INCLUDES@
  
- CINCLUDES =	-I. -Iinclude ${ISC_INCLUDES} @OPENSSL_INCLUDES@ @CMOCKA_CFLAGS@
+-CINCLUDES =	-I. -Iinclude ${ISC_INCLUDES} @OPENSSL_INCLUDES@ @CMOCKA_CFLAGS@
 -CDEFINES =	-DTESTS="\"${top_builddir}/lib/isc/tests/\""
++CINCLUDES =	-I. -Iinclude ${ISC_PKCS11_INCLUDES} @OPENSSL_INCLUDES@ @CMOCKA_CFLAGS@
 +CDEFINES =	-DTESTS="\"${top_builddir}/lib/isc-pkcs11/tests/\""
  
--ISCLIBS =	../libisc.@A@ @OPENSSL_LIBS@
+ ISCLIBS =	../libisc-pkcs11.@A@ @OPENSSL_LIBS@
 -ISCDEPLIBS =	../libisc.@A@
-+ISCLIBS =	../libisc-pkcs11.@A@ @ISC_OPENSSL_LIBS@
 +ISCDEPLIBS =	../libisc-pkcs11.@A@
  
  LIBS =		@LIBS@ @CMOCKA_LIBS@
diff --git a/bind-9.14-json-c.patch b/bind-9.14-json-c.patch
new file mode 100644
index 0000000..870b46b
--- /dev/null
+++ b/bind-9.14-json-c.patch
@@ -0,0 +1,95 @@
+From 0698eb93f6e618d2882ae2c8758c5fa87524bea6 Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Tue, 23 Jul 2019 12:10:39 +0200
+Subject: [PATCH] Allow explicitly using json-c but not libjson
+
+Separate detection of json support. Allows explicit use of json-c when
+jsoncpp package is found. Have to use --without-libjson --with-json-c.
+---
+ configure.ac | 52 +++++++++++++++++++++++++++++++++++++++++-----------
+ 1 file changed, 41 insertions(+), 11 deletions(-)
+
+diff --git a/configure.ac b/configure.ac
+index f7978e4..40b4f9f 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -1331,7 +1331,6 @@ AC_ARG_WITH(libjson,
+ 	    use_libjson="$withval", use_libjson="auto")
+ 
+ have_libjson=""
+-have_libjson_c=""
+ case "$use_libjson" in
+ 	no)
+ 		libjson_libs=""
+@@ -1347,7 +1346,43 @@ case "$use_libjson" in
+ 					LIBS="$LIBS -L${d}/lib"
+ 				fi
+ 				have_libjson="yes"
+-			elif test -f "${d}/include/json-c/json.h"
++			fi
++		done
++		;;
++	*)
++		if test -f "${use_libjson}/include/json/json.h"
++		then
++			libjson_cflags="-I${use_libjson}/include"
++			LIBS="$LIBS -L${use_libjson}/lib"
++			have_libjson="yes"
++		else
++			AC_MSG_ERROR([$use_libjson/include/json/json.h not found.])
++		fi
++		;;
++esac
++
++#
++# was --with-json-c specified?
++#
++AC_ARG_WITH(json-c,
++	    AS_HELP_STRING([--with-json-c[=PATH]],
++			   [build with json-c library [yes|no|path]]),
++	    use_json_c="$withval", use_json_c="$use_libjson")
++
++if test "X${have_libjson}" != "X"
++then
++	# Do not use if libjson were found
++	use_json_c=no
++fi
++
++have_libjson_c=""
++case "$use_json_c" in
++	no)
++		;;
++	auto|yes)
++		for d in /usr /usr/local /opt/local
++		do
++			if test -f "${d}/include/json-c/json.h"
+ 			then
+ 				if test ${d} != /usr
+ 				then
+@@ -1360,19 +1395,14 @@ case "$use_libjson" in
+ 		done
+ 		;;
+ 	*)
+-		if test -f "${use_libjson}/include/json/json.h"
+-		then
+-			libjson_cflags="-I${use_libjson}/include"
+-			LIBS="$LIBS -L${use_libjson}/lib"
+-			have_libjson="yes"
+-		elif test -f "${use_libjson}/include/json-c/json.h"
++		if test -f "${use_json_c}/include/json-c/json.h"
+ 		then
+-			libjson_cflags="-I${use_libjson}/include"
+-			LIBS="$LIBS -L${use_libjson}/lib"
++			libjson_cflags="-I${use_json_c}/include"
++			LIBS="$LIBS -L${use_json_c}/lib"
+ 			have_libjson="yes"
+ 			have_libjson_c="yes"
+ 		else
+-			AC_MSG_ERROR([$use_libjson/include/json{,-c}/json.h not found.])
++			AC_MSG_ERROR([$use_json_c/include/json-c/json.h not found.])
+ 		fi
+ 		;;
+ esac
+-- 
+2.20.1
+
diff --git a/bind.spec b/bind.spec
index 1e83ecd..e2c3f60 100644
--- a/bind.spec
+++ b/bind.spec
@@ -21,8 +21,11 @@
 %bcond_without LMDB
 %bcond_without JSON
 %bcond_without DNSTAP
-%bcond_without DLZ
+# TODO: mysql is not well suported without SDB.
 %bcond_with    BDB
+# skip DLZ for now
+%bcond_with DLZ
+# Support for builds without threads removed. DHCP no longer needs it anyway.
 %bcond_with    EXPORT_LIBS
 # Legacy GeoIP support
 %bcond_with    GEOIP
@@ -163,6 +166,7 @@ Patch173:bind-9.11-rh1732883.patch
 # Make sure jsonccp-devel does not interfere
 Patch174:bind-9.11-json-c.patch
 Patch175:bind-9.11-fips-disable.patch
+Patch176: bind-9.11-unit-dnstap-pkcs11.patch
 Patch177: bind-9.11-serve-stale.patch
 Patch178: bind-9.11-serve-stale-dbfix.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=1736762
@@ -567,6 +571,7 @@ are used for building ISC DHCP.
 #%patch174 -p1 -b .unit-timer
 %patch174 -p1 -b .json-c
 %patch175 -p1 -b .rh1709553
+%patch176 -p1 -b .unit-dnstap
 %patch177 -p1 -b .serve-stale
 %patch178 -p1 -b .rh1770492
 %patch183 -p1 -b .rh1736762-5
@@ -706,7 +711,7 @@ export LIBDIR_SUFFIX
   --with-lmdb=no \
 %endif
 %if %{with JSON}
-  --with-libjson \
+  --without-libjson --with-json-c \
 %endif
 %if %{with DNSTAP}
   --enable-dnstap \
@@ -1401,14 +1406,13 @@ fi;
 %files devel
 %{_libdir}/libbind9.so
 %{_libdir}/libisccc.so
-%{_libdir}/liblwres.so
+%{_libdir}/libns.so
 %{_includedir}/bind9/config.h
 %{_includedir}/bind9/bind9
 %{_includedir}/bind9/isccc
 %{_includedir}/bind9/ns
 %{_mandir}/man1/isc-config.sh.1*
 %{_mandir}/man1/bind9-config.1*
-%{_mandir}/man3/lwres*
 %{_bindir}/isc-config.sh
 %{_bindir}/bind9-config
 %endif

From 3c4d9d472a67824db82f1a3d948b98317688f212 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 24 Jul 2019 12:06:39 +0200
Subject: [PATCH 111/460] Update changelog

---
 bind.spec | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/bind.spec b/bind.spec
index e2c3f60..538f891 100644
--- a/bind.spec
+++ b/bind.spec
@@ -69,7 +69,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.14.0
-Release:  0%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1608,7 +1608,10 @@ fi;
 
 
 %changelog
-* Wed Jan 08 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.14-4
+* Wed Jan 08 2020 Petr Menšík <pemensik@redhat.com> - 32:9.14.0-1
+- Update to 9.14.0, disabled SDB and DLZ
+
+ * Wed Jan 08 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.14-4
 - Remove libmaxminddb-devel from devel package dependencies
 
 * Fri Jan 03 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.14-3

From 2dbb099871bad9c12b6ae248bcb4866b6648573e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 24 Jul 2019 12:50:29 +0200
Subject: [PATCH 112/460] Update to 9.14.4

Current latest version fixes unit tests.
---
 .gitignore                         |  1 +
 bind-9.10-dist-native-pkcs11.patch | 74 ++++++++++++++++--------------
 bind-9.11-feature-test-named.patch | 14 +++---
 bind-9.11-fips-tests.patch         | 27 +++--------
 bind-9.11-kyua-pkcs11.patch        | 12 ++---
 bind-9.14.4.tar.gz.asc             | 16 +++++++
 bind.spec                          | 11 +++--
 sources                            |  3 +-
 8 files changed, 84 insertions(+), 74 deletions(-)
 create mode 100644 bind-9.14.4.tar.gz.asc

diff --git a/.gitignore b/.gitignore
index d72777d..2084547 100644
--- a/.gitignore
+++ b/.gitignore
@@ -92,6 +92,7 @@ bind-9.7.2b1.tar.gz
 /bind-9.11.5-P4.tar.gz
 /bind-9.11.6.tar.gz
 /bind-9.11.6-P1.tar.gz
+/bind-9.14.4.tar.gz
 /bind-9.11.7.tar.gz
 /bind-9.11.8.tar.gz
 /bind-9.11.9.tar.gz
diff --git a/bind-9.10-dist-native-pkcs11.patch b/bind-9.10-dist-native-pkcs11.patch
index dc18dc7..c255fab 100644
--- a/bind-9.10-dist-native-pkcs11.patch
+++ b/bind-9.10-dist-native-pkcs11.patch
@@ -12,7 +12,7 @@ index 9ad7f62..094775a 100644
  TARGETS =
  
 diff --git a/bin/dnssec-pkcs11/Makefile.in b/bin/dnssec-pkcs11/Makefile.in
-index be1ac3b..c1ee27c 100644
+index 321058b..5067ee1 100644
 --- a/bin/dnssec-pkcs11/Makefile.in
 +++ b/bin/dnssec-pkcs11/Makefile.in
 @@ -15,17 +15,17 @@ VERSION=@BIND9_VERSION@
@@ -25,10 +25,10 @@ index be1ac3b..c1ee27c 100644
  CDEFINES =	-DVERSION=\"${VERSION}\"
  CWARNINGS =
  
--DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
+-DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
 -ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
 -ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @OPENSSL_LIBS@
-+DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ @DNS_CRYPTO_LIBS@
++DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
 +ISCLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@ @OPENSSL_LIBS@
 +ISCNOSYMLIBS =	../../lib/isc-pkcs11/libisc-pkcs11-nosymtbl.@A@ @OPENSSL_LIBS@
  
@@ -132,10 +132,10 @@ index be1ac3b..c1ee27c 100644
  
  clean distclean::
 diff --git a/bin/named-pkcs11/Makefile.in b/bin/named-pkcs11/Makefile.in
-index 856463f..dc826dd 100644
+index eecfa76..416e12e 100644
 --- a/bin/named-pkcs11/Makefile.in
 +++ b/bin/named-pkcs11/Makefile.in
-@@ -43,27 +43,27 @@ DLZDRIVER_INCLUDES =	@DLZ_DRIVER_INCLUDES@
+@@ -43,9 +43,9 @@ DLZDRIVER_INCLUDES =	@DLZ_DRIVER_INCLUDES@
  DLZDRIVER_LIBS =	@DLZ_DRIVER_LIBS@
  
  CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
@@ -144,14 +144,15 @@ index 856463f..dc826dd 100644
  		${BIND9_INCLUDES} ${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} \
 -		${ISC_INCLUDES} ${DLZDRIVER_INCLUDES} \
 +		${ISC_PKCS11_INCLUDES} ${DLZDRIVER_INCLUDES} \
- 		${DBDRIVER_INCLUDES} @OPENSSL_INCLUDES@
+ 		${DBDRIVER_INCLUDES} ${MAXMINDDB_CFLAGS} \
+ 		@OPENSSL_INCLUDES@
  
- CDEFINES =      @CONTRIB_DLZ@
+@@ -53,18 +53,18 @@ CDEFINES =      @CONTRIB_DLZ@
  
  CWARNINGS =
  
--DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
-+DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ @DNS_CRYPTO_LIBS@
+-DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
++DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
  ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
  ISCCCLIBS =	../../lib/isccc/libisccc.@A@
 -ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
@@ -170,7 +171,7 @@ index 856463f..dc826dd 100644
  BIND9DEPLIBS =	../../lib/bind9/libbind9.@A@
  NSDEPLIBS =	../../lib/ns/libns.@A@
  
-@@ -72,17 +72,17 @@ DEPLIBS =	${NSDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
+@@ -73,17 +73,17 @@ DEPLIBS =	${NSDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
  
  LIBS =		${NSLIBS} ${DNSLIBS} ${BIND9LIBS} \
  		${ISCCFGLIBS} ${ISCCCLIBS} ${ISCLIBS} \
@@ -190,9 +191,9 @@ index 856463f..dc826dd 100644
 +TARGETS =	named-pkcs11@EXEEXT@ feature-test-pkcs11@EXEEXT@
  
  GEOIPLINKOBJS = geoip.@O@
- 
-@@ -90,8 +90,7 @@ OBJS =		builtin.@O@ config.@O@ control.@O@ \
- 		controlconf.@O@ fuzz.@O@ @GEOIPLINKOBJS@ \
+ GEOIP2LINKOBJS = geoip.@O@
+@@ -93,8 +93,7 @@ OBJS =		builtin.@O@ config.@O@ control.@O@ \
+ 		@GEOIPLINKOBJS@ @GEOIP2LINKOBJS@ \
  		log.@O@ logconf.@O@ main.@O@ \
  		server.@O@ statschannel.@O@ \
 -		tkeyconf.@O@ tsigconf.@O@ zoneconf.@O@ \
@@ -201,8 +202,8 @@ index 856463f..dc826dd 100644
  
  UOBJS =		unix/os.@O@ unix/dlz_dlopen_driver.@O@
  
-@@ -103,8 +102,7 @@ SRCS =		builtin.c config.c control.c \
- 		controlconf.c fuzz.c @GEOIPLINKSRCS@ \
+@@ -108,8 +107,7 @@ SRCS =		builtin.c config.c control.c \
+ 		@GEOIPLINKSRCS@ @GEOIP2LINKSRCS@ \
  		log.c logconf.c main.c \
  		server.c statschannel.c \
 -		tkeyconf.c tsigconf.c zoneconf.c \
@@ -211,7 +212,7 @@ index 856463f..dc826dd 100644
  
  MANPAGES =	named.8 named.conf.5
  
-@@ -143,7 +141,7 @@ server.@O@: server.c
+@@ -149,7 +147,7 @@ server.@O@: server.c
  		-DPRODUCT=\"${PRODUCT}\" \
  		-DVERSION=\"${VERSION}\" -c ${srcdir}/server.c
  
@@ -220,7 +221,7 @@ index 856463f..dc826dd 100644
  	export MAKE_SYMTABLE="yes"; \
  	export BASEOBJS="${OBJS} ${UOBJS}"; \
  	${FINALBUILDCMD}
-@@ -153,7 +151,7 @@ feature-test.@O@: ${top_srcdir}/bin/tests/system/feature-test.c
+@@ -159,7 +157,7 @@ feature-test.@O@: ${top_srcdir}/bin/tests/system/feature-test.c
  	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} \
  		-c ${top_srcdir}/bin/tests/system/feature-test.c
  
@@ -229,7 +230,7 @@ index 856463f..dc826dd 100644
  	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} \
  		-o $@ feature-test.@O@ ${ISCLIBS} ${LIBS}
  
-@@ -186,13 +184,13 @@ install-man8: named.8
+@@ -192,13 +190,13 @@ install-man8: named.8
  
  install-man: install-man5 install-man8
  
@@ -268,10 +269,10 @@ index 96aec05..0e542f3 100644
  DEPLIBS =	${ISCDEPLIBS}
  
 diff --git a/configure.ac b/configure.ac
-index 6e17d3a..0f7c850 100644
+index 29106cb..3dff344 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -1188,12 +1188,14 @@ AC_SUBST(USE_GSSAPI)
+@@ -1267,12 +1267,14 @@ AC_SUBST(USE_GSSAPI)
  AC_SUBST(DST_GSSAPI_INC)
  AC_SUBST(DNS_GSSAPI_LIBS)
  DNS_CRYPTO_LIBS="$DNS_GSSAPI_LIBS"
@@ -286,7 +287,7 @@ index 6e17d3a..0f7c850 100644
  
  #
  # was --with-lmdb specified?
-@@ -2466,6 +2468,9 @@ AC_SUBST(BIND9_DNS_BUILDINCLUDE)
+@@ -2542,6 +2544,9 @@ AC_SUBST(BIND9_DNS_BUILDINCLUDE)
  AC_SUBST(BIND9_NS_BUILDINCLUDE)
  AC_SUBST(BIND9_BIND9_BUILDINCLUDE)
  AC_SUBST(BIND9_IRS_BUILDINCLUDE)
@@ -296,7 +297,7 @@ index 6e17d3a..0f7c850 100644
  if test "X$srcdir" != "X"; then
  	BIND9_ISC_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/isc/include"
  	BIND9_ISCCC_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/isccc/include"
-@@ -2474,6 +2479,9 @@ if test "X$srcdir" != "X"; then
+@@ -2550,6 +2555,9 @@ if test "X$srcdir" != "X"; then
  	BIND9_NS_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/ns/include"
  	BIND9_BIND9_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/bind9/include"
  	BIND9_IRS_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/irs/include"
@@ -306,7 +307,7 @@ index 6e17d3a..0f7c850 100644
  else
  	BIND9_ISC_BUILDINCLUDE=""
  	BIND9_ISCCC_BUILDINCLUDE=""
-@@ -2482,6 +2490,9 @@ else
+@@ -2558,6 +2566,9 @@ else
  	BIND9_NS_BUILDINCLUDE=""
  	BIND9_BIND9_BUILDINCLUDE=""
  	BIND9_IRS_BUILDINCLUDE=""
@@ -316,7 +317,7 @@ index 6e17d3a..0f7c850 100644
  fi
  
  AC_SUBST_FILE(BIND9_MAKE_INCLUDES)
-@@ -2940,8 +2951,11 @@ AC_CONFIG_FILES([
+@@ -3021,8 +3032,11 @@ AC_CONFIG_FILES([
  	bin/delv/Makefile
  	bin/dig/Makefile
  	bin/dnssec/Makefile
@@ -328,7 +329,7 @@ index 6e17d3a..0f7c850 100644
  	bin/nsupdate/Makefile
  	bin/pkcs11/Makefile
  	bin/plugins/Makefile
-@@ -3014,6 +3028,10 @@ AC_CONFIG_FILES([
+@@ -3095,6 +3109,10 @@ AC_CONFIG_FILES([
  	lib/dns/include/dns/Makefile
  	lib/dns/include/dst/Makefile
  	lib/dns/tests/Makefile
@@ -339,7 +340,7 @@ index 6e17d3a..0f7c850 100644
  	lib/irs/Makefile
  	lib/irs/include/Makefile
  	lib/irs/include/irs/Makefile
-@@ -3034,6 +3052,20 @@ AC_CONFIG_FILES([
+@@ -3115,6 +3133,20 @@ AC_CONFIG_FILES([
  	lib/isc/unix/include/Makefile
  	lib/isc/unix/include/isc/Makefile
  	lib/isc/unix/include/pkcs11/Makefile
@@ -374,17 +375,18 @@ index ffa2d5a..439d748 100644
  
  @BIND9_MAKE_RULES@
 diff --git a/lib/dns-pkcs11/Makefile.in b/lib/dns-pkcs11/Makefile.in
-index eb3346a..c9e4960 100644
+index 60c87a8..50da232 100644
 --- a/lib/dns-pkcs11/Makefile.in
 +++ b/lib/dns-pkcs11/Makefile.in
-@@ -26,16 +26,16 @@ VERSION=@BIND9_VERSION@
+@@ -26,17 +26,17 @@ VERSION=@BIND9_VERSION@
  
  USE_ISC_SPNEGO = @USE_ISC_SPNEGO@
  
 -CINCLUDES =	-I. -I${top_srcdir}/lib/dns -Iinclude ${DNS_INCLUDES} \
--		${ISC_INCLUDES} @OPENSSL_INCLUDES@ @DST_GSSAPI_INC@
+-		${ISC_INCLUDES} ${MAXMINDDB_CFLAGS} \
 +CINCLUDES =	-I. -I${top_srcdir}/lib/dns-pkcs11 -Iinclude ${DNS_PKCS11_INCLUDES} \
-+		${ISC_PKCS11_INCLUDES} @OPENSSL_INCLUDES@ @DST_GSSAPI_INC@
++		${ISC_PKCS11_INCLUDES} ${MAXMINDDB_CFLAGS} \
+ 		@OPENSSL_INCLUDES@ @DST_GSSAPI_INC@
  
  CDEFINES =	@USE_GSSAPI@ ${USE_ISC_SPNEGO}
  
@@ -396,9 +398,9 @@ index eb3346a..c9e4960 100644
 -ISCDEPLIBS =	../../lib/isc/libisc.@A@
 +ISCDEPLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
  
- LIBS =		@LIBS@
+ LIBS =		${MAXMINDDB_LIBS} @LIBS@
  
-@@ -134,15 +134,15 @@ version.@O@: version.c
+@@ -138,15 +138,15 @@ version.@O@: version.c
  		-DLIBAGE=${LIBAGE} \
  		-c ${srcdir}/version.c
  
@@ -418,13 +420,15 @@ index eb3346a..c9e4960 100644
  
  include: gen
  	${MAKE} include/dns/enumtype.h
-@@ -168,25 +168,25 @@ code.h:	gen
+@@ -172,27 +172,27 @@ code.h:	gen
  	./gen -s ${srcdir} > code.h || { rm -f $@ ; exit 1; }
  
  gen: gen.c
 -	${BUILD_CC} ${BUILD_CFLAGS} -I${top_srcdir}/lib/isc/include \
 +	${BUILD_CC} ${BUILD_CFLAGS} -I${top_srcdir}/lib/isc-pkcs11/include \
- 	${BUILD_CPPFLAGS} ${BUILD_LDFLAGS} -o $@ ${srcdir}/gen.c ${BUILD_LIBS}
+ 	${LFS_CFLAGS} ${LFS_LDFLAGS} \
+ 	${BUILD_CPPFLAGS} ${BUILD_LDFLAGS} -o $@ ${srcdir}/gen.c \
+ 	${BUILD_LIBS} ${LFS_LIBS}
  
 -timestamp: include libdns.@A@
 +timestamp: include libdns-pkcs11.@A@
@@ -449,7 +453,7 @@ index eb3346a..c9e4960 100644
 +	rm -f libdns-pkcs11.@A@ timestamp
  	rm -f gen code.h include/dns/enumtype.h include/dns/enumclass.h
  	rm -f include/dns/rdatastruct.h
- 	rm -f dnstap.pb-c.c dnstap.pb-c.h include/dns/dnstap.pb-c.h
+ 	rm -f dnstap.pb-c.c dnstap.pb-c.h
 diff --git a/lib/isc-pkcs11/Makefile.in b/lib/isc-pkcs11/Makefile.in
 index ed87279..3171b48 100644
 --- a/lib/isc-pkcs11/Makefile.in
diff --git a/bind-9.11-feature-test-named.patch b/bind-9.11-feature-test-named.patch
index 1b89e1b..61c31ea 100644
--- a/bind-9.11-feature-test-named.patch
+++ b/bind-9.11-feature-test-named.patch
@@ -1,4 +1,4 @@
-From b45cc1caf018d46753a03d59bb9e75cdeef1deeb Mon Sep 17 00:00:00 2001
+From 36e3d1b08f697190b259a8421472ec16b52315b5 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Wed, 30 Jan 2019 14:37:17 +0100
 Subject: [PATCH] Create feature-test in source directory
@@ -12,10 +12,10 @@ compile feature-test for each of them this way.
  2 files changed, 11 insertions(+), 2 deletions(-)
 
 diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
-index 10d568f..856463f 100644
+index 4e8006d..eecfa76 100644
 --- a/bin/named/Makefile.in
 +++ b/bin/named/Makefile.in
-@@ -82,7 +82,7 @@ NOSYMLIBS =	${NSLIBS} ${DNSLIBS} ${BIND9LIBS} \
+@@ -83,7 +83,7 @@ NOSYMLIBS =	${NSLIBS} ${DNSLIBS} ${BIND9LIBS} \
  
  SUBDIRS =	unix
  
@@ -23,8 +23,8 @@ index 10d568f..856463f 100644
 +TARGETS =	named@EXEEXT@ feature-test@EXEEXT@
  
  GEOIPLINKOBJS = geoip.@O@
- 
-@@ -148,6 +148,15 @@ named@EXEEXT@: ${OBJS} ${DEPLIBS}
+ GEOIP2LINKOBJS = geoip.@O@
+@@ -154,6 +154,15 @@ named@EXEEXT@: ${OBJS} ${DEPLIBS}
  	export BASEOBJS="${OBJS} ${UOBJS}"; \
  	${FINALBUILDCMD}
  
@@ -41,10 +41,10 @@ index 10d568f..856463f 100644
  
  docclean manclean maintainer-clean::
 diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
-index d9efc63..0f4ead0 100644
+index c713d96..20366e5 100644
 --- a/bin/tests/system/conf.sh.in
 +++ b/bin/tests/system/conf.sh.in
-@@ -38,7 +38,7 @@ DELV=$TOP/bin/delv/delv
+@@ -34,7 +34,7 @@ DELV=$TOP/bin/delv/delv
  DIG=$TOP/bin/dig/dig
  DNSTAPREAD=$TOP/bin/tools/dnstap-read
  DSFROMKEY=$TOP/bin/dnssec/dnssec-dsfromkey
diff --git a/bind-9.11-fips-tests.patch b/bind-9.11-fips-tests.patch
index 09169ae..f11fc5b 100644
--- a/bind-9.11-fips-tests.patch
+++ b/bind-9.11-fips-tests.patch
@@ -1,4 +1,4 @@
-From 0b1c2b11ccec87da88bcdceeda814c489163461b Mon Sep 17 00:00:00 2001
+From 11d42f5d851881fd559a716df78a18dba1d6975d Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 2 Aug 2018 23:46:45 +0200
 Subject: [PATCH] FIPS tests changes
@@ -76,7 +76,6 @@ Date:   Wed Mar 7 10:44:23 2018 +0100
  bin/tests/system/catz/ns2/named.conf.in       |  2 +-
  bin/tests/system/checkconf/bad-tsig.conf      |  2 +-
  bin/tests/system/checkconf/good.conf          |  2 +-
- bin/tests/system/dlv/ns3/sign.sh              |  1 +
  bin/tests/system/feature-test.c               | 14 ++++
  bin/tests/system/notify/ns5/named.conf.in     |  6 +-
  bin/tests/system/notify/tests.sh              |  6 +-
@@ -91,7 +90,7 @@ Date:   Wed Mar 7 10:44:23 2018 +0100
  bin/tests/system/tsig/tests.sh                | 67 ++++++++++++-------
  bin/tests/system/upforwd/ns1/named.conf.in    |  2 +-
  bin/tests/system/upforwd/tests.sh             |  2 +-
- 33 files changed, 152 insertions(+), 107 deletions(-)
+ 32 files changed, 151 insertions(+), 107 deletions(-)
 
 diff --git a/bin/tests/system/acl/ns2/named1.conf.in b/bin/tests/system/acl/ns2/named1.conf.in
 index 0ea6502..026db3f 100644
@@ -561,20 +560,8 @@ index d627d2a..9d0322a 100644
 +	algorithm "hmac-sha256";
  	secret "qwertyuiopasdfgh";
  };
-diff --git a/bin/tests/system/dlv/ns3/sign.sh b/bin/tests/system/dlv/ns3/sign.sh
-index fa51ae1..bc46942 100755
---- a/bin/tests/system/dlv/ns3/sign.sh
-+++ b/bin/tests/system/dlv/ns3/sign.sh
-@@ -19,6 +19,7 @@ echo_i "dlv/ns3/sign.sh"
- dlvzone=dlv.utld.
- dlvsets=
- dssets=
-+bits=1024
- 
- zone=child1.utld.
- infile=child.db.in
 diff --git a/bin/tests/system/feature-test.c b/bin/tests/system/feature-test.c
-index 8b9deb6..e5d8997 100644
+index ff92ad2..746e022 100644
 --- a/bin/tests/system/feature-test.c
 +++ b/bin/tests/system/feature-test.c
 @@ -19,6 +19,7 @@
@@ -585,7 +572,7 @@ index 8b9deb6..e5d8997 100644
  #include <dns/edns.h>
  
  #ifdef WIN32
-@@ -159,6 +160,19 @@ main(int argc, char **argv) {
+@@ -168,6 +169,19 @@ main(int argc, char **argv) {
  #endif
  	}
  
@@ -698,10 +685,10 @@ index 5d70114..6c4b55a 100644
  $DDNSCONFGEN -q -a hmac-sha224 -k sha224-key -z keytests.nil > ns1/sha224.key
  $DDNSCONFGEN -q -a hmac-sha256 -k sha256-key -z keytests.nil > ns1/sha256.key
 diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh
-index dd0286f..906135c 100755
+index b73d178..f573905 100755
 --- a/bin/tests/system/nsupdate/tests.sh
 +++ b/bin/tests/system/nsupdate/tests.sh
-@@ -700,7 +700,14 @@ fi
+@@ -708,7 +708,14 @@ fi
  n=`expr $n + 1`
  ret=0
  echo_i "check TSIG key algorithms ($n)"
@@ -717,7 +704,7 @@ index dd0286f..906135c 100755
      $NSUPDATE -k ns1/${alg}.key <<END > /dev/null || ret=1
  server 10.53.0.1 ${PORT}
  update add ${alg}.keytests.nil. 600 A 10.10.10.3
-@@ -708,7 +715,7 @@ send
+@@ -716,7 +723,7 @@ send
  END
  done
  sleep 2
diff --git a/bind-9.11-kyua-pkcs11.patch b/bind-9.11-kyua-pkcs11.patch
index 87809b7..95e9843 100644
--- a/bind-9.11-kyua-pkcs11.patch
+++ b/bind-9.11-kyua-pkcs11.patch
@@ -1,4 +1,4 @@
-From c2e22d5b55fdc17cd51bf77980892e147c2b2ea1 Mon Sep 17 00:00:00 2001
+From f0ce2b4855b70f1fb04394b35626c37ebb0a8c75 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Tue, 2 Jan 2018 18:13:07 +0100
 Subject: [PATCH] Fix pkcs11 variants atf tests
@@ -15,10 +15,10 @@ Add pkcs11 Kyuafile, fix dh_test to pass in pkcs11 mode
  5 files changed, 14 insertions(+), 10 deletions(-)
 
 diff --git a/configure.ac b/configure.ac
-index 0f7c850..0532e5f 100644
+index 3dff344..424a542 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -3032,6 +3032,7 @@ AC_CONFIG_FILES([
+@@ -3113,6 +3113,7 @@ AC_CONFIG_FILES([
  	lib/dns-pkcs11/include/Makefile
  	lib/dns-pkcs11/include/dns/Makefile
  	lib/dns-pkcs11/include/dst/Makefile
@@ -42,7 +42,7 @@ index 39ce986..dcfb139 100644
  include('isccfg/Kyuafile')
  include('ns/Kyuafile')
 diff --git a/lib/dns-pkcs11/tests/Makefile.in b/lib/dns-pkcs11/tests/Makefile.in
-index 7b35b93..c95d1c8 100644
+index eb297c9..144d6b2 100644
 --- a/lib/dns-pkcs11/tests/Makefile.in
 +++ b/lib/dns-pkcs11/tests/Makefile.in
 @@ -15,14 +15,14 @@ VERSION=@BIND9_VERSION@
@@ -57,11 +57,11 @@ index 7b35b93..c95d1c8 100644
  
 -ISCLIBS =	../../isc/libisc.@A@ @OPENSSL_LIBS@
 -ISCDEPLIBS =	../../isc/libisc.@A@
--DNSLIBS =	../libdns.@A@ @DNS_CRYPTO_LIBS@
+-DNSLIBS =	../libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
 -DNSDEPLIBS =	../libdns.@A@
 +ISCLIBS =	../../isc-pkcs11/libisc-pkcs11.@A@
 +ISCDEPLIBS =	../../isc-pkcs11/libisc-pkcs11.@A@
-+DNSLIBS =	../libdns-pkcs11.@A@ @DNS_CRYPTO_LIBS@
++DNSLIBS =	../libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
 +DNSDEPLIBS =	../libdns-pkcs11.@A@
  
  LIBS =		@LIBS@ @CMOCKA_LIBS@
diff --git a/bind-9.14.4.tar.gz.asc b/bind-9.14.4.tar.gz.asc
new file mode 100644
index 0000000..46eb6f8
--- /dev/null
+++ b/bind-9.14.4.tar.gz.asc
@@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABAgAdFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAl0u4wkACgkQdLtrmky7
+PThVjxAAgSBMHHL5U/vjlK1ZaNdOlwdG2b48+IYu3TkOnFHoAoX0Zkt12xgdWdHi
+ChL645zHeCo16a7OY40wcDhmSa9lIB+M7D7SNNhFAp0Ta2DGKy3mvSloTup/XDeJ
+cdb7rOQdvh70nf+YV4NKADP/QvQdAmMOEhNIZzAW2u+LOCcJwVAlaN1cMt2GEYLM
+0qhKynPKNWcotA9RnCH3K2eNPT4u8X6MyU1XqA+JHJvwFLwJq6xpV8l7IfHEnK5l
+6nhul6IlYAclHtFEw4rADQScQE8Zg2PXtb8Ajn/ml2nXbSjluprAWgHd8aUl2/gV
+VZVzGI9ZaZD9a2Vkj9pJcNKWMcGk0tlBME5Sv9BIwx8jna66kze9z0AhaziwDgnV
+4Ur+xYo784FzSXoxhwvSQlvbs18TZHTx9vYTg2xUIFO2bjIfdAY2oe2Hegr8u9mj
+tCxnOJYE+xLJaj3CsPEoPwDcyV11Swka6+jqsA8ngVb99Y/tct8+BDd6zgjRQaSG
+7ETk6Hi09QFAMe2YPy+BwcHhk05SD784Cvs3KH9W7x0uFVIdc7xVs+vwe+5SH/Q3
+IPCKfhk0k4A/dmjYSmKvzkT5UyIdt/VqVYuVFmMFLqs3Xf0F1KUt/3fJJJfGhaOp
+tflZWGpR6Gou7TY/kMM35yGz9HnZ5uSWAOUhEQAHG1uKck49GjA=
+=DwY1
+-----END PGP SIGNATURE-----
diff --git a/bind.spec b/bind.spec
index 538f891..6f90f56 100644
--- a/bind.spec
+++ b/bind.spec
@@ -68,7 +68,7 @@
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.14.0
+Version:  9.14.4
 Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
@@ -166,7 +166,7 @@ Patch173:bind-9.11-rh1732883.patch
 # Make sure jsonccp-devel does not interfere
 Patch174:bind-9.11-json-c.patch
 Patch175:bind-9.11-fips-disable.patch
-Patch176: bind-9.11-unit-dnstap-pkcs11.patch
+#Patch176: bind-9.11-unit-dnstap-pkcs11.patch
 Patch177: bind-9.11-serve-stale.patch
 Patch178: bind-9.11-serve-stale-dbfix.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=1736762
@@ -571,7 +571,7 @@ are used for building ISC DHCP.
 #%patch174 -p1 -b .unit-timer
 %patch174 -p1 -b .json-c
 %patch175 -p1 -b .rh1709553
-%patch176 -p1 -b .unit-dnstap
+#%patch176 -p1 -b .unit-dnstap
 %patch177 -p1 -b .serve-stale
 %patch178 -p1 -b .rh1770492
 %patch183 -p1 -b .rh1736762-5
@@ -877,7 +877,7 @@ export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0"
     fi;
     popd
   %endif
-
+## End of UNITTEST
 %endif
 
 %if %{with SYSTEMTEST}
@@ -1608,6 +1608,9 @@ fi;
 
 
 %changelog
+* Wed Jan 08 2020 Petr Menšík <pemensik@redhat.com> - 32:9.14.4-1
+- Update to 9.14.4
+
 * Wed Jan 08 2020 Petr Menšík <pemensik@redhat.com> - 32:9.14.0-1
 - Update to 9.14.0, disabled SDB and DLZ
 
diff --git a/sources b/sources
index d7c9b81..62a9471 100644
--- a/sources
+++ b/sources
@@ -1,2 +1 @@
-SHA512 (bind-9.11.14.tar.gz) = fc7729e780e44c3c4e50059032fdae2af3d0e07b492b5088b2fefc15354829d3c9a83fab4f2ecaa9323cd7a37b1f7eb94890c149ba1df5c4fbea7a145095cbe9
-SHA512 (bind-9.11.14.tar.gz.asc) = fd28a1ebd4adf8c2854de434cc6f5f4d47d982eaad73fbb42dce8df97f7b069feb6e7c374178e203a07fff83f2cd021dfd10fb77dd6e8c5201ee4d299df98b89
+SHA512 (bind-9.14.4.tar.gz) = f5f4dc9b6a1d60838b59ce57ad37dc1e51fa26719aa203405a73850780f06bdc6ecea71c762efd464f946bdcce5a7c324de98caea36d2fe2781cce116fcd4932

From 0990c9b32df826c49eff3599e7519cfa4ae72ef8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 24 Jul 2019 12:57:55 +0200
Subject: [PATCH 113/460] Remove last lwres remains

---
 bind.spec | 2 --
 1 file changed, 2 deletions(-)

diff --git a/bind.spec b/bind.spec
index 6f90f56..eda2faf 100644
--- a/bind.spec
+++ b/bind.spec
@@ -1280,7 +1280,6 @@ fi;
 %{_sbindir}/named-checkconf
 %{_bindir}/named-rrchecker
 %{_bindir}/mdig
-%{_sbindir}/lwresd
 %{_sbindir}/named
 %{_sbindir}/rndc*
 %{_libexecdir}/generate-rndc-key.sh
@@ -1290,7 +1289,6 @@ fi;
 %{_mandir}/man5/rndc.conf.5*
 %{_mandir}/man8/rndc.8*
 %{_mandir}/man8/named.8*
-%{_mandir}/man8/lwresd.8*
 %{_mandir}/man8/named-checkconf.8*
 %{_mandir}/man8/rndc-confgen.8*
 %{_mandir}/man8/named-journalprint.8*

From e34707285dc87db079017ece23dd0782bf964cea Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 24 Jul 2019 13:15:47 +0200
Subject: [PATCH 114/460] Update so version, remove unused patches

Remove already deleted patches from the list. Some patches still kept
intact.
---
 bind.spec | 16 +++-------------
 1 file changed, 3 insertions(+), 13 deletions(-)

diff --git a/bind.spec b/bind.spec
index eda2faf..37b11d7 100644
--- a/bind.spec
+++ b/bind.spec
@@ -60,8 +60,8 @@
 #
 
 # lib*.so.X versions of selected libraries
-%global sover_dns 1306
-%global sover_isc 1306
+%global sover_dns 1309
+%global sover_isc 1308
 %global sover_irs 1301
 %global sover_isccfg 1302
 
@@ -122,7 +122,6 @@ Patch112:bind97-rh645544.patch
 Patch130:bind-9.9.1-P2-dlz-libdb.patch
 Patch131:bind-9.9.1-P2-multlib-conflict.patch
 Patch133:bind99-rh640538.patch
-#Patch134:bind97-rh669163.patch # lwres discontinued
 # Fedora specific patch to distribute native-pkcs#11 functionality
 Patch136:bind-9.10-dist-native-pkcs11.patch
 
@@ -144,14 +143,6 @@ Patch157:bind-9.11-fips-tests.patch
 #Patch158:bind-9.11-rt31459.patch
 # [RT #46047] commit 24172bd2eeba91441ab1c65d2717b0692309244a ISC 4724
 #Patch159:bind-9.11-rt46047.patch
-# commit 66ba2fdad583d962a1f4971c85d58381f0849e4d
-# commit b105ccee68ccc3c18e6ea530063b3c8e5a42571c
-# commit 083461d3329ff6f2410745848a926090586a9846
-#Patch160:bind-9.11-rh1624100.patch
-# https://gitlab.isc.org/isc-projects/bind9/issues/555
-#Patch161:bind-9.11-host-idn-disable.patch
-# https://gitlab.isc.org/isc-projects/bind9/commit/8a98277811e
-#Patch163:bind-9.11-rh1663318.patch
 # https://gitlab.isc.org/isc-projects/bind9/issues/819
 Patch164:bind-9.11-rh1666814.patch
 # random_test fails too often by random, disable it
@@ -162,7 +153,6 @@ Patch170:bind-9.11-feature-test-named.patch
 Patch171:bind-9.11-tests-variants.patch
 Patch172:bind-9.11-tests-pkcs11.patch
 Patch173:bind-9.11-rh1732883.patch
-#Patch174: bind-9.11-unit-timer-nothread.patch
 # Make sure jsonccp-devel does not interfere
 Patch174:bind-9.11-json-c.patch
 Patch175:bind-9.11-fips-disable.patch
@@ -1343,7 +1333,7 @@ fi;
 %files libs
 %{_libdir}/libbind9.so.1302*
 %{_libdir}/libisccc.so.1302*
-%{_libdir}/libns.so.1304*
+%{_libdir}/libns.so.1306*
 
 %files libs-lite
 %{_libdir}/libdns.so.%{sover_dns}*

From eeb7df78d94b7c294bea3923d70703a23f374228 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 24 Jul 2019 14:05:39 +0200
Subject: [PATCH 115/460] Remove no longer distributed tools, include named
 plugin

Includes new functionality as separate loadable library.
Currently it uses another directory %{_libdir}/named. bind-dyndb-ldap
uses %{_libdir}/bind.
---
 bind.spec | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/bind.spec b/bind.spec
index 37b11d7..149e8c2 100644
--- a/bind.spec
+++ b/bind.spec
@@ -1260,6 +1260,7 @@ fi;
 
 %files
 %{_libdir}/bind
+%{_libdir}/named
 %config(noreplace) %verify(not md5 size mtime) %{_sysconfdir}/sysconfig/named
 %config(noreplace) %attr(0644,root,named) %{_sysconfdir}/named.root.key
 %{_tmpfilesdir}/named.conf
@@ -1273,6 +1274,7 @@ fi;
 %{_sbindir}/named
 %{_sbindir}/rndc*
 %{_libexecdir}/generate-rndc-key.sh
+%{_libdir}/named/filter-aaaa.so
 %{_mandir}/man1/mdig.1*
 %{_mandir}/man1/named-rrchecker.1*
 %{_mandir}/man5/named.conf.5*
@@ -1282,6 +1284,7 @@ fi;
 %{_mandir}/man8/named-checkconf.8*
 %{_mandir}/man8/rndc-confgen.8*
 %{_mandir}/man8/named-journalprint.8*
+%{_mandir}/man8/filter-aaaa.8.gz
 %doc CHANGES README named.conf.default
 %doc doc/arm/*html doc/arm/*pdf
 %doc sample/
@@ -1354,9 +1357,7 @@ fi;
 %{_bindir}/arpaname
 %{_sbindir}/ddns-confgen
 %{_sbindir}/tsig-keygen
-%{_sbindir}/genrandom
 %{_sbindir}/nsec3hash
-%{_sbindir}/isc-hmac-fixup
 %{_sbindir}/named-checkzone
 %{_sbindir}/named-compilezone
 %if %{with DNSTAP}
@@ -1375,9 +1376,7 @@ fi;
 %{_mandir}/man1/arpaname.1*
 %{_mandir}/man8/ddns-confgen.8*
 %{_mandir}/man8/tsig-keygen.8*
-%{_mandir}/man8/genrandom.8*
 %{_mandir}/man8/nsec3hash.8*
-%{_mandir}/man8/isc-hmac-fixup.8*
 %{_mandir}/man8/named-checkzone.8*
 %{_mandir}/man8/named-compilezone.8*
 %{_sysconfdir}/trusted-key.key

From cc967eb09ec2018084f6c09ad717a89f08f09af2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 24 Jul 2019 14:28:06 +0200
Subject: [PATCH 116/460] Enable GeoLite2 support

Make GeoIP support controlled by bcond, defaults to off now.
Instead enable GeoLite2 support.
---
 bind.spec | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/bind.spec b/bind.spec
index 149e8c2..46c9a43 100644
--- a/bind.spec
+++ b/bind.spec
@@ -25,6 +25,10 @@
 %bcond_with    BDB
 # skip DLZ for now
 %bcond_with DLZ
+# Legacy GeoIP support
+%bcond_with    GEOIP
+# New MaxMind GeoLite support
+%bcond_without GEOIP2
 # Support for builds without threads removed. DHCP no longer needs it anyway.
 %bcond_with    EXPORT_LIBS
 # Legacy GeoIP support
@@ -402,6 +406,12 @@ Requires:  json-c-devel%{?_isa}
 %if %{with DNSTAP}
 Requires:  fstrm-devel%{?_isa} protobuf-c-devel%{?_isa}
 %endif
+%if %{with GEOIP}
+Requires:  GeoIP-devel%{?_isa}
+%endif
+%if %{with GEOIP2}
+Requires:  libmaxminddb-devel%{?_isa}
+%endif
 
 %description lite-devel
 The bind-lite-devel package contains lite version of the header
@@ -1597,6 +1607,7 @@ fi;
 %changelog
 * Wed Jan 08 2020 Petr Menšík <pemensik@redhat.com> - 32:9.14.4-1
 - Update to 9.14.4
+- Add GeoLite2 support
 
 * Wed Jan 08 2020 Petr Menšík <pemensik@redhat.com> - 32:9.14.0-1
 - Update to 9.14.0, disabled SDB and DLZ

From a6454b966c54dc482d2fdc554a09c44ded84e763 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 18 Oct 2019 13:24:50 +0200
Subject: [PATCH 117/460] Update to 9.14.7

Rebase to new sources

14.5:
A SipHash 2-4 based DNS Cookie (RFC 7873) algorithm has been added.
---
 bind-9.14.4.tar.gz.asc | 16 ----------------
 bind-9.14.7.tar.gz.asc | 16 ++++++++++++++++
 bind.spec              | 13 ++++++++-----
 3 files changed, 24 insertions(+), 21 deletions(-)
 delete mode 100644 bind-9.14.4.tar.gz.asc
 create mode 100644 bind-9.14.7.tar.gz.asc

diff --git a/bind-9.14.4.tar.gz.asc b/bind-9.14.4.tar.gz.asc
deleted file mode 100644
index 46eb6f8..0000000
--- a/bind-9.14.4.tar.gz.asc
+++ /dev/null
@@ -1,16 +0,0 @@
------BEGIN PGP SIGNATURE-----
-
-iQIzBAABAgAdFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAl0u4wkACgkQdLtrmky7
-PThVjxAAgSBMHHL5U/vjlK1ZaNdOlwdG2b48+IYu3TkOnFHoAoX0Zkt12xgdWdHi
-ChL645zHeCo16a7OY40wcDhmSa9lIB+M7D7SNNhFAp0Ta2DGKy3mvSloTup/XDeJ
-cdb7rOQdvh70nf+YV4NKADP/QvQdAmMOEhNIZzAW2u+LOCcJwVAlaN1cMt2GEYLM
-0qhKynPKNWcotA9RnCH3K2eNPT4u8X6MyU1XqA+JHJvwFLwJq6xpV8l7IfHEnK5l
-6nhul6IlYAclHtFEw4rADQScQE8Zg2PXtb8Ajn/ml2nXbSjluprAWgHd8aUl2/gV
-VZVzGI9ZaZD9a2Vkj9pJcNKWMcGk0tlBME5Sv9BIwx8jna66kze9z0AhaziwDgnV
-4Ur+xYo784FzSXoxhwvSQlvbs18TZHTx9vYTg2xUIFO2bjIfdAY2oe2Hegr8u9mj
-tCxnOJYE+xLJaj3CsPEoPwDcyV11Swka6+jqsA8ngVb99Y/tct8+BDd6zgjRQaSG
-7ETk6Hi09QFAMe2YPy+BwcHhk05SD784Cvs3KH9W7x0uFVIdc7xVs+vwe+5SH/Q3
-IPCKfhk0k4A/dmjYSmKvzkT5UyIdt/VqVYuVFmMFLqs3Xf0F1KUt/3fJJJfGhaOp
-tflZWGpR6Gou7TY/kMM35yGz9HnZ5uSWAOUhEQAHG1uKck49GjA=
-=DwY1
------END PGP SIGNATURE-----
diff --git a/bind-9.14.7.tar.gz.asc b/bind-9.14.7.tar.gz.asc
new file mode 100644
index 0000000..1134ae1
--- /dev/null
+++ b/bind-9.14.7.tar.gz.asc
@@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABAgAdFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAl2WMpEACgkQdLtrmky7
+PTh/sg//QbNRAQvADQfwF1PPo+JxB+3WzQ9oJAWeHbOoiubwkUwO9xE+BEnTNd5o
+oM1lSLqFxNykOTaoeJlqPftPod1cxo7lSzkwflugGyB/59wliCpqCg053YV4x9mO
+QggvA/E50+0FI/Om/7v4GHGADu/JE83FovOueWAB0LgqfDSD6QFcNFF9sUJJ4P7r
+FcEXSWj8QbrHMWBKncZUOpD2ECotvtrYmi0DTHl1XfigESDQpWtsnTFuabCCsvkh
+ch9wQRplAes2Mf/aS5tl1y0QKKBFuEjtGiTdgrDl6o9GLnx6CueX5saZehu2EVkr
+fq2vEYUC2lRQSjuxSMMJ3L0TGUcl7+ixlAIISS2K9L5Xx7MhBXt/EH5KiKPfsEet
+3EH+DhxV5uXjDU7MgvREnxT+ssV23e0HWTz4tVVQ9LpvYmWPIgLcSOhHCc57yoQF
+c46V0f69dMWbMAlQ93EZSG274ZvpIszpK8+3hGI3/TuDFFgiQJeJJBFVtYJMle69
+3mEEclfzO7fBiXZFec6nVx2309bL64bafN7zszPKXl4XgoefOfD0v0eWqQT4fxfm
+dnGC0qMqSZs5F+d0fISV5JUUNYzt9PZjvnzqLLGOeTF6l3/n9G1mmNsXcxJ1OEIF
+6qh1oO7JTPjt0MFhKac4QjNQi/Bnp25O3I/PRyWZCbiwXkyvyQU=
+=ZT7s
+-----END PGP SIGNATURE-----
diff --git a/bind.spec b/bind.spec
index 46c9a43..92240f7 100644
--- a/bind.spec
+++ b/bind.spec
@@ -64,15 +64,15 @@
 #
 
 # lib*.so.X versions of selected libraries
-%global sover_dns 1309
-%global sover_isc 1308
+%global sover_dns 1310
+%global sover_isc 1309
 %global sover_irs 1301
 %global sover_isccfg 1302
 
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.14.4
+Version:  9.14.7
 Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
@@ -1269,6 +1269,7 @@ fi;
 %endif
 
 %files
+# TODO: Move from lib/bind to lib/named, as used by upstream
 %{_libdir}/bind
 %{_libdir}/named
 %config(noreplace) %verify(not md5 size mtime) %{_sysconfdir}/sysconfig/named
@@ -1284,7 +1285,6 @@ fi;
 %{_sbindir}/named
 %{_sbindir}/rndc*
 %{_libexecdir}/generate-rndc-key.sh
-%{_libdir}/named/filter-aaaa.so
 %{_mandir}/man1/mdig.1*
 %{_mandir}/man1/named-rrchecker.1*
 %{_mandir}/man5/named.conf.5*
@@ -1346,7 +1346,7 @@ fi;
 %files libs
 %{_libdir}/libbind9.so.1302*
 %{_libdir}/libisccc.so.1302*
-%{_libdir}/libns.so.1306*
+%{_libdir}/libns.so.1307*
 
 %files libs-lite
 %{_libdir}/libdns.so.%{sover_dns}*
@@ -1605,6 +1605,9 @@ fi;
 
 
 %changelog
+* Wed Jan 08 2020 Petr Menšík <pemensik@redhat.com> - 32:9.14.7-1
+- Update to 9.14.7
+
 * Wed Jan 08 2020 Petr Menšík <pemensik@redhat.com> - 32:9.14.4-1
 - Update to 9.14.4
 - Add GeoLite2 support

From 6a048cc0b6733ef198764bbe38a7ba1d271f0bd4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 18 Oct 2019 22:35:56 +0200
Subject: [PATCH 118/460] Tweaks to PKCS11 support

Current build has PKCS11 enabled for both variants, because USE_PKCS11
is configured in config.h.
---
 bind-9.14-config-pkcs11.patch      | 119 +++++++++++++++++++
 bind-9.14-disable-isc-pkcs11.patch | 180 +++++++++++++++++++++++++++++
 bind.spec                          |  10 +-
 3 files changed, 307 insertions(+), 2 deletions(-)
 create mode 100644 bind-9.14-config-pkcs11.patch
 create mode 100644 bind-9.14-disable-isc-pkcs11.patch

diff --git a/bind-9.14-config-pkcs11.patch b/bind-9.14-config-pkcs11.patch
new file mode 100644
index 0000000..4559fe5
--- /dev/null
+++ b/bind-9.14-config-pkcs11.patch
@@ -0,0 +1,119 @@
+From 0427e970f0294cadf4dff04021f41e751c713e3c Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Fri, 18 Oct 2019 21:30:52 +0200
+Subject: [PATCH] Move USE_PKCS11 and USE_OPENSSL out of config.h
+
+Building two variants with the same common code requires to unset
+USE_PKCS11 on part of build. That is not possible with config.h value.
+Move it as normal define to CDEFINES.
+---
+ bin/confgen/Makefile.in | 2 +-
+ bin/dig/Makefile.in     | 2 +-
+ bin/dnssec/Makefile.in  | 2 +-
+ bin/named/Makefile.in   | 2 +-
+ configure.ac            | 8 ++++++--
+ lib/dns/Makefile.in     | 2 +-
+ lib/ns/Makefile.in      | 2 +-
+ 7 files changed, 12 insertions(+), 8 deletions(-)
+
+diff --git a/bin/confgen/Makefile.in b/bin/confgen/Makefile.in
+index dc3a7f6..1e0fe0e 100644
+--- a/bin/confgen/Makefile.in
++++ b/bin/confgen/Makefile.in
+@@ -22,7 +22,7 @@ VERSION=@BIND9_VERSION@
+ CINCLUDES = -I${srcdir}/include ${ISC_INCLUDES} ${ISCCC_INCLUDES} \
+ 	${ISCCFG_INCLUDES} ${DNS_INCLUDES} ${BIND9_INCLUDES}
+ 
+-CDEFINES =
++CDEFINES = @USE_PKCS11@
+ CWARNINGS =
+ 
+ ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
+diff --git a/bin/dig/Makefile.in b/bin/dig/Makefile.in
+index 0601939..2317ec0 100644
+--- a/bin/dig/Makefile.in
++++ b/bin/dig/Makefile.in
+@@ -21,7 +21,7 @@ CINCLUDES =	-I${srcdir}/include ${DNS_INCLUDES} \
+ 		${BIND9_INCLUDES} ${ISC_INCLUDES} \
+ 		${IRS_INCLUDES} ${ISCCFG_INCLUDES} @LIBIDN2_CFLAGS@ @OPENSSL_INCLUDES@
+ 
+-CDEFINES =	-DVERSION=\"${VERSION}\"
++CDEFINES =	-DVERSION=\"${VERSION}\" @USE_PKCS11@
+ CWARNINGS =
+ 
+ ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
+diff --git a/bin/dnssec/Makefile.in b/bin/dnssec/Makefile.in
+index 321058b..1dad340 100644
+--- a/bin/dnssec/Makefile.in
++++ b/bin/dnssec/Makefile.in
+@@ -17,7 +17,7 @@ VERSION=@BIND9_VERSION@
+ 
+ CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} @OPENSSL_INCLUDES@
+ 
+-CDEFINES =	-DVERSION=\"${VERSION}\"
++CDEFINES =	-DVERSION=\"${VERSION}\" @USE_PKCS11@
+ CWARNINGS =
+ 
+ DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
+diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
+index eecfa76..e5b0d4b 100644
+--- a/bin/named/Makefile.in
++++ b/bin/named/Makefile.in
+@@ -49,7 +49,7 @@ CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
+ 		${DBDRIVER_INCLUDES} ${MAXMINDDB_CFLAGS} \
+ 		@OPENSSL_INCLUDES@
+ 
+-CDEFINES =      @CONTRIB_DLZ@
++CDEFINES =      @CONTRIB_DLZ@ @USE_PKCS11@
+ 
+ CWARNINGS =
+ 
+diff --git a/configure.ac b/configure.ac
+index da6de97..6d4cdcc 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -963,9 +963,13 @@ AS_CASE([$enable_native_pkcs11],
+ AC_SUBST([PKCS11_TEST])
+ AC_SUBST([PKCS11_TOOLS])
+ 
++USE_PKCS11=
++USE_OPENSSL=
+ AS_CASE([$CRYPTO],
+-	[pkcs11],[AC_DEFINE([USE_PKCS11], [1], [define if PKCS11 is used for Public-Key Cryptography])],
+-	[AC_DEFINE([USE_OPENSSL], [1], [define if OpenSSL is used for Public-Key Cryptography])])
++	[pkcs11],[USE_PKCS11='-DUSE_PKCS11'],
++	[USE_OPENSSL='-DUSE_OPENSSL'])
++AC_SUBST(USE_PKCS11)
++AC_SUBST(USE_OPENSSL)
+ 
+ # preparation for automake
+ # AM_CONDITIONAL([PKCS11_TOOLS], [test "$with_native_pkcs11" = "yes"])
+diff --git a/lib/dns/Makefile.in b/lib/dns/Makefile.in
+index 60c87a8..9125b10 100644
+--- a/lib/dns/Makefile.in
++++ b/lib/dns/Makefile.in
+@@ -30,7 +30,7 @@ CINCLUDES =	-I. -I${top_srcdir}/lib/dns -Iinclude ${DNS_INCLUDES} \
+ 		${ISC_INCLUDES} ${MAXMINDDB_CFLAGS} \
+ 		@OPENSSL_INCLUDES@ @DST_GSSAPI_INC@
+ 
+-CDEFINES =	@USE_GSSAPI@ ${USE_ISC_SPNEGO}
++CDEFINES =	@USE_GSSAPI@ ${USE_ISC_SPNEGO} @USE_OPENSSL@ @USE_PKCS11@
+ 
+ CWARNINGS =
+ 
+diff --git a/lib/ns/Makefile.in b/lib/ns/Makefile.in
+index a14728d..58d731a 100644
+--- a/lib/ns/Makefile.in
++++ b/lib/ns/Makefile.in
+@@ -24,7 +24,7 @@ CINCLUDES =	-I. -I${top_srcdir}/lib/ns -Iinclude \
+ 		${NS_INCLUDES} ${DNS_INCLUDES} ${ISC_INCLUDES} \
+ 		@OPENSSL_INCLUDES@ @DST_GSSAPI_INC@
+ 
+-CDEFINES =	-DNAMED_PLUGINDIR=\"${plugindir}\"
++CDEFINES =	@USE_PKCS11@ -DNAMED_PLUGINDIR=\"${plugindir}\"
+ 
+ CWARNINGS =
+ 
+-- 
+2.20.1
+
diff --git a/bind-9.14-disable-isc-pkcs11.patch b/bind-9.14-disable-isc-pkcs11.patch
new file mode 100644
index 0000000..b8ee475
--- /dev/null
+++ b/bind-9.14-disable-isc-pkcs11.patch
@@ -0,0 +1,180 @@
+From f354e06035a6661b29f665890933c9d0108cd3e5 Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Fri, 18 Oct 2019 21:55:19 +0200
+Subject: [PATCH] Do not define ISC_PKCS11_INCLUDES
+
+isc library is no longer different. Just dns library is different.
+Do not try to use isc-pkcs11 library for no reason.
+---
+ bin/dnssec-pkcs11/Makefile.in    |  8 ++++----
+ bin/named-pkcs11/Makefile.in     | 10 +++++-----
+ bin/pkcs11/Makefile.in           |  6 +++---
+ configure.ac                     | 15 ---------------
+ lib/Makefile.in                  |  2 +-
+ lib/dns-pkcs11/tests/Makefile.in |  4 ++--
+ make/includes.in                 |  6 ------
+ 7 files changed, 15 insertions(+), 36 deletions(-)
+
+diff --git a/bin/dnssec-pkcs11/Makefile.in b/bin/dnssec-pkcs11/Makefile.in
+index 5067ee1..54b9f10 100644
+--- a/bin/dnssec-pkcs11/Makefile.in
++++ b/bin/dnssec-pkcs11/Makefile.in
+@@ -15,17 +15,17 @@ VERSION=@BIND9_VERSION@
+ 
+ @BIND9_MAKE_INCLUDES@
+ 
+-CINCLUDES =	${DNS_PKCS11_INCLUDES} ${ISC_PKCS11_INCLUDES} @OPENSSL_INCLUDES@
++CINCLUDES =	${DNS_PKCS11_INCLUDES} ${ISC_INCLUDES} @OPENSSL_INCLUDES@
+ 
+ CDEFINES =	-DVERSION=\"${VERSION}\"
+ CWARNINGS =
+ 
+ DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
+-ISCLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@ @OPENSSL_LIBS@
+-ISCNOSYMLIBS =	../../lib/isc-pkcs11/libisc-pkcs11-nosymtbl.@A@ @OPENSSL_LIBS@
++ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
++ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @OPENSSL_LIBS@
+ 
+ DNSDEPLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@
+-ISCDEPLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
++ISCDEPLIBS =	../../lib/isc/libisc.@A@
+ 
+ DEPLIBS =	${DNSDEPLIBS} ${ISCDEPLIBS}
+ 
+diff --git a/bin/named-pkcs11/Makefile.in b/bin/named-pkcs11/Makefile.in
+index 416e12e..a0e8314 100644
+--- a/bin/named-pkcs11/Makefile.in
++++ b/bin/named-pkcs11/Makefile.in
+@@ -43,9 +43,9 @@ DLZDRIVER_INCLUDES =	@DLZ_DRIVER_INCLUDES@
+ DLZDRIVER_LIBS =	@DLZ_DRIVER_LIBS@
+ 
+ CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
+-		${NS_INCLUDES} ${DNS_PKCS11_INCLUDES} \
++		${NS_PKCS11_INCLUDES} ${DNS_PKCS11_INCLUDES} \
+ 		${BIND9_INCLUDES} ${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} \
+-		${ISC_PKCS11_INCLUDES} ${DLZDRIVER_INCLUDES} \
++		${ISC_INCLUDES} ${DLZDRIVER_INCLUDES} \
+ 		${DBDRIVER_INCLUDES} ${MAXMINDDB_CFLAGS} \
+ 		@OPENSSL_INCLUDES@
+ 
+@@ -56,15 +56,15 @@ CWARNINGS =
+ DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
+ ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
+ ISCCCLIBS =	../../lib/isccc/libisccc.@A@
+-ISCLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@ @OPENSSL_LIBS@
+-ISCNOSYMLIBS =	../../lib/isc-pkcs11/libisc-pkcs11-nosymtbl.@A@ @OPENSSL_LIBS@
++ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
++ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @OPENSSL_LIBS@
+ BIND9LIBS =	../../lib/bind9/libbind9.@A@
+ NSLIBS =	../../lib/ns/libns.@A@
+ 
+ DNSDEPLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@
+ ISCCFGDEPLIBS =	../../lib/isccfg/libisccfg.@A@
+ ISCCCDEPLIBS =	../../lib/isccc/libisccc.@A@
+-ISCDEPLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
++ISCDEPLIBS =	../../lib/isc/libisc.@A@
+ BIND9DEPLIBS =	../../lib/bind9/libbind9.@A@
+ NSDEPLIBS =	../../lib/ns/libns.@A@
+ 
+diff --git a/bin/pkcs11/Makefile.in b/bin/pkcs11/Makefile.in
+index 0e542f3..96aec05 100644
+--- a/bin/pkcs11/Makefile.in
++++ b/bin/pkcs11/Makefile.in
+@@ -13,13 +13,13 @@ top_srcdir =	@top_srcdir@
+ 
+ @BIND9_MAKE_INCLUDES@
+ 
+-CINCLUDES =	${ISC_PKCS11_INCLUDES}
++CINCLUDES =	${ISC_INCLUDES}
+ 
+ CDEFINES =
+ 
+-ISCLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@ @OPENSSL_LIBS@
++ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
+ 
+-ISCDEPLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
++ISCDEPLIBS =	../../lib/isc/libisc.@A@
+ 
+ DEPLIBS =	${ISCDEPLIBS}
+ 
+diff --git a/configure.ac b/configure.ac
+index 6d4cdcc..39c1d95 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -2535,7 +2535,6 @@ if test "X$srcdir" != "X"; then
+ 	BIND9_NS_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/ns/include"
+ 	BIND9_BIND9_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/bind9/include"
+ 	BIND9_IRS_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/irs/include"
+-	BIND9_ISC_PKCS11_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/isc-pkcs11/include"
+ 	BIND9_DNS_PKCS11_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/dns-pkcs11/include"
+ 	BIND9_NS_PKCS11_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/ns-pkcs11/include"
+ else
+@@ -3114,20 +3113,6 @@ AC_CONFIG_FILES([
+ 	lib/isc/unix/include/Makefile
+ 	lib/isc/unix/include/isc/Makefile
+ 	lib/isc/unix/include/pkcs11/Makefile
+-	lib/isc-pkcs11/pthreads/Makefile
+-	lib/isc-pkcs11/pthreads/include/Makefile
+-	lib/isc-pkcs11/pthreads/include/isc/Makefile
+-	lib/isc-pkcs11/Makefile
+-	lib/isc-pkcs11/include/Makefile
+-	lib/isc-pkcs11/include/isc/Makefile
+-	lib/isc-pkcs11/include/isc/platform.h
+-	lib/isc-pkcs11/include/pk11/Makefile
+-	lib/isc-pkcs11/include/pkcs11/Makefile
+-	lib/isc-pkcs11/tests/Makefile
+-	lib/isc-pkcs11/unix/Makefile
+-	lib/isc-pkcs11/unix/include/Makefile
+-	lib/isc-pkcs11/unix/include/isc/Makefile
+-	lib/isc-pkcs11/unix/include/pkcs11/Makefile
+ 	lib/isccc/Makefile
+ 	lib/isccc/include/Makefile
+ 	lib/isccc/include/isccc/Makefile
+diff --git a/lib/Makefile.in b/lib/Makefile.in
+index 439d748..3f655e8 100644
+--- a/lib/Makefile.in
++++ b/lib/Makefile.in
+@@ -15,7 +15,7 @@ top_srcdir =	@top_srcdir@
+ # Attempt to disable parallel processing.
+ .NOTPARALLEL:
+ .NO_PARALLEL:
+-SUBDIRS =	isc isc-pkcs11 isccc dns dns-pkcs11 ns isccfg bind9 irs samples
++SUBDIRS =	isc isccc dns dns-pkcs11 ns isccfg bind9 irs samples
+ TARGETS =
+ 
+ @BIND9_MAKE_RULES@
+diff --git a/lib/dns-pkcs11/tests/Makefile.in b/lib/dns-pkcs11/tests/Makefile.in
+index 9f78596..ac187c9 100644
+--- a/lib/dns-pkcs11/tests/Makefile.in
++++ b/lib/dns-pkcs11/tests/Makefile.in
+@@ -19,8 +19,8 @@ CINCLUDES =	-I. -Iinclude ${DNS_PKCS11_INCLUDES} ${ISC_PKCS11_INCLUDES} \
+ 		@OPENSSL_INCLUDES@ @CMOCKA_CFLAGS@
+ CDEFINES =	-DTESTS="\"${top_builddir}/lib/dns-pkcs11/tests/\""
+ 
+-ISCLIBS =	../../isc-pkcs11/libisc-pkcs11.@A@
+-ISCDEPLIBS =	../../isc-pkcs11/libisc-pkcs11.@A@
++ISCLIBS =	../../isc/libisc.@A@
++ISCDEPLIBS =	../../isc/libisc.@A@
+ DNSLIBS =	../libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
+ DNSDEPLIBS =	../libdns-pkcs11.@A@
+ 
+diff --git a/make/includes.in b/make/includes.in
+index 6e6572b..7b17738 100644
+--- a/make/includes.in
++++ b/make/includes.in
+@@ -40,12 +40,6 @@ BIND9_INCLUDES = @BIND9_BIND9_BUILDINCLUDE@ \
+ TEST_INCLUDES = \
+ 	-I${top_srcdir}/lib/tests/include
+ 
+-ISC_PKCS11_INCLUDES = @BIND9_ISC_PKCS11_BUILDINCLUDE@ \
+-	-I${top_srcdir}/lib/isc-pkcs11 \
+-	-I${top_srcdir}/lib/isc-pkcs11/include \
+-	-I${top_srcdir}/lib/isc-pkcs11/unix/include \
+-	-I${top_srcdir}/lib/isc-pkcs11/pthreads/include
+-
+ DNS_PKCS11_INCLUDES = @BIND9_DNS_PKCS11_BUILDINCLUDE@ \
+ 	-I${top_srcdir}/lib/dns-pkcs11/include
+ 
+-- 
+2.20.1
+
diff --git a/bind.spec b/bind.spec
index 92240f7..df6cc92 100644
--- a/bind.spec
+++ b/bind.spec
@@ -126,15 +126,19 @@ Patch112:bind97-rh645544.patch
 Patch130:bind-9.9.1-P2-dlz-libdb.patch
 Patch131:bind-9.9.1-P2-multlib-conflict.patch
 Patch133:bind99-rh640538.patch
+# Make PKCS11 used only for pkcs11 parts
+Patch135:bind-9.14-config-pkcs11.patch
 # Fedora specific patch to distribute native-pkcs#11 functionality
 Patch136:bind-9.10-dist-native-pkcs11.patch
+# Do not use isc-pkcs11.
+# FIXME: should be part of Patch136
+Patch138:bind-9.14-disable-isc-pkcs11.patch
+Patch149:bind-9.11-kyua-pkcs11.patch
 
 # [ISC-Bugs #42525] non-portable use of strlcat in contrib/sdb/ldap/zone2ldap.c
 # introduced by https://source.isc.org/cgi-bin/gitweb.cgi?p=bind9.git;a=commit;h=fc9f0ac5778f78003a7acc957a23711811fec122
 Patch137:bind-9.10-use-of-strlcat.patch
 Patch140:bind-9.11-rh1410433.patch
-# [ISC-Bugs #46853] commit cb616c6d5c2ece1fac37fa6e0bca2b53d4043098 ISC 4851
-Patch149:bind-9.11-kyua-pkcs11.patch
 # Avoid conflicts with OpenSSL PKCS11 engine
 Patch150:bind-9.11-engine-pkcs11.patch
 Patch153:bind-9.11-export-suffix.patch
@@ -581,11 +585,13 @@ are used for building ISC DHCP.
 %patch187 -p1 -b .oot-gen
 
 %if %{with PKCS11}
+%patch135 -p1 -b .config-pkcs11
 cp -r bin/named{,-pkcs11}
 cp -r bin/dnssec{,-pkcs11}
 cp -r lib/isc{,-pkcs11}
 cp -r lib/dns{,-pkcs11}
 %patch136 -p1 -b .dist_pkcs11
+%patch138 -p1 -b .no-isc-pkcs11
 %patch149 -p1 -b .kyua-pkcs11
 %patch150 -p1 -b .engine-pkcs11
 %endif

From b4a5bc525b86ea50bbfe298b3e226ecd12518062 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Sat, 19 Oct 2019 01:56:53 +0200
Subject: [PATCH 119/460] Create place for documenting changes in upstream

---
 Changes.md | 12 ++++++++++++
 1 file changed, 12 insertions(+)
 create mode 100644 Changes.md

diff --git a/Changes.md b/Changes.md
new file mode 100644
index 0000000..91e17b4
--- /dev/null
+++ b/Changes.md
@@ -0,0 +1,12 @@
+= Changes in BIND9 package =
+
+== 9.14 ==
+
+- single thread support removed. Cannot provide bind-export-libs for DHCP
+- lwres support completely removed. Both daemon and library
+- common parts of daemon moved into libns shared library
+- introduced plugin for filtering aaaa responses
+- some SDB utilities no longer supported
+
+=== 9.14.7 ===
+[notes](https://downloads.isc.org/isc/bind9/9.14.7/RELEASE-NOTES-bind-9.14.7.html)

From 05dbc8892854153c60e3b4097cf7b3c99970569b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Sat, 19 Oct 2019 01:51:12 +0200
Subject: [PATCH 120/460] Iterative update, not working properly

Fixed PKCS#11 used everywhere. Just custom system to use PKCS11 on part
of built tools.

FIXME: unit tests not passing, something broken inside.
---
 bind-9.10-dist-native-pkcs11.patch | 380 ++++++++++++++++-------------
 bind-9.11-kyua-pkcs11.patch        |  68 +-----
 bind-9.14-config-pkcs11.patch      |  61 +++--
 bind-9.14-disable-isc-pkcs11.patch | 180 --------------
 bind.spec                          |   5 +-
 5 files changed, 275 insertions(+), 419 deletions(-)
 delete mode 100644 bind-9.14-disable-isc-pkcs11.patch

diff --git a/bind-9.10-dist-native-pkcs11.patch b/bind-9.10-dist-native-pkcs11.patch
index c255fab..c1b479a 100644
--- a/bind-9.10-dist-native-pkcs11.patch
+++ b/bind-9.10-dist-native-pkcs11.patch
@@ -11,34 +11,56 @@ index 9ad7f62..094775a 100644
  		@NZD_TOOLS@ @PYTHON_TOOLS@ @PKCS11_TOOLS@ plugins tests
  TARGETS =
  
+diff --git a/bin/confgen/Makefile.in b/bin/confgen/Makefile.in
+index 1e0fe0e..dc3a7f6 100644
+--- a/bin/confgen/Makefile.in
++++ b/bin/confgen/Makefile.in
+@@ -22,7 +22,7 @@ VERSION=@BIND9_VERSION@
+ CINCLUDES = -I${srcdir}/include ${ISC_INCLUDES} ${ISCCC_INCLUDES} \
+ 	${ISCCFG_INCLUDES} ${DNS_INCLUDES} ${BIND9_INCLUDES}
+ 
+-CDEFINES = @USE_PKCS11@
++CDEFINES =
+ CWARNINGS =
+ 
+ ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
+diff --git a/bin/dig/Makefile.in b/bin/dig/Makefile.in
+index 2317ec0..0601939 100644
+--- a/bin/dig/Makefile.in
++++ b/bin/dig/Makefile.in
+@@ -21,7 +21,7 @@ CINCLUDES =	-I${srcdir}/include ${DNS_INCLUDES} \
+ 		${BIND9_INCLUDES} ${ISC_INCLUDES} \
+ 		${IRS_INCLUDES} ${ISCCFG_INCLUDES} @LIBIDN2_CFLAGS@ @OPENSSL_INCLUDES@
+ 
+-CDEFINES =	-DVERSION=\"${VERSION}\" @USE_PKCS11@
++CDEFINES =	-DVERSION=\"${VERSION}\"
+ CWARNINGS =
+ 
+ ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
 diff --git a/bin/dnssec-pkcs11/Makefile.in b/bin/dnssec-pkcs11/Makefile.in
-index 321058b..5067ee1 100644
+index 1dad340..ffac64e 100644
 --- a/bin/dnssec-pkcs11/Makefile.in
 +++ b/bin/dnssec-pkcs11/Makefile.in
-@@ -15,17 +15,17 @@ VERSION=@BIND9_VERSION@
+@@ -15,16 +15,16 @@ VERSION=@BIND9_VERSION@
  
  @BIND9_MAKE_INCLUDES@
  
 -CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} @OPENSSL_INCLUDES@
-+CINCLUDES =	${DNS_PKCS11_INCLUDES} ${ISC_PKCS11_INCLUDES} @OPENSSL_INCLUDES@
++CINCLUDES =	${DNS_PKCS11_INCLUDES} ${ISC_INCLUDES} @OPENSSL_INCLUDES@
  
- CDEFINES =	-DVERSION=\"${VERSION}\"
+ CDEFINES =	-DVERSION=\"${VERSION}\" @USE_PKCS11@
  CWARNINGS =
  
 -DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
--ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
--ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @OPENSSL_LIBS@
-+DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
-+ISCLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@ @OPENSSL_LIBS@
-+ISCNOSYMLIBS =	../../lib/isc-pkcs11/libisc-pkcs11-nosymtbl.@A@ @OPENSSL_LIBS@
++DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_PK11_LIBS@
+ ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
+ ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @OPENSSL_LIBS@
  
 -DNSDEPLIBS =	../../lib/dns/libdns.@A@
--ISCDEPLIBS =	../../lib/isc/libisc.@A@
 +DNSDEPLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@
-+ISCDEPLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
+ ISCDEPLIBS =	../../lib/isc/libisc.@A@
  
  DEPLIBS =	${DNSDEPLIBS} ${ISCDEPLIBS}
- 
 @@ -34,11 +34,11 @@ LIBS =		${DNSLIBS} ${ISCLIBS} @LIBS@
  NOSYMLIBS =	${DNSLIBS} ${ISCNOSYMLIBS} @LIBS@
  
@@ -131,47 +153,57 @@ index 321058b..5067ee1 100644
  	for t in ${TARGETS}; do ${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/$$t || exit 1; done
  
  clean distclean::
+diff --git a/bin/dnssec/Makefile.in b/bin/dnssec/Makefile.in
+index 1dad340..321058b 100644
+--- a/bin/dnssec/Makefile.in
++++ b/bin/dnssec/Makefile.in
+@@ -17,7 +17,7 @@ VERSION=@BIND9_VERSION@
+ 
+ CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} @OPENSSL_INCLUDES@
+ 
+-CDEFINES =	-DVERSION=\"${VERSION}\" @USE_PKCS11@
++CDEFINES =	-DVERSION=\"${VERSION}\"
+ CWARNINGS =
+ 
+ DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
 diff --git a/bin/named-pkcs11/Makefile.in b/bin/named-pkcs11/Makefile.in
-index eecfa76..416e12e 100644
+index e5b0d4b..b739869 100644
 --- a/bin/named-pkcs11/Makefile.in
 +++ b/bin/named-pkcs11/Makefile.in
-@@ -43,9 +43,9 @@ DLZDRIVER_INCLUDES =	@DLZ_DRIVER_INCLUDES@
+@@ -43,7 +43,7 @@ DLZDRIVER_INCLUDES =	@DLZ_DRIVER_INCLUDES@
  DLZDRIVER_LIBS =	@DLZ_DRIVER_LIBS@
  
  CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
 -		${NS_INCLUDES} ${DNS_INCLUDES} \
-+		${NS_INCLUDES} ${DNS_PKCS11_INCLUDES} \
++		${NS_PKCS11_INCLUDES} ${DNS_PKCS11_INCLUDES} \
  		${BIND9_INCLUDES} ${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} \
--		${ISC_INCLUDES} ${DLZDRIVER_INCLUDES} \
-+		${ISC_PKCS11_INCLUDES} ${DLZDRIVER_INCLUDES} \
+ 		${ISC_INCLUDES} ${DLZDRIVER_INCLUDES} \
  		${DBDRIVER_INCLUDES} ${MAXMINDDB_CFLAGS} \
- 		@OPENSSL_INCLUDES@
- 
-@@ -53,18 +53,18 @@ CDEFINES =      @CONTRIB_DLZ@
+@@ -53,37 +53,37 @@ CDEFINES =      @CONTRIB_DLZ@ @USE_PKCS11@
  
  CWARNINGS =
  
 -DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
-+DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
++DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_PK11_LIBS@
  ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
  ISCCCLIBS =	../../lib/isccc/libisccc.@A@
--ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
--ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @OPENSSL_LIBS@
-+ISCLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@ @OPENSSL_LIBS@
-+ISCNOSYMLIBS =	../../lib/isc-pkcs11/libisc-pkcs11-nosymtbl.@A@ @OPENSSL_LIBS@
+ ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
+ ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @OPENSSL_LIBS@
  BIND9LIBS =	../../lib/bind9/libbind9.@A@
- NSLIBS =	../../lib/ns/libns.@A@
+-NSLIBS =	../../lib/ns/libns.@A@
++NSLIBS =	../../lib/ns-pkcs11/libns-pkcs11.@A@
  
 -DNSDEPLIBS =	../../lib/dns/libdns.@A@
 +DNSDEPLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@
  ISCCFGDEPLIBS =	../../lib/isccfg/libisccfg.@A@
  ISCCCDEPLIBS =	../../lib/isccc/libisccc.@A@
--ISCDEPLIBS =	../../lib/isc/libisc.@A@
-+ISCDEPLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
+ ISCDEPLIBS =	../../lib/isc/libisc.@A@
  BIND9DEPLIBS =	../../lib/bind9/libbind9.@A@
- NSDEPLIBS =	../../lib/ns/libns.@A@
+-NSDEPLIBS =	../../lib/ns/libns.@A@
++NSDEPLIBS =	../../lib/ns-pkcs11/libns-pkcs11.@A@
  
-@@ -73,17 +73,17 @@ DEPLIBS =	${NSDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
+ DEPLIBS =	${NSDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
+ 		${ISCCFGDEPLIBS} ${ISCCCDEPLIBS} ${ISCDEPLIBS}
  
  LIBS =		${NSLIBS} ${DNSLIBS} ${BIND9LIBS} \
  		${ISCCFGLIBS} ${ISCCCLIBS} ${ISCLIBS} \
@@ -247,32 +279,24 @@ index eecfa76..416e12e 100644
  
  @DLZ_DRIVER_RULES@
  
-diff --git a/bin/pkcs11/Makefile.in b/bin/pkcs11/Makefile.in
-index 96aec05..0e542f3 100644
---- a/bin/pkcs11/Makefile.in
-+++ b/bin/pkcs11/Makefile.in
-@@ -13,13 +13,13 @@ top_srcdir =	@top_srcdir@
+diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
+index e5b0d4b..eecfa76 100644
+--- a/bin/named/Makefile.in
++++ b/bin/named/Makefile.in
+@@ -49,7 +49,7 @@ CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
+ 		${DBDRIVER_INCLUDES} ${MAXMINDDB_CFLAGS} \
+ 		@OPENSSL_INCLUDES@
  
- @BIND9_MAKE_INCLUDES@
+-CDEFINES =      @CONTRIB_DLZ@ @USE_PKCS11@
++CDEFINES =      @CONTRIB_DLZ@
  
--CINCLUDES =	${ISC_INCLUDES}
-+CINCLUDES =	${ISC_PKCS11_INCLUDES}
- 
- CDEFINES =
- 
--ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
-+ISCLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@ @OPENSSL_LIBS@
- 
--ISCDEPLIBS =	../../lib/isc/libisc.@A@
-+ISCDEPLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
- 
- DEPLIBS =	${ISCDEPLIBS}
+ CWARNINGS =
  
 diff --git a/configure.ac b/configure.ac
-index 29106cb..3dff344 100644
+index 6cce3bb..d80ae31 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -1267,12 +1267,14 @@ AC_SUBST(USE_GSSAPI)
+@@ -1276,12 +1276,14 @@ AC_SUBST(USE_GSSAPI)
  AC_SUBST(DST_GSSAPI_INC)
  AC_SUBST(DNS_GSSAPI_LIBS)
  DNS_CRYPTO_LIBS="$DNS_GSSAPI_LIBS"
@@ -287,37 +311,34 @@ index 29106cb..3dff344 100644
  
  #
  # was --with-lmdb specified?
-@@ -2542,6 +2544,9 @@ AC_SUBST(BIND9_DNS_BUILDINCLUDE)
+@@ -2522,6 +2524,8 @@ AC_SUBST(BIND9_DNS_BUILDINCLUDE)
  AC_SUBST(BIND9_NS_BUILDINCLUDE)
  AC_SUBST(BIND9_BIND9_BUILDINCLUDE)
  AC_SUBST(BIND9_IRS_BUILDINCLUDE)
-+AC_SUBST(BIND9_ISC_PKCS11_BUILDINCLUDE)
 +AC_SUBST(BIND9_DNS_PKCS11_BUILDINCLUDE)
 +AC_SUBST(BIND9_NS_PKCS11_BUILDINCLUDE)
  if test "X$srcdir" != "X"; then
  	BIND9_ISC_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/isc/include"
  	BIND9_ISCCC_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/isccc/include"
-@@ -2550,6 +2555,9 @@ if test "X$srcdir" != "X"; then
+@@ -2530,6 +2534,8 @@ if test "X$srcdir" != "X"; then
  	BIND9_NS_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/ns/include"
  	BIND9_BIND9_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/bind9/include"
  	BIND9_IRS_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/irs/include"
-+	BIND9_ISC_PKCS11_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/isc-pkcs11/include"
 +	BIND9_DNS_PKCS11_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/dns-pkcs11/include"
 +	BIND9_NS_PKCS11_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/ns-pkcs11/include"
  else
  	BIND9_ISC_BUILDINCLUDE=""
  	BIND9_ISCCC_BUILDINCLUDE=""
-@@ -2558,6 +2566,9 @@ else
+@@ -2538,6 +2544,8 @@ else
  	BIND9_NS_BUILDINCLUDE=""
  	BIND9_BIND9_BUILDINCLUDE=""
  	BIND9_IRS_BUILDINCLUDE=""
-+	BIND9_ISC_PKCS11_BUILDINCLUDE=""
 +	BIND9_DNS_PKCS11_BUILDINCLUDE=""
 +	BIND9_NS_PKCS11_BUILDINCLUDE=""
  fi
  
  AC_SUBST_FILE(BIND9_MAKE_INCLUDES)
-@@ -3021,8 +3032,11 @@ AC_CONFIG_FILES([
+@@ -3001,8 +3009,11 @@ AC_CONFIG_FILES([
  	bin/delv/Makefile
  	bin/dig/Makefile
  	bin/dnssec/Makefile
@@ -329,7 +350,7 @@ index 29106cb..3dff344 100644
  	bin/nsupdate/Makefile
  	bin/pkcs11/Makefile
  	bin/plugins/Makefile
-@@ -3095,6 +3109,10 @@ AC_CONFIG_FILES([
+@@ -3075,6 +3086,10 @@ AC_CONFIG_FILES([
  	lib/dns/include/dns/Makefile
  	lib/dns/include/dst/Makefile
  	lib/dns/tests/Makefile
@@ -340,29 +361,19 @@ index 29106cb..3dff344 100644
  	lib/irs/Makefile
  	lib/irs/include/Makefile
  	lib/irs/include/irs/Makefile
-@@ -3115,6 +3133,20 @@ AC_CONFIG_FILES([
- 	lib/isc/unix/include/Makefile
- 	lib/isc/unix/include/isc/Makefile
- 	lib/isc/unix/include/pkcs11/Makefile
-+	lib/isc-pkcs11/pthreads/Makefile
-+	lib/isc-pkcs11/pthreads/include/Makefile
-+	lib/isc-pkcs11/pthreads/include/isc/Makefile
-+	lib/isc-pkcs11/Makefile
-+	lib/isc-pkcs11/include/Makefile
-+	lib/isc-pkcs11/include/isc/Makefile
-+	lib/isc-pkcs11/include/isc/platform.h
-+	lib/isc-pkcs11/include/pk11/Makefile
-+	lib/isc-pkcs11/include/pkcs11/Makefile
-+	lib/isc-pkcs11/tests/Makefile
-+	lib/isc-pkcs11/unix/Makefile
-+	lib/isc-pkcs11/unix/include/Makefile
-+	lib/isc-pkcs11/unix/include/isc/Makefile
-+	lib/isc-pkcs11/unix/include/pkcs11/Makefile
- 	lib/isccc/Makefile
- 	lib/isccc/include/Makefile
- 	lib/isccc/include/isccc/Makefile
+@@ -3107,6 +3122,10 @@ AC_CONFIG_FILES([
+ 	lib/ns/include/Makefile
+ 	lib/ns/include/ns/Makefile
+ 	lib/ns/tests/Makefile
++	lib/ns-pkcs11/Makefile
++	lib/ns-pkcs11/include/Makefile
++	lib/ns-pkcs11/include/ns/Makefile
++	lib/ns-pkcs11/tests/Makefile
+ 	lib/samples/Makefile
+ 	lib/samples/Makefile-postinstall
+ 	unit/unittest.sh
 diff --git a/lib/Makefile.in b/lib/Makefile.in
-index ffa2d5a..439d748 100644
+index ffa2d5a..6fbc192 100644
 --- a/lib/Makefile.in
 +++ b/lib/Makefile.in
 @@ -15,7 +15,7 @@ top_srcdir =	@top_srcdir@
@@ -370,36 +381,28 @@ index ffa2d5a..439d748 100644
  .NOTPARALLEL:
  .NO_PARALLEL:
 -SUBDIRS =	isc isccc dns ns isccfg bind9 irs samples
-+SUBDIRS =	isc isc-pkcs11 isccc dns dns-pkcs11 ns isccfg bind9 irs samples
++SUBDIRS =	isc isccc dns dns-pkcs11 ns ns-pkcs11 isccfg bind9 irs samples
  TARGETS =
  
  @BIND9_MAKE_RULES@
 diff --git a/lib/dns-pkcs11/Makefile.in b/lib/dns-pkcs11/Makefile.in
-index 60c87a8..50da232 100644
+index 9125b10..593270d 100644
 --- a/lib/dns-pkcs11/Makefile.in
 +++ b/lib/dns-pkcs11/Makefile.in
-@@ -26,17 +26,17 @@ VERSION=@BIND9_VERSION@
+@@ -26,11 +26,11 @@ VERSION=@BIND9_VERSION@
  
  USE_ISC_SPNEGO = @USE_ISC_SPNEGO@
  
 -CINCLUDES =	-I. -I${top_srcdir}/lib/dns -Iinclude ${DNS_INCLUDES} \
--		${ISC_INCLUDES} ${MAXMINDDB_CFLAGS} \
 +CINCLUDES =	-I. -I${top_srcdir}/lib/dns-pkcs11 -Iinclude ${DNS_PKCS11_INCLUDES} \
-+		${ISC_PKCS11_INCLUDES} ${MAXMINDDB_CFLAGS} \
+ 		${ISC_INCLUDES} ${MAXMINDDB_CFLAGS} \
  		@OPENSSL_INCLUDES@ @DST_GSSAPI_INC@
  
- CDEFINES =	@USE_GSSAPI@ ${USE_ISC_SPNEGO}
+-CDEFINES =	@USE_GSSAPI@ ${USE_ISC_SPNEGO} @USE_OPENSSL@ @USE_PKCS11@
++CDEFINES =	@USE_GSSAPI@ ${USE_ISC_SPNEGO} @USE_PKCS11@ -DUSE_OPENSSL=0
  
  CWARNINGS =
  
--ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
-+ISCLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@ @OPENSSL_LIBS@
- 
--ISCDEPLIBS =	../../lib/isc/libisc.@A@
-+ISCDEPLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
- 
- LIBS =		${MAXMINDDB_LIBS} @LIBS@
- 
 @@ -138,15 +138,15 @@ version.@O@: version.c
  		-DLIBAGE=${LIBAGE} \
  		-c ${srcdir}/version.c
@@ -420,13 +423,7 @@ index 60c87a8..50da232 100644
  
  include: gen
  	${MAKE} include/dns/enumtype.h
-@@ -172,27 +172,27 @@ code.h:	gen
- 	./gen -s ${srcdir} > code.h || { rm -f $@ ; exit 1; }
- 
- gen: gen.c
--	${BUILD_CC} ${BUILD_CFLAGS} -I${top_srcdir}/lib/isc/include \
-+	${BUILD_CC} ${BUILD_CFLAGS} -I${top_srcdir}/lib/isc-pkcs11/include \
- 	${LFS_CFLAGS} ${LFS_LDFLAGS} \
+@@ -177,22 +177,22 @@ gen: gen.c
  	${BUILD_CPPFLAGS} ${BUILD_LDFLAGS} -o $@ ${srcdir}/gen.c \
  	${BUILD_LIBS} ${LFS_LIBS}
  
@@ -454,100 +451,155 @@ index 60c87a8..50da232 100644
  	rm -f gen code.h include/dns/enumtype.h include/dns/enumclass.h
  	rm -f include/dns/rdatastruct.h
  	rm -f dnstap.pb-c.c dnstap.pb-c.h
-diff --git a/lib/isc-pkcs11/Makefile.in b/lib/isc-pkcs11/Makefile.in
-index ed87279..3171b48 100644
---- a/lib/isc-pkcs11/Makefile.in
-+++ b/lib/isc-pkcs11/Makefile.in
-@@ -20,7 +20,7 @@ VERSION=@BIND9_VERSION@
- CINCLUDES =	-I${srcdir}/unix/include \
- 		-I${srcdir}/pthreads/include \
- 		-I./include \
--		-I${srcdir}/include ${DNS_INCLUDES} @OPENSSL_INCLUDES@
-+		-I${srcdir}/include ${DNS_PKCS11_INCLUDES} @OPENSSL_INCLUDES@
- CDEFINES =
+diff --git a/lib/dns-pkcs11/tests/Makefile.in b/lib/dns-pkcs11/tests/Makefile.in
+index 0e91523..9351c3f 100644
+--- a/lib/dns-pkcs11/tests/Makefile.in
++++ b/lib/dns-pkcs11/tests/Makefile.in
+@@ -15,14 +15,14 @@ VERSION=@BIND9_VERSION@
+ 
+ @BIND9_MAKE_INCLUDES@
+ 
+-CINCLUDES =	-I. -Iinclude ${DNS_INCLUDES} ${ISC_INCLUDES} \
++CINCLUDES =	-I. -Iinclude ${DNS_PKCS11_INCLUDES} ${ISC_INCLUDES} \
+ 		@OPENSSL_INCLUDES@ @CMOCKA_CFLAGS@
+-CDEFINES =	-DTESTS="\"${top_builddir}/lib/dns/tests/\""
++CDEFINES =	@USE_PKCS11@ -DTESTS="\"${top_builddir}/lib/dns-pkcs11/tests/\""
+ 
+ ISCLIBS =	../../isc/libisc.@A@ @OPENSSL_LIBS@
+ ISCDEPLIBS =	../../isc/libisc.@A@
+-DNSLIBS =	../libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
+-DNSDEPLIBS =	../libdns.@A@
++DNSLIBS =	../libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_PK11_LIBS@
++DNSDEPLIBS =	../libdns-pkcs11.@A@
+ 
+ LIBS =		@LIBS@ @CMOCKA_LIBS@
+ 
+diff --git a/lib/dns/Makefile.in b/lib/dns/Makefile.in
+index 9125b10..70644d8 100644
+--- a/lib/dns/Makefile.in
++++ b/lib/dns/Makefile.in
+@@ -30,7 +30,7 @@ CINCLUDES =	-I. -I${top_srcdir}/lib/dns -Iinclude ${DNS_INCLUDES} \
+ 		${ISC_INCLUDES} ${MAXMINDDB_CFLAGS} \
+ 		@OPENSSL_INCLUDES@ @DST_GSSAPI_INC@
+ 
+-CDEFINES =	@USE_GSSAPI@ ${USE_ISC_SPNEGO} @USE_OPENSSL@ @USE_PKCS11@
++CDEFINES =	@USE_GSSAPI@ ${USE_ISC_SPNEGO} @USE_OPENSSL@
+ 
  CWARNINGS =
  
-@@ -94,40 +94,40 @@ version.@O@: version.c
+diff --git a/lib/ns-pkcs11/Makefile.in b/lib/ns-pkcs11/Makefile.in
+index 58d731a..47b4b98 100644
+--- a/lib/ns-pkcs11/Makefile.in
++++ b/lib/ns-pkcs11/Makefile.in
+@@ -20,8 +20,8 @@ VERSION=@BIND9_VERSION@
+ 
+ USE_ISC_SPNEGO = @USE_ISC_SPNEGO@
+ 
+-CINCLUDES =	-I. -I${top_srcdir}/lib/ns -Iinclude \
+-		${NS_INCLUDES} ${DNS_INCLUDES} ${ISC_INCLUDES} \
++CINCLUDES =	-I. -I${top_srcdir}/lib/ns-pkcs11 -Iinclude \
++		${NS_PKCS11_INCLUDES} ${DNS_PKCS11_INCLUDES} ${ISC_INCLUDES} \
+ 		@OPENSSL_INCLUDES@ @DST_GSSAPI_INC@
+ 
+ CDEFINES =	@USE_PKCS11@ -DNAMED_PLUGINDIR=\"${plugindir}\"
+@@ -32,9 +32,9 @@ ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
+ 
+ ISCDEPLIBS =	../../lib/isc/libisc.@A@
+ 
+-DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
++DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_PK11_LIBS@
+ 
+-DNSDEPLIBS =	../../lib/dns/libdns.@A@
++DNSDEPLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@
+ 
+ LIBS =		@LIBS@
+ 
+@@ -66,28 +66,28 @@ version.@O@: version.c
  		-DLIBAGE=${LIBAGE} \
  		-c ${srcdir}/version.c
  
--libisc.@SA@: ${OBJS} ${SYMTBLOBJS}
-+libisc-pkcs11.@SA@: ${OBJS} ${SYMTBLOBJS}
- 	${AR} ${ARFLAGS} $@ ${OBJS} ${SYMTBLOBJS}
- 	${RANLIB} $@
- 
--libisc-nosymtbl.@SA@: ${OBJS}
-+libisc-pkcs11-nosymtbl.@SA@: ${OBJS}
+-libns.@SA@: ${OBJS}
++libns-pkcs11.@SA@: ${OBJS}
  	${AR} ${ARFLAGS} $@ ${OBJS}
  	${RANLIB} $@
  
--libisc.la: ${OBJS} ${SYMTBLOBJS}
-+libisc-pkcs11.la: ${OBJS} ${SYMTBLOBJS}
+-libns.la: ${OBJS}
++libns-pkcs11.la: ${OBJS}
  	${LIBTOOL_MODE_LINK} \
--		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisc.la -rpath ${libdir} \
-+		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisc-pkcs11.la -rpath ${libdir} \
+-		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libns.la -rpath ${libdir} \
++		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libns-pkcs11.la -rpath ${libdir} \
  		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
- 		${OBJS} ${SYMTBLOBJS} ${LIBS}
+-		${OBJS} ${ISCLIBS} @DNS_CRYPTO_LIBS@ ${LIBS}
++		${OBJS} ${ISCLIBS} @DNS_CRYPTO_PK11_LIBS@ ${LIBS}
  
--libisc-nosymtbl.la: ${OBJS}
-+libisc-pkcs11-nosymtbl.la: ${OBJS}
- 	${LIBTOOL_MODE_LINK} \
--		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisc-nosymtbl.la -rpath ${libdir} \
-+		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisc-pkcs11-nosymtbl.la -rpath ${libdir} \
- 		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
- 		${OBJS} ${LIBS}
- 
--timestamp: libisc.@A@ libisc-nosymtbl.@A@
-+timestamp: libisc-pkcs11.@A@ libisc-pkcs11-nosymtbl.@A@
+-timestamp: libns.@A@
++timestamp: libns-pkcs11.@A@
  	touch timestamp
  
--testdirs: libisc.@A@ libisc-nosymtbl.@A@
-+testdirs: libisc-pkcs11.@A@ libisc-pkcs11-nosymtbl.@A@
- 
  installdirs:
  	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${libdir}
  
  install:: timestamp installdirs
--	${LIBTOOL_MODE_INSTALL} ${INSTALL_LIBRARY} libisc.@A@ ${DESTDIR}${libdir}
-+	${LIBTOOL_MODE_INSTALL} ${INSTALL_LIBRARY} libisc-pkcs11.@A@ ${DESTDIR}${libdir}
+-	${LIBTOOL_MODE_INSTALL} ${INSTALL_LIBRARY} libns.@A@ \
++	${LIBTOOL_MODE_INSTALL} ${INSTALL_LIBRARY} libns-pkcs11.@A@ \
+ 		${DESTDIR}${libdir}
  
  uninstall::
--	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${libdir}/libisc.@A@
-+	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${libdir}/libisc-pkcs11.@A@
+-	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${libdir}/libns.@A@
++	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${libdir}/libns-pkcs11.@A@
  
  clean distclean::
--	rm -f libisc.@A@ libisc-nosymtbl.@A@ libisc.la \
--	libisc-nosymtbl.la timestamp
-+	rm -f libisc-pkcs11.@A@ libisc-pkcs11-nosymtbl.@A@ libisc-pkcs11.la \
-+	libisc-pkcs11-nosymtbl.la timestamp
-diff --git a/lib/isc-pkcs11/tests/Makefile.in b/lib/isc-pkcs11/tests/Makefile.in
-index 5735829..7e62737 100644
---- a/lib/isc-pkcs11/tests/Makefile.in
-+++ b/lib/isc-pkcs11/tests/Makefile.in
-@@ -18,7 +18,7 @@ VERSION=@BIND9_VERSION@
- CINCLUDES =	-I. -Iinclude ${ISC_INCLUDES} @OPENSSL_INCLUDES@ @CMOCKA_CFLAGS@
- CDEFINES =	-DTESTS="\"${top_builddir}/lib/isc/tests/\""
+-	rm -f libns.@A@ timestamp
++	rm -f libns-pkcs11.@A@ timestamp
+diff --git a/lib/ns-pkcs11/tests/Makefile.in b/lib/ns-pkcs11/tests/Makefile.in
+index ffd8f41..4a6cb1b 100644
+--- a/lib/ns-pkcs11/tests/Makefile.in
++++ b/lib/ns-pkcs11/tests/Makefile.in
+@@ -15,16 +15,16 @@ VERSION=@BIND9_VERSION@
  
--ISCLIBS =	../libisc.@A@ @OPENSSL_LIBS@
-+ISCLIBS =	../libisc-pkcs11.@A@ @OPENSSL_LIBS@
- ISCDEPLIBS =	../libisc.@A@
+ @BIND9_MAKE_INCLUDES@
+ 
+-CINCLUDES =	-I. -Iinclude ${NS_INCLUDES} ${DNS_INCLUDES} ${ISC_INCLUDES} \
++CINCLUDES =	-I. -Iinclude ${NS_PKCS11_INCLUDES} ${DNS_PKCS11_INCLUDES} ${ISC_INCLUDES} \
+ 		@OPENSSL_INCLUDES@ @CMOCKA_CFLAGS@
+-CDEFINES =	-DTESTS="\"${top_builddir}/lib/ns/tests/\"" -DNAMED_PLUGINDIR=\"${plugindir}\"
++CDEFINES =	@USE_PKCS11@ -DTESTS="\"${top_builddir}/lib/ns/tests/\"" -DNAMED_PLUGINDIR=\"${plugindir}\"
+ 
+ ISCLIBS =	../../isc/libisc.@A@ @OPENSSL_LIBS@
+ ISCDEPLIBS =	../../isc/libisc.@A@
+-DNSLIBS =	../../dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
+-DNSDEPLIBS =	../../dns/libdns.@A@
+-NSLIBS =	../libns.@A@
+-NSDEPLIBS =	../libns.@A@
++DNSLIBS =	../../dns-pkcs11/libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_PK11_LIBS@
++DNSDEPLIBS =	../../dns-pkcs11/libdns-pkcs11.@A@
++NSLIBS =	../libns-pkcs11.@A@
++NSDEPLIBS =	../libns-pkcs11.@A@
  
  LIBS =		@LIBS@ @CMOCKA_LIBS@
+ 
+diff --git a/lib/ns/Makefile.in b/lib/ns/Makefile.in
+index 58d731a..a14728d 100644
+--- a/lib/ns/Makefile.in
++++ b/lib/ns/Makefile.in
+@@ -24,7 +24,7 @@ CINCLUDES =	-I. -I${top_srcdir}/lib/ns -Iinclude \
+ 		${NS_INCLUDES} ${DNS_INCLUDES} ${ISC_INCLUDES} \
+ 		@OPENSSL_INCLUDES@ @DST_GSSAPI_INC@
+ 
+-CDEFINES =	@USE_PKCS11@ -DNAMED_PLUGINDIR=\"${plugindir}\"
++CDEFINES =	-DNAMED_PLUGINDIR=\"${plugindir}\"
+ 
+ CWARNINGS =
+ 
 diff --git a/make/includes.in b/make/includes.in
-index 48cdaf7..6e6572b 100644
+index 48cdaf7..7b17738 100644
 --- a/make/includes.in
 +++ b/make/includes.in
-@@ -39,3 +39,16 @@ BIND9_INCLUDES = @BIND9_BIND9_BUILDINCLUDE@ \
+@@ -39,3 +39,10 @@ BIND9_INCLUDES = @BIND9_BIND9_BUILDINCLUDE@ \
  
  TEST_INCLUDES = \
  	-I${top_srcdir}/lib/tests/include
 +
-+ISC_PKCS11_INCLUDES = @BIND9_ISC_PKCS11_BUILDINCLUDE@ \
-+	-I${top_srcdir}/lib/isc-pkcs11 \
-+	-I${top_srcdir}/lib/isc-pkcs11/include \
-+	-I${top_srcdir}/lib/isc-pkcs11/unix/include \
-+	-I${top_srcdir}/lib/isc-pkcs11/pthreads/include
-+
 +DNS_PKCS11_INCLUDES = @BIND9_DNS_PKCS11_BUILDINCLUDE@ \
 +	-I${top_srcdir}/lib/dns-pkcs11/include
 +
diff --git a/bind-9.11-kyua-pkcs11.patch b/bind-9.11-kyua-pkcs11.patch
index 95e9843..ea9a51a 100644
--- a/bind-9.11-kyua-pkcs11.patch
+++ b/bind-9.11-kyua-pkcs11.patch
@@ -1,4 +1,4 @@
-From f0ce2b4855b70f1fb04394b35626c37ebb0a8c75 Mon Sep 17 00:00:00 2001
+From 1241f2005d08673c28a595c5a6cd61350b95a929 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Tue, 2 Jan 2018 18:13:07 +0100
 Subject: [PATCH] Fix pkcs11 variants atf tests
@@ -7,18 +7,16 @@ Add dns-pkcs11 tests Makefile to configure
 
 Add pkcs11 Kyuafile, fix dh_test to pass in pkcs11 mode
 ---
- configure.ac                     |  1 +
- lib/Kyuafile                     |  2 ++
- lib/dns-pkcs11/tests/Makefile.in | 12 ++++++------
- lib/dns-pkcs11/tests/dh_test.c   |  3 ++-
- lib/isc-pkcs11/tests/Makefile.in |  6 +++---
- 5 files changed, 14 insertions(+), 10 deletions(-)
+ configure.ac                   | 1 +
+ lib/Kyuafile                   | 2 ++
+ lib/dns-pkcs11/tests/dh_test.c | 3 ++-
+ 3 files changed, 5 insertions(+), 1 deletion(-)
 
 diff --git a/configure.ac b/configure.ac
-index 3dff344..424a542 100644
+index d80ae31..0fb9328 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -3113,6 +3113,7 @@ AC_CONFIG_FILES([
+@@ -3090,6 +3090,7 @@ AC_CONFIG_FILES([
  	lib/dns-pkcs11/include/Makefile
  	lib/dns-pkcs11/include/dns/Makefile
  	lib/dns-pkcs11/include/dst/Makefile
@@ -27,7 +25,7 @@ index 3dff344..424a542 100644
  	lib/irs/include/Makefile
  	lib/irs/include/irs/Makefile
 diff --git a/lib/Kyuafile b/lib/Kyuafile
-index 39ce986..dcfb139 100644
+index 39ce986..037e5ef 100644
 --- a/lib/Kyuafile
 +++ b/lib/Kyuafile
 @@ -2,8 +2,10 @@ syntax(2)
@@ -37,40 +35,15 @@ index 39ce986..dcfb139 100644
 +include('dns-pkcs11/Kyuafile')
  include('irs/Kyuafile')
  include('isc/Kyuafile')
-+include('isc-pkcs11/Kyuafile')
  include('isccc/Kyuafile')
  include('isccfg/Kyuafile')
  include('ns/Kyuafile')
-diff --git a/lib/dns-pkcs11/tests/Makefile.in b/lib/dns-pkcs11/tests/Makefile.in
-index eb297c9..144d6b2 100644
---- a/lib/dns-pkcs11/tests/Makefile.in
-+++ b/lib/dns-pkcs11/tests/Makefile.in
-@@ -15,14 +15,14 @@ VERSION=@BIND9_VERSION@
- 
- @BIND9_MAKE_INCLUDES@
- 
--CINCLUDES =	-I. -Iinclude ${DNS_INCLUDES} ${ISC_INCLUDES} \
-+CINCLUDES =	-I. -Iinclude ${DNS_PKCS11_INCLUDES} ${ISC_PKCS11_INCLUDES} \
- 		@OPENSSL_INCLUDES@ @CMOCKA_CFLAGS@
--CDEFINES =	-DTESTS="\"${top_builddir}/lib/dns/tests/\""
-+CDEFINES =	-DTESTS="\"${top_builddir}/lib/dns-pkcs11/tests/\""
- 
--ISCLIBS =	../../isc/libisc.@A@ @OPENSSL_LIBS@
--ISCDEPLIBS =	../../isc/libisc.@A@
--DNSLIBS =	../libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
--DNSDEPLIBS =	../libdns.@A@
-+ISCLIBS =	../../isc-pkcs11/libisc-pkcs11.@A@
-+ISCDEPLIBS =	../../isc-pkcs11/libisc-pkcs11.@A@
-+DNSLIBS =	../libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
-+DNSDEPLIBS =	../libdns-pkcs11.@A@
- 
- LIBS =		@LIBS@ @CMOCKA_LIBS@
- 
++include('ns-pkcs11/Kyuafile')
 diff --git a/lib/dns-pkcs11/tests/dh_test.c b/lib/dns-pkcs11/tests/dh_test.c
-index d83d9f5..d5bda29 100644
+index 934e8fd..658d1af 100644
 --- a/lib/dns-pkcs11/tests/dh_test.c
 +++ b/lib/dns-pkcs11/tests/dh_test.c
-@@ -85,7 +85,8 @@ dh_computesecret(void **state) {
+@@ -87,7 +87,8 @@ dh_computesecret(void **state) {
  	result = dst_key_computesecret(key, key, &buf);
  	assert_int_equal(result, DST_R_NOTPRIVATEKEY);
  	result = key->func->computesecret(key, key, &buf);
@@ -80,25 +53,6 @@ index d83d9f5..d5bda29 100644
  
  	dst_key_free(&key);
  }
-diff --git a/lib/isc-pkcs11/tests/Makefile.in b/lib/isc-pkcs11/tests/Makefile.in
-index 7e62737..e91cd67 100644
---- a/lib/isc-pkcs11/tests/Makefile.in
-+++ b/lib/isc-pkcs11/tests/Makefile.in
-@@ -15,11 +15,11 @@ VERSION=@BIND9_VERSION@
- 
- @BIND9_MAKE_INCLUDES@
- 
--CINCLUDES =	-I. -Iinclude ${ISC_INCLUDES} @OPENSSL_INCLUDES@ @CMOCKA_CFLAGS@
--CDEFINES =	-DTESTS="\"${top_builddir}/lib/isc/tests/\""
-+CINCLUDES =	-I. -Iinclude ${ISC_PKCS11_INCLUDES} @OPENSSL_INCLUDES@ @CMOCKA_CFLAGS@
-+CDEFINES =	-DTESTS="\"${top_builddir}/lib/isc-pkcs11/tests/\""
- 
- ISCLIBS =	../libisc-pkcs11.@A@ @OPENSSL_LIBS@
--ISCDEPLIBS =	../libisc.@A@
-+ISCDEPLIBS =	../libisc-pkcs11.@A@
- 
- LIBS =		@LIBS@ @CMOCKA_LIBS@
- 
 -- 
 2.20.1
 
diff --git a/bind-9.14-config-pkcs11.patch b/bind-9.14-config-pkcs11.patch
index 4559fe5..cf73a1c 100644
--- a/bind-9.14-config-pkcs11.patch
+++ b/bind-9.14-config-pkcs11.patch
@@ -1,4 +1,4 @@
-From 0427e970f0294cadf4dff04021f41e751c713e3c Mon Sep 17 00:00:00 2001
+From 233d3784d04bee37b772f391da8726f0cd7b223e Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Fri, 18 Oct 2019 21:30:52 +0200
 Subject: [PATCH] Move USE_PKCS11 and USE_OPENSSL out of config.h
@@ -7,14 +7,15 @@ Building two variants with the same common code requires to unset
 USE_PKCS11 on part of build. That is not possible with config.h value.
 Move it as normal define to CDEFINES.
 ---
- bin/confgen/Makefile.in | 2 +-
- bin/dig/Makefile.in     | 2 +-
- bin/dnssec/Makefile.in  | 2 +-
- bin/named/Makefile.in   | 2 +-
- configure.ac            | 8 ++++++--
- lib/dns/Makefile.in     | 2 +-
- lib/ns/Makefile.in      | 2 +-
- 7 files changed, 12 insertions(+), 8 deletions(-)
+ bin/confgen/Makefile.in |  2 +-
+ bin/dig/Makefile.in     |  2 +-
+ bin/dnssec/Makefile.in  |  2 +-
+ bin/named/Makefile.in   |  2 +-
+ configure.ac            |  8 ++++++--
+ lib/dns/Makefile.in     |  2 +-
+ lib/dns/dst_internal.h  | 12 +++++++++---
+ lib/ns/Makefile.in      |  2 +-
+ 8 files changed, 21 insertions(+), 11 deletions(-)
 
 diff --git a/bin/confgen/Makefile.in b/bin/confgen/Makefile.in
 index dc3a7f6..1e0fe0e 100644
@@ -69,20 +70,20 @@ index eecfa76..e5b0d4b 100644
  CWARNINGS =
  
 diff --git a/configure.ac b/configure.ac
-index da6de97..6d4cdcc 100644
+index 80039b7..6cce3bb 100644
 --- a/configure.ac
 +++ b/configure.ac
 @@ -963,9 +963,13 @@ AS_CASE([$enable_native_pkcs11],
  AC_SUBST([PKCS11_TEST])
  AC_SUBST([PKCS11_TOOLS])
  
-+USE_PKCS11=
-+USE_OPENSSL=
++USE_PKCS11='-DUSE_PKCS11=0'
++USE_OPENSSL='-DUSE_OPENSSL=0'
  AS_CASE([$CRYPTO],
 -	[pkcs11],[AC_DEFINE([USE_PKCS11], [1], [define if PKCS11 is used for Public-Key Cryptography])],
 -	[AC_DEFINE([USE_OPENSSL], [1], [define if OpenSSL is used for Public-Key Cryptography])])
-+	[pkcs11],[USE_PKCS11='-DUSE_PKCS11'],
-+	[USE_OPENSSL='-DUSE_OPENSSL'])
++	[pkcs11],[USE_PKCS11='-DUSE_PKCS11=1'],
++	[USE_OPENSSL='-DUSE_OPENSSL=1'])
 +AC_SUBST(USE_PKCS11)
 +AC_SUBST(USE_OPENSSL)
  
@@ -101,6 +102,38 @@ index 60c87a8..9125b10 100644
  
  CWARNINGS =
  
+diff --git a/lib/dns/dst_internal.h b/lib/dns/dst_internal.h
+index bfa28f0..d3ff613 100644
+--- a/lib/dns/dst_internal.h
++++ b/lib/dns/dst_internal.h
+@@ -40,6 +40,13 @@
+ #include <isc/stdtime.h>
+ #include <isc/hmac.h>
+ 
++#ifndef USE_OPENSSL
++#define USE_OPENSSL 1
++#endif
++#ifndef USE_PKCS11
++#define USE_PKCS11 0
++#endif
++
+ #if USE_PKCS11
+ #include <pk11/pk11.h>
+ #include <pk11/site.h>
+@@ -99,11 +106,10 @@ struct dst_key {
+ 		void *generic;
+ 		gss_ctx_id_t gssctx;
+ 		DH *dh;
+-#if USE_OPENSSL
+-		EVP_PKEY *pkey;
+-#endif
+ #if USE_PKCS11
+ 		pk11_object_t *pkey;
++#else
++		EVP_PKEY *pkey;
+ #endif
+ 		dst_hmac_key_t *hmac_key;
+ 	} keydata;			/*%< pointer to key in crypto pkg fmt */
 diff --git a/lib/ns/Makefile.in b/lib/ns/Makefile.in
 index a14728d..58d731a 100644
 --- a/lib/ns/Makefile.in
diff --git a/bind-9.14-disable-isc-pkcs11.patch b/bind-9.14-disable-isc-pkcs11.patch
deleted file mode 100644
index b8ee475..0000000
--- a/bind-9.14-disable-isc-pkcs11.patch
+++ /dev/null
@@ -1,180 +0,0 @@
-From f354e06035a6661b29f665890933c9d0108cd3e5 Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Fri, 18 Oct 2019 21:55:19 +0200
-Subject: [PATCH] Do not define ISC_PKCS11_INCLUDES
-
-isc library is no longer different. Just dns library is different.
-Do not try to use isc-pkcs11 library for no reason.
----
- bin/dnssec-pkcs11/Makefile.in    |  8 ++++----
- bin/named-pkcs11/Makefile.in     | 10 +++++-----
- bin/pkcs11/Makefile.in           |  6 +++---
- configure.ac                     | 15 ---------------
- lib/Makefile.in                  |  2 +-
- lib/dns-pkcs11/tests/Makefile.in |  4 ++--
- make/includes.in                 |  6 ------
- 7 files changed, 15 insertions(+), 36 deletions(-)
-
-diff --git a/bin/dnssec-pkcs11/Makefile.in b/bin/dnssec-pkcs11/Makefile.in
-index 5067ee1..54b9f10 100644
---- a/bin/dnssec-pkcs11/Makefile.in
-+++ b/bin/dnssec-pkcs11/Makefile.in
-@@ -15,17 +15,17 @@ VERSION=@BIND9_VERSION@
- 
- @BIND9_MAKE_INCLUDES@
- 
--CINCLUDES =	${DNS_PKCS11_INCLUDES} ${ISC_PKCS11_INCLUDES} @OPENSSL_INCLUDES@
-+CINCLUDES =	${DNS_PKCS11_INCLUDES} ${ISC_INCLUDES} @OPENSSL_INCLUDES@
- 
- CDEFINES =	-DVERSION=\"${VERSION}\"
- CWARNINGS =
- 
- DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
--ISCLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@ @OPENSSL_LIBS@
--ISCNOSYMLIBS =	../../lib/isc-pkcs11/libisc-pkcs11-nosymtbl.@A@ @OPENSSL_LIBS@
-+ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
-+ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @OPENSSL_LIBS@
- 
- DNSDEPLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@
--ISCDEPLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
-+ISCDEPLIBS =	../../lib/isc/libisc.@A@
- 
- DEPLIBS =	${DNSDEPLIBS} ${ISCDEPLIBS}
- 
-diff --git a/bin/named-pkcs11/Makefile.in b/bin/named-pkcs11/Makefile.in
-index 416e12e..a0e8314 100644
---- a/bin/named-pkcs11/Makefile.in
-+++ b/bin/named-pkcs11/Makefile.in
-@@ -43,9 +43,9 @@ DLZDRIVER_INCLUDES =	@DLZ_DRIVER_INCLUDES@
- DLZDRIVER_LIBS =	@DLZ_DRIVER_LIBS@
- 
- CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
--		${NS_INCLUDES} ${DNS_PKCS11_INCLUDES} \
-+		${NS_PKCS11_INCLUDES} ${DNS_PKCS11_INCLUDES} \
- 		${BIND9_INCLUDES} ${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} \
--		${ISC_PKCS11_INCLUDES} ${DLZDRIVER_INCLUDES} \
-+		${ISC_INCLUDES} ${DLZDRIVER_INCLUDES} \
- 		${DBDRIVER_INCLUDES} ${MAXMINDDB_CFLAGS} \
- 		@OPENSSL_INCLUDES@
- 
-@@ -56,15 +56,15 @@ CWARNINGS =
- DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
- ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
- ISCCCLIBS =	../../lib/isccc/libisccc.@A@
--ISCLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@ @OPENSSL_LIBS@
--ISCNOSYMLIBS =	../../lib/isc-pkcs11/libisc-pkcs11-nosymtbl.@A@ @OPENSSL_LIBS@
-+ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
-+ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @OPENSSL_LIBS@
- BIND9LIBS =	../../lib/bind9/libbind9.@A@
- NSLIBS =	../../lib/ns/libns.@A@
- 
- DNSDEPLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@
- ISCCFGDEPLIBS =	../../lib/isccfg/libisccfg.@A@
- ISCCCDEPLIBS =	../../lib/isccc/libisccc.@A@
--ISCDEPLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
-+ISCDEPLIBS =	../../lib/isc/libisc.@A@
- BIND9DEPLIBS =	../../lib/bind9/libbind9.@A@
- NSDEPLIBS =	../../lib/ns/libns.@A@
- 
-diff --git a/bin/pkcs11/Makefile.in b/bin/pkcs11/Makefile.in
-index 0e542f3..96aec05 100644
---- a/bin/pkcs11/Makefile.in
-+++ b/bin/pkcs11/Makefile.in
-@@ -13,13 +13,13 @@ top_srcdir =	@top_srcdir@
- 
- @BIND9_MAKE_INCLUDES@
- 
--CINCLUDES =	${ISC_PKCS11_INCLUDES}
-+CINCLUDES =	${ISC_INCLUDES}
- 
- CDEFINES =
- 
--ISCLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@ @OPENSSL_LIBS@
-+ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
- 
--ISCDEPLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
-+ISCDEPLIBS =	../../lib/isc/libisc.@A@
- 
- DEPLIBS =	${ISCDEPLIBS}
- 
-diff --git a/configure.ac b/configure.ac
-index 6d4cdcc..39c1d95 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -2535,7 +2535,6 @@ if test "X$srcdir" != "X"; then
- 	BIND9_NS_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/ns/include"
- 	BIND9_BIND9_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/bind9/include"
- 	BIND9_IRS_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/irs/include"
--	BIND9_ISC_PKCS11_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/isc-pkcs11/include"
- 	BIND9_DNS_PKCS11_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/dns-pkcs11/include"
- 	BIND9_NS_PKCS11_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/ns-pkcs11/include"
- else
-@@ -3114,20 +3113,6 @@ AC_CONFIG_FILES([
- 	lib/isc/unix/include/Makefile
- 	lib/isc/unix/include/isc/Makefile
- 	lib/isc/unix/include/pkcs11/Makefile
--	lib/isc-pkcs11/pthreads/Makefile
--	lib/isc-pkcs11/pthreads/include/Makefile
--	lib/isc-pkcs11/pthreads/include/isc/Makefile
--	lib/isc-pkcs11/Makefile
--	lib/isc-pkcs11/include/Makefile
--	lib/isc-pkcs11/include/isc/Makefile
--	lib/isc-pkcs11/include/isc/platform.h
--	lib/isc-pkcs11/include/pk11/Makefile
--	lib/isc-pkcs11/include/pkcs11/Makefile
--	lib/isc-pkcs11/tests/Makefile
--	lib/isc-pkcs11/unix/Makefile
--	lib/isc-pkcs11/unix/include/Makefile
--	lib/isc-pkcs11/unix/include/isc/Makefile
--	lib/isc-pkcs11/unix/include/pkcs11/Makefile
- 	lib/isccc/Makefile
- 	lib/isccc/include/Makefile
- 	lib/isccc/include/isccc/Makefile
-diff --git a/lib/Makefile.in b/lib/Makefile.in
-index 439d748..3f655e8 100644
---- a/lib/Makefile.in
-+++ b/lib/Makefile.in
-@@ -15,7 +15,7 @@ top_srcdir =	@top_srcdir@
- # Attempt to disable parallel processing.
- .NOTPARALLEL:
- .NO_PARALLEL:
--SUBDIRS =	isc isc-pkcs11 isccc dns dns-pkcs11 ns isccfg bind9 irs samples
-+SUBDIRS =	isc isccc dns dns-pkcs11 ns isccfg bind9 irs samples
- TARGETS =
- 
- @BIND9_MAKE_RULES@
-diff --git a/lib/dns-pkcs11/tests/Makefile.in b/lib/dns-pkcs11/tests/Makefile.in
-index 9f78596..ac187c9 100644
---- a/lib/dns-pkcs11/tests/Makefile.in
-+++ b/lib/dns-pkcs11/tests/Makefile.in
-@@ -19,8 +19,8 @@ CINCLUDES =	-I. -Iinclude ${DNS_PKCS11_INCLUDES} ${ISC_PKCS11_INCLUDES} \
- 		@OPENSSL_INCLUDES@ @CMOCKA_CFLAGS@
- CDEFINES =	-DTESTS="\"${top_builddir}/lib/dns-pkcs11/tests/\""
- 
--ISCLIBS =	../../isc-pkcs11/libisc-pkcs11.@A@
--ISCDEPLIBS =	../../isc-pkcs11/libisc-pkcs11.@A@
-+ISCLIBS =	../../isc/libisc.@A@
-+ISCDEPLIBS =	../../isc/libisc.@A@
- DNSLIBS =	../libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
- DNSDEPLIBS =	../libdns-pkcs11.@A@
- 
-diff --git a/make/includes.in b/make/includes.in
-index 6e6572b..7b17738 100644
---- a/make/includes.in
-+++ b/make/includes.in
-@@ -40,12 +40,6 @@ BIND9_INCLUDES = @BIND9_BIND9_BUILDINCLUDE@ \
- TEST_INCLUDES = \
- 	-I${top_srcdir}/lib/tests/include
- 
--ISC_PKCS11_INCLUDES = @BIND9_ISC_PKCS11_BUILDINCLUDE@ \
--	-I${top_srcdir}/lib/isc-pkcs11 \
--	-I${top_srcdir}/lib/isc-pkcs11/include \
--	-I${top_srcdir}/lib/isc-pkcs11/unix/include \
--	-I${top_srcdir}/lib/isc-pkcs11/pthreads/include
--
- DNS_PKCS11_INCLUDES = @BIND9_DNS_PKCS11_BUILDINCLUDE@ \
- 	-I${top_srcdir}/lib/dns-pkcs11/include
- 
--- 
-2.20.1
-
diff --git a/bind.spec b/bind.spec
index df6cc92..538202b 100644
--- a/bind.spec
+++ b/bind.spec
@@ -131,8 +131,6 @@ Patch135:bind-9.14-config-pkcs11.patch
 # Fedora specific patch to distribute native-pkcs#11 functionality
 Patch136:bind-9.10-dist-native-pkcs11.patch
 # Do not use isc-pkcs11.
-# FIXME: should be part of Patch136
-Patch138:bind-9.14-disable-isc-pkcs11.patch
 Patch149:bind-9.11-kyua-pkcs11.patch
 
 # [ISC-Bugs #42525] non-portable use of strlcat in contrib/sdb/ldap/zone2ldap.c
@@ -588,10 +586,9 @@ are used for building ISC DHCP.
 %patch135 -p1 -b .config-pkcs11
 cp -r bin/named{,-pkcs11}
 cp -r bin/dnssec{,-pkcs11}
-cp -r lib/isc{,-pkcs11}
 cp -r lib/dns{,-pkcs11}
+cp -r lib/ns{,-pkcs11}
 %patch136 -p1 -b .dist_pkcs11
-%patch138 -p1 -b .no-isc-pkcs11
 %patch149 -p1 -b .kyua-pkcs11
 %patch150 -p1 -b .engine-pkcs11
 %endif

From b626a2bfa5066c4fcc35676657b454539b06b199 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 26 Mar 2020 21:46:02 +0100
Subject: [PATCH 121/460] Compilable 9.16.1 package

Updated from 9.14 to 9.16.1.
Disabled SIGCHASE, since it no longer exists.
Disabled PKCS11 native build for now
Disabled EXPORT_LIBS

No longer ships isc-config.sh, missing it.
---
 .gitignore                           |  2 +
 bind-9.11-feature-test-named.patch   | 16 +++---
 bind-9.11-fips-tests.patch           | 46 ++++++++--------
 bind-9.11-pk11.patch                 | 13 -----
 bind-9.11-rh1410433.patch            | 15 +++---
 bind-9.11-rh1666814.patch            | 29 +++++-----
 bind-9.11-unit-disable-random.patch  | 29 ----------
 bind-9.9.1-P2-multlib-conflict.patch | 41 --------------
 bind.spec                            | 55 +++++++++----------
 bind93-rh490837.patch                | 80 +++++++---------------------
 bind97-rh645544.patch                | 20 +++----
 sources                              |  3 +-
 12 files changed, 109 insertions(+), 240 deletions(-)
 delete mode 100644 bind-9.11-pk11.patch
 delete mode 100644 bind-9.11-unit-disable-random.patch
 delete mode 100644 bind-9.9.1-P2-multlib-conflict.patch

diff --git a/.gitignore b/.gitignore
index 2084547..6cad3d9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -103,3 +103,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.11.13.tar.gz.asc
 /bind-9.11.14.tar.gz
 /bind-9.11.14.tar.gz.asc
+/bind-9.16.1.tar.xz
+/bind-9.16.1.tar.xz.asc
\ No newline at end of file
diff --git a/bind-9.11-feature-test-named.patch b/bind-9.11-feature-test-named.patch
index 61c31ea..1c1e63d 100644
--- a/bind-9.11-feature-test-named.patch
+++ b/bind-9.11-feature-test-named.patch
@@ -1,4 +1,4 @@
-From 36e3d1b08f697190b259a8421472ec16b52315b5 Mon Sep 17 00:00:00 2001
+From df27b2a23a195f844687c424a9117d4da14bc6dd Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Wed, 30 Jan 2019 14:37:17 +0100
 Subject: [PATCH] Create feature-test in source directory
@@ -12,19 +12,19 @@ compile feature-test for each of them this way.
  2 files changed, 11 insertions(+), 2 deletions(-)
 
 diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
-index 4e8006d..eecfa76 100644
+index dd25774..cb187e5 100644
 --- a/bin/named/Makefile.in
 +++ b/bin/named/Makefile.in
-@@ -83,7 +83,7 @@ NOSYMLIBS =	${NSLIBS} ${DNSLIBS} ${BIND9LIBS} \
+@@ -87,7 +87,7 @@ NOSYMLIBS =	${NSLIBS} ${DNSLIBS} ${BIND9LIBS} \
  
  SUBDIRS =	unix
  
 -TARGETS =	named@EXEEXT@
 +TARGETS =	named@EXEEXT@ feature-test@EXEEXT@
  
- GEOIPLINKOBJS = geoip.@O@
  GEOIP2LINKOBJS = geoip.@O@
-@@ -154,6 +154,15 @@ named@EXEEXT@: ${OBJS} ${DEPLIBS}
+ 
+@@ -156,6 +156,15 @@ named@EXEEXT@: ${OBJS} ${DEPLIBS}
  	export BASEOBJS="${OBJS} ${UOBJS}"; \
  	${FINALBUILDCMD}
  
@@ -41,10 +41,10 @@ index 4e8006d..eecfa76 100644
  
  docclean manclean maintainer-clean::
 diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
-index c713d96..20366e5 100644
+index 0d83fdf..be4123b 100644
 --- a/bin/tests/system/conf.sh.in
 +++ b/bin/tests/system/conf.sh.in
-@@ -34,7 +34,7 @@ DELV=$TOP/bin/delv/delv
+@@ -37,7 +37,7 @@ DELV=$TOP/bin/delv/delv
  DIG=$TOP/bin/dig/dig
  DNSTAPREAD=$TOP/bin/tools/dnstap-read
  DSFROMKEY=$TOP/bin/dnssec/dnssec-dsfromkey
@@ -54,5 +54,5 @@ index c713d96..20366e5 100644
  IMPORTKEY=$TOP/bin/dnssec/dnssec-importkey
  JOURNALPRINT=$TOP/bin/tools/named-journalprint
 -- 
-2.20.1
+2.21.1
 
diff --git a/bind-9.11-fips-tests.patch b/bind-9.11-fips-tests.patch
index f11fc5b..9f25c90 100644
--- a/bind-9.11-fips-tests.patch
+++ b/bind-9.11-fips-tests.patch
@@ -1,4 +1,4 @@
-From 11d42f5d851881fd559a716df78a18dba1d6975d Mon Sep 17 00:00:00 2001
+From 3f9d05b72f725defd1452fd3d4b8ef3192e96c0b Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 2 Aug 2018 23:46:45 +0200
 Subject: [PATCH] FIPS tests changes
@@ -549,10 +549,10 @@ index 21be03e..e57c308 100644
  };
  
 diff --git a/bin/tests/system/checkconf/good.conf b/bin/tests/system/checkconf/good.conf
-index d627d2a..9d0322a 100644
+index 2eb2850..9e6913d 100644
 --- a/bin/tests/system/checkconf/good.conf
 +++ b/bin/tests/system/checkconf/good.conf
-@@ -157,6 +157,6 @@ dyndb "name" "library.so" {
+@@ -197,6 +197,6 @@ dyndb "name" "library.so" {
  	system;
  };
  key "mykey" {
@@ -561,19 +561,19 @@ index d627d2a..9d0322a 100644
  	secret "qwertyuiopasdfgh";
  };
 diff --git a/bin/tests/system/feature-test.c b/bin/tests/system/feature-test.c
-index ff92ad2..746e022 100644
+index 204d612..684fab6 100644
 --- a/bin/tests/system/feature-test.c
 +++ b/bin/tests/system/feature-test.c
-@@ -19,6 +19,7 @@
+@@ -14,6 +14,7 @@
+ #include <string.h>
+ #include <unistd.h>
+ 
++#include <isc/md.h>
+ #include <isc/net.h>
  #include <isc/print.h>
  #include <isc/util.h>
- #include <isc/net.h>
-+#include <isc/md.h>
- #include <dns/edns.h>
- 
- #ifdef WIN32
-@@ -168,6 +169,19 @@ main(int argc, char **argv) {
- #endif
+@@ -158,6 +159,19 @@ main(int argc, char **argv) {
+ #endif /* ifdef DLZ_FILESYSTEM */
  	}
  
 +	if (strcmp(argv[1], "--md5") == 0) {
@@ -618,7 +618,7 @@ index 2976bfc..256d846 100644
  };
  
 diff --git a/bin/tests/system/notify/tests.sh b/bin/tests/system/notify/tests.sh
-index fb2eb74..0e45424 100644
+index d54ab0d..ba38177 100644
 --- a/bin/tests/system/notify/tests.sh
 +++ b/bin/tests/system/notify/tests.sh
 @@ -212,16 +212,16 @@ ret=0
@@ -685,10 +685,10 @@ index 5d70114..6c4b55a 100644
  $DDNSCONFGEN -q -a hmac-sha224 -k sha224-key -z keytests.nil > ns1/sha224.key
  $DDNSCONFGEN -q -a hmac-sha256 -k sha256-key -z keytests.nil > ns1/sha256.key
 diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh
-index b73d178..f573905 100755
+index 72a282a..5d42e04 100755
 --- a/bin/tests/system/nsupdate/tests.sh
 +++ b/bin/tests/system/nsupdate/tests.sh
-@@ -708,7 +708,14 @@ fi
+@@ -715,7 +715,14 @@ fi
  n=`expr $n + 1`
  ret=0
  echo_i "check TSIG key algorithms ($n)"
@@ -704,7 +704,7 @@ index b73d178..f573905 100755
      $NSUPDATE -k ns1/${alg}.key <<END > /dev/null || ret=1
  server 10.53.0.1 ${PORT}
  update add ${alg}.keytests.nil. 600 A 10.10.10.3
-@@ -716,7 +723,7 @@ send
+@@ -723,7 +730,7 @@ send
  END
  done
  sleep 2
@@ -714,10 +714,10 @@ index b73d178..f573905 100755
  done
  if [ $ret -ne 0 ]; then
 diff --git a/bin/tests/system/rndc/setup.sh b/bin/tests/system/rndc/setup.sh
-index cb64dd9..c9b2447 100644
+index 6b539d1..4d7eaa2 100644
 --- a/bin/tests/system/rndc/setup.sh
 +++ b/bin/tests/system/rndc/setup.sh
-@@ -35,7 +35,7 @@ make_key () {
+@@ -33,7 +33,7 @@ make_key () {
              sed 's/allow { 10.53.0.4/allow { any/' >> ns4/named.conf
  }
  
@@ -727,10 +727,10 @@ index cb64dd9..c9b2447 100644
  make_key 3 ${EXTRAPORT3} hmac-sha224
  make_key 4 ${EXTRAPORT4} hmac-sha256
 diff --git a/bin/tests/system/rndc/tests.sh b/bin/tests/system/rndc/tests.sh
-index 7cbe2c7..b8cc6a0 100644
+index 2af855a..36cd1aa 100644
 --- a/bin/tests/system/rndc/tests.sh
 +++ b/bin/tests/system/rndc/tests.sh
-@@ -356,15 +356,20 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
+@@ -348,15 +348,20 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
  status=`expr $status + $ret`
  
  n=`expr $n + 1`
@@ -907,10 +907,10 @@ index ea42b4d..08676da 100644
  };
  
 diff --git a/bin/tests/system/upforwd/tests.sh b/bin/tests/system/upforwd/tests.sh
-index b0694bb..9adae82 100644
+index 3b0d7b3..cc1ae3e 100644
 --- a/bin/tests/system/upforwd/tests.sh
 +++ b/bin/tests/system/upforwd/tests.sh
-@@ -68,7 +68,7 @@ if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
+@@ -66,7 +66,7 @@ if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
  
  echo_i "updating zone (signed) ($n)"
  ret=0
@@ -920,5 +920,5 @@ index b0694bb..9adae82 100644
  update add updated.example. 600 A 10.10.10.1
  update add updated.example. 600 TXT Foo
 -- 
-2.20.1
+2.21.1
 
diff --git a/bind-9.11-pk11.patch b/bind-9.11-pk11.patch
deleted file mode 100644
index fd75a6c..0000000
--- a/bind-9.11-pk11.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/lib/isc/include/pk11/internal.h b/lib/isc/include/pk11/internal.h
-index aa8907a..603712a 100644
---- a/lib/isc/include/pk11/internal.h
-+++ b/lib/isc/include/pk11/internal.h
-@@ -13,6 +13,8 @@
- #ifndef PK11_INTERNAL_H
- #define PK11_INTERNAL_H 1
- 
-+#include <pk11/pk11.h>
-+
- /*! \file pk11/internal.h */
- 
- ISC_LANG_BEGINDECLS
diff --git a/bind-9.11-rh1410433.patch b/bind-9.11-rh1410433.patch
index d307620..10f1dd2 100644
--- a/bind-9.11-rh1410433.patch
+++ b/bind-9.11-rh1410433.patch
@@ -1,16 +1,13 @@
 diff --git a/lib/dns/dyndb.c b/lib/dns/dyndb.c
-index 15561ce..e4449b0 100644
+index fdc8ea5..d638777 100644
 --- a/lib/dns/dyndb.c
 +++ b/lib/dns/dyndb.c
-@@ -133,8 +133,11 @@ load_library(isc_mem_t *mctx, const char *filename, const char *instname,
+@@ -131,7 +131,7 @@ load_library(isc_mem_t *mctx, const char *filename, const char *instname,
  		      instname, filename);
  
- 	flags = RTLD_NOW|RTLD_LOCAL;
-+#if 0
-+	/* Shared global namespace is required for dns-pkcs11 library */
- #if defined(RTLD_DEEPBIND) && !__SANITIZE_ADDRESS__
+ 	flags = RTLD_NOW | RTLD_LOCAL;
+-#if defined(RTLD_DEEPBIND) && !__SANITIZE_ADDRESS__
++#if 0 && defined(RTLD_DEEPBIND) && !__SANITIZE_ADDRESS__
  	flags |= RTLD_DEEPBIND;
-+#endif
- #endif
+ #endif /* if defined(RTLD_DEEPBIND) && !__SANITIZE_ADDRESS__ */
  
- 	handle = dlopen(filename, flags);
diff --git a/bind-9.11-rh1666814.patch b/bind-9.11-rh1666814.patch
index ea1df5d..e66a5ab 100644
--- a/bind-9.11-rh1666814.patch
+++ b/bind-9.11-rh1666814.patch
@@ -1,37 +1,38 @@
-From 3bb29f45604ac6890f4ea5cdcbd1a62e6dad14a7 Mon Sep 17 00:00:00 2001
+From a1a4730c1f02cd85680cf7608ac81e0db59ee522 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Wed, 16 Jan 2019 16:27:33 +0100
-Subject: [PATCH 2/2] Fix possible crash when loading corrupted file
+Subject: [PATCH] Fix possible crash when loading corrupted file
 
 Some values passes internal triggers by coincidence. Fix the check and
 check also first_node_offset before even passing it further.
 ---
- lib/dns/rbt.c | 5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
+ lib/dns/rbt.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
 
 diff --git a/lib/dns/rbt.c b/lib/dns/rbt.c
-index 62d0826..b029b7d 100644
+index ef6441b..404fd6d 100644
 --- a/lib/dns/rbt.c
 +++ b/lib/dns/rbt.c
-@@ -787,7 +787,7 @@ treefix(dns_rbt_t *rbt, void *base, size_t filesize, dns_rbtnode_t *n,
- 		return (ISC_R_SUCCESS);
+@@ -754,7 +754,7 @@ treefix(dns_rbt_t *rbt, void *base, size_t filesize, dns_rbtnode_t *n,
+ 	}
  
- 	CONFIRM((void *) n >= base);
--	CONFIRM((char *) n - (char *) base <= (int) nodemax);
-+	CONFIRM((size_t)((char *) n - (char *) base) <= nodemax);
+ 	CONFIRM((void *)n >= base);
+-	CONFIRM((char *)n - (char *)base <= (int)nodemax);
++	CONFIRM((size_t)((char *)n - (char *)base) <= (int)nodemax);
  	CONFIRM(DNS_RBTNODE_VALID(n));
  
  	dns_name_init(&nodename, NULL);
-@@ -939,7 +939,8 @@ dns_rbt_deserialize_tree(void *base_address, size_t filesize,
- 	rbt->root = (dns_rbtnode_t *)((char *)base_address +
- 				header_offset + header->first_node_offset);
+@@ -911,7 +911,9 @@ dns_rbt_deserialize_tree(void *base_address, size_t filesize,
+ 	rbt->root = (dns_rbtnode_t *)((char *)base_address + header_offset +
+ 				      header->first_node_offset);
  
 -	if ((header->nodecount * sizeof(dns_rbtnode_t)) > filesize) {
 +	if ((header->nodecount * sizeof(dns_rbtnode_t)) > filesize
 +	    || header->first_node_offset > filesize) {
++
  		result = ISC_R_INVALIDFILE;
  		goto cleanup;
  	}
 -- 
-2.20.1
+2.21.1
 
diff --git a/bind-9.11-unit-disable-random.patch b/bind-9.11-unit-disable-random.patch
deleted file mode 100644
index dbd0cb6..0000000
--- a/bind-9.11-unit-disable-random.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-From 605d1575414c67f5e7eefeaae9dd2d0820c082dc Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Thu, 21 Feb 2019 22:42:27 +0100
-Subject: [PATCH] Disable random_test
-
-It fails too often on some architecture, failing the whole build along.
-Because it runs two times for pkcs11 and normal build and any of
-subtests can occasionally fail, stop it.
-
-It can be used again by defining 'unstable' variable in Kyuafile.
----
- lib/isc/tests/Kyuafile | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/lib/isc/tests/Kyuafile b/lib/isc/tests/Kyuafile
-index e2b2498..df2741e 100644
---- a/lib/isc/tests/Kyuafile
-+++ b/lib/isc/tests/Kyuafile
-@@ -18,6 +18,7 @@ tap_test_program{name='parse_test'}
- tap_test_program{name='pool_test'}
- tap_test_program{name='queue_test'}
- tap_test_program{name='radix_test'}
-+-- tap_test_program{name='random_test', required_configs='unstable'}
- tap_test_program{name='regex_test'}
- tap_test_program{name='result_test'}
- tap_test_program{name='safe_test'}
--- 
-2.20.1
-
diff --git a/bind-9.9.1-P2-multlib-conflict.patch b/bind-9.9.1-P2-multlib-conflict.patch
deleted file mode 100644
index 1de1e04..0000000
--- a/bind-9.9.1-P2-multlib-conflict.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-diff --git a/isc-config.sh.in b/isc-config.sh.in
-index 40f9bba..e446da2 100644
---- a/isc-config.sh.in
-+++ b/isc-config.sh.in
-@@ -13,7 +13,18 @@ prefix=@prefix@
- exec_prefix=@exec_prefix@
- exec_prefix_set=
- includedir=@includedir@
--libdir=@libdir@
-+arch=$(uname -m)
-+
-+case $arch in
-+	x86_64 | amd64 | sparc64 | s390x | ppc64)
-+		libdir=/usr/lib64
-+		sec_libdir=/usr/lib
-+		;;
-+	* )
-+		libdir=/usr/lib
-+		sec_libdir=/usr/lib64
-+		;;
-+esac
- 
- usage()
- {
-@@ -128,6 +139,16 @@ if test x"$echo_libs" = x"true"; then
- 	if test x"${exec_prefix_set}" = x"true"; then
- 		libs="-L${exec_prefix}/lib"
- 	else
-+		if [ ! -x $libdir/libisc.so ] ; then
-+			if [ ! -x $sec_libdir/libisc.so ] ; then
-+				echo "Error: ISC libs not found in $libdir"
-+				if [ -d $sec_libdir ] ; then
-+					echo "Error: ISC libs not found in $sec_libdir"
-+				fi
-+				exit 1
-+			fi
-+			libdir=$sec_libdir
-+		fi
- 		libs="-L${libdir}"
- 	fi
- 	if test x"$libirs" = x"true" ; then
diff --git a/bind.spec b/bind.spec
index 538202b..7668ede 100644
--- a/bind.spec
+++ b/bind.spec
@@ -16,7 +16,7 @@
 %bcond_without GSSTSIG
 # it is not possible to build the package without PKCS11 sub-package
 # due to extensive changes to Makefiles
-%bcond_without PKCS11
+%bcond_with PKCS11
 %bcond_without DEVEL
 %bcond_without LMDB
 %bcond_without JSON
@@ -62,24 +62,27 @@
 # Visit https://bugzilla.redhat.com/show_bug.cgi?id=1540300
 %undefine _strict_symbol_defs_build
 #
+# significant changes:
+# no more isc-config.sh and bind9-config
 
 # lib*.so.X versions of selected libraries
-%global sover_dns 1310
-%global sover_isc 1309
-%global sover_irs 1301
-%global sover_isccfg 1302
+%global sover_dns 1601
+%global sover_isc 1601
+%global sover_irs 1600
+%global sover_isccfg 1600
+
 
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.14.7
+Version:  9.16.1
 Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
-Source:   https://ftp.isc.org/isc/bind9/%{BINDVERSION}/bind-%{BINDVERSION}.tar.gz
+Source:   https://ftp.isc.org/isc/bind9/%{BINDVERSION}/bind-%{BINDVERSION}.tar.xz
 Source1:  named.sysconfig
-Source2:  https://ftp.isc.org/isc/bind9/%{BINDVERSION}/bind-%{BINDVERSION}.tar.gz.asc
+Source2:  https://ftp.isc.org/isc/bind9/%{BINDVERSION}/bind-%{BINDVERSION}.tar.xz.asc
 Source3:  named.logrotate
 Source4:  https://downloads.isc.org/isc/pgpkeys/codesign2019.txt
 Source7:  bind-9.3.1rc1-sdb_tools-Makefile.in
@@ -124,7 +127,6 @@ Patch101:bind-96-old-api.patch
 Patch106:bind93-rh490837.patch
 Patch112:bind97-rh645544.patch
 Patch130:bind-9.9.1-P2-dlz-libdb.patch
-Patch131:bind-9.9.1-P2-multlib-conflict.patch
 Patch133:bind99-rh640538.patch
 # Make PKCS11 used only for pkcs11 parts
 Patch135:bind-9.14-config-pkcs11.patch
@@ -141,7 +143,6 @@ Patch140:bind-9.11-rh1410433.patch
 Patch150:bind-9.11-engine-pkcs11.patch
 Patch153:bind-9.11-export-suffix.patch
 Patch154:bind-9.11-oot-manual.patch
-Patch155:bind-9.11-pk11.patch
 # FIXME: needs review. Should not be required
 #Patch156:bind-9.11-fips-code.patch
 Patch157:bind-9.11-fips-tests.patch
@@ -151,9 +152,6 @@ Patch157:bind-9.11-fips-tests.patch
 #Patch159:bind-9.11-rt46047.patch
 # https://gitlab.isc.org/isc-projects/bind9/issues/819
 Patch164:bind-9.11-rh1666814.patch
-# random_test fails too often by random, disable it
-# not present on 9.14.0
-Patch168:bind-9.11-unit-disable-random.patch
 #Patch169:bind-9.11-feature-test-dlz.patch
 Patch170:bind-9.11-feature-test-named.patch
 Patch171:bind-9.11-tests-variants.patch
@@ -209,6 +207,7 @@ BuildRequires:  python3-devel
 BuildRequires:  python3-ply
 BuildRequires:  findutils sed
 BuildRequires:  gnupg2
+BuildRequires:  libuv-devel
 %if %{with SDB}
 BuildRequires:  openldap-devel, libpq-devel, sqlite-devel, mariadb-connector-c-devel
 %endif
@@ -551,11 +550,11 @@ are used for building ISC DHCP.
 %patch106 -p1 -b .rh490837
 %patch112 -p1 -b .rh645544
 %patch130 -p1 -b .libdb
-%patch131 -p1 -b .multlib-conflict
 %patch140 -p1 -b .rh1410433
+%if %{with EXPORT_LIBS}
 %patch153 -p1 -b .export_suffix
+%endif
 %patch154 -p1 -b .oot-man
-%patch155 -p1 -b .pk11-internal
 #%patch156 -p1 -b .fips-code
 %patch157 -p1 -b .fips-tests
 #%patch158 -p1 -b .rt31459
@@ -564,7 +563,6 @@ are used for building ISC DHCP.
 #%patch161 -p1 -b .host-idn-disable
 #%patch163 -p1 -b .rh1663318
 %patch164 -p1 -b .rh1666814
-%patch168 -p1 -b .random_test-disable
 #%patch169 -p1 -b .featuretest-dlz
 %patch170 -p1 -b .featuretest-named
 %patch171 -p1 -b .test-variant
@@ -654,7 +652,6 @@ CFLAGS="$CFLAGS $RPM_OPT_FLAGS"
   CFLAGS+=" -O1 -fsanitize=thread -fPIE -pie"
 %endif
 export CFLAGS
-export CPPFLAGS="$CPPFLAGS -DDIG_SIGCHASE"
 export STD_CDEFINES="$CPPFLAGS"
 
 
@@ -775,7 +772,6 @@ popd # build
 %systemtest_prepare_build build
 
 %if %{with EXPORT_LIBS}
-cp isc-config.sh.1 isc-export-config.sh.1
 
 ## Create export libs ##
 mkdir -p export-libs
@@ -812,12 +808,9 @@ export LIBDIR_SUFFIX
 ## FIXME this should be in patch instead of SED'ing
 ## but do we really like/want to patch generated files?
 
-mv isc-config.sh isc-export-config.sh
 
 sed -i \
 -e '/^SUBDIRS =/s/.*/SUBDIRS = make lib/i' \
--e 's/isc-config.sh/isc-export-config.sh/g' \
--e 's/bind9-config/bind9-export-config/g' \
 Makefile
 
 sed -i -e \
@@ -987,6 +980,11 @@ install -m 644 %{SOURCE45} ${RPM_BUILD_ROOT}%{_unitdir}
 
 %if %{with PKCS11}
 install -m 644 %{SOURCE47} ${RPM_BUILD_ROOT}%{_unitdir}
+%else
+# Not packaged without PKCS11
+find ${RPM_BUILD_ROOT}%{_includedir}/bind9/pk11 ${RPM_BUILD_ROOT}%{_includedir}/bind9/pkcs11 \
+	 -name '*.h' \! -name site.h -delete
+
 %endif
 
 mkdir -p ${RPM_BUILD_ROOT}%{_libexecdir}
@@ -1043,9 +1041,7 @@ find ${RPM_BUILD_ROOT}/%{_libdir} -name '*.la' -exec '/bin/rm' '-f' '{}' ';';
 %if !%{with DEVEL}
 rm -f ${RPM_BUILD_ROOT}/%{_libdir}/bind9/*so
 rm -rf ${RPM_BUILD_ROOT}/%{_includedir}/bind9
-rm -f ${RPM_BUILD_ROOT}/%{_mandir}/man1/isc-config.sh.1*
 rm -f ${RPM_BUILD_ROOT}/%{_mandir}/man3/lwres*
-rm -f ${RPM_BUILD_ROOT}/%{_bindir}/isc-config.sh
 %endif
 
 # SDB manpages
@@ -1347,9 +1343,9 @@ fi;
 %endif
 
 %files libs
-%{_libdir}/libbind9.so.1302*
-%{_libdir}/libisccc.so.1302*
-%{_libdir}/libns.so.1307*
+%{_libdir}/libbind9.so.1600*
+%{_libdir}/libisccc.so.1600*
+%{_libdir}/libns.so.1601*
 
 %files libs-lite
 %{_libdir}/libdns.so.%{sover_dns}*
@@ -1411,10 +1407,6 @@ fi;
 %{_includedir}/bind9/bind9
 %{_includedir}/bind9/isccc
 %{_includedir}/bind9/ns
-%{_mandir}/man1/isc-config.sh.1*
-%{_mandir}/man1/bind9-config.1*
-%{_bindir}/isc-config.sh
-%{_bindir}/bind9-config
 %endif
 
 %files lite-devel
@@ -1608,6 +1600,9 @@ fi;
 
 
 %changelog
+* Thu Mar 26 2020 Petr Menšík <pemensik@redhat.com> - 32:9.16.1-1
+- Update to 9.16.1
+
 * Wed Jan 08 2020 Petr Menšík <pemensik@redhat.com> - 32:9.14.7-1
 - Update to 9.14.7
 
diff --git a/bind93-rh490837.patch b/bind93-rh490837.patch
index 6390c2f..4b32b4d 100644
--- a/bind93-rh490837.patch
+++ b/bind93-rh490837.patch
@@ -1,78 +1,34 @@
-diff --git a/lib/isc/include/isc/stdio.h b/lib/isc/include/isc/stdio.h
-index 1f44b5a..a3625f9 100644
---- a/lib/isc/include/isc/stdio.h
-+++ b/lib/isc/include/isc/stdio.h
-@@ -69,6 +69,9 @@ isc_stdio_sync(FILE *f);
-  * direct counterpart in the stdio library.
-  */
- 
-+isc_result_t
-+isc_stdio_fgetc(FILE *f, int *ret);
-+
- ISC_LANG_ENDDECLS
- 
- #endif /* ISC_STDIO_H */
 diff --git a/lib/isc/lex.c b/lib/isc/lex.c
-index ca5fe6d..b0152eb 100644
+index cd44fe3..5b7c539 100644
 --- a/lib/isc/lex.c
 +++ b/lib/isc/lex.c
-@@ -433,15 +433,11 @@ isc_lex_gettoken(isc_lex_t *lex, unsigned int options, isc_token_t *tokenp) {
- 			if (source->is_file) {
- 				stream = source->input;
+@@ -27,6 +27,8 @@
+ #include <isc/string.h>
+ #include <isc/util.h>
  
--#if defined(HAVE_FLOCKFILE) && defined(HAVE_GETC_UNLOCKED)
--				c = getc_unlocked(stream);
--#else
--				c = getc(stream);
--#endif
--				if (c == EOF) {
--					if (ferror(stream)) {
--						source->result = ISC_R_IOERROR;
--						result = source->result;
-+				result = isc_stdio_fgetc(stream, &c);
++#include "../errno2result.h"
 +
-+				if (result != ISC_R_SUCCESS) {
-+					if (result != ISC_R_EOF) {
-+						source->result = result;
+ typedef struct inputsource {
+ 	isc_result_t result;
+ 	bool is_file;
+@@ -422,7 +424,7 @@ isc_lex_gettoken(isc_lex_t *lex, unsigned int options, isc_token_t *tokenp) {
+ #endif /* if defined(HAVE_FLOCKFILE) && defined(HAVE_GETC_UNLOCKED) */
+ 				if (c == EOF) {
+ 					if (ferror(stream)) {
+-						source->result = ISC_R_IOERROR;
++						source->result = isc__errno2result(errno);
+ 						result = source->result;
  						goto done;
  					}
- 					source->at_eof = true;
 diff --git a/lib/isc/unix/errno2result.c b/lib/isc/unix/errno2result.c
-index d72d56f..4287ff3 100644
+index e3e2644..5e58600 100644
 --- a/lib/isc/unix/errno2result.c
 +++ b/lib/isc/unix/errno2result.c
-@@ -42,6 +42,7 @@ isc___errno2result(int posixerrno, bool dolog,
- 	case EINVAL:		/* XXX sometimes this is not for files */
+@@ -37,6 +37,7 @@ isc___errno2result(int posixerrno, bool dolog, const char *file,
+ 	case EINVAL: /* XXX sometimes this is not for files */
  	case ENAMETOOLONG:
  	case EBADF:
 +	case EISDIR:
  		return (ISC_R_INVALIDFILE);
  	case ENOENT:
  		return (ISC_R_FILENOTFOUND);
-diff --git a/lib/isc/unix/stdio.c b/lib/isc/unix/stdio.c
-index d2b1dda..79630b2 100644
---- a/lib/isc/unix/stdio.c
-+++ b/lib/isc/unix/stdio.c
-@@ -141,3 +141,22 @@ isc_stdio_sync(FILE *f) {
- 		return (isc__errno2result(errno));
- }
- 
-+isc_result_t
-+isc_stdio_fgetc(FILE *f, int *ret) {
-+	int r;
-+	isc_result_t result = ISC_R_SUCCESS;
-+
-+#if defined(HAVE_FLOCKFILE) && defined(HAVE_GETCUNLOCKED)
-+	r = fgetc_unlocked(f);
-+#else
-+	r = fgetc(f);
-+#endif
-+
-+	if (r == EOF)
-+		result = ferror(f) ? isc__errno2result(errno) : ISC_R_EOF;
-+
-+	*ret = r;
-+
-+	return result;
-+}
-+
diff --git a/bind97-rh645544.patch b/bind97-rh645544.patch
index 282fa2f..e7f67d8 100644
--- a/bind97-rh645544.patch
+++ b/bind97-rh645544.patch
@@ -1,31 +1,31 @@
 diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
-index 2a6e69c..b2f8cec 100644
+index 51bc368..20a17b9 100644
 --- a/lib/dns/resolver.c
 +++ b/lib/dns/resolver.c
-@@ -1676,7 +1676,7 @@ log_edns(fetchctx_t *fctx) {
+@@ -1754,7 +1754,7 @@ log_edns(fetchctx_t *fctx) {
  	 */
  	dns_name_format(&fctx->domain, domainbuf, sizeof(domainbuf));
  	isc_log_write(dns_lctx, DNS_LOGCATEGORY_EDNS_DISABLED,
 -		      DNS_LOGMODULE_RESOLVER, ISC_LOG_INFO,
 +		      DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(1),
- 		      "success resolving '%s' (in '%s'?) after %s",
- 		      fctx->info, domainbuf, fctx->reason);
+ 		      "success resolving '%s' (in '%s'?) after %s", fctx->info,
+ 		      domainbuf, fctx->reason);
  }
-@@ -5084,7 +5084,7 @@ log_lame(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo) {
+@@ -5275,7 +5275,7 @@ log_lame(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo) {
  	dns_name_format(&fctx->domain, domainbuf, sizeof(domainbuf));
  	isc_sockaddr_format(&addrinfo->sockaddr, addrbuf, sizeof(addrbuf));
  	isc_log_write(dns_lctx, DNS_LOGCATEGORY_LAME_SERVERS,
 -		      DNS_LOGMODULE_RESOLVER, ISC_LOG_INFO,
 +		      DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(1),
- 		      "lame server resolving '%s' (in '%s'?): %s",
- 		      namebuf, domainbuf, addrbuf);
+ 		      "lame server resolving '%s' (in '%s'?): %s", namebuf,
+ 		      domainbuf, addrbuf);
  }
-@@ -5111,7 +5111,7 @@ log_formerr(fetchctx_t *fctx, const char *format, ...) {
+@@ -5302,7 +5302,7 @@ log_formerr(fetchctx_t *fctx, const char *format, ...) {
  	}
  
  	isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
 -		      DNS_LOGMODULE_RESOLVER, ISC_LOG_NOTICE,
 +		      DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(1),
- 		      "DNS format error from %s resolving %s%s%s: %s",
- 		      nsbuf, fctx->info, clmsg, clbuf, msgbuf);
+ 		      "DNS format error from %s resolving %s%s%s: %s", nsbuf,
+ 		      fctx->info, clmsg, clbuf, msgbuf);
  }
diff --git a/sources b/sources
index 62a9471..e1955e4 100644
--- a/sources
+++ b/sources
@@ -1 +1,2 @@
-SHA512 (bind-9.14.4.tar.gz) = f5f4dc9b6a1d60838b59ce57ad37dc1e51fa26719aa203405a73850780f06bdc6ecea71c762efd464f946bdcce5a7c324de98caea36d2fe2781cce116fcd4932
+SHA512 (bind-9.16.1.tar.xz) = 9a1e8987f312b09a16c2ee0fd1d1eb8e4951b8dbcf3c0d51a1a1fb179a261028239ab2bebc3e559592cc766de57a26ba37b27621a0c5e1711d36c2416f0a0c26
+SHA512 (bind-9.16.1.tar.xz.asc) = fb9967033a0f8efbc05537ce4f3b315607ff06805b415303cf338afab303ca0f146a4d8049e7166971969b87064aa480a72c41d2c0ab1a8f3165e2049ccc4cb0

From 78968700e2db035bb347989f1390342a61b17765 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 27 Mar 2020 10:27:25 +0100
Subject: [PATCH 122/460] Fix tsig system test

During rebase, custom md5 part gone missing.
---
 bind-9.11-fips-tests.patch | 22 ++++++++++++++++++++--
 1 file changed, 20 insertions(+), 2 deletions(-)

diff --git a/bind-9.11-fips-tests.patch b/bind-9.11-fips-tests.patch
index 9f25c90..7ee915b 100644
--- a/bind-9.11-fips-tests.patch
+++ b/bind-9.11-fips-tests.patch
@@ -1,4 +1,4 @@
-From 3f9d05b72f725defd1452fd3d4b8ef3192e96c0b Mon Sep 17 00:00:00 2001
+From 303aae42064a4f6245f9c519953a5e6dd67510c0 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 2 Aug 2018 23:46:45 +0200
 Subject: [PATCH] FIPS tests changes
@@ -86,11 +86,13 @@ Date:   Wed Mar 7 10:44:23 2018 +0100
  bin/tests/system/rndc/setup.sh                |  2 +-
  bin/tests/system/rndc/tests.sh                | 23 ++++---
  bin/tests/system/tsig/ns1/named.conf.in       | 10 +--
+ bin/tests/system/tsig/ns1/rndc5.conf.in       | 10 +++
  bin/tests/system/tsig/setup.sh                |  5 ++
  bin/tests/system/tsig/tests.sh                | 67 ++++++++++++-------
  bin/tests/system/upforwd/ns1/named.conf.in    |  2 +-
  bin/tests/system/upforwd/tests.sh             |  2 +-
- 32 files changed, 151 insertions(+), 107 deletions(-)
+ 33 files changed, 161 insertions(+), 107 deletions(-)
+ create mode 100644 bin/tests/system/tsig/ns1/rndc5.conf.in
 
 diff --git a/bin/tests/system/acl/ns2/named1.conf.in b/bin/tests/system/acl/ns2/named1.conf.in
 index 0ea6502..026db3f 100644
@@ -788,6 +790,22 @@ index fbf30c6..f61657d 100644
  
  key "sha1-trunc" {
  	secret "FrSt77yPTFx6hTs4i2tKLB9LmE0=";
+diff --git a/bin/tests/system/tsig/ns1/rndc5.conf.in b/bin/tests/system/tsig/ns1/rndc5.conf.in
+new file mode 100644
+index 0000000..0682194
+--- /dev/null
++++ b/bin/tests/system/tsig/ns1/rndc5.conf.in
+@@ -0,0 +1,10 @@
++# Conditionally included when support for MD5 is available
++key "md5" {
++	secret "97rnFx24Tfna4mHPfgnerA==";
++	algorithm hmac-md5;
++};
++
++key "md5-trunc" {
++	secret "97rnFx24Tfna4mHPfgnerA==";
++	algorithm hmac-md5-80;
++};
 diff --git a/bin/tests/system/tsig/setup.sh b/bin/tests/system/tsig/setup.sh
 index b3e0450..90a6ce4 100644
 --- a/bin/tests/system/tsig/setup.sh

From 814547323ea4824aed15582d8fbcebd379f6966b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 27 Mar 2020 12:30:39 +0100
Subject: [PATCH 123/460] Update patches after rebase

---
 bind-9.11-fips-disable.patch      |   86 +-
 bind-9.11-json-c.patch            |   50 -
 bind-9.11-oot-gen.patch           |   47 -
 bind-9.11-rh1732883.patch         |  194 --
 bind-9.11-rh1736762-5.patch       |   59 -
 bind-9.11-rh1736762-6.patch       |  159 --
 bind-9.11-rh1736762-7.patch       |   77 -
 bind-9.11-rh1736762-8.patch       |   38 -
 bind-9.11-serve-stale-dbfix.patch |   42 -
 bind-9.11-serve-stale.patch       | 3858 -----------------------------
 bind.spec                         |   23 +-
 11 files changed, 17 insertions(+), 4616 deletions(-)
 delete mode 100644 bind-9.11-json-c.patch
 delete mode 100644 bind-9.11-oot-gen.patch
 delete mode 100644 bind-9.11-rh1732883.patch
 delete mode 100644 bind-9.11-rh1736762-5.patch
 delete mode 100644 bind-9.11-rh1736762-6.patch
 delete mode 100644 bind-9.11-rh1736762-7.patch
 delete mode 100644 bind-9.11-rh1736762-8.patch
 delete mode 100644 bind-9.11-serve-stale-dbfix.patch
 delete mode 100644 bind-9.11-serve-stale.patch

diff --git a/bind-9.11-fips-disable.patch b/bind-9.11-fips-disable.patch
index afe9564..c01d914 100644
--- a/bind-9.11-fips-disable.patch
+++ b/bind-9.11-fips-disable.patch
@@ -1,4 +1,4 @@
-From 83b889c238282b210f874a3ad81bb56299767495 Mon Sep 17 00:00:00 2001
+From 2b0dce163a119f5f62eb4428b485f7575f321d6f Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Mon, 5 Aug 2019 11:54:03 +0200
 Subject: [PATCH] Allow explicit disabling of autodisabled MD5
@@ -9,16 +9,16 @@ RSAMD5 is included in security policy, it fails to start, because that
 algorithm is not recognized. Allow it disabled, but fail on any
 other usage.
 ---
- bin/named/server.c |  4 ++--
- lib/bind9/check.c  |  4 ++++
- lib/dns/rcode.c    | 33 +++++++++++++++------------------
- 3 files changed, 21 insertions(+), 20 deletions(-)
+ bin/named/server.c | 4 ++--
+ lib/bind9/check.c  | 4 ++++
+ lib/dns/rcode.c    | 1 +
+ 3 files changed, 7 insertions(+), 2 deletions(-)
 
 diff --git a/bin/named/server.c b/bin/named/server.c
-index 5b57371..51702ab 100644
+index ee23f10..22a5c01 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
-@@ -1547,12 +1547,12 @@ disable_algorithms(const cfg_obj_t *disabled, dns_resolver_t *resolver) {
+@@ -1689,12 +1689,12 @@ disable_algorithms(const cfg_obj_t *disabled, dns_resolver_t *resolver) {
  		r.length = strlen(r.base);
  
  		result = dns_secalg_fromtext(&alg, &r);
@@ -30,14 +30,14 @@ index 5b57371..51702ab 100644
  		}
 -		if (result != ISC_R_SUCCESS) {
 +		if (result != ISC_R_SUCCESS && result != ISC_R_DISABLED) {
- 			cfg_obj_log(cfg_listelt_value(element),
- 				    ns_g_lctx, ISC_LOG_ERROR,
- 				    "invalid algorithm");
+ 			cfg_obj_log(cfg_listelt_value(element), named_g_lctx,
+ 				    ISC_LOG_ERROR, "invalid algorithm");
+ 			CHECK(result);
 diff --git a/lib/bind9/check.c b/lib/bind9/check.c
-index e0803d4..8023784 100644
+index f49a346..dbf9ddb 100644
 --- a/lib/bind9/check.c
 +++ b/lib/bind9/check.c
-@@ -302,6 +302,10 @@ disabled_algorithms(const cfg_obj_t *disabled, isc_log_t *logctx) {
+@@ -317,6 +317,10 @@ disabled_algorithms(const cfg_obj_t *disabled, isc_log_t *logctx) {
  		r.length = strlen(r.base);
  
  		tresult = dns_secalg_fromtext(&alg, &r);
@@ -49,18 +49,10 @@ index e0803d4..8023784 100644
  			cfg_obj_log(cfg_listelt_value(element), logctx,
  				    ISC_LOG_ERROR, "invalid algorithm '%s'",
 diff --git a/lib/dns/rcode.c b/lib/dns/rcode.c
-index f51d548..c49b8d1 100644
+index 327248e..78adf63 100644
 --- a/lib/dns/rcode.c
 +++ b/lib/dns/rcode.c
-@@ -126,7 +126,6 @@
- #endif
- 
- #define SECALGNAMES \
--	MD5_SECALGNAMES \
- 	DH_SECALGNAMES \
- 	DSA_SECALGNAMES \
- 	{ DNS_KEYALG_ECC, "ECC", 0 }, \
-@@ -178,6 +177,7 @@ static struct tbl rcodes[] = { RCODENAMES ERCODENAMES };
+@@ -152,6 +152,7 @@ static struct tbl rcodes[] = { RCODENAMES ERCODENAMES };
  static struct tbl tsigrcodes[] = { RCODENAMES TSIGRCODENAMES };
  static struct tbl certs[] = { CERTNAMES };
  static struct tbl secalgs[] = { SECALGNAMES };
@@ -68,54 +60,6 @@ index f51d548..c49b8d1 100644
  static struct tbl secprotos[] = { SECPROTONAMES };
  static struct tbl hashalgs[] = { HASHALGNAMES };
  static struct tbl dsdigests[] = { DSDIGESTNAMES };
-@@ -358,33 +358,30 @@ dns_cert_totext(dns_cert_t cert, isc_buffer_t *target) {
- 	return (dns_mnemonic_totext(cert, target, certs));
- }
- 
--static inline struct tbl *
--secalgs_tbl_start() {
--	struct tbl *algs = secalgs;
--
--#ifndef PK11_MD5_DISABLE
--	if (!isc_md5_available()) {
--		while (algs->name != NULL &&
--		       algs->value == DNS_KEYALG_RSAMD5)
--			++algs;
--	}
--#endif
--	return algs;
--}
--
- isc_result_t
- dns_secalg_fromtext(dns_secalg_t *secalgp, isc_textregion_t *source) {
- 	unsigned int value;
-+	isc_result_t result;
- 
--	RETERR(dns_mnemonic_fromtext(&value, source,
--	                             secalgs_tbl_start(), 0xff));
-+	result = dns_mnemonic_fromtext(&value, source,
-+	                               secalgs, 0xff);
-+	if (result != ISC_R_SUCCESS) {
-+		result = dns_mnemonic_fromtext(&value, source,
-+	                                       md5_secalgs, 0xff);
-+		if (result != ISC_R_SUCCESS) {
-+			return (result);
-+		} else if (!isc_md5_available()) {
-+			*secalgp = value;
-+			return (ISC_R_DISABLED);
-+		}
-+	}
- 	*secalgp = value;
- 	return (ISC_R_SUCCESS);
- }
- 
- isc_result_t
- dns_secalg_totext(dns_secalg_t secalg, isc_buffer_t *target) {
--	return (dns_mnemonic_totext(secalg, target, secalgs_tbl_start()));
-+	return (dns_mnemonic_totext(secalg, target, secalgs));
- }
- 
- void
 -- 
-2.20.1
+2.21.1
 
diff --git a/bind-9.11-json-c.patch b/bind-9.11-json-c.patch
deleted file mode 100644
index 95e5597..0000000
--- a/bind-9.11-json-c.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-From cb6d2019766a6c8c5516fd8859cedf0052f03293 Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Thu, 25 Jul 2019 11:37:57 +0200
-Subject: [PATCH] Skip support of jsoncpp
-
-Bind cannot be compiled when jsoncpp-devel is installed. Remove support
-for jsoncpp, use only json-c-devel. Bind 9.15 has already support for
---with-json-c, do not yet introduce it.
----
- configure.ac | 17 ++---------------
- 1 file changed, 2 insertions(+), 15 deletions(-)
-
-diff --git a/configure.ac b/configure.ac
-index 6d05337..5ce83b5 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -2594,15 +2594,7 @@ case "$use_libjson" in
- 	auto|yes)
- 		for d in /usr /usr/local /opt/local
- 		do
--			if test -f "${d}/include/json/json.h"
--			then
--				if test ${d} != /usr
--				then
--					libjson_cflags="-I ${d}/include"
--					LIBS="$LIBS -L${d}/lib"
--				fi
--				have_libjson="yes"
--			elif test -f "${d}/include/json-c/json.h"
-+			if test -f "${d}/include/json-c/json.h"
- 			then
- 				if test ${d} != /usr
- 				then
-@@ -2615,12 +2607,7 @@ case "$use_libjson" in
- 		done
- 		;;
- 	*)
--		if test -f "${use_libjson}/include/json/json.h"
--		then
--			libjson_cflags="-I${use_libjson}/include"
--			LIBS="$LIBS -L${use_libjson}/lib"
--			have_libjson="yes"
--		elif test -f "${use_libjson}/include/json-c/json.h"
-+		if test -f "${use_libjson}/include/json-c/json.h"
- 		then
- 			libjson_cflags="-I${use_libjson}/include"
- 			LIBS="$LIBS -L${use_libjson}/lib"
--- 
-2.20.1
-
diff --git a/bind-9.11-oot-gen.patch b/bind-9.11-oot-gen.patch
deleted file mode 100644
index 9a7f991..0000000
--- a/bind-9.11-oot-gen.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From cb654ddde5953cab9dfde7173ea1ed14b51c3727 Mon Sep 17 00:00:00 2001
-From: Mark Andrews <marka@isc.org>
-Date: Sun, 22 Dec 2019 21:51:21 +0000
-Subject: [PATCH] Merge branch
- '1530-lib-dns-gen-c-29-26-fatal-error-isc-platform-h-no-such-file-or-directory-v9_11'
- into 'v9_11'
-
-Resolve "lib/dns/gen.c:29:26: fatal error: isc/platform.h: No such file or directory"
-
-See merge request isc-projects/bind9!2794
-
-(cherry picked from commit 335ab375d6a0227fb362722acad22f2a5b75d8b7)
----
- lib/dns/gen.c | 10 +++++-----
- 1 file changed, 5 insertions(+), 5 deletions(-)
-
-diff --git a/lib/dns/gen.c b/lib/dns/gen.c
-index 81bc7ada1d..5fbdc3bfd3 100644
---- a/lib/dns/gen.c
-+++ b/lib/dns/gen.c
-@@ -26,18 +26,18 @@
- 
- #include <sys/types.h>
- 
--#include <isc/platform.h>
--
- #include <ctype.h>
-+#include <errno.h>
- #include <limits.h>
- #include <stdint.h>
--#include <stdlib.h>
- #include <stdio.h>
- #include <stdlib.h>
- #include <string.h>
- #include <time.h>
--#include <errno.h>
--#include <limits.h>
-+
-+#ifndef PATH_MAX
-+#define PATH_MAX 1024
-+#endif
- 
- #ifdef WIN32
- #include "gen-win32.h"
--- 
-2.21.0
-
diff --git a/bind-9.11-rh1732883.patch b/bind-9.11-rh1732883.patch
deleted file mode 100644
index 14bf265..0000000
--- a/bind-9.11-rh1732883.patch
+++ /dev/null
@@ -1,194 +0,0 @@
-From 6010876e561b4345e569ffd11eaec9ea52725817 Mon Sep 17 00:00:00 2001
-From: Pavel Zhukov <pzhukov@redhat.com>
-Date: Wed, 24 Jul 2019 17:15:55 +0200
-Subject: [PATCH] Detect system time jumps
-
-In case if system time was changed backward it's possible to have ip
-address dropped by the kernel due to lifetime expirity. Try to detect
-this situation using either monotonic time or saved timestamp and execute
-go_reboot() procedure to request lease extention
----
- lib/isc/include/isc/result.h    |  3 ++-
- lib/isc/include/isc/util.h      |  3 +++
- lib/isc/result.c                |  2 ++
- lib/isc/unix/app.c              | 39 +++++++++++++++++++++++++++++----
- lib/isc/unix/include/isc/time.h | 20 +++++++++++++++++
- lib/isc/unix/time.c             | 22 +++++++++++++++++++
- 6 files changed, 84 insertions(+), 5 deletions(-)
-
-diff --git a/lib/isc/include/isc/result.h b/lib/isc/include/isc/result.h
-index 0389efa..149cde5 100644
---- a/lib/isc/include/isc/result.h
-+++ b/lib/isc/include/isc/result.h
-@@ -89,7 +89,8 @@
- #define ISC_R_DISCFULL			67	/*%< disc full */
- #define ISC_R_DEFAULT			68	/*%< default */
- #define ISC_R_IPV4PREFIX		69	/*%< IPv4 prefix */
--#define ISC_R_NRESULTS 			70
-+#define ISC_R_TIMESHIFTED               70      /*%< system time changed */
-+#define ISC_R_NRESULTS 			71
- 
- ISC_LANG_BEGINDECLS
- 
-diff --git a/lib/isc/include/isc/util.h b/lib/isc/include/isc/util.h
-index 973c348..8160dd3 100644
---- a/lib/isc/include/isc/util.h
-+++ b/lib/isc/include/isc/util.h
-@@ -289,6 +289,9 @@ extern void mock_assert(const int result, const char* const expression,
-  * Time
-  */
- #define TIME_NOW(tp) 	RUNTIME_CHECK(isc_time_now((tp)) == ISC_R_SUCCESS)
-+#ifdef CLOCK_BOOTTIME
-+#define TIME_MONOTONIC(tp) 	RUNTIME_CHECK(isc_time_boottime((tp)) == ISC_R_SUCCESS)
-+#endif
- 
- /*%
-  * Alignment
-diff --git a/lib/isc/result.c b/lib/isc/result.c
-index a9db132..7c04831 100644
---- a/lib/isc/result.c
-+++ b/lib/isc/result.c
-@@ -105,6 +105,7 @@ static const char *description[ISC_R_NRESULTS] = {
- 	"disc full",				/*%< 67 */
- 	"default",				/*%< 68 */
- 	"IPv4 prefix",				/*%< 69 */
-+        "time changed",                         /*%< 70 */
- };
- 
- static const char *identifier[ISC_R_NRESULTS] = {
-@@ -178,6 +179,7 @@ static const char *identifier[ISC_R_NRESULTS] = {
- 	"ISC_R_DISCFULL",
- 	"ISC_R_DEFAULT",
- 	"ISC_R_IPV4PREFIX",
-+        "ISC_R_TIMESHIFTED",
- };
- 
- #define ISC_RESULT_RESULTSET			2
-diff --git a/lib/isc/unix/app.c b/lib/isc/unix/app.c
-index a6e9882..52eb3e0 100644
---- a/lib/isc/unix/app.c
-+++ b/lib/isc/unix/app.c
-@@ -442,15 +442,48 @@ isc__app_ctxonrun(isc_appctx_t *ctx0, isc_mem_t *mctx, isc_task_t *task,
- static isc_result_t
- evloop(isc__appctx_t *ctx) {
- 	isc_result_t result;
-+        isc_time_t now;
-+#ifdef CLOCK_BOOTTIME
-+        isc_time_t monotonic;
-+        uint64_t diff  = 0;
-+#else
-+        isc_time_t prev;
-+        TIME_NOW(&prev);
-+#endif
-+
-+
- 
- 	while (!ctx->want_shutdown) {
- 		int n;
--		isc_time_t when, now;
-+		isc_time_t when;
- 		struct timeval tv, *tvp;
- 		isc_socketwait_t *swait;
- 		bool readytasks;
- 		bool call_timer_dispatch = false;
--
-+                uint64_t us;
-+
-+#ifdef CLOCK_BOOTTIME
-+                // TBD macros for following three lines
-+                TIME_NOW(&now);
-+                TIME_MONOTONIC(&monotonic);
-+                INSIST(now.seconds > monotonic.seconds)
-+                us = isc_time_microdiff (&now, &monotonic);
-+                if (us < diff){
-+                  us = diff - us;
-+                  if (us > 1000000){ // ignoring shifts less than one second
-+                    return ISC_R_TIMESHIFTED;
-+                  };
-+                  diff = isc_time_microdiff (&now, &monotonic);
-+                } else {
-+                  diff = isc_time_microdiff (&now, &monotonic);
-+                  // not implemented
-+                }
-+#else
-+                TIME_NOW(&now);
-+                if (isc_time_compare (&now, &prev) < 0)
-+                  return ISC_R_TIMESHIFTED;
-+                TIME_NOW(&prev);
-+#endif
- 		/*
- 		 * Check the reload (or suspend) case first for exiting the
- 		 * loop as fast as possible in case:
-@@ -475,8 +508,6 @@ evloop(isc__appctx_t *ctx) {
- 			if (result != ISC_R_SUCCESS)
- 				tvp = NULL;
- 			else {
--				uint64_t us;
--
- 				TIME_NOW(&now);
- 				us = isc_time_microdiff(&when, &now);
- 				if (us == 0)
-diff --git a/lib/isc/unix/include/isc/time.h b/lib/isc/unix/include/isc/time.h
-index b864c29..5dd43c9 100644
---- a/lib/isc/unix/include/isc/time.h
-+++ b/lib/isc/unix/include/isc/time.h
-@@ -132,6 +132,26 @@ isc_time_isepoch(const isc_time_t *t);
-  *\li	't' is a valid pointer.
-  */
- 
-+#ifdef CLOCK_BOOTTIME
-+isc_result_t
-+isc_time_boottime(isc_time_t *t);
-+/*%<
-+ * Set 't' to monotonic time from previous boot
-+ * it's not affected by system time change. It also
-+ * includes the time system was suspended
-+ *
-+ * Requires:
-+ *\li	't' is a valid pointer.
-+ *
-+ * Returns:
-+ *
-+ *\li	Success
-+ *\li	Unexpected error
-+ *		Getting the time from the system failed.
-+ */
-+#endif /* CLOCK_BOOTTIME */
-+ 
-+
- isc_result_t
- isc_time_now(isc_time_t *t);
- /*%<
-diff --git a/lib/isc/unix/time.c b/lib/isc/unix/time.c
-index 8edc9df..fe0bb91 100644
---- a/lib/isc/unix/time.c
-+++ b/lib/isc/unix/time.c
-@@ -498,3 +498,25 @@ isc_time_formatISO8601ms(const isc_time_t *t, char *buf, unsigned int len) {
- 			 t->nanoseconds / NS_PER_MS);
- 	}
- }
-+
-+
-+#ifdef CLOCK_BOOTTIME
-+isc_result_t
-+isc_time_boottime(isc_time_t *t) {
-+  struct timespec ts;
-+  
-+  char strbuf[ISC_STRERRORSIZE];
-+
-+  if (clock_gettime (CLOCK_BOOTTIME, &ts) != 0){
-+    isc__strerror(errno, strbuf, sizeof(strbuf));
-+    UNEXPECTED_ERROR(__FILE__, __LINE__, "%s", strbuf);
-+    return (ISC_R_UNEXPECTED);    
-+  }
-+
-+  t->seconds = ts.tv_sec;
-+  t->nanoseconds = ts.tv_nsec;
-+
-+  return (ISC_R_SUCCESS);
-+  
-+};
-+#endif
--- 
-2.20.1
-
diff --git a/bind-9.11-rh1736762-5.patch b/bind-9.11-rh1736762-5.patch
deleted file mode 100644
index e14efca..0000000
--- a/bind-9.11-rh1736762-5.patch
+++ /dev/null
@@ -1,59 +0,0 @@
-From 6257d829c9d7e71ac51bcdc6b5b981c7a19200e2 Mon Sep 17 00:00:00 2001
-From: Mark Andrews <marka@isc.org>
-Date: Mon, 25 Nov 2019 05:46:55 +0000
-Subject: [PATCH] Merge branch
- '1373-threadsanitizer-data-race-rbtdb-c-5193-in-detachnode' into 'master'
-
-Resolve "ThreadSanitizer: data race rbtdb.c:5193 in detachnode"
-
-Closes #1373
-
-See merge request isc-projects/bind9!2598
----
- lib/dns/include/dns/rbt.h | 22 +++++++++-------------
- 1 file changed, 9 insertions(+), 13 deletions(-)
-
-diff --git a/lib/dns/include/dns/rbt.h b/lib/dns/include/dns/rbt.h
-index 67ac3e4d8a..a084bd6193 100644
---- a/lib/dns/include/dns/rbt.h
-+++ b/lib/dns/include/dns/rbt.h
-@@ -49,10 +49,7 @@ ISC_LANG_BEGINDECLS
- 
- #define DNS_RBT_USEMAGIC 1
- 
--/*
-- * These should add up to 30.
-- */
--#define DNS_RBT_LOCKLENGTH                      10
-+#define DNS_RBT_LOCKLENGTH		(sizeof(((dns_rbtnode_t *)0)->locknum)*8)
- #define DNS_RBT_REFLENGTH                       20
- 
- #define DNS_RBTNODE_MAGIC               ISC_MAGIC('R','B','N','O')
-@@ -159,16 +156,15 @@ struct dns_rbtnode {
- 	 * separate region of memory.
- 	 */
- 	void *data;
--	unsigned int :0;                /* start of bitfields c/o node lock */
--	unsigned int dirty:1;
--	unsigned int wild:1;
--	unsigned int locknum:DNS_RBT_LOCKLENGTH;
--#ifndef DNS_RBT_USEISCREFCOUNT
--	unsigned int references:DNS_RBT_REFLENGTH;
--#endif
--	unsigned int :0;                /* end of bitfields c/o node lock */
-+	uint8_t :0;                /* start of bitfields c/o node lock */
-+	uint8_t dirty:1;
-+	uint8_t wild:1;
-+	uint8_t :0;                /* end of bitfields c/o node lock */
-+	uint16_t locknum;	   /* note that this is not in the bitfield */
- #ifdef DNS_RBT_USEISCREFCOUNT
--	isc_refcount_t references; /* note that this is not in the bitfield */
-+	isc_refcount_t references;
-+#else
-+	unsigned int references:DNS_RBT_REFLENGTH;
- #endif
- 	/*@}*/
- };
--- 
-2.21.0
-
diff --git a/bind-9.11-rh1736762-6.patch b/bind-9.11-rh1736762-6.patch
deleted file mode 100644
index abc36f0..0000000
--- a/bind-9.11-rh1736762-6.patch
+++ /dev/null
@@ -1,159 +0,0 @@
-From 638561615c37e8eace986e268811335c12d1b6a1 Mon Sep 17 00:00:00 2001
-From: Mark Andrews <marka@isc.org>
-Date: Thu, 12 Dec 2019 20:41:44 +1100
-Subject: [PATCH] give zspill its own lock
-
-(cherry picked from commit a52189e8e67a20097539fe3e6f7da4e4c01dc340)
----
- lib/dns/resolver.c | 45 +++++++++++++++++++++++++++++----------------
- 1 file changed, 29 insertions(+), 16 deletions(-)
-
-diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
-index 9f65c0596a..04367f82c6 100644
---- a/lib/dns/resolver.c
-+++ b/lib/dns/resolver.c
-@@ -460,20 +460,21 @@ struct dns_resolver {
- 	isc_mutex_t			lock;
- 	isc_mutex_t			nlock;
- 	isc_mutex_t			primelock;
-+	isc_mutex_t			zspill_lock;
- 	dns_rdataclass_t		rdclass;
- 	isc_socketmgr_t *		socketmgr;
- 	isc_timermgr_t *		timermgr;
- 	isc_taskmgr_t *			taskmgr;
- 	dns_view_t *			view;
--	bool			frozen;
-+	bool				frozen;
- 	unsigned int			options;
- 	dns_dispatchmgr_t *		dispatchmgr;
- 	dns_dispatchset_t *		dispatches4;
--	bool			exclusivev4;
-+	bool				exclusivev4;
- 	dns_dispatchset_t *		dispatches6;
- 	isc_dscp_t			querydscp4;
- 	isc_dscp_t			querydscp6;
--	bool			exclusivev6;
-+	bool				exclusivev6;
- 	unsigned int			nbuckets;
- 	fctxbucket_t *			buckets;
- 	zonebucket_t *			dbuckets;
-@@ -492,7 +493,7 @@ struct dns_resolver {
- 	unsigned int			spillatmax;
- 	unsigned int			spillatmin;
- 	isc_timer_t *			spillattimer;
--	bool			zero_no_soa_ttl;
-+	bool				zero_no_soa_ttl;
- 	unsigned int			query_timeout;
- 	unsigned int			maxdepth;
- 	unsigned int			maxqueries;
-@@ -502,14 +503,16 @@ struct dns_resolver {
- 	unsigned int			retryinterval; /* in milliseconds */
- 	unsigned int			nonbackofftries;
- 
-+	/* Locked by lock. */
-+	unsigned int			zspill;		/* fetches-per-zone */
-+
- 	/* Locked by lock. */
- 	unsigned int			references;
--	bool			exiting;
-+	bool				exiting;
- 	isc_eventlist_t			whenshutdown;
- 	unsigned int			activebuckets;
--	bool			priming;
-+	bool				priming;
- 	unsigned int			spillat;	/* clients-per-query */
--	unsigned int			zspill;		/* fetches-per-zone */
- 
- 	dns_badcache_t  * 		badcache;	 /* Bad cache. */
- 
-@@ -1257,7 +1260,7 @@ fcount_incr(fetchctx_t *fctx, bool force) {
- 	isc_result_t result = ISC_R_SUCCESS;
- 	zonebucket_t *dbucket;
- 	fctxcount_t *counter;
--	unsigned int bucketnum, spill;
-+	unsigned int bucketnum;
- 
- 	REQUIRE(fctx != NULL);
- 	REQUIRE(fctx->res != NULL);
-@@ -1266,10 +1269,6 @@ fcount_incr(fetchctx_t *fctx, bool force) {
- 	bucketnum = dns_name_fullhash(&fctx->domain, false)
- 			% RES_DOMAIN_BUCKETS;
- 
--	LOCK(&fctx->res->lock);
--	spill = fctx->res->zspill;
--	UNLOCK(&fctx->res->lock);
--
- 	dbucket = &fctx->res->dbuckets[bucketnum];
- 
- 	LOCK(&dbucket->lock);
-@@ -1297,6 +1296,12 @@ fcount_incr(fetchctx_t *fctx, bool force) {
- 			ISC_LIST_APPEND(dbucket->list, counter, link);
- 		}
- 	} else {
-+		unsigned int spill;
-+
-+		LOCK(&fctx->res->zspill_lock);
-+		spill = fctx->res->zspill;
-+		UNLOCK(&fctx->res->zspill_lock);
-+
- 		if (!force && spill != 0 && counter->count >= spill) {
- 			counter->dropped++;
- 			fcount_logspill(fctx, counter);
-@@ -8811,6 +8816,7 @@ destroy(dns_resolver_t *res) {
- 
- 	INSIST(res->nfctx == 0);
- 
-+	DESTROYLOCK(&res->zspill_lock);
- 	DESTROYLOCK(&res->primelock);
- 	DESTROYLOCK(&res->nlock);
- 	DESTROYLOCK(&res->lock);
-@@ -9089,10 +9095,14 @@ dns_resolver_create(dns_view_t *view,
- 	if (result != ISC_R_SUCCESS)
- 		goto cleanup_nlock;
- 
-+	result = isc_mutex_init(&res->zspill_lock);
-+	if (result != ISC_R_SUCCESS)
-+		goto cleanup_primelock;
-+
- 	task = NULL;
- 	result = isc_task_create(taskmgr, 0, &task);
- 	if (result != ISC_R_SUCCESS)
--		goto cleanup_primelock;
-+		goto cleanup_zspill_lock;
- 	isc_task_setname(task, "resolver_task", NULL);
- 
- 	result = isc_timer_create(timermgr, isc_timertype_inactive, NULL, NULL,
-@@ -9100,7 +9110,7 @@ dns_resolver_create(dns_view_t *view,
- 				  &res->spillattimer);
- 	isc_task_detach(&task);
- 	if (result != ISC_R_SUCCESS)
--		goto cleanup_primelock;
-+		goto cleanup_zspill_lock;
- 
- #if USE_ALGLOCK
- 	result = isc_rwlock_init(&res->alglock, 0, 0);
-@@ -9133,6 +9143,9 @@ dns_resolver_create(dns_view_t *view,
- 	isc_timer_detach(&res->spillattimer);
- #endif
- 
-+ cleanup_zspill_lock:
-+	DESTROYLOCK(&res->zspill_lock);
-+
-  cleanup_primelock:
- 	DESTROYLOCK(&res->primelock);
- 
-@@ -10275,9 +10288,9 @@ dns_resolver_setfetchesperzone(dns_resolver_t *resolver, uint32_t clients)
- {
- 	REQUIRE(VALID_RESOLVER(resolver));
- 
--	LOCK(&resolver->lock);
-+	LOCK(&resolver->zspill_lock);
- 	resolver->zspill = clients;
--	UNLOCK(&resolver->lock);
-+	UNLOCK(&resolver->zspill_lock);
- }
- 
- 
--- 
-2.21.0
-
diff --git a/bind-9.11-rh1736762-7.patch b/bind-9.11-rh1736762-7.patch
deleted file mode 100644
index 38617a2..0000000
--- a/bind-9.11-rh1736762-7.patch
+++ /dev/null
@@ -1,77 +0,0 @@
-From 23a6775f62deeee63e9f7927be387fecf23a8074 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
-Date: Tue, 10 Dec 2019 10:02:09 +0100
-Subject: [PATCH] Ensure all zone_settimer() calls are done on locked zone
-
-(cherry picked from commit cf48e8eb326f824170f2069e5d5c33992b1783a4)
-(cherry picked from commit 3bac7e98074643ff62582545e5840e4195517b07)
----
- lib/dns/zone.c | 9 +++++----
- 1 file changed, 5 insertions(+), 4 deletions(-)
-
-diff --git a/lib/dns/zone.c b/lib/dns/zone.c
-index e8cff77588..db837aae50 100644
---- a/lib/dns/zone.c
-+++ b/lib/dns/zone.c
-@@ -10291,7 +10291,9 @@ zone_maintenance(dns_zone_t *zone) {
- 	default:
- 		break;
- 	}
-+	LOCK_ZONE(zone);
- 	zone_settimer(zone, &now);
-+	UNLOCK_ZONE(zone);
- }
- 
- void
-@@ -13081,6 +13083,7 @@ zone_settimer(dns_zone_t *zone, isc_time_t *now) {
- 	isc_result_t result;
- 
- 	REQUIRE(DNS_ZONE_VALID(zone));
-+	REQUIRE(LOCKED_ZONE(zone));
- 	ENTER;
- 
- 	if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_EXITING))
-@@ -18405,6 +18408,7 @@ zone_rekey(dns_zone_t *zone) {
- 		UNLOCK_ZONE(zone);
- 	}
- 
-+	LOCK_ZONE(zone);
- 	isc_time_settoepoch(&zone->refreshkeytime);
- 
- 	/*
-@@ -18416,11 +18420,9 @@ zone_rekey(dns_zone_t *zone) {
- 		isc_time_t timethen;
- 		isc_stdtime_t then;
- 
--		LOCK_ZONE(zone);
- 		DNS_ZONE_TIME_ADD(&timenow, zone->refreshkeyinterval,
- 				  &timethen);
- 		zone->refreshkeytime = timethen;
--		UNLOCK_ZONE(zone);
- 
- 		for (key = ISC_LIST_HEAD(dnskeys);
- 		     key != NULL;
-@@ -18431,12 +18433,10 @@ zone_rekey(dns_zone_t *zone) {
- 				continue;
- 
- 			DNS_ZONE_TIME_ADD(&timenow, then - now, &timethen);
--			LOCK_ZONE(zone);
- 			if (isc_time_compare(&timethen,
- 					     &zone->refreshkeytime) < 0) {
- 				zone->refreshkeytime = timethen;
- 			}
--			UNLOCK_ZONE(zone);
- 		}
- 
- 		zone_settimer(zone, &timenow);
-@@ -18444,6 +18444,7 @@ zone_rekey(dns_zone_t *zone) {
- 		isc_time_formattimestamp(&zone->refreshkeytime, timebuf, 80);
- 		dns_zone_log(zone, ISC_LOG_INFO, "next key event: %s", timebuf);
- 	}
-+	UNLOCK_ZONE(zone);
- 
-  done:
- 	dns_diff_clear(&diff);
--- 
-2.21.0
-
diff --git a/bind-9.11-rh1736762-8.patch b/bind-9.11-rh1736762-8.patch
deleted file mode 100644
index f04a98a..0000000
--- a/bind-9.11-rh1736762-8.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From 7e844b093b0442bdc5cdc5aefd56fdc05f9be88f Mon Sep 17 00:00:00 2001
-From: Mark Andrews <marka@isc.org>
-Date: Thu, 12 Dec 2019 19:17:39 +1100
-Subject: [PATCH] acquire task lock before calling push_readyq for task->flags
- access
-
-(cherry picked from commit 7c94d2cd7dfaa3f04cd86ad9ed97e8366a774a4c)
----
- lib/isc/task.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/lib/isc/task.c b/lib/isc/task.c
-index 329604a465..f9c4354bd2 100644
---- a/lib/isc/task.c
-+++ b/lib/isc/task.c
-@@ -473,7 +473,9 @@ task_ready(isc__task_t *task) {
- 	XTRACE("task_ready");
- 
- 	LOCK(&manager->lock);
-+	LOCK(&task->lock);
- 	push_readyq(manager, task);
-+	UNLOCK(&task->lock);
- #ifdef USE_WORKER_THREADS
- 	if (manager->mode == isc_taskmgrmode_normal || has_privilege)
- 		SIGNAL(&manager->work_available);
-@@ -1263,7 +1265,9 @@ dispatch(isc__taskmgr_t *manager) {
- 				 * might even hurt rather than help.
- 				 */
- #ifdef USE_WORKER_THREADS
-+				LOCK(&task->lock);
- 				push_readyq(manager, task);
-+				UNLOCK(&task->lock);
- #else
- 				ENQUEUE(new_ready_tasks, task, ready_link);
- 				if ((task->flags & TASK_F_PRIVILEGED) != 0)
--- 
-2.21.0
-
diff --git a/bind-9.11-serve-stale-dbfix.patch b/bind-9.11-serve-stale-dbfix.patch
deleted file mode 100644
index 7091871..0000000
--- a/bind-9.11-serve-stale-dbfix.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From 20848d8284951481051f6ebdeb8128c05c7e82e2 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Mon, 11 Nov 2019 16:56:52 +0100
-Subject: [PATCH] Move stale_ttl from middle to the end
-
-bind-dyndb-ldap is using rdataset structure. Do not modify its body,
-move stale_ttl to the end. Make it binary compatible.
----
- lib/dns/include/dns/rdataset.h | 10 +++++-----
- 1 file changed, 5 insertions(+), 5 deletions(-)
-
-diff --git a/lib/dns/include/dns/rdataset.h b/lib/dns/include/dns/rdataset.h
-index 97071ed496..a0c6afe624 100644
---- a/lib/dns/include/dns/rdataset.h
-+++ b/lib/dns/include/dns/rdataset.h
-@@ -137,11 +137,6 @@ struct dns_rdataset {
- 	dns_rdataclass_t		rdclass;
- 	dns_rdatatype_t			type;
- 	dns_ttl_t			ttl;
--	/*
--	 * Stale ttl is used to see how long this RRset can still be used
--	 * to serve to clients, after the TTL has expired.
--	 */
--	dns_ttl_t			stale_ttl;
- 	dns_trust_t			trust;
- 	dns_rdatatype_t			covers;
- 
-@@ -178,6 +173,11 @@ struct dns_rdataset {
- 	void *				private7;
- 	/*@}*/
- 
-+	/*
-+	 * Stale ttl is used to see how long this RRset can still be used
-+	 * to serve to clients, after the TTL has expired.
-+	 */
-+	dns_ttl_t			stale_ttl;
- };
- 
- /*!
--- 
-2.20.1
-
diff --git a/bind-9.11-serve-stale.patch b/bind-9.11-serve-stale.patch
deleted file mode 100644
index 6baa4a7..0000000
--- a/bind-9.11-serve-stale.patch
+++ /dev/null
@@ -1,3858 +0,0 @@
-From 3829de3d5caba113d5a8560c5ff0d2a32b57a7fc Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Thu, 7 Nov 2019 14:31:03 +0100
-Subject: [PATCH] Implement serve-stale in 9.11
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Squashed commit of the following:
-
-commit 32f47f36e545223b2a4757588d7bd4af8c5f5760
-Author: Petr Menšík <pemensik@redhat.com>
-Date:   Tue Sep 3 18:45:54 2019 +0200
-
-    convert serve_stale to db_test
-
-    Manual checkout from commit e8f61dd315c5d1c88915bb79361182241e42e47a.
-    Use test modified for cmocka, including serve-stale tests.
-
-commit 071eb1fb0786f6d614955813d99c3caabff33383
-Author: Michał Kępień <michal@isc.org>
-Date:   Fri Apr 27 09:13:26 2018 +0200
-
-    Detect recursion loops during query processing
-
-    Interrupt query processing when query_recurse() attempts to ask the same
-    name servers for the same QNAME/QTYPE tuple for two times in a row as
-    this indicates that query processing may be stuck for an indeterminate
-    period of time, e.g. due to interactions between features able to
-    restart query_lookup().
-
-    (cherry picked from commit 46bb4dd124ed031d4c219d1e37a3c6322092e30c)
-
-commit c12090bc361c7fa4522ace73899e778e44e9b295
-Author: Petr Menšík <pemensik@redhat.com>
-Date:   Mon Sep 2 11:12:32 2019 +0200
-
-    Fix test name used in whole test-suite
-
-    Correct name is serve-stale
-
-commit ff4d826f295d268a248ca06941d65c903e1b405c
-Author: Petr Menšík <pemensik@redhat.com>
-Date:   Fri Aug 30 17:43:28 2019 +0200
-
-    Clean files in more generic rules
-
-commit 8d81ed15eda9a2a11e1433d1fdddacfc772708b6
-Author: Petr Menšík <pemensik@redhat.com>
-Date:   Thu Aug 29 21:27:57 2019 +0200
-
-    [rt46602] Pass port numbers to tests via environment variables
-
-    Manually applied commit f5d8f079008b648d2e343543e66dd728054c6101
-
-commit 94fafa477891576286def8c4041ad127734af2d1
-Author: Tony Finch <dot@dotat.at>
-Date:   Tue Apr 10 16:17:57 2018 +0100
-
-    Move serve-stale logging to its own category, so that its verbosity can be curtailed.
-
-    (cherry picked from commit 4b442c309dfb2c8880b19af4133047655bb734df)
-
-commit e0c884bee98c3d2533dfaa667f58c6a80d8a3a00
-Author: Michał Kępień <michal@isc.org>
-Date:   Fri Apr 27 09:13:26 2018 +0200
-
-    Prevent check_stale_header() from leaking rdataset headers
-
-    check_stale_header() fails to update the pointer to the previous header
-    while processing rdataset headers eligible for serve-stale, thus
-    enabling rdataset headers to be leaked (i.e. disassociated from a node
-    and left on the relevant TTL heap) while iterating through a node.  This
-    can lead to several different assertion failures.  Add the missing
-    pointer update.
-
-    (cherry picked from commit 391fac1fc8d2e470287b5cc4344b3adb90c6f54a)
-
-commit d724cc1d80ee8d46113eaf82549d49636739b67c
-Author: Matthijs Mekking <matthijs@isc.org>
-Date:   Thu Jan 24 10:24:44 2019 +0100
-
-    Print in dump-file stale ttl
-
-    This change makes rndc dumpdb correctly print the "; stale" line.
-    It also provides extra information on how long this data may still
-    be served to clients (in other words how long the stale RRset may
-    still be used).
-
-    (cherry picked from commit 924ebc605db798e2a383ee5eaaebad739e7c789c)
-
-commit 625da4bd4590ac6108bb30eddd23ceffb245ae49
-Author: Michał Kępień <michal@isc.org>
-Date:   Mon Oct 22 15:26:45 2018 +0200
-
-    Check serve-stale behavior with a cold cache
-
-    Ensure that serve-stale works as expected when returning stale answers
-    is enabled, the authoritative server does not respond, and there is no
-    cached answer available.
-
-    (cherry picked from commit 27cfe83a388147edfa0451b28c06c746912ea684)
-
-commit d67ae10461c409fdafdbbe64f857db2552b71059
-Author: Michał Kępień <michal@isc.org>
-Date:   Mon Oct 22 15:26:45 2018 +0200
-
-    Check TTL of stale answers
-
-    Make sure that stale answers returned when the serve-stale feature is
-    enabled have a TTL matching the value of the stale-answer-ttl setting.
-
-    (cherry picked from commit 893ab37ce78c658215bd3a019f25afe795b37d5a)
-
-commit 50459107805e68e4a63a8e497bf58ef3ce013ddb
-Author: Michał Kępień <michal@isc.org>
-Date:   Mon Jul 9 14:35:12 2018 +0200
-
-    Do not use Net::DNS::Nameserver in the "serve-stale" system test
-
-    Net::DNS versions older than 0.67 respond to queries sent to a
-    Net::DNS::Nameserver even if its ReplyHandler returns undef.  This makes
-    the "serve-stale" system test fail as it takes advantage of the newer
-    behavior.  Since the latest Net::DNS version available with stock
-    RHEL/CentOS 6 packages is 0.65 and we officially support that operating
-    system, bin/tests/system/serve-stale/ans2/ans.pl should behave
-    consistently for various Net::DNS versions.  Ensure that by reworking it
-    so that it does not use Net::DNS::Nameserver.
-
-    (cherry picked from commit c4209418a50c09142375f7edadca731c526f3d3a)
-
-commit 4b5befc714bb386bd245b1c14ce3bce5ae6fb5fa
-Author: Petr Menšík <pemensik@redhat.com>
-Date:   Tue Jun 5 21:38:29 2018 +0200
-
-    Fix server-stale requirement, skip without Time::HiRes
-
-    (cherry picked from commit 7a0c7bf9c8e6a724e52635eed213ad25b9504e66)
-
-commit 5ce51a3a7e5ef3087c4d022e3fca42fb2fd0c996
-Author: Ondřej Surý <ondrej@sury.org>
-Date:   Wed Oct 18 13:01:14 2017 +0200
-
-    [rt46602] Update server-stale test to run on port passed from run.sh script
-
-    (cherry picked from commit f83ebd34b9555a5a834c58146035173bcbd01dda)
-
-commit 3954a9bf3437f6fab050294a7f2f954a23d161ec
-Author: Ondřej Surý <ondrej@sury.org>
-Date:   Wed Oct 18 14:18:59 2017 +0200
-
-    [rt46602] Add serve-stale working files to .gitignore
-
-    (cherry picked from commit cba162e70e7fac43435a606106841a69ce468526)
-
-commit 112aa21f5fa875494820e4d1eb70e41e10e1aae7
-Author: Mark Andrews <marka@isc.org>
-Date:   Thu Oct 12 15:33:47 2017 +1100
-
-    test for Net::DNS::Nameserver
-
-    (cherry picked from commit 5b60d0608ac2852753180b762d1917163f9dc315)
-
-commit 9d610e46af8a636f44914cee4cf8b2016054db1e
-Author: Mark Andrews <marka@isc.org>
-Date:   Thu Oct 12 15:19:45 2017 +1100
-
-    add Net::DNS prerequiste test
-
-    (cherry picked from commit fa644181f51559da3e3913acd72dbc3f6d916e71)
-
-commit e4ea7ba88d9a9a0c79579400c68a5dabe03e8572
-Author: Mark Andrews <marka@isc.org>
-Date:   Wed Sep 6 19:26:10 2017 +1000
-
-    add quotes arount $send_response
-
-    (cherry picked from commit 023ab19634b287543169e9b7b5259f3126cd60ff)
-
-commit 0af0c5d33c2de34da164571288b650282c6be10a
-Author: Mark Andrews <marka@isc.org>
-Date:   Thu Nov 23 16:11:49 2017 +1100
-
-    initalise serve_stale_ttl
-
-    (cherry picked from commit 2f4e0e5a81278f59037bf06ae99ff52245cd57e9)
-
-commit fbadd90ee81863d617c4c319d5f0079b877fe102
-Author: Evan Hunt <each@isc.org>
-Date:   Thu Sep 14 11:48:21 2017 -0700
-
-    [master] add thanks to APNIC and add missing note for serve-stale
-
-commit deb8adaa59955970b9d2f2fe58060a3cbf08312b
-Author: Mark Andrews <marka@isc.org>
-Date:   Wed Sep 6 12:16:10 2017 +1000
-
-    silence 'staleanswersok' may be used uninitialized in this function warning. [RT #14147
-
-commit 0e2d03823768dc545015e6ce309777210f4a9f85
-Author: Petr Menšík <pemensik@redhat.com>
-Date:   Thu Aug 29 19:57:58 2019 +0200
-
-    More fixes to merge
-
-commit 360e25ffe7623ea0a2eec49395001f4940967776
-Author: Mark Andrews <marka@isc.org>
-Date:   Wed Sep 6 09:58:29 2017 +1000
-
-    4700.   [func]          Serving of stale answers is now supported. This
-                            allows named to provide stale cached answers when
-                            the authoritative server is under attack.
-                            See max-stale-ttl, stale-answer-enable,
-                            stale-answer-ttl. [RT #44790]
-
-Signed-off-by: Petr Menšík <pemensik@redhat.com>
----
- bin/named/config.c                            |   9 +-
- bin/named/control.c                           |   2 +
- bin/named/include/named/control.h             |   1 +
- bin/named/include/named/log.h                 |   1 +
- bin/named/include/named/query.h               |  15 +
- bin/named/include/named/server.h              |  13 +-
- bin/named/log.c                               |   1 +
- bin/named/query.c                             | 164 +++++-
- bin/named/server.c                            | 177 +++++-
- bin/named/statschannel.c                      |   6 +
- bin/rndc/rndc.c                               |   2 +
- bin/rndc/rndc.docbook                         |  19 +
- bin/tests/system/chain/prereq.sh              |   7 +
- bin/tests/system/conf.sh.in                   |   2 +-
- bin/tests/system/dyndb/driver/db.c            |   2 +
- bin/tests/system/serve-stale/.gitignore       |  11 +
- bin/tests/system/serve-stale/ans2/ans.pl.in   | 178 ++++++
- bin/tests/system/serve-stale/clean.sh         |  15 +
- .../system/serve-stale/ns1/named1.conf.in     |  35 ++
- .../system/serve-stale/ns1/named2.conf.in     |  35 ++
- bin/tests/system/serve-stale/ns1/root.db      |   5 +
- .../system/serve-stale/ns3/named.conf.in      |  35 ++
- bin/tests/system/serve-stale/prereq.sh        |  38 ++
- bin/tests/system/serve-stale/setup.sh         |  13 +
- bin/tests/system/serve-stale/tests.sh         | 536 ++++++++++++++++++
- doc/arm/Bv9ARM-book.xml                       |  69 ++-
- doc/arm/logging-categories.xml                |  11 +
- doc/arm/notes-rh-changes.xml                  |  14 +-
- doc/misc/options                              |  10 +
- lib/bind9/check.c                             |  78 ++-
- lib/dns/cache.c                               |  38 +-
- lib/dns/db.c                                  |  22 +
- lib/dns/ecdb.c                                |   4 +-
- lib/dns/include/dns/cache.h                   |  21 +
- lib/dns/include/dns/db.h                      |  35 ++
- lib/dns/include/dns/rdataset.h                |  11 +
- lib/dns/include/dns/resolver.h                |  43 +-
- lib/dns/include/dns/types.h                   |   6 +
- lib/dns/include/dns/view.h                    |   3 +
- lib/dns/master.c                              |  14 +-
- lib/dns/masterdump.c                          |  23 +
- lib/dns/rbtdb.c                               | 207 ++++++-
- lib/dns/resolver.c                            |  78 ++-
- lib/dns/sdb.c                                 |   4 +-
- lib/dns/sdlz.c                                |   4 +-
- lib/dns/tests/db_test.c                       | 198 ++++++-
- lib/dns/view.c                                |   3 +
- lib/isccfg/namedconf.c                        |   5 +
- 48 files changed, 2121 insertions(+), 102 deletions(-)
- create mode 100644 bin/tests/system/serve-stale/.gitignore
- create mode 100644 bin/tests/system/serve-stale/ans2/ans.pl.in
- create mode 100644 bin/tests/system/serve-stale/clean.sh
- create mode 100644 bin/tests/system/serve-stale/ns1/named1.conf.in
- create mode 100644 bin/tests/system/serve-stale/ns1/named2.conf.in
- create mode 100644 bin/tests/system/serve-stale/ns1/root.db
- create mode 100644 bin/tests/system/serve-stale/ns3/named.conf.in
- create mode 100644 bin/tests/system/serve-stale/prereq.sh
- create mode 100644 bin/tests/system/serve-stale/setup.sh
- create mode 100755 bin/tests/system/serve-stale/tests.sh
-
-diff --git a/bin/named/config.c b/bin/named/config.c
-index 63da4b0..b598f9b 100644
---- a/bin/named/config.c
-+++ b/bin/named/config.c
-@@ -182,13 +182,14 @@ options {\n\
- #ifdef HAVE_LMDB
- "	lmdb-mapsize 32M;\n"
- #endif
--"	max-acache-size 16M;\n\
--	max-cache-size 90%;\n\
-+"	max-cache-size 90%;\n\
-+	max-acache-size 16M;\n\
- 	max-cache-ttl 604800; /* 1 week */\n\
- 	max-clients-per-query 100;\n\
- 	max-ncache-ttl 10800; /* 3 hours */\n\
- 	max-recursion-depth 7;\n\
- 	max-recursion-queries 75;\n\
-+	max-stale-ttl 604800; /* 1 week */\n\
- 	message-compression yes;\n\
- #	min-roots <obsolete>;\n\
- 	minimal-any false;\n\
-@@ -203,10 +204,14 @@ options {\n\
- 	request-expire true;\n\
- 	request-ixfr true;\n\
- 	require-server-cookie no;\n\
-+	resolver-nonbackoff-tries 3;\n\
-+	resolver-retry-interval 800; /* in milliseconds */\n\
- #	rfc2308-type1 <obsolete>;\n\
- 	root-key-sentinel yes;\n\
- 	servfail-ttl 1;\n\
- #	sortlist <none>\n\
-+	stale-answer-enable false;\n\
-+	stale-answer-ttl 1; /* 1 second */\n\
- #	topology <none>\n\
- 	transfer-format many-answers;\n\
- 	v6-bias 50;\n\
-diff --git a/bin/named/control.c b/bin/named/control.c
-index df23c26..8b79850 100644
---- a/bin/named/control.c
-+++ b/bin/named/control.c
-@@ -282,6 +282,8 @@ ns_control_docommand(isccc_sexpr_t *message, bool readonly,
- 		result = ns_server_validation(ns_g_server, lex, text);
- 	} else if (command_compare(command, NS_COMMAND_ZONESTATUS)) {
- 		result = ns_server_zonestatus(ns_g_server, lex, text);
-+	} else if (command_compare(command, NS_COMMAND_SERVESTALE)) {
-+		result = ns_server_servestale(ns_g_server, lex, text);
- 	} else {
- 		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
- 			      NS_LOGMODULE_CONTROL, ISC_LOG_WARNING,
-diff --git a/bin/named/include/named/control.h b/bin/named/include/named/control.h
-index 8705fdd..1634154 100644
---- a/bin/named/include/named/control.h
-+++ b/bin/named/include/named/control.h
-@@ -69,6 +69,7 @@
- #define NS_COMMAND_MKEYS	"managed-keys"
- #define NS_COMMAND_DNSTAPREOPEN	"dnstap-reopen"
- #define NS_COMMAND_DNSTAP	"dnstap"
-+#define NS_COMMAND_SERVESTALE	"serve-stale"
- 
- isc_result_t
- ns_controls_create(ns_server_t *server, ns_controls_t **ctrlsp);
-diff --git a/bin/named/include/named/log.h b/bin/named/include/named/log.h
-index 56bfcd4..cd8db60 100644
---- a/bin/named/include/named/log.h
-+++ b/bin/named/include/named/log.h
-@@ -32,6 +32,7 @@
- #define NS_LOGCATEGORY_UPDATE_SECURITY	(&ns_g_categories[6])
- #define NS_LOGCATEGORY_QUERY_ERRORS	(&ns_g_categories[7])
- #define NS_LOGCATEGORY_TAT		(&ns_g_categories[8])
-+#define NS_LOGCATEGORY_SERVE_STALE	(&ns_g_categories[9])
- 
- /*
-  * Backwards compatibility.
-diff --git a/bin/named/include/named/query.h b/bin/named/include/named/query.h
-index 9661f56..445b578 100644
---- a/bin/named/include/named/query.h
-+++ b/bin/named/include/named/query.h
-@@ -35,6 +35,18 @@ typedef struct ns_dbversion {
- 	ISC_LINK(struct ns_dbversion)	link;
- } ns_dbversion_t;
- 
-+/*%
-+ * nameserver recursion parameters, to uniquely identify a recursion
-+ * query; this is used to detect a recursion loop
-+ */
-+typedef struct ns_query_recparam {
-+	dns_rdatatype_t			qtype;
-+	dns_name_t *			qname;
-+	dns_fixedname_t			fqname;
-+	dns_name_t *			qdomain;
-+	dns_fixedname_t			fqdomain;
-+} ns_query_recparam_t;
-+
- /*% nameserver query structure */
- struct ns_query {
- 	unsigned int			attributes;
-@@ -63,6 +75,7 @@ struct ns_query {
- 	unsigned int			dns64_aaaaoklen;
- 	unsigned int			dns64_options;
- 	unsigned int			dns64_ttl;
-+
- 	struct {
- 		dns_db_t *      	db;
- 		dns_zone_t *      	zone;
-@@ -76,6 +89,8 @@ struct ns_query {
- 		bool		authoritative;
- 		bool		is_zone;
- 	} redirect;
-+
-+	ns_query_recparam_t		recparam;
- 	dns_keytag_t root_key_sentinel_keyid;
- 	bool root_key_sentinel_is_ta;
- 	bool root_key_sentinel_not_ta;
-diff --git a/bin/named/include/named/server.h b/bin/named/include/named/server.h
-index c92922e..588bf2d 100644
---- a/bin/named/include/named/server.h
-+++ b/bin/named/include/named/server.h
-@@ -226,7 +226,10 @@ enum {
- 
- 	dns_nsstatscounter_reclimitdropped = 58,
- 
--	dns_nsstatscounter_max = 59
-+	dns_nsstatscounter_trystale = 59,
-+	dns_nsstatscounter_usedstale = 60,
-+
-+	dns_nsstatscounter_max = 61
- };
- 
- /*%
-@@ -765,4 +768,12 @@ ns_server_mkeys(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text);
- isc_result_t
- ns_server_dnstap(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text);
- 
-+
-+/*%
-+ * Control whether stale answers are served or not when configured in
-+ * named.conf.
-+ */
-+isc_result_t
-+ns_server_servestale(ns_server_t *server, isc_lex_t *lex,
-+		     isc_buffer_t **text);
- #endif /* NAMED_SERVER_H */
-diff --git a/bin/named/log.c b/bin/named/log.c
-index 3aa25e9..12f178b 100644
---- a/bin/named/log.c
-+++ b/bin/named/log.c
-@@ -38,6 +38,7 @@ static isc_logcategory_t categories[] = {
- 	{ "update-security",		0 },
- 	{ "query-errors",		0 },
- 	{ "trust-anchor-telemetry",	0 },
-+	{ "serve-stale",                0 },
- 	{ NULL, 			0 }
- };
- 
-diff --git a/bin/named/query.c b/bin/named/query.c
-index 0940714..882d69c 100644
---- a/bin/named/query.c
-+++ b/bin/named/query.c
-@@ -125,10 +125,14 @@
- #define REDIRECT(c)		(((c)->query.attributes & \
- 				  NS_QUERYATTR_REDIRECT) != 0)
- 
--/*% No QNAME Proof? */
-+/*% Does the rdataset 'r' have an attached 'No QNAME Proof'? */
- #define NOQNAME(r)		(((r)->attributes & \
- 				  DNS_RDATASETATTR_NOQNAME) != 0)
- 
-+/*% Does the rdataset 'r' contain a stale answer? */
-+#define STALE(r)		(((r)->attributes & \
-+				  DNS_RDATASETATTR_STALE) != 0)
-+
- #ifdef WANT_QUERYTRACE
- static inline void
- client_trace(ns_client_t *client, int level, const char *message) {
-@@ -217,6 +221,10 @@ static bool
- rpz_ck_dnssec(ns_client_t *client, isc_result_t qresult,
- 	      dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset);
- 
-+static void
-+recparam_update(ns_query_recparam_t *param, dns_rdatatype_t qtype,
-+		const dns_name_t *qname, const dns_name_t *qdomain);
-+
- /*%
-  * Increment query statistics counters.
-  */
-@@ -470,6 +478,7 @@ query_reset(ns_client_t *client, bool everything) {
- 	client->query.isreferral = false;
- 	client->query.dns64_options = 0;
- 	client->query.dns64_ttl = UINT32_MAX;
-+	recparam_update(&client->query.recparam, 0, NULL, NULL);
- 	client->query.root_key_sentinel_keyid = 0;
- 	client->query.root_key_sentinel_is_ta = false;
- 	client->query.root_key_sentinel_not_ta = false;
-@@ -4254,6 +4263,54 @@ query_prefetch(ns_client_t *client, dns_name_t *qname,
- 	dns_rdataset_clearprefetch(rdataset);
- }
- 
-+/*%
-+ * Check whether the recursion parameters in 'param' match the current query's
-+ * recursion parameters provided in 'qtype', 'qname', and 'qdomain'.
-+ */
-+static bool
-+recparam_match(const ns_query_recparam_t *param, dns_rdatatype_t qtype,
-+	       const dns_name_t *qname, const dns_name_t *qdomain)
-+{
-+	REQUIRE(param != NULL);
-+
-+	return (param->qtype == qtype &&
-+	        param->qname != NULL && qname != NULL &&
-+	        param->qdomain != NULL && qdomain != NULL &&
-+	        dns_name_equal(param->qname, qname) &&
-+	        dns_name_equal(param->qdomain, qdomain));
-+}
-+
-+/*%
-+ * Update 'param' with current query's recursion parameters provided in
-+ * 'qtype', 'qname', and 'qdomain'.
-+ */
-+static void
-+recparam_update(ns_query_recparam_t *param, dns_rdatatype_t qtype,
-+		const dns_name_t *qname, const dns_name_t *qdomain)
-+{
-+	isc_result_t result;
-+
-+	REQUIRE(param != NULL);
-+
-+	param->qtype = qtype;
-+
-+	if (qname == NULL) {
-+		param->qname = NULL;
-+	} else {
-+		param->qname = dns_fixedname_initname(&param->fqname);
-+		result = dns_name_copy(qname, param->qname, NULL);
-+		RUNTIME_CHECK(result == ISC_R_SUCCESS);
-+	}
-+
-+	if (qdomain == NULL) {
-+		param->qdomain = NULL;
-+	} else {
-+		param->qdomain = dns_fixedname_initname(&param->fqdomain);
-+		result = dns_name_copy(qdomain, param->qdomain, NULL);
-+		RUNTIME_CHECK(result == ISC_R_SUCCESS);
-+	}
-+}
-+
- static isc_result_t
- query_recurse(ns_client_t *client, dns_rdatatype_t qtype, dns_name_t *qname,
- 	      dns_name_t *qdomain, dns_rdataset_t *nameservers,
-@@ -4263,6 +4320,19 @@ query_recurse(ns_client_t *client, dns_rdatatype_t qtype, dns_name_t *qname,
- 	dns_rdataset_t *rdataset, *sigrdataset;
- 	isc_sockaddr_t *peeraddr;
- 
-+	/*
-+	 * Check recursion parameters from the previous query to see if they
-+	 * match.  If not, update recursion parameters and proceed.
-+	 */
-+	if (recparam_match(&client->query.recparam, qtype, qname, qdomain)) {
-+		ns_client_log(client, NS_LOGCATEGORY_CLIENT,
-+			      NS_LOGMODULE_QUERY, ISC_LOG_INFO,
-+			      "recursion loop detected");
-+		return (ISC_R_FAILURE);
-+	}
-+
-+	recparam_update(&client->query.recparam, qtype, qname, qdomain);
-+
- 	if (!resuming)
- 		inc_stats(client, dns_nsstatscounter_recursion);
- 
-@@ -6780,6 +6850,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
- 	int line = -1;
- 	bool dns64_exclude, dns64, rpz;
- 	bool nxrewrite = false;
-+	bool want_stale = false;
- 	bool redirected = false;
- 	dns_clientinfomethods_t cm;
- 	dns_clientinfo_t ci;
-@@ -7089,6 +7160,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
- 		type = qtype;
- 
-  restart:
-+	// query_start
- 	CTRACE(ISC_LOG_DEBUG(3), "query_find: restart");
- 	want_restart = false;
- 	authoritative = false;
-@@ -7233,6 +7305,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
- 	}
- 
-  db_find:
-+	// query_lookup
- 	CTRACE(ISC_LOG_DEBUG(3), "query_find: db_find");
- 	/*
- 	 * We'll need some resources...
-@@ -7290,6 +7363,35 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
- 	if (!is_zone)
- 		dns_cache_updatestats(client->view->cache, result);
- 
-+	if (want_stale) {
-+		char namebuf[DNS_NAME_FORMATSIZE];
-+		bool success;
-+
-+		client->query.dboptions &= ~DNS_DBFIND_STALEOK;
-+		want_stale = false;
-+
-+		if (dns_rdataset_isassociated(rdataset) &&
-+		    dns_rdataset_count(rdataset) > 0 &&
-+		    STALE(rdataset)) {
-+			rdataset->ttl = client->view->staleanswerttl;
-+			success = true;
-+		} else {
-+			success = false;
-+		}
-+
-+		dns_name_format(client->query.qname,
-+				namebuf, sizeof(namebuf));
-+		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_SERVE_STALE,
-+			      NS_LOGMODULE_QUERY, ISC_LOG_INFO,
-+			      "%s resolver failure, stale answer %s",
-+			      namebuf, success ? "used" : "unavailable");
-+
-+		if (!success) {
-+			QUERY_ERROR(DNS_R_SERVFAIL);
-+			goto cleanup;
-+		}
-+	}
-+
-  resume:
- 	CTRACE(ISC_LOG_DEBUG(3), "query_find: resume");
- 
-@@ -7635,6 +7737,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
- 		 * The cache doesn't even have the root NS.  Get them from
- 		 * the hints DB.
- 		 */
-+		// query_notfound
- 		INSIST(!is_zone);
- 		if (db != NULL)
- 			dns_db_detach(&db);
-@@ -7697,12 +7800,14 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
- 		 */
- 		/* FALLTHROUGH */
- 	case DNS_R_DELEGATION:
-+		// query_delegation
- 		authoritative = false;
- 		if (is_zone) {
- 			/*
- 			 * Look to see if we are authoritative for the
- 			 * child zone if the query type is DS.
- 			 */
-+			// query_zone_delegation
- 			if (!RECURSIONOK(client) &&
- 			    (options & DNS_GETDB_NOEXACT) != 0 &&
- 			    qtype == dns_rdatatype_ds) {
-@@ -8089,6 +8194,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
- 						       false, true);
- 			}
- 		}
-+		// query_nxdomain
- 		if (dns_rdataset_isassociated(rdataset)) {
- 			/*
- 			 * If we've got a NSEC record, we need to save the
-@@ -8409,7 +8515,8 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
- 		/*
- 		 * If we have a zero ttl from the cache refetch it.
- 		 */
--		if (!is_zone && !resuming && rdataset->ttl == 0 &&
-+		// query_cname
-+		if (!is_zone && !resuming && !STALE(rdataset) && rdataset->ttl == 0 &&
- 		    RECURSIONOK(client))
- 		{
- 			if (dns_rdataset_isassociated(rdataset))
-@@ -8627,7 +8734,11 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
- 			 "query_find: unexpected error after resuming: %s",
- 			 isc_result_totext(result));
- 		CTRACE(ISC_LOG_ERROR, errmsg);
--		QUERY_ERROR(DNS_R_SERVFAIL);
-+		if (resuming) {
-+			want_stale = true;
-+		} else {
-+			QUERY_ERROR(DNS_R_SERVFAIL);
-+		}
- 		goto cleanup;
- 	}
- 
-@@ -8883,7 +8994,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
- 		/*
- 		 * If we have a zero ttl from the cache refetch it.
- 		 */
--		if (!is_zone && !resuming && rdataset->ttl == 0 &&
-+		if (!is_zone && !resuming && !STALE(rdataset) && rdataset->ttl == 0 &&
- 		    RECURSIONOK(client))
- 		{
- 			if (dns_rdataset_isassociated(rdataset))
-@@ -8894,6 +9005,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
- 			if (node != NULL)
- 				dns_db_detachnode(db, &node);
- 
-+			// query_respond
- 			INSIST(!REDIRECT(client));
- 			result = query_recurse(client, qtype,
- 					       client->query.qname,
-@@ -9174,6 +9286,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
- 				       dns_fixedname_name(&wildcardname),
- 				       true, false);
-  cleanup:
-+	// query_done
- 	CTRACE(ISC_LOG_DEBUG(3), "query_find: cleanup");
- 	/*
- 	 * General cleanup.
-@@ -9230,6 +9343,49 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
- 		goto restart;
- 	}
- 
-+	if (want_stale) {
-+		dns_ttl_t stale_ttl = 0;
-+		isc_result_t result;
-+		bool staleanswersok = false;
-+
-+		/*
-+		 * Stale answers only make sense if stale_ttl > 0 but
-+		 * we want rndc to be able to control returning stale
-+		 * answers if they are configured.
-+		 */
-+		dns_db_attach(client->view->cachedb, &db);
-+		result = dns_db_getservestalettl(db, &stale_ttl);
-+		if (result == ISC_R_SUCCESS && stale_ttl > 0)  {
-+			switch (client->view->staleanswersok) {
-+			case dns_stale_answer_yes:
-+				staleanswersok = true;
-+				break;
-+			case dns_stale_answer_conf:
-+				staleanswersok =
-+					client->view->staleanswersenable;
-+				break;
-+			case dns_stale_answer_no:
-+				staleanswersok = false;
-+				break;
-+			}
-+		} else {
-+			staleanswersok = false;
-+		}
-+
-+		if (staleanswersok) {
-+			client->query.dboptions |= DNS_DBFIND_STALEOK;
-+			inc_stats(client, dns_nsstatscounter_trystale);
-+			if (client->query.fetch != NULL)
-+				dns_resolver_destroyfetch(
-+						   &client->query.fetch);
-+			goto db_find;
-+		}
-+		dns_db_detach(&db);
-+		want_stale = false;
-+		QUERY_ERROR(DNS_R_SERVFAIL);
-+		goto cleanup;
-+	}
-+
- 	if (eresult != ISC_R_SUCCESS &&
- 	    (!PARTIALANSWER(client) || WANTRECURSION(client)
- 	     || eresult == DNS_R_DROP)) {
-diff --git a/bin/named/server.c b/bin/named/server.c
-index 36e0227..73c2b47 100644
---- a/bin/named/server.c
-+++ b/bin/named/server.c
-@@ -1720,7 +1720,8 @@ static bool
- cache_sharable(dns_view_t *originview, dns_view_t *view,
- 	       bool new_zero_no_soattl,
- 	       unsigned int new_cleaning_interval,
--	       uint64_t new_max_cache_size)
-+	       uint64_t new_max_cache_size,
-+	       uint32_t new_stale_ttl)
- {
- 	/*
- 	 * If the cache cannot even reused for the same view, it cannot be
-@@ -1735,6 +1736,7 @@ cache_sharable(dns_view_t *originview, dns_view_t *view,
- 	 */
- 	if (dns_cache_getcleaninginterval(originview->cache) !=
- 	    new_cleaning_interval ||
-+	    dns_cache_getservestalettl(originview->cache) != new_stale_ttl ||
- 	    dns_cache_getcachesize(originview->cache) != new_max_cache_size) {
- 		return (false);
- 	}
-@@ -3290,6 +3292,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
- 	size_t max_acache_size;
- 	size_t max_adb_size;
- 	uint32_t lame_ttl, fail_ttl;
-+	uint32_t max_stale_ttl;
- 	dns_tsig_keyring_t *ring = NULL;
- 	dns_view_t *pview = NULL;	/* Production view */
- 	isc_mem_t *cmctx = NULL, *hmctx = NULL;
-@@ -3318,6 +3321,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
- 	bool old_rpz_ok = false;
- 	isc_dscp_t dscp4 = -1, dscp6 = -1;
- 	dns_dyndbctx_t *dctx = NULL;
-+	unsigned int resolver_param;
- 
- 	REQUIRE(DNS_VIEW_VALID(view));
- 
-@@ -3732,6 +3736,24 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
- 	if (view->maxncachettl > 7 * 24 * 3600)
- 		view->maxncachettl = 7 * 24 * 3600;
- 
-+	obj = NULL;
-+	result = ns_config_get(maps, "max-stale-ttl", &obj);
-+	INSIST(result == ISC_R_SUCCESS);
-+	max_stale_ttl = cfg_obj_asuint32(obj);
-+
-+	obj = NULL;
-+	result = ns_config_get(maps, "stale-answer-enable", &obj);
-+	INSIST(result == ISC_R_SUCCESS);
-+	view->staleanswersenable = cfg_obj_asboolean(obj);
-+
-+	result = dns_viewlist_find(&ns_g_server->viewlist, view->name,
-+				   view->rdclass, &pview);
-+	if (result == ISC_R_SUCCESS) {
-+		view->staleanswersok = pview->staleanswersok;
-+		dns_view_detach(&pview);
-+	} else
-+		view->staleanswersok = dns_stale_answer_conf;
-+
- 	/*
- 	 * Configure the view's cache.
- 	 *
-@@ -3765,7 +3787,8 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
- 	nsc = cachelist_find(cachelist, cachename, view->rdclass);
- 	if (nsc != NULL) {
- 		if (!cache_sharable(nsc->primaryview, view, zero_no_soattl,
--				    cleaning_interval, max_cache_size)) {
-+				    cleaning_interval, max_cache_size,
-+				    max_stale_ttl)) {
- 			isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
- 				      NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
- 				      "views %s and %s can't share the cache "
-@@ -3864,9 +3887,15 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
- 
- 	dns_cache_setcleaninginterval(cache, cleaning_interval);
- 	dns_cache_setcachesize(cache, max_cache_size);
-+	dns_cache_setservestalettl(cache, max_stale_ttl);
- 
- 	dns_cache_detach(&cache);
- 
-+	obj = NULL;
-+	result = ns_config_get(maps, "stale-answer-ttl", &obj);
-+	INSIST(result == ISC_R_SUCCESS);
-+	view->staleanswerttl = ISC_MAX(cfg_obj_asuint32(obj), 1);
-+
- 	/*
- 	 * Resolver.
- 	 *
-@@ -4055,6 +4084,21 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
- 		maxbits = 4096;
- 	view->maxbits = maxbits;
- 
-+	/*
-+	 * Set resolver retry parameters.
-+	 */
-+	obj = NULL;
-+	CHECK(ns_config_get(maps, "resolver-retry-interval", &obj));
-+	resolver_param = cfg_obj_asuint32(obj);
-+	if (resolver_param > 0)
-+		dns_resolver_setretryinterval(view->resolver, resolver_param);
-+
-+	obj = NULL;
-+	CHECK(ns_config_get(maps, "resolver-nonbackoff-tries", &obj));
-+	resolver_param = cfg_obj_asuint32(obj);
-+	if (resolver_param > 0)
-+		dns_resolver_setnonbackofftries(view->resolver, resolver_param);
-+
- 	/*
- 	 * Set supported DNSSEC algorithms.
- 	 */
-@@ -14434,3 +14478,132 @@ ns_server_dnstap(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text) {
- 	return (ISC_R_NOTIMPLEMENTED);
- #endif
- }
-+
-+isc_result_t
-+ns_server_servestale(ns_server_t *server, isc_lex_t *lex,
-+		     isc_buffer_t **text)
-+{
-+	char *ptr, *classtxt, *viewtxt = NULL;
-+	char msg[128];
-+	dns_rdataclass_t rdclass = dns_rdataclass_in;
-+	dns_view_t *view;
-+	bool found = false;
-+	dns_stale_answer_t staleanswersok = dns_stale_answer_conf;
-+	bool wantstatus = false;
-+	isc_result_t result = ISC_R_SUCCESS;
-+
-+	/* Skip the command name. */
-+	ptr = next_token(lex, text);
-+	if (ptr == NULL)
-+		return (ISC_R_UNEXPECTEDEND);
-+
-+	ptr = next_token(lex, NULL);
-+	if (ptr == NULL)
-+		return (ISC_R_UNEXPECTEDEND);
-+
-+	if (strcasecmp(ptr, "on") == 0 || strcasecmp(ptr, "yes") == 0) {
-+		staleanswersok = dns_stale_answer_yes;
-+	} else if (strcasecmp(ptr, "off") == 0 || strcasecmp(ptr, "no") == 0) {
-+		staleanswersok = dns_stale_answer_no;
-+	} else if (strcasecmp(ptr, "reset") == 0) {
-+		staleanswersok = dns_stale_answer_conf;
-+	} else if (strcasecmp(ptr, "status") == 0) {
-+		wantstatus = true;
-+	} else
-+		return (DNS_R_SYNTAX);
-+
-+	/* Look for the optional class name. */
-+	classtxt = next_token(lex, text);
-+	if (classtxt != NULL) {
-+		/* Look for the optional view name. */
-+		viewtxt = next_token(lex, text);
-+	}
-+
-+	if (classtxt != NULL) {
-+		isc_textregion_t r;
-+
-+		r.base = classtxt;
-+		r.length = strlen(classtxt);
-+		result = dns_rdataclass_fromtext(&rdclass, &r);
-+		if (result != ISC_R_SUCCESS) {
-+			if (viewtxt == NULL) {
-+				viewtxt = classtxt;
-+				classtxt = NULL;
-+				result = ISC_R_SUCCESS;
-+			} else {
-+				snprintf(msg, sizeof(msg),
-+					 "unknown class '%s'", classtxt);
-+				(void) putstr(text, msg);
-+				goto cleanup;
-+			}
-+		}
-+	}
-+
-+	result = isc_task_beginexclusive(server->task);
-+	RUNTIME_CHECK(result == ISC_R_SUCCESS);
-+
-+	for (view = ISC_LIST_HEAD(server->viewlist);
-+	     view != NULL;
-+	     view = ISC_LIST_NEXT(view, link))
-+	{
-+		dns_ttl_t stale_ttl = 0;
-+		dns_db_t *db = NULL;
-+
-+		if (classtxt != NULL && rdclass != view->rdclass)
-+			continue;
-+
-+		if (viewtxt != NULL && strcmp(view->name, viewtxt) != 0)
-+			continue;
-+
-+		if (!wantstatus) {
-+			view->staleanswersok = staleanswersok;
-+			found = true;
-+			continue;
-+		}
-+
-+		db = NULL;
-+		dns_db_attach(view->cachedb, &db);
-+		(void)dns_db_getservestalettl(db, &stale_ttl);
-+		dns_db_detach(&db);
-+		if (found)
-+			CHECK(putstr(text, "\n"));
-+		CHECK(putstr(text, view->name));
-+		CHECK(putstr(text, ": "));
-+		switch (view->staleanswersok) {
-+		case dns_stale_answer_yes:
-+			if (stale_ttl > 0)
-+				CHECK(putstr(text, "on (rndc)"));
-+			else
-+				CHECK(putstr(text, "off (not-cached)"));
-+			break;
-+		case dns_stale_answer_no:
-+			CHECK(putstr(text, "off (rndc)"));
-+			break;
-+		case dns_stale_answer_conf:
-+			if (view->staleanswersenable && stale_ttl > 0)
-+				CHECK(putstr(text, "on"));
-+			else if (view->staleanswersenable)
-+				CHECK(putstr(text, "off (not-cached)"));
-+			else
-+				CHECK(putstr(text, "off"));
-+			break;
-+		}
-+		if (stale_ttl > 0) {
-+			snprintf(msg, sizeof(msg),
-+				 " (stale-answer-ttl=%u max-stale-ttl=%u)",
-+				 view->staleanswerttl, stale_ttl);
-+			CHECK(putstr(text, msg));
-+		}
-+		found = true;
-+	}
-+	isc_task_endexclusive(ns_g_server->task);
-+
-+	if (!found)
-+		result = ISC_R_NOTFOUND;
-+
-+cleanup:
-+	if (isc_buffer_usedlength(*text) > 0)
-+		(void) putnull(text);
-+
-+	return (result);
-+}
-diff --git a/bin/named/statschannel.c b/bin/named/statschannel.c
-index 6292bcb..fb034a7 100644
---- a/bin/named/statschannel.c
-+++ b/bin/named/statschannel.c
-@@ -300,6 +300,12 @@ init_desc(void) {
- 	SET_NSSTATDESC(reclimitdropped,
- 		       "queries dropped due to recursive client limit",
- 		       "RecLimitDropped");
-+	SET_NSSTATDESC(trystale,
-+		       "attempts to use stale cache data after lookup failure",
-+		       "QryTryStale");
-+	SET_NSSTATDESC(usedstale,
-+		       "successful uses of stale cache data after lookup failure",
-+		       "QryUsedStale");
- 	INSIST(i == dns_nsstatscounter_max);
- 
- 	/* Initialize resolver statistics */
-diff --git a/bin/rndc/rndc.c b/bin/rndc/rndc.c
-index 8083654..d519983 100644
---- a/bin/rndc/rndc.c
-+++ b/bin/rndc/rndc.c
-@@ -160,6 +160,8 @@ command is one of the following:\n\
-   scan		Scan available network interfaces for changes.\n\
-   secroots [view ...]\n\
- 		Write security roots to the secroots file.\n\
-+  serve-stale	( yes | no | reset ) [class [view]]\n\
-+		Control whether stale answers are returned\n\
-   showzone zone [class [view]]\n\
- 		Print a zone's configuration.\n\
-   sign zone [class [view]]\n\
-diff --git a/bin/rndc/rndc.docbook b/bin/rndc/rndc.docbook
-index 06b073a..6ae8e5d 100644
---- a/bin/rndc/rndc.docbook
-+++ b/bin/rndc/rndc.docbook
-@@ -688,6 +688,25 @@
- 	</listitem>
-       </varlistentry>
- 
-+      <varlistentry>
-+	<term><userinput>serve-stale ( on | off | reset | status) <optional><replaceable>class</replaceable> <optional><replaceable>view</replaceable></optional></optional></userinput></term>
-+	<listitem>
-+	  <para>
-+	    Enable, disable, or reset the serving of stale answers
-+	    as configured in named.conf. Serving of stale answers
-+	    will remain disabled across <filename>named.conf</filename>
-+	    reloads if disabled via rndc until it is reset via rndc.
-+	  </para>
-+	  <para>
-+	    Status will report whether serving of stale answers is
-+	    currently enabled, disabled or not configured for a
-+	    view.  If serving of stale records is configured then
-+	    the values of stale-answer-ttl and max-stale-ttl are
-+	    reported.
-+	  </para>
-+	</listitem>
-+      </varlistentry>
-+
-       <varlistentry>
- 	<term><userinput>secroots <optional>-</optional> <optional><replaceable>view ...</replaceable></optional></userinput></term>
- 	<listitem>
-diff --git a/bin/tests/system/chain/prereq.sh b/bin/tests/system/chain/prereq.sh
-index f3f1939..9ff3f07 100644
---- a/bin/tests/system/chain/prereq.sh
-+++ b/bin/tests/system/chain/prereq.sh
-@@ -48,3 +48,10 @@ else
-     echo_i "This test requires the Net::DNS::Nameserver library." >&2
-     exit 1
- fi
-+if $PERL -e 'use Net::DNS::Nameserver;' 2>/dev/null
-+then
-+	:
-+else
-+    echo "I:This test requires the Net::DNS::Nameserver library." >&2
-+    exit 1
-+fi
-diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
-index 1e5f221..96ee63e 100644
---- a/bin/tests/system/conf.sh.in
-+++ b/bin/tests/system/conf.sh.in
-@@ -128,7 +128,7 @@ PARALLELDIRS="dnssec rpzrecurse \
- 	reclimit redirect resolver rndc rootkeysentinel rpz \
- 	rrchecker rrl rrsetorder rsabigexponent runtime \
- 	sfcache smartsign sortlist \
--	spf staticstub statistics statschannel stub \
-+	spf serve-stale staticstub statistics statschannel stub \
- 	tcp tsig tsiggss \
- 	unknown upforwd verify views wildcard \
- 	xfer xferquota zero zonechecks"
-diff --git a/bin/tests/system/dyndb/driver/db.c b/bin/tests/system/dyndb/driver/db.c
-index 02aa6ab..a77c7de 100644
---- a/bin/tests/system/dyndb/driver/db.c
-+++ b/bin/tests/system/dyndb/driver/db.c
-@@ -629,6 +629,8 @@ static dns_dbmethods_t sampledb_methods = {
- 	hashsize,
- 	NULL,
- 	NULL,
-+	NULL,
-+	NULL,
- };
- 
- /* Auxiliary driver functions. */
-diff --git a/bin/tests/system/serve-stale/.gitignore b/bin/tests/system/serve-stale/.gitignore
-new file mode 100644
-index 0000000..2272eef
---- /dev/null
-+++ b/bin/tests/system/serve-stale/.gitignore
-@@ -0,0 +1,11 @@
-+/ans2/ans.pid
-+/ans2/ans.pl
-+/dig.out*
-+/ns1/named.conf
-+/ns3/named.conf
-+/ns3/root.bk
-+/rndc.out*
-+named.lock
-+named.pid
-+named.port
-+named.run
-diff --git a/bin/tests/system/serve-stale/ans2/ans.pl.in b/bin/tests/system/serve-stale/ans2/ans.pl.in
-new file mode 100644
-index 0000000..2b39eca
---- /dev/null
-+++ b/bin/tests/system/serve-stale/ans2/ans.pl.in
-@@ -0,0 +1,178 @@
-+#!/usr/bin/env perl
-+#
-+# Copyright (C) 2014-2016  Internet Systems Consortium, Inc. ("ISC")
-+#
-+# This Source Code Form is subject to the terms of the Mozilla Public
-+# License, v. 2.0. If a copy of the MPL was not distributed with this
-+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-+
-+use strict;
-+use warnings;
-+
-+use IO::File;
-+use IO::Socket;
-+use Getopt::Long;
-+use Net::DNS;
-+use Time::HiRes qw(usleep nanosleep);
-+
-+my $pidf = new IO::File "ans.pid", "w" or die "cannot open pid file: $!";
-+print $pidf "$$\n" or die "cannot write pid file: $!";
-+$pidf->close or die "cannot close pid file: $!";
-+sub rmpid { unlink "ans.pid"; exit 1; };
-+
-+$SIG{INT} = \&rmpid;
-+$SIG{TERM} = \&rmpid;
-+
-+my $send_response = 1;
-+
-+my $localaddr = "10.53.0.2";
-+my $localport = @PORT@;
-+my $udpsock = IO::Socket::INET->new(LocalAddr => "$localaddr",
-+   LocalPort => $localport, Proto => "udp", Reuse => 1) or die "$!";
-+
-+#
-+# Delegation
-+#
-+my $SOA = "example 300 IN SOA . . 0 0 0 0 300";
-+my $NS = "example 300 IN NS ns.example";
-+my $A = "ns.example 300 IN A $localaddr";
-+#
-+# Records to be TTL stretched
-+#
-+my $TXT = "data.example 1 IN TXT \"A text record with a 1 second ttl\"";
-+my $negSOA = "example 1 IN SOA . . 0 0 0 0 300";
-+
-+sub reply_handler {
-+    my ($qname, $qclass, $qtype) = @_;
-+    my ($rcode, @ans, @auth, @add);
-+
-+    print ("request: $qname/$qtype\n");
-+    STDOUT->flush();
-+
-+    # Control whether we send a response or not.
-+    # We always respond to control commands.
-+    if ($qname eq "enable" ) {
-+	if ($qtype eq "TXT") {
-+	    $send_response = 1;
-+            my $rr = new Net::DNS::RR("$qname 0 $qclass TXT \"$send_response\"");
-+            push @ans, $rr;
-+	}
-+	$rcode = "NOERROR";
-+        return ($rcode, \@ans, \@auth, \@add, { aa => 1 });
-+    } elsif ($qname eq "disable" ) {
-+	if ($qtype eq "TXT") {
-+	    $send_response = 0;
-+            my $rr = new Net::DNS::RR("$qname 0 $qclass TXT \"$send_response\"");
-+            push @ans, $rr;
-+	}
-+	$rcode = "NOERROR";
-+        return ($rcode, \@ans, \@auth, \@add, { aa => 1 });
-+    }
-+
-+    # If we are not responding to queries we are done.
-+    return if (!$send_response);
-+
-+    # Construct the response and send it.
-+    if ($qname eq "ns.example" ) {
-+	if ($qtype eq "A") {
-+	    my $rr = new Net::DNS::RR($A);
-+	    push @ans, $rr;
-+	} else {
-+	    my $rr = new Net::DNS::RR($SOA);
-+	    push @auth, $rr;
-+	}
-+	$rcode = "NOERROR";
-+    } elsif ($qname eq "example") {
-+	if ($qtype eq "NS") {
-+	    my $rr = new Net::DNS::RR($NS);
-+	    push @auth, $rr;
-+	    $rr = new Net::DNS::RR($A);
-+	    push @add, $rr;
-+	} elsif ($qtype eq "SOA") {
-+	    my $rr = new Net::DNS::RR($SOA);
-+	    push @ans, $rr;
-+	} else {
-+	    my $rr = new Net::DNS::RR($SOA);
-+	    push @auth, $rr;
-+	}
-+	$rcode = "NOERROR";
-+    } elsif ($qname eq "nodata.example") {
-+	my $rr = new Net::DNS::RR($negSOA);
-+	push @auth, $rr;
-+	$rcode = "NOERROR";
-+    } elsif ($qname eq "data.example") {
-+	if ($qtype eq "TXT") {
-+	    my $rr = new Net::DNS::RR($TXT);
-+	    push @ans, $rr;
-+	} else {
-+	    my $rr = new Net::DNS::RR($negSOA);
-+	    push @auth, $rr;
-+	}
-+	$rcode = "NOERROR";
-+    } elsif ($qname eq "nxdomain.example") {
-+	my $rr = new Net::DNS::RR($negSOA);
-+	push @auth, $rr;
-+	$rcode = "NXDOMAIN";
-+    } else {
-+        my $rr = new Net::DNS::RR($SOA);
-+	push @auth, $rr;
-+	$rcode = "NXDOMAIN";
-+    }
-+
-+    # mark the answer as authoritive (by setting the 'aa' flag
-+    return ($rcode, \@ans, \@auth, \@add, { aa => 1 });
-+}
-+
-+GetOptions(
-+    'port=i' => \$localport,
-+);
-+
-+my $rin;
-+my $rout;
-+
-+for (;;) {
-+	$rin = '';
-+	vec($rin, fileno($udpsock), 1) = 1;
-+
-+	select($rout = $rin, undef, undef, undef);
-+
-+	if (vec($rout, fileno($udpsock), 1)) {
-+		my ($buf, $request, $err);
-+		$udpsock->recv($buf, 512);
-+
-+		if ($Net::DNS::VERSION > 0.68) {
-+			$request = new Net::DNS::Packet(\$buf, 0);
-+			$@ and die $@;
-+		} else {
-+			my $err;
-+			($request, $err) = new Net::DNS::Packet(\$buf, 0);
-+			$err and die $err;
-+		}
-+
-+		my @questions = $request->question;
-+		my $qname = $questions[0]->qname;
-+		my $qclass = $questions[0]->qclass;
-+		my $qtype = $questions[0]->qtype;
-+		my $id = $request->header->id;
-+
-+		my ($rcode, $ans, $auth, $add, $headermask) = reply_handler($qname, $qclass, $qtype);
-+
-+		if (!defined($rcode)) {
-+			print "  Silently ignoring query\n";
-+			next;
-+		}
-+
-+		my $reply = Net::DNS::Packet->new();
-+		$reply->header->qr(1);
-+		$reply->header->aa(1) if $headermask->{'aa'};
-+		$reply->header->id($id);
-+		$reply->header->rcode($rcode);
-+		$reply->push("question",   @questions);
-+		$reply->push("answer",     @$ans)  if $ans;
-+		$reply->push("authority",  @$auth) if $auth;
-+		$reply->push("additional", @$add)  if $add;
-+
-+		my $num_chars = $udpsock->send($reply->data);
-+		print "  Sent $num_chars bytes via UDP\n";
-+	}
-+}
-diff --git a/bin/tests/system/serve-stale/clean.sh b/bin/tests/system/serve-stale/clean.sh
-new file mode 100644
-index 0000000..2397326
---- /dev/null
-+++ b/bin/tests/system/serve-stale/clean.sh
-@@ -0,0 +1,15 @@
-+# Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
-+#
-+# This Source Code Form is subject to the terms of the Mozilla Public
-+# License, v. 2.0. If a copy of the MPL was not distributed with this
-+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-+
-+rm -f test.output
-+rm -f dig.out.test*
-+rm -f ans2/ans.pl
-+rm -f ns3/root.bk
-+rm -f rndc.out.test*
-+rm -f ns*/named.memstats
-+rm -f ns*/managed-keys.bind
-+rm -f ns*/named.conf
-+rm -f ns*/named.run
-diff --git a/bin/tests/system/serve-stale/ns1/named1.conf.in b/bin/tests/system/serve-stale/ns1/named1.conf.in
-new file mode 100644
-index 0000000..8a75a10
---- /dev/null
-+++ b/bin/tests/system/serve-stale/ns1/named1.conf.in
-@@ -0,0 +1,35 @@
-+/*
-+ * Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
-+ *
-+ * This Source Code Form is subject to the terms of the Mozilla Public
-+ * License, v. 2.0. If a copy of the MPL was not distributed with this
-+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
-+ */
-+
-+key rndc_key {
-+        secret "1234abcd8765";
-+        algorithm hmac-sha256;
-+};
-+
-+controls {
-+	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-+};
-+
-+options {
-+	query-source address 10.53.0.1;
-+	notify-source 10.53.0.1;
-+	transfer-source 10.53.0.1;
-+	port @PORT@;
-+	pid-file "named.pid";
-+	listen-on { 10.53.0.1; };
-+	listen-on-v6 { none; };
-+	recursion yes;
-+	max-stale-ttl 3600;
-+	stale-answer-ttl 1;
-+	stale-answer-enable yes;
-+};
-+
-+zone "." {
-+	type master;
-+	file "root.db";
-+};
-diff --git a/bin/tests/system/serve-stale/ns1/named2.conf.in b/bin/tests/system/serve-stale/ns1/named2.conf.in
-new file mode 100644
-index 0000000..072e6ec
---- /dev/null
-+++ b/bin/tests/system/serve-stale/ns1/named2.conf.in
-@@ -0,0 +1,35 @@
-+/*
-+ * Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
-+ *
-+ * This Source Code Form is subject to the terms of the Mozilla Public
-+ * License, v. 2.0. If a copy of the MPL was not distributed with this
-+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
-+ */
-+
-+key rndc_key {
-+        secret "1234abcd8765";
-+        algorithm hmac-sha256;
-+};
-+
-+controls {
-+	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-+};
-+
-+options {
-+	query-source address 10.53.0.1;
-+	notify-source 10.53.0.1;
-+	transfer-source 10.53.0.1;
-+	port @PORT@;
-+	pid-file "named.pid";
-+	listen-on { 10.53.0.1; };
-+	listen-on-v6 { none; };
-+	recursion yes;
-+	max-stale-ttl 7200;
-+	stale-answer-ttl 2;
-+	stale-answer-enable yes;
-+};
-+
-+zone "." {
-+	type master;
-+	file "root.db";
-+};
-diff --git a/bin/tests/system/serve-stale/ns1/root.db b/bin/tests/system/serve-stale/ns1/root.db
-new file mode 100644
-index 0000000..eb9ad3e
---- /dev/null
-+++ b/bin/tests/system/serve-stale/ns1/root.db
-@@ -0,0 +1,5 @@
-+.		300	SOA	. . 0 0 0 0 0
-+.		300	NS	ns.nil.
-+ns.nil.		300	A	10.53.0.1
-+example.	300	NS	ns.example.
-+ns.example.	300	A	10.53.0.2
-diff --git a/bin/tests/system/serve-stale/ns3/named.conf.in b/bin/tests/system/serve-stale/ns3/named.conf.in
-new file mode 100644
-index 0000000..24a3293
---- /dev/null
-+++ b/bin/tests/system/serve-stale/ns3/named.conf.in
-@@ -0,0 +1,35 @@
-+/*
-+ * Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
-+ *
-+ * This Source Code Form is subject to the terms of the Mozilla Public
-+ * License, v. 2.0. If a copy of the MPL was not distributed with this
-+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
-+ */
-+
-+key rndc_key {
-+        secret "1234abcd8765";
-+        algorithm hmac-sha256;
-+};
-+
-+controls {
-+	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-+};
-+
-+options {
-+	query-source address 10.53.0.3;
-+	notify-source 10.53.0.3;
-+	transfer-source 10.53.0.3;
-+	port @PORT@;
-+	pid-file "named.pid";
-+	listen-on { 10.53.0.3; };
-+	listen-on-v6 { none; };
-+	recursion yes;
-+	// max-stale-ttl 3600;
-+	// stale-answer-ttl 3;
-+};
-+
-+zone "." {
-+	type slave;
-+	masters { 10.53.0.1; };
-+	file "root.bk";
-+};
-diff --git a/bin/tests/system/serve-stale/prereq.sh b/bin/tests/system/serve-stale/prereq.sh
-new file mode 100644
-index 0000000..a3bbef8
---- /dev/null
-+++ b/bin/tests/system/serve-stale/prereq.sh
-@@ -0,0 +1,38 @@
-+#!/bin/sh
-+#
-+# Copyright (C) 2011, 2012, 2014, 2016  Internet Systems Consortium, Inc. ("ISC")
-+#
-+# This Source Code Form is subject to the terms of the Mozilla Public
-+# License, v. 2.0. If a copy of the MPL was not distributed with this
-+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-+
-+SYSTEMTESTTOP=..
-+. $SYSTEMTESTTOP/conf.sh
-+
-+if $PERL -e 'use Net::DNS;' 2>/dev/null
-+then
-+    if $PERL -e 'use Net::DNS; die if ($Net::DNS::VERSION >= 0.69 && $Net::DNS::VERSION <= 0.74);' 2>/dev/null
-+    then
-+        :
-+    else
-+        echo "I:Net::DNS versions 0.69 to 0.74 have bugs that cause this test to fail: please update." >&2
-+        exit 1
-+    fi
-+else
-+    echo "I:This test requires the Net::DNS library." >&2
-+    exit 1
-+fi
-+if $PERL -e 'use Net::DNS::Nameserver;' 2>/dev/null
-+then
-+	:
-+else
-+	echo "I:This test requires the Net::DNS::Nameserver library." >&2
-+	exit 1
-+fi
-+if $PERL -e 'use Time::HiRes;' 2>/dev/null
-+then
-+	:
-+else
-+	echo "I:This test requires the Time::HiRes library." >&2
-+	exit 1
-+fi
-diff --git a/bin/tests/system/serve-stale/setup.sh b/bin/tests/system/serve-stale/setup.sh
-new file mode 100644
-index 0000000..690f43c
---- /dev/null
-+++ b/bin/tests/system/serve-stale/setup.sh
-@@ -0,0 +1,13 @@
-+#!/bin/sh
-+# Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
-+#
-+# This Source Code Form is subject to the terms of the Mozilla Public
-+# License, v. 2.0. If a copy of the MPL was not distributed with this
-+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-+
-+SYSTEMTESTTOP=..
-+. $SYSTEMTESTTOP/conf.sh
-+
-+copy_setports ns1/named1.conf.in ns1/named.conf
-+copy_setports ans2/ans.pl.in ans2/ans.pl
-+copy_setports ns3/named.conf.in ns3/named.conf
-diff --git a/bin/tests/system/serve-stale/tests.sh b/bin/tests/system/serve-stale/tests.sh
-new file mode 100755
-index 0000000..201c996
---- /dev/null
-+++ b/bin/tests/system/serve-stale/tests.sh
-@@ -0,0 +1,536 @@
-+#!/bin/sh
-+#
-+# Copyright (C) 2000, 2001, 2004, 2007, 2009-2016  Internet Systems Consortium, Inc. ("ISC")
-+#
-+# This Source Code Form is subject to the terms of the Mozilla Public
-+# License, v. 2.0. If a copy of the MPL was not distributed with this
-+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-+
-+SYSTEMTESTTOP=..
-+. $SYSTEMTESTTOP/conf.sh
-+
-+while getopts "p:c:" flag; do
-+    case "$flag" in
-+	p) port=$OPTARG ;;
-+	c) controlport=$OPTARG ;;
-+	*) exit 1 ;;
-+    esac
-+done
-+
-+RNDCCMD="$RNDC -c $SYSTEMTESTTOP/common/rndc.conf -p ${CONTROLPORT} -s"
-+
-+echo "RNDCCMD: ${RNDCCMD}"
-+
-+status=0
-+n=0
-+
-+#echo "I:check ans.pl server ($n)"
-+#$DIG -p ${PORT} @10.53.0.2 example NS
-+#$DIG -p ${PORT} @10.53.0.2 example SOA
-+#$DIG -p ${PORT} @10.53.0.2 ns.example A
-+#$DIG -p ${PORT} @10.53.0.2 ns.example AAAA
-+#$DIG -p ${PORT} @10.53.0.2 txt enable
-+#$DIG -p ${PORT} @10.53.0.2 txt disable
-+#$DIG -p ${PORT} @10.53.0.2 ns.example AAAA
-+#$DIG -p ${PORT} @10.53.0.2 txt enable
-+#$DIG -p ${PORT} @10.53.0.2 ns.example AAAA
-+##$DIG -p ${PORT} @10.53.0.2 data.example TXT
-+#$DIG -p ${PORT} @10.53.0.2 nodata.example TXT
-+#$DIG -p ${PORT} @10.53.0.2 nxdomain.example TXT
-+
-+n=`expr $n + 1`
-+echo "I:prime cache data.example ($n)"
-+ret=0
-+$DIG -p ${PORT} @10.53.0.1 data.example TXT > dig.out.test$n
-+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
-+grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
-+if [ $ret != 0 ]; then echo "I:failed"; fi
-+status=`expr $status + $ret`
-+
-+n=`expr $n + 1`
-+echo "I:prime cache nodata.example ($n)"
-+ret=0
-+$DIG -p ${PORT} @10.53.0.1 nodata.example TXT > dig.out.test$n
-+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
-+grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
-+if [ $ret != 0 ]; then echo "I:failed"; fi
-+status=`expr $status + $ret`
-+
-+n=`expr $n + 1`
-+echo "I:prime cache nxdomain.example ($n)"
-+ret=0
-+$DIG -p ${PORT} @10.53.0.1 nxdomain.example TXT > dig.out.test$n
-+grep "status: NXDOMAIN" dig.out.test$n > /dev/null || ret=1
-+grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
-+if [ $ret != 0 ]; then echo "I:failed"; fi
-+status=`expr $status + $ret`
-+
-+n=`expr $n + 1`
-+echo "I:disable responses from authoritative server ($n)"
-+ret=0
-+$DIG -p ${PORT} @10.53.0.2 txt disable  > dig.out.test$n
-+grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
-+grep "TXT.\"0\"" dig.out.test$n > /dev/null || ret=1
-+if [ $ret != 0 ]; then echo "I:failed"; fi
-+status=`expr $status + $ret`
-+
-+sleep 1
-+
-+n=`expr $n + 1`
-+echo "I:check 'rndc serve-stale status' ($n)"
-+ret=0
-+$RNDCCMD 10.53.0.1 serve-stale status > rndc.out.test$n 2>&1 || ret=1
-+grep '_default: on (stale-answer-ttl=1 max-stale-ttl=3600)' rndc.out.test$n > /dev/null || ret=1
-+if [ $ret != 0 ]; then echo "I:failed"; fi
-+status=`expr $status + $ret`
-+
-+n=`expr $n + 1`
-+echo "I:check stale data.example ($n)"
-+ret=0
-+$DIG -p ${PORT} @10.53.0.1 data.example TXT > dig.out.test$n
-+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
-+grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
-+grep "example.*1.*IN" dig.out.test$n > /dev/null || ret=1
-+if [ $ret != 0 ]; then echo "I:failed"; fi
-+status=`expr $status + $ret`
-+
-+n=`expr $n + 1`
-+echo "I:check stale nodata.example ($n)"
-+ret=0
-+$DIG -p ${PORT} @10.53.0.1 nodata.example TXT > dig.out.test$n
-+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
-+grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
-+grep "example.*1.*IN" dig.out.test$n > /dev/null || ret=1
-+if [ $ret != 0 ]; then echo "I:failed"; fi
-+status=`expr $status + $ret`
-+
-+n=`expr $n + 1`
-+echo "I:check stale nxdomain.example ($n)"
-+ret=0
-+$DIG -p ${PORT} @10.53.0.1 nxdomain.example TXT > dig.out.test$n
-+grep "status: NXDOMAIN" dig.out.test$n > /dev/null || ret=1
-+grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
-+grep "example.*1.*IN" dig.out.test$n > /dev/null || ret=1
-+if [ $ret != 0 ]; then echo "I:failed"; fi
-+status=`expr $status + $ret`
-+
-+n=`expr $n + 1`
-+echo "I:running 'rndc serve-stale off' ($n)"
-+ret=0
-+$RNDCCMD 10.53.0.1 serve-stale off || ret=1
-+if [ $ret != 0 ]; then echo "I:failed"; fi
-+status=`expr $status + $ret`
-+
-+n=`expr $n + 1`
-+echo "I:check 'rndc serve-stale status' ($n)"
-+ret=0
-+$RNDCCMD 10.53.0.1 serve-stale status > rndc.out.test$n 2>&1 || ret=1
-+grep '_default: off (rndc) (stale-answer-ttl=1 max-stale-ttl=3600)' rndc.out.test$n > /dev/null || ret=1
-+if [ $ret != 0 ]; then echo "I:failed"; fi
-+status=`expr $status + $ret`
-+
-+n=`expr $n + 1`
-+echo "I:check stale data.example (serve-stale off) ($n)"
-+ret=0
-+$DIG -p ${PORT} @10.53.0.1 data.example TXT > dig.out.test$n
-+grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
-+if [ $ret != 0 ]; then echo "I:failed"; fi
-+status=`expr $status + $ret`
-+if [ $ret != 0 ]; then echo "I:failed"; fi
-+status=`expr $status + $ret`
-+
-+n=`expr $n + 1`
-+echo "I:check stale nodata.example (serve-stale off) ($n)"
-+ret=0
-+$DIG -p ${PORT} @10.53.0.1 nodata.example TXT > dig.out.test$n
-+grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
-+if [ $ret != 0 ]; then echo "I:failed"; fi
-+status=`expr $status + $ret`
-+
-+n=`expr $n + 1`
-+echo "I:check stale nxdomain.example (serve-stale off) ($n)"
-+ret=0
-+$DIG -p ${PORT} @10.53.0.1 nxdomain.example TXT > dig.out.test$n
-+grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
-+if [ $ret != 0 ]; then echo "I:failed"; fi
-+status=`expr $status + $ret`
-+
-+n=`expr $n + 1`
-+echo "I:running 'rndc serve-stale on' ($n)"
-+ret=0
-+$RNDCCMD 10.53.0.1 serve-stale on || ret=1
-+if [ $ret != 0 ]; then echo "I:failed"; fi
-+status=`expr $status + $ret`
-+
-+n=`expr $n + 1`
-+echo "I:check 'rndc serve-stale status' ($n)"
-+ret=0
-+$RNDCCMD 10.53.0.1 serve-stale status > rndc.out.test$n 2>&1 || ret=1
-+grep '_default: on (rndc) (stale-answer-ttl=1 max-stale-ttl=3600)' rndc.out.test$n > /dev/null || ret=1
-+if [ $ret != 0 ]; then echo "I:failed"; fi
-+status=`expr $status + $ret`
-+
-+n=`expr $n + 1`
-+echo "I:check stale data.example (serve-stale on) ($n)"
-+ret=0
-+$DIG -p ${PORT} @10.53.0.1 data.example TXT > dig.out.test$n
-+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
-+grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
-+grep "example.*1.*IN" dig.out.test$n > /dev/null || ret=1
-+if [ $ret != 0 ]; then echo "I:failed"; fi
-+status=`expr $status + $ret`
-+
-+n=`expr $n + 1`
-+echo "I:check stale nodata.example (serve-stale on) ($n)"
-+ret=0
-+$DIG -p ${PORT} @10.53.0.1 nodata.example TXT > dig.out.test$n
-+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
-+grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
-+grep "example.*1.*IN" dig.out.test$n > /dev/null || ret=1
-+if [ $ret != 0 ]; then echo "I:failed"; fi
-+status=`expr $status + $ret`
-+
-+n=`expr $n + 1`
-+echo "I:check stale nxdomain.example (serve-stale on) ($n)"
-+ret=0
-+$DIG -p ${PORT} @10.53.0.1 nxdomain.example TXT > dig.out.test$n
-+grep "status: NXDOMAIN" dig.out.test$n > /dev/null || ret=1
-+grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
-+grep "example.*1.*IN" dig.out.test$n > /dev/null || ret=1
-+if [ $ret != 0 ]; then echo "I:failed"; fi
-+status=`expr $status + $ret`
-+
-+n=`expr $n + 1`
-+echo "I:running 'rndc serve-stale no' ($n)"
-+ret=0
-+$RNDCCMD 10.53.0.1 serve-stale no || ret=1
-+if [ $ret != 0 ]; then echo "I:failed"; fi
-+status=`expr $status + $ret`
-+
-+n=`expr $n + 1`
-+echo "I:check 'rndc serve-stale status' ($n)"
-+ret=0
-+$RNDCCMD 10.53.0.1 serve-stale status > rndc.out.test$n 2>&1 || ret=1
-+grep '_default: off (rndc) (stale-answer-ttl=1 max-stale-ttl=3600)' rndc.out.test$n > /dev/null || ret=1
-+if [ $ret != 0 ]; then echo "I:failed"; fi
-+status=`expr $status + $ret`
-+
-+n=`expr $n + 1`
-+echo "I:check stale data.example (serve-stale no) ($n)"
-+ret=0
-+$DIG -p ${PORT} @10.53.0.1 data.example TXT > dig.out.test$n
-+grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
-+if [ $ret != 0 ]; then echo "I:failed"; fi
-+status=`expr $status + $ret`
-+if [ $ret != 0 ]; then echo "I:failed"; fi
-+status=`expr $status + $ret`
-+
-+n=`expr $n + 1`
-+echo "I:check stale nodata.example (serve-stale no) ($n)"
-+ret=0
-+$DIG -p ${PORT} @10.53.0.1 nodata.example TXT > dig.out.test$n
-+grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
-+if [ $ret != 0 ]; then echo "I:failed"; fi
-+status=`expr $status + $ret`
-+
-+n=`expr $n + 1`
-+echo "I:check stale nxdomain.example (serve-stale no) ($n)"
-+ret=0
-+$DIG -p ${PORT} @10.53.0.1 nxdomain.example TXT > dig.out.test$n
-+grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
-+if [ $ret != 0 ]; then echo "I:failed"; fi
-+status=`expr $status + $ret`
-+
-+n=`expr $n + 1`
-+echo "I:running 'rndc serve-stale yes' ($n)"
-+ret=0
-+$RNDCCMD 10.53.0.1 serve-stale yes || ret=1
-+if [ $ret != 0 ]; then echo "I:failed"; fi
-+status=`expr $status + $ret`
-+
-+n=`expr $n + 1`
-+echo "I:check 'rndc serve-stale status' ($n)"
-+ret=0
-+$RNDCCMD 10.53.0.1 serve-stale status > rndc.out.test$n 2>&1 || ret=1
-+grep '_default: on (rndc) (stale-answer-ttl=1 max-stale-ttl=3600)' rndc.out.test$n > /dev/null || ret=1
-+if [ $ret != 0 ]; then echo "I:failed"; fi
-+status=`expr $status + $ret`
-+
-+n=`expr $n + 1`
-+echo "I:check stale data.example (serve-stale yes) ($n)"
-+ret=0
-+$DIG -p ${PORT} @10.53.0.1 data.example TXT > dig.out.test$n
-+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
-+grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
-+grep "example.*1.*IN" dig.out.test$n > /dev/null || ret=1
-+if [ $ret != 0 ]; then echo "I:failed"; fi
-+status=`expr $status + $ret`
-+
-+n=`expr $n + 1`
-+echo "I:check stale nodata.example (serve-stale yes) ($n)"
-+ret=0
-+$DIG -p ${PORT} @10.53.0.1 nodata.example TXT > dig.out.test$n
-+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
-+grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
-+grep "example.*1.*IN" dig.out.test$n > /dev/null || ret=1
-+if [ $ret != 0 ]; then echo "I:failed"; fi
-+status=`expr $status + $ret`
-+
-+n=`expr $n + 1`
-+echo "I:check stale nxdomain.example (serve-stale yes) ($n)"
-+ret=0
-+$DIG -p ${PORT} @10.53.0.1 nxdomain.example TXT > dig.out.test$n
-+grep "status: NXDOMAIN" dig.out.test$n > /dev/null || ret=1
-+grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
-+grep "example.*1.*IN" dig.out.test$n > /dev/null || ret=1
-+if [ $ret != 0 ]; then echo "I:failed"; fi
-+status=`expr $status + $ret`
-+
-+n=`expr $n + 1`
-+echo "I:running 'rndc serve-stale off' ($n)"
-+ret=0
-+$RNDCCMD 10.53.0.1 serve-stale off || ret=1
-+if [ $ret != 0 ]; then echo "I:failed"; fi
-+status=`expr $status + $ret`
-+
-+n=`expr $n + 1`
-+echo "I:running 'rndc serve-stale reset' ($n)"
-+ret=0
-+$RNDCCMD 10.53.0.1 serve-stale reset || ret=1
-+if [ $ret != 0 ]; then echo "I:failed"; fi
-+status=`expr $status + $ret`
-+
-+n=`expr $n + 1`
-+echo "I:check 'rndc serve-stale status' ($n)"
-+ret=0
-+$RNDCCMD 10.53.0.1 serve-stale status > rndc.out.test$n 2>&1 || ret=1
-+grep '_default: on (stale-answer-ttl=1 max-stale-ttl=3600)' rndc.out.test$n > /dev/null || ret=1
-+if [ $ret != 0 ]; then echo "I:failed"; fi
-+status=`expr $status + $ret`
-+
-+n=`expr $n + 1`
-+echo "I:check stale data.example (serve-stale reset) ($n)"
-+ret=0
-+$DIG -p ${PORT} @10.53.0.1 data.example TXT > dig.out.test$n
-+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
-+grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
-+grep "example.*1.*IN" dig.out.test$n > /dev/null || ret=1
-+if [ $ret != 0 ]; then echo "I:failed"; fi
-+status=`expr $status + $ret`
-+
-+n=`expr $n + 1`
-+echo "I:check stale nodata.example (serve-stale reset) ($n)"
-+ret=0
-+$DIG -p ${PORT} @10.53.0.1 nodata.example TXT > dig.out.test$n
-+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
-+grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
-+grep "example.*1.*IN" dig.out.test$n > /dev/null || ret=1
-+if [ $ret != 0 ]; then echo "I:failed"; fi
-+status=`expr $status + $ret`
-+
-+n=`expr $n + 1`
-+echo "I:check stale nxdomain.example (serve-stale reset) ($n)"
-+ret=0
-+$DIG -p ${PORT} @10.53.0.1 nxdomain.example TXT > dig.out.test$n
-+grep "status: NXDOMAIN" dig.out.test$n > /dev/null || ret=1
-+grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
-+grep "example.*1.*IN" dig.out.test$n > /dev/null || ret=1
-+if [ $ret != 0 ]; then echo "I:failed"; fi
-+status=`expr $status + $ret`
-+
-+n=`expr $n + 1`
-+echo "I:running 'rndc serve-stale off' ($n)"
-+ret=0
-+$RNDCCMD 10.53.0.1 serve-stale off || ret=1
-+if [ $ret != 0 ]; then echo "I:failed"; fi
-+status=`expr $status + $ret`
-+
-+n=`expr $n + 1`
-+echo "I:check 'rndc serve-stale status' ($n)"
-+ret=0
-+$RNDCCMD 10.53.0.1 serve-stale status > rndc.out.test$n 2>&1 || ret=1
-+grep '_default: off (rndc) (stale-answer-ttl=1 max-stale-ttl=3600)' rndc.out.test$n > /dev/null || ret=1
-+if [ $ret != 0 ]; then echo "I:failed"; fi
-+status=`expr $status + $ret`
-+
-+n=`expr $n + 1`
-+echo "I:updating ns1/named.conf ($n)"
-+ret=0
-+sed -e "s/@PORT@/${PORT}/g;s/@CONTROLPORT@/${CONTROLPORT}/g" < ns1/named2.conf.in > ns1/named.conf
-+if [ $ret != 0 ]; then echo "I:failed"; fi
-+status=`expr $status + $ret`
-+
-+n=`expr $n + 1`
-+echo "I:running 'rndc reload' ($n)"
-+ret=0
-+$RNDCCMD 10.53.0.1 reload > rndc.out.test$n 2>&1 || ret=1
-+grep "server reload successful" rndc.out.test$n > /dev/null || ret=1
-+if [ $ret != 0 ]; then echo "I:failed"; fi
-+status=`expr $status + $ret`
-+
-+n=`expr $n + 1`
-+echo "I:check 'rndc serve-stale status' ($n)"
-+ret=0
-+$RNDCCMD 10.53.0.1 serve-stale status > rndc.out.test$n 2>&1 || ret=1
-+grep '_default: off (rndc) (stale-answer-ttl=2 max-stale-ttl=7200)' rndc.out.test$n > /dev/null || ret=1
-+if [ $ret != 0 ]; then echo "I:failed"; fi
-+status=`expr $status + $ret`
-+
-+n=`expr $n + 1`
-+echo "I:check 'rndc serve-stale' ($n)"
-+ret=0
-+$RNDCCMD 10.53.0.1 serve-stale > rndc.out.test$n 2>&1 && ret=1
-+grep "unexpected end of input" rndc.out.test$n > /dev/null || ret=1
-+if [ $ret != 0 ]; then echo "I:failed"; fi
-+status=`expr $status + $ret`
-+
-+n=`expr $n + 1`
-+echo "I:check 'rndc serve-stale unknown' ($n)"
-+ret=0
-+$RNDCCMD 10.53.0.1 serve-stale unknown > rndc.out.test$n 2>&1 && ret=1
-+grep "syntax error" rndc.out.test$n > /dev/null || ret=1
-+if [ $ret != 0 ]; then echo "I:failed"; fi
-+status=`expr $status + $ret`
-+
-+n=`expr $n + 1`
-+echo_i "flush cache, re-enable serve-stale and query again ($n)"
-+ret=0
-+$RNDCCMD 10.53.0.1 flushtree example > rndc.out.test$n.1 2>&1 || ret=1
-+$RNDCCMD 10.53.0.1 serve-stale on > rndc.out.test$n.2 2>&1 || ret=1
-+$DIG -p ${PORT} @10.53.0.1 data.example TXT > dig.out.test$n
-+grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
-+grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
-+if [ $ret != 0 ]; then echo_i "failed"; fi
-+status=`expr $status + $ret`
-+
-+n=`expr $n + 1`
-+ret=0
-+$DIG -p ${PORT} @10.53.0.2 txt enable  > dig.out.test$n
-+grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
-+grep "TXT.\"1\"" dig.out.test$n > /dev/null || ret=1
-+if [ $ret != 0 ]; then echo "I:failed"; fi
-+status=`expr $status + $ret`
-+
-+n=`expr $n + 1`
-+echo "I:prime cache data.example (max-stale-ttl default) ($n)"
-+ret=0
-+$DIG -p ${PORT} @10.53.0.3 data.example TXT > dig.out.test$n
-+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
-+grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
-+grep "example.*1.*IN" dig.out.test$n > /dev/null || ret=1
-+if [ $ret != 0 ]; then echo "I:failed"; fi
-+status=`expr $status + $ret`
-+
-+n=`expr $n + 1`
-+echo "I:prime cache nodata.example (max-stale-ttl default) ($n)"
-+ret=0
-+$DIG -p ${PORT} @10.53.0.3 nodata.example TXT > dig.out.test$n
-+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
-+grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
-+grep "example.*1.*IN" dig.out.test$n > /dev/null || ret=1
-+if [ $ret != 0 ]; then echo "I:failed"; fi
-+status=`expr $status + $ret`
-+
-+n=`expr $n + 1`
-+echo "I:prime cache nxdomain.example (max-stale-ttl default) ($n)"
-+ret=0
-+$DIG -p ${PORT} @10.53.0.3 nxdomain.example TXT > dig.out.test$n
-+grep "status: NXDOMAIN" dig.out.test$n > /dev/null || ret=1
-+grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
-+grep "example.*1.*IN" dig.out.test$n > /dev/null || ret=1
-+if [ $ret != 0 ]; then echo "I:failed"; fi
-+status=`expr $status + $ret`
-+
-+n=`expr $n + 1`
-+echo "I:disable responses from authoritative server ($n)"
-+ret=0
-+$DIG -p ${PORT} @10.53.0.2 txt disable  > dig.out.test$n
-+grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
-+grep "TXT.\"0\"" dig.out.test$n > /dev/null || ret=1
-+if [ $ret != 0 ]; then echo "I:failed"; fi
-+status=`expr $status + $ret`
-+
-+sleep 1
-+
-+n=`expr $n + 1`
-+echo "I:check 'rndc serve-stale status' ($n)"
-+ret=0
-+$RNDCCMD 10.53.0.3 serve-stale status > rndc.out.test$n 2>&1 || ret=1
-+grep '_default: off (stale-answer-ttl=1 max-stale-ttl=604800)' rndc.out.test$n > /dev/null || ret=1
-+if [ $ret != 0 ]; then echo "I:failed"; fi
-+status=`expr $status + $ret`
-+
-+n=`expr $n + 1`
-+echo "I:check fail of data.example (max-stale-ttl default) ($n)"
-+ret=0
-+$DIG -p ${PORT} @10.53.0.3 data.example TXT > dig.out.test$n
-+grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
-+grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
-+if [ $ret != 0 ]; then echo "I:failed"; fi
-+status=`expr $status + $ret`
-+
-+n=`expr $n + 1`
-+echo "I:check fail of nodata.example (max-stale-ttl default) ($n)"
-+ret=0
-+$DIG -p ${PORT} @10.53.0.3 nodata.example TXT > dig.out.test$n
-+grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
-+grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
-+if [ $ret != 0 ]; then echo "I:failed"; fi
-+status=`expr $status + $ret`
-+
-+n=`expr $n + 1`
-+echo "I:check fail of nxdomain.example (max-stale-ttl default) ($n)"
-+ret=0
-+$DIG -p ${PORT} @10.53.0.3 nxdomain.example TXT > dig.out.test$n
-+grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
-+grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
-+if [ $ret != 0 ]; then echo "I:failed"; fi
-+status=`expr $status + $ret`
-+
-+n=`expr $n + 1`
-+echo "I:check 'rndc serve-stale on' ($n)"
-+ret=0
-+$RNDCCMD 10.53.0.3 serve-stale on > rndc.out.test$n 2>&1 || ret=1
-+if [ $ret != 0 ]; then echo "I:failed"; fi
-+status=`expr $status + $ret`
-+
-+n=`expr $n + 1`
-+echo "I:check 'rndc serve-stale status' ($n)"
-+ret=0
-+$RNDCCMD 10.53.0.3 serve-stale status > rndc.out.test$n 2>&1 || ret=1
-+grep '_default: on (rndc) (stale-answer-ttl=1 max-stale-ttl=604800)' rndc.out.test$n > /dev/null || ret=1
-+if [ $ret != 0 ]; then echo "I:failed"; fi
-+status=`expr $status + $ret`
-+
-+n=`expr $n + 1`
-+echo "I:check data.example (max-stale-ttl default) ($n)"
-+ret=0
-+$DIG -p ${PORT} @10.53.0.3 data.example TXT > dig.out.test$n
-+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
-+grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
-+grep "example.*1.*IN" dig.out.test$n > /dev/null || ret=1
-+if [ $ret != 0 ]; then echo "I:failed"; fi
-+status=`expr $status + $ret`
-+
-+n=`expr $n + 1`
-+echo "I:check nodata.example (max-stale-ttl default) ($n)"
-+ret=0
-+$DIG -p ${PORT} @10.53.0.3 nodata.example TXT > dig.out.test$n
-+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
-+grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
-+grep "example.*1.*IN" dig.out.test$n > /dev/null || ret=1
-+if [ $ret != 0 ]; then echo "I:failed"; fi
-+status=`expr $status + $ret`
-+
-+n=`expr $n + 1`
-+echo "I:check nxdomain.example (max-stale-ttl default) ($n)"
-+ret=0
-+$DIG -p ${PORT} @10.53.0.3 nxdomain.example TXT > dig.out.test$n
-+grep "status: NXDOMAIN" dig.out.test$n > /dev/null || ret=1
-+grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
-+grep "example.*1.*IN" dig.out.test$n > /dev/null || ret=1
-+if [ $ret != 0 ]; then echo "I:failed"; fi
-+status=`expr $status + $ret`
-+
-+echo "I:exit status: $status"
-+[ $status -eq 0 ] || exit 1
-diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
-index 539973c..8528649 100644
---- a/doc/arm/Bv9ARM-book.xml
-+++ b/doc/arm/Bv9ARM-book.xml
-@@ -4376,6 +4376,9 @@ badresp:1,adberr:0,findfail:0,valfail:0]
- 	  statement in the <filename>named.conf</filename> file:
- 	</para>
- 	<xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="options.grammar.xml"/>
-+  [ <command>max-stale-ttl</command> <replaceable>number</replaceable> ; ]
-+  [ <command>stale-answer-enable</command> <replaceable>yes_or_no</replaceable> ; ]
-+  [ <command>stale-answer-ttl</command> <replaceable>number</replaceable> ; ]
-       </section>
- 
-       <section xml:id="options"><info><title><command>options</command> Statement Definition and
-@@ -4469,6 +4472,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
- 		  <command>dnssec-validation</command>,
- 		  <command>max-cache-ttl</command>,
- 		  <command>max-ncache-ttl</command>,
-+		  <command>max-stale-ttl</command>,
- 		  <command>max-cache-size</command>, and
- 		  <command>zero-no-soa-ttl</command>.
- 		</para>
-@@ -5480,7 +5484,6 @@ options {
- 	    </listitem>
- 	  </varlistentry>
- 
--
- 	  <varlistentry>
- 	    <term><command>max-zone-ttl</command></term>
- 	    <listitem>
-@@ -5516,6 +5519,21 @@ options {
- 	    </listitem>
- 	  </varlistentry>
- 
-+	  <varlistentry>
-+	    <term><command>stale-answer-ttl</command></term>
-+	    <listitem>
-+	      <para>
-+		Specifies the TTL to be returned on stale answers.
-+		The default is 1 second. The minimal allowed is
-+		also 1 second; a value of 0 will be updated silently
-+		to 1 second.  For stale answers to be returned
-+		<option>max-stale-ttl</option> must be set to a
-+		non zero value and they must not have been disabled
-+		by <command>rndc</command>.
-+	      </para>
-+	    </listitem>
-+	  </varlistentry>
-+
- 	  <varlistentry>
- 	    <term><command>serial-update-method</command></term>
- 	    <listitem>
-@@ -6275,6 +6293,22 @@ options {
- 	      </listitem>
- 	    </varlistentry>
- 
-+	    <varlistentry>
-+	      <term><command>serve-stale-enable</command></term>
-+	      <listitem>
-+		<para>
-+		  Enable the returning of stale answers when the
-+		  nameservers for the zone are not answering.  This
-+		  is off by default but can be enabled/disabled via
-+		  <command>rndc server-stale on</command> and
-+		  <command>rndc server-stale off</command> which
-+		  override the named.conf setting.  <command>rndc
-+		  server-stale reset</command> will restore control
-+		  via named.conf.
-+		</para>
-+	      </listitem>
-+	    </varlistentry>
-+
- 	    <varlistentry>
- 	      <term><command>nocookie-udp-size</command></term>
- 	      <listitem>
-@@ -7483,14 +7517,20 @@ options {
- 	      <term><command>resolver-query-timeout</command></term>
- 	      <listitem>
- 		<para>
--		  The amount of time in seconds that the resolver
-+		  The amount of time in milliseconds that the resolver
- 		  will spend attempting to resolve a recursive
- 		  query before failing.  The default and minimum
--		  is <literal>10</literal> and the maximum is
--		  <literal>30</literal>.  Setting it to
-+		  is <literal>10000</literal> and the maximum is
-+		  <literal>30000</literal>.  Setting it to
- 		  <literal>0</literal> will result in the default
- 		  being used.
- 		</para>
-+		<para>
-+		  This value was originally specified in seconds.
-+		  Values less than or equal to 300 will be be treated
-+		  as seconds and converted to milliseconds before
-+		  applying the above limits.
-+		</para>
- 	      </listitem>
- 	    </varlistentry>
- 	  </variablelist>
-@@ -8976,6 +9016,27 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
- 	      </listitem>
- 	    </varlistentry>
- 
-+	    <varlistentry>
-+	      <term><command>max-stale-ttl</command></term>
-+	      <listitem>
-+		<para>
-+		  Sets the maximum time for which the server will
-+		  retain records past their normal expiry to
-+		  return them as stale records when the servers
-+		  for those records are not reachable.  The default
-+		  is to not retain the record.
-+		</para>
-+		<para>
-+		  <command>rndc serve-stale</command> can be used
-+		  to disable and re-enable the serving of stale
-+		  records at runtime.  Reloading or reconfiguring
-+		  <command>named</command> will not re-enable serving
-+		  of stale records if they have been disabled via
-+		  <command>rndc</command>.
-+		</para>
-+	      </listitem>
-+	    </varlistentry>
-+
- 	    <varlistentry>
- 	      <term><command>min-roots</command></term>
- 	      <listitem>
-diff --git a/doc/arm/logging-categories.xml b/doc/arm/logging-categories.xml
-index 181def7..59f6afb 100644
---- a/doc/arm/logging-categories.xml
-+++ b/doc/arm/logging-categories.xml
-@@ -311,6 +311,17 @@
- 	  </para>
- 	</entry>
-       </row>
-+      <row rowsep="0">
-+	<entry colname="1">
-+	  <para><command>serve-stale</command></para>
-+	</entry>
-+	<entry colname="2">
-+	  <para>
-+	    Whether or not a stale answer is used
-+	    following a resolver failure.
-+	  </para>
-+	</entry>
-+      </row>
-       <row rowsep="0">
- 	<entry colname="1">
- 	  <para><command>spill</command></para>
-diff --git a/doc/arm/notes-rh-changes.xml b/doc/arm/notes-rh-changes.xml
-index 11c3a7c..ba3c2cc 100644
---- a/doc/arm/notes-rh-changes.xml
-+++ b/doc/arm/notes-rh-changes.xml
-@@ -13,6 +13,9 @@
- <section xml:id="relnotes_rh_changes"><info><title>Red Hat Specific Changes</title></info>
-   <itemizedlist>
-      <listitem>
-+      <para>
-+        This version includes some features not present in releases by ISC.
-+      </para>
-       <para>
-         By default, BIND now uses the random number generation functions
-         in the cryptographic library (i.e., OpenSSL or a PKCS#11
-@@ -37,7 +40,16 @@
-         case <filename>/dev/random</filename> will be the default
-         entropy source.  [RT #31459] [RT #46047]
-       </para>
--    </listitem>
-+      <para>
-+        When acting as a recursive resolver, <command>named</command>
-+        can now continue returning answers whose TTLs have expired
-+        when the authoritative server is under attack and unable to
-+        respond. This is controlled by the
-+        <command>stale-answer-enable</command>,
-+        <command>stale-answer-ttl</command> and
-+        <command>max-stale-ttl</command> options. [RT #44790]
-+      </para>
-+     </listitem>
-   </itemizedlist>
- </section>
- 
-diff --git a/doc/misc/options b/doc/misc/options
-index e11beed..fde93c7 100644
---- a/doc/misc/options
-+++ b/doc/misc/options
-@@ -225,6 +225,7 @@ options {
-         max-refresh-time <integer>;
-         max-retry-time <integer>;
-         max-rsa-exponent-size <integer>;
-+        max-stale-ttl <ttlval>;
-         max-transfer-idle-in <integer>;
-         max-transfer-idle-out <integer>;
-         max-transfer-time-in <integer>;
-@@ -298,7 +299,9 @@ options {
-         request-sit <boolean>; // obsolete
-         require-server-cookie <boolean>;
-         reserved-sockets <integer>;
-+        resolver-nonbackoff-tries <integer>;
-         resolver-query-timeout <integer>;
-+        resolver-retry-interval <integer>;
-         response-policy { zone <string> [ log <boolean> ] [ max-policy-ttl
-             <integer> ] [ policy ( cname | disabled | drop | given | no-op
-             | nodata | nxdomain | passthru | tcp-only <quoted_string> ) ] [
-@@ -328,6 +331,8 @@ options {
-         sit-secret <string>; // obsolete
-         sortlist { <address_match_element>; ... };
-         stacksize ( default | unlimited | <sizeval> );
-+        stale-answer-enable <boolean>;
-+        stale-answer-ttl <ttlval>;
-         startup-notify-rate <integer>;
-         statistics-file <quoted_string>;
-         statistics-interval <integer>; // not yet implemented
-@@ -539,6 +544,7 @@ view <string> [ <class> ] {
-         max-recursion-queries <integer>;
-         max-refresh-time <integer>;
-         max-retry-time <integer>;
-+        max-stale-ttl <ttlval>;
-         max-transfer-idle-in <integer>;
-         max-transfer-idle-out <integer>;
-         max-transfer-time-in <integer>;
-@@ -600,7 +606,9 @@ view <string> [ <class> ] {
-         request-nsid <boolean>;
-         request-sit <boolean>; // obsolete
-         require-server-cookie <boolean>;
-+        resolver-nonbackoff-tries <integer>;
-         resolver-query-timeout <integer>;
-+        resolver-retry-interval <integer>;
-         response-policy { zone <string> [ log <boolean> ] [ max-policy-ttl
-             <integer> ] [ policy ( cname | disabled | drop | given | no-op
-             | nodata | nxdomain | passthru | tcp-only <quoted_string> ) ] [
-@@ -655,6 +663,8 @@ view <string> [ <class> ] {
-         sig-signing-type <integer>;
-         sig-validity-interval <integer> [ <integer> ];
-         sortlist { <address_match_element>; ... };
-+        stale-answer-enable <boolean>;
-+        stale-answer-ttl <ttlval>;
-         suppress-initial-notify <boolean>; // not yet implemented
-         topology { <address_match_element>; ... }; // not implemented
-         transfer-format ( many-answers | one-answer );
-diff --git a/lib/bind9/check.c b/lib/bind9/check.c
-index bd16aec..91cedb7 100644
---- a/lib/bind9/check.c
-+++ b/lib/bind9/check.c
-@@ -99,7 +99,8 @@ check_orderent(const cfg_obj_t *ent, isc_log_t *logctx) {
- 			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
- 				    "rrset-order: invalid class '%s'",
- 				    r.base);
--			result = ISC_R_FAILURE;
-+			if (result == ISC_R_SUCCESS)
-+				result = ISC_R_FAILURE;
- 		}
- 	}
- 
-@@ -112,7 +113,8 @@ check_orderent(const cfg_obj_t *ent, isc_log_t *logctx) {
- 			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
- 				    "rrset-order: invalid type '%s'",
- 				    r.base);
--			result = ISC_R_FAILURE;
-+			if (result == ISC_R_SUCCESS)
-+				result = ISC_R_FAILURE;
- 		}
- 	}
- 
-@@ -126,7 +128,8 @@ check_orderent(const cfg_obj_t *ent, isc_log_t *logctx) {
- 		if (tresult != ISC_R_SUCCESS) {
- 			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
- 				    "rrset-order: invalid name '%s'", str);
--			result = ISC_R_FAILURE;
-+			if (result == ISC_R_SUCCESS)
-+				result = ISC_R_FAILURE;
- 		}
- 	}
- 
-@@ -135,14 +138,16 @@ check_orderent(const cfg_obj_t *ent, isc_log_t *logctx) {
- 	    strcasecmp("order", cfg_obj_asstring(obj)) != 0) {
- 		cfg_obj_log(ent, logctx, ISC_LOG_ERROR,
- 			    "rrset-order: keyword 'order' missing");
--		result = ISC_R_FAILURE;
-+		if (result == ISC_R_SUCCESS)
-+			result = ISC_R_FAILURE;
- 	}
- 
- 	obj = cfg_tuple_get(ent, "ordering");
- 	if (!cfg_obj_isstring(obj)) {
- 	    cfg_obj_log(ent, logctx, ISC_LOG_ERROR,
- 			"rrset-order: missing ordering");
--		result = ISC_R_FAILURE;
-+		if (result == ISC_R_SUCCESS)
-+			result = ISC_R_FAILURE;
- 	} else if (strcasecmp(cfg_obj_asstring(obj), "fixed") == 0) {
- #if !DNS_RDATASET_FIXED
- 		cfg_obj_log(obj, logctx, ISC_LOG_WARNING,
-@@ -154,7 +159,8 @@ check_orderent(const cfg_obj_t *ent, isc_log_t *logctx) {
- 		cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
- 			    "rrset-order: invalid order '%s'",
- 			    cfg_obj_asstring(obj));
--		result = ISC_R_FAILURE;
-+		if (result == ISC_R_SUCCESS)
-+			result = ISC_R_FAILURE;
- 	}
- 	return (result);
- }
-@@ -174,7 +180,7 @@ check_order(const cfg_obj_t *options, isc_log_t *logctx) {
- 	     element = cfg_list_next(element))
- 	{
- 		tresult = check_orderent(cfg_listelt_value(element), logctx);
--		if (tresult != ISC_R_SUCCESS)
-+		if (result == ISC_R_SUCCESS && tresult != ISC_R_SUCCESS)
- 			result = tresult;
- 	}
- 	return (result);
-@@ -204,7 +210,8 @@ check_dual_stack(const cfg_obj_t *options, isc_log_t *logctx) {
- 		if (val > UINT16_MAX) {
- 			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
- 				    "port '%u' out of range", val);
--			result = ISC_R_FAILURE;
-+			if (result == ISC_R_SUCCESS)
-+				result = ISC_R_RANGE;
- 		}
- 	}
- 	obj = cfg_tuple_get(alternates, "addresses");
-@@ -224,7 +231,8 @@ check_dual_stack(const cfg_obj_t *options, isc_log_t *logctx) {
- 		if (tresult != ISC_R_SUCCESS) {
- 			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
- 				    "bad name '%s'", str);
--			result = ISC_R_FAILURE;
-+			if (result == ISC_R_SUCCESS)
-+				result = tresult;
- 		}
- 		obj = cfg_tuple_get(value, "port");
- 		if (cfg_obj_isuint32(obj)) {
-@@ -232,7 +240,8 @@ check_dual_stack(const cfg_obj_t *options, isc_log_t *logctx) {
- 			if (val > UINT16_MAX) {
- 				cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
- 					    "port '%u' out of range", val);
--				result = ISC_R_FAILURE;
-+				if (result == ISC_R_SUCCESS)
-+					result = ISC_R_RANGE;
- 			}
- 		}
- 	}
-@@ -1271,7 +1280,8 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
- 			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
- 				    "auto-dnssec may only be activated at the "
- 				    "zone level");
--			result = ISC_R_FAILURE;
-+			if (result == ISC_R_SUCCESS)
-+				result = ISC_R_FAILURE;
- 		}
- 	}
- 
-@@ -1291,7 +1301,7 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
- 		{
- 			obj = cfg_listelt_value(element);
- 			tresult = mustbesecure(obj, symtab, logctx, mctx);
--			if (tresult != ISC_R_SUCCESS)
-+			if (result == ISC_R_SUCCESS && tresult != ISC_R_SUCCESS)
- 				result = tresult;
- 		}
- 		if (symtab != NULL)
-@@ -1310,7 +1320,8 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
- 				cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
- 					    "%s: invalid name '%s'",
- 					    server_contact[i], str);
--				result = ISC_R_FAILURE;
-+				if (result == ISC_R_SUCCESS)
-+					result = ISC_R_FAILURE;
- 			}
- 		}
- 	}
-@@ -1330,7 +1341,8 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
- 			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
- 				    "disable-empty-zone: invalid name '%s'",
- 				    str);
--			result = ISC_R_FAILURE;
-+			if (result == ISC_R_SUCCESS)
-+				result = ISC_R_FAILURE;
- 		}
- 	}
- 
-@@ -1344,11 +1356,12 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
- 	    strlen(cfg_obj_asstring(obj)) > 1024U) {
- 		cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
- 			    "'server-id' too big (>1024 bytes)");
--		result = ISC_R_FAILURE;
-+		if (result == ISC_R_SUCCESS)
-+			result = ISC_R_FAILURE;
- 	}
- 
- 	tresult = check_dscp(options, logctx);
--	if (tresult != ISC_R_SUCCESS)
-+	if (result == ISC_R_SUCCESS && tresult != ISC_R_SUCCESS)
- 		result = tresult;
- 
- 	obj = NULL;
-@@ -1358,11 +1371,13 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
- 		if (lifetime > 604800) {	/* 7 days */
- 			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
- 				    "'nta-lifetime' cannot exceed one week");
--			result = ISC_R_RANGE;
-+			if (result == ISC_R_SUCCESS)
-+				result = ISC_R_RANGE;
- 		} else if (lifetime == 0) {
- 			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
- 				    "'nta-lifetime' may not be zero");
--			result = ISC_R_RANGE;
-+			if (result == ISC_R_SUCCESS)
-+				result = ISC_R_RANGE;
- 		}
- 	}
- 
-@@ -1373,7 +1388,8 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
- 		if (recheck > 604800) {		/* 7 days */
- 			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
- 				    "'nta-recheck' cannot exceed one week");
--			result = ISC_R_RANGE;
-+			if (result == ISC_R_SUCCESS)
-+				result = ISC_R_RANGE;
- 		}
- 
- 		if (recheck > lifetime)
-@@ -1391,7 +1407,8 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
- 	if (strcasecmp(ccalg, "aes") == 0) {
- 		cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
- 			    "cookie-algorithm: '%s' not supported", ccalg);
--		result = ISC_R_NOTIMPLEMENTED;
-+		if (result == ISC_R_SUCCESS)
-+			result = ISC_R_NOTIMPLEMENTED;
- 	}
- #endif
- 
-@@ -1480,7 +1497,8 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
- 				cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
- 					    "%s out of range (%u < %u)",
- 					    fstrm[i].name, value, fstrm[i].min);
--			result = ISC_R_RANGE;
-+			if (result == ISC_R_SUCCESS)
-+				result = ISC_R_RANGE;
- 		}
- 
- 		if (strcmp(fstrm[i].name, "fstrm-set-input-queue-size") == 0) {
-@@ -1494,7 +1512,8 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
- 					    "%s '%u' not a power-of-2",
- 					    fstrm[i].name,
- 					    cfg_obj_asuint32(obj));
--				result = ISC_R_RANGE;
-+				if (result == ISC_R_SUCCESS)
-+					result = ISC_R_RANGE;
- 			}
- 		}
- 	}
-@@ -1512,7 +1531,8 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
- 				    "%" PRId64 "' "
- 				    "is too small",
- 				    mapsize);
--			return (ISC_R_RANGE);
-+			if (result == ISC_R_SUCCESS)
-+				result = ISC_R_RANGE;
- 		} else if (mapsize > (1ULL << 40)) { /* 1 terabyte */
- 			cfg_obj_log(obj, logctx,
- 				    ISC_LOG_ERROR,
-@@ -1520,10 +1540,20 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
- 				    "%" PRId64 "' "
- 				    "is too large",
- 				    mapsize);
--			return (ISC_R_RANGE);
-+			if (result == ISC_R_SUCCESS)
-+				result = ISC_R_RANGE;
- 		}
- 	}
- 
-+	obj = NULL;
-+	(void)cfg_map_get(options, "resolver-nonbackoff-tries", &obj);
-+	if (obj != NULL && cfg_obj_asuint32(obj) == 0U) {
-+		cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
-+			    "'resolver-nonbackoff-tries' must be >= 1");
-+		if (result == ISC_R_SUCCESS)
-+			result = ISC_R_RANGE;
-+	}
-+
- 	return (result);
- }
- 
-diff --git a/lib/dns/cache.c b/lib/dns/cache.c
-index 4701ff8..97e427a 100644
---- a/lib/dns/cache.c
-+++ b/lib/dns/cache.c
-@@ -138,6 +138,7 @@ struct dns_cache {
- 	int			db_argc;
- 	char			**db_argv;
- 	size_t			size;
-+	dns_ttl_t		serve_stale_ttl;
- 	isc_stats_t		*stats;
- 
- 	/* Locked by 'filelock'. */
-@@ -167,9 +168,13 @@ overmem_cleaning_action(isc_task_t *task, isc_event_t *event);
- 
- static inline isc_result_t
- cache_create_db(dns_cache_t *cache, dns_db_t **db) {
--	return (dns_db_create(cache->mctx, cache->db_type, dns_rootname,
--			      dns_dbtype_cache, cache->rdclass,
--			      cache->db_argc, cache->db_argv, db));
-+	isc_result_t result;
-+	result = dns_db_create(cache->mctx, cache->db_type, dns_rootname,
-+			       dns_dbtype_cache, cache->rdclass,
-+			       cache->db_argc, cache->db_argv, db);
-+	if (result == ISC_R_SUCCESS)
-+		dns_db_setservestalettl(*db, cache->serve_stale_ttl);
-+	return (result);
- }
- 
- isc_result_t
-@@ -238,6 +243,7 @@ dns_cache_create3(isc_mem_t *cmctx, isc_mem_t *hmctx, isc_taskmgr_t *taskmgr,
- 	cache->references = 1;
- 	cache->live_tasks = 0;
- 	cache->rdclass = rdclass;
-+	cache->serve_stale_ttl = 0;
- 
- 	cache->stats = NULL;
- 	result = isc_stats_create(cmctx, &cache->stats,
-@@ -1092,6 +1098,32 @@ dns_cache_getcachesize(dns_cache_t *cache) {
- 	return (size);
- }
- 
-+void
-+dns_cache_setservestalettl(dns_cache_t *cache, dns_ttl_t ttl) {
-+	REQUIRE(VALID_CACHE(cache));
-+
-+	LOCK(&cache->lock);
-+	cache->serve_stale_ttl = ttl;
-+	UNLOCK(&cache->lock);
-+
-+	(void)dns_db_setservestalettl(cache->db, ttl);
-+}
-+
-+dns_ttl_t
-+dns_cache_getservestalettl(dns_cache_t *cache) {
-+	dns_ttl_t ttl;
-+	isc_result_t result;
-+
-+	REQUIRE(VALID_CACHE(cache));
-+
-+	/*
-+	 * Could get it straight from the dns_cache_t, but use db
-+	 * to confirm the value that the db is really using.
-+	 */
-+	result = dns_db_getservestalettl(cache->db, &ttl);
-+	return result == ISC_R_SUCCESS ? ttl : 0;
-+}
-+
- /*
-  * The cleaner task is shutting down; do the necessary cleanup.
-  */
-diff --git a/lib/dns/db.c b/lib/dns/db.c
-index ee3e00d..576aa65 100644
---- a/lib/dns/db.c
-+++ b/lib/dns/db.c
-@@ -1130,3 +1130,25 @@ dns_db_nodefullname(dns_db_t *db, dns_dbnode_t *node, dns_name_t *name) {
- 		return (ISC_R_NOTIMPLEMENTED);
- 	return ((db->methods->nodefullname)(db, node, name));
- }
-+
-+isc_result_t
-+dns_db_setservestalettl(dns_db_t *db, dns_ttl_t ttl)
-+{
-+	REQUIRE(DNS_DB_VALID(db));
-+	REQUIRE((db->attributes & DNS_DBATTR_CACHE) != 0);
-+
-+	if (db->methods->setservestalettl != NULL)
-+		return ((db->methods->setservestalettl)(db, ttl));
-+	return (ISC_R_NOTIMPLEMENTED);
-+}
-+
-+isc_result_t
-+dns_db_getservestalettl(dns_db_t *db, dns_ttl_t *ttl)
-+{
-+	REQUIRE(DNS_DB_VALID(db));
-+	REQUIRE((db->attributes & DNS_DBATTR_CACHE) != 0);
-+
-+	if (db->methods->getservestalettl != NULL)
-+		return ((db->methods->getservestalettl)(db, ttl));
-+	return (ISC_R_NOTIMPLEMENTED);
-+}
-diff --git a/lib/dns/ecdb.c b/lib/dns/ecdb.c
-index 47994ea..23bfe7d 100644
---- a/lib/dns/ecdb.c
-+++ b/lib/dns/ecdb.c
-@@ -588,7 +588,9 @@ static dns_dbmethods_t ecdb_methods = {
- 	NULL,			/* setcachestats */
- 	NULL,			/* hashsize */
- 	NULL,			/* nodefullname */
--	NULL			/* getsize */
-+	NULL,			/* getsize */
-+	NULL,			/* setservestalettl */
-+	NULL			/* getservestalettl */
- };
- 
- static isc_result_t
-diff --git a/lib/dns/include/dns/cache.h b/lib/dns/include/dns/cache.h
-index 62797db..714b78e 100644
---- a/lib/dns/include/dns/cache.h
-+++ b/lib/dns/include/dns/cache.h
-@@ -260,6 +260,27 @@ dns_cache_getcachesize(dns_cache_t *cache);
-  * Get the maximum cache size.
-  */
- 
-+void
-+dns_cache_setservestalettl(dns_cache_t *cache, dns_ttl_t ttl);
-+/*%<
-+ * Sets the maximum length of time that cached answers may be retained
-+ * past their normal TTL.  Default value for the library is 0, disabling
-+ * the use of stale data.
-+ *
-+ * Requires:
-+ *\li	'cache' to be valid.
-+ */
-+
-+dns_ttl_t
-+dns_cache_getservestalettl(dns_cache_t *cache);
-+/*%<
-+ * Gets the maximum length of time that cached answers may be kept past
-+ * normal expiry.
-+ *
-+ * Requires:
-+ *\li	'cache' to be valid.
-+ */
-+
- isc_result_t
- dns_cache_flush(dns_cache_t *cache);
- /*%<
-diff --git a/lib/dns/include/dns/db.h b/lib/dns/include/dns/db.h
-index ae6ae36..5079053 100644
---- a/lib/dns/include/dns/db.h
-+++ b/lib/dns/include/dns/db.h
-@@ -197,6 +197,8 @@ typedef struct dns_dbmethods {
- 					dns_name_t *name);
- 	isc_result_t	(*getsize)(dns_db_t *db, dns_dbversion_t *version,
- 				   uint64_t *records, uint64_t *bytes);
-+	isc_result_t	(*setservestalettl)(dns_db_t *db, dns_ttl_t ttl);
-+	isc_result_t	(*getservestalettl)(dns_db_t *db, dns_ttl_t *ttl);
- } dns_dbmethods_t;
- 
- typedef isc_result_t
-@@ -255,6 +257,7 @@ struct dns_dbonupdatelistener {
- #define DNS_DBFIND_FORCENSEC3		0x0080
- #define DNS_DBFIND_ADDITIONALOK		0x0100
- #define DNS_DBFIND_NOZONECUT		0x0200
-+#define DNS_DBFIND_STALEOK		0x0400
- /*@}*/
- 
- /*@{*/
-@@ -1685,6 +1688,38 @@ dns_db_nodefullname(dns_db_t *db, dns_dbnode_t *node, dns_name_t *name);
-  * \li	'db' is a valid database
-  * \li	'node' and 'name' are not NULL
-  */
-+
-+isc_result_t
-+dns_db_setservestalettl(dns_db_t *db, dns_ttl_t ttl);
-+/*%<
-+ * Sets the maximum length of time that cached answers may be retained
-+ * past their normal TTL. Default value for the library is 0, disabling
-+ * the use of stale data.
-+ *
-+ * Requires:
-+ * \li	'db' is a valid cache database.
-+ * \li	'ttl' is the number of seconds to retain data past its normal expiry.
-+ *
-+ * Returns:
-+ * \li	#ISC_R_SUCCESS
-+ * \li	#ISC_R_NOTIMPLEMENTED - Not supported by this DB implementation.
-+ */
-+
-+isc_result_t
-+dns_db_getservestalettl(dns_db_t *db, dns_ttl_t *ttl);
-+/*%<
-+ * Gets maximum length of time that cached answers may be kept past
-+ * normal TTL expiration.
-+ *
-+ * Requires:
-+ * \li	'db' is a valid cache database.
-+ * \li	'ttl' is the number of seconds to retain data past its normal expiry.
-+ *
-+ * Returns:
-+ * \li	#ISC_R_SUCCESS
-+ * \li	#ISC_R_NOTIMPLEMENTED - Not supported by this DB implementation.
-+ */
-+
- ISC_LANG_ENDDECLS
- 
- #endif /* DNS_DB_H */
-diff --git a/lib/dns/include/dns/rdataset.h b/lib/dns/include/dns/rdataset.h
-index 5295d8e..97071ed 100644
---- a/lib/dns/include/dns/rdataset.h
-+++ b/lib/dns/include/dns/rdataset.h
-@@ -128,6 +128,7 @@ struct dns_rdataset {
- 	unsigned int			magic;		/* XXX ? */
- 	dns_rdatasetmethods_t *		methods;
- 	ISC_LINK(dns_rdataset_t)	link;
-+
- 	/*
- 	 * XXX do we need these, or should they be retrieved by methods?
- 	 * Leaning towards the latter, since they are not frequently required
-@@ -136,12 +137,19 @@ struct dns_rdataset {
- 	dns_rdataclass_t		rdclass;
- 	dns_rdatatype_t			type;
- 	dns_ttl_t			ttl;
-+	/*
-+	 * Stale ttl is used to see how long this RRset can still be used
-+	 * to serve to clients, after the TTL has expired.
-+	 */
-+	dns_ttl_t			stale_ttl;
- 	dns_trust_t			trust;
- 	dns_rdatatype_t			covers;
-+
- 	/*
- 	 * attributes
- 	 */
- 	unsigned int			attributes;
-+
- 	/*%
- 	 * the counter provides the starting point in the "cyclic" order.
- 	 * The value UINT32_MAX has a special meaning of "picking up a
-@@ -149,11 +157,13 @@ struct dns_rdataset {
- 	 * increment the counter.
- 	 */
- 	uint32_t			count;
-+
- 	/*
- 	 * This RRSIG RRset should be re-generated around this time.
- 	 * Only valid if DNS_RDATASETATTR_RESIGN is set in attributes.
- 	 */
- 	isc_stdtime_t			resign;
-+
- 	/*@{*/
- 	/*%
- 	 * These are for use by the rdataset implementation, and MUST NOT
-@@ -206,6 +216,7 @@ struct dns_rdataset {
- #define DNS_RDATASETATTR_OPTOUT		0x00100000	/*%< OPTOUT proof */
- #define DNS_RDATASETATTR_NEGATIVE	0x00200000
- #define DNS_RDATASETATTR_PREFETCH	0x00400000
-+#define DNS_RDATASETATTR_STALE		0x01000000
- 
- /*%
-  * _OMITDNSSEC:
-diff --git a/lib/dns/include/dns/resolver.h b/lib/dns/include/dns/resolver.h
-index 6da41b7..7b397cb 100644
---- a/lib/dns/include/dns/resolver.h
-+++ b/lib/dns/include/dns/resolver.h
-@@ -547,9 +547,12 @@ dns_resolver_getmustbesecure(dns_resolver_t *resolver, dns_name_t *name);
- 
- 
- void
--dns_resolver_settimeout(dns_resolver_t *resolver, unsigned int seconds);
-+dns_resolver_settimeout(dns_resolver_t *resolver, unsigned int timeout);
- /*%<
-- * Set the length of time the resolver will work on a query, in seconds.
-+ * Set the length of time the resolver will work on a query, in milliseconds.
-+ *
-+ * 'timeout' was originally defined in seconds, and later redefined to be in
-+ * milliseconds.  Values less than or equal to 300 are treated as seconds.
-  *
-  * If timeout is 0, the default timeout will be applied.
-  *
-@@ -560,7 +563,8 @@ dns_resolver_settimeout(dns_resolver_t *resolver, unsigned int seconds);
- unsigned int
- dns_resolver_gettimeout(dns_resolver_t *resolver);
- /*%<
-- * Get the current length of time the resolver will work on a query, in seconds.
-+ * Get the current length of time the resolver will work on a query,
-+ * in milliseconds.
-  *
-  * Requires:
-  * \li  resolver to be valid.
-@@ -582,6 +586,39 @@ dns_resolver_getzeronosoattl(dns_resolver_t *resolver);
- void
- dns_resolver_setzeronosoattl(dns_resolver_t *resolver, bool state);
- 
-+unsigned int
-+dns_resolver_getretryinterval(dns_resolver_t *resolver);
-+
-+void
-+dns_resolver_setretryinterval(dns_resolver_t *resolver, unsigned int interval);
-+/*%<
-+ * Sets the amount of time, in millseconds, that is waited for a reply
-+ * to a server before another server is tried.  Interacts with the
-+ * value of dns_resolver_getnonbackofftries() by trying that number of times
-+ * at this interval, before doing exponential backoff and doubling the interval
-+ * on each subsequent try, to a maximum of 10 seconds.  Defaults to 800 ms;
-+ * silently capped at 2000 ms.
-+ *
-+ * Requires:
-+ * \li	resolver to be valid.
-+ * \li  interval > 0.
-+ */
-+
-+unsigned int
-+dns_resolver_getnonbackofftries(dns_resolver_t *resolver);
-+
-+void
-+dns_resolver_setnonbackofftries(dns_resolver_t *resolver, unsigned int tries);
-+/*%<
-+ * Sets the number of failures of getting a reply from remote servers for
-+ * a query before backing off by doubling the retry interval for each
-+ * subsequent request sent.  Defaults to 3.
-+ *
-+ * Requires:
-+ * \li	resolver to be valid.
-+ * \li  tries > 0.
-+ */
-+
- unsigned int
- dns_resolver_getoptions(dns_resolver_t *resolver);
- 
-diff --git a/lib/dns/include/dns/types.h b/lib/dns/include/dns/types.h
-index 567e8a8..7bf2b60 100644
---- a/lib/dns/include/dns/types.h
-+++ b/lib/dns/include/dns/types.h
-@@ -385,6 +385,12 @@ typedef enum {
- 	dns_updatemethod_date
- } dns_updatemethod_t;
- 
-+typedef enum {
-+	dns_stale_answer_no,
-+	dns_stale_answer_yes,
-+	dns_stale_answer_conf
-+} dns_stale_answer_t;
-+
- /*
-  * Functions.
-  */
-diff --git a/lib/dns/include/dns/view.h b/lib/dns/include/dns/view.h
-index c849dec..647ca2a 100644
---- a/lib/dns/include/dns/view.h
-+++ b/lib/dns/include/dns/view.h
-@@ -229,6 +229,9 @@ struct dns_view {
- 	dns_dtenv_t			*dtenv;		/* Dnstap environment */
- 	dns_dtmsgtype_t			dttypes;	/* Dnstap message types
- 							   to log */
-+	dns_ttl_t			staleanswerttl;
-+	dns_stale_answer_t		staleanswersok;		/* rndc setting */
-+	bool				staleanswersenable;	/* named.conf setting */
- };
- 
- #define DNS_VIEW_MAGIC			ISC_MAGIC('V','i','e','w')
-diff --git a/lib/dns/master.c b/lib/dns/master.c
-index 2a87bca..ac4bb19 100644
---- a/lib/dns/master.c
-+++ b/lib/dns/master.c
-@@ -1948,12 +1948,18 @@ load_text(dns_loadctx_t *lctx) {
- 
- 		if ((lctx->options & DNS_MASTER_AGETTL) != 0) {
- 			/*
--			 * Adjust the TTL for $DATE.  If the RR has already
--			 * expired, ignore it.
-+			 * Adjust the TTL for $DATE. If the RR has
-+			 * already expired, set its TTL to 0. This
-+			 * should be okay even if the TTL stretching
-+			 * feature is not in effect, because it will
-+			 * just be quickly expired by the cache, and the
-+			 * way this was written before the patch it
-+			 * could potentially add 0 TTLs anyway.
- 			 */
- 			if (lctx->ttl < ttl_offset)
--				continue;
--			lctx->ttl -= ttl_offset;
-+				lctx->ttl = 0;
-+			else
-+				lctx->ttl -= ttl_offset;
- 		}
- 
- 		/*
-diff --git a/lib/dns/masterdump.c b/lib/dns/masterdump.c
-index 13d1a3e..873b694 100644
---- a/lib/dns/masterdump.c
-+++ b/lib/dns/masterdump.c
-@@ -81,6 +81,9 @@ struct dns_master_style {
-  */
- #define DNS_TOTEXT_LINEBREAK_MAXLEN 100
- 
-+/*% Does the rdataset 'r' contain a stale answer? */
-+#define STALE(r) (((r)->attributes & DNS_RDATASETATTR_STALE) != 0)
-+
- /*%
-  * Context structure for a masterfile dump in progress.
-  */
-@@ -94,6 +97,7 @@ typedef struct dns_totext_ctx {
- 	dns_fixedname_t		origin_fixname;
- 	uint32_t 		current_ttl;
- 	bool 			current_ttl_valid;
-+	dns_ttl_t		serve_stale_ttl;
- } dns_totext_ctx_t;
- 
- LIBDNS_EXTERNAL_DATA const dns_master_style_t
-@@ -382,6 +386,7 @@ totext_ctx_init(const dns_master_style_t *style, dns_totext_ctx_t *ctx) {
- 	ctx->neworigin = NULL;
- 	ctx->current_ttl = 0;
- 	ctx->current_ttl_valid = false;
-+	ctx->serve_stale_ttl = 0;
- 
- 	return (ISC_R_SUCCESS);
- }
-@@ -1028,6 +1033,11 @@ dump_rdatasets_text(isc_mem_t *mctx, dns_name_t *name,
- 		    (ctx->style.flags & DNS_STYLEFLAG_NCACHE) == 0) {
- 			/* Omit negative cache entries */
- 		} else {
-+			if (STALE(rds)) {
-+				fprintf(f, "; stale (for %u more seconds)\n",
-+					(rds->stale_ttl -
-+					 ctx->serve_stale_ttl));
-+			}
- 			isc_result_t result =
- 				dump_rdataset(mctx, name, rds, ctx,
- 					       buffer, f);
-@@ -1496,6 +1506,16 @@ dumpctx_create(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version,
- 	dns_db_attach(db, &dctx->db);
- 
- 	dctx->do_date = dns_db_iscache(dctx->db);
-+	if (dctx->do_date) {
-+		/*
-+		 * Adjust the date backwards by the serve-stale TTL, if any.
-+		 * This is so the TTL will be loaded correctly when next
-+		 * started.
-+		 */
-+		(void)dns_db_getservestalettl(dctx->db,
-+					      &dctx->tctx.serve_stale_ttl);
-+		dctx->now -= dctx->tctx.serve_stale_ttl;
-+	}
- 
- 	if (dctx->format == dns_masterformat_text &&
- 	    (dctx->tctx.style.flags & DNS_STYLEFLAG_REL_OWNER) != 0) {
-@@ -1555,6 +1575,9 @@ writeheader(dns_dumpctx_t *dctx) {
- 		 * it in the zone case.
- 		 */
- 		if (dctx->do_date) {
-+			fprintf(dctx->f,
-+				"; using a %d second stale ttl\n",
-+				dctx->tctx.serve_stale_ttl);
- 			result = dns_time32_totext(dctx->now, &buffer);
- 			RUNTIME_CHECK(result == ISC_R_SUCCESS);
- 			isc_buffer_usedregion(&buffer, &r);
-diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
-index 68e6a89..d8b5c60 100644
---- a/lib/dns/rbtdb.c
-+++ b/lib/dns/rbtdb.c
-@@ -488,6 +488,7 @@ typedef ISC_LIST(rdatasetheader_t)      rdatasetheaderlist_t;
- typedef ISC_LIST(dns_rbtnode_t)         rbtnodelist_t;
- 
- #define RDATASET_ATTR_NONEXISTENT       0x0001
-+/*%< May be potentially served as stale data. */
- #define RDATASET_ATTR_STALE             0x0002
- #define RDATASET_ATTR_IGNORE            0x0004
- #define RDATASET_ATTR_RETAIN            0x0008
-@@ -500,6 +501,8 @@ typedef ISC_LIST(dns_rbtnode_t)         rbtnodelist_t;
- #define RDATASET_ATTR_CASESET           0x0400
- #define RDATASET_ATTR_ZEROTTL           0x0800
- #define RDATASET_ATTR_CASEFULLYLOWER    0x1000
-+/*%< Ancient - awaiting cleanup. */
-+#define RDATASET_ATTR_ANCIENT           0x2000
- 
- typedef struct acache_cbarg {
- 	dns_rdatasetadditional_t        type;
-@@ -550,6 +553,8 @@ struct acachectl {
- 	(((header)->attributes & RDATASET_ATTR_ZEROTTL) != 0)
- #define CASEFULLYLOWER(header) \
- 	(((header)->attributes & RDATASET_ATTR_CASEFULLYLOWER) != 0)
-+#define ANCIENT(header) \
-+	(((header)->attributes & RDATASET_ATTR_ANCIENT) != 0)
- 
- 
- #define ACTIVE(header, now) \
-@@ -609,6 +614,12 @@ typedef enum {
- 	expire_flush
- } expire_t;
- 
-+typedef enum {
-+	rdataset_ttl_fresh,
-+	rdataset_ttl_stale,
-+	rdataset_ttl_ancient
-+} rdataset_ttl_t;
-+
- typedef struct rbtdb_version {
- 	/* Not locked */
- 	rbtdb_serial_t                  serial;
-@@ -676,6 +687,12 @@ struct dns_rbtdb {
- 	dns_dbnode_t                    *soanode;
- 	dns_dbnode_t                    *nsnode;
- 
-+	/*
-+	 * Maximum length of time to keep using a stale answer past its
-+	 * normal TTL expiry.
-+	*/
-+	dns_ttl_t			serve_stale_ttl;
-+
- 	/*
- 	 * This is a linked list used to implement the LRU cache.  There will
- 	 * be node_lock_count linked lists here.  Nodes in bucket 1 will be
-@@ -719,6 +736,8 @@ struct dns_rbtdb {
- #define RBTDB_ATTR_LOADED               0x01
- #define RBTDB_ATTR_LOADING              0x02
- 
-+#define KEEPSTALE(rbtdb) ((rbtdb)->serve_stale_ttl > 0)
-+
- /*%
-  * Search Context
-  */
-@@ -1784,15 +1803,15 @@ rollback_node(dns_rbtnode_t *node, rbtdb_serial_t serial) {
- }
- 
- static inline void
--mark_stale_header(dns_rbtdb_t *rbtdb, rdatasetheader_t *header) {
-+mark_header_ancient(dns_rbtdb_t *rbtdb, rdatasetheader_t *header) {
- 
- 	/*
--	 * If we are already stale there is nothing to do.
-+	 * If we are already ancient there is nothing to do.
- 	 */
--	if ((header->attributes & RDATASET_ATTR_STALE) != 0)
-+	if (ANCIENT(header))
- 		return;
- 
--	header->attributes |= RDATASET_ATTR_STALE;
-+	header->attributes |= RDATASET_ATTR_ANCIENT;
- 	header->node->dirty = 1;
- 
- 	/*
-@@ -1833,8 +1852,8 @@ clean_cache_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node) {
- 		/*
- 		 * If current is nonexistent or stale, we can clean it up.
- 		 */
--		if ((current->attributes &
--		     (RDATASET_ATTR_NONEXISTENT|RDATASET_ATTR_STALE)) != 0) {
-+		if (NONEXISTENT(current) || ANCIENT(current) ||
-+		    (STALE(current) && ! KEEPSTALE(rbtdb))) {
- 			if (top_prev != NULL)
- 				top_prev->next = current->next;
- 			else
-@@ -2079,6 +2098,80 @@ delete_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node) {
- 	}
- }
- 
-+#if 0
-+static void
-+clean_now_or_later(dns_rbtnode_t *node, dns_rbtdb_t *rbtdb,
-+		   rdatasetheader_t *header, rdatasetheader_t **header_prevp)
-+{
-+	if (dns_rbtnode_refcurrent(node) == 0) {
-+		isc_mem_t *mctx;
-+
-+		/*
-+		 * header->down can be non-NULL if the refcount has just
-+		 * decremented to 0 but decrement_reference() has not performed
-+		 * clean_cache_node(), in which case we need to purge the stale
-+		 * headers first.
-+		 */
-+		mctx = rbtdb->common.mctx;
-+		clean_stale_headers(rbtdb, mctx, header);
-+		if (*header_prevp != NULL)
-+			(*header_prevp)->next = header->next;
-+		else
-+			node->data = header->next;
-+		free_rdataset(rbtdb, mctx, header);
-+	} else {
-+		header->attributes |= RDATASET_ATTR_STALE |
-+		                      RDATASET_ATTR_ANCIENT;
-+		node->dirty = 1;
-+		*header_prevp = header;
-+	}
-+}
-+
-+static rdataset_ttl_t
-+check_ttl(dns_rbtnode_t *node, rbtdb_search_t *search,
-+	  rdatasetheader_t *header, rdatasetheader_t **header_prevp,
-+	  nodelock_t *lock, isc_rwlocktype_t *locktype)
-+{
-+	dns_rbtdb_t *rbtdb = search->rbtdb;
-+
-+	if (header->rdh_ttl > search->now)
-+		return rdataset_ttl_fresh;
-+
-+	/*
-+	 * This rdataset is stale, but perhaps still usable.
-+	 */
-+	if (KEEPSTALE(rbtdb) &&
-+	    header->rdh_ttl + rbtdb->serve_stale_ttl > search->now) {
-+		header->attributes |= RDATASET_ATTR_STALE;
-+		/* Doesn't set dirty because it doesn't need removal. */
-+		return rdataset_ttl_stale;
-+	}
-+
-+	/*
-+	 * This rdataset is so stale it is no longer usable, even with
-+	 * KEEPSTALE.  If no one else is using the node, we can clean it up
-+	 * right now, otherwise we mark it as ancient, and the node as dirty,
-+	 * so it will get cleaned up later.
-+	 */
-+	if ((header->rdh_ttl <= search->now - RBTDB_VIRTUAL) &&
-+	    (*locktype == isc_rwlocktype_write ||
-+	     NODE_TRYUPGRADE(lock) == ISC_R_SUCCESS)) {
-+		/*
-+		 * We update the node's status only when we can get write
-+		 * access; otherwise, we leave others to this work.  Periodical
-+		 * cleaning will eventually take the job as the last resort.
-+		 * We won't downgrade the lock, since other rdatasets are
-+		 * probably stale, too.
-+		 */
-+		*locktype = isc_rwlocktype_write;
-+		clean_now_or_later(node, rbtdb, header, header_prevp);
-+	} else
-+		*header_prevp = header;
-+
-+	return rdataset_ttl_ancient;
-+}
-+#endif
-+
- /*
-  * Caller must be holding the node lock.
-  */
-@@ -3316,6 +3409,12 @@ bind_rdataset(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
- 		rdataset->attributes |= DNS_RDATASETATTR_OPTOUT;
- 	if (PREFETCH(header))
- 		rdataset->attributes |= DNS_RDATASETATTR_PREFETCH;
-+	if (STALE(header)) {
-+		rdataset->attributes |= DNS_RDATASETATTR_STALE;
-+		rdataset->stale_ttl =
-+			(rbtdb->serve_stale_ttl + header->rdh_ttl) - now;
-+		rdataset->ttl = 0;
-+	}
- 	rdataset->private1 = rbtdb;
- 	rdataset->private2 = node;
- 	raw = (unsigned char *)header + sizeof(*header);
-@@ -4656,6 +4755,19 @@ check_stale_header(dns_rbtnode_t *node, rdatasetheader_t *header,
- #endif
- 
- 	if (!ACTIVE(header, search->now)) {
-+		dns_ttl_t stale = header->rdh_ttl +
-+				  search->rbtdb->serve_stale_ttl;
-+		/*
-+		 * If this data is in the stale window keep it and if
-+		 * DNS_DBFIND_STALEOK is not set we tell the caller to
-+		 * skip this record.
-+		 */
-+		if (KEEPSTALE(search->rbtdb) && stale > search->now) {
-+			header->attributes |= RDATASET_ATTR_STALE;
-+			*header_prev = header;
-+			return ((search->options & DNS_DBFIND_STALEOK) == 0);
-+		}
-+
- 		/*
- 		 * This rdataset is stale.  If no one else is using the
- 		 * node, we can clean it up right now, otherwise we mark
-@@ -4695,7 +4807,7 @@ check_stale_header(dns_rbtnode_t *node, rdatasetheader_t *header,
- 					node->data = header->next;
- 				free_rdataset(search->rbtdb, mctx, header);
- 			} else {
--				mark_stale_header(search->rbtdb, header);
-+				mark_header_ancient(search->rbtdb, header);
- 				*header_prev = header;
- 			}
- 		} else
-@@ -5133,7 +5245,7 @@ cache_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
- 				       &locktype, lock, &search,
- 				       &header_prev)) {
- 			/* Do nothing. */
--		} else if (EXISTS(header) && (!STALE(header))) {
-+		} else if (EXISTS(header) && !ANCIENT(header)) {
- 			/*
- 			 * We now know that there is at least one active
- 			 * non-stale rdataset at this node.
-@@ -5611,7 +5723,7 @@ expirenode(dns_db_t *db, dns_dbnode_t *node, isc_stdtime_t now) {
- 			 * refcurrent(rbtnode) must be non-zero.  This is so
- 			 * because 'node' is an argument to the function.
- 			 */
--			mark_stale_header(rbtdb, header);
-+			mark_header_ancient(rbtdb, header);
- 			if (log)
- 				isc_log_write(dns_lctx, category, module,
- 					      level, "overmem cache: stale %s",
-@@ -5619,7 +5731,7 @@ expirenode(dns_db_t *db, dns_dbnode_t *node, isc_stdtime_t now) {
- 		} else if (force_expire) {
- 			if (! RETAIN(header)) {
- 				set_ttl(rbtdb, header, 0);
--				mark_stale_header(rbtdb, header);
-+				mark_header_ancient(rbtdb, header);
- 			} else if (log) {
- 				isc_log_write(dns_lctx, category, module,
- 					      level, "overmem cache: "
-@@ -5876,9 +5988,9 @@ cache_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
- 				 * non-zero.  This is so because 'node' is an
- 				 * argument to the function.
- 				 */
--				mark_stale_header(rbtdb, header);
-+				mark_header_ancient(rbtdb, header);
- 			}
--		} else if (EXISTS(header) && (!STALE(header))) {
-+		} else if (EXISTS(header) && !ANCIENT(header)) {
- 			if (header->type == matchtype)
- 				found = header;
- 			else if (header->type == RBTDB_RDATATYPE_NCACHEANY ||
-@@ -6170,7 +6282,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
- 				     topheader = topheader->next)
- 				{
- 					set_ttl(rbtdb, topheader, 0);
--					mark_stale_header(rbtdb, topheader);
-+					mark_header_ancient(rbtdb, topheader);
- 				}
- 				goto find_header;
- 			}
-@@ -6228,7 +6340,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
- 				 * ncache entry.
- 				 */
- 				set_ttl(rbtdb, topheader, 0);
--				mark_stale_header(rbtdb, topheader);
-+				mark_header_ancient(rbtdb, topheader);
- 				topheader = NULL;
- 				goto find_header;
- 			}
-@@ -6266,8 +6378,11 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
- 		}
- 
- 		/*
--		 * Trying to add an rdataset with lower trust to a cache DB
--		 * has no effect, provided that the cache data isn't stale.
-+		 * Trying to add an rdataset with lower trust to a cache
-+		 * DB has no effect, provided that the cache data isn't
-+		 * stale. If the cache data is stale, new lower trust
-+		 * data will supersede it below. Unclear what the best
-+		 * policy is here.
- 		 */
- 		if (rbtversion == NULL && trust < header->trust &&
- 		    (ACTIVE(header, now) || header_nx)) {
-@@ -6296,6 +6411,10 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
- 
- 			if ((options & DNS_DBADD_EXACT) != 0)
- 				flags |= DNS_RDATASLAB_EXACT;
-+			/*
-+			 * TTL use here is irrelevant to the cache;
-+			 * merge is only done with zonedbs.
-+			 */
- 			if ((options & DNS_DBADD_EXACTTTL) != 0 &&
- 			     newheader->rdh_ttl != header->rdh_ttl)
- 					result = DNS_R_NOTEXACT;
-@@ -6339,11 +6458,12 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
- 			}
- 		}
- 		/*
--		 * Don't replace existing NS, A and AAAA RRsets
--		 * in the cache if they are already exist.  This
--		 * prevents named being locked to old servers.
--		 * Don't lower trust of existing record if the
--		 * update is forced.
-+		 * Don't replace existing NS, A and AAAA RRsets in the
-+		 * cache if they are already exist. This prevents named
-+		 * being locked to old servers. Don't lower trust of
-+		 * existing record if the update is forced. Nothing
-+		 * special to be done w.r.t stale data; it gets replaced
-+		 * normally further down.
- 		 */
- 		if (IS_CACHE(rbtdb) && ACTIVE(header, now) &&
- 		    header->type == dns_rdatatype_ns &&
-@@ -6514,10 +6634,10 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
- 				changed->dirty = true;
- 			if (rbtversion == NULL) {
- 				set_ttl(rbtdb, header, 0);
--				mark_stale_header(rbtdb, header);
-+				mark_header_ancient(rbtdb, header);
- 				if (sigheader != NULL) {
- 					set_ttl(rbtdb, sigheader, 0);
--					mark_stale_header(rbtdb, sigheader);
-+					mark_header_ancient(rbtdb, sigheader);
- 				}
- 			}
- 			if (rbtversion != NULL && !header_nx) {
-@@ -8334,6 +8454,30 @@ nodefullname(dns_db_t *db, dns_dbnode_t *node, dns_name_t *name) {
- 	return (result);
- }
- 
-+static isc_result_t
-+setservestalettl(dns_db_t *db, dns_ttl_t ttl) {
-+	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
-+
-+	REQUIRE(VALID_RBTDB(rbtdb));
-+	REQUIRE(IS_CACHE(rbtdb));
-+
-+	/* currently no bounds checking.  0 means disable. */
-+	rbtdb->serve_stale_ttl = ttl;
-+	return ISC_R_SUCCESS;
-+}
-+
-+static isc_result_t
-+getservestalettl(dns_db_t *db, dns_ttl_t *ttl) {
-+	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
-+
-+	REQUIRE(VALID_RBTDB(rbtdb));
-+	REQUIRE(IS_CACHE(rbtdb));
-+
-+	*ttl = rbtdb->serve_stale_ttl;
-+	return ISC_R_SUCCESS;
-+}
-+
-+
- static dns_dbmethods_t zone_methods = {
- 	attach,
- 	detach,
-@@ -8379,7 +8523,9 @@ static dns_dbmethods_t zone_methods = {
- 	NULL,
- 	hashsize,
- 	nodefullname,
--	getsize
-+	getsize,
-+	NULL,
-+	NULL
- };
- 
- static dns_dbmethods_t cache_methods = {
-@@ -8427,7 +8573,9 @@ static dns_dbmethods_t cache_methods = {
- 	setcachestats,
- 	hashsize,
- 	nodefullname,
--	NULL
-+	NULL,
-+	setservestalettl,
-+	getservestalettl
- };
- 
- isc_result_t
-@@ -8698,7 +8846,7 @@ dns_rbtdb_create
- 	rbtdb->rpzs = NULL;
- 	rbtdb->load_rpzs = NULL;
- 	rbtdb->rpz_num = DNS_RPZ_INVALID_NUM;
--
-+	rbtdb->serve_stale_ttl = 0;
- 	/*
- 	 * Version Initialization.
- 	 */
-@@ -9116,7 +9264,8 @@ rdatasetiter_first(dns_rdatasetiter_t *iterator) {
- 				 * rdatasets to work.
- 				 */
- 				if (NONEXISTENT(header) ||
--				    (now != 0 && now > header->rdh_ttl))
-+				    (now != 0 && now > header->rdh_ttl
-+						     + rbtdb->serve_stale_ttl))
- 					header = NULL;
- 				break;
- 			} else
-@@ -10325,7 +10474,7 @@ static inline bool
- need_headerupdate(rdatasetheader_t *header, isc_stdtime_t now) {
- 	if ((header->attributes &
- 	     (RDATASET_ATTR_NONEXISTENT |
--	      RDATASET_ATTR_STALE |
-+	      RDATASET_ATTR_ANCIENT |
- 	      RDATASET_ATTR_ZEROTTL)) != 0)
- 		return (false);
- 
-@@ -10431,7 +10580,7 @@ expire_header(dns_rbtdb_t *rbtdb, rdatasetheader_t *header,
- 	      bool tree_locked, expire_t reason)
- {
- 	set_ttl(rbtdb, header, 0);
--	mark_stale_header(rbtdb, header);
-+	mark_header_ancient(rbtdb, header);
- 
- 	/*
- 	 * Caller must hold the node (write) lock.
-diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
-index 8db9845..9f65c05 100644
---- a/lib/dns/resolver.c
-+++ b/lib/dns/resolver.c
-@@ -141,16 +141,17 @@
- #endif /* WANT_QUERYTRACE */
- 
- #define US_PER_SEC 1000000U
-+#define US_PER_MSEC 1000U
- /*
-  * The maximum time we will wait for a single query.
-  */
--#define MAX_SINGLE_QUERY_TIMEOUT 9U
--#define MAX_SINGLE_QUERY_TIMEOUT_US (MAX_SINGLE_QUERY_TIMEOUT*US_PER_SEC)
-+#define MAX_SINGLE_QUERY_TIMEOUT 9000U
-+#define MAX_SINGLE_QUERY_TIMEOUT_US (MAX_SINGLE_QUERY_TIMEOUT*US_PER_MSEC)
- 
- /*
-  * We need to allow a individual query time to complete / timeout.
-  */
--#define MINIMUM_QUERY_TIMEOUT (MAX_SINGLE_QUERY_TIMEOUT + 1U)
-+#define MINIMUM_QUERY_TIMEOUT (MAX_SINGLE_QUERY_TIMEOUT + 1000U)
- 
- /* The default time in seconds for the whole query to live. */
- #ifndef DEFAULT_QUERY_TIMEOUT
-@@ -159,7 +160,7 @@
- 
- /* The maximum time in seconds for the whole query to live. */
- #ifndef MAXIMUM_QUERY_TIMEOUT
--#define MAXIMUM_QUERY_TIMEOUT 30
-+#define MAXIMUM_QUERY_TIMEOUT 30000
- #endif
- 
- /* The default maximum number of recursions to follow before giving up. */
-@@ -497,6 +498,10 @@ struct dns_resolver {
- 	unsigned int			maxqueries;
- 	isc_result_t			quotaresp[2];
- 
-+	/* Additions for serve-stale feature. */
-+	unsigned int			retryinterval; /* in milliseconds */
-+	unsigned int			nonbackofftries;
-+
- 	/* Locked by lock. */
- 	unsigned int			references;
- 	bool			exiting;
-@@ -1620,14 +1625,12 @@ fctx_setretryinterval(fetchctx_t *fctx, unsigned int rtt) {
- 	unsigned int seconds;
- 	unsigned int us;
- 
-+	us = fctx->res->retryinterval * 1000;
- 	/*
--	 * We retry every .8 seconds the first two times through the address
--	 * list, and then we do exponential back-off.
-+	 * Exponential backoff after the first few tries.
- 	 */
--	if (fctx->restarts < 3)
--		us = 800000;
--	else
--		us = (800000 << (fctx->restarts - 2));
-+	if (fctx->restarts >= fctx->res->nonbackofftries)
-+		us <<= (fctx->restarts - fctx->res->nonbackofftries - 1);
- 
- 	/*
- 	 * Add a fudge factor to the expected rtt based on the current
-@@ -4489,7 +4492,8 @@ fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type,
- 	/*
- 	 * Compute an expiration time for the entire fetch.
- 	 */
--	isc_interval_set(&interval, res->query_timeout, 0);
-+	isc_interval_set(&interval, res->query_timeout / 1000,
-+			 res->query_timeout % 1000 * 1000000);
- 	iresult = isc_time_nowplusinterval(&fctx->expires, &interval);
- 	if (iresult != ISC_R_SUCCESS) {
- 		UNEXPECTED_ERROR(__FILE__, __LINE__,
-@@ -8977,6 +8981,8 @@ dns_resolver_create(dns_view_t *view,
- 	res->spillattimer = NULL;
- 	res->zspill = 0;
- 	res->zero_no_soa_ttl = false;
-+	res->retryinterval = 30000;
-+	res->nonbackofftries = 3;
- 	res->query_timeout = DEFAULT_QUERY_TIMEOUT;
- 	res->maxdepth = DEFAULT_RECURSION_DEPTH;
- 	res->maxqueries = DEFAULT_MAX_QUERIES;
-@@ -10304,17 +10310,20 @@ dns_resolver_gettimeout(dns_resolver_t *resolver) {
- }
- 
- void
--dns_resolver_settimeout(dns_resolver_t *resolver, unsigned int seconds) {
-+dns_resolver_settimeout(dns_resolver_t *resolver, unsigned int timeout) {
- 	REQUIRE(VALID_RESOLVER(resolver));
- 
--	if (seconds == 0)
--		seconds = DEFAULT_QUERY_TIMEOUT;
--	if (seconds > MAXIMUM_QUERY_TIMEOUT)
--		seconds = MAXIMUM_QUERY_TIMEOUT;
--	if (seconds < MINIMUM_QUERY_TIMEOUT)
--		seconds =  MINIMUM_QUERY_TIMEOUT;
-+	if (timeout <= 300)
-+		timeout *= 1000;
-+
-+	if (timeout == 0)
-+		timeout = DEFAULT_QUERY_TIMEOUT;
-+	if (timeout > MAXIMUM_QUERY_TIMEOUT)
-+		timeout = MAXIMUM_QUERY_TIMEOUT;
-+	if (timeout < MINIMUM_QUERY_TIMEOUT)
-+		timeout =  MINIMUM_QUERY_TIMEOUT;
- 
--	resolver->query_timeout = seconds;
-+	resolver->query_timeout = timeout;
- }
- 
- void
-@@ -10411,3 +10420,34 @@ dns_resolver_getquotaresponse(dns_resolver_t *resolver, dns_quotatype_t which)
- 
- 	return (resolver->quotaresp[which]);
- }
-+
-+unsigned int
-+dns_resolver_getretryinterval(dns_resolver_t *resolver) {
-+	REQUIRE(VALID_RESOLVER(resolver));
-+
-+	return (resolver->retryinterval);
-+}
-+
-+void
-+dns_resolver_setretryinterval(dns_resolver_t *resolver, unsigned int interval)
-+{
-+	REQUIRE(VALID_RESOLVER(resolver));
-+	REQUIRE(interval > 0);
-+
-+	resolver->retryinterval = ISC_MIN(interval, 2000);
-+}
-+
-+unsigned int
-+dns_resolver_getnonbackofftries(dns_resolver_t *resolver) {
-+	REQUIRE(VALID_RESOLVER(resolver));
-+
-+	return (resolver->nonbackofftries);
-+}
-+
-+void
-+dns_resolver_setnonbackofftries(dns_resolver_t *resolver, unsigned int tries) {
-+	REQUIRE(VALID_RESOLVER(resolver));
-+	REQUIRE(tries > 0);
-+
-+	resolver->nonbackofftries = tries;
-+}
-diff --git a/lib/dns/sdb.c b/lib/dns/sdb.c
-index d4c8c67..ee9be79 100644
---- a/lib/dns/sdb.c
-+++ b/lib/dns/sdb.c
-@@ -1368,7 +1368,9 @@ static dns_dbmethods_t sdb_methods = {
- 	NULL,			/* setcachestats */
- 	NULL,			/* hashsize */
- 	NULL,			/* nodefullname */
--	NULL			/* getsize */
-+	NULL,			/* getsize */
-+	NULL,			/* setservestalettl */
-+	NULL			/* getservestalettl */
- };
- 
- static isc_result_t
-diff --git a/lib/dns/sdlz.c b/lib/dns/sdlz.c
-index 0b9620c..331992e 100644
---- a/lib/dns/sdlz.c
-+++ b/lib/dns/sdlz.c
-@@ -1336,7 +1336,9 @@ static dns_dbmethods_t sdlzdb_methods = {
- 	NULL,			/* setcachestats */
- 	NULL,			/* hashsize */
- 	NULL,			/* nodefullname */
--	NULL			/* getsize */
-+	NULL,			/* getsize */
-+	NULL,			/* setservestalettl */
-+	NULL			/* getservestalettl */
- };
- 
- /*
-diff --git a/lib/dns/tests/db_test.c b/lib/dns/tests/db_test.c
-index 35cf21d..bf39545 100644
---- a/lib/dns/tests/db_test.c
-+++ b/lib/dns/tests/db_test.c
-@@ -28,8 +28,9 @@
- 
- #include <dns/db.h>
- #include <dns/dbiterator.h>
--#include <dns/name.h>
- #include <dns/journal.h>
-+#include <dns/name.h>
-+#include <dns/rdatalist.h>
- 
- #include "dnstest.h"
- 
-@@ -76,7 +77,7 @@ getoriginnode_test(void **state) {
- 	assert_int_equal(result, ISC_R_SUCCESS);
- 
- 	result = dns_db_create(mymctx, "rbt", dns_rootname, dns_dbtype_zone,
--			    dns_rdataclass_in, 0, NULL, &db);
-+			       dns_rdataclass_in, 0, NULL, &db);
- 	assert_int_equal(result, ISC_R_SUCCESS);
- 
- 	result = dns_db_getoriginnode(db, &node);
-@@ -91,6 +92,197 @@ getoriginnode_test(void **state) {
- 	isc_mem_detach(&mymctx);
- }
- 
-+/* test getservestalettl and setservestalettl */
-+static void
-+getsetservestalettl_test(void **state) {
-+	dns_db_t *db = NULL;
-+	isc_mem_t *mymctx = NULL;
-+	isc_result_t result;
-+	dns_ttl_t ttl;
-+
-+	UNUSED(state);
-+
-+	result = isc_mem_create(0, 0, &mymctx);
-+	assert_int_equal(result, ISC_R_SUCCESS);
-+
-+	result = dns_db_create(mymctx, "rbt", dns_rootname, dns_dbtype_cache,
-+			       dns_rdataclass_in, 0, NULL, &db);
-+	assert_int_equal(result, ISC_R_SUCCESS);
-+
-+	ttl = 5000;
-+	result = dns_db_getservestalettl(db, &ttl);
-+	assert_int_equal(result, ISC_R_SUCCESS);
-+	assert_int_equal(ttl, 0);
-+
-+	ttl = 6 * 3600;
-+	result = dns_db_setservestalettl(db, ttl);
-+	assert_int_equal(result, ISC_R_SUCCESS);
-+
-+	ttl = 5000;
-+	result = dns_db_getservestalettl(db, &ttl);
-+	assert_int_equal(result, ISC_R_SUCCESS);
-+	assert_int_equal(ttl, 6 * 3600);
-+
-+	dns_db_detach(&db);
-+	isc_mem_detach(&mymctx);
-+}
-+
-+/* check DNS_DBFIND_STALEOK works */
-+static void
-+dns_dbfind_staleok_test(void **state) {
-+	dns_db_t *db = NULL;
-+	dns_dbnode_t *node = NULL;
-+	dns_fixedname_t example_fixed;
-+	dns_fixedname_t found_fixed;
-+	dns_name_t *example;
-+	dns_name_t *found;
-+	dns_rdatalist_t rdatalist;
-+	dns_rdataset_t rdataset;
-+	int count;
-+	int pass;
-+	isc_mem_t *mymctx = NULL;
-+	isc_result_t result;
-+	unsigned char data[] = { 0x0a, 0x00, 0x00, 0x01 };
-+
-+	UNUSED(state);
-+
-+	result = isc_mem_create(0, 0, &mymctx);
-+	assert_int_equal(result, ISC_R_SUCCESS);
-+
-+	result = dns_db_create(mymctx, "rbt", dns_rootname, dns_dbtype_cache,
-+			       dns_rdataclass_in, 0, NULL, &db);
-+	assert_int_equal(result, ISC_R_SUCCESS);
-+
-+	example = dns_fixedname_initname(&example_fixed);
-+	found = dns_fixedname_initname(&found_fixed);
-+
-+	result = dns_name_fromstring(example, "example", 0, NULL);
-+	assert_int_equal(result, ISC_R_SUCCESS);
-+
-+	/*
-+	 * Pass 0: default; no stale processing permitted.
-+	 * Pass 1: stale processing for 1 second.
-+	 * Pass 2: stale turned off after being on.
-+	 */
-+	for (pass = 0; pass < 3; pass++) {
-+		dns_rdata_t rdata = DNS_RDATA_INIT;
-+
-+		/* 10.0.0.1 */
-+		rdata.data = data;
-+		rdata.length = 4;
-+		rdata.rdclass = dns_rdataclass_in;
-+		rdata.type = dns_rdatatype_a;
-+
-+		dns_rdatalist_init(&rdatalist);
-+		rdatalist.ttl = 2;
-+		rdatalist.type = dns_rdatatype_a;
-+		rdatalist.rdclass = dns_rdataclass_in;
-+		ISC_LIST_APPEND(rdatalist.rdata, &rdata, link);
-+
-+		switch (pass) {
-+		case 0:
-+			/* default: stale processing off */
-+			break;
-+		case 1:
-+			/* turn on stale processing */
-+			result = dns_db_setservestalettl(db, 1);
-+			assert_int_equal(result, ISC_R_SUCCESS);
-+			break;
-+		case 2:
-+			/* turn off stale processing */
-+			result = dns_db_setservestalettl(db, 0);
-+			assert_int_equal(result, ISC_R_SUCCESS);
-+			break;
-+		}
-+
-+		dns_rdataset_init(&rdataset);
-+		result = dns_rdatalist_tordataset(&rdatalist, &rdataset);
-+		assert_int_equal(result, ISC_R_SUCCESS);
-+
-+		result = dns_db_findnode(db, example, true, &node);
-+		assert_int_equal(result, ISC_R_SUCCESS);
-+
-+		result = dns_db_addrdataset(db, node, NULL, 0, &rdataset, 0,
-+					    NULL);
-+		assert_int_equal(result, ISC_R_SUCCESS);
-+
-+		dns_db_detachnode(db, &node);
-+		dns_rdataset_disassociate(&rdataset);
-+
-+		result = dns_db_find(db, example, NULL, dns_rdatatype_a,
-+				     0, 0, &node, found, &rdataset, NULL);
-+		assert_int_equal(result, ISC_R_SUCCESS);
-+
-+		/*
-+		 * May loop for up to 2 seconds performing non stale lookups.
-+		 */
-+		count = 0;
-+		do {
-+			count++;
-+			assert_in_range(count, 0, 20); /* loop sanity */
-+			assert_int_equal(rdataset.attributes &
-+				     DNS_RDATASETATTR_STALE, 0);
-+			assert_true(rdataset.ttl > 0);
-+			dns_db_detachnode(db, &node);
-+			dns_rdataset_disassociate(&rdataset);
-+
-+			usleep(100000);	/* 100 ms */
-+
-+			result = dns_db_find(db, example, NULL,
-+					     dns_rdatatype_a, 0, 0,
-+					     &node, found, &rdataset, NULL);
-+		} while (result == ISC_R_SUCCESS);
-+
-+		assert_int_equal(result, ISC_R_NOTFOUND);
-+
-+		/*
-+		 * Check whether we can get stale data.
-+		 */
-+		result = dns_db_find(db, example, NULL, dns_rdatatype_a,
-+				     DNS_DBFIND_STALEOK, 0,
-+				     &node, found, &rdataset, NULL);
-+		switch (pass) {
-+		case 0:
-+			assert_int_equal(result, ISC_R_NOTFOUND);
-+			break;
-+		case 1:
-+			/*
-+			 * Should loop for 1 second with stale lookups then
-+			 * stop.
-+			 */
-+			count = 0;
-+			do {
-+				count++;
-+				assert_in_range(count, 0, 49); /* loop sanity */
-+				assert_int_equal(result, ISC_R_SUCCESS);
-+				assert_int_equal(rdataset.ttl, 0);
-+				assert_int_equal(rdataset.attributes &
-+					     DNS_RDATASETATTR_STALE,
-+					     DNS_RDATASETATTR_STALE);
-+				dns_db_detachnode(db, &node);
-+				dns_rdataset_disassociate(&rdataset);
-+
-+				usleep(100000);	/* 100 ms */
-+
-+				result = dns_db_find(db, example, NULL,
-+						     dns_rdatatype_a,
-+						     DNS_DBFIND_STALEOK,
-+						     0, &node, found,
-+						     &rdataset, NULL);
-+			} while (result == ISC_R_SUCCESS);
-+			assert_in_range(count, 1, 10);
-+			assert_int_equal(result, ISC_R_NOTFOUND);
-+			break;
-+		case 2:
-+			assert_int_equal(result, ISC_R_NOTFOUND);
-+			break;
-+		}
-+	}
-+
-+	dns_db_detach(&db);
-+	isc_mem_detach(&mymctx);
-+}
-+
- /* database class */
- static void
- class_test(void **state) {
-@@ -213,6 +405,8 @@ int
- main(void) {
- 	const struct CMUnitTest tests[] = {
- 		cmocka_unit_test(getoriginnode_test),
-+		cmocka_unit_test(getsetservestalettl_test),
-+		cmocka_unit_test(dns_dbfind_staleok_test),
- 		cmocka_unit_test_setup_teardown(class_test,
- 						_setup, _teardown),
- 		cmocka_unit_test_setup_teardown(dbtype_test,
-diff --git a/lib/dns/view.c b/lib/dns/view.c
-index a1a4301..abf6a4c 100644
---- a/lib/dns/view.c
-+++ b/lib/dns/view.c
-@@ -229,6 +229,9 @@ dns_view_create(isc_mem_t *mctx, dns_rdataclass_t rdclass,
- 	view->flush = false;
- 	view->dlv = NULL;
- 	view->maxudp = 0;
-+	view->staleanswerttl = 1;
-+	view->staleanswersok = dns_stale_answer_conf;
-+	view->staleanswersenable = false;
- 	view->nocookieudp = 0;
- 	view->maxbits = 0;
- 	view->v4_aaaa = dns_aaaa_ok;
-diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
-index 7bad989..bbf4b45 100644
---- a/lib/isccfg/namedconf.c
-+++ b/lib/isccfg/namedconf.c
-@@ -1778,6 +1778,7 @@ view_clauses[] = {
- 	{ "max-ncache-ttl", &cfg_type_uint32, 0 },
- 	{ "max-recursion-depth", &cfg_type_uint32, 0 },
- 	{ "max-recursion-queries", &cfg_type_uint32, 0 },
-+	{ "max-stale-ttl", &cfg_type_ttlval, 0 },
- 	{ "max-udp-size", &cfg_type_uint32, 0 },
- 	{ "message-compression", &cfg_type_boolean, 0 },
- 	{ "min-roots", &cfg_type_uint32, CFG_CLAUSEFLAG_NOTIMP },
-@@ -1806,7 +1807,9 @@ view_clauses[] = {
- 	{ "request-nsid", &cfg_type_boolean, 0 },
- 	{ "request-sit", &cfg_type_boolean, CFG_CLAUSEFLAG_OBSOLETE },
- 	{ "require-server-cookie", &cfg_type_boolean, 0 },
-+	{ "resolver-nonbackoff-tries", &cfg_type_uint32, 0 },
- 	{ "resolver-query-timeout", &cfg_type_uint32, 0 },
-+	{ "resolver-retry-interval", &cfg_type_uint32, 0 },
- 	{ "response-policy", &cfg_type_rpz, 0 },
- 	{ "rfc2308-type1", &cfg_type_boolean, CFG_CLAUSEFLAG_NYI },
- 	{ "root-delegation-only",  &cfg_type_optional_exclude, 0 },
-@@ -1815,6 +1818,8 @@ view_clauses[] = {
- 	{ "send-cookie", &cfg_type_boolean, 0 },
- 	{ "servfail-ttl", &cfg_type_ttlval, 0 },
- 	{ "sortlist", &cfg_type_bracketed_aml, 0 },
-+	{ "stale-answer-enable", &cfg_type_boolean, 0 },
-+	{ "stale-answer-ttl", &cfg_type_ttlval, 0 },
- 	{ "suppress-initial-notify", &cfg_type_boolean, CFG_CLAUSEFLAG_NYI },
- 	{ "topology", &cfg_type_bracketed_aml, CFG_CLAUSEFLAG_NOTIMP },
- 	{ "transfer-format", &cfg_type_transferformat, 0 },
--- 
-2.21.0
-
diff --git a/bind.spec b/bind.spec
index 7668ede..a525f1c 100644
--- a/bind.spec
+++ b/bind.spec
@@ -156,19 +156,9 @@ Patch164:bind-9.11-rh1666814.patch
 Patch170:bind-9.11-feature-test-named.patch
 Patch171:bind-9.11-tests-variants.patch
 Patch172:bind-9.11-tests-pkcs11.patch
-Patch173:bind-9.11-rh1732883.patch
 # Make sure jsonccp-devel does not interfere
-Patch174:bind-9.11-json-c.patch
-Patch175:bind-9.11-fips-disable.patch
+#Patch175:bind-9.11-fips-disable.patch
 #Patch176: bind-9.11-unit-dnstap-pkcs11.patch
-Patch177: bind-9.11-serve-stale.patch
-Patch178: bind-9.11-serve-stale-dbfix.patch
-# https://bugzilla.redhat.com/show_bug.cgi?id=1736762
-Patch183: bind-9.11-rh1736762-5.patch
-Patch184: bind-9.11-rh1736762-6.patch
-Patch185: bind-9.11-rh1736762-7.patch
-Patch186: bind-9.11-rh1736762-8.patch
-Patch187: bind-9.11-oot-gen.patch
 
 # SDB patches
 Patch11: bind-9.3.2b2-sdbsrc.patch
@@ -567,18 +557,9 @@ are used for building ISC DHCP.
 %patch170 -p1 -b .featuretest-named
 %patch171 -p1 -b .test-variant
 %patch172 -p1 -b .test-pkcs11
-%patch173 -p1 -b .rh1732883
 #%patch174 -p1 -b .unit-timer
-%patch174 -p1 -b .json-c
-%patch175 -p1 -b .rh1709553
+#%patch175 -p1 -b .rh1709553
 #%patch176 -p1 -b .unit-dnstap
-%patch177 -p1 -b .serve-stale
-%patch178 -p1 -b .rh1770492
-%patch183 -p1 -b .rh1736762-5
-%patch184 -p1 -b .rh1736762-6
-%patch185 -p1 -b .rh1736762-7
-%patch186 -p1 -b .rh1736762-8
-%patch187 -p1 -b .oot-gen
 
 %if %{with PKCS11}
 %patch135 -p1 -b .config-pkcs11

From a6f9fe005ec983b4c5a886833fdd82255c2844c4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 27 Mar 2020 12:39:30 +0100
Subject: [PATCH 124/460] Remove unused 9.14 patches

---
 bind-9.11-fips-code.patch | 1459 -------------------------------------
 bind-9.11-rt31459.patch   |  375 ----------
 bind-9.11-rt46047.patch   |  799 --------------------
 bind.spec                 |   21 -
 4 files changed, 2654 deletions(-)
 delete mode 100644 bind-9.11-fips-code.patch
 delete mode 100644 bind-9.11-rt31459.patch
 delete mode 100644 bind-9.11-rt46047.patch

diff --git a/bind-9.11-fips-code.patch b/bind-9.11-fips-code.patch
deleted file mode 100644
index cf00104..0000000
--- a/bind-9.11-fips-code.patch
+++ /dev/null
@@ -1,1459 +0,0 @@
-From eff6dcb62f3cea6df0a848c2220a49bc02cb4a0e Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Thu, 2 Aug 2018 23:34:45 +0200
-Subject: [PATCH] FIPS code changes
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Squashed commit of the following:
-
-commit b49f70ce0575b6b52a71b90fe0376dbf16f92c6b
-Author: Petr Menšík <pemensik@redhat.com>
-Date:   Mon Jan 22 14:12:37 2018 +0100
-
-    Update system tests to detect MD5 disabled at runtime
-
-commit 80ceffee4860c24baf70bc9a8653d92731eda2e4
-Author: Petr Menšík <pemensik@redhat.com>
-Date:   Thu Aug 2 14:53:54 2018 +0200
-
-    Avoid warning about undefined parameters
-
-commit e4ad4363e3d1acaac58456117579f02761f38fdc
-Author: Petr Menšík <pemensik@redhat.com>
-Date:   Wed Jun 20 19:31:19 2018 +0200
-
-    Fix rndc-confgen default algorithm, report true algorithm in usage.
-
-commit 7e629a351010cb75e0589ec361f720085675998c
-Author: Petr Menšík <pemensik@redhat.com>
-Date:   Fri Feb 23 21:21:30 2018 +0100
-
-    Cleanup only if initialization was successful
-
-commit 2101b948c77cbcbe07eb4a1e60f3e693b2245ec6
-Author: Petr Menšík <pemensik@redhat.com>
-Date:   Mon Feb 5 12:19:28 2018 +0100
-
-    Ensure dst backend is initialized first even before hmac algorithms.
-
-commit 7567c7edde7519115a9ae7e20818c835d3eb1ffe
-Author: Petr Menšík <pemensik@redhat.com>
-Date:   Mon Feb 5 12:17:54 2018 +0100
-
-    Skip initialization of MD5 based algorithms if not available.
-
-commit 5782137df6b45a6d900d5a1c250c1257227e917a
-Author: Petr Menšík <pemensik@redhat.com>
-Date:   Mon Feb 5 10:21:27 2018 +0100
-
-    Change secalgs skipping to be more safe
-
-commit f2d78729898182d2d19d5064de1bec9b66817159
-Author: Petr Menšík <pemensik@redhat.com>
-Date:   Wed Jan 31 18:26:11 2018 +0100
-
-    Skip MD5 algorithm also in case of NULL name
-
-commit 32a2ad4abc7aaca1c257730319ad3c27405d3407
-Author: Petr Menšík <pemensik@redhat.com>
-Date:   Wed Jan 31 11:38:12 2018 +0100
-
-    Make MD5 behave like unknown algorithm in TSIG.
-
-commit 13cd3f704dce568fdf24a567be5802b58ac6007b
-Author: Petr Menšík <pemensik@redhat.com>
-Date:   Tue Nov 28 20:14:37 2017 +0100
-
-    Select token with most supported functions, instead of demanding it must support all functions
-
-    Initialize PKCS#11 always until successfully initialized
-
-commit a71df74abdca4fe63bcdf542b81a109cf1f495b4
-Author: Petr Menšík <pemensik@redhat.com>
-Date:   Mon Jan 22 16:17:44 2018 +0100
-
-    Handle MD5 unavailability from DST
-
-commit dd82cb263efa2753d3ee772972726ea08bcc639b
-Author: Petr Menšík <pemensik@redhat.com>
-Date:   Mon Jan 22 14:11:16 2018 +0100
-
-    Check runtime flag from library and applications, fail gracefully.
-
-commit c7b2f87f07ecae75b821a908e29f08a42371e32e
-Author: Petr Menšík <pemensik@redhat.com>
-Date:   Mon Jan 22 08:39:08 2018 +0100
-
-    Modify libraries to use isc_md5_available() if PK11_MD5_DISABLE is not
-    defined.
-    TODO: pk11.c should accept slot without MD5 support.
-
-commit 0b8e470ec636b9e350b5ec3203eb2b4091415fde
-Author: Petr Menšík <pemensik@redhat.com>
-Date:   Mon Jan 22 07:21:04 2018 +0100
-
-    Add runtime detection whether MD5 is useable.
----
- bin/confgen/keygen.c              | 10 +++-
- bin/confgen/rndc-confgen.c        | 32 ++++---------
- bin/dig/dig.c                     |  7 +--
- bin/dig/dighost.c                 | 14 ++++--
- bin/dnssec/dnssec-keygen.c        | 14 ++++++
- bin/named/config.c                | 25 +++++++++-
- bin/nsupdate/nsupdate.c           | 24 ++++++----
- bin/rndc/rndc.c                   |  3 +-
- bin/tests/optional/hash_test.c    | 78 ++++++++++++++++---------------
- bin/tests/system/tkey/keycreate.c |  3 ++
- bin/tests/system/tkey/keydelete.c | 17 ++++---
- lib/bind9/check.c                 | 10 ++++
- lib/dns/dst_api.c                 | 23 ++++++---
- lib/dns/dst_internal.h            |  3 +-
- lib/dns/dst_parse.c               | 18 +++++--
- lib/dns/hmac_link.c               | 18 ++-----
- lib/dns/opensslrsa_link.c         |  6 +++
- lib/dns/pkcs11rsa_link.c          | 33 +++++++++++--
- lib/dns/rcode.c                   | 21 ++++++++-
- lib/dns/tests/rsa_test.c          |  4 ++
- lib/dns/tests/tsig_test.c         |  1 +
- lib/dns/tkey.c                    |  9 ++++
- lib/dns/tsec.c                    |  8 +++-
- lib/dns/tsig.c                    | 17 ++++---
- lib/isc/include/isc/md5.h         |  3 ++
- lib/isc/md5.c                     | 59 +++++++++++++++++++++++
- lib/isc/pk11.c                    | 44 +++++++++++------
- lib/isc/tests/hash_test.c         |  9 ++++
- lib/isccc/cc.c                    | 42 +++++++++++------
- 29 files changed, 400 insertions(+), 155 deletions(-)
-
-diff --git a/bin/confgen/keygen.c b/bin/confgen/keygen.c
-index 8931ad5..5015abb 100644
---- a/bin/confgen/keygen.c
-+++ b/bin/confgen/keygen.c
-@@ -22,6 +22,7 @@
- #include <isc/entropy.h>
- #include <isc/file.h>
- #include <isc/keyboard.h>
-+#include <isc/md5.h>
- #include <isc/mem.h>
- #include <isc/print.h>
- #include <isc/result.h>
-@@ -73,7 +74,7 @@ alg_fromtext(const char *name) {
- 		p = &name[5];
- 
- #ifndef PK11_MD5_DISABLE
--	if (strcasecmp(p, "md5") == 0)
-+	if (strcasecmp(p, "md5") == 0 && isc_md5_available())
- 		return DST_ALG_HMACMD5;
- #endif
- 	if (strcasecmp(p, "sha1") == 0)
-@@ -132,6 +133,13 @@ generate_key(isc_mem_t *mctx, const char *randomfile, dns_secalg_t alg,
- 	switch (alg) {
- #ifndef PK11_MD5_DISABLE
- 	    case DST_ALG_HMACMD5:
-+		if (!isc_md5_available()) {
-+			fatal("unsupported algorithm %d\n", alg);
-+		} else if (keysize < 1 || keysize > 512) {
-+			fatal("keysize %d out of range (must be 1-512)\n",
-+			      keysize);
-+		}
-+		break;
- #endif
- 	    case DST_ALG_HMACSHA1:
- 	    case DST_ALG_HMACSHA224:
-diff --git a/bin/confgen/rndc-confgen.c b/bin/confgen/rndc-confgen.c
-index 5ca3d76..6b7790a 100644
---- a/bin/confgen/rndc-confgen.c
-+++ b/bin/confgen/rndc-confgen.c
-@@ -36,6 +36,7 @@
- #include <isc/file.h>
- #include <isc/keyboard.h>
- #include <isc/mem.h>
-+#include <isc/md5.h>
- #include <isc/net.h>
- #include <isc/print.h>
- #include <isc/result.h>
-@@ -63,7 +64,7 @@ const char *progname;
- 
- bool verbose = false;
- 
--const char *keyfile, *keydef;
-+const char *keyfile, *keydef, *algdef;
- 
- ISC_PLATFORM_NORETURN_PRE static void
- usage(int status) ISC_PLATFORM_NORETURN_POST;
-@@ -71,13 +72,12 @@ usage(int status) ISC_PLATFORM_NORETURN_POST;
- static void
- usage(int status) {
- 
--#ifndef PK11_MD5_DISABLE
- 	fprintf(stderr, "\
- Usage:\n\
-  %s [-a] [-b bits] [-c keyfile] [-k keyname] [-p port] [-r randomfile] \
- [-s addr] [-t chrootdir] [-u user]\n\
-   -a:		 generate just the key clause and write it to keyfile (%s)\n\
--  -A alg:	 algorithm (default hmac-md5)\n\
-+  -A alg:	 algorithm (default %s)\n\
-   -b bits:	 from 1 through 512, default 256; total length of the secret\n\
-   -c keyfile:	 specify an alternate key file (requires -a)\n\
-   -k keyname:	 the name as it will be used  in named.conf and rndc.conf\n\
-@@ -86,24 +86,7 @@ Usage:\n\
-   -s addr:	 the address to which rndc should connect\n\
-   -t chrootdir:	 write a keyfile in chrootdir as well (requires -a)\n\
-   -u user:	 set the keyfile owner to \"user\" (requires -a)\n",
--		 progname, keydef);
--#else
--	fprintf(stderr, "\
--Usage:\n\
-- %s [-a] [-b bits] [-c keyfile] [-k keyname] [-p port] [-r randomfile] \
--[-s addr] [-t chrootdir] [-u user]\n\
--  -a:		 generate just the key clause and write it to keyfile (%s)\n\
--  -A alg:	 algorithm (default hmac-sha256)\n\
--  -b bits:	 from 1 through 512, default 256; total length of the secret\n\
--  -c keyfile:	 specify an alternate key file (requires -a)\n\
--  -k keyname:	 the name as it will be used  in named.conf and rndc.conf\n\
--  -p port:	 the port named will listen on and rndc will connect to\n\
--  -r randomfile: source of random data (use \"keyboard\" for key timing)\n\
--  -s addr:	 the address to which rndc should connect\n\
--  -t chrootdir:	 write a keyfile in chrootdir as well (requires -a)\n\
--  -u user:	 set the keyfile owner to \"user\" (requires -a)\n",
--		 progname, keydef);
--#endif
-+		 progname, keydef, algdef);
- 
- 	exit (status);
- }
-@@ -139,11 +122,12 @@ main(int argc, char **argv) {
- 	progname = program;
- 
- 	keyname = DEFAULT_KEYNAME;
--#ifndef PK11_MD5_DISABLE
--	alg = DST_ALG_HMACMD5;
--#else
- 	alg = DST_ALG_HMACSHA256;
-+#ifndef PK11_MD5_DISABLE
-+	if (isc_md5_available())
-+		alg = DST_ALG_HMACMD5;
- #endif
-+	algdef = alg_totext(alg);
- 	serveraddr = DEFAULT_SERVER;
- 	port = DEFAULT_PORT;
- 
-diff --git a/bin/dig/dig.c b/bin/dig/dig.c
-index 706299e..aaf22e7 100644
---- a/bin/dig/dig.c
-+++ b/bin/dig/dig.c
-@@ -20,6 +20,7 @@
- #include <ctype.h>
- 
- #include <isc/app.h>
-+#include <isc/md5.h>
- #include <isc/netaddr.h>
- #include <isc/parseint.h>
- #include <isc/platform.h>
-@@ -1774,10 +1775,10 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
- 			ptr = ptr2;
- 			ptr2 = ptr3;
- 		} else  {
--#ifndef PK11_MD5_DISABLE
--			hmacname = DNS_TSIG_HMACMD5_NAME;
--#else
- 			hmacname = DNS_TSIG_HMACSHA256_NAME;
-+#ifndef PK11_MD5_DISABLE
-+			if (isc_md5_available())
-+				hmacname = DNS_TSIG_HMACMD5_NAME;
- #endif
- 			digestbits = 0;
- 		}
-diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
-index 93e5b40..afd2700 100644
---- a/bin/dig/dighost.c
-+++ b/bin/dig/dighost.c
-@@ -80,6 +80,7 @@
- #include <isc/hex.h>
- #include <isc/lang.h>
- #include <isc/log.h>
-+#include <isc/md5.h>
- #include <isc/netaddr.h>
- #include <isc/netdb.h>
- #include <isc/parseint.h>
-@@ -1246,9 +1247,10 @@ parse_hmac(const char *hmac) {
- 	digestbits = 0;
- 
- #ifndef PK11_MD5_DISABLE
--	if (strcasecmp(buf, "hmac-md5") == 0) {
-+	if (strcasecmp(buf, "hmac-md5") == 0 && isc_md5_available()) {
- 		hmacname = DNS_TSIG_HMACMD5_NAME;
--	} else if (strncasecmp(buf, "hmac-md5-", 9) == 0) {
-+	} else if (strncasecmp(buf, "hmac-md5-", 9) == 0 &&
-+		   isc_md5_available()) {
- 		hmacname = DNS_TSIG_HMACMD5_NAME;
- 		digestbits = parse_bits(&buf[9], "digest-bits [0..128]", 128);
- 	} else
-@@ -1368,7 +1370,13 @@ setup_file_key(void) {
- 	switch (dst_key_alg(dstkey)) {
- #ifndef PK11_MD5_DISABLE
- 	case DST_ALG_HMACMD5:
--		hmacname = DNS_TSIG_HMACMD5_NAME;
-+		if (isc_md5_available()) {
-+			hmacname = DNS_TSIG_HMACMD5_NAME;
-+		} else {
-+			printf(";; Couldn't create key %s: bad algorithm\n",
-+			       keynametext);
-+			goto failure;
-+		}
- 		break;
- #endif
- 	case DST_ALG_HMACSHA1:
-diff --git a/bin/dnssec/dnssec-keygen.c b/bin/dnssec/dnssec-keygen.c
-index 1476d0d..f5c9316 100644
---- a/bin/dnssec/dnssec-keygen.c
-+++ b/bin/dnssec/dnssec-keygen.c
-@@ -36,6 +36,7 @@
- #include <isc/buffer.h>
- #include <isc/commandline.h>
- #include <isc/entropy.h>
-+#include <isc/md5.h>
- #include <isc/mem.h>
- #include <isc/print.h>
- #include <isc/region.h>
-@@ -562,6 +563,19 @@ main(int argc, char **argv) {
- 					"\"-a RSAMD5\"\n");
- 			INSIST(freeit == NULL);
- 			return (1);
-+		} else if (strcasecmp(algname, "HMAC-MD5") == 0) {
-+			if (isc_md5_available()) {
-+				alg = DST_ALG_HMACMD5;
-+			} else {
-+				fprintf(stderr,
-+					"The use of HMAC-MD5 was disabled\n");
-+				return (1);
-+			}
-+		} else if (strcasecmp(algname, "RSAMD5") == 0 &&
-+			   !isc_md5_available()) {
-+			fprintf(stderr, "The use of RSAMD5 was disabled\n");
-+			INSIST(freeit == NULL);
-+			return (1);
- 		} else if (strcasecmp(algname, "HMAC-MD5") == 0) {
- 			alg = DST_ALG_HMACMD5;
- #else
-diff --git a/bin/named/config.c b/bin/named/config.c
-index 32c454a..dff826b 100644
---- a/bin/named/config.c
-+++ b/bin/named/config.c
-@@ -18,6 +18,7 @@
- 
- #include <isc/buffer.h>
- #include <isc/log.h>
-+#include <isc/md5.h>
- #include <isc/mem.h>
- #include <isc/parseint.h>
- #include <isc/region.h>
-@@ -974,6 +975,21 @@ ns_config_getkeyalgorithm(const char *str, dns_name_t **name,
- 	return (ns_config_getkeyalgorithm2(str, name, NULL, digestbits));
- }
- 
-+static inline int
-+algorithms_start() {
-+#ifndef PK11_MD5_DISABLE
-+	if (!isc_md5_available()) {
-+		int i = 0;
-+		while (algorithms[i].str != NULL &&
-+			algorithms[i].hmac == hmacmd5) {
-+			i++;
-+		}
-+		return i;
-+	}
-+#endif
-+	return 0;
-+}
-+
- isc_result_t
- ns_config_getkeyalgorithm2(const char *str, dns_name_t **name,
- 			   unsigned int *typep, uint16_t *digestbits)
-@@ -983,7 +999,7 @@ ns_config_getkeyalgorithm2(const char *str, dns_name_t **name,
- 	uint16_t bits;
- 	isc_result_t result;
- 
--	for (i = 0; algorithms[i].str != NULL; i++) {
-+	for (i = algorithms_start(); algorithms[i].str != NULL; i++) {
- 		len = strlen(algorithms[i].str);
- 		if (strncasecmp(algorithms[i].str, str, len) == 0 &&
- 		    (str[len] == '\0' ||
-@@ -1006,7 +1022,12 @@ ns_config_getkeyalgorithm2(const char *str, dns_name_t **name,
- 	if (name != NULL) {
- 		switch (algorithms[i].hmac) {
- #ifndef PK11_MD5_DISABLE
--		case hmacmd5: *name = dns_tsig_hmacmd5_name; break;
-+		case hmacmd5:
-+			if (isc_md5_available()) {
-+				*name = dns_tsig_hmacmd5_name; break;
-+			} else {
-+				return (ISC_R_NOTFOUND);
-+			}
- #endif
- 		case hmacsha1: *name = dns_tsig_hmacsha1_name; break;
- 		case hmacsha224: *name = dns_tsig_hmacsha224_name; break;
-diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
-index de60313..bbb3936 100644
---- a/bin/nsupdate/nsupdate.c
-+++ b/bin/nsupdate/nsupdate.c
-@@ -31,6 +31,7 @@
- #include <isc/hash.h>
- #include <isc/lex.h>
- #include <isc/log.h>
-+#include <isc/md5.h>
- #include <isc/mem.h>
- #include <isc/parseint.h>
- #include <isc/portset.h>
-@@ -477,9 +478,10 @@ parse_hmac(dns_name_t **hmac, const char *hmacstr, size_t len,
- 	strlcpy(buf, hmacstr, ISC_MIN(len + 1, sizeof(buf)));
- 
- #ifndef PK11_MD5_DISABLE
--	if (strcasecmp(buf, "hmac-md5") == 0) {
-+	if (strcasecmp(buf, "hmac-md5") == 0 && isc_md5_available()) {
- 		*hmac = DNS_TSIG_HMACMD5_NAME;
--	} else if (strncasecmp(buf, "hmac-md5-", 9) == 0) {
-+	} else if (strncasecmp(buf, "hmac-md5-", 9) == 0 &&
-+		   isc_md5_available()) {
- 		*hmac = DNS_TSIG_HMACMD5_NAME;
- 		result = isc_parse_uint16(&digestbits, &buf[9], 10);
- 		if (result != ISC_R_SUCCESS || digestbits > 128) {
-@@ -592,10 +594,10 @@ setup_keystr(void) {
- 			exit(1);
- 		}
- 	} else {
--#ifndef PK11_MD5_DISABLE
--		hmacname = DNS_TSIG_HMACMD5_NAME;
--#else
- 		hmacname = DNS_TSIG_HMACSHA256_NAME;
-+#ifndef PK11_MD5_DISABLE
-+		if (isc_md5_available())
-+			hmacname = DNS_TSIG_HMACMD5_NAME;
- #endif
- 		name = keystr;
- 		n = s;
-@@ -732,7 +734,8 @@ setup_keyfile(isc_mem_t *mctx, isc_log_t *lctx) {
- 	switch (dst_key_alg(dstkey)) {
- #ifndef PK11_MD5_DISABLE
- 	case DST_ALG_HMACMD5:
--		hmacname = DNS_TSIG_HMACMD5_NAME;
-+		if (isc_md5_available())
-+			hmacname = DNS_TSIG_HMACMD5_NAME;
- 		break;
- #endif
- 	case DST_ALG_HMACSHA1:
-@@ -1637,12 +1640,13 @@ evaluate_key(char *cmdline) {
- 			return (STATUS_SYNTAX);
- 		}
- 		namestr = n + 1;
--	} else
--#ifndef PK11_MD5_DISABLE
--		hmacname = DNS_TSIG_HMACMD5_NAME;
--#else
-+	} else {
- 		hmacname = DNS_TSIG_HMACSHA256_NAME;
-+#ifndef PK11_MD5_DISABLE
-+		if (isc_md5_available())
-+			hmacname = DNS_TSIG_HMACMD5_NAME;
- #endif
-+	}
- 
- 	isc_buffer_init(&b, namestr, strlen(namestr));
- 	isc_buffer_add(&b, strlen(namestr));
-diff --git a/bin/rndc/rndc.c b/bin/rndc/rndc.c
-index 9eb0ce0..8083654 100644
---- a/bin/rndc/rndc.c
-+++ b/bin/rndc/rndc.c
-@@ -23,6 +23,7 @@
- #include <isc/file.h>
- #include <isc/log.h>
- #include <isc/net.h>
-+#include <isc/md5.h>
- #include <isc/mem.h>
- #include <isc/print.h>
- #include <isc/random.h>
-@@ -636,7 +637,7 @@ parse_config(isc_mem_t *mctx, isc_log_t *log, const char *keyname,
- 	algorithmstr = cfg_obj_asstring(algorithmobj);
- 
- #ifndef PK11_MD5_DISABLE
--	if (strcasecmp(algorithmstr, "hmac-md5") == 0)
-+	if (strcasecmp(algorithmstr, "hmac-md5") == 0 && isc_md5_available())
- 		algorithm = ISCCC_ALG_HMACMD5;
- 	else
- #endif
-diff --git a/bin/tests/optional/hash_test.c b/bin/tests/optional/hash_test.c
-index bf2891a..b5f0a1c 100644
---- a/bin/tests/optional/hash_test.c
-+++ b/bin/tests/optional/hash_test.c
-@@ -90,43 +90,47 @@ main(int argc, char **argv) {
- 	print_digest(s, "sha224", digest, ISC_SHA224_DIGESTLENGTH/4);
- 
- #ifndef PK11_MD5_DISABLE
--	s = "abc";
--	isc_md5_init(&md5);
--	memmove(buffer, s, strlen(s));
--	isc_md5_update(&md5, buffer, strlen(s));
--	isc_md5_final(&md5, digest);
--	print_digest(s, "md5", digest, 4);
--
--	/*
--	 * The 3 HMAC-MD5 examples from RFC2104
--	 */
--	s = "Hi There";
--	memset(key, 0x0b, 16);
--	isc_hmacmd5_init(&hmacmd5, key, 16);
--	memmove(buffer, s, strlen(s));
--	isc_hmacmd5_update(&hmacmd5, buffer, strlen(s));
--	isc_hmacmd5_sign(&hmacmd5, digest);
--	print_digest(s, "hmacmd5", digest, 4);
--
--	s = "what do ya want for nothing?";
--	strlcpy((char *)key, "Jefe", sizeof(key));
--	isc_hmacmd5_init(&hmacmd5, key, 4);
--	memmove(buffer, s, strlen(s));
--	isc_hmacmd5_update(&hmacmd5, buffer, strlen(s));
--	isc_hmacmd5_sign(&hmacmd5, digest);
--	print_digest(s, "hmacmd5", digest, 4);
--
--	s = "\335\335\335\335\335\335\335\335\335\335"
--	    "\335\335\335\335\335\335\335\335\335\335"
--	    "\335\335\335\335\335\335\335\335\335\335"
--	    "\335\335\335\335\335\335\335\335\335\335"
--	    "\335\335\335\335\335\335\335\335\335\335";
--	memset(key, 0xaa, 16);
--	isc_hmacmd5_init(&hmacmd5, key, 16);
--	memmove(buffer, s, strlen(s));
--	isc_hmacmd5_update(&hmacmd5, buffer, strlen(s));
--	isc_hmacmd5_sign(&hmacmd5, digest);
--	print_digest(s, "hmacmd5", digest, 4);
-+	if (isc_md5_available()) {
-+		s = "abc";
-+		isc_md5_init(&md5);
-+		memmove(buffer, s, strlen(s));
-+		isc_md5_update(&md5, buffer, strlen(s));
-+		isc_md5_final(&md5, digest);
-+		print_digest(s, "md5", digest, 4);
-+
-+		/*
-+		 * The 3 HMAC-MD5 examples from RFC2104
-+		 */
-+		s = "Hi There";
-+		memset(key, 0x0b, 16);
-+		isc_hmacmd5_init(&hmacmd5, key, 16);
-+		memmove(buffer, s, strlen(s));
-+		isc_hmacmd5_update(&hmacmd5, buffer, strlen(s));
-+		isc_hmacmd5_sign(&hmacmd5, digest);
-+		print_digest(s, "hmacmd5", digest, 4);
-+
-+		s = "what do ya want for nothing?";
-+		strlcpy((char *)key, "Jefe", sizeof(key));
-+		isc_hmacmd5_init(&hmacmd5, key, 4);
-+		memmove(buffer, s, strlen(s));
-+		isc_hmacmd5_update(&hmacmd5, buffer, strlen(s));
-+		isc_hmacmd5_sign(&hmacmd5, digest);
-+		print_digest(s, "hmacmd5", digest, 4);
-+
-+		s = "\335\335\335\335\335\335\335\335\335\335"
-+		    "\335\335\335\335\335\335\335\335\335\335"
-+		    "\335\335\335\335\335\335\335\335\335\335"
-+		    "\335\335\335\335\335\335\335\335\335\335"
-+		    "\335\335\335\335\335\335\335\335\335\335";
-+		memset(key, 0xaa, 16);
-+		isc_hmacmd5_init(&hmacmd5, key, 16);
-+		memmove(buffer, s, strlen(s));
-+		isc_hmacmd5_update(&hmacmd5, buffer, strlen(s));
-+		isc_hmacmd5_sign(&hmacmd5, digest);
-+		print_digest(s, "hmacmd5", digest, 4);
-+	} else {
-+		fprintf(stderr, "Skipping disabled MD5 algorithm\n");
-+	}
- #endif
- 
- 	/*
-diff --git a/bin/tests/system/tkey/keycreate.c b/bin/tests/system/tkey/keycreate.c
-index 5a00f86..653c951 100644
---- a/bin/tests/system/tkey/keycreate.c
-+++ b/bin/tests/system/tkey/keycreate.c
-@@ -20,6 +20,7 @@
- #include <isc/entropy.h>
- #include <isc/hash.h>
- #include <isc/log.h>
-+#include <isc/md5.h>
- #include <isc/mem.h>
- #include <isc/print.h>
- #include <isc/sockaddr.h>
-@@ -142,6 +143,8 @@ sendquery(isc_task_t *task, isc_event_t *event) {
- 	static char keystr[] = "0123456789ab";
- 
- 	isc_event_free(&event);
-+	if (!isc_md5_available())
-+		CHECK("MD5 was disabled", ISC_R_NOTIMPLEMENTED);
- 
- 	result = ISC_R_FAILURE;
- 	if (inet_pton(AF_INET, "10.53.0.1", &inaddr) != 1)
-diff --git a/bin/tests/system/tkey/keydelete.c b/bin/tests/system/tkey/keydelete.c
-index bde66a4..70a40c3 100644
---- a/bin/tests/system/tkey/keydelete.c
-+++ b/bin/tests/system/tkey/keydelete.c
-@@ -225,12 +225,17 @@ main(int argc, char **argv) {
- 	result = dst_key_fromnamedfile(keyname, NULL, type, mctx, &dstkey);
- 	CHECK("dst_key_fromnamedfile", result);
- #ifndef PK11_MD5_DISABLE
--	result = dns_tsigkey_createfromkey(dst_key_name(dstkey),
--					   DNS_TSIG_HMACMD5_NAME,
--					   dstkey, true, NULL, 0, 0,
--					   mctx, ring, &tsigkey);
--	dst_key_free(&dstkey);
--	CHECK("dns_tsigkey_createfromkey", result);
-+	if (isc_md5_available()) {
-+		result = dns_tsigkey_createfromkey(dst_key_name(dstkey),
-+						   DNS_TSIG_HMACMD5_NAME,
-+						   dstkey, true, NULL, 0, 0,
-+						   mctx, ring, &tsigkey);
-+		dst_key_free(&dstkey);
-+		CHECK("dns_tsigkey_createfromkey", result);
-+	} else {
-+		dst_key_free(&dstkey);
-+		CHECK("MD5 was disabled", ISC_R_NOTIMPLEMENTED);
-+	}
- #else
- 	dst_key_free(&dstkey);
- 	CHECK("MD5 was disabled", ISC_R_NOTIMPLEMENTED);
-diff --git a/lib/bind9/check.c b/lib/bind9/check.c
-index ec0ab6d..e0803d4 100644
---- a/lib/bind9/check.c
-+++ b/lib/bind9/check.c
-@@ -23,6 +23,7 @@
- #include <isc/file.h>
- #include <isc/hex.h>
- #include <isc/log.h>
-+#include <isc/md5.h>
- #include <isc/mem.h>
- #include <isc/netaddr.h>
- #include <isc/parseint.h>
-@@ -2618,6 +2619,15 @@ bind9_check_key(const cfg_obj_t *key, isc_log_t *logctx) {
- 	}
- 
- 	algorithm = cfg_obj_asstring(algobj);
-+#ifndef PK11_MD5_DISABLE
-+	/* Skip hmac-md5* algorithms */
-+	if (!isc_md5_available() &&
-+	    strncasecmp(algorithm, "hmac-md5", 8) == 0) {
-+		cfg_obj_log(algobj, logctx, ISC_LOG_ERROR,
-+			    "disabled algorithm '%s'", algorithm);
-+		return (ISC_R_DISABLED);
-+	}
-+#endif
- 	for (i = 0; algorithms[i].name != NULL; i++) {
- 		len = strlen(algorithms[i].name);
- 		if (strncasecmp(algorithms[i].name, algorithm, len) == 0 &&
-diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c
-index e3c47a9..320c0f8 100644
---- a/lib/dns/dst_api.c
-+++ b/lib/dns/dst_api.c
-@@ -192,6 +192,12 @@ dst_lib_init2(isc_mem_t *mctx, isc_entropy_t *ectx,
- 	dst_result_register();
- 
- 	memset(dst_t_func, 0, sizeof(dst_t_func));
-+
-+#ifdef OPENSSL
-+	RETERR(dst__openssl_init(engine));
-+#elif PKCS11CRYPTO
-+	RETERR(dst__pkcs11_init(mctx, engine));
-+#endif
- #ifndef PK11_MD5_DISABLE
- 	RETERR(dst__hmacmd5_init(&dst_t_func[DST_ALG_HMACMD5]));
- #endif
-@@ -201,7 +207,6 @@ dst_lib_init2(isc_mem_t *mctx, isc_entropy_t *ectx,
- 	RETERR(dst__hmacsha384_init(&dst_t_func[DST_ALG_HMACSHA384]));
- 	RETERR(dst__hmacsha512_init(&dst_t_func[DST_ALG_HMACSHA512]));
- #ifdef OPENSSL
--	RETERR(dst__openssl_init(engine));
- #ifndef PK11_MD5_DISABLE
- 	RETERR(dst__opensslrsa_init(&dst_t_func[DST_ALG_RSAMD5],
- 				    DST_ALG_RSAMD5));
-@@ -235,14 +240,18 @@ dst_lib_init2(isc_mem_t *mctx, isc_entropy_t *ectx,
- 	RETERR(dst__openssleddsa_init(&dst_t_func[DST_ALG_ED448]));
- #endif
- #elif PKCS11CRYPTO
--	RETERR(dst__pkcs11_init(mctx, engine));
- #ifndef PK11_MD5_DISABLE
--	RETERR(dst__pkcs11rsa_init(&dst_t_func[DST_ALG_RSAMD5]));
-+	RETERR(dst__pkcs11rsa_init(&dst_t_func[DST_ALG_RSAMD5],
-+				   DST_ALG_RSAMD5));
- #endif
--	RETERR(dst__pkcs11rsa_init(&dst_t_func[DST_ALG_RSASHA1]));
--	RETERR(dst__pkcs11rsa_init(&dst_t_func[DST_ALG_NSEC3RSASHA1]));
--	RETERR(dst__pkcs11rsa_init(&dst_t_func[DST_ALG_RSASHA256]));
--	RETERR(dst__pkcs11rsa_init(&dst_t_func[DST_ALG_RSASHA512]));
-+	RETERR(dst__pkcs11rsa_init(&dst_t_func[DST_ALG_RSASHA1],
-+				   DST_ALG_RSASHA1));
-+	RETERR(dst__pkcs11rsa_init(&dst_t_func[DST_ALG_NSEC3RSASHA1],
-+				   DST_ALG_NSEC3RSASHA1));
-+	RETERR(dst__pkcs11rsa_init(&dst_t_func[DST_ALG_RSASHA256],
-+				   DST_ALG_RSASHA256));
-+	RETERR(dst__pkcs11rsa_init(&dst_t_func[DST_ALG_RSASHA512],
-+				   DST_ALG_RSASHA512));
- #ifndef PK11_DSA_DISABLE
- 	RETERR(dst__pkcs11dsa_init(&dst_t_func[DST_ALG_DSA]));
- 	RETERR(dst__pkcs11dsa_init(&dst_t_func[DST_ALG_NSEC3DSA]));
-diff --git a/lib/dns/dst_internal.h b/lib/dns/dst_internal.h
-index 6ee796c..3e55d44 100644
---- a/lib/dns/dst_internal.h
-+++ b/lib/dns/dst_internal.h
-@@ -250,7 +250,8 @@ isc_result_t dst__hmacsha384_init(struct dst_func **funcp);
- isc_result_t dst__hmacsha512_init(struct dst_func **funcp);
- isc_result_t dst__opensslrsa_init(struct dst_func **funcp,
- 				  unsigned char algorithm);
--isc_result_t dst__pkcs11rsa_init(struct dst_func **funcp);
-+isc_result_t dst__pkcs11rsa_init(struct dst_func **funcp,
-+				 unsigned char algorithm);
- #ifndef PK11_DSA_DISABLE
- isc_result_t dst__openssldsa_init(struct dst_func **funcp);
- isc_result_t dst__pkcs11dsa_init(struct dst_func **funcp);
-diff --git a/lib/dns/dst_parse.c b/lib/dns/dst_parse.c
-index f31c33d..87023a6 100644
---- a/lib/dns/dst_parse.c
-+++ b/lib/dns/dst_parse.c
-@@ -33,6 +33,7 @@
- #include <isc/file.h>
- #include <isc/fsaccess.h>
- #include <isc/lex.h>
-+#include <isc/md5.h>
- #include <isc/mem.h>
- #include <isc/print.h>
- #include <isc/stdtime.h>
-@@ -396,6 +397,10 @@ check_data(const dst_private_t *priv, const unsigned int alg,
- 	switch (alg) {
- #ifndef PK11_MD5_DISABLE
- 	case DST_ALG_RSAMD5:
-+		if (isc_md5_available())
-+			return (check_rsa(priv, external));
-+		else
-+			return (DST_R_UNSUPPORTEDALG);
- #endif
- 	case DST_ALG_RSASHA1:
- 	case DST_ALG_NSEC3RSASHA1:
-@@ -421,7 +426,10 @@ check_data(const dst_private_t *priv, const unsigned int alg,
- 		return (check_eddsa(priv, external));
- #ifndef PK11_MD5_DISABLE
- 	case DST_ALG_HMACMD5:
--		return (check_hmac_md5(priv, old));
-+		if (isc_md5_available())
-+			return (check_hmac_md5(priv, old));
-+		else
-+			return (DST_R_UNSUPPORTEDALG);
- #endif
- 	case DST_ALG_HMACSHA1:
- 		return (check_hmac_sha(priv, HMACSHA1_NTAGS, alg));
-@@ -640,11 +648,13 @@ dst__privstruct_parse(dst_key_t *key, unsigned int alg, isc_lex_t *lex,
- 	}
- 
- #ifdef PK11_MD5_DISABLE
--	check = check_data(priv, alg == DST_ALG_RSA ? DST_ALG_RSASHA1 : alg,
--			   true, external);
-+	if (alg == DST_ALG_RSA)
-+		alg = DST_ALG_RSASHA1;
- #else
--	check = check_data(priv, alg, true, external);
-+	if (!isc_md5_available() && alg == DST_ALG_RSA)
-+		alg = DST_ALG_RSASHA1;
- #endif
-+	check = check_data(priv, alg, true, external);
- 	if (check < 0) {
- 		ret = DST_R_INVALIDPRIVATEKEY;
- 		goto fail;
-diff --git a/lib/dns/hmac_link.c b/lib/dns/hmac_link.c
-index 3b6579b..4bdce2f 100644
---- a/lib/dns/hmac_link.c
-+++ b/lib/dns/hmac_link.c
-@@ -340,20 +340,10 @@ static dst_func_t hmacmd5_functions = {
- 
- isc_result_t
- dst__hmacmd5_init(dst_func_t **funcp) {
--#ifdef HAVE_FIPS_MODE
--	/*
--	 * Problems from OpenSSL are likely from FIPS mode
--	 */
--	int fips_mode = FIPS_mode();
--
--	if (fips_mode != 0) {
--		UNEXPECTED_ERROR(__FILE__, __LINE__,
--				 "FIPS mode is %d: MD5 is only supported "
--				 "if the value is 0.\n"
--				 "Please disable either FIPS mode or MD5.",
--				 fips_mode);
--	}
--#endif
-+
-+	/* Intentionally skip initialization */
-+	if (!isc_md5_available())
-+		return (ISC_R_SUCCESS);
- 
- #if PK11_FLAVOR != PK11_UTIMACO_FLAVOR
- 	/*
-diff --git a/lib/dns/opensslrsa_link.c b/lib/dns/opensslrsa_link.c
-index ec35f50..c80fabe 100644
---- a/lib/dns/opensslrsa_link.c
-+++ b/lib/dns/opensslrsa_link.c
-@@ -1812,6 +1812,12 @@ dst__opensslrsa_init(dst_func_t **funcp, unsigned char algorithm) {
- 
- 	if (*funcp == NULL) {
- 		switch (algorithm) {
-+#ifndef PK11_MD5_DISABLE
-+		case DST_ALG_RSAMD5:
-+			if (isc_md5_available())
-+				*funcp = &opensslrsa_functions;
-+			break;
-+#endif
- 		case DST_ALG_RSASHA256:
- #if defined(HAVE_EVP_SHA256) || !USE_EVP
- 			*funcp = &opensslrsa_functions;
-diff --git a/lib/dns/pkcs11rsa_link.c b/lib/dns/pkcs11rsa_link.c
-index 096c1a8..6c280bf 100644
---- a/lib/dns/pkcs11rsa_link.c
-+++ b/lib/dns/pkcs11rsa_link.c
-@@ -96,10 +96,15 @@ pkcs11rsa_createctx_sign(dst_key_t *key, dst_context_t *dctx) {
- #endif
- 
- 	/*
--	 * Reject incorrect RSA key lengths.
-+	 * Reject incorrect RSA key lengths or disabled algorithms.
- 	 */
- 	switch (dctx->key->key_alg) {
- 	case DST_ALG_RSAMD5:
-+#ifndef PK11_MD5_DISABLE
-+		if (!isc_md5_available())
-+			return (ISC_R_FAILURE);
-+#endif
-+		/* FALLTHROUGH */
- 	case DST_ALG_RSASHA1:
- 	case DST_ALG_NSEC3RSASHA1:
- 		/* From RFC 3110 */
-@@ -641,6 +646,9 @@ pkcs11rsa_createctx(dst_key_t *key, dst_context_t *dctx) {
- 	switch (key->key_alg) {
- #ifndef PK11_MD5_DISABLE
- 	case DST_ALG_RSAMD5:
-+		if (!isc_md5_available())
-+			return (ISC_R_FAILURE);
-+	
- 		mech.mechanism = CKM_MD5;
- 		break;
- #endif
-@@ -799,6 +807,9 @@ pkcs11rsa_sign(dst_context_t *dctx, isc_buffer_t *sig) {
- 	switch (key->key_alg) {
- #ifndef PK11_MD5_DISABLE
- 	case DST_ALG_RSAMD5:
-+		if (!isc_md5_available())
-+			return (ISC_R_FAILURE);
-+
- 		der = md5_der;
- 		derlen = sizeof(md5_der);
- 		hashlen = ISC_MD5_DIGESTLENGTH;
-@@ -1024,6 +1035,9 @@ pkcs11rsa_verify(dst_context_t *dctx, const isc_region_t *sig) {
- 	switch (key->key_alg) {
- #ifndef PK11_MD5_DISABLE
- 	case DST_ALG_RSAMD5:
-+		if (!isc_md5_available())
-+			return (ISC_R_FAILURE);
-+
- 		der = md5_der;
- 		derlen = sizeof(md5_der);
- 		hashlen = ISC_MD5_DIGESTLENGTH;
-@@ -2231,11 +2245,22 @@ static dst_func_t pkcs11rsa_functions = {
- };
- 
- isc_result_t
--dst__pkcs11rsa_init(dst_func_t **funcp) {
-+dst__pkcs11rsa_init(dst_func_t **funcp, unsigned char algorithm) {
- 	REQUIRE(funcp != NULL);
- 
--	if (*funcp == NULL)
--		*funcp = &pkcs11rsa_functions;
-+	if (*funcp == NULL) {
-+		switch (algorithm) {
-+#ifndef PK11_MD5_DISABLE
-+			case DST_ALG_RSAMD5:
-+				if (isc_md5_available())
-+					*funcp = &pkcs11rsa_functions;
-+				break;
-+#endif
-+			default:
-+				*funcp = &pkcs11rsa_functions;
-+				break;
-+		}
-+	}
- 	return (ISC_R_SUCCESS);
- }
- 
-diff --git a/lib/dns/rcode.c b/lib/dns/rcode.c
-index 9c42c50..f51d548 100644
---- a/lib/dns/rcode.c
-+++ b/lib/dns/rcode.c
-@@ -16,6 +16,7 @@
- #include <stdbool.h>
- 
- #include <isc/buffer.h>
-+#include <isc/md5.h>
- #include <isc/parseint.h>
- #include <isc/print.h>
- #include <isc/region.h>
-@@ -357,17 +358,33 @@ dns_cert_totext(dns_cert_t cert, isc_buffer_t *target) {
- 	return (dns_mnemonic_totext(cert, target, certs));
- }
- 
-+static inline struct tbl *
-+secalgs_tbl_start() {
-+	struct tbl *algs = secalgs;
-+
-+#ifndef PK11_MD5_DISABLE
-+	if (!isc_md5_available()) {
-+		while (algs->name != NULL &&
-+		       algs->value == DNS_KEYALG_RSAMD5)
-+			++algs;
-+	}
-+#endif
-+	return algs;
-+}
-+
- isc_result_t
- dns_secalg_fromtext(dns_secalg_t *secalgp, isc_textregion_t *source) {
- 	unsigned int value;
--	RETERR(dns_mnemonic_fromtext(&value, source, secalgs, 0xff));
-+
-+	RETERR(dns_mnemonic_fromtext(&value, source,
-+	                             secalgs_tbl_start(), 0xff));
- 	*secalgp = value;
- 	return (ISC_R_SUCCESS);
- }
- 
- isc_result_t
- dns_secalg_totext(dns_secalg_t secalg, isc_buffer_t *target) {
--	return (dns_mnemonic_totext(secalg, target, secalgs));
-+	return (dns_mnemonic_totext(secalg, target, secalgs_tbl_start()));
- }
- 
- void
-diff --git a/lib/dns/tests/rsa_test.c b/lib/dns/tests/rsa_test.c
-index f9ac6d0..241e17e 100644
---- a/lib/dns/tests/rsa_test.c
-+++ b/lib/dns/tests/rsa_test.c
-@@ -27,6 +27,7 @@
- #define UNIT_TESTING
- #include <cmocka.h>
- 
-+#include <isc/md5.h>
- #include <isc/util.h>
- #include <isc/print.h>
- 
-@@ -248,6 +249,8 @@ isc_rsa_verify_test(void **state) {
- 	/* RSAMD5 */
- 
- #ifndef PK11_MD5_DISABLE
-+	if (isc_md5_available()) {
-+		/* wrong indentation is kept for diff minimization */
- 	key->key_alg = DST_ALG_RSAMD5;
- 
- 	ret = dst_context_create3(key, mctx, DNS_LOGCATEGORY_DNSSEC,
-@@ -265,6 +268,7 @@ isc_rsa_verify_test(void **state) {
- 	assert_int_equal(ret, ISC_R_SUCCESS);
- 
- 	dst_context_destroy(&ctx);
-+	}
- #endif
- 
- 	/* RSASHA256 */
-diff --git a/lib/dns/tests/tsig_test.c b/lib/dns/tests/tsig_test.c
-index 11d011a..feb2068 100644
---- a/lib/dns/tests/tsig_test.c
-+++ b/lib/dns/tests/tsig_test.c
-@@ -25,6 +25,7 @@
- #define UNIT_TESTING
- #include <cmocka.h>
- 
-+#include <isc/md5.h>
- #include <isc/mem.h>
- #include <isc/print.h>
- #include <isc/util.h>
-diff --git a/lib/dns/tkey.c b/lib/dns/tkey.c
-index 89cfc79..d07364a 100644
---- a/lib/dns/tkey.c
-+++ b/lib/dns/tkey.c
-@@ -245,6 +245,9 @@ compute_secret(isc_buffer_t *shared, isc_region_t *queryrandomness,
- 	unsigned char digests[32];
- 	unsigned int i;
- 
-+	if (!isc_md5_available())
-+		return (ISC_R_NOTIMPLEMENTED);
-+
- 	isc_buffer_usedregion(shared, &r);
- 
- 	/*
-@@ -321,6 +324,12 @@ process_dhtkey(dns_message_t *msg, dns_name_t *signer, dns_name_t *name,
- 	}
- 
- #ifndef PK11_MD5_DISABLE
-+	if (!isc_md5_available()) {
-+		tkey_log("process_dhtkey: MD5 was disabled");
-+		tkeyout->error = dns_tsigerror_badalg;
-+		return (ISC_R_SUCCESS);
-+	}
-+
- 	if (!dns_name_equal(&tkeyin->algorithm, DNS_TSIG_HMACMD5_NAME)) {
- 		tkey_log("process_dhtkey: algorithms other than "
- 			 "hmac-md5 are not supported");
-diff --git a/lib/dns/tsec.c b/lib/dns/tsec.c
-index 9d8ead4..0c82f65 100644
---- a/lib/dns/tsec.c
-+++ b/lib/dns/tsec.c
-@@ -11,6 +11,7 @@
- 
- #include <config.h>
- 
-+#include <isc/md5.h>
- #include <isc/mem.h>
- #include <isc/util.h>
- 
-@@ -63,7 +64,12 @@ dns_tsec_create(isc_mem_t *mctx, dns_tsectype_t type, dst_key_t *key,
- 		switch (dst_key_alg(key)) {
- #ifndef PK11_MD5_DISABLE
- 		case DST_ALG_HMACMD5:
--			algname = dns_tsig_hmacmd5_name;
-+			if (isc_md5_available()) {
-+				algname = dns_tsig_hmacmd5_name;
-+			} else {
-+				isc_mem_put(mctx, tsec, sizeof(*tsec));
-+				return (DNS_R_BADALG);
-+			}
- 			break;
- #endif
- 		case DST_ALG_HMACSHA1:
-diff --git a/lib/dns/tsig.c b/lib/dns/tsig.c
-index 58c1104..00ee1e1 100644
---- a/lib/dns/tsig.c
-+++ b/lib/dns/tsig.c
-@@ -273,7 +273,8 @@ dns_tsigkey_createfromkey(dns_name_t *name, dns_name_t *algorithm,
- 	(void)dns_name_downcase(&tkey->name, &tkey->name, NULL);
- 
- #ifndef PK11_MD5_DISABLE
--	if (dns_name_equal(algorithm, DNS_TSIG_HMACMD5_NAME)) {
-+	if (dns_name_equal(algorithm, DNS_TSIG_HMACMD5_NAME) &&
-+	    isc_md5_available()) {
- 		tkey->algorithm = DNS_TSIG_HMACMD5_NAME;
- 		if (dstkey != NULL && dst_key_alg(dstkey) != DST_ALG_HMACMD5) {
- 			ret = DNS_R_BADALG;
-@@ -499,7 +500,8 @@ destroyring(dns_tsig_keyring_t *ring) {
- static unsigned int
- dst_alg_fromname(dns_name_t *algorithm) {
- #ifndef PK11_MD5_DISABLE
--	if (dns_name_equal(algorithm, DNS_TSIG_HMACMD5_NAME)) {
-+	if (dns_name_equal(algorithm, DNS_TSIG_HMACMD5_NAME) &&
-+	    isc_md5_available()) {
- 		return (DST_ALG_HMACMD5);
- 	} else
- #endif
-@@ -683,7 +685,8 @@ dns_tsigkey_create(dns_name_t *name, dns_name_t *algorithm,
- 		REQUIRE(secret != NULL);
- 
- #ifndef PK11_MD5_DISABLE
--	if (dns_name_equal(algorithm, DNS_TSIG_HMACMD5_NAME)) {
-+	if (dns_name_equal(algorithm, DNS_TSIG_HMACMD5_NAME) &&
-+	    isc_md5_available()) {
- 		if (secret != NULL) {
- 			isc_buffer_t b;
- 
-@@ -1291,7 +1294,7 @@ dns_tsig_verify(isc_buffer_t *source, dns_message_t *msg,
- 		return (ret);
- 	if (
- #ifndef PK11_MD5_DISABLE
--	    alg == DST_ALG_HMACMD5 ||
-+	    (alg == DST_ALG_HMACMD5 && isc_md5_available()) ||
- #endif
- 	    alg == DST_ALG_HMACSHA1 ||
- 	    alg == DST_ALG_HMACSHA224 || alg == DST_ALG_HMACSHA256 ||
-@@ -1460,7 +1463,7 @@ dns_tsig_verify(isc_buffer_t *source, dns_message_t *msg,
- 
- 	if (
- #ifndef PK11_MD5_DISABLE
--	    alg == DST_ALG_HMACMD5 ||
-+	    (alg == DST_ALG_HMACMD5 && isc_md5_available()) ||
- #endif
- 	    alg == DST_ALG_HMACSHA1 ||
- 	    alg == DST_ALG_HMACSHA224 || alg == DST_ALG_HMACSHA256 ||
-@@ -1601,7 +1604,7 @@ tsig_verify_tcp(isc_buffer_t *source, dns_message_t *msg) {
- 			goto cleanup_querystruct;
- 		if (
- #ifndef PK11_MD5_DISABLE
--			alg == DST_ALG_HMACMD5 ||
-+			(alg == DST_ALG_HMACMD5 && isc_md5_available()) ||
- #endif
- 			alg == DST_ALG_HMACSHA1 ||
- 			alg == DST_ALG_HMACSHA224 ||
-@@ -1780,7 +1783,7 @@ tsig_verify_tcp(isc_buffer_t *source, dns_message_t *msg) {
- 			goto cleanup_context;
- 		if (
- #ifndef PK11_MD5_DISABLE
--			alg == DST_ALG_HMACMD5 ||
-+			(alg == DST_ALG_HMACMD5 && isc_md5_available()) ||
- #endif
- 			alg == DST_ALG_HMACSHA1 ||
- 			alg == DST_ALG_HMACSHA224 ||
-diff --git a/lib/isc/include/isc/md5.h b/lib/isc/include/isc/md5.h
-index 4d29398..e3f5cec 100644
---- a/lib/isc/include/isc/md5.h
-+++ b/lib/isc/include/isc/md5.h
-@@ -91,6 +91,9 @@ isc_md5_final(isc_md5_t *ctx, unsigned char *digest);
- bool
- isc_md5_check(bool testing);
- 
-+bool
-+isc_md5_available(void);
-+
- ISC_LANG_ENDDECLS
- 
- #endif /* !PK11_MD5_DISABLE */
-diff --git a/lib/isc/md5.c b/lib/isc/md5.c
-index 249f3da..628a414 100644
---- a/lib/isc/md5.c
-+++ b/lib/isc/md5.c
-@@ -37,6 +37,7 @@
- 
- #include <isc/assertions.h>
- #include <isc/md5.h>
-+#include <isc/once.h>
- #include <isc/platform.h>
- #include <isc/safe.h>
- #include <isc/string.h>
-@@ -54,6 +55,9 @@
- #define EVP_MD_CTX_free(ptr) EVP_MD_CTX_cleanup(ptr)
- #endif
- 
-+static isc_once_t available_once = ISC_ONCE_INIT;
-+static bool available = false;
-+
- void
- isc_md5_init(isc_md5_t *ctx) {
- 	ctx->ctx = EVP_MD_CTX_new();
-@@ -85,8 +89,33 @@ isc_md5_final(isc_md5_t *ctx, unsigned char *digest) {
- 	ctx->ctx = NULL;
- }
- 
-+static void
-+do_detect_available() {
-+	isc_md5_t local;
-+	isc_md5_t *ctx = &local;
-+	unsigned char digest[ISC_MD5_DIGESTLENGTH];
-+
-+	ctx->ctx = EVP_MD_CTX_new();
-+	RUNTIME_CHECK(ctx->ctx != NULL);
-+	available = (EVP_DigestInit(ctx->ctx, EVP_md5()) == 1);
-+	if (available)
-+		(void)EVP_DigestFinal(ctx->ctx, digest, NULL);
-+	EVP_MD_CTX_free(ctx->ctx);
-+	ctx->ctx = NULL;
-+}
-+
-+bool
-+isc_md5_available() {
-+	RUNTIME_CHECK(isc_once_do(&available_once, do_detect_available)
-+		      == ISC_R_SUCCESS);
-+	return available;
-+}
-+
- #elif PKCS11CRYPTO
- 
-+static isc_once_t available_once = ISC_ONCE_INIT;
-+static bool available = false;
-+
- void
- isc_md5_init(isc_md5_t *ctx) {
- 	CK_RV rv;
-@@ -129,6 +158,31 @@ isc_md5_final(isc_md5_t *ctx, unsigned char *digest) {
- 	pk11_return_session(ctx);
- }
- 
-+static void
-+do_detect_available() {
-+	isc_md5_t local;
-+	isc_md5_t *ctx = &local;
-+	CK_RV rv;
-+	CK_MECHANISM mech = { CKM_MD5, NULL, 0 };
-+
-+	if (pk11_get_session(ctx, OP_DIGEST, true, false,
-+				       false, NULL, 0) == ISC_R_SUCCESS)
-+	{
-+		rv = pkcs_C_DigestInit(ctx->session, &mech);
-+		isc_md5_invalidate(ctx);
-+		available = (rv == CKR_OK);
-+	} else {
-+		available = false;
-+	}
-+}
-+
-+bool
-+isc_md5_available() {
-+	RUNTIME_CHECK(isc_once_do(&available_once, do_detect_available)
-+		      == ISC_R_SUCCESS);
-+	return available;
-+}
-+
- #else
- 
- static void
-@@ -338,6 +392,11 @@ isc_md5_final(isc_md5_t *ctx, unsigned char *digest) {
- 	memmove(digest, ctx->buf, 16);
- 	isc_safe_memwipe(ctx, sizeof(*ctx));	/* In case it's sensitive */
- }
-+
-+bool
-+isc_md5_available() {
-+	return true;
-+}
- #endif
- 
- /*
-diff --git a/lib/isc/pk11.c b/lib/isc/pk11.c
-index 0d5b009..7809e7b 100644
---- a/lib/isc/pk11.c
-+++ b/lib/isc/pk11.c
-@@ -197,8 +197,6 @@ pk11_initialize(isc_mem_t *mctx, const char *engine) {
- 	UNLOCK(&alloclock);
- 	if (initialized) {
- 		goto unlock;
--	} else {
--		initialized = true;
- 	}
- 
- 	ISC_LIST_INIT(tokens);
-@@ -238,6 +236,7 @@ pk11_initialize(isc_mem_t *mctx, const char *engine) {
- 	}
- #endif
- #endif /* PKCS11CRYPTO */
-+	initialized = true;
-  unlock:
- 	UNLOCK(&sessionlock);
- 	return (result);
-@@ -589,6 +588,8 @@ scan_slots(void) {
- 	pk11_token_t *token;
- 	unsigned int i;
- 	bool bad;
-+	unsigned int best_rsa_algorithms = 0;
-+	unsigned int best_digest_algorithms = 0;
- 
- 	slotCount = 0;
- 	PK11_FATALCHECK(pkcs_C_GetSlotList, (CK_FALSE, NULL_PTR, &slotCount));
-@@ -601,6 +602,8 @@ scan_slots(void) {
- 	PK11_FATALCHECK(pkcs_C_GetSlotList, (CK_FALSE, slotList, &slotCount));
- 
- 	for (i = 0; i < slotCount; i++) {
-+		unsigned int rsa_algorithms = 0;
-+		unsigned int digest_algorithms = 0;
- 		slot = slotList[i];
- 		PK11_TRACE2("slot#%u=0x%lx\n", i, slot);
- 
-@@ -640,11 +643,12 @@ scan_slots(void) {
- 		if ((rv != CKR_OK) ||
- 		    ((mechInfo.flags & CKF_SIGN) == 0) ||
- 		    ((mechInfo.flags & CKF_VERIFY) == 0)) {
--#if !defined(PK11_MD5_DISABLE) && !defined(PK11_RSA_PKCS_REPLACE)
--			bad = true;
--#endif
- 			PK11_TRACEM(CKM_MD5_RSA_PKCS);
- 		}
-+#if !defined(PK11_MD5_DISABLE) && !defined(PK11_RSA_PKCS_REPLACE)
-+		else
-+			++rsa_algorithms;
-+#endif
- 		rv = pkcs_C_GetMechanismInfo(slot, CKM_SHA1_RSA_PKCS,
- 					     &mechInfo);
- 		if ((rv != CKR_OK) ||
-@@ -687,8 +691,14 @@ scan_slots(void) {
- 		if (bad)
- 			goto try_dsa;
- 		token->operations |= 1 << OP_RSA;
--		if (best_rsa_token == NULL)
-+		if (best_rsa_token == NULL) {
- 			best_rsa_token = token;
-+			best_rsa_algorithms = rsa_algorithms;
-+		} else if (rsa_algorithms > best_rsa_algorithms) {
-+			pk11_mem_put(best_rsa_token, sizeof(*best_rsa_token));
-+			best_rsa_token = token;
-+			best_rsa_algorithms = rsa_algorithms;
-+		}
- 
- 	try_dsa:
- 		bad = false;
-@@ -756,11 +766,12 @@ scan_slots(void) {
- 		bad = false;
- 		rv = pkcs_C_GetMechanismInfo(slot, CKM_MD5, &mechInfo);
- 		if ((rv != CKR_OK) || ((mechInfo.flags & CKF_DIGEST) == 0)) {
--#ifndef PK11_MD5_DISABLE
--			bad = true;
--#endif
- 			PK11_TRACEM(CKM_MD5);
- 		}
-+#ifndef PK11_MD5_DISABLE
-+		else
-+			++digest_algorithms;
-+#endif
- 		rv = pkcs_C_GetMechanismInfo(slot, CKM_SHA_1, &mechInfo);
- 		if ((rv != CKR_OK) || ((mechInfo.flags & CKF_DIGEST) == 0)) {
- 			bad = true;
-@@ -788,11 +799,12 @@ scan_slots(void) {
- 		}
- 		rv = pkcs_C_GetMechanismInfo(slot, CKM_MD5_HMAC, &mechInfo);
- 		if ((rv != CKR_OK) || ((mechInfo.flags & CKF_SIGN) == 0)) {
--#if !defined(PK11_MD5_DISABLE) && !defined(PK11_MD5_HMAC_REPLACE)
--			bad = true;
--#endif
- 			PK11_TRACEM(CKM_MD5_HMAC);
- 		}
-+#if !defined(PK11_MD5_DISABLE) && !defined(PK11_MD5_HMAC_REPLACE)
-+		else
-+			++digest_algorithms;
-+#endif
- 		rv = pkcs_C_GetMechanismInfo(slot, CKM_SHA_1_HMAC, &mechInfo);
- 		if ((rv != CKR_OK) || ((mechInfo.flags & CKF_SIGN) == 0)) {
- #ifndef PK11_SHA_1_HMAC_REPLACE
-@@ -830,8 +842,14 @@ scan_slots(void) {
- 		}
- 		if (!bad) {
- 			token->operations |= 1 << OP_DIGEST;
--			if (digest_token == NULL)
-+			if (digest_token == NULL) {
- 				digest_token = token;
-+				best_digest_algorithms = digest_algorithms;
-+			} else if (digest_algorithms > best_digest_algorithms) {
-+				pk11_mem_put(digest_token, sizeof(*digest_token));
-+				digest_token = token;
-+				best_digest_algorithms = digest_algorithms;
-+			}
- 		}
- 
- 		/* ECDSA requires digest */
-diff --git a/lib/isc/tests/hash_test.c b/lib/isc/tests/hash_test.c
-index 31ced94..421131e 100644
---- a/lib/isc/tests/hash_test.c
-+++ b/lib/isc/tests/hash_test.c
-@@ -775,6 +775,9 @@ isc_md5_test(void **state) {
- 
- 	UNUSED(state);
- 
-+	if (!isc_md5_available())
-+		return;
-+
- 	/*
- 	 * These are the various test vectors.  All of these are passed
- 	 * through the hash function and the results are compared to the
-@@ -1630,6 +1633,9 @@ isc_hmacmd5_test(void **state) {
- 
- 	UNUSED(state);
- 
-+	if (!isc_md5_available())
-+		return;
-+
- 	/*
- 	 * These are the various test vectors.  All of these are passed
- 	 * through the hash function and the results are compared to the
-@@ -1940,6 +1946,9 @@ static void
- md5_check_test(void **state) {
- 	UNUSED(state);
- 
-+	if (!isc_md5_available())
-+		return;
-+
- 	assert_true(isc_md5_check(false));
- 	assert_false(isc_md5_check(true));
- 
-diff --git a/lib/isccc/cc.c b/lib/isccc/cc.c
-index c2740cb..c314d76 100644
---- a/lib/isccc/cc.c
-+++ b/lib/isccc/cc.c
-@@ -272,11 +272,15 @@ sign(unsigned char *data, unsigned int length, unsigned char *hmac,
- 	switch (algorithm) {
- #ifndef PK11_MD5_DISABLE
- 	case ISCCC_ALG_HMACMD5:
--		isc_hmacmd5_init(&ctx.hmd5, secret->rstart,
--				 REGION_SIZE(*secret));
--		isc_hmacmd5_update(&ctx.hmd5, data, length);
--		isc_hmacmd5_sign(&ctx.hmd5, digest);
--		source.rend = digest + ISC_MD5_DIGESTLENGTH;
-+		if (isc_md5_available()) {
-+			isc_hmacmd5_init(&ctx.hmd5, secret->rstart,
-+					 REGION_SIZE(*secret));
-+			isc_hmacmd5_update(&ctx.hmd5, data, length);
-+			isc_hmacmd5_sign(&ctx.hmd5, digest);
-+			source.rend = digest + ISC_MD5_DIGESTLENGTH;
-+		} else {
-+			return (ISC_R_FAILURE);
-+		}
- 		break;
- #endif
- 
-@@ -350,14 +354,18 @@ isccc_cc_towire(isccc_sexpr_t *alist, isc_buffer_t **buffer,
- {
- 	unsigned int hmac_base, signed_base;
- 	isc_result_t result;
-+	const bool md5 = (algorithm == ISCCC_ALG_HMACMD5);
- 
- #ifndef PK11_MD5_DISABLE
-+	if (md5 && !isc_md5_available())
-+		return (ISC_R_NOTIMPLEMENTED);
-+
- 	result = isc_buffer_reserve(buffer,
--				    4 + ((algorithm == ISCCC_ALG_HMACMD5) ?
-+				    4 + ((md5) ?
- 					 sizeof(auth_hmd5) :
- 					 sizeof(auth_hsha)));
- #else
--	if (algorithm == ISCCC_ALG_HMACMD5)
-+	if (md5)
- 		return (ISC_R_NOTIMPLEMENTED);
- 	result = isc_buffer_reserve(buffer, 4 + sizeof(auth_hsha));
- #endif
-@@ -376,7 +384,7 @@ isccc_cc_towire(isccc_sexpr_t *alist, isc_buffer_t **buffer,
- 		 * we know what it is.
- 		 */
- #ifndef PK11_MD5_DISABLE
--		if (algorithm == ISCCC_ALG_HMACMD5) {
-+		if (md5) {
- 			hmac_base = (*buffer)->used + HMD5_OFFSET;
- 			isc_buffer_putmem(*buffer,
- 					  auth_hmd5, sizeof(auth_hmd5));
-@@ -442,7 +450,7 @@ verify(isccc_sexpr_t *alist, unsigned char *data, unsigned int length,
- 	if (!isccc_alist_alistp(_auth))
- 		return (ISC_R_FAILURE);
- #ifndef PK11_MD5_DISABLE
--	if (algorithm == ISCCC_ALG_HMACMD5)
-+	if (algorithm == ISCCC_ALG_HMACMD5 && isc_md5_available())
- 		hmac = isccc_alist_lookup(_auth, "hmd5");
- 	else
- #endif
-@@ -457,12 +465,16 @@ verify(isccc_sexpr_t *alist, unsigned char *data, unsigned int length,
- 	switch (algorithm) {
- #ifndef PK11_MD5_DISABLE
- 	case ISCCC_ALG_HMACMD5:
--		isc_hmacmd5_init(&ctx.hmd5, secret->rstart,
--				 REGION_SIZE(*secret));
--		isc_hmacmd5_update(&ctx.hmd5, data, length);
--		isc_hmacmd5_sign(&ctx.hmd5, digest);
--		source.rend = digest + ISC_MD5_DIGESTLENGTH;
--		break;
-+		if (isc_md5_available()) {
-+			isc_hmacmd5_init(&ctx.hmd5, secret->rstart,
-+					 REGION_SIZE(*secret));
-+			isc_hmacmd5_update(&ctx.hmd5, data, length);
-+			isc_hmacmd5_sign(&ctx.hmd5, digest);
-+			source.rend = digest + ISC_MD5_DIGESTLENGTH;
-+			break;
-+		} else {
-+			return (ISC_R_FAILURE);
-+		}
- #endif
- 
- 	case ISCCC_ALG_HMACSHA1:
--- 
-2.20.1
-
diff --git a/bind-9.11-rt31459.patch b/bind-9.11-rt31459.patch
deleted file mode 100644
index 587fc28..0000000
--- a/bind-9.11-rt31459.patch
+++ /dev/null
@@ -1,375 +0,0 @@
-From 31612e4f76eeb07d0fffa33814ce5edef04b286a Mon Sep 17 00:00:00 2001
-From: Evan Hunt <each@isc.org>
-Date: Tue, 12 Sep 2017 19:05:46 -0700
-Subject: [PATCH] rebased rt31459c
-
-[rt31459d] update the newer tools
-
-[rt31459d] setup entropy in dns_lib_init()
-
-[rt31459d] silence compiler warning
-
-DNS_OPENSSL_LIBS -> DST_OPENSSL_LIBS
-
-Include new unit test
----
- bin/tests/system/pipelined/pipequeries.c |  1 +
- bin/tests/system/pipelined/tests.sh      |  4 +-
- bin/tests/system/tkey/keycreate.c        |  1 +
- bin/tests/system/tkey/keydelete.c        |  1 +
- bin/tests/system/tkey/tests.sh           |  8 +-
- configure                                | 97 ++++++++++--------------
- lib/dns/include/dst/dst.h                |  8 ++
- lib/dns/lib.c                            |  1 +
- lib/dns/tests/Makefile.in                |  5 ++
- lib/isc/include/isc/types.h              |  2 +
- win32utils/Configure                     |  4 +-
- 11 files changed, 66 insertions(+), 66 deletions(-)
-
-diff --git a/bin/tests/system/pipelined/pipequeries.c b/bin/tests/system/pipelined/pipequeries.c
-index 74de833..4fac3cb 100644
---- a/bin/tests/system/pipelined/pipequeries.c
-+++ b/bin/tests/system/pipelined/pipequeries.c
-@@ -205,6 +205,7 @@ sendqueries(isc_task_t *task, isc_event_t *event) {
- 
- int
- main(int argc, char *argv[]) {
-+	char *randomfile = NULL;
- 	isc_sockaddr_t bind_any;
- 	struct in_addr inaddr;
- 	isc_result_t result;
-diff --git a/bin/tests/system/pipelined/tests.sh b/bin/tests/system/pipelined/tests.sh
-index 61f1ff7..ed1302a 100644
---- a/bin/tests/system/pipelined/tests.sh
-+++ b/bin/tests/system/pipelined/tests.sh
-@@ -19,7 +19,7 @@ status=0
- 
- echo_i "check pipelined TCP queries"
- ret=0
--$PIPEQUERIES -p ${PORT} < input > raw || ret=1
-+$PIPEQUERIES -p ${PORT} -r $RANDFILE < input > raw || ret=1
- awk '{ print $1 " " $5 }' < raw > output
- sort < output > output-sorted
- $DIFF ref output-sorted || { ret=1 ; echo_i "diff sorted failed"; }
-@@ -43,7 +43,7 @@ status=`expr $status + $ret`
- 
- echo_i "check keep-response-order"
- ret=0
--$PIPEQUERIES -p ${PORT} ++ < inputb > rawb || ret=1
-+$PIPEQUERIES -p ${PORT} -r $RANDFILE ++ < inputb > rawb || ret=1
- awk '{ print $1 " " $5 }' < rawb > outputb
- $DIFF refb outputb || ret=1
- if [ $ret != 0 ]; then echo_i "failed"; fi
-diff --git a/bin/tests/system/tkey/keycreate.c b/bin/tests/system/tkey/keycreate.c
-index c39f6a4..b29a3cb 100644
---- a/bin/tests/system/tkey/keycreate.c
-+++ b/bin/tests/system/tkey/keycreate.c
-@@ -195,6 +195,7 @@ sendquery(isc_task_t *task, isc_event_t *event) {
- int
- main(int argc, char *argv[]) {
- 	char *ourkeyname;
-+	char *randomfile;
- 	isc_taskmgr_t *taskmgr;
- 	isc_timermgr_t *timermgr;
- 	isc_socketmgr_t *socketmgr;
-diff --git a/bin/tests/system/tkey/keydelete.c b/bin/tests/system/tkey/keydelete.c
-index 547e8d0..efcea1d 100644
---- a/bin/tests/system/tkey/keydelete.c
-+++ b/bin/tests/system/tkey/keydelete.c
-@@ -136,6 +136,7 @@ sendquery(isc_task_t *task, isc_event_t *event) {
- int
- main(int argc, char **argv) {
- 	char *keyname;
-+	char *randomfile;
- 	isc_taskmgr_t *taskmgr;
- 	isc_timermgr_t *timermgr;
- 	isc_socketmgr_t *socketmgr;
-diff --git a/bin/tests/system/tkey/tests.sh b/bin/tests/system/tkey/tests.sh
-index a293d32..51ed2cb 100644
---- a/bin/tests/system/tkey/tests.sh
-+++ b/bin/tests/system/tkey/tests.sh
-@@ -31,7 +31,7 @@ for owner in . foo.example.
- do
- 	echo "I:creating new key using owner name \"$owner\""
- 	ret=0
--	keyname=`$KEYCREATE $dhkeyname $owner` || ret=1
-+	keyname=`$KEYCREATE -r $RANDFILE $dhkeyname $owner` || ret=1
- 	if [ $ret != 0 ]; then
- 		echo "I:failed"
- 		status=`expr $status + $ret`
-@@ -53,7 +53,7 @@ do
- 
- 	echo "I:deleting new key"
- 	ret=0
--	$KEYDELETE $keyname || ret=1
-+	$KEYDELETE -r $RANDFILE $keyname || ret=1
- 	if [ $ret != 0 ]; then
- 		echo "I:failed"
- 	fi
-@@ -73,7 +73,7 @@ done
- 
- echo "I:creating new key using owner name bar.example."
- ret=0
--keyname=`$KEYCREATE $dhkeyname bar.example.` || ret=1
-+keyname=`$KEYCREATE -r $RANDFILE $dhkeyname bar.example.` || ret=1
- if [ $ret != 0 ]; then
-         echo "I:failed"
- 	status=`expr $status + $ret`
-@@ -114,7 +114,7 @@ status=`expr $status + $ret`
- 
- echo "I:recreating the bar.example. key"
- ret=0
--keyname=`$KEYCREATE $dhkeyname bar.example.` || ret=1
-+keyname=`$KEYCREATE -r $RANDFILE $dhkeyname bar.example.` || ret=1
- if [ $ret != 0 ]; then
-         echo "I:failed"
- 	status=`expr $status + $ret`
-diff --git a/configure b/configure
-index 4c97c8c..1e047bd 100755
---- a/configure
-+++ b/configure
-@@ -632,6 +632,7 @@ ac_includes_default="\
- 
- ac_subst_vars='LTLIBOBJS
- LIBOBJS
-+LIBDIR_SUFFIX
- BUILD_LIBS
- BUILD_LDFLAGS
- BUILD_CPPFLAGS
-@@ -20509,6 +20510,30 @@ fi
- #
- dlzdir='${DLZ_DRIVER_DIR}'
- 
-+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for target libdir" >&5
-+$as_echo_n "checking for target libdir... " >&6; }
-+if test "$cross_compiling" = yes; then :
-+  { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
-+$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
-+as_fn_error $? "cannot run test program while cross compiling
-+See \`config.log' for more details" "$LINENO" 5; }
-+else
-+  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-+/* end confdefs.h.  */
-+int main(void) {exit((sizeof(void *) == 8) ? 0 : 1);}
-+_ACEOF
-+if ac_fn_c_try_run "$LINENO"; then :
-+  target_lib=lib64
-+else
-+  target_lib=lib
-+fi
-+rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
-+  conftest.$ac_objext conftest.beam conftest.$ac_ext
-+fi
-+
-+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: \"$target_lib\"" >&5
-+$as_echo "\"$target_lib\"" >&6; }
-+
- #
- # Private autoconf macro to simplify configuring drivers:
- #
-@@ -20839,11 +20864,11 @@ $as_echo "no" >&6; }
- $as_echo "using mysql with libs ${mysql_lib} and includes ${mysql_include}" >&6; }
- 		;;
- 	*)
--		if test -d "$use_dlz_mysql/lib/mysql"
-+		if test -d $use_dlz_mysql/${target_lib}/mysql
- 		then
--			mysql_lib="$use_dlz_mysql/lib/mysql"
-+			mysql_lib=$use_dlz_mysql/${target_lib}/mysql
- 		else
--			mysql_lib="$use_dlz_mysql/lib"
-+			mysql_lib=$use_dlz_mysql/${target_lib}
- 		fi
- 
- 	CONTRIB_DLZ="$CONTRIB_DLZ -DDLZ_MYSQL"
-@@ -20928,7 +20953,7 @@ $as_echo "" >&6; }
- 			# Check other locations for includes.
- 			# Order is important (sigh).
- 
--			bdb_incdirs="/db53 /db51 /db48 /db47 /db46 /db45 /db44 /db43 /db42 /db41 /db4 /db"
-+			bdb_incdirs="/db53 /db51 /db48 /db47 /db46 /db45 /db44 /db43 /db42 /db41 /db4 /libdb /db"
- 			# include a blank element first
- 			for d in "" $bdb_incdirs
- 			do
-@@ -20953,57 +20978,9 @@ $as_echo "" >&6; }
- 			bdb_libnames="db53 db-5.3 db51 db-5.1 db48 db-4.8 db47 db-4.7 db46 db-4.6 db45 db-4.5 db44 db-4.4 db43 db-4.3 db42 db-4.2 db41 db-4.1 db"
- 			for d in $bdb_libnames
- 			do
--				if test "$dd" = "/usr"
--				then
--					as_ac_Lib=`$as_echo "ac_cv_lib_$d''_db_create" | $as_tr_sh`
--{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for db_create in -l$d" >&5
--$as_echo_n "checking for db_create in -l$d... " >&6; }
--if eval \${$as_ac_Lib+:} false; then :
--  $as_echo_n "(cached) " >&6
--else
--  ac_check_lib_save_LIBS=$LIBS
--LIBS="-l$d  $LIBS"
--cat confdefs.h - <<_ACEOF >conftest.$ac_ext
--/* end confdefs.h.  */
--
--/* Override any GCC internal prototype to avoid an error.
--   Use char because int might match the return type of a GCC
--   builtin and then its argument prototype would still apply.  */
--#ifdef __cplusplus
--extern "C"
--#endif
--char db_create ();
--int
--main ()
--{
--return db_create ();
--  ;
--  return 0;
--}
--_ACEOF
--if ac_fn_c_try_link "$LINENO"; then :
--  eval "$as_ac_Lib=yes"
--else
--  eval "$as_ac_Lib=no"
--fi
--rm -f core conftest.err conftest.$ac_objext \
--    conftest$ac_exeext conftest.$ac_ext
--LIBS=$ac_check_lib_save_LIBS
--fi
--eval ac_res=\$$as_ac_Lib
--	       { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
--$as_echo "$ac_res" >&6; }
--if eval test \"x\$"$as_ac_Lib"\" = x"yes"; then :
--  dlz_bdb_libs="-l${d}"
--fi
--
--					if test $dlz_bdb_libs != "yes"
--					then
--						break
--					fi
--				elif test -f "$dd/lib/lib${d}.so"
-+				if test -f "$dd/${target_lib}/lib${d}.so"
- 				then
--					dlz_bdb_libs="-L${dd}/lib -l${d}"
-+					dlz_bdb_libs="-L${dd}/${target_lib}/libdb -l${d}"
- 					break
- 				fi
- 			done
-@@ -21162,10 +21139,10 @@ $as_echo "no" >&6; }
- 		DLZ_DRIVER_INCLUDES="$DLZ_DRIVER_INCLUDES -I$use_dlz_ldap/include"
- 		DLZ_DRIVER_LDAP_INCLUDES="-I$use_dlz_ldap/include"
- 	fi
--	if test -n "-L$use_dlz_ldap/lib -lldap -llber"
-+	if test -n "-L$use_dlz_ldap/${target_lib} -lldap -llber"
- 	then
--		DLZ_DRIVER_LIBS="$DLZ_DRIVER_LIBS -L$use_dlz_ldap/lib -lldap -llber"
--		DLZ_DRIVER_LDAP_LIBS="-L$use_dlz_ldap/lib -lldap -llber"
-+		DLZ_DRIVER_LIBS="$DLZ_DRIVER_LIBS -L$use_dlz_ldap/${target_lib} -lldap -llber"
-+		DLZ_DRIVER_LDAP_LIBS="-L$use_dlz_ldap/${target_lib} -lldap -llber"
- 	fi
- 
- 
-@@ -21251,11 +21228,11 @@ fi
- 		odbcdirs="/usr /usr/local /usr/pkg"
- 		for d in $odbcdirs
- 		do
--			if test -f $d/include/sql.h -a -f $d/lib/libodbc.a
-+			if test -f $d/include/sql.h -a -f $d/${target_lib}/libodbc.a
- 			then
- 				use_dlz_odbc=$d
- 				dlz_odbc_include="-I$use_dlz_odbc/include"
--				dlz_odbc_libs="-L$use_dlz_odbc/lib -lodbc"
-+				dlz_odbc_libs="-L$use_dlz_odbc/${target_lib} -lodbc"
- 				break
- 			fi
- 		done
-@@ -21530,6 +21507,8 @@ DNS_CRYPTO_LIBS="$NEWFLAGS"
- 
- 
- 
-+
-+
- #
- # Commands to run at the end of config.status.
- # Don't just put these into configure, it won't work right if somebody
-diff --git a/lib/dns/include/dst/dst.h b/lib/dns/include/dst/dst.h
-index 3146d88..3f7ac4d 100644
---- a/lib/dns/include/dst/dst.h
-+++ b/lib/dns/include/dst/dst.h
-@@ -153,6 +153,14 @@ dst_lib_destroy(void);
-  * Releases all resources allocated by DST.
-  */
- 
-+isc_result_t
-+dst_random_getdata(void *data, unsigned int length,
-+		   unsigned int *returned, unsigned int flags);
-+/*%<
-+ * \brief Return data from the crypto random generator.
-+ * Specialization of isc_entropy_getdata().
-+ */
-+
- bool
- dst_algorithm_supported(unsigned int alg);
- /*%<
-diff --git a/lib/dns/lib.c b/lib/dns/lib.c
-index 5fccb57..1f627c4 100644
---- a/lib/dns/lib.c
-+++ b/lib/dns/lib.c
-@@ -51,6 +51,7 @@ static unsigned int references = 0;
- static void
- initialize(void) {
- 	isc_result_t result;
-+	isc_entropy_t *ectx = NULL;
- 
- 	REQUIRE(initialize_done == false);
- 
-diff --git a/lib/dns/tests/Makefile.in b/lib/dns/tests/Makefile.in
-index 7b35b93..c5befff 100644
---- a/lib/dns/tests/Makefile.in
-+++ b/lib/dns/tests/Makefile.in
-@@ -259,6 +259,11 @@ zt_test@EXEEXT@: zt_test.@O@ dnstest.@O@ ${ISCDEPLIBS} ${DNSDEPLIBS}
- 		${LDFLAGS} -o $@ zt_test.@O@ dnstest.@O@ \
- 		${DNSLIBS} ${ISCLIBS} ${LIBS}
- 
-+dstrandom_test@EXEEXT@: dstrandom_test.@O@ ${ISCDEPLIBS} ${DNSDEPLIBS}
-+	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \
-+			dstrandom_test.@O@ ${DNSLIBS} \
-+			${ISCLIBS} ${ISCPK11LIBS} ${LIBS}
-+
- unit::
- 	sh ${top_builddir}/unit/unittest.sh
- 
-diff --git a/lib/isc/include/isc/types.h b/lib/isc/include/isc/types.h
-index f8e5ae6..d0dc9b5 100644
---- a/lib/isc/include/isc/types.h
-+++ b/lib/isc/include/isc/types.h
-@@ -82,6 +82,8 @@ typedef struct isc_time			isc_time_t;		/*%< Time */
- typedef struct isc_timer		isc_timer_t;		/*%< Timer */
- typedef struct isc_timermgr		isc_timermgr_t;		/*%< Timer Manager */
- 
-+typedef isc_result_t (*isc_entropy_getdata_t)(void *, unsigned int,
-+					      unsigned int *, unsigned int);
- typedef void (*isc_taskaction_t)(isc_task_t *, isc_event_t *);
- typedef int (*isc_sockfdwatch_t)(isc_task_t *, isc_socket_t *, void *, int);
- 
-diff --git a/win32utils/Configure b/win32utils/Configure
-index 9731b0c..0b7bc6e 100644
---- a/win32utils/Configure
-+++ b/win32utils/Configure
-@@ -353,7 +353,8 @@ my @allcond = (@substcond, "NOTYET", "NOLONGER");
- 
- # enable-xxx/disable-xxx
- 
--my @enablelist = ("developer",
-+my @enablelist = ("crypto-rand",
-+                  "developer",
-                   "fixed-rrset",
-                   "intrinsics",
-                   "isc-spnego",
-@@ -2929,6 +2930,7 @@ exit 0;
- #  --enable-developer partially supported
- #  --enable-newstats (9.9/9.9sub only)
- #  --enable-native-pkcs11 supported
-+#  --enable-crypto-rand supported
- #  --enable-openssl-version-check included without a way to disable it
- #  --enable-openssl-hash supported
- #  --enable-threads included without a way to disable it
--- 
-2.20.1
-
diff --git a/bind-9.11-rt46047.patch b/bind-9.11-rt46047.patch
deleted file mode 100644
index 8f413f6..0000000
--- a/bind-9.11-rt46047.patch
+++ /dev/null
@@ -1,799 +0,0 @@
-From 5a465424f5249ceaf0547ab90361a16eb08f7a2b Mon Sep 17 00:00:00 2001
-From: Evan Hunt <each@isc.org>
-Date: Thu, 28 Sep 2017 10:09:22 -0700
-Subject: [PATCH] completed and corrected the crypto-random change
-
-4724.	[func]		By default, BIND now uses the random number
-			functions provided by the crypto library (i.e.,
-			OpenSSL or a PKCS#11 provider) as a source of
-			randomness rather than /dev/random.  This is
-			suitable for virtual machine environments
-			which have limited entropy pools and lack
-			hardware random number generators.
-
-			This can be overridden by specifying another
-			entropy source via the "random-device" option
-			in named.conf, or via the -r command line option;
-			however, for functions requiring full cryptographic
-			strength, such as DNSSEC key generation, this
-			cannot be overridden. In particular, the -r
-			command line option no longer has any effect on
-			dnssec-keygen.
-
-			This can be disabled by building with
-			"configure --disable-crypto-rand".
-			[RT #31459] [RT #46047]
----
- bin/confgen/keygen.c                     | 12 +++---
- bin/dnssec/dnssec-keygen.docbook         | 24 +++++++----
- bin/dnssec/dnssectool.c                  | 12 +++---
- bin/named/client.c                       |  3 +-
- bin/named/config.c                       |  4 +-
- bin/named/controlconf.c                  | 19 +++++---
- bin/named/include/named/server.h         |  2 +
- bin/named/interfacemgr.c                 |  1 +
- bin/named/query.c                        |  1 +
- bin/named/server.c                       | 52 ++++++++++++++--------
- bin/nsupdate/nsupdate.c                  |  4 +-
- bin/tests/system/pipelined/pipequeries.c |  4 +-
- bin/tests/system/tkey/keycreate.c        |  4 +-
- bin/tests/system/tkey/keydelete.c        |  5 +--
- doc/arm/Bv9ARM-book.xml                  | 55 +++++++++++++++++-------
- doc/arm/notes-rh-changes.xml             | 43 ++++++++++++++++++
- doc/arm/notes.xml                        |  1 +
- lib/dns/dst_api.c                        |  4 +-
- lib/dns/include/dst/dst.h                | 14 +++++-
- lib/dns/openssl_link.c                   |  3 +-
- lib/isc/include/isc/entropy.h            | 50 +++++++++++++++------
- lib/isc/include/isc/random.h             | 28 +++++++-----
- lib/isccfg/namedconf.c                   |  2 +-
- 23 files changed, 241 insertions(+), 106 deletions(-)
- create mode 100644 doc/arm/notes-rh-changes.xml
-
-diff --git a/bin/confgen/keygen.c b/bin/confgen/keygen.c
-index 295e16f..0f79aa8 100644
---- a/bin/confgen/keygen.c
-+++ b/bin/confgen/keygen.c
-@@ -161,17 +161,15 @@ generate_key(isc_mem_t *mctx, const char *randomfile, dns_secalg_t alg,
- 
- 	DO("create entropy context", isc_entropy_create(mctx, &ectx));
- 
--	if (randomfile != NULL && strcmp(randomfile, "keyboard") == 0) {
--		randomfile = NULL;
--		open_keyboard = ISC_ENTROPY_KEYBOARDYES;
--	}
- #ifdef ISC_PLATFORM_CRYPTORANDOM
--	if (randomfile != NULL &&
--	    strcmp(randomfile, ISC_PLATFORM_CRYPTORANDOM) == 0) {
--		randomfile = NULL;
-+	if (randomfile == NULL) {
- 		isc_entropy_usehook(ectx, true);
- 	}
- #endif
-+	if (randomfile != NULL && strcmp(randomfile, "keyboard") == 0) {
-+		randomfile = NULL;
-+		open_keyboard = ISC_ENTROPY_KEYBOARDYES;
-+	}
- 	DO("start entropy source", isc_entropy_usebestsource(ectx,
- 							     &entropy_source,
- 							     randomfile,
-diff --git a/bin/dnssec/dnssec-keygen.docbook b/bin/dnssec/dnssec-keygen.docbook
-index 0ae6b41..4562430 100644
---- a/bin/dnssec/dnssec-keygen.docbook
-+++ b/bin/dnssec/dnssec-keygen.docbook
-@@ -348,15 +348,23 @@
- 	<term>-r <replaceable class="parameter">randomdev</replaceable></term>
- 	<listitem>
- 	  <para>
--	    Specifies the source of randomness.  If the operating
--	    system does not provide a <filename>/dev/random</filename>
--	    or equivalent device, the default source of randomness
--	    is keyboard input.  <filename>randomdev</filename>
--	    specifies
-+	    Specifies a source of randomness.  Normally, when generating
-+	    DNSSEC keys, this option has no effect; the random number
-+	    generation function provided by the cryptographic library will
-+	    be used.
-+	  </para>
-+	  <para>
-+	    If that behavior is disabled at compile time, however,
-+	    the specified file will be used as entropy source
-+	    for key generation.  <filename>randomdev</filename> is
- 	    the name of a character device or file containing random
--	    data to be used instead of the default.  The special value
--	    <filename>keyboard</filename> indicates that keyboard
--	    input should be used.
-+	    data to be used.  The special value <filename>keyboard</filename>
-+	    indicates that keyboard input should be used.
-+	  </para>
-+	  <para>
-+	    The default is <filename>/dev/random</filename> if the
-+	    operating system provides it or an equivalent device;
-+	    if not, the default source of randomness is keyboard input.
- 	  </para>
- 	</listitem>
-       </varlistentry>
-diff --git a/bin/dnssec/dnssectool.c b/bin/dnssec/dnssectool.c
-index 31a99e7..38c83ed 100644
---- a/bin/dnssec/dnssectool.c
-+++ b/bin/dnssec/dnssectool.c
-@@ -241,18 +241,16 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
- 		ISC_LIST_INIT(sources);
- 	}
- 
-+#ifdef ISC_PLATFORM_CRYPTORANDOM
-+	if (randomfile == NULL) {
-+		isc_entropy_usehook(*ectx, true);
-+	}
-+#endif
- 	if (randomfile != NULL && strcmp(randomfile, "keyboard") == 0) {
- 		usekeyboard = ISC_ENTROPY_KEYBOARDYES;
- 		randomfile = NULL;
- 	}
- 
--#ifdef ISC_PLATFORM_CRYPTORANDOM
--	if (randomfile != NULL &&
--	    strcmp(randomfile, ISC_PLATFORM_CRYPTORANDOM) == 0) {
--		randomfile = NULL;
--		isc_entropy_usehook(*ectx, true);
--	}
--#endif
- 	result = isc_entropy_usebestsource(*ectx, &source, randomfile,
- 					   usekeyboard);
- 
-diff --git a/bin/named/client.c b/bin/named/client.c
-index 50fa2cd..524d9a3 100644
---- a/bin/named/client.c
-+++ b/bin/named/client.c
-@@ -1762,7 +1762,8 @@ ns_client_addopt(ns_client_t *client, dns_message_t *message,
- 
- 		isc_buffer_init(&buf, cookie, sizeof(cookie));
- 		isc_stdtime_get(&now);
--		isc_random_get(&nonce);
-+		nonce = ((isc_rng_random(ns_g_server->rngctx) << 16) |
-+			 isc_rng_random(ns_g_server->rngctx));
- 
- 		compute_cookie(client, now, nonce, ns_g_server->secret, &buf);
- 
-diff --git a/bin/named/config.c b/bin/named/config.c
-index dbdff64..63da4b0 100644
---- a/bin/named/config.c
-+++ b/bin/named/config.c
-@@ -98,7 +98,9 @@ options {\n\
- #	pid-file \"" NS_LOCALSTATEDIR "/run/named/named.pid\"; /* or /lwresd.pid */\n\
- 	port 53;\n\
- 	prefetch 2 9;\n"
--#ifdef PATH_RANDOMDEV
-+#if defined(ISC_PLATFORM_CRYPTORANDOM)
-+"	random-device none;\n"
-+#elif defined(PATH_RANDOMDEV)
- "	random-device \"" PATH_RANDOMDEV "\";\n"
- #endif
- "	recursing-file \"named.recursing\";\n\
-diff --git a/bin/named/controlconf.c b/bin/named/controlconf.c
-index d955c2f..40621f2 100644
---- a/bin/named/controlconf.c
-+++ b/bin/named/controlconf.c
-@@ -325,9 +325,10 @@ log_invalid(isccc_ccmsg_t *ccmsg, isc_result_t result) {
- 
- static void
- control_recvmessage(isc_task_t *task, isc_event_t *event) {
--	controlconnection_t *conn;
--	controllistener_t *listener;
--	controlkey_t *key;
-+	controlconnection_t *conn = NULL;
-+	controllistener_t *listener = NULL;
-+	ns_server_t *server = NULL;
-+	controlkey_t *key = NULL;
- 	isccc_sexpr_t *request = NULL;
- 	isccc_sexpr_t *response = NULL;
- 	uint32_t algorithm;
-@@ -338,16 +339,17 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
- 	isc_buffer_t *text;
- 	isc_result_t result;
- 	isc_result_t eresult;
--	isccc_sexpr_t *_ctrl;
-+	isccc_sexpr_t *_ctrl = NULL;
- 	isccc_time_t sent;
- 	isccc_time_t exp;
- 	uint32_t nonce;
--	isccc_sexpr_t *data;
-+	isccc_sexpr_t *data = NULL;
- 
- 	REQUIRE(event->ev_type == ISCCC_EVENT_CCMSG);
- 
- 	conn = event->ev_arg;
- 	listener = conn->listener;
-+	server = listener->controls->server;
- 	algorithm = DST_ALG_UNKNOWN;
- 	secret.rstart = NULL;
- 	text = NULL;
-@@ -458,8 +460,11 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
- 	 * Establish nonce.
- 	 */
- 	if (conn->nonce == 0) {
--		while (conn->nonce == 0)
--			isc_random_get(&conn->nonce);
-+		while (conn->nonce == 0) {
-+			uint16_t r1 = isc_rng_random(server->rngctx);
-+			uint16_t r2 = isc_rng_random(server->rngctx);
-+			conn->nonce = (r1 << 16) | r2;
-+		}
- 		eresult = ISC_R_SUCCESS;
- 	} else
- 		eresult = ns_control_docommand(request, listener->readonly, &text);
-diff --git a/bin/named/include/named/server.h b/bin/named/include/named/server.h
-index 7ee8f66..8982d26 100644
---- a/bin/named/include/named/server.h
-+++ b/bin/named/include/named/server.h
-@@ -20,6 +20,7 @@
- #include <isc/log.h>
- #include <isc/magic.h>
- #include <isc/quota.h>
-+#include <isc/random.h>
- #include <isc/sockaddr.h>
- #include <isc/types.h>
- #include <isc/xml.h>
-@@ -134,6 +135,7 @@ struct ns_server {
- 	char *			lockfile;
- 
- 	uint16_t		transfer_tcp_message_size;
-+	isc_rng_t *		rngctx;
- };
- 
- struct ns_altsecret {
-diff --git a/bin/named/interfacemgr.c b/bin/named/interfacemgr.c
-index 9dea7c1..272d300 100644
---- a/bin/named/interfacemgr.c
-+++ b/bin/named/interfacemgr.c
-@@ -17,6 +17,7 @@
- 
- #include <isc/interfaceiter.h>
- #include <isc/os.h>
-+#include <isc/random.h>
- #include <isc/string.h>
- #include <isc/task.h>
- #include <isc/util.h>
-diff --git a/bin/named/query.c b/bin/named/query.c
-index c9e5469..0940714 100644
---- a/bin/named/query.c
-+++ b/bin/named/query.c
-@@ -19,6 +19,7 @@
- #include <isc/hex.h>
- #include <isc/mem.h>
- #include <isc/print.h>
-+#include <isc/random.h>
- #include <isc/rwlock.h>
- #include <isc/serial.h>
- #include <isc/stats.h>
-diff --git a/bin/named/server.c b/bin/named/server.c
-index 36fc047..3c1eec0 100644
---- a/bin/named/server.c
-+++ b/bin/named/server.c
-@@ -8208,21 +8208,32 @@ load_configuration(const char *filename, ns_server_t *server,
- 	 * Open the source of entropy.
- 	 */
- 	if (first_time) {
-+		const char *randomdev = NULL;
-+		int level = ISC_LOG_ERROR;
- 		obj = NULL;
- 		result = ns_config_get(maps, "random-device", &obj);
--		if (result != ISC_R_SUCCESS) {
-+		if (result == ISC_R_SUCCESS) {
-+			if (!cfg_obj_isvoid(obj)) {
-+				level = ISC_LOG_INFO;
-+				randomdev = cfg_obj_asstring(obj);
-+			}
-+		}
-+		if (randomdev == NULL) {
-+#ifdef ISC_PLATFORM_CRYPTORANDOM
-+			isc_entropy_usehook(ns_g_entropy, true);
-+#else
-+			if ((obj != NULL) && !cfg_obj_isvoid(obj))
-+				level = ISC_LOG_INFO;
- 			isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
--				      NS_LOGMODULE_SERVER, ISC_LOG_INFO,
-+				      NS_LOGMODULE_SERVER, level,
- 				      "no source of entropy found");
-+			if ((obj == NULL) || cfg_obj_isvoid(obj)) {
-+				CHECK(ISC_R_FAILURE);
-+			}
-+#endif
- 		} else {
--			const char *randomdev = cfg_obj_asstring(obj);
--#ifdef ISC_PLATFORM_CRYPTORANDOM
--			if (strcmp(randomdev, ISC_PLATFORM_CRYPTORANDOM) == 0)
--				isc_entropy_usehook(ns_g_entropy, true);
--#else
--			int level = ISC_LOG_ERROR;
- 			result = isc_entropy_createfilesource(ns_g_entropy,
--							      randomdev);
-+			                                      randomdev);
- #ifdef PATH_RANDOMDEV
- 			if (ns_g_fallbackentropy != NULL) {
- 				level = ISC_LOG_INFO;
-@@ -8233,8 +8244,8 @@ load_configuration(const char *filename, ns_server_t *server,
- 					      NS_LOGCATEGORY_GENERAL,
- 					      NS_LOGMODULE_SERVER,
- 					      level,
--					      "could not open entropy source "
--					      "%s: %s",
-+					      "could not open "
-+					      "entropy source %s: %s",
- 					      randomdev,
- 					      isc_result_totext(result));
- 			}
-@@ -8254,7 +8265,6 @@ load_configuration(const char *filename, ns_server_t *server,
- 				}
- 				isc_entropy_detach(&ns_g_fallbackentropy);
- 			}
--#endif
- #endif
- 		}
- 
-@@ -9022,6 +9032,7 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
- 	server->in_roothints = NULL;
- 	server->blackholeacl = NULL;
- 	server->keepresporder = NULL;
-+	server->rngctx = NULL;
- 
- 	/* Must be first. */
- 	CHECKFATAL(dst_lib_init2(ns_g_mctx, ns_g_entropy,
-@@ -9048,6 +9059,9 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
- 	CHECKFATAL(dns_tkeyctx_create(ns_g_mctx, ns_g_entropy,
- 				      &server->tkeyctx),
- 		   "creating TKEY context");
-+	server->rngctx = NULL;
-+	CHECKFATAL(isc_rng_create(ns_g_mctx, ns_g_entropy, &server->rngctx),
-+	           "creating random numbers context");
- 
- 	/*
- 	 * Setup the server task, which is responsible for coordinating
-@@ -9254,7 +9268,8 @@ ns_server_destroy(ns_server_t **serverp) {
- 
- 	if (server->zonemgr != NULL)
- 		dns_zonemgr_detach(&server->zonemgr);
--
-+	if (server->rngctx != NULL)
-+		isc_rng_detach(&server->rngctx);
- 	if (server->tkeyctx != NULL)
- 		dns_tkeyctx_destroy(&server->tkeyctx);
- 
-@@ -13230,10 +13245,10 @@ newzone_cfgctx_destroy(void **cfgp) {
- 
- static isc_result_t
- generate_salt(unsigned char *salt, size_t saltlen) {
--	int i, n;
-+	size_t i, n;
- 	union {
- 		unsigned char rnd[256];
--		uint32_t rnd32[64];
-+		uint16_t rnd16[128];
- 	} rnd;
- 	unsigned char text[512 + 1];
- 	isc_region_t r;
-@@ -13243,9 +13258,10 @@ generate_salt(unsigned char *salt, size_t saltlen) {
- 	if (saltlen > 256U)
- 		return (ISC_R_RANGE);
- 
--	n = (int) (saltlen + sizeof(uint32_t) - 1) / sizeof(uint32_t);
--	for (i = 0; i < n; i++)
--		isc_random_get(&rnd.rnd32[i]);
-+	n = (saltlen + sizeof(uint16_t) - 1) / sizeof(uint16_t);
-+	for (i = 0; i < n; i++) {
-+		rnd.rnd16[i] = isc_rng_random(ns_g_server->rngctx);
-+	}
- 
- 	memmove(salt, rnd.rnd, saltlen);
- 
-diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
-index 0286987..0376377 100644
---- a/bin/nsupdate/nsupdate.c
-+++ b/bin/nsupdate/nsupdate.c
-@@ -283,9 +283,7 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
- 	}
- 
- #ifdef ISC_PLATFORM_CRYPTORANDOM
--	if (randomfile != NULL &&
--	    strcmp(randomfile, ISC_PLATFORM_CRYPTORANDOM) == 0) {
--		randomfile = NULL;
-+	if (randomfile == NULL) {
- 		isc_entropy_usehook(*ectx, true);
- 	}
- #endif
-diff --git a/bin/tests/system/pipelined/pipequeries.c b/bin/tests/system/pipelined/pipequeries.c
-index f0a6ff2..55064f6 100644
---- a/bin/tests/system/pipelined/pipequeries.c
-+++ b/bin/tests/system/pipelined/pipequeries.c
-@@ -280,9 +280,7 @@ main(int argc, char *argv[]) {
- 	ectx = NULL;
- 	RUNCHECK(isc_entropy_create(mctx, &ectx));
- #ifdef ISC_PLATFORM_CRYPTORANDOM
--	if (randomfile != NULL &&
--	    strcmp(randomfile, ISC_PLATFORM_CRYPTORANDOM) == 0) {
--		randomfile = NULL;
-+	if (randomfile == NULL) {
- 		isc_entropy_usehook(ectx, true);
- 	}
- #endif
-diff --git a/bin/tests/system/tkey/keycreate.c b/bin/tests/system/tkey/keycreate.c
-index fe8698e..937fcc3 100644
---- a/bin/tests/system/tkey/keycreate.c
-+++ b/bin/tests/system/tkey/keycreate.c
-@@ -255,9 +255,7 @@ main(int argc, char *argv[]) {
- 	ectx = NULL;
- 	RUNCHECK(isc_entropy_create(mctx, &ectx));
- #ifdef ISC_PLATFORM_CRYPTORANDOM
--	if (randomfile != NULL &&
--	    strcmp(randomfile, ISC_PLATFORM_CRYPTORANDOM) == 0) {
--		randomfile = NULL;
-+	if (randomfile == NULL) {
- 		isc_entropy_usehook(ectx, true);
- 	}
- #endif
-diff --git a/bin/tests/system/tkey/keydelete.c b/bin/tests/system/tkey/keydelete.c
-index 2146f9b..64b8e74 100644
---- a/bin/tests/system/tkey/keydelete.c
-+++ b/bin/tests/system/tkey/keydelete.c
-@@ -171,6 +171,7 @@ main(int argc, char **argv) {
- 		randomfile = argv[2];
- 		argv += 2;
- 		argc -= 2;
-+		POST(argc);
- 	}
- 	keyname = argv[1];
- 
-@@ -182,9 +183,7 @@ main(int argc, char **argv) {
- 	ectx = NULL;
- 	RUNCHECK(isc_entropy_create(mctx, &ectx));
- #ifdef ISC_PLATFORM_CRYPTORANDOM
--	if (randomfile != NULL &&
--	    strcmp(randomfile, ISC_PLATFORM_CRYPTORANDOM) == 0) {
--		randomfile = NULL;
-+	if (randomfile == NULL) {
- 		isc_entropy_usehook(ectx, true);
- 	}
- #endif
-diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
-index 33e06e6..539973c 100644
---- a/doc/arm/Bv9ARM-book.xml
-+++ b/doc/arm/Bv9ARM-book.xml
-@@ -5076,22 +5076,45 @@ badresp:1,adberr:0,findfail:0,valfail:0]
- 	    <term><command>random-device</command></term>
- 	    <listitem>
- 	      <para>
--		The source of entropy to be used by the server.  Entropy is
--		primarily needed
--		for DNSSEC operations, such as TKEY transactions and dynamic
--		update of signed
--		zones.  This options specifies the device (or file) from which
--		to read
--		entropy.  If this is a file, operations requiring entropy will
--		fail when the
--		file has been exhausted.  If not specified, the default value
--		is
--		<filename>/dev/random</filename>
--		(or equivalent) when present, and none otherwise.  The
--		<command>random-device</command> option takes
--		effect during
--		the initial configuration load at server startup time and
--		is ignored on subsequent reloads.
-+		Specifies a source of entropy to be used by the server.
-+		This is a device or file from which to read entropy.
-+		If it is a file, operations requiring entropy
-+		will fail when the file has been exhausted.
-+	      </para>
-+	      <para>
-+		Entropy is needed for cryptographic operations such as
-+		TKEY transactions, dynamic update of signed zones, and
-+		generation of TSIG session keys. It is also used for
-+		seeding and stirring the pseudo-random number generator,
-+		which is used for less critical functions requiring
-+		randomness such as generation of DNS message transaction
-+		ID's.
-+	      </para>
-+	      <para>
-+		If <command>random-device</command> is not specified, or
-+		if it is set to <literal>none</literal>, entropy will be
-+		read from the random number generation function supplied
-+		by the cryptographic library with which BIND was linked
-+		(i.e.  OpenSSL or a PKCS#11 provider).
-+	      </para>
-+	      <para>
-+		The <command>random-device</command> option takes
-+		effect during the initial configuration load at server
-+		startup time and is ignored on subsequent reloads.
-+	      </para>
-+	      <para>
-+		If BIND is built with
-+		<command>configure --disable-crypto-rand</command>, then
-+		entropy is <emphasis>not</emphasis> sourced from the
-+		cryptographic library. In this case, if
-+		<command>random-device</command> is not specified, the
-+		default value is the system random device,
-+		<filename>/dev/random</filename> or the equivalent.
-+		This default can be overridden with
-+		<command>configure --with-randomdev</command>.
-+		If no system random device exists, then no entropy source
-+		will be configured, and <command>named</command> will only
-+		be able to use pseudo-random numbers.
- 	      </para>
- 	    </listitem>
- 	  </varlistentry>
-diff --git a/doc/arm/notes-rh-changes.xml b/doc/arm/notes-rh-changes.xml
-new file mode 100644
-index 0000000..11c3a7c
---- /dev/null
-+++ b/doc/arm/notes-rh-changes.xml
-@@ -0,0 +1,43 @@
-+
-+<!--
-+ - Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-+ -
-+ - This Source Code Form is subject to the terms of the Mozilla Public
-+ - License, v. 2.0. If a copy of the MPL was not distributed with this
-+ - file, You can obtain one at http://mozilla.org/MPL/2.0/.
-+ -
-+ - See the COPYRIGHT file distributed with this work for additional
-+ - information regarding copyright ownership.
-+-->
-+
-+<section xml:id="relnotes_rh_changes"><info><title>Red Hat Specific Changes</title></info>
-+  <itemizedlist>
-+     <listitem>
-+      <para>
-+        By default, BIND now uses the random number generation functions
-+        in the cryptographic library (i.e., OpenSSL or a PKCS#11
-+        provider) as a source of high-quality randomness rather than
-+        <filename>/dev/random</filename>.  This is suitable for virtual
-+        machine environments, which may have limited entropy pools and
-+        lack hardware random number generators.
-+      </para>
-+      <para>
-+        This can be overridden by specifying another entropy source via
-+        the <command>random-device</command> option in
-+        <filename>named.conf</filename>, or via the <command>-r</command>
-+        command line option.  However, for functions requiring full
-+        cryptographic strength, such as DNSSEC key generation, this
-+        <emphasis>cannot</emphasis> be overridden. In particular, the
-+        <command>-r</command> command line option no longer has any
-+        effect on <command>dnssec-keygen</command>.
-+      </para>
-+      <para>
-+        This can be disabled by building with
-+        <command>configure --disable-crypto-rand</command>, in which
-+        case <filename>/dev/random</filename> will be the default
-+        entropy source.  [RT #31459] [RT #46047]
-+      </para>
-+    </listitem>
-+  </itemizedlist>
-+</section>
-+
-diff --git a/doc/arm/notes.xml b/doc/arm/notes.xml
-index b16dab6..763ff7e 100644
---- a/doc/arm/notes.xml
-+++ b/doc/arm/notes.xml
-@@ -36,6 +36,7 @@
-   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-9.11.1.xml"/>
-   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-9.11.0.xml"/>
- 
-+  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-rh-changes.xml"/>
-   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-eol.xml"/>
-   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-thankyou.xml"/>
- </section>
-diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c
-index 1614afa..0f52df9 100644
---- a/lib/dns/dst_api.c
-+++ b/lib/dns/dst_api.c
-@@ -2017,10 +2017,12 @@ dst__entropy_getdata(void *buf, unsigned int len, bool pseudo) {
- 	else
- 		flags |= ISC_ENTROPY_BLOCKING;
- #ifdef ISC_PLATFORM_CRYPTORANDOM
-+	/* get entropy directly from crypto provider */
- 	return (dst_random_getdata(buf, len, NULL, flags));
- #else
-+	/* get entropy from entropy source or hook function */
- 	return (isc_entropy_getdata(dst_entropy_pool, buf, len, NULL, flags));
--#endif
-+#endif /* ISC_PLATFORM_CRYPTORANDOM */
- #endif /* PKCS11CRYPTO */
- }
- 
-diff --git a/lib/dns/include/dst/dst.h b/lib/dns/include/dst/dst.h
-index 6813c96..665574d 100644
---- a/lib/dns/include/dst/dst.h
-+++ b/lib/dns/include/dst/dst.h
-@@ -163,8 +163,18 @@ isc_result_t
- dst_random_getdata(void *data, unsigned int length,
- 		   unsigned int *returned, unsigned int flags);
- /*%<
-- * \brief Return data from the crypto random generator.
-- * Specialization of isc_entropy_getdata().
-+ * Gets random data from the random generator provided by the
-+ * crypto library, if BIND was built with --enable-crypto-rand.
-+ *
-+ * See isc_entropy_getdata() for parameter usage. Normally when
-+ * this function is available, it will be set up as a hook in the
-+ * entropy context, so that isc_entropy_getdata() is a front-end to
-+ * this function.
-+ *
-+ * Returns:
-+ * \li	ISC_R_SUCCESS on success
-+ * \li	ISC_R_NOTIMPLEMENTED if BIND is built with --disable-crypto-rand
-+ * \li	DST_R_OPENSSLFAILURE, DST_R_CRYPTOFAILURE, or other codes on error
-  */
- 
- bool
-diff --git a/lib/dns/openssl_link.c b/lib/dns/openssl_link.c
-index 6849732..e00a0e4 100644
---- a/lib/dns/openssl_link.c
-+++ b/lib/dns/openssl_link.c
-@@ -484,7 +484,8 @@ dst__openssl_getengine(const char *engine) {
- 
- isc_result_t
- dst_random_getdata(void *data, unsigned int length,
--		   unsigned int *returned, unsigned int flags) {
-+		   unsigned int *returned, unsigned int flags)
-+{
- #ifdef ISC_PLATFORM_CRYPTORANDOM
- #ifndef DONT_REQUIRE_DST_LIB_INIT
- 	INSIST(dst__memory_pool != NULL);
-diff --git a/lib/isc/include/isc/entropy.h b/lib/isc/include/isc/entropy.h
-index 632166a..c7cb17d 100644
---- a/lib/isc/include/isc/entropy.h
-+++ b/lib/isc/include/isc/entropy.h
-@@ -9,8 +9,6 @@
-  * information regarding copyright ownership.
-  */
- 
--/* $Id: entropy.h,v 1.35 2009/10/19 02:37:08 marka Exp $ */
--
- #ifndef ISC_ENTROPY_H
- #define ISC_ENTROPY_H 1
- 
-@@ -191,9 +189,8 @@ isc_entropy_createcallbacksource(isc_entropy_t *ent,
- /*!<
-  * \brief Create an entropy source that is polled via a callback.
-  *
-- * This would
-- * be used when keyboard input is used, or a GUI input method.  It can
-- * also be used to hook in any external entropy source.
-+ * This would be used when keyboard input is used, or a GUI input method.
-+ * It can also be used to hook in any external entropy source.
-  *
-  * Samples are added via isc_entropy_addcallbacksample(), below.
-  * _addcallbacksample() is the only function which may be called from
-@@ -234,15 +231,32 @@ isc_result_t
- isc_entropy_getdata(isc_entropy_t *ent, void *data, unsigned int length,
- 		    unsigned int *returned, unsigned int flags);
- /*!<
-- * \brief Extract data from the entropy pool.  This may load the pool from various
-- * sources.
-+ * \brief Get random data from entropy pool 'ent'.
-+ *
-+ * If a hook has been set up using isc_entropy_sethook() and
-+ * isc_entropy_usehook(), then the hook function will be called to get
-+ * random data.
-+ *
-+ * Otherwise, randomness is extracted from the entropy pool set up in BIND.
-+ * This may cause the pool to be loaded from various sources. Ths is done
-+ * by stirring the pool and returning a part of hash as randomness.
-+ * (Note that no secrets are given away here since parts of the hash are
-+ * XORed together before returning.)
-+ *
-+ * 'flags' may contain ISC_ENTROPY_GOODONLY, ISC_ENTROPY_PARTIAL, or
-+ * ISC_ENTROPY_BLOCKING. These will be honored if the hook function is
-+ * not in use. If it is, the flags will be passed to the hook function
-+ * but it may ignore them.
-  *
-- * Do this by stiring the pool and returning a part of hash as randomness.
-- * Note that no secrets are given away here since parts of the hash are
-- * xored together before returned.
-+ * Up to 'length' bytes of randomness are retrieved and copied into 'data'.
-+ * (If 'returned' is not NULL, and the number of bytes copied is less than
-+ * 'length' - which may happen if ISC_ENTROPY_PARTIAL was used - then the
-+ * number of bytes copied will be stored in *returned.)
-  *
-- * Honor the request from the caller to only return good data, any data,
-- * etc.
-+ * Returns:
-+ * \li	ISC_R_SUCCESS on success
-+ * \li	ISC_R_NOENTROPY if entropy pool is empty
-+ * \li	other error codes are possible when a hook is in use
-  */
- 
- void
-@@ -307,13 +321,21 @@ isc_entropy_usebestsource(isc_entropy_t *ectx, isc_entropysource_t **source,
- void
- isc_entropy_usehook(isc_entropy_t *ectx, bool onoff);
- /*!<
-- * \brief Mark/unmark the given entropy structure as being hooked.
-+ * \brief Configure entropy context 'ectx' to use the hook function
-+ *
-+ * Sets the entropy context to call the hook function for random number
-+ * generation, if such a function has been configured via
-+ * isc_entropy_sethook(), whenever isc_entropy_getdata() is called.
-  */
- 
- void
- isc_entropy_sethook(isc_entropy_getdata_t myhook);
- /*!<
-- * \brief Set the getdata hook (e.g., for a crypto random generator).
-+ * \brief Set the hook function.
-+ *
-+ * The hook function is a global value: only one hook function
-+ * can be set in the system. Individual entropy contexts may be
-+ * configured to use it, or not, by calling isc_entropy_usehook().
-  */
- 
- ISC_LANG_ENDDECLS
-diff --git a/lib/isc/include/isc/random.h b/lib/isc/include/isc/random.h
-index f8aed34..17c551b 100644
---- a/lib/isc/include/isc/random.h
-+++ b/lib/isc/include/isc/random.h
-@@ -9,8 +9,6 @@
-  * information regarding copyright ownership.
-  */
- 
--/* $Id: random.h,v 1.20 2009/01/17 23:47:43 tbox Exp $ */
--
- #ifndef ISC_RANDOM_H
- #define ISC_RANDOM_H 1
- 
-@@ -21,13 +19,23 @@
- #include <isc/mutex.h>
- 
- /*! \file isc/random.h
-- * \brief Implements a random state pool which will let the caller return a
-- * series of possibly non-reproducible random values.
-+ * \brief Implements pseudo random number generators.
-+ *
-+ * Two pseudo-random number generators are implemented, in isc_random_*
-+ * and isc_rng_*. Neither one is very strong; they should not be used
-+ * in cryptography functions.
-+ *
-+ * isc_random_* is based on arc4random if it is available on the system.
-+ * Otherwise it is based on the posix srand() and rand() functions.
-+ * It is useful for jittering values a bit here and there, such as
-+ * timeouts, etc, but should not be relied upon to generate
-+ * unpredictable sequences (for example, when choosing transaction IDs).
-  *
-- * Note that the
-- * strength of these numbers is not all that high, and should not be
-- * used in cryptography functions.  It is useful for jittering values
-- * a bit here and there, such as timeouts, etc.
-+ * isc_rng_* is based on ChaCha20, and is seeded and stirred from the
-+ * system entropy source. It is stronger than isc_random_* and can
-+ * be used for generating unpredictable sequences. It is still not as
-+ * good as using system entropy directly (see entropy.h) and should not
-+ * be used for cryptographic functions such as key generation.
-  */
- 
- ISC_LANG_BEGINDECLS
-@@ -115,8 +123,8 @@ isc_rng_random(isc_rng_t *rngctx);
- uint16_t
- isc_rng_uniformrandom(isc_rng_t *rngctx, uint16_t upper_bound);
- /*%<
-- * Returns a uniformly distributed pseudo random 16-bit unsigned
-- * integer.
-+ * Returns a uniformly distributed pseudo-random 16-bit unsigned integer
-+ * less than 'upper_bound'.
-  */
- 
- ISC_LANG_ENDDECLS
-diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
-index 03890a3..7bad989 100644
---- a/lib/isccfg/namedconf.c
-+++ b/lib/isccfg/namedconf.c
-@@ -1109,7 +1109,7 @@ options_clauses[] = {
- 	{ "pid-file", &cfg_type_qstringornone, 0 },
- 	{ "port", &cfg_type_uint32, 0 },
- 	{ "querylog", &cfg_type_boolean, 0 },
--	{ "random-device", &cfg_type_qstring, 0 },
-+	{ "random-device", &cfg_type_qstringornone, 0 },
- 	{ "recursing-file", &cfg_type_qstring, 0 },
- 	{ "recursive-clients", &cfg_type_uint32, 0 },
- 	{ "reserved-sockets", &cfg_type_uint32, 0 },
--- 
-2.20.1
-
diff --git a/bind.spec b/bind.spec
index a525f1c..e96b5a3 100644
--- a/bind.spec
+++ b/bind.spec
@@ -143,22 +143,11 @@ Patch140:bind-9.11-rh1410433.patch
 Patch150:bind-9.11-engine-pkcs11.patch
 Patch153:bind-9.11-export-suffix.patch
 Patch154:bind-9.11-oot-manual.patch
-# FIXME: needs review. Should not be required
-#Patch156:bind-9.11-fips-code.patch
 Patch157:bind-9.11-fips-tests.patch
-# [RT #31459] commit 06a8051d2476fb526fe6960832209392c763a9af
-#Patch158:bind-9.11-rt31459.patch
-# [RT #46047] commit 24172bd2eeba91441ab1c65d2717b0692309244a ISC 4724
-#Patch159:bind-9.11-rt46047.patch
-# https://gitlab.isc.org/isc-projects/bind9/issues/819
 Patch164:bind-9.11-rh1666814.patch
-#Patch169:bind-9.11-feature-test-dlz.patch
 Patch170:bind-9.11-feature-test-named.patch
 Patch171:bind-9.11-tests-variants.patch
 Patch172:bind-9.11-tests-pkcs11.patch
-# Make sure jsonccp-devel does not interfere
-#Patch175:bind-9.11-fips-disable.patch
-#Patch176: bind-9.11-unit-dnstap-pkcs11.patch
 
 # SDB patches
 Patch11: bind-9.3.2b2-sdbsrc.patch
@@ -545,21 +534,11 @@ are used for building ISC DHCP.
 %patch153 -p1 -b .export_suffix
 %endif
 %patch154 -p1 -b .oot-man
-#%patch156 -p1 -b .fips-code
 %patch157 -p1 -b .fips-tests
-#%patch158 -p1 -b .rt31459
-#%patch159 -p1 -b .rt46047
-#%patch160 -p1 -b .rh1624100
-#%patch161 -p1 -b .host-idn-disable
-#%patch163 -p1 -b .rh1663318
 %patch164 -p1 -b .rh1666814
-#%patch169 -p1 -b .featuretest-dlz
 %patch170 -p1 -b .featuretest-named
 %patch171 -p1 -b .test-variant
 %patch172 -p1 -b .test-pkcs11
-#%patch174 -p1 -b .unit-timer
-#%patch175 -p1 -b .rh1709553
-#%patch176 -p1 -b .unit-dnstap
 
 %if %{with PKCS11}
 %patch135 -p1 -b .config-pkcs11

From 80d0367669fae192e5b7cdde317ef59bb3d24a54 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 27 Mar 2020 12:53:49 +0100
Subject: [PATCH 125/460] Remove GEOIP and EXPORT_LIBS

Most recent release is no longer able to statisfy export libs and geoip
legacy. Remove its support from GeoIP.
---
 bind-9.11-export-suffix.patch |  39 --------
 bind.spec                     | 175 +---------------------------------
 2 files changed, 1 insertion(+), 213 deletions(-)
 delete mode 100644 bind-9.11-export-suffix.patch

diff --git a/bind-9.11-export-suffix.patch b/bind-9.11-export-suffix.patch
deleted file mode 100644
index 8703747..0000000
--- a/bind-9.11-export-suffix.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-diff --git a/configure.ac b/configure.ac
-index c1bfd62..7c5ad51 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -5333,6 +5333,8 @@ AC_SUBST(BUILD_CPPFLAGS)
- AC_SUBST(BUILD_LDFLAGS)
- AC_SUBST(BUILD_LIBS)
- 
-+AC_SUBST(LIBDIR_SUFFIX)
-+
- #
- # Commands to run at the end of config.status.
- # Don't just put these into configure, it won't work right if somebody
-diff --git a/isc-config.sh.in b/isc-config.sh.in
-index b5e94ed..d2857e0 100644
---- a/isc-config.sh.in
-+++ b/isc-config.sh.in
-@@ -13,16 +13,17 @@ prefix=@prefix@
- exec_prefix=@exec_prefix@
- exec_prefix_set=
- includedir=@includedir@
-+libdir_suffix=@LIBDIR_SUFFIX@
- arch=$(uname -m)
- 
- case $arch in
- 	x86_64 | amd64 | sparc64 | s390x | ppc64)
--		libdir=/usr/lib64
--		sec_libdir=/usr/lib
-+		libdir=/usr/lib64${libdir_suffix}
-+		sec_libdir=/usr/lib${libdir_suffix}
- 		;;
- 	* )
--		libdir=/usr/lib
--		sec_libdir=/usr/lib64
-+		libdir=/usr/lib${libdir_suffix}
-+		sec_libdir=/usr/lib64${libdir_suffix}
- 		;;
- esac
- 
diff --git a/bind.spec b/bind.spec
index e96b5a3..b9a7e1e 100644
--- a/bind.spec
+++ b/bind.spec
@@ -29,8 +29,6 @@
 %bcond_with    GEOIP
 # New MaxMind GeoLite support
 %bcond_without GEOIP2
-# Support for builds without threads removed. DHCP no longer needs it anyway.
-%bcond_with    EXPORT_LIBS
 # Legacy GeoIP support
 %bcond_with    GEOIP
 # New MaxMind GeoLite support
@@ -141,7 +139,6 @@ Patch137:bind-9.10-use-of-strlcat.patch
 Patch140:bind-9.11-rh1410433.patch
 # Avoid conflicts with OpenSSL PKCS11 engine
 Patch150:bind-9.11-engine-pkcs11.patch
-Patch153:bind-9.11-export-suffix.patch
 Patch154:bind-9.11-oot-manual.patch
 Patch157:bind-9.11-fips-tests.patch
 Patch164:bind-9.11-rh1666814.patch
@@ -485,39 +482,6 @@ BuildArch: noarch
 %description -n python3-bind
 This package provides a module which allows commands to be sent to rndc directly from Python programs.
 
-%if %{with EXPORT_LIBS}
-%package export-libs
-Summary:   ISC libs for DHCP application
-%if 0%{?fedora} >= 1
-Obsoletes: bind99-libs < 9.9.11-4
-Provides:  bind99-libs = 9.9.11-4
-# This subpackage will not use shared license, but distribute its own
-%endif
-
-%description export-libs
-BIND (Berkeley Internet Name Domain) is an implementation of the DNS
-(Domain Name System) protocols. This package set contains only export
-version of BIND libraries, that are used for building ISC DHCP.
-
-%package export-devel
-Summary:  Header files and libraries needed for BIND export libraries
-Requires: %{name}-export-libs%{?_isa} = %{epoch}:%{version}-%{release}
-Requires: openssl-devel
-Requires: libcap-devel
-
-%if 0%{?fedora} >= 1
-Obsoletes: bind99-devel < 9.9.11-4
-# To prevent linking against wrong set of libraries,
-# do not coexist with bind99-devel
-Conflicts: bind99-devel
-%endif
-
-%description export-devel
-This package contains export version of the header files and libraries
-required for development with ISC BIND. These headers and libraries
-are used for building ISC DHCP.
-%endif
-
 %prep
 %{gpgverify} --keyring='%{SOURCE4}' --signature='%{SOURCE2}' --data='%{SOURCE0}'
 %setup -q -n %{name}-%{BINDVERSION}
@@ -530,9 +494,6 @@ are used for building ISC DHCP.
 %patch112 -p1 -b .rh645544
 %patch130 -p1 -b .libdb
 %patch140 -p1 -b .rh1410433
-%if %{with EXPORT_LIBS}
-%patch153 -p1 -b .export_suffix
-%endif
 %patch154 -p1 -b .oot-man
 %patch157 -p1 -b .fips-tests
 %patch164 -p1 -b .rh1666814
@@ -645,7 +606,7 @@ export LIBDIR_SUFFIX
   --with-geoip \
 %endif
 %if %{with GEOIP2}
-  --with-geoip2 \
+  --with-maxminddb \
 %endif
 %if %{with PKCS11}
   --enable-native-pkcs11 \
@@ -731,78 +692,6 @@ popd # build
 %unit_prepare_build build
 %systemtest_prepare_build build
 
-%if %{with EXPORT_LIBS}
-
-## Create export libs ##
-mkdir -p export-libs
-pushd export-libs
-LIBDIR_SUFFIX=%{_export_dir}
-export LIBDIR_SUFFIX
-## minimal subset of options to make clients aka dhcp working
-%{configure} \
-        --with-libtool \
-        --disable-static \
-        --disable-epoll \
-        --disable-kqueue \
-        --libdir=%{_libdir}%{_export_dir} \
-        --includedir=%{_includedir}%{_export_dir}/ \
-        --disable-threads \
-%if %{with GSSTSIG}
-        --with-gssapi=yes \
-        --disable-isc-spnego \
-%endif
-%if %{with UNITTEST}
-        --with-cmocka \
-%endif
-        --enable-fixed-rrset \
-        --disable-rpz-nsip \
-        --disable-rpz-nsdname \
-        --without-lmdb \
-        --without-libxml2 \
-        --without-libjson \
-        --without-zlib \
-        --without-dlopen \
-        --enable-full-report
-
-## We don't want to build other libs than -export twice
-## FIXME this should be in patch instead of SED'ing
-## but do we really like/want to patch generated files?
-
-
-sed -i \
--e '/^SUBDIRS =/s/.*/SUBDIRS = make lib/i' \
-Makefile
-
-sed -i -e \
-"/^SUBDIRS =/s/.*/SUBDIRS = %{bind_export_libs}/i" \
-lib/Makefile
-
-for lib in %{bind_export_libs}
-do
-        find .  -name Makefile -exec sed  "s/lib${lib}\./lib${lib}-export\./g" -i {} \;
-        sed -e "s/-l${lib}\([^[:alpha:]]\)/-l${lib}-export\1/g" \
-            -e "s/lib${lib}\./lib${lib}-export\./g" \
-            -i isc-export-config.sh
-done;
-
-make %{?_smp_mflags}
-popd
-
-# export library unit tests
-%unit_prepare_build export-libs
-# Test just compiled libraries
-for lib in %{bind_export_libs}
-do
-  sed -e "s,^\s*include(.*${lib}/.*,-- use &," \
-      -i export-libs/lib/Kyuafile
-done
-
-sed -e "/^\s*include(/ d" -e 's/^-- use //' \
-    -i export-libs/lib/Kyuafile
-
-## End of export libs
-%endif
-
 %check
 %if %{with PKCS11}
   # Tests require initialization of pkcs11 token
@@ -822,17 +711,6 @@ export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0"
     exit $e;
   fi;
   popd
-
-  %if %{with EXPORT_LIBS}
-    pushd export-libs
-    make unit
-    e=$?
-    if [ "$e" -ne 0 ]; then
-      echo "ERROR: this build of BIND export-libs failed 'make unit'. Aborting."
-      exit $e;
-    fi;
-    popd
-  %endif
 ## End of UNITTEST
 %endif
 
@@ -911,17 +789,6 @@ pushd build
 make DESTDIR=${RPM_BUILD_ROOT} install
 popd
 
-%if %{with EXPORT_LIBS}
-pushd export-libs
-make DESTDIR=${RPM_BUILD_ROOT} install
-mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/ld.so.conf.d
-echo "%{_libdir}/%{_export_dir}" > %{buildroot}%{_sysconfdir}/ld.so.conf.d/%{name}-export-%{_arch}.conf
-cp -fp config.h ${RPM_BUILD_ROOT}/%{_includedir}%{_export_dir}
-rm -rf ${RPM_BUILD_ROOT}/%{_includedir}%{_export_dir}/pkcs11/
-rm -f ${RPM_BUILD_ROOT}/%{_includedir}%{_export_dir}/pk11/{constants,internal,pk11,result}.h
-popd
-%endif
-
 # Remove unwanted files
 rm -f ${RPM_BUILD_ROOT}/etc/bind.keys
 
@@ -1163,14 +1030,6 @@ fi
 %ldconfig_scriptlets pkcs11-libs
 %endif
 
-%if %{with EXPORT_LIBS}
-%post export-libs -p /sbin/ldconfig
-%end
-
-%postun export-libs -p /sbin/ldconfig
-%end
-%endif
-
 # Fix permissions on existing device files on upgrade
 %define chroot_fix_devices() \
 if [ $1 -gt 1 ]; then \
@@ -1488,38 +1347,6 @@ fi;
 %{_libdir}/libisc-pkcs11.so
 %endif
 
-%if %{with EXPORT_LIBS}
-%files export-libs
-%dir %{_libdir}/%{_export_dir}
-%{_libdir}/%{_export_dir}/libdns-export.so.%{sover_dns}*
-%{_libdir}/%{_export_dir}/libirs-export.so.%{sover_irs}*
-%{_libdir}/%{_export_dir}/libisc-export.so.%{sover_isc}*
-%{_libdir}/%{_export_dir}/libisccfg-export.so.%{sover_isccfg}*
-%config(noreplace) %{_sysconfdir}/ld.so.conf.d/%{name}-export-%{_arch}.conf
-# This subpackage has to distribute its own license. Do not conflict with
-# other subpackages of different version
-%license COPYRIGHT
-
-%files export-devel
-%{_libdir}/%{_export_dir}/libdns-export.so
-%{_libdir}/%{_export_dir}/libirs-export.so
-%{_libdir}/%{_export_dir}/libisc-export.so
-%{_libdir}/%{_export_dir}/libisccfg-export.so
-%dir %{_includedir}/%{_export_dir}
-%{_includedir}/%{_export_dir}/dns
-%{_includedir}/%{_export_dir}/dst
-%{_includedir}/%{_export_dir}/irs
-%{_includedir}/%{_export_dir}/isc
-%dir %{_includedir}/%{_export_dir}/pk11
-%{_includedir}/%{_export_dir}/pk11/site.h
-%{_includedir}/%{_export_dir}/isccfg
-%{_includedir}/%{_export_dir}/config.h
-%{_mandir}/man1/isc-export-config.sh.1*
-%{_mandir}/man1/bind9-export-config.1*
-%attr(0755,root,root) %{_bindir}/isc-export-config.sh
-%{_bindir}/bind9-export-config
-%endif
-
 %if %{with DLZ} && %{with BDB}
 %files dlz-bdb
 %if %{with SDB}

From 15cfc8b4024d11bb292f1fea0774afb24dddf544 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 27 Mar 2020 13:25:10 +0100
Subject: [PATCH 126/460] Disable GEOIP and compile on s390x without SDB

---
 bind.spec | 22 ++++++----------------
 1 file changed, 6 insertions(+), 16 deletions(-)

diff --git a/bind.spec b/bind.spec
index b9a7e1e..aa3ca96 100644
--- a/bind.spec
+++ b/bind.spec
@@ -25,12 +25,6 @@
 %bcond_with    BDB
 # skip DLZ for now
 %bcond_with DLZ
-# Legacy GeoIP support
-%bcond_with    GEOIP
-# New MaxMind GeoLite support
-%bcond_without GEOIP2
-# Legacy GeoIP support
-%bcond_with    GEOIP
 # New MaxMind GeoLite support
 %bcond_without GEOIP2
 %if 0%{?fedora} >= 28
@@ -212,9 +206,6 @@ BuildRequires:  lmdb-devel
 %if %{with JSON}
 BuildRequires:  json-c-devel
 %endif
-%if %{with GEOIP}
-BuildRequires:  GeoIP-devel
-%endif
 %if %{with GEOIP2}
 BuildRequires:  libmaxminddb-devel
 %endif
@@ -383,9 +374,6 @@ Requires:  json-c-devel%{?_isa}
 %if %{with DNSTAP}
 Requires:  fstrm-devel%{?_isa} protobuf-c-devel%{?_isa}
 %endif
-%if %{with GEOIP}
-Requires:  GeoIP-devel%{?_isa}
-%endif
 %if %{with GEOIP2}
 Requires:  libmaxminddb-devel%{?_isa}
 %endif
@@ -545,9 +533,14 @@ cp -fp contrib/sdb/sqlite/zone2sqlite.c bin/sdb_tools
 
 # Sparc and s390 arches need to use -fPIE
 %ifarch sparcv9 sparc64 s390 s390x
-for i in bin/named{,-sdb}/{,unix}/Makefile.in; do
+for i in bin/named/{,unix}/Makefile.in; do
   sed -i 's|fpie|fPIE|g' $i
 done
+%if %{with SDB}
+for i in bin/named-sdb/{,unix}/Makefile.in; do
+  sed -i 's|fpie|fPIE|g' $i
+done
+%endif
 %endif
 :;
 
@@ -602,9 +595,6 @@ export LIBDIR_SUFFIX
   --includedir=%{_includedir}/bind9 \
   --with-tuning=large \
   --with-libidn2 \
-%if %{with GEOIP}
-  --with-geoip \
-%endif
 %if %{with GEOIP2}
   --with-maxminddb \
 %endif

From fcefdeb1292175c93755ab05233688e4d52d700d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 27 Mar 2020 16:06:37 +0100
Subject: [PATCH 127/460] Disable SDB and its patches, enable DLZ

SDB is no longer part of bind distribution. Do not try to compile static
linked version named-sdb. But DLZ modules work, enable them without
tools.
---
 bind-9.3.2b2-sdbsrc.patch | 230 --------------------------------------
 bind-96-old-api.patch     |  23 ----
 bind.spec                 |   8 +-
 3 files changed, 2 insertions(+), 259 deletions(-)
 delete mode 100644 bind-9.3.2b2-sdbsrc.patch
 delete mode 100644 bind-96-old-api.patch

diff --git a/bind-9.3.2b2-sdbsrc.patch b/bind-9.3.2b2-sdbsrc.patch
deleted file mode 100644
index 46e183c..0000000
--- a/bind-9.3.2b2-sdbsrc.patch
+++ /dev/null
@@ -1,230 +0,0 @@
-diff --git a/contrib/sdb/bdb/bdb.c b/contrib/sdb/bdb/bdb.c
-index 23594bb..b3c6619 100644
---- a/contrib/sdb/bdb/bdb.c
-+++ b/contrib/sdb/bdb/bdb.c
-@@ -43,7 +43,7 @@
- #include <dns/lib.h>
- #include <dns/ttl.h>
- 
--#include <named/bdb.h>
-+#include "bdb.h"
- #include <named/globals.h>
- #include <named/config.h>
- 
-diff --git a/contrib/sdb/ldap/zone2ldap.c b/contrib/sdb/ldap/zone2ldap.c
-index 07c89bc..23dd873 100644
---- a/contrib/sdb/ldap/zone2ldap.c
-+++ b/contrib/sdb/ldap/zone2ldap.c
-@@ -63,16 +63,16 @@ typedef struct LDAP_INFO
- ldap_info;
- 
- /* usage Info */
--void usage ();
-+void usage (void);
- 
- /* Add to the ldap dit */
- void add_ldap_values (ldap_info * ldinfo);
- 
- /* Init an ldap connection */
--void init_ldap_conn ();
-+void init_ldap_conn (void);
- 
- /* Ldap error checking */
--void ldap_result_check (char *msg, char *dn, int err);
-+void ldap_result_check (const char *msg, char *dn, int err);
- 
- /* Put a hostname into a char ** array */
- char **hostname_to_dn_list (char *hostname, char *zone, unsigned int flags);
-@@ -88,7 +88,7 @@ void add_to_rr_list (char *dn, char *name, char *type, char *data,
- 		     unsigned int ttl, unsigned int flags);
- 
- /* Error checking */
--void isc_result_check (isc_result_t res, char *errorstr);
-+void isc_result_check (isc_result_t res, const char *errorstr);
- 
- /* Generate LDIF Format files */
- void generate_ldap (dns_name_t * dnsname, dns_rdata_t * rdata,
-@@ -97,11 +97,17 @@ void generate_ldap (dns_name_t * dnsname, dns_rdata_t * rdata,
- /* head pointer to the list */
- ldap_info *ldap_info_base = NULL;
- 
-+ldap_info *
-+locate_by_dn (char *dn);
-+void
-+init_ldap_conn ();
-+void usage();
-+
- char *argzone, *ldapbase, *binddn, *bindpw = NULL;
--char *ldapsystem = "localhost";
--static char *objectClasses[] =
-+const char *ldapsystem = "localhost";
-+static const char *objectClasses[] =
-   { "top", "dNSZone", NULL };
--static char *topObjectClasses[] = { "top", NULL };
-+static const char *topObjectClasses[] = { "top", NULL };
- LDAP *conn;
- unsigned int debug = 0;
- 
-@@ -128,7 +134,7 @@ main (int argc, char **argv)
-   LDAPMod *base_attrs[2];
-   LDAPMod base;
-   isc_buffer_t buff;
--  char *zonefile;
-+  char *zonefile=0L;
-   char fullbasedn[1024];
-   char *ctmp;
-   dns_fixedname_t fixedzone, fixedname;
-@@ -304,9 +310,9 @@ main (int argc, char **argv)
- 	  if ((*ctmp == ',') || (ctmp == &basedn[0]))
- 	    {
- 	      base.mod_op = LDAP_MOD_ADD;
--	      base.mod_type = "objectClass";
--	      base.mod_values = topObjectClasses;
--	      base_attrs[0] = &base;
-+	      base.mod_type = (char*)"objectClass";
-+	      base.mod_values = (char**)topObjectClasses;
-+	      base_attrs[0] = (void*)&base;
- 	      base_attrs[1] = NULL;
- 
- 	      if (ldapbase)
-@@ -363,7 +369,7 @@ main (int argc, char **argv)
-  * I should probably rename this function, as not to cause any
-  * confusion with the isc* routines. Will exit on error. */
- void
--isc_result_check (isc_result_t res, char *errorstr)
-+isc_result_check (isc_result_t res, const char *errorstr)
- {
-   if (res != ISC_R_SUCCESS)
-     {
-@@ -470,20 +476,20 @@ add_to_rr_list (char *dn, char *name, char *type,
-       if (tmp->attrs == (LDAPMod **) NULL)
- 	fatal("calloc");
- 
--      for (i = 0; i < flags; i++)
-+      for (i = 0; i < (int)flags; i++)
- 	{
- 	  tmp->attrs[i] = (LDAPMod *) malloc (sizeof (LDAPMod));
- 	  if (tmp->attrs[i] == (LDAPMod *) NULL)
- 	    fatal("malloc");
- 	}
-       tmp->attrs[0]->mod_op = LDAP_MOD_ADD;
--      tmp->attrs[0]->mod_type = "objectClass";
-+      tmp->attrs[0]->mod_type = (char*)"objectClass";
- 
-       if (flags == DNS_OBJECT)
--	tmp->attrs[0]->mod_values = objectClasses;
-+	tmp->attrs[0]->mod_values = (char**)objectClasses;
-       else
- 	{
--	  tmp->attrs[0]->mod_values = topObjectClasses;
-+	  tmp->attrs[0]->mod_values = (char**)topObjectClasses;
- 	  tmp->attrs[1] = NULL;
- 	  tmp->attrcnt = 2;
- 	  tmp->next = ldap_info_base;
-@@ -492,7 +498,7 @@ add_to_rr_list (char *dn, char *name, char *type,
- 	}
- 
-       tmp->attrs[1]->mod_op = LDAP_MOD_ADD;
--      tmp->attrs[1]->mod_type = "relativeDomainName";
-+      tmp->attrs[1]->mod_type = (char*)"relativeDomainName";
-       tmp->attrs[1]->mod_values = (char **) calloc (sizeof (char *), 2);
- 
-       if (tmp->attrs[1]->mod_values == (char **)NULL)
-@@ -521,7 +527,7 @@ add_to_rr_list (char *dn, char *name, char *type,
- 	 fatal("strdup");
- 
-       tmp->attrs[3]->mod_op = LDAP_MOD_ADD;
--      tmp->attrs[3]->mod_type = "dNSTTL";
-+      tmp->attrs[3]->mod_type = (char*)"dNSTTL";
-       tmp->attrs[3]->mod_values = (char **) calloc (sizeof (char *), 2);
- 
-       if (tmp->attrs[3]->mod_values == (char **)NULL)
-@@ -535,7 +541,7 @@ add_to_rr_list (char *dn, char *name, char *type,
- 	 fatal("strdup");
- 
-       tmp->attrs[4]->mod_op = LDAP_MOD_ADD;
--      tmp->attrs[4]->mod_type = "zoneName";
-+      tmp->attrs[4]->mod_type = (char*)"zoneName";
-       tmp->attrs[4]->mod_values = (char **)calloc(sizeof(char *), 2);
- 
-       if (tmp->attrs[4]->mod_values == (char **)NULL)
-@@ -648,7 +654,7 @@ hostname_to_dn_list (char *hostname, char *zone, unsigned int flags)
- 	  zname = ++tmp;
- 	}
-       else
--	hnamebuff = "@";
-+	hnamebuff = (char*)"@";
-     }
-   else
-     {
-@@ -727,12 +733,12 @@ init_ldap_conn ()
-     }
- 
-   result = ldap_simple_bind_s (conn, binddn, bindpw);
--  ldap_result_check ("ldap_simple_bind_s", "LDAP Bind", result);
-+  ldap_result_check ("ldap_simple_bind_s", (char*)"LDAP Bind", result);
- }
- 
- /* Like isc_result_check, only for LDAP */
- void
--ldap_result_check (char *msg, char *dn, int err)
-+ldap_result_check (const char *msg, char *dn, int err)
- {
-   if ((err != LDAP_SUCCESS) && (err != LDAP_ALREADY_EXISTS))
-     {
-diff --git a/contrib/sdb/pgsql/pgsqldb.c b/contrib/sdb/pgsql/pgsqldb.c
-index 50d3cba..516eb9f 100644
---- a/contrib/sdb/pgsql/pgsqldb.c
-+++ b/contrib/sdb/pgsql/pgsqldb.c
-@@ -23,7 +23,7 @@
- #include <string.h>
- #include <stdlib.h>
- 
--#include <pgsql/libpq-fe.h>
-+#include <libpq-fe.h>
- 
- #include <isc/mem.h>
- #include <isc/print.h>
-diff --git a/contrib/sdb/pgsql/zonetodb.c b/contrib/sdb/pgsql/zonetodb.c
-index b8f5912..ff2d135 100644
---- a/contrib/sdb/pgsql/zonetodb.c
-+++ b/contrib/sdb/pgsql/zonetodb.c
-@@ -37,7 +37,7 @@
- #include <dns/rdatatype.h>
- #include <dns/result.h>
- 
--#include <pgsql/libpq-fe.h>
-+#include <libpq-fe.h>
- 
- /*
-  * Generate a PostgreSQL table from a zone.
-@@ -54,6 +54,9 @@ char *dbname, *dbtable;
- char str[10240];
- 
- void
-+closeandexit(int status);
-+
-+void
- closeandexit(int status) {
- 	if (conn != NULL)
- 		PQfinish(conn);
-@@ -61,6 +64,9 @@ closeandexit(int status) {
- }
- 
- void
-+check_result(isc_result_t result, const char *message);
-+
-+void
- check_result(isc_result_t result, const char *message) {
- 	if (result != ISC_R_SUCCESS) {
- 		fprintf(stderr, "%s: %s\n", message,
-@@ -84,7 +90,8 @@ quotestring(const unsigned char *source, unsigned char *dest) {
- 	}
- 	*dest++ = 0;
- }
--
-+void
-+addrdata(dns_name_t *name, dns_ttl_t ttl, dns_rdata_t *rdata);
- void
- addrdata(dns_name_t *name, dns_ttl_t ttl, dns_rdata_t *rdata) {
- 	unsigned char namearray[DNS_NAME_MAXTEXT + 1];
diff --git a/bind-96-old-api.patch b/bind-96-old-api.patch
deleted file mode 100644
index d181d3e..0000000
--- a/bind-96-old-api.patch
+++ /dev/null
@@ -1,23 +0,0 @@
-diff -up bind-9.6.0b1/contrib/sdb/ldap/ldapdb.c.old-api bind-9.6.0b1/contrib/sdb/ldap/ldapdb.c
---- bind-9.6.0b1/contrib/sdb/ldap/ldapdb.c.old-api	2008-11-24 13:28:13.000000000 +0100
-+++ bind-9.6.0b1/contrib/sdb/ldap/ldapdb.c	2008-11-24 13:28:23.000000000 +0100
-@@ -25,6 +25,7 @@
- /* Using LDAPv3 by default, change this if you want v2 */
- #ifndef LDAPDB_LDAP_VERSION
- #define LDAPDB_LDAP_VERSION 3
-+#define LDAP_DEPRECATED 1
- #endif
- 
- #include <config.h>
-diff -up bind-9.6.0b1/contrib/sdb/ldap/zone2ldap.c.old-api bind-9.6.0b1/contrib/sdb/ldap/zone2ldap.c
---- bind-9.6.0b1/contrib/sdb/ldap/zone2ldap.c.old-api	2008-11-24 13:29:05.000000000 +0100
-+++ bind-9.6.0b1/contrib/sdb/ldap/zone2ldap.c	2008-11-24 13:29:14.000000000 +0100
-@@ -13,6 +13,8 @@
-  * ditched dNSDomain2 schema support. Version 0.3-ALPHA
-  */
- 
-+#define LDAP_DEPRECATED 1
-+
- #include <errno.h>
- #include <string.h>
- #include <stdlib.h>
diff --git a/bind.spec b/bind.spec
index aa3ca96..941eb4b 100644
--- a/bind.spec
+++ b/bind.spec
@@ -24,7 +24,7 @@
 # TODO: mysql is not well suported without SDB.
 %bcond_with    BDB
 # skip DLZ for now
-%bcond_with DLZ
+%bcond_without DLZ
 # New MaxMind GeoLite support
 %bcond_without GEOIP2
 %if 0%{?fedora} >= 28
@@ -115,7 +115,6 @@ Source49: named-chroot.files
 Patch10: bind-9.5-PIE.patch
 Patch16: bind-9.3.2-redhat_doc.patch
 Patch72: bind-9.5-dlz-64bit.patch
-Patch101:bind-96-old-api.patch
 Patch106:bind93-rh490837.patch
 Patch112:bind97-rh645544.patch
 Patch130:bind-9.9.1-P2-dlz-libdb.patch
@@ -141,7 +140,6 @@ Patch171:bind-9.11-tests-variants.patch
 Patch172:bind-9.11-tests-pkcs11.patch
 
 # SDB patches
-Patch11: bind-9.3.2b2-sdbsrc.patch
 Patch12: bind-9.10-sdb.patch
 
 # needs inpection
@@ -501,10 +499,8 @@ cp -r lib/ns{,-pkcs11}
 %endif
 
 %if %{with SDB}
-%patch101 -p1 -b .old-api
 mkdir bin/named-sdb
 cp -r bin/named/* bin/named-sdb
-%patch11 -p1 -b .sdbsrc
 # SDB ldap
 cp -fp contrib/sdb/ldap/ldapdb.[ch] bin/named-sdb
 # SDB postgreSQL
@@ -602,8 +598,8 @@ export LIBDIR_SUFFIX
   --enable-native-pkcs11 \
   --with-pkcs11=%{_libdir}/pkcs11/libsofthsm2.so \
 %endif
-%if %{with SDB}
   --with-dlopen=yes \
+%if %{with SDB} || %{with DLZ}
   --with-dlz-ldap=yes \
   --with-dlz-postgres=yes \
   --with-dlz-mysql=yes \

From c223e3e275f27830606b126693647dd2db5d623e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 31 Mar 2020 20:16:14 +0200
Subject: [PATCH 128/460] Update to 9.11.17

Updated a bit SDB related patches.
---
 .gitignore                      |   2 +
 bind-9.10-sdb.patch             |  18 +--
 bind-9.11-oot-gen.patch         |  47 -------
 bind-9.11-rh1736762-6.patch     | 159 -----------------------
 bind-9.11-rh1736762-7.patch     |  77 -----------
 bind-9.11-rh1736762-8.patch     |  38 ------
 bind-9.11-rt31459.patch         |  86 ++++++-------
 bind-9.11-rt46047.patch         |  96 +++++++-------
 bind-9.11-serve-stale.patch     | 153 +++++++++++-----------
 bind-9.3.2b1-fix_sdb_ldap.patch | 222 +++++++++++++++-----------------
 bind.spec                       |  19 +--
 sources                         |   4 +-
 12 files changed, 290 insertions(+), 631 deletions(-)
 delete mode 100644 bind-9.11-oot-gen.patch
 delete mode 100644 bind-9.11-rh1736762-6.patch
 delete mode 100644 bind-9.11-rh1736762-7.patch
 delete mode 100644 bind-9.11-rh1736762-8.patch

diff --git a/.gitignore b/.gitignore
index d72777d..621325c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -102,3 +102,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.11.13.tar.gz.asc
 /bind-9.11.14.tar.gz
 /bind-9.11.14.tar.gz.asc
+/bind-9.11.17.tar.gz
+/bind-9.11.17.tar.gz.asc
diff --git a/bind-9.10-sdb.patch b/bind-9.10-sdb.patch
index ef9a8dc..5c4987f 100644
--- a/bind-9.10-sdb.patch
+++ b/bind-9.10-sdb.patch
@@ -88,10 +88,10 @@ index 4cfed4d..c6b42b2 100644
  @DLZ_DRIVER_RULES@
  
 diff --git a/bin/named-sdb/main.c b/bin/named-sdb/main.c
-index 108b8d6..a943421 100644
+index c9fc3cc..148ebb3 100644
 --- a/bin/named-sdb/main.c
 +++ b/bin/named-sdb/main.c
-@@ -93,6 +93,10 @@
+@@ -97,6 +97,10 @@
   * Include header files for database drivers here.
   */
  /* #include "xxdb.h" */
@@ -102,7 +102,7 @@ index 108b8d6..a943421 100644
  
  #ifdef CONTRIB_DLZ
  /*
-@@ -1069,6 +1073,11 @@ setup(void) {
+@@ -1134,6 +1138,11 @@ setup(void) {
  		ns_main_earlyfatal("isc_app_start() failed: %s",
  				   isc_result_totext(result));
  
@@ -114,7 +114,7 @@ index 108b8d6..a943421 100644
  	isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
  		      ISC_LOG_NOTICE, "starting %s %s%s%s <id:%s>",
  		      ns_g_product, ns_g_version,
-@@ -1269,6 +1278,75 @@ setup(void) {
+@@ -1334,6 +1343,75 @@ setup(void) {
  				   isc_result_totext(result));
  #endif
  
@@ -190,7 +190,7 @@ index 108b8d6..a943421 100644
  	ns_server_create(ns_g_mctx, &ns_g_server);
  
  #ifdef HAVE_LIBSECCOMP
-@@ -1311,6 +1389,11 @@ cleanup(void) {
+@@ -1376,6 +1454,11 @@ cleanup(void) {
  
  	dns_name_destroy();
  
@@ -297,10 +297,10 @@ index c7e0868..95ab742 100644
 +	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zone2sqlite@EXEEXT@ ${DESTDIR}${sbindir}
  	${INSTALL_DATA} ${srcdir}/zone2ldap.1 ${DESTDIR}${mandir}/man1/zone2ldap.1
 diff --git a/configure.ac b/configure.ac
-index f6380b1..318e533 100644
+index f85f45f..7d28c52 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -5416,6 +5416,8 @@ AC_CONFIG_FILES([
+@@ -5400,6 +5400,8 @@ AC_CONFIG_FILES([
  	bin/named/unix/Makefile
  	bin/named-pkcs11/Makefile
  	bin/named-pkcs11/unix/Makefile
@@ -309,9 +309,9 @@ index f6380b1..318e533 100644
  	bin/nsupdate/Makefile
  	bin/pkcs11/Makefile
  	bin/python/Makefile
-@@ -5440,6 +5442,7 @@ AC_CONFIG_FILES([
- 	bin/python/isc/tests/dnskey_test.py
+@@ -5424,6 +5426,7 @@ AC_CONFIG_FILES([
  	bin/python/isc/tests/policy_test.py
+ 	bin/python/isc/utils.py
  	bin/rndc/Makefile
 +	bin/sdb_tools/Makefile
  	bin/tests/Makefile
diff --git a/bind-9.11-oot-gen.patch b/bind-9.11-oot-gen.patch
deleted file mode 100644
index 9a7f991..0000000
--- a/bind-9.11-oot-gen.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From cb654ddde5953cab9dfde7173ea1ed14b51c3727 Mon Sep 17 00:00:00 2001
-From: Mark Andrews <marka@isc.org>
-Date: Sun, 22 Dec 2019 21:51:21 +0000
-Subject: [PATCH] Merge branch
- '1530-lib-dns-gen-c-29-26-fatal-error-isc-platform-h-no-such-file-or-directory-v9_11'
- into 'v9_11'
-
-Resolve "lib/dns/gen.c:29:26: fatal error: isc/platform.h: No such file or directory"
-
-See merge request isc-projects/bind9!2794
-
-(cherry picked from commit 335ab375d6a0227fb362722acad22f2a5b75d8b7)
----
- lib/dns/gen.c | 10 +++++-----
- 1 file changed, 5 insertions(+), 5 deletions(-)
-
-diff --git a/lib/dns/gen.c b/lib/dns/gen.c
-index 81bc7ada1d..5fbdc3bfd3 100644
---- a/lib/dns/gen.c
-+++ b/lib/dns/gen.c
-@@ -26,18 +26,18 @@
- 
- #include <sys/types.h>
- 
--#include <isc/platform.h>
--
- #include <ctype.h>
-+#include <errno.h>
- #include <limits.h>
- #include <stdint.h>
--#include <stdlib.h>
- #include <stdio.h>
- #include <stdlib.h>
- #include <string.h>
- #include <time.h>
--#include <errno.h>
--#include <limits.h>
-+
-+#ifndef PATH_MAX
-+#define PATH_MAX 1024
-+#endif
- 
- #ifdef WIN32
- #include "gen-win32.h"
--- 
-2.21.0
-
diff --git a/bind-9.11-rh1736762-6.patch b/bind-9.11-rh1736762-6.patch
deleted file mode 100644
index abc36f0..0000000
--- a/bind-9.11-rh1736762-6.patch
+++ /dev/null
@@ -1,159 +0,0 @@
-From 638561615c37e8eace986e268811335c12d1b6a1 Mon Sep 17 00:00:00 2001
-From: Mark Andrews <marka@isc.org>
-Date: Thu, 12 Dec 2019 20:41:44 +1100
-Subject: [PATCH] give zspill its own lock
-
-(cherry picked from commit a52189e8e67a20097539fe3e6f7da4e4c01dc340)
----
- lib/dns/resolver.c | 45 +++++++++++++++++++++++++++++----------------
- 1 file changed, 29 insertions(+), 16 deletions(-)
-
-diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
-index 9f65c0596a..04367f82c6 100644
---- a/lib/dns/resolver.c
-+++ b/lib/dns/resolver.c
-@@ -460,20 +460,21 @@ struct dns_resolver {
- 	isc_mutex_t			lock;
- 	isc_mutex_t			nlock;
- 	isc_mutex_t			primelock;
-+	isc_mutex_t			zspill_lock;
- 	dns_rdataclass_t		rdclass;
- 	isc_socketmgr_t *		socketmgr;
- 	isc_timermgr_t *		timermgr;
- 	isc_taskmgr_t *			taskmgr;
- 	dns_view_t *			view;
--	bool			frozen;
-+	bool				frozen;
- 	unsigned int			options;
- 	dns_dispatchmgr_t *		dispatchmgr;
- 	dns_dispatchset_t *		dispatches4;
--	bool			exclusivev4;
-+	bool				exclusivev4;
- 	dns_dispatchset_t *		dispatches6;
- 	isc_dscp_t			querydscp4;
- 	isc_dscp_t			querydscp6;
--	bool			exclusivev6;
-+	bool				exclusivev6;
- 	unsigned int			nbuckets;
- 	fctxbucket_t *			buckets;
- 	zonebucket_t *			dbuckets;
-@@ -492,7 +493,7 @@ struct dns_resolver {
- 	unsigned int			spillatmax;
- 	unsigned int			spillatmin;
- 	isc_timer_t *			spillattimer;
--	bool			zero_no_soa_ttl;
-+	bool				zero_no_soa_ttl;
- 	unsigned int			query_timeout;
- 	unsigned int			maxdepth;
- 	unsigned int			maxqueries;
-@@ -502,14 +503,16 @@ struct dns_resolver {
- 	unsigned int			retryinterval; /* in milliseconds */
- 	unsigned int			nonbackofftries;
- 
-+	/* Locked by lock. */
-+	unsigned int			zspill;		/* fetches-per-zone */
-+
- 	/* Locked by lock. */
- 	unsigned int			references;
--	bool			exiting;
-+	bool				exiting;
- 	isc_eventlist_t			whenshutdown;
- 	unsigned int			activebuckets;
--	bool			priming;
-+	bool				priming;
- 	unsigned int			spillat;	/* clients-per-query */
--	unsigned int			zspill;		/* fetches-per-zone */
- 
- 	dns_badcache_t  * 		badcache;	 /* Bad cache. */
- 
-@@ -1257,7 +1260,7 @@ fcount_incr(fetchctx_t *fctx, bool force) {
- 	isc_result_t result = ISC_R_SUCCESS;
- 	zonebucket_t *dbucket;
- 	fctxcount_t *counter;
--	unsigned int bucketnum, spill;
-+	unsigned int bucketnum;
- 
- 	REQUIRE(fctx != NULL);
- 	REQUIRE(fctx->res != NULL);
-@@ -1266,10 +1269,6 @@ fcount_incr(fetchctx_t *fctx, bool force) {
- 	bucketnum = dns_name_fullhash(&fctx->domain, false)
- 			% RES_DOMAIN_BUCKETS;
- 
--	LOCK(&fctx->res->lock);
--	spill = fctx->res->zspill;
--	UNLOCK(&fctx->res->lock);
--
- 	dbucket = &fctx->res->dbuckets[bucketnum];
- 
- 	LOCK(&dbucket->lock);
-@@ -1297,6 +1296,12 @@ fcount_incr(fetchctx_t *fctx, bool force) {
- 			ISC_LIST_APPEND(dbucket->list, counter, link);
- 		}
- 	} else {
-+		unsigned int spill;
-+
-+		LOCK(&fctx->res->zspill_lock);
-+		spill = fctx->res->zspill;
-+		UNLOCK(&fctx->res->zspill_lock);
-+
- 		if (!force && spill != 0 && counter->count >= spill) {
- 			counter->dropped++;
- 			fcount_logspill(fctx, counter);
-@@ -8811,6 +8816,7 @@ destroy(dns_resolver_t *res) {
- 
- 	INSIST(res->nfctx == 0);
- 
-+	DESTROYLOCK(&res->zspill_lock);
- 	DESTROYLOCK(&res->primelock);
- 	DESTROYLOCK(&res->nlock);
- 	DESTROYLOCK(&res->lock);
-@@ -9089,10 +9095,14 @@ dns_resolver_create(dns_view_t *view,
- 	if (result != ISC_R_SUCCESS)
- 		goto cleanup_nlock;
- 
-+	result = isc_mutex_init(&res->zspill_lock);
-+	if (result != ISC_R_SUCCESS)
-+		goto cleanup_primelock;
-+
- 	task = NULL;
- 	result = isc_task_create(taskmgr, 0, &task);
- 	if (result != ISC_R_SUCCESS)
--		goto cleanup_primelock;
-+		goto cleanup_zspill_lock;
- 	isc_task_setname(task, "resolver_task", NULL);
- 
- 	result = isc_timer_create(timermgr, isc_timertype_inactive, NULL, NULL,
-@@ -9100,7 +9110,7 @@ dns_resolver_create(dns_view_t *view,
- 				  &res->spillattimer);
- 	isc_task_detach(&task);
- 	if (result != ISC_R_SUCCESS)
--		goto cleanup_primelock;
-+		goto cleanup_zspill_lock;
- 
- #if USE_ALGLOCK
- 	result = isc_rwlock_init(&res->alglock, 0, 0);
-@@ -9133,6 +9143,9 @@ dns_resolver_create(dns_view_t *view,
- 	isc_timer_detach(&res->spillattimer);
- #endif
- 
-+ cleanup_zspill_lock:
-+	DESTROYLOCK(&res->zspill_lock);
-+
-  cleanup_primelock:
- 	DESTROYLOCK(&res->primelock);
- 
-@@ -10275,9 +10288,9 @@ dns_resolver_setfetchesperzone(dns_resolver_t *resolver, uint32_t clients)
- {
- 	REQUIRE(VALID_RESOLVER(resolver));
- 
--	LOCK(&resolver->lock);
-+	LOCK(&resolver->zspill_lock);
- 	resolver->zspill = clients;
--	UNLOCK(&resolver->lock);
-+	UNLOCK(&resolver->zspill_lock);
- }
- 
- 
--- 
-2.21.0
-
diff --git a/bind-9.11-rh1736762-7.patch b/bind-9.11-rh1736762-7.patch
deleted file mode 100644
index 38617a2..0000000
--- a/bind-9.11-rh1736762-7.patch
+++ /dev/null
@@ -1,77 +0,0 @@
-From 23a6775f62deeee63e9f7927be387fecf23a8074 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
-Date: Tue, 10 Dec 2019 10:02:09 +0100
-Subject: [PATCH] Ensure all zone_settimer() calls are done on locked zone
-
-(cherry picked from commit cf48e8eb326f824170f2069e5d5c33992b1783a4)
-(cherry picked from commit 3bac7e98074643ff62582545e5840e4195517b07)
----
- lib/dns/zone.c | 9 +++++----
- 1 file changed, 5 insertions(+), 4 deletions(-)
-
-diff --git a/lib/dns/zone.c b/lib/dns/zone.c
-index e8cff77588..db837aae50 100644
---- a/lib/dns/zone.c
-+++ b/lib/dns/zone.c
-@@ -10291,7 +10291,9 @@ zone_maintenance(dns_zone_t *zone) {
- 	default:
- 		break;
- 	}
-+	LOCK_ZONE(zone);
- 	zone_settimer(zone, &now);
-+	UNLOCK_ZONE(zone);
- }
- 
- void
-@@ -13081,6 +13083,7 @@ zone_settimer(dns_zone_t *zone, isc_time_t *now) {
- 	isc_result_t result;
- 
- 	REQUIRE(DNS_ZONE_VALID(zone));
-+	REQUIRE(LOCKED_ZONE(zone));
- 	ENTER;
- 
- 	if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_EXITING))
-@@ -18405,6 +18408,7 @@ zone_rekey(dns_zone_t *zone) {
- 		UNLOCK_ZONE(zone);
- 	}
- 
-+	LOCK_ZONE(zone);
- 	isc_time_settoepoch(&zone->refreshkeytime);
- 
- 	/*
-@@ -18416,11 +18420,9 @@ zone_rekey(dns_zone_t *zone) {
- 		isc_time_t timethen;
- 		isc_stdtime_t then;
- 
--		LOCK_ZONE(zone);
- 		DNS_ZONE_TIME_ADD(&timenow, zone->refreshkeyinterval,
- 				  &timethen);
- 		zone->refreshkeytime = timethen;
--		UNLOCK_ZONE(zone);
- 
- 		for (key = ISC_LIST_HEAD(dnskeys);
- 		     key != NULL;
-@@ -18431,12 +18433,10 @@ zone_rekey(dns_zone_t *zone) {
- 				continue;
- 
- 			DNS_ZONE_TIME_ADD(&timenow, then - now, &timethen);
--			LOCK_ZONE(zone);
- 			if (isc_time_compare(&timethen,
- 					     &zone->refreshkeytime) < 0) {
- 				zone->refreshkeytime = timethen;
- 			}
--			UNLOCK_ZONE(zone);
- 		}
- 
- 		zone_settimer(zone, &timenow);
-@@ -18444,6 +18444,7 @@ zone_rekey(dns_zone_t *zone) {
- 		isc_time_formattimestamp(&zone->refreshkeytime, timebuf, 80);
- 		dns_zone_log(zone, ISC_LOG_INFO, "next key event: %s", timebuf);
- 	}
-+	UNLOCK_ZONE(zone);
- 
-  done:
- 	dns_diff_clear(&diff);
--- 
-2.21.0
-
diff --git a/bind-9.11-rh1736762-8.patch b/bind-9.11-rh1736762-8.patch
deleted file mode 100644
index f04a98a..0000000
--- a/bind-9.11-rh1736762-8.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From 7e844b093b0442bdc5cdc5aefd56fdc05f9be88f Mon Sep 17 00:00:00 2001
-From: Mark Andrews <marka@isc.org>
-Date: Thu, 12 Dec 2019 19:17:39 +1100
-Subject: [PATCH] acquire task lock before calling push_readyq for task->flags
- access
-
-(cherry picked from commit 7c94d2cd7dfaa3f04cd86ad9ed97e8366a774a4c)
----
- lib/isc/task.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/lib/isc/task.c b/lib/isc/task.c
-index 329604a465..f9c4354bd2 100644
---- a/lib/isc/task.c
-+++ b/lib/isc/task.c
-@@ -473,7 +473,9 @@ task_ready(isc__task_t *task) {
- 	XTRACE("task_ready");
- 
- 	LOCK(&manager->lock);
-+	LOCK(&task->lock);
- 	push_readyq(manager, task);
-+	UNLOCK(&task->lock);
- #ifdef USE_WORKER_THREADS
- 	if (manager->mode == isc_taskmgrmode_normal || has_privilege)
- 		SIGNAL(&manager->work_available);
-@@ -1263,7 +1265,9 @@ dispatch(isc__taskmgr_t *manager) {
- 				 * might even hurt rather than help.
- 				 */
- #ifdef USE_WORKER_THREADS
-+				LOCK(&task->lock);
- 				push_readyq(manager, task);
-+				UNLOCK(&task->lock);
- #else
- 				ENQUEUE(new_ready_tasks, task, ready_link);
- 				if ((task->flags & TASK_F_PRIVILEGED) != 0)
--- 
-2.21.0
-
diff --git a/bind-9.11-rt31459.patch b/bind-9.11-rt31459.patch
index efcc6fa..266f78c 100644
--- a/bind-9.11-rt31459.patch
+++ b/bind-9.11-rt31459.patch
@@ -1,4 +1,4 @@
-From e83a6723d84e4c4400ca646077393a24b092c623 Mon Sep 17 00:00:00 2001
+From 5c29299e43db5a4e6f8b1b07af84dfe1687c4c2b Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Tue, 12 Sep 2017 19:05:46 -0700
 Subject: [PATCH] rebased rt31459c
@@ -199,7 +199,7 @@ index 7afcaee..1cfa511 100644
  	if (verbose > 10)
  		isc_mem_stats(mctx, stdout);
 diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c
-index 71f5672..9b100ca 100644
+index 319a805..27ae4d4 100644
 --- a/bin/dnssec/dnssec-signzone.c
 +++ b/bin/dnssec/dnssec-signzone.c
 @@ -3460,14 +3460,15 @@ main(int argc, char *argv[]) {
@@ -257,7 +257,7 @@ index 4c293bf..3263cbc 100644
  
  	rdclass = strtoclass(classname);
 diff --git a/bin/dnssec/dnssectool.c b/bin/dnssec/dnssectool.c
-index 9d2a016..a9f90b6 100644
+index 618ec5b..5654435 100644
 --- a/bin/dnssec/dnssectool.c
 +++ b/bin/dnssec/dnssectool.c
 @@ -34,6 +34,7 @@
@@ -293,7 +293,7 @@ index 9d2a016..a9f90b6 100644
  					   usekeyboard);
  
 diff --git a/bin/named/server.c b/bin/named/server.c
-index 5a860e4..21c340c 100644
+index 4e503e5..f27071f 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
 @@ -36,6 +36,7 @@
@@ -688,7 +688,7 @@ index bf6dbb6..0416b21 100644
  	parse_args(false, argc, argv);
  	if (server == NULL)
 diff --git a/configure b/configure
-index aab472a..b686178 100755
+index 6d05371..33689c9 100755
 --- a/configure
 +++ b/configure
 @@ -640,6 +640,7 @@ ac_includes_default="\
@@ -699,7 +699,7 @@ index aab472a..b686178 100755
  BUILD_LIBS
  BUILD_LDFLAGS
  BUILD_CPPFLAGS
-@@ -821,6 +822,7 @@ XMLSTATS
+@@ -823,6 +824,7 @@ LIBXML2_CFLAGS
  NZDTARGETS
  NZDSRCS
  NZD_TOOLS
@@ -707,7 +707,7 @@ index aab472a..b686178 100755
  PKCS11_TEST
  PKCS11_ED25519
  PKCS11_GOST
-@@ -1045,6 +1047,7 @@ with_eddsa
+@@ -1047,6 +1049,7 @@ with_eddsa
  with_aes
  enable_openssl_hash
  with_cc_alg
@@ -715,7 +715,7 @@ index aab472a..b686178 100755
  with_lmdb
  with_libxml2
  with_libjson
-@@ -1745,6 +1748,7 @@ Optional Features:
+@@ -1749,6 +1752,7 @@ Optional Features:
    --enable-threads        enable multithreading
    --enable-native-pkcs11  use native PKCS11 for all crypto [default=no]
    --enable-openssl-hash   use OpenSSL for hash functions [default=no]
@@ -723,7 +723,7 @@ index aab472a..b686178 100755
    --enable-largefile      64-bit file support
    --enable-backtrace      log stack backtrace on abort [default=yes]
    --enable-symtable       use internal symbol table for backtrace
-@@ -17135,6 +17139,7 @@ case "$use_openssl" in
+@@ -17144,6 +17148,7 @@ case "$use_openssl" in
  $as_echo "disabled because of native PKCS11" >&6; }
  		DST_OPENSSL_INC=""
  		CRYPTO="-DPKCS11CRYPTO"
@@ -731,7 +731,7 @@ index aab472a..b686178 100755
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -17149,6 +17154,7 @@ $as_echo "disabled because of native PKCS11" >&6; }
+@@ -17158,6 +17163,7 @@ $as_echo "disabled because of native PKCS11" >&6; }
  $as_echo "no" >&6; }
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -739,7 +739,7 @@ index aab472a..b686178 100755
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -17161,6 +17167,7 @@ $as_echo "no" >&6; }
+@@ -17170,6 +17176,7 @@ $as_echo "no" >&6; }
  	auto)
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -747,7 +747,7 @@ index aab472a..b686178 100755
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -17170,7 +17177,7 @@ $as_echo "no" >&6; }
+@@ -17179,7 +17186,7 @@ $as_echo "no" >&6; }
  		OPENSSLLINKOBJS=""
  		OPENSSLLINKSRCS=""
  		as_fn_error $? "OpenSSL was not found in any of $openssldirs; use --with-openssl=/path
@@ -756,7 +756,7 @@ index aab472a..b686178 100755
  		;;
  	*)
  		if test "yes" = "$want_native_pkcs11"
-@@ -17201,6 +17208,7 @@ $as_echo "not found" >&6; }
+@@ -17210,6 +17217,7 @@ $as_echo "not found" >&6; }
  			as_fn_error $? "\"$use_openssl/include/openssl/opensslv.h\" not found" "$LINENO" 5
  		fi
  		CRYPTO='-DOPENSSL'
@@ -764,7 +764,7 @@ index aab472a..b686178 100755
  		if test "/usr" = "$use_openssl"
  		then
  			DST_OPENSSL_INC=""
-@@ -17826,8 +17834,6 @@ fi
+@@ -17835,8 +17843,6 @@ fi
  # Use OpenSSL for hash functions
  #
  
@@ -773,7 +773,7 @@ index aab472a..b686178 100755
  ISC_PLATFORM_OPENSSLHASH="#undef ISC_PLATFORM_OPENSSLHASH"
  case $want_openssl_hash in
  	yes)
-@@ -18202,6 +18208,86 @@ if test "rt" = "$have_clock_gt"; then
+@@ -18211,6 +18217,86 @@ if test "rt" = "$have_clock_gt"; then
  	LIBS="-lrt $LIBS"
  fi
  
@@ -860,7 +860,7 @@ index aab472a..b686178 100755
  #
  # was --with-lmdb specified?
  #
-@@ -20284,9 +20370,12 @@ _ACEOF
+@@ -20441,9 +20527,12 @@ _ACEOF
  if ac_fn_c_try_compile "$LINENO"; then :
    { $as_echo "$as_me:${as_lineno-$LINENO}: result: size_t for buflen; int for flags" >&5
  $as_echo "size_t for buflen; int for flags" >&6; }
@@ -875,7 +875,7 @@ index aab472a..b686178 100755
  
  	 $as_echo "#define IRS_GETNAMEINFO_FLAGS_T int" >>confdefs.h
  
-@@ -21601,12 +21690,7 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
+@@ -21758,12 +21847,7 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
  ISC_PLATFORM_USESTDASM="#undef ISC_PLATFORM_USESTDASM"
  ISC_PLATFORM_USEMACASM="#undef ISC_PLATFORM_USEMACASM"
  if test "yes" = "$use_atomic"; then
@@ -889,7 +889,7 @@ index aab472a..b686178 100755
  # version HP92453-01 B.11.11.23709.GP, which incorrectly rejects
  # declarations like `int a3[[(sizeof (unsigned char)) >= 0]];'.
  # This bug is HP SR number 8606223364.
-@@ -21639,6 +21723,11 @@ cat >>confdefs.h <<_ACEOF
+@@ -21796,6 +21880,11 @@ cat >>confdefs.h <<_ACEOF
  _ACEOF
  
  
@@ -901,7 +901,7 @@ index aab472a..b686178 100755
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -21647,39 +21736,6 @@ _ACEOF
+@@ -21804,39 +21893,6 @@ _ACEOF
  		fi
  	;;
  	x86_64-*|amd64-*)
@@ -941,7 +941,7 @@ index aab472a..b686178 100755
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -21710,6 +21766,10 @@ $as_echo_n "checking architecture type for atomic operations... " >&6; }
+@@ -21867,6 +21923,10 @@ $as_echo_n "checking architecture type for atomic operations... " >&6; }
  $as_echo "$arch" >&6; }
  fi
  
@@ -952,7 +952,7 @@ index aab472a..b686178 100755
  if test "yes" = "$have_atomic"; then
  	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking compiler support for inline assembly code" >&5
  $as_echo_n "checking compiler support for inline assembly code... " >&6; }
-@@ -24264,6 +24324,30 @@ CFLAGS="$CFLAGS $SO_CFLAGS"
+@@ -24421,6 +24481,30 @@ CFLAGS="$CFLAGS $SO_CFLAGS"
  #
  dlzdir='${DLZ_DRIVER_DIR}'
  
@@ -983,7 +983,7 @@ index aab472a..b686178 100755
  #
  # Private autoconf macro to simplify configuring drivers:
  #
-@@ -24594,11 +24678,11 @@ $as_echo "no" >&6; }
+@@ -24751,11 +24835,11 @@ $as_echo "no" >&6; }
  $as_echo "using mysql with libs ${mysql_lib} and includes ${mysql_include}" >&6; }
  		;;
  	*)
@@ -998,7 +998,7 @@ index aab472a..b686178 100755
  		fi
  
  	CONTRIB_DLZ="$CONTRIB_DLZ -DDLZ_MYSQL"
-@@ -24683,7 +24767,7 @@ $as_echo "" >&6; }
+@@ -24840,7 +24924,7 @@ $as_echo "" >&6; }
  			# Check other locations for includes.
  			# Order is important (sigh).
  
@@ -1007,7 +1007,7 @@ index aab472a..b686178 100755
  			# include a blank element first
  			for d in "" $bdb_incdirs
  			do
-@@ -24708,57 +24792,9 @@ $as_echo "" >&6; }
+@@ -24865,57 +24949,9 @@ $as_echo "" >&6; }
  			bdb_libnames="db53 db-5.3 db51 db-5.1 db48 db-4.8 db47 db-4.7 db46 db-4.6 db45 db-4.5 db44 db-4.4 db43 db-4.3 db42 db-4.2 db41 db-4.1 db"
  			for d in $bdb_libnames
  			do
@@ -1067,7 +1067,7 @@ index aab472a..b686178 100755
  					break
  				fi
  			done
-@@ -24917,10 +24953,10 @@ $as_echo "no" >&6; }
+@@ -25074,10 +25110,10 @@ $as_echo "no" >&6; }
  		DLZ_DRIVER_INCLUDES="$DLZ_DRIVER_INCLUDES -I$use_dlz_ldap/include"
  		DLZ_DRIVER_LDAP_INCLUDES="-I$use_dlz_ldap/include"
  	fi
@@ -1081,7 +1081,7 @@ index aab472a..b686178 100755
  	fi
  
  
-@@ -25006,11 +25042,11 @@ fi
+@@ -25163,11 +25199,11 @@ fi
  		odbcdirs="/usr /usr/local /usr/pkg"
  		for d in $odbcdirs
  		do
@@ -1095,7 +1095,7 @@ index aab472a..b686178 100755
  				break
  			fi
  		done
-@@ -25285,6 +25321,8 @@ DNS_CRYPTO_LIBS="$NEWFLAGS"
+@@ -25442,6 +25478,8 @@ DNS_CRYPTO_LIBS="$NEWFLAGS"
  
  
  
@@ -1104,7 +1104,7 @@ index aab472a..b686178 100755
  #
  # Commands to run at the end of config.status.
  # Don't just put these into configure, it won't work right if somebody
-@@ -27661,6 +27699,8 @@ report() {
+@@ -27819,6 +27857,8 @@ report() {
  	    echo "    IPv6 support (--enable-ipv6)"
  	test "X$CRYPTO" = "X" -o "yes" = "$want_native_pkcs11" || \
  		echo "    OpenSSL cryptography/DNSSEC (--with-openssl)"
@@ -1113,7 +1113,7 @@ index aab472a..b686178 100755
  	test "X$PYTHON" = "X" || echo "    Python tools (--with-python)"
  	test "X$XMLSTATS" = "X" || echo "    XML statistics (--with-libxml2)"
  	test "X$JSONSTATS" = "X" || echo "    JSON statistics (--with-libjson)"
-@@ -27701,6 +27741,8 @@ report() {
+@@ -27859,6 +27899,8 @@ report() {
  	echo "    Very verbose query trace logging (--enable-querytrace)"
      test "no" = "$with_cmocka" || echo "    CMocka Unit Testing Framework (--with-cmocka)"
  
@@ -1122,7 +1122,7 @@ index aab472a..b686178 100755
      echo "    Dynamically loadable zone (DLZ) drivers:"
      test "no" = "$use_dlz_bdb" || \
  	echo "        Berkeley DB (--with-dlz-bdb)"
-@@ -27748,6 +27790,8 @@ report() {
+@@ -27906,6 +27948,8 @@ report() {
  	echo "    ECDSA algorithm support (--with-ecdsa)"
      test "X$CRYPTO" = "X" -o "yes" = "$OPENSSL_ED25519" -o "yes" = "$PKCS11_ED25519" || \
  	echo "    EDDSA algorithm support (--with-eddsa)"
@@ -1132,7 +1132,7 @@ index aab472a..b686178 100755
      test "yes" = "$enable_seccomp" || \
  	echo "    Use libseccomp system call filtering (--enable-seccomp)"
 diff --git a/configure.ac b/configure.ac
-index 0e16cc8..dd0055d 100644
+index d10cde5..68bead8 100644
 --- a/configure.ac
 +++ b/configure.ac
 @@ -1550,6 +1550,7 @@ case "$use_openssl" in
@@ -1252,7 +1252,7 @@ index 0e16cc8..dd0055d 100644
  #
  # was --with-lmdb specified?
  #
-@@ -4118,12 +4182,12 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
+@@ -4098,12 +4162,12 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
  ISC_PLATFORM_USESTDASM="#undef ISC_PLATFORM_USESTDASM"
  ISC_PLATFORM_USEMACASM="#undef ISC_PLATFORM_USEMACASM"
  if test "yes" = "$use_atomic"; then
@@ -1266,7 +1266,7 @@ index 0e16cc8..dd0055d 100644
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -4132,7 +4196,6 @@ if test "yes" = "$use_atomic"; then
+@@ -4112,7 +4176,6 @@ if test "yes" = "$use_atomic"; then
  		fi
  	;;
  	x86_64-*|amd64-*)
@@ -1274,7 +1274,7 @@ index 0e16cc8..dd0055d 100644
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -5537,6 +5600,8 @@ report() {
+@@ -5518,6 +5581,8 @@ report() {
  	    echo "    IPv6 support (--enable-ipv6)"
  	test "X$CRYPTO" = "X" -o "yes" = "$want_native_pkcs11" || \
  		echo "    OpenSSL cryptography/DNSSEC (--with-openssl)"
@@ -1283,7 +1283,7 @@ index 0e16cc8..dd0055d 100644
  	test "X$PYTHON" = "X" || echo "    Python tools (--with-python)"
  	test "X$XMLSTATS" = "X" || echo "    XML statistics (--with-libxml2)"
  	test "X$JSONSTATS" = "X" || echo "    JSON statistics (--with-libjson)"
-@@ -5577,6 +5642,8 @@ report() {
+@@ -5558,6 +5623,8 @@ report() {
  	echo "    Very verbose query trace logging (--enable-querytrace)"
      test "no" = "$with_cmocka" || echo "    CMocka Unit Testing Framework (--with-cmocka)"
  
@@ -1292,7 +1292,7 @@ index 0e16cc8..dd0055d 100644
      echo "    Dynamically loadable zone (DLZ) drivers:"
      test "no" = "$use_dlz_bdb" || \
  	echo "        Berkeley DB (--with-dlz-bdb)"
-@@ -5624,6 +5691,8 @@ report() {
+@@ -5605,6 +5672,8 @@ report() {
  	echo "    ECDSA algorithm support (--with-ecdsa)"
      test "X$CRYPTO" = "X" -o "yes" = "$OPENSSL_ED25519" -o "yes" = "$PKCS11_ED25519" || \
  	echo "    EDDSA algorithm support (--with-eddsa)"
@@ -1863,7 +1863,7 @@ index 63be973..40b21fa 100644
  dst_region_computerid
  dst_result_register
 diff --git a/lib/isc/entropy.c b/lib/isc/entropy.c
-index ab2f617..ed05ed6 100644
+index 907e470..451544d 100644
 --- a/lib/isc/entropy.c
 +++ b/lib/isc/entropy.c
 @@ -104,11 +104,15 @@ struct isc_entropy {
@@ -1921,10 +1921,10 @@ index ab2f617..ed05ed6 100644
 +	hook = myhook;
 +}
 diff --git a/lib/isc/include/isc/entropy.h b/lib/isc/include/isc/entropy.h
-index 4bba8e1..632166a 100644
+index e8733db..c40a18c 100644
 --- a/lib/isc/include/isc/entropy.h
 +++ b/lib/isc/include/isc/entropy.h
-@@ -304,6 +304,18 @@ isc_entropy_usebestsource(isc_entropy_t *ectx, isc_entropysource_t **source,
+@@ -302,6 +302,18 @@ isc_entropy_usebestsource(isc_entropy_t *ectx, isc_entropysource_t **source,
   *	isc_entropy_createcallbacksource().
   */
  
@@ -1944,7 +1944,7 @@ index 4bba8e1..632166a 100644
  
  #endif /* ISC_ENTROPY_H */
 diff --git a/lib/isc/include/isc/platform.h.in b/lib/isc/include/isc/platform.h.in
-index 4192946..dbd1560 100644
+index 61960f1..d22993d 100644
 --- a/lib/isc/include/isc/platform.h.in
 +++ b/lib/isc/include/isc/platform.h.in
 @@ -359,6 +359,11 @@
@@ -2015,7 +2015,7 @@ index 8ade705..fa72f9d 100644
   * Define if the hash functions must be provided by OpenSSL.
   */
 diff --git a/win32utils/Configure b/win32utils/Configure
-index 953f2aa..55cc929 100644
+index 79d682e..6c78cb2 100644
 --- a/win32utils/Configure
 +++ b/win32utils/Configure
 @@ -382,6 +382,7 @@ my @substdefh = ("ALLOW_FILTER_AAAA",
@@ -2038,7 +2038,7 @@ index 953f2aa..55cc929 100644
                    "isc-spnego",
 @@ -580,6 +582,7 @@ my @help = (
  "\nOptional Features:\n",
- "  enable-intrinsics     enable instrinsic/atomic functions [default=yes]\n",
+ "  enable-intrinsics     enable intrinsic/atomic functions [default=yes]\n",
  "  enable-native-pkcs11  use native PKCS#11 for all crypto [default=no]\n",
 +"  enable-crypto-rand    use crypto provider for random [default=yes]\n",
  "  enable-openssl-hash   use OpenSSL for hash functions [default=yes]\n",
@@ -2118,5 +2118,5 @@ index 953f2aa..55cc929 100644
  #  --enable-openssl-hash supported
  #  --enable-threads included without a way to disable it
 -- 
-2.21.0
+2.21.1
 
diff --git a/bind-9.11-rt46047.patch b/bind-9.11-rt46047.patch
index 8f413f6..ee9bae8 100644
--- a/bind-9.11-rt46047.patch
+++ b/bind-9.11-rt46047.patch
@@ -1,4 +1,4 @@
-From 5a465424f5249ceaf0547ab90361a16eb08f7a2b Mon Sep 17 00:00:00 2001
+From 344c19ad4b3f058e65a4b41650bb0ee20692cc5c Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Thu, 28 Sep 2017 10:09:22 -0700
 Subject: [PATCH] completed and corrected the crypto-random change
@@ -39,15 +39,15 @@ Subject: [PATCH] completed and corrected the crypto-random change
  bin/tests/system/tkey/keycreate.c        |  4 +-
  bin/tests/system/tkey/keydelete.c        |  5 +--
  doc/arm/Bv9ARM-book.xml                  | 55 +++++++++++++++++-------
- doc/arm/notes-rh-changes.xml             | 43 ++++++++++++++++++
+ doc/arm/notes-rh-changes.xml             | 42 ++++++++++++++++++
  doc/arm/notes.xml                        |  1 +
  lib/dns/dst_api.c                        |  4 +-
  lib/dns/include/dst/dst.h                | 14 +++++-
  lib/dns/openssl_link.c                   |  3 +-
- lib/isc/include/isc/entropy.h            | 50 +++++++++++++++------
+ lib/isc/include/isc/entropy.h            | 48 +++++++++++++++------
  lib/isc/include/isc/random.h             | 28 +++++++-----
  lib/isccfg/namedconf.c                   |  2 +-
- 23 files changed, 241 insertions(+), 106 deletions(-)
+ 23 files changed, 240 insertions(+), 104 deletions(-)
  create mode 100644 doc/arm/notes-rh-changes.xml
 
 diff --git a/bin/confgen/keygen.c b/bin/confgen/keygen.c
@@ -78,10 +78,10 @@ index 295e16f..0f79aa8 100644
  							     &entropy_source,
  							     randomfile,
 diff --git a/bin/dnssec/dnssec-keygen.docbook b/bin/dnssec/dnssec-keygen.docbook
-index 0ae6b41..4562430 100644
+index 1826919..96543fc 100644
 --- a/bin/dnssec/dnssec-keygen.docbook
 +++ b/bin/dnssec/dnssec-keygen.docbook
-@@ -348,15 +348,23 @@
+@@ -349,15 +349,23 @@
  	<term>-r <replaceable class="parameter">randomdev</replaceable></term>
  	<listitem>
  	  <para>
@@ -114,7 +114,7 @@ index 0ae6b41..4562430 100644
  	</listitem>
        </varlistentry>
 diff --git a/bin/dnssec/dnssectool.c b/bin/dnssec/dnssectool.c
-index 31a99e7..38c83ed 100644
+index 5654435..24c0d5a 100644
 --- a/bin/dnssec/dnssectool.c
 +++ b/bin/dnssec/dnssectool.c
 @@ -241,18 +241,16 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
@@ -142,10 +142,10 @@ index 31a99e7..38c83ed 100644
  					   usekeyboard);
  
 diff --git a/bin/named/client.c b/bin/named/client.c
-index 50fa2cd..524d9a3 100644
+index 9a0d3c8..c573177 100644
 --- a/bin/named/client.c
 +++ b/bin/named/client.c
-@@ -1762,7 +1762,8 @@ ns_client_addopt(ns_client_t *client, dns_message_t *message,
+@@ -1765,7 +1765,8 @@ ns_client_addopt(ns_client_t *client, dns_message_t *message,
  
  		isc_buffer_init(&buf, cookie, sizeof(cookie));
  		isc_stdtime_get(&now);
@@ -223,7 +223,7 @@ index d955c2f..40621f2 100644
  	} else
  		eresult = ns_control_docommand(request, listener->readonly, &text);
 diff --git a/bin/named/include/named/server.h b/bin/named/include/named/server.h
-index 7ee8f66..8982d26 100644
+index 3f96b7b..c92922e 100644
 --- a/bin/named/include/named/server.h
 +++ b/bin/named/include/named/server.h
 @@ -20,6 +20,7 @@
@@ -255,7 +255,7 @@ index 9dea7c1..272d300 100644
  #include <isc/task.h>
  #include <isc/util.h>
 diff --git a/bin/named/query.c b/bin/named/query.c
-index c9e5469..0940714 100644
+index 203f1e6..25eeced 100644
 --- a/bin/named/query.c
 +++ b/bin/named/query.c
 @@ -19,6 +19,7 @@
@@ -267,10 +267,10 @@ index c9e5469..0940714 100644
  #include <isc/serial.h>
  #include <isc/stats.h>
 diff --git a/bin/named/server.c b/bin/named/server.c
-index 36fc047..3c1eec0 100644
+index f27071f..f132c19 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
-@@ -8208,21 +8208,32 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8210,21 +8210,32 @@ load_configuration(const char *filename, ns_server_t *server,
  	 * Open the source of entropy.
  	 */
  	if (first_time) {
@@ -312,7 +312,7 @@ index 36fc047..3c1eec0 100644
  #ifdef PATH_RANDOMDEV
  			if (ns_g_fallbackentropy != NULL) {
  				level = ISC_LOG_INFO;
-@@ -8233,8 +8244,8 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8235,8 +8246,8 @@ load_configuration(const char *filename, ns_server_t *server,
  					      NS_LOGCATEGORY_GENERAL,
  					      NS_LOGMODULE_SERVER,
  					      level,
@@ -323,7 +323,7 @@ index 36fc047..3c1eec0 100644
  					      randomdev,
  					      isc_result_totext(result));
  			}
-@@ -8254,7 +8265,6 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8256,7 +8267,6 @@ load_configuration(const char *filename, ns_server_t *server,
  				}
  				isc_entropy_detach(&ns_g_fallbackentropy);
  			}
@@ -331,7 +331,7 @@ index 36fc047..3c1eec0 100644
  #endif
  		}
  
-@@ -9022,6 +9032,7 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
+@@ -9025,6 +9035,7 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
  	server->in_roothints = NULL;
  	server->blackholeacl = NULL;
  	server->keepresporder = NULL;
@@ -339,7 +339,7 @@ index 36fc047..3c1eec0 100644
  
  	/* Must be first. */
  	CHECKFATAL(dst_lib_init2(ns_g_mctx, ns_g_entropy,
-@@ -9048,6 +9059,9 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
+@@ -9051,6 +9062,9 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
  	CHECKFATAL(dns_tkeyctx_create(ns_g_mctx, ns_g_entropy,
  				      &server->tkeyctx),
  		   "creating TKEY context");
@@ -349,7 +349,7 @@ index 36fc047..3c1eec0 100644
  
  	/*
  	 * Setup the server task, which is responsible for coordinating
-@@ -9254,7 +9268,8 @@ ns_server_destroy(ns_server_t **serverp) {
+@@ -9257,7 +9271,8 @@ ns_server_destroy(ns_server_t **serverp) {
  
  	if (server->zonemgr != NULL)
  		dns_zonemgr_detach(&server->zonemgr);
@@ -359,7 +359,7 @@ index 36fc047..3c1eec0 100644
  	if (server->tkeyctx != NULL)
  		dns_tkeyctx_destroy(&server->tkeyctx);
  
-@@ -13230,10 +13245,10 @@ newzone_cfgctx_destroy(void **cfgp) {
+@@ -13263,10 +13278,10 @@ newzone_cfgctx_destroy(void **cfgp) {
  
  static isc_result_t
  generate_salt(unsigned char *salt, size_t saltlen) {
@@ -372,7 +372,7 @@ index 36fc047..3c1eec0 100644
  	} rnd;
  	unsigned char text[512 + 1];
  	isc_region_t r;
-@@ -13243,9 +13258,10 @@ generate_salt(unsigned char *salt, size_t saltlen) {
+@@ -13276,9 +13291,10 @@ generate_salt(unsigned char *salt, size_t saltlen) {
  	if (saltlen > 256U)
  		return (ISC_R_RANGE);
  
@@ -455,10 +455,10 @@ index 2146f9b..64b8e74 100644
  	}
  #endif
 diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
-index 33e06e6..539973c 100644
+index 93c7a08..bb1e81d 100644
 --- a/doc/arm/Bv9ARM-book.xml
 +++ b/doc/arm/Bv9ARM-book.xml
-@@ -5076,22 +5076,45 @@ badresp:1,adberr:0,findfail:0,valfail:0]
+@@ -5081,22 +5081,45 @@ badresp:1,adberr:0,findfail:0,valfail:0]
  	    <term><command>random-device</command></term>
  	    <listitem>
  	      <para>
@@ -522,11 +522,10 @@ index 33e06e6..539973c 100644
  	  </varlistentry>
 diff --git a/doc/arm/notes-rh-changes.xml b/doc/arm/notes-rh-changes.xml
 new file mode 100644
-index 0000000..11c3a7c
+index 0000000..89a4961
 --- /dev/null
 +++ b/doc/arm/notes-rh-changes.xml
-@@ -0,0 +1,43 @@
-+
+@@ -0,0 +1,42 @@
 +<!--
 + - Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 + -
@@ -570,10 +569,10 @@ index 0000000..11c3a7c
 +</section>
 +
 diff --git a/doc/arm/notes.xml b/doc/arm/notes.xml
-index b16dab6..763ff7e 100644
+index 589a347..052a0bd 100644
 --- a/doc/arm/notes.xml
 +++ b/doc/arm/notes.xml
-@@ -36,6 +36,7 @@
+@@ -40,6 +40,7 @@
    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-9.11.1.xml"/>
    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-9.11.0.xml"/>
  
@@ -582,7 +581,7 @@ index b16dab6..763ff7e 100644
    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-thankyou.xml"/>
  </section>
 diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c
-index 1614afa..0f52df9 100644
+index 1eccbe7..1933993 100644
 --- a/lib/dns/dst_api.c
 +++ b/lib/dns/dst_api.c
 @@ -2017,10 +2017,12 @@ dst__entropy_getdata(void *buf, unsigned int len, bool pseudo) {
@@ -625,7 +624,7 @@ index 6813c96..665574d 100644
  
  bool
 diff --git a/lib/dns/openssl_link.c b/lib/dns/openssl_link.c
-index 6849732..e00a0e4 100644
+index ffe0a69..5e48686 100644
 --- a/lib/dns/openssl_link.c
 +++ b/lib/dns/openssl_link.c
 @@ -484,7 +484,8 @@ dst__openssl_getengine(const char *engine) {
@@ -639,19 +638,10 @@ index 6849732..e00a0e4 100644
  #ifndef DONT_REQUIRE_DST_LIB_INIT
  	INSIST(dst__memory_pool != NULL);
 diff --git a/lib/isc/include/isc/entropy.h b/lib/isc/include/isc/entropy.h
-index 632166a..c7cb17d 100644
+index c40a18c..c7cb17d 100644
 --- a/lib/isc/include/isc/entropy.h
 +++ b/lib/isc/include/isc/entropy.h
-@@ -9,8 +9,6 @@
-  * information regarding copyright ownership.
-  */
- 
--/* $Id: entropy.h,v 1.35 2009/10/19 02:37:08 marka Exp $ */
--
- #ifndef ISC_ENTROPY_H
- #define ISC_ENTROPY_H 1
- 
-@@ -191,9 +189,8 @@ isc_entropy_createcallbacksource(isc_entropy_t *ent,
+@@ -189,9 +189,8 @@ isc_entropy_createcallbacksource(isc_entropy_t *ent,
  /*!<
   * \brief Create an entropy source that is polled via a callback.
   *
@@ -663,18 +653,23 @@ index 632166a..c7cb17d 100644
   *
   * Samples are added via isc_entropy_addcallbacksample(), below.
   * _addcallbacksample() is the only function which may be called from
-@@ -234,15 +231,32 @@ isc_result_t
+@@ -232,15 +231,32 @@ isc_result_t
  isc_entropy_getdata(isc_entropy_t *ent, void *data, unsigned int length,
  		    unsigned int *returned, unsigned int flags);
  /*!<
 - * \brief Extract data from the entropy pool.  This may load the pool from various
 - * sources.
 + * \brief Get random data from entropy pool 'ent'.
-+ *
+  *
+- * Do this by stirring the pool and returning a part of hash as randomness.
+- * Note that no secrets are given away here since parts of the hash are
+- * xored together before returned.
 + * If a hook has been set up using isc_entropy_sethook() and
 + * isc_entropy_usehook(), then the hook function will be called to get
 + * random data.
-+ *
+  *
+- * Honor the request from the caller to only return good data, any data,
+- * etc.
 + * Otherwise, randomness is extracted from the entropy pool set up in BIND.
 + * This may cause the pool to be loaded from various sources. Ths is done
 + * by stirring the pool and returning a part of hash as randomness.
@@ -685,17 +680,12 @@ index 632166a..c7cb17d 100644
 + * ISC_ENTROPY_BLOCKING. These will be honored if the hook function is
 + * not in use. If it is, the flags will be passed to the hook function
 + * but it may ignore them.
-  *
-- * Do this by stiring the pool and returning a part of hash as randomness.
-- * Note that no secrets are given away here since parts of the hash are
-- * xored together before returned.
++ *
 + * Up to 'length' bytes of randomness are retrieved and copied into 'data'.
 + * (If 'returned' is not NULL, and the number of bytes copied is less than
 + * 'length' - which may happen if ISC_ENTROPY_PARTIAL was used - then the
 + * number of bytes copied will be stored in *returned.)
-  *
-- * Honor the request from the caller to only return good data, any data,
-- * etc.
++ *
 + * Returns:
 + * \li	ISC_R_SUCCESS on success
 + * \li	ISC_R_NOENTROPY if entropy pool is empty
@@ -703,7 +693,7 @@ index 632166a..c7cb17d 100644
   */
  
  void
-@@ -307,13 +321,21 @@ isc_entropy_usebestsource(isc_entropy_t *ectx, isc_entropysource_t **source,
+@@ -305,13 +321,21 @@ isc_entropy_usebestsource(isc_entropy_t *ectx, isc_entropysource_t **source,
  void
  isc_entropy_usehook(isc_entropy_t *ectx, bool onoff);
  /*!<
@@ -782,7 +772,7 @@ index f8aed34..17c551b 100644
  
  ISC_LANG_ENDDECLS
 diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
-index 03890a3..7bad989 100644
+index 1c45d5c..91693b5 100644
 --- a/lib/isccfg/namedconf.c
 +++ b/lib/isccfg/namedconf.c
 @@ -1109,7 +1109,7 @@ options_clauses[] = {
@@ -795,5 +785,5 @@ index 03890a3..7bad989 100644
  	{ "recursive-clients", &cfg_type_uint32, 0 },
  	{ "reserved-sockets", &cfg_type_uint32, 0 },
 -- 
-2.20.1
+2.21.1
 
diff --git a/bind-9.11-serve-stale.patch b/bind-9.11-serve-stale.patch
index 6baa4a7..724a57b 100644
--- a/bind-9.11-serve-stale.patch
+++ b/bind-9.11-serve-stale.patch
@@ -1,4 +1,4 @@
-From 3829de3d5caba113d5a8560c5ff0d2a32b57a7fc Mon Sep 17 00:00:00 2001
+From 521fc8dcc0ac064ae8bc521418f5b03f0ceec657 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 7 Nov 2019 14:31:03 +0100
 Subject: [PATCH] Implement serve-stale in 9.11
@@ -257,13 +257,13 @@ Signed-off-by: Petr Menšík <pemensik@redhat.com>
  lib/dns/master.c                              |  14 +-
  lib/dns/masterdump.c                          |  23 +
  lib/dns/rbtdb.c                               | 207 ++++++-
- lib/dns/resolver.c                            |  78 ++-
+ lib/dns/resolver.c                            |  79 ++-
  lib/dns/sdb.c                                 |   4 +-
  lib/dns/sdlz.c                                |   4 +-
  lib/dns/tests/db_test.c                       | 198 ++++++-
  lib/dns/view.c                                |   3 +
  lib/isccfg/namedconf.c                        |   5 +
- 48 files changed, 2121 insertions(+), 102 deletions(-)
+ 48 files changed, 2122 insertions(+), 102 deletions(-)
  create mode 100644 bin/tests/system/serve-stale/.gitignore
  create mode 100644 bin/tests/system/serve-stale/ans2/ans.pl.in
  create mode 100644 bin/tests/system/serve-stale/clean.sh
@@ -430,7 +430,7 @@ index 3aa25e9..12f178b 100644
  };
  
 diff --git a/bin/named/query.c b/bin/named/query.c
-index 0940714..882d69c 100644
+index 25eeced..162e4ea 100644
 --- a/bin/named/query.c
 +++ b/bin/named/query.c
 @@ -125,10 +125,14 @@
@@ -733,7 +733,7 @@ index 0940714..882d69c 100644
  	    (!PARTIALANSWER(client) || WANTRECURSION(client)
  	     || eresult == DNS_R_DROP)) {
 diff --git a/bin/named/server.c b/bin/named/server.c
-index 36e0227..73c2b47 100644
+index 1f23cf0..1fa836f 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
 @@ -1720,7 +1720,8 @@ static bool
@@ -843,7 +843,7 @@ index 36e0227..73c2b47 100644
  	/*
  	 * Set supported DNSSEC algorithms.
  	 */
-@@ -14434,3 +14478,132 @@ ns_server_dnstap(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text) {
+@@ -14456,3 +14500,132 @@ ns_server_dnstap(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text) {
  	return (ISC_R_NOTIMPLEMENTED);
  #endif
  }
@@ -977,7 +977,7 @@ index 36e0227..73c2b47 100644
 +	return (result);
 +}
 diff --git a/bin/named/statschannel.c b/bin/named/statschannel.c
-index 6292bcb..fb034a7 100644
+index 4b8d972..8c68737 100644
 --- a/bin/named/statschannel.c
 +++ b/bin/named/statschannel.c
 @@ -300,6 +300,12 @@ init_desc(void) {
@@ -1007,10 +1007,10 @@ index 8083654..d519983 100644
  		Print a zone's configuration.\n\
    sign zone [class [view]]\n\
 diff --git a/bin/rndc/rndc.docbook b/bin/rndc/rndc.docbook
-index 06b073a..6ae8e5d 100644
+index e14a17e..eaf32d3 100644
 --- a/bin/rndc/rndc.docbook
 +++ b/bin/rndc/rndc.docbook
-@@ -688,6 +688,25 @@
+@@ -689,6 +689,25 @@
  	</listitem>
        </varlistentry>
  
@@ -1052,7 +1052,7 @@ index f3f1939..9ff3f07 100644
 +    exit 1
 +fi
 diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
-index 1e5f221..96ee63e 100644
+index 22749b9..a247fd5 100644
 --- a/bin/tests/system/conf.sh.in
 +++ b/bin/tests/system/conf.sh.in
 @@ -128,7 +128,7 @@ PARALLELDIRS="dnssec rpzrecurse \
@@ -2039,10 +2039,10 @@ index 0000000..201c996
 +echo "I:exit status: $status"
 +[ $status -eq 0 ] || exit 1
 diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
-index 539973c..8528649 100644
+index bb1e81d..6dbbfad 100644
 --- a/doc/arm/Bv9ARM-book.xml
 +++ b/doc/arm/Bv9ARM-book.xml
-@@ -4376,6 +4376,9 @@ badresp:1,adberr:0,findfail:0,valfail:0]
+@@ -4381,6 +4381,9 @@ badresp:1,adberr:0,findfail:0,valfail:0]
  	  statement in the <filename>named.conf</filename> file:
  	</para>
  	<xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="options.grammar.xml"/>
@@ -2052,7 +2052,7 @@ index 539973c..8528649 100644
        </section>
  
        <section xml:id="options"><info><title><command>options</command> Statement Definition and
-@@ -4469,6 +4472,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
+@@ -4474,6 +4477,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
  		  <command>dnssec-validation</command>,
  		  <command>max-cache-ttl</command>,
  		  <command>max-ncache-ttl</command>,
@@ -2060,7 +2060,7 @@ index 539973c..8528649 100644
  		  <command>max-cache-size</command>, and
  		  <command>zero-no-soa-ttl</command>.
  		</para>
-@@ -5480,7 +5484,6 @@ options {
+@@ -5485,7 +5489,6 @@ options {
  	    </listitem>
  	  </varlistentry>
  
@@ -2068,7 +2068,7 @@ index 539973c..8528649 100644
  	  <varlistentry>
  	    <term><command>max-zone-ttl</command></term>
  	    <listitem>
-@@ -5516,6 +5519,21 @@ options {
+@@ -5521,6 +5524,21 @@ options {
  	    </listitem>
  	  </varlistentry>
  
@@ -2090,7 +2090,7 @@ index 539973c..8528649 100644
  	  <varlistentry>
  	    <term><command>serial-update-method</command></term>
  	    <listitem>
-@@ -6275,6 +6293,22 @@ options {
+@@ -6280,6 +6298,22 @@ options {
  	      </listitem>
  	    </varlistentry>
  
@@ -2113,7 +2113,7 @@ index 539973c..8528649 100644
  	    <varlistentry>
  	      <term><command>nocookie-udp-size</command></term>
  	      <listitem>
-@@ -7483,14 +7517,20 @@ options {
+@@ -7501,14 +7535,20 @@ options {
  	      <term><command>resolver-query-timeout</command></term>
  	      <listitem>
  		<para>
@@ -2137,7 +2137,7 @@ index 539973c..8528649 100644
  	      </listitem>
  	    </varlistentry>
  	  </variablelist>
-@@ -8976,6 +9016,27 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
+@@ -8994,6 +9034,27 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
  	      </listitem>
  	    </varlistentry>
  
@@ -2188,10 +2188,10 @@ index 181def7..59f6afb 100644
  	<entry colname="1">
  	  <para><command>spill</command></para>
 diff --git a/doc/arm/notes-rh-changes.xml b/doc/arm/notes-rh-changes.xml
-index 11c3a7c..ba3c2cc 100644
+index 89a4961..80b7dee 100644
 --- a/doc/arm/notes-rh-changes.xml
 +++ b/doc/arm/notes-rh-changes.xml
-@@ -13,6 +13,9 @@
+@@ -12,6 +12,9 @@
  <section xml:id="relnotes_rh_changes"><info><title>Red Hat Specific Changes</title></info>
    <itemizedlist>
       <listitem>
@@ -2201,7 +2201,7 @@ index 11c3a7c..ba3c2cc 100644
        <para>
          By default, BIND now uses the random number generation functions
          in the cryptographic library (i.e., OpenSSL or a PKCS#11
-@@ -37,7 +40,16 @@
+@@ -36,7 +39,16 @@
          case <filename>/dev/random</filename> will be the default
          entropy source.  [RT #31459] [RT #46047]
        </para>
@@ -2278,7 +2278,7 @@ index e11beed..fde93c7 100644
          topology { <address_match_element>; ... }; // not implemented
          transfer-format ( many-answers | one-answer );
 diff --git a/lib/bind9/check.c b/lib/bind9/check.c
-index bd16aec..91cedb7 100644
+index eaac5ba..a89d78f 100644
 --- a/lib/bind9/check.c
 +++ b/lib/bind9/check.c
 @@ -99,7 +99,8 @@ check_orderent(const cfg_obj_t *ent, isc_log_t *logctx) {
@@ -2669,10 +2669,10 @@ index 62797db..714b78e 100644
  dns_cache_flush(dns_cache_t *cache);
  /*%<
 diff --git a/lib/dns/include/dns/db.h b/lib/dns/include/dns/db.h
-index ae6ae36..5079053 100644
+index 6f0eed0..e3917f2 100644
 --- a/lib/dns/include/dns/db.h
 +++ b/lib/dns/include/dns/db.h
-@@ -197,6 +197,8 @@ typedef struct dns_dbmethods {
+@@ -195,6 +195,8 @@ typedef struct dns_dbmethods {
  					dns_name_t *name);
  	isc_result_t	(*getsize)(dns_db_t *db, dns_dbversion_t *version,
  				   uint64_t *records, uint64_t *bytes);
@@ -2681,7 +2681,7 @@ index ae6ae36..5079053 100644
  } dns_dbmethods_t;
  
  typedef isc_result_t
-@@ -255,6 +257,7 @@ struct dns_dbonupdatelistener {
+@@ -253,6 +255,7 @@ struct dns_dbonupdatelistener {
  #define DNS_DBFIND_FORCENSEC3		0x0080
  #define DNS_DBFIND_ADDITIONALOK		0x0100
  #define DNS_DBFIND_NOZONECUT		0x0200
@@ -2689,7 +2689,7 @@ index ae6ae36..5079053 100644
  /*@}*/
  
  /*@{*/
-@@ -1685,6 +1688,38 @@ dns_db_nodefullname(dns_db_t *db, dns_dbnode_t *node, dns_name_t *name);
+@@ -1683,6 +1686,38 @@ dns_db_nodefullname(dns_db_t *db, dns_dbnode_t *node, dns_name_t *name);
   * \li	'db' is a valid database
   * \li	'node' and 'name' are not NULL
   */
@@ -2783,7 +2783,7 @@ index 5295d8e..97071ed 100644
  /*%
   * _OMITDNSSEC:
 diff --git a/lib/dns/include/dns/resolver.h b/lib/dns/include/dns/resolver.h
-index 6da41b7..7b397cb 100644
+index 0b66c75..4b4b6bd 100644
 --- a/lib/dns/include/dns/resolver.h
 +++ b/lib/dns/include/dns/resolver.h
 @@ -547,9 +547,12 @@ dns_resolver_getmustbesecure(dns_resolver_t *resolver, dns_name_t *name);
@@ -2883,7 +2883,7 @@ index c849dec..647ca2a 100644
  
  #define DNS_VIEW_MAGIC			ISC_MAGIC('V','i','e','w')
 diff --git a/lib/dns/master.c b/lib/dns/master.c
-index 2a87bca..ac4bb19 100644
+index 8edd732..8c9f00e 100644
 --- a/lib/dns/master.c
 +++ b/lib/dns/master.c
 @@ -1948,12 +1948,18 @@ load_text(dns_loadctx_t *lctx) {
@@ -2979,10 +2979,10 @@ index 13d1a3e..873b694 100644
  			RUNTIME_CHECK(result == ISC_R_SUCCESS);
  			isc_buffer_usedregion(&buffer, &r);
 diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
-index 68e6a89..d8b5c60 100644
+index 02f2c84..fda991d 100644
 --- a/lib/dns/rbtdb.c
 +++ b/lib/dns/rbtdb.c
-@@ -488,6 +488,7 @@ typedef ISC_LIST(rdatasetheader_t)      rdatasetheaderlist_t;
+@@ -490,6 +490,7 @@ typedef ISC_LIST(rdatasetheader_t)      rdatasetheaderlist_t;
  typedef ISC_LIST(dns_rbtnode_t)         rbtnodelist_t;
  
  #define RDATASET_ATTR_NONEXISTENT       0x0001
@@ -2990,7 +2990,7 @@ index 68e6a89..d8b5c60 100644
  #define RDATASET_ATTR_STALE             0x0002
  #define RDATASET_ATTR_IGNORE            0x0004
  #define RDATASET_ATTR_RETAIN            0x0008
-@@ -500,6 +501,8 @@ typedef ISC_LIST(dns_rbtnode_t)         rbtnodelist_t;
+@@ -502,6 +503,8 @@ typedef ISC_LIST(dns_rbtnode_t)         rbtnodelist_t;
  #define RDATASET_ATTR_CASESET           0x0400
  #define RDATASET_ATTR_ZEROTTL           0x0800
  #define RDATASET_ATTR_CASEFULLYLOWER    0x1000
@@ -2999,7 +2999,7 @@ index 68e6a89..d8b5c60 100644
  
  typedef struct acache_cbarg {
  	dns_rdatasetadditional_t        type;
-@@ -550,6 +553,8 @@ struct acachectl {
+@@ -552,6 +555,8 @@ struct acachectl {
  	(((header)->attributes & RDATASET_ATTR_ZEROTTL) != 0)
  #define CASEFULLYLOWER(header) \
  	(((header)->attributes & RDATASET_ATTR_CASEFULLYLOWER) != 0)
@@ -3008,7 +3008,7 @@ index 68e6a89..d8b5c60 100644
  
  
  #define ACTIVE(header, now) \
-@@ -609,6 +614,12 @@ typedef enum {
+@@ -611,6 +616,12 @@ typedef enum {
  	expire_flush
  } expire_t;
  
@@ -3021,7 +3021,7 @@ index 68e6a89..d8b5c60 100644
  typedef struct rbtdb_version {
  	/* Not locked */
  	rbtdb_serial_t                  serial;
-@@ -676,6 +687,12 @@ struct dns_rbtdb {
+@@ -678,6 +689,12 @@ struct dns_rbtdb {
  	dns_dbnode_t                    *soanode;
  	dns_dbnode_t                    *nsnode;
  
@@ -3034,7 +3034,7 @@ index 68e6a89..d8b5c60 100644
  	/*
  	 * This is a linked list used to implement the LRU cache.  There will
  	 * be node_lock_count linked lists here.  Nodes in bucket 1 will be
-@@ -719,6 +736,8 @@ struct dns_rbtdb {
+@@ -721,6 +738,8 @@ struct dns_rbtdb {
  #define RBTDB_ATTR_LOADED               0x01
  #define RBTDB_ATTR_LOADING              0x02
  
@@ -3043,7 +3043,7 @@ index 68e6a89..d8b5c60 100644
  /*%
   * Search Context
   */
-@@ -1784,15 +1803,15 @@ rollback_node(dns_rbtnode_t *node, rbtdb_serial_t serial) {
+@@ -1791,15 +1810,15 @@ rollback_node(dns_rbtnode_t *node, rbtdb_serial_t serial) {
  }
  
  static inline void
@@ -3063,7 +3063,7 @@ index 68e6a89..d8b5c60 100644
  	header->node->dirty = 1;
  
  	/*
-@@ -1833,8 +1852,8 @@ clean_cache_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node) {
+@@ -1840,8 +1859,8 @@ clean_cache_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node) {
  		/*
  		 * If current is nonexistent or stale, we can clean it up.
  		 */
@@ -3074,7 +3074,7 @@ index 68e6a89..d8b5c60 100644
  			if (top_prev != NULL)
  				top_prev->next = current->next;
  			else
-@@ -2079,6 +2098,80 @@ delete_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node) {
+@@ -2086,6 +2105,80 @@ delete_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node) {
  	}
  }
  
@@ -3155,7 +3155,7 @@ index 68e6a89..d8b5c60 100644
  /*
   * Caller must be holding the node lock.
   */
-@@ -3316,6 +3409,12 @@ bind_rdataset(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
+@@ -3313,6 +3406,12 @@ bind_rdataset(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
  		rdataset->attributes |= DNS_RDATASETATTR_OPTOUT;
  	if (PREFETCH(header))
  		rdataset->attributes |= DNS_RDATASETATTR_PREFETCH;
@@ -3168,7 +3168,7 @@ index 68e6a89..d8b5c60 100644
  	rdataset->private1 = rbtdb;
  	rdataset->private2 = node;
  	raw = (unsigned char *)header + sizeof(*header);
-@@ -4656,6 +4755,19 @@ check_stale_header(dns_rbtnode_t *node, rdatasetheader_t *header,
+@@ -4653,6 +4752,19 @@ check_stale_header(dns_rbtnode_t *node, rdatasetheader_t *header,
  #endif
  
  	if (!ACTIVE(header, search->now)) {
@@ -3188,7 +3188,7 @@ index 68e6a89..d8b5c60 100644
  		/*
  		 * This rdataset is stale.  If no one else is using the
  		 * node, we can clean it up right now, otherwise we mark
-@@ -4695,7 +4807,7 @@ check_stale_header(dns_rbtnode_t *node, rdatasetheader_t *header,
+@@ -4692,7 +4804,7 @@ check_stale_header(dns_rbtnode_t *node, rdatasetheader_t *header,
  					node->data = header->next;
  				free_rdataset(search->rbtdb, mctx, header);
  			} else {
@@ -3197,7 +3197,7 @@ index 68e6a89..d8b5c60 100644
  				*header_prev = header;
  			}
  		} else
-@@ -5133,7 +5245,7 @@ cache_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
+@@ -5130,7 +5242,7 @@ cache_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
  				       &locktype, lock, &search,
  				       &header_prev)) {
  			/* Do nothing. */
@@ -3206,7 +3206,7 @@ index 68e6a89..d8b5c60 100644
  			/*
  			 * We now know that there is at least one active
  			 * non-stale rdataset at this node.
-@@ -5611,7 +5723,7 @@ expirenode(dns_db_t *db, dns_dbnode_t *node, isc_stdtime_t now) {
+@@ -5608,7 +5720,7 @@ expirenode(dns_db_t *db, dns_dbnode_t *node, isc_stdtime_t now) {
  			 * refcurrent(rbtnode) must be non-zero.  This is so
  			 * because 'node' is an argument to the function.
  			 */
@@ -3215,7 +3215,7 @@ index 68e6a89..d8b5c60 100644
  			if (log)
  				isc_log_write(dns_lctx, category, module,
  					      level, "overmem cache: stale %s",
-@@ -5619,7 +5731,7 @@ expirenode(dns_db_t *db, dns_dbnode_t *node, isc_stdtime_t now) {
+@@ -5616,7 +5728,7 @@ expirenode(dns_db_t *db, dns_dbnode_t *node, isc_stdtime_t now) {
  		} else if (force_expire) {
  			if (! RETAIN(header)) {
  				set_ttl(rbtdb, header, 0);
@@ -3224,7 +3224,7 @@ index 68e6a89..d8b5c60 100644
  			} else if (log) {
  				isc_log_write(dns_lctx, category, module,
  					      level, "overmem cache: "
-@@ -5876,9 +5988,9 @@ cache_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
+@@ -5873,9 +5985,9 @@ cache_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
  				 * non-zero.  This is so because 'node' is an
  				 * argument to the function.
  				 */
@@ -3236,7 +3236,7 @@ index 68e6a89..d8b5c60 100644
  			if (header->type == matchtype)
  				found = header;
  			else if (header->type == RBTDB_RDATATYPE_NCACHEANY ||
-@@ -6170,7 +6282,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+@@ -6167,7 +6279,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
  				     topheader = topheader->next)
  				{
  					set_ttl(rbtdb, topheader, 0);
@@ -3245,7 +3245,7 @@ index 68e6a89..d8b5c60 100644
  				}
  				goto find_header;
  			}
-@@ -6228,7 +6340,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+@@ -6225,7 +6337,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
  				 * ncache entry.
  				 */
  				set_ttl(rbtdb, topheader, 0);
@@ -3254,7 +3254,7 @@ index 68e6a89..d8b5c60 100644
  				topheader = NULL;
  				goto find_header;
  			}
-@@ -6266,8 +6378,11 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+@@ -6263,8 +6375,11 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
  		}
  
  		/*
@@ -3268,7 +3268,7 @@ index 68e6a89..d8b5c60 100644
  		 */
  		if (rbtversion == NULL && trust < header->trust &&
  		    (ACTIVE(header, now) || header_nx)) {
-@@ -6296,6 +6411,10 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+@@ -6293,6 +6408,10 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
  
  			if ((options & DNS_DBADD_EXACT) != 0)
  				flags |= DNS_RDATASLAB_EXACT;
@@ -3279,7 +3279,7 @@ index 68e6a89..d8b5c60 100644
  			if ((options & DNS_DBADD_EXACTTTL) != 0 &&
  			     newheader->rdh_ttl != header->rdh_ttl)
  					result = DNS_R_NOTEXACT;
-@@ -6339,11 +6458,12 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+@@ -6336,11 +6455,12 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
  			}
  		}
  		/*
@@ -3297,7 +3297,7 @@ index 68e6a89..d8b5c60 100644
  		 */
  		if (IS_CACHE(rbtdb) && ACTIVE(header, now) &&
  		    header->type == dns_rdatatype_ns &&
-@@ -6514,10 +6634,10 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+@@ -6511,10 +6631,10 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
  				changed->dirty = true;
  			if (rbtversion == NULL) {
  				set_ttl(rbtdb, header, 0);
@@ -3310,7 +3310,7 @@ index 68e6a89..d8b5c60 100644
  				}
  			}
  			if (rbtversion != NULL && !header_nx) {
-@@ -8334,6 +8454,30 @@ nodefullname(dns_db_t *db, dns_dbnode_t *node, dns_name_t *name) {
+@@ -8331,6 +8451,30 @@ nodefullname(dns_db_t *db, dns_dbnode_t *node, dns_name_t *name) {
  	return (result);
  }
  
@@ -3341,7 +3341,7 @@ index 68e6a89..d8b5c60 100644
  static dns_dbmethods_t zone_methods = {
  	attach,
  	detach,
-@@ -8379,7 +8523,9 @@ static dns_dbmethods_t zone_methods = {
+@@ -8376,7 +8520,9 @@ static dns_dbmethods_t zone_methods = {
  	NULL,
  	hashsize,
  	nodefullname,
@@ -3352,7 +3352,7 @@ index 68e6a89..d8b5c60 100644
  };
  
  static dns_dbmethods_t cache_methods = {
-@@ -8427,7 +8573,9 @@ static dns_dbmethods_t cache_methods = {
+@@ -8424,7 +8570,9 @@ static dns_dbmethods_t cache_methods = {
  	setcachestats,
  	hashsize,
  	nodefullname,
@@ -3363,7 +3363,7 @@ index 68e6a89..d8b5c60 100644
  };
  
  isc_result_t
-@@ -8698,7 +8846,7 @@ dns_rbtdb_create
+@@ -8695,7 +8843,7 @@ dns_rbtdb_create
  	rbtdb->rpzs = NULL;
  	rbtdb->load_rpzs = NULL;
  	rbtdb->rpz_num = DNS_RPZ_INVALID_NUM;
@@ -3372,7 +3372,7 @@ index 68e6a89..d8b5c60 100644
  	/*
  	 * Version Initialization.
  	 */
-@@ -9116,7 +9264,8 @@ rdatasetiter_first(dns_rdatasetiter_t *iterator) {
+@@ -9113,7 +9261,8 @@ rdatasetiter_first(dns_rdatasetiter_t *iterator) {
  				 * rdatasets to work.
  				 */
  				if (NONEXISTENT(header) ||
@@ -3382,7 +3382,7 @@ index 68e6a89..d8b5c60 100644
  					header = NULL;
  				break;
  			} else
-@@ -10325,7 +10474,7 @@ static inline bool
+@@ -10322,7 +10471,7 @@ static inline bool
  need_headerupdate(rdatasetheader_t *header, isc_stdtime_t now) {
  	if ((header->attributes &
  	     (RDATASET_ATTR_NONEXISTENT |
@@ -3391,7 +3391,7 @@ index 68e6a89..d8b5c60 100644
  	      RDATASET_ATTR_ZEROTTL)) != 0)
  		return (false);
  
-@@ -10431,7 +10580,7 @@ expire_header(dns_rbtdb_t *rbtdb, rdatasetheader_t *header,
+@@ -10428,7 +10577,7 @@ expire_header(dns_rbtdb_t *rbtdb, rdatasetheader_t *header,
  	      bool tree_locked, expire_t reason)
  {
  	set_ttl(rbtdb, header, 0);
@@ -3401,7 +3401,7 @@ index 68e6a89..d8b5c60 100644
  	/*
  	 * Caller must hold the node (write) lock.
 diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
-index 8db9845..9f65c05 100644
+index 337a2f3..24e14d2 100644
 --- a/lib/dns/resolver.c
 +++ b/lib/dns/resolver.c
 @@ -141,16 +141,17 @@
@@ -3434,18 +3434,19 @@ index 8db9845..9f65c05 100644
  #endif
  
  /* The default maximum number of recursions to follow before giving up. */
-@@ -497,6 +498,10 @@ struct dns_resolver {
- 	unsigned int			maxqueries;
- 	isc_result_t			quotaresp[2];
- 
-+	/* Additions for serve-stale feature. */
+@@ -515,6 +516,11 @@ struct dns_resolver {
+ 	dns_fetch_t *			primefetch;
+ 	/* Locked by nlock. */
+ 	unsigned int			nfctx;
++
++	/* Unlocked. Additions for serve-stale feature. */
 +	unsigned int			retryinterval; /* in milliseconds */
 +	unsigned int			nonbackofftries;
 +
- 	/* Locked by lock. */
- 	unsigned int			references;
- 	bool			exiting;
-@@ -1620,14 +1625,12 @@ fctx_setretryinterval(fetchctx_t *fctx, unsigned int rtt) {
+ };
+ 
+ #define RES_MAGIC			ISC_MAGIC('R', 'e', 's', '!')
+@@ -1625,14 +1631,12 @@ fctx_setretryinterval(fetchctx_t *fctx, unsigned int rtt) {
  	unsigned int seconds;
  	unsigned int us;
  
@@ -3464,7 +3465,7 @@ index 8db9845..9f65c05 100644
  
  	/*
  	 * Add a fudge factor to the expected rtt based on the current
-@@ -4489,7 +4492,8 @@ fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type,
+@@ -4494,7 +4498,8 @@ fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type,
  	/*
  	 * Compute an expiration time for the entire fetch.
  	 */
@@ -3474,7 +3475,7 @@ index 8db9845..9f65c05 100644
  	iresult = isc_time_nowplusinterval(&fctx->expires, &interval);
  	if (iresult != ISC_R_SUCCESS) {
  		UNEXPECTED_ERROR(__FILE__, __LINE__,
-@@ -8977,6 +8981,8 @@ dns_resolver_create(dns_view_t *view,
+@@ -8983,6 +8988,8 @@ dns_resolver_create(dns_view_t *view,
  	res->spillattimer = NULL;
  	res->zspill = 0;
  	res->zero_no_soa_ttl = false;
@@ -3483,7 +3484,7 @@ index 8db9845..9f65c05 100644
  	res->query_timeout = DEFAULT_QUERY_TIMEOUT;
  	res->maxdepth = DEFAULT_RECURSION_DEPTH;
  	res->maxqueries = DEFAULT_MAX_QUERIES;
-@@ -10304,17 +10310,20 @@ dns_resolver_gettimeout(dns_resolver_t *resolver) {
+@@ -10317,17 +10324,20 @@ dns_resolver_gettimeout(dns_resolver_t *resolver) {
  }
  
  void
@@ -3512,7 +3513,7 @@ index 8db9845..9f65c05 100644
  }
  
  void
-@@ -10411,3 +10420,34 @@ dns_resolver_getquotaresponse(dns_resolver_t *resolver, dns_quotatype_t which)
+@@ -10424,3 +10434,34 @@ dns_resolver_getquotaresponse(dns_resolver_t *resolver, dns_quotatype_t which)
  
  	return (resolver->quotaresp[which]);
  }
@@ -3578,7 +3579,7 @@ index 0b9620c..331992e 100644
  
  /*
 diff --git a/lib/dns/tests/db_test.c b/lib/dns/tests/db_test.c
-index 35cf21d..bf39545 100644
+index 2849775..812f750 100644
 --- a/lib/dns/tests/db_test.c
 +++ b/lib/dns/tests/db_test.c
 @@ -28,8 +28,9 @@
@@ -3809,7 +3810,7 @@ index 35cf21d..bf39545 100644
  						_setup, _teardown),
  		cmocka_unit_test_setup_teardown(dbtype_test,
 diff --git a/lib/dns/view.c b/lib/dns/view.c
-index a1a4301..abf6a4c 100644
+index 0fca1d9..55ede81 100644
 --- a/lib/dns/view.c
 +++ b/lib/dns/view.c
 @@ -229,6 +229,9 @@ dns_view_create(isc_mem_t *mctx, dns_rdataclass_t rdclass,
@@ -3823,7 +3824,7 @@ index a1a4301..abf6a4c 100644
  	view->maxbits = 0;
  	view->v4_aaaa = dns_aaaa_ok;
 diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
-index 7bad989..bbf4b45 100644
+index 91693b5..5771774 100644
 --- a/lib/isccfg/namedconf.c
 +++ b/lib/isccfg/namedconf.c
 @@ -1778,6 +1778,7 @@ view_clauses[] = {
@@ -3854,5 +3855,5 @@ index 7bad989..bbf4b45 100644
  	{ "topology", &cfg_type_bracketed_aml, CFG_CLAUSEFLAG_NOTIMP },
  	{ "transfer-format", &cfg_type_transferformat, 0 },
 -- 
-2.21.0
+2.21.1
 
diff --git a/bind-9.3.2b1-fix_sdb_ldap.patch b/bind-9.3.2b1-fix_sdb_ldap.patch
index 35c8542..e5a418e 100644
--- a/bind-9.3.2b1-fix_sdb_ldap.patch
+++ b/bind-9.3.2b1-fix_sdb_ldap.patch
@@ -1,5 +1,5 @@
 diff --git a/bin/sdb_tools/Makefile.in b/bin/sdb_tools/Makefile.in
-index 95ab742..6069f09 100644
+index 95ab742..5059a17 100644
 --- a/bin/sdb_tools/Makefile.in
 +++ b/bin/sdb_tools/Makefile.in
 @@ -32,11 +32,11 @@ DEPLIBS =	${LWRESDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
@@ -7,49 +7,46 @@ index 95ab742..6069f09 100644
  		${ISCCFGLIBS} ${ISCCCLIBS} ${ISCLIBS} ${DBDRIVER_LIBS} @LIBS@
  
 -TARGETS =	zone2ldap@EXEEXT@ zonetodb@EXEEXT@ zone2sqlite@EXEEXT@
-+TARGETS =	zone2ldap@EXEEXT@ ldap2zone@EXEEXT@ zonetodb@EXEEXT@ zone2sqlite@EXEEXT@
++TARGETS =	zone2ldap@EXEEXT@ zonetodb@EXEEXT@ zone2sqlite@EXEEXT@ ldap2zone@EXEEXT@
  
 -OBJS	=	zone2ldap.@O@ zonetodb.@O@ zone2sqlite.@O@
-+OBJS	=	zone2ldap.@O@ ldap2zone.@O@ zonetodb.@O@ zone2sqlite.@O@
++OBJS	=	zone2ldap.@O@ zonetodb.@O@ zone2sqlite.@O@ ldap2zone.@O@
  
 -SRCS    =       zone2ldap.c zonetodb.c zone2sqlite.c
-+SRCS    =       zone2ldap.c ldap2zone.c zonetodb.c zone2sqlite.c
++SRCS    =       zone2ldap.c zonetodb.c zone2sqlite.c ldap2zone.c
  
  MANPAGES =      zone2ldap.1
  
-@@ -53,6 +53,9 @@ zonetodb@EXEEXT@: zonetodb.@O@  ${DEPLIBS}
- zone2sqlite@EXEEXT@: zone2sqlite.@O@  ${DEPLIBS}
- 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${ALL_CFLAGS} ${LDFLAGS} -o $@ zone2sqlite.@O@ -lsqlite3 -lssl ${LIBS}
+@@ -47,6 +47,9 @@ EXT_CFLAGS =
+ zone2ldap@EXEEXT@: zone2ldap.@O@ ${DEPLIBS}
+ 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ zone2ldap.@O@ -lldap -llber ${LIBS}
  
 +ldap2zone@EXEEXT@: ldap2zone.@O@ ${DEPLIBS}
 +	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${ALL_CFLAGS} ${LDFLAGS} -o $@ ldap2zone.@O@ -lldap -llber ${LIBS}
 +
- clean distclean manclean maintainer-clean::
- 	rm -f ${TARGETS} ${OBJS}
+ zonetodb@EXEEXT@: zonetodb.@O@  ${DEPLIBS}
+ 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ zonetodb.@O@ -lpq ${LIBS}
  
-@@ -62,6 +65,7 @@ installdirs:
- 
- install:: ${TARGETS} installdirs
+@@ -64,4 +67,5 @@ install:: ${TARGETS} installdirs
  	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zone2ldap@EXEEXT@ ${DESTDIR}${sbindir}
-+	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} ldap2zone@EXEEXT@ ${DESTDIR}${sbindir}
  	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zonetodb@EXEEXT@  ${DESTDIR}${sbindir}
  	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zone2sqlite@EXEEXT@ ${DESTDIR}${sbindir}
++	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} ldap2zone@EXEEXT@ ${DESTDIR}${sbindir}
  	${INSTALL_DATA} ${srcdir}/zone2ldap.1 ${DESTDIR}${mandir}/man1/zone2ldap.1
 diff --git a/bin/sdb_tools/zone2ldap.c b/bin/sdb_tools/zone2ldap.c
-index aa2c711..76186b5 100644
+index e0e9207..d59936c 100644
 --- a/bin/sdb_tools/zone2ldap.c
 +++ b/bin/sdb_tools/zone2ldap.c
-@@ -66,6 +66,9 @@ ldap_info;
- /* usage Info */
- void usage (void);
+@@ -73,7 +73,7 @@ void add_ldap_values (ldap_info * ldinfo);
+ void init_ldap_conn (void);
  
-+/* Check for existence of (and possibly add) containing dNSZone objects */
-+int lookup_dns_zones( ldap_info *ldinfo);
-+
- /* Add to the ldap dit */
- void add_ldap_values (ldap_info * ldinfo);
+ /* Ldap error checking */
+-void ldap_result_check (const char *msg, char *dn, int err);
++void ldap_result_check (const char *msg, const char *dn, int err);
  
-@@ -82,7 +85,7 @@ char **hostname_to_dn_list (char *hostname, char *zone, unsigned int flags);
+ /* Put a hostname into a char ** array */
+ char **hostname_to_dn_list (char *hostname, char *zone, unsigned int flags);
+@@ -82,7 +82,7 @@ char **hostname_to_dn_list (char *hostname, char *zone, unsigned int flags);
  int get_attr_list_size (char **tmp);
  
  /* Get a DN */
@@ -58,7 +55,7 @@ index aa2c711..76186b5 100644
  
  /* Add to RR list */
  void add_to_rr_list (char *dn, char *name, char *type, char *data,
-@@ -104,11 +107,27 @@ void
+@@ -104,11 +104,26 @@ void
  init_ldap_conn ();
  void usage();
  
@@ -87,11 +84,19 @@ index aa2c711..76186b5 100644
 +static char *objectClasses    []= { &(topClass[0]), &(dNSZoneClass[0]), NULL };
 +static char *topObjectClasses []= { &(topClass[0]), &(dcObjectClass[0]), &(dNSZoneClass[0]), NULL };
 +static char *dn_buffer      [64]={NULL};
-+
  LDAP *conn;
  unsigned int debug = 0;
  
-@@ -132,12 +151,12 @@ main (int argc, char **argv)
+@@ -120,7 +135,7 @@ static void
+ fatal(const char *msg) {
+   perror(msg);
+   if (conn != NULL)
+-    ldap_unbind_s(conn);
++    ldap_unbind_ext_s(conn, NULL, NULL);
+   exit(1);
+ }
+ 
+@@ -132,12 +147,13 @@ main (int argc, char **argv)
    isc_result_t result;
    char *basedn;
    ldap_info *tmp;
@@ -102,12 +107,12 @@ index aa2c711..76186b5 100644
    isc_buffer_t buff;
    char *zonefile=0L;
    char fullbasedn[1024];
--  char *ctmp;
-+  char *ctmp, *zn, *dcp[2], *znp[2], *rdn[2];
+   char *ctmp;
++  char *zn, *dcp[2], *znp[2], *rdn[2];
    dns_fixedname_t fixedzone, fixedname;
    dns_rdataset_t rdataset;
    char **dc_list;
-@@ -150,7 +169,7 @@ main (int argc, char **argv)
+@@ -150,7 +166,7 @@ main (int argc, char **argv)
    extern char *optarg;
    extern int optind, opterr, optopt;
    int create_base = 0;
@@ -116,7 +121,7 @@ index aa2c711..76186b5 100644
  
    if (argc < 2)
      {
-@@ -158,7 +177,7 @@ main (int argc, char **argv)
+@@ -158,7 +174,7 @@ main (int argc, char **argv)
        exit (-1);
      }
  
@@ -125,7 +130,7 @@ index aa2c711..76186b5 100644
      {
        switch (topt)
  	{
-@@ -181,6 +200,9 @@ main (int argc, char **argv)
+@@ -181,6 +197,9 @@ main (int argc, char **argv)
  	  if (bindpw == NULL)
  	    fatal("strdup");
  	  break;
@@ -135,35 +140,27 @@ index aa2c711..76186b5 100644
  	case 'b':
  	  ldapbase = strdup (optarg);
  	  if (ldapbase == NULL)
-@@ -300,27 +322,62 @@ main (int argc, char **argv)
-     {
-       if (debug)
+@@ -302,17 +321,51 @@ main (int argc, char **argv)
  	printf ("Creating base zone DN %s\n", argzone);
--
-+      
+ 
        dc_list = hostname_to_dn_list (argzone, argzone, DNS_TOP);
 -      basedn = build_dn_from_dc_list (dc_list, 0, NO_SPEC);
- 
--      for (ctmp = &basedn[strlen (basedn)]; ctmp >= &basedn[0]; ctmp--)
 +      basedn = build_dn_from_dc_list (dc_list, 0, NO_SPEC, argzone);
 +      if (debug)
 +	printf ("base DN %s\n", basedn);
-+
+ 
+-      for (ctmp = &basedn[strlen (basedn)]; ctmp >= &basedn[0]; ctmp--)
 +      for (ctmp = &basedn[strlen (basedn)], dcn=0; ctmp >= &basedn[0]; ctmp--)
  	{
--	  if ((*ctmp == ',') || (ctmp == &basedn[0]))
-+	    if ((*ctmp == ',') || (ctmp == &basedn[0]))
+ 	  if ((*ctmp == ',') || (ctmp == &basedn[0]))
  	    {
-+
  	      base.mod_op = LDAP_MOD_ADD;
 -	      base.mod_type = (char*)"objectClass";
--	      base.mod_values = (char**)topObjectClasses;
 +	      base.mod_type = objectClass;
-+	      base.mod_values = topObjectClasses;
+ 	      base.mod_values = (char**)topObjectClasses;
  	      base_attrs[0] = (void*)&base;
 -	      base_attrs[1] = NULL;
--
-+	     
++
 +	      dcBase.mod_op = LDAP_MOD_ADD;
 +	      dcBase.mod_type = dc;
 +	      dcp[0]=dc_list[dcn];
@@ -172,13 +169,13 @@ index aa2c711..76186b5 100644
 +	      base_attrs[1] = (void*)&dcBase;
 +
 +	      znBase.mod_op = LDAP_MOD_ADD;
-+	      znBase.mod_type = zoneName;	      
++	      znBase.mod_type = zoneName;
 +	      for( zdn = dcn, znlen = 0; zdn >= 0; zdn-- )
 +		  znlen += strlen(dc_list[zdn])+1;
 +	      znp[0] = (char*)malloc(znlen+1);
 +	      znp[1] = 0L;
-+	      for( zdn = dcn, zn=znp[0]; zdn >= 0; zdn-- )		  
-+		  zn+=sprintf(zn,"%s%s",dc_list[zdn], 
++	      for( zdn = dcn, zn=znp[0]; zdn >= 0; zdn-- )
++		  zn+=sprintf(zn,"%s%s",dc_list[zdn],
 +			      ((zdn > 0) && (*(dc_list[zdn-1])!='.')) ? "." : ""
 +		             );
 +
@@ -191,24 +188,15 @@ index aa2c711..76186b5 100644
 +	      rdn[1] = 0L;
 +	      rdnBase.mod_values = rdn;
 +	      base_attrs[3] = (void*)&rdnBase;
-+	      
++
 +	      dcn++;
 +
 +	      base.mod_values = topObjectClasses;
-+	      base_attrs[4] = NULL;	      
-+	      
++	      base_attrs[4] = NULL;
+ 
  	      if (ldapbase)
  		{
- 		  if (ctmp != &basedn[0])
- 		    sprintf (fullbasedn, "%s,%s", ctmp + 1, ldapbase);
- 		  else
--		    sprintf (fullbasedn, "%s,%s", ctmp, ldapbase);
--
-+		    sprintf (fullbasedn, "%s,%s", ctmp, ldapbase);		  
- 		}
- 	      else
- 		{
-@@ -329,8 +386,13 @@ main (int argc, char **argv)
+@@ -329,6 +382,10 @@ main (int argc, char **argv)
  		  else
  		    sprintf (fullbasedn, "%s", ctmp);
  		}
@@ -217,12 +205,9 @@ index aa2c711..76186b5 100644
 +		  printf("Full base dn: %s\n", fullbasedn);
 +
  	      result = ldap_add_s (conn, fullbasedn, base_attrs);
- 	      ldap_result_check ("intial ldap_add_s", fullbasedn, result);
-+
+ 	      ldap_result_check ("initial ldap_add_s", fullbasedn, result);
  	    }
- 
- 	}
-@@ -408,14 +470,14 @@ generate_ldap (dns_name_t * dnsname, dns_rdata_t * rdata, unsigned int ttl)
+@@ -408,14 +465,14 @@ generate_ldap (dns_name_t * dnsname, dns_rdata_t * rdata, unsigned int ttl)
    isc_result_check (result, "dns_rdata_totext");
    data[isc_buffer_usedlength (&buff)] = 0;
  
@@ -240,7 +225,7 @@ index aa2c711..76186b5 100644
  }
  
  
-@@ -455,7 +517,8 @@ add_to_rr_list (char *dn, char *name, char *type,
+@@ -455,7 +512,8 @@ add_to_rr_list (char *dn, char *name, char *type,
    int attrlist;
    char ldap_type_buffer[128];
    char charttl[64];
@@ -250,7 +235,7 @@ index aa2c711..76186b5 100644
  
    if ((tmp = locate_by_dn (dn)) == NULL)
      {
-@@ -482,13 +545,13 @@ add_to_rr_list (char *dn, char *name, char *type,
+@@ -482,10 +540,10 @@ add_to_rr_list (char *dn, char *name, char *type,
  	    fatal("malloc");
  	}
        tmp->attrs[0]->mod_op = LDAP_MOD_ADD;
@@ -262,12 +247,8 @@ index aa2c711..76186b5 100644
 +	tmp->attrs[0]->mod_values = objectClasses;
        else
  	{
--	  tmp->attrs[0]->mod_values = (char**)topObjectClasses;
-+	  tmp->attrs[0]->mod_values =topObjectClasses;
- 	  tmp->attrs[1] = NULL;
- 	  tmp->attrcnt = 2;
- 	  tmp->next = ldap_info_base;
-@@ -497,7 +560,7 @@ add_to_rr_list (char *dn, char *name, char *type,
+ 	  tmp->attrs[0]->mod_values = (char**)topObjectClasses;
+@@ -497,7 +555,7 @@ add_to_rr_list (char *dn, char *name, char *type,
  	}
  
        tmp->attrs[1]->mod_op = LDAP_MOD_ADD;
@@ -276,7 +257,7 @@ index aa2c711..76186b5 100644
        tmp->attrs[1]->mod_values = (char **) calloc (sizeof (char *), 2);
  
        if (tmp->attrs[1]->mod_values == (char **)NULL)
-@@ -526,7 +589,7 @@ add_to_rr_list (char *dn, char *name, char *type,
+@@ -526,7 +584,7 @@ add_to_rr_list (char *dn, char *name, char *type,
  	 fatal("strdup");
  
        tmp->attrs[3]->mod_op = LDAP_MOD_ADD;
@@ -285,16 +266,16 @@ index aa2c711..76186b5 100644
        tmp->attrs[3]->mod_values = (char **) calloc (sizeof (char *), 2);
  
        if (tmp->attrs[3]->mod_values == (char **)NULL)
-@@ -539,14 +602,25 @@ add_to_rr_list (char *dn, char *name, char *type,
+@@ -539,14 +597,25 @@ add_to_rr_list (char *dn, char *name, char *type,
        if (tmp->attrs[3]->mod_values[0] == NULL)
  	 fatal("strdup");
  
-+      znlen=strlen(gbl_zone);      
-+      if ( *(gbl_zone + (znlen-1)) == '.' )
++      znlen=strlen(gbl_zone);
++      if ( gbl_zone[znlen-1] == '.' )
 +      { /* ldapdb MUST search by relative zone name */
 +	  zn = (char*)malloc(znlen);
-+	  strncpy(zn,gbl_zone,znlen-1);
-+	  *(zn + (znlen-1))='\0';	  
++	  memcpy(zn, gbl_zone, znlen-1);
++	  zn[znlen-1]='\0';
 +      }else
 +      {
 +	  zn = gbl_zone;
@@ -313,7 +294,7 @@ index aa2c711..76186b5 100644
        tmp->attrs[4]->mod_values[1] = NULL;
  
        tmp->attrs[5] = NULL;
-@@ -557,7 +631,7 @@ add_to_rr_list (char *dn, char *name, char *type,
+@@ -557,7 +626,7 @@ add_to_rr_list (char *dn, char *name, char *type,
    else
      {
  
@@ -322,7 +303,7 @@ index aa2c711..76186b5 100644
  	{
  	  sprintf (ldap_type_buffer, "%sRecord", type);
  	  if (!strncmp
-@@ -631,44 +705,70 @@ char **
+@@ -631,44 +700,70 @@ char **
  hostname_to_dn_list (char *hostname, char *zone, unsigned int flags)
  {
    char *tmp;
@@ -382,10 +363,10 @@ index aa2c711..76186b5 100644
 +      {
 +	  if( hname == 0 )
 +	      hname=strdup(hostname);
-+  	  last = strdup(sameZone);
++	  last = strdup(sameZone);
 +      }else
-+      {	   
-+	  if(  (hlen < zlen) 
++      {
++	  if(  (hlen < zlen)
 +	     ||( strcmp( hostname + (hlen - zlen), zone ) != 0)
 +	    )
 +	  {
@@ -422,7 +403,7 @@ index aa2c711..76186b5 100644
 +	  *tmp = '\0';
 +	  if( tmp == hname )
 +	      break;
-+      }	  
++      }
 +  }
 +  if( ( last != hname ) && (tmp != hname) )
 +      dn_buffer[i++] = hname;
@@ -430,7 +411,7 @@ index aa2c711..76186b5 100644
    dn_buffer[i] = NULL;
  
    return dn_buffer;
-@@ -680,24 +780,32 @@ hostname_to_dn_list (char *hostname, char *zone, unsigned int flags)
+@@ -680,30 +775,38 @@ hostname_to_dn_list (char *hostname, char *zone, unsigned int flags)
   * exception of "@"/SOA. */
  
  char *
@@ -439,19 +420,21 @@ index aa2c711..76186b5 100644
  {
    int size;
 -  int x;
+-  static char dn[1024];
+-  char tmp[128];
 +  int x, znlen;
-   static char dn[1024];
-   char tmp[128];
++  static char dn[DNS_NAME_MAXTEXT*3/2];
++  char tmp[DNS_NAME_MAXTEXT*3/2];
 +  char zn[DNS_NAME_MAXTEXT+1];
  
    bzero (tmp, sizeof (tmp));
    bzero (dn, sizeof (dn));
    size = get_attr_list_size (dc_list);
 +  znlen = strlen(zone);
-+  if ( *(zone + (znlen-1)) == '.' )
++  if ( zone[znlen-1] == '.' )
 +  { /* ldapdb MUST search by relative zone name */
 +      memcpy(&(zn[0]),zone,znlen-1);
-+      *(zn + (znlen-1))='\0';
++      zn[znlen-1]='\0';
 +      zone = zn;
 +  }
    for (x = size - 2; x > 0; x--)
@@ -460,40 +443,47 @@ index aa2c711..76186b5 100644
      {
        if (x == (size - 2) && (strncmp (dc_list[x], "@", 1) == 0) && (ttl))
 -	sprintf (tmp, "relativeDomainName=%s + dNSTTL=%u,", dc_list[x], ttl);
-+	sprintf (tmp, "zoneName=%s + relativeDomainName=%s,", zone, dc_list[x]);
++	snprintf (tmp, sizeof(tmp), "zoneName=%s + relativeDomainName=%s,", zone, dc_list[x]);
        else if (x == (size - 2))
 -	      sprintf(tmp, "relativeDomainName=%s,",dc_list[x]);
-+	      sprintf(tmp, "zoneName=%s + relativeDomainName=%s,", zone, dc_list[x]);
++	      snprintf(tmp, sizeof(tmp), "zoneName=%s + relativeDomainName=%s,", zone, dc_list[x]);
        else
- 	      sprintf(tmp,"dc=%s,", dc_list[x]);
+-	      sprintf(tmp,"dc=%s,", dc_list[x]);
++	      snprintf(tmp, sizeof(tmp), "dc=%s,", dc_list[x]);
      }
-@@ -723,6 +831,7 @@ void
- init_ldap_conn ()
- {
-   int result;
-+  char ldb_tag[]="LDAP Bind";
-   conn = ldap_open (ldapsystem, LDAP_PORT);
-   if (conn == NULL)
+     else
      {
-@@ -732,7 +841,7 @@ init_ldap_conn ()
+-	    sprintf(tmp, "dc=%s,", dc_list[x]);
++	    snprintf(tmp, sizeof(tmp), "dc=%s,", dc_list[x]);
+     }
+ 
+ 
+@@ -732,19 +835,18 @@ init_ldap_conn ()
      }
  
    result = ldap_simple_bind_s (conn, binddn, bindpw);
 -  ldap_result_check ("ldap_simple_bind_s", (char*)"LDAP Bind", result);
-+  ldap_result_check ("ldap_simple_bind_s", ldb_tag , result);
++  ldap_result_check ("ldap_simple_bind_s", "LDAP Bind", result);
  }
  
  /* Like isc_result_check, only for LDAP */
-@@ -749,8 +858,6 @@ ldap_result_check (const char *msg, char *dn, int err)
+ void
+-ldap_result_check (const char *msg, char *dn, int err)
++ldap_result_check (const char *msg, const char *dn, int err)
+ {
+   if ((err != LDAP_SUCCESS) && (err != LDAP_ALREADY_EXISTS))
+     {
+-      fprintf(stderr, "Error while adding %s (%s):\n",
+-		      dn, msg);
+-      ldap_perror (conn, dn);
+-      ldap_unbind_s (conn);
++      fprintf(stderr, "Error while adding %s (%s):\n%s",
++		      dn, msg, ldap_err2string(err));
++      ldap_unbind_ext_s (conn, NULL, NULL);
+       exit (-1);
      }
  }
- 
--
--
- /* For running the ldap_info run queue. */
- void
- add_ldap_values (ldap_info * ldinfo)
-@@ -758,14 +865,14 @@ add_ldap_values (ldap_info * ldinfo)
+@@ -758,16 +860,15 @@ add_ldap_values (ldap_info * ldinfo)
    int result;
    char dnbuffer[1024];
  
@@ -505,12 +495,14 @@ index aa2c711..76186b5 100644
  
    result = ldap_add_s (conn, dnbuffer, ldinfo->attrs);
 -  ldap_result_check ("ldap_add_s", dnbuffer, result);
+-}
 +    ldap_result_check ("ldap_add_s", dnbuffer, result);
-+
- }
+ 
++}
  
  
-@@ -776,5 +883,5 @@ void
+ 
+@@ -776,5 +877,5 @@ void
  usage ()
  {
    fprintf (stderr,
diff --git a/bind.spec b/bind.spec
index b99f546..8dae2f7 100644
--- a/bind.spec
+++ b/bind.spec
@@ -55,16 +55,16 @@
 #
 
 # lib*.so.X versions of selected libraries
-%global sover_dns 1107
-%global sover_isc 1104
+%global sover_dns 1110
+%global sover_isc 1105
 %global sover_irs 161
 %global sover_isccfg 163
 
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.11.14
-Release:  5%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Version:  9.11.17
+Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -165,10 +165,6 @@ Patch177: bind-9.11-serve-stale.patch
 Patch178: bind-9.11-serve-stale-dbfix.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=1736762
 Patch183: bind-9.11-rh1736762-5.patch
-Patch184: bind-9.11-rh1736762-6.patch
-Patch185: bind-9.11-rh1736762-7.patch
-Patch186: bind-9.11-rh1736762-8.patch
-Patch187: bind-9.11-oot-gen.patch
 
 # SDB patches
 Patch11: bind-9.3.2b2-sdbsrc.patch
@@ -569,10 +565,6 @@ are used for building ISC DHCP.
 %patch177 -p1 -b .serve-stale
 %patch178 -p1 -b .rh1770492
 %patch183 -p1 -b .rh1736762-5
-%patch184 -p1 -b .rh1736762-6
-%patch185 -p1 -b .rh1736762-7
-%patch186 -p1 -b .rh1736762-8
-%patch187 -p1 -b .oot-gen
 
 mkdir lib/dns/tests/testdata/dstrandom
 cp -a %{SOURCE50} lib/dns/tests/testdata/dstrandom/random.data
@@ -1609,6 +1601,9 @@ fi;
 
 
 %changelog
+* Tue Mar 31 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.17-1
+- Update to 9.11.17
+
 * Tue Jan 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.11.14-5
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
 
diff --git a/sources b/sources
index d7c9b81..d31ad61 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.11.14.tar.gz) = fc7729e780e44c3c4e50059032fdae2af3d0e07b492b5088b2fefc15354829d3c9a83fab4f2ecaa9323cd7a37b1f7eb94890c149ba1df5c4fbea7a145095cbe9
-SHA512 (bind-9.11.14.tar.gz.asc) = fd28a1ebd4adf8c2854de434cc6f5f4d47d982eaad73fbb42dce8df97f7b069feb6e7c374178e203a07fff83f2cd021dfd10fb77dd6e8c5201ee4d299df98b89
+SHA512 (bind-9.11.17.tar.gz) = 0c5aebd9763fdf61709d347abc79c898f62bcc6bc19bcae0e355804cfee3fd24d7054ebb574dce1987138e4a755c4bc963afb92f920ac15223c1a738d831b652
+SHA512 (bind-9.11.17.tar.gz.asc) = fb5c03facaf8530bf4168be6a106bc75517bb4b45e164fbadd20ce9968098e43badff854ca735b14cddbeb76f8cc10cfaf7cad760b7b630639a1c9243dd7c422

From 5c15ad824e6e9ccbfb44cf527ba99cec25f06378 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 31 Mar 2020 20:42:27 +0200
Subject: [PATCH 129/460] Remove unused patches

---
 bind-9.10-sdb-sqlite-bld.patch | 53 ---------------------
 bind-9.11-rh1647829-2.patch    | 86 ----------------------------------
 bind-9.11-rh1768258.patch      | 28 -----------
 bind.spec                      |  5 +-
 4 files changed, 2 insertions(+), 170 deletions(-)
 delete mode 100644 bind-9.10-sdb-sqlite-bld.patch
 delete mode 100644 bind-9.11-rh1647829-2.patch
 delete mode 100644 bind-9.11-rh1768258.patch

diff --git a/bind-9.10-sdb-sqlite-bld.patch b/bind-9.10-sdb-sqlite-bld.patch
deleted file mode 100644
index c5df396..0000000
--- a/bind-9.10-sdb-sqlite-bld.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-diff --git a/bin/named-sdb/Makefile.in b/bin/named-sdb/Makefile.in
-index 1894830..445182a 100644
---- a/bin/named-sdb/Makefile.in
-+++ b/bin/named-sdb/Makefile.in
-@@ -34,10 +34,10 @@ top_srcdir =	@top_srcdir@
- #
- # Add database drivers here.
- #
--DBDRIVER_OBJS =	ldapdb.@O@ pgsqldb.@O@ dirdb.@O@
--DBDRIVER_SRCS =	ldapdb.c pgsqldb.c dirdb.c
-+DBDRIVER_OBJS =	ldapdb.@O@ pgsqldb.@O@ sqlitedb.@O@ dirdb.@O@
-+DBDRIVER_SRCS =	ldapdb.c pgsqldb.c sqlitedb.c dirdb.c
- DBDRIVER_INCLUDES =
--DBDRIVER_LIBS =	-lldap -llber -lpq
-+DBDRIVER_LIBS =	-lldap -llber -lsqlite3 -lpq
- 
- DLZ_DRIVER_DIR =	${top_srcdir}/contrib/dlz/drivers
- 
-diff --git a/bin/sdb_tools/Makefile.in b/bin/sdb_tools/Makefile.in
-index 7f3c5e2..b1bca66 100644
---- a/bin/sdb_tools/Makefile.in
-+++ b/bin/sdb_tools/Makefile.in
-@@ -32,11 +32,11 @@ DEPLIBS =	${LWRESDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
- LIBS =		${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
- 		${ISCCFGLIBS} ${ISCCCLIBS} ${ISCLIBS} ${DBDRIVER_LIBS} @LIBS@
- 
--TARGETS =	zone2ldap@EXEEXT@ zonetodb@EXEEXT@
-+TARGETS =	zone2ldap@EXEEXT@ zonetodb@EXEEXT@ zone2sqlite@EXEEXT@
- 
--OBJS	=	zone2ldap.@O@ zonetodb.@O@
-+OBJS	=	zone2ldap.@O@ zonetodb.@O@ zone2sqlite.@O@
- 
--SRCS    =       zone2ldap.c zonetodb.c
-+SRCS    =       zone2ldap.c zonetodb.c zone2sqlite.c
- 
- MANPAGES =      zone2ldap.1
- 
-@@ -50,6 +50,9 @@ zone2ldap@EXEEXT@: zone2ldap.@O@ ${DEPLIBS}
- zonetodb@EXEEXT@: zonetodb.@O@  ${DEPLIBS}
- 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ zonetodb.@O@ -lpq ${LIBS}
- 
-+zone2sqlite@EXEEXT@: zone2sqlite.@O@  ${DEPLIBS}
-+	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${ALL_CFLAGS} ${LDFLAGS} -o $@ zone2sqlite.@O@ -lsqlite3 -lssl ${LIBS}
-+
- clean distclean manclean maintainer-clean::
- 	rm -f ${TARGETS} ${OBJS}
- 
-@@ -60,4 +63,5 @@ installdirs:
- install:: ${TARGETS} installdirs
- 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zone2ldap@EXEEXT@ ${DESTDIR}${sbindir}
- 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zonetodb@EXEEXT@  ${DESTDIR}${sbindir}
-+	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zone2sqlite@EXEEXT@ ${DESTDIR}${sbindir}
- 	${INSTALL_DATA} ${srcdir}/zone2ldap.1 ${DESTDIR}${mandir}/man1/zone2ldap.1
diff --git a/bind-9.11-rh1647829-2.patch b/bind-9.11-rh1647829-2.patch
deleted file mode 100644
index 98612bf..0000000
--- a/bind-9.11-rh1647829-2.patch
+++ /dev/null
@@ -1,86 +0,0 @@
-From fdfc8ad6a1069eea6b012972c972798003d58312 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Tue, 29 Jan 2019 18:07:44 +0100
-Subject: [PATCH] Fallback to ASCII on output IDN conversion error
-
-It is possible dig used ACE encoded name in locale, which does not
-support converting it to unicode. Instead of fatal error, fallback to
-ACE name on output.
-
-(cherry picked from commit 7f4cb8f9584597fea16de6557124ac8b1bd47440)
-
-Modify idna test to fallback to ACE
-
-Test valid A-label on input would be displayed as A-label on output if
-locale does not allow U-label.
-
-(cherry picked from commit 4ce232f8605bdbe0594ebe5a71383c9d4e6f263b)
-
-Emit warning on IDN output failure
-
-Warning is emitted before any dig headers.
-
-(cherry picked from commit 4b410038c531fbb902cd5fb83174eed1f06cb7d7)
----
- bin/dig/dighost.c              | 15 +++++++++++++--
- bin/tests/system/idna/tests.sh | 17 +++++++++++++++++
- 2 files changed, 30 insertions(+), 2 deletions(-)
-
-diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
-index 73aaab8..375f99f 100644
---- a/bin/dig/dighost.c
-+++ b/bin/dig/dighost.c
-@@ -4877,9 +4877,20 @@ idn_ace_to_locale(const char *from, char *to, size_t tolen) {
- 	 */
- 	res = idn2_to_unicode_8zlz(utf8_src, &tmp_str, 0);
- 	if (res != IDN2_OK) {
--		fatal("Cannot represent '%s' in the current locale (%s), "
--		      "use +noidnout or a different locale",
-+		static bool warned = false;
-+
-+		res = idn2_to_ascii_8z(utf8_src, &tmp_str, 0);
-+		if (res != IDN2_OK) {
-+			fatal("Cannot represent '%s' "
-+			      "in the current locale nor ascii (%s), "
-+			      "use +noidnout or a different locale",
- 		      from, idn2_strerror(res));
-+		} else if (!warned) {
-+			fprintf(stderr, ";; Warning: cannot represent '%s' "
-+			      "in the current locale",
-+			      tmp_str);
-+			warned = true;
-+		}
- 	}
- 
- 	/*
-diff --git a/bin/tests/system/idna/tests.sh b/bin/tests/system/idna/tests.sh
-index 7acb0fa..0269bcd 100644
---- a/bin/tests/system/idna/tests.sh
-+++ b/bin/tests/system/idna/tests.sh
-@@ -244,6 +244,23 @@ idna_enabled_test() {
-     idna_test "$text" "+idnin +noidnout"   "xn--nxasmq6b.com" "xn--nxasmq6b.com."
-     idna_test "$text" "+idnin +idnout"     "xn--nxasmq6b.com" "βόλοσ.com."
- 
-+    # Test of valid A-label in locale that cannot display it
-+    #
-+    # +noidnout: The string is sent as-is to the server and the returned qname
-+    #            is displayed in the same form.
-+    # +idnout:   The string is sent as-is to the server and the returned qname
-+    #            is displayed as the corresponding A-label.
-+    #
-+    # The "+[no]idnout" flag has no effect in these cases.
-+    text="Checking valid A-label in C locale"
-+    label="xn--nxasmq6b.com"
-+    LC_ALL=C idna_test "$text" ""                   "$label" "$label."
-+    LC_ALL=C idna_test "$text" "+noidnin +noidnout" "$label" "$label."
-+    LC_ALL=C idna_test "$text" "+noidnin +idnout"   "$label" "$label."
-+    LC_ALL=C idna_test "$text" "+idnin +noidnout"   "$label" "$label."
-+    LC_ALL=C idna_test "$text" "+idnin +idnout"     "$label" "$label."
-+    LC_ALL=C idna_test "$text" "+noidnin +idnout"   "$label" "$label."
-+
- 
- 
-     # Tests of invalid A-labels
--- 
-2.20.1
-
diff --git a/bind-9.11-rh1768258.patch b/bind-9.11-rh1768258.patch
deleted file mode 100644
index 71cd57f..0000000
--- a/bind-9.11-rh1768258.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-From 3466dfd7d44940821f195a36fceb0f1100f77c4e Mon Sep 17 00:00:00 2001
-From: Mark Andrews <marka@isc.org>
-Date: Tue, 5 Nov 2019 12:56:18 +1100
-Subject: [PATCH] The default geoip-directory should be
- <MAXMINDDB_PREFIX>/share/GeoIP
-
-(cherry picked from commit fcd765a59db9b9a2b187448a90f3dbe6aa72fb84)
-(cherry picked from commit 7e79ebeebada6bcca81e8368eef72efbaae3c8c7)
----
- bin/named/config.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/bin/named/config.c b/bin/named/config.c
-index 833c1dc9d3..63da4b03f6 100644
---- a/bin/named/config.c
-+++ b/bin/named/config.c
-@@ -72,7 +72,7 @@ options {\n\
- "	files unlimited;\n"
- #endif
- #if defined(HAVE_GEOIP2) && !defined(WIN32)
--"	geoip-directory \"" MAXMINDDB_PREFIX "/share/GeoIP2\";\n"
-+"	geoip-directory \"" MAXMINDDB_PREFIX "/share/GeoIP\";\n"
- #elif defined(HAVE_GEOIP2)
- "	geoip-directory \".\";\n"
- #endif
--- 
-2.20.1
-
diff --git a/bind.spec b/bind.spec
index 8dae2f7..a0e9182 100644
--- a/bind.spec
+++ b/bind.spec
@@ -169,9 +169,8 @@ Patch183: bind-9.11-rh1736762-5.patch
 # SDB patches
 Patch11: bind-9.3.2b2-sdbsrc.patch
 Patch12: bind-9.10-sdb.patch
-
 # needs inpection
-Patch17: bind-9.3.2b1-fix_sdb_ldap.patch
+Patch13: bind-9.3.2b1-fix_sdb_ldap.patch
 
 Requires(post):   systemd
 Requires(preun):  systemd
@@ -603,7 +602,7 @@ cp -fp contrib/sdb/ldap/{zone2ldap.1,zone2ldap.c} bin/sdb_tools
 cp -fp contrib/sdb/pgsql/zonetodb.c bin/sdb_tools
 cp -fp contrib/sdb/sqlite/zone2sqlite.c bin/sdb_tools
 %patch12 -p1 -b .sdb
-%patch17 -p1 -b .fix_sdb_ldap
+%patch13 -p1 -b .fix_sdb_ldap
 %patch137 -p1 -b .strlcat_fix
 %endif
 

From 29036faad7203e1889c9e320aee09b21c34f8c62 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 1 Apr 2020 19:56:12 +0200
Subject: [PATCH 130/460] Link all used libraries to libisc

Library should link all required libraries. Link all used libraries
directly to libisc. Should help with dynamic linking of -lisc alone.
---
 bind-9.16-libisc-link.patch | 27 +++++++++++++++++++++++++++
 bind.spec                   |  7 ++++++-
 2 files changed, 33 insertions(+), 1 deletion(-)
 create mode 100644 bind-9.16-libisc-link.patch

diff --git a/bind-9.16-libisc-link.patch b/bind-9.16-libisc-link.patch
new file mode 100644
index 0000000..35652df
--- /dev/null
+++ b/bind-9.16-libisc-link.patch
@@ -0,0 +1,27 @@
+From 5ee0a7ace7588b986f41ac68f51b315fece69094 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
+Date: Wed, 1 Apr 2020 14:28:42 +0200
+Subject: [PATCH] Link all required libraries to libisc
+
+It would fail to link -lisc without additional libraries, which should
+not be required.
+---
+ lib/isc/Makefile.in | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/isc/Makefile.in b/lib/isc/Makefile.in
+index 1b6b4466cd..e9df8d1e17 100644
+--- a/lib/isc/Makefile.in
++++ b/lib/isc/Makefile.in
+@@ -81,7 +81,7 @@ SRCS =		pk11.c pk11_result.c \
+ 		symtab.c task.c taskpool.c timer.c \
+ 		tm.c version.c
+ 
+-LIBS =		${OPENSSL_LIBS} @LIBS@
++LIBS =		${OPENSSL_LIBS} ${JSON_C_LIBS} ${LIBXML2_LIBS} ${ZLIB_LIBS} @LIBS@
+ 
+ # Note: the order of SUBDIRS is important.
+ # Attempt to disable parallel processing.
+-- 
+2.21.1
+
diff --git a/bind.spec b/bind.spec
index 941eb4b..10b3495 100644
--- a/bind.spec
+++ b/bind.spec
@@ -68,7 +68,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.16.1
-Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -138,6 +138,7 @@ Patch164:bind-9.11-rh1666814.patch
 Patch170:bind-9.11-feature-test-named.patch
 Patch171:bind-9.11-tests-variants.patch
 Patch172:bind-9.11-tests-pkcs11.patch
+Patch173:bind-9.16-libisc-link.patch
 
 # SDB patches
 Patch12: bind-9.10-sdb.patch
@@ -486,6 +487,7 @@ This package provides a module which allows commands to be sent to rndc directly
 %patch170 -p1 -b .featuretest-named
 %patch171 -p1 -b .test-variant
 %patch172 -p1 -b .test-pkcs11
+%patch173 -p1 -b .link-isc
 
 %if %{with PKCS11}
 %patch135 -p1 -b .config-pkcs11
@@ -1373,6 +1375,9 @@ fi;
 
 
 %changelog
+* Wed Apr 01 2020 Petr Menšík <pemensik@redhat.com> - 32:9.16.1-2
+- Link all used libraries to libisc
+
 * Thu Mar 26 2020 Petr Menšík <pemensik@redhat.com> - 32:9.16.1-1
 - Update to 9.16.1
 

From 74c92fb0da3c6ce36a54dc0b214f4d446420b6fa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 1 Apr 2020 20:17:37 +0200
Subject: [PATCH 131/460] Enable DLZ dependencies without SDB

---
 bind.spec | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index 10b3495..a95a4cf 100644
--- a/bind.spec
+++ b/bind.spec
@@ -177,7 +177,7 @@ BuildRequires:  python3-ply
 BuildRequires:  findutils sed
 BuildRequires:  gnupg2
 BuildRequires:  libuv-devel
-%if %{with SDB}
+%if %{with DLZ}
 BuildRequires:  openldap-devel, libpq-devel, sqlite-devel, mariadb-connector-c-devel
 %endif
 %if %{with BDB}

From ec5a01d972e96367da4d2b61c09beef664fa3bc4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 1 Apr 2020 20:25:56 +0200
Subject: [PATCH 132/460] Remove SDB sections

Since 9.12 BIND no longer ships required files to create SDB version.
Limited support should still be possible with DLZ modules.
---
 README.sdb_pgsql                    |  79 -----
 bind-9.10-sdb.patch                 | 319 -----------------
 bind-9.3.1rc1-sdb_tools-Makefile.in |  63 ----
 bind-9.3.2b1-fix_sdb_ldap.patch     | 519 ----------------------------
 bind.spec                           | 222 +-----------
 dnszone.schema                      | 148 --------
 ldap2zone.1                         |  41 ---
 named-sdb-chroot-setup.service      |  12 -
 named-sdb-chroot.service            |  30 --
 named-sdb.8                         |   1 -
 named-sdb.service                   |  26 --
 zone2sqlite.1                       |  53 ---
 zonetodb.1                          |  53 ---
 13 files changed, 1 insertion(+), 1565 deletions(-)
 delete mode 100644 README.sdb_pgsql
 delete mode 100644 bind-9.10-sdb.patch
 delete mode 100644 bind-9.3.1rc1-sdb_tools-Makefile.in
 delete mode 100644 bind-9.3.2b1-fix_sdb_ldap.patch
 delete mode 100644 dnszone.schema
 delete mode 100644 ldap2zone.1
 delete mode 100644 named-sdb-chroot-setup.service
 delete mode 100644 named-sdb-chroot.service
 delete mode 100644 named-sdb.8
 delete mode 100644 named-sdb.service
 delete mode 100644 zone2sqlite.1
 delete mode 100644 zonetodb.1

diff --git a/README.sdb_pgsql b/README.sdb_pgsql
deleted file mode 100644
index c10c294..0000000
--- a/README.sdb_pgsql
+++ /dev/null
@@ -1,79 +0,0 @@
-			PGSQL BIND SDB driver
-
-The postgresql BIND SDB driver is of experimental status and should not be 
-used for production systems.
-
-Usage:
-
-o Use the named_sdb process ( put ENABLE_SDB=yes in /etc/sysconfig/named )
-
-o Edit your named.conf to contain a database zone, eg. :
-  
-zone "pgdb.net." IN {
-        type master;
-        database "pgsql  bind        pgdb     localhost pguser pgpasswd";
-        #                ^- DB name  ^-Table  ^-host    ^-user ^-password
-};
-
-o Create the database zone table
-  The table must contain the columns "name", "rdtype", and "rdata", and
-  is expected to contain a properly constructed zone.  The program "zonetodb"
-  creates such a table.
-  
-  zonetodb usage:
-    
-    zonetodb origin file dbname dbtable
-
-    where
-	origin : zone origin, eg "pgdb.net."
-	file   : master zone database file, eg. pgdb.net.db
-	dbname : name of postgresql database 
-        dbtable: name of table in database
-
-    Eg. to import this zone in the file 'pgdb.net.db' into the 'bind' database 
-        'pgdb' table:
-
----
-#pgdb.net.db:
-$TTL 1H
-@       SOA     localhost.      root.localhost. (       1
-                                                3H
-                                                1H
-                                                1W
-                                                1H )
-        NS      localhost.
-host1   A       192.168.2.1
-host2   A       192.168.2.2
-host3   A       192.168.2.3
-host4   A       192.168.2.4
-host5   A       192.168.2.5
-host6   A       192.168.2.6
-host7   A       192.168.2.7
----
-
-Issue this command as the pgsql user authorized to update the bind database:
- 
-# zonetodb pgdb.net. pgdb.net.db bind pgdb
-
-will create / update the pgdb table in the 'bind' db:
-
-$ psql -dbind -c 'select * from pgdb;'
-      name      | ttl  | rdtype |                        rdata
-----------------+------+--------+-----------------------------------------------------
- pgdb.net       | 3600 | SOA    | localhost. root.localhost. 1 10800 3600 604800 3600
- pgdb.net       | 3600 | NS     | localhost.
- host1.pgdb.net | 3600 | A      | 192.168.2.1
- host2.pgdb.net | 3600 | A      | 192.168.2.2
- host3.pgdb.net | 3600 | A      | 192.168.2.3
- host4.pgdb.net | 3600 | A      | 192.168.2.4
- host5.pgdb.net | 3600 | A      | 192.168.2.5
- host6.pgdb.net | 3600 | A      | 192.168.2.6
- host7.pgdb.net | 3600 | A      | 192.168.2.7
-(9 rows)
-
-I've tested exactly the above configuration with bind-sdb-9.3.1+ and it works OK.
-
-NOTE: If you use pgsqldb SDB, ensure the postgresql service is started before the named
-      service .
-
-USE AT YOUR OWN RISK!
diff --git a/bind-9.10-sdb.patch b/bind-9.10-sdb.patch
deleted file mode 100644
index ef9a8dc..0000000
--- a/bind-9.10-sdb.patch
+++ /dev/null
@@ -1,319 +0,0 @@
-diff --git a/bin/Makefile.in b/bin/Makefile.in
-index ce7a2da..4e6a824 100644
---- a/bin/Makefile.in
-+++ b/bin/Makefile.in
-@@ -11,8 +11,8 @@ srcdir =	@srcdir@
- VPATH =		@srcdir@
- top_srcdir =	@top_srcdir@
- 
--SUBDIRS =	named named-pkcs11 rndc dig delv dnssec dnssec-pkcs11 tools nsupdate \
--		check confgen @NZD_TOOLS@ @PYTHON_TOOLS@ @PKCS11_TOOLS@ tests
-+SUBDIRS =	named named-sdb named-pkcs11 rndc dig delv dnssec dnssec-pkcs11 tools nsupdate \
-+		check confgen @NZD_TOOLS@ @PYTHON_TOOLS@ @PKCS11_TOOLS@ sdb_tools tests
- TARGETS =
- 
- @BIND9_MAKE_RULES@
-diff --git a/bin/named-sdb/Makefile.in b/bin/named-sdb/Makefile.in
-index 4cfed4d..c6b42b2 100644
---- a/bin/named-sdb/Makefile.in
-+++ b/bin/named-sdb/Makefile.in
-@@ -30,10 +30,10 @@ VERSION=@BIND9_VERSION@
- #
- # Add database drivers here.
- #
--DBDRIVER_OBJS =
--DBDRIVER_SRCS =
-+DBDRIVER_OBJS =	ldapdb.@O@ pgsqldb.@O@ sqlitedb.@O@ dirdb.@O@
-+DBDRIVER_SRCS =	ldapdb.c pgsqldb.c sqlitedb.c dirdb.c
- DBDRIVER_INCLUDES =
--DBDRIVER_LIBS =
-+DBDRIVER_LIBS =	-lldap -llber -lsqlite3 -lpq
- 
- DLZ_DRIVER_DIR =	${top_srcdir}/contrib/dlz/drivers
- 
-@@ -80,7 +80,7 @@ NOSYMLIBS =	${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
- 
- SUBDIRS =	unix
- 
--TARGETS =	named@EXEEXT@ lwresd@EXEEXT@ feature-test@EXEEXT@
-+TARGETS =	named-sdb@EXEEXT@ feature-test-sdb@EXEEXT@
- 
- GEOIPLINKOBJS = geoip.@O@
- GEOIP2LINKOBJS = geoip.@O@
-@@ -154,7 +154,7 @@ server.@O@: server.c
- 		-DPRODUCT=\"${PRODUCT}\" \
- 		-DVERSION=\"${VERSION}\" -c ${srcdir}/server.c
- 
--named@EXEEXT@: ${OBJS} ${DEPLIBS}
-+named-sdb@EXEEXT@: ${OBJS} ${DEPLIBS}
- 	export MAKE_SYMTABLE="yes"; \
- 	export BASEOBJS="${OBJS} ${UOBJS}"; \
- 	${FINALBUILDCMD}
-@@ -168,7 +168,7 @@ feature-test.@O@: ${top_srcdir}/bin/tests/system/feature-test.c
- 	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} \
- 		-c ${top_srcdir}/bin/tests/system/feature-test.c
- 
--feature-test@EXEEXT@: feature-test.@O@
-+feature-test-sdb@EXEEXT@: feature-test.@O@
- 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} \
- 		-o $@ feature-test.@O@ ${ISCLIBS} ${LIBS}
- 
-@@ -190,8 +190,6 @@ statschannel.@O@: bind9.xsl.h
- 
- installdirs:
- 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
--	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man5
--	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
- 
- install-man5: named.conf.5
- 	${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man5
-@@ -201,16 +199,11 @@ install-man8: named.8 lwresd.8
- 
- install-man: install-man5 install-man8
- 
--install:: named@EXEEXT@ lwresd@EXEEXT@ installdirs install-man
--	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named@EXEEXT@ ${DESTDIR}${sbindir}
--	(cd ${DESTDIR}${sbindir}; rm -f lwresd@EXEEXT@; @LN@ named@EXEEXT@ lwresd@EXEEXT@)
-+install:: ${TARGETS} installdirs
-+	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named-sdb@EXEEXT@ ${DESTDIR}${sbindir}
- 
- uninstall::
--	rm -f ${DESTDIR}${mandir}/man5/named.conf.5
--	rm -f ${DESTDIR}${mandir}/man8/lwresd.8
--	rm -f ${DESTDIR}${mandir}/man8/named.8
--	rm -f ${DESTDIR}${sbindir}/lwresd@EXEEXT@
--	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/named@EXEEXT@
-+	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/named-sdb@EXEEXT@
- 
- @DLZ_DRIVER_RULES@
- 
-diff --git a/bin/named-sdb/main.c b/bin/named-sdb/main.c
-index 108b8d6..a943421 100644
---- a/bin/named-sdb/main.c
-+++ b/bin/named-sdb/main.c
-@@ -93,6 +93,10 @@
-  * Include header files for database drivers here.
-  */
- /* #include "xxdb.h" */
-+#include "ldapdb.h"
-+#include "pgsqldb.h"
-+#include "sqlitedb.h"
-+#include "dirdb.h"
- 
- #ifdef CONTRIB_DLZ
- /*
-@@ -1069,6 +1073,11 @@ setup(void) {
- 		ns_main_earlyfatal("isc_app_start() failed: %s",
- 				   isc_result_totext(result));
- 
-+	ldapdb_clear();
-+	pgsqldb_clear();
-+	dirdb_clear();
-+	sqlitedb_clear();
-+
- 	isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
- 		      ISC_LOG_NOTICE, "starting %s %s%s%s <id:%s>",
- 		      ns_g_product, ns_g_version,
-@@ -1269,6 +1278,75 @@ setup(void) {
- 				   isc_result_totext(result));
- #endif
- 
-+        result = ldapdb_init();
-+        if (result != ISC_R_SUCCESS)
-+        {
-+            isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
-+                          ISC_LOG_ERROR, 
-+                          "SDB ldap module initialisation failed: %s.",
-+                          isc_result_totext(result)
-+                );
-+            isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
-+                          ISC_LOG_ERROR, 
-+                          "SDB ldap zone database will be unavailable."
-+                );
-+        }else
-+            isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
-+                          ISC_LOG_NOTICE, "SDB ldap zone database module loaded."
-+                         );
-+
-+        result = pgsqldb_init();
-+        if (result != ISC_R_SUCCESS)
-+        {
-+            isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
-+                          ISC_LOG_ERROR, 
-+                          "SDB pgsql module initialisation failed: %s.",
-+                          isc_result_totext(result)
-+                );
-+            isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
-+                          ISC_LOG_ERROR, 
-+                          "SDB pgsql zone database will be unavailable."
-+                );
-+        }else
-+            isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
-+                          ISC_LOG_NOTICE, "SDB postgreSQL DB zone database module loaded."
-+                         );
-+
-+        result = sqlitedb_init();
-+        if (result != ISC_R_SUCCESS)
-+        {
-+             isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
-+                          ISC_LOG_ERROR, 
-+                          "SDB sqlite3 module initialisation failed: %s.",
-+                          isc_result_totext(result)
-+                );
-+            isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
-+                          ISC_LOG_ERROR, 
-+                          "SDB sqlite3 zone database will be unavailable."
-+                );
-+        }else
-+            isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
-+                          ISC_LOG_NOTICE, "SDB sqlite3 DB zone database module loaded."
-+                         );
-+
-+        result = dirdb_init();
-+        if (result != ISC_R_SUCCESS)
-+        {
-+            isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
-+                          ISC_LOG_ERROR, 
-+                          "SDB directory DB module initialisation failed: %s.",
-+                          isc_result_totext(result)
-+                );
-+            isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
-+                          ISC_LOG_ERROR, 
-+                          "SDB directory DB zone database will be unavailable."
-+                );
-+        }else
-+            isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
-+                          ISC_LOG_NOTICE, "SDB directory DB zone database module loaded."
-+                         );
-+
-+
- 	ns_server_create(ns_g_mctx, &ns_g_server);
- 
- #ifdef HAVE_LIBSECCOMP
-@@ -1311,6 +1389,11 @@ cleanup(void) {
- 
- 	dns_name_destroy();
- 
-+	ldapdb_clear();
-+	pgsqldb_clear();
-+	sqlitedb_clear();
-+	dirdb_clear();
-+
- 	isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
- 		      ISC_LOG_NOTICE, "exiting");
- 	ns_log_shutdown();
-diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
-index 4cfed4d..f4bce7b 100644
---- a/bin/named/Makefile.in
-+++ b/bin/named/Makefile.in
-@@ -45,10 +45,10 @@ DLZDRIVER_LIBS =	@DLZ_DRIVER_LIBS@
- CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
- 		${LWRES_INCLUDES} ${DNS_INCLUDES} ${BIND9_INCLUDES} \
- 		${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} ${ISC_INCLUDES} \
--		${DLZDRIVER_INCLUDES} ${DBDRIVER_INCLUDES} ${MAXMINDDB_CFLAGS} \
-+		${MAXMINDDB_CFLAGS} \
- 		@DST_OPENSSL_INC@
- 
--CDEFINES =      @CONTRIB_DLZ@ @USE_GSSAPI@ @CRYPTO@
-+CDEFINES =      @USE_GSSAPI@ @CRYPTO@
- 
- CWARNINGS =
- 
-@@ -72,11 +72,11 @@ DEPLIBS =	${LWRESDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
- 
- LIBS =		${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
- 		${ISCCFGLIBS} ${ISCCCLIBS} ${ISCLIBS} \
--		${DLZDRIVER_LIBS} ${DBDRIVER_LIBS} @LIBS@
-+		@LIBS@
- 
- NOSYMLIBS =	${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
- 		${ISCCFGLIBS} ${ISCCCLIBS} ${ISCNOSYMLIBS} \
--		${DLZDRIVER_LIBS} ${DBDRIVER_LIBS} @LIBS@
-+		@LIBS@
- 
- SUBDIRS =	unix
- 
-@@ -94,8 +94,7 @@ OBJS =		builtin.@O@ client.@O@ config.@O@ control.@O@ \
- 		tkeyconf.@O@ tsigconf.@O@ update.@O@ xfrout.@O@ \
- 		zoneconf.@O@ \
- 		lwaddr.@O@ lwresd.@O@ lwdclient.@O@ lwderror.@O@ lwdgabn.@O@ \
--		lwdgnba.@O@ lwdgrbn.@O@ lwdnoop.@O@ lwsearch.@O@ \
--		${DLZDRIVER_OBJS} ${DBDRIVER_OBJS}
-+		lwdgnba.@O@ lwdgrbn.@O@ lwdnoop.@O@ lwsearch.@O@
- 
- UOBJS =		unix/os.@O@ unix/dlz_dlopen_driver.@O@
- 
-@@ -113,8 +112,7 @@ SRCS =		builtin.c client.c config.c control.c \
- 		tkeyconf.c tsigconf.c update.c xfrout.c \
- 		zoneconf.c \
- 		lwaddr.c lwresd.c lwdclient.c lwderror.c lwdgabn.c \
--		lwdgnba.c lwdgrbn.c lwdnoop.c lwsearch.c \
--		${DLZDRIVER_SRCS} ${DBDRIVER_SRCS}
-+		lwdgnba.c lwdgrbn.c lwdnoop.c lwsearch.c
- 
- MANPAGES =	named.8 lwresd.8 named.conf.5
- 
-@@ -212,7 +210,5 @@ uninstall::
- 	rm -f ${DESTDIR}${sbindir}/lwresd@EXEEXT@
- 	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/named@EXEEXT@
- 
--@DLZ_DRIVER_RULES@
--
- named-symtbl.@O@: named-symtbl.c
- 	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} -c named-symtbl.c
-diff --git a/bin/sdb_tools/Makefile.in b/bin/sdb_tools/Makefile.in
-index c7e0868..95ab742 100644
---- a/bin/sdb_tools/Makefile.in
-+++ b/bin/sdb_tools/Makefile.in
-@@ -32,11 +32,11 @@ DEPLIBS =	${LWRESDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
- LIBS =		${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
- 		${ISCCFGLIBS} ${ISCCCLIBS} ${ISCLIBS} ${DBDRIVER_LIBS} @LIBS@
- 
--TARGETS =	zone2ldap@EXEEXT@ zonetodb@EXEEXT@
-+TARGETS =	zone2ldap@EXEEXT@ zonetodb@EXEEXT@ zone2sqlite@EXEEXT@
- 
--OBJS	=	zone2ldap.@O@ zonetodb.@O@
-+OBJS	=	zone2ldap.@O@ zonetodb.@O@ zone2sqlite.@O@
- 
--SRCS    =       zone2ldap.c zonetodb.c
-+SRCS    =       zone2ldap.c zonetodb.c zone2sqlite.c
- 
- MANPAGES =      zone2ldap.1
- 
-@@ -50,6 +50,9 @@ zone2ldap@EXEEXT@: zone2ldap.@O@ ${DEPLIBS}
- zonetodb@EXEEXT@: zonetodb.@O@  ${DEPLIBS}
- 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ zonetodb.@O@ -lpq ${LIBS}
- 
-+zone2sqlite@EXEEXT@: zone2sqlite.@O@  ${DEPLIBS}
-+	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${ALL_CFLAGS} ${LDFLAGS} -o $@ zone2sqlite.@O@ -lsqlite3 -lssl ${LIBS}
-+
- clean distclean manclean maintainer-clean::
- 	rm -f ${TARGETS} ${OBJS}
- 
-@@ -60,4 +63,5 @@ installdirs:
- install:: ${TARGETS} installdirs
- 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zone2ldap@EXEEXT@ ${DESTDIR}${sbindir}
- 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zonetodb@EXEEXT@  ${DESTDIR}${sbindir}
-+	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zone2sqlite@EXEEXT@ ${DESTDIR}${sbindir}
- 	${INSTALL_DATA} ${srcdir}/zone2ldap.1 ${DESTDIR}${mandir}/man1/zone2ldap.1
-diff --git a/configure.ac b/configure.ac
-index f6380b1..318e533 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -5416,6 +5416,8 @@ AC_CONFIG_FILES([
- 	bin/named/unix/Makefile
- 	bin/named-pkcs11/Makefile
- 	bin/named-pkcs11/unix/Makefile
-+	bin/named-sdb/Makefile
-+	bin/named-sdb/unix/Makefile
- 	bin/nsupdate/Makefile
- 	bin/pkcs11/Makefile
- 	bin/python/Makefile
-@@ -5440,6 +5442,7 @@ AC_CONFIG_FILES([
- 	bin/python/isc/tests/dnskey_test.py
- 	bin/python/isc/tests/policy_test.py
- 	bin/rndc/Makefile
-+	bin/sdb_tools/Makefile
- 	bin/tests/Makefile
- 	bin/tests/headerdep_test.sh
- 	bin/tests/optional/Makefile
diff --git a/bind-9.3.1rc1-sdb_tools-Makefile.in b/bind-9.3.1rc1-sdb_tools-Makefile.in
deleted file mode 100644
index c7e0868..0000000
--- a/bind-9.3.1rc1-sdb_tools-Makefile.in
+++ /dev/null
@@ -1,63 +0,0 @@
-srcdir     =	@srcdir@
-VPATH      =	@srcdir@
-top_srcdir =	@top_srcdir@
-
-VERSION=@BIND9_VERSION@
-
-@BIND9_MAKE_INCLUDES@
-
-CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include \
-		${LWRES_INCLUDES} ${DNS_INCLUDES} ${BIND9_INCLUDES} \
-		${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} ${ISC_INCLUDES}
-
-CDEFINES =	-DBIND9
-
-DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
-ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
-ISCCCLIBS =	../../lib/isccc/libisccc.@A@
-ISCLIBS =	../../lib/isc/libisc.@A@
-LWRESLIBS =	../../lib/lwres/liblwres.@A@
-BIND9LIBS =	../../lib/bind9/libbind9.@A@
-
-DNSDEPLIBS =	../../lib/dns/libdns.@A@
-ISCCFGDEPLIBS =	../../lib/isccfg/libisccfg.@A@
-ISCCCDEPLIBS =	../../lib/isccc/libisccc.@A@
-ISCDEPLIBS =	../../lib/isc/libisc.@A@
-LWRESDEPLIBS =	../../lib/lwres/liblwres.@A@
-BIND9DEPLIBS =	../../lib/bind9/libbind9.@A@
-
-DEPLIBS =	${LWRESDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
-		${ISCCFGDEPLIBS} ${ISCCCDEPLIBS} ${ISCDEPLIBS}
-
-LIBS =		${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
-		${ISCCFGLIBS} ${ISCCCLIBS} ${ISCLIBS} ${DBDRIVER_LIBS} @LIBS@
-
-TARGETS =	zone2ldap@EXEEXT@ zonetodb@EXEEXT@
-
-OBJS	=	zone2ldap.@O@ zonetodb.@O@
-
-SRCS    =       zone2ldap.c zonetodb.c
-
-MANPAGES =      zone2ldap.1
-
-EXT_CFLAGS =
-
-@BIND9_MAKE_RULES@
-
-zone2ldap@EXEEXT@: zone2ldap.@O@ ${DEPLIBS}
-	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ zone2ldap.@O@ -lldap -llber ${LIBS}
-
-zonetodb@EXEEXT@: zonetodb.@O@  ${DEPLIBS}
-	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ zonetodb.@O@ -lpq ${LIBS}
-
-clean distclean manclean maintainer-clean::
-	rm -f ${TARGETS} ${OBJS}
-
-installdirs:
-	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
-	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man1
-
-install:: ${TARGETS} installdirs
-	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zone2ldap@EXEEXT@ ${DESTDIR}${sbindir}
-	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zonetodb@EXEEXT@  ${DESTDIR}${sbindir}
-	${INSTALL_DATA} ${srcdir}/zone2ldap.1 ${DESTDIR}${mandir}/man1/zone2ldap.1
diff --git a/bind-9.3.2b1-fix_sdb_ldap.patch b/bind-9.3.2b1-fix_sdb_ldap.patch
deleted file mode 100644
index 35c8542..0000000
--- a/bind-9.3.2b1-fix_sdb_ldap.patch
+++ /dev/null
@@ -1,519 +0,0 @@
-diff --git a/bin/sdb_tools/Makefile.in b/bin/sdb_tools/Makefile.in
-index 95ab742..6069f09 100644
---- a/bin/sdb_tools/Makefile.in
-+++ b/bin/sdb_tools/Makefile.in
-@@ -32,11 +32,11 @@ DEPLIBS =	${LWRESDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
- LIBS =		${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
- 		${ISCCFGLIBS} ${ISCCCLIBS} ${ISCLIBS} ${DBDRIVER_LIBS} @LIBS@
- 
--TARGETS =	zone2ldap@EXEEXT@ zonetodb@EXEEXT@ zone2sqlite@EXEEXT@
-+TARGETS =	zone2ldap@EXEEXT@ ldap2zone@EXEEXT@ zonetodb@EXEEXT@ zone2sqlite@EXEEXT@
- 
--OBJS	=	zone2ldap.@O@ zonetodb.@O@ zone2sqlite.@O@
-+OBJS	=	zone2ldap.@O@ ldap2zone.@O@ zonetodb.@O@ zone2sqlite.@O@
- 
--SRCS    =       zone2ldap.c zonetodb.c zone2sqlite.c
-+SRCS    =       zone2ldap.c ldap2zone.c zonetodb.c zone2sqlite.c
- 
- MANPAGES =      zone2ldap.1
- 
-@@ -53,6 +53,9 @@ zonetodb@EXEEXT@: zonetodb.@O@  ${DEPLIBS}
- zone2sqlite@EXEEXT@: zone2sqlite.@O@  ${DEPLIBS}
- 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${ALL_CFLAGS} ${LDFLAGS} -o $@ zone2sqlite.@O@ -lsqlite3 -lssl ${LIBS}
- 
-+ldap2zone@EXEEXT@: ldap2zone.@O@ ${DEPLIBS}
-+	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${ALL_CFLAGS} ${LDFLAGS} -o $@ ldap2zone.@O@ -lldap -llber ${LIBS}
-+
- clean distclean manclean maintainer-clean::
- 	rm -f ${TARGETS} ${OBJS}
- 
-@@ -62,6 +65,7 @@ installdirs:
- 
- install:: ${TARGETS} installdirs
- 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zone2ldap@EXEEXT@ ${DESTDIR}${sbindir}
-+	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} ldap2zone@EXEEXT@ ${DESTDIR}${sbindir}
- 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zonetodb@EXEEXT@  ${DESTDIR}${sbindir}
- 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zone2sqlite@EXEEXT@ ${DESTDIR}${sbindir}
- 	${INSTALL_DATA} ${srcdir}/zone2ldap.1 ${DESTDIR}${mandir}/man1/zone2ldap.1
-diff --git a/bin/sdb_tools/zone2ldap.c b/bin/sdb_tools/zone2ldap.c
-index aa2c711..76186b5 100644
---- a/bin/sdb_tools/zone2ldap.c
-+++ b/bin/sdb_tools/zone2ldap.c
-@@ -66,6 +66,9 @@ ldap_info;
- /* usage Info */
- void usage (void);
- 
-+/* Check for existence of (and possibly add) containing dNSZone objects */
-+int lookup_dns_zones( ldap_info *ldinfo);
-+
- /* Add to the ldap dit */
- void add_ldap_values (ldap_info * ldinfo);
- 
-@@ -82,7 +85,7 @@ char **hostname_to_dn_list (char *hostname, char *zone, unsigned int flags);
- int get_attr_list_size (char **tmp);
- 
- /* Get a DN */
--char *build_dn_from_dc_list (char **dc_list, unsigned int ttl, int flag);
-+char *build_dn_from_dc_list (char **dc_list, unsigned int ttl, int flag, char *zone);
- 
- /* Add to RR list */
- void add_to_rr_list (char *dn, char *name, char *type, char *data,
-@@ -104,11 +107,27 @@ void
- init_ldap_conn ();
- void usage();
- 
--char *argzone, *ldapbase, *binddn, *bindpw = NULL;
--const char *ldapsystem = "localhost";
--static const char *objectClasses[] =
--  { "top", "dNSZone", NULL };
--static const char *topObjectClasses[] = { "top", NULL };
-+static char *argzone, *ldapbase, *binddn, *bindpw = NULL;
-+
-+/* these are needed to placate gcc4's const-ness const-ernations : */
-+static char localhost[] = "localhost";
-+static char *ldapsystem=&(localhost[0]);
-+/* dnszone schema class names: */
-+static char topClass    [] ="top";
-+static char dNSZoneClass[] ="dNSZone";
-+static char objectClass [] ="objectClass";
-+static char dcObjectClass[]="dcObject";
-+/* dnszone schema attribute names: */
-+static char relativeDomainName[]="relativeDomainName";
-+static char dNSTTL            []="dNSTTL";
-+static char zoneName          []="zoneName";
-+static char dc                []="dc";
-+static char sameZone          []="@";
-+/* LDAPMod mod_values: */
-+static char *objectClasses    []= { &(topClass[0]), &(dNSZoneClass[0]), NULL };
-+static char *topObjectClasses []= { &(topClass[0]), &(dcObjectClass[0]), &(dNSZoneClass[0]), NULL };
-+static char *dn_buffer      [64]={NULL};
-+
- LDAP *conn;
- unsigned int debug = 0;
- 
-@@ -132,12 +151,12 @@ main (int argc, char **argv)
-   isc_result_t result;
-   char *basedn;
-   ldap_info *tmp;
--  LDAPMod *base_attrs[2];
--  LDAPMod base;
-+  LDAPMod *base_attrs[5];
-+  LDAPMod base, dcBase, znBase, rdnBase;
-   isc_buffer_t buff;
-   char *zonefile=0L;
-   char fullbasedn[1024];
--  char *ctmp;
-+  char *ctmp, *zn, *dcp[2], *znp[2], *rdn[2];
-   dns_fixedname_t fixedzone, fixedname;
-   dns_rdataset_t rdataset;
-   char **dc_list;
-@@ -150,7 +169,7 @@ main (int argc, char **argv)
-   extern char *optarg;
-   extern int optind, opterr, optopt;
-   int create_base = 0;
--  int topt;
-+  int topt, dcn, zdn, znlen;
- 
-   if (argc < 2)
-     {
-@@ -158,7 +177,7 @@ main (int argc, char **argv)
-       exit (-1);
-     }
- 
--  while ((topt = getopt (argc, argv, "D:w:b:z:f:h:?dcv")) != -1)
-+  while ((topt = getopt (argc, argv, "D:Ww:b:z:f:h:?dcv")) != -1)
-     {
-       switch (topt)
- 	{
-@@ -181,6 +200,9 @@ main (int argc, char **argv)
- 	  if (bindpw == NULL)
- 	    fatal("strdup");
- 	  break;
-+	case 'W':
-+	  bindpw = getpass("Enter LDAP Password: ");
-+	  break;
- 	case 'b':
- 	  ldapbase = strdup (optarg);
- 	  if (ldapbase == NULL)
-@@ -300,27 +322,62 @@ main (int argc, char **argv)
-     {
-       if (debug)
- 	printf ("Creating base zone DN %s\n", argzone);
--
-+      
-       dc_list = hostname_to_dn_list (argzone, argzone, DNS_TOP);
--      basedn = build_dn_from_dc_list (dc_list, 0, NO_SPEC);
- 
--      for (ctmp = &basedn[strlen (basedn)]; ctmp >= &basedn[0]; ctmp--)
-+      basedn = build_dn_from_dc_list (dc_list, 0, NO_SPEC, argzone);
-+      if (debug)
-+	printf ("base DN %s\n", basedn);
-+
-+      for (ctmp = &basedn[strlen (basedn)], dcn=0; ctmp >= &basedn[0]; ctmp--)
- 	{
--	  if ((*ctmp == ',') || (ctmp == &basedn[0]))
-+	    if ((*ctmp == ',') || (ctmp == &basedn[0]))
- 	    {
-+
- 	      base.mod_op = LDAP_MOD_ADD;
--	      base.mod_type = (char*)"objectClass";
--	      base.mod_values = (char**)topObjectClasses;
-+	      base.mod_type = objectClass;
-+	      base.mod_values = topObjectClasses;
- 	      base_attrs[0] = (void*)&base;
--	      base_attrs[1] = NULL;
--
-+	     
-+	      dcBase.mod_op = LDAP_MOD_ADD;
-+	      dcBase.mod_type = dc;
-+	      dcp[0]=dc_list[dcn];
-+	      dcp[1]=0L;
-+	      dcBase.mod_values=dcp;
-+	      base_attrs[1] = (void*)&dcBase;
-+
-+	      znBase.mod_op = LDAP_MOD_ADD;
-+	      znBase.mod_type = zoneName;	      
-+	      for( zdn = dcn, znlen = 0; zdn >= 0; zdn-- )
-+		  znlen += strlen(dc_list[zdn])+1;
-+	      znp[0] = (char*)malloc(znlen+1);
-+	      znp[1] = 0L;
-+	      for( zdn = dcn, zn=znp[0]; zdn >= 0; zdn-- )		  
-+		  zn+=sprintf(zn,"%s%s",dc_list[zdn], 
-+			      ((zdn > 0) && (*(dc_list[zdn-1])!='.')) ? "." : ""
-+		             );
-+
-+	      znBase.mod_values = znp;
-+	      base_attrs[2] = (void*)&znBase;
-+
-+	      rdnBase.mod_op = LDAP_MOD_ADD;
-+	      rdnBase.mod_type = relativeDomainName;
-+	      rdn[0] = strdup(sameZone);
-+	      rdn[1] = 0L;
-+	      rdnBase.mod_values = rdn;
-+	      base_attrs[3] = (void*)&rdnBase;
-+	      
-+	      dcn++;
-+
-+	      base.mod_values = topObjectClasses;
-+	      base_attrs[4] = NULL;	      
-+	      
- 	      if (ldapbase)
- 		{
- 		  if (ctmp != &basedn[0])
- 		    sprintf (fullbasedn, "%s,%s", ctmp + 1, ldapbase);
- 		  else
--		    sprintf (fullbasedn, "%s,%s", ctmp, ldapbase);
--
-+		    sprintf (fullbasedn, "%s,%s", ctmp, ldapbase);		  
- 		}
- 	      else
- 		{
-@@ -329,8 +386,13 @@ main (int argc, char **argv)
- 		  else
- 		    sprintf (fullbasedn, "%s", ctmp);
- 		}
-+
-+	      if( debug )
-+		  printf("Full base dn: %s\n", fullbasedn);
-+
- 	      result = ldap_add_s (conn, fullbasedn, base_attrs);
- 	      ldap_result_check ("intial ldap_add_s", fullbasedn, result);
-+
- 	    }
- 
- 	}
-@@ -408,14 +470,14 @@ generate_ldap (dns_name_t * dnsname, dns_rdata_t * rdata, unsigned int ttl)
-   isc_result_check (result, "dns_rdata_totext");
-   data[isc_buffer_usedlength (&buff)] = 0;
- 
--  dc_list = hostname_to_dn_list (name, argzone, DNS_OBJECT);
-+  dc_list = hostname_to_dn_list ((char*)name, argzone, DNS_OBJECT);
-   len = (get_attr_list_size (dc_list) - 2);
--  dn = build_dn_from_dc_list (dc_list, ttl, WI_SPEC);
-+  dn = build_dn_from_dc_list (dc_list, ttl, WI_SPEC, argzone);
- 
-   if (debug)
-     printf ("Adding %s (%s %s) to run queue list.\n", dn, type, data);
- 
--  add_to_rr_list (dn, dc_list[len], type, data, ttl, DNS_OBJECT);
-+  add_to_rr_list (dn, dc_list[len], (char*)type, (char*)data, ttl, DNS_OBJECT);
- }
- 
- 
-@@ -455,7 +517,8 @@ add_to_rr_list (char *dn, char *name, char *type,
-   int attrlist;
-   char ldap_type_buffer[128];
-   char charttl[64];
--
-+  char *zn;
-+  int znlen;
- 
-   if ((tmp = locate_by_dn (dn)) == NULL)
-     {
-@@ -482,13 +545,13 @@ add_to_rr_list (char *dn, char *name, char *type,
- 	    fatal("malloc");
- 	}
-       tmp->attrs[0]->mod_op = LDAP_MOD_ADD;
--      tmp->attrs[0]->mod_type = (char*)"objectClass";
-+      tmp->attrs[0]->mod_type = objectClass;
- 
-       if (flags == DNS_OBJECT)
--	tmp->attrs[0]->mod_values = (char**)objectClasses;
-+	tmp->attrs[0]->mod_values = objectClasses;
-       else
- 	{
--	  tmp->attrs[0]->mod_values = (char**)topObjectClasses;
-+	  tmp->attrs[0]->mod_values =topObjectClasses;
- 	  tmp->attrs[1] = NULL;
- 	  tmp->attrcnt = 2;
- 	  tmp->next = ldap_info_base;
-@@ -497,7 +560,7 @@ add_to_rr_list (char *dn, char *name, char *type,
- 	}
- 
-       tmp->attrs[1]->mod_op = LDAP_MOD_ADD;
--      tmp->attrs[1]->mod_type = (char*)"relativeDomainName";
-+      tmp->attrs[1]->mod_type = relativeDomainName;
-       tmp->attrs[1]->mod_values = (char **) calloc (sizeof (char *), 2);
- 
-       if (tmp->attrs[1]->mod_values == (char **)NULL)
-@@ -526,7 +589,7 @@ add_to_rr_list (char *dn, char *name, char *type,
- 	 fatal("strdup");
- 
-       tmp->attrs[3]->mod_op = LDAP_MOD_ADD;
--      tmp->attrs[3]->mod_type = (char*)"dNSTTL";
-+      tmp->attrs[3]->mod_type = dNSTTL;
-       tmp->attrs[3]->mod_values = (char **) calloc (sizeof (char *), 2);
- 
-       if (tmp->attrs[3]->mod_values == (char **)NULL)
-@@ -539,14 +602,25 @@ add_to_rr_list (char *dn, char *name, char *type,
-       if (tmp->attrs[3]->mod_values[0] == NULL)
- 	 fatal("strdup");
- 
-+      znlen=strlen(gbl_zone);      
-+      if ( *(gbl_zone + (znlen-1)) == '.' )
-+      { /* ldapdb MUST search by relative zone name */
-+	  zn = (char*)malloc(znlen);
-+	  strncpy(zn,gbl_zone,znlen-1);
-+	  *(zn + (znlen-1))='\0';	  
-+      }else
-+      {
-+	  zn = gbl_zone;
-+      }
-+
-       tmp->attrs[4]->mod_op = LDAP_MOD_ADD;
--      tmp->attrs[4]->mod_type = (char*)"zoneName";
-+      tmp->attrs[4]->mod_type = zoneName;
-       tmp->attrs[4]->mod_values = (char **)calloc(sizeof(char *), 2);
- 
-       if (tmp->attrs[4]->mod_values == (char **)NULL)
- 	 fatal("calloc");
- 
--      tmp->attrs[4]->mod_values[0] = gbl_zone;
-+      tmp->attrs[4]->mod_values[0] = zn;
-       tmp->attrs[4]->mod_values[1] = NULL;
- 
-       tmp->attrs[5] = NULL;
-@@ -557,7 +631,7 @@ add_to_rr_list (char *dn, char *name, char *type,
-   else
-     {
- 
--      for (i = 0; tmp->attrs[i] != NULL; i++)
-+	for (i = 0; tmp->attrs[i] != NULL; i++)
- 	{
- 	  sprintf (ldap_type_buffer, "%sRecord", type);
- 	  if (!strncmp
-@@ -631,44 +705,70 @@ char **
- hostname_to_dn_list (char *hostname, char *zone, unsigned int flags)
- {
-   char *tmp;
--  static char *dn_buffer[64];
-   int i = 0;
--  char *zname;
--  char *hnamebuff;
--
--  zname = strdup (hostname);
--  if (zname == NULL)
--	fatal("strdup");
--
--  if (flags == DNS_OBJECT)
--    {
--
--      if (strlen (zname) != strlen (zone))
--	{
--	  tmp = &zname[strlen (zname) - strlen (zone)];
--	  *--tmp = '\0';
--	  hnamebuff = strdup (zname);
--	  if (hnamebuff == NULL)
--		fatal("strdup");
--	  zname = ++tmp;
--	}
--      else
--	hnamebuff = (char*)"@";
--    }
--  else
--    {
--      zname = zone;
--      hnamebuff = NULL;
--    }
--
--  for (tmp = strrchr (zname, '.'); tmp != (char *) 0;
--       tmp = strrchr (zname, '.'))
--    {
--      *tmp++ = '\0';
--      dn_buffer[i++] = tmp;
--    }
--  dn_buffer[i++] = zname;
--  dn_buffer[i++] = hnamebuff;
-+  char *hname=0L, *last=0L;
-+  int hlen=strlen(hostname), zlen=(strlen(zone));
-+
-+/*  printf("hostname: %s zone: %s\n",hostname, zone); */
-+  hname=0L;
-+  if(flags == DNS_OBJECT)
-+  {
-+      if( (zone[ zlen - 1 ] == '.') && (hostname[hlen - 1] != '.') )
-+      {
-+	  hname=(char*)malloc(hlen + 1);
-+	  hlen += 1;
-+	  sprintf(hname, "%s.", hostname);
-+	  hostname = hname;
-+      }
-+      if(strcmp(hostname, zone) == 0)
-+      {
-+	  if( hname == 0 )
-+	      hname=strdup(hostname);
-+  	  last = strdup(sameZone);
-+      }else
-+      {	   
-+	  if(  (hlen < zlen) 
-+	     ||( strcmp( hostname + (hlen - zlen), zone ) != 0)
-+	    )
-+	  {
-+	      if( hname != 0 )
-+		  free(hname);
-+	      hname=(char*)malloc( hlen + zlen + 1);
-+	      if( *zone == '.' )
-+		  sprintf(hname, "%s%s", hostname, zone);
-+	      else
-+		  sprintf(hname,"%s",zone);
-+	  }else
-+	  {
-+	      if( hname == 0 )
-+		  hname = strdup(hostname);
-+	  }
-+	  last = hname;
-+      }
-+  }else
-+  { /* flags == DNS_TOP */
-+      hname = strdup(zone);
-+      last = hname;
-+  }
-+
-+  for (tmp = strrchr (hname, '.'); tmp != (char *) 0;
-+       tmp = strrchr (hname, '.'))
-+  {
-+      if( *( tmp + 1 ) != '\0' )
-+      {
-+	  *tmp = '\0';
-+	  dn_buffer[i++] = ++tmp;
-+      }else
-+      { /* trailing '.' ! */
-+	  dn_buffer[i++] = strdup(".");
-+	  *tmp = '\0';
-+	  if( tmp == hname )
-+	      break;
-+      }	  
-+  }
-+  if( ( last != hname ) && (tmp != hname) )
-+      dn_buffer[i++] = hname;
-+  dn_buffer[i++] = last;
-   dn_buffer[i] = NULL;
- 
-   return dn_buffer;
-@@ -680,24 +780,32 @@ hostname_to_dn_list (char *hostname, char *zone, unsigned int flags)
-  * exception of "@"/SOA. */
- 
- char *
--build_dn_from_dc_list (char **dc_list, unsigned int ttl, int flag)
-+build_dn_from_dc_list (char **dc_list, unsigned int ttl, int flag, char *zone)
- {
-   int size;
--  int x;
-+  int x, znlen;
-   static char dn[1024];
-   char tmp[128];
-+  char zn[DNS_NAME_MAXTEXT+1];
- 
-   bzero (tmp, sizeof (tmp));
-   bzero (dn, sizeof (dn));
-   size = get_attr_list_size (dc_list);
-+  znlen = strlen(zone);
-+  if ( *(zone + (znlen-1)) == '.' )
-+  { /* ldapdb MUST search by relative zone name */
-+      memcpy(&(zn[0]),zone,znlen-1);
-+      *(zn + (znlen-1))='\0';
-+      zone = zn;
-+  }
-   for (x = size - 2; x > 0; x--)
-     {
-     if (flag == WI_SPEC)
-     {
-       if (x == (size - 2) && (strncmp (dc_list[x], "@", 1) == 0) && (ttl))
--	sprintf (tmp, "relativeDomainName=%s + dNSTTL=%u,", dc_list[x], ttl);
-+	sprintf (tmp, "zoneName=%s + relativeDomainName=%s,", zone, dc_list[x]);
-       else if (x == (size - 2))
--	      sprintf(tmp, "relativeDomainName=%s,",dc_list[x]);
-+	      sprintf(tmp, "zoneName=%s + relativeDomainName=%s,", zone, dc_list[x]);
-       else
- 	      sprintf(tmp,"dc=%s,", dc_list[x]);
-     }
-@@ -723,6 +831,7 @@ void
- init_ldap_conn ()
- {
-   int result;
-+  char ldb_tag[]="LDAP Bind";
-   conn = ldap_open (ldapsystem, LDAP_PORT);
-   if (conn == NULL)
-     {
-@@ -732,7 +841,7 @@ init_ldap_conn ()
-     }
- 
-   result = ldap_simple_bind_s (conn, binddn, bindpw);
--  ldap_result_check ("ldap_simple_bind_s", (char*)"LDAP Bind", result);
-+  ldap_result_check ("ldap_simple_bind_s", ldb_tag , result);
- }
- 
- /* Like isc_result_check, only for LDAP */
-@@ -749,8 +858,6 @@ ldap_result_check (const char *msg, char *dn, int err)
-     }
- }
- 
--
--
- /* For running the ldap_info run queue. */
- void
- add_ldap_values (ldap_info * ldinfo)
-@@ -758,14 +865,14 @@ add_ldap_values (ldap_info * ldinfo)
-   int result;
-   char dnbuffer[1024];
- 
--
-   if (ldapbase != NULL)
-     sprintf (dnbuffer, "%s,%s", ldinfo->dn, ldapbase);
-   else
-     sprintf (dnbuffer, "%s", ldinfo->dn);
- 
-   result = ldap_add_s (conn, dnbuffer, ldinfo->attrs);
--  ldap_result_check ("ldap_add_s", dnbuffer, result);
-+    ldap_result_check ("ldap_add_s", dnbuffer, result);
-+
- }
- 
- 
-@@ -776,5 +883,5 @@ void
- usage ()
- {
-   fprintf (stderr,
--	   "zone2ldap -D [BIND DN] -w [BIND PASSWORD] -b [BASE DN] -z [ZONE] -f [ZONE FILE] -h [LDAP HOST] "
-+	   "zone2ldap -D [BIND DN] [-w BIND PASSWORD | -W:prompt] -b [BASE DN] -z [ZONE] -f [ZONE FILE] -h [LDAP HOST] "
- 	   "[-c Create LDAP Base structure][-d Debug Output (lots !)] \n ");}
diff --git a/bind.spec b/bind.spec
index a95a4cf..1b5b869 100644
--- a/bind.spec
+++ b/bind.spec
@@ -10,9 +10,6 @@
 # bcond_without is built by default, unless --without X is passed
 # bcond_with is built only when --with X is passed to build
 %bcond_with    SYSTEMTEST
-# TODO: sdb tools from contrib were removed.
-# Disable SDB for now
-%bcond_with SDB
 %bcond_without GSSTSIG
 # it is not possible to build the package without PKCS11 sub-package
 # due to extensive changes to Makefiles
@@ -21,7 +18,6 @@
 %bcond_without LMDB
 %bcond_without JSON
 %bcond_without DNSTAP
-# TODO: mysql is not well suported without SDB.
 %bcond_with    BDB
 # skip DLZ for now
 %bcond_without DLZ
@@ -38,9 +34,6 @@
 %{?!bind_gid:  %global bind_gid  25}
 %global        bind_dir          /var/named
 %global        chroot_prefix     %{bind_dir}/chroot
-%if %{with SDB}
-%global        chroot_sdb_prefix %{bind_dir}/chroot_sdb
-%endif
 %global        chroot_create_directories /dev /run/named %{_localstatedir}/{log,named,tmp} \\\
                                          %{_sysconfdir}/{crypto-policies/back-ends,pki/dnssec-keys,named} \\\
                                          %{_libdir}/bind %{_datadir}/GeoIP
@@ -77,9 +70,6 @@ Source1:  named.sysconfig
 Source2:  https://ftp.isc.org/isc/bind9/%{BINDVERSION}/bind-%{BINDVERSION}.tar.xz.asc
 Source3:  named.logrotate
 Source4:  https://downloads.isc.org/isc/pgpkeys/codesign2019.txt
-Source7:  bind-9.3.1rc1-sdb_tools-Makefile.in
-Source8:  dnszone.schema
-Source12: README.sdb_pgsql
 Source16: named.conf
 # Refresh by command: dig @a.root-servers.net. +tcp +norec
 # or from URL
@@ -90,22 +80,14 @@ Source20: named.empty
 Source23: named.rfc1912.zones
 Source25: named.conf.sample
 Source27: named.root.key
-Source30: ldap2zone.c
-Source31: ldap2zone.1
-Source32: named-sdb.8
-Source33: zonetodb.1
-Source34: zone2sqlite.1
 Source35: bind.tmpfiles.d
 Source36: trusted-key.key
 Source37: named.service
 Source38: named-chroot.service
-Source39: named-sdb.service
-Source40: named-sdb-chroot.service
 Source41: setup-named-chroot.sh
 Source42: generate-rndc-key.sh
 Source43: named.rwtab
 Source44: named-chroot-setup.service
-Source45: named-sdb-chroot-setup.service
 Source46: named-setup-rndc.service
 Source47: named-pkcs11.service
 Source48: setup-named-softhsm.sh
@@ -140,12 +122,6 @@ Patch171:bind-9.11-tests-variants.patch
 Patch172:bind-9.11-tests-pkcs11.patch
 Patch173:bind-9.16-libisc-link.patch
 
-# SDB patches
-Patch12: bind-9.10-sdb.patch
-
-# needs inpection
-Patch17: bind-9.3.2b1-fix_sdb_ldap.patch
-
 Requires(post):   systemd
 Requires(preun):  systemd
 Requires(postun): systemd
@@ -268,25 +244,6 @@ This a set of development files for BIND libraries (dns, isc) compiled
 with native PKCS#11 functionality.
 %endif
 
-%if %{with SDB}
-%package sdb
-Summary: BIND server with database backends and DLZ support
-Requires: systemd
-Requires: bind%{?_isa} = %{epoch}:%{version}-%{release}
-Requires: bind-libs%{?_isa} = %{epoch}:%{version}-%{release}
-Requires: bind-libs-lite%{?_isa} = %{epoch}:%{version}-%{release}
-
-%description sdb
-BIND (Berkeley Internet Name Domain) is an implementation of the DNS
-(Domain Name System) protocols. BIND includes a DNS server (named-sdb)
-which has compiled-in SDB (Simplified Database Backend) which includes
-support for using alternative Zone Databases stored in an LDAP server
-(ldapdb), a postgreSQL database (pgsqldb), an sqlite database (sqlitedb),
-or in the filesystem (dirdb), in addition to the standard in-memory RBT
-(Red Black Tree) zone database. It also includes support for DLZ
-(Dynamic Loadable Zones)
-%endif
-
 %package libs-lite
 Summary:  Libraries for working with the DNS protocol
 Obsoletes:bind-libbind-devel < 31:9.3.3-4.fc7
@@ -393,20 +350,6 @@ This package contains a tree of files which can be used as a
 chroot(2) jail for the named(8) program from the BIND package.
 Based on the code from Jan "Yenya" Kasprzak <kas@fi.muni.cz>
 
-%if %{with SDB}
-%package sdb-chroot
-Summary:        A chroot runtime environment for the ISC BIND DNS server, named-sdb(8)
-Prefix:         %{chroot_sdb_prefix}
-# grep is required due to setup-named-chroot.sh script
-Requires:       grep
-Requires:       bind-sdb%{?_isa} = %{epoch}:%{version}-%{release}
-
-%description sdb-chroot
-This package contains a tree of files which can be used as a
-chroot(2) jail for the named-sdb(8) program from the BIND package.
-Based on the code from Jan "Yenya" Kasprzak <kas@fi.muni.cz>
-%endif
-
 
 %if %{with DLZ}
 %if %{with BDB}
@@ -500,32 +443,6 @@ cp -r lib/ns{,-pkcs11}
 %patch150 -p1 -b .engine-pkcs11
 %endif
 
-%if %{with SDB}
-mkdir bin/named-sdb
-cp -r bin/named/* bin/named-sdb
-# SDB ldap
-cp -fp contrib/sdb/ldap/ldapdb.[ch] bin/named-sdb
-# SDB postgreSQL
-cp -fp contrib/sdb/pgsql/pgsqldb.[ch] bin/named-sdb
-# SDB sqlite
-cp -fp contrib/sdb/sqlite/sqlitedb.[ch] bin/named-sdb
-# SDB Berkeley DB - needs to be ported to DB4!
-#cp -fp contrib/sdb/bdb/bdb.[ch] bin/named_sdb
-# SDB dir
-cp -fp contrib/sdb/dir/dirdb.[ch] bin/named-sdb
-# SDB tools
-mkdir -p bin/sdb_tools
-cp -fp %{SOURCE30} bin/sdb_tools/ldap2zone.c
-cp -fp %{SOURCE7} bin/sdb_tools/Makefile.in
-#cp -fp contrib/sdb/bdb/zone2bdb.c bin/sdb_tools
-cp -fp contrib/sdb/ldap/{zone2ldap.1,zone2ldap.c} bin/sdb_tools
-cp -fp contrib/sdb/pgsql/zonetodb.c bin/sdb_tools
-cp -fp contrib/sdb/sqlite/zone2sqlite.c bin/sdb_tools
-%patch12 -p1 -b .sdb
-%patch17 -p1 -b .fix_sdb_ldap
-%patch137 -p1 -b .strlcat_fix
-%endif
-
 %patch133 -p1 -b .rh640538
 #%patch134 -p1 -b .rh669163
 
@@ -534,11 +451,6 @@ cp -fp contrib/sdb/sqlite/zone2sqlite.c bin/sdb_tools
 for i in bin/named/{,unix}/Makefile.in; do
   sed -i 's|fpie|fPIE|g' $i
 done
-%if %{with SDB}
-for i in bin/named-sdb/{,unix}/Makefile.in; do
-  sed -i 's|fpie|fPIE|g' $i
-done
-%endif
 %endif
 :;
 
@@ -601,7 +513,7 @@ export LIBDIR_SUFFIX
   --with-pkcs11=%{_libdir}/pkcs11/libsofthsm2.so \
 %endif
   --with-dlopen=yes \
-%if %{with SDB} || %{with DLZ}
+%if %{with DLZ}
   --with-dlz-ldap=yes \
   --with-dlz-postgres=yes \
   --with-dlz-mysql=yes \
@@ -756,23 +668,6 @@ popd
 touch ${RPM_BUILD_ROOT}/%{chroot_prefix}%{_sysconfdir}/named.conf
 #end chroot
 
-#sdb-chroot
-%if %{with SDB}
-for D in %{chroot_create_directories}
-do
-  mkdir -p ${RPM_BUILD_ROOT}/%{chroot_sdb_prefix}${D}
-done
-
-# create symlink as it is on real filesystem
-pushd ${RPM_BUILD_ROOT}/%{chroot_sdb_prefix}%{_localstatedir}
-ln -s ../run run
-popd
-
-# these are required to prevent them being erased during upgrade of previous
-touch ${RPM_BUILD_ROOT}/%{chroot_sdb_prefix}%{_sysconfdir}/named.conf
-%endif
-#end sdb-chroot
-
 pushd build
 make DESTDIR=${RPM_BUILD_ROOT} install
 popd
@@ -787,12 +682,6 @@ install -m 644 %{SOURCE38} ${RPM_BUILD_ROOT}%{_unitdir}
 install -m 644 %{SOURCE44} ${RPM_BUILD_ROOT}%{_unitdir}
 install -m 644 %{SOURCE46} ${RPM_BUILD_ROOT}%{_unitdir}
 
-%if %{with SDB}
-install -m 644 %{SOURCE39} ${RPM_BUILD_ROOT}%{_unitdir}
-install -m 644 %{SOURCE40} ${RPM_BUILD_ROOT}%{_unitdir}
-install -m 644 %{SOURCE45} ${RPM_BUILD_ROOT}%{_unitdir}
-%endif
-
 %if %{with PKCS11}
 install -m 644 %{SOURCE47} ${RPM_BUILD_ROOT}%{_unitdir}
 %else
@@ -814,11 +703,6 @@ install -m 644 %SOURCE3 ${RPM_BUILD_ROOT}/etc/logrotate.d/named
 mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/sysconfig
 install -m 644 %{SOURCE1} ${RPM_BUILD_ROOT}%{_sysconfdir}/sysconfig/named
 install -m 644 %{SOURCE49} ${RPM_BUILD_ROOT}%{_sysconfdir}/named-chroot.files
-%if %{with SDB}
-mkdir -p ${RPM_BUILD_ROOT}/etc/openldap/schema
-install -m 644 %{SOURCE8} ${RPM_BUILD_ROOT}/etc/openldap/schema/dnszone.schema
-install -m 644 %{SOURCE12} contrib/sdb/pgsql/
-%endif
 
 %if %{with DLZ}
   pushd build
@@ -859,14 +743,6 @@ rm -rf ${RPM_BUILD_ROOT}/%{_includedir}/bind9
 rm -f ${RPM_BUILD_ROOT}/%{_mandir}/man3/lwres*
 %endif
 
-# SDB manpages
-%if %{with SDB}
-install -m 644 %{SOURCE31} ${RPM_BUILD_ROOT}%{_mandir}/man1/ldap2zone.1
-install -m 644 %{SOURCE32} ${RPM_BUILD_ROOT}%{_mandir}/man8/named-sdb.8
-install -m 644 %{SOURCE33} ${RPM_BUILD_ROOT}%{_mandir}/man1/zonetodb.1
-install -m 644 %{SOURCE34} ${RPM_BUILD_ROOT}%{_mandir}/man1/zone2sqlite.1
-%endif
-
 # PKCS11 versions manpages
 %if %{with PKCS11}
 pushd ${RPM_BUILD_ROOT}%{_mandir}/man8
@@ -972,20 +848,6 @@ if [ -e "%{_sysconfdir}/selinux/config" ]; then
   %selinux_unset_booleans -s mls %{selinuxbooleans}
 fi
 
-%if %{with SDB}
-%post sdb
-# Initial installation 
-%systemd_post named-sdb.service
-
-%preun sdb
-# Package removal, not upgrade
-%systemd_preun named-sdb.service
-
-%postun sdb
-# Package upgrade, not uninstall
-%systemd_postun_with_restart named-sdb.service
-%endif
-
 %if %{with PKCS11}
 %post pkcs11
 # Initial installation
@@ -1051,29 +913,6 @@ fi;
 %systemd_postun_with_restart named-chroot.service
 
 
-%if %{with SDB}
-
-%post sdb-chroot
-%systemd_post named-sdb-chroot.service
-%chroot_fix_devices %{chroot_sdb_prefix}
-:;
-
-%posttrans sdb-chroot
-if [ -x /usr/sbin/selinuxenabled ] && /usr/sbin/selinuxenabled; then
-  [ -x /sbin/restorecon ] && /sbin/restorecon %{chroot_sdb_prefix}/dev/* > /dev/null 2>&1;
-fi;
-:;
-
-%preun sdb-chroot
-%systemd_preun named-sdb-chroot.service 
-:;
-
-%postun sdb-chroot
-# Package upgrade, not uninstall
-%systemd_postun_with_restart named-sdb-chroot.service
-
-%endif
-
 %files
 # TODO: Move from lib/bind to lib/named, as used by upstream
 %{_libdir}/bind
@@ -1131,24 +970,6 @@ fi;
 %defattr(-,named,named,-)
 %dir /run/named
 
-%if %{with SDB}
-%files sdb
-%{_unitdir}/named-sdb.service
-%{_mandir}/man1/zone2ldap.1*
-%{_mandir}/man1/ldap2zone.1*
-%{_mandir}/man1/zonetodb.1*
-%{_mandir}/man1/zone2sqlite.1*
-%{_mandir}/man8/named-sdb.8*
-%doc contrib/sdb/ldap/README.ldap contrib/sdb/ldap/INSTALL.ldap contrib/sdb/pgsql/README.sdb_pgsql
-%dir %{_sysconfdir}/openldap/schema
-%config(noreplace) %{_sysconfdir}/openldap/schema/dnszone.schema
-%{_sbindir}/named-sdb
-%{_sbindir}/zone2ldap
-%{_sbindir}/ldap2zone
-%{_sbindir}/zonetodb
-%{_sbindir}/zone2sqlite
-%endif
-
 %files libs
 %{_libdir}/libbind9.so.1600*
 %{_libdir}/libisccc.so.1600*
@@ -1266,44 +1087,6 @@ fi;
 %dir %{chroot_prefix}/run/named
 %{chroot_prefix}%{_localstatedir}/run
 
-%if %{with SDB}
-%files sdb-chroot
-%config(noreplace) %{_sysconfdir}/named-chroot.files
-%{_unitdir}/named-sdb-chroot.service
-%{_unitdir}/named-sdb-chroot-setup.service
-%{_libexecdir}/setup-named-chroot.sh
-%defattr(0664,root,named,-)
-%ghost %dev(c,1,3) %verify(not mtime) %{chroot_sdb_prefix}/dev/null
-%ghost %dev(c,1,8) %verify(not mtime) %{chroot_sdb_prefix}/dev/random
-%ghost %dev(c,1,9) %verify(not mtime) %{chroot_sdb_prefix}/dev/urandom
-%ghost %dev(c,1,5) %verify(not mtime) %{chroot_sdb_prefix}/dev/zero
-%defattr(0640,root,named,0750)
-%dir %{chroot_sdb_prefix}
-%dir %{chroot_sdb_prefix}/dev
-%dir %{chroot_sdb_prefix}%{_sysconfdir}
-%dir %{chroot_sdb_prefix}%{_sysconfdir}/named
-%dir %{chroot_sdb_prefix}%{_sysconfdir}/pki
-%dir %{chroot_sdb_prefix}%{_sysconfdir}/pki/dnssec-keys
-%dir %{chroot_sdb_prefix}%{_sysconfdir}/crypto-policies
-%dir %{chroot_sdb_prefix}%{_sysconfdir}/crypto-policies/back-ends
-%dir %{chroot_sdb_prefix}%{_localstatedir}
-%dir %{chroot_sdb_prefix}/run
-%ghost %config(noreplace) %{chroot_sdb_prefix}%{_sysconfdir}/named.conf
-%defattr(0660,root,named,01770)
-%dir %{chroot_sdb_prefix}%{_localstatedir}/named
-%defattr(-,root,root,-)
-%dir %{chroot_sdb_prefix}/usr
-%dir %{chroot_sdb_prefix}/%{_libdir}
-%dir %{chroot_sdb_prefix}/%{_libdir}/bind
-%dir %{chroot_sdb_prefix}/%{_datadir}/GeoIP
-%defattr(0660,named,named,0770)
-%dir %{chroot_sdb_prefix}%{_localstatedir}/tmp
-%dir %{chroot_sdb_prefix}%{_localstatedir}/log
-%defattr(-,named,named,-)
-%dir %{chroot_sdb_prefix}/run/named
-%{chroot_sdb_prefix}%{_localstatedir}/run
-%endif
-
 %if %{with PKCS11}
 %files pkcs11
 %{_sbindir}/named-pkcs11
@@ -1337,9 +1120,6 @@ fi;
 
 %if %{with DLZ} && %{with BDB}
 %files dlz-bdb
-%if %{with SDB}
-%{_sbindir}/dlzbdb
-%endif
 %{_libdir}/bind/dlz_bdbhpt_dynamic.so
 %doc contrib/dlz/modules/bdbhpt/testing/*
 %doc contrib/dlz/modules/bdbhpt/README*
diff --git a/dnszone.schema b/dnszone.schema
deleted file mode 100644
index cb72a3f..0000000
--- a/dnszone.schema
+++ /dev/null
@@ -1,148 +0,0 @@
-# A schema for storing DNS zones in LDAP
-#
-attributetype ( 1.3.6.1.4.1.2428.20.0.0  NAME 'dNSTTL'
-	DESC 'An integer denoting time to live'
-	EQUALITY integerMatch
-	SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )
-
-attributetype ( 1.3.6.1.4.1.2428.20.0.1 NAME 'dNSClass'
-	DESC 'The class of a resource record'
-	EQUALITY caseIgnoreIA5Match
-	SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
-
-attributetype ( 1.3.6.1.4.1.2428.20.0.2 NAME 'zoneName'
-	DESC 'The name of a zone, i.e. the name of the highest node in the zone'
-	EQUALITY caseIgnoreIA5Match
-	SUBSTR caseIgnoreIA5SubstringsMatch
-	SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
-
-attributetype ( 1.3.6.1.4.1.2428.20.0.3 NAME 'relativeDomainName'
-	DESC 'The starting labels of a domain name'
-	EQUALITY caseIgnoreIA5Match
-	SUBSTR caseIgnoreIA5SubstringsMatch
-	SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
-
-attributetype ( 1.3.6.1.4.1.2428.20.1.12 NAME 'pTRRecord'
-	DESC 'domain name pointer, RFC 1035'
-	EQUALITY caseIgnoreIA5Match
-	SUBSTR caseIgnoreIA5SubstringsMatch
-	SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
-
-attributetype ( 1.3.6.1.4.1.2428.20.1.13 NAME 'hInfoRecord'
-	DESC 'host information, RFC 1035'
-	EQUALITY caseIgnoreIA5Match
-	SUBSTR caseIgnoreIA5SubstringsMatch
-	SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
-
-attributetype ( 1.3.6.1.4.1.2428.20.1.14 NAME 'mInfoRecord'
-	DESC 'mailbox or mail list information, RFC 1035'
-	EQUALITY caseIgnoreIA5Match
-	SUBSTR caseIgnoreIA5SubstringsMatch
-	SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
-
-attributetype ( 1.3.6.1.4.1.2428.20.1.16 NAME 'tXTRecord'
-	DESC 'text string, RFC 1035'
-	EQUALITY caseIgnoreIA5Match
-	SUBSTR caseIgnoreIA5SubstringsMatch
-	SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
-
-attributetype ( 1.3.6.1.4.1.2428.20.1.18 NAME 'aFSDBRecord'
-	DESC 'for AFS Data Base location, RFC 1183'
-	EQUALITY caseIgnoreIA5Match
-	SUBSTR caseIgnoreIA5SubstringsMatch
-	SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
-
-attributetype ( 1.3.6.1.4.1.2428.20.1.24 NAME 'SigRecord'
-	DESC 'Signature, RFC 2535'
-	EQUALITY caseIgnoreIA5Match
-	SUBSTR caseIgnoreIA5SubstringsMatch
-	SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
-
-attributetype ( 1.3.6.1.4.1.2428.20.1.25 NAME 'KeyRecord'
-	DESC 'Key, RFC 2535'
-	EQUALITY caseIgnoreIA5Match
-	SUBSTR caseIgnoreIA5SubstringsMatch
-	SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
-
-attributetype ( 1.3.6.1.4.1.2428.20.1.28 NAME 'aAAARecord'
-	DESC 'IPv6 address, RFC 1886'
-	EQUALITY caseIgnoreIA5Match
-	SUBSTR caseIgnoreIA5SubstringsMatch
-	SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
-
-attributetype ( 1.3.6.1.4.1.2428.20.1.29 NAME 'LocRecord'
-	DESC 'Location, RFC 1876'
-	EQUALITY caseIgnoreIA5Match
-	SUBSTR caseIgnoreIA5SubstringsMatch
-	SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
-
-attributetype ( 1.3.6.1.4.1.2428.20.1.30 NAME 'nXTRecord'
-	DESC 'non-existant, RFC 2535'
-	EQUALITY caseIgnoreIA5Match
-	SUBSTR caseIgnoreIA5SubstringsMatch
-	SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
-
-attributetype ( 1.3.6.1.4.1.2428.20.1.33 NAME 'sRVRecord'
-	DESC 'service location, RFC 2782'
-	EQUALITY caseIgnoreIA5Match
-	SUBSTR caseIgnoreIA5SubstringsMatch
-	SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
-
-attributetype ( 1.3.6.1.4.1.2428.20.1.35 NAME 'nAPTRRecord'
-	DESC 'Naming Authority Pointer, RFC 2915'
-	EQUALITY caseIgnoreIA5Match
-	SUBSTR caseIgnoreIA5SubstringsMatch
-	SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
-
-attributetype ( 1.3.6.1.4.1.2428.20.1.36 NAME 'kXRecord'
-	DESC 'Key Exchange Delegation, RFC 2230'
-	EQUALITY caseIgnoreIA5Match
-	SUBSTR caseIgnoreIA5SubstringsMatch
-	SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
-
-attributetype ( 1.3.6.1.4.1.2428.20.1.37 NAME 'certRecord'
-	DESC 'certificate, RFC 2538'
-	EQUALITY caseIgnoreIA5Match
-	SUBSTR caseIgnoreIA5SubstringsMatch
-	SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
-
-attributetype ( 1.3.6.1.4.1.2428.20.1.38 NAME 'a6Record'
-	DESC 'A6 Record Type, RFC 2874'
-	EQUALITY caseIgnoreIA5Match
-	SUBSTR caseIgnoreIA5SubstringsMatch
-	SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
-
-attributetype ( 1.3.6.1.4.1.2428.20.1.39 NAME 'dNameRecord'
-	DESC 'Non-Terminal DNS Name Redirection, RFC 2672'
-	EQUALITY caseIgnoreIA5Match
-	SUBSTR caseIgnoreIA5SubstringsMatch
-	SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
-
-attributetype ( 1.3.6.1.4.1.2428.20.1.43 NAME 'dSRecord'
-	DESC 'Delegation Signer, RFC 3658'
-	EQUALITY caseIgnoreIA5Match
-	SUBSTR caseIgnoreIA5SubstringsMatch
-	SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
-
-attributetype ( 1.3.6.1.4.1.2428.20.1.46 NAME 'rRSIGRecord'
-	DESC 'RRSIG, RFC 3755'
-	EQUALITY caseIgnoreIA5Match
-	SUBSTR caseIgnoreIA5SubstringsMatch
-	SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
-
-attributetype ( 1.3.6.1.4.1.2428.20.1.47 NAME 'nSECRecord'
-	DESC 'NSEC, RFC 3755'
-	EQUALITY caseIgnoreIA5Match
-	SUBSTR caseIgnoreIA5SubstringsMatch
-	SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
-
-objectclass ( 1.3.6.1.4.1.2428.20.3 NAME 'dNSZone'
-        SUP top STRUCTURAL
-	MUST ( zoneName $ relativeDomainName )
-        MAY ( DNSTTL $ DNSClass $
-              ARecord $ MDRecord $ MXRecord $ NSRecord $
-	      SOARecord $ CNAMERecord $ PTRRecord $ HINFORecord $
-              MINFORecord $ TXTRecord $ SIGRecord $ KEYRecord $
-              AAAARecord $ LOCRecord $ NXTRecord $ SRVRecord $
-              NAPTRRecord $ KXRecord $ CERTRecord $ A6Record $
-              DNAMERecord ) )
diff --git a/ldap2zone.1 b/ldap2zone.1
deleted file mode 100644
index a48c69f..0000000
--- a/ldap2zone.1
+++ /dev/null
@@ -1,41 +0,0 @@
-.\" Copyright (C) 2004, 2005 Stig Venaas <venaas@uninett.no>
-.\" 
-.\" Permission to use, copy, modify, and distribute this software for any
-.\" purpose with or without fee is hereby granted, provided that the above
-.\" copyright notice and this permission notice appear in all copies.
-.\" Manpage written by Jan Gorig
-.TH ldap2zone 1 "15 March 2010" "BIND9"
-.SH NAME
-ldap2zone - Creates zone file from LDAP dnszone information
-.SH SYNOPSIS
-.B ldap2zone zone-name LDAP-URL default-ttl [serial]
-.SH DESCRIPTION
-ldap2zone is a tool that reads info for a zone from LDAP and constructs a standard plain ascii zone file that is written to the standard output. The LDAP information has to be stored using the dnszone schema. The schema is used by BIND with LDAP back-end.
-
-\fBzone-name\fR
-.RS 4
-Name of the zone, eg "mydomain.net."
-.RE
-.PP
-\fBLDAP-URL\fR
-.RS 4
-LDAP URL to dnszone information
-.RE
-.PP
-\fBdefault-ttl\fR
-.RS 4
-Default TTL value to be used in zone
-.RE
-.PP
-\fBserial\fR
-.RS 4
-(optional) Program checks this number to be different than SOA serial number.
-.RE
-
-.SH "EXIT STATUS"
-Exits with 0 on success or 1 on failure.
-.SH "SEE ALSO"
-named(8) ldap(3) 
-http://www.venaas.no/dns/ldap2zone/
-.SH "COPYRIGHT"
-Copyright (C) 2004, 2005 Stig Venaas
diff --git a/named-sdb-chroot-setup.service b/named-sdb-chroot-setup.service
deleted file mode 100644
index 5a3e173..0000000
--- a/named-sdb-chroot-setup.service
+++ /dev/null
@@ -1,12 +0,0 @@
-[Unit]
-Description=Set-up/destroy chroot environment for named-sdb
-BindsTo=named-sdb-chroot.service
-Wants=named-setup-rndc.service
-After=named-setup-rndc.service
-
-
-[Service]
-Type=oneshot
-RemainAfterExit=yes
-ExecStart=/usr/libexec/setup-named-chroot.sh /var/named/chroot_sdb on /etc/named-chroot.files
-ExecStop=/usr/libexec/setup-named-chroot.sh /var/named/chroot_sdb off /etc/named-chroot.files
diff --git a/named-sdb-chroot.service b/named-sdb-chroot.service
deleted file mode 100644
index acf88ba..0000000
--- a/named-sdb-chroot.service
+++ /dev/null
@@ -1,30 +0,0 @@
-# Don't forget to add "$AddUnixListenSocket /var/named/chroot_sdb/dev/log"
-# line to your /etc/rsyslog.conf file. Otherwise your logging becomes
-# broken when rsyslogd daemon is restarted (due update, for example).
-
-[Unit]
-Description=Berkeley Internet Name Domain (DNS)
-Wants=nss-lookup.target
-Requires=named-sdb-chroot-setup.service
-Before=nss-lookup.target
-After=named-sdb-chroot-setup.service
-After=network.target
-
-[Service]
-Type=forking
-Environment=NAMEDCONF=/etc/named.conf
-EnvironmentFile=-/etc/sysconfig/named
-Environment=KRB5_KTNAME=/etc/named.keytab
-PIDFile=/var/named/chroot_sdb/run/named/named.pid
-
-ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf -t /var/named/chroot_sdb -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
-ExecStart=/usr/sbin/named-sdb -u named -c ${NAMEDCONF} -t /var/named/chroot_sdb $OPTIONS
-
-ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
-
-ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'
-
-PrivateTmp=false
-
-[Install]
-WantedBy=multi-user.target
diff --git a/named-sdb.8 b/named-sdb.8
deleted file mode 100644
index 1e456c3..0000000
--- a/named-sdb.8
+++ /dev/null
@@ -1 +0,0 @@
-.so man8/named.8.gz
\ No newline at end of file
diff --git a/named-sdb.service b/named-sdb.service
deleted file mode 100644
index cdf3a62..0000000
--- a/named-sdb.service
+++ /dev/null
@@ -1,26 +0,0 @@
-[Unit]
-Description=Berkeley Internet Name Domain (DNS)
-Wants=nss-lookup.target
-Wants=named-setup-rndc.service
-Before=nss-lookup.target
-After=named-setup-rndc.service
-After=network.target
-
-[Service]
-Type=forking
-Environment=NAMEDCONF=/etc/named.conf
-EnvironmentFile=-/etc/sysconfig/named
-Environment=KRB5_KTNAME=/etc/named.keytab
-PIDFile=/run/named/named.pid
-
-ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
-ExecStart=/usr/sbin/named-sdb -u named -c ${NAMEDCONF} $OPTIONS
-
-ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
-
-ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'
-
-PrivateTmp=true
-
-[Install]
-WantedBy=multi-user.target
diff --git a/zone2sqlite.1 b/zone2sqlite.1
deleted file mode 100644
index 6897827..0000000
--- a/zone2sqlite.1
+++ /dev/null
@@ -1,53 +0,0 @@
-.\" Copyright (C) 2004, 2005, 2007-2009 Internet Systems Consortium, Inc. ("ISC")
-.\" Copyright (C) 2000, 2001 Internet Software Consortium.
-.\" 
-.\" Permission to use, copy, modify, and/or distribute this software for any
-.\" purpose with or without fee is hereby granted, provided that the above
-.\" copyright notice and this permission notice appear in all copies.
-.\" 
-.\" THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
-.\" REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
-.\" AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
-.\" INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
-.\" LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
-.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
-.\" PERFORMANCE OF THIS SOFTWARE.
-.\"
-.\" Manpage written by Jan Gorig
-.TH zone2sqlite 1 "15 March 2010" "BIND9"
-.SH NAME
-zone2sqlite - Load BIND 9 zone file into SQLite database
-.SH SYNOPSIS
-.B zone2sqlite zone zonefile dbfile dbtable
-.SH DESCRIPTION
-zone2sqlite parses DNS zone file and creates database for use with SQLite BIND SDB driver.
-
-\fBzone\fR
-.RS 4
-Zone origin, eg "mydomain.net."
-.RE
-.PP
-\fBzonefile\fR
-.RS 4
-Master zone database file, eg. mydomain.net.zone
-.RE
-.PP
-\fBdbfile\fR
-.RS 4
-Name of SQLite database file
-.RE
-.PP
-\fBdbtable\fR
-.RS 4
-Name of table in database
-.RE
-
-.SH "EXIT STATUS"
-Exits with 0 on success or 1 on failure.
-.SH "SEE ALSO"
-named(8)
-.SH "COPYRIGHT"
-Copyright \(co 2004, 2005, 2007\-2009 Internet Systems Consortium, Inc. ("ISC")
-.br
-Copyright \(co 2000, 2001 Internet Software Consortium.
-.br
diff --git a/zonetodb.1 b/zonetodb.1
deleted file mode 100644
index 897e74f..0000000
--- a/zonetodb.1
+++ /dev/null
@@ -1,53 +0,0 @@
-.\" Copyright (C) 2004, 2005, 2007-2009 Internet Systems Consortium, Inc. ("ISC")
-.\" Copyright (C) 2000, 2001 Internet Software Consortium.
-.\" 
-.\" Permission to use, copy, modify, and/or distribute this software for any
-.\" purpose with or without fee is hereby granted, provided that the above
-.\" copyright notice and this permission notice appear in all copies.
-.\" 
-.\" THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
-.\" REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
-.\" AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
-.\" INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
-.\" LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
-.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
-.\" PERFORMANCE OF THIS SOFTWARE.
-.\"
-.\" Manpage written by Jan Gorig
-.TH zonetodb 1 "15 March 2010" "BIND9"
-.SH NAME
-zonetodb - Generate a PostgreSQL table from a zone.
-.SH SYNOPSIS
-.B zonetodb origin file dbname dbtable
-.SH DESCRIPTION
-zonetodb parses DNS zone file and creates table in selected database for use with PostgreSQL BIND SDB driver.
-
-\fBzone\fR
-.RS 4
-Zone origin, eg "pgdb.net."
-.RE
-.PP
-\fBfile\fR
-.RS 4
-Master zone database file, eg. pgdb.net.db
-.RE
-.PP
-\fBdbname\fR
-.RS 4
-Name of PostgreSQL database (database must exist)
-.RE
-.PP
-\fBdbtable\fR
-.RS 4
-Name of table in database
-.RE
-
-.SH "EXIT STATUS"
-Exits with 0 on success or 1 on failure.
-.SH "SEE ALSO"
-named(8)
-.SH "COPYRIGHT"
-Copyright \(co 2004, 2005, 2007\-2009 Internet Systems Consortium, Inc. ("ISC")
-.br
-Copyright \(co 2000, 2001 Internet Software Consortium.
-.br

From 6b3788d0269b13d68183ed39a960dea126f16dd9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 8 Apr 2020 20:14:01 +0200
Subject: [PATCH 133/460] Provide link to merge request for lastest patch

Document when it should be removed
---
 bind.spec | 1 +
 1 file changed, 1 insertion(+)

diff --git a/bind.spec b/bind.spec
index 1b5b869..e7bc694 100644
--- a/bind.spec
+++ b/bind.spec
@@ -120,6 +120,7 @@ Patch164:bind-9.11-rh1666814.patch
 Patch170:bind-9.11-feature-test-named.patch
 Patch171:bind-9.11-tests-variants.patch
 Patch172:bind-9.11-tests-pkcs11.patch
+# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/3323
 Patch173:bind-9.16-libisc-link.patch
 
 Requires(post):   systemd

From 304cfaa8e056047f94d9e7c5952011edeab88b33 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 8 Apr 2020 20:49:02 +0200
Subject: [PATCH 134/460] Enable source verification only on Fedora builds

---
 bind.spec | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/bind.spec b/bind.spec
index e7bc694..ee7f5ff 100644
--- a/bind.spec
+++ b/bind.spec
@@ -152,7 +152,9 @@ BuildRequires:  selinux-policy
 BuildRequires:  python3-devel
 BuildRequires:  python3-ply
 BuildRequires:  findutils sed
+%if 0%{?fedora}
 BuildRequires:  gnupg2
+%endif
 BuildRequires:  libuv-devel
 %if %{with DLZ}
 BuildRequires:  openldap-devel, libpq-devel, sqlite-devel, mariadb-connector-c-devel
@@ -414,7 +416,10 @@ BuildArch: noarch
 This package provides a module which allows commands to be sent to rndc directly from Python programs.
 
 %prep
+%if 0%{?fedora}
+# RHEL does not yet support this verification
 %{gpgverify} --keyring='%{SOURCE4}' --signature='%{SOURCE2}' --data='%{SOURCE0}'
+%endif
 %setup -q -n %{name}-%{BINDVERSION}
 
 # Common patches

From f3b42f85fe88084b40219506ab2274a4f7bc3f31 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 9 Oct 2019 22:00:34 +0200
Subject: [PATCH 135/460] Try to pass with modified branch

---
 tests/tests.yml | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/tests/tests.yml b/tests/tests.yml
index 15360ed..831b492 100644
--- a/tests/tests.yml
+++ b/tests/tests.yml
@@ -5,10 +5,14 @@
   - role: standard-test-beakerlib
     tags:
     - classic
-    tests:
-    - Master-server-chrooted
-    - Master-server-not-chrooted
-    - Run-internal-BIND-test-suite
+    repositories:
+    - repo: "https://github.com/InfrastructureServices/bind-tests.git"
+      dest: "bind-tests"
+      branch: "sanity-tests"
+#    tests:
+#    - bind-tests/Sanity/Master-server-chrooted
+#    - bind-tests/Sanity/Master-server-not-chrooted
+#    - bind-tests/Sanity/Run-internal-BIND-test-suite
     required_packages:
     - bind
     - bind-chroot

From 93e0db889f86aca78fc08c32bc044712c071cf3d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 9 Oct 2019 22:00:52 +0200
Subject: [PATCH 136/460] Not sure how to specify tests to run

check https://fmf.readthedocs.io/en/latest/ for help
---
 tests/tests.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/tests/tests.yml b/tests/tests.yml
index 831b492..c1d9468 100644
--- a/tests/tests.yml
+++ b/tests/tests.yml
@@ -9,10 +9,10 @@
     - repo: "https://github.com/InfrastructureServices/bind-tests.git"
       dest: "bind-tests"
       branch: "sanity-tests"
-#    tests:
-#    - bind-tests/Sanity/Master-server-chrooted
-#    - bind-tests/Sanity/Master-server-not-chrooted
-#    - bind-tests/Sanity/Run-internal-BIND-test-suite
+    tests:
+    - Master-server-chrooted
+    - Master-server-not-chrooted
+    - Run-internal-BIND-test-suite
     required_packages:
     - bind
     - bind-chroot

From 2e8a3a9146776de4f0d6fe266d18276f11b45c7c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 14 Apr 2020 09:13:43 +0200
Subject: [PATCH 137/460] Use fmf filter for test case selection

---
 tests/tests.yml | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/tests/tests.yml b/tests/tests.yml
index c1d9468..25d0a73 100644
--- a/tests/tests.yml
+++ b/tests/tests.yml
@@ -9,10 +9,7 @@
     - repo: "https://github.com/InfrastructureServices/bind-tests.git"
       dest: "bind-tests"
       branch: "sanity-tests"
-    tests:
-    - Master-server-chrooted
-    - Master-server-not-chrooted
-    - Run-internal-BIND-test-suite
+    fmf_filter: "tier: 1"
     required_packages:
     - bind
     - bind-chroot

From ce9edd09af2c94129be7ccee560bb22ffa527fd5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 14 Apr 2020 09:55:27 +0200
Subject: [PATCH 138/460] Run master branch instead

---
 tests/tests.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/tests.yml b/tests/tests.yml
index 25d0a73..d7b998e 100644
--- a/tests/tests.yml
+++ b/tests/tests.yml
@@ -8,7 +8,7 @@
     repositories:
     - repo: "https://github.com/InfrastructureServices/bind-tests.git"
       dest: "bind-tests"
-      branch: "sanity-tests"
+      branch: "master"
     fmf_filter: "tier: 1"
     required_packages:
     - bind

From 449ff581adf9ac4dd74d4657a8b9efdf30f87c21 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 14 Apr 2020 11:12:10 +0200
Subject: [PATCH 139/460] Move filter to correct location

---
 tests/tests.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/tests.yml b/tests/tests.yml
index d7b998e..4b29060 100644
--- a/tests/tests.yml
+++ b/tests/tests.yml
@@ -9,7 +9,6 @@
     - repo: "https://github.com/InfrastructureServices/bind-tests.git"
       dest: "bind-tests"
       branch: "master"
-    fmf_filter: "tier: 1"
     required_packages:
     - bind
     - bind-chroot
@@ -25,3 +24,4 @@
     - softhsm
     - bind-pkcs11
     - bind-pkcs11-utils
+      fmf_filter: "tier: 1"

From 485d16a77ea319f1da091d798ac2a926d025e882 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 14 Apr 2020 11:13:10 +0200
Subject: [PATCH 140/460] Cleanup test definition

Leave installation of dependencies on tests itself. Use beakerlib to
install packages.
---
 tests/tests.yml | 16 ----------------
 1 file changed, 16 deletions(-)

diff --git a/tests/tests.yml b/tests/tests.yml
index 4b29060..c3d8fcd 100644
--- a/tests/tests.yml
+++ b/tests/tests.yml
@@ -8,20 +8,4 @@
     repositories:
     - repo: "https://github.com/InfrastructureServices/bind-tests.git"
       dest: "bind-tests"
-      branch: "master"
-    required_packages:
-    - bind
-    - bind-chroot
-    - bind-sdb-chroot
-    - redhat-lsb
-    - bind-utils
-    - dnf-utils
-    - kyua
-    - bind-devel
-    - perl-Net-DNS
-    - perl-Net-DNS-Nameserver
-    - perl-Time-HiRes
-    - softhsm
-    - bind-pkcs11
-    - bind-pkcs11-utils
       fmf_filter: "tier: 1"

From 6e3b160e3724afd2d118c7343684ce6c0f2925f4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 16 Apr 2020 10:53:28 +0200
Subject: [PATCH 141/460] Update to BIND 9.11.18

From Upstream Release notes:

Security Fixes

    DNS rebinding protection was ineffective when BIND 9 is configured as a forwarding DNS server. Found and responsibly reported by Tobias Klein. [GL #1574]

Known Issues

    We have received reports that in some circumstances, receipt of an IXFR can cause the processing of queries to slow significantly. Some of these were related to RPZ processing, which has been fixed in this release (see below). Others appear to occur where there are NSEC3-related changes (such as an operator changing the NSEC3 salt used in the hash calculation). These are being investigated. [GL #1685]
---
 .gitignore                     |  2 ++
 bind-9.11-kyua-pkcs11.patch    | 34 +++++++++++++++++-----------------
 bind-9.11-tests-variants.patch | 20 ++++++++++----------
 bind.spec                      |  5 ++++-
 sources                        |  4 ++--
 5 files changed, 35 insertions(+), 30 deletions(-)

diff --git a/.gitignore b/.gitignore
index 621325c..c48ee55 100644
--- a/.gitignore
+++ b/.gitignore
@@ -104,3 +104,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.11.14.tar.gz.asc
 /bind-9.11.17.tar.gz
 /bind-9.11.17.tar.gz.asc
+/bind-9.11.18.tar.gz
+/bind-9.11.18.tar.gz.asc
diff --git a/bind-9.11-kyua-pkcs11.patch b/bind-9.11-kyua-pkcs11.patch
index ac15d22..9cfa618 100644
--- a/bind-9.11-kyua-pkcs11.patch
+++ b/bind-9.11-kyua-pkcs11.patch
@@ -1,4 +1,4 @@
-From eb38d2278937ec3fe45d0af30cd080953bbb5b54 Mon Sep 17 00:00:00 2001
+From a9b5785f174cf7fd74891fa64f6b69b9a9b55466 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Tue, 2 Jan 2018 18:13:07 +0100
 Subject: [PATCH] Fix pkcs11 variants atf tests
@@ -16,10 +16,10 @@ Add pkcs11 Kyuafile, fix dh_test to pass in pkcs11 mode
  6 files changed, 38 insertions(+), 16 deletions(-)
 
 diff --git a/configure.ac b/configure.ac
-index 0532feb..a83ddd5 100644
+index 62ecf56..0940a7d 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -5578,6 +5578,7 @@ AC_CONFIG_FILES([
+@@ -5476,6 +5476,7 @@ AC_CONFIG_FILES([
  	lib/dns-pkcs11/include/Makefile
  	lib/dns-pkcs11/include/dns/Makefile
  	lib/dns-pkcs11/include/dst/Makefile
@@ -43,13 +43,13 @@ index 7c8bab0..eec9564 100644
  include('isccfg/Kyuafile')
  include('lwres/Kyuafile')
 diff --git a/lib/dns-pkcs11/tests/Makefile.in b/lib/dns-pkcs11/tests/Makefile.in
-index 7671e1d..e237d5c 100644
+index 22a06a8..5df5b15 100644
 --- a/lib/dns-pkcs11/tests/Makefile.in
 +++ b/lib/dns-pkcs11/tests/Makefile.in
 @@ -17,12 +17,12 @@ VERSION=@BIND9_VERSION@
  
  CINCLUDES =	-I. -Iinclude ${DNS_INCLUDES} ${ISC_INCLUDES} \
- 		@DST_OPENSSL_INC@
+ 		@DST_OPENSSL_INC@ ${MAXMINDDB_CFLAGS}
 -CDEFINES =	@CRYPTO@ -DTESTS="\"${top_builddir}/lib/dns/tests/\""
 +CDEFINES =	@CRYPTO_PK11@ -DTESTS="\"${top_builddir}/lib/dns-pkcs11/tests/\""
  
@@ -65,10 +65,10 @@ index 7671e1d..e237d5c 100644
  LIBS =		@LIBS@ @CMOCKA_LIBS@
  CFLAGS =	@CFLAGS@ @CMOCKA_CFLAGS@
 diff --git a/lib/dns-pkcs11/tests/dh_test.c b/lib/dns-pkcs11/tests/dh_test.c
-index 4dbfd82..a383b8e 100644
+index a5bf46c..9ff2b76 100644
 --- a/lib/dns-pkcs11/tests/dh_test.c
 +++ b/lib/dns-pkcs11/tests/dh_test.c
-@@ -86,7 +86,8 @@ dh_computesecret(void **state) {
+@@ -88,7 +88,8 @@ dh_computesecret(void **state) {
  	result = dst_key_computesecret(key, key, &buf);
  	assert_int_equal(result, DST_R_NOTPRIVATEKEY);
  	result = key->func->computesecret(key, key, &buf);
@@ -79,7 +79,7 @@ index 4dbfd82..a383b8e 100644
  	dst_key_free(&key);
  }
 diff --git a/lib/isc-pkcs11/tests/Makefile.in b/lib/isc-pkcs11/tests/Makefile.in
-index 2fdee0b..a263b35 100644
+index 36d2207..00dfbc9 100644
 --- a/lib/isc-pkcs11/tests/Makefile.in
 +++ b/lib/isc-pkcs11/tests/Makefile.in
 @@ -16,10 +16,10 @@ VERSION=@BIND9_VERSION@
@@ -97,10 +97,10 @@ index 2fdee0b..a263b35 100644
  LIBS =		@LIBS@ @CMOCKA_LIBS@
  CFLAGS =	@CFLAGS@ @CMOCKA_CFLAGS@
 diff --git a/lib/isc-pkcs11/tests/hash_test.c b/lib/isc-pkcs11/tests/hash_test.c
-index 9c4d299..d9deba2 100644
+index 4fafc38..5eb2be2 100644
 --- a/lib/isc-pkcs11/tests/hash_test.c
 +++ b/lib/isc-pkcs11/tests/hash_test.c
-@@ -85,7 +85,7 @@ typedef struct hash_testcase {
+@@ -84,7 +84,7 @@ typedef struct hash_testcase {
  
  typedef struct hash_test_key {
  	const char *key;
@@ -109,7 +109,7 @@ index 9c4d299..d9deba2 100644
  } hash_test_key_t;
  
  /* non-hmac tests */
-@@ -956,8 +956,11 @@ isc_hmacsha1_test(void **state) {
+@@ -955,8 +955,11 @@ isc_hmacsha1_test(void **state) {
  	hash_test_key_t *test_key = test_keys;
  
  	while (testcase->input != NULL && testcase->result != NULL) {
@@ -122,7 +122,7 @@ index 9c4d299..d9deba2 100644
  		isc_hmacsha1_update(&hmacsha1,
  				    (const uint8_t *) testcase->input,
  				    testcase->input_len);
-@@ -1116,8 +1119,11 @@ isc_hmacsha224_test(void **state) {
+@@ -1115,8 +1118,11 @@ isc_hmacsha224_test(void **state) {
  	hash_test_key_t *test_key = test_keys;
  
  	while (testcase->input != NULL && testcase->result != NULL) {
@@ -135,7 +135,7 @@ index 9c4d299..d9deba2 100644
  		isc_hmacsha224_update(&hmacsha224,
  				      (const uint8_t *) testcase->input,
  				      testcase->input_len);
-@@ -1277,8 +1283,11 @@ isc_hmacsha256_test(void **state) {
+@@ -1276,8 +1282,11 @@ isc_hmacsha256_test(void **state) {
  	hash_test_key_t *test_key = test_keys;
  
  	while (testcase->input != NULL && testcase->result != NULL) {
@@ -148,7 +148,7 @@ index 9c4d299..d9deba2 100644
  		isc_hmacsha256_update(&hmacsha256,
  				      (const uint8_t *) testcase->input,
  				      testcase->input_len);
-@@ -1444,8 +1453,11 @@ isc_hmacsha384_test(void **state) {
+@@ -1443,8 +1452,11 @@ isc_hmacsha384_test(void **state) {
  	hash_test_key_t *test_key = test_keys;
  
  	while (testcase->input != NULL && testcase->result != NULL) {
@@ -161,7 +161,7 @@ index 9c4d299..d9deba2 100644
  		isc_hmacsha384_update(&hmacsha384,
  				      (const uint8_t *) testcase->input,
  				      testcase->input_len);
-@@ -1611,8 +1623,11 @@ isc_hmacsha512_test(void **state) {
+@@ -1610,8 +1622,11 @@ isc_hmacsha512_test(void **state) {
  	hash_test_key_t *test_key = test_keys;
  
  	while (testcase->input != NULL && testcase->result != NULL) {
@@ -174,7 +174,7 @@ index 9c4d299..d9deba2 100644
  		isc_hmacsha512_update(&hmacsha512,
  				      (const uint8_t *) testcase->input,
  				      testcase->input_len);
-@@ -1755,8 +1770,11 @@ isc_hmacmd5_test(void **state) {
+@@ -1754,8 +1769,11 @@ isc_hmacmd5_test(void **state) {
  	hash_test_key_t *test_key = test_keys;
  
  	while (testcase->input != NULL && testcase->result != NULL) {
@@ -188,5 +188,5 @@ index 9c4d299..d9deba2 100644
  				   (const uint8_t *) testcase->input,
  				   testcase->input_len);
 -- 
-2.20.1
+2.21.1
 
diff --git a/bind-9.11-tests-variants.patch b/bind-9.11-tests-variants.patch
index d983671..7f28397 100644
--- a/bind-9.11-tests-variants.patch
+++ b/bind-9.11-tests-variants.patch
@@ -1,4 +1,4 @@
-From 06a22ff20ac3d68fa1f995c91068b43392425e43 Mon Sep 17 00:00:00 2001
+From 9576e960ad3719aa9c1707734ad7ba0eccf16e5f Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Fri, 1 Mar 2019 15:48:20 +0100
 Subject: [PATCH] Make alternative named builds testable in system tests
@@ -13,14 +13,14 @@ export NAMED_VARIANT=-sdb DNSSEC_VARIANT=
 For pkcs variant use:
 export NAMED_VARIANT=-pkcs11 DNSSEC_VARIANT=-pkcs11
 ---
- bin/tests/system/conf.sh.in | 19 ++++++++++---------
- 1 file changed, 10 insertions(+), 9 deletions(-)
+ bin/tests/system/conf.sh.in | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
 
 diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
-index 4b0fe39..f135af6 100644
+index 6f2dbcd..05605ae 100644
 --- a/bin/tests/system/conf.sh.in
 +++ b/bin/tests/system/conf.sh.in
-@@ -34,7 +34,7 @@ DISABLED_ALGORITHM=ECDSAP384SHA384
+@@ -37,7 +37,7 @@ DISABLED_ALGORITHM=ECDSAP384SHA384
  DISABLED_ALGORITHM_NUMBER=14
  DISABLED_BITS=384
  
@@ -29,7 +29,7 @@ index 4b0fe39..f135af6 100644
  # We must use "named -l" instead of "lwresd" because argv[0] is lost
  # if the program is libtoolized.
  LWRESD="$TOP/bin/named/named -l"
-@@ -45,13 +45,14 @@ NSUPDATE=$TOP/bin/nsupdate/nsupdate
+@@ -48,14 +48,14 @@ NSUPDATE=$TOP/bin/nsupdate/nsupdate
  DDNSCONFGEN=$TOP/bin/confgen/ddns-confgen
  TSIGKEYGEN=$TOP/bin/confgen/tsig-keygen
  RNDCCONFGEN=$TOP/bin/confgen/rndc-confgen
@@ -39,19 +39,19 @@ index 4b0fe39..f135af6 100644
 -REVOKE=$TOP/bin/dnssec/dnssec-revoke
 -SETTIME=$TOP/bin/dnssec/dnssec-settime
 -DSFROMKEY=$TOP/bin/dnssec/dnssec-dsfromkey
--IMPORTKEY=$TOP/bin/dnssec/dnssec-importkey
 +KEYGEN=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-keygen${DNSSEC_VARIANT}
 +KEYFRLAB=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-keyfromlabel${DNSSEC_VARIANT}
 +SIGNER=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-signzone${DNSSEC_VARIANT}
 +REVOKE=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-revoke${DNSSEC_VARIANT}
 +SETTIME=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-settime${DNSSEC_VARIANT}
 +DSFROMKEY=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-dsfromkey${DNSSEC_VARIANT}
+ HOST=$TOP/bin/dig/host
+-IMPORTKEY=$TOP/bin/dnssec/dnssec-importkey
 +IMPORTKEY=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-importkey${DNSSEC_VARIANT}
-+CHECKDS=$TOP/bin/python/dnssec-checkds
  CHECKDS=$TOP/bin/python/dnssec-checkds
  COVERAGE=$TOP/bin/python/dnssec-coverage
  KEYMGR=$TOP/bin/python/dnssec-keymgr
-@@ -71,7 +72,7 @@ DNSTAPREAD=$TOP/bin/tools/dnstap-read
+@@ -75,7 +75,7 @@ DNSTAPREAD=$TOP/bin/tools/dnstap-read
  MDIG=$TOP/bin/tools/mdig
  NZD2NZF=$TOP/bin/tools/named-nzd2nzf
  FSTRM_CAPTURE=@FSTRM_CAPTURE@
@@ -61,5 +61,5 @@ index 4b0fe39..f135af6 100644
  RANDFILE=$TOP/bin/tests/system/random.data
  
 -- 
-2.20.1
+2.21.1
 
diff --git a/bind.spec b/bind.spec
index a0e9182..5f411ed 100644
--- a/bind.spec
+++ b/bind.spec
@@ -63,7 +63,7 @@
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.11.17
+Version:  9.11.18
 Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
@@ -1600,6 +1600,9 @@ fi;
 
 
 %changelog
+* Thu Apr 16 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.18-1
+- Update to 9.11.18
+
 * Tue Mar 31 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.17-1
 - Update to 9.11.17
 
diff --git a/sources b/sources
index d31ad61..d0ed2a0 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.11.17.tar.gz) = 0c5aebd9763fdf61709d347abc79c898f62bcc6bc19bcae0e355804cfee3fd24d7054ebb574dce1987138e4a755c4bc963afb92f920ac15223c1a738d831b652
-SHA512 (bind-9.11.17.tar.gz.asc) = fb5c03facaf8530bf4168be6a106bc75517bb4b45e164fbadd20ce9968098e43badff854ca735b14cddbeb76f8cc10cfaf7cad760b7b630639a1c9243dd7c422
+SHA512 (bind-9.11.18.tar.gz) = 947a7f9f58ac40744c541b2c23ef3eb9d8b6ecc8e3bb4f4b102ba5aafcc20c58ad5e8bacdd338821369c1f7de9d1073c264208e45f054ff7e3a9391894b424ab
+SHA512 (bind-9.11.18.tar.gz.asc) = aeeef8b211199a5d2715b63da9d648322241726e60b8cffae883bcec0e6335fd6c5ee431755a0bcb5b2a39ce540986edb0c9f51c6365aa226cff83ba358bac1a

From 96e1d963a4f3f0474202e4befbdfb839464d9da0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 16 Apr 2020 11:10:15 +0200
Subject: [PATCH 142/460] Make spec work also on CentOS 8

Move some conditional requirements to be enabled just on Fedora.
---
 bind.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index 5f411ed..55ed424 100644
--- a/bind.spec
+++ b/bind.spec
@@ -18,7 +18,6 @@
 %bcond_without DEVEL
 %bcond_without LMDB
 %bcond_without JSON
-%bcond_without DNSTAP
 %bcond_without DLZ
 %bcond_with    BDB
 %bcond_with    EXPORT_LIBS
@@ -28,8 +27,10 @@
 %bcond_without GEOIP2
 %if 0%{?fedora} >= 28
 %bcond_without UNITTEST
+%bcond_without DNSTAP
 %else
 %bcond_with    UNITTEST
+%bcond_with    DNSTAP
 %endif
 %bcond_with    TSAN
 
@@ -528,7 +529,9 @@ are used for building ISC DHCP.
 %endif
 
 %prep
+%if 0%{?gpgverify:1}
 %{gpgverify} --keyring='%{SOURCE4}' --signature='%{SOURCE2}' --data='%{SOURCE0}'
+%endif
 %setup -q -n %{name}-%{BINDVERSION}
 
 # Common patches

From 5e13eb8e75ab571adf595e5d3c36485bd5ebfa1b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 16 Apr 2020 11:10:15 +0200
Subject: [PATCH 143/460] Make spec work also on CentOS 8

Move some conditional requirements to be enabled just on Fedora.
---
 bind.spec | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/bind.spec b/bind.spec
index ee7f5ff..f5e8686 100644
--- a/bind.spec
+++ b/bind.spec
@@ -17,7 +17,6 @@
 %bcond_without DEVEL
 %bcond_without LMDB
 %bcond_without JSON
-%bcond_without DNSTAP
 %bcond_with    BDB
 # skip DLZ for now
 %bcond_without DLZ
@@ -25,8 +24,10 @@
 %bcond_without GEOIP2
 %if 0%{?fedora} >= 28
 %bcond_without UNITTEST
+%bcond_without DNSTAP
 %else
 %bcond_with    UNITTEST
+%bcond_with    DNSTAP
 %endif
 %bcond_with    TSAN
 
@@ -416,7 +417,7 @@ BuildArch: noarch
 This package provides a module which allows commands to be sent to rndc directly from Python programs.
 
 %prep
-%if 0%{?fedora}
+%if 0%{?gpgverify:1}
 # RHEL does not yet support this verification
 %{gpgverify} --keyring='%{SOURCE4}' --signature='%{SOURCE2}' --data='%{SOURCE0}'
 %endif

From 1b133224fccfe9dbf531026c679ca599b2bd2cb7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 16 Apr 2020 11:39:29 +0200
Subject: [PATCH 144/460] Update to 9.16.2

Notes for BIND 9.16.2
Security Fixes

    DNS rebinding protection was ineffective when BIND 9 is configured as a forwarding DNS server. Found and responsibly reported by Tobias Klein. [GL #1574]

Known Issues

    We have received reports that in some circumstances, receipt of an IXFR can cause the processing of queries to slow significantly. Some of these were related to RPZ processing, which has been fixed in this release (see below). Others appear to occur where there are NSEC3-related changes (such as an operator changing the NSEC3 salt used in the hash calculation). These are being investigated. [GL #1685]

Feature Changes

    The previous DNSSEC sign statistics used lots of memory. The number of keys to track is reduced to four per zone, which should be enough for 99% of all signed zones. [GL #1179]

Bug Fixes

    When an RPZ policy zone was updated via zone transfer and a large number of records was deleted, named could become nonresponsive for a short period while deleted names were removed from the RPZ summary database. This database cleanup is now done incrementally over a longer period of time, reducing such delays. [GL #1447]

    When trying to migrate an already-signed zone from auto-dnssec maintain to one based on dnssec-policy, the existing keys were immediately deleted and replaced with new ones. As the key rollover timing constraints were not being followed, it was possible that some clients would not have been able to validate responses until all old DNSSEC information had timed out from caches. BIND now looks at the time metadata of the existing keys and incorporates it into its DNSSEC policy operation. [GL #1706]
---
 .gitignore                         |  4 +++-
 bind-9.11-feature-test-named.patch |  6 +++---
 bind-9.11-tests-variants.patch     |  9 +++++----
 bind-9.16-libisc-link.patch        | 27 ---------------------------
 bind.spec                          | 16 ++++++++--------
 sources                            |  4 ++--
 6 files changed, 21 insertions(+), 45 deletions(-)
 delete mode 100644 bind-9.16-libisc-link.patch

diff --git a/.gitignore b/.gitignore
index 6cad3d9..36cb37f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -104,4 +104,6 @@ bind-9.7.2b1.tar.gz
 /bind-9.11.14.tar.gz
 /bind-9.11.14.tar.gz.asc
 /bind-9.16.1.tar.xz
-/bind-9.16.1.tar.xz.asc
\ No newline at end of file
+/bind-9.16.1.tar.xz.asc
+/bind-9.16.2.tar.xz
+/bind-9.16.2.tar.xz.asc
diff --git a/bind-9.11-feature-test-named.patch b/bind-9.11-feature-test-named.patch
index 1c1e63d..c4bbe16 100644
--- a/bind-9.11-feature-test-named.patch
+++ b/bind-9.11-feature-test-named.patch
@@ -1,4 +1,4 @@
-From df27b2a23a195f844687c424a9117d4da14bc6dd Mon Sep 17 00:00:00 2001
+From 64f29512679fd00c89473d93d8b22017b018dd8f Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Wed, 30 Jan 2019 14:37:17 +0100
 Subject: [PATCH] Create feature-test in source directory
@@ -41,7 +41,7 @@ index dd25774..cb187e5 100644
  
  docclean manclean maintainer-clean::
 diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
-index 0d83fdf..be4123b 100644
+index 2317bd8..5015d5c 100644
 --- a/bin/tests/system/conf.sh.in
 +++ b/bin/tests/system/conf.sh.in
 @@ -37,7 +37,7 @@ DELV=$TOP/bin/delv/delv
@@ -51,8 +51,8 @@ index 0d83fdf..be4123b 100644
 -FEATURETEST=$TOP/bin/tests/system/feature-test
 +FEATURETEST=$TOP/bin/named/feature-test
  FSTRM_CAPTURE=@FSTRM_CAPTURE@
+ HOST=$TOP/bin/dig/host
  IMPORTKEY=$TOP/bin/dnssec/dnssec-importkey
- JOURNALPRINT=$TOP/bin/tools/named-journalprint
 -- 
 2.21.1
 
diff --git a/bind-9.11-tests-variants.patch b/bind-9.11-tests-variants.patch
index 275f3cb..897691a 100644
--- a/bind-9.11-tests-variants.patch
+++ b/bind-9.11-tests-variants.patch
@@ -1,4 +1,4 @@
-From e706bb1dccf0b3492664c591f99f698a2a40fce7 Mon Sep 17 00:00:00 2001
+From 2faaad96a86614f2df13e65f3d3a31cc2d4155c0 Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Fri, 1 Mar 2019 15:48:20 +0100
 Subject: [PATCH] Make alternative named builds testable in system tests
@@ -17,10 +17,10 @@ export NAMED_VARIANT=-pkcs11 DNSSEC_VARIANT=-pkcs11
  1 file changed, 9 insertions(+), 9 deletions(-)
 
 diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
-index 0f4ead0..e7831d8 100644
+index 5015d5c..331b728 100644
 --- a/bin/tests/system/conf.sh.in
 +++ b/bin/tests/system/conf.sh.in
-@@ -37,16 +37,16 @@ DDNSCONFGEN=$TOP/bin/confgen/ddns-confgen
+@@ -36,17 +36,17 @@ DDNSCONFGEN=$TOP/bin/confgen/ddns-confgen
  DELV=$TOP/bin/delv/delv
  DIG=$TOP/bin/dig/dig
  DNSTAPREAD=$TOP/bin/tools/dnstap-read
@@ -29,6 +29,7 @@ index 0f4ead0..e7831d8 100644
 +DSFROMKEY=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-dsfromkey${DNSSEC_VARIANT}
 +FEATURETEST=$TOP/bin/named${NAMED_VARIANT}/feature-test${NAMED_VARIANT}
  FSTRM_CAPTURE=@FSTRM_CAPTURE@
+ HOST=$TOP/bin/dig/host
 -IMPORTKEY=$TOP/bin/dnssec/dnssec-importkey
 +IMPORTKEY=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-importkey${DNSSEC_VARIANT}
  JOURNALPRINT=$TOP/bin/tools/named-journalprint
@@ -60,5 +61,5 @@ index 0f4ead0..e7831d8 100644
  VERIFY=$TOP/bin/dnssec/dnssec-verify
  WIRETEST=$TOP/bin/tests/wire_test
 -- 
-2.20.1
+2.21.1
 
diff --git a/bind-9.16-libisc-link.patch b/bind-9.16-libisc-link.patch
deleted file mode 100644
index 35652df..0000000
--- a/bind-9.16-libisc-link.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From 5ee0a7ace7588b986f41ac68f51b315fece69094 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Wed, 1 Apr 2020 14:28:42 +0200
-Subject: [PATCH] Link all required libraries to libisc
-
-It would fail to link -lisc without additional libraries, which should
-not be required.
----
- lib/isc/Makefile.in | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/lib/isc/Makefile.in b/lib/isc/Makefile.in
-index 1b6b4466cd..e9df8d1e17 100644
---- a/lib/isc/Makefile.in
-+++ b/lib/isc/Makefile.in
-@@ -81,7 +81,7 @@ SRCS =		pk11.c pk11_result.c \
- 		symtab.c task.c taskpool.c timer.c \
- 		tm.c version.c
- 
--LIBS =		${OPENSSL_LIBS} @LIBS@
-+LIBS =		${OPENSSL_LIBS} ${JSON_C_LIBS} ${LIBXML2_LIBS} ${ZLIB_LIBS} @LIBS@
- 
- # Note: the order of SUBDIRS is important.
- # Attempt to disable parallel processing.
--- 
-2.21.1
-
diff --git a/bind.spec b/bind.spec
index f5e8686..3568099 100644
--- a/bind.spec
+++ b/bind.spec
@@ -52,8 +52,8 @@
 # no more isc-config.sh and bind9-config
 
 # lib*.so.X versions of selected libraries
-%global sover_dns 1601
-%global sover_isc 1601
+%global sover_dns 1602
+%global sover_isc 1602
 %global sover_irs 1600
 %global sover_isccfg 1600
 
@@ -61,8 +61,8 @@
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.16.1
-Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Version:  9.16.2
+Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -121,8 +121,6 @@ Patch164:bind-9.11-rh1666814.patch
 Patch170:bind-9.11-feature-test-named.patch
 Patch171:bind-9.11-tests-variants.patch
 Patch172:bind-9.11-tests-pkcs11.patch
-# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/3323
-Patch173:bind-9.16-libisc-link.patch
 
 Requires(post):   systemd
 Requires(preun):  systemd
@@ -437,7 +435,6 @@ This package provides a module which allows commands to be sent to rndc directly
 %patch170 -p1 -b .featuretest-named
 %patch171 -p1 -b .test-variant
 %patch172 -p1 -b .test-pkcs11
-%patch173 -p1 -b .link-isc
 
 %if %{with PKCS11}
 %patch135 -p1 -b .config-pkcs11
@@ -980,7 +977,7 @@ fi;
 %files libs
 %{_libdir}/libbind9.so.1600*
 %{_libdir}/libisccc.so.1600*
-%{_libdir}/libns.so.1601*
+%{_libdir}/libns.so.1602*
 
 %files libs-lite
 %{_libdir}/libdns.so.%{sover_dns}*
@@ -1162,6 +1159,9 @@ fi;
 
 
 %changelog
+* Thu Apr 16 2020 Petr Menšík <pemensik@redhat.com> - 32:9.16.2-1
+- Update to 9.16.2
+
 * Wed Apr 01 2020 Petr Menšík <pemensik@redhat.com> - 32:9.16.1-2
 - Link all used libraries to libisc
 
diff --git a/sources b/sources
index e1955e4..863a695 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.16.1.tar.xz) = 9a1e8987f312b09a16c2ee0fd1d1eb8e4951b8dbcf3c0d51a1a1fb179a261028239ab2bebc3e559592cc766de57a26ba37b27621a0c5e1711d36c2416f0a0c26
-SHA512 (bind-9.16.1.tar.xz.asc) = fb9967033a0f8efbc05537ce4f3b315607ff06805b415303cf338afab303ca0f146a4d8049e7166971969b87064aa480a72c41d2c0ab1a8f3165e2049ccc4cb0
+SHA512 (bind-9.16.2.tar.xz) = fec47a0df6f91318504d57730148816ee19d7d14769d9c6f84ecd2ced9f575ea86bac2eac65886835aae99f7120495150a40923ee06a7755c6118ffb1f7f166f
+SHA512 (bind-9.16.2.tar.xz.asc) = 854a5f2e82e491e74cfafb874f5cd614c9cb289e1c1bfae66ba37a881d7f8ee0acca99ff9aaddc118e8d52474121a81b627c475e432536cd99411c084479b69b

From 1d9c1cf435894fbd19e440ed70c340256632bed9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 16 Apr 2020 12:42:25 +0200
Subject: [PATCH 145/460] fixup! Make spec work also on CentOS 8

---
 bind.spec | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index 3568099..6d18835 100644
--- a/bind.spec
+++ b/bind.spec
@@ -15,7 +15,6 @@
 # due to extensive changes to Makefiles
 %bcond_with PKCS11
 %bcond_without DEVEL
-%bcond_without LMDB
 %bcond_without JSON
 %bcond_with    BDB
 # skip DLZ for now
@@ -25,9 +24,11 @@
 %if 0%{?fedora} >= 28
 %bcond_without UNITTEST
 %bcond_without DNSTAP
+%bcond_without LMDB
 %else
 %bcond_with    UNITTEST
 %bcond_with    DNSTAP
+%bcond_with    LMDB
 %endif
 %bcond_with    TSAN
 

From 076f5f80bc68b4b25d229bac16f5d555d199c50f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 16 Apr 2020 12:46:45 +0200
Subject: [PATCH 146/460] fixup! Make spec work also on CentOS 8

---
 bind.spec | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index 55ed424..ef77bef 100644
--- a/bind.spec
+++ b/bind.spec
@@ -16,7 +16,6 @@
 # due to extensive changes to Makefiles
 %bcond_without PKCS11
 %bcond_without DEVEL
-%bcond_without LMDB
 %bcond_without JSON
 %bcond_without DLZ
 %bcond_with    BDB
@@ -28,9 +27,11 @@
 %if 0%{?fedora} >= 28
 %bcond_without UNITTEST
 %bcond_without DNSTAP
+%bcond_without LMDB
 %else
 %bcond_with    UNITTEST
 %bcond_with    DNSTAP
+%bcond_with    LMDB
 %endif
 %bcond_with    TSAN
 

From b72488cc2473eb2a04fdbad5ae2426e1b20d0f40 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bj=C3=B6rn=20Esser?= <besser82@fedoraproject.org>
Date: Wed, 22 Apr 2020 00:01:59 +0200
Subject: [PATCH 147/460] Rebuild (json-c)

---
 bind.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index ef77bef..01d00ea 100644
--- a/bind.spec
+++ b/bind.spec
@@ -66,7 +66,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.11.18
-Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1604,6 +1604,9 @@ fi;
 
 
 %changelog
+* Tue Apr 21 2020 Björn Esser <besser82@fedoraproject.org> - 32:9.11.18-2
+- Rebuild (json-c)
+
 * Thu Apr 16 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.18-1
 - Update to 9.11.18
 

From aaa1cdaabfb975fd8148639ed99c7776854ee59f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 24 Apr 2020 15:17:14 +0200
Subject: [PATCH 148/460] Update configuration to 9.16

Fixes warnings in default configuration file. Skip always enabled DNSSEC
and use more recent trust anchor format.
---
 bind.spec      | 5 ++++-
 named.conf     | 1 -
 named.root.key | 2 +-
 3 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/bind.spec b/bind.spec
index 6d18835..b2f8451 100644
--- a/bind.spec
+++ b/bind.spec
@@ -63,7 +63,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.16.2
-Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1160,6 +1160,9 @@ fi;
 
 
 %changelog
+* Fri Apr 24 2020 Petr Menšík <pemensik@redhat.com> - 32:9.16.2-2
+- Remove warnings in default configuration
+
 * Thu Apr 16 2020 Petr Menšík <pemensik@redhat.com> - 32:9.16.2-1
 - Update to 9.16.2
 
diff --git a/named.conf b/named.conf
index cea9782..c906875 100644
--- a/named.conf
+++ b/named.conf
@@ -30,7 +30,6 @@ options {
 	*/
 	recursion yes;
 
-	dnssec-enable yes;
 	dnssec-validation yes;
 
 	managed-keys-directory "/var/named/dynamic";
diff --git a/named.root.key b/named.root.key
index 48449a8..647e1bd 100644
--- a/named.root.key
+++ b/named.root.key
@@ -1,4 +1,4 @@
-managed-keys {
+trusted-anchors {
         # ROOT KEYS: See https://data.iana.org/root-anchors/root-anchors.xml
         # for current trust anchor information.
         #

From 8b8d05ffc028047b879d72a5578106a75f4dd8b8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 27 Apr 2020 12:01:53 +0200
Subject: [PATCH 149/460] Update sample config to match current version

---
 bind.spec         |  5 ++++-
 named.conf.sample | 51 +++++++++++++++++++----------------------------
 named.root.key    |  2 +-
 3 files changed, 26 insertions(+), 32 deletions(-)

diff --git a/bind.spec b/bind.spec
index b2f8451..c45b2f1 100644
--- a/bind.spec
+++ b/bind.spec
@@ -63,7 +63,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.16.2
-Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  3%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1160,6 +1160,9 @@ fi;
 
 
 %changelog
+* Mon Apr 27 2020 Petr Menšík <pemensik@redhat.com> - 32:9.16.2-3
+- Correct trust anchors
+
 * Fri Apr 24 2020 Petr Menšík <pemensik@redhat.com> - 32:9.16.2-2
 - Remove warnings in default configuration
 
diff --git a/named.conf.sample b/named.conf.sample
index a6cdc5e..d2ce6dd 100644
--- a/named.conf.sample
+++ b/named.conf.sample
@@ -63,10 +63,6 @@ options
 
 	/* DNSSEC related options. See information about keys ("Trusted keys", bellow) */
 
-	/* Enable serving of DNSSEC related data - enable on both authoritative
- 	   and recursive servers DNSSEC aware servers */
-	dnssec-enable yes;
-
 	/* Enable DNSSEC validation on recursive servers */
 	dnssec-validation yes;
 
@@ -182,8 +178,8 @@ view "internal"
 
 key ddns_key
 {
-	algorithm hmac-md5;
-	secret "use /usr/sbin/dnssec-keygen to generate TSIG keys";
+	algorithm hmac-sha256;
+	secret "use /usr/sbin/ddns-confgen to generate TSIG keys";
 };
 
 view "external"
@@ -214,39 +210,34 @@ view "external"
 /* Trusted keys
 
   This statement contains DNSSEC keys. If you want DNSSEC aware resolver you
-  have to configure at least one trusted key.
+  should configure at least one trusted key.
 
   Note that no key written below is valid. Especially root key because root zone
   is not signed yet.
 */
 /*
-trusted-keys {
+trust-anchors {
 // Root Key
-"." 257 3 3 "BNY4wrWM1nCfJ+CXd0rVXyYmobt7sEEfK3clRbGaTwSJxrGkxJWoZu6I7PzJu/
-             E9gx4UC1zGAHlXKdE4zYIpRhaBKnvcC2U9mZhkdUpd1Vso/HAdjNe8LmMlnzY3
-             zy2Xy4klWOADTPzSv9eamj8V18PHGjBLaVtYvk/ln5ZApjYghf+6fElrmLkdaz
-             MQ2OCnACR817DF4BBa7UR/beDHyp5iWTXWSi6XmoJLbG9Scqc7l70KDqlvXR3M
-             /lUUVRbkeg1IPJSidmK3ZyCllh4XSKbje/45SKucHgnwU5jefMtq66gKodQj+M
-             iA21AfUVe7u99WzTLzY3qlxDhxYQQ20FQ97S+LKUTpQcq27R7AT3/V5hRQxScI
-             Nqwcz4jYqZD2fQdgxbcDTClU0CRBdiieyLMNzXG3";
+. initial-key 257 3 8 "AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3
+		      +/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kv
+		      ArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF
+		      0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+e
+		      oZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfd
+		      RUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwN
+		      R1AkUTV74bU=";
 
 // Key for forward zone
-example.com. 257 3 5 "AwEAAaxPMcR2x0HbQV4WeZB6oEDX+r0QM65KbhTjrW1ZaARmPhEZZe
-                      3Y9ifgEuq7vZ/zGZUdEGNWy+JZzus0lUptwgjGwhUS1558Hb4JKUbb
-                      OTcM8pwXlj0EiX3oDFVmjHO444gLkBO UKUf/mC7HvfwYH/Be22GnC
-                      lrinKJp1Og4ywzO9WglMk7jbfW33gUKvirTHr25GL7STQUzBb5Usxt
-                      8lgnyTUHs1t3JwCY5hKZ6CqFxmAVZP20igTixin/1LcrgX/KMEGd/b
-                      iuvF4qJCyduieHukuY3H4XMAcR+xia2 nIUPvm/oyWR8BW/hWdzOvn
-                      SCThlHf3xiYleDbt/o1OTQ09A0=";
+example.com. static-key 257 3 8 "AwEAAZ0aqu1rJ6orJynrRfNpPmayJZoAx9Ic2/Rl9VQW
+				LMHyjxxem3VUSoNUIFXERQbj0A9Ogp0zDM9YIccKLRd6
+				LmWiDCt7UJQxVdD+heb5Ec4qlqGmyX9MDabkvX2NvMws
+				UecbYBq8oXeTT9LRmCUt9KUt/WOi6DKECxoG/bWTykrX
+				yBR8elD+SQY43OAVjlWrVltHxgp4/rhBCvRbmdflunaP
+				Igu27eE2U4myDSLT8a4A0rB5uHG4PkOa9dIRs9y00M2m
+				Wf4lyPee7vi5few2dbayHXmieGcaAHrx76NGAABeY393
+				xjlmDNcUkF1gpNWUla4fWZbbaYQzA93mLdrng+M=";
+
 
 // Key for reverse zone.
-2.0.192.IN-ADDRPA.NET. 257 3 5 "AQOnS4xn/IgOUpBPJ3bogzwcxOdNax071L18QqZnQQQA
-                                VVr+iLhGTnNGp3HoWQLUIzKrJVZ3zggy3WwNT6kZo6c0
-                                tszYqbtvchmgQC8CzKojM/W16i6MG/ea fGU3siaOdS0
-                                yOI6BgPsw+YZdzlYMaIJGf4M4dyoKIhzdZyQ2bYQrjyQ
-                                4LB0lC7aOnsMyYKHHYeRv PxjIQXmdqgOJGq+vsevG06
-                                zW+1xgYJh9rCIfnm1GX/KMgxLPG2vXTD/RnLX+D3T3UL
-                                7HJYHJhAZD5L59VvjSPsZJHeDCUyWYrvPZesZDIRvhDD
-                                52SKvbheeTJUm6EhkzytNN2SN96QRk8j/iI8ib";
+2.0.192.IN-ADDRPA.NET. initial-ds 31406 8 2 "F78CF3344F72137235098ECBBD08947C2C9001C7F6A085A17F518B5D8F6B916D";
 };
 */
diff --git a/named.root.key b/named.root.key
index 647e1bd..e76a698 100644
--- a/named.root.key
+++ b/named.root.key
@@ -1,4 +1,4 @@
-trusted-anchors {
+trust-anchors {
         # ROOT KEYS: See https://data.iana.org/root-anchors/root-anchors.xml
         # for current trust anchor information.
         #

From 3ef9cd3dce339bd1cc54f3f8e382ebb29f4a3206 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 27 Apr 2020 12:21:58 +0200
Subject: [PATCH 150/460] Replace initial key with just digest of it

Mentioned link if a file leads to XML with only checksums included.
Relation between them and included key is not obvious or specified.
Include initial digest, which is shorter and easier to validate.
---
 named.root.key | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/named.root.key b/named.root.key
index e76a698..fbcb5d3 100644
--- a/named.root.key
+++ b/named.root.key
@@ -9,11 +9,5 @@ trust-anchors {
         # file as initializing keys; thereafter, the keys in the
         # managed key database will be trusted and maintained
         # automatically.
-        . initial-key 257 3 8 "AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3
-                +/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kv
-                ArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF
-                0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+e
-                oZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfd
-                RUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwN
-                R1AkUTV74bU=";
+        . initial-ds 20326 8 2 "E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D";
 };

From afbbd0be5277063c24da197f42561380f1f88d33 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 27 Apr 2020 21:59:25 +0200
Subject: [PATCH 151/460] Add support to native PKCS11

Set of patches and changes, that fixes compilation of native PKCS11
support as subpackage. Moves definition of USE_PKCS11 from config.h to
Makefiles. Defaults to off and only PKCS11 subdirectories set it to
true.
---
 bind-9.10-dist-native-pkcs11.patch | 253 +++++++++++------------------
 bind-9.11-engine-pkcs11.patch      |  27 ---
 bind-9.14-config-pkcs11.patch      | 102 ++----------
 bind.spec                          |   9 +-
 4 files changed, 114 insertions(+), 277 deletions(-)
 delete mode 100644 bind-9.11-engine-pkcs11.patch

diff --git a/bind-9.10-dist-native-pkcs11.patch b/bind-9.10-dist-native-pkcs11.patch
index c1b479a..b623f58 100644
--- a/bind-9.10-dist-native-pkcs11.patch
+++ b/bind-9.10-dist-native-pkcs11.patch
@@ -12,7 +12,7 @@ index 9ad7f62..094775a 100644
  TARGETS =
  
 diff --git a/bin/confgen/Makefile.in b/bin/confgen/Makefile.in
-index 1e0fe0e..dc3a7f6 100644
+index ef3e70c..1f5165a 100644
 --- a/bin/confgen/Makefile.in
 +++ b/bin/confgen/Makefile.in
 @@ -22,7 +22,7 @@ VERSION=@BIND9_VERSION@
@@ -23,62 +23,56 @@ index 1e0fe0e..dc3a7f6 100644
 +CDEFINES =
  CWARNINGS =
  
- ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
-diff --git a/bin/dig/Makefile.in b/bin/dig/Makefile.in
-index 2317ec0..0601939 100644
---- a/bin/dig/Makefile.in
-+++ b/bin/dig/Makefile.in
-@@ -21,7 +21,7 @@ CINCLUDES =	-I${srcdir}/include ${DNS_INCLUDES} \
- 		${BIND9_INCLUDES} ${ISC_INCLUDES} \
- 		${IRS_INCLUDES} ${ISCCFG_INCLUDES} @LIBIDN2_CFLAGS@ @OPENSSL_INCLUDES@
- 
--CDEFINES =	-DVERSION=\"${VERSION}\" @USE_PKCS11@
-+CDEFINES =	-DVERSION=\"${VERSION}\"
- CWARNINGS =
- 
  ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
 diff --git a/bin/dnssec-pkcs11/Makefile.in b/bin/dnssec-pkcs11/Makefile.in
-index 1dad340..ffac64e 100644
+index 7486bf0..7d791d1 100644
 --- a/bin/dnssec-pkcs11/Makefile.in
 +++ b/bin/dnssec-pkcs11/Makefile.in
-@@ -15,16 +15,16 @@ VERSION=@BIND9_VERSION@
+@@ -15,18 +15,18 @@ VERSION=@BIND9_VERSION@
  
  @BIND9_MAKE_INCLUDES@
  
--CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} @OPENSSL_INCLUDES@
-+CINCLUDES =	${DNS_PKCS11_INCLUDES} ${ISC_INCLUDES} @OPENSSL_INCLUDES@
+-CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} ${ISCCFG_INCLUDES} \
++CINCLUDES =	${DNS_PKCS11_INCLUDES} ${ISC_INCLUDES} ${ISCCFG_INCLUDES} \
+ 		${OPENSSL_CFLAGS}
  
- CDEFINES =	-DVERSION=\"${VERSION}\" @USE_PKCS11@
+-CDEFINES =	-DVERSION=\"${VERSION}\" -DNAMED_CONFFILE=\"${sysconfdir}/named.conf\"
++CDEFINES =	-DVERSION=\"${VERSION}\" -DNAMED_CONFFILE=\"${sysconfdir}/named.conf\" -DUSE_PKCS11=1
  CWARNINGS =
  
 -DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
 +DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_PK11_LIBS@
- ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
- ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @OPENSSL_LIBS@
+ ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
+ ISCLIBS =	../../lib/isc/libisc.@A@ ${OPENSSL_LIBS} ${JSON_C_LIBS} ${LIBXML2_LIBS} ${ZLIB_LIBS}
+ ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ ${OPENSSL_LIBS} ${JSON_C_LIBS} ${LIBXML2_LIBS} ${ZLIB_LIBS}
  
 -DNSDEPLIBS =	../../lib/dns/libdns.@A@
 +DNSDEPLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@
  ISCDEPLIBS =	../../lib/isc/libisc.@A@
+ ISCCFGDEPLIBS =	../../lib/isccfg/libisccfg.@A@
  
- DEPLIBS =	${DNSDEPLIBS} ${ISCDEPLIBS}
-@@ -34,11 +34,11 @@ LIBS =		${DNSLIBS} ${ISCLIBS} @LIBS@
- NOSYMLIBS =	${DNSLIBS} ${ISCNOSYMLIBS} @LIBS@
+@@ -36,12 +36,15 @@ LIBS =		${DNSLIBS} ${ISCCFGLIBS} ${ISCLIBS} @LIBS@
  
+ NOSYMLIBS =	${DNSLIBS} ${ISCCFGLIBS} ${ISCNOSYMLIBS} @LIBS@
+ 
++# Add suffix to all targets
++EXEEXT =	-pkcs11@EXEEXT@
++
  # Alphabetically
 -TARGETS =	dnssec-cds@EXEEXT@ dnssec-dsfromkey@EXEEXT@ \
 -		dnssec-importkey@EXEEXT@ dnssec-keyfromlabel@EXEEXT@ \
 -		dnssec-keygen@EXEEXT@ dnssec-revoke@EXEEXT@ \
 -		dnssec-settime@EXEEXT@ dnssec-signzone@EXEEXT@ \
 -		dnssec-verify@EXEEXT@
-+TARGETS =	dnssec-cds-pkcs11@EXEEXT@ dnssec-dsfromkey-pkcs11@EXEEXT@ \
-+		dnssec-importkey-pkcs11@EXEEXT@ dnssec-keyfromlabel-pkcs11@EXEEXT@ \
-+		dnssec-keygen-pkcs11@EXEEXT@ dnssec-revoke-pkcs11@EXEEXT@ \
-+		dnssec-settime-pkcs11@EXEEXT@ dnssec-signzone-pkcs11@EXEEXT@ \
-+		dnssec-verify-pkcs11@EXEEXT@
++TARGETS =	dnssec-cds${EXEEXT} dnssec-dsfromkey${EXEEXT} \
++		dnssec-importkey${EXEEXT} dnssec-keyfromlabel${EXEEXT} \
++		dnssec-keygen${EXEEXT} dnssec-revoke${EXEEXT} \
++		dnssec-settime${EXEEXT} dnssec-signzone${EXEEXT} \
++		dnssec-verify${EXEEXT}
  
  OBJS =		dnssectool.@O@
  
-@@ -61,19 +61,19 @@ MANOBJS =	${MANPAGES} ${HTMLPAGES}
+@@ -64,19 +67,19 @@ MANOBJS =	${MANPAGES} ${HTMLPAGES}
  
  @BIND9_MAKE_RULES@
  
@@ -102,7 +96,7 @@ index 1dad340..ffac64e 100644
  	export BASEOBJS="dnssec-keygen.@O@ ${OBJS}"; \
  	${FINALBUILDCMD}
  
-@@ -81,7 +81,7 @@ dnssec-signzone.@O@: dnssec-signzone.c
+@@ -84,7 +87,7 @@ dnssec-signzone.@O@: dnssec-signzone.c
  	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} -DVERSION=\"${VERSION}\" \
  		-c ${srcdir}/dnssec-signzone.c
  
@@ -111,7 +105,7 @@ index 1dad340..ffac64e 100644
  	export BASEOBJS="dnssec-signzone.@O@ ${OBJS}"; \
  	${FINALBUILDCMD}
  
-@@ -89,19 +89,19 @@ dnssec-verify.@O@: dnssec-verify.c
+@@ -92,19 +95,19 @@ dnssec-verify.@O@: dnssec-verify.c
  	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} -DVERSION=\"${VERSION}\" \
  		-c ${srcdir}/dnssec-verify.c
  
@@ -135,7 +129,7 @@ index 1dad340..ffac64e 100644
  	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \
  	dnssec-importkey.@O@ ${OBJS} ${LIBS}
  
-@@ -112,16 +112,14 @@ docclean manclean maintainer-clean::
+@@ -115,16 +118,14 @@ docclean manclean maintainer-clean::
  
  installdirs:
  	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
@@ -153,33 +147,36 @@ index 1dad340..ffac64e 100644
  	for t in ${TARGETS}; do ${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/$$t || exit 1; done
  
  clean distclean::
-diff --git a/bin/dnssec/Makefile.in b/bin/dnssec/Makefile.in
-index 1dad340..321058b 100644
---- a/bin/dnssec/Makefile.in
-+++ b/bin/dnssec/Makefile.in
-@@ -17,7 +17,7 @@ VERSION=@BIND9_VERSION@
- 
- CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} @OPENSSL_INCLUDES@
- 
--CDEFINES =	-DVERSION=\"${VERSION}\" @USE_PKCS11@
-+CDEFINES =	-DVERSION=\"${VERSION}\"
- CWARNINGS =
- 
- DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
 diff --git a/bin/named-pkcs11/Makefile.in b/bin/named-pkcs11/Makefile.in
-index e5b0d4b..b739869 100644
+index cb187e5..1bcb249 100644
 --- a/bin/named-pkcs11/Makefile.in
 +++ b/bin/named-pkcs11/Makefile.in
-@@ -43,7 +43,7 @@ DLZDRIVER_INCLUDES =	@DLZ_DRIVER_INCLUDES@
- DLZDRIVER_LIBS =	@DLZ_DRIVER_LIBS@
+@@ -37,13 +37,14 @@ DBDRIVER_LIBS =
+ 
+ DLZ_DRIVER_DIR =	${top_srcdir}/contrib/dlz/drivers
+ 
+-DLZDRIVER_OBJS =	@DLZ_DRIVER_OBJS@
+-DLZDRIVER_SRCS =	@DLZ_DRIVER_SRCS@
+-DLZDRIVER_INCLUDES =	@DLZ_DRIVER_INCLUDES@
+-DLZDRIVER_LIBS =	@DLZ_DRIVER_LIBS@
++# Skip building on PKCS11 variant
++DLZDRIVER_OBJS =
++DLZDRIVER_SRCS =
++DLZDRIVER_INCLUDES =
++DLZDRIVER_LIBS =
  
  CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
 -		${NS_INCLUDES} ${DNS_INCLUDES} \
 +		${NS_PKCS11_INCLUDES} ${DNS_PKCS11_INCLUDES} \
  		${BIND9_INCLUDES} ${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} \
  		${ISC_INCLUDES} ${DLZDRIVER_INCLUDES} \
- 		${DBDRIVER_INCLUDES} ${MAXMINDDB_CFLAGS} \
-@@ -53,37 +53,37 @@ CDEFINES =      @CONTRIB_DLZ@ @USE_PKCS11@
+ 		${DBDRIVER_INCLUDES} \
+@@ -53,24 +54,24 @@ CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
+ 		${MAXMINDDB_CFLAGS} \
+ 		${ZLIB_CFLAGS}
+ 
+-CDEFINES =      @CONTRIB_DLZ@
++CDEFINES =
  
  CWARNINGS =
  
@@ -187,8 +184,8 @@ index e5b0d4b..b739869 100644
 +DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_PK11_LIBS@
  ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
  ISCCCLIBS =	../../lib/isccc/libisccc.@A@
- ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
- ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @OPENSSL_LIBS@
+ ISCLIBS =	../../lib/isc/libisc.@A@ ${OPENSSL_LIBS} ${JSON_C_LIBS} ${LIBXML2_LIBS} ${ZLIB_LIBS}
+ ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ ${OPENSSL_LIBS} ${JSON_C_LIBS} ${LIBXML2_LIBS} ${ZLIB_LIBS}
  BIND9LIBS =	../../lib/bind9/libbind9.@A@
 -NSLIBS =	../../lib/ns/libns.@A@
 +NSLIBS =	../../lib/ns-pkcs11/libns-pkcs11.@A@
@@ -204,47 +201,16 @@ index e5b0d4b..b739869 100644
  
  DEPLIBS =	${NSDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
  		${ISCCFGDEPLIBS} ${ISCCCDEPLIBS} ${ISCDEPLIBS}
- 
- LIBS =		${NSLIBS} ${DNSLIBS} ${BIND9LIBS} \
- 		${ISCCFGLIBS} ${ISCCCLIBS} ${ISCLIBS} \
--		${DLZDRIVER_LIBS} ${DBDRIVER_LIBS} @LIBCAP_LIBS@ \
-+		@LIBCAP_LIBS@ \
- 		@LIBS@
- 
- NOSYMLIBS =	${NSLIBS} ${DNSLIBS} ${BIND9LIBS} \
- 		${ISCCFGLIBS} ${ISCCCLIBS} ${ISCNOSYMLIBS} \
--		${DLZDRIVER_LIBS} ${DBDRIVER_LIBS} @LIBCAP_LIBS@ \
-+		@LIBCAP_LIBS@ \
- 		@LIBS@
+@@ -87,7 +88,7 @@ NOSYMLIBS =	${NSLIBS} ${DNSLIBS} ${BIND9LIBS} \
  
  SUBDIRS =	unix
  
 -TARGETS =	named@EXEEXT@ feature-test@EXEEXT@
 +TARGETS =	named-pkcs11@EXEEXT@ feature-test-pkcs11@EXEEXT@
  
- GEOIPLINKOBJS = geoip.@O@
  GEOIP2LINKOBJS = geoip.@O@
-@@ -93,8 +93,7 @@ OBJS =		builtin.@O@ config.@O@ control.@O@ \
- 		@GEOIPLINKOBJS@ @GEOIP2LINKOBJS@ \
- 		log.@O@ logconf.@O@ main.@O@ \
- 		server.@O@ statschannel.@O@ \
--		tkeyconf.@O@ tsigconf.@O@ zoneconf.@O@ \
--		${DLZDRIVER_OBJS} ${DBDRIVER_OBJS}
-+		tkeyconf.@O@ tsigconf.@O@ zoneconf.@O@
  
- UOBJS =		unix/os.@O@ unix/dlz_dlopen_driver.@O@
- 
-@@ -108,8 +107,7 @@ SRCS =		builtin.c config.c control.c \
- 		@GEOIPLINKSRCS@ @GEOIP2LINKSRCS@ \
- 		log.c logconf.c main.c \
- 		server.c statschannel.c \
--		tkeyconf.c tsigconf.c zoneconf.c \
--		${DLZDRIVER_SRCS} ${DBDRIVER_SRCS}
-+		tkeyconf.c tsigconf.c zoneconf.c
- 
- MANPAGES =	named.8 named.conf.5
- 
-@@ -149,7 +147,7 @@ server.@O@: server.c
+@@ -151,7 +152,7 @@ server.@O@: server.c
  		-DPRODUCT=\"${PRODUCT}\" \
  		-DVERSION=\"${VERSION}\" -c ${srcdir}/server.c
  
@@ -253,7 +219,7 @@ index e5b0d4b..b739869 100644
  	export MAKE_SYMTABLE="yes"; \
  	export BASEOBJS="${OBJS} ${UOBJS}"; \
  	${FINALBUILDCMD}
-@@ -159,7 +157,7 @@ feature-test.@O@: ${top_srcdir}/bin/tests/system/feature-test.c
+@@ -161,7 +162,7 @@ feature-test.@O@: ${top_srcdir}/bin/tests/system/feature-test.c
  	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} \
  		-c ${top_srcdir}/bin/tests/system/feature-test.c
  
@@ -262,7 +228,7 @@ index e5b0d4b..b739869 100644
  	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} \
  		-o $@ feature-test.@O@ ${ISCLIBS} ${LIBS}
  
-@@ -192,13 +190,13 @@ install-man8: named.8
+@@ -194,13 +195,13 @@ install-man8: named.8
  
  install-man: install-man5 install-man8
  
@@ -279,24 +245,11 @@ index e5b0d4b..b739869 100644
  
  @DLZ_DRIVER_RULES@
  
-diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
-index e5b0d4b..eecfa76 100644
---- a/bin/named/Makefile.in
-+++ b/bin/named/Makefile.in
-@@ -49,7 +49,7 @@ CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
- 		${DBDRIVER_INCLUDES} ${MAXMINDDB_CFLAGS} \
- 		@OPENSSL_INCLUDES@
- 
--CDEFINES =      @CONTRIB_DLZ@ @USE_PKCS11@
-+CDEFINES =      @CONTRIB_DLZ@
- 
- CWARNINGS =
- 
 diff --git a/configure.ac b/configure.ac
-index 6cce3bb..d80ae31 100644
+index de6a248..e95ef36 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -1276,12 +1276,14 @@ AC_SUBST(USE_GSSAPI)
+@@ -1196,12 +1196,14 @@ AC_SUBST(USE_GSSAPI)
  AC_SUBST(DST_GSSAPI_INC)
  AC_SUBST(DNS_GSSAPI_LIBS)
  DNS_CRYPTO_LIBS="$DNS_GSSAPI_LIBS"
@@ -311,7 +264,7 @@ index 6cce3bb..d80ae31 100644
  
  #
  # was --with-lmdb specified?
-@@ -2522,6 +2524,8 @@ AC_SUBST(BIND9_DNS_BUILDINCLUDE)
+@@ -2296,6 +2298,8 @@ AC_SUBST(BIND9_DNS_BUILDINCLUDE)
  AC_SUBST(BIND9_NS_BUILDINCLUDE)
  AC_SUBST(BIND9_BIND9_BUILDINCLUDE)
  AC_SUBST(BIND9_IRS_BUILDINCLUDE)
@@ -320,7 +273,7 @@ index 6cce3bb..d80ae31 100644
  if test "X$srcdir" != "X"; then
  	BIND9_ISC_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/isc/include"
  	BIND9_ISCCC_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/isccc/include"
-@@ -2530,6 +2534,8 @@ if test "X$srcdir" != "X"; then
+@@ -2304,6 +2308,8 @@ if test "X$srcdir" != "X"; then
  	BIND9_NS_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/ns/include"
  	BIND9_BIND9_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/bind9/include"
  	BIND9_IRS_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/irs/include"
@@ -329,7 +282,7 @@ index 6cce3bb..d80ae31 100644
  else
  	BIND9_ISC_BUILDINCLUDE=""
  	BIND9_ISCCC_BUILDINCLUDE=""
-@@ -2538,6 +2544,8 @@ else
+@@ -2312,6 +2318,8 @@ else
  	BIND9_NS_BUILDINCLUDE=""
  	BIND9_BIND9_BUILDINCLUDE=""
  	BIND9_IRS_BUILDINCLUDE=""
@@ -338,7 +291,7 @@ index 6cce3bb..d80ae31 100644
  fi
  
  AC_SUBST_FILE(BIND9_MAKE_INCLUDES)
-@@ -3001,8 +3009,11 @@ AC_CONFIG_FILES([
+@@ -2771,8 +2779,11 @@ AC_CONFIG_FILES([
  	bin/delv/Makefile
  	bin/dig/Makefile
  	bin/dnssec/Makefile
@@ -350,7 +303,7 @@ index 6cce3bb..d80ae31 100644
  	bin/nsupdate/Makefile
  	bin/pkcs11/Makefile
  	bin/plugins/Makefile
-@@ -3075,6 +3086,10 @@ AC_CONFIG_FILES([
+@@ -2843,6 +2854,10 @@ AC_CONFIG_FILES([
  	lib/dns/include/dns/Makefile
  	lib/dns/include/dst/Makefile
  	lib/dns/tests/Makefile
@@ -361,7 +314,7 @@ index 6cce3bb..d80ae31 100644
  	lib/irs/Makefile
  	lib/irs/include/Makefile
  	lib/irs/include/irs/Makefile
-@@ -3107,6 +3122,10 @@ AC_CONFIG_FILES([
+@@ -2875,6 +2890,10 @@ AC_CONFIG_FILES([
  	lib/ns/include/Makefile
  	lib/ns/include/ns/Makefile
  	lib/ns/tests/Makefile
@@ -371,7 +324,7 @@ index 6cce3bb..d80ae31 100644
 +	lib/ns-pkcs11/tests/Makefile
  	lib/samples/Makefile
  	lib/samples/Makefile-postinstall
- 	unit/unittest.sh
+ 	make/Makefile
 diff --git a/lib/Makefile.in b/lib/Makefile.in
 index ffa2d5a..6fbc192 100644
 --- a/lib/Makefile.in
@@ -386,24 +339,27 @@ index ffa2d5a..6fbc192 100644
  
  @BIND9_MAKE_RULES@
 diff --git a/lib/dns-pkcs11/Makefile.in b/lib/dns-pkcs11/Makefile.in
-index 9125b10..593270d 100644
+index 0ef3b5f..80683c2 100644
 --- a/lib/dns-pkcs11/Makefile.in
 +++ b/lib/dns-pkcs11/Makefile.in
-@@ -26,11 +26,11 @@ VERSION=@BIND9_VERSION@
+@@ -26,14 +26,14 @@ VERSION=@BIND9_VERSION@
  
  USE_ISC_SPNEGO = @USE_ISC_SPNEGO@
  
 -CINCLUDES =	-I. -I${top_srcdir}/lib/dns -Iinclude ${DNS_INCLUDES} \
 +CINCLUDES =	-I. -I${top_srcdir}/lib/dns-pkcs11 -Iinclude ${DNS_PKCS11_INCLUDES} \
- 		${ISC_INCLUDES} ${MAXMINDDB_CFLAGS} \
- 		@OPENSSL_INCLUDES@ @DST_GSSAPI_INC@
+ 		${ISC_INCLUDES} \
+ 		${OPENSSL_CFLAGS} @DST_GSSAPI_INC@ \
+ 		${JSON_C_CFLAGS} \
+ 		${LIBXML2_CFLAGS} \
+ 		${MAXMINDDB_CFLAGS}
  
--CDEFINES =	@USE_GSSAPI@ ${USE_ISC_SPNEGO} @USE_OPENSSL@ @USE_PKCS11@
-+CDEFINES =	@USE_GSSAPI@ ${USE_ISC_SPNEGO} @USE_PKCS11@ -DUSE_OPENSSL=0
+-CDEFINES =	@USE_GSSAPI@ ${USE_ISC_SPNEGO}
++CDEFINES =	@USE_GSSAPI@ ${USE_ISC_SPNEGO} @USE_PKCS11@
  
  CWARNINGS =
  
-@@ -138,15 +138,15 @@ version.@O@: version.c
+@@ -139,15 +139,15 @@ version.@O@: version.c
  		-DLIBAGE=${LIBAGE} \
  		-c ${srcdir}/version.c
  
@@ -423,7 +379,7 @@ index 9125b10..593270d 100644
  
  include: gen
  	${MAKE} include/dns/enumtype.h
-@@ -177,22 +177,22 @@ gen: gen.c
+@@ -178,22 +178,22 @@ gen: gen.c
  	${BUILD_CPPFLAGS} ${BUILD_LDFLAGS} -o $@ ${srcdir}/gen.c \
  	${BUILD_LIBS} ${LFS_LIBS}
  
@@ -452,7 +408,7 @@ index 9125b10..593270d 100644
  	rm -f include/dns/rdatastruct.h
  	rm -f dnstap.pb-c.c dnstap.pb-c.h
 diff --git a/lib/dns-pkcs11/tests/Makefile.in b/lib/dns-pkcs11/tests/Makefile.in
-index 0e91523..9351c3f 100644
+index fd8ebb9..9384a4f 100644
 --- a/lib/dns-pkcs11/tests/Makefile.in
 +++ b/lib/dns-pkcs11/tests/Makefile.in
 @@ -15,14 +15,14 @@ VERSION=@BIND9_VERSION@
@@ -461,11 +417,11 @@ index 0e91523..9351c3f 100644
  
 -CINCLUDES =	-I. -Iinclude ${DNS_INCLUDES} ${ISC_INCLUDES} \
 +CINCLUDES =	-I. -Iinclude ${DNS_PKCS11_INCLUDES} ${ISC_INCLUDES} \
- 		@OPENSSL_INCLUDES@ @CMOCKA_CFLAGS@
+ 		${OPENSSL_CFLAGS} ${MAXMINDDB_CFLAGS} @CMOCKA_CFLAGS@
 -CDEFINES =	-DTESTS="\"${top_builddir}/lib/dns/tests/\""
 +CDEFINES =	@USE_PKCS11@ -DTESTS="\"${top_builddir}/lib/dns-pkcs11/tests/\""
  
- ISCLIBS =	../../isc/libisc.@A@ @OPENSSL_LIBS@
+ ISCLIBS =	../../isc/libisc.@A@ ${OPENSSL_LIBS} ${JSON_C_LIBS} ${LIBXML2_LIBS} ${ZLIB_LIBS}
  ISCDEPLIBS =	../../isc/libisc.@A@
 -DNSLIBS =	../libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
 -DNSDEPLIBS =	../libdns.@A@
@@ -474,24 +430,11 @@ index 0e91523..9351c3f 100644
  
  LIBS =		@LIBS@ @CMOCKA_LIBS@
  
-diff --git a/lib/dns/Makefile.in b/lib/dns/Makefile.in
-index 9125b10..70644d8 100644
---- a/lib/dns/Makefile.in
-+++ b/lib/dns/Makefile.in
-@@ -30,7 +30,7 @@ CINCLUDES =	-I. -I${top_srcdir}/lib/dns -Iinclude ${DNS_INCLUDES} \
- 		${ISC_INCLUDES} ${MAXMINDDB_CFLAGS} \
- 		@OPENSSL_INCLUDES@ @DST_GSSAPI_INC@
- 
--CDEFINES =	@USE_GSSAPI@ ${USE_ISC_SPNEGO} @USE_OPENSSL@ @USE_PKCS11@
-+CDEFINES =	@USE_GSSAPI@ ${USE_ISC_SPNEGO} @USE_OPENSSL@
- 
- CWARNINGS =
- 
 diff --git a/lib/ns-pkcs11/Makefile.in b/lib/ns-pkcs11/Makefile.in
-index 58d731a..47b4b98 100644
+index 97aaaf6..c7ffc7b 100644
 --- a/lib/ns-pkcs11/Makefile.in
 +++ b/lib/ns-pkcs11/Makefile.in
-@@ -20,8 +20,8 @@ VERSION=@BIND9_VERSION@
+@@ -20,11 +20,11 @@ VERSION=@BIND9_VERSION@
  
  USE_ISC_SPNEGO = @USE_ISC_SPNEGO@
  
@@ -499,10 +442,14 @@ index 58d731a..47b4b98 100644
 -		${NS_INCLUDES} ${DNS_INCLUDES} ${ISC_INCLUDES} \
 +CINCLUDES =	-I. -I${top_srcdir}/lib/ns-pkcs11 -Iinclude \
 +		${NS_PKCS11_INCLUDES} ${DNS_PKCS11_INCLUDES} ${ISC_INCLUDES} \
- 		@OPENSSL_INCLUDES@ @DST_GSSAPI_INC@
+ 		${OPENSSL_CFLAGS} @DST_GSSAPI_INC@
  
- CDEFINES =	@USE_PKCS11@ -DNAMED_PLUGINDIR=\"${plugindir}\"
-@@ -32,9 +32,9 @@ ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
+-CDEFINES =	-DNAMED_PLUGINDIR=\"${plugindir}\"
++CDEFINES =	@USE_PKCS11@ -DNAMED_PLUGINDIR=\"${plugindir}\"
+ 
+ CWARNINGS =
+ 
+@@ -32,9 +32,9 @@ ISCLIBS =	../../lib/isc/libisc.@A@ ${OPENSSL_LIBS} ${JSON_C_LIBS} ${LIBXML2_LIBS
  
  ISCDEPLIBS =	../../lib/isc/libisc.@A@
  
@@ -552,20 +499,21 @@ index 58d731a..47b4b98 100644
 -	rm -f libns.@A@ timestamp
 +	rm -f libns-pkcs11.@A@ timestamp
 diff --git a/lib/ns-pkcs11/tests/Makefile.in b/lib/ns-pkcs11/tests/Makefile.in
-index ffd8f41..4a6cb1b 100644
+index 70c77a4..87955a7 100644
 --- a/lib/ns-pkcs11/tests/Makefile.in
 +++ b/lib/ns-pkcs11/tests/Makefile.in
-@@ -15,16 +15,16 @@ VERSION=@BIND9_VERSION@
- 
- @BIND9_MAKE_INCLUDES@
+@@ -21,17 +21,17 @@ WRAP_NAME =	-Wl,-install_name,${top_builddir}/lib/ns/tests/$@
+ WRAP_RPATH =	-Wl,-rpath,${top_builddir}/lib/ns/tests
+ WRAP_LIB =	-L${top_builddir}/lib/ns/tests -lwrap
  
 -CINCLUDES =	-I. -Iinclude ${NS_INCLUDES} ${DNS_INCLUDES} ${ISC_INCLUDES} \
 +CINCLUDES =	-I. -Iinclude ${NS_PKCS11_INCLUDES} ${DNS_PKCS11_INCLUDES} ${ISC_INCLUDES} \
- 		@OPENSSL_INCLUDES@ @CMOCKA_CFLAGS@
+ 		${OPENSSL_CFLAGS} \
+ 		@CMOCKA_CFLAGS@
 -CDEFINES =	-DTESTS="\"${top_builddir}/lib/ns/tests/\"" -DNAMED_PLUGINDIR=\"${plugindir}\"
-+CDEFINES =	@USE_PKCS11@ -DTESTS="\"${top_builddir}/lib/ns/tests/\"" -DNAMED_PLUGINDIR=\"${plugindir}\"
++CDEFINES =	-DTESTS="\"${top_builddir}/lib/ns/tests/\"" -DNAMED_PLUGINDIR=\"${plugindir}\" @USE_PKCS11@
  
- ISCLIBS =	../../isc/libisc.@A@ @OPENSSL_LIBS@
+ ISCLIBS =	../../isc/libisc.@A@ ${OPENSSL_LIBS} ${JSON_C_LIBS} ${LIBXML2_LIBS} ${ZLIB_LIBS}
  ISCDEPLIBS =	../../isc/libisc.@A@
 -DNSLIBS =	../../dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
 -DNSDEPLIBS =	../../dns/libdns.@A@
@@ -578,19 +526,6 @@ index ffd8f41..4a6cb1b 100644
  
  LIBS =		@LIBS@ @CMOCKA_LIBS@
  
-diff --git a/lib/ns/Makefile.in b/lib/ns/Makefile.in
-index 58d731a..a14728d 100644
---- a/lib/ns/Makefile.in
-+++ b/lib/ns/Makefile.in
-@@ -24,7 +24,7 @@ CINCLUDES =	-I. -I${top_srcdir}/lib/ns -Iinclude \
- 		${NS_INCLUDES} ${DNS_INCLUDES} ${ISC_INCLUDES} \
- 		@OPENSSL_INCLUDES@ @DST_GSSAPI_INC@
- 
--CDEFINES =	@USE_PKCS11@ -DNAMED_PLUGINDIR=\"${plugindir}\"
-+CDEFINES =	-DNAMED_PLUGINDIR=\"${plugindir}\"
- 
- CWARNINGS =
- 
 diff --git a/make/includes.in b/make/includes.in
 index 48cdaf7..7b17738 100644
 --- a/make/includes.in
diff --git a/bind-9.11-engine-pkcs11.patch b/bind-9.11-engine-pkcs11.patch
deleted file mode 100644
index 4a6290d..0000000
--- a/bind-9.11-engine-pkcs11.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From 37f89ccfc439f8d86c401d9ae10e94e53b924961 Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Tue, 27 Aug 2019 20:39:59 +0200
-Subject: [PATCH] Do not set engine for native PKCS11
-
-It resets already set lib_path to pkcs11, which is invalid in native
-pkcs11 crypto. Engine has to be path to PKCS#11 module.
----
- bin/named/include/named/globals.h | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/bin/named/include/named/globals.h b/bin/named/include/named/globals.h
-index eda2214..2a611d5 100644
---- a/bin/named/include/named/globals.h
-+++ b/bin/named/include/named/globals.h
-@@ -160,7 +160,7 @@ EXTERN const char *		ns_g_defaultdnstap	INIT(NULL);
- 
- EXTERN const char *		ns_g_username		INIT(NULL);
- 
--#if defined(USE_PKCS11)
-+#if defined(USE_PKCS11) && !defined(PKCS11CRYPTO)
- EXTERN const char *		ns_g_engine		INIT(PKCS11_ENGINE);
- #else
- EXTERN const char *		ns_g_engine		INIT(NULL);
--- 
-2.20.1
-
diff --git a/bind-9.14-config-pkcs11.patch b/bind-9.14-config-pkcs11.patch
index cf73a1c..a71d772 100644
--- a/bind-9.14-config-pkcs11.patch
+++ b/bind-9.14-config-pkcs11.patch
@@ -1,4 +1,4 @@
-From 233d3784d04bee37b772f391da8726f0cd7b223e Mon Sep 17 00:00:00 2001
+From 2d8abd838870b58629ce55df411b6ba1b2c7288f Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Fri, 18 Oct 2019 21:30:52 +0200
 Subject: [PATCH] Move USE_PKCS11 and USE_OPENSSL out of config.h
@@ -8,17 +8,12 @@ USE_PKCS11 on part of build. That is not possible with config.h value.
 Move it as normal define to CDEFINES.
 ---
  bin/confgen/Makefile.in |  2 +-
- bin/dig/Makefile.in     |  2 +-
- bin/dnssec/Makefile.in  |  2 +-
- bin/named/Makefile.in   |  2 +-
  configure.ac            |  8 ++++++--
- lib/dns/Makefile.in     |  2 +-
  lib/dns/dst_internal.h  | 12 +++++++++---
- lib/ns/Makefile.in      |  2 +-
- 8 files changed, 21 insertions(+), 11 deletions(-)
+ 3 files changed, 16 insertions(+), 6 deletions(-)
 
 diff --git a/bin/confgen/Makefile.in b/bin/confgen/Makefile.in
-index dc3a7f6..1e0fe0e 100644
+index 1f5165a..ef3e70c 100644
 --- a/bin/confgen/Makefile.in
 +++ b/bin/confgen/Makefile.in
 @@ -22,7 +22,7 @@ VERSION=@BIND9_VERSION@
@@ -30,50 +25,11 @@ index dc3a7f6..1e0fe0e 100644
  CWARNINGS =
  
  ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
-diff --git a/bin/dig/Makefile.in b/bin/dig/Makefile.in
-index 0601939..2317ec0 100644
---- a/bin/dig/Makefile.in
-+++ b/bin/dig/Makefile.in
-@@ -21,7 +21,7 @@ CINCLUDES =	-I${srcdir}/include ${DNS_INCLUDES} \
- 		${BIND9_INCLUDES} ${ISC_INCLUDES} \
- 		${IRS_INCLUDES} ${ISCCFG_INCLUDES} @LIBIDN2_CFLAGS@ @OPENSSL_INCLUDES@
- 
--CDEFINES =	-DVERSION=\"${VERSION}\"
-+CDEFINES =	-DVERSION=\"${VERSION}\" @USE_PKCS11@
- CWARNINGS =
- 
- ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
-diff --git a/bin/dnssec/Makefile.in b/bin/dnssec/Makefile.in
-index 321058b..1dad340 100644
---- a/bin/dnssec/Makefile.in
-+++ b/bin/dnssec/Makefile.in
-@@ -17,7 +17,7 @@ VERSION=@BIND9_VERSION@
- 
- CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} @OPENSSL_INCLUDES@
- 
--CDEFINES =	-DVERSION=\"${VERSION}\"
-+CDEFINES =	-DVERSION=\"${VERSION}\" @USE_PKCS11@
- CWARNINGS =
- 
- DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
-diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
-index eecfa76..e5b0d4b 100644
---- a/bin/named/Makefile.in
-+++ b/bin/named/Makefile.in
-@@ -49,7 +49,7 @@ CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
- 		${DBDRIVER_INCLUDES} ${MAXMINDDB_CFLAGS} \
- 		@OPENSSL_INCLUDES@
- 
--CDEFINES =      @CONTRIB_DLZ@
-+CDEFINES =      @CONTRIB_DLZ@ @USE_PKCS11@
- 
- CWARNINGS =
- 
 diff --git a/configure.ac b/configure.ac
-index 80039b7..6cce3bb 100644
+index c69bc37..de6a248 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -963,9 +963,13 @@ AS_CASE([$enable_native_pkcs11],
+@@ -883,9 +883,13 @@ AS_CASE([$enable_native_pkcs11],
  AC_SUBST([PKCS11_TEST])
  AC_SUBST([PKCS11_TOOLS])
  
@@ -89,64 +45,38 @@ index 80039b7..6cce3bb 100644
  
  # preparation for automake
  # AM_CONDITIONAL([PKCS11_TOOLS], [test "$with_native_pkcs11" = "yes"])
-diff --git a/lib/dns/Makefile.in b/lib/dns/Makefile.in
-index 60c87a8..9125b10 100644
---- a/lib/dns/Makefile.in
-+++ b/lib/dns/Makefile.in
-@@ -30,7 +30,7 @@ CINCLUDES =	-I. -I${top_srcdir}/lib/dns -Iinclude ${DNS_INCLUDES} \
- 		${ISC_INCLUDES} ${MAXMINDDB_CFLAGS} \
- 		@OPENSSL_INCLUDES@ @DST_GSSAPI_INC@
- 
--CDEFINES =	@USE_GSSAPI@ ${USE_ISC_SPNEGO}
-+CDEFINES =	@USE_GSSAPI@ ${USE_ISC_SPNEGO} @USE_OPENSSL@ @USE_PKCS11@
- 
- CWARNINGS =
- 
 diff --git a/lib/dns/dst_internal.h b/lib/dns/dst_internal.h
-index bfa28f0..d3ff613 100644
+index bce2a9f..ef9d045 100644
 --- a/lib/dns/dst_internal.h
 +++ b/lib/dns/dst_internal.h
-@@ -40,6 +40,13 @@
+@@ -38,6 +38,13 @@
  #include <isc/stdtime.h>
- #include <isc/hmac.h>
+ #include <isc/types.h>
  
-+#ifndef USE_OPENSSL
-+#define USE_OPENSSL 1
-+#endif
 +#ifndef USE_PKCS11
 +#define USE_PKCS11 0
 +#endif
++#ifndef USE_OPENSSL
++#define USE_OPENSSL (! USE_PKCS11)
++#endif
 +
  #if USE_PKCS11
  #include <pk11/pk11.h>
  #include <pk11/site.h>
-@@ -99,11 +106,10 @@ struct dst_key {
+@@ -98,11 +105,10 @@ struct dst_key {
  		void *generic;
  		gss_ctx_id_t gssctx;
  		DH *dh;
 -#if USE_OPENSSL
 -		EVP_PKEY *pkey;
--#endif
+-#endif /* if USE_OPENSSL */
  #if USE_PKCS11
  		pk11_object_t *pkey;
 +#else
 +		EVP_PKEY *pkey;
- #endif
+ #endif /* if USE_PKCS11 */
  		dst_hmac_key_t *hmac_key;
- 	} keydata;			/*%< pointer to key in crypto pkg fmt */
-diff --git a/lib/ns/Makefile.in b/lib/ns/Makefile.in
-index a14728d..58d731a 100644
---- a/lib/ns/Makefile.in
-+++ b/lib/ns/Makefile.in
-@@ -24,7 +24,7 @@ CINCLUDES =	-I. -I${top_srcdir}/lib/ns -Iinclude \
- 		${NS_INCLUDES} ${DNS_INCLUDES} ${ISC_INCLUDES} \
- 		@OPENSSL_INCLUDES@ @DST_GSSAPI_INC@
- 
--CDEFINES =	-DNAMED_PLUGINDIR=\"${plugindir}\"
-+CDEFINES =	@USE_PKCS11@ -DNAMED_PLUGINDIR=\"${plugindir}\"
- 
- CWARNINGS =
- 
+ 	} keydata; /*%< pointer to key in crypto pkg fmt */
 -- 
-2.20.1
+2.21.1
 
diff --git a/bind.spec b/bind.spec
index c45b2f1..bf11fcf 100644
--- a/bind.spec
+++ b/bind.spec
@@ -57,6 +57,7 @@
 %global sover_isc 1602
 %global sover_irs 1600
 %global sover_isccfg 1600
+%global sover_ns 1602
 
 
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
@@ -115,7 +116,6 @@ Patch149:bind-9.11-kyua-pkcs11.patch
 Patch137:bind-9.10-use-of-strlcat.patch
 Patch140:bind-9.11-rh1410433.patch
 # Avoid conflicts with OpenSSL PKCS11 engine
-Patch150:bind-9.11-engine-pkcs11.patch
 Patch154:bind-9.11-oot-manual.patch
 Patch157:bind-9.11-fips-tests.patch
 Patch164:bind-9.11-rh1666814.patch
@@ -445,7 +445,6 @@ cp -r lib/dns{,-pkcs11}
 cp -r lib/ns{,-pkcs11}
 %patch136 -p1 -b .dist_pkcs11
 %patch149 -p1 -b .kyua-pkcs11
-%patch150 -p1 -b .engine-pkcs11
 %endif
 
 %patch133 -p1 -b .rh640538
@@ -978,7 +977,7 @@ fi;
 %files libs
 %{_libdir}/libbind9.so.1600*
 %{_libdir}/libisccc.so.1600*
-%{_libdir}/libns.so.1602*
+%{_libdir}/libns.so.%{sover_ns}*
 
 %files libs-lite
 %{_libdir}/libdns.so.%{sover_dns}*
@@ -1113,14 +1112,14 @@ fi;
 
 %files pkcs11-libs
 %{_libdir}/libdns-pkcs11.so.%{sover_dns}*
-%{_libdir}/libisc-pkcs11.so.%{sover_isc}*
+%{_libdir}/libns-pkcs11.so.%{sover_ns}*
 
 %files pkcs11-devel
 %{_includedir}/bind9/pk11/*.h
 %exclude %{_includedir}/bind9/pk11/site.h
 %{_includedir}/bind9/pkcs11
 %{_libdir}/libdns-pkcs11.so
-%{_libdir}/libisc-pkcs11.so
+%{_libdir}/libns-pkcs11.so
 %endif
 
 %if %{with DLZ} && %{with BDB}

From 40861268f35becf171fb4c636c3285cb34fe5e70 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 27 Apr 2020 22:22:47 +0200
Subject: [PATCH 152/460] Enable native PKCS11 build again

It was disabled because patches were not fixed. It compiles now, try it.
---
 bind.spec | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/bind.spec b/bind.spec
index bf11fcf..2f216cf 100644
--- a/bind.spec
+++ b/bind.spec
@@ -13,7 +13,7 @@
 %bcond_without GSSTSIG
 # it is not possible to build the package without PKCS11 sub-package
 # due to extensive changes to Makefiles
-%bcond_with PKCS11
+%bcond_without PKCS11
 %bcond_without DEVEL
 %bcond_without JSON
 %bcond_with    BDB
@@ -64,7 +64,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.16.2
-Release:  3%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  4%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1159,6 +1159,9 @@ fi;
 
 
 %changelog
+* Mon Apr 27 2020 Petr Menšík <pemensik@redhat.com> - 32:9.16.2-4
+- Enable PKCS#11 builds again
+
 * Mon Apr 27 2020 Petr Menšík <pemensik@redhat.com> - 32:9.16.2-3
 - Correct trust anchors
 

From 775befed48991de698562ea14370924e367f0c94 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 28 Apr 2020 10:18:03 +0200
Subject: [PATCH 153/460] Try successful build on epel8

softhsm is not provided on RHEL 8 as normal package. It is distributed
only in idm:DL1 module. If unittest or systemtest is not enabled, skip
configuring softhsm. It would not be used anyway.
---
 bind.spec | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/bind.spec b/bind.spec
index 2f216cf..0161355 100644
--- a/bind.spec
+++ b/bind.spec
@@ -166,7 +166,7 @@ BuildRequires:  libdb-devel
 # make unit dependencies
 BuildRequires:  libcmocka-devel kyua
 %endif
-%if %{with PKCS11}
+%if %{with PKCS11} && (%{with UNITTEST} || %{with SYSTEMTEST})
 BuildRequires:  softhsm
 %endif
 %if %{with SYSTEMTEST}
@@ -597,7 +597,7 @@ popd # build
 %systemtest_prepare_build build
 
 %check
-%if %{with PKCS11}
+%if %{with PKCS11} && (%{with UNITTEST} || %{with SYSTEMTEST})
   # Tests require initialization of pkcs11 token
   eval "$(bash %{SOURCE48} -A "`pwd`/softhsm-tokens")"
 %endif

From 8ad137901985d39db0b44edf367ad07826139b8f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 11 May 2020 18:09:54 +0200
Subject: [PATCH 154/460] Do not request use of urandom and report failure

Original script did not report failure as exit status. Report error if
rndc key generation failed also by exit status, not only by failed
message.

-r parameter is unsupported now, do not require it anymore.
---
 generate-rndc-key.sh | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/generate-rndc-key.sh b/generate-rndc-key.sh
index dde7f70..1ba0004 100755
--- a/generate-rndc-key.sh
+++ b/generate-rndc-key.sh
@@ -6,7 +6,7 @@
 
 if [ ! -s /etc/rndc.key -a ! -s /etc/rndc.conf ]; then
   echo -n $"Generating /etc/rndc.key:"
-  if /usr/sbin/rndc-confgen -a -A hmac-sha256 -r /dev/urandom > /dev/null 2>&1
+  if /usr/sbin/rndc-confgen -a -A hmac-sha256 > /dev/null 2>&1
   then
     chmod 640 /etc/rndc.key
     chown root:named /etc/rndc.key
@@ -16,5 +16,6 @@ if [ ! -s /etc/rndc.key -a ! -s /etc/rndc.conf ]; then
   else
     failure $"/etc/rndc.key generation"
     echo
+    exit 1
   fi
 fi

From 7fe31e189255cf58dcbdad511d1573419013b93f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 20 May 2020 13:25:26 +0200
Subject: [PATCH 155/460] Update to 9.16.3

Changes some solib versions and fixes two important CVEs:
CVE-2020-8616 CVE-2020-8617
---
 bind-9.11-tests-pkcs11.patch  | 39 -----------------------------------
 bind-9.14-config-pkcs11.patch |  9 ++++----
 bind.spec                     | 17 ++++++++-------
 3 files changed, 14 insertions(+), 51 deletions(-)
 delete mode 100644 bind-9.11-tests-pkcs11.patch

diff --git a/bind-9.11-tests-pkcs11.patch b/bind-9.11-tests-pkcs11.patch
deleted file mode 100644
index cdba1b0..0000000
--- a/bind-9.11-tests-pkcs11.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From 84fc64b556d5b5145eb7831393b856a26a818dc1 Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Fri, 1 Mar 2019 15:55:46 +0100
-Subject: [PATCH] Detect correctly pkcs11 support
-
-It fails now always, because oot builds are not supported by
-cleanpkcs11.sh.
----
- bin/tests/system/cleanpkcs11.sh | 2 +-
- bin/tests/system/conf.sh.in     | 1 +
- 2 files changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/bin/tests/system/cleanpkcs11.sh b/bin/tests/system/cleanpkcs11.sh
-index b974708..3bbef4c 100644
---- a/bin/tests/system/cleanpkcs11.sh
-+++ b/bin/tests/system/cleanpkcs11.sh
-@@ -12,6 +12,6 @@
- SYSTEMTESTTOP=.
- . $SYSTEMTESTTOP/conf.sh
- 
--if [ ! -x ../../pkcs11/pkcs11-destroy ]; then exit 1; fi
-+if [ ! -x "$PK11DESTROY" ]; then exit 1; fi
- 
- $PK11DEL -w0 > /dev/null 2>&1
-diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
-index e7831d8..aa2d841 100644
---- a/bin/tests/system/conf.sh.in
-+++ b/bin/tests/system/conf.sh.in
-@@ -52,6 +52,7 @@ NSLOOKUP=$TOP/bin/dig/nslookup
- NSUPDATE=$TOP/bin/nsupdate/nsupdate
- NZD2NZF=$TOP/bin/tools/named-nzd2nzf
- PK11DEL="$TOP/bin/pkcs11/pkcs11-destroy -s ${SLOT:-0} -p ${HSMPIN:-1234} -w 0"
-+PK11DESTROY=$TOP/bin/pkcs11/pkcs11-destroy
- PK11GEN="$TOP/bin/pkcs11/pkcs11-keygen -q -s ${SLOT:-0} -p ${HSMPIN:-1234}"
- PK11LIST="$TOP/bin/pkcs11/pkcs11-list -s ${SLOT:-0} -p ${HSMPIN:-1234}"
- RESOLVE=$TOP/lib/samples/resolve
--- 
-2.20.1
-
diff --git a/bind-9.14-config-pkcs11.patch b/bind-9.14-config-pkcs11.patch
index a71d772..bfc6e45 100644
--- a/bind-9.14-config-pkcs11.patch
+++ b/bind-9.14-config-pkcs11.patch
@@ -1,4 +1,4 @@
-From 2d8abd838870b58629ce55df411b6ba1b2c7288f Mon Sep 17 00:00:00 2001
+From 124c9e4c0500e7589ee63376e8f860f4abc675f2 Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Fri, 18 Oct 2019 21:30:52 +0200
 Subject: [PATCH] Move USE_PKCS11 and USE_OPENSSL out of config.h
@@ -26,15 +26,16 @@ index 1f5165a..ef3e70c 100644
  
  ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
 diff --git a/configure.ac b/configure.ac
-index c69bc37..de6a248 100644
+index fde41dc..e5cc3cd 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -883,9 +883,13 @@ AS_CASE([$enable_native_pkcs11],
+@@ -889,10 +889,14 @@ AS_CASE([$enable_native_pkcs11],
  AC_SUBST([PKCS11_TEST])
  AC_SUBST([PKCS11_TOOLS])
  
 +USE_PKCS11='-DUSE_PKCS11=0'
 +USE_OPENSSL='-DUSE_OPENSSL=0'
+ AC_SUBST([CRYPTO])
  AS_CASE([$CRYPTO],
 -	[pkcs11],[AC_DEFINE([USE_PKCS11], [1], [define if PKCS11 is used for Public-Key Cryptography])],
 -	[AC_DEFINE([USE_OPENSSL], [1], [define if OpenSSL is used for Public-Key Cryptography])])
@@ -46,7 +47,7 @@ index c69bc37..de6a248 100644
  # preparation for automake
  # AM_CONDITIONAL([PKCS11_TOOLS], [test "$with_native_pkcs11" = "yes"])
 diff --git a/lib/dns/dst_internal.h b/lib/dns/dst_internal.h
-index bce2a9f..ef9d045 100644
+index 116e2d2..99bdf5b 100644
 --- a/lib/dns/dst_internal.h
 +++ b/lib/dns/dst_internal.h
 @@ -38,6 +38,13 @@
diff --git a/bind.spec b/bind.spec
index 0161355..48f91e8 100644
--- a/bind.spec
+++ b/bind.spec
@@ -53,18 +53,18 @@
 # no more isc-config.sh and bind9-config
 
 # lib*.so.X versions of selected libraries
-%global sover_dns 1602
-%global sover_isc 1602
-%global sover_irs 1600
+%global sover_dns 1603
+%global sover_isc 1603
+%global sover_irs 1601
 %global sover_isccfg 1600
-%global sover_ns 1602
+%global sover_ns 1603
 
 
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.16.2
-Release:  4%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Version:  9.16.3
+Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -121,7 +121,6 @@ Patch157:bind-9.11-fips-tests.patch
 Patch164:bind-9.11-rh1666814.patch
 Patch170:bind-9.11-feature-test-named.patch
 Patch171:bind-9.11-tests-variants.patch
-Patch172:bind-9.11-tests-pkcs11.patch
 
 Requires(post):   systemd
 Requires(preun):  systemd
@@ -435,7 +434,6 @@ This package provides a module which allows commands to be sent to rndc directly
 %patch164 -p1 -b .rh1666814
 %patch170 -p1 -b .featuretest-named
 %patch171 -p1 -b .test-variant
-%patch172 -p1 -b .test-pkcs11
 
 %if %{with PKCS11}
 %patch135 -p1 -b .config-pkcs11
@@ -1159,6 +1157,9 @@ fi;
 
 
 %changelog
+* Wed May 20 2020 Petr Menšík <pemensik@redhat.com> - 32:9.16.3-1
+- Update to 9.16.3
+
 * Mon Apr 27 2020 Petr Menšík <pemensik@redhat.com> - 32:9.16.2-4
 - Enable PKCS#11 builds again
 

From 23458b3db173e1a9fd47aae3b3cfeab245ee6f18 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 22 May 2020 11:25:14 +0200
Subject: [PATCH 156/460] Make usage of initscripts optional

Do not depend hard on initscript just to provide fancy colored status.
When started from systemd, it does not really matter.

Return exactly the same return code as returned by the original tool.
---
 bind.spec            |  1 +
 generate-rndc-key.sh | 16 ++++++++++++++--
 2 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/bind.spec b/bind.spec
index 48f91e8..e533822 100644
--- a/bind.spec
+++ b/bind.spec
@@ -1159,6 +1159,7 @@ fi;
 %changelog
 * Wed May 20 2020 Petr Menšík <pemensik@redhat.com> - 32:9.16.3-1
 - Update to 9.16.3
+- Make initscripts just optional dependency
 
 * Mon Apr 27 2020 Petr Menšík <pemensik@redhat.com> - 32:9.16.2-4
 - Enable PKCS#11 builds again
diff --git a/generate-rndc-key.sh b/generate-rndc-key.sh
index 1ba0004..956bb8e 100755
--- a/generate-rndc-key.sh
+++ b/generate-rndc-key.sh
@@ -1,6 +1,17 @@
 #!/bin/bash
 
-. /etc/rc.d/init.d/functions
+if [ -r /etc/rc.d/init.d/functions ]; then
+	. /etc/rc.d/init.d/functions
+else
+success() {
+	echo $" OK "
+}
+
+failure() {
+	echo -n " "
+	echo $"FAILED"
+}
+fi
 
 # This script generates /etc/rndc.key if doesn't exist AND if there is no rndc.conf
 
@@ -14,8 +25,9 @@ if [ ! -s /etc/rndc.key -a ! -s /etc/rndc.conf ]; then
     success $"/etc/rndc.key generation"
     echo
   else
+    rc=$?
     failure $"/etc/rndc.key generation"
     echo
-    exit 1
+    exit $rc
   fi
 fi

From f9201b844d65216751d619acec6ea674633dc1e3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 15 May 2020 13:20:06 +0200
Subject: [PATCH 157/460] Update to 9.11.19

Includes new CVE fixes
---
 .gitignore | 2 ++
 bind.spec  | 7 +++++--
 sources    | 4 ++--
 3 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/.gitignore b/.gitignore
index c48ee55..1e054e5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -106,3 +106,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.11.17.tar.gz.asc
 /bind-9.11.18.tar.gz
 /bind-9.11.18.tar.gz.asc
+/bind-9.11.19.tar.gz
+/bind-9.11.19.tar.gz.asc
diff --git a/bind.spec b/bind.spec
index 01d00ea..547829f 100644
--- a/bind.spec
+++ b/bind.spec
@@ -65,8 +65,8 @@
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.11.18
-Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Version:  9.11.19
+Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1604,6 +1604,9 @@ fi;
 
 
 %changelog
+* Fri May 15 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.19-1
+- Update to 9.11.19 (CVE-2020-8616, CVE-2020-8617)
+
 * Tue Apr 21 2020 Björn Esser <besser82@fedoraproject.org> - 32:9.11.18-2
 - Rebuild (json-c)
 
diff --git a/sources b/sources
index d0ed2a0..1c102a3 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.11.18.tar.gz) = 947a7f9f58ac40744c541b2c23ef3eb9d8b6ecc8e3bb4f4b102ba5aafcc20c58ad5e8bacdd338821369c1f7de9d1073c264208e45f054ff7e3a9391894b424ab
-SHA512 (bind-9.11.18.tar.gz.asc) = aeeef8b211199a5d2715b63da9d648322241726e60b8cffae883bcec0e6335fd6c5ee431755a0bcb5b2a39ce540986edb0c9f51c6365aa226cff83ba358bac1a
+SHA512 (bind-9.11.19.tar.gz) = 4378afcd8c72a3f1b597e180a21674e1bbfc44b8378831ab3256395bdc46dce74da31aaa855fbae29d4c93e360dad233e3c8e3e69326779ddfecddbc96511ea2
+SHA512 (bind-9.11.19.tar.gz.asc) = 0cdbbe94a1b3a250dcdeb9934b6225cfda35d8646a2e0fada5485ef7b79f3c9bb831b3d19059f93aed9e01ae9ee80708c1d696eca82f01f8e6ae5523c8d3cf2e

From 674cbdbb3e2d510c65483c558ccf8a8cc494bb65 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 22 May 2020 11:25:14 +0200
Subject: [PATCH 158/460] Make usage of initscripts optional

Do not depend hard on initscript just to provide fancy colored status.
When started from systemd, it does not really matter.

Return exactly the same return code as returned by the original tool.
---
 bind.spec            |  1 +
 generate-rndc-key.sh | 15 ++++++++++++++-
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index 547829f..5791770 100644
--- a/bind.spec
+++ b/bind.spec
@@ -1606,6 +1606,7 @@ fi;
 %changelog
 * Fri May 15 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.19-1
 - Update to 9.11.19 (CVE-2020-8616, CVE-2020-8617)
+- Make initscripts just optional dependency
 
 * Tue Apr 21 2020 Björn Esser <besser82@fedoraproject.org> - 32:9.11.18-2
 - Rebuild (json-c)
diff --git a/generate-rndc-key.sh b/generate-rndc-key.sh
index dde7f70..375a48e 100755
--- a/generate-rndc-key.sh
+++ b/generate-rndc-key.sh
@@ -1,6 +1,17 @@
 #!/bin/bash
 
-. /etc/rc.d/init.d/functions
+if [ -r /etc/rc.d/init.d/functions ]; then
+	. /etc/rc.d/init.d/functions
+else
+success() {
+	echo $" OK "
+}
+
+failure() {
+	echo -n " "
+	echo $"FAILED"
+}
+fi
 
 # This script generates /etc/rndc.key if doesn't exist AND if there is no rndc.conf
 
@@ -14,7 +25,9 @@ if [ ! -s /etc/rndc.key -a ! -s /etc/rndc.conf ]; then
     success $"/etc/rndc.key generation"
     echo
   else
+    rc=$?
     failure $"/etc/rndc.key generation"
     echo
+    exit $rc
   fi
 fi

From 8aa5837978fa3d22158c7c15e3f51c96343b8eee Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
Date: Tue, 26 May 2020 02:41:36 +0200
Subject: [PATCH 159/460] Rebuilt for Python 3.9

---
 bind.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index 5791770..8662d91 100644
--- a/bind.spec
+++ b/bind.spec
@@ -66,7 +66,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.11.19
-Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1604,6 +1604,9 @@ fi;
 
 
 %changelog
+* Tue May 26 2020 Miro Hrončok <mhroncok@redhat.com> - 32:9.11.19-2
+- Rebuilt for Python 3.9
+
 * Fri May 15 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.19-1
 - Update to 9.11.19 (CVE-2020-8616, CVE-2020-8617)
 - Make initscripts just optional dependency

From f82859a3a0109fdf79d73bcb2da5d482602ac0df Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 17 Jun 2020 09:41:25 +0200
Subject: [PATCH 160/460] Update to 9.11.20

Fixes CVE-2020-8619 and few more issues
---
 .gitignore                |  2 ++
 bind-9.11-rh1624100.patch | 14 +++++++-------
 bind.spec                 |  7 +++++--
 bind97-rh645544.patch     | 19 ++++++++++---------
 sources                   |  4 ++--
 5 files changed, 26 insertions(+), 20 deletions(-)

diff --git a/.gitignore b/.gitignore
index 1e054e5..27a7197 100644
--- a/.gitignore
+++ b/.gitignore
@@ -108,3 +108,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.11.18.tar.gz.asc
 /bind-9.11.19.tar.gz
 /bind-9.11.19.tar.gz.asc
+/bind-9.11.20.tar.gz
+/bind-9.11.20.tar.gz.asc
diff --git a/bind-9.11-rh1624100.patch b/bind-9.11-rh1624100.patch
index 5764ed7..0775820 100644
--- a/bind-9.11-rh1624100.patch
+++ b/bind-9.11-rh1624100.patch
@@ -1,4 +1,4 @@
-From 76594cba9a1e910bb36160d96fc3872349341799 Mon Sep 17 00:00:00 2001
+From f27598743ab6e03271e26f23da4beba748d19c60 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@sury.org>
 Date: Wed, 25 Apr 2018 14:04:31 +0200
 Subject: [PATCH] Replace isc_safe routines with their OpenSSL counter parts
@@ -24,10 +24,10 @@ Fix the isc_safe_memwipe() usage with (NULL, >0)
  delete mode 100644 lib/isc/safe.c
 
 diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c
-index 6ddaebe..d921870 100644
+index 6dded0c..a9c5557 100644
 --- a/bin/dnssec/dnssec-signzone.c
 +++ b/bin/dnssec/dnssec-signzone.c
-@@ -787,7 +787,7 @@ hashlist_add_dns_name(hashlist_t *l, /*const*/ dns_name_t *name,
+@@ -784,7 +784,7 @@ hashlist_add_dns_name(hashlist_t *l, /*const*/ dns_name_t *name,
  
  static int
  hashlist_comp(const void *a, const void *b) {
@@ -81,7 +81,7 @@ index ad77f24..670982a 100644
  
  /* accept_sec_context.c */
 diff --git a/lib/isc/Makefile.in b/lib/isc/Makefile.in
-index 0fd0837..8ad54bb 100644
+index 149552a..8529a86 100644
 --- a/lib/isc/Makefile.in
 +++ b/lib/isc/Makefile.in
 @@ -60,7 +60,7 @@ OBJS =		@ISC_EXTRA_OBJS@ @ISC_PK11_O@ @ISC_PK11_RESULT_O@ \
@@ -91,7 +91,7 @@ index 0fd0837..8ad54bb 100644
 -		safe.@O@ serial.@O@ siphash.@O@ sha1.@O@ sha2.@O@ sockaddr.@O@ stats.@O@ \
 +		serial.@O@ siphash.@O@ sha1.@O@ sha2.@O@ sockaddr.@O@ stats.@O@ \
  		string.@O@ strtoul.@O@ symtab.@O@ task.@O@ taskpool.@O@ \
- 		tm.@O@ timer.@O@ version.@O@ \
+ 		tm.@O@ timer.@O@ utf8.@O@ version.@O@ \
  		${UNIXOBJS} ${NLSOBJS} ${THREADOBJS}
 @@ -79,7 +79,7 @@ SRCS =		@ISC_EXTRA_SRCS@ @ISC_PK11_C@ @ISC_PK11_RESULT_C@ \
  		netaddr.c netscope.c pool.c ondestroy.c \
@@ -100,7 +100,7 @@ index 0fd0837..8ad54bb 100644
 -		safe.c serial.c siphash.c sha1.c sha2.c sockaddr.c stats.c string.c \
 +		serial.c siphash.c sha1.c sha2.c sockaddr.c stats.c string.c \
  		strtoul.c symtab.c task.c taskpool.c timer.c \
- 		tm.c version.c
+ 		tm.c utf8.c version.c
  
 @@ -95,10 +95,6 @@ TESTDIRS =	@UNITTESTS@
  
@@ -284,5 +284,5 @@ index 266ac75..60e9181 100644
  
  	return (cmocka_run_group_tests(tests, NULL, NULL));
 -- 
-2.20.1
+2.26.2
 
diff --git a/bind.spec b/bind.spec
index 8662d91..e010170 100644
--- a/bind.spec
+++ b/bind.spec
@@ -65,8 +65,8 @@
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.11.19
-Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Version:  9.11.20
+Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1604,6 +1604,9 @@ fi;
 
 
 %changelog
+* Wed Jun 17 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.20-1
+- Update to 9.11.20
+
 * Tue May 26 2020 Miro Hrončok <mhroncok@redhat.com> - 32:9.11.19-2
 - Rebuilt for Python 3.9
 
diff --git a/bind97-rh645544.patch b/bind97-rh645544.patch
index d1d8429..c15eeb5 100644
--- a/bind97-rh645544.patch
+++ b/bind97-rh645544.patch
@@ -1,7 +1,8 @@
-diff -up bind-9.9.4rc2/lib/dns/resolver.c.rh645544 bind-9.9.4rc2/lib/dns/resolver.c
---- bind-9.9.4rc2/lib/dns/resolver.c.rh645544	2013-08-19 10:30:52.000000000 +0200
-+++ bind-9.9.4rc2/lib/dns/resolver.c	2013-09-06 17:58:03.864165823 +0200
-@@ -1138,7 +1138,7 @@ log_edns(fetchctx_t *fctx) {
+diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
+index ecb3ddb..f7f73cd 100644
+--- a/lib/dns/resolver.c
++++ b/lib/dns/resolver.c
+@@ -1456,7 +1456,7 @@ log_edns(fetchctx_t *fctx) {
  	 */
  	dns_name_format(&fctx->domain, domainbuf, sizeof(domainbuf));
  	isc_log_write(dns_lctx, DNS_LOGCATEGORY_EDNS_DISABLED,
@@ -10,7 +11,7 @@ diff -up bind-9.9.4rc2/lib/dns/resolver.c.rh645544 bind-9.9.4rc2/lib/dns/resolve
  		      "success resolving '%s' (in '%s'?) after %s",
  		      fctx->info, domainbuf, fctx->reason);
  
-@@ -3804,7 +3804,7 @@ log_lame(fetchctx_t *fctx, dns_adbaddrin
+@@ -4667,7 +4667,7 @@ log_lame(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo) {
  	dns_name_format(&fctx->domain, domainbuf, sizeof(domainbuf));
  	isc_sockaddr_format(&addrinfo->sockaddr, addrbuf, sizeof(addrbuf));
  	isc_log_write(dns_lctx, DNS_LOGCATEGORY_LAME_SERVERS,
@@ -19,12 +20,12 @@ diff -up bind-9.9.4rc2/lib/dns/resolver.c.rh645544 bind-9.9.4rc2/lib/dns/resolve
  		      "lame server resolving '%s' (in '%s'?): %s",
  		      namebuf, domainbuf, addrbuf);
  }
-@@ -3831,7 +3831,7 @@ log_formerr(fetchctx_t *fctx, const char
- 	}
+@@ -4685,7 +4685,7 @@ log_formerr(fetchctx_t *fctx, const char *format, ...) {
+ 	isc_sockaddr_format(&fctx->addrinfo->sockaddr, nsbuf, sizeof(nsbuf));
  
  	isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
 -		      DNS_LOGMODULE_RESOLVER, ISC_LOG_NOTICE,
 +		      DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(1),
- 		      "DNS format error from %s resolving %s%s%s: %s",
- 		      nsbuf, fctx->info, clmsg, clbuf, msgbuf);
+ 		      "DNS format error from %s resolving %s for %s: %s",
+ 		      nsbuf, fctx->info, fctx->clientstr, msgbuf);
  }
diff --git a/sources b/sources
index 1c102a3..3cbd20a 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.11.19.tar.gz) = 4378afcd8c72a3f1b597e180a21674e1bbfc44b8378831ab3256395bdc46dce74da31aaa855fbae29d4c93e360dad233e3c8e3e69326779ddfecddbc96511ea2
-SHA512 (bind-9.11.19.tar.gz.asc) = 0cdbbe94a1b3a250dcdeb9934b6225cfda35d8646a2e0fada5485ef7b79f3c9bb831b3d19059f93aed9e01ae9ee80708c1d696eca82f01f8e6ae5523c8d3cf2e
+SHA512 (bind-9.11.20.tar.gz) = 249710a35dfd340abf8d07c526fb9dd05ab3ed186641f33b697f9a59a866965f43d77e6d0c77b3690698eb6d451a15506cedc5da18aff666c9d95a864268dd25
+SHA512 (bind-9.11.20.tar.gz.asc) = f8dba8b72639eefc4b3e5e5e27f28506aa3333101bb903ea7add92716ec95718a0506023a6d812c6d03b93dc634100c0463b667ce7a889e01d087a97eda903f3

From b8ccda0801d6c7e0029763d7770da4e5d76406db Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 18 Jun 2020 04:08:57 +0200
Subject: [PATCH 161/460] Update to 9.16.4

Documentation changed and requires another commit.
---
 bind-9.10-dist-native-pkcs11.patch            | 138 ++++++++----------
 bind-9.11-feature-test-named.patch            |  21 +--
 bind-9.14-config-pkcs11.patch                 |  12 +-
 ...at_doc.patch => bind-9.16-redhat_doc.patch |  96 ++++++------
 bind-9.5-PIE.patch                            |  21 +--
 bind.spec                                     |  11 +-
 bind97-rh645544.patch                         |  14 +-
 bind99-rh640538.patch                         |  60 +++-----
 8 files changed, 174 insertions(+), 199 deletions(-)
 rename bind-9.3.2-redhat_doc.patch => bind-9.16-redhat_doc.patch (56%)

diff --git a/bind-9.10-dist-native-pkcs11.patch b/bind-9.10-dist-native-pkcs11.patch
index b623f58..0dfc74c 100644
--- a/bind-9.10-dist-native-pkcs11.patch
+++ b/bind-9.10-dist-native-pkcs11.patch
@@ -12,7 +12,7 @@ index 9ad7f62..094775a 100644
  TARGETS =
  
 diff --git a/bin/confgen/Makefile.in b/bin/confgen/Makefile.in
-index ef3e70c..1f5165a 100644
+index c126bf3..1b7512d 100644
 --- a/bin/confgen/Makefile.in
 +++ b/bin/confgen/Makefile.in
 @@ -22,7 +22,7 @@ VERSION=@BIND9_VERSION@
@@ -25,7 +25,7 @@ index ef3e70c..1f5165a 100644
  
  ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
 diff --git a/bin/dnssec-pkcs11/Makefile.in b/bin/dnssec-pkcs11/Makefile.in
-index 7486bf0..7d791d1 100644
+index ace0e5a..e0f6a00 100644
 --- a/bin/dnssec-pkcs11/Makefile.in
 +++ b/bin/dnssec-pkcs11/Makefile.in
 @@ -15,18 +15,18 @@ VERSION=@BIND9_VERSION@
@@ -40,11 +40,11 @@ index 7486bf0..7d791d1 100644
 +CDEFINES =	-DVERSION=\"${VERSION}\" -DNAMED_CONFFILE=\"${sysconfdir}/named.conf\" -DUSE_PKCS11=1
  CWARNINGS =
  
--DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
-+DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_PK11_LIBS@
+-DNSLIBS =	../../lib/dns/libdns.@A@ @NO_LIBTOOL_DNSLIBS@
++DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ @NO_LIBTOOL_DNSLIBS@
  ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
- ISCLIBS =	../../lib/isc/libisc.@A@ ${OPENSSL_LIBS} ${JSON_C_LIBS} ${LIBXML2_LIBS} ${ZLIB_LIBS}
- ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ ${OPENSSL_LIBS} ${JSON_C_LIBS} ${LIBXML2_LIBS} ${ZLIB_LIBS}
+ ISCLIBS =	../../lib/isc/libisc.@A@ @NO_LIBTOOL_ISCLIBS@
+ ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @NO_LIBTOOL_ISCLIBS@
  
 -DNSDEPLIBS =	../../lib/dns/libdns.@A@
 +DNSDEPLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@
@@ -72,7 +72,7 @@ index 7486bf0..7d791d1 100644
  
  OBJS =		dnssectool.@O@
  
-@@ -64,19 +67,19 @@ MANOBJS =	${MANPAGES} ${HTMLPAGES}
+@@ -52,19 +55,19 @@ SRCS =		dnssec-cds.c dnssec-dsfromkey.c dnssec-importkey.c \
  
  @BIND9_MAKE_RULES@
  
@@ -96,7 +96,7 @@ index 7486bf0..7d791d1 100644
  	export BASEOBJS="dnssec-keygen.@O@ ${OBJS}"; \
  	${FINALBUILDCMD}
  
-@@ -84,7 +87,7 @@ dnssec-signzone.@O@: dnssec-signzone.c
+@@ -72,7 +75,7 @@ dnssec-signzone.@O@: dnssec-signzone.c
  	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} -DVERSION=\"${VERSION}\" \
  		-c ${srcdir}/dnssec-signzone.c
  
@@ -105,7 +105,7 @@ index 7486bf0..7d791d1 100644
  	export BASEOBJS="dnssec-signzone.@O@ ${OBJS}"; \
  	${FINALBUILDCMD}
  
-@@ -92,19 +95,19 @@ dnssec-verify.@O@: dnssec-verify.c
+@@ -80,19 +83,19 @@ dnssec-verify.@O@: dnssec-verify.c
  	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} -DVERSION=\"${VERSION}\" \
  		-c ${srcdir}/dnssec-verify.c
  
@@ -129,26 +129,8 @@ index 7486bf0..7d791d1 100644
  	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \
  	dnssec-importkey.@O@ ${OBJS} ${LIBS}
  
-@@ -115,16 +118,14 @@ docclean manclean maintainer-clean::
- 
- installdirs:
- 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
--	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
- 
- install-man8: ${MANPAGES}
- 	${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man8
- 
--install:: ${TARGETS} installdirs install-man8
-+install:: ${TARGETS} installdirs
- 	for t in ${TARGETS}; do ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} $$t ${DESTDIR}${sbindir} || exit 1; done
- 
- uninstall::
--	for m in ${MANPAGES}; do rm -f ${DESTDIR}${mandir}/man8/$$m || exit 1; done
- 	for t in ${TARGETS}; do ${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/$$t || exit 1; done
- 
- clean distclean::
 diff --git a/bin/named-pkcs11/Makefile.in b/bin/named-pkcs11/Makefile.in
-index cb187e5..1bcb249 100644
+index ed9add2..90bcec7 100644
 --- a/bin/named-pkcs11/Makefile.in
 +++ b/bin/named-pkcs11/Makefile.in
 @@ -37,13 +37,14 @@ DBDRIVER_LIBS =
@@ -171,21 +153,21 @@ index cb187e5..1bcb249 100644
  		${BIND9_INCLUDES} ${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} \
  		${ISC_INCLUDES} ${DLZDRIVER_INCLUDES} \
  		${DBDRIVER_INCLUDES} \
-@@ -53,24 +54,24 @@ CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
- 		${MAXMINDDB_CFLAGS} \
- 		${ZLIB_CFLAGS}
+@@ -54,24 +55,24 @@ CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
+ 		${LIBXML2_CFLAGS} \
+ 		${MAXMINDDB_CFLAGS}
  
 -CDEFINES =      @CONTRIB_DLZ@
 +CDEFINES =
  
  CWARNINGS =
  
--DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
-+DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_PK11_LIBS@
+-DNSLIBS =	../../lib/dns/libdns.@A@ @NO_LIBTOOL_DNSLIBS@
++DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ @NO_LIBTOOL_DNSLIBS@
  ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
  ISCCCLIBS =	../../lib/isccc/libisccc.@A@
- ISCLIBS =	../../lib/isc/libisc.@A@ ${OPENSSL_LIBS} ${JSON_C_LIBS} ${LIBXML2_LIBS} ${ZLIB_LIBS}
- ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ ${OPENSSL_LIBS} ${JSON_C_LIBS} ${LIBXML2_LIBS} ${ZLIB_LIBS}
+ ISCLIBS =	../../lib/isc/libisc.@A@ @NO_LIBTOOL_ISCLIBS@
+ ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @NO_LIBTOOL_ISCLIBS@
  BIND9LIBS =	../../lib/bind9/libbind9.@A@
 -NSLIBS =	../../lib/ns/libns.@A@
 +NSLIBS =	../../lib/ns-pkcs11/libns-pkcs11.@A@
@@ -201,7 +183,7 @@ index cb187e5..1bcb249 100644
  
  DEPLIBS =	${NSDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
  		${ISCCFGDEPLIBS} ${ISCCCDEPLIBS} ${ISCDEPLIBS}
-@@ -87,7 +88,7 @@ NOSYMLIBS =	${NSLIBS} ${DNSLIBS} ${BIND9LIBS} \
+@@ -91,7 +92,7 @@ NOSYMLIBS =	${NSLIBS} ${DNSLIBS} ${BIND9LIBS} \
  
  SUBDIRS =	unix
  
@@ -210,7 +192,7 @@ index cb187e5..1bcb249 100644
  
  GEOIP2LINKOBJS = geoip.@O@
  
-@@ -151,7 +152,7 @@ server.@O@: server.c
+@@ -149,7 +150,7 @@ server.@O@: server.c
  		-DPRODUCT=\"${PRODUCT}\" \
  		-DVERSION=\"${VERSION}\" -c ${srcdir}/server.c
  
@@ -219,7 +201,7 @@ index cb187e5..1bcb249 100644
  	export MAKE_SYMTABLE="yes"; \
  	export BASEOBJS="${OBJS} ${UOBJS}"; \
  	${FINALBUILDCMD}
-@@ -161,7 +162,7 @@ feature-test.@O@: ${top_srcdir}/bin/tests/system/feature-test.c
+@@ -159,7 +160,7 @@ feature-test.@O@: ${top_srcdir}/bin/tests/system/feature-test.c
  	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} \
  		-c ${top_srcdir}/bin/tests/system/feature-test.c
  
@@ -228,28 +210,26 @@ index cb187e5..1bcb249 100644
  	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} \
  		-o $@ feature-test.@O@ ${ISCLIBS} ${LIBS}
  
-@@ -194,13 +195,13 @@ install-man8: named.8
+@@ -178,11 +179,11 @@ statschannel.@O@: bind9.xsl.h
+ installdirs:
+ 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
  
- install-man: install-man5 install-man8
- 
--install:: named@EXEEXT@ installdirs install-man
+-install:: named@EXEEXT@ installdirs
 -	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named@EXEEXT@ ${DESTDIR}${sbindir}
-+install:: named-pkcs11@EXEEXT@ installdirs install-man
++install:: named-pkcs11@EXEEXT@ installdirs
 +	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named-pkcs11@EXEEXT@ ${DESTDIR}${sbindir}
  
  uninstall::
- 	rm -f ${DESTDIR}${mandir}/man5/named.conf.5
- 	rm -f ${DESTDIR}${mandir}/man8/named.8
 -	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/named@EXEEXT@
 +	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/named-pkcs11@EXEEXT@
  
  @DLZ_DRIVER_RULES@
  
 diff --git a/configure.ac b/configure.ac
-index de6a248..e95ef36 100644
+index 2ff68a5..2638ef2 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -1196,12 +1196,14 @@ AC_SUBST(USE_GSSAPI)
+@@ -1214,12 +1214,14 @@ AC_SUBST(USE_GSSAPI)
  AC_SUBST(DST_GSSAPI_INC)
  AC_SUBST(DNS_GSSAPI_LIBS)
  DNS_CRYPTO_LIBS="$DNS_GSSAPI_LIBS"
@@ -264,7 +244,7 @@ index de6a248..e95ef36 100644
  
  #
  # was --with-lmdb specified?
-@@ -2296,6 +2298,8 @@ AC_SUBST(BIND9_DNS_BUILDINCLUDE)
+@@ -2281,6 +2283,8 @@ AC_SUBST(BIND9_DNS_BUILDINCLUDE)
  AC_SUBST(BIND9_NS_BUILDINCLUDE)
  AC_SUBST(BIND9_BIND9_BUILDINCLUDE)
  AC_SUBST(BIND9_IRS_BUILDINCLUDE)
@@ -273,7 +253,7 @@ index de6a248..e95ef36 100644
  if test "X$srcdir" != "X"; then
  	BIND9_ISC_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/isc/include"
  	BIND9_ISCCC_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/isccc/include"
-@@ -2304,6 +2308,8 @@ if test "X$srcdir" != "X"; then
+@@ -2289,6 +2293,8 @@ if test "X$srcdir" != "X"; then
  	BIND9_NS_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/ns/include"
  	BIND9_BIND9_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/bind9/include"
  	BIND9_IRS_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/irs/include"
@@ -282,7 +262,7 @@ index de6a248..e95ef36 100644
  else
  	BIND9_ISC_BUILDINCLUDE=""
  	BIND9_ISCCC_BUILDINCLUDE=""
-@@ -2312,6 +2318,8 @@ else
+@@ -2297,6 +2303,8 @@ else
  	BIND9_NS_BUILDINCLUDE=""
  	BIND9_BIND9_BUILDINCLUDE=""
  	BIND9_IRS_BUILDINCLUDE=""
@@ -291,7 +271,7 @@ index de6a248..e95ef36 100644
  fi
  
  AC_SUBST_FILE(BIND9_MAKE_INCLUDES)
-@@ -2771,8 +2779,11 @@ AC_CONFIG_FILES([
+@@ -2757,8 +2765,11 @@ AC_CONFIG_FILES([
  	bin/delv/Makefile
  	bin/dig/Makefile
  	bin/dnssec/Makefile
@@ -303,7 +283,7 @@ index de6a248..e95ef36 100644
  	bin/nsupdate/Makefile
  	bin/pkcs11/Makefile
  	bin/plugins/Makefile
-@@ -2843,6 +2854,10 @@ AC_CONFIG_FILES([
+@@ -2820,6 +2831,10 @@ AC_CONFIG_FILES([
  	lib/dns/include/dns/Makefile
  	lib/dns/include/dst/Makefile
  	lib/dns/tests/Makefile
@@ -314,7 +294,7 @@ index de6a248..e95ef36 100644
  	lib/irs/Makefile
  	lib/irs/include/Makefile
  	lib/irs/include/irs/Makefile
-@@ -2875,6 +2890,10 @@ AC_CONFIG_FILES([
+@@ -2852,6 +2867,10 @@ AC_CONFIG_FILES([
  	lib/ns/include/Makefile
  	lib/ns/include/ns/Makefile
  	lib/ns/tests/Makefile
@@ -339,19 +319,20 @@ index ffa2d5a..6fbc192 100644
  
  @BIND9_MAKE_RULES@
 diff --git a/lib/dns-pkcs11/Makefile.in b/lib/dns-pkcs11/Makefile.in
-index 0ef3b5f..80683c2 100644
+index 8de85bf..d5c3c2b 100644
 --- a/lib/dns-pkcs11/Makefile.in
 +++ b/lib/dns-pkcs11/Makefile.in
-@@ -26,14 +26,14 @@ VERSION=@BIND9_VERSION@
+@@ -26,7 +26,7 @@ VERSION=@BIND9_VERSION@
  
  USE_ISC_SPNEGO = @USE_ISC_SPNEGO@
  
 -CINCLUDES =	-I. -I${top_srcdir}/lib/dns -Iinclude ${DNS_INCLUDES} \
 +CINCLUDES =	-I. -I${top_srcdir}/lib/dns-pkcs11 -Iinclude ${DNS_PKCS11_INCLUDES} \
  		${ISC_INCLUDES} \
+ 		${FSTRM_CFLAGS} \
  		${OPENSSL_CFLAGS} @DST_GSSAPI_INC@ \
- 		${JSON_C_CFLAGS} \
- 		${LIBXML2_CFLAGS} \
+@@ -36,7 +36,7 @@ CINCLUDES =	-I. -I${top_srcdir}/lib/dns -Iinclude ${DNS_INCLUDES} \
+ 		${LMDB_CFLAGS} \
  		${MAXMINDDB_CFLAGS}
  
 -CDEFINES =	@USE_GSSAPI@ ${USE_ISC_SPNEGO}
@@ -359,7 +340,7 @@ index 0ef3b5f..80683c2 100644
  
  CWARNINGS =
  
-@@ -139,15 +139,15 @@ version.@O@: version.c
+@@ -142,15 +142,15 @@ version.@O@: version.c
  		-DLIBAGE=${LIBAGE} \
  		-c ${srcdir}/version.c
  
@@ -379,7 +360,7 @@ index 0ef3b5f..80683c2 100644
  
  include: gen
  	${MAKE} include/dns/enumtype.h
-@@ -178,22 +178,22 @@ gen: gen.c
+@@ -181,22 +181,22 @@ gen: gen.c
  	${BUILD_CPPFLAGS} ${BUILD_LDFLAGS} -o $@ ${srcdir}/gen.c \
  	${BUILD_LIBS} ${LFS_LIBS}
  
@@ -408,7 +389,7 @@ index 0ef3b5f..80683c2 100644
  	rm -f include/dns/rdatastruct.h
  	rm -f dnstap.pb-c.c dnstap.pb-c.h
 diff --git a/lib/dns-pkcs11/tests/Makefile.in b/lib/dns-pkcs11/tests/Makefile.in
-index fd8ebb9..9384a4f 100644
+index 8aec0a8..3c2cc04 100644
 --- a/lib/dns-pkcs11/tests/Makefile.in
 +++ b/lib/dns-pkcs11/tests/Makefile.in
 @@ -15,14 +15,14 @@ VERSION=@BIND9_VERSION@
@@ -421,20 +402,20 @@ index fd8ebb9..9384a4f 100644
 -CDEFINES =	-DTESTS="\"${top_builddir}/lib/dns/tests/\""
 +CDEFINES =	@USE_PKCS11@ -DTESTS="\"${top_builddir}/lib/dns-pkcs11/tests/\""
  
- ISCLIBS =	../../isc/libisc.@A@ ${OPENSSL_LIBS} ${JSON_C_LIBS} ${LIBXML2_LIBS} ${ZLIB_LIBS}
+ ISCLIBS =	../../isc/libisc.@A@ @NO_LIBTOOL_ISCLIBS@
  ISCDEPLIBS =	../../isc/libisc.@A@
--DNSLIBS =	../libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
+-DNSLIBS =	../libdns.@A@ @NO_LIBTOOL_DNSLIBS@
 -DNSDEPLIBS =	../libdns.@A@
-+DNSLIBS =	../libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_PK11_LIBS@
++DNSLIBS =	../libdns-pkcs11.@A@ @NO_LIBTOOL_DNSLIBS@
 +DNSDEPLIBS =	../libdns-pkcs11.@A@
  
  LIBS =		@LIBS@ @CMOCKA_LIBS@
  
 diff --git a/lib/ns-pkcs11/Makefile.in b/lib/ns-pkcs11/Makefile.in
-index 97aaaf6..c7ffc7b 100644
+index d00ddaf..b867afe 100644
 --- a/lib/ns-pkcs11/Makefile.in
 +++ b/lib/ns-pkcs11/Makefile.in
-@@ -20,11 +20,11 @@ VERSION=@BIND9_VERSION@
+@@ -20,12 +20,12 @@ VERSION=@BIND9_VERSION@
  
  USE_ISC_SPNEGO = @USE_ISC_SPNEGO@
  
@@ -442,26 +423,27 @@ index 97aaaf6..c7ffc7b 100644
 -		${NS_INCLUDES} ${DNS_INCLUDES} ${ISC_INCLUDES} \
 +CINCLUDES =	-I. -I${top_srcdir}/lib/ns-pkcs11 -Iinclude \
 +		${NS_PKCS11_INCLUDES} ${DNS_PKCS11_INCLUDES} ${ISC_INCLUDES} \
- 		${OPENSSL_CFLAGS} @DST_GSSAPI_INC@
+ 		${OPENSSL_CFLAGS} @DST_GSSAPI_INC@ \
+ 		${FSTRM_CFLAGS}
  
 -CDEFINES =	-DNAMED_PLUGINDIR=\"${plugindir}\"
 +CDEFINES =	@USE_PKCS11@ -DNAMED_PLUGINDIR=\"${plugindir}\"
  
  CWARNINGS =
  
-@@ -32,9 +32,9 @@ ISCLIBS =	../../lib/isc/libisc.@A@ ${OPENSSL_LIBS} ${JSON_C_LIBS} ${LIBXML2_LIBS
+@@ -33,9 +33,9 @@ ISCLIBS =	../../lib/isc/libisc.@A@
  
  ISCDEPLIBS =	../../lib/isc/libisc.@A@
  
--DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
-+DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_PK11_LIBS@
+-DNSLIBS =	../../lib/dns/libdns.@A@ @NO_LIBTOOL_DNSLIBS@
++DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ @NO_LIBTOOL_DNSLIBS@
  
 -DNSDEPLIBS =	../../lib/dns/libdns.@A@
 +DNSDEPLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@
  
  LIBS =		@LIBS@
  
-@@ -66,28 +66,28 @@ version.@O@: version.c
+@@ -67,28 +67,28 @@ version.@O@: version.c
  		-DLIBAGE=${LIBAGE} \
  		-c ${srcdir}/version.c
  
@@ -476,8 +458,8 @@ index 97aaaf6..c7ffc7b 100644
 -		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libns.la -rpath ${libdir} \
 +		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libns-pkcs11.la -rpath ${libdir} \
  		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
--		${OBJS} ${ISCLIBS} @DNS_CRYPTO_LIBS@ ${LIBS}
-+		${OBJS} ${ISCLIBS} @DNS_CRYPTO_PK11_LIBS@ ${LIBS}
+-		${OBJS} ${ISCLIBS} ${DNSLIBS} @DNS_CRYPTO_LIBS@ ${LIBS}
++		${OBJS} ${ISCLIBS} ${DNSLIBS} @DNS_CRYPTO_PK11_LIBS@ ${LIBS}
  
 -timestamp: libns.@A@
 +timestamp: libns-pkcs11.@A@
@@ -499,7 +481,7 @@ index 97aaaf6..c7ffc7b 100644
 -	rm -f libns.@A@ timestamp
 +	rm -f libns-pkcs11.@A@ timestamp
 diff --git a/lib/ns-pkcs11/tests/Makefile.in b/lib/ns-pkcs11/tests/Makefile.in
-index 70c77a4..87955a7 100644
+index 7869c8e..789d6cb 100644
 --- a/lib/ns-pkcs11/tests/Makefile.in
 +++ b/lib/ns-pkcs11/tests/Makefile.in
 @@ -21,17 +21,17 @@ WRAP_NAME =	-Wl,-install_name,${top_builddir}/lib/ns/tests/$@
@@ -513,13 +495,13 @@ index 70c77a4..87955a7 100644
 -CDEFINES =	-DTESTS="\"${top_builddir}/lib/ns/tests/\"" -DNAMED_PLUGINDIR=\"${plugindir}\"
 +CDEFINES =	-DTESTS="\"${top_builddir}/lib/ns/tests/\"" -DNAMED_PLUGINDIR=\"${plugindir}\" @USE_PKCS11@
  
- ISCLIBS =	../../isc/libisc.@A@ ${OPENSSL_LIBS} ${JSON_C_LIBS} ${LIBXML2_LIBS} ${ZLIB_LIBS}
+ ISCLIBS =	../../isc/libisc.@A@ @NO_LIBTOOL_ISCLIBS@
  ISCDEPLIBS =	../../isc/libisc.@A@
--DNSLIBS =	../../dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
+-DNSLIBS =	../../dns/libdns.@A@ @NO_LIBTOOL_DNSLIBS@
 -DNSDEPLIBS =	../../dns/libdns.@A@
 -NSLIBS =	../libns.@A@
 -NSDEPLIBS =	../libns.@A@
-+DNSLIBS =	../../dns-pkcs11/libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_PK11_LIBS@
++DNSLIBS =	../../dns-pkcs11/libdns-pkcs11.@A@ @NO_LIBTOOL_DNSLIBS@
 +DNSDEPLIBS =	../../dns-pkcs11/libdns-pkcs11.@A@
 +NSLIBS =	../libns-pkcs11.@A@
 +NSDEPLIBS =	../libns-pkcs11.@A@
@@ -527,10 +509,10 @@ index 70c77a4..87955a7 100644
  LIBS =		@LIBS@ @CMOCKA_LIBS@
  
 diff --git a/make/includes.in b/make/includes.in
-index 48cdaf7..7b17738 100644
+index 9ff1bd8..ebab049 100644
 --- a/make/includes.in
 +++ b/make/includes.in
-@@ -39,3 +39,10 @@ BIND9_INCLUDES = @BIND9_BIND9_BUILDINCLUDE@ \
+@@ -41,3 +41,10 @@ BIND9_INCLUDES = @BIND9_BIND9_BUILDINCLUDE@ \
  
  TEST_INCLUDES = \
  	-I${top_srcdir}/lib/tests/include
diff --git a/bind-9.11-feature-test-named.patch b/bind-9.11-feature-test-named.patch
index c4bbe16..9af8d73 100644
--- a/bind-9.11-feature-test-named.patch
+++ b/bind-9.11-feature-test-named.patch
@@ -1,4 +1,4 @@
-From 64f29512679fd00c89473d93d8b22017b018dd8f Mon Sep 17 00:00:00 2001
+From e645046202006750f87531e21e3ff7c26fba3466 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Wed, 30 Jan 2019 14:37:17 +0100
 Subject: [PATCH] Create feature-test in source directory
@@ -7,15 +7,15 @@ Feature-test tool is used in system tests to test compiled in changes.
 Because we build more variants of named with different configuration,
 compile feature-test for each of them this way.
 ---
- bin/named/Makefile.in       | 11 ++++++++++-
+ bin/named/Makefile.in       | 12 +++++++++++-
  bin/tests/system/conf.sh.in |  2 +-
- 2 files changed, 11 insertions(+), 2 deletions(-)
+ 2 files changed, 12 insertions(+), 2 deletions(-)
 
 diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
-index dd25774..cb187e5 100644
+index 37053a7..ed9add2 100644
 --- a/bin/named/Makefile.in
 +++ b/bin/named/Makefile.in
-@@ -87,7 +87,7 @@ NOSYMLIBS =	${NSLIBS} ${DNSLIBS} ${BIND9LIBS} \
+@@ -91,7 +91,7 @@ NOSYMLIBS =	${NSLIBS} ${DNSLIBS} ${BIND9LIBS} \
  
  SUBDIRS =	unix
  
@@ -24,7 +24,7 @@ index dd25774..cb187e5 100644
  
  GEOIP2LINKOBJS = geoip.@O@
  
-@@ -156,6 +156,15 @@ named@EXEEXT@: ${OBJS} ${DEPLIBS}
+@@ -154,6 +154,16 @@ named@EXEEXT@: ${OBJS} ${DEPLIBS}
  	export BASEOBJS="${OBJS} ${UOBJS}"; \
  	${FINALBUILDCMD}
  
@@ -37,11 +37,12 @@ index dd25774..cb187e5 100644
 +	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} \
 +		-o $@ feature-test.@O@ ${ISCLIBS} ${LIBS}
 +
- doc man:: ${MANOBJS}
++
+ clean distclean maintainer-clean::
+ 	rm -f ${TARGETS} ${OBJS}
  
- docclean manclean maintainer-clean::
 diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
-index 2317bd8..5015d5c 100644
+index 7934930..e84fde2 100644
 --- a/bin/tests/system/conf.sh.in
 +++ b/bin/tests/system/conf.sh.in
 @@ -37,7 +37,7 @@ DELV=$TOP/bin/delv/delv
@@ -54,5 +55,5 @@ index 2317bd8..5015d5c 100644
  HOST=$TOP/bin/dig/host
  IMPORTKEY=$TOP/bin/dnssec/dnssec-importkey
 -- 
-2.21.1
+2.26.2
 
diff --git a/bind-9.14-config-pkcs11.patch b/bind-9.14-config-pkcs11.patch
index bfc6e45..58b492b 100644
--- a/bind-9.14-config-pkcs11.patch
+++ b/bind-9.14-config-pkcs11.patch
@@ -1,4 +1,4 @@
-From 124c9e4c0500e7589ee63376e8f860f4abc675f2 Mon Sep 17 00:00:00 2001
+From c42c0ff6f6e0e920356d99b9ed26ed52544621c2 Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Fri, 18 Oct 2019 21:30:52 +0200
 Subject: [PATCH] Move USE_PKCS11 and USE_OPENSSL out of config.h
@@ -13,7 +13,7 @@ Move it as normal define to CDEFINES.
  3 files changed, 16 insertions(+), 6 deletions(-)
 
 diff --git a/bin/confgen/Makefile.in b/bin/confgen/Makefile.in
-index 1f5165a..ef3e70c 100644
+index 1b7512d..c126bf3 100644
 --- a/bin/confgen/Makefile.in
 +++ b/bin/confgen/Makefile.in
 @@ -22,7 +22,7 @@ VERSION=@BIND9_VERSION@
@@ -26,12 +26,12 @@ index 1f5165a..ef3e70c 100644
  
  ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
 diff --git a/configure.ac b/configure.ac
-index fde41dc..e5cc3cd 100644
+index eaa6b12..2ff68a5 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -889,10 +889,14 @@ AS_CASE([$enable_native_pkcs11],
- AC_SUBST([PKCS11_TEST])
+@@ -900,10 +900,14 @@ AC_SUBST([PKCS11_TEST])
  AC_SUBST([PKCS11_TOOLS])
+ AC_SUBST([PKCS11_MANS])
  
 +USE_PKCS11='-DUSE_PKCS11=0'
 +USE_OPENSSL='-DUSE_OPENSSL=0'
@@ -79,5 +79,5 @@ index 116e2d2..99bdf5b 100644
  		dst_hmac_key_t *hmac_key;
  	} keydata; /*%< pointer to key in crypto pkg fmt */
 -- 
-2.21.1
+2.26.2
 
diff --git a/bind-9.3.2-redhat_doc.patch b/bind-9.16-redhat_doc.patch
similarity index 56%
rename from bind-9.3.2-redhat_doc.patch
rename to bind-9.16-redhat_doc.patch
index d4531f4..15c8a41 100644
--- a/bind-9.3.2-redhat_doc.patch
+++ b/bind-9.16-redhat_doc.patch
@@ -1,68 +1,74 @@
-diff --git a/bin/named/named.8 b/bin/named/named.8
-index ef10ef4..3150b22 100644
---- a/bin/named/named.8
-+++ b/bin/named/named.8
-@@ -349,6 +349,63 @@ The default configuration file\&.
- /var/run/named/named\&.pid
- .RS 4
- The default process\-id file\&.
-+.PP
-+.SH "NOTES"
-+.PP
-+.TP
-+\fBRed Hat SELinux BIND Security Profile:\fR
-+.PP
+From 86fd25f3f0c5189fa93e10c6afa1a1cffe639ade Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Wed, 17 Jun 2020 23:17:13 +0200
+Subject: [PATCH] Update man named with Red Hat specifics
+
+This is almost unmodified text and requires revalidation. Some of those
+statements are no longer correct.
+---
+ bin/named/named.rst | 49 +++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 49 insertions(+)
+
+diff --git a/bin/named/named.rst b/bin/named/named.rst
+index 3c54a67..c44b6d7 100644
+--- a/bin/named/named.rst
++++ b/bin/named/named.rst
+@@ -228,6 +228,55 @@ Files
+ ``/var/run/named/named.pid``
+    The default process-id file.
+ 
++Notes
++~~~~~
++
++**Red Hat SELinux BIND Security Profile:**
++
 +By default, Red Hat ships BIND with the most secure SELinux policy
 +that will not prevent normal BIND operation and will prevent exploitation
 +of all known BIND security vulnerabilities . See the selinux(8) man page
 +for information about SElinux.
-+.PP
++
 +It is not necessary to run named in a chroot environment if the Red Hat
 +SELinux policy for named is enabled. When enabled, this policy is far
 +more secure than a chroot environment. Users are recommended to enable
 +SELinux and remove the bind-chroot package.
-+.PP
-+With this extra security comes some restrictions:
-+.PP
++
++*With this extra security comes some restrictions:*
++
 +By default, the SELinux policy does not allow named to write any master
 +zone database files. Only the root user may create files in the $ROOTDIR/var/named
 +zone database file directory (the options { "directory" } option), where
 +$ROOTDIR is set in /etc/sysconfig/named.
-+.PP
++
 +The "named" group must be granted read privelege to
 +these files in order for named to be enabled to read them.
-+.PP
++
 +Any file created in the zone database file directory is automatically assigned
-+the SELinux file context named_zone_t .
-+.PP
-+By default, SELinux prevents any role from modifying named_zone_t files; this
++the SELinux file context *named_zone_t* .
++
++By default, SELinux prevents any role from modifying *named_zone_t* files; this
 +means that files in the zone database directory cannot be modified by dynamic
 +DNS (DDNS) updates or zone transfers.
-+.PP
++
 +The Red Hat BIND distribution and SELinux policy creates three directories where
-+named is allowed to create and modify files: /var/named/slaves, /var/named/dynamic
-+/var/named/data. By placing files you want named to modify, such as
++named is allowed to create and modify files: */var/named/slaves*, */var/named/dynamic*
++*/var/named/data*. By placing files you want named to modify, such as
 +slave or DDNS updateable zone files and database / statistics dump files in
 +these directories, named will work normally and no further operator action is
-+required. Files in these directories are automatically assigned the 'named_cache_t'
++required. Files in these directories are automatically assigned the '*named_cache_t*'
 +file context, which SELinux allows named to write.
-+.PP
-+\fBRed Hat BIND SDB support:\fR
-+.PP
++
++**Red Hat BIND SDB support:**
++
 +Red Hat ships named with compiled in Simplified Database Backend modules that ISC
-+provides in the "contrib/sdb" directory. Install bind-sdb package if you want use them
-+.PP
-+The SDB modules for LDAP, PostGreSQL, DirDB and SQLite are compiled into named-sdb.
-+.PP
++provides in the "contrib/sdb" directory. Install **bind-sdb** package if you want use them
++
++The SDB modules for LDAP, PostGreSQL, DirDB and SQLite are compiled into *named-sdb*.
++
 +See the documentation for the various SDB modules in /usr/share/doc/bind-sdb-*/ .
-+.br
-+.PP
-+\fBRed Hat system-config-bind:\fR
-+.PP
-+Red Hat provides the system-config-bind GUI to configure named.conf and zone
-+database files. Run the "system-config-bind" command and access the manual
-+by selecting the Help menu.
-+.PP
- .RE
- .SH "SEE ALSO"
- .PP
++
+ See Also
+ ~~~~~~~~
+ 
+-- 
+2.26.2
+
diff --git a/bind-9.5-PIE.patch b/bind-9.5-PIE.patch
index a525b9b..d3c73ee 100644
--- a/bind-9.5-PIE.patch
+++ b/bind-9.5-PIE.patch
@@ -1,8 +1,10 @@
---- bind-9.5.0b2/bin/named/Makefile.in.pie	2008-02-11 17:21:47.000000000 +0100
-+++ bind-9.5.0b2/bin/named/Makefile.in	2008-02-11 17:22:10.000000000 +0100
-@@ -100,8 +100,12 @@ HTMLPAGES =	named.html lwresd.html named
- 
- MANOBJS =	${MANPAGES} ${HTMLPAGES}
+diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
+index eb622d1..37053a7 100644
+--- a/bin/named/Makefile.in
++++ b/bin/named/Makefile.in
+@@ -117,8 +117,12 @@ SRCS =		builtin.c config.c control.c \
+ 		tkeyconf.c tsigconf.c zoneconf.c \
+ 		${DLZDRIVER_SRCS} ${DBDRIVER_SRCS}
  
 +EXT_CFLAGS = -fpie
 +
@@ -13,10 +15,11 @@
  main.@O@: main.c
  	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} \
  		-DVERSION=\"${VERSION}\" \
-diff -up bind-9.5.0b2/bin/named/unix/Makefile.in.pie bind-9.5.0b2/bin/named/unix/Makefile.in
---- bind-9.5.0b2/bin/named/unix/Makefile.in.pie	2008-02-11 17:22:21.000000000 +0100
-+++ bind-9.5.0b2/bin/named/unix/Makefile.in	2008-02-11 17:23:00.000000000 +0100
-@@ -19,6 +19,8 @@ srcdir =	@srcdir@
+diff --git a/bin/named/unix/Makefile.in b/bin/named/unix/Makefile.in
+index fd9ca8d..f1c102c 100644
+--- a/bin/named/unix/Makefile.in
++++ b/bin/named/unix/Makefile.in
+@@ -11,6 +11,8 @@ srcdir =	@srcdir@
  VPATH =		@srcdir@
  top_srcdir =	@top_srcdir@
  
diff --git a/bind.spec b/bind.spec
index e533822..01b5197 100644
--- a/bind.spec
+++ b/bind.spec
@@ -63,7 +63,7 @@
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.16.3
+Version:  9.16.4
 Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
@@ -98,7 +98,7 @@ Source49: named-chroot.files
 
 # Common patches
 Patch10: bind-9.5-PIE.patch
-Patch16: bind-9.3.2-redhat_doc.patch
+Patch16: bind-9.16-redhat_doc.patch
 Patch72: bind-9.5-dlz-64bit.patch
 Patch106:bind93-rh490837.patch
 Patch112:bind97-rh645544.patch
@@ -150,6 +150,8 @@ BuildRequires:  selinux-policy
 # needed for %%{__python3} macro
 BuildRequires:  python3-devel
 BuildRequires:  python3-ply
+BuildRequires:  python3-sphinx
+BuildRequires:  doxygen
 BuildRequires:  findutils sed
 %if 0%{?fedora}
 BuildRequires:  gnupg2
@@ -429,7 +431,7 @@ This package provides a module which allows commands to be sent to rndc directly
 %patch112 -p1 -b .rh645544
 %patch130 -p1 -b .libdb
 %patch140 -p1 -b .rh1410433
-%patch154 -p1 -b .oot-man
+#%patch154 -p1 -b .oot-man # FIXME: sphinx replace?
 %patch157 -p1 -b .fips-tests
 %patch164 -p1 -b .rh1666814
 %patch170 -p1 -b .featuretest-named
@@ -1157,6 +1159,9 @@ fi;
 
 
 %changelog
+* Thu Jun 18 2020 Petr Menšík <pemensik@redhat.com> - 32:9.16.4-1
+- Update to 9.16.4
+
 * Wed May 20 2020 Petr Menšík <pemensik@redhat.com> - 32:9.16.3-1
 - Update to 9.16.3
 - Make initscripts just optional dependency
diff --git a/bind97-rh645544.patch b/bind97-rh645544.patch
index e7f67d8..e2ae978 100644
--- a/bind97-rh645544.patch
+++ b/bind97-rh645544.patch
@@ -1,8 +1,8 @@
 diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
-index 51bc368..20a17b9 100644
+index 31549c6..65a14b6 100644
 --- a/lib/dns/resolver.c
 +++ b/lib/dns/resolver.c
-@@ -1754,7 +1754,7 @@ log_edns(fetchctx_t *fctx) {
+@@ -1762,7 +1762,7 @@ log_edns(fetchctx_t *fctx) {
  	 */
  	dns_name_format(&fctx->domain, domainbuf, sizeof(domainbuf));
  	isc_log_write(dns_lctx, DNS_LOGCATEGORY_EDNS_DISABLED,
@@ -11,7 +11,7 @@ index 51bc368..20a17b9 100644
  		      "success resolving '%s' (in '%s'?) after %s", fctx->info,
  		      domainbuf, fctx->reason);
  }
-@@ -5275,7 +5275,7 @@ log_lame(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo) {
+@@ -5298,7 +5298,7 @@ log_lame(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo) {
  	dns_name_format(&fctx->domain, domainbuf, sizeof(domainbuf));
  	isc_sockaddr_format(&addrinfo->sockaddr, addrbuf, sizeof(addrbuf));
  	isc_log_write(dns_lctx, DNS_LOGCATEGORY_LAME_SERVERS,
@@ -20,12 +20,12 @@ index 51bc368..20a17b9 100644
  		      "lame server resolving '%s' (in '%s'?): %s", namebuf,
  		      domainbuf, addrbuf);
  }
-@@ -5302,7 +5302,7 @@ log_formerr(fetchctx_t *fctx, const char *format, ...) {
- 	}
+@@ -5316,7 +5316,7 @@ log_formerr(fetchctx_t *fctx, const char *format, ...) {
+ 	isc_sockaddr_format(&fctx->addrinfo->sockaddr, nsbuf, sizeof(nsbuf));
  
  	isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
 -		      DNS_LOGMODULE_RESOLVER, ISC_LOG_NOTICE,
 +		      DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(1),
- 		      "DNS format error from %s resolving %s%s%s: %s", nsbuf,
- 		      fctx->info, clmsg, clbuf, msgbuf);
+ 		      "DNS format error from %s resolving %s for %s: %s", nsbuf,
+ 		      fctx->info, fctx->clientstr, msgbuf);
  }
diff --git a/bind99-rh640538.patch b/bind99-rh640538.patch
index 5066a14..54d7e1b 100644
--- a/bind99-rh640538.patch
+++ b/bind99-rh640538.patch
@@ -1,44 +1,22 @@
-diff --git a/bin/dig/dig.docbook b/bin/dig/dig.docbook
-index 1079421..f11abd1 100644
---- a/bin/dig/dig.docbook
-+++ b/bin/dig/dig.docbook
-@@ -1177,6 +1177,39 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
-     </para>
-   </refsection>
+diff --git a/bin/dig/dig.rst b/bin/dig/dig.rst
+index 3c899ce..3e9957b 100644
+--- a/bin/dig/dig.rst
++++ b/bin/dig/dig.rst
+@@ -616,6 +616,17 @@ like to turn off the IDN support for some reason, use parameters
+ ``+noidnin`` and ``+noidnout`` or define the IDN_DISABLE environment
+ variable.
  
-+  <refsection><info><title>RETURN CODES</title></info>
-+    <para>
-+      <command>Dig</command> return codes are:
-+      <variablelist>
-+        <varlistentry>
-+          <listitem>
-+            <para>0: Everything went well, including things like NXDOMAIN</para>
-+          </listitem>
-+        </varlistentry>
-+        <varlistentry>
-+          <listitem>
-+            <para>1: Usage error</para>
-+          </listitem>
-+        </varlistentry>
-+        <varlistentry>
-+          <listitem>
-+            <para>8: Couldn't open batch file</para>
-+          </listitem>
-+        </varlistentry>
-+        <varlistentry>
-+          <listitem>
-+            <para>9: No reply from server</para>
-+          </listitem>
-+        </varlistentry>
-+        <varlistentry>
-+          <listitem>
-+            <para>10: Internal error</para>
-+          </listitem>
-+        </varlistentry>
-+      </variablelist>
-+    </para>
-+  </refsection>
++Return codes
++~~~~~~~~~~~~
 +
-   <refsection><info><title>FILES</title></info>
++``dig`` return codes are:
++
++   0: Everything went well, including things like NXDOMAIN
++   1: Usage error
++   8: Couldn't open batch file
++   9: No reply from server
++   10: Internal error
++
+ Files
+ ~~~~~
  
-     <para><filename>/etc/resolv.conf</filename>

From 0963df6403987d8689f752dd52aa35f951baa19c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 18 Jun 2020 04:26:31 +0200
Subject: [PATCH 162/460] Create doc subpackage and regenerate documentation

Regenerates full documentation on each build. Make documentation
optional in case some dependencies would be missing.
---
 bind-9.11-oot-manual.patch | 252 -------------------------------------
 bind.spec                  |  48 +++++--
 2 files changed, 41 insertions(+), 259 deletions(-)
 delete mode 100644 bind-9.11-oot-manual.patch

diff --git a/bind-9.11-oot-manual.patch b/bind-9.11-oot-manual.patch
deleted file mode 100644
index fe1788f..0000000
--- a/bind-9.11-oot-manual.patch
+++ /dev/null
@@ -1,252 +0,0 @@
-From c5b39725cd4f3f30eac7eeafd7802005a1fad533 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Wed, 25 Jul 2018 12:24:16 +0200
-Subject: [PATCH] Use make automatic variables to install updated manuals
-
-Make will choose modified manual from build directory or original from source
-directory automagically. Take advantage of install tool feature.
-Install all files in single command instead of iterating on each of them.
----
- bin/check/Makefile.in   |  8 +++++---
- bin/confgen/Makefile.in |  9 +++++----
- bin/delv/Makefile.in    |  6 ++++--
- bin/dig/Makefile.in     |  8 ++++----
- bin/dnssec/Makefile.in  |  6 ++++--
- bin/named/Makefile.in   | 12 +++++++++---
- bin/pkcs11/Makefile.in  |  9 ++++-----
- bin/python/Makefile.in  |  8 ++++----
- bin/tools/Makefile.in   | 25 +++++++++++++++----------
- 9 files changed, 54 insertions(+), 37 deletions(-)
-
-diff --git a/bin/check/Makefile.in b/bin/check/Makefile.in
-index 8f009a4..de3c066 100644
---- a/bin/check/Makefile.in
-+++ b/bin/check/Makefile.in
-@@ -84,12 +84,14 @@ installdirs:
- 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
- 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
- 
--install:: named-checkconf@EXEEXT@ named-checkzone@EXEEXT@ installdirs
-+install-man8: ${MANPAGES}
-+	${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man8
-+	(cd ${DESTDIR}${mandir}/man8; rm -f named-compilezone.8; ${LINK_PROGRAM} named-checkzone.8 named-compilezone.8)
-+
-+install:: named-checkconf@EXEEXT@ named-checkzone@EXEEXT@ installdirs install-man8
- 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named-checkconf@EXEEXT@ ${DESTDIR}${sbindir}
- 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named-checkzone@EXEEXT@ ${DESTDIR}${sbindir}
- 	(cd ${DESTDIR}${sbindir}; rm -f named-compilezone@EXEEXT@; ${LINK_PROGRAM} named-checkzone@EXEEXT@ named-compilezone@EXEEXT@)
--	for m in ${MANPAGES}; do ${INSTALL_DATA} ${srcdir}/$$m ${DESTDIR}${mandir}/man8 || exit 1; done
--	(cd ${DESTDIR}${mandir}/man8; rm -f named-compilezone.8; ${LINK_PROGRAM} named-checkzone.8 named-compilezone.8)
- 
- uninstall::
- 	rm -f ${DESTDIR}${mandir}/man8/named-compilezone.8
-diff --git a/bin/confgen/Makefile.in b/bin/confgen/Makefile.in
-index 0588f8b..44d87fd 100644
---- a/bin/confgen/Makefile.in
-+++ b/bin/confgen/Makefile.in
-@@ -93,13 +93,14 @@ installdirs:
- 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
- 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
- 
--install:: rndc-confgen@EXEEXT@ ddns-confgen@EXEEXT@ installdirs
-+install-man8: rndc-confgen.8 ddns-confgen.8
-+	${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man8
-+	(cd ${DESTDIR}${mandir}/man8; rm -f tsig-keygen.8; ${LINK_PROGRAM} ddns-confgen.8 tsig-keygen.8)
-+
-+install:: rndc-confgen@EXEEXT@ ddns-confgen@EXEEXT@ installdirs install-man8
- 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} rndc-confgen@EXEEXT@ ${DESTDIR}${sbindir}
- 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} ddns-confgen@EXEEXT@ ${DESTDIR}${sbindir}
--	${INSTALL_DATA} ${srcdir}/rndc-confgen.8 ${DESTDIR}${mandir}/man8
--	${INSTALL_DATA} ${srcdir}/ddns-confgen.8 ${DESTDIR}${mandir}/man8
- 	(cd ${DESTDIR}${sbindir}; rm -f tsig-keygen@EXEEXT@; ${LINK_PROGRAM} ddns-confgen@EXEEXT@ tsig-keygen@EXEEXT@)
--	(cd ${DESTDIR}${mandir}/man8; rm -f tsig-keygen.8; ${LINK_PROGRAM} ddns-confgen.8 tsig-keygen.8)
- 
- uninstall::
- 	rm -f ${DESTDIR}${mandir}/man8/tsig-keygen.8
-diff --git a/bin/delv/Makefile.in b/bin/delv/Makefile.in
-index ea106f8..77adc91 100644
---- a/bin/delv/Makefile.in
-+++ b/bin/delv/Makefile.in
-@@ -63,10 +63,12 @@ installdirs:
- 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${bindir}
- 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man1
- 
--install:: delv@EXEEXT@ installdirs
-+install-man1: delv.1
-+	${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man1
-+
-+install:: delv@EXEEXT@ installdirs install-man1
- 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} \
- 		delv@EXEEXT@ ${DESTDIR}${bindir}
--	${INSTALL_DATA} ${srcdir}/delv.1 ${DESTDIR}${mandir}/man1
- 
- uninstall::
- 	rm -f ${DESTDIR}${mandir}/man1/delv.1
-diff --git a/bin/dig/Makefile.in b/bin/dig/Makefile.in
-index 8ea146f..3a97024 100644
---- a/bin/dig/Makefile.in
-+++ b/bin/dig/Makefile.in
-@@ -93,16 +93,16 @@ installdirs:
- 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${bindir}
- 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man1
- 
--install:: dig@EXEEXT@ host@EXEEXT@ nslookup@EXEEXT@ installdirs
-+install-man1: ${MANPAGES}
-+	${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man1
-+
-+install:: dig@EXEEXT@ host@EXEEXT@ nslookup@EXEEXT@ installdirs install-man1
- 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} \
- 		dig@EXEEXT@ ${DESTDIR}${bindir}
- 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} \
- 		host@EXEEXT@ ${DESTDIR}${bindir}
- 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} \
- 		nslookup@EXEEXT@ ${DESTDIR}${bindir}
--	for m in ${MANPAGES}; do \
--		${INSTALL_DATA} ${srcdir}/$$m ${DESTDIR}${mandir}/man1 || exit 1; \
--	done
- 
- uninstall::
- 	for m in ${MANPAGES}; do \
-diff --git a/bin/dnssec/Makefile.in b/bin/dnssec/Makefile.in
-index dfaad27..be1ac3b 100644
---- a/bin/dnssec/Makefile.in
-+++ b/bin/dnssec/Makefile.in
-@@ -114,9 +114,11 @@ installdirs:
- 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
- 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
- 
--install:: ${TARGETS} installdirs
-+install-man8: ${MANPAGES}
-+	${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man8
-+
-+install:: ${TARGETS} installdirs install-man8
- 	for t in ${TARGETS}; do ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} $$t ${DESTDIR}${sbindir} || exit 1; done
--	for m in ${MANPAGES}; do ${INSTALL_DATA} ${srcdir}/$$m ${DESTDIR}${mandir}/man8 || exit 1; done
- 
- uninstall::
- 	for m in ${MANPAGES}; do rm -f ${DESTDIR}${mandir}/man8/$$m || exit 1; done
-diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
-index 0485002..10d568f 100644
---- a/bin/named/Makefile.in
-+++ b/bin/named/Makefile.in
-@@ -169,10 +169,16 @@ installdirs:
- 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man5
- 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
- 
--install:: named@EXEEXT@ installdirs
-+install-man5: named.conf.5
-+	${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man5
-+
-+install-man8: named.8
-+	${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man8
-+
-+install-man: install-man5 install-man8
-+
-+install:: named@EXEEXT@ installdirs install-man
- 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named@EXEEXT@ ${DESTDIR}${sbindir}
--	${INSTALL_DATA} ${srcdir}/named.8 ${DESTDIR}${mandir}/man8
--	${INSTALL_DATA} ${srcdir}/named.conf.5 ${DESTDIR}${mandir}/man5
- 
- uninstall::
- 	rm -f ${DESTDIR}${mandir}/man5/named.conf.5
-diff --git a/bin/pkcs11/Makefile.in b/bin/pkcs11/Makefile.in
-index 2fd9861..96aec05 100644
---- a/bin/pkcs11/Makefile.in
-+++ b/bin/pkcs11/Makefile.in
-@@ -69,7 +69,10 @@ installdirs:
- 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
- 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
- 
--install:: ${TARGETS} installdirs
-+install-man8: ${MANPAGES}
-+	${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man8
-+
-+install:: ${TARGETS} installdirs install-man8
- 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} pkcs11-list@EXEEXT@ \
- 		${DESTDIR}${sbindir}
- 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} pkcs11-destroy@EXEEXT@ \
-@@ -78,10 +81,6 @@ install:: ${TARGETS} installdirs
- 		${DESTDIR}${sbindir}
- 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} pkcs11-tokens@EXEEXT@ \
- 		${DESTDIR}${sbindir}
--	${INSTALL_DATA} ${srcdir}/pkcs11-list.8 ${DESTDIR}${mandir}/man8
--	${INSTALL_DATA} ${srcdir}/pkcs11-destroy.8 ${DESTDIR}${mandir}/man8
--	${INSTALL_DATA} ${srcdir}/pkcs11-keygen.8 ${DESTDIR}${mandir}/man8
--	${INSTALL_DATA} ${srcdir}/pkcs11-tokens.8 ${DESTDIR}${mandir}/man8
- 
- uninstall::
- 	rm -f ${DESTDIR}${mandir}/man8/pkcs11-tokens.8
-diff --git a/bin/python/Makefile.in b/bin/python/Makefile.in
-index aa678d4..064c404 100644
---- a/bin/python/Makefile.in
-+++ b/bin/python/Makefile.in
-@@ -47,13 +47,13 @@ installdirs:
- 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
- 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
- 
--install:: ${TARGETS} installdirs
-+install-man8: ${MANPAGES}
-+	${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man8
-+
-+install:: ${TARGETS} installdirs install-man8
- 	${INSTALL_SCRIPT} dnssec-checkds ${DESTDIR}${sbindir}
- 	${INSTALL_SCRIPT} dnssec-coverage ${DESTDIR}${sbindir}
- 	${INSTALL_SCRIPT} dnssec-keymgr ${DESTDIR}${sbindir}
--	${INSTALL_DATA} ${srcdir}/dnssec-checkds.8 ${DESTDIR}${mandir}/man8
--	${INSTALL_DATA} ${srcdir}/dnssec-coverage.8 ${DESTDIR}${mandir}/man8
--	${INSTALL_DATA} ${srcdir}/dnssec-keymgr.8 ${DESTDIR}${mandir}/man8
- 	if test -n "${PYTHON}" ; then \
- 		if test -n "${DESTDIR}" ; then \
- 			${PYTHON} ${srcdir}/setup.py install --root=${DESTDIR} --prefix=${prefix} @PYTHON_INSTALL_LIB@ ; \
-diff --git a/bin/tools/Makefile.in b/bin/tools/Makefile.in
-index 0fd2847..3c4f028 100644
---- a/bin/tools/Makefile.in
-+++ b/bin/tools/Makefile.in
-@@ -107,17 +107,27 @@ installdirs:
- 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man1
- 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
- 
--nzd:
-+nzd-man: named-nzd2nzf.8
-+	${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man8
-+
-+nzd: nzd-man
- 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named-nzd2nzf@EXEEXT@ \
- 		${DESTDIR}${sbindir}
--	${INSTALL_DATA} ${srcdir}/named-nzd2nzf.8 ${DESTDIR}${mandir}/man8
- 
--dnstap:
-+dnstap-man: dnstap-read.1
-+	${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man1
-+
-+dnstap: dnstap-man
- 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} dnstap-read@EXEEXT@ \
- 		${DESTDIR}${bindir}
--	${INSTALL_DATA} ${srcdir}/dnstap-read.1 ${DESTDIR}${mandir}/man1
- 
--install:: ${TARGETS} installdirs @DNSTAP@ @NZD_TOOLS@
-+install-man1: arpaname.1 named-rrchecker.1 mdig.1
-+	${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man1
-+
-+install-man8: named-journalprint.8 nsec3hash.8
-+	${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man8
-+
-+install:: ${TARGETS} installdirs @DNSTAP@ @NZD_TOOLS@ install-man1 install-man8
- 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} arpaname@EXEEXT@ \
- 		${DESTDIR}${bindir}
- 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named-journalprint@EXEEXT@ \
-@@ -128,11 +138,6 @@ install:: ${TARGETS} installdirs @DNSTAP@ @NZD_TOOLS@
- 		${DESTDIR}${sbindir}
- 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} mdig@EXEEXT@ \
- 		${DESTDIR}${bindir}
--	${INSTALL_DATA} ${srcdir}/arpaname.1 ${DESTDIR}${mandir}/man1
--	${INSTALL_DATA} ${srcdir}/named-journalprint.8 ${DESTDIR}${mandir}/man8
--	${INSTALL_DATA} ${srcdir}/named-rrchecker.1 ${DESTDIR}${mandir}/man1
--	${INSTALL_DATA} ${srcdir}/nsec3hash.8 ${DESTDIR}${mandir}/man8
--	${INSTALL_DATA} ${srcdir}/mdig.1 ${DESTDIR}${mandir}/man1
- 
- uninstall::
- 	rm -f ${DESTDIR}${mandir}/man1/mdig.1
--- 
-2.20.1
-
diff --git a/bind.spec b/bind.spec
index 01b5197..9b3a8d1 100644
--- a/bind.spec
+++ b/bind.spec
@@ -25,10 +25,12 @@
 %bcond_without UNITTEST
 %bcond_without DNSTAP
 %bcond_without LMDB
+%bcond_without DOC
 %else
 %bcond_with    UNITTEST
 %bcond_with    DNSTAP
 %bcond_with    LMDB
+%bcond_with    DOC
 %endif
 %bcond_with    TSAN
 
@@ -115,8 +117,6 @@ Patch149:bind-9.11-kyua-pkcs11.patch
 # introduced by https://source.isc.org/cgi-bin/gitweb.cgi?p=bind9.git;a=commit;h=fc9f0ac5778f78003a7acc957a23711811fec122
 Patch137:bind-9.10-use-of-strlcat.patch
 Patch140:bind-9.11-rh1410433.patch
-# Avoid conflicts with OpenSSL PKCS11 engine
-Patch154:bind-9.11-oot-manual.patch
 Patch157:bind-9.11-fips-tests.patch
 Patch164:bind-9.11-rh1666814.patch
 Patch170:bind-9.11-feature-test-named.patch
@@ -150,8 +150,6 @@ BuildRequires:  selinux-policy
 # needed for %%{__python3} macro
 BuildRequires:  python3-devel
 BuildRequires:  python3-ply
-BuildRequires:  python3-sphinx
-BuildRequires:  doxygen
 BuildRequires:  findutils sed
 %if 0%{?fedora}
 BuildRequires:  gnupg2
@@ -192,7 +190,11 @@ BuildRequires:  libmaxminddb-devel
 BuildRequires:  fstrm-devel protobuf-c-devel
 %endif
 # Needed to regenerate dig.1 manpage
-BuildRequires: docbook-style-xsl, libxslt
+%if %{with DOC}
+BuildRequires:  python3-sphinx python3-sphinx_rtd_theme
+BuildRequires:  python3-sphinx-latex latexmk texlive-xetex texlive-xindy
+BuildRequires:  doxygen
+%endif
 %if %{with TSAN}
 BuildRequires: libtsan
 %endif
@@ -416,6 +418,25 @@ BuildArch: noarch
 %description -n python3-bind
 This package provides a module which allows commands to be sent to rndc directly from Python programs.
 
+%if %{with DOC}
+%package doc
+Summary:   Documentation for BIND
+Requires:  bind-license = %{epoch}:%{version}-%{release}
+BuildArch: noarch
+
+%description doc
+BIND (Berkeley Internet Name Domain) is an implementation of the DNS
+(Domain Name System) protocols. BIND includes a DNS server (named),
+which resolves host names to IP addresses; a resolver library
+(routines for applications to use when interfacing with DNS); and
+tools for verifying that the DNS server is operating properly.
+
+This package contains BIND 9 Administrator Reference Manual
+in HTML and PDF format.
+%end
+
+%endif
+
 %prep
 %if 0%{?gpgverify:1}
 # RHEL does not yet support this verification
@@ -431,7 +452,6 @@ This package provides a module which allows commands to be sent to rndc directly
 %patch112 -p1 -b .rh645544
 %patch130 -p1 -b .libdb
 %patch140 -p1 -b .rh1410433
-#%patch154 -p1 -b .oot-man # FIXME: sphinx replace?
 %patch157 -p1 -b .fips-tests
 %patch164 -p1 -b .rh1666814
 %patch170 -p1 -b .featuretest-named
@@ -574,6 +594,10 @@ pushd bin/python
 make man
 popd
 
+%if %{with DOC}
+  make doc
+%endif
+
 %if %{with DLZ}
   pushd contrib/dlz
   pushd modules
@@ -763,6 +787,11 @@ ln -s dnssec-verify.8.gz dnssec-verify-pkcs11.8.gz
 popd
 %endif
 
+pushd ${RPM_BUILD_ROOT}%{_mandir}/man8
+ln -s ddns-confgen.8.gz tsig-keygen.8.gz
+ln -s named-checkzone.8.gz named-compilezone.8.gz
+popd
+
 # Ghost config files:
 touch ${RPM_BUILD_ROOT}%{_localstatedir}/log/named.log
 
@@ -945,7 +974,6 @@ fi;
 %{_mandir}/man8/named-journalprint.8*
 %{_mandir}/man8/filter-aaaa.8.gz
 %doc CHANGES README named.conf.default
-%doc doc/arm/*html doc/arm/*pdf
 %doc sample/
 
 # Hide configuration
@@ -1157,10 +1185,16 @@ fi;
 %{python3_sitelib}/*.egg-info
 %{python3_sitelib}/isc/
 
+%if %{with DOC}
+%files doc
+%doc build/doc/arm/_build/html
+%doc build/doc/arm/Bv9ARM.pdf
+%endif
 
 %changelog
 * Thu Jun 18 2020 Petr Menšík <pemensik@redhat.com> - 32:9.16.4-1
 - Update to 9.16.4
+- Create separate bind-doc package with ARM
 
 * Wed May 20 2020 Petr Menšík <pemensik@redhat.com> - 32:9.16.3-1
 - Update to 9.16.3

From e8b35851c351851d5299caa657e55344d91a2d8a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 18 Jun 2020 12:33:42 +0200
Subject: [PATCH 163/460] Delete installed manuals for disabled features

Some manuals are installed, even when those features are disabled.
Remove such manuals after installation.
---
 bind.spec | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/bind.spec b/bind.spec
index 9b3a8d1..afa4d71 100644
--- a/bind.spec
+++ b/bind.spec
@@ -787,6 +787,14 @@ ln -s dnssec-verify.8.gz dnssec-verify-pkcs11.8.gz
 popd
 %endif
 
+# 9.16.4 installs even manual pages for tools not generated
+%if %{without DNSTAP}
+rm -f ${RPM_BUILD_ROOT}%{_mandir}/man1/dnstap-read.1* || true
+%endif
+%if %{without LMDB}
+rm -f ${RPM_BUILD_ROOT}%{_mandir}/man8/named-nzd2nzf.8* || true
+%endif
+
 pushd ${RPM_BUILD_ROOT}%{_mandir}/man8
 ln -s ddns-confgen.8.gz tsig-keygen.8.gz
 ln -s named-checkzone.8.gz named-compilezone.8.gz

From 2a2d2faeae0ee889b1fdc8d5f9fccd43a63b8592 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 18 Jun 2020 14:07:00 +0200
Subject: [PATCH 164/460] fixup! Update to 9.16.4

---
 .gitignore | 2 ++
 sources    | 4 ++--
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/.gitignore b/.gitignore
index 36cb37f..b7f9074 100644
--- a/.gitignore
+++ b/.gitignore
@@ -107,3 +107,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.16.1.tar.xz.asc
 /bind-9.16.2.tar.xz
 /bind-9.16.2.tar.xz.asc
+/bind-9.16.4.tar.xz
+/bind-9.16.4.tar.xz.asc
diff --git a/sources b/sources
index 863a695..2c9c198 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.16.2.tar.xz) = fec47a0df6f91318504d57730148816ee19d7d14769d9c6f84ecd2ced9f575ea86bac2eac65886835aae99f7120495150a40923ee06a7755c6118ffb1f7f166f
-SHA512 (bind-9.16.2.tar.xz.asc) = 854a5f2e82e491e74cfafb874f5cd614c9cb289e1c1bfae66ba37a881d7f8ee0acca99ff9aaddc118e8d52474121a81b627c475e432536cd99411c084479b69b
+SHA512 (bind-9.16.4.tar.xz) = b1cf0607b0d7569ea594e02848eed601b8faf31c527fc17d379cfff3cd45c0c8b849364af0312e9b65bc14875aad87de379281603c150a07bf021ec740e92860
+SHA512 (bind-9.16.4.tar.xz.asc) = 3eb7d79a1127ecb404020349ae0c077f27616a27bd3f7983eee6d0d70eb9823d293eea405d8f79e5b87830eb92817dce2de52d96ddad51ff0c1130c4a20ad9eb

From 9a4be750942b2dc71227cf147f2dbbdf216e2926 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 19 Jun 2020 20:10:55 +0200
Subject: [PATCH 165/460] Move documentation from bind-doc subdir to bind

Subpackage is there just as shared documentation for main package.
I want to stay in original directory, even most of paths have changed
since move to sphinx generated documentation.
---
 bind.spec             | 18 +++++++++++++++---
 bind99-rh640538.patch | 37 +++++++++++++++++++++++++++++--------
 2 files changed, 44 insertions(+), 11 deletions(-)

diff --git a/bind.spec b/bind.spec
index afa4d71..23934dc 100644
--- a/bind.spec
+++ b/bind.spec
@@ -36,6 +36,7 @@
 
 %{?!bind_uid:  %global bind_uid  25}
 %{?!bind_gid:  %global bind_gid  25}
+%{!?_pkgdocdir:%global _pkgdocdir %{_docdir}/%{name}-%{version}}
 %global        bind_dir          /var/named
 %global        chroot_prefix     %{bind_dir}/chroot
 %global        chroot_create_directories /dev /run/named %{_localstatedir}/{log,named,tmp} \\\
@@ -66,7 +67,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.16.4
-Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -800,6 +801,13 @@ ln -s ddns-confgen.8.gz tsig-keygen.8.gz
 ln -s named-checkzone.8.gz named-compilezone.8.gz
 popd
 
+%if %{with DOC}
+mkdir -p ${RPM_BUILD_ROOT}%{_pkgdocdir}
+cp -a build/doc/arm/{Bv9ARM.pdf,_build/html} build/doc/man/_build/html ${RPM_BUILD_ROOT}%{_pkgdocdir}
+cp -a build/doc/man/_build/html ${RPM_BUILD_ROOT}%{_pkgdocdir}/html/man
+rm -rf ${RPM_BUILD_ROOT}%{_pkgdocdir}/{html,html/man}/.{buildinfo,doctrees}
+%endif
+
 # Ghost config files:
 touch ${RPM_BUILD_ROOT}%{_localstatedir}/log/named.log
 
@@ -1195,11 +1203,15 @@ fi;
 
 %if %{with DOC}
 %files doc
-%doc build/doc/arm/_build/html
-%doc build/doc/arm/Bv9ARM.pdf
+%dir %{_pkgdocdir}
+%doc %{_pkgdocdir}/html
+%doc %{_pkgdocdir}/Bv9ARM.pdf
 %endif
 
 %changelog
+* Fri Jun 19 2020 Petr Menšík <pemensik@redhat.com> - 32:9.16.4-2
+- Move html into doc/bind
+
 * Thu Jun 18 2020 Petr Menšík <pemensik@redhat.com> - 32:9.16.4-1
 - Update to 9.16.4
 - Create separate bind-doc package with ARM
diff --git a/bind99-rh640538.patch b/bind99-rh640538.patch
index 54d7e1b..30e0a03 100644
--- a/bind99-rh640538.patch
+++ b/bind99-rh640538.patch
@@ -1,22 +1,43 @@
+From 8b0a284d551d24ec2323713a5641b783b6e1baaa Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Fri, 19 Jun 2020 18:48:23 +0200
+Subject: [PATCH] .rh640538
+
+---
+ bin/dig/dig.rst | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
 diff --git a/bin/dig/dig.rst b/bin/dig/dig.rst
-index 3c899ce..3e9957b 100644
+index 3c899ce..46c9885 100644
 --- a/bin/dig/dig.rst
 +++ b/bin/dig/dig.rst
-@@ -616,6 +616,17 @@ like to turn off the IDN support for some reason, use parameters
+@@ -616,6 +616,26 @@ like to turn off the IDN support for some reason, use parameters
  ``+noidnin`` and ``+noidnout`` or define the IDN_DISABLE environment
  variable.
  
-+Return codes
++Return Codes
 +~~~~~~~~~~~~
 +
 +``dig`` return codes are:
 +
-+   0: Everything went well, including things like NXDOMAIN
-+   1: Usage error
-+   8: Couldn't open batch file
-+   9: No reply from server
-+   10: Internal error
++``0``
++   Response received, including NXDOMAIN status
++
++``1``
++   Usage error
++
++``8``
++   Couldn't open batch file
++
++``9``
++   No reply from server
++
++``10``
++   Internal error
 +
  Files
  ~~~~~
  
+-- 
+2.26.2
+

From 78aed13f06a4ebc3ead0bb7932ab51439e81c13d Mon Sep 17 00:00:00 2001
From: Adrian Reber <adrian@lisas.de>
Date: Sat, 20 Jun 2020 18:38:33 +0200
Subject: [PATCH 166/460] Rebuilt for protobuf 3.12

---
 bind.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index e010170..5122af4 100644
--- a/bind.spec
+++ b/bind.spec
@@ -66,7 +66,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.11.20
-Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1604,6 +1604,9 @@ fi;
 
 
 %changelog
+* Sat Jun 20 2020 Adrian Reber <adrian@lisas.de> - 32:9.11.20-2
+- Rebuilt for protobuf 3.12
+
 * Wed Jun 17 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.20-1
 - Update to 9.11.20
 

From 192c76c22a74d2b3be1dbc72b81298d2dc16308d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 19 Jun 2020 20:10:55 +0200
Subject: [PATCH 167/460] Create doc subpackage

Subpackage is there just as shared documentation for main package.
I want to stay in original directory, files should not move since they
were in bind package.

Documentation is not regenerated, but used as shipped by upstream.
---
 bind.spec | 45 ++++++++++++++++++++++++++++++++++++++++++---
 1 file changed, 42 insertions(+), 3 deletions(-)

diff --git a/bind.spec b/bind.spec
index 5122af4..250b8b5 100644
--- a/bind.spec
+++ b/bind.spec
@@ -24,6 +24,7 @@
 %bcond_with    GEOIP
 # New MaxMind GeoLite support
 %bcond_without GEOIP2
+%bcond_without DOC
 %if 0%{?fedora} >= 28
 %bcond_without UNITTEST
 %bcond_without DNSTAP
@@ -37,6 +38,7 @@
 
 %{?!bind_uid:  %global bind_uid  25}
 %{?!bind_gid:  %global bind_gid  25}
+%{!?_pkgdocdir:%global _pkgdocdir %{_docdir}/%{name}-%{version}}
 %global        bind_dir          /var/named
 %global        chroot_prefix     %{bind_dir}/chroot
 %if %{with SDB}
@@ -66,7 +68,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.11.20
-Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  3%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -242,7 +244,7 @@ BuildRequires:  libmaxminddb-devel
 BuildRequires:  fstrm-devel protobuf-c-devel
 %endif
 # Needed to regenerate dig.1 manpage
-BuildRequires: docbook-style-xsl, libxslt
+BuildRequires:  docbook-style-xsl, libxslt
 %if %{with TSAN}
 BuildRequires: libtsan
 %endif
@@ -496,6 +498,25 @@ BuildArch: noarch
 %description -n python3-bind
 This package provides a module which allows commands to be sent to rndc directly from Python programs.
 
+%if %{with DOC}
+%package doc
+Summary:   BIND 9 Administrator Reference Manual
+Requires:  bind-license = %{epoch}:%{version}-%{release}
+BuildArch: noarch
+
+%description doc
+BIND (Berkeley Internet Name Domain) is an implementation of the DNS
+(Domain Name System) protocols. BIND includes a DNS server (named),
+which resolves host names to IP addresses; a resolver library
+(routines for applications to use when interfacing with DNS); and
+tools for verifying that the DNS server is operating properly.
+
+This package contains BIND 9 Administrator Reference Manual
+in HTML and PDF format.
+%end
+
+%endif
+
 %if %{with EXPORT_LIBS}
 %package export-libs
 Summary:   ISC libs for DHCP application
@@ -745,6 +766,11 @@ pushd bin/python
 make man
 popd
 
+%if %{with DOC}
+  # Does not work. Use upstream generated documentation instead.
+  # make doc
+%endif
+
 %if %{with DLZ}
   pushd contrib/dlz
   pushd modules
@@ -1066,6 +1092,11 @@ ln -s dnssec-verify.8.gz dnssec-verify-pkcs11.8.gz
 popd
 %endif
 
+%if %{with DOC}
+mkdir -p ${RPM_BUILD_ROOT}%{_pkgdocdir}
+cp -a doc/arm/*.html doc/arm/*.pdf ${RPM_BUILD_ROOT}%{_pkgdocdir}
+%endif
+
 # Ghost config files:
 touch ${RPM_BUILD_ROOT}%{_localstatedir}/log/named.log
 
@@ -1292,7 +1323,6 @@ fi;
 %{_mandir}/man8/rndc-confgen.8*
 %{_mandir}/man8/named-journalprint.8*
 %doc CHANGES README named.conf.default
-%doc doc/arm/*html doc/arm/*pdf
 %doc sample/
 
 # Hide configuration
@@ -1602,8 +1632,17 @@ fi;
 %{python3_sitelib}/*.egg-info
 %{python3_sitelib}/isc/
 
+%if %{with DOC}
+%files doc
+%dir %{_pkgdocdir}
+%doc %{_pkgdocdir}/*.html
+%doc %{_pkgdocdir}/*.pdf
+%endif
 
 %changelog
+* Tue Jun 23 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.20-3
+- Move documentation to separate bind-doc package
+
 * Sat Jun 20 2020 Adrian Reber <adrian@lisas.de> - 32:9.11.20-2
 - Rebuilt for protobuf 3.12
 

From b4eefd1f9675555f217d0ee74dbb078fe09d8a00 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 23 Jun 2020 12:30:57 +0200
Subject: [PATCH 168/460] Add missing lite library depends

---
 bind.spec | 1 +
 1 file changed, 1 insertion(+)

diff --git a/bind.spec b/bind.spec
index 250b8b5..5da6a8f 100644
--- a/bind.spec
+++ b/bind.spec
@@ -185,6 +185,7 @@ Requires(post): shadow-utils
 Requires(post): glibc-common
 Requires(post): grep
 Requires:       bind-libs%{?_isa} = %{epoch}:%{version}-%{release}
+Requires:       bind-libs-lite%{?_isa} = %{epoch}:%{version}-%{release}
 Obsoletes:      bind-config < 30:9.3.2-34.fc6
 Provides:       bind-config = 30:9.3.2-34.fc6
 Obsoletes:      caching-nameserver < 31:9.4.1-7.fc8

From 146cab798984be526460ae77187242220086954f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 15 Jul 2020 22:15:32 +0200
Subject: [PATCH 169/460] Update to 9.11.21

Only bugfix release without significant changes.

Release notes at:
https://downloads.isc.org/isc/bind9/9.11.21/RELEASE-NOTES-bind-9.11.21.html
---
 .gitignore | 2 ++
 bind.spec  | 7 +++++--
 sources    | 4 ++--
 3 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/.gitignore b/.gitignore
index 27a7197..2c71b88 100644
--- a/.gitignore
+++ b/.gitignore
@@ -110,3 +110,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.11.19.tar.gz.asc
 /bind-9.11.20.tar.gz
 /bind-9.11.20.tar.gz.asc
+/bind-9.11.21.tar.gz
+/bind-9.11.21.tar.gz.asc
diff --git a/bind.spec b/bind.spec
index 5da6a8f..fed4a01 100644
--- a/bind.spec
+++ b/bind.spec
@@ -67,8 +67,8 @@
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.11.20
-Release:  3%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Version:  9.11.21
+Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1641,6 +1641,9 @@ fi;
 %endif
 
 %changelog
+* Wed Jul 15 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.21-1
+- Update to 9.11.21
+
 * Tue Jun 23 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.20-3
 - Move documentation to separate bind-doc package
 
diff --git a/sources b/sources
index 3cbd20a..be00cf2 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.11.20.tar.gz) = 249710a35dfd340abf8d07c526fb9dd05ab3ed186641f33b697f9a59a866965f43d77e6d0c77b3690698eb6d451a15506cedc5da18aff666c9d95a864268dd25
-SHA512 (bind-9.11.20.tar.gz.asc) = f8dba8b72639eefc4b3e5e5e27f28506aa3333101bb903ea7add92716ec95718a0506023a6d812c6d03b93dc634100c0463b667ce7a889e01d087a97eda903f3
+SHA512 (bind-9.11.21.tar.gz) = d807c6fdc2ab46f14f0f72db2d991166e7fe1d37b6f458256b4e25de1fd5c5291c2338e407733388e0fa49da447941db1323a1b6fead813134101d2d5c331064
+SHA512 (bind-9.11.21.tar.gz.asc) = 172c7c21f6f17f7e8c421b8f09f4da6bf907ce39c5da564d0f731fd262e265cb26b0f95c907d473cc17ff8c0b2f37d32df8371dd7d0992ca3633b557f325502a

From 23ca2929094b4d75b9ccf9d09cc90377d8ef0179 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 15 Jul 2020 22:39:37 +0200
Subject: [PATCH 170/460] Update to 9.16.5

Modifies API of libraries, needs rebuild of dependent packages.
---
 .gitignore |  2 ++
 bind.spec  | 13 ++++++++-----
 sources    |  4 ++--
 3 files changed, 12 insertions(+), 7 deletions(-)

diff --git a/.gitignore b/.gitignore
index b7f9074..75cbcdf 100644
--- a/.gitignore
+++ b/.gitignore
@@ -109,3 +109,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.16.2.tar.xz.asc
 /bind-9.16.4.tar.xz
 /bind-9.16.4.tar.xz.asc
+/bind-9.16.5.tar.xz
+/bind-9.16.5.tar.xz.asc
diff --git a/bind.spec b/bind.spec
index 23934dc..91b8c70 100644
--- a/bind.spec
+++ b/bind.spec
@@ -56,18 +56,18 @@
 # no more isc-config.sh and bind9-config
 
 # lib*.so.X versions of selected libraries
-%global sover_dns 1603
-%global sover_isc 1603
+%global sover_dns 1605
+%global sover_isc 1605
 %global sover_irs 1601
 %global sover_isccfg 1600
-%global sover_ns 1603
+%global sover_ns 1604
 
 
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.16.4
-Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Version:  9.16.5
+Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1209,6 +1209,9 @@ fi;
 %endif
 
 %changelog
+* Wed Jul 15 2020 Petr Menšík <pemensik@redhat.com> - 32:9.16.5-1
+- Update to 9.16.5
+
 * Fri Jun 19 2020 Petr Menšík <pemensik@redhat.com> - 32:9.16.4-2
 - Move html into doc/bind
 
diff --git a/sources b/sources
index 2c9c198..fd7066c 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.16.4.tar.xz) = b1cf0607b0d7569ea594e02848eed601b8faf31c527fc17d379cfff3cd45c0c8b849364af0312e9b65bc14875aad87de379281603c150a07bf021ec740e92860
-SHA512 (bind-9.16.4.tar.xz.asc) = 3eb7d79a1127ecb404020349ae0c077f27616a27bd3f7983eee6d0d70eb9823d293eea405d8f79e5b87830eb92817dce2de52d96ddad51ff0c1130c4a20ad9eb
+SHA512 (bind-9.16.5.tar.xz) = 789fc19f60e81f67ef13ebacd030ea5d8f8cc42cf5f06a01ee2eefe9b7c6d3b10603a3a6a3df85b0e5d770fcf462ce8dddc3a7e5f7f2dab27aa5879ee5380eb7
+SHA512 (bind-9.16.5.tar.xz.asc) = 264d0e7de24e2d549f4eb6f368c55afd04aea2136416dbf131a47adcf99bae5e440245124469976f311bf752d5e9d3b7652d41d1d4b6d5fb67ed7cd86f3aaf27

From 2053b89207f35a28e8d7b26c0be106e0b2d7cb10 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 16 Jul 2020 00:02:49 +0200
Subject: [PATCH 171/460] Remove duplicate copy of HTML manual pages

---
 bind.spec | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/bind.spec b/bind.spec
index 91b8c70..247116b 100644
--- a/bind.spec
+++ b/bind.spec
@@ -802,10 +802,10 @@ ln -s named-checkzone.8.gz named-compilezone.8.gz
 popd
 
 %if %{with DOC}
-mkdir -p ${RPM_BUILD_ROOT}%{_pkgdocdir}
-cp -a build/doc/arm/{Bv9ARM.pdf,_build/html} build/doc/man/_build/html ${RPM_BUILD_ROOT}%{_pkgdocdir}
-cp -a build/doc/man/_build/html ${RPM_BUILD_ROOT}%{_pkgdocdir}/html/man
-rm -rf ${RPM_BUILD_ROOT}%{_pkgdocdir}/{html,html/man}/.{buildinfo,doctrees}
+mkdir -p ${RPM_BUILD_ROOT}%{_pkgdocdir}/html/man
+cp -a build/doc/arm/{Bv9ARM.pdf,_build/html} ${RPM_BUILD_ROOT}%{_pkgdocdir}
+cp -a build/doc/man/_build/html ${RPM_BUILD_ROOT}%{_pkgdocdir}/html
+rm -rf ${RPM_BUILD_ROOT}%{_pkgdocdir}/html/.{buildinfo,doctrees}
 %endif
 
 # Ghost config files:

From bd472bc593ac9dec6c9e48c55de46a17202f926e Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Mon, 27 Jul 2020 13:07:40 +0000
Subject: [PATCH 172/460] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
---
 bind.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index fed4a01..b054dec 100644
--- a/bind.spec
+++ b/bind.spec
@@ -68,7 +68,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.11.21
-Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1641,6 +1641,9 @@ fi;
 %endif
 
 %changelog
+* Mon Jul 27 2020 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.11.21-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
 * Wed Jul 15 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.21-1
 - Update to 9.11.21
 

From 2dfc59bcefff52337c56a0515b37511f238890b4 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Sat, 1 Aug 2020 00:08:12 +0000
Subject: [PATCH 173/460] - Second attempt - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
---
 bind.spec | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index b054dec..bb7cb0e 100644
--- a/bind.spec
+++ b/bind.spec
@@ -68,7 +68,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.11.21
-Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  3%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1641,6 +1641,10 @@ fi;
 %endif
 
 %changelog
+* Sat Aug 01 2020 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.11.21-3
+- Second attempt - Rebuilt for
+  https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
 * Mon Jul 27 2020 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.11.21-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
 

From 745f43ac05493cd67566f330deaa81e080cdb86a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 21 Aug 2020 10:28:16 +0200
Subject: [PATCH 174/460] Update to 9.11.22

https://downloads.isc.org/isc/bind9/9.11.22/RELEASE-NOTES-bind-9.11.22.html
---
 .gitignore                  |   2 +
 bind-9.11-fips-tests.patch  | 131 +++++++++++++++++-------------------
 bind-9.11-rt46047.patch     |  46 ++++++-------
 bind-9.11-serve-stale.patch | 119 ++++++++++++++++----------------
 bind.spec                   |   9 ++-
 sources                     |   4 +-
 6 files changed, 154 insertions(+), 157 deletions(-)

diff --git a/.gitignore b/.gitignore
index 2c71b88..a41a75a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -112,3 +112,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.11.20.tar.gz.asc
 /bind-9.11.21.tar.gz
 /bind-9.11.21.tar.gz.asc
+/bind-9.11.22.tar.gz
+/bind-9.11.22.tar.gz.asc
diff --git a/bind-9.11-fips-tests.patch b/bind-9.11-fips-tests.patch
index 29dda07..c08fca6 100644
--- a/bind-9.11-fips-tests.patch
+++ b/bind-9.11-fips-tests.patch
@@ -1,4 +1,4 @@
-From c23daf334d5487fa53fef88c82312e439a2d8523 Mon Sep 17 00:00:00 2001
+From da45a97312a63f815b295167c3f3abb9fe8941a3 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 2 Aug 2018 23:46:45 +0200
 Subject: [PATCH] FIPS tests changes
@@ -80,7 +80,7 @@ Date:   Wed Mar 7 10:44:23 2018 +0100
  bin/tests/system/digdelv/tests.sh             | 20 +++---
  bin/tests/system/dlv/ns1/sign.sh              |  4 +-
  bin/tests/system/dlv/ns2/sign.sh              |  4 +-
- bin/tests/system/dlv/ns6/sign.sh              | 66 +++++++++---------
+ bin/tests/system/dlv/ns6/sign.sh              | 66 ++++++++++---------
  bin/tests/system/dnssec/ns2/sign.sh           |  8 +--
  bin/tests/system/dnssec/ns5/trusted.conf.bad  |  2 +-
  bin/tests/system/dnssec/tests.sh              |  4 +-
@@ -92,18 +92,17 @@ Date:   Wed Mar 7 10:44:23 2018 +0100
  bin/tests/system/nsupdate/ns1/named.conf.in   |  2 +-
  bin/tests/system/nsupdate/ns2/named.conf.in   |  2 +-
  bin/tests/system/nsupdate/setup.sh            |  7 +-
- bin/tests/system/nsupdate/tests.sh            | 11 ++-
+ bin/tests/system/nsupdate/tests.sh            | 11 +++-
  bin/tests/system/rndc/setup.sh                |  2 +-
  bin/tests/system/rndc/tests.sh                | 23 ++++---
- bin/tests/system/tsig/clean.sh                |  1 +
  bin/tests/system/tsig/ns1/named.conf.in       | 10 +--
+ bin/tests/system/tsig/ns1/rndc5.conf.in       | 10 +++
  bin/tests/system/tsig/setup.sh                |  5 ++
- bin/tests/system/tsig/tests.sh                | 67 ++++++++++++-------
+ bin/tests/system/tsig/tests.sh                | 65 +++++++++++-------
  bin/tests/system/tsiggss/setup.sh             |  2 +-
  bin/tests/system/upforwd/ns1/named.conf.in    |  2 +-
  bin/tests/system/upforwd/tests.sh             |  2 +-
- bin/tests/system/tsig/ns1/rndc5.conf.in | 10 +++
- 45 files changed, 232 insertions(+), 171 deletions(-)
+ 44 files changed, 230 insertions(+), 170 deletions(-)
  create mode 100644 bin/tests/system/tsig/ns1/rndc5.conf.in
 
 diff --git a/bin/tests/system/acl/ns2/named1.conf.in b/bin/tests/system/acl/ns2/named1.conf.in
@@ -563,10 +562,10 @@ index 21be03e..e57c308 100644
  };
  
 diff --git a/bin/tests/system/checkconf/good.conf b/bin/tests/system/checkconf/good.conf
-index 9ab35b3..486551a 100644
+index 09d188a..7cf4030 100644
 --- a/bin/tests/system/checkconf/good.conf
 +++ b/bin/tests/system/checkconf/good.conf
-@@ -153,6 +153,6 @@ dyndb "name" "library.so" {
+@@ -159,6 +159,6 @@ dyndb "name" "library.so" {
  	system;
  };
  key "mykey" {
@@ -601,10 +600,10 @@ index f4e30f5..9f53e31 100644
  ; TTL of 3 weeks
  weeks		1814400	A	10.53.0.2
 diff --git a/bin/tests/system/digdelv/tests.sh b/bin/tests/system/digdelv/tests.sh
-index ade45ce..d3aff24 100644
+index 3d1010e..fa9eb92 100644
 --- a/bin/tests/system/digdelv/tests.sh
 +++ b/bin/tests/system/digdelv/tests.sh
-@@ -106,7 +106,7 @@ if [ -x "$DIG" ] ; then
+@@ -155,7 +155,7 @@ if [ -x "$DIG" ] ; then
    echo_i "checking dig +rrcomments works for DNSKEY($n)"
    ret=0
    $DIG $DIGOPTS +tcp @10.53.0.3 +rrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1
@@ -613,7 +612,7 @@ index ade45ce..d3aff24 100644
    check_ttl_range dig.out.test$n "DNSKEY" 300 || ret=1
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
-@@ -115,7 +115,7 @@ if [ -x "$DIG" ] ; then
+@@ -164,7 +164,7 @@ if [ -x "$DIG" ] ; then
    echo_i "checking dig +short +rrcomments works for DNSKEY ($n)"
    ret=0
    $DIG $DIGOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1
@@ -622,7 +621,7 @@ index ade45ce..d3aff24 100644
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
  
-@@ -123,7 +123,7 @@ if [ -x "$DIG" ] ; then
+@@ -172,7 +172,7 @@ if [ -x "$DIG" ] ; then
    echo_i "checking dig +short +nosplit works($n)"
    ret=0
    $DIG $DIGOPTS +tcp @10.53.0.3 +short +nosplit DNSKEY dnskey.example > dig.out.test$n || ret=1
@@ -631,7 +630,7 @@ index ade45ce..d3aff24 100644
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
  
-@@ -131,7 +131,7 @@ if [ -x "$DIG" ] ; then
+@@ -180,7 +180,7 @@ if [ -x "$DIG" ] ; then
    echo_i "checking dig +short +rrcomments works($n)"
    ret=0
    $DIG $DIGOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1
@@ -640,7 +639,7 @@ index ade45ce..d3aff24 100644
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
  
-@@ -148,7 +148,7 @@ if [ -x "$DIG" ] ; then
+@@ -197,7 +197,7 @@ if [ -x "$DIG" ] ; then
    echo_i "checking dig +short +rrcomments works($n)"
    ret=0
    $DIG $DIGOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1
@@ -649,7 +648,7 @@ index ade45ce..d3aff24 100644
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
  
-@@ -695,7 +695,7 @@ if [ -x ${DELV} ] ; then
+@@ -799,7 +799,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +rrcomments works for DNSKEY($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +rrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
@@ -658,7 +657,7 @@ index ade45ce..d3aff24 100644
    check_ttl_range delv.out.test$n "DNSKEY" 300 || ret=1
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
-@@ -704,7 +704,7 @@ if [ -x ${DELV} ] ; then
+@@ -808,7 +808,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +short +rrcomments works for DNSKEY ($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
@@ -667,7 +666,7 @@ index ade45ce..d3aff24 100644
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
  
-@@ -712,7 +712,7 @@ if [ -x ${DELV} ] ; then
+@@ -816,7 +816,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +short +rrcomments works ($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
@@ -676,7 +675,7 @@ index ade45ce..d3aff24 100644
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
  
-@@ -720,7 +720,7 @@ if [ -x ${DELV} ] ; then
+@@ -824,7 +824,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +short +nosplit works ($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +short +nosplit DNSKEY dnskey.example > delv.out.test$n || ret=1
@@ -685,7 +684,7 @@ index ade45ce..d3aff24 100644
    if test `wc -l < delv.out.test$n` != 1 ; then ret=1 ; fi
    f=`awk '{print NF}' < delv.out.test$n`
    test "${f:-0}" -eq 14 || ret=1
-@@ -731,7 +731,7 @@ if [ -x ${DELV} ] ; then
+@@ -835,7 +835,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +short +nosplit +norrcomments works ($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +short +nosplit +norrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
@@ -912,7 +911,7 @@ index 1e39862..4ed19ac 100755
  cat $infile $keyname1.key $keyname2.key >$zonefile
  
 diff --git a/bin/tests/system/dnssec/ns2/sign.sh b/bin/tests/system/dnssec/ns2/sign.sh
-index 13fb924..1ffa279 100644
+index 7f95c8a..3a9251b 100644
 --- a/bin/tests/system/dnssec/ns2/sign.sh
 +++ b/bin/tests/system/dnssec/ns2/sign.sh
 @@ -126,8 +126,8 @@ zone=in-addr.arpa.
@@ -956,10 +955,10 @@ index ed30460..e6b1126 100644
 +    "." 256 3 8 "AwEAAarwAdjV4gIhpBCjXVAScRFEx3co7k8smJdxrnqoGsl5NB7EZ9jRdgvCXbJn6v8y9jlNWVHvaC8ilhfhLh0A1vLWiWv4ijd/12xcnrY7xpG7Cu3YkxUxaXJ7Jdg/Iw1+9mGgXF1v4UbCIcw/3U3cxyk7OxYg+VSb5KBAQSR0upxV";
  };
 diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh
-index b31c1b4..a5e237b 100644
+index 6f7eaa7..bd2778b 100644
 --- a/bin/tests/system/dnssec/tests.sh
 +++ b/bin/tests/system/dnssec/tests.sh
-@@ -3235,8 +3235,8 @@ do
+@@ -3257,8 +3257,8 @@ do
  	   alg=`expr $alg + 1`
  	   continue;;
  	3) size="-b 512";;
@@ -1065,7 +1064,7 @@ index cfcfe8f..0a1614d 100644
  };
  
 diff --git a/bin/tests/system/notify/tests.sh b/bin/tests/system/notify/tests.sh
-index 1f6e6d0..c08bd25 100644
+index c112d2c..987b6de 100644
 --- a/bin/tests/system/notify/tests.sh
 +++ b/bin/tests/system/notify/tests.sh
 @@ -212,16 +212,16 @@ ret=0
@@ -1089,7 +1088,7 @@ index 1f6e6d0..c08bd25 100644
  	grep "test string" dig.out.b.ns5.test$n > /dev/null &&
  	grep "test string" dig.out.c.ns5.test$n > /dev/null &&
 diff --git a/bin/tests/system/nsupdate/ns1/named.conf.in b/bin/tests/system/nsupdate/ns1/named.conf.in
-index 1d999ad..26b6b7c 100644
+index e90907a..540a984 100644
 --- a/bin/tests/system/nsupdate/ns1/named.conf.in
 +++ b/bin/tests/system/nsupdate/ns1/named.conf.in
 @@ -32,7 +32,7 @@ controls {
@@ -1115,10 +1114,10 @@ index 4549184..cb7dccd 100644
  };
  
 diff --git a/bin/tests/system/nsupdate/setup.sh b/bin/tests/system/nsupdate/setup.sh
-index 21805c5..0d3d85c 100644
+index a35b8ee..8383162 100644
 --- a/bin/tests/system/nsupdate/setup.sh
 +++ b/bin/tests/system/nsupdate/setup.sh
-@@ -58,7 +58,12 @@ EOF
+@@ -53,7 +53,12 @@ EOF
  
  $DDNSCONFGEN -q -r $RANDFILE -z example.nil > ns1/ddns.key
  
@@ -1133,10 +1132,10 @@ index 21805c5..0d3d85c 100644
  $DDNSCONFGEN -q -r $RANDFILE -a hmac-sha224 -k sha224-key -z keytests.nil > ns1/sha224.key
  $DDNSCONFGEN -q -r $RANDFILE -a hmac-sha256 -k sha256-key -z keytests.nil > ns1/sha256.key
 diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh
-index 4da4849..b3bc807 100755
+index 14952c8..5c51972 100755
 --- a/bin/tests/system/nsupdate/tests.sh
 +++ b/bin/tests/system/nsupdate/tests.sh
-@@ -708,7 +708,14 @@ fi
+@@ -760,7 +760,14 @@ fi
  n=`expr $n + 1`
  ret=0
  echo_i "check TSIG key algorithms ($n)"
@@ -1152,7 +1151,7 @@ index 4da4849..b3bc807 100755
      $NSUPDATE -k ns1/${alg}.key <<END > /dev/null || ret=1
  server 10.53.0.1 ${PORT}
  update add ${alg}.keytests.nil. 600 A 10.10.10.3
-@@ -716,7 +723,7 @@ send
+@@ -768,7 +775,7 @@ send
  END
  done
  sleep 2
@@ -1162,10 +1161,10 @@ index 4da4849..b3bc807 100755
  done
  if [ $ret -ne 0 ]; then
 diff --git a/bin/tests/system/rndc/setup.sh b/bin/tests/system/rndc/setup.sh
-index 343869e..c30efb0 100644
+index 8521ff8..565a1d7 100644
 --- a/bin/tests/system/rndc/setup.sh
 +++ b/bin/tests/system/rndc/setup.sh
-@@ -37,7 +37,7 @@ make_key () {
+@@ -35,7 +35,7 @@ make_key () {
              sed 's/allow { 10.53.0.4/allow { any/' >> ns4/named.conf
  }
  
@@ -1208,15 +1207,6 @@ index 57e066d..186a723 100644
  
  n=`expr $n + 1`
  echo_i "testing rndc with hmac-sha1 ($n)"
-diff --git a/bin/tests/system/tsig/clean.sh b/bin/tests/system/tsig/clean.sh
-index 576ec70..cb7a852 100644
---- a/bin/tests/system/tsig/clean.sh
-+++ b/bin/tests/system/tsig/clean.sh
-@@ -20,3 +20,4 @@ rm -f */named.run
- rm -f ns*/named.lock
- rm -f Kexample.net.+163+*
- rm -f keygen.out?
-+rm -f ns1/named.conf
 diff --git a/bin/tests/system/tsig/ns1/named.conf.in b/bin/tests/system/tsig/ns1/named.conf.in
 index fbf30c6..f61657d 100644
 --- a/bin/tests/system/tsig/ns1/named.conf.in
@@ -1245,11 +1235,27 @@ index fbf30c6..f61657d 100644
  
  key "sha1-trunc" {
  	secret "FrSt77yPTFx6hTs4i2tKLB9LmE0=";
+diff --git a/bin/tests/system/tsig/ns1/rndc5.conf.in b/bin/tests/system/tsig/ns1/rndc5.conf.in
+new file mode 100644
+index 0000000..0682194
+--- /dev/null
++++ b/bin/tests/system/tsig/ns1/rndc5.conf.in
+@@ -0,0 +1,10 @@
++# Conditionally included when support for MD5 is available
++key "md5" {
++	secret "97rnFx24Tfna4mHPfgnerA==";
++	algorithm hmac-md5;
++};
++
++key "md5-trunc" {
++	secret "97rnFx24Tfna4mHPfgnerA==";
++	algorithm hmac-md5-80;
++};
 diff --git a/bin/tests/system/tsig/setup.sh b/bin/tests/system/tsig/setup.sh
-index 4dd4a25..aa0f966 100644
+index 9a8ab2e..1311689 100644
 --- a/bin/tests/system/tsig/setup.sh
 +++ b/bin/tests/system/tsig/setup.sh
-@@ -17,3 +17,8 @@ $SHELL clean.sh
+@@ -15,3 +15,8 @@ SYSTEMTESTTOP=..
  copy_setports ns1/named.conf.in ns1/named.conf
  
  test -r $RANDFILE || $GENRANDOM $RANDOMSIZE $RANDFILE
@@ -1259,7 +1265,7 @@ index 4dd4a25..aa0f966 100644
 +	cat ns1/rndc5.conf.in >> ns1/named.conf
 +fi
 diff --git a/bin/tests/system/tsig/tests.sh b/bin/tests/system/tsig/tests.sh
-index f731fa6..cade35b 100644
+index 526dbca..bf359a4 100644
 --- a/bin/tests/system/tsig/tests.sh
 +++ b/bin/tests/system/tsig/tests.sh
 @@ -26,20 +26,25 @@ sha512="jI/Pa4qRu96t76Pns5Z/Ndxbn3QCkwcxLOgt9vgvnJw5wqTRvNyk3FtD6yIMd1dWVlqZ+Y4f
@@ -1273,13 +1279,6 @@ index f731fa6..cade35b 100644
 -if [ $ret -eq 1 ] ; then
 -	echo_i "failed"; status=1
 -fi
--
--echo_i "fetching using hmac-md5 (new form)"
--ret=0
--$DIG $DIGOPTS example.nil. -y "hmac-md5:md5:$md5" @10.53.0.1 soa > dig.out.md5.new || ret=1
--grep -i "md5.*TSIG.*NOERROR" dig.out.md5.new > /dev/null || ret=1
--if [ $ret -eq 1 ] ; then
--	echo_i "failed"; status=1
 +if $FEATURETEST --md5
 +then
 +	echo_i "fetching using hmac-md5 (old form)"
@@ -1289,7 +1288,13 @@ index f731fa6..cade35b 100644
 +	if [ $ret -eq 1 ] ; then
 +		echo_i "failed"; status=1
 +	fi
-+
+ 
+-echo_i "fetching using hmac-md5 (new form)"
+-ret=0
+-$DIG $DIGOPTS example.nil. -y "hmac-md5:md5:$md5" @10.53.0.1 soa > dig.out.md5.new || ret=1
+-grep -i "md5.*TSIG.*NOERROR" dig.out.md5.new > /dev/null || ret=1
+-if [ $ret -eq 1 ] ; then
+-	echo_i "failed"; status=1
 +	echo_i "fetching using hmac-md5 (new form)"
 +	ret=0
 +	$DIG $DIGOPTS example.nil. -y "hmac-md5:md5:$md5" @10.53.0.1 soa > dig.out.md5.new || ret=1
@@ -1351,10 +1356,10 @@ index f731fa6..cade35b 100644
  
  echo_i "fetching using hmac-sha1-80 (BADTRUNC)"
 diff --git a/bin/tests/system/tsiggss/setup.sh b/bin/tests/system/tsiggss/setup.sh
-index 0d21c7b..dbcb7b4 100644
+index 49510b4..8d8bb2a 100644
 --- a/bin/tests/system/tsiggss/setup.sh
 +++ b/bin/tests/system/tsiggss/setup.sh
-@@ -18,5 +18,5 @@ test -r $RANDFILE || $GENRANDOM $RANDOMSIZE $RANDFILE
+@@ -16,5 +16,5 @@ test -r $RANDFILE || $GENRANDOM $RANDOMSIZE $RANDFILE
  
  copy_setports ns1/named.conf.in ns1/named.conf
  
@@ -1387,22 +1392,6 @@ index b0694bb..9adae82 100644
  server 10.53.0.3 ${PORT}
  update add updated.example. 600 A 10.10.10.1
  update add updated.example. 600 TXT Foo
-diff --git a/bin/tests/system/tsig/ns1/rndc5.conf.in b/bin/tests/system/tsig/ns1/rndc5.conf.in
-new file mode 100644
-index 0000000..0682194
---- /dev/null
-+++ b/bin/tests/system/tsig/ns1/rndc5.conf.in
-@@ -0,0 +1,10 @@
-+# Conditionally included when support for MD5 is available
-+key "md5" {
-+	secret "97rnFx24Tfna4mHPfgnerA==";
-+	algorithm hmac-md5;
-+};
-+
-+key "md5-trunc" {
-+	secret "97rnFx24Tfna4mHPfgnerA==";
-+	algorithm hmac-md5-80;
-+};
 -- 
-2.20.1
+2.26.2
 
diff --git a/bind-9.11-rt46047.patch b/bind-9.11-rt46047.patch
index ee9bae8..90ea7a4 100644
--- a/bind-9.11-rt46047.patch
+++ b/bind-9.11-rt46047.patch
@@ -1,4 +1,4 @@
-From 344c19ad4b3f058e65a4b41650bb0ee20692cc5c Mon Sep 17 00:00:00 2001
+From 8a064944dc10421a387725a365650d656d2a97f1 Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Thu, 28 Sep 2017 10:09:22 -0700
 Subject: [PATCH] completed and corrected the crypto-random change
@@ -142,7 +142,7 @@ index 5654435..24c0d5a 100644
  					   usekeyboard);
  
 diff --git a/bin/named/client.c b/bin/named/client.c
-index 9a0d3c8..c573177 100644
+index f4a5ff9..58549d3 100644
 --- a/bin/named/client.c
 +++ b/bin/named/client.c
 @@ -1765,7 +1765,8 @@ ns_client_addopt(ns_client_t *client, dns_message_t *message,
@@ -156,7 +156,7 @@ index 9a0d3c8..c573177 100644
  		compute_cookie(client, now, nonce, ns_g_server->secret, &buf);
  
 diff --git a/bin/named/config.c b/bin/named/config.c
-index dbdff64..63da4b0 100644
+index eef8181..ff868b8 100644
 --- a/bin/named/config.c
 +++ b/bin/named/config.c
 @@ -98,7 +98,9 @@ options {\n\
@@ -267,10 +267,10 @@ index 203f1e6..25eeced 100644
  #include <isc/serial.h>
  #include <isc/stats.h>
 diff --git a/bin/named/server.c b/bin/named/server.c
-index f27071f..f132c19 100644
+index 7b3b736..4aaa92f 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
-@@ -8210,21 +8210,32 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8234,21 +8234,32 @@ load_configuration(const char *filename, ns_server_t *server,
  	 * Open the source of entropy.
  	 */
  	if (first_time) {
@@ -312,7 +312,7 @@ index f27071f..f132c19 100644
  #ifdef PATH_RANDOMDEV
  			if (ns_g_fallbackentropy != NULL) {
  				level = ISC_LOG_INFO;
-@@ -8235,8 +8246,8 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8259,8 +8270,8 @@ load_configuration(const char *filename, ns_server_t *server,
  					      NS_LOGCATEGORY_GENERAL,
  					      NS_LOGMODULE_SERVER,
  					      level,
@@ -323,7 +323,7 @@ index f27071f..f132c19 100644
  					      randomdev,
  					      isc_result_totext(result));
  			}
-@@ -8256,7 +8267,6 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8280,7 +8291,6 @@ load_configuration(const char *filename, ns_server_t *server,
  				}
  				isc_entropy_detach(&ns_g_fallbackentropy);
  			}
@@ -331,7 +331,7 @@ index f27071f..f132c19 100644
  #endif
  		}
  
-@@ -9025,6 +9035,7 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
+@@ -9049,6 +9059,7 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
  	server->in_roothints = NULL;
  	server->blackholeacl = NULL;
  	server->keepresporder = NULL;
@@ -339,7 +339,7 @@ index f27071f..f132c19 100644
  
  	/* Must be first. */
  	CHECKFATAL(dst_lib_init2(ns_g_mctx, ns_g_entropy,
-@@ -9051,6 +9062,9 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
+@@ -9075,6 +9086,9 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
  	CHECKFATAL(dns_tkeyctx_create(ns_g_mctx, ns_g_entropy,
  				      &server->tkeyctx),
  		   "creating TKEY context");
@@ -349,7 +349,7 @@ index f27071f..f132c19 100644
  
  	/*
  	 * Setup the server task, which is responsible for coordinating
-@@ -9257,7 +9271,8 @@ ns_server_destroy(ns_server_t **serverp) {
+@@ -9281,7 +9295,8 @@ ns_server_destroy(ns_server_t **serverp) {
  
  	if (server->zonemgr != NULL)
  		dns_zonemgr_detach(&server->zonemgr);
@@ -359,7 +359,7 @@ index f27071f..f132c19 100644
  	if (server->tkeyctx != NULL)
  		dns_tkeyctx_destroy(&server->tkeyctx);
  
-@@ -13263,10 +13278,10 @@ newzone_cfgctx_destroy(void **cfgp) {
+@@ -13316,10 +13331,10 @@ newzone_cfgctx_destroy(void **cfgp) {
  
  static isc_result_t
  generate_salt(unsigned char *salt, size_t saltlen) {
@@ -372,7 +372,7 @@ index f27071f..f132c19 100644
  	} rnd;
  	unsigned char text[512 + 1];
  	isc_region_t r;
-@@ -13276,9 +13291,10 @@ generate_salt(unsigned char *salt, size_t saltlen) {
+@@ -13329,9 +13344,10 @@ generate_salt(unsigned char *salt, size_t saltlen) {
  	if (saltlen > 256U)
  		return (ISC_R_RANGE);
  
@@ -387,10 +387,10 @@ index f27071f..f132c19 100644
  	memmove(salt, rnd.rnd, saltlen);
  
 diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
-index 0286987..0376377 100644
+index 2436731..6f59456 100644
 --- a/bin/nsupdate/nsupdate.c
 +++ b/bin/nsupdate/nsupdate.c
-@@ -283,9 +283,7 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
+@@ -284,9 +284,7 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
  	}
  
  #ifdef ISC_PLATFORM_CRYPTORANDOM
@@ -455,22 +455,22 @@ index 2146f9b..64b8e74 100644
  	}
  #endif
 diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
-index 93c7a08..bb1e81d 100644
+index 1da0565..7eef5b2 100644
 --- a/doc/arm/Bv9ARM-book.xml
 +++ b/doc/arm/Bv9ARM-book.xml
-@@ -5081,22 +5081,45 @@ badresp:1,adberr:0,findfail:0,valfail:0]
+@@ -5034,22 +5034,45 @@ badresp:1,adberr:0,findfail:0,valfail:0]
  	    <term><command>random-device</command></term>
  	    <listitem>
  	      <para>
--		The source of entropy to be used by the server.  Entropy is
+-		This specifies a source of entropy to be used by the server.  Entropy is
 -		primarily needed
 -		for DNSSEC operations, such as TKEY transactions and dynamic
 -		update of signed
--		zones.  This options specifies the device (or file) from which
+-		zones.  This option specifies the device (or file) from which
 -		to read
--		entropy.  If this is a file, operations requiring entropy will
+-		entropy.  If it is a file, operations requiring entropy will
 -		fail when the
--		file has been exhausted.  If not specified, the default value
+-		file has been exhausted.  If <command>random-device</command> is not specified, the default value
 -		is
 -		<filename>/dev/random</filename>
 -		(or equivalent) when present, and none otherwise.  The
@@ -569,10 +569,10 @@ index 0000000..89a4961
 +</section>
 +
 diff --git a/doc/arm/notes.xml b/doc/arm/notes.xml
-index 589a347..052a0bd 100644
+index adffaa0..2ffe344 100644
 --- a/doc/arm/notes.xml
 +++ b/doc/arm/notes.xml
-@@ -40,6 +40,7 @@
+@@ -45,6 +45,7 @@
    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-9.11.1.xml"/>
    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-9.11.0.xml"/>
  
@@ -785,5 +785,5 @@ index 1c45d5c..91693b5 100644
  	{ "recursive-clients", &cfg_type_uint32, 0 },
  	{ "reserved-sockets", &cfg_type_uint32, 0 },
 -- 
-2.21.1
+2.26.2
 
diff --git a/bind-9.11-serve-stale.patch b/bind-9.11-serve-stale.patch
index 724a57b..d18077c 100644
--- a/bind-9.11-serve-stale.patch
+++ b/bind-9.11-serve-stale.patch
@@ -1,4 +1,4 @@
-From 521fc8dcc0ac064ae8bc521418f5b03f0ceec657 Mon Sep 17 00:00:00 2001
+From 5400119bfb19243b37e4f4f27baad4f610fff8da Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 7 Nov 2019 14:31:03 +0100
 Subject: [PATCH] Implement serve-stale in 9.11
@@ -240,7 +240,7 @@ Signed-off-by: Petr Menšík <pemensik@redhat.com>
  bin/tests/system/serve-stale/prereq.sh        |  38 ++
  bin/tests/system/serve-stale/setup.sh         |  13 +
  bin/tests/system/serve-stale/tests.sh         | 536 ++++++++++++++++++
- doc/arm/Bv9ARM-book.xml                       |  69 ++-
+ doc/arm/Bv9ARM-book.xml                       |  77 ++-
  doc/arm/logging-categories.xml                |  11 +
  doc/arm/notes-rh-changes.xml                  |  14 +-
  doc/misc/options                              |  10 +
@@ -263,7 +263,7 @@ Signed-off-by: Petr Menšík <pemensik@redhat.com>
  lib/dns/tests/db_test.c                       | 198 ++++++-
  lib/dns/view.c                                |   3 +
  lib/isccfg/namedconf.c                        |   5 +
- 48 files changed, 2122 insertions(+), 102 deletions(-)
+ 48 files changed, 2126 insertions(+), 106 deletions(-)
  create mode 100644 bin/tests/system/serve-stale/.gitignore
  create mode 100644 bin/tests/system/serve-stale/ans2/ans.pl.in
  create mode 100644 bin/tests/system/serve-stale/clean.sh
@@ -276,7 +276,7 @@ Signed-off-by: Petr Menšík <pemensik@redhat.com>
  create mode 100755 bin/tests/system/serve-stale/tests.sh
 
 diff --git a/bin/named/config.c b/bin/named/config.c
-index 63da4b0..b598f9b 100644
+index ff868b8..f23bed1 100644
 --- a/bin/named/config.c
 +++ b/bin/named/config.c
 @@ -182,13 +182,14 @@ options {\n\
@@ -733,7 +733,7 @@ index 25eeced..162e4ea 100644
  	    (!PARTIALANSWER(client) || WANTRECURSION(client)
  	     || eresult == DNS_R_DROP)) {
 diff --git a/bin/named/server.c b/bin/named/server.c
-index 1f23cf0..1fa836f 100644
+index 1cbb9a0..0c899ba 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
 @@ -1720,7 +1720,8 @@ static bool
@@ -843,7 +843,7 @@ index 1f23cf0..1fa836f 100644
  	/*
  	 * Set supported DNSSEC algorithms.
  	 */
-@@ -14456,3 +14500,132 @@ ns_server_dnstap(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text) {
+@@ -14509,3 +14553,132 @@ ns_server_dnstap(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text) {
  	return (ISC_R_NOTIMPLEMENTED);
  #endif
  }
@@ -994,7 +994,7 @@ index 4b8d972..8c68737 100644
  
  	/* Initialize resolver statistics */
 diff --git a/bin/rndc/rndc.c b/bin/rndc/rndc.c
-index 8083654..d519983 100644
+index 1b48861..f50635b 100644
 --- a/bin/rndc/rndc.c
 +++ b/bin/rndc/rndc.c
 @@ -160,6 +160,8 @@ command is one of the following:\n\
@@ -1052,7 +1052,7 @@ index f3f1939..9ff3f07 100644
 +    exit 1
 +fi
 diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
-index 22749b9..a247fd5 100644
+index 4c122c8..a2eb833 100644
 --- a/bin/tests/system/conf.sh.in
 +++ b/bin/tests/system/conf.sh.in
 @@ -128,7 +128,7 @@ PARALLELDIRS="dnssec rpzrecurse \
@@ -2039,10 +2039,10 @@ index 0000000..201c996
 +echo "I:exit status: $status"
 +[ $status -eq 0 ] || exit 1
 diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
-index bb1e81d..6dbbfad 100644
+index 7eef5b2..b16b239 100644
 --- a/doc/arm/Bv9ARM-book.xml
 +++ b/doc/arm/Bv9ARM-book.xml
-@@ -4381,6 +4381,9 @@ badresp:1,adberr:0,findfail:0,valfail:0]
+@@ -4336,6 +4336,9 @@ badresp:1,adberr:0,findfail:0,valfail:0]
  	  statement in the <filename>named.conf</filename> file:
  	</para>
  	<xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="options.grammar.xml"/>
@@ -2052,7 +2052,7 @@ index bb1e81d..6dbbfad 100644
        </section>
  
        <section xml:id="options"><info><title><command>options</command> Statement Definition and
-@@ -4474,6 +4477,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
+@@ -4429,6 +4432,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
  		  <command>dnssec-validation</command>,
  		  <command>max-cache-ttl</command>,
  		  <command>max-ncache-ttl</command>,
@@ -2060,7 +2060,7 @@ index bb1e81d..6dbbfad 100644
  		  <command>max-cache-size</command>, and
  		  <command>zero-no-soa-ttl</command>.
  		</para>
-@@ -5485,7 +5489,6 @@ options {
+@@ -5438,7 +5442,6 @@ options {
  	    </listitem>
  	  </varlistentry>
  
@@ -2068,7 +2068,7 @@ index bb1e81d..6dbbfad 100644
  	  <varlistentry>
  	    <term><command>max-zone-ttl</command></term>
  	    <listitem>
-@@ -5521,6 +5524,21 @@ options {
+@@ -5474,6 +5477,21 @@ options {
  	    </listitem>
  	  </varlistentry>
  
@@ -2090,7 +2090,7 @@ index bb1e81d..6dbbfad 100644
  	  <varlistentry>
  	    <term><command>serial-update-method</command></term>
  	    <listitem>
-@@ -6280,6 +6298,22 @@ options {
+@@ -6227,6 +6245,22 @@ options {
  	      </listitem>
  	    </varlistentry>
  
@@ -2113,31 +2113,34 @@ index bb1e81d..6dbbfad 100644
  	    <varlistentry>
  	      <term><command>nocookie-udp-size</command></term>
  	      <listitem>
-@@ -7501,14 +7535,20 @@ options {
+@@ -7448,13 +7482,19 @@ options {
  	      <term><command>resolver-query-timeout</command></term>
  	      <listitem>
  		<para>
--		  The amount of time in seconds that the resolver
-+		  The amount of time in milliseconds that the resolver
- 		  will spend attempting to resolve a recursive
- 		  query before failing.  The default and minimum
+-		  This is the amount of time in seconds that the
+-		  resolver spends attempting to resolve a recursive
+-		  query before failing.  The default and minimum
 -		  is <literal>10</literal> and the maximum is
 -		  <literal>30</literal>.  Setting it to
+-		  <literal>0</literal> results in the default
+-		  being used.
++		  The amount of time in milliseconds that the resolver
++ 		  will spend attempting to resolve a recursive
++ 		  query before failing.  The default and minimum
 +		  is <literal>10000</literal> and the maximum is
 +		  <literal>30000</literal>.  Setting it to
- 		  <literal>0</literal> will result in the default
- 		  being used.
- 		</para>
++ 		  <literal>0</literal> will result in the default
++ 		  being used.
++ 		</para>
 +		<para>
 +		  This value was originally specified in seconds.
 +		  Values less than or equal to 300 will be be treated
 +		  as seconds and converted to milliseconds before
 +		  applying the above limits.
-+		</para>
+ 		</para>
  	      </listitem>
  	    </varlistentry>
- 	  </variablelist>
-@@ -8994,6 +9034,27 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
+@@ -8928,6 +8968,27 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
  	      </listitem>
  	    </varlistentry>
  
@@ -2166,7 +2169,7 @@ index bb1e81d..6dbbfad 100644
  	      <term><command>min-roots</command></term>
  	      <listitem>
 diff --git a/doc/arm/logging-categories.xml b/doc/arm/logging-categories.xml
-index 181def7..59f6afb 100644
+index e41bd3b..2f505c8 100644
 --- a/doc/arm/logging-categories.xml
 +++ b/doc/arm/logging-categories.xml
 @@ -311,6 +311,17 @@
@@ -2869,7 +2872,7 @@ index 567e8a8..7bf2b60 100644
   * Functions.
   */
 diff --git a/lib/dns/include/dns/view.h b/lib/dns/include/dns/view.h
-index c849dec..647ca2a 100644
+index 09a9725..8e3b3cb 100644
 --- a/lib/dns/include/dns/view.h
 +++ b/lib/dns/include/dns/view.h
 @@ -229,6 +229,9 @@ struct dns_view {
@@ -2979,7 +2982,7 @@ index 13d1a3e..873b694 100644
  			RUNTIME_CHECK(result == ISC_R_SUCCESS);
  			isc_buffer_usedregion(&buffer, &r);
 diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
-index 02f2c84..fda991d 100644
+index baf7641..a8f4609 100644
 --- a/lib/dns/rbtdb.c
 +++ b/lib/dns/rbtdb.c
 @@ -490,6 +490,7 @@ typedef ISC_LIST(rdatasetheader_t)      rdatasetheaderlist_t;
@@ -3155,7 +3158,7 @@ index 02f2c84..fda991d 100644
  /*
   * Caller must be holding the node lock.
   */
-@@ -3313,6 +3406,12 @@ bind_rdataset(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
+@@ -3318,6 +3411,12 @@ bind_rdataset(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node, rdatasetheader_t *header,
  		rdataset->attributes |= DNS_RDATASETATTR_OPTOUT;
  	if (PREFETCH(header))
  		rdataset->attributes |= DNS_RDATASETATTR_PREFETCH;
@@ -3168,7 +3171,7 @@ index 02f2c84..fda991d 100644
  	rdataset->private1 = rbtdb;
  	rdataset->private2 = node;
  	raw = (unsigned char *)header + sizeof(*header);
-@@ -4653,6 +4752,19 @@ check_stale_header(dns_rbtnode_t *node, rdatasetheader_t *header,
+@@ -4674,6 +4773,19 @@ check_stale_header(dns_rbtnode_t *node, rdatasetheader_t *header,
  #endif
  
  	if (!ACTIVE(header, search->now)) {
@@ -3188,7 +3191,7 @@ index 02f2c84..fda991d 100644
  		/*
  		 * This rdataset is stale.  If no one else is using the
  		 * node, we can clean it up right now, otherwise we mark
-@@ -4692,7 +4804,7 @@ check_stale_header(dns_rbtnode_t *node, rdatasetheader_t *header,
+@@ -4713,7 +4825,7 @@ check_stale_header(dns_rbtnode_t *node, rdatasetheader_t *header,
  					node->data = header->next;
  				free_rdataset(search->rbtdb, mctx, header);
  			} else {
@@ -3197,7 +3200,7 @@ index 02f2c84..fda991d 100644
  				*header_prev = header;
  			}
  		} else
-@@ -5130,7 +5242,7 @@ cache_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
+@@ -5154,7 +5266,7 @@ cache_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
  				       &locktype, lock, &search,
  				       &header_prev)) {
  			/* Do nothing. */
@@ -3206,7 +3209,7 @@ index 02f2c84..fda991d 100644
  			/*
  			 * We now know that there is at least one active
  			 * non-stale rdataset at this node.
-@@ -5608,7 +5720,7 @@ expirenode(dns_db_t *db, dns_dbnode_t *node, isc_stdtime_t now) {
+@@ -5637,7 +5749,7 @@ expirenode(dns_db_t *db, dns_dbnode_t *node, isc_stdtime_t now) {
  			 * refcurrent(rbtnode) must be non-zero.  This is so
  			 * because 'node' is an argument to the function.
  			 */
@@ -3215,7 +3218,7 @@ index 02f2c84..fda991d 100644
  			if (log)
  				isc_log_write(dns_lctx, category, module,
  					      level, "overmem cache: stale %s",
-@@ -5616,7 +5728,7 @@ expirenode(dns_db_t *db, dns_dbnode_t *node, isc_stdtime_t now) {
+@@ -5645,7 +5757,7 @@ expirenode(dns_db_t *db, dns_dbnode_t *node, isc_stdtime_t now) {
  		} else if (force_expire) {
  			if (! RETAIN(header)) {
  				set_ttl(rbtdb, header, 0);
@@ -3224,7 +3227,7 @@ index 02f2c84..fda991d 100644
  			} else if (log) {
  				isc_log_write(dns_lctx, category, module,
  					      level, "overmem cache: "
-@@ -5873,9 +5985,9 @@ cache_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
+@@ -5904,9 +6016,9 @@ cache_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
  				 * non-zero.  This is so because 'node' is an
  				 * argument to the function.
  				 */
@@ -3236,7 +3239,7 @@ index 02f2c84..fda991d 100644
  			if (header->type == matchtype)
  				found = header;
  			else if (header->type == RBTDB_RDATATYPE_NCACHEANY ||
-@@ -6167,7 +6279,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+@@ -6206,7 +6318,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
  				     topheader = topheader->next)
  				{
  					set_ttl(rbtdb, topheader, 0);
@@ -3245,7 +3248,7 @@ index 02f2c84..fda991d 100644
  				}
  				goto find_header;
  			}
-@@ -6225,7 +6337,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+@@ -6267,7 +6379,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
  				 * ncache entry.
  				 */
  				set_ttl(rbtdb, topheader, 0);
@@ -3254,7 +3257,7 @@ index 02f2c84..fda991d 100644
  				topheader = NULL;
  				goto find_header;
  			}
-@@ -6263,8 +6375,11 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+@@ -6305,8 +6417,11 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
  		}
  
  		/*
@@ -3268,7 +3271,7 @@ index 02f2c84..fda991d 100644
  		 */
  		if (rbtversion == NULL && trust < header->trust &&
  		    (ACTIVE(header, now) || header_nx)) {
-@@ -6293,6 +6408,10 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+@@ -6336,6 +6451,10 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
  
  			if ((options & DNS_DBADD_EXACT) != 0)
  				flags |= DNS_RDATASLAB_EXACT;
@@ -3279,7 +3282,7 @@ index 02f2c84..fda991d 100644
  			if ((options & DNS_DBADD_EXACTTTL) != 0 &&
  			     newheader->rdh_ttl != header->rdh_ttl)
  					result = DNS_R_NOTEXACT;
-@@ -6336,11 +6455,12 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+@@ -6379,11 +6498,12 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
  			}
  		}
  		/*
@@ -3297,7 +3300,7 @@ index 02f2c84..fda991d 100644
  		 */
  		if (IS_CACHE(rbtdb) && ACTIVE(header, now) &&
  		    header->type == dns_rdatatype_ns &&
-@@ -6511,10 +6631,10 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+@@ -6556,10 +6676,10 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
  				changed->dirty = true;
  			if (rbtversion == NULL) {
  				set_ttl(rbtdb, header, 0);
@@ -3310,7 +3313,7 @@ index 02f2c84..fda991d 100644
  				}
  			}
  			if (rbtversion != NULL && !header_nx) {
-@@ -8331,6 +8451,30 @@ nodefullname(dns_db_t *db, dns_dbnode_t *node, dns_name_t *name) {
+@@ -8410,6 +8530,30 @@ nodefullname(dns_db_t *db, dns_dbnode_t *node, dns_name_t *name) {
  	return (result);
  }
  
@@ -3341,7 +3344,7 @@ index 02f2c84..fda991d 100644
  static dns_dbmethods_t zone_methods = {
  	attach,
  	detach,
-@@ -8376,7 +8520,9 @@ static dns_dbmethods_t zone_methods = {
+@@ -8455,7 +8599,9 @@ static dns_dbmethods_t zone_methods = {
  	NULL,
  	hashsize,
  	nodefullname,
@@ -3352,7 +3355,7 @@ index 02f2c84..fda991d 100644
  };
  
  static dns_dbmethods_t cache_methods = {
-@@ -8424,7 +8570,9 @@ static dns_dbmethods_t cache_methods = {
+@@ -8503,7 +8649,9 @@ static dns_dbmethods_t cache_methods = {
  	setcachestats,
  	hashsize,
  	nodefullname,
@@ -3363,7 +3366,7 @@ index 02f2c84..fda991d 100644
  };
  
  isc_result_t
-@@ -8695,7 +8843,7 @@ dns_rbtdb_create
+@@ -8774,7 +8922,7 @@ dns_rbtdb_create
  	rbtdb->rpzs = NULL;
  	rbtdb->load_rpzs = NULL;
  	rbtdb->rpz_num = DNS_RPZ_INVALID_NUM;
@@ -3372,7 +3375,7 @@ index 02f2c84..fda991d 100644
  	/*
  	 * Version Initialization.
  	 */
-@@ -9113,7 +9261,8 @@ rdatasetiter_first(dns_rdatasetiter_t *iterator) {
+@@ -9192,7 +9340,8 @@ rdatasetiter_first(dns_rdatasetiter_t *iterator) {
  				 * rdatasets to work.
  				 */
  				if (NONEXISTENT(header) ||
@@ -3382,7 +3385,7 @@ index 02f2c84..fda991d 100644
  					header = NULL;
  				break;
  			} else
-@@ -10322,7 +10471,7 @@ static inline bool
+@@ -10401,7 +10550,7 @@ static inline bool
  need_headerupdate(rdatasetheader_t *header, isc_stdtime_t now) {
  	if ((header->attributes &
  	     (RDATASET_ATTR_NONEXISTENT |
@@ -3391,7 +3394,7 @@ index 02f2c84..fda991d 100644
  	      RDATASET_ATTR_ZEROTTL)) != 0)
  		return (false);
  
-@@ -10428,7 +10577,7 @@ expire_header(dns_rbtdb_t *rbtdb, rdatasetheader_t *header,
+@@ -10507,7 +10656,7 @@ expire_header(dns_rbtdb_t *rbtdb, rdatasetheader_t *header,
  	      bool tree_locked, expire_t reason)
  {
  	set_ttl(rbtdb, header, 0);
@@ -3401,7 +3404,7 @@ index 02f2c84..fda991d 100644
  	/*
  	 * Caller must hold the node (write) lock.
 diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
-index 337a2f3..24e14d2 100644
+index f7f73cd..7a77bde 100644
 --- a/lib/dns/resolver.c
 +++ b/lib/dns/resolver.c
 @@ -141,16 +141,17 @@
@@ -3434,7 +3437,7 @@ index 337a2f3..24e14d2 100644
  #endif
  
  /* The default maximum number of recursions to follow before giving up. */
-@@ -515,6 +516,11 @@ struct dns_resolver {
+@@ -523,6 +524,11 @@ struct dns_resolver {
  	dns_fetch_t *			primefetch;
  	/* Locked by nlock. */
  	unsigned int			nfctx;
@@ -3446,7 +3449,7 @@ index 337a2f3..24e14d2 100644
  };
  
  #define RES_MAGIC			ISC_MAGIC('R', 'e', 's', '!')
-@@ -1625,14 +1631,12 @@ fctx_setretryinterval(fetchctx_t *fctx, unsigned int rtt) {
+@@ -1633,14 +1639,12 @@ fctx_setretryinterval(fetchctx_t *fctx, unsigned int rtt) {
  	unsigned int seconds;
  	unsigned int us;
  
@@ -3465,7 +3468,7 @@ index 337a2f3..24e14d2 100644
  
  	/*
  	 * Add a fudge factor to the expected rtt based on the current
-@@ -4494,7 +4498,8 @@ fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type,
+@@ -4518,7 +4522,8 @@ fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type,
  	/*
  	 * Compute an expiration time for the entire fetch.
  	 */
@@ -3475,7 +3478,7 @@ index 337a2f3..24e14d2 100644
  	iresult = isc_time_nowplusinterval(&fctx->expires, &interval);
  	if (iresult != ISC_R_SUCCESS) {
  		UNEXPECTED_ERROR(__FILE__, __LINE__,
-@@ -8983,6 +8988,8 @@ dns_resolver_create(dns_view_t *view,
+@@ -9005,6 +9010,8 @@ dns_resolver_create(dns_view_t *view,
  	res->spillattimer = NULL;
  	res->zspill = 0;
  	res->zero_no_soa_ttl = false;
@@ -3484,7 +3487,7 @@ index 337a2f3..24e14d2 100644
  	res->query_timeout = DEFAULT_QUERY_TIMEOUT;
  	res->maxdepth = DEFAULT_RECURSION_DEPTH;
  	res->maxqueries = DEFAULT_MAX_QUERIES;
-@@ -10317,17 +10324,20 @@ dns_resolver_gettimeout(dns_resolver_t *resolver) {
+@@ -10339,17 +10346,20 @@ dns_resolver_gettimeout(dns_resolver_t *resolver) {
  }
  
  void
@@ -3513,7 +3516,7 @@ index 337a2f3..24e14d2 100644
  }
  
  void
-@@ -10424,3 +10434,34 @@ dns_resolver_getquotaresponse(dns_resolver_t *resolver, dns_quotatype_t which)
+@@ -10446,3 +10456,34 @@ dns_resolver_getquotaresponse(dns_resolver_t *resolver, dns_quotatype_t which)
  
  	return (resolver->quotaresp[which]);
  }
@@ -3549,10 +3552,10 @@ index 337a2f3..24e14d2 100644
 +	resolver->nonbackofftries = tries;
 +}
 diff --git a/lib/dns/sdb.c b/lib/dns/sdb.c
-index d4c8c67..ee9be79 100644
+index 8afaa52..b370e05 100644
 --- a/lib/dns/sdb.c
 +++ b/lib/dns/sdb.c
-@@ -1368,7 +1368,9 @@ static dns_dbmethods_t sdb_methods = {
+@@ -1370,7 +1370,9 @@ static dns_dbmethods_t sdb_methods = {
  	NULL,			/* setcachestats */
  	NULL,			/* hashsize */
  	NULL,			/* nodefullname */
@@ -3855,5 +3858,5 @@ index 91693b5..5771774 100644
  	{ "topology", &cfg_type_bracketed_aml, CFG_CLAUSEFLAG_NOTIMP },
  	{ "transfer-format", &cfg_type_transferformat, 0 },
 -- 
-2.21.1
+2.26.2
 
diff --git a/bind.spec b/bind.spec
index bb7cb0e..e7f19ab 100644
--- a/bind.spec
+++ b/bind.spec
@@ -60,15 +60,15 @@
 
 # lib*.so.X versions of selected libraries
 %global sover_dns 1110
-%global sover_isc 1105
+%global sover_isc 1107
 %global sover_irs 161
 %global sover_isccfg 163
 
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.11.21
-Release:  3%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Version:  9.11.22
+Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1641,6 +1641,9 @@ fi;
 %endif
 
 %changelog
+* Thu Aug 20 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.22-1
+- Update to 9.11.22
+
 * Sat Aug 01 2020 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.11.21-3
 - Second attempt - Rebuilt for
   https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
diff --git a/sources b/sources
index be00cf2..51de436 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.11.21.tar.gz) = d807c6fdc2ab46f14f0f72db2d991166e7fe1d37b6f458256b4e25de1fd5c5291c2338e407733388e0fa49da447941db1323a1b6fead813134101d2d5c331064
-SHA512 (bind-9.11.21.tar.gz.asc) = 172c7c21f6f17f7e8c421b8f09f4da6bf907ce39c5da564d0f731fd262e265cb26b0f95c907d473cc17ff8c0b2f37d32df8371dd7d0992ca3633b557f325502a
+SHA512 (bind-9.11.22.tar.gz) = 8ed2ed661b87705bbb7ddde3076a132b4e53971d669600997abfa104404e0c8b4bf04cc04c6be1c2c701123db5e0d4645ab797e5a985a18f5a1d68824a3df3ed
+SHA512 (bind-9.11.22.tar.gz.asc) = 009c2035f8ed992771b863369f480575e91b2dbaad50fbfd5322cd8761bf4dced0870c448375ad746271717b6847012a2ba5f9dcc862f63c05ff6b1fcd77885f

From cb3f3691e4e57763929c2b9f5ffdd04280e5a29d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Sat, 22 Aug 2020 11:44:09 +0200
Subject: [PATCH 175/460] Update to 9.16.6

Release notes:
https://downloads.isc.org/isc/bind9/9.16.6/doc/arm/html/notes.html#notes-for-bind-9-16-6
---
 .gitignore | 2 ++
 bind.spec  | 7 +++++--
 sources    | 4 ++--
 3 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/.gitignore b/.gitignore
index 75cbcdf..c4326f3 100644
--- a/.gitignore
+++ b/.gitignore
@@ -111,3 +111,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.16.4.tar.xz.asc
 /bind-9.16.5.tar.xz
 /bind-9.16.5.tar.xz.asc
+/bind-9.16.6.tar.xz
+/bind-9.16.6.tar.xz.asc
diff --git a/bind.spec b/bind.spec
index 247116b..0f31225 100644
--- a/bind.spec
+++ b/bind.spec
@@ -57,7 +57,7 @@
 
 # lib*.so.X versions of selected libraries
 %global sover_dns 1605
-%global sover_isc 1605
+%global sover_isc 1606
 %global sover_irs 1601
 %global sover_isccfg 1600
 %global sover_ns 1604
@@ -66,7 +66,7 @@
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.16.5
+Version:  9.16.6
 Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
@@ -1209,6 +1209,9 @@ fi;
 %endif
 
 %changelog
+* Sat Aug 22 2020 Petr Menšík <pemensik@redhat.com> - 32:9.16.6-1
+- Update to 9.16.6
+
 * Wed Jul 15 2020 Petr Menšík <pemensik@redhat.com> - 32:9.16.5-1
 - Update to 9.16.5
 
diff --git a/sources b/sources
index fd7066c..7cbeac0 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.16.5.tar.xz) = 789fc19f60e81f67ef13ebacd030ea5d8f8cc42cf5f06a01ee2eefe9b7c6d3b10603a3a6a3df85b0e5d770fcf462ce8dddc3a7e5f7f2dab27aa5879ee5380eb7
-SHA512 (bind-9.16.5.tar.xz.asc) = 264d0e7de24e2d549f4eb6f368c55afd04aea2136416dbf131a47adcf99bae5e440245124469976f311bf752d5e9d3b7652d41d1d4b6d5fb67ed7cd86f3aaf27
+SHA512 (bind-9.16.6.tar.xz) = 37f57db6d1633cc85a4d954a69bbb3372c65ac43fef965df5aee8dcdd32153bb5b0c6d0d5f00f353dd4464c71d74dc8e801937b930e2b8f6799fa77af5f243e0
+SHA512 (bind-9.16.6.tar.xz.asc) = 519f264f9f2f9f78c3a972aca72d4843328294cb0785d19199a61d6d922ba1dfe30fd80187fcb4e42db177692826158f53ddf8b9333fcb1239b6c78b88491229

From 04a7c5632c73190bfcc6e52564c94aef349ad943 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 26 Aug 2020 12:10:38 +0200
Subject: [PATCH 176/460] Do not use home for pdf build files

texlive stores some files in $HOME directory. Redirect those files to
build directory, where it belongs. Do not touch anything user has.
---
 bind.spec | 1 +
 1 file changed, 1 insertion(+)

diff --git a/bind.spec b/bind.spec
index 0f31225..57b8c4a 100644
--- a/bind.spec
+++ b/bind.spec
@@ -521,6 +521,7 @@ cp -frp contrib/dlz/modules build/contrib/dlz/modules
 pushd build
 LIBDIR_SUFFIX=
 export LIBDIR_SUFFIX
+export TEXMFVAR="`pwd`" # avoid using home for pdf latex files
 %configure \
   --with-python=%{__python3} \
   --with-libtool \

From 7d8ad626e701528f401802181a56c05a5ace64f8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 26 Aug 2020 12:44:44 +0200
Subject: [PATCH 177/460] Use fmtutil to generate local settings

COPR is missing fmtutil configuration. Try generating it.
---
 bind.spec | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/bind.spec b/bind.spec
index 57b8c4a..a159174 100644
--- a/bind.spec
+++ b/bind.spec
@@ -521,7 +521,6 @@ cp -frp contrib/dlz/modules build/contrib/dlz/modules
 pushd build
 LIBDIR_SUFFIX=
 export LIBDIR_SUFFIX
-export TEXMFVAR="`pwd`" # avoid using home for pdf latex files
 %configure \
   --with-python=%{__python3} \
   --with-libtool \
@@ -579,7 +578,15 @@ export TEXMFVAR="`pwd`" # avoid using home for pdf latex files
 %endif
   popd
 %endif
-make %{?_smp_mflags}
+
+%if %{with DOC}
+# avoid using home for pdf latex files
+export TEXMFVAR="`pwd`"
+export TEXMFCONFIG="`pwd`"
+fmtutil --missing -user
+%endif
+
+%make_build
 
 ### FIXME hack!!!
 ### xsltproc doesn't find properly configured files
@@ -699,7 +706,7 @@ touch ${RPM_BUILD_ROOT}/%{chroot_prefix}%{_sysconfdir}/named.conf
 #end chroot
 
 pushd build
-make DESTDIR=${RPM_BUILD_ROOT} install
+%make_install
 popd
 
 # Remove unwanted files

From 823e9d22cf58fec4e5c541d4643be00000b193f0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 26 Aug 2020 16:48:02 +0200
Subject: [PATCH 178/460] List latex configuration before make

---
 bind.spec | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index a159174..69f065b 100644
--- a/bind.spec
+++ b/bind.spec
@@ -583,7 +583,8 @@ export LIBDIR_SUFFIX
 # avoid using home for pdf latex files
 export TEXMFVAR="`pwd`"
 export TEXMFCONFIG="`pwd`"
-fmtutil --missing -user
+fmtutil-user --listcfg
+fmtutil-user --missing
 %endif
 
 %make_build

From bd765f0cce22e9b8fc188b5d7b02ab2661125027 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 28 Aug 2020 11:15:29 +0200
Subject: [PATCH 179/460] Ignore fmtutil command status

It is not important for the build, just inform about latex tools.
---
 bind.spec | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/bind.spec b/bind.spec
index 69f065b..ff412e9 100644
--- a/bind.spec
+++ b/bind.spec
@@ -583,8 +583,8 @@ export LIBDIR_SUFFIX
 # avoid using home for pdf latex files
 export TEXMFVAR="`pwd`"
 export TEXMFCONFIG="`pwd`"
-fmtutil-user --listcfg
-fmtutil-user --missing
+fmtutil-user --listcfg || :
+fmtutil-user --missing || :
 %endif
 
 %make_build

From 7be72b675e82972952e67ed1896aaba995d1bb28 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 31 Aug 2020 13:32:11 +0200
Subject: [PATCH 180/460] Disable PDF regeneration

Because pending issues with PDF regeneration, disable PDF for now.
Allow turning it on with --with DOCPDF.

It prevents building successfully on Rawhide/f33 for some reason.
---
 bind.spec | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/bind.spec b/bind.spec
index ff412e9..cd58c9c 100644
--- a/bind.spec
+++ b/bind.spec
@@ -32,6 +32,8 @@
 %bcond_with    LMDB
 %bcond_with    DOC
 %endif
+# Because of issues with PDF rebuild, include only HTML pages
+%bcond_with    DOCPDF
 %bcond_with    TSAN
 
 %{?!bind_uid:  %global bind_uid  25}
@@ -193,9 +195,12 @@ BuildRequires:  fstrm-devel protobuf-c-devel
 # Needed to regenerate dig.1 manpage
 %if %{with DOC}
 BuildRequires:  python3-sphinx python3-sphinx_rtd_theme
-BuildRequires:  python3-sphinx-latex latexmk texlive-xetex texlive-xindy
 BuildRequires:  doxygen
 %endif
+%if %{with DOCPDF}
+# Because remaining issues with COPR, allow turning off PDF (re)generation
+BuildRequires:  python3-sphinx-latex latexmk texlive-xetex texlive-xindy
+%endif
 %if %{with TSAN}
 BuildRequires: libtsan
 %endif
@@ -579,7 +584,7 @@ export LIBDIR_SUFFIX
   popd
 %endif
 
-%if %{with DOC}
+%if %{with DOCPDF}
 # avoid using home for pdf latex files
 export TEXMFVAR="`pwd`"
 export TEXMFCONFIG="`pwd`"
@@ -812,10 +817,13 @@ popd
 
 %if %{with DOC}
 mkdir -p ${RPM_BUILD_ROOT}%{_pkgdocdir}/html/man
-cp -a build/doc/arm/{Bv9ARM.pdf,_build/html} ${RPM_BUILD_ROOT}%{_pkgdocdir}
+cp -a build/doc/arm/_build/html ${RPM_BUILD_ROOT}%{_pkgdocdir}
 cp -a build/doc/man/_build/html ${RPM_BUILD_ROOT}%{_pkgdocdir}/html
 rm -rf ${RPM_BUILD_ROOT}%{_pkgdocdir}/html/.{buildinfo,doctrees}
 %endif
+%if %{with DOCPDF}
+cp -a build/doc/arm/Bv9ARM.pdf ${RPM_BUILD_ROOT}%{_pkgdocdir}
+%endif
 
 # Ghost config files:
 touch ${RPM_BUILD_ROOT}%{_localstatedir}/log/named.log
@@ -1214,6 +1222,8 @@ fi;
 %files doc
 %dir %{_pkgdocdir}
 %doc %{_pkgdocdir}/html
+%endif
+%if %{with DOCPDF}
 %doc %{_pkgdocdir}/Bv9ARM.pdf
 %endif
 

From 1667a58d2a43d56c091c8c8ee99f2be06b5bc4a4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 31 Aug 2020 14:55:06 +0200
Subject: [PATCH 181/460] Generate html man pages into man subdirectory

---
 bind.spec | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/bind.spec b/bind.spec
index cd58c9c..81552cf 100644
--- a/bind.spec
+++ b/bind.spec
@@ -816,10 +816,10 @@ ln -s named-checkzone.8.gz named-compilezone.8.gz
 popd
 
 %if %{with DOC}
-mkdir -p ${RPM_BUILD_ROOT}%{_pkgdocdir}/html/man
+mkdir -p ${RPM_BUILD_ROOT}%{_pkgdocdir}
 cp -a build/doc/arm/_build/html ${RPM_BUILD_ROOT}%{_pkgdocdir}
-cp -a build/doc/man/_build/html ${RPM_BUILD_ROOT}%{_pkgdocdir}/html
-rm -rf ${RPM_BUILD_ROOT}%{_pkgdocdir}/html/.{buildinfo,doctrees}
+cp -a build/doc/man/_build/html ${RPM_BUILD_ROOT}%{_pkgdocdir}/html/man
+rm -rf ${RPM_BUILD_ROOT}%{_pkgdocdir}/html{,/man}/.{buildinfo,doctrees}
 %endif
 %if %{with DOCPDF}
 cp -a build/doc/arm/Bv9ARM.pdf ${RPM_BUILD_ROOT}%{_pkgdocdir}

From 89421c0410ecbd485cfbe05cd1945a56bf529904 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 31 Aug 2020 14:57:43 +0200
Subject: [PATCH 182/460] Remove lwres remains

---
 bind.spec | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/bind.spec b/bind.spec
index 81552cf..4a92ce9 100644
--- a/bind.spec
+++ b/bind.spec
@@ -780,10 +780,9 @@ popd
 find ${RPM_BUILD_ROOT}/%{_libdir} -name '*.la' -exec '/bin/rm' '-f' '{}' ';';
 
 # Remove -devel files out of buildroot if not needed
-%if !%{with DEVEL}
-rm -f ${RPM_BUILD_ROOT}/%{_libdir}/bind9/*so
+%if %{without DEVEL}
+rm -f ${RPM_BUILD_ROOT}/%{_libdir}/bind9/*.so
 rm -rf ${RPM_BUILD_ROOT}/%{_includedir}/bind9
-rm -f ${RPM_BUILD_ROOT}/%{_mandir}/man3/lwres*
 %endif
 
 # PKCS11 versions manpages

From e761bce6ce10b901eec6a1b9a3763bdaf96e9808 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 4 Sep 2020 12:38:57 +0200
Subject: [PATCH 183/460] Require libcap-devel from devel package

isc-config.sh --libs isc requires libcap devel, even when it is not
required by any headers. Make sure it is present.
---
 bind.spec | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index e7f19ab..435a3e3 100644
--- a/bind.spec
+++ b/bind.spec
@@ -68,7 +68,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.11.22
-Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -394,6 +394,8 @@ required for development with ISC BIND 9
 Summary:  Lite version of header files and libraries needed for BIND DNS development
 Requires: bind-libs-lite%{?_isa} = %{epoch}:%{version}-%{release}
 Requires: openssl-devel%{?_isa} libxml2-devel%{?_isa}
+# Not required by headers, but "isc-config.sh --libs isc" requires it
+Requires: libcap-devel%{?_isa}
 %if %{with GSSTSIG}
 Requires: krb5-devel%{?_isa}
 %endif
@@ -1641,6 +1643,9 @@ fi;
 %endif
 
 %changelog
+* Tue Sep 01 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.22-2
+- Require libcap from devel package
+
 * Thu Aug 20 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.22-1
 - Update to 9.11.22
 

From ef5c71f941ef1d4e0388112c3debb34db2ee0e5f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 14 Sep 2020 17:08:06 +0200
Subject: [PATCH 184/460] Share static data in doc package

Fonts add unnecessary size to doc package. Instead of local copy, link
to theme package static directory and reuse data already installed.
---
 bind.spec | 20 +++++++++++++++++---
 1 file changed, 17 insertions(+), 3 deletions(-)

diff --git a/bind.spec b/bind.spec
index 4a92ce9..205b723 100644
--- a/bind.spec
+++ b/bind.spec
@@ -69,7 +69,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.16.6
-Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -428,6 +428,7 @@ This package provides a module which allows commands to be sent to rndc directly
 %package doc
 Summary:   Documentation for BIND
 Requires:  bind-license = %{epoch}:%{version}-%{release}
+Requires:  python3-sphinx_rtd_theme
 BuildArch: noarch
 
 %description doc
@@ -817,8 +818,18 @@ popd
 %if %{with DOC}
 mkdir -p ${RPM_BUILD_ROOT}%{_pkgdocdir}
 cp -a build/doc/arm/_build/html ${RPM_BUILD_ROOT}%{_pkgdocdir}
-cp -a build/doc/man/_build/html ${RPM_BUILD_ROOT}%{_pkgdocdir}/html/man
-rm -rf ${RPM_BUILD_ROOT}%{_pkgdocdir}/html{,/man}/.{buildinfo,doctrees}
+rm -rf ${RPM_BUILD_ROOT}%{_pkgdocdir}/html/.{buildinfo,doctrees}
+# Share static data from original sphinx package
+THEMEDIR=$(rpm -ql python3-sphinx_rtd_theme | grep 'sphinx_rtd_theme/static$')
+for DIR in "$THEMEDIR"/*
+do
+  BASE=$(basename -- "$DIR")
+  BINDTHEMEDIR="${RPM_BUILD_ROOT}%{_pkgdocdir}/html/_static/$BASE"
+  if [ -d "$BINDTHEMEDIR" ]; then
+    rm -rf "$BINDTHEMEDIR"
+    ln -s "$DIR" "$BINDTHEMEDIR"
+  fi
+done
 %endif
 %if %{with DOCPDF}
 cp -a build/doc/arm/Bv9ARM.pdf ${RPM_BUILD_ROOT}%{_pkgdocdir}
@@ -1227,6 +1238,9 @@ fi;
 %endif
 
 %changelog
+* Mon Sep 14 2020 Petr Menšík <pemensik@redhat.com> - 32:9.16.6-2
+- Share static data in doc package
+
 * Sat Aug 22 2020 Petr Menšík <pemensik@redhat.com> - 32:9.16.6-1
 - Update to 9.16.6
 

From e1be70d96ec420bf83a3221009e9d980e1e14c79 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 14 Sep 2020 21:17:32 +0200
Subject: [PATCH 185/460] Disable SDB remains and build only DLZ modules

DLZ modules turned built-in support into named, just like former
named-sdb package had. That was non-intentional and is disabled now.
Instead, build only dynamically loaded modules with support for various
database access.
---
 bind.spec | 55 +++++--------------------------------------------------
 1 file changed, 5 insertions(+), 50 deletions(-)

diff --git a/bind.spec b/bind.spec
index 205b723..768ef33 100644
--- a/bind.spec
+++ b/bind.spec
@@ -16,8 +16,6 @@
 %bcond_without PKCS11
 %bcond_without DEVEL
 %bcond_without JSON
-%bcond_with    BDB
-# skip DLZ for now
 %bcond_without DLZ
 # New MaxMind GeoLite support
 %bcond_without GEOIP2
@@ -161,9 +159,6 @@ BuildRequires:  libuv-devel
 %if %{with DLZ}
 BuildRequires:  openldap-devel, libpq-devel, sqlite-devel, mariadb-connector-c-devel
 %endif
-%if %{with BDB}
-BuildRequires:  libdb-devel
-%endif
 %if %{with UNITTEST}
 # make unit dependencies
 BuildRequires:  libcmocka-devel kyua
@@ -364,18 +359,6 @@ Based on the code from Jan "Yenya" Kasprzak <kas@fi.muni.cz>
 
 
 %if %{with DLZ}
-%if %{with BDB}
-%package dlz-bdb
-Summary: BIND server bdb DLZ module
-Requires: bind%{?_isa} = %{epoch}:%{version}-%{release}
-
-%description dlz-bdb
-Dynamic Loadable Zones Berkeley DB module for BIND server.
-
-%end
-
-%endif
-
 %package dlz-filesystem
 Summary: BIND server filesystem DLZ module
 Requires: bind%{?_isa} = %{epoch}:%{version}-%{release}
@@ -544,15 +527,6 @@ export LIBDIR_SUFFIX
   --with-pkcs11=%{_libdir}/pkcs11/libsofthsm2.so \
 %endif
   --with-dlopen=yes \
-%if %{with DLZ}
-  --with-dlz-ldap=yes \
-  --with-dlz-postgres=yes \
-  --with-dlz-mysql=yes \
-  --with-dlz-filesystem=yes \
-%endif
-%if %{with BDB}
-  --with-dlz-bdb=yes \
-%endif
 %if %{with GSSTSIG}
   --with-gssapi=yes \
   --disable-isc-spnego \
@@ -617,18 +591,15 @@ popd
 %if %{with DLZ}
   pushd contrib/dlz
   pushd modules
+  for DIR in mysql mysqldyn; do
+    sed -e 's/@DLZ_DRIVER_MYSQL_INCLUDES@/$(shell mysql_config --cflags)/' \
+        -e 's/@DLZ_DRIVER_MYSQL_LIBS@/$(shell mysql_config --libs)/' \
+        $DIR/Makefile.in > $DIR/Makefile
+  done
   for DIR in filesystem ldap mysql mysqldyn sqlite3; do
     make -C $DIR CFLAGS="-fPIC -I../include $CFLAGS $LDFLAGS"
   done
   popd
-  %if %{with BDB}
-    pushd bin/dlzbdb
-      make
-    popd
-    pushd modules
-      make -C bdbhpt CFLAGS="-fPIC -I../include $CFLAGS $LDFLAGS"
-    popd
-  %endif
   popd
 %endif
 popd # build
@@ -756,15 +727,7 @@ install -m 644 %{SOURCE49} ${RPM_BUILD_ROOT}%{_sysconfdir}/named-chroot.files
     make -C $DIR DESTDIR=${RPM_BUILD_ROOT} libdir=%{_libdir}/bind install
   done
   mv mysqldyn/testing/README mysqldyn/testing/README.testing
-  %if %{with BDB}
-    make -C bdbhpt DESTDIR=${RPM_BUILD_ROOT} libdir=%{_libdir}/bind install
-  %endif
   popd
-  %if %{with BDB}
-    pushd bin/dlzbdb
-      make DESTDIR=${RPM_BUILD_ROOT} install
-    popd
-  %endif
   popd
   popd
 %endif
@@ -1193,14 +1156,6 @@ fi;
 %{_libdir}/libns-pkcs11.so
 %endif
 
-%if %{with DLZ} && %{with BDB}
-%files dlz-bdb
-%{_libdir}/bind/dlz_bdbhpt_dynamic.so
-%doc contrib/dlz/modules/bdbhpt/testing/*
-%doc contrib/dlz/modules/bdbhpt/README*
-
-%endif
-
 %if %{with DLZ}
 %files dlz-filesystem
 %{_libdir}/bind/dlz_filesystem_dynamic.so

From 1799c36d2300037d91634c11e85d0934ffaa3868 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 15 Sep 2020 17:51:50 +0200
Subject: [PATCH 186/460] Merge bind-lite-devel into bind-devel

Those packages were very similar in BIND 9.11. Since there is no
isc-config.sh, no significant or required reason to have them separated
exist. Keep separated libraries, but only one devel package.
---
 bind.spec | 36 +++++++++++++++---------------------
 1 file changed, 15 insertions(+), 21 deletions(-)

diff --git a/bind.spec b/bind.spec
index 768ef33..4a55578 100644
--- a/bind.spec
+++ b/bind.spec
@@ -67,7 +67,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.16.6
-Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  3%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -244,7 +244,7 @@ functionality.
 %package pkcs11-devel
 Summary: Development files for Bind libraries compiled with native PKCS#11
 Requires: bind-pkcs11-libs%{?_isa} = %{epoch}:%{version}-%{release}
-Requires: bind-lite-devel%{?_isa} = %{epoch}:%{version}-%{release}
+Requires: bind-devel%{?_isa} = %{epoch}:%{version}-%{release}
 
 %description pkcs11-devel
 This a set of development files for BIND libraries (dns, isc) compiled
@@ -314,15 +314,7 @@ Summary:  Header files and libraries needed for BIND DNS development
 Obsoletes:bind-libbind-devel < 31:9.3.3-4.fc7
 Provides: bind-libbind-devel = 31:9.3.3-4.fc7
 Requires: bind-libs%{?_isa} = %{epoch}:%{version}-%{release}
-Requires: bind-lite-devel%{?_isa} = %{epoch}:%{version}-%{release}
-
-%description devel
-The bind-devel package contains full version of the header files and libraries
-required for development with ISC BIND 9
-%endif
-
-%package lite-devel
-Summary:  Lite version of header files and libraries needed for BIND DNS development
+Provides: bind-lite-devel%{?_isa} = %{epoch}:%{version}-%{release}
 Requires: bind-libs-lite%{?_isa} = %{epoch}:%{version}-%{release}
 Requires: openssl-devel%{?_isa} libxml2-devel%{?_isa}
 %if %{with GSSTSIG}
@@ -341,9 +333,10 @@ Requires:  fstrm-devel%{?_isa} protobuf-c-devel%{?_isa}
 Requires:  libmaxminddb-devel%{?_isa}
 %endif
 
-%description lite-devel
-The bind-lite-devel package contains lite version of the header
-files and libraries required for development with ISC BIND 9
+%description devel
+The bind-devel package contains full version of the header files and libraries
+required for development with ISC BIND 9
+%endif
 
 %package chroot
 Summary:        A chroot runtime environment for the ISC BIND DNS server, named(8)
@@ -1069,18 +1062,15 @@ fi;
 %{_libdir}/libbind9.so
 %{_libdir}/libisccc.so
 %{_libdir}/libns.so
-%{_includedir}/bind9/config.h
-%{_includedir}/bind9/bind9
-%{_includedir}/bind9/isccc
-%{_includedir}/bind9/ns
-%endif
-
-%files lite-devel
 %{_libdir}/libdns.so
 %{_libdir}/libirs.so
 %{_libdir}/libisc.so
 %{_libdir}/libisccfg.so
 %dir %{_includedir}/bind9
+%{_includedir}/bind9/config.h
+%{_includedir}/bind9/bind9
+%{_includedir}/bind9/isccc
+%{_includedir}/bind9/ns
 %{_includedir}/bind9/dns
 %{_includedir}/bind9/dst
 %{_includedir}/bind9/irs
@@ -1088,6 +1078,7 @@ fi;
 %dir %{_includedir}/bind9/pk11
 %{_includedir}/bind9/pk11/site.h
 %{_includedir}/bind9/isccfg
+%endif
 
 %files chroot
 %config(noreplace) %{_sysconfdir}/named-chroot.files
@@ -1193,6 +1184,9 @@ fi;
 %endif
 
 %changelog
+* Tue Sep 15 2020 Petr Menšík <pemensik@redhat.com> - 32:9.16.6-3
+- Merge bind-lite-devel into devel package
+
 * Mon Sep 14 2020 Petr Menšík <pemensik@redhat.com> - 32:9.16.6-2
 - Share static data in doc package
 

From 8a73c57ad49fb896be5ddab9e340a882620e0161 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 15 Sep 2020 17:55:01 +0200
Subject: [PATCH 187/460] Remove DEVEL conditional define

I find no reason to turn off devel package creation. It can be ignored
if required, but is mandatory due to Fedora packaging guidelines.
Simplify it a bit.
---
 bind.spec | 11 -----------
 1 file changed, 11 deletions(-)

diff --git a/bind.spec b/bind.spec
index 4a55578..0dab73c 100644
--- a/bind.spec
+++ b/bind.spec
@@ -14,7 +14,6 @@
 # it is not possible to build the package without PKCS11 sub-package
 # due to extensive changes to Makefiles
 %bcond_without PKCS11
-%bcond_without DEVEL
 %bcond_without JSON
 %bcond_without DLZ
 # New MaxMind GeoLite support
@@ -308,7 +307,6 @@ revocation and verification of keys and DNSSEC signatures in zone files.
 You should install bind-dnssec-utils if you need to sign a DNS zone
 or maintain keys for it.
 
-%if %{with DEVEL}
 %package devel
 Summary:  Header files and libraries needed for BIND DNS development
 Obsoletes:bind-libbind-devel < 31:9.3.3-4.fc7
@@ -331,7 +329,6 @@ Requires:  fstrm-devel%{?_isa} protobuf-c-devel%{?_isa}
 %endif
 %if %{with GEOIP2}
 Requires:  libmaxminddb-devel%{?_isa}
-%endif
 
 %description devel
 The bind-devel package contains full version of the header files and libraries
@@ -736,12 +733,6 @@ popd
 # Remove libtool .la files:
 find ${RPM_BUILD_ROOT}/%{_libdir} -name '*.la' -exec '/bin/rm' '-f' '{}' ';';
 
-# Remove -devel files out of buildroot if not needed
-%if %{without DEVEL}
-rm -f ${RPM_BUILD_ROOT}/%{_libdir}/bind9/*.so
-rm -rf ${RPM_BUILD_ROOT}/%{_includedir}/bind9
-%endif
-
 # PKCS11 versions manpages
 %if %{with PKCS11}
 pushd ${RPM_BUILD_ROOT}%{_mandir}/man8
@@ -1057,7 +1048,6 @@ fi;
 %exclude %{_mandir}/man8/dnssec*-pkcs11.8*
 %endif
 
-%if %{with DEVEL}
 %files devel
 %{_libdir}/libbind9.so
 %{_libdir}/libisccc.so
@@ -1078,7 +1068,6 @@ fi;
 %dir %{_includedir}/bind9/pk11
 %{_includedir}/bind9/pk11/site.h
 %{_includedir}/bind9/isccfg
-%endif
 
 %files chroot
 %config(noreplace) %{_sysconfdir}/named-chroot.files

From f290ef8ed65b3a772ae1a7eb293c135c784f204b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 15 Sep 2020 18:06:30 +0200
Subject: [PATCH 188/460] Move DLZ modules out of bind base package

All DLZ modules were installed by mistake in main bind package.
Remove them from there, they should be offered only by each dlz
subpackage.

Move modules to upstream used directory %{_libdir}/named.
---
 bind.spec | 16 +++++++---------
 1 file changed, 7 insertions(+), 9 deletions(-)

diff --git a/bind.spec b/bind.spec
index 0dab73c..1ddeb0a 100644
--- a/bind.spec
+++ b/bind.spec
@@ -579,8 +579,7 @@ popd
 %endif
 
 %if %{with DLZ}
-  pushd contrib/dlz
-  pushd modules
+  pushd contrib/dlz/modules
   for DIR in mysql mysqldyn; do
     sed -e 's/@DLZ_DRIVER_MYSQL_INCLUDES@/$(shell mysql_config --cflags)/' \
         -e 's/@DLZ_DRIVER_MYSQL_LIBS@/$(shell mysql_config --libs)/' \
@@ -590,7 +589,6 @@ popd
     make -C $DIR CFLAGS="-fPIC -I../include $CFLAGS $LDFLAGS"
   done
   popd
-  popd
 %endif
 popd # build
 
@@ -711,15 +709,13 @@ install -m 644 %{SOURCE49} ${RPM_BUILD_ROOT}%{_sysconfdir}/named-chroot.files
 
 %if %{with DLZ}
   pushd build
-  pushd contrib/dlz
-  pushd modules
+  pushd contrib/dlz/modules
   for DIR in filesystem ldap mysql mysqldyn sqlite3; do
-    make -C $DIR DESTDIR=${RPM_BUILD_ROOT} libdir=%{_libdir}/bind install
+    make -C $DIR DESTDIR=${RPM_BUILD_ROOT} libdir=%{_libdir}/named install
   done
   mv mysqldyn/testing/README mysqldyn/testing/README.testing
   popd
   popd
-  popd
 %endif
 
 # Install isc/errno2result.h header
@@ -938,8 +934,10 @@ fi;
 
 %files
 # TODO: Move from lib/bind to lib/named, as used by upstream
-%{_libdir}/bind
-%{_libdir}/named
+%dir %{_libdir}/bind
+%dir %{_libdir}/named
+%{_libdir}/named/*.so
+%exclude %{_libdir}/named/dlz_*.so
 %config(noreplace) %verify(not md5 size mtime) %{_sysconfdir}/sysconfig/named
 %config(noreplace) %attr(0644,root,named) %{_sysconfdir}/named.root.key
 %{_tmpfilesdir}/named.conf

From bd20caa99a248d8f44be17c5828cc36347ab6416 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 15 Sep 2020 18:22:27 +0200
Subject: [PATCH 189/460] Move plugins to upstream default directory

Keep backward-compatible links from old directory. Any original
configuration should keep running like before.
---
 bind.spec          | 17 ++++++++++-------
 named-chroot.files |  2 ++
 2 files changed, 12 insertions(+), 7 deletions(-)

diff --git a/bind.spec b/bind.spec
index 1ddeb0a..96c852d 100644
--- a/bind.spec
+++ b/bind.spec
@@ -40,7 +40,7 @@
 %global        chroot_prefix     %{bind_dir}/chroot
 %global        chroot_create_directories /dev /run/named %{_localstatedir}/{log,named,tmp} \\\
                                          %{_sysconfdir}/{crypto-policies/back-ends,pki/dnssec-keys,named} \\\
-                                         %{_libdir}/bind %{_datadir}/GeoIP
+                                         %{_libdir}/bind %{_libdir}/named %{_datadir}/GeoIP
 
 %global        selinuxbooleans   named_write_master_zones=1
 ## The order of libs is important. See lib/Makefile.in for details
@@ -650,7 +650,7 @@ fi
 %install
 # Build directory hierarchy
 mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/logrotate.d
-mkdir -p ${RPM_BUILD_ROOT}%{_libdir}/bind
+mkdir -p ${RPM_BUILD_ROOT}%{_libdir}/{bind,named}
 mkdir -p ${RPM_BUILD_ROOT}%{_localstatedir}/named/{slaves,data,dynamic}
 mkdir -p ${RPM_BUILD_ROOT}%{_mandir}/{man1,man5,man8}
 mkdir -p ${RPM_BUILD_ROOT}/run/named
@@ -713,6 +713,9 @@ install -m 644 %{SOURCE49} ${RPM_BUILD_ROOT}%{_sysconfdir}/named-chroot.files
   for DIR in filesystem ldap mysql mysqldyn sqlite3; do
     make -C $DIR DESTDIR=${RPM_BUILD_ROOT} libdir=%{_libdir}/named install
   done
+  pushd ${RPM_BUILD_ROOT}/%{_libdir}/bind
+    cp -s ../named/dlz_*.so .
+  popd
   mv mysqldyn/testing/README mysqldyn/testing/README.testing
   popd
   popd
@@ -1136,23 +1139,23 @@ fi;
 
 %if %{with DLZ}
 %files dlz-filesystem
-%{_libdir}/bind/dlz_filesystem_dynamic.so
+%{_libdir}/{named,bind}/dlz_filesystem_dynamic.so
 
 %files dlz-mysql
-%{_libdir}/bind/dlz_mysql_dynamic.so
+%{_libdir}/{named,bind}/dlz_mysql_dynamic.so
 %doc contrib/dlz/modules/mysql/testing/*
 
 %files dlz-mysqldyn
-%{_libdir}/bind/dlz_mysqldyn_mod.so
+%{_libdir}/{named,bind}/dlz_mysqldyn_mod.so
 %doc contrib/dlz/modules/mysqldyn/testing/*
 %doc contrib/dlz/modules/mysqldyn/README*
 
 %files dlz-ldap
-%{_libdir}/bind/dlz_ldap_dynamic.so
+%{_libdir}/{named,bind}/dlz_ldap_dynamic.so
 %doc contrib/dlz/modules/ldap/testing/*
 
 %files dlz-sqlite3
-%{_libdir}/bind/dlz_sqlite3_dynamic.so
+%{_libdir}/{named,bind}/dlz_sqlite3_dynamic.so
 %doc contrib/dlz/modules/sqlite3/testing/*
 
 %endif
diff --git a/named-chroot.files b/named-chroot.files
index 43c559a..9a768e4 100644
--- a/named-chroot.files
+++ b/named-chroot.files
@@ -16,6 +16,8 @@
 /etc/named
 /usr/lib64/bind
 /usr/lib/bind
+/usr/lib64/named
+/usr/lib/named
 /usr/share/GeoIP
 /run/named
 # Warning: the order is important

From aa8fce73814cb6996a86edb72b0f9d0822cd14ca Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 15 Sep 2020 19:28:35 +0200
Subject: [PATCH 190/460] Remove ancient provides

Most of they are related to RHEL 5, which is far too long unsupported.
Stop dragging them along for ages.
---
 bind.spec | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/bind.spec b/bind.spec
index 96c852d..86f2b3b 100644
--- a/bind.spec
+++ b/bind.spec
@@ -131,12 +131,6 @@ Requires(post): shadow-utils
 Requires(post): glibc-common
 Requires(post): grep
 Requires:       bind-libs%{?_isa} = %{epoch}:%{version}-%{release}
-Obsoletes:      bind-config < 30:9.3.2-34.fc6
-Provides:       bind-config = 30:9.3.2-34.fc6
-Obsoletes:      caching-nameserver < 31:9.4.1-7.fc8
-Provides:       caching-nameserver = 31:9.4.1-7.fc8
-Obsoletes:      dnssec-conf < 1.27-2
-Provides:       dnssec-conf = 1.27-2
 # This wild require should satisfy %%selinux_set_boolean macro only
 # in case it needs to be used
 Requires(post): ((policycoreutils-python-utils and libselinux-utils) if (selinux-policy-targeted or selinux-policy-mls))
@@ -252,8 +246,6 @@ with native PKCS#11 functionality.
 
 %package libs-lite
 Summary:  Libraries for working with the DNS protocol
-Obsoletes:bind-libbind-devel < 31:9.3.3-4.fc7
-Provides: bind-libbind-devel = 31:9.3.3-4.fc7
 Requires: bind-license = %{epoch}:%{version}-%{release}
 
 %description libs-lite
@@ -309,8 +301,6 @@ or maintain keys for it.
 
 %package devel
 Summary:  Header files and libraries needed for BIND DNS development
-Obsoletes:bind-libbind-devel < 31:9.3.3-4.fc7
-Provides: bind-libbind-devel = 31:9.3.3-4.fc7
 Requires: bind-libs%{?_isa} = %{epoch}:%{version}-%{release}
 Provides: bind-lite-devel%{?_isa} = %{epoch}:%{version}-%{release}
 Requires: bind-libs-lite%{?_isa} = %{epoch}:%{version}-%{release}

From 4158647a7a9e40f095898fed51940b6a51f3a693 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 15 Sep 2020 19:34:43 +0200
Subject: [PATCH 191/460] Remove ancient version triggers

---
 bind.spec | 29 +++++++++++------------------
 1 file changed, 11 insertions(+), 18 deletions(-)

diff --git a/bind.spec b/bind.spec
index 86f2b3b..4801ee8 100644
--- a/bind.spec
+++ b/bind.spec
@@ -874,24 +874,6 @@ fi
 %systemd_postun_with_restart named-pkcs11.service
 %endif
 
-%triggerpostun -n bind -- bind <= 32:9.5.0-20.b1
-if [ "$1" -gt 0 ]; then
-  [ -e /etc/rndc.key ] && chown root:named /etc/rndc.key
-  [ -e /etc/rndc.key ] && chmod 0640 /etc/rndc.key
-fi
-:;
-
-%triggerun -- bind < 32:9.9.0-0.6.rc1
-/sbin/chkconfig --del named >/dev/null 2>&1 || :
-/bin/systemctl try-restart named.service >/dev/null 2>&1 || :
-
-%ldconfig_scriptlets libs
-%ldconfig_scriptlets libs-lite
-
-%if %{with PKCS11}
-%ldconfig_scriptlets pkcs11-libs
-%endif
-
 # Fix permissions on existing device files on upgrade
 %define chroot_fix_devices() \
 if [ $1 -gt 1 ]; then \
@@ -904,6 +886,17 @@ if [ $1 -gt 1 ]; then \
   done \
 fi
 
+%triggerun -- bind < 32:9.9.0-0.6.rc1
+/sbin/chkconfig --del named >/dev/null 2>&1 || :
+/bin/systemctl try-restart named.service >/dev/null 2>&1 || :
+
+%ldconfig_scriptlets libs
+%ldconfig_scriptlets libs-lite
+
+%if %{with PKCS11}
+%ldconfig_scriptlets pkcs11-libs
+%endif
+
 %post chroot
 %systemd_post named-chroot.service
 %chroot_fix_devices %{chroot_prefix}

From aa13488713f9519bb20872006d0832c41ad8da55 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 15 Sep 2020 19:48:36 +0200
Subject: [PATCH 192/460] Create bind-dnssec-doc subpackage

Move there all manual pages of bind-dnssec-utils. They can be then
shared by bind-pkcs11-utils with just one package owning them.
---
 bind.spec | 21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/bind.spec b/bind.spec
index 4801ee8..5c5ad8b 100644
--- a/bind.spec
+++ b/bind.spec
@@ -219,6 +219,7 @@ For other supported HSM modules please check the BIND documentation.
 Summary: Bind tools with native PKCS#11 for using DNSSEC
 Requires: bind-pkcs11-libs%{?_isa} = %{epoch}:%{version}-%{release}
 Obsoletes: bind-pkcs11 < 32:9.9.4-16.P2
+Requires: bind-dnssec-doc = %{epoch}:%{version}-%{release}
 
 %description pkcs11-utils
 This is a set of PKCS#11 utilities that when used together create rsa
@@ -286,10 +287,11 @@ You should install bind-utils if you need to get information from DNS name
 servers.
 
 %package dnssec-utils
-Summary: Utilities for DNSSEC keys and DNS zone files management
+Summary: DNSSEC keys and zones management utilities
 Requires: bind-libs-lite%{?_isa} = %{epoch}:%{version}-%{release}
 Recommends: bind-utils
 Requires: python3-bind = %{epoch}:%{version}-%{release}
+Requires: bind-dnssec-doc = %{epoch}:%{version}-%{release}
 
 %description dnssec-utils
 Bind-dnssec-utils contains a collection of utilities for editing
@@ -299,6 +301,14 @@ revocation and verification of keys and DNSSEC signatures in zone files.
 You should install bind-dnssec-utils if you need to sign a DNS zone
 or maintain keys for it.
 
+%package dnssec-doc
+Summary: Manual pages of DNSSEC utilities
+Requires: bind-license = %{epoch}:%{version}-%{release}
+BuildArch:noarch
+
+%description dnssec-doc
+Bind-dnssec-doc contains manual pages for bind-dnssec-utils.
+
 %package devel
 Summary:  Header files and libraries needed for BIND DNS development
 Requires: bind-libs%{?_isa} = %{epoch}:%{version}-%{release}
@@ -1026,9 +1036,13 @@ fi;
 
 %files dnssec-utils
 %{_sbindir}/dnssec*
-%{_mandir}/man8/dnssec*.8*
 %if %{with PKCS11}
 %exclude %{_sbindir}/dnssec*pkcs11
+%endif
+
+%files dnssec-doc
+%{_mandir}/man8/dnssec*.8*
+%if %{with PKCS11}
 %exclude %{_mandir}/man8/dnssec*-pkcs11.8*
 %endif
 
@@ -1104,9 +1118,6 @@ fi;
 %{_sbindir}/pkcs11-tokens
 %{_mandir}/man8/pkcs11*.8*
 %{_mandir}/man8/dnssec*-pkcs11.8*
-%{_mandir}/man8/dnssec*.8*
-%exclude %{_mandir}/man8/dnssec-coverage.8*
-%exclude %{_mandir}/man8/dnssec-keymgr.8*
 
 %files pkcs11-libs
 %{_libdir}/libdns-pkcs11.so.%{sover_dns}*

From 11da1628d865b2980c8de8582d583fbc211e8ce7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 16 Sep 2020 12:05:00 +0200
Subject: [PATCH 193/460] Allow easy upgrade of bind-devel

bind-lite-devel needs to be obsoleted. It demands license with its own
reason and block upgrade.
---
 bind.spec | 1 +
 1 file changed, 1 insertion(+)

diff --git a/bind.spec b/bind.spec
index 5c5ad8b..a4d1e87 100644
--- a/bind.spec
+++ b/bind.spec
@@ -313,6 +313,7 @@ Bind-dnssec-doc contains manual pages for bind-dnssec-utils.
 Summary:  Header files and libraries needed for BIND DNS development
 Requires: bind-libs%{?_isa} = %{epoch}:%{version}-%{release}
 Provides: bind-lite-devel%{?_isa} = %{epoch}:%{version}-%{release}
+Obsoletes: bind-lite-devel < 32:9.16.6-3
 Requires: bind-libs-lite%{?_isa} = %{epoch}:%{version}-%{release}
 Requires: openssl-devel%{?_isa} libxml2-devel%{?_isa}
 %if %{with GSSTSIG}

From c2387c40c77eb1481e9645d8da4061cdb6a50e98 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 16 Sep 2020 12:13:51 +0200
Subject: [PATCH 194/460] Add missing architecture to lmdb

---
 bind.spec | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index a4d1e87..46c32e3 100644
--- a/bind.spec
+++ b/bind.spec
@@ -320,7 +320,7 @@ Requires: openssl-devel%{?_isa} libxml2-devel%{?_isa}
 Requires: krb5-devel%{?_isa}
 %endif
 %if %{with LMDB}
-Requires: lmdb-devel
+Requires: lmdb-devel%{?_isa}
 %endif
 %if %{with JSON}
 Requires:  json-c-devel%{?_isa}

From fe1a07243532af52a469cdf75afc8a6f2908f3cc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 16 Sep 2020 16:09:08 +0200
Subject: [PATCH 195/460] Provide should not contain architecture

---
 bind.spec | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/bind.spec b/bind.spec
index 46c32e3..6c9bcfa 100644
--- a/bind.spec
+++ b/bind.spec
@@ -311,10 +311,10 @@ Bind-dnssec-doc contains manual pages for bind-dnssec-utils.
 
 %package devel
 Summary:  Header files and libraries needed for BIND DNS development
-Requires: bind-libs%{?_isa} = %{epoch}:%{version}-%{release}
-Provides: bind-lite-devel%{?_isa} = %{epoch}:%{version}-%{release}
+Provides: bind-lite-devel = %{epoch}:%{version}-%{release}
 Obsoletes: bind-lite-devel < 32:9.16.6-3
 Requires: bind-libs-lite%{?_isa} = %{epoch}:%{version}-%{release}
+Requires: bind-libs%{?_isa} = %{epoch}:%{version}-%{release}
 Requires: openssl-devel%{?_isa} libxml2-devel%{?_isa}
 %if %{with GSSTSIG}
 Requires: krb5-devel%{?_isa}

From 7ffde7d75569505fc09ef24c473fdfa21aa8ba97 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 16 Sep 2020 16:12:12 +0200
Subject: [PATCH 196/460] Address warning of rpmlint

---
 bind-9.10-use-of-strlcat.patch | 18 ------------------
 bind.spec                      |  6 +-----
 2 files changed, 1 insertion(+), 23 deletions(-)
 delete mode 100644 bind-9.10-use-of-strlcat.patch

diff --git a/bind-9.10-use-of-strlcat.patch b/bind-9.10-use-of-strlcat.patch
deleted file mode 100644
index 2a39916..0000000
--- a/bind-9.10-use-of-strlcat.patch
+++ /dev/null
@@ -1,18 +0,0 @@
-diff --git a/bin/sdb_tools/zone2ldap.c b/bin/sdb_tools/zone2ldap.c
-index d56bc56..99c3314 100644
---- a/bin/sdb_tools/zone2ldap.c
-+++ b/bin/sdb_tools/zone2ldap.c
-@@ -817,11 +817,11 @@ build_dn_from_dc_list (char **dc_list, unsigned int ttl, int flag, char *zone)
-     }
- 
- 
--      strlcat (dn, tmp, sizeof (dn));
-+      strncat (dn, tmp, sizeof (dn) - strlen (dn));
-     }
- 
-   sprintf (tmp, "dc=%s", dc_list[0]);
--  strlcat (dn, tmp, sizeof (dn));
-+  strncat (dn, tmp, sizeof (dn) - strlen (dn));
- 
- 	    fflush(NULL);
-   return dn;
diff --git a/bind.spec b/bind.spec
index 6c9bcfa..3ecc99a 100644
--- a/bind.spec
+++ b/bind.spec
@@ -113,9 +113,6 @@ Patch136:bind-9.10-dist-native-pkcs11.patch
 # Do not use isc-pkcs11.
 Patch149:bind-9.11-kyua-pkcs11.patch
 
-# [ISC-Bugs #42525] non-portable use of strlcat in contrib/sdb/ldap/zone2ldap.c
-# introduced by https://source.isc.org/cgi-bin/gitweb.cgi?p=bind9.git;a=commit;h=fc9f0ac5778f78003a7acc957a23711811fec122
-Patch137:bind-9.10-use-of-strlcat.patch
 Patch140:bind-9.11-rh1410433.patch
 Patch157:bind-9.11-fips-tests.patch
 Patch164:bind-9.11-rh1666814.patch
@@ -449,7 +446,6 @@ cp -r lib/ns{,-pkcs11}
 %endif
 
 %patch133 -p1 -b .rh640538
-#%patch134 -p1 -b .rh669163
 
 # Sparc and s390 arches need to use -fPIE
 %ifarch sparcv9 sparc64 s390 s390x
@@ -691,7 +687,7 @@ install -m 644 %{SOURCE47} ${RPM_BUILD_ROOT}%{_unitdir}
 %else
 # Not packaged without PKCS11
 find ${RPM_BUILD_ROOT}%{_includedir}/bind9/pk11 ${RPM_BUILD_ROOT}%{_includedir}/bind9/pkcs11 \
-	 -name '*.h' \! -name site.h -delete
+  -name '*.h' \! -name site.h -delete
 
 %endif
 

From 1f070d7ab35f4651e31b506f440239f2823830c6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 16 Sep 2020 16:52:39 +0200
Subject: [PATCH 197/460] Move mysql DLZ modules together

Remove dlz-mysqldyn subpackage, move documentation and modules to the
same package. It is similar and has exactly the same dependencies,
different package is not required.
---
 bind.spec | 24 ++++++++++--------------
 1 file changed, 10 insertions(+), 14 deletions(-)

diff --git a/bind.spec b/bind.spec
index 3ecc99a..725d270 100644
--- a/bind.spec
+++ b/bind.spec
@@ -362,18 +362,14 @@ Requires: bind%{?_isa} = %{epoch}:%{version}-%{release}
 Dynamic Loadable Zones LDAP module for BIND server.
 
 %package dlz-mysql
-Summary: BIND server mysql DLZ module
+Summary: BIND server mysql and mysqldyn DLZ modules
 Requires: bind%{?_isa} = %{epoch}:%{version}-%{release}
+Provides: %{name}-dlz-mysqldyn
+Obsoletes: %{name}-dlz-mysqldyn < 32:9.16.6-3
 
 %description dlz-mysql
 Dynamic Loadable Zones MySQL module for BIND server.
-
-%package dlz-mysqldyn
-Summary: BIND server mysqldyn DLZ module
-Requires: bind%{?_isa} = %{epoch}:%{version}-%{release}
-
-%description dlz-mysqldyn
-BIND 9 DLZ MySQL module with support for dynamic DNS (DDNS)
+Contains also mysqldyn module with dynamic DNS updates (DDNS) support.
 
 %package dlz-sqlite3
 Summary: BIND server sqlite3 DLZ module
@@ -713,7 +709,10 @@ install -m 644 %{SOURCE49} ${RPM_BUILD_ROOT}%{_sysconfdir}/named-chroot.files
   pushd ${RPM_BUILD_ROOT}/%{_libdir}/bind
     cp -s ../named/dlz_*.so .
   popd
-  mv mysqldyn/testing/README mysqldyn/testing/README.testing
+  mkdir -p doc/{mysql,mysqldyn}
+  cp -p mysqldyn/testing/README doc/mysqldyn/README.testing
+  cp -p mysqldyn/testing/* doc/mysqldyn
+  cp -p mysql/testing/* doc/mysql
   popd
   popd
 %endif
@@ -1134,12 +1133,9 @@ fi;
 
 %files dlz-mysql
 %{_libdir}/{named,bind}/dlz_mysql_dynamic.so
-%doc contrib/dlz/modules/mysql/testing/*
-
-%files dlz-mysqldyn
+%doc build/contrib/dlz/modules/doc/mysql
 %{_libdir}/{named,bind}/dlz_mysqldyn_mod.so
-%doc contrib/dlz/modules/mysqldyn/testing/*
-%doc contrib/dlz/modules/mysqldyn/README*
+%doc build/contrib/dlz/modules/doc/mysqldyn
 
 %files dlz-ldap
 %{_libdir}/{named,bind}/dlz_ldap_dynamic.so

From 9e7477b3c47d78490a0fdd5c982b1983ea4e7e0b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 17 Sep 2020 11:42:55 +0200
Subject: [PATCH 198/460] Update to 9.16.7

Bugfix release.

https://downloads.isc.org/isc/bind9/9.16.7/doc/arm/html/notes.html#notes-for-bind-9-16-7
---
 .gitignore |  2 ++
 bind.spec  | 11 +++++++----
 sources    |  4 ++--
 3 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/.gitignore b/.gitignore
index c4326f3..7ff5f5f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -113,3 +113,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.16.5.tar.xz.asc
 /bind-9.16.6.tar.xz
 /bind-9.16.6.tar.xz.asc
+/bind-9.16.7.tar.xz
+/bind-9.16.7.tar.xz.asc
diff --git a/bind.spec b/bind.spec
index 725d270..4f649a0 100644
--- a/bind.spec
+++ b/bind.spec
@@ -55,18 +55,18 @@
 # no more isc-config.sh and bind9-config
 
 # lib*.so.X versions of selected libraries
-%global sover_dns 1605
+%global sover_dns 1607
 %global sover_isc 1606
 %global sover_irs 1601
-%global sover_isccfg 1600
+%global sover_isccfg 1601
 %global sover_ns 1604
 
 
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.16.6
-Release:  3%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Version:  9.16.7
+Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1161,6 +1161,9 @@ fi;
 %endif
 
 %changelog
+* Thu Sep 17 2020 Petr Menšík <pemensik@redhat.com> - 32:9.16.7-1
+- Update to 9.16.7
+
 * Tue Sep 15 2020 Petr Menšík <pemensik@redhat.com> - 32:9.16.6-3
 - Merge bind-lite-devel into devel package
 
diff --git a/sources b/sources
index 7cbeac0..0dab457 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.16.6.tar.xz) = 37f57db6d1633cc85a4d954a69bbb3372c65ac43fef965df5aee8dcdd32153bb5b0c6d0d5f00f353dd4464c71d74dc8e801937b930e2b8f6799fa77af5f243e0
-SHA512 (bind-9.16.6.tar.xz.asc) = 519f264f9f2f9f78c3a972aca72d4843328294cb0785d19199a61d6d922ba1dfe30fd80187fcb4e42db177692826158f53ddf8b9333fcb1239b6c78b88491229
+SHA512 (bind-9.16.7.tar.xz) = 176c84657e8a7b10a7ca93c939ca6a7fcdefb22f9200c3f01be59bcd8990dee27b8dc0970299225bcbe0f1aa8f49a67c80c4a9853895ffbcd685adb9674e7768
+SHA512 (bind-9.16.7.tar.xz.asc) = a94721692a3c400aa9df9499874ac833e605a647ec8e4e42065bf4822581eb6e3cfb8b5f61e127fb069e821364de9aef2030fa7bb456616993321897e06c7ec4

From dac5cf7a4c53f30bd3ec9d96fdcc30ea7c7a2cfc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 16 Sep 2020 12:13:51 +0200
Subject: [PATCH 199/460] Add missing architecture to lmdb

---
 bind.spec | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index 435a3e3..79faae0 100644
--- a/bind.spec
+++ b/bind.spec
@@ -400,7 +400,7 @@ Requires: libcap-devel%{?_isa}
 Requires: krb5-devel%{?_isa}
 %endif
 %if %{with LMDB}
-Requires: lmdb-devel
+Requires: lmdb-devel%{?_isa}
 %endif
 %if %{with JSON}
 Requires:  json-c-devel%{?_isa}

From f37fbc82054e669fa2a55b0588cf8109e4401273 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 15 Sep 2020 17:55:01 +0200
Subject: [PATCH 200/460] Remove DEVEL conditional define

I find no reason to turn off devel package creation. It can be ignored
if required, but is mandatory due to Fedora packaging guidelines.
Simplify it a bit.
---
 bind.spec | 13 -------------
 1 file changed, 13 deletions(-)

diff --git a/bind.spec b/bind.spec
index 79faae0..82022e8 100644
--- a/bind.spec
+++ b/bind.spec
@@ -15,7 +15,6 @@
 # it is not possible to build the package without PKCS11 sub-package
 # due to extensive changes to Makefiles
 %bcond_without PKCS11
-%bcond_without DEVEL
 %bcond_without JSON
 %bcond_without DLZ
 %bcond_with    BDB
@@ -377,7 +376,6 @@ revocation and verification of keys and DNSSEC signatures in zone files.
 You should install bind-dnssec-utils if you need to sign a DNS zone
 or maintain keys for it.
 
-%if %{with DEVEL}
 %package devel
 Summary:  Header files and libraries needed for BIND DNS development
 Obsoletes:bind-libbind-devel < 31:9.3.3-4.fc7
@@ -388,7 +386,6 @@ Requires: bind-lite-devel%{?_isa} = %{epoch}:%{version}-%{release}
 %description devel
 The bind-devel package contains full version of the header files and libraries
 required for development with ISC BIND 9
-%endif
 
 %package lite-devel
 Summary:  Lite version of header files and libraries needed for BIND DNS development
@@ -1062,14 +1059,6 @@ popd
 # Remove libtool .la files:
 find ${RPM_BUILD_ROOT}/%{_libdir} -name '*.la' -exec '/bin/rm' '-f' '{}' ';';
 
-# Remove -devel files out of buildroot if not needed
-%if !%{with DEVEL}
-rm -f ${RPM_BUILD_ROOT}/%{_libdir}/bind9/*so
-rm -rf ${RPM_BUILD_ROOT}/%{_includedir}/bind9
-rm -f ${RPM_BUILD_ROOT}/%{_mandir}/man1/isc-config.sh.1*
-rm -f ${RPM_BUILD_ROOT}/%{_mandir}/man3/lwres*
-rm -f ${RPM_BUILD_ROOT}/%{_bindir}/isc-config.sh
-%endif
 
 # SDB manpages
 %if %{with SDB}
@@ -1432,7 +1421,6 @@ fi;
 %exclude %{_mandir}/man8/dnssec*-pkcs11.8*
 %endif
 
-%if %{with DEVEL}
 %files devel
 %{_libdir}/libbind9.so
 %{_libdir}/libisccc.so
@@ -1446,7 +1434,6 @@ fi;
 %{_mandir}/man3/lwres*
 %{_bindir}/isc-config.sh
 %{_bindir}/bind9-config
-%endif
 
 %files lite-devel
 %{_libdir}/libdns.so

From 165b833b3d94c8b569c083fc192d1d7fa44e3b41 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 15 Sep 2020 19:28:35 +0200
Subject: [PATCH 201/460] Remove ancient provides

Most of they are related to RHEL 5, which is far too long unsupported.
Stop dragging them along for ages.
---
 bind.spec | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/bind.spec b/bind.spec
index 82022e8..1a091c4 100644
--- a/bind.spec
+++ b/bind.spec
@@ -185,12 +185,6 @@ Requires(post): glibc-common
 Requires(post): grep
 Requires:       bind-libs%{?_isa} = %{epoch}:%{version}-%{release}
 Requires:       bind-libs-lite%{?_isa} = %{epoch}:%{version}-%{release}
-Obsoletes:      bind-config < 30:9.3.2-34.fc6
-Provides:       bind-config = 30:9.3.2-34.fc6
-Obsoletes:      caching-nameserver < 31:9.4.1-7.fc8
-Provides:       caching-nameserver = 31:9.4.1-7.fc8
-Obsoletes:      dnssec-conf < 1.27-2
-Provides:       dnssec-conf = 1.27-2
 # This wild require should satisfy %%selinux_set_boolean macro only
 # in case it needs to be used
 Requires(post): ((policycoreutils-python-utils and libselinux-utils) if (selinux-policy-targeted or selinux-policy-mls))
@@ -321,8 +315,6 @@ or in the filesystem (dirdb), in addition to the standard in-memory RBT
 
 %package libs-lite
 Summary:  Libraries for working with the DNS protocol
-Obsoletes:bind-libbind-devel < 31:9.3.3-4.fc7
-Provides: bind-libbind-devel = 31:9.3.3-4.fc7
 Requires: bind-license = %{epoch}:%{version}-%{release}
 
 %description libs-lite
@@ -378,8 +370,6 @@ or maintain keys for it.
 
 %package devel
 Summary:  Header files and libraries needed for BIND DNS development
-Obsoletes:bind-libbind-devel < 31:9.3.3-4.fc7
-Provides: bind-libbind-devel = 31:9.3.3-4.fc7
 Requires: bind-libs%{?_isa} = %{epoch}:%{version}-%{release}
 Requires: bind-lite-devel%{?_isa} = %{epoch}:%{version}-%{release}
 

From d4dab07e864b28fb07ba85359945a7d505cd959d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 15 Sep 2020 19:34:43 +0200
Subject: [PATCH 202/460] Remove ancient version triggers

---
 bind.spec | 27 ++++++++++-----------------
 1 file changed, 10 insertions(+), 17 deletions(-)

diff --git a/bind.spec b/bind.spec
index 1a091c4..42934f5 100644
--- a/bind.spec
+++ b/bind.spec
@@ -1196,12 +1196,17 @@ fi
 %systemd_postun_with_restart named-pkcs11.service
 %endif
 
-%triggerpostun -n bind -- bind <= 32:9.5.0-20.b1
-if [ "$1" -gt 0 ]; then
-  [ -e /etc/rndc.key ] && chown root:named /etc/rndc.key
-  [ -e /etc/rndc.key ] && chmod 0640 /etc/rndc.key
+# Fix permissions on existing device files on upgrade
+%define chroot_fix_devices() \
+if [ $1 -gt 1 ]; then \
+  for DEV in "%{1}/dev"/{null,random,zero}; do \
+    if [ -e "$DEV" -a "$(/bin/stat --printf="%G %a" "$DEV")" = "root 644" ]; \
+    then \
+      /bin/chmod 0664 "$DEV" \
+      /bin/chgrp named "$DEV" \
+    fi \
+  done \
 fi
-:;
 
 %triggerun -- bind < 32:9.9.0-0.6.rc1
 /sbin/chkconfig --del named >/dev/null 2>&1 || :
@@ -1222,18 +1227,6 @@ fi
 %end
 %endif
 
-# Fix permissions on existing device files on upgrade
-%define chroot_fix_devices() \
-if [ $1 -gt 1 ]; then \
-  for DEV in "%{1}/dev"/{null,random,zero}; do \
-    if [ -e "$DEV" -a "$(/bin/stat --printf="%G %a" "$DEV")" = "root 644" ]; \
-    then \
-      /bin/chmod 0664 "$DEV" \
-      /bin/chgrp named "$DEV" \
-    fi \
-  done \
-fi
-
 %post chroot
 %systemd_post named-chroot.service
 %chroot_fix_devices %{chroot_prefix}

From c8e4226ec1094e37b681d02538785ee0aa62b46d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 15 Sep 2020 19:48:36 +0200
Subject: [PATCH 203/460] Create bind-dnssec-doc subpackage

Move there all manual pages of bind-dnssec-utils. They can be then
shared by bind-pkcs11-utils with just one package owning them.
---
 bind.spec | 21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/bind.spec b/bind.spec
index 42934f5..9e6da49 100644
--- a/bind.spec
+++ b/bind.spec
@@ -269,6 +269,7 @@ For other supported HSM modules please check the BIND documentation.
 Summary: Bind tools with native PKCS#11 for using DNSSEC
 Requires: bind-pkcs11-libs%{?_isa} = %{epoch}:%{version}-%{release}
 Obsoletes: bind-pkcs11 < 32:9.9.4-16.P2
+Requires: bind-dnssec-doc = %{epoch}:%{version}-%{release}
 
 %description pkcs11-utils
 This is a set of PKCS#11 utilities that when used together create rsa
@@ -355,10 +356,11 @@ You should install bind-utils if you need to get information from DNS name
 servers.
 
 %package dnssec-utils
-Summary: Utilities for DNSSEC keys and DNS zone files management
+Summary: DNSSEC keys and zones management utilities
 Requires: bind-libs-lite%{?_isa} = %{epoch}:%{version}-%{release}
 Recommends: bind-utils
 Requires: python3-bind = %{epoch}:%{version}-%{release}
+Requires: bind-dnssec-doc = %{epoch}:%{version}-%{release}
 
 %description dnssec-utils
 Bind-dnssec-utils contains a collection of utilities for editing
@@ -368,6 +370,14 @@ revocation and verification of keys and DNSSEC signatures in zone files.
 You should install bind-dnssec-utils if you need to sign a DNS zone
 or maintain keys for it.
 
+%package dnssec-doc
+Summary: Manual pages of DNSSEC utilities
+Requires: bind-license = %{epoch}:%{version}-%{release}
+BuildArch:noarch
+
+%description dnssec-doc
+Bind-dnssec-doc contains manual pages for bind-dnssec-utils.
+
 %package devel
 Summary:  Header files and libraries needed for BIND DNS development
 Requires: bind-libs%{?_isa} = %{epoch}:%{version}-%{release}
@@ -1398,9 +1408,13 @@ fi;
 
 %files dnssec-utils
 %{_sbindir}/dnssec*
-%{_mandir}/man8/dnssec*.8*
 %if %{with PKCS11}
 %exclude %{_sbindir}/dnssec*pkcs11
+%endif
+
+%files dnssec-doc
+%{_mandir}/man8/dnssec*.8*
+%if %{with PKCS11}
 %exclude %{_mandir}/man8/dnssec*-pkcs11.8*
 %endif
 
@@ -1521,9 +1535,6 @@ fi;
 %{_sbindir}/pkcs11-tokens
 %{_mandir}/man8/pkcs11*.8*
 %{_mandir}/man8/dnssec*-pkcs11.8*
-%{_mandir}/man8/dnssec*.8*
-%exclude %{_mandir}/man8/dnssec-coverage.8*
-%exclude %{_mandir}/man8/dnssec-keymgr.8*
 
 %files pkcs11-libs
 %{_libdir}/libdns-pkcs11.so.%{sover_dns}*

From 1d47d2b5c91a852e60bd2a6f145da9c38e811d4c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 17 Sep 2020 23:01:41 +0200
Subject: [PATCH 204/460] Update to 9.11.23
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Only bugs fixed.
- LOC records parsing fixed
- nonsecurity fixes from fuzzing

upstream release notes:
https://downloads.isc.org/isc/bind9/9.11.23/RELEASE-NOTES-bind-9.11.23.html

Signed-off-by: Petr Menšík <pemensik@redhat.com>
---
 .gitignore | 2 ++
 bind.spec  | 7 +++++--
 sources    | 4 ++--
 3 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/.gitignore b/.gitignore
index a41a75a..ef57da0 100644
--- a/.gitignore
+++ b/.gitignore
@@ -114,3 +114,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.11.21.tar.gz.asc
 /bind-9.11.22.tar.gz
 /bind-9.11.22.tar.gz.asc
+/bind-9.11.23.tar.gz
+/bind-9.11.23.tar.gz.asc
diff --git a/bind.spec b/bind.spec
index 9e6da49..3103281 100644
--- a/bind.spec
+++ b/bind.spec
@@ -66,8 +66,8 @@
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.11.22
-Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Version:  9.11.23
+Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1624,6 +1624,9 @@ fi;
 %endif
 
 %changelog
+* Thu Sep 17 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.23-1
+- Update to 9.11.23
+
 * Tue Sep 01 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.22-2
 - Require libcap from devel package
 
diff --git a/sources b/sources
index 51de436..a76ec35 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.11.22.tar.gz) = 8ed2ed661b87705bbb7ddde3076a132b4e53971d669600997abfa104404e0c8b4bf04cc04c6be1c2c701123db5e0d4645ab797e5a985a18f5a1d68824a3df3ed
-SHA512 (bind-9.11.22.tar.gz.asc) = 009c2035f8ed992771b863369f480575e91b2dbaad50fbfd5322cd8761bf4dced0870c448375ad746271717b6847012a2ba5f9dcc862f63c05ff6b1fcd77885f
+SHA512 (bind-9.11.23.tar.gz) = df374dcfdad5c905d5607fd3a5dcfd236f1c9ee448902db520748a738d1ff2f1761603bf62949d38932fcd3ebbf36e693737c40f0a6233af20ee91c3f9a3f462
+SHA512 (bind-9.11.23.tar.gz.asc) = afba039f50ad94fffa7891730d2d506a035f7abedeaec2f05abf19d030ffebc271b49e24adb3720f7bdb73318d52ededf0765ee082a6dc7cd9b581facafd411a

From 392ac795ce6a63840ccd341463a00288c9d4a86e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 18 Sep 2020 14:27:54 +0200
Subject: [PATCH 205/460] Add fix of rbtdb.c from upstream
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

ARM and s390x cannot compile, because they lack atomic implementation in
lib/isc. Include upstream fix after 9.11.23 release.

Signed-off-by: Petr Menšík <pemensik@redhat.com>
---
 bind-9.11.23-atomic.patch | 178 ++++++++++++++++++++++++++++++++++++++
 bind.spec                 |   3 +
 2 files changed, 181 insertions(+)
 create mode 100644 bind-9.11.23-atomic.patch

diff --git a/bind-9.11.23-atomic.patch b/bind-9.11.23-atomic.patch
new file mode 100644
index 0000000..b5c37ec
--- /dev/null
+++ b/bind-9.11.23-atomic.patch
@@ -0,0 +1,178 @@
+From 1528f231b559670445cfc427937174535981917d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
+Date: Fri, 18 Sep 2020 14:46:02 +0200
+Subject: [PATCH] Fix isc_atomic_xadd symbol missing
+
+Squashed commit of the following:
+
+commit d8afe85342f05d8fec8ee0255451568e936b7eb2
+Author: Mark Andrews <marka@isc.org>
+Date:   Mon Sep 7 16:12:31 2020 +1000
+
+    Update 'init_count' atomically to silence tsan errors.
+
+    (cherry picked from commit 90185b225f4c7acde2fbb04697d857fe496725a2)
+
+commit f166c7fb7cc262a688ed511e40c9b0d551d5992d
+Author: Mark Andrews <marka@isc.org>
+Date:   Thu Sep 3 12:53:53 2020 +1000
+
+    The node lock was released too early.
+
+    NEGATIVE needs to be call with the node lock held.
+
+    WARNING: ThreadSanitizer: data race
+      Write of size 2 at 0x000000000001 by thread T1 (mutexes: write M1):
+        #0 mark_stale_header lib/dns/rbtdb.c:1802:21
+        #1 add32 lib/dns/rbtdb.c:6559:5
+        #2 addrdataset lib/dns/rbtdb.c:6975:12
+        #3 dns_db_addrdataset lib/dns/db.c:783:10
+        #4 cache_name lib/dns/resolver.c:5829:13
+        #5 cache_message lib/dns/resolver.c:5926:14
+        #6 resquery_response lib/dns/resolver.c:8618:12
+        #7 dispatch lib/isc/task.c:1157:7
+        #8 run lib/isc/task.c:1331:2
+
+      Previous read of size 2 at 0x000000000001 by thread T2:
+        #0 cache_findrdataset lib/dns/rbtdb.c:5932:6
+        #1 dns_db_findrdataset lib/dns/db.c:739:10
+        #2 query_addadditional2 bin/named/query.c:2196:11
+        #3 additionaldata_ns lib/dns/./rdata/generic/ns_2.c:198:10
+        #4 dns_rdata_additionaldata lib/dns/rdata.c:1246:2
+        #5 dns_rdataset_additionaldata lib/dns/rdataset.c:629:12
+        #6 query_addrdataset bin/named/query.c:2411:8
+        #7 query_addrrset bin/named/query.c:2802:2
+        #8 query_addbestns bin/named/query.c:3501:2
+        #9 query_find bin/named/query.c:9165:4
+        #10 query_resume bin/named/query.c:4164:12
+        #11 dispatch lib/isc/task.c:1157:7
+        #12 run lib/isc/task.c:1331:2
+
+    (cherry picked from commit a1dcb73f677969d99df3ccff2acf4737e18a72b1)
+
+commit 591a80fa95b8f3f3e716c45ceb9c5e4ccfa551c8
+Author: Mark Andrews <marka@isc.org>
+Date:   Mon Aug 24 17:34:58 2020 +1000
+
+    increment header->count atomically
+
+    (cherry picked from commit 121837aa75ced489e28f8ce1dd20315487d199fa)
+---
+ lib/dns/rbtdb.c | 43 +++++++++++++++++++++++++++++++++++--------
+ 1 file changed, 35 insertions(+), 8 deletions(-)
+
+diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
+index 88c39bf714..31ced8e73a 100644
+--- a/lib/dns/rbtdb.c
++++ b/lib/dns/rbtdb.c
+@@ -399,6 +399,23 @@ typedef isc_mutex_t nodelock_t;
+ #define NODE_WEAKDOWNGRADE(l)   ((void)0)
+ #endif
+ 
++#if defined(ISC_PLATFORM_HAVESTDATOMIC)
++#if defined(__cplusplus)
++#include <isc/stdatomic.h>
++#else
++#include <stdatomic.h>
++#endif
++#define DNS_RBTDB_STDATOMIC 1
++#define DNS_RBTDB_INC(x) atomic_fetch_add(&(x), (1))
++#define DNS_RBTDB_LOAD(x) atomic_load(&(x))
++#elif defined(ISC_PLATFORM_HAVEXADD)
++#define DNS_RBTDB_INC(x) isc_atomic_xadd((int *)&(x), 1);
++#define DNS_RBTDB_LOAD(x) isc_atomic_xadd((int *)&(x), 0);
++#else
++#define DNS_RBTDB_INC(x) ((x)++)
++#define DNS_RBTDB_LOAD(x) (x)
++#endif
++
+ /*%
+  * Whether to rate-limit updating the LRU to avoid possible thread contention.
+  * Our performance measurement has shown the cost is marginal, so it's defined
+@@ -457,7 +474,11 @@ typedef struct rdatasetheader {
+ 	 * this rdataset.
+ 	 */
+ 
+-	uint32_t                    count;
++#ifdef DNS_RBTDB_STDATOMIC
++	_Atomic(uint32_t)                count;
++#else
++	uint32_t                         count;
++#endif
+ 	/*%<
+ 	 * Monotonously increased every time this rdataset is bound so that
+ 	 * it is used as the base of the starting point in DNS responses
+@@ -952,7 +973,11 @@ static char FILE_VERSION[32] = "\0";
+  *      that indicates that the database does not implement cyclic
+  *      processing.
+  */
++#ifdef DNS_RBTDB_STDATOMIC
++static _Atomic(unsigned int) init_count;
++#else
+ static unsigned int init_count;
++#endif
+ 
+ /*
+  * Locking
+@@ -3322,7 +3347,7 @@ bind_rdataset(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node, rdatasetheader_t *header,
+ 	rdataset->private2 = node;
+ 	raw = (unsigned char *)header + sizeof(*header);
+ 	rdataset->private3 = raw;
+-	rdataset->count = header->count++;
++	rdataset->count = DNS_RBTDB_INC(header->count);
+ 	if (rdataset->count == UINT32_MAX)
+ 		rdataset->count = 0;
+ 
+@@ -5924,10 +5949,10 @@ cache_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
+ 		}
+ 	}
+ 
+-	NODE_UNLOCK(lock, locktype);
+-
+-	if (found == NULL)
++	if (found == NULL) {
++		NODE_UNLOCK(lock, locktype);
+ 		return (ISC_R_NOTFOUND);
++	}
+ 
+ 	if (NEGATIVE(found)) {
+ 		/*
+@@ -5939,6 +5964,8 @@ cache_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
+ 			result = DNS_R_NCACHENXRRSET;
+ 	}
+ 
++	NODE_UNLOCK(lock, locktype);
++
+ 	update_cachestats(rbtdb, result);
+ 
+ 	return (result);
+@@ -6839,7 +6866,7 @@ addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
+ 		newheader->attributes |= RDATASET_ATTR_ZEROTTL;
+ 	newheader->noqname = NULL;
+ 	newheader->closest = NULL;
+-	newheader->count = isc_atomic_xadd((int32_t*)&init_count, 1);
++	newheader->count = DNS_RBTDB_INC(init_count);
+ 	newheader->trust = rdataset->trust;
+ 	newheader->additional_auth = NULL;
+ 	newheader->additional_glue = NULL;
+@@ -7035,7 +7062,7 @@ subtractrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
+ 	newheader->trust = 0;
+ 	newheader->noqname = NULL;
+ 	newheader->closest = NULL;
+-	newheader->count = isc_atomic_xadd((int32_t*)&init_count, 1);
++	newheader->count = DNS_RBTDB_INC(init_count);
+ 	newheader->additional_auth = NULL;
+ 	newheader->additional_glue = NULL;
+ 	newheader->last_used = 0;
+@@ -7481,7 +7508,7 @@ loading_addrdataset(void *arg, dns_name_t *name, dns_rdataset_t *rdataset) {
+ 	newheader->serial = 1;
+ 	newheader->noqname = NULL;
+ 	newheader->closest = NULL;
+-	newheader->count = isc_atomic_xadd((int32_t*)&init_count, 1);
++	newheader->count = DNS_RBTDB_INC(init_count);
+ 	newheader->additional_auth = NULL;
+ 	newheader->additional_glue = NULL;
+ 	newheader->last_used = 0;
+-- 
+2.26.2
+
diff --git a/bind.spec b/bind.spec
index 3103281..1e4edfa 100644
--- a/bind.spec
+++ b/bind.spec
@@ -168,6 +168,8 @@ Patch177: bind-9.11-serve-stale.patch
 Patch178: bind-9.11-serve-stale-dbfix.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=1736762
 Patch183: bind-9.11-rh1736762-5.patch
+# https://gitlab.isc.org/isc-projects/bind9/-/issues/2167
+Patch184: bind-9.11.23-atomic.patch
 
 # SDB patches
 Patch11: bind-9.3.2b2-sdbsrc.patch
@@ -589,6 +591,7 @@ are used for building ISC DHCP.
 %patch177 -p1 -b .serve-stale
 %patch178 -p1 -b .rh1770492
 %patch183 -p1 -b .rh1736762-5
+%patch184 -p1 -b .rbtdb-atomic
 
 mkdir lib/dns/tests/testdata/dstrandom
 cp -a %{SOURCE50} lib/dns/tests/testdata/dstrandom/random.data

From fa2913151c19af86934e6652f05c2f660e458cf1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 15 Sep 2020 17:51:50 +0200
Subject: [PATCH 206/460] Merge bind-lite-devel into bind-devel

Those packages were very similar in BIND 9.11. Because nothing requires
just bind-lite-devel package, make just one devel package with all
requirements.  Keep separated libraries, but only one devel package.

Include also obsolete for automatic uninstall of previous bind-lite-devel
package. bind-devel now contains everything required to link against
libraries.
---
 bind.spec | 27 ++++++++++-----------------
 1 file changed, 10 insertions(+), 17 deletions(-)

diff --git a/bind.spec b/bind.spec
index 1e4edfa..52318db 100644
--- a/bind.spec
+++ b/bind.spec
@@ -290,7 +290,7 @@ functionality.
 %package pkcs11-devel
 Summary: Development files for Bind libraries compiled with native PKCS#11
 Requires: bind-pkcs11-libs%{?_isa} = %{epoch}:%{version}-%{release}
-Requires: bind-lite-devel%{?_isa} = %{epoch}:%{version}-%{release}
+Requires: bind-devel%{?_isa} = %{epoch}:%{version}-%{release}
 
 %description pkcs11-devel
 This a set of development files for BIND libraries (dns, isc) compiled
@@ -383,14 +383,8 @@ Bind-dnssec-doc contains manual pages for bind-dnssec-utils.
 %package devel
 Summary:  Header files and libraries needed for BIND DNS development
 Requires: bind-libs%{?_isa} = %{epoch}:%{version}-%{release}
-Requires: bind-lite-devel%{?_isa} = %{epoch}:%{version}-%{release}
-
-%description devel
-The bind-devel package contains full version of the header files and libraries
-required for development with ISC BIND 9
-
-%package lite-devel
-Summary:  Lite version of header files and libraries needed for BIND DNS development
+Provides: bind-lite-devel = %{epoch}:%{version}-%{release}
+Obsoletes: bind-lite-devel < 32:9.11.23-1
 Requires: bind-libs-lite%{?_isa} = %{epoch}:%{version}-%{release}
 Requires: openssl-devel%{?_isa} libxml2-devel%{?_isa}
 # Not required by headers, but "isc-config.sh --libs isc" requires it
@@ -408,9 +402,9 @@ Requires:  json-c-devel%{?_isa}
 Requires:  fstrm-devel%{?_isa} protobuf-c-devel%{?_isa}
 %endif
 
-%description lite-devel
-The bind-lite-devel package contains lite version of the header
-files and libraries required for development with ISC BIND 9
+%description devel
+The bind-devel package contains full version of the header files and libraries
+required for development with ISC BIND 9
 
 %package chroot
 Summary:        A chroot runtime environment for the ISC BIND DNS server, named(8)
@@ -1425,22 +1419,20 @@ fi;
 %{_libdir}/libbind9.so
 %{_libdir}/libisccc.so
 %{_libdir}/liblwres.so
-%{_includedir}/bind9/config.h
-%{_includedir}/bind9/bind9
-%{_includedir}/bind9/isccc
 %{_includedir}/bind9/lwres
 %{_mandir}/man1/isc-config.sh.1*
 %{_mandir}/man1/bind9-config.1*
 %{_mandir}/man3/lwres*
 %{_bindir}/isc-config.sh
 %{_bindir}/bind9-config
-
-%files lite-devel
 %{_libdir}/libdns.so
 %{_libdir}/libirs.so
 %{_libdir}/libisc.so
 %{_libdir}/libisccfg.so
 %dir %{_includedir}/bind9
+%{_includedir}/bind9/config.h
+%{_includedir}/bind9/bind9
+%{_includedir}/bind9/isccc
 %{_includedir}/bind9/dns
 %{_includedir}/bind9/dst
 %{_includedir}/bind9/irs
@@ -1629,6 +1621,7 @@ fi;
 %changelog
 * Thu Sep 17 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.23-1
 - Update to 9.11.23
+- Merge bind-lite-devel into devel package
 
 * Tue Sep 01 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.22-2
 - Require libcap from devel package

From 293d93455e05945f11b4ee320db6a2fa4f31e43c Mon Sep 17 00:00:00 2001
From: Adrian Reber <adrian@lisas.de>
Date: Wed, 23 Sep 2020 17:05:51 +0200
Subject: [PATCH 207/460] Rebuilt for protobuf 3.13

---
 bind.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index 52318db..a5c8020 100644
--- a/bind.spec
+++ b/bind.spec
@@ -67,7 +67,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.11.23
-Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1619,6 +1619,9 @@ fi;
 %endif
 
 %changelog
+* Wed Sep 23 2020 Adrian Reber <adrian@lisas.de> - 32:9.11.23-2
+- Rebuilt for protobuf 3.13
+
 * Thu Sep 17 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.23-1
 - Update to 9.11.23
 - Merge bind-lite-devel into devel package

From 01c5de480b816ef4fcab8dbb15b5a71bad4d74ab Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 23 Oct 2020 17:20:10 +0200
Subject: [PATCH 208/460] Update to 9.11.24

DNS Flag Day 2020 - default ENDS buffer size changed to 1232.

https://downloads.isc.org/isc/bind9/9.11.24/RELEASE-NOTES-bind-9.11.24.html
---
 .gitignore                         |   2 +
 bind-9.10-dist-native-pkcs11.patch |  62 ++++---
 bind-9.11-fips-tests.patch         | 138 ++++++--------
 bind-9.11-rh1624100.patch          | 288 -----------------------------
 bind-9.11-rh1736762-5.patch        |  59 ------
 bind-9.11-rt46047.patch            | 109 +++++------
 bind-9.11-serve-stale.patch        | 198 ++++++++++----------
 bind-9.11.23-atomic.patch          | 178 ------------------
 bind.spec                          |  20 +-
 sources                            |   4 +-
 10 files changed, 251 insertions(+), 807 deletions(-)
 delete mode 100644 bind-9.11-rh1624100.patch
 delete mode 100644 bind-9.11-rh1736762-5.patch
 delete mode 100644 bind-9.11.23-atomic.patch

diff --git a/.gitignore b/.gitignore
index ef57da0..2333cba 100644
--- a/.gitignore
+++ b/.gitignore
@@ -116,3 +116,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.11.22.tar.gz.asc
 /bind-9.11.23.tar.gz
 /bind-9.11.23.tar.gz.asc
+/bind-9.11.24.tar.gz
+/bind-9.11.24.tar.gz.asc
diff --git a/bind-9.10-dist-native-pkcs11.patch b/bind-9.10-dist-native-pkcs11.patch
index df0d896..52909c0 100644
--- a/bind-9.10-dist-native-pkcs11.patch
+++ b/bind-9.10-dist-native-pkcs11.patch
@@ -1,5 +1,5 @@
 diff --git a/bin/Makefile.in b/bin/Makefile.in
-index f0c504a..ce7a2da 100644
+index a18b222..26a7e4e 100644
 --- a/bin/Makefile.in
 +++ b/bin/Makefile.in
 @@ -11,8 +11,8 @@ srcdir =	@srcdir@
@@ -14,7 +14,7 @@ index f0c504a..ce7a2da 100644
  
  @BIND9_MAKE_RULES@
 diff --git a/bin/dnssec-pkcs11/Makefile.in b/bin/dnssec-pkcs11/Makefile.in
-index 4b8ca13..32f4470 100644
+index 390aa0c..e59a118 100644
 --- a/bin/dnssec-pkcs11/Makefile.in
 +++ b/bin/dnssec-pkcs11/Makefile.in
 @@ -15,18 +15,18 @@ VERSION=@BIND9_VERSION@
@@ -130,7 +130,7 @@ index 4b8ca13..32f4470 100644
  
  clean distclean::
 diff --git a/bin/dnssec/Makefile.in b/bin/dnssec/Makefile.in
-index 4b8ca13..4175996 100644
+index 390aa0c..851a008 100644
 --- a/bin/dnssec/Makefile.in
 +++ b/bin/dnssec/Makefile.in
 @@ -17,7 +17,7 @@ VERSION=@BIND9_VERSION@
@@ -143,7 +143,7 @@ index 4b8ca13..4175996 100644
  CWARNINGS =
  
 diff --git a/bin/named-pkcs11/Makefile.in b/bin/named-pkcs11/Makefile.in
-index 70e5571..b5a4a6b 100644
+index 7a490fa..1f56836 100644
 --- a/bin/named-pkcs11/Makefile.in
 +++ b/bin/named-pkcs11/Makefile.in
 @@ -43,27 +43,27 @@ DLZDRIVER_INCLUDES =	@DLZ_DRIVER_INCLUDES@
@@ -268,7 +268,7 @@ index 70e5571..b5a4a6b 100644
  @DLZ_DRIVER_RULES@
  
 diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
-index 70e5571..4cfed4d 100644
+index 7a490fa..3d8655f 100644
 --- a/bin/named/Makefile.in
 +++ b/bin/named/Makefile.in
 @@ -48,7 +48,7 @@ CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
@@ -281,10 +281,10 @@ index 70e5571..4cfed4d 100644
  CWARNINGS =
  
 diff --git a/bin/pkcs11/Makefile.in b/bin/pkcs11/Makefile.in
-index a058c91..d4b689a 100644
+index 2c19e7e..8223d5e 100644
 --- a/bin/pkcs11/Makefile.in
 +++ b/bin/pkcs11/Makefile.in
-@@ -15,13 +15,13 @@ top_srcdir =	@top_srcdir@
+@@ -13,13 +13,13 @@ top_srcdir =	@top_srcdir@
  
  @BIND9_MAKE_INCLUDES@
  
@@ -302,10 +302,10 @@ index a058c91..d4b689a 100644
  DEPLIBS =	${ISCDEPLIBS}
  
 diff --git a/configure.ac b/configure.ac
-index 9b7d778..59ba20b 100644
+index c6715b4..8144268 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -1139,12 +1139,14 @@ AC_SUBST(USE_GSSAPI)
+@@ -1176,12 +1176,14 @@ AC_SUBST(USE_GSSAPI)
  AC_SUBST(DST_GSSAPI_INC)
  AC_SUBST(DNS_GSSAPI_LIBS)
  DNS_CRYPTO_LIBS="$DNS_GSSAPI_LIBS $DNS_CRYPTO_LIBS"
@@ -320,24 +320,26 @@ index 9b7d778..59ba20b 100644
  
  #
  # was --with-randomdev specified?
-@@ -1494,11 +1496,11 @@ AC_ARG_ENABLE(openssl-hash,
+@@ -1554,12 +1556,12 @@ AC_ARG_ENABLE(openssl-hash,
  AC_MSG_CHECKING(for OpenSSL library)
  OPENSSL_WARNING=
  openssldirs="/usr /usr/local /usr/local/ssl /opt/local /usr/pkg /usr/sfw"
 -if test "yes" = "$want_native_pkcs11"
 -then
 -	use_openssl="native_pkcs11"
+-	want_openssl_hash="no"
 -	AC_MSG_RESULT(use of native PKCS11 instead)
 -fi
-+# if test "yes" = "$want_native_pkcs11"
-+# then
-+# 	use_openssl="native_pkcs11"
-+# 	AC_MSG_RESULT(use of native PKCS11 instead)
-+# fi
++#if test "yes" = "$want_native_pkcs11"
++#then
++#	use_openssl="native_pkcs11"
++#	want_openssl_hash="no"
++#	AC_MSG_RESULT(use of native PKCS11 instead)
++#fi
  
  if test "auto" = "$use_openssl"
  then
-@@ -1511,6 +1513,7 @@ then
+@@ -1572,6 +1574,7 @@ then
  		fi
  	done
  fi
@@ -345,7 +347,7 @@ index 9b7d778..59ba20b 100644
  OPENSSL_ECDSA=""
  OPENSSL_GOST=""
  OPENSSL_ED25519=""
-@@ -1532,11 +1535,10 @@ case "$with_gost" in
+@@ -1593,11 +1596,10 @@ case "$with_gost" in
  		;;
  esac
  
@@ -360,7 +362,7 @@ index 9b7d778..59ba20b 100644
  		CRYPTOLIB="pkcs11"
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
-@@ -1546,7 +1548,9 @@ case "$use_openssl" in
+@@ -1607,7 +1609,9 @@ case "$use_openssl" in
  		OPENSSLGOSTLINKSRCS=""
  		OPENSSLLINKOBJS=""
  		OPENSSLLINKSRCS=""
@@ -371,7 +373,7 @@ index 9b7d778..59ba20b 100644
  	no)
  		AC_MSG_RESULT(no)
  		DST_OPENSSL_INC=""
-@@ -1578,7 +1582,7 @@ case "$use_openssl" in
+@@ -1639,7 +1643,7 @@ case "$use_openssl" in
  If you do not want OpenSSL, use --without-openssl])
  		;;
  	*)
@@ -380,7 +382,7 @@ index 9b7d778..59ba20b 100644
  		then
  			AC_MSG_RESULT()
  			AC_MSG_ERROR([OpenSSL and native PKCS11 cannot be used together.])
-@@ -2006,6 +2010,7 @@ AC_SUBST(OPENSSL_ED25519)
+@@ -2067,6 +2071,7 @@ AC_SUBST(OPENSSL_ED25519)
  AC_SUBST(OPENSSL_GOST)
  
  DNS_CRYPTO_LIBS="$DNS_CRYPTO_LIBS $DST_OPENSSL_LIBS"
@@ -388,7 +390,7 @@ index 9b7d778..59ba20b 100644
  
  ISC_PLATFORM_WANTAES="#undef ISC_PLATFORM_WANTAES"
  if test "yes" = "$with_aes"
-@@ -2291,6 +2296,7 @@ esac
+@@ -2353,6 +2358,7 @@ esac
  AC_SUBST(PKCS11LINKOBJS)
  AC_SUBST(PKCS11LINKSRCS)
  AC_SUBST(CRYPTO)
@@ -396,7 +398,7 @@ index 9b7d778..59ba20b 100644
  AC_SUBST(PKCS11_ECDSA)
  AC_SUBST(PKCS11_GOST)
  AC_SUBST(PKCS11_ED25519)
-@@ -5405,8 +5411,11 @@ AC_CONFIG_FILES([
+@@ -5501,8 +5507,11 @@ AC_CONFIG_FILES([
  	bin/delv/Makefile
  	bin/dig/Makefile
  	bin/dnssec/Makefile
@@ -408,7 +410,7 @@ index 9b7d778..59ba20b 100644
  	bin/nsupdate/Makefile
  	bin/pkcs11/Makefile
  	bin/python/Makefile
-@@ -5479,6 +5488,10 @@ AC_CONFIG_FILES([
+@@ -5575,6 +5584,10 @@ AC_CONFIG_FILES([
  	lib/dns/include/dns/Makefile
  	lib/dns/include/dst/Makefile
  	lib/dns/tests/Makefile
@@ -419,7 +421,7 @@ index 9b7d778..59ba20b 100644
  	lib/irs/Makefile
  	lib/irs/include/Makefile
  	lib/irs/include/irs/Makefile
-@@ -5503,6 +5516,24 @@ AC_CONFIG_FILES([
+@@ -5599,6 +5612,24 @@ AC_CONFIG_FILES([
  	lib/isc/unix/include/Makefile
  	lib/isc/unix/include/isc/Makefile
  	lib/isc/unix/include/pkcs11/Makefile
@@ -445,7 +447,7 @@ index 9b7d778..59ba20b 100644
  	lib/isccc/include/Makefile
  	lib/isccc/include/isccc/Makefile
 diff --git a/lib/Makefile.in b/lib/Makefile.in
-index 81270a0..bcb5312 100644
+index f089bea..3ed939b 100644
 --- a/lib/Makefile.in
 +++ b/lib/Makefile.in
 @@ -15,7 +15,7 @@ top_srcdir =	@top_srcdir@
@@ -458,7 +460,7 @@ index 81270a0..bcb5312 100644
  
  @BIND9_MAKE_RULES@
 diff --git a/lib/dns-pkcs11/Makefile.in b/lib/dns-pkcs11/Makefile.in
-index 7f09bd6..c388d9e 100644
+index 8fc4e94..5eefb14 100644
 --- a/lib/dns-pkcs11/Makefile.in
 +++ b/lib/dns-pkcs11/Makefile.in
 @@ -26,17 +26,16 @@ VERSION=@BIND9_VERSION@
@@ -533,7 +535,7 @@ index 7f09bd6..c388d9e 100644
  	rm -f include/dns/rdatastruct.h
  	rm -f dnstap.pb-c.c dnstap.pb-c.h
 diff --git a/lib/isc-pkcs11/Makefile.in b/lib/isc-pkcs11/Makefile.in
-index 8ad54bb..a3ecdfb 100644
+index 7e3e9ce..58d7466 100644
 --- a/lib/isc-pkcs11/Makefile.in
 +++ b/lib/isc-pkcs11/Makefile.in
 @@ -23,8 +23,8 @@ CINCLUDES =	-I${srcdir}/unix/include \
@@ -547,7 +549,7 @@ index 8ad54bb..a3ecdfb 100644
  CWARNINGS =
  
  # Alphabetically
-@@ -103,40 +103,40 @@ version.@O@: version.c
+@@ -107,40 +107,40 @@ version.@O@: version.c
  		-DLIBAGE=${LIBAGE} \
  		-c ${srcdir}/version.c
  
@@ -601,10 +603,10 @@ index 8ad54bb..a3ecdfb 100644
 +	rm -f libisc-pkcs11.@A@ libisc-pkcs11-nosymtbl.@A@ libisc-pkcs11.la \
 +	libisc-pkcs11-nosymtbl.la timestamp
 diff --git a/make/includes.in b/make/includes.in
-index fa86ad1..3cfbe9f 100644
+index 66efe68..966671f 100644
 --- a/make/includes.in
 +++ b/make/includes.in
-@@ -43,3 +43,13 @@ BIND9_INCLUDES = @BIND9_BIND9_BUILDINCLUDE@ \
+@@ -41,3 +41,13 @@ BIND9_INCLUDES = @BIND9_BIND9_BUILDINCLUDE@ \
  
  TEST_INCLUDES = \
  	-I${top_srcdir}/lib/tests/include
diff --git a/bind-9.11-fips-tests.patch b/bind-9.11-fips-tests.patch
index c08fca6..592b0d2 100644
--- a/bind-9.11-fips-tests.patch
+++ b/bind-9.11-fips-tests.patch
@@ -1,4 +1,4 @@
-From da45a97312a63f815b295167c3f3abb9fe8941a3 Mon Sep 17 00:00:00 2001
+From 14ad3e0b42bc999072d30268396412bec158a22d Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 2 Aug 2018 23:46:45 +0200
 Subject: [PATCH] FIPS tests changes
@@ -96,17 +96,15 @@ Date:   Wed Mar 7 10:44:23 2018 +0100
  bin/tests/system/rndc/setup.sh                |  2 +-
  bin/tests/system/rndc/tests.sh                | 23 ++++---
  bin/tests/system/tsig/ns1/named.conf.in       | 10 +--
- bin/tests/system/tsig/ns1/rndc5.conf.in       | 10 +++
  bin/tests/system/tsig/setup.sh                |  5 ++
  bin/tests/system/tsig/tests.sh                | 65 +++++++++++-------
  bin/tests/system/tsiggss/setup.sh             |  2 +-
  bin/tests/system/upforwd/ns1/named.conf.in    |  2 +-
  bin/tests/system/upforwd/tests.sh             |  2 +-
- 44 files changed, 230 insertions(+), 170 deletions(-)
- create mode 100644 bin/tests/system/tsig/ns1/rndc5.conf.in
+ 43 files changed, 220 insertions(+), 170 deletions(-)
 
 diff --git a/bin/tests/system/acl/ns2/named1.conf.in b/bin/tests/system/acl/ns2/named1.conf.in
-index 0ea6502..026db3f 100644
+index 9999ada..e3f8d0e 100644
 --- a/bin/tests/system/acl/ns2/named1.conf.in
 +++ b/bin/tests/system/acl/ns2/named1.conf.in
 @@ -33,12 +33,12 @@ options {
@@ -125,7 +123,7 @@ index 0ea6502..026db3f 100644
  };
  
 diff --git a/bin/tests/system/acl/ns2/named2.conf.in b/bin/tests/system/acl/ns2/named2.conf.in
-index b877880..d8f50be 100644
+index f8ec34e..d2d6ad3 100644
 --- a/bin/tests/system/acl/ns2/named2.conf.in
 +++ b/bin/tests/system/acl/ns2/named2.conf.in
 @@ -33,12 +33,12 @@ options {
@@ -144,7 +142,7 @@ index b877880..d8f50be 100644
  };
  
 diff --git a/bin/tests/system/acl/ns2/named3.conf.in b/bin/tests/system/acl/ns2/named3.conf.in
-index 0a95062..aa54088 100644
+index 2acb813..6a00344 100644
 --- a/bin/tests/system/acl/ns2/named3.conf.in
 +++ b/bin/tests/system/acl/ns2/named3.conf.in
 @@ -33,17 +33,17 @@ options {
@@ -169,7 +167,7 @@ index 0a95062..aa54088 100644
  };
  
 diff --git a/bin/tests/system/acl/ns2/named4.conf.in b/bin/tests/system/acl/ns2/named4.conf.in
-index 7cdcb6e..606a345 100644
+index bca3ee1..5913420 100644
 --- a/bin/tests/system/acl/ns2/named4.conf.in
 +++ b/bin/tests/system/acl/ns2/named4.conf.in
 @@ -33,12 +33,12 @@ options {
@@ -188,7 +186,7 @@ index 7cdcb6e..606a345 100644
  };
  
 diff --git a/bin/tests/system/acl/ns2/named5.conf.in b/bin/tests/system/acl/ns2/named5.conf.in
-index 4b4e050..0e679a8 100644
+index 9ef8171..5ae8d38 100644
 --- a/bin/tests/system/acl/ns2/named5.conf.in
 +++ b/bin/tests/system/acl/ns2/named5.conf.in
 @@ -34,12 +34,12 @@ options {
@@ -207,7 +205,7 @@ index 4b4e050..0e679a8 100644
  };
  
 diff --git a/bin/tests/system/acl/tests.sh b/bin/tests/system/acl/tests.sh
-index 09f31f2..f88f0d4 100644
+index 2ee34a0..a73a54e 100644
 --- a/bin/tests/system/acl/tests.sh
 +++ b/bin/tests/system/acl/tests.sh
 @@ -22,14 +22,14 @@ echo_i "testing basic ACL processing"
@@ -333,7 +331,7 @@ index 09f31f2..f88f0d4 100644
  
  echo_i "testing allow-query-on ACL processing"
 diff --git a/bin/tests/system/allow-query/ns2/named10.conf.in b/bin/tests/system/allow-query/ns2/named10.conf.in
-index 1569913..e9c5c2d 100644
+index a579f32..3b8f853 100644
 --- a/bin/tests/system/allow-query/ns2/named10.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named10.conf.in
 @@ -12,7 +12,7 @@
@@ -346,7 +344,7 @@ index 1569913..e9c5c2d 100644
  };
  
 diff --git a/bin/tests/system/allow-query/ns2/named11.conf.in b/bin/tests/system/allow-query/ns2/named11.conf.in
-index 18ac91c..2b1c873 100644
+index 166afa1..997ece9 100644
 --- a/bin/tests/system/allow-query/ns2/named11.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named11.conf.in
 @@ -12,12 +12,12 @@
@@ -365,7 +363,7 @@ index 18ac91c..2b1c873 100644
  };
  
 diff --git a/bin/tests/system/allow-query/ns2/named12.conf.in b/bin/tests/system/allow-query/ns2/named12.conf.in
-index b824844..dd48945 100644
+index 25271a5..a9cb65d 100644
 --- a/bin/tests/system/allow-query/ns2/named12.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named12.conf.in
 @@ -12,7 +12,7 @@
@@ -378,7 +376,7 @@ index b824844..dd48945 100644
  };
  
 diff --git a/bin/tests/system/allow-query/ns2/named30.conf.in b/bin/tests/system/allow-query/ns2/named30.conf.in
-index aeb1540..bfce58b 100644
+index c7c8254..f165e65 100644
 --- a/bin/tests/system/allow-query/ns2/named30.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named30.conf.in
 @@ -12,7 +12,7 @@
@@ -391,7 +389,7 @@ index aeb1540..bfce58b 100644
  };
  
 diff --git a/bin/tests/system/allow-query/ns2/named31.conf.in b/bin/tests/system/allow-query/ns2/named31.conf.in
-index d4b7432..e0f5252 100644
+index 567bbcc..4fd2035 100644
 --- a/bin/tests/system/allow-query/ns2/named31.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named31.conf.in
 @@ -12,12 +12,12 @@
@@ -410,7 +408,7 @@ index d4b7432..e0f5252 100644
  };
  
 diff --git a/bin/tests/system/allow-query/ns2/named32.conf.in b/bin/tests/system/allow-query/ns2/named32.conf.in
-index c025938..87afb3f 100644
+index b75161f..7b254e6 100644
 --- a/bin/tests/system/allow-query/ns2/named32.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named32.conf.in
 @@ -12,7 +12,7 @@
@@ -423,7 +421,7 @@ index c025938..87afb3f 100644
  };
  
 diff --git a/bin/tests/system/allow-query/ns2/named40.conf.in b/bin/tests/system/allow-query/ns2/named40.conf.in
-index d83b376..d726b94 100644
+index 9e17818..22f5001 100644
 --- a/bin/tests/system/allow-query/ns2/named40.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named40.conf.in
 @@ -16,12 +16,12 @@ acl accept { 10.53.0.2; };
@@ -442,7 +440,7 @@ index d83b376..d726b94 100644
  };
  
 diff --git a/bin/tests/system/allow-query/tests.sh b/bin/tests/system/allow-query/tests.sh
-index fb6059d..f960156 100644
+index 791a1a4..95cd971 100644
 --- a/bin/tests/system/allow-query/tests.sh
 +++ b/bin/tests/system/allow-query/tests.sh
 @@ -190,7 +190,7 @@ rndc_reload
@@ -527,7 +525,7 @@ index fb6059d..f960156 100644
  grep '^a.keydisallow.example' dig.out.ns2.$n > /dev/null && ret=1
  if [ $ret != 0 ]; then echo_i "failed"; fi
 diff --git a/bin/tests/system/catz/ns1/named.conf.in b/bin/tests/system/catz/ns1/named.conf.in
-index 74b7d37..c353766 100644
+index 6856ec7..0ac1fa3 100644
 --- a/bin/tests/system/catz/ns1/named.conf.in
 +++ b/bin/tests/system/catz/ns1/named.conf.in
 @@ -61,5 +61,5 @@ zone "catalog4.example" {
@@ -538,7 +536,7 @@ index 74b7d37..c353766 100644
 +	algorithm hmac-sha256;
  };
 diff --git a/bin/tests/system/catz/ns2/named.conf.in b/bin/tests/system/catz/ns2/named.conf.in
-index ee83efb..35ced08 100644
+index dd3a9dc..77b8d96 100644
 --- a/bin/tests/system/catz/ns2/named.conf.in
 +++ b/bin/tests/system/catz/ns2/named.conf.in
 @@ -70,5 +70,5 @@ zone "catalog4.example" {
@@ -549,7 +547,7 @@ index ee83efb..35ced08 100644
 +	algorithm hmac-sha256;
  };
 diff --git a/bin/tests/system/checkconf/bad-tsig.conf b/bin/tests/system/checkconf/bad-tsig.conf
-index 21be03e..e57c308 100644
+index 338dddb..90cd424 100644
 --- a/bin/tests/system/checkconf/bad-tsig.conf
 +++ b/bin/tests/system/checkconf/bad-tsig.conf
 @@ -11,7 +11,7 @@
@@ -562,7 +560,7 @@ index 21be03e..e57c308 100644
  };
  
 diff --git a/bin/tests/system/checkconf/good.conf b/bin/tests/system/checkconf/good.conf
-index 09d188a..7cf4030 100644
+index 2282f87..1359cf3 100644
 --- a/bin/tests/system/checkconf/good.conf
 +++ b/bin/tests/system/checkconf/good.conf
 @@ -159,6 +159,6 @@ dyndb "name" "library.so" {
@@ -574,7 +572,7 @@ index 09d188a..7cf4030 100644
  	secret "qwertyuiopasdfgh";
  };
 diff --git a/bin/tests/system/digdelv/ns2/example.db b/bin/tests/system/digdelv/ns2/example.db
-index f4e30f5..9f53e31 100644
+index b66207a..359b220 100644
 --- a/bin/tests/system/digdelv/ns2/example.db
 +++ b/bin/tests/system/digdelv/ns2/example.db
 @@ -38,12 +38,15 @@ foo			SSHFP	2 1 123456789abcdef67890123456789abcdef67890
@@ -600,7 +598,7 @@ index f4e30f5..9f53e31 100644
  ; TTL of 3 weeks
  weeks		1814400	A	10.53.0.2
 diff --git a/bin/tests/system/digdelv/tests.sh b/bin/tests/system/digdelv/tests.sh
-index 3d1010e..fa9eb92 100644
+index 2109001..ded5557 100644
 --- a/bin/tests/system/digdelv/tests.sh
 +++ b/bin/tests/system/digdelv/tests.sh
 @@ -155,7 +155,7 @@ if [ -x "$DIG" ] ; then
@@ -648,7 +646,7 @@ index 3d1010e..fa9eb92 100644
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
  
-@@ -799,7 +799,7 @@ if [ -x ${DELV} ] ; then
+@@ -827,7 +827,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +rrcomments works for DNSKEY($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +rrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
@@ -657,7 +655,7 @@ index 3d1010e..fa9eb92 100644
    check_ttl_range delv.out.test$n "DNSKEY" 300 || ret=1
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
-@@ -808,7 +808,7 @@ if [ -x ${DELV} ] ; then
+@@ -836,7 +836,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +short +rrcomments works for DNSKEY ($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
@@ -666,7 +664,7 @@ index 3d1010e..fa9eb92 100644
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
  
-@@ -816,7 +816,7 @@ if [ -x ${DELV} ] ; then
+@@ -844,7 +844,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +short +rrcomments works ($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
@@ -675,7 +673,7 @@ index 3d1010e..fa9eb92 100644
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
  
-@@ -824,7 +824,7 @@ if [ -x ${DELV} ] ; then
+@@ -852,7 +852,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +short +nosplit works ($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +short +nosplit DNSKEY dnskey.example > delv.out.test$n || ret=1
@@ -684,7 +682,7 @@ index 3d1010e..fa9eb92 100644
    if test `wc -l < delv.out.test$n` != 1 ; then ret=1 ; fi
    f=`awk '{print NF}' < delv.out.test$n`
    test "${f:-0}" -eq 14 || ret=1
-@@ -835,7 +835,7 @@ if [ -x ${DELV} ] ; then
+@@ -863,7 +863,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +short +nosplit +norrcomments works ($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +short +nosplit +norrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
@@ -694,7 +692,7 @@ index 3d1010e..fa9eb92 100644
    f=`awk '{print NF}' < delv.out.test$n`
    test "${f:-0}" -eq 4 || ret=1
 diff --git a/bin/tests/system/dlv/ns1/sign.sh b/bin/tests/system/dlv/ns1/sign.sh
-index 606e7cc..a3a0d60 100755
+index 14ca5db..3f522d0 100755
 --- a/bin/tests/system/dlv/ns1/sign.sh
 +++ b/bin/tests/system/dlv/ns1/sign.sh
 @@ -23,8 +23,8 @@ infile=root.db.in
@@ -709,7 +707,7 @@ index 606e7cc..a3a0d60 100755
  cat $infile $keyname1.key $keyname2.key >$zonefile
  
 diff --git a/bin/tests/system/dlv/ns2/sign.sh b/bin/tests/system/dlv/ns2/sign.sh
-index 9825c57..202c978 100755
+index d870798..b0ab372 100755
 --- a/bin/tests/system/dlv/ns2/sign.sh
 +++ b/bin/tests/system/dlv/ns2/sign.sh
 @@ -24,8 +24,8 @@ zonefile=druz.db
@@ -724,7 +722,7 @@ index 9825c57..202c978 100755
  cat $infile $keyname1.key $keyname2.key >$zonefile
  
 diff --git a/bin/tests/system/dlv/ns6/sign.sh b/bin/tests/system/dlv/ns6/sign.sh
-index 1e39862..4ed19ac 100755
+index ba39f90..f20a2dd 100755
 --- a/bin/tests/system/dlv/ns6/sign.sh
 +++ b/bin/tests/system/dlv/ns6/sign.sh
 @@ -16,13 +16,15 @@ SYSTESTDIR=dlv
@@ -911,7 +909,7 @@ index 1e39862..4ed19ac 100755
  cat $infile $keyname1.key $keyname2.key >$zonefile
  
 diff --git a/bin/tests/system/dnssec/ns2/sign.sh b/bin/tests/system/dnssec/ns2/sign.sh
-index 7f95c8a..3a9251b 100644
+index e28b3f1..29c169b 100644
 --- a/bin/tests/system/dnssec/ns2/sign.sh
 +++ b/bin/tests/system/dnssec/ns2/sign.sh
 @@ -126,8 +126,8 @@ zone=in-addr.arpa.
@@ -944,7 +942,7 @@ index 7f95c8a..3a9251b 100644
  cat $dlvinfile $dlvkeyname.key $dlvsetfile > $dlvzonefile
  
 diff --git a/bin/tests/system/dnssec/ns5/trusted.conf.bad b/bin/tests/system/dnssec/ns5/trusted.conf.bad
-index ed30460..e6b1126 100644
+index 75cf699..b4d848c 100644
 --- a/bin/tests/system/dnssec/ns5/trusted.conf.bad
 +++ b/bin/tests/system/dnssec/ns5/trusted.conf.bad
 @@ -10,5 +10,5 @@
@@ -955,7 +953,7 @@ index ed30460..e6b1126 100644
 +    "." 256 3 8 "AwEAAarwAdjV4gIhpBCjXVAScRFEx3co7k8smJdxrnqoGsl5NB7EZ9jRdgvCXbJn6v8y9jlNWVHvaC8ilhfhLh0A1vLWiWv4ijd/12xcnrY7xpG7Cu3YkxUxaXJ7Jdg/Iw1+9mGgXF1v4UbCIcw/3U3cxyk7OxYg+VSb5KBAQSR0upxV";
  };
 diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh
-index 6f7eaa7..bd2778b 100644
+index 3e8e4d5..da692f9 100644
 --- a/bin/tests/system/dnssec/tests.sh
 +++ b/bin/tests/system/dnssec/tests.sh
 @@ -3257,8 +3257,8 @@ do
@@ -970,7 +968,7 @@ index 6f7eaa7..bd2778b 100644
  	8) size="-b 512";;
  	10) size="-b 1024";;
 diff --git a/bin/tests/system/feature-test.c b/bin/tests/system/feature-test.c
-index c1249ed..20a3139 100644
+index 5e473ab..b08692e 100644
 --- a/bin/tests/system/feature-test.c
 +++ b/bin/tests/system/feature-test.c
 @@ -19,6 +19,7 @@
@@ -982,14 +980,14 @@ index c1249ed..20a3139 100644
  
  #ifdef WIN32
 @@ -47,6 +48,7 @@ usage() {
- 	fprintf(stderr, "	--have-geoip2\n");
- 	fprintf(stderr, "	--have-libxml2\n");
- 	fprintf(stderr, "	--ipv6only=no\n");
-+	fprintf(stderr, "       --md5\n");
- 	fprintf(stderr, "	--rpz-nsdname\n");
- 	fprintf(stderr, "	--rpz-nsip\n");
- 	fprintf(stderr, "	--with-idn\n");
-@@ -155,6 +157,18 @@ main(int argc, char **argv) {
+ 	fprintf(stderr, "\t--have-geoip\n");
+ 	fprintf(stderr, "\t--have-libxml2\n");
+ 	fprintf(stderr, "\t--ipv6only=no\n");
++	fprintf(stderr, "\t--md5\n");
+ 	fprintf(stderr, "\t--rpz-log-qtype-qclass\n");
+ 	fprintf(stderr, "\t--rpz-nsdname\n");
+ 	fprintf(stderr, "\t--rpz-nsip\n");
+@@ -194,6 +196,18 @@ main(int argc, char **argv) {
  #endif
  	}
  
@@ -1009,7 +1007,7 @@ index c1249ed..20a3139 100644
  #ifdef ENABLE_RPZ_NSIP
  		return (0);
 diff --git a/bin/tests/system/filter-aaaa/ns1/sign.sh b/bin/tests/system/filter-aaaa/ns1/sign.sh
-index f755581..4a7d890 100755
+index 479f98c..4d4a765 100755
 --- a/bin/tests/system/filter-aaaa/ns1/sign.sh
 +++ b/bin/tests/system/filter-aaaa/ns1/sign.sh
 @@ -21,8 +21,8 @@ infile=signed.db.in
@@ -1024,7 +1022,7 @@ index f755581..4a7d890 100755
  cat $infile $keyname1.key $keyname2.key >$zonefile
  
 diff --git a/bin/tests/system/filter-aaaa/ns4/sign.sh b/bin/tests/system/filter-aaaa/ns4/sign.sh
-index f755581..4a7d890 100755
+index 479f98c..4d4a765 100755
 --- a/bin/tests/system/filter-aaaa/ns4/sign.sh
 +++ b/bin/tests/system/filter-aaaa/ns4/sign.sh
 @@ -21,8 +21,8 @@ infile=signed.db.in
@@ -1039,7 +1037,7 @@ index f755581..4a7d890 100755
  cat $infile $keyname1.key $keyname2.key >$zonefile
  
 diff --git a/bin/tests/system/notify/ns5/named.conf.in b/bin/tests/system/notify/ns5/named.conf.in
-index cfcfe8f..0a1614d 100644
+index 157ef16..b802288 100644
 --- a/bin/tests/system/notify/ns5/named.conf.in
 +++ b/bin/tests/system/notify/ns5/named.conf.in
 @@ -10,17 +10,17 @@
@@ -1064,7 +1062,7 @@ index cfcfe8f..0a1614d 100644
  };
  
 diff --git a/bin/tests/system/notify/tests.sh b/bin/tests/system/notify/tests.sh
-index c112d2c..987b6de 100644
+index f9fd3f5..916af75 100644
 --- a/bin/tests/system/notify/tests.sh
 +++ b/bin/tests/system/notify/tests.sh
 @@ -212,16 +212,16 @@ ret=0
@@ -1088,7 +1086,7 @@ index c112d2c..987b6de 100644
  	grep "test string" dig.out.b.ns5.test$n > /dev/null &&
  	grep "test string" dig.out.c.ns5.test$n > /dev/null &&
 diff --git a/bin/tests/system/nsupdate/ns1/named.conf.in b/bin/tests/system/nsupdate/ns1/named.conf.in
-index e90907a..540a984 100644
+index b0ded3a..cb80269 100644
 --- a/bin/tests/system/nsupdate/ns1/named.conf.in
 +++ b/bin/tests/system/nsupdate/ns1/named.conf.in
 @@ -32,7 +32,7 @@ controls {
@@ -1101,7 +1099,7 @@ index e90907a..540a984 100644
  };
  
 diff --git a/bin/tests/system/nsupdate/ns2/named.conf.in b/bin/tests/system/nsupdate/ns2/named.conf.in
-index 4549184..cb7dccd 100644
+index e6e2382..b0a94e0 100644
 --- a/bin/tests/system/nsupdate/ns2/named.conf.in
 +++ b/bin/tests/system/nsupdate/ns2/named.conf.in
 @@ -33,7 +33,7 @@ controls {
@@ -1114,7 +1112,7 @@ index 4549184..cb7dccd 100644
  };
  
 diff --git a/bin/tests/system/nsupdate/setup.sh b/bin/tests/system/nsupdate/setup.sh
-index a35b8ee..8383162 100644
+index 6fbf1d7..a712b17 100644
 --- a/bin/tests/system/nsupdate/setup.sh
 +++ b/bin/tests/system/nsupdate/setup.sh
 @@ -53,7 +53,12 @@ EOF
@@ -1132,10 +1130,10 @@ index a35b8ee..8383162 100644
  $DDNSCONFGEN -q -r $RANDFILE -a hmac-sha224 -k sha224-key -z keytests.nil > ns1/sha224.key
  $DDNSCONFGEN -q -r $RANDFILE -a hmac-sha256 -k sha256-key -z keytests.nil > ns1/sha256.key
 diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh
-index 14952c8..5c51972 100755
+index 6b2c8f6..96ad95e 100755
 --- a/bin/tests/system/nsupdate/tests.sh
 +++ b/bin/tests/system/nsupdate/tests.sh
-@@ -760,7 +760,14 @@ fi
+@@ -788,7 +788,14 @@ fi
  n=`expr $n + 1`
  ret=0
  echo_i "check TSIG key algorithms ($n)"
@@ -1151,7 +1149,7 @@ index 14952c8..5c51972 100755
      $NSUPDATE -k ns1/${alg}.key <<END > /dev/null || ret=1
  server 10.53.0.1 ${PORT}
  update add ${alg}.keytests.nil. 600 A 10.10.10.3
-@@ -768,7 +775,7 @@ send
+@@ -796,7 +803,7 @@ send
  END
  done
  sleep 2
@@ -1161,7 +1159,7 @@ index 14952c8..5c51972 100755
  done
  if [ $ret -ne 0 ]; then
 diff --git a/bin/tests/system/rndc/setup.sh b/bin/tests/system/rndc/setup.sh
-index 8521ff8..565a1d7 100644
+index 2eb2cd5..36f5114 100644
 --- a/bin/tests/system/rndc/setup.sh
 +++ b/bin/tests/system/rndc/setup.sh
 @@ -35,7 +35,7 @@ make_key () {
@@ -1174,7 +1172,7 @@ index 8521ff8..565a1d7 100644
  make_key 3 ${EXTRAPORT3} hmac-sha224
  make_key 4 ${EXTRAPORT4} hmac-sha256
 diff --git a/bin/tests/system/rndc/tests.sh b/bin/tests/system/rndc/tests.sh
-index 57e066d..186a723 100644
+index 4e25e51..cb8934c 100644
 --- a/bin/tests/system/rndc/tests.sh
 +++ b/bin/tests/system/rndc/tests.sh
 @@ -348,15 +348,20 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -1208,7 +1206,7 @@ index 57e066d..186a723 100644
  n=`expr $n + 1`
  echo_i "testing rndc with hmac-sha1 ($n)"
 diff --git a/bin/tests/system/tsig/ns1/named.conf.in b/bin/tests/system/tsig/ns1/named.conf.in
-index fbf30c6..f61657d 100644
+index 4905ffd..958d9fb 100644
 --- a/bin/tests/system/tsig/ns1/named.conf.in
 +++ b/bin/tests/system/tsig/ns1/named.conf.in
 @@ -21,10 +21,7 @@ options {
@@ -1235,24 +1233,8 @@ index fbf30c6..f61657d 100644
  
  key "sha1-trunc" {
  	secret "FrSt77yPTFx6hTs4i2tKLB9LmE0=";
-diff --git a/bin/tests/system/tsig/ns1/rndc5.conf.in b/bin/tests/system/tsig/ns1/rndc5.conf.in
-new file mode 100644
-index 0000000..0682194
---- /dev/null
-+++ b/bin/tests/system/tsig/ns1/rndc5.conf.in
-@@ -0,0 +1,10 @@
-+# Conditionally included when support for MD5 is available
-+key "md5" {
-+	secret "97rnFx24Tfna4mHPfgnerA==";
-+	algorithm hmac-md5;
-+};
-+
-+key "md5-trunc" {
-+	secret "97rnFx24Tfna4mHPfgnerA==";
-+	algorithm hmac-md5-80;
-+};
 diff --git a/bin/tests/system/tsig/setup.sh b/bin/tests/system/tsig/setup.sh
-index 9a8ab2e..1311689 100644
+index f42aa79..bfcf4a6 100644
 --- a/bin/tests/system/tsig/setup.sh
 +++ b/bin/tests/system/tsig/setup.sh
 @@ -15,3 +15,8 @@ SYSTEMTESTTOP=..
@@ -1265,7 +1247,7 @@ index 9a8ab2e..1311689 100644
 +	cat ns1/rndc5.conf.in >> ns1/named.conf
 +fi
 diff --git a/bin/tests/system/tsig/tests.sh b/bin/tests/system/tsig/tests.sh
-index 526dbca..bf359a4 100644
+index ed41e1d..98c542e 100644
 --- a/bin/tests/system/tsig/tests.sh
 +++ b/bin/tests/system/tsig/tests.sh
 @@ -26,20 +26,25 @@ sha512="jI/Pa4qRu96t76Pns5Z/Ndxbn3QCkwcxLOgt9vgvnJw5wqTRvNyk3FtD6yIMd1dWVlqZ+Y4f
@@ -1356,7 +1338,7 @@ index 526dbca..bf359a4 100644
  
  echo_i "fetching using hmac-sha1-80 (BADTRUNC)"
 diff --git a/bin/tests/system/tsiggss/setup.sh b/bin/tests/system/tsiggss/setup.sh
-index 49510b4..8d8bb2a 100644
+index f04c907..09da5f9 100644
 --- a/bin/tests/system/tsiggss/setup.sh
 +++ b/bin/tests/system/tsiggss/setup.sh
 @@ -16,5 +16,5 @@ test -r $RANDFILE || $GENRANDOM $RANDOMSIZE $RANDFILE
@@ -1367,7 +1349,7 @@ index 49510b4..8d8bb2a 100644
 +key=`$KEYGEN -Cq -K ns1 -a DSA -b 1024 -r $RANDFILE -n HOST -T KEY key.example.nil.`
  cat ns1/example.nil.db.in ns1/${key}.key > ns1/example.nil.db
 diff --git a/bin/tests/system/upforwd/ns1/named.conf.in b/bin/tests/system/upforwd/ns1/named.conf.in
-index e0a30cd..6a77b1c 100644
+index 4ddd7a4..238f52a 100644
 --- a/bin/tests/system/upforwd/ns1/named.conf.in
 +++ b/bin/tests/system/upforwd/ns1/named.conf.in
 @@ -10,7 +10,7 @@
@@ -1380,7 +1362,7 @@ index e0a30cd..6a77b1c 100644
  };
  
 diff --git a/bin/tests/system/upforwd/tests.sh b/bin/tests/system/upforwd/tests.sh
-index b0694bb..9adae82 100644
+index 1cf8d3b..f4c3216 100644
 --- a/bin/tests/system/upforwd/tests.sh
 +++ b/bin/tests/system/upforwd/tests.sh
 @@ -68,7 +68,7 @@ if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
diff --git a/bind-9.11-rh1624100.patch b/bind-9.11-rh1624100.patch
deleted file mode 100644
index 0775820..0000000
--- a/bind-9.11-rh1624100.patch
+++ /dev/null
@@ -1,288 +0,0 @@
-From f27598743ab6e03271e26f23da4beba748d19c60 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@sury.org>
-Date: Wed, 25 Apr 2018 14:04:31 +0200
-Subject: [PATCH] Replace isc_safe routines with their OpenSSL counter parts
-
-(cherry picked from commit 66ba2fdad583d962a1f4971c85d58381f0849e4d)
-
-Remove isc_safe_memcompare, it's not needed anywhere and can't be replaced with CRYPTO_memcmp()
-
-(cherry picked from commit b105ccee68ccc3c18e6ea530063b3c8e5a42571c)
-
-Fix the isc_safe_memwipe() usage with (NULL, >0)
-
-(cherry picked from commit 083461d3329ff6f2410745848a926090586a9846)
----
- bin/dnssec/dnssec-signzone.c |  2 +-
- lib/dns/nsec3.c              |  4 +-
- lib/dns/spnego.c             |  4 +-
- lib/isc/Makefile.in          |  8 +---
- lib/isc/include/isc/safe.h   | 18 ++------
- lib/isc/safe.c               | 83 ------------------------------------
- lib/isc/tests/safe_test.c    | 18 --------
- 7 files changed, 11 insertions(+), 126 deletions(-)
- delete mode 100644 lib/isc/safe.c
-
-diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c
-index 6dded0c..a9c5557 100644
---- a/bin/dnssec/dnssec-signzone.c
-+++ b/bin/dnssec/dnssec-signzone.c
-@@ -784,7 +784,7 @@ hashlist_add_dns_name(hashlist_t *l, /*const*/ dns_name_t *name,
- 
- static int
- hashlist_comp(const void *a, const void *b) {
--	return (isc_safe_memcompare(a, b, hash_length + 1));
-+	return (memcmp(a, b, hash_length + 1));
- }
- 
- static void
-diff --git a/lib/dns/nsec3.c b/lib/dns/nsec3.c
-index 6ae7ca8..01426d6 100644
---- a/lib/dns/nsec3.c
-+++ b/lib/dns/nsec3.c
-@@ -1963,7 +1963,7 @@ dns_nsec3_noexistnodata(dns_rdatatype_t type, dns_name_t* name,
- 	 * Work out what this NSEC3 covers.
- 	 * Inside (<0) or outside (>=0).
- 	 */
--	scope = isc_safe_memcompare(owner, nsec3.next, nsec3.next_length);
-+	scope = memcmp(owner, nsec3.next, nsec3.next_length);
- 
- 	/*
- 	 * Prepare to compute all the hashes.
-@@ -1987,7 +1987,7 @@ dns_nsec3_noexistnodata(dns_rdatatype_t type, dns_name_t* name,
- 			return (ISC_R_IGNORE);
- 		}
- 
--		order = isc_safe_memcompare(hash, owner, length);
-+		order = memcmp(hash, owner, length);
- 		if (first && order == 0) {
- 			/*
- 			 * The hashes are the same.
-diff --git a/lib/dns/spnego.c b/lib/dns/spnego.c
-index ad77f24..670982a 100644
---- a/lib/dns/spnego.c
-+++ b/lib/dns/spnego.c
-@@ -371,7 +371,7 @@ gssapi_spnego_decapsulate(OM_uint32 *,
- 
- /* mod_auth_kerb.c */
- 
--static int
-+static isc_boolean_t
- cmp_gss_type(gss_buffer_t token, gss_OID gssoid)
- {
- 	unsigned char *p;
-@@ -395,7 +395,7 @@ cmp_gss_type(gss_buffer_t token, gss_OID gssoid)
- 	if (((OM_uint32) *p++) != gssoid->length)
- 		return (GSS_S_DEFECTIVE_TOKEN);
- 
--	return (isc_safe_memcompare(p, gssoid->elements, gssoid->length));
-+	return (!isc_safe_memequal(p, gssoid->elements, gssoid->length));
- }
- 
- /* accept_sec_context.c */
-diff --git a/lib/isc/Makefile.in b/lib/isc/Makefile.in
-index 149552a..8529a86 100644
---- a/lib/isc/Makefile.in
-+++ b/lib/isc/Makefile.in
-@@ -60,7 +60,7 @@ OBJS =		@ISC_EXTRA_OBJS@ @ISC_PK11_O@ @ISC_PK11_RESULT_O@ \
- 		parseint.@O@ portset.@O@ quota.@O@ radix.@O@ random.@O@ \
- 		ratelimiter.@O@ refcount.@O@ region.@O@ regex.@O@ result.@O@ \
- 		rwlock.@O@ \
--		safe.@O@ serial.@O@ siphash.@O@ sha1.@O@ sha2.@O@ sockaddr.@O@ stats.@O@ \
-+		serial.@O@ siphash.@O@ sha1.@O@ sha2.@O@ sockaddr.@O@ stats.@O@ \
- 		string.@O@ strtoul.@O@ symtab.@O@ task.@O@ taskpool.@O@ \
- 		tm.@O@ timer.@O@ utf8.@O@ version.@O@ \
- 		${UNIXOBJS} ${NLSOBJS} ${THREADOBJS}
-@@ -79,7 +79,7 @@ SRCS =		@ISC_EXTRA_SRCS@ @ISC_PK11_C@ @ISC_PK11_RESULT_C@ \
- 		netaddr.c netscope.c pool.c ondestroy.c \
- 		parseint.c portset.c quota.c radix.c random.c ${CHACHASRCS} \
- 		ratelimiter.c refcount.c region.c regex.c result.c rwlock.c \
--		safe.c serial.c siphash.c sha1.c sha2.c sockaddr.c stats.c string.c \
-+		serial.c siphash.c sha1.c sha2.c sockaddr.c stats.c string.c \
- 		strtoul.c symtab.c task.c taskpool.c timer.c \
- 		tm.c utf8.c version.c
- 
-@@ -95,10 +95,6 @@ TESTDIRS =	@UNITTESTS@
- 
- @BIND9_MAKE_RULES@
- 
--safe.@O@: safe.c
--	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} @CCNOOPT@ \
--		-c ${srcdir}/safe.c
--
- version.@O@: version.c
- 	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} \
- 		-DVERSION=\"${VERSION}\" \
-diff --git a/lib/isc/include/isc/safe.h b/lib/isc/include/isc/safe.h
-index 66ed08b..88b8f47 100644
---- a/lib/isc/include/isc/safe.h
-+++ b/lib/isc/include/isc/safe.h
-@@ -15,29 +15,19 @@
- 
- /*! \file isc/safe.h */
- 
--#include <stdbool.h>
--
--#include <isc/types.h>
--#include <stdlib.h>
-+#include <isc/lang.h>
-+#include <openssl/crypto.h>
- 
- ISC_LANG_BEGINDECLS
- 
--bool
--isc_safe_memequal(const void *s1, const void *s2, size_t n);
-+#define isc_safe_memequal(s1, s2, n) !CRYPTO_memcmp(s1, s2, n)
- /*%<
-  * Returns true iff. two blocks of memory are equal, otherwise
-  * false.
-  *
-  */
- 
--int
--isc_safe_memcompare(const void *b1, const void *b2, size_t len);
--/*%<
-- * Clone of libc memcmp() which is safe to differential timing attacks.
-- */
--
--void
--isc_safe_memwipe(void *ptr, size_t len);
-+#define isc_safe_memwipe(ptr, len) OPENSSL_cleanse(ptr, len)
- /*%<
-  * Clear the memory of length `len` pointed to by `ptr`.
-  *
-diff --git a/lib/isc/safe.c b/lib/isc/safe.c
-deleted file mode 100644
-index 7a464b6..0000000
---- a/lib/isc/safe.c
-+++ /dev/null
-@@ -1,83 +0,0 @@
--/*
-- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-- *
-- * This Source Code Form is subject to the terms of the Mozilla Public
-- * License, v. 2.0. If a copy of the MPL was not distributed with this
-- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
-- *
-- * See the COPYRIGHT file distributed with this work for additional
-- * information regarding copyright ownership.
-- */
--
--/*! \file */
--
--#include <config.h>
--
--#include <stdbool.h>
--
--#include <isc/safe.h>
--#include <isc/string.h>
--#include <isc/util.h>
--
--#ifdef WIN32
--#include <windows.h>
--#endif
--
--#ifdef _MSC_VER
--#pragma optimize("", off)
--#endif
--
--bool
--isc_safe_memequal(const void *s1, const void *s2, size_t n) {
--	uint8_t acc = 0;
--
--	if (n != 0U) {
--		const uint8_t *p1 = s1, *p2 = s2;
--
--		do {
--			acc |= *p1++ ^ *p2++;
--		} while (--n != 0U);
--	}
--	return (acc == 0);
--}
--
--
--int
--isc_safe_memcompare(const void *b1, const void *b2, size_t len) {
--	const unsigned char *p1 = b1, *p2 = b2;
--	size_t i;
--	int res = 0, done = 0;
--
--	for (i = 0; i < len; i++) {
--		/* lt is -1 if p1[i] < p2[i]; else 0. */
--		int lt = (p1[i] - p2[i]) >> CHAR_BIT;
--
--		/* gt is -1 if p1[i] > p2[i]; else 0. */
--		int gt = (p2[i] - p1[i]) >> CHAR_BIT;
--
--		/* cmp is 1 if p1[i] > p2[i]; -1 if p1[i] < p2[i]; else 0. */
--		int cmp = lt - gt;
--
--		/* set res = cmp if !done. */
--		res |= cmp & ~done;
--
--		/* set done if p1[i] != p2[i]. */
--		done |= lt | gt;
--	}
--
--	return (res);
--}
--
--void
--isc_safe_memwipe(void *ptr, size_t len) {
--	if (ISC_UNLIKELY(ptr == NULL || len == 0))
--		return;
--
--#ifdef WIN32
--	SecureZeroMemory(ptr, len);
--#elif HAVE_EXPLICIT_BZERO
--	explicit_bzero(ptr, len);
--#else
--	memset(ptr, 0, len);
--#endif
--}
-diff --git a/lib/isc/tests/safe_test.c b/lib/isc/tests/safe_test.c
-index 266ac75..60e9181 100644
---- a/lib/isc/tests/safe_test.c
-+++ b/lib/isc/tests/safe_test.c
-@@ -45,22 +45,6 @@ isc_safe_memequal_test(void **state) {
- 				       "\x00\x00\x00\x00", 4));
- }
- 
--/* test isc_safe_memcompare() */
--static void
--isc_safe_memcompare_test(void **state) {
--	UNUSED(state);
--
--	assert_int_equal(isc_safe_memcompare("test", "test", 4), 0);
--	assert_true(isc_safe_memcompare("test", "tesc", 4) > 0);
--	assert_true(isc_safe_memcompare("test", "tesy", 4) < 0);
--	assert_int_equal(isc_safe_memcompare("\x00\x00\x00\x00",
--					     "\x00\x00\x00\x00", 4), 0);
--	assert_true(isc_safe_memcompare("\x00\x00\x00\x00",
--					"\x00\x00\x00\x01", 4) < 0);
--	assert_true(isc_safe_memcompare("\x00\x00\x00\x02",
--					"\x00\x00\x00\x00", 4) > 0);
--}
--
- /* test isc_safe_memwipe() */
- static void
- isc_safe_memwipe_test(void **state) {
-@@ -69,7 +53,6 @@ isc_safe_memwipe_test(void **state) {
- 	/* These should pass. */
- 	isc_safe_memwipe(NULL, 0);
- 	isc_safe_memwipe((void *) -1, 0);
--	isc_safe_memwipe(NULL, 42);
- 
- 	/*
- 	 * isc_safe_memwipe(ptr, size) should function same as
-@@ -108,7 +91,6 @@ main(void) {
- 	const struct CMUnitTest tests[] = {
- 		cmocka_unit_test(isc_safe_memequal_test),
- 		cmocka_unit_test(isc_safe_memwipe_test),
--		cmocka_unit_test(isc_safe_memcompare_test),
- 	};
- 
- 	return (cmocka_run_group_tests(tests, NULL, NULL));
--- 
-2.26.2
-
diff --git a/bind-9.11-rh1736762-5.patch b/bind-9.11-rh1736762-5.patch
deleted file mode 100644
index e14efca..0000000
--- a/bind-9.11-rh1736762-5.patch
+++ /dev/null
@@ -1,59 +0,0 @@
-From 6257d829c9d7e71ac51bcdc6b5b981c7a19200e2 Mon Sep 17 00:00:00 2001
-From: Mark Andrews <marka@isc.org>
-Date: Mon, 25 Nov 2019 05:46:55 +0000
-Subject: [PATCH] Merge branch
- '1373-threadsanitizer-data-race-rbtdb-c-5193-in-detachnode' into 'master'
-
-Resolve "ThreadSanitizer: data race rbtdb.c:5193 in detachnode"
-
-Closes #1373
-
-See merge request isc-projects/bind9!2598
----
- lib/dns/include/dns/rbt.h | 22 +++++++++-------------
- 1 file changed, 9 insertions(+), 13 deletions(-)
-
-diff --git a/lib/dns/include/dns/rbt.h b/lib/dns/include/dns/rbt.h
-index 67ac3e4d8a..a084bd6193 100644
---- a/lib/dns/include/dns/rbt.h
-+++ b/lib/dns/include/dns/rbt.h
-@@ -49,10 +49,7 @@ ISC_LANG_BEGINDECLS
- 
- #define DNS_RBT_USEMAGIC 1
- 
--/*
-- * These should add up to 30.
-- */
--#define DNS_RBT_LOCKLENGTH                      10
-+#define DNS_RBT_LOCKLENGTH		(sizeof(((dns_rbtnode_t *)0)->locknum)*8)
- #define DNS_RBT_REFLENGTH                       20
- 
- #define DNS_RBTNODE_MAGIC               ISC_MAGIC('R','B','N','O')
-@@ -159,16 +156,15 @@ struct dns_rbtnode {
- 	 * separate region of memory.
- 	 */
- 	void *data;
--	unsigned int :0;                /* start of bitfields c/o node lock */
--	unsigned int dirty:1;
--	unsigned int wild:1;
--	unsigned int locknum:DNS_RBT_LOCKLENGTH;
--#ifndef DNS_RBT_USEISCREFCOUNT
--	unsigned int references:DNS_RBT_REFLENGTH;
--#endif
--	unsigned int :0;                /* end of bitfields c/o node lock */
-+	uint8_t :0;                /* start of bitfields c/o node lock */
-+	uint8_t dirty:1;
-+	uint8_t wild:1;
-+	uint8_t :0;                /* end of bitfields c/o node lock */
-+	uint16_t locknum;	   /* note that this is not in the bitfield */
- #ifdef DNS_RBT_USEISCREFCOUNT
--	isc_refcount_t references; /* note that this is not in the bitfield */
-+	isc_refcount_t references;
-+#else
-+	unsigned int references:DNS_RBT_REFLENGTH;
- #endif
- 	/*@}*/
- };
--- 
-2.21.0
-
diff --git a/bind-9.11-rt46047.patch b/bind-9.11-rt46047.patch
index 90ea7a4..dc2a8e2 100644
--- a/bind-9.11-rt46047.patch
+++ b/bind-9.11-rt46047.patch
@@ -1,4 +1,4 @@
-From 8a064944dc10421a387725a365650d656d2a97f1 Mon Sep 17 00:00:00 2001
+From af3b530773231f8cff6548e36962ad1f25e38c5d Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Thu, 28 Sep 2017 10:09:22 -0700
 Subject: [PATCH] completed and corrected the crypto-random change
@@ -45,13 +45,13 @@ Subject: [PATCH] completed and corrected the crypto-random change
  lib/dns/include/dst/dst.h                | 14 +++++-
  lib/dns/openssl_link.c                   |  3 +-
  lib/isc/include/isc/entropy.h            | 48 +++++++++++++++------
- lib/isc/include/isc/random.h             | 28 +++++++-----
+ lib/isc/include/isc/random.h             | 26 +++++++----
  lib/isccfg/namedconf.c                   |  2 +-
- 23 files changed, 240 insertions(+), 104 deletions(-)
+ 23 files changed, 240 insertions(+), 102 deletions(-)
  create mode 100644 doc/arm/notes-rh-changes.xml
 
 diff --git a/bin/confgen/keygen.c b/bin/confgen/keygen.c
-index 295e16f..0f79aa8 100644
+index bd269e7..1ac775f 100644
 --- a/bin/confgen/keygen.c
 +++ b/bin/confgen/keygen.c
 @@ -161,17 +161,15 @@ generate_key(isc_mem_t *mctx, const char *randomfile, dns_secalg_t alg,
@@ -78,7 +78,7 @@ index 295e16f..0f79aa8 100644
  							     &entropy_source,
  							     randomfile,
 diff --git a/bin/dnssec/dnssec-keygen.docbook b/bin/dnssec/dnssec-keygen.docbook
-index 1826919..96543fc 100644
+index bd19e1d..2c09b30 100644
 --- a/bin/dnssec/dnssec-keygen.docbook
 +++ b/bin/dnssec/dnssec-keygen.docbook
 @@ -349,15 +349,23 @@
@@ -114,7 +114,7 @@ index 1826919..96543fc 100644
  	</listitem>
        </varlistentry>
 diff --git a/bin/dnssec/dnssectool.c b/bin/dnssec/dnssectool.c
-index 5654435..24c0d5a 100644
+index 2a0f9c6..6fcd411 100644
 --- a/bin/dnssec/dnssectool.c
 +++ b/bin/dnssec/dnssectool.c
 @@ -241,18 +241,16 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
@@ -142,10 +142,10 @@ index 5654435..24c0d5a 100644
  					   usekeyboard);
  
 diff --git a/bin/named/client.c b/bin/named/client.c
-index f4a5ff9..58549d3 100644
+index 4a50ad9..4d140e8 100644
 --- a/bin/named/client.c
 +++ b/bin/named/client.c
-@@ -1765,7 +1765,8 @@ ns_client_addopt(ns_client_t *client, dns_message_t *message,
+@@ -1768,7 +1768,8 @@ ns_client_addopt(ns_client_t *client, dns_message_t *message,
  
  		isc_buffer_init(&buf, cookie, sizeof(cookie));
  		isc_stdtime_get(&now);
@@ -156,7 +156,7 @@ index f4a5ff9..58549d3 100644
  		compute_cookie(client, now, nonce, ns_g_server->secret, &buf);
  
 diff --git a/bin/named/config.c b/bin/named/config.c
-index eef8181..ff868b8 100644
+index 9b343fa..5e663c6 100644
 --- a/bin/named/config.c
 +++ b/bin/named/config.c
 @@ -98,7 +98,9 @@ options {\n\
@@ -171,10 +171,10 @@ index eef8181..ff868b8 100644
  #endif
  "	recursing-file \"named.recursing\";\n\
 diff --git a/bin/named/controlconf.c b/bin/named/controlconf.c
-index d955c2f..40621f2 100644
+index 9fdf49b..42128dc 100644
 --- a/bin/named/controlconf.c
 +++ b/bin/named/controlconf.c
-@@ -325,9 +325,10 @@ log_invalid(isccc_ccmsg_t *ccmsg, isc_result_t result) {
+@@ -327,9 +327,10 @@ log_invalid(isccc_ccmsg_t *ccmsg, isc_result_t result) {
  
  static void
  control_recvmessage(isc_task_t *task, isc_event_t *event) {
@@ -188,7 +188,7 @@ index d955c2f..40621f2 100644
  	isccc_sexpr_t *request = NULL;
  	isccc_sexpr_t *response = NULL;
  	uint32_t algorithm;
-@@ -338,16 +339,17 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
+@@ -340,16 +341,17 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
  	isc_buffer_t *text;
  	isc_result_t result;
  	isc_result_t eresult;
@@ -208,7 +208,7 @@ index d955c2f..40621f2 100644
  	algorithm = DST_ALG_UNKNOWN;
  	secret.rstart = NULL;
  	text = NULL;
-@@ -458,8 +460,11 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
+@@ -462,8 +464,11 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
  	 * Establish nonce.
  	 */
  	if (conn->nonce == 0) {
@@ -223,7 +223,7 @@ index d955c2f..40621f2 100644
  	} else
  		eresult = ns_control_docommand(request, listener->readonly, &text);
 diff --git a/bin/named/include/named/server.h b/bin/named/include/named/server.h
-index 3f96b7b..c92922e 100644
+index 4fd0194..0ba2627 100644
 --- a/bin/named/include/named/server.h
 +++ b/bin/named/include/named/server.h
 @@ -20,6 +20,7 @@
@@ -234,7 +234,7 @@ index 3f96b7b..c92922e 100644
  #include <isc/sockaddr.h>
  #include <isc/types.h>
  #include <isc/xml.h>
-@@ -134,6 +135,7 @@ struct ns_server {
+@@ -135,6 +136,7 @@ struct ns_server {
  	char *			lockfile;
  
  	uint16_t		transfer_tcp_message_size;
@@ -243,7 +243,7 @@ index 3f96b7b..c92922e 100644
  
  struct ns_altsecret {
 diff --git a/bin/named/interfacemgr.c b/bin/named/interfacemgr.c
-index 9dea7c1..272d300 100644
+index 93aac31..e12fad9 100644
 --- a/bin/named/interfacemgr.c
 +++ b/bin/named/interfacemgr.c
 @@ -17,6 +17,7 @@
@@ -255,22 +255,22 @@ index 9dea7c1..272d300 100644
  #include <isc/task.h>
  #include <isc/util.h>
 diff --git a/bin/named/query.c b/bin/named/query.c
-index 203f1e6..25eeced 100644
+index 58b5914..edf42d2 100644
 --- a/bin/named/query.c
 +++ b/bin/named/query.c
-@@ -19,6 +19,7 @@
- #include <isc/hex.h>
+@@ -20,6 +20,7 @@
  #include <isc/mem.h>
+ #include <isc/platform.h>
  #include <isc/print.h>
 +#include <isc/random.h>
  #include <isc/rwlock.h>
  #include <isc/serial.h>
  #include <isc/stats.h>
 diff --git a/bin/named/server.c b/bin/named/server.c
-index 7b3b736..4aaa92f 100644
+index b2ae57c..cca7fe8 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
-@@ -8234,21 +8234,32 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8279,21 +8279,32 @@ load_configuration(const char *filename, ns_server_t *server,
  	 * Open the source of entropy.
  	 */
  	if (first_time) {
@@ -312,7 +312,7 @@ index 7b3b736..4aaa92f 100644
  #ifdef PATH_RANDOMDEV
  			if (ns_g_fallbackentropy != NULL) {
  				level = ISC_LOG_INFO;
-@@ -8259,8 +8270,8 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8304,8 +8315,8 @@ load_configuration(const char *filename, ns_server_t *server,
  					      NS_LOGCATEGORY_GENERAL,
  					      NS_LOGMODULE_SERVER,
  					      level,
@@ -323,7 +323,7 @@ index 7b3b736..4aaa92f 100644
  					      randomdev,
  					      isc_result_totext(result));
  			}
-@@ -8280,7 +8291,6 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8325,7 +8336,6 @@ load_configuration(const char *filename, ns_server_t *server,
  				}
  				isc_entropy_detach(&ns_g_fallbackentropy);
  			}
@@ -331,7 +331,7 @@ index 7b3b736..4aaa92f 100644
  #endif
  		}
  
-@@ -9049,6 +9059,7 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
+@@ -9097,6 +9107,7 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
  	server->in_roothints = NULL;
  	server->blackholeacl = NULL;
  	server->keepresporder = NULL;
@@ -339,7 +339,7 @@ index 7b3b736..4aaa92f 100644
  
  	/* Must be first. */
  	CHECKFATAL(dst_lib_init2(ns_g_mctx, ns_g_entropy,
-@@ -9075,6 +9086,9 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
+@@ -9123,6 +9134,9 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
  	CHECKFATAL(dns_tkeyctx_create(ns_g_mctx, ns_g_entropy,
  				      &server->tkeyctx),
  		   "creating TKEY context");
@@ -349,7 +349,7 @@ index 7b3b736..4aaa92f 100644
  
  	/*
  	 * Setup the server task, which is responsible for coordinating
-@@ -9281,7 +9295,8 @@ ns_server_destroy(ns_server_t **serverp) {
+@@ -9329,7 +9343,8 @@ ns_server_destroy(ns_server_t **serverp) {
  
  	if (server->zonemgr != NULL)
  		dns_zonemgr_detach(&server->zonemgr);
@@ -359,7 +359,7 @@ index 7b3b736..4aaa92f 100644
  	if (server->tkeyctx != NULL)
  		dns_tkeyctx_destroy(&server->tkeyctx);
  
-@@ -13316,10 +13331,10 @@ newzone_cfgctx_destroy(void **cfgp) {
+@@ -13366,10 +13381,10 @@ newzone_cfgctx_destroy(void **cfgp) {
  
  static isc_result_t
  generate_salt(unsigned char *salt, size_t saltlen) {
@@ -372,7 +372,7 @@ index 7b3b736..4aaa92f 100644
  	} rnd;
  	unsigned char text[512 + 1];
  	isc_region_t r;
-@@ -13329,9 +13344,10 @@ generate_salt(unsigned char *salt, size_t saltlen) {
+@@ -13379,9 +13394,10 @@ generate_salt(unsigned char *salt, size_t saltlen) {
  	if (saltlen > 256U)
  		return (ISC_R_RANGE);
  
@@ -387,10 +387,10 @@ index 7b3b736..4aaa92f 100644
  	memmove(salt, rnd.rnd, saltlen);
  
 diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
-index 2436731..6f59456 100644
+index 7f15cbc..458aa76 100644
 --- a/bin/nsupdate/nsupdate.c
 +++ b/bin/nsupdate/nsupdate.c
-@@ -284,9 +284,7 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
+@@ -289,9 +289,7 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
  	}
  
  #ifdef ISC_PLATFORM_CRYPTORANDOM
@@ -402,7 +402,7 @@ index 2436731..6f59456 100644
  	}
  #endif
 diff --git a/bin/tests/system/pipelined/pipequeries.c b/bin/tests/system/pipelined/pipequeries.c
-index f0a6ff2..55064f6 100644
+index 95b65bf..7a81d4e 100644
 --- a/bin/tests/system/pipelined/pipequeries.c
 +++ b/bin/tests/system/pipelined/pipequeries.c
 @@ -280,9 +280,7 @@ main(int argc, char *argv[]) {
@@ -417,7 +417,7 @@ index f0a6ff2..55064f6 100644
  	}
  #endif
 diff --git a/bin/tests/system/tkey/keycreate.c b/bin/tests/system/tkey/keycreate.c
-index fe8698e..937fcc3 100644
+index 3236968..4fa77b6 100644
 --- a/bin/tests/system/tkey/keycreate.c
 +++ b/bin/tests/system/tkey/keycreate.c
 @@ -255,9 +255,7 @@ main(int argc, char *argv[]) {
@@ -432,7 +432,7 @@ index fe8698e..937fcc3 100644
  	}
  #endif
 diff --git a/bin/tests/system/tkey/keydelete.c b/bin/tests/system/tkey/keydelete.c
-index 2146f9b..64b8e74 100644
+index 43fb6b0..105e151 100644
 --- a/bin/tests/system/tkey/keydelete.c
 +++ b/bin/tests/system/tkey/keydelete.c
 @@ -171,6 +171,7 @@ main(int argc, char **argv) {
@@ -455,7 +455,7 @@ index 2146f9b..64b8e74 100644
  	}
  #endif
 diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
-index 1da0565..7eef5b2 100644
+index ca98726..1f9df2c 100644
 --- a/doc/arm/Bv9ARM-book.xml
 +++ b/doc/arm/Bv9ARM-book.xml
 @@ -5034,22 +5034,45 @@ badresp:1,adberr:0,findfail:0,valfail:0]
@@ -569,10 +569,10 @@ index 0000000..89a4961
 +</section>
 +
 diff --git a/doc/arm/notes.xml b/doc/arm/notes.xml
-index adffaa0..2ffe344 100644
+index a5e42c0..f8cb1f9 100644
 --- a/doc/arm/notes.xml
 +++ b/doc/arm/notes.xml
-@@ -45,6 +45,7 @@
+@@ -47,6 +47,7 @@
    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-9.11.1.xml"/>
    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-9.11.0.xml"/>
  
@@ -581,7 +581,7 @@ index adffaa0..2ffe344 100644
    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-thankyou.xml"/>
  </section>
 diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c
-index 1eccbe7..1933993 100644
+index aa54afc..2156384 100644
 --- a/lib/dns/dst_api.c
 +++ b/lib/dns/dst_api.c
 @@ -2017,10 +2017,12 @@ dst__entropy_getdata(void *buf, unsigned int len, bool pseudo) {
@@ -599,7 +599,7 @@ index 1eccbe7..1933993 100644
  }
  
 diff --git a/lib/dns/include/dst/dst.h b/lib/dns/include/dst/dst.h
-index 6813c96..665574d 100644
+index 3aba028..180c841 100644
 --- a/lib/dns/include/dst/dst.h
 +++ b/lib/dns/include/dst/dst.h
 @@ -163,8 +163,18 @@ isc_result_t
@@ -624,7 +624,7 @@ index 6813c96..665574d 100644
  
  bool
 diff --git a/lib/dns/openssl_link.c b/lib/dns/openssl_link.c
-index ffe0a69..5e48686 100644
+index 3f4f822..cfdc757 100644
 --- a/lib/dns/openssl_link.c
 +++ b/lib/dns/openssl_link.c
 @@ -484,7 +484,8 @@ dst__openssl_getengine(const char *engine) {
@@ -638,7 +638,7 @@ index ffe0a69..5e48686 100644
  #ifndef DONT_REQUIRE_DST_LIB_INIT
  	INSIST(dst__memory_pool != NULL);
 diff --git a/lib/isc/include/isc/entropy.h b/lib/isc/include/isc/entropy.h
-index c40a18c..c7cb17d 100644
+index f32c9dc..bed276b 100644
 --- a/lib/isc/include/isc/entropy.h
 +++ b/lib/isc/include/isc/entropy.h
 @@ -189,9 +189,8 @@ isc_entropy_createcallbacksource(isc_entropy_t *ent,
@@ -718,26 +718,21 @@ index c40a18c..c7cb17d 100644
  
  ISC_LANG_ENDDECLS
 diff --git a/lib/isc/include/isc/random.h b/lib/isc/include/isc/random.h
-index f8aed34..17c551b 100644
+index f38e80d..3cb1c56 100644
 --- a/lib/isc/include/isc/random.h
 +++ b/lib/isc/include/isc/random.h
-@@ -9,8 +9,6 @@
-  * information regarding copyright ownership.
-  */
- 
--/* $Id: random.h,v 1.20 2009/01/17 23:47:43 tbox Exp $ */
--
- #ifndef ISC_RANDOM_H
- #define ISC_RANDOM_H 1
- 
-@@ -21,13 +19,23 @@
+@@ -19,13 +19,23 @@
  #include <isc/mutex.h>
  
  /*! \file isc/random.h
 - * \brief Implements a random state pool which will let the caller return a
 - * series of possibly non-reproducible random values.
 + * \brief Implements pseudo random number generators.
-+ *
+  *
+- * Note that the
+- * strength of these numbers is not all that high, and should not be
+- * used in cryptography functions.  It is useful for jittering values
+- * a bit here and there, such as timeouts, etc.
 + * Two pseudo-random number generators are implemented, in isc_random_*
 + * and isc_rng_*. Neither one is very strong; they should not be used
 + * in cryptography functions.
@@ -747,11 +742,7 @@ index f8aed34..17c551b 100644
 + * It is useful for jittering values a bit here and there, such as
 + * timeouts, etc, but should not be relied upon to generate
 + * unpredictable sequences (for example, when choosing transaction IDs).
-  *
-- * Note that the
-- * strength of these numbers is not all that high, and should not be
-- * used in cryptography functions.  It is useful for jittering values
-- * a bit here and there, such as timeouts, etc.
++  *
 + * isc_rng_* is based on ChaCha20, and is seeded and stirred from the
 + * system entropy source. It is stronger than isc_random_* and can
 + * be used for generating unpredictable sequences. It is still not as
@@ -760,7 +751,7 @@ index f8aed34..17c551b 100644
   */
  
  ISC_LANG_BEGINDECLS
-@@ -115,8 +123,8 @@ isc_rng_random(isc_rng_t *rngctx);
+@@ -113,8 +123,8 @@ isc_rng_random(isc_rng_t *rngctx);
  uint16_t
  isc_rng_uniformrandom(isc_rng_t *rngctx, uint16_t upper_bound);
  /*%<
@@ -772,7 +763,7 @@ index f8aed34..17c551b 100644
  
  ISC_LANG_ENDDECLS
 diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
-index 1c45d5c..91693b5 100644
+index e74c93b..212194e 100644
 --- a/lib/isccfg/namedconf.c
 +++ b/lib/isccfg/namedconf.c
 @@ -1109,7 +1109,7 @@ options_clauses[] = {
diff --git a/bind-9.11-serve-stale.patch b/bind-9.11-serve-stale.patch
index d18077c..c6fae7d 100644
--- a/bind-9.11-serve-stale.patch
+++ b/bind-9.11-serve-stale.patch
@@ -1,4 +1,4 @@
-From 5400119bfb19243b37e4f4f27baad4f610fff8da Mon Sep 17 00:00:00 2001
+From 95b25d45662f4fad39cbc9ddbc3b4bcdae0a04ec Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 7 Nov 2019 14:31:03 +0100
 Subject: [PATCH] Implement serve-stale in 9.11
@@ -276,7 +276,7 @@ Signed-off-by: Petr Menšík <pemensik@redhat.com>
  create mode 100755 bin/tests/system/serve-stale/tests.sh
 
 diff --git a/bin/named/config.c b/bin/named/config.c
-index ff868b8..f23bed1 100644
+index 5e663c6..560ef04 100644
 --- a/bin/named/config.c
 +++ b/bin/named/config.c
 @@ -182,13 +182,14 @@ options {\n\
@@ -312,7 +312,7 @@ index ff868b8..f23bed1 100644
  	transfer-format many-answers;\n\
  	v6-bias 50;\n\
 diff --git a/bin/named/control.c b/bin/named/control.c
-index df23c26..8b79850 100644
+index 23620b4..0756c73 100644
 --- a/bin/named/control.c
 +++ b/bin/named/control.c
 @@ -282,6 +282,8 @@ ns_control_docommand(isccc_sexpr_t *message, bool readonly,
@@ -325,10 +325,10 @@ index df23c26..8b79850 100644
  		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
  			      NS_LOGMODULE_CONTROL, ISC_LOG_WARNING,
 diff --git a/bin/named/include/named/control.h b/bin/named/include/named/control.h
-index 8705fdd..1634154 100644
+index 56bad8d..37403f1 100644
 --- a/bin/named/include/named/control.h
 +++ b/bin/named/include/named/control.h
-@@ -69,6 +69,7 @@
+@@ -67,6 +67,7 @@
  #define NS_COMMAND_MKEYS	"managed-keys"
  #define NS_COMMAND_DNSTAPREOPEN	"dnstap-reopen"
  #define NS_COMMAND_DNSTAP	"dnstap"
@@ -337,10 +337,10 @@ index 8705fdd..1634154 100644
  isc_result_t
  ns_controls_create(ns_server_t *server, ns_controls_t **ctrlsp);
 diff --git a/bin/named/include/named/log.h b/bin/named/include/named/log.h
-index 56bfcd4..cd8db60 100644
+index 76e3a51..0d1d985 100644
 --- a/bin/named/include/named/log.h
 +++ b/bin/named/include/named/log.h
-@@ -32,6 +32,7 @@
+@@ -30,6 +30,7 @@
  #define NS_LOGCATEGORY_UPDATE_SECURITY	(&ns_g_categories[6])
  #define NS_LOGCATEGORY_QUERY_ERRORS	(&ns_g_categories[7])
  #define NS_LOGCATEGORY_TAT		(&ns_g_categories[8])
@@ -349,7 +349,7 @@ index 56bfcd4..cd8db60 100644
  /*
   * Backwards compatibility.
 diff --git a/bin/named/include/named/query.h b/bin/named/include/named/query.h
-index 9661f56..445b578 100644
+index ef1b172..53c052b 100644
 --- a/bin/named/include/named/query.h
 +++ b/bin/named/include/named/query.h
 @@ -35,6 +35,18 @@ typedef struct ns_dbversion {
@@ -389,10 +389,10 @@ index 9661f56..445b578 100644
  	bool root_key_sentinel_is_ta;
  	bool root_key_sentinel_not_ta;
 diff --git a/bin/named/include/named/server.h b/bin/named/include/named/server.h
-index c92922e..588bf2d 100644
+index 0ba2627..08a02dc 100644
 --- a/bin/named/include/named/server.h
 +++ b/bin/named/include/named/server.h
-@@ -226,7 +226,10 @@ enum {
+@@ -227,7 +227,10 @@ enum {
  
  	dns_nsstatscounter_reclimitdropped = 58,
  
@@ -404,7 +404,7 @@ index c92922e..588bf2d 100644
  };
  
  /*%
-@@ -765,4 +768,12 @@ ns_server_mkeys(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text);
+@@ -766,4 +769,12 @@ ns_server_mkeys(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text);
  isc_result_t
  ns_server_dnstap(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text);
  
@@ -418,7 +418,7 @@ index c92922e..588bf2d 100644
 +		     isc_buffer_t **text);
  #endif /* NAMED_SERVER_H */
 diff --git a/bin/named/log.c b/bin/named/log.c
-index 3aa25e9..12f178b 100644
+index acfa766..ea6f114 100644
 --- a/bin/named/log.c
 +++ b/bin/named/log.c
 @@ -38,6 +38,7 @@ static isc_logcategory_t categories[] = {
@@ -430,10 +430,10 @@ index 3aa25e9..12f178b 100644
  };
  
 diff --git a/bin/named/query.c b/bin/named/query.c
-index 25eeced..162e4ea 100644
+index edf42d2..89cc574 100644
 --- a/bin/named/query.c
 +++ b/bin/named/query.c
-@@ -125,10 +125,14 @@
+@@ -149,10 +149,14 @@ last_cmpxchg(isc_stdtime_t *x, isc_stdtime_t *e, isc_stdtime_t r) {
  #define REDIRECT(c)		(((c)->query.attributes & \
  				  NS_QUERYATTR_REDIRECT) != 0)
  
@@ -449,7 +449,7 @@ index 25eeced..162e4ea 100644
  #ifdef WANT_QUERYTRACE
  static inline void
  client_trace(ns_client_t *client, int level, const char *message) {
-@@ -217,6 +221,10 @@ static bool
+@@ -241,6 +245,10 @@ static bool
  rpz_ck_dnssec(ns_client_t *client, isc_result_t qresult,
  	      dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset);
  
@@ -460,7 +460,7 @@ index 25eeced..162e4ea 100644
  /*%
   * Increment query statistics counters.
   */
-@@ -470,6 +478,7 @@ query_reset(ns_client_t *client, bool everything) {
+@@ -494,6 +502,7 @@ query_reset(ns_client_t *client, bool everything) {
  	client->query.isreferral = false;
  	client->query.dns64_options = 0;
  	client->query.dns64_ttl = UINT32_MAX;
@@ -468,8 +468,8 @@ index 25eeced..162e4ea 100644
  	client->query.root_key_sentinel_keyid = 0;
  	client->query.root_key_sentinel_is_ta = false;
  	client->query.root_key_sentinel_not_ta = false;
-@@ -4254,6 +4263,54 @@ query_prefetch(ns_client_t *client, dns_name_t *qname,
- 	dns_rdataset_clearprefetch(rdataset);
+@@ -4305,6 +4314,54 @@ log_quota(ns_client_t *client, isc_stdtime_t *last, isc_stdtime_t now,
+ 	}
  }
  
 +/*%
@@ -523,7 +523,7 @@ index 25eeced..162e4ea 100644
  static isc_result_t
  query_recurse(ns_client_t *client, dns_rdatatype_t qtype, dns_name_t *qname,
  	      dns_name_t *qdomain, dns_rdataset_t *nameservers,
-@@ -4263,6 +4320,19 @@ query_recurse(ns_client_t *client, dns_rdatatype_t qtype, dns_name_t *qname,
+@@ -4314,6 +4371,19 @@ query_recurse(ns_client_t *client, dns_rdatatype_t qtype, dns_name_t *qname,
  	dns_rdataset_t *rdataset, *sigrdataset;
  	isc_sockaddr_t *peeraddr;
  
@@ -543,7 +543,7 @@ index 25eeced..162e4ea 100644
  	if (!resuming)
  		inc_stats(client, dns_nsstatscounter_recursion);
  
-@@ -6780,6 +6850,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
+@@ -6821,6 +6891,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
  	int line = -1;
  	bool dns64_exclude, dns64, rpz;
  	bool nxrewrite = false;
@@ -551,7 +551,7 @@ index 25eeced..162e4ea 100644
  	bool redirected = false;
  	dns_clientinfomethods_t cm;
  	dns_clientinfo_t ci;
-@@ -7089,6 +7160,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
+@@ -7130,6 +7201,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
  		type = qtype;
  
   restart:
@@ -559,7 +559,7 @@ index 25eeced..162e4ea 100644
  	CTRACE(ISC_LOG_DEBUG(3), "query_find: restart");
  	want_restart = false;
  	authoritative = false;
-@@ -7233,6 +7305,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
+@@ -7274,6 +7346,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
  	}
  
   db_find:
@@ -567,7 +567,7 @@ index 25eeced..162e4ea 100644
  	CTRACE(ISC_LOG_DEBUG(3), "query_find: db_find");
  	/*
  	 * We'll need some resources...
-@@ -7290,6 +7363,35 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
+@@ -7331,6 +7404,35 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
  	if (!is_zone)
  		dns_cache_updatestats(client->view->cache, result);
  
@@ -603,7 +603,7 @@ index 25eeced..162e4ea 100644
   resume:
  	CTRACE(ISC_LOG_DEBUG(3), "query_find: resume");
  
-@@ -7635,6 +7737,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
+@@ -7676,6 +7778,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
  		 * The cache doesn't even have the root NS.  Get them from
  		 * the hints DB.
  		 */
@@ -611,7 +611,7 @@ index 25eeced..162e4ea 100644
  		INSIST(!is_zone);
  		if (db != NULL)
  			dns_db_detach(&db);
-@@ -7697,12 +7800,14 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
+@@ -7738,12 +7841,14 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
  		 */
  		/* FALLTHROUGH */
  	case DNS_R_DELEGATION:
@@ -626,7 +626,7 @@ index 25eeced..162e4ea 100644
  			if (!RECURSIONOK(client) &&
  			    (options & DNS_GETDB_NOEXACT) != 0 &&
  			    qtype == dns_rdatatype_ds) {
-@@ -8089,6 +8194,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
+@@ -8130,6 +8235,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
  						       false, true);
  			}
  		}
@@ -634,7 +634,7 @@ index 25eeced..162e4ea 100644
  		if (dns_rdataset_isassociated(rdataset)) {
  			/*
  			 * If we've got a NSEC record, we need to save the
-@@ -8409,7 +8515,8 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
+@@ -8450,7 +8556,8 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
  		/*
  		 * If we have a zero ttl from the cache refetch it.
  		 */
@@ -644,7 +644,7 @@ index 25eeced..162e4ea 100644
  		    RECURSIONOK(client))
  		{
  			if (dns_rdataset_isassociated(rdataset))
-@@ -8627,7 +8734,11 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
+@@ -8668,7 +8775,11 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
  			 "query_find: unexpected error after resuming: %s",
  			 isc_result_totext(result));
  		CTRACE(ISC_LOG_ERROR, errmsg);
@@ -657,7 +657,7 @@ index 25eeced..162e4ea 100644
  		goto cleanup;
  	}
  
-@@ -8883,7 +8994,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
+@@ -8924,7 +9035,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
  		/*
  		 * If we have a zero ttl from the cache refetch it.
  		 */
@@ -666,7 +666,7 @@ index 25eeced..162e4ea 100644
  		    RECURSIONOK(client))
  		{
  			if (dns_rdataset_isassociated(rdataset))
-@@ -8894,6 +9005,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
+@@ -8935,6 +9046,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
  			if (node != NULL)
  				dns_db_detachnode(db, &node);
  
@@ -674,7 +674,7 @@ index 25eeced..162e4ea 100644
  			INSIST(!REDIRECT(client));
  			result = query_recurse(client, qtype,
  					       client->query.qname,
-@@ -9174,6 +9286,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
+@@ -9215,6 +9327,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
  				       dns_fixedname_name(&wildcardname),
  				       true, false);
   cleanup:
@@ -682,7 +682,7 @@ index 25eeced..162e4ea 100644
  	CTRACE(ISC_LOG_DEBUG(3), "query_find: cleanup");
  	/*
  	 * General cleanup.
-@@ -9230,6 +9343,49 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
+@@ -9271,6 +9384,49 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
  		goto restart;
  	}
  
@@ -733,7 +733,7 @@ index 25eeced..162e4ea 100644
  	    (!PARTIALANSWER(client) || WANTRECURSION(client)
  	     || eresult == DNS_R_DROP)) {
 diff --git a/bin/named/server.c b/bin/named/server.c
-index 1cbb9a0..0c899ba 100644
+index 2bdf690..3a5ba91 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
 @@ -1720,7 +1720,8 @@ static bool
@@ -843,7 +843,7 @@ index 1cbb9a0..0c899ba 100644
  	/*
  	 * Set supported DNSSEC algorithms.
  	 */
-@@ -14509,3 +14553,132 @@ ns_server_dnstap(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text) {
+@@ -14559,3 +14603,132 @@ ns_server_dnstap(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text) {
  	return (ISC_R_NOTIMPLEMENTED);
  #endif
  }
@@ -977,7 +977,7 @@ index 1cbb9a0..0c899ba 100644
 +	return (result);
 +}
 diff --git a/bin/named/statschannel.c b/bin/named/statschannel.c
-index 4b8d972..8c68737 100644
+index 12ab048..4938c03 100644
 --- a/bin/named/statschannel.c
 +++ b/bin/named/statschannel.c
 @@ -300,6 +300,12 @@ init_desc(void) {
@@ -994,7 +994,7 @@ index 4b8d972..8c68737 100644
  
  	/* Initialize resolver statistics */
 diff --git a/bin/rndc/rndc.c b/bin/rndc/rndc.c
-index 1b48861..f50635b 100644
+index 0acfe3a..2c21c1d 100644
 --- a/bin/rndc/rndc.c
 +++ b/bin/rndc/rndc.c
 @@ -160,6 +160,8 @@ command is one of the following:\n\
@@ -1007,7 +1007,7 @@ index 1b48861..f50635b 100644
  		Print a zone's configuration.\n\
    sign zone [class [view]]\n\
 diff --git a/bin/rndc/rndc.docbook b/bin/rndc/rndc.docbook
-index e14a17e..eaf32d3 100644
+index 1e3812e..c7fe65f 100644
 --- a/bin/rndc/rndc.docbook
 +++ b/bin/rndc/rndc.docbook
 @@ -689,6 +689,25 @@
@@ -1037,7 +1037,7 @@ index e14a17e..eaf32d3 100644
  	<term><userinput>secroots <optional>-</optional> <optional><replaceable>view ...</replaceable></optional></userinput></term>
  	<listitem>
 diff --git a/bin/tests/system/chain/prereq.sh b/bin/tests/system/chain/prereq.sh
-index f3f1939..9ff3f07 100644
+index 23bedcd..43385de 100644
 --- a/bin/tests/system/chain/prereq.sh
 +++ b/bin/tests/system/chain/prereq.sh
 @@ -48,3 +48,10 @@ else
@@ -1052,7 +1052,7 @@ index f3f1939..9ff3f07 100644
 +    exit 1
 +fi
 diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
-index 4c122c8..a2eb833 100644
+index c59cfaf..2b3de5f 100644
 --- a/bin/tests/system/conf.sh.in
 +++ b/bin/tests/system/conf.sh.in
 @@ -128,7 +128,7 @@ PARALLELDIRS="dnssec rpzrecurse \
@@ -2039,7 +2039,7 @@ index 0000000..201c996
 +echo "I:exit status: $status"
 +[ $status -eq 0 ] || exit 1
 diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
-index 7eef5b2..b16b239 100644
+index 1f9df2c..78e75ce 100644
 --- a/doc/arm/Bv9ARM-book.xml
 +++ b/doc/arm/Bv9ARM-book.xml
 @@ -4336,6 +4336,9 @@ badresp:1,adberr:0,findfail:0,valfail:0]
@@ -2140,7 +2140,7 @@ index 7eef5b2..b16b239 100644
  		</para>
  	      </listitem>
  	    </varlistentry>
-@@ -8928,6 +8968,27 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
+@@ -9015,6 +9055,27 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
  	      </listitem>
  	    </varlistentry>
  
@@ -2169,7 +2169,7 @@ index 7eef5b2..b16b239 100644
  	      <term><command>min-roots</command></term>
  	      <listitem>
 diff --git a/doc/arm/logging-categories.xml b/doc/arm/logging-categories.xml
-index e41bd3b..2f505c8 100644
+index f0776fe..c4b903a 100644
 --- a/doc/arm/logging-categories.xml
 +++ b/doc/arm/logging-categories.xml
 @@ -311,6 +311,17 @@
@@ -2281,7 +2281,7 @@ index e11beed..fde93c7 100644
          topology { <address_match_element>; ... }; // not implemented
          transfer-format ( many-answers | one-answer );
 diff --git a/lib/bind9/check.c b/lib/bind9/check.c
-index eaac5ba..a89d78f 100644
+index bf769fe..6c57fa4 100644
 --- a/lib/bind9/check.c
 +++ b/lib/bind9/check.c
 @@ -99,7 +99,8 @@ check_orderent(const cfg_obj_t *ent, isc_log_t *logctx) {
@@ -2525,7 +2525,7 @@ index eaac5ba..a89d78f 100644
  }
  
 diff --git a/lib/dns/cache.c b/lib/dns/cache.c
-index 4701ff8..97e427a 100644
+index 2965a4f..617737a 100644
 --- a/lib/dns/cache.c
 +++ b/lib/dns/cache.c
 @@ -138,6 +138,7 @@ struct dns_cache {
@@ -2595,7 +2595,7 @@ index 4701ff8..97e427a 100644
   * The cleaner task is shutting down; do the necessary cleanup.
   */
 diff --git a/lib/dns/db.c b/lib/dns/db.c
-index ee3e00d..576aa65 100644
+index a28a566..c581646 100644
 --- a/lib/dns/db.c
 +++ b/lib/dns/db.c
 @@ -1130,3 +1130,25 @@ dns_db_nodefullname(dns_db_t *db, dns_dbnode_t *node, dns_name_t *name) {
@@ -2625,7 +2625,7 @@ index ee3e00d..576aa65 100644
 +	return (ISC_R_NOTIMPLEMENTED);
 +}
 diff --git a/lib/dns/ecdb.c b/lib/dns/ecdb.c
-index 47994ea..23bfe7d 100644
+index fc94ccf..76d0417 100644
 --- a/lib/dns/ecdb.c
 +++ b/lib/dns/ecdb.c
 @@ -588,7 +588,9 @@ static dns_dbmethods_t ecdb_methods = {
@@ -2640,7 +2640,7 @@ index 47994ea..23bfe7d 100644
  
  static isc_result_t
 diff --git a/lib/dns/include/dns/cache.h b/lib/dns/include/dns/cache.h
-index 62797db..714b78e 100644
+index ab4b0b5..e158014 100644
 --- a/lib/dns/include/dns/cache.h
 +++ b/lib/dns/include/dns/cache.h
 @@ -260,6 +260,27 @@ dns_cache_getcachesize(dns_cache_t *cache);
@@ -2672,7 +2672,7 @@ index 62797db..714b78e 100644
  dns_cache_flush(dns_cache_t *cache);
  /*%<
 diff --git a/lib/dns/include/dns/db.h b/lib/dns/include/dns/db.h
-index 6f0eed0..e3917f2 100644
+index 96f3a8f..452770f 100644
 --- a/lib/dns/include/dns/db.h
 +++ b/lib/dns/include/dns/db.h
 @@ -195,6 +195,8 @@ typedef struct dns_dbmethods {
@@ -2732,7 +2732,7 @@ index 6f0eed0..e3917f2 100644
  
  #endif /* DNS_DB_H */
 diff --git a/lib/dns/include/dns/rdataset.h b/lib/dns/include/dns/rdataset.h
-index 5295d8e..97071ed 100644
+index ed9119a..710e97c 100644
 --- a/lib/dns/include/dns/rdataset.h
 +++ b/lib/dns/include/dns/rdataset.h
 @@ -128,6 +128,7 @@ struct dns_rdataset {
@@ -2786,7 +2786,7 @@ index 5295d8e..97071ed 100644
  /*%
   * _OMITDNSSEC:
 diff --git a/lib/dns/include/dns/resolver.h b/lib/dns/include/dns/resolver.h
-index 0b66c75..4b4b6bd 100644
+index 7b3c047..bd7d225 100644
 --- a/lib/dns/include/dns/resolver.h
 +++ b/lib/dns/include/dns/resolver.h
 @@ -547,9 +547,12 @@ dns_resolver_getmustbesecure(dns_resolver_t *resolver, dns_name_t *name);
@@ -2855,12 +2855,12 @@ index 0b66c75..4b4b6bd 100644
  dns_resolver_getoptions(dns_resolver_t *resolver);
  
 diff --git a/lib/dns/include/dns/types.h b/lib/dns/include/dns/types.h
-index 567e8a8..7bf2b60 100644
+index 2468e3c..934a641 100644
 --- a/lib/dns/include/dns/types.h
 +++ b/lib/dns/include/dns/types.h
-@@ -385,6 +385,12 @@ typedef enum {
- 	dns_updatemethod_date
- } dns_updatemethod_t;
+@@ -390,6 +390,12 @@ typedef struct {
+ 	size_t      count;
+ } dns_indent_t;
  
 +typedef enum {
 +	dns_stale_answer_no,
@@ -2872,7 +2872,7 @@ index 567e8a8..7bf2b60 100644
   * Functions.
   */
 diff --git a/lib/dns/include/dns/view.h b/lib/dns/include/dns/view.h
-index 09a9725..8e3b3cb 100644
+index 53f1db1..96148c7 100644
 --- a/lib/dns/include/dns/view.h
 +++ b/lib/dns/include/dns/view.h
 @@ -229,6 +229,9 @@ struct dns_view {
@@ -2886,7 +2886,7 @@ index 09a9725..8e3b3cb 100644
  
  #define DNS_VIEW_MAGIC			ISC_MAGIC('V','i','e','w')
 diff --git a/lib/dns/master.c b/lib/dns/master.c
-index 8edd732..8c9f00e 100644
+index 7d26b81..36999b5 100644
 --- a/lib/dns/master.c
 +++ b/lib/dns/master.c
 @@ -1948,12 +1948,18 @@ load_text(dns_loadctx_t *lctx) {
@@ -2913,7 +2913,7 @@ index 8edd732..8c9f00e 100644
  
  		/*
 diff --git a/lib/dns/masterdump.c b/lib/dns/masterdump.c
-index 13d1a3e..873b694 100644
+index fa839a0..91b3cab 100644
 --- a/lib/dns/masterdump.c
 +++ b/lib/dns/masterdump.c
 @@ -81,6 +81,9 @@ struct dns_master_style {
@@ -2982,10 +2982,10 @@ index 13d1a3e..873b694 100644
  			RUNTIME_CHECK(result == ISC_R_SUCCESS);
  			isc_buffer_usedregion(&buffer, &r);
 diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
-index baf7641..a8f4609 100644
+index 3b75cad..535202b 100644
 --- a/lib/dns/rbtdb.c
 +++ b/lib/dns/rbtdb.c
-@@ -490,6 +490,7 @@ typedef ISC_LIST(rdatasetheader_t)      rdatasetheaderlist_t;
+@@ -511,6 +511,7 @@ typedef ISC_LIST(rdatasetheader_t)      rdatasetheaderlist_t;
  typedef ISC_LIST(dns_rbtnode_t)         rbtnodelist_t;
  
  #define RDATASET_ATTR_NONEXISTENT       0x0001
@@ -2993,7 +2993,7 @@ index baf7641..a8f4609 100644
  #define RDATASET_ATTR_STALE             0x0002
  #define RDATASET_ATTR_IGNORE            0x0004
  #define RDATASET_ATTR_RETAIN            0x0008
-@@ -502,6 +503,8 @@ typedef ISC_LIST(dns_rbtnode_t)         rbtnodelist_t;
+@@ -523,6 +524,8 @@ typedef ISC_LIST(dns_rbtnode_t)         rbtnodelist_t;
  #define RDATASET_ATTR_CASESET           0x0400
  #define RDATASET_ATTR_ZEROTTL           0x0800
  #define RDATASET_ATTR_CASEFULLYLOWER    0x1000
@@ -3002,7 +3002,7 @@ index baf7641..a8f4609 100644
  
  typedef struct acache_cbarg {
  	dns_rdatasetadditional_t        type;
-@@ -552,6 +555,8 @@ struct acachectl {
+@@ -573,6 +576,8 @@ struct acachectl {
  	(((header)->attributes & RDATASET_ATTR_ZEROTTL) != 0)
  #define CASEFULLYLOWER(header) \
  	(((header)->attributes & RDATASET_ATTR_CASEFULLYLOWER) != 0)
@@ -3011,7 +3011,7 @@ index baf7641..a8f4609 100644
  
  
  #define ACTIVE(header, now) \
-@@ -611,6 +616,12 @@ typedef enum {
+@@ -632,6 +637,12 @@ typedef enum {
  	expire_flush
  } expire_t;
  
@@ -3024,7 +3024,7 @@ index baf7641..a8f4609 100644
  typedef struct rbtdb_version {
  	/* Not locked */
  	rbtdb_serial_t                  serial;
-@@ -678,6 +689,12 @@ struct dns_rbtdb {
+@@ -699,6 +710,12 @@ struct dns_rbtdb {
  	dns_dbnode_t                    *soanode;
  	dns_dbnode_t                    *nsnode;
  
@@ -3037,7 +3037,7 @@ index baf7641..a8f4609 100644
  	/*
  	 * This is a linked list used to implement the LRU cache.  There will
  	 * be node_lock_count linked lists here.  Nodes in bucket 1 will be
-@@ -721,6 +738,8 @@ struct dns_rbtdb {
+@@ -742,6 +759,8 @@ struct dns_rbtdb {
  #define RBTDB_ATTR_LOADED               0x01
  #define RBTDB_ATTR_LOADING              0x02
  
@@ -3046,7 +3046,7 @@ index baf7641..a8f4609 100644
  /*%
   * Search Context
   */
-@@ -1791,15 +1810,15 @@ rollback_node(dns_rbtnode_t *node, rbtdb_serial_t serial) {
+@@ -1816,15 +1835,15 @@ rollback_node(dns_rbtnode_t *node, rbtdb_serial_t serial) {
  }
  
  static inline void
@@ -3066,7 +3066,7 @@ index baf7641..a8f4609 100644
  	header->node->dirty = 1;
  
  	/*
-@@ -1840,8 +1859,8 @@ clean_cache_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node) {
+@@ -1865,8 +1884,8 @@ clean_cache_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node) {
  		/*
  		 * If current is nonexistent or stale, we can clean it up.
  		 */
@@ -3077,7 +3077,7 @@ index baf7641..a8f4609 100644
  			if (top_prev != NULL)
  				top_prev->next = current->next;
  			else
-@@ -2086,6 +2105,80 @@ delete_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node) {
+@@ -2111,6 +2130,80 @@ delete_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node) {
  	}
  }
  
@@ -3158,7 +3158,7 @@ index baf7641..a8f4609 100644
  /*
   * Caller must be holding the node lock.
   */
-@@ -3318,6 +3411,12 @@ bind_rdataset(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node, rdatasetheader_t *header,
+@@ -3343,6 +3436,12 @@ bind_rdataset(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node, rdatasetheader_t *header,
  		rdataset->attributes |= DNS_RDATASETATTR_OPTOUT;
  	if (PREFETCH(header))
  		rdataset->attributes |= DNS_RDATASETATTR_PREFETCH;
@@ -3171,7 +3171,7 @@ index baf7641..a8f4609 100644
  	rdataset->private1 = rbtdb;
  	rdataset->private2 = node;
  	raw = (unsigned char *)header + sizeof(*header);
-@@ -4674,6 +4773,19 @@ check_stale_header(dns_rbtnode_t *node, rdatasetheader_t *header,
+@@ -4699,6 +4798,19 @@ check_stale_header(dns_rbtnode_t *node, rdatasetheader_t *header,
  #endif
  
  	if (!ACTIVE(header, search->now)) {
@@ -3191,7 +3191,7 @@ index baf7641..a8f4609 100644
  		/*
  		 * This rdataset is stale.  If no one else is using the
  		 * node, we can clean it up right now, otherwise we mark
-@@ -4713,7 +4825,7 @@ check_stale_header(dns_rbtnode_t *node, rdatasetheader_t *header,
+@@ -4738,7 +4850,7 @@ check_stale_header(dns_rbtnode_t *node, rdatasetheader_t *header,
  					node->data = header->next;
  				free_rdataset(search->rbtdb, mctx, header);
  			} else {
@@ -3200,7 +3200,7 @@ index baf7641..a8f4609 100644
  				*header_prev = header;
  			}
  		} else
-@@ -5154,7 +5266,7 @@ cache_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
+@@ -5179,7 +5291,7 @@ cache_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
  				       &locktype, lock, &search,
  				       &header_prev)) {
  			/* Do nothing. */
@@ -3209,7 +3209,7 @@ index baf7641..a8f4609 100644
  			/*
  			 * We now know that there is at least one active
  			 * non-stale rdataset at this node.
-@@ -5637,7 +5749,7 @@ expirenode(dns_db_t *db, dns_dbnode_t *node, isc_stdtime_t now) {
+@@ -5662,7 +5774,7 @@ expirenode(dns_db_t *db, dns_dbnode_t *node, isc_stdtime_t now) {
  			 * refcurrent(rbtnode) must be non-zero.  This is so
  			 * because 'node' is an argument to the function.
  			 */
@@ -3218,7 +3218,7 @@ index baf7641..a8f4609 100644
  			if (log)
  				isc_log_write(dns_lctx, category, module,
  					      level, "overmem cache: stale %s",
-@@ -5645,7 +5757,7 @@ expirenode(dns_db_t *db, dns_dbnode_t *node, isc_stdtime_t now) {
+@@ -5670,7 +5782,7 @@ expirenode(dns_db_t *db, dns_dbnode_t *node, isc_stdtime_t now) {
  		} else if (force_expire) {
  			if (! RETAIN(header)) {
  				set_ttl(rbtdb, header, 0);
@@ -3227,7 +3227,7 @@ index baf7641..a8f4609 100644
  			} else if (log) {
  				isc_log_write(dns_lctx, category, module,
  					      level, "overmem cache: "
-@@ -5904,9 +6016,9 @@ cache_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
+@@ -5929,9 +6041,9 @@ cache_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
  				 * non-zero.  This is so because 'node' is an
  				 * argument to the function.
  				 */
@@ -3239,7 +3239,7 @@ index baf7641..a8f4609 100644
  			if (header->type == matchtype)
  				found = header;
  			else if (header->type == RBTDB_RDATATYPE_NCACHEANY ||
-@@ -6206,7 +6318,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+@@ -6233,7 +6345,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
  				     topheader = topheader->next)
  				{
  					set_ttl(rbtdb, topheader, 0);
@@ -3248,7 +3248,7 @@ index baf7641..a8f4609 100644
  				}
  				goto find_header;
  			}
-@@ -6267,7 +6379,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+@@ -6294,7 +6406,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
  				 * ncache entry.
  				 */
  				set_ttl(rbtdb, topheader, 0);
@@ -3257,7 +3257,7 @@ index baf7641..a8f4609 100644
  				topheader = NULL;
  				goto find_header;
  			}
-@@ -6305,8 +6417,11 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+@@ -6332,8 +6444,11 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
  		}
  
  		/*
@@ -3271,7 +3271,7 @@ index baf7641..a8f4609 100644
  		 */
  		if (rbtversion == NULL && trust < header->trust &&
  		    (ACTIVE(header, now) || header_nx)) {
-@@ -6336,6 +6451,10 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+@@ -6363,6 +6478,10 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
  
  			if ((options & DNS_DBADD_EXACT) != 0)
  				flags |= DNS_RDATASLAB_EXACT;
@@ -3282,7 +3282,7 @@ index baf7641..a8f4609 100644
  			if ((options & DNS_DBADD_EXACTTTL) != 0 &&
  			     newheader->rdh_ttl != header->rdh_ttl)
  					result = DNS_R_NOTEXACT;
-@@ -6379,11 +6498,12 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+@@ -6406,11 +6525,12 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
  			}
  		}
  		/*
@@ -3300,7 +3300,7 @@ index baf7641..a8f4609 100644
  		 */
  		if (IS_CACHE(rbtdb) && ACTIVE(header, now) &&
  		    header->type == dns_rdatatype_ns &&
-@@ -6556,10 +6676,10 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+@@ -6583,10 +6703,10 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
  				changed->dirty = true;
  			if (rbtversion == NULL) {
  				set_ttl(rbtdb, header, 0);
@@ -3313,7 +3313,7 @@ index baf7641..a8f4609 100644
  				}
  			}
  			if (rbtversion != NULL && !header_nx) {
-@@ -8410,6 +8530,30 @@ nodefullname(dns_db_t *db, dns_dbnode_t *node, dns_name_t *name) {
+@@ -8437,6 +8557,30 @@ nodefullname(dns_db_t *db, dns_dbnode_t *node, dns_name_t *name) {
  	return (result);
  }
  
@@ -3344,7 +3344,7 @@ index baf7641..a8f4609 100644
  static dns_dbmethods_t zone_methods = {
  	attach,
  	detach,
-@@ -8455,7 +8599,9 @@ static dns_dbmethods_t zone_methods = {
+@@ -8482,7 +8626,9 @@ static dns_dbmethods_t zone_methods = {
  	NULL,
  	hashsize,
  	nodefullname,
@@ -3355,7 +3355,7 @@ index baf7641..a8f4609 100644
  };
  
  static dns_dbmethods_t cache_methods = {
-@@ -8503,7 +8649,9 @@ static dns_dbmethods_t cache_methods = {
+@@ -8530,7 +8676,9 @@ static dns_dbmethods_t cache_methods = {
  	setcachestats,
  	hashsize,
  	nodefullname,
@@ -3366,7 +3366,7 @@ index baf7641..a8f4609 100644
  };
  
  isc_result_t
-@@ -8774,7 +8922,7 @@ dns_rbtdb_create
+@@ -8801,7 +8949,7 @@ dns_rbtdb_create
  	rbtdb->rpzs = NULL;
  	rbtdb->load_rpzs = NULL;
  	rbtdb->rpz_num = DNS_RPZ_INVALID_NUM;
@@ -3375,7 +3375,7 @@ index baf7641..a8f4609 100644
  	/*
  	 * Version Initialization.
  	 */
-@@ -9192,7 +9340,8 @@ rdatasetiter_first(dns_rdatasetiter_t *iterator) {
+@@ -9219,7 +9367,8 @@ rdatasetiter_first(dns_rdatasetiter_t *iterator) {
  				 * rdatasets to work.
  				 */
  				if (NONEXISTENT(header) ||
@@ -3385,7 +3385,7 @@ index baf7641..a8f4609 100644
  					header = NULL;
  				break;
  			} else
-@@ -10401,7 +10550,7 @@ static inline bool
+@@ -10428,7 +10577,7 @@ static inline bool
  need_headerupdate(rdatasetheader_t *header, isc_stdtime_t now) {
  	if ((header->attributes &
  	     (RDATASET_ATTR_NONEXISTENT |
@@ -3394,7 +3394,7 @@ index baf7641..a8f4609 100644
  	      RDATASET_ATTR_ZEROTTL)) != 0)
  		return (false);
  
-@@ -10507,7 +10656,7 @@ expire_header(dns_rbtdb_t *rbtdb, rdatasetheader_t *header,
+@@ -10534,7 +10683,7 @@ expire_header(dns_rbtdb_t *rbtdb, rdatasetheader_t *header,
  	      bool tree_locked, expire_t reason)
  {
  	set_ttl(rbtdb, header, 0);
@@ -3404,7 +3404,7 @@ index baf7641..a8f4609 100644
  	/*
  	 * Caller must hold the node (write) lock.
 diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
-index f7f73cd..7a77bde 100644
+index 5e20783..17a4eee 100644
 --- a/lib/dns/resolver.c
 +++ b/lib/dns/resolver.c
 @@ -141,16 +141,17 @@
@@ -3437,7 +3437,7 @@ index f7f73cd..7a77bde 100644
  #endif
  
  /* The default maximum number of recursions to follow before giving up. */
-@@ -523,6 +524,11 @@ struct dns_resolver {
+@@ -529,6 +530,11 @@ struct dns_resolver {
  	dns_fetch_t *			primefetch;
  	/* Locked by nlock. */
  	unsigned int			nfctx;
@@ -3449,7 +3449,7 @@ index f7f73cd..7a77bde 100644
  };
  
  #define RES_MAGIC			ISC_MAGIC('R', 'e', 's', '!')
-@@ -1633,14 +1639,12 @@ fctx_setretryinterval(fetchctx_t *fctx, unsigned int rtt) {
+@@ -1650,14 +1656,12 @@ fctx_setretryinterval(fetchctx_t *fctx, unsigned int rtt) {
  	unsigned int seconds;
  	unsigned int us;
  
@@ -3468,7 +3468,7 @@ index f7f73cd..7a77bde 100644
  
  	/*
  	 * Add a fudge factor to the expected rtt based on the current
-@@ -4518,7 +4522,8 @@ fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type,
+@@ -4535,7 +4539,8 @@ fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type,
  	/*
  	 * Compute an expiration time for the entire fetch.
  	 */
@@ -3478,7 +3478,7 @@ index f7f73cd..7a77bde 100644
  	iresult = isc_time_nowplusinterval(&fctx->expires, &interval);
  	if (iresult != ISC_R_SUCCESS) {
  		UNEXPECTED_ERROR(__FILE__, __LINE__,
-@@ -9005,6 +9010,8 @@ dns_resolver_create(dns_view_t *view,
+@@ -9059,6 +9064,8 @@ dns_resolver_create(dns_view_t *view,
  	res->spillattimer = NULL;
  	res->zspill = 0;
  	res->zero_no_soa_ttl = false;
@@ -3487,7 +3487,7 @@ index f7f73cd..7a77bde 100644
  	res->query_timeout = DEFAULT_QUERY_TIMEOUT;
  	res->maxdepth = DEFAULT_RECURSION_DEPTH;
  	res->maxqueries = DEFAULT_MAX_QUERIES;
-@@ -10339,17 +10346,20 @@ dns_resolver_gettimeout(dns_resolver_t *resolver) {
+@@ -10393,17 +10400,20 @@ dns_resolver_gettimeout(dns_resolver_t *resolver) {
  }
  
  void
@@ -3516,7 +3516,7 @@ index f7f73cd..7a77bde 100644
  }
  
  void
-@@ -10446,3 +10456,34 @@ dns_resolver_getquotaresponse(dns_resolver_t *resolver, dns_quotatype_t which)
+@@ -10500,3 +10510,34 @@ dns_resolver_getquotaresponse(dns_resolver_t *resolver, dns_quotatype_t which)
  
  	return (resolver->quotaresp[which]);
  }
@@ -3552,7 +3552,7 @@ index f7f73cd..7a77bde 100644
 +	resolver->nonbackofftries = tries;
 +}
 diff --git a/lib/dns/sdb.c b/lib/dns/sdb.c
-index 8afaa52..b370e05 100644
+index 477bb74..09cf932 100644
 --- a/lib/dns/sdb.c
 +++ b/lib/dns/sdb.c
 @@ -1370,7 +1370,9 @@ static dns_dbmethods_t sdb_methods = {
@@ -3567,7 +3567,7 @@ index 8afaa52..b370e05 100644
  
  static isc_result_t
 diff --git a/lib/dns/sdlz.c b/lib/dns/sdlz.c
-index 0b9620c..331992e 100644
+index 037d74a..9218fed 100644
 --- a/lib/dns/sdlz.c
 +++ b/lib/dns/sdlz.c
 @@ -1336,7 +1336,9 @@ static dns_dbmethods_t sdlzdb_methods = {
@@ -3582,7 +3582,7 @@ index 0b9620c..331992e 100644
  
  /*
 diff --git a/lib/dns/tests/db_test.c b/lib/dns/tests/db_test.c
-index 2849775..812f750 100644
+index bc1cc3f..60fdb81 100644
 --- a/lib/dns/tests/db_test.c
 +++ b/lib/dns/tests/db_test.c
 @@ -28,8 +28,9 @@
@@ -3813,7 +3813,7 @@ index 2849775..812f750 100644
  						_setup, _teardown),
  		cmocka_unit_test_setup_teardown(dbtype_test,
 diff --git a/lib/dns/view.c b/lib/dns/view.c
-index 0fca1d9..55ede81 100644
+index a7ba613..a644c5f 100644
 --- a/lib/dns/view.c
 +++ b/lib/dns/view.c
 @@ -229,6 +229,9 @@ dns_view_create(isc_mem_t *mctx, dns_rdataclass_t rdclass,
@@ -3827,7 +3827,7 @@ index 0fca1d9..55ede81 100644
  	view->maxbits = 0;
  	view->v4_aaaa = dns_aaaa_ok;
 diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
-index 91693b5..5771774 100644
+index 212194e..b562f95 100644
 --- a/lib/isccfg/namedconf.c
 +++ b/lib/isccfg/namedconf.c
 @@ -1778,6 +1778,7 @@ view_clauses[] = {
diff --git a/bind-9.11.23-atomic.patch b/bind-9.11.23-atomic.patch
deleted file mode 100644
index b5c37ec..0000000
--- a/bind-9.11.23-atomic.patch
+++ /dev/null
@@ -1,178 +0,0 @@
-From 1528f231b559670445cfc427937174535981917d Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Fri, 18 Sep 2020 14:46:02 +0200
-Subject: [PATCH] Fix isc_atomic_xadd symbol missing
-
-Squashed commit of the following:
-
-commit d8afe85342f05d8fec8ee0255451568e936b7eb2
-Author: Mark Andrews <marka@isc.org>
-Date:   Mon Sep 7 16:12:31 2020 +1000
-
-    Update 'init_count' atomically to silence tsan errors.
-
-    (cherry picked from commit 90185b225f4c7acde2fbb04697d857fe496725a2)
-
-commit f166c7fb7cc262a688ed511e40c9b0d551d5992d
-Author: Mark Andrews <marka@isc.org>
-Date:   Thu Sep 3 12:53:53 2020 +1000
-
-    The node lock was released too early.
-
-    NEGATIVE needs to be call with the node lock held.
-
-    WARNING: ThreadSanitizer: data race
-      Write of size 2 at 0x000000000001 by thread T1 (mutexes: write M1):
-        #0 mark_stale_header lib/dns/rbtdb.c:1802:21
-        #1 add32 lib/dns/rbtdb.c:6559:5
-        #2 addrdataset lib/dns/rbtdb.c:6975:12
-        #3 dns_db_addrdataset lib/dns/db.c:783:10
-        #4 cache_name lib/dns/resolver.c:5829:13
-        #5 cache_message lib/dns/resolver.c:5926:14
-        #6 resquery_response lib/dns/resolver.c:8618:12
-        #7 dispatch lib/isc/task.c:1157:7
-        #8 run lib/isc/task.c:1331:2
-
-      Previous read of size 2 at 0x000000000001 by thread T2:
-        #0 cache_findrdataset lib/dns/rbtdb.c:5932:6
-        #1 dns_db_findrdataset lib/dns/db.c:739:10
-        #2 query_addadditional2 bin/named/query.c:2196:11
-        #3 additionaldata_ns lib/dns/./rdata/generic/ns_2.c:198:10
-        #4 dns_rdata_additionaldata lib/dns/rdata.c:1246:2
-        #5 dns_rdataset_additionaldata lib/dns/rdataset.c:629:12
-        #6 query_addrdataset bin/named/query.c:2411:8
-        #7 query_addrrset bin/named/query.c:2802:2
-        #8 query_addbestns bin/named/query.c:3501:2
-        #9 query_find bin/named/query.c:9165:4
-        #10 query_resume bin/named/query.c:4164:12
-        #11 dispatch lib/isc/task.c:1157:7
-        #12 run lib/isc/task.c:1331:2
-
-    (cherry picked from commit a1dcb73f677969d99df3ccff2acf4737e18a72b1)
-
-commit 591a80fa95b8f3f3e716c45ceb9c5e4ccfa551c8
-Author: Mark Andrews <marka@isc.org>
-Date:   Mon Aug 24 17:34:58 2020 +1000
-
-    increment header->count atomically
-
-    (cherry picked from commit 121837aa75ced489e28f8ce1dd20315487d199fa)
----
- lib/dns/rbtdb.c | 43 +++++++++++++++++++++++++++++++++++--------
- 1 file changed, 35 insertions(+), 8 deletions(-)
-
-diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
-index 88c39bf714..31ced8e73a 100644
---- a/lib/dns/rbtdb.c
-+++ b/lib/dns/rbtdb.c
-@@ -399,6 +399,23 @@ typedef isc_mutex_t nodelock_t;
- #define NODE_WEAKDOWNGRADE(l)   ((void)0)
- #endif
- 
-+#if defined(ISC_PLATFORM_HAVESTDATOMIC)
-+#if defined(__cplusplus)
-+#include <isc/stdatomic.h>
-+#else
-+#include <stdatomic.h>
-+#endif
-+#define DNS_RBTDB_STDATOMIC 1
-+#define DNS_RBTDB_INC(x) atomic_fetch_add(&(x), (1))
-+#define DNS_RBTDB_LOAD(x) atomic_load(&(x))
-+#elif defined(ISC_PLATFORM_HAVEXADD)
-+#define DNS_RBTDB_INC(x) isc_atomic_xadd((int *)&(x), 1);
-+#define DNS_RBTDB_LOAD(x) isc_atomic_xadd((int *)&(x), 0);
-+#else
-+#define DNS_RBTDB_INC(x) ((x)++)
-+#define DNS_RBTDB_LOAD(x) (x)
-+#endif
-+
- /*%
-  * Whether to rate-limit updating the LRU to avoid possible thread contention.
-  * Our performance measurement has shown the cost is marginal, so it's defined
-@@ -457,7 +474,11 @@ typedef struct rdatasetheader {
- 	 * this rdataset.
- 	 */
- 
--	uint32_t                    count;
-+#ifdef DNS_RBTDB_STDATOMIC
-+	_Atomic(uint32_t)                count;
-+#else
-+	uint32_t                         count;
-+#endif
- 	/*%<
- 	 * Monotonously increased every time this rdataset is bound so that
- 	 * it is used as the base of the starting point in DNS responses
-@@ -952,7 +973,11 @@ static char FILE_VERSION[32] = "\0";
-  *      that indicates that the database does not implement cyclic
-  *      processing.
-  */
-+#ifdef DNS_RBTDB_STDATOMIC
-+static _Atomic(unsigned int) init_count;
-+#else
- static unsigned int init_count;
-+#endif
- 
- /*
-  * Locking
-@@ -3322,7 +3347,7 @@ bind_rdataset(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node, rdatasetheader_t *header,
- 	rdataset->private2 = node;
- 	raw = (unsigned char *)header + sizeof(*header);
- 	rdataset->private3 = raw;
--	rdataset->count = header->count++;
-+	rdataset->count = DNS_RBTDB_INC(header->count);
- 	if (rdataset->count == UINT32_MAX)
- 		rdataset->count = 0;
- 
-@@ -5924,10 +5949,10 @@ cache_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
- 		}
- 	}
- 
--	NODE_UNLOCK(lock, locktype);
--
--	if (found == NULL)
-+	if (found == NULL) {
-+		NODE_UNLOCK(lock, locktype);
- 		return (ISC_R_NOTFOUND);
-+	}
- 
- 	if (NEGATIVE(found)) {
- 		/*
-@@ -5939,6 +5964,8 @@ cache_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
- 			result = DNS_R_NCACHENXRRSET;
- 	}
- 
-+	NODE_UNLOCK(lock, locktype);
-+
- 	update_cachestats(rbtdb, result);
- 
- 	return (result);
-@@ -6839,7 +6866,7 @@ addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
- 		newheader->attributes |= RDATASET_ATTR_ZEROTTL;
- 	newheader->noqname = NULL;
- 	newheader->closest = NULL;
--	newheader->count = isc_atomic_xadd((int32_t*)&init_count, 1);
-+	newheader->count = DNS_RBTDB_INC(init_count);
- 	newheader->trust = rdataset->trust;
- 	newheader->additional_auth = NULL;
- 	newheader->additional_glue = NULL;
-@@ -7035,7 +7062,7 @@ subtractrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
- 	newheader->trust = 0;
- 	newheader->noqname = NULL;
- 	newheader->closest = NULL;
--	newheader->count = isc_atomic_xadd((int32_t*)&init_count, 1);
-+	newheader->count = DNS_RBTDB_INC(init_count);
- 	newheader->additional_auth = NULL;
- 	newheader->additional_glue = NULL;
- 	newheader->last_used = 0;
-@@ -7481,7 +7508,7 @@ loading_addrdataset(void *arg, dns_name_t *name, dns_rdataset_t *rdataset) {
- 	newheader->serial = 1;
- 	newheader->noqname = NULL;
- 	newheader->closest = NULL;
--	newheader->count = isc_atomic_xadd((int32_t*)&init_count, 1);
-+	newheader->count = DNS_RBTDB_INC(init_count);
- 	newheader->additional_auth = NULL;
- 	newheader->additional_glue = NULL;
- 	newheader->last_used = 0;
--- 
-2.26.2
-
diff --git a/bind.spec b/bind.spec
index a5c8020..1a90d93 100644
--- a/bind.spec
+++ b/bind.spec
@@ -58,7 +58,7 @@
 #
 
 # lib*.so.X versions of selected libraries
-%global sover_dns 1110
+%global sover_dns 1112
 %global sover_isc 1107
 %global sover_irs 161
 %global sover_isccfg 163
@@ -66,8 +66,8 @@
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.11.23
-Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Version:  9.11.24
+Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -145,10 +145,6 @@ Patch157:bind-9.11-fips-tests.patch
 Patch158:bind-9.11-rt31459.patch
 # [RT #46047] commit 24172bd2eeba91441ab1c65d2717b0692309244a ISC 4724
 Patch159:bind-9.11-rt46047.patch
-# commit 66ba2fdad583d962a1f4971c85d58381f0849e4d
-# commit b105ccee68ccc3c18e6ea530063b3c8e5a42571c
-# commit 083461d3329ff6f2410745848a926090586a9846
-Patch160:bind-9.11-rh1624100.patch
 # https://gitlab.isc.org/isc-projects/bind9/issues/555
 Patch161:bind-9.11-host-idn-disable.patch
 # https://gitlab.isc.org/isc-projects/bind9/commit/8a98277811e
@@ -166,10 +162,6 @@ Patch174:bind-9.11-json-c.patch
 Patch175:bind-9.11-fips-disable.patch
 Patch177: bind-9.11-serve-stale.patch
 Patch178: bind-9.11-serve-stale-dbfix.patch
-# https://bugzilla.redhat.com/show_bug.cgi?id=1736762
-Patch183: bind-9.11-rh1736762-5.patch
-# https://gitlab.isc.org/isc-projects/bind9/-/issues/2167
-Patch184: bind-9.11.23-atomic.patch
 
 # SDB patches
 Patch11: bind-9.3.2b2-sdbsrc.patch
@@ -571,7 +563,6 @@ are used for building ISC DHCP.
 %patch157 -p1 -b .fips-tests
 %patch158 -p1 -b .rt31459
 %patch159 -p1 -b .rt46047
-%patch160 -p1 -b .rh1624100
 %patch161 -p1 -b .host-idn-disable
 %patch163 -p1 -b .rh1663318
 %patch164 -p1 -b .rh1666814
@@ -584,8 +575,6 @@ are used for building ISC DHCP.
 %patch175 -p1 -b .rh1709553
 %patch177 -p1 -b .serve-stale
 %patch178 -p1 -b .rh1770492
-%patch183 -p1 -b .rh1736762-5
-%patch184 -p1 -b .rbtdb-atomic
 
 mkdir lib/dns/tests/testdata/dstrandom
 cp -a %{SOURCE50} lib/dns/tests/testdata/dstrandom/random.data
@@ -1619,6 +1608,9 @@ fi;
 %endif
 
 %changelog
+* Fri Oct 23 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.24-1
+- Update to 9.11.24
+
 * Wed Sep 23 2020 Adrian Reber <adrian@lisas.de> - 32:9.11.23-2
 - Rebuilt for protobuf 3.13
 
diff --git a/sources b/sources
index a76ec35..9a9dda2 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.11.23.tar.gz) = df374dcfdad5c905d5607fd3a5dcfd236f1c9ee448902db520748a738d1ff2f1761603bf62949d38932fcd3ebbf36e693737c40f0a6233af20ee91c3f9a3f462
-SHA512 (bind-9.11.23.tar.gz.asc) = afba039f50ad94fffa7891730d2d506a035f7abedeaec2f05abf19d030ffebc271b49e24adb3720f7bdb73318d52ededf0765ee082a6dc7cd9b581facafd411a
+SHA512 (bind-9.11.24.tar.gz) = 30b4910be9e59b1df9184ddbd95341494c08a2c530b02077f28492c248af607d7d4c6666459a0e7cc0e9ad6c2b12ff3e7b03f500a720b39d304008f0ab94d5fa
+SHA512 (bind-9.11.24.tar.gz.asc) = 7ec9a0fa9cc61ab64c2c2c67fabfe17311253da509dbe658dfe5a63d4fada2d0800a2e6d388d8303ccaa4ef110c5a110569724030df3a34dee58b0a58904bbcb

From b4711541c268311522488306310125b61706545c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 23 Oct 2020 20:30:49 +0200
Subject: [PATCH 209/460] Update to 9.16.8

DNS Flag Day 2020 - reduced default EDNS buffer to 1232.
New rndc dnssec -rollover command.

https://downloads.isc.org/isc/bind9/9.16.8/doc/arm/html/notes.html#notes-for-bind-9-16-8
---
 .gitignore                         |  2 +
 bind-9.10-dist-native-pkcs11.patch | 40 ++++++++---------
 bind-9.11-fips-tests.patch         | 69 +++++++++++++++---------------
 bind.spec                          | 15 ++++---
 sources                            |  4 +-
 5 files changed, 67 insertions(+), 63 deletions(-)

diff --git a/.gitignore b/.gitignore
index 7ff5f5f..20396a6 100644
--- a/.gitignore
+++ b/.gitignore
@@ -115,3 +115,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.16.6.tar.xz.asc
 /bind-9.16.7.tar.xz
 /bind-9.16.7.tar.xz.asc
+/bind-9.16.8.tar.xz
+/bind-9.16.8.tar.xz.asc
diff --git a/bind-9.10-dist-native-pkcs11.patch b/bind-9.10-dist-native-pkcs11.patch
index 0dfc74c..48ff40b 100644
--- a/bind-9.10-dist-native-pkcs11.patch
+++ b/bind-9.10-dist-native-pkcs11.patch
@@ -130,7 +130,7 @@ index ace0e5a..e0f6a00 100644
  	dnssec-importkey.@O@ ${OBJS} ${LIBS}
  
 diff --git a/bin/named-pkcs11/Makefile.in b/bin/named-pkcs11/Makefile.in
-index ed9add2..90bcec7 100644
+index 525f505..d517ec6 100644
 --- a/bin/named-pkcs11/Makefile.in
 +++ b/bin/named-pkcs11/Makefile.in
 @@ -37,13 +37,14 @@ DBDRIVER_LIBS =
@@ -153,7 +153,7 @@ index ed9add2..90bcec7 100644
  		${BIND9_INCLUDES} ${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} \
  		${ISC_INCLUDES} ${DLZDRIVER_INCLUDES} \
  		${DBDRIVER_INCLUDES} \
-@@ -54,24 +55,24 @@ CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
+@@ -55,24 +56,24 @@ CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
  		${LIBXML2_CFLAGS} \
  		${MAXMINDDB_CFLAGS}
  
@@ -183,7 +183,7 @@ index ed9add2..90bcec7 100644
  
  DEPLIBS =	${NSDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
  		${ISCCFGDEPLIBS} ${ISCCCDEPLIBS} ${ISCDEPLIBS}
-@@ -91,7 +92,7 @@ NOSYMLIBS =	${NSLIBS} ${DNSLIBS} ${BIND9LIBS} \
+@@ -92,7 +93,7 @@ NOSYMLIBS =	${NSLIBS} ${DNSLIBS} ${BIND9LIBS} \
  
  SUBDIRS =	unix
  
@@ -192,7 +192,7 @@ index ed9add2..90bcec7 100644
  
  GEOIP2LINKOBJS = geoip.@O@
  
-@@ -149,7 +150,7 @@ server.@O@: server.c
+@@ -150,7 +151,7 @@ server.@O@: server.c
  		-DPRODUCT=\"${PRODUCT}\" \
  		-DVERSION=\"${VERSION}\" -c ${srcdir}/server.c
  
@@ -201,7 +201,7 @@ index ed9add2..90bcec7 100644
  	export MAKE_SYMTABLE="yes"; \
  	export BASEOBJS="${OBJS} ${UOBJS}"; \
  	${FINALBUILDCMD}
-@@ -159,7 +160,7 @@ feature-test.@O@: ${top_srcdir}/bin/tests/system/feature-test.c
+@@ -160,7 +161,7 @@ feature-test.@O@: ${top_srcdir}/bin/tests/system/feature-test.c
  	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} \
  		-c ${top_srcdir}/bin/tests/system/feature-test.c
  
@@ -210,7 +210,7 @@ index ed9add2..90bcec7 100644
  	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} \
  		-o $@ feature-test.@O@ ${ISCLIBS} ${LIBS}
  
-@@ -178,11 +179,11 @@ statschannel.@O@: bind9.xsl.h
+@@ -179,11 +180,11 @@ statschannel.@O@: bind9.xsl.h
  installdirs:
  	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
  
@@ -226,10 +226,10 @@ index ed9add2..90bcec7 100644
  @DLZ_DRIVER_RULES@
  
 diff --git a/configure.ac b/configure.ac
-index 2ff68a5..2638ef2 100644
+index 1932000..cf15786 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -1214,12 +1214,14 @@ AC_SUBST(USE_GSSAPI)
+@@ -1244,12 +1244,14 @@ AC_SUBST(USE_GSSAPI)
  AC_SUBST(DST_GSSAPI_INC)
  AC_SUBST(DNS_GSSAPI_LIBS)
  DNS_CRYPTO_LIBS="$DNS_GSSAPI_LIBS"
@@ -244,7 +244,7 @@ index 2ff68a5..2638ef2 100644
  
  #
  # was --with-lmdb specified?
-@@ -2281,6 +2283,8 @@ AC_SUBST(BIND9_DNS_BUILDINCLUDE)
+@@ -2336,6 +2338,8 @@ AC_SUBST(BIND9_DNS_BUILDINCLUDE)
  AC_SUBST(BIND9_NS_BUILDINCLUDE)
  AC_SUBST(BIND9_BIND9_BUILDINCLUDE)
  AC_SUBST(BIND9_IRS_BUILDINCLUDE)
@@ -253,7 +253,7 @@ index 2ff68a5..2638ef2 100644
  if test "X$srcdir" != "X"; then
  	BIND9_ISC_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/isc/include"
  	BIND9_ISCCC_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/isccc/include"
-@@ -2289,6 +2293,8 @@ if test "X$srcdir" != "X"; then
+@@ -2344,6 +2348,8 @@ if test "X$srcdir" != "X"; then
  	BIND9_NS_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/ns/include"
  	BIND9_BIND9_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/bind9/include"
  	BIND9_IRS_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/irs/include"
@@ -262,7 +262,7 @@ index 2ff68a5..2638ef2 100644
  else
  	BIND9_ISC_BUILDINCLUDE=""
  	BIND9_ISCCC_BUILDINCLUDE=""
-@@ -2297,6 +2303,8 @@ else
+@@ -2352,6 +2358,8 @@ else
  	BIND9_NS_BUILDINCLUDE=""
  	BIND9_BIND9_BUILDINCLUDE=""
  	BIND9_IRS_BUILDINCLUDE=""
@@ -271,7 +271,7 @@ index 2ff68a5..2638ef2 100644
  fi
  
  AC_SUBST_FILE(BIND9_MAKE_INCLUDES)
-@@ -2757,8 +2765,11 @@ AC_CONFIG_FILES([
+@@ -2824,8 +2832,11 @@ AC_CONFIG_FILES([
  	bin/delv/Makefile
  	bin/dig/Makefile
  	bin/dnssec/Makefile
@@ -283,7 +283,7 @@ index 2ff68a5..2638ef2 100644
  	bin/nsupdate/Makefile
  	bin/pkcs11/Makefile
  	bin/plugins/Makefile
-@@ -2820,6 +2831,10 @@ AC_CONFIG_FILES([
+@@ -2887,6 +2898,10 @@ AC_CONFIG_FILES([
  	lib/dns/include/dns/Makefile
  	lib/dns/include/dst/Makefile
  	lib/dns/tests/Makefile
@@ -294,7 +294,7 @@ index 2ff68a5..2638ef2 100644
  	lib/irs/Makefile
  	lib/irs/include/Makefile
  	lib/irs/include/irs/Makefile
-@@ -2852,6 +2867,10 @@ AC_CONFIG_FILES([
+@@ -2919,6 +2934,10 @@ AC_CONFIG_FILES([
  	lib/ns/include/Makefile
  	lib/ns/include/ns/Makefile
  	lib/ns/tests/Makefile
@@ -481,19 +481,19 @@ index d00ddaf..b867afe 100644
 -	rm -f libns.@A@ timestamp
 +	rm -f libns-pkcs11.@A@ timestamp
 diff --git a/lib/ns-pkcs11/tests/Makefile.in b/lib/ns-pkcs11/tests/Makefile.in
-index 7869c8e..789d6cb 100644
+index ef1c1a6..5bbf10d 100644
 --- a/lib/ns-pkcs11/tests/Makefile.in
 +++ b/lib/ns-pkcs11/tests/Makefile.in
-@@ -21,17 +21,17 @@ WRAP_NAME =	-Wl,-install_name,${top_builddir}/lib/ns/tests/$@
- WRAP_RPATH =	-Wl,-rpath,${top_builddir}/lib/ns/tests
- WRAP_LIB =	-L${top_builddir}/lib/ns/tests -lwrap
+@@ -17,17 +17,17 @@ VERSION=@BIND9_VERSION@
+ 
+ WRAP_OPTIONS =	-Wl,--wrap=isc_nmhandle_detach -Wl,--wrap=isc_nmhandle_attach
  
 -CINCLUDES =	-I. -Iinclude ${NS_INCLUDES} ${DNS_INCLUDES} ${ISC_INCLUDES} \
 +CINCLUDES =	-I. -Iinclude ${NS_PKCS11_INCLUDES} ${DNS_PKCS11_INCLUDES} ${ISC_INCLUDES} \
  		${OPENSSL_CFLAGS} \
  		@CMOCKA_CFLAGS@
 -CDEFINES =	-DTESTS="\"${top_builddir}/lib/ns/tests/\"" -DNAMED_PLUGINDIR=\"${plugindir}\"
-+CDEFINES =	-DTESTS="\"${top_builddir}/lib/ns/tests/\"" -DNAMED_PLUGINDIR=\"${plugindir}\" @USE_PKCS11@
++CDEFINES =	-DTESTS="\"${top_builddir}/lib/ns-pkcs11/tests/\"" -DNAMED_PLUGINDIR=\"${plugindir}\" @USE_PKCS11@
  
  ISCLIBS =	../../isc/libisc.@A@ @NO_LIBTOOL_ISCLIBS@
  ISCDEPLIBS =	../../isc/libisc.@A@
@@ -509,7 +509,7 @@ index 7869c8e..789d6cb 100644
  LIBS =		@LIBS@ @CMOCKA_LIBS@
  
 diff --git a/make/includes.in b/make/includes.in
-index 9ff1bd8..ebab049 100644
+index 5373a7e..f1901ee 100644
 --- a/make/includes.in
 +++ b/make/includes.in
 @@ -41,3 +41,10 @@ BIND9_INCLUDES = @BIND9_BIND9_BUILDINCLUDE@ \
diff --git a/bind-9.11-fips-tests.patch b/bind-9.11-fips-tests.patch
index 7ee915b..03d7ad1 100644
--- a/bind-9.11-fips-tests.patch
+++ b/bind-9.11-fips-tests.patch
@@ -1,4 +1,4 @@
-From 303aae42064a4f6245f9c519953a5e6dd67510c0 Mon Sep 17 00:00:00 2001
+From cb648b203af5bf9085ad78d021f47c3baeb9b6e0 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 2 Aug 2018 23:46:45 +0200
 Subject: [PATCH] FIPS tests changes
@@ -82,16 +82,16 @@ Date:   Wed Mar 7 10:44:23 2018 +0100
  bin/tests/system/nsupdate/ns1/named.conf.in   |  2 +-
  bin/tests/system/nsupdate/ns2/named.conf.in   |  2 +-
  bin/tests/system/nsupdate/setup.sh            |  6 +-
- bin/tests/system/nsupdate/tests.sh            | 11 ++-
+ bin/tests/system/nsupdate/tests.sh            | 11 +++-
  bin/tests/system/rndc/setup.sh                |  2 +-
  bin/tests/system/rndc/tests.sh                | 23 ++++---
  bin/tests/system/tsig/ns1/named.conf.in       | 10 +--
  bin/tests/system/tsig/ns1/rndc5.conf.in       | 10 +++
  bin/tests/system/tsig/setup.sh                |  5 ++
- bin/tests/system/tsig/tests.sh                | 67 ++++++++++++-------
+ bin/tests/system/tsig/tests.sh                | 65 ++++++++++++-------
  bin/tests/system/upforwd/ns1/named.conf.in    |  2 +-
  bin/tests/system/upforwd/tests.sh             |  2 +-
- 33 files changed, 161 insertions(+), 107 deletions(-)
+ 33 files changed, 160 insertions(+), 106 deletions(-)
  create mode 100644 bin/tests/system/tsig/ns1/rndc5.conf.in
 
 diff --git a/bin/tests/system/acl/ns2/named1.conf.in b/bin/tests/system/acl/ns2/named1.conf.in
@@ -177,10 +177,10 @@ index 7cdcb6e..606a345 100644
  };
  
 diff --git a/bin/tests/system/acl/ns2/named5.conf.in b/bin/tests/system/acl/ns2/named5.conf.in
-index 4b4e050..0e679a8 100644
+index 7e20bac..9753a9d 100644
 --- a/bin/tests/system/acl/ns2/named5.conf.in
 +++ b/bin/tests/system/acl/ns2/named5.conf.in
-@@ -34,12 +34,12 @@ options {
+@@ -35,12 +35,12 @@ options {
  };
  
  key one {
@@ -196,7 +196,7 @@ index 4b4e050..0e679a8 100644
  };
  
 diff --git a/bin/tests/system/acl/tests.sh b/bin/tests/system/acl/tests.sh
-index fe49a86..d7819f1 100644
+index b4d3045..ebbc798 100644
 --- a/bin/tests/system/acl/tests.sh
 +++ b/bin/tests/system/acl/tests.sh
 @@ -22,14 +22,14 @@ echo_i "testing basic ACL processing"
@@ -431,7 +431,7 @@ index f4bc399..e01f312 100644
  };
  
 diff --git a/bin/tests/system/allow-query/tests.sh b/bin/tests/system/allow-query/tests.sh
-index 479910c..53b9e5c 100644
+index 4cb2709..c0884cf 100644
 --- a/bin/tests/system/allow-query/tests.sh
 +++ b/bin/tests/system/allow-query/tests.sh
 @@ -182,7 +182,7 @@ rndc_reload ns2 10.53.0.2
@@ -551,10 +551,10 @@ index 21be03e..e57c308 100644
  };
  
 diff --git a/bin/tests/system/checkconf/good.conf b/bin/tests/system/checkconf/good.conf
-index 2eb2850..9e6913d 100644
+index 0dabe54..d55c51b 100644
 --- a/bin/tests/system/checkconf/good.conf
 +++ b/bin/tests/system/checkconf/good.conf
-@@ -197,6 +197,6 @@ dyndb "name" "library.so" {
+@@ -204,6 +204,6 @@ dyndb "name" "library.so" {
  	system;
  };
  key "mykey" {
@@ -563,7 +563,7 @@ index 2eb2850..9e6913d 100644
  	secret "qwertyuiopasdfgh";
  };
 diff --git a/bin/tests/system/feature-test.c b/bin/tests/system/feature-test.c
-index 204d612..684fab6 100644
+index 4a90332..2f85b44 100644
 --- a/bin/tests/system/feature-test.c
 +++ b/bin/tests/system/feature-test.c
 @@ -14,6 +14,7 @@
@@ -574,7 +574,7 @@ index 204d612..684fab6 100644
  #include <isc/net.h>
  #include <isc/print.h>
  #include <isc/util.h>
-@@ -158,6 +159,19 @@ main(int argc, char **argv) {
+@@ -177,6 +178,19 @@ main(int argc, char **argv) {
  #endif /* ifdef DLZ_FILESYSTEM */
  	}
  
@@ -591,8 +591,8 @@ index 204d612..684fab6 100644
 +		}
 +	}
 +
- 	if (strcmp(argv[1], "--ipv6only=no") == 0) {
- #ifdef WIN32
+ 	if (strcmp(argv[1], "--with-idn") == 0) {
+ #ifdef HAVE_LIBIDN2
  		return (0);
 diff --git a/bin/tests/system/notify/ns5/named.conf.in b/bin/tests/system/notify/ns5/named.conf.in
 index 2976bfc..256d846 100644
@@ -620,7 +620,7 @@ index 2976bfc..256d846 100644
  };
  
 diff --git a/bin/tests/system/notify/tests.sh b/bin/tests/system/notify/tests.sh
-index d54ab0d..ba38177 100644
+index 3d7e0b7..ec4d9a7 100644
 --- a/bin/tests/system/notify/tests.sh
 +++ b/bin/tests/system/notify/tests.sh
 @@ -212,16 +212,16 @@ ret=0
@@ -644,7 +644,7 @@ index d54ab0d..ba38177 100644
  	grep "test string" dig.out.b.ns5.test$n > /dev/null &&
  	grep "test string" dig.out.c.ns5.test$n > /dev/null &&
 diff --git a/bin/tests/system/nsupdate/ns1/named.conf.in b/bin/tests/system/nsupdate/ns1/named.conf.in
-index e7b6adb..4ad5cc1 100644
+index 346b647..c018fb4 100644
 --- a/bin/tests/system/nsupdate/ns1/named.conf.in
 +++ b/bin/tests/system/nsupdate/ns1/named.conf.in
 @@ -33,7 +33,7 @@ controls {
@@ -670,7 +670,7 @@ index b703843..8bfe2b0 100644
  };
  
 diff --git a/bin/tests/system/nsupdate/setup.sh b/bin/tests/system/nsupdate/setup.sh
-index 5d70114..6c4b55a 100644
+index c055da3..4e1242b 100644
 --- a/bin/tests/system/nsupdate/setup.sh
 +++ b/bin/tests/system/nsupdate/setup.sh
 @@ -56,7 +56,11 @@ EOF
@@ -687,10 +687,10 @@ index 5d70114..6c4b55a 100644
  $DDNSCONFGEN -q -a hmac-sha224 -k sha224-key -z keytests.nil > ns1/sha224.key
  $DDNSCONFGEN -q -a hmac-sha256 -k sha256-key -z keytests.nil > ns1/sha256.key
 diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh
-index 72a282a..5d42e04 100755
+index b15fa2d..cb7979b 100755
 --- a/bin/tests/system/nsupdate/tests.sh
 +++ b/bin/tests/system/nsupdate/tests.sh
-@@ -715,7 +715,14 @@ fi
+@@ -797,7 +797,14 @@ fi
  n=`expr $n + 1`
  ret=0
  echo_i "check TSIG key algorithms ($n)"
@@ -706,7 +706,7 @@ index 72a282a..5d42e04 100755
      $NSUPDATE -k ns1/${alg}.key <<END > /dev/null || ret=1
  server 10.53.0.1 ${PORT}
  update add ${alg}.keytests.nil. 600 A 10.10.10.3
-@@ -723,7 +730,7 @@ send
+@@ -805,7 +812,7 @@ send
  END
  done
  sleep 2
@@ -716,7 +716,7 @@ index 72a282a..5d42e04 100755
  done
  if [ $ret -ne 0 ]; then
 diff --git a/bin/tests/system/rndc/setup.sh b/bin/tests/system/rndc/setup.sh
-index 6b539d1..4d7eaa2 100644
+index b59e7a7..04d5f5a 100644
 --- a/bin/tests/system/rndc/setup.sh
 +++ b/bin/tests/system/rndc/setup.sh
 @@ -33,7 +33,7 @@ make_key () {
@@ -729,7 +729,7 @@ index 6b539d1..4d7eaa2 100644
  make_key 3 ${EXTRAPORT3} hmac-sha224
  make_key 4 ${EXTRAPORT4} hmac-sha256
 diff --git a/bin/tests/system/rndc/tests.sh b/bin/tests/system/rndc/tests.sh
-index 2af855a..36cd1aa 100644
+index 78508f3..a2a201e 100644
 --- a/bin/tests/system/rndc/tests.sh
 +++ b/bin/tests/system/rndc/tests.sh
 @@ -348,15 +348,20 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -763,7 +763,7 @@ index 2af855a..36cd1aa 100644
  n=`expr $n + 1`
  echo_i "testing rndc with hmac-sha1 ($n)"
 diff --git a/bin/tests/system/tsig/ns1/named.conf.in b/bin/tests/system/tsig/ns1/named.conf.in
-index fbf30c6..f61657d 100644
+index 4ee703f..635434e 100644
 --- a/bin/tests/system/tsig/ns1/named.conf.in
 +++ b/bin/tests/system/tsig/ns1/named.conf.in
 @@ -21,10 +21,7 @@ options {
@@ -807,7 +807,7 @@ index 0000000..0682194
 +	algorithm hmac-md5-80;
 +};
 diff --git a/bin/tests/system/tsig/setup.sh b/bin/tests/system/tsig/setup.sh
-index b3e0450..90a6ce4 100644
+index e3b4a45..ae21d04 100644
 --- a/bin/tests/system/tsig/setup.sh
 +++ b/bin/tests/system/tsig/setup.sh
 @@ -15,3 +15,8 @@ SYSTEMTESTTOP=..
@@ -820,7 +820,7 @@ index b3e0450..90a6ce4 100644
 +	cat ns1/rndc5.conf.in >> ns1/named.conf
 +fi
 diff --git a/bin/tests/system/tsig/tests.sh b/bin/tests/system/tsig/tests.sh
-index 3a720de..e20e7f9 100644
+index 38d842a..668aa6f 100644
 --- a/bin/tests/system/tsig/tests.sh
 +++ b/bin/tests/system/tsig/tests.sh
 @@ -26,20 +26,25 @@ sha512="jI/Pa4qRu96t76Pns5Z/Ndxbn3QCkwcxLOgt9vgvnJw5wqTRvNyk3FtD6yIMd1dWVlqZ+Y4f
@@ -834,13 +834,6 @@ index 3a720de..e20e7f9 100644
 -if [ $ret -eq 1 ] ; then
 -	echo_i "failed"; status=1
 -fi
--
--echo_i "fetching using hmac-md5 (new form)"
--ret=0
--$DIG $DIGOPTS example.nil. -y "hmac-md5:md5:$md5" @10.53.0.1 soa > dig.out.md5.new || ret=1
--grep -i "md5.*TSIG.*NOERROR" dig.out.md5.new > /dev/null || ret=1
--if [ $ret -eq 1 ] ; then
--	echo_i "failed"; status=1
 +if $FEATURETEST --md5
 +then
 +	echo_i "fetching using hmac-md5 (old form)"
@@ -850,7 +843,13 @@ index 3a720de..e20e7f9 100644
 +	if [ $ret -eq 1 ] ; then
 +		echo_i "failed"; status=1
 +	fi
-+
+ 
+-echo_i "fetching using hmac-md5 (new form)"
+-ret=0
+-$DIG $DIGOPTS example.nil. -y "hmac-md5:md5:$md5" @10.53.0.1 soa > dig.out.md5.new || ret=1
+-grep -i "md5.*TSIG.*NOERROR" dig.out.md5.new > /dev/null || ret=1
+-if [ $ret -eq 1 ] ; then
+-	echo_i "failed"; status=1
 +	echo_i "fetching using hmac-md5 (new form)"
 +	ret=0
 +	$DIG $DIGOPTS example.nil. -y "hmac-md5:md5:$md5" @10.53.0.1 soa > dig.out.md5.new || ret=1
@@ -925,7 +924,7 @@ index ea42b4d..08676da 100644
  };
  
 diff --git a/bin/tests/system/upforwd/tests.sh b/bin/tests/system/upforwd/tests.sh
-index 3b0d7b3..cc1ae3e 100644
+index ecd91a6..be9993a 100644
 --- a/bin/tests/system/upforwd/tests.sh
 +++ b/bin/tests/system/upforwd/tests.sh
 @@ -66,7 +66,7 @@ if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
@@ -938,5 +937,5 @@ index 3b0d7b3..cc1ae3e 100644
  update add updated.example. 600 A 10.10.10.1
  update add updated.example. 600 TXT Foo
 -- 
-2.21.1
+2.26.2
 
diff --git a/bind.spec b/bind.spec
index 4f649a0..7eb101a 100644
--- a/bind.spec
+++ b/bind.spec
@@ -55,24 +55,24 @@
 # no more isc-config.sh and bind9-config
 
 # lib*.so.X versions of selected libraries
-%global sover_dns 1607
-%global sover_isc 1606
+%global sover_dns 1608
+%global sover_isc 1607
 %global sover_irs 1601
 %global sover_isccfg 1601
-%global sover_ns 1604
+%global sover_ns 1605
 
 
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.16.7
+Version:  9.16.8
 Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
-Source:   https://ftp.isc.org/isc/bind9/%{BINDVERSION}/bind-%{BINDVERSION}.tar.xz
+Source0:  https://downloads.isc.org/isc/bind9/%{BINDVERSION}/bind-%{BINDVERSION}.tar.xz
 Source1:  named.sysconfig
-Source2:  https://ftp.isc.org/isc/bind9/%{BINDVERSION}/bind-%{BINDVERSION}.tar.xz.asc
+Source2:  https://downloads.isc.org/isc/bind9/%{BINDVERSION}/bind-%{BINDVERSION}.tar.xz.asc
 Source3:  named.logrotate
 Source4:  https://downloads.isc.org/isc/pgpkeys/codesign2019.txt
 Source16: named.conf
@@ -1161,6 +1161,9 @@ fi;
 %endif
 
 %changelog
+* Fri Oct 23 2020 Petr Menšík <pemensik@redhat.com> - 32:9.16.8-1
+- Update to 9.16.8
+
 * Thu Sep 17 2020 Petr Menšík <pemensik@redhat.com> - 32:9.16.7-1
 - Update to 9.16.7
 
diff --git a/sources b/sources
index 0dab457..0b7efe9 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.16.7.tar.xz) = 176c84657e8a7b10a7ca93c939ca6a7fcdefb22f9200c3f01be59bcd8990dee27b8dc0970299225bcbe0f1aa8f49a67c80c4a9853895ffbcd685adb9674e7768
-SHA512 (bind-9.16.7.tar.xz.asc) = a94721692a3c400aa9df9499874ac833e605a647ec8e4e42065bf4822581eb6e3cfb8b5f61e127fb069e821364de9aef2030fa7bb456616993321897e06c7ec4
+SHA512 (bind-9.16.8.tar.xz) = 803af842b4f83c16556036f3a2a52b4aeab4781bafb35385b786a3331cf17ef6148c23928f6903fd371337ba92870d7a8548f5d178b805d160d0af34af45fee7
+SHA512 (bind-9.16.8.tar.xz.asc) = e33fdd6dc8b1fffc7ffaf4b23a5b1c2b7e75296cff745b3e6bc35f362e42097b52202600f9b1762e7c6193e295254335cf992ffa3d34ee85cda8fad7b74bcb07

From aae89bb5edab5bfcdd61d69bc8b082ce38587f6d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 4 Nov 2020 15:31:29 +0100
Subject: [PATCH 210/460] Fix crash on NTA recheck failure (#1893761)

Call nta_detach() before dns_view_weakdetach() so view is available.
---
 bind-9.11-rh1893761.patch | 28 ++++++++++++++++++++++++++++
 bind.spec                 |  7 ++++++-
 2 files changed, 34 insertions(+), 1 deletion(-)
 create mode 100644 bind-9.11-rh1893761.patch

diff --git a/bind-9.11-rh1893761.patch b/bind-9.11-rh1893761.patch
new file mode 100644
index 0000000..0ce51dd
--- /dev/null
+++ b/bind-9.11-rh1893761.patch
@@ -0,0 +1,28 @@
+From ee53b9558fb73dc0c2f328fe91421f2c32e9a369 Mon Sep 17 00:00:00 2001
+From: Mark Andrews <marka@isc.org>
+Date: Tue, 3 Nov 2020 11:25:55 +1100
+Subject: [PATCH] Call nta_detach() before dns_view_weakdetach() so view is
+ available.
+
+(cherry picked from commit ea956976d1e89f49570a4690fbad377e4f607c77)
+---
+ lib/dns/nta.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/dns/nta.c b/lib/dns/nta.c
+index 79058bb9b5..73febe44ed 100644
+--- a/lib/dns/nta.c
++++ b/lib/dns/nta.c
+@@ -283,8 +283,8 @@ checkbogus(isc_task_t *task, isc_event_t *event) {
+ 					  &nta->sigrdataset,
+ 					  &nta->fetch);
+ 	if (result != ISC_R_SUCCESS) {
+-		dns_view_weakdetach(&view);
+ 		nta_detach(view->mctx, &nta);
++		dns_view_weakdetach(&view);
+ 	}
+ }
+ 
+-- 
+2.26.2
+
diff --git a/bind.spec b/bind.spec
index 1a90d93..9089da0 100644
--- a/bind.spec
+++ b/bind.spec
@@ -67,7 +67,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.11.24
-Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -162,6 +162,7 @@ Patch174:bind-9.11-json-c.patch
 Patch175:bind-9.11-fips-disable.patch
 Patch177: bind-9.11-serve-stale.patch
 Patch178: bind-9.11-serve-stale-dbfix.patch
+Patch179: bind-9.11-rh1893761.patch
 
 # SDB patches
 Patch11: bind-9.3.2b2-sdbsrc.patch
@@ -575,6 +576,7 @@ are used for building ISC DHCP.
 %patch175 -p1 -b .rh1709553
 %patch177 -p1 -b .serve-stale
 %patch178 -p1 -b .rh1770492
+%patch179 -p1 -b .rh1893761
 
 mkdir lib/dns/tests/testdata/dstrandom
 cp -a %{SOURCE50} lib/dns/tests/testdata/dstrandom/random.data
@@ -1608,6 +1610,9 @@ fi;
 %endif
 
 %changelog
+* Wed Nov 04 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.24-2
+- Fix crash on NTA recheck failure (#1893761)
+
 * Fri Oct 23 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.24-1
 - Update to 9.11.24
 

From ad33c6c09557956426b2c7053495496dc9c442cb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 26 Nov 2020 13:21:59 +0100
Subject: [PATCH 211/460] Update to BIND 9.11.25

Moved Red Hat specific changes from generated named.8 file to docbook.
It is regenerated to named.8 during the build.

Release notes: https://downloads.isc.org/isc/bind9/9.11.25/RELEASE-NOTES-bind-9.11.25.html
---
 .gitignore                  |   2 +
 bind-9.11-rh1893761.patch   |  28 -----
 bind-9.11-rt31459.patch     | 212 ++++++++++++++++++------------------
 bind-9.3.2-redhat_doc.patch | 166 ++++++++++++++++------------
 bind.spec                   |   9 +-
 sources                     |   4 +-
 6 files changed, 213 insertions(+), 208 deletions(-)
 delete mode 100644 bind-9.11-rh1893761.patch

diff --git a/.gitignore b/.gitignore
index 2333cba..25c757f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -118,3 +118,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.11.23.tar.gz.asc
 /bind-9.11.24.tar.gz
 /bind-9.11.24.tar.gz.asc
+/bind-9.11.25.tar.gz
+/bind-9.11.25.tar.gz.asc
diff --git a/bind-9.11-rh1893761.patch b/bind-9.11-rh1893761.patch
deleted file mode 100644
index 0ce51dd..0000000
--- a/bind-9.11-rh1893761.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-From ee53b9558fb73dc0c2f328fe91421f2c32e9a369 Mon Sep 17 00:00:00 2001
-From: Mark Andrews <marka@isc.org>
-Date: Tue, 3 Nov 2020 11:25:55 +1100
-Subject: [PATCH] Call nta_detach() before dns_view_weakdetach() so view is
- available.
-
-(cherry picked from commit ea956976d1e89f49570a4690fbad377e4f607c77)
----
- lib/dns/nta.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/lib/dns/nta.c b/lib/dns/nta.c
-index 79058bb9b5..73febe44ed 100644
---- a/lib/dns/nta.c
-+++ b/lib/dns/nta.c
-@@ -283,8 +283,8 @@ checkbogus(isc_task_t *task, isc_event_t *event) {
- 					  &nta->sigrdataset,
- 					  &nta->fetch);
- 	if (result != ISC_R_SUCCESS) {
--		dns_view_weakdetach(&view);
- 		nta_detach(view->mctx, &nta);
-+		dns_view_weakdetach(&view);
- 	}
- }
- 
--- 
-2.26.2
-
diff --git a/bind-9.11-rt31459.patch b/bind-9.11-rt31459.patch
index 266f78c..822839c 100644
--- a/bind-9.11-rt31459.patch
+++ b/bind-9.11-rt31459.patch
@@ -1,4 +1,4 @@
-From 5c29299e43db5a4e6f8b1b07af84dfe1687c4c2b Mon Sep 17 00:00:00 2001
+From 63d1fe9e1ac0db37f89cf31b40c35d6d22578ded Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Tue, 12 Sep 2017 19:05:46 -0700
 Subject: [PATCH] rebased rt31459c
@@ -53,7 +53,7 @@ Include new unit test
  create mode 100644 lib/dns/tests/dstrandom_test.c
 
 diff --git a/bin/confgen/keygen.c b/bin/confgen/keygen.c
-index 5015abb..295e16f 100644
+index 40cf74c..bd269e7 100644
 --- a/bin/confgen/keygen.c
 +++ b/bin/confgen/keygen.c
 @@ -165,6 +165,13 @@ generate_key(isc_mem_t *mctx, const char *randomfile, dns_secalg_t alg,
@@ -71,7 +71,7 @@ index 5015abb..295e16f 100644
  							     &entropy_source,
  							     randomfile,
 diff --git a/bin/dnssec/dnssec-dsfromkey.c b/bin/dnssec/dnssec-dsfromkey.c
-index d9d6bb9..de4b15f 100644
+index 4420f2d..9cb63a8 100644
 --- a/bin/dnssec/dnssec-dsfromkey.c
 +++ b/bin/dnssec/dnssec-dsfromkey.c
 @@ -498,14 +498,14 @@ main(int argc, char **argv) {
@@ -103,7 +103,7 @@ index d9d6bb9..de4b15f 100644
  	dns_name_destroy();
  	if (verbose > 10)
 diff --git a/bin/dnssec/dnssec-importkey.c b/bin/dnssec/dnssec-importkey.c
-index d65a514..04b3094 100644
+index dc9a293..52863a1 100644
 --- a/bin/dnssec/dnssec-importkey.c
 +++ b/bin/dnssec/dnssec-importkey.c
 @@ -404,14 +404,14 @@ main(int argc, char **argv) {
@@ -135,7 +135,7 @@ index d65a514..04b3094 100644
  	dns_name_destroy();
  	if (verbose > 10)
 diff --git a/bin/dnssec/dnssec-revoke.c b/bin/dnssec/dnssec-revoke.c
-index 7d82dbf..10f9359 100644
+index 0121a34..74a99b0 100644
 --- a/bin/dnssec/dnssec-revoke.c
 +++ b/bin/dnssec/dnssec-revoke.c
 @@ -184,14 +184,14 @@ main(int argc, char **argv) {
@@ -167,10 +167,10 @@ index 7d82dbf..10f9359 100644
  	if (verbose > 10)
  		isc_mem_stats(mctx, stdout);
 diff --git a/bin/dnssec/dnssec-settime.c b/bin/dnssec/dnssec-settime.c
-index 7afcaee..1cfa511 100644
+index f017895..2c568fc 100644
 --- a/bin/dnssec/dnssec-settime.c
 +++ b/bin/dnssec/dnssec-settime.c
-@@ -380,14 +380,14 @@ main(int argc, char **argv) {
+@@ -391,14 +391,14 @@ main(int argc, char **argv) {
  
  	if (ectx == NULL)
  		setup_entropy(mctx, NULL, &ectx);
@@ -188,7 +188,7 @@ index 7afcaee..1cfa511 100644
  	isc_entropy_stopcallbacksources(ectx);
  
  	if (predecessor != NULL) {
-@@ -672,8 +672,8 @@ main(int argc, char **argv) {
+@@ -683,8 +683,8 @@ main(int argc, char **argv) {
  	if (prevkey != NULL)
  		dst_key_free(&prevkey);
  	dst_key_free(&key);
@@ -199,10 +199,10 @@ index 7afcaee..1cfa511 100644
  	if (verbose > 10)
  		isc_mem_stats(mctx, stdout);
 diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c
-index 319a805..27ae4d4 100644
+index dde1b2f..7308fc6 100644
 --- a/bin/dnssec/dnssec-signzone.c
 +++ b/bin/dnssec/dnssec-signzone.c
-@@ -3460,14 +3460,15 @@ main(int argc, char *argv[]) {
+@@ -3465,14 +3465,15 @@ main(int argc, char *argv[]) {
  	if (!pseudorandom)
  		eflags |= ISC_ENTROPY_GOODONLY;
  
@@ -222,7 +222,7 @@ index 319a805..27ae4d4 100644
  	isc_stdtime_get(&now);
  
  	if (startstr != NULL) {
-@@ -3879,8 +3880,8 @@ main(int argc, char *argv[]) {
+@@ -3884,8 +3885,8 @@ main(int argc, char *argv[]) {
  	dns_master_styledestroy(&dsstyle, mctx);
  
  	cleanup_logging(&log);
@@ -233,7 +233,7 @@ index 319a805..27ae4d4 100644
  	dns_name_destroy();
  	if (verbose > 10)
 diff --git a/bin/dnssec/dnssec-verify.c b/bin/dnssec/dnssec-verify.c
-index 4c293bf..3263cbc 100644
+index 087cd5d..07c7294 100644
 --- a/bin/dnssec/dnssec-verify.c
 +++ b/bin/dnssec/dnssec-verify.c
 @@ -281,15 +281,15 @@ main(int argc, char *argv[]) {
@@ -257,7 +257,7 @@ index 4c293bf..3263cbc 100644
  
  	rdclass = strtoclass(classname);
 diff --git a/bin/dnssec/dnssectool.c b/bin/dnssec/dnssectool.c
-index 618ec5b..5654435 100644
+index 7f045e8..2a0f9c6 100644
 --- a/bin/dnssec/dnssectool.c
 +++ b/bin/dnssec/dnssectool.c
 @@ -34,6 +34,7 @@
@@ -293,7 +293,7 @@ index 618ec5b..5654435 100644
  					   usekeyboard);
  
 diff --git a/bin/named/server.c b/bin/named/server.c
-index 4e503e5..f27071f 100644
+index 30d38be..b2ae57c 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
 @@ -36,6 +36,7 @@
@@ -304,7 +304,7 @@ index 4e503e5..f27071f 100644
  #include <isc/portset.h>
  #include <isc/print.h>
  #include <isc/random.h>
-@@ -8217,6 +8218,10 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8286,6 +8287,10 @@ load_configuration(const char *filename, ns_server_t *server,
  				      "no source of entropy found");
  		} else {
  			const char *randomdev = cfg_obj_asstring(obj);
@@ -315,7 +315,7 @@ index 4e503e5..f27071f 100644
  			int level = ISC_LOG_ERROR;
  			result = isc_entropy_createfilesource(ns_g_entropy,
  							      randomdev);
-@@ -8251,6 +8256,7 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8320,6 +8325,7 @@ load_configuration(const char *filename, ns_server_t *server,
  				}
  				isc_entropy_detach(&ns_g_fallbackentropy);
  			}
@@ -324,10 +324,10 @@ index 4e503e5..f27071f 100644
  		}
  
 diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
-index bbb3936..0286987 100644
+index 5a2c660..7f15cbc 100644
 --- a/bin/nsupdate/nsupdate.c
 +++ b/bin/nsupdate/nsupdate.c
-@@ -272,7 +272,8 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
+@@ -278,7 +278,8 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
  	if (*ectx == NULL) {
  		result = isc_entropy_create(mctx, ectx);
  		if (result != ISC_R_SUCCESS)
@@ -337,7 +337,7 @@ index bbb3936..0286987 100644
  		ISC_LIST_INIT(sources);
  	}
  
-@@ -281,6 +282,13 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
+@@ -287,6 +288,13 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
  		randomfile = NULL;
  	}
  
@@ -351,7 +351,7 @@ index bbb3936..0286987 100644
  	result = isc_entropy_usebestsource(*ectx, &source, randomfile,
  					   usekeyboard);
  
-@@ -979,11 +987,11 @@ setup_system(void) {
+@@ -989,11 +997,11 @@ setup_system(void) {
  		}
  	}
  
@@ -366,7 +366,7 @@ index bbb3936..0286987 100644
  	result = dns_dispatchmgr_create(gmctx, entropy, &dispatchmgr);
  	check_result(result, "dns_dispatchmgr_create");
 diff --git a/bin/tests/makejournal.c b/bin/tests/makejournal.c
-index 61a41b0..acc71a1 100644
+index 68b5e5a..cd54c8d 100644
 --- a/bin/tests/makejournal.c
 +++ b/bin/tests/makejournal.c
 @@ -102,12 +102,12 @@ main(int argc, char **argv) {
@@ -386,7 +386,7 @@ index 61a41b0..acc71a1 100644
  	isc_log_registercategories(lctx, categories);
  	isc_log_setcontext(lctx);
 diff --git a/bin/tests/system/pipelined/pipequeries.c b/bin/tests/system/pipelined/pipequeries.c
-index c6ab7f8..f0a6ff2 100644
+index e16ec11..95b65bf 100644
 --- a/bin/tests/system/pipelined/pipequeries.c
 +++ b/bin/tests/system/pipelined/pipequeries.c
 @@ -204,6 +204,7 @@ sendqueries(isc_task_t *task, isc_event_t *event) {
@@ -448,7 +448,7 @@ index c6ab7f8..f0a6ff2 100644
  
  	isc_log_destroy(&lctx);
 diff --git a/bin/tests/system/pipelined/tests.sh b/bin/tests/system/pipelined/tests.sh
-index 61f1ff7..ed1302a 100644
+index c0a99a2..0245527 100644
 --- a/bin/tests/system/pipelined/tests.sh
 +++ b/bin/tests/system/pipelined/tests.sh
 @@ -19,7 +19,7 @@ status=0
@@ -470,7 +470,7 @@ index 61f1ff7..ed1302a 100644
  $DIFF refb outputb || ret=1
  if [ $ret != 0 ]; then echo_i "failed"; fi
 diff --git a/bin/tests/system/rsabigexponent/bigkey.c b/bin/tests/system/rsabigexponent/bigkey.c
-index 4462f2e..f06268d 100644
+index abf12ed..fa5182c 100644
 --- a/bin/tests/system/rsabigexponent/bigkey.c
 +++ b/bin/tests/system/rsabigexponent/bigkey.c
 @@ -20,6 +20,7 @@
@@ -492,7 +492,7 @@ index 4462f2e..f06268d 100644
  					"../random.data",
  					ISC_ENTROPY_KEYBOARDNO),
 diff --git a/bin/tests/system/tkey/keycreate.c b/bin/tests/system/tkey/keycreate.c
-index 653c951..fe8698e 100644
+index 34360aa..3236968 100644
 --- a/bin/tests/system/tkey/keycreate.c
 +++ b/bin/tests/system/tkey/keycreate.c
 @@ -206,6 +206,7 @@ sendquery(isc_task_t *task, isc_event_t *event) {
@@ -561,7 +561,7 @@ index 653c951..fe8698e 100644
  
  	isc_mem_destroy(&mctx);
 diff --git a/bin/tests/system/tkey/keydelete.c b/bin/tests/system/tkey/keydelete.c
-index 70a40c3..2146f9b 100644
+index 4b5b901..43fb6b0 100644
 --- a/bin/tests/system/tkey/keydelete.c
 +++ b/bin/tests/system/tkey/keydelete.c
 @@ -136,6 +136,7 @@ sendquery(isc_task_t *task, isc_event_t *event) {
@@ -630,50 +630,50 @@ index 70a40c3..2146f9b 100644
  
  	isc_mem_destroy(&mctx);
 diff --git a/bin/tests/system/tkey/tests.sh b/bin/tests/system/tkey/tests.sh
-index 9f90dd7..fad6c83 100644
+index b265156..bcd60a6 100644
 --- a/bin/tests/system/tkey/tests.sh
 +++ b/bin/tests/system/tkey/tests.sh
 @@ -33,7 +33,7 @@ for owner in . foo.example.
  do
- 	echo "I:creating new key using owner name \"$owner\""
+ 	echo_i "creating new key using owner name \"$owner\" ($n)"
  	ret=0
 -	keyname=`$KEYCREATE $dhkeyname $owner` || ret=1
 +	keyname=`$KEYCREATE -r $RANDFILE $dhkeyname $owner` || ret=1
  	if [ $ret != 0 ]; then
- 		echo "I:failed"
- 		status=`expr $status + $ret`
-@@ -55,7 +55,7 @@ do
+ 		echo_i "failed"
+ 		status=$((status+ret))
+@@ -57,7 +57,7 @@ do
  
- 	echo "I:deleting new key"
+ 	echo_i "deleting new key ($n)"
  	ret=0
 -	$KEYDELETE $keyname || ret=1
 +	$KEYDELETE -r $RANDFILE $keyname || ret=1
  	if [ $ret != 0 ]; then
- 		echo "I:failed"
+ 		echo_i "failed"
  	fi
-@@ -75,7 +75,7 @@ done
+@@ -79,7 +79,7 @@ done
  
- echo "I:creating new key using owner name bar.example."
+ echo_i "creating new key using owner name bar.example. ($n)"
  ret=0
 -keyname=`$KEYCREATE $dhkeyname bar.example.` || ret=1
 +keyname=`$KEYCREATE -r $RANDFILE $dhkeyname bar.example.` || ret=1
  if [ $ret != 0 ]; then
-         echo "I:failed"
- 	status=`expr $status + $ret`
-@@ -116,7 +116,7 @@ status=`expr $status + $ret`
+         echo_i "failed"
+ 	status=$((status+ret))
+@@ -124,7 +124,7 @@ n=$((n+1))
  
- echo "I:recreating the bar.example. key"
+ echo_i "recreating the bar.example. key ($n)"
  ret=0
 -keyname=`$KEYCREATE $dhkeyname bar.example.` || ret=1
 +keyname=`$KEYCREATE -r $RANDFILE $dhkeyname bar.example.` || ret=1
  if [ $ret != 0 ]; then
-         echo "I:failed"
- 	status=`expr $status + $ret`
+         echo_i "failed"
+ 	status=$((status+ret))
 diff --git a/bin/tools/mdig.c b/bin/tools/mdig.c
-index bf6dbb6..0416b21 100644
+index 26fa609..fb34aa0 100644
 --- a/bin/tools/mdig.c
 +++ b/bin/tools/mdig.c
-@@ -1972,12 +1972,11 @@ main(int argc, char *argv[]) {
+@@ -2005,12 +2005,11 @@ main(int argc, char *argv[]) {
  
  	ectx = NULL;
  	RUNCHECK(isc_entropy_create(mctx, &ectx));
@@ -688,7 +688,7 @@ index bf6dbb6..0416b21 100644
  	parse_args(false, argc, argv);
  	if (server == NULL)
 diff --git a/configure b/configure
-index 6d05371..33689c9 100755
+index 0faca65..d5ffc87 100755
 --- a/configure
 +++ b/configure
 @@ -640,6 +640,7 @@ ac_includes_default="\
@@ -723,7 +723,7 @@ index 6d05371..33689c9 100755
    --enable-largefile      64-bit file support
    --enable-backtrace      log stack backtrace on abort [default=yes]
    --enable-symtable       use internal symbol table for backtrace
-@@ -17144,6 +17148,7 @@ case "$use_openssl" in
+@@ -17205,6 +17209,7 @@ case "$use_openssl" in
  $as_echo "disabled because of native PKCS11" >&6; }
  		DST_OPENSSL_INC=""
  		CRYPTO="-DPKCS11CRYPTO"
@@ -731,7 +731,7 @@ index 6d05371..33689c9 100755
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -17158,6 +17163,7 @@ $as_echo "disabled because of native PKCS11" >&6; }
+@@ -17219,6 +17224,7 @@ $as_echo "disabled because of native PKCS11" >&6; }
  $as_echo "no" >&6; }
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -739,7 +739,7 @@ index 6d05371..33689c9 100755
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -17170,6 +17176,7 @@ $as_echo "no" >&6; }
+@@ -17231,6 +17237,7 @@ $as_echo "no" >&6; }
  	auto)
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -747,7 +747,7 @@ index 6d05371..33689c9 100755
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -17179,7 +17186,7 @@ $as_echo "no" >&6; }
+@@ -17240,7 +17247,7 @@ $as_echo "no" >&6; }
  		OPENSSLLINKOBJS=""
  		OPENSSLLINKSRCS=""
  		as_fn_error $? "OpenSSL was not found in any of $openssldirs; use --with-openssl=/path
@@ -756,7 +756,7 @@ index 6d05371..33689c9 100755
  		;;
  	*)
  		if test "yes" = "$want_native_pkcs11"
-@@ -17210,6 +17217,7 @@ $as_echo "not found" >&6; }
+@@ -17271,6 +17278,7 @@ $as_echo "not found" >&6; }
  			as_fn_error $? "\"$use_openssl/include/openssl/opensslv.h\" not found" "$LINENO" 5
  		fi
  		CRYPTO='-DOPENSSL'
@@ -764,7 +764,7 @@ index 6d05371..33689c9 100755
  		if test "/usr" = "$use_openssl"
  		then
  			DST_OPENSSL_INC=""
-@@ -17835,8 +17843,6 @@ fi
+@@ -17897,8 +17905,6 @@ fi
  # Use OpenSSL for hash functions
  #
  
@@ -773,7 +773,7 @@ index 6d05371..33689c9 100755
  ISC_PLATFORM_OPENSSLHASH="#undef ISC_PLATFORM_OPENSSLHASH"
  case $want_openssl_hash in
  	yes)
-@@ -18211,6 +18217,86 @@ if test "rt" = "$have_clock_gt"; then
+@@ -18273,6 +18279,86 @@ if test "rt" = "$have_clock_gt"; then
  	LIBS="-lrt $LIBS"
  fi
  
@@ -860,7 +860,7 @@ index 6d05371..33689c9 100755
  #
  # was --with-lmdb specified?
  #
-@@ -20441,9 +20527,12 @@ _ACEOF
+@@ -20549,9 +20635,12 @@ _ACEOF
  if ac_fn_c_try_compile "$LINENO"; then :
    { $as_echo "$as_me:${as_lineno-$LINENO}: result: size_t for buflen; int for flags" >&5
  $as_echo "size_t for buflen; int for flags" >&6; }
@@ -875,7 +875,7 @@ index 6d05371..33689c9 100755
  
  	 $as_echo "#define IRS_GETNAMEINFO_FLAGS_T int" >>confdefs.h
  
-@@ -21758,12 +21847,7 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
+@@ -21877,12 +21966,7 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
  ISC_PLATFORM_USESTDASM="#undef ISC_PLATFORM_USESTDASM"
  ISC_PLATFORM_USEMACASM="#undef ISC_PLATFORM_USEMACASM"
  if test "yes" = "$use_atomic"; then
@@ -889,7 +889,7 @@ index 6d05371..33689c9 100755
  # version HP92453-01 B.11.11.23709.GP, which incorrectly rejects
  # declarations like `int a3[[(sizeof (unsigned char)) >= 0]];'.
  # This bug is HP SR number 8606223364.
-@@ -21796,6 +21880,11 @@ cat >>confdefs.h <<_ACEOF
+@@ -21915,6 +21999,11 @@ cat >>confdefs.h <<_ACEOF
  _ACEOF
  
  
@@ -901,7 +901,7 @@ index 6d05371..33689c9 100755
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -21804,39 +21893,6 @@ _ACEOF
+@@ -21923,39 +22012,6 @@ _ACEOF
  		fi
  	;;
  	x86_64-*|amd64-*)
@@ -941,7 +941,7 @@ index 6d05371..33689c9 100755
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -21867,6 +21923,10 @@ $as_echo_n "checking architecture type for atomic operations... " >&6; }
+@@ -21986,6 +22042,10 @@ $as_echo_n "checking architecture type for atomic operations... " >&6; }
  $as_echo "$arch" >&6; }
  fi
  
@@ -952,7 +952,7 @@ index 6d05371..33689c9 100755
  if test "yes" = "$have_atomic"; then
  	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking compiler support for inline assembly code" >&5
  $as_echo_n "checking compiler support for inline assembly code... " >&6; }
-@@ -24421,6 +24481,30 @@ CFLAGS="$CFLAGS $SO_CFLAGS"
+@@ -24567,6 +24627,30 @@ CFLAGS="$CFLAGS $SO_CFLAGS"
  #
  dlzdir='${DLZ_DRIVER_DIR}'
  
@@ -983,7 +983,7 @@ index 6d05371..33689c9 100755
  #
  # Private autoconf macro to simplify configuring drivers:
  #
-@@ -24751,11 +24835,11 @@ $as_echo "no" >&6; }
+@@ -24897,11 +24981,11 @@ $as_echo "no" >&6; }
  $as_echo "using mysql with libs ${mysql_lib} and includes ${mysql_include}" >&6; }
  		;;
  	*)
@@ -998,7 +998,7 @@ index 6d05371..33689c9 100755
  		fi
  
  	CONTRIB_DLZ="$CONTRIB_DLZ -DDLZ_MYSQL"
-@@ -24840,7 +24924,7 @@ $as_echo "" >&6; }
+@@ -24986,7 +25070,7 @@ $as_echo "" >&6; }
  			# Check other locations for includes.
  			# Order is important (sigh).
  
@@ -1007,7 +1007,7 @@ index 6d05371..33689c9 100755
  			# include a blank element first
  			for d in "" $bdb_incdirs
  			do
-@@ -24865,57 +24949,9 @@ $as_echo "" >&6; }
+@@ -25011,57 +25095,9 @@ $as_echo "" >&6; }
  			bdb_libnames="db53 db-5.3 db51 db-5.1 db48 db-4.8 db47 db-4.7 db46 db-4.6 db45 db-4.5 db44 db-4.4 db43 db-4.3 db42 db-4.2 db41 db-4.1 db"
  			for d in $bdb_libnames
  			do
@@ -1067,7 +1067,7 @@ index 6d05371..33689c9 100755
  					break
  				fi
  			done
-@@ -25074,10 +25110,10 @@ $as_echo "no" >&6; }
+@@ -25220,10 +25256,10 @@ $as_echo "no" >&6; }
  		DLZ_DRIVER_INCLUDES="$DLZ_DRIVER_INCLUDES -I$use_dlz_ldap/include"
  		DLZ_DRIVER_LDAP_INCLUDES="-I$use_dlz_ldap/include"
  	fi
@@ -1081,7 +1081,7 @@ index 6d05371..33689c9 100755
  	fi
  
  
-@@ -25163,11 +25199,11 @@ fi
+@@ -25309,11 +25345,11 @@ fi
  		odbcdirs="/usr /usr/local /usr/pkg"
  		for d in $odbcdirs
  		do
@@ -1095,7 +1095,7 @@ index 6d05371..33689c9 100755
  				break
  			fi
  		done
-@@ -25442,6 +25478,8 @@ DNS_CRYPTO_LIBS="$NEWFLAGS"
+@@ -25588,6 +25624,8 @@ DNS_CRYPTO_LIBS="$NEWFLAGS"
  
  
  
@@ -1104,7 +1104,7 @@ index 6d05371..33689c9 100755
  #
  # Commands to run at the end of config.status.
  # Don't just put these into configure, it won't work right if somebody
-@@ -27819,6 +27857,8 @@ report() {
+@@ -27966,6 +28004,8 @@ report() {
  	    echo "    IPv6 support (--enable-ipv6)"
  	test "X$CRYPTO" = "X" -o "yes" = "$want_native_pkcs11" || \
  		echo "    OpenSSL cryptography/DNSSEC (--with-openssl)"
@@ -1113,7 +1113,7 @@ index 6d05371..33689c9 100755
  	test "X$PYTHON" = "X" || echo "    Python tools (--with-python)"
  	test "X$XMLSTATS" = "X" || echo "    XML statistics (--with-libxml2)"
  	test "X$JSONSTATS" = "X" || echo "    JSON statistics (--with-libjson)"
-@@ -27859,6 +27899,8 @@ report() {
+@@ -28006,6 +28046,8 @@ report() {
  	echo "    Very verbose query trace logging (--enable-querytrace)"
      test "no" = "$with_cmocka" || echo "    CMocka Unit Testing Framework (--with-cmocka)"
  
@@ -1122,7 +1122,7 @@ index 6d05371..33689c9 100755
      echo "    Dynamically loadable zone (DLZ) drivers:"
      test "no" = "$use_dlz_bdb" || \
  	echo "        Berkeley DB (--with-dlz-bdb)"
-@@ -27906,6 +27948,8 @@ report() {
+@@ -28053,6 +28095,8 @@ report() {
  	echo "    ECDSA algorithm support (--with-ecdsa)"
      test "X$CRYPTO" = "X" -o "yes" = "$OPENSSL_ED25519" -o "yes" = "$PKCS11_ED25519" || \
  	echo "    EDDSA algorithm support (--with-eddsa)"
@@ -1132,10 +1132,10 @@ index 6d05371..33689c9 100755
      test "yes" = "$enable_seccomp" || \
  	echo "    Use libseccomp system call filtering (--enable-seccomp)"
 diff --git a/configure.ac b/configure.ac
-index d10cde5..68bead8 100644
+index 78535bd..faef2e8 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -1550,6 +1550,7 @@ case "$use_openssl" in
+@@ -1598,6 +1598,7 @@ case "$use_openssl" in
  		AC_MSG_RESULT(disabled because of native PKCS11)
  		DST_OPENSSL_INC=""
  		CRYPTO="-DPKCS11CRYPTO"
@@ -1143,7 +1143,7 @@ index d10cde5..68bead8 100644
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -1563,6 +1564,7 @@ case "$use_openssl" in
+@@ -1611,6 +1612,7 @@ case "$use_openssl" in
  		AC_MSG_RESULT(no)
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -1151,7 +1151,7 @@ index d10cde5..68bead8 100644
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -1575,6 +1577,7 @@ case "$use_openssl" in
+@@ -1623,6 +1625,7 @@ case "$use_openssl" in
  	auto)
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -1159,7 +1159,7 @@ index d10cde5..68bead8 100644
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -1585,7 +1588,7 @@ case "$use_openssl" in
+@@ -1633,7 +1636,7 @@ case "$use_openssl" in
  		OPENSSLLINKSRCS=""
  		AC_MSG_ERROR(
  [OpenSSL was not found in any of $openssldirs; use --with-openssl=/path
@@ -1168,7 +1168,7 @@ index d10cde5..68bead8 100644
  		;;
  	*)
  		if test "yes" = "$want_native_pkcs11"
-@@ -1615,6 +1618,7 @@ If you don't want OpenSSL, use --without-openssl])
+@@ -1663,6 +1666,7 @@ If you don't want OpenSSL, use --without-openssl])
  			AC_MSG_ERROR(["$use_openssl/include/openssl/opensslv.h" not found])
  		fi
  		CRYPTO='-DOPENSSL'
@@ -1176,7 +1176,7 @@ index d10cde5..68bead8 100644
  		if test "/usr" = "$use_openssl"
  		then
  			DST_OPENSSL_INC=""
-@@ -2050,7 +2054,6 @@ fi
+@@ -2099,7 +2103,6 @@ fi
  # Use OpenSSL for hash functions
  #
  
@@ -1184,7 +1184,7 @@ index d10cde5..68bead8 100644
  ISC_PLATFORM_OPENSSLHASH="#undef ISC_PLATFORM_OPENSSLHASH"
  case $want_openssl_hash in
  	yes)
-@@ -2322,6 +2325,67 @@ if test "rt" = "$have_clock_gt"; then
+@@ -2371,6 +2374,67 @@ if test "rt" = "$have_clock_gt"; then
  	LIBS="-lrt $LIBS"
  fi
  
@@ -1252,7 +1252,7 @@ index d10cde5..68bead8 100644
  #
  # was --with-lmdb specified?
  #
-@@ -4098,12 +4162,12 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
+@@ -4188,12 +4252,12 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
  ISC_PLATFORM_USESTDASM="#undef ISC_PLATFORM_USESTDASM"
  ISC_PLATFORM_USEMACASM="#undef ISC_PLATFORM_USEMACASM"
  if test "yes" = "$use_atomic"; then
@@ -1266,7 +1266,7 @@ index d10cde5..68bead8 100644
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -4112,7 +4176,6 @@ if test "yes" = "$use_atomic"; then
+@@ -4202,7 +4266,6 @@ if test "yes" = "$use_atomic"; then
  		fi
  	;;
  	x86_64-*|amd64-*)
@@ -1274,7 +1274,7 @@ index d10cde5..68bead8 100644
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -5518,6 +5581,8 @@ report() {
+@@ -5635,6 +5698,8 @@ report() {
  	    echo "    IPv6 support (--enable-ipv6)"
  	test "X$CRYPTO" = "X" -o "yes" = "$want_native_pkcs11" || \
  		echo "    OpenSSL cryptography/DNSSEC (--with-openssl)"
@@ -1283,7 +1283,7 @@ index d10cde5..68bead8 100644
  	test "X$PYTHON" = "X" || echo "    Python tools (--with-python)"
  	test "X$XMLSTATS" = "X" || echo "    XML statistics (--with-libxml2)"
  	test "X$JSONSTATS" = "X" || echo "    JSON statistics (--with-libjson)"
-@@ -5558,6 +5623,8 @@ report() {
+@@ -5675,6 +5740,8 @@ report() {
  	echo "    Very verbose query trace logging (--enable-querytrace)"
      test "no" = "$with_cmocka" || echo "    CMocka Unit Testing Framework (--with-cmocka)"
  
@@ -1292,7 +1292,7 @@ index d10cde5..68bead8 100644
      echo "    Dynamically loadable zone (DLZ) drivers:"
      test "no" = "$use_dlz_bdb" || \
  	echo "        Berkeley DB (--with-dlz-bdb)"
-@@ -5605,6 +5672,8 @@ report() {
+@@ -5722,6 +5789,8 @@ report() {
  	echo "    ECDSA algorithm support (--with-ecdsa)"
      test "X$CRYPTO" = "X" -o "yes" = "$OPENSSL_ED25519" -o "yes" = "$PKCS11_ED25519" || \
  	echo "    EDDSA algorithm support (--with-eddsa)"
@@ -1302,7 +1302,7 @@ index d10cde5..68bead8 100644
      test "yes" = "$enable_seccomp" || \
  	echo "    Use libseccomp system call filtering (--enable-seccomp)"
 diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c
-index 65bf25d..1eccbe7 100644
+index 7a86506..aa54afc 100644
 --- a/lib/dns/dst_api.c
 +++ b/lib/dns/dst_api.c
 @@ -277,6 +277,12 @@ dst_lib_init2(isc_mem_t *mctx, isc_entropy_t *ectx,
@@ -1366,7 +1366,7 @@ index 65bf25d..1eccbe7 100644
  #endif
  }
 diff --git a/lib/dns/include/dst/dst.h b/lib/dns/include/dst/dst.h
-index 1924e74..6813c96 100644
+index 5b42ab4..3aba028 100644
 --- a/lib/dns/include/dst/dst.h
 +++ b/lib/dns/include/dst/dst.h
 @@ -159,6 +159,14 @@ dst_lib_destroy(void);
@@ -1385,10 +1385,10 @@ index 1924e74..6813c96 100644
  dst_algorithm_supported(unsigned int alg);
  /*%<
 diff --git a/lib/dns/lib.c b/lib/dns/lib.c
-index 304814b..60543c4 100644
+index d9417de..0dc935d 100644
 --- a/lib/dns/lib.c
 +++ b/lib/dns/lib.c
-@@ -18,6 +18,7 @@
+@@ -16,6 +16,7 @@
  #include <stdbool.h>
  #include <stddef.h>
  
@@ -1396,7 +1396,7 @@ index 304814b..60543c4 100644
  #include <isc/hash.h>
  #include <isc/mem.h>
  #include <isc/msgcat.h>
-@@ -78,6 +79,7 @@ static unsigned int references = 0;
+@@ -76,6 +77,7 @@ static unsigned int references = 0;
  static void
  initialize(void) {
  	isc_result_t result;
@@ -1404,7 +1404,7 @@ index 304814b..60543c4 100644
  
  	REQUIRE(initialize_done == false);
  
-@@ -88,11 +90,14 @@ initialize(void) {
+@@ -86,11 +88,14 @@ initialize(void) {
  	result = dns_ecdb_register(dns_g_mctx, &dbimp);
  	if (result != ISC_R_SUCCESS)
  		goto cleanup_mctx;
@@ -1421,7 +1421,7 @@ index 304814b..60543c4 100644
  	if (result != ISC_R_SUCCESS)
  		goto cleanup_hash;
  
-@@ -100,11 +105,17 @@ initialize(void) {
+@@ -98,11 +103,17 @@ initialize(void) {
  	if (result != ISC_R_SUCCESS)
  		goto cleanup_dst;
  
@@ -1440,7 +1440,7 @@ index 304814b..60543c4 100644
  	isc_hash_destroy();
    cleanup_db:
 diff --git a/lib/dns/openssl_link.c b/lib/dns/openssl_link.c
-index 13e838f..ffe0a69 100644
+index 1e57c71..3f4f822 100644
 --- a/lib/dns/openssl_link.c
 +++ b/lib/dns/openssl_link.c
 @@ -31,6 +31,7 @@
@@ -1624,7 +1624,7 @@ index 13e838f..ffe0a69 100644
  #endif /* OPENSSL */
  /*! \file */
 diff --git a/lib/dns/pkcs11.c b/lib/dns/pkcs11.c
-index 5a2c502..8eaef53 100644
+index 6b30309..20552fa 100644
 --- a/lib/dns/pkcs11.c
 +++ b/lib/dns/pkcs11.c
 @@ -13,12 +13,15 @@
@@ -1692,7 +1692,7 @@ index 937b548..f3c0e38 100644
  tap_test_program{name='gost_test'}
  tap_test_program{name='keytable_test'}
 diff --git a/lib/dns/tests/Makefile.in b/lib/dns/tests/Makefile.in
-index 90dc3a6..7671e1d 100644
+index 4126372..30cab17 100644
 --- a/lib/dns/tests/Makefile.in
 +++ b/lib/dns/tests/Makefile.in
 @@ -37,6 +37,7 @@ SRCS =		acl_test.c \
@@ -1845,10 +1845,10 @@ index 0000000..bd3d164
 +
 +#endif
 diff --git a/lib/dns/win32/libdns.def.in b/lib/dns/win32/libdns.def.in
-index 63be973..40b21fa 100644
+index 9c2ef79..f597049 100644
 --- a/lib/dns/win32/libdns.def.in
 +++ b/lib/dns/win32/libdns.def.in
-@@ -1485,6 +1485,13 @@ dst_lib_destroy
+@@ -1487,6 +1487,13 @@ dst_lib_destroy
  dst_lib_init
  dst_lib_init2
  dst_lib_initmsgcat
@@ -1863,7 +1863,7 @@ index 63be973..40b21fa 100644
  dst_region_computerid
  dst_result_register
 diff --git a/lib/isc/entropy.c b/lib/isc/entropy.c
-index 907e470..451544d 100644
+index 0c1f3ed..fdd17d7 100644
 --- a/lib/isc/entropy.c
 +++ b/lib/isc/entropy.c
 @@ -104,11 +104,15 @@ struct isc_entropy {
@@ -1921,7 +1921,7 @@ index 907e470..451544d 100644
 +	hook = myhook;
 +}
 diff --git a/lib/isc/include/isc/entropy.h b/lib/isc/include/isc/entropy.h
-index e8733db..c40a18c 100644
+index b5bc956..f32c9dc 100644
 --- a/lib/isc/include/isc/entropy.h
 +++ b/lib/isc/include/isc/entropy.h
 @@ -302,6 +302,18 @@ isc_entropy_usebestsource(isc_entropy_t *ectx, isc_entropysource_t **source,
@@ -1944,7 +1944,7 @@ index e8733db..c40a18c 100644
  
  #endif /* ISC_ENTROPY_H */
 diff --git a/lib/isc/include/isc/platform.h.in b/lib/isc/include/isc/platform.h.in
-index 61960f1..d22993d 100644
+index 2bf8758..f4c684e 100644
 --- a/lib/isc/include/isc/platform.h.in
 +++ b/lib/isc/include/isc/platform.h.in
 @@ -359,6 +359,11 @@
@@ -1960,10 +1960,10 @@ index 61960f1..d22993d 100644
   * Define if the hash functions must be provided by OpenSSL.
   */
 diff --git a/lib/isc/include/isc/types.h b/lib/isc/include/isc/types.h
-index da9d66f..4205400 100644
+index 3bdd54f..d5acd39 100644
 --- a/lib/isc/include/isc/types.h
 +++ b/lib/isc/include/isc/types.h
-@@ -97,6 +97,8 @@ typedef struct isc_time			isc_time_t;		/*%< Time */
+@@ -95,6 +95,8 @@ typedef struct isc_time			isc_time_t;		/*%< Time */
  typedef struct isc_timer		isc_timer_t;		/*%< Timer */
  typedef struct isc_timermgr		isc_timermgr_t;		/*%< Timer Manager */
  
@@ -1973,7 +1973,7 @@ index da9d66f..4205400 100644
  typedef int (*isc_sockfdwatch_t)(isc_task_t *, isc_socket_t *, void *, int);
  
 diff --git a/lib/isc/pk11.c b/lib/isc/pk11.c
-index 68aebdc..4b85527 100644
+index 227f807..4a63fdf 100644
 --- a/lib/isc/pk11.c
 +++ b/lib/isc/pk11.c
 @@ -321,14 +321,16 @@ pk11_rand_seed_fromfile(const char *randomfile) {
@@ -1999,7 +1999,7 @@ index 68aebdc..4b85527 100644
      cleanup:
  	if (stream != NULL)
 diff --git a/lib/isc/win32/include/isc/platform.h.in b/lib/isc/win32/include/isc/platform.h.in
-index 8ade705..fa72f9d 100644
+index 1f785e0..f9051c3 100644
 --- a/lib/isc/win32/include/isc/platform.h.in
 +++ b/lib/isc/win32/include/isc/platform.h.in
 @@ -73,6 +73,11 @@
@@ -2015,7 +2015,7 @@ index 8ade705..fa72f9d 100644
   * Define if the hash functions must be provided by OpenSSL.
   */
 diff --git a/win32utils/Configure b/win32utils/Configure
-index 79d682e..6c78cb2 100644
+index 5f66a82..ff39910 100644
 --- a/win32utils/Configure
 +++ b/win32utils/Configure
 @@ -382,6 +382,7 @@ my @substdefh = ("ALLOW_FILTER_AAAA",
@@ -2054,7 +2054,7 @@ index 79d682e..6c78cb2 100644
  my $enable_openssl_hash = "auto";
  my $enable_filter_aaaa = "yes";
  my $enable_isc_spnego = "yes";
-@@ -847,6 +852,10 @@ sub myenable {
+@@ -848,6 +853,10 @@ sub myenable {
          if ($val =~ /^yes$/i) {
              $enable_native_pkcs11 = "yes";
          }
@@ -2065,7 +2065,7 @@ index 79d682e..6c78cb2 100644
      } elsif ($key =~ /^openssl-hash$/i) {
          if ($val =~ /^yes$/i) {
              $enable_openssl_hash = "yes";
-@@ -1153,6 +1162,11 @@ if ($verbose) {
+@@ -1154,6 +1163,11 @@ if ($verbose) {
      } else {
          print "native-pkcs11: disabled\n";
      }
@@ -2077,7 +2077,7 @@ index 79d682e..6c78cb2 100644
      if ($enable_openssl_hash eq "yes") {
          print "openssl-hash: enabled\n";
      } else {
-@@ -1510,6 +1524,7 @@ if ($enable_intrinsics eq "yes") {
+@@ -1511,6 +1525,7 @@ if ($enable_intrinsics eq "yes") {
  
  # enable-native-pkcs11
  if ($enable_native_pkcs11 eq "yes") {
@@ -2085,7 +2085,7 @@ index 79d682e..6c78cb2 100644
      if ($use_openssl eq "auto") {
          $use_openssl = "no";
      }
-@@ -1719,6 +1734,7 @@ if ($use_openssl eq "yes") {
+@@ -1720,6 +1735,7 @@ if ($use_openssl eq "yes") {
          $openssl_dll = File::Spec->catdir($openssl_path, "@dirlist[0]");
      }   
  
@@ -2093,7 +2093,7 @@ index 79d682e..6c78cb2 100644
      $configcond{"OPENSSL"} = 1;
      $configdefd{"CRYPTO"} = "OPENSSL";
      $configvar{"OPENSSL_PATH"} = "$openssl_path";
-@@ -2290,6 +2306,15 @@ if ($use_aes eq "yes") {
+@@ -2291,6 +2307,15 @@ if ($use_aes eq "yes") {
  }
  
  
@@ -2109,7 +2109,7 @@ index 79d682e..6c78cb2 100644
  # enable-openssl-hash
  if ($enable_openssl_hash eq "yes") {
      if ($use_openssl eq "no") {
-@@ -3665,6 +3690,7 @@ exit 0;
+@@ -3673,6 +3698,7 @@ exit 0;
  #  --enable-developer partially supported
  #  --enable-newstats (9.9/9.9sub only)
  #  --enable-native-pkcs11 supported
@@ -2118,5 +2118,5 @@ index 79d682e..6c78cb2 100644
  #  --enable-openssl-hash supported
  #  --enable-threads included without a way to disable it
 -- 
-2.21.1
+2.26.2
 
diff --git a/bind-9.3.2-redhat_doc.patch b/bind-9.3.2-redhat_doc.patch
index d4531f4..d50374f 100644
--- a/bind-9.3.2-redhat_doc.patch
+++ b/bind-9.3.2-redhat_doc.patch
@@ -1,68 +1,98 @@
-diff --git a/bin/named/named.8 b/bin/named/named.8
-index ef10ef4..3150b22 100644
---- a/bin/named/named.8
-+++ b/bin/named/named.8
-@@ -349,6 +349,63 @@ The default configuration file\&.
- /var/run/named/named\&.pid
- .RS 4
- The default process\-id file\&.
-+.PP
-+.SH "NOTES"
-+.PP
-+.TP
-+\fBRed Hat SELinux BIND Security Profile:\fR
-+.PP
-+By default, Red Hat ships BIND with the most secure SELinux policy
-+that will not prevent normal BIND operation and will prevent exploitation
-+of all known BIND security vulnerabilities . See the selinux(8) man page
-+for information about SElinux.
-+.PP
-+It is not necessary to run named in a chroot environment if the Red Hat
-+SELinux policy for named is enabled. When enabled, this policy is far
-+more secure than a chroot environment. Users are recommended to enable
-+SELinux and remove the bind-chroot package.
-+.PP
-+With this extra security comes some restrictions:
-+.PP
-+By default, the SELinux policy does not allow named to write any master
-+zone database files. Only the root user may create files in the $ROOTDIR/var/named
-+zone database file directory (the options { "directory" } option), where
-+$ROOTDIR is set in /etc/sysconfig/named.
-+.PP
-+The "named" group must be granted read privelege to
-+these files in order for named to be enabled to read them.
-+.PP
-+Any file created in the zone database file directory is automatically assigned
-+the SELinux file context named_zone_t .
-+.PP
-+By default, SELinux prevents any role from modifying named_zone_t files; this
-+means that files in the zone database directory cannot be modified by dynamic
-+DNS (DDNS) updates or zone transfers.
-+.PP
-+The Red Hat BIND distribution and SELinux policy creates three directories where
-+named is allowed to create and modify files: /var/named/slaves, /var/named/dynamic
-+/var/named/data. By placing files you want named to modify, such as
-+slave or DDNS updateable zone files and database / statistics dump files in
-+these directories, named will work normally and no further operator action is
-+required. Files in these directories are automatically assigned the 'named_cache_t'
-+file context, which SELinux allows named to write.
-+.PP
-+\fBRed Hat BIND SDB support:\fR
-+.PP
-+Red Hat ships named with compiled in Simplified Database Backend modules that ISC
-+provides in the "contrib/sdb" directory. Install bind-sdb package if you want use them
-+.PP
-+The SDB modules for LDAP, PostGreSQL, DirDB and SQLite are compiled into named-sdb.
-+.PP
-+See the documentation for the various SDB modules in /usr/share/doc/bind-sdb-*/ .
-+.br
-+.PP
-+\fBRed Hat system-config-bind:\fR
-+.PP
-+Red Hat provides the system-config-bind GUI to configure named.conf and zone
-+database files. Run the "system-config-bind" command and access the manual
-+by selecting the Help menu.
-+.PP
- .RE
- .SH "SEE ALSO"
- .PP
+From facdbb0f2a266c6a3a1fa823afaa09cbd3fc38a5 Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Thu, 26 Nov 2020 12:13:10 +0100
+Subject: [PATCH] Note specific Red Hat changes in manual page
+
+Change docbook template instead of generated manual page. Remove
+system-config-bind reference, package were discontinued.
+---
+ bin/named/named.docbook | 73 +++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 73 insertions(+)
+
+diff --git a/bin/named/named.docbook b/bin/named/named.docbook
+index 7e743a9..802bec3 100644
+--- a/bin/named/named.docbook
++++ b/bin/named/named.docbook
+@@ -516,6 +516,79 @@
+ 
+   </refsection>
+ 
++  <refsection><info><title>NOTES</title></info>
++    <refsection><info><title>Red Hat SELinux BIND Security Profile</title></info>
++
++    <para>
++    By default, Red Hat ships BIND with the most secure SELinux policy
++    that will not prevent normal BIND operation and will prevent exploitation
++    of all known BIND security vulnerabilities . See the selinux(8) man page
++    for information about SElinux.
++    </para>
++
++    <para>
++    It is not necessary to run named in a chroot environment if the Red Hat
++    SELinux policy for named is enabled. When enabled, this policy is far
++    more secure than a chroot environment. Users are recommended to enable
++    SELinux and remove the bind-chroot package.
++    </para>
++
++    <para>
++    With this extra security comes some restrictions:
++    </para>
++
++    <para>
++    By default, the SELinux policy allows named to write any master
++    zone database files. Only the root user may create files in the $ROOTDIR/var/named
++    zone database file directory (the options { "directory" } option), where
++    $ROOTDIR is set in /etc/sysconfig/named.
++    </para>
++
++    <para>
++    The "named" group must be granted read privelege to
++    these files in order for named to be enabled to read them.
++    </para>
++
++    <para>
++    Any file created in the zone database file directory is automatically assigned
++    the SELinux file context named_zone_t .
++    </para>
++
++    <para>
++    By default, SELinux prevents any role from modifying named_zone_t files; this
++    means that files in the zone database directory cannot be modified by dynamic
++    DNS (DDNS) updates or zone transfers.
++    </para>
++
++    <para>
++    The Red Hat BIND distribution and SELinux policy creates three directories where
++    named is allowed to create and modify files: /var/named/slaves, /var/named/dynamic
++    /var/named/data. By placing files you want named to modify, such as
++    slave or DDNS updateable zone files and database / statistics dump files in
++    these directories, named will work normally and no further operator action is
++    required. Files in these directories are automatically assigned the 'named_cache_t'
++    file context, which SELinux allows named to write.
++    </para>
++    </refsection>
++
++    <refsection><info><title>Red Hat BIND SDB support</title></info>
++
++    <para>
++    Red Hat ships named with compiled in Simplified Database Backend modules that ISC
++    provides in the "contrib/sdb" directory. Install bind-sdb package if you want use them.
++    </para>
++
++    <para>
++    The SDB modules for LDAP, PostGreSQL, DirDB and SQLite are compiled into <command>named-sdb</command>.
++    </para>
++
++    <para>
++    See the documentation for the various SDB modules in /usr/share/doc/bind-sdb-*/ .
++    </para>
++    </refsection>
++
++  </refsection>
++
+   <refsection><info><title>SEE ALSO</title></info>
+ 
+     <para><citetitle>RFC 1033</citetitle>,
+-- 
+2.26.2
+
diff --git a/bind.spec b/bind.spec
index 9089da0..1ecdb8d 100644
--- a/bind.spec
+++ b/bind.spec
@@ -66,8 +66,8 @@
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.11.24
-Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Version:  9.11.25
+Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -162,7 +162,6 @@ Patch174:bind-9.11-json-c.patch
 Patch175:bind-9.11-fips-disable.patch
 Patch177: bind-9.11-serve-stale.patch
 Patch178: bind-9.11-serve-stale-dbfix.patch
-Patch179: bind-9.11-rh1893761.patch
 
 # SDB patches
 Patch11: bind-9.3.2b2-sdbsrc.patch
@@ -576,7 +575,6 @@ are used for building ISC DHCP.
 %patch175 -p1 -b .rh1709553
 %patch177 -p1 -b .serve-stale
 %patch178 -p1 -b .rh1770492
-%patch179 -p1 -b .rh1893761
 
 mkdir lib/dns/tests/testdata/dstrandom
 cp -a %{SOURCE50} lib/dns/tests/testdata/dstrandom/random.data
@@ -1610,6 +1608,9 @@ fi;
 %endif
 
 %changelog
+* Thu Nov 26 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.25-1
+- Update to 9.11.25
+
 * Wed Nov 04 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.24-2
 - Fix crash on NTA recheck failure (#1893761)
 
diff --git a/sources b/sources
index 9a9dda2..0f11c4e 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.11.24.tar.gz) = 30b4910be9e59b1df9184ddbd95341494c08a2c530b02077f28492c248af607d7d4c6666459a0e7cc0e9ad6c2b12ff3e7b03f500a720b39d304008f0ab94d5fa
-SHA512 (bind-9.11.24.tar.gz.asc) = 7ec9a0fa9cc61ab64c2c2c67fabfe17311253da509dbe658dfe5a63d4fada2d0800a2e6d388d8303ccaa4ef110c5a110569724030df3a34dee58b0a58904bbcb
+SHA512 (bind-9.11.25.tar.gz) = 852b15b6cf2f77ab103018e6fc078d856653c62c2db0ca2ef4f8bee64a60b06ed481d9fcdf29020e5072c69b9982545f032b2ab4c94dac28848150e04b9cecf9
+SHA512 (bind-9.11.25.tar.gz.asc) = 8cc8e5d21a445d918e82b42057f1d4e73ed977f4eb9584736008b71ae747078d500cc962c3bd03eb4f6a18688b642b108a8e3d673851b0dd4818fc9a33e5faf7

From 1f381a94698eba91ea0b5518fbcba73e9ef0c591 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 26 Nov 2020 15:17:59 +0100
Subject: [PATCH 212/460] Update to 9.16.9

Changes solib version, requires rebuild of dependent packages.

Upstream release notes:
https://downloads.isc.org/isc/bind9/9.16.9/doc/arm/html/notes.html#notes-for-bind-9-16-9
---
 .gitignore |  2 ++
 bind.spec  | 11 +++++++----
 sources    |  4 ++--
 3 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/.gitignore b/.gitignore
index 20396a6..2737bdf 100644
--- a/.gitignore
+++ b/.gitignore
@@ -117,3 +117,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.16.7.tar.xz.asc
 /bind-9.16.8.tar.xz
 /bind-9.16.8.tar.xz.asc
+/bind-9.16.9.tar.xz
+/bind-9.16.9.tar.xz.asc
diff --git a/bind.spec b/bind.spec
index 7eb101a..09c1aec 100644
--- a/bind.spec
+++ b/bind.spec
@@ -55,17 +55,17 @@
 # no more isc-config.sh and bind9-config
 
 # lib*.so.X versions of selected libraries
-%global sover_dns 1608
-%global sover_isc 1607
+%global sover_dns 1609
+%global sover_isc 1608
 %global sover_irs 1601
 %global sover_isccfg 1601
-%global sover_ns 1605
+%global sover_ns 1606
 
 
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.16.8
+Version:  9.16.9
 Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
@@ -1161,6 +1161,9 @@ fi;
 %endif
 
 %changelog
+* Thu Nov 26 2020 Petr Menšík <pemensik@redhat.com> - 32:9.16.9-1
+- Update to 9.16.9
+
 * Fri Oct 23 2020 Petr Menšík <pemensik@redhat.com> - 32:9.16.8-1
 - Update to 9.16.8
 
diff --git a/sources b/sources
index 0b7efe9..36feb7d 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.16.8.tar.xz) = 803af842b4f83c16556036f3a2a52b4aeab4781bafb35385b786a3331cf17ef6148c23928f6903fd371337ba92870d7a8548f5d178b805d160d0af34af45fee7
-SHA512 (bind-9.16.8.tar.xz.asc) = e33fdd6dc8b1fffc7ffaf4b23a5b1c2b7e75296cff745b3e6bc35f362e42097b52202600f9b1762e7c6193e295254335cf992ffa3d34ee85cda8fad7b74bcb07
+SHA512 (bind-9.16.9.tar.xz) = d5b7694c51d3756aa273efd19d08889d28dd0e80d4ee29660cd06de0fdbc16a77f4f0d2dd9faef527eea1e496ec3292d158a556a84d5aa3f42dbddbb9c890aac
+SHA512 (bind-9.16.9.tar.xz.asc) = 0e2092e91dc092c39b05acda817a350fc937a941890e537dc6ef40b473c40c42bb6058b4822eb8e8e7e9bb7ad560b7eff1a5b3942993daa6059187d412831b9c

From d553bc086fadb7e230c4ff9611d18f4ea376feed Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 26 Nov 2020 15:52:06 +0100
Subject: [PATCH 213/460] Support ifconfig.sh for out-of-tree builds

---
 bind.spec | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/bind.spec b/bind.spec
index 09c1aec..4198807 100644
--- a/bind.spec
+++ b/bind.spec
@@ -449,6 +449,8 @@ for i in bin/named/{,unix}/Makefile.in; do
   sed -i 's|fpie|fPIE|g' $i
 done
 %endif
+
+sed -e 's|"$TOP/config.guess"|"$TOP_SRCDIR/config.guess"|' -i bin/tests/system/ifconfig.sh
 :;
 
 

From 91193796e74a616d7a89023ad1080a798a3fc03b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 26 Nov 2020 16:19:35 +0100
Subject: [PATCH 214/460] Use python macro instead of rpm query

Rpm might prevent access to rpm database during the build. It is not
required anyway. Use %python3_sitelib macro to get path for shared data.
---
 bind.spec | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/bind.spec b/bind.spec
index 4198807..763ee53 100644
--- a/bind.spec
+++ b/bind.spec
@@ -764,8 +764,7 @@ mkdir -p ${RPM_BUILD_ROOT}%{_pkgdocdir}
 cp -a build/doc/arm/_build/html ${RPM_BUILD_ROOT}%{_pkgdocdir}
 rm -rf ${RPM_BUILD_ROOT}%{_pkgdocdir}/html/.{buildinfo,doctrees}
 # Share static data from original sphinx package
-THEMEDIR=$(rpm -ql python3-sphinx_rtd_theme | grep 'sphinx_rtd_theme/static$')
-for DIR in "$THEMEDIR"/*
+for DIR in %{python3_sitelib}/sphinx_rtd_theme/static/*
 do
   BASE=$(basename -- "$DIR")
   BINDTHEMEDIR="${RPM_BUILD_ROOT}%{_pkgdocdir}/html/_static/$BASE"

From 46e0d484eedcb4a14046baa005213b06d6375a1e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 30 Nov 2020 14:10:37 +0100
Subject: [PATCH 215/460] Reenable documentation building

Latest release has not correctly formatted manual pages. Correct it by
rebuilding every manual page during the build, not only those modified
by a patch.

Fixed oot build of documentation. Because docbook does not work well
with out of tree builds, copy all sources required for documentation
into build directory. Should regenerate all manual pages, also html and
PDF formatted ARM.
---
 bind.spec | 25 +++++++++++++++++++++----
 1 file changed, 21 insertions(+), 4 deletions(-)

diff --git a/bind.spec b/bind.spec
index 1ecdb8d..f7e66a4 100644
--- a/bind.spec
+++ b/bind.spec
@@ -67,7 +67,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.11.25
-Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -236,6 +236,10 @@ BuildRequires:  docbook-style-xsl, libxslt
 %if %{with TSAN}
 BuildRequires: libtsan
 %endif
+%if %{with DOC}
+BuildRequires:  dblatex
+BuildRequires:  doxygen
+%endif
 
 %description
 BIND (Berkeley Internet Name Domain) is an implementation of the DNS
@@ -753,8 +757,18 @@ make man
 popd
 
 %if %{with DOC}
-  # Does not work. Use upstream generated documentation instead.
-  # make doc
+  # Because oot is not supported in docbook, copy required sources to build directory
+  pushd ..
+  # Note: force all manual pages regeneration, don't preserve timestamps
+  find -name '*.docbook' | while read F; do install -Dv "$F" "build/$F"; done
+  find doc -name '*.xml' | while read F; do [ -f "build/$F" ] || install -Dvp "$F" "build/$F"; done
+  popd
+  cp -upv ../doc/xsl/*.xsl doc/xsl/
+  cp -Rupv ../doc/xsl/graphics doc/xsl/
+  cp -upv ../doc/tex/notestyle.sty doc/tex/
+  cp -upv ../doc/arm/*.conf ../doc/arm/isc-logo.pdf doc/arm/
+  cp -upv ../doc/doxygen/*.html doc/doxygen
+  make doc
 %endif
 
 %if %{with DLZ}
@@ -1072,7 +1086,7 @@ popd
 
 %if %{with DOC}
 mkdir -p ${RPM_BUILD_ROOT}%{_pkgdocdir}
-cp -a doc/arm/*.html doc/arm/*.pdf ${RPM_BUILD_ROOT}%{_pkgdocdir}
+cp -a build/doc/arm/{*.html,*.pdf} ${RPM_BUILD_ROOT}%{_pkgdocdir}
 %endif
 
 # Ghost config files:
@@ -1608,6 +1622,9 @@ fi;
 %endif
 
 %changelog
+* Mon Nov 30 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.25-2
+- Regenerate all manual pages on build
+
 * Thu Nov 26 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.25-1
 - Update to 9.11.25
 

From 118269cb8cf79a5888f76d091b0842d312d0a44f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 4 Jan 2021 12:53:08 +0100
Subject: [PATCH 216/460] Update to 9.11.26

Bugfix release, just tweaks in few default values.

https://downloads.isc.org/isc/bind9/9.11.26/RELEASE-NOTES-bind-9.11.26.html
---
 .gitignore                  |  2 +
 bind-9.11-serve-stale.patch | 80 ++++++++++++++++++-------------------
 bind.spec                   |  7 +++-
 sources                     |  4 +-
 4 files changed, 49 insertions(+), 44 deletions(-)

diff --git a/.gitignore b/.gitignore
index 25c757f..8c508fc 100644
--- a/.gitignore
+++ b/.gitignore
@@ -120,3 +120,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.11.24.tar.gz.asc
 /bind-9.11.25.tar.gz
 /bind-9.11.25.tar.gz.asc
+/bind-9.11.26.tar.gz
+/bind-9.11.26.tar.gz.asc
diff --git a/bind-9.11-serve-stale.patch b/bind-9.11-serve-stale.patch
index c6fae7d..764a40c 100644
--- a/bind-9.11-serve-stale.patch
+++ b/bind-9.11-serve-stale.patch
@@ -1,4 +1,4 @@
-From 95b25d45662f4fad39cbc9ddbc3b4bcdae0a04ec Mon Sep 17 00:00:00 2001
+From d55a57427ee696dec51149950478394e43019607 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 7 Nov 2019 14:31:03 +0100
 Subject: [PATCH] Implement serve-stale in 9.11
@@ -276,7 +276,7 @@ Signed-off-by: Petr Menšík <pemensik@redhat.com>
  create mode 100755 bin/tests/system/serve-stale/tests.sh
 
 diff --git a/bin/named/config.c b/bin/named/config.c
-index 5e663c6..560ef04 100644
+index 9e071bb..d2cd3bc 100644
 --- a/bin/named/config.c
 +++ b/bin/named/config.c
 @@ -182,13 +182,14 @@ options {\n\
@@ -291,7 +291,7 @@ index 5e663c6..560ef04 100644
  	max-clients-per-query 100;\n\
  	max-ncache-ttl 10800; /* 3 hours */\n\
  	max-recursion-depth 7;\n\
- 	max-recursion-queries 75;\n\
+ 	max-recursion-queries 100;\n\
 +	max-stale-ttl 604800; /* 1 week */\n\
  	message-compression yes;\n\
  #	min-roots <obsolete>;\n\
@@ -430,7 +430,7 @@ index acfa766..ea6f114 100644
  };
  
 diff --git a/bin/named/query.c b/bin/named/query.c
-index edf42d2..89cc574 100644
+index b14f081..a95f5ad 100644
 --- a/bin/named/query.c
 +++ b/bin/named/query.c
 @@ -149,10 +149,14 @@ last_cmpxchg(isc_stdtime_t *x, isc_stdtime_t *e, isc_stdtime_t r) {
@@ -644,7 +644,7 @@ index edf42d2..89cc574 100644
  		    RECURSIONOK(client))
  		{
  			if (dns_rdataset_isassociated(rdataset))
-@@ -8668,7 +8775,11 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
+@@ -8676,7 +8783,11 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
  			 "query_find: unexpected error after resuming: %s",
  			 isc_result_totext(result));
  		CTRACE(ISC_LOG_ERROR, errmsg);
@@ -657,7 +657,7 @@ index edf42d2..89cc574 100644
  		goto cleanup;
  	}
  
-@@ -8924,7 +9035,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
+@@ -8932,7 +9043,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
  		/*
  		 * If we have a zero ttl from the cache refetch it.
  		 */
@@ -666,7 +666,7 @@ index edf42d2..89cc574 100644
  		    RECURSIONOK(client))
  		{
  			if (dns_rdataset_isassociated(rdataset))
-@@ -8935,6 +9046,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
+@@ -8943,6 +9054,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
  			if (node != NULL)
  				dns_db_detachnode(db, &node);
  
@@ -674,7 +674,7 @@ index edf42d2..89cc574 100644
  			INSIST(!REDIRECT(client));
  			result = query_recurse(client, qtype,
  					       client->query.qname,
-@@ -9215,6 +9327,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
+@@ -9223,6 +9335,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
  				       dns_fixedname_name(&wildcardname),
  				       true, false);
   cleanup:
@@ -682,7 +682,7 @@ index edf42d2..89cc574 100644
  	CTRACE(ISC_LOG_DEBUG(3), "query_find: cleanup");
  	/*
  	 * General cleanup.
-@@ -9271,6 +9384,49 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
+@@ -9279,6 +9392,49 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
  		goto restart;
  	}
  
@@ -1007,7 +1007,7 @@ index 0acfe3a..2c21c1d 100644
  		Print a zone's configuration.\n\
    sign zone [class [view]]\n\
 diff --git a/bin/rndc/rndc.docbook b/bin/rndc/rndc.docbook
-index 1e3812e..c7fe65f 100644
+index 159ded9..12a7208 100644
 --- a/bin/rndc/rndc.docbook
 +++ b/bin/rndc/rndc.docbook
 @@ -689,6 +689,25 @@
@@ -1052,7 +1052,7 @@ index 23bedcd..43385de 100644
 +    exit 1
 +fi
 diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
-index c59cfaf..2b3de5f 100644
+index f6412f6..26c8901 100644
 --- a/bin/tests/system/conf.sh.in
 +++ b/bin/tests/system/conf.sh.in
 @@ -128,7 +128,7 @@ PARALLELDIRS="dnssec rpzrecurse \
@@ -2039,7 +2039,7 @@ index 0000000..201c996
 +echo "I:exit status: $status"
 +[ $status -eq 0 ] || exit 1
 diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
-index 1f9df2c..78e75ce 100644
+index 99c8680..5fbabfe 100644
 --- a/doc/arm/Bv9ARM-book.xml
 +++ b/doc/arm/Bv9ARM-book.xml
 @@ -4336,6 +4336,9 @@ badresp:1,adberr:0,findfail:0,valfail:0]
@@ -2113,7 +2113,7 @@ index 1f9df2c..78e75ce 100644
  	    <varlistentry>
  	      <term><command>nocookie-udp-size</command></term>
  	      <listitem>
-@@ -7448,13 +7482,19 @@ options {
+@@ -7449,13 +7483,19 @@ options {
  	      <term><command>resolver-query-timeout</command></term>
  	      <listitem>
  		<para>
@@ -2140,7 +2140,7 @@ index 1f9df2c..78e75ce 100644
  		</para>
  	      </listitem>
  	    </varlistentry>
-@@ -9015,6 +9055,27 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
+@@ -9016,6 +9056,27 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
  	      </listitem>
  	    </varlistentry>
  
@@ -2169,7 +2169,7 @@ index 1f9df2c..78e75ce 100644
  	      <term><command>min-roots</command></term>
  	      <listitem>
 diff --git a/doc/arm/logging-categories.xml b/doc/arm/logging-categories.xml
-index f0776fe..c4b903a 100644
+index 56d05e8..098342b 100644
 --- a/doc/arm/logging-categories.xml
 +++ b/doc/arm/logging-categories.xml
 @@ -311,6 +311,17 @@
@@ -2982,7 +2982,7 @@ index fa839a0..91b3cab 100644
  			RUNTIME_CHECK(result == ISC_R_SUCCESS);
  			isc_buffer_usedregion(&buffer, &r);
 diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
-index 3b75cad..535202b 100644
+index 3a60bcf..8ea4d47 100644
 --- a/lib/dns/rbtdb.c
 +++ b/lib/dns/rbtdb.c
 @@ -511,6 +511,7 @@ typedef ISC_LIST(rdatasetheader_t)      rdatasetheaderlist_t;
@@ -3171,7 +3171,7 @@ index 3b75cad..535202b 100644
  	rdataset->private1 = rbtdb;
  	rdataset->private2 = node;
  	raw = (unsigned char *)header + sizeof(*header);
-@@ -4699,6 +4798,19 @@ check_stale_header(dns_rbtnode_t *node, rdatasetheader_t *header,
+@@ -4698,6 +4797,19 @@ check_stale_header(dns_rbtnode_t *node, rdatasetheader_t *header,
  #endif
  
  	if (!ACTIVE(header, search->now)) {
@@ -3191,7 +3191,7 @@ index 3b75cad..535202b 100644
  		/*
  		 * This rdataset is stale.  If no one else is using the
  		 * node, we can clean it up right now, otherwise we mark
-@@ -4738,7 +4850,7 @@ check_stale_header(dns_rbtnode_t *node, rdatasetheader_t *header,
+@@ -4737,7 +4849,7 @@ check_stale_header(dns_rbtnode_t *node, rdatasetheader_t *header,
  					node->data = header->next;
  				free_rdataset(search->rbtdb, mctx, header);
  			} else {
@@ -3200,7 +3200,7 @@ index 3b75cad..535202b 100644
  				*header_prev = header;
  			}
  		} else
-@@ -5179,7 +5291,7 @@ cache_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
+@@ -5178,7 +5290,7 @@ cache_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
  				       &locktype, lock, &search,
  				       &header_prev)) {
  			/* Do nothing. */
@@ -3209,7 +3209,7 @@ index 3b75cad..535202b 100644
  			/*
  			 * We now know that there is at least one active
  			 * non-stale rdataset at this node.
-@@ -5662,7 +5774,7 @@ expirenode(dns_db_t *db, dns_dbnode_t *node, isc_stdtime_t now) {
+@@ -5661,7 +5773,7 @@ expirenode(dns_db_t *db, dns_dbnode_t *node, isc_stdtime_t now) {
  			 * refcurrent(rbtnode) must be non-zero.  This is so
  			 * because 'node' is an argument to the function.
  			 */
@@ -3218,7 +3218,7 @@ index 3b75cad..535202b 100644
  			if (log)
  				isc_log_write(dns_lctx, category, module,
  					      level, "overmem cache: stale %s",
-@@ -5670,7 +5782,7 @@ expirenode(dns_db_t *db, dns_dbnode_t *node, isc_stdtime_t now) {
+@@ -5669,7 +5781,7 @@ expirenode(dns_db_t *db, dns_dbnode_t *node, isc_stdtime_t now) {
  		} else if (force_expire) {
  			if (! RETAIN(header)) {
  				set_ttl(rbtdb, header, 0);
@@ -3227,7 +3227,7 @@ index 3b75cad..535202b 100644
  			} else if (log) {
  				isc_log_write(dns_lctx, category, module,
  					      level, "overmem cache: "
-@@ -5929,9 +6041,9 @@ cache_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
+@@ -5928,9 +6040,9 @@ cache_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
  				 * non-zero.  This is so because 'node' is an
  				 * argument to the function.
  				 */
@@ -3239,7 +3239,7 @@ index 3b75cad..535202b 100644
  			if (header->type == matchtype)
  				found = header;
  			else if (header->type == RBTDB_RDATATYPE_NCACHEANY ||
-@@ -6233,7 +6345,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+@@ -6232,7 +6344,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
  				     topheader = topheader->next)
  				{
  					set_ttl(rbtdb, topheader, 0);
@@ -3248,7 +3248,7 @@ index 3b75cad..535202b 100644
  				}
  				goto find_header;
  			}
-@@ -6294,7 +6406,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+@@ -6293,7 +6405,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
  				 * ncache entry.
  				 */
  				set_ttl(rbtdb, topheader, 0);
@@ -3257,7 +3257,7 @@ index 3b75cad..535202b 100644
  				topheader = NULL;
  				goto find_header;
  			}
-@@ -6332,8 +6444,11 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+@@ -6331,8 +6443,11 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
  		}
  
  		/*
@@ -3271,7 +3271,7 @@ index 3b75cad..535202b 100644
  		 */
  		if (rbtversion == NULL && trust < header->trust &&
  		    (ACTIVE(header, now) || header_nx)) {
-@@ -6363,6 +6478,10 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+@@ -6362,6 +6477,10 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
  
  			if ((options & DNS_DBADD_EXACT) != 0)
  				flags |= DNS_RDATASLAB_EXACT;
@@ -3282,7 +3282,7 @@ index 3b75cad..535202b 100644
  			if ((options & DNS_DBADD_EXACTTTL) != 0 &&
  			     newheader->rdh_ttl != header->rdh_ttl)
  					result = DNS_R_NOTEXACT;
-@@ -6406,11 +6525,12 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+@@ -6405,11 +6524,12 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
  			}
  		}
  		/*
@@ -3300,7 +3300,7 @@ index 3b75cad..535202b 100644
  		 */
  		if (IS_CACHE(rbtdb) && ACTIVE(header, now) &&
  		    header->type == dns_rdatatype_ns &&
-@@ -6583,10 +6703,10 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+@@ -6582,10 +6702,10 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
  				changed->dirty = true;
  			if (rbtversion == NULL) {
  				set_ttl(rbtdb, header, 0);
@@ -3313,7 +3313,7 @@ index 3b75cad..535202b 100644
  				}
  			}
  			if (rbtversion != NULL && !header_nx) {
-@@ -8437,6 +8557,30 @@ nodefullname(dns_db_t *db, dns_dbnode_t *node, dns_name_t *name) {
+@@ -8436,6 +8556,30 @@ nodefullname(dns_db_t *db, dns_dbnode_t *node, dns_name_t *name) {
  	return (result);
  }
  
@@ -3344,7 +3344,7 @@ index 3b75cad..535202b 100644
  static dns_dbmethods_t zone_methods = {
  	attach,
  	detach,
-@@ -8482,7 +8626,9 @@ static dns_dbmethods_t zone_methods = {
+@@ -8481,7 +8625,9 @@ static dns_dbmethods_t zone_methods = {
  	NULL,
  	hashsize,
  	nodefullname,
@@ -3355,7 +3355,7 @@ index 3b75cad..535202b 100644
  };
  
  static dns_dbmethods_t cache_methods = {
-@@ -8530,7 +8676,9 @@ static dns_dbmethods_t cache_methods = {
+@@ -8529,7 +8675,9 @@ static dns_dbmethods_t cache_methods = {
  	setcachestats,
  	hashsize,
  	nodefullname,
@@ -3366,7 +3366,7 @@ index 3b75cad..535202b 100644
  };
  
  isc_result_t
-@@ -8801,7 +8949,7 @@ dns_rbtdb_create
+@@ -8800,7 +8948,7 @@ dns_rbtdb_create
  	rbtdb->rpzs = NULL;
  	rbtdb->load_rpzs = NULL;
  	rbtdb->rpz_num = DNS_RPZ_INVALID_NUM;
@@ -3375,7 +3375,7 @@ index 3b75cad..535202b 100644
  	/*
  	 * Version Initialization.
  	 */
-@@ -9219,7 +9367,8 @@ rdatasetiter_first(dns_rdatasetiter_t *iterator) {
+@@ -9218,7 +9366,8 @@ rdatasetiter_first(dns_rdatasetiter_t *iterator) {
  				 * rdatasets to work.
  				 */
  				if (NONEXISTENT(header) ||
@@ -3385,7 +3385,7 @@ index 3b75cad..535202b 100644
  					header = NULL;
  				break;
  			} else
-@@ -10428,7 +10577,7 @@ static inline bool
+@@ -10427,7 +10576,7 @@ static inline bool
  need_headerupdate(rdatasetheader_t *header, isc_stdtime_t now) {
  	if ((header->attributes &
  	     (RDATASET_ATTR_NONEXISTENT |
@@ -3394,7 +3394,7 @@ index 3b75cad..535202b 100644
  	      RDATASET_ATTR_ZEROTTL)) != 0)
  		return (false);
  
-@@ -10534,7 +10683,7 @@ expire_header(dns_rbtdb_t *rbtdb, rdatasetheader_t *header,
+@@ -10533,7 +10682,7 @@ expire_header(dns_rbtdb_t *rbtdb, rdatasetheader_t *header,
  	      bool tree_locked, expire_t reason)
  {
  	set_ttl(rbtdb, header, 0);
@@ -3404,7 +3404,7 @@ index 3b75cad..535202b 100644
  	/*
  	 * Caller must hold the node (write) lock.
 diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
-index 5e20783..17a4eee 100644
+index 49ec49c..2de70a6 100644
 --- a/lib/dns/resolver.c
 +++ b/lib/dns/resolver.c
 @@ -141,16 +141,17 @@
@@ -3468,7 +3468,7 @@ index 5e20783..17a4eee 100644
  
  	/*
  	 * Add a fudge factor to the expected rtt based on the current
-@@ -4535,7 +4539,8 @@ fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type,
+@@ -4542,7 +4546,8 @@ fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type,
  	/*
  	 * Compute an expiration time for the entire fetch.
  	 */
@@ -3478,7 +3478,7 @@ index 5e20783..17a4eee 100644
  	iresult = isc_time_nowplusinterval(&fctx->expires, &interval);
  	if (iresult != ISC_R_SUCCESS) {
  		UNEXPECTED_ERROR(__FILE__, __LINE__,
-@@ -9059,6 +9064,8 @@ dns_resolver_create(dns_view_t *view,
+@@ -9105,6 +9110,8 @@ dns_resolver_create(dns_view_t *view,
  	res->spillattimer = NULL;
  	res->zspill = 0;
  	res->zero_no_soa_ttl = false;
@@ -3487,7 +3487,7 @@ index 5e20783..17a4eee 100644
  	res->query_timeout = DEFAULT_QUERY_TIMEOUT;
  	res->maxdepth = DEFAULT_RECURSION_DEPTH;
  	res->maxqueries = DEFAULT_MAX_QUERIES;
-@@ -10393,17 +10400,20 @@ dns_resolver_gettimeout(dns_resolver_t *resolver) {
+@@ -10439,17 +10446,20 @@ dns_resolver_gettimeout(dns_resolver_t *resolver) {
  }
  
  void
@@ -3516,7 +3516,7 @@ index 5e20783..17a4eee 100644
  }
  
  void
-@@ -10500,3 +10510,34 @@ dns_resolver_getquotaresponse(dns_resolver_t *resolver, dns_quotatype_t which)
+@@ -10546,3 +10556,34 @@ dns_resolver_getquotaresponse(dns_resolver_t *resolver, dns_quotatype_t which)
  
  	return (resolver->quotaresp[which]);
  }
diff --git a/bind.spec b/bind.spec
index f7e66a4..e5c9fd5 100644
--- a/bind.spec
+++ b/bind.spec
@@ -66,8 +66,8 @@
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.11.25
-Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Version:  9.11.26
+Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1622,6 +1622,9 @@ fi;
 %endif
 
 %changelog
+* Mon Jan 04 2021 Petr Menšík <pemensik@redhat.com> - 32:9.11.26-1
+- Update to 9.11.26
+
 * Mon Nov 30 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.25-2
 - Regenerate all manual pages on build
 
diff --git a/sources b/sources
index 0f11c4e..692eb08 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.11.25.tar.gz) = 852b15b6cf2f77ab103018e6fc078d856653c62c2db0ca2ef4f8bee64a60b06ed481d9fcdf29020e5072c69b9982545f032b2ab4c94dac28848150e04b9cecf9
-SHA512 (bind-9.11.25.tar.gz.asc) = 8cc8e5d21a445d918e82b42057f1d4e73ed977f4eb9584736008b71ae747078d500cc962c3bd03eb4f6a18688b642b108a8e3d673851b0dd4818fc9a33e5faf7
+SHA512 (bind-9.11.26.tar.gz) = 7ec32ca50b7f552d6a0b16ec1e168a24ecbf33420b8df123f74c7b9f615b8267e3e6e973a72f3ce3912eb60e94ebfacbacb4ae3945ac587c73f7cf695b46ce00
+SHA512 (bind-9.11.26.tar.gz.asc) = 3ce0d4dc1ba67d4e7ae84775c82e5a637427f774d7515e947c59761302fb9d665f8daf938d32227512fd99dc0b56754863082a53be24a38d375fc428e5bdab92

From ddf24a90e3ac5a7fee5f21ca01db0261a7a14037 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 5 Jan 2021 15:16:21 +0100
Subject: [PATCH 217/460] Update to 9.16.10

Enhancement and bugfix update.

Changes documented at upstream release note:
https://downloads.isc.org/isc/bind9/9.16.10/doc/arm/html/notes.html#notes-for-bind-9-16-10
---
 .gitignore | 2 ++
 bind.spec  | 9 ++++++---
 sources    | 4 ++--
 3 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/.gitignore b/.gitignore
index 2737bdf..eae28e5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -119,3 +119,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.16.8.tar.xz.asc
 /bind-9.16.9.tar.xz
 /bind-9.16.9.tar.xz.asc
+/bind-9.16.10.tar.xz
+/bind-9.16.10.tar.xz.asc
diff --git a/bind.spec b/bind.spec
index 763ee53..421a6d8 100644
--- a/bind.spec
+++ b/bind.spec
@@ -55,17 +55,17 @@
 # no more isc-config.sh and bind9-config
 
 # lib*.so.X versions of selected libraries
-%global sover_dns 1609
+%global sover_dns 1610
 %global sover_isc 1608
 %global sover_irs 1601
-%global sover_isccfg 1601
+%global sover_isccfg 1602
 %global sover_ns 1606
 
 
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.16.9
+Version:  9.16.10
 Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
@@ -1162,6 +1162,9 @@ fi;
 %endif
 
 %changelog
+* Tue Jan 05 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.10-1
+- Update to 9.16.10
+
 * Thu Nov 26 2020 Petr Menšík <pemensik@redhat.com> - 32:9.16.9-1
 - Update to 9.16.9
 
diff --git a/sources b/sources
index 36feb7d..08489e3 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.16.9.tar.xz) = d5b7694c51d3756aa273efd19d08889d28dd0e80d4ee29660cd06de0fdbc16a77f4f0d2dd9faef527eea1e496ec3292d158a556a84d5aa3f42dbddbb9c890aac
-SHA512 (bind-9.16.9.tar.xz.asc) = 0e2092e91dc092c39b05acda817a350fc937a941890e537dc6ef40b473c40c42bb6058b4822eb8e8e7e9bb7ad560b7eff1a5b3942993daa6059187d412831b9c
+SHA512 (bind-9.16.10.tar.xz) = cb140fd577042ddeb7a47bc5e132d405d885bed22c9aeecb3d91a9115481ce4380ef191f78ba7acc9580ad0d4c8ed2658643007adf5b5527060879f34efdf8f7
+SHA512 (bind-9.16.10.tar.xz.asc) = 9ab68e1628ea953996190e754476c37e27a3c0f2b2d391c86e1da96930fddbcd5792df13cc5012d8b9f28c5565950a7d1d8ad36b8bef5abec90e407872724bf8

From 7c7ec8981c5434fbe2a99fbdccaeed7bcce751c3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 5 Jan 2021 12:04:18 +0100
Subject: [PATCH 218/460] Update to correct Docbook stylesheets

Docbook5 stylesheets with namespaces are required. BIND uses Docbook5
format. While it tries to keep compatibility with older stylesheets,
it fails silently and format of manual pages is broken.

Details in upstream issue:
https://gitlab.isc.org/isc-projects/bind9/-/issues/2310

Docbook5 generates manual pages with [FIXME: manual] instead of BIND9.
Fix metadata to be recognized and provide this value.
---
 bind.spec             | 11 +++++--
 bind99-rh640538.patch | 75 +++++++++++++++++++++++++++----------------
 2 files changed, 57 insertions(+), 29 deletions(-)

diff --git a/bind.spec b/bind.spec
index e5c9fd5..d363068 100644
--- a/bind.spec
+++ b/bind.spec
@@ -232,7 +232,9 @@ BuildRequires:  libmaxminddb-devel
 BuildRequires:  fstrm-devel protobuf-c-devel
 %endif
 # Needed to regenerate dig.1 manpage
-BuildRequires:  docbook-style-xsl, libxslt
+# Docbook5 with namespace is required.
+# Visit for details: https://gitlab.isc.org/isc-projects/bind9/-/issues/2310
+BuildRequires:  docbook5-style-xsl, libxslt
 %if %{with TSAN}
 BuildRequires: libtsan
 %endif
@@ -583,6 +585,11 @@ are used for building ISC DHCP.
 mkdir lib/dns/tests/testdata/dstrandom
 cp -a %{SOURCE50} lib/dns/tests/testdata/dstrandom/random.data
 
+# Avoid having [FIXME: manual] on top of generated manual pages
+# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/4524
+find bin lib/lwres/man -name '*.docbook' -exec \
+  sed -e 's|<refmiscinfo>BIND9|<refmiscinfo class="manual">BIND9|' -i '{}' ';'
+
 %if %{with PKCS11}
 cp -r bin/named{,-pkcs11}
 cp -r bin/dnssec{,-pkcs11}
@@ -727,7 +734,7 @@ export LIBDIR_SUFFIX
   --with-cmocka \
 %endif
   --enable-fixed-rrset \
-  --with-docbook-xsl=%{_datadir}/sgml/docbook/xsl-stylesheets \
+  --with-docbook-xsl=%{_datadir}/sgml/docbook/xsl-ns-stylesheets \
   --enable-full-report \
 ;
 %if %{with DNSTAP}
diff --git a/bind99-rh640538.patch b/bind99-rh640538.patch
index 5066a14..e2c0de7 100644
--- a/bind99-rh640538.patch
+++ b/bind99-rh640538.patch
@@ -1,40 +1,58 @@
+From a76716d5d039947d6fe2cd49a151b16a29e12d42 Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Mon, 4 Jan 2021 12:55:49 +0100
+Subject: [PATCH] .rh640538
+---
+ bin/dig/dig.docbook | 43 +++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 43 insertions(+)
+
 diff --git a/bin/dig/dig.docbook b/bin/dig/dig.docbook
-index 1079421..f11abd1 100644
+index 8ccf207..6d16d37 100644
 --- a/bin/dig/dig.docbook
 +++ b/bin/dig/dig.docbook
-@@ -1177,6 +1177,39 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
+@@ -1336,6 +1336,49 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
      </para>
    </refsection>
  
 +  <refsection><info><title>RETURN CODES</title></info>
++
 +    <para>
 +      <command>Dig</command> return codes are:
++
 +      <variablelist>
-+        <varlistentry>
-+          <listitem>
-+            <para>0: Everything went well, including things like NXDOMAIN</para>
-+          </listitem>
-+        </varlistentry>
-+        <varlistentry>
-+          <listitem>
-+            <para>1: Usage error</para>
-+          </listitem>
-+        </varlistentry>
-+        <varlistentry>
-+          <listitem>
-+            <para>8: Couldn't open batch file</para>
-+          </listitem>
-+        </varlistentry>
-+        <varlistentry>
-+          <listitem>
-+            <para>9: No reply from server</para>
-+          </listitem>
-+        </varlistentry>
-+        <varlistentry>
-+          <listitem>
-+            <para>10: Internal error</para>
-+          </listitem>
-+        </varlistentry>
++	<varlistentry>
++	  <term>0</term>
++	  <listitem>
++	    <para>Everything went well, including things like NXDOMAIN.</para>
++	  </listitem>
++	</varlistentry>
++	<varlistentry>
++	  <term>1</term>
++	  <listitem>
++	    <para>Usage error.</para>
++	  </listitem>
++	</varlistentry>
++
++	<varlistentry>
++	  <term>8</term>
++	  <listitem>
++	    <para>Could not open batch file.</para>
++	  </listitem>
++	</varlistentry>
++	<varlistentry>
++	  <term>9</term>
++	  <listitem>
++	    <para>No reply from server.
++	    </para>
++	  </listitem>
++	</varlistentry>
++	<varlistentry>
++	  <term>10</term>
++	  <listitem>
++	    <para>Internal error.
++	    </para>
++	  </listitem>
++	</varlistentry>
 +      </variablelist>
 +    </para>
 +  </refsection>
@@ -42,3 +60,6 @@ index 1079421..f11abd1 100644
    <refsection><info><title>FILES</title></info>
  
      <para><filename>/etc/resolv.conf</filename>
+-- 
+2.26.2
+

From 5c10c94304e6ec47b15ac64ac1897e86feff4d39 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 5 Jan 2021 13:59:44 +0100
Subject: [PATCH 219/460] Do not regenerate all manual pages

Required to regenerate all manual pages. Because they are fixed,
regenerate only modified pages again.
---
 bind.spec | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/bind.spec b/bind.spec
index d363068..b8483c1 100644
--- a/bind.spec
+++ b/bind.spec
@@ -766,8 +766,7 @@ popd
 %if %{with DOC}
   # Because oot is not supported in docbook, copy required sources to build directory
   pushd ..
-  # Note: force all manual pages regeneration, don't preserve timestamps
-  find -name '*.docbook' | while read F; do install -Dv "$F" "build/$F"; done
+  find -name '*.docbook' | while read F; do install -Dvp "$F" "build/$F"; done
   find doc -name '*.xml' | while read F; do [ -f "build/$F" ] || install -Dvp "$F" "build/$F"; done
   popd
   cp -upv ../doc/xsl/*.xsl doc/xsl/

From 177a98f40b4b142b3fd2b0ce9ca47d07a34eb168 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 6 Jan 2021 14:41:24 +0100
Subject: [PATCH 220/460] Use make macros

Reduce number of variables, use prepared %make_build and %make_install
where possible.

Manual merge of MR #7.
---
 bind.spec | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/bind.spec b/bind.spec
index b8483c1..c6a1878 100644
--- a/bind.spec
+++ b/bind.spec
@@ -67,7 +67,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.11.26
-Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -746,7 +746,7 @@ export LIBDIR_SUFFIX
 %endif
   popd
 %endif
-make %{?_smp_mflags}
+%make_build
 
 ### FIXME hack!!!
 ### xsltproc doesn't find properly configured files
@@ -858,7 +858,7 @@ do
             -i isc-export-config.sh
 done;
 
-make %{?_smp_mflags}
+%make_build
 popd
 
 # export library unit tests
@@ -981,12 +981,12 @@ touch ${RPM_BUILD_ROOT}/%{chroot_sdb_prefix}%{_sysconfdir}/named.conf
 #end sdb-chroot
 
 pushd build
-make DESTDIR=${RPM_BUILD_ROOT} install
+%make_install
 popd
 
 %if %{with EXPORT_LIBS}
 pushd export-libs
-make DESTDIR=${RPM_BUILD_ROOT} install
+%make_install
 mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/ld.so.conf.d
 echo "%{_libdir}/%{_export_dir}" > %{buildroot}%{_sysconfdir}/ld.so.conf.d/%{name}-export-%{_arch}.conf
 cp -fp config.h ${RPM_BUILD_ROOT}/%{_includedir}%{_export_dir}
@@ -1038,16 +1038,16 @@ install -m 644 %{SOURCE12} contrib/sdb/pgsql/
   pushd contrib/dlz
   pushd modules
   for DIR in filesystem ldap mysql mysqldyn sqlite3; do
-    make -C $DIR DESTDIR=${RPM_BUILD_ROOT} libdir=%{_libdir}/bind install
+    %make_install -C $DIR libdir=%{_libdir}/bind
   done
   mv mysqldyn/testing/README mysqldyn/testing/README.testing
   %if %{with BDB}
-    make -C bdbhpt DESTDIR=${RPM_BUILD_ROOT} libdir=%{_libdir}/bind install
+    %make_install -C bdbhpt libdir=%{_libdir}/bind
   %endif
   popd
   %if %{with BDB}
     pushd bin/dlzbdb
-      make DESTDIR=${RPM_BUILD_ROOT} install
+      %make_install
     popd
   %endif
   popd
@@ -1628,6 +1628,10 @@ fi;
 %endif
 
 %changelog
+* Wed Jan 06 2021 Petr Menšík <pemensik@redhat.com> - 32:9.11.26-2
+- Use make macros
+- https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro
+
 * Mon Jan 04 2021 Petr Menšík <pemensik@redhat.com> - 32:9.11.26-1
 - Update to 9.11.26
 

From d955a1450b6ef009d85e931e669acb2e3fdd3e27 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 7 Jan 2021 11:38:47 +0100
Subject: [PATCH 221/460] Link tests to fedora test namespace

Add ci.fmf too.
---
 ci.fmf          | 13 +++++++++++++
 tests/tests.yml |  2 +-
 2 files changed, 14 insertions(+), 1 deletion(-)
 create mode 100644 ci.fmf

diff --git a/ci.fmf b/ci.fmf
new file mode 100644
index 0000000..9a9fbea
--- /dev/null
+++ b/ci.fmf
@@ -0,0 +1,13 @@
+/test:
+    summary:
+        CI plan, picks Tier1 tests, runs in beakerlib.
+    description:
+        This special plan has to be named ci.fmf to run in CI.
+        It selects test which have 'tier 1' in their main.fmf file
+    discover:
+      - name: tier1
+        how: fmf
+        filter: 'tier: 1'
+        repository: "https://src.fedoraproject.org/tests/bind.git"
+    execute:
+        how: tmt
diff --git a/tests/tests.yml b/tests/tests.yml
index c3d8fcd..d2fb221 100644
--- a/tests/tests.yml
+++ b/tests/tests.yml
@@ -6,6 +6,6 @@
     tags:
     - classic
     repositories:
-    - repo: "https://github.com/InfrastructureServices/bind-tests.git"
+    - repo: "https://src.fedoraproject.org/tests/bind.git"
       dest: "bind-tests"
       fmf_filter: "tier: 1"

From bea44d51ee3d251d8eb618049895edcbdf318c65 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 6 Jan 2021 14:41:24 +0100
Subject: [PATCH 222/460] Use make macros

Reduce number of variables, use prepared %make_build and %make_install
where possible.

Manual merge of MR #7.
---
 bind.spec | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/bind.spec b/bind.spec
index 421a6d8..a2720ba 100644
--- a/bind.spec
+++ b/bind.spec
@@ -66,7 +66,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.16.10
-Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -628,7 +628,7 @@ then
   set -e
   pushd build/bin/tests
   chown -R ${USER} . # Can be unknown user
-  make test %{?_smp_mflags} 2>&1 | tee test.log
+  %make_build test 2>&1 | tee test.log
   e=$?
   popd
   [ "$CONFIGURED" = build ] && sh bin/tests/system/ifconfig.sh down
@@ -706,7 +706,7 @@ install -m 644 %{SOURCE49} ${RPM_BUILD_ROOT}%{_sysconfdir}/named-chroot.files
   pushd build
   pushd contrib/dlz/modules
   for DIR in filesystem ldap mysql mysqldyn sqlite3; do
-    make -C $DIR DESTDIR=${RPM_BUILD_ROOT} libdir=%{_libdir}/named install
+    %make_install -C $DIR libdir=%{_libdir}/bind
   done
   pushd ${RPM_BUILD_ROOT}/%{_libdir}/bind
     cp -s ../named/dlz_*.so .
@@ -1162,6 +1162,10 @@ fi;
 %endif
 
 %changelog
+* Wed Jan 06 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.10-2
+- Use make macros
+- https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro
+
 * Tue Jan 05 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.10-1
 - Update to 9.16.10
 

From dbc722407ebe4986fb23f2c4b96289aa7996fe69 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 7 Jan 2021 11:38:47 +0100
Subject: [PATCH 223/460] Link tests to fedora test namespace

Add ci.fmf too.
---
 ci.fmf          | 13 +++++++++++++
 tests/tests.yml | 21 +++------------------
 2 files changed, 16 insertions(+), 18 deletions(-)
 create mode 100644 ci.fmf

diff --git a/ci.fmf b/ci.fmf
new file mode 100644
index 0000000..9a9fbea
--- /dev/null
+++ b/ci.fmf
@@ -0,0 +1,13 @@
+/test:
+    summary:
+        CI plan, picks Tier1 tests, runs in beakerlib.
+    description:
+        This special plan has to be named ci.fmf to run in CI.
+        It selects test which have 'tier 1' in their main.fmf file
+    discover:
+      - name: tier1
+        how: fmf
+        filter: 'tier: 1'
+        repository: "https://src.fedoraproject.org/tests/bind.git"
+    execute:
+        how: tmt
diff --git a/tests/tests.yml b/tests/tests.yml
index 15360ed..f30faff 100644
--- a/tests/tests.yml
+++ b/tests/tests.yml
@@ -6,21 +6,6 @@
     tags:
     - classic
     tests:
-    - Master-server-chrooted
-    - Master-server-not-chrooted
-    - Run-internal-BIND-test-suite
-    required_packages:
-    - bind
-    - bind-chroot
-    - bind-sdb-chroot
-    - redhat-lsb
-    - bind-utils
-    - dnf-utils
-    - kyua
-    - bind-devel
-    - perl-Net-DNS
-    - perl-Net-DNS-Nameserver
-    - perl-Time-HiRes
-    - softhsm
-    - bind-pkcs11
-    - bind-pkcs11-utils
+    - repo: "https://src.fedoraproject.org/tests/bind.git"
+      dest: "bind-tests"
+      fmf_filter: "tier: 1"

From 893376130b8c2433bb79fccf6c29215c3c51c47d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 12 Jan 2021 11:03:40 +0100
Subject: [PATCH 224/460] Remove docbook generation remains

New BIND no longer uses any part of docbook. It can handle out of tree
builds, therefore no hacks with copy back are required.

Documents should be installed just fine.
---
 bind.spec | 10 +---------
 1 file changed, 1 insertion(+), 9 deletions(-)

diff --git a/bind.spec b/bind.spec
index a2720ba..7938b62 100644
--- a/bind.spec
+++ b/bind.spec
@@ -498,7 +498,7 @@ export LIBDIR_SUFFIX
 %configure \
   --with-python=%{__python3} \
   --with-libtool \
-  --localstatedir=/var \
+  --localstatedir=%{_var} \
   --with-pic \
   --disable-static \
   --includedir=%{_includedir}/bind9 \
@@ -531,7 +531,6 @@ export LIBDIR_SUFFIX
   --with-cmocka \
 %endif
   --enable-fixed-rrset \
-  --with-docbook-xsl=%{_datadir}/sgml/docbook/xsl-stylesheets \
   --enable-full-report \
 ;
 %if %{with DNSTAP}
@@ -554,13 +553,6 @@ fmtutil-user --missing || :
 
 %make_build
 
-### FIXME hack!!!
-### xsltproc doesn't find properly configured files
-### and use ones from source tree
-### copy generated files to the original location
-cp -rv doc/* ../doc/
-
-
 # Regenerate dig.1 manpage
 pushd bin/dig
 make man

From 6648a9230f1b911a8437f4893162d140ab5cf158 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 12 Jan 2021 11:04:39 +0100
Subject: [PATCH 225/460] Install DLZ modules to named location

Make compatibility symlinks to original bind location.
---
 bind.spec | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index 7938b62..ccdded9 100644
--- a/bind.spec
+++ b/bind.spec
@@ -698,7 +698,7 @@ install -m 644 %{SOURCE49} ${RPM_BUILD_ROOT}%{_sysconfdir}/named-chroot.files
   pushd build
   pushd contrib/dlz/modules
   for DIR in filesystem ldap mysql mysqldyn sqlite3; do
-    %make_install -C $DIR libdir=%{_libdir}/bind
+    %make_install -C $DIR libdir=%{_libdir}/named
   done
   pushd ${RPM_BUILD_ROOT}/%{_libdir}/bind
     cp -s ../named/dlz_*.so .

From cc152b028f6dddc9e0e77827d295510ebe1270ce Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 12 Jan 2021 11:39:58 +0100
Subject: [PATCH 226/460] Use autosetup/autopatch, reorder few patches

Use autopatch, do not require mentioning each patch twice.
Patches below 300 are generic patches applied after unpacking.
Patches betwee 300 and 310 are PKCS11 specific, applied only when pkcs11
is enabled.

Substracted 100 from current patches.
---
 bind.spec | 61 +++++++++++++++++++++++--------------------------------
 1 file changed, 25 insertions(+), 36 deletions(-)

diff --git a/bind.spec b/bind.spec
index ccdded9..5bf8c9f 100644
--- a/bind.spec
+++ b/bind.spec
@@ -99,25 +99,26 @@ Source48: setup-named-softhsm.sh
 Source49: named-chroot.files
 
 # Common patches
-Patch10: bind-9.5-PIE.patch
-Patch16: bind-9.16-redhat_doc.patch
-Patch72: bind-9.5-dlz-64bit.patch
-Patch106:bind93-rh490837.patch
-Patch112:bind97-rh645544.patch
-Patch130:bind-9.9.1-P2-dlz-libdb.patch
-Patch133:bind99-rh640538.patch
-# Make PKCS11 used only for pkcs11 parts
-Patch135:bind-9.14-config-pkcs11.patch
-# Fedora specific patch to distribute native-pkcs#11 functionality
-Patch136:bind-9.10-dist-native-pkcs11.patch
-# Do not use isc-pkcs11.
-Patch149:bind-9.11-kyua-pkcs11.patch
+Patch01: bind-9.5-PIE.patch
+Patch02: bind-9.16-redhat_doc.patch
+Patch03: bind-9.5-dlz-64bit.patch
+Patch06: bind93-rh490837.patch
+Patch12: bind97-rh645544.patch
+Patch30: bind-9.9.1-P2-dlz-libdb.patch
+# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/2688
+Patch33: bind99-rh640538.patch
+Patch40: bind-9.11-rh1410433.patch
+Patch57: bind-9.11-fips-tests.patch
+Patch64: bind-9.11-rh1666814.patch
+Patch70: bind-9.11-feature-test-named.patch
+Patch71: bind-9.11-tests-variants.patch
 
-Patch140:bind-9.11-rh1410433.patch
-Patch157:bind-9.11-fips-tests.patch
-Patch164:bind-9.11-rh1666814.patch
-Patch170:bind-9.11-feature-test-named.patch
-Patch171:bind-9.11-tests-variants.patch
+# Make PKCS11 used only for pkcs11 parts
+Patch300: bind-9.14-config-pkcs11.patch
+# Fedora specific patch to distribute native-pkcs#11 functionality
+Patch301: bind-9.10-dist-native-pkcs11.patch
+# Do not use isc-pkcs11.
+Patch302: bind-9.11-kyua-pkcs11.patch
 
 Requires(post):   systemd
 Requires(preun):  systemd
@@ -412,36 +413,23 @@ in HTML and PDF format.
 %endif
 
 %prep
-%if 0%{?gpgverify:1}
-# RHEL does not yet support this verification
+%if 0%{?fedora}
 %{gpgverify} --keyring='%{SOURCE4}' --signature='%{SOURCE2}' --data='%{SOURCE0}'
 %endif
-%setup -q -n %{name}-%{BINDVERSION}
+%autosetup -n %{name}-%{BINDVERSION} -N
 
 # Common patches
-%patch10 -p1 -b .PIE
-%patch16 -p1 -b .redhat_doc
-%patch72 -p1 -b .64bit
-%patch106 -p1 -b .rh490837
-%patch112 -p1 -b .rh645544
-%patch130 -p1 -b .libdb
-%patch140 -p1 -b .rh1410433
-%patch157 -p1 -b .fips-tests
-%patch164 -p1 -b .rh1666814
-%patch170 -p1 -b .featuretest-named
-%patch171 -p1 -b .test-variant
+%autopatch -M 299 -p1
 
 %if %{with PKCS11}
-%patch135 -p1 -b .config-pkcs11
+%patch300 -p1 -b .config-pkcs11
 cp -r bin/named{,-pkcs11}
 cp -r bin/dnssec{,-pkcs11}
 cp -r lib/dns{,-pkcs11}
 cp -r lib/ns{,-pkcs11}
-%patch136 -p1 -b .dist_pkcs11
-%patch149 -p1 -b .kyua-pkcs11
+%autopatch -m 301 -M 309 -p1
 %endif
 
-%patch133 -p1 -b .rh640538
 
 # Sparc and s390 arches need to use -fPIE
 %ifarch sparcv9 sparc64 s390 s390x
@@ -1157,6 +1145,7 @@ fi;
 * Wed Jan 06 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.10-2
 - Use make macros
 - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro
+- Use autosetup/autopatch macros
 
 * Tue Jan 05 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.10-1
 - Update to 9.16.10

From 684e4b0d0a94d487f24108cb59a952eda5a67f5b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 12 Jan 2021 20:54:56 +0100
Subject: [PATCH 227/460] Revert "Use autosetup/autopatch, reorder few patches"

This reverts commit cc152b028f6dddc9e0e77827d295510ebe1270ce.

EPEL and RHEL 8 do not yet support %autopatch -M X. I want check the
compatibility with them, keep it legacy way until they are supported in
RHEL 8.
---
 bind.spec | 57 +++++++++++++++++++++++++++++++++----------------------
 1 file changed, 34 insertions(+), 23 deletions(-)

diff --git a/bind.spec b/bind.spec
index 5bf8c9f..ccdded9 100644
--- a/bind.spec
+++ b/bind.spec
@@ -99,26 +99,25 @@ Source48: setup-named-softhsm.sh
 Source49: named-chroot.files
 
 # Common patches
-Patch01: bind-9.5-PIE.patch
-Patch02: bind-9.16-redhat_doc.patch
-Patch03: bind-9.5-dlz-64bit.patch
-Patch06: bind93-rh490837.patch
-Patch12: bind97-rh645544.patch
-Patch30: bind-9.9.1-P2-dlz-libdb.patch
-# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/2688
-Patch33: bind99-rh640538.patch
-Patch40: bind-9.11-rh1410433.patch
-Patch57: bind-9.11-fips-tests.patch
-Patch64: bind-9.11-rh1666814.patch
-Patch70: bind-9.11-feature-test-named.patch
-Patch71: bind-9.11-tests-variants.patch
-
+Patch10: bind-9.5-PIE.patch
+Patch16: bind-9.16-redhat_doc.patch
+Patch72: bind-9.5-dlz-64bit.patch
+Patch106:bind93-rh490837.patch
+Patch112:bind97-rh645544.patch
+Patch130:bind-9.9.1-P2-dlz-libdb.patch
+Patch133:bind99-rh640538.patch
 # Make PKCS11 used only for pkcs11 parts
-Patch300: bind-9.14-config-pkcs11.patch
+Patch135:bind-9.14-config-pkcs11.patch
 # Fedora specific patch to distribute native-pkcs#11 functionality
-Patch301: bind-9.10-dist-native-pkcs11.patch
+Patch136:bind-9.10-dist-native-pkcs11.patch
 # Do not use isc-pkcs11.
-Patch302: bind-9.11-kyua-pkcs11.patch
+Patch149:bind-9.11-kyua-pkcs11.patch
+
+Patch140:bind-9.11-rh1410433.patch
+Patch157:bind-9.11-fips-tests.patch
+Patch164:bind-9.11-rh1666814.patch
+Patch170:bind-9.11-feature-test-named.patch
+Patch171:bind-9.11-tests-variants.patch
 
 Requires(post):   systemd
 Requires(preun):  systemd
@@ -413,23 +412,36 @@ in HTML and PDF format.
 %endif
 
 %prep
-%if 0%{?fedora}
+%if 0%{?gpgverify:1}
+# RHEL does not yet support this verification
 %{gpgverify} --keyring='%{SOURCE4}' --signature='%{SOURCE2}' --data='%{SOURCE0}'
 %endif
-%autosetup -n %{name}-%{BINDVERSION} -N
+%setup -q -n %{name}-%{BINDVERSION}
 
 # Common patches
-%autopatch -M 299 -p1
+%patch10 -p1 -b .PIE
+%patch16 -p1 -b .redhat_doc
+%patch72 -p1 -b .64bit
+%patch106 -p1 -b .rh490837
+%patch112 -p1 -b .rh645544
+%patch130 -p1 -b .libdb
+%patch140 -p1 -b .rh1410433
+%patch157 -p1 -b .fips-tests
+%patch164 -p1 -b .rh1666814
+%patch170 -p1 -b .featuretest-named
+%patch171 -p1 -b .test-variant
 
 %if %{with PKCS11}
-%patch300 -p1 -b .config-pkcs11
+%patch135 -p1 -b .config-pkcs11
 cp -r bin/named{,-pkcs11}
 cp -r bin/dnssec{,-pkcs11}
 cp -r lib/dns{,-pkcs11}
 cp -r lib/ns{,-pkcs11}
-%autopatch -m 301 -M 309 -p1
+%patch136 -p1 -b .dist_pkcs11
+%patch149 -p1 -b .kyua-pkcs11
 %endif
 
+%patch133 -p1 -b .rh640538
 
 # Sparc and s390 arches need to use -fPIE
 %ifarch sparcv9 sparc64 s390 s390x
@@ -1145,7 +1157,6 @@ fi;
 * Wed Jan 06 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.10-2
 - Use make macros
 - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro
-- Use autosetup/autopatch macros
 
 * Tue Jan 05 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.10-1
 - Update to 9.16.10

From af42e590708ff76011fda73f481639480c155d1d Mon Sep 17 00:00:00 2001
From: Adrian Reber <adrian@lisas.de>
Date: Wed, 13 Jan 2021 08:55:12 +0100
Subject: [PATCH 228/460] Rebuilt for protobuf 3.14

---
 bind.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index c6a1878..5dbac61 100644
--- a/bind.spec
+++ b/bind.spec
@@ -67,7 +67,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.11.26
-Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  3%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1628,6 +1628,9 @@ fi;
 %endif
 
 %changelog
+* Wed Jan 13 08:55:11 CET 2021 Adrian Reber <adrian@lisas.de> - 32:9.11.26-3
+- Rebuilt for protobuf 3.14
+
 * Wed Jan 06 2021 Petr Menšík <pemensik@redhat.com> - 32:9.11.26-2
 - Use make macros
 - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro

From ce6a7853ac6e54fdbc260eec8546dfe3e9cc343c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 14 Jan 2021 23:21:42 +0100
Subject: [PATCH 229/460] Make provide versioned, remove lwres remain

lwres remain was left in spec, it fails the build now.
---
 bind.spec | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/bind.spec b/bind.spec
index bf20937..cf83832 100644
--- a/bind.spec
+++ b/bind.spec
@@ -365,7 +365,7 @@ Dynamic Loadable Zones LDAP module for BIND server.
 %package dlz-mysql
 Summary: BIND server mysql and mysqldyn DLZ modules
 Requires: bind%{?_isa} = %{epoch}:%{version}-%{release}
-Provides: %{name}-dlz-mysqldyn
+Provides: %{name}-dlz-mysqldyn = %{epoch}:%{version}-%{release}
 Obsoletes: %{name}-dlz-mysqldyn < 32:9.16.6-3
 
 %description dlz-mysql
@@ -432,11 +432,6 @@ in HTML and PDF format.
 %patch170 -p1 -b .featuretest-named
 %patch171 -p1 -b .test-variant
 
-# Avoid having [FIXME: manual] on top of generated manual pages
-# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/4524
-find bin lib/lwres/man -name '*.docbook' -exec \
-  sed -e 's|<refmiscinfo>BIND9|<refmiscinfo class="manual">BIND9|' -i '{}' ';'
-
 %if %{with PKCS11}
 %patch135 -p1 -b .config-pkcs11
 cp -r bin/named{,-pkcs11}

From 9a979d2e9c2de0cf1bb00274df1b8727e542234f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 15 Jan 2021 12:43:31 +0100
Subject: [PATCH 230/460] Update Changes and README to match 9.16 release

---
 Changes.md | 45 ++++++++++++++++++++++++++++++++++++++-------
 README.md  |  5 ++---
 2 files changed, 40 insertions(+), 10 deletions(-)

diff --git a/Changes.md b/Changes.md
index 91e17b4..6661034 100644
--- a/Changes.md
+++ b/Changes.md
@@ -1,12 +1,43 @@
-= Changes in BIND9 package =
+# Significant Changes in BIND9 package
 
-== 9.14 ==
+## BIND 9.16
 
-- single thread support removed. Cannot provide bind-export-libs for DHCP
-- lwres support completely removed. Both daemon and library
-- common parts of daemon moved into libns shared library
+### New features
+
+- *libuv* is used for network subsystem as a mandatory dependency
+- *dnssec-policy* support in named.conf is introduced, providing a a key and signing policy
+  ([KASP](https://gitlab.isc.org/isc-projects/bind9/-/wikis/DNSSEC-Key-and-Signing-Policy-(KASP)))
+- *trusted-keys* and *managed-keys* are deprecated, replaced by *trust-anchors*
+- *trust-anchors* support also anchor in a *DS* format, in addition to *DNSKEY* format
+- **dig, mdig** and **delv** support **+yaml** parameter to print detailed machine parseable output
+
+### Feature changes
+
+- Static trust anchor and *dnssec-validation auto;* are incompatible and cause fatal error, when used together.
+- *DS* and *CDS* now generates only SHA-256 digest, SHA-1 is no longer generated by default
+- SipHash 2-4 DNS Cookie ([RFC 7873](https://www.rfc-editor.org/rfc/rfc7873.html) is now default).
+  Only AES alternative algorithm is kept, HMAC-SHA cookie support were removed.
+- **dnssec-signzone** and **dnssec-verify** commands print output to stdout, *-q* parameter can silence them
+
+### Features removed
+
+- *dnssec-enable* option is obsolete, DNSSEC support is always enabled
+- *dnssec-lookaside* option is deprecated and support for it removed from all tools
+- *cleaning-interval* option is removed
+
+### Upstream release notes
+
+- [9.16.10 notes](https://downloads.isc.org/isc/bind9/9.16.10/doc/arm/html/notes.html#notes-for-bind-9-16-10)
+- [9.16.0 notes](https://downloads.isc.org/isc/bind9/9.16.0/doc/arm/html/notes.html#notes-for-bind-9-16-0)
+
+## BIND 9.14
+
+- single thread support removed. Cannot provide *bind-export-libs* for DHCP
+- *lwres* support completely removed. Both daemon and library
+- common parts of daemon moved into *libns* shared library
 - introduced plugin for filtering aaaa responses
 - some SDB utilities no longer supported
 
-=== 9.14.7 ===
-[notes](https://downloads.isc.org/isc/bind9/9.14.7/RELEASE-NOTES-bind-9.14.7.html)
+### Upstream release notes
+
+- [9.14.7 notes](https://downloads.isc.org/isc/bind9/9.14.7/RELEASE-NOTES-bind-9.14.7.html)
diff --git a/README.md b/README.md
index 8ce75e1..22359bb 100644
--- a/README.md
+++ b/README.md
@@ -22,11 +22,10 @@ The package contains several subpackages, some of them can be disabled on rebuil
 * **bind-utils** -- set of tools to analyse DNS responses or update entries (dig, host)
 * **bind-doc** -- documentation for current bind, *BIND 9 Administrator Reference Manual*.
 * **bind-license** -- Shared license for all packages but bind-export-libs.
-* **bind-sdb** -- *named* daemon built with support for [Dynamically Loadable Zones](http://bind-dlz.sourceforge.net/), interface to serve DNS names from external databases like LDAP or SQL. Can be disabled by `--without SDB`.
 * **bind-pkcs11** -- *named* daemon built with native PKCS#11 support. Can be disabled by `--without PKCS11`.
 * **bind-libs** and **bind-libs-lite** -- Shared libraries used by some others programs
-* **bind-export-libs** -- Special subset of libraries without support for threads. Used by *dhcp* package. Can be disabled by `--without EXPORT_LIBS`
-* **bind-devel** -- Development headers for libs. Can be disabled by `--without DEVEL`
+* **bind-devel** -- Development headers for libs.
+* **bind-dlz-\*** -- Dynamic loadable [DLZ plugins](http://bind-dlz.sourceforge.net/) with support for external databases
 
 
 ## Optional features

From f3d54bbf18ae4a6ad519bcc35e866b2d51efb8c1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 21 Jan 2021 11:12:46 +0100
Subject: [PATCH 231/460] Update to 9.16.11 (#1827602)

https://downloads.isc.org/isc/bind9/9.16.11/RELEASE-NOTES-bind-9.16.11.html
---
 .gitignore                         |   4 +-
 bind-9.10-dist-native-pkcs11.patch |  46 ++-
 bind.spec                          |  17 +-
 codesign2019.txt                   | 252 --------------
 codesign2021.txt                   | 534 +++++++++++++++++++++++++++++
 sources                            |   4 +-
 6 files changed, 584 insertions(+), 273 deletions(-)
 delete mode 100644 codesign2019.txt
 create mode 100644 codesign2021.txt

diff --git a/.gitignore b/.gitignore
index de4664d..27084be 100644
--- a/.gitignore
+++ b/.gitignore
@@ -139,4 +139,6 @@ bind-9.7.2b1.tar.gz
 /bind-9.16.9.tar.xz
 /bind-9.16.9.tar.xz.asc
 /bind-9.16.10.tar.xz
-/bind-9.16.10.tar.xz.asc
\ No newline at end of file
+/bind-9.16.10.tar.xz.asc
+/bind-9.16.11.tar.xz
+/bind-9.16.11.tar.xz.asc
diff --git a/bind-9.10-dist-native-pkcs11.patch b/bind-9.10-dist-native-pkcs11.patch
index 48ff40b..119884e 100644
--- a/bind-9.10-dist-native-pkcs11.patch
+++ b/bind-9.10-dist-native-pkcs11.patch
@@ -1,3 +1,24 @@
+From 9091161562587fe7ab017fc4042143987514a643 Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Thu, 21 Jan 2021 10:46:20 +0100
+Subject: [PATCH] Enable custom pkcs11 native build
+
+Share common parts like libisc, libcc and others. But provide native
+pkcs11 libraries as a new copy of libdns and libns.
+---
+ bin/Makefile.in                  |  2 +-
+ bin/confgen/Makefile.in          |  2 +-
+ bin/dnssec-pkcs11/Makefile.in    | 39 +++++++++++++++++---------------
+ bin/named-pkcs11/Makefile.in     | 33 ++++++++++++++-------------
+ configure.ac                     | 19 ++++++++++++++++
+ lib/Makefile.in                  |  2 +-
+ lib/dns-pkcs11/Makefile.in       | 22 +++++++++---------
+ lib/dns-pkcs11/tests/Makefile.in |  8 +++----
+ lib/ns-pkcs11/Makefile.in        | 26 ++++++++++-----------
+ lib/ns-pkcs11/tests/Makefile.in  | 12 +++++-----
+ make/includes.in                 |  7 ++++++
+ 11 files changed, 101 insertions(+), 71 deletions(-)
+
 diff --git a/bin/Makefile.in b/bin/Makefile.in
 index 9ad7f62..094775a 100644
 --- a/bin/Makefile.in
@@ -226,10 +247,10 @@ index 525f505..d517ec6 100644
  @DLZ_DRIVER_RULES@
  
 diff --git a/configure.ac b/configure.ac
-index 1932000..cf15786 100644
+index 02e36a7..f1f50fe 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -1244,12 +1244,14 @@ AC_SUBST(USE_GSSAPI)
+@@ -1245,12 +1245,14 @@ AC_SUBST(USE_GSSAPI)
  AC_SUBST(DST_GSSAPI_INC)
  AC_SUBST(DNS_GSSAPI_LIBS)
  DNS_CRYPTO_LIBS="$DNS_GSSAPI_LIBS"
@@ -244,7 +265,7 @@ index 1932000..cf15786 100644
  
  #
  # was --with-lmdb specified?
-@@ -2336,6 +2338,8 @@ AC_SUBST(BIND9_DNS_BUILDINCLUDE)
+@@ -2344,6 +2346,8 @@ AC_SUBST(BIND9_DNS_BUILDINCLUDE)
  AC_SUBST(BIND9_NS_BUILDINCLUDE)
  AC_SUBST(BIND9_BIND9_BUILDINCLUDE)
  AC_SUBST(BIND9_IRS_BUILDINCLUDE)
@@ -253,7 +274,7 @@ index 1932000..cf15786 100644
  if test "X$srcdir" != "X"; then
  	BIND9_ISC_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/isc/include"
  	BIND9_ISCCC_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/isccc/include"
-@@ -2344,6 +2348,8 @@ if test "X$srcdir" != "X"; then
+@@ -2352,6 +2356,8 @@ if test "X$srcdir" != "X"; then
  	BIND9_NS_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/ns/include"
  	BIND9_BIND9_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/bind9/include"
  	BIND9_IRS_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/irs/include"
@@ -262,7 +283,7 @@ index 1932000..cf15786 100644
  else
  	BIND9_ISC_BUILDINCLUDE=""
  	BIND9_ISCCC_BUILDINCLUDE=""
-@@ -2352,6 +2358,8 @@ else
+@@ -2360,6 +2366,8 @@ else
  	BIND9_NS_BUILDINCLUDE=""
  	BIND9_BIND9_BUILDINCLUDE=""
  	BIND9_IRS_BUILDINCLUDE=""
@@ -271,7 +292,7 @@ index 1932000..cf15786 100644
  fi
  
  AC_SUBST_FILE(BIND9_MAKE_INCLUDES)
-@@ -2824,8 +2832,11 @@ AC_CONFIG_FILES([
+@@ -2830,8 +2838,11 @@ AC_CONFIG_FILES([
  	bin/delv/Makefile
  	bin/dig/Makefile
  	bin/dnssec/Makefile
@@ -283,7 +304,7 @@ index 1932000..cf15786 100644
  	bin/nsupdate/Makefile
  	bin/pkcs11/Makefile
  	bin/plugins/Makefile
-@@ -2887,6 +2898,10 @@ AC_CONFIG_FILES([
+@@ -2893,6 +2904,10 @@ AC_CONFIG_FILES([
  	lib/dns/include/dns/Makefile
  	lib/dns/include/dst/Makefile
  	lib/dns/tests/Makefile
@@ -294,7 +315,7 @@ index 1932000..cf15786 100644
  	lib/irs/Makefile
  	lib/irs/include/Makefile
  	lib/irs/include/irs/Makefile
-@@ -2919,6 +2934,10 @@ AC_CONFIG_FILES([
+@@ -2925,6 +2940,10 @@ AC_CONFIG_FILES([
  	lib/ns/include/Makefile
  	lib/ns/include/ns/Makefile
  	lib/ns/tests/Makefile
@@ -389,7 +410,7 @@ index 8de85bf..d5c3c2b 100644
  	rm -f include/dns/rdatastruct.h
  	rm -f dnstap.pb-c.c dnstap.pb-c.h
 diff --git a/lib/dns-pkcs11/tests/Makefile.in b/lib/dns-pkcs11/tests/Makefile.in
-index 8aec0a8..3c2cc04 100644
+index a56c7d3..768ead8 100644
 --- a/lib/dns-pkcs11/tests/Makefile.in
 +++ b/lib/dns-pkcs11/tests/Makefile.in
 @@ -15,14 +15,14 @@ VERSION=@BIND9_VERSION@
@@ -481,12 +502,12 @@ index d00ddaf..b867afe 100644
 -	rm -f libns.@A@ timestamp
 +	rm -f libns-pkcs11.@A@ timestamp
 diff --git a/lib/ns-pkcs11/tests/Makefile.in b/lib/ns-pkcs11/tests/Makefile.in
-index ef1c1a6..5bbf10d 100644
+index 4c3e694..c1b6d99 100644
 --- a/lib/ns-pkcs11/tests/Makefile.in
 +++ b/lib/ns-pkcs11/tests/Makefile.in
 @@ -17,17 +17,17 @@ VERSION=@BIND9_VERSION@
  
- WRAP_OPTIONS =	-Wl,--wrap=isc_nmhandle_detach -Wl,--wrap=isc_nmhandle_attach
+ WRAP_OPTIONS =	-Wl,--wrap=isc__nmhandle_detach -Wl,--wrap=isc__nmhandle_attach
  
 -CINCLUDES =	-I. -Iinclude ${NS_INCLUDES} ${DNS_INCLUDES} ${ISC_INCLUDES} \
 +CINCLUDES =	-I. -Iinclude ${NS_PKCS11_INCLUDES} ${DNS_PKCS11_INCLUDES} ${ISC_INCLUDES} \
@@ -523,3 +544,6 @@ index 5373a7e..f1901ee 100644
 +NS_PKCS11_INCLUDES = @BIND9_NS_PKCS11_BUILDINCLUDE@ \
 +	-I${top_srcdir}/lib/ns-pkcs11/include
 +
+-- 
+2.26.2
+
diff --git a/bind.spec b/bind.spec
index cf83832..a4017f4 100644
--- a/bind.spec
+++ b/bind.spec
@@ -55,18 +55,18 @@
 # no more isc-config.sh and bind9-config
 
 # lib*.so.X versions of selected libraries
-%global sover_dns 1610
-%global sover_isc 1608
+%global sover_dns 1611
+%global sover_isc 1609
 %global sover_irs 1601
-%global sover_isccfg 1602
-%global sover_ns 1606
+%global sover_isccfg 1603
+%global sover_ns 1607
 
 
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.16.10
-Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Version:  9.16.11
+Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -74,7 +74,7 @@ Source0:  https://downloads.isc.org/isc/bind9/%{BINDVERSION}/bind-%{BINDVERSION}
 Source1:  named.sysconfig
 Source2:  https://downloads.isc.org/isc/bind9/%{BINDVERSION}/bind-%{BINDVERSION}.tar.xz.asc
 Source3:  named.logrotate
-Source4:  https://downloads.isc.org/isc/pgpkeys/codesign2019.txt
+Source4:  https://downloads.isc.org/isc/pgpkeys/codesign2021.txt
 Source16: named.conf
 # Refresh by command: dig @a.root-servers.net. +tcp +norec
 # or from URL
@@ -1155,6 +1155,9 @@ fi;
 %endif
 
 %changelog
+* Thu Jan 21 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.11-1
+- Update to 9.16.11 (#1827602)
+
 * Thu Jan 14 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.10-2
 - Update to 9.16.10
 - Remove bind-sdb package
diff --git a/codesign2019.txt b/codesign2019.txt
deleted file mode 100644
index 1807b58..0000000
--- a/codesign2019.txt
+++ /dev/null
@@ -1,252 +0,0 @@
------BEGIN PGP PUBLIC KEY BLOCK-----
-Comment: GPGTools - http://gpgtools.org
-
-mQINBFwq9BQBEADHjPDCwsHVtxnMNilgu187W8a9rYTMLgLfQwioSbjsF7dUJu8m
-r1w2stcsatRs7HBk/j26RNJagY2Jt0QufOQLlTePpTl6UPU8EeiJ8c15DNf45TMk
-pa/3MdIVpDnBioyD1JNqsI4z+yCYZ7p/TRVCyh5vCcwmt5pdKjKMTcu7aD2PtTtI
-yhTIetJavy1HQmgOl4/t/nKL7Lll2xtZ56JFUt7epo0h69fiUvPewkhykzoEf4UG
-ZFHSLZKqdMNPs/Jr9n7zS+iOgEXJnKDkp8SoXpAcgJ5fncROMXpxgY2U+G5rB9n0
-/hvV1zG+EP6OLIGqekiDUga84LdmR/8Cyc7DimUmaoIZXrAo0Alpt0aZ8GimdKmh
-qirIguJOSrrsZTeZLilCWu37fRIjCQ3dSMNyhHJaOhRJQpQOEDG7jHxFak7627aF
-UnVwBAOK3NlFfbomapXQm64lYNoONGrpV0ctueD3VoPipxIyzNHHgcsXDZ6C00sv
-SbuuS9jlFEDonA6S8tApKgkEJuToBuopM4xqqwHNJ4e6QoXYjERIgIBTco3r/76D
-o22ZxSK1m2m2i+p0gnWTlFn6RH+r6gfLwZRj8iR4fa0yMn3DztyTO6H8AiaslONt
-LV2kvkhBar1/6dzlBvMdiRBejrVnw+Jg2bOmYTncFN00szPOXbEalps8wwARAQAB
-tE1JbnRlcm5ldCBTeXN0ZW1zIENvbnNvcnRpdW0sIEluYy4gKFNpZ25pbmcga2V5
-LCAyMDE5LTIwMjApIDxjb2Rlc2lnbkBpc2Mub3JnPokCVAQTAQgAPhYhBK4/rHln
-EexZ/AB6pHS7a5pMuz04BQJcKvQUAhsDBQkD7JcABQsJCAcCBhUKCQgLAgQWAgMB
-Ah4BAheAAAoJEHS7a5pMuz0476oP/1+UaSHfe4WVHV43QaQ/z1rw7vg2aHEwyWJA
-1D1tBr9+LvfohswwWBLIjcKRaoXZ4pLBFjuiYHBTsdaAQFeQQvQTXMmBx21ZyUZj
-tjim8f9T1JhmIrMx6tF14NbqFpjw82Mv0rc8y74pdRvkdnFigqLKUoN2tFQlKeG+
-5T24zNwrGrlR3S7gnM47nD1JqKwt4GnczLnMBW/0gbLscMUpAeNo/gY4g0GV/zkn
-Rt91bLpcEyDAv+ZhQZbkJ49dnNzl5cTK5+uQWnlAZAdPecdLkvBNRNgj/FKL41RF
-JGN6eqq3+jlPbyj9okeJoGQ64Ibv1ZHVTQIx5vT1+PuVX/Nm0GqSUZdLqR33daKI
-hjpgUdUK/D0AnN5ulVuE1NnZWjVDTXVEeU8DFvi4lxZVHnZixejxFIZ7vRMvyaHa
-xLwbevwEUuPLzWn3XhC5yQeqCe6zmzzaPhPlg6NTnM5wgzcKORqCXgxzmtnX+Pbd
-gXTwNKAJId/141vj1OtZQKJexG9QLufMjBg5rg/qdKooozremeM+FovIocbdFnmX
-pzP8it8r8FKi7FpXRE3fwxwba4Y9AS2/owtuixlJ2+7M2OXwZEtxyXTXw2v5GFOP
-vN64G/b71l9c3yKVlQ3BXD0jErv9XcieeFDR9PK0XGlsxykPcIXZYVy2KSWptkSf
-6f2op3tMiQEzBBABCAAdFiEEFcm6uMUTPAcGawLtlumWUDlMmawFAlwuSqAACgkQ
-lumWUDlMmaz+igf/ZW8OY5aWjRk7QiXp93jkWRIbMi8kB9jW5u6tfYXFjMADpqiQ
-yYdzEHFayRF92PQwj81UzIWzOWjErFWLDE2xol9sP5LdzeqoyED+XTqKggpVsIs+
-Lq672qnumQoZKp1YGb8MDocU2DNg/VsMdi7kCnEnPbcSuBxksmxGYomusXNrAF94
-1OJ2sqd9BuFamLIyn8XUCGGYlsvMoe4kTCg6Cc1sQvx0lDG8urKN57jBKWbP4alV
-+JBV5KQcf74gzPmE3ypgY1tMEwxyH/WyS9ekDbai0qauX6eUAsM1bduH8fIcknLS
-Zl5hrJTrzWFF9/DKOth8QOwhJ9zoIF1fcAsx9okBMwQQAQgAHRYhBHpqR7X54SM6
-0lUrXL2X3GOe6MR7BQJcLktcAAoJEL2X3GOe6MR7jwEH/iaolMeno1oeWAgzN6Mg
-bx3maweh/9Vqty1fwk7Crq1G78X5i1OCkknEL2p0Bfle4ApwcC4HZVcqCgoYpRV3
-/EEXtwkMNy3plWdBbLCQSev/E1D39GzgAHiMnv7NUJnkoJbvMrvrAiUTXPTtARMM
-gjEpvgEs60wuJxS8ESomRhe/KW4myxDoBxF+K+e5bOkOvvWVcAYJHWZ1BIZs4n6b
-+C2vO8q5aKTkQ/XvNT7utbTOqj1SGhItRaAQKXHBdzkQ1Et3wTA4+uRg4gK12624
-9LperYs26w9X9UzApl+qVxQhtWUw3tnUXMastDfQrRcvJgq1xpv++OqX5Uc93RTf
-SNWJAjMEEAEIAB0WIQS+DpdItxglOii7if/xsRvwXPAuVwUCXC5LlQAKCRDxsRvw
-XPAuV29KEACEwlTVVKe4gnBYHnlAD7csoQ0+gJ6C+Ofzlw+UItRIcFeVCAknSGBs
-NPxr9JStIvKpmsbSKpCNUEAYnRP2immh94y/C6BuTe1uUUmqBGr1f4OAUwZpmI29
-ixYeY/uUs9FZO3bS0/WtG46tdcJK41qtM0DYAGT3oeZhJMTW15dfvMGlFukauSOU
-+BbR+6sZhqdbWl/AOTE/6x5otnAaW0GObY/BW240Xq/KTgBrzVdK5qNoYsMVsiTd
-0im0JKvFG08ED+ZfcILhlO6G9jRhoTkhtYuf8CKN1dPf2IoB5FrRFf0xqRr9hNlk
-X7ViNMP9OPb8i3BubWvRi5rNSquCwrFATSiAgaA9Yi1BNzQsmQxOql9lsh7eCH7m
-+8zzUg9umWI6PkSv8vHBo2kPX73wmtEsF6vxJlk0yDBuQw7y0uuKh406tEEk4cP2
-8U4baq+ihpioupDhNuEII1h1Eh/RBE408RAOpcr+2F0m/fKOoJyz7u+AxyV81Ia6
-fyBnUfZnlfKo16w87c1HJRs9dKkRa5yGziBf9TcED3sru58Pftes2Nr80/iOh26i
-P2pRihcIyrmeAqDWnneErVCmPMDTe6zkMrm/0iZ25/Jfq+M8IHEzFEw3Y1FBOeFg
-9TyMDwYG2biJPTNTDO0BQ+Rrvs4SjFWEYSxgJSvG1jMfSPt5AR6MJrkCDQRcKvQU
-ARAAufZX5WzJr0lZAhxaGpHY6JMBr4jVOCP4TrDZhwC2K4CXNM/PLLNisWzquiWa
-FvUDhB89kCxrEhipwVFYhBr16CDQxrr8yhah3RIxrBMYhRTxgIAkANgkhGWfDJSE
-zXauA7krYtS3rYwhfXe4cNsTkLPbnMUlyLJcqj2wnZcZIt97aL+NFRPyfIw1KfUb
-9u3tB9seDYbvTEULeL07aTnHpWM5f3bTwJrJ2OFPzXseCCzPiVNh3Bv+YtJ1pMTr
-c/UHO5DoJuHLsF0wicPSrpD0twspFdR/0rT6eNycsaCtV4GQzBcMPvY7qai5XrZm
-Cqgluo1W6l6+F5YrKvRMtyyFkUNGcPywdjSlP44JyRrS2uzvFUViSsJArcmFG2TJ
-LCohnse8wqjw0dIUVbmDbE4zjaG56zkvu0k+04Wwp3XPgOZrbl6cbhX3yLhu/Gt0
-dzd9EReoNfKXk32hBzKas/vdeB5DZejbOOOWYftqyZC1LvDvvrYFhFK6VGozfZ6L
-Fml1hzn+xPahp5tRv93/T9zXeVPm9zilGMqm/gjRgh8ojWxNQoNzJyqTPWIvWmbu
-EIP3T3cTFq6lJpJsg3+sfzofGWZCGnBZQGqm8rEOoUWiaKe1BvQCX1x8p4/x8/tX
-TaVDpQCGoqxXt09plkDuGMuiDICxBlaHWUR2jLoHc2cLrB8AEQEAAYkCPAQYAQgA
-JhYhBK4/rHlnEexZ/AB6pHS7a5pMuz04BQJcKvQUAhsMBQkD7JcAAAoJEHS7a5pM
-uz04pB8P/Amfg54IFeALiPOrKbjC3bVAQzrsf09IL8sUln/LCZIx9HgGAJj/f35S
-Q35sK2ucjWiDX6qCxVrWmC6caQXFgXOFSKIlqladmmgj4sIdLM5wj4nbomHChpB5
-rqV/GgkFwWBQ3kPCatXvc8Bg+zKJ+wXgTuPFXefyE9R+SLuas2grQ9hAjvTGHYbq
-iYxSlNDFc1aHLAQ3bS76351MHuMHOpLzoB0OkZDCVNW4GNEqrLbINdr50RAK+Loo
-Z2UBIobEZjXYor9A2FWkSvdjyz6X1QKMdQMath6R91k/O0abBa7ly4/805eAGXM3
-w1Xf2eMlpiUs69BeYoJBklK8aNMntpDREunJjhiPU4JoDzSxl5Qv7LuXylyo0YJA
-9YmydKhTTcRdwsKc//nGr/ckg4BRl+VbtJBYvd3xGB7IQ+pT/TOakv9qCospAhr3
-EQjVP/XpnWJRd+x+dq8UXqwWmTenWDE42cNr7BDFJdOqS5ZWy4sIz4sdjpSxXMB9
-8iiRtKSpKRCJgXScB7SYebh835EgG2YyQGdhJMO7C6ok9POYQBqL8sBqRzImJKoT
-VDvOH42WArKwJWTHa4mPdiDHEIZlkONerec3JXtl4Mfv8cwZ5Lb8fSiB/x8AWvqs
-puc/7hQtkus4TcgutS1fwhAwpnFItpVF6+73CMQrJsblBdTjW0T+uQINBFxbVHwB
-EADebZOJbhPdhHeBPdlZYE3rRjB8scDpWdjrCupfmeTC9MM6JgCE4DEMBtBXk+h1
-+7wfpblYYNFwGVFvytG5nvGRDtHWxwd1Z9O8Fx4Zqu0Fx/wAn7ZL3ryE+tdHR7JK
-7SLxOa2X49T/8LY0U8Q65I4ZRo/b4VMcXApCmncw3QSRqHT/mYdNnf+HHPvi3jza
-md3iVptCS4Iaisc079DFda+htWXspBc13lmPi2vGQkWjjS3B4yO8JackyQPVhpsg
-KYbRBzOH0Kii8bXmyA6O5uIJYEddp5Veged4FE/ej3CrgGP1D0Yk1epx8lLbi9RB
-kwFS7DA5rQ23UnbSy1WyV1ZgPrWqQAWuGpjMTVTWN0ElI3AGxAnE8lZlSXyE+XyV
-uHjjIVrayBjLKVqDuSLdKZeCvI4QsyHH6F0NKJQkngvXxLZYxO6s0c2EFFLzdVWT
-1V9GMP8UsDrrb+JsZjUVmPR1tTP4xqEQG6KjfFoQm5XWpGtFwh91OK1lwf/Bx2/C
-j+PquLLFcj7hEP79VDTUZPQAduTTxIeTzHXH+x1PCHFB10xxH3e82VSdJeBUrJxn
-riXzK50SKTTmF+uYpHqE8Jg1N2Y1n5ksuxeYUy8PFjhAeBCqZ6ZcldUDf4999e/z
-PT8bwfCDr8jRdqJHrq7RxTJiP5RsMudWpKeohzJGwQ5uZwARAQABiQRyBBgBCAAm
-FiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAlxbVHwCGwIFCQO9IQACQAkQdLtrmky7
-PTjBdCAEGQEIAB0WIQSVztolaxygoV8wL7WVIaftXazpGAUCXFtUfAAKCRCVIaft
-XazpGPeMEACm9nxA/VKf8RxDo2ZuTgyuSwlR8tCjAE4k3+UoiYUbamkW4pjx9Vgd
-1zC5bNxSWZ5vlJ4CH8ArKFqNK5LBVDZqhYureAo/1Af2b9vRJw0/QQHhuXz/jqeT
-wwrLuKpy796Gpt+aFfcmS0ZC4QXfxJERhAP6tu1p6YmAsSb+bjziQVkKrt9mhOrL
-dtz6WP0Fg1joRj33FgnnLtayHvtgQrNFI3ztCjk/B2FjYZxqbBGfk5gyo0cTE2Fi
-oLhG/XrxIoZepFMJkGYETnYQXrOt2KuJLvawV70YQmG8EqHYY8drKA0XDZs8TVdT
-5cvGvtm8ERz5znsssRBxQMI5Ml6O2ahrXp8Eq4htCzlvO8t2MOtzvqAJRiyAd6bA
-Uo+MGVRpnvePOR1SAgBXCd416rF0iCXc1utZxnqwdq9kJAZ+8mCLx4N4jk6AdGpX
-zcNkLg7QmUzXn75RxZ6GrIUYZJNMlswXq5XhSW4o8ePlaxWjh9+QTtU964AZhpA1
-uoHsKGTBxHJs0w6McZm14kb2PuaO2/rpf8s8IZyc93+Y5O/gHZ6/agBjA9qN6wkQ
-R1d5UhJC4QS/m35rBGBKK9X3fqQxaBCio6Qz+m4A3GchrztJpq+2P+ma5ylsTq5j
-V4njky26WNtrV7+N0C4Moj3I4Qn6YU/eSManTXzHzoiPZCEH/IOxgXIiD/9Zm3Zz
-I+h4NCfSGyP11/w1gEzlTHQ4at/FXIIDh0Y2ZNpWPffuFQLtcER2vyKPwhDYpGMy
-NNHXks4azfrXVCv0wmSNBbeS8pJrYtopZpCEBrAbg/YLv9m5lpDSRHaR3gv/qMZ7
-QxY+NwqciqTwGq68PuF4mDSvtfuFmbEES9Iybiie+eL/6DU2knfBjgshUe6vElR+
-LYoPQ45GY2IxRTJ1pMXaZw1+evwH3UvseRGkRygiaBgoU/qR4prynvjMQcacCa+C
-aRnXZJYp/usVBeY0xut9toc9/OcLGoBr5h9l5YjruO2vu8VHou8N0tarVQn3YbQR
-Fi+YtNtclWJa8Pq1AsKRTCFwDwP6eODv6mNOrEFydNRcpiQmzp47VWF/YHRfHzCq
-A1wHLxLUrpQTaVw6J4FqedAQ31aAO4faA7MS+ZMNBqZCZ7lTGC6TvojqqBAN2yX7
-AnnYpZHM+lGpi2/ukVzLqSkGmdNOgbu+UZvoej3YnHYig4yWP+z2xrlJl8bkhU/d
-r9IQE5aRCEPB/JWhHJ2/GqYl9qjshlB52+6X2KDarwptOtzT9ooArYhpMwKIYh34
-c7X8tlAKYk7V5j7txIRFDKKAftC7dM82PntXJxSkWyR70GYnYjiXyrqqerqT7xIC
-mDEQgFOPpy09zFW62paO9uiZw6qwybwqgGpoX7kCDQRcW1TbARAA3ERo2mPv2VVg
-ZUFr4MtPDm4UG00YJW/LYa3D3k0e9tdSScACXprk1sAoxUlQx/CSdErPKwXG4rax
-iN4t5nICUUNYSC0dh09G25jC7nwsWc0AYyZu+h/FzfvpOm3fBwmBlzILlGh0URwH
-Ffj9fHt6hos4C+3PFZZ/X24aMJF/cov1oYi9rqFwt/l0mgtPE88Iyj2/Vp3Lergg
-QMzKfEuyluj9fL2cgU0Qa7oAPXmaxhHtua4cvbM5SXGo3FXjIgzH9OfM+2orebeN
-wH1M3ec6w+nPmRmCJLvPKGOeS7GVXL5/aOyPlDWzSXYnpCKS2ntw4K4nt0IA8n8z
-1db109l/C2noDrDSJEqOo843ShNGTYOMVUrj3a+Y7o2ATc9pNZalf0PwnKas7NDb
-IJ152PEQw665iYXcv2awjLF6W0yuSq8kfiaAxIrsie2Dto0zgqOs0Ot9Y74u11Hh
-wBSHUO3mEZJScAAcI/yDF2PvjvCQSzu4mdXb77t6X2O6YHULz4A7bVQCMazcTDI9
-/S0W2+ixPnnJVnE3xgjK9zuizji8JDJw1hJCQM+yTLVqq9pfvcRfQ6uwpMRzz/O3
-S0zDRiA69/GyfNwkpgz5QaGpY02IK5WrQU1doRjIz4BHAYzoIOkMkRqTtjdElQZw
-/D3wSO2uwsEMNwRzibR/Lz1JF2aGn6EAEQEAAYkEcgQYAQgAJhYhBK4/rHlnEexZ
-/AB6pHS7a5pMuz04BQJcW1TbAhsCBQkDvSEAAkAJEHS7a5pMuz04wXQgBBkBCAAd
-FiEE1wyE5ktVjlvM7AchMuIXXx11eioFAlxbVNsACgkQMuIXXx11eiqCfQ//SFDf
-rOIEoslp6n6vlCuavOg02wvjskKQGP1P1Q4v40Fw1Gl87n9uXAoMpeF4H+pzUxOi
-BHYCQi+EemwocSThzaWfPzd3JG/0OcRymf+ZOcBb+58VJL7p88QdMFIAi5J+KMuA
-fEG0zLkc9anEnXoVMmQJX5K+6PyeVDvBbYGjLjQAsWTZTiVuQI0w3WxFtDGWqQII
-8e/qE0DA7c/auGn7j2hid308+FcdfpmLefW9YesWjE1yYvHoCRdFOJ/7Sft4MQCI
-Re7UET3TRMBvtisP2DcqyzGPp22s4ZYFCCJJNiB92bXdEl5zXe4Ff7JTfNE/QrR7
-Wg5R9hZHgHdbp8p8bA3f0y29YCx3puYg7BbmQWiMh3rXWE5b090pSpw0K9BQU3vO
-irr+5/2TaFOJXHl4VF03GrWsSncShCbdsdRIv4TB0lY2mN4q+e7bjlAzJJeoaS97
-GIqu3DBlAJyx/ZwWW23DXXwoQ4jNuJhpl2jaCE7rVQB0uLjbp0i9Zdd4SdYZxmO/
-Y+JfgoJz8eyx8wZi4eDz1ijN0WKsIGjxJH5VUK9STjijDMeG6ZZRLc6b1QCGhe97
-ZbDkEUTdQGoeu4L5Fiqoma13NEsf8ofBDv+myJm/O67Va9JI3gxhIrhmF7LMzQQp
-lYx2peZC1CmhEnn83dtt83mhXvX6Dth657BW/Qd+GQ//SVuTPuNkBXfrTi4dbnv+
-cU6IsoIBodTF/WsQ6h4kbtsPhO5DbrsLNuNumrqVEN8jw+HUsEeNvFNeMrTPdG2V
-87ShQ4BQGkCf+GFRBj0myxxXOFZYQx6RpY5fCe7yOcTzpkbnPWmm7V8HdOuZ0NnL
-JNQ5YogOI6UvXVKv35R9qBo+G9jkhhb0eaAu6BERzKVANKfsGN7545ElZ1qlffMh
-AQhXGb6TsvCeSg2cWGb2cnVL2d58uVukD4PDiq4qqwgClkF3bOO70SIgGrCteHbi
-4Hseopex5m6GqqjoUYXr7QQBwSaQdc+gKtEjMHCsHbUyHRk0qEHdEe+2RmL0d0ra
-QMJfKyYQjcCR7tnrgN4WD1h4NKRdC/KRW31MDmH9XVPrkOMQCUCnArXkOwdKWsKf
-h8af9HqweXOT1FHJN/M3tWaBpv6KoduF2f2pj1VhPZ2EqFUycJ26lrHyOpsynQR6
-+TD+c1uXotDwKN5RW+YL1cydk6mhib64fdOyPUeTcHehjMAFgM2f5wi35Ujcj8id
-37cWOqRsggSbMnGO4AUA/YtcVNG8TjZbakson8ENK7e8q4sEiNFUZ7/CtzNokwHQ
-5uOG1+qB85Y4ImGnIZVeiBpjt73VVawg4Zvm/omtW50P9R+4rVhMJZZFAgrWg8BH
-H/KNznW0vUuShG8B+2FA/eu5Ag0EXFtVDAEQAL5ftI1GgVJEFgX5VsuFnfBnH95c
-zqmwEXaTP4s7Xm3O0Wy579EzRUD1eEw/UaD/q2OHScwvMP65cZYQ9w4hnCN6H96P
-96Teo7LOMCssvSXIO7gqP33LKTqDzsIoAFHwWE3dq1jbyP6T1Je85mr0Edvk8kOC
-B1hudswAARno/7X9zGulhhwuEHk5Iey7R59yRUQqBctdNcetGyaiFjjX0evuVADi
-/z/s07XhDLDt7+3Vglh1/7XGC64QhB9QjZ8j0u7+0xfmLLjhi+7EpkDlAHIJXX1H
-0wAsPOGKlYruQUmIsMNfBINZeulHEBZ4cAd30xsM296DzJ6QL9sAGfYMhRs0YHB/
-EJ10Zv0iw1pU2jCCUv/9Kf4F4nwgHQWQP7JAbfhOIUOUq/YlxjTLnkd25+7vD3KH
-NQ6UiRDROR9Jwetpd/zokpf5O5iTBpVL+sCq+NsTZyDOjITve2sY0V8v10M+Z+pL
-cp/cUZ4JEDS/WJ4/ovBNJP8b+YwN/RBgCjl8UBX/N+e7AA52eYP2H9GK9XPkzSCE
-VxEf5PyjGrwedpoLkzagrHsDuWo3uBquLyneT/ozihqKQAuInUy5B7rWU4mpKHe5
-Vto5o6Zuj+6MgHgIQzRK6Da2ziMNEmroxwZibcYCtUPdvcvxGh+byclnzBclKjOw
-kAalFPx0SxEbHmzPABEBAAGJBHIEGAEIACYWIQSuP6x5ZxHsWfwAeqR0u2uaTLs9
-OAUCXFtVDAIbAgUJA70hAAJACRB0u2uaTLs9OMF0IAQZAQgAHRYhBK7WIv4CB360
-tcFGwUKiedJIzcMQBQJcW1UMAAoJEEKiedJIzcMQH+cQAIQYXDnqi4Hl21LtAgky
-pZxug+x/LECVlwkrIfaQF337+fG+H9J7SdU87Sn1Xe/YUgQnF0XP/fjIVFM0e/Tb
-xVlmTFqiejLnIwJJDgUaHO3POT2sGEyO3tc0mqSzyRBxtMQ8yvApccBhL5QODv3h
-hlRWgk5MXU0IPeXw134IWm+o/PRiPBoXPawvVfEVIBlUFaiSZASf4BAiSad4aJQe
-P8PyP7FPvQB1xiib0iSetn6ZmNeN2OSUJPiPA8aE9JCKuFtomVQEDM0BqQDl5A7h
-5O2uyf0Li+/ArqBvfBjrH03e5zbID02dO3D2BjsV3jUeVPQ5WDgVg8LH+nfg/rRy
-wfCsx9zFp1mt3K4xN2v7IKwxGndApgCcx17gsjzMvLz0J7sSGov4MNjzqvGEDKCl
-uUvNKXqy7je9xcQLpoyvWtoWFXWTbQAcK5Vv+hC67r9bHpjI1KuqA8hYqNKxsv7s
-wiLZdd4SK9SIuwf0j8/XTZwmoFfGolJil0ZNxyqBF39+CMVpaHdLM1qKZz99TVzS
-h4obOOjkUjK458xSo0XCbJ4qXYp7PgxyWK6GIbTozbbG/1ldw+LUnqxt8Shf797L
-J9lbI3ICuR2P5PYlKJf3b6D9GyfqyrP387fKAKhHsYkZ1XD54/8wIgTrdfeNPtL0
-1mjWDjw5KvO9kuPBjcmzgt+NrtsQAJwKeZsiqLLcY8kJ9xP+/xtTlh2iVuZMfxwq
-hwlo4MMCzpobLDZ/JKU398m77eboTKJSBfeUYxQd4ATn1L8NLKjLxKAaBkjEk0nN
-8w9OUQbFlhQ/asLzzF7Z9IGGh9/SEgBZ8V67a0O3Qw9Xdi3ARK3bbZ8RIVJ0+P9G
-CGrfq9j4ZmGA2L4irLjsvDAv7CSMb4WBKW8j0Jz5LFMwOMJgG1TT5c6lNqFj6y09
-rZcVLnt8+lUv2Bw3LC0oI1TjFkrrCzIdfg++mPi3K/ZFc50bvnWF4eCOjgZ5U9Vb
-sxFZq3+vTRcIfI9z2lZ9CNDRA1O5jGvuVtEGLiSLF2aJ6kiNriLuuGTlXfg/Fpgh
-GTvyppOTzF7PtHzHBQ/ZjnhWojnc/jyJRwLK8cCl6+EOc887v8BDmqgFWtmycsE2
-5fDJ7UFGP13g/eDL3ZUgMDty5dQaUOTX145t2KT+lMqpY6ZK2EC+eoqrnIGJ+tYy
-0l4RRxi10mbNhuPIIDdph7X+mUHgCeA9gyF0Y+LqiB6CX+zFg7ovLvnCbMPxdGXq
-z7AjfwqZBKI+BVuBeDtyW4onmElCu5cXNKsg3W0IlQlZf9PMDU6Ht0XLUs7EPfbQ
-sH1Vqi1XE1W/tGnkmjcpG/qlt9Gx1uwFGLP6iomqUBc2c0GZ6R1xplXvd3w3yC8d
-8lAgPGImuQINBFxbVToBEADkuxhQx9gxlzzCc0nUu2v82XsD+GzONp9irt14gslx
-te96eKaTXTi0t5eya0X5TIY3wbREwjlfAeM9AfcAmWcsM4izrfPtANM6WOxB2Tbz
-EY2cqv7NBQii7Z5aqPyjcIiT0b0Gs2evlDkn3xEBBqTSrNcnGSA29bZPIkaUb7Qo
-p/Ani0S3/tgcR21gXsJwkgpfNKwvPT03Lz3/o5rXAyag0M/25adgk9SVKNcXc8h2
-HSGv5ENjwUKNNnowVbNLw4287mFUM2Vd6unGJ2MBj7aUwTrfBl7gNV96mMdDJWcB
-hGKYkxUvibuHCa2KH7gTrnV6X7sdrgD5CbJMPq6OZNSP6n6bUVg22eHxoETplFwT
-4NvV3clRMWIAG1XgXR1l99LAh7PPnPMM1pHQGPwYHQskoBFS4g5knzHpB9h9TfZ3
-MM4cDZR5NgWmE0fYVnWe5ax+wW0/IOklUoHv3qoL4yiN9wFJq2oLzUNQd9+tsqiy
-vxSTh8iYmHegyn5KuBPsrMPgvqiKOdalTZKkak9DOx4cGQL2qHspKxiBOb6uox2v
-fjMQ5bDeUn+4DYMdnZNHeywCUegJmDakUtlfvN+136IDHGwfdGcitqzswzd3+PI2
-qlwPE19gkrp9NUaD3Qj2ZtDP7sU2cThc6Gra5KRFW8f98bI77j1Wu6pCnYFLqPz4
-QQARAQABiQRyBBgBCAAmFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAlxbVToCGwIF
-CQO9IQACQAkQdLtrmky7PTjBdCAEGQEIAB0WIQR5HX64jryNAThDSqwz3zWa56YK
-eQUCXFtVOgAKCRAz3zWa56YKeSWOEADK8u03LESGSQlZQqnnCAI8iYs1s+XRMEnG
-2tAQ1OK7/4eNgr1yZckmaW4FBMgeEgYIBJ7v3SlW7Hf7dE10TYPNGbP6UxVW8HIP
-rA4CINcGZXWWwpS374JNMS6A5eb6viuEgEMEi00jx0MmLvCMZKypmwXQUl5YJ5nB
-ytpQ1681mCQxGBMhT1eKQt3B4nAsoEnP+HnqVM/nKxBemSBNXX+C0b/YeQoLC3sD
-L+Z0NRI8U6PZl9Rokod3uynH0vfBYCEJd6MvsjtnJlVVaseYIA3ESNrFG12tw95I
-wKNrVCANZ1DBSyK4ovmmWsDrH+uFTHSLNjlxIuVxUfmXcLfgcepVCmd/7Z7UrWYr
-SXSvP0VG4ZmEPE7tNb8bfyADftO1cVsmcHBQeSrgvpSrTv9L8MocojpR5vJc1f+a
-sBT7rAeGzZP9riz1GmryXawaZgdLfaaJfzRQkc1uTChb7kMN+UMhVUdCAXmho0XO
-SfcsW84u/LpjdYh2Ww41xQO6EWvbZDNgD/Fdmp8Uh1MqJ1Dejri6kjNn6wPImXJd
-Eu6nHqWDRdYsfT4XUB18tB+4aIpFzCyIgpf7p1uaVU7Oqip5sZkc/WXKr77lV23m
-PQvpGRNCzgU2TJY7ktR3LOvUVN6wNfLMHzeQk18NdmcEGUrJ0YYtl9vE5/Eg9L6x
-LBH9PKt17IQ8D/9DLwQX8pl3fuTM8ZbzIPLxiXhbgzBBTXKRE2u1888+RIq9xE7c
-aVFjwq4qpgqZ5SFonTcG4Pi5ck3mFAzyA5zLRF+ckpmBpwSPMpLwCpv10369D1jh
-AF3JsUwt6DIb2BISMhh2ThSUMSKO75q8GSotsKjJyjD6vl1x4L7WXubTWxEiNuwD
-3kAjFWS1Z1VWtA9SURWAbsDaCV4VmwCCpSIwRr9OTbyu9XuMdMxGNpl8SwW7MVQb
-x4aYNvR7Hl/wIR71AHAXoSfrKp3p12anXjYYASHmbm16ugP4H7HLMBfznKet2f76
-gIxJr1CsAMTSqypcC1UoVb6Gz8djeIR+GU+6efHI4TIUMy5uMIUx8tYbwSEeo/y6
-NnjpJFYYjJa671iSABInNxs4+X+1zrFa+wl45EnaFxziEet2Qzv/VsusoLvLwnYi
-BZckclAS5xoVGFW0WJ01OfLUDHxGMt9GSheL8c+GLMaMtaCWunpmmt9zZ9WdpBOu
-AGluMG1Cee50TrhXaGE8CdNr8nOdSeLNAveBAPmuVa0JDSe20/D/RuYJLKeG9Vsq
-BZvjuGlOUsfl6UjtiGRbgS9OWpxeez5ugc9yyV+rBGIpmnIb+9quz2HmGxE65eA2
-cRNsZRIjFLzeAx/0RMaT1nlLFTBbUuZ+tJ+fgFtRGMhifZn1pb2dMQo0N7kCDQRc
-W1VuARAAv4LYaNq2Zev/v7M5DnxLpgHRcMkG7TOQpycrlK5653llpZzTy3mh5peW
-vcq3IDmdeUIJxQ+WDh2f0vS+NIKDC/HAddfHrZPbhO7zLxLcMW5KmV05ancaRSP0
-s0+IyQmvVxUNrgPinZiphlvRGoLXS6pdgfc4jIR9B2umPecfvfu/6EWFPnXZgG8K
-yY3Z+mwrmEO0FaXHBQuu6nactiPe79N4bLe8hk9RW6yIxLBeJzIoOlIcJmuRHapt
-nS2lV3mfhZdFnkAp1o6a2TL5BwgMY0wZUKZr78HEMKh6LbPN9rPepf0neUeq/k1l
-NJU7V6XMS+rezF31vgSJ5KoNGYhxtWZ54uksH2rcw7+ltpSVtqY91G/vibpRCJG3
-LdX/kxHni1NEWyZlpS/6ntuH6HSoNYsR9IMsbESs3QVCH74ApK88CxYCRB0SEo0M
-yAElbQ3bfEKCKl/FwC4IzAYAJ2arWKwBHRSJlsrNCtczrjG7j3EyJrn8+Tm5yjO6
-0THQjvc/nBxrNE09r1Lzz7jrDWC9Rl+BH6wqdniymoYyUAQsX2rZ+Jhah1Zkf+Gu
-76qtY+EH494dPM+0FazcBlgBd6/J5mh3Wk9JuecXLTEUGtzd1GmI9CENPAklCauX
-tNOWeTop27djuKWsZxuP1GyV6UYixFVOSWteyAbA32cncVv/2ZUAEQEAAYkEcgQY
-AQgAJhYhBK4/rHlnEexZ/AB6pHS7a5pMuz04BQJcW1VuAhsCBQkDvSEAAkAJEHS7
-a5pMuz04wXQgBBkBCAAdFiEEFWiQaF6g32oTce8gF8xdsfAIhAcFAlxbVW4ACgkQ
-F8xdsfAIhAd4jxAAiO9+VRQQ3eBOsJRgANdgL/l51kq7qE3u8xnSqNkrmdYDdT2H
-TYH5W4n2AmGo50BDafdjd6tut0qtzA3/hGWCooydxKFOsnIYziUeoHvlICj3RkHO
-y7utcFhAgRWi+kzFwnnXGf13dMU9iG7yvKrCrCEw44gzoQ1KnY1Xsj18n5JkqxeT
-94bzcSbz20OpOSIMfSQPrpy18WrZYwHodcIZ3IUUACCpMZdfTa9c/qHRQ/rcwl+B
-0JlHx0V4AYiSAsiMVgflO1Eqi7apPuwxPPd5nnHkrdDM9CYC3LdBORBXwncG3oZ5
-eTSXmsvFxHXH41JHsm/1QFcVmFAYhu9qJFCGiD+8UeTFtT+nnHU69BszgtUskqX8
-k9PqLdK7Vxkp16wc6WOp1NeIQ6Fd4PxTGrPqs9bJk7TlYtTFWpA0X+EMj/San+Ku
-PxqLEa4Ab12R4vs1pCrn/g1z3C/6ujH4B70HOrRTIeTjULJ6xdwXGtwUA09hio0r
-pHhtyZhAh5irUJNto4ZOk/Qyd+dfMsNvRJfbVIK2mmeRaBnp902AsQNgYVdi2Aki
-0h4kz3bVLGw7iD/xV2hV69+JwLSijkkmOpz/EjMwj0hDDYrHH3Y3o0dV3dNdk/5i
-6lQgcxSVsl9kWlHcoEllKbf0Hb1muKVwoGGYxFYna2jsLFVjG29M7iPSgrHjmg/+
-I3fmsLZ0VI9kmxniUlZ6gz5NB5PJ3RXmwKO9LkBgE5C1wpuZbNEQ1NsR2bprlJPm
-++GNSo8HaheuTRJn42kkOgfIJwjuvXih3FE/NtRA/W8H2uF6YLDjBKGZJbxQcmsd
-CTEuCRCVP8X7C5n3rl1YqzfWfNr8QFxvH7ivG7KOlSxvyTKcYatWb9uDUPrnr74f
-ZaMljHGsNyKj70MzZcrrsmt61yWGR0h+02rmIKlskl4hkh+qF5ehI+Bkd7eblsBy
-rxEREHq/ij2Vd7l0Z606YCE8vj8WfcsJj8JjwR3A+nND/oNJTTbQ3b8OvasvqIey
-WqqmGg73nbHjd/VIAUsfvnsEYatDk4pAA/wQr9c4T4s5Q/QRwDrAsa4J89FrDjWC
-hQBPL7TaP8Af/3Y3/86jLCN4lnW1qjPXv5rhBFeI0EVi1k1qdV06qr5HOk7CwQTT
-uc4rCdFcEnw8kVKZa/yFnlJfRa0Z4IwSahdp5fdFEuad6LpOcFFnYxWtIWhcg4GT
-RcMha/OZnsfqOqiAt6In+1IwuJBz3uMM7xw2AMaxzAejGEL63F81C5iJ6Ld6kQK+
-XblDW0G643bVbzkBb46MAT+UnLuWQUs3NDtk1FEioJyWUgbO/srMH4MoWM7rG8ZT
-nQPohNmPBrqL2phmE27HQsQ0rTjH2Z2ol7iy9OFMtT0=
-=MkGo
------END PGP PUBLIC KEY BLOCK-----
diff --git a/codesign2021.txt b/codesign2021.txt
new file mode 100644
index 0000000..d021b56
--- /dev/null
+++ b/codesign2021.txt
@@ -0,0 +1,534 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBFwq9BQBEADHjPDCwsHVtxnMNilgu187W8a9rYTMLgLfQwioSbjsF7dUJu8m
+r1w2stcsatRs7HBk/j26RNJagY2Jt0QufOQLlTePpTl6UPU8EeiJ8c15DNf45TMk
+pa/3MdIVpDnBioyD1JNqsI4z+yCYZ7p/TRVCyh5vCcwmt5pdKjKMTcu7aD2PtTtI
+yhTIetJavy1HQmgOl4/t/nKL7Lll2xtZ56JFUt7epo0h69fiUvPewkhykzoEf4UG
+ZFHSLZKqdMNPs/Jr9n7zS+iOgEXJnKDkp8SoXpAcgJ5fncROMXpxgY2U+G5rB9n0
+/hvV1zG+EP6OLIGqekiDUga84LdmR/8Cyc7DimUmaoIZXrAo0Alpt0aZ8GimdKmh
+qirIguJOSrrsZTeZLilCWu37fRIjCQ3dSMNyhHJaOhRJQpQOEDG7jHxFak7627aF
+UnVwBAOK3NlFfbomapXQm64lYNoONGrpV0ctueD3VoPipxIyzNHHgcsXDZ6C00sv
+SbuuS9jlFEDonA6S8tApKgkEJuToBuopM4xqqwHNJ4e6QoXYjERIgIBTco3r/76D
+o22ZxSK1m2m2i+p0gnWTlFn6RH+r6gfLwZRj8iR4fa0yMn3DztyTO6H8AiaslONt
+LV2kvkhBar1/6dzlBvMdiRBejrVnw+Jg2bOmYTncFN00szPOXbEalps8wwARAQAB
+tE1JbnRlcm5ldCBTeXN0ZW1zIENvbnNvcnRpdW0sIEluYy4gKFNpZ25pbmcga2V5
+LCAyMDE5LTIwMjApIDxjb2Rlc2lnbkBpc2Mub3JnPokCVAQTAQgAPhYhBK4/rHln
+EexZ/AB6pHS7a5pMuz04BQJcKvQUAhsDBQkD7JcABQsJCAcCBhUKCQgLAgQWAgMB
+Ah4BAheAAAoJEHS7a5pMuz0476oP/1+UaSHfe4WVHV43QaQ/z1rw7vg2aHEwyWJA
+1D1tBr9+LvfohswwWBLIjcKRaoXZ4pLBFjuiYHBTsdaAQFeQQvQTXMmBx21ZyUZj
+tjim8f9T1JhmIrMx6tF14NbqFpjw82Mv0rc8y74pdRvkdnFigqLKUoN2tFQlKeG+
+5T24zNwrGrlR3S7gnM47nD1JqKwt4GnczLnMBW/0gbLscMUpAeNo/gY4g0GV/zkn
+Rt91bLpcEyDAv+ZhQZbkJ49dnNzl5cTK5+uQWnlAZAdPecdLkvBNRNgj/FKL41RF
+JGN6eqq3+jlPbyj9okeJoGQ64Ibv1ZHVTQIx5vT1+PuVX/Nm0GqSUZdLqR33daKI
+hjpgUdUK/D0AnN5ulVuE1NnZWjVDTXVEeU8DFvi4lxZVHnZixejxFIZ7vRMvyaHa
+xLwbevwEUuPLzWn3XhC5yQeqCe6zmzzaPhPlg6NTnM5wgzcKORqCXgxzmtnX+Pbd
+gXTwNKAJId/141vj1OtZQKJexG9QLufMjBg5rg/qdKooozremeM+FovIocbdFnmX
+pzP8it8r8FKi7FpXRE3fwxwba4Y9AS2/owtuixlJ2+7M2OXwZEtxyXTXw2v5GFOP
+vN64G/b71l9c3yKVlQ3BXD0jErv9XcieeFDR9PK0XGlsxykPcIXZYVy2KSWptkSf
+6f2op3tMuQINBFwq9BQBEAC59lflbMmvSVkCHFoakdjokwGviNU4I/hOsNmHALYr
+gJc0z88ss2KxbOq6JZoW9QOEHz2QLGsSGKnBUViEGvXoINDGuvzKFqHdEjGsExiF
+FPGAgCQA2CSEZZ8MlITNdq4DuSti1LetjCF9d7hw2xOQs9ucxSXIslyqPbCdlxki
+33tov40VE/J8jDUp9Rv27e0H2x4Nhu9MRQt4vTtpOcelYzl/dtPAmsnY4U/Nex4I
+LM+JU2HcG/5i0nWkxOtz9Qc7kOgm4cuwXTCJw9KukPS3CykV1H/StPp43JyxoK1X
+gZDMFww+9jupqLletmYKqCW6jVbqXr4Xlisq9Ey3LIWRQ0Zw/LB2NKU/jgnJGtLa
+7O8VRWJKwkCtyYUbZMksKiGex7zCqPDR0hRVuYNsTjONobnrOS+7ST7ThbCndc+A
+5mtuXpxuFffIuG78a3R3N30RF6g18peTfaEHMpqz+914HkNl6Ns445Zh+2rJkLUu
+8O++tgWEUrpUajN9nosWaXWHOf7E9qGnm1G/3f9P3Nd5U+b3OKUYyqb+CNGCHyiN
+bE1Cg3MnKpM9Yi9aZu4Qg/dPdxMWrqUmkmyDf6x/Oh8ZZkIacFlAaqbysQ6hRaJo
+p7UG9AJfXHynj/Hz+1dNpUOlAIairFe3T2mWQO4Yy6IMgLEGVodZRHaMugdzZwus
+HwARAQABiQI8BBgBCAAmFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAlwq9BQCGwwF
+CQPslwAACgkQdLtrmky7PTikHw/8CZ+DnggV4AuI86spuMLdtUBDOux/T0gvyxSW
+f8sJkjH0eAYAmP9/flJDfmwra5yNaINfqoLFWtaYLpxpBcWBc4VIoiWqVp2aaCPi
+wh0sznCPiduiYcKGkHmupX8aCQXBYFDeQ8Jq1e9zwGD7Mon7BeBO48Vd5/IT1H5I
+u5qzaCtD2ECO9MYdhuqJjFKU0MVzVocsBDdtLvrfnUwe4wc6kvOgHQ6RkMJU1bgY
+0Sqstsg12vnREAr4uihnZQEihsRmNdiiv0DYVaRK92PLPpfVAox1Axq2HpH3WT87
+RpsFruXLj/zTl4AZczfDVd/Z4yWmJSzr0F5igkGSUrxo0ye2kNES6cmOGI9TgmgP
+NLGXlC/su5fKXKjRgkD1ibJ0qFNNxF3Cwpz/+cav9ySDgFGX5Vu0kFi93fEYHshD
+6lP9M5qS/2oKiykCGvcRCNU/9emdYlF37H52rxRerBaZN6dYMTjZw2vsEMUl06pL
+llbLiwjPix2OlLFcwH3yKJG0pKkpEImBdJwHtJh5uHzfkSAbZjJAZ2Ekw7sLqiT0
+85hAGovywGpHMiYkqhNUO84fjZYCsrAlZMdriY92IMcQhmWQ416t5zcle2Xgx+/x
+zBnktvx9KIH/HwBa+qym5z/uFC2S6zhNyC61LV/CEDCmcUi2lUXr7vcIxCsmxuUF
+1ONbRP65Ag0EXFtUfAEQAN5tk4luE92Ed4E92VlgTetGMHyxwOlZ2OsK6l+Z5ML0
+wzomAITgMQwG0FeT6HX7vB+luVhg0XAZUW/K0bme8ZEO0dbHB3Vn07wXHhmq7QXH
+/ACftkvevIT610dHskrtIvE5rZfj1P/wtjRTxDrkjhlGj9vhUxxcCkKadzDdBJGo
+dP+Zh02d/4cc++LePNqZ3eJWm0JLghqKxzTv0MV1r6G1ZeykFzXeWY+La8ZCRaON
+LcHjI7wlpyTJA9WGmyAphtEHM4fQqKLxtebIDo7m4glgR12nlV6B53gUT96PcKuA
+Y/UPRiTV6nHyUtuL1EGTAVLsMDmtDbdSdtLLVbJXVmA+tapABa4amMxNVNY3QSUj
+cAbECcTyVmVJfIT5fJW4eOMhWtrIGMspWoO5It0pl4K8jhCzIcfoXQ0olCSeC9fE
+tljE7qzRzYQUUvN1VZPVX0Yw/xSwOutv4mxmNRWY9HW1M/jGoRAboqN8WhCbldak
+a0XCH3U4rWXB/8HHb8KP4+q4ssVyPuEQ/v1UNNRk9AB25NPEh5PMdcf7HU8IcUHX
+THEfd7zZVJ0l4FSsnGeuJfMrnRIpNOYX65ikeoTwmDU3ZjWfmSy7F5hTLw8WOEB4
+EKpnplyV1QN/j3317/M9PxvB8IOvyNF2okeurtHFMmI/lGwy51akp6iHMkbBDm5n
+ABEBAAGJBHIEGAEIACYWIQSuP6x5ZxHsWfwAeqR0u2uaTLs9OAUCXFtUfAIbAgUJ
+A70hAAJACRB0u2uaTLs9OMF0IAQZAQgAHRYhBJXO2iVrHKChXzAvtZUhp+1drOkY
+BQJcW1R8AAoJEJUhp+1drOkY94wQAKb2fED9Up/xHEOjZm5ODK5LCVHy0KMATiTf
+5SiJhRtqaRbimPH1WB3XMLls3FJZnm+UngIfwCsoWo0rksFUNmqFi6t4Cj/UB/Zv
+29EnDT9BAeG5fP+Op5PDCsu4qnLv3oam35oV9yZLRkLhBd/EkRGEA/q27WnpiYCx
+Jv5uPOJBWQqu32aE6st23PpY/QWDWOhGPfcWCecu1rIe+2BCs0UjfO0KOT8HYWNh
+nGpsEZ+TmDKjRxMTYWKguEb9evEihl6kUwmQZgROdhBes63Yq4ku9rBXvRhCYbwS
+odhjx2soDRcNmzxNV1Ply8a+2bwRHPnOeyyxEHFAwjkyXo7ZqGtenwSriG0LOW87
+y3Yw63O+oAlGLIB3psBSj4wZVGme9485HVICAFcJ3jXqsXSIJdzW61nGerB2r2Qk
+Bn7yYIvHg3iOToB0alfNw2QuDtCZTNefvlHFnoashRhkk0yWzBerleFJbijx4+Vr
+FaOH35BO1T3rgBmGkDW6gewoZMHEcmzTDoxxmbXiRvY+5o7b+ul/yzwhnJz3f5jk
+7+Adnr9qAGMD2o3rCRBHV3lSEkLhBL+bfmsEYEor1fd+pDFoEKKjpDP6bgDcZyGv
+O0mmr7Y/6ZrnKWxOrmNXieOTLbpY22tXv43QLgyiPcjhCfphT95IxqdNfMfOiI9k
+IQf8g7GBciIP/1mbdnMj6Hg0J9IbI/XX/DWATOVMdDhq38VcggOHRjZk2lY99+4V
+Au1wRHa/Io/CENikYzI00deSzhrN+tdUK/TCZI0Ft5Lykmti2ilmkIQGsBuD9gu/
+2bmWkNJEdpHeC/+oxntDFj43CpyKpPAarrw+4XiYNK+1+4WZsQRL0jJuKJ754v/o
+NTaSd8GOCyFR7q8SVH4tig9DjkZjYjFFMnWkxdpnDX56/AfdS+x5EaRHKCJoGChT
++pHimvKe+MxBxpwJr4JpGddklin+6xUF5jTG6322hz385wsagGvmH2XliOu47a+7
+xUei7w3S1qtVCfdhtBEWL5i021yVYlrw+rUCwpFMIXAPA/p44O/qY06sQXJ01Fym
+JCbOnjtVYX9gdF8fMKoDXAcvEtSulBNpXDongWp50BDfVoA7h9oDsxL5kw0GpkJn
+uVMYLpO+iOqoEA3bJfsCedilkcz6UamLb+6RXMupKQaZ006Bu75Rm+h6PdicdiKD
+jJY/7PbGuUmXxuSFT92v0hATlpEIQ8H8laEcnb8apiX2qOyGUHnb7pfYoNqvCm06
+3NP2igCtiGkzAohiHfhztfy2UApiTtXmPu3EhEUMooB+0Lt0zzY+e1cnFKRbJHvQ
+ZidiOJfKuqp6upPvEgKYMRCAU4+nLT3MVbralo726JnDqrDJvCqAamhfuQINBFxb
+VNsBEADcRGjaY+/ZVWBlQWvgy08ObhQbTRglb8thrcPeTR7211JJwAJemuTWwCjF
+SVDH8JJ0Ss8rBcbitrGI3i3mcgJRQ1hILR2HT0bbmMLufCxZzQBjJm76H8XN++k6
+bd8HCYGXMguUaHRRHAcV+P18e3qGizgL7c8Vln9fbhowkX9yi/WhiL2uoXC3+XSa
+C08TzwjKPb9Wnct6uCBAzMp8S7KW6P18vZyBTRBrugA9eZrGEe25rhy9szlJcajc
+VeMiDMf058z7ait5t43AfUzd5zrD6c+ZGYIku88oY55LsZVcvn9o7I+UNbNJdiek
+IpLae3Dgrie3QgDyfzPV1vXT2X8LaegOsNIkSo6jzjdKE0ZNg4xVSuPdr5jujYBN
+z2k1lqV/Q/Ccpqzs0NsgnXnY8RDDrrmJhdy/ZrCMsXpbTK5KryR+JoDEiuyJ7YO2
+jTOCo6zQ631jvi7XUeHAFIdQ7eYRklJwABwj/IMXY++O8JBLO7iZ1dvvu3pfY7pg
+dQvPgDttVAIxrNxMMj39LRbb6LE+eclWcTfGCMr3O6LOOLwkMnDWEkJAz7JMtWqr
+2l+9xF9Dq7CkxHPP87dLTMNGIDr38bJ83CSmDPlBoaljTYgrlatBTV2hGMjPgEcB
+jOgg6QyRGpO2N0SVBnD8PfBI7a7CwQw3BHOJtH8vPUkXZoafoQARAQABiQRyBBgB
+CAAmFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAlxbVNsCGwIFCQO9IQACQAkQdLtr
+mky7PTjBdCAEGQEIAB0WIQTXDITmS1WOW8zsByEy4hdfHXV6KgUCXFtU2wAKCRAy
+4hdfHXV6KoJ9D/9IUN+s4gSiyWnqfq+UK5q86DTbC+OyQpAY/U/VDi/jQXDUaXzu
+f25cCgyl4Xgf6nNTE6IEdgJCL4R6bChxJOHNpZ8/N3ckb/Q5xHKZ/5k5wFv7nxUk
+vunzxB0wUgCLkn4oy4B8QbTMuRz1qcSdehUyZAlfkr7o/J5UO8FtgaMuNACxZNlO
+JW5AjTDdbEW0MZapAgjx7+oTQMDtz9q4afuPaGJ3fTz4Vx1+mYt59b1h6xaMTXJi
+8egJF0U4n/tJ+3gxAIhF7tQRPdNEwG+2Kw/YNyrLMY+nbazhlgUIIkk2IH3Ztd0S
+XnNd7gV/slN80T9CtHtaDlH2FkeAd1unynxsDd/TLb1gLHem5iDsFuZBaIyHetdY
+TlvT3SlKnDQr0FBTe86Kuv7n/ZNoU4lceXhUXTcataxKdxKEJt2x1Ei/hMHSVjaY
+3ir57tuOUDMkl6hpL3sYiq7cMGUAnLH9nBZbbcNdfChDiM24mGmXaNoITutVAHS4
+uNunSL1l13hJ1hnGY79j4l+CgnPx7LHzBmLh4PPWKM3RYqwgaPEkflVQr1JOOKMM
+x4bpllEtzpvVAIaF73tlsOQRRN1Aah67gvkWKqiZrXc0Sx/yh8EO/6bImb87rtVr
+0kjeDGEiuGYXsszNBCmVjHal5kLUKaESefzd223zeaFe9foO2HrnsFb9B34ZD/9J
+W5M+42QFd+tOLh1ue/5xToiyggGh1MX9axDqHiRu2w+E7kNuuws2426aupUQ3yPD
+4dSwR428U14ytM90bZXztKFDgFAaQJ/4YVEGPSbLHFc4VlhDHpGljl8J7vI5xPOm
+Ruc9aabtXwd065nQ2csk1DliiA4jpS9dUq/flH2oGj4b2OSGFvR5oC7oERHMpUA0
+p+wY3vnjkSVnWqV98yEBCFcZvpOy8J5KDZxYZvZydUvZ3ny5W6QPg8OKriqrCAKW
+QXds47vRIiAasK14duLgex6il7HmboaqqOhRhevtBAHBJpB1z6Aq0SMwcKwdtTId
+GTSoQd0R77ZGYvR3StpAwl8rJhCNwJHu2euA3hYPWHg0pF0L8pFbfUwOYf1dU+uQ
+4xAJQKcCteQ7B0pawp+Hxp/0erB5c5PUUck38ze1ZoGm/oqh24XZ/amPVWE9nYSo
+VTJwnbqWsfI6mzKdBHr5MP5zW5ei0PAo3lFb5gvVzJ2TqaGJvrh907I9R5Nwd6GM
+wAWAzZ/nCLflSNyPyJ3ftxY6pGyCBJsycY7gBQD9i1xU0bxONltqSyifwQ0rt7yr
+iwSI0VRnv8K3M2iTAdDm44bX6oHzljgiYachlV6IGmO3vdVVrCDhm+b+ia1bnQ/1
+H7itWEwllkUCCtaDwEcf8o3OdbS9S5KEbwH7YUD967kCDQRcW1UMARAAvl+0jUaB
+UkQWBflWy4Wd8Gcf3lzOqbARdpM/iztebc7RbLnv0TNFQPV4TD9RoP+rY4dJzC8w
+/rlxlhD3DiGcI3of3o/3pN6jss4wKyy9Jcg7uCo/fcspOoPOwigAUfBYTd2rWNvI
+/pPUl7zmavQR2+TyQ4IHWG52zAABGej/tf3Ma6WGHC4QeTkh7LtHn3JFRCoFy101
+x60bJqIWONfR6+5UAOL/P+zTteEMsO3v7dWCWHX/tcYLrhCEH1CNnyPS7v7TF+Ys
+uOGL7sSmQOUAcgldfUfTACw84YqViu5BSYiww18Eg1l66UcQFnhwB3fTGwzb3oPM
+npAv2wAZ9gyFGzRgcH8QnXRm/SLDWlTaMIJS//0p/gXifCAdBZA/skBt+E4hQ5Sr
+9iXGNMueR3bn7u8Pcoc1DpSJENE5H0nB62l3/OiSl/k7mJMGlUv6wKr42xNnIM6M
+hO97axjRXy/XQz5n6ktyn9xRngkQNL9Ynj+i8E0k/xv5jA39EGAKOXxQFf8357sA
+DnZ5g/Yf0Yr1c+TNIIRXER/k/KMavB52mguTNqCsewO5aje4Gq4vKd5P+jOKGopA
+C4idTLkHutZTiakod7lW2jmjpm6P7oyAeAhDNEroNrbOIw0SaujHBmJtxgK1Q929
+y/EaH5vJyWfMFyUqM7CQBqUU/HRLERsebM8AEQEAAYkEcgQYAQgAJhYhBK4/rHln
+EexZ/AB6pHS7a5pMuz04BQJcW1UMAhsCBQkDvSEAAkAJEHS7a5pMuz04wXQgBBkB
+CAAdFiEErtYi/gIHfrS1wUbBQqJ50kjNwxAFAlxbVQwACgkQQqJ50kjNwxAf5xAA
+hBhcOeqLgeXbUu0CCTKlnG6D7H8sQJWXCSsh9pAXffv58b4f0ntJ1TztKfVd79hS
+BCcXRc/9+MhUUzR79NvFWWZMWqJ6MucjAkkOBRoc7c85PawYTI7e1zSapLPJEHG0
+xDzK8ClxwGEvlA4O/eGGVFaCTkxdTQg95fDXfghab6j89GI8Ghc9rC9V8RUgGVQV
+qJJkBJ/gECJJp3holB4/w/I/sU+9AHXGKJvSJJ62fpmY143Y5JQk+I8DxoT0kIq4
+W2iZVAQMzQGpAOXkDuHk7a7J/QuL78CuoG98GOsfTd7nNsgPTZ07cPYGOxXeNR5U
+9DlYOBWDwsf6d+D+tHLB8KzH3MWnWa3crjE3a/sgrDEad0CmAJzHXuCyPMy8vPQn
+uxIai/gw2POq8YQMoKW5S80perLuN73FxAumjK9a2hYVdZNtABwrlW/6ELruv1se
+mMjUq6oDyFio0rGy/uzCItl13hIr1Ii7B/SPz9dNnCagV8aiUmKXRk3HKoEXf34I
+xWlod0szWopnP31NXNKHihs46ORSMrjnzFKjRcJsnipdins+DHJYroYhtOjNtsb/
+WV3D4tSerG3xKF/v3ssn2VsjcgK5HY/k9iUol/dvoP0bJ+rKs/fzt8oAqEexiRnV
+cPnj/zAiBOt1940+0vTWaNYOPDkq872S48GNybOC342u2xAAnAp5myKostxjyQn3
+E/7/G1OWHaJW5kx/HCqHCWjgwwLOmhssNn8kpTf3ybvt5uhMolIF95RjFB3gBOfU
+vw0sqMvEoBoGSMSTSc3zD05RBsWWFD9qwvPMXtn0gYaH39ISAFnxXrtrQ7dDD1d2
+LcBErdttnxEhUnT4/0YIat+r2PhmYYDYviKsuOy8MC/sJIxvhYEpbyPQnPksUzA4
+wmAbVNPlzqU2oWPrLT2tlxUue3z6VS/YHDcsLSgjVOMWSusLMh1+D76Y+Lcr9kVz
+nRu+dYXh4I6OBnlT1VuzEVmrf69NFwh8j3PaVn0I0NEDU7mMa+5W0QYuJIsXZonq
+SI2uIu64ZOVd+D8WmCEZO/Kmk5PMXs+0fMcFD9mOeFaiOdz+PIlHAsrxwKXr4Q5z
+zzu/wEOaqAVa2bJywTbl8MntQUY/XeD94MvdlSAwO3Ll1BpQ5NfXjm3YpP6Uyqlj
+pkrYQL56iqucgYn61jLSXhFHGLXSZs2G48ggN2mHtf6ZQeAJ4D2DIXRj4uqIHoJf
+7MWDui8u+cJsw/F0ZerPsCN/CpkEoj4FW4F4O3JbiieYSUK7lxc0qyDdbQiVCVl/
+08wNToe3RctSzsQ99tCwfVWqLVcTVb+0aeSaNykb+qW30bHW7AUYs/qKiapQFzZz
+QZnpHXGmVe93fDfILx3yUCA8Yia5Ag0EXFtVOgEQAOS7GFDH2DGXPMJzSdS7a/zZ
+ewP4bM42n2Ku3XiCyXG173p4ppNdOLS3l7JrRflMhjfBtETCOV8B4z0B9wCZZywz
+iLOt8+0A0zpY7EHZNvMRjZyq/s0FCKLtnlqo/KNwiJPRvQazZ6+UOSffEQEGpNKs
+1ycZIDb1tk8iRpRvtCin8CeLRLf+2BxHbWBewnCSCl80rC89PTcvPf+jmtcDJqDQ
+z/blp2CT1JUo1xdzyHYdIa/kQ2PBQo02ejBVs0vDjbzuYVQzZV3q6cYnYwGPtpTB
+Ot8GXuA1X3qYx0MlZwGEYpiTFS+Ju4cJrYofuBOudXpfux2uAPkJskw+ro5k1I/q
+fptRWDbZ4fGgROmUXBPg29XdyVExYgAbVeBdHWX30sCHs8+c8wzWkdAY/BgdCySg
+EVLiDmSfMekH2H1N9ncwzhwNlHk2BaYTR9hWdZ7lrH7BbT8g6SVSge/eqgvjKI33
+AUmragvNQ1B3362yqLK/FJOHyJiYd6DKfkq4E+ysw+C+qIo51qVNkqRqT0M7HhwZ
+AvaoeykrGIE5vq6jHa9+MxDlsN5Sf7gNgx2dk0d7LAJR6AmYNqRS2V+837XfogMc
+bB90ZyK2rOzDN3f48jaqXA8TX2CSun01RoPdCPZm0M/uxTZxOFzoatrkpEVbx/3x
+sjvuPVa7qkKdgUuo/PhBABEBAAGJBHIEGAEIACYWIQSuP6x5ZxHsWfwAeqR0u2ua
+TLs9OAUCXFtVOgIbAgUJA70hAAJACRB0u2uaTLs9OMF0IAQZAQgAHRYhBHkdfriO
+vI0BOENKrDPfNZrnpgp5BQJcW1U6AAoJEDPfNZrnpgp5JY4QAMry7TcsRIZJCVlC
+qecIAjyJizWz5dEwScba0BDU4rv/h42CvXJlySZpbgUEyB4SBggEnu/dKVbsd/t0
+TXRNg80Zs/pTFVbwcg+sDgIg1wZldZbClLfvgk0xLoDl5vq+K4SAQwSLTSPHQyYu
+8IxkrKmbBdBSXlgnmcHK2lDXrzWYJDEYEyFPV4pC3cHicCygSc/4eepUz+crEF6Z
+IE1df4LRv9h5CgsLewMv5nQ1EjxTo9mX1GiSh3e7KcfS98FgIQl3oy+yO2cmVVVq
+x5ggDcRI2sUbXa3D3kjAo2tUIA1nUMFLIrii+aZawOsf64VMdIs2OXEi5XFR+Zdw
+t+Bx6lUKZ3/tntStZitJdK8/RUbhmYQ8Tu01vxt/IAN+07VxWyZwcFB5KuC+lKtO
+/0vwyhyiOlHm8lzV/5qwFPusB4bNk/2uLPUaavJdrBpmB0t9pol/NFCRzW5MKFvu
+Qw35QyFVR0IBeaGjRc5J9yxbzi78umN1iHZbDjXFA7oRa9tkM2AP8V2anxSHUyon
+UN6OuLqSM2frA8iZcl0S7qcepYNF1ix9PhdQHXy0H7hoikXMLIiCl/unW5pVTs6q
+KnmxmRz9ZcqvvuVXbeY9C+kZE0LOBTZMljuS1Hcs69RU3rA18swfN5CTXw12ZwQZ
+SsnRhi2X28Tn8SD0vrEsEf08q3XshDwP/0MvBBfymXd+5MzxlvMg8vGJeFuDMEFN
+cpETa7Xzzz5Eir3ETtxpUWPCriqmCpnlIWidNwbg+LlyTeYUDPIDnMtEX5ySmYGn
+BI8ykvAKm/XTfr0PWOEAXcmxTC3oMhvYEhIyGHZOFJQxIo7vmrwZKi2wqMnKMPq+
+XXHgvtZe5tNbESI27APeQCMVZLVnVVa0D1JRFYBuwNoJXhWbAIKlIjBGv05NvK71
+e4x0zEY2mXxLBbsxVBvHhpg29HseX/AhHvUAcBehJ+sqnenXZqdeNhgBIeZubXq6
+A/gfscswF/Ocp63Z/vqAjEmvUKwAxNKrKlwLVShVvobPx2N4hH4ZT7p58cjhMhQz
+Lm4whTHy1hvBIR6j/Lo2eOkkVhiMlrrvWJIAEic3Gzj5f7XOsVr7CXjkSdoXHOIR
+63ZDO/9Wy6ygu8vCdiIFlyRyUBLnGhUYVbRYnTU58tQMfEYy30ZKF4vxz4Ysxoy1
+oJa6emaa33Nn1Z2kE64AaW4wbUJ57nROuFdoYTwJ02vyc51J4s0C94EA+a5VrQkN
+J7bT8P9G5gksp4b1WyoFm+O4aU5Sx+XpSO2IZFuBL05anF57Pm6Bz3LJX6sEYima
+chv72q7PYeYbETrl4DZxE2xlEiMUvN4DH/RExpPWeUsVMFtS5n60n5+AW1EYyGJ9
+mfWlvZ0xCjQ3uQINBFxbVW4BEAC/gtho2rZl6/+/szkOfEumAdFwyQbtM5CnJyuU
+rnrneWWlnNPLeaHml5a9yrcgOZ15QgnFD5YOHZ/S9L40goML8cB118etk9uE7vMv
+EtwxbkqZXTlqdxpFI/SzT4jJCa9XFQ2uA+KdmKmGW9EagtdLql2B9ziMhH0Ha6Y9
+5x+9+7/oRYU+ddmAbwrJjdn6bCuYQ7QVpccFC67qdpy2I97v03hst7yGT1FbrIjE
+sF4nMig6Uhwma5Edqm2dLaVXeZ+Fl0WeQCnWjprZMvkHCAxjTBlQpmvvwcQwqHot
+s832s96l/Sd5R6r+TWU0lTtXpcxL6t7MXfW+BInkqg0ZiHG1Znni6SwfatzDv6W2
+lJW2pj3Ub++JulEIkbct1f+TEeeLU0RbJmWlL/qe24fodKg1ixH0gyxsRKzdBUIf
+vgCkrzwLFgJEHRISjQzIASVtDdt8QoIqX8XALgjMBgAnZqtYrAEdFImWys0K1zOu
+MbuPcTImufz5ObnKM7rRMdCO9z+cHGs0TT2vUvPPuOsNYL1GX4EfrCp2eLKahjJQ
+BCxfatn4mFqHVmR/4a7vqq1j4Qfj3h08z7QVrNwGWAF3r8nmaHdaT0m55xctMRQa
+3N3UaYj0IQ08CSUJq5e005Z5Oinbt2O4paxnG4/UbJXpRiLEVU5Ja17IBsDfZydx
+W//ZlQARAQABiQRyBBgBCAAmFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAlxbVW4C
+GwIFCQO9IQACQAkQdLtrmky7PTjBdCAEGQEIAB0WIQQVaJBoXqDfahNx7yAXzF2x
+8AiEBwUCXFtVbgAKCRAXzF2x8AiEB3iPEACI735VFBDd4E6wlGAA12Av+XnWSruo
+Te7zGdKo2SuZ1gN1PYdNgflbifYCYajnQENp92N3q263Sq3MDf+EZYKijJ3EoU6y
+chjOJR6ge+UgKPdGQc7Lu61wWECBFaL6TMXCedcZ/Xd0xT2IbvK8qsKsITDjiDOh
+DUqdjVeyPXyfkmSrF5P3hvNxJvPbQ6k5Igx9JA+unLXxatljAeh1whnchRQAIKkx
+l19Nr1z+odFD+tzCX4HQmUfHRXgBiJICyIxWB+U7USqLtqk+7DE893meceSt0Mz0
+JgLct0E5EFfCdwbehnl5NJeay8XEdcfjUkeyb/VAVxWYUBiG72okUIaIP7xR5MW1
+P6ecdTr0GzOC1SySpfyT0+ot0rtXGSnXrBzpY6nU14hDoV3g/FMas+qz1smTtOVi
+1MVakDRf4QyP9Jqf4q4/GosRrgBvXZHi+zWkKuf+DXPcL/q6MfgHvQc6tFMh5ONQ
+snrF3Bca3BQDT2GKjSukeG3JmECHmKtQk22jhk6T9DJ3518yw29El9tUgraaZ5Fo
+Gen3TYCxA2BhV2LYCSLSHiTPdtUsbDuIP/FXaFXr34nAtKKOSSY6nP8SMzCPSEMN
+iscfdjejR1Xd012T/mLqVCBzFJWyX2RaUdygSWUpt/QdvWa4pXCgYZjEVidraOws
+VWMbb0zuI9KCseOaD/4jd+awtnRUj2SbGeJSVnqDPk0Hk8ndFebAo70uQGATkLXC
+m5ls0RDU2xHZumuUk+b74Y1KjwdqF65NEmfjaSQ6B8gnCO69eKHcUT821ED9bwfa
+4XpgsOMEoZklvFByax0JMS4JEJU/xfsLmfeuXVirN9Z82vxAXG8fuK8bso6VLG/J
+Mpxhq1Zv24NQ+uevvh9loyWMcaw3IqPvQzNlyuuya3rXJYZHSH7TauYgqWySXiGS
+H6oXl6Ej4GR3t5uWwHKvEREQer+KPZV3uXRnrTpgITy+PxZ9ywmPwmPBHcD6c0P+
+g0lNNtDdvw69qy+oh7JaqqYaDvedseN39UgBSx++ewRhq0OTikAD/BCv1zhPizlD
+9BHAOsCxrgnz0WsONYKFAE8vtNo/wB//djf/zqMsI3iWdbWqM9e/muEEV4jQRWLW
+TWp1XTqqvkc6TsLBBNO5zisJ0VwSfDyRUplr/IWeUl9FrRngjBJqF2nl90US5p3o
+uk5wUWdjFa0haFyDgZNFwyFr85mex+o6qIC3oif7UjC4kHPe4wzvHDYAxrHMB6MY
+QvrcXzULmInot3qRAr5duUNbQbrjdtVvOQFvjowBP5Scu5ZBSzc0O2TUUSKgnJZS
+Bs7+yswfgyhYzusbxlOdA+iE2Y8GuovamGYTbsdCxDStOMfZnaiXuLL04Uy1PQ==
+=fX+D
+-----END PGP PUBLIC KEY BLOCK-----
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBF/u5KMBEAC0hPiTonjYEe5FqNzFn73KmcN8KGD2wzujmWWLnFXGEVDEpFcS
+ULQDshhCclwNeXUArUey4nficwpqUe+Xl2h4dP4z7yh3WiL5nA5JRjJjw8KJQGVW
+AkgiZTnJHH8DrzNt9LnDL516qMDJarTHemDUUUZLNxnuv0RDEhDxsXWiVCQZZcw/
+41yIY97uCf30dsDwnckVl3iEmYaGTYavWbKP60S8WaxO0YG57RI1etmlIQ0nMmka
+4bvFnwwb9Jdnwle4LIiRMCGymsheaKCKrEZgIJY+idyBuExLLykiL8iNBj2Pzi7z
+XSCniH9qcEwfqgZlP/KZwujLhGOc4c4peNwpuDGcmYZoAsUD8CZ8H/LU1FIR2A1u
+/UrRREtC8nNTDGxCckSMEquHNURfMk1QmDbJ9gaa9aOk0AArxuTxyj6Cn+KQd5l5
+0mN0R1sDVQq9xWdvnB7N0d3MDhnV7f19iUhi3KYvjVTkCMXjhNXjDH/KXFKoFhKa
+9SkxYGfW25inwSQoqbP1TE5+rESf57bo+XFxfVQuYfVJ5BlZobz+sRl2iDQyBJDM
+uDFyXE/t+E76BmwyHeOI1weqUMYebqHgu0x76dTYj9yWgWdQAC1pXi15/MTIaOtQ
+hWezb5rkI2yZqaZLaRBOIRBIPM5C5AOjL2XbfwUuSr2W4+TvxLocxi48DwARAQAB
+tE1JbnRlcm5ldCBTeXN0ZW1zIENvbnNvcnRpdW0sIEluYy4gKFNpZ25pbmcga2V5
+LCAyMDIxLTIwMjIpIDxjb2Rlc2lnbkBpc2Mub3JnPokCVAQTAQgAPhYhBH4ckayA
+MKWlnR76uXUPPIdyPkASBQJf7uSjAhsPBQkD60WABQsJCAcCBhUKCQgLAgQWAgMB
+Ah4BAheAAAoJEHUPPIdyPkAS0lMP/2IgMErScBUaXrZXqYXoluR8xU0p9DyZEBx+
+ZGNAcJ2CTPAbn3FrkNGNpK4SOCLXEZPKOQ09umaIxl8H6uEGaTut1JLj1qGaZ8ID
+4gAeQcTIN9OQA5ElQo+ci20XE9JSvzqY1zb04EkMuVL678xPCYJhUSLS0MAQkcDJ
+JQLN17SwNi4vGqzVhnwKUviQU9/s+LRUkThsTg4qT0fNnmGoVJXqrshxJa2ZWM6J
+QtOWBgJiC6xZ+zRiZS898L0tekU4o9yxtnnDWry2bI+mJbxAp94ZAXgKahOU7LKV
+3SPxkx7TAng24nOWi1EaP51pe7usTFH1BR3CUHZdoIQ4xruZGkt/qPumskofzl+1
+8bw1bEFbq8S6jC+twT3JUcE02HbEIbrd6l2T8pYBXaojFggGjUTSv9d5YUN5N9U/
+/Qy0o3xZwHNdXLx6xSrUO+NT5JU1Nh/0sutEH7ru/YqFZof9vfCbV86y8fIOPgk8
+LkJNUSu4QCJ1PHKB+fJp7yAhlPkOXNG1b9+W/hVp96rdkovpCUkLD83s+suQyJGk
+QB7Qpem7nS4zp7/Naui+g3M3p/uRSzZgELTnXNyY//bw9fOqx5SDLjSUslUMz+TH
+sFTwfo/Mot70MPHMe6aE6tdTDoJTcv4Iim/8MDhJ6yqKt8sxprataZoWwFi6zAF9
+BzWkJcrbuQINBF/u5P4BEACso8iLzFJ+M1wqcsCDup+GtRMzte04CAlLmaLgyzfL
+3xxBo4AUgX6UbUCGycG878JVn52S6Nsl6FlasmyH00MGjZt1CuNz4htfSmLGcBMj
+IwQv1CYR8bm9EPwR15NaWdgzJHShCduMHv4HdfqSa6UQfzO/P8mwioER19fkDQSE
+U1KsY0yl//ipWiW3ZJGShGHLnn4YbxogQtsRPESKUsQ9MtzuMt3ehGtkN4RguOXC
+6pCWP8J4F9lgjSZ+uLOQKV4rmpbSMXntOJi2nu+14Zj36enW8xyAXO/w5z/wci2G
+LN/aa/v2a3GM3WJQsPNzpDwB+pr1n0Kp+wK6K7siVmDoV+WecD2KNNgOuSyUve7h
+BjWRM9W13LsgLGhKJA8yUpPvhXk91vLRUhwFJ2GUirxLPLs2TSTjHlHvhcPy6aX2
+HxbHkcOt53n2h0zx7ntl1N7XHozMWmHphPsSvOZ5StuQRAFvfE63EyfR84KUPIbZ
+kvftbAJPKCJC8W6GqhfORzYZqldDNNva5iYHF1OItF79ZLGI56diNsBV9SOVKk4d
+f9Qp6urYOd+9RGQGmCQte/WSFaU9z9QYPEGl1NlmGAWt7KKyB6QXZH1oEMwXtPd8
+4GQX3XGtyggEp6BGwkFFWRQzF1EZ0maRPrpN4bpQqLXSJiqQxsX+FAcOkhpo6X7b
+8QARAQABiQRyBBgBCAAmFiEEfhyRrIAwpaWdHvq5dQ88h3I+QBIFAl/u5P4CGwIF
+CQPrRYACQAkQdQ88h3I+QBLBdCAEGQEIAB0WIQTpq255IzwEFuiZP0UMA6+pClln
+xAUCX+7k/gAKCRAMA6+pCllnxDtmD/0YCUccmKudW9PiQw7mI1HSuwL6aS+MlG6/
+LJ79nmi6TTpe87NDcEv2bBpVWYcQK87smCxIYyuj4SCZuBQivjyuecipRoG14PUh
+KU8UiqdF+vKDvUAA7huOBlR4dgr7/KvjirnbwO3mGouwZszDOLvaHuO403+TPm1b
+mJtEA9y6Wbk/+PTtfPymQwnaiJkPhQ6Q7ZbyasRIisO3MRPacUjt2DXFi5VV/Mya
+8o5Pae3zY+5SjMyE2siPnVE4/nzp424jDzSq4DGEUip/x+QYHFwxhCJmdZlRIFmn
+vSCAGXBpyPVbckC0Gw8kZ8HsGzNbMbx/VjDG3LFT8TR2Djsh99/6icO1J+jDkPNn
+IFEsYjAw7Tos5IPhIT1XkSCW84KqBG5pGI5h7fJzf19sR7Ki6XyFe6VYvggeQIS7
+VN1ISl3tRN/dk0GbrKkUKr0OVfaRD0wXQHTzbec8Fs43G0z/DKoFutGB/J3yjAmw
+IOcP5R6rqjhVp4APQpsB51XCaaqEXaXZyMWrKILbPIjlE6FHeh1qd+zdIjullnF2
+YZv89HU9dIXxKr35CM8f3BWm4D4cRjsUOWoGhMNwdHzHYOdys6T72KBK9D2irz8C
+L0bycjN+SIpde/auo+dQKqKD3/ipr4dyKJyOUsls9cyhxkFp031cZ5rWbXcLJ8/s
+1BeVPjFCngqPD/9rMKA6kCSnTo+rSqZRxo9RlQwy4K6xfPPdHZvBi3A4UYCsurgl
+qLtFtGG8SMWigmUZWLT6uhsi0orR5wfG7vzajF0Hcd8yuWa4zGeu0rFJXgG64Pyj
+nJHtv2Tzi8DNY5Y+8mfXqUewyEUXQLxnLqpGlPjNUAJKvjm4SstNadewgWeb6F8x
+UQJc8owGmK5+yZQ5LZj6bjt9Dr3SCM3Og/iS5XK5POGUJgtgXLXp3uy7p9SzsJ73
+qhrDII/YqSwToMu8tUv4xEGxyceVPDm+ywde5SXYmtvMYrq5DBdlalZ9kBlC5fyc
+IIzKoIOOkKKpa/YAyKdLTk8ZByjDk1RrdcOyP4VNpCvyisf6JPwWfKdM5mxf47hb
+s7zioUH7miUGA6i5TNi1e+DU2mL92sJwQ0WkHw6KaUez2Y9CaD8hZnQw/h/JcNq6
+nb8y0GR8h7qWms3K0rtSs8SuDXUsdZrFAeURivccmohXddtt0FDzkheKGXs27SSl
+8oOCh+jl/hEUzz2mJGFwRBo0FI5ipN51IfjhMJ8zzSmvfrtdwT2Tu6wSY9DLsYR7
+0tWGOc2HA6o7kdcC1V0p2jvQct281FrC9dTXFgcDuGUBYhzEZeWwjuYQXBzMquF6
+ersVnPo/Z5l1SnkK+wVBQbf4igHOaobl0AQxnb86W4CXBTZ3CvRq6o8vWbkCDQRf
+7uUlARAA7oTlVZXhdVlPnSQlnI5JwovG2jEIrRifpbyavlhlosX+rgtQ5EILn0DS
+PJ35CNfOAeOcLQeRrJAZj6w/x9FHWfKRAHUeiTTsVDzTrDyJBCVuC40ck587KVUc
+GuB3vee03/y8qAczj5TZNaDdl+4qAzOFQuV4MjwJOx5fsXZw3dUAS7pw1mTkAYTh
+nz557buc8JJCxrebT6FvN8bugk7LJ8SYmI154Q5wCdXB6Q42sdSMFlKKPYRRmIvX
+vI4Ytl/J35v43gCLbXccTWQpBX+ra75sndS2hYGQhcC+WdNtt4THgU6Sb7ErpJK7
+7A1r1Wf0WSioQ2VWjT0QbUE+6IXD1J8duh6ZgzuqppMm13aDdMDZGwdcxlFw+vlo
+bM+IAX+QgzPjslM3FHVvvfCLka+ctMO+lL0bz1G4njNEXcIAILhmoqRI4ItVH7Nl
+ZI3pAfLLB4qbhTKTIiS+uIoA82RU86ozr5oJZCsJa5N5EpJnYxnjv2tYhU42eh+j
+hyM+5ra1dXtveKvL5SkVuRUlPZvgOuwQ14Qnj6sv8CmtBpyVpupHmY2RbNtLVLdH
+Ix3lyQbgVo9iMJIoXiPXmcRWCgLgOeuETjFXsEcFLxuN+D0My0dtwWcg+271vtPn
+0orTObxkctFK+V32ByJYxVvytNCW245bICpxCicxmh5kYEmQCnMAEQEAAYkEcgQY
+AQgAJhYhBH4ckayAMKWlnR76uXUPPIdyPkASBQJf7uUlAhsCBQkD60WAAkAJEHUP
+PIdyPkASwXQgBBkBCAAdFiEEqtu6UHTxQC97adVrxbTukxqfnf0FAl/u5SUACgkQ
+xbTukxqfnf2aeg//ZspIr4ETVf3ai0dXCm2Pf6gpM7QUfI9fPUHymvBhNrNhfZqN
+ADpzbJefzLif8as7kUr904zTc5Jse5a0MzCrMyEwTDIoCKDv2ktLq1L20bwflZs+
+oP27CYC5FkJYgLYPrQZ/7hRC8EWjgn6v3seJtEo8G73kiVEBOnxVEfGZ8zxmX1Cp
+aOWfhiFYCmkEe6Ck9hG+OaWt7+WW0wWT1UFiluzRRAEMROcCUtyB5IPCqCH/Rz/m
+/bE6G+lHZo6OY/wY2q/oW2f9JB/4QyJeSI+fkjY/wDjfNQjiPMLfZctv25IeZYVY
+ZvIKrdnjbzRe+GwYLg5G/SbpSOEb5O55Ps8mNUpYFaMCfefW+DG48a4WyUGzFr52
+BMKvHKtc6c7P3+muBAqcNZYxRqyLIQiYiV9CCjpIV1WgUeedroHUXvJF/SAvNVvB
+ZR00I/D2hsD9BFh3B1FEYbw7GuYuG27Z6fgRolOQUeTabjQLI386SV3IxZ1KFwm4
+GU8BTbUA2zwT3hu/BaaCI5jTSLyBpdo10b1wgMEnqmXG6AbNdxFVEWwE+CE++BHW
+0YBhKp8fghHwwN1fwTCV+QyA4Qn6EBVDkTrUPKqTeCmHzt3AQh8WVrsmrodyr5Yp
+69LoRnlkLcGJiOCKMOmkop9Z32ckGieYHrl24Dw6hmUSWDG+pBn0ezbSPit3FhAA
+qD2y1VzqxsaCOD634Ltq8AbvphP8XZPrrsC3DIA36ITaCQDa5Cn7madLCXy/uP6N
++tojtzXf4tUzumwGJGFLtdMXNmuEuXrj++NrU1xcscbvDn5O4NDMadwI1EDlQo7w
+uWK9jaQAVhF7iDEBEazZe26knQFxC0my4SyO1uQaEg3BKHj6z7dkAjzWJaQZhzql
+yrRzbCiVUUI8ZkrgM/+/6NJohUG/had6DoefgK6H8/yjgVx1Wtx+XAuBQ2cvclhc
+TAmHs128dWduNHxI2Yx+uM4kuHYpPKBwdEh91ZNeNqtBJURfSVjBCjKkTYiS7kiv
+XyvQOBdZVeSVpj/QoAfaUlQoBVm7aF6xf7GtYlVzjMsLYdpjXhy4ZbQQVUuPI+1f
+yFkw8PpASZ3gvO6KQ4V2w3hOYAxYQ1kSwTtaA7+18nyv65VolTmAotmLun94UKn7
+zjopByBnC/XEqsU3tibg9A7xQ2KUpWkpmG35f4ZR9aEIxSe2Jmm+Se0JfiAq6Szf
+dyWvr/TzaS/BZL4WEPk2Vw/mzWEPZOscpIkBFGK+Ul7yuXvbrbwr+zmAikHmTb1V
+XfPb9eBnwDDuRHhLBym4FMrPjzeziAxxkScTfDjWq6rvMmaEe1CX+dj6ldx9Jp9d
+iUngol89eSgAQOtptjcit5o0Y0Mu/RF6KIBG89ghFly5Ag0EX+7lVAEQAKFx5asK
+W7A9BNKPkaXgym0AlW2szQR1nwxi3APLVLS0Al9Y/3mnBbYyO84HDr82AtMSWSMY
+UZIKtkUj2sVqUb+xHOPkY/MenyoBrCl2qaTVJ89nnWMUjtrX2qk0O09+ByoYXTit
+BVPAIZ/qZfGNB+Dsp1haNKRdowkf6WXkw7A9dHB5isVmaM/Z0THNJRHwc6mcqbEV
+M4fDL+OCx6m2KQHTHirk+OE9Nwral82IIqj3d5UBHmjHAbQNXTDzZbWg6tYbLN3I
+EYxSRQpkJZIVheyBmWFZuivm4hCDZxJlZ1sgxQeIZk6wR2LBR6ccTW6PH11PhIpr
+6O8aQh8JUMg+/aJK2eQXINozYdjOTUjnWAUeUqML7Pg/vERRAgHXO9Z+NTIEWEOo
+Ee+8WOFmrmfjb9Uz27DtymhUjOl0ryiG6F1b90t1rZvVKWR2OaCUhICm88o3MCgb
+HFeOh7v3tnQb2Uot7kY1hgch6j1MNYWGb8LjwoTAmx9okEv9mh119k+SdVJP6wsX
+ZtL4860vTfTw6RQM7rkZBzTyf4qCvU5uRSd2u6JqtUhw4m/gkKQyW8jLEkqX7JaT
++iEBgPzjALvfSWDbDgst0szqU5jltYpgjG3On7/ZGFFJrkB06orUvovxLThWWvm1
+iugw4/av3n64hl/yfxvKQHLQA3Kfkjjzc3oPABEBAAGJBHIEGAEIACYWIQR+HJGs
+gDClpZ0e+rl1DzyHcj5AEgUCX+7lVAIbAgUJA+tFgAJACRB1DzyHcj5AEsF0IAQZ
+AQgAHRYhBGFPhWcuJXtdQn6ZBiGZBzrXgrS4BQJf7uVUAAoJECGZBzrXgrS4jfkP
+/ApYZIRnBL+LdTPYdbZDYXotkE6RO6ZsPdcV1G6na5jJ7igdVuvoz5nP3rX+oQoH
+6k9DysQzyh/SkXRPnbOOyvQsI7atmH7SkhNn7ke8zmEJLzApHA0ZMGXtBJHQkZwA
+5LDWIQb8HbtJTBr2DyJcQdpRmP3hHDgyYgwg0AUG/2JEwYqps+/pqJCrLSP+GLOA
+ia+wRH9xwv1Vl2gIxWXqEO6U3puqUg+0z1Av4Gj/xzuw1F3eLrOfgklhpASc8QtC
+89kx1nhFS+OybQfRAH7YN9DKE5L1kJxQ4t+uW8TiXf9r+MdcVMEI3LATZRtgowFc
+493g7EkTppmqabFns9OamyxXdIzLAKoKvykr7HPCBWUnZn2I2RrcGQltRBQlR0Mb
+jO+sFi89XnFPwXIw/t/9zoq1bXCGTt7H5RtrfxC1wTYXqLEdV9pptNj7j5mlff9g
+DMw1v3MfUxbz9gIDzs7ANnw3SkWi+d0v0bLadWdItkq2WKvvgB58NJtKPc8Jwilh
+nO7W31U/kv8FR9JcFXzS9+Y6ejIClF4FAwr5tK07N/xSFAKEs5kyAYEKxP6vI59m
+5h+tO8cws+pi4gqfWa3t3b+dVzKl9AIkWAYjq9FvbfiqZgKTlTviSUMpmK5qJVld
+72+NiolUVniJbw9Z10ps4G4zmXSl1ZxyKnehUzcKyPieEEsP/1/tctQx1LhVu0TJ
+RLtWrE523hqxpqDdF8/QrNp9dX3YVoEkMQW3YYir2oERtaosWXmRjldq5dNfgtwc
+lhG+/CP5rxNeCJlI+b64pC/yQMCrbz/V74aAipuv7ZZMflgr7ZD5i3jyM/7/AunS
+qOUPwkKrjetNF85eibeO7c0Y9/HhILkLQ8EoNfJshdc0/scwMZEpLHTMAHSrxCAV
+FuhLsF9epenA6IbtuMsp43aSxshX05RH7F94uj4VCMUSs/90viB5njItpPdZCqUH
+eXSvLSjxqsmS4Tz9Dn+uWvxleBLRRcpZykuNLGgwVXafWftWbA+U9KaJnDWFdzjJ
++gAsWfHfFBOa1RfXYP++e+VJflcHaEZ4byLG5Zf1HqAvvcaShAVuMXY1hoYJinvh
+uk1zJRW9dP7apZx7BXWxbWcn8LMR5GFfunl/M2iNASmkqxJ9gvy6TBRWJu2QeNbN
+5Ks0/GDUawQqvhmM3V6zFQWVsPwaHpufIaGqnKC2gXaIHXPP0ldyXdLXwgZ+6A7D
+IEqHQB2BDbiJtovk6GaK8PUCEHTiDmRF/mBzlpBJOn+Hc5ELufgr9E2lkrKJzFag
+CBCucNhVEaUedFrycxfSALing7DJPWb5cobu9K+3T9L3k57XgxSAj+g6vOxHuxHL
+ve1IPheCWfkKpJH5faFDWKpJYYPauQINBF/u5YABEADgWTS7wFA39XvpWNHSfAAR
+2/nlGWuTvD7zoirzUwOd2+I2XYwgl910KsznhlqDrHZlqKuGRjQlbpyTbsOH2N5k
+IE+0uEXidU3iwslSZ33RLL0h9+czDnlgijYXLCg5ScswBEC1E/kXX685AUCTPX2n
+D1+Ymxxgov3AvItVxKDd3N5ERsy6hYWPK4ACXt47hJFqPfPtnQe2IdFkRm3bOuX/
+X79Kb5N6cAoao65Tpsix1pm6tTNww0+THzIWzK/yhi1/tUOv/QJMEVAxeBAPr+Pm
+mvjHvsI9RNQt7VnoHVkqJhPDxyQZR2IOVQXvlYyCtkPA4WQlyxLzWM24TG8xhD1v
+zZzA8qs//o9QI8OLg2ZYxplC4lW6GEZk3GnrTXs7bW6HUq+RlayIbDw7oMs30jAv
+YyDdQpZrYuZvsWKbKu+65Yi3M5kW0v96LT3ueMJaL/RanL9JhAWuEqyezffsBZ5a
+88/i0n9FJ8cQ1fZq2/GLq/mN2JZ3e/HSWynTnlmk+qGk2bq0cRFJNHAs2HNAm0Id
+pjSFCPmek9j30wp2c2knML+SsSw5h6570mwILuKwFr6i2hyFlPk4H7nP04vPQ8P2
+Pu5O/Cfg9rPSBjIi9FsNS8/a29sSuOmsSGHZnMrVUpGw+iKmx/jVejOtqe6hYydu
+MSQtIU59E2fq5TM4tub6qwARAQABiQRyBBgBCAAmFiEEfhyRrIAwpaWdHvq5dQ88
+h3I+QBIFAl/u5YACGwIFCQPrRYACQAkQdQ88h3I+QBLBdCAEGQEIAB0WIQQjoUGa
+YHzyVyZWN3UsTffOV4ELlAUCX+7lgAAKCRAsTffOV4ELlDerEACBP9kAH17GHloL
+XJjd1IHttRWU2Qs/VV0H14g14hgRz2/Qa7KRR4mGrXPKS/ctMkDXwlvs4HPUTeO4
+MMT38hwxv54AjW7CtF8DR3EQFXKR51roICQognvqpPe1auNERdLzAdcn+NoHEQB7
+eyPqjQM3OGGq0SVRwNnv777o+Kd8Ncv/4fR1xvA20Ds94G5vCYpHB6J+lPPVXBmz
+rOYSf+QZWsXjAZdnAAYkpEjfJhNrqvqSoRxZ0dweCqieenm8Nzt/vdL9nT3+4AGy
+5hmaAG2ENj5AhI194gtgACvKwCl5hF0VKMhtm5d9SWS+1quHzgn3UFh3VZrfjPid
+CR64mIu3RpZe7EcR+lMl7gCJxdFlHVD3z1lbz2V6u+xH4ZsLrTY+v8kDxzY8ojM/
+zDbnlEK+xzA9akhlaD3D3wKXRVuSlrxfEVv14mwKN5AYHN7bLL3bjOo9WYtLznH6
+Av4GqXSQ+LOl0+6bLKmD68/N0q2IiZwUSOsxTE1fUdYPF8eiN8L+35Qt0jwybieU
+a3JYtmO8EW4ZEmjJGwKgyrf+eigJN2/0AeBwcJyUw1YfzaqqS35NNyn5eKANyFQ2
+ZhIjuXRyBOoUMBAx2TSm7FGeFOIw+aQgap6HuGbZ0EZBz6hr9ogNC9FVXCPENKo+
+GdTGoIEs0n6gGOPP5ssp7xUK3420AM3HEACSmYaNC1Gfq2d81fI0TBJ9ATCRPo14
+MjJGiWaFaXoVp/lQeOvlX2JyBG2I6fhMGPGKntCfX+/MERLNAiahQgOjvnOCQdlL
+hbq+6loQ1eSTX2AXpRlQpvyxLuebbM+HX3N/9mqAksgQdljmqoJQbiE/HqXqjmKe
+16ylU3Rjabyc2p/31p7hm0IJ/3yqDsM06FUBJ108SALQyVvKqRA6q1t/Odb3xgt2
+isbCEgvhJ8kYz3LQkvTW75rSa1cM53Udd1rbyo1t0PaOSGeUZw73/nY1+6LtUEg7
+Q0x4ohL1UE7z7+14mAtn4OvGDuZJil7Lf4cPszf0SFoHPs8iUFpSorBwn3u+5ZXW
+NYFblPU2WK3O52qZqsjuQI/gK7uQhXjJO5nA5M8Yv7bVrbLMOj64hdOpNbd56Ycc
+qwYbHZL3WyRAN7TNg5ZlHgIVac22StawjXiHWDGaAXpCaHJn8ryM3LY+LTz16R2M
+bi+HVaw+0fY9f/mIcOdT6AyDg+V200GkGXL6aw0LZkBZmDin+OMmL7AS8TZ4dvZt
+zj+sykcT8DsaFj5Au6zHJoCnsuShMquHOA/vcUkhoe8/E2Y2QdiX7zwDM8vFM8tX
+DujFLNPIZuItcVEpE3ysFV2ZfVgBXoxTlZUQxdgJBQ0zg6Ez7rDYEAhVqo2gY9sk
+XtN80X/unsjGSbkCDQRf7uWiARAA3i7pu8/QvukeIBoIk1V0GHGPjX+GeV3fR4fu
+ciYgx+NKTXT/oJ/89KVeetT4CSnGEZcEpAvsBL3hsiblJYyLVmeoCniFlU+rMem4
+zYP2PnEX70Q56d6SjBArs3K1FZK25S5qqv5ceM10NVRwPufV1RIuui6mQLm2ZwlY
+JyyANZZXMrHMJdaHpK9mMBSSF42MFQZhcauQCrhMhcpmZKn0D2+PpRveYwSr43Qi
+qBWR2INTDmj/V3ERMviE7vLajWQcmDdcrBp4u3miAJcJSn3XR5SiuL5W77jFEzgJ
+zR8yTC4hWE60nWJOk8UrEbpLyr7mBE0Tr7+1IBMgVXh8WHyzLE2ENREFvtp8KlSS
+y47Ky9n+5aqPI4M7epMNwU/ZGQnC8o3yX0zZL1tKq0fTAw1Ly4NGE1gRbmzrQcCh
+qUHg/J4KFYBMg8eCAzuPp4CRk8wUzu4fRWrOraoz/7bvhH8ilgPu1teLLKzDdOdx
+QAaiz/nGy00ICNbYqifR5m73K/rDdjtIqgsMp9Az0mEpgVNq8SPzM5grqAnP/iww
+QxwFftiXq/pEP2d8rn65e8NikN42Q28PH1D/uBYnOuVdZUvjU9wwywmfyr+NZMaH
+X9sN8R3Kk990W9VxwdOTITpAjz0qMtpE7i/GwPEtpZPTIfl54+cVKvyUjBuTXkWn
+vXN+6MkAEQEAAYkEcgQYAQgAJhYhBH4ckayAMKWlnR76uXUPPIdyPkASBQJf7uWi
+AhsCBQkD60WAAkAJEHUPPIdyPkASwXQgBBkBCAAdFiEEBjEqvVaiYb6sKxATk1aQ
+aqvQi4MFAl/u5aIACgkQk1aQaqvQi4P2Mg/9FXfsIZAgPN/Dq95y1fHG8jsPXEoY
+VNY1codxxAaNqvBXZkfJbFwSYpLY3xIbyxHuGuOtC9NpIy9M1+PR7MsxtZAvSjP+
+flP/12x+6nP2H3NWOICpsY1tNOnQe2SjKJxZXHFnDqDBgKpv3QfKUHmYEdExJe3p
+NQrjZAgmdbEHeoj+P2VV5vqRrJoqNV/pUbM9czfEHeMVMm/mwWNOi/paCh1y/PxZ
+Mkj2bqLMRFfML9O/7QOJRxu3wQwl6jJHj4o6CHks6t237FSB+qZhhQP+vR2CZl5w
+lQ4trw0wpNgbZRIMlU3tUfFQ+KdFsM7UqwzwrVgWFur5r7KrFzJN88EKSplrIY0q
+se6S5b58H7Tw1jtfjb/xF6jQz5aoZ9xemd8roLReRpKPq70o2eIP1HkjCtqmd5Xc
+RQaVEUvlv34WZQ5w2eA1bEBESjbrKhX+H0Un0msUS0JpnpegRNZqW3Bedeos0usy
+MsfqMYmZEcZb3hw51XnSb8B/WhkSmcoEuECRxeCu1tw0pn7o4GemAeqT5ng8LXeE
+RJhrUTlCIyRab8TIQZvmf6XjneT0stZLKCoZUXO+7FH7F7nPsew1dU+WFIauQX71
+PkZp2JMT7W57HKPuEillF8v5+H1k9Jq/2k+ZdgmT1Gd27nALBOc7q8rr00Lf6BU3
+K+XsfWo+p08CXKudfQ/+JFzzpyKeX5nVqiqbxqUakPy/Ot010/7457YVpvcLmcvT
+Yn4cR0dottl96lp5wT1jN7VXfZu/tsHEtTg1ofeExNuCL8DZVsSN836idRmObhLP
+dnYmThZcXBJ3RgSniQNwvuuGUtpH7OXb5vnAOe42+n3yucxhPI9Gzo5g6fTqWwb+
+qwh39ydxtiv3v3jgFixJLj/HH3MsxTm6cNUTWNLzvX+HugBeuOfyDG9++fe3UmZe
+MczAF9N9tDFP+0b1diXywJWfSdVLBmMARYeh0Swjud60SQLTqaqXVfPSECGo9LVc
+wot2u4q67QhUC2OTKiTkF6QVE05iKoPEPkCTmMvSpbHF3ERZE3J6YsVg17Uc7LrZ
+7DRRF+03mu4njS8LvIoeBuqsB96mNQNH/PwLSANWTtclCwj2C9W1HKy3zKjnu3kC
+PHLzwQFEO28TE5EsblnBdA8ozNIV887V7yw89MxPhpuXRn8BVAU1S9Dj7j3mNHLj
+rVAgZmr/nx3oDt8VfOZpK8u3u1voZdC+cnTBdcG2gzM8Ya+h8C60Y8dFzykr8hr4
+b5gDeDI1OkQ2vOQHtnQPdscYKl0v1ntHq2wrFuCIol4WneKh3Jrvdb37cL971u4g
+dpw0jTO/ykCvLlipxjJ/NrnXFb6TriZRgWZqiIwY2lKEfZDXqc/iOa2L0yBr21a5
+Ag0EX+7luwEQAM/CQdinTzIHaEJsCe42g6tt4dBC/UC4wD367rJcyJbEd+qaLJwS
+CQUbg/wrEdRT+aROHVKLwrvXxtgJs0x15vvFTurkn1BnNMh7p8woYwip7PKrNn2+
+96Yg7Aqc3a3gkDQeF8Q7uipOH/5feJh6l7Iu718pvnDUw4UFZt/RUrdqseFXVwr/
+ffSalLx7gJhL3mYuU1qpJZxsonNwAS43eViagI0FHSqixB5kPgFcbBf3BIiisOCy
+a1L9a+zSt1y1aEFC7m+9YlGJA3C0/X8s+dK0VWOrJlP/WmKUp3Epxpu6srsBItcT
+YMuGA82/03YAJ+jpGMRb+X1Dq9vuOUxvDjG+G10Cgew2EjiAkXpVg/1NsCrQWRbs
+KtFf5PXGfKCO0i8hEzwmJLd5OlNIIiup450iX4eS77Tey69hGyweLIC4YDPDwFpp
+bkDdRG6nDvePbEHi5z1L41NaWNa0wEyh28OqrmD0FCcGukk24pBVemVEx0En4siQ
+la6/1QXQlG/wTi7Yi71V/4oz7iZ4lSPWs0ACFGD9W5InlRykiRXC1cV27f+qMw9u
+Y6UbgvN70cWflK5C7e2h/eAQfxj+seYFUjMnJTkXiZE85m63p1Yu2A1c9+jqJ0L3
+Lfn5YIQdtWdY3Qc1RIQYPVRl5NcgXIPV7TwjvnjowuHjWX0IQbhv61lNABEBAAGJ
+BHIEGAEIACYWIQR+HJGsgDClpZ0e+rl1DzyHcj5AEgUCX+7luwIbAgUJA+tFgAJA
+CRB1DzyHcj5AEsF0IAQZAQgAHRYhBOJesM8c6ASdR/HZpjPhDkoYOo5GBQJf7uW7
+AAoJEDPhDkoYOo5GhpcQALowCpZ8UowMWlQFfZ2ySJalnZM6S2RxCFiss4W9pGuu
+9PKuN2wdXW3HGkBGDAuQgLwanSfhGSt/urT3+DT40OlDMzanRwEK0qiSaSs/xBtK
+dNL7JmGbcWTXpNP3aHhfYhVOg7NJnsfZ8Ti3dfuv3ZrjcLvgdnZ/s6O9S3gU8DtH
+fpnOfE3hxjUEHEw9hs9Otc6foCqMDZDvfU3emYduD5AvTiXYdeD/mZBD4OmF99II
+XWNuQexAJ+xgOPdvXaYt0lBuXmfMcn/1hrU3RJqguwnPZ2cU5zo41/uSbdsFrTHK
+yEOLTn0XYYk07mZGdscljzmXbpsbAC4Jp8CDBhUfdzfi1n3AOyblk1nywfionLlz
+HDtfWQYCxp16N8S2MU7tA1w8rFNwVDVwmxIfgjLrjPAgvqSpCmLHTXNBfdLUYRAv
+SpY9TR+U4YOOuEx2Niwnprdjm1qilN+fmPR3tWvVChlD3kHmSpi1+9ix+xizlBjN
+eZ08Eq5rDBPsTpqJmoNS8pHE0EL3IVpcB1pZ5rd6UBSa7LoMLeWwWm7Ap5VZALfp
+jMNws4SA2q5OTRY2or/+m1+cfDWIP+2XQV4YaNFMbO7XKr3vnUOxY9gyADqfRJiv
+DljHiw5iLzbkaHs7dYJOPNMGMlRzZfkkxg6Patx44TQ2rO7LnyCgVdFZWDHNevgR
+Z8AP/152xfh3qsOnT+R32Rt8CcwXmKFxLylgpjegcUmbutow9zdlX26qZ67cJ/3p
+hNLZgAYKPrGecGA0BJ2UzsPEKKz8I/dAp96LpHo/24WqUamh1z2PRAgyJGC43zm0
+rA/KAlcht8bbI/VuZ5eAYXjH01QfPS7i7fFOryYYFqfH+BTp3ZEr/A7FkcOZXmNV
+Gg4+oC2t6cJnzDsM0MUJ7dgNAHTLGx6RZZahdE3LJ8oVJ8Vek9KtjJbPr143EZLt
+ymkiy93pzLUaKWfCZJCCI9nfJnNZnvoQXv0l3wnrQIFE14Fv0jbTALHRgRJlB4cZ
+i3teEuf7shSDsd13JDdfmxMsxnfeVsIUPa+J0GBSbe14JHXlcd0t03cpbzO547Qb
+rFpD98XO6Y7OefWD3pwDF2Izjnn4Cny/hpUIEO1A2j4qHhUkqmnFmBO6yIFic637
+CJnYe3uU7ss/TNIUKLhujqlcNl8WeOMVPbhnCuOhyQh2aioAKn1yiQ1EgNSIGIVD
+LwqMt0kxI52/aDkZgCcEfBFC1c17IeUH+G0HMGm49/acFHkhX61S4efXhvzH5J0l
+Dr+0qk4aVKNwqkUNp56GSMLhiiSYivX9Xa4qQGNlmrki1pC2DamlTXDLB67XQcRp
+dAc+4nNTK4E/czrr0+wlkgz7pC1MAllCLilyTSPGnKIPlOd2uQINBF/u5d0BEADF
++6hDuKvzbmKWZNXjJK6Em/5nnzBOa155YQLN91zMs6COI4p+YuIVPPzVWZYR0yHs
+gTWw45cMV+RYwuL/P+1Z84bgOyPloIVF9VQjOC+wB3Gn4qmTzobr6q+UfQVvUiUQ
+8fGG11teWvYpWiG91uialjHZmrpAOQxjHRxHPpi0cZtTFEqinCIy6c942xbtZnzf
+nzPpxkKl0a8s1eKZ0KlDK6Ab59nxAinilohXRg/U6sqypsyLl41L0qMZek5dEt4C
+r3spdSkZgxqJpLTqQy/5VB4pcfEaIaank3sLxhpil/oQiq+38WA0VkICQyeiCsvf
+eEKyt1C6COBNH+olegUxudTKDHFthyGMPRz3McI5jHxCyru0mfLJag2hHXzgGoaD
+VkYIwkvyVsHWDqrZMMXcCIUVlpphxtHo1M32AATnWFe4K1nFdbejR9XC5xWOgwbT
+zCblqporHzU0c8WBbfJ0Y10IDrHsa/F08PkFvVN48Ydik6rcwowSPxP+59Q9AKLh
+Isd2hzfWU2zAbG5Ph1wecwlYR3tp/0i3uSTDXfuuaY+vrqpoECN6fnSg8NxiBbjU
+JR0Ju6KDM2SeBUz5hp9BzL8+OPTogRZoinxBogrRAvdGLOnLG5hMjBezzF8UEvp6
+IMisGHBZgXoX4Juvf78RE8JOwHa+HUejj5kYiQW6TwARAQABiQRyBBgBCAAmFiEE
+fhyRrIAwpaWdHvq5dQ88h3I+QBIFAl/u5d0CGwIFCQPrRYACQAkQdQ88h3I+QBLB
+dCAEGQEIAB0WIQT2AU9wN9W7TuO6I3E56nu98JFFWwUCX+7l3QAKCRA56nu98JFF
+W5whD/9Hu5cnJ0hnzqk3MQsdMXbTNLsv+KePV71kcMRat4hjw2Li/TUaC8xtA81d
+O/1obmsuoDAgv82KlQ7DLDXjFk2q45lJdgZxAkN3dEoYakdTIEi11FvwbhV+qxZK
+jTq3jFQho4i3GDLgrvBMG4B1TGMH0IPux9fmBGpxYKmp1GjhpgoMXp9bqzsV/mPZ
+TxPlmIpeJEO2jeCWKhHHw6rzwGjF68G3HiJ0TqvjdCtcNrwd3GTDsdEJtUl49aqF
+M7VfoqKjVdRO/YDL//+TJNOYz5EBGjIZxbhgZJ9Qz+geSBx9GJtDWdq193ofFi39
+oleTFnEMj+OeIr1Bc2pc8Z3HJttFknicJDkeze3mM0CZAkhVkLFy6DvAQkXrgvfp
+AUYFACQW8E2XmRBiKd4huojWYz5QGSEIk2fYRVhse2HAUZ9gTODSX2L13nls+BEi
+sArsmSFA/RQslDXW+Jl+P0e37BzN51uk2Dg4ylJUBgcpTRUn4Q8c1DgHDhkEVnBI
+ny2H/MFuhImw9g5xqlBfCEKh5D8D0e4fX28MhSsBlOCeIKJoY85U3GNY0tlIwAt8
+M7IIHe1n1qncPbAMmq0K48J1lfyTEbXpnSfArzEdbnosjBUaiQX5EwA656eZ6wb3
+Vq02UDei6KPuOosl4Voy+Ffq5MCkanVMA97/0wV3CeCvQYGbsvsUD/9fLYc3yH7A
+0xksK7PImztDR8MLsUPoiv/vnfZ+WJJ+YJ0TKAHm1ZO3NqeZmD7XoWHKwh83zsK8
+x/JUASCBN16isC+Ym6IwF83/HXJfKNvvotkr2WG6Dv8Vg1Hhk2Iv5y3EMbFa9rfv
+6vjxho+0sYrraJH8qQAM08IIOi7+afrkR/ikgA8V7ymqmdxtMMHZqG+h5R0VGTVw
+QBxZ5/ZiY56Qn5UH2m0Tc2AHOcAQTvCEwyb19IPyhif+rek3npSvKtDc6WBJioyi
+gvDhl+jgIfcIo77w6GthgbFc9k68Je56Peu2J30zWj76Z+Di1OJhAj1wFr4/XT5o
+c1MB/Vfyx3hEPRDNz7dRaDqoVnYVdoI0blyCiSkD9I4/axb4X3xN2SK4XA/zv+Lb
+1FbCM1XFL2aF+09tk+77EVdWsBmQpOArD0d54E1YulBGaxVm5QKfov23KiqHIFVF
+8WYqJqNJwbJRZii7klczkVm3wFte3NWK7HW8kfF147lv0z3AiZYnk0O6Mj1ip3R8
+Qm5yiv57DbbgIMkSPWCpEtFGHIoK2msJ2bQcizh2WGxLos00RTx3IVAeSAS54+kr
+rMBg50wNczcGHKPDUKLwkYczgHonUtljAkeXnTl69rifChI+KpjHNtF6dFgC1aSt
+MOud6HhAcd0f3lmuPzCGGp4YOQx9tV139bkCDQRf7uX4ARAAxaybudQK4fMIzLiV
+grIzthhb3/DK83PNohTNMemM2V2z1Ij5Dlu2XNDypMdR0rKM/QI3zWud1+vd2h/l
+QZlg58FspvrY6I7hI+cbdRldVaAKDGQHo5Bi0a7BkonZvS/0wnNUPIhy/znzXtXR
+f4L7ePZMofH/2shz4TZ1yNpU8zaomY6eNjSc51P4vVxtDQ4QofQeJEn8aO9a4whu
+O0TVEAPKRYBRgjM8faDuUJtLfiC3OrhLg+B7JVSF3di4JITAyafPbZACLjV7Umxb
+SUL3qTJZVpIuhF0xQOCE+WRx3Xs7lkPdHMqP2OaJ8Y4ymR08cSfIP2XFKsQFtoqT
+VyMQgGgI6VXF8OfnCnGgx0Do1vJNoL0neFzVXpCPPzh1RbcrtndZWum/1R4egkYg
+J8TPQH5X391J58Uwd5l9/ZDdoSeeQYdtTR4YQ8//ATFO3hoSRvES4U6ZwO8LM6di
+ra6pqb6j0liT+DdcBwE4C1bGJMJ6d93S5SfH3llDIMJo7uJDbKILFMES9rg7S6I8
++SW75TjKUk4Y7L8R8qwURqEyuOOGfaQXirqvji4PdcGDBiIk2Oq69Ky6lmlJgyIH
+SZ7SO1JXk0yAJTXb+a6FJTLFxidkIZzu+LhLBn/MhAPjVyv3qCTQ7O0lu8Mfcqg5
+8hhJ6IE79PBHS3z8ok+mFK0iGrcAEQEAAYkEcgQYAQgAJhYhBH4ckayAMKWlnR76
+uXUPPIdyPkASBQJf7uX4AhsCBQkD60WAAkAJEHUPPIdyPkASwXQgBBkBCAAdFiEE
+JFV3TUL9/mucOD64/hACvFlwgR8FAl/u5fgACgkQ/hACvFlwgR+LoRAAgtIgaKb4
+ZY8qoAFZeph+Syg+mMKfPJkBuGUedJl6IxbHBSg2mhnCjJ0bmdqxsAXgtcSUqmtZ
+Yw9NyoGgiVjs+gu5sQp1Oxc2/keQXaVksTkoXwdnf+2iXyp1WPeeLGySHmzuwy9c
+eExt+h0mVmBgFls2wNdFGPbVfiT3PvFkwqsnta6HebDTN4pMzvG1IIGV7L5KRo1E
+dmkrt3lXQWmdgHl3JoNQ9v/Jgf4jo6gDw53YvJFKJcaOOAS3d4CzPWmcLzcy4mf0
+9YI3DoQCbYL3cRNelUwzUF2L6QyPCwonXemLCmfkBgsSVqvW4fq8qbEHGF2fK7x3
+d7bZEsUiGCt/tXOkDkNJ31T/mC35nxZfcj8AMPixO+BnAeKeYC37LbQD76jrw526
+tUXsAF+QON5DPeot+e8bIx9qSbvdqpXDkK4lGcRTuS2OVC8J9XfDTch4wm3Kd4P4
+lDdRAJWnLfVay0m05LGlekWdEzcjP8KDaICH9rEs6f9e1gy6mTEBnBW//41BxELT
+KxoTGlcX3yEhCmK36g5C/+d6b7Ji5arGGTCa96v/xG32KYc1zfn3TYkCx06pPUbz
+iAl2l0MTpGeqz2hJMOGA3JuxwlksJKqnPYy0hHKdVW4Pnn25NeXcBp8wpkt8VZOR
+bzjw/TJB7qvJHoRo1tat85Uij9rAXqTyO8Ea0hAAi/EfuiDDy3GV7bvjFSA1XEjL
+d+F40g2X0QG/PHTScYB4rFJwV0GFUxLHr4g7iypAVI+BB4EYikx8gpee6B0g3J+r
+aCFDDrRPDKdqrpZK53oYcBPkdSBbCr5MAa/M3DerKBEgoBVUbaSHWN7OH2ae+5R6
+X2ERmYZdW4PCj6lw7a+RhkAsgKo8RjonjV61ehQPZh20noI19Q80BYYSCfHHvzy5
+vwvByhmTMJNrl3PDpBy9/TwBR5DpnHfOPJX6bnl3pdu65F2TRM6yoFbfoUiEqrXV
+4wC1I++N9VjrQvXSp0ik/XaMWq87wLIg+1owElJIzwyZWukQkZMAYtesVFz20YwC
+7Nu8SNr/NTSCH1EqLsS4YhBTsjpc2T8AqUlgxKrilmLbrj64PXgMsQ9WYm5zwlC5
+UA5eky5YhETFJ25dIaplMm47aIbPSH5f9y5eYPkfOCoMu5oDzDzoXdH9V1YfsHqa
+8bboSgTdariC23x38E9PaWQNyY2MFKL6cFt2ilIsMSSD6JAm1x8kBtn1bBopG588
+7mTDtlqHCw/QrTuLreJG9KJ1dQFJ/Q42+csH09l081wlv4BBuVlN1Xmj+c2sWn90
+l1BPZfYHd9jhggI96yTZhfTfFbSMSuGPQyqHnwDYdA3cNj5BYievBkO5FZaCe9SZ
+4xcYgqlVpv15O7VrD+I=
+=Uugw
+-----END PGP PUBLIC KEY BLOCK-----
diff --git a/sources b/sources
index 08489e3..e157acd 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.16.10.tar.xz) = cb140fd577042ddeb7a47bc5e132d405d885bed22c9aeecb3d91a9115481ce4380ef191f78ba7acc9580ad0d4c8ed2658643007adf5b5527060879f34efdf8f7
-SHA512 (bind-9.16.10.tar.xz.asc) = 9ab68e1628ea953996190e754476c37e27a3c0f2b2d391c86e1da96930fddbcd5792df13cc5012d8b9f28c5565950a7d1d8ad36b8bef5abec90e407872724bf8
+SHA512 (bind-9.16.11.tar.xz) = 5ed632df7c74f5e6693db9b378450ea3073b8002e9924df1d0465f8b8edb933df3a853d3965a290a0477a67ca2bfa79f679d7e344db08a65462860c58d04dc1b
+SHA512 (bind-9.16.11.tar.xz.asc) = 90f548c13f617b4f0db2bfe0af9e357cd67ebcfff861114c2d45a3b33867070023cac2112f30ba965d2260d43c46d5e739c05143e44fa78ee1df1e0c8478ecdf

From 21682d00a6ede861ab834e78e0b9d6a4209db162 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 21 Jan 2021 11:55:40 +0100
Subject: [PATCH 232/460] Avoid failures during unit tests

Unit tests fail always on builders with 56 cores. There is issue with
limit of threads count in netmgr. Internal counter in hp.c does not
reset on each unit tests teardown. With many cores, it can lead to
assertion failures during the test.
---
 bind-9.16-unit-tests-multicore.patch | 84 ++++++++++++++++++++++++++++
 bind.spec                            |  4 ++
 2 files changed, 88 insertions(+)
 create mode 100644 bind-9.16-unit-tests-multicore.patch

diff --git a/bind-9.16-unit-tests-multicore.patch b/bind-9.16-unit-tests-multicore.patch
new file mode 100644
index 0000000..8ca0448
--- /dev/null
+++ b/bind-9.16-unit-tests-multicore.patch
@@ -0,0 +1,84 @@
+From 0175b942efc2fb6a05a2c76d62a9fb9157141757 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
+Date: Wed, 20 Jan 2021 01:01:52 +0100
+Subject: [PATCH] Workaround errors in unit test on 56 CPU machine
+
+hp.c should be just implementation detail, but unit tests use it
+repeatedly without resetting tid_v_base. Reset the base counter, when
+number of processors is configured. Configure it when creating network
+manager.
+
+Use id of current thread as a base. Should be usually 0, but must not be
+below id of the main thread.
+---
+ bin/named/main.c        | 7 -------
+ lib/isc/hp.c            | 1 +
+ lib/isc/netmgr/netmgr.c | 8 ++++++++
+ 3 files changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/bin/named/main.c b/bin/named/main.c
+index 9836de9d7f..d1be43a632 100644
+--- a/bin/named/main.c
++++ b/bin/named/main.c
+@@ -24,7 +24,6 @@
+ #include <isc/dir.h>
+ #include <isc/file.h>
+ #include <isc/hash.h>
+-#include <isc/hp.h>
+ #include <isc/httpd.h>
+ #include <isc/netmgr.h>
+ #include <isc/os.h>
+@@ -909,12 +908,6 @@ create_managers(void) {
+ 		      "using %u UDP listener%s per interface", named_g_udpdisp,
+ 		      named_g_udpdisp == 1 ? "" : "s");
+ 
+-	/*
+-	 * We have ncpus network threads, ncpus worker threads, ncpus
+-	 * old network threads - make it 4x just to be safe. The memory
+-	 * impact is negligible.
+-	 */
+-	isc_hp_init(4 * named_g_cpus);
+ 	named_g_nm = isc_nm_start(named_g_mctx, named_g_cpus);
+ 	if (named_g_nm == NULL) {
+ 		UNEXPECTED_ERROR(__FILE__, __LINE__, "isc_nm_start() failed");
+diff --git a/lib/isc/hp.c b/lib/isc/hp.c
+index 3ea13bbe24..e4a98afc82 100644
+--- a/lib/isc/hp.c
++++ b/lib/isc/hp.c
+@@ -95,6 +95,7 @@ void
+ isc_hp_init(int max_threads) {
+ 	isc__hp_max_threads = max_threads;
+ 	isc__hp_max_retired = max_threads * HP_MAX_HPS;
++	atomic_store_release(&tid_v_base, tid());
+ }
+ 
+ isc_hp_t *
+diff --git a/lib/isc/netmgr/netmgr.c b/lib/isc/netmgr/netmgr.c
+index 46f0758620..e3469f4c3a 100644
+--- a/lib/isc/netmgr/netmgr.c
++++ b/lib/isc/netmgr/netmgr.c
+@@ -17,6 +17,7 @@
+ #include <isc/buffer.h>
+ #include <isc/condition.h>
+ #include <isc/errno.h>
++#include <isc/hp.h>
+ #include <isc/magic.h>
+ #include <isc/mem.h>
+ #include <isc/netmgr.h>
+@@ -238,6 +239,13 @@ isc_nm_start(isc_mem_t *mctx, uint32_t workers) {
+ 	atomic_init(&mgr->keepalive, 30000);
+ 	atomic_init(&mgr->advertised, 30000);
+ 
++	/*
++	 * We have ncpus network threads, ncpus worker threads, ncpus
++	 * old network threads - make it 4x just to be safe. The memory
++	 * impact is negligible.
++	 */
++	isc_hp_init(4 * workers);
++
+ 	isc_mutex_init(&mgr->reqlock);
+ 	isc_mempool_create(mgr->mctx, sizeof(isc__nm_uvreq_t), &mgr->reqpool);
+ 	isc_mempool_setname(mgr->reqpool, "nm_reqpool");
+-- 
+2.26.2
+
diff --git a/bind.spec b/bind.spec
index a4017f4..989efb9 100644
--- a/bind.spec
+++ b/bind.spec
@@ -118,6 +118,8 @@ Patch157:bind-9.11-fips-tests.patch
 Patch164:bind-9.11-rh1666814.patch
 Patch170:bind-9.11-feature-test-named.patch
 Patch171:bind-9.11-tests-variants.patch
+# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/4582
+Patch172:bind-9.16-unit-tests-multicore.patch
 
 Requires(post):   systemd
 Requires(preun):  systemd
@@ -431,6 +433,7 @@ in HTML and PDF format.
 %patch164 -p1 -b .rh1666814
 %patch170 -p1 -b .featuretest-named
 %patch171 -p1 -b .test-variant
+%patch172 -p1 -b .multicore
 
 %if %{with PKCS11}
 %patch135 -p1 -b .config-pkcs11
@@ -1157,6 +1160,7 @@ fi;
 %changelog
 * Thu Jan 21 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.11-1
 - Update to 9.16.11 (#1827602)
+- Avoid unit test failures on machines with many cores
 
 * Thu Jan 14 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.10-2
 - Update to 9.16.10

From 84e2317aef685da5ba32268db0d9abe7b9799362 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 21 Jan 2021 13:06:07 +0100
Subject: [PATCH 233/460] Increase open files limit for unit tests

On machines with high CPU cores, few lib/ns unit tests fail due to not
enough file descriptors. Increase limit, it would be set higher on 40+
core machines anyway.
---
 bind.spec | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/bind.spec b/bind.spec
index 989efb9..0ce9484 100644
--- a/bind.spec
+++ b/bind.spec
@@ -598,12 +598,15 @@ export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0"
 
 %if %{with UNITTEST}
   pushd build
+  ORIGFILES=$(ulimit -n)
+  ulimit -n 4096 # Requires on some machines with many cores
   make unit
   e=$?
   if [ "$e" -ne 0 ]; then
     echo "ERROR: this build of BIND failed 'make unit'. Aborting."
     exit $e;
   fi;
+  ulimit -n $ORIGFILES
   popd
 ## End of UNITTEST
 %endif

From c37bc659facb9c7e64420366d5e0015321f2edad Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 25 Jan 2021 22:43:45 +0100
Subject: [PATCH 234/460] Check freeipa test results on each update

Require explicit waiving update, if the test fails. Last update did not
go well without this.
---
 gating.yaml | 7 +++++++
 1 file changed, 7 insertions(+)
 create mode 100644 gating.yaml

diff --git a/gating.yaml b/gating.yaml
new file mode 100644
index 0000000..cc8a043
--- /dev/null
+++ b/gating.yaml
@@ -0,0 +1,7 @@
+--- !Policy
+product_versions:
+  - fedora-*
+decision_context: bodhi_update_push_stable
+rules:
+  - !PassingTestCaseRule {test_case_name: update.server_freeipa_replication_master}
+# fedora-ci.koji-build.tier0.functional is not yet stable, cannot enable it

From 8713f270d5e970ec15fece7051a4fc50cdbd9eda Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Tue, 26 Jan 2021 01:08:32 +0000
Subject: [PATCH 235/460] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
---
 bind.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index 0ce9484..946f8db 100644
--- a/bind.spec
+++ b/bind.spec
@@ -66,7 +66,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.16.11
-Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1161,6 +1161,9 @@ fi;
 %endif
 
 %changelog
+* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.16.11-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
+
 * Thu Jan 21 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.11-1
 - Update to 9.16.11 (#1827602)
 - Avoid unit test failures on machines with many cores

From a6938e85a73d21fd58b21c17b02803907a2a57bc Mon Sep 17 00:00:00 2001
From: Pavel Raiskup <praiskup@redhat.com>
Date: Mon, 8 Feb 2021 09:22:52 +0100
Subject: [PATCH 236/460] rebuild for libpq ABI fix

Related: rhbz#1908268
---
 bind.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index 946f8db..c67b140 100644
--- a/bind.spec
+++ b/bind.spec
@@ -66,7 +66,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.16.11
-Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  3%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1161,6 +1161,9 @@ fi;
 %endif
 
 %changelog
+* Mon Feb 08 2021 Pavel Raiskup <praiskup@redhat.com> - 32:9.16.11-3
+- rebuild for libpq ABI fix rhbz#1908268
+
 * Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.16.11-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
 

From 9bba50dd4ade8444469bcf3d374c3358ded44ce2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 27 Jan 2021 14:36:55 +0100
Subject: [PATCH 237/460] Set ulimit only with many CPUs

Allow ulimit setting fail without breaking the build.
Some builders do not allow changing ulimit, that would not be a problem
on most of builders. Use it more a hint than requirement.
---
 bind.spec | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/bind.spec b/bind.spec
index c67b140..4e3ad7e 100644
--- a/bind.spec
+++ b/bind.spec
@@ -598,15 +598,18 @@ export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0"
 
 %if %{with UNITTEST}
   pushd build
-  ORIGFILES=$(ulimit -n)
-  ulimit -n 4096 # Requires on some machines with many cores
+  CPUS=$(lscpu -p=cpu,core | grep -v '^#' | wc -l)
+  if [ "$CPUS" -gt 16 ]; then
+    ORIGFILES=$(ulimit -n)
+    ulimit -n 4096 || : # Requires on some machines with many cores
+  fi
   make unit
   e=$?
   if [ "$e" -ne 0 ]; then
     echo "ERROR: this build of BIND failed 'make unit'. Aborting."
     exit $e;
   fi;
-  ulimit -n $ORIGFILES
+  [ "$CPUS" -gt 16 ] && ulimit -n $ORIGFILES || :
   popd
 ## End of UNITTEST
 %endif

From 71c1a9ec1e7e0cf272f96c7322c6f7c61c53a675 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 22 Feb 2021 21:42:44 +0100
Subject: [PATCH 238/460] Fix off-by-one bug in ISC SPNEGO implementation
 (#1929965)

Because of other failures in rebase, doing just security patch this
time.
---
 bind-9.16-CVE-2020-8625.patch | 45 +++++++++++++++++++++++++++++++++++
 bind.spec                     |  8 ++++++-
 2 files changed, 52 insertions(+), 1 deletion(-)
 create mode 100644 bind-9.16-CVE-2020-8625.patch

diff --git a/bind-9.16-CVE-2020-8625.patch b/bind-9.16-CVE-2020-8625.patch
new file mode 100644
index 0000000..ce92a48
--- /dev/null
+++ b/bind-9.16-CVE-2020-8625.patch
@@ -0,0 +1,45 @@
+From b04cb88462863d762093760ffcfe1946200e30f5 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
+Date: Thu, 7 Jan 2021 10:44:46 +0100
+Subject: [PATCH] Fix off-by-one bug in ISC SPNEGO implementation
+
+The ISC SPNEGO implementation is based on mod_auth_kerb code.  When
+CVE-2006-5989 was disclosed, the relevant fix was not applied to the
+BIND 9 codebase, making the latter vulnerable to the aforementioned flaw
+when "tkey-gssapi-keytab" or "tkey-gssapi-credential" is set in
+named.conf.
+
+The original description of CVE-2006-5989 was:
+
+    Off-by-one error in the der_get_oid function in mod_auth_kerb 5.0
+    allows remote attackers to cause a denial of service (crash) via a
+    crafted Kerberos message that triggers a heap-based buffer overflow
+    in the component array.
+
+Later research revealed that this flaw also theoretically enables remote
+code execution, though achieving the latter in real-world conditions is
+currently deemed very difficult.
+
+This vulnerability was responsibly reported as ZDI-CAN-12302 ("ISC BIND
+TKEY Query Heap-based Buffer Overflow Remote Code Execution
+Vulnerability") by Trend Micro Zero Day Initiative.
+---
+ lib/dns/spnego.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/dns/spnego.c b/lib/dns/spnego.c
+index e61d1c600f..753dc8049f 100644
+--- a/lib/dns/spnego.c
++++ b/lib/dns/spnego.c
+@@ -848,7 +848,7 @@ der_get_oid(const unsigned char *p, size_t len, oid *data, size_t *size) {
+ 		return (ASN1_OVERRUN);
+ 	}
+ 
+-	data->components = malloc(len * sizeof(*data->components));
++	data->components = malloc((len + 1) * sizeof(*data->components));
+ 	if (data->components == NULL) {
+ 		return (ENOMEM);
+ 	}
+-- 
+2.26.2
+
diff --git a/bind.spec b/bind.spec
index 4e3ad7e..cb333e1 100644
--- a/bind.spec
+++ b/bind.spec
@@ -66,7 +66,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.16.11
-Release:  3%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  4%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -120,6 +120,8 @@ Patch170:bind-9.11-feature-test-named.patch
 Patch171:bind-9.11-tests-variants.patch
 # https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/4582
 Patch172:bind-9.16-unit-tests-multicore.patch
+# https://gitlab.isc.org/isc-projects/bind9/commit/b04cb88462863d762093760ffcfe1946200e30f5
+Patch173:bind-9.16-CVE-2020-8625.patch
 
 Requires(post):   systemd
 Requires(preun):  systemd
@@ -434,6 +436,7 @@ in HTML and PDF format.
 %patch170 -p1 -b .featuretest-named
 %patch171 -p1 -b .test-variant
 %patch172 -p1 -b .multicore
+%patch173 -p1 -b .CVE-2020-8625
 
 %if %{with PKCS11}
 %patch135 -p1 -b .config-pkcs11
@@ -1164,6 +1167,9 @@ fi;
 %endif
 
 %changelog
+* Mon Feb 22 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.11-4
+- Fix off-by-one bug in ISC SPNEGO implementation (#1929965)
+
 * Mon Feb 08 2021 Pavel Raiskup <praiskup@redhat.com> - 32:9.16.11-3
 - rebuild for libpq ABI fix rhbz#1908268
 

From 55f06ea072e5037f65a56e6d905d0f5a4709c5fb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 22 Feb 2021 23:13:22 +0100
Subject: [PATCH 239/460] Temporary unit tests disabled

Kyua is broken on some architectures, it just cannot pass any test.
Disable it to make builds working.
---
 bind.spec | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index cb333e1..fed67e0 100644
--- a/bind.spec
+++ b/bind.spec
@@ -19,7 +19,8 @@
 # New MaxMind GeoLite support
 %bcond_without GEOIP2
 %if 0%{?fedora} >= 28
-%bcond_without UNITTEST
+# Disabled temporarily until kyua is fixed on rawhide, bug #1926779
+%bcond_with UNITTEST
 %bcond_without DNSTAP
 %bcond_without LMDB
 %bcond_without DOC

From d4a07bb1cc9a5065239e1dcf656d5de44d45b40e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 26 Feb 2021 19:37:51 +0100
Subject: [PATCH 240/460] Make logrotate.d world-readable (#1917061)

---
 bind.spec | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/bind.spec b/bind.spec
index fed67e0..9f89fea 100644
--- a/bind.spec
+++ b/bind.spec
@@ -67,7 +67,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.16.11
-Release:  4%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  5%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -939,6 +939,7 @@ fi;
 %exclude %{_libdir}/named/dlz_*.so
 %config(noreplace) %verify(not md5 size mtime) %{_sysconfdir}/sysconfig/named
 %config(noreplace) %attr(0644,root,named) %{_sysconfdir}/named.root.key
+%config(noreplace) %{_sysconfdir}/logrotate.d/named
 %{_tmpfilesdir}/named.conf
 %{_sysconfdir}/rwtab.d/named
 %{_unitdir}/named.service
@@ -985,7 +986,6 @@ fi;
 %ghost %config(noreplace) %{_sysconfdir}/rndc.conf
 # ^- The default rndc.conf which uses rndc.key is in named's default internal config -
 #    so rndc.conf is not necessary.
-%config(noreplace) %{_sysconfdir}/logrotate.d/named
 %defattr(-,named,named,-)
 %dir /run/named
 
@@ -1168,6 +1168,9 @@ fi;
 %endif
 
 %changelog
+* Fri Feb 26 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.11-5
+- Make logrotate.d world-readable (#1917061)
+
 * Mon Feb 22 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.11-4
 - Fix off-by-one bug in ISC SPNEGO implementation (#1929965)
 

From 718b1f98f867eeba35a99c6dd167a605dd664cfe Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
Date: Tue, 2 Mar 2021 16:14:12 +0100
Subject: [PATCH 241/460] Rebuilt for updated systemd-rpm-macros

See https://pagure.io/fesco/issue/2583.
---
 bind.spec | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index 9f89fea..70a7b73 100644
--- a/bind.spec
+++ b/bind.spec
@@ -67,7 +67,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.16.11
-Release:  5%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  6%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1168,6 +1168,10 @@ fi;
 %endif
 
 %changelog
+* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 32:9.16.11-6
+- Rebuilt for updated systemd-rpm-macros
+  See https://pagure.io/fesco/issue/2583.
+
 * Fri Feb 26 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.11-5
 - Make logrotate.d world-readable (#1917061)
 

From f182202f6ea6305ddfcac02797269203115571dd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 3 Mar 2021 10:41:50 +0100
Subject: [PATCH 242/460] Freeipa tests were wrong and matched elsewhere

OpenQA tests are already started for critpath components. Freeipa
results are checked by Fedora critpath checks, it does not need to be in
gating.yaml.

Check fedora-infra/ansible repo,
roles/openshift-apps/greenwave/templates/fedora.yaml for details.
---
 gating.yaml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/gating.yaml b/gating.yaml
index cc8a043..ecab956 100644
--- a/gating.yaml
+++ b/gating.yaml
@@ -2,6 +2,5 @@
 product_versions:
   - fedora-*
 decision_context: bodhi_update_push_stable
-rules:
-  - !PassingTestCaseRule {test_case_name: update.server_freeipa_replication_master}
+rules: []
 # fedora-ci.koji-build.tier0.functional is not yet stable, cannot enable it

From 76074cd59a69a940a8d4d165d5ed1c77d397cd10 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 25 Mar 2021 22:17:54 +0100
Subject: [PATCH 243/460] Update to 9.16.13

Reworked custom redhat version. Complete version is now part of library
names. Libraries are not recommended for any third party application.
They are still required for bind-dyndb-ldap only.

Version of named changed, only suffix -RH is appended to upstream
version. Therefore dig would not contain version
9.6.11-RedHat-9.6.11-1.fc34, but only 9.6.13-RH. Version of fedora build
have to be obtained from rpm -q bind.

Version is now part of library names, bind-libs-lite was merged to
bind-libs. bind-dyndb-ldap needs whole bind, no point to offer smaller
library set just for its dependencies.

Updated also named(8) manual page to match current state of SELinux.
---
 .gitignore                           |  2 +
 bind-9.10-dist-native-pkcs11.patch   | 67 +++++++++++-----------
 bind-9.11-fips-tests.patch           | 86 +++++++++++++++++-----------
 bind-9.14-config-pkcs11.patch        | 12 ++--
 bind-9.16-CVE-2020-8625.patch        | 45 ---------------
 bind-9.16-redhat_doc.patch           | 44 +++++---------
 bind-9.16-unit-tests-multicore.patch | 84 ---------------------------
 bind.spec                            | 71 +++++++++--------------
 bind99-rh640538.patch                |  8 +--
 sources                              |  4 +-
 10 files changed, 142 insertions(+), 281 deletions(-)
 delete mode 100644 bind-9.16-CVE-2020-8625.patch
 delete mode 100644 bind-9.16-unit-tests-multicore.patch

diff --git a/.gitignore b/.gitignore
index 27084be..afa828e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -142,3 +142,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.16.10.tar.xz.asc
 /bind-9.16.11.tar.xz
 /bind-9.16.11.tar.xz.asc
+/bind-9.16.13.tar.xz
+/bind-9.16.13.tar.xz.asc
diff --git a/bind-9.10-dist-native-pkcs11.patch b/bind-9.10-dist-native-pkcs11.patch
index 119884e..2003f1b 100644
--- a/bind-9.10-dist-native-pkcs11.patch
+++ b/bind-9.10-dist-native-pkcs11.patch
@@ -1,4 +1,4 @@
-From 9091161562587fe7ab017fc4042143987514a643 Mon Sep 17 00:00:00 2001
+From 17c6e65cde059c98d48ae3b948aa157865d1c99c Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Thu, 21 Jan 2021 10:46:20 +0100
 Subject: [PATCH] Enable custom pkcs11 native build
@@ -151,7 +151,7 @@ index ace0e5a..e0f6a00 100644
  	dnssec-importkey.@O@ ${OBJS} ${LIBS}
  
 diff --git a/bin/named-pkcs11/Makefile.in b/bin/named-pkcs11/Makefile.in
-index 525f505..d517ec6 100644
+index 98125dd..518a75f 100644
 --- a/bin/named-pkcs11/Makefile.in
 +++ b/bin/named-pkcs11/Makefile.in
 @@ -37,13 +37,14 @@ DBDRIVER_LIBS =
@@ -174,7 +174,7 @@ index 525f505..d517ec6 100644
  		${BIND9_INCLUDES} ${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} \
  		${ISC_INCLUDES} ${DLZDRIVER_INCLUDES} \
  		${DBDRIVER_INCLUDES} \
-@@ -55,24 +56,24 @@ CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
+@@ -56,24 +57,24 @@ CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
  		${LIBXML2_CFLAGS} \
  		${MAXMINDDB_CFLAGS}
  
@@ -204,7 +204,7 @@ index 525f505..d517ec6 100644
  
  DEPLIBS =	${NSDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
  		${ISCCFGDEPLIBS} ${ISCCCDEPLIBS} ${ISCDEPLIBS}
-@@ -92,7 +93,7 @@ NOSYMLIBS =	${NSLIBS} ${DNSLIBS} ${BIND9LIBS} \
+@@ -93,7 +94,7 @@ NOSYMLIBS =	${NSLIBS} ${DNSLIBS} ${BIND9LIBS} \
  
  SUBDIRS =	unix
  
@@ -213,7 +213,7 @@ index 525f505..d517ec6 100644
  
  GEOIP2LINKOBJS = geoip.@O@
  
-@@ -150,7 +151,7 @@ server.@O@: server.c
+@@ -151,7 +152,7 @@ server.@O@: server.c
  		-DPRODUCT=\"${PRODUCT}\" \
  		-DVERSION=\"${VERSION}\" -c ${srcdir}/server.c
  
@@ -222,7 +222,7 @@ index 525f505..d517ec6 100644
  	export MAKE_SYMTABLE="yes"; \
  	export BASEOBJS="${OBJS} ${UOBJS}"; \
  	${FINALBUILDCMD}
-@@ -160,7 +161,7 @@ feature-test.@O@: ${top_srcdir}/bin/tests/system/feature-test.c
+@@ -161,7 +162,7 @@ feature-test.@O@: ${top_srcdir}/bin/tests/system/feature-test.c
  	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} \
  		-c ${top_srcdir}/bin/tests/system/feature-test.c
  
@@ -231,7 +231,7 @@ index 525f505..d517ec6 100644
  	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} \
  		-o $@ feature-test.@O@ ${ISCLIBS} ${LIBS}
  
-@@ -179,11 +180,11 @@ statschannel.@O@: bind9.xsl.h
+@@ -180,11 +181,11 @@ statschannel.@O@: bind9.xsl.h
  installdirs:
  	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
  
@@ -247,10 +247,10 @@ index 525f505..d517ec6 100644
  @DLZ_DRIVER_RULES@
  
 diff --git a/configure.ac b/configure.ac
-index 02e36a7..f1f50fe 100644
+index 08a7d8a..4d762c9 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -1245,12 +1245,14 @@ AC_SUBST(USE_GSSAPI)
+@@ -1251,12 +1251,14 @@ AC_SUBST(USE_GSSAPI)
  AC_SUBST(DST_GSSAPI_INC)
  AC_SUBST(DNS_GSSAPI_LIBS)
  DNS_CRYPTO_LIBS="$DNS_GSSAPI_LIBS"
@@ -265,7 +265,7 @@ index 02e36a7..f1f50fe 100644
  
  #
  # was --with-lmdb specified?
-@@ -2344,6 +2346,8 @@ AC_SUBST(BIND9_DNS_BUILDINCLUDE)
+@@ -2352,6 +2354,8 @@ AC_SUBST(BIND9_DNS_BUILDINCLUDE)
  AC_SUBST(BIND9_NS_BUILDINCLUDE)
  AC_SUBST(BIND9_BIND9_BUILDINCLUDE)
  AC_SUBST(BIND9_IRS_BUILDINCLUDE)
@@ -274,7 +274,7 @@ index 02e36a7..f1f50fe 100644
  if test "X$srcdir" != "X"; then
  	BIND9_ISC_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/isc/include"
  	BIND9_ISCCC_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/isccc/include"
-@@ -2352,6 +2356,8 @@ if test "X$srcdir" != "X"; then
+@@ -2360,6 +2364,8 @@ if test "X$srcdir" != "X"; then
  	BIND9_NS_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/ns/include"
  	BIND9_BIND9_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/bind9/include"
  	BIND9_IRS_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/irs/include"
@@ -283,7 +283,7 @@ index 02e36a7..f1f50fe 100644
  else
  	BIND9_ISC_BUILDINCLUDE=""
  	BIND9_ISCCC_BUILDINCLUDE=""
-@@ -2360,6 +2366,8 @@ else
+@@ -2368,6 +2374,8 @@ else
  	BIND9_NS_BUILDINCLUDE=""
  	BIND9_BIND9_BUILDINCLUDE=""
  	BIND9_IRS_BUILDINCLUDE=""
@@ -292,7 +292,7 @@ index 02e36a7..f1f50fe 100644
  fi
  
  AC_SUBST_FILE(BIND9_MAKE_INCLUDES)
-@@ -2830,8 +2838,11 @@ AC_CONFIG_FILES([
+@@ -2823,8 +2831,11 @@ AC_CONFIG_FILES([
  	bin/delv/Makefile
  	bin/dig/Makefile
  	bin/dnssec/Makefile
@@ -304,7 +304,7 @@ index 02e36a7..f1f50fe 100644
  	bin/nsupdate/Makefile
  	bin/pkcs11/Makefile
  	bin/plugins/Makefile
-@@ -2893,6 +2904,10 @@ AC_CONFIG_FILES([
+@@ -2886,6 +2897,10 @@ AC_CONFIG_FILES([
  	lib/dns/include/dns/Makefile
  	lib/dns/include/dst/Makefile
  	lib/dns/tests/Makefile
@@ -315,7 +315,7 @@ index 02e36a7..f1f50fe 100644
  	lib/irs/Makefile
  	lib/irs/include/Makefile
  	lib/irs/include/irs/Makefile
-@@ -2925,6 +2940,10 @@ AC_CONFIG_FILES([
+@@ -2918,6 +2933,10 @@ AC_CONFIG_FILES([
  	lib/ns/include/Makefile
  	lib/ns/include/ns/Makefile
  	lib/ns/tests/Makefile
@@ -340,10 +340,10 @@ index ffa2d5a..6fbc192 100644
  
  @BIND9_MAKE_RULES@
 diff --git a/lib/dns-pkcs11/Makefile.in b/lib/dns-pkcs11/Makefile.in
-index 8de85bf..d5c3c2b 100644
+index 283b7f2..a234dc5 100644
 --- a/lib/dns-pkcs11/Makefile.in
 +++ b/lib/dns-pkcs11/Makefile.in
-@@ -26,7 +26,7 @@ VERSION=@BIND9_VERSION@
+@@ -24,7 +24,7 @@ VERSION=@BIND9_VERSION@
  
  USE_ISC_SPNEGO = @USE_ISC_SPNEGO@
  
@@ -352,7 +352,7 @@ index 8de85bf..d5c3c2b 100644
  		${ISC_INCLUDES} \
  		${FSTRM_CFLAGS} \
  		${OPENSSL_CFLAGS} @DST_GSSAPI_INC@ \
-@@ -36,7 +36,7 @@ CINCLUDES =	-I. -I${top_srcdir}/lib/dns -Iinclude ${DNS_INCLUDES} \
+@@ -34,7 +34,7 @@ CINCLUDES =	-I. -I${top_srcdir}/lib/dns -Iinclude ${DNS_INCLUDES} \
  		${LMDB_CFLAGS} \
  		${MAXMINDDB_CFLAGS}
  
@@ -361,8 +361,8 @@ index 8de85bf..d5c3c2b 100644
  
  CWARNINGS =
  
-@@ -142,15 +142,15 @@ version.@O@: version.c
- 		-DLIBAGE=${LIBAGE} \
+@@ -137,15 +137,15 @@ version.@O@: version.c
+ 		-DMAPAPI=\"${MAPAPI}\" \
  		-c ${srcdir}/version.c
  
 -libdns.@SA@: ${OBJS}
@@ -375,13 +375,13 @@ index 8de85bf..d5c3c2b 100644
  	${LIBTOOL_MODE_LINK} \
 -		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libdns.la -rpath ${libdir} \
 +		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libdns-pkcs11.la -rpath ${libdir} \
- 		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
+ 		-release "${VERSION}" \
 -		${OBJS} ${ISCLIBS} @DNS_CRYPTO_LIBS@ ${LIBS}
 +		${OBJS} ${ISCLIBS} @DNS_CRYPTO_PK11_LIBS@ ${LIBS}
  
  include: gen
  	${MAKE} include/dns/enumtype.h
-@@ -181,22 +181,22 @@ gen: gen.c
+@@ -176,22 +176,22 @@ gen: gen.c
  	${BUILD_CPPFLAGS} ${BUILD_LDFLAGS} -o $@ ${srcdir}/gen.c \
  	${BUILD_LIBS} ${LFS_LIBS}
  
@@ -410,16 +410,17 @@ index 8de85bf..d5c3c2b 100644
  	rm -f include/dns/rdatastruct.h
  	rm -f dnstap.pb-c.c dnstap.pb-c.h
 diff --git a/lib/dns-pkcs11/tests/Makefile.in b/lib/dns-pkcs11/tests/Makefile.in
-index a56c7d3..768ead8 100644
+index 3bb5e01..c96fe7d 100644
 --- a/lib/dns-pkcs11/tests/Makefile.in
 +++ b/lib/dns-pkcs11/tests/Makefile.in
-@@ -15,14 +15,14 @@ VERSION=@BIND9_VERSION@
+@@ -15,15 +15,15 @@ VERSION=@BIND9_VERSION@
  
  @BIND9_MAKE_INCLUDES@
  
 -CINCLUDES =	-I. -Iinclude ${DNS_INCLUDES} ${ISC_INCLUDES} \
 +CINCLUDES =	-I. -Iinclude ${DNS_PKCS11_INCLUDES} ${ISC_INCLUDES} \
- 		${OPENSSL_CFLAGS} ${MAXMINDDB_CFLAGS} @CMOCKA_CFLAGS@
+ 		${FSTRM_CFLAGS} ${OPENSSL_CFLAGS} \
+ 		${PROTOBUF_C_CFLAGS} ${MAXMINDDB_CFLAGS} @CMOCKA_CFLAGS@
 -CDEFINES =	-DTESTS="\"${top_builddir}/lib/dns/tests/\""
 +CDEFINES =	@USE_PKCS11@ -DTESTS="\"${top_builddir}/lib/dns-pkcs11/tests/\""
  
@@ -433,10 +434,10 @@ index a56c7d3..768ead8 100644
  LIBS =		@LIBS@ @CMOCKA_LIBS@
  
 diff --git a/lib/ns-pkcs11/Makefile.in b/lib/ns-pkcs11/Makefile.in
-index d00ddaf..b867afe 100644
+index f126f1f..21b20e4 100644
 --- a/lib/ns-pkcs11/Makefile.in
 +++ b/lib/ns-pkcs11/Makefile.in
-@@ -20,12 +20,12 @@ VERSION=@BIND9_VERSION@
+@@ -18,12 +18,12 @@ VERSION=@BIND9_VERSION@
  
  USE_ISC_SPNEGO = @USE_ISC_SPNEGO@
  
@@ -452,7 +453,7 @@ index d00ddaf..b867afe 100644
  
  CWARNINGS =
  
-@@ -33,9 +33,9 @@ ISCLIBS =	../../lib/isc/libisc.@A@
+@@ -31,9 +31,9 @@ ISCLIBS =	../../lib/isc/libisc.@A@
  
  ISCDEPLIBS =	../../lib/isc/libisc.@A@
  
@@ -464,8 +465,8 @@ index d00ddaf..b867afe 100644
  
  LIBS =		@LIBS@
  
-@@ -67,28 +67,28 @@ version.@O@: version.c
- 		-DLIBAGE=${LIBAGE} \
+@@ -62,28 +62,28 @@ version.@O@: version.c
+ 		-DMAJOR=\"${MAJOR}\" \
  		-c ${srcdir}/version.c
  
 -libns.@SA@: ${OBJS}
@@ -478,7 +479,7 @@ index d00ddaf..b867afe 100644
  	${LIBTOOL_MODE_LINK} \
 -		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libns.la -rpath ${libdir} \
 +		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libns-pkcs11.la -rpath ${libdir} \
- 		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
+ 		-release "${VERSION}" \
 -		${OBJS} ${ISCLIBS} ${DNSLIBS} @DNS_CRYPTO_LIBS@ ${LIBS}
 +		${OBJS} ${ISCLIBS} ${DNSLIBS} @DNS_CRYPTO_PK11_LIBS@ ${LIBS}
  
@@ -530,10 +531,10 @@ index 4c3e694..c1b6d99 100644
  LIBS =		@LIBS@ @CMOCKA_LIBS@
  
 diff --git a/make/includes.in b/make/includes.in
-index 5373a7e..f1901ee 100644
+index b8317d3..b73b0c4 100644
 --- a/make/includes.in
 +++ b/make/includes.in
-@@ -41,3 +41,10 @@ BIND9_INCLUDES = @BIND9_BIND9_BUILDINCLUDE@ \
+@@ -39,3 +39,10 @@ BIND9_INCLUDES = @BIND9_BIND9_BUILDINCLUDE@ \
  
  TEST_INCLUDES = \
  	-I${top_srcdir}/lib/tests/include
diff --git a/bind-9.11-fips-tests.patch b/bind-9.11-fips-tests.patch
index 03d7ad1..51927a4 100644
--- a/bind-9.11-fips-tests.patch
+++ b/bind-9.11-fips-tests.patch
@@ -1,4 +1,4 @@
-From cb648b203af5bf9085ad78d021f47c3baeb9b6e0 Mon Sep 17 00:00:00 2001
+From 3f04cf343dbeb8819197702ce1be737e26e0638a Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 2 Aug 2018 23:46:45 +0200
 Subject: [PATCH] FIPS tests changes
@@ -82,7 +82,7 @@ Date:   Wed Mar 7 10:44:23 2018 +0100
  bin/tests/system/nsupdate/ns1/named.conf.in   |  2 +-
  bin/tests/system/nsupdate/ns2/named.conf.in   |  2 +-
  bin/tests/system/nsupdate/setup.sh            |  6 +-
- bin/tests/system/nsupdate/tests.sh            | 11 +++-
+ bin/tests/system/nsupdate/tests.sh            | 15 +++--
  bin/tests/system/rndc/setup.sh                |  2 +-
  bin/tests/system/rndc/tests.sh                | 23 ++++---
  bin/tests/system/tsig/ns1/named.conf.in       | 10 +--
@@ -91,11 +91,11 @@ Date:   Wed Mar 7 10:44:23 2018 +0100
  bin/tests/system/tsig/tests.sh                | 65 ++++++++++++-------
  bin/tests/system/upforwd/ns1/named.conf.in    |  2 +-
  bin/tests/system/upforwd/tests.sh             |  2 +-
- 33 files changed, 160 insertions(+), 106 deletions(-)
+ 33 files changed, 162 insertions(+), 108 deletions(-)
  create mode 100644 bin/tests/system/tsig/ns1/rndc5.conf.in
 
 diff --git a/bin/tests/system/acl/ns2/named1.conf.in b/bin/tests/system/acl/ns2/named1.conf.in
-index 0ea6502..026db3f 100644
+index 60f22e1..249f672 100644
 --- a/bin/tests/system/acl/ns2/named1.conf.in
 +++ b/bin/tests/system/acl/ns2/named1.conf.in
 @@ -33,12 +33,12 @@ options {
@@ -114,7 +114,7 @@ index 0ea6502..026db3f 100644
  };
  
 diff --git a/bin/tests/system/acl/ns2/named2.conf.in b/bin/tests/system/acl/ns2/named2.conf.in
-index b877880..d8f50be 100644
+index ada97bc..f82d858 100644
 --- a/bin/tests/system/acl/ns2/named2.conf.in
 +++ b/bin/tests/system/acl/ns2/named2.conf.in
 @@ -33,12 +33,12 @@ options {
@@ -133,7 +133,7 @@ index b877880..d8f50be 100644
  };
  
 diff --git a/bin/tests/system/acl/ns2/named3.conf.in b/bin/tests/system/acl/ns2/named3.conf.in
-index 0a95062..aa54088 100644
+index 97684e4..de6a2e9 100644
 --- a/bin/tests/system/acl/ns2/named3.conf.in
 +++ b/bin/tests/system/acl/ns2/named3.conf.in
 @@ -33,17 +33,17 @@ options {
@@ -158,7 +158,7 @@ index 0a95062..aa54088 100644
  };
  
 diff --git a/bin/tests/system/acl/ns2/named4.conf.in b/bin/tests/system/acl/ns2/named4.conf.in
-index 7cdcb6e..606a345 100644
+index 462b3fa..994b35c 100644
 --- a/bin/tests/system/acl/ns2/named4.conf.in
 +++ b/bin/tests/system/acl/ns2/named4.conf.in
 @@ -33,12 +33,12 @@ options {
@@ -177,7 +177,7 @@ index 7cdcb6e..606a345 100644
  };
  
 diff --git a/bin/tests/system/acl/ns2/named5.conf.in b/bin/tests/system/acl/ns2/named5.conf.in
-index 7e20bac..9753a9d 100644
+index 728da58..8f00d09 100644
 --- a/bin/tests/system/acl/ns2/named5.conf.in
 +++ b/bin/tests/system/acl/ns2/named5.conf.in
 @@ -35,12 +35,12 @@ options {
@@ -196,7 +196,7 @@ index 7e20bac..9753a9d 100644
  };
  
 diff --git a/bin/tests/system/acl/tests.sh b/bin/tests/system/acl/tests.sh
-index b4d3045..ebbc798 100644
+index be59d64..13d5bdc 100644
 --- a/bin/tests/system/acl/tests.sh
 +++ b/bin/tests/system/acl/tests.sh
 @@ -22,14 +22,14 @@ echo_i "testing basic ACL processing"
@@ -322,7 +322,7 @@ index b4d3045..ebbc798 100644
  
  echo_i "testing allow-query-on ACL processing"
 diff --git a/bin/tests/system/allow-query/ns2/named10.conf.in b/bin/tests/system/allow-query/ns2/named10.conf.in
-index c5f38c9..00db0da 100644
+index 7d43e36..f7b25f9 100644
 --- a/bin/tests/system/allow-query/ns2/named10.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named10.conf.in
 @@ -10,7 +10,7 @@
@@ -335,7 +335,7 @@ index c5f38c9..00db0da 100644
  };
  
 diff --git a/bin/tests/system/allow-query/ns2/named11.conf.in b/bin/tests/system/allow-query/ns2/named11.conf.in
-index 56e5cc4..2c32b71 100644
+index 2952518..121557e 100644
 --- a/bin/tests/system/allow-query/ns2/named11.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named11.conf.in
 @@ -10,12 +10,12 @@
@@ -354,7 +354,7 @@ index 56e5cc4..2c32b71 100644
  };
  
 diff --git a/bin/tests/system/allow-query/ns2/named12.conf.in b/bin/tests/system/allow-query/ns2/named12.conf.in
-index 8381950..21a6366 100644
+index 0c01071..ceabbb5 100644
 --- a/bin/tests/system/allow-query/ns2/named12.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named12.conf.in
 @@ -10,7 +10,7 @@
@@ -367,7 +367,7 @@ index 8381950..21a6366 100644
  };
  
 diff --git a/bin/tests/system/allow-query/ns2/named30.conf.in b/bin/tests/system/allow-query/ns2/named30.conf.in
-index 0e5ff55..a90ed6a 100644
+index 4c17292..9cd9d1f 100644
 --- a/bin/tests/system/allow-query/ns2/named30.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named30.conf.in
 @@ -10,7 +10,7 @@
@@ -380,7 +380,7 @@ index 0e5ff55..a90ed6a 100644
  };
  
 diff --git a/bin/tests/system/allow-query/ns2/named31.conf.in b/bin/tests/system/allow-query/ns2/named31.conf.in
-index faadb3f..b99f337 100644
+index a2690a4..f488730 100644
 --- a/bin/tests/system/allow-query/ns2/named31.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named31.conf.in
 @@ -10,12 +10,12 @@
@@ -399,7 +399,7 @@ index faadb3f..b99f337 100644
  };
  
 diff --git a/bin/tests/system/allow-query/ns2/named32.conf.in b/bin/tests/system/allow-query/ns2/named32.conf.in
-index 9e78dd0..ea7a413 100644
+index a0708c8..51fa457 100644
 --- a/bin/tests/system/allow-query/ns2/named32.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named32.conf.in
 @@ -10,7 +10,7 @@
@@ -412,7 +412,7 @@ index 9e78dd0..ea7a413 100644
  };
  
 diff --git a/bin/tests/system/allow-query/ns2/named40.conf.in b/bin/tests/system/allow-query/ns2/named40.conf.in
-index f4bc399..e01f312 100644
+index 687768e..d24d6d2 100644
 --- a/bin/tests/system/allow-query/ns2/named40.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named40.conf.in
 @@ -14,12 +14,12 @@ acl accept { 10.53.0.2; };
@@ -431,7 +431,7 @@ index f4bc399..e01f312 100644
  };
  
 diff --git a/bin/tests/system/allow-query/tests.sh b/bin/tests/system/allow-query/tests.sh
-index 4cb2709..c0884cf 100644
+index fe40635..543c663 100644
 --- a/bin/tests/system/allow-query/tests.sh
 +++ b/bin/tests/system/allow-query/tests.sh
 @@ -182,7 +182,7 @@ rndc_reload ns2 10.53.0.2
@@ -516,7 +516,7 @@ index 4cb2709..c0884cf 100644
  grep '^a.keydisallow.example' dig.out.ns2.$n > /dev/null && ret=1
  if [ $ret != 0 ]; then echo_i "failed"; fi
 diff --git a/bin/tests/system/catz/ns1/named.conf.in b/bin/tests/system/catz/ns1/named.conf.in
-index 74b7d37..c353766 100644
+index 1218669..e62715e 100644
 --- a/bin/tests/system/catz/ns1/named.conf.in
 +++ b/bin/tests/system/catz/ns1/named.conf.in
 @@ -61,5 +61,5 @@ zone "catalog4.example" {
@@ -527,7 +527,7 @@ index 74b7d37..c353766 100644
 +	algorithm hmac-sha256;
  };
 diff --git a/bin/tests/system/catz/ns2/named.conf.in b/bin/tests/system/catz/ns2/named.conf.in
-index ee83efb..35ced08 100644
+index 30333e6..4005152 100644
 --- a/bin/tests/system/catz/ns2/named.conf.in
 +++ b/bin/tests/system/catz/ns2/named.conf.in
 @@ -70,5 +70,5 @@ zone "catalog4.example" {
@@ -551,10 +551,10 @@ index 21be03e..e57c308 100644
  };
  
 diff --git a/bin/tests/system/checkconf/good.conf b/bin/tests/system/checkconf/good.conf
-index 0dabe54..d55c51b 100644
+index e09b9e8..2e824b3 100644
 --- a/bin/tests/system/checkconf/good.conf
 +++ b/bin/tests/system/checkconf/good.conf
-@@ -204,6 +204,6 @@ dyndb "name" "library.so" {
+@@ -210,6 +210,6 @@ dyndb "name" "library.so" {
  	system;
  };
  key "mykey" {
@@ -563,7 +563,7 @@ index 0dabe54..d55c51b 100644
  	secret "qwertyuiopasdfgh";
  };
 diff --git a/bin/tests/system/feature-test.c b/bin/tests/system/feature-test.c
-index 4a90332..2f85b44 100644
+index 877504f..577660a 100644
 --- a/bin/tests/system/feature-test.c
 +++ b/bin/tests/system/feature-test.c
 @@ -14,6 +14,7 @@
@@ -574,7 +574,7 @@ index 4a90332..2f85b44 100644
  #include <isc/net.h>
  #include <isc/print.h>
  #include <isc/util.h>
-@@ -177,6 +178,19 @@ main(int argc, char **argv) {
+@@ -186,6 +187,19 @@ main(int argc, char **argv) {
  #endif /* ifdef DLZ_FILESYSTEM */
  	}
  
@@ -595,7 +595,7 @@ index 4a90332..2f85b44 100644
  #ifdef HAVE_LIBIDN2
  		return (0);
 diff --git a/bin/tests/system/notify/ns5/named.conf.in b/bin/tests/system/notify/ns5/named.conf.in
-index 2976bfc..256d846 100644
+index 1ee8df4..2b75d9a 100644
 --- a/bin/tests/system/notify/ns5/named.conf.in
 +++ b/bin/tests/system/notify/ns5/named.conf.in
 @@ -10,17 +10,17 @@
@@ -644,10 +644,10 @@ index 3d7e0b7..ec4d9a7 100644
  	grep "test string" dig.out.b.ns5.test$n > /dev/null &&
  	grep "test string" dig.out.c.ns5.test$n > /dev/null &&
 diff --git a/bin/tests/system/nsupdate/ns1/named.conf.in b/bin/tests/system/nsupdate/ns1/named.conf.in
-index 346b647..c018fb4 100644
+index b51e700..436c97d 100644
 --- a/bin/tests/system/nsupdate/ns1/named.conf.in
 +++ b/bin/tests/system/nsupdate/ns1/named.conf.in
-@@ -33,7 +33,7 @@ controls {
+@@ -37,7 +37,7 @@ controls {
  };
  
  key altkey {
@@ -657,7 +657,7 @@ index 346b647..c018fb4 100644
  };
  
 diff --git a/bin/tests/system/nsupdate/ns2/named.conf.in b/bin/tests/system/nsupdate/ns2/named.conf.in
-index b703843..8bfe2b0 100644
+index da6b3b4..c547e47 100644
 --- a/bin/tests/system/nsupdate/ns2/named.conf.in
 +++ b/bin/tests/system/nsupdate/ns2/named.conf.in
 @@ -32,7 +32,7 @@ controls {
@@ -687,13 +687,13 @@ index c055da3..4e1242b 100644
  $DDNSCONFGEN -q -a hmac-sha224 -k sha224-key -z keytests.nil > ns1/sha224.key
  $DDNSCONFGEN -q -a hmac-sha256 -k sha256-key -z keytests.nil > ns1/sha256.key
 diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh
-index b15fa2d..cb7979b 100755
+index b35d797..41c128e 100755
 --- a/bin/tests/system/nsupdate/tests.sh
 +++ b/bin/tests/system/nsupdate/tests.sh
 @@ -797,7 +797,14 @@ fi
  n=`expr $n + 1`
  ret=0
- echo_i "check TSIG key algorithms ($n)"
+ echo_i "check TSIG key algorithms (nsupdate -k) ($n)"
 -for alg in md5 sha1 sha224 sha256 sha384 sha512; do
 +if $FEATURETEST --md5
 +then
@@ -715,6 +715,24 @@ index b15fa2d..cb7979b 100755
      $DIG $DIGOPTS +short @10.53.0.1 ${alg}.keytests.nil | grep 10.10.10.3 > /dev/null 2>&1 || ret=1
  done
  if [ $ret -ne 0 ]; then
+@@ -816,7 +823,7 @@ fi
+ n=`expr $n + 1`
+ ret=0
+ echo_i "check TSIG key algorithms (nsupdate -y) ($n)"
+-for alg in md5 sha1 sha224 sha256 sha384 sha512; do
++for alg in $ALGS; do
+     secret=$(sed -n 's/.*secret "\(.*\)";.*/\1/p' ns1/${alg}.key)
+     $NSUPDATE -y "hmac-${alg}:${alg}-key:$secret" <<END > /dev/null || ret=1
+ server 10.53.0.1 ${PORT}
+@@ -825,7 +832,7 @@ send
+ END
+ done
+ sleep 2
+-for alg in md5 sha1 sha224 sha256 sha384 sha512; do
++for alg in $ALGS; do
+     $DIG $DIGOPTS +short @10.53.0.1 ${alg}.keytests.nil | grep 10.10.10.50 > /dev/null 2>&1 || ret=1
+ done
+ if [ $ret -ne 0 ]; then
 diff --git a/bin/tests/system/rndc/setup.sh b/bin/tests/system/rndc/setup.sh
 index b59e7a7..04d5f5a 100644
 --- a/bin/tests/system/rndc/setup.sh
@@ -729,7 +747,7 @@ index b59e7a7..04d5f5a 100644
  make_key 3 ${EXTRAPORT3} hmac-sha224
  make_key 4 ${EXTRAPORT4} hmac-sha256
 diff --git a/bin/tests/system/rndc/tests.sh b/bin/tests/system/rndc/tests.sh
-index 78508f3..a2a201e 100644
+index 9fd84ed..d0b188f 100644
 --- a/bin/tests/system/rndc/tests.sh
 +++ b/bin/tests/system/rndc/tests.sh
 @@ -348,15 +348,20 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -763,7 +781,7 @@ index 78508f3..a2a201e 100644
  n=`expr $n + 1`
  echo_i "testing rndc with hmac-sha1 ($n)"
 diff --git a/bin/tests/system/tsig/ns1/named.conf.in b/bin/tests/system/tsig/ns1/named.conf.in
-index 4ee703f..635434e 100644
+index 3470c4f..cf539cd 100644
 --- a/bin/tests/system/tsig/ns1/named.conf.in
 +++ b/bin/tests/system/tsig/ns1/named.conf.in
 @@ -21,10 +21,7 @@ options {
@@ -911,7 +929,7 @@ index 38d842a..668aa6f 100644
  
  echo_i "fetching using hmac-sha1-80 (BADTRUNC)"
 diff --git a/bin/tests/system/upforwd/ns1/named.conf.in b/bin/tests/system/upforwd/ns1/named.conf.in
-index ea42b4d..08676da 100644
+index 3873c7c..b359a5a 100644
 --- a/bin/tests/system/upforwd/ns1/named.conf.in
 +++ b/bin/tests/system/upforwd/ns1/named.conf.in
 @@ -10,7 +10,7 @@
@@ -924,10 +942,10 @@ index ea42b4d..08676da 100644
  };
  
 diff --git a/bin/tests/system/upforwd/tests.sh b/bin/tests/system/upforwd/tests.sh
-index ecd91a6..be9993a 100644
+index a50c896..8062d68 100644
 --- a/bin/tests/system/upforwd/tests.sh
 +++ b/bin/tests/system/upforwd/tests.sh
-@@ -66,7 +66,7 @@ if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
+@@ -79,7 +79,7 @@ if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
  
  echo_i "updating zone (signed) ($n)"
  ret=0
diff --git a/bind-9.14-config-pkcs11.patch b/bind-9.14-config-pkcs11.patch
index 58b492b..0d62df6 100644
--- a/bind-9.14-config-pkcs11.patch
+++ b/bind-9.14-config-pkcs11.patch
@@ -1,4 +1,4 @@
-From c42c0ff6f6e0e920356d99b9ed26ed52544621c2 Mon Sep 17 00:00:00 2001
+From e6ab9c67f0a14adc23c1067e03a106da1b1651b7 Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Fri, 18 Oct 2019 21:30:52 +0200
 Subject: [PATCH] Move USE_PKCS11 and USE_OPENSSL out of config.h
@@ -26,10 +26,10 @@ index 1b7512d..c126bf3 100644
  
  ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
 diff --git a/configure.ac b/configure.ac
-index eaa6b12..2ff68a5 100644
+index f5483fe..08a7d8a 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -900,10 +900,14 @@ AC_SUBST([PKCS11_TEST])
+@@ -935,10 +935,14 @@ AC_SUBST([PKCS11_TEST])
  AC_SUBST([PKCS11_TOOLS])
  AC_SUBST([PKCS11_MANS])
  
@@ -47,7 +47,7 @@ index eaa6b12..2ff68a5 100644
  # preparation for automake
  # AM_CONDITIONAL([PKCS11_TOOLS], [test "$with_native_pkcs11" = "yes"])
 diff --git a/lib/dns/dst_internal.h b/lib/dns/dst_internal.h
-index 116e2d2..99bdf5b 100644
+index 2c3b4a3..55e9dc4 100644
 --- a/lib/dns/dst_internal.h
 +++ b/lib/dns/dst_internal.h
 @@ -38,6 +38,13 @@
@@ -64,9 +64,9 @@ index 116e2d2..99bdf5b 100644
  #if USE_PKCS11
  #include <pk11/pk11.h>
  #include <pk11/site.h>
-@@ -98,11 +105,10 @@ struct dst_key {
+@@ -116,11 +123,10 @@ struct dst_key {
  		void *generic;
- 		gss_ctx_id_t gssctx;
+ 		dns_gss_ctx_id_t gssctx;
  		DH *dh;
 -#if USE_OPENSSL
 -		EVP_PKEY *pkey;
diff --git a/bind-9.16-CVE-2020-8625.patch b/bind-9.16-CVE-2020-8625.patch
deleted file mode 100644
index ce92a48..0000000
--- a/bind-9.16-CVE-2020-8625.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-From b04cb88462863d762093760ffcfe1946200e30f5 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
-Date: Thu, 7 Jan 2021 10:44:46 +0100
-Subject: [PATCH] Fix off-by-one bug in ISC SPNEGO implementation
-
-The ISC SPNEGO implementation is based on mod_auth_kerb code.  When
-CVE-2006-5989 was disclosed, the relevant fix was not applied to the
-BIND 9 codebase, making the latter vulnerable to the aforementioned flaw
-when "tkey-gssapi-keytab" or "tkey-gssapi-credential" is set in
-named.conf.
-
-The original description of CVE-2006-5989 was:
-
-    Off-by-one error in the der_get_oid function in mod_auth_kerb 5.0
-    allows remote attackers to cause a denial of service (crash) via a
-    crafted Kerberos message that triggers a heap-based buffer overflow
-    in the component array.
-
-Later research revealed that this flaw also theoretically enables remote
-code execution, though achieving the latter in real-world conditions is
-currently deemed very difficult.
-
-This vulnerability was responsibly reported as ZDI-CAN-12302 ("ISC BIND
-TKEY Query Heap-based Buffer Overflow Remote Code Execution
-Vulnerability") by Trend Micro Zero Day Initiative.
----
- lib/dns/spnego.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/lib/dns/spnego.c b/lib/dns/spnego.c
-index e61d1c600f..753dc8049f 100644
---- a/lib/dns/spnego.c
-+++ b/lib/dns/spnego.c
-@@ -848,7 +848,7 @@ der_get_oid(const unsigned char *p, size_t len, oid *data, size_t *size) {
- 		return (ASN1_OVERRUN);
- 	}
- 
--	data->components = malloc(len * sizeof(*data->components));
-+	data->components = malloc((len + 1) * sizeof(*data->components));
- 	if (data->components == NULL) {
- 		return (ENOMEM);
- 	}
--- 
-2.26.2
-
diff --git a/bind-9.16-redhat_doc.patch b/bind-9.16-redhat_doc.patch
index 15c8a41..ef76e16 100644
--- a/bind-9.16-redhat_doc.patch
+++ b/bind-9.16-redhat_doc.patch
@@ -1,4 +1,4 @@
-From 86fd25f3f0c5189fa93e10c6afa1a1cffe639ade Mon Sep 17 00:00:00 2001
+From 3a161af91bffcd457586ab466e32ac8484028763 Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Wed, 17 Jun 2020 23:17:13 +0200
 Subject: [PATCH] Update man named with Red Hat specifics
@@ -6,14 +6,14 @@ Subject: [PATCH] Update man named with Red Hat specifics
 This is almost unmodified text and requires revalidation. Some of those
 statements are no longer correct.
 ---
- bin/named/named.rst | 49 +++++++++++++++++++++++++++++++++++++++++++++
- 1 file changed, 49 insertions(+)
+ bin/named/named.rst | 35 +++++++++++++++++++++++++++++++++++
+ 1 file changed, 35 insertions(+)
 
 diff --git a/bin/named/named.rst b/bin/named/named.rst
-index 3c54a67..c44b6d7 100644
+index 6fd8f87..3cd6350 100644
 --- a/bin/named/named.rst
 +++ b/bin/named/named.rst
-@@ -228,6 +228,55 @@ Files
+@@ -228,6 +228,41 @@ Files
  ``/var/run/named/named.pid``
     The default process-id file.
  
@@ -24,7 +24,7 @@ index 3c54a67..c44b6d7 100644
 +
 +By default, Red Hat ships BIND with the most secure SELinux policy
 +that will not prevent normal BIND operation and will prevent exploitation
-+of all known BIND security vulnerabilities . See the selinux(8) man page
++of all known BIND security vulnerabilities. See the selinux(8) man page
 +for information about SElinux.
 +
 +It is not necessary to run named in a chroot environment if the Red Hat
@@ -34,37 +34,23 @@ index 3c54a67..c44b6d7 100644
 +
 +*With this extra security comes some restrictions:*
 +
-+By default, the SELinux policy does not allow named to write any master
-+zone database files. Only the root user may create files in the $ROOTDIR/var/named
-+zone database file directory (the options { "directory" } option), where
-+$ROOTDIR is set in /etc/sysconfig/named.
++By default, the SELinux policy does not allow named to write outside directory
++/var/named. That directory used to be read-only for named, but write access is
++enabled by default now.
 +
 +The "named" group must be granted read privelege to
 +these files in order for named to be enabled to read them.
++Any file updated by named must be writeable by named user or named group.
 +
 +Any file created in the zone database file directory is automatically assigned
 +the SELinux file context *named_zone_t* .
 +
-+By default, SELinux prevents any role from modifying *named_zone_t* files; this
-+means that files in the zone database directory cannot be modified by dynamic
-+DNS (DDNS) updates or zone transfers.
-+
 +The Red Hat BIND distribution and SELinux policy creates three directories where
-+named is allowed to create and modify files: */var/named/slaves*, */var/named/dynamic*
-+*/var/named/data*. By placing files you want named to modify, such as
-+slave or DDNS updateable zone files and database / statistics dump files in
-+these directories, named will work normally and no further operator action is
-+required. Files in these directories are automatically assigned the '*named_cache_t*'
-+file context, which SELinux allows named to write.
-+
-+**Red Hat BIND SDB support:**
-+
-+Red Hat ships named with compiled in Simplified Database Backend modules that ISC
-+provides in the "contrib/sdb" directory. Install **bind-sdb** package if you want use them
-+
-+The SDB modules for LDAP, PostGreSQL, DirDB and SQLite are compiled into *named-sdb*.
-+
-+See the documentation for the various SDB modules in /usr/share/doc/bind-sdb-*/ .
++named were allowed to create and modify files: */var/named/slaves*, */var/named/dynamic*
++*/var/named/data*. The service is able to write and file under */var/named* with appropriate
++permissions. They are used for better organisation of zones and backward compatibility.
++Files in these directories are automatically assigned the '*named_cache_t*'
++file context, which SELinux always allows named to write.
 +
  See Also
  ~~~~~~~~
diff --git a/bind-9.16-unit-tests-multicore.patch b/bind-9.16-unit-tests-multicore.patch
deleted file mode 100644
index 8ca0448..0000000
--- a/bind-9.16-unit-tests-multicore.patch
+++ /dev/null
@@ -1,84 +0,0 @@
-From 0175b942efc2fb6a05a2c76d62a9fb9157141757 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Wed, 20 Jan 2021 01:01:52 +0100
-Subject: [PATCH] Workaround errors in unit test on 56 CPU machine
-
-hp.c should be just implementation detail, but unit tests use it
-repeatedly without resetting tid_v_base. Reset the base counter, when
-number of processors is configured. Configure it when creating network
-manager.
-
-Use id of current thread as a base. Should be usually 0, but must not be
-below id of the main thread.
----
- bin/named/main.c        | 7 -------
- lib/isc/hp.c            | 1 +
- lib/isc/netmgr/netmgr.c | 8 ++++++++
- 3 files changed, 9 insertions(+), 7 deletions(-)
-
-diff --git a/bin/named/main.c b/bin/named/main.c
-index 9836de9d7f..d1be43a632 100644
---- a/bin/named/main.c
-+++ b/bin/named/main.c
-@@ -24,7 +24,6 @@
- #include <isc/dir.h>
- #include <isc/file.h>
- #include <isc/hash.h>
--#include <isc/hp.h>
- #include <isc/httpd.h>
- #include <isc/netmgr.h>
- #include <isc/os.h>
-@@ -909,12 +908,6 @@ create_managers(void) {
- 		      "using %u UDP listener%s per interface", named_g_udpdisp,
- 		      named_g_udpdisp == 1 ? "" : "s");
- 
--	/*
--	 * We have ncpus network threads, ncpus worker threads, ncpus
--	 * old network threads - make it 4x just to be safe. The memory
--	 * impact is negligible.
--	 */
--	isc_hp_init(4 * named_g_cpus);
- 	named_g_nm = isc_nm_start(named_g_mctx, named_g_cpus);
- 	if (named_g_nm == NULL) {
- 		UNEXPECTED_ERROR(__FILE__, __LINE__, "isc_nm_start() failed");
-diff --git a/lib/isc/hp.c b/lib/isc/hp.c
-index 3ea13bbe24..e4a98afc82 100644
---- a/lib/isc/hp.c
-+++ b/lib/isc/hp.c
-@@ -95,6 +95,7 @@ void
- isc_hp_init(int max_threads) {
- 	isc__hp_max_threads = max_threads;
- 	isc__hp_max_retired = max_threads * HP_MAX_HPS;
-+	atomic_store_release(&tid_v_base, tid());
- }
- 
- isc_hp_t *
-diff --git a/lib/isc/netmgr/netmgr.c b/lib/isc/netmgr/netmgr.c
-index 46f0758620..e3469f4c3a 100644
---- a/lib/isc/netmgr/netmgr.c
-+++ b/lib/isc/netmgr/netmgr.c
-@@ -17,6 +17,7 @@
- #include <isc/buffer.h>
- #include <isc/condition.h>
- #include <isc/errno.h>
-+#include <isc/hp.h>
- #include <isc/magic.h>
- #include <isc/mem.h>
- #include <isc/netmgr.h>
-@@ -238,6 +239,13 @@ isc_nm_start(isc_mem_t *mctx, uint32_t workers) {
- 	atomic_init(&mgr->keepalive, 30000);
- 	atomic_init(&mgr->advertised, 30000);
- 
-+	/*
-+	 * We have ncpus network threads, ncpus worker threads, ncpus
-+	 * old network threads - make it 4x just to be safe. The memory
-+	 * impact is negligible.
-+	 */
-+	isc_hp_init(4 * workers);
-+
- 	isc_mutex_init(&mgr->reqlock);
- 	isc_mempool_create(mgr->mctx, sizeof(isc__nm_uvreq_t), &mgr->reqpool);
- 	isc_mempool_setname(mgr->reqpool, "nm_reqpool");
--- 
-2.26.2
-
diff --git a/bind.spec b/bind.spec
index 70a7b73..234dbcb 100644
--- a/bind.spec
+++ b/bind.spec
@@ -54,20 +54,15 @@
 #
 # significant changes:
 # no more isc-config.sh and bind9-config
-
-# lib*.so.X versions of selected libraries
-%global sover_dns 1611
-%global sover_isc 1609
-%global sover_irs 1601
-%global sover_isccfg 1603
-%global sover_ns 1607
+# lib*.so.X versions of selected libraries no longer provided,
+# lib*-%%{version}-RH.so is provided as an internal implementation detail
 
 
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.16.11
-Release:  6%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Version:  9.16.13
+Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -119,10 +114,6 @@ Patch157:bind-9.11-fips-tests.patch
 Patch164:bind-9.11-rh1666814.patch
 Patch170:bind-9.11-feature-test-named.patch
 Patch171:bind-9.11-tests-variants.patch
-# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/4582
-Patch172:bind-9.16-unit-tests-multicore.patch
-# https://gitlab.isc.org/isc-projects/bind9/commit/b04cb88462863d762093760ffcfe1946200e30f5
-Patch173:bind-9.16-CVE-2020-8625.patch
 
 Requires(post):   systemd
 Requires(preun):  systemd
@@ -208,7 +199,6 @@ Summary: Bind with native PKCS#11 functionality for crypto
 Requires: systemd
 Requires: bind%{?_isa} = %{epoch}:%{version}-%{release}
 Requires: bind-libs%{?_isa} = %{epoch}:%{version}-%{release}
-Requires: bind-libs-lite%{?_isa} = %{epoch}:%{version}-%{release}
 Requires: bind-pkcs11-libs%{?_isa} = %{epoch}:%{version}-%{release}
 Recommends: softhsm
 
@@ -247,18 +237,11 @@ This a set of development files for BIND libraries (dns, isc) compiled
 with native PKCS#11 functionality.
 %endif
 
-%package libs-lite
-Summary:  Libraries for working with the DNS protocol
-Requires: bind-license = %{epoch}:%{version}-%{release}
-
-%description libs-lite
-Contains lite version of BIND suite libraries which are used by various
-programs to work with DNS protocol.
-
 %package libs
 Summary: Libraries used by the BIND DNS packages
 Requires: bind-license = %{epoch}:%{version}-%{release}
-Requires: bind-libs-lite%{?_isa} = %{epoch}:%{version}-%{release}
+Provides: bind-libs-lite = %{epoch}:%{version}-%{release}
+Obsoletes: bind-libs-lite < 32:9.16.13
 
 %description libs
 Contains heavyweight version of BIND suite libraries used by both named DNS
@@ -273,7 +256,6 @@ Contains license of the BIND DNS suite.
 
 %package utils
 Summary: Utilities for querying DNS name servers
-Requires: bind-libs-lite%{?_isa} = %{epoch}:%{version}-%{release}
 Requires: bind-libs%{?_isa} = %{epoch}:%{version}-%{release}
 # For compatibility with Debian package
 Provides: dnsutils = %{epoch}:%{version}-%{release}
@@ -290,7 +272,7 @@ servers.
 
 %package dnssec-utils
 Summary: DNSSEC keys and zones management utilities
-Requires: bind-libs-lite%{?_isa} = %{epoch}:%{version}-%{release}
+Requires: bind-libs%{?_isa} = %{epoch}:%{version}-%{release}
 Recommends: bind-utils
 Requires: python3-bind = %{epoch}:%{version}-%{release}
 Requires: bind-dnssec-doc = %{epoch}:%{version}-%{release}
@@ -310,14 +292,13 @@ BuildArch:noarch
 
 %description dnssec-doc
 Bind-dnssec-doc contains manual pages for bind-dnssec-utils.
+
 %package devel
-Summary:  Header files and libraries needed for BIND DNS development
+Summary:  Header files and libraries needed for bind-dyndb-ldap
 Provides: bind-lite-devel = %{epoch}:%{version}-%{release}
 Obsoletes: bind-lite-devel < 32:9.16.6-3
-Requires: bind-libs-lite%{?_isa} = %{epoch}:%{version}-%{release}
 Requires: bind-libs%{?_isa} = %{epoch}:%{version}-%{release}
 Requires: openssl-devel%{?_isa} libxml2-devel%{?_isa}
-# Not required by headers, but "isc-config.sh --libs isc" requires it
 Requires: libcap-devel%{?_isa}
 %if %{with GSSTSIG}
 Requires: krb5-devel%{?_isa}
@@ -336,7 +317,8 @@ Requires:  libmaxminddb-devel%{?_isa}
 
 %description devel
 The bind-devel package contains full version of the header files and libraries
-required for development with ISC BIND 9
+required for building bind-dyndb-ldap. Upstream no longer supports nor recommends
+bind libraries for third party applications.
 %endif
 
 %package chroot
@@ -436,8 +418,6 @@ in HTML and PDF format.
 %patch164 -p1 -b .rh1666814
 %patch170 -p1 -b .featuretest-named
 %patch171 -p1 -b .test-variant
-%patch172 -p1 -b .multicore
-%patch173 -p1 -b .CVE-2020-8625
 
 %if %{with PKCS11}
 %patch135 -p1 -b .config-pkcs11
@@ -487,7 +467,7 @@ export STD_CDEFINES="$CPPFLAGS"
 
 
 sed -i -e \
-'s/RELEASEVER=\(.*\)/RELEASEVER=\1-RedHat-%{version}-%{release}/' \
+'s/RELEASEVER=\(.*\)/RELEASEVER=\1-RH/' \
 version
 
 libtoolize -c -f; aclocal -I libtool.m4 --force; autoconf -f
@@ -904,7 +884,6 @@ fi
 /bin/systemctl try-restart named.service >/dev/null 2>&1 || :
 
 %ldconfig_scriptlets libs
-%ldconfig_scriptlets libs-lite
 
 %if %{with PKCS11}
 %ldconfig_scriptlets pkcs11-libs
@@ -990,15 +969,13 @@ fi;
 %dir /run/named
 
 %files libs
-%{_libdir}/libbind9.so.1600*
-%{_libdir}/libisccc.so.1600*
-%{_libdir}/libns.so.%{sover_ns}*
-
-%files libs-lite
-%{_libdir}/libdns.so.%{sover_dns}*
-%{_libdir}/libirs.so.%{sover_irs}*
-%{_libdir}/libisc.so.%{sover_isc}*
-%{_libdir}/libisccfg.so.%{sover_isccfg}*
+%{_libdir}/libbind9-%{version}*.so
+%{_libdir}/libisccc-%{version}*.so
+%{_libdir}/libns-%{version}*.so
+%{_libdir}/libdns-%{version}*.so
+%{_libdir}/libirs-%{version}*.so
+%{_libdir}/libisc-%{version}*.so
+%{_libdir}/libisccfg-%{version}*.so
 
 %files license
 %{!?_licensedir:%global license %%doc}
@@ -1123,8 +1100,8 @@ fi;
 %{_mandir}/man8/dnssec*-pkcs11.8*
 
 %files pkcs11-libs
-%{_libdir}/libdns-pkcs11.so.%{sover_dns}*
-%{_libdir}/libns-pkcs11.so.%{sover_ns}*
+%{_libdir}/libdns-pkcs11-%{version}*.so
+%{_libdir}/libns-pkcs11-%{version}*.so
 
 %files pkcs11-devel
 %{_includedir}/bind9/pk11/*.h
@@ -1168,6 +1145,12 @@ fi;
 %endif
 
 %changelog
+* Thu Mar 25 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.13-1
+- Update to 9.16.13
+- Changed displayed version just to include -RH suffix, not release
+- Version is now part of library names, soname versions are no longer provided
+- Removed bind-libs-lite subpackage
+
 * Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 32:9.16.11-6
 - Rebuilt for updated systemd-rpm-macros
   See https://pagure.io/fesco/issue/2583.
diff --git a/bind99-rh640538.patch b/bind99-rh640538.patch
index 30e0a03..833c476 100644
--- a/bind99-rh640538.patch
+++ b/bind99-rh640538.patch
@@ -1,4 +1,4 @@
-From 8b0a284d551d24ec2323713a5641b783b6e1baaa Mon Sep 17 00:00:00 2001
+From d3c58d860737f0f70eff05edad77e0b2a90d4cb9 Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Fri, 19 Jun 2020 18:48:23 +0200
 Subject: [PATCH] .rh640538
@@ -8,11 +8,11 @@ Subject: [PATCH] .rh640538
  1 file changed, 20 insertions(+)
 
 diff --git a/bin/dig/dig.rst b/bin/dig/dig.rst
-index 3c899ce..46c9885 100644
+index bef52ba..9f16607 100644
 --- a/bin/dig/dig.rst
 +++ b/bin/dig/dig.rst
-@@ -616,6 +616,26 @@ like to turn off the IDN support for some reason, use parameters
- ``+noidnin`` and ``+noidnout`` or define the IDN_DISABLE environment
+@@ -615,6 +615,26 @@ To turn off IDN support, use the parameters
+ ``+noidnin`` and ``+noidnout``, or define the ``IDN_DISABLE`` environment
  variable.
  
 +Return Codes
diff --git a/sources b/sources
index e157acd..cc951ad 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.16.11.tar.xz) = 5ed632df7c74f5e6693db9b378450ea3073b8002e9924df1d0465f8b8edb933df3a853d3965a290a0477a67ca2bfa79f679d7e344db08a65462860c58d04dc1b
-SHA512 (bind-9.16.11.tar.xz.asc) = 90f548c13f617b4f0db2bfe0af9e357cd67ebcfff861114c2d45a3b33867070023cac2112f30ba965d2260d43c46d5e739c05143e44fa78ee1df1e0c8478ecdf
+SHA512 (bind-9.16.13.tar.xz) = 1f3c8f54dd2c9e18cd9b67cfebb645d0a8e8f566add07fc4690cb8820bf81640c33b2b0685cb8be095e0f9ac84b2cf78176aea841a30c27d547b569b8353b07b
+SHA512 (bind-9.16.13.tar.xz.asc) = 636c5101f31092b1a0251c923676583afed69eb1e7ff625d3d7b2088c66014090e9676a61e332e553e4283872c5e641db1c09fbf76871e52938715163d61dd2e

From 2e4a03677c85aae0659ec29432362548ce722747 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 26 Mar 2021 11:21:37 +0100
Subject: [PATCH 244/460] Allow use of isc/util.h without "config.h"

It prevents compilation of bind-dyndb-ldap. Because config.h is never
used by bind-dyndb-ldap, stop exporting it in devel package. It should
be only implementation detail.
---
 bind-9.16-isc-constructor.h | 53 +++++++++++++++++++++++++++++++++++++
 bind.spec                   |  9 +++----
 2 files changed, 56 insertions(+), 6 deletions(-)
 create mode 100644 bind-9.16-isc-constructor.h

diff --git a/bind-9.16-isc-constructor.h b/bind-9.16-isc-constructor.h
new file mode 100644
index 0000000..71a08b3
--- /dev/null
+++ b/bind-9.16-isc-constructor.h
@@ -0,0 +1,53 @@
+From 48df32cadb5071f5b186b00da3f4406a13320b44 Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Fri, 26 Mar 2021 11:01:59 +0100
+Subject: [PATCH] Do not require config.h to use isc/util.h
+
+util.h requires ISC_CONSTRUCTOR definition, which depends on config.h
+inclusion. It does not include it from isc/util.h (or any other header).
+Using isc/util.h fails hard when isc/util.h is used without including
+bind's config.h.
+
+Move the check to c file, where ISC_CONSTRUCTOR is used. Ensure config.h
+is included there.
+---
+ lib/isc/include/isc/util.h | 2 --
+ lib/isc/lib.c              | 5 +++++
+ 2 files changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/lib/isc/include/isc/util.h b/lib/isc/include/isc/util.h
+index 3c8c40b..3144557 100644
+--- a/lib/isc/include/isc/util.h
++++ b/lib/isc/include/isc/util.h
+@@ -54,8 +54,6 @@
+ #elif WIN32
+ #define ISC_CONSTRUCTOR(priority)
+ #define ISC_DESTRUCTOR(priority)
+-#else
+-#error Either __attribute__((constructor|destructor))__ or DllMain support needed to compile BIND 9.
+ #endif
+ 
+ /*%
+diff --git a/lib/isc/lib.c b/lib/isc/lib.c
+index 27d7be1..08a1b91 100644
+--- a/lib/isc/lib.c
++++ b/lib/isc/lib.c
+@@ -17,10 +17,15 @@
+ #include <isc/tls.h>
+ #include <isc/util.h>
+ 
++#include "config.h"
+ #include "mem_p.h"
+ #include "tls_p.h"
+ #include "trampoline_p.h"
+ 
++#ifndef ISC_CONSTRUCTOR
++#error Either __attribute__((constructor|destructor))__ or DllMain support needed to compile BIND 9.
++#endif
++
+ /***
+  *** Functions
+  ***/
+-- 
+2.26.2
+
diff --git a/bind.spec b/bind.spec
index 234dbcb..77448d3 100644
--- a/bind.spec
+++ b/bind.spec
@@ -114,6 +114,8 @@ Patch157:bind-9.11-fips-tests.patch
 Patch164:bind-9.11-rh1666814.patch
 Patch170:bind-9.11-feature-test-named.patch
 Patch171:bind-9.11-tests-variants.patch
+# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/4840
+Patch172:bind-9.16-isc-constructor.h
 
 Requires(post):   systemd
 Requires(preun):  systemd
@@ -418,6 +420,7 @@ in HTML and PDF format.
 %patch164 -p1 -b .rh1666814
 %patch170 -p1 -b .featuretest-named
 %patch171 -p1 -b .test-variant
+%patch172 -p1 -b .isc-constructor
 
 %if %{with PKCS11}
 %patch135 -p1 -b .config-pkcs11
@@ -708,11 +711,6 @@ install -m 644 %{SOURCE49} ${RPM_BUILD_ROOT}%{_sysconfdir}/named-chroot.files
 # Install isc/errno2result.h header
 install -m 644 lib/isc/unix/errno2result.h ${RPM_BUILD_ROOT}%{_includedir}/bind9/isc
 
-pushd build
-# Files required to run test-suite outside of build tree:
-cp -fp config.h ${RPM_BUILD_ROOT}/%{_includedir}/bind9
-popd
-
 # Remove libtool .la files:
 find ${RPM_BUILD_ROOT}/%{_libdir} -name '*.la' -exec '/bin/rm' '-f' '{}' ';';
 
@@ -1035,7 +1033,6 @@ fi;
 %{_libdir}/libisc.so
 %{_libdir}/libisccfg.so
 %dir %{_includedir}/bind9
-%{_includedir}/bind9/config.h
 %{_includedir}/bind9/bind9
 %{_includedir}/bind9/isccc
 %{_includedir}/bind9/ns

From f8cb93d57c5be83e9cfbb515d2e8fc1abef24e29 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 29 Apr 2021 18:12:16 +0200
Subject: [PATCH 245/460] Update to 9.16.15

Resolves CVE-2021-25215 and CVE-2021-25214.
Removes disable-isc-spnego flag, because custom isc spnego code were
removed with also this flag. It is default (and the only) option now.
---
 .gitignore                         |  2 ++
 bind-9.10-dist-native-pkcs11.patch | 44 ++++++++++++-------------
 bind-9.16-isc-constructor.h        | 53 ------------------------------
 bind.spec                          |  9 +++--
 sources                            |  4 +--
 5 files changed, 30 insertions(+), 82 deletions(-)
 delete mode 100644 bind-9.16-isc-constructor.h

diff --git a/.gitignore b/.gitignore
index afa828e..e46cd63 100644
--- a/.gitignore
+++ b/.gitignore
@@ -144,3 +144,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.16.11.tar.xz.asc
 /bind-9.16.13.tar.xz
 /bind-9.16.13.tar.xz.asc
+/bind-9.16.15.tar.xz
+/bind-9.16.15.tar.xz.asc
diff --git a/bind-9.10-dist-native-pkcs11.patch b/bind-9.10-dist-native-pkcs11.patch
index 2003f1b..72a8317 100644
--- a/bind-9.10-dist-native-pkcs11.patch
+++ b/bind-9.10-dist-native-pkcs11.patch
@@ -1,4 +1,4 @@
-From 17c6e65cde059c98d48ae3b948aa157865d1c99c Mon Sep 17 00:00:00 2001
+From 8f232dac49cbb143a30a5c807f9085f3ef251f0e Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Thu, 21 Jan 2021 10:46:20 +0100
 Subject: [PATCH] Enable custom pkcs11 native build
@@ -247,7 +247,7 @@ index 98125dd..518a75f 100644
  @DLZ_DRIVER_RULES@
  
 diff --git a/configure.ac b/configure.ac
-index 08a7d8a..4d762c9 100644
+index da99e85..55680ea 100644
 --- a/configure.ac
 +++ b/configure.ac
 @@ -1251,12 +1251,14 @@ AC_SUBST(USE_GSSAPI)
@@ -265,7 +265,7 @@ index 08a7d8a..4d762c9 100644
  
  #
  # was --with-lmdb specified?
-@@ -2352,6 +2354,8 @@ AC_SUBST(BIND9_DNS_BUILDINCLUDE)
+@@ -2327,6 +2329,8 @@ AC_SUBST(BIND9_DNS_BUILDINCLUDE)
  AC_SUBST(BIND9_NS_BUILDINCLUDE)
  AC_SUBST(BIND9_BIND9_BUILDINCLUDE)
  AC_SUBST(BIND9_IRS_BUILDINCLUDE)
@@ -274,7 +274,7 @@ index 08a7d8a..4d762c9 100644
  if test "X$srcdir" != "X"; then
  	BIND9_ISC_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/isc/include"
  	BIND9_ISCCC_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/isccc/include"
-@@ -2360,6 +2364,8 @@ if test "X$srcdir" != "X"; then
+@@ -2335,6 +2339,8 @@ if test "X$srcdir" != "X"; then
  	BIND9_NS_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/ns/include"
  	BIND9_BIND9_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/bind9/include"
  	BIND9_IRS_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/irs/include"
@@ -283,7 +283,7 @@ index 08a7d8a..4d762c9 100644
  else
  	BIND9_ISC_BUILDINCLUDE=""
  	BIND9_ISCCC_BUILDINCLUDE=""
-@@ -2368,6 +2374,8 @@ else
+@@ -2343,6 +2349,8 @@ else
  	BIND9_NS_BUILDINCLUDE=""
  	BIND9_BIND9_BUILDINCLUDE=""
  	BIND9_IRS_BUILDINCLUDE=""
@@ -292,7 +292,7 @@ index 08a7d8a..4d762c9 100644
  fi
  
  AC_SUBST_FILE(BIND9_MAKE_INCLUDES)
-@@ -2823,8 +2831,11 @@ AC_CONFIG_FILES([
+@@ -2798,8 +2806,11 @@ AC_CONFIG_FILES([
  	bin/delv/Makefile
  	bin/dig/Makefile
  	bin/dnssec/Makefile
@@ -304,7 +304,7 @@ index 08a7d8a..4d762c9 100644
  	bin/nsupdate/Makefile
  	bin/pkcs11/Makefile
  	bin/plugins/Makefile
-@@ -2886,6 +2897,10 @@ AC_CONFIG_FILES([
+@@ -2861,6 +2872,10 @@ AC_CONFIG_FILES([
  	lib/dns/include/dns/Makefile
  	lib/dns/include/dst/Makefile
  	lib/dns/tests/Makefile
@@ -315,7 +315,7 @@ index 08a7d8a..4d762c9 100644
  	lib/irs/Makefile
  	lib/irs/include/Makefile
  	lib/irs/include/irs/Makefile
-@@ -2918,6 +2933,10 @@ AC_CONFIG_FILES([
+@@ -2893,6 +2908,10 @@ AC_CONFIG_FILES([
  	lib/ns/include/Makefile
  	lib/ns/include/ns/Makefile
  	lib/ns/tests/Makefile
@@ -340,28 +340,28 @@ index ffa2d5a..6fbc192 100644
  
  @BIND9_MAKE_RULES@
 diff --git a/lib/dns-pkcs11/Makefile.in b/lib/dns-pkcs11/Makefile.in
-index 283b7f2..a234dc5 100644
+index 58bda3c..d6a45df 100644
 --- a/lib/dns-pkcs11/Makefile.in
 +++ b/lib/dns-pkcs11/Makefile.in
-@@ -24,7 +24,7 @@ VERSION=@BIND9_VERSION@
+@@ -22,7 +22,7 @@ VERSION=@BIND9_VERSION@
  
- USE_ISC_SPNEGO = @USE_ISC_SPNEGO@
+ @BIND9_MAKE_INCLUDES@
  
 -CINCLUDES =	-I. -I${top_srcdir}/lib/dns -Iinclude ${DNS_INCLUDES} \
 +CINCLUDES =	-I. -I${top_srcdir}/lib/dns-pkcs11 -Iinclude ${DNS_PKCS11_INCLUDES} \
  		${ISC_INCLUDES} \
  		${FSTRM_CFLAGS} \
  		${OPENSSL_CFLAGS} @DST_GSSAPI_INC@ \
-@@ -34,7 +34,7 @@ CINCLUDES =	-I. -I${top_srcdir}/lib/dns -Iinclude ${DNS_INCLUDES} \
+@@ -32,7 +32,7 @@ CINCLUDES =	-I. -I${top_srcdir}/lib/dns -Iinclude ${DNS_INCLUDES} \
  		${LMDB_CFLAGS} \
  		${MAXMINDDB_CFLAGS}
  
--CDEFINES =	@USE_GSSAPI@ ${USE_ISC_SPNEGO}
-+CDEFINES =	@USE_GSSAPI@ ${USE_ISC_SPNEGO} @USE_PKCS11@
+-CDEFINES =	@USE_GSSAPI@
++CDEFINES =	@USE_GSSAPI@ @USE_PKCS11@
  
  CWARNINGS =
  
-@@ -137,15 +137,15 @@ version.@O@: version.c
+@@ -135,15 +135,15 @@ version.@O@: version.c
  		-DMAPAPI=\"${MAPAPI}\" \
  		-c ${srcdir}/version.c
  
@@ -381,7 +381,7 @@ index 283b7f2..a234dc5 100644
  
  include: gen
  	${MAKE} include/dns/enumtype.h
-@@ -176,22 +176,22 @@ gen: gen.c
+@@ -174,22 +174,22 @@ gen: gen.c
  	${BUILD_CPPFLAGS} ${BUILD_LDFLAGS} -o $@ ${srcdir}/gen.c \
  	${BUILD_LIBS} ${LFS_LIBS}
  
@@ -434,12 +434,12 @@ index 3bb5e01..c96fe7d 100644
  LIBS =		@LIBS@ @CMOCKA_LIBS@
  
 diff --git a/lib/ns-pkcs11/Makefile.in b/lib/ns-pkcs11/Makefile.in
-index f126f1f..21b20e4 100644
+index bc683ce..7a9d2f2 100644
 --- a/lib/ns-pkcs11/Makefile.in
 +++ b/lib/ns-pkcs11/Makefile.in
-@@ -18,12 +18,12 @@ VERSION=@BIND9_VERSION@
+@@ -16,12 +16,12 @@ VERSION=@BIND9_VERSION@
  
- USE_ISC_SPNEGO = @USE_ISC_SPNEGO@
+ @BIND9_MAKE_INCLUDES@
  
 -CINCLUDES =	-I. -I${top_srcdir}/lib/ns -Iinclude \
 -		${NS_INCLUDES} ${DNS_INCLUDES} ${ISC_INCLUDES} \
@@ -453,7 +453,7 @@ index f126f1f..21b20e4 100644
  
  CWARNINGS =
  
-@@ -31,9 +31,9 @@ ISCLIBS =	../../lib/isc/libisc.@A@
+@@ -29,9 +29,9 @@ ISCLIBS =	../../lib/isc/libisc.@A@
  
  ISCDEPLIBS =	../../lib/isc/libisc.@A@
  
@@ -465,7 +465,7 @@ index f126f1f..21b20e4 100644
  
  LIBS =		@LIBS@
  
-@@ -62,28 +62,28 @@ version.@O@: version.c
+@@ -60,28 +60,28 @@ version.@O@: version.c
  		-DMAJOR=\"${MAJOR}\" \
  		-c ${srcdir}/version.c
  
@@ -546,5 +546,5 @@ index b8317d3..b73b0c4 100644
 +	-I${top_srcdir}/lib/ns-pkcs11/include
 +
 -- 
-2.26.2
+2.26.3
 
diff --git a/bind-9.16-isc-constructor.h b/bind-9.16-isc-constructor.h
deleted file mode 100644
index 71a08b3..0000000
--- a/bind-9.16-isc-constructor.h
+++ /dev/null
@@ -1,53 +0,0 @@
-From 48df32cadb5071f5b186b00da3f4406a13320b44 Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Fri, 26 Mar 2021 11:01:59 +0100
-Subject: [PATCH] Do not require config.h to use isc/util.h
-
-util.h requires ISC_CONSTRUCTOR definition, which depends on config.h
-inclusion. It does not include it from isc/util.h (or any other header).
-Using isc/util.h fails hard when isc/util.h is used without including
-bind's config.h.
-
-Move the check to c file, where ISC_CONSTRUCTOR is used. Ensure config.h
-is included there.
----
- lib/isc/include/isc/util.h | 2 --
- lib/isc/lib.c              | 5 +++++
- 2 files changed, 5 insertions(+), 2 deletions(-)
-
-diff --git a/lib/isc/include/isc/util.h b/lib/isc/include/isc/util.h
-index 3c8c40b..3144557 100644
---- a/lib/isc/include/isc/util.h
-+++ b/lib/isc/include/isc/util.h
-@@ -54,8 +54,6 @@
- #elif WIN32
- #define ISC_CONSTRUCTOR(priority)
- #define ISC_DESTRUCTOR(priority)
--#else
--#error Either __attribute__((constructor|destructor))__ or DllMain support needed to compile BIND 9.
- #endif
- 
- /*%
-diff --git a/lib/isc/lib.c b/lib/isc/lib.c
-index 27d7be1..08a1b91 100644
---- a/lib/isc/lib.c
-+++ b/lib/isc/lib.c
-@@ -17,10 +17,15 @@
- #include <isc/tls.h>
- #include <isc/util.h>
- 
-+#include "config.h"
- #include "mem_p.h"
- #include "tls_p.h"
- #include "trampoline_p.h"
- 
-+#ifndef ISC_CONSTRUCTOR
-+#error Either __attribute__((constructor|destructor))__ or DllMain support needed to compile BIND 9.
-+#endif
-+
- /***
-  *** Functions
-  ***/
--- 
-2.26.2
-
diff --git a/bind.spec b/bind.spec
index 77448d3..a16adc2 100644
--- a/bind.spec
+++ b/bind.spec
@@ -61,7 +61,7 @@
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.16.13
+Version:  9.16.15
 Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
@@ -114,8 +114,6 @@ Patch157:bind-9.11-fips-tests.patch
 Patch164:bind-9.11-rh1666814.patch
 Patch170:bind-9.11-feature-test-named.patch
 Patch171:bind-9.11-tests-variants.patch
-# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/4840
-Patch172:bind-9.16-isc-constructor.h
 
 Requires(post):   systemd
 Requires(preun):  systemd
@@ -420,7 +418,6 @@ in HTML and PDF format.
 %patch164 -p1 -b .rh1666814
 %patch170 -p1 -b .featuretest-named
 %patch171 -p1 -b .test-variant
-%patch172 -p1 -b .isc-constructor
 
 %if %{with PKCS11}
 %patch135 -p1 -b .config-pkcs11
@@ -505,7 +502,6 @@ export LIBDIR_SUFFIX
   --with-dlopen=yes \
 %if %{with GSSTSIG}
   --with-gssapi=yes \
-  --disable-isc-spnego \
 %endif
 %if %{with LMDB}
   --with-lmdb=yes \
@@ -1142,6 +1138,9 @@ fi;
 %endif
 
 %changelog
+* Thu Apr 29 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.15-1
+- Update to 9.16.15
+
 * Thu Mar 25 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.13-1
 - Update to 9.16.13
 - Changed displayed version just to include -RH suffix, not release
diff --git a/sources b/sources
index cc951ad..3dd65a2 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.16.13.tar.xz) = 1f3c8f54dd2c9e18cd9b67cfebb645d0a8e8f566add07fc4690cb8820bf81640c33b2b0685cb8be095e0f9ac84b2cf78176aea841a30c27d547b569b8353b07b
-SHA512 (bind-9.16.13.tar.xz.asc) = 636c5101f31092b1a0251c923676583afed69eb1e7ff625d3d7b2088c66014090e9676a61e332e553e4283872c5e641db1c09fbf76871e52938715163d61dd2e
+SHA512 (bind-9.16.15.tar.xz) = 30dad6e2144b3ac53ef0a2d1ed3c8342120f148fc0eb6409113a6d5ed3444eecb917915fdf39c26fd223396fc1e873410a50da305f0b870864f7fbbdccec8033
+SHA512 (bind-9.16.15.tar.xz.asc) = b845f0527235a5b24c617e4e0975988df3966b05db3eec33c798c242b00560dbfdb3258da991743629eb24017759d7deccbaf58277d215ff4616f6c255a8c0d4

From 9c54517d6f68e3d6e96cd98b7cfc8829573f6c27 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 20 May 2021 11:58:09 +0200
Subject: [PATCH 246/460] Update to 9.16.16 (#1954827)

https://downloads.isc.org/isc/bind9/9.16.16/doc/arm/html/notes.html#notes-for-bind-9-16-16
---
 .gitignore                         |  2 ++
 bind-9.10-dist-native-pkcs11.patch | 14 +++++++-------
 bind-9.11-tests-variants.patch     | 12 ++++++------
 bind.spec                          |  5 ++++-
 sources                            |  4 ++--
 5 files changed, 21 insertions(+), 16 deletions(-)

diff --git a/.gitignore b/.gitignore
index e46cd63..07695aa 100644
--- a/.gitignore
+++ b/.gitignore
@@ -146,3 +146,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.16.13.tar.xz.asc
 /bind-9.16.15.tar.xz
 /bind-9.16.15.tar.xz.asc
+/bind-9.16.16.tar.xz
+/bind-9.16.16.tar.xz.asc
diff --git a/bind-9.10-dist-native-pkcs11.patch b/bind-9.10-dist-native-pkcs11.patch
index 72a8317..85ece30 100644
--- a/bind-9.10-dist-native-pkcs11.patch
+++ b/bind-9.10-dist-native-pkcs11.patch
@@ -1,4 +1,4 @@
-From 8f232dac49cbb143a30a5c807f9085f3ef251f0e Mon Sep 17 00:00:00 2001
+From 040227009453b3f0aa7914c7a6a94dc57ad5269b Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Thu, 21 Jan 2021 10:46:20 +0100
 Subject: [PATCH] Enable custom pkcs11 native build
@@ -247,7 +247,7 @@ index 98125dd..518a75f 100644
  @DLZ_DRIVER_RULES@
  
 diff --git a/configure.ac b/configure.ac
-index da99e85..55680ea 100644
+index 032228b..64e3da0 100644
 --- a/configure.ac
 +++ b/configure.ac
 @@ -1251,12 +1251,14 @@ AC_SUBST(USE_GSSAPI)
@@ -323,19 +323,19 @@ index da99e85..55680ea 100644
 +	lib/ns-pkcs11/include/Makefile
 +	lib/ns-pkcs11/include/ns/Makefile
 +	lib/ns-pkcs11/tests/Makefile
- 	lib/samples/Makefile
- 	lib/samples/Makefile-postinstall
  	make/Makefile
+ 	make/mkdep
+ 	unit/unittest.sh
 diff --git a/lib/Makefile.in b/lib/Makefile.in
-index ffa2d5a..6fbc192 100644
+index 833964e..058ba2f 100644
 --- a/lib/Makefile.in
 +++ b/lib/Makefile.in
 @@ -15,7 +15,7 @@ top_srcdir =	@top_srcdir@
  # Attempt to disable parallel processing.
  .NOTPARALLEL:
  .NO_PARALLEL:
--SUBDIRS =	isc isccc dns ns isccfg bind9 irs samples
-+SUBDIRS =	isc isccc dns dns-pkcs11 ns ns-pkcs11 isccfg bind9 irs samples
+-SUBDIRS =	isc isccc dns ns isccfg bind9 irs
++SUBDIRS =	isc isccc dns dns-pkcs11 ns ns-pkcs11 isccfg bind9 irs
  TARGETS =
  
  @BIND9_MAKE_RULES@
diff --git a/bind-9.11-tests-variants.patch b/bind-9.11-tests-variants.patch
index 897691a..807a4a0 100644
--- a/bind-9.11-tests-variants.patch
+++ b/bind-9.11-tests-variants.patch
@@ -1,4 +1,4 @@
-From 2faaad96a86614f2df13e65f3d3a31cc2d4155c0 Mon Sep 17 00:00:00 2001
+From 607cec78382b016aad0fe041f2e1895b6896c647 Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Fri, 1 Mar 2019 15:48:20 +0100
 Subject: [PATCH] Make alternative named builds testable in system tests
@@ -17,10 +17,10 @@ export NAMED_VARIANT=-pkcs11 DNSSEC_VARIANT=-pkcs11
  1 file changed, 9 insertions(+), 9 deletions(-)
 
 diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
-index 5015d5c..331b728 100644
+index d859909..9152f07 100644
 --- a/bin/tests/system/conf.sh.in
 +++ b/bin/tests/system/conf.sh.in
-@@ -36,17 +36,17 @@ DDNSCONFGEN=$TOP/bin/confgen/ddns-confgen
+@@ -37,17 +37,17 @@ DDNSCONFGEN=$TOP/bin/confgen/ddns-confgen
  DELV=$TOP/bin/delv/delv
  DIG=$TOP/bin/dig/dig
  DNSTAPREAD=$TOP/bin/tools/dnstap-read
@@ -44,10 +44,10 @@ index 5015d5c..331b728 100644
  NSEC3HASH=$TOP/bin/tools/nsec3hash
  NSLOOKUP=$TOP/bin/dig/nslookup
  NSUPDATE=$TOP/bin/nsupdate/nsupdate
-@@ -55,12 +55,12 @@ PK11DEL="$TOP/bin/pkcs11/pkcs11-destroy -s ${SLOT:-0} -p ${HSMPIN:-1234} -w 0"
+@@ -56,12 +56,12 @@ PK11DEL="$TOP/bin/pkcs11/pkcs11-destroy -s ${SLOT:-0} -p ${HSMPIN:-1234} -w 0"
  PK11GEN="$TOP/bin/pkcs11/pkcs11-keygen -q -s ${SLOT:-0} -p ${HSMPIN:-1234}"
  PK11LIST="$TOP/bin/pkcs11/pkcs11-list -s ${SLOT:-0} -p ${HSMPIN:-1234}"
- RESOLVE=$TOP/lib/samples/resolve
+ RESOLVE=$TOP/bin/tests/system/resolve
 -REVOKE=$TOP/bin/dnssec/dnssec-revoke
 +REVOKE=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-revoke${DNSSEC_VARIANT}
  RNDC=$TOP/bin/rndc/rndc
@@ -61,5 +61,5 @@ index 5015d5c..331b728 100644
  VERIFY=$TOP/bin/dnssec/dnssec-verify
  WIRETEST=$TOP/bin/tests/wire_test
 -- 
-2.21.1
+2.26.3
 
diff --git a/bind.spec b/bind.spec
index a16adc2..8c4e836 100644
--- a/bind.spec
+++ b/bind.spec
@@ -61,7 +61,7 @@
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.16.15
+Version:  9.16.16
 Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
@@ -1138,6 +1138,9 @@ fi;
 %endif
 
 %changelog
+* Thu May 20 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.16-1
+- Update to 9.16.16 (#1954827)
+
 * Thu Apr 29 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.15-1
 - Update to 9.16.15
 
diff --git a/sources b/sources
index 3dd65a2..2560b1f 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.16.15.tar.xz) = 30dad6e2144b3ac53ef0a2d1ed3c8342120f148fc0eb6409113a6d5ed3444eecb917915fdf39c26fd223396fc1e873410a50da305f0b870864f7fbbdccec8033
-SHA512 (bind-9.16.15.tar.xz.asc) = b845f0527235a5b24c617e4e0975988df3966b05db3eec33c798c242b00560dbfdb3258da991743629eb24017759d7deccbaf58277d215ff4616f6c255a8c0d4
+SHA512 (bind-9.16.16.tar.xz) = 264aa70d0d111ddb2a62c65f57e3eeb7eb93afdebcc523166d236e8f23d61d1e4f91b5a2df8dffa49e6f8e3c7101a2689c38dd6d77ecdedb79e2b163990e6093
+SHA512 (bind-9.16.16.tar.xz.asc) = 60cd60267553a2cff2055c431d69d3d6a72bf31ee123ef1af82c000ed6732e34a8f552c5b0f15cf74294dea17e9a251684820a3889ecd8eaf51c77ddd8411203

From 08ea20b0dd9d713fa3f896972125f7e2138113b8 Mon Sep 17 00:00:00 2001
From: Python Maint <python-maint@redhat.com>
Date: Fri, 4 Jun 2021 20:00:26 +0200
Subject: [PATCH 247/460] Rebuilt for Python 3.10

---
 bind.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index 8c4e836..7368564 100644
--- a/bind.spec
+++ b/bind.spec
@@ -62,7 +62,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.16.16
-Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1138,6 +1138,9 @@ fi;
 %endif
 
 %changelog
+* Fri Jun 04 2021 Python Maint <python-maint@redhat.com> - 32:9.16.16-2
+- Rebuilt for Python 3.10
+
 * Thu May 20 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.16-1
 - Update to 9.16.16 (#1954827)
 

From 83399543c177a5cdaec21b53a2e81274f8e23027 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 17 Jun 2021 16:33:32 +0200
Subject: [PATCH 248/460] Update to 9.16.17

---
 .gitignore                |  2 ++
 bind-9.11-rh1410433.patch | 13 -------------
 bind.spec                 |  9 +++++----
 sources                   |  4 ++--
 4 files changed, 9 insertions(+), 19 deletions(-)
 delete mode 100644 bind-9.11-rh1410433.patch

diff --git a/.gitignore b/.gitignore
index 07695aa..52f9770 100644
--- a/.gitignore
+++ b/.gitignore
@@ -148,3 +148,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.16.15.tar.xz.asc
 /bind-9.16.16.tar.xz
 /bind-9.16.16.tar.xz.asc
+/bind-9.16.17.tar.xz
+/bind-9.16.17.tar.xz.asc
diff --git a/bind-9.11-rh1410433.patch b/bind-9.11-rh1410433.patch
deleted file mode 100644
index 10f1dd2..0000000
--- a/bind-9.11-rh1410433.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/lib/dns/dyndb.c b/lib/dns/dyndb.c
-index fdc8ea5..d638777 100644
---- a/lib/dns/dyndb.c
-+++ b/lib/dns/dyndb.c
-@@ -131,7 +131,7 @@ load_library(isc_mem_t *mctx, const char *filename, const char *instname,
- 		      instname, filename);
- 
- 	flags = RTLD_NOW | RTLD_LOCAL;
--#if defined(RTLD_DEEPBIND) && !__SANITIZE_ADDRESS__
-+#if 0 && defined(RTLD_DEEPBIND) && !__SANITIZE_ADDRESS__
- 	flags |= RTLD_DEEPBIND;
- #endif /* if defined(RTLD_DEEPBIND) && !__SANITIZE_ADDRESS__ */
- 
diff --git a/bind.spec b/bind.spec
index 7368564..140b596 100644
--- a/bind.spec
+++ b/bind.spec
@@ -61,8 +61,8 @@
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.16.16
-Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Version:  9.16.17
+Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -109,7 +109,6 @@ Patch136:bind-9.10-dist-native-pkcs11.patch
 # Do not use isc-pkcs11.
 Patch149:bind-9.11-kyua-pkcs11.patch
 
-Patch140:bind-9.11-rh1410433.patch
 Patch157:bind-9.11-fips-tests.patch
 Patch164:bind-9.11-rh1666814.patch
 Patch170:bind-9.11-feature-test-named.patch
@@ -413,7 +412,6 @@ in HTML and PDF format.
 %patch106 -p1 -b .rh490837
 %patch112 -p1 -b .rh645544
 %patch130 -p1 -b .libdb
-%patch140 -p1 -b .rh1410433
 %patch157 -p1 -b .fips-tests
 %patch164 -p1 -b .rh1666814
 %patch170 -p1 -b .featuretest-named
@@ -1138,6 +1136,9 @@ fi;
 %endif
 
 %changelog
+* Thu Jun 17 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.17-1
+- Update to 9.16.17
+
 * Fri Jun 04 2021 Python Maint <python-maint@redhat.com> - 32:9.16.16-2
 - Rebuilt for Python 3.10
 
diff --git a/sources b/sources
index 2560b1f..0f9307f 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.16.16.tar.xz) = 264aa70d0d111ddb2a62c65f57e3eeb7eb93afdebcc523166d236e8f23d61d1e4f91b5a2df8dffa49e6f8e3c7101a2689c38dd6d77ecdedb79e2b163990e6093
-SHA512 (bind-9.16.16.tar.xz.asc) = 60cd60267553a2cff2055c431d69d3d6a72bf31ee123ef1af82c000ed6732e34a8f552c5b0f15cf74294dea17e9a251684820a3889ecd8eaf51c77ddd8411203
+SHA512 (bind-9.16.17.tar.xz) = 983d7d0ecd17ae926db2811c4af0354bafcfbaa96c82625f419be3dc81132ed23d599d1273351a3924ee9df79b358d67d88f42a91ad48c2dc596ff01904c83c3
+SHA512 (bind-9.16.17.tar.xz.asc) = 0c7c7fa4a1176020888805b5f47547b5e040d216a3f8dfe24a9c4e9ed39d66bac327bf94300043ad92ace623c0470eac91006021432b66c4343aa560cdae7699

From 2c4a614d016398ddfb6474f1133c491f72328f9b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 18 Jun 2021 10:57:22 +0200
Subject: [PATCH 249/460] Fix 'w' wildcard expansion regressio in last release

Upstream maptolower and maptoupper did not contain w character. It makes
response mangled, replacing 'w' and 'W' characters with '\0' in answer.

Resolves: rhbz#1973587
---
 bind-9.16-maptolower-w.patch      | 37 ++++++++++++++++++++
 bind-9.16-test-wildcard-expansion | 58 +++++++++++++++++++++++++++++++
 bind.spec                         | 10 +++++-
 3 files changed, 104 insertions(+), 1 deletion(-)
 create mode 100644 bind-9.16-maptolower-w.patch
 create mode 100644 bind-9.16-test-wildcard-expansion

diff --git a/bind-9.16-maptolower-w.patch b/bind-9.16-maptolower-w.patch
new file mode 100644
index 0000000..487c923
--- /dev/null
+++ b/bind-9.16-maptolower-w.patch
@@ -0,0 +1,37 @@
+From 52cc9ff372ba637289d1e8f35d1f3f35d46ea25f Mon Sep 17 00:00:00 2001
+From: Mark Andrews <marka@isc.org>
+Date: Fri, 18 Jun 2021 11:29:45 +1000
+Subject: [PATCH] Add w and W to maptoupper and maptolower tables
+
+(cherry picked from commit 08eeebb6a7ef45ac796a0df47a92350473a4e0b8)
+---
+ lib/dns/rbtdb.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
+index 223194a6d6..9dfd219dce 100644
+--- a/lib/dns/rbtdb.c
++++ b/lib/dns/rbtdb.c
+@@ -9890,7 +9890,8 @@ static const unsigned char maptolower[256] = {
+ 	['F'] = 'f', ['G'] = 'g', ['H'] = 'h', ['I'] = 'i', ['J'] = 'j',
+ 	['K'] = 'k', ['L'] = 'l', ['M'] = 'm', ['N'] = 'n', ['O'] = 'o',
+ 	['P'] = 'p', ['Q'] = 'q', ['R'] = 'r', ['S'] = 's', ['T'] = 't',
+-	['U'] = 'u', ['V'] = 'v', ['X'] = 'x', ['Y'] = 'y', ['Z'] = 'z',
++	['U'] = 'u', ['V'] = 'v', ['W'] = 'w', ['X'] = 'x', ['Y'] = 'y',
++	['Z'] = 'z',
+ };
+ 
+ static const unsigned char maptoupper[256] = {
+@@ -9898,7 +9899,8 @@ static const unsigned char maptoupper[256] = {
+ 	['f'] = 'F', ['g'] = 'G', ['h'] = 'H', ['i'] = 'I', ['j'] = 'J',
+ 	['k'] = 'K', ['l'] = 'L', ['m'] = 'M', ['n'] = 'N', ['o'] = 'O',
+ 	['p'] = 'P', ['q'] = 'Q', ['r'] = 'R', ['s'] = 'S', ['t'] = 'T',
+-	['u'] = 'U', ['v'] = 'V', ['x'] = 'X', ['y'] = 'Y', ['z'] = 'Z',
++	['u'] = 'U', ['v'] = 'V', ['w'] = 'W', ['x'] = 'X', ['y'] = 'Y',
++	['z'] = 'Z',
+ };
+ 
+ static void
+-- 
+2.31.1
+
diff --git a/bind-9.16-test-wildcard-expansion b/bind-9.16-test-wildcard-expansion
new file mode 100644
index 0000000..9d34d2d
--- /dev/null
+++ b/bind-9.16-test-wildcard-expansion
@@ -0,0 +1,58 @@
+From ab597b8b91de5f9c6d6b0da410e8a0350876f484 Mon Sep 17 00:00:00 2001
+From: Mark Andrews <marka@isc.org>
+Date: Fri, 18 Jun 2021 13:02:46 +1000
+Subject: [PATCH] Check wild card expansions by code point
+
+(cherry picked from commit c65dc2f7dc211358d5e28ff368cd60ddf5d5dcd4)
+---
+ bin/tests/system/wildcard/tests.sh | 35 ++++++++++++++++++++++++++++++
+ 1 file changed, 35 insertions(+)
+
+diff --git a/bin/tests/system/wildcard/tests.sh b/bin/tests/system/wildcard/tests.sh
+index 439f8f1eff..0cf2189223 100644
+--- a/bin/tests/system/wildcard/tests.sh
++++ b/bin/tests/system/wildcard/tests.sh
+@@ -231,5 +231,40 @@ grep "ANSWER: 0," dig.out.ns1.test$n > /dev/null || ret=1
+ if [ $ret != 0 ]; then echo_i "failed"; fi
+ status=`expr $status + $ret`
+ 
++n=`expr $n + 1`
++echo_i "check wild card expansions by code point ($n)"
++ret=0
++i=0
++while test $i -lt 256
++do
++	x=`expr 00$i : '.*\(...\)$'`
++	$DIG $DIGOPTS @10.53.0.1 "\\$x.example" TXT > dig.out.ns1.$x.test$n
++	if test $i -le 32 -o $i -ge 127
++	then
++		grep '^\\'"$x"'\.example\..*TXT.*\"this is a wildcard\"$' dig.out.ns1.$x.test$n > /dev/null || { echo_i "code point $x failed" ; ret=1; }
++        # "=34 $=36 (=40 )=41 .=46 ;=59 \=92 @=64
++	elif test $i -eq 34 -o $i -eq 36 -o $i -eq 40 -o $i -eq 41 -o \
++                  $i -eq 46 -o $i -eq 59 -o $i -eq 64 -o $i -eq 92
++	then
++		case $i in
++		34) a='"';;
++		36) a='$';;
++		40) a='(';;
++		41) a=')';;
++		46) a='\.';;
++		59) a=';';;
++		64) a='@';;
++		92) a='\\';;
++		*) a=''; echo_i "code point $x failed" ; ret=1 ;;
++		esac
++		grep '^\\'"$a"'\.example.*.*TXT.*"this is a wildcard"$' dig.out.ns1.$x.test$n > /dev/null || { echo_i "code point $x failed" ; ret=1; }
++	else
++		grep '^\\' dig.out.ns1.$x.test$n && { echo_i "code point $x failed" ; ret=1; }
++	fi
++	i=`expr $i + 1`
++done
++if [ $ret != 0 ]; then echo_i "failed"; fi
++status=`expr $status + $ret`
++
+ echo_i "exit status: $status"
+ [ $status -eq 0 ] || exit 1
+-- 
+2.31.1
+
diff --git a/bind.spec b/bind.spec
index 140b596..4f3258b 100644
--- a/bind.spec
+++ b/bind.spec
@@ -62,7 +62,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.16.17
-Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -113,6 +113,9 @@ Patch157:bind-9.11-fips-tests.patch
 Patch164:bind-9.11-rh1666814.patch
 Patch170:bind-9.11-feature-test-named.patch
 Patch171:bind-9.11-tests-variants.patch
+# https://gitlab.isc.org/isc-projects/bind9/-/issues/2779
+Patch172:bind-9.16-maptolower-w.patch
+Patch173:bind-9.16-test-wildcard-expansion
 
 Requires(post):   systemd
 Requires(preun):  systemd
@@ -416,6 +419,8 @@ in HTML and PDF format.
 %patch164 -p1 -b .rh1666814
 %patch170 -p1 -b .featuretest-named
 %patch171 -p1 -b .test-variant
+%patch172 -p1 -b .rh1973587
+%patch173 -p1 -b .rh1973587
 
 %if %{with PKCS11}
 %patch135 -p1 -b .config-pkcs11
@@ -1136,6 +1141,9 @@ fi;
 %endif
 
 %changelog
+* Fri Jun 18 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.17-2
+- Fix wildcard expansion not working with 'w' (#1973587)
+
 * Thu Jun 17 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.17-1
 - Update to 9.16.17
 

From 48d8c90e0df434d0c4853eb834236143d5be072d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 18 Jun 2021 16:38:18 +0200
Subject: [PATCH 250/460] Update to 9.16.18

Fixup release after bugs released in 9.16.17.

https://downloads.isc.org/isc/bind9/9.16.18/doc/arm/html/notes.html#notes-for-bind-9-16-18
---
 .gitignore                        |  2 ++
 bind-9.16-maptolower-w.patch      | 37 --------------------
 bind-9.16-test-wildcard-expansion | 58 -------------------------------
 bind.spec                         | 12 +++----
 sources                           |  4 +--
 5 files changed, 9 insertions(+), 104 deletions(-)
 delete mode 100644 bind-9.16-maptolower-w.patch
 delete mode 100644 bind-9.16-test-wildcard-expansion

diff --git a/.gitignore b/.gitignore
index 52f9770..8a32a1b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -150,3 +150,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.16.16.tar.xz.asc
 /bind-9.16.17.tar.xz
 /bind-9.16.17.tar.xz.asc
+/bind-9.16.18.tar.xz
+/bind-9.16.18.tar.xz.asc
diff --git a/bind-9.16-maptolower-w.patch b/bind-9.16-maptolower-w.patch
deleted file mode 100644
index 487c923..0000000
--- a/bind-9.16-maptolower-w.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From 52cc9ff372ba637289d1e8f35d1f3f35d46ea25f Mon Sep 17 00:00:00 2001
-From: Mark Andrews <marka@isc.org>
-Date: Fri, 18 Jun 2021 11:29:45 +1000
-Subject: [PATCH] Add w and W to maptoupper and maptolower tables
-
-(cherry picked from commit 08eeebb6a7ef45ac796a0df47a92350473a4e0b8)
----
- lib/dns/rbtdb.c | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
-index 223194a6d6..9dfd219dce 100644
---- a/lib/dns/rbtdb.c
-+++ b/lib/dns/rbtdb.c
-@@ -9890,7 +9890,8 @@ static const unsigned char maptolower[256] = {
- 	['F'] = 'f', ['G'] = 'g', ['H'] = 'h', ['I'] = 'i', ['J'] = 'j',
- 	['K'] = 'k', ['L'] = 'l', ['M'] = 'm', ['N'] = 'n', ['O'] = 'o',
- 	['P'] = 'p', ['Q'] = 'q', ['R'] = 'r', ['S'] = 's', ['T'] = 't',
--	['U'] = 'u', ['V'] = 'v', ['X'] = 'x', ['Y'] = 'y', ['Z'] = 'z',
-+	['U'] = 'u', ['V'] = 'v', ['W'] = 'w', ['X'] = 'x', ['Y'] = 'y',
-+	['Z'] = 'z',
- };
- 
- static const unsigned char maptoupper[256] = {
-@@ -9898,7 +9899,8 @@ static const unsigned char maptoupper[256] = {
- 	['f'] = 'F', ['g'] = 'G', ['h'] = 'H', ['i'] = 'I', ['j'] = 'J',
- 	['k'] = 'K', ['l'] = 'L', ['m'] = 'M', ['n'] = 'N', ['o'] = 'O',
- 	['p'] = 'P', ['q'] = 'Q', ['r'] = 'R', ['s'] = 'S', ['t'] = 'T',
--	['u'] = 'U', ['v'] = 'V', ['x'] = 'X', ['y'] = 'Y', ['z'] = 'Z',
-+	['u'] = 'U', ['v'] = 'V', ['w'] = 'W', ['x'] = 'X', ['y'] = 'Y',
-+	['z'] = 'Z',
- };
- 
- static void
--- 
-2.31.1
-
diff --git a/bind-9.16-test-wildcard-expansion b/bind-9.16-test-wildcard-expansion
deleted file mode 100644
index 9d34d2d..0000000
--- a/bind-9.16-test-wildcard-expansion
+++ /dev/null
@@ -1,58 +0,0 @@
-From ab597b8b91de5f9c6d6b0da410e8a0350876f484 Mon Sep 17 00:00:00 2001
-From: Mark Andrews <marka@isc.org>
-Date: Fri, 18 Jun 2021 13:02:46 +1000
-Subject: [PATCH] Check wild card expansions by code point
-
-(cherry picked from commit c65dc2f7dc211358d5e28ff368cd60ddf5d5dcd4)
----
- bin/tests/system/wildcard/tests.sh | 35 ++++++++++++++++++++++++++++++
- 1 file changed, 35 insertions(+)
-
-diff --git a/bin/tests/system/wildcard/tests.sh b/bin/tests/system/wildcard/tests.sh
-index 439f8f1eff..0cf2189223 100644
---- a/bin/tests/system/wildcard/tests.sh
-+++ b/bin/tests/system/wildcard/tests.sh
-@@ -231,5 +231,40 @@ grep "ANSWER: 0," dig.out.ns1.test$n > /dev/null || ret=1
- if [ $ret != 0 ]; then echo_i "failed"; fi
- status=`expr $status + $ret`
- 
-+n=`expr $n + 1`
-+echo_i "check wild card expansions by code point ($n)"
-+ret=0
-+i=0
-+while test $i -lt 256
-+do
-+	x=`expr 00$i : '.*\(...\)$'`
-+	$DIG $DIGOPTS @10.53.0.1 "\\$x.example" TXT > dig.out.ns1.$x.test$n
-+	if test $i -le 32 -o $i -ge 127
-+	then
-+		grep '^\\'"$x"'\.example\..*TXT.*\"this is a wildcard\"$' dig.out.ns1.$x.test$n > /dev/null || { echo_i "code point $x failed" ; ret=1; }
-+        # "=34 $=36 (=40 )=41 .=46 ;=59 \=92 @=64
-+	elif test $i -eq 34 -o $i -eq 36 -o $i -eq 40 -o $i -eq 41 -o \
-+                  $i -eq 46 -o $i -eq 59 -o $i -eq 64 -o $i -eq 92
-+	then
-+		case $i in
-+		34) a='"';;
-+		36) a='$';;
-+		40) a='(';;
-+		41) a=')';;
-+		46) a='\.';;
-+		59) a=';';;
-+		64) a='@';;
-+		92) a='\\';;
-+		*) a=''; echo_i "code point $x failed" ; ret=1 ;;
-+		esac
-+		grep '^\\'"$a"'\.example.*.*TXT.*"this is a wildcard"$' dig.out.ns1.$x.test$n > /dev/null || { echo_i "code point $x failed" ; ret=1; }
-+	else
-+		grep '^\\' dig.out.ns1.$x.test$n && { echo_i "code point $x failed" ; ret=1; }
-+	fi
-+	i=`expr $i + 1`
-+done
-+if [ $ret != 0 ]; then echo_i "failed"; fi
-+status=`expr $status + $ret`
-+
- echo_i "exit status: $status"
- [ $status -eq 0 ] || exit 1
--- 
-2.31.1
-
diff --git a/bind.spec b/bind.spec
index 4f3258b..822d3fc 100644
--- a/bind.spec
+++ b/bind.spec
@@ -61,8 +61,8 @@
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.16.17
-Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Version:  9.16.18
+Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -113,9 +113,6 @@ Patch157:bind-9.11-fips-tests.patch
 Patch164:bind-9.11-rh1666814.patch
 Patch170:bind-9.11-feature-test-named.patch
 Patch171:bind-9.11-tests-variants.patch
-# https://gitlab.isc.org/isc-projects/bind9/-/issues/2779
-Patch172:bind-9.16-maptolower-w.patch
-Patch173:bind-9.16-test-wildcard-expansion
 
 Requires(post):   systemd
 Requires(preun):  systemd
@@ -419,8 +416,6 @@ in HTML and PDF format.
 %patch164 -p1 -b .rh1666814
 %patch170 -p1 -b .featuretest-named
 %patch171 -p1 -b .test-variant
-%patch172 -p1 -b .rh1973587
-%patch173 -p1 -b .rh1973587
 
 %if %{with PKCS11}
 %patch135 -p1 -b .config-pkcs11
@@ -1141,6 +1136,9 @@ fi;
 %endif
 
 %changelog
+* Fri Jun 18 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.18-1
+- Update to 9.16.18
+
 * Fri Jun 18 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.17-2
 - Fix wildcard expansion not working with 'w' (#1973587)
 
diff --git a/sources b/sources
index 0f9307f..07b3b7d 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.16.17.tar.xz) = 983d7d0ecd17ae926db2811c4af0354bafcfbaa96c82625f419be3dc81132ed23d599d1273351a3924ee9df79b358d67d88f42a91ad48c2dc596ff01904c83c3
-SHA512 (bind-9.16.17.tar.xz.asc) = 0c7c7fa4a1176020888805b5f47547b5e040d216a3f8dfe24a9c4e9ed39d66bac327bf94300043ad92ace623c0470eac91006021432b66c4343aa560cdae7699
+SHA512 (bind-9.16.18.tar.xz) = 6ba2f14324ebdc66d2a6d60e929fb47e170dd7662cf4b18ef3ad9da30a61b43c7d5539e931c483ab36e63ae0398aeed255fd672489fb332dccf182df9aa102f9
+SHA512 (bind-9.16.18.tar.xz.asc) = 384887fec89de30436b3c570843f2ae532b9bb54065991a8778c63262a3608c724a7007c55989c4f9132d7718f5a08b447b0c73ff9025f5fa6d47ee41200dabe

From 43d9682d1331da6ca25f0415fb6bf6815c71a0ba Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 18 Jun 2021 16:51:25 +0200
Subject: [PATCH 251/460] Correct cds system test

Downstream patch creates error. Variants are still not used, but make
they yet working.
---
 bind-9.11-tests-variants.patch | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/bind-9.11-tests-variants.patch b/bind-9.11-tests-variants.patch
index 807a4a0..2b29b99 100644
--- a/bind-9.11-tests-variants.patch
+++ b/bind-9.11-tests-variants.patch
@@ -1,4 +1,4 @@
-From 607cec78382b016aad0fe041f2e1895b6896c647 Mon Sep 17 00:00:00 2001
+From 953e480044f61dd162726f8345acf450d6ddbecc Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Fri, 1 Mar 2019 15:48:20 +0100
 Subject: [PATCH] Make alternative named builds testable in system tests
@@ -17,7 +17,7 @@ export NAMED_VARIANT=-pkcs11 DNSSEC_VARIANT=-pkcs11
  1 file changed, 9 insertions(+), 9 deletions(-)
 
 diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
-index d859909..9152f07 100644
+index d859909..db2bafb 100644
 --- a/bin/tests/system/conf.sh.in
 +++ b/bin/tests/system/conf.sh.in
 @@ -37,17 +37,17 @@ DDNSCONFGEN=$TOP/bin/confgen/ddns-confgen
@@ -26,21 +26,21 @@ index d859909..9152f07 100644
  DNSTAPREAD=$TOP/bin/tools/dnstap-read
 -DSFROMKEY=$TOP/bin/dnssec/dnssec-dsfromkey
 -FEATURETEST=$TOP/bin/named/feature-test
-+DSFROMKEY=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-dsfromkey${DNSSEC_VARIANT}
-+FEATURETEST=$TOP/bin/named${NAMED_VARIANT}/feature-test${NAMED_VARIANT}
++DSFROMKEY=$TOP/bin/dnssec${DNSSEC_VARIANT:-}/dnssec-dsfromkey${DNSSEC_VARIANT:-}
++FEATURETEST=$TOP/bin/named${NAMED_VARIANT:-}/feature-test${NAMED_VARIANT:-}
  FSTRM_CAPTURE=@FSTRM_CAPTURE@
  HOST=$TOP/bin/dig/host
 -IMPORTKEY=$TOP/bin/dnssec/dnssec-importkey
-+IMPORTKEY=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-importkey${DNSSEC_VARIANT}
++IMPORTKEY=$TOP/bin/dnssec${DNSSEC_VARIANT:-}/dnssec-importkey${DNSSEC_VARIANT:-}
  JOURNALPRINT=$TOP/bin/tools/named-journalprint
 -KEYFRLAB=$TOP/bin/dnssec/dnssec-keyfromlabel
 -KEYGEN=$TOP/bin/dnssec/dnssec-keygen
-+KEYFRLAB=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-keyfromlabel${DNSSEC_VARIANT}
-+KEYGEN=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-keygen${DNSSEC_VARIANT}
++KEYFRLAB=$TOP/bin/dnssec${DNSSEC_VARIANT:-}/dnssec-keyfromlabel${DNSSEC_VARIANT:-}
++KEYGEN=$TOP/bin/dnssec${DNSSEC_VARIANT:-}/dnssec-keygen${DNSSEC_VARIANT:-}
  KEYMGR=$TOP/bin/python/dnssec-keymgr
  MDIG=$TOP/bin/tools/mdig
 -NAMED=$TOP/bin/named/named
-+NAMED=$TOP/bin/named${NAMED_VARIANT}/named${NAMED_VARIANT}
++NAMED=$TOP/bin/named${NAMED_VARIANT:-}/named${NAMED_VARIANT:-}
  NSEC3HASH=$TOP/bin/tools/nsec3hash
  NSLOOKUP=$TOP/bin/dig/nslookup
  NSUPDATE=$TOP/bin/nsupdate/nsupdate
@@ -49,17 +49,17 @@ index d859909..9152f07 100644
  PK11LIST="$TOP/bin/pkcs11/pkcs11-list -s ${SLOT:-0} -p ${HSMPIN:-1234}"
  RESOLVE=$TOP/bin/tests/system/resolve
 -REVOKE=$TOP/bin/dnssec/dnssec-revoke
-+REVOKE=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-revoke${DNSSEC_VARIANT}
++REVOKE=$TOP/bin/dnssec${DNSSEC_VARIANT:-}/dnssec-revoke${DNSSEC_VARIANT:-}
  RNDC=$TOP/bin/rndc/rndc
  RNDCCONFGEN=$TOP/bin/confgen/rndc-confgen
  RRCHECKER=$TOP/bin/tools/named-rrchecker
 -SETTIME=$TOP/bin/dnssec/dnssec-settime
 -SIGNER=$TOP/bin/dnssec/dnssec-signzone
-+SETTIME=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-settime${DNSSEC_VARIANT}
-+SIGNER=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-signzone${DNSSEC_VARIANT}
++SETTIME=$TOP/bin/dnssec${DNSSEC_VARIANT:-}/dnssec-settime${DNSSEC_VARIANT:-}
++SIGNER=$TOP/bin/dnssec${DNSSEC_VARIANT:-}/dnssec-signzone${DNSSEC_VARIANT:-}
  TSIGKEYGEN=$TOP/bin/confgen/tsig-keygen
  VERIFY=$TOP/bin/dnssec/dnssec-verify
  WIRETEST=$TOP/bin/tests/wire_test
 -- 
-2.26.3
+2.31.1
 

From 2cc6a869e5fa5e1d7032a86d72958659a20d187d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 24 Jun 2021 12:14:55 +0200
Subject: [PATCH 252/460] Re-enable PDF building

Remove also conditionals for RHEL. RHEL8 and 9 has different
requirements, it does not make sense to tune them in Fedora package
itself. CentOS Stream 9 has already public spec adjusted to RHEL.
---
 bind.spec | 14 +++++---------
 1 file changed, 5 insertions(+), 9 deletions(-)

diff --git a/bind.spec b/bind.spec
index 822d3fc..c219eef 100644
--- a/bind.spec
+++ b/bind.spec
@@ -18,20 +18,13 @@
 %bcond_without DLZ
 # New MaxMind GeoLite support
 %bcond_without GEOIP2
-%if 0%{?fedora} >= 28
 # Disabled temporarily until kyua is fixed on rawhide, bug #1926779
 %bcond_with UNITTEST
 %bcond_without DNSTAP
 %bcond_without LMDB
 %bcond_without DOC
-%else
-%bcond_with    UNITTEST
-%bcond_with    DNSTAP
-%bcond_with    LMDB
-%bcond_with    DOC
-%endif
 # Because of issues with PDF rebuild, include only HTML pages
-%bcond_with    DOCPDF
+%bcond_without DOCPDF
 %bcond_with    TSAN
 
 %{?!bind_uid:  %global bind_uid  25}
@@ -62,7 +55,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.16.18
-Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1136,6 +1129,9 @@ fi;
 %endif
 
 %changelog
+* Tue Jun 22 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.18-2
+- Re-enable building of PDF ARM documentation
+
 * Fri Jun 18 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.18-1
 - Update to 9.16.18
 

From c9d581a577890e0b921ed26c7c67b424ff50ddf5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bj=C3=B6rn=20Esser?= <besser82@fedoraproject.org>
Date: Sat, 10 Jul 2021 11:51:41 +0200
Subject: [PATCH 253/460] Rebuild for versioned symbols in json-c

---
 bind.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index c219eef..616da37 100644
--- a/bind.spec
+++ b/bind.spec
@@ -55,7 +55,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.16.18
-Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  3%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1129,6 +1129,9 @@ fi;
 %endif
 
 %changelog
+* Sat Jul 10 2021 Björn Esser <besser82@fedoraproject.org> - 32:9.16.18-3
+- Rebuild for versioned symbols in json-c
+
 * Tue Jun 22 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.18-2
 - Re-enable building of PDF ARM documentation
 

From b2579336757089ec8ec78792d884e8e9bb9a4ceb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Sat, 10 Jul 2021 14:47:31 +0200
Subject: [PATCH 254/460] Disable PDF build on ELN

texlive-xindy is not available on ELN branch, therefore PDF building
would always fail. Skip PDF there.
---
 bind.spec | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index 616da37..47527e0 100644
--- a/bind.spec
+++ b/bind.spec
@@ -23,8 +23,11 @@
 %bcond_without DNSTAP
 %bcond_without LMDB
 %bcond_without DOC
+%if 0%{?fedora}
 # Because of issues with PDF rebuild, include only HTML pages
+# RHEL and ELN do not have all required packages
 %bcond_without DOCPDF
+%endif
 %bcond_with    TSAN
 
 %{?!bind_uid:  %global bind_uid  25}
@@ -55,7 +58,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.16.18
-Release:  3%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  4%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1129,6 +1132,9 @@ fi;
 %endif
 
 %changelog
+* Sat Jul 10 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.18-4
+- Disable PDF building on ELN
+
 * Sat Jul 10 2021 Björn Esser <besser82@fedoraproject.org> - 32:9.16.18-3
 - Rebuild for versioned symbols in json-c
 

From 9f3c81825074d914573b3cdf8f054373b0fb1173 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Wed, 21 Jul 2021 13:40:12 +0000
Subject: [PATCH 255/460] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>

From c02f91407f82c24963fa30b971d415815c27ce6d Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Wed, 21 Jul 2021 18:36:41 +0000
Subject: [PATCH 256/460] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
---
 bind.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index 47527e0..fe8128a 100644
--- a/bind.spec
+++ b/bind.spec
@@ -58,7 +58,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.16.18
-Release:  4%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  5%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1132,6 +1132,9 @@ fi;
 %endif
 
 %changelog
+* Wed Jul 21 2021 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.16.18-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
+
 * Sat Jul 10 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.18-4
 - Disable PDF building on ELN
 

From 3bd7080e5325c7423468b4a190c070ac8fa6bfd8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 21 Jul 2021 21:30:04 +0200
Subject: [PATCH 257/460] Update to 9.16.19

Remove support for PREVER and PATCHVER, since upstream no longer
releases them. Simplifies a bit versioning.

Resolves: rhbz#1984627
---
 .gitignore |  2 ++
 bind.spec  | 19 +++++++++----------
 sources    |  4 ++--
 3 files changed, 13 insertions(+), 12 deletions(-)

diff --git a/.gitignore b/.gitignore
index 8a32a1b..c54e3d9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -152,3 +152,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.16.17.tar.xz.asc
 /bind-9.16.18.tar.xz
 /bind-9.16.18.tar.xz.asc
+/bind-9.16.19.tar.xz
+/bind-9.16.19.tar.xz.asc
diff --git a/bind.spec b/bind.spec
index fe8128a..820b53d 100644
--- a/bind.spec
+++ b/bind.spec
@@ -1,12 +1,8 @@
 #
-# Red Hat BIND package .spec file
+# Red Hat BIND9 package .spec file
 #
 # vim:expandtab ts=2:
 
-#%%global PATCHVER P1
-#%%global PREVER rc1
-%global BINDVERSION %{version}%{?PREVER}%{?PATCHVER:-%{PATCHVER}}
-
 # bcond_without is built by default, unless --without X is passed
 # bcond_with is built only when --with X is passed to build
 %bcond_with    SYSTEMTEST
@@ -57,14 +53,14 @@
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.16.18
-Release:  5%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Version:  9.16.19
+Release:  1%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
-Source0:  https://downloads.isc.org/isc/bind9/%{BINDVERSION}/bind-%{BINDVERSION}.tar.xz
+Source0:  https://downloads.isc.org/isc/bind9/%{version}/bind-%{version}.tar.xz
 Source1:  named.sysconfig
-Source2:  https://downloads.isc.org/isc/bind9/%{BINDVERSION}/bind-%{BINDVERSION}.tar.xz.asc
+Source2:  https://downloads.isc.org/isc/bind9/%{version}/bind-%{version}.tar.xz.asc
 Source3:  named.logrotate
 Source4:  https://downloads.isc.org/isc/pgpkeys/codesign2021.txt
 Source16: named.conf
@@ -399,7 +395,7 @@ in HTML and PDF format.
 # RHEL does not yet support this verification
 %{gpgverify} --keyring='%{SOURCE4}' --signature='%{SOURCE2}' --data='%{SOURCE0}'
 %endif
-%setup -q -n %{name}-%{BINDVERSION}
+%setup -q
 
 # Common patches
 %patch10 -p1 -b .PIE
@@ -1132,6 +1128,9 @@ fi;
 %endif
 
 %changelog
+* Wed Jul 21 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.19-1
+- Update to 9.16.19 (#1984627)
+
 * Wed Jul 21 2021 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.16.18-5
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
 
diff --git a/sources b/sources
index 07b3b7d..5c71987 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.16.18.tar.xz) = 6ba2f14324ebdc66d2a6d60e929fb47e170dd7662cf4b18ef3ad9da30a61b43c7d5539e931c483ab36e63ae0398aeed255fd672489fb332dccf182df9aa102f9
-SHA512 (bind-9.16.18.tar.xz.asc) = 384887fec89de30436b3c570843f2ae532b9bb54065991a8778c63262a3608c724a7007c55989c4f9132d7718f5a08b447b0c73ff9025f5fa6d47ee41200dabe
+SHA512 (bind-9.16.19.tar.xz) = 47a0867a34c73dd939f6e24ab63e1a9cc7ba3e4d42987dbf1be424afe320734587b09b26c3b3371861fe79e3ddc08a81a019bba0cadecf76e20f717103578dca
+SHA512 (bind-9.16.19.tar.xz.asc) = 91f35ce1eb53d874653f3bf56412cc8f90400e2064b1e0f5c9978f16a61a3eac0c19f80843fef49f4db0f4bc5e3df62458a6f09cada8f923ab8ea296165f4f2e

From a58a3a3f05c723152027dfa065a28a559ab5f104 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 21 Jul 2021 23:39:34 +0200
Subject: [PATCH 258/460] Disable PDF building on Rawhide (#1984687)

Just temporary workaround to failing pdf build.
---
 bind.spec | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index 820b53d..d4ffeed 100644
--- a/bind.spec
+++ b/bind.spec
@@ -19,7 +19,8 @@
 %bcond_without DNSTAP
 %bcond_without LMDB
 %bcond_without DOC
-%if 0%{?fedora}
+%if 0%{?fedora} && 0%{?fedora} < 35
+# FIXME: broken again on f35 (bug #1984687)
 # Because of issues with PDF rebuild, include only HTML pages
 # RHEL and ELN do not have all required packages
 %bcond_without DOCPDF
@@ -1130,6 +1131,7 @@ fi;
 %changelog
 * Wed Jul 21 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.19-1
 - Update to 9.16.19 (#1984627)
+- Disable PDF rebuild on Rawhide (#1984687)
 
 * Wed Jul 21 2021 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.16.18-5
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild

From dc4646b7fd6ec1409c06c67043928274a41e26a0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 23 Jul 2021 12:14:17 +0200
Subject: [PATCH 259/460] Include backward compatible html symlink in doc
 subpackage

---
 bind.spec | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index d4ffeed..91df24e 100644
--- a/bind.spec
+++ b/bind.spec
@@ -55,7 +55,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.16.19
-Release:  1%{?dist}
+Release:  2%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -734,6 +734,8 @@ popd
 mkdir -p ${RPM_BUILD_ROOT}%{_pkgdocdir}
 cp -a build/doc/arm/_build/html ${RPM_BUILD_ROOT}%{_pkgdocdir}
 rm -rf ${RPM_BUILD_ROOT}%{_pkgdocdir}/html/.{buildinfo,doctrees}
+# Backward compatible link to 9.11 documentation
+(cd ${RPM_BUILD_ROOT}%{_pkgdocdir} && ln -s html/index.html Bv9ARM.html)
 # Share static data from original sphinx package
 for DIR in %{python3_sitelib}/sphinx_rtd_theme/static/*
 do
@@ -1122,6 +1124,7 @@ fi;
 %if %{with DOC}
 %files doc
 %dir %{_pkgdocdir}
+%doc %{_pkgdocdir}/Bv9ARM.html
 %doc %{_pkgdocdir}/html
 %endif
 %if %{with DOCPDF}
@@ -1129,6 +1132,9 @@ fi;
 %endif
 
 %changelog
+* Fri Jul 23 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.19-2
+- Include backward compatible html symlink in doc subpackage
+
 * Wed Jul 21 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.19-1
 - Update to 9.16.19 (#1984627)
 - Disable PDF rebuild on Rawhide (#1984687)

From 77857154b59d9e33480b005e0136d8b86c3e9bc8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 3 Aug 2021 08:11:03 +0200
Subject: [PATCH 260/460] Reenable PDF building again (#1984687)

---
 bind.spec | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/bind.spec b/bind.spec
index 91df24e..b3a15fb 100644
--- a/bind.spec
+++ b/bind.spec
@@ -19,9 +19,7 @@
 %bcond_without DNSTAP
 %bcond_without LMDB
 %bcond_without DOC
-%if 0%{?fedora} && 0%{?fedora} < 35
-# FIXME: broken again on f35 (bug #1984687)
-# Because of issues with PDF rebuild, include only HTML pages
+%if 0%{?fedora}
 # RHEL and ELN do not have all required packages
 %bcond_without DOCPDF
 %endif
@@ -55,7 +53,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.16.19
-Release:  2%{?dist}
+Release:  3%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1132,6 +1130,9 @@ fi;
 %endif
 
 %changelog
+* Tue Aug 03 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.19-3
+- Reenable PDF building again (#1984687)
+
 * Fri Jul 23 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.19-2
 - Include backward compatible html symlink in doc subpackage
 

From 739136846ce1caf0d34b2cf7f164c88ead0fa169 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 5 Aug 2021 14:33:51 +0200
Subject: [PATCH 261/460] Do not depend on systemd package

---
 bind.spec | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/bind.spec b/bind.spec
index b3a15fb..00338fd 100644
--- a/bind.spec
+++ b/bind.spec
@@ -53,7 +53,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.16.19
-Release:  3%{?dist}
+Release:  4%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -105,9 +105,7 @@ Patch164:bind-9.11-rh1666814.patch
 Patch170:bind-9.11-feature-test-named.patch
 Patch171:bind-9.11-tests-variants.patch
 
-Requires(post):   systemd
-Requires(preun):  systemd
-Requires(postun): systemd
+%{?systemd_ordering}
 Requires:       coreutils
 Requires(pre):  shadow-utils
 Requires(post): shadow-utils
@@ -122,7 +120,7 @@ Recommends:     bind-utils bind-dnssec-utils
 BuildRequires:  gcc, make
 BuildRequires:  openssl-devel, libtool, autoconf, pkgconfig, libcap-devel
 BuildRequires:  libidn2-devel, libxml2-devel
-BuildRequires:  systemd
+BuildRequires:  systemd-rpm-macros
 BuildRequires:  selinux-policy
 # needed for %%{__python3} macro
 BuildRequires:  python3-devel
@@ -186,7 +184,6 @@ tools for verifying that the DNS server is operating properly.
 %if %{with PKCS11}
 %package pkcs11
 Summary: Bind with native PKCS#11 functionality for crypto
-Requires: systemd
 Requires: bind%{?_isa} = %{epoch}:%{version}-%{release}
 Requires: bind-libs%{?_isa} = %{epoch}:%{version}-%{release}
 Requires: bind-pkcs11-libs%{?_isa} = %{epoch}:%{version}-%{release}
@@ -1130,6 +1127,9 @@ fi;
 %endif
 
 %changelog
+* Thu Aug 05 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.19-4
+- Do not depend on systemd package
+
 * Tue Aug 03 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.19-3
 - Reenable PDF building again (#1984687)
 

From 9d509c6973c59665ec67660b85092f9580f3ccc2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 18 Aug 2021 19:51:11 +0200
Subject: [PATCH 262/460] Update to 9.16.20 (#1995289)

---
 .gitignore | 2 ++
 bind.spec  | 7 +++++--
 sources    | 4 ++--
 3 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/.gitignore b/.gitignore
index c54e3d9..0cb91f0 100644
--- a/.gitignore
+++ b/.gitignore
@@ -154,3 +154,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.16.18.tar.xz.asc
 /bind-9.16.19.tar.xz
 /bind-9.16.19.tar.xz.asc
+/bind-9.16.20.tar.xz
+/bind-9.16.20.tar.xz.asc
diff --git a/bind.spec b/bind.spec
index 00338fd..c4e9ad4 100644
--- a/bind.spec
+++ b/bind.spec
@@ -52,8 +52,8 @@
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.16.19
-Release:  4%{?dist}
+Version:  9.16.20
+Release:  1%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1127,6 +1127,9 @@ fi;
 %endif
 
 %changelog
+* Tue Aug 17 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.20-1
+- Update to 9.16.20
+
 * Thu Aug 05 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.19-4
 - Do not depend on systemd package
 
diff --git a/sources b/sources
index 5c71987..b49745d 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.16.19.tar.xz) = 47a0867a34c73dd939f6e24ab63e1a9cc7ba3e4d42987dbf1be424afe320734587b09b26c3b3371861fe79e3ddc08a81a019bba0cadecf76e20f717103578dca
-SHA512 (bind-9.16.19.tar.xz.asc) = 91f35ce1eb53d874653f3bf56412cc8f90400e2064b1e0f5c9978f16a61a3eac0c19f80843fef49f4db0f4bc5e3df62458a6f09cada8f923ab8ea296165f4f2e
+SHA512 (bind-9.16.20.tar.xz) = bd4ffcc2589ca8f1ac228576ec11e86f317d5a78d7964a0a7ae70b2fa38831d5bd65c2e8c35d8190502de7139f85d8b080b3b8ee968811a8df78e5761781525d
+SHA512 (bind-9.16.20.tar.xz.asc) = ae4fdcd0ab40ac4adce6154ef3b251a552a7cd42dc8ebfd1c38dfd0a6ead5d6e74e67cb1f4247c4a3fb25a9580043635cc946e536f2a7ec8bc9e654dde2d58bf

From 50e206624d5dc36e17fef68eddd009768f220be0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 19 Aug 2021 17:05:11 +0200
Subject: [PATCH 263/460] Fix regression in map fileformat compatibility

https://gitlab.isc.org/isc-projects/bind9/-/issues/2872
---
 bind-9.16-nodelock-count.patch | 38 ++++++++++++++++++++++++++++++++++
 bind.spec                      |  8 ++++++-
 2 files changed, 45 insertions(+), 1 deletion(-)
 create mode 100644 bind-9.16-nodelock-count.patch

diff --git a/bind-9.16-nodelock-count.patch b/bind-9.16-nodelock-count.patch
new file mode 100644
index 0000000..4462811
--- /dev/null
+++ b/bind-9.16-nodelock-count.patch
@@ -0,0 +1,38 @@
+From 33e5888cb723bb43bc622eaa8ded2c9f383e4a54 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
+Date: Thu, 19 Aug 2021 16:58:14 +0200
+Subject: [PATCH] Revert "Reduce the nodelock count for both cache and regular
+ rbtdb"
+
+This reverts commit bceda720e420cd22e60c7a407535746281efb33b.
+
+https://gitlab.isc.org/isc-projects/bind9/-/issues/2872
+---
+ lib/dns/rbtdb.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
+index 18503950ad..5c37b7d049 100644
+--- a/lib/dns/rbtdb.c
++++ b/lib/dns/rbtdb.c
+@@ -348,7 +348,7 @@ typedef ISC_LIST(dns_rbtnode_t) rbtnodelist_t;
+ 	(((header)->rdh_ttl > (now)) || \
+ 	 ((header)->rdh_ttl == (now) && ZEROTTL(header)))
+ 
+-#define DEFAULT_NODE_LOCK_COUNT	    7 /*%< Should be prime. */
++#define DEFAULT_NODE_LOCK_COUNT	    53 /*%< Should be prime. */
+ #define RBTDB_GLUE_TABLE_INIT_BITS  2U
+ #define RBTDB_GLUE_TABLE_MAX_BITS   32U
+ #define RBTDB_GLUE_TABLE_OVERCOMMIT 3
+@@ -380,7 +380,7 @@ hash_32(uint32_t val, unsigned int bits) {
+ #define DEFAULT_CACHE_NODE_LOCK_COUNT DNS_RBTDB_CACHE_NODE_LOCK_COUNT
+ #endif /* if DNS_RBTDB_CACHE_NODE_LOCK_COUNT <= 1 */
+ #else  /* ifdef DNS_RBTDB_CACHE_NODE_LOCK_COUNT */
+-#define DEFAULT_CACHE_NODE_LOCK_COUNT 17
++#define DEFAULT_CACHE_NODE_LOCK_COUNT 97
+ #endif /* DNS_RBTDB_CACHE_NODE_LOCK_COUNT */
+ 
+ typedef struct {
+-- 
+2.31.1
+
diff --git a/bind.spec b/bind.spec
index c4e9ad4..ef281b9 100644
--- a/bind.spec
+++ b/bind.spec
@@ -53,7 +53,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.16.20
-Release:  1%{?dist}
+Release:  2%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -104,6 +104,8 @@ Patch157:bind-9.11-fips-tests.patch
 Patch164:bind-9.11-rh1666814.patch
 Patch170:bind-9.11-feature-test-named.patch
 Patch171:bind-9.11-tests-variants.patch
+# https://gitlab.isc.org/isc-projects/bind9/-/issues/2872
+Patch172:bind-9.16-nodelock-count.patch
 
 %{?systemd_ordering}
 Requires:       coreutils
@@ -404,6 +406,7 @@ in HTML and PDF format.
 %patch164 -p1 -b .rh1666814
 %patch170 -p1 -b .featuretest-named
 %patch171 -p1 -b .test-variant
+%patch172 -p1 -b .node-count
 
 %if %{with PKCS11}
 %patch135 -p1 -b .config-pkcs11
@@ -1127,6 +1130,9 @@ fi;
 %endif
 
 %changelog
+* Thu Aug 19 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.20-2
+- Fix map file format regression
+
 * Tue Aug 17 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.20-1
 - Update to 9.16.20
 

From 4cac5c90e0c3f815823c971c58f83b6d82265977 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 25 Aug 2021 14:30:17 +0200
Subject: [PATCH 264/460] Increase map format version, lower memory consuption
 a bit

Resolves: rhbz#1997504
---
 bind-9.16-nodelock-count.patch    | 38 -------------------------------
 bind-9.16.20-map-format-fix.patch |  8 +++++++
 bind.spec                         |  9 +++++---
 3 files changed, 14 insertions(+), 41 deletions(-)
 delete mode 100644 bind-9.16-nodelock-count.patch
 create mode 100644 bind-9.16.20-map-format-fix.patch

diff --git a/bind-9.16-nodelock-count.patch b/bind-9.16-nodelock-count.patch
deleted file mode 100644
index 4462811..0000000
--- a/bind-9.16-nodelock-count.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From 33e5888cb723bb43bc622eaa8ded2c9f383e4a54 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Thu, 19 Aug 2021 16:58:14 +0200
-Subject: [PATCH] Revert "Reduce the nodelock count for both cache and regular
- rbtdb"
-
-This reverts commit bceda720e420cd22e60c7a407535746281efb33b.
-
-https://gitlab.isc.org/isc-projects/bind9/-/issues/2872
----
- lib/dns/rbtdb.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
-index 18503950ad..5c37b7d049 100644
---- a/lib/dns/rbtdb.c
-+++ b/lib/dns/rbtdb.c
-@@ -348,7 +348,7 @@ typedef ISC_LIST(dns_rbtnode_t) rbtnodelist_t;
- 	(((header)->rdh_ttl > (now)) || \
- 	 ((header)->rdh_ttl == (now) && ZEROTTL(header)))
- 
--#define DEFAULT_NODE_LOCK_COUNT	    7 /*%< Should be prime. */
-+#define DEFAULT_NODE_LOCK_COUNT	    53 /*%< Should be prime. */
- #define RBTDB_GLUE_TABLE_INIT_BITS  2U
- #define RBTDB_GLUE_TABLE_MAX_BITS   32U
- #define RBTDB_GLUE_TABLE_OVERCOMMIT 3
-@@ -380,7 +380,7 @@ hash_32(uint32_t val, unsigned int bits) {
- #define DEFAULT_CACHE_NODE_LOCK_COUNT DNS_RBTDB_CACHE_NODE_LOCK_COUNT
- #endif /* if DNS_RBTDB_CACHE_NODE_LOCK_COUNT <= 1 */
- #else  /* ifdef DNS_RBTDB_CACHE_NODE_LOCK_COUNT */
--#define DEFAULT_CACHE_NODE_LOCK_COUNT 17
-+#define DEFAULT_CACHE_NODE_LOCK_COUNT 97
- #endif /* DNS_RBTDB_CACHE_NODE_LOCK_COUNT */
- 
- typedef struct {
--- 
-2.31.1
-
diff --git a/bind-9.16.20-map-format-fix.patch b/bind-9.16.20-map-format-fix.patch
new file mode 100644
index 0000000..f6e3c9b
--- /dev/null
+++ b/bind-9.16.20-map-format-fix.patch
@@ -0,0 +1,8 @@
+--- a/lib/dns/mapapi
++++ b/lib/dns/mapapi
+@@ -13,4 +13,4 @@
+ # Whenever releasing a new major release of BIND9, set this value
+ # back to 1.0 when releasing the first alpha.  Map files are *never*
+ # compatible across major releases.
+-MAPAPI=2.0
++MAPAPI=3.0
diff --git a/bind.spec b/bind.spec
index ef281b9..d020de0 100644
--- a/bind.spec
+++ b/bind.spec
@@ -53,7 +53,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.16.20
-Release:  2%{?dist}
+Release:  3%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -105,7 +105,7 @@ Patch164:bind-9.11-rh1666814.patch
 Patch170:bind-9.11-feature-test-named.patch
 Patch171:bind-9.11-tests-variants.patch
 # https://gitlab.isc.org/isc-projects/bind9/-/issues/2872
-Patch172:bind-9.16-nodelock-count.patch
+Patch172:https://downloads.isc.org/isc/bind9/9.16.20/patches/bind-9.16.20-map-format-fix.patch
 
 %{?systemd_ordering}
 Requires:       coreutils
@@ -406,7 +406,7 @@ in HTML and PDF format.
 %patch164 -p1 -b .rh1666814
 %patch170 -p1 -b .featuretest-named
 %patch171 -p1 -b .test-variant
-%patch172 -p1 -b .node-count
+%patch172 -p1 -b .map-format
 
 %if %{with PKCS11}
 %patch135 -p1 -b .config-pkcs11
@@ -1130,6 +1130,9 @@ fi;
 %endif
 
 %changelog
+* Wed Aug 25 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.20-3
+- Increase map format version, lower memory consuption a bit (#1997504)
+
 * Thu Aug 19 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.20-2
 - Fix map file format regression
 

From 32ee97f516c864592e9771fc18b9bb8833f12e6f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 25 Aug 2021 15:38:17 +0200
Subject: [PATCH 265/460] Remove unneeded test variants changes

Variants for testing were planned to test also named-sdb and
named-pkcs11 builds. Instead, those build were deprecated, named-sdb no
longer exists with possible replacement of named-dlz plugins.
named-pkcs11 would not be built soon, it can be replaced by using -E
pkcs11 parameter to named and some dnssec-* tools. Testing those
variants should not be required this way.
---
 bind-9.10-dist-native-pkcs11.patch | 43 ++++++++------------
 bind-9.11-feature-test-named.patch | 59 ---------------------------
 bind-9.11-tests-variants.patch     | 65 ------------------------------
 bind.spec                          |  6 +--
 4 files changed, 19 insertions(+), 154 deletions(-)
 delete mode 100644 bind-9.11-feature-test-named.patch
 delete mode 100644 bind-9.11-tests-variants.patch

diff --git a/bind-9.10-dist-native-pkcs11.patch b/bind-9.10-dist-native-pkcs11.patch
index 85ece30..e4f1ebd 100644
--- a/bind-9.10-dist-native-pkcs11.patch
+++ b/bind-9.10-dist-native-pkcs11.patch
@@ -1,4 +1,4 @@
-From 040227009453b3f0aa7914c7a6a94dc57ad5269b Mon Sep 17 00:00:00 2001
+From 1cbffe7e8b5bced9134abbae23a2a20c83d39a6a Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Thu, 21 Jan 2021 10:46:20 +0100
 Subject: [PATCH] Enable custom pkcs11 native build
@@ -9,7 +9,7 @@ pkcs11 libraries as a new copy of libdns and libns.
  bin/Makefile.in                  |  2 +-
  bin/confgen/Makefile.in          |  2 +-
  bin/dnssec-pkcs11/Makefile.in    | 39 +++++++++++++++++---------------
- bin/named-pkcs11/Makefile.in     | 33 ++++++++++++++-------------
+ bin/named-pkcs11/Makefile.in     | 31 +++++++++++++------------
  configure.ac                     | 19 ++++++++++++++++
  lib/Makefile.in                  |  2 +-
  lib/dns-pkcs11/Makefile.in       | 22 +++++++++---------
@@ -17,7 +17,7 @@ pkcs11 libraries as a new copy of libdns and libns.
  lib/ns-pkcs11/Makefile.in        | 26 ++++++++++-----------
  lib/ns-pkcs11/tests/Makefile.in  | 12 +++++-----
  make/includes.in                 |  7 ++++++
- 11 files changed, 101 insertions(+), 71 deletions(-)
+ 11 files changed, 100 insertions(+), 70 deletions(-)
 
 diff --git a/bin/Makefile.in b/bin/Makefile.in
 index 9ad7f62..094775a 100644
@@ -151,7 +151,7 @@ index ace0e5a..e0f6a00 100644
  	dnssec-importkey.@O@ ${OBJS} ${LIBS}
  
 diff --git a/bin/named-pkcs11/Makefile.in b/bin/named-pkcs11/Makefile.in
-index 98125dd..518a75f 100644
+index debb906..ecfdb6c 100644
 --- a/bin/named-pkcs11/Makefile.in
 +++ b/bin/named-pkcs11/Makefile.in
 @@ -37,13 +37,14 @@ DBDRIVER_LIBS =
@@ -208,8 +208,8 @@ index 98125dd..518a75f 100644
  
  SUBDIRS =	unix
  
--TARGETS =	named@EXEEXT@ feature-test@EXEEXT@
-+TARGETS =	named-pkcs11@EXEEXT@ feature-test-pkcs11@EXEEXT@
+-TARGETS =	named@EXEEXT@
++TARGETS =	named-pkcs11@EXEEXT@
  
  GEOIP2LINKOBJS = geoip.@O@
  
@@ -222,16 +222,7 @@ index 98125dd..518a75f 100644
  	export MAKE_SYMTABLE="yes"; \
  	export BASEOBJS="${OBJS} ${UOBJS}"; \
  	${FINALBUILDCMD}
-@@ -161,7 +162,7 @@ feature-test.@O@: ${top_srcdir}/bin/tests/system/feature-test.c
- 	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} \
- 		-c ${top_srcdir}/bin/tests/system/feature-test.c
- 
--feature-test@EXEEXT@: feature-test.@O@
-+feature-test-pkcs11@EXEEXT@: feature-test.@O@
- 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} \
- 		-o $@ feature-test.@O@ ${ISCLIBS} ${LIBS}
- 
-@@ -180,11 +181,11 @@ statschannel.@O@: bind9.xsl.h
+@@ -170,11 +171,11 @@ statschannel.@O@: bind9.xsl.h
  installdirs:
  	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
  
@@ -247,10 +238,10 @@ index 98125dd..518a75f 100644
  @DLZ_DRIVER_RULES@
  
 diff --git a/configure.ac b/configure.ac
-index 032228b..64e3da0 100644
+index e405eaf..efaa5a7 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -1251,12 +1251,14 @@ AC_SUBST(USE_GSSAPI)
+@@ -1269,12 +1269,14 @@ AC_SUBST(USE_GSSAPI)
  AC_SUBST(DST_GSSAPI_INC)
  AC_SUBST(DNS_GSSAPI_LIBS)
  DNS_CRYPTO_LIBS="$DNS_GSSAPI_LIBS"
@@ -265,7 +256,7 @@ index 032228b..64e3da0 100644
  
  #
  # was --with-lmdb specified?
-@@ -2327,6 +2329,8 @@ AC_SUBST(BIND9_DNS_BUILDINCLUDE)
+@@ -2345,6 +2347,8 @@ AC_SUBST(BIND9_DNS_BUILDINCLUDE)
  AC_SUBST(BIND9_NS_BUILDINCLUDE)
  AC_SUBST(BIND9_BIND9_BUILDINCLUDE)
  AC_SUBST(BIND9_IRS_BUILDINCLUDE)
@@ -274,7 +265,7 @@ index 032228b..64e3da0 100644
  if test "X$srcdir" != "X"; then
  	BIND9_ISC_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/isc/include"
  	BIND9_ISCCC_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/isccc/include"
-@@ -2335,6 +2339,8 @@ if test "X$srcdir" != "X"; then
+@@ -2353,6 +2357,8 @@ if test "X$srcdir" != "X"; then
  	BIND9_NS_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/ns/include"
  	BIND9_BIND9_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/bind9/include"
  	BIND9_IRS_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/irs/include"
@@ -283,7 +274,7 @@ index 032228b..64e3da0 100644
  else
  	BIND9_ISC_BUILDINCLUDE=""
  	BIND9_ISCCC_BUILDINCLUDE=""
-@@ -2343,6 +2349,8 @@ else
+@@ -2361,6 +2367,8 @@ else
  	BIND9_NS_BUILDINCLUDE=""
  	BIND9_BIND9_BUILDINCLUDE=""
  	BIND9_IRS_BUILDINCLUDE=""
@@ -292,7 +283,7 @@ index 032228b..64e3da0 100644
  fi
  
  AC_SUBST_FILE(BIND9_MAKE_INCLUDES)
-@@ -2798,8 +2806,11 @@ AC_CONFIG_FILES([
+@@ -2816,8 +2824,11 @@ AC_CONFIG_FILES([
  	bin/delv/Makefile
  	bin/dig/Makefile
  	bin/dnssec/Makefile
@@ -304,7 +295,7 @@ index 032228b..64e3da0 100644
  	bin/nsupdate/Makefile
  	bin/pkcs11/Makefile
  	bin/plugins/Makefile
-@@ -2861,6 +2872,10 @@ AC_CONFIG_FILES([
+@@ -2879,6 +2890,10 @@ AC_CONFIG_FILES([
  	lib/dns/include/dns/Makefile
  	lib/dns/include/dst/Makefile
  	lib/dns/tests/Makefile
@@ -315,7 +306,7 @@ index 032228b..64e3da0 100644
  	lib/irs/Makefile
  	lib/irs/include/Makefile
  	lib/irs/include/irs/Makefile
-@@ -2893,6 +2908,10 @@ AC_CONFIG_FILES([
+@@ -2911,6 +2926,10 @@ AC_CONFIG_FILES([
  	lib/ns/include/Makefile
  	lib/ns/include/ns/Makefile
  	lib/ns/tests/Makefile
@@ -410,7 +401,7 @@ index 58bda3c..d6a45df 100644
  	rm -f include/dns/rdatastruct.h
  	rm -f dnstap.pb-c.c dnstap.pb-c.h
 diff --git a/lib/dns-pkcs11/tests/Makefile.in b/lib/dns-pkcs11/tests/Makefile.in
-index 3bb5e01..c96fe7d 100644
+index da91394..aadb73f 100644
 --- a/lib/dns-pkcs11/tests/Makefile.in
 +++ b/lib/dns-pkcs11/tests/Makefile.in
 @@ -15,15 +15,15 @@ VERSION=@BIND9_VERSION@
@@ -546,5 +537,5 @@ index b8317d3..b73b0c4 100644
 +	-I${top_srcdir}/lib/ns-pkcs11/include
 +
 -- 
-2.26.3
+2.31.1
 
diff --git a/bind-9.11-feature-test-named.patch b/bind-9.11-feature-test-named.patch
deleted file mode 100644
index 9af8d73..0000000
--- a/bind-9.11-feature-test-named.patch
+++ /dev/null
@@ -1,59 +0,0 @@
-From e645046202006750f87531e21e3ff7c26fba3466 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Wed, 30 Jan 2019 14:37:17 +0100
-Subject: [PATCH] Create feature-test in source directory
-
-Feature-test tool is used in system tests to test compiled in changes.
-Because we build more variants of named with different configuration,
-compile feature-test for each of them this way.
----
- bin/named/Makefile.in       | 12 +++++++++++-
- bin/tests/system/conf.sh.in |  2 +-
- 2 files changed, 12 insertions(+), 2 deletions(-)
-
-diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
-index 37053a7..ed9add2 100644
---- a/bin/named/Makefile.in
-+++ b/bin/named/Makefile.in
-@@ -91,7 +91,7 @@ NOSYMLIBS =	${NSLIBS} ${DNSLIBS} ${BIND9LIBS} \
- 
- SUBDIRS =	unix
- 
--TARGETS =	named@EXEEXT@
-+TARGETS =	named@EXEEXT@ feature-test@EXEEXT@
- 
- GEOIP2LINKOBJS = geoip.@O@
- 
-@@ -154,6 +154,16 @@ named@EXEEXT@: ${OBJS} ${DEPLIBS}
- 	export BASEOBJS="${OBJS} ${UOBJS}"; \
- 	${FINALBUILDCMD}
- 
-+# Bit of hack, do not produce intermediate .o object for featuretest
-+feature-test.@O@: ${top_srcdir}/bin/tests/system/feature-test.c
-+	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} \
-+		-c ${top_srcdir}/bin/tests/system/feature-test.c
-+
-+feature-test@EXEEXT@: feature-test.@O@
-+	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} \
-+		-o $@ feature-test.@O@ ${ISCLIBS} ${LIBS}
-+
-+
- clean distclean maintainer-clean::
- 	rm -f ${TARGETS} ${OBJS}
- 
-diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
-index 7934930..e84fde2 100644
---- a/bin/tests/system/conf.sh.in
-+++ b/bin/tests/system/conf.sh.in
-@@ -37,7 +37,7 @@ DELV=$TOP/bin/delv/delv
- DIG=$TOP/bin/dig/dig
- DNSTAPREAD=$TOP/bin/tools/dnstap-read
- DSFROMKEY=$TOP/bin/dnssec/dnssec-dsfromkey
--FEATURETEST=$TOP/bin/tests/system/feature-test
-+FEATURETEST=$TOP/bin/named/feature-test
- FSTRM_CAPTURE=@FSTRM_CAPTURE@
- HOST=$TOP/bin/dig/host
- IMPORTKEY=$TOP/bin/dnssec/dnssec-importkey
--- 
-2.26.2
-
diff --git a/bind-9.11-tests-variants.patch b/bind-9.11-tests-variants.patch
deleted file mode 100644
index 2b29b99..0000000
--- a/bind-9.11-tests-variants.patch
+++ /dev/null
@@ -1,65 +0,0 @@
-From 953e480044f61dd162726f8345acf450d6ddbecc Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Fri, 1 Mar 2019 15:48:20 +0100
-Subject: [PATCH] Make alternative named builds testable in system tests
-
-Red Hat has alternative variant builds of named, which are not ever
-tested by system tests. New variables make it relatively easy to test
-alternative variants.
-
-For sdb variant use:
-export NAMED_VARIANT=-sdb DNSSEC_VARIANT=
-
-For pkcs variant use:
-export NAMED_VARIANT=-pkcs11 DNSSEC_VARIANT=-pkcs11
----
- bin/tests/system/conf.sh.in | 18 +++++++++---------
- 1 file changed, 9 insertions(+), 9 deletions(-)
-
-diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
-index d859909..db2bafb 100644
---- a/bin/tests/system/conf.sh.in
-+++ b/bin/tests/system/conf.sh.in
-@@ -37,17 +37,17 @@ DDNSCONFGEN=$TOP/bin/confgen/ddns-confgen
- DELV=$TOP/bin/delv/delv
- DIG=$TOP/bin/dig/dig
- DNSTAPREAD=$TOP/bin/tools/dnstap-read
--DSFROMKEY=$TOP/bin/dnssec/dnssec-dsfromkey
--FEATURETEST=$TOP/bin/named/feature-test
-+DSFROMKEY=$TOP/bin/dnssec${DNSSEC_VARIANT:-}/dnssec-dsfromkey${DNSSEC_VARIANT:-}
-+FEATURETEST=$TOP/bin/named${NAMED_VARIANT:-}/feature-test${NAMED_VARIANT:-}
- FSTRM_CAPTURE=@FSTRM_CAPTURE@
- HOST=$TOP/bin/dig/host
--IMPORTKEY=$TOP/bin/dnssec/dnssec-importkey
-+IMPORTKEY=$TOP/bin/dnssec${DNSSEC_VARIANT:-}/dnssec-importkey${DNSSEC_VARIANT:-}
- JOURNALPRINT=$TOP/bin/tools/named-journalprint
--KEYFRLAB=$TOP/bin/dnssec/dnssec-keyfromlabel
--KEYGEN=$TOP/bin/dnssec/dnssec-keygen
-+KEYFRLAB=$TOP/bin/dnssec${DNSSEC_VARIANT:-}/dnssec-keyfromlabel${DNSSEC_VARIANT:-}
-+KEYGEN=$TOP/bin/dnssec${DNSSEC_VARIANT:-}/dnssec-keygen${DNSSEC_VARIANT:-}
- KEYMGR=$TOP/bin/python/dnssec-keymgr
- MDIG=$TOP/bin/tools/mdig
--NAMED=$TOP/bin/named/named
-+NAMED=$TOP/bin/named${NAMED_VARIANT:-}/named${NAMED_VARIANT:-}
- NSEC3HASH=$TOP/bin/tools/nsec3hash
- NSLOOKUP=$TOP/bin/dig/nslookup
- NSUPDATE=$TOP/bin/nsupdate/nsupdate
-@@ -56,12 +56,12 @@ PK11DEL="$TOP/bin/pkcs11/pkcs11-destroy -s ${SLOT:-0} -p ${HSMPIN:-1234} -w 0"
- PK11GEN="$TOP/bin/pkcs11/pkcs11-keygen -q -s ${SLOT:-0} -p ${HSMPIN:-1234}"
- PK11LIST="$TOP/bin/pkcs11/pkcs11-list -s ${SLOT:-0} -p ${HSMPIN:-1234}"
- RESOLVE=$TOP/bin/tests/system/resolve
--REVOKE=$TOP/bin/dnssec/dnssec-revoke
-+REVOKE=$TOP/bin/dnssec${DNSSEC_VARIANT:-}/dnssec-revoke${DNSSEC_VARIANT:-}
- RNDC=$TOP/bin/rndc/rndc
- RNDCCONFGEN=$TOP/bin/confgen/rndc-confgen
- RRCHECKER=$TOP/bin/tools/named-rrchecker
--SETTIME=$TOP/bin/dnssec/dnssec-settime
--SIGNER=$TOP/bin/dnssec/dnssec-signzone
-+SETTIME=$TOP/bin/dnssec${DNSSEC_VARIANT:-}/dnssec-settime${DNSSEC_VARIANT:-}
-+SIGNER=$TOP/bin/dnssec${DNSSEC_VARIANT:-}/dnssec-signzone${DNSSEC_VARIANT:-}
- TSIGKEYGEN=$TOP/bin/confgen/tsig-keygen
- VERIFY=$TOP/bin/dnssec/dnssec-verify
- WIRETEST=$TOP/bin/tests/wire_test
--- 
-2.31.1
-
diff --git a/bind.spec b/bind.spec
index d020de0..5a86ee0 100644
--- a/bind.spec
+++ b/bind.spec
@@ -102,8 +102,6 @@ Patch149:bind-9.11-kyua-pkcs11.patch
 
 Patch157:bind-9.11-fips-tests.patch
 Patch164:bind-9.11-rh1666814.patch
-Patch170:bind-9.11-feature-test-named.patch
-Patch171:bind-9.11-tests-variants.patch
 # https://gitlab.isc.org/isc-projects/bind9/-/issues/2872
 Patch172:https://downloads.isc.org/isc/bind9/9.16.20/patches/bind-9.16.20-map-format-fix.patch
 
@@ -404,8 +402,6 @@ in HTML and PDF format.
 %patch130 -p1 -b .libdb
 %patch157 -p1 -b .fips-tests
 %patch164 -p1 -b .rh1666814
-%patch170 -p1 -b .featuretest-named
-%patch171 -p1 -b .test-variant
 %patch172 -p1 -b .map-format
 
 %if %{with PKCS11}
@@ -1130,8 +1126,10 @@ fi;
 %endif
 
 %changelog
+
 * Wed Aug 25 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.20-3
 - Increase map format version, lower memory consuption a bit (#1997504)
+- Remove unneeded test variants changes
 
 * Thu Aug 19 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.20-2
 - Fix map file format regression

From 113ef2a069e262083330bf0c210b4f3dd72a3295 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 25 Aug 2021 16:34:25 +0200
Subject: [PATCH 266/460] Ensure return codes make it into generated dig manual

It seems patched version were not catched by build dependencies. Change
include modification to propagate it.
---
 bind.spec | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/bind.spec b/bind.spec
index 5a86ee0..ec2280a 100644
--- a/bind.spec
+++ b/bind.spec
@@ -92,6 +92,7 @@ Patch72: bind-9.5-dlz-64bit.patch
 Patch106:bind93-rh490837.patch
 Patch112:bind97-rh645544.patch
 Patch130:bind-9.9.1-P2-dlz-libdb.patch
+# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/2688
 Patch133:bind99-rh640538.patch
 # Make PKCS11 used only for pkcs11 parts
 Patch135:bind-9.14-config-pkcs11.patch
@@ -415,6 +416,7 @@ cp -r lib/ns{,-pkcs11}
 %endif
 
 %patch133 -p1 -b .rh640538
+touch doc/man/dig.rst
 
 # Sparc and s390 arches need to use -fPIE
 %ifarch sparcv9 sparc64 s390 s390x
@@ -1130,6 +1132,7 @@ fi;
 * Wed Aug 25 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.20-3
 - Increase map format version, lower memory consuption a bit (#1997504)
 - Remove unneeded test variants changes
+- Include documentation of dig return codes
 
 * Thu Aug 19 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.20-2
 - Fix map file format regression

From 50423aedd63dc518e622cd793b7e7b88e1323d32 Mon Sep 17 00:00:00 2001
From: Sahana Prasad <sahana@redhat.com>
Date: Tue, 14 Sep 2021 18:59:02 +0200
Subject: [PATCH 267/460] Rebuilt with OpenSSL 3.0.0

---
 bind.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index ec2280a..080306e 100644
--- a/bind.spec
+++ b/bind.spec
@@ -53,7 +53,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.16.20
-Release:  3%{?dist}
+Release:  4%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1128,6 +1128,9 @@ fi;
 %endif
 
 %changelog
+* Tue Sep 14 2021 Sahana Prasad <sahana@redhat.com> - 32:9.16.20-4
+- Rebuilt with OpenSSL 3.0.0
+
 
 * Wed Aug 25 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.20-3
 - Increase map format version, lower memory consuption a bit (#1997504)

From 59865beb68eb8030663b83608d2490f871e1bb96 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 15 Sep 2021 12:24:43 +0200
Subject: [PATCH 268/460] Update to 9.16.21

- Support for HTTPS and SVCB

https://downloads.isc.org/isc/bind9/9.16.21/doc/arm/html/notes.html#notes-for-bind-9-16-21
---
 .gitignore                        |  2 ++
 bind-9.11-rh1666814.patch         | 21 +++++----------
 bind-9.16.20-map-format-fix.patch |  8 ------
 bind.spec                         | 17 +++++-------
 bind99-rh640538.patch             | 43 -------------------------------
 sources                           |  4 +--
 6 files changed, 16 insertions(+), 79 deletions(-)
 delete mode 100644 bind-9.16.20-map-format-fix.patch
 delete mode 100644 bind99-rh640538.patch

diff --git a/.gitignore b/.gitignore
index 0cb91f0..550e2d1 100644
--- a/.gitignore
+++ b/.gitignore
@@ -156,3 +156,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.16.19.tar.xz.asc
 /bind-9.16.20.tar.xz
 /bind-9.16.20.tar.xz.asc
+/bind-9.16.21.tar.xz
+/bind-9.16.21.tar.xz.asc
diff --git a/bind-9.11-rh1666814.patch b/bind-9.11-rh1666814.patch
index e66a5ab..533781d 100644
--- a/bind-9.11-rh1666814.patch
+++ b/bind-9.11-rh1666814.patch
@@ -1,4 +1,4 @@
-From a1a4730c1f02cd85680cf7608ac81e0db59ee522 Mon Sep 17 00:00:00 2001
+From d05d116da39c0a5c580ceaac6ba069899b82c5a0 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Wed, 16 Jan 2019 16:27:33 +0100
 Subject: [PATCH] Fix possible crash when loading corrupted file
@@ -6,23 +6,14 @@ Subject: [PATCH] Fix possible crash when loading corrupted file
 Some values passes internal triggers by coincidence. Fix the check and
 check also first_node_offset before even passing it further.
 ---
- lib/dns/rbt.c | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
+ lib/dns/rbt.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
 
 diff --git a/lib/dns/rbt.c b/lib/dns/rbt.c
-index ef6441b..404fd6d 100644
+index 5aee5f6..7f2c2d2 100644
 --- a/lib/dns/rbt.c
 +++ b/lib/dns/rbt.c
-@@ -754,7 +754,7 @@ treefix(dns_rbt_t *rbt, void *base, size_t filesize, dns_rbtnode_t *n,
- 	}
- 
- 	CONFIRM((void *)n >= base);
--	CONFIRM((char *)n - (char *)base <= (int)nodemax);
-+	CONFIRM((size_t)((char *)n - (char *)base) <= (int)nodemax);
- 	CONFIRM(DNS_RBTNODE_VALID(n));
- 
- 	dns_name_init(&nodename, NULL);
-@@ -911,7 +911,9 @@ dns_rbt_deserialize_tree(void *base_address, size_t filesize,
+@@ -945,7 +945,9 @@ dns_rbt_deserialize_tree(void *base_address, size_t filesize,
  	rbt->root = (dns_rbtnode_t *)((char *)base_address + header_offset +
  				      header->first_node_offset);
  
@@ -34,5 +25,5 @@ index ef6441b..404fd6d 100644
  		goto cleanup;
  	}
 -- 
-2.21.1
+2.31.1
 
diff --git a/bind-9.16.20-map-format-fix.patch b/bind-9.16.20-map-format-fix.patch
deleted file mode 100644
index f6e3c9b..0000000
--- a/bind-9.16.20-map-format-fix.patch
+++ /dev/null
@@ -1,8 +0,0 @@
---- a/lib/dns/mapapi
-+++ b/lib/dns/mapapi
-@@ -13,4 +13,4 @@
- # Whenever releasing a new major release of BIND9, set this value
- # back to 1.0 when releasing the first alpha.  Map files are *never*
- # compatible across major releases.
--MAPAPI=2.0
-+MAPAPI=3.0
diff --git a/bind.spec b/bind.spec
index 080306e..2737d16 100644
--- a/bind.spec
+++ b/bind.spec
@@ -52,8 +52,8 @@
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.16.20
-Release:  4%{?dist}
+Version:  9.16.21
+Release:  1%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -92,8 +92,6 @@ Patch72: bind-9.5-dlz-64bit.patch
 Patch106:bind93-rh490837.patch
 Patch112:bind97-rh645544.patch
 Patch130:bind-9.9.1-P2-dlz-libdb.patch
-# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/2688
-Patch133:bind99-rh640538.patch
 # Make PKCS11 used only for pkcs11 parts
 Patch135:bind-9.14-config-pkcs11.patch
 # Fedora specific patch to distribute native-pkcs#11 functionality
@@ -102,9 +100,8 @@ Patch136:bind-9.10-dist-native-pkcs11.patch
 Patch149:bind-9.11-kyua-pkcs11.patch
 
 Patch157:bind-9.11-fips-tests.patch
+# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/2689
 Patch164:bind-9.11-rh1666814.patch
-# https://gitlab.isc.org/isc-projects/bind9/-/issues/2872
-Patch172:https://downloads.isc.org/isc/bind9/9.16.20/patches/bind-9.16.20-map-format-fix.patch
 
 %{?systemd_ordering}
 Requires:       coreutils
@@ -403,7 +400,6 @@ in HTML and PDF format.
 %patch130 -p1 -b .libdb
 %patch157 -p1 -b .fips-tests
 %patch164 -p1 -b .rh1666814
-%patch172 -p1 -b .map-format
 
 %if %{with PKCS11}
 %patch135 -p1 -b .config-pkcs11
@@ -415,9 +411,6 @@ cp -r lib/ns{,-pkcs11}
 %patch149 -p1 -b .kyua-pkcs11
 %endif
 
-%patch133 -p1 -b .rh640538
-touch doc/man/dig.rst
-
 # Sparc and s390 arches need to use -fPIE
 %ifarch sparcv9 sparc64 s390 s390x
 for i in bin/named/{,unix}/Makefile.in; do
@@ -1128,10 +1121,12 @@ fi;
 %endif
 
 %changelog
+* Wed Sep 15 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.21-1
+- Update to 9.16.21
+
 * Tue Sep 14 2021 Sahana Prasad <sahana@redhat.com> - 32:9.16.20-4
 - Rebuilt with OpenSSL 3.0.0
 
-
 * Wed Aug 25 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.20-3
 - Increase map format version, lower memory consuption a bit (#1997504)
 - Remove unneeded test variants changes
diff --git a/bind99-rh640538.patch b/bind99-rh640538.patch
deleted file mode 100644
index 833c476..0000000
--- a/bind99-rh640538.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From d3c58d860737f0f70eff05edad77e0b2a90d4cb9 Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Fri, 19 Jun 2020 18:48:23 +0200
-Subject: [PATCH] .rh640538
-
----
- bin/dig/dig.rst | 20 ++++++++++++++++++++
- 1 file changed, 20 insertions(+)
-
-diff --git a/bin/dig/dig.rst b/bin/dig/dig.rst
-index bef52ba..9f16607 100644
---- a/bin/dig/dig.rst
-+++ b/bin/dig/dig.rst
-@@ -615,6 +615,26 @@ To turn off IDN support, use the parameters
- ``+noidnin`` and ``+noidnout``, or define the ``IDN_DISABLE`` environment
- variable.
- 
-+Return Codes
-+~~~~~~~~~~~~
-+
-+``dig`` return codes are:
-+
-+``0``
-+   Response received, including NXDOMAIN status
-+
-+``1``
-+   Usage error
-+
-+``8``
-+   Couldn't open batch file
-+
-+``9``
-+   No reply from server
-+
-+``10``
-+   Internal error
-+
- Files
- ~~~~~
- 
--- 
-2.26.2
-
diff --git a/sources b/sources
index b49745d..c51be57 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.16.20.tar.xz) = bd4ffcc2589ca8f1ac228576ec11e86f317d5a78d7964a0a7ae70b2fa38831d5bd65c2e8c35d8190502de7139f85d8b080b3b8ee968811a8df78e5761781525d
-SHA512 (bind-9.16.20.tar.xz.asc) = ae4fdcd0ab40ac4adce6154ef3b251a552a7cd42dc8ebfd1c38dfd0a6ead5d6e74e67cb1f4247c4a3fb25a9580043635cc946e536f2a7ec8bc9e654dde2d58bf
+SHA512 (bind-9.16.21.tar.xz) = 2cb71e50600fd7409ca7b7e2e9cf4ef6668b07faad7980ac8060e6a76f30a315182d75534ad1dcfb740c225cdf727b2bd6aa9ceb24ab77ffff09b7b5d6eaca2d
+SHA512 (bind-9.16.21.tar.xz.asc) = 6bed602050fe42e63b9073da0dc8563848406a4ac36d3c621a618c22d856fc6185304446a958ca534c780a384fec870801f2a92d3aa4e07b0afba46eb17c187a

From 67a5f4ae9906046c4f4bde4cfe558d8943270cdb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 13 Oct 2021 11:21:00 +0200
Subject: [PATCH 269/460] Propagate system emphemeral ports to chroot

BIND reads default system port ranges from /proc file. Propagate just
that single file to bind chroot. Defaults should be therefore the same
as on named.service.

Resolves: rhbz#2013597
---
 bind.spec          | 8 ++++++--
 named-chroot.files | 1 +
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/bind.spec b/bind.spec
index 2737d16..f642b77 100644
--- a/bind.spec
+++ b/bind.spec
@@ -32,7 +32,7 @@
 %global        chroot_prefix     %{bind_dir}/chroot
 %global        chroot_create_directories /dev /run/named %{_localstatedir}/{log,named,tmp} \\\
                                          %{_sysconfdir}/{crypto-policies/back-ends,pki/dnssec-keys,named} \\\
-                                         %{_libdir}/bind %{_libdir}/named %{_datadir}/GeoIP
+                                         %{_libdir}/bind %{_libdir}/named %{_datadir}/GeoIP /proc/sys/net/ipv4
 
 %global        selinuxbooleans   named_write_master_zones=1
 ## The order of libs is important. See lib/Makefile.in for details
@@ -53,7 +53,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.16.21
-Release:  1%{?dist}
+Release:  2%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1049,6 +1049,7 @@ fi;
 %dir %{chroot_prefix}/%{_libdir}
 %dir %{chroot_prefix}/%{_libdir}/bind
 %dir %{chroot_prefix}/%{_datadir}/GeoIP
+%{chroot_prefix}/proc
 %defattr(0660,root,named,01770)
 %dir %{chroot_prefix}%{_localstatedir}/named
 %defattr(0660,named,named,0770)
@@ -1121,6 +1122,9 @@ fi;
 %endif
 
 %changelog
+* Wed Oct 13 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.21-2
+- Propagate ephemeral port ranges to chroot (#2013597)
+
 * Wed Sep 15 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.21-1
 - Update to 9.16.21
 
diff --git a/named-chroot.files b/named-chroot.files
index 9a768e4..75e6aa1 100644
--- a/named-chroot.files
+++ b/named-chroot.files
@@ -20,6 +20,7 @@
 /usr/lib/named
 /usr/share/GeoIP
 /run/named
+/proc/sys/net/ipv4/ip_local_port_range
 # Warning: the order is important
 # If a directory containing $ROOTDIR is listed here,
 # it MUST be listed last. (/var/named contains /var/named/chroot)

From 6d858e28342de1cbe5bb8b4843e734689ba44d92 Mon Sep 17 00:00:00 2001
From: Adrian Reber <adrian@lisas.de>
Date: Sun, 24 Oct 2021 18:46:54 +0200
Subject: [PATCH 270/460] Rebuilt for protobuf 3.18.1

---
 bind.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index f642b77..9da55bb 100644
--- a/bind.spec
+++ b/bind.spec
@@ -53,7 +53,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.16.21
-Release:  2%{?dist}
+Release:  3%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1122,6 +1122,9 @@ fi;
 %endif
 
 %changelog
+* Sun Oct 24 2021 Adrian Reber <adrian@lisas.de> - 32:9.16.21-3
+- Rebuilt for protobuf 3.18.1
+
 * Wed Oct 13 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.21-2
 - Propagate ephemeral port ranges to chroot (#2013597)
 

From 5a12a8cddcdbc8f26735afdd73ebcb70fd39328d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 27 Oct 2021 20:13:32 +0200
Subject: [PATCH 271/460] Update to 9.16.22

---
 .gitignore | 2 ++
 bind.spec  | 7 +++++--
 sources    | 4 ++--
 3 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/.gitignore b/.gitignore
index 550e2d1..3aaae8a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -158,3 +158,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.16.20.tar.xz.asc
 /bind-9.16.21.tar.xz
 /bind-9.16.21.tar.xz.asc
+/bind-9.16.22.tar.xz
+/bind-9.16.22.tar.xz.asc
diff --git a/bind.spec b/bind.spec
index 9da55bb..076c58c 100644
--- a/bind.spec
+++ b/bind.spec
@@ -52,8 +52,8 @@
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.16.21
-Release:  3%{?dist}
+Version:  9.16.22
+Release:  1%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1122,6 +1122,9 @@ fi;
 %endif
 
 %changelog
+* Wed Oct 27 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.22-1
+- Update to 9.16.22
+
 * Sun Oct 24 2021 Adrian Reber <adrian@lisas.de> - 32:9.16.21-3
 - Rebuilt for protobuf 3.18.1
 
diff --git a/sources b/sources
index c51be57..cd323b3 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.16.21.tar.xz) = 2cb71e50600fd7409ca7b7e2e9cf4ef6668b07faad7980ac8060e6a76f30a315182d75534ad1dcfb740c225cdf727b2bd6aa9ceb24ab77ffff09b7b5d6eaca2d
-SHA512 (bind-9.16.21.tar.xz.asc) = 6bed602050fe42e63b9073da0dc8563848406a4ac36d3c621a618c22d856fc6185304446a958ca534c780a384fec870801f2a92d3aa4e07b0afba46eb17c187a
+SHA512 (bind-9.16.22.tar.xz) = 586fb4d5a656d6539033dcdfdd230b36465a2d2e6ada651c1f1548d062a9050e7a962af87e2a56931fe24c65586d29012d4a041dcddbb28f42b4d01fe291d9d1
+SHA512 (bind-9.16.22.tar.xz.asc) = eaffe44c19dd9a0c4ee4c707a599a2cae5c7038f524140f682f3edaf0d4737c44d6dd4be86fd43b9e66b23a21948e31b94f60543f849050ecd706b4be0c5b374

From cbb68a1d09a04a31fe244e047237824491308892 Mon Sep 17 00:00:00 2001
From: Adrian Reber <adrian@lisas.de>
Date: Sat, 6 Nov 2021 10:16:53 +0100
Subject: [PATCH 272/460] Rebuilt for protobuf 3.19.0

---
 bind.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index 076c58c..511373b 100644
--- a/bind.spec
+++ b/bind.spec
@@ -53,7 +53,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.16.22
-Release:  1%{?dist}
+Release:  2%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1122,6 +1122,9 @@ fi;
 %endif
 
 %changelog
+* Sat Nov 06 2021 Adrian Reber <adrian@lisas.de> - 32:9.16.22-2
+- Rebuilt for protobuf 3.19.0
+
 * Wed Oct 27 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.22-1
 - Update to 9.16.22
 

From f8d4aed3a6f45cc571add9178c299644e7d1d0ef Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 19 Nov 2021 18:40:03 +0100
Subject: [PATCH 273/460] Update 9.16.23

Reloading a catalog zone which referenced a missing/deleted member zone
triggered a runtime check failure, causing named to exit prematurely.
This has been fixed. [GL #2308]

https://downloads.isc.org/isc/bind9/9.16.23/doc/arm/html/notes.html#notes-for-bind-9-16-23
---
 .gitignore | 2 ++
 bind.spec  | 7 +++++--
 sources    | 4 ++--
 3 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/.gitignore b/.gitignore
index 3aaae8a..a917966 100644
--- a/.gitignore
+++ b/.gitignore
@@ -160,3 +160,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.16.21.tar.xz.asc
 /bind-9.16.22.tar.xz
 /bind-9.16.22.tar.xz.asc
+/bind-9.16.23.tar.xz
+/bind-9.16.23.tar.xz.asc
diff --git a/bind.spec b/bind.spec
index 511373b..371d5df 100644
--- a/bind.spec
+++ b/bind.spec
@@ -52,8 +52,8 @@
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.16.22
-Release:  2%{?dist}
+Version:  9.16.23
+Release:  1%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1122,6 +1122,9 @@ fi;
 %endif
 
 %changelog
+* Fri Nov 19 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-1
+- Update to 9.16.23 (#2024210)
+
 * Sat Nov 06 2021 Adrian Reber <adrian@lisas.de> - 32:9.16.22-2
 - Rebuilt for protobuf 3.19.0
 
diff --git a/sources b/sources
index cd323b3..38a7720 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.16.22.tar.xz) = 586fb4d5a656d6539033dcdfdd230b36465a2d2e6ada651c1f1548d062a9050e7a962af87e2a56931fe24c65586d29012d4a041dcddbb28f42b4d01fe291d9d1
-SHA512 (bind-9.16.22.tar.xz.asc) = eaffe44c19dd9a0c4ee4c707a599a2cae5c7038f524140f682f3edaf0d4737c44d6dd4be86fd43b9e66b23a21948e31b94f60543f849050ecd706b4be0c5b374
+SHA512 (bind-9.16.23.tar.xz) = 9dd1c5241f15bf6c3c1e1564564c7e91cba0dfc7f1262d53b4b54f4f7230ed651a148e95efa25efab1712b65bdeb555dfc0e1b524dcfc2a05ede43dd5b3978cf
+SHA512 (bind-9.16.23.tar.xz.asc) = b17fb7f8e24fd22f12113a5462e654c13660c1f66eeff19bb3e0e2eb63f048c2cac9e4a627e5e2d16b75d69234f5b9618f4d52ba4d9dd7d77fd2baf77322024a

From 0ddb138d488dc7cf382eb79bba5d979ef4cdde00 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 26 Nov 2021 12:14:11 +0100
Subject: [PATCH 274/460] Correct wrong %endif on --without GEOIP2

Description for devel subpackage needs to be always defined.

Resolves: rhbz#2026823
---
 bind.spec | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/bind.spec b/bind.spec
index 371d5df..b762d8c 100644
--- a/bind.spec
+++ b/bind.spec
@@ -53,7 +53,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.16.23
-Release:  1%{?dist}
+Release:  2%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -299,12 +299,12 @@ Requires:  fstrm-devel%{?_isa} protobuf-c-devel%{?_isa}
 %endif
 %if %{with GEOIP2}
 Requires:  libmaxminddb-devel%{?_isa}
+%endif
 
 %description devel
 The bind-devel package contains full version of the header files and libraries
 required for building bind-dyndb-ldap. Upstream no longer supports nor recommends
 bind libraries for third party applications.
-%endif
 
 %package chroot
 Summary:        A chroot runtime environment for the ISC BIND DNS server, named(8)
@@ -1122,6 +1122,9 @@ fi;
 %endif
 
 %changelog
+* Fri Nov 26 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-2
+- Correct with GEOIP2 condition (#2026823)
+
 * Fri Nov 19 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-1
 - Update to 9.16.23 (#2024210)
 

From 25b398b4e2bf35e06d892923206c00b18e3e809b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 15 Dec 2021 20:58:57 +0100
Subject: [PATCH 275/460] Update to 9.16.24

https://downloads.isc.org/isc/bind9/9.16.24/RELEASE-NOTES-bind-9.16.24.html
---
 bind-9.11-fips-tests.patch | 52 +++++++++++++++++++++++---------------
 bind.spec                  |  7 +++--
 2 files changed, 37 insertions(+), 22 deletions(-)

diff --git a/bind-9.11-fips-tests.patch b/bind-9.11-fips-tests.patch
index 51927a4..651db2a 100644
--- a/bind-9.11-fips-tests.patch
+++ b/bind-9.11-fips-tests.patch
@@ -1,4 +1,4 @@
-From 3f04cf343dbeb8819197702ce1be737e26e0638a Mon Sep 17 00:00:00 2001
+From 9575852be2344244ac182d7d019869406d3bd963 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 2 Aug 2018 23:46:45 +0200
 Subject: [PATCH] FIPS tests changes
@@ -73,7 +73,8 @@ Date:   Wed Mar 7 10:44:23 2018 +0100
  .../system/allow-query/ns2/named40.conf.in    |  4 +-
  bin/tests/system/allow-query/tests.sh         | 18 ++---
  bin/tests/system/catz/ns1/named.conf.in       |  2 +-
- bin/tests/system/catz/ns2/named.conf.in       |  2 +-
+ bin/tests/system/catz/ns2/named1.conf.in      |  2 +-
+ bin/tests/system/catz/ns2/named2.conf.in      |  2 +-
  bin/tests/system/checkconf/bad-tsig.conf      |  2 +-
  bin/tests/system/checkconf/good.conf          |  2 +-
  bin/tests/system/feature-test.c               | 14 ++++
@@ -91,7 +92,7 @@ Date:   Wed Mar 7 10:44:23 2018 +0100
  bin/tests/system/tsig/tests.sh                | 65 ++++++++++++-------
  bin/tests/system/upforwd/ns1/named.conf.in    |  2 +-
  bin/tests/system/upforwd/tests.sh             |  2 +-
- 33 files changed, 162 insertions(+), 108 deletions(-)
+ 34 files changed, 163 insertions(+), 109 deletions(-)
  create mode 100644 bin/tests/system/tsig/ns1/rndc5.conf.in
 
 diff --git a/bin/tests/system/acl/ns2/named1.conf.in b/bin/tests/system/acl/ns2/named1.conf.in
@@ -526,15 +527,26 @@ index 1218669..e62715e 100644
 -	algorithm hmac-md5;
 +	algorithm hmac-sha256;
  };
-diff --git a/bin/tests/system/catz/ns2/named.conf.in b/bin/tests/system/catz/ns2/named.conf.in
+diff --git a/bin/tests/system/catz/ns2/named1.conf.in b/bin/tests/system/catz/ns2/named1.conf.in
 index 30333e6..4005152 100644
---- a/bin/tests/system/catz/ns2/named.conf.in
-+++ b/bin/tests/system/catz/ns2/named.conf.in
+--- a/bin/tests/system/catz/ns2/named1.conf.in
++++ b/bin/tests/system/catz/ns2/named1.conf.in
 @@ -70,5 +70,5 @@ zone "catalog4.example" {
  
  key tsig_key. {
  	secret "LSAnCU+Z";
 -	algorithm hmac-md5;
++	algorithm hmac-sha256;
+ };
+diff --git a/bin/tests/system/catz/ns2/named2.conf.in b/bin/tests/system/catz/ns2/named2.conf.in
+index fcd99ca..84c97ca 100644
+--- a/bin/tests/system/catz/ns2/named2.conf.in
++++ b/bin/tests/system/catz/ns2/named2.conf.in
+@@ -56,5 +56,5 @@ zone "catalog4.example" {
+ 
+ key tsig_key. {
+ 	secret "LSAnCU+Z";
+-	algorithm hmac-md5;
 +	algorithm hmac-sha256;
  };
 diff --git a/bin/tests/system/checkconf/bad-tsig.conf b/bin/tests/system/checkconf/bad-tsig.conf
@@ -551,10 +563,10 @@ index 21be03e..e57c308 100644
  };
  
 diff --git a/bin/tests/system/checkconf/good.conf b/bin/tests/system/checkconf/good.conf
-index e09b9e8..2e824b3 100644
+index 616a544..e3a59a5 100644
 --- a/bin/tests/system/checkconf/good.conf
 +++ b/bin/tests/system/checkconf/good.conf
-@@ -210,6 +210,6 @@ dyndb "name" "library.so" {
+@@ -268,6 +268,6 @@ dyndb "name" "library.so" {
  	system;
  };
  key "mykey" {
@@ -670,10 +682,10 @@ index da6b3b4..c547e47 100644
  };
  
 diff --git a/bin/tests/system/nsupdate/setup.sh b/bin/tests/system/nsupdate/setup.sh
-index c055da3..4e1242b 100644
+index 5593a2e..7cd1a74 100644
 --- a/bin/tests/system/nsupdate/setup.sh
 +++ b/bin/tests/system/nsupdate/setup.sh
-@@ -56,7 +56,11 @@ EOF
+@@ -71,7 +71,11 @@ EOF
  
  $DDNSCONFGEN -q -z example.nil > ns1/ddns.key
  
@@ -687,10 +699,10 @@ index c055da3..4e1242b 100644
  $DDNSCONFGEN -q -a hmac-sha224 -k sha224-key -z keytests.nil > ns1/sha224.key
  $DDNSCONFGEN -q -a hmac-sha256 -k sha256-key -z keytests.nil > ns1/sha256.key
 diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh
-index b35d797..41c128e 100755
+index 8839131..fde6135 100755
 --- a/bin/tests/system/nsupdate/tests.sh
 +++ b/bin/tests/system/nsupdate/tests.sh
-@@ -797,7 +797,14 @@ fi
+@@ -824,7 +824,14 @@ fi
  n=`expr $n + 1`
  ret=0
  echo_i "check TSIG key algorithms (nsupdate -k) ($n)"
@@ -706,7 +718,7 @@ index b35d797..41c128e 100755
      $NSUPDATE -k ns1/${alg}.key <<END > /dev/null || ret=1
  server 10.53.0.1 ${PORT}
  update add ${alg}.keytests.nil. 600 A 10.10.10.3
-@@ -805,7 +812,7 @@ send
+@@ -832,7 +839,7 @@ send
  END
  done
  sleep 2
@@ -715,7 +727,7 @@ index b35d797..41c128e 100755
      $DIG $DIGOPTS +short @10.53.0.1 ${alg}.keytests.nil | grep 10.10.10.3 > /dev/null 2>&1 || ret=1
  done
  if [ $ret -ne 0 ]; then
-@@ -816,7 +823,7 @@ fi
+@@ -843,7 +850,7 @@ fi
  n=`expr $n + 1`
  ret=0
  echo_i "check TSIG key algorithms (nsupdate -y) ($n)"
@@ -724,7 +736,7 @@ index b35d797..41c128e 100755
      secret=$(sed -n 's/.*secret "\(.*\)";.*/\1/p' ns1/${alg}.key)
      $NSUPDATE -y "hmac-${alg}:${alg}-key:$secret" <<END > /dev/null || ret=1
  server 10.53.0.1 ${PORT}
-@@ -825,7 +832,7 @@ send
+@@ -852,7 +859,7 @@ send
  END
  done
  sleep 2
@@ -734,10 +746,10 @@ index b35d797..41c128e 100755
  done
  if [ $ret -ne 0 ]; then
 diff --git a/bin/tests/system/rndc/setup.sh b/bin/tests/system/rndc/setup.sh
-index b59e7a7..04d5f5a 100644
+index 225722f..63ac938 100644
 --- a/bin/tests/system/rndc/setup.sh
 +++ b/bin/tests/system/rndc/setup.sh
-@@ -33,7 +33,7 @@ make_key () {
+@@ -38,7 +38,7 @@ make_key () {
              sed 's/allow { 10.53.0.4/allow { any/' >> ns4/named.conf
  }
  
@@ -747,10 +759,10 @@ index b59e7a7..04d5f5a 100644
  make_key 3 ${EXTRAPORT3} hmac-sha224
  make_key 4 ${EXTRAPORT4} hmac-sha256
 diff --git a/bin/tests/system/rndc/tests.sh b/bin/tests/system/rndc/tests.sh
-index 9fd84ed..d0b188f 100644
+index 9bf86c6..b8a7a1f 100644
 --- a/bin/tests/system/rndc/tests.sh
 +++ b/bin/tests/system/rndc/tests.sh
-@@ -348,15 +348,20 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
+@@ -349,15 +349,20 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
  status=`expr $status + $ret`
  
  n=`expr $n + 1`
@@ -955,5 +967,5 @@ index a50c896..8062d68 100644
  update add updated.example. 600 A 10.10.10.1
  update add updated.example. 600 TXT Foo
 -- 
-2.26.2
+2.31.1
 
diff --git a/bind.spec b/bind.spec
index b762d8c..347cdfc 100644
--- a/bind.spec
+++ b/bind.spec
@@ -52,8 +52,8 @@
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.16.23
-Release:  2%{?dist}
+Version:  9.16.24
+Release:  1%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1122,6 +1122,9 @@ fi;
 %endif
 
 %changelog
+* Wed Dec 15 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.24-1
+- Update to 9.16.24 (#2032934)
+
 * Fri Nov 26 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-2
 - Correct with GEOIP2 condition (#2026823)
 

From 13da6470e0925c1d6ab9d86f92459cc67f667da3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 20 Dec 2021 11:37:38 +0100
Subject: [PATCH 276/460] Upload new sources

---
 .gitignore | 2 ++
 sources    | 4 ++--
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/.gitignore b/.gitignore
index a917966..283f728 100644
--- a/.gitignore
+++ b/.gitignore
@@ -162,3 +162,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.16.22.tar.xz.asc
 /bind-9.16.23.tar.xz
 /bind-9.16.23.tar.xz.asc
+/bind-9.16.24.tar.xz
+/bind-9.16.24.tar.xz.asc
diff --git a/sources b/sources
index 38a7720..ed0528a 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.16.23.tar.xz) = 9dd1c5241f15bf6c3c1e1564564c7e91cba0dfc7f1262d53b4b54f4f7230ed651a148e95efa25efab1712b65bdeb555dfc0e1b524dcfc2a05ede43dd5b3978cf
-SHA512 (bind-9.16.23.tar.xz.asc) = b17fb7f8e24fd22f12113a5462e654c13660c1f66eeff19bb3e0e2eb63f048c2cac9e4a627e5e2d16b75d69234f5b9618f4d52ba4d9dd7d77fd2baf77322024a
+SHA512 (bind-9.16.24.tar.xz) = a982bcad8c517dbcb81e768486e1a8b92e495efcf45c4961170c3bc7fac837903605dcd05cfb9b9e1074599b90be1b9c3dbca4162ede0a32fe4c3405ad92816b
+SHA512 (bind-9.16.24.tar.xz.asc) = 60afa2b2646fc761d85d15bc236fc700399478dfc8a9376bd591f1a3df4c0f26e029d6e8818cce3cdcd04600fd9d7b4d0092ac11a7c322159d15795165af3c79

From ec7f7e4c125f8d3ac99dd1bba0fba0d4f7639a5d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 22 Dec 2021 13:53:11 +0100
Subject: [PATCH 277/460] Fix OpenLDAP 2.6 conflict

Rename internal function to not start with just ldap_ prefix. OpenLDAP
library provides such function with different parameters and compiler
cannot pass it.
---
 bind-9.16-openldap-2.6.patch | 55 ++++++++++++++++++++++++++++++++++++
 bind.spec                    |  7 ++++-
 2 files changed, 61 insertions(+), 1 deletion(-)
 create mode 100644 bind-9.16-openldap-2.6.patch

diff --git a/bind-9.16-openldap-2.6.patch b/bind-9.16-openldap-2.6.patch
new file mode 100644
index 0000000..bdb7da5
--- /dev/null
+++ b/bind-9.16-openldap-2.6.patch
@@ -0,0 +1,55 @@
+From e6ed26c98ebac9313ce531a366f96ff9912e84af Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Wed, 22 Dec 2021 13:36:39 +0100
+Subject: [PATCH 1/2] Avoid conflict with ldap_connect function of openldap
+
+ldap_connect is defined by OpenLDAP 2.6. Compiler complains there are
+conflicting declarations. Use dlz_ldap prefix instead of ldap to avoid
+conflict.
+---
+ contrib/dlz/modules/ldap/dlz_ldap_dynamic.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/contrib/dlz/modules/ldap/dlz_ldap_dynamic.c b/contrib/dlz/modules/ldap/dlz_ldap_dynamic.c
+index 543a95d..317a691 100644
+--- a/contrib/dlz/modules/ldap/dlz_ldap_dynamic.c
++++ b/contrib/dlz/modules/ldap/dlz_ldap_dynamic.c
+@@ -193,7 +193,7 @@ cleanup:
+ 
+ /*% Connects / reconnects to LDAP server */
+ static isc_result_t
+-ldap_connect(ldap_instance_t *dbi, dbinstance_t *dbc) {
++dlz_ldap_connect(ldap_instance_t *dbi, dbinstance_t *dbc) {
+ 	isc_result_t result;
+ 	int ldap_result;
+ 
+@@ -700,7 +700,7 @@ ldap_get_results(const char *zone, const char *record, const char *client,
+ 			db->log(ISC_LOG_INFO, "LDAP driver attempting to "
+ 					      "re-connect");
+ 
+-			result = ldap_connect((ldap_instance_t *)dbdata, dbi);
++			result = dlz_ldap_connect((ldap_instance_t *)dbdata, dbi);
+ 			if (result != ISC_R_SUCCESS) {
+ 				result = ISC_R_FAILURE;
+ 				continue;
+@@ -731,7 +731,7 @@ ldap_get_results(const char *zone, const char *record, const char *client,
+ 		case LDAP_SERVER_DOWN:
+ 			db->log(ISC_LOG_INFO, "LDAP driver attempting to "
+ 					      "re-connect");
+-			result = ldap_connect((ldap_instance_t *)dbdata, dbi);
++			result = dlz_ldap_connect((ldap_instance_t *)dbdata, dbi);
+ 			if (result != ISC_R_SUCCESS) {
+ 				result = ISC_R_FAILURE;
+ 			}
+@@ -1117,7 +1117,7 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
+ 	ldap->db = dbi;
+ #endif /* if PTHREADS */
+ 		/* attempt to connect */
+-		result = ldap_connect(ldap, dbi);
++		result = dlz_ldap_connect(ldap, dbi);
+ 
+ 		/*
+ 		 * if db connection cannot be created, log err msg and
+-- 
+2.31.1
+
diff --git a/bind.spec b/bind.spec
index 347cdfc..6d8ecfb 100644
--- a/bind.spec
+++ b/bind.spec
@@ -53,7 +53,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.16.24
-Release:  1%{?dist}
+Release:  2%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -102,6 +102,7 @@ Patch149:bind-9.11-kyua-pkcs11.patch
 Patch157:bind-9.11-fips-tests.patch
 # https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/2689
 Patch164:bind-9.11-rh1666814.patch
+Patch165:bind-9.16-openldap-2.6.patch
 
 %{?systemd_ordering}
 Requires:       coreutils
@@ -400,6 +401,7 @@ in HTML and PDF format.
 %patch130 -p1 -b .libdb
 %patch157 -p1 -b .fips-tests
 %patch164 -p1 -b .rh1666814
+%patch165 -p1
 
 %if %{with PKCS11}
 %patch135 -p1 -b .config-pkcs11
@@ -1122,6 +1124,9 @@ fi;
 %endif
 
 %changelog
+* Wed Dec 22 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.24-2
+- Build with OpenLDAP 2.6 (#2032704)
+
 * Wed Dec 15 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.24-1
 - Update to 9.16.24 (#2032934)
 

From a8e525a2104a9548510538f0910c920bf5ecd9bb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 22 Dec 2021 13:57:36 +0100
Subject: [PATCH 278/460] Rename all function starting with ldap_ in dlz plugin

To prevent any future conflicts, rename all functions starting with
ldap_.
---
 bind-9.16-openldap-2.6-all.patch | 199 +++++++++++++++++++++++++++++++
 bind.spec                        |   5 +-
 2 files changed, 203 insertions(+), 1 deletion(-)
 create mode 100644 bind-9.16-openldap-2.6-all.patch

diff --git a/bind-9.16-openldap-2.6-all.patch b/bind-9.16-openldap-2.6-all.patch
new file mode 100644
index 0000000..6af2714
--- /dev/null
+++ b/bind-9.16-openldap-2.6-all.patch
@@ -0,0 +1,199 @@
+From d02a805719d593863dd438798a29312a4177d207 Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Wed, 22 Dec 2021 13:38:02 +0100
+Subject: [PATCH 2/2] Change all internal functions to dlz_ldap prefix
+
+To prevent any conflict in the future, avoid ldap_ prefix in any
+internal functions. Keep it reserved for openldap only.
+---
+ contrib/dlz/modules/ldap/dlz_ldap_dynamic.c | 52 ++++++++++-----------
+ 1 file changed, 26 insertions(+), 26 deletions(-)
+
+diff --git a/contrib/dlz/modules/ldap/dlz_ldap_dynamic.c b/contrib/dlz/modules/ldap/dlz_ldap_dynamic.c
+index 317a691..a653fac 100644
+--- a/contrib/dlz/modules/ldap/dlz_ldap_dynamic.c
++++ b/contrib/dlz/modules/ldap/dlz_ldap_dynamic.c
+@@ -128,7 +128,7 @@ b9_add_helper(ldap_instance_t *db, const char *helper_name, void *ptr);
+ 
+ /*% checks that the LDAP URL parameters make sense */
+ static isc_result_t
+-ldap_checkURL(ldap_instance_t *db, char *URL, int attrCnt, const char *msg) {
++dlz_ldap_checkURL(ldap_instance_t *db, char *URL, int attrCnt, const char *msg) {
+ 	isc_result_t result = ISC_R_SUCCESS;
+ 	int ldap_result;
+ 	LDAPURLDesc *ldap_url = NULL;
+@@ -248,7 +248,7 @@ cleanup:
+  * multithreaded operation.
+  */
+ static void
+-ldap_destroy_dblist(db_list_t *dblist) {
++dlz_ldap_destroy_dblist(db_list_t *dblist) {
+ 	dbinstance_t *ndbi = NULL;
+ 	dbinstance_t *dbi = NULL;
+ 
+@@ -282,7 +282,7 @@ ldap_destroy_dblist(db_list_t *dblist) {
+  * multithreaded operation.
+  */
+ static dbinstance_t *
+-ldap_find_avail_conn(ldap_instance_t *ldap) {
++dlz_ldap_find_avail_conn(ldap_instance_t *ldap) {
+ 	dbinstance_t *dbi = NULL;
+ 	dbinstance_t *head;
+ 	int count = 0;
+@@ -315,7 +315,7 @@ ldap_find_avail_conn(ldap_instance_t *ldap) {
+ #endif /* PTHREADS */
+ 
+ static isc_result_t
+-ldap_process_results(ldap_instance_t *db, LDAP *dbc, LDAPMessage *msg,
++dlz_ldap_process_results(ldap_instance_t *db, LDAP *dbc, LDAPMessage *msg,
+ 		     char **attrs, void *ptr, bool allnodes) {
+ 	isc_result_t result = ISC_R_SUCCESS;
+ 	int i = 0;
+@@ -543,7 +543,7 @@ cleanup:
+  * obtain a result set.
+  */
+ static isc_result_t
+-ldap_get_results(const char *zone, const char *record, const char *client,
++dlz_ldap_get_results(const char *zone, const char *record, const char *client,
+ 		 unsigned int query, void *dbdata, void *ptr) {
+ 	isc_result_t result;
+ 	ldap_instance_t *db = (ldap_instance_t *)dbdata;
+@@ -558,7 +558,7 @@ ldap_get_results(const char *zone, const char *record, const char *client,
+ 	/* get db instance / connection */
+ #if PTHREADS
+ 	/* find an available DBI from the list */
+-	dbi = ldap_find_avail_conn(db);
++	dbi = dlz_ldap_find_avail_conn(db);
+ #else  /* PTHREADS */
+ 	/*
+ 	 * only 1 DBI - no need to lock instance lock either
+@@ -667,7 +667,7 @@ ldap_get_results(const char *zone, const char *record, const char *client,
+ 		 * screwed up!
+ 		 */
+ 		db->log(ISC_LOG_ERROR, "Incorrect query flag passed to "
+-				       "ldap_get_results");
++				       "dlz_ldap_get_results");
+ 		result = ISC_R_UNEXPECTED;
+ 		goto cleanup;
+ 	}
+@@ -755,13 +755,13 @@ ldap_get_results(const char *zone, const char *record, const char *client,
+ 
+ 	switch (query) {
+ 	case ALLNODES:
+-		result = ldap_process_results(db, (LDAP *)dbi->dbconn, ldap_msg,
+-					      ldap_url->lud_attrs, ptr, true);
++		result = dlz_ldap_process_results(db, (LDAP *)dbi->dbconn, ldap_msg,
++					          ldap_url->lud_attrs, ptr, true);
+ 		break;
+ 	case AUTHORITY:
+ 	case LOOKUP:
+-		result = ldap_process_results(db, (LDAP *)dbi->dbconn, ldap_msg,
+-					      ldap_url->lud_attrs, ptr, false);
++		result = dlz_ldap_process_results(db, (LDAP *)dbi->dbconn, ldap_msg,
++					          ldap_url->lud_attrs, ptr, false);
+ 		break;
+ 	case ALLOWXFR:
+ 		entries = ldap_count_entries((LDAP *)dbi->dbconn, ldap_msg);
+@@ -789,7 +789,7 @@ ldap_get_results(const char *zone, const char *record, const char *client,
+ 		 * screwed up!
+ 		 */
+ 		db->log(ISC_LOG_ERROR, "Incorrect query flag passed to "
+-				       "ldap_get_results");
++				       "dlz_ldap_get_results");
+ 		result = ISC_R_UNEXPECTED;
+ 	}
+ 
+@@ -847,18 +847,18 @@ dlz_allowzonexfr(void *dbdata, const char *name, const char *client) {
+ 	}
+ 
+ 	/* get all the zone data */
+-	result = ldap_get_results(name, NULL, client, ALLOWXFR, dbdata, NULL);
++	result = dlz_ldap_get_results(name, NULL, client, ALLOWXFR, dbdata, NULL);
+ 	return (result);
+ }
+ 
+ isc_result_t
+ dlz_allnodes(const char *zone, void *dbdata, dns_sdlzallnodes_t *allnodes) {
+-	return (ldap_get_results(zone, NULL, NULL, ALLNODES, dbdata, allnodes));
++	return (dlz_ldap_get_results(zone, NULL, NULL, ALLNODES, dbdata, allnodes));
+ }
+ 
+ isc_result_t
+ dlz_authority(const char *zone, void *dbdata, dns_sdlzlookup_t *lookup) {
+-	return (ldap_get_results(zone, NULL, NULL, AUTHORITY, dbdata, lookup));
++	return (dlz_ldap_get_results(zone, NULL, NULL, AUTHORITY, dbdata, lookup));
+ }
+ 
+ #if DLZ_DLOPEN_VERSION < 3
+@@ -874,7 +874,7 @@ dlz_findzonedb(void *dbdata, const char *name, dns_clientinfomethods_t *methods,
+ 	UNUSED(methods);
+ 	UNUSED(clientinfo);
+ #endif /* if DLZ_DLOPEN_VERSION >= 3 */
+-	return (ldap_get_results(name, NULL, NULL, FINDZONE, dbdata, NULL));
++	return (dlz_ldap_get_results(name, NULL, NULL, FINDZONE, dbdata, NULL));
+ }
+ 
+ #if DLZ_DLOPEN_VERSION == 1
+@@ -896,11 +896,11 @@ dlz_lookup(const char *zone, const char *name, void *dbdata,
+ #endif /* if DLZ_DLOPEN_VERSION >= 2 */
+ 
+ 	if (strcmp(name, "*") == 0) {
+-		result = ldap_get_results(zone, "~", NULL, LOOKUP, dbdata,
+-					  lookup);
++		result = dlz_ldap_get_results(zone, "~", NULL, LOOKUP, dbdata,
++					      lookup);
+ 	} else {
+-		result = ldap_get_results(zone, name, NULL, LOOKUP, dbdata,
+-					  lookup);
++		result = dlz_ldap_get_results(zone, name, NULL, LOOKUP, dbdata,
++					      lookup);
+ 	}
+ 	return (result);
+ }
+@@ -1000,29 +1000,29 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
+ 	/* check that LDAP URL parameters make sense */
+ 	switch (argc) {
+ 	case 12:
+-		result = ldap_checkURL(ldap, argv[11], 0,
++		result = dlz_ldap_checkURL(ldap, argv[11], 0,
+ 				       "allow zone transfer");
+ 		if (result != ISC_R_SUCCESS) {
+ 			goto cleanup;
+ 		}
+ 	case 11:
+-		result = ldap_checkURL(ldap, argv[10], 3, "all nodes");
++		result = dlz_ldap_checkURL(ldap, argv[10], 3, "all nodes");
+ 		if (result != ISC_R_SUCCESS) {
+ 			goto cleanup;
+ 		}
+ 	case 10:
+ 		if (strlen(argv[9]) > 0) {
+-			result = ldap_checkURL(ldap, argv[9], 3, "authority");
++			result = dlz_ldap_checkURL(ldap, argv[9], 3, "authority");
+ 			if (result != ISC_R_SUCCESS) {
+ 				goto cleanup;
+ 			}
+ 		}
+ 	case 9:
+-		result = ldap_checkURL(ldap, argv[8], 3, "lookup");
++		result = dlz_ldap_checkURL(ldap, argv[8], 3, "lookup");
+ 		if (result != ISC_R_SUCCESS) {
+ 			goto cleanup;
+ 		}
+-		result = ldap_checkURL(ldap, argv[7], 0, "find zone");
++		result = dlz_ldap_checkURL(ldap, argv[7], 0, "find zone");
+ 		if (result != ISC_R_SUCCESS) {
+ 			goto cleanup;
+ 		}
+@@ -1199,7 +1199,7 @@ dlz_destroy(void *dbdata) {
+ #if PTHREADS
+ 		/* cleanup the list of DBI's */
+ 		if (db->db != NULL) {
+-			ldap_destroy_dblist((db_list_t *)(db->db));
++			dlz_ldap_destroy_dblist((db_list_t *)(db->db));
+ 		}
+ #else  /* PTHREADS */
+ 		if (db->db->dbconn != NULL) {
+-- 
+2.31.1
+
diff --git a/bind.spec b/bind.spec
index 6d8ecfb..9a6712d 100644
--- a/bind.spec
+++ b/bind.spec
@@ -102,7 +102,9 @@ Patch149:bind-9.11-kyua-pkcs11.patch
 Patch157:bind-9.11-fips-tests.patch
 # https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/2689
 Patch164:bind-9.11-rh1666814.patch
+# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/5665
 Patch165:bind-9.16-openldap-2.6.patch
+Patch166:bind-9.16-openldap-2.6-all.patch
 
 %{?systemd_ordering}
 Requires:       coreutils
@@ -401,7 +403,8 @@ in HTML and PDF format.
 %patch130 -p1 -b .libdb
 %patch157 -p1 -b .fips-tests
 %patch164 -p1 -b .rh1666814
-%patch165 -p1
+%patch165 -p1 -b .rh2032704
+%patch166 -p1 -b .rh2032704-2
 
 %if %{with PKCS11}
 %patch135 -p1 -b .config-pkcs11

From ed2f945c40d0d328bb810d607a8e1a20cf023020 Mon Sep 17 00:00:00 2001
From: Petr Sklenar <psklenar@redhat.com>
Date: Tue, 4 Jan 2022 11:16:17 +0100
Subject: [PATCH 279/460] Adding fmf plan

---
 .fmf/version                                  |   1 +
 ci.fmf                                        |  13 --
 gating.yaml                                   |  16 +-
 plans/all.fmf                                 |   6 +
 plans/tier1-public.fmf                        |   7 +
 tests/Master-server-chrooted/Makefile         |  63 ------
 tests/Master-server-chrooted/PURPOSE          |   6 -
 tests/Master-server-chrooted/runtest.sh       |  73 -------
 tests/Master-server-not-chrooted/Makefile     |  65 ------
 tests/Master-server-not-chrooted/PURPOSE      |   6 -
 tests/Master-server-not-chrooted/named.conf   |  11 --
 tests/Master-server-not-chrooted/runtest.sh   | 109 -----------
 tests/Master-server-not-chrooted/zonefile     |  27 ---
 tests/Run-internal-BIND-test-suite/Makefile   |  77 --------
 tests/Run-internal-BIND-test-suite/PURPOSE    |   6 -
 .../bind-systest-filter.sh                    |  47 -----
 tests/Run-internal-BIND-test-suite/knownerror |   2 -
 tests/Run-internal-BIND-test-suite/runtest.sh | 185 ------------------
 .../setup-named-softhsm.sh                    | 123 ------------
 tests/tests.yml                               |  11 --
 20 files changed, 27 insertions(+), 827 deletions(-)
 create mode 100644 .fmf/version
 delete mode 100644 ci.fmf
 create mode 100644 plans/all.fmf
 create mode 100644 plans/tier1-public.fmf
 delete mode 100644 tests/Master-server-chrooted/Makefile
 delete mode 100644 tests/Master-server-chrooted/PURPOSE
 delete mode 100755 tests/Master-server-chrooted/runtest.sh
 delete mode 100644 tests/Master-server-not-chrooted/Makefile
 delete mode 100644 tests/Master-server-not-chrooted/PURPOSE
 delete mode 100644 tests/Master-server-not-chrooted/named.conf
 delete mode 100644 tests/Master-server-not-chrooted/runtest.sh
 delete mode 100644 tests/Master-server-not-chrooted/zonefile
 delete mode 100644 tests/Run-internal-BIND-test-suite/Makefile
 delete mode 100644 tests/Run-internal-BIND-test-suite/PURPOSE
 delete mode 100755 tests/Run-internal-BIND-test-suite/bind-systest-filter.sh
 delete mode 100644 tests/Run-internal-BIND-test-suite/knownerror
 delete mode 100755 tests/Run-internal-BIND-test-suite/runtest.sh
 delete mode 100755 tests/Run-internal-BIND-test-suite/setup-named-softhsm.sh
 delete mode 100644 tests/tests.yml

diff --git a/.fmf/version b/.fmf/version
new file mode 100644
index 0000000..d00491f
--- /dev/null
+++ b/.fmf/version
@@ -0,0 +1 @@
+1
diff --git a/ci.fmf b/ci.fmf
deleted file mode 100644
index 9a9fbea..0000000
--- a/ci.fmf
+++ /dev/null
@@ -1,13 +0,0 @@
-/test:
-    summary:
-        CI plan, picks Tier1 tests, runs in beakerlib.
-    description:
-        This special plan has to be named ci.fmf to run in CI.
-        It selects test which have 'tier 1' in their main.fmf file
-    discover:
-      - name: tier1
-        how: fmf
-        filter: 'tier: 1'
-        repository: "https://src.fedoraproject.org/tests/bind.git"
-    execute:
-        how: tmt
diff --git a/gating.yaml b/gating.yaml
index ecab956..e4c04e7 100644
--- a/gating.yaml
+++ b/gating.yaml
@@ -1,6 +1,16 @@
 --- !Policy
 product_versions:
   - fedora-*
-decision_context: bodhi_update_push_stable
-rules: []
-# fedora-ci.koji-build.tier0.functional is not yet stable, cannot enable it
+decision_contexts: [bodhi_update_push_testing]
+subject_type: koji_build
+rules:
+  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/tier1-public.functional}
+
+#gating rawhide
+--- !Policy
+product_versions:
+  - fedora-*
+decision_contexts: [bodhi_update_push_stable]
+subject_type: koji_build
+rules:
+  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/tier1-public.functional}
diff --git a/plans/all.fmf b/plans/all.fmf
new file mode 100644
index 0000000..1afeb5d
--- /dev/null
+++ b/plans/all.fmf
@@ -0,0 +1,6 @@
+summary: Test plan with all beakerlib tests
+discover:
+    how: fmf
+    url: https://src.fedoraproject.org/tests/bind.git
+execute:
+    how: tmt
diff --git a/plans/tier1-public.fmf b/plans/tier1-public.fmf
new file mode 100644
index 0000000..35808fd
--- /dev/null
+++ b/plans/tier1-public.fmf
@@ -0,0 +1,7 @@
+summary: Public (Fedora) Tier1 beakerlib tests
+discover:
+    how: fmf
+    url: https://src.fedoraproject.org/tests/bind.git
+    filter: 'tier: 1'
+execute:
+    how: tmt
diff --git a/tests/Master-server-chrooted/Makefile b/tests/Master-server-chrooted/Makefile
deleted file mode 100644
index 257c238..0000000
--- a/tests/Master-server-chrooted/Makefile
+++ /dev/null
@@ -1,63 +0,0 @@
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-#   Makefile of /CoreOS/tests/Sanity/Master-server-chrooted
-#   Description: Run basic empty named service and try to resolve localhost on it
-#   Author: Petr Mensik <pemensik@redhat.com>
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-#   Copyright (c) 2018 Red Hat, Inc.
-#
-#   This program is free software: you can redistribute it and/or
-#   modify it under the terms of the GNU General Public License as
-#   published by the Free Software Foundation, either version 2 of
-#   the License, or (at your option) any later version.
-#
-#   This program is distributed in the hope that it will be
-#   useful, but WITHOUT ANY WARRANTY; without even the implied
-#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
-#   PURPOSE.  See the GNU General Public License for more details.
-#
-#   You should have received a copy of the GNU General Public License
-#   along with this program. If not, see http://www.gnu.org/licenses/.
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-export TEST=/CoreOS/tests/Sanity/Master-server-chrooted
-export TESTVERSION=1.0
-
-BUILT_FILES=
-
-FILES=$(METADATA) runtest.sh Makefile PURPOSE
-
-.PHONY: all install download clean
-
-run: $(FILES) build
-	./runtest.sh
-
-build: $(BUILT_FILES)
-	test -x runtest.sh || chmod a+x runtest.sh
-
-clean:
-	rm -f *~ $(BUILT_FILES)
-
-
-include /usr/share/rhts/lib/rhts-make.include
-
-$(METADATA): Makefile
-	@echo "Owner:           Petr Mensik <pemensik@redhat.com>" > $(METADATA)
-	@echo "Name:            $(TEST)" >> $(METADATA)
-	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
-	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
-	@echo "Description:     Run basic empty named-chroot service and try to resolve localhost on it" >> $(METADATA)
-	@echo "Type:            Sanity" >> $(METADATA)
-	@echo "TestTime:        5m" >> $(METADATA)
-	@echo "RunFor:          bind" >> $(METADATA)
-	@echo "Requires:        bind bind-utils bind-chroot bind-sdb-chroot" >> $(METADATA)
-	@echo "Priority:        Normal" >> $(METADATA)
-	@echo "License:         GPLv2+" >> $(METADATA)
-	@echo "Confidential:    no" >> $(METADATA)
-	@echo "Destructive:     no" >> $(METADATA)
-	@echo "Releases:        -RHEL4 -RHELClient5 -RHELServer5 -RHEL6" >> $(METADATA)
-
-	rhts-lint $(METADATA)
diff --git a/tests/Master-server-chrooted/PURPOSE b/tests/Master-server-chrooted/PURPOSE
deleted file mode 100644
index c5468a4..0000000
--- a/tests/Master-server-chrooted/PURPOSE
+++ /dev/null
@@ -1,6 +0,0 @@
-PURPOSE of /CoreOS/tests/Sanity/Master-server-chrooted
-Description: Run basic empty named-chroot service and try to resolve localhost on it
-Author: Petr Mensik <pemensik@redhat.com>
-
-Check also clean package both when running and finished.
-https://bugzilla.redhat.com/show_bug.cgi?id=1592873
diff --git a/tests/Master-server-chrooted/runtest.sh b/tests/Master-server-chrooted/runtest.sh
deleted file mode 100755
index 15ebc12..0000000
--- a/tests/Master-server-chrooted/runtest.sh
+++ /dev/null
@@ -1,73 +0,0 @@
-#!/bin/bash
-# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-#   runtest.sh of /CoreOS/tests/Sanity/Master-server-chrooted
-#   Description: Run basic empty named-chroot service and try to resolve localhost on it
-#   Author: Petr Mensik <pemensik@redhat.com>
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-#   Copyright (c) 2018 Red Hat, Inc.
-#
-#   This program is free software: you can redistribute it and/or
-#   modify it under the terms of the GNU General Public License as
-#   published by the Free Software Foundation, either version 2 of
-#   the License, or (at your option) any later version.
-#
-#   This program is distributed in the hope that it will be
-#   useful, but WITHOUT ANY WARRANTY; without even the implied
-#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
-#   PURPOSE.  See the GNU General Public License for more details.
-#
-#   You should have received a copy of the GNU General Public License
-#   along with this program. If not, see http://www.gnu.org/licenses/.
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-# Include Beaker environment
-. /usr/bin/rhts-environment.sh || exit 1
-. /usr/share/beakerlib/beakerlib.sh || exit 1
-
-PACKAGE="bind"
-
-test_service()
-{
-    local SERVICE="$1"
-    local PACKAGE="$2"
-	rlRun "rlServiceStart $SERVICE"
-	rlRun "dig @localhost localhost | grep '^localhost'"
-	rlRun "dig @localhost -x 127.0.0.1 | grep 'PTR[[:space:]]\+localhost.$'" 0 "Reverse address works"
-	rlRun "rpm -V $PACKAGE" 0 "Checking $SERVICE package when running"
-	rlRun "rlServiceRestore $SERVICE"
-	rlRun "rpm -V $PACKAGE" 0 "Checking $SERVICE package when stopped"
-}
-
-rlJournalStart
-    rlPhaseStartSetup
-        rlAssertRpm bind
-	rlAssertRpm bind-utils
-	rlAssertRpm bind-chroot
-    rlPhaseEnd
-
-    rlPhaseStartTest "Testing named"
-	test_service named bind
-    rlPhaseEnd
-
-    rlPhaseStartTest "Testing named-chroot"
-	test_service named-chroot bind-chroot
-    rlPhaseEnd
-
-    rlPhaseStartTest "Testing named-sdb-chroot"
-	    if rpm -q bind-sdb-chroot; then
-		test_service named-sdb-chroot bind-sdb-chroot
-	    else
-		rlLog "bind-sdb-chroot not installed, skipping it"
-	    fi
-    rlPhaseEnd
-
-    rlPhaseStartCleanup
-	# noop
-    rlPhaseEnd
-rlJournalPrintText
-rlJournalEnd
diff --git a/tests/Master-server-not-chrooted/Makefile b/tests/Master-server-not-chrooted/Makefile
deleted file mode 100644
index 891a9a3..0000000
--- a/tests/Master-server-not-chrooted/Makefile
+++ /dev/null
@@ -1,65 +0,0 @@
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-#   Makefile of /CoreOS/bind/Sanity/Master-server-not-chrooted
-#   Description: Set up master nameserver, test it.
-#   Author: Martin Cermak <mcermak@redhat.com>
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-#   Copyright (c) 2009 Red Hat, Inc. All rights reserved.
-#
-#   This copyrighted material is made available to anyone wishing
-#   to use, modify, copy, or redistribute it subject to the terms
-#   and conditions of the GNU General Public License version 2.
-#
-#   This program is distributed in the hope that it will be
-#   useful, but WITHOUT ANY WARRANTY; without even the implied
-#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
-#   PURPOSE. See the GNU General Public License for more details.
-#
-#   You should have received a copy of the GNU General Public
-#   License along with this program; if not, write to the Free
-#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-#   Boston, MA 02110-1301, USA.
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-export TEST=/CoreOS/bind/Sanity/Master-server-not-chrooted
-export TESTVERSION=1.0
-
-BUILT_FILES=
-
-FILES=$(METADATA) runtest.sh Makefile PURPOSE named.conf zonefile 
-
-.PHONY: all install download clean
-
-run: $(FILES) build
-	./runtest.sh
-
-build: $(BUILT_FILES)
-	chmod a+x runtest.sh
-
-clean:
-	rm -f *~ $(BUILT_FILES)
-
-
-include /usr/share/rhts/lib/rhts-make.include
-
-$(METADATA): Makefile
-	@echo "Owner:           Martin Cermak <mcermak@redhat.com>" > $(METADATA)
-	@echo "Name:            $(TEST)" >> $(METADATA)
-	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
-	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
-	@echo "Description:     Set up master nameserver in chrooted env, test it." >> $(METADATA)
-	@echo "Type:            Sanity" >> $(METADATA)
-	@echo "TestTime:        5m" >> $(METADATA)
-	@echo "RunFor:          bind" >> $(METADATA)
-	@echo "Requires:        bind bind-chroot redhat-lsb" >> $(METADATA)
-	@echo "Requires:        bind-utils" >> $(METADATA)
-	@echo "Priority:        Normal" >> $(METADATA)
-	@echo "License:         GPLv2" >> $(METADATA)
-	@echo "Confidential:    no" >> $(METADATA)
-	@echo "Destructive:     no" >> $(METADATA)
-	@echo "RhtsRequires: library(bind/bind-setup)" >> $(METADATA)
-
-	rhts-lint $(METADATA)
diff --git a/tests/Master-server-not-chrooted/PURPOSE b/tests/Master-server-not-chrooted/PURPOSE
deleted file mode 100644
index 92cb7bd..0000000
--- a/tests/Master-server-not-chrooted/PURPOSE
+++ /dev/null
@@ -1,6 +0,0 @@
-PURPOSE of /CoreOS/bind/Sanity/Master-server-not-chrooted
-Description: Set up master nameserver in chrooted env, test it.
-             This is a very basic sanity test for bind9.
-             The main purpose for me was to learn how
-             bind works :-)
-Author: Martin Cermak <mcermak@redhat.com>
diff --git a/tests/Master-server-not-chrooted/named.conf b/tests/Master-server-not-chrooted/named.conf
deleted file mode 100644
index e477af9..0000000
--- a/tests/Master-server-not-chrooted/named.conf
+++ /dev/null
@@ -1,11 +0,0 @@
-options {
-        directory       "/var/named";
-        allow-query     { any; };
-};
-
-zone "<DOMAIN>" IN {
-  type master;
-  file "<DOMAIN>.zone";
-  allow-update { none; };
-};
-
diff --git a/tests/Master-server-not-chrooted/runtest.sh b/tests/Master-server-not-chrooted/runtest.sh
deleted file mode 100644
index ec62a04..0000000
--- a/tests/Master-server-not-chrooted/runtest.sh
+++ /dev/null
@@ -1,109 +0,0 @@
-#!/bin/bash
-# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-#   runtest.sh of /CoreOS/bind/Sanity/Master-server-not-chrooted
-#   Description: Set up master nameserver, test it.
-#   Author: Martin Cermak <mcermak@redhat.com>
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-#   Copyright (c) 2009 Red Hat, Inc. All rights reserved.
-#
-#   This copyrighted material is made available to anyone wishing
-#   to use, modify, copy, or redistribute it subject to the terms
-#   and conditions of the GNU General Public License version 2.
-#
-#   This program is distributed in the hope that it will be
-#   useful, but WITHOUT ANY WARRANTY; without even the implied
-#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
-#   PURPOSE. See the GNU General Public License for more details.
-#
-#   You should have received a copy of the GNU General Public
-#   License along with this program; if not, write to the Free
-#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-#   Boston, MA 02110-1301, USA.
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-# Include rhts environment
-#set -x
-. /usr/bin/rhts-environment.sh
-. /usr/lib/beakerlib/beakerlib.sh
-
-# Some heplful functions
-randomString () {
-    TEMPSTR=`date +%c%N | md5sum | awk '{print $1}'`
-    echo ${TEMPSTR:0:8}
-    unset TEMPSTR
-}
-
-randomIp () {
-    echo "192.168.1.`echo $[ $RANDOM / 256 + 1 ]`"
-}
-
-randomSerial () {
-    date +%N
-}
-
-# Variable declarations
-CONF="/etc/named.conf"
-IP1=`randomIp`
-IP2=`randomIp`
-IP3=`randomIp`
-IP4=`randomIp`
-IP5=`randomIp`
-SERIAL=`randomSerial`
-ORIGPWD=`pwd`
-
-# The test
-rlJournalStart
-    rlPhaseStartSetup
-        rlRun "TmpDir=\`mktemp -d\`" 0 "Creating tmp directory"
-        rlRun "pushd $TmpDir"
-
-        rlRun "rlImport bind/bind-setup"
-
-        bsBindSetupStart "$ORIGPWD/named.conf" "off"
-
-        rlRun "TDOMAIN=`randomString`.cz"
-        rlRun "TZONEFILE=$ROOTDIR/var/named/$TDOMAIN.zone"
-
-        # set up /etc/named.conf
-        rlRun "sed -i \"s/<DOMAIN>/$TDOMAIN/g\" $CONF"
-
-        # set up zonefile
-        rlRun "cp $ORIGPWD/zonefile $TZONEFILE"
-        rlRun "chmod a+r $TZONEFILE"
-        rlRun "sed -i \"s/<DOMAIN>/$TDOMAIN/g\" $TZONEFILE"
-        rlRun "sed -i \"s/<IP1>/$IP1/g\" $TZONEFILE"
-        rlRun "sed -i \"s/<IP2>/$IP2/g\" $TZONEFILE"
-        rlRun "sed -i \"s/<IP3>/$IP3/g\" $TZONEFILE"
-        rlRun "sed -i \"s/<IP4>/$IP4/g\" $TZONEFILE"
-        rlRun "sed -i \"s/<IP5>/$IP5/g\" $TZONEFILE"
-        rlRun "sed -i \"s/<SERIAL>/$SERIAL/g\" $TZONEFILE"
-
-        bsBindSetupDone
-    rlPhaseEnd
-
-    rlPhaseStartTest
-        # perform tests
-        rlRun "dig @localhost $TDOMAIN | grep \"^$TDOMAIN\" | head -n 1 | grep \"$IP1\""
-        rlRun "dig @localhost server1.$TDOMAIN | grep \"^server1.$TDOMAIN\" | grep \"$IP2\""
-        rlRun "dig @localhost server2.$TDOMAIN | grep \"^server2.$TDOMAIN\" | grep \"$IP3\""
-        rlRun "dig @localhost dns1.$TDOMAIN | grep \"^dns1.$TDOMAIN\" | grep \"$IP4\""
-        rlRun "dig @localhost dns2.$TDOMAIN | grep \"^dns2.$TDOMAIN\" | grep \"$IP5\""
-        rlRun "dig @localhost ftp.$TDOMAIN | grep \"^ftp.$TDOMAIN\" | grep \"server1.$TDOMAIN\""
-        rlRun "dig @localhost mail.$TDOMAIN | grep \"^mail.$TDOMAIN\" | grep \"server1.$TDOMAIN\""
-        rlRun "dig @localhost mail2.$TDOMAIN | grep \"^mail2.$TDOMAIN\" | grep \"server2.$TDOMAIN\""
-        rlRun "dig @localhost www.$TDOMAIN | grep \"^www.$TDOMAIN\" | grep \"server2.$TDOMAIN\""
-
-    rlPhaseEnd
-
-    rlPhaseStartCleanup
-        bsBindSetupCleanup
-        rlRun "popd"
-        rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
-        rlRun "rm -rf $TZONEFILE"
-    rlPhaseEnd
-rlJournalEnd
diff --git a/tests/Master-server-not-chrooted/zonefile b/tests/Master-server-not-chrooted/zonefile
deleted file mode 100644
index 198991e..0000000
--- a/tests/Master-server-not-chrooted/zonefile
+++ /dev/null
@@ -1,27 +0,0 @@
-$ORIGIN <DOMAIN>.
-$TTL 86400
-@     IN     SOA    dns1.<DOMAIN>.  hostmaster.<DOMAIN>. (
-                    <SERIAL>  ; serial
-                    21600      ; refresh after 6 hours
-                    3600       ; retry after 1 hour
-                    604800     ; expire after 1 week
-                    86400 )    ; minimum TTL of 1 day
-
-      IN     NS     dns1.<DOMAIN>.
-      IN     NS     dns2.<DOMAIN>.
-
-      IN     MX     10     mail.<DOMAIN>.
-      IN     MX     20     mail2.<DOMAIN>.
-
-             IN     A       <IP1>
-
-server1      IN     A       <IP2>
-server2      IN     A       <IP3>
-dns1         IN     A       <IP4>
-dns2         IN     A       <IP5>
-
-ftp          IN     CNAME   server1
-mail         IN     CNAME   server1
-mail2        IN     CNAME   server2
-www          IN     CNAME   server2
-
diff --git a/tests/Run-internal-BIND-test-suite/Makefile b/tests/Run-internal-BIND-test-suite/Makefile
deleted file mode 100644
index 0b90930..0000000
--- a/tests/Run-internal-BIND-test-suite/Makefile
+++ /dev/null
@@ -1,77 +0,0 @@
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-#   Makefile of tests/Run-internal-BIND-test-suite
-#   Description: Run internal BIND test suite
-#   Author: Martin Cermak <mcermak@redhat.com>
-#   Author: Petr Mensik <pemensik@redhat.com>
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-#   Copyright (c) 2010 Red Hat, Inc. All rights reserved.
-#
-#   This copyrighted material is made available to anyone wishing
-#   to use, modify, copy, or redistribute it subject to the terms
-#   and conditions of the GNU General Public License version 2.
-#
-#   This program is distributed in the hope that it will be
-#   useful, but WITHOUT ANY WARRANTY; without even the implied
-#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
-#   PURPOSE. See the GNU General Public License for more details.
-#
-#   You should have received a copy of the GNU General Public
-#   License along with this program; if not, write to the Free
-#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-#   Boston, MA 02110-1301, USA.
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-export TEST=tests/Run-internal-BIND-test-suite
-export TESTVERSION=1.3
-
-BUILT_FILES=
-
-FILES=$(METADATA) runtest.sh Makefile PURPOSE knownerror* setup-named-softhsm.sh bind-systest-filter.sh
-
-.PHONY: all install download clean
-
-run: $(FILES) build
-	./runtest.sh
-
-build: $(BUILT_FILES)
-	chmod a+x runtest.sh
-
-clean:
-	rm -f *~ $(BUILT_FILES)
-
-
-include /usr/share/rhts/lib/rhts-make.include
-
-$(METADATA): Makefile
-	@echo "Owner:           Martin Cermak <mcermak@redhat.com>" > $(METADATA)
-	@echo "Name:            $(TEST)" >> $(METADATA)
-	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
-	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
-	@echo "Description:     Run internal BIND test suite" >> $(METADATA)
-	@echo "Type:            Sanity" >> $(METADATA)
-	@echo "TestTime:        8h" >> $(METADATA)
-	@echo "RunFor:          bind" >> $(METADATA)
-	@echo "Requires:        bind rpm-build bind-utils" >> $(METADATA)
-	@echo "Requires:        perl-Net-DNS perl-Net-DNS-Nameserver" >> $(METADATA)
-	@echo "Requires:        perl-Time-HiRes" >> $(METADATA)
-	@echo "Requires:        bind-pkcs11 bind-pkcs11-utils softhsm" >> $(METADATA)
-	@echo "Requires:        openssl-devel libtool autoconf" >> $(METADATA)
-# Try to satisfy all build dependencies from here
-	@echo "Requires:        bind-devel" >> $(METADATA)
-	@echo "Requires:        net-tools" >> $(METADATA)
-	@echo "Requires:        dnf-utils" >> $(METADATA)
-	@echo "Requires:        kyua" >> $(METADATA)
-	@echo "Requires:        libcmocka-devel" >> $(METADATA)
-# Obsolete, uses cmocka
-#	@echo "Requires:        libatf-c gcc-c++" >> $(METADATA)
-	@echo "Priority:        Normal" >> $(METADATA)
-	@echo "License:         GPLv2" >> $(METADATA)
-	@echo "Confidential:    no" >> $(METADATA)
-	@echo "Destructive:     no" >> $(METADATA)
-	@echo "Bug:             642970" >> $(METADATA)
-
-	rhts-lint $(METADATA)
diff --git a/tests/Run-internal-BIND-test-suite/PURPOSE b/tests/Run-internal-BIND-test-suite/PURPOSE
deleted file mode 100644
index 754ba2a..0000000
--- a/tests/Run-internal-BIND-test-suite/PURPOSE
+++ /dev/null
@@ -1,6 +0,0 @@
-PURPOSE of tests/Run-internal-BIND-test-suite
-Description: Run internal BIND test suite
-Author: Martin Cermak <mcermak@redhat.com>
-Bug summary: Run internal BIND test suite
-Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=642970
-
diff --git a/tests/Run-internal-BIND-test-suite/bind-systest-filter.sh b/tests/Run-internal-BIND-test-suite/bind-systest-filter.sh
deleted file mode 100755
index 8a153a1..0000000
--- a/tests/Run-internal-BIND-test-suite/bind-systest-filter.sh
+++ /dev/null
@@ -1,47 +0,0 @@
-#!/bin/bash
-#
-# This script will filter out output from BINDs tests
-# It supports form from BIND 9.9 and BIND 9.11
-# Its purpose is to display only failed tests from list of all tests
-
-CURRENT_TEST=
-CURRENT_OUTPUT=
-STATUS_ONLY=
-
-for P; do
-	case "$P" in
-		-s|--status)	STATUS_ONLY=yes; shift ;;
-	esac
-done
-
-cat $@ | while read LINE; do
-	if [ "${LINE#S:}" != "$LINE" ]; then
-		CURRENT_TEST=`echo $LINE | cut -d: -f2`
-		CURRENT_OUTPUT="$LINE"$'\n'
-	elif [ "${LINE#R:}" != "$LINE" ]; then
-		# echo "$CURRENT_TEST $LINE"
-		if [ "${LINE/#R:*:*}" != "$LINE" ]; then
-			# more recent results contain test name
-			# R:dlz:FAIL
-			CURRENT_TEST="${LINE#R:}"
-			CURRENT_TEST="${CURRENT_TEST/%:*}"
-			RESULT="${LINE/#*:}"
-		else
-			# S:dlz:time
-			# R:FAIL
-			RESULT="${LINE/#R*:/}"
-		fi
-		if [ "$RESULT" != "PASS" ]; then
-			if [ -n "$STATUS_ONLY" ]; then
-				echo "$RESULT $CURRENT_TEST"
-			else
-				CURRENT_OUTPUT+="$LINE"
-				echo "$CURRENT_OUTPUT"
-				echo
-			fi
-		fi
-		CURRENT_OUTPUT=
-	else
-		CURRENT_OUTPUT+="$LINE"$'\n'
-	fi
-done
diff --git a/tests/Run-internal-BIND-test-suite/knownerror b/tests/Run-internal-BIND-test-suite/knownerror
deleted file mode 100644
index 2d0c8e9..0000000
--- a/tests/Run-internal-BIND-test-suite/knownerror
+++ /dev/null
@@ -1,2 +0,0 @@
-A:System test dlz
-A:System test idna
diff --git a/tests/Run-internal-BIND-test-suite/runtest.sh b/tests/Run-internal-BIND-test-suite/runtest.sh
deleted file mode 100755
index 7066344..0000000
--- a/tests/Run-internal-BIND-test-suite/runtest.sh
+++ /dev/null
@@ -1,185 +0,0 @@
-#!/bin/bash
-# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-#   runtest.sh of tests/Run-internal-BIND-test-suite
-#   Description: Run internal BIND test suite
-#   Author: Martin Cermak <mcermak@redhat.com>
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-#   Copyright (c) 2010 Red Hat, Inc. All rights reserved.
-#
-#   This copyrighted material is made available to anyone wishing
-#   to use, modify, copy, or redistribute it subject to the terms
-#   and conditions of the GNU General Public License version 2.
-#
-#   This program is distributed in the hope that it will be
-#   useful, but WITHOUT ANY WARRANTY; without even the implied
-#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
-#   PURPOSE. See the GNU General Public License for more details.
-#
-#   You should have received a copy of the GNU General Public
-#   License along with this program; if not, write to the Free
-#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-#   Boston, MA 02110-1301, USA.
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-# Include rhts environment
-. /usr/bin/rhts-environment.sh
-. /usr/lib/beakerlib/beakerlib.sh
-
-PACKAGE="bind"
-
-# Set those variables to n to skip tests on variants
-#DEFAULT_VARIANTS="normal pkcs11 sdb"
-DEFAULT_VARIANTS="normal"
-#TEST_VARIANTS="normal"
-
-#
-# Runs test suite and checks known errors
-# Prepared to be repeated with another variants
-run_testsuite()
-{
-	local RESULT_TEXT="$TMPDIR/test${NAMED_VARIANT}.txt"
-	local FOUNDERROR=`mktemp found-XXXXXXXX.err`
-	local KNOWNERROR=/dev/null
-
-	if [ -f "$ORIG/knownerror${NAMED_VARIANT}.$TAG" ]; then
-		KNOWNERROR=`readlink -f $ORIG/knownerror.$TAG`
-	elif [ -f "$ORIG/knownerror${NAMED_VARIANT}" ]; then
-		KNOWNERROR=`readlink -f $ORIG/knownerror`
-	fi
-
-	# Sometime it can fail. Report just failures that are not known
-        rlRun "make test -j${CORES:-1} &> $RESULT_TEXT" 0-255 "Perform the test."
-        rlRun "grep -C 10 FAIL $RESULT_TEXT" 0-255 "Quickly show the test error (if any)."
-
-	rlRun "$FILTER $RESULT_TEXT" 0 "Showing unsuccessful tests"
-	rlRun "$FILTER -s $RESULT_TEXT > $FOUNDERROR" 0
-	rlRun "ls $KNOWNERROR $FOUNDERROR $RESULT_TEXT" 0 'check if there is needed files'
-	rlLog "`cat $FOUNDERROR`"
-
-	rlAssertLesserOrEqual "Checking number of found errors is in limits" "$(grep '^FAIL' $FOUNDERROR | wc -l)" "$(wc -l <$KNOWNERROR)"
-        cat $FOUNDERROR | while read STATUS TEST ; do
-		if [ "$STATUS" = FAIL ]; then
-			rlRun "grep '$TEST' $KNOWNERROR" 0 "Check $TEST failure is expected"
-		else
-			rlLog "$STATUS $TEST"
-		fi
-        done
-}
-
-rlJournalStart
-    rlPhaseStartSetup
-        # package assertions
-        rlAssertRpm $PACKAGE 
-        rlAssertRpm rpm-build
-        rlAssertRpm perl-Net-DNS-Nameserver
-
-	#pwd
-	ORIG=`pwd`
-	SETUP_SOFTHSM=`readlink -f setup-named-softhsm.sh`
-	FILTER=`readlink -f bind-systest-filter.sh`
-	CORES=`grep 'processor\s*:' /proc/cpuinfo | wc -l`
-
-	TAG=generic
-	if [ -f /etc/os-release ]; then
-		# extract platform tag
-		TAG=`(source /etc/os-release && echo ${PLATFORM_ID#platform:})`
-	fi
-
-        #tempdir
-        rlRun "TMPDIR=\`mktemp -d\`" 0 "Creating tmp directory"
-        rlRun "pushd $TMPDIR"
-
-        # topdir
-	TOPDIR=`rpm -E '%{_topdir}'`
-
-        # cleanup in topdir
-        mkdir -p $TOPDIR/{BUILD,SOURCES,SPECS}
-        rm -rf $TOPDIR/{BUILD,SOURCES,SPECS}/*
-
-        # download src rpm
-	if ! ls bind*.src.rpm; then
-		rlRun "dnf --enablerepo='*-source' download --source bind" 0 "Fetch source from repository"
-		rlRun "rpm -i bind*.src.rpm"
-	fi
-	
-        rlRun "rpm --define '_topdir $TOPDIR' -Uvh *rpm &> $TMPDIR/install.txt"
-        rlRun "cd $TOPDIR/SPECS" 
-
-	rlRun "dnf -y builddep *.spec"
-
-        # stop bind if it is running
-        rlServiceStop named
-    rlPhaseEnd
-
-    rlPhaseStartTest
-        # rebuild from source
-        rlRun "rpmbuild -ba *.spec &> $TMPDIR/build.txt"
-
-        # the test
-        rlRun "cd $TOPDIR/BUILD/bind*"
-
-        rlLogInfo "Test takes place in `pwd`"
-
-        rlRun "chown -R root ."
-
-	if [ -x "$SETUP_SOFTHSM" ]; then
-		rlRun "eval \"$(bash $SETUP_SOFTHSM -A)\"" 0 "Preparing PKCS#11 token slot"
-		rlRun "pkcs11-tokens" 0 "Testing token slot availability"
-	else
-		rlLog "PKCS#11 not initialized"
-	fi
-
-	if [ -d build ]; then
-		BUILD=build
-	else
-		BUILD=.
-	fi
-
-        rlRun "./bin/tests/system/ifconfig.sh up" 0 "Setup fake network interfaces."
-
-	# required by idna test 
-	export LC_ALL=en_US.UTF-8
-
-        rlRun "pushd $BUILD"
-
-	if echo "${TEST_VARIANTS:-$DEFAULT_VARIANTS}" | grep -q normal; then
-		rlLog "Running normal variant"
-		export NAMED_VARIANT= DNSSEC_VARIANT=
-		run_testsuite
-		rlLog "Finished normal variant"
-	fi
-
-	if echo "${TEST_VARIANTS:-$DEFAULT_VARIANTS}" | grep -q sdb; then
-		rlLog "Running sdb variant"
-		export NAMED_VARIANT=-sdb DNSSEC_VARIANT=
-		run_testsuite
-		rlLog "Finished sdb variant"
-	fi
-
-	if echo "${TEST_VARIANTS:-$DEFAULT_VARIANTS}" | grep -q pkcs11; then
-		rlLog "Running pkcs11 variant"
-		# Unfortunately, PKCS11 variant uses shared key storage
-		# It cannot use more threads for that reason
-		export NAMED_VARIANT=-pkcs11 DNSSEC_VARIANT=-pkcs11
-		CORES=1 run_testsuite
-		rlLog "Finished pkcs11 variant"
-	fi
-
-        rlRun "popd"
-
-        rlRun "./bin/tests/system/ifconfig.sh down" 0 "Remove fake network interfaces."
-
-    rlPhaseEnd
-
-    rlPhaseStartCleanup
-        rlBundleLogs "BUILD_LOGS" "$TMPDIR/install.txt" "$TMPDIR/builddeps.txt" "$TMPDIR/build.txt"
-        rlBundleLogs "TEST_LOGS" "$TMPDIR"/test*.txt
-        rlRun "popd"
-        rlRun "rm -r $TMPDIR" 0 "Removing tmp directory"
-    rlPhaseEnd
-rlJournalEnd
diff --git a/tests/Run-internal-BIND-test-suite/setup-named-softhsm.sh b/tests/Run-internal-BIND-test-suite/setup-named-softhsm.sh
deleted file mode 100755
index a13c91e..0000000
--- a/tests/Run-internal-BIND-test-suite/setup-named-softhsm.sh
+++ /dev/null
@@ -1,123 +0,0 @@
-#!/bin/sh
-#
-# This script will initialise token storage of softhsm PKCS11 provider
-# in custom location. Is useful to store tokens in non-standard location.
-#
-# Output can be evaluated from bash, it will prepare it for usage of temporary tokens.
-# Recommended use:
-# eval $(bash setup-named-softhsm.sh -A)
-#
-
-SOFTHSM2_CONF="$1"
-TOKENPATH="$2"
-GROUPNAME="$3"
-# Do not use this script for real keys worth protection
-# This is intended for crypto accelerators using PKCS11 interface.
-# Uninitialized token would fail any crypto operation.
-PIN=1234
-SO_PIN=1234
-LABEL=rpm
-
-set -e
-
-echo_i()
-{
-	echo "#" $@
-}
-
-random()
-{
-	if [ -x "$(which openssl 2>/dev/null)" ]; then
-		openssl rand -base64 $1
-	else
-		dd if=/dev/urandom bs=1c count=$1 | base64
-	fi
-}
-
-usage()
-{
-	echo "Usage: $0 -A [token directory] [group]"
-	echo "   or: $0 <config file> <token directory> [group]"
-}
-
-if [ "$SOFTHSM2_CONF" = "-A" -a -z "$TOKENPATH" ]; then
-	TOKENPATH=$(mktemp -d /var/tmp/softhsm-XXXXXX)
-fi
-
-if [ -z "$SOFTHSM2_CONF" -o -z "$TOKENPATH" ]; then
-	usage >&2
-	exit 1
-fi
-
-if [ "$SOFTHSM2_CONF" = "-A" ]; then
-	# Automagic mode instead
-	MODE=secure
-	SOFTHSM2_CONF="$TOKENPATH/softhsm2.conf"
-	PIN_SOURCE="$TOKENPATH/pin"
-	SOPIN_SOURCE="$TOKENPATH/so-pin"
-	TOKENPATH="$TOKENPATH/tokens"
-else
-	MODE=legacy
-fi
-
-[ -d "$TOKENPATH" ] || mkdir -p "$TOKENPATH"
-
-umask 0022
-
-if ! [ -f "$SOFTHSM2_CONF" ]; then
-cat  << SED > "$SOFTHSM2_CONF"
-# SoftHSM v2 configuration file
-
-directories.tokendir = ${TOKENPATH}
-objectstore.backend = file
-
-# ERROR, WARNING, INFO, DEBUG
-log.level = ERROR
-
-# If CKF_REMOVABLE_DEVICE flag should be set
-slots.removable = false
-SED
-else
-	echo_i "Config file $SOFTHSM2_CONF already exists" >&2
-fi
-
-if [ -n "$PIN_SOURCE" ]; then
-	touch "$PIN_SOURCE" "$SOPIN_SOURCE"
-	chmod 0600 "$PIN_SOURCE" "$SOPIN_SOURCE"
-	if [ -n "$GROUPNAME" ]; then
-		chgrp "$GROUPNAME" "$PIN_SOURCE" "$SOPIN_SOURCE"
-		chmod g+r "$PIN_SOURCE" "$SOPIN_SOURCE"
-	fi
-fi
-
-export SOFTHSM2_CONF
-
-if softhsm2-util --show-slots | grep 'Initialized:[[:space:]]*yes' > /dev/null
-then
-	echo_i "Token in ${TOKENPATH} is already initialized" >&2
-
-	[ -f "$PIN_SOURCE" ] && PIN=$(cat "$PIN_SOURCE")
-	[ -f "$SOPIN_SOURCE" ] && SO_PIN=$(cat "$SOPIN_SOURCE")
-else
-	PIN=$(random 6)
-	SO_PIN=$(random 18)
-	if [ -n "$PIN_SOURCE" ]; then
-		echo -n "$PIN" > "$PIN_SOURCE"
-		echo -n "$SO_PIN" > "$SOPIN_SOURCE"
-	fi
-
-	echo_i "Initializing tokens to ${TOKENPATH}..."
-	softhsm2-util --init-token --free --label "$LABEL" --pin "$PIN" --so-pin "$SO_PIN" | sed -e 's/^/# /'
-
-	if [ -n "$GROUPNAME" ]; then
-		chgrp -R -- "$GROUPNAME" "$TOKENPATH"
-		chmod -R -- g=rX,o= "$TOKENPATH"
-	fi
-fi
-
-echo "export SOFTHSM2_CONF=\"$SOFTHSM2_CONF\""
-echo "export PIN_SOURCE=\"$PIN_SOURCE\""
-echo "export SOPIN_SOURCE=\"$SOPIN_SOURCE\""
-# These are intentionaly not exported
-echo "PIN=\"$PIN\""
-echo "SO_PIN=\"$SO_PIN\""
diff --git a/tests/tests.yml b/tests/tests.yml
deleted file mode 100644
index d2fb221..0000000
--- a/tests/tests.yml
+++ /dev/null
@@ -1,11 +0,0 @@
----
-# This first play always runs on the local staging system
-- hosts: localhost
-  roles:
-  - role: standard-test-beakerlib
-    tags:
-    - classic
-    repositories:
-    - repo: "https://src.fedoraproject.org/tests/bind.git"
-      dest: "bind-tests"
-      fmf_filter: "tier: 1"

From e20853883a6ecd8bb3a2efbf169a77ff289c5d07 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 18 Jan 2022 12:17:17 +0100
Subject: [PATCH 280/460] Correct shell warnings detected by coverity

---
 generate-rndc-key.sh  | 2 +-
 setup-named-chroot.sh | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/generate-rndc-key.sh b/generate-rndc-key.sh
index 956bb8e..df0604a 100755
--- a/generate-rndc-key.sh
+++ b/generate-rndc-key.sh
@@ -15,7 +15,7 @@ fi
 
 # This script generates /etc/rndc.key if doesn't exist AND if there is no rndc.conf
 
-if [ ! -s /etc/rndc.key -a ! -s /etc/rndc.conf ]; then
+if [ ! -s /etc/rndc.key ] && [ ! -s /etc/rndc.conf ]; then
   echo -n $"Generating /etc/rndc.key:"
   if /usr/sbin/rndc-confgen -a -A hmac-sha256 > /dev/null 2>&1
   then
diff --git a/setup-named-chroot.sh b/setup-named-chroot.sh
index 5e68915..da82cff 100755
--- a/setup-named-chroot.sh
+++ b/setup-named-chroot.sh
@@ -10,7 +10,7 @@ usage()
   echo 'Usage: setup-named-chroot.sh ROOTDIR <on|off> [chroot.files]'
 }
 
-if ! [ "$#" -ge 2 -a "$#" -le 3 ]; then
+if ! [ "$#" -ge 2 ] && [ "$#" -le 3 ]; then
   echo 'Wrong number of arguments'
   usage
   exit 1
@@ -34,9 +34,9 @@ dev_create()
   DEVNAME="$ROOTDIR/dev/$1"
   shift
   if ! [ -e "$DEVNAME" ]; then
-    /bin/mknod -m 0664 "$DEVNAME" $@
+    /bin/mknod -m 0664 "$DEVNAME" "$@"
     /bin/chgrp named "$DEVNAME"
-    if [ -x /usr/sbin/selinuxenabled -a -x /sbin/restorecon ]; then
+    if [ -x /usr/sbin/selinuxenabled ] && [ -x /sbin/restorecon ]; then
       /usr/sbin/selinuxenabled && /sbin/restorecon "$DEVNAME" > /dev/null || :
     fi
   fi
@@ -78,7 +78,7 @@ mount_chroot_conf()
       else
         # Mount source is a directory. Mount it only if directory in chroot is
         # empty.
-        if [ -e "$all" ] && [ `ls -1A $ROOTDIR$all | wc -l` -eq 0 ]; then
+        if [ -e "$all" ] && [ `ls -1A "$ROOTDIR$all" | wc -l` -eq 0 ]; then
           mount --bind --make-private "$all" "$ROOTDIR$all"
         fi
       fi

From 3bb763c2a7801874053e30e89c648d3d040401c1 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Wed, 19 Jan 2022 22:20:21 +0000
Subject: [PATCH 281/460] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
---
 bind.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index 9a6712d..66c6c94 100644
--- a/bind.spec
+++ b/bind.spec
@@ -53,7 +53,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.16.24
-Release:  2%{?dist}
+Release:  3%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1127,6 +1127,9 @@ fi;
 %endif
 
 %changelog
+* Wed Jan 19 2022 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.16.24-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
+
 * Wed Dec 22 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.24-2
 - Build with OpenLDAP 2.6 (#2032704)
 

From 11207651f79e27d3f40d96f7c1cc2764565cfff0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 21 Jan 2022 18:07:00 +0100
Subject: [PATCH 282/460] Update to 9.16.25 (#2042504)

- Reduced memory usage on machines with many CPU cores.
- Offline ZSK expired signatures would be signed by KSK instead
- Inline signed zone could be saved without serial, causing error after
  restart

https://downloads.isc.org/isc/bind9/9.16.25/doc/arm/html/notes.html#notes-for-bind-9-16-25
---
 .gitignore                       |   2 +
 bind-9.16-openldap-2.6-all.patch | 199 -------------------------------
 bind-9.16-openldap-2.6.patch     |  55 ---------
 bind.spec                        |  12 +-
 sources                          |   4 +-
 5 files changed, 9 insertions(+), 263 deletions(-)
 delete mode 100644 bind-9.16-openldap-2.6-all.patch
 delete mode 100644 bind-9.16-openldap-2.6.patch

diff --git a/.gitignore b/.gitignore
index 283f728..741f979 100644
--- a/.gitignore
+++ b/.gitignore
@@ -164,3 +164,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.16.23.tar.xz.asc
 /bind-9.16.24.tar.xz
 /bind-9.16.24.tar.xz.asc
+/bind-9.16.25.tar.xz
+/bind-9.16.25.tar.xz.asc
diff --git a/bind-9.16-openldap-2.6-all.patch b/bind-9.16-openldap-2.6-all.patch
deleted file mode 100644
index 6af2714..0000000
--- a/bind-9.16-openldap-2.6-all.patch
+++ /dev/null
@@ -1,199 +0,0 @@
-From d02a805719d593863dd438798a29312a4177d207 Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Wed, 22 Dec 2021 13:38:02 +0100
-Subject: [PATCH 2/2] Change all internal functions to dlz_ldap prefix
-
-To prevent any conflict in the future, avoid ldap_ prefix in any
-internal functions. Keep it reserved for openldap only.
----
- contrib/dlz/modules/ldap/dlz_ldap_dynamic.c | 52 ++++++++++-----------
- 1 file changed, 26 insertions(+), 26 deletions(-)
-
-diff --git a/contrib/dlz/modules/ldap/dlz_ldap_dynamic.c b/contrib/dlz/modules/ldap/dlz_ldap_dynamic.c
-index 317a691..a653fac 100644
---- a/contrib/dlz/modules/ldap/dlz_ldap_dynamic.c
-+++ b/contrib/dlz/modules/ldap/dlz_ldap_dynamic.c
-@@ -128,7 +128,7 @@ b9_add_helper(ldap_instance_t *db, const char *helper_name, void *ptr);
- 
- /*% checks that the LDAP URL parameters make sense */
- static isc_result_t
--ldap_checkURL(ldap_instance_t *db, char *URL, int attrCnt, const char *msg) {
-+dlz_ldap_checkURL(ldap_instance_t *db, char *URL, int attrCnt, const char *msg) {
- 	isc_result_t result = ISC_R_SUCCESS;
- 	int ldap_result;
- 	LDAPURLDesc *ldap_url = NULL;
-@@ -248,7 +248,7 @@ cleanup:
-  * multithreaded operation.
-  */
- static void
--ldap_destroy_dblist(db_list_t *dblist) {
-+dlz_ldap_destroy_dblist(db_list_t *dblist) {
- 	dbinstance_t *ndbi = NULL;
- 	dbinstance_t *dbi = NULL;
- 
-@@ -282,7 +282,7 @@ ldap_destroy_dblist(db_list_t *dblist) {
-  * multithreaded operation.
-  */
- static dbinstance_t *
--ldap_find_avail_conn(ldap_instance_t *ldap) {
-+dlz_ldap_find_avail_conn(ldap_instance_t *ldap) {
- 	dbinstance_t *dbi = NULL;
- 	dbinstance_t *head;
- 	int count = 0;
-@@ -315,7 +315,7 @@ ldap_find_avail_conn(ldap_instance_t *ldap) {
- #endif /* PTHREADS */
- 
- static isc_result_t
--ldap_process_results(ldap_instance_t *db, LDAP *dbc, LDAPMessage *msg,
-+dlz_ldap_process_results(ldap_instance_t *db, LDAP *dbc, LDAPMessage *msg,
- 		     char **attrs, void *ptr, bool allnodes) {
- 	isc_result_t result = ISC_R_SUCCESS;
- 	int i = 0;
-@@ -543,7 +543,7 @@ cleanup:
-  * obtain a result set.
-  */
- static isc_result_t
--ldap_get_results(const char *zone, const char *record, const char *client,
-+dlz_ldap_get_results(const char *zone, const char *record, const char *client,
- 		 unsigned int query, void *dbdata, void *ptr) {
- 	isc_result_t result;
- 	ldap_instance_t *db = (ldap_instance_t *)dbdata;
-@@ -558,7 +558,7 @@ ldap_get_results(const char *zone, const char *record, const char *client,
- 	/* get db instance / connection */
- #if PTHREADS
- 	/* find an available DBI from the list */
--	dbi = ldap_find_avail_conn(db);
-+	dbi = dlz_ldap_find_avail_conn(db);
- #else  /* PTHREADS */
- 	/*
- 	 * only 1 DBI - no need to lock instance lock either
-@@ -667,7 +667,7 @@ ldap_get_results(const char *zone, const char *record, const char *client,
- 		 * screwed up!
- 		 */
- 		db->log(ISC_LOG_ERROR, "Incorrect query flag passed to "
--				       "ldap_get_results");
-+				       "dlz_ldap_get_results");
- 		result = ISC_R_UNEXPECTED;
- 		goto cleanup;
- 	}
-@@ -755,13 +755,13 @@ ldap_get_results(const char *zone, const char *record, const char *client,
- 
- 	switch (query) {
- 	case ALLNODES:
--		result = ldap_process_results(db, (LDAP *)dbi->dbconn, ldap_msg,
--					      ldap_url->lud_attrs, ptr, true);
-+		result = dlz_ldap_process_results(db, (LDAP *)dbi->dbconn, ldap_msg,
-+					          ldap_url->lud_attrs, ptr, true);
- 		break;
- 	case AUTHORITY:
- 	case LOOKUP:
--		result = ldap_process_results(db, (LDAP *)dbi->dbconn, ldap_msg,
--					      ldap_url->lud_attrs, ptr, false);
-+		result = dlz_ldap_process_results(db, (LDAP *)dbi->dbconn, ldap_msg,
-+					          ldap_url->lud_attrs, ptr, false);
- 		break;
- 	case ALLOWXFR:
- 		entries = ldap_count_entries((LDAP *)dbi->dbconn, ldap_msg);
-@@ -789,7 +789,7 @@ ldap_get_results(const char *zone, const char *record, const char *client,
- 		 * screwed up!
- 		 */
- 		db->log(ISC_LOG_ERROR, "Incorrect query flag passed to "
--				       "ldap_get_results");
-+				       "dlz_ldap_get_results");
- 		result = ISC_R_UNEXPECTED;
- 	}
- 
-@@ -847,18 +847,18 @@ dlz_allowzonexfr(void *dbdata, const char *name, const char *client) {
- 	}
- 
- 	/* get all the zone data */
--	result = ldap_get_results(name, NULL, client, ALLOWXFR, dbdata, NULL);
-+	result = dlz_ldap_get_results(name, NULL, client, ALLOWXFR, dbdata, NULL);
- 	return (result);
- }
- 
- isc_result_t
- dlz_allnodes(const char *zone, void *dbdata, dns_sdlzallnodes_t *allnodes) {
--	return (ldap_get_results(zone, NULL, NULL, ALLNODES, dbdata, allnodes));
-+	return (dlz_ldap_get_results(zone, NULL, NULL, ALLNODES, dbdata, allnodes));
- }
- 
- isc_result_t
- dlz_authority(const char *zone, void *dbdata, dns_sdlzlookup_t *lookup) {
--	return (ldap_get_results(zone, NULL, NULL, AUTHORITY, dbdata, lookup));
-+	return (dlz_ldap_get_results(zone, NULL, NULL, AUTHORITY, dbdata, lookup));
- }
- 
- #if DLZ_DLOPEN_VERSION < 3
-@@ -874,7 +874,7 @@ dlz_findzonedb(void *dbdata, const char *name, dns_clientinfomethods_t *methods,
- 	UNUSED(methods);
- 	UNUSED(clientinfo);
- #endif /* if DLZ_DLOPEN_VERSION >= 3 */
--	return (ldap_get_results(name, NULL, NULL, FINDZONE, dbdata, NULL));
-+	return (dlz_ldap_get_results(name, NULL, NULL, FINDZONE, dbdata, NULL));
- }
- 
- #if DLZ_DLOPEN_VERSION == 1
-@@ -896,11 +896,11 @@ dlz_lookup(const char *zone, const char *name, void *dbdata,
- #endif /* if DLZ_DLOPEN_VERSION >= 2 */
- 
- 	if (strcmp(name, "*") == 0) {
--		result = ldap_get_results(zone, "~", NULL, LOOKUP, dbdata,
--					  lookup);
-+		result = dlz_ldap_get_results(zone, "~", NULL, LOOKUP, dbdata,
-+					      lookup);
- 	} else {
--		result = ldap_get_results(zone, name, NULL, LOOKUP, dbdata,
--					  lookup);
-+		result = dlz_ldap_get_results(zone, name, NULL, LOOKUP, dbdata,
-+					      lookup);
- 	}
- 	return (result);
- }
-@@ -1000,29 +1000,29 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
- 	/* check that LDAP URL parameters make sense */
- 	switch (argc) {
- 	case 12:
--		result = ldap_checkURL(ldap, argv[11], 0,
-+		result = dlz_ldap_checkURL(ldap, argv[11], 0,
- 				       "allow zone transfer");
- 		if (result != ISC_R_SUCCESS) {
- 			goto cleanup;
- 		}
- 	case 11:
--		result = ldap_checkURL(ldap, argv[10], 3, "all nodes");
-+		result = dlz_ldap_checkURL(ldap, argv[10], 3, "all nodes");
- 		if (result != ISC_R_SUCCESS) {
- 			goto cleanup;
- 		}
- 	case 10:
- 		if (strlen(argv[9]) > 0) {
--			result = ldap_checkURL(ldap, argv[9], 3, "authority");
-+			result = dlz_ldap_checkURL(ldap, argv[9], 3, "authority");
- 			if (result != ISC_R_SUCCESS) {
- 				goto cleanup;
- 			}
- 		}
- 	case 9:
--		result = ldap_checkURL(ldap, argv[8], 3, "lookup");
-+		result = dlz_ldap_checkURL(ldap, argv[8], 3, "lookup");
- 		if (result != ISC_R_SUCCESS) {
- 			goto cleanup;
- 		}
--		result = ldap_checkURL(ldap, argv[7], 0, "find zone");
-+		result = dlz_ldap_checkURL(ldap, argv[7], 0, "find zone");
- 		if (result != ISC_R_SUCCESS) {
- 			goto cleanup;
- 		}
-@@ -1199,7 +1199,7 @@ dlz_destroy(void *dbdata) {
- #if PTHREADS
- 		/* cleanup the list of DBI's */
- 		if (db->db != NULL) {
--			ldap_destroy_dblist((db_list_t *)(db->db));
-+			dlz_ldap_destroy_dblist((db_list_t *)(db->db));
- 		}
- #else  /* PTHREADS */
- 		if (db->db->dbconn != NULL) {
--- 
-2.31.1
-
diff --git a/bind-9.16-openldap-2.6.patch b/bind-9.16-openldap-2.6.patch
deleted file mode 100644
index bdb7da5..0000000
--- a/bind-9.16-openldap-2.6.patch
+++ /dev/null
@@ -1,55 +0,0 @@
-From e6ed26c98ebac9313ce531a366f96ff9912e84af Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Wed, 22 Dec 2021 13:36:39 +0100
-Subject: [PATCH 1/2] Avoid conflict with ldap_connect function of openldap
-
-ldap_connect is defined by OpenLDAP 2.6. Compiler complains there are
-conflicting declarations. Use dlz_ldap prefix instead of ldap to avoid
-conflict.
----
- contrib/dlz/modules/ldap/dlz_ldap_dynamic.c | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/contrib/dlz/modules/ldap/dlz_ldap_dynamic.c b/contrib/dlz/modules/ldap/dlz_ldap_dynamic.c
-index 543a95d..317a691 100644
---- a/contrib/dlz/modules/ldap/dlz_ldap_dynamic.c
-+++ b/contrib/dlz/modules/ldap/dlz_ldap_dynamic.c
-@@ -193,7 +193,7 @@ cleanup:
- 
- /*% Connects / reconnects to LDAP server */
- static isc_result_t
--ldap_connect(ldap_instance_t *dbi, dbinstance_t *dbc) {
-+dlz_ldap_connect(ldap_instance_t *dbi, dbinstance_t *dbc) {
- 	isc_result_t result;
- 	int ldap_result;
- 
-@@ -700,7 +700,7 @@ ldap_get_results(const char *zone, const char *record, const char *client,
- 			db->log(ISC_LOG_INFO, "LDAP driver attempting to "
- 					      "re-connect");
- 
--			result = ldap_connect((ldap_instance_t *)dbdata, dbi);
-+			result = dlz_ldap_connect((ldap_instance_t *)dbdata, dbi);
- 			if (result != ISC_R_SUCCESS) {
- 				result = ISC_R_FAILURE;
- 				continue;
-@@ -731,7 +731,7 @@ ldap_get_results(const char *zone, const char *record, const char *client,
- 		case LDAP_SERVER_DOWN:
- 			db->log(ISC_LOG_INFO, "LDAP driver attempting to "
- 					      "re-connect");
--			result = ldap_connect((ldap_instance_t *)dbdata, dbi);
-+			result = dlz_ldap_connect((ldap_instance_t *)dbdata, dbi);
- 			if (result != ISC_R_SUCCESS) {
- 				result = ISC_R_FAILURE;
- 			}
-@@ -1117,7 +1117,7 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
- 	ldap->db = dbi;
- #endif /* if PTHREADS */
- 		/* attempt to connect */
--		result = ldap_connect(ldap, dbi);
-+		result = dlz_ldap_connect(ldap, dbi);
- 
- 		/*
- 		 * if db connection cannot be created, log err msg and
--- 
-2.31.1
-
diff --git a/bind.spec b/bind.spec
index 66c6c94..976853f 100644
--- a/bind.spec
+++ b/bind.spec
@@ -52,8 +52,8 @@
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.16.24
-Release:  3%{?dist}
+Version:  9.16.25
+Release:  1%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -102,9 +102,6 @@ Patch149:bind-9.11-kyua-pkcs11.patch
 Patch157:bind-9.11-fips-tests.patch
 # https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/2689
 Patch164:bind-9.11-rh1666814.patch
-# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/5665
-Patch165:bind-9.16-openldap-2.6.patch
-Patch166:bind-9.16-openldap-2.6-all.patch
 
 %{?systemd_ordering}
 Requires:       coreutils
@@ -403,8 +400,6 @@ in HTML and PDF format.
 %patch130 -p1 -b .libdb
 %patch157 -p1 -b .fips-tests
 %patch164 -p1 -b .rh1666814
-%patch165 -p1 -b .rh2032704
-%patch166 -p1 -b .rh2032704-2
 
 %if %{with PKCS11}
 %patch135 -p1 -b .config-pkcs11
@@ -1127,6 +1122,9 @@ fi;
 %endif
 
 %changelog
+* Fri Jan 21 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.25-1
+- Update to 9.16.25 (#2042504)
+
 * Wed Jan 19 2022 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.16.24-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
 
diff --git a/sources b/sources
index ed0528a..fcfd18b 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.16.24.tar.xz) = a982bcad8c517dbcb81e768486e1a8b92e495efcf45c4961170c3bc7fac837903605dcd05cfb9b9e1074599b90be1b9c3dbca4162ede0a32fe4c3405ad92816b
-SHA512 (bind-9.16.24.tar.xz.asc) = 60afa2b2646fc761d85d15bc236fc700399478dfc8a9376bd591f1a3df4c0f26e029d6e8818cce3cdcd04600fd9d7b4d0092ac11a7c322159d15795165af3c79
+SHA512 (bind-9.16.25.tar.xz) = e43c0e59159d3a5642db051f3982d8767fb726426380c32960fefe4b9afd05708ed8f7e80a98b803a580b048e1a368c888e2dd5695fa5fcd7b8b75574a27cb62
+SHA512 (bind-9.16.25.tar.xz.asc) = ceb0af75619f2a2da4f183bb7d367f5a302ee41e140bc710b47aefedc3717b9cd7452f988e480a8798734f532338f3c03252a704e45b9d0a31f46ea499d1d572

From c0565f0da1028965049d9d2441ae559ff85acc58 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 21 Jan 2022 18:28:45 +0100
Subject: [PATCH 283/460] Fix ldap and sqlite3 DLZ module failure

Thread removal were incomplete, it has broken some dlz modules
compilation. Ensure threaded variant is always used, remove
remains of single-thread variant.
---
 bind-9.16-pthread-dlz-threaded.patch | 486 +++++++++++++++++++++++++++
 bind-9.16-pthread-dlz.patch          |  33 ++
 bind.spec                            |   5 +
 3 files changed, 524 insertions(+)
 create mode 100644 bind-9.16-pthread-dlz-threaded.patch
 create mode 100644 bind-9.16-pthread-dlz.patch

diff --git a/bind-9.16-pthread-dlz-threaded.patch b/bind-9.16-pthread-dlz-threaded.patch
new file mode 100644
index 0000000..a5a1312
--- /dev/null
+++ b/bind-9.16-pthread-dlz-threaded.patch
@@ -0,0 +1,486 @@
+From 053886b260204e399a33a6b95c6ee95f6161b451 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
+Date: Fri, 21 Jan 2022 18:52:45 +0100
+Subject: [PATCH] Remove remains of #if PTHREADS
+
+Always use only threaded version. Single thread version does not exist
+anymore.
+---
+ contrib/dlz/modules/ldap/dlz_ldap_dynamic.c   | 59 -------------------
+ contrib/dlz/modules/mysql/dlz_mysql_dynamic.c | 37 ------------
+ .../dlz/modules/sqlite3/dlz_sqlite3_dynamic.c | 37 ------------
+ 3 files changed, 133 deletions(-)
+
+diff --git a/contrib/dlz/modules/ldap/dlz_ldap_dynamic.c b/contrib/dlz/modules/ldap/dlz_ldap_dynamic.c
+index 7f9231244a..25a7837b67 100644
+--- a/contrib/dlz/modules/ldap/dlz_ldap_dynamic.c
++++ b/contrib/dlz/modules/ldap/dlz_ldap_dynamic.c
+@@ -69,11 +69,7 @@
+  * many separate instances.
+  */
+ typedef struct {
+-#if PTHREADS
+ 	db_list_t *db; /*%< handle to a list of DB */
+-#else		       /* if PTHREADS */
+-	dbinstance_t *db; /*%< handle to db */
+-#endif		       /* if PTHREADS */
+ 	int method;    /*%< security authentication
+ 			* method */
+ 	char *user;    /*%< who is authenticating */
+@@ -227,7 +223,6 @@ cleanup:
+ 	return (result);
+ }
+ 
+-#if PTHREADS
+ /*%
+  * Properly cleans up a list of database instances.
+  * This function is only used when the driver is compiled for
+@@ -298,7 +293,6 @@ dlz_ldap_find_avail_conn(ldap_instance_t *ldap) {
+ 		  count);
+ 	return (NULL);
+ }
+-#endif /* PTHREADS */
+ 
+ static isc_result_t
+ dlz_ldap_process_results(ldap_instance_t *db, LDAP *dbc, LDAPMessage *msg,
+@@ -542,16 +536,8 @@ dlz_ldap_get_results(const char *zone, const char *record, const char *client,
+ 	int entries;
+ 
+ 	/* get db instance / connection */
+-#if PTHREADS
+ 	/* find an available DBI from the list */
+ 	dbi = dlz_ldap_find_avail_conn(db);
+-#else  /* PTHREADS */
+-	/*
+-	 * only 1 DBI - no need to lock instance lock either
+-	 * only 1 thread in the whole process, no possible contention.
+-	 */
+-	dbi = (dbinstance_t *)(db->db);
+-#endif /* PTHREADS */
+ 
+ 	/* if DBI is null, can't do anything else */
+ 	if (dbi == NULL) {
+@@ -907,11 +893,9 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
+ 	const char *helper_name;
+ 	int protocol;
+ 	int method;
+-#if PTHREADS
+ 	int dbcount;
+ 	char *endp;
+ 	int i;
+-#endif /* PTHREADS */
+ 	va_list ap;
+ 
+ 	UNUSED(dlzname);
+@@ -930,13 +914,8 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
+ 	}
+ 	va_end(ap);
+ 
+-#if PTHREADS
+ 	/* if debugging, let user know we are multithreaded. */
+ 	ldap->log(ISC_LOG_DEBUG(1), "LDAP driver running multithreaded");
+-#else  /* PTHREADS */
+-	/* if debugging, let user know we are single threaded. */
+-	ldap->log(ISC_LOG_DEBUG(1), "LDAP driver running single threaded");
+-#endif /* PTHREADS */
+ 
+ 	if (argc < 9) {
+ 		ldap->log(ISC_LOG_ERROR, "LDAP driver requires at least "
+@@ -979,7 +958,6 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
+ 	}
+ 
+ 	/* multithreaded build can have multiple DB connections */
+-#if PTHREADS
+ 	/* check how many db connections we should create */
+ 	dbcount = strtol(argv[1], &endp, 10);
+ 	if (*endp != '\0' || dbcount < 0) {
+@@ -988,7 +966,6 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
+ 					 "must be positive.");
+ 		goto cleanup;
+ 	}
+-#endif /* if PTHREADS */
+ 
+ 	/* check that LDAP URL parameters make sense */
+ 	switch (argc) {
+@@ -1045,7 +1022,6 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
+ 		goto cleanup;
+ 	}
+ 
+-#if PTHREADS
+ 	/* allocate memory for database connection list */
+ 	ldap->db = calloc(1, sizeof(db_list_t));
+ 	if (ldap->db == NULL) {
+@@ -1061,7 +1037,6 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
+ 	 * append each new DBI to the end of the list
+ 	 */
+ 	for (i = 0; i < dbcount; i++) {
+-#endif /* PTHREADS */
+ 		/* how many queries were passed in from config file? */
+ 		switch (argc) {
+ 		case 9:
+@@ -1099,17 +1074,9 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
+ 			goto cleanup;
+ 		}
+ 
+-#if PTHREADS
+ 		/* when multithreaded, build a list of DBI's */
+ 		DLZ_LINK_INIT(dbi, link);
+ 		DLZ_LIST_APPEND(*(ldap->db), dbi, link);
+-#else  /* if PTHREADS */
+-	/*
+-	 * when single threaded, hold onto the one connection
+-	 * instance.
+-	 */
+-	ldap->db = dbi;
+-#endif /* if PTHREADS */
+ 		/* attempt to connect */
+ 		result = dlz_ldap_connect(ldap, dbi);
+ 
+@@ -1126,16 +1093,10 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
+ 		 * allocate memory
+ 		 */
+ 		case ISC_R_NOMEMORY:
+-#if PTHREADS
+ 			ldap->log(ISC_LOG_ERROR,
+ 				  "LDAP driver could not allocate memory "
+ 				  "for connection number %u",
+ 				  i + 1);
+-#else  /* if PTHREADS */
+-		ldap->log(ISC_LOG_ERROR, "LDAP driver could not allocate "
+-					 "memory "
+-					 "for connection");
+-#endif /* if PTHREADS */
+ 			goto cleanup;
+ 		/*
+ 		 * no perm means ldap_set_option could not set
+@@ -1148,15 +1109,10 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
+ 			goto cleanup;
+ 		/* failure means couldn't connect to ldap server */
+ 		case ISC_R_FAILURE:
+-#if PTHREADS
+ 			ldap->log(ISC_LOG_ERROR,
+ 				  "LDAP driver could not bind "
+ 				  "connection number %u to server.",
+ 				  i + 1);
+-#else  /* if PTHREADS */
+-		ldap->log(ISC_LOG_ERROR, "LDAP driver could not "
+-					 "bind connection to server.");
+-#endif /* if PTHREADS */
+ 			goto cleanup;
+ 		/*
+ 		 * default should never happen.  If it does,
+@@ -1169,11 +1125,9 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
+ 			goto cleanup;
+ 		}
+ 
+-#if PTHREADS
+ 		/* set DBI = null for next loop through. */
+ 		dbi = NULL;
+ 	}
+-#endif /* PTHREADS */
+ 
+ 	/* set dbdata to the ldap_instance we created. */
+ 	*dbdata = ldap;
+@@ -1190,19 +1144,10 @@ void
+ dlz_destroy(void *dbdata) {
+ 	if (dbdata != NULL) {
+ 		ldap_instance_t *db = (ldap_instance_t *)dbdata;
+-#if PTHREADS
+ 		/* cleanup the list of DBI's */
+ 		if (db->db != NULL) {
+ 			dlz_ldap_destroy_dblist((db_list_t *)(db->db));
+ 		}
+-#else  /* PTHREADS */
+-		if (db->db->dbconn != NULL) {
+-			ldap_unbind_s((LDAP *)(db->db->dbconn));
+-		}
+-
+-		/* destroy single DB instance */
+-		destroy_dbinstance(db->db);
+-#endif /* PTHREADS */
+ 
+ 		if (db->hosts != NULL) {
+ 			free(db->hosts);
+@@ -1223,11 +1168,7 @@ dlz_destroy(void *dbdata) {
+ int
+ dlz_version(unsigned int *flags) {
+ 	*flags |= DNS_SDLZFLAG_RELATIVERDATA;
+-#if PTHREADS
+ 	*flags |= DNS_SDLZFLAG_THREADSAFE;
+-#else  /* if PTHREADS */
+-	*flags &= ~DNS_SDLZFLAG_THREADSAFE;
+-#endif /* if PTHREADS */
+ 	return (DLZ_DLOPEN_VERSION);
+ }
+ 
+diff --git a/contrib/dlz/modules/mysql/dlz_mysql_dynamic.c b/contrib/dlz/modules/mysql/dlz_mysql_dynamic.c
+index 81b46aa79e..0b8be40112 100644
+--- a/contrib/dlz/modules/mysql/dlz_mysql_dynamic.c
++++ b/contrib/dlz/modules/mysql/dlz_mysql_dynamic.c
+@@ -64,12 +64,8 @@ typedef bool my_bool;
+  * many separate instances.
+  */
+ typedef struct {
+-#if PTHREADS
+ 	db_list_t *db; /*%< handle to a list of DB */
+ 	int dbcount;
+-#else  /* if PTHREADS */
+-	dbinstance_t *db; /*%< handle to DB */
+-#endif /* if PTHREADS */
+ 
+ 	unsigned int flags;
+ 	char *dbname;
+@@ -112,7 +108,6 @@ mysql_destroy(dbinstance_t *db) {
+ 	destroy_dbinstance(db);
+ }
+ 
+-#if PTHREADS
+ /*%
+  * Properly cleans up a list of database instances.
+  * This function is only used when the module is compiled for
+@@ -175,7 +170,6 @@ mysql_find_avail_conn(mysql_instance_t *mysql) {
+ 		   count);
+ 	return (NULL);
+ }
+-#endif /* PTHREADS */
+ 
+ /*%
+  * Allocates memory for a new string, and then constructs the new
+@@ -224,16 +218,8 @@ mysql_get_resultset(const char *zone, const char *record, const char *client,
+ 	unsigned int j = 0;
+ 	int qres = 0;
+ 
+-#if PTHREADS
+ 	/* find an available DBI from the list */
+ 	dbi = mysql_find_avail_conn(db);
+-#else  /* PTHREADS */
+-	/*
+-	 * only 1 DBI - no need to lock instance lock either
+-	 * only 1 thread in the whole process, no possible contention.
+-	 */
+-	dbi = (dbinstance_t *)(db->db);
+-#endif /* PTHREADS */
+ 
+ 	if (dbi == NULL) {
+ 		return (ISC_R_FAILURE);
+@@ -801,10 +787,8 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
+ 	char *endp;
+ 	int j;
+ 	const char *helper_name;
+-#if PTHREADS
+ 	int dbcount;
+ 	int i;
+-#endif /* PTHREADS */
+ 	va_list ap;
+ 
+ 	UNUSED(dlzname);
+@@ -823,13 +807,8 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
+ 	}
+ 	va_end(ap);
+ 
+-#if PTHREADS
+ 	/* if debugging, let user know we are multithreaded. */
+ 	mysql->log(ISC_LOG_DEBUG(1), "MySQL module running multithreaded");
+-#else  /* PTHREADS */
+-	/* if debugging, let user know we are single threaded. */
+-	mysql->log(ISC_LOG_DEBUG(1), "MySQL module running single threaded");
+-#endif /* PTHREADS */
+ 
+ 	/* verify we have at least 4 arg's passed to the module */
+ 	if (argc < 4) {
+@@ -901,7 +880,6 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
+ 		free(tmp);
+ 	}
+ 
+-#if PTHREADS
+ 	/* multithreaded build can have multiple DB connections */
+ 	tmp = get_parameter_value(argv[1], "threads=");
+ 	if (tmp == NULL) {
+@@ -934,7 +912,6 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
+ 	 * append each new DBI to the end of the list
+ 	 */
+ 	for (i = 0; i < dbcount; i++) {
+-#endif /* PTHREADS */
+ 		switch (argc) {
+ 		case 4:
+ 			result = build_dbinstance(NULL, NULL, NULL, argv[2],
+@@ -973,17 +950,9 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
+ 			goto cleanup;
+ 		}
+ 
+-#if PTHREADS
+ 		/* when multithreaded, build a list of DBI's */
+ 		DLZ_LINK_INIT(dbi, link);
+ 		DLZ_LIST_APPEND(*(mysql->db), dbi, link);
+-#else  /* if PTHREADS */
+-	/*
+-	 * when single threaded, hold onto the one connection
+-	 * instance.
+-	 */
+-	mysql->db = dbi;
+-#endif /* if PTHREADS */
+ 
+ 		/* create and set db connection */
+ 		dbi->dbconn = mysql_init(NULL);
+@@ -1029,11 +998,9 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
+ 			goto cleanup;
+ 		}
+ 
+-#if PTHREADS
+ 		/* set DBI = null for next loop through. */
+ 		dbi = NULL;
+ 	}
+-#endif /* PTHREADS */
+ 
+ 	*dbdata = mysql;
+ 
+@@ -1051,14 +1018,10 @@ cleanup:
+ void
+ dlz_destroy(void *dbdata) {
+ 	mysql_instance_t *db = (mysql_instance_t *)dbdata;
+-#if PTHREADS
+ 	/* cleanup the list of DBI's */
+ 	if (db->db != NULL) {
+ 		mysql_destroy_dblist((db_list_t *)(db->db));
+ 	}
+-#else  /* PTHREADS */
+-	mysql_destroy(db);
+-#endif /* PTHREADS */
+ 
+ 	if (db->dbname != NULL) {
+ 		free(db->dbname);
+diff --git a/contrib/dlz/modules/sqlite3/dlz_sqlite3_dynamic.c b/contrib/dlz/modules/sqlite3/dlz_sqlite3_dynamic.c
+index c2a8958d6a..459ae7f68d 100644
+--- a/contrib/dlz/modules/sqlite3/dlz_sqlite3_dynamic.c
++++ b/contrib/dlz/modules/sqlite3/dlz_sqlite3_dynamic.c
+@@ -59,12 +59,8 @@
+  * many separate instances.
+  */
+ typedef struct {
+-#if PTHREADS
+ 	db_list_t *db; /*%< handle to a list of DB */
+ 	int dbcount;
+-#else  /* if PTHREADS */
+-	dbinstance_t *db; /*%< handle to DB */
+-#endif /* if PTHREADS */
+ 
+ 	char *dbname;
+ 
+@@ -113,7 +109,6 @@ sqlite3_destroy(dbinstance_t *db) {
+ 	destroy_dbinstance(db);
+ }
+ 
+-#if PTHREADS
+ /*%
+  * Properly cleans up a list of database instances.
+  * This function is only used when the module is compiled for
+@@ -176,7 +171,6 @@ sqlite3_find_avail(sqlite3_instance_t *sqlite3) {
+ 		     count);
+ 	return (NULL);
+ }
+-#endif /* PTHREADS */
+ 
+ /*%
+  * Allocates memory for a new string, and then constructs the new
+@@ -252,16 +246,8 @@ sqlite3_get_resultset(const char *zone, const char *record, const char *client,
+ 		goto cleanup;
+ 	}
+ 
+-#if PTHREADS
+ 	/* find an available DBI from the list */
+ 	dbi = sqlite3_find_avail(db);
+-#else  /* PTHREADS */
+-	/*
+-	 * only 1 DBI - no need to lock instance lock either
+-	 * only 1 thread in the whole process, no possible contention.
+-	 */
+-	dbi = (dbinstance_t *)(db->db);
+-#endif /* PTHREADS */
+ 
+ 	if (dbi == NULL) {
+ 		return (ISC_R_FAILURE);
+@@ -872,10 +858,8 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
+ 	char *tmp = NULL;
+ 	char *endp;
+ 	const char *helper_name;
+-#if PTHREADS
+ 	int dbcount;
+ 	int i, ret;
+-#endif /* PTHREADS */
+ 	va_list ap;
+ 
+ 	UNUSED(dlzname);
+@@ -894,13 +878,8 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
+ 	}
+ 	va_end(ap);
+ 
+-#if PTHREADS
+ 	/* if debugging, let user know we are multithreaded. */
+ 	s3->log(ISC_LOG_DEBUG(1), "SQLite3 module: running multithreaded");
+-#else  /* PTHREADS */
+-	/* if debugging, let user know we are single threaded. */
+-	s3->log(ISC_LOG_DEBUG(1), "SQLite3 module: running single threaded");
+-#endif /* PTHREADS */
+ 
+ 	/* verify we have at least 4 arg's passed to the module */
+ 	if (argc < 4) {
+@@ -925,7 +904,6 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
+ 		goto cleanup;
+ 	}
+ 
+-#if PTHREADS
+ 	/* multithreaded build can have multiple DB connections */
+ 	tmp = get_parameter_value(argv[1], "threads=");
+ 	if (tmp == NULL) {
+@@ -958,7 +936,6 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
+ 	 * append each new DBI to the end of the list
+ 	 */
+ 	for (i = 0; i < dbcount; i++) {
+-#endif /* PTHREADS */
+ 		switch (argc) {
+ 		case 4:
+ 			result = build_dbinstance(NULL, NULL, NULL, argv[2],
+@@ -1014,25 +991,15 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
+ 			goto cleanup;
+ 		}
+ 
+-#if PTHREADS
+ 		/* when multithreaded, build a list of DBI's */
+ 		DLZ_LINK_INIT(dbi, link);
+ 		DLZ_LIST_APPEND(*(s3->db), dbi, link);
+-#else  /* if PTHREADS */
+-	/*
+-	 * when single threaded, hold onto the one connection
+-	 * instance.
+-	 */
+-	s3->db = dbi;
+-#endif /* if PTHREADS */
+ 
+ 		dbi->dbconn = dbc;
+ 		dbc = NULL;
+-#if PTHREADS
+ 		/* set DBI = null for next loop through. */
+ 		dbi = NULL;
+ 	}
+-#endif /* PTHREADS */
+ 
+ 	*dbdata = s3;
+ 	return (ISC_R_SUCCESS);
+@@ -1049,14 +1016,10 @@ cleanup:
+ void
+ dlz_destroy(void *dbdata) {
+ 	sqlite3_instance_t *db = (sqlite3_instance_t *)dbdata;
+-#if PTHREADS
+ 	/* cleanup the list of DBI's */
+ 	if (db->db != NULL) {
+ 		sqlite3_destroy_dblist((db_list_t *)(db->db));
+ 	}
+-#else  /* PTHREADS */
+-	sqlite3_destroy(db);
+-#endif /* PTHREADS */
+ 
+ 	if (db->dbname != NULL) {
+ 		free(db->dbname);
+-- 
+2.31.1
+
diff --git a/bind-9.16-pthread-dlz.patch b/bind-9.16-pthread-dlz.patch
new file mode 100644
index 0000000..f78488b
--- /dev/null
+++ b/bind-9.16-pthread-dlz.patch
@@ -0,0 +1,33 @@
+From ed812b09c091ba31c0c14b597ddbcfab47ce1cf3 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
+Date: Fri, 21 Jan 2022 18:19:04 +0100
+Subject: [PATCH] Correct #ifdef broken by pthread removal
+
+Commit 2bf7921c7e93d43fa32fcfc9cd8e20d26c5f2084 has broken building of
+ldap module. Initial #ifdef PTHREADS were removed without removing also
+else and endif parts. DLZ modules do not compile anymore.
+---
+ contrib/dlz/modules/include/dlz_pthread.h | 8 --------
+ 1 file changed, 8 deletions(-)
+
+diff --git a/contrib/dlz/modules/include/dlz_pthread.h b/contrib/dlz/modules/include/dlz_pthread.h
+index c1b6db637e..10619d39b9 100644
+--- a/contrib/dlz/modules/include/dlz_pthread.h
++++ b/contrib/dlz/modules/include/dlz_pthread.h
+@@ -26,13 +26,5 @@
+ #define dlz_mutex_lock	  pthread_mutex_lock
+ #define dlz_mutex_trylock pthread_mutex_trylock
+ #define dlz_mutex_unlock  pthread_mutex_unlock
+-#else /* !PTHREADS */
+-#define dlz_mutex_t	     void
+-#define dlz_mutex_init(a, b) (0)
+-#define dlz_mutex_destroy(a) (0)
+-#define dlz_mutex_lock(a)    (0)
+-#define dlz_mutex_trylock(a) (0)
+-#define dlz_mutex_unlock(a)  (0)
+-#endif /* ifdef PTHREADS */
+ 
+ #endif /* DLZ_PTHREAD_H */
+-- 
+2.31.1
+
diff --git a/bind.spec b/bind.spec
index 976853f..c8d5212 100644
--- a/bind.spec
+++ b/bind.spec
@@ -102,6 +102,9 @@ Patch149:bind-9.11-kyua-pkcs11.patch
 Patch157:bind-9.11-fips-tests.patch
 # https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/2689
 Patch164:bind-9.11-rh1666814.patch
+# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/5747
+Patch165:bind-9.16-pthread-dlz.patch
+Patch166:bind-9.16-pthread-dlz-threaded.patch
 
 %{?systemd_ordering}
 Requires:       coreutils
@@ -400,6 +403,8 @@ in HTML and PDF format.
 %patch130 -p1 -b .libdb
 %patch157 -p1 -b .fips-tests
 %patch164 -p1 -b .rh1666814
+%patch165 -p1 -b .pthread-dlz
+%patch166 -p1 -b .pthreaded-dlz
 
 %if %{with PKCS11}
 %patch135 -p1 -b .config-pkcs11

From c81513c7589fa21d02c2b6db3fd4c282b65e1ddd Mon Sep 17 00:00:00 2001
From: Petr Sklenar <psklenar@redhat.com>
Date: Tue, 25 Jan 2022 08:26:01 +0100
Subject: [PATCH 284/460] adding ci.fmf with multiple plans support

---
 ci.fmf | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 ci.fmf

diff --git a/ci.fmf b/ci.fmf
new file mode 100644
index 0000000..c5aa0e0
--- /dev/null
+++ b/ci.fmf
@@ -0,0 +1 @@
+resultsdb-testcase: separate

From de4624f6e021168661235f6e7e4e7731d571c279 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 25 Jan 2022 15:07:27 +0100
Subject: [PATCH 285/460] Replace master with primary in configuration

Use more friendly value for primary and secondary zones. It used master
for ages, but that might have wrong connotation to someone. Use
something without problematic history.
---
 bind.spec           |  5 ++++-
 named.conf.sample   |  8 ++++----
 named.rfc1912.zones | 10 +++++-----
 3 files changed, 13 insertions(+), 10 deletions(-)

diff --git a/bind.spec b/bind.spec
index c8d5212..3cc6589 100644
--- a/bind.spec
+++ b/bind.spec
@@ -53,7 +53,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.16.25
-Release:  1%{?dist}
+Release:  2%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1127,6 +1127,9 @@ fi;
 %endif
 
 %changelog
+* Tue Jan 25 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.25-2
+- Replace master with primary in configuration
+
 * Fri Jan 21 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.25-1
 - Update to 9.16.25 (#2042504)
 
diff --git a/named.conf.sample b/named.conf.sample
index d2ce6dd..0f3ae98 100644
--- a/named.conf.sample
+++ b/named.conf.sample
@@ -159,17 +159,17 @@ view "internal"
 	*/
 
 	zone "my.internal.zone" { 
-		type master;
+		type primary;
 		file "my.internal.zone.db";
 	};
 	zone "my.slave.internal.zone" {
-		type slave;
+		type secondary;
 		file "slaves/my.slave.internal.zone.db";
 		masters { /* put master nameserver IPs here */ 127.0.0.1; } ;
 		// put slave zones in the slaves/ directory so named can update them
 	};	
 	zone "my.ddns.internal.zone" {
-		type master;
+		type primary;
 		allow-update { key ddns_key; };
 		file "dynamic/my.ddns.internal.zone.db";
 		// put dynamically updateable zones in the slaves/ directory so named can update them
@@ -202,7 +202,7 @@ view "external"
         // contain entries for just your web and mail servers:
 
 	zone "my.external.zone" { 
-		type master;
+		type primary;
 		file "my.external.zone.db";
 	};
 };
diff --git a/named.rfc1912.zones b/named.rfc1912.zones
index fa8caf5..2c3c2a8 100644
--- a/named.rfc1912.zones
+++ b/named.rfc1912.zones
@@ -15,31 +15,31 @@
 // 
 
 zone "localhost.localdomain" IN {
-	type master;
+	type primary;
 	file "named.localhost";
 	allow-update { none; };
 };
 
 zone "localhost" IN {
-	type master;
+	type primary;
 	file "named.localhost";
 	allow-update { none; };
 };
 
 zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" IN {
-	type master;
+	type primary;
 	file "named.loopback";
 	allow-update { none; };
 };
 
 zone "1.0.0.127.in-addr.arpa" IN {
-	type master;
+	type primary;
 	file "named.loopback";
 	allow-update { none; };
 };
 
 zone "0.in-addr.arpa" IN {
-	type master;
+	type primary;
 	file "named.empty";
 	allow-update { none; };
 };

From 5df92605e8d6ddd71bcdc9dc7a859cbf5afd73bf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 11 Feb 2022 15:33:40 +0100
Subject: [PATCH 286/460] Use upstream applied fix to DLZ modules

---
 bind-9.16-pthread-dlz-threaded.patch | 486 ---------------------------
 bind-9.16-pthread-dlz.patch          |  45 ++-
 bind.spec                            |   4 +-
 3 files changed, 22 insertions(+), 513 deletions(-)
 delete mode 100644 bind-9.16-pthread-dlz-threaded.patch

diff --git a/bind-9.16-pthread-dlz-threaded.patch b/bind-9.16-pthread-dlz-threaded.patch
deleted file mode 100644
index a5a1312..0000000
--- a/bind-9.16-pthread-dlz-threaded.patch
+++ /dev/null
@@ -1,486 +0,0 @@
-From 053886b260204e399a33a6b95c6ee95f6161b451 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Fri, 21 Jan 2022 18:52:45 +0100
-Subject: [PATCH] Remove remains of #if PTHREADS
-
-Always use only threaded version. Single thread version does not exist
-anymore.
----
- contrib/dlz/modules/ldap/dlz_ldap_dynamic.c   | 59 -------------------
- contrib/dlz/modules/mysql/dlz_mysql_dynamic.c | 37 ------------
- .../dlz/modules/sqlite3/dlz_sqlite3_dynamic.c | 37 ------------
- 3 files changed, 133 deletions(-)
-
-diff --git a/contrib/dlz/modules/ldap/dlz_ldap_dynamic.c b/contrib/dlz/modules/ldap/dlz_ldap_dynamic.c
-index 7f9231244a..25a7837b67 100644
---- a/contrib/dlz/modules/ldap/dlz_ldap_dynamic.c
-+++ b/contrib/dlz/modules/ldap/dlz_ldap_dynamic.c
-@@ -69,11 +69,7 @@
-  * many separate instances.
-  */
- typedef struct {
--#if PTHREADS
- 	db_list_t *db; /*%< handle to a list of DB */
--#else		       /* if PTHREADS */
--	dbinstance_t *db; /*%< handle to db */
--#endif		       /* if PTHREADS */
- 	int method;    /*%< security authentication
- 			* method */
- 	char *user;    /*%< who is authenticating */
-@@ -227,7 +223,6 @@ cleanup:
- 	return (result);
- }
- 
--#if PTHREADS
- /*%
-  * Properly cleans up a list of database instances.
-  * This function is only used when the driver is compiled for
-@@ -298,7 +293,6 @@ dlz_ldap_find_avail_conn(ldap_instance_t *ldap) {
- 		  count);
- 	return (NULL);
- }
--#endif /* PTHREADS */
- 
- static isc_result_t
- dlz_ldap_process_results(ldap_instance_t *db, LDAP *dbc, LDAPMessage *msg,
-@@ -542,16 +536,8 @@ dlz_ldap_get_results(const char *zone, const char *record, const char *client,
- 	int entries;
- 
- 	/* get db instance / connection */
--#if PTHREADS
- 	/* find an available DBI from the list */
- 	dbi = dlz_ldap_find_avail_conn(db);
--#else  /* PTHREADS */
--	/*
--	 * only 1 DBI - no need to lock instance lock either
--	 * only 1 thread in the whole process, no possible contention.
--	 */
--	dbi = (dbinstance_t *)(db->db);
--#endif /* PTHREADS */
- 
- 	/* if DBI is null, can't do anything else */
- 	if (dbi == NULL) {
-@@ -907,11 +893,9 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
- 	const char *helper_name;
- 	int protocol;
- 	int method;
--#if PTHREADS
- 	int dbcount;
- 	char *endp;
- 	int i;
--#endif /* PTHREADS */
- 	va_list ap;
- 
- 	UNUSED(dlzname);
-@@ -930,13 +914,8 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
- 	}
- 	va_end(ap);
- 
--#if PTHREADS
- 	/* if debugging, let user know we are multithreaded. */
- 	ldap->log(ISC_LOG_DEBUG(1), "LDAP driver running multithreaded");
--#else  /* PTHREADS */
--	/* if debugging, let user know we are single threaded. */
--	ldap->log(ISC_LOG_DEBUG(1), "LDAP driver running single threaded");
--#endif /* PTHREADS */
- 
- 	if (argc < 9) {
- 		ldap->log(ISC_LOG_ERROR, "LDAP driver requires at least "
-@@ -979,7 +958,6 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
- 	}
- 
- 	/* multithreaded build can have multiple DB connections */
--#if PTHREADS
- 	/* check how many db connections we should create */
- 	dbcount = strtol(argv[1], &endp, 10);
- 	if (*endp != '\0' || dbcount < 0) {
-@@ -988,7 +966,6 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
- 					 "must be positive.");
- 		goto cleanup;
- 	}
--#endif /* if PTHREADS */
- 
- 	/* check that LDAP URL parameters make sense */
- 	switch (argc) {
-@@ -1045,7 +1022,6 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
- 		goto cleanup;
- 	}
- 
--#if PTHREADS
- 	/* allocate memory for database connection list */
- 	ldap->db = calloc(1, sizeof(db_list_t));
- 	if (ldap->db == NULL) {
-@@ -1061,7 +1037,6 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
- 	 * append each new DBI to the end of the list
- 	 */
- 	for (i = 0; i < dbcount; i++) {
--#endif /* PTHREADS */
- 		/* how many queries were passed in from config file? */
- 		switch (argc) {
- 		case 9:
-@@ -1099,17 +1074,9 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
- 			goto cleanup;
- 		}
- 
--#if PTHREADS
- 		/* when multithreaded, build a list of DBI's */
- 		DLZ_LINK_INIT(dbi, link);
- 		DLZ_LIST_APPEND(*(ldap->db), dbi, link);
--#else  /* if PTHREADS */
--	/*
--	 * when single threaded, hold onto the one connection
--	 * instance.
--	 */
--	ldap->db = dbi;
--#endif /* if PTHREADS */
- 		/* attempt to connect */
- 		result = dlz_ldap_connect(ldap, dbi);
- 
-@@ -1126,16 +1093,10 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
- 		 * allocate memory
- 		 */
- 		case ISC_R_NOMEMORY:
--#if PTHREADS
- 			ldap->log(ISC_LOG_ERROR,
- 				  "LDAP driver could not allocate memory "
- 				  "for connection number %u",
- 				  i + 1);
--#else  /* if PTHREADS */
--		ldap->log(ISC_LOG_ERROR, "LDAP driver could not allocate "
--					 "memory "
--					 "for connection");
--#endif /* if PTHREADS */
- 			goto cleanup;
- 		/*
- 		 * no perm means ldap_set_option could not set
-@@ -1148,15 +1109,10 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
- 			goto cleanup;
- 		/* failure means couldn't connect to ldap server */
- 		case ISC_R_FAILURE:
--#if PTHREADS
- 			ldap->log(ISC_LOG_ERROR,
- 				  "LDAP driver could not bind "
- 				  "connection number %u to server.",
- 				  i + 1);
--#else  /* if PTHREADS */
--		ldap->log(ISC_LOG_ERROR, "LDAP driver could not "
--					 "bind connection to server.");
--#endif /* if PTHREADS */
- 			goto cleanup;
- 		/*
- 		 * default should never happen.  If it does,
-@@ -1169,11 +1125,9 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
- 			goto cleanup;
- 		}
- 
--#if PTHREADS
- 		/* set DBI = null for next loop through. */
- 		dbi = NULL;
- 	}
--#endif /* PTHREADS */
- 
- 	/* set dbdata to the ldap_instance we created. */
- 	*dbdata = ldap;
-@@ -1190,19 +1144,10 @@ void
- dlz_destroy(void *dbdata) {
- 	if (dbdata != NULL) {
- 		ldap_instance_t *db = (ldap_instance_t *)dbdata;
--#if PTHREADS
- 		/* cleanup the list of DBI's */
- 		if (db->db != NULL) {
- 			dlz_ldap_destroy_dblist((db_list_t *)(db->db));
- 		}
--#else  /* PTHREADS */
--		if (db->db->dbconn != NULL) {
--			ldap_unbind_s((LDAP *)(db->db->dbconn));
--		}
--
--		/* destroy single DB instance */
--		destroy_dbinstance(db->db);
--#endif /* PTHREADS */
- 
- 		if (db->hosts != NULL) {
- 			free(db->hosts);
-@@ -1223,11 +1168,7 @@ dlz_destroy(void *dbdata) {
- int
- dlz_version(unsigned int *flags) {
- 	*flags |= DNS_SDLZFLAG_RELATIVERDATA;
--#if PTHREADS
- 	*flags |= DNS_SDLZFLAG_THREADSAFE;
--#else  /* if PTHREADS */
--	*flags &= ~DNS_SDLZFLAG_THREADSAFE;
--#endif /* if PTHREADS */
- 	return (DLZ_DLOPEN_VERSION);
- }
- 
-diff --git a/contrib/dlz/modules/mysql/dlz_mysql_dynamic.c b/contrib/dlz/modules/mysql/dlz_mysql_dynamic.c
-index 81b46aa79e..0b8be40112 100644
---- a/contrib/dlz/modules/mysql/dlz_mysql_dynamic.c
-+++ b/contrib/dlz/modules/mysql/dlz_mysql_dynamic.c
-@@ -64,12 +64,8 @@ typedef bool my_bool;
-  * many separate instances.
-  */
- typedef struct {
--#if PTHREADS
- 	db_list_t *db; /*%< handle to a list of DB */
- 	int dbcount;
--#else  /* if PTHREADS */
--	dbinstance_t *db; /*%< handle to DB */
--#endif /* if PTHREADS */
- 
- 	unsigned int flags;
- 	char *dbname;
-@@ -112,7 +108,6 @@ mysql_destroy(dbinstance_t *db) {
- 	destroy_dbinstance(db);
- }
- 
--#if PTHREADS
- /*%
-  * Properly cleans up a list of database instances.
-  * This function is only used when the module is compiled for
-@@ -175,7 +170,6 @@ mysql_find_avail_conn(mysql_instance_t *mysql) {
- 		   count);
- 	return (NULL);
- }
--#endif /* PTHREADS */
- 
- /*%
-  * Allocates memory for a new string, and then constructs the new
-@@ -224,16 +218,8 @@ mysql_get_resultset(const char *zone, const char *record, const char *client,
- 	unsigned int j = 0;
- 	int qres = 0;
- 
--#if PTHREADS
- 	/* find an available DBI from the list */
- 	dbi = mysql_find_avail_conn(db);
--#else  /* PTHREADS */
--	/*
--	 * only 1 DBI - no need to lock instance lock either
--	 * only 1 thread in the whole process, no possible contention.
--	 */
--	dbi = (dbinstance_t *)(db->db);
--#endif /* PTHREADS */
- 
- 	if (dbi == NULL) {
- 		return (ISC_R_FAILURE);
-@@ -801,10 +787,8 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
- 	char *endp;
- 	int j;
- 	const char *helper_name;
--#if PTHREADS
- 	int dbcount;
- 	int i;
--#endif /* PTHREADS */
- 	va_list ap;
- 
- 	UNUSED(dlzname);
-@@ -823,13 +807,8 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
- 	}
- 	va_end(ap);
- 
--#if PTHREADS
- 	/* if debugging, let user know we are multithreaded. */
- 	mysql->log(ISC_LOG_DEBUG(1), "MySQL module running multithreaded");
--#else  /* PTHREADS */
--	/* if debugging, let user know we are single threaded. */
--	mysql->log(ISC_LOG_DEBUG(1), "MySQL module running single threaded");
--#endif /* PTHREADS */
- 
- 	/* verify we have at least 4 arg's passed to the module */
- 	if (argc < 4) {
-@@ -901,7 +880,6 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
- 		free(tmp);
- 	}
- 
--#if PTHREADS
- 	/* multithreaded build can have multiple DB connections */
- 	tmp = get_parameter_value(argv[1], "threads=");
- 	if (tmp == NULL) {
-@@ -934,7 +912,6 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
- 	 * append each new DBI to the end of the list
- 	 */
- 	for (i = 0; i < dbcount; i++) {
--#endif /* PTHREADS */
- 		switch (argc) {
- 		case 4:
- 			result = build_dbinstance(NULL, NULL, NULL, argv[2],
-@@ -973,17 +950,9 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
- 			goto cleanup;
- 		}
- 
--#if PTHREADS
- 		/* when multithreaded, build a list of DBI's */
- 		DLZ_LINK_INIT(dbi, link);
- 		DLZ_LIST_APPEND(*(mysql->db), dbi, link);
--#else  /* if PTHREADS */
--	/*
--	 * when single threaded, hold onto the one connection
--	 * instance.
--	 */
--	mysql->db = dbi;
--#endif /* if PTHREADS */
- 
- 		/* create and set db connection */
- 		dbi->dbconn = mysql_init(NULL);
-@@ -1029,11 +998,9 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
- 			goto cleanup;
- 		}
- 
--#if PTHREADS
- 		/* set DBI = null for next loop through. */
- 		dbi = NULL;
- 	}
--#endif /* PTHREADS */
- 
- 	*dbdata = mysql;
- 
-@@ -1051,14 +1018,10 @@ cleanup:
- void
- dlz_destroy(void *dbdata) {
- 	mysql_instance_t *db = (mysql_instance_t *)dbdata;
--#if PTHREADS
- 	/* cleanup the list of DBI's */
- 	if (db->db != NULL) {
- 		mysql_destroy_dblist((db_list_t *)(db->db));
- 	}
--#else  /* PTHREADS */
--	mysql_destroy(db);
--#endif /* PTHREADS */
- 
- 	if (db->dbname != NULL) {
- 		free(db->dbname);
-diff --git a/contrib/dlz/modules/sqlite3/dlz_sqlite3_dynamic.c b/contrib/dlz/modules/sqlite3/dlz_sqlite3_dynamic.c
-index c2a8958d6a..459ae7f68d 100644
---- a/contrib/dlz/modules/sqlite3/dlz_sqlite3_dynamic.c
-+++ b/contrib/dlz/modules/sqlite3/dlz_sqlite3_dynamic.c
-@@ -59,12 +59,8 @@
-  * many separate instances.
-  */
- typedef struct {
--#if PTHREADS
- 	db_list_t *db; /*%< handle to a list of DB */
- 	int dbcount;
--#else  /* if PTHREADS */
--	dbinstance_t *db; /*%< handle to DB */
--#endif /* if PTHREADS */
- 
- 	char *dbname;
- 
-@@ -113,7 +109,6 @@ sqlite3_destroy(dbinstance_t *db) {
- 	destroy_dbinstance(db);
- }
- 
--#if PTHREADS
- /*%
-  * Properly cleans up a list of database instances.
-  * This function is only used when the module is compiled for
-@@ -176,7 +171,6 @@ sqlite3_find_avail(sqlite3_instance_t *sqlite3) {
- 		     count);
- 	return (NULL);
- }
--#endif /* PTHREADS */
- 
- /*%
-  * Allocates memory for a new string, and then constructs the new
-@@ -252,16 +246,8 @@ sqlite3_get_resultset(const char *zone, const char *record, const char *client,
- 		goto cleanup;
- 	}
- 
--#if PTHREADS
- 	/* find an available DBI from the list */
- 	dbi = sqlite3_find_avail(db);
--#else  /* PTHREADS */
--	/*
--	 * only 1 DBI - no need to lock instance lock either
--	 * only 1 thread in the whole process, no possible contention.
--	 */
--	dbi = (dbinstance_t *)(db->db);
--#endif /* PTHREADS */
- 
- 	if (dbi == NULL) {
- 		return (ISC_R_FAILURE);
-@@ -872,10 +858,8 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
- 	char *tmp = NULL;
- 	char *endp;
- 	const char *helper_name;
--#if PTHREADS
- 	int dbcount;
- 	int i, ret;
--#endif /* PTHREADS */
- 	va_list ap;
- 
- 	UNUSED(dlzname);
-@@ -894,13 +878,8 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
- 	}
- 	va_end(ap);
- 
--#if PTHREADS
- 	/* if debugging, let user know we are multithreaded. */
- 	s3->log(ISC_LOG_DEBUG(1), "SQLite3 module: running multithreaded");
--#else  /* PTHREADS */
--	/* if debugging, let user know we are single threaded. */
--	s3->log(ISC_LOG_DEBUG(1), "SQLite3 module: running single threaded");
--#endif /* PTHREADS */
- 
- 	/* verify we have at least 4 arg's passed to the module */
- 	if (argc < 4) {
-@@ -925,7 +904,6 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
- 		goto cleanup;
- 	}
- 
--#if PTHREADS
- 	/* multithreaded build can have multiple DB connections */
- 	tmp = get_parameter_value(argv[1], "threads=");
- 	if (tmp == NULL) {
-@@ -958,7 +936,6 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
- 	 * append each new DBI to the end of the list
- 	 */
- 	for (i = 0; i < dbcount; i++) {
--#endif /* PTHREADS */
- 		switch (argc) {
- 		case 4:
- 			result = build_dbinstance(NULL, NULL, NULL, argv[2],
-@@ -1014,25 +991,15 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
- 			goto cleanup;
- 		}
- 
--#if PTHREADS
- 		/* when multithreaded, build a list of DBI's */
- 		DLZ_LINK_INIT(dbi, link);
- 		DLZ_LIST_APPEND(*(s3->db), dbi, link);
--#else  /* if PTHREADS */
--	/*
--	 * when single threaded, hold onto the one connection
--	 * instance.
--	 */
--	s3->db = dbi;
--#endif /* if PTHREADS */
- 
- 		dbi->dbconn = dbc;
- 		dbc = NULL;
--#if PTHREADS
- 		/* set DBI = null for next loop through. */
- 		dbi = NULL;
- 	}
--#endif /* PTHREADS */
- 
- 	*dbdata = s3;
- 	return (ISC_R_SUCCESS);
-@@ -1049,14 +1016,10 @@ cleanup:
- void
- dlz_destroy(void *dbdata) {
- 	sqlite3_instance_t *db = (sqlite3_instance_t *)dbdata;
--#if PTHREADS
- 	/* cleanup the list of DBI's */
- 	if (db->db != NULL) {
- 		sqlite3_destroy_dblist((db_list_t *)(db->db));
- 	}
--#else  /* PTHREADS */
--	sqlite3_destroy(db);
--#endif /* PTHREADS */
- 
- 	if (db->dbname != NULL) {
- 		free(db->dbname);
--- 
-2.31.1
-
diff --git a/bind-9.16-pthread-dlz.patch b/bind-9.16-pthread-dlz.patch
index f78488b..627d235 100644
--- a/bind-9.16-pthread-dlz.patch
+++ b/bind-9.16-pthread-dlz.patch
@@ -1,33 +1,30 @@
-From ed812b09c091ba31c0c14b597ddbcfab47ce1cf3 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Fri, 21 Jan 2022 18:19:04 +0100
-Subject: [PATCH] Correct #ifdef broken by pthread removal
+From 5996c73516ad1a21eff008145f4643d9eded2c80 Mon Sep 17 00:00:00 2001
+From: Evan Hunt <each@isc.org>
+Date: Tue, 25 Jan 2022 12:28:48 -0800
+Subject: [PATCH] restore missing lines in dlz_pthread.h
 
-Commit 2bf7921c7e93d43fa32fcfc9cd8e20d26c5f2084 has broken building of
-ldap module. Initial #ifdef PTHREADS were removed without removing also
-else and endif parts. DLZ modules do not compile anymore.
+some lines were accidentally deleted during a backport that
+made it imposisble to build DLZ modules.
 ---
- contrib/dlz/modules/include/dlz_pthread.h | 8 --------
- 1 file changed, 8 deletions(-)
+ contrib/dlz/modules/include/dlz_pthread.h | 5 +++++
+ 1 file changed, 5 insertions(+)
 
 diff --git a/contrib/dlz/modules/include/dlz_pthread.h b/contrib/dlz/modules/include/dlz_pthread.h
-index c1b6db637e..10619d39b9 100644
+index c1b6db637e..4479f836c0 100644
 --- a/contrib/dlz/modules/include/dlz_pthread.h
 +++ b/contrib/dlz/modules/include/dlz_pthread.h
-@@ -26,13 +26,5 @@
- #define dlz_mutex_lock	  pthread_mutex_lock
- #define dlz_mutex_trylock pthread_mutex_trylock
- #define dlz_mutex_unlock  pthread_mutex_unlock
--#else /* !PTHREADS */
--#define dlz_mutex_t	     void
--#define dlz_mutex_init(a, b) (0)
--#define dlz_mutex_destroy(a) (0)
--#define dlz_mutex_lock(a)    (0)
--#define dlz_mutex_trylock(a) (0)
--#define dlz_mutex_unlock(a)  (0)
--#endif /* ifdef PTHREADS */
+@@ -19,6 +19,11 @@
+ #ifndef DLZ_PTHREAD_H
+ #define DLZ_PTHREAD_H 1
  
- #endif /* DLZ_PTHREAD_H */
++#ifndef PTHREADS
++#define PTHREADS 1
++#endif /* ifndef PTHREADS */
++
++#ifdef PTHREADS
+ #include <pthread.h>
+ #define dlz_mutex_t	  pthread_mutex_t
+ #define dlz_mutex_init	  pthread_mutex_init
 -- 
-2.31.1
+2.34.1
 
diff --git a/bind.spec b/bind.spec
index 3cc6589..2627b6f 100644
--- a/bind.spec
+++ b/bind.spec
@@ -102,9 +102,8 @@ Patch149:bind-9.11-kyua-pkcs11.patch
 Patch157:bind-9.11-fips-tests.patch
 # https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/2689
 Patch164:bind-9.11-rh1666814.patch
-# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/5747
+# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/5757
 Patch165:bind-9.16-pthread-dlz.patch
-Patch166:bind-9.16-pthread-dlz-threaded.patch
 
 %{?systemd_ordering}
 Requires:       coreutils
@@ -404,7 +403,6 @@ in HTML and PDF format.
 %patch157 -p1 -b .fips-tests
 %patch164 -p1 -b .rh1666814
 %patch165 -p1 -b .pthread-dlz
-%patch166 -p1 -b .pthreaded-dlz
 
 %if %{with PKCS11}
 %patch135 -p1 -b .config-pkcs11

From 3f2a16fed6815e6031c247f49b79ef40f0bc35a1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 11 Feb 2022 15:26:43 +0100
Subject: [PATCH 287/460] Allow manual reservation of additional hp threads

bind-dyndb-ldap started crashing after memory optimization made in
9.16.25 release. It attempts to use now uninitialized memory part. Work
around this problem by extra command line parameters, which would
request additional threads. Those threads then would be safely used by
bind-dyndb-ldap. Requires change to bind-dyndb-ldap and freeipa
packages.

Needs freeipa to add OPTIONS+="-H 200" to /etc/sysconfig/named

Related: rhbz#2048235
---
 bind-9.16-hp-workers-rh2048235-dyndb.patch | 116 +++++++++++++
 bind-9.16-hp-workers-rh2048235.patch       | 180 +++++++++++++++++++++
 bind.spec                                  |  10 +-
 3 files changed, 305 insertions(+), 1 deletion(-)
 create mode 100644 bind-9.16-hp-workers-rh2048235-dyndb.patch
 create mode 100644 bind-9.16-hp-workers-rh2048235.patch

diff --git a/bind-9.16-hp-workers-rh2048235-dyndb.patch b/bind-9.16-hp-workers-rh2048235-dyndb.patch
new file mode 100644
index 0000000..12ae5ad
--- /dev/null
+++ b/bind-9.16-hp-workers-rh2048235-dyndb.patch
@@ -0,0 +1,116 @@
+From b6320643194a3b435f2a6ae4569ace19db6ac795 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
+Date: Fri, 11 Feb 2022 14:19:10 +0100
+Subject: [PATCH] Propagate extra hp threads to dyndb plugins
+
+Plugin may require extra threads for processing its own source data. If
+that plugin needs to call isc_task_send() from those threads, it needs
+extra hp threads initialized. Allow plugin to read how many such threads
+it can use. Allows plugin to fail initialization if not enough workers
+were initialized.
+---
+ bin/named/server.c          |  9 +++++----
+ lib/dns/dyndb.c             |  4 +++-
+ lib/dns/include/dns/dyndb.h | 22 +++++++++++++---------
+ 3 files changed, 21 insertions(+), 14 deletions(-)
+
+diff --git a/bin/named/server.c b/bin/named/server.c
+index 721464db8e..27e23fd52e 100644
+--- a/bin/named/server.c
++++ b/bin/named/server.c
+@@ -5581,10 +5581,11 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
+ 
+ 		if (dctx == NULL) {
+ 			const void *hashinit = isc_hash_get_initializer();
+-			CHECK(dns_dyndb_createctx(mctx, hashinit, named_g_lctx,
+-						  view, named_g_server->zonemgr,
+-						  named_g_server->task,
+-						  named_g_timermgr, &dctx));
++			CHECK(dns_dyndb_createctx(
++				mctx, hashinit, named_g_lctx, view,
++				named_g_server->zonemgr, named_g_server->task,
++				named_g_timermgr, named_g_hp_extra_workers,
++				&dctx));
+ 		}
+ 
+ 		CHECK(configure_dyndb(dyndb, mctx, dctx));
+diff --git a/lib/dns/dyndb.c b/lib/dns/dyndb.c
+index 1caf90bab7..7d2784c5fa 100644
+--- a/lib/dns/dyndb.c
++++ b/lib/dns/dyndb.c
+@@ -408,7 +408,8 @@ dns_dyndb_cleanup(bool exiting) {
+ isc_result_t
+ dns_dyndb_createctx(isc_mem_t *mctx, const void *hashinit, isc_log_t *lctx,
+ 		    dns_view_t *view, dns_zonemgr_t *zmgr, isc_task_t *task,
+-		    isc_timermgr_t *tmgr, dns_dyndbctx_t **dctxp) {
++		    isc_timermgr_t *tmgr, unsigned int extra_workers,
++		    dns_dyndbctx_t **dctxp) {
+ 	dns_dyndbctx_t *dctx;
+ 
+ 	REQUIRE(dctxp != NULL && *dctxp == NULL);
+@@ -429,6 +430,7 @@ dns_dyndb_createctx(isc_mem_t *mctx, const void *hashinit, isc_log_t *lctx,
+ 	dctx->hashinit = hashinit;
+ 	dctx->lctx = lctx;
+ 	dctx->memdebug = &isc_mem_debugging;
++	dctx->extra_workers = extra_workers;
+ 
+ 	isc_mem_attach(mctx, &dctx->mctx);
+ 	dctx->magic = DNS_DYNDBCTX_MAGIC;
+diff --git a/lib/dns/include/dns/dyndb.h b/lib/dns/include/dns/dyndb.h
+index bda744a8d9..a93947d340 100644
+--- a/lib/dns/include/dns/dyndb.h
++++ b/lib/dns/include/dns/dyndb.h
+@@ -35,14 +35,15 @@ ISC_LANG_BEGINDECLS
+  */
+ struct dns_dyndbctx {
+ 	unsigned int	magic;
+-	const void	   *hashinit;
+-	isc_mem_t	  *mctx;
+-	isc_log_t	  *lctx;
+-	dns_view_t	   *view;
+-	dns_zonemgr_t  *zmgr;
+-	isc_task_t	   *task;
++	const void *	hashinit;
++	isc_mem_t *	mctx;
++	isc_log_t *	lctx;
++	dns_view_t *	view;
++	dns_zonemgr_t * zmgr;
++	isc_task_t *	task;
+ 	isc_timermgr_t *timermgr;
+-	unsigned int   *memdebug;
++	unsigned int *	memdebug;
++	unsigned int	extra_workers;
+ };
+ 
+ #define DNS_DYNDBCTX_MAGIC    ISC_MAGIC('D', 'd', 'b', 'c')
+@@ -58,7 +59,7 @@ struct dns_dyndbctx {
+  */
+ #ifndef DNS_DYNDB_VERSION
+ #define DNS_DYNDB_VERSION 1
+-#define DNS_DYNDB_AGE	  0
++#define DNS_DYNDB_AGE	  1
+ #endif /* ifndef DNS_DYNDB_VERSION */
+ 
+ typedef isc_result_t
+@@ -135,7 +136,8 @@ dns_dyndb_cleanup(bool exiting);
+ isc_result_t
+ dns_dyndb_createctx(isc_mem_t *mctx, const void *hashinit, isc_log_t *lctx,
+ 		    dns_view_t *view, dns_zonemgr_t *zmgr, isc_task_t *task,
+-		    isc_timermgr_t *tmgr, dns_dyndbctx_t **dctxp);
++		    isc_timermgr_t *tmgr, unsigned int extra_workers,
++		    dns_dyndbctx_t **dctxp);
+ /*%
+  * Create a dyndb initialization context structure, with
+  * pointers to structures in the server that the dyndb module will
+@@ -143,6 +145,8 @@ dns_dyndb_createctx(isc_mem_t *mctx, const void *hashinit, isc_log_t *lctx,
+  * etc). This structure is expected to last only until all dyndb
+  * modules have been loaded and initialized; after that it will be
+  * destroyed with dns_dyndb_destroyctx().
++ * extra workers specifies how many extra worker threads can plugin
++ * use to send tasks to named threads by isc_task_send()
+  *
+  * Returns:
+  *\li	#ISC_R_SUCCESS
+-- 
+2.34.1
+
diff --git a/bind-9.16-hp-workers-rh2048235.patch b/bind-9.16-hp-workers-rh2048235.patch
new file mode 100644
index 0000000..019274b
--- /dev/null
+++ b/bind-9.16-hp-workers-rh2048235.patch
@@ -0,0 +1,180 @@
+From 140ae14a4d6374530c9ab19a29c246abbf6d60b8 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
+Date: Fri, 11 Feb 2022 13:29:03 +0100
+Subject: [PATCH] Add extra hp workers parameter
+
+May be needed by dyndb plugins to prepare extra worker threads. If they
+use isc_task_send, their threads need to have initialized enough thread
+identifiers in isc_hp_init. New parameters allow that.
+
+Allows specification of both relative and absolute number of extra
+workers.
+
+Adds new function isc_managers_create2() with extra parameter, call
+original function from many tests and tools unchanged.
+---
+ bin/named/include/named/globals.h |  2 ++
+ bin/named/include/named/main.h    |  2 +-
+ bin/named/main.c                  | 29 +++++++++++++++++++++++++----
+ bin/named/named.rst               |  9 +++++++++
+ lib/isc/include/isc/managers.h    |  5 +++++
+ lib/isc/managers.c                | 11 ++++++++++-
+ 6 files changed, 52 insertions(+), 6 deletions(-)
+
+diff --git a/bin/named/include/named/globals.h b/bin/named/include/named/globals.h
+index 82b632ef04..d46e62b94d 100644
+--- a/bin/named/include/named/globals.h
++++ b/bin/named/include/named/globals.h
+@@ -53,6 +53,8 @@ EXTERN unsigned int named_g_udpdisp	      INIT(0);
+ EXTERN isc_taskmgr_t *named_g_taskmgr	      INIT(NULL);
+ EXTERN dns_dispatchmgr_t *named_g_dispatchmgr INIT(NULL);
+ EXTERN unsigned int named_g_cpus_detected     INIT(1);
++EXTERN unsigned int named_g_hp_extra_workers  INIT(0);
++EXTERN unsigned int named_g_hp_extra_percent  INIT(100);
+ 
+ #ifdef ENABLE_AFL
+ EXTERN bool named_g_run_done INIT(false);
+diff --git a/bin/named/include/named/main.h b/bin/named/include/named/main.h
+index 816aeae7a0..9618251f4d 100644
+--- a/bin/named/include/named/main.h
++++ b/bin/named/include/named/main.h
+@@ -23,7 +23,7 @@
+ /*
+  * Commandline arguments for named; also referenced in win32/ntservice.c
+  */
+-#define NAMED_MAIN_ARGS "46A:c:d:D:E:fFgL:M:m:n:N:p:sS:t:T:U:u:vVx:X:"
++#define NAMED_MAIN_ARGS "46A:c:d:D:E:fFgh:H:L:M:m:n:N:p:sS:t:T:U:u:vVx:X:"
+ 
+ ISC_PLATFORM_NORETURN_PRE void
+ named_main_earlyfatal(const char *format, ...)
+diff --git a/bin/named/main.c b/bin/named/main.c
+index 9ad2d0e277..fbe4c8d011 100644
+--- a/bin/named/main.c
++++ b/bin/named/main.c
+@@ -351,7 +351,8 @@ usage(void) {
+ 			"username] [-U listeners]\n"
+ 			"             [-X lockfile] [-m "
+ 			"{usage|trace|record|size|mctx}]\n"
+-			"             [-M fill|nofill]\n"
++			"             [-M fill|nofill] [-h extra_workers] "
++			"[-H extra_percent]\n"
+ 			"usage: named [-v|-V]\n");
+ }
+ 
+@@ -792,6 +793,21 @@ parse_command_line(int argc, char *argv[]) {
+ 			named_g_foreground = true;
+ 			named_g_logstderr = true;
+ 			break;
++		case 'h':
++			named_g_hp_extra_workers =
++				parse_int(isc_commandline_argument,
++					  "number of extra workers");
++			break;
++		case 'H':
++			named_g_hp_extra_percent =
++				parse_int(isc_commandline_argument,
++					  "percent of extra workers");
++			if (named_g_hp_extra_percent < 100) {
++				named_main_earlyfatal(
++					"percent of extra workers "
++					"cannot be less than 100");
++			}
++			break;
+ 		case 'L':
+ 			named_g_logfile = isc_commandline_argument;
+ 			break;
+@@ -904,6 +920,10 @@ create_managers(void) {
+ 	if (named_g_cpus == 0) {
+ 		named_g_cpus = named_g_cpus_detected;
+ 	}
++	if (named_g_hp_extra_percent > 100) {
++		named_g_hp_extra_workers +=
++			named_g_cpus * (named_g_hp_extra_percent - 100) / 100;
++	}
+ 	isc_log_write(
+ 		named_g_lctx, NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
+ 		ISC_LOG_INFO, "found %u CPU%s, using %u worker thread%s",
+@@ -924,11 +944,12 @@ create_managers(void) {
+ 		      "using %u UDP listener%s per interface", named_g_udpdisp,
+ 		      named_g_udpdisp == 1 ? "" : "s");
+ 
+-	result = isc_managers_create(named_g_mctx, named_g_cpus, 0, &named_g_nm,
+-				     &named_g_taskmgr);
++	result = isc_managers_create2(named_g_mctx, named_g_cpus, 0,
++				      named_g_hp_extra_workers, &named_g_nm,
++				      &named_g_taskmgr);
+ 	if (result != ISC_R_SUCCESS) {
+ 		UNEXPECTED_ERROR(__FILE__, __LINE__,
+-				 "isc_managers_create() failed: %s",
++				 "isc_managers_create2() failed: %s",
+ 				 isc_result_totext(result));
+ 		return (ISC_R_UNEXPECTED);
+ 	}
+diff --git a/bin/named/named.rst b/bin/named/named.rst
+index 39c445f5f9..b5bf95398c 100644
+--- a/bin/named/named.rst
++++ b/bin/named/named.rst
+@@ -75,6 +75,15 @@ Options
+ ``-g``
+    This option runs the server in the foreground and forces all logging to ``stderr``.
+ 
++``-h #workers``
++   This option requests extra worker threads initialized by hazard pointers. Used only for
++   dyndb plugins.
++
++``-H workers%``
++   This option requests extra worker threads initialized by hazard pointers. Value is
++   computed as percent of number of cpus set by ``-n`` parameter. Minimal value is 100%.
++   Used only for dyndb plugins.
++
+ ``-L logfile``
+    This option sets the log to the file ``logfile`` by default, instead of the system log.
+ 
+diff --git a/lib/isc/include/isc/managers.h b/lib/isc/include/isc/managers.h
+index 0ed17ff31d..712ea3e3ed 100644
+--- a/lib/isc/include/isc/managers.h
++++ b/lib/isc/include/isc/managers.h
+@@ -25,5 +25,10 @@ isc_result_t
+ isc_managers_create(isc_mem_t *mctx, size_t workers, size_t quantum,
+ 		    isc_nm_t **netmgrp, isc_taskmgr_t **taskmgrp);
+ 
++isc_result_t
++isc_managers_create2(isc_mem_t *mctx, size_t workers, size_t quantum,
++		     size_t hp_extra, isc_nm_t **netmgrp,
++		     isc_taskmgr_t **taskmgrp);
++
+ void
+ isc_managers_destroy(isc_nm_t **netmgrp, isc_taskmgr_t **taskmgrp);
+diff --git a/lib/isc/managers.c b/lib/isc/managers.c
+index a285e80d8a..daf19c5596 100644
+--- a/lib/isc/managers.c
++++ b/lib/isc/managers.c
+@@ -21,15 +21,24 @@
+ isc_result_t
+ isc_managers_create(isc_mem_t *mctx, size_t workers, size_t quantum,
+ 		    isc_nm_t **netmgrp, isc_taskmgr_t **taskmgrp) {
++	return isc_managers_create2(mctx, workers, quantum, 0, netmgrp,
++				    taskmgrp);
++}
++
++isc_result_t
++isc_managers_create2(isc_mem_t *mctx, size_t workers, size_t quantum,
++		     size_t hp_extra, isc_nm_t **netmgrp,
++		     isc_taskmgr_t **taskmgrp) {
+ 	isc_result_t result;
+ 	isc_taskmgr_t *taskmgr = NULL;
+ 	isc_nm_t *netmgr = NULL;
++	size_t hp_workers = 4 * (workers + hp_extra);
+ 
+ 	/*
+ 	 * We have ncpus network threads, ncpus old network threads - make
+ 	 * it 4x just to be on the safe side.
+ 	 */
+-	isc_hp_init(4 * workers);
++	isc_hp_init(hp_workers);
+ 
+ 	REQUIRE(netmgrp != NULL && *netmgrp == NULL);
+ 	isc__netmgr_create(mctx, workers, &netmgr);
+-- 
+2.34.1
+
diff --git a/bind.spec b/bind.spec
index 2627b6f..574b0fe 100644
--- a/bind.spec
+++ b/bind.spec
@@ -53,7 +53,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.16.25
-Release:  2%{?dist}
+Release:  3%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -104,6 +104,9 @@ Patch157:bind-9.11-fips-tests.patch
 Patch164:bind-9.11-rh1666814.patch
 # https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/5757
 Patch165:bind-9.16-pthread-dlz.patch
+# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/5795
+Patch167:bind-9.16-hp-workers-rh2048235.patch
+Patch168:bind-9.16-hp-workers-rh2048235-dyndb.patch
 
 %{?systemd_ordering}
 Requires:       coreutils
@@ -403,6 +406,8 @@ in HTML and PDF format.
 %patch157 -p1 -b .fips-tests
 %patch164 -p1 -b .rh1666814
 %patch165 -p1 -b .pthread-dlz
+%patch167 -p1 -b .rh2048235
+%patch168 -p1 -b .rh2048235-dyndb
 
 %if %{with PKCS11}
 %patch135 -p1 -b .config-pkcs11
@@ -1125,6 +1130,9 @@ fi;
 %endif
 
 %changelog
+* Fri Feb 11 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.25-3
+- Allow reservation of extra hp threads (#2048235)
+
 * Tue Jan 25 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.25-2
 - Replace master with primary in configuration
 

From 74f70469b14b0a1fa010927c21ba56dcd1052233 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 17 Feb 2022 23:21:17 +0100
Subject: [PATCH 288/460] Update to 9.16.26 (#2055120)

---
 .gitignore                  |  2 ++
 bind-9.16-pthread-dlz.patch | 30 ------------------------------
 bind.spec                   | 10 +++++-----
 sources                     |  4 ++--
 4 files changed, 9 insertions(+), 37 deletions(-)
 delete mode 100644 bind-9.16-pthread-dlz.patch

diff --git a/.gitignore b/.gitignore
index 741f979..de3fb36 100644
--- a/.gitignore
+++ b/.gitignore
@@ -166,3 +166,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.16.24.tar.xz.asc
 /bind-9.16.25.tar.xz
 /bind-9.16.25.tar.xz.asc
+/bind-9.16.26.tar.xz
+/bind-9.16.26.tar.xz.asc
diff --git a/bind-9.16-pthread-dlz.patch b/bind-9.16-pthread-dlz.patch
deleted file mode 100644
index 627d235..0000000
--- a/bind-9.16-pthread-dlz.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-From 5996c73516ad1a21eff008145f4643d9eded2c80 Mon Sep 17 00:00:00 2001
-From: Evan Hunt <each@isc.org>
-Date: Tue, 25 Jan 2022 12:28:48 -0800
-Subject: [PATCH] restore missing lines in dlz_pthread.h
-
-some lines were accidentally deleted during a backport that
-made it imposisble to build DLZ modules.
----
- contrib/dlz/modules/include/dlz_pthread.h | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/contrib/dlz/modules/include/dlz_pthread.h b/contrib/dlz/modules/include/dlz_pthread.h
-index c1b6db637e..4479f836c0 100644
---- a/contrib/dlz/modules/include/dlz_pthread.h
-+++ b/contrib/dlz/modules/include/dlz_pthread.h
-@@ -19,6 +19,11 @@
- #ifndef DLZ_PTHREAD_H
- #define DLZ_PTHREAD_H 1
- 
-+#ifndef PTHREADS
-+#define PTHREADS 1
-+#endif /* ifndef PTHREADS */
-+
-+#ifdef PTHREADS
- #include <pthread.h>
- #define dlz_mutex_t	  pthread_mutex_t
- #define dlz_mutex_init	  pthread_mutex_init
--- 
-2.34.1
-
diff --git a/bind.spec b/bind.spec
index 574b0fe..ef10977 100644
--- a/bind.spec
+++ b/bind.spec
@@ -52,8 +52,8 @@
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.16.25
-Release:  3%{?dist}
+Version:  9.16.26
+Release:  1%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -102,8 +102,6 @@ Patch149:bind-9.11-kyua-pkcs11.patch
 Patch157:bind-9.11-fips-tests.patch
 # https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/2689
 Patch164:bind-9.11-rh1666814.patch
-# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/5757
-Patch165:bind-9.16-pthread-dlz.patch
 # https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/5795
 Patch167:bind-9.16-hp-workers-rh2048235.patch
 Patch168:bind-9.16-hp-workers-rh2048235-dyndb.patch
@@ -405,7 +403,6 @@ in HTML and PDF format.
 %patch130 -p1 -b .libdb
 %patch157 -p1 -b .fips-tests
 %patch164 -p1 -b .rh1666814
-%patch165 -p1 -b .pthread-dlz
 %patch167 -p1 -b .rh2048235
 %patch168 -p1 -b .rh2048235-dyndb
 
@@ -1130,6 +1127,9 @@ fi;
 %endif
 
 %changelog
+* Thu Feb 17 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.26-1
+- Update to 9.16.26 (#2055120)
+
 * Fri Feb 11 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.25-3
 - Allow reservation of extra hp threads (#2048235)
 
diff --git a/sources b/sources
index fcfd18b..e1701b9 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.16.25.tar.xz) = e43c0e59159d3a5642db051f3982d8767fb726426380c32960fefe4b9afd05708ed8f7e80a98b803a580b048e1a368c888e2dd5695fa5fcd7b8b75574a27cb62
-SHA512 (bind-9.16.25.tar.xz.asc) = ceb0af75619f2a2da4f183bb7d367f5a302ee41e140bc710b47aefedc3717b9cd7452f988e480a8798734f532338f3c03252a704e45b9d0a31f46ea499d1d572
+SHA512 (bind-9.16.26.tar.xz) = d75e9e0c0853dbfeb0a1e765c2e39d83393c9be5a48cfccd84e758a0f11cf9d480f892431bbba9f7579dfef82e03987580619878d2a5bb5dc35f5dbb35101dbe
+SHA512 (bind-9.16.26.tar.xz.asc) = 5779ac2330ef93682a83d349b42f0fd3f8b14fb59010f399a60cdee1180ad2911c2ec7204d3e13dc06b1c8397949474be045c6d38b6c5a9599810c6159f0fb91

From b0bc4995fbdf36e9317bed61637754712215a105 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 21 Feb 2022 12:42:48 +0100
Subject: [PATCH 289/460] Remove unused patches

---
 bind-9.11-fips-disable.patch | 65 ------------------------
 bind-9.14-json-c.patch       | 95 ------------------------------------
 2 files changed, 160 deletions(-)
 delete mode 100644 bind-9.11-fips-disable.patch
 delete mode 100644 bind-9.14-json-c.patch

diff --git a/bind-9.11-fips-disable.patch b/bind-9.11-fips-disable.patch
deleted file mode 100644
index c01d914..0000000
--- a/bind-9.11-fips-disable.patch
+++ /dev/null
@@ -1,65 +0,0 @@
-From 2b0dce163a119f5f62eb4428b485f7575f321d6f Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Mon, 5 Aug 2019 11:54:03 +0200
-Subject: [PATCH] Allow explicit disabling of autodisabled MD5
-
-Default security policy might include explicitly disabled RSAMD5
-algorithm. Current FIPS code automatically disables in FIPS mode. But if
-RSAMD5 is included in security policy, it fails to start, because that
-algorithm is not recognized. Allow it disabled, but fail on any
-other usage.
----
- bin/named/server.c | 4 ++--
- lib/bind9/check.c  | 4 ++++
- lib/dns/rcode.c    | 1 +
- 3 files changed, 7 insertions(+), 2 deletions(-)
-
-diff --git a/bin/named/server.c b/bin/named/server.c
-index ee23f10..22a5c01 100644
---- a/bin/named/server.c
-+++ b/bin/named/server.c
-@@ -1689,12 +1689,12 @@ disable_algorithms(const cfg_obj_t *disabled, dns_resolver_t *resolver) {
- 		r.length = strlen(r.base);
- 
- 		result = dns_secalg_fromtext(&alg, &r);
--		if (result != ISC_R_SUCCESS) {
-+		if (result != ISC_R_SUCCESS && result != ISC_R_DISABLED) {
- 			uint8_t ui;
- 			result = isc_parse_uint8(&ui, r.base, 10);
- 			alg = ui;
- 		}
--		if (result != ISC_R_SUCCESS) {
-+		if (result != ISC_R_SUCCESS && result != ISC_R_DISABLED) {
- 			cfg_obj_log(cfg_listelt_value(element), named_g_lctx,
- 				    ISC_LOG_ERROR, "invalid algorithm");
- 			CHECK(result);
-diff --git a/lib/bind9/check.c b/lib/bind9/check.c
-index f49a346..dbf9ddb 100644
---- a/lib/bind9/check.c
-+++ b/lib/bind9/check.c
-@@ -317,6 +317,10 @@ disabled_algorithms(const cfg_obj_t *disabled, isc_log_t *logctx) {
- 		r.length = strlen(r.base);
- 
- 		tresult = dns_secalg_fromtext(&alg, &r);
-+		if (tresult == ISC_R_DISABLED) {
-+			// Recognize disabled algorithms, disable it explicitly
-+			tresult = ISC_R_SUCCESS;
-+		}
- 		if (tresult != ISC_R_SUCCESS) {
- 			cfg_obj_log(cfg_listelt_value(element), logctx,
- 				    ISC_LOG_ERROR, "invalid algorithm '%s'",
-diff --git a/lib/dns/rcode.c b/lib/dns/rcode.c
-index 327248e..78adf63 100644
---- a/lib/dns/rcode.c
-+++ b/lib/dns/rcode.c
-@@ -152,6 +152,7 @@ static struct tbl rcodes[] = { RCODENAMES ERCODENAMES };
- static struct tbl tsigrcodes[] = { RCODENAMES TSIGRCODENAMES };
- static struct tbl certs[] = { CERTNAMES };
- static struct tbl secalgs[] = { SECALGNAMES };
-+static struct tbl md5_secalgs[] = { MD5_SECALGNAMES };
- static struct tbl secprotos[] = { SECPROTONAMES };
- static struct tbl hashalgs[] = { HASHALGNAMES };
- static struct tbl dsdigests[] = { DSDIGESTNAMES };
--- 
-2.21.1
-
diff --git a/bind-9.14-json-c.patch b/bind-9.14-json-c.patch
deleted file mode 100644
index 870b46b..0000000
--- a/bind-9.14-json-c.patch
+++ /dev/null
@@ -1,95 +0,0 @@
-From 0698eb93f6e618d2882ae2c8758c5fa87524bea6 Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Tue, 23 Jul 2019 12:10:39 +0200
-Subject: [PATCH] Allow explicitly using json-c but not libjson
-
-Separate detection of json support. Allows explicit use of json-c when
-jsoncpp package is found. Have to use --without-libjson --with-json-c.
----
- configure.ac | 52 +++++++++++++++++++++++++++++++++++++++++-----------
- 1 file changed, 41 insertions(+), 11 deletions(-)
-
-diff --git a/configure.ac b/configure.ac
-index f7978e4..40b4f9f 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -1331,7 +1331,6 @@ AC_ARG_WITH(libjson,
- 	    use_libjson="$withval", use_libjson="auto")
- 
- have_libjson=""
--have_libjson_c=""
- case "$use_libjson" in
- 	no)
- 		libjson_libs=""
-@@ -1347,7 +1346,43 @@ case "$use_libjson" in
- 					LIBS="$LIBS -L${d}/lib"
- 				fi
- 				have_libjson="yes"
--			elif test -f "${d}/include/json-c/json.h"
-+			fi
-+		done
-+		;;
-+	*)
-+		if test -f "${use_libjson}/include/json/json.h"
-+		then
-+			libjson_cflags="-I${use_libjson}/include"
-+			LIBS="$LIBS -L${use_libjson}/lib"
-+			have_libjson="yes"
-+		else
-+			AC_MSG_ERROR([$use_libjson/include/json/json.h not found.])
-+		fi
-+		;;
-+esac
-+
-+#
-+# was --with-json-c specified?
-+#
-+AC_ARG_WITH(json-c,
-+	    AS_HELP_STRING([--with-json-c[=PATH]],
-+			   [build with json-c library [yes|no|path]]),
-+	    use_json_c="$withval", use_json_c="$use_libjson")
-+
-+if test "X${have_libjson}" != "X"
-+then
-+	# Do not use if libjson were found
-+	use_json_c=no
-+fi
-+
-+have_libjson_c=""
-+case "$use_json_c" in
-+	no)
-+		;;
-+	auto|yes)
-+		for d in /usr /usr/local /opt/local
-+		do
-+			if test -f "${d}/include/json-c/json.h"
- 			then
- 				if test ${d} != /usr
- 				then
-@@ -1360,19 +1395,14 @@ case "$use_libjson" in
- 		done
- 		;;
- 	*)
--		if test -f "${use_libjson}/include/json/json.h"
--		then
--			libjson_cflags="-I${use_libjson}/include"
--			LIBS="$LIBS -L${use_libjson}/lib"
--			have_libjson="yes"
--		elif test -f "${use_libjson}/include/json-c/json.h"
-+		if test -f "${use_json_c}/include/json-c/json.h"
- 		then
--			libjson_cflags="-I${use_libjson}/include"
--			LIBS="$LIBS -L${use_libjson}/lib"
-+			libjson_cflags="-I${use_json_c}/include"
-+			LIBS="$LIBS -L${use_json_c}/lib"
- 			have_libjson="yes"
- 			have_libjson_c="yes"
- 		else
--			AC_MSG_ERROR([$use_libjson/include/json{,-c}/json.h not found.])
-+			AC_MSG_ERROR([$use_json_c/include/json-c/json.h not found.])
- 		fi
- 		;;
- esac
--- 
-2.20.1
-

From 24d1ecd259cfcf686660cada39b537a5bc4e47da Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 1 Dec 2021 19:17:24 +0100
Subject: [PATCH 290/460] Switch to %autosetup

Renumber high numbered patches to two digits patch. It does not really
matter for autosetup. Simplify applying of new patches.
---
 bind.spec | 44 ++++++++++++++++----------------------------
 1 file changed, 16 insertions(+), 28 deletions(-)

diff --git a/bind.spec b/bind.spec
index ef10977..2aa155c 100644
--- a/bind.spec
+++ b/bind.spec
@@ -88,23 +88,24 @@ Source49: named-chroot.files
 # Common patches
 Patch10: bind-9.5-PIE.patch
 Patch16: bind-9.16-redhat_doc.patch
-Patch72: bind-9.5-dlz-64bit.patch
-Patch106:bind93-rh490837.patch
-Patch112:bind97-rh645544.patch
-Patch130:bind-9.9.1-P2-dlz-libdb.patch
+Patch20: bind-9.5-dlz-64bit.patch
+# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/5601
+Patch21: bind93-rh490837.patch
+Patch22: bind-9.11-fips-tests.patch
+Patch23: bind97-rh645544.patch
+Patch24: bind-9.9.1-P2-dlz-libdb.patch
 # Make PKCS11 used only for pkcs11 parts
-Patch135:bind-9.14-config-pkcs11.patch
+Patch70: bind-9.14-config-pkcs11.patch
 # Fedora specific patch to distribute native-pkcs#11 functionality
-Patch136:bind-9.10-dist-native-pkcs11.patch
+Patch71: bind-9.10-dist-native-pkcs11.patch
 # Do not use isc-pkcs11.
-Patch149:bind-9.11-kyua-pkcs11.patch
+Patch72: bind-9.11-kyua-pkcs11.patch
 
-Patch157:bind-9.11-fips-tests.patch
 # https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/2689
-Patch164:bind-9.11-rh1666814.patch
+Patch25:bind-9.11-rh1666814.patch
 # https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/5795
-Patch167:bind-9.16-hp-workers-rh2048235.patch
-Patch168:bind-9.16-hp-workers-rh2048235-dyndb.patch
+Patch26:bind-9.16-hp-workers-rh2048235.patch
+Patch27:bind-9.16-hp-workers-rh2048235-dyndb.patch
 
 %{?systemd_ordering}
 Requires:       coreutils
@@ -392,28 +393,15 @@ in HTML and PDF format.
 # RHEL does not yet support this verification
 %{gpgverify} --keyring='%{SOURCE4}' --signature='%{SOURCE2}' --data='%{SOURCE0}'
 %endif
-%setup -q
-
-# Common patches
-%patch10 -p1 -b .PIE
-%patch16 -p1 -b .redhat_doc
-%patch72 -p1 -b .64bit
-%patch106 -p1 -b .rh490837
-%patch112 -p1 -b .rh645544
-%patch130 -p1 -b .libdb
-%patch157 -p1 -b .fips-tests
-%patch164 -p1 -b .rh1666814
-%patch167 -p1 -b .rh2048235
-%patch168 -p1 -b .rh2048235-dyndb
-
+%autosetup -n %{name}-%{version} -p1 -N
+%autopatch -p1 -M 69
 %if %{with PKCS11}
-%patch135 -p1 -b .config-pkcs11
+%autopatch -m 70 -M 70
 cp -r bin/named{,-pkcs11}
 cp -r bin/dnssec{,-pkcs11}
 cp -r lib/dns{,-pkcs11}
 cp -r lib/ns{,-pkcs11}
-%patch136 -p1 -b .dist_pkcs11
-%patch149 -p1 -b .kyua-pkcs11
+%autopatch -m 71
 %endif
 
 # Sparc and s390 arches need to use -fPIE

From cc49e08ee993d70f7a3cc719b9a2a7fbaac22340 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 21 Feb 2022 14:27:06 +0100
Subject: [PATCH 291/460] Renumber native PKCS11 patches to beginning

Allow all subsequent patches with higher number to be added to normal
common list of patches. Make just initial patches special.

Ensure all patch chunks use -p1 prefix.
---
 bind.spec | 25 +++++++++++++------------
 1 file changed, 13 insertions(+), 12 deletions(-)

diff --git a/bind.spec b/bind.spec
index 2aa155c..f2d4650 100644
--- a/bind.spec
+++ b/bind.spec
@@ -85,21 +85,22 @@ Source47: named-pkcs11.service
 Source48: setup-named-softhsm.sh
 Source49: named-chroot.files
 
+# Make PKCS11 used only for pkcs11 parts
+Patch1:  bind-9.14-config-pkcs11.patch
+# Fedora specific patch to distribute native-pkcs#11 functionality
+Patch2:  bind-9.10-dist-native-pkcs11.patch
+# Do not use isc-pkcs11.
+Patch3:  bind-9.11-kyua-pkcs11.patch
+
 # Common patches
-Patch10: bind-9.5-PIE.patch
-Patch16: bind-9.16-redhat_doc.patch
+Patch18: bind-9.5-PIE.patch
+Patch19: bind-9.16-redhat_doc.patch
 Patch20: bind-9.5-dlz-64bit.patch
 # https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/5601
 Patch21: bind93-rh490837.patch
 Patch22: bind-9.11-fips-tests.patch
 Patch23: bind97-rh645544.patch
 Patch24: bind-9.9.1-P2-dlz-libdb.patch
-# Make PKCS11 used only for pkcs11 parts
-Patch70: bind-9.14-config-pkcs11.patch
-# Fedora specific patch to distribute native-pkcs#11 functionality
-Patch71: bind-9.10-dist-native-pkcs11.patch
-# Do not use isc-pkcs11.
-Patch72: bind-9.11-kyua-pkcs11.patch
 
 # https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/2689
 Patch25:bind-9.11-rh1666814.patch
@@ -393,15 +394,15 @@ in HTML and PDF format.
 # RHEL does not yet support this verification
 %{gpgverify} --keyring='%{SOURCE4}' --signature='%{SOURCE2}' --data='%{SOURCE0}'
 %endif
-%autosetup -n %{name}-%{version} -p1 -N
-%autopatch -p1 -M 69
+%autosetup -n %{name}-%{version} -N
+%autopatch -p1 -m 18
 %if %{with PKCS11}
-%autopatch -m 70 -M 70
+%autopatch -p1 -m 1 -M 1
 cp -r bin/named{,-pkcs11}
 cp -r bin/dnssec{,-pkcs11}
 cp -r lib/dns{,-pkcs11}
 cp -r lib/ns{,-pkcs11}
-%autopatch -m 71
+%autopatch -p1 -m 2 -M 17
 %endif
 
 # Sparc and s390 arches need to use -fPIE

From 36d2b494694781e07bdb66e7ff1e118c28688403 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 1 Dec 2021 19:12:21 +0100
Subject: [PATCH 292/460] Remove lame server errors hiding patch

Those errors can be dropped by simple configuration:

logging {
category lame_servers { null; };
};

Do not hide them into debug log on all servers. Expect lame servers are
not so common to drop it always.
---
 bind.spec             |  1 -
 bind97-rh645544.patch | 31 -------------------------------
 2 files changed, 32 deletions(-)
 delete mode 100644 bind97-rh645544.patch

diff --git a/bind.spec b/bind.spec
index f2d4650..105cc5d 100644
--- a/bind.spec
+++ b/bind.spec
@@ -99,7 +99,6 @@ Patch20: bind-9.5-dlz-64bit.patch
 # https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/5601
 Patch21: bind93-rh490837.patch
 Patch22: bind-9.11-fips-tests.patch
-Patch23: bind97-rh645544.patch
 Patch24: bind-9.9.1-P2-dlz-libdb.patch
 
 # https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/2689
diff --git a/bind97-rh645544.patch b/bind97-rh645544.patch
deleted file mode 100644
index e2ae978..0000000
--- a/bind97-rh645544.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
-index 31549c6..65a14b6 100644
---- a/lib/dns/resolver.c
-+++ b/lib/dns/resolver.c
-@@ -1762,7 +1762,7 @@ log_edns(fetchctx_t *fctx) {
- 	 */
- 	dns_name_format(&fctx->domain, domainbuf, sizeof(domainbuf));
- 	isc_log_write(dns_lctx, DNS_LOGCATEGORY_EDNS_DISABLED,
--		      DNS_LOGMODULE_RESOLVER, ISC_LOG_INFO,
-+		      DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(1),
- 		      "success resolving '%s' (in '%s'?) after %s", fctx->info,
- 		      domainbuf, fctx->reason);
- }
-@@ -5298,7 +5298,7 @@ log_lame(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo) {
- 	dns_name_format(&fctx->domain, domainbuf, sizeof(domainbuf));
- 	isc_sockaddr_format(&addrinfo->sockaddr, addrbuf, sizeof(addrbuf));
- 	isc_log_write(dns_lctx, DNS_LOGCATEGORY_LAME_SERVERS,
--		      DNS_LOGMODULE_RESOLVER, ISC_LOG_INFO,
-+		      DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(1),
- 		      "lame server resolving '%s' (in '%s'?): %s", namebuf,
- 		      domainbuf, addrbuf);
- }
-@@ -5316,7 +5316,7 @@ log_formerr(fetchctx_t *fctx, const char *format, ...) {
- 	isc_sockaddr_format(&fctx->addrinfo->sockaddr, nsbuf, sizeof(nsbuf));
- 
- 	isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
--		      DNS_LOGMODULE_RESOLVER, ISC_LOG_NOTICE,
-+		      DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(1),
- 		      "DNS format error from %s resolving %s for %s: %s", nsbuf,
- 		      fctx->info, fctx->clientstr, msgbuf);
- }

From ee4347d7db9f66bff11d7a47d2c1dab5809b6509 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 1 Mar 2022 16:43:39 +0100
Subject: [PATCH 293/460] Replace downstream change with upstream proposal

bind-dyndb-ldap requires sending from custom spawned thread to main
named threads. Change queue type to locked variant, which would not
crash when isc_send_task() is called from dyndb worker thread.

Related: rhbz#2048235
---
 bind-9.16-hp-workers-rh2048235-dyndb.patch | 116 -----------
 bind-9.16-hp-workers-rh2048235.patch       | 180 -----------------
 bind-9.16-locked-isc-queue.patch           | 214 +++++++++++++++++++++
 bind.spec                                  |  11 +-
 4 files changed, 221 insertions(+), 300 deletions(-)
 delete mode 100644 bind-9.16-hp-workers-rh2048235-dyndb.patch
 delete mode 100644 bind-9.16-hp-workers-rh2048235.patch
 create mode 100644 bind-9.16-locked-isc-queue.patch

diff --git a/bind-9.16-hp-workers-rh2048235-dyndb.patch b/bind-9.16-hp-workers-rh2048235-dyndb.patch
deleted file mode 100644
index 12ae5ad..0000000
--- a/bind-9.16-hp-workers-rh2048235-dyndb.patch
+++ /dev/null
@@ -1,116 +0,0 @@
-From b6320643194a3b435f2a6ae4569ace19db6ac795 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Fri, 11 Feb 2022 14:19:10 +0100
-Subject: [PATCH] Propagate extra hp threads to dyndb plugins
-
-Plugin may require extra threads for processing its own source data. If
-that plugin needs to call isc_task_send() from those threads, it needs
-extra hp threads initialized. Allow plugin to read how many such threads
-it can use. Allows plugin to fail initialization if not enough workers
-were initialized.
----
- bin/named/server.c          |  9 +++++----
- lib/dns/dyndb.c             |  4 +++-
- lib/dns/include/dns/dyndb.h | 22 +++++++++++++---------
- 3 files changed, 21 insertions(+), 14 deletions(-)
-
-diff --git a/bin/named/server.c b/bin/named/server.c
-index 721464db8e..27e23fd52e 100644
---- a/bin/named/server.c
-+++ b/bin/named/server.c
-@@ -5581,10 +5581,11 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
- 
- 		if (dctx == NULL) {
- 			const void *hashinit = isc_hash_get_initializer();
--			CHECK(dns_dyndb_createctx(mctx, hashinit, named_g_lctx,
--						  view, named_g_server->zonemgr,
--						  named_g_server->task,
--						  named_g_timermgr, &dctx));
-+			CHECK(dns_dyndb_createctx(
-+				mctx, hashinit, named_g_lctx, view,
-+				named_g_server->zonemgr, named_g_server->task,
-+				named_g_timermgr, named_g_hp_extra_workers,
-+				&dctx));
- 		}
- 
- 		CHECK(configure_dyndb(dyndb, mctx, dctx));
-diff --git a/lib/dns/dyndb.c b/lib/dns/dyndb.c
-index 1caf90bab7..7d2784c5fa 100644
---- a/lib/dns/dyndb.c
-+++ b/lib/dns/dyndb.c
-@@ -408,7 +408,8 @@ dns_dyndb_cleanup(bool exiting) {
- isc_result_t
- dns_dyndb_createctx(isc_mem_t *mctx, const void *hashinit, isc_log_t *lctx,
- 		    dns_view_t *view, dns_zonemgr_t *zmgr, isc_task_t *task,
--		    isc_timermgr_t *tmgr, dns_dyndbctx_t **dctxp) {
-+		    isc_timermgr_t *tmgr, unsigned int extra_workers,
-+		    dns_dyndbctx_t **dctxp) {
- 	dns_dyndbctx_t *dctx;
- 
- 	REQUIRE(dctxp != NULL && *dctxp == NULL);
-@@ -429,6 +430,7 @@ dns_dyndb_createctx(isc_mem_t *mctx, const void *hashinit, isc_log_t *lctx,
- 	dctx->hashinit = hashinit;
- 	dctx->lctx = lctx;
- 	dctx->memdebug = &isc_mem_debugging;
-+	dctx->extra_workers = extra_workers;
- 
- 	isc_mem_attach(mctx, &dctx->mctx);
- 	dctx->magic = DNS_DYNDBCTX_MAGIC;
-diff --git a/lib/dns/include/dns/dyndb.h b/lib/dns/include/dns/dyndb.h
-index bda744a8d9..a93947d340 100644
---- a/lib/dns/include/dns/dyndb.h
-+++ b/lib/dns/include/dns/dyndb.h
-@@ -35,14 +35,15 @@ ISC_LANG_BEGINDECLS
-  */
- struct dns_dyndbctx {
- 	unsigned int	magic;
--	const void	   *hashinit;
--	isc_mem_t	  *mctx;
--	isc_log_t	  *lctx;
--	dns_view_t	   *view;
--	dns_zonemgr_t  *zmgr;
--	isc_task_t	   *task;
-+	const void *	hashinit;
-+	isc_mem_t *	mctx;
-+	isc_log_t *	lctx;
-+	dns_view_t *	view;
-+	dns_zonemgr_t * zmgr;
-+	isc_task_t *	task;
- 	isc_timermgr_t *timermgr;
--	unsigned int   *memdebug;
-+	unsigned int *	memdebug;
-+	unsigned int	extra_workers;
- };
- 
- #define DNS_DYNDBCTX_MAGIC    ISC_MAGIC('D', 'd', 'b', 'c')
-@@ -58,7 +59,7 @@ struct dns_dyndbctx {
-  */
- #ifndef DNS_DYNDB_VERSION
- #define DNS_DYNDB_VERSION 1
--#define DNS_DYNDB_AGE	  0
-+#define DNS_DYNDB_AGE	  1
- #endif /* ifndef DNS_DYNDB_VERSION */
- 
- typedef isc_result_t
-@@ -135,7 +136,8 @@ dns_dyndb_cleanup(bool exiting);
- isc_result_t
- dns_dyndb_createctx(isc_mem_t *mctx, const void *hashinit, isc_log_t *lctx,
- 		    dns_view_t *view, dns_zonemgr_t *zmgr, isc_task_t *task,
--		    isc_timermgr_t *tmgr, dns_dyndbctx_t **dctxp);
-+		    isc_timermgr_t *tmgr, unsigned int extra_workers,
-+		    dns_dyndbctx_t **dctxp);
- /*%
-  * Create a dyndb initialization context structure, with
-  * pointers to structures in the server that the dyndb module will
-@@ -143,6 +145,8 @@ dns_dyndb_createctx(isc_mem_t *mctx, const void *hashinit, isc_log_t *lctx,
-  * etc). This structure is expected to last only until all dyndb
-  * modules have been loaded and initialized; after that it will be
-  * destroyed with dns_dyndb_destroyctx().
-+ * extra workers specifies how many extra worker threads can plugin
-+ * use to send tasks to named threads by isc_task_send()
-  *
-  * Returns:
-  *\li	#ISC_R_SUCCESS
--- 
-2.34.1
-
diff --git a/bind-9.16-hp-workers-rh2048235.patch b/bind-9.16-hp-workers-rh2048235.patch
deleted file mode 100644
index 019274b..0000000
--- a/bind-9.16-hp-workers-rh2048235.patch
+++ /dev/null
@@ -1,180 +0,0 @@
-From 140ae14a4d6374530c9ab19a29c246abbf6d60b8 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Fri, 11 Feb 2022 13:29:03 +0100
-Subject: [PATCH] Add extra hp workers parameter
-
-May be needed by dyndb plugins to prepare extra worker threads. If they
-use isc_task_send, their threads need to have initialized enough thread
-identifiers in isc_hp_init. New parameters allow that.
-
-Allows specification of both relative and absolute number of extra
-workers.
-
-Adds new function isc_managers_create2() with extra parameter, call
-original function from many tests and tools unchanged.
----
- bin/named/include/named/globals.h |  2 ++
- bin/named/include/named/main.h    |  2 +-
- bin/named/main.c                  | 29 +++++++++++++++++++++++++----
- bin/named/named.rst               |  9 +++++++++
- lib/isc/include/isc/managers.h    |  5 +++++
- lib/isc/managers.c                | 11 ++++++++++-
- 6 files changed, 52 insertions(+), 6 deletions(-)
-
-diff --git a/bin/named/include/named/globals.h b/bin/named/include/named/globals.h
-index 82b632ef04..d46e62b94d 100644
---- a/bin/named/include/named/globals.h
-+++ b/bin/named/include/named/globals.h
-@@ -53,6 +53,8 @@ EXTERN unsigned int named_g_udpdisp	      INIT(0);
- EXTERN isc_taskmgr_t *named_g_taskmgr	      INIT(NULL);
- EXTERN dns_dispatchmgr_t *named_g_dispatchmgr INIT(NULL);
- EXTERN unsigned int named_g_cpus_detected     INIT(1);
-+EXTERN unsigned int named_g_hp_extra_workers  INIT(0);
-+EXTERN unsigned int named_g_hp_extra_percent  INIT(100);
- 
- #ifdef ENABLE_AFL
- EXTERN bool named_g_run_done INIT(false);
-diff --git a/bin/named/include/named/main.h b/bin/named/include/named/main.h
-index 816aeae7a0..9618251f4d 100644
---- a/bin/named/include/named/main.h
-+++ b/bin/named/include/named/main.h
-@@ -23,7 +23,7 @@
- /*
-  * Commandline arguments for named; also referenced in win32/ntservice.c
-  */
--#define NAMED_MAIN_ARGS "46A:c:d:D:E:fFgL:M:m:n:N:p:sS:t:T:U:u:vVx:X:"
-+#define NAMED_MAIN_ARGS "46A:c:d:D:E:fFgh:H:L:M:m:n:N:p:sS:t:T:U:u:vVx:X:"
- 
- ISC_PLATFORM_NORETURN_PRE void
- named_main_earlyfatal(const char *format, ...)
-diff --git a/bin/named/main.c b/bin/named/main.c
-index 9ad2d0e277..fbe4c8d011 100644
---- a/bin/named/main.c
-+++ b/bin/named/main.c
-@@ -351,7 +351,8 @@ usage(void) {
- 			"username] [-U listeners]\n"
- 			"             [-X lockfile] [-m "
- 			"{usage|trace|record|size|mctx}]\n"
--			"             [-M fill|nofill]\n"
-+			"             [-M fill|nofill] [-h extra_workers] "
-+			"[-H extra_percent]\n"
- 			"usage: named [-v|-V]\n");
- }
- 
-@@ -792,6 +793,21 @@ parse_command_line(int argc, char *argv[]) {
- 			named_g_foreground = true;
- 			named_g_logstderr = true;
- 			break;
-+		case 'h':
-+			named_g_hp_extra_workers =
-+				parse_int(isc_commandline_argument,
-+					  "number of extra workers");
-+			break;
-+		case 'H':
-+			named_g_hp_extra_percent =
-+				parse_int(isc_commandline_argument,
-+					  "percent of extra workers");
-+			if (named_g_hp_extra_percent < 100) {
-+				named_main_earlyfatal(
-+					"percent of extra workers "
-+					"cannot be less than 100");
-+			}
-+			break;
- 		case 'L':
- 			named_g_logfile = isc_commandline_argument;
- 			break;
-@@ -904,6 +920,10 @@ create_managers(void) {
- 	if (named_g_cpus == 0) {
- 		named_g_cpus = named_g_cpus_detected;
- 	}
-+	if (named_g_hp_extra_percent > 100) {
-+		named_g_hp_extra_workers +=
-+			named_g_cpus * (named_g_hp_extra_percent - 100) / 100;
-+	}
- 	isc_log_write(
- 		named_g_lctx, NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
- 		ISC_LOG_INFO, "found %u CPU%s, using %u worker thread%s",
-@@ -924,11 +944,12 @@ create_managers(void) {
- 		      "using %u UDP listener%s per interface", named_g_udpdisp,
- 		      named_g_udpdisp == 1 ? "" : "s");
- 
--	result = isc_managers_create(named_g_mctx, named_g_cpus, 0, &named_g_nm,
--				     &named_g_taskmgr);
-+	result = isc_managers_create2(named_g_mctx, named_g_cpus, 0,
-+				      named_g_hp_extra_workers, &named_g_nm,
-+				      &named_g_taskmgr);
- 	if (result != ISC_R_SUCCESS) {
- 		UNEXPECTED_ERROR(__FILE__, __LINE__,
--				 "isc_managers_create() failed: %s",
-+				 "isc_managers_create2() failed: %s",
- 				 isc_result_totext(result));
- 		return (ISC_R_UNEXPECTED);
- 	}
-diff --git a/bin/named/named.rst b/bin/named/named.rst
-index 39c445f5f9..b5bf95398c 100644
---- a/bin/named/named.rst
-+++ b/bin/named/named.rst
-@@ -75,6 +75,15 @@ Options
- ``-g``
-    This option runs the server in the foreground and forces all logging to ``stderr``.
- 
-+``-h #workers``
-+   This option requests extra worker threads initialized by hazard pointers. Used only for
-+   dyndb plugins.
-+
-+``-H workers%``
-+   This option requests extra worker threads initialized by hazard pointers. Value is
-+   computed as percent of number of cpus set by ``-n`` parameter. Minimal value is 100%.
-+   Used only for dyndb plugins.
-+
- ``-L logfile``
-    This option sets the log to the file ``logfile`` by default, instead of the system log.
- 
-diff --git a/lib/isc/include/isc/managers.h b/lib/isc/include/isc/managers.h
-index 0ed17ff31d..712ea3e3ed 100644
---- a/lib/isc/include/isc/managers.h
-+++ b/lib/isc/include/isc/managers.h
-@@ -25,5 +25,10 @@ isc_result_t
- isc_managers_create(isc_mem_t *mctx, size_t workers, size_t quantum,
- 		    isc_nm_t **netmgrp, isc_taskmgr_t **taskmgrp);
- 
-+isc_result_t
-+isc_managers_create2(isc_mem_t *mctx, size_t workers, size_t quantum,
-+		     size_t hp_extra, isc_nm_t **netmgrp,
-+		     isc_taskmgr_t **taskmgrp);
-+
- void
- isc_managers_destroy(isc_nm_t **netmgrp, isc_taskmgr_t **taskmgrp);
-diff --git a/lib/isc/managers.c b/lib/isc/managers.c
-index a285e80d8a..daf19c5596 100644
---- a/lib/isc/managers.c
-+++ b/lib/isc/managers.c
-@@ -21,15 +21,24 @@
- isc_result_t
- isc_managers_create(isc_mem_t *mctx, size_t workers, size_t quantum,
- 		    isc_nm_t **netmgrp, isc_taskmgr_t **taskmgrp) {
-+	return isc_managers_create2(mctx, workers, quantum, 0, netmgrp,
-+				    taskmgrp);
-+}
-+
-+isc_result_t
-+isc_managers_create2(isc_mem_t *mctx, size_t workers, size_t quantum,
-+		     size_t hp_extra, isc_nm_t **netmgrp,
-+		     isc_taskmgr_t **taskmgrp) {
- 	isc_result_t result;
- 	isc_taskmgr_t *taskmgr = NULL;
- 	isc_nm_t *netmgr = NULL;
-+	size_t hp_workers = 4 * (workers + hp_extra);
- 
- 	/*
- 	 * We have ncpus network threads, ncpus old network threads - make
- 	 * it 4x just to be on the safe side.
- 	 */
--	isc_hp_init(4 * workers);
-+	isc_hp_init(hp_workers);
- 
- 	REQUIRE(netmgrp != NULL && *netmgrp == NULL);
- 	isc__netmgr_create(mctx, workers, &netmgr);
--- 
-2.34.1
-
diff --git a/bind-9.16-locked-isc-queue.patch b/bind-9.16-locked-isc-queue.patch
new file mode 100644
index 0000000..816d960
--- /dev/null
+++ b/bind-9.16-locked-isc-queue.patch
@@ -0,0 +1,214 @@
+From 0df59049fe13ef89d362fa7f109f289b297441dc Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
+Date: Tue, 22 Feb 2022 23:40:39 +0100
+Subject: [PATCH] Provide alternative isc_queue implementation based on locked
+ list
+
+The current implementation of isc_queue uses Michael-Scott lock-free
+queue that in turn uses hazard pointers.  It was discovered that the way
+we use the isc_queue, such complicated mechanism isn't really needed,
+because most of the time, we either execute the work directly when on
+nmthread (in case of UDP) or schedule the work from the matching
+nmthreads.
+
+Provide alternative implementation for the isc_queue based on locked
+ISC_LIST.
+PatchNumber: 11
+PatchNumber: 11
+---
+ bin/named/main.c            |   1 -
+ configure.ac                |  12 ++++
+ lib/isc/include/isc/queue.h |   3 +-
+ lib/isc/queue.c             | 121 ++++++++++++++++++++++++++++++++++++
+ 4 files changed, 134 insertions(+), 3 deletions(-)
+
+diff --git a/bin/named/main.c b/bin/named/main.c
+index 9ad2d0e..8870933 100644
+--- a/bin/named/main.c
++++ b/bin/named/main.c
+@@ -34,7 +34,6 @@
+ #include <isc/dir.h>
+ #include <isc/file.h>
+ #include <isc/hash.h>
+-#include <isc/hp.h>
+ #include <isc/httpd.h>
+ #include <isc/managers.h>
+ #include <isc/netmgr.h>
+diff --git a/configure.ac b/configure.ac
+index 79d33d1..26241a0 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -2263,8 +2263,20 @@ AS_CASE([$with_cmocka],
+ AC_SUBST([CMOCKA_CFLAGS])
+ AC_SUBST([CMOCKA_LIBS])
+ 
++#
++# Use lock-free Michael-Scott's queue implementation or locked-list queue
++#
++# [pairwise: --enable-lock-free-queue, --disable-lock-free-queue]
++AC_ARG_ENABLE([lock-free-queue],
++	    [AS_HELP_STRING([--enable-lock-free-queue],[enable lock-free queue implementation (default is enabled)])],
++	    [],[enable_lock_free_queue=yes])
++AS_CASE([$enable_lock_free_queue],
++	[no],[],
++	[yes],[AC_DEFINE([USE_LOCK_FREE_QUEUE],[1],[Define to 1 to enable lock-free queue])])
++
+ AC_DEFINE([SKIPPED_TEST_EXIT_CODE], [0], [Exit code for skipped tests])
+ 
++
+ #
+ # Check for kyua execution engine if CMocka was requested
+ # and bail out if execution engine was not found
+diff --git a/lib/isc/include/isc/queue.h b/lib/isc/include/isc/queue.h
+index 0927075..568bf18 100644
+--- a/lib/isc/include/isc/queue.h
++++ b/lib/isc/include/isc/queue.h
+@@ -39,8 +39,7 @@ uintptr_t
+ isc_queue_dequeue(isc_queue_t *queue);
+ /*%<
+  * Remove an object pointer from the head of the queue and return the
+- * pointer. If the queue is empty, return `nulluintptr` (the uintptr_t
+- * representation of NULL).
++ * pointer. If the queue is empty, return `NULL`.
+  *
+  * Requires:
+  * \li	'queue' is not null.
+diff --git a/lib/isc/queue.c b/lib/isc/queue.c
+index d7ea824..c4cb404 100644
+--- a/lib/isc/queue.c
++++ b/lib/isc/queue.c
+@@ -28,6 +28,10 @@
+ 
+ static uintptr_t nulluintptr = (uintptr_t)NULL;
+ 
++#if USE_LOCK_FREE_QUEUE
++
++#define BUFFER_SIZE 1024
++
+ typedef struct node {
+ 	atomic_uint_fast32_t deqidx;
+ 	atomic_uintptr_t items[BUFFER_SIZE];
+@@ -232,3 +236,120 @@ isc_queue_destroy(isc_queue_t *queue) {
+ 	alloced = queue->alloced_ptr;
+ 	isc_mem_putanddetach(&queue->mctx, alloced, sizeof(*queue) + ALIGNMENT);
+ }
++
++#else /* USE_LOCK_FREE_QUEUE */
++
++typedef struct node node_t;
++
++struct node {
++	uintptr_t item;
++	ISC_LINK(node_t) link;
++};
++
++struct isc_queue {
++	isc_mem_t *mctx;
++	isc_mutex_t lock;
++	int max_threads;
++	ISC_LIST(node_t) nodes;
++	void *alloced_ptr;
++};
++
++static node_t *
++node_new(isc_mem_t *mctx, uintptr_t item) {
++	node_t *node = isc_mem_get(mctx, sizeof(*node));
++	*node = (node_t){
++		.item = item,
++	};
++
++	ISC_LINK_INIT(node, link);
++
++	return (node);
++}
++
++static void
++node_destroy(isc_mem_t *mctx, node_t *node) {
++	isc_mem_put(mctx, node, sizeof(*node));
++}
++
++isc_queue_t *
++isc_queue_new(isc_mem_t *mctx, int max_threads) {
++	isc_queue_t *queue = NULL;
++	void *qbuf = NULL;
++	uintptr_t qptr;
++
++	qbuf = isc_mem_get(mctx, sizeof(*queue) + ALIGNMENT);
++	qptr = (uintptr_t)qbuf;
++	queue = (isc_queue_t *)(qptr + (ALIGNMENT - (qptr % ALIGNMENT)));
++
++	if (max_threads == 0) {
++		max_threads = MAX_THREADS;
++	}
++
++	*queue = (isc_queue_t){
++		.max_threads = max_threads,
++		.alloced_ptr = qbuf,
++	};
++
++	ISC_LIST_INIT(queue->nodes);
++
++	isc_mutex_init(&queue->lock);
++	isc_mem_attach(mctx, &queue->mctx);
++
++	return (queue);
++}
++
++void
++isc_queue_enqueue(isc_queue_t *queue, uintptr_t item) {
++	node_t *node = node_new(queue->mctx, item);
++	REQUIRE(item != nulluintptr);
++
++	LOCK(&queue->lock);
++	ISC_LIST_ENQUEUE(queue->nodes, node, link);
++	UNLOCK(&queue->lock);
++}
++
++uintptr_t
++isc_queue_dequeue(isc_queue_t *queue) {
++	node_t *node = NULL;
++	uintptr_t item = nulluintptr;
++	REQUIRE(queue != NULL);
++
++	LOCK(&queue->lock);
++	node = ISC_LIST_HEAD(queue->nodes);
++	if (node != NULL) {
++		ISC_LIST_DEQUEUE(queue->nodes, node, link);
++		item = node->item;
++	}
++	UNLOCK(&queue->lock);
++
++	if (node != NULL) {
++		node_destroy(queue->mctx, node);
++	}
++
++	return (item);
++}
++
++void
++isc_queue_destroy(isc_queue_t *queue) {
++	node_t *node = NULL;
++	void *alloced = NULL;
++
++	REQUIRE(queue != NULL);
++
++	LOCK(&queue->lock);
++	node = ISC_LIST_HEAD(queue->nodes);
++	while (node != NULL) {
++		node_t *next = ISC_LIST_NEXT(node, link);
++		ISC_LIST_DEQUEUE(queue->nodes, node, link);
++		node_destroy(queue->mctx, node);
++		node = next;
++	}
++	UNLOCK(&queue->lock);
++
++	isc_mutex_destroy(&queue->lock);
++
++	alloced = queue->alloced_ptr;
++	isc_mem_putanddetach(&queue->mctx, alloced, sizeof(*queue) + ALIGNMENT);
++}
++
++#endif /* USE_LOCK_FREE_QUEUE */
+-- 
+2.34.1
+
diff --git a/bind.spec b/bind.spec
index 105cc5d..ccfbe36 100644
--- a/bind.spec
+++ b/bind.spec
@@ -53,7 +53,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.16.26
-Release:  1%{?dist}
+Release:  2%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -103,9 +103,8 @@ Patch24: bind-9.9.1-P2-dlz-libdb.patch
 
 # https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/2689
 Patch25:bind-9.11-rh1666814.patch
-# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/5795
-Patch26:bind-9.16-hp-workers-rh2048235.patch
-Patch27:bind-9.16-hp-workers-rh2048235-dyndb.patch
+# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/5905
+Patch26: bind-9.16-locked-isc-queue.patch
 
 %{?systemd_ordering}
 Requires:       coreutils
@@ -465,6 +464,7 @@ export LIBDIR_SUFFIX
   --includedir=%{_includedir}/bind9 \
   --with-tuning=large \
   --with-libidn2 \
+  --disable-lock-free-queue \
 %if %{with GEOIP2}
   --with-maxminddb \
 %endif
@@ -1115,6 +1115,9 @@ fi;
 %endif
 
 %changelog
+* Tue Mar 01 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.26-2
+- Switch to locked queue (#2048235)
+
 * Thu Feb 17 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.26-1
 - Update to 9.16.26 (#2055120)
 

From e52a50215010b069ac75b5b3cdcdfd7457019880 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 17 Mar 2022 11:46:09 +0100
Subject: [PATCH 294/460] Upgrade to 9.16.27 (#2055120)

https://downloads.isc.org/isc/bind9/9.16.27/doc/arm/html/notes.html#notes-for-bind-9-16-27

Resolves: CVE-2021-25220 CVE-2022-0396
---
 .gitignore | 2 ++
 bind.spec  | 7 +++++--
 sources    | 4 ++--
 3 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/.gitignore b/.gitignore
index de3fb36..f056823 100644
--- a/.gitignore
+++ b/.gitignore
@@ -168,3 +168,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.16.25.tar.xz.asc
 /bind-9.16.26.tar.xz
 /bind-9.16.26.tar.xz.asc
+/bind-9.16.27.tar.xz
+/bind-9.16.27.tar.xz.asc
diff --git a/bind.spec b/bind.spec
index ccfbe36..0573368 100644
--- a/bind.spec
+++ b/bind.spec
@@ -52,8 +52,8 @@
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.16.26
-Release:  2%{?dist}
+Version:  9.16.27
+Release:  1%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1115,6 +1115,9 @@ fi;
 %endif
 
 %changelog
+* Thu Mar 17 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.27-1
+- Upgrade to 9.16.27 (#2055120)
+
 * Tue Mar 01 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.26-2
 - Switch to locked queue (#2048235)
 
diff --git a/sources b/sources
index e1701b9..7da9ce4 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.16.26.tar.xz) = d75e9e0c0853dbfeb0a1e765c2e39d83393c9be5a48cfccd84e758a0f11cf9d480f892431bbba9f7579dfef82e03987580619878d2a5bb5dc35f5dbb35101dbe
-SHA512 (bind-9.16.26.tar.xz.asc) = 5779ac2330ef93682a83d349b42f0fd3f8b14fb59010f399a60cdee1180ad2911c2ec7204d3e13dc06b1c8397949474be045c6d38b6c5a9599810c6159f0fb91
+SHA512 (bind-9.16.27.tar.xz) = 5c71f228db83aa8cc9e65466d6e5afca4a9f80c693358111a003fe09e1a14522175eb2b6a0f11e2a2cd4fdba01f2ae315de52e394a441b3861ca2a011e02af62
+SHA512 (bind-9.16.27.tar.xz.asc) = 5df05d9a4f2425807e8f01c45fb707ddbaa3bcce76512dac87a681f8fd0dba96ad6346311984bfab1a45152cb47252219024d9fc58f85a2b2adf6ad9b0eab7f7

From 0cc36e95a3bd0d015df5b5a1c512e72131fa68e3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 20 Apr 2022 18:05:30 +0200
Subject: [PATCH 295/460] Update to 9.16.28 (#2076941)

https://downloads.isc.org/isc/bind9/9.16.28/doc/arm/html/notes.html#notes-for-bind-9-16-28
---
 .gitignore | 2 ++
 bind.spec  | 5 ++++-
 sources    | 4 ++--
 3 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/.gitignore b/.gitignore
index f056823..5acd1a9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -170,3 +170,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.16.26.tar.xz.asc
 /bind-9.16.27.tar.xz
 /bind-9.16.27.tar.xz.asc
+/bind-9.16.28.tar.xz
+/bind-9.16.28.tar.xz.asc
diff --git a/bind.spec b/bind.spec
index 0573368..13e4997 100644
--- a/bind.spec
+++ b/bind.spec
@@ -52,7 +52,7 @@
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.16.27
+Version:  9.16.28
 Release:  1%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
@@ -1115,6 +1115,9 @@ fi;
 %endif
 
 %changelog
+* Wed Apr 20 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.28-1
+- Update to 9.16.28 (#2076941)
+
 * Thu Mar 17 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.27-1
 - Upgrade to 9.16.27 (#2055120)
 
diff --git a/sources b/sources
index 7da9ce4..8d1fcc3 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.16.27.tar.xz) = 5c71f228db83aa8cc9e65466d6e5afca4a9f80c693358111a003fe09e1a14522175eb2b6a0f11e2a2cd4fdba01f2ae315de52e394a441b3861ca2a011e02af62
-SHA512 (bind-9.16.27.tar.xz.asc) = 5df05d9a4f2425807e8f01c45fb707ddbaa3bcce76512dac87a681f8fd0dba96ad6346311984bfab1a45152cb47252219024d9fc58f85a2b2adf6ad9b0eab7f7
+SHA512 (bind-9.16.28.tar.xz) = 7314c039b6d61b90e7f7c6d4465a26b214de67272116e334b8a3e2551b1d66c028819024ec819676c1cc66e6bf81f17890239bb48e4c40f9d6cea35f025976d3
+SHA512 (bind-9.16.28.tar.xz.asc) = f0461c6764054108c78161e6ef4582559a6ee5fa81d609fb35234022ac0970f712021037c7d94cfc4ad8c5b6a823d5129a7b95fe88c6af31b657683f5b5349ec

From 48bb18e1755003af11520cf8a24f196d8d94b53d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 17 May 2022 15:39:31 +0200
Subject: [PATCH 296/460] Parse again timeout and attempts from resolv.conf

Resolves rhbz#2087156
---
 ....16-resolv.conf-options-timeout-test.patch | 113 ++++++++++
 bind-9.16-resolv.conf-options-timeout.patch   | 203 ++++++++++++++++++
 bind.spec                                     |   8 +-
 3 files changed, 323 insertions(+), 1 deletion(-)
 create mode 100644 bind-9.16-resolv.conf-options-timeout-test.patch
 create mode 100644 bind-9.16-resolv.conf-options-timeout.patch

diff --git a/bind-9.16-resolv.conf-options-timeout-test.patch b/bind-9.16-resolv.conf-options-timeout-test.patch
new file mode 100644
index 0000000..16cf020
--- /dev/null
+++ b/bind-9.16-resolv.conf-options-timeout-test.patch
@@ -0,0 +1,113 @@
+From 7270604440268bb17b39ae734ff33003a67c8343 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
+Date: Tue, 20 Jul 2021 19:34:42 +0200
+Subject: [PATCH] Check parsed resconf values
+
+Add 'attempts' check, fix 'ndots' data. Create a bunch of verification
+functions and check parsed values, not just return codes.
+---
+ lib/irs/tests/resconf_test.c                 | 46 ++++++++++++++++++--
+ lib/irs/tests/testdata/options-attempts.conf | 10 +++++
+ lib/irs/tests/testdata/options-ndots.conf    |  2 +-
+ 3 files changed, 54 insertions(+), 4 deletions(-)
+ create mode 100644 lib/irs/tests/testdata/options-attempts.conf
+
+diff --git a/lib/irs/tests/resconf_test.c b/lib/irs/tests/resconf_test.c
+index 6951758..ce94345 100644
+--- a/lib/irs/tests/resconf_test.c
++++ b/lib/irs/tests/resconf_test.c
+@@ -45,6 +45,43 @@ setup_test() {
+ 	assert_return_code(chdir(TESTS), 0);
+ }
+ 
++static isc_result_t
++check_number(unsigned int n, unsigned int expected) {
++	return ((n == expected) ? ISC_R_SUCCESS : ISC_R_BADNUMBER);
++}
++
++static isc_result_t
++check_attempts(irs_resconf_t *resconf) {
++	return (check_number(irs_resconf_getattempts(resconf), 4));
++}
++
++static isc_result_t
++check_timeout(irs_resconf_t *resconf) {
++	return (check_number(irs_resconf_gettimeout(resconf), 1));
++}
++
++static isc_result_t
++check_ndots(irs_resconf_t *resconf) {
++	return (check_number(irs_resconf_getndots(resconf), 2));
++}
++
++static isc_result_t
++check_options(irs_resconf_t *resconf) {
++	if (irs_resconf_getattempts(resconf) != 3) {
++		return ISC_R_BADNUMBER; /* default value only */
++	}
++
++	if (irs_resconf_getndots(resconf) != 2) {
++		return ISC_R_BADNUMBER;
++	}
++
++	if (irs_resconf_gettimeout(resconf) != 1) {
++		return ISC_R_BADNUMBER;
++	}
++
++	return (ISC_R_SUCCESS);
++}
++
+ /* test irs_resconf_load() */
+ static void
+ irs_resconf_load_test(void **state) {
+@@ -64,15 +101,18 @@ irs_resconf_load_test(void **state) {
+ 		  ISC_R_SUCCESS },
+ 		{ "testdata/nameserver-v6-scoped.conf", ISC_R_SUCCESS, NULL,
+ 		  ISC_R_SUCCESS },
++		{ "testdata/options-attempts.conf", ISC_R_SUCCESS,
++		  check_attempts, ISC_R_SUCCESS },
+ 		{ "testdata/options-debug.conf", ISC_R_SUCCESS, NULL,
+ 		  ISC_R_SUCCESS },
+-		{ "testdata/options-ndots.conf", ISC_R_SUCCESS, NULL,
++		{ "testdata/options-ndots.conf", ISC_R_SUCCESS, check_ndots,
+ 		  ISC_R_SUCCESS },
+-		{ "testdata/options-timeout.conf", ISC_R_SUCCESS, NULL,
++		{ "testdata/options-timeout.conf", ISC_R_SUCCESS, check_timeout,
+ 		  ISC_R_SUCCESS },
+ 		{ "testdata/options-unknown.conf", ISC_R_SUCCESS, NULL,
+ 		  ISC_R_SUCCESS },
+-		{ "testdata/options.conf", ISC_R_SUCCESS, NULL, ISC_R_SUCCESS },
++		{ "testdata/options.conf", ISC_R_SUCCESS, check_options,
++		  ISC_R_SUCCESS },
+ 		{ "testdata/options-bad-ndots.conf", ISC_R_RANGE, NULL,
+ 		  ISC_R_SUCCESS },
+ 		{ "testdata/options-empty.conf", ISC_R_UNEXPECTEDEND, NULL,
+diff --git a/lib/irs/tests/testdata/options-attempts.conf b/lib/irs/tests/testdata/options-attempts.conf
+new file mode 100644
+index 0000000..4538643
+--- /dev/null
++++ b/lib/irs/tests/testdata/options-attempts.conf
+@@ -0,0 +1,10 @@
++# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
++#
++# This Source Code Form is subject to the terms of the Mozilla Public
++# License, v. 2.0. If a copy of the MPL was not distributed with this
++# file, you can obtain one at https://mozilla.org/MPL/2.0/.
++#
++# See the COPYRIGHT file distributed with this work for additional
++# information regarding copyright ownership.
++
++options attempts:4
+diff --git a/lib/irs/tests/testdata/options-ndots.conf b/lib/irs/tests/testdata/options-ndots.conf
+index 5d18d26..f37c712 100644
+--- a/lib/irs/tests/testdata/options-ndots.conf
++++ b/lib/irs/tests/testdata/options-ndots.conf
+@@ -9,4 +9,4 @@
+ # See the COPYRIGHT file distributed with this work for additional
+ # information regarding copyright ownership.
+ 
+-option ndots:2
++options ndots:2
+-- 
+2.35.3
+
diff --git a/bind-9.16-resolv.conf-options-timeout.patch b/bind-9.16-resolv.conf-options-timeout.patch
new file mode 100644
index 0000000..2c28b6d
--- /dev/null
+++ b/bind-9.16-resolv.conf-options-timeout.patch
@@ -0,0 +1,203 @@
+From b0e79979672935ff07bf23703c675ee788940c59 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
+Date: Tue, 22 Jun 2021 16:35:46 +0200
+Subject: [PATCH] Parse 'timeout' and 'attempts' from resolv.conf
+
+It was supported by lwres in BIND 9.11, and is still mentioned in
+the manual page. Restore support for it by adding it to libirs.
+---
+ bin/dig/dighost.c             | 13 ++++++-
+ lib/irs/include/irs/resconf.h | 20 +++++++++++
+ lib/irs/resconf.c             | 64 ++++++++++++++++++++++++++++-------
+ 3 files changed, 84 insertions(+), 13 deletions(-)
+
+diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
+index 0222454..274e894 100644
+--- a/bin/dig/dighost.c
++++ b/bin/dig/dighost.c
+@@ -133,7 +133,7 @@ int sendcount = 0;
+ int recvcount = 0;
+ int sockcount = 0;
+ int ndots = -1;
+-int tries = 3;
++int tries = -1;
+ int lookup_counter = 0;
+ 
+ static char servercookie[256];
+@@ -1330,6 +1330,17 @@ setup_system(bool ipv4only, bool ipv6only) {
+ 		ndots = irs_resconf_getndots(resconf);
+ 		debug("ndots is %d.", ndots);
+ 	}
++	if (timeout == 0) {
++		timeout = irs_resconf_gettimeout(resconf);
++		debug("timeout is %d.", timeout);
++	}
++	if (tries == -1) {
++		tries = irs_resconf_getattempts(resconf);
++		if (tries == 0) {
++			tries = 3;
++		}
++		debug("retries is %d.", tries);
++	}
+ 
+ 	/* If user doesn't specify server use nameservers from resolv.conf. */
+ 	if (ISC_LIST_EMPTY(server_list)) {
+diff --git a/lib/irs/include/irs/resconf.h b/lib/irs/include/irs/resconf.h
+index 424b795..74fc84a 100644
+--- a/lib/irs/include/irs/resconf.h
++++ b/lib/irs/include/irs/resconf.h
+@@ -113,6 +113,26 @@ irs_resconf_getndots(irs_resconf_t *conf);
+  *\li	'conf' is a valid resconf object.
+  */
+ 
++unsigned int
++irs_resconf_getattempts(irs_resconf_t *conf);
++/*%<
++ * Return the 'attempts' value stored in 'conf'.
++ *
++ * Requires:
++ *
++ *\li	'conf' is a valid resconf object.
++ */
++
++unsigned int
++irs_resconf_gettimeout(irs_resconf_t *conf);
++/*%<
++ * Return the 'timeout' value stored in 'conf'.
++ *
++ * Requires:
++ *
++ *\li	'conf' is a valid resconf object.
++ */
++
+ ISC_LANG_ENDDECLS
+ 
+ #endif /* IRS_RESCONF_H */
+diff --git a/lib/irs/resconf.c b/lib/irs/resconf.c
+index 096064b..dd51d71 100644
+--- a/lib/irs/resconf.c
++++ b/lib/irs/resconf.c
+@@ -80,6 +80,13 @@
+ #define RESCONFMAXLINELEN     256U /*%< max size of a line */
+ #define RESCONFMAXSORTLIST    10U  /*%< max 10 */
+ 
++#define CHECK(op)                            \
++	do {                                 \
++		result = (op);               \
++		if (result != ISC_R_SUCCESS) \
++			goto cleanup;        \
++	} while (0)
++
+ /*!
+  * configuration data structure
+  */
+@@ -114,6 +121,10 @@ struct irs_resconf {
+ 	uint8_t resdebug;
+ 	/*%< set to n in 'options ndots:n' */
+ 	uint8_t ndots;
++	/*%< set to n in 'options attempts:n' */
++	uint8_t attempts;
++	/*%< set to n in 'options timeout:n' */
++	uint8_t timeout;
+ };
+ 
+ static isc_result_t
+@@ -176,8 +187,8 @@ eatwhite(FILE *fp) {
+  */
+ static int
+ getword(FILE *fp, char *buffer, size_t size) {
++	char *p = NULL;
+ 	int ch;
+-	char *p;
+ 
+ 	REQUIRE(buffer != NULL);
+ 	REQUIRE(size > 0U);
+@@ -457,11 +468,26 @@ resconf_parsesortlist(irs_resconf_t *conf, FILE *fp) {
+ 	return (ISC_R_SUCCESS);
+ }
+ 
++static isc_result_t
++resconf_optionnumber(const char *word, uint8_t *number) {
++	char *p;
++	long n;
++
++	n = strtol(word, &p, 10);
++	if (*p != '\0') { /* Bad string. */
++		return (ISC_R_UNEXPECTEDTOKEN);
++	}
++	if (n < 0 || n > 0xff) { /* Out of range. */
++		return (ISC_R_RANGE);
++	}
++	*number = n;
++	return (ISC_R_SUCCESS);
++}
++
+ static isc_result_t
+ resconf_parseoption(irs_resconf_t *conf, FILE *fp) {
+ 	int delim;
+-	long ndots;
+-	char *p;
++	isc_result_t result = ISC_R_SUCCESS;
+ 	char word[RESCONFMAXLINELEN];
+ 
+ 	delim = getword(fp, word, sizeof(word));
+@@ -473,14 +499,11 @@ resconf_parseoption(irs_resconf_t *conf, FILE *fp) {
+ 		if (strcmp("debug", word) == 0) {
+ 			conf->resdebug = 1;
+ 		} else if (strncmp("ndots:", word, 6) == 0) {
+-			ndots = strtol(word + 6, &p, 10);
+-			if (*p != '\0') { /* Bad string. */
+-				return (ISC_R_UNEXPECTEDTOKEN);
+-			}
+-			if (ndots < 0 || ndots > 0xff) { /* Out of range. */
+-				return (ISC_R_RANGE);
+-			}
+-			conf->ndots = (uint8_t)ndots;
++			CHECK(resconf_optionnumber(word + 6, &conf->ndots));
++		} else if (strncmp("attempts:", word, 9) == 0) {
++			CHECK(resconf_optionnumber(word + 9, &conf->attempts));
++		} else if (strncmp("timeout:", word, 8) == 0) {
++			CHECK(resconf_optionnumber(word + 8, &conf->timeout));
+ 		}
+ 
+ 		if (delim == EOF || delim == '\n') {
+@@ -490,7 +513,8 @@ resconf_parseoption(irs_resconf_t *conf, FILE *fp) {
+ 		}
+ 	}
+ 
+-	return (ISC_R_SUCCESS);
++cleanup:
++	return (result);
+ }
+ 
+ static isc_result_t
+@@ -532,6 +556,8 @@ irs_resconf_load(isc_mem_t *mctx, const char *filename, irs_resconf_t **confp) {
+ 	conf->sortlistnxt = 0;
+ 	conf->resdebug = 0;
+ 	conf->ndots = 1;
++	conf->attempts = 3;
++	conf->timeout = 0;
+ 	for (i = 0; i < RESCONFMAXSEARCH; i++) {
+ 		conf->search[i] = NULL;
+ 	}
+@@ -687,3 +713,17 @@ irs_resconf_getndots(irs_resconf_t *conf) {
+ 
+ 	return ((unsigned int)conf->ndots);
+ }
++
++unsigned int
++irs_resconf_getattempts(irs_resconf_t *conf) {
++	REQUIRE(IRS_RESCONF_VALID(conf));
++
++	return ((unsigned int)conf->attempts);
++}
++
++unsigned int
++irs_resconf_gettimeout(irs_resconf_t *conf) {
++	REQUIRE(IRS_RESCONF_VALID(conf));
++
++	return ((unsigned int)conf->timeout);
++}
+-- 
+2.35.3
+
diff --git a/bind.spec b/bind.spec
index 13e4997..d830eb9 100644
--- a/bind.spec
+++ b/bind.spec
@@ -53,7 +53,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.16.28
-Release:  1%{?dist}
+Release:  2%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -105,6 +105,9 @@ Patch24: bind-9.9.1-P2-dlz-libdb.patch
 Patch25:bind-9.11-rh1666814.patch
 # https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/5905
 Patch26: bind-9.16-locked-isc-queue.patch
+# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/5273
+Patch27: bind-9.16-resolv.conf-options-timeout.patch
+Patch28: bind-9.16-resolv.conf-options-timeout-test.patch
 
 %{?systemd_ordering}
 Requires:       coreutils
@@ -1115,6 +1118,9 @@ fi;
 %endif
 
 %changelog
+* Tue May 17 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.28-2
+- Parse again timeout and attempts from resolv.conf (#2087156)
+
 * Wed Apr 20 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.28-1
 - Update to 9.16.28 (#2076941)
 

From fdb091757f70dbb2e320f56aa65df2aeb12f4dfa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 17 May 2022 17:28:20 +0200
Subject: [PATCH 297/460] Reeanble unit tests

---
 bind.spec | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/bind.spec b/bind.spec
index d830eb9..0414eef 100644
--- a/bind.spec
+++ b/bind.spec
@@ -14,8 +14,7 @@
 %bcond_without DLZ
 # New MaxMind GeoLite support
 %bcond_without GEOIP2
-# Disabled temporarily until kyua is fixed on rawhide, bug #1926779
-%bcond_with UNITTEST
+%bcond_without UNITTEST
 %bcond_without DNSTAP
 %bcond_without LMDB
 %bcond_without DOC
@@ -1120,6 +1119,7 @@ fi;
 %changelog
 * Tue May 17 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.28-2
 - Parse again timeout and attempts from resolv.conf (#2087156)
+- Reenable unit tests during build
 
 * Wed Apr 20 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.28-1
 - Update to 9.16.28 (#2076941)

From bb1dcf68daf97812b7b2301c764adfd1f66822f4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 26 May 2022 23:02:36 +0200
Subject: [PATCH 298/460] Update to 9.16.29

Previously, CDS and CDNSKEY DELETE records were removed from
the zone when configured with the auto-dnssec maintain; option.
This has been fixed. [GL #2931]

https://downloads.isc.org/isc/bind9/9.16.29/doc/arm/html/notes.html#notes-for-bind-9-16-29

Resolves: rhbz#2087920
---
 .gitignore | 2 ++
 bind.spec  | 7 +++++--
 sources    | 4 ++--
 3 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/.gitignore b/.gitignore
index 5acd1a9..699ff79 100644
--- a/.gitignore
+++ b/.gitignore
@@ -172,3 +172,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.16.27.tar.xz.asc
 /bind-9.16.28.tar.xz
 /bind-9.16.28.tar.xz.asc
+/bind-9.16.29.tar.xz
+/bind-9.16.29.tar.xz.asc
diff --git a/bind.spec b/bind.spec
index 0414eef..0f72831 100644
--- a/bind.spec
+++ b/bind.spec
@@ -51,8 +51,8 @@
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.16.28
-Release:  2%{?dist}
+Version:  9.16.29
+Release:  1%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1117,6 +1117,9 @@ fi;
 %endif
 
 %changelog
+* Thu May 26 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.29-1
+- Update to 9.16.29 (#2087920)
+
 * Tue May 17 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.28-2
 - Parse again timeout and attempts from resolv.conf (#2087156)
 - Reenable unit tests during build
diff --git a/sources b/sources
index 8d1fcc3..f51a876 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.16.28.tar.xz) = 7314c039b6d61b90e7f7c6d4465a26b214de67272116e334b8a3e2551b1d66c028819024ec819676c1cc66e6bf81f17890239bb48e4c40f9d6cea35f025976d3
-SHA512 (bind-9.16.28.tar.xz.asc) = f0461c6764054108c78161e6ef4582559a6ee5fa81d609fb35234022ac0970f712021037c7d94cfc4ad8c5b6a823d5129a7b95fe88c6af31b657683f5b5349ec
+SHA512 (bind-9.16.29.tar.xz) = b4acbafed370438ac53e73468ccb5ea5745a1c8f764dd96f9c9a027594a3b7ce0d486e7f01138b39795b456265e0e6116cd76e44f5a3329687cd718550ca79fb
+SHA512 (bind-9.16.29.tar.xz.asc) = 98c1fea8cc2a2465aff5f4449a122046fbb98ff648a96147885c4bdd9d1e7e578de693d14587544a8846c89c0cff97d2fa9620fb1a63c3938086b2fea0eb1112

From bb9452718aab4c4114b85db490d37b54395e189f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 26 May 2022 23:07:23 +0200
Subject: [PATCH 299/460] Correct failing test

Prevent failures of netmgr_test. Enable unit tests again, since issue
with kyua seems to be fixed.

Resolves: rhbz#2088125
---
 bind-9.16-rhbz2088125.patch | 66 +++++++++++++++++++++++++++++++++++++
 bind.spec                   |  3 ++
 2 files changed, 69 insertions(+)
 create mode 100644 bind-9.16-rhbz2088125.patch

diff --git a/bind-9.16-rhbz2088125.patch b/bind-9.16-rhbz2088125.patch
new file mode 100644
index 0000000..0ac3a99
--- /dev/null
+++ b/bind-9.16-rhbz2088125.patch
@@ -0,0 +1,66 @@
+From 1feb389f80f7595d2f873c3ff8678b52cd2db828 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
+Date: Tue, 24 May 2022 19:42:41 +0200
+Subject: [PATCH] Fix failures in isc netmgr_test on big endian machines
+
+Typing from libuv structure to isc_region_t is not possible, because
+their sizes differ on 64 bit architectures. Little endian machines seems
+to be lucky and still result in test passed. But big endian machine such
+as s390x fails the test reliably.
+
+Fix by directly creating the buffer as isc_region_t and skipping the
+type conversion. More readable and still more correct.
+
+(cherry picked from commit 057438cb45f2f02615dc309e3822f23c0ca70a0a)
+---
+ lib/isc/tests/netmgr_test.c | 18 ++++++++----------
+ 1 file changed, 8 insertions(+), 10 deletions(-)
+
+diff --git a/lib/isc/tests/netmgr_test.c b/lib/isc/tests/netmgr_test.c
+index c2d7fffb32..9fa0d47e5b 100644
+--- a/lib/isc/tests/netmgr_test.c
++++ b/lib/isc/tests/netmgr_test.c
+@@ -62,11 +62,11 @@ static isc_sockaddr_t tcp_connect_addr;
+ static uint64_t send_magic = 0;
+ static uint64_t stop_magic = 0;
+ 
+-static uv_buf_t send_msg = { .base = (char *)&send_magic,
+-			     .len = sizeof(send_magic) };
++static isc_region_t send_msg = { .base = (unsigned char *)&send_magic,
++				 .length = sizeof(send_magic) };
+ 
+-static uv_buf_t stop_msg = { .base = (char *)&stop_magic,
+-			     .len = sizeof(stop_magic) };
++static isc_region_t stop_msg = { .base = (unsigned char *)&stop_magic,
++				 .length = sizeof(stop_magic) };
+ 
+ static atomic_bool do_send = false;
+ static unsigned int workers = 0;
+@@ -420,11 +420,9 @@ connect_send(isc_nmhandle_t *handle) {
+ 	isc_nmhandle_attach(handle, &sendhandle);
+ 	isc_nmhandle_setwritetimeout(handle, T_IDLE);
+ 	if (atomic_fetch_sub(&nsends, 1) > 1) {
+-		isc_nm_send(sendhandle, (isc_region_t *)&send_msg,
+-			    connect_send_cb, NULL);
++		isc_nm_send(sendhandle, &send_msg, connect_send_cb, NULL);
+ 	} else {
+-		isc_nm_send(sendhandle, (isc_region_t *)&stop_msg,
+-			    connect_send_cb, NULL);
++		isc_nm_send(sendhandle, &stop_msg, connect_send_cb, NULL);
+ 	}
+ }
+ 
+@@ -531,8 +529,8 @@ listen_read_cb(isc_nmhandle_t *handle, isc_result_t eresult,
+ 			isc_nmhandle_attach(handle, &sendhandle);
+ 			isc_refcount_increment0(&active_ssends);
+ 			isc_nmhandle_setwritetimeout(sendhandle, T_IDLE);
+-			isc_nm_send(sendhandle, (isc_region_t *)&send_msg,
+-				    listen_send_cb, cbarg);
++			isc_nm_send(sendhandle, &send_msg, listen_send_cb,
++				    cbarg);
+ 		}
+ 		return;
+ 	}
+-- 
+2.34.3
+
diff --git a/bind.spec b/bind.spec
index 0f72831..77c13d1 100644
--- a/bind.spec
+++ b/bind.spec
@@ -107,6 +107,8 @@ Patch26: bind-9.16-locked-isc-queue.patch
 # https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/5273
 Patch27: bind-9.16-resolv.conf-options-timeout.patch
 Patch28: bind-9.16-resolv.conf-options-timeout-test.patch
+# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/6352
+Patch29: bind-9.16-rhbz2088125.patch
 
 %{?systemd_ordering}
 Requires:       coreutils
@@ -1119,6 +1121,7 @@ fi;
 %changelog
 * Thu May 26 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.29-1
 - Update to 9.16.29 (#2087920)
+- Fix netmgr_test fails on s390x (#2088125)
 
 * Tue May 17 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.28-2
 - Parse again timeout and attempts from resolv.conf (#2087156)

From e3377c558bfe2702cb54a274c5703952bd7020ed Mon Sep 17 00:00:00 2001
From: Python Maint <python-maint@redhat.com>
Date: Mon, 13 Jun 2022 18:18:12 +0200
Subject: [PATCH 300/460] Rebuilt for Python 3.11

---
 bind.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index 77c13d1..f9f1e89 100644
--- a/bind.spec
+++ b/bind.spec
@@ -52,7 +52,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.16.29
-Release:  1%{?dist}
+Release:  2%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1119,6 +1119,9 @@ fi;
 %endif
 
 %changelog
+* Mon Jun 13 2022 Python Maint <python-maint@redhat.com> - 32:9.16.29-2
+- Rebuilt for Python 3.11
+
 * Thu May 26 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.29-1
 - Update to 9.16.29 (#2087920)
 - Fix netmgr_test fails on s390x (#2088125)

From f887e1691144a69cd0169ba5fdd8711f9270e14e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 20 Jun 2022 14:21:46 +0200
Subject: [PATCH 301/460] Update to 9.16.30 (#2097312)

https://downloads.isc.org/isc/bind9/9.16.30/doc/arm/html/notes.html#notes-for-bind-9-16-30
---
 .gitignore                       |   2 +
 bind-9.16-locked-isc-queue.patch | 214 -------------------------------
 bind-9.16-rhbz2088125.patch      |  66 ----------
 bind.spec                        |  12 +-
 sources                          |   4 +-
 5 files changed, 9 insertions(+), 289 deletions(-)
 delete mode 100644 bind-9.16-locked-isc-queue.patch
 delete mode 100644 bind-9.16-rhbz2088125.patch

diff --git a/.gitignore b/.gitignore
index 699ff79..c7d7172 100644
--- a/.gitignore
+++ b/.gitignore
@@ -174,3 +174,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.16.28.tar.xz.asc
 /bind-9.16.29.tar.xz
 /bind-9.16.29.tar.xz.asc
+/bind-9.16.30.tar.xz
+/bind-9.16.30.tar.xz.asc
diff --git a/bind-9.16-locked-isc-queue.patch b/bind-9.16-locked-isc-queue.patch
deleted file mode 100644
index 816d960..0000000
--- a/bind-9.16-locked-isc-queue.patch
+++ /dev/null
@@ -1,214 +0,0 @@
-From 0df59049fe13ef89d362fa7f109f289b297441dc Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
-Date: Tue, 22 Feb 2022 23:40:39 +0100
-Subject: [PATCH] Provide alternative isc_queue implementation based on locked
- list
-
-The current implementation of isc_queue uses Michael-Scott lock-free
-queue that in turn uses hazard pointers.  It was discovered that the way
-we use the isc_queue, such complicated mechanism isn't really needed,
-because most of the time, we either execute the work directly when on
-nmthread (in case of UDP) or schedule the work from the matching
-nmthreads.
-
-Provide alternative implementation for the isc_queue based on locked
-ISC_LIST.
-PatchNumber: 11
-PatchNumber: 11
----
- bin/named/main.c            |   1 -
- configure.ac                |  12 ++++
- lib/isc/include/isc/queue.h |   3 +-
- lib/isc/queue.c             | 121 ++++++++++++++++++++++++++++++++++++
- 4 files changed, 134 insertions(+), 3 deletions(-)
-
-diff --git a/bin/named/main.c b/bin/named/main.c
-index 9ad2d0e..8870933 100644
---- a/bin/named/main.c
-+++ b/bin/named/main.c
-@@ -34,7 +34,6 @@
- #include <isc/dir.h>
- #include <isc/file.h>
- #include <isc/hash.h>
--#include <isc/hp.h>
- #include <isc/httpd.h>
- #include <isc/managers.h>
- #include <isc/netmgr.h>
-diff --git a/configure.ac b/configure.ac
-index 79d33d1..26241a0 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -2263,8 +2263,20 @@ AS_CASE([$with_cmocka],
- AC_SUBST([CMOCKA_CFLAGS])
- AC_SUBST([CMOCKA_LIBS])
- 
-+#
-+# Use lock-free Michael-Scott's queue implementation or locked-list queue
-+#
-+# [pairwise: --enable-lock-free-queue, --disable-lock-free-queue]
-+AC_ARG_ENABLE([lock-free-queue],
-+	    [AS_HELP_STRING([--enable-lock-free-queue],[enable lock-free queue implementation (default is enabled)])],
-+	    [],[enable_lock_free_queue=yes])
-+AS_CASE([$enable_lock_free_queue],
-+	[no],[],
-+	[yes],[AC_DEFINE([USE_LOCK_FREE_QUEUE],[1],[Define to 1 to enable lock-free queue])])
-+
- AC_DEFINE([SKIPPED_TEST_EXIT_CODE], [0], [Exit code for skipped tests])
- 
-+
- #
- # Check for kyua execution engine if CMocka was requested
- # and bail out if execution engine was not found
-diff --git a/lib/isc/include/isc/queue.h b/lib/isc/include/isc/queue.h
-index 0927075..568bf18 100644
---- a/lib/isc/include/isc/queue.h
-+++ b/lib/isc/include/isc/queue.h
-@@ -39,8 +39,7 @@ uintptr_t
- isc_queue_dequeue(isc_queue_t *queue);
- /*%<
-  * Remove an object pointer from the head of the queue and return the
-- * pointer. If the queue is empty, return `nulluintptr` (the uintptr_t
-- * representation of NULL).
-+ * pointer. If the queue is empty, return `NULL`.
-  *
-  * Requires:
-  * \li	'queue' is not null.
-diff --git a/lib/isc/queue.c b/lib/isc/queue.c
-index d7ea824..c4cb404 100644
---- a/lib/isc/queue.c
-+++ b/lib/isc/queue.c
-@@ -28,6 +28,10 @@
- 
- static uintptr_t nulluintptr = (uintptr_t)NULL;
- 
-+#if USE_LOCK_FREE_QUEUE
-+
-+#define BUFFER_SIZE 1024
-+
- typedef struct node {
- 	atomic_uint_fast32_t deqidx;
- 	atomic_uintptr_t items[BUFFER_SIZE];
-@@ -232,3 +236,120 @@ isc_queue_destroy(isc_queue_t *queue) {
- 	alloced = queue->alloced_ptr;
- 	isc_mem_putanddetach(&queue->mctx, alloced, sizeof(*queue) + ALIGNMENT);
- }
-+
-+#else /* USE_LOCK_FREE_QUEUE */
-+
-+typedef struct node node_t;
-+
-+struct node {
-+	uintptr_t item;
-+	ISC_LINK(node_t) link;
-+};
-+
-+struct isc_queue {
-+	isc_mem_t *mctx;
-+	isc_mutex_t lock;
-+	int max_threads;
-+	ISC_LIST(node_t) nodes;
-+	void *alloced_ptr;
-+};
-+
-+static node_t *
-+node_new(isc_mem_t *mctx, uintptr_t item) {
-+	node_t *node = isc_mem_get(mctx, sizeof(*node));
-+	*node = (node_t){
-+		.item = item,
-+	};
-+
-+	ISC_LINK_INIT(node, link);
-+
-+	return (node);
-+}
-+
-+static void
-+node_destroy(isc_mem_t *mctx, node_t *node) {
-+	isc_mem_put(mctx, node, sizeof(*node));
-+}
-+
-+isc_queue_t *
-+isc_queue_new(isc_mem_t *mctx, int max_threads) {
-+	isc_queue_t *queue = NULL;
-+	void *qbuf = NULL;
-+	uintptr_t qptr;
-+
-+	qbuf = isc_mem_get(mctx, sizeof(*queue) + ALIGNMENT);
-+	qptr = (uintptr_t)qbuf;
-+	queue = (isc_queue_t *)(qptr + (ALIGNMENT - (qptr % ALIGNMENT)));
-+
-+	if (max_threads == 0) {
-+		max_threads = MAX_THREADS;
-+	}
-+
-+	*queue = (isc_queue_t){
-+		.max_threads = max_threads,
-+		.alloced_ptr = qbuf,
-+	};
-+
-+	ISC_LIST_INIT(queue->nodes);
-+
-+	isc_mutex_init(&queue->lock);
-+	isc_mem_attach(mctx, &queue->mctx);
-+
-+	return (queue);
-+}
-+
-+void
-+isc_queue_enqueue(isc_queue_t *queue, uintptr_t item) {
-+	node_t *node = node_new(queue->mctx, item);
-+	REQUIRE(item != nulluintptr);
-+
-+	LOCK(&queue->lock);
-+	ISC_LIST_ENQUEUE(queue->nodes, node, link);
-+	UNLOCK(&queue->lock);
-+}
-+
-+uintptr_t
-+isc_queue_dequeue(isc_queue_t *queue) {
-+	node_t *node = NULL;
-+	uintptr_t item = nulluintptr;
-+	REQUIRE(queue != NULL);
-+
-+	LOCK(&queue->lock);
-+	node = ISC_LIST_HEAD(queue->nodes);
-+	if (node != NULL) {
-+		ISC_LIST_DEQUEUE(queue->nodes, node, link);
-+		item = node->item;
-+	}
-+	UNLOCK(&queue->lock);
-+
-+	if (node != NULL) {
-+		node_destroy(queue->mctx, node);
-+	}
-+
-+	return (item);
-+}
-+
-+void
-+isc_queue_destroy(isc_queue_t *queue) {
-+	node_t *node = NULL;
-+	void *alloced = NULL;
-+
-+	REQUIRE(queue != NULL);
-+
-+	LOCK(&queue->lock);
-+	node = ISC_LIST_HEAD(queue->nodes);
-+	while (node != NULL) {
-+		node_t *next = ISC_LIST_NEXT(node, link);
-+		ISC_LIST_DEQUEUE(queue->nodes, node, link);
-+		node_destroy(queue->mctx, node);
-+		node = next;
-+	}
-+	UNLOCK(&queue->lock);
-+
-+	isc_mutex_destroy(&queue->lock);
-+
-+	alloced = queue->alloced_ptr;
-+	isc_mem_putanddetach(&queue->mctx, alloced, sizeof(*queue) + ALIGNMENT);
-+}
-+
-+#endif /* USE_LOCK_FREE_QUEUE */
--- 
-2.34.1
-
diff --git a/bind-9.16-rhbz2088125.patch b/bind-9.16-rhbz2088125.patch
deleted file mode 100644
index 0ac3a99..0000000
--- a/bind-9.16-rhbz2088125.patch
+++ /dev/null
@@ -1,66 +0,0 @@
-From 1feb389f80f7595d2f873c3ff8678b52cd2db828 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Tue, 24 May 2022 19:42:41 +0200
-Subject: [PATCH] Fix failures in isc netmgr_test on big endian machines
-
-Typing from libuv structure to isc_region_t is not possible, because
-their sizes differ on 64 bit architectures. Little endian machines seems
-to be lucky and still result in test passed. But big endian machine such
-as s390x fails the test reliably.
-
-Fix by directly creating the buffer as isc_region_t and skipping the
-type conversion. More readable and still more correct.
-
-(cherry picked from commit 057438cb45f2f02615dc309e3822f23c0ca70a0a)
----
- lib/isc/tests/netmgr_test.c | 18 ++++++++----------
- 1 file changed, 8 insertions(+), 10 deletions(-)
-
-diff --git a/lib/isc/tests/netmgr_test.c b/lib/isc/tests/netmgr_test.c
-index c2d7fffb32..9fa0d47e5b 100644
---- a/lib/isc/tests/netmgr_test.c
-+++ b/lib/isc/tests/netmgr_test.c
-@@ -62,11 +62,11 @@ static isc_sockaddr_t tcp_connect_addr;
- static uint64_t send_magic = 0;
- static uint64_t stop_magic = 0;
- 
--static uv_buf_t send_msg = { .base = (char *)&send_magic,
--			     .len = sizeof(send_magic) };
-+static isc_region_t send_msg = { .base = (unsigned char *)&send_magic,
-+				 .length = sizeof(send_magic) };
- 
--static uv_buf_t stop_msg = { .base = (char *)&stop_magic,
--			     .len = sizeof(stop_magic) };
-+static isc_region_t stop_msg = { .base = (unsigned char *)&stop_magic,
-+				 .length = sizeof(stop_magic) };
- 
- static atomic_bool do_send = false;
- static unsigned int workers = 0;
-@@ -420,11 +420,9 @@ connect_send(isc_nmhandle_t *handle) {
- 	isc_nmhandle_attach(handle, &sendhandle);
- 	isc_nmhandle_setwritetimeout(handle, T_IDLE);
- 	if (atomic_fetch_sub(&nsends, 1) > 1) {
--		isc_nm_send(sendhandle, (isc_region_t *)&send_msg,
--			    connect_send_cb, NULL);
-+		isc_nm_send(sendhandle, &send_msg, connect_send_cb, NULL);
- 	} else {
--		isc_nm_send(sendhandle, (isc_region_t *)&stop_msg,
--			    connect_send_cb, NULL);
-+		isc_nm_send(sendhandle, &stop_msg, connect_send_cb, NULL);
- 	}
- }
- 
-@@ -531,8 +529,8 @@ listen_read_cb(isc_nmhandle_t *handle, isc_result_t eresult,
- 			isc_nmhandle_attach(handle, &sendhandle);
- 			isc_refcount_increment0(&active_ssends);
- 			isc_nmhandle_setwritetimeout(sendhandle, T_IDLE);
--			isc_nm_send(sendhandle, (isc_region_t *)&send_msg,
--				    listen_send_cb, cbarg);
-+			isc_nm_send(sendhandle, &send_msg, listen_send_cb,
-+				    cbarg);
- 		}
- 		return;
- 	}
--- 
-2.34.3
-
diff --git a/bind.spec b/bind.spec
index f9f1e89..7d80c0b 100644
--- a/bind.spec
+++ b/bind.spec
@@ -51,8 +51,8 @@
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.16.29
-Release:  2%{?dist}
+Version:  9.16.30
+Release:  1%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -102,13 +102,9 @@ Patch24: bind-9.9.1-P2-dlz-libdb.patch
 
 # https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/2689
 Patch25:bind-9.11-rh1666814.patch
-# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/5905
-Patch26: bind-9.16-locked-isc-queue.patch
 # https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/5273
 Patch27: bind-9.16-resolv.conf-options-timeout.patch
 Patch28: bind-9.16-resolv.conf-options-timeout-test.patch
-# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/6352
-Patch29: bind-9.16-rhbz2088125.patch
 
 %{?systemd_ordering}
 Requires:       coreutils
@@ -468,7 +464,6 @@ export LIBDIR_SUFFIX
   --includedir=%{_includedir}/bind9 \
   --with-tuning=large \
   --with-libidn2 \
-  --disable-lock-free-queue \
 %if %{with GEOIP2}
   --with-maxminddb \
 %endif
@@ -1119,6 +1114,9 @@ fi;
 %endif
 
 %changelog
+* Mon Jun 20 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.30-1
+- Update to 9.16.30 (#2097312)
+
 * Mon Jun 13 2022 Python Maint <python-maint@redhat.com> - 32:9.16.29-2
 - Rebuilt for Python 3.11
 
diff --git a/sources b/sources
index f51a876..4bc717f 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.16.29.tar.xz) = b4acbafed370438ac53e73468ccb5ea5745a1c8f764dd96f9c9a027594a3b7ce0d486e7f01138b39795b456265e0e6116cd76e44f5a3329687cd718550ca79fb
-SHA512 (bind-9.16.29.tar.xz.asc) = 98c1fea8cc2a2465aff5f4449a122046fbb98ff648a96147885c4bdd9d1e7e578de693d14587544a8846c89c0cff97d2fa9620fb1a63c3938086b2fea0eb1112
+SHA512 (bind-9.16.30.tar.xz) = cc9bcbedf63c2efe0a23f14db3e57fdae46f0509aac58e5840a6805ce4fbd76cad5bfde4d461442adb88c4d947f8d79bf979aeb24aeb9303b6adc8d169b7118c
+SHA512 (bind-9.16.30.tar.xz.asc) = 943ff140aaa413f125d039748a0c10d7ae20b0fa4075227ab0b9d065816e7960a3c4e0fb2a4498946926409568c71076026cbd0be33a78db73966366d43bfdb1

From d540d034df225e7f492a1ba997b582fbe6136488 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Wed, 20 Jul 2022 21:59:12 +0000
Subject: [PATCH 302/460] Rebuilt for
 https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
---
 bind.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index 7d80c0b..cf76813 100644
--- a/bind.spec
+++ b/bind.spec
@@ -52,7 +52,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.16.30
-Release:  1%{?dist}
+Release:  2%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1114,6 +1114,9 @@ fi;
 %endif
 
 %changelog
+* Wed Jul 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.16.30-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
+
 * Mon Jun 20 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.30-1
 - Update to 9.16.30 (#2097312)
 

From 8a47aa2c7580550df27a8543922dd319450acd6c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 12 Jul 2022 15:40:10 +0200
Subject: [PATCH 303/460] Import version from branch v9_18

Uses git checkout 38726e67340b2b60715fa2f342dc800273d3772f -- .

Remove unused patches from distgit.
---
 .gitignore                                    |  10 +
 README.md                                     |   6 +-
 bind-9.10-dist-native-pkcs11.patch            | 541 ------------------
 bind-9.11-fips-tests.patch                    | 341 +++++------
 bind-9.11-kyua-pkcs11.patch                   |  58 --
 bind-9.11-rh1666814.patch                     |  29 -
 bind-9.14-config-pkcs11.patch                 |  83 ---
 bind-9.16-redhat_doc.patch                    |  40 +-
 ....16-resolv.conf-options-timeout-test.patch | 113 ----
 bind-9.16-resolv.conf-options-timeout.patch   | 203 -------
 bind-9.5-PIE.patch                            |  46 +-
 bind-9.5-dlz-64bit.patch                      |  53 --
 bind-9.9.1-P2-dlz-libdb.patch                 |  31 -
 bind.spec                                     | 288 ++++------
 bind93-rh490837.patch                         |  34 --
 codesign2019.txt                              | 252 ++++++++
 named-chroot.files                            |   2 -
 named-chroot.service                          |   2 +-
 named-pkcs11.service                          |   2 +-
 named.root                                    | 153 +++--
 named.service                                 |   2 +-
 setup-named-chroot.sh                         |   8 +-
 sources                                       |   4 +-
 23 files changed, 670 insertions(+), 1631 deletions(-)
 delete mode 100644 bind-9.10-dist-native-pkcs11.patch
 delete mode 100644 bind-9.11-kyua-pkcs11.patch
 delete mode 100644 bind-9.11-rh1666814.patch
 delete mode 100644 bind-9.14-config-pkcs11.patch
 delete mode 100644 bind-9.16-resolv.conf-options-timeout-test.patch
 delete mode 100644 bind-9.16-resolv.conf-options-timeout.patch
 delete mode 100644 bind-9.5-dlz-64bit.patch
 delete mode 100644 bind-9.9.1-P2-dlz-libdb.patch
 delete mode 100644 bind93-rh490837.patch
 create mode 100644 codesign2019.txt

diff --git a/.gitignore b/.gitignore
index c7d7172..4bfd826 100644
--- a/.gitignore
+++ b/.gitignore
@@ -176,3 +176,13 @@ bind-9.7.2b1.tar.gz
 /bind-9.16.29.tar.xz.asc
 /bind-9.16.30.tar.xz
 /bind-9.16.30.tar.xz.asc
+/bind-9.18.0.tar.xz
+/bind-9.18.0.tar.xz.asc
+/bind-9.18.1.tar.xz
+/bind-9.18.1.tar.xz.asc
+/bind-9.18.2.tar.xz
+/bind-9.18.2.tar.xz.asc
+/bind-9.18.3.tar.xz
+/bind-9.18.3.tar.xz.asc
+/bind-9.18.4.tar.xz
+/bind-9.18.4.tar.xz.asc
diff --git a/README.md b/README.md
index 22359bb..42aad62 100644
--- a/README.md
+++ b/README.md
@@ -22,10 +22,8 @@ The package contains several subpackages, some of them can be disabled on rebuil
 * **bind-utils** -- set of tools to analyse DNS responses or update entries (dig, host)
 * **bind-doc** -- documentation for current bind, *BIND 9 Administrator Reference Manual*.
 * **bind-license** -- Shared license for all packages but bind-export-libs.
-* **bind-pkcs11** -- *named* daemon built with native PKCS#11 support. Can be disabled by `--without PKCS11`.
-* **bind-libs** and **bind-libs-lite** -- Shared libraries used by some others programs
-* **bind-devel** -- Development headers for libs.
-* **bind-dlz-\*** -- Dynamic loadable [DLZ plugins](http://bind-dlz.sourceforge.net/) with support for external databases
+* **bind-libs** -- Shared libraries used by some others programs
+* **bind-devel** -- Development headers for libs. Can be disabled by `--without DEVEL`
 
 
 ## Optional features
diff --git a/bind-9.10-dist-native-pkcs11.patch b/bind-9.10-dist-native-pkcs11.patch
deleted file mode 100644
index e4f1ebd..0000000
--- a/bind-9.10-dist-native-pkcs11.patch
+++ /dev/null
@@ -1,541 +0,0 @@
-From 1cbffe7e8b5bced9134abbae23a2a20c83d39a6a Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Thu, 21 Jan 2021 10:46:20 +0100
-Subject: [PATCH] Enable custom pkcs11 native build
-
-Share common parts like libisc, libcc and others. But provide native
-pkcs11 libraries as a new copy of libdns and libns.
----
- bin/Makefile.in                  |  2 +-
- bin/confgen/Makefile.in          |  2 +-
- bin/dnssec-pkcs11/Makefile.in    | 39 +++++++++++++++++---------------
- bin/named-pkcs11/Makefile.in     | 31 +++++++++++++------------
- configure.ac                     | 19 ++++++++++++++++
- lib/Makefile.in                  |  2 +-
- lib/dns-pkcs11/Makefile.in       | 22 +++++++++---------
- lib/dns-pkcs11/tests/Makefile.in |  8 +++----
- lib/ns-pkcs11/Makefile.in        | 26 ++++++++++-----------
- lib/ns-pkcs11/tests/Makefile.in  | 12 +++++-----
- make/includes.in                 |  7 ++++++
- 11 files changed, 100 insertions(+), 70 deletions(-)
-
-diff --git a/bin/Makefile.in b/bin/Makefile.in
-index 9ad7f62..094775a 100644
---- a/bin/Makefile.in
-+++ b/bin/Makefile.in
-@@ -11,7 +11,7 @@ srcdir =	@srcdir@
- VPATH =		@srcdir@
- top_srcdir =	@top_srcdir@
- 
--SUBDIRS =	named rndc dig delv dnssec tools nsupdate check confgen \
-+SUBDIRS =	named named-pkcs11 rndc dig delv dnssec dnssec-pkcs11 tools nsupdate check confgen \
- 		@NZD_TOOLS@ @PYTHON_TOOLS@ @PKCS11_TOOLS@ plugins tests
- TARGETS =
- 
-diff --git a/bin/confgen/Makefile.in b/bin/confgen/Makefile.in
-index c126bf3..1b7512d 100644
---- a/bin/confgen/Makefile.in
-+++ b/bin/confgen/Makefile.in
-@@ -22,7 +22,7 @@ VERSION=@BIND9_VERSION@
- CINCLUDES = -I${srcdir}/include ${ISC_INCLUDES} ${ISCCC_INCLUDES} \
- 	${ISCCFG_INCLUDES} ${DNS_INCLUDES} ${BIND9_INCLUDES}
- 
--CDEFINES = @USE_PKCS11@
-+CDEFINES =
- CWARNINGS =
- 
- ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
-diff --git a/bin/dnssec-pkcs11/Makefile.in b/bin/dnssec-pkcs11/Makefile.in
-index ace0e5a..e0f6a00 100644
---- a/bin/dnssec-pkcs11/Makefile.in
-+++ b/bin/dnssec-pkcs11/Makefile.in
-@@ -15,18 +15,18 @@ VERSION=@BIND9_VERSION@
- 
- @BIND9_MAKE_INCLUDES@
- 
--CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} ${ISCCFG_INCLUDES} \
-+CINCLUDES =	${DNS_PKCS11_INCLUDES} ${ISC_INCLUDES} ${ISCCFG_INCLUDES} \
- 		${OPENSSL_CFLAGS}
- 
--CDEFINES =	-DVERSION=\"${VERSION}\" -DNAMED_CONFFILE=\"${sysconfdir}/named.conf\"
-+CDEFINES =	-DVERSION=\"${VERSION}\" -DNAMED_CONFFILE=\"${sysconfdir}/named.conf\" -DUSE_PKCS11=1
- CWARNINGS =
- 
--DNSLIBS =	../../lib/dns/libdns.@A@ @NO_LIBTOOL_DNSLIBS@
-+DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ @NO_LIBTOOL_DNSLIBS@
- ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
- ISCLIBS =	../../lib/isc/libisc.@A@ @NO_LIBTOOL_ISCLIBS@
- ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @NO_LIBTOOL_ISCLIBS@
- 
--DNSDEPLIBS =	../../lib/dns/libdns.@A@
-+DNSDEPLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@
- ISCDEPLIBS =	../../lib/isc/libisc.@A@
- ISCCFGDEPLIBS =	../../lib/isccfg/libisccfg.@A@
- 
-@@ -36,12 +36,15 @@ LIBS =		${DNSLIBS} ${ISCCFGLIBS} ${ISCLIBS} @LIBS@
- 
- NOSYMLIBS =	${DNSLIBS} ${ISCCFGLIBS} ${ISCNOSYMLIBS} @LIBS@
- 
-+# Add suffix to all targets
-+EXEEXT =	-pkcs11@EXEEXT@
-+
- # Alphabetically
--TARGETS =	dnssec-cds@EXEEXT@ dnssec-dsfromkey@EXEEXT@ \
--		dnssec-importkey@EXEEXT@ dnssec-keyfromlabel@EXEEXT@ \
--		dnssec-keygen@EXEEXT@ dnssec-revoke@EXEEXT@ \
--		dnssec-settime@EXEEXT@ dnssec-signzone@EXEEXT@ \
--		dnssec-verify@EXEEXT@
-+TARGETS =	dnssec-cds${EXEEXT} dnssec-dsfromkey${EXEEXT} \
-+		dnssec-importkey${EXEEXT} dnssec-keyfromlabel${EXEEXT} \
-+		dnssec-keygen${EXEEXT} dnssec-revoke${EXEEXT} \
-+		dnssec-settime${EXEEXT} dnssec-signzone${EXEEXT} \
-+		dnssec-verify${EXEEXT}
- 
- OBJS =		dnssectool.@O@
- 
-@@ -52,19 +55,19 @@ SRCS =		dnssec-cds.c dnssec-dsfromkey.c dnssec-importkey.c \
- 
- @BIND9_MAKE_RULES@
- 
--dnssec-cds@EXEEXT@: dnssec-cds.@O@ ${OBJS} ${DEPLIBS}
-+dnssec-cds-pkcs11@EXEEXT@: dnssec-cds.@O@ ${OBJS} ${DEPLIBS}
- 	export BASEOBJS="dnssec-cds.@O@ ${OBJS}"; \
- 	${FINALBUILDCMD}
- 
--dnssec-dsfromkey@EXEEXT@: dnssec-dsfromkey.@O@ ${OBJS} ${DEPLIBS}
-+dnssec-dsfromkey-pkcs11@EXEEXT@: dnssec-dsfromkey.@O@ ${OBJS} ${DEPLIBS}
- 	export BASEOBJS="dnssec-dsfromkey.@O@ ${OBJS}"; \
- 	${FINALBUILDCMD}
- 
--dnssec-keyfromlabel@EXEEXT@: dnssec-keyfromlabel.@O@ ${OBJS} ${DEPLIBS}
-+dnssec-keyfromlabel-pkcs11@EXEEXT@: dnssec-keyfromlabel.@O@ ${OBJS} ${DEPLIBS}
- 	export BASEOBJS="dnssec-keyfromlabel.@O@ ${OBJS}"; \
- 	${FINALBUILDCMD}
- 
--dnssec-keygen@EXEEXT@: dnssec-keygen.@O@ ${OBJS} ${DEPLIBS}
-+dnssec-keygen-pkcs11@EXEEXT@: dnssec-keygen.@O@ ${OBJS} ${DEPLIBS}
- 	export BASEOBJS="dnssec-keygen.@O@ ${OBJS}"; \
- 	${FINALBUILDCMD}
- 
-@@ -72,7 +75,7 @@ dnssec-signzone.@O@: dnssec-signzone.c
- 	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} -DVERSION=\"${VERSION}\" \
- 		-c ${srcdir}/dnssec-signzone.c
- 
--dnssec-signzone@EXEEXT@: dnssec-signzone.@O@ ${OBJS} ${DEPLIBS}
-+dnssec-signzone-pkcs11@EXEEXT@: dnssec-signzone.@O@ ${OBJS} ${DEPLIBS}
- 	export BASEOBJS="dnssec-signzone.@O@ ${OBJS}"; \
- 	${FINALBUILDCMD}
- 
-@@ -80,19 +83,19 @@ dnssec-verify.@O@: dnssec-verify.c
- 	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} -DVERSION=\"${VERSION}\" \
- 		-c ${srcdir}/dnssec-verify.c
- 
--dnssec-verify@EXEEXT@: dnssec-verify.@O@ ${OBJS} ${DEPLIBS}
-+dnssec-verify-pkcs11@EXEEXT@: dnssec-verify.@O@ ${OBJS} ${DEPLIBS}
- 	export BASEOBJS="dnssec-verify.@O@ ${OBJS}"; \
- 	${FINALBUILDCMD}
- 
--dnssec-revoke@EXEEXT@: dnssec-revoke.@O@ ${OBJS} ${DEPLIBS}
-+dnssec-revoke-pkcs11@EXEEXT@: dnssec-revoke.@O@ ${OBJS} ${DEPLIBS}
- 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \
- 	dnssec-revoke.@O@ ${OBJS} ${LIBS}
- 
--dnssec-settime@EXEEXT@: dnssec-settime.@O@ ${OBJS} ${DEPLIBS}
-+dnssec-settime-pkcs11@EXEEXT@: dnssec-settime.@O@ ${OBJS} ${DEPLIBS}
- 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \
- 	dnssec-settime.@O@ ${OBJS} ${LIBS}
- 
--dnssec-importkey@EXEEXT@: dnssec-importkey.@O@ ${OBJS} ${DEPLIBS}
-+dnssec-importkey-pkcs11@EXEEXT@: dnssec-importkey.@O@ ${OBJS} ${DEPLIBS}
- 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \
- 	dnssec-importkey.@O@ ${OBJS} ${LIBS}
- 
-diff --git a/bin/named-pkcs11/Makefile.in b/bin/named-pkcs11/Makefile.in
-index debb906..ecfdb6c 100644
---- a/bin/named-pkcs11/Makefile.in
-+++ b/bin/named-pkcs11/Makefile.in
-@@ -37,13 +37,14 @@ DBDRIVER_LIBS =
- 
- DLZ_DRIVER_DIR =	${top_srcdir}/contrib/dlz/drivers
- 
--DLZDRIVER_OBJS =	@DLZ_DRIVER_OBJS@
--DLZDRIVER_SRCS =	@DLZ_DRIVER_SRCS@
--DLZDRIVER_INCLUDES =	@DLZ_DRIVER_INCLUDES@
--DLZDRIVER_LIBS =	@DLZ_DRIVER_LIBS@
-+# Skip building on PKCS11 variant
-+DLZDRIVER_OBJS =
-+DLZDRIVER_SRCS =
-+DLZDRIVER_INCLUDES =
-+DLZDRIVER_LIBS =
- 
- CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
--		${NS_INCLUDES} ${DNS_INCLUDES} \
-+		${NS_PKCS11_INCLUDES} ${DNS_PKCS11_INCLUDES} \
- 		${BIND9_INCLUDES} ${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} \
- 		${ISC_INCLUDES} ${DLZDRIVER_INCLUDES} \
- 		${DBDRIVER_INCLUDES} \
-@@ -56,24 +57,24 @@ CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
- 		${LIBXML2_CFLAGS} \
- 		${MAXMINDDB_CFLAGS}
- 
--CDEFINES =      @CONTRIB_DLZ@
-+CDEFINES =
- 
- CWARNINGS =
- 
--DNSLIBS =	../../lib/dns/libdns.@A@ @NO_LIBTOOL_DNSLIBS@
-+DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ @NO_LIBTOOL_DNSLIBS@
- ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
- ISCCCLIBS =	../../lib/isccc/libisccc.@A@
- ISCLIBS =	../../lib/isc/libisc.@A@ @NO_LIBTOOL_ISCLIBS@
- ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @NO_LIBTOOL_ISCLIBS@
- BIND9LIBS =	../../lib/bind9/libbind9.@A@
--NSLIBS =	../../lib/ns/libns.@A@
-+NSLIBS =	../../lib/ns-pkcs11/libns-pkcs11.@A@
- 
--DNSDEPLIBS =	../../lib/dns/libdns.@A@
-+DNSDEPLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@
- ISCCFGDEPLIBS =	../../lib/isccfg/libisccfg.@A@
- ISCCCDEPLIBS =	../../lib/isccc/libisccc.@A@
- ISCDEPLIBS =	../../lib/isc/libisc.@A@
- BIND9DEPLIBS =	../../lib/bind9/libbind9.@A@
--NSDEPLIBS =	../../lib/ns/libns.@A@
-+NSDEPLIBS =	../../lib/ns-pkcs11/libns-pkcs11.@A@
- 
- DEPLIBS =	${NSDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
- 		${ISCCFGDEPLIBS} ${ISCCCDEPLIBS} ${ISCDEPLIBS}
-@@ -93,7 +94,7 @@ NOSYMLIBS =	${NSLIBS} ${DNSLIBS} ${BIND9LIBS} \
- 
- SUBDIRS =	unix
- 
--TARGETS =	named@EXEEXT@
-+TARGETS =	named-pkcs11@EXEEXT@
- 
- GEOIP2LINKOBJS = geoip.@O@
- 
-@@ -151,7 +152,7 @@ server.@O@: server.c
- 		-DPRODUCT=\"${PRODUCT}\" \
- 		-DVERSION=\"${VERSION}\" -c ${srcdir}/server.c
- 
--named@EXEEXT@: ${OBJS} ${DEPLIBS}
-+named-pkcs11@EXEEXT@: ${OBJS} ${DEPLIBS}
- 	export MAKE_SYMTABLE="yes"; \
- 	export BASEOBJS="${OBJS} ${UOBJS}"; \
- 	${FINALBUILDCMD}
-@@ -170,11 +171,11 @@ statschannel.@O@: bind9.xsl.h
- installdirs:
- 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
- 
--install:: named@EXEEXT@ installdirs
--	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named@EXEEXT@ ${DESTDIR}${sbindir}
-+install:: named-pkcs11@EXEEXT@ installdirs
-+	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named-pkcs11@EXEEXT@ ${DESTDIR}${sbindir}
- 
- uninstall::
--	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/named@EXEEXT@
-+	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/named-pkcs11@EXEEXT@
- 
- @DLZ_DRIVER_RULES@
- 
-diff --git a/configure.ac b/configure.ac
-index e405eaf..efaa5a7 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -1269,12 +1269,14 @@ AC_SUBST(USE_GSSAPI)
- AC_SUBST(DST_GSSAPI_INC)
- AC_SUBST(DNS_GSSAPI_LIBS)
- DNS_CRYPTO_LIBS="$DNS_GSSAPI_LIBS"
-+DNS_CRYPTO_PK11_LIBS="$DNS_GSSAPI_LIBS $DNS_CRYPTO_PK11_LIBS"
- 
- #
- # Applications linking with libdns also need to link with these libraries.
- #
- 
- AC_SUBST(DNS_CRYPTO_LIBS)
-+AC_SUBST(DNS_CRYPTO_PK11_LIBS)
- 
- #
- # was --with-lmdb specified?
-@@ -2345,6 +2347,8 @@ AC_SUBST(BIND9_DNS_BUILDINCLUDE)
- AC_SUBST(BIND9_NS_BUILDINCLUDE)
- AC_SUBST(BIND9_BIND9_BUILDINCLUDE)
- AC_SUBST(BIND9_IRS_BUILDINCLUDE)
-+AC_SUBST(BIND9_DNS_PKCS11_BUILDINCLUDE)
-+AC_SUBST(BIND9_NS_PKCS11_BUILDINCLUDE)
- if test "X$srcdir" != "X"; then
- 	BIND9_ISC_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/isc/include"
- 	BIND9_ISCCC_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/isccc/include"
-@@ -2353,6 +2357,8 @@ if test "X$srcdir" != "X"; then
- 	BIND9_NS_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/ns/include"
- 	BIND9_BIND9_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/bind9/include"
- 	BIND9_IRS_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/irs/include"
-+	BIND9_DNS_PKCS11_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/dns-pkcs11/include"
-+	BIND9_NS_PKCS11_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/ns-pkcs11/include"
- else
- 	BIND9_ISC_BUILDINCLUDE=""
- 	BIND9_ISCCC_BUILDINCLUDE=""
-@@ -2361,6 +2367,8 @@ else
- 	BIND9_NS_BUILDINCLUDE=""
- 	BIND9_BIND9_BUILDINCLUDE=""
- 	BIND9_IRS_BUILDINCLUDE=""
-+	BIND9_DNS_PKCS11_BUILDINCLUDE=""
-+	BIND9_NS_PKCS11_BUILDINCLUDE=""
- fi
- 
- AC_SUBST_FILE(BIND9_MAKE_INCLUDES)
-@@ -2816,8 +2824,11 @@ AC_CONFIG_FILES([
- 	bin/delv/Makefile
- 	bin/dig/Makefile
- 	bin/dnssec/Makefile
-+	bin/dnssec-pkcs11/Makefile
- 	bin/named/Makefile
- 	bin/named/unix/Makefile
-+	bin/named-pkcs11/Makefile
-+	bin/named-pkcs11/unix/Makefile
- 	bin/nsupdate/Makefile
- 	bin/pkcs11/Makefile
- 	bin/plugins/Makefile
-@@ -2879,6 +2890,10 @@ AC_CONFIG_FILES([
- 	lib/dns/include/dns/Makefile
- 	lib/dns/include/dst/Makefile
- 	lib/dns/tests/Makefile
-+	lib/dns-pkcs11/Makefile
-+	lib/dns-pkcs11/include/Makefile
-+	lib/dns-pkcs11/include/dns/Makefile
-+	lib/dns-pkcs11/include/dst/Makefile
- 	lib/irs/Makefile
- 	lib/irs/include/Makefile
- 	lib/irs/include/irs/Makefile
-@@ -2911,6 +2926,10 @@ AC_CONFIG_FILES([
- 	lib/ns/include/Makefile
- 	lib/ns/include/ns/Makefile
- 	lib/ns/tests/Makefile
-+	lib/ns-pkcs11/Makefile
-+	lib/ns-pkcs11/include/Makefile
-+	lib/ns-pkcs11/include/ns/Makefile
-+	lib/ns-pkcs11/tests/Makefile
- 	make/Makefile
- 	make/mkdep
- 	unit/unittest.sh
-diff --git a/lib/Makefile.in b/lib/Makefile.in
-index 833964e..058ba2f 100644
---- a/lib/Makefile.in
-+++ b/lib/Makefile.in
-@@ -15,7 +15,7 @@ top_srcdir =	@top_srcdir@
- # Attempt to disable parallel processing.
- .NOTPARALLEL:
- .NO_PARALLEL:
--SUBDIRS =	isc isccc dns ns isccfg bind9 irs
-+SUBDIRS =	isc isccc dns dns-pkcs11 ns ns-pkcs11 isccfg bind9 irs
- TARGETS =
- 
- @BIND9_MAKE_RULES@
-diff --git a/lib/dns-pkcs11/Makefile.in b/lib/dns-pkcs11/Makefile.in
-index 58bda3c..d6a45df 100644
---- a/lib/dns-pkcs11/Makefile.in
-+++ b/lib/dns-pkcs11/Makefile.in
-@@ -22,7 +22,7 @@ VERSION=@BIND9_VERSION@
- 
- @BIND9_MAKE_INCLUDES@
- 
--CINCLUDES =	-I. -I${top_srcdir}/lib/dns -Iinclude ${DNS_INCLUDES} \
-+CINCLUDES =	-I. -I${top_srcdir}/lib/dns-pkcs11 -Iinclude ${DNS_PKCS11_INCLUDES} \
- 		${ISC_INCLUDES} \
- 		${FSTRM_CFLAGS} \
- 		${OPENSSL_CFLAGS} @DST_GSSAPI_INC@ \
-@@ -32,7 +32,7 @@ CINCLUDES =	-I. -I${top_srcdir}/lib/dns -Iinclude ${DNS_INCLUDES} \
- 		${LMDB_CFLAGS} \
- 		${MAXMINDDB_CFLAGS}
- 
--CDEFINES =	@USE_GSSAPI@
-+CDEFINES =	@USE_GSSAPI@ @USE_PKCS11@
- 
- CWARNINGS =
- 
-@@ -135,15 +135,15 @@ version.@O@: version.c
- 		-DMAPAPI=\"${MAPAPI}\" \
- 		-c ${srcdir}/version.c
- 
--libdns.@SA@: ${OBJS}
-+libdns-pkcs11.@SA@: ${OBJS}
- 	${AR} ${ARFLAGS} $@ ${OBJS}
- 	${RANLIB} $@
- 
--libdns.la: ${OBJS}
-+libdns-pkcs11.la: ${OBJS}
- 	${LIBTOOL_MODE_LINK} \
--		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libdns.la -rpath ${libdir} \
-+		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libdns-pkcs11.la -rpath ${libdir} \
- 		-release "${VERSION}" \
--		${OBJS} ${ISCLIBS} @DNS_CRYPTO_LIBS@ ${LIBS}
-+		${OBJS} ${ISCLIBS} @DNS_CRYPTO_PK11_LIBS@ ${LIBS}
- 
- include: gen
- 	${MAKE} include/dns/enumtype.h
-@@ -174,22 +174,22 @@ gen: gen.c
- 	${BUILD_CPPFLAGS} ${BUILD_LDFLAGS} -o $@ ${srcdir}/gen.c \
- 	${BUILD_LIBS} ${LFS_LIBS}
- 
--timestamp: include libdns.@A@
-+timestamp: include libdns-pkcs11.@A@
- 	touch timestamp
- 
--testdirs: libdns.@A@
-+testdirs: libdns-pkcs11.@A@
- 
- installdirs:
- 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${libdir}
- 
- install:: timestamp installdirs
--	${LIBTOOL_MODE_INSTALL} ${INSTALL_LIBRARY} libdns.@A@ ${DESTDIR}${libdir}
-+	${LIBTOOL_MODE_INSTALL} ${INSTALL_LIBRARY} libdns-pkcs11.@A@ ${DESTDIR}${libdir}
- 
- uninstall::
--	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${libdir}/libdns.@A@
-+	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${libdir}/libdns-pkcs11.@A@
- 
- clean distclean::
--	rm -f libdns.@A@ timestamp
-+	rm -f libdns-pkcs11.@A@ timestamp
- 	rm -f gen code.h include/dns/enumtype.h include/dns/enumclass.h
- 	rm -f include/dns/rdatastruct.h
- 	rm -f dnstap.pb-c.c dnstap.pb-c.h
-diff --git a/lib/dns-pkcs11/tests/Makefile.in b/lib/dns-pkcs11/tests/Makefile.in
-index da91394..aadb73f 100644
---- a/lib/dns-pkcs11/tests/Makefile.in
-+++ b/lib/dns-pkcs11/tests/Makefile.in
-@@ -15,15 +15,15 @@ VERSION=@BIND9_VERSION@
- 
- @BIND9_MAKE_INCLUDES@
- 
--CINCLUDES =	-I. -Iinclude ${DNS_INCLUDES} ${ISC_INCLUDES} \
-+CINCLUDES =	-I. -Iinclude ${DNS_PKCS11_INCLUDES} ${ISC_INCLUDES} \
- 		${FSTRM_CFLAGS} ${OPENSSL_CFLAGS} \
- 		${PROTOBUF_C_CFLAGS} ${MAXMINDDB_CFLAGS} @CMOCKA_CFLAGS@
--CDEFINES =	-DTESTS="\"${top_builddir}/lib/dns/tests/\""
-+CDEFINES =	@USE_PKCS11@ -DTESTS="\"${top_builddir}/lib/dns-pkcs11/tests/\""
- 
- ISCLIBS =	../../isc/libisc.@A@ @NO_LIBTOOL_ISCLIBS@
- ISCDEPLIBS =	../../isc/libisc.@A@
--DNSLIBS =	../libdns.@A@ @NO_LIBTOOL_DNSLIBS@
--DNSDEPLIBS =	../libdns.@A@
-+DNSLIBS =	../libdns-pkcs11.@A@ @NO_LIBTOOL_DNSLIBS@
-+DNSDEPLIBS =	../libdns-pkcs11.@A@
- 
- LIBS =		@LIBS@ @CMOCKA_LIBS@
- 
-diff --git a/lib/ns-pkcs11/Makefile.in b/lib/ns-pkcs11/Makefile.in
-index bc683ce..7a9d2f2 100644
---- a/lib/ns-pkcs11/Makefile.in
-+++ b/lib/ns-pkcs11/Makefile.in
-@@ -16,12 +16,12 @@ VERSION=@BIND9_VERSION@
- 
- @BIND9_MAKE_INCLUDES@
- 
--CINCLUDES =	-I. -I${top_srcdir}/lib/ns -Iinclude \
--		${NS_INCLUDES} ${DNS_INCLUDES} ${ISC_INCLUDES} \
-+CINCLUDES =	-I. -I${top_srcdir}/lib/ns-pkcs11 -Iinclude \
-+		${NS_PKCS11_INCLUDES} ${DNS_PKCS11_INCLUDES} ${ISC_INCLUDES} \
- 		${OPENSSL_CFLAGS} @DST_GSSAPI_INC@ \
- 		${FSTRM_CFLAGS}
- 
--CDEFINES =	-DNAMED_PLUGINDIR=\"${plugindir}\"
-+CDEFINES =	@USE_PKCS11@ -DNAMED_PLUGINDIR=\"${plugindir}\"
- 
- CWARNINGS =
- 
-@@ -29,9 +29,9 @@ ISCLIBS =	../../lib/isc/libisc.@A@
- 
- ISCDEPLIBS =	../../lib/isc/libisc.@A@
- 
--DNSLIBS =	../../lib/dns/libdns.@A@ @NO_LIBTOOL_DNSLIBS@
-+DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ @NO_LIBTOOL_DNSLIBS@
- 
--DNSDEPLIBS =	../../lib/dns/libdns.@A@
-+DNSDEPLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@
- 
- LIBS =		@LIBS@
- 
-@@ -60,28 +60,28 @@ version.@O@: version.c
- 		-DMAJOR=\"${MAJOR}\" \
- 		-c ${srcdir}/version.c
- 
--libns.@SA@: ${OBJS}
-+libns-pkcs11.@SA@: ${OBJS}
- 	${AR} ${ARFLAGS} $@ ${OBJS}
- 	${RANLIB} $@
- 
--libns.la: ${OBJS}
-+libns-pkcs11.la: ${OBJS}
- 	${LIBTOOL_MODE_LINK} \
--		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libns.la -rpath ${libdir} \
-+		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libns-pkcs11.la -rpath ${libdir} \
- 		-release "${VERSION}" \
--		${OBJS} ${ISCLIBS} ${DNSLIBS} @DNS_CRYPTO_LIBS@ ${LIBS}
-+		${OBJS} ${ISCLIBS} ${DNSLIBS} @DNS_CRYPTO_PK11_LIBS@ ${LIBS}
- 
--timestamp: libns.@A@
-+timestamp: libns-pkcs11.@A@
- 	touch timestamp
- 
- installdirs:
- 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${libdir}
- 
- install:: timestamp installdirs
--	${LIBTOOL_MODE_INSTALL} ${INSTALL_LIBRARY} libns.@A@ \
-+	${LIBTOOL_MODE_INSTALL} ${INSTALL_LIBRARY} libns-pkcs11.@A@ \
- 		${DESTDIR}${libdir}
- 
- uninstall::
--	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${libdir}/libns.@A@
-+	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${libdir}/libns-pkcs11.@A@
- 
- clean distclean::
--	rm -f libns.@A@ timestamp
-+	rm -f libns-pkcs11.@A@ timestamp
-diff --git a/lib/ns-pkcs11/tests/Makefile.in b/lib/ns-pkcs11/tests/Makefile.in
-index 4c3e694..c1b6d99 100644
---- a/lib/ns-pkcs11/tests/Makefile.in
-+++ b/lib/ns-pkcs11/tests/Makefile.in
-@@ -17,17 +17,17 @@ VERSION=@BIND9_VERSION@
- 
- WRAP_OPTIONS =	-Wl,--wrap=isc__nmhandle_detach -Wl,--wrap=isc__nmhandle_attach
- 
--CINCLUDES =	-I. -Iinclude ${NS_INCLUDES} ${DNS_INCLUDES} ${ISC_INCLUDES} \
-+CINCLUDES =	-I. -Iinclude ${NS_PKCS11_INCLUDES} ${DNS_PKCS11_INCLUDES} ${ISC_INCLUDES} \
- 		${OPENSSL_CFLAGS} \
- 		@CMOCKA_CFLAGS@
--CDEFINES =	-DTESTS="\"${top_builddir}/lib/ns/tests/\"" -DNAMED_PLUGINDIR=\"${plugindir}\"
-+CDEFINES =	-DTESTS="\"${top_builddir}/lib/ns-pkcs11/tests/\"" -DNAMED_PLUGINDIR=\"${plugindir}\" @USE_PKCS11@
- 
- ISCLIBS =	../../isc/libisc.@A@ @NO_LIBTOOL_ISCLIBS@
- ISCDEPLIBS =	../../isc/libisc.@A@
--DNSLIBS =	../../dns/libdns.@A@ @NO_LIBTOOL_DNSLIBS@
--DNSDEPLIBS =	../../dns/libdns.@A@
--NSLIBS =	../libns.@A@
--NSDEPLIBS =	../libns.@A@
-+DNSLIBS =	../../dns-pkcs11/libdns-pkcs11.@A@ @NO_LIBTOOL_DNSLIBS@
-+DNSDEPLIBS =	../../dns-pkcs11/libdns-pkcs11.@A@
-+NSLIBS =	../libns-pkcs11.@A@
-+NSDEPLIBS =	../libns-pkcs11.@A@
- 
- LIBS =		@LIBS@ @CMOCKA_LIBS@
- 
-diff --git a/make/includes.in b/make/includes.in
-index b8317d3..b73b0c4 100644
---- a/make/includes.in
-+++ b/make/includes.in
-@@ -39,3 +39,10 @@ BIND9_INCLUDES = @BIND9_BIND9_BUILDINCLUDE@ \
- 
- TEST_INCLUDES = \
- 	-I${top_srcdir}/lib/tests/include
-+
-+DNS_PKCS11_INCLUDES = @BIND9_DNS_PKCS11_BUILDINCLUDE@ \
-+	-I${top_srcdir}/lib/dns-pkcs11/include
-+
-+NS_PKCS11_INCLUDES = @BIND9_NS_PKCS11_BUILDINCLUDE@ \
-+	-I${top_srcdir}/lib/ns-pkcs11/include
-+
--- 
-2.31.1
-
diff --git a/bind-9.11-fips-tests.patch b/bind-9.11-fips-tests.patch
index 651db2a..6fae234 100644
--- a/bind-9.11-fips-tests.patch
+++ b/bind-9.11-fips-tests.patch
@@ -1,4 +1,4 @@
-From 9575852be2344244ac182d7d019869406d3bd963 Mon Sep 17 00:00:00 2001
+From 8bbfacc1a90301a71a487e776db071fa2ef6c8dd Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 2 Aug 2018 23:46:45 +0200
 Subject: [PATCH] FIPS tests changes
@@ -73,8 +73,6 @@ Date:   Wed Mar 7 10:44:23 2018 +0100
  .../system/allow-query/ns2/named40.conf.in    |  4 +-
  bin/tests/system/allow-query/tests.sh         | 18 ++---
  bin/tests/system/catz/ns1/named.conf.in       |  2 +-
- bin/tests/system/catz/ns2/named1.conf.in      |  2 +-
- bin/tests/system/catz/ns2/named2.conf.in      |  2 +-
  bin/tests/system/checkconf/bad-tsig.conf      |  2 +-
  bin/tests/system/checkconf/good.conf          |  2 +-
  bin/tests/system/feature-test.c               | 14 ++++
@@ -83,23 +81,21 @@ Date:   Wed Mar 7 10:44:23 2018 +0100
  bin/tests/system/nsupdate/ns1/named.conf.in   |  2 +-
  bin/tests/system/nsupdate/ns2/named.conf.in   |  2 +-
  bin/tests/system/nsupdate/setup.sh            |  6 +-
- bin/tests/system/nsupdate/tests.sh            | 15 +++--
+ bin/tests/system/nsupdate/tests.sh            | 11 ++-
  bin/tests/system/rndc/setup.sh                |  2 +-
- bin/tests/system/rndc/tests.sh                | 23 ++++---
+ bin/tests/system/rndc/tests.sh                | 22 +++---
  bin/tests/system/tsig/ns1/named.conf.in       | 10 +--
- bin/tests/system/tsig/ns1/rndc5.conf.in       | 10 +++
  bin/tests/system/tsig/setup.sh                |  5 ++
- bin/tests/system/tsig/tests.sh                | 65 ++++++++++++-------
+ bin/tests/system/tsig/tests.sh                | 67 ++++++++++++-------
  bin/tests/system/upforwd/ns1/named.conf.in    |  2 +-
  bin/tests/system/upforwd/tests.sh             |  2 +-
- 34 files changed, 163 insertions(+), 109 deletions(-)
- create mode 100644 bin/tests/system/tsig/ns1/rndc5.conf.in
+ 31 files changed, 149 insertions(+), 106 deletions(-)
 
 diff --git a/bin/tests/system/acl/ns2/named1.conf.in b/bin/tests/system/acl/ns2/named1.conf.in
-index 60f22e1..249f672 100644
+index 745048a..93cb411 100644
 --- a/bin/tests/system/acl/ns2/named1.conf.in
 +++ b/bin/tests/system/acl/ns2/named1.conf.in
-@@ -33,12 +33,12 @@ options {
+@@ -35,12 +35,12 @@ options {
  };
  
  key one {
@@ -115,10 +111,10 @@ index 60f22e1..249f672 100644
  };
  
 diff --git a/bin/tests/system/acl/ns2/named2.conf.in b/bin/tests/system/acl/ns2/named2.conf.in
-index ada97bc..f82d858 100644
+index 21aa991..78e71cc 100644
 --- a/bin/tests/system/acl/ns2/named2.conf.in
 +++ b/bin/tests/system/acl/ns2/named2.conf.in
-@@ -33,12 +33,12 @@ options {
+@@ -35,12 +35,12 @@ options {
  };
  
  key one {
@@ -134,10 +130,10 @@ index ada97bc..f82d858 100644
  };
  
 diff --git a/bin/tests/system/acl/ns2/named3.conf.in b/bin/tests/system/acl/ns2/named3.conf.in
-index 97684e4..de6a2e9 100644
+index 3208c92..bed6325 100644
 --- a/bin/tests/system/acl/ns2/named3.conf.in
 +++ b/bin/tests/system/acl/ns2/named3.conf.in
-@@ -33,17 +33,17 @@ options {
+@@ -35,17 +35,17 @@ options {
  };
  
  key one {
@@ -159,28 +155,9 @@ index 97684e4..de6a2e9 100644
  };
  
 diff --git a/bin/tests/system/acl/ns2/named4.conf.in b/bin/tests/system/acl/ns2/named4.conf.in
-index 462b3fa..994b35c 100644
+index 14e82ed..a22cafe 100644
 --- a/bin/tests/system/acl/ns2/named4.conf.in
 +++ b/bin/tests/system/acl/ns2/named4.conf.in
-@@ -33,12 +33,12 @@ options {
- };
- 
- key one {
--	algorithm hmac-md5;
-+	algorithm hmac-sha256;
- 	secret "1234abcd8765";
- };
- 
- key two {
--	algorithm hmac-md5;
-+	algorithm hmac-sha256;
- 	secret "1234abcd8765";
- };
- 
-diff --git a/bin/tests/system/acl/ns2/named5.conf.in b/bin/tests/system/acl/ns2/named5.conf.in
-index 728da58..8f00d09 100644
---- a/bin/tests/system/acl/ns2/named5.conf.in
-+++ b/bin/tests/system/acl/ns2/named5.conf.in
 @@ -35,12 +35,12 @@ options {
  };
  
@@ -196,11 +173,30 @@ index 728da58..8f00d09 100644
  	secret "1234abcd8765";
  };
  
+diff --git a/bin/tests/system/acl/ns2/named5.conf.in b/bin/tests/system/acl/ns2/named5.conf.in
+index f43f33c..f4a865a 100644
+--- a/bin/tests/system/acl/ns2/named5.conf.in
++++ b/bin/tests/system/acl/ns2/named5.conf.in
+@@ -37,12 +37,12 @@ options {
+ };
+ 
+ key one {
+-	algorithm hmac-md5;
++	algorithm hmac-sha256;
+ 	secret "1234abcd8765";
+ };
+ 
+ key two {
+-	algorithm hmac-md5;
++	algorithm hmac-sha256;
+ 	secret "1234abcd8765";
+ };
+ 
 diff --git a/bin/tests/system/acl/tests.sh b/bin/tests/system/acl/tests.sh
-index be59d64..13d5bdc 100644
+index 9ee3984..f7d4388 100644
 --- a/bin/tests/system/acl/tests.sh
 +++ b/bin/tests/system/acl/tests.sh
-@@ -22,14 +22,14 @@ echo_i "testing basic ACL processing"
+@@ -23,14 +23,14 @@ echo_i "testing basic ACL processing"
  # key "one" should fail
  t=`expr $t + 1`
  $DIG $DIGOPTS tsigzone. \
@@ -217,7 +213,7 @@ index be59d64..13d5bdc 100644
  grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
  
  copy_setports ns2/named2.conf.in ns2/named.conf
-@@ -39,18 +39,18 @@ sleep 5
+@@ -40,18 +40,18 @@ sleep 5
  # prefix 10/8 should fail
  t=`expr $t + 1`
  $DIG $DIGOPTS tsigzone. \
@@ -239,7 +235,7 @@ index be59d64..13d5bdc 100644
  grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
  
  echo_i "testing nested ACL processing"
-@@ -62,31 +62,31 @@ sleep 5
+@@ -63,31 +63,31 @@ sleep 5
  # should succeed
  t=`expr $t + 1`
  $DIG $DIGOPTS tsigzone. \
@@ -276,7 +272,7 @@ index be59d64..13d5bdc 100644
  grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
  
  t=`expr $t + 1`
-@@ -97,7 +97,7 @@ grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $tt failed" ; status=1
+@@ -98,7 +98,7 @@ grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $tt failed" ; status=1
  # and other values? right out
  t=`expr $t + 1`
  $DIG $DIGOPTS tsigzone. \
@@ -285,7 +281,7 @@ index be59d64..13d5bdc 100644
  grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
  
  # now we only allow 10.53.0.1 *and* key one, or 10.53.0.2 *and* key two
-@@ -108,31 +108,31 @@ sleep 5
+@@ -109,31 +109,31 @@ sleep 5
  # should succeed
  t=`expr $t + 1`
  $DIG $DIGOPTS tsigzone. \
@@ -323,10 +319,10 @@ index be59d64..13d5bdc 100644
  
  echo_i "testing allow-query-on ACL processing"
 diff --git a/bin/tests/system/allow-query/ns2/named10.conf.in b/bin/tests/system/allow-query/ns2/named10.conf.in
-index 7d43e36..f7b25f9 100644
+index b91d19a..7d777c2 100644
 --- a/bin/tests/system/allow-query/ns2/named10.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named10.conf.in
-@@ -10,7 +10,7 @@
+@@ -12,7 +12,7 @@
   */
  
  key one {
@@ -336,10 +332,10 @@ index 7d43e36..f7b25f9 100644
  };
  
 diff --git a/bin/tests/system/allow-query/ns2/named11.conf.in b/bin/tests/system/allow-query/ns2/named11.conf.in
-index 2952518..121557e 100644
+index 308c4ca..00f6f40 100644
 --- a/bin/tests/system/allow-query/ns2/named11.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named11.conf.in
-@@ -10,12 +10,12 @@
+@@ -12,12 +12,12 @@
   */
  
  key one {
@@ -355,10 +351,10 @@ index 2952518..121557e 100644
  };
  
 diff --git a/bin/tests/system/allow-query/ns2/named12.conf.in b/bin/tests/system/allow-query/ns2/named12.conf.in
-index 0c01071..ceabbb5 100644
+index 6b0fe55..491e514 100644
 --- a/bin/tests/system/allow-query/ns2/named12.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named12.conf.in
-@@ -10,7 +10,7 @@
+@@ -12,7 +12,7 @@
   */
  
  key one {
@@ -368,10 +364,10 @@ index 0c01071..ceabbb5 100644
  };
  
 diff --git a/bin/tests/system/allow-query/ns2/named30.conf.in b/bin/tests/system/allow-query/ns2/named30.conf.in
-index 4c17292..9cd9d1f 100644
+index aefc474..7c06596 100644
 --- a/bin/tests/system/allow-query/ns2/named30.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named30.conf.in
-@@ -10,7 +10,7 @@
+@@ -12,7 +12,7 @@
   */
  
  key one {
@@ -381,10 +377,10 @@ index 4c17292..9cd9d1f 100644
  };
  
 diff --git a/bin/tests/system/allow-query/ns2/named31.conf.in b/bin/tests/system/allow-query/ns2/named31.conf.in
-index a2690a4..f488730 100644
+index 27eccc2..eecb990 100644
 --- a/bin/tests/system/allow-query/ns2/named31.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named31.conf.in
-@@ -10,12 +10,12 @@
+@@ -12,12 +12,12 @@
   */
  
  key one {
@@ -400,10 +396,10 @@ index a2690a4..f488730 100644
  };
  
 diff --git a/bin/tests/system/allow-query/ns2/named32.conf.in b/bin/tests/system/allow-query/ns2/named32.conf.in
-index a0708c8..51fa457 100644
+index adbb203..744d122 100644
 --- a/bin/tests/system/allow-query/ns2/named32.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named32.conf.in
-@@ -10,7 +10,7 @@
+@@ -12,7 +12,7 @@
   */
  
  key one {
@@ -413,10 +409,10 @@ index a0708c8..51fa457 100644
  };
  
 diff --git a/bin/tests/system/allow-query/ns2/named40.conf.in b/bin/tests/system/allow-query/ns2/named40.conf.in
-index 687768e..d24d6d2 100644
+index 364f94b..9518f82 100644
 --- a/bin/tests/system/allow-query/ns2/named40.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named40.conf.in
-@@ -14,12 +14,12 @@ acl accept { 10.53.0.2; };
+@@ -16,12 +16,12 @@ acl accept { 10.53.0.2; };
  acl badaccept { 10.53.0.1; };
  
  key one {
@@ -432,10 +428,10 @@ index 687768e..d24d6d2 100644
  };
  
 diff --git a/bin/tests/system/allow-query/tests.sh b/bin/tests/system/allow-query/tests.sh
-index fe40635..543c663 100644
+index bbffe07..80da0fe 100644
 --- a/bin/tests/system/allow-query/tests.sh
 +++ b/bin/tests/system/allow-query/tests.sh
-@@ -182,7 +182,7 @@ rndc_reload ns2 10.53.0.2
+@@ -200,7 +200,7 @@ rndc_reload ns2 10.53.0.2
  
  echo_i "test $n: key allowed - query allowed"
  ret=0
@@ -444,25 +440,25 @@ index fe40635..543c663 100644
  grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
  grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1
  if [ $ret != 0 ]; then echo_i "failed"; fi
-@@ -195,7 +195,7 @@ rndc_reload ns2 10.53.0.2
+@@ -213,7 +213,7 @@ rndc_reload ns2 10.53.0.2
  
  echo_i "test $n: key not allowed - query refused"
  ret=0
 -$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1
 +$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1
  grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
+ grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1
  grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
- if [ $ret != 0 ]; then echo_i "failed"; fi
-@@ -208,7 +208,7 @@ rndc_reload ns2 10.53.0.2
+@@ -227,7 +227,7 @@ rndc_reload ns2 10.53.0.2
  
  echo_i "test $n: key disallowed - query refused"
  ret=0
 -$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
 +$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
  grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
+ grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1
  grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
- if [ $ret != 0 ]; then echo_i "failed"; fi
-@@ -341,7 +341,7 @@ rndc_reload ns2 10.53.0.2
+@@ -366,7 +366,7 @@ rndc_reload ns2 10.53.0.2
  
  echo_i "test $n: views key allowed - query allowed"
  ret=0
@@ -471,25 +467,25 @@ index fe40635..543c663 100644
  grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
  grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1
  if [ $ret != 0 ]; then echo_i "failed"; fi
-@@ -354,7 +354,7 @@ rndc_reload ns2 10.53.0.2
+@@ -379,7 +379,7 @@ rndc_reload ns2 10.53.0.2
  
  echo_i "test $n: views key not allowed - query refused"
  ret=0
 -$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1
 +$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1
  grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
+ grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1
  grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
- if [ $ret != 0 ]; then echo_i "failed"; fi
-@@ -367,7 +367,7 @@ rndc_reload ns2 10.53.0.2
+@@ -393,7 +393,7 @@ rndc_reload ns2 10.53.0.2
  
  echo_i "test $n: views key disallowed - query refused"
  ret=0
 -$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
 +$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
  grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
+ grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1
  grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
- if [ $ret != 0 ]; then echo_i "failed"; fi
-@@ -500,7 +500,7 @@ status=`expr $status + $ret`
+@@ -533,7 +533,7 @@ status=`expr $status + $ret`
  n=`expr $n + 1`
  echo_i "test $n: zone key allowed - query allowed"
  ret=0
@@ -498,51 +494,29 @@ index fe40635..543c663 100644
  grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
  grep '^a.keyallow.example' dig.out.ns2.$n > /dev/null || ret=1
  if [ $ret != 0 ]; then echo_i "failed"; fi
-@@ -510,7 +510,7 @@ status=`expr $status + $ret`
+@@ -543,7 +543,7 @@ status=`expr $status + $ret`
  n=`expr $n + 1`
  echo_i "test $n: zone key not allowed - query refused"
  ret=0
 -$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y two:1234efgh8765 a.keyallow.example a > dig.out.ns2.$n || ret=1
 +$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:two:1234efgh8765 a.keyallow.example a > dig.out.ns2.$n || ret=1
  grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
+ grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1
  grep '^a.keyallow.example' dig.out.ns2.$n > /dev/null && ret=1
- if [ $ret != 0 ]; then echo_i "failed"; fi
-@@ -520,7 +520,7 @@ status=`expr $status + $ret`
+@@ -554,7 +554,7 @@ status=`expr $status + $ret`
  n=`expr $n + 1`
  echo_i "test $n: zone key disallowed - query refused"
  ret=0
 -$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.keydisallow.example a > dig.out.ns2.$n || ret=1
 +$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.keydisallow.example a > dig.out.ns2.$n || ret=1
  grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
+ grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1
  grep '^a.keydisallow.example' dig.out.ns2.$n > /dev/null && ret=1
- if [ $ret != 0 ]; then echo_i "failed"; fi
 diff --git a/bin/tests/system/catz/ns1/named.conf.in b/bin/tests/system/catz/ns1/named.conf.in
-index 1218669..e62715e 100644
+index 5a46d39..fc1bd07 100644
 --- a/bin/tests/system/catz/ns1/named.conf.in
 +++ b/bin/tests/system/catz/ns1/named.conf.in
-@@ -61,5 +61,5 @@ zone "catalog4.example" {
- 
- key tsig_key. {
- 	secret "LSAnCU+Z";
--	algorithm hmac-md5;
-+	algorithm hmac-sha256;
- };
-diff --git a/bin/tests/system/catz/ns2/named1.conf.in b/bin/tests/system/catz/ns2/named1.conf.in
-index 30333e6..4005152 100644
---- a/bin/tests/system/catz/ns2/named1.conf.in
-+++ b/bin/tests/system/catz/ns2/named1.conf.in
-@@ -70,5 +70,5 @@ zone "catalog4.example" {
- 
- key tsig_key. {
- 	secret "LSAnCU+Z";
--	algorithm hmac-md5;
-+	algorithm hmac-sha256;
- };
-diff --git a/bin/tests/system/catz/ns2/named2.conf.in b/bin/tests/system/catz/ns2/named2.conf.in
-index fcd99ca..84c97ca 100644
---- a/bin/tests/system/catz/ns2/named2.conf.in
-+++ b/bin/tests/system/catz/ns2/named2.conf.in
-@@ -56,5 +56,5 @@ zone "catalog4.example" {
+@@ -63,5 +63,5 @@ zone "catalog4.example" {
  
  key tsig_key. {
  	secret "LSAnCU+Z";
@@ -550,10 +524,10 @@ index fcd99ca..84c97ca 100644
 +	algorithm hmac-sha256;
  };
 diff --git a/bin/tests/system/checkconf/bad-tsig.conf b/bin/tests/system/checkconf/bad-tsig.conf
-index 21be03e..e57c308 100644
+index 4af25b0..9f202d5 100644
 --- a/bin/tests/system/checkconf/bad-tsig.conf
 +++ b/bin/tests/system/checkconf/bad-tsig.conf
-@@ -11,7 +11,7 @@
+@@ -13,7 +13,7 @@
  
  /* Bad secret */
  key "badtsig" {
@@ -563,10 +537,10 @@ index 21be03e..e57c308 100644
  };
  
 diff --git a/bin/tests/system/checkconf/good.conf b/bin/tests/system/checkconf/good.conf
-index 616a544..e3a59a5 100644
+index 897dc86..e4b6dc1 100644
 --- a/bin/tests/system/checkconf/good.conf
 +++ b/bin/tests/system/checkconf/good.conf
-@@ -268,6 +268,6 @@ dyndb "name" "library.so" {
+@@ -270,6 +270,6 @@ dyndb "name" "library.so" {
  	system;
  };
  key "mykey" {
@@ -575,10 +549,10 @@ index 616a544..e3a59a5 100644
  	secret "qwertyuiopasdfgh";
  };
 diff --git a/bin/tests/system/feature-test.c b/bin/tests/system/feature-test.c
-index 877504f..577660a 100644
+index 30e6e14..ba7f98e 100644
 --- a/bin/tests/system/feature-test.c
 +++ b/bin/tests/system/feature-test.c
-@@ -14,6 +14,7 @@
+@@ -16,6 +16,7 @@
  #include <string.h>
  #include <unistd.h>
  
@@ -586,8 +560,8 @@ index 877504f..577660a 100644
  #include <isc/net.h>
  #include <isc/print.h>
  #include <isc/util.h>
-@@ -186,6 +187,19 @@ main(int argc, char **argv) {
- #endif /* ifdef DLZ_FILESYSTEM */
+@@ -140,6 +141,19 @@ main(int argc, char **argv) {
+ #endif
  	}
  
 +	if (strcmp(argv[1], "--md5") == 0) {
@@ -603,14 +577,14 @@ index 877504f..577660a 100644
 +		}
 +	}
 +
- 	if (strcmp(argv[1], "--with-idn") == 0) {
- #ifdef HAVE_LIBIDN2
- 		return (0);
+ 	if (strcmp(argv[1], "--ipv6only=no") == 0) {
+ #if defined(IPPROTO_IPV6) && defined(IPV6_V6ONLY)
+ 		int s;
 diff --git a/bin/tests/system/notify/ns5/named.conf.in b/bin/tests/system/notify/ns5/named.conf.in
-index 1ee8df4..2b75d9a 100644
+index 5cab276..d4a7bf3 100644
 --- a/bin/tests/system/notify/ns5/named.conf.in
 +++ b/bin/tests/system/notify/ns5/named.conf.in
-@@ -10,17 +10,17 @@
+@@ -12,17 +12,17 @@
   */
  
  key "a" {
@@ -632,10 +606,10 @@ index 1ee8df4..2b75d9a 100644
  };
  
 diff --git a/bin/tests/system/notify/tests.sh b/bin/tests/system/notify/tests.sh
-index 3d7e0b7..ec4d9a7 100644
+index 52d2f81..1fd02d4 100644
 --- a/bin/tests/system/notify/tests.sh
 +++ b/bin/tests/system/notify/tests.sh
-@@ -212,16 +212,16 @@ ret=0
+@@ -187,7 +187,7 @@ test_start "checking notify to multiple views using tsig"
  $NSUPDATE << EOF
  server 10.53.0.5 ${PORT}
  zone x21
@@ -644,22 +618,23 @@ index 3d7e0b7..ec4d9a7 100644
  update add added.x21 0 in txt "test string"
  send
  EOF
- 
+@@ -195,9 +195,9 @@ fnb="dig.out.b.ns5.test$n"
+ fnc="dig.out.c.ns5.test$n"
  for i in 1 2 3 4 5 6 7 8 9
  do
--	$DIG $DIGOPTS added.x21. -y b:bbbbbbbbbbbbbbbbbbbb @10.53.0.5 \
-+	$DIG $DIGOPTS added.x21. -y hmac-sha256:b:bbbbbbbbbbbbbbbbbbbb @10.53.0.5 \
- 		txt > dig.out.b.ns5.test$n || ret=1
--	$DIG $DIGOPTS added.x21. -y c:cccccccccccccccccccc @10.53.0.5 \
-+	$DIG $DIGOPTS added.x21. -y hmac-sha256:c:cccccccccccccccccccc @10.53.0.5 \
- 		txt > dig.out.c.ns5.test$n || ret=1
- 	grep "test string" dig.out.b.ns5.test$n > /dev/null &&
- 	grep "test string" dig.out.c.ns5.test$n > /dev/null &&
+-	dig_plus_opts added.x21. -y b:bbbbbbbbbbbbbbbbbbbb @10.53.0.5 \
++	dig_plus_opts added.x21. -y hmac-sha256:b:bbbbbbbbbbbbbbbbbbbb @10.53.0.5 \
+ 		txt > "$fnb" || ret=1
+-	dig_plus_opts added.x21. -y c:cccccccccccccccccccc @10.53.0.5 \
++	dig_plus_opts added.x21. -y hmac-sha256:c:cccccccccccccccccccc @10.53.0.5 \
+ 		txt > "$fnc" || ret=1
+ 	grep "test string" "$fnb" > /dev/null &&
+ 	grep "test string" "$fnc" > /dev/null &&
 diff --git a/bin/tests/system/nsupdate/ns1/named.conf.in b/bin/tests/system/nsupdate/ns1/named.conf.in
-index b51e700..436c97d 100644
+index 81d0c99..effbe2e 100644
 --- a/bin/tests/system/nsupdate/ns1/named.conf.in
 +++ b/bin/tests/system/nsupdate/ns1/named.conf.in
-@@ -37,7 +37,7 @@ controls {
+@@ -39,7 +39,7 @@ controls {
  };
  
  key altkey {
@@ -669,10 +644,10 @@ index b51e700..436c97d 100644
  };
  
 diff --git a/bin/tests/system/nsupdate/ns2/named.conf.in b/bin/tests/system/nsupdate/ns2/named.conf.in
-index da6b3b4..c547e47 100644
+index f1a1735..da2b3d1 100644
 --- a/bin/tests/system/nsupdate/ns2/named.conf.in
 +++ b/bin/tests/system/nsupdate/ns2/named.conf.in
-@@ -32,7 +32,7 @@ controls {
+@@ -34,7 +34,7 @@ controls {
  };
  
  key altkey {
@@ -682,27 +657,27 @@ index da6b3b4..c547e47 100644
  };
  
 diff --git a/bin/tests/system/nsupdate/setup.sh b/bin/tests/system/nsupdate/setup.sh
-index 5593a2e..7cd1a74 100644
+index 50056dc..a4a1a3f 100644
 --- a/bin/tests/system/nsupdate/setup.sh
 +++ b/bin/tests/system/nsupdate/setup.sh
-@@ -71,7 +71,11 @@ EOF
+@@ -72,7 +72,11 @@ EOF
  
- $DDNSCONFGEN -q -z example.nil > ns1/ddns.key
+ $TSIGKEYGEN ddns-key.example.nil > ns1/ddns.key
  
--$DDNSCONFGEN -q -a hmac-md5 -k md5-key -z keytests.nil > ns1/md5.key
+-$TSIGKEYGEN -a hmac-md5 md5-key > ns1/md5.key
 +if $FEATURETEST --md5; then
-+	$DDNSCONFGEN -q -a hmac-md5 -k md5-key -z keytests.nil > ns1/md5.key
++	$TSIGKEYGEN -a hmac-md5 md5-key > ns1/md5.key
 +else
 +	echo -n > ns1/md5.key
 +fi
- $DDNSCONFGEN -q -a hmac-sha1 -k sha1-key -z keytests.nil > ns1/sha1.key
- $DDNSCONFGEN -q -a hmac-sha224 -k sha224-key -z keytests.nil > ns1/sha224.key
- $DDNSCONFGEN -q -a hmac-sha256 -k sha256-key -z keytests.nil > ns1/sha256.key
+ $TSIGKEYGEN -a hmac-sha1 sha1-key > ns1/sha1.key
+ $TSIGKEYGEN -a hmac-sha224 sha224-key > ns1/sha224.key
+ $TSIGKEYGEN -a hmac-sha256 sha256-key > ns1/sha256.key
 diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh
-index 8839131..fde6135 100755
+index 0863d0a..559def7 100755
 --- a/bin/tests/system/nsupdate/tests.sh
 +++ b/bin/tests/system/nsupdate/tests.sh
-@@ -824,7 +824,14 @@ fi
+@@ -841,7 +841,14 @@ fi
  n=`expr $n + 1`
  ret=0
  echo_i "check TSIG key algorithms (nsupdate -k) ($n)"
@@ -718,7 +693,7 @@ index 8839131..fde6135 100755
      $NSUPDATE -k ns1/${alg}.key <<END > /dev/null || ret=1
  server 10.53.0.1 ${PORT}
  update add ${alg}.keytests.nil. 600 A 10.10.10.3
-@@ -832,7 +839,7 @@ send
+@@ -849,7 +856,7 @@ send
  END
  done
  sleep 2
@@ -727,29 +702,11 @@ index 8839131..fde6135 100755
      $DIG $DIGOPTS +short @10.53.0.1 ${alg}.keytests.nil | grep 10.10.10.3 > /dev/null 2>&1 || ret=1
  done
  if [ $ret -ne 0 ]; then
-@@ -843,7 +850,7 @@ fi
- n=`expr $n + 1`
- ret=0
- echo_i "check TSIG key algorithms (nsupdate -y) ($n)"
--for alg in md5 sha1 sha224 sha256 sha384 sha512; do
-+for alg in $ALGS; do
-     secret=$(sed -n 's/.*secret "\(.*\)";.*/\1/p' ns1/${alg}.key)
-     $NSUPDATE -y "hmac-${alg}:${alg}-key:$secret" <<END > /dev/null || ret=1
- server 10.53.0.1 ${PORT}
-@@ -852,7 +859,7 @@ send
- END
- done
- sleep 2
--for alg in md5 sha1 sha224 sha256 sha384 sha512; do
-+for alg in $ALGS; do
-     $DIG $DIGOPTS +short @10.53.0.1 ${alg}.keytests.nil | grep 10.10.10.50 > /dev/null 2>&1 || ret=1
- done
- if [ $ret -ne 0 ]; then
 diff --git a/bin/tests/system/rndc/setup.sh b/bin/tests/system/rndc/setup.sh
-index 225722f..63ac938 100644
+index 4dd6fa7..1b79263 100644
 --- a/bin/tests/system/rndc/setup.sh
 +++ b/bin/tests/system/rndc/setup.sh
-@@ -38,7 +38,7 @@ make_key () {
+@@ -47,7 +47,7 @@ make_key () {
              sed 's/allow { 10.53.0.4/allow { any/' >> ns4/named.conf
  }
  
@@ -759,13 +716,13 @@ index 225722f..63ac938 100644
  make_key 3 ${EXTRAPORT3} hmac-sha224
  make_key 4 ${EXTRAPORT4} hmac-sha256
 diff --git a/bin/tests/system/rndc/tests.sh b/bin/tests/system/rndc/tests.sh
-index 9bf86c6..b8a7a1f 100644
+index 85c271b..ac69f32 100644
 --- a/bin/tests/system/rndc/tests.sh
 +++ b/bin/tests/system/rndc/tests.sh
-@@ -349,15 +349,20 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
- status=`expr $status + $ret`
+@@ -350,15 +350,19 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
+ status=$((status+ret))
  
- n=`expr $n + 1`
+ n=$((n+1))
 -echo_i "testing rndc with hmac-md5 ($n)"
 -ret=0
 -$RNDC -s 10.53.0.4 -p ${EXTRAPORT1} -c ns4/key1.conf status > /dev/null 2>&1 || ret=1
@@ -774,29 +731,28 @@ index 9bf86c6..b8a7a1f 100644
 -        $RNDC -s 10.53.0.4 -p ${EXTRAPORT1} -c ns4/key${i}.conf status > /dev/null 2>&1 && ret=1
 -done
 -if [ $ret != 0 ]; then echo_i "failed"; fi
--status=`expr $status + $ret`
+-status=$((status+ret))
 +if $FEATURETEST --md5
-+then
 +	echo_i "testing rndc with hmac-md5 ($n)"
 +	ret=0
 +	$RNDC -s 10.53.0.4 -p ${EXTRAPORT1} -c ns4/key1.conf status > /dev/null 2>&1 || ret=1
 +	for i in 2 3 4 5 6
 +	do
-+		$RNDC -s 10.53.0.4 -p ${EXTRAPORT1} -c ns4/key${i}.conf status > /dev/null 2>&1 && ret=1
++	        $RNDC -s 10.53.0.4 -p ${EXTRAPORT1} -c ns4/key${i}.conf status > /dev/null 2>&1 && ret=1
 +	done
 +	if [ $ret != 0 ]; then echo_i "failed"; fi
-+	status=`expr $status + $ret`
++	status=$((status+ret))
 +else
 +	echo_i "skipping rndc with hmac-md5 ($n)"
 +fi
  
- n=`expr $n + 1`
+ n=$((n+1))
  echo_i "testing rndc with hmac-sha1 ($n)"
 diff --git a/bin/tests/system/tsig/ns1/named.conf.in b/bin/tests/system/tsig/ns1/named.conf.in
-index 3470c4f..cf539cd 100644
+index 76cf970..22637af 100644
 --- a/bin/tests/system/tsig/ns1/named.conf.in
 +++ b/bin/tests/system/tsig/ns1/named.conf.in
-@@ -21,10 +21,7 @@ options {
+@@ -23,10 +23,7 @@ options {
  	notify no;
  };
  
@@ -808,7 +764,7 @@ index 3470c4f..cf539cd 100644
  
  key "sha1" {
  	secret "FrSt77yPTFx6hTs4i2tKLB9LmE0=";
-@@ -51,10 +48,7 @@ key "sha512" {
+@@ -53,10 +50,7 @@ key "sha512" {
  	algorithm hmac-sha512;
  };
  
@@ -820,27 +776,11 @@ index 3470c4f..cf539cd 100644
  
  key "sha1-trunc" {
  	secret "FrSt77yPTFx6hTs4i2tKLB9LmE0=";
-diff --git a/bin/tests/system/tsig/ns1/rndc5.conf.in b/bin/tests/system/tsig/ns1/rndc5.conf.in
-new file mode 100644
-index 0000000..0682194
---- /dev/null
-+++ b/bin/tests/system/tsig/ns1/rndc5.conf.in
-@@ -0,0 +1,10 @@
-+# Conditionally included when support for MD5 is available
-+key "md5" {
-+	secret "97rnFx24Tfna4mHPfgnerA==";
-+	algorithm hmac-md5;
-+};
-+
-+key "md5-trunc" {
-+	secret "97rnFx24Tfna4mHPfgnerA==";
-+	algorithm hmac-md5-80;
-+};
 diff --git a/bin/tests/system/tsig/setup.sh b/bin/tests/system/tsig/setup.sh
-index e3b4a45..ae21d04 100644
+index 34cc73b..d51ff21 100644
 --- a/bin/tests/system/tsig/setup.sh
 +++ b/bin/tests/system/tsig/setup.sh
-@@ -15,3 +15,8 @@ SYSTEMTESTTOP=..
+@@ -16,3 +16,8 @@
  $SHELL clean.sh
  
  copy_setports ns1/named.conf.in ns1/named.conf
@@ -850,10 +790,10 @@ index e3b4a45..ae21d04 100644
 +	cat ns1/rndc5.conf.in >> ns1/named.conf
 +fi
 diff --git a/bin/tests/system/tsig/tests.sh b/bin/tests/system/tsig/tests.sh
-index 38d842a..668aa6f 100644
+index 1067227..ee05e83 100644
 --- a/bin/tests/system/tsig/tests.sh
 +++ b/bin/tests/system/tsig/tests.sh
-@@ -26,20 +26,25 @@ sha512="jI/Pa4qRu96t76Pns5Z/Ndxbn3QCkwcxLOgt9vgvnJw5wqTRvNyk3FtD6yIMd1dWVlqZ+Y4f
+@@ -27,20 +27,25 @@ sha512="jI/Pa4qRu96t76Pns5Z/Ndxbn3QCkwcxLOgt9vgvnJw5wqTRvNyk3FtD6yIMd1dWVlqZ+Y4f
  
  status=0
  
@@ -864,6 +804,13 @@ index 38d842a..668aa6f 100644
 -if [ $ret -eq 1 ] ; then
 -	echo_i "failed"; status=1
 -fi
+-
+-echo_i "fetching using hmac-md5 (new form)"
+-ret=0
+-$DIG $DIGOPTS example.nil. -y "hmac-md5:md5:$md5" @10.53.0.1 soa > dig.out.md5.new || ret=1
+-grep -i "md5.*TSIG.*NOERROR" dig.out.md5.new > /dev/null || ret=1
+-if [ $ret -eq 1 ] ; then
+-	echo_i "failed"; status=1
 +if $FEATURETEST --md5
 +then
 +	echo_i "fetching using hmac-md5 (old form)"
@@ -873,13 +820,7 @@ index 38d842a..668aa6f 100644
 +	if [ $ret -eq 1 ] ; then
 +		echo_i "failed"; status=1
 +	fi
- 
--echo_i "fetching using hmac-md5 (new form)"
--ret=0
--$DIG $DIGOPTS example.nil. -y "hmac-md5:md5:$md5" @10.53.0.1 soa > dig.out.md5.new || ret=1
--grep -i "md5.*TSIG.*NOERROR" dig.out.md5.new > /dev/null || ret=1
--if [ $ret -eq 1 ] ; then
--	echo_i "failed"; status=1
++
 +	echo_i "fetching using hmac-md5 (new form)"
 +	ret=0
 +	$DIG $DIGOPTS example.nil. -y "hmac-md5:md5:$md5" @10.53.0.1 soa > dig.out.md5.new || ret=1
@@ -892,7 +833,7 @@ index 38d842a..668aa6f 100644
  fi
  
  echo_i "fetching using hmac-sha1"
-@@ -87,12 +92,17 @@ fi
+@@ -88,12 +93,17 @@ fi
  #	Truncated TSIG
  #
  #
@@ -916,7 +857,7 @@ index 38d842a..668aa6f 100644
  fi
  
  echo_i "fetching using hmac-sha1 (trunc)"
-@@ -141,12 +151,17 @@ fi
+@@ -142,12 +152,17 @@ fi
  #	Check for bad truncation.
  #
  #
@@ -941,10 +882,10 @@ index 38d842a..668aa6f 100644
  
  echo_i "fetching using hmac-sha1-80 (BADTRUNC)"
 diff --git a/bin/tests/system/upforwd/ns1/named.conf.in b/bin/tests/system/upforwd/ns1/named.conf.in
-index 3873c7c..b359a5a 100644
+index c2b57dd..cb13aa1 100644
 --- a/bin/tests/system/upforwd/ns1/named.conf.in
 +++ b/bin/tests/system/upforwd/ns1/named.conf.in
-@@ -10,7 +10,7 @@
+@@ -12,7 +12,7 @@
   */
  
  key "update.example." {
@@ -954,10 +895,10 @@ index 3873c7c..b359a5a 100644
  };
  
 diff --git a/bin/tests/system/upforwd/tests.sh b/bin/tests/system/upforwd/tests.sh
-index a50c896..8062d68 100644
+index a6de312..ebcadb1 100644
 --- a/bin/tests/system/upforwd/tests.sh
 +++ b/bin/tests/system/upforwd/tests.sh
-@@ -79,7 +79,7 @@ if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
+@@ -80,7 +80,7 @@ if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
  
  echo_i "updating zone (signed) ($n)"
  ret=0
@@ -967,5 +908,5 @@ index a50c896..8062d68 100644
  update add updated.example. 600 A 10.10.10.1
  update add updated.example. 600 TXT Foo
 -- 
-2.31.1
+2.34.1
 
diff --git a/bind-9.11-kyua-pkcs11.patch b/bind-9.11-kyua-pkcs11.patch
deleted file mode 100644
index ea9a51a..0000000
--- a/bind-9.11-kyua-pkcs11.patch
+++ /dev/null
@@ -1,58 +0,0 @@
-From 1241f2005d08673c28a595c5a6cd61350b95a929 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Tue, 2 Jan 2018 18:13:07 +0100
-Subject: [PATCH] Fix pkcs11 variants atf tests
-
-Add dns-pkcs11 tests Makefile to configure
-
-Add pkcs11 Kyuafile, fix dh_test to pass in pkcs11 mode
----
- configure.ac                   | 1 +
- lib/Kyuafile                   | 2 ++
- lib/dns-pkcs11/tests/dh_test.c | 3 ++-
- 3 files changed, 5 insertions(+), 1 deletion(-)
-
-diff --git a/configure.ac b/configure.ac
-index d80ae31..0fb9328 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -3090,6 +3090,7 @@ AC_CONFIG_FILES([
- 	lib/dns-pkcs11/include/Makefile
- 	lib/dns-pkcs11/include/dns/Makefile
- 	lib/dns-pkcs11/include/dst/Makefile
-+	lib/dns-pkcs11/tests/Makefile
- 	lib/irs/Makefile
- 	lib/irs/include/Makefile
- 	lib/irs/include/irs/Makefile
-diff --git a/lib/Kyuafile b/lib/Kyuafile
-index 39ce986..037e5ef 100644
---- a/lib/Kyuafile
-+++ b/lib/Kyuafile
-@@ -2,8 +2,10 @@ syntax(2)
- test_suite('bind9')
- 
- include('dns/Kyuafile')
-+include('dns-pkcs11/Kyuafile')
- include('irs/Kyuafile')
- include('isc/Kyuafile')
- include('isccc/Kyuafile')
- include('isccfg/Kyuafile')
- include('ns/Kyuafile')
-+include('ns-pkcs11/Kyuafile')
-diff --git a/lib/dns-pkcs11/tests/dh_test.c b/lib/dns-pkcs11/tests/dh_test.c
-index 934e8fd..658d1af 100644
---- a/lib/dns-pkcs11/tests/dh_test.c
-+++ b/lib/dns-pkcs11/tests/dh_test.c
-@@ -87,7 +87,8 @@ dh_computesecret(void **state) {
- 	result = dst_key_computesecret(key, key, &buf);
- 	assert_int_equal(result, DST_R_NOTPRIVATEKEY);
- 	result = key->func->computesecret(key, key, &buf);
--	assert_int_equal(result, DST_R_COMPUTESECRETFAILURE);
-+	/* PKCS11 variant gives different result, accept both */
-+	assert_true(result == DST_R_COMPUTESECRETFAILURE || result == DST_R_INVALIDPRIVATEKEY);
- 
- 	dst_key_free(&key);
- }
--- 
-2.20.1
-
diff --git a/bind-9.11-rh1666814.patch b/bind-9.11-rh1666814.patch
deleted file mode 100644
index 533781d..0000000
--- a/bind-9.11-rh1666814.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-From d05d116da39c0a5c580ceaac6ba069899b82c5a0 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Wed, 16 Jan 2019 16:27:33 +0100
-Subject: [PATCH] Fix possible crash when loading corrupted file
-
-Some values passes internal triggers by coincidence. Fix the check and
-check also first_node_offset before even passing it further.
----
- lib/dns/rbt.c | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/lib/dns/rbt.c b/lib/dns/rbt.c
-index 5aee5f6..7f2c2d2 100644
---- a/lib/dns/rbt.c
-+++ b/lib/dns/rbt.c
-@@ -945,7 +945,9 @@ dns_rbt_deserialize_tree(void *base_address, size_t filesize,
- 	rbt->root = (dns_rbtnode_t *)((char *)base_address + header_offset +
- 				      header->first_node_offset);
- 
--	if ((header->nodecount * sizeof(dns_rbtnode_t)) > filesize) {
-+	if ((header->nodecount * sizeof(dns_rbtnode_t)) > filesize
-+	    || header->first_node_offset > filesize) {
-+
- 		result = ISC_R_INVALIDFILE;
- 		goto cleanup;
- 	}
--- 
-2.31.1
-
diff --git a/bind-9.14-config-pkcs11.patch b/bind-9.14-config-pkcs11.patch
deleted file mode 100644
index 0d62df6..0000000
--- a/bind-9.14-config-pkcs11.patch
+++ /dev/null
@@ -1,83 +0,0 @@
-From e6ab9c67f0a14adc23c1067e03a106da1b1651b7 Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Fri, 18 Oct 2019 21:30:52 +0200
-Subject: [PATCH] Move USE_PKCS11 and USE_OPENSSL out of config.h
-
-Building two variants with the same common code requires to unset
-USE_PKCS11 on part of build. That is not possible with config.h value.
-Move it as normal define to CDEFINES.
----
- bin/confgen/Makefile.in |  2 +-
- configure.ac            |  8 ++++++--
- lib/dns/dst_internal.h  | 12 +++++++++---
- 3 files changed, 16 insertions(+), 6 deletions(-)
-
-diff --git a/bin/confgen/Makefile.in b/bin/confgen/Makefile.in
-index 1b7512d..c126bf3 100644
---- a/bin/confgen/Makefile.in
-+++ b/bin/confgen/Makefile.in
-@@ -22,7 +22,7 @@ VERSION=@BIND9_VERSION@
- CINCLUDES = -I${srcdir}/include ${ISC_INCLUDES} ${ISCCC_INCLUDES} \
- 	${ISCCFG_INCLUDES} ${DNS_INCLUDES} ${BIND9_INCLUDES}
- 
--CDEFINES =
-+CDEFINES = @USE_PKCS11@
- CWARNINGS =
- 
- ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
-diff --git a/configure.ac b/configure.ac
-index f5483fe..08a7d8a 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -935,10 +935,14 @@ AC_SUBST([PKCS11_TEST])
- AC_SUBST([PKCS11_TOOLS])
- AC_SUBST([PKCS11_MANS])
- 
-+USE_PKCS11='-DUSE_PKCS11=0'
-+USE_OPENSSL='-DUSE_OPENSSL=0'
- AC_SUBST([CRYPTO])
- AS_CASE([$CRYPTO],
--	[pkcs11],[AC_DEFINE([USE_PKCS11], [1], [define if PKCS11 is used for Public-Key Cryptography])],
--	[AC_DEFINE([USE_OPENSSL], [1], [define if OpenSSL is used for Public-Key Cryptography])])
-+	[pkcs11],[USE_PKCS11='-DUSE_PKCS11=1'],
-+	[USE_OPENSSL='-DUSE_OPENSSL=1'])
-+AC_SUBST(USE_PKCS11)
-+AC_SUBST(USE_OPENSSL)
- 
- # preparation for automake
- # AM_CONDITIONAL([PKCS11_TOOLS], [test "$with_native_pkcs11" = "yes"])
-diff --git a/lib/dns/dst_internal.h b/lib/dns/dst_internal.h
-index 2c3b4a3..55e9dc4 100644
---- a/lib/dns/dst_internal.h
-+++ b/lib/dns/dst_internal.h
-@@ -38,6 +38,13 @@
- #include <isc/stdtime.h>
- #include <isc/types.h>
- 
-+#ifndef USE_PKCS11
-+#define USE_PKCS11 0
-+#endif
-+#ifndef USE_OPENSSL
-+#define USE_OPENSSL (! USE_PKCS11)
-+#endif
-+
- #if USE_PKCS11
- #include <pk11/pk11.h>
- #include <pk11/site.h>
-@@ -116,11 +123,10 @@ struct dst_key {
- 		void *generic;
- 		dns_gss_ctx_id_t gssctx;
- 		DH *dh;
--#if USE_OPENSSL
--		EVP_PKEY *pkey;
--#endif /* if USE_OPENSSL */
- #if USE_PKCS11
- 		pk11_object_t *pkey;
-+#else
-+		EVP_PKEY *pkey;
- #endif /* if USE_PKCS11 */
- 		dst_hmac_key_t *hmac_key;
- 	} keydata; /*%< pointer to key in crypto pkg fmt */
--- 
-2.26.2
-
diff --git a/bind-9.16-redhat_doc.patch b/bind-9.16-redhat_doc.patch
index ef76e16..fe8ed11 100644
--- a/bind-9.16-redhat_doc.patch
+++ b/bind-9.16-redhat_doc.patch
@@ -1,4 +1,4 @@
-From 3a161af91bffcd457586ab466e32ac8484028763 Mon Sep 17 00:00:00 2001
+From 402403b4bbb4f603693378e86b6c97997ccb0401 Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Wed, 17 Jun 2020 23:17:13 +0200
 Subject: [PATCH] Update man named with Red Hat specifics
@@ -6,15 +6,15 @@ Subject: [PATCH] Update man named with Red Hat specifics
 This is almost unmodified text and requires revalidation. Some of those
 statements are no longer correct.
 ---
- bin/named/named.rst | 35 +++++++++++++++++++++++++++++++++++
- 1 file changed, 35 insertions(+)
+ bin/named/named.rst | 41 +++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 41 insertions(+)
 
 diff --git a/bin/named/named.rst b/bin/named/named.rst
-index 6fd8f87..3cd6350 100644
+index ea440b2..fa51984 100644
 --- a/bin/named/named.rst
 +++ b/bin/named/named.rst
-@@ -228,6 +228,41 @@ Files
- ``/var/run/named/named.pid``
+@@ -212,6 +212,47 @@ Files
+ |named_pid|
     The default process-id file.
  
 +Notes
@@ -24,7 +24,7 @@ index 6fd8f87..3cd6350 100644
 +
 +By default, Red Hat ships BIND with the most secure SELinux policy
 +that will not prevent normal BIND operation and will prevent exploitation
-+of all known BIND security vulnerabilities. See the selinux(8) man page
++of all known BIND security vulnerabilities . See the selinux(8) man page
 +for information about SElinux.
 +
 +It is not necessary to run named in a chroot environment if the Red Hat
@@ -34,27 +34,33 @@ index 6fd8f87..3cd6350 100644
 +
 +*With this extra security comes some restrictions:*
 +
-+By default, the SELinux policy does not allow named to write outside directory
-+/var/named. That directory used to be read-only for named, but write access is
-+enabled by default now.
++By default, the SELinux policy does not allow named to write any master
++zone database files. Only the root user may create files in the $ROOTDIR/var/named
++zone database file directory (the options { "directory" } option), where
++$ROOTDIR is set in /etc/sysconfig/named.
 +
 +The "named" group must be granted read privelege to
 +these files in order for named to be enabled to read them.
-+Any file updated by named must be writeable by named user or named group.
 +
 +Any file created in the zone database file directory is automatically assigned
 +the SELinux file context *named_zone_t* .
 +
++By default, SELinux prevents any role from modifying *named_zone_t* files; this
++means that files in the zone database directory cannot be modified by dynamic
++DNS (DDNS) updates or zone transfers.
++
 +The Red Hat BIND distribution and SELinux policy creates three directories where
-+named were allowed to create and modify files: */var/named/slaves*, */var/named/dynamic*
-+*/var/named/data*. The service is able to write and file under */var/named* with appropriate
-+permissions. They are used for better organisation of zones and backward compatibility.
-+Files in these directories are automatically assigned the '*named_cache_t*'
-+file context, which SELinux always allows named to write.
++named is allowed to create and modify files: */var/named/slaves*, */var/named/dynamic*
++*/var/named/data*. By placing files you want named to modify, such as
++slave or DDNS updateable zone files and database / statistics dump files in
++these directories, named will work normally and no further operator action is
++required. Files in these directories are automatically assigned the '*named_cache_t*'
++file context, which SELinux allows named to write.
++
 +
  See Also
  ~~~~~~~~
  
 -- 
-2.26.2
+2.34.1
 
diff --git a/bind-9.16-resolv.conf-options-timeout-test.patch b/bind-9.16-resolv.conf-options-timeout-test.patch
deleted file mode 100644
index 16cf020..0000000
--- a/bind-9.16-resolv.conf-options-timeout-test.patch
+++ /dev/null
@@ -1,113 +0,0 @@
-From 7270604440268bb17b39ae734ff33003a67c8343 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Tue, 20 Jul 2021 19:34:42 +0200
-Subject: [PATCH] Check parsed resconf values
-
-Add 'attempts' check, fix 'ndots' data. Create a bunch of verification
-functions and check parsed values, not just return codes.
----
- lib/irs/tests/resconf_test.c                 | 46 ++++++++++++++++++--
- lib/irs/tests/testdata/options-attempts.conf | 10 +++++
- lib/irs/tests/testdata/options-ndots.conf    |  2 +-
- 3 files changed, 54 insertions(+), 4 deletions(-)
- create mode 100644 lib/irs/tests/testdata/options-attempts.conf
-
-diff --git a/lib/irs/tests/resconf_test.c b/lib/irs/tests/resconf_test.c
-index 6951758..ce94345 100644
---- a/lib/irs/tests/resconf_test.c
-+++ b/lib/irs/tests/resconf_test.c
-@@ -45,6 +45,43 @@ setup_test() {
- 	assert_return_code(chdir(TESTS), 0);
- }
- 
-+static isc_result_t
-+check_number(unsigned int n, unsigned int expected) {
-+	return ((n == expected) ? ISC_R_SUCCESS : ISC_R_BADNUMBER);
-+}
-+
-+static isc_result_t
-+check_attempts(irs_resconf_t *resconf) {
-+	return (check_number(irs_resconf_getattempts(resconf), 4));
-+}
-+
-+static isc_result_t
-+check_timeout(irs_resconf_t *resconf) {
-+	return (check_number(irs_resconf_gettimeout(resconf), 1));
-+}
-+
-+static isc_result_t
-+check_ndots(irs_resconf_t *resconf) {
-+	return (check_number(irs_resconf_getndots(resconf), 2));
-+}
-+
-+static isc_result_t
-+check_options(irs_resconf_t *resconf) {
-+	if (irs_resconf_getattempts(resconf) != 3) {
-+		return ISC_R_BADNUMBER; /* default value only */
-+	}
-+
-+	if (irs_resconf_getndots(resconf) != 2) {
-+		return ISC_R_BADNUMBER;
-+	}
-+
-+	if (irs_resconf_gettimeout(resconf) != 1) {
-+		return ISC_R_BADNUMBER;
-+	}
-+
-+	return (ISC_R_SUCCESS);
-+}
-+
- /* test irs_resconf_load() */
- static void
- irs_resconf_load_test(void **state) {
-@@ -64,15 +101,18 @@ irs_resconf_load_test(void **state) {
- 		  ISC_R_SUCCESS },
- 		{ "testdata/nameserver-v6-scoped.conf", ISC_R_SUCCESS, NULL,
- 		  ISC_R_SUCCESS },
-+		{ "testdata/options-attempts.conf", ISC_R_SUCCESS,
-+		  check_attempts, ISC_R_SUCCESS },
- 		{ "testdata/options-debug.conf", ISC_R_SUCCESS, NULL,
- 		  ISC_R_SUCCESS },
--		{ "testdata/options-ndots.conf", ISC_R_SUCCESS, NULL,
-+		{ "testdata/options-ndots.conf", ISC_R_SUCCESS, check_ndots,
- 		  ISC_R_SUCCESS },
--		{ "testdata/options-timeout.conf", ISC_R_SUCCESS, NULL,
-+		{ "testdata/options-timeout.conf", ISC_R_SUCCESS, check_timeout,
- 		  ISC_R_SUCCESS },
- 		{ "testdata/options-unknown.conf", ISC_R_SUCCESS, NULL,
- 		  ISC_R_SUCCESS },
--		{ "testdata/options.conf", ISC_R_SUCCESS, NULL, ISC_R_SUCCESS },
-+		{ "testdata/options.conf", ISC_R_SUCCESS, check_options,
-+		  ISC_R_SUCCESS },
- 		{ "testdata/options-bad-ndots.conf", ISC_R_RANGE, NULL,
- 		  ISC_R_SUCCESS },
- 		{ "testdata/options-empty.conf", ISC_R_UNEXPECTEDEND, NULL,
-diff --git a/lib/irs/tests/testdata/options-attempts.conf b/lib/irs/tests/testdata/options-attempts.conf
-new file mode 100644
-index 0000000..4538643
---- /dev/null
-+++ b/lib/irs/tests/testdata/options-attempts.conf
-@@ -0,0 +1,10 @@
-+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-+#
-+# This Source Code Form is subject to the terms of the Mozilla Public
-+# License, v. 2.0. If a copy of the MPL was not distributed with this
-+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-+#
-+# See the COPYRIGHT file distributed with this work for additional
-+# information regarding copyright ownership.
-+
-+options attempts:4
-diff --git a/lib/irs/tests/testdata/options-ndots.conf b/lib/irs/tests/testdata/options-ndots.conf
-index 5d18d26..f37c712 100644
---- a/lib/irs/tests/testdata/options-ndots.conf
-+++ b/lib/irs/tests/testdata/options-ndots.conf
-@@ -9,4 +9,4 @@
- # See the COPYRIGHT file distributed with this work for additional
- # information regarding copyright ownership.
- 
--option ndots:2
-+options ndots:2
--- 
-2.35.3
-
diff --git a/bind-9.16-resolv.conf-options-timeout.patch b/bind-9.16-resolv.conf-options-timeout.patch
deleted file mode 100644
index 2c28b6d..0000000
--- a/bind-9.16-resolv.conf-options-timeout.patch
+++ /dev/null
@@ -1,203 +0,0 @@
-From b0e79979672935ff07bf23703c675ee788940c59 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Tue, 22 Jun 2021 16:35:46 +0200
-Subject: [PATCH] Parse 'timeout' and 'attempts' from resolv.conf
-
-It was supported by lwres in BIND 9.11, and is still mentioned in
-the manual page. Restore support for it by adding it to libirs.
----
- bin/dig/dighost.c             | 13 ++++++-
- lib/irs/include/irs/resconf.h | 20 +++++++++++
- lib/irs/resconf.c             | 64 ++++++++++++++++++++++++++++-------
- 3 files changed, 84 insertions(+), 13 deletions(-)
-
-diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
-index 0222454..274e894 100644
---- a/bin/dig/dighost.c
-+++ b/bin/dig/dighost.c
-@@ -133,7 +133,7 @@ int sendcount = 0;
- int recvcount = 0;
- int sockcount = 0;
- int ndots = -1;
--int tries = 3;
-+int tries = -1;
- int lookup_counter = 0;
- 
- static char servercookie[256];
-@@ -1330,6 +1330,17 @@ setup_system(bool ipv4only, bool ipv6only) {
- 		ndots = irs_resconf_getndots(resconf);
- 		debug("ndots is %d.", ndots);
- 	}
-+	if (timeout == 0) {
-+		timeout = irs_resconf_gettimeout(resconf);
-+		debug("timeout is %d.", timeout);
-+	}
-+	if (tries == -1) {
-+		tries = irs_resconf_getattempts(resconf);
-+		if (tries == 0) {
-+			tries = 3;
-+		}
-+		debug("retries is %d.", tries);
-+	}
- 
- 	/* If user doesn't specify server use nameservers from resolv.conf. */
- 	if (ISC_LIST_EMPTY(server_list)) {
-diff --git a/lib/irs/include/irs/resconf.h b/lib/irs/include/irs/resconf.h
-index 424b795..74fc84a 100644
---- a/lib/irs/include/irs/resconf.h
-+++ b/lib/irs/include/irs/resconf.h
-@@ -113,6 +113,26 @@ irs_resconf_getndots(irs_resconf_t *conf);
-  *\li	'conf' is a valid resconf object.
-  */
- 
-+unsigned int
-+irs_resconf_getattempts(irs_resconf_t *conf);
-+/*%<
-+ * Return the 'attempts' value stored in 'conf'.
-+ *
-+ * Requires:
-+ *
-+ *\li	'conf' is a valid resconf object.
-+ */
-+
-+unsigned int
-+irs_resconf_gettimeout(irs_resconf_t *conf);
-+/*%<
-+ * Return the 'timeout' value stored in 'conf'.
-+ *
-+ * Requires:
-+ *
-+ *\li	'conf' is a valid resconf object.
-+ */
-+
- ISC_LANG_ENDDECLS
- 
- #endif /* IRS_RESCONF_H */
-diff --git a/lib/irs/resconf.c b/lib/irs/resconf.c
-index 096064b..dd51d71 100644
---- a/lib/irs/resconf.c
-+++ b/lib/irs/resconf.c
-@@ -80,6 +80,13 @@
- #define RESCONFMAXLINELEN     256U /*%< max size of a line */
- #define RESCONFMAXSORTLIST    10U  /*%< max 10 */
- 
-+#define CHECK(op)                            \
-+	do {                                 \
-+		result = (op);               \
-+		if (result != ISC_R_SUCCESS) \
-+			goto cleanup;        \
-+	} while (0)
-+
- /*!
-  * configuration data structure
-  */
-@@ -114,6 +121,10 @@ struct irs_resconf {
- 	uint8_t resdebug;
- 	/*%< set to n in 'options ndots:n' */
- 	uint8_t ndots;
-+	/*%< set to n in 'options attempts:n' */
-+	uint8_t attempts;
-+	/*%< set to n in 'options timeout:n' */
-+	uint8_t timeout;
- };
- 
- static isc_result_t
-@@ -176,8 +187,8 @@ eatwhite(FILE *fp) {
-  */
- static int
- getword(FILE *fp, char *buffer, size_t size) {
-+	char *p = NULL;
- 	int ch;
--	char *p;
- 
- 	REQUIRE(buffer != NULL);
- 	REQUIRE(size > 0U);
-@@ -457,11 +468,26 @@ resconf_parsesortlist(irs_resconf_t *conf, FILE *fp) {
- 	return (ISC_R_SUCCESS);
- }
- 
-+static isc_result_t
-+resconf_optionnumber(const char *word, uint8_t *number) {
-+	char *p;
-+	long n;
-+
-+	n = strtol(word, &p, 10);
-+	if (*p != '\0') { /* Bad string. */
-+		return (ISC_R_UNEXPECTEDTOKEN);
-+	}
-+	if (n < 0 || n > 0xff) { /* Out of range. */
-+		return (ISC_R_RANGE);
-+	}
-+	*number = n;
-+	return (ISC_R_SUCCESS);
-+}
-+
- static isc_result_t
- resconf_parseoption(irs_resconf_t *conf, FILE *fp) {
- 	int delim;
--	long ndots;
--	char *p;
-+	isc_result_t result = ISC_R_SUCCESS;
- 	char word[RESCONFMAXLINELEN];
- 
- 	delim = getword(fp, word, sizeof(word));
-@@ -473,14 +499,11 @@ resconf_parseoption(irs_resconf_t *conf, FILE *fp) {
- 		if (strcmp("debug", word) == 0) {
- 			conf->resdebug = 1;
- 		} else if (strncmp("ndots:", word, 6) == 0) {
--			ndots = strtol(word + 6, &p, 10);
--			if (*p != '\0') { /* Bad string. */
--				return (ISC_R_UNEXPECTEDTOKEN);
--			}
--			if (ndots < 0 || ndots > 0xff) { /* Out of range. */
--				return (ISC_R_RANGE);
--			}
--			conf->ndots = (uint8_t)ndots;
-+			CHECK(resconf_optionnumber(word + 6, &conf->ndots));
-+		} else if (strncmp("attempts:", word, 9) == 0) {
-+			CHECK(resconf_optionnumber(word + 9, &conf->attempts));
-+		} else if (strncmp("timeout:", word, 8) == 0) {
-+			CHECK(resconf_optionnumber(word + 8, &conf->timeout));
- 		}
- 
- 		if (delim == EOF || delim == '\n') {
-@@ -490,7 +513,8 @@ resconf_parseoption(irs_resconf_t *conf, FILE *fp) {
- 		}
- 	}
- 
--	return (ISC_R_SUCCESS);
-+cleanup:
-+	return (result);
- }
- 
- static isc_result_t
-@@ -532,6 +556,8 @@ irs_resconf_load(isc_mem_t *mctx, const char *filename, irs_resconf_t **confp) {
- 	conf->sortlistnxt = 0;
- 	conf->resdebug = 0;
- 	conf->ndots = 1;
-+	conf->attempts = 3;
-+	conf->timeout = 0;
- 	for (i = 0; i < RESCONFMAXSEARCH; i++) {
- 		conf->search[i] = NULL;
- 	}
-@@ -687,3 +713,17 @@ irs_resconf_getndots(irs_resconf_t *conf) {
- 
- 	return ((unsigned int)conf->ndots);
- }
-+
-+unsigned int
-+irs_resconf_getattempts(irs_resconf_t *conf) {
-+	REQUIRE(IRS_RESCONF_VALID(conf));
-+
-+	return ((unsigned int)conf->attempts);
-+}
-+
-+unsigned int
-+irs_resconf_gettimeout(irs_resconf_t *conf) {
-+	REQUIRE(IRS_RESCONF_VALID(conf));
-+
-+	return ((unsigned int)conf->timeout);
-+}
--- 
-2.35.3
-
diff --git a/bind-9.5-PIE.patch b/bind-9.5-PIE.patch
index d3c73ee..3f47a0a 100644
--- a/bind-9.5-PIE.patch
+++ b/bind-9.5-PIE.patch
@@ -1,30 +1,20 @@
-diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
-index eb622d1..37053a7 100644
---- a/bin/named/Makefile.in
-+++ b/bin/named/Makefile.in
-@@ -117,8 +117,12 @@ SRCS =		builtin.c config.c control.c \
- 		tkeyconf.c tsigconf.c zoneconf.c \
- 		${DLZDRIVER_SRCS} ${DBDRIVER_SRCS}
+diff --git a/bin/named/Makefile.am b/bin/named/Makefile.am
+index 7065a90..e2e485b 100644
+--- a/bin/named/Makefile.am
++++ b/bin/named/Makefile.am
+@@ -32,6 +32,7 @@ AM_CPPFLAGS +=				\
+ endif HAVE_LIBXML2
  
-+EXT_CFLAGS = -fpie
+ AM_CPPFLAGS +=						\
++	-fpie                                           \
+ 	-DNAMED_LOCALSTATEDIR=\"${localstatedir}\"	\
+ 	-DNAMED_SYSCONFDIR=\"${sysconfdir}\"
+ 
+@@ -122,5 +123,7 @@ named_LDADD +=					\
+ 	$(LIBNGHTTP2_LIBS)
+ endif HAVE_LIBNGHTTP2
+ 
++AM_LDFLAGS += -pie -Wl,-z,relro,-z,now,-z,nodlopen,-z,noexecstack
 +
- @BIND9_MAKE_RULES@
- 
-+LDFLAGS += -pie -Wl,-z,relro,-z,now,-z,nodlopen,-z,noexecstack
-+
- main.@O@: main.c
- 	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} \
- 		-DVERSION=\"${VERSION}\" \
-diff --git a/bin/named/unix/Makefile.in b/bin/named/unix/Makefile.in
-index fd9ca8d..f1c102c 100644
---- a/bin/named/unix/Makefile.in
-+++ b/bin/named/unix/Makefile.in
-@@ -11,6 +11,8 @@ srcdir =	@srcdir@
- VPATH =		@srcdir@
- top_srcdir =	@top_srcdir@
- 
-+EXT_CFLAGS = -fpie
-+
- @BIND9_MAKE_INCLUDES@
- 
- CINCLUDES =	-I${srcdir}/include -I${srcdir}/../include \
+ MAINTAINERCLEANFILES =				\
+ 	named.conf.rst
diff --git a/bind-9.5-dlz-64bit.patch b/bind-9.5-dlz-64bit.patch
deleted file mode 100644
index ec064c6..0000000
--- a/bind-9.5-dlz-64bit.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-diff --git a/contrib/dlz/config.dlz.in b/contrib/dlz/config.dlz.in
-index 47525af..eefe3c3 100644
---- a/contrib/dlz/config.dlz.in
-+++ b/contrib/dlz/config.dlz.in
-@@ -17,6 +17,13 @@
- #
- dlzdir='${DLZ_DRIVER_DIR}'
- 
-+AC_MSG_CHECKING([for target libdir])
-+AC_RUN_IFELSE([int main(void) {exit((sizeof(void *) == 8) ? 0 : 1);}],
-+	[target_lib=lib64],
-+	[target_lib=lib],
-+)
-+AC_MSG_RESULT(["$target_lib"])
-+
- #
- # Private autoconf macro to simplify configuring drivers:
- #
-@@ -292,9 +299,9 @@ case "$use_dlz_bdb" in
- 					then
- 						break
- 					fi
--				elif test -f "$dd/lib/lib${d}.so"
-+				elif test -f "$dd/${target_lib}/lib${d}.so"
- 				then
--					dlz_bdb_libs="-L${dd}/lib -l${d}"
-+					dlz_bdb_libs="-L${dd}/${target_lib} -l${d}"
- 					break
- 				fi
- 			done
-@@ -396,7 +403,7 @@ case "$use_dlz_ldap" in
- 	*)
- 		DLZ_ADD_DRIVER(LDAP, dlz_ldap_driver,
- 				[-I$use_dlz_ldap/include],
--				[-L$use_dlz_ldap/lib -lldap -llber])
-+				[-L$use_dlz_ldap/${target_lib} -lldap -llber])
- 
- 		AC_MSG_RESULT(
- [using LDAP from $use_dlz_ldap/lib and $use_dlz_ldap/include])
-@@ -432,11 +439,11 @@ then
- 		odbcdirs="/usr /usr/local /usr/pkg"
- 		for d in $odbcdirs
- 		do
--			if test -f $d/include/sql.h -a -f $d/lib/libodbc.a
-+			if test -f $d/include/sql.h -a -f $d/${target_lib}/libodbc.a
- 			then
- 				use_dlz_odbc=$d
- 				dlz_odbc_include="-I$use_dlz_odbc/include"
--				dlz_odbc_libs="-L$use_dlz_odbc/lib -lodbc"
-+				dlz_odbc_libs="-L$use_dlz_odbc/${target_lib} -lodbc"
- 				break
- 			fi
- 		done
diff --git a/bind-9.9.1-P2-dlz-libdb.patch b/bind-9.9.1-P2-dlz-libdb.patch
deleted file mode 100644
index 866ed8f..0000000
--- a/bind-9.9.1-P2-dlz-libdb.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-diff -up bind-9.10.1b1/contrib/dlz/config.dlz.in.libdb bind-9.10.1b1/contrib/dlz/config.dlz.in
---- bind-9.10.1b1/contrib/dlz/config.dlz.in.libdb	2014-08-04 12:33:09.320735111 +0200
-+++ bind-9.10.1b1/contrib/dlz/config.dlz.in	2014-08-04 12:41:46.888241910 +0200
-@@ -263,7 +263,7 @@ case "$use_dlz_bdb" in
- 			# Check other locations for includes.
- 			# Order is important (sigh).
- 
--			bdb_incdirs="/db53 /db51 /db48 /db47 /db46 /db45 /db44 /db43 /db42 /db41 /db4 /db"
-+			bdb_incdirs="/db53 /db51 /db48 /db47 /db46 /db45 /db44 /db43 /db42 /db41 /db4 /libdb /db"
- 			# include a blank element first
- 			for d in "" $bdb_incdirs
- 			do
-@@ -288,16 +288,9 @@ case "$use_dlz_bdb" in
- 			bdb_libnames="db53 db-5.3 db51 db-5.1 db48 db-4.8 db47 db-4.7 db46 db-4.6 db45 db-4.5 db44 db-4.4 db43 db-4.3 db42 db-4.2 db41 db-4.1 db"
- 			for d in $bdb_libnames
- 			do
--				if test "$dd" = "/usr"
-+				if test -f "$dd/${target_lib}/lib${d}.so"
- 				then
--					AC_CHECK_LIB($d, db_create, dlz_bdb_libs="-l${d}")
--					if test $dlz_bdb_libs != "yes"
--					then
--						break
--					fi
--				elif test -f "$dd/${target_lib}/lib${d}.so"
--				then
--					dlz_bdb_libs="-L${dd}/${target_lib} -l${d}"
-+					dlz_bdb_libs="-L${dd}/${target_lib}/libdb -l${d}"
- 					break
- 				fi
- 			done
diff --git a/bind.spec b/bind.spec
index cf76813..486f24a 100644
--- a/bind.spec
+++ b/bind.spec
@@ -9,15 +9,19 @@
 %bcond_without GSSTSIG
 # it is not possible to build the package without PKCS11 sub-package
 # due to extensive changes to Makefiles
-%bcond_without PKCS11
+%bcond_with PKCS11 # TODO: Remove
 %bcond_without JSON
+# FIXME: Not ready. Should it be worked on?
 %bcond_without DLZ
 # New MaxMind GeoLite support
 %bcond_without GEOIP2
+# Disabled temporarily until kyua is fixed on rawhide, bug #1926779
 %bcond_without UNITTEST
 %bcond_without DNSTAP
 %bcond_without LMDB
 %bcond_without DOC
+# Because of issues with PDF rebuild, include only HTML pages
+# Current error: unable top find isc-logo.pdf
 %if 0%{?fedora}
 # RHEL and ELN do not have all required packages
 %bcond_without DOCPDF
@@ -47,18 +51,26 @@
 # lib*.so.X versions of selected libraries no longer provided,
 # lib*-%%{version}-RH.so is provided as an internal implementation detail
 
+# Upstream package name
+%global upname bind
+%define upname_compat() \
+%if "%{name}" != "%{upname}" \
+Provides: %1 = %{epoch}:%{version}-%{release} \
+Obsoletes: %1 < 32:9.17.0 \
+Conflicts: %1 \
+%endif
 
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.16.30
+Version:  9.18.4
 Release:  2%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
-Source0:  https://downloads.isc.org/isc/bind9/%{version}/bind-%{version}.tar.xz
+Source0:  https://downloads.isc.org/isc/bind9/%{version}/%{upname}-%{version}.tar.xz
 Source1:  named.sysconfig
-Source2:  https://downloads.isc.org/isc/bind9/%{version}/bind-%{version}.tar.xz.asc
+Source2:  https://downloads.isc.org/isc/bind9/%{version}/%{upname}-%{version}.tar.xz.asc
 Source3:  named.logrotate
 Source4:  https://downloads.isc.org/isc/pgpkeys/codesign2021.txt
 Source16: named.conf
@@ -84,27 +96,11 @@ Source47: named-pkcs11.service
 Source48: setup-named-softhsm.sh
 Source49: named-chroot.files
 
-# Make PKCS11 used only for pkcs11 parts
-Patch1:  bind-9.14-config-pkcs11.patch
-# Fedora specific patch to distribute native-pkcs#11 functionality
-Patch2:  bind-9.10-dist-native-pkcs11.patch
-# Do not use isc-pkcs11.
-Patch3:  bind-9.11-kyua-pkcs11.patch
-
 # Common patches
-Patch18: bind-9.5-PIE.patch
-Patch19: bind-9.16-redhat_doc.patch
-Patch20: bind-9.5-dlz-64bit.patch
-# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/5601
-Patch21: bind93-rh490837.patch
+# FIXME: Is this still required?
+Patch10: bind-9.5-PIE.patch
+Patch16: bind-9.16-redhat_doc.patch
 Patch22: bind-9.11-fips-tests.patch
-Patch24: bind-9.9.1-P2-dlz-libdb.patch
-
-# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/2689
-Patch25:bind-9.11-rh1666814.patch
-# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/5273
-Patch27: bind-9.16-resolv.conf-options-timeout.patch
-Patch28: bind-9.16-resolv.conf-options-timeout-test.patch
 
 %{?systemd_ordering}
 Requires:       coreutils
@@ -112,22 +108,23 @@ Requires(pre):  shadow-utils
 Requires(post): shadow-utils
 Requires(post): glibc-common
 Requires(post): grep
-Requires:       bind-libs%{?_isa} = %{epoch}:%{version}-%{release}
+Requires:       %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
 # This wild require should satisfy %%selinux_set_boolean macro only
 # in case it needs to be used
 Requires(post): ((policycoreutils-python-utils and libselinux-utils) if (selinux-policy-targeted or selinux-policy-mls))
 Requires(post): ((selinux-policy and selinux-policy-base) if (selinux-policy-targeted or selinux-policy-mls))
-Recommends:     bind-utils bind-dnssec-utils
+Recommends:     %{name}-utils %{name}-dnssec-utils
+%upname_compat %{upname}
+
 BuildRequires:  gcc, make
 BuildRequires:  openssl-devel, libtool, autoconf, pkgconfig, libcap-devel
 BuildRequires:  libidn2-devel, libxml2-devel
 BuildRequires:  systemd-rpm-macros
 BuildRequires:  selinux-policy
-# needed for %%{__python3} macro
-BuildRequires:  python3-devel
-BuildRequires:  python3-ply
 BuildRequires:  findutils sed
+BuildRequires:  libnghttp2-devel
 %if 0%{?fedora}
+BuildRequires:  jemalloc-devel
 BuildRequires:  gnupg2
 %endif
 BuildRequires:  libuv-devel
@@ -136,7 +133,7 @@ BuildRequires:  openldap-devel, libpq-devel, sqlite-devel, mariadb-connector-c-d
 %endif
 %if %{with UNITTEST}
 # make unit dependencies
-BuildRequires:  libcmocka-devel kyua
+BuildRequires:  libcmocka-devel
 %endif
 %if %{with PKCS11} && (%{with UNITTEST} || %{with SYSTEMTEST})
 BuildRequires:  softhsm
@@ -185,9 +182,9 @@ tools for verifying that the DNS server is operating properly.
 %if %{with PKCS11}
 %package pkcs11
 Summary: Bind with native PKCS#11 functionality for crypto
-Requires: bind%{?_isa} = %{epoch}:%{version}-%{release}
-Requires: bind-libs%{?_isa} = %{epoch}:%{version}-%{release}
-Requires: bind-pkcs11-libs%{?_isa} = %{epoch}:%{version}-%{release}
+Requires: %{name}%{?_isa} = %{epoch}:%{version}-%{release}
+Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
+Requires: %{name}-pkcs11-libs%{?_isa} = %{epoch}:%{version}-%{release}
 Recommends: softhsm
 
 %description pkcs11
@@ -195,21 +192,27 @@ This is a version of BIND server built with native PKCS#11 functionality.
 It is important to have SoftHSM v2+ installed and some token initialized.
 For other supported HSM modules please check the BIND documentation.
 
+# TODO: Those utils can be used also without pkcs11 variant, but are not?
 %package pkcs11-utils
 Summary: Bind tools with native PKCS#11 for using DNSSEC
-Requires: bind-pkcs11-libs%{?_isa} = %{epoch}:%{version}-%{release}
-Obsoletes: bind-pkcs11 < 32:9.9.4-16.P2
-Requires: bind-dnssec-doc = %{epoch}:%{version}-%{release}
+Obsoletes: %{name}-pkcs11 < 32:9.9.4-16.P2
+Requires: %{name}-dnssec-doc = %{epoch}:%{version}-%{release}
+%if %{with PKCS11}
+Requires: %{name}-pkcs11-libs%{?_isa} = %{epoch}:%{version}-%{release}
+%endif
 
 %description pkcs11-utils
 This is a set of PKCS#11 utilities that when used together create rsa
-keys in a PKCS11 keystore. Also utilities for working with DNSSEC
+keys in a PKCS11 keystore.
+%if %{with PKCS11}
+Also utilities for working with DNSSEC
 compiled with native PKCS#11 functionality are included.
+%endif
 
 %package pkcs11-libs
 Summary: Bind libraries compiled with native PKCS#11
-Requires: bind-license = %{epoch}:%{version}-%{release}
-Requires: bind-libs%{?_isa} = %{epoch}:%{version}-%{release}
+Requires: %{name}-license = %{epoch}:%{version}-%{release}
+Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
 
 %description pkcs11-libs
 This is a set of BIND libraries (dns, isc) compiled with native PKCS#11
@@ -217,8 +220,8 @@ functionality.
 
 %package pkcs11-devel
 Summary: Development files for Bind libraries compiled with native PKCS#11
-Requires: bind-pkcs11-libs%{?_isa} = %{epoch}:%{version}-%{release}
-Requires: bind-devel%{?_isa} = %{epoch}:%{version}-%{release}
+Requires: %{name}-pkcs11-libs%{?_isa} = %{epoch}:%{version}-%{release}
+Requires: %{name}-devel%{?_isa} = %{epoch}:%{version}-%{release}
 
 %description pkcs11-devel
 This a set of development files for BIND libraries (dns, isc) compiled
@@ -227,13 +230,13 @@ with native PKCS#11 functionality.
 
 %package libs
 Summary: Libraries used by the BIND DNS packages
-Requires: bind-license = %{epoch}:%{version}-%{release}
-Provides: bind-libs-lite = %{epoch}:%{version}-%{release}
-Obsoletes: bind-libs-lite < 32:9.16.13
+Requires: %{name}-license = %{epoch}:%{version}-%{release}
+Provides: %{name}-libs-lite = %{epoch}:%{version}-%{release}
+Obsoletes: %{name}-libs-lite < 32:9.16.13
 
 %description libs
 Contains heavyweight version of BIND suite libraries used by both named DNS
-server and utilities in bind-utils package.
+server and utilities in %{name}-utils package.
 
 %package license
 Summary:  License of the BIND DNS suite
@@ -244,9 +247,10 @@ Contains license of the BIND DNS suite.
 
 %package utils
 Summary: Utilities for querying DNS name servers
-Requires: bind-libs%{?_isa} = %{epoch}:%{version}-%{release}
+Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
 # For compatibility with Debian package
 Provides: dnsutils = %{epoch}:%{version}-%{release}
+%upname_compat %{upname}-utils
 
 %description utils
 Bind-utils contains a collection of utilities for querying DNS (Domain
@@ -255,37 +259,37 @@ hosts. These tools will provide you with the IP addresses for given
 host names, as well as other information about registered domains and
 network addresses.
 
-You should install bind-utils if you need to get information from DNS name
+You should install %{name}-utils if you need to get information from DNS name
 servers.
 
 %package dnssec-utils
 Summary: DNSSEC keys and zones management utilities
-Requires: bind-libs%{?_isa} = %{epoch}:%{version}-%{release}
-Recommends: bind-utils
-Requires: python3-bind = %{epoch}:%{version}-%{release}
-Requires: bind-dnssec-doc = %{epoch}:%{version}-%{release}
+Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
+Recommends: %{name}-utils
+Requires: %{name}-dnssec-doc = %{epoch}:%{version}-%{release}
+%upname_compat %{upname}-dnssec-utils
 
 %description dnssec-utils
-Bind-dnssec-utils contains a collection of utilities for editing
+%{name}-dnssec-utils contains a collection of utilities for editing
 DNSSEC keys and BIND zone files. These tools provide generation,
 revocation and verification of keys and DNSSEC signatures in zone files.
 
-You should install bind-dnssec-utils if you need to sign a DNS zone
+You should install %{name}-dnssec-utils if you need to sign a DNS zone
 or maintain keys for it.
 
 %package dnssec-doc
 Summary: Manual pages of DNSSEC utilities
-Requires: bind-license = %{epoch}:%{version}-%{release}
+Requires: %{name}-license = %{epoch}:%{version}-%{release}
 BuildArch:noarch
 
 %description dnssec-doc
-Bind-dnssec-doc contains manual pages for bind-dnssec-utils.
+%{name}-dnssec-doc contains manual pages for %{name}-dnssec-utils.
 
 %package devel
 Summary:  Header files and libraries needed for bind-dyndb-ldap
-Provides: bind-lite-devel = %{epoch}:%{version}-%{release}
-Obsoletes: bind-lite-devel < 32:9.16.6-3
-Requires: bind-libs%{?_isa} = %{epoch}:%{version}-%{release}
+Provides: %{name}-lite-devel = %{epoch}:%{version}-%{release}
+Obsoletes: %{name}-lite-devel < 32:9.16.6-3
+Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
 Requires: openssl-devel%{?_isa} libxml2-devel%{?_isa}
 Requires: libcap-devel%{?_isa}
 %if %{with GSSTSIG}
@@ -305,7 +309,7 @@ Requires:  libmaxminddb-devel%{?_isa}
 %endif
 
 %description devel
-The bind-devel package contains full version of the header files and libraries
+The %{name}-devel package contains full version of the header files and libraries
 required for building bind-dyndb-ldap. Upstream no longer supports nor recommends
 bind libraries for third party applications.
 
@@ -314,7 +318,7 @@ Summary:        A chroot runtime environment for the ISC BIND DNS server, named(
 Prefix:         %{chroot_prefix}
 # grep is required due to setup-named-chroot.sh script
 Requires:       grep
-Requires:       bind%{?_isa} = %{epoch}:%{version}-%{release}
+Requires:       %{name}%{?_isa} = %{epoch}:%{version}-%{release}
 
 %description chroot
 This package contains a tree of files which can be used as a
@@ -325,21 +329,21 @@ Based on the code from Jan "Yenya" Kasprzak <kas@fi.muni.cz>
 %if %{with DLZ}
 %package dlz-filesystem
 Summary: BIND server filesystem DLZ module
-Requires: bind%{?_isa} = %{epoch}:%{version}-%{release}
+Requires: %{name}%{?_isa} = %{epoch}:%{version}-%{release}
 
 %description dlz-filesystem
 Dynamic Loadable Zones filesystem module for BIND server.
 
 %package dlz-ldap
 Summary: BIND server ldap DLZ module
-Requires: bind%{?_isa} = %{epoch}:%{version}-%{release}
+Requires: %{name}%{?_isa} = %{epoch}:%{version}-%{release}
 
 %description dlz-ldap
 Dynamic Loadable Zones LDAP module for BIND server.
 
 %package dlz-mysql
 Summary: BIND server mysql and mysqldyn DLZ modules
-Requires: bind%{?_isa} = %{epoch}:%{version}-%{release}
+Requires: %{name}%{?_isa} = %{epoch}:%{version}-%{release}
 Provides: %{name}-dlz-mysqldyn = %{epoch}:%{version}-%{release}
 Obsoletes: %{name}-dlz-mysqldyn < 32:9.16.6-3
 
@@ -349,28 +353,16 @@ Contains also mysqldyn module with dynamic DNS updates (DDNS) support.
 
 %package dlz-sqlite3
 Summary: BIND server sqlite3 DLZ module
-Requires: bind%{?_isa} = %{epoch}:%{version}-%{release}
+Requires: %{name}%{?_isa} = %{epoch}:%{version}-%{release}
 
 %description dlz-sqlite3
 Dynamic Loadable Zones sqlite3 module for BIND server.
 %endif
 
-
-%package -n python3-bind
-Summary:   A module allowing rndc commands to be sent from Python programs
-Requires:  bind-license = %{epoch}:%{version}-%{release}
-Requires:  python3 python3-ply %{?py3_dist:%py3_dist ply}
-BuildArch: noarch
-%{?python_provide:%python_provide python3-bind}
-%{?python_provide:%python_provide python3-isc}
-
-%description -n python3-bind
-This package provides a module which allows commands to be sent to rndc directly from Python programs.
-
 %if %{with DOC}
 %package doc
 Summary:   BIND 9 Administrator Reference Manual
-Requires:  bind-license = %{epoch}:%{version}-%{release}
+Requires:  %{name}-license = %{epoch}:%{version}-%{release}
 Requires:  python3-sphinx_rtd_theme
 BuildArch: noarch
 
@@ -392,25 +384,15 @@ in HTML and PDF format.
 # RHEL does not yet support this verification
 %{gpgverify} --keyring='%{SOURCE4}' --signature='%{SOURCE2}' --data='%{SOURCE0}'
 %endif
-%autosetup -n %{name}-%{version} -N
-%autopatch -p1 -m 18
-%if %{with PKCS11}
-%autopatch -p1 -m 1 -M 1
-cp -r bin/named{,-pkcs11}
-cp -r bin/dnssec{,-pkcs11}
-cp -r lib/dns{,-pkcs11}
-cp -r lib/ns{,-pkcs11}
-%autopatch -p1 -m 2 -M 17
-%endif
+%autosetup -n %{upname}-%{version} -p1
 
 # Sparc and s390 arches need to use -fPIE
 %ifarch sparcv9 sparc64 s390 s390x
-for i in bin/named/{,unix}/Makefile.in; do
+for i in bin/named/Makefile.am; do
   sed -i 's|fpie|fPIE|g' $i
 done
 %endif
 
-sed -e 's|"$TOP/config.guess"|"$TOP_SRCDIR/config.guess"|' -i bin/tests/system/ifconfig.sh
 :;
 
 
@@ -420,15 +402,12 @@ sed -e 's|"$TOP/config.guess"|"$TOP_SRCDIR/config.guess"|' -i bin/tests/system/i
 
 # normal and pkcs11 unit tests
 %define unit_prepare_build() \
-  cp -uv Kyuafile "%{1}/" \
   find lib -name 'K*.key' -exec cp -uv '{}' "%{1}/{}" ';' \
-  find lib -name 'Kyuafile' -exec cp -uv '{}' "%{1}/{}" ';' \
   find lib -name 'testdata' -type d -exec cp -Tav '{}' "%{1}/{}" ';' \
   find lib -name 'testkeys' -type d -exec cp -Tav '{}' "%{1}/{}" ';' \
 
 %define systemtest_prepare_build() \
   cp -Tuav bin/tests "%{1}/bin/tests/" \
-  cp -uv version "%{1}" \
 
 CFLAGS="$CFLAGS $RPM_OPT_FLAGS"
 %if %{with TSAN}
@@ -439,10 +418,10 @@ export STD_CDEFINES="$CPPFLAGS"
 
 
 sed -i -e \
-'s/RELEASEVER=\(.*\)/RELEASEVER=\1-RH/' \
-version
+'s/([bind_VERSION_EXTRA],\s*\([^)]*\))/([bind_VERSION_EXTRA], \1-RH)/' \
+configure.ac
 
-libtoolize -c -f; aclocal -I libtool.m4 --force; autoconf -f
+autoreconf --force --install
 
 mkdir build
 
@@ -456,8 +435,6 @@ pushd build
 LIBDIR_SUFFIX=
 export LIBDIR_SUFFIX
 %configure \
-  --with-python=%{__python3} \
-  --with-libtool \
   --localstatedir=%{_var} \
   --with-pic \
   --disable-static \
@@ -471,7 +448,6 @@ export LIBDIR_SUFFIX
   --enable-native-pkcs11 \
   --with-pkcs11=%{_libdir}/pkcs11/libsofthsm2.so \
 %endif
-  --with-dlopen=yes \
 %if %{with GSSTSIG}
   --with-gssapi=yes \
 %endif
@@ -481,7 +457,7 @@ export LIBDIR_SUFFIX
   --with-lmdb=no \
 %endif
 %if %{with JSON}
-  --without-libjson --with-json-c \
+  --with-json-c \
 %endif
 %if %{with DNSTAP}
   --enable-dnstap \
@@ -496,9 +472,6 @@ export LIBDIR_SUFFIX
   pushd lib
   SRCLIB="../../../lib"
   (cd dns && ln -s ${SRCLIB}/dns/dnstap.proto)
-%if %{with PKCS11}
-  (cd dns-pkcs11 && ln -s ${SRCLIB}/dns-pkcs11/dnstap.proto)
-%endif
   popd
 %endif
 
@@ -512,27 +485,14 @@ fmtutil-user --missing || :
 
 %make_build
 
-# Regenerate dig.1 manpage
-pushd bin/dig
-make man
-popd
-pushd bin/python
-make man
-popd
-
 %if %{with DOC}
   make doc
 %endif
 
 %if %{with DLZ}
   pushd contrib/dlz/modules
-  for DIR in mysql mysqldyn; do
-    sed -e 's/@DLZ_DRIVER_MYSQL_INCLUDES@/$(shell mysql_config --cflags)/' \
-        -e 's/@DLZ_DRIVER_MYSQL_LIBS@/$(shell mysql_config --libs)/' \
-        $DIR/Makefile.in > $DIR/Makefile
-  done
   for DIR in filesystem ldap mysql mysqldyn sqlite3; do
-    make -C $DIR CFLAGS="-fPIC -I../include $CFLAGS $LDFLAGS"
+    make -C $DIR CFLAGS="-fPIC -I../include $CFLAGS $LDFLAGS -DPTHREADS=1" LDFLAGS="$LDFLAGS"
   done
   popd
 %endif
@@ -639,11 +599,6 @@ install -m 644 %{SOURCE46} ${RPM_BUILD_ROOT}%{_unitdir}
 
 %if %{with PKCS11}
 install -m 644 %{SOURCE47} ${RPM_BUILD_ROOT}%{_unitdir}
-%else
-# Not packaged without PKCS11
-find ${RPM_BUILD_ROOT}%{_includedir}/bind9/pk11 ${RPM_BUILD_ROOT}%{_includedir}/bind9/pkcs11 \
-  -name '*.h' \! -name site.h -delete
-
 %endif
 
 mkdir -p ${RPM_BUILD_ROOT}%{_libexecdir}
@@ -659,14 +614,22 @@ mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/sysconfig
 install -m 644 %{SOURCE1} ${RPM_BUILD_ROOT}%{_sysconfdir}/sysconfig/named
 install -m 644 %{SOURCE49} ${RPM_BUILD_ROOT}%{_sysconfdir}/named-chroot.files
 
+pushd ${RPM_BUILD_ROOT}%{_sbindir}
+# Compatibility with previous major versions, only for selected binaries
+for BIN in named-checkconf named-checkzone named-compilezone
+do
+  ln -s ../bin/$BIN $BIN
+done
+popd
+
 %if %{with DLZ}
   pushd build
   pushd contrib/dlz/modules
   for DIR in filesystem ldap mysql mysqldyn sqlite3; do
-    %make_install -C $DIR libdir=%{_libdir}/named
+    %make_install -C $DIR libdir=%{_libdir}/bind
   done
-  pushd ${RPM_BUILD_ROOT}/%{_libdir}/bind
-    cp -s ../named/dlz_*.so .
+  pushd ${RPM_BUILD_ROOT}/%{_libdir}/named
+    cp -s ../bind/dlz_*.so .
   popd
   mkdir -p doc/{mysql,mysqldyn}
   cp -p mysqldyn/testing/README doc/mysqldyn/README.testing
@@ -676,9 +639,6 @@ install -m 644 %{SOURCE49} ${RPM_BUILD_ROOT}%{_sysconfdir}/named-chroot.files
   popd
 %endif
 
-# Install isc/errno2result.h header
-install -m 644 lib/isc/unix/errno2result.h ${RPM_BUILD_ROOT}%{_includedir}/bind9/isc
-
 # Remove libtool .la files:
 find ${RPM_BUILD_ROOT}/%{_libdir} -name '*.la' -exec '/bin/rm' '-f' '{}' ';';
 
@@ -708,15 +668,15 @@ rm -f ${RPM_BUILD_ROOT}%{_mandir}/man8/named-nzd2nzf.8* || true
 
 pushd ${RPM_BUILD_ROOT}%{_mandir}/man8
 ln -s ddns-confgen.8.gz tsig-keygen.8.gz
-ln -s named-checkzone.8.gz named-compilezone.8.gz
+popd
+pushd ${RPM_BUILD_ROOT}%{_mandir}/man1
+ln -s named-checkzone.1.gz named-compilezone.1.gz
 popd
 
 %if %{with DOC}
 mkdir -p ${RPM_BUILD_ROOT}%{_pkgdocdir}
 cp -a build/doc/arm/_build/html ${RPM_BUILD_ROOT}%{_pkgdocdir}
 rm -rf ${RPM_BUILD_ROOT}%{_pkgdocdir}/html/.{buildinfo,doctrees}
-# Backward compatible link to 9.11 documentation
-(cd ${RPM_BUILD_ROOT}%{_pkgdocdir} && ln -s html/index.html Bv9ARM.html)
 # Share static data from original sphinx package
 for DIR in %{python3_sitelib}/sphinx_rtd_theme/static/*
 do
@@ -729,7 +689,7 @@ do
 done
 %endif
 %if %{with DOCPDF}
-cp -a build/doc/arm/Bv9ARM.pdf ${RPM_BUILD_ROOT}%{_pkgdocdir}
+cp -p build/doc/arm/_build/latex/Bv9ARM.pdf ${RPM_BUILD_ROOT}%{_pkgdocdir}
 %endif
 
 # Ghost config files:
@@ -795,7 +755,7 @@ else
     /sbin/usermod -s /sbin/nologin named
   fi
   # Checkconf will parse out comments
-  if /usr/sbin/named-checkconf -p /etc/named.conf 2>/dev/null | grep -q named.iscdlv.key
+  if /usr/bin/named-checkconf -p /etc/named.conf 2>/dev/null | grep -q named.iscdlv.key
   then
     echo "Replacing obsolete named.iscdlv.key with named.root.key..."
     if cp -Rf --preserve=all --remove-destination /etc/named.conf /etc/named.conf.rpmbackup; then
@@ -880,10 +840,10 @@ fi;
 
 %files
 # TODO: Move from lib/bind to lib/named, as used by upstream
+# FIXME: current build targets filters into %%_libdir/bind again?
 %dir %{_libdir}/bind
+%{_libdir}/bind/filter*.so
 %dir %{_libdir}/named
-%{_libdir}/named/*.so
-%exclude %{_libdir}/named/dlz_*.so
 %config(noreplace) %verify(not md5 size mtime) %{_sysconfdir}/sysconfig/named
 %config(noreplace) %attr(0644,root,named) %{_sysconfdir}/named.root.key
 %config(noreplace) %{_sysconfdir}/logrotate.d/named
@@ -891,12 +851,13 @@ fi;
 %{_sysconfdir}/rwtab.d/named
 %{_unitdir}/named.service
 %{_unitdir}/named-setup-rndc.service
-%{_sbindir}/named-journalprint
-%{_sbindir}/named-checkconf
+%{_bindir}/named-journalprint
+%{_bindir}/named-checkconf
 %{_bindir}/named-rrchecker
 %{_bindir}/mdig
 %{_sbindir}/named
 %{_sbindir}/rndc*
+%{_sbindir}/named-checkconf
 %{_libexecdir}/generate-rndc-key.sh
 %{_mandir}/man1/mdig.1*
 %{_mandir}/man1/named-rrchecker.1*
@@ -904,11 +865,11 @@ fi;
 %{_mandir}/man5/rndc.conf.5*
 %{_mandir}/man8/rndc.8*
 %{_mandir}/man8/named.8*
-%{_mandir}/man8/named-checkconf.8*
+%{_mandir}/man1/named-checkconf.1*
 %{_mandir}/man8/rndc-confgen.8*
-%{_mandir}/man8/named-journalprint.8*
-%{_mandir}/man8/filter-aaaa.8.gz
-%doc CHANGES README named.conf.default
+%{_mandir}/man1/named-journalprint.1*
+%{_mandir}/man8/filter-*.8.gz
+%doc CHANGES README.md named.conf.default
 %doc sample/
 
 # Hide configuration
@@ -958,7 +919,9 @@ fi;
 %{_bindir}/arpaname
 %{_sbindir}/ddns-confgen
 %{_sbindir}/tsig-keygen
-%{_sbindir}/nsec3hash
+%{_bindir}/nsec3hash
+%{_bindir}/named-checkzone
+%{_bindir}/named-compilezone
 %{_sbindir}/named-checkzone
 %{_sbindir}/named-compilezone
 %if %{with DNSTAP}
@@ -966,8 +929,8 @@ fi;
 %{_mandir}/man1/dnstap-read.1*
 %endif
 %if %{with LMDB}
-%{_sbindir}/named-nzd2nzf
-%{_mandir}/man8/named-nzd2nzf.8*
+%{_bindir}/named-nzd2nzf
+%{_mandir}/man1/named-nzd2nzf.1*
 %endif
 %{_mandir}/man1/host.1*
 %{_mandir}/man1/nsupdate.1*
@@ -977,21 +940,21 @@ fi;
 %{_mandir}/man1/arpaname.1*
 %{_mandir}/man8/ddns-confgen.8*
 %{_mandir}/man8/tsig-keygen.8*
-%{_mandir}/man8/nsec3hash.8*
-%{_mandir}/man8/named-checkzone.8*
-%{_mandir}/man8/named-compilezone.8*
+%{_mandir}/man1/nsec3hash.1*
+%{_mandir}/man1/named-checkzone.1*
+%{_mandir}/man1/named-compilezone.1*
 %{_sysconfdir}/trusted-key.key
 
 %files dnssec-utils
-%{_sbindir}/dnssec*
+%{_bindir}/dnssec*
 %if %{with PKCS11}
 %exclude %{_sbindir}/dnssec*pkcs11
 %endif
 
 %files dnssec-doc
-%{_mandir}/man8/dnssec*.8*
+%{_mandir}/man1/dnssec*.1*
 %if %{with PKCS11}
-%exclude %{_mandir}/man8/dnssec*-pkcs11.8*
+%exclude %{_mandir}/man1/dnssec*-pkcs11.1*
 %endif
 
 %files devel
@@ -1010,8 +973,6 @@ fi;
 %{_includedir}/bind9/dst
 %{_includedir}/bind9/irs
 %{_includedir}/bind9/isc
-%dir %{_includedir}/bind9/pk11
-%{_includedir}/bind9/pk11/site.h
 %{_includedir}/bind9/isccfg
 
 %files chroot
@@ -1059,22 +1020,21 @@ fi;
 %{_libexecdir}/setup-named-softhsm.sh
 
 %files pkcs11-utils
-%{_sbindir}/dnssec*pkcs11
-%{_sbindir}/pkcs11-destroy
-%{_sbindir}/pkcs11-keygen
-%{_sbindir}/pkcs11-list
-%{_sbindir}/pkcs11-tokens
-%{_mandir}/man8/pkcs11*.8*
-%{_mandir}/man8/dnssec*-pkcs11.8*
+%{_bindir}/pkcs11-destroy
+%{_bindir}/pkcs11-keygen
+%{_bindir}/pkcs11-list
+%{_bindir}/pkcs11-tokens
+%{_mandir}/man1/pkcs11-*.1*
+%if %{with PKCS11}
+%{_bindir}/dnssec*pkcs11
+%{_mandir}/man1/dnssec*-pkcs11.1*
+%endif
 
 %files pkcs11-libs
 %{_libdir}/libdns-pkcs11-%{version}*.so
 %{_libdir}/libns-pkcs11-%{version}*.so
 
 %files pkcs11-devel
-%{_includedir}/bind9/pk11/*.h
-%exclude %{_includedir}/bind9/pk11/site.h
-%{_includedir}/bind9/pkcs11
 %{_libdir}/libdns-pkcs11.so
 %{_libdir}/libns-pkcs11.so
 %endif
@@ -1099,14 +1059,9 @@ fi;
 
 %endif
 
-%files -n python3-bind
-%{python3_sitelib}/*.egg-info
-%{python3_sitelib}/isc/
-
 %if %{with DOC}
 %files doc
 %dir %{_pkgdocdir}
-%doc %{_pkgdocdir}/Bv9ARM.html
 %doc %{_pkgdocdir}/html
 %endif
 %if %{with DOCPDF}
@@ -1114,6 +1069,9 @@ fi;
 %endif
 
 %changelog
+* Wed Jul 20 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.4-1
+- Update to 9.18.4 (#2057493)
+
 * Wed Jul 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.16.30-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
 
diff --git a/bind93-rh490837.patch b/bind93-rh490837.patch
deleted file mode 100644
index 4b32b4d..0000000
--- a/bind93-rh490837.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-diff --git a/lib/isc/lex.c b/lib/isc/lex.c
-index cd44fe3..5b7c539 100644
---- a/lib/isc/lex.c
-+++ b/lib/isc/lex.c
-@@ -27,6 +27,8 @@
- #include <isc/string.h>
- #include <isc/util.h>
- 
-+#include "../errno2result.h"
-+
- typedef struct inputsource {
- 	isc_result_t result;
- 	bool is_file;
-@@ -422,7 +424,7 @@ isc_lex_gettoken(isc_lex_t *lex, unsigned int options, isc_token_t *tokenp) {
- #endif /* if defined(HAVE_FLOCKFILE) && defined(HAVE_GETC_UNLOCKED) */
- 				if (c == EOF) {
- 					if (ferror(stream)) {
--						source->result = ISC_R_IOERROR;
-+						source->result = isc__errno2result(errno);
- 						result = source->result;
- 						goto done;
- 					}
-diff --git a/lib/isc/unix/errno2result.c b/lib/isc/unix/errno2result.c
-index e3e2644..5e58600 100644
---- a/lib/isc/unix/errno2result.c
-+++ b/lib/isc/unix/errno2result.c
-@@ -37,6 +37,7 @@ isc___errno2result(int posixerrno, bool dolog, const char *file,
- 	case EINVAL: /* XXX sometimes this is not for files */
- 	case ENAMETOOLONG:
- 	case EBADF:
-+	case EISDIR:
- 		return (ISC_R_INVALIDFILE);
- 	case ENOENT:
- 		return (ISC_R_FILENOTFOUND);
diff --git a/codesign2019.txt b/codesign2019.txt
new file mode 100644
index 0000000..1807b58
--- /dev/null
+++ b/codesign2019.txt
@@ -0,0 +1,252 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Comment: GPGTools - http://gpgtools.org
+
+mQINBFwq9BQBEADHjPDCwsHVtxnMNilgu187W8a9rYTMLgLfQwioSbjsF7dUJu8m
+r1w2stcsatRs7HBk/j26RNJagY2Jt0QufOQLlTePpTl6UPU8EeiJ8c15DNf45TMk
+pa/3MdIVpDnBioyD1JNqsI4z+yCYZ7p/TRVCyh5vCcwmt5pdKjKMTcu7aD2PtTtI
+yhTIetJavy1HQmgOl4/t/nKL7Lll2xtZ56JFUt7epo0h69fiUvPewkhykzoEf4UG
+ZFHSLZKqdMNPs/Jr9n7zS+iOgEXJnKDkp8SoXpAcgJ5fncROMXpxgY2U+G5rB9n0
+/hvV1zG+EP6OLIGqekiDUga84LdmR/8Cyc7DimUmaoIZXrAo0Alpt0aZ8GimdKmh
+qirIguJOSrrsZTeZLilCWu37fRIjCQ3dSMNyhHJaOhRJQpQOEDG7jHxFak7627aF
+UnVwBAOK3NlFfbomapXQm64lYNoONGrpV0ctueD3VoPipxIyzNHHgcsXDZ6C00sv
+SbuuS9jlFEDonA6S8tApKgkEJuToBuopM4xqqwHNJ4e6QoXYjERIgIBTco3r/76D
+o22ZxSK1m2m2i+p0gnWTlFn6RH+r6gfLwZRj8iR4fa0yMn3DztyTO6H8AiaslONt
+LV2kvkhBar1/6dzlBvMdiRBejrVnw+Jg2bOmYTncFN00szPOXbEalps8wwARAQAB
+tE1JbnRlcm5ldCBTeXN0ZW1zIENvbnNvcnRpdW0sIEluYy4gKFNpZ25pbmcga2V5
+LCAyMDE5LTIwMjApIDxjb2Rlc2lnbkBpc2Mub3JnPokCVAQTAQgAPhYhBK4/rHln
+EexZ/AB6pHS7a5pMuz04BQJcKvQUAhsDBQkD7JcABQsJCAcCBhUKCQgLAgQWAgMB
+Ah4BAheAAAoJEHS7a5pMuz0476oP/1+UaSHfe4WVHV43QaQ/z1rw7vg2aHEwyWJA
+1D1tBr9+LvfohswwWBLIjcKRaoXZ4pLBFjuiYHBTsdaAQFeQQvQTXMmBx21ZyUZj
+tjim8f9T1JhmIrMx6tF14NbqFpjw82Mv0rc8y74pdRvkdnFigqLKUoN2tFQlKeG+
+5T24zNwrGrlR3S7gnM47nD1JqKwt4GnczLnMBW/0gbLscMUpAeNo/gY4g0GV/zkn
+Rt91bLpcEyDAv+ZhQZbkJ49dnNzl5cTK5+uQWnlAZAdPecdLkvBNRNgj/FKL41RF
+JGN6eqq3+jlPbyj9okeJoGQ64Ibv1ZHVTQIx5vT1+PuVX/Nm0GqSUZdLqR33daKI
+hjpgUdUK/D0AnN5ulVuE1NnZWjVDTXVEeU8DFvi4lxZVHnZixejxFIZ7vRMvyaHa
+xLwbevwEUuPLzWn3XhC5yQeqCe6zmzzaPhPlg6NTnM5wgzcKORqCXgxzmtnX+Pbd
+gXTwNKAJId/141vj1OtZQKJexG9QLufMjBg5rg/qdKooozremeM+FovIocbdFnmX
+pzP8it8r8FKi7FpXRE3fwxwba4Y9AS2/owtuixlJ2+7M2OXwZEtxyXTXw2v5GFOP
+vN64G/b71l9c3yKVlQ3BXD0jErv9XcieeFDR9PK0XGlsxykPcIXZYVy2KSWptkSf
+6f2op3tMiQEzBBABCAAdFiEEFcm6uMUTPAcGawLtlumWUDlMmawFAlwuSqAACgkQ
+lumWUDlMmaz+igf/ZW8OY5aWjRk7QiXp93jkWRIbMi8kB9jW5u6tfYXFjMADpqiQ
+yYdzEHFayRF92PQwj81UzIWzOWjErFWLDE2xol9sP5LdzeqoyED+XTqKggpVsIs+
+Lq672qnumQoZKp1YGb8MDocU2DNg/VsMdi7kCnEnPbcSuBxksmxGYomusXNrAF94
+1OJ2sqd9BuFamLIyn8XUCGGYlsvMoe4kTCg6Cc1sQvx0lDG8urKN57jBKWbP4alV
++JBV5KQcf74gzPmE3ypgY1tMEwxyH/WyS9ekDbai0qauX6eUAsM1bduH8fIcknLS
+Zl5hrJTrzWFF9/DKOth8QOwhJ9zoIF1fcAsx9okBMwQQAQgAHRYhBHpqR7X54SM6
+0lUrXL2X3GOe6MR7BQJcLktcAAoJEL2X3GOe6MR7jwEH/iaolMeno1oeWAgzN6Mg
+bx3maweh/9Vqty1fwk7Crq1G78X5i1OCkknEL2p0Bfle4ApwcC4HZVcqCgoYpRV3
+/EEXtwkMNy3plWdBbLCQSev/E1D39GzgAHiMnv7NUJnkoJbvMrvrAiUTXPTtARMM
+gjEpvgEs60wuJxS8ESomRhe/KW4myxDoBxF+K+e5bOkOvvWVcAYJHWZ1BIZs4n6b
++C2vO8q5aKTkQ/XvNT7utbTOqj1SGhItRaAQKXHBdzkQ1Et3wTA4+uRg4gK12624
+9LperYs26w9X9UzApl+qVxQhtWUw3tnUXMastDfQrRcvJgq1xpv++OqX5Uc93RTf
+SNWJAjMEEAEIAB0WIQS+DpdItxglOii7if/xsRvwXPAuVwUCXC5LlQAKCRDxsRvw
+XPAuV29KEACEwlTVVKe4gnBYHnlAD7csoQ0+gJ6C+Ofzlw+UItRIcFeVCAknSGBs
+NPxr9JStIvKpmsbSKpCNUEAYnRP2immh94y/C6BuTe1uUUmqBGr1f4OAUwZpmI29
+ixYeY/uUs9FZO3bS0/WtG46tdcJK41qtM0DYAGT3oeZhJMTW15dfvMGlFukauSOU
++BbR+6sZhqdbWl/AOTE/6x5otnAaW0GObY/BW240Xq/KTgBrzVdK5qNoYsMVsiTd
+0im0JKvFG08ED+ZfcILhlO6G9jRhoTkhtYuf8CKN1dPf2IoB5FrRFf0xqRr9hNlk
+X7ViNMP9OPb8i3BubWvRi5rNSquCwrFATSiAgaA9Yi1BNzQsmQxOql9lsh7eCH7m
++8zzUg9umWI6PkSv8vHBo2kPX73wmtEsF6vxJlk0yDBuQw7y0uuKh406tEEk4cP2
+8U4baq+ihpioupDhNuEII1h1Eh/RBE408RAOpcr+2F0m/fKOoJyz7u+AxyV81Ia6
+fyBnUfZnlfKo16w87c1HJRs9dKkRa5yGziBf9TcED3sru58Pftes2Nr80/iOh26i
+P2pRihcIyrmeAqDWnneErVCmPMDTe6zkMrm/0iZ25/Jfq+M8IHEzFEw3Y1FBOeFg
+9TyMDwYG2biJPTNTDO0BQ+Rrvs4SjFWEYSxgJSvG1jMfSPt5AR6MJrkCDQRcKvQU
+ARAAufZX5WzJr0lZAhxaGpHY6JMBr4jVOCP4TrDZhwC2K4CXNM/PLLNisWzquiWa
+FvUDhB89kCxrEhipwVFYhBr16CDQxrr8yhah3RIxrBMYhRTxgIAkANgkhGWfDJSE
+zXauA7krYtS3rYwhfXe4cNsTkLPbnMUlyLJcqj2wnZcZIt97aL+NFRPyfIw1KfUb
+9u3tB9seDYbvTEULeL07aTnHpWM5f3bTwJrJ2OFPzXseCCzPiVNh3Bv+YtJ1pMTr
+c/UHO5DoJuHLsF0wicPSrpD0twspFdR/0rT6eNycsaCtV4GQzBcMPvY7qai5XrZm
+Cqgluo1W6l6+F5YrKvRMtyyFkUNGcPywdjSlP44JyRrS2uzvFUViSsJArcmFG2TJ
+LCohnse8wqjw0dIUVbmDbE4zjaG56zkvu0k+04Wwp3XPgOZrbl6cbhX3yLhu/Gt0
+dzd9EReoNfKXk32hBzKas/vdeB5DZejbOOOWYftqyZC1LvDvvrYFhFK6VGozfZ6L
+Fml1hzn+xPahp5tRv93/T9zXeVPm9zilGMqm/gjRgh8ojWxNQoNzJyqTPWIvWmbu
+EIP3T3cTFq6lJpJsg3+sfzofGWZCGnBZQGqm8rEOoUWiaKe1BvQCX1x8p4/x8/tX
+TaVDpQCGoqxXt09plkDuGMuiDICxBlaHWUR2jLoHc2cLrB8AEQEAAYkCPAQYAQgA
+JhYhBK4/rHlnEexZ/AB6pHS7a5pMuz04BQJcKvQUAhsMBQkD7JcAAAoJEHS7a5pM
+uz04pB8P/Amfg54IFeALiPOrKbjC3bVAQzrsf09IL8sUln/LCZIx9HgGAJj/f35S
+Q35sK2ucjWiDX6qCxVrWmC6caQXFgXOFSKIlqladmmgj4sIdLM5wj4nbomHChpB5
+rqV/GgkFwWBQ3kPCatXvc8Bg+zKJ+wXgTuPFXefyE9R+SLuas2grQ9hAjvTGHYbq
+iYxSlNDFc1aHLAQ3bS76351MHuMHOpLzoB0OkZDCVNW4GNEqrLbINdr50RAK+Loo
+Z2UBIobEZjXYor9A2FWkSvdjyz6X1QKMdQMath6R91k/O0abBa7ly4/805eAGXM3
+w1Xf2eMlpiUs69BeYoJBklK8aNMntpDREunJjhiPU4JoDzSxl5Qv7LuXylyo0YJA
+9YmydKhTTcRdwsKc//nGr/ckg4BRl+VbtJBYvd3xGB7IQ+pT/TOakv9qCospAhr3
+EQjVP/XpnWJRd+x+dq8UXqwWmTenWDE42cNr7BDFJdOqS5ZWy4sIz4sdjpSxXMB9
+8iiRtKSpKRCJgXScB7SYebh835EgG2YyQGdhJMO7C6ok9POYQBqL8sBqRzImJKoT
+VDvOH42WArKwJWTHa4mPdiDHEIZlkONerec3JXtl4Mfv8cwZ5Lb8fSiB/x8AWvqs
+puc/7hQtkus4TcgutS1fwhAwpnFItpVF6+73CMQrJsblBdTjW0T+uQINBFxbVHwB
+EADebZOJbhPdhHeBPdlZYE3rRjB8scDpWdjrCupfmeTC9MM6JgCE4DEMBtBXk+h1
++7wfpblYYNFwGVFvytG5nvGRDtHWxwd1Z9O8Fx4Zqu0Fx/wAn7ZL3ryE+tdHR7JK
+7SLxOa2X49T/8LY0U8Q65I4ZRo/b4VMcXApCmncw3QSRqHT/mYdNnf+HHPvi3jza
+md3iVptCS4Iaisc079DFda+htWXspBc13lmPi2vGQkWjjS3B4yO8JackyQPVhpsg
+KYbRBzOH0Kii8bXmyA6O5uIJYEddp5Veged4FE/ej3CrgGP1D0Yk1epx8lLbi9RB
+kwFS7DA5rQ23UnbSy1WyV1ZgPrWqQAWuGpjMTVTWN0ElI3AGxAnE8lZlSXyE+XyV
+uHjjIVrayBjLKVqDuSLdKZeCvI4QsyHH6F0NKJQkngvXxLZYxO6s0c2EFFLzdVWT
+1V9GMP8UsDrrb+JsZjUVmPR1tTP4xqEQG6KjfFoQm5XWpGtFwh91OK1lwf/Bx2/C
+j+PquLLFcj7hEP79VDTUZPQAduTTxIeTzHXH+x1PCHFB10xxH3e82VSdJeBUrJxn
+riXzK50SKTTmF+uYpHqE8Jg1N2Y1n5ksuxeYUy8PFjhAeBCqZ6ZcldUDf4999e/z
+PT8bwfCDr8jRdqJHrq7RxTJiP5RsMudWpKeohzJGwQ5uZwARAQABiQRyBBgBCAAm
+FiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAlxbVHwCGwIFCQO9IQACQAkQdLtrmky7
+PTjBdCAEGQEIAB0WIQSVztolaxygoV8wL7WVIaftXazpGAUCXFtUfAAKCRCVIaft
+XazpGPeMEACm9nxA/VKf8RxDo2ZuTgyuSwlR8tCjAE4k3+UoiYUbamkW4pjx9Vgd
+1zC5bNxSWZ5vlJ4CH8ArKFqNK5LBVDZqhYureAo/1Af2b9vRJw0/QQHhuXz/jqeT
+wwrLuKpy796Gpt+aFfcmS0ZC4QXfxJERhAP6tu1p6YmAsSb+bjziQVkKrt9mhOrL
+dtz6WP0Fg1joRj33FgnnLtayHvtgQrNFI3ztCjk/B2FjYZxqbBGfk5gyo0cTE2Fi
+oLhG/XrxIoZepFMJkGYETnYQXrOt2KuJLvawV70YQmG8EqHYY8drKA0XDZs8TVdT
+5cvGvtm8ERz5znsssRBxQMI5Ml6O2ahrXp8Eq4htCzlvO8t2MOtzvqAJRiyAd6bA
+Uo+MGVRpnvePOR1SAgBXCd416rF0iCXc1utZxnqwdq9kJAZ+8mCLx4N4jk6AdGpX
+zcNkLg7QmUzXn75RxZ6GrIUYZJNMlswXq5XhSW4o8ePlaxWjh9+QTtU964AZhpA1
+uoHsKGTBxHJs0w6McZm14kb2PuaO2/rpf8s8IZyc93+Y5O/gHZ6/agBjA9qN6wkQ
+R1d5UhJC4QS/m35rBGBKK9X3fqQxaBCio6Qz+m4A3GchrztJpq+2P+ma5ylsTq5j
+V4njky26WNtrV7+N0C4Moj3I4Qn6YU/eSManTXzHzoiPZCEH/IOxgXIiD/9Zm3Zz
+I+h4NCfSGyP11/w1gEzlTHQ4at/FXIIDh0Y2ZNpWPffuFQLtcER2vyKPwhDYpGMy
+NNHXks4azfrXVCv0wmSNBbeS8pJrYtopZpCEBrAbg/YLv9m5lpDSRHaR3gv/qMZ7
+QxY+NwqciqTwGq68PuF4mDSvtfuFmbEES9Iybiie+eL/6DU2knfBjgshUe6vElR+
+LYoPQ45GY2IxRTJ1pMXaZw1+evwH3UvseRGkRygiaBgoU/qR4prynvjMQcacCa+C
+aRnXZJYp/usVBeY0xut9toc9/OcLGoBr5h9l5YjruO2vu8VHou8N0tarVQn3YbQR
+Fi+YtNtclWJa8Pq1AsKRTCFwDwP6eODv6mNOrEFydNRcpiQmzp47VWF/YHRfHzCq
+A1wHLxLUrpQTaVw6J4FqedAQ31aAO4faA7MS+ZMNBqZCZ7lTGC6TvojqqBAN2yX7
+AnnYpZHM+lGpi2/ukVzLqSkGmdNOgbu+UZvoej3YnHYig4yWP+z2xrlJl8bkhU/d
+r9IQE5aRCEPB/JWhHJ2/GqYl9qjshlB52+6X2KDarwptOtzT9ooArYhpMwKIYh34
+c7X8tlAKYk7V5j7txIRFDKKAftC7dM82PntXJxSkWyR70GYnYjiXyrqqerqT7xIC
+mDEQgFOPpy09zFW62paO9uiZw6qwybwqgGpoX7kCDQRcW1TbARAA3ERo2mPv2VVg
+ZUFr4MtPDm4UG00YJW/LYa3D3k0e9tdSScACXprk1sAoxUlQx/CSdErPKwXG4rax
+iN4t5nICUUNYSC0dh09G25jC7nwsWc0AYyZu+h/FzfvpOm3fBwmBlzILlGh0URwH
+Ffj9fHt6hos4C+3PFZZ/X24aMJF/cov1oYi9rqFwt/l0mgtPE88Iyj2/Vp3Lergg
+QMzKfEuyluj9fL2cgU0Qa7oAPXmaxhHtua4cvbM5SXGo3FXjIgzH9OfM+2orebeN
+wH1M3ec6w+nPmRmCJLvPKGOeS7GVXL5/aOyPlDWzSXYnpCKS2ntw4K4nt0IA8n8z
+1db109l/C2noDrDSJEqOo843ShNGTYOMVUrj3a+Y7o2ATc9pNZalf0PwnKas7NDb
+IJ152PEQw665iYXcv2awjLF6W0yuSq8kfiaAxIrsie2Dto0zgqOs0Ot9Y74u11Hh
+wBSHUO3mEZJScAAcI/yDF2PvjvCQSzu4mdXb77t6X2O6YHULz4A7bVQCMazcTDI9
+/S0W2+ixPnnJVnE3xgjK9zuizji8JDJw1hJCQM+yTLVqq9pfvcRfQ6uwpMRzz/O3
+S0zDRiA69/GyfNwkpgz5QaGpY02IK5WrQU1doRjIz4BHAYzoIOkMkRqTtjdElQZw
+/D3wSO2uwsEMNwRzibR/Lz1JF2aGn6EAEQEAAYkEcgQYAQgAJhYhBK4/rHlnEexZ
+/AB6pHS7a5pMuz04BQJcW1TbAhsCBQkDvSEAAkAJEHS7a5pMuz04wXQgBBkBCAAd
+FiEE1wyE5ktVjlvM7AchMuIXXx11eioFAlxbVNsACgkQMuIXXx11eiqCfQ//SFDf
+rOIEoslp6n6vlCuavOg02wvjskKQGP1P1Q4v40Fw1Gl87n9uXAoMpeF4H+pzUxOi
+BHYCQi+EemwocSThzaWfPzd3JG/0OcRymf+ZOcBb+58VJL7p88QdMFIAi5J+KMuA
+fEG0zLkc9anEnXoVMmQJX5K+6PyeVDvBbYGjLjQAsWTZTiVuQI0w3WxFtDGWqQII
+8e/qE0DA7c/auGn7j2hid308+FcdfpmLefW9YesWjE1yYvHoCRdFOJ/7Sft4MQCI
+Re7UET3TRMBvtisP2DcqyzGPp22s4ZYFCCJJNiB92bXdEl5zXe4Ff7JTfNE/QrR7
+Wg5R9hZHgHdbp8p8bA3f0y29YCx3puYg7BbmQWiMh3rXWE5b090pSpw0K9BQU3vO
+irr+5/2TaFOJXHl4VF03GrWsSncShCbdsdRIv4TB0lY2mN4q+e7bjlAzJJeoaS97
+GIqu3DBlAJyx/ZwWW23DXXwoQ4jNuJhpl2jaCE7rVQB0uLjbp0i9Zdd4SdYZxmO/
+Y+JfgoJz8eyx8wZi4eDz1ijN0WKsIGjxJH5VUK9STjijDMeG6ZZRLc6b1QCGhe97
+ZbDkEUTdQGoeu4L5Fiqoma13NEsf8ofBDv+myJm/O67Va9JI3gxhIrhmF7LMzQQp
+lYx2peZC1CmhEnn83dtt83mhXvX6Dth657BW/Qd+GQ//SVuTPuNkBXfrTi4dbnv+
+cU6IsoIBodTF/WsQ6h4kbtsPhO5DbrsLNuNumrqVEN8jw+HUsEeNvFNeMrTPdG2V
+87ShQ4BQGkCf+GFRBj0myxxXOFZYQx6RpY5fCe7yOcTzpkbnPWmm7V8HdOuZ0NnL
+JNQ5YogOI6UvXVKv35R9qBo+G9jkhhb0eaAu6BERzKVANKfsGN7545ElZ1qlffMh
+AQhXGb6TsvCeSg2cWGb2cnVL2d58uVukD4PDiq4qqwgClkF3bOO70SIgGrCteHbi
+4Hseopex5m6GqqjoUYXr7QQBwSaQdc+gKtEjMHCsHbUyHRk0qEHdEe+2RmL0d0ra
+QMJfKyYQjcCR7tnrgN4WD1h4NKRdC/KRW31MDmH9XVPrkOMQCUCnArXkOwdKWsKf
+h8af9HqweXOT1FHJN/M3tWaBpv6KoduF2f2pj1VhPZ2EqFUycJ26lrHyOpsynQR6
++TD+c1uXotDwKN5RW+YL1cydk6mhib64fdOyPUeTcHehjMAFgM2f5wi35Ujcj8id
+37cWOqRsggSbMnGO4AUA/YtcVNG8TjZbakson8ENK7e8q4sEiNFUZ7/CtzNokwHQ
+5uOG1+qB85Y4ImGnIZVeiBpjt73VVawg4Zvm/omtW50P9R+4rVhMJZZFAgrWg8BH
+H/KNznW0vUuShG8B+2FA/eu5Ag0EXFtVDAEQAL5ftI1GgVJEFgX5VsuFnfBnH95c
+zqmwEXaTP4s7Xm3O0Wy579EzRUD1eEw/UaD/q2OHScwvMP65cZYQ9w4hnCN6H96P
+96Teo7LOMCssvSXIO7gqP33LKTqDzsIoAFHwWE3dq1jbyP6T1Je85mr0Edvk8kOC
+B1hudswAARno/7X9zGulhhwuEHk5Iey7R59yRUQqBctdNcetGyaiFjjX0evuVADi
+/z/s07XhDLDt7+3Vglh1/7XGC64QhB9QjZ8j0u7+0xfmLLjhi+7EpkDlAHIJXX1H
+0wAsPOGKlYruQUmIsMNfBINZeulHEBZ4cAd30xsM296DzJ6QL9sAGfYMhRs0YHB/
+EJ10Zv0iw1pU2jCCUv/9Kf4F4nwgHQWQP7JAbfhOIUOUq/YlxjTLnkd25+7vD3KH
+NQ6UiRDROR9Jwetpd/zokpf5O5iTBpVL+sCq+NsTZyDOjITve2sY0V8v10M+Z+pL
+cp/cUZ4JEDS/WJ4/ovBNJP8b+YwN/RBgCjl8UBX/N+e7AA52eYP2H9GK9XPkzSCE
+VxEf5PyjGrwedpoLkzagrHsDuWo3uBquLyneT/ozihqKQAuInUy5B7rWU4mpKHe5
+Vto5o6Zuj+6MgHgIQzRK6Da2ziMNEmroxwZibcYCtUPdvcvxGh+byclnzBclKjOw
+kAalFPx0SxEbHmzPABEBAAGJBHIEGAEIACYWIQSuP6x5ZxHsWfwAeqR0u2uaTLs9
+OAUCXFtVDAIbAgUJA70hAAJACRB0u2uaTLs9OMF0IAQZAQgAHRYhBK7WIv4CB360
+tcFGwUKiedJIzcMQBQJcW1UMAAoJEEKiedJIzcMQH+cQAIQYXDnqi4Hl21LtAgky
+pZxug+x/LECVlwkrIfaQF337+fG+H9J7SdU87Sn1Xe/YUgQnF0XP/fjIVFM0e/Tb
+xVlmTFqiejLnIwJJDgUaHO3POT2sGEyO3tc0mqSzyRBxtMQ8yvApccBhL5QODv3h
+hlRWgk5MXU0IPeXw134IWm+o/PRiPBoXPawvVfEVIBlUFaiSZASf4BAiSad4aJQe
+P8PyP7FPvQB1xiib0iSetn6ZmNeN2OSUJPiPA8aE9JCKuFtomVQEDM0BqQDl5A7h
+5O2uyf0Li+/ArqBvfBjrH03e5zbID02dO3D2BjsV3jUeVPQ5WDgVg8LH+nfg/rRy
+wfCsx9zFp1mt3K4xN2v7IKwxGndApgCcx17gsjzMvLz0J7sSGov4MNjzqvGEDKCl
+uUvNKXqy7je9xcQLpoyvWtoWFXWTbQAcK5Vv+hC67r9bHpjI1KuqA8hYqNKxsv7s
+wiLZdd4SK9SIuwf0j8/XTZwmoFfGolJil0ZNxyqBF39+CMVpaHdLM1qKZz99TVzS
+h4obOOjkUjK458xSo0XCbJ4qXYp7PgxyWK6GIbTozbbG/1ldw+LUnqxt8Shf797L
+J9lbI3ICuR2P5PYlKJf3b6D9GyfqyrP387fKAKhHsYkZ1XD54/8wIgTrdfeNPtL0
+1mjWDjw5KvO9kuPBjcmzgt+NrtsQAJwKeZsiqLLcY8kJ9xP+/xtTlh2iVuZMfxwq
+hwlo4MMCzpobLDZ/JKU398m77eboTKJSBfeUYxQd4ATn1L8NLKjLxKAaBkjEk0nN
+8w9OUQbFlhQ/asLzzF7Z9IGGh9/SEgBZ8V67a0O3Qw9Xdi3ARK3bbZ8RIVJ0+P9G
+CGrfq9j4ZmGA2L4irLjsvDAv7CSMb4WBKW8j0Jz5LFMwOMJgG1TT5c6lNqFj6y09
+rZcVLnt8+lUv2Bw3LC0oI1TjFkrrCzIdfg++mPi3K/ZFc50bvnWF4eCOjgZ5U9Vb
+sxFZq3+vTRcIfI9z2lZ9CNDRA1O5jGvuVtEGLiSLF2aJ6kiNriLuuGTlXfg/Fpgh
+GTvyppOTzF7PtHzHBQ/ZjnhWojnc/jyJRwLK8cCl6+EOc887v8BDmqgFWtmycsE2
+5fDJ7UFGP13g/eDL3ZUgMDty5dQaUOTX145t2KT+lMqpY6ZK2EC+eoqrnIGJ+tYy
+0l4RRxi10mbNhuPIIDdph7X+mUHgCeA9gyF0Y+LqiB6CX+zFg7ovLvnCbMPxdGXq
+z7AjfwqZBKI+BVuBeDtyW4onmElCu5cXNKsg3W0IlQlZf9PMDU6Ht0XLUs7EPfbQ
+sH1Vqi1XE1W/tGnkmjcpG/qlt9Gx1uwFGLP6iomqUBc2c0GZ6R1xplXvd3w3yC8d
+8lAgPGImuQINBFxbVToBEADkuxhQx9gxlzzCc0nUu2v82XsD+GzONp9irt14gslx
+te96eKaTXTi0t5eya0X5TIY3wbREwjlfAeM9AfcAmWcsM4izrfPtANM6WOxB2Tbz
+EY2cqv7NBQii7Z5aqPyjcIiT0b0Gs2evlDkn3xEBBqTSrNcnGSA29bZPIkaUb7Qo
+p/Ani0S3/tgcR21gXsJwkgpfNKwvPT03Lz3/o5rXAyag0M/25adgk9SVKNcXc8h2
+HSGv5ENjwUKNNnowVbNLw4287mFUM2Vd6unGJ2MBj7aUwTrfBl7gNV96mMdDJWcB
+hGKYkxUvibuHCa2KH7gTrnV6X7sdrgD5CbJMPq6OZNSP6n6bUVg22eHxoETplFwT
+4NvV3clRMWIAG1XgXR1l99LAh7PPnPMM1pHQGPwYHQskoBFS4g5knzHpB9h9TfZ3
+MM4cDZR5NgWmE0fYVnWe5ax+wW0/IOklUoHv3qoL4yiN9wFJq2oLzUNQd9+tsqiy
+vxSTh8iYmHegyn5KuBPsrMPgvqiKOdalTZKkak9DOx4cGQL2qHspKxiBOb6uox2v
+fjMQ5bDeUn+4DYMdnZNHeywCUegJmDakUtlfvN+136IDHGwfdGcitqzswzd3+PI2
+qlwPE19gkrp9NUaD3Qj2ZtDP7sU2cThc6Gra5KRFW8f98bI77j1Wu6pCnYFLqPz4
+QQARAQABiQRyBBgBCAAmFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAlxbVToCGwIF
+CQO9IQACQAkQdLtrmky7PTjBdCAEGQEIAB0WIQR5HX64jryNAThDSqwz3zWa56YK
+eQUCXFtVOgAKCRAz3zWa56YKeSWOEADK8u03LESGSQlZQqnnCAI8iYs1s+XRMEnG
+2tAQ1OK7/4eNgr1yZckmaW4FBMgeEgYIBJ7v3SlW7Hf7dE10TYPNGbP6UxVW8HIP
+rA4CINcGZXWWwpS374JNMS6A5eb6viuEgEMEi00jx0MmLvCMZKypmwXQUl5YJ5nB
+ytpQ1681mCQxGBMhT1eKQt3B4nAsoEnP+HnqVM/nKxBemSBNXX+C0b/YeQoLC3sD
+L+Z0NRI8U6PZl9Rokod3uynH0vfBYCEJd6MvsjtnJlVVaseYIA3ESNrFG12tw95I
+wKNrVCANZ1DBSyK4ovmmWsDrH+uFTHSLNjlxIuVxUfmXcLfgcepVCmd/7Z7UrWYr
+SXSvP0VG4ZmEPE7tNb8bfyADftO1cVsmcHBQeSrgvpSrTv9L8MocojpR5vJc1f+a
+sBT7rAeGzZP9riz1GmryXawaZgdLfaaJfzRQkc1uTChb7kMN+UMhVUdCAXmho0XO
+SfcsW84u/LpjdYh2Ww41xQO6EWvbZDNgD/Fdmp8Uh1MqJ1Dejri6kjNn6wPImXJd
+Eu6nHqWDRdYsfT4XUB18tB+4aIpFzCyIgpf7p1uaVU7Oqip5sZkc/WXKr77lV23m
+PQvpGRNCzgU2TJY7ktR3LOvUVN6wNfLMHzeQk18NdmcEGUrJ0YYtl9vE5/Eg9L6x
+LBH9PKt17IQ8D/9DLwQX8pl3fuTM8ZbzIPLxiXhbgzBBTXKRE2u1888+RIq9xE7c
+aVFjwq4qpgqZ5SFonTcG4Pi5ck3mFAzyA5zLRF+ckpmBpwSPMpLwCpv10369D1jh
+AF3JsUwt6DIb2BISMhh2ThSUMSKO75q8GSotsKjJyjD6vl1x4L7WXubTWxEiNuwD
+3kAjFWS1Z1VWtA9SURWAbsDaCV4VmwCCpSIwRr9OTbyu9XuMdMxGNpl8SwW7MVQb
+x4aYNvR7Hl/wIR71AHAXoSfrKp3p12anXjYYASHmbm16ugP4H7HLMBfznKet2f76
+gIxJr1CsAMTSqypcC1UoVb6Gz8djeIR+GU+6efHI4TIUMy5uMIUx8tYbwSEeo/y6
+NnjpJFYYjJa671iSABInNxs4+X+1zrFa+wl45EnaFxziEet2Qzv/VsusoLvLwnYi
+BZckclAS5xoVGFW0WJ01OfLUDHxGMt9GSheL8c+GLMaMtaCWunpmmt9zZ9WdpBOu
+AGluMG1Cee50TrhXaGE8CdNr8nOdSeLNAveBAPmuVa0JDSe20/D/RuYJLKeG9Vsq
+BZvjuGlOUsfl6UjtiGRbgS9OWpxeez5ugc9yyV+rBGIpmnIb+9quz2HmGxE65eA2
+cRNsZRIjFLzeAx/0RMaT1nlLFTBbUuZ+tJ+fgFtRGMhifZn1pb2dMQo0N7kCDQRc
+W1VuARAAv4LYaNq2Zev/v7M5DnxLpgHRcMkG7TOQpycrlK5653llpZzTy3mh5peW
+vcq3IDmdeUIJxQ+WDh2f0vS+NIKDC/HAddfHrZPbhO7zLxLcMW5KmV05ancaRSP0
+s0+IyQmvVxUNrgPinZiphlvRGoLXS6pdgfc4jIR9B2umPecfvfu/6EWFPnXZgG8K
+yY3Z+mwrmEO0FaXHBQuu6nactiPe79N4bLe8hk9RW6yIxLBeJzIoOlIcJmuRHapt
+nS2lV3mfhZdFnkAp1o6a2TL5BwgMY0wZUKZr78HEMKh6LbPN9rPepf0neUeq/k1l
+NJU7V6XMS+rezF31vgSJ5KoNGYhxtWZ54uksH2rcw7+ltpSVtqY91G/vibpRCJG3
+LdX/kxHni1NEWyZlpS/6ntuH6HSoNYsR9IMsbESs3QVCH74ApK88CxYCRB0SEo0M
+yAElbQ3bfEKCKl/FwC4IzAYAJ2arWKwBHRSJlsrNCtczrjG7j3EyJrn8+Tm5yjO6
+0THQjvc/nBxrNE09r1Lzz7jrDWC9Rl+BH6wqdniymoYyUAQsX2rZ+Jhah1Zkf+Gu
+76qtY+EH494dPM+0FazcBlgBd6/J5mh3Wk9JuecXLTEUGtzd1GmI9CENPAklCauX
+tNOWeTop27djuKWsZxuP1GyV6UYixFVOSWteyAbA32cncVv/2ZUAEQEAAYkEcgQY
+AQgAJhYhBK4/rHlnEexZ/AB6pHS7a5pMuz04BQJcW1VuAhsCBQkDvSEAAkAJEHS7
+a5pMuz04wXQgBBkBCAAdFiEEFWiQaF6g32oTce8gF8xdsfAIhAcFAlxbVW4ACgkQ
+F8xdsfAIhAd4jxAAiO9+VRQQ3eBOsJRgANdgL/l51kq7qE3u8xnSqNkrmdYDdT2H
+TYH5W4n2AmGo50BDafdjd6tut0qtzA3/hGWCooydxKFOsnIYziUeoHvlICj3RkHO
+y7utcFhAgRWi+kzFwnnXGf13dMU9iG7yvKrCrCEw44gzoQ1KnY1Xsj18n5JkqxeT
+94bzcSbz20OpOSIMfSQPrpy18WrZYwHodcIZ3IUUACCpMZdfTa9c/qHRQ/rcwl+B
+0JlHx0V4AYiSAsiMVgflO1Eqi7apPuwxPPd5nnHkrdDM9CYC3LdBORBXwncG3oZ5
+eTSXmsvFxHXH41JHsm/1QFcVmFAYhu9qJFCGiD+8UeTFtT+nnHU69BszgtUskqX8
+k9PqLdK7Vxkp16wc6WOp1NeIQ6Fd4PxTGrPqs9bJk7TlYtTFWpA0X+EMj/San+Ku
+PxqLEa4Ab12R4vs1pCrn/g1z3C/6ujH4B70HOrRTIeTjULJ6xdwXGtwUA09hio0r
+pHhtyZhAh5irUJNto4ZOk/Qyd+dfMsNvRJfbVIK2mmeRaBnp902AsQNgYVdi2Aki
+0h4kz3bVLGw7iD/xV2hV69+JwLSijkkmOpz/EjMwj0hDDYrHH3Y3o0dV3dNdk/5i
+6lQgcxSVsl9kWlHcoEllKbf0Hb1muKVwoGGYxFYna2jsLFVjG29M7iPSgrHjmg/+
+I3fmsLZ0VI9kmxniUlZ6gz5NB5PJ3RXmwKO9LkBgE5C1wpuZbNEQ1NsR2bprlJPm
+++GNSo8HaheuTRJn42kkOgfIJwjuvXih3FE/NtRA/W8H2uF6YLDjBKGZJbxQcmsd
+CTEuCRCVP8X7C5n3rl1YqzfWfNr8QFxvH7ivG7KOlSxvyTKcYatWb9uDUPrnr74f
+ZaMljHGsNyKj70MzZcrrsmt61yWGR0h+02rmIKlskl4hkh+qF5ehI+Bkd7eblsBy
+rxEREHq/ij2Vd7l0Z606YCE8vj8WfcsJj8JjwR3A+nND/oNJTTbQ3b8OvasvqIey
+WqqmGg73nbHjd/VIAUsfvnsEYatDk4pAA/wQr9c4T4s5Q/QRwDrAsa4J89FrDjWC
+hQBPL7TaP8Af/3Y3/86jLCN4lnW1qjPXv5rhBFeI0EVi1k1qdV06qr5HOk7CwQTT
+uc4rCdFcEnw8kVKZa/yFnlJfRa0Z4IwSahdp5fdFEuad6LpOcFFnYxWtIWhcg4GT
+RcMha/OZnsfqOqiAt6In+1IwuJBz3uMM7xw2AMaxzAejGEL63F81C5iJ6Ld6kQK+
+XblDW0G643bVbzkBb46MAT+UnLuWQUs3NDtk1FEioJyWUgbO/srMH4MoWM7rG8ZT
+nQPohNmPBrqL2phmE27HQsQ0rTjH2Z2ol7iy9OFMtT0=
+=MkGo
+-----END PGP PUBLIC KEY BLOCK-----
diff --git a/named-chroot.files b/named-chroot.files
index 75e6aa1..08c21b2 100644
--- a/named-chroot.files
+++ b/named-chroot.files
@@ -16,8 +16,6 @@
 /etc/named
 /usr/lib64/bind
 /usr/lib/bind
-/usr/lib64/named
-/usr/lib/named
 /usr/share/GeoIP
 /run/named
 /proc/sys/net/ipv4/ip_local_port_range
diff --git a/named-chroot.service b/named-chroot.service
index a49df15..ff793f2 100644
--- a/named-chroot.service
+++ b/named-chroot.service
@@ -17,7 +17,7 @@ EnvironmentFile=-/etc/sysconfig/named
 Environment=KRB5_KTNAME=/etc/named.keytab
 PIDFile=/var/named/chroot/run/named/named.pid
 
-ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf -t /var/named/chroot -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
+ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/bin/named-checkconf -t /var/named/chroot -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
 ExecStart=/usr/sbin/named -u named -c ${NAMEDCONF} -t /var/named/chroot $OPTIONS
 
 ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
diff --git a/named-pkcs11.service b/named-pkcs11.service
index 27e0693..241cb7d 100644
--- a/named-pkcs11.service
+++ b/named-pkcs11.service
@@ -13,7 +13,7 @@ EnvironmentFile=-/etc/sysconfig/named
 Environment=KRB5_KTNAME=/etc/named.keytab
 PIDFile=/run/named/named.pid
 
-ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
+ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/bin/named-checkconf -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
 ExecStart=/usr/sbin/named-pkcs11 -u named -c ${NAMEDCONF} $OPTIONS
 
 ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
diff --git a/named.root b/named.root
index 532d4ff..cd808e8 100644
--- a/named.root
+++ b/named.root
@@ -1,61 +1,92 @@
-
-; <<>> DiG 9.11.3-RedHat-9.11.3-3.fc27 <<>> +bufsize=1200 +norec @a.root-servers.net
-; (2 servers found)
-;; global options: +cmd
-;; Got answer:
-;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 46900
-;; flags: qr aa; QUERY: 1, ANSWER: 13, AUTHORITY: 0, ADDITIONAL: 27
-
-;; OPT PSEUDOSECTION:
-; EDNS: version: 0, flags:; udp: 1472
-;; QUESTION SECTION:
-;.				IN	NS
-
-;; ANSWER SECTION:
-.			518400	IN	NS	a.root-servers.net.
-.			518400	IN	NS	b.root-servers.net.
-.			518400	IN	NS	c.root-servers.net.
-.			518400	IN	NS	d.root-servers.net.
-.			518400	IN	NS	e.root-servers.net.
-.			518400	IN	NS	f.root-servers.net.
-.			518400	IN	NS	g.root-servers.net.
-.			518400	IN	NS	h.root-servers.net.
-.			518400	IN	NS	i.root-servers.net.
-.			518400	IN	NS	j.root-servers.net.
-.			518400	IN	NS	k.root-servers.net.
-.			518400	IN	NS	l.root-servers.net.
-.			518400	IN	NS	m.root-servers.net.
-
-;; ADDITIONAL SECTION:
-a.root-servers.net.	518400	IN	A	198.41.0.4
-b.root-servers.net.	518400	IN	A	199.9.14.201
-c.root-servers.net.	518400	IN	A	192.33.4.12
-d.root-servers.net.	518400	IN	A	199.7.91.13
-e.root-servers.net.	518400	IN	A	192.203.230.10
-f.root-servers.net.	518400	IN	A	192.5.5.241
-g.root-servers.net.	518400	IN	A	192.112.36.4
-h.root-servers.net.	518400	IN	A	198.97.190.53
-i.root-servers.net.	518400	IN	A	192.36.148.17
-j.root-servers.net.	518400	IN	A	192.58.128.30
-k.root-servers.net.	518400	IN	A	193.0.14.129
-l.root-servers.net.	518400	IN	A	199.7.83.42
-m.root-servers.net.	518400	IN	A	202.12.27.33
-a.root-servers.net.	518400	IN	AAAA	2001:503:ba3e::2:30
-b.root-servers.net.	518400	IN	AAAA	2001:500:200::b
-c.root-servers.net.	518400	IN	AAAA	2001:500:2::c
-d.root-servers.net.	518400	IN	AAAA	2001:500:2d::d
-e.root-servers.net.	518400	IN	AAAA	2001:500:a8::e
-f.root-servers.net.	518400	IN	AAAA	2001:500:2f::f
-g.root-servers.net.	518400	IN	AAAA	2001:500:12::d0d
-h.root-servers.net.	518400	IN	AAAA	2001:500:1::53
-i.root-servers.net.	518400	IN	AAAA	2001:7fe::53
-j.root-servers.net.	518400	IN	AAAA	2001:503:c27::2:30
-k.root-servers.net.	518400	IN	AAAA	2001:7fd::1
-l.root-servers.net.	518400	IN	AAAA	2001:500:9f::42
-m.root-servers.net.	518400	IN	AAAA	2001:dc3::35
-
-;; Query time: 24 msec
-;; SERVER: 198.41.0.4#53(198.41.0.4)
-;; WHEN: Thu Apr 05 15:57:34 CEST 2018
-;; MSG SIZE  rcvd: 811
-
+;       This file holds the information on root name servers needed to 
+;       initialize cache of Internet domain name servers
+;       (e.g. reference this file in the "cache  .  <file>"
+;       configuration file of BIND domain name servers). 
+; 
+;       This file is made available by InterNIC 
+;       under anonymous FTP as
+;           file                /domain/named.cache 
+;           on server           FTP.INTERNIC.NET
+;       -OR-                    RS.INTERNIC.NET
+; 
+;       last update:     June 24, 2021 
+;       related version of root zone:     2021062401
+; 
+; FORMERLY NS.INTERNIC.NET 
+;
+.                        3600000      NS    A.ROOT-SERVERS.NET.
+A.ROOT-SERVERS.NET.      3600000      A     198.41.0.4
+A.ROOT-SERVERS.NET.      3600000      AAAA  2001:503:ba3e::2:30
+; 
+; FORMERLY NS1.ISI.EDU 
+;
+.                        3600000      NS    B.ROOT-SERVERS.NET.
+B.ROOT-SERVERS.NET.      3600000      A     199.9.14.201
+B.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:200::b
+; 
+; FORMERLY C.PSI.NET 
+;
+.                        3600000      NS    C.ROOT-SERVERS.NET.
+C.ROOT-SERVERS.NET.      3600000      A     192.33.4.12
+C.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:2::c
+; 
+; FORMERLY TERP.UMD.EDU 
+;
+.                        3600000      NS    D.ROOT-SERVERS.NET.
+D.ROOT-SERVERS.NET.      3600000      A     199.7.91.13
+D.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:2d::d
+; 
+; FORMERLY NS.NASA.GOV
+;
+.                        3600000      NS    E.ROOT-SERVERS.NET.
+E.ROOT-SERVERS.NET.      3600000      A     192.203.230.10
+E.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:a8::e
+; 
+; FORMERLY NS.ISC.ORG
+;
+.                        3600000      NS    F.ROOT-SERVERS.NET.
+F.ROOT-SERVERS.NET.      3600000      A     192.5.5.241
+F.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:2f::f
+; 
+; FORMERLY NS.NIC.DDN.MIL
+;
+.                        3600000      NS    G.ROOT-SERVERS.NET.
+G.ROOT-SERVERS.NET.      3600000      A     192.112.36.4
+G.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:12::d0d
+; 
+; FORMERLY AOS.ARL.ARMY.MIL
+;
+.                        3600000      NS    H.ROOT-SERVERS.NET.
+H.ROOT-SERVERS.NET.      3600000      A     198.97.190.53
+H.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:1::53
+; 
+; FORMERLY NIC.NORDU.NET
+;
+.                        3600000      NS    I.ROOT-SERVERS.NET.
+I.ROOT-SERVERS.NET.      3600000      A     192.36.148.17
+I.ROOT-SERVERS.NET.      3600000      AAAA  2001:7fe::53
+; 
+; OPERATED BY VERISIGN, INC.
+;
+.                        3600000      NS    J.ROOT-SERVERS.NET.
+J.ROOT-SERVERS.NET.      3600000      A     192.58.128.30
+J.ROOT-SERVERS.NET.      3600000      AAAA  2001:503:c27::2:30
+; 
+; OPERATED BY RIPE NCC
+;
+.                        3600000      NS    K.ROOT-SERVERS.NET.
+K.ROOT-SERVERS.NET.      3600000      A     193.0.14.129
+K.ROOT-SERVERS.NET.      3600000      AAAA  2001:7fd::1
+; 
+; OPERATED BY ICANN
+;
+.                        3600000      NS    L.ROOT-SERVERS.NET.
+L.ROOT-SERVERS.NET.      3600000      A     199.7.83.42
+L.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:9f::42
+; 
+; OPERATED BY WIDE
+;
+.                        3600000      NS    M.ROOT-SERVERS.NET.
+M.ROOT-SERVERS.NET.      3600000      A     202.12.27.33
+M.ROOT-SERVERS.NET.      3600000      AAAA  2001:dc3::35
+; End of file
\ No newline at end of file
diff --git a/named.service b/named.service
index 7cd6d34..252c9d5 100644
--- a/named.service
+++ b/named.service
@@ -13,7 +13,7 @@ EnvironmentFile=-/etc/sysconfig/named
 Environment=KRB5_KTNAME=/etc/named.keytab
 PIDFile=/run/named/named.pid
 
-ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
+ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/bin/named-checkconf -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
 ExecStart=/usr/sbin/named -u named -c ${NAMEDCONF} $OPTIONS
 ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
 
diff --git a/setup-named-chroot.sh b/setup-named-chroot.sh
index da82cff..5e68915 100755
--- a/setup-named-chroot.sh
+++ b/setup-named-chroot.sh
@@ -10,7 +10,7 @@ usage()
   echo 'Usage: setup-named-chroot.sh ROOTDIR <on|off> [chroot.files]'
 }
 
-if ! [ "$#" -ge 2 ] && [ "$#" -le 3 ]; then
+if ! [ "$#" -ge 2 -a "$#" -le 3 ]; then
   echo 'Wrong number of arguments'
   usage
   exit 1
@@ -34,9 +34,9 @@ dev_create()
   DEVNAME="$ROOTDIR/dev/$1"
   shift
   if ! [ -e "$DEVNAME" ]; then
-    /bin/mknod -m 0664 "$DEVNAME" "$@"
+    /bin/mknod -m 0664 "$DEVNAME" $@
     /bin/chgrp named "$DEVNAME"
-    if [ -x /usr/sbin/selinuxenabled ] && [ -x /sbin/restorecon ]; then
+    if [ -x /usr/sbin/selinuxenabled -a -x /sbin/restorecon ]; then
       /usr/sbin/selinuxenabled && /sbin/restorecon "$DEVNAME" > /dev/null || :
     fi
   fi
@@ -78,7 +78,7 @@ mount_chroot_conf()
       else
         # Mount source is a directory. Mount it only if directory in chroot is
         # empty.
-        if [ -e "$all" ] && [ `ls -1A "$ROOTDIR$all" | wc -l` -eq 0 ]; then
+        if [ -e "$all" ] && [ `ls -1A $ROOTDIR$all | wc -l` -eq 0 ]; then
           mount --bind --make-private "$all" "$ROOTDIR$all"
         fi
       fi
diff --git a/sources b/sources
index 4bc717f..73a8b25 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.16.30.tar.xz) = cc9bcbedf63c2efe0a23f14db3e57fdae46f0509aac58e5840a6805ce4fbd76cad5bfde4d461442adb88c4d947f8d79bf979aeb24aeb9303b6adc8d169b7118c
-SHA512 (bind-9.16.30.tar.xz.asc) = 943ff140aaa413f125d039748a0c10d7ae20b0fa4075227ab0b9d065816e7960a3c4e0fb2a4498946926409568c71076026cbd0be33a78db73966366d43bfdb1
+SHA512 (bind-9.18.4.tar.xz) = 5deb46f6549e42087734fe80f8cd8de8f3fa54590e4635f8c0e2e8d362f8756404e911e46d7fe1cd75f0f19217532ca402e7a5947111f16e412c8aaa754b9e16
+SHA512 (bind-9.18.4.tar.xz.asc) = dfe7b24c499e6e54bc836350b73ef24deb78e1394059d75acc434512b3a60ab44708d3e1faa861be161afa0e69f789fd6b75dd881777679e4845a56f2fd6ab9a

From 55526b37a7125f2576e07a5f52718f550b9f24c1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 23 Jun 2022 16:54:49 +0200
Subject: [PATCH 304/460] Stop enabling selinux booleans on every upgrade

SELinux booleans system pushes enablement into a stack. It saves
previous values and restores them on removal. But the default for
boolean named_write_master_zones has changed to true. Update it just
single time on upgrade from previous bind versions. Then rely on
previous version being a permanent value.
---
 bind.spec | 26 ++++++++++++++------------
 1 file changed, 14 insertions(+), 12 deletions(-)

diff --git a/bind.spec b/bind.spec
index 486f24a..327cde4 100644
--- a/bind.spec
+++ b/bind.spec
@@ -109,10 +109,6 @@ Requires(post): shadow-utils
 Requires(post): glibc-common
 Requires(post): grep
 Requires:       %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
-# This wild require should satisfy %%selinux_set_boolean macro only
-# in case it needs to be used
-Requires(post): ((policycoreutils-python-utils and libselinux-utils) if (selinux-policy-targeted or selinux-policy-mls))
-Requires(post): ((selinux-policy and selinux-policy-base) if (selinux-policy-targeted or selinux-policy-mls))
 Recommends:     %{name}-utils %{name}-dnssec-utils
 %upname_compat %{upname}
 
@@ -739,10 +735,6 @@ fi;
 
 %post
 %?ldconfig
-if [ -e "%{_sysconfdir}/selinux/config" ]; then
-  %selinux_set_booleans -s targeted %{selinuxbooleans}
-  %selinux_set_booleans -s mls %{selinuxbooleans}
-fi
 if [ "$1" -eq 1 ]; then
   # Initial installation
   [ -x /sbin/restorecon ] && /sbin/restorecon /etc/rndc.* /etc/named.* >/dev/null 2>&1 ;
@@ -776,10 +768,6 @@ fi
 %?ldconfig
 # Package upgrade, not uninstall
 %systemd_postun_with_restart named.service
-if [ -e "%{_sysconfdir}/selinux/config" ]; then
-  %selinux_unset_booleans -s targeted %{selinuxbooleans}
-  %selinux_unset_booleans -s mls %{selinuxbooleans}
-fi
 
 %if %{with PKCS11}
 %post pkcs11
@@ -811,6 +799,17 @@ fi
 /sbin/chkconfig --del named >/dev/null 2>&1 || :
 /bin/systemctl try-restart named.service >/dev/null 2>&1 || :
 
+%triggerpostun -- bind < 32:9.18.4-2, selinux-policy, policycoreutils
+if [ -x %{_sbindir}/selinuxenabled ] && [ -x %{_sbindir}/getsebool ] && [ -x %{_sbindir}/setsebool ] \
+   && %{_sbindir}/selinuxenabled && [ -x %{_sbindir}/named ]; then
+  # Return master zones after upgrade from selinux_booleans version
+  WRITEBOOL="$(LC_ALL=C %{_sbindir}/getsebool named_write_master_zones)"
+  if [ "echo ${WRITEBOOL#named_write_master_zones --> }" = "off" ]; then
+    echo "Restoring new sebool default of named_write_master_zones..."
+    %{_sbindir}/setsebool -P named_write_master_zones=1 || :
+  fi
+fi
+
 %ldconfig_scriptlets libs
 
 %if %{with PKCS11}
@@ -1069,6 +1068,9 @@ fi;
 %endif
 
 %changelog
+* Wed Jul 20 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.4-2
+- Stop enabling selinux booleans on every upgrade
+
 * Wed Jul 20 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.4-1
 - Update to 9.18.4 (#2057493)
 

From 411463dad7d7b4fbc53a2c473714bb78a8d828bf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 23 Jun 2022 18:39:33 +0200
Subject: [PATCH 305/460] Deprecate python3-bind for smooth upgrade

---
 bind.spec | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/bind.spec b/bind.spec
index 327cde4..d10e7ff 100644
--- a/bind.spec
+++ b/bind.spec
@@ -263,6 +263,7 @@ Summary: DNSSEC keys and zones management utilities
 Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
 Recommends: %{name}-utils
 Requires: %{name}-dnssec-doc = %{epoch}:%{version}-%{release}
+Obsoletes: python3-%{name} < 32:9.18.0
 %upname_compat %{upname}-dnssec-utils
 
 %description dnssec-utils
@@ -1070,6 +1071,7 @@ fi;
 %changelog
 * Wed Jul 20 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.4-2
 - Stop enabling selinux booleans on every upgrade
+- Deprecate python3-bind for smooth upgrade
 
 * Wed Jul 20 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.4-1
 - Update to 9.18.4 (#2057493)

From 989a3e3876ecf36cc4cc4ae4452118e28e267d4e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 28 Jun 2022 20:19:10 +0200
Subject: [PATCH 306/460] Remove all pkcs11 variants

Recent freeipa uses openssl backend pkcs11 to offload keys to secure
storage. Remove duplicate native builds of pkcs11 tools and daemon. Do
not build tools like pkcs11-tokens, rely or more advanced tools p11tool
and pkcs11-tool. Keep setup-named-softhsm as part of named package.
---
 bind.spec            | 151 +++----------------------------------------
 named-pkcs11.service |  26 --------
 2 files changed, 8 insertions(+), 169 deletions(-)
 delete mode 100644 named-pkcs11.service

diff --git a/bind.spec b/bind.spec
index d10e7ff..5745128 100644
--- a/bind.spec
+++ b/bind.spec
@@ -7,9 +7,6 @@
 # bcond_with is built only when --with X is passed to build
 %bcond_with    SYSTEMTEST
 %bcond_without GSSTSIG
-# it is not possible to build the package without PKCS11 sub-package
-# due to extensive changes to Makefiles
-%bcond_with PKCS11 # TODO: Remove
 %bcond_without JSON
 # FIXME: Not ready. Should it be worked on?
 %bcond_without DLZ
@@ -92,7 +89,6 @@ Source42: generate-rndc-key.sh
 Source43: named.rwtab
 Source44: named-chroot-setup.service
 Source46: named-setup-rndc.service
-Source47: named-pkcs11.service
 Source48: setup-named-softhsm.sh
 Source49: named-chroot.files
 
@@ -111,6 +107,7 @@ Requires(post): grep
 Requires:       %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
 Recommends:     %{name}-utils %{name}-dnssec-utils
 %upname_compat %{upname}
+Obsoletes:      %{name}-pkcs11 < 32:9.18.4-2
 
 BuildRequires:  gcc, make
 BuildRequires:  openssl-devel, libtool, autoconf, pkgconfig, libcap-devel
@@ -131,7 +128,7 @@ BuildRequires:  openldap-devel, libpq-devel, sqlite-devel, mariadb-connector-c-d
 # make unit dependencies
 BuildRequires:  libcmocka-devel
 %endif
-%if %{with PKCS11} && (%{with UNITTEST} || %{with SYSTEMTEST})
+%if %{with UNITTEST} || %{with SYSTEMTEST}
 BuildRequires:  softhsm
 %endif
 %if %{with SYSTEMTEST}
@@ -175,60 +172,12 @@ which resolves host names to IP addresses; a resolver library
 (routines for applications to use when interfacing with DNS); and
 tools for verifying that the DNS server is operating properly.
 
-%if %{with PKCS11}
-%package pkcs11
-Summary: Bind with native PKCS#11 functionality for crypto
-Requires: %{name}%{?_isa} = %{epoch}:%{version}-%{release}
-Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
-Requires: %{name}-pkcs11-libs%{?_isa} = %{epoch}:%{version}-%{release}
-Recommends: softhsm
-
-%description pkcs11
-This is a version of BIND server built with native PKCS#11 functionality.
-It is important to have SoftHSM v2+ installed and some token initialized.
-For other supported HSM modules please check the BIND documentation.
-
-# TODO: Those utils can be used also without pkcs11 variant, but are not?
-%package pkcs11-utils
-Summary: Bind tools with native PKCS#11 for using DNSSEC
-Obsoletes: %{name}-pkcs11 < 32:9.9.4-16.P2
-Requires: %{name}-dnssec-doc = %{epoch}:%{version}-%{release}
-%if %{with PKCS11}
-Requires: %{name}-pkcs11-libs%{?_isa} = %{epoch}:%{version}-%{release}
-%endif
-
-%description pkcs11-utils
-This is a set of PKCS#11 utilities that when used together create rsa
-keys in a PKCS11 keystore.
-%if %{with PKCS11}
-Also utilities for working with DNSSEC
-compiled with native PKCS#11 functionality are included.
-%endif
-
-%package pkcs11-libs
-Summary: Bind libraries compiled with native PKCS#11
-Requires: %{name}-license = %{epoch}:%{version}-%{release}
-Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
-
-%description pkcs11-libs
-This is a set of BIND libraries (dns, isc) compiled with native PKCS#11
-functionality.
-
-%package pkcs11-devel
-Summary: Development files for Bind libraries compiled with native PKCS#11
-Requires: %{name}-pkcs11-libs%{?_isa} = %{epoch}:%{version}-%{release}
-Requires: %{name}-devel%{?_isa} = %{epoch}:%{version}-%{release}
-
-%description pkcs11-devel
-This a set of development files for BIND libraries (dns, isc) compiled
-with native PKCS#11 functionality.
-%endif
-
 %package libs
 Summary: Libraries used by the BIND DNS packages
 Requires: %{name}-license = %{epoch}:%{version}-%{release}
 Provides: %{name}-libs-lite = %{epoch}:%{version}-%{release}
 Obsoletes: %{name}-libs-lite < 32:9.16.13
+Obsoletes: %{name}-pkcs11-libs < 32:9.18.4-2
 
 %description libs
 Contains heavyweight version of BIND suite libraries used by both named DNS
@@ -246,6 +195,7 @@ Summary: Utilities for querying DNS name servers
 Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
 # For compatibility with Debian package
 Provides: dnsutils = %{epoch}:%{version}-%{release}
+Obsoletes: %{name}-pkcs11-utils < 32:9.18.4-2
 %upname_compat %{upname}-utils
 
 %description utils
@@ -262,8 +212,8 @@ servers.
 Summary: DNSSEC keys and zones management utilities
 Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
 Recommends: %{name}-utils
-Requires: %{name}-dnssec-doc = %{epoch}:%{version}-%{release}
 Obsoletes: python3-%{name} < 32:9.18.0
+Obsoletes: %{name}-dnssec-doc < 32:9.18.4
 %upname_compat %{upname}-dnssec-utils
 
 %description dnssec-utils
@@ -274,14 +224,6 @@ revocation and verification of keys and DNSSEC signatures in zone files.
 You should install %{name}-dnssec-utils if you need to sign a DNS zone
 or maintain keys for it.
 
-%package dnssec-doc
-Summary: Manual pages of DNSSEC utilities
-Requires: %{name}-license = %{epoch}:%{version}-%{release}
-BuildArch:noarch
-
-%description dnssec-doc
-%{name}-dnssec-doc contains manual pages for %{name}-dnssec-utils.
-
 %package devel
 Summary:  Header files and libraries needed for bind-dyndb-ldap
 Provides: %{name}-lite-devel = %{epoch}:%{version}-%{release}
@@ -441,10 +383,6 @@ export LIBDIR_SUFFIX
 %if %{with GEOIP2}
   --with-maxminddb \
 %endif
-%if %{with PKCS11}
-  --enable-native-pkcs11 \
-  --with-pkcs11=%{_libdir}/pkcs11/libsofthsm2.so \
-%endif
 %if %{with GSSTSIG}
   --with-gssapi=yes \
 %endif
@@ -499,7 +437,7 @@ popd # build
 %systemtest_prepare_build build
 
 %check
-%if %{with PKCS11} && (%{with UNITTEST} || %{with SYSTEMTEST})
+%if %{with UNITTEST} || %{with SYSTEMTEST}
   # Tests require initialization of pkcs11 token
   eval "$(bash %{SOURCE48} -A "`pwd`/softhsm-tokens")"
 %endif
@@ -594,17 +532,11 @@ install -m 644 %{SOURCE38} ${RPM_BUILD_ROOT}%{_unitdir}
 install -m 644 %{SOURCE44} ${RPM_BUILD_ROOT}%{_unitdir}
 install -m 644 %{SOURCE46} ${RPM_BUILD_ROOT}%{_unitdir}
 
-%if %{with PKCS11}
-install -m 644 %{SOURCE47} ${RPM_BUILD_ROOT}%{_unitdir}
-%endif
-
 mkdir -p ${RPM_BUILD_ROOT}%{_libexecdir}
 install -m 755 %{SOURCE41} ${RPM_BUILD_ROOT}%{_libexecdir}/setup-named-chroot.sh
 install -m 755 %{SOURCE42} ${RPM_BUILD_ROOT}%{_libexecdir}/generate-rndc-key.sh
 
-%if %{with PKCS11}
 install -m 755 %{SOURCE48} ${RPM_BUILD_ROOT}%{_libexecdir}/setup-named-softhsm.sh
-%endif
 
 install -m 644 %SOURCE3 ${RPM_BUILD_ROOT}/etc/logrotate.d/named
 mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/sysconfig
@@ -639,22 +571,6 @@ popd
 # Remove libtool .la files:
 find ${RPM_BUILD_ROOT}/%{_libdir} -name '*.la' -exec '/bin/rm' '-f' '{}' ';';
 
-# PKCS11 versions manpages
-%if %{with PKCS11}
-pushd ${RPM_BUILD_ROOT}%{_mandir}/man8
-ln -s named.8.gz named-pkcs11.8.gz
-ln -s dnssec-checkds.8.gz dnssec-checkds-pkcs11.8.gz
-ln -s dnssec-dsfromkey.8.gz dnssec-dsfromkey-pkcs11.8.gz
-ln -s dnssec-importkey.8.gz dnssec-importkey-pkcs11.8.gz
-ln -s dnssec-keyfromlabel.8.gz dnssec-keyfromlabel-pkcs11.8.gz
-ln -s dnssec-keygen.8.gz dnssec-keygen-pkcs11.8.gz
-ln -s dnssec-revoke.8.gz dnssec-revoke-pkcs11.8.gz
-ln -s dnssec-settime.8.gz dnssec-settime-pkcs11.8.gz
-ln -s dnssec-signzone.8.gz dnssec-signzone-pkcs11.8.gz
-ln -s dnssec-verify.8.gz dnssec-verify-pkcs11.8.gz
-popd
-%endif
-
 # 9.16.4 installs even manual pages for tools not generated
 %if %{without DNSTAP}
 rm -f ${RPM_BUILD_ROOT}%{_mandir}/man1/dnstap-read.1* || true
@@ -770,20 +686,6 @@ fi
 # Package upgrade, not uninstall
 %systemd_postun_with_restart named.service
 
-%if %{with PKCS11}
-%post pkcs11
-# Initial installation
-%systemd_post named-pkcs11.service
-
-%preun pkcs11
-# Package removal, not upgrade
-%systemd_preun named-pkcs11.service
-
-%postun pkcs11
-# Package upgrade, not uninstall
-%systemd_postun_with_restart named-pkcs11.service
-%endif
-
 # Fix permissions on existing device files on upgrade
 %define chroot_fix_devices() \
 if [ $1 -gt 1 ]; then \
@@ -813,10 +715,6 @@ fi
 
 %ldconfig_scriptlets libs
 
-%if %{with PKCS11}
-%ldconfig_scriptlets pkcs11-libs
-%endif
-
 %post chroot
 %systemd_post named-chroot.service
 %chroot_fix_devices %{chroot_prefix}
@@ -859,6 +757,7 @@ fi;
 %{_sbindir}/rndc*
 %{_sbindir}/named-checkconf
 %{_libexecdir}/generate-rndc-key.sh
+%{_libexecdir}/setup-named-softhsm.sh
 %{_mandir}/man1/mdig.1*
 %{_mandir}/man1/named-rrchecker.1*
 %{_mandir}/man5/named.conf.5*
@@ -947,15 +846,7 @@ fi;
 
 %files dnssec-utils
 %{_bindir}/dnssec*
-%if %{with PKCS11}
-%exclude %{_sbindir}/dnssec*pkcs11
-%endif
-
-%files dnssec-doc
 %{_mandir}/man1/dnssec*.1*
-%if %{with PKCS11}
-%exclude %{_mandir}/man1/dnssec*-pkcs11.1*
-%endif
 
 %files devel
 %{_libdir}/libbind9.so
@@ -1012,33 +903,6 @@ fi;
 %dir %{chroot_prefix}/run/named
 %{chroot_prefix}%{_localstatedir}/run
 
-%if %{with PKCS11}
-%files pkcs11
-%{_sbindir}/named-pkcs11
-%{_unitdir}/named-pkcs11.service
-%{_mandir}/man8/named-pkcs11.8*
-%{_libexecdir}/setup-named-softhsm.sh
-
-%files pkcs11-utils
-%{_bindir}/pkcs11-destroy
-%{_bindir}/pkcs11-keygen
-%{_bindir}/pkcs11-list
-%{_bindir}/pkcs11-tokens
-%{_mandir}/man1/pkcs11-*.1*
-%if %{with PKCS11}
-%{_bindir}/dnssec*pkcs11
-%{_mandir}/man1/dnssec*-pkcs11.1*
-%endif
-
-%files pkcs11-libs
-%{_libdir}/libdns-pkcs11-%{version}*.so
-%{_libdir}/libns-pkcs11-%{version}*.so
-
-%files pkcs11-devel
-%{_libdir}/libdns-pkcs11.so
-%{_libdir}/libns-pkcs11.so
-%endif
-
 %if %{with DLZ}
 %files dlz-filesystem
 %{_libdir}/{named,bind}/dlz_filesystem_dynamic.so
@@ -1072,6 +936,7 @@ fi;
 * Wed Jul 20 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.4-2
 - Stop enabling selinux booleans on every upgrade
 - Deprecate python3-bind for smooth upgrade
+- Remove PKCS1111 native utilities, libs and daemon
 
 * Wed Jul 20 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.4-1
 - Update to 9.18.4 (#2057493)
diff --git a/named-pkcs11.service b/named-pkcs11.service
deleted file mode 100644
index 241cb7d..0000000
--- a/named-pkcs11.service
+++ /dev/null
@@ -1,26 +0,0 @@
-[Unit]
-Description=Berkeley Internet Name Domain (DNS) with native PKCS#11
-Wants=nss-lookup.target
-Wants=named-setup-rndc.service
-Before=nss-lookup.target
-After=network.target
-After=named-setup-rndc.service
-
-[Service]
-Type=forking
-Environment=NAMEDCONF=/etc/named.conf
-EnvironmentFile=-/etc/sysconfig/named
-Environment=KRB5_KTNAME=/etc/named.keytab
-PIDFile=/run/named/named.pid
-
-ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/bin/named-checkconf -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
-ExecStart=/usr/sbin/named-pkcs11 -u named -c ${NAMEDCONF} $OPTIONS
-
-ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
-
-ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'
-
-PrivateTmp=true
-
-[Install]
-WantedBy=multi-user.target

From 66ddbbdf47a450cb8a44356b96b114524db0d498 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 3 Aug 2022 20:17:30 +0200
Subject: [PATCH 307/460] Update to 9.18.5 (#2109170)

https://downloads.isc.org/isc/bind9/9.18.5/doc/arm/html/notes.html#notes-for-bind-9-18-5

Changes NSEC3 default count to zero.
---
 .gitignore         |  2 ++
 bind-9.5-PIE.patch | 13 +++++--------
 bind.spec          |  7 +++++--
 sources            |  4 ++--
 4 files changed, 14 insertions(+), 12 deletions(-)

diff --git a/.gitignore b/.gitignore
index 4bfd826..c04e554 100644
--- a/.gitignore
+++ b/.gitignore
@@ -186,3 +186,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.18.3.tar.xz.asc
 /bind-9.18.4.tar.xz
 /bind-9.18.4.tar.xz.asc
+/bind-9.18.5.tar.xz
+/bind-9.18.5.tar.xz.asc
diff --git a/bind-9.5-PIE.patch b/bind-9.5-PIE.patch
index 3f47a0a..1420cf3 100644
--- a/bind-9.5-PIE.patch
+++ b/bind-9.5-PIE.patch
@@ -1,8 +1,8 @@
 diff --git a/bin/named/Makefile.am b/bin/named/Makefile.am
-index 7065a90..e2e485b 100644
+index 57a023b..085f2f7 100644
 --- a/bin/named/Makefile.am
 +++ b/bin/named/Makefile.am
-@@ -32,6 +32,7 @@ AM_CPPFLAGS +=				\
+@@ -32,9 +32,12 @@ AM_CPPFLAGS +=				\
  endif HAVE_LIBXML2
  
  AM_CPPFLAGS +=						\
@@ -10,11 +10,8 @@ index 7065a90..e2e485b 100644
  	-DNAMED_LOCALSTATEDIR=\"${localstatedir}\"	\
  	-DNAMED_SYSCONFDIR=\"${sysconfdir}\"
  
-@@ -122,5 +123,7 @@ named_LDADD +=					\
- 	$(LIBNGHTTP2_LIBS)
- endif HAVE_LIBNGHTTP2
- 
 +AM_LDFLAGS += -pie -Wl,-z,relro,-z,now,-z,nodlopen,-z,noexecstack
 +
- MAINTAINERCLEANFILES =				\
- 	named.conf.rst
+ sbin_PROGRAMS = named
+ 
+ nodist_named_SOURCES = xsl.c
diff --git a/bind.spec b/bind.spec
index 5745128..d1752e8 100644
--- a/bind.spec
+++ b/bind.spec
@@ -60,8 +60,8 @@ Conflicts: %1 \
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.18.4
-Release:  2%{?dist}
+Version:  9.18.5
+Release:  1%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -933,6 +933,9 @@ fi;
 %endif
 
 %changelog
+* Wed Aug 03 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.5-1
+- Update to 9.18.5 (#2109170)
+
 * Wed Jul 20 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.4-2
 - Stop enabling selinux booleans on every upgrade
 - Deprecate python3-bind for smooth upgrade
diff --git a/sources b/sources
index 73a8b25..36eaf12 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.18.4.tar.xz) = 5deb46f6549e42087734fe80f8cd8de8f3fa54590e4635f8c0e2e8d362f8756404e911e46d7fe1cd75f0f19217532ca402e7a5947111f16e412c8aaa754b9e16
-SHA512 (bind-9.18.4.tar.xz.asc) = dfe7b24c499e6e54bc836350b73ef24deb78e1394059d75acc434512b3a60ab44708d3e1faa861be161afa0e69f789fd6b75dd881777679e4845a56f2fd6ab9a
+SHA512 (bind-9.18.5.tar.xz) = 41149e2a225125af0923ac597a31975b0a09eba64c0c4fe2ac6e6d6ae54ef8a72ff95db44d3b516af965871b6bde1b5e20489dd483c120e6f938744f56ab39c3
+SHA512 (bind-9.18.5.tar.xz.asc) = 66464762bb19115d31e6fd19cd18d31d81579e080e42828ccf5f7180488e24eab707d3296bdf6265340cd4e4334ed8147ea6bc3f40cf30c11d702b7394d4c345

From b33592e3c6864d1d66f2b105449f4b9f42858d06 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 3 Aug 2022 20:26:06 +0200
Subject: [PATCH 308/460] Return doc symlink to main page

Bind 9.11 guide had different HTML manual, include backward compatible
link to the new place.
---
 bind.spec | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/bind.spec b/bind.spec
index d1752e8..e147563 100644
--- a/bind.spec
+++ b/bind.spec
@@ -590,6 +590,8 @@ popd
 mkdir -p ${RPM_BUILD_ROOT}%{_pkgdocdir}
 cp -a build/doc/arm/_build/html ${RPM_BUILD_ROOT}%{_pkgdocdir}
 rm -rf ${RPM_BUILD_ROOT}%{_pkgdocdir}/html/.{buildinfo,doctrees}
+# Backward compatible link to 9.11 documentation
+(cd ${RPM_BUILD_ROOT}%{_pkgdocdir} && ln -s html/index.html Bv9ARM.html)
 # Share static data from original sphinx package
 for DIR in %{python3_sitelib}/sphinx_rtd_theme/static/*
 do
@@ -927,6 +929,7 @@ fi;
 %files doc
 %dir %{_pkgdocdir}
 %doc %{_pkgdocdir}/html
+%doc %{_pkgdocdir}/Bv9ARM.html
 %endif
 %if %{with DOCPDF}
 %doc %{_pkgdocdir}/Bv9ARM.pdf
@@ -935,6 +938,7 @@ fi;
 %changelog
 * Wed Aug 03 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.5-1
 - Update to 9.18.5 (#2109170)
+- Return doc symlink to main page
 
 * Wed Jul 20 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.4-2
 - Stop enabling selinux booleans on every upgrade

From bd4f2660acba74c47aa6b98a4d1dccb9313e3d55 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 11 Aug 2022 11:50:14 +0200
Subject: [PATCH 309/460] Use multiple threads on unit tests, but 16 at most

---
 bind.spec | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/bind.spec b/bind.spec
index e147563..f5ad2c9 100644
--- a/bind.spec
+++ b/bind.spec
@@ -61,7 +61,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.18.5
-Release:  1%{?dist}
+Release:  2%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -449,11 +449,13 @@ export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0"
 %if %{with UNITTEST}
   pushd build
   CPUS=$(lscpu -p=cpu,core | grep -v '^#' | wc -l)
+  THREADS="$CPUS"
   if [ "$CPUS" -gt 16 ]; then
     ORIGFILES=$(ulimit -n)
-    ulimit -n 4096 || : # Requires on some machines with many cores
+    THREADS=16
+    ulimit -n 8092 || : # Requires on some machines with many cores
   fi
-  make unit
+  make unit -j${THREADS}
   e=$?
   if [ "$e" -ne 0 ]; then
     echo "ERROR: this build of BIND failed 'make unit'. Aborting."
@@ -936,6 +938,9 @@ fi;
 %endif
 
 %changelog
+* Thu Aug 04 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.5-2
+- Use multiple threads on unit tests, but 16 at most
+
 * Wed Aug 03 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.5-1
 - Update to 9.18.5 (#2109170)
 - Return doc symlink to main page

From c0c776f65937e0fd85e4442771a394bb3b786217 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 30 Aug 2022 20:07:05 +0200
Subject: [PATCH 310/460] Update to 9.18.6 (#2119132)

https://downloads.isc.org/isc/bind9/9.18.6/doc/arm/html/notes.html#notes-for-bind-9-18-6
---
 .gitignore | 2 ++
 bind.spec  | 7 +++++--
 sources    | 4 ++--
 3 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/.gitignore b/.gitignore
index c04e554..2e6cd23 100644
--- a/.gitignore
+++ b/.gitignore
@@ -188,3 +188,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.18.4.tar.xz.asc
 /bind-9.18.5.tar.xz
 /bind-9.18.5.tar.xz.asc
+/bind-9.18.6.tar.xz
+/bind-9.18.6.tar.xz.asc
diff --git a/bind.spec b/bind.spec
index f5ad2c9..40e8649 100644
--- a/bind.spec
+++ b/bind.spec
@@ -60,8 +60,8 @@ Conflicts: %1 \
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.18.5
-Release:  2%{?dist}
+Version:  9.18.6
+Release:  1%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -938,6 +938,9 @@ fi;
 %endif
 
 %changelog
+* Tue Aug 30 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.6-1
+- Update to 9.18.6 (#2119132)
+
 * Thu Aug 04 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.5-2
 - Use multiple threads on unit tests, but 16 at most
 
diff --git a/sources b/sources
index 36eaf12..9d5923f 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.18.5.tar.xz) = 41149e2a225125af0923ac597a31975b0a09eba64c0c4fe2ac6e6d6ae54ef8a72ff95db44d3b516af965871b6bde1b5e20489dd483c120e6f938744f56ab39c3
-SHA512 (bind-9.18.5.tar.xz.asc) = 66464762bb19115d31e6fd19cd18d31d81579e080e42828ccf5f7180488e24eab707d3296bdf6265340cd4e4334ed8147ea6bc3f40cf30c11d702b7394d4c345
+SHA512 (bind-9.18.6.tar.xz) = 6b31eb56cf25b2cb1d8af0f76f9cac0e0985c78cbe3ba80164d773cb0bf77116dd98b5c4b84e3c74fd35b5da501ee6ba2dc0fae12267104edde2cb2daa1e1ba7
+SHA512 (bind-9.18.6.tar.xz.asc) = 13629b56acb02ca1fe861e6a17e949fee276de83624d972174893e48cc5de650a2a0081262e5e0d6913360861e2c91fed6b808ed8ae702e5cb2e2380eacf163b

From e4b16641a8841b0ab41d55b77a9dd975dc9ebe5d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 30 Aug 2022 20:21:14 +0200
Subject: [PATCH 311/460] Improve reporting of results after unittest

---
 bind.spec | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/bind.spec b/bind.spec
index 40e8649..8ab6233 100644
--- a/bind.spec
+++ b/bind.spec
@@ -450,6 +450,7 @@ export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0"
   pushd build
   CPUS=$(lscpu -p=cpu,core | grep -v '^#' | wc -l)
   THREADS="$CPUS"
+  export CI=true
   if [ "$CPUS" -gt 16 ]; then
     ORIGFILES=$(ulimit -n)
     THREADS=16
@@ -457,6 +458,8 @@ export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0"
   fi
   make unit -j${THREADS}
   e=$?
+  # Display details of failure
+  cat tests/*/test-suite.log
   if [ "$e" -ne 0 ]; then
     echo "ERROR: this build of BIND failed 'make unit'. Aborting."
     exit $e;
@@ -940,6 +943,7 @@ fi;
 %changelog
 * Tue Aug 30 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.6-1
 - Update to 9.18.6 (#2119132)
+- Report unit tests detailed results
 
 * Thu Aug 04 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.5-2
 - Use multiple threads on unit tests, but 16 at most

From 9ef018d129decae3241dcc018ee7cc14a7bf6e2a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 1 Sep 2022 11:52:57 +0200
Subject: [PATCH 312/460] Always display test suite errors (#2122010)

Previous change did not do anything, because rpm will terminate the
recipe on the first failed command. Make make check not failing
directly, but fail it later explicitly. Show details in the mean time.
---
 bind.spec | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/bind.spec b/bind.spec
index 8ab6233..860a524 100644
--- a/bind.spec
+++ b/bind.spec
@@ -61,7 +61,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.18.6
-Release:  1%{?dist}
+Release:  2%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -456,8 +456,8 @@ export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0"
     THREADS=16
     ulimit -n 8092 || : # Requires on some machines with many cores
   fi
-  make unit -j${THREADS}
-  e=$?
+  e=0
+  make unit -j${THREADS} || e=$?
   # Display details of failure
   cat tests/*/test-suite.log
   if [ "$e" -ne 0 ]; then
@@ -941,6 +941,9 @@ fi;
 %endif
 
 %changelog
+* Thu Sep 01 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.6-2
+- Always show error details for failed unittests (#2122010)
+
 * Tue Aug 30 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.6-1
 - Update to 9.18.6 (#2119132)
 - Report unit tests detailed results

From a912dbe98be0f3aafd29e963d2c4ba7c6b865f38 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 6 Sep 2022 12:28:46 +0200
Subject: [PATCH 313/460] Return engine implementation but use legacy OpenSSL

Engine interface were deprecated in OpenSSL and therefore removed from
normal compilation. But it is possible to compile on OpenSSL with compat
define. That disables deprecation warnings and use functions same as for
OpenSSL 1.1. That is required to keep working engine pkcs11 support.

Otherwise loading keys via ENGINE_load_private_key would always fail.

Resolves: rhbz:#2122010
---
 bind-9.18-pkcs11-engine-compat-api.patch      | 1554 +++++++++++++++++
 bind-9.18-pkcs11-engine-init.patch            |   48 +
 bind-9.18-pkcs11-engine-remove-deadcode.patch |  245 +++
 bind.spec                                     |   14 +-
 4 files changed, 1859 insertions(+), 2 deletions(-)
 create mode 100644 bind-9.18-pkcs11-engine-compat-api.patch
 create mode 100644 bind-9.18-pkcs11-engine-init.patch
 create mode 100644 bind-9.18-pkcs11-engine-remove-deadcode.patch

diff --git a/bind-9.18-pkcs11-engine-compat-api.patch b/bind-9.18-pkcs11-engine-compat-api.patch
new file mode 100644
index 0000000..32126f4
--- /dev/null
+++ b/bind-9.18-pkcs11-engine-compat-api.patch
@@ -0,0 +1,1554 @@
+From 561356ec1d46abb939e4eed10ee2c9e639eb88db Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
+Date: Thu, 8 Sep 2022 17:19:20 +0200
+Subject: [PATCH 2/3] Do not use OSSL_PARAM when engine API is compiled
+
+OpenSSL has deprecated many things in version 3.0. If pkcs11 engine
+should work then no builder from OpenSSL 3.0 API can be used.
+
+Allow switching to OpenSSL 1.1 like calls even on OpenSSL 3.0 when
+OPENSSL_API_COMPAT=10100 is defined. It would still compile and allow
+working keys loading from the engine passed on command line.
+---
+ lib/dns/openssldh_link.c    | 136 +++++++++++++++++++-----------------
+ lib/dns/opensslecdsa_link.c | 119 +++++++++++++++----------------
+ lib/dns/opensslrsa_link.c   | 118 +++++++++++++++----------------
+ 3 files changed, 189 insertions(+), 184 deletions(-)
+
+diff --git a/lib/dns/openssldh_link.c b/lib/dns/openssldh_link.c
+index d5dbc2e889..96c1d523b7 100644
+--- a/lib/dns/openssldh_link.c
++++ b/lib/dns/openssldh_link.c
+@@ -91,7 +91,7 @@ static BIGNUM *bn2 = NULL, *bn768 = NULL, *bn1024 = NULL, *bn1536 = NULL;
+ static isc_result_t
+ openssldh_computesecret(const dst_key_t *pub, const dst_key_t *priv,
+ 			isc_buffer_t *secret) {
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	DH *dhpub, *dhpriv;
+ 	const BIGNUM *pub_key = NULL;
+ 	int secret_len = 0;
+@@ -99,11 +99,11 @@ openssldh_computesecret(const dst_key_t *pub, const dst_key_t *priv,
+ 	EVP_PKEY_CTX *ctx = NULL;
+ 	EVP_PKEY *dhpub, *dhpriv;
+ 	size_t secret_len = 0;
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 	isc_region_t r;
+ 	unsigned int len;
+ 
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	REQUIRE(pub->keydata.dh != NULL);
+ 	REQUIRE(priv->keydata.dh != NULL);
+ 
+@@ -119,14 +119,14 @@ openssldh_computesecret(const dst_key_t *pub, const dst_key_t *priv,
+ 	dhpriv = priv->keydata.pkey;
+ 
+ 	len = EVP_PKEY_get_size(dhpriv);
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+ 	isc_buffer_availableregion(secret, &r);
+ 	if (r.length < len) {
+ 		return (ISC_R_NOSPACE);
+ 	}
+ 
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	DH_get0_key(dhpub, &pub_key, NULL);
+ 	secret_len = DH_compute_key(r.base, pub_key, dhpriv);
+ 	if (secret_len <= 0) {
+@@ -156,7 +156,7 @@ openssldh_computesecret(const dst_key_t *pub, const dst_key_t *priv,
+ 					       DST_R_COMPUTESECRETFAILURE));
+ 	}
+ 	EVP_PKEY_CTX_free(ctx);
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+ 	isc_buffer_add(secret, (unsigned int)secret_len);
+ 
+@@ -165,7 +165,7 @@ openssldh_computesecret(const dst_key_t *pub, const dst_key_t *priv,
+ 
+ static bool
+ openssldh_compare(const dst_key_t *key1, const dst_key_t *key2) {
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	DH *dh1, *dh2;
+ 	const BIGNUM *pub_key1 = NULL, *pub_key2 = NULL;
+ 	const BIGNUM *priv_key1 = NULL, *priv_key2 = NULL;
+@@ -175,9 +175,9 @@ openssldh_compare(const dst_key_t *key1, const dst_key_t *key2) {
+ 	BIGNUM *pub_key1 = NULL, *pub_key2 = NULL;
+ 	BIGNUM *priv_key1 = NULL, *priv_key2 = NULL;
+ 	BIGNUM *p1 = NULL, *g1 = NULL, *p2 = NULL, *g2 = NULL;
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	dh1 = key1->keydata.dh;
+ 	dh2 = key2->keydata.dh;
+ 
+@@ -209,7 +209,7 @@ openssldh_compare(const dst_key_t *key1, const dst_key_t *key2) {
+ 	EVP_PKEY_get_bn_param(pkey2, OSSL_PKEY_PARAM_PUB_KEY, &pub_key2);
+ 	EVP_PKEY_get_bn_param(pkey1, OSSL_PKEY_PARAM_PRIV_KEY, &priv_key1);
+ 	EVP_PKEY_get_bn_param(pkey2, OSSL_PKEY_PARAM_PRIV_KEY, &priv_key2);
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L*/
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000*/
+ 
+ 	if (BN_cmp(p1, p2) != 0 || BN_cmp(g1, g2) != 0 ||
+ 	    BN_cmp(pub_key1, pub_key2) != 0)
+@@ -226,7 +226,7 @@ openssldh_compare(const dst_key_t *key1, const dst_key_t *key2) {
+ 		}
+ 	}
+ 
+-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
++#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+ 	if (p1 != NULL) {
+ 		BN_free(p1);
+ 	}
+@@ -251,22 +251,23 @@ openssldh_compare(const dst_key_t *key1, const dst_key_t *key2) {
+ 	if (priv_key2 != NULL) {
+ 		BN_clear_free(priv_key2);
+ 	}
+-#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000 \
++	*/
+ 
+ 	return (true);
+ }
+ 
+ static bool
+ openssldh_paramcompare(const dst_key_t *key1, const dst_key_t *key2) {
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	DH *dh1, *dh2;
+ 	const BIGNUM *p1 = NULL, *g1 = NULL, *p2 = NULL, *g2 = NULL;
+ #else
+ 	EVP_PKEY *pkey1, *pkey2;
+ 	BIGNUM *p1 = NULL, *g1 = NULL, *p2 = NULL, *g2 = NULL;
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	dh1 = key1->keydata.dh;
+ 	dh2 = key2->keydata.dh;
+ 
+@@ -292,13 +293,13 @@ openssldh_paramcompare(const dst_key_t *key1, const dst_key_t *key2) {
+ 	EVP_PKEY_get_bn_param(pkey2, OSSL_PKEY_PARAM_FFC_P, &p2);
+ 	EVP_PKEY_get_bn_param(pkey1, OSSL_PKEY_PARAM_FFC_G, &g1);
+ 	EVP_PKEY_get_bn_param(pkey2, OSSL_PKEY_PARAM_FFC_G, &g2);
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+ 	if (BN_cmp(p1, p2) != 0 || BN_cmp(g1, g2) != 0) {
+ 		return (false);
+ 	}
+ 
+-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
++#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+ 	if (p1 != NULL) {
+ 		BN_free(p1);
+ 	}
+@@ -311,12 +312,13 @@ openssldh_paramcompare(const dst_key_t *key1, const dst_key_t *key2) {
+ 	if (g2 != NULL) {
+ 		BN_free(g2);
+ 	}
+-#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000 \
++	*/
+ 
+ 	return (true);
+ }
+ 
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ static int
+ progress_cb(int p, int n, BN_GENCB *cb) {
+ 	union {
+@@ -347,7 +349,7 @@ progress_cb(EVP_PKEY_CTX *ctx) {
+ 	}
+ 	return (1);
+ }
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+ static isc_result_t
+ openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) {
+@@ -357,7 +359,7 @@ openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) {
+ 		void (*fptr)(int);
+ 	} u;
+ 	BIGNUM *p = NULL, *g = NULL;
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	DH *dh = NULL;
+ 	BN_GENCB *cb = NULL;
+ #if !HAVE_BN_GENCB_NEW
+@@ -370,9 +372,9 @@ openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) {
+ 	EVP_PKEY_CTX *ctx = NULL;
+ 	EVP_PKEY *param_pkey = NULL;
+ 	EVP_PKEY *pkey = NULL;
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	dh = DH_new();
+ 	if (dh == NULL) {
+ 		DST_RET(dst__openssl_toresult(ISC_R_NOMEMORY));
+@@ -386,7 +388,7 @@ openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) {
+ 	if (param_ctx == NULL) {
+ 		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
+ 	}
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+ 	if (generator == 0) {
+ 		/*
+@@ -406,7 +408,7 @@ openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) {
+ 			if (p == NULL || g == NULL) {
+ 				DST_RET(dst__openssl_toresult(ISC_R_NOMEMORY));
+ 			}
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 			if (DH_set0_pqg(dh, p, NULL, g) != 1) {
+ 				DST_RET(dst__openssl_toresult2(
+ 					"DH_set0_pqg", DST_R_OPENSSLFAILURE));
+@@ -430,7 +432,7 @@ openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) {
+ 					DST_R_OPENSSLFAILURE));
+ 			}
+ 			params = OSSL_PARAM_BLD_to_param(bld);
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+ 		} else {
+ 			/*
+@@ -443,7 +445,7 @@ openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) {
+ 	}
+ 
+ 	if (generator != 0) {
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 		cb = BN_GENCB_new();
+ #if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
+ 		if (cb == NULL) {
+@@ -486,10 +488,10 @@ openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) {
+ 						       DST_R_OPENSSLFAILURE));
+ 		}
+ 		params = OSSL_PARAM_BLD_to_param(bld);
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 	}
+ 
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	if (DH_generate_key(dh) == 0) {
+ 		DST_RET(dst__openssl_toresult2("DH_generate_key",
+ 					       DST_R_OPENSSLFAILURE));
+@@ -557,12 +559,12 @@ openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) {
+ 
+ 	key->keydata.pkey = pkey;
+ 	pkey = NULL;
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+ 	ret = ISC_R_SUCCESS;
+ 
+ err:
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	if (dh != NULL) {
+ 		DH_free(dh);
+ 	}
+@@ -594,14 +596,14 @@ err:
+ 	if (g != NULL) {
+ 		BN_free(g);
+ 	}
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+ 	return (ret);
+ }
+ 
+ static bool
+ openssldh_isprivate(const dst_key_t *key) {
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	DH *dh = key->keydata.dh;
+ 	const BIGNUM *priv_key = NULL;
+ 
+@@ -626,12 +628,12 @@ openssldh_isprivate(const dst_key_t *key) {
+ 	}
+ 
+ 	return (ret);
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ }
+ 
+ static void
+ openssldh_destroy(dst_key_t *key) {
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	DH *dh = key->keydata.dh;
+ 
+ 	if (dh == NULL) {
+@@ -649,7 +651,7 @@ openssldh_destroy(dst_key_t *key) {
+ 
+ 	EVP_PKEY_free(pkey);
+ 	key->keydata.pkey = NULL;
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ }
+ 
+ static void
+@@ -675,17 +677,17 @@ uint16_fromregion(isc_region_t *region) {
+ 
+ static isc_result_t
+ openssldh_todns(const dst_key_t *key, isc_buffer_t *data) {
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	DH *dh;
+ 	const BIGNUM *pub_key = NULL, *p = NULL, *g = NULL;
+ #else
+ 	EVP_PKEY *pkey;
+ 	BIGNUM *pub_key = NULL, *p = NULL, *g = NULL;
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 	isc_region_t r;
+ 	uint16_t dnslen, plen, glen, publen;
+ 
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	REQUIRE(key->keydata.dh != NULL);
+ 
+ 	dh = key->keydata.dh;
+@@ -698,7 +700,7 @@ openssldh_todns(const dst_key_t *key, isc_buffer_t *data) {
+ 	EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_FFC_P, &p);
+ 	EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_FFC_G, &g);
+ 	EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_PUB_KEY, &pub_key);
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+ 	isc_buffer_availableregion(data, &r);
+ 
+@@ -745,7 +747,7 @@ openssldh_todns(const dst_key_t *key, isc_buffer_t *data) {
+ 
+ 	isc_buffer_add(data, dnslen);
+ 
+-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
++#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+ 	if (p != NULL) {
+ 		BN_free(p);
+ 	}
+@@ -755,7 +757,8 @@ openssldh_todns(const dst_key_t *key, isc_buffer_t *data) {
+ 	if (pub_key != NULL) {
+ 		BN_free(pub_key);
+ 	}
+-#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000 \
++	*/
+ 
+ 	return (ISC_R_SUCCESS);
+ }
+@@ -763,14 +766,14 @@ openssldh_todns(const dst_key_t *key, isc_buffer_t *data) {
+ static isc_result_t
+ openssldh_fromdns(dst_key_t *key, isc_buffer_t *data) {
+ 	isc_result_t ret;
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	DH *dh;
+ #else
+ 	OSSL_PARAM_BLD *bld = NULL;
+ 	OSSL_PARAM *params = NULL;
+ 	EVP_PKEY_CTX *ctx = NULL;
+ 	EVP_PKEY *pkey = NULL;
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 	BIGNUM *pub_key = NULL, *p = NULL, *g = NULL;
+ 	int key_size;
+ 	isc_region_t r;
+@@ -782,7 +785,7 @@ openssldh_fromdns(dst_key_t *key, isc_buffer_t *data) {
+ 		return (ISC_R_SUCCESS);
+ 	}
+ 
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	dh = DH_new();
+ 	if (dh == NULL) {
+ 		DST_RET(dst__openssl_toresult(ISC_R_NOMEMORY));
+@@ -797,7 +800,7 @@ openssldh_fromdns(dst_key_t *key, isc_buffer_t *data) {
+ 	if (ctx == NULL) {
+ 		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
+ 	}
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+ 	/*
+ 	 * Read the prime length.  1 & 2 are table entries, > 16 means a
+@@ -873,7 +876,7 @@ openssldh_fromdns(dst_key_t *key, isc_buffer_t *data) {
+ 
+ 	key_size = BN_num_bits(p);
+ 
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	if (DH_set0_pqg(dh, p, NULL, g) != 1) {
+ 		DST_RET(dst__openssl_toresult2("DH_set0_pqg",
+ 					       DST_R_OPENSSLFAILURE));
+@@ -889,7 +892,7 @@ openssldh_fromdns(dst_key_t *key, isc_buffer_t *data) {
+ 		DST_RET(dst__openssl_toresult2("OSSL_PARAM_BLD_push_BN",
+ 					       DST_R_OPENSSLFAILURE));
+ 	}
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+ 	if (r.length < 2) {
+ 		DST_RET(DST_R_INVALIDPUBLICKEY);
+@@ -907,7 +910,7 @@ openssldh_fromdns(dst_key_t *key, isc_buffer_t *data) {
+ 
+ 	isc_buffer_forward(data, plen + glen + publen + 6);
+ 
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ #if (LIBRESSL_VERSION_NUMBER >= 0x2070000fL) && \
+ 	(LIBRESSL_VERSION_NUMBER <= 0x2070200fL)
+ 	/*
+@@ -951,14 +954,14 @@ openssldh_fromdns(dst_key_t *key, isc_buffer_t *data) {
+ 
+ 	key->keydata.pkey = pkey;
+ 	pkey = NULL;
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+ 	key->key_size = (unsigned int)key_size;
+ 
+ 	ret = ISC_R_SUCCESS;
+ 
+ err:
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	if (dh != NULL) {
+ 		DH_free(dh);
+ 	}
+@@ -975,7 +978,7 @@ err:
+ 	if (bld != NULL) {
+ 		OSSL_PARAM_BLD_free(bld);
+ 	}
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 	if (p != NULL) {
+ 		BN_free(p);
+ 	}
+@@ -991,13 +994,13 @@ err:
+ 
+ static isc_result_t
+ openssldh_tofile(const dst_key_t *key, const char *directory) {
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	DH *dh;
+ 	const BIGNUM *pub_key = NULL, *priv_key = NULL, *p = NULL, *g = NULL;
+ #else
+ 	EVP_PKEY *pkey;
+ 	BIGNUM *pub_key = NULL, *priv_key = NULL, *p = NULL, *g = NULL;
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 	dst_private_t priv;
+ 	unsigned char *bufs[4] = { NULL };
+ 	unsigned short i = 0;
+@@ -1007,7 +1010,7 @@ openssldh_tofile(const dst_key_t *key, const char *directory) {
+ 		return (DST_R_EXTERNALKEY);
+ 	}
+ 
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	if (key->keydata.dh == NULL) {
+ 		return (DST_R_NULLKEY);
+ 	}
+@@ -1025,7 +1028,7 @@ openssldh_tofile(const dst_key_t *key, const char *directory) {
+ 	EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_FFC_G, &g);
+ 	EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_PUB_KEY, &pub_key);
+ 	EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_PRIV_KEY, &priv_key);
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+ 	priv.elements[i].tag = TAG_DH_PRIME;
+ 	priv.elements[i].length = BN_num_bytes(p);
+@@ -1065,7 +1068,7 @@ openssldh_tofile(const dst_key_t *key, const char *directory) {
+ 		}
+ 	}
+ 
+-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
++#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+ 	if (p != NULL) {
+ 		BN_free(p);
+ 	}
+@@ -1078,7 +1081,8 @@ openssldh_tofile(const dst_key_t *key, const char *directory) {
+ 	if (priv_key != NULL) {
+ 		BN_clear_free(priv_key);
+ 	}
+-#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000 \
++	*/
+ 
+ 	return (result);
+ }
+@@ -1088,14 +1092,14 @@ openssldh_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
+ 	dst_private_t priv;
+ 	isc_result_t ret;
+ 	int i;
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	DH *dh = NULL;
+ #else
+ 	OSSL_PARAM_BLD *bld = NULL;
+ 	OSSL_PARAM *params = NULL;
+ 	EVP_PKEY_CTX *ctx = NULL;
+ 	EVP_PKEY *pkey = NULL;
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 	BIGNUM *pub_key = NULL, *priv_key = NULL, *p = NULL, *g = NULL;
+ 	int key_size = 0;
+ 	isc_mem_t *mctx;
+@@ -1113,7 +1117,7 @@ openssldh_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
+ 		DST_RET(DST_R_EXTERNALKEY);
+ 	}
+ 
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	dh = DH_new();
+ 	if (dh == NULL) {
+ 		DST_RET(ISC_R_NOMEMORY);
+@@ -1128,7 +1132,7 @@ openssldh_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
+ 	if (ctx == NULL) {
+ 		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
+ 	}
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+ 	for (i = 0; i < priv.nelements; i++) {
+ 		BIGNUM *bn;
+@@ -1155,7 +1159,7 @@ openssldh_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
+ 		}
+ 	}
+ 
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	if (DH_set0_key(dh, pub_key, priv_key) != 1) {
+ 		DST_RET(dst__openssl_toresult2("DH_set0_key",
+ 					       DST_R_OPENSSLFAILURE));
+@@ -1202,13 +1206,13 @@ openssldh_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
+ 
+ 	key->keydata.pkey = pkey;
+ 	pkey = NULL;
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+ 	key->key_size = (unsigned int)key_size;
+ 	ret = ISC_R_SUCCESS;
+ 
+ err:
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	if (dh != NULL) {
+ 		DH_free(dh);
+ 	}
+@@ -1225,7 +1229,7 @@ err:
+ 	if (bld != NULL) {
+ 		OSSL_PARAM_BLD_free(bld);
+ 	}
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 	if (p != NULL) {
+ 		BN_free(p);
+ 	}
+diff --git a/lib/dns/opensslecdsa_link.c b/lib/dns/opensslecdsa_link.c
+index 519e88b7e7..04f0d80b5e 100644
+--- a/lib/dns/opensslecdsa_link.c
++++ b/lib/dns/opensslecdsa_link.c
+@@ -17,14 +17,14 @@
+ 
+ #include <openssl/bn.h>
+ #include <openssl/opensslv.h>
+-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
++#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+ #include <openssl/core_names.h>
+ #endif
+ #include <openssl/ecdsa.h>
+ #include <openssl/err.h>
+ #include <openssl/evp.h>
+ #include <openssl/objects.h>
+-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
++#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+ #include <openssl/param_build.h>
+ #endif
+ #if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000
+@@ -57,7 +57,7 @@
+ 		goto err; \
+ 	}
+ 
+-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
++#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+ static isc_result_t
+ raw_key_to_ossl(unsigned int key_alg, int private, const unsigned char *key,
+ 		size_t key_len, EVP_PKEY **pkey) {
+@@ -159,7 +159,8 @@ err:
+ 
+ 	return (ret);
+ }
+-#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000 \
++	*/
+ 
+ static isc_result_t
+ opensslecdsa_createctx(dst_key_t *key, dst_context_t *dctx) {
+@@ -411,7 +412,7 @@ opensslecdsa_compare(const dst_key_t *key1, const dst_key_t *key2) {
+ 	bool ret;
+ 	EVP_PKEY *pkey1 = key1->keydata.pkey;
+ 	EVP_PKEY *pkey2 = key2->keydata.pkey;
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	EC_KEY *eckey1 = NULL;
+ 	EC_KEY *eckey2 = NULL;
+ 	const BIGNUM *priv1;
+@@ -419,7 +420,7 @@ opensslecdsa_compare(const dst_key_t *key1, const dst_key_t *key2) {
+ #else
+ 	BIGNUM *priv1 = NULL;
+ 	BIGNUM *priv2 = NULL;
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+ 	if (pkey1 == NULL && pkey2 == NULL) {
+ 		return (true);
+@@ -432,7 +433,7 @@ opensslecdsa_compare(const dst_key_t *key1, const dst_key_t *key2) {
+ 		DST_RET(false);
+ 	}
+ 
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	eckey1 = EVP_PKEY_get1_EC_KEY(pkey1);
+ 	eckey2 = EVP_PKEY_get1_EC_KEY(pkey2);
+ 	if (eckey1 == NULL && eckey2 == NULL) {
+@@ -445,7 +446,7 @@ opensslecdsa_compare(const dst_key_t *key1, const dst_key_t *key2) {
+ #else
+ 	EVP_PKEY_get_bn_param(pkey1, OSSL_PKEY_PARAM_PRIV_KEY, &priv1);
+ 	EVP_PKEY_get_bn_param(pkey2, OSSL_PKEY_PARAM_PRIV_KEY, &priv2);
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+ 	if (priv1 != NULL || priv2 != NULL) {
+ 		if (priv1 == NULL || priv2 == NULL || BN_cmp(priv1, priv2) != 0)
+@@ -457,7 +458,7 @@ opensslecdsa_compare(const dst_key_t *key1, const dst_key_t *key2) {
+ 	ret = true;
+ 
+ err:
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	if (eckey1 != NULL) {
+ 		EC_KEY_free(eckey1);
+ 	}
+@@ -471,7 +472,7 @@ err:
+ 	if (priv2 != NULL) {
+ 		BN_clear_free(priv2);
+ 	}
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+ 	return (ret);
+ }
+@@ -481,12 +482,12 @@ opensslecdsa_generate(dst_key_t *key, int unused, void (*callback)(int)) {
+ 	isc_result_t ret;
+ 	int status;
+ 	EVP_PKEY *pkey = NULL;
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	EC_KEY *eckey = NULL;
+ #else
+ 	EVP_PKEY_CTX *ctx = NULL;
+ 	EVP_PKEY *params_pkey = NULL;
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 	int group_nid;
+ 
+ 	REQUIRE(key->key_alg == DST_ALG_ECDSA256 ||
+@@ -502,7 +503,7 @@ opensslecdsa_generate(dst_key_t *key, int unused, void (*callback)(int)) {
+ 		key->key_size = DNS_KEY_ECDSA384SIZE * 4;
+ 	}
+ 
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	eckey = EC_KEY_new_by_curve_name(group_nid);
+ 	if (eckey == NULL) {
+ 		DST_RET(dst__openssl_toresult2("EC_KEY_new_by_curve_name",
+@@ -563,7 +564,7 @@ opensslecdsa_generate(dst_key_t *key, int unused, void (*callback)(int)) {
+ 		DST_RET(dst__openssl_toresult2("EVP_PKEY_keygen",
+ 					       DST_R_OPENSSLFAILURE));
+ 	}
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+ 	key->keydata.pkey = pkey;
+ 	pkey = NULL;
+@@ -573,7 +574,7 @@ err:
+ 	if (pkey != NULL) {
+ 		EVP_PKEY_free(pkey);
+ 	}
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	if (eckey != NULL) {
+ 		EC_KEY_free(eckey);
+ 	}
+@@ -584,7 +585,7 @@ err:
+ 	if (ctx != NULL) {
+ 		EVP_PKEY_CTX_free(ctx);
+ 	}
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+ 	return (ret);
+ }
+@@ -593,11 +594,11 @@ static bool
+ opensslecdsa_isprivate(const dst_key_t *key) {
+ 	bool ret;
+ 	EVP_PKEY *pkey;
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	EC_KEY *eckey;
+ #else
+ 	BIGNUM *priv = NULL;
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+ 	REQUIRE(key->key_alg == DST_ALG_ECDSA256 ||
+ 		key->key_alg == DST_ALG_ECDSA384);
+@@ -607,7 +608,7 @@ opensslecdsa_isprivate(const dst_key_t *key) {
+ 		return (false);
+ 	}
+ 
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	eckey = EVP_PKEY_get1_EC_KEY(pkey);
+ 
+ 	ret = (eckey != NULL && EC_KEY_get0_private_key(eckey) != NULL);
+@@ -621,7 +622,7 @@ opensslecdsa_isprivate(const dst_key_t *key) {
+ 	if (priv != NULL) {
+ 		BN_clear_free(priv);
+ 	}
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+ 	return (ret);
+ }
+@@ -640,7 +641,7 @@ static isc_result_t
+ opensslecdsa_todns(const dst_key_t *key, isc_buffer_t *data) {
+ 	isc_result_t ret;
+ 	EVP_PKEY *pkey;
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	EC_KEY *eckey = NULL;
+ 	int len;
+ 	unsigned char *cp;
+@@ -650,7 +651,7 @@ opensslecdsa_todns(const dst_key_t *key, isc_buffer_t *data) {
+ 	BIGNUM *y = NULL;
+ 	size_t keysize = 0;
+ 	size_t len = 0;
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 	isc_region_t r;
+ 	unsigned char buf[DNS_KEY_ECDSA384SIZE + 1];
+ 
+@@ -658,7 +659,7 @@ opensslecdsa_todns(const dst_key_t *key, isc_buffer_t *data) {
+ 
+ 	pkey = key->keydata.pkey;
+ 
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	eckey = EVP_PKEY_get1_EC_KEY(pkey);
+ 	if (eckey == NULL) {
+ 		DST_RET(dst__openssl_toresult(ISC_R_FAILURE));
+@@ -677,14 +678,14 @@ opensslecdsa_todns(const dst_key_t *key, isc_buffer_t *data) {
+ 	}
+ 
+ 	len = keysize;
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+ 	isc_buffer_availableregion(data, &r);
+ 	if (r.length < (unsigned int)len) {
+ 		DST_RET(ISC_R_NOSPACE);
+ 	}
+ 
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	cp = buf;
+ 	if (!i2o_ECPublicKey(eckey, &cp)) {
+ 		DST_RET(dst__openssl_toresult(ISC_R_FAILURE));
+@@ -704,13 +705,13 @@ opensslecdsa_todns(const dst_key_t *key, isc_buffer_t *data) {
+ 	BN_bn2bin_fixed(x, &buf[0], keysize / 2);
+ 	BN_bn2bin_fixed(y, &buf[keysize / 2], keysize / 2);
+ 	memmove(r.base, buf, len);
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+ 	isc_buffer_add(data, len);
+ 	ret = ISC_R_SUCCESS;
+ 
+ err:
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	if (eckey != NULL) {
+ 		EC_KEY_free(eckey);
+ 	}
+@@ -721,7 +722,7 @@ err:
+ 	if (y != NULL) {
+ 		BN_clear_free(y);
+ 	}
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+ 	return (ret);
+ }
+@@ -731,7 +732,7 @@ opensslecdsa_fromdns(dst_key_t *key, isc_buffer_t *data) {
+ 	isc_result_t ret;
+ 	EVP_PKEY *pkey = NULL;
+ 	isc_region_t r;
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	EC_KEY *eckey = NULL;
+ 	const unsigned char *cp;
+ 	unsigned int len;
+@@ -739,7 +740,7 @@ opensslecdsa_fromdns(dst_key_t *key, isc_buffer_t *data) {
+ 	int group_nid;
+ #else
+ 	size_t len;
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+ 	REQUIRE(key->key_alg == DST_ALG_ECDSA256 ||
+ 		key->key_alg == DST_ALG_ECDSA384);
+@@ -758,7 +759,7 @@ opensslecdsa_fromdns(dst_key_t *key, isc_buffer_t *data) {
+ 		DST_RET(DST_R_INVALIDPUBLICKEY);
+ 	}
+ 
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	if (key->key_alg == DST_ALG_ECDSA256) {
+ 		group_nid = NID_X9_62_prime256v1;
+ 	} else {
+@@ -794,7 +795,7 @@ opensslecdsa_fromdns(dst_key_t *key, isc_buffer_t *data) {
+ 	if (ret != ISC_R_SUCCESS) {
+ 		DST_RET(ret);
+ 	}
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+ 	isc_buffer_forward(data, len);
+ 	key->keydata.pkey = pkey;
+@@ -802,11 +803,11 @@ opensslecdsa_fromdns(dst_key_t *key, isc_buffer_t *data) {
+ 	ret = ISC_R_SUCCESS;
+ 
+ err:
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	if (eckey != NULL) {
+ 		EC_KEY_free(eckey);
+ 	}
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 	return (ret);
+ }
+ 
+@@ -814,13 +815,13 @@ static isc_result_t
+ opensslecdsa_tofile(const dst_key_t *key, const char *directory) {
+ 	isc_result_t ret;
+ 	EVP_PKEY *pkey;
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	EC_KEY *eckey = NULL;
+ 	const BIGNUM *privkey = NULL;
+ #else
+ 	int status;
+ 	BIGNUM *privkey = NULL;
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 	dst_private_t priv;
+ 	unsigned char *buf = NULL;
+ 	unsigned short i;
+@@ -835,7 +836,7 @@ opensslecdsa_tofile(const dst_key_t *key, const char *directory) {
+ 	}
+ 
+ 	pkey = key->keydata.pkey;
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	eckey = EVP_PKEY_get1_EC_KEY(pkey);
+ 	if (eckey == NULL) {
+ 		DST_RET(dst__openssl_toresult2("EVP_PKEY_get1_EC_KEY",
+@@ -853,7 +854,7 @@ opensslecdsa_tofile(const dst_key_t *key, const char *directory) {
+ 		DST_RET(dst__openssl_toresult2("EVP_PKEY_get_bn_param",
+ 					       DST_R_OPENSSLFAILURE));
+ 	}
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+ 	buf = isc_mem_get(key->mctx, BN_num_bytes(privkey));
+ 
+@@ -888,7 +889,7 @@ err:
+ 	if (buf != NULL && privkey != NULL) {
+ 		isc_mem_put(key->mctx, buf, BN_num_bytes(privkey));
+ 	}
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	if (eckey != NULL) {
+ 		EC_KEY_free(eckey);
+ 	}
+@@ -896,12 +897,12 @@ err:
+ 	if (privkey != NULL) {
+ 		BN_clear_free(privkey);
+ 	}
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+ 	return (ret);
+ }
+ 
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ static isc_result_t
+ ecdsa_check(EC_KEY *eckey, EC_KEY *pubeckey) {
+ 	const EC_POINT *pubkey;
+@@ -1065,9 +1066,9 @@ err:
+ 
+ 	return (ret);
+ }
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ static isc_result_t
+ load_privkey_from_privstruct(EC_KEY *eckey, dst_private_t *priv,
+ 			     int privkey_index) {
+@@ -1102,16 +1103,16 @@ eckey_to_pkey(EC_KEY *eckey, EVP_PKEY **pkey) {
+ 	}
+ 	return (ISC_R_SUCCESS);
+ }
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+ static isc_result_t
+ finalize_eckey(dst_key_t *key,
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	       EC_KEY *eckey,
+ #endif
+ 	       const char *engine, const char *label) {
+ 	isc_result_t result = ISC_R_SUCCESS;
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	EVP_PKEY *pkey = NULL;
+ 
+ 	REQUIRE(eckey != NULL);
+@@ -1122,7 +1123,7 @@ finalize_eckey(dst_key_t *key,
+ 	}
+ 
+ 	key->keydata.pkey = pkey;
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+ 	if (label != NULL) {
+ 		key->label = isc_mem_strdup(key->mctx, label);
+@@ -1138,7 +1139,7 @@ finalize_eckey(dst_key_t *key,
+ 	return (result);
+ }
+ 
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ static isc_result_t
+ dst__key_to_eckey(dst_key_t *key, EC_KEY **eckey) {
+ 	int group_nid;
+@@ -1163,7 +1164,7 @@ dst__key_to_eckey(dst_key_t *key, EC_KEY **eckey) {
+ 
+ 	return (ISC_R_SUCCESS);
+ }
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+ static isc_result_t
+ opensslecdsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
+@@ -1173,10 +1174,10 @@ static isc_result_t
+ opensslecdsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
+ 	dst_private_t priv;
+ 	isc_result_t ret;
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	EC_KEY *eckey = NULL;
+ 	EC_KEY *pubeckey = NULL;
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 	const char *engine = NULL;
+ 	const char *label = NULL;
+ 	int i, privkey_index = -1;
+@@ -1227,14 +1228,14 @@ opensslecdsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
+ 			goto err;
+ 		}
+ 
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 		eckey = EVP_PKEY_get1_EC_KEY(key->keydata.pkey);
+ 		if (eckey == NULL) {
+ 			DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
+ 		}
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 	} else {
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 		ret = dst__key_to_eckey(key, &eckey);
+ 		if (ret != ISC_R_SUCCESS) {
+ 			goto err;
+@@ -1251,7 +1252,7 @@ opensslecdsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
+ 				      priv.elements[privkey_index].data,
+ 				      priv.elements[privkey_index].length,
+ 				      &key->keydata.pkey);
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+ 		if (ret != ISC_R_SUCCESS) {
+ 			goto err;
+@@ -1260,7 +1261,7 @@ opensslecdsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
+ 		finalize_key = true;
+ 	}
+ 
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	if (pub != NULL && pub->keydata.pkey != NULL) {
+ 		pubeckey = EVP_PKEY_get1_EC_KEY(pub->keydata.pkey);
+ 	}
+@@ -1283,17 +1284,17 @@ opensslecdsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
+ 	if (finalize_key) {
+ 		ret = finalize_eckey(key, engine, label);
+ 	}
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+ err:
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	if (pubeckey != NULL) {
+ 		EC_KEY_free(pubeckey);
+ 	}
+ 	if (eckey != NULL) {
+ 		EC_KEY_free(eckey);
+ 	}
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 	if (ret != ISC_R_SUCCESS) {
+ 		key->keydata.generic = NULL;
+ 	}
+diff --git a/lib/dns/opensslrsa_link.c b/lib/dns/opensslrsa_link.c
+index fc905b7d60..867b486a2f 100644
+--- a/lib/dns/opensslrsa_link.c
++++ b/lib/dns/opensslrsa_link.c
+@@ -18,7 +18,7 @@
+ 
+ #include <openssl/bn.h>
+ #include <openssl/opensslv.h>
+-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
++#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+ #include <openssl/core_names.h>
+ #endif
+ #if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000
+@@ -26,7 +26,7 @@
+ #endif /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */
+ #include <openssl/err.h>
+ #include <openssl/objects.h>
+-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
++#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+ #include <openssl/param_build.h>
+ #endif
+ #include <openssl/rsa.h>
+@@ -180,12 +180,12 @@ static isc_result_t
+ opensslrsa_verify2(dst_context_t *dctx, int maxbits, const isc_region_t *sig) {
+ 	dst_key_t *key = dctx->key;
+ 	int status = 0;
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	RSA *rsa;
+ 	const BIGNUM *e = NULL;
+ #else
+ 	BIGNUM *e = NULL;
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 	EVP_MD_CTX *evp_md_ctx = dctx->ctxdata.evp_md_ctx;
+ 	EVP_PKEY *pkey = key->keydata.pkey;
+ 	int bits;
+@@ -195,7 +195,7 @@ opensslrsa_verify2(dst_context_t *dctx, int maxbits, const isc_region_t *sig) {
+ 		dctx->key->key_alg == DST_ALG_RSASHA256 ||
+ 		dctx->key->key_alg == DST_ALG_RSASHA512);
+ 
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	rsa = EVP_PKEY_get1_RSA(pkey);
+ 	if (rsa == NULL) {
+ 		return (dst__openssl_toresult(DST_R_OPENSSLFAILURE));
+@@ -213,7 +213,7 @@ opensslrsa_verify2(dst_context_t *dctx, int maxbits, const isc_region_t *sig) {
+ 	}
+ 	bits = BN_num_bits(e);
+ 	BN_free(e);
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+ 	if (bits > maxbits && maxbits != 0) {
+ 		return (DST_R_VERIFYFAILURE);
+@@ -243,7 +243,7 @@ opensslrsa_compare(const dst_key_t *key1, const dst_key_t *key2) {
+ 	int status;
+ 	EVP_PKEY *pkey1 = key1->keydata.pkey;
+ 	EVP_PKEY *pkey2 = key2->keydata.pkey;
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	RSA *rsa1 = NULL;
+ 	RSA *rsa2 = NULL;
+ 	const BIGNUM *d1 = NULL, *d2 = NULL;
+@@ -253,7 +253,7 @@ opensslrsa_compare(const dst_key_t *key1, const dst_key_t *key2) {
+ 	BIGNUM *d1 = NULL, *d2 = NULL;
+ 	BIGNUM *p1 = NULL, *p2 = NULL;
+ 	BIGNUM *q1 = NULL, *q2 = NULL;
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+ 	if (pkey1 == NULL && pkey2 == NULL) {
+ 		return (true);
+@@ -267,7 +267,7 @@ opensslrsa_compare(const dst_key_t *key1, const dst_key_t *key2) {
+ 		DST_RET(false);
+ 	}
+ 
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	rsa1 = EVP_PKEY_get1_RSA(pkey1);
+ 	rsa2 = EVP_PKEY_get1_RSA(pkey2);
+ 	if (rsa1 == NULL && rsa2 == NULL) {
+@@ -280,14 +280,14 @@ opensslrsa_compare(const dst_key_t *key1, const dst_key_t *key2) {
+ #else
+ 	EVP_PKEY_get_bn_param(pkey1, OSSL_PKEY_PARAM_RSA_D, &d1);
+ 	EVP_PKEY_get_bn_param(pkey2, OSSL_PKEY_PARAM_RSA_D, &d2);
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+ 	if (d1 != NULL || d2 != NULL) {
+ 		if (d1 == NULL || d2 == NULL) {
+ 			DST_RET(false);
+ 		}
+ 
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 		RSA_get0_factors(rsa1, &p1, &q1);
+ 		RSA_get0_factors(rsa2, &p2, &q2);
+ #else
+@@ -295,7 +295,7 @@ opensslrsa_compare(const dst_key_t *key1, const dst_key_t *key2) {
+ 		EVP_PKEY_get_bn_param(pkey1, OSSL_PKEY_PARAM_RSA_FACTOR2, &q1);
+ 		EVP_PKEY_get_bn_param(pkey2, OSSL_PKEY_PARAM_RSA_FACTOR1, &p2);
+ 		EVP_PKEY_get_bn_param(pkey2, OSSL_PKEY_PARAM_RSA_FACTOR2, &q2);
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+ 		if (BN_cmp(d1, d2) != 0 || BN_cmp(p1, p2) != 0 ||
+ 		    BN_cmp(q1, q2) != 0) {
+@@ -306,7 +306,7 @@ opensslrsa_compare(const dst_key_t *key1, const dst_key_t *key2) {
+ 	ret = true;
+ 
+ err:
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	if (rsa1 != NULL) {
+ 		RSA_free(rsa1);
+ 	}
+@@ -332,12 +332,12 @@ err:
+ 	if (q2 != NULL) {
+ 		BN_clear_free(q2);
+ 	}
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+ 	return (ret);
+ }
+ 
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ static int
+ progress_cb(int p, int n, BN_GENCB *cb) {
+ 	union {
+@@ -368,7 +368,7 @@ progress_cb(EVP_PKEY_CTX *ctx) {
+ 	}
+ 	return (1);
+ }
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+ static isc_result_t
+ opensslrsa_generate(dst_key_t *key, int exp, void (*callback)(int)) {
+@@ -378,7 +378,7 @@ opensslrsa_generate(dst_key_t *key, int exp, void (*callback)(int)) {
+ 		void (*fptr)(int);
+ 	} u;
+ 	BIGNUM *e = BN_new();
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	RSA *rsa = RSA_new();
+ 	EVP_PKEY *pkey = EVP_PKEY_new();
+ #if !HAVE_BN_GENCB_NEW
+@@ -388,9 +388,9 @@ opensslrsa_generate(dst_key_t *key, int exp, void (*callback)(int)) {
+ #else
+ 	EVP_PKEY_CTX *ctx = EVP_PKEY_CTX_new_from_name(NULL, "RSA", NULL);
+ 	EVP_PKEY *pkey = NULL;
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	if (e == NULL || rsa == NULL || pkey == NULL || cb == NULL) {
+ 		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
+ 	}
+@@ -398,7 +398,7 @@ opensslrsa_generate(dst_key_t *key, int exp, void (*callback)(int)) {
+ 	if (e == NULL || ctx == NULL) {
+ 		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
+ 	}
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+ 	/*
+ 	 * Reject incorrect RSA key lengths.
+@@ -437,7 +437,7 @@ opensslrsa_generate(dst_key_t *key, int exp, void (*callback)(int)) {
+ 		BN_set_bit(e, 32);
+ 	}
+ 
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	if (EVP_PKEY_set1_RSA(pkey, rsa) != 1) {
+ 		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
+ 	}
+@@ -476,7 +476,7 @@ opensslrsa_generate(dst_key_t *key, int exp, void (*callback)(int)) {
+ 		DST_RET(dst__openssl_toresult2("EVP_PKEY_keygen",
+ 					       DST_R_OPENSSLFAILURE));
+ 	}
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+ 	key->keydata.pkey = pkey;
+ 	pkey = NULL;
+@@ -486,7 +486,7 @@ err:
+ 	if (pkey != NULL) {
+ 		EVP_PKEY_free(pkey);
+ 	}
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	if (rsa != NULL) {
+ 		RSA_free(rsa);
+ 	}
+@@ -497,7 +497,7 @@ err:
+ 	if (ctx != NULL) {
+ 		EVP_PKEY_CTX_free(ctx);
+ 	}
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 	if (e != NULL) {
+ 		BN_free(e);
+ 	}
+@@ -508,12 +508,12 @@ static bool
+ opensslrsa_isprivate(const dst_key_t *key) {
+ 	bool ret;
+ 	EVP_PKEY *pkey;
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	RSA *rsa;
+ 	const BIGNUM *d = NULL;
+ #else
+ 	BIGNUM *d = NULL;
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+ 	REQUIRE(key->key_alg == DST_ALG_RSASHA1 ||
+ 		key->key_alg == DST_ALG_NSEC3RSASHA1 ||
+@@ -525,7 +525,7 @@ opensslrsa_isprivate(const dst_key_t *key) {
+ 		return (false);
+ 	}
+ 
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	rsa = EVP_PKEY_get1_RSA(pkey);
+ 	INSIST(rsa != NULL);
+ 
+@@ -542,7 +542,7 @@ opensslrsa_isprivate(const dst_key_t *key) {
+ 	if (d != NULL) {
+ 		BN_clear_free(d);
+ 	}
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+ 	return (ret);
+ }
+@@ -564,19 +564,19 @@ opensslrsa_todns(const dst_key_t *key, isc_buffer_t *data) {
+ 	unsigned int mod_bytes;
+ 	isc_result_t ret;
+ 	EVP_PKEY *pkey;
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	RSA *rsa;
+ 	const BIGNUM *e = NULL, *n = NULL;
+ #else
+ 	BIGNUM *e = NULL, *n = NULL;
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+ 	REQUIRE(key->keydata.pkey != NULL);
+ 
+ 	pkey = key->keydata.pkey;
+ 	isc_buffer_availableregion(data, &r);
+ 
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	rsa = EVP_PKEY_get1_RSA(pkey);
+ 	if (rsa == NULL) {
+ 		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
+@@ -588,7 +588,7 @@ opensslrsa_todns(const dst_key_t *key, isc_buffer_t *data) {
+ 	if (e == NULL || n == NULL) {
+ 		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
+ 	}
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+ 	mod_bytes = BN_num_bytes(n);
+ 	e_bytes = BN_num_bytes(e);
+@@ -621,7 +621,7 @@ opensslrsa_todns(const dst_key_t *key, isc_buffer_t *data) {
+ 
+ 	ret = ISC_R_SUCCESS;
+ err:
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	if (rsa != NULL) {
+ 		RSA_free(rsa);
+ 	}
+@@ -632,7 +632,7 @@ err:
+ 	if (n != NULL) {
+ 		BN_free(n);
+ 	}
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 	return (ret);
+ }
+ 
+@@ -643,13 +643,13 @@ opensslrsa_fromdns(dst_key_t *key, isc_buffer_t *data) {
+ 	isc_region_t r;
+ 	unsigned int e_bytes;
+ 	unsigned int length;
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	RSA *rsa = NULL;
+ #else
+ 	OSSL_PARAM_BLD *bld = NULL;
+ 	OSSL_PARAM *params = NULL;
+ 	EVP_PKEY_CTX *ctx = NULL;
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 	EVP_PKEY *pkey = NULL;
+ 	BIGNUM *e = NULL, *n = NULL;
+ 
+@@ -691,7 +691,7 @@ opensslrsa_fromdns(dst_key_t *key, isc_buffer_t *data) {
+ 
+ 	isc_buffer_forward(data, length);
+ 
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	rsa = RSA_new();
+ 	if (rsa == NULL) {
+ 		DST_RET(dst__openssl_toresult2("RSA_new",
+@@ -749,7 +749,7 @@ opensslrsa_fromdns(dst_key_t *key, isc_buffer_t *data) {
+ 		DST_RET(dst__openssl_toresult2("EVP_PKEY_fromdata",
+ 					       DST_R_OPENSSLFAILURE));
+ 	}
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+ 	key->keydata.pkey = pkey;
+ 	pkey = NULL;
+@@ -757,7 +757,7 @@ opensslrsa_fromdns(dst_key_t *key, isc_buffer_t *data) {
+ 
+ err:
+ 
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	if (rsa != NULL) {
+ 		RSA_free(rsa);
+ 	}
+@@ -771,7 +771,7 @@ err:
+ 	if (bld != NULL) {
+ 		OSSL_PARAM_BLD_free(bld);
+ 	}
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 	if (n != NULL) {
+ 		BN_free(n);
+ 	}
+@@ -792,7 +792,7 @@ opensslrsa_tofile(const dst_key_t *key, const char *directory) {
+ 	unsigned char *bufs[8] = { NULL };
+ 	unsigned short i = 0;
+ 	EVP_PKEY *pkey;
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	RSA *rsa = NULL;
+ 	const BIGNUM *n = NULL, *e = NULL, *d = NULL;
+ 	const BIGNUM *p = NULL, *q = NULL;
+@@ -801,7 +801,7 @@ opensslrsa_tofile(const dst_key_t *key, const char *directory) {
+ 	BIGNUM *n = NULL, *e = NULL, *d = NULL;
+ 	BIGNUM *p = NULL, *q = NULL;
+ 	BIGNUM *dmp1 = NULL, *dmq1 = NULL, *iqmp = NULL;
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+ 	if (key->keydata.pkey == NULL) {
+ 		DST_RET(DST_R_NULLKEY);
+@@ -812,7 +812,7 @@ opensslrsa_tofile(const dst_key_t *key, const char *directory) {
+ 	}
+ 
+ 	pkey = key->keydata.pkey;
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	rsa = EVP_PKEY_get1_RSA(pkey);
+ 	if (rsa == NULL) {
+ 		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
+@@ -829,7 +829,7 @@ opensslrsa_tofile(const dst_key_t *key, const char *directory) {
+ 	EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_RSA_EXPONENT1, &dmp1);
+ 	EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_RSA_EXPONENT2, &dmq1);
+ 	EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_RSA_COEFFICIENT1, &iqmp);
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+ 	if (n == NULL || e == NULL) {
+ 		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
+@@ -935,7 +935,7 @@ err:
+ 				    priv.elements[i].length);
+ 		}
+ 	}
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	RSA_free(rsa);
+ #else
+ 	if (n != NULL) {
+@@ -962,12 +962,12 @@ err:
+ 	if (iqmp != NULL) {
+ 		BN_clear_free(iqmp);
+ 	}
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+ 	return (ret);
+ }
+ 
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ static isc_result_t
+ rsa_check(RSA *rsa, RSA *pub) {
+ 	const BIGNUM *n1 = NULL, *n2 = NULL;
+@@ -1079,14 +1079,14 @@ err:
+ 
+ 	return (ret);
+ }
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+ static isc_result_t
+ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
+ 	dst_private_t priv;
+ 	isc_result_t ret;
+ 	int i;
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	RSA *rsa = NULL, *pubrsa = NULL;
+ 	const BIGNUM *ex = NULL;
+ #else
+@@ -1094,7 +1094,7 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
+ 	OSSL_PARAM *params = NULL;
+ 	EVP_PKEY_CTX *ctx = NULL;
+ 	BIGNUM *ex = NULL;
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ #if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000
+ 	ENGINE *ep = NULL;
+ #endif /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */
+@@ -1126,11 +1126,11 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
+ 		DST_RET(ISC_R_SUCCESS);
+ 	}
+ 
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	if (pub != NULL && pub->keydata.pkey != NULL) {
+ 		pubrsa = EVP_PKEY_get1_RSA(pub->keydata.pkey);
+ 	}
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+ 	for (i = 0; i < priv.nelements; i++) {
+ 		switch (priv.elements[i].tag) {
+@@ -1249,7 +1249,7 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
+ 		}
+ 	}
+ 
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	rsa = RSA_new();
+ 	if (rsa == NULL) {
+ 		DST_RET(ISC_R_NOMEMORY);
+@@ -1361,7 +1361,7 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
+ 	    ISC_R_SUCCESS) {
+ 		DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
+ 	}
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+ 	if (BN_num_bits(e) > RSA_MAX_PUBEXP_BITS) {
+ 		DST_RET(ISC_R_RANGE);
+@@ -1375,7 +1375,7 @@ err:
+ 	if (pkey != NULL) {
+ 		EVP_PKEY_free(pkey);
+ 	}
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	if (rsa != NULL) {
+ 		RSA_free(rsa);
+ 	}
+@@ -1419,7 +1419,7 @@ err:
+ 	if (iqmp != NULL) {
+ 		BN_clear_free(iqmp);
+ 	}
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 	if (ret != ISC_R_SUCCESS) {
+ 		key->keydata.generic = NULL;
+ 	}
+@@ -1643,7 +1643,7 @@ check_algorithm(unsigned char algorithm) {
+ 	int status;
+ 	isc_result_t ret = ISC_R_SUCCESS;
+ 	size_t len;
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	RSA *rsa = NULL;
+ #else
+ 	OSSL_PARAM *params = NULL;
+@@ -1689,7 +1689,7 @@ check_algorithm(unsigned char algorithm) {
+ 		DST_RET(ISC_R_NOMEMORY);
+ 	}
+ 
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	rsa = RSA_new();
+ 	if (rsa == NULL) {
+ 		DST_RET(dst__openssl_toresult2("RSA_new",
+@@ -1762,7 +1762,7 @@ check_algorithm(unsigned char algorithm) {
+ err:
+ 	BN_free(e);
+ 	BN_free(n);
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	if (rsa != NULL) {
+ 		RSA_free(rsa);
+ 	}
+-- 
+2.37.2
+
diff --git a/bind-9.18-pkcs11-engine-init.patch b/bind-9.18-pkcs11-engine-init.patch
new file mode 100644
index 0000000..5c0c6c4
--- /dev/null
+++ b/bind-9.18-pkcs11-engine-init.patch
@@ -0,0 +1,48 @@
+From 87a2eac7a8264a0e8d64a8db85d44ec22454e256 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
+Date: Wed, 7 Sep 2022 13:46:31 +0200
+Subject: [PATCH 1/3] Add ENGINE_init and ENGINE_finish calls
+
+According to manual page of ENGINE_init, it should be called explicitly
+before any key operations happens. Make it active whole lifetime.
+---
+ lib/dns/openssl_link.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/lib/dns/openssl_link.c b/lib/dns/openssl_link.c
+index 333f34cb37..a3f63885fa 100644
+--- a/lib/dns/openssl_link.c
++++ b/lib/dns/openssl_link.c
+@@ -85,14 +85,20 @@ dst__openssl_init(const char *engine) {
+ 			result = DST_R_NOENGINE;
+ 			goto cleanup_rm;
+ 		}
++		if (!ENGINE_init(e)) {
++			result = DST_R_NOENGINE;
++			goto cleanup_rm;
++		}
+ 		/* This will init the engine. */
+ 		if (!ENGINE_set_default(e, ENGINE_METHOD_ALL)) {
+ 			result = DST_R_NOENGINE;
+-			goto cleanup_rm;
++			goto cleanup_init;
+ 		}
+ 	}
+ 
+ 	return (ISC_R_SUCCESS);
++cleanup_init:
++	ENGINE_finish(e);
+ cleanup_rm:
+ 	if (e != NULL) {
+ 		ENGINE_free(e);
+@@ -108,6 +114,7 @@ void
+ dst__openssl_destroy(void) {
+ #if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000
+ 	if (e != NULL) {
++		ENGINE_finish(e);
+ 		ENGINE_free(e);
+ 	}
+ 	e = NULL;
+-- 
+2.37.2
+
diff --git a/bind-9.18-pkcs11-engine-remove-deadcode.patch b/bind-9.18-pkcs11-engine-remove-deadcode.patch
new file mode 100644
index 0000000..7586395
--- /dev/null
+++ b/bind-9.18-pkcs11-engine-remove-deadcode.patch
@@ -0,0 +1,245 @@
+From cc8edfc6670ba97434bc5acb595539fd9c7d9123 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
+Date: Thu, 8 Sep 2022 16:33:38 +0200
+Subject: [PATCH 3/3] Remove engine related parts for OpenSSL 3.0
+
+OpenSSL just cannot work with mixing ENGINE_* api mixed with OSSL_PARAM
+builders. But it can be built in legacy mode, where deprecated but still
+working API would be used.
+
+It can work under OpenSSL 3.0, but only if using legacy code paths
+matching OpenSSL 1.1 calls and functions.
+
+Remove fromlabel processing by OpenSSL 3.0 only functions. They can
+return later with a proper provider support for pkcs11.
+---
+ lib/dns/opensslecdsa_link.c | 55 -------------------------------------
+ lib/dns/opensslrsa_link.c   | 32 ---------------------
+ 2 files changed, 87 deletions(-)
+
+diff --git a/lib/dns/opensslecdsa_link.c b/lib/dns/opensslecdsa_link.c
+index 04f0d80b5e..f04f076e42 100644
+--- a/lib/dns/opensslecdsa_link.c
++++ b/lib/dns/opensslecdsa_link.c
+@@ -1311,15 +1311,9 @@ opensslecdsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
+ #if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000
+ 	isc_result_t ret = ISC_R_SUCCESS;
+ 	ENGINE *e;
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
+ 	EC_KEY *eckey = NULL;
+ 	EC_KEY *pubeckey = NULL;
+ 	int group_nid;
+-#else
+-	size_t len;
+-	const char *curve_name, *nist_curve_name;
+-	char buf[128]; /* Sufficient for all of the supported curves' names. */
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
+ 	EVP_PKEY *pkey = NULL;
+ 	EVP_PKEY *pubpkey = NULL;
+ 
+@@ -1336,22 +1330,11 @@ opensslecdsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
+ 		DST_RET(DST_R_NOENGINE);
+ 	}
+ 
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
+ 	if (key->key_alg == DST_ALG_ECDSA256) {
+ 		group_nid = NID_X9_62_prime256v1;
+ 	} else {
+ 		group_nid = NID_secp384r1;
+ 	}
+-#else
+-	/* Get the expected curve names */
+-	if (key->key_alg == DST_ALG_ECDSA256) {
+-		curve_name = "prime256v1";
+-		nist_curve_name = "P-256";
+-	} else {
+-		curve_name = "secp384r1";
+-		nist_curve_name = "P-384";
+-	}
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
+ 
+ 	/* Load private key. */
+ 	pkey = ENGINE_load_private_key(e, label, NULL, NULL);
+@@ -1363,7 +1346,6 @@ opensslecdsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
+ 	if (EVP_PKEY_base_id(pkey) != EVP_PKEY_EC) {
+ 		DST_RET(DST_R_INVALIDPRIVATEKEY);
+ 	}
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
+ 	eckey = EVP_PKEY_get1_EC_KEY(pkey);
+ 	if (eckey == NULL) {
+ 		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
+@@ -1371,20 +1353,6 @@ opensslecdsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
+ 	if (EC_GROUP_get_curve_name(EC_KEY_get0_group(eckey)) != group_nid) {
+ 		DST_RET(DST_R_INVALIDPRIVATEKEY);
+ 	}
+-#else
+-	len = 0;
+-	if (EVP_PKEY_get_utf8_string_param(pkey, OSSL_PKEY_PARAM_GROUP_NAME,
+-					   buf, sizeof buf, &len) != 1 ||
+-	    len == 0 || len >= sizeof buf)
+-	{
+-		DST_RET(DST_R_INVALIDPRIVATEKEY);
+-	}
+-	if (strncasecmp(buf, curve_name, strlen(curve_name)) != 0 &&
+-	    strncasecmp(buf, nist_curve_name, strlen(nist_curve_name)) != 0)
+-	{
+-		DST_RET(DST_R_INVALIDPRIVATEKEY);
+-	}
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
+ 
+ 	/* Load public key. */
+ 	pubpkey = ENGINE_load_public_key(e, label, NULL, NULL);
+@@ -1396,7 +1364,6 @@ opensslecdsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
+ 	if (EVP_PKEY_base_id(pubpkey) != EVP_PKEY_EC) {
+ 		DST_RET(DST_R_INVALIDPUBLICKEY);
+ 	}
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
+ 	pubeckey = EVP_PKEY_get1_EC_KEY(pubpkey);
+ 	if (pubeckey == NULL) {
+ 		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
+@@ -1404,30 +1371,10 @@ opensslecdsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
+ 	if (EC_GROUP_get_curve_name(EC_KEY_get0_group(pubeckey)) != group_nid) {
+ 		DST_RET(DST_R_INVALIDPUBLICKEY);
+ 	}
+-#else
+-	len = 0;
+-	if (EVP_PKEY_get_utf8_string_param(pubpkey, OSSL_PKEY_PARAM_GROUP_NAME,
+-					   buf, sizeof buf, &len) != 1 ||
+-	    len == 0 || len >= sizeof buf)
+-	{
+-		DST_RET(DST_R_INVALIDPUBLICKEY);
+-	}
+-	if (strncasecmp(buf, curve_name, strlen(curve_name)) != 0 &&
+-	    strncasecmp(buf, nist_curve_name, strlen(nist_curve_name)) != 0)
+-	{
+-		DST_RET(DST_R_INVALIDPUBLICKEY);
+-	}
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
+ 
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
+ 	if (ecdsa_check(eckey, pubeckey) != ISC_R_SUCCESS) {
+ 		DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
+ 	}
+-#else
+-	if (ecdsa_check(&pkey, pubpkey) != ISC_R_SUCCESS) {
+-		DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
+-	}
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
+ 
+ 	key->label = isc_mem_strdup(key->mctx, label);
+ 	key->engine = isc_mem_strdup(key->mctx, engine);
+@@ -1442,14 +1389,12 @@ err:
+ 	if (pkey != NULL) {
+ 		EVP_PKEY_free(pkey);
+ 	}
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
+ 	if (pubeckey != NULL) {
+ 		EC_KEY_free(pubeckey);
+ 	}
+ 	if (eckey != NULL) {
+ 		EC_KEY_free(eckey);
+ 	}
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
+ 
+ 	return (ret);
+ #else
+diff --git a/lib/dns/opensslrsa_link.c b/lib/dns/opensslrsa_link.c
+index 867b486a2f..cf350610ba 100644
+--- a/lib/dns/opensslrsa_link.c
++++ b/lib/dns/opensslrsa_link.c
+@@ -1167,7 +1167,6 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
+ 		key->engine = isc_mem_strdup(key->mctx, engine);
+ 		key->label = isc_mem_strdup(key->mctx, label);
+ 
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
+ 		rsa = EVP_PKEY_get1_RSA(pkey);
+ 		if (rsa == NULL) {
+ 			DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
+@@ -1176,16 +1175,6 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
+ 			DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
+ 		}
+ 		RSA_get0_key(rsa, NULL, &ex, NULL);
+-#else
+-		if (rsa_check(pkey, pub != NULL ? pub->keydata.pkey : NULL) !=
+-		    ISC_R_SUCCESS) {
+-			DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
+-		}
+-		if (EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_RSA_E, &ex) !=
+-		    1) {
+-			DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
+-		}
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
+ 
+ 		if (ex == NULL) {
+ 			DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
+@@ -1437,12 +1426,8 @@ opensslrsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
+ 	ENGINE *e = NULL;
+ 	isc_result_t ret = ISC_R_SUCCESS;
+ 	EVP_PKEY *pkey = NULL, *pubpkey = NULL;
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
+ 	RSA *rsa = NULL, *pubrsa = NULL;
+ 	const BIGNUM *ex = NULL;
+-#else
+-	BIGNUM *ex = NULL;
+-#endif
+ 
+ 	UNUSED(pin);
+ 
+@@ -1459,12 +1444,10 @@ opensslrsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
+ 		DST_RET(dst__openssl_toresult2("ENGINE_load_public_key",
+ 					       DST_R_OPENSSLFAILURE));
+ 	}
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
+ 	pubrsa = EVP_PKEY_get1_RSA(pubpkey);
+ 	if (pubrsa == NULL) {
+ 		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
+ 	}
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
+ 
+ 	pkey = ENGINE_load_private_key(e, label, NULL, NULL);
+ 	if (pkey == NULL) {
+@@ -1475,7 +1458,6 @@ opensslrsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
+ 	key->engine = isc_mem_strdup(key->mctx, engine);
+ 	key->label = isc_mem_strdup(key->mctx, label);
+ 
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
+ 	rsa = EVP_PKEY_get1_RSA(pkey);
+ 	if (rsa == NULL) {
+ 		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
+@@ -1484,14 +1466,6 @@ opensslrsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
+ 		DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
+ 	}
+ 	RSA_get0_key(rsa, NULL, &ex, NULL);
+-#else
+-	if (rsa_check(pkey, pubpkey) != ISC_R_SUCCESS) {
+-		DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
+-	}
+-	if (EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_RSA_E, &ex) != 1) {
+-		DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
+-	}
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
+ 
+ 	if (ex == NULL) {
+ 		DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
+@@ -1505,18 +1479,12 @@ opensslrsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
+ 	pkey = NULL;
+ 
+ err:
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
+ 	if (rsa != NULL) {
+ 		RSA_free(rsa);
+ 	}
+ 	if (pubrsa != NULL) {
+ 		RSA_free(pubrsa);
+ 	}
+-#else
+-	if (ex != NULL) {
+-		BN_free(ex);
+-	}
+-#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
+ 	if (pkey != NULL) {
+ 		EVP_PKEY_free(pkey);
+ 	}
+-- 
+2.37.2
+
diff --git a/bind.spec b/bind.spec
index 860a524..1840c00 100644
--- a/bind.spec
+++ b/bind.spec
@@ -61,7 +61,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.18.6
-Release:  2%{?dist}
+Release:  3%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -97,6 +97,11 @@ Source49: named-chroot.files
 Patch10: bind-9.5-PIE.patch
 Patch16: bind-9.16-redhat_doc.patch
 Patch22: bind-9.11-fips-tests.patch
+# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/5385
+# https://bugzilla.redhat.com/show_bug.cgi?id=2122841
+Patch23: bind-9.18-pkcs11-engine-init.patch
+Patch24: bind-9.18-pkcs11-engine-compat-api.patch
+Patch25: bind-9.18-pkcs11-engine-remove-deadcode.patch
 
 %{?systemd_ordering}
 Requires:       coreutils
@@ -349,10 +354,11 @@ done
   cp -Tuav bin/tests "%{1}/bin/tests/" \
 
 CFLAGS="$CFLAGS $RPM_OPT_FLAGS"
+CPPFLAGS="$CPPFLAGS -DOPENSSL_API_COMPAT=10100"
 %if %{with TSAN}
   CFLAGS+=" -O1 -fsanitize=thread -fPIE -pie"
 %endif
-export CFLAGS
+export CFLAGS CPPFLAGS
 export STD_CDEFINES="$CPPFLAGS"
 
 
@@ -402,6 +408,7 @@ export LIBDIR_SUFFIX
 %endif
   --enable-fixed-rrset \
   --enable-full-report \
+  CPPFLAGS="$CPPFLAGS" \
 ;
 %if %{with DNSTAP}
   pushd lib
@@ -941,6 +948,9 @@ fi;
 %endif
 
 %changelog
+* Tue Sep 06 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.6-3
+- Return OpenSSL engine implementation for pkcs11 interface (#2122841)
+
 * Thu Sep 01 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.6-2
 - Always show error details for failed unittests (#2122010)
 

From 99f74efbdc17bf091b692970710c9631b301e1a0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 12 Sep 2022 10:43:01 +0200
Subject: [PATCH 314/460] Fix some tests conditionals

---
 bind-9.11-fips-tests.patch | 46 ++++++++++++++++++++++++++------------
 1 file changed, 32 insertions(+), 14 deletions(-)

diff --git a/bind-9.11-fips-tests.patch b/bind-9.11-fips-tests.patch
index 6fae234..ea38410 100644
--- a/bind-9.11-fips-tests.patch
+++ b/bind-9.11-fips-tests.patch
@@ -1,4 +1,4 @@
-From 8bbfacc1a90301a71a487e776db071fa2ef6c8dd Mon Sep 17 00:00:00 2001
+From 09030b066846a9b7252b5cb4f483d4a55b4639fc Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 2 Aug 2018 23:46:45 +0200
 Subject: [PATCH] FIPS tests changes
@@ -85,11 +85,13 @@ Date:   Wed Mar 7 10:44:23 2018 +0100
  bin/tests/system/rndc/setup.sh                |  2 +-
  bin/tests/system/rndc/tests.sh                | 22 +++---
  bin/tests/system/tsig/ns1/named.conf.in       | 10 +--
+ bin/tests/system/tsig/ns1/rndc5.conf.in       | 10 +++
  bin/tests/system/tsig/setup.sh                |  5 ++
  bin/tests/system/tsig/tests.sh                | 67 ++++++++++++-------
  bin/tests/system/upforwd/ns1/named.conf.in    |  2 +-
  bin/tests/system/upforwd/tests.sh             |  2 +-
- 31 files changed, 149 insertions(+), 106 deletions(-)
+ 32 files changed, 159 insertions(+), 106 deletions(-)
+ create mode 100644 bin/tests/system/tsig/ns1/rndc5.conf.in
 
 diff --git a/bin/tests/system/acl/ns2/named1.conf.in b/bin/tests/system/acl/ns2/named1.conf.in
 index 745048a..93cb411 100644
@@ -193,7 +195,7 @@ index f43f33c..f4a865a 100644
  };
  
 diff --git a/bin/tests/system/acl/tests.sh b/bin/tests/system/acl/tests.sh
-index 9ee3984..f7d4388 100644
+index ad98fa1..7a7ff4a 100644
 --- a/bin/tests/system/acl/tests.sh
 +++ b/bin/tests/system/acl/tests.sh
 @@ -23,14 +23,14 @@ echo_i "testing basic ACL processing"
@@ -513,10 +515,10 @@ index bbffe07..80da0fe 100644
  grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1
  grep '^a.keydisallow.example' dig.out.ns2.$n > /dev/null && ret=1
 diff --git a/bin/tests/system/catz/ns1/named.conf.in b/bin/tests/system/catz/ns1/named.conf.in
-index 5a46d39..fc1bd07 100644
+index 1421281..424afb8 100644
 --- a/bin/tests/system/catz/ns1/named.conf.in
 +++ b/bin/tests/system/catz/ns1/named.conf.in
-@@ -63,5 +63,5 @@ zone "catalog4.example" {
+@@ -122,5 +122,5 @@ view "ch" ch {
  
  key tsig_key. {
  	secret "LSAnCU+Z";
@@ -549,10 +551,10 @@ index 897dc86..e4b6dc1 100644
  	secret "qwertyuiopasdfgh";
  };
 diff --git a/bin/tests/system/feature-test.c b/bin/tests/system/feature-test.c
-index 30e6e14..ba7f98e 100644
+index 3435c91..aaaa264 100644
 --- a/bin/tests/system/feature-test.c
 +++ b/bin/tests/system/feature-test.c
-@@ -16,6 +16,7 @@
+@@ -17,6 +17,7 @@
  #include <string.h>
  #include <unistd.h>
  
@@ -560,7 +562,7 @@ index 30e6e14..ba7f98e 100644
  #include <isc/net.h>
  #include <isc/print.h>
  #include <isc/util.h>
-@@ -140,6 +141,19 @@ main(int argc, char **argv) {
+@@ -133,6 +134,19 @@ main(int argc, char **argv) {
  #endif
  	}
  
@@ -606,10 +608,10 @@ index 5cab276..d4a7bf3 100644
  };
  
 diff --git a/bin/tests/system/notify/tests.sh b/bin/tests/system/notify/tests.sh
-index 52d2f81..1fd02d4 100644
+index 04fd34b..e5476ea 100644
 --- a/bin/tests/system/notify/tests.sh
 +++ b/bin/tests/system/notify/tests.sh
-@@ -187,7 +187,7 @@ test_start "checking notify to multiple views using tsig"
+@@ -179,7 +179,7 @@ test_start "checking notify to multiple views using tsig"
  $NSUPDATE << EOF
  server 10.53.0.5 ${PORT}
  zone x21
@@ -618,7 +620,7 @@ index 52d2f81..1fd02d4 100644
  update add added.x21 0 in txt "test string"
  send
  EOF
-@@ -195,9 +195,9 @@ fnb="dig.out.b.ns5.test$n"
+@@ -187,9 +187,9 @@ fnb="dig.out.b.ns5.test$n"
  fnc="dig.out.c.ns5.test$n"
  for i in 1 2 3 4 5 6 7 8 9
  do
@@ -716,7 +718,7 @@ index 4dd6fa7..1b79263 100644
  make_key 3 ${EXTRAPORT3} hmac-sha224
  make_key 4 ${EXTRAPORT4} hmac-sha256
 diff --git a/bin/tests/system/rndc/tests.sh b/bin/tests/system/rndc/tests.sh
-index 85c271b..ac69f32 100644
+index e678153..e7ec855 100644
 --- a/bin/tests/system/rndc/tests.sh
 +++ b/bin/tests/system/rndc/tests.sh
 @@ -350,15 +350,19 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -732,7 +734,7 @@ index 85c271b..ac69f32 100644
 -done
 -if [ $ret != 0 ]; then echo_i "failed"; fi
 -status=$((status+ret))
-+if $FEATURETEST --md5
++if $FEATURETEST --md5; then
 +	echo_i "testing rndc with hmac-md5 ($n)"
 +	ret=0
 +	$RNDC -s 10.53.0.4 -p ${EXTRAPORT1} -c ns4/key1.conf status > /dev/null 2>&1 || ret=1
@@ -776,6 +778,22 @@ index 76cf970..22637af 100644
  
  key "sha1-trunc" {
  	secret "FrSt77yPTFx6hTs4i2tKLB9LmE0=";
+diff --git a/bin/tests/system/tsig/ns1/rndc5.conf.in b/bin/tests/system/tsig/ns1/rndc5.conf.in
+new file mode 100644
+index 0000000..0682194
+--- /dev/null
++++ b/bin/tests/system/tsig/ns1/rndc5.conf.in
+@@ -0,0 +1,10 @@
++# Conditionally included when support for MD5 is available
++key "md5" {
++	secret "97rnFx24Tfna4mHPfgnerA==";
++	algorithm hmac-md5;
++};
++
++key "md5-trunc" {
++	secret "97rnFx24Tfna4mHPfgnerA==";
++	algorithm hmac-md5-80;
++};
 diff --git a/bin/tests/system/tsig/setup.sh b/bin/tests/system/tsig/setup.sh
 index 34cc73b..d51ff21 100644
 --- a/bin/tests/system/tsig/setup.sh
@@ -908,5 +926,5 @@ index a6de312..ebcadb1 100644
  update add updated.example. 600 A 10.10.10.1
  update add updated.example. 600 TXT Foo
 -- 
-2.34.1
+2.37.3
 

From 4562ffc7bef9cb6dc38c018dc4ab5fcf0c1183ce Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 12 Sep 2022 10:48:32 +0200
Subject: [PATCH 315/460] Skip problematic netmgr unit tests (#2122010)

Set CI=true only when --with UNITTEST_ALL is not used, which is a
default. Should skip problematic and often failing test in netmgr:

- tcp_recv_two_quota
- tcp_noresponse
---
 bind-9.18-unittest-netmgr-unstable.patch | 34 ++++++++++++++++++++++++
 bind.spec                                |  7 +++++
 2 files changed, 41 insertions(+)
 create mode 100644 bind-9.18-unittest-netmgr-unstable.patch

diff --git a/bind-9.18-unittest-netmgr-unstable.patch b/bind-9.18-unittest-netmgr-unstable.patch
new file mode 100644
index 0000000..ae28158
--- /dev/null
+++ b/bind-9.18-unittest-netmgr-unstable.patch
@@ -0,0 +1,34 @@
+From 586c548f376562ace6f5125ba50a7add6c080069 Mon Sep 17 00:00:00 2001
+From: rpm-build <rpm-build>
+Date: Mon, 12 Sep 2022 10:40:35 +0200
+Subject: [PATCH] Disable two often failing tests
+
+Make those tests skipped in default build, when CI=true environment is
+set.
+---
+ tests/isc/netmgr_test.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tests/isc/netmgr_test.c b/tests/isc/netmgr_test.c
+index 94e4bf7..0cda885 100644
+--- a/tests/isc/netmgr_test.c
++++ b/tests/isc/netmgr_test.c
+@@ -1567,13 +1567,13 @@ stream_half_recv_half_send(void **state __attribute__((unused))) {
+ /* TCP */
+ ISC_RUN_TEST_IMPL(tcp_noop) { stream_noop(state); }
+ 
+-ISC_RUN_TEST_IMPL(tcp_noresponse) { stream_noresponse(state); }
++ISC_RUN_TEST_IMPL(tcp_noresponse) { SKIP_IN_CI; stream_noresponse(state); }
+ 
+ ISC_RUN_TEST_IMPL(tcp_timeout_recovery) { stream_timeout_recovery(state); }
+ 
+ ISC_RUN_TEST_IMPL(tcp_recv_one) { stream_recv_one(state); }
+ 
+-ISC_RUN_TEST_IMPL(tcp_recv_two) { stream_recv_two(state); }
++ISC_RUN_TEST_IMPL(tcp_recv_two) { SKIP_IN_CI; stream_recv_two(state); }
+ 
+ ISC_RUN_TEST_IMPL(tcp_recv_send) {
+ 	SKIP_IN_CI;
+-- 
+2.37.3
+
diff --git a/bind.spec b/bind.spec
index 1840c00..0099d6e 100644
--- a/bind.spec
+++ b/bind.spec
@@ -14,6 +14,8 @@
 %bcond_without GEOIP2
 # Disabled temporarily until kyua is fixed on rawhide, bug #1926779
 %bcond_without UNITTEST
+# Do not set CI environment, include more unit tests, even less stable
+%bcond_with    UNITTEST_ALL
 %bcond_without DNSTAP
 %bcond_without LMDB
 %bcond_without DOC
@@ -102,6 +104,8 @@ Patch22: bind-9.11-fips-tests.patch
 Patch23: bind-9.18-pkcs11-engine-init.patch
 Patch24: bind-9.18-pkcs11-engine-compat-api.patch
 Patch25: bind-9.18-pkcs11-engine-remove-deadcode.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=2122010
+Patch26: bind-9.18-unittest-netmgr-unstable.patch
 
 %{?systemd_ordering}
 Requires:       coreutils
@@ -457,7 +461,9 @@ export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0"
   pushd build
   CPUS=$(lscpu -p=cpu,core | grep -v '^#' | wc -l)
   THREADS="$CPUS"
+%if %{without UNITTEST_ALL}
   export CI=true
+%endif
   if [ "$CPUS" -gt 16 ]; then
     ORIGFILES=$(ulimit -n)
     THREADS=16
@@ -950,6 +956,7 @@ fi;
 %changelog
 * Tue Sep 06 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.6-3
 - Return OpenSSL engine implementation for pkcs11 interface (#2122841)
+- Skip problematic netmgr unit tests (#2122010)
 
 * Thu Sep 01 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.6-2
 - Always show error details for failed unittests (#2122010)

From cb7d24f2e5b865028c653bc9b3d9dc4c1e9fb9f0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 13 Sep 2022 12:54:19 +0200
Subject: [PATCH 316/460] Properly obsolete bind-dnssec-doc

Last version installed can be 9.18.4-1, which still provides dnssec-doc
subpackage. Make it more specific to obsolete even that version and
allow smooth upgrade.
---
 bind.spec | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index 0099d6e..fb6250c 100644
--- a/bind.spec
+++ b/bind.spec
@@ -222,7 +222,7 @@ Summary: DNSSEC keys and zones management utilities
 Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
 Recommends: %{name}-utils
 Obsoletes: python3-%{name} < 32:9.18.0
-Obsoletes: %{name}-dnssec-doc < 32:9.18.4
+Obsoletes: %{name}-dnssec-doc < 32:9.18.4-2
 %upname_compat %{upname}-dnssec-utils
 
 %description dnssec-utils
@@ -957,6 +957,7 @@ fi;
 * Tue Sep 06 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.6-3
 - Return OpenSSL engine implementation for pkcs11 interface (#2122841)
 - Skip problematic netmgr unit tests (#2122010)
+- Properly obsolete bind-dnssec-doc
 
 * Thu Sep 01 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.6-2
 - Always show error details for failed unittests (#2122010)

From 24465000af0698b88291a4c3dbb45a3da4ef3d49 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 14 Sep 2022 13:08:31 +0200
Subject: [PATCH 317/460] Disable more test cases in netmgr_test (#2122010)

---
 bind-9.18-unittest-netmgr-unstable.patch | 59 ++++++++++++++++++++----
 bind.spec                                |  5 +-
 2 files changed, 54 insertions(+), 10 deletions(-)

diff --git a/bind-9.18-unittest-netmgr-unstable.patch b/bind-9.18-unittest-netmgr-unstable.patch
index ae28158..992758d 100644
--- a/bind-9.18-unittest-netmgr-unstable.patch
+++ b/bind-9.18-unittest-netmgr-unstable.patch
@@ -1,16 +1,17 @@
-From 586c548f376562ace6f5125ba50a7add6c080069 Mon Sep 17 00:00:00 2001
-From: rpm-build <rpm-build>
-Date: Mon, 12 Sep 2022 10:40:35 +0200
-Subject: [PATCH] Disable two often failing tests
+From 0f3a398fe813189c5dd56b0367a72c7b3f19504b Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Wed, 14 Sep 2022 13:06:24 +0200
+Subject: [PATCH] Disable some often failing tests
 
 Make those tests skipped in default build, when CI=true environment is
-set.
+set. It is not clear why they fail mostly on COPR, but they do fail
+often.
 ---
- tests/isc/netmgr_test.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
+ tests/isc/netmgr_test.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
 
 diff --git a/tests/isc/netmgr_test.c b/tests/isc/netmgr_test.c
-index 94e4bf7..0cda885 100644
+index 94e4bf7..7f9629c 100644
 --- a/tests/isc/netmgr_test.c
 +++ b/tests/isc/netmgr_test.c
 @@ -1567,13 +1567,13 @@ stream_half_recv_half_send(void **state __attribute__((unused))) {
@@ -29,6 +30,46 @@ index 94e4bf7..0cda885 100644
  
  ISC_RUN_TEST_IMPL(tcp_recv_send) {
  	SKIP_IN_CI;
+@@ -1623,6 +1623,7 @@ ISC_RUN_TEST_IMPL(tcp_recv_one_quota) {
+ }
+ 
+ ISC_RUN_TEST_IMPL(tcp_recv_two_quota) {
++	SKIP_IN_CI;
+ 	atomic_store(&check_listener_quota, true);
+ 	stream_recv_two(state);
+ }
+@@ -1836,6 +1837,7 @@ ISC_RUN_TEST_IMPL(tcpdns_recv_two) {
+ 	isc_result_t result = ISC_R_SUCCESS;
+ 	isc_nmsocket_t *listen_sock = NULL;
+ 
++	SKIP_IN_CI;
+ 	atomic_store(&nsends, 2);
+ 
+ 	result = isc_nm_listentcpdns(listen_nm, &tcp_listen_addr,
+@@ -2095,6 +2097,7 @@ ISC_RUN_TEST_IMPL(tls_recv_one) {
+ }
+ 
+ ISC_RUN_TEST_IMPL(tls_recv_two) {
++	SKIP_IN_CI;
+ 	stream_use_TLS = true;
+ 	stream_recv_two(state);
+ }
+@@ -2160,6 +2163,7 @@ ISC_RUN_TEST_IMPL(tls_recv_one_quota) {
+ }
+ 
+ ISC_RUN_TEST_IMPL(tls_recv_two_quota) {
++	SKIP_IN_CI;
+ 	stream_use_TLS = true;
+ 	atomic_store(&check_listener_quota, true);
+ 	stream_recv_two(state);
+@@ -2395,6 +2399,7 @@ ISC_RUN_TEST_IMPL(tlsdns_recv_two) {
+ 	isc_result_t result = ISC_R_SUCCESS;
+ 	isc_nmsocket_t *listen_sock = NULL;
+ 
++	SKIP_IN_CI;
+ 	atomic_store(&nsends, 2);
+ 
+ 	result = isc_nm_listentlsdns(listen_nm, &tcp_listen_addr,
 -- 
-2.37.3
+2.37.2
 
diff --git a/bind.spec b/bind.spec
index fb6250c..cc93e82 100644
--- a/bind.spec
+++ b/bind.spec
@@ -63,7 +63,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.18.6
-Release:  3%{?dist}
+Release:  4%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -954,6 +954,9 @@ fi;
 %endif
 
 %changelog
+* Wed Sep 14 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.6-4
+- Disable yet another test (##2122010)
+
 * Tue Sep 06 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.6-3
 - Return OpenSSL engine implementation for pkcs11 interface (#2122841)
 - Skip problematic netmgr unit tests (#2122010)

From bbdbcbc779b779b787a14376538694b12cee6db2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 21 Sep 2022 14:33:11 +0200
Subject: [PATCH 318/460] Update to 9.18.7 (#2128609)

https://downloads.isc.org/isc/bind9/9.18.7/doc/arm/html/notes.html#notes-for-bind-9-18-7
---
 .gitignore                               |   2 +
 bind-9.11-fips-tests.patch               |  64 +++++--------
 bind-9.18-pkcs11-engine-compat-api.patch | 114 ++++++++++++-----------
 bind.spec                                |   7 +-
 sources                                  |   4 +-
 5 files changed, 89 insertions(+), 102 deletions(-)

diff --git a/.gitignore b/.gitignore
index 2e6cd23..c6e3afe 100644
--- a/.gitignore
+++ b/.gitignore
@@ -190,3 +190,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.18.5.tar.xz.asc
 /bind-9.18.6.tar.xz
 /bind-9.18.6.tar.xz.asc
+/bind-9.18.7.tar.xz
+/bind-9.18.7.tar.xz.asc
diff --git a/bind-9.11-fips-tests.patch b/bind-9.11-fips-tests.patch
index ea38410..415a87a 100644
--- a/bind-9.11-fips-tests.patch
+++ b/bind-9.11-fips-tests.patch
@@ -1,4 +1,4 @@
-From 09030b066846a9b7252b5cb4f483d4a55b4639fc Mon Sep 17 00:00:00 2001
+From b1e27453fadcf8ce453beed5b896ad995dfb5534 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 2 Aug 2018 23:46:45 +0200
 Subject: [PATCH] FIPS tests changes
@@ -81,20 +81,18 @@ Date:   Wed Mar 7 10:44:23 2018 +0100
  bin/tests/system/nsupdate/ns1/named.conf.in   |  2 +-
  bin/tests/system/nsupdate/ns2/named.conf.in   |  2 +-
  bin/tests/system/nsupdate/setup.sh            |  6 +-
- bin/tests/system/nsupdate/tests.sh            | 11 ++-
+ bin/tests/system/nsupdate/tests.sh            |  9 ++-
  bin/tests/system/rndc/setup.sh                |  2 +-
  bin/tests/system/rndc/tests.sh                | 22 +++---
  bin/tests/system/tsig/ns1/named.conf.in       | 10 +--
- bin/tests/system/tsig/ns1/rndc5.conf.in       | 10 +++
  bin/tests/system/tsig/setup.sh                |  5 ++
  bin/tests/system/tsig/tests.sh                | 67 ++++++++++++-------
  bin/tests/system/upforwd/ns1/named.conf.in    |  2 +-
  bin/tests/system/upforwd/tests.sh             |  2 +-
- 32 files changed, 159 insertions(+), 106 deletions(-)
- create mode 100644 bin/tests/system/tsig/ns1/rndc5.conf.in
+ 31 files changed, 147 insertions(+), 106 deletions(-)
 
 diff --git a/bin/tests/system/acl/ns2/named1.conf.in b/bin/tests/system/acl/ns2/named1.conf.in
-index 745048a..93cb411 100644
+index 8787c6a..b781d0b 100644
 --- a/bin/tests/system/acl/ns2/named1.conf.in
 +++ b/bin/tests/system/acl/ns2/named1.conf.in
 @@ -35,12 +35,12 @@ options {
@@ -113,7 +111,7 @@ index 745048a..93cb411 100644
  };
  
 diff --git a/bin/tests/system/acl/ns2/named2.conf.in b/bin/tests/system/acl/ns2/named2.conf.in
-index 21aa991..78e71cc 100644
+index a95b4c1..3f3f471 100644
 --- a/bin/tests/system/acl/ns2/named2.conf.in
 +++ b/bin/tests/system/acl/ns2/named2.conf.in
 @@ -35,12 +35,12 @@ options {
@@ -132,7 +130,7 @@ index 21aa991..78e71cc 100644
  };
  
 diff --git a/bin/tests/system/acl/ns2/named3.conf.in b/bin/tests/system/acl/ns2/named3.conf.in
-index 3208c92..bed6325 100644
+index 14cc3fe..9507706 100644
 --- a/bin/tests/system/acl/ns2/named3.conf.in
 +++ b/bin/tests/system/acl/ns2/named3.conf.in
 @@ -35,17 +35,17 @@ options {
@@ -157,7 +155,7 @@ index 3208c92..bed6325 100644
  };
  
 diff --git a/bin/tests/system/acl/ns2/named4.conf.in b/bin/tests/system/acl/ns2/named4.conf.in
-index 14e82ed..a22cafe 100644
+index 77cf110..029c91b 100644
 --- a/bin/tests/system/acl/ns2/named4.conf.in
 +++ b/bin/tests/system/acl/ns2/named4.conf.in
 @@ -35,12 +35,12 @@ options {
@@ -176,7 +174,7 @@ index 14e82ed..a22cafe 100644
  };
  
 diff --git a/bin/tests/system/acl/ns2/named5.conf.in b/bin/tests/system/acl/ns2/named5.conf.in
-index f43f33c..f4a865a 100644
+index 5ccabf9..6154797 100644
 --- a/bin/tests/system/acl/ns2/named5.conf.in
 +++ b/bin/tests/system/acl/ns2/named5.conf.in
 @@ -37,12 +37,12 @@ options {
@@ -539,10 +537,10 @@ index 4af25b0..9f202d5 100644
  };
  
 diff --git a/bin/tests/system/checkconf/good.conf b/bin/tests/system/checkconf/good.conf
-index 897dc86..e4b6dc1 100644
+index 154bf75..e7a05cd 100644
 --- a/bin/tests/system/checkconf/good.conf
 +++ b/bin/tests/system/checkconf/good.conf
-@@ -270,6 +270,6 @@ dyndb "name" "library.so" {
+@@ -283,6 +283,6 @@ dyndb "name" "library.so" {
  	system;
  };
  key "mykey" {
@@ -608,7 +606,7 @@ index 5cab276..d4a7bf3 100644
  };
  
 diff --git a/bin/tests/system/notify/tests.sh b/bin/tests/system/notify/tests.sh
-index 04fd34b..e5476ea 100644
+index 95158a4..9b9aa0a 100644
 --- a/bin/tests/system/notify/tests.sh
 +++ b/bin/tests/system/notify/tests.sh
 @@ -179,7 +179,7 @@ test_start "checking notify to multiple views using tsig"
@@ -633,7 +631,7 @@ index 04fd34b..e5476ea 100644
  	grep "test string" "$fnb" > /dev/null &&
  	grep "test string" "$fnc" > /dev/null &&
 diff --git a/bin/tests/system/nsupdate/ns1/named.conf.in b/bin/tests/system/nsupdate/ns1/named.conf.in
-index 81d0c99..effbe2e 100644
+index 2b67360..a734584 100644
 --- a/bin/tests/system/nsupdate/ns1/named.conf.in
 +++ b/bin/tests/system/nsupdate/ns1/named.conf.in
 @@ -39,7 +39,7 @@ controls {
@@ -646,7 +644,7 @@ index 81d0c99..effbe2e 100644
  };
  
 diff --git a/bin/tests/system/nsupdate/ns2/named.conf.in b/bin/tests/system/nsupdate/ns2/named.conf.in
-index f1a1735..da2b3d1 100644
+index c85eef5..428b6b1 100644
 --- a/bin/tests/system/nsupdate/ns2/named.conf.in
 +++ b/bin/tests/system/nsupdate/ns2/named.conf.in
 @@ -34,7 +34,7 @@ controls {
@@ -676,26 +674,24 @@ index 50056dc..a4a1a3f 100644
  $TSIGKEYGEN -a hmac-sha224 sha224-key > ns1/sha224.key
  $TSIGKEYGEN -a hmac-sha256 sha256-key > ns1/sha256.key
 diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh
-index 0863d0a..559def7 100755
+index 0bb9d00..ecbc0df 100755
 --- a/bin/tests/system/nsupdate/tests.sh
 +++ b/bin/tests/system/nsupdate/tests.sh
-@@ -841,7 +841,14 @@ fi
- n=`expr $n + 1`
+@@ -841,7 +841,12 @@ fi
+ n=$((n + 1))
  ret=0
  echo_i "check TSIG key algorithms (nsupdate -k) ($n)"
 -for alg in md5 sha1 sha224 sha256 sha384 sha512; do
-+if $FEATURETEST --md5
-+then
-+	ALGS="md5 sha1 sha224 sha256 sha384 sha512"
-+else
-+	ALGS="sha1 sha224 sha256 sha384 sha512"
++MD5ALG='md5'
++if ! $FEATURETEST --md5; then
++	MD5ALG=''
 +	echo_i "skipping disabled md5 algorithm"
 +fi
-+for alg in $ALGS; do
++for alg in $MD5ALG sha1 sha224 sha256 sha384 sha512; do
      $NSUPDATE -k ns1/${alg}.key <<END > /dev/null || ret=1
  server 10.53.0.1 ${PORT}
  update add ${alg}.keytests.nil. 600 A 10.10.10.3
-@@ -849,7 +856,7 @@ send
+@@ -849,7 +854,7 @@ send
  END
  done
  sleep 2
@@ -718,7 +714,7 @@ index 4dd6fa7..1b79263 100644
  make_key 3 ${EXTRAPORT3} hmac-sha224
  make_key 4 ${EXTRAPORT4} hmac-sha256
 diff --git a/bin/tests/system/rndc/tests.sh b/bin/tests/system/rndc/tests.sh
-index e678153..e7ec855 100644
+index a66ca15..6ebf78c 100644
 --- a/bin/tests/system/rndc/tests.sh
 +++ b/bin/tests/system/rndc/tests.sh
 @@ -350,15 +350,19 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -778,22 +774,6 @@ index 76cf970..22637af 100644
  
  key "sha1-trunc" {
  	secret "FrSt77yPTFx6hTs4i2tKLB9LmE0=";
-diff --git a/bin/tests/system/tsig/ns1/rndc5.conf.in b/bin/tests/system/tsig/ns1/rndc5.conf.in
-new file mode 100644
-index 0000000..0682194
---- /dev/null
-+++ b/bin/tests/system/tsig/ns1/rndc5.conf.in
-@@ -0,0 +1,10 @@
-+# Conditionally included when support for MD5 is available
-+key "md5" {
-+	secret "97rnFx24Tfna4mHPfgnerA==";
-+	algorithm hmac-md5;
-+};
-+
-+key "md5-trunc" {
-+	secret "97rnFx24Tfna4mHPfgnerA==";
-+	algorithm hmac-md5-80;
-+};
 diff --git a/bin/tests/system/tsig/setup.sh b/bin/tests/system/tsig/setup.sh
 index 34cc73b..d51ff21 100644
 --- a/bin/tests/system/tsig/setup.sh
diff --git a/bind-9.18-pkcs11-engine-compat-api.patch b/bind-9.18-pkcs11-engine-compat-api.patch
index 32126f4..678d199 100644
--- a/bind-9.18-pkcs11-engine-compat-api.patch
+++ b/bind-9.18-pkcs11-engine-compat-api.patch
@@ -1,7 +1,7 @@
-From 561356ec1d46abb939e4eed10ee2c9e639eb88db Mon Sep 17 00:00:00 2001
+From 1ecf072a6a556aa386003d1d5b83fe172320e7ed Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 8 Sep 2022 17:19:20 +0200
-Subject: [PATCH 2/3] Do not use OSSL_PARAM when engine API is compiled
+Subject: [PATCH] Do not use OSSL_PARAM when engine API is compiled
 
 OpenSSL has deprecated many things in version 3.0. If pkcs11 engine
 should work then no builder from OpenSSL 3.0 API can be used.
@@ -16,7 +16,7 @@ working keys loading from the engine passed on command line.
  3 files changed, 189 insertions(+), 184 deletions(-)
 
 diff --git a/lib/dns/openssldh_link.c b/lib/dns/openssldh_link.c
-index d5dbc2e889..96c1d523b7 100644
+index 1a01c2b..7df483f 100644
 --- a/lib/dns/openssldh_link.c
 +++ b/lib/dns/openssldh_link.c
 @@ -91,7 +91,7 @@ static BIGNUM *bn2 = NULL, *bn768 = NULL, *bn1024 = NULL, *bn1536 = NULL;
@@ -68,16 +68,16 @@ index d5dbc2e889..96c1d523b7 100644
  
  	isc_buffer_add(secret, (unsigned int)secret_len);
  
-@@ -165,7 +165,7 @@ openssldh_computesecret(const dst_key_t *pub, const dst_key_t *priv,
- 
+@@ -166,7 +166,7 @@ openssldh_computesecret(const dst_key_t *pub, const dst_key_t *priv,
  static bool
  openssldh_compare(const dst_key_t *key1, const dst_key_t *key2) {
+ 	bool ret = true;
 -#if OPENSSL_VERSION_NUMBER < 0x30000000L
 +#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
  	DH *dh1, *dh2;
  	const BIGNUM *pub_key1 = NULL, *pub_key2 = NULL;
  	const BIGNUM *priv_key1 = NULL, *priv_key2 = NULL;
-@@ -175,9 +175,9 @@ openssldh_compare(const dst_key_t *key1, const dst_key_t *key2) {
+@@ -176,9 +176,9 @@ openssldh_compare(const dst_key_t *key1, const dst_key_t *key2) {
  	BIGNUM *pub_key1 = NULL, *pub_key2 = NULL;
  	BIGNUM *priv_key1 = NULL, *priv_key2 = NULL;
  	BIGNUM *p1 = NULL, *g1 = NULL, *p2 = NULL, *g2 = NULL;
@@ -89,7 +89,7 @@ index d5dbc2e889..96c1d523b7 100644
  	dh1 = key1->keydata.dh;
  	dh2 = key2->keydata.dh;
  
-@@ -209,7 +209,7 @@ openssldh_compare(const dst_key_t *key1, const dst_key_t *key2) {
+@@ -210,7 +210,7 @@ openssldh_compare(const dst_key_t *key1, const dst_key_t *key2) {
  	EVP_PKEY_get_bn_param(pkey2, OSSL_PKEY_PARAM_PUB_KEY, &pub_key2);
  	EVP_PKEY_get_bn_param(pkey1, OSSL_PKEY_PARAM_PRIV_KEY, &priv_key1);
  	EVP_PKEY_get_bn_param(pkey2, OSSL_PKEY_PARAM_PRIV_KEY, &priv_key2);
@@ -99,15 +99,15 @@ index d5dbc2e889..96c1d523b7 100644
  	if (BN_cmp(p1, p2) != 0 || BN_cmp(g1, g2) != 0 ||
  	    BN_cmp(pub_key1, pub_key2) != 0)
 @@ -226,7 +226,7 @@ openssldh_compare(const dst_key_t *key1, const dst_key_t *key2) {
- 		}
  	}
  
+ err:
 -#if OPENSSL_VERSION_NUMBER >= 0x30000000L
 +#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
  	if (p1 != NULL) {
  		BN_free(p1);
  	}
-@@ -251,22 +251,23 @@ openssldh_compare(const dst_key_t *key1, const dst_key_t *key2) {
+@@ -251,7 +251,8 @@ err:
  	if (priv_key2 != NULL) {
  		BN_clear_free(priv_key2);
  	}
@@ -115,11 +115,12 @@ index d5dbc2e889..96c1d523b7 100644
 +#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000 \
 +	*/
  
- 	return (true);
+ 	return (ret);
  }
- 
+@@ -259,15 +260,15 @@ err:
  static bool
  openssldh_paramcompare(const dst_key_t *key1, const dst_key_t *key2) {
+ 	bool ret = true;
 -#if OPENSSL_VERSION_NUMBER < 0x30000000L
 +#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
  	DH *dh1, *dh2;
@@ -135,7 +136,7 @@ index d5dbc2e889..96c1d523b7 100644
  	dh1 = key1->keydata.dh;
  	dh2 = key2->keydata.dh;
  
-@@ -292,13 +293,13 @@ openssldh_paramcompare(const dst_key_t *key1, const dst_key_t *key2) {
+@@ -293,14 +294,14 @@ openssldh_paramcompare(const dst_key_t *key1, const dst_key_t *key2) {
  	EVP_PKEY_get_bn_param(pkey2, OSSL_PKEY_PARAM_FFC_P, &p2);
  	EVP_PKEY_get_bn_param(pkey1, OSSL_PKEY_PARAM_FFC_G, &g1);
  	EVP_PKEY_get_bn_param(pkey2, OSSL_PKEY_PARAM_FFC_G, &g2);
@@ -143,15 +144,16 @@ index d5dbc2e889..96c1d523b7 100644
 +#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
  
  	if (BN_cmp(p1, p2) != 0 || BN_cmp(g1, g2) != 0) {
- 		return (false);
+ 		DST_RET(false);
  	}
  
+ err:
 -#if OPENSSL_VERSION_NUMBER >= 0x30000000L
 +#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
  	if (p1 != NULL) {
  		BN_free(p1);
  	}
-@@ -311,12 +312,13 @@ openssldh_paramcompare(const dst_key_t *key1, const dst_key_t *key2) {
+@@ -313,12 +314,13 @@ err:
  	if (g2 != NULL) {
  		BN_free(g2);
  	}
@@ -159,7 +161,7 @@ index d5dbc2e889..96c1d523b7 100644
 +#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000 \
 +	*/
  
- 	return (true);
+ 	return (ret);
  }
  
 -#if OPENSSL_VERSION_NUMBER < 0x30000000L
@@ -167,7 +169,7 @@ index d5dbc2e889..96c1d523b7 100644
  static int
  progress_cb(int p, int n, BN_GENCB *cb) {
  	union {
-@@ -347,7 +349,7 @@ progress_cb(EVP_PKEY_CTX *ctx) {
+@@ -349,7 +351,7 @@ progress_cb(EVP_PKEY_CTX *ctx) {
  	}
  	return (1);
  }
@@ -176,7 +178,7 @@ index d5dbc2e889..96c1d523b7 100644
  
  static isc_result_t
  openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) {
-@@ -357,7 +359,7 @@ openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) {
+@@ -359,7 +361,7 @@ openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) {
  		void (*fptr)(int);
  	} u;
  	BIGNUM *p = NULL, *g = NULL;
@@ -185,7 +187,7 @@ index d5dbc2e889..96c1d523b7 100644
  	DH *dh = NULL;
  	BN_GENCB *cb = NULL;
  #if !HAVE_BN_GENCB_NEW
-@@ -370,9 +372,9 @@ openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) {
+@@ -372,9 +374,9 @@ openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) {
  	EVP_PKEY_CTX *ctx = NULL;
  	EVP_PKEY *param_pkey = NULL;
  	EVP_PKEY *pkey = NULL;
@@ -197,7 +199,7 @@ index d5dbc2e889..96c1d523b7 100644
  	dh = DH_new();
  	if (dh == NULL) {
  		DST_RET(dst__openssl_toresult(ISC_R_NOMEMORY));
-@@ -386,7 +388,7 @@ openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) {
+@@ -388,7 +390,7 @@ openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) {
  	if (param_ctx == NULL) {
  		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
  	}
@@ -206,7 +208,7 @@ index d5dbc2e889..96c1d523b7 100644
  
  	if (generator == 0) {
  		/*
-@@ -406,7 +408,7 @@ openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) {
+@@ -408,7 +410,7 @@ openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) {
  			if (p == NULL || g == NULL) {
  				DST_RET(dst__openssl_toresult(ISC_R_NOMEMORY));
  			}
@@ -215,7 +217,7 @@ index d5dbc2e889..96c1d523b7 100644
  			if (DH_set0_pqg(dh, p, NULL, g) != 1) {
  				DST_RET(dst__openssl_toresult2(
  					"DH_set0_pqg", DST_R_OPENSSLFAILURE));
-@@ -430,7 +432,7 @@ openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) {
+@@ -432,7 +434,7 @@ openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) {
  					DST_R_OPENSSLFAILURE));
  			}
  			params = OSSL_PARAM_BLD_to_param(bld);
@@ -224,7 +226,7 @@ index d5dbc2e889..96c1d523b7 100644
  
  		} else {
  			/*
-@@ -443,7 +445,7 @@ openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) {
+@@ -445,7 +447,7 @@ openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) {
  	}
  
  	if (generator != 0) {
@@ -233,7 +235,7 @@ index d5dbc2e889..96c1d523b7 100644
  		cb = BN_GENCB_new();
  #if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
  		if (cb == NULL) {
-@@ -486,10 +488,10 @@ openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) {
+@@ -488,10 +490,10 @@ openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) {
  						       DST_R_OPENSSLFAILURE));
  		}
  		params = OSSL_PARAM_BLD_to_param(bld);
@@ -246,7 +248,7 @@ index d5dbc2e889..96c1d523b7 100644
  	if (DH_generate_key(dh) == 0) {
  		DST_RET(dst__openssl_toresult2("DH_generate_key",
  					       DST_R_OPENSSLFAILURE));
-@@ -557,12 +559,12 @@ openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) {
+@@ -559,12 +561,12 @@ openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) {
  
  	key->keydata.pkey = pkey;
  	pkey = NULL;
@@ -261,7 +263,7 @@ index d5dbc2e889..96c1d523b7 100644
  	if (dh != NULL) {
  		DH_free(dh);
  	}
-@@ -594,14 +596,14 @@ err:
+@@ -596,14 +598,14 @@ err:
  	if (g != NULL) {
  		BN_free(g);
  	}
@@ -278,7 +280,7 @@ index d5dbc2e889..96c1d523b7 100644
  	DH *dh = key->keydata.dh;
  	const BIGNUM *priv_key = NULL;
  
-@@ -626,12 +628,12 @@ openssldh_isprivate(const dst_key_t *key) {
+@@ -628,12 +630,12 @@ openssldh_isprivate(const dst_key_t *key) {
  	}
  
  	return (ret);
@@ -293,7 +295,7 @@ index d5dbc2e889..96c1d523b7 100644
  	DH *dh = key->keydata.dh;
  
  	if (dh == NULL) {
-@@ -649,7 +651,7 @@ openssldh_destroy(dst_key_t *key) {
+@@ -651,7 +653,7 @@ openssldh_destroy(dst_key_t *key) {
  
  	EVP_PKEY_free(pkey);
  	key->keydata.pkey = NULL;
@@ -302,10 +304,10 @@ index d5dbc2e889..96c1d523b7 100644
  }
  
  static void
-@@ -675,17 +677,17 @@ uint16_fromregion(isc_region_t *region) {
- 
+@@ -678,17 +680,17 @@ uint16_fromregion(isc_region_t *region) {
  static isc_result_t
  openssldh_todns(const dst_key_t *key, isc_buffer_t *data) {
+ 	isc_result_t ret = ISC_R_SUCCESS;
 -#if OPENSSL_VERSION_NUMBER < 0x30000000L
 +#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
  	DH *dh;
@@ -323,7 +325,7 @@ index d5dbc2e889..96c1d523b7 100644
  	REQUIRE(key->keydata.dh != NULL);
  
  	dh = key->keydata.dh;
-@@ -698,7 +700,7 @@ openssldh_todns(const dst_key_t *key, isc_buffer_t *data) {
+@@ -701,7 +703,7 @@ openssldh_todns(const dst_key_t *key, isc_buffer_t *data) {
  	EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_FFC_P, &p);
  	EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_FFC_G, &g);
  	EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_PUB_KEY, &pub_key);
@@ -332,16 +334,16 @@ index d5dbc2e889..96c1d523b7 100644
  
  	isc_buffer_availableregion(data, &r);
  
-@@ -745,7 +747,7 @@ openssldh_todns(const dst_key_t *key, isc_buffer_t *data) {
- 
+@@ -749,7 +751,7 @@ openssldh_todns(const dst_key_t *key, isc_buffer_t *data) {
  	isc_buffer_add(data, dnslen);
  
+ err:
 -#if OPENSSL_VERSION_NUMBER >= 0x30000000L
 +#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
  	if (p != NULL) {
  		BN_free(p);
  	}
-@@ -755,7 +757,8 @@ openssldh_todns(const dst_key_t *key, isc_buffer_t *data) {
+@@ -759,7 +761,8 @@ err:
  	if (pub_key != NULL) {
  		BN_free(pub_key);
  	}
@@ -349,9 +351,9 @@ index d5dbc2e889..96c1d523b7 100644
 +#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000 \
 +	*/
  
- 	return (ISC_R_SUCCESS);
+ 	return (ret);
  }
-@@ -763,14 +766,14 @@ openssldh_todns(const dst_key_t *key, isc_buffer_t *data) {
+@@ -767,14 +770,14 @@ err:
  static isc_result_t
  openssldh_fromdns(dst_key_t *key, isc_buffer_t *data) {
  	isc_result_t ret;
@@ -368,7 +370,7 @@ index d5dbc2e889..96c1d523b7 100644
  	BIGNUM *pub_key = NULL, *p = NULL, *g = NULL;
  	int key_size;
  	isc_region_t r;
-@@ -782,7 +785,7 @@ openssldh_fromdns(dst_key_t *key, isc_buffer_t *data) {
+@@ -786,7 +789,7 @@ openssldh_fromdns(dst_key_t *key, isc_buffer_t *data) {
  		return (ISC_R_SUCCESS);
  	}
  
@@ -377,7 +379,7 @@ index d5dbc2e889..96c1d523b7 100644
  	dh = DH_new();
  	if (dh == NULL) {
  		DST_RET(dst__openssl_toresult(ISC_R_NOMEMORY));
-@@ -797,7 +800,7 @@ openssldh_fromdns(dst_key_t *key, isc_buffer_t *data) {
+@@ -801,7 +804,7 @@ openssldh_fromdns(dst_key_t *key, isc_buffer_t *data) {
  	if (ctx == NULL) {
  		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
  	}
@@ -386,7 +388,7 @@ index d5dbc2e889..96c1d523b7 100644
  
  	/*
  	 * Read the prime length.  1 & 2 are table entries, > 16 means a
-@@ -873,7 +876,7 @@ openssldh_fromdns(dst_key_t *key, isc_buffer_t *data) {
+@@ -877,7 +880,7 @@ openssldh_fromdns(dst_key_t *key, isc_buffer_t *data) {
  
  	key_size = BN_num_bits(p);
  
@@ -395,7 +397,7 @@ index d5dbc2e889..96c1d523b7 100644
  	if (DH_set0_pqg(dh, p, NULL, g) != 1) {
  		DST_RET(dst__openssl_toresult2("DH_set0_pqg",
  					       DST_R_OPENSSLFAILURE));
-@@ -889,7 +892,7 @@ openssldh_fromdns(dst_key_t *key, isc_buffer_t *data) {
+@@ -893,7 +896,7 @@ openssldh_fromdns(dst_key_t *key, isc_buffer_t *data) {
  		DST_RET(dst__openssl_toresult2("OSSL_PARAM_BLD_push_BN",
  					       DST_R_OPENSSLFAILURE));
  	}
@@ -404,7 +406,7 @@ index d5dbc2e889..96c1d523b7 100644
  
  	if (r.length < 2) {
  		DST_RET(DST_R_INVALIDPUBLICKEY);
-@@ -907,7 +910,7 @@ openssldh_fromdns(dst_key_t *key, isc_buffer_t *data) {
+@@ -911,7 +914,7 @@ openssldh_fromdns(dst_key_t *key, isc_buffer_t *data) {
  
  	isc_buffer_forward(data, plen + glen + publen + 6);
  
@@ -413,7 +415,7 @@ index d5dbc2e889..96c1d523b7 100644
  #if (LIBRESSL_VERSION_NUMBER >= 0x2070000fL) && \
  	(LIBRESSL_VERSION_NUMBER <= 0x2070200fL)
  	/*
-@@ -951,14 +954,14 @@ openssldh_fromdns(dst_key_t *key, isc_buffer_t *data) {
+@@ -955,14 +958,14 @@ openssldh_fromdns(dst_key_t *key, isc_buffer_t *data) {
  
  	key->keydata.pkey = pkey;
  	pkey = NULL;
@@ -430,7 +432,7 @@ index d5dbc2e889..96c1d523b7 100644
  	if (dh != NULL) {
  		DH_free(dh);
  	}
-@@ -975,7 +978,7 @@ err:
+@@ -979,7 +982,7 @@ err:
  	if (bld != NULL) {
  		OSSL_PARAM_BLD_free(bld);
  	}
@@ -439,7 +441,7 @@ index d5dbc2e889..96c1d523b7 100644
  	if (p != NULL) {
  		BN_free(p);
  	}
-@@ -991,13 +994,13 @@ err:
+@@ -995,13 +998,13 @@ err:
  
  static isc_result_t
  openssldh_tofile(const dst_key_t *key, const char *directory) {
@@ -455,7 +457,7 @@ index d5dbc2e889..96c1d523b7 100644
  	dst_private_t priv;
  	unsigned char *bufs[4] = { NULL };
  	unsigned short i = 0;
-@@ -1007,7 +1010,7 @@ openssldh_tofile(const dst_key_t *key, const char *directory) {
+@@ -1011,7 +1014,7 @@ openssldh_tofile(const dst_key_t *key, const char *directory) {
  		return (DST_R_EXTERNALKEY);
  	}
  
@@ -464,7 +466,7 @@ index d5dbc2e889..96c1d523b7 100644
  	if (key->keydata.dh == NULL) {
  		return (DST_R_NULLKEY);
  	}
-@@ -1025,7 +1028,7 @@ openssldh_tofile(const dst_key_t *key, const char *directory) {
+@@ -1029,7 +1032,7 @@ openssldh_tofile(const dst_key_t *key, const char *directory) {
  	EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_FFC_G, &g);
  	EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_PUB_KEY, &pub_key);
  	EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_PRIV_KEY, &priv_key);
@@ -473,7 +475,7 @@ index d5dbc2e889..96c1d523b7 100644
  
  	priv.elements[i].tag = TAG_DH_PRIME;
  	priv.elements[i].length = BN_num_bytes(p);
-@@ -1065,7 +1068,7 @@ openssldh_tofile(const dst_key_t *key, const char *directory) {
+@@ -1069,7 +1072,7 @@ openssldh_tofile(const dst_key_t *key, const char *directory) {
  		}
  	}
  
@@ -482,7 +484,7 @@ index d5dbc2e889..96c1d523b7 100644
  	if (p != NULL) {
  		BN_free(p);
  	}
-@@ -1078,7 +1081,8 @@ openssldh_tofile(const dst_key_t *key, const char *directory) {
+@@ -1082,7 +1085,8 @@ openssldh_tofile(const dst_key_t *key, const char *directory) {
  	if (priv_key != NULL) {
  		BN_clear_free(priv_key);
  	}
@@ -492,7 +494,7 @@ index d5dbc2e889..96c1d523b7 100644
  
  	return (result);
  }
-@@ -1088,14 +1092,14 @@ openssldh_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
+@@ -1092,14 +1096,14 @@ openssldh_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
  	dst_private_t priv;
  	isc_result_t ret;
  	int i;
@@ -509,7 +511,7 @@ index d5dbc2e889..96c1d523b7 100644
  	BIGNUM *pub_key = NULL, *priv_key = NULL, *p = NULL, *g = NULL;
  	int key_size = 0;
  	isc_mem_t *mctx;
-@@ -1113,7 +1117,7 @@ openssldh_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
+@@ -1117,7 +1121,7 @@ openssldh_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
  		DST_RET(DST_R_EXTERNALKEY);
  	}
  
@@ -518,7 +520,7 @@ index d5dbc2e889..96c1d523b7 100644
  	dh = DH_new();
  	if (dh == NULL) {
  		DST_RET(ISC_R_NOMEMORY);
-@@ -1128,7 +1132,7 @@ openssldh_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
+@@ -1132,7 +1136,7 @@ openssldh_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
  	if (ctx == NULL) {
  		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
  	}
@@ -527,7 +529,7 @@ index d5dbc2e889..96c1d523b7 100644
  
  	for (i = 0; i < priv.nelements; i++) {
  		BIGNUM *bn;
-@@ -1155,7 +1159,7 @@ openssldh_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
+@@ -1159,7 +1163,7 @@ openssldh_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
  		}
  	}
  
@@ -536,7 +538,7 @@ index d5dbc2e889..96c1d523b7 100644
  	if (DH_set0_key(dh, pub_key, priv_key) != 1) {
  		DST_RET(dst__openssl_toresult2("DH_set0_key",
  					       DST_R_OPENSSLFAILURE));
-@@ -1202,13 +1206,13 @@ openssldh_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
+@@ -1206,13 +1210,13 @@ openssldh_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
  
  	key->keydata.pkey = pkey;
  	pkey = NULL;
@@ -552,7 +554,7 @@ index d5dbc2e889..96c1d523b7 100644
  	if (dh != NULL) {
  		DH_free(dh);
  	}
-@@ -1225,7 +1229,7 @@ err:
+@@ -1229,7 +1233,7 @@ err:
  	if (bld != NULL) {
  		OSSL_PARAM_BLD_free(bld);
  	}
@@ -562,7 +564,7 @@ index d5dbc2e889..96c1d523b7 100644
  		BN_free(p);
  	}
 diff --git a/lib/dns/opensslecdsa_link.c b/lib/dns/opensslecdsa_link.c
-index 519e88b7e7..04f0d80b5e 100644
+index 519e88b..04f0d80 100644
 --- a/lib/dns/opensslecdsa_link.c
 +++ b/lib/dns/opensslecdsa_link.c
 @@ -17,14 +17,14 @@
@@ -1045,7 +1047,7 @@ index 519e88b7e7..04f0d80b5e 100644
  		key->keydata.generic = NULL;
  	}
 diff --git a/lib/dns/opensslrsa_link.c b/lib/dns/opensslrsa_link.c
-index fc905b7d60..867b486a2f 100644
+index fc905b7..867b486 100644
 --- a/lib/dns/opensslrsa_link.c
 +++ b/lib/dns/opensslrsa_link.c
 @@ -18,7 +18,7 @@
@@ -1550,5 +1552,5 @@ index fc905b7d60..867b486a2f 100644
  		RSA_free(rsa);
  	}
 -- 
-2.37.2
+2.37.3
 
diff --git a/bind.spec b/bind.spec
index cc93e82..178f2b9 100644
--- a/bind.spec
+++ b/bind.spec
@@ -62,8 +62,8 @@ Conflicts: %1 \
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.18.6
-Release:  4%{?dist}
+Version:  9.18.7
+Release:  1%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -954,6 +954,9 @@ fi;
 %endif
 
 %changelog
+* Wed Sep 21 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.7-1
+- Update to 9.18.7 (#2128609)
+
 * Wed Sep 14 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.6-4
 - Disable yet another test (##2122010)
 
diff --git a/sources b/sources
index 9d5923f..25459e0 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.18.6.tar.xz) = 6b31eb56cf25b2cb1d8af0f76f9cac0e0985c78cbe3ba80164d773cb0bf77116dd98b5c4b84e3c74fd35b5da501ee6ba2dc0fae12267104edde2cb2daa1e1ba7
-SHA512 (bind-9.18.6.tar.xz.asc) = 13629b56acb02ca1fe861e6a17e949fee276de83624d972174893e48cc5de650a2a0081262e5e0d6913360861e2c91fed6b808ed8ae702e5cb2e2380eacf163b
+SHA512 (bind-9.18.7.tar.xz) = 2cdceb4125b8759f5225296c6ffecdbb895b0a27dfcfcd98b04b9ad78552d16c16b0452fb823dc47d11cec21d2c6ecb05a107dd3094f8e7419bb9717d68820c5
+SHA512 (bind-9.18.7.tar.xz.asc) = 40030c2259858f1ba7ce4fbcd523025631ed78687ca87863d0f0bcd0fd530d96052e0601808ffa37e59d574a9a9c84bb2ededc66f730b9eaf560a00a6ef29c48

From 5b047433e1e3817e4dbc4a2b3480bd4e97a36d04 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Sat, 24 Sep 2022 19:55:40 +0200
Subject: [PATCH 319/460] Build ARM documentation also with older sphinx on
 RHEL9

---
 bind-9.18-doc-arm-rhel9.patch | 46 +++++++++++++++++++++++++++++++++++
 bind.spec                     |  8 +++++-
 2 files changed, 53 insertions(+), 1 deletion(-)
 create mode 100644 bind-9.18-doc-arm-rhel9.patch

diff --git a/bind-9.18-doc-arm-rhel9.patch b/bind-9.18-doc-arm-rhel9.patch
new file mode 100644
index 0000000..2778e1e
--- /dev/null
+++ b/bind-9.18-doc-arm-rhel9.patch
@@ -0,0 +1,46 @@
+diff --git a/doc/arm/dnssec.inc.rst b/doc/arm/dnssec.inc.rst
+index 0d72000..f4810ae 100644
+--- a/doc/arm/dnssec.inc.rst
++++ b/doc/arm/dnssec.inc.rst
+@@ -282,7 +282,7 @@ NSEC3
+ 
+ To sign using :ref:`NSEC3 <advanced_discussions_nsec3>` instead of :ref:`NSEC
+ <advanced_discussions_nsec>`, add an NSEC3PARAM record to the initial update
+-request. The :term:`OPTOUT <opt-out>` bit in the NSEC3
++request. The :term:`OPTOUT <Opt-out>` bit in the NSEC3
+ chain can be set in the flags field of the
+ NSEC3PARAM record.
+ 
+diff --git a/doc/arm/reference.rst b/doc/arm/reference.rst
+index ef6c1c7..b59b0ac 100644
+--- a/doc/arm/reference.rst
++++ b/doc/arm/reference.rst
+@@ -35,7 +35,7 @@ The file :file:`named.conf` may contain three types of entities:
+ 
+    Block
+       :ref:`Blocks <configuration_blocks>` are containers for :term:`statements
+-      <statement>` which either have common functionality - for example,
++      <Statement>` which either have common functionality - for example,
+       the definition of a cryptographic key in a :namedconf:ref:`key` block - or which
+       define the scope of the statement - for example, a statement which appears
+       in a :namedconf:ref:`zone` block has scope only for that zone.
+@@ -68,7 +68,7 @@ The file :file:`named.conf` may contain three types of entities:
+         more argument/value pairs. The :any:`also-notify` statement may take a number
+         of such argument/value pairs, such as ``also-notify port 5353;``,
+         where ``port`` is the argument and ``5353`` is the corresponding value.
+-      - Statements can appear in a single :term:`block` - for
++      - Statements can appear in a single :term:`block <Block>` - for
+         example, an :namedconf:ref:`algorithm` statement can appear only in a
+         :namedconf:ref:`key` block - or in multiple blocks - for example, an
+         :any:`also-notify` statement can appear in an :namedconf:ref:`options`
+@@ -6550,8 +6550,8 @@ The following options can be specified in a :any:`dnssec-policy` statement:
+     of the indicated length.
+ 
+     .. warning::
+-       Do not use extra :term:`iterations`, :term:`salt`, and
+-       :term:`opt-out` unless their implications are fully understood.
++       Do not use extra :term:`iterations <Iterations>`, :term:`salt <Salt>`, and
++       :term:`opt-out <Opt-out>` unless their implications are fully understood.
+        A higher number of iterations causes interoperability problems and opens
+        servers to CPU-exhausting DoS attacks.
+ 
diff --git a/bind.spec b/bind.spec
index 178f2b9..29f1762 100644
--- a/bind.spec
+++ b/bind.spec
@@ -63,7 +63,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.18.7
-Release:  1%{?dist}
+Release:  2%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -106,6 +106,9 @@ Patch24: bind-9.18-pkcs11-engine-compat-api.patch
 Patch25: bind-9.18-pkcs11-engine-remove-deadcode.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=2122010
 Patch26: bind-9.18-unittest-netmgr-unstable.patch
+# Fix building ARM docs in EPEL9
+# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/6815
+Patch27: bind-9.18-doc-arm-rhel9.patch
 
 %{?systemd_ordering}
 Requires:       coreutils
@@ -954,6 +957,9 @@ fi;
 %endif
 
 %changelog
+* Sat Sep 24 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.7-2
+- Build ARM documentation also with older sphinx on RHEL9
+
 * Wed Sep 21 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.7-1
 - Update to 9.18.7 (#2128609)
 

From dc511b8cc3871131ab781696e0ea1aa0b634119f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 30 Sep 2022 12:48:17 +0200
Subject: [PATCH 320/460] Update License to SPDX identifier

---
 bind.spec | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/bind.spec b/bind.spec
index 29f1762..ac40820 100644
--- a/bind.spec
+++ b/bind.spec
@@ -61,9 +61,9 @@ Conflicts: %1 \
 
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
-License:  MPLv2.0
+License:  MPL-2.0
 Version:  9.18.7
-Release:  2%{?dist}
+Release:  3%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -957,6 +957,9 @@ fi;
 %endif
 
 %changelog
+* Fri Sep 30 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.7-3
+- Update License to SPDX identifier
+
 * Sat Sep 24 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.7-2
 - Build ARM documentation also with older sphinx on RHEL9
 

From e6424d1a0900be7e756722b890c650722ba66e14 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 30 Sep 2022 12:51:19 +0200
Subject: [PATCH 321/460] Enable automatic restart on crashes

named contains high number of assertions checking expected state of the
daemon. That is part of defensive code style to prevent many attacks.
The most common failure is failing some assertion check in rare
circumstances. Even when this should not happen, try keeping the service
running. If such failed assertion produces coredump just from time to
time, avoid failing hard the whole service. coredumpctl will keep track
of all crashes anyway.
---
 bind.spec            | 1 +
 named-chroot.service | 1 +
 named.service        | 1 +
 3 files changed, 3 insertions(+)

diff --git a/bind.spec b/bind.spec
index ac40820..20bb29e 100644
--- a/bind.spec
+++ b/bind.spec
@@ -959,6 +959,7 @@ fi;
 %changelog
 * Fri Sep 30 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.7-3
 - Update License to SPDX identifier
+- Enable automatic restart on crashes
 
 * Sat Sep 24 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.7-2
 - Build ARM documentation also with older sphinx on RHEL9
diff --git a/named-chroot.service b/named-chroot.service
index ff793f2..4c38601 100644
--- a/named-chroot.service
+++ b/named-chroot.service
@@ -25,6 +25,7 @@ ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/r
 ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'
 
 PrivateTmp=false
+Restart=on-abnormal
 
 [Install]
 WantedBy=multi-user.target
diff --git a/named.service b/named.service
index 252c9d5..5c32fc5 100644
--- a/named.service
+++ b/named.service
@@ -20,6 +20,7 @@ ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/r
 ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'
 
 PrivateTmp=true
+Restart=on-abnormal
 
 [Install]
 WantedBy=multi-user.target

From 99fd53a10661f8de99fb9d335c37f8e891d4455a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Sat, 22 Oct 2022 20:16:47 +0200
Subject: [PATCH 322/460] Update to 9.18.8 (#2136100)

https://downloads.isc.org/isc/bind9/9.18.8/doc/arm/html/notes.html#notes-for-bind-9-18-8
---
 .gitignore                                    |    2 +
 bind-9.11-fips-tests.patch                    |   28 +-
 bind-9.18-doc-arm-rhel9.patch                 |   46 -
 bind-9.18-pkcs11-engine-compat-api.patch      | 1556 -----------------
 bind-9.18-pkcs11-engine-init.patch            |   48 -
 bind-9.18-pkcs11-engine-remove-deadcode.patch |  245 ---
 bind.spec                                     |   15 +-
 sources                                       |    4 +-
 8 files changed, 24 insertions(+), 1920 deletions(-)
 delete mode 100644 bind-9.18-doc-arm-rhel9.patch
 delete mode 100644 bind-9.18-pkcs11-engine-compat-api.patch
 delete mode 100644 bind-9.18-pkcs11-engine-init.patch
 delete mode 100644 bind-9.18-pkcs11-engine-remove-deadcode.patch

diff --git a/.gitignore b/.gitignore
index c6e3afe..d9ce40c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -192,3 +192,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.18.6.tar.xz.asc
 /bind-9.18.7.tar.xz
 /bind-9.18.7.tar.xz.asc
+/bind-9.18.8.tar.xz
+/bind-9.18.8.tar.xz.asc
diff --git a/bind-9.11-fips-tests.patch b/bind-9.11-fips-tests.patch
index 415a87a..072419f 100644
--- a/bind-9.11-fips-tests.patch
+++ b/bind-9.11-fips-tests.patch
@@ -1,4 +1,4 @@
-From b1e27453fadcf8ce453beed5b896ad995dfb5534 Mon Sep 17 00:00:00 2001
+From 2ad42c7c23858f12d977526d6ebc3465907d7b1b Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 2 Aug 2018 23:46:45 +0200
 Subject: [PATCH] FIPS tests changes
@@ -428,10 +428,10 @@ index 364f94b..9518f82 100644
  };
  
 diff --git a/bin/tests/system/allow-query/tests.sh b/bin/tests/system/allow-query/tests.sh
-index bbffe07..80da0fe 100644
+index 01a13cf..3711c63 100644
 --- a/bin/tests/system/allow-query/tests.sh
 +++ b/bin/tests/system/allow-query/tests.sh
-@@ -200,7 +200,7 @@ rndc_reload ns2 10.53.0.2
+@@ -201,7 +201,7 @@ rndc_reload ns2 10.53.0.2
  
  echo_i "test $n: key allowed - query allowed"
  ret=0
@@ -440,7 +440,7 @@ index bbffe07..80da0fe 100644
  grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
  grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1
  if [ $ret != 0 ]; then echo_i "failed"; fi
-@@ -213,7 +213,7 @@ rndc_reload ns2 10.53.0.2
+@@ -214,7 +214,7 @@ rndc_reload ns2 10.53.0.2
  
  echo_i "test $n: key not allowed - query refused"
  ret=0
@@ -449,7 +449,7 @@ index bbffe07..80da0fe 100644
  grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
  grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1
  grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
-@@ -227,7 +227,7 @@ rndc_reload ns2 10.53.0.2
+@@ -228,7 +228,7 @@ rndc_reload ns2 10.53.0.2
  
  echo_i "test $n: key disallowed - query refused"
  ret=0
@@ -458,7 +458,7 @@ index bbffe07..80da0fe 100644
  grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
  grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1
  grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
-@@ -366,7 +366,7 @@ rndc_reload ns2 10.53.0.2
+@@ -367,7 +367,7 @@ rndc_reload ns2 10.53.0.2
  
  echo_i "test $n: views key allowed - query allowed"
  ret=0
@@ -467,7 +467,7 @@ index bbffe07..80da0fe 100644
  grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
  grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1
  if [ $ret != 0 ]; then echo_i "failed"; fi
-@@ -379,7 +379,7 @@ rndc_reload ns2 10.53.0.2
+@@ -380,7 +380,7 @@ rndc_reload ns2 10.53.0.2
  
  echo_i "test $n: views key not allowed - query refused"
  ret=0
@@ -476,7 +476,7 @@ index bbffe07..80da0fe 100644
  grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
  grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1
  grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
-@@ -393,7 +393,7 @@ rndc_reload ns2 10.53.0.2
+@@ -394,7 +394,7 @@ rndc_reload ns2 10.53.0.2
  
  echo_i "test $n: views key disallowed - query refused"
  ret=0
@@ -485,7 +485,7 @@ index bbffe07..80da0fe 100644
  grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
  grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1
  grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
-@@ -533,7 +533,7 @@ status=`expr $status + $ret`
+@@ -534,7 +534,7 @@ status=`expr $status + $ret`
  n=`expr $n + 1`
  echo_i "test $n: zone key allowed - query allowed"
  ret=0
@@ -494,7 +494,7 @@ index bbffe07..80da0fe 100644
  grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
  grep '^a.keyallow.example' dig.out.ns2.$n > /dev/null || ret=1
  if [ $ret != 0 ]; then echo_i "failed"; fi
-@@ -543,7 +543,7 @@ status=`expr $status + $ret`
+@@ -544,7 +544,7 @@ status=`expr $status + $ret`
  n=`expr $n + 1`
  echo_i "test $n: zone key not allowed - query refused"
  ret=0
@@ -503,7 +503,7 @@ index bbffe07..80da0fe 100644
  grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
  grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1
  grep '^a.keyallow.example' dig.out.ns2.$n > /dev/null && ret=1
-@@ -554,7 +554,7 @@ status=`expr $status + $ret`
+@@ -555,7 +555,7 @@ status=`expr $status + $ret`
  n=`expr $n + 1`
  echo_i "test $n: zone key disallowed - query refused"
  ret=0
@@ -513,16 +513,18 @@ index bbffe07..80da0fe 100644
  grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1
  grep '^a.keydisallow.example' dig.out.ns2.$n > /dev/null && ret=1
 diff --git a/bin/tests/system/catz/ns1/named.conf.in b/bin/tests/system/catz/ns1/named.conf.in
-index 1421281..424afb8 100644
+index 3a8e401..82e720d 100644
 --- a/bin/tests/system/catz/ns1/named.conf.in
 +++ b/bin/tests/system/catz/ns1/named.conf.in
-@@ -122,5 +122,5 @@ view "ch" ch {
+@@ -122,7 +122,7 @@ view "ch" ch {
  
  key tsig_key. {
  	secret "LSAnCU+Z";
 -	algorithm hmac-md5;
 +	algorithm hmac-sha256;
  };
+ 
+ key next_key. {
 diff --git a/bin/tests/system/checkconf/bad-tsig.conf b/bin/tests/system/checkconf/bad-tsig.conf
 index 4af25b0..9f202d5 100644
 --- a/bin/tests/system/checkconf/bad-tsig.conf
diff --git a/bind-9.18-doc-arm-rhel9.patch b/bind-9.18-doc-arm-rhel9.patch
deleted file mode 100644
index 2778e1e..0000000
--- a/bind-9.18-doc-arm-rhel9.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-diff --git a/doc/arm/dnssec.inc.rst b/doc/arm/dnssec.inc.rst
-index 0d72000..f4810ae 100644
---- a/doc/arm/dnssec.inc.rst
-+++ b/doc/arm/dnssec.inc.rst
-@@ -282,7 +282,7 @@ NSEC3
- 
- To sign using :ref:`NSEC3 <advanced_discussions_nsec3>` instead of :ref:`NSEC
- <advanced_discussions_nsec>`, add an NSEC3PARAM record to the initial update
--request. The :term:`OPTOUT <opt-out>` bit in the NSEC3
-+request. The :term:`OPTOUT <Opt-out>` bit in the NSEC3
- chain can be set in the flags field of the
- NSEC3PARAM record.
- 
-diff --git a/doc/arm/reference.rst b/doc/arm/reference.rst
-index ef6c1c7..b59b0ac 100644
---- a/doc/arm/reference.rst
-+++ b/doc/arm/reference.rst
-@@ -35,7 +35,7 @@ The file :file:`named.conf` may contain three types of entities:
- 
-    Block
-       :ref:`Blocks <configuration_blocks>` are containers for :term:`statements
--      <statement>` which either have common functionality - for example,
-+      <Statement>` which either have common functionality - for example,
-       the definition of a cryptographic key in a :namedconf:ref:`key` block - or which
-       define the scope of the statement - for example, a statement which appears
-       in a :namedconf:ref:`zone` block has scope only for that zone.
-@@ -68,7 +68,7 @@ The file :file:`named.conf` may contain three types of entities:
-         more argument/value pairs. The :any:`also-notify` statement may take a number
-         of such argument/value pairs, such as ``also-notify port 5353;``,
-         where ``port`` is the argument and ``5353`` is the corresponding value.
--      - Statements can appear in a single :term:`block` - for
-+      - Statements can appear in a single :term:`block <Block>` - for
-         example, an :namedconf:ref:`algorithm` statement can appear only in a
-         :namedconf:ref:`key` block - or in multiple blocks - for example, an
-         :any:`also-notify` statement can appear in an :namedconf:ref:`options`
-@@ -6550,8 +6550,8 @@ The following options can be specified in a :any:`dnssec-policy` statement:
-     of the indicated length.
- 
-     .. warning::
--       Do not use extra :term:`iterations`, :term:`salt`, and
--       :term:`opt-out` unless their implications are fully understood.
-+       Do not use extra :term:`iterations <Iterations>`, :term:`salt <Salt>`, and
-+       :term:`opt-out <Opt-out>` unless their implications are fully understood.
-        A higher number of iterations causes interoperability problems and opens
-        servers to CPU-exhausting DoS attacks.
- 
diff --git a/bind-9.18-pkcs11-engine-compat-api.patch b/bind-9.18-pkcs11-engine-compat-api.patch
deleted file mode 100644
index 678d199..0000000
--- a/bind-9.18-pkcs11-engine-compat-api.patch
+++ /dev/null
@@ -1,1556 +0,0 @@
-From 1ecf072a6a556aa386003d1d5b83fe172320e7ed Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Thu, 8 Sep 2022 17:19:20 +0200
-Subject: [PATCH] Do not use OSSL_PARAM when engine API is compiled
-
-OpenSSL has deprecated many things in version 3.0. If pkcs11 engine
-should work then no builder from OpenSSL 3.0 API can be used.
-
-Allow switching to OpenSSL 1.1 like calls even on OpenSSL 3.0 when
-OPENSSL_API_COMPAT=10100 is defined. It would still compile and allow
-working keys loading from the engine passed on command line.
----
- lib/dns/openssldh_link.c    | 136 +++++++++++++++++++-----------------
- lib/dns/opensslecdsa_link.c | 119 +++++++++++++++----------------
- lib/dns/opensslrsa_link.c   | 118 +++++++++++++++----------------
- 3 files changed, 189 insertions(+), 184 deletions(-)
-
-diff --git a/lib/dns/openssldh_link.c b/lib/dns/openssldh_link.c
-index 1a01c2b..7df483f 100644
---- a/lib/dns/openssldh_link.c
-+++ b/lib/dns/openssldh_link.c
-@@ -91,7 +91,7 @@ static BIGNUM *bn2 = NULL, *bn768 = NULL, *bn1024 = NULL, *bn1536 = NULL;
- static isc_result_t
- openssldh_computesecret(const dst_key_t *pub, const dst_key_t *priv,
- 			isc_buffer_t *secret) {
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	DH *dhpub, *dhpriv;
- 	const BIGNUM *pub_key = NULL;
- 	int secret_len = 0;
-@@ -99,11 +99,11 @@ openssldh_computesecret(const dst_key_t *pub, const dst_key_t *priv,
- 	EVP_PKEY_CTX *ctx = NULL;
- 	EVP_PKEY *dhpub, *dhpriv;
- 	size_t secret_len = 0;
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 	isc_region_t r;
- 	unsigned int len;
- 
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	REQUIRE(pub->keydata.dh != NULL);
- 	REQUIRE(priv->keydata.dh != NULL);
- 
-@@ -119,14 +119,14 @@ openssldh_computesecret(const dst_key_t *pub, const dst_key_t *priv,
- 	dhpriv = priv->keydata.pkey;
- 
- 	len = EVP_PKEY_get_size(dhpriv);
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 
- 	isc_buffer_availableregion(secret, &r);
- 	if (r.length < len) {
- 		return (ISC_R_NOSPACE);
- 	}
- 
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	DH_get0_key(dhpub, &pub_key, NULL);
- 	secret_len = DH_compute_key(r.base, pub_key, dhpriv);
- 	if (secret_len <= 0) {
-@@ -156,7 +156,7 @@ openssldh_computesecret(const dst_key_t *pub, const dst_key_t *priv,
- 					       DST_R_COMPUTESECRETFAILURE));
- 	}
- 	EVP_PKEY_CTX_free(ctx);
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 
- 	isc_buffer_add(secret, (unsigned int)secret_len);
- 
-@@ -166,7 +166,7 @@ openssldh_computesecret(const dst_key_t *pub, const dst_key_t *priv,
- static bool
- openssldh_compare(const dst_key_t *key1, const dst_key_t *key2) {
- 	bool ret = true;
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	DH *dh1, *dh2;
- 	const BIGNUM *pub_key1 = NULL, *pub_key2 = NULL;
- 	const BIGNUM *priv_key1 = NULL, *priv_key2 = NULL;
-@@ -176,9 +176,9 @@ openssldh_compare(const dst_key_t *key1, const dst_key_t *key2) {
- 	BIGNUM *pub_key1 = NULL, *pub_key2 = NULL;
- 	BIGNUM *priv_key1 = NULL, *priv_key2 = NULL;
- 	BIGNUM *p1 = NULL, *g1 = NULL, *p2 = NULL, *g2 = NULL;
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	dh1 = key1->keydata.dh;
- 	dh2 = key2->keydata.dh;
- 
-@@ -210,7 +210,7 @@ openssldh_compare(const dst_key_t *key1, const dst_key_t *key2) {
- 	EVP_PKEY_get_bn_param(pkey2, OSSL_PKEY_PARAM_PUB_KEY, &pub_key2);
- 	EVP_PKEY_get_bn_param(pkey1, OSSL_PKEY_PARAM_PRIV_KEY, &priv_key1);
- 	EVP_PKEY_get_bn_param(pkey2, OSSL_PKEY_PARAM_PRIV_KEY, &priv_key2);
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L*/
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000*/
- 
- 	if (BN_cmp(p1, p2) != 0 || BN_cmp(g1, g2) != 0 ||
- 	    BN_cmp(pub_key1, pub_key2) != 0)
-@@ -226,7 +226,7 @@ openssldh_compare(const dst_key_t *key1, const dst_key_t *key2) {
- 	}
- 
- err:
--#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
- 	if (p1 != NULL) {
- 		BN_free(p1);
- 	}
-@@ -251,7 +251,8 @@ err:
- 	if (priv_key2 != NULL) {
- 		BN_clear_free(priv_key2);
- 	}
--#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000 \
-+	*/
- 
- 	return (ret);
- }
-@@ -259,15 +260,15 @@ err:
- static bool
- openssldh_paramcompare(const dst_key_t *key1, const dst_key_t *key2) {
- 	bool ret = true;
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	DH *dh1, *dh2;
- 	const BIGNUM *p1 = NULL, *g1 = NULL, *p2 = NULL, *g2 = NULL;
- #else
- 	EVP_PKEY *pkey1, *pkey2;
- 	BIGNUM *p1 = NULL, *g1 = NULL, *p2 = NULL, *g2 = NULL;
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	dh1 = key1->keydata.dh;
- 	dh2 = key2->keydata.dh;
- 
-@@ -293,14 +294,14 @@ openssldh_paramcompare(const dst_key_t *key1, const dst_key_t *key2) {
- 	EVP_PKEY_get_bn_param(pkey2, OSSL_PKEY_PARAM_FFC_P, &p2);
- 	EVP_PKEY_get_bn_param(pkey1, OSSL_PKEY_PARAM_FFC_G, &g1);
- 	EVP_PKEY_get_bn_param(pkey2, OSSL_PKEY_PARAM_FFC_G, &g2);
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 
- 	if (BN_cmp(p1, p2) != 0 || BN_cmp(g1, g2) != 0) {
- 		DST_RET(false);
- 	}
- 
- err:
--#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
- 	if (p1 != NULL) {
- 		BN_free(p1);
- 	}
-@@ -313,12 +314,13 @@ err:
- 	if (g2 != NULL) {
- 		BN_free(g2);
- 	}
--#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000 \
-+	*/
- 
- 	return (ret);
- }
- 
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- static int
- progress_cb(int p, int n, BN_GENCB *cb) {
- 	union {
-@@ -349,7 +351,7 @@ progress_cb(EVP_PKEY_CTX *ctx) {
- 	}
- 	return (1);
- }
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 
- static isc_result_t
- openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) {
-@@ -359,7 +361,7 @@ openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) {
- 		void (*fptr)(int);
- 	} u;
- 	BIGNUM *p = NULL, *g = NULL;
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	DH *dh = NULL;
- 	BN_GENCB *cb = NULL;
- #if !HAVE_BN_GENCB_NEW
-@@ -372,9 +374,9 @@ openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) {
- 	EVP_PKEY_CTX *ctx = NULL;
- 	EVP_PKEY *param_pkey = NULL;
- 	EVP_PKEY *pkey = NULL;
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	dh = DH_new();
- 	if (dh == NULL) {
- 		DST_RET(dst__openssl_toresult(ISC_R_NOMEMORY));
-@@ -388,7 +390,7 @@ openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) {
- 	if (param_ctx == NULL) {
- 		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
- 	}
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 
- 	if (generator == 0) {
- 		/*
-@@ -408,7 +410,7 @@ openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) {
- 			if (p == NULL || g == NULL) {
- 				DST_RET(dst__openssl_toresult(ISC_R_NOMEMORY));
- 			}
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 			if (DH_set0_pqg(dh, p, NULL, g) != 1) {
- 				DST_RET(dst__openssl_toresult2(
- 					"DH_set0_pqg", DST_R_OPENSSLFAILURE));
-@@ -432,7 +434,7 @@ openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) {
- 					DST_R_OPENSSLFAILURE));
- 			}
- 			params = OSSL_PARAM_BLD_to_param(bld);
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 
- 		} else {
- 			/*
-@@ -445,7 +447,7 @@ openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) {
- 	}
- 
- 	if (generator != 0) {
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 		cb = BN_GENCB_new();
- #if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
- 		if (cb == NULL) {
-@@ -488,10 +490,10 @@ openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) {
- 						       DST_R_OPENSSLFAILURE));
- 		}
- 		params = OSSL_PARAM_BLD_to_param(bld);
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 	}
- 
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	if (DH_generate_key(dh) == 0) {
- 		DST_RET(dst__openssl_toresult2("DH_generate_key",
- 					       DST_R_OPENSSLFAILURE));
-@@ -559,12 +561,12 @@ openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) {
- 
- 	key->keydata.pkey = pkey;
- 	pkey = NULL;
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 
- 	ret = ISC_R_SUCCESS;
- 
- err:
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	if (dh != NULL) {
- 		DH_free(dh);
- 	}
-@@ -596,14 +598,14 @@ err:
- 	if (g != NULL) {
- 		BN_free(g);
- 	}
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 
- 	return (ret);
- }
- 
- static bool
- openssldh_isprivate(const dst_key_t *key) {
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	DH *dh = key->keydata.dh;
- 	const BIGNUM *priv_key = NULL;
- 
-@@ -628,12 +630,12 @@ openssldh_isprivate(const dst_key_t *key) {
- 	}
- 
- 	return (ret);
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- }
- 
- static void
- openssldh_destroy(dst_key_t *key) {
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	DH *dh = key->keydata.dh;
- 
- 	if (dh == NULL) {
-@@ -651,7 +653,7 @@ openssldh_destroy(dst_key_t *key) {
- 
- 	EVP_PKEY_free(pkey);
- 	key->keydata.pkey = NULL;
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- }
- 
- static void
-@@ -678,17 +680,17 @@ uint16_fromregion(isc_region_t *region) {
- static isc_result_t
- openssldh_todns(const dst_key_t *key, isc_buffer_t *data) {
- 	isc_result_t ret = ISC_R_SUCCESS;
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	DH *dh;
- 	const BIGNUM *pub_key = NULL, *p = NULL, *g = NULL;
- #else
- 	EVP_PKEY *pkey;
- 	BIGNUM *pub_key = NULL, *p = NULL, *g = NULL;
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 	isc_region_t r;
- 	uint16_t dnslen, plen, glen, publen;
- 
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	REQUIRE(key->keydata.dh != NULL);
- 
- 	dh = key->keydata.dh;
-@@ -701,7 +703,7 @@ openssldh_todns(const dst_key_t *key, isc_buffer_t *data) {
- 	EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_FFC_P, &p);
- 	EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_FFC_G, &g);
- 	EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_PUB_KEY, &pub_key);
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 
- 	isc_buffer_availableregion(data, &r);
- 
-@@ -749,7 +751,7 @@ openssldh_todns(const dst_key_t *key, isc_buffer_t *data) {
- 	isc_buffer_add(data, dnslen);
- 
- err:
--#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
- 	if (p != NULL) {
- 		BN_free(p);
- 	}
-@@ -759,7 +761,8 @@ err:
- 	if (pub_key != NULL) {
- 		BN_free(pub_key);
- 	}
--#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000 \
-+	*/
- 
- 	return (ret);
- }
-@@ -767,14 +770,14 @@ err:
- static isc_result_t
- openssldh_fromdns(dst_key_t *key, isc_buffer_t *data) {
- 	isc_result_t ret;
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	DH *dh;
- #else
- 	OSSL_PARAM_BLD *bld = NULL;
- 	OSSL_PARAM *params = NULL;
- 	EVP_PKEY_CTX *ctx = NULL;
- 	EVP_PKEY *pkey = NULL;
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 	BIGNUM *pub_key = NULL, *p = NULL, *g = NULL;
- 	int key_size;
- 	isc_region_t r;
-@@ -786,7 +789,7 @@ openssldh_fromdns(dst_key_t *key, isc_buffer_t *data) {
- 		return (ISC_R_SUCCESS);
- 	}
- 
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	dh = DH_new();
- 	if (dh == NULL) {
- 		DST_RET(dst__openssl_toresult(ISC_R_NOMEMORY));
-@@ -801,7 +804,7 @@ openssldh_fromdns(dst_key_t *key, isc_buffer_t *data) {
- 	if (ctx == NULL) {
- 		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
- 	}
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 
- 	/*
- 	 * Read the prime length.  1 & 2 are table entries, > 16 means a
-@@ -877,7 +880,7 @@ openssldh_fromdns(dst_key_t *key, isc_buffer_t *data) {
- 
- 	key_size = BN_num_bits(p);
- 
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	if (DH_set0_pqg(dh, p, NULL, g) != 1) {
- 		DST_RET(dst__openssl_toresult2("DH_set0_pqg",
- 					       DST_R_OPENSSLFAILURE));
-@@ -893,7 +896,7 @@ openssldh_fromdns(dst_key_t *key, isc_buffer_t *data) {
- 		DST_RET(dst__openssl_toresult2("OSSL_PARAM_BLD_push_BN",
- 					       DST_R_OPENSSLFAILURE));
- 	}
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 
- 	if (r.length < 2) {
- 		DST_RET(DST_R_INVALIDPUBLICKEY);
-@@ -911,7 +914,7 @@ openssldh_fromdns(dst_key_t *key, isc_buffer_t *data) {
- 
- 	isc_buffer_forward(data, plen + glen + publen + 6);
- 
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- #if (LIBRESSL_VERSION_NUMBER >= 0x2070000fL) && \
- 	(LIBRESSL_VERSION_NUMBER <= 0x2070200fL)
- 	/*
-@@ -955,14 +958,14 @@ openssldh_fromdns(dst_key_t *key, isc_buffer_t *data) {
- 
- 	key->keydata.pkey = pkey;
- 	pkey = NULL;
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 
- 	key->key_size = (unsigned int)key_size;
- 
- 	ret = ISC_R_SUCCESS;
- 
- err:
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	if (dh != NULL) {
- 		DH_free(dh);
- 	}
-@@ -979,7 +982,7 @@ err:
- 	if (bld != NULL) {
- 		OSSL_PARAM_BLD_free(bld);
- 	}
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 	if (p != NULL) {
- 		BN_free(p);
- 	}
-@@ -995,13 +998,13 @@ err:
- 
- static isc_result_t
- openssldh_tofile(const dst_key_t *key, const char *directory) {
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	DH *dh;
- 	const BIGNUM *pub_key = NULL, *priv_key = NULL, *p = NULL, *g = NULL;
- #else
- 	EVP_PKEY *pkey;
- 	BIGNUM *pub_key = NULL, *priv_key = NULL, *p = NULL, *g = NULL;
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 	dst_private_t priv;
- 	unsigned char *bufs[4] = { NULL };
- 	unsigned short i = 0;
-@@ -1011,7 +1014,7 @@ openssldh_tofile(const dst_key_t *key, const char *directory) {
- 		return (DST_R_EXTERNALKEY);
- 	}
- 
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	if (key->keydata.dh == NULL) {
- 		return (DST_R_NULLKEY);
- 	}
-@@ -1029,7 +1032,7 @@ openssldh_tofile(const dst_key_t *key, const char *directory) {
- 	EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_FFC_G, &g);
- 	EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_PUB_KEY, &pub_key);
- 	EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_PRIV_KEY, &priv_key);
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 
- 	priv.elements[i].tag = TAG_DH_PRIME;
- 	priv.elements[i].length = BN_num_bytes(p);
-@@ -1069,7 +1072,7 @@ openssldh_tofile(const dst_key_t *key, const char *directory) {
- 		}
- 	}
- 
--#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
- 	if (p != NULL) {
- 		BN_free(p);
- 	}
-@@ -1082,7 +1085,8 @@ openssldh_tofile(const dst_key_t *key, const char *directory) {
- 	if (priv_key != NULL) {
- 		BN_clear_free(priv_key);
- 	}
--#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000 \
-+	*/
- 
- 	return (result);
- }
-@@ -1092,14 +1096,14 @@ openssldh_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
- 	dst_private_t priv;
- 	isc_result_t ret;
- 	int i;
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	DH *dh = NULL;
- #else
- 	OSSL_PARAM_BLD *bld = NULL;
- 	OSSL_PARAM *params = NULL;
- 	EVP_PKEY_CTX *ctx = NULL;
- 	EVP_PKEY *pkey = NULL;
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 	BIGNUM *pub_key = NULL, *priv_key = NULL, *p = NULL, *g = NULL;
- 	int key_size = 0;
- 	isc_mem_t *mctx;
-@@ -1117,7 +1121,7 @@ openssldh_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
- 		DST_RET(DST_R_EXTERNALKEY);
- 	}
- 
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	dh = DH_new();
- 	if (dh == NULL) {
- 		DST_RET(ISC_R_NOMEMORY);
-@@ -1132,7 +1136,7 @@ openssldh_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
- 	if (ctx == NULL) {
- 		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
- 	}
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 
- 	for (i = 0; i < priv.nelements; i++) {
- 		BIGNUM *bn;
-@@ -1159,7 +1163,7 @@ openssldh_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
- 		}
- 	}
- 
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	if (DH_set0_key(dh, pub_key, priv_key) != 1) {
- 		DST_RET(dst__openssl_toresult2("DH_set0_key",
- 					       DST_R_OPENSSLFAILURE));
-@@ -1206,13 +1210,13 @@ openssldh_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
- 
- 	key->keydata.pkey = pkey;
- 	pkey = NULL;
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 
- 	key->key_size = (unsigned int)key_size;
- 	ret = ISC_R_SUCCESS;
- 
- err:
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	if (dh != NULL) {
- 		DH_free(dh);
- 	}
-@@ -1229,7 +1233,7 @@ err:
- 	if (bld != NULL) {
- 		OSSL_PARAM_BLD_free(bld);
- 	}
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 	if (p != NULL) {
- 		BN_free(p);
- 	}
-diff --git a/lib/dns/opensslecdsa_link.c b/lib/dns/opensslecdsa_link.c
-index 519e88b..04f0d80 100644
---- a/lib/dns/opensslecdsa_link.c
-+++ b/lib/dns/opensslecdsa_link.c
-@@ -17,14 +17,14 @@
- 
- #include <openssl/bn.h>
- #include <openssl/opensslv.h>
--#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
- #include <openssl/core_names.h>
- #endif
- #include <openssl/ecdsa.h>
- #include <openssl/err.h>
- #include <openssl/evp.h>
- #include <openssl/objects.h>
--#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
- #include <openssl/param_build.h>
- #endif
- #if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000
-@@ -57,7 +57,7 @@
- 		goto err; \
- 	}
- 
--#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
- static isc_result_t
- raw_key_to_ossl(unsigned int key_alg, int private, const unsigned char *key,
- 		size_t key_len, EVP_PKEY **pkey) {
-@@ -159,7 +159,8 @@ err:
- 
- 	return (ret);
- }
--#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000 \
-+	*/
- 
- static isc_result_t
- opensslecdsa_createctx(dst_key_t *key, dst_context_t *dctx) {
-@@ -411,7 +412,7 @@ opensslecdsa_compare(const dst_key_t *key1, const dst_key_t *key2) {
- 	bool ret;
- 	EVP_PKEY *pkey1 = key1->keydata.pkey;
- 	EVP_PKEY *pkey2 = key2->keydata.pkey;
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	EC_KEY *eckey1 = NULL;
- 	EC_KEY *eckey2 = NULL;
- 	const BIGNUM *priv1;
-@@ -419,7 +420,7 @@ opensslecdsa_compare(const dst_key_t *key1, const dst_key_t *key2) {
- #else
- 	BIGNUM *priv1 = NULL;
- 	BIGNUM *priv2 = NULL;
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 
- 	if (pkey1 == NULL && pkey2 == NULL) {
- 		return (true);
-@@ -432,7 +433,7 @@ opensslecdsa_compare(const dst_key_t *key1, const dst_key_t *key2) {
- 		DST_RET(false);
- 	}
- 
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	eckey1 = EVP_PKEY_get1_EC_KEY(pkey1);
- 	eckey2 = EVP_PKEY_get1_EC_KEY(pkey2);
- 	if (eckey1 == NULL && eckey2 == NULL) {
-@@ -445,7 +446,7 @@ opensslecdsa_compare(const dst_key_t *key1, const dst_key_t *key2) {
- #else
- 	EVP_PKEY_get_bn_param(pkey1, OSSL_PKEY_PARAM_PRIV_KEY, &priv1);
- 	EVP_PKEY_get_bn_param(pkey2, OSSL_PKEY_PARAM_PRIV_KEY, &priv2);
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 
- 	if (priv1 != NULL || priv2 != NULL) {
- 		if (priv1 == NULL || priv2 == NULL || BN_cmp(priv1, priv2) != 0)
-@@ -457,7 +458,7 @@ opensslecdsa_compare(const dst_key_t *key1, const dst_key_t *key2) {
- 	ret = true;
- 
- err:
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	if (eckey1 != NULL) {
- 		EC_KEY_free(eckey1);
- 	}
-@@ -471,7 +472,7 @@ err:
- 	if (priv2 != NULL) {
- 		BN_clear_free(priv2);
- 	}
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 
- 	return (ret);
- }
-@@ -481,12 +482,12 @@ opensslecdsa_generate(dst_key_t *key, int unused, void (*callback)(int)) {
- 	isc_result_t ret;
- 	int status;
- 	EVP_PKEY *pkey = NULL;
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	EC_KEY *eckey = NULL;
- #else
- 	EVP_PKEY_CTX *ctx = NULL;
- 	EVP_PKEY *params_pkey = NULL;
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 	int group_nid;
- 
- 	REQUIRE(key->key_alg == DST_ALG_ECDSA256 ||
-@@ -502,7 +503,7 @@ opensslecdsa_generate(dst_key_t *key, int unused, void (*callback)(int)) {
- 		key->key_size = DNS_KEY_ECDSA384SIZE * 4;
- 	}
- 
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	eckey = EC_KEY_new_by_curve_name(group_nid);
- 	if (eckey == NULL) {
- 		DST_RET(dst__openssl_toresult2("EC_KEY_new_by_curve_name",
-@@ -563,7 +564,7 @@ opensslecdsa_generate(dst_key_t *key, int unused, void (*callback)(int)) {
- 		DST_RET(dst__openssl_toresult2("EVP_PKEY_keygen",
- 					       DST_R_OPENSSLFAILURE));
- 	}
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 
- 	key->keydata.pkey = pkey;
- 	pkey = NULL;
-@@ -573,7 +574,7 @@ err:
- 	if (pkey != NULL) {
- 		EVP_PKEY_free(pkey);
- 	}
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	if (eckey != NULL) {
- 		EC_KEY_free(eckey);
- 	}
-@@ -584,7 +585,7 @@ err:
- 	if (ctx != NULL) {
- 		EVP_PKEY_CTX_free(ctx);
- 	}
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 
- 	return (ret);
- }
-@@ -593,11 +594,11 @@ static bool
- opensslecdsa_isprivate(const dst_key_t *key) {
- 	bool ret;
- 	EVP_PKEY *pkey;
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	EC_KEY *eckey;
- #else
- 	BIGNUM *priv = NULL;
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 
- 	REQUIRE(key->key_alg == DST_ALG_ECDSA256 ||
- 		key->key_alg == DST_ALG_ECDSA384);
-@@ -607,7 +608,7 @@ opensslecdsa_isprivate(const dst_key_t *key) {
- 		return (false);
- 	}
- 
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	eckey = EVP_PKEY_get1_EC_KEY(pkey);
- 
- 	ret = (eckey != NULL && EC_KEY_get0_private_key(eckey) != NULL);
-@@ -621,7 +622,7 @@ opensslecdsa_isprivate(const dst_key_t *key) {
- 	if (priv != NULL) {
- 		BN_clear_free(priv);
- 	}
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 
- 	return (ret);
- }
-@@ -640,7 +641,7 @@ static isc_result_t
- opensslecdsa_todns(const dst_key_t *key, isc_buffer_t *data) {
- 	isc_result_t ret;
- 	EVP_PKEY *pkey;
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	EC_KEY *eckey = NULL;
- 	int len;
- 	unsigned char *cp;
-@@ -650,7 +651,7 @@ opensslecdsa_todns(const dst_key_t *key, isc_buffer_t *data) {
- 	BIGNUM *y = NULL;
- 	size_t keysize = 0;
- 	size_t len = 0;
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 	isc_region_t r;
- 	unsigned char buf[DNS_KEY_ECDSA384SIZE + 1];
- 
-@@ -658,7 +659,7 @@ opensslecdsa_todns(const dst_key_t *key, isc_buffer_t *data) {
- 
- 	pkey = key->keydata.pkey;
- 
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	eckey = EVP_PKEY_get1_EC_KEY(pkey);
- 	if (eckey == NULL) {
- 		DST_RET(dst__openssl_toresult(ISC_R_FAILURE));
-@@ -677,14 +678,14 @@ opensslecdsa_todns(const dst_key_t *key, isc_buffer_t *data) {
- 	}
- 
- 	len = keysize;
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 
- 	isc_buffer_availableregion(data, &r);
- 	if (r.length < (unsigned int)len) {
- 		DST_RET(ISC_R_NOSPACE);
- 	}
- 
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	cp = buf;
- 	if (!i2o_ECPublicKey(eckey, &cp)) {
- 		DST_RET(dst__openssl_toresult(ISC_R_FAILURE));
-@@ -704,13 +705,13 @@ opensslecdsa_todns(const dst_key_t *key, isc_buffer_t *data) {
- 	BN_bn2bin_fixed(x, &buf[0], keysize / 2);
- 	BN_bn2bin_fixed(y, &buf[keysize / 2], keysize / 2);
- 	memmove(r.base, buf, len);
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 
- 	isc_buffer_add(data, len);
- 	ret = ISC_R_SUCCESS;
- 
- err:
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	if (eckey != NULL) {
- 		EC_KEY_free(eckey);
- 	}
-@@ -721,7 +722,7 @@ err:
- 	if (y != NULL) {
- 		BN_clear_free(y);
- 	}
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 
- 	return (ret);
- }
-@@ -731,7 +732,7 @@ opensslecdsa_fromdns(dst_key_t *key, isc_buffer_t *data) {
- 	isc_result_t ret;
- 	EVP_PKEY *pkey = NULL;
- 	isc_region_t r;
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	EC_KEY *eckey = NULL;
- 	const unsigned char *cp;
- 	unsigned int len;
-@@ -739,7 +740,7 @@ opensslecdsa_fromdns(dst_key_t *key, isc_buffer_t *data) {
- 	int group_nid;
- #else
- 	size_t len;
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 
- 	REQUIRE(key->key_alg == DST_ALG_ECDSA256 ||
- 		key->key_alg == DST_ALG_ECDSA384);
-@@ -758,7 +759,7 @@ opensslecdsa_fromdns(dst_key_t *key, isc_buffer_t *data) {
- 		DST_RET(DST_R_INVALIDPUBLICKEY);
- 	}
- 
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	if (key->key_alg == DST_ALG_ECDSA256) {
- 		group_nid = NID_X9_62_prime256v1;
- 	} else {
-@@ -794,7 +795,7 @@ opensslecdsa_fromdns(dst_key_t *key, isc_buffer_t *data) {
- 	if (ret != ISC_R_SUCCESS) {
- 		DST_RET(ret);
- 	}
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 
- 	isc_buffer_forward(data, len);
- 	key->keydata.pkey = pkey;
-@@ -802,11 +803,11 @@ opensslecdsa_fromdns(dst_key_t *key, isc_buffer_t *data) {
- 	ret = ISC_R_SUCCESS;
- 
- err:
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	if (eckey != NULL) {
- 		EC_KEY_free(eckey);
- 	}
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 	return (ret);
- }
- 
-@@ -814,13 +815,13 @@ static isc_result_t
- opensslecdsa_tofile(const dst_key_t *key, const char *directory) {
- 	isc_result_t ret;
- 	EVP_PKEY *pkey;
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	EC_KEY *eckey = NULL;
- 	const BIGNUM *privkey = NULL;
- #else
- 	int status;
- 	BIGNUM *privkey = NULL;
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 	dst_private_t priv;
- 	unsigned char *buf = NULL;
- 	unsigned short i;
-@@ -835,7 +836,7 @@ opensslecdsa_tofile(const dst_key_t *key, const char *directory) {
- 	}
- 
- 	pkey = key->keydata.pkey;
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	eckey = EVP_PKEY_get1_EC_KEY(pkey);
- 	if (eckey == NULL) {
- 		DST_RET(dst__openssl_toresult2("EVP_PKEY_get1_EC_KEY",
-@@ -853,7 +854,7 @@ opensslecdsa_tofile(const dst_key_t *key, const char *directory) {
- 		DST_RET(dst__openssl_toresult2("EVP_PKEY_get_bn_param",
- 					       DST_R_OPENSSLFAILURE));
- 	}
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 
- 	buf = isc_mem_get(key->mctx, BN_num_bytes(privkey));
- 
-@@ -888,7 +889,7 @@ err:
- 	if (buf != NULL && privkey != NULL) {
- 		isc_mem_put(key->mctx, buf, BN_num_bytes(privkey));
- 	}
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	if (eckey != NULL) {
- 		EC_KEY_free(eckey);
- 	}
-@@ -896,12 +897,12 @@ err:
- 	if (privkey != NULL) {
- 		BN_clear_free(privkey);
- 	}
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 
- 	return (ret);
- }
- 
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- static isc_result_t
- ecdsa_check(EC_KEY *eckey, EC_KEY *pubeckey) {
- 	const EC_POINT *pubkey;
-@@ -1065,9 +1066,9 @@ err:
- 
- 	return (ret);
- }
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- static isc_result_t
- load_privkey_from_privstruct(EC_KEY *eckey, dst_private_t *priv,
- 			     int privkey_index) {
-@@ -1102,16 +1103,16 @@ eckey_to_pkey(EC_KEY *eckey, EVP_PKEY **pkey) {
- 	}
- 	return (ISC_R_SUCCESS);
- }
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 
- static isc_result_t
- finalize_eckey(dst_key_t *key,
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	       EC_KEY *eckey,
- #endif
- 	       const char *engine, const char *label) {
- 	isc_result_t result = ISC_R_SUCCESS;
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	EVP_PKEY *pkey = NULL;
- 
- 	REQUIRE(eckey != NULL);
-@@ -1122,7 +1123,7 @@ finalize_eckey(dst_key_t *key,
- 	}
- 
- 	key->keydata.pkey = pkey;
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 
- 	if (label != NULL) {
- 		key->label = isc_mem_strdup(key->mctx, label);
-@@ -1138,7 +1139,7 @@ finalize_eckey(dst_key_t *key,
- 	return (result);
- }
- 
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- static isc_result_t
- dst__key_to_eckey(dst_key_t *key, EC_KEY **eckey) {
- 	int group_nid;
-@@ -1163,7 +1164,7 @@ dst__key_to_eckey(dst_key_t *key, EC_KEY **eckey) {
- 
- 	return (ISC_R_SUCCESS);
- }
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 
- static isc_result_t
- opensslecdsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
-@@ -1173,10 +1174,10 @@ static isc_result_t
- opensslecdsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
- 	dst_private_t priv;
- 	isc_result_t ret;
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	EC_KEY *eckey = NULL;
- 	EC_KEY *pubeckey = NULL;
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 	const char *engine = NULL;
- 	const char *label = NULL;
- 	int i, privkey_index = -1;
-@@ -1227,14 +1228,14 @@ opensslecdsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
- 			goto err;
- 		}
- 
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 		eckey = EVP_PKEY_get1_EC_KEY(key->keydata.pkey);
- 		if (eckey == NULL) {
- 			DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
- 		}
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 	} else {
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 		ret = dst__key_to_eckey(key, &eckey);
- 		if (ret != ISC_R_SUCCESS) {
- 			goto err;
-@@ -1251,7 +1252,7 @@ opensslecdsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
- 				      priv.elements[privkey_index].data,
- 				      priv.elements[privkey_index].length,
- 				      &key->keydata.pkey);
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 
- 		if (ret != ISC_R_SUCCESS) {
- 			goto err;
-@@ -1260,7 +1261,7 @@ opensslecdsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
- 		finalize_key = true;
- 	}
- 
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	if (pub != NULL && pub->keydata.pkey != NULL) {
- 		pubeckey = EVP_PKEY_get1_EC_KEY(pub->keydata.pkey);
- 	}
-@@ -1283,17 +1284,17 @@ opensslecdsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
- 	if (finalize_key) {
- 		ret = finalize_eckey(key, engine, label);
- 	}
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 
- err:
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	if (pubeckey != NULL) {
- 		EC_KEY_free(pubeckey);
- 	}
- 	if (eckey != NULL) {
- 		EC_KEY_free(eckey);
- 	}
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 	if (ret != ISC_R_SUCCESS) {
- 		key->keydata.generic = NULL;
- 	}
-diff --git a/lib/dns/opensslrsa_link.c b/lib/dns/opensslrsa_link.c
-index fc905b7..867b486 100644
---- a/lib/dns/opensslrsa_link.c
-+++ b/lib/dns/opensslrsa_link.c
-@@ -18,7 +18,7 @@
- 
- #include <openssl/bn.h>
- #include <openssl/opensslv.h>
--#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
- #include <openssl/core_names.h>
- #endif
- #if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000
-@@ -26,7 +26,7 @@
- #endif /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */
- #include <openssl/err.h>
- #include <openssl/objects.h>
--#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
- #include <openssl/param_build.h>
- #endif
- #include <openssl/rsa.h>
-@@ -180,12 +180,12 @@ static isc_result_t
- opensslrsa_verify2(dst_context_t *dctx, int maxbits, const isc_region_t *sig) {
- 	dst_key_t *key = dctx->key;
- 	int status = 0;
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	RSA *rsa;
- 	const BIGNUM *e = NULL;
- #else
- 	BIGNUM *e = NULL;
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 	EVP_MD_CTX *evp_md_ctx = dctx->ctxdata.evp_md_ctx;
- 	EVP_PKEY *pkey = key->keydata.pkey;
- 	int bits;
-@@ -195,7 +195,7 @@ opensslrsa_verify2(dst_context_t *dctx, int maxbits, const isc_region_t *sig) {
- 		dctx->key->key_alg == DST_ALG_RSASHA256 ||
- 		dctx->key->key_alg == DST_ALG_RSASHA512);
- 
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	rsa = EVP_PKEY_get1_RSA(pkey);
- 	if (rsa == NULL) {
- 		return (dst__openssl_toresult(DST_R_OPENSSLFAILURE));
-@@ -213,7 +213,7 @@ opensslrsa_verify2(dst_context_t *dctx, int maxbits, const isc_region_t *sig) {
- 	}
- 	bits = BN_num_bits(e);
- 	BN_free(e);
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 
- 	if (bits > maxbits && maxbits != 0) {
- 		return (DST_R_VERIFYFAILURE);
-@@ -243,7 +243,7 @@ opensslrsa_compare(const dst_key_t *key1, const dst_key_t *key2) {
- 	int status;
- 	EVP_PKEY *pkey1 = key1->keydata.pkey;
- 	EVP_PKEY *pkey2 = key2->keydata.pkey;
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	RSA *rsa1 = NULL;
- 	RSA *rsa2 = NULL;
- 	const BIGNUM *d1 = NULL, *d2 = NULL;
-@@ -253,7 +253,7 @@ opensslrsa_compare(const dst_key_t *key1, const dst_key_t *key2) {
- 	BIGNUM *d1 = NULL, *d2 = NULL;
- 	BIGNUM *p1 = NULL, *p2 = NULL;
- 	BIGNUM *q1 = NULL, *q2 = NULL;
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 
- 	if (pkey1 == NULL && pkey2 == NULL) {
- 		return (true);
-@@ -267,7 +267,7 @@ opensslrsa_compare(const dst_key_t *key1, const dst_key_t *key2) {
- 		DST_RET(false);
- 	}
- 
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	rsa1 = EVP_PKEY_get1_RSA(pkey1);
- 	rsa2 = EVP_PKEY_get1_RSA(pkey2);
- 	if (rsa1 == NULL && rsa2 == NULL) {
-@@ -280,14 +280,14 @@ opensslrsa_compare(const dst_key_t *key1, const dst_key_t *key2) {
- #else
- 	EVP_PKEY_get_bn_param(pkey1, OSSL_PKEY_PARAM_RSA_D, &d1);
- 	EVP_PKEY_get_bn_param(pkey2, OSSL_PKEY_PARAM_RSA_D, &d2);
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 
- 	if (d1 != NULL || d2 != NULL) {
- 		if (d1 == NULL || d2 == NULL) {
- 			DST_RET(false);
- 		}
- 
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 		RSA_get0_factors(rsa1, &p1, &q1);
- 		RSA_get0_factors(rsa2, &p2, &q2);
- #else
-@@ -295,7 +295,7 @@ opensslrsa_compare(const dst_key_t *key1, const dst_key_t *key2) {
- 		EVP_PKEY_get_bn_param(pkey1, OSSL_PKEY_PARAM_RSA_FACTOR2, &q1);
- 		EVP_PKEY_get_bn_param(pkey2, OSSL_PKEY_PARAM_RSA_FACTOR1, &p2);
- 		EVP_PKEY_get_bn_param(pkey2, OSSL_PKEY_PARAM_RSA_FACTOR2, &q2);
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 
- 		if (BN_cmp(d1, d2) != 0 || BN_cmp(p1, p2) != 0 ||
- 		    BN_cmp(q1, q2) != 0) {
-@@ -306,7 +306,7 @@ opensslrsa_compare(const dst_key_t *key1, const dst_key_t *key2) {
- 	ret = true;
- 
- err:
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	if (rsa1 != NULL) {
- 		RSA_free(rsa1);
- 	}
-@@ -332,12 +332,12 @@ err:
- 	if (q2 != NULL) {
- 		BN_clear_free(q2);
- 	}
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 
- 	return (ret);
- }
- 
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- static int
- progress_cb(int p, int n, BN_GENCB *cb) {
- 	union {
-@@ -368,7 +368,7 @@ progress_cb(EVP_PKEY_CTX *ctx) {
- 	}
- 	return (1);
- }
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 
- static isc_result_t
- opensslrsa_generate(dst_key_t *key, int exp, void (*callback)(int)) {
-@@ -378,7 +378,7 @@ opensslrsa_generate(dst_key_t *key, int exp, void (*callback)(int)) {
- 		void (*fptr)(int);
- 	} u;
- 	BIGNUM *e = BN_new();
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	RSA *rsa = RSA_new();
- 	EVP_PKEY *pkey = EVP_PKEY_new();
- #if !HAVE_BN_GENCB_NEW
-@@ -388,9 +388,9 @@ opensslrsa_generate(dst_key_t *key, int exp, void (*callback)(int)) {
- #else
- 	EVP_PKEY_CTX *ctx = EVP_PKEY_CTX_new_from_name(NULL, "RSA", NULL);
- 	EVP_PKEY *pkey = NULL;
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	if (e == NULL || rsa == NULL || pkey == NULL || cb == NULL) {
- 		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
- 	}
-@@ -398,7 +398,7 @@ opensslrsa_generate(dst_key_t *key, int exp, void (*callback)(int)) {
- 	if (e == NULL || ctx == NULL) {
- 		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
- 	}
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 
- 	/*
- 	 * Reject incorrect RSA key lengths.
-@@ -437,7 +437,7 @@ opensslrsa_generate(dst_key_t *key, int exp, void (*callback)(int)) {
- 		BN_set_bit(e, 32);
- 	}
- 
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	if (EVP_PKEY_set1_RSA(pkey, rsa) != 1) {
- 		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
- 	}
-@@ -476,7 +476,7 @@ opensslrsa_generate(dst_key_t *key, int exp, void (*callback)(int)) {
- 		DST_RET(dst__openssl_toresult2("EVP_PKEY_keygen",
- 					       DST_R_OPENSSLFAILURE));
- 	}
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 
- 	key->keydata.pkey = pkey;
- 	pkey = NULL;
-@@ -486,7 +486,7 @@ err:
- 	if (pkey != NULL) {
- 		EVP_PKEY_free(pkey);
- 	}
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	if (rsa != NULL) {
- 		RSA_free(rsa);
- 	}
-@@ -497,7 +497,7 @@ err:
- 	if (ctx != NULL) {
- 		EVP_PKEY_CTX_free(ctx);
- 	}
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 	if (e != NULL) {
- 		BN_free(e);
- 	}
-@@ -508,12 +508,12 @@ static bool
- opensslrsa_isprivate(const dst_key_t *key) {
- 	bool ret;
- 	EVP_PKEY *pkey;
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	RSA *rsa;
- 	const BIGNUM *d = NULL;
- #else
- 	BIGNUM *d = NULL;
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 
- 	REQUIRE(key->key_alg == DST_ALG_RSASHA1 ||
- 		key->key_alg == DST_ALG_NSEC3RSASHA1 ||
-@@ -525,7 +525,7 @@ opensslrsa_isprivate(const dst_key_t *key) {
- 		return (false);
- 	}
- 
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	rsa = EVP_PKEY_get1_RSA(pkey);
- 	INSIST(rsa != NULL);
- 
-@@ -542,7 +542,7 @@ opensslrsa_isprivate(const dst_key_t *key) {
- 	if (d != NULL) {
- 		BN_clear_free(d);
- 	}
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 
- 	return (ret);
- }
-@@ -564,19 +564,19 @@ opensslrsa_todns(const dst_key_t *key, isc_buffer_t *data) {
- 	unsigned int mod_bytes;
- 	isc_result_t ret;
- 	EVP_PKEY *pkey;
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	RSA *rsa;
- 	const BIGNUM *e = NULL, *n = NULL;
- #else
- 	BIGNUM *e = NULL, *n = NULL;
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 
- 	REQUIRE(key->keydata.pkey != NULL);
- 
- 	pkey = key->keydata.pkey;
- 	isc_buffer_availableregion(data, &r);
- 
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	rsa = EVP_PKEY_get1_RSA(pkey);
- 	if (rsa == NULL) {
- 		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
-@@ -588,7 +588,7 @@ opensslrsa_todns(const dst_key_t *key, isc_buffer_t *data) {
- 	if (e == NULL || n == NULL) {
- 		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
- 	}
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 
- 	mod_bytes = BN_num_bytes(n);
- 	e_bytes = BN_num_bytes(e);
-@@ -621,7 +621,7 @@ opensslrsa_todns(const dst_key_t *key, isc_buffer_t *data) {
- 
- 	ret = ISC_R_SUCCESS;
- err:
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	if (rsa != NULL) {
- 		RSA_free(rsa);
- 	}
-@@ -632,7 +632,7 @@ err:
- 	if (n != NULL) {
- 		BN_free(n);
- 	}
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 	return (ret);
- }
- 
-@@ -643,13 +643,13 @@ opensslrsa_fromdns(dst_key_t *key, isc_buffer_t *data) {
- 	isc_region_t r;
- 	unsigned int e_bytes;
- 	unsigned int length;
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	RSA *rsa = NULL;
- #else
- 	OSSL_PARAM_BLD *bld = NULL;
- 	OSSL_PARAM *params = NULL;
- 	EVP_PKEY_CTX *ctx = NULL;
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 	EVP_PKEY *pkey = NULL;
- 	BIGNUM *e = NULL, *n = NULL;
- 
-@@ -691,7 +691,7 @@ opensslrsa_fromdns(dst_key_t *key, isc_buffer_t *data) {
- 
- 	isc_buffer_forward(data, length);
- 
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	rsa = RSA_new();
- 	if (rsa == NULL) {
- 		DST_RET(dst__openssl_toresult2("RSA_new",
-@@ -749,7 +749,7 @@ opensslrsa_fromdns(dst_key_t *key, isc_buffer_t *data) {
- 		DST_RET(dst__openssl_toresult2("EVP_PKEY_fromdata",
- 					       DST_R_OPENSSLFAILURE));
- 	}
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 
- 	key->keydata.pkey = pkey;
- 	pkey = NULL;
-@@ -757,7 +757,7 @@ opensslrsa_fromdns(dst_key_t *key, isc_buffer_t *data) {
- 
- err:
- 
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	if (rsa != NULL) {
- 		RSA_free(rsa);
- 	}
-@@ -771,7 +771,7 @@ err:
- 	if (bld != NULL) {
- 		OSSL_PARAM_BLD_free(bld);
- 	}
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 	if (n != NULL) {
- 		BN_free(n);
- 	}
-@@ -792,7 +792,7 @@ opensslrsa_tofile(const dst_key_t *key, const char *directory) {
- 	unsigned char *bufs[8] = { NULL };
- 	unsigned short i = 0;
- 	EVP_PKEY *pkey;
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	RSA *rsa = NULL;
- 	const BIGNUM *n = NULL, *e = NULL, *d = NULL;
- 	const BIGNUM *p = NULL, *q = NULL;
-@@ -801,7 +801,7 @@ opensslrsa_tofile(const dst_key_t *key, const char *directory) {
- 	BIGNUM *n = NULL, *e = NULL, *d = NULL;
- 	BIGNUM *p = NULL, *q = NULL;
- 	BIGNUM *dmp1 = NULL, *dmq1 = NULL, *iqmp = NULL;
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 
- 	if (key->keydata.pkey == NULL) {
- 		DST_RET(DST_R_NULLKEY);
-@@ -812,7 +812,7 @@ opensslrsa_tofile(const dst_key_t *key, const char *directory) {
- 	}
- 
- 	pkey = key->keydata.pkey;
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	rsa = EVP_PKEY_get1_RSA(pkey);
- 	if (rsa == NULL) {
- 		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
-@@ -829,7 +829,7 @@ opensslrsa_tofile(const dst_key_t *key, const char *directory) {
- 	EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_RSA_EXPONENT1, &dmp1);
- 	EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_RSA_EXPONENT2, &dmq1);
- 	EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_RSA_COEFFICIENT1, &iqmp);
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 
- 	if (n == NULL || e == NULL) {
- 		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
-@@ -935,7 +935,7 @@ err:
- 				    priv.elements[i].length);
- 		}
- 	}
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	RSA_free(rsa);
- #else
- 	if (n != NULL) {
-@@ -962,12 +962,12 @@ err:
- 	if (iqmp != NULL) {
- 		BN_clear_free(iqmp);
- 	}
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 
- 	return (ret);
- }
- 
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- static isc_result_t
- rsa_check(RSA *rsa, RSA *pub) {
- 	const BIGNUM *n1 = NULL, *n2 = NULL;
-@@ -1079,14 +1079,14 @@ err:
- 
- 	return (ret);
- }
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 
- static isc_result_t
- opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
- 	dst_private_t priv;
- 	isc_result_t ret;
- 	int i;
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	RSA *rsa = NULL, *pubrsa = NULL;
- 	const BIGNUM *ex = NULL;
- #else
-@@ -1094,7 +1094,7 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
- 	OSSL_PARAM *params = NULL;
- 	EVP_PKEY_CTX *ctx = NULL;
- 	BIGNUM *ex = NULL;
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- #if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000
- 	ENGINE *ep = NULL;
- #endif /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */
-@@ -1126,11 +1126,11 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
- 		DST_RET(ISC_R_SUCCESS);
- 	}
- 
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	if (pub != NULL && pub->keydata.pkey != NULL) {
- 		pubrsa = EVP_PKEY_get1_RSA(pub->keydata.pkey);
- 	}
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 
- 	for (i = 0; i < priv.nelements; i++) {
- 		switch (priv.elements[i].tag) {
-@@ -1249,7 +1249,7 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
- 		}
- 	}
- 
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	rsa = RSA_new();
- 	if (rsa == NULL) {
- 		DST_RET(ISC_R_NOMEMORY);
-@@ -1361,7 +1361,7 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
- 	    ISC_R_SUCCESS) {
- 		DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
- 	}
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 
- 	if (BN_num_bits(e) > RSA_MAX_PUBEXP_BITS) {
- 		DST_RET(ISC_R_RANGE);
-@@ -1375,7 +1375,7 @@ err:
- 	if (pkey != NULL) {
- 		EVP_PKEY_free(pkey);
- 	}
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	if (rsa != NULL) {
- 		RSA_free(rsa);
- 	}
-@@ -1419,7 +1419,7 @@ err:
- 	if (iqmp != NULL) {
- 		BN_clear_free(iqmp);
- 	}
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
-+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
- 	if (ret != ISC_R_SUCCESS) {
- 		key->keydata.generic = NULL;
- 	}
-@@ -1643,7 +1643,7 @@ check_algorithm(unsigned char algorithm) {
- 	int status;
- 	isc_result_t ret = ISC_R_SUCCESS;
- 	size_t len;
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	RSA *rsa = NULL;
- #else
- 	OSSL_PARAM *params = NULL;
-@@ -1689,7 +1689,7 @@ check_algorithm(unsigned char algorithm) {
- 		DST_RET(ISC_R_NOMEMORY);
- 	}
- 
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	rsa = RSA_new();
- 	if (rsa == NULL) {
- 		DST_RET(dst__openssl_toresult2("RSA_new",
-@@ -1762,7 +1762,7 @@ check_algorithm(unsigned char algorithm) {
- err:
- 	BN_free(e);
- 	BN_free(n);
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
- 	if (rsa != NULL) {
- 		RSA_free(rsa);
- 	}
--- 
-2.37.3
-
diff --git a/bind-9.18-pkcs11-engine-init.patch b/bind-9.18-pkcs11-engine-init.patch
deleted file mode 100644
index 5c0c6c4..0000000
--- a/bind-9.18-pkcs11-engine-init.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-From 87a2eac7a8264a0e8d64a8db85d44ec22454e256 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Wed, 7 Sep 2022 13:46:31 +0200
-Subject: [PATCH 1/3] Add ENGINE_init and ENGINE_finish calls
-
-According to manual page of ENGINE_init, it should be called explicitly
-before any key operations happens. Make it active whole lifetime.
----
- lib/dns/openssl_link.c | 9 ++++++++-
- 1 file changed, 8 insertions(+), 1 deletion(-)
-
-diff --git a/lib/dns/openssl_link.c b/lib/dns/openssl_link.c
-index 333f34cb37..a3f63885fa 100644
---- a/lib/dns/openssl_link.c
-+++ b/lib/dns/openssl_link.c
-@@ -85,14 +85,20 @@ dst__openssl_init(const char *engine) {
- 			result = DST_R_NOENGINE;
- 			goto cleanup_rm;
- 		}
-+		if (!ENGINE_init(e)) {
-+			result = DST_R_NOENGINE;
-+			goto cleanup_rm;
-+		}
- 		/* This will init the engine. */
- 		if (!ENGINE_set_default(e, ENGINE_METHOD_ALL)) {
- 			result = DST_R_NOENGINE;
--			goto cleanup_rm;
-+			goto cleanup_init;
- 		}
- 	}
- 
- 	return (ISC_R_SUCCESS);
-+cleanup_init:
-+	ENGINE_finish(e);
- cleanup_rm:
- 	if (e != NULL) {
- 		ENGINE_free(e);
-@@ -108,6 +114,7 @@ void
- dst__openssl_destroy(void) {
- #if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000
- 	if (e != NULL) {
-+		ENGINE_finish(e);
- 		ENGINE_free(e);
- 	}
- 	e = NULL;
--- 
-2.37.2
-
diff --git a/bind-9.18-pkcs11-engine-remove-deadcode.patch b/bind-9.18-pkcs11-engine-remove-deadcode.patch
deleted file mode 100644
index 7586395..0000000
--- a/bind-9.18-pkcs11-engine-remove-deadcode.patch
+++ /dev/null
@@ -1,245 +0,0 @@
-From cc8edfc6670ba97434bc5acb595539fd9c7d9123 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Thu, 8 Sep 2022 16:33:38 +0200
-Subject: [PATCH 3/3] Remove engine related parts for OpenSSL 3.0
-
-OpenSSL just cannot work with mixing ENGINE_* api mixed with OSSL_PARAM
-builders. But it can be built in legacy mode, where deprecated but still
-working API would be used.
-
-It can work under OpenSSL 3.0, but only if using legacy code paths
-matching OpenSSL 1.1 calls and functions.
-
-Remove fromlabel processing by OpenSSL 3.0 only functions. They can
-return later with a proper provider support for pkcs11.
----
- lib/dns/opensslecdsa_link.c | 55 -------------------------------------
- lib/dns/opensslrsa_link.c   | 32 ---------------------
- 2 files changed, 87 deletions(-)
-
-diff --git a/lib/dns/opensslecdsa_link.c b/lib/dns/opensslecdsa_link.c
-index 04f0d80b5e..f04f076e42 100644
---- a/lib/dns/opensslecdsa_link.c
-+++ b/lib/dns/opensslecdsa_link.c
-@@ -1311,15 +1311,9 @@ opensslecdsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
- #if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000
- 	isc_result_t ret = ISC_R_SUCCESS;
- 	ENGINE *e;
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
- 	EC_KEY *eckey = NULL;
- 	EC_KEY *pubeckey = NULL;
- 	int group_nid;
--#else
--	size_t len;
--	const char *curve_name, *nist_curve_name;
--	char buf[128]; /* Sufficient for all of the supported curves' names. */
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
- 	EVP_PKEY *pkey = NULL;
- 	EVP_PKEY *pubpkey = NULL;
- 
-@@ -1336,22 +1330,11 @@ opensslecdsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
- 		DST_RET(DST_R_NOENGINE);
- 	}
- 
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
- 	if (key->key_alg == DST_ALG_ECDSA256) {
- 		group_nid = NID_X9_62_prime256v1;
- 	} else {
- 		group_nid = NID_secp384r1;
- 	}
--#else
--	/* Get the expected curve names */
--	if (key->key_alg == DST_ALG_ECDSA256) {
--		curve_name = "prime256v1";
--		nist_curve_name = "P-256";
--	} else {
--		curve_name = "secp384r1";
--		nist_curve_name = "P-384";
--	}
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
- 
- 	/* Load private key. */
- 	pkey = ENGINE_load_private_key(e, label, NULL, NULL);
-@@ -1363,7 +1346,6 @@ opensslecdsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
- 	if (EVP_PKEY_base_id(pkey) != EVP_PKEY_EC) {
- 		DST_RET(DST_R_INVALIDPRIVATEKEY);
- 	}
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
- 	eckey = EVP_PKEY_get1_EC_KEY(pkey);
- 	if (eckey == NULL) {
- 		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
-@@ -1371,20 +1353,6 @@ opensslecdsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
- 	if (EC_GROUP_get_curve_name(EC_KEY_get0_group(eckey)) != group_nid) {
- 		DST_RET(DST_R_INVALIDPRIVATEKEY);
- 	}
--#else
--	len = 0;
--	if (EVP_PKEY_get_utf8_string_param(pkey, OSSL_PKEY_PARAM_GROUP_NAME,
--					   buf, sizeof buf, &len) != 1 ||
--	    len == 0 || len >= sizeof buf)
--	{
--		DST_RET(DST_R_INVALIDPRIVATEKEY);
--	}
--	if (strncasecmp(buf, curve_name, strlen(curve_name)) != 0 &&
--	    strncasecmp(buf, nist_curve_name, strlen(nist_curve_name)) != 0)
--	{
--		DST_RET(DST_R_INVALIDPRIVATEKEY);
--	}
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
- 
- 	/* Load public key. */
- 	pubpkey = ENGINE_load_public_key(e, label, NULL, NULL);
-@@ -1396,7 +1364,6 @@ opensslecdsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
- 	if (EVP_PKEY_base_id(pubpkey) != EVP_PKEY_EC) {
- 		DST_RET(DST_R_INVALIDPUBLICKEY);
- 	}
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
- 	pubeckey = EVP_PKEY_get1_EC_KEY(pubpkey);
- 	if (pubeckey == NULL) {
- 		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
-@@ -1404,30 +1371,10 @@ opensslecdsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
- 	if (EC_GROUP_get_curve_name(EC_KEY_get0_group(pubeckey)) != group_nid) {
- 		DST_RET(DST_R_INVALIDPUBLICKEY);
- 	}
--#else
--	len = 0;
--	if (EVP_PKEY_get_utf8_string_param(pubpkey, OSSL_PKEY_PARAM_GROUP_NAME,
--					   buf, sizeof buf, &len) != 1 ||
--	    len == 0 || len >= sizeof buf)
--	{
--		DST_RET(DST_R_INVALIDPUBLICKEY);
--	}
--	if (strncasecmp(buf, curve_name, strlen(curve_name)) != 0 &&
--	    strncasecmp(buf, nist_curve_name, strlen(nist_curve_name)) != 0)
--	{
--		DST_RET(DST_R_INVALIDPUBLICKEY);
--	}
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
- 
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
- 	if (ecdsa_check(eckey, pubeckey) != ISC_R_SUCCESS) {
- 		DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
- 	}
--#else
--	if (ecdsa_check(&pkey, pubpkey) != ISC_R_SUCCESS) {
--		DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
--	}
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
- 
- 	key->label = isc_mem_strdup(key->mctx, label);
- 	key->engine = isc_mem_strdup(key->mctx, engine);
-@@ -1442,14 +1389,12 @@ err:
- 	if (pkey != NULL) {
- 		EVP_PKEY_free(pkey);
- 	}
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
- 	if (pubeckey != NULL) {
- 		EC_KEY_free(pubeckey);
- 	}
- 	if (eckey != NULL) {
- 		EC_KEY_free(eckey);
- 	}
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
- 
- 	return (ret);
- #else
-diff --git a/lib/dns/opensslrsa_link.c b/lib/dns/opensslrsa_link.c
-index 867b486a2f..cf350610ba 100644
---- a/lib/dns/opensslrsa_link.c
-+++ b/lib/dns/opensslrsa_link.c
-@@ -1167,7 +1167,6 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
- 		key->engine = isc_mem_strdup(key->mctx, engine);
- 		key->label = isc_mem_strdup(key->mctx, label);
- 
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
- 		rsa = EVP_PKEY_get1_RSA(pkey);
- 		if (rsa == NULL) {
- 			DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
-@@ -1176,16 +1175,6 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
- 			DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
- 		}
- 		RSA_get0_key(rsa, NULL, &ex, NULL);
--#else
--		if (rsa_check(pkey, pub != NULL ? pub->keydata.pkey : NULL) !=
--		    ISC_R_SUCCESS) {
--			DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
--		}
--		if (EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_RSA_E, &ex) !=
--		    1) {
--			DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
--		}
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
- 
- 		if (ex == NULL) {
- 			DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
-@@ -1437,12 +1426,8 @@ opensslrsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
- 	ENGINE *e = NULL;
- 	isc_result_t ret = ISC_R_SUCCESS;
- 	EVP_PKEY *pkey = NULL, *pubpkey = NULL;
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
- 	RSA *rsa = NULL, *pubrsa = NULL;
- 	const BIGNUM *ex = NULL;
--#else
--	BIGNUM *ex = NULL;
--#endif
- 
- 	UNUSED(pin);
- 
-@@ -1459,12 +1444,10 @@ opensslrsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
- 		DST_RET(dst__openssl_toresult2("ENGINE_load_public_key",
- 					       DST_R_OPENSSLFAILURE));
- 	}
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
- 	pubrsa = EVP_PKEY_get1_RSA(pubpkey);
- 	if (pubrsa == NULL) {
- 		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
- 	}
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
- 
- 	pkey = ENGINE_load_private_key(e, label, NULL, NULL);
- 	if (pkey == NULL) {
-@@ -1475,7 +1458,6 @@ opensslrsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
- 	key->engine = isc_mem_strdup(key->mctx, engine);
- 	key->label = isc_mem_strdup(key->mctx, label);
- 
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
- 	rsa = EVP_PKEY_get1_RSA(pkey);
- 	if (rsa == NULL) {
- 		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
-@@ -1484,14 +1466,6 @@ opensslrsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
- 		DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
- 	}
- 	RSA_get0_key(rsa, NULL, &ex, NULL);
--#else
--	if (rsa_check(pkey, pubpkey) != ISC_R_SUCCESS) {
--		DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
--	}
--	if (EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_RSA_E, &ex) != 1) {
--		DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
--	}
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
- 
- 	if (ex == NULL) {
- 		DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
-@@ -1505,18 +1479,12 @@ opensslrsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
- 	pkey = NULL;
- 
- err:
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
- 	if (rsa != NULL) {
- 		RSA_free(rsa);
- 	}
- 	if (pubrsa != NULL) {
- 		RSA_free(pubrsa);
- 	}
--#else
--	if (ex != NULL) {
--		BN_free(ex);
--	}
--#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
- 	if (pkey != NULL) {
- 		EVP_PKEY_free(pkey);
- 	}
--- 
-2.37.2
-
diff --git a/bind.spec b/bind.spec
index 20bb29e..ef86ef1 100644
--- a/bind.spec
+++ b/bind.spec
@@ -62,8 +62,8 @@ Conflicts: %1 \
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPL-2.0
-Version:  9.18.7
-Release:  3%{?dist}
+Version:  9.18.8
+Release:  1%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -99,16 +99,8 @@ Source49: named-chroot.files
 Patch10: bind-9.5-PIE.patch
 Patch16: bind-9.16-redhat_doc.patch
 Patch22: bind-9.11-fips-tests.patch
-# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/5385
-# https://bugzilla.redhat.com/show_bug.cgi?id=2122841
-Patch23: bind-9.18-pkcs11-engine-init.patch
-Patch24: bind-9.18-pkcs11-engine-compat-api.patch
-Patch25: bind-9.18-pkcs11-engine-remove-deadcode.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=2122010
 Patch26: bind-9.18-unittest-netmgr-unstable.patch
-# Fix building ARM docs in EPEL9
-# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/6815
-Patch27: bind-9.18-doc-arm-rhel9.patch
 
 %{?systemd_ordering}
 Requires:       coreutils
@@ -957,6 +949,9 @@ fi;
 %endif
 
 %changelog
+* Sat Oct 22 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.8-1
+- Update to 9.18.8 (#2136100)
+
 * Fri Sep 30 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.7-3
 - Update License to SPDX identifier
 - Enable automatic restart on crashes
diff --git a/sources b/sources
index 25459e0..10c60a2 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.18.7.tar.xz) = 2cdceb4125b8759f5225296c6ffecdbb895b0a27dfcfcd98b04b9ad78552d16c16b0452fb823dc47d11cec21d2c6ecb05a107dd3094f8e7419bb9717d68820c5
-SHA512 (bind-9.18.7.tar.xz.asc) = 40030c2259858f1ba7ce4fbcd523025631ed78687ca87863d0f0bcd0fd530d96052e0601808ffa37e59d574a9a9c84bb2ededc66f730b9eaf560a00a6ef29c48
+SHA512 (bind-9.18.8.tar.xz) = ea6cad5276269a320fa1e666544888ed88b9d058ecab56c82aebff24e841a4ad221ce9c1209b1258884d71f7c03eed4d1c6a7e1922780073644344bc939a0e89
+SHA512 (bind-9.18.8.tar.xz.asc) = 06a880eb3af14e760f52ab5bd666b6512487d724a16a0fdf646ad9a07f17249e68a9a59ddf902f9111aee6450d96ed8dfe36d6fb433808f993d9bbc6dd4e665c

From 21fe71bc4651ed668ae90d3de0f7db80ad262a14 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Sat, 22 Oct 2022 22:57:46 +0200
Subject: [PATCH 323/460] Start using DEFAULT_HMAC configured variable

Do not replace hmac-md5 with fixed algorithm. But use default variable
used by more recent versions.
---
 bind-9.11-fips-tests.patch | 200 +++++++++++++++++++++++++++++--------
 1 file changed, 157 insertions(+), 43 deletions(-)

diff --git a/bind-9.11-fips-tests.patch b/bind-9.11-fips-tests.patch
index 072419f..25f0e76 100644
--- a/bind-9.11-fips-tests.patch
+++ b/bind-9.11-fips-tests.patch
@@ -1,4 +1,4 @@
-From 2ad42c7c23858f12d977526d6ebc3465907d7b1b Mon Sep 17 00:00:00 2001
+From f7d0320466815001b0fdf85f85a436f39463287e Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 2 Aug 2018 23:46:45 +0200
 Subject: [PATCH] FIPS tests changes
@@ -57,6 +57,8 @@ Date:   Wed Mar 7 10:44:23 2018 +0100
     Change tests to not use hmac-md5 algorithms if not required
 
     Use hmac-sha256 instead of default hmac-md5 for allow-query
+
+Use DEFAULT_HMAC configured variable
 ---
  bin/tests/system/acl/ns2/named1.conf.in       |  4 +-
  bin/tests/system/acl/ns2/named2.conf.in       |  4 +-
@@ -73,26 +75,35 @@ Date:   Wed Mar 7 10:44:23 2018 +0100
  .../system/allow-query/ns2/named40.conf.in    |  4 +-
  bin/tests/system/allow-query/tests.sh         | 18 ++---
  bin/tests/system/catz/ns1/named.conf.in       |  2 +-
+ bin/tests/system/catz/ns2/named1.conf.in      |  2 +-
+ bin/tests/system/catz/ns2/named2.conf.in      |  2 +-
  bin/tests/system/checkconf/bad-tsig.conf      |  2 +-
  bin/tests/system/checkconf/good.conf          |  2 +-
+ bin/tests/system/cookie/ns1/named.conf.in     |  2 +-
+ bin/tests/system/dnssec/ns4/named5.conf.in    |  2 +-
  bin/tests/system/feature-test.c               | 14 ++++
  bin/tests/system/notify/ns5/named.conf.in     |  6 +-
  bin/tests/system/notify/tests.sh              |  6 +-
  bin/tests/system/nsupdate/ns1/named.conf.in   |  2 +-
  bin/tests/system/nsupdate/ns2/named.conf.in   |  2 +-
+ bin/tests/system/nsupdate/ns9/named.conf.in   |  2 +-
  bin/tests/system/nsupdate/setup.sh            |  6 +-
  bin/tests/system/nsupdate/tests.sh            |  9 ++-
+ bin/tests/system/rndc/ns2/named.conf.in       |  2 +-
+ bin/tests/system/rndc/ns3/named.conf.in       |  2 +-
  bin/tests/system/rndc/setup.sh                |  2 +-
  bin/tests/system/rndc/tests.sh                | 22 +++---
  bin/tests/system/tsig/ns1/named.conf.in       | 10 +--
+ bin/tests/system/tsig/ns1/rndc5.conf.in       | 10 +++
  bin/tests/system/tsig/setup.sh                |  5 ++
  bin/tests/system/tsig/tests.sh                | 67 ++++++++++++-------
  bin/tests/system/upforwd/ns1/named.conf.in    |  2 +-
  bin/tests/system/upforwd/tests.sh             |  2 +-
- 31 files changed, 147 insertions(+), 106 deletions(-)
+ 39 files changed, 164 insertions(+), 113 deletions(-)
+ create mode 100644 bin/tests/system/tsig/ns1/rndc5.conf.in
 
 diff --git a/bin/tests/system/acl/ns2/named1.conf.in b/bin/tests/system/acl/ns2/named1.conf.in
-index 8787c6a..b781d0b 100644
+index 8787c6a..682ba97 100644
 --- a/bin/tests/system/acl/ns2/named1.conf.in
 +++ b/bin/tests/system/acl/ns2/named1.conf.in
 @@ -35,12 +35,12 @@ options {
@@ -100,18 +111,18 @@ index 8787c6a..b781d0b 100644
  
  key one {
 -	algorithm hmac-md5;
-+	algorithm hmac-sha256;
++	algorithm @DEFAULT_HMAC@;
  	secret "1234abcd8765";
  };
  
  key two {
 -	algorithm hmac-md5;
-+	algorithm hmac-sha256;
++	algorithm @DEFAULT_HMAC@;
  	secret "1234abcd8765";
  };
  
 diff --git a/bin/tests/system/acl/ns2/named2.conf.in b/bin/tests/system/acl/ns2/named2.conf.in
-index a95b4c1..3f3f471 100644
+index a95b4c1..7b1cea6 100644
 --- a/bin/tests/system/acl/ns2/named2.conf.in
 +++ b/bin/tests/system/acl/ns2/named2.conf.in
 @@ -35,12 +35,12 @@ options {
@@ -119,18 +130,18 @@ index a95b4c1..3f3f471 100644
  
  key one {
 -	algorithm hmac-md5;
-+	algorithm hmac-sha256;
++	algorithm @DEFAULT_HMAC@;
  	secret "1234abcd8765";
  };
  
  key two {
 -	algorithm hmac-md5;
-+	algorithm hmac-sha256;
++	algorithm @DEFAULT_HMAC@;
  	secret "1234abcd8765";
  };
  
 diff --git a/bin/tests/system/acl/ns2/named3.conf.in b/bin/tests/system/acl/ns2/named3.conf.in
-index 14cc3fe..9507706 100644
+index 14cc3fe..6b35ba5 100644
 --- a/bin/tests/system/acl/ns2/named3.conf.in
 +++ b/bin/tests/system/acl/ns2/named3.conf.in
 @@ -35,17 +35,17 @@ options {
@@ -138,24 +149,24 @@ index 14cc3fe..9507706 100644
  
  key one {
 -	algorithm hmac-md5;
-+	algorithm hmac-sha256;
++	algorithm @DEFAULT_HMAC@;
  	secret "1234abcd8765";
  };
  
  key two {
 -	algorithm hmac-md5;
-+	algorithm hmac-sha256;
++	algorithm @DEFAULT_HMAC@;
  	secret "1234abcd8765";
  };
  
  key three {
 -	algorithm hmac-md5;
-+	algorithm hmac-sha256;
++	algorithm @DEFAULT_HMAC@;
  	secret "1234abcd8765";
  };
  
 diff --git a/bin/tests/system/acl/ns2/named4.conf.in b/bin/tests/system/acl/ns2/named4.conf.in
-index 77cf110..029c91b 100644
+index 77cf110..b23a1ca 100644
 --- a/bin/tests/system/acl/ns2/named4.conf.in
 +++ b/bin/tests/system/acl/ns2/named4.conf.in
 @@ -35,12 +35,12 @@ options {
@@ -163,18 +174,18 @@ index 77cf110..029c91b 100644
  
  key one {
 -	algorithm hmac-md5;
-+	algorithm hmac-sha256;
++	algorithm @DEFAULT_HMAC@;
  	secret "1234abcd8765";
  };
  
  key two {
 -	algorithm hmac-md5;
-+	algorithm hmac-sha256;
++	algorithm @DEFAULT_HMAC@;
  	secret "1234abcd8765";
  };
  
 diff --git a/bin/tests/system/acl/ns2/named5.conf.in b/bin/tests/system/acl/ns2/named5.conf.in
-index 5ccabf9..6154797 100644
+index 5ccabf9..52791aa 100644
 --- a/bin/tests/system/acl/ns2/named5.conf.in
 +++ b/bin/tests/system/acl/ns2/named5.conf.in
 @@ -37,12 +37,12 @@ options {
@@ -182,13 +193,13 @@ index 5ccabf9..6154797 100644
  
  key one {
 -	algorithm hmac-md5;
-+	algorithm hmac-sha256;
++	algorithm @DEFAULT_HMAC@;
  	secret "1234abcd8765";
  };
  
  key two {
 -	algorithm hmac-md5;
-+	algorithm hmac-sha256;
++	algorithm @DEFAULT_HMAC@;
  	secret "1234abcd8765";
  };
  
@@ -319,7 +330,7 @@ index ad98fa1..7a7ff4a 100644
  
  echo_i "testing allow-query-on ACL processing"
 diff --git a/bin/tests/system/allow-query/ns2/named10.conf.in b/bin/tests/system/allow-query/ns2/named10.conf.in
-index b91d19a..7d777c2 100644
+index b91d19a..ae485e8 100644
 --- a/bin/tests/system/allow-query/ns2/named10.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named10.conf.in
 @@ -12,7 +12,7 @@
@@ -327,12 +338,12 @@ index b91d19a..7d777c2 100644
  
  key one {
 -	algorithm hmac-md5;
-+	algorithm hmac-sha256;
++	algorithm @DEFAULT_HMAC@;
  	secret "1234abcd8765";
  };
  
 diff --git a/bin/tests/system/allow-query/ns2/named11.conf.in b/bin/tests/system/allow-query/ns2/named11.conf.in
-index 308c4ca..00f6f40 100644
+index 308c4ca..8a5e806 100644
 --- a/bin/tests/system/allow-query/ns2/named11.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named11.conf.in
 @@ -12,12 +12,12 @@
@@ -340,18 +351,18 @@ index 308c4ca..00f6f40 100644
  
  key one {
 -	algorithm hmac-md5;
-+	algorithm hmac-sha256;
++	algorithm @DEFAULT_HMAC@;
  	secret "1234abcd8765";
  };
  
  key two {
 -	algorithm hmac-md5;
-+	algorithm hmac-sha256;
++	algorithm @DEFAULT_HMAC@;
  	secret "1234efgh8765";
  };
  
 diff --git a/bin/tests/system/allow-query/ns2/named12.conf.in b/bin/tests/system/allow-query/ns2/named12.conf.in
-index 6b0fe55..491e514 100644
+index 6b0fe55..a10c6d0 100644
 --- a/bin/tests/system/allow-query/ns2/named12.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named12.conf.in
 @@ -12,7 +12,7 @@
@@ -359,12 +370,12 @@ index 6b0fe55..491e514 100644
  
  key one {
 -	algorithm hmac-md5;
-+	algorithm hmac-sha256;
++	algorithm @DEFAULT_HMAC@;
  	secret "1234abcd8765";
  };
  
 diff --git a/bin/tests/system/allow-query/ns2/named30.conf.in b/bin/tests/system/allow-query/ns2/named30.conf.in
-index aefc474..7c06596 100644
+index aefc474..52981a7 100644
 --- a/bin/tests/system/allow-query/ns2/named30.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named30.conf.in
 @@ -12,7 +12,7 @@
@@ -372,12 +383,12 @@ index aefc474..7c06596 100644
  
  key one {
 -	algorithm hmac-md5;
-+	algorithm hmac-sha256;
++	algorithm @DEFAULT_HMAC@;
  	secret "1234abcd8765";
  };
  
 diff --git a/bin/tests/system/allow-query/ns2/named31.conf.in b/bin/tests/system/allow-query/ns2/named31.conf.in
-index 27eccc2..eecb990 100644
+index 27eccc2..f627870 100644
 --- a/bin/tests/system/allow-query/ns2/named31.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named31.conf.in
 @@ -12,12 +12,12 @@
@@ -385,18 +396,18 @@ index 27eccc2..eecb990 100644
  
  key one {
 -	algorithm hmac-md5;
-+	algorithm hmac-sha256;
++	algorithm @DEFAULT_HMAC@;
  	secret "1234abcd8765";
  };
  
  key two {
 -	algorithm hmac-md5;
-+	algorithm hmac-sha256;
++	algorithm @DEFAULT_HMAC@;
  	secret "1234efgh8765";
  };
  
 diff --git a/bin/tests/system/allow-query/ns2/named32.conf.in b/bin/tests/system/allow-query/ns2/named32.conf.in
-index adbb203..744d122 100644
+index adbb203..6fd516b 100644
 --- a/bin/tests/system/allow-query/ns2/named32.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named32.conf.in
 @@ -12,7 +12,7 @@
@@ -404,12 +415,12 @@ index adbb203..744d122 100644
  
  key one {
 -	algorithm hmac-md5;
-+	algorithm hmac-sha256;
++	algorithm @DEFAULT_HMAC@;
  	secret "1234abcd8765";
  };
  
 diff --git a/bin/tests/system/allow-query/ns2/named40.conf.in b/bin/tests/system/allow-query/ns2/named40.conf.in
-index 364f94b..9518f82 100644
+index 364f94b..de37915 100644
 --- a/bin/tests/system/allow-query/ns2/named40.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named40.conf.in
 @@ -16,12 +16,12 @@ acl accept { 10.53.0.2; };
@@ -417,13 +428,13 @@ index 364f94b..9518f82 100644
  
  key one {
 -	algorithm hmac-md5;
-+	algorithm hmac-sha256;
++	algorithm @DEFAULT_HMAC@;
  	secret "1234abcd8765";
  };
  
  key two {
 -	algorithm hmac-md5;
-+	algorithm hmac-sha256;
++	algorithm @DEFAULT_HMAC@;
  	secret "1234efgh8765";
  };
  
@@ -513,7 +524,7 @@ index 01a13cf..3711c63 100644
  grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1
  grep '^a.keydisallow.example' dig.out.ns2.$n > /dev/null && ret=1
 diff --git a/bin/tests/system/catz/ns1/named.conf.in b/bin/tests/system/catz/ns1/named.conf.in
-index 3a8e401..82e720d 100644
+index 3a8e401..052ae3f 100644
 --- a/bin/tests/system/catz/ns1/named.conf.in
 +++ b/bin/tests/system/catz/ns1/named.conf.in
 @@ -122,7 +122,7 @@ view "ch" ch {
@@ -521,10 +532,34 @@ index 3a8e401..82e720d 100644
  key tsig_key. {
  	secret "LSAnCU+Z";
 -	algorithm hmac-md5;
-+	algorithm hmac-sha256;
++	algorithm @DEFAULT_HMAC@;
  };
  
  key next_key. {
+diff --git a/bin/tests/system/catz/ns2/named1.conf.in b/bin/tests/system/catz/ns2/named1.conf.in
+index 23383ed..5a7babd 100644
+--- a/bin/tests/system/catz/ns2/named1.conf.in
++++ b/bin/tests/system/catz/ns2/named1.conf.in
+@@ -165,7 +165,7 @@ view "ch" ch {
+ 
+ key tsig_key. {
+ 	secret "LSAnCU+Z";
+-	algorithm hmac-md5;
++	algorithm @DEFAULT_HMAC@;
+ };
+ 
+ key next_key. {
+diff --git a/bin/tests/system/catz/ns2/named2.conf.in b/bin/tests/system/catz/ns2/named2.conf.in
+index 62b76a6..cd5f2b9 100644
+--- a/bin/tests/system/catz/ns2/named2.conf.in
++++ b/bin/tests/system/catz/ns2/named2.conf.in
+@@ -122,5 +122,5 @@ view "ch" ch {
+ 
+ key tsig_key. {
+ 	secret "LSAnCU+Z";
+-	algorithm hmac-md5;
++	algorithm @DEFAULT_HMAC@;
+ };
 diff --git a/bin/tests/system/checkconf/bad-tsig.conf b/bin/tests/system/checkconf/bad-tsig.conf
 index 4af25b0..9f202d5 100644
 --- a/bin/tests/system/checkconf/bad-tsig.conf
@@ -550,6 +585,30 @@ index 154bf75..e7a05cd 100644
 +	algorithm "hmac-sha256";
  	secret "qwertyuiopasdfgh";
  };
+diff --git a/bin/tests/system/cookie/ns1/named.conf.in b/bin/tests/system/cookie/ns1/named.conf.in
+index 1304303..e9c28c6 100644
+--- a/bin/tests/system/cookie/ns1/named.conf.in
++++ b/bin/tests/system/cookie/ns1/named.conf.in
+@@ -18,7 +18,7 @@ key rndc_key {
+ 
+ key foo {
+ 	secret "aaaaaaaaaaaa";
+-	algorithm hmac-sha256;
++	algorithm @DEFAULT_HMAC@;
+ };
+ 
+ server 10.53.0.10 {
+diff --git a/bin/tests/system/dnssec/ns4/named5.conf.in b/bin/tests/system/dnssec/ns4/named5.conf.in
+index f1b817a..e457062 100644
+--- a/bin/tests/system/dnssec/ns4/named5.conf.in
++++ b/bin/tests/system/dnssec/ns4/named5.conf.in
+@@ -35,5 +35,5 @@ controls {
+ 
+ key auth {
+ 	secret "1234abcd8765";
+-	algorithm hmac-sha256;
++	algorithm @DEFAULT_HMAC@;
+ };
 diff --git a/bin/tests/system/feature-test.c b/bin/tests/system/feature-test.c
 index 3435c91..aaaa264 100644
 --- a/bin/tests/system/feature-test.c
@@ -583,7 +642,7 @@ index 3435c91..aaaa264 100644
  #if defined(IPPROTO_IPV6) && defined(IPV6_V6ONLY)
  		int s;
 diff --git a/bin/tests/system/notify/ns5/named.conf.in b/bin/tests/system/notify/ns5/named.conf.in
-index 5cab276..d4a7bf3 100644
+index 5cab276..c0492e1 100644
 --- a/bin/tests/system/notify/ns5/named.conf.in
 +++ b/bin/tests/system/notify/ns5/named.conf.in
 @@ -12,17 +12,17 @@
@@ -591,19 +650,19 @@ index 5cab276..d4a7bf3 100644
  
  key "a" {
 -	algorithm "hmac-md5";
-+	algorithm "hmac-sha256";
++	algorithm "@DEFAULT_HMAC@";
  	secret "aaaaaaaaaaaaaaaaaaaa";
  };
  
  key "b" {
 -	algorithm "hmac-md5";
-+	algorithm "hmac-sha256";
++	algorithm "@DEFAULT_HMAC@";
  	secret "bbbbbbbbbbbbbbbbbbbb";
  };
  
  key "c" {
 -	algorithm "hmac-md5";
-+	algorithm "hmac-sha256";
++	algorithm "@DEFAULT_HMAC@";
  	secret "cccccccccccccccccccc";
  };
  
@@ -658,6 +717,19 @@ index c85eef5..428b6b1 100644
  	secret "1234abcd8765";
  };
  
+diff --git a/bin/tests/system/nsupdate/ns9/named.conf.in b/bin/tests/system/nsupdate/ns9/named.conf.in
+index 6a7ff88..0b70745 100644
+--- a/bin/tests/system/nsupdate/ns9/named.conf.in
++++ b/bin/tests/system/nsupdate/ns9/named.conf.in
+@@ -32,7 +32,7 @@ key rndc_key {
+ 
+ key subkey {
+ 	secret "1234abcd8765";
+-	algorithm hmac-sha256;
++	algorithm @DEFAULT_HMAC@;
+ };
+ 
+ controls {
 diff --git a/bin/tests/system/nsupdate/setup.sh b/bin/tests/system/nsupdate/setup.sh
 index 50056dc..a4a1a3f 100644
 --- a/bin/tests/system/nsupdate/setup.sh
@@ -702,6 +774,32 @@ index 0bb9d00..ecbc0df 100755
      $DIG $DIGOPTS +short @10.53.0.1 ${alg}.keytests.nil | grep 10.10.10.3 > /dev/null 2>&1 || ret=1
  done
  if [ $ret -ne 0 ]; then
+diff --git a/bin/tests/system/rndc/ns2/named.conf.in b/bin/tests/system/rndc/ns2/named.conf.in
+index 117a5f4..be1af25 100644
+--- a/bin/tests/system/rndc/ns2/named.conf.in
++++ b/bin/tests/system/rndc/ns2/named.conf.in
+@@ -27,7 +27,7 @@ key rndc_key {
+ 
+ key secondkey {
+ 	secret "abcd1234abcd8765";
+-	algorithm hmac-sha256;
++	algorithm @DEFAULT_HMAC@;
+ };
+ 
+ controls {
+diff --git a/bin/tests/system/rndc/ns3/named.conf.in b/bin/tests/system/rndc/ns3/named.conf.in
+index 3078e90..fd97ca2 100644
+--- a/bin/tests/system/rndc/ns3/named.conf.in
++++ b/bin/tests/system/rndc/ns3/named.conf.in
+@@ -25,7 +25,7 @@ key rndc_key {
+ 
+ key secondkey {
+ 	secret "abcd1234abcd8765";
+-	algorithm hmac-sha256;
++	algorithm @DEFAULT_HMAC@;
+ };
+ 
+ controls {
 diff --git a/bin/tests/system/rndc/setup.sh b/bin/tests/system/rndc/setup.sh
 index 4dd6fa7..1b79263 100644
 --- a/bin/tests/system/rndc/setup.sh
@@ -776,6 +874,22 @@ index 76cf970..22637af 100644
  
  key "sha1-trunc" {
  	secret "FrSt77yPTFx6hTs4i2tKLB9LmE0=";
+diff --git a/bin/tests/system/tsig/ns1/rndc5.conf.in b/bin/tests/system/tsig/ns1/rndc5.conf.in
+new file mode 100644
+index 0000000..0682194
+--- /dev/null
++++ b/bin/tests/system/tsig/ns1/rndc5.conf.in
+@@ -0,0 +1,10 @@
++# Conditionally included when support for MD5 is available
++key "md5" {
++	secret "97rnFx24Tfna4mHPfgnerA==";
++	algorithm hmac-md5;
++};
++
++key "md5-trunc" {
++	secret "97rnFx24Tfna4mHPfgnerA==";
++	algorithm hmac-md5-80;
++};
 diff --git a/bin/tests/system/tsig/setup.sh b/bin/tests/system/tsig/setup.sh
 index 34cc73b..d51ff21 100644
 --- a/bin/tests/system/tsig/setup.sh
@@ -882,7 +996,7 @@ index 1067227..ee05e83 100644
  
  echo_i "fetching using hmac-sha1-80 (BADTRUNC)"
 diff --git a/bin/tests/system/upforwd/ns1/named.conf.in b/bin/tests/system/upforwd/ns1/named.conf.in
-index c2b57dd..cb13aa1 100644
+index c2b57dd..ea744f8 100644
 --- a/bin/tests/system/upforwd/ns1/named.conf.in
 +++ b/bin/tests/system/upforwd/ns1/named.conf.in
 @@ -12,7 +12,7 @@
@@ -890,7 +1004,7 @@ index c2b57dd..cb13aa1 100644
  
  key "update.example." {
 -	algorithm "hmac-md5";
-+	algorithm "hmac-sha256";
++	algorithm "@DEFAULT_HMAC@";
  	secret "c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K";
  };
  

From 5e42931b09efdb82910813c7c8f266490a4f9e15 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 21 Nov 2022 12:39:51 +0100
Subject: [PATCH 324/460] Update to 9.18.9 (#2143258)

https://downloads.isc.org/isc/bind9/9.18.9/doc/arm/html/notes.html#notes-for-bind-9-18-9
---
 .gitignore | 2 ++
 bind.spec  | 5 ++++-
 sources    | 4 ++--
 3 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/.gitignore b/.gitignore
index d9ce40c..3fb2376 100644
--- a/.gitignore
+++ b/.gitignore
@@ -194,3 +194,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.18.7.tar.xz.asc
 /bind-9.18.8.tar.xz
 /bind-9.18.8.tar.xz.asc
+/bind-9.18.9.tar.xz
+/bind-9.18.9.tar.xz.asc
diff --git a/bind.spec b/bind.spec
index ef86ef1..4ac22e8 100644
--- a/bind.spec
+++ b/bind.spec
@@ -62,7 +62,7 @@ Conflicts: %1 \
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPL-2.0
-Version:  9.18.8
+Version:  9.18.9
 Release:  1%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
@@ -949,6 +949,9 @@ fi;
 %endif
 
 %changelog
+* Mon Nov 21 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.9-1
+- Update to 9.18.9 (#2143258)
+
 * Sat Oct 22 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.8-1
 - Update to 9.18.8 (#2136100)
 
diff --git a/sources b/sources
index 10c60a2..27ae4ae 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.18.8.tar.xz) = ea6cad5276269a320fa1e666544888ed88b9d058ecab56c82aebff24e841a4ad221ce9c1209b1258884d71f7c03eed4d1c6a7e1922780073644344bc939a0e89
-SHA512 (bind-9.18.8.tar.xz.asc) = 06a880eb3af14e760f52ab5bd666b6512487d724a16a0fdf646ad9a07f17249e68a9a59ddf902f9111aee6450d96ed8dfe36d6fb433808f993d9bbc6dd4e665c
+SHA512 (bind-9.18.9.tar.xz) = 7d9bca47e29e8634416ab52819d78ce4ec6196c0dcbd9fe95a24687337f71c69b6472cf20bf49ea0ae1751a861944f354f9122acfb01780f51278ad4a3fdd817
+SHA512 (bind-9.18.9.tar.xz.asc) = ad45ef665a78c7da24fcfcfdc382d5226786fd037d1752d76b74e2b26c8148ce2be66132fdbd2993ee46cce2590cf55340ce0b2624d654ac7c2bd1757b388401

From 9b329d0dd6ac9062787609de7c4bb4f221ecd3f1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 16 Jan 2023 14:32:06 +0100
Subject: [PATCH 325/460] Update to 9.18.10 (#2143258)

https://downloads.isc.org/isc/bind9/9.18.10/doc/arm/html/notes.html#notes-for-bind-9-18-10
---
 .gitignore                 |   2 +
 bind-9.11-fips-tests.patch |  62 +----
 bind.spec                  |   7 +-
 codesign2021.txt           | 534 -------------------------------------
 isc-keyblock.asc           | 151 +++++++++++
 sources                    |   4 +-
 6 files changed, 171 insertions(+), 589 deletions(-)
 delete mode 100644 codesign2021.txt
 create mode 100644 isc-keyblock.asc

diff --git a/.gitignore b/.gitignore
index 3fb2376..87a8eb0 100644
--- a/.gitignore
+++ b/.gitignore
@@ -196,3 +196,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.18.8.tar.xz.asc
 /bind-9.18.9.tar.xz
 /bind-9.18.9.tar.xz.asc
+/bind-9.18.10.tar.xz
+/bind-9.18.10.tar.xz.asc
diff --git a/bind-9.11-fips-tests.patch b/bind-9.11-fips-tests.patch
index 25f0e76..7efac6d 100644
--- a/bind-9.11-fips-tests.patch
+++ b/bind-9.11-fips-tests.patch
@@ -1,4 +1,4 @@
-From f7d0320466815001b0fdf85f85a436f39463287e Mon Sep 17 00:00:00 2001
+From 3446425cf03f2b5a7cbf6af47bd167f72e4135aa Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 2 Aug 2018 23:46:45 +0200
 Subject: [PATCH] FIPS tests changes
@@ -74,9 +74,6 @@ Use DEFAULT_HMAC configured variable
  .../system/allow-query/ns2/named32.conf.in    |  2 +-
  .../system/allow-query/ns2/named40.conf.in    |  4 +-
  bin/tests/system/allow-query/tests.sh         | 18 ++---
- bin/tests/system/catz/ns1/named.conf.in       |  2 +-
- bin/tests/system/catz/ns2/named1.conf.in      |  2 +-
- bin/tests/system/catz/ns2/named2.conf.in      |  2 +-
  bin/tests/system/checkconf/bad-tsig.conf      |  2 +-
  bin/tests/system/checkconf/good.conf          |  2 +-
  bin/tests/system/cookie/ns1/named.conf.in     |  2 +-
@@ -99,7 +96,7 @@ Use DEFAULT_HMAC configured variable
  bin/tests/system/tsig/tests.sh                | 67 ++++++++++++-------
  bin/tests/system/upforwd/ns1/named.conf.in    |  2 +-
  bin/tests/system/upforwd/tests.sh             |  2 +-
- 39 files changed, 164 insertions(+), 113 deletions(-)
+ 36 files changed, 161 insertions(+), 110 deletions(-)
  create mode 100644 bin/tests/system/tsig/ns1/rndc5.conf.in
 
 diff --git a/bin/tests/system/acl/ns2/named1.conf.in b/bin/tests/system/acl/ns2/named1.conf.in
@@ -523,43 +520,6 @@ index 01a13cf..3711c63 100644
  grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
  grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1
  grep '^a.keydisallow.example' dig.out.ns2.$n > /dev/null && ret=1
-diff --git a/bin/tests/system/catz/ns1/named.conf.in b/bin/tests/system/catz/ns1/named.conf.in
-index 3a8e401..052ae3f 100644
---- a/bin/tests/system/catz/ns1/named.conf.in
-+++ b/bin/tests/system/catz/ns1/named.conf.in
-@@ -122,7 +122,7 @@ view "ch" ch {
- 
- key tsig_key. {
- 	secret "LSAnCU+Z";
--	algorithm hmac-md5;
-+	algorithm @DEFAULT_HMAC@;
- };
- 
- key next_key. {
-diff --git a/bin/tests/system/catz/ns2/named1.conf.in b/bin/tests/system/catz/ns2/named1.conf.in
-index 23383ed..5a7babd 100644
---- a/bin/tests/system/catz/ns2/named1.conf.in
-+++ b/bin/tests/system/catz/ns2/named1.conf.in
-@@ -165,7 +165,7 @@ view "ch" ch {
- 
- key tsig_key. {
- 	secret "LSAnCU+Z";
--	algorithm hmac-md5;
-+	algorithm @DEFAULT_HMAC@;
- };
- 
- key next_key. {
-diff --git a/bin/tests/system/catz/ns2/named2.conf.in b/bin/tests/system/catz/ns2/named2.conf.in
-index 62b76a6..cd5f2b9 100644
---- a/bin/tests/system/catz/ns2/named2.conf.in
-+++ b/bin/tests/system/catz/ns2/named2.conf.in
-@@ -122,5 +122,5 @@ view "ch" ch {
- 
- key tsig_key. {
- 	secret "LSAnCU+Z";
--	algorithm hmac-md5;
-+	algorithm @DEFAULT_HMAC@;
- };
 diff --git a/bin/tests/system/checkconf/bad-tsig.conf b/bin/tests/system/checkconf/bad-tsig.conf
 index 4af25b0..9f202d5 100644
 --- a/bin/tests/system/checkconf/bad-tsig.conf
@@ -574,10 +534,10 @@ index 4af25b0..9f202d5 100644
  };
  
 diff --git a/bin/tests/system/checkconf/good.conf b/bin/tests/system/checkconf/good.conf
-index 154bf75..e7a05cd 100644
+index 93939ff..3f78622 100644
 --- a/bin/tests/system/checkconf/good.conf
 +++ b/bin/tests/system/checkconf/good.conf
-@@ -283,6 +283,6 @@ dyndb "name" "library.so" {
+@@ -280,6 +280,6 @@ dyndb "name" "library.so" {
  	system;
  };
  key "mykey" {
@@ -610,7 +570,7 @@ index f1b817a..e457062 100644
 +	algorithm @DEFAULT_HMAC@;
  };
 diff --git a/bin/tests/system/feature-test.c b/bin/tests/system/feature-test.c
-index 3435c91..aaaa264 100644
+index b1adaed..3942df6 100644
 --- a/bin/tests/system/feature-test.c
 +++ b/bin/tests/system/feature-test.c
 @@ -17,6 +17,7 @@
@@ -621,7 +581,7 @@ index 3435c91..aaaa264 100644
  #include <isc/net.h>
  #include <isc/print.h>
  #include <isc/util.h>
-@@ -133,6 +134,19 @@ main(int argc, char **argv) {
+@@ -143,6 +144,19 @@ main(int argc, char **argv) {
  #endif
  	}
  
@@ -667,7 +627,7 @@ index 5cab276..c0492e1 100644
  };
  
 diff --git a/bin/tests/system/notify/tests.sh b/bin/tests/system/notify/tests.sh
-index 95158a4..9b9aa0a 100644
+index 706b7fc..2565ab4 100644
 --- a/bin/tests/system/notify/tests.sh
 +++ b/bin/tests/system/notify/tests.sh
 @@ -179,7 +179,7 @@ test_start "checking notify to multiple views using tsig"
@@ -748,7 +708,7 @@ index 50056dc..a4a1a3f 100644
  $TSIGKEYGEN -a hmac-sha224 sha224-key > ns1/sha224.key
  $TSIGKEYGEN -a hmac-sha256 sha256-key > ns1/sha256.key
 diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh
-index 0bb9d00..ecbc0df 100755
+index d612a22..9f18e57 100755
 --- a/bin/tests/system/nsupdate/tests.sh
 +++ b/bin/tests/system/nsupdate/tests.sh
 @@ -841,7 +841,12 @@ fi
@@ -801,7 +761,7 @@ index 3078e90..fd97ca2 100644
  
  controls {
 diff --git a/bin/tests/system/rndc/setup.sh b/bin/tests/system/rndc/setup.sh
-index 4dd6fa7..1b79263 100644
+index 5f638ef..85d6b73 100644
 --- a/bin/tests/system/rndc/setup.sh
 +++ b/bin/tests/system/rndc/setup.sh
 @@ -47,7 +47,7 @@ make_key () {
@@ -814,7 +774,7 @@ index 4dd6fa7..1b79263 100644
  make_key 3 ${EXTRAPORT3} hmac-sha224
  make_key 4 ${EXTRAPORT4} hmac-sha256
 diff --git a/bin/tests/system/rndc/tests.sh b/bin/tests/system/rndc/tests.sh
-index a66ca15..6ebf78c 100644
+index e68428c..acbeb52 100644
 --- a/bin/tests/system/rndc/tests.sh
 +++ b/bin/tests/system/rndc/tests.sh
 @@ -350,15 +350,19 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -1022,5 +982,5 @@ index a6de312..ebcadb1 100644
  update add updated.example. 600 A 10.10.10.1
  update add updated.example. 600 TXT Foo
 -- 
-2.37.3
+2.39.0
 
diff --git a/bind.spec b/bind.spec
index 4ac22e8..3c58340 100644
--- a/bind.spec
+++ b/bind.spec
@@ -62,7 +62,7 @@ Conflicts: %1 \
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPL-2.0
-Version:  9.18.9
+Version:  9.18.10
 Release:  1%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
@@ -71,7 +71,7 @@ Source0:  https://downloads.isc.org/isc/bind9/%{version}/%{upname}-%{version}.ta
 Source1:  named.sysconfig
 Source2:  https://downloads.isc.org/isc/bind9/%{version}/%{upname}-%{version}.tar.xz.asc
 Source3:  named.logrotate
-Source4:  https://downloads.isc.org/isc/pgpkeys/codesign2021.txt
+Source4:  https://www.isc.org/docs/isc-keyblock.asc
 Source16: named.conf
 # Refresh by command: dig @a.root-servers.net. +tcp +norec
 # or from URL
@@ -949,6 +949,9 @@ fi;
 %endif
 
 %changelog
+* Mon Jan 16 2023 Petr Menšík <pemensik@redhat.com> - 32:9.18.10-1
+- Update to 9.18.10 (#2143258)
+
 * Mon Nov 21 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.9-1
 - Update to 9.18.9 (#2143258)
 
diff --git a/codesign2021.txt b/codesign2021.txt
deleted file mode 100644
index d021b56..0000000
--- a/codesign2021.txt
+++ /dev/null
@@ -1,534 +0,0 @@
------BEGIN PGP PUBLIC KEY BLOCK-----
-
-mQINBFwq9BQBEADHjPDCwsHVtxnMNilgu187W8a9rYTMLgLfQwioSbjsF7dUJu8m
-r1w2stcsatRs7HBk/j26RNJagY2Jt0QufOQLlTePpTl6UPU8EeiJ8c15DNf45TMk
-pa/3MdIVpDnBioyD1JNqsI4z+yCYZ7p/TRVCyh5vCcwmt5pdKjKMTcu7aD2PtTtI
-yhTIetJavy1HQmgOl4/t/nKL7Lll2xtZ56JFUt7epo0h69fiUvPewkhykzoEf4UG
-ZFHSLZKqdMNPs/Jr9n7zS+iOgEXJnKDkp8SoXpAcgJ5fncROMXpxgY2U+G5rB9n0
-/hvV1zG+EP6OLIGqekiDUga84LdmR/8Cyc7DimUmaoIZXrAo0Alpt0aZ8GimdKmh
-qirIguJOSrrsZTeZLilCWu37fRIjCQ3dSMNyhHJaOhRJQpQOEDG7jHxFak7627aF
-UnVwBAOK3NlFfbomapXQm64lYNoONGrpV0ctueD3VoPipxIyzNHHgcsXDZ6C00sv
-SbuuS9jlFEDonA6S8tApKgkEJuToBuopM4xqqwHNJ4e6QoXYjERIgIBTco3r/76D
-o22ZxSK1m2m2i+p0gnWTlFn6RH+r6gfLwZRj8iR4fa0yMn3DztyTO6H8AiaslONt
-LV2kvkhBar1/6dzlBvMdiRBejrVnw+Jg2bOmYTncFN00szPOXbEalps8wwARAQAB
-tE1JbnRlcm5ldCBTeXN0ZW1zIENvbnNvcnRpdW0sIEluYy4gKFNpZ25pbmcga2V5
-LCAyMDE5LTIwMjApIDxjb2Rlc2lnbkBpc2Mub3JnPokCVAQTAQgAPhYhBK4/rHln
-EexZ/AB6pHS7a5pMuz04BQJcKvQUAhsDBQkD7JcABQsJCAcCBhUKCQgLAgQWAgMB
-Ah4BAheAAAoJEHS7a5pMuz0476oP/1+UaSHfe4WVHV43QaQ/z1rw7vg2aHEwyWJA
-1D1tBr9+LvfohswwWBLIjcKRaoXZ4pLBFjuiYHBTsdaAQFeQQvQTXMmBx21ZyUZj
-tjim8f9T1JhmIrMx6tF14NbqFpjw82Mv0rc8y74pdRvkdnFigqLKUoN2tFQlKeG+
-5T24zNwrGrlR3S7gnM47nD1JqKwt4GnczLnMBW/0gbLscMUpAeNo/gY4g0GV/zkn
-Rt91bLpcEyDAv+ZhQZbkJ49dnNzl5cTK5+uQWnlAZAdPecdLkvBNRNgj/FKL41RF
-JGN6eqq3+jlPbyj9okeJoGQ64Ibv1ZHVTQIx5vT1+PuVX/Nm0GqSUZdLqR33daKI
-hjpgUdUK/D0AnN5ulVuE1NnZWjVDTXVEeU8DFvi4lxZVHnZixejxFIZ7vRMvyaHa
-xLwbevwEUuPLzWn3XhC5yQeqCe6zmzzaPhPlg6NTnM5wgzcKORqCXgxzmtnX+Pbd
-gXTwNKAJId/141vj1OtZQKJexG9QLufMjBg5rg/qdKooozremeM+FovIocbdFnmX
-pzP8it8r8FKi7FpXRE3fwxwba4Y9AS2/owtuixlJ2+7M2OXwZEtxyXTXw2v5GFOP
-vN64G/b71l9c3yKVlQ3BXD0jErv9XcieeFDR9PK0XGlsxykPcIXZYVy2KSWptkSf
-6f2op3tMuQINBFwq9BQBEAC59lflbMmvSVkCHFoakdjokwGviNU4I/hOsNmHALYr
-gJc0z88ss2KxbOq6JZoW9QOEHz2QLGsSGKnBUViEGvXoINDGuvzKFqHdEjGsExiF
-FPGAgCQA2CSEZZ8MlITNdq4DuSti1LetjCF9d7hw2xOQs9ucxSXIslyqPbCdlxki
-33tov40VE/J8jDUp9Rv27e0H2x4Nhu9MRQt4vTtpOcelYzl/dtPAmsnY4U/Nex4I
-LM+JU2HcG/5i0nWkxOtz9Qc7kOgm4cuwXTCJw9KukPS3CykV1H/StPp43JyxoK1X
-gZDMFww+9jupqLletmYKqCW6jVbqXr4Xlisq9Ey3LIWRQ0Zw/LB2NKU/jgnJGtLa
-7O8VRWJKwkCtyYUbZMksKiGex7zCqPDR0hRVuYNsTjONobnrOS+7ST7ThbCndc+A
-5mtuXpxuFffIuG78a3R3N30RF6g18peTfaEHMpqz+914HkNl6Ns445Zh+2rJkLUu
-8O++tgWEUrpUajN9nosWaXWHOf7E9qGnm1G/3f9P3Nd5U+b3OKUYyqb+CNGCHyiN
-bE1Cg3MnKpM9Yi9aZu4Qg/dPdxMWrqUmkmyDf6x/Oh8ZZkIacFlAaqbysQ6hRaJo
-p7UG9AJfXHynj/Hz+1dNpUOlAIairFe3T2mWQO4Yy6IMgLEGVodZRHaMugdzZwus
-HwARAQABiQI8BBgBCAAmFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAlwq9BQCGwwF
-CQPslwAACgkQdLtrmky7PTikHw/8CZ+DnggV4AuI86spuMLdtUBDOux/T0gvyxSW
-f8sJkjH0eAYAmP9/flJDfmwra5yNaINfqoLFWtaYLpxpBcWBc4VIoiWqVp2aaCPi
-wh0sznCPiduiYcKGkHmupX8aCQXBYFDeQ8Jq1e9zwGD7Mon7BeBO48Vd5/IT1H5I
-u5qzaCtD2ECO9MYdhuqJjFKU0MVzVocsBDdtLvrfnUwe4wc6kvOgHQ6RkMJU1bgY
-0Sqstsg12vnREAr4uihnZQEihsRmNdiiv0DYVaRK92PLPpfVAox1Axq2HpH3WT87
-RpsFruXLj/zTl4AZczfDVd/Z4yWmJSzr0F5igkGSUrxo0ye2kNES6cmOGI9TgmgP
-NLGXlC/su5fKXKjRgkD1ibJ0qFNNxF3Cwpz/+cav9ySDgFGX5Vu0kFi93fEYHshD
-6lP9M5qS/2oKiykCGvcRCNU/9emdYlF37H52rxRerBaZN6dYMTjZw2vsEMUl06pL
-llbLiwjPix2OlLFcwH3yKJG0pKkpEImBdJwHtJh5uHzfkSAbZjJAZ2Ekw7sLqiT0
-85hAGovywGpHMiYkqhNUO84fjZYCsrAlZMdriY92IMcQhmWQ416t5zcle2Xgx+/x
-zBnktvx9KIH/HwBa+qym5z/uFC2S6zhNyC61LV/CEDCmcUi2lUXr7vcIxCsmxuUF
-1ONbRP65Ag0EXFtUfAEQAN5tk4luE92Ed4E92VlgTetGMHyxwOlZ2OsK6l+Z5ML0
-wzomAITgMQwG0FeT6HX7vB+luVhg0XAZUW/K0bme8ZEO0dbHB3Vn07wXHhmq7QXH
-/ACftkvevIT610dHskrtIvE5rZfj1P/wtjRTxDrkjhlGj9vhUxxcCkKadzDdBJGo
-dP+Zh02d/4cc++LePNqZ3eJWm0JLghqKxzTv0MV1r6G1ZeykFzXeWY+La8ZCRaON
-LcHjI7wlpyTJA9WGmyAphtEHM4fQqKLxtebIDo7m4glgR12nlV6B53gUT96PcKuA
-Y/UPRiTV6nHyUtuL1EGTAVLsMDmtDbdSdtLLVbJXVmA+tapABa4amMxNVNY3QSUj
-cAbECcTyVmVJfIT5fJW4eOMhWtrIGMspWoO5It0pl4K8jhCzIcfoXQ0olCSeC9fE
-tljE7qzRzYQUUvN1VZPVX0Yw/xSwOutv4mxmNRWY9HW1M/jGoRAboqN8WhCbldak
-a0XCH3U4rWXB/8HHb8KP4+q4ssVyPuEQ/v1UNNRk9AB25NPEh5PMdcf7HU8IcUHX
-THEfd7zZVJ0l4FSsnGeuJfMrnRIpNOYX65ikeoTwmDU3ZjWfmSy7F5hTLw8WOEB4
-EKpnplyV1QN/j3317/M9PxvB8IOvyNF2okeurtHFMmI/lGwy51akp6iHMkbBDm5n
-ABEBAAGJBHIEGAEIACYWIQSuP6x5ZxHsWfwAeqR0u2uaTLs9OAUCXFtUfAIbAgUJ
-A70hAAJACRB0u2uaTLs9OMF0IAQZAQgAHRYhBJXO2iVrHKChXzAvtZUhp+1drOkY
-BQJcW1R8AAoJEJUhp+1drOkY94wQAKb2fED9Up/xHEOjZm5ODK5LCVHy0KMATiTf
-5SiJhRtqaRbimPH1WB3XMLls3FJZnm+UngIfwCsoWo0rksFUNmqFi6t4Cj/UB/Zv
-29EnDT9BAeG5fP+Op5PDCsu4qnLv3oam35oV9yZLRkLhBd/EkRGEA/q27WnpiYCx
-Jv5uPOJBWQqu32aE6st23PpY/QWDWOhGPfcWCecu1rIe+2BCs0UjfO0KOT8HYWNh
-nGpsEZ+TmDKjRxMTYWKguEb9evEihl6kUwmQZgROdhBes63Yq4ku9rBXvRhCYbwS
-odhjx2soDRcNmzxNV1Ply8a+2bwRHPnOeyyxEHFAwjkyXo7ZqGtenwSriG0LOW87
-y3Yw63O+oAlGLIB3psBSj4wZVGme9485HVICAFcJ3jXqsXSIJdzW61nGerB2r2Qk
-Bn7yYIvHg3iOToB0alfNw2QuDtCZTNefvlHFnoashRhkk0yWzBerleFJbijx4+Vr
-FaOH35BO1T3rgBmGkDW6gewoZMHEcmzTDoxxmbXiRvY+5o7b+ul/yzwhnJz3f5jk
-7+Adnr9qAGMD2o3rCRBHV3lSEkLhBL+bfmsEYEor1fd+pDFoEKKjpDP6bgDcZyGv
-O0mmr7Y/6ZrnKWxOrmNXieOTLbpY22tXv43QLgyiPcjhCfphT95IxqdNfMfOiI9k
-IQf8g7GBciIP/1mbdnMj6Hg0J9IbI/XX/DWATOVMdDhq38VcggOHRjZk2lY99+4V
-Au1wRHa/Io/CENikYzI00deSzhrN+tdUK/TCZI0Ft5Lykmti2ilmkIQGsBuD9gu/
-2bmWkNJEdpHeC/+oxntDFj43CpyKpPAarrw+4XiYNK+1+4WZsQRL0jJuKJ754v/o
-NTaSd8GOCyFR7q8SVH4tig9DjkZjYjFFMnWkxdpnDX56/AfdS+x5EaRHKCJoGChT
-+pHimvKe+MxBxpwJr4JpGddklin+6xUF5jTG6322hz385wsagGvmH2XliOu47a+7
-xUei7w3S1qtVCfdhtBEWL5i021yVYlrw+rUCwpFMIXAPA/p44O/qY06sQXJ01Fym
-JCbOnjtVYX9gdF8fMKoDXAcvEtSulBNpXDongWp50BDfVoA7h9oDsxL5kw0GpkJn
-uVMYLpO+iOqoEA3bJfsCedilkcz6UamLb+6RXMupKQaZ006Bu75Rm+h6PdicdiKD
-jJY/7PbGuUmXxuSFT92v0hATlpEIQ8H8laEcnb8apiX2qOyGUHnb7pfYoNqvCm06
-3NP2igCtiGkzAohiHfhztfy2UApiTtXmPu3EhEUMooB+0Lt0zzY+e1cnFKRbJHvQ
-ZidiOJfKuqp6upPvEgKYMRCAU4+nLT3MVbralo726JnDqrDJvCqAamhfuQINBFxb
-VNsBEADcRGjaY+/ZVWBlQWvgy08ObhQbTRglb8thrcPeTR7211JJwAJemuTWwCjF
-SVDH8JJ0Ss8rBcbitrGI3i3mcgJRQ1hILR2HT0bbmMLufCxZzQBjJm76H8XN++k6
-bd8HCYGXMguUaHRRHAcV+P18e3qGizgL7c8Vln9fbhowkX9yi/WhiL2uoXC3+XSa
-C08TzwjKPb9Wnct6uCBAzMp8S7KW6P18vZyBTRBrugA9eZrGEe25rhy9szlJcajc
-VeMiDMf058z7ait5t43AfUzd5zrD6c+ZGYIku88oY55LsZVcvn9o7I+UNbNJdiek
-IpLae3Dgrie3QgDyfzPV1vXT2X8LaegOsNIkSo6jzjdKE0ZNg4xVSuPdr5jujYBN
-z2k1lqV/Q/Ccpqzs0NsgnXnY8RDDrrmJhdy/ZrCMsXpbTK5KryR+JoDEiuyJ7YO2
-jTOCo6zQ631jvi7XUeHAFIdQ7eYRklJwABwj/IMXY++O8JBLO7iZ1dvvu3pfY7pg
-dQvPgDttVAIxrNxMMj39LRbb6LE+eclWcTfGCMr3O6LOOLwkMnDWEkJAz7JMtWqr
-2l+9xF9Dq7CkxHPP87dLTMNGIDr38bJ83CSmDPlBoaljTYgrlatBTV2hGMjPgEcB
-jOgg6QyRGpO2N0SVBnD8PfBI7a7CwQw3BHOJtH8vPUkXZoafoQARAQABiQRyBBgB
-CAAmFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAlxbVNsCGwIFCQO9IQACQAkQdLtr
-mky7PTjBdCAEGQEIAB0WIQTXDITmS1WOW8zsByEy4hdfHXV6KgUCXFtU2wAKCRAy
-4hdfHXV6KoJ9D/9IUN+s4gSiyWnqfq+UK5q86DTbC+OyQpAY/U/VDi/jQXDUaXzu
-f25cCgyl4Xgf6nNTE6IEdgJCL4R6bChxJOHNpZ8/N3ckb/Q5xHKZ/5k5wFv7nxUk
-vunzxB0wUgCLkn4oy4B8QbTMuRz1qcSdehUyZAlfkr7o/J5UO8FtgaMuNACxZNlO
-JW5AjTDdbEW0MZapAgjx7+oTQMDtz9q4afuPaGJ3fTz4Vx1+mYt59b1h6xaMTXJi
-8egJF0U4n/tJ+3gxAIhF7tQRPdNEwG+2Kw/YNyrLMY+nbazhlgUIIkk2IH3Ztd0S
-XnNd7gV/slN80T9CtHtaDlH2FkeAd1unynxsDd/TLb1gLHem5iDsFuZBaIyHetdY
-TlvT3SlKnDQr0FBTe86Kuv7n/ZNoU4lceXhUXTcataxKdxKEJt2x1Ei/hMHSVjaY
-3ir57tuOUDMkl6hpL3sYiq7cMGUAnLH9nBZbbcNdfChDiM24mGmXaNoITutVAHS4
-uNunSL1l13hJ1hnGY79j4l+CgnPx7LHzBmLh4PPWKM3RYqwgaPEkflVQr1JOOKMM
-x4bpllEtzpvVAIaF73tlsOQRRN1Aah67gvkWKqiZrXc0Sx/yh8EO/6bImb87rtVr
-0kjeDGEiuGYXsszNBCmVjHal5kLUKaESefzd223zeaFe9foO2HrnsFb9B34ZD/9J
-W5M+42QFd+tOLh1ue/5xToiyggGh1MX9axDqHiRu2w+E7kNuuws2426aupUQ3yPD
-4dSwR428U14ytM90bZXztKFDgFAaQJ/4YVEGPSbLHFc4VlhDHpGljl8J7vI5xPOm
-Ruc9aabtXwd065nQ2csk1DliiA4jpS9dUq/flH2oGj4b2OSGFvR5oC7oERHMpUA0
-p+wY3vnjkSVnWqV98yEBCFcZvpOy8J5KDZxYZvZydUvZ3ny5W6QPg8OKriqrCAKW
-QXds47vRIiAasK14duLgex6il7HmboaqqOhRhevtBAHBJpB1z6Aq0SMwcKwdtTId
-GTSoQd0R77ZGYvR3StpAwl8rJhCNwJHu2euA3hYPWHg0pF0L8pFbfUwOYf1dU+uQ
-4xAJQKcCteQ7B0pawp+Hxp/0erB5c5PUUck38ze1ZoGm/oqh24XZ/amPVWE9nYSo
-VTJwnbqWsfI6mzKdBHr5MP5zW5ei0PAo3lFb5gvVzJ2TqaGJvrh907I9R5Nwd6GM
-wAWAzZ/nCLflSNyPyJ3ftxY6pGyCBJsycY7gBQD9i1xU0bxONltqSyifwQ0rt7yr
-iwSI0VRnv8K3M2iTAdDm44bX6oHzljgiYachlV6IGmO3vdVVrCDhm+b+ia1bnQ/1
-H7itWEwllkUCCtaDwEcf8o3OdbS9S5KEbwH7YUD967kCDQRcW1UMARAAvl+0jUaB
-UkQWBflWy4Wd8Gcf3lzOqbARdpM/iztebc7RbLnv0TNFQPV4TD9RoP+rY4dJzC8w
-/rlxlhD3DiGcI3of3o/3pN6jss4wKyy9Jcg7uCo/fcspOoPOwigAUfBYTd2rWNvI
-/pPUl7zmavQR2+TyQ4IHWG52zAABGej/tf3Ma6WGHC4QeTkh7LtHn3JFRCoFy101
-x60bJqIWONfR6+5UAOL/P+zTteEMsO3v7dWCWHX/tcYLrhCEH1CNnyPS7v7TF+Ys
-uOGL7sSmQOUAcgldfUfTACw84YqViu5BSYiww18Eg1l66UcQFnhwB3fTGwzb3oPM
-npAv2wAZ9gyFGzRgcH8QnXRm/SLDWlTaMIJS//0p/gXifCAdBZA/skBt+E4hQ5Sr
-9iXGNMueR3bn7u8Pcoc1DpSJENE5H0nB62l3/OiSl/k7mJMGlUv6wKr42xNnIM6M
-hO97axjRXy/XQz5n6ktyn9xRngkQNL9Ynj+i8E0k/xv5jA39EGAKOXxQFf8357sA
-DnZ5g/Yf0Yr1c+TNIIRXER/k/KMavB52mguTNqCsewO5aje4Gq4vKd5P+jOKGopA
-C4idTLkHutZTiakod7lW2jmjpm6P7oyAeAhDNEroNrbOIw0SaujHBmJtxgK1Q929
-y/EaH5vJyWfMFyUqM7CQBqUU/HRLERsebM8AEQEAAYkEcgQYAQgAJhYhBK4/rHln
-EexZ/AB6pHS7a5pMuz04BQJcW1UMAhsCBQkDvSEAAkAJEHS7a5pMuz04wXQgBBkB
-CAAdFiEErtYi/gIHfrS1wUbBQqJ50kjNwxAFAlxbVQwACgkQQqJ50kjNwxAf5xAA
-hBhcOeqLgeXbUu0CCTKlnG6D7H8sQJWXCSsh9pAXffv58b4f0ntJ1TztKfVd79hS
-BCcXRc/9+MhUUzR79NvFWWZMWqJ6MucjAkkOBRoc7c85PawYTI7e1zSapLPJEHG0
-xDzK8ClxwGEvlA4O/eGGVFaCTkxdTQg95fDXfghab6j89GI8Ghc9rC9V8RUgGVQV
-qJJkBJ/gECJJp3holB4/w/I/sU+9AHXGKJvSJJ62fpmY143Y5JQk+I8DxoT0kIq4
-W2iZVAQMzQGpAOXkDuHk7a7J/QuL78CuoG98GOsfTd7nNsgPTZ07cPYGOxXeNR5U
-9DlYOBWDwsf6d+D+tHLB8KzH3MWnWa3crjE3a/sgrDEad0CmAJzHXuCyPMy8vPQn
-uxIai/gw2POq8YQMoKW5S80perLuN73FxAumjK9a2hYVdZNtABwrlW/6ELruv1se
-mMjUq6oDyFio0rGy/uzCItl13hIr1Ii7B/SPz9dNnCagV8aiUmKXRk3HKoEXf34I
-xWlod0szWopnP31NXNKHihs46ORSMrjnzFKjRcJsnipdins+DHJYroYhtOjNtsb/
-WV3D4tSerG3xKF/v3ssn2VsjcgK5HY/k9iUol/dvoP0bJ+rKs/fzt8oAqEexiRnV
-cPnj/zAiBOt1940+0vTWaNYOPDkq872S48GNybOC342u2xAAnAp5myKostxjyQn3
-E/7/G1OWHaJW5kx/HCqHCWjgwwLOmhssNn8kpTf3ybvt5uhMolIF95RjFB3gBOfU
-vw0sqMvEoBoGSMSTSc3zD05RBsWWFD9qwvPMXtn0gYaH39ISAFnxXrtrQ7dDD1d2
-LcBErdttnxEhUnT4/0YIat+r2PhmYYDYviKsuOy8MC/sJIxvhYEpbyPQnPksUzA4
-wmAbVNPlzqU2oWPrLT2tlxUue3z6VS/YHDcsLSgjVOMWSusLMh1+D76Y+Lcr9kVz
-nRu+dYXh4I6OBnlT1VuzEVmrf69NFwh8j3PaVn0I0NEDU7mMa+5W0QYuJIsXZonq
-SI2uIu64ZOVd+D8WmCEZO/Kmk5PMXs+0fMcFD9mOeFaiOdz+PIlHAsrxwKXr4Q5z
-zzu/wEOaqAVa2bJywTbl8MntQUY/XeD94MvdlSAwO3Ll1BpQ5NfXjm3YpP6Uyqlj
-pkrYQL56iqucgYn61jLSXhFHGLXSZs2G48ggN2mHtf6ZQeAJ4D2DIXRj4uqIHoJf
-7MWDui8u+cJsw/F0ZerPsCN/CpkEoj4FW4F4O3JbiieYSUK7lxc0qyDdbQiVCVl/
-08wNToe3RctSzsQ99tCwfVWqLVcTVb+0aeSaNykb+qW30bHW7AUYs/qKiapQFzZz
-QZnpHXGmVe93fDfILx3yUCA8Yia5Ag0EXFtVOgEQAOS7GFDH2DGXPMJzSdS7a/zZ
-ewP4bM42n2Ku3XiCyXG173p4ppNdOLS3l7JrRflMhjfBtETCOV8B4z0B9wCZZywz
-iLOt8+0A0zpY7EHZNvMRjZyq/s0FCKLtnlqo/KNwiJPRvQazZ6+UOSffEQEGpNKs
-1ycZIDb1tk8iRpRvtCin8CeLRLf+2BxHbWBewnCSCl80rC89PTcvPf+jmtcDJqDQ
-z/blp2CT1JUo1xdzyHYdIa/kQ2PBQo02ejBVs0vDjbzuYVQzZV3q6cYnYwGPtpTB
-Ot8GXuA1X3qYx0MlZwGEYpiTFS+Ju4cJrYofuBOudXpfux2uAPkJskw+ro5k1I/q
-fptRWDbZ4fGgROmUXBPg29XdyVExYgAbVeBdHWX30sCHs8+c8wzWkdAY/BgdCySg
-EVLiDmSfMekH2H1N9ncwzhwNlHk2BaYTR9hWdZ7lrH7BbT8g6SVSge/eqgvjKI33
-AUmragvNQ1B3362yqLK/FJOHyJiYd6DKfkq4E+ysw+C+qIo51qVNkqRqT0M7HhwZ
-AvaoeykrGIE5vq6jHa9+MxDlsN5Sf7gNgx2dk0d7LAJR6AmYNqRS2V+837XfogMc
-bB90ZyK2rOzDN3f48jaqXA8TX2CSun01RoPdCPZm0M/uxTZxOFzoatrkpEVbx/3x
-sjvuPVa7qkKdgUuo/PhBABEBAAGJBHIEGAEIACYWIQSuP6x5ZxHsWfwAeqR0u2ua
-TLs9OAUCXFtVOgIbAgUJA70hAAJACRB0u2uaTLs9OMF0IAQZAQgAHRYhBHkdfriO
-vI0BOENKrDPfNZrnpgp5BQJcW1U6AAoJEDPfNZrnpgp5JY4QAMry7TcsRIZJCVlC
-qecIAjyJizWz5dEwScba0BDU4rv/h42CvXJlySZpbgUEyB4SBggEnu/dKVbsd/t0
-TXRNg80Zs/pTFVbwcg+sDgIg1wZldZbClLfvgk0xLoDl5vq+K4SAQwSLTSPHQyYu
-8IxkrKmbBdBSXlgnmcHK2lDXrzWYJDEYEyFPV4pC3cHicCygSc/4eepUz+crEF6Z
-IE1df4LRv9h5CgsLewMv5nQ1EjxTo9mX1GiSh3e7KcfS98FgIQl3oy+yO2cmVVVq
-x5ggDcRI2sUbXa3D3kjAo2tUIA1nUMFLIrii+aZawOsf64VMdIs2OXEi5XFR+Zdw
-t+Bx6lUKZ3/tntStZitJdK8/RUbhmYQ8Tu01vxt/IAN+07VxWyZwcFB5KuC+lKtO
-/0vwyhyiOlHm8lzV/5qwFPusB4bNk/2uLPUaavJdrBpmB0t9pol/NFCRzW5MKFvu
-Qw35QyFVR0IBeaGjRc5J9yxbzi78umN1iHZbDjXFA7oRa9tkM2AP8V2anxSHUyon
-UN6OuLqSM2frA8iZcl0S7qcepYNF1ix9PhdQHXy0H7hoikXMLIiCl/unW5pVTs6q
-KnmxmRz9ZcqvvuVXbeY9C+kZE0LOBTZMljuS1Hcs69RU3rA18swfN5CTXw12ZwQZ
-SsnRhi2X28Tn8SD0vrEsEf08q3XshDwP/0MvBBfymXd+5MzxlvMg8vGJeFuDMEFN
-cpETa7Xzzz5Eir3ETtxpUWPCriqmCpnlIWidNwbg+LlyTeYUDPIDnMtEX5ySmYGn
-BI8ykvAKm/XTfr0PWOEAXcmxTC3oMhvYEhIyGHZOFJQxIo7vmrwZKi2wqMnKMPq+
-XXHgvtZe5tNbESI27APeQCMVZLVnVVa0D1JRFYBuwNoJXhWbAIKlIjBGv05NvK71
-e4x0zEY2mXxLBbsxVBvHhpg29HseX/AhHvUAcBehJ+sqnenXZqdeNhgBIeZubXq6
-A/gfscswF/Ocp63Z/vqAjEmvUKwAxNKrKlwLVShVvobPx2N4hH4ZT7p58cjhMhQz
-Lm4whTHy1hvBIR6j/Lo2eOkkVhiMlrrvWJIAEic3Gzj5f7XOsVr7CXjkSdoXHOIR
-63ZDO/9Wy6ygu8vCdiIFlyRyUBLnGhUYVbRYnTU58tQMfEYy30ZKF4vxz4Ysxoy1
-oJa6emaa33Nn1Z2kE64AaW4wbUJ57nROuFdoYTwJ02vyc51J4s0C94EA+a5VrQkN
-J7bT8P9G5gksp4b1WyoFm+O4aU5Sx+XpSO2IZFuBL05anF57Pm6Bz3LJX6sEYima
-chv72q7PYeYbETrl4DZxE2xlEiMUvN4DH/RExpPWeUsVMFtS5n60n5+AW1EYyGJ9
-mfWlvZ0xCjQ3uQINBFxbVW4BEAC/gtho2rZl6/+/szkOfEumAdFwyQbtM5CnJyuU
-rnrneWWlnNPLeaHml5a9yrcgOZ15QgnFD5YOHZ/S9L40goML8cB118etk9uE7vMv
-EtwxbkqZXTlqdxpFI/SzT4jJCa9XFQ2uA+KdmKmGW9EagtdLql2B9ziMhH0Ha6Y9
-5x+9+7/oRYU+ddmAbwrJjdn6bCuYQ7QVpccFC67qdpy2I97v03hst7yGT1FbrIjE
-sF4nMig6Uhwma5Edqm2dLaVXeZ+Fl0WeQCnWjprZMvkHCAxjTBlQpmvvwcQwqHot
-s832s96l/Sd5R6r+TWU0lTtXpcxL6t7MXfW+BInkqg0ZiHG1Znni6SwfatzDv6W2
-lJW2pj3Ub++JulEIkbct1f+TEeeLU0RbJmWlL/qe24fodKg1ixH0gyxsRKzdBUIf
-vgCkrzwLFgJEHRISjQzIASVtDdt8QoIqX8XALgjMBgAnZqtYrAEdFImWys0K1zOu
-MbuPcTImufz5ObnKM7rRMdCO9z+cHGs0TT2vUvPPuOsNYL1GX4EfrCp2eLKahjJQ
-BCxfatn4mFqHVmR/4a7vqq1j4Qfj3h08z7QVrNwGWAF3r8nmaHdaT0m55xctMRQa
-3N3UaYj0IQ08CSUJq5e005Z5Oinbt2O4paxnG4/UbJXpRiLEVU5Ja17IBsDfZydx
-W//ZlQARAQABiQRyBBgBCAAmFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAlxbVW4C
-GwIFCQO9IQACQAkQdLtrmky7PTjBdCAEGQEIAB0WIQQVaJBoXqDfahNx7yAXzF2x
-8AiEBwUCXFtVbgAKCRAXzF2x8AiEB3iPEACI735VFBDd4E6wlGAA12Av+XnWSruo
-Te7zGdKo2SuZ1gN1PYdNgflbifYCYajnQENp92N3q263Sq3MDf+EZYKijJ3EoU6y
-chjOJR6ge+UgKPdGQc7Lu61wWECBFaL6TMXCedcZ/Xd0xT2IbvK8qsKsITDjiDOh
-DUqdjVeyPXyfkmSrF5P3hvNxJvPbQ6k5Igx9JA+unLXxatljAeh1whnchRQAIKkx
-l19Nr1z+odFD+tzCX4HQmUfHRXgBiJICyIxWB+U7USqLtqk+7DE893meceSt0Mz0
-JgLct0E5EFfCdwbehnl5NJeay8XEdcfjUkeyb/VAVxWYUBiG72okUIaIP7xR5MW1
-P6ecdTr0GzOC1SySpfyT0+ot0rtXGSnXrBzpY6nU14hDoV3g/FMas+qz1smTtOVi
-1MVakDRf4QyP9Jqf4q4/GosRrgBvXZHi+zWkKuf+DXPcL/q6MfgHvQc6tFMh5ONQ
-snrF3Bca3BQDT2GKjSukeG3JmECHmKtQk22jhk6T9DJ3518yw29El9tUgraaZ5Fo
-Gen3TYCxA2BhV2LYCSLSHiTPdtUsbDuIP/FXaFXr34nAtKKOSSY6nP8SMzCPSEMN
-iscfdjejR1Xd012T/mLqVCBzFJWyX2RaUdygSWUpt/QdvWa4pXCgYZjEVidraOws
-VWMbb0zuI9KCseOaD/4jd+awtnRUj2SbGeJSVnqDPk0Hk8ndFebAo70uQGATkLXC
-m5ls0RDU2xHZumuUk+b74Y1KjwdqF65NEmfjaSQ6B8gnCO69eKHcUT821ED9bwfa
-4XpgsOMEoZklvFByax0JMS4JEJU/xfsLmfeuXVirN9Z82vxAXG8fuK8bso6VLG/J
-Mpxhq1Zv24NQ+uevvh9loyWMcaw3IqPvQzNlyuuya3rXJYZHSH7TauYgqWySXiGS
-H6oXl6Ej4GR3t5uWwHKvEREQer+KPZV3uXRnrTpgITy+PxZ9ywmPwmPBHcD6c0P+
-g0lNNtDdvw69qy+oh7JaqqYaDvedseN39UgBSx++ewRhq0OTikAD/BCv1zhPizlD
-9BHAOsCxrgnz0WsONYKFAE8vtNo/wB//djf/zqMsI3iWdbWqM9e/muEEV4jQRWLW
-TWp1XTqqvkc6TsLBBNO5zisJ0VwSfDyRUplr/IWeUl9FrRngjBJqF2nl90US5p3o
-uk5wUWdjFa0haFyDgZNFwyFr85mex+o6qIC3oif7UjC4kHPe4wzvHDYAxrHMB6MY
-QvrcXzULmInot3qRAr5duUNbQbrjdtVvOQFvjowBP5Scu5ZBSzc0O2TUUSKgnJZS
-Bs7+yswfgyhYzusbxlOdA+iE2Y8GuovamGYTbsdCxDStOMfZnaiXuLL04Uy1PQ==
-=fX+D
------END PGP PUBLIC KEY BLOCK-----
------BEGIN PGP PUBLIC KEY BLOCK-----
-
-mQINBF/u5KMBEAC0hPiTonjYEe5FqNzFn73KmcN8KGD2wzujmWWLnFXGEVDEpFcS
-ULQDshhCclwNeXUArUey4nficwpqUe+Xl2h4dP4z7yh3WiL5nA5JRjJjw8KJQGVW
-AkgiZTnJHH8DrzNt9LnDL516qMDJarTHemDUUUZLNxnuv0RDEhDxsXWiVCQZZcw/
-41yIY97uCf30dsDwnckVl3iEmYaGTYavWbKP60S8WaxO0YG57RI1etmlIQ0nMmka
-4bvFnwwb9Jdnwle4LIiRMCGymsheaKCKrEZgIJY+idyBuExLLykiL8iNBj2Pzi7z
-XSCniH9qcEwfqgZlP/KZwujLhGOc4c4peNwpuDGcmYZoAsUD8CZ8H/LU1FIR2A1u
-/UrRREtC8nNTDGxCckSMEquHNURfMk1QmDbJ9gaa9aOk0AArxuTxyj6Cn+KQd5l5
-0mN0R1sDVQq9xWdvnB7N0d3MDhnV7f19iUhi3KYvjVTkCMXjhNXjDH/KXFKoFhKa
-9SkxYGfW25inwSQoqbP1TE5+rESf57bo+XFxfVQuYfVJ5BlZobz+sRl2iDQyBJDM
-uDFyXE/t+E76BmwyHeOI1weqUMYebqHgu0x76dTYj9yWgWdQAC1pXi15/MTIaOtQ
-hWezb5rkI2yZqaZLaRBOIRBIPM5C5AOjL2XbfwUuSr2W4+TvxLocxi48DwARAQAB
-tE1JbnRlcm5ldCBTeXN0ZW1zIENvbnNvcnRpdW0sIEluYy4gKFNpZ25pbmcga2V5
-LCAyMDIxLTIwMjIpIDxjb2Rlc2lnbkBpc2Mub3JnPokCVAQTAQgAPhYhBH4ckayA
-MKWlnR76uXUPPIdyPkASBQJf7uSjAhsPBQkD60WABQsJCAcCBhUKCQgLAgQWAgMB
-Ah4BAheAAAoJEHUPPIdyPkAS0lMP/2IgMErScBUaXrZXqYXoluR8xU0p9DyZEBx+
-ZGNAcJ2CTPAbn3FrkNGNpK4SOCLXEZPKOQ09umaIxl8H6uEGaTut1JLj1qGaZ8ID
-4gAeQcTIN9OQA5ElQo+ci20XE9JSvzqY1zb04EkMuVL678xPCYJhUSLS0MAQkcDJ
-JQLN17SwNi4vGqzVhnwKUviQU9/s+LRUkThsTg4qT0fNnmGoVJXqrshxJa2ZWM6J
-QtOWBgJiC6xZ+zRiZS898L0tekU4o9yxtnnDWry2bI+mJbxAp94ZAXgKahOU7LKV
-3SPxkx7TAng24nOWi1EaP51pe7usTFH1BR3CUHZdoIQ4xruZGkt/qPumskofzl+1
-8bw1bEFbq8S6jC+twT3JUcE02HbEIbrd6l2T8pYBXaojFggGjUTSv9d5YUN5N9U/
-/Qy0o3xZwHNdXLx6xSrUO+NT5JU1Nh/0sutEH7ru/YqFZof9vfCbV86y8fIOPgk8
-LkJNUSu4QCJ1PHKB+fJp7yAhlPkOXNG1b9+W/hVp96rdkovpCUkLD83s+suQyJGk
-QB7Qpem7nS4zp7/Naui+g3M3p/uRSzZgELTnXNyY//bw9fOqx5SDLjSUslUMz+TH
-sFTwfo/Mot70MPHMe6aE6tdTDoJTcv4Iim/8MDhJ6yqKt8sxprataZoWwFi6zAF9
-BzWkJcrbuQINBF/u5P4BEACso8iLzFJ+M1wqcsCDup+GtRMzte04CAlLmaLgyzfL
-3xxBo4AUgX6UbUCGycG878JVn52S6Nsl6FlasmyH00MGjZt1CuNz4htfSmLGcBMj
-IwQv1CYR8bm9EPwR15NaWdgzJHShCduMHv4HdfqSa6UQfzO/P8mwioER19fkDQSE
-U1KsY0yl//ipWiW3ZJGShGHLnn4YbxogQtsRPESKUsQ9MtzuMt3ehGtkN4RguOXC
-6pCWP8J4F9lgjSZ+uLOQKV4rmpbSMXntOJi2nu+14Zj36enW8xyAXO/w5z/wci2G
-LN/aa/v2a3GM3WJQsPNzpDwB+pr1n0Kp+wK6K7siVmDoV+WecD2KNNgOuSyUve7h
-BjWRM9W13LsgLGhKJA8yUpPvhXk91vLRUhwFJ2GUirxLPLs2TSTjHlHvhcPy6aX2
-HxbHkcOt53n2h0zx7ntl1N7XHozMWmHphPsSvOZ5StuQRAFvfE63EyfR84KUPIbZ
-kvftbAJPKCJC8W6GqhfORzYZqldDNNva5iYHF1OItF79ZLGI56diNsBV9SOVKk4d
-f9Qp6urYOd+9RGQGmCQte/WSFaU9z9QYPEGl1NlmGAWt7KKyB6QXZH1oEMwXtPd8
-4GQX3XGtyggEp6BGwkFFWRQzF1EZ0maRPrpN4bpQqLXSJiqQxsX+FAcOkhpo6X7b
-8QARAQABiQRyBBgBCAAmFiEEfhyRrIAwpaWdHvq5dQ88h3I+QBIFAl/u5P4CGwIF
-CQPrRYACQAkQdQ88h3I+QBLBdCAEGQEIAB0WIQTpq255IzwEFuiZP0UMA6+pClln
-xAUCX+7k/gAKCRAMA6+pCllnxDtmD/0YCUccmKudW9PiQw7mI1HSuwL6aS+MlG6/
-LJ79nmi6TTpe87NDcEv2bBpVWYcQK87smCxIYyuj4SCZuBQivjyuecipRoG14PUh
-KU8UiqdF+vKDvUAA7huOBlR4dgr7/KvjirnbwO3mGouwZszDOLvaHuO403+TPm1b
-mJtEA9y6Wbk/+PTtfPymQwnaiJkPhQ6Q7ZbyasRIisO3MRPacUjt2DXFi5VV/Mya
-8o5Pae3zY+5SjMyE2siPnVE4/nzp424jDzSq4DGEUip/x+QYHFwxhCJmdZlRIFmn
-vSCAGXBpyPVbckC0Gw8kZ8HsGzNbMbx/VjDG3LFT8TR2Djsh99/6icO1J+jDkPNn
-IFEsYjAw7Tos5IPhIT1XkSCW84KqBG5pGI5h7fJzf19sR7Ki6XyFe6VYvggeQIS7
-VN1ISl3tRN/dk0GbrKkUKr0OVfaRD0wXQHTzbec8Fs43G0z/DKoFutGB/J3yjAmw
-IOcP5R6rqjhVp4APQpsB51XCaaqEXaXZyMWrKILbPIjlE6FHeh1qd+zdIjullnF2
-YZv89HU9dIXxKr35CM8f3BWm4D4cRjsUOWoGhMNwdHzHYOdys6T72KBK9D2irz8C
-L0bycjN+SIpde/auo+dQKqKD3/ipr4dyKJyOUsls9cyhxkFp031cZ5rWbXcLJ8/s
-1BeVPjFCngqPD/9rMKA6kCSnTo+rSqZRxo9RlQwy4K6xfPPdHZvBi3A4UYCsurgl
-qLtFtGG8SMWigmUZWLT6uhsi0orR5wfG7vzajF0Hcd8yuWa4zGeu0rFJXgG64Pyj
-nJHtv2Tzi8DNY5Y+8mfXqUewyEUXQLxnLqpGlPjNUAJKvjm4SstNadewgWeb6F8x
-UQJc8owGmK5+yZQ5LZj6bjt9Dr3SCM3Og/iS5XK5POGUJgtgXLXp3uy7p9SzsJ73
-qhrDII/YqSwToMu8tUv4xEGxyceVPDm+ywde5SXYmtvMYrq5DBdlalZ9kBlC5fyc
-IIzKoIOOkKKpa/YAyKdLTk8ZByjDk1RrdcOyP4VNpCvyisf6JPwWfKdM5mxf47hb
-s7zioUH7miUGA6i5TNi1e+DU2mL92sJwQ0WkHw6KaUez2Y9CaD8hZnQw/h/JcNq6
-nb8y0GR8h7qWms3K0rtSs8SuDXUsdZrFAeURivccmohXddtt0FDzkheKGXs27SSl
-8oOCh+jl/hEUzz2mJGFwRBo0FI5ipN51IfjhMJ8zzSmvfrtdwT2Tu6wSY9DLsYR7
-0tWGOc2HA6o7kdcC1V0p2jvQct281FrC9dTXFgcDuGUBYhzEZeWwjuYQXBzMquF6
-ersVnPo/Z5l1SnkK+wVBQbf4igHOaobl0AQxnb86W4CXBTZ3CvRq6o8vWbkCDQRf
-7uUlARAA7oTlVZXhdVlPnSQlnI5JwovG2jEIrRifpbyavlhlosX+rgtQ5EILn0DS
-PJ35CNfOAeOcLQeRrJAZj6w/x9FHWfKRAHUeiTTsVDzTrDyJBCVuC40ck587KVUc
-GuB3vee03/y8qAczj5TZNaDdl+4qAzOFQuV4MjwJOx5fsXZw3dUAS7pw1mTkAYTh
-nz557buc8JJCxrebT6FvN8bugk7LJ8SYmI154Q5wCdXB6Q42sdSMFlKKPYRRmIvX
-vI4Ytl/J35v43gCLbXccTWQpBX+ra75sndS2hYGQhcC+WdNtt4THgU6Sb7ErpJK7
-7A1r1Wf0WSioQ2VWjT0QbUE+6IXD1J8duh6ZgzuqppMm13aDdMDZGwdcxlFw+vlo
-bM+IAX+QgzPjslM3FHVvvfCLka+ctMO+lL0bz1G4njNEXcIAILhmoqRI4ItVH7Nl
-ZI3pAfLLB4qbhTKTIiS+uIoA82RU86ozr5oJZCsJa5N5EpJnYxnjv2tYhU42eh+j
-hyM+5ra1dXtveKvL5SkVuRUlPZvgOuwQ14Qnj6sv8CmtBpyVpupHmY2RbNtLVLdH
-Ix3lyQbgVo9iMJIoXiPXmcRWCgLgOeuETjFXsEcFLxuN+D0My0dtwWcg+271vtPn
-0orTObxkctFK+V32ByJYxVvytNCW245bICpxCicxmh5kYEmQCnMAEQEAAYkEcgQY
-AQgAJhYhBH4ckayAMKWlnR76uXUPPIdyPkASBQJf7uUlAhsCBQkD60WAAkAJEHUP
-PIdyPkASwXQgBBkBCAAdFiEEqtu6UHTxQC97adVrxbTukxqfnf0FAl/u5SUACgkQ
-xbTukxqfnf2aeg//ZspIr4ETVf3ai0dXCm2Pf6gpM7QUfI9fPUHymvBhNrNhfZqN
-ADpzbJefzLif8as7kUr904zTc5Jse5a0MzCrMyEwTDIoCKDv2ktLq1L20bwflZs+
-oP27CYC5FkJYgLYPrQZ/7hRC8EWjgn6v3seJtEo8G73kiVEBOnxVEfGZ8zxmX1Cp
-aOWfhiFYCmkEe6Ck9hG+OaWt7+WW0wWT1UFiluzRRAEMROcCUtyB5IPCqCH/Rz/m
-/bE6G+lHZo6OY/wY2q/oW2f9JB/4QyJeSI+fkjY/wDjfNQjiPMLfZctv25IeZYVY
-ZvIKrdnjbzRe+GwYLg5G/SbpSOEb5O55Ps8mNUpYFaMCfefW+DG48a4WyUGzFr52
-BMKvHKtc6c7P3+muBAqcNZYxRqyLIQiYiV9CCjpIV1WgUeedroHUXvJF/SAvNVvB
-ZR00I/D2hsD9BFh3B1FEYbw7GuYuG27Z6fgRolOQUeTabjQLI386SV3IxZ1KFwm4
-GU8BTbUA2zwT3hu/BaaCI5jTSLyBpdo10b1wgMEnqmXG6AbNdxFVEWwE+CE++BHW
-0YBhKp8fghHwwN1fwTCV+QyA4Qn6EBVDkTrUPKqTeCmHzt3AQh8WVrsmrodyr5Yp
-69LoRnlkLcGJiOCKMOmkop9Z32ckGieYHrl24Dw6hmUSWDG+pBn0ezbSPit3FhAA
-qD2y1VzqxsaCOD634Ltq8AbvphP8XZPrrsC3DIA36ITaCQDa5Cn7madLCXy/uP6N
-+tojtzXf4tUzumwGJGFLtdMXNmuEuXrj++NrU1xcscbvDn5O4NDMadwI1EDlQo7w
-uWK9jaQAVhF7iDEBEazZe26knQFxC0my4SyO1uQaEg3BKHj6z7dkAjzWJaQZhzql
-yrRzbCiVUUI8ZkrgM/+/6NJohUG/had6DoefgK6H8/yjgVx1Wtx+XAuBQ2cvclhc
-TAmHs128dWduNHxI2Yx+uM4kuHYpPKBwdEh91ZNeNqtBJURfSVjBCjKkTYiS7kiv
-XyvQOBdZVeSVpj/QoAfaUlQoBVm7aF6xf7GtYlVzjMsLYdpjXhy4ZbQQVUuPI+1f
-yFkw8PpASZ3gvO6KQ4V2w3hOYAxYQ1kSwTtaA7+18nyv65VolTmAotmLun94UKn7
-zjopByBnC/XEqsU3tibg9A7xQ2KUpWkpmG35f4ZR9aEIxSe2Jmm+Se0JfiAq6Szf
-dyWvr/TzaS/BZL4WEPk2Vw/mzWEPZOscpIkBFGK+Ul7yuXvbrbwr+zmAikHmTb1V
-XfPb9eBnwDDuRHhLBym4FMrPjzeziAxxkScTfDjWq6rvMmaEe1CX+dj6ldx9Jp9d
-iUngol89eSgAQOtptjcit5o0Y0Mu/RF6KIBG89ghFly5Ag0EX+7lVAEQAKFx5asK
-W7A9BNKPkaXgym0AlW2szQR1nwxi3APLVLS0Al9Y/3mnBbYyO84HDr82AtMSWSMY
-UZIKtkUj2sVqUb+xHOPkY/MenyoBrCl2qaTVJ89nnWMUjtrX2qk0O09+ByoYXTit
-BVPAIZ/qZfGNB+Dsp1haNKRdowkf6WXkw7A9dHB5isVmaM/Z0THNJRHwc6mcqbEV
-M4fDL+OCx6m2KQHTHirk+OE9Nwral82IIqj3d5UBHmjHAbQNXTDzZbWg6tYbLN3I
-EYxSRQpkJZIVheyBmWFZuivm4hCDZxJlZ1sgxQeIZk6wR2LBR6ccTW6PH11PhIpr
-6O8aQh8JUMg+/aJK2eQXINozYdjOTUjnWAUeUqML7Pg/vERRAgHXO9Z+NTIEWEOo
-Ee+8WOFmrmfjb9Uz27DtymhUjOl0ryiG6F1b90t1rZvVKWR2OaCUhICm88o3MCgb
-HFeOh7v3tnQb2Uot7kY1hgch6j1MNYWGb8LjwoTAmx9okEv9mh119k+SdVJP6wsX
-ZtL4860vTfTw6RQM7rkZBzTyf4qCvU5uRSd2u6JqtUhw4m/gkKQyW8jLEkqX7JaT
-+iEBgPzjALvfSWDbDgst0szqU5jltYpgjG3On7/ZGFFJrkB06orUvovxLThWWvm1
-iugw4/av3n64hl/yfxvKQHLQA3Kfkjjzc3oPABEBAAGJBHIEGAEIACYWIQR+HJGs
-gDClpZ0e+rl1DzyHcj5AEgUCX+7lVAIbAgUJA+tFgAJACRB1DzyHcj5AEsF0IAQZ
-AQgAHRYhBGFPhWcuJXtdQn6ZBiGZBzrXgrS4BQJf7uVUAAoJECGZBzrXgrS4jfkP
-/ApYZIRnBL+LdTPYdbZDYXotkE6RO6ZsPdcV1G6na5jJ7igdVuvoz5nP3rX+oQoH
-6k9DysQzyh/SkXRPnbOOyvQsI7atmH7SkhNn7ke8zmEJLzApHA0ZMGXtBJHQkZwA
-5LDWIQb8HbtJTBr2DyJcQdpRmP3hHDgyYgwg0AUG/2JEwYqps+/pqJCrLSP+GLOA
-ia+wRH9xwv1Vl2gIxWXqEO6U3puqUg+0z1Av4Gj/xzuw1F3eLrOfgklhpASc8QtC
-89kx1nhFS+OybQfRAH7YN9DKE5L1kJxQ4t+uW8TiXf9r+MdcVMEI3LATZRtgowFc
-493g7EkTppmqabFns9OamyxXdIzLAKoKvykr7HPCBWUnZn2I2RrcGQltRBQlR0Mb
-jO+sFi89XnFPwXIw/t/9zoq1bXCGTt7H5RtrfxC1wTYXqLEdV9pptNj7j5mlff9g
-DMw1v3MfUxbz9gIDzs7ANnw3SkWi+d0v0bLadWdItkq2WKvvgB58NJtKPc8Jwilh
-nO7W31U/kv8FR9JcFXzS9+Y6ejIClF4FAwr5tK07N/xSFAKEs5kyAYEKxP6vI59m
-5h+tO8cws+pi4gqfWa3t3b+dVzKl9AIkWAYjq9FvbfiqZgKTlTviSUMpmK5qJVld
-72+NiolUVniJbw9Z10ps4G4zmXSl1ZxyKnehUzcKyPieEEsP/1/tctQx1LhVu0TJ
-RLtWrE523hqxpqDdF8/QrNp9dX3YVoEkMQW3YYir2oERtaosWXmRjldq5dNfgtwc
-lhG+/CP5rxNeCJlI+b64pC/yQMCrbz/V74aAipuv7ZZMflgr7ZD5i3jyM/7/AunS
-qOUPwkKrjetNF85eibeO7c0Y9/HhILkLQ8EoNfJshdc0/scwMZEpLHTMAHSrxCAV
-FuhLsF9epenA6IbtuMsp43aSxshX05RH7F94uj4VCMUSs/90viB5njItpPdZCqUH
-eXSvLSjxqsmS4Tz9Dn+uWvxleBLRRcpZykuNLGgwVXafWftWbA+U9KaJnDWFdzjJ
-+gAsWfHfFBOa1RfXYP++e+VJflcHaEZ4byLG5Zf1HqAvvcaShAVuMXY1hoYJinvh
-uk1zJRW9dP7apZx7BXWxbWcn8LMR5GFfunl/M2iNASmkqxJ9gvy6TBRWJu2QeNbN
-5Ks0/GDUawQqvhmM3V6zFQWVsPwaHpufIaGqnKC2gXaIHXPP0ldyXdLXwgZ+6A7D
-IEqHQB2BDbiJtovk6GaK8PUCEHTiDmRF/mBzlpBJOn+Hc5ELufgr9E2lkrKJzFag
-CBCucNhVEaUedFrycxfSALing7DJPWb5cobu9K+3T9L3k57XgxSAj+g6vOxHuxHL
-ve1IPheCWfkKpJH5faFDWKpJYYPauQINBF/u5YABEADgWTS7wFA39XvpWNHSfAAR
-2/nlGWuTvD7zoirzUwOd2+I2XYwgl910KsznhlqDrHZlqKuGRjQlbpyTbsOH2N5k
-IE+0uEXidU3iwslSZ33RLL0h9+czDnlgijYXLCg5ScswBEC1E/kXX685AUCTPX2n
-D1+Ymxxgov3AvItVxKDd3N5ERsy6hYWPK4ACXt47hJFqPfPtnQe2IdFkRm3bOuX/
-X79Kb5N6cAoao65Tpsix1pm6tTNww0+THzIWzK/yhi1/tUOv/QJMEVAxeBAPr+Pm
-mvjHvsI9RNQt7VnoHVkqJhPDxyQZR2IOVQXvlYyCtkPA4WQlyxLzWM24TG8xhD1v
-zZzA8qs//o9QI8OLg2ZYxplC4lW6GEZk3GnrTXs7bW6HUq+RlayIbDw7oMs30jAv
-YyDdQpZrYuZvsWKbKu+65Yi3M5kW0v96LT3ueMJaL/RanL9JhAWuEqyezffsBZ5a
-88/i0n9FJ8cQ1fZq2/GLq/mN2JZ3e/HSWynTnlmk+qGk2bq0cRFJNHAs2HNAm0Id
-pjSFCPmek9j30wp2c2knML+SsSw5h6570mwILuKwFr6i2hyFlPk4H7nP04vPQ8P2
-Pu5O/Cfg9rPSBjIi9FsNS8/a29sSuOmsSGHZnMrVUpGw+iKmx/jVejOtqe6hYydu
-MSQtIU59E2fq5TM4tub6qwARAQABiQRyBBgBCAAmFiEEfhyRrIAwpaWdHvq5dQ88
-h3I+QBIFAl/u5YACGwIFCQPrRYACQAkQdQ88h3I+QBLBdCAEGQEIAB0WIQQjoUGa
-YHzyVyZWN3UsTffOV4ELlAUCX+7lgAAKCRAsTffOV4ELlDerEACBP9kAH17GHloL
-XJjd1IHttRWU2Qs/VV0H14g14hgRz2/Qa7KRR4mGrXPKS/ctMkDXwlvs4HPUTeO4
-MMT38hwxv54AjW7CtF8DR3EQFXKR51roICQognvqpPe1auNERdLzAdcn+NoHEQB7
-eyPqjQM3OGGq0SVRwNnv777o+Kd8Ncv/4fR1xvA20Ds94G5vCYpHB6J+lPPVXBmz
-rOYSf+QZWsXjAZdnAAYkpEjfJhNrqvqSoRxZ0dweCqieenm8Nzt/vdL9nT3+4AGy
-5hmaAG2ENj5AhI194gtgACvKwCl5hF0VKMhtm5d9SWS+1quHzgn3UFh3VZrfjPid
-CR64mIu3RpZe7EcR+lMl7gCJxdFlHVD3z1lbz2V6u+xH4ZsLrTY+v8kDxzY8ojM/
-zDbnlEK+xzA9akhlaD3D3wKXRVuSlrxfEVv14mwKN5AYHN7bLL3bjOo9WYtLznH6
-Av4GqXSQ+LOl0+6bLKmD68/N0q2IiZwUSOsxTE1fUdYPF8eiN8L+35Qt0jwybieU
-a3JYtmO8EW4ZEmjJGwKgyrf+eigJN2/0AeBwcJyUw1YfzaqqS35NNyn5eKANyFQ2
-ZhIjuXRyBOoUMBAx2TSm7FGeFOIw+aQgap6HuGbZ0EZBz6hr9ogNC9FVXCPENKo+
-GdTGoIEs0n6gGOPP5ssp7xUK3420AM3HEACSmYaNC1Gfq2d81fI0TBJ9ATCRPo14
-MjJGiWaFaXoVp/lQeOvlX2JyBG2I6fhMGPGKntCfX+/MERLNAiahQgOjvnOCQdlL
-hbq+6loQ1eSTX2AXpRlQpvyxLuebbM+HX3N/9mqAksgQdljmqoJQbiE/HqXqjmKe
-16ylU3Rjabyc2p/31p7hm0IJ/3yqDsM06FUBJ108SALQyVvKqRA6q1t/Odb3xgt2
-isbCEgvhJ8kYz3LQkvTW75rSa1cM53Udd1rbyo1t0PaOSGeUZw73/nY1+6LtUEg7
-Q0x4ohL1UE7z7+14mAtn4OvGDuZJil7Lf4cPszf0SFoHPs8iUFpSorBwn3u+5ZXW
-NYFblPU2WK3O52qZqsjuQI/gK7uQhXjJO5nA5M8Yv7bVrbLMOj64hdOpNbd56Ycc
-qwYbHZL3WyRAN7TNg5ZlHgIVac22StawjXiHWDGaAXpCaHJn8ryM3LY+LTz16R2M
-bi+HVaw+0fY9f/mIcOdT6AyDg+V200GkGXL6aw0LZkBZmDin+OMmL7AS8TZ4dvZt
-zj+sykcT8DsaFj5Au6zHJoCnsuShMquHOA/vcUkhoe8/E2Y2QdiX7zwDM8vFM8tX
-DujFLNPIZuItcVEpE3ysFV2ZfVgBXoxTlZUQxdgJBQ0zg6Ez7rDYEAhVqo2gY9sk
-XtN80X/unsjGSbkCDQRf7uWiARAA3i7pu8/QvukeIBoIk1V0GHGPjX+GeV3fR4fu
-ciYgx+NKTXT/oJ/89KVeetT4CSnGEZcEpAvsBL3hsiblJYyLVmeoCniFlU+rMem4
-zYP2PnEX70Q56d6SjBArs3K1FZK25S5qqv5ceM10NVRwPufV1RIuui6mQLm2ZwlY
-JyyANZZXMrHMJdaHpK9mMBSSF42MFQZhcauQCrhMhcpmZKn0D2+PpRveYwSr43Qi
-qBWR2INTDmj/V3ERMviE7vLajWQcmDdcrBp4u3miAJcJSn3XR5SiuL5W77jFEzgJ
-zR8yTC4hWE60nWJOk8UrEbpLyr7mBE0Tr7+1IBMgVXh8WHyzLE2ENREFvtp8KlSS
-y47Ky9n+5aqPI4M7epMNwU/ZGQnC8o3yX0zZL1tKq0fTAw1Ly4NGE1gRbmzrQcCh
-qUHg/J4KFYBMg8eCAzuPp4CRk8wUzu4fRWrOraoz/7bvhH8ilgPu1teLLKzDdOdx
-QAaiz/nGy00ICNbYqifR5m73K/rDdjtIqgsMp9Az0mEpgVNq8SPzM5grqAnP/iww
-QxwFftiXq/pEP2d8rn65e8NikN42Q28PH1D/uBYnOuVdZUvjU9wwywmfyr+NZMaH
-X9sN8R3Kk990W9VxwdOTITpAjz0qMtpE7i/GwPEtpZPTIfl54+cVKvyUjBuTXkWn
-vXN+6MkAEQEAAYkEcgQYAQgAJhYhBH4ckayAMKWlnR76uXUPPIdyPkASBQJf7uWi
-AhsCBQkD60WAAkAJEHUPPIdyPkASwXQgBBkBCAAdFiEEBjEqvVaiYb6sKxATk1aQ
-aqvQi4MFAl/u5aIACgkQk1aQaqvQi4P2Mg/9FXfsIZAgPN/Dq95y1fHG8jsPXEoY
-VNY1codxxAaNqvBXZkfJbFwSYpLY3xIbyxHuGuOtC9NpIy9M1+PR7MsxtZAvSjP+
-flP/12x+6nP2H3NWOICpsY1tNOnQe2SjKJxZXHFnDqDBgKpv3QfKUHmYEdExJe3p
-NQrjZAgmdbEHeoj+P2VV5vqRrJoqNV/pUbM9czfEHeMVMm/mwWNOi/paCh1y/PxZ
-Mkj2bqLMRFfML9O/7QOJRxu3wQwl6jJHj4o6CHks6t237FSB+qZhhQP+vR2CZl5w
-lQ4trw0wpNgbZRIMlU3tUfFQ+KdFsM7UqwzwrVgWFur5r7KrFzJN88EKSplrIY0q
-se6S5b58H7Tw1jtfjb/xF6jQz5aoZ9xemd8roLReRpKPq70o2eIP1HkjCtqmd5Xc
-RQaVEUvlv34WZQ5w2eA1bEBESjbrKhX+H0Un0msUS0JpnpegRNZqW3Bedeos0usy
-MsfqMYmZEcZb3hw51XnSb8B/WhkSmcoEuECRxeCu1tw0pn7o4GemAeqT5ng8LXeE
-RJhrUTlCIyRab8TIQZvmf6XjneT0stZLKCoZUXO+7FH7F7nPsew1dU+WFIauQX71
-PkZp2JMT7W57HKPuEillF8v5+H1k9Jq/2k+ZdgmT1Gd27nALBOc7q8rr00Lf6BU3
-K+XsfWo+p08CXKudfQ/+JFzzpyKeX5nVqiqbxqUakPy/Ot010/7457YVpvcLmcvT
-Yn4cR0dottl96lp5wT1jN7VXfZu/tsHEtTg1ofeExNuCL8DZVsSN836idRmObhLP
-dnYmThZcXBJ3RgSniQNwvuuGUtpH7OXb5vnAOe42+n3yucxhPI9Gzo5g6fTqWwb+
-qwh39ydxtiv3v3jgFixJLj/HH3MsxTm6cNUTWNLzvX+HugBeuOfyDG9++fe3UmZe
-MczAF9N9tDFP+0b1diXywJWfSdVLBmMARYeh0Swjud60SQLTqaqXVfPSECGo9LVc
-wot2u4q67QhUC2OTKiTkF6QVE05iKoPEPkCTmMvSpbHF3ERZE3J6YsVg17Uc7LrZ
-7DRRF+03mu4njS8LvIoeBuqsB96mNQNH/PwLSANWTtclCwj2C9W1HKy3zKjnu3kC
-PHLzwQFEO28TE5EsblnBdA8ozNIV887V7yw89MxPhpuXRn8BVAU1S9Dj7j3mNHLj
-rVAgZmr/nx3oDt8VfOZpK8u3u1voZdC+cnTBdcG2gzM8Ya+h8C60Y8dFzykr8hr4
-b5gDeDI1OkQ2vOQHtnQPdscYKl0v1ntHq2wrFuCIol4WneKh3Jrvdb37cL971u4g
-dpw0jTO/ykCvLlipxjJ/NrnXFb6TriZRgWZqiIwY2lKEfZDXqc/iOa2L0yBr21a5
-Ag0EX+7luwEQAM/CQdinTzIHaEJsCe42g6tt4dBC/UC4wD367rJcyJbEd+qaLJwS
-CQUbg/wrEdRT+aROHVKLwrvXxtgJs0x15vvFTurkn1BnNMh7p8woYwip7PKrNn2+
-96Yg7Aqc3a3gkDQeF8Q7uipOH/5feJh6l7Iu718pvnDUw4UFZt/RUrdqseFXVwr/
-ffSalLx7gJhL3mYuU1qpJZxsonNwAS43eViagI0FHSqixB5kPgFcbBf3BIiisOCy
-a1L9a+zSt1y1aEFC7m+9YlGJA3C0/X8s+dK0VWOrJlP/WmKUp3Epxpu6srsBItcT
-YMuGA82/03YAJ+jpGMRb+X1Dq9vuOUxvDjG+G10Cgew2EjiAkXpVg/1NsCrQWRbs
-KtFf5PXGfKCO0i8hEzwmJLd5OlNIIiup450iX4eS77Tey69hGyweLIC4YDPDwFpp
-bkDdRG6nDvePbEHi5z1L41NaWNa0wEyh28OqrmD0FCcGukk24pBVemVEx0En4siQ
-la6/1QXQlG/wTi7Yi71V/4oz7iZ4lSPWs0ACFGD9W5InlRykiRXC1cV27f+qMw9u
-Y6UbgvN70cWflK5C7e2h/eAQfxj+seYFUjMnJTkXiZE85m63p1Yu2A1c9+jqJ0L3
-Lfn5YIQdtWdY3Qc1RIQYPVRl5NcgXIPV7TwjvnjowuHjWX0IQbhv61lNABEBAAGJ
-BHIEGAEIACYWIQR+HJGsgDClpZ0e+rl1DzyHcj5AEgUCX+7luwIbAgUJA+tFgAJA
-CRB1DzyHcj5AEsF0IAQZAQgAHRYhBOJesM8c6ASdR/HZpjPhDkoYOo5GBQJf7uW7
-AAoJEDPhDkoYOo5GhpcQALowCpZ8UowMWlQFfZ2ySJalnZM6S2RxCFiss4W9pGuu
-9PKuN2wdXW3HGkBGDAuQgLwanSfhGSt/urT3+DT40OlDMzanRwEK0qiSaSs/xBtK
-dNL7JmGbcWTXpNP3aHhfYhVOg7NJnsfZ8Ti3dfuv3ZrjcLvgdnZ/s6O9S3gU8DtH
-fpnOfE3hxjUEHEw9hs9Otc6foCqMDZDvfU3emYduD5AvTiXYdeD/mZBD4OmF99II
-XWNuQexAJ+xgOPdvXaYt0lBuXmfMcn/1hrU3RJqguwnPZ2cU5zo41/uSbdsFrTHK
-yEOLTn0XYYk07mZGdscljzmXbpsbAC4Jp8CDBhUfdzfi1n3AOyblk1nywfionLlz
-HDtfWQYCxp16N8S2MU7tA1w8rFNwVDVwmxIfgjLrjPAgvqSpCmLHTXNBfdLUYRAv
-SpY9TR+U4YOOuEx2Niwnprdjm1qilN+fmPR3tWvVChlD3kHmSpi1+9ix+xizlBjN
-eZ08Eq5rDBPsTpqJmoNS8pHE0EL3IVpcB1pZ5rd6UBSa7LoMLeWwWm7Ap5VZALfp
-jMNws4SA2q5OTRY2or/+m1+cfDWIP+2XQV4YaNFMbO7XKr3vnUOxY9gyADqfRJiv
-DljHiw5iLzbkaHs7dYJOPNMGMlRzZfkkxg6Patx44TQ2rO7LnyCgVdFZWDHNevgR
-Z8AP/152xfh3qsOnT+R32Rt8CcwXmKFxLylgpjegcUmbutow9zdlX26qZ67cJ/3p
-hNLZgAYKPrGecGA0BJ2UzsPEKKz8I/dAp96LpHo/24WqUamh1z2PRAgyJGC43zm0
-rA/KAlcht8bbI/VuZ5eAYXjH01QfPS7i7fFOryYYFqfH+BTp3ZEr/A7FkcOZXmNV
-Gg4+oC2t6cJnzDsM0MUJ7dgNAHTLGx6RZZahdE3LJ8oVJ8Vek9KtjJbPr143EZLt
-ymkiy93pzLUaKWfCZJCCI9nfJnNZnvoQXv0l3wnrQIFE14Fv0jbTALHRgRJlB4cZ
-i3teEuf7shSDsd13JDdfmxMsxnfeVsIUPa+J0GBSbe14JHXlcd0t03cpbzO547Qb
-rFpD98XO6Y7OefWD3pwDF2Izjnn4Cny/hpUIEO1A2j4qHhUkqmnFmBO6yIFic637
-CJnYe3uU7ss/TNIUKLhujqlcNl8WeOMVPbhnCuOhyQh2aioAKn1yiQ1EgNSIGIVD
-LwqMt0kxI52/aDkZgCcEfBFC1c17IeUH+G0HMGm49/acFHkhX61S4efXhvzH5J0l
-Dr+0qk4aVKNwqkUNp56GSMLhiiSYivX9Xa4qQGNlmrki1pC2DamlTXDLB67XQcRp
-dAc+4nNTK4E/czrr0+wlkgz7pC1MAllCLilyTSPGnKIPlOd2uQINBF/u5d0BEADF
-+6hDuKvzbmKWZNXjJK6Em/5nnzBOa155YQLN91zMs6COI4p+YuIVPPzVWZYR0yHs
-gTWw45cMV+RYwuL/P+1Z84bgOyPloIVF9VQjOC+wB3Gn4qmTzobr6q+UfQVvUiUQ
-8fGG11teWvYpWiG91uialjHZmrpAOQxjHRxHPpi0cZtTFEqinCIy6c942xbtZnzf
-nzPpxkKl0a8s1eKZ0KlDK6Ab59nxAinilohXRg/U6sqypsyLl41L0qMZek5dEt4C
-r3spdSkZgxqJpLTqQy/5VB4pcfEaIaank3sLxhpil/oQiq+38WA0VkICQyeiCsvf
-eEKyt1C6COBNH+olegUxudTKDHFthyGMPRz3McI5jHxCyru0mfLJag2hHXzgGoaD
-VkYIwkvyVsHWDqrZMMXcCIUVlpphxtHo1M32AATnWFe4K1nFdbejR9XC5xWOgwbT
-zCblqporHzU0c8WBbfJ0Y10IDrHsa/F08PkFvVN48Ydik6rcwowSPxP+59Q9AKLh
-Isd2hzfWU2zAbG5Ph1wecwlYR3tp/0i3uSTDXfuuaY+vrqpoECN6fnSg8NxiBbjU
-JR0Ju6KDM2SeBUz5hp9BzL8+OPTogRZoinxBogrRAvdGLOnLG5hMjBezzF8UEvp6
-IMisGHBZgXoX4Juvf78RE8JOwHa+HUejj5kYiQW6TwARAQABiQRyBBgBCAAmFiEE
-fhyRrIAwpaWdHvq5dQ88h3I+QBIFAl/u5d0CGwIFCQPrRYACQAkQdQ88h3I+QBLB
-dCAEGQEIAB0WIQT2AU9wN9W7TuO6I3E56nu98JFFWwUCX+7l3QAKCRA56nu98JFF
-W5whD/9Hu5cnJ0hnzqk3MQsdMXbTNLsv+KePV71kcMRat4hjw2Li/TUaC8xtA81d
-O/1obmsuoDAgv82KlQ7DLDXjFk2q45lJdgZxAkN3dEoYakdTIEi11FvwbhV+qxZK
-jTq3jFQho4i3GDLgrvBMG4B1TGMH0IPux9fmBGpxYKmp1GjhpgoMXp9bqzsV/mPZ
-TxPlmIpeJEO2jeCWKhHHw6rzwGjF68G3HiJ0TqvjdCtcNrwd3GTDsdEJtUl49aqF
-M7VfoqKjVdRO/YDL//+TJNOYz5EBGjIZxbhgZJ9Qz+geSBx9GJtDWdq193ofFi39
-oleTFnEMj+OeIr1Bc2pc8Z3HJttFknicJDkeze3mM0CZAkhVkLFy6DvAQkXrgvfp
-AUYFACQW8E2XmRBiKd4huojWYz5QGSEIk2fYRVhse2HAUZ9gTODSX2L13nls+BEi
-sArsmSFA/RQslDXW+Jl+P0e37BzN51uk2Dg4ylJUBgcpTRUn4Q8c1DgHDhkEVnBI
-ny2H/MFuhImw9g5xqlBfCEKh5D8D0e4fX28MhSsBlOCeIKJoY85U3GNY0tlIwAt8
-M7IIHe1n1qncPbAMmq0K48J1lfyTEbXpnSfArzEdbnosjBUaiQX5EwA656eZ6wb3
-Vq02UDei6KPuOosl4Voy+Ffq5MCkanVMA97/0wV3CeCvQYGbsvsUD/9fLYc3yH7A
-0xksK7PImztDR8MLsUPoiv/vnfZ+WJJ+YJ0TKAHm1ZO3NqeZmD7XoWHKwh83zsK8
-x/JUASCBN16isC+Ym6IwF83/HXJfKNvvotkr2WG6Dv8Vg1Hhk2Iv5y3EMbFa9rfv
-6vjxho+0sYrraJH8qQAM08IIOi7+afrkR/ikgA8V7ymqmdxtMMHZqG+h5R0VGTVw
-QBxZ5/ZiY56Qn5UH2m0Tc2AHOcAQTvCEwyb19IPyhif+rek3npSvKtDc6WBJioyi
-gvDhl+jgIfcIo77w6GthgbFc9k68Je56Peu2J30zWj76Z+Di1OJhAj1wFr4/XT5o
-c1MB/Vfyx3hEPRDNz7dRaDqoVnYVdoI0blyCiSkD9I4/axb4X3xN2SK4XA/zv+Lb
-1FbCM1XFL2aF+09tk+77EVdWsBmQpOArD0d54E1YulBGaxVm5QKfov23KiqHIFVF
-8WYqJqNJwbJRZii7klczkVm3wFte3NWK7HW8kfF147lv0z3AiZYnk0O6Mj1ip3R8
-Qm5yiv57DbbgIMkSPWCpEtFGHIoK2msJ2bQcizh2WGxLos00RTx3IVAeSAS54+kr
-rMBg50wNczcGHKPDUKLwkYczgHonUtljAkeXnTl69rifChI+KpjHNtF6dFgC1aSt
-MOud6HhAcd0f3lmuPzCGGp4YOQx9tV139bkCDQRf7uX4ARAAxaybudQK4fMIzLiV
-grIzthhb3/DK83PNohTNMemM2V2z1Ij5Dlu2XNDypMdR0rKM/QI3zWud1+vd2h/l
-QZlg58FspvrY6I7hI+cbdRldVaAKDGQHo5Bi0a7BkonZvS/0wnNUPIhy/znzXtXR
-f4L7ePZMofH/2shz4TZ1yNpU8zaomY6eNjSc51P4vVxtDQ4QofQeJEn8aO9a4whu
-O0TVEAPKRYBRgjM8faDuUJtLfiC3OrhLg+B7JVSF3di4JITAyafPbZACLjV7Umxb
-SUL3qTJZVpIuhF0xQOCE+WRx3Xs7lkPdHMqP2OaJ8Y4ymR08cSfIP2XFKsQFtoqT
-VyMQgGgI6VXF8OfnCnGgx0Do1vJNoL0neFzVXpCPPzh1RbcrtndZWum/1R4egkYg
-J8TPQH5X391J58Uwd5l9/ZDdoSeeQYdtTR4YQ8//ATFO3hoSRvES4U6ZwO8LM6di
-ra6pqb6j0liT+DdcBwE4C1bGJMJ6d93S5SfH3llDIMJo7uJDbKILFMES9rg7S6I8
-+SW75TjKUk4Y7L8R8qwURqEyuOOGfaQXirqvji4PdcGDBiIk2Oq69Ky6lmlJgyIH
-SZ7SO1JXk0yAJTXb+a6FJTLFxidkIZzu+LhLBn/MhAPjVyv3qCTQ7O0lu8Mfcqg5
-8hhJ6IE79PBHS3z8ok+mFK0iGrcAEQEAAYkEcgQYAQgAJhYhBH4ckayAMKWlnR76
-uXUPPIdyPkASBQJf7uX4AhsCBQkD60WAAkAJEHUPPIdyPkASwXQgBBkBCAAdFiEE
-JFV3TUL9/mucOD64/hACvFlwgR8FAl/u5fgACgkQ/hACvFlwgR+LoRAAgtIgaKb4
-ZY8qoAFZeph+Syg+mMKfPJkBuGUedJl6IxbHBSg2mhnCjJ0bmdqxsAXgtcSUqmtZ
-Yw9NyoGgiVjs+gu5sQp1Oxc2/keQXaVksTkoXwdnf+2iXyp1WPeeLGySHmzuwy9c
-eExt+h0mVmBgFls2wNdFGPbVfiT3PvFkwqsnta6HebDTN4pMzvG1IIGV7L5KRo1E
-dmkrt3lXQWmdgHl3JoNQ9v/Jgf4jo6gDw53YvJFKJcaOOAS3d4CzPWmcLzcy4mf0
-9YI3DoQCbYL3cRNelUwzUF2L6QyPCwonXemLCmfkBgsSVqvW4fq8qbEHGF2fK7x3
-d7bZEsUiGCt/tXOkDkNJ31T/mC35nxZfcj8AMPixO+BnAeKeYC37LbQD76jrw526
-tUXsAF+QON5DPeot+e8bIx9qSbvdqpXDkK4lGcRTuS2OVC8J9XfDTch4wm3Kd4P4
-lDdRAJWnLfVay0m05LGlekWdEzcjP8KDaICH9rEs6f9e1gy6mTEBnBW//41BxELT
-KxoTGlcX3yEhCmK36g5C/+d6b7Ji5arGGTCa96v/xG32KYc1zfn3TYkCx06pPUbz
-iAl2l0MTpGeqz2hJMOGA3JuxwlksJKqnPYy0hHKdVW4Pnn25NeXcBp8wpkt8VZOR
-bzjw/TJB7qvJHoRo1tat85Uij9rAXqTyO8Ea0hAAi/EfuiDDy3GV7bvjFSA1XEjL
-d+F40g2X0QG/PHTScYB4rFJwV0GFUxLHr4g7iypAVI+BB4EYikx8gpee6B0g3J+r
-aCFDDrRPDKdqrpZK53oYcBPkdSBbCr5MAa/M3DerKBEgoBVUbaSHWN7OH2ae+5R6
-X2ERmYZdW4PCj6lw7a+RhkAsgKo8RjonjV61ehQPZh20noI19Q80BYYSCfHHvzy5
-vwvByhmTMJNrl3PDpBy9/TwBR5DpnHfOPJX6bnl3pdu65F2TRM6yoFbfoUiEqrXV
-4wC1I++N9VjrQvXSp0ik/XaMWq87wLIg+1owElJIzwyZWukQkZMAYtesVFz20YwC
-7Nu8SNr/NTSCH1EqLsS4YhBTsjpc2T8AqUlgxKrilmLbrj64PXgMsQ9WYm5zwlC5
-UA5eky5YhETFJ25dIaplMm47aIbPSH5f9y5eYPkfOCoMu5oDzDzoXdH9V1YfsHqa
-8bboSgTdariC23x38E9PaWQNyY2MFKL6cFt2ilIsMSSD6JAm1x8kBtn1bBopG588
-7mTDtlqHCw/QrTuLreJG9KJ1dQFJ/Q42+csH09l081wlv4BBuVlN1Xmj+c2sWn90
-l1BPZfYHd9jhggI96yTZhfTfFbSMSuGPQyqHnwDYdA3cNj5BYievBkO5FZaCe9SZ
-4xcYgqlVpv15O7VrD+I=
-=Uugw
------END PGP PUBLIC KEY BLOCK-----
diff --git a/isc-keyblock.asc b/isc-keyblock.asc
new file mode 100644
index 0000000..3750f41
--- /dev/null
+++ b/isc-keyblock.asc
@@ -0,0 +1,151 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBGNjen4BEADDHiUVNbkFtiKPaMWjKxbKmF1nmv7XKjDhwSww6WFiGPbQyxNM
+r8EHlEJx5kMT67rx0IYMhTLiXm/9C4dGYyUfFWc35CGetuzstzCNkwJs7vZAhEyk
++06CX4GFiHPOmWIupGCxFkNz1Qopz3ZePMlZRslVCHzW4dbg5NKLI0ojXlNaTDU5
+mgUXpsPi/6l6QE6q3ouvmWPF4u71cZ1+W4UkIRAXOlbVsDzGaMaoHjJd8cOM8DrZ
+gKHACNPjzqOvEujXDC2vyKw6XpxR+pHz0QcrRtlKnVhPNiKcDfw2mJJ5zxi9uSDc
+dh5FomMn9sS4gy2Tub2urELnPf9xnURftRGG3VO6nZc81ufQB4s1BNT2ny0Uhx5V
+mXUJwefMypMBfAvWCWBCeyWYtBeo7LT3NmtLq3oVGPfl7+a0ToFAYeghspK8/nOX
+6/fqF1MEtzvWjXljz6K7FSDYSY9AoaESLHGwCo6dtff5S7f1+l6PCUNo6aM/B5Ke
+SIAN9Lm6z2iVuy9Lukw+5IRoRKHHV4rJauPtDeYoWnNiSd7Q4vFtotUIjRpDARpm
+xWS711Q2T+knHFLEiU8QzxjLhOnTzh4n9dDLHCkOY5WM5krldVeL5EuTyPKinuSn
+oE01A7I4IGJp753CshibxjNYDiEOVeK93R38Y543edlIrYxnfyMVsiqPkwARAQAB
+tDRNaWNoYcWCIEvEmXBpZcWEIChDb2RlLVNpZ25pbmcgS2V5KSA8bWljaGFsQGlz
+Yy5vcmc+iQJOBBMBCgA4FiEEcGtsKGIOdvkdEfffUQpkKgbFLOwFAmNjen4CGwMF
+CwkIBwMFFQoJCAsFFgIDAQACHgECF4AACgkQUQpkKgbFLOwiLxAAjYuI4JQ8mPq7
+YrV9m4tu+jOKvoKfpjct2Rh02n/X3ChOgrdcXU898eH56tRk8Mv/E+cBTPN9zQn6
+rLprbYR2t2R+zgvuUZWA8In7aewoPIJw8OdlG0gTK9m3VHJIOhIX07qcFttSZw4m
+4rEU5mdxi9FatBWBzqnVm4Pn577aqRXK908j+6TvgWbZ6Cq0tw3syVT4kGj+93+P
+uIQQQkTYN8UDQPsAKzfzkbQC9I5YXBKUoB9CfhXig8V9N75R0gsWkJ8Vy/8wsPXT
+9/EPIIzhnhSuUIjvvBPbLGrzDgbhrfUQ/QVuXDVN8xl3rAWM/tiNGOnmzoYORyM5
+ftrnCDIaO4aVKR6rtEzfdQa5Kid1StfhFien/U8jYErxkEn2HRt2gVEX5nYq31T+
+0jgVode2Dzkm4+HKHmfOYsQeC07Mu6wZw9raNYqFjTcfh0ajFpLIT3j2YqOJE2jy
+KbcveJcy2NiOiUl13exIZuBkZm0wEVbvgVX1PlgL3GJqnbU/Q+maRTb8FBoQVsOd
+GIm7U/phU91qR+00SkOcp2LgHCCNKrmHXgiBNYBbInNIp6ze3bFvfKTRFn8WdY9v
+Z7vNfKar8rt90mpjYG9qMhmvh4E9icfp3wRUtOwyi7VVtVTTUq0iFTe2C0m0v6KW
+XcDwwwaTbl79BOqOH3Gp1flS2ECBsyiZAg0EY2N8xQEQAMWcyZbpxEyefX4JTszG
+ocpz8C8yqvZJQUfoDK5AecQWR7OegPkIqwJcHEH5cz+MduklXNQdra/snn6pxGig
+At3xCwfzRTH/aYXdjcjnma1elzZSTgk6Maw4zR/W9wea2DcUtMCcsys0gviN/VUe
+Aqt+5pmhy2PlEWfJG+Mzyrqgz3Q8hRyAJAKONAwNhs1A4ZqQX/6iuCkJbH1CBeoW
++c+5qJHYEXsx25qR1yiKOFo5b90QOcwaebUq+xKQRlnESn75FTgDjDfDm9BqrHcn
+Tv79kOuIN5vhz4BCsuo5QbNu4RGrs/1VSTPvMf5AN7xs9pYNMAEde7pSF1Ps3B5p
+CE6iUw9L53ytV4iJQKXpzG29LofUu65YQjIXPgK7NbBO7FUHA41YbSfoWiOAjfMh
+iE025YM2+RPQh/Nrc3PqBj4h21ycT+d8eEXKfc/okbVFFE9dKS1hUwKgSrs7baOG
+CBZdpiB+t3jWrr8UrteALab7v0rndco3QKOe9U3f+Gm3MdgLK1TGiRgpdyiIXEel
+J7zhsdoYEvaKMgUOjhf+COdlf8b9ITg93mDKe8h0OcpirCXw4O2ma3sklabzZKZf
+CPhhja6Ro5gmO5pxaLau+esQWNrjEikynNIs+GRphtcFsVVH+ww26mR0nI65Llgv
+kb4+DrbDGSPP6R/C2q/LMLM1ABEBAAG0ME1pY2hhbCBOb3dhayAoQ29kZS1TaWdu
+aW5nIEtleSkgPG1ub3dha0Bpc2Mub3JnPokCTgQTAQoAOBYhBNmczq+Hl0cBTwON
+YxguI1eUYu+qBQJjY3zFAhsDBQsJCAcDBRUKCQgLBRYCAwEAAh4BAheAAAoJEBgu
+I1eUYu+q9IAP/j/GGneuvjwbXdATiQAmkiFlOxjs+SsO/hgA/mmWcm+Kpg4cAlbP
+C2xEDa6biJyZ8TmLZEqPNrRm/umiisC8JnIJpIbInn42n4aDCRDW35lrYGdnP1Ft
+fexnEOWAJBDRVvh9OnfRfvf+HLFfLFl40b/15YzkTYGIfrMR9y8zalkzXxsVNsyr
+9Eq2pmYR7BT2z8d/9SAVuh8D3qgUylIgcFcCFJodsrI4zJSpIMfMntwVsZxDlis8
+JVFN8/pfhuBBe6vjqX/cGJnj6OL3T12jvvniv13W3rar2Ocm6XA9j1t5TZNhKqAy
+azAKu52NtdJjh25B6C/H+haXAX1eduCCE74uSarqS3F1wf6JI3p8fnWzk4hZNzxp
+nZjIk3vrHNjE4jXTZosXCf5DoVRfMpNbxj3YEnXV+kNZQRYPPatUPgFYbxz91hbN
+tHyCiy0GmTyf0QId8LTc0y9mPtP9QureJJ6rL8lt7pvXyrYglqhxDgRhJIGKMKdw
+0bQtTEF4tyNzC4/sg4/omAGH66clhXlqMmuUjHSUiQyA4LL1mJl63Q+bwqXX4B8t
+898tSUmb4Jmg3jLZ3Z9Hl7H8Sp3yYPOLzb2YUF6w3xFsUrNNzVxHFo8tAtEhtEfX
+D+ypkowZq8g41WqMlOBrrzQFuExUSXckH2Cn97lV6lkBoueqxP+Zv0bbmQINBGNj
+qIkBEADDw/CKszyuFKpVp4Z26rKJ3ooOlp8p9a+fmfuknPtMjJMSX8xK8pOlK739
+K83yvDRUidT4+R9IAUKM7TqGA0hoPZmZQLiK0YLlAAXufKxO9IsDZI/7DuF2d8fu
+usKQfS4oJC/IbzOAVwgwodnvKhttLWutT09GxiHrnfVPu6Uf4A+GWtrcTIWhXuxE
+m7+16ToxBOTLtQ3hh79/RndUuM0ldKRRzJUzASGIPmdQJDLCKgSSeaGjZAdq6gkl
+qT/K/R8eoLWSOaBRq8lBE1k7Tq4nSwthMHtCQq4+vxFWH3VF9hwy6ixccROPqt9s
+fNfJK3KF4KGhfejMuVn/Lxp1v+Ne2DsdnVofFakAbBMpMyauzAyXPncYSfFhzLBD
+kkn7THkfRznmHD8ux89kV534EyqYLjAy8AAD6zNc3tSYgfC0UUw7yz05Sl/eV9Xc
+pbezu2ipONlXko8jpCQiiHck599cy+StrjjYPwcHF5m8uUlNnzHoUj8qsoK5SA8u
+RnTW2I4DFbL0+x8eL7gmNQYFdMaA4azogtaTFWgPL2jPJ3B+/bUfHDZflvR0FB5+
+OD/QHsDv4SB6uX8TOhGbFsHpt7E0scb2U9B8gQeQQJZ3jmcIRp+K18mjYh/ErDFW
+23ixBe7h3tn2MGUTOhv1ibOYDE3GYBuGLQiom6yhCs8zrneuAQARAQABtDFXbG9k
+ZWsgV2VuY2VsIChDb2RlLVNpZ25pbmcgS2V5KSA8d2xvZGVrQGlzYy5vcmc+iQJO
+BBMBCgA4FiEEAlmjO19aOkRmzzRcel4ITKylGIQFAmNjqIkCGwMFCwkIBwMFFQoJ
+CAsFFgIDAQACHgECF4AACgkQel4ITKylGIRk9g//XrvOYy9zQkpo4Dkol8yLxr99
+Dq9Ur2v8F5Ba4za4QdUxeYrlq8J827mkUqMtnlyb/+3zSMy2I6HAI8QxlDZL5K0g
+Gm7iLrwVTM8nAQiNU5vAe4D6PeO5ATBEvRdAUTQGz4xeaTrUXbmNUSC1dZEPvH1z
+Fa/Z1WZoy9GLeuWDXix6OXTP8FlQWUTL4/ILLtfJDsWCCX7efkyfnvad8Ye2NfU9
+tBjRX5QQ0Dpvgpr8/7El44XcmaHxPWEiq8X2p/d6j3nU/7LspUXRu3ptu5Q2RqMM
+iRDZme2c8zieHETpC7m5sshzGxRtT5jWEtZ6V37On5DNTObvXCiaGV95qgiHi5VG
+s3MFD3QSo1jJI951k68UM8V+OnzbJGN7TezZ3fTn5Pwdd4C4035QMl0E5NXCcXc8
+9d+3DeFmewRRGCaOKPuO/jFPLWcwMlQqp5tkNx8LpqEZfD7/t6FrSvDUsUDU8Rn0
+TQILnUZioO68HmeuJbhKaUCMuZGjBIbBqviiufFRiJuEFOVKADQ1u/P5ct/0T/gE
+JAho3aubzdYMH5DLsaw03W5KfOjeTLW10zSmSK65wnR6fdwlo5l/Sg6Z63QXD+/H
+/OIFgzviJkyoh6MkH55z2K8BDWbhOmaUBjNAcQEXV1KyHeLDkQ+TJfLjctv4KIpv
+D7i6kNIp1b6OSdDS9W+ZAg0EY2OzdwEQAMRWPO237ohaXNpKO+dw1qkfOYYisiTQ
+yfkT7BG0Xvu8jxeOdRuvUzzplgOfwWhOQkyEEXd205/PpwReeeRwhiu0BDSrzYGM
+KZdw9Bw4enoaOinf5WTqM76mc5WUYfvDJIiHies+ANxj4EqTzvSif9hxvvzrbKYV
+lHdaGtLm40D6yZSzDEe3X49DmEABM4g/Bs7NfVJcJ3LtLo6qbLy2tKEgNPW+VN/s
+harufucxnH5HM6BUUOGZx8L04UCNJu+jvZ0zjLc5DqubNO1526kZclAo94DfTkb+
+ir9nxKn7RkdcseibeYPdeIh3le6aU6M0KhTJs3RCxaQF9At08Vrrkh+wkK2Jr5QW
+bs8cHpEJ+Q7BwDuAQetFi94eq7Sswh4mjhJ6ZnFCx8v9EbQnvL76afMbhZOezpaQ
+aAwXVuIio2fsJpHfxWnXb93H1QKiOQdBZZLQGowcFQCqAWg7h2FwWWbKMV1smGHr
+/28tLZtk/4aSCd9cZ9+nofFPPemPLbYwnBECIZN21QKZ2oBXKxb3hchy4EBTKWtC
+G/fbTsjSfTCUpMNZ57HO3rGXchjSdIf+tTGJpAqWkTcXuhWXBMWPK6/2REk/DKis
+XHugHg9R9hqGs2DaMpGh5NrOLly9+0dsjU15iTQucXbCS9895bRtmDjIN8dLSo9H
+6DDw4yO7SHTlABEBAAG0NE1hcmNpbiBHb2R6aW5hIChDb2RlLVNpZ25pbmcgS2V5
+KSA8bWdvZHppbmFAaXNjLm9yZz6JAk4EEwEKADgWIQQJCioHkj+SW1dngDpC5d94
+yDJx2wUCY2OzdwIbAwULCQgHAwUVCgkICwUWAgMBAAIeAQIXgAAKCRBC5d94yDJx
+29U0D/41C8WaGEphQW1N5lT/1284qiPuz3w3iSciAAoAe8iHUGBcSNpAWQmWvWXI
+buKb92Gtt8JtSOHwQj8qiHjqRsUu02t/tEgQMQUq6p2jqbxODJfHR8oMFMMB0i0I
+RgKtEQeq5wRJpVtH+zIFSl9PorsJtHHfhVbqxvE/axcNKa+WaqZdHuKMqADupQEw
+6rD7yYVX6YPiHxMhba2AAAoHT/3VpHC0JidZ5BWGwkfnGbV1/7O91GHfJx6KN/AK
+DKb5hFl4TrieDLJzphBWg0y4FJ4K7WSIKvcT2cLel9f9pHV6ysqSZWkCbkjkaVIi
+LyoA0o7l263WU0D5oG2ihW6Pa2YrWHDDjfTem+kOEFsMjN+Gw74I4KWUBtldfnHK
+A8TyeviKkVok1lwDAoJ3LJi/bcyCLgBZLInOU31mQ7mIXq1ENCOIvQvaG0Lwdt59
+sBI8sknHkt+54t/VCaKbWSBOzgGur6EDf9WtPHWvHNCKEleDiHCELdhRYYtENO7T
+vTv6Fq6Lh26dor26LnARLPvGLAKwONJ0vlTEG8IyoD5AHz9MwdXYgzh8wIvc/HtD
+/0FlQGLd0WYVI6UjZfPxHOZAzARJKXLJMqiSn8hnO8v6JZaUcOF0yRKTKtzqsjzU
+v9TubCGdQAaCSCaD2fmA0BEs/FpOnZ8P1fXMpcHGEtMV0qc0wZkCDQRjY7/GARAA
+ubCCHkdiMblMA9ZlcOVN1Wep7TuYxQouATTb+73iHDQRNIU7DvluHoSq5zJe1Qst
+zjTmtlkr2dyI5JnBexUEKrw2X7gPXfLaXY01gLLB/Jn8tU9VxPqBybxmjmEdP58B
+I7BwmCyMYNqDuvPSfTMlogH/pF35Al+c8UbOfDEQqxSO2nKPNa4T5ZoVxvMxV4gn
+hEJPv8Xte/wiE+CxxbmO2we6rwJjWe7O3T0mNmqvpO8iIsLlQnwTFD5L1huywPc0
+UDHK0nl8k2lkue2buaOiancLatXt/i+L1DIimCgZwOt3DlVLURH5lz5ALXE/fn+5
+wKkp+XVyNTAEFhSGifgBDYFw3nZeRTU7unMsRssL8SjuwPWoCcRI/3VE08xCuXc+
+h6NpGfeJjLRgUSSBF+958djY320TcXaRLrqRhjcJ34dBsDYsRSC15nnq2JU6Vj5t
+rJL9qOdwVAFwKeAfROUULcy/LHZ3QgKLN5jOfdqYzE2KHk1+VANttRPTG34i6uq6
+yzCFFYadwST22+QWvxh2ohYj2INvvrzRf3lVxssWyb4USB0JPajgnGeNY/hSYfDa
+KArqOr9S+3q7h0v4RgoPxDRFIC8v/10W4wPC7R3wj0m/1WHkSm951Wtzq3V84uCF
+LLhx2ByNpnJFRFqklonAH3WHUIeYcdXAsTeunrGU/XsAEQEAAbQuR3JlZyBDaG91
+bGVzIChDb2RlLVNpZ25pbmcgS2V5KSA8Z3JlZ0Bpc2Mub3JnPokCTgQTAQoAOBYh
+BJWA1r8syA8eO7ESUt6rkdVLE8m4BQJjY7/GAhsDBQsJCAcDBRUKCQgLBRYCAwEA
+Ah4BAheAAAoJEN6rkdVLE8m42PwP/RFmUzgsoM23Z/NQ2AacCFTmHweEllkmf+25
+3hP80BuSHKsdzlmllFux+xbKZEpQK0nL3fqW8yyv69WmsoKZPpZJxmQ6bwUbtXC7
+rHkt5gfOXiTaxDBmgO2dcnDsKLb+bEQ7C5hay1P8rOvf13a4UZeTP37gRGmMr38+
+LvADIspIxBdSvFa7Hb4HKG4VVDai8jaPCF0q8daEWMJxyKSfOQBtSVVAzjLcGrYR
+bCPDAI1DEASyQOru52WREe4vJCwSaq9dZyGhaWcnyTVQO8bsSLxu7cUVxA3SOheQ
+izYKkYNbaBDmWlZxLYFsTUf5izEYdW5BwHaowmw22hSspFod+c37BoY/ePfkR5iQ
+YuEff/unyqvdHMDqIXWZqpAi5o5hW3jdCd7ZL5T0WWjz4CQ8eko1ZYYnYzZlDrge
+F0veW8+lzHBLx3Ad8HyVGwtRe+VV1V0AZ0lpWMtxo02ZDRtqNDqPqVfLT5P87ZPv
+r5GhKtedgrjwY2clgmCT0xgAKNxi2SC+c/vI5PRkIoqwbTiryLIYq8tl6T1k6AMY
+eN1ZNQR7eNEXpIvYRD/BZw7IWKkCRaKwfDVhUHCm0ikylwdLXIfEEEA5mu2LJeZh
+vCddhks0S8+lRyWR/3okurF6rlloNtM1pslceh2AMDwfs3fORhYJxFsV7O7fyRnD
+NS93fq56mQINBGNj8P4BEADXK//p0lWEUNUYirsm6BUyUXqPlPrpVTdPB1tJPj1o
+zgeMKFOpYRPU1IZF1G6pbKD09gL6y19LehQYx1a57PF7kCx2ZvvcFN24EHto1H1p
+Ti48dZ7KyyEO1rBeLY5Zjgz6YvQZcSH3cd6cTrAo7hPIAjtgSTWp04FjtYJqf+tT
+gf+9ZWY+i4nQ6/Q5Z5NUd8jsOcOoFDsmY6Fds+lzn0aZSg2yfd8fnX5QFOIwDv66
+aM25q2kvkrX0wtvSQbulC8x5g6fIB3xEL6MWbXcEBYkBMW5Cnw/Kmyj7lJwVwvEO
+FFhKaOH/d2LG3rM66gl048aJYLhEJyFSyooBynXs8S/NLDgca94Bvb54FPX8LC3p
+lqJRLxhdkha5NLcUYiHOq/L7LWdThh5rRAy87Ggog8TVza118K3oiYujlyVEzLhB
+NVMT8x5kl15YknVgOKJAv9j28bSZihHrS7aga1BtYFD8yA9MuuDaHARV6YmThkdg
+OEz/PNECjsxCLcT5Bbthzg6Jg1qo3Unyeup0UbyX4zxSphCVmerDmMYddLjJ/ydc
+1uxyn4IPINBSx2sAPuUIymhVC29MB6N+SnB37/poTvSsIH15Vg264OVdaervIpuC
+W3eUANr7zrdO85nc1CTWGhugFwccXv9nyxAt8zUF/ci17p1/mLpy9K3LqlStVI9j
+MwARAQABtDBDYXRoeSBBbG1vbmQgKENvZGUtU2lnbmluZyBLZXkpIDxjYXRoeWFA
+aXNjLm9yZz6JAk4EEwEKADgWIQT8h0w+P+hncHCscb617/asfhrd+AUCY2Pw/gIb
+AwULCQgHAwUVCgkICwUWAgMBAAIeAQIXgAAKCRC17/asfhrd+HM6D/9KD/n245Fq
+jVzew92lJtufAxAFkTA5WO6fXweMlUeqMOub4vpVMLPLoFe5TzWbJMtF0m/P5+aU
+YbcvZBWFHsrnwTgA55c1VrhggLOxpw4EU0TvBdwrO7PFOYc2WznaMG+mJdqw+uNM
+yK+G44aIaC6rvi3ILSo5HPnbgQWHs39QIRLLcUjtqvavQQeyYAl0zrvNI9Xrs/Nf
+eE6PS4hIXg90A9VJRhay18w9hA+STb+xmK+3oSwP1ayLqqQ43OnV/pExSHBsjBQk
+4p1nIPlRFL30lGp/o2MoBsRvQM1tELpgBTk1LaTHzuKEpOskrWU37xu0QgEtj7YE
+r0X+GGBxgJuUzqSyLsaDgH1sEDqE+AthFfv2dxDadcXM2cdch9y3OyuSMo89aWGc
+mEVyesjYoV40tDCG73qLtfehhV/iARDMCfnZGyGYIZdDBL+tZTNeLKVDIUi/R3x9
+OmpEl8ZuCuYltyEsJnCF/rQBVMgcTOmsMu6CMx+qT3kC8iGtHqkUT2ufpKISahTn
+e329FQjClEWwBHkr0T4K80Z0REjSo6UBtio73IOCxXe0RqO37L/qgo8xKZbLxy86
+857PRWJhgbw169FJ2kR5p+M5d/g/MUeYnigvWlORW5LyrFg6RnZ1ZbULZI80QhHN
+aSFf/w020HBsLCkzWA/XM6MO2ifJTSn8Ng==
+=C1ed
+-----END PGP PUBLIC KEY BLOCK-----
diff --git a/sources b/sources
index 27ae4ae..aade61e 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.18.9.tar.xz) = 7d9bca47e29e8634416ab52819d78ce4ec6196c0dcbd9fe95a24687337f71c69b6472cf20bf49ea0ae1751a861944f354f9122acfb01780f51278ad4a3fdd817
-SHA512 (bind-9.18.9.tar.xz.asc) = ad45ef665a78c7da24fcfcfdc382d5226786fd037d1752d76b74e2b26c8148ce2be66132fdbd2993ee46cce2590cf55340ce0b2624d654ac7c2bd1757b388401
+SHA512 (bind-9.18.10.tar.xz) = 517b070e28cc3c3ab6bc47d353d00ea5d365c0f46859d80c4712df97da759de5176126efe7d53887a2f141d06e61adfe4c0036df8e79db1ca93b0818a1d65b5e
+SHA512 (bind-9.18.10.tar.xz.asc) = 6d872807d0b0c87e0cec10a8f4d9cf6b6dacbf7a6c65250862e2ec3cf01a1366c7141aec36b82fe3f2320a60e9b551ebfe3d62e4ea3b60ad6e34179a1d019bbc

From ced3b36a51dedda5307de6584da9e75698642ffc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 16 Jan 2023 21:56:43 +0100
Subject: [PATCH 326/460] Ensure isc_rwlocktype_t is defined always

Prevent issues in compilation after dns/zt.h change.
---
 bind-9.18-zt-include-rwlock.patch | 27 +++++++++++++++++++++++++++
 bind.spec                         |  3 +++
 2 files changed, 30 insertions(+)
 create mode 100644 bind-9.18-zt-include-rwlock.patch

diff --git a/bind-9.18-zt-include-rwlock.patch b/bind-9.18-zt-include-rwlock.patch
new file mode 100644
index 0000000..ebe6a4f
--- /dev/null
+++ b/bind-9.18-zt-include-rwlock.patch
@@ -0,0 +1,27 @@
+From 395d6fca2638129e1cc1f55ee4b3aa0dbba44dc0 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
+Date: Mon, 16 Jan 2023 11:45:31 +0100
+Subject: [PATCH] Include isc_rwlocktype_t type definition in zt.h
+
+After changes zt.h uses rwlock type, which is not enforced to be always
+defined. Ensure full type definition is ready by including appropriate
+header.
+---
+ lib/dns/include/dns/zt.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/lib/dns/include/dns/zt.h b/lib/dns/include/dns/zt.h
+index 077b26ddea..037d0a9495 100644
+--- a/lib/dns/include/dns/zt.h
++++ b/lib/dns/include/dns/zt.h
+@@ -18,6 +18,7 @@
+ #include <stdbool.h>
+ 
+ #include <isc/lang.h>
++#include <isc/rwlock.h>
+ 
+ #include <dns/types.h>
+ 
+-- 
+2.39.0
+
diff --git a/bind.spec b/bind.spec
index 3c58340..2a2dbba 100644
--- a/bind.spec
+++ b/bind.spec
@@ -101,6 +101,8 @@ Patch16: bind-9.16-redhat_doc.patch
 Patch22: bind-9.11-fips-tests.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=2122010
 Patch26: bind-9.18-unittest-netmgr-unstable.patch
+# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/7376/
+Patch27: bind-9.18-zt-include-rwlock.patch
 
 %{?systemd_ordering}
 Requires:       coreutils
@@ -951,6 +953,7 @@ fi;
 %changelog
 * Mon Jan 16 2023 Petr Menšík <pemensik@redhat.com> - 32:9.18.10-1
 - Update to 9.18.10 (#2143258)
+- Include rwlock.h from dns/zt.h
 
 * Mon Nov 21 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.9-1
 - Update to 9.18.9 (#2143258)

From e1fa37e19cce11799190472fd1881b92e55b245f Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Wed, 18 Jan 2023 22:52:41 +0000
Subject: [PATCH 327/460] Rebuilt for
 https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
---
 bind.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index 2a2dbba..3199455 100644
--- a/bind.spec
+++ b/bind.spec
@@ -63,7 +63,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPL-2.0
 Version:  9.18.10
-Release:  1%{?dist}
+Release:  2%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -951,6 +951,9 @@ fi;
 %endif
 
 %changelog
+* Wed Jan 18 2023 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.18.10-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
+
 * Mon Jan 16 2023 Petr Menšík <pemensik@redhat.com> - 32:9.18.10-1
 - Update to 9.18.10 (#2143258)
 - Include rwlock.h from dns/zt.h

From 6db54085387c2ad21fef4456409a8e65605d2958 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 27 Jan 2023 17:25:00 +0100
Subject: [PATCH 328/460] Update to 9.18.11 (#2164395)

Resolves: CVE-2022-3094 CVE-2022-3736 CVE-2022-3924

https://downloads.isc.org/isc/bind9/9.18.11/doc/arm/html/notes.html#notes-for-bind-9-18-11
---
 .gitignore                 |  2 ++
 bind-9.11-fips-tests.patch | 22 +++++++++++-----------
 bind.spec                  |  7 +++++--
 sources                    |  4 ++--
 4 files changed, 20 insertions(+), 15 deletions(-)

diff --git a/.gitignore b/.gitignore
index 87a8eb0..8c663e5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -198,3 +198,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.18.9.tar.xz.asc
 /bind-9.18.10.tar.xz
 /bind-9.18.10.tar.xz.asc
+/bind-9.18.11.tar.xz
+/bind-9.18.11.tar.xz.asc
diff --git a/bind-9.11-fips-tests.patch b/bind-9.11-fips-tests.patch
index 7efac6d..5af7c53 100644
--- a/bind-9.11-fips-tests.patch
+++ b/bind-9.11-fips-tests.patch
@@ -1,4 +1,4 @@
-From 3446425cf03f2b5a7cbf6af47bd167f72e4135aa Mon Sep 17 00:00:00 2001
+From 196642ce544dbffcaa4f8651f2abbb3ff16af278 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 2 Aug 2018 23:46:45 +0200
 Subject: [PATCH] FIPS tests changes
@@ -534,10 +534,10 @@ index 4af25b0..9f202d5 100644
  };
  
 diff --git a/bin/tests/system/checkconf/good.conf b/bin/tests/system/checkconf/good.conf
-index 93939ff..3f78622 100644
+index f8d0408..bef7174 100644
 --- a/bin/tests/system/checkconf/good.conf
 +++ b/bin/tests/system/checkconf/good.conf
-@@ -280,6 +280,6 @@ dyndb "name" "library.so" {
+@@ -281,6 +281,6 @@ dyndb "name" "library.so" {
  	system;
  };
  key "mykey" {
@@ -546,7 +546,7 @@ index 93939ff..3f78622 100644
  	secret "qwertyuiopasdfgh";
  };
 diff --git a/bin/tests/system/cookie/ns1/named.conf.in b/bin/tests/system/cookie/ns1/named.conf.in
-index 1304303..e9c28c6 100644
+index 025f8d0..20ebca3 100644
 --- a/bin/tests/system/cookie/ns1/named.conf.in
 +++ b/bin/tests/system/cookie/ns1/named.conf.in
 @@ -18,7 +18,7 @@ key rndc_key {
@@ -652,10 +652,10 @@ index 706b7fc..2565ab4 100644
  	grep "test string" "$fnb" > /dev/null &&
  	grep "test string" "$fnc" > /dev/null &&
 diff --git a/bin/tests/system/nsupdate/ns1/named.conf.in b/bin/tests/system/nsupdate/ns1/named.conf.in
-index 2b67360..a734584 100644
+index b502ea7..461f256 100644
 --- a/bin/tests/system/nsupdate/ns1/named.conf.in
 +++ b/bin/tests/system/nsupdate/ns1/named.conf.in
-@@ -39,7 +39,7 @@ controls {
+@@ -40,7 +40,7 @@ controls {
  };
  
  key altkey {
@@ -665,7 +665,7 @@ index 2b67360..a734584 100644
  };
  
 diff --git a/bin/tests/system/nsupdate/ns2/named.conf.in b/bin/tests/system/nsupdate/ns2/named.conf.in
-index c85eef5..428b6b1 100644
+index 43137fe..be0b6b4 100644
 --- a/bin/tests/system/nsupdate/ns2/named.conf.in
 +++ b/bin/tests/system/nsupdate/ns2/named.conf.in
 @@ -34,7 +34,7 @@ controls {
@@ -708,7 +708,7 @@ index 50056dc..a4a1a3f 100644
  $TSIGKEYGEN -a hmac-sha224 sha224-key > ns1/sha224.key
  $TSIGKEYGEN -a hmac-sha256 sha256-key > ns1/sha256.key
 diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh
-index d612a22..9f18e57 100755
+index 9b80dd4..6671104 100755
 --- a/bin/tests/system/nsupdate/tests.sh
 +++ b/bin/tests/system/nsupdate/tests.sh
 @@ -841,7 +841,12 @@ fi
@@ -969,7 +969,7 @@ index c2b57dd..ea744f8 100644
  };
  
 diff --git a/bin/tests/system/upforwd/tests.sh b/bin/tests/system/upforwd/tests.sh
-index a6de312..ebcadb1 100644
+index 1d11bdf..456f9c5 100644
 --- a/bin/tests/system/upforwd/tests.sh
 +++ b/bin/tests/system/upforwd/tests.sh
 @@ -80,7 +80,7 @@ if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
@@ -977,10 +977,10 @@ index a6de312..ebcadb1 100644
  echo_i "updating zone (signed) ($n)"
  ret=0
 -$NSUPDATE -y update.example:c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K -- - <<EOF || ret=1
-+$NSUPDATE -y hmac-sha256:update.example:c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K -- - <<EOF || ret=1
++$NSUPDATE -y ${DEFAULT_HMAC}:update.example:c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K -- - <<EOF || ret=1
+ local 10.53.0.1
  server 10.53.0.3 ${PORT}
  update add updated.example. 600 A 10.10.10.1
- update add updated.example. 600 TXT Foo
 -- 
 2.39.0
 
diff --git a/bind.spec b/bind.spec
index 3199455..735ec1b 100644
--- a/bind.spec
+++ b/bind.spec
@@ -62,8 +62,8 @@ Conflicts: %1 \
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPL-2.0
-Version:  9.18.10
-Release:  2%{?dist}
+Version:  9.18.11
+Release:  1%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -951,6 +951,9 @@ fi;
 %endif
 
 %changelog
+* Fri Jan 27 2023 Petr Menšík <pemensik@redhat.com> - 32:9.18.11-1
+- Update to 9.18.11 (#2164395)
+
 * Wed Jan 18 2023 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.18.10-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
 
diff --git a/sources b/sources
index aade61e..b0b7e54 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.18.10.tar.xz) = 517b070e28cc3c3ab6bc47d353d00ea5d365c0f46859d80c4712df97da759de5176126efe7d53887a2f141d06e61adfe4c0036df8e79db1ca93b0818a1d65b5e
-SHA512 (bind-9.18.10.tar.xz.asc) = 6d872807d0b0c87e0cec10a8f4d9cf6b6dacbf7a6c65250862e2ec3cf01a1366c7141aec36b82fe3f2320a60e9b551ebfe3d62e4ea3b60ad6e34179a1d019bbc
+SHA512 (bind-9.18.11.tar.xz) = 1f71560efca3b6886d71861c76d4a11d59c28f0ffed684f040a59dd9c14be594985a3f15e6d610a4d88a40a16a19e259977d4a254e146469323d15587b23f3ad
+SHA512 (bind-9.18.11.tar.xz.asc) = fb093a98c8a3f8eb12b03aee65bd88df9e17bed45810d963f7e74c00d470807b5dea73f9601c51a66b2f52e2b6fb16549c0733f3fe54d6c5a74c5c7dde63075f

From 9303298043d30e21a6306b44ed1f754205550ceb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 30 Jan 2023 17:31:14 +0100
Subject: [PATCH 329/460] Parametrize tests for this component

---
 plans/all.fmf          | 3 +++
 plans/tier1-public.fmf | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/plans/all.fmf b/plans/all.fmf
index 1afeb5d..10bce2d 100644
--- a/plans/all.fmf
+++ b/plans/all.fmf
@@ -1,4 +1,7 @@
 summary: Test plan with all beakerlib tests
+component: bind
+environment+:
+    PACKAGE: bind
 discover:
     how: fmf
     url: https://src.fedoraproject.org/tests/bind.git
diff --git a/plans/tier1-public.fmf b/plans/tier1-public.fmf
index 35808fd..3a37d22 100644
--- a/plans/tier1-public.fmf
+++ b/plans/tier1-public.fmf
@@ -1,4 +1,7 @@
 summary: Public (Fedora) Tier1 beakerlib tests
+component: bind
+environment+:
+    PACKAGE: bind
 discover:
     how: fmf
     url: https://src.fedoraproject.org/tests/bind.git

From 10cb7fcdc54db43fca7f35029f62f979a5d57251 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 16 Feb 2023 02:43:32 +0100
Subject: [PATCH 330/460] Update to 9.18.12 (#2170096)

https://downloads.isc.org/isc/bind9/9.18.12/doc/arm/html/notes.html#notes-for-bind-9-18-12
---
 .gitignore                        |  2 ++
 bind-9.18-zt-include-rwlock.patch | 27 ---------------------------
 bind.spec                         |  7 ++++---
 sources                           |  4 ++--
 4 files changed, 8 insertions(+), 32 deletions(-)
 delete mode 100644 bind-9.18-zt-include-rwlock.patch

diff --git a/.gitignore b/.gitignore
index 8c663e5..07df030 100644
--- a/.gitignore
+++ b/.gitignore
@@ -200,3 +200,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.18.10.tar.xz.asc
 /bind-9.18.11.tar.xz
 /bind-9.18.11.tar.xz.asc
+/bind-9.18.12.tar.xz
+/bind-9.18.12.tar.xz.asc
diff --git a/bind-9.18-zt-include-rwlock.patch b/bind-9.18-zt-include-rwlock.patch
deleted file mode 100644
index ebe6a4f..0000000
--- a/bind-9.18-zt-include-rwlock.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From 395d6fca2638129e1cc1f55ee4b3aa0dbba44dc0 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Mon, 16 Jan 2023 11:45:31 +0100
-Subject: [PATCH] Include isc_rwlocktype_t type definition in zt.h
-
-After changes zt.h uses rwlock type, which is not enforced to be always
-defined. Ensure full type definition is ready by including appropriate
-header.
----
- lib/dns/include/dns/zt.h | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/lib/dns/include/dns/zt.h b/lib/dns/include/dns/zt.h
-index 077b26ddea..037d0a9495 100644
---- a/lib/dns/include/dns/zt.h
-+++ b/lib/dns/include/dns/zt.h
-@@ -18,6 +18,7 @@
- #include <stdbool.h>
- 
- #include <isc/lang.h>
-+#include <isc/rwlock.h>
- 
- #include <dns/types.h>
- 
--- 
-2.39.0
-
diff --git a/bind.spec b/bind.spec
index 735ec1b..4c15dbf 100644
--- a/bind.spec
+++ b/bind.spec
@@ -62,7 +62,7 @@ Conflicts: %1 \
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPL-2.0
-Version:  9.18.11
+Version:  9.18.12
 Release:  1%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
@@ -101,8 +101,6 @@ Patch16: bind-9.16-redhat_doc.patch
 Patch22: bind-9.11-fips-tests.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=2122010
 Patch26: bind-9.18-unittest-netmgr-unstable.patch
-# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/7376/
-Patch27: bind-9.18-zt-include-rwlock.patch
 
 %{?systemd_ordering}
 Requires:       coreutils
@@ -951,6 +949,9 @@ fi;
 %endif
 
 %changelog
+* Thu Feb 16 2023 Petr Menšík <pemensik@redhat.com> - 32:9.18.12-1
+- Update to 9.18.12 (#2170096)
+
 * Fri Jan 27 2023 Petr Menšík <pemensik@redhat.com> - 32:9.18.11-1
 - Update to 9.18.11 (#2164395)
 
diff --git a/sources b/sources
index b0b7e54..7cdcf76 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.18.11.tar.xz) = 1f71560efca3b6886d71861c76d4a11d59c28f0ffed684f040a59dd9c14be594985a3f15e6d610a4d88a40a16a19e259977d4a254e146469323d15587b23f3ad
-SHA512 (bind-9.18.11.tar.xz.asc) = fb093a98c8a3f8eb12b03aee65bd88df9e17bed45810d963f7e74c00d470807b5dea73f9601c51a66b2f52e2b6fb16549c0733f3fe54d6c5a74c5c7dde63075f
+SHA512 (bind-9.18.12.tar.xz) = 9741ea1260eb0922f5e42fb7916ede3f922291edf6a6b97ca574b53c0179eecb05197d49ca8204e8aae48e0ac393a03e01129c5d9b5d0d32e836009b1b914fac
+SHA512 (bind-9.18.12.tar.xz.asc) = 551844ee503f182d6e149897f8cd8b267f8cebc2b7eb9c88448f382800f6a3bf01efb8ff4be1ff1c61b1b98d33b79c52fa02be55c0b88f47f488e87592d5f2c6

From e853970bcf833b9d1587cac3bc45309421bfc445 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 7 Mar 2023 15:26:38 +0100
Subject: [PATCH 331/460] Remove component from test plans again

---
 plans/all.fmf          | 1 -
 plans/tier1-public.fmf | 1 -
 2 files changed, 2 deletions(-)

diff --git a/plans/all.fmf b/plans/all.fmf
index 10bce2d..df1b3e6 100644
--- a/plans/all.fmf
+++ b/plans/all.fmf
@@ -1,5 +1,4 @@
 summary: Test plan with all beakerlib tests
-component: bind
 environment+:
     PACKAGE: bind
 discover:
diff --git a/plans/tier1-public.fmf b/plans/tier1-public.fmf
index 3a37d22..31400b7 100644
--- a/plans/tier1-public.fmf
+++ b/plans/tier1-public.fmf
@@ -1,5 +1,4 @@
 summary: Public (Fedora) Tier1 beakerlib tests
-component: bind
 environment+:
     PACKAGE: bind
 discover:

From 13b1bcc0f09f11db0865815817fd865e6affc60d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Sat, 18 Mar 2023 12:09:06 +0100
Subject: [PATCH 332/460] Update to 9.18.3 (#2178717)

https://downloads.isc.org/isc/bind9/9.18.13/doc/arm/html/notes.html#notes-for-bind-9-18-13
---
 .gitignore                 |   2 +
 bind-9.11-fips-tests.patch | 986 -------------------------------------
 bind.spec                  |   6 +-
 sources                    |   4 +-
 4 files changed, 8 insertions(+), 990 deletions(-)
 delete mode 100644 bind-9.11-fips-tests.patch

diff --git a/.gitignore b/.gitignore
index 07df030..af968a5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -202,3 +202,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.18.11.tar.xz.asc
 /bind-9.18.12.tar.xz
 /bind-9.18.12.tar.xz.asc
+/bind-9.18.13.tar.xz
+/bind-9.18.13.tar.xz.asc
diff --git a/bind-9.11-fips-tests.patch b/bind-9.11-fips-tests.patch
deleted file mode 100644
index 5af7c53..0000000
--- a/bind-9.11-fips-tests.patch
+++ /dev/null
@@ -1,986 +0,0 @@
-From 196642ce544dbffcaa4f8651f2abbb3ff16af278 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Thu, 2 Aug 2018 23:46:45 +0200
-Subject: [PATCH] FIPS tests changes
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Squashed commit of the following:
-
-commit 09e5eb48698d4fef2fc1031870de86c553b6bfaa
-Author: Petr Menšík <pemensik@redhat.com>
-Date:   Wed Mar 7 20:35:13 2018 +0100
-
-    Fix nsupdate test. Do not use md5 by default for rndc, skip gracefully md5 if not available.
-
-commit ab303db70082db76ecf36493d0b82ef3e8750cad
-Author: Petr Menšík <pemensik@redhat.com>
-Date:   Wed Mar 7 18:11:10 2018 +0100
-
-    Changed root key to be RSASHA256
-
-    Change bad trusted key to be the same algorithm.
-
-commit 88ab07c0e14cc71247e1f9d11a1ea832b64c1ee8
-Author: Petr Menšík <pemensik@redhat.com>
-Date:   Wed Mar 7 16:56:17 2018 +0100
-
-    Change used key to not use hmac-md5
-
-    Fix upforwd test, do not use hmac-md5
-
-commit aec891571626f053acfb4d0a247240cbc21a84e9
-Author: Petr Menšík <pemensik@redhat.com>
-Date:   Wed Mar 7 15:54:11 2018 +0100
-
-    Increase bitsize of DSA key to pass FIPS 140-2 mode.
-
-commit bca8e164fa0d9aff2f946b8b4eb0f1f7e0bf6696
-Author: Petr Menšík <pemensik@redhat.com>
-Date:   Wed Mar 7 15:41:08 2018 +0100
-
-    Fix tsig and rndc tests for disabled md5
-
-    Use hmac-sha256 instead of hmac-md5.
-
-commit 0d314c1ab6151aa13574a21ad22f28d3b7f42a67
-Author: Petr Menšík <pemensik@redhat.com>
-Date:   Wed Mar 7 13:21:00 2018 +0100
-
-    Add md5 availability detection to featuretest
-
-commit f389a918803e2853e4b55fed62765dc4a492e34f
-Author: Petr Menšík <pemensik@redhat.com>
-Date:   Wed Mar 7 10:44:23 2018 +0100
-
-    Change tests to not use hmac-md5 algorithms if not required
-
-    Use hmac-sha256 instead of default hmac-md5 for allow-query
-
-Use DEFAULT_HMAC configured variable
----
- bin/tests/system/acl/ns2/named1.conf.in       |  4 +-
- bin/tests/system/acl/ns2/named2.conf.in       |  4 +-
- bin/tests/system/acl/ns2/named3.conf.in       |  6 +-
- bin/tests/system/acl/ns2/named4.conf.in       |  4 +-
- bin/tests/system/acl/ns2/named5.conf.in       |  4 +-
- bin/tests/system/acl/tests.sh                 | 32 ++++-----
- .../system/allow-query/ns2/named10.conf.in    |  2 +-
- .../system/allow-query/ns2/named11.conf.in    |  4 +-
- .../system/allow-query/ns2/named12.conf.in    |  2 +-
- .../system/allow-query/ns2/named30.conf.in    |  2 +-
- .../system/allow-query/ns2/named31.conf.in    |  4 +-
- .../system/allow-query/ns2/named32.conf.in    |  2 +-
- .../system/allow-query/ns2/named40.conf.in    |  4 +-
- bin/tests/system/allow-query/tests.sh         | 18 ++---
- bin/tests/system/checkconf/bad-tsig.conf      |  2 +-
- bin/tests/system/checkconf/good.conf          |  2 +-
- bin/tests/system/cookie/ns1/named.conf.in     |  2 +-
- bin/tests/system/dnssec/ns4/named5.conf.in    |  2 +-
- bin/tests/system/feature-test.c               | 14 ++++
- bin/tests/system/notify/ns5/named.conf.in     |  6 +-
- bin/tests/system/notify/tests.sh              |  6 +-
- bin/tests/system/nsupdate/ns1/named.conf.in   |  2 +-
- bin/tests/system/nsupdate/ns2/named.conf.in   |  2 +-
- bin/tests/system/nsupdate/ns9/named.conf.in   |  2 +-
- bin/tests/system/nsupdate/setup.sh            |  6 +-
- bin/tests/system/nsupdate/tests.sh            |  9 ++-
- bin/tests/system/rndc/ns2/named.conf.in       |  2 +-
- bin/tests/system/rndc/ns3/named.conf.in       |  2 +-
- bin/tests/system/rndc/setup.sh                |  2 +-
- bin/tests/system/rndc/tests.sh                | 22 +++---
- bin/tests/system/tsig/ns1/named.conf.in       | 10 +--
- bin/tests/system/tsig/ns1/rndc5.conf.in       | 10 +++
- bin/tests/system/tsig/setup.sh                |  5 ++
- bin/tests/system/tsig/tests.sh                | 67 ++++++++++++-------
- bin/tests/system/upforwd/ns1/named.conf.in    |  2 +-
- bin/tests/system/upforwd/tests.sh             |  2 +-
- 36 files changed, 161 insertions(+), 110 deletions(-)
- create mode 100644 bin/tests/system/tsig/ns1/rndc5.conf.in
-
-diff --git a/bin/tests/system/acl/ns2/named1.conf.in b/bin/tests/system/acl/ns2/named1.conf.in
-index 8787c6a..682ba97 100644
---- a/bin/tests/system/acl/ns2/named1.conf.in
-+++ b/bin/tests/system/acl/ns2/named1.conf.in
-@@ -35,12 +35,12 @@ options {
- };
- 
- key one {
--	algorithm hmac-md5;
-+	algorithm @DEFAULT_HMAC@;
- 	secret "1234abcd8765";
- };
- 
- key two {
--	algorithm hmac-md5;
-+	algorithm @DEFAULT_HMAC@;
- 	secret "1234abcd8765";
- };
- 
-diff --git a/bin/tests/system/acl/ns2/named2.conf.in b/bin/tests/system/acl/ns2/named2.conf.in
-index a95b4c1..7b1cea6 100644
---- a/bin/tests/system/acl/ns2/named2.conf.in
-+++ b/bin/tests/system/acl/ns2/named2.conf.in
-@@ -35,12 +35,12 @@ options {
- };
- 
- key one {
--	algorithm hmac-md5;
-+	algorithm @DEFAULT_HMAC@;
- 	secret "1234abcd8765";
- };
- 
- key two {
--	algorithm hmac-md5;
-+	algorithm @DEFAULT_HMAC@;
- 	secret "1234abcd8765";
- };
- 
-diff --git a/bin/tests/system/acl/ns2/named3.conf.in b/bin/tests/system/acl/ns2/named3.conf.in
-index 14cc3fe..6b35ba5 100644
---- a/bin/tests/system/acl/ns2/named3.conf.in
-+++ b/bin/tests/system/acl/ns2/named3.conf.in
-@@ -35,17 +35,17 @@ options {
- };
- 
- key one {
--	algorithm hmac-md5;
-+	algorithm @DEFAULT_HMAC@;
- 	secret "1234abcd8765";
- };
- 
- key two {
--	algorithm hmac-md5;
-+	algorithm @DEFAULT_HMAC@;
- 	secret "1234abcd8765";
- };
- 
- key three {
--	algorithm hmac-md5;
-+	algorithm @DEFAULT_HMAC@;
- 	secret "1234abcd8765";
- };
- 
-diff --git a/bin/tests/system/acl/ns2/named4.conf.in b/bin/tests/system/acl/ns2/named4.conf.in
-index 77cf110..b23a1ca 100644
---- a/bin/tests/system/acl/ns2/named4.conf.in
-+++ b/bin/tests/system/acl/ns2/named4.conf.in
-@@ -35,12 +35,12 @@ options {
- };
- 
- key one {
--	algorithm hmac-md5;
-+	algorithm @DEFAULT_HMAC@;
- 	secret "1234abcd8765";
- };
- 
- key two {
--	algorithm hmac-md5;
-+	algorithm @DEFAULT_HMAC@;
- 	secret "1234abcd8765";
- };
- 
-diff --git a/bin/tests/system/acl/ns2/named5.conf.in b/bin/tests/system/acl/ns2/named5.conf.in
-index 5ccabf9..52791aa 100644
---- a/bin/tests/system/acl/ns2/named5.conf.in
-+++ b/bin/tests/system/acl/ns2/named5.conf.in
-@@ -37,12 +37,12 @@ options {
- };
- 
- key one {
--	algorithm hmac-md5;
-+	algorithm @DEFAULT_HMAC@;
- 	secret "1234abcd8765";
- };
- 
- key two {
--	algorithm hmac-md5;
-+	algorithm @DEFAULT_HMAC@;
- 	secret "1234abcd8765";
- };
- 
-diff --git a/bin/tests/system/acl/tests.sh b/bin/tests/system/acl/tests.sh
-index ad98fa1..7a7ff4a 100644
---- a/bin/tests/system/acl/tests.sh
-+++ b/bin/tests/system/acl/tests.sh
-@@ -23,14 +23,14 @@ echo_i "testing basic ACL processing"
- # key "one" should fail
- t=`expr $t + 1`
- $DIG $DIGOPTS tsigzone. \
--	@10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 > dig.out.${t}
-+	@10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}
- grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
- 
- 
- # any other key should be fine
- t=`expr $t + 1`
- $DIG $DIGOPTS tsigzone. \
--	@10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t}
-+	@10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}
- grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
- 
- copy_setports ns2/named2.conf.in ns2/named.conf
-@@ -40,18 +40,18 @@ sleep 5
- # prefix 10/8 should fail
- t=`expr $t + 1`
- $DIG $DIGOPTS tsigzone. \
--	@10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 > dig.out.${t}
-+	@10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}
- grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
- 
- # any other address should work, as long as it sends key "one"
- t=`expr $t + 1`
- $DIG $DIGOPTS tsigzone. \
--	@10.53.0.2 -b 127.0.0.1 axfr -y two:1234abcd8765 > dig.out.${t}
-+	@10.53.0.2 -b 127.0.0.1 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}
- grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
- 
- t=`expr $t + 1`
- $DIG $DIGOPTS tsigzone. \
--	@10.53.0.2 -b 127.0.0.1 axfr -y one:1234abcd8765 > dig.out.${t}
-+	@10.53.0.2 -b 127.0.0.1 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}
- grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
- 
- echo_i "testing nested ACL processing"
-@@ -63,31 +63,31 @@ sleep 5
- # should succeed
- t=`expr $t + 1`
- $DIG $DIGOPTS tsigzone. \
--	@10.53.0.2 -b 10.53.0.2 axfr -y two:1234abcd8765 > dig.out.${t}
-+	@10.53.0.2 -b 10.53.0.2 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}
- grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
- 
- # should succeed
- t=`expr $t + 1`
- $DIG $DIGOPTS tsigzone. \
--	@10.53.0.2 -b 10.53.0.2 axfr -y one:1234abcd8765 > dig.out.${t}
-+	@10.53.0.2 -b 10.53.0.2 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}
- grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
- 
- # should succeed
- t=`expr $t + 1`
- $DIG $DIGOPTS tsigzone. \
--	@10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t}
-+	@10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}
- grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
- 
- # should succeed
- t=`expr $t + 1`
- $DIG $DIGOPTS tsigzone. \
--	@10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t}
-+	@10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}
- grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
- 
- # but only one or the other should fail
- t=`expr $t + 1`
- $DIG $DIGOPTS tsigzone. \
--	@10.53.0.2 -b 127.0.0.1 axfr -y one:1234abcd8765 > dig.out.${t}
-+	@10.53.0.2 -b 127.0.0.1 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}
- grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
- 
- t=`expr $t + 1`
-@@ -98,7 +98,7 @@ grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $tt failed" ; status=1
- # and other values? right out
- t=`expr $t + 1`
- $DIG $DIGOPTS tsigzone. \
--	@10.53.0.2 -b 127.0.0.1 axfr -y three:1234abcd8765 > dig.out.${t}
-+	@10.53.0.2 -b 127.0.0.1 axfr -y hmac-sha256:three:1234abcd8765 > dig.out.${t}
- grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
- 
- # now we only allow 10.53.0.1 *and* key one, or 10.53.0.2 *and* key two
-@@ -109,31 +109,31 @@ sleep 5
- # should succeed
- t=`expr $t + 1`
- $DIG $DIGOPTS tsigzone. \
--	@10.53.0.2 -b 10.53.0.2 axfr -y two:1234abcd8765 > dig.out.${t}
-+	@10.53.0.2 -b 10.53.0.2 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}
- grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
- 
- # should succeed
- t=`expr $t + 1`
- $DIG $DIGOPTS tsigzone. \
--	@10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 > dig.out.${t}
-+	@10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}
- grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
- 
- # should fail
- t=`expr $t + 1`
- $DIG $DIGOPTS tsigzone. \
--	@10.53.0.2 -b 10.53.0.2 axfr -y one:1234abcd8765 > dig.out.${t}
-+	@10.53.0.2 -b 10.53.0.2 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}
- grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
- 
- # should fail
- t=`expr $t + 1`
- $DIG $DIGOPTS tsigzone. \
--	@10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t}
-+	@10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}
- grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
- 
- # should fail
- t=`expr $t + 1`
- $DIG $DIGOPTS tsigzone. \
--	@10.53.0.2 -b 10.53.0.3 axfr -y one:1234abcd8765 > dig.out.${t}
-+	@10.53.0.2 -b 10.53.0.3 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}
- grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
- 
- echo_i "testing allow-query-on ACL processing"
-diff --git a/bin/tests/system/allow-query/ns2/named10.conf.in b/bin/tests/system/allow-query/ns2/named10.conf.in
-index b91d19a..ae485e8 100644
---- a/bin/tests/system/allow-query/ns2/named10.conf.in
-+++ b/bin/tests/system/allow-query/ns2/named10.conf.in
-@@ -12,7 +12,7 @@
-  */
- 
- key one {
--	algorithm hmac-md5;
-+	algorithm @DEFAULT_HMAC@;
- 	secret "1234abcd8765";
- };
- 
-diff --git a/bin/tests/system/allow-query/ns2/named11.conf.in b/bin/tests/system/allow-query/ns2/named11.conf.in
-index 308c4ca..8a5e806 100644
---- a/bin/tests/system/allow-query/ns2/named11.conf.in
-+++ b/bin/tests/system/allow-query/ns2/named11.conf.in
-@@ -12,12 +12,12 @@
-  */
- 
- key one {
--	algorithm hmac-md5;
-+	algorithm @DEFAULT_HMAC@;
- 	secret "1234abcd8765";
- };
- 
- key two {
--	algorithm hmac-md5;
-+	algorithm @DEFAULT_HMAC@;
- 	secret "1234efgh8765";
- };
- 
-diff --git a/bin/tests/system/allow-query/ns2/named12.conf.in b/bin/tests/system/allow-query/ns2/named12.conf.in
-index 6b0fe55..a10c6d0 100644
---- a/bin/tests/system/allow-query/ns2/named12.conf.in
-+++ b/bin/tests/system/allow-query/ns2/named12.conf.in
-@@ -12,7 +12,7 @@
-  */
- 
- key one {
--	algorithm hmac-md5;
-+	algorithm @DEFAULT_HMAC@;
- 	secret "1234abcd8765";
- };
- 
-diff --git a/bin/tests/system/allow-query/ns2/named30.conf.in b/bin/tests/system/allow-query/ns2/named30.conf.in
-index aefc474..52981a7 100644
---- a/bin/tests/system/allow-query/ns2/named30.conf.in
-+++ b/bin/tests/system/allow-query/ns2/named30.conf.in
-@@ -12,7 +12,7 @@
-  */
- 
- key one {
--	algorithm hmac-md5;
-+	algorithm @DEFAULT_HMAC@;
- 	secret "1234abcd8765";
- };
- 
-diff --git a/bin/tests/system/allow-query/ns2/named31.conf.in b/bin/tests/system/allow-query/ns2/named31.conf.in
-index 27eccc2..f627870 100644
---- a/bin/tests/system/allow-query/ns2/named31.conf.in
-+++ b/bin/tests/system/allow-query/ns2/named31.conf.in
-@@ -12,12 +12,12 @@
-  */
- 
- key one {
--	algorithm hmac-md5;
-+	algorithm @DEFAULT_HMAC@;
- 	secret "1234abcd8765";
- };
- 
- key two {
--	algorithm hmac-md5;
-+	algorithm @DEFAULT_HMAC@;
- 	secret "1234efgh8765";
- };
- 
-diff --git a/bin/tests/system/allow-query/ns2/named32.conf.in b/bin/tests/system/allow-query/ns2/named32.conf.in
-index adbb203..6fd516b 100644
---- a/bin/tests/system/allow-query/ns2/named32.conf.in
-+++ b/bin/tests/system/allow-query/ns2/named32.conf.in
-@@ -12,7 +12,7 @@
-  */
- 
- key one {
--	algorithm hmac-md5;
-+	algorithm @DEFAULT_HMAC@;
- 	secret "1234abcd8765";
- };
- 
-diff --git a/bin/tests/system/allow-query/ns2/named40.conf.in b/bin/tests/system/allow-query/ns2/named40.conf.in
-index 364f94b..de37915 100644
---- a/bin/tests/system/allow-query/ns2/named40.conf.in
-+++ b/bin/tests/system/allow-query/ns2/named40.conf.in
-@@ -16,12 +16,12 @@ acl accept { 10.53.0.2; };
- acl badaccept { 10.53.0.1; };
- 
- key one {
--	algorithm hmac-md5;
-+	algorithm @DEFAULT_HMAC@;
- 	secret "1234abcd8765";
- };
- 
- key two {
--	algorithm hmac-md5;
-+	algorithm @DEFAULT_HMAC@;
- 	secret "1234efgh8765";
- };
- 
-diff --git a/bin/tests/system/allow-query/tests.sh b/bin/tests/system/allow-query/tests.sh
-index 01a13cf..3711c63 100644
---- a/bin/tests/system/allow-query/tests.sh
-+++ b/bin/tests/system/allow-query/tests.sh
-@@ -201,7 +201,7 @@ rndc_reload ns2 10.53.0.2
- 
- echo_i "test $n: key allowed - query allowed"
- ret=0
--$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
-+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
- grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
- grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1
- if [ $ret != 0 ]; then echo_i "failed"; fi
-@@ -214,7 +214,7 @@ rndc_reload ns2 10.53.0.2
- 
- echo_i "test $n: key not allowed - query refused"
- ret=0
--$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1
-+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1
- grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
- grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1
- grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
-@@ -228,7 +228,7 @@ rndc_reload ns2 10.53.0.2
- 
- echo_i "test $n: key disallowed - query refused"
- ret=0
--$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
-+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
- grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
- grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1
- grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
-@@ -367,7 +367,7 @@ rndc_reload ns2 10.53.0.2
- 
- echo_i "test $n: views key allowed - query allowed"
- ret=0
--$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
-+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
- grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
- grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1
- if [ $ret != 0 ]; then echo_i "failed"; fi
-@@ -380,7 +380,7 @@ rndc_reload ns2 10.53.0.2
- 
- echo_i "test $n: views key not allowed - query refused"
- ret=0
--$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1
-+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1
- grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
- grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1
- grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
-@@ -394,7 +394,7 @@ rndc_reload ns2 10.53.0.2
- 
- echo_i "test $n: views key disallowed - query refused"
- ret=0
--$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
-+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
- grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
- grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1
- grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
-@@ -534,7 +534,7 @@ status=`expr $status + $ret`
- n=`expr $n + 1`
- echo_i "test $n: zone key allowed - query allowed"
- ret=0
--$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.keyallow.example a > dig.out.ns2.$n || ret=1
-+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.keyallow.example a > dig.out.ns2.$n || ret=1
- grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
- grep '^a.keyallow.example' dig.out.ns2.$n > /dev/null || ret=1
- if [ $ret != 0 ]; then echo_i "failed"; fi
-@@ -544,7 +544,7 @@ status=`expr $status + $ret`
- n=`expr $n + 1`
- echo_i "test $n: zone key not allowed - query refused"
- ret=0
--$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y two:1234efgh8765 a.keyallow.example a > dig.out.ns2.$n || ret=1
-+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:two:1234efgh8765 a.keyallow.example a > dig.out.ns2.$n || ret=1
- grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
- grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1
- grep '^a.keyallow.example' dig.out.ns2.$n > /dev/null && ret=1
-@@ -555,7 +555,7 @@ status=`expr $status + $ret`
- n=`expr $n + 1`
- echo_i "test $n: zone key disallowed - query refused"
- ret=0
--$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.keydisallow.example a > dig.out.ns2.$n || ret=1
-+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.keydisallow.example a > dig.out.ns2.$n || ret=1
- grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
- grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1
- grep '^a.keydisallow.example' dig.out.ns2.$n > /dev/null && ret=1
-diff --git a/bin/tests/system/checkconf/bad-tsig.conf b/bin/tests/system/checkconf/bad-tsig.conf
-index 4af25b0..9f202d5 100644
---- a/bin/tests/system/checkconf/bad-tsig.conf
-+++ b/bin/tests/system/checkconf/bad-tsig.conf
-@@ -13,7 +13,7 @@
- 
- /* Bad secret */
- key "badtsig" {
--	algorithm hmac-md5;
-+	algorithm hmac-sha256;
- 	secret "jEdD+BPKg==";
- };
- 
-diff --git a/bin/tests/system/checkconf/good.conf b/bin/tests/system/checkconf/good.conf
-index f8d0408..bef7174 100644
---- a/bin/tests/system/checkconf/good.conf
-+++ b/bin/tests/system/checkconf/good.conf
-@@ -281,6 +281,6 @@ dyndb "name" "library.so" {
- 	system;
- };
- key "mykey" {
--	algorithm "hmac-md5";
-+	algorithm "hmac-sha256";
- 	secret "qwertyuiopasdfgh";
- };
-diff --git a/bin/tests/system/cookie/ns1/named.conf.in b/bin/tests/system/cookie/ns1/named.conf.in
-index 025f8d0..20ebca3 100644
---- a/bin/tests/system/cookie/ns1/named.conf.in
-+++ b/bin/tests/system/cookie/ns1/named.conf.in
-@@ -18,7 +18,7 @@ key rndc_key {
- 
- key foo {
- 	secret "aaaaaaaaaaaa";
--	algorithm hmac-sha256;
-+	algorithm @DEFAULT_HMAC@;
- };
- 
- server 10.53.0.10 {
-diff --git a/bin/tests/system/dnssec/ns4/named5.conf.in b/bin/tests/system/dnssec/ns4/named5.conf.in
-index f1b817a..e457062 100644
---- a/bin/tests/system/dnssec/ns4/named5.conf.in
-+++ b/bin/tests/system/dnssec/ns4/named5.conf.in
-@@ -35,5 +35,5 @@ controls {
- 
- key auth {
- 	secret "1234abcd8765";
--	algorithm hmac-sha256;
-+	algorithm @DEFAULT_HMAC@;
- };
-diff --git a/bin/tests/system/feature-test.c b/bin/tests/system/feature-test.c
-index b1adaed..3942df6 100644
---- a/bin/tests/system/feature-test.c
-+++ b/bin/tests/system/feature-test.c
-@@ -17,6 +17,7 @@
- #include <string.h>
- #include <unistd.h>
- 
-+#include <isc/md.h>
- #include <isc/net.h>
- #include <isc/print.h>
- #include <isc/util.h>
-@@ -143,6 +144,19 @@ main(int argc, char **argv) {
- #endif
- 	}
- 
-+	if (strcmp(argv[1], "--md5") == 0) {
-+		unsigned char digest[ISC_MAX_MD_SIZE];
-+		const unsigned char test[] = "test";
-+		unsigned int size = sizeof(digest);
-+
-+		if (isc_md(ISC_MD_MD5, test, sizeof(test),
-+		           digest, &size) == ISC_R_SUCCESS) {
-+			return (0);
-+		} else {
-+			return (1);
-+		}
-+	}
-+
- 	if (strcmp(argv[1], "--ipv6only=no") == 0) {
- #if defined(IPPROTO_IPV6) && defined(IPV6_V6ONLY)
- 		int s;
-diff --git a/bin/tests/system/notify/ns5/named.conf.in b/bin/tests/system/notify/ns5/named.conf.in
-index 5cab276..c0492e1 100644
---- a/bin/tests/system/notify/ns5/named.conf.in
-+++ b/bin/tests/system/notify/ns5/named.conf.in
-@@ -12,17 +12,17 @@
-  */
- 
- key "a" {
--	algorithm "hmac-md5";
-+	algorithm "@DEFAULT_HMAC@";
- 	secret "aaaaaaaaaaaaaaaaaaaa";
- };
- 
- key "b" {
--	algorithm "hmac-md5";
-+	algorithm "@DEFAULT_HMAC@";
- 	secret "bbbbbbbbbbbbbbbbbbbb";
- };
- 
- key "c" {
--	algorithm "hmac-md5";
-+	algorithm "@DEFAULT_HMAC@";
- 	secret "cccccccccccccccccccc";
- };
- 
-diff --git a/bin/tests/system/notify/tests.sh b/bin/tests/system/notify/tests.sh
-index 706b7fc..2565ab4 100644
---- a/bin/tests/system/notify/tests.sh
-+++ b/bin/tests/system/notify/tests.sh
-@@ -179,7 +179,7 @@ test_start "checking notify to multiple views using tsig"
- $NSUPDATE << EOF
- server 10.53.0.5 ${PORT}
- zone x21
--key a aaaaaaaaaaaaaaaaaaaa
-+key hmac-sha256:a aaaaaaaaaaaaaaaaaaaa
- update add added.x21 0 in txt "test string"
- send
- EOF
-@@ -187,9 +187,9 @@ fnb="dig.out.b.ns5.test$n"
- fnc="dig.out.c.ns5.test$n"
- for i in 1 2 3 4 5 6 7 8 9
- do
--	dig_plus_opts added.x21. -y b:bbbbbbbbbbbbbbbbbbbb @10.53.0.5 \
-+	dig_plus_opts added.x21. -y hmac-sha256:b:bbbbbbbbbbbbbbbbbbbb @10.53.0.5 \
- 		txt > "$fnb" || ret=1
--	dig_plus_opts added.x21. -y c:cccccccccccccccccccc @10.53.0.5 \
-+	dig_plus_opts added.x21. -y hmac-sha256:c:cccccccccccccccccccc @10.53.0.5 \
- 		txt > "$fnc" || ret=1
- 	grep "test string" "$fnb" > /dev/null &&
- 	grep "test string" "$fnc" > /dev/null &&
-diff --git a/bin/tests/system/nsupdate/ns1/named.conf.in b/bin/tests/system/nsupdate/ns1/named.conf.in
-index b502ea7..461f256 100644
---- a/bin/tests/system/nsupdate/ns1/named.conf.in
-+++ b/bin/tests/system/nsupdate/ns1/named.conf.in
-@@ -40,7 +40,7 @@ controls {
- };
- 
- key altkey {
--	algorithm hmac-md5;
-+	algorithm hmac-sha512;
- 	secret "1234abcd8765";
- };
- 
-diff --git a/bin/tests/system/nsupdate/ns2/named.conf.in b/bin/tests/system/nsupdate/ns2/named.conf.in
-index 43137fe..be0b6b4 100644
---- a/bin/tests/system/nsupdate/ns2/named.conf.in
-+++ b/bin/tests/system/nsupdate/ns2/named.conf.in
-@@ -34,7 +34,7 @@ controls {
- };
- 
- key altkey {
--	algorithm hmac-md5;
-+	algorithm hmac-sha512;
- 	secret "1234abcd8765";
- };
- 
-diff --git a/bin/tests/system/nsupdate/ns9/named.conf.in b/bin/tests/system/nsupdate/ns9/named.conf.in
-index 6a7ff88..0b70745 100644
---- a/bin/tests/system/nsupdate/ns9/named.conf.in
-+++ b/bin/tests/system/nsupdate/ns9/named.conf.in
-@@ -32,7 +32,7 @@ key rndc_key {
- 
- key subkey {
- 	secret "1234abcd8765";
--	algorithm hmac-sha256;
-+	algorithm @DEFAULT_HMAC@;
- };
- 
- controls {
-diff --git a/bin/tests/system/nsupdate/setup.sh b/bin/tests/system/nsupdate/setup.sh
-index 50056dc..a4a1a3f 100644
---- a/bin/tests/system/nsupdate/setup.sh
-+++ b/bin/tests/system/nsupdate/setup.sh
-@@ -72,7 +72,11 @@ EOF
- 
- $TSIGKEYGEN ddns-key.example.nil > ns1/ddns.key
- 
--$TSIGKEYGEN -a hmac-md5 md5-key > ns1/md5.key
-+if $FEATURETEST --md5; then
-+	$TSIGKEYGEN -a hmac-md5 md5-key > ns1/md5.key
-+else
-+	echo -n > ns1/md5.key
-+fi
- $TSIGKEYGEN -a hmac-sha1 sha1-key > ns1/sha1.key
- $TSIGKEYGEN -a hmac-sha224 sha224-key > ns1/sha224.key
- $TSIGKEYGEN -a hmac-sha256 sha256-key > ns1/sha256.key
-diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh
-index 9b80dd4..6671104 100755
---- a/bin/tests/system/nsupdate/tests.sh
-+++ b/bin/tests/system/nsupdate/tests.sh
-@@ -841,7 +841,12 @@ fi
- n=$((n + 1))
- ret=0
- echo_i "check TSIG key algorithms (nsupdate -k) ($n)"
--for alg in md5 sha1 sha224 sha256 sha384 sha512; do
-+MD5ALG='md5'
-+if ! $FEATURETEST --md5; then
-+	MD5ALG=''
-+	echo_i "skipping disabled md5 algorithm"
-+fi
-+for alg in $MD5ALG sha1 sha224 sha256 sha384 sha512; do
-     $NSUPDATE -k ns1/${alg}.key <<END > /dev/null || ret=1
- server 10.53.0.1 ${PORT}
- update add ${alg}.keytests.nil. 600 A 10.10.10.3
-@@ -849,7 +854,7 @@ send
- END
- done
- sleep 2
--for alg in md5 sha1 sha224 sha256 sha384 sha512; do
-+for alg in $ALGS; do
-     $DIG $DIGOPTS +short @10.53.0.1 ${alg}.keytests.nil | grep 10.10.10.3 > /dev/null 2>&1 || ret=1
- done
- if [ $ret -ne 0 ]; then
-diff --git a/bin/tests/system/rndc/ns2/named.conf.in b/bin/tests/system/rndc/ns2/named.conf.in
-index 117a5f4..be1af25 100644
---- a/bin/tests/system/rndc/ns2/named.conf.in
-+++ b/bin/tests/system/rndc/ns2/named.conf.in
-@@ -27,7 +27,7 @@ key rndc_key {
- 
- key secondkey {
- 	secret "abcd1234abcd8765";
--	algorithm hmac-sha256;
-+	algorithm @DEFAULT_HMAC@;
- };
- 
- controls {
-diff --git a/bin/tests/system/rndc/ns3/named.conf.in b/bin/tests/system/rndc/ns3/named.conf.in
-index 3078e90..fd97ca2 100644
---- a/bin/tests/system/rndc/ns3/named.conf.in
-+++ b/bin/tests/system/rndc/ns3/named.conf.in
-@@ -25,7 +25,7 @@ key rndc_key {
- 
- key secondkey {
- 	secret "abcd1234abcd8765";
--	algorithm hmac-sha256;
-+	algorithm @DEFAULT_HMAC@;
- };
- 
- controls {
-diff --git a/bin/tests/system/rndc/setup.sh b/bin/tests/system/rndc/setup.sh
-index 5f638ef..85d6b73 100644
---- a/bin/tests/system/rndc/setup.sh
-+++ b/bin/tests/system/rndc/setup.sh
-@@ -47,7 +47,7 @@ make_key () {
-             sed 's/allow { 10.53.0.4/allow { any/' >> ns4/named.conf
- }
- 
--make_key 1 ${EXTRAPORT1} hmac-md5
-+$FEATURETEST --md5 && make_key 1 ${EXTRAPORT1} hmac-md5
- make_key 2 ${EXTRAPORT2} hmac-sha1
- make_key 3 ${EXTRAPORT3} hmac-sha224
- make_key 4 ${EXTRAPORT4} hmac-sha256
-diff --git a/bin/tests/system/rndc/tests.sh b/bin/tests/system/rndc/tests.sh
-index e68428c..acbeb52 100644
---- a/bin/tests/system/rndc/tests.sh
-+++ b/bin/tests/system/rndc/tests.sh
-@@ -350,15 +350,19 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
- status=$((status+ret))
- 
- n=$((n+1))
--echo_i "testing rndc with hmac-md5 ($n)"
--ret=0
--$RNDC -s 10.53.0.4 -p ${EXTRAPORT1} -c ns4/key1.conf status > /dev/null 2>&1 || ret=1
--for i in 2 3 4 5 6
--do
--        $RNDC -s 10.53.0.4 -p ${EXTRAPORT1} -c ns4/key${i}.conf status > /dev/null 2>&1 && ret=1
--done
--if [ $ret != 0 ]; then echo_i "failed"; fi
--status=$((status+ret))
-+if $FEATURETEST --md5; then
-+	echo_i "testing rndc with hmac-md5 ($n)"
-+	ret=0
-+	$RNDC -s 10.53.0.4 -p ${EXTRAPORT1} -c ns4/key1.conf status > /dev/null 2>&1 || ret=1
-+	for i in 2 3 4 5 6
-+	do
-+	        $RNDC -s 10.53.0.4 -p ${EXTRAPORT1} -c ns4/key${i}.conf status > /dev/null 2>&1 && ret=1
-+	done
-+	if [ $ret != 0 ]; then echo_i "failed"; fi
-+	status=$((status+ret))
-+else
-+	echo_i "skipping rndc with hmac-md5 ($n)"
-+fi
- 
- n=$((n+1))
- echo_i "testing rndc with hmac-sha1 ($n)"
-diff --git a/bin/tests/system/tsig/ns1/named.conf.in b/bin/tests/system/tsig/ns1/named.conf.in
-index 76cf970..22637af 100644
---- a/bin/tests/system/tsig/ns1/named.conf.in
-+++ b/bin/tests/system/tsig/ns1/named.conf.in
-@@ -23,10 +23,7 @@ options {
- 	notify no;
- };
- 
--key "md5" {
--	secret "97rnFx24Tfna4mHPfgnerA==";
--	algorithm hmac-md5;
--};
-+# md5 key appended by setup.sh at the end
- 
- key "sha1" {
- 	secret "FrSt77yPTFx6hTs4i2tKLB9LmE0=";
-@@ -53,10 +50,7 @@ key "sha512" {
- 	algorithm hmac-sha512;
- };
- 
--key "md5-trunc" {
--	secret "97rnFx24Tfna4mHPfgnerA==";
--	algorithm hmac-md5-80;
--};
-+# md5-trunc key appended by setup.sh at the end
- 
- key "sha1-trunc" {
- 	secret "FrSt77yPTFx6hTs4i2tKLB9LmE0=";
-diff --git a/bin/tests/system/tsig/ns1/rndc5.conf.in b/bin/tests/system/tsig/ns1/rndc5.conf.in
-new file mode 100644
-index 0000000..0682194
---- /dev/null
-+++ b/bin/tests/system/tsig/ns1/rndc5.conf.in
-@@ -0,0 +1,10 @@
-+# Conditionally included when support for MD5 is available
-+key "md5" {
-+	secret "97rnFx24Tfna4mHPfgnerA==";
-+	algorithm hmac-md5;
-+};
-+
-+key "md5-trunc" {
-+	secret "97rnFx24Tfna4mHPfgnerA==";
-+	algorithm hmac-md5-80;
-+};
-diff --git a/bin/tests/system/tsig/setup.sh b/bin/tests/system/tsig/setup.sh
-index 34cc73b..d51ff21 100644
---- a/bin/tests/system/tsig/setup.sh
-+++ b/bin/tests/system/tsig/setup.sh
-@@ -16,3 +16,8 @@
- $SHELL clean.sh
- 
- copy_setports ns1/named.conf.in ns1/named.conf
-+
-+if $FEATURETEST --md5
-+then
-+	cat ns1/rndc5.conf.in >> ns1/named.conf
-+fi
-diff --git a/bin/tests/system/tsig/tests.sh b/bin/tests/system/tsig/tests.sh
-index 1067227..ee05e83 100644
---- a/bin/tests/system/tsig/tests.sh
-+++ b/bin/tests/system/tsig/tests.sh
-@@ -27,20 +27,25 @@ sha512="jI/Pa4qRu96t76Pns5Z/Ndxbn3QCkwcxLOgt9vgvnJw5wqTRvNyk3FtD6yIMd1dWVlqZ+Y4f
- 
- status=0
- 
--echo_i "fetching using hmac-md5 (old form)"
--ret=0
--$DIG $DIGOPTS example.nil. -y "md5:$md5" @10.53.0.1 soa > dig.out.md5.old || ret=1
--grep -i "md5.*TSIG.*NOERROR" dig.out.md5.old > /dev/null || ret=1
--if [ $ret -eq 1 ] ; then
--	echo_i "failed"; status=1
--fi
--
--echo_i "fetching using hmac-md5 (new form)"
--ret=0
--$DIG $DIGOPTS example.nil. -y "hmac-md5:md5:$md5" @10.53.0.1 soa > dig.out.md5.new || ret=1
--grep -i "md5.*TSIG.*NOERROR" dig.out.md5.new > /dev/null || ret=1
--if [ $ret -eq 1 ] ; then
--	echo_i "failed"; status=1
-+if $FEATURETEST --md5
-+then
-+	echo_i "fetching using hmac-md5 (old form)"
-+	ret=0
-+	$DIG $DIGOPTS example.nil. -y "md5:$md5" @10.53.0.1 soa > dig.out.md5.old || ret=1
-+	grep -i "md5.*TSIG.*NOERROR" dig.out.md5.old > /dev/null || ret=1
-+	if [ $ret -eq 1 ] ; then
-+		echo_i "failed"; status=1
-+	fi
-+
-+	echo_i "fetching using hmac-md5 (new form)"
-+	ret=0
-+	$DIG $DIGOPTS example.nil. -y "hmac-md5:md5:$md5" @10.53.0.1 soa > dig.out.md5.new || ret=1
-+	grep -i "md5.*TSIG.*NOERROR" dig.out.md5.new > /dev/null || ret=1
-+	if [ $ret -eq 1 ] ; then
-+		echo_i "failed"; status=1
-+	fi
-+else
-+	echo_i "skipping using hmac-md5"
- fi
- 
- echo_i "fetching using hmac-sha1"
-@@ -88,12 +93,17 @@ fi
- #	Truncated TSIG
- #
- #
--echo_i "fetching using hmac-md5 (trunc)"
--ret=0
--$DIG $DIGOPTS example.nil. -y "hmac-md5-80:md5-trunc:$md5" @10.53.0.1 soa > dig.out.md5.trunc || ret=1
--grep -i "md5-trunc.*TSIG.*NOERROR" dig.out.md5.trunc > /dev/null || ret=1
--if [ $ret -eq 1 ] ; then
--	echo_i "failed"; status=1
-+if $FEATURETEST --md5
-+then
-+	echo_i "fetching using hmac-md5 (trunc)"
-+	ret=0
-+	$DIG $DIGOPTS example.nil. -y "hmac-md5-80:md5-trunc:$md5" @10.53.0.1 soa > dig.out.md5.trunc || ret=1
-+	grep -i "md5-trunc.*TSIG.*NOERROR" dig.out.md5.trunc > /dev/null || ret=1
-+	if [ $ret -eq 1 ] ; then
-+		echo_i "failed"; status=1
-+	fi
-+else
-+	echo_i "skipping using hmac-md5 (trunc)"
- fi
- 
- echo_i "fetching using hmac-sha1 (trunc)"
-@@ -142,12 +152,17 @@ fi
- #	Check for bad truncation.
- #
- #
--echo_i "fetching using hmac-md5-80 (BADTRUNC)"
--ret=0
--$DIG $DIGOPTS example.nil. -y "hmac-md5-80:md5:$md5" @10.53.0.1 soa > dig.out.md5-80 || ret=1
--grep -i "md5.*TSIG.*BADTRUNC" dig.out.md5-80 > /dev/null || ret=1
--if [ $ret -eq 1 ] ; then
--	echo_i "failed"; status=1
-+if $FEATURETEST --md5
-+then
-+	echo_i "fetching using hmac-md5-80 (BADTRUNC)" 
-+	ret=0
-+	$DIG $DIGOPTS example.nil. -y "hmac-md5-80:md5:$md5" @10.53.0.1 soa > dig.out.md5-80 || ret=1
-+	grep -i "md5.*TSIG.*BADTRUNC" dig.out.md5-80 > /dev/null || ret=1
-+	if [ $ret -eq 1 ] ; then
-+		echo_i "failed"; status=1
-+	fi
-+else
-+	echo_i "skipping using hmac-md5-80 (BADTRUNC)" 
- fi
- 
- echo_i "fetching using hmac-sha1-80 (BADTRUNC)"
-diff --git a/bin/tests/system/upforwd/ns1/named.conf.in b/bin/tests/system/upforwd/ns1/named.conf.in
-index c2b57dd..ea744f8 100644
---- a/bin/tests/system/upforwd/ns1/named.conf.in
-+++ b/bin/tests/system/upforwd/ns1/named.conf.in
-@@ -12,7 +12,7 @@
-  */
- 
- key "update.example." {
--	algorithm "hmac-md5";
-+	algorithm "@DEFAULT_HMAC@";
- 	secret "c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K";
- };
- 
-diff --git a/bin/tests/system/upforwd/tests.sh b/bin/tests/system/upforwd/tests.sh
-index 1d11bdf..456f9c5 100644
---- a/bin/tests/system/upforwd/tests.sh
-+++ b/bin/tests/system/upforwd/tests.sh
-@@ -80,7 +80,7 @@ if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
- 
- echo_i "updating zone (signed) ($n)"
- ret=0
--$NSUPDATE -y update.example:c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K -- - <<EOF || ret=1
-+$NSUPDATE -y ${DEFAULT_HMAC}:update.example:c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K -- - <<EOF || ret=1
- local 10.53.0.1
- server 10.53.0.3 ${PORT}
- update add updated.example. 600 A 10.10.10.1
--- 
-2.39.0
-
diff --git a/bind.spec b/bind.spec
index 4c15dbf..3dc741b 100644
--- a/bind.spec
+++ b/bind.spec
@@ -62,7 +62,7 @@ Conflicts: %1 \
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPL-2.0
-Version:  9.18.12
+Version:  9.18.13
 Release:  1%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
@@ -98,7 +98,6 @@ Source49: named-chroot.files
 # FIXME: Is this still required?
 Patch10: bind-9.5-PIE.patch
 Patch16: bind-9.16-redhat_doc.patch
-Patch22: bind-9.11-fips-tests.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=2122010
 Patch26: bind-9.18-unittest-netmgr-unstable.patch
 
@@ -949,6 +948,9 @@ fi;
 %endif
 
 %changelog
+* Sat Mar 18 2023 Petr Menšík <pemensik@redhat.com> - 32:9.18.13-1
+- Update to 9.18.3 (#2178717)
+
 * Thu Feb 16 2023 Petr Menšík <pemensik@redhat.com> - 32:9.18.12-1
 - Update to 9.18.12 (#2170096)
 
diff --git a/sources b/sources
index 7cdcf76..8c333dc 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.18.12.tar.xz) = 9741ea1260eb0922f5e42fb7916ede3f922291edf6a6b97ca574b53c0179eecb05197d49ca8204e8aae48e0ac393a03e01129c5d9b5d0d32e836009b1b914fac
-SHA512 (bind-9.18.12.tar.xz.asc) = 551844ee503f182d6e149897f8cd8b267f8cebc2b7eb9c88448f382800f6a3bf01efb8ff4be1ff1c61b1b98d33b79c52fa02be55c0b88f47f488e87592d5f2c6
+SHA512 (bind-9.18.13.tar.xz) = e385a285c5a23bac26155f8a3f3a826a6dec0fd2bf4e3e2270debc45d21031cecc41dc05350b1ec0aed5020e0e4ae75db6632e99deea6834519756af4eb69b3c
+SHA512 (bind-9.18.13.tar.xz.asc) = 7f3239ab40dbfcd95e0dd5badffbac1e4972fd68906d010399c318bf55073e82ebfe1f19ad2228dd6b5d659df71bd51397b3aacf8584f2a9a285e4dea94640d1

From 03b1f0a4e43abf1cc6a492ad67bea147dfd6af2f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 5 Apr 2023 14:34:25 +0200
Subject: [PATCH 333/460] Enumerate all SPDX licenses used

---
 bind.spec | 21 +++++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)

diff --git a/bind.spec b/bind.spec
index 3dc741b..9409544 100644
--- a/bind.spec
+++ b/bind.spec
@@ -61,9 +61,23 @@ Conflicts: %1 \
 
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
-License:  MPL-2.0
+License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
+# Most of code is licensed under MPL-2.0. Some additions follow:
+# ./contrib/dlz/* ISC and/or MPL-2.0
+# ./lib/isccc/*.c ISC and/or MPL-2.0
+# ./lib/isccc/include/isccc/*.h ISC and/or MPL-2.0
+# ./lib/isc/picohttpparser.c Expat, should be MIT
+# ./lib/isc/picohttpparser.h Expat, should be MIT
+# ./lib/isc/url.c Expat and/or MPL-2.0, should be MIT
+# ./lib/isc/include/isc/url.h Expat and/or MPL-2.0
+# ./lib/dns/dnstap.c BSD-3-clause and/or MPL-2.0
+# ./lib/isc/commandline.c BSD-3-clause and/or MPL-2.0
+# ./lib/isc/file.c BSD-3-clause and/or MPL-2.0
+# ./lib/isc/string.c BSD-3-clause and/or MPL-2.0
+# ./lib/isc/tm.c BSD-2-clause and/or MPL-2.0
+# ./lib/isccfg/parser.c BSD-2-clause and/or MPL-2.0
 Version:  9.18.13
-Release:  1%{?dist}
+Release:  2%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -948,6 +962,9 @@ fi;
 %endif
 
 %changelog
+* Wed Apr 05 2023 Petr Menšík <pemensik@redhat.com> - 32:9.18.13-2
+- Enumerate all SPDX licenses used
+
 * Sat Mar 18 2023 Petr Menšík <pemensik@redhat.com> - 32:9.18.13-1
 - Update to 9.18.3 (#2178717)
 

From 15dc7fb16a3085aefed4180026d6610f92ad88a8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 21 Apr 2023 22:13:37 +0200
Subject: [PATCH 334/460] Update to 9.18.14 (#2187996)

https://downloads.isc.org/isc/bind9/9.18.14/doc/arm/html/notes.html#notes-for-bind-9-18-14
---
 .gitignore | 2 ++
 bind.spec  | 7 +++++--
 sources    | 4 ++--
 3 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/.gitignore b/.gitignore
index af968a5..307b888 100644
--- a/.gitignore
+++ b/.gitignore
@@ -204,3 +204,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.18.12.tar.xz.asc
 /bind-9.18.13.tar.xz
 /bind-9.18.13.tar.xz.asc
+/bind-9.18.14.tar.xz
+/bind-9.18.14.tar.xz.asc
diff --git a/bind.spec b/bind.spec
index 9409544..a98b535 100644
--- a/bind.spec
+++ b/bind.spec
@@ -76,8 +76,8 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 # ./lib/isc/string.c BSD-3-clause and/or MPL-2.0
 # ./lib/isc/tm.c BSD-2-clause and/or MPL-2.0
 # ./lib/isccfg/parser.c BSD-2-clause and/or MPL-2.0
-Version:  9.18.13
-Release:  2%{?dist}
+Version:  9.18.14
+Release:  1%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -962,6 +962,9 @@ fi;
 %endif
 
 %changelog
+* Fri Apr 21 2023 Petr Menšík <pemensik@redhat.com> - 32:9.18.14-1
+- Update to 9.18.14 (#2187996)
+
 * Wed Apr 05 2023 Petr Menšík <pemensik@redhat.com> - 32:9.18.13-2
 - Enumerate all SPDX licenses used
 
diff --git a/sources b/sources
index 8c333dc..a2558fe 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.18.13.tar.xz) = e385a285c5a23bac26155f8a3f3a826a6dec0fd2bf4e3e2270debc45d21031cecc41dc05350b1ec0aed5020e0e4ae75db6632e99deea6834519756af4eb69b3c
-SHA512 (bind-9.18.13.tar.xz.asc) = 7f3239ab40dbfcd95e0dd5badffbac1e4972fd68906d010399c318bf55073e82ebfe1f19ad2228dd6b5d659df71bd51397b3aacf8584f2a9a285e4dea94640d1
+SHA512 (bind-9.18.14.tar.xz) = 3dccda83ee4c9fa9fa74232a52d97122bd957e98152a12568a099bcfc2780367f17424702e7e0bff3a1ac427e9b71647eefeb9b4f8d462e27893a057e0a5b969
+SHA512 (bind-9.18.14.tar.xz.asc) = 681ea7d1fd2bbfa195099404aa6a85dd315beba5e3baed59a6945dc9d7afab2c7e8e9efa00422f286e1b9dcf2e8119bc9afa77f9c45c64bec1099fa92c872584

From 9678d7855f0a0650efbf5b99458d60ceca466523 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 17 May 2023 18:59:49 +0200
Subject: [PATCH 335/460] Update to 9.18.15 (#2207908)

---
 .gitignore | 2 ++
 bind.spec  | 5 ++++-
 sources    | 4 ++--
 3 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/.gitignore b/.gitignore
index 307b888..af9f0bf 100644
--- a/.gitignore
+++ b/.gitignore
@@ -206,3 +206,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.18.13.tar.xz.asc
 /bind-9.18.14.tar.xz
 /bind-9.18.14.tar.xz.asc
+/bind-9.18.15.tar.xz
+/bind-9.18.15.tar.xz.asc
diff --git a/bind.spec b/bind.spec
index a98b535..1a3be30 100644
--- a/bind.spec
+++ b/bind.spec
@@ -76,7 +76,7 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 # ./lib/isc/string.c BSD-3-clause and/or MPL-2.0
 # ./lib/isc/tm.c BSD-2-clause and/or MPL-2.0
 # ./lib/isccfg/parser.c BSD-2-clause and/or MPL-2.0
-Version:  9.18.14
+Version:  9.18.15
 Release:  1%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
@@ -962,6 +962,9 @@ fi;
 %endif
 
 %changelog
+* Wed May 17 2023 Petr Menšík <pemensik@redhat.com> - 32:9.18.15-1
+- Update to 9.18.15 (#2207908)
+
 * Fri Apr 21 2023 Petr Menšík <pemensik@redhat.com> - 32:9.18.14-1
 - Update to 9.18.14 (#2187996)
 
diff --git a/sources b/sources
index a2558fe..c6cc47b 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.18.14.tar.xz) = 3dccda83ee4c9fa9fa74232a52d97122bd957e98152a12568a099bcfc2780367f17424702e7e0bff3a1ac427e9b71647eefeb9b4f8d462e27893a057e0a5b969
-SHA512 (bind-9.18.14.tar.xz.asc) = 681ea7d1fd2bbfa195099404aa6a85dd315beba5e3baed59a6945dc9d7afab2c7e8e9efa00422f286e1b9dcf2e8119bc9afa77f9c45c64bec1099fa92c872584
+SHA512 (bind-9.18.15.tar.xz) = e038574f9c7b1156c8e3049b9b2464421d6d5e53ab09c47dc68d3b66af9cec1eda9f41b2517909573307a5341f8cf14a8c5f5155e8bbfffee4e06ecb61baa8bf
+SHA512 (bind-9.18.15.tar.xz.asc) = 282dabb481b3cd9f61cbeddee5cefe0eb6a3a45b6d6b27f789bd34dd175927dcbacbeeb3fe67b21d3666ca591b9608c18a442519b56b921e5b40fba340cf6f75

From 7ee174a831674a1abe89a9a3b1ab079b391be18b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 22 Jun 2023 00:34:42 +0200
Subject: [PATCH 336/460] Update to 9.18.16 (#2216462)

https://downloads.isc.org/isc/bind9/9.18.16/doc/arm/html/notes.html#notes-for-bind-9-18-16

Resolves: CVE-2023-2828 CVE-2023-2911
---
 .gitignore       |  2 ++
 bind.spec        |  5 ++++-
 isc-keyblock.asc | 28 ++++++++++++++++++++++++++--
 sources          |  4 ++--
 4 files changed, 34 insertions(+), 5 deletions(-)

diff --git a/.gitignore b/.gitignore
index af9f0bf..a26e0b1 100644
--- a/.gitignore
+++ b/.gitignore
@@ -208,3 +208,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.18.14.tar.xz.asc
 /bind-9.18.15.tar.xz
 /bind-9.18.15.tar.xz.asc
+/bind-9.18.16.tar.xz
+/bind-9.18.16.tar.xz.asc
diff --git a/bind.spec b/bind.spec
index 1a3be30..e52c26f 100644
--- a/bind.spec
+++ b/bind.spec
@@ -76,7 +76,7 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 # ./lib/isc/string.c BSD-3-clause and/or MPL-2.0
 # ./lib/isc/tm.c BSD-2-clause and/or MPL-2.0
 # ./lib/isccfg/parser.c BSD-2-clause and/or MPL-2.0
-Version:  9.18.15
+Version:  9.18.16
 Release:  1%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
@@ -962,6 +962,9 @@ fi;
 %endif
 
 %changelog
+* Wed Jun 21 2023 Petr Menšík <pemensik@redhat.com> - 32:9.18.16-1
+- Update to 9.18.16 (#2216462)
+
 * Wed May 17 2023 Petr Menšík <pemensik@redhat.com> - 32:9.18.15-1
 - Update to 9.18.15 (#2207908)
 
diff --git a/isc-keyblock.asc b/isc-keyblock.asc
index 3750f41..876061d 100644
--- a/isc-keyblock.asc
+++ b/isc-keyblock.asc
@@ -146,6 +146,30 @@ mEVyesjYoV40tDCG73qLtfehhV/iARDMCfnZGyGYIZdDBL+tZTNeLKVDIUi/R3x9
 OmpEl8ZuCuYltyEsJnCF/rQBVMgcTOmsMu6CMx+qT3kC8iGtHqkUT2ufpKISahTn
 e329FQjClEWwBHkr0T4K80Z0REjSo6UBtio73IOCxXe0RqO37L/qgo8xKZbLxy86
 857PRWJhgbw169FJ2kR5p+M5d/g/MUeYnigvWlORW5LyrFg6RnZ1ZbULZI80QhHN
-aSFf/w020HBsLCkzWA/XM6MO2ifJTSn8Ng==
-=C1ed
+aSFf/w020HBsLCkzWA/XM6MO2ifJTSn8NpkCDQRkSjCrARAApLUMHAbmxUMWLgDQ
+apRZBwWXriEyIVqA/SIy1PyWPPFXqs3LZ5Kn5Gw1WO8PfzkPZNtccGmNLjujIoRB
+qR41nV5zxcpS896SujBoYl80A4F4v9Op9i2pFeI9r9acFcUDjbGWBqNro4EfRcJN
+Ctkd9+pl3TUvFX06QCTxmmHy3M81SW3b4NWI+jia1cKjCd+qBFBgKWdjSMBeVTBC
+R9eKqsBQ1UJql2bRzc8pReS+TYCeEbhaOCvUCCKCwGtsSUOW726iNB/4zR4OOuQV
+B9ORufwed+E/RXa8N08/l5O96uXG0krJtOVm0/qQcXOaKxiDo6djnAgCdjFK5zaj
+7594wqbI7de58alWb/egqIhjBTgk+/cO+epZ05qx5SoJZL7ny2ottrfS2cBqP4g1
+SIt1sYl9ImHmJkNrNDy0s25nE9Nga6OfRqVbwnwot4ouTGwj0oZsCjw+gWjDdztH
+1fUWSnlA8jaX9/RZG2wKt9dI+Tp/U4d5dyTb8lIIzzgtAzDmDfPxwwT0rxAAL13A
+gDkJ0AzXA4WTOxb/JE2yfCz//kt7n8SYM//LixL4VAB7e/wnfZBhTq0OFpaPjFU0
+h/k0dc40AqcUuK3lSSjQr3KTzRHtjz8qtN4DFSuyZac83QSVtWE1rFKjS8bl3XHC
+kFFRJ2dMt2WRSkLOYNiTGbYLvmEAEQEAAbQwQW5kcmVpIFBhdmVsIChDb2RlLVNp
+Z25pbmcgS2V5KSA8YW5kcmVpQGlzYy5vcmc+iQJOBBMBCgA4FiEE2mo1COZypJ3T
+gq/ZW49NkbiO2QkFAmRKMKsCGwMFCwkIBwMFFQoJCAsFFgIDAQACHgECF4AACgkQ
+W49NkbiO2QnQZw//XCpeqT0z/sqtu4FYWwYLz1OvWqhe+uA45f9BccnNSVkGFa7w
+3hlLQC/FLUIx2cVy9AluJBP29iQge/bCcXnzo/QvCbhe/4lCTxhr7nsBe1bWpuNI
+4Pl+cQxZQBwcz74zZ1jjaaQOqm3XtdZxeKNfCQmNvz389UZEk2m8K6qJD23fy20V
+n5Y2C502UuP3MitbYKBxBSbs+Auwy1evz/prQ9VeD4Nv3Zr+jWbWFW+dSDC8jkrX
+cGdwWrUQ51QD8VBB9lPWPGY6yTbRmacr4AlVSo2DAfyjHRrGHigRF/VAD5p1+u2g
+3UFLJaEyujfzwU1kG4+zQCWZ2W2UBOekklq/yefxEY5vU1/Lad7vQhBmogQNF21T
+FvLUE6ez7XNsdMZStDPiT8OoTyFZYLRM4yw5rWKw+1mICBv7NV82YD/8hoMoZPyX
+2tNRTXv2MZ6qD++0dMCIZNEyFTB344srvQSyJ7K7vwxulc7iFWngRA8oe6JkAhH4
+B0yNq1FJm6jIL41S2FmnDL3DlfAdKWapBqzgqkv+X5DQBaTlG9a4BcSsdMJgU/Yx
+dD03YsKhDtEWTqBmmEamR1K1CgCC3mOJfsHB5z+Qhdraz2hMr00EQrD5lnpLLpcF
+rYWoilvVlRy7Y7U5wfhY4074L2ZfB+yElKsvtfGKJX/8g+eJdeRuII+hjEc=
+=NX7P
 -----END PGP PUBLIC KEY BLOCK-----
diff --git a/sources b/sources
index c6cc47b..7d07178 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.18.15.tar.xz) = e038574f9c7b1156c8e3049b9b2464421d6d5e53ab09c47dc68d3b66af9cec1eda9f41b2517909573307a5341f8cf14a8c5f5155e8bbfffee4e06ecb61baa8bf
-SHA512 (bind-9.18.15.tar.xz.asc) = 282dabb481b3cd9f61cbeddee5cefe0eb6a3a45b6d6b27f789bd34dd175927dcbacbeeb3fe67b21d3666ca591b9608c18a442519b56b921e5b40fba340cf6f75
+SHA512 (bind-9.18.16.tar.xz) = 90b510552e8fd0c358a627e32bd840eaafc946a2b3c5c4623d0e24aa167fb99aedd91ed19392a104ed5bfce341d9944bab02c680e19d312b59e6688f9546a1fd
+SHA512 (bind-9.18.16.tar.xz.asc) = 31f4f2d00975c576d551aa6cbd231ea91022c8d97c23c2341c844744258aec73965b2671e4f6a6bc20cd12e1c4dcca915dde0d99cff9cbb6b449fe23ebb79017

From 3deb8ee24562356fe231cec9f37d37e3a1cd113a Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Wed, 19 Jul 2023 14:36:49 +0000
Subject: [PATCH 337/460] Rebuilt for
 https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
---
 bind.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index e52c26f..e3b4314 100644
--- a/bind.spec
+++ b/bind.spec
@@ -77,7 +77,7 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 # ./lib/isc/tm.c BSD-2-clause and/or MPL-2.0
 # ./lib/isccfg/parser.c BSD-2-clause and/or MPL-2.0
 Version:  9.18.16
-Release:  1%{?dist}
+Release:  2%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -962,6 +962,9 @@ fi;
 %endif
 
 %changelog
+* Wed Jul 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.18.16-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
+
 * Wed Jun 21 2023 Petr Menšík <pemensik@redhat.com> - 32:9.18.16-1
 - Update to 9.18.16 (#2216462)
 

From fc196eb713021be30611b1fa4d254e77ecd829da Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 19 Jul 2023 23:47:02 +0200
Subject: [PATCH 338/460] Update to 9.18.17 (#2223913)

https://downloads.isc.org/isc/bind9/9.18.17/doc/arm/html/notes.html#notes-for-bind-9-18-17
---
 .gitignore | 2 ++
 bind.spec  | 7 +++++--
 sources    | 4 ++--
 3 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/.gitignore b/.gitignore
index a26e0b1..d2b5b35 100644
--- a/.gitignore
+++ b/.gitignore
@@ -210,3 +210,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.18.15.tar.xz.asc
 /bind-9.18.16.tar.xz
 /bind-9.18.16.tar.xz.asc
+/bind-9.18.17.tar.xz
+/bind-9.18.17.tar.xz.asc
diff --git a/bind.spec b/bind.spec
index e3b4314..4df5f4c 100644
--- a/bind.spec
+++ b/bind.spec
@@ -76,8 +76,8 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 # ./lib/isc/string.c BSD-3-clause and/or MPL-2.0
 # ./lib/isc/tm.c BSD-2-clause and/or MPL-2.0
 # ./lib/isccfg/parser.c BSD-2-clause and/or MPL-2.0
-Version:  9.18.16
-Release:  2%{?dist}
+Version:  9.18.17
+Release:  1%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -962,6 +962,9 @@ fi;
 %endif
 
 %changelog
+* Wed Jul 19 2023 Petr Menšík <pemensik@redhat.com> - 32:9.18.17-1
+- Update to 9.18.17 (#2223913)
+
 * Wed Jul 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.18.16-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
 
diff --git a/sources b/sources
index 7d07178..dbdfccc 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.18.16.tar.xz) = 90b510552e8fd0c358a627e32bd840eaafc946a2b3c5c4623d0e24aa167fb99aedd91ed19392a104ed5bfce341d9944bab02c680e19d312b59e6688f9546a1fd
-SHA512 (bind-9.18.16.tar.xz.asc) = 31f4f2d00975c576d551aa6cbd231ea91022c8d97c23c2341c844744258aec73965b2671e4f6a6bc20cd12e1c4dcca915dde0d99cff9cbb6b449fe23ebb79017
+SHA512 (bind-9.18.17.tar.xz) = d4843a864c012c7fa3c276a0d304b3d8184cb9c2c80f4a8bb55178ff654fba1f244b39f38a8ac4fe7ca0e68722a539bccb80f896d1c18946ab6540d4a57d3abe
+SHA512 (bind-9.18.17.tar.xz.asc) = 13b0baa4d18bf644f40863482be28711d57b46c742a15a99569ab272d45ecb8af5e9302f20e04615954532f6d07abd8e0e0b9bfabf8754123365d942fe4f8b56

From bd877cd86b926933a8cb285a6056f9a4fc6a6744 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 25 Aug 2023 13:21:19 +0200
Subject: [PATCH 339/460] Add preparation for multi-component shared tests

Define explicit component for testing run from this component.
Alternative component in fedora is bind9-next
---
 plans/all.fmf          | 2 ++
 plans/tier1-public.fmf | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/plans/all.fmf b/plans/all.fmf
index df1b3e6..03bf500 100644
--- a/plans/all.fmf
+++ b/plans/all.fmf
@@ -6,3 +6,5 @@ discover:
     url: https://src.fedoraproject.org/tests/bind.git
 execute:
     how: tmt
+context:
+    component: bind
diff --git a/plans/tier1-public.fmf b/plans/tier1-public.fmf
index 31400b7..e5b273a 100644
--- a/plans/tier1-public.fmf
+++ b/plans/tier1-public.fmf
@@ -7,3 +7,5 @@ discover:
     filter: 'tier: 1'
 execute:
     how: tmt
+context:
+    component: bind

From 782e6f0ca58724bc95941a72a4be459d33cdc64d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 6 Sep 2023 20:06:06 +0200
Subject: [PATCH 340/460] Update to 9.18.18 (#2232346)

https://downloads.isc.org/isc/bind9/9.18.18/doc/arm/html/notes.html#notes-for-bind-9-18-18
---
 .gitignore | 2 ++
 bind.spec  | 5 ++++-
 sources    | 4 ++--
 3 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/.gitignore b/.gitignore
index d2b5b35..0fdf8e7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -212,3 +212,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.18.16.tar.xz.asc
 /bind-9.18.17.tar.xz
 /bind-9.18.17.tar.xz.asc
+/bind-9.18.18.tar.xz
+/bind-9.18.18.tar.xz.asc
diff --git a/bind.spec b/bind.spec
index 4df5f4c..8691bc2 100644
--- a/bind.spec
+++ b/bind.spec
@@ -76,7 +76,7 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 # ./lib/isc/string.c BSD-3-clause and/or MPL-2.0
 # ./lib/isc/tm.c BSD-2-clause and/or MPL-2.0
 # ./lib/isccfg/parser.c BSD-2-clause and/or MPL-2.0
-Version:  9.18.17
+Version:  9.18.18
 Release:  1%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
@@ -962,6 +962,9 @@ fi;
 %endif
 
 %changelog
+* Wed Sep 06 2023 Petr Menšík <pemensik@redhat.com> - 32:9.18.18-1
+- Update to 9.18.18 (#2232346)
+
 * Wed Jul 19 2023 Petr Menšík <pemensik@redhat.com> - 32:9.18.17-1
 - Update to 9.18.17 (#2223913)
 
diff --git a/sources b/sources
index dbdfccc..519b6ef 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.18.17.tar.xz) = d4843a864c012c7fa3c276a0d304b3d8184cb9c2c80f4a8bb55178ff654fba1f244b39f38a8ac4fe7ca0e68722a539bccb80f896d1c18946ab6540d4a57d3abe
-SHA512 (bind-9.18.17.tar.xz.asc) = 13b0baa4d18bf644f40863482be28711d57b46c742a15a99569ab272d45ecb8af5e9302f20e04615954532f6d07abd8e0e0b9bfabf8754123365d942fe4f8b56
+SHA512 (bind-9.18.18.tar.xz) = 8d94ec93915c776b9035bce2c3e707c6fb2fa526dbc3b08211c8265daa2c3c88bde51bec08dc416b5b7ba61604754846c4d1efa3f09eebd23847c417c9dc8760
+SHA512 (bind-9.18.18.tar.xz.asc) = f928d702967940f60fd8a0c9e6458f75abaf2f902220094aa0c1df7b158cb22230689c06b987cea3cbe88b0f8847d0bd073fb542730ff0c879086019d2917f32

From 286970af6adc3deb395870b5074763de2065c02c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 22 Sep 2023 20:01:32 +0200
Subject: [PATCH 341/460] Skip failing test on i686 (#2240253)

---
 bind-9.18-tests-rbtdb_test-i686.patch | 41 +++++++++++++++++++++++++++
 bind.spec                             | 10 ++++++-
 2 files changed, 50 insertions(+), 1 deletion(-)
 create mode 100644 bind-9.18-tests-rbtdb_test-i686.patch

diff --git a/bind-9.18-tests-rbtdb_test-i686.patch b/bind-9.18-tests-rbtdb_test-i686.patch
new file mode 100644
index 0000000..a709217
--- /dev/null
+++ b/bind-9.18-tests-rbtdb_test-i686.patch
@@ -0,0 +1,41 @@
+From 37643c9689c2dee85b453879f7145bb393b99dfa Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Fri, 22 Sep 2023 19:54:36 +0200
+Subject: [PATCH] Skip failing tests on 32 platform
+
+Reported to fail also on 32 bit arm, but skip it only on current builds.
+---
+ tests/dns/rbtdb_test.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/tests/dns/rbtdb_test.c b/tests/dns/rbtdb_test.c
+index 59a5786..384a26a 100644
+--- a/tests/dns/rbtdb_test.c
++++ b/tests/dns/rbtdb_test.c
+@@ -326,6 +326,7 @@ ISC_RUN_TEST_IMPL(overmempurge_bigrdata) {
+ 	isc_mem_destroy(&mctx2);
+ }
+ 
++#ifndef i386
+ ISC_RUN_TEST_IMPL(overmempurge_longname) {
+ 	size_t maxcache = 2097152U; /* 2MB - same as DNS_CACHE_MINSIZE */
+ 	size_t hiwater = maxcache - (maxcache >> 3); /* borrowed from cache.c */
+@@ -370,12 +371,15 @@ ISC_RUN_TEST_IMPL(overmempurge_longname) {
+ 	dns_db_detach(&db);
+ 	isc_mem_destroy(&mctx2);
+ }
++#endif
+ 
+ ISC_TEST_LIST_START
+ ISC_TEST_ENTRY(ownercase)
+ ISC_TEST_ENTRY(setownercase)
+ ISC_TEST_ENTRY(overmempurge_bigrdata)
++#ifndef i386
+ ISC_TEST_ENTRY(overmempurge_longname)
++#endif
+ ISC_TEST_LIST_END
+ 
+ ISC_TEST_MAIN
+-- 
+2.41.0
+
diff --git a/bind.spec b/bind.spec
index 8691bc2..e88b33c 100644
--- a/bind.spec
+++ b/bind.spec
@@ -76,7 +76,7 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 # ./lib/isc/string.c BSD-3-clause and/or MPL-2.0
 # ./lib/isc/tm.c BSD-2-clause and/or MPL-2.0
 # ./lib/isccfg/parser.c BSD-2-clause and/or MPL-2.0
-Version:  9.18.18
+Version:  9.18.19
 Release:  1%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
@@ -114,6 +114,8 @@ Patch10: bind-9.5-PIE.patch
 Patch16: bind-9.16-redhat_doc.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=2122010
 Patch26: bind-9.18-unittest-netmgr-unstable.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=2240253
+Patch27: bind-9.18-tests-rbtdb_test-i686.patch
 
 %{?systemd_ordering}
 Requires:       coreutils
@@ -962,6 +964,12 @@ fi;
 %endif
 
 %changelog
+* Fri Sep 22 2023 Petr Menšík <pemensik@redhat.com> - 32:9.18.19-1
+- Update to 9.18.19 (#2232346)
+
+* Fri Sep 22 2023 Petr Menšík <pemensik@redhat.com> - 32:9.18.18-2
+- Skip failing rbtdb_test unit test on i686 (#2240253)
+
 * Wed Sep 06 2023 Petr Menšík <pemensik@redhat.com> - 32:9.18.18-1
 - Update to 9.18.18 (#2232346)
 

From d03e0852a993f2b23e44d2c7ab753b6e919c4e87 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 22 Sep 2023 20:18:07 +0200
Subject: [PATCH 342/460] Update to 9.18.19 (#2232346)

https://downloads.isc.org/isc/bind9/9.18.19/doc/arm/html/notes.html#notes-for-bind-9-18-19

Resolves: CVE-2023-3341 CVE-2023-4236
---
 .gitignore | 2 ++
 sources    | 4 ++--
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/.gitignore b/.gitignore
index 0fdf8e7..20245ab 100644
--- a/.gitignore
+++ b/.gitignore
@@ -214,3 +214,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.18.17.tar.xz.asc
 /bind-9.18.18.tar.xz
 /bind-9.18.18.tar.xz.asc
+/bind-9.18.19.tar.xz
+/bind-9.18.19.tar.xz.asc
diff --git a/sources b/sources
index 519b6ef..cc18249 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.18.18.tar.xz) = 8d94ec93915c776b9035bce2c3e707c6fb2fa526dbc3b08211c8265daa2c3c88bde51bec08dc416b5b7ba61604754846c4d1efa3f09eebd23847c417c9dc8760
-SHA512 (bind-9.18.18.tar.xz.asc) = f928d702967940f60fd8a0c9e6458f75abaf2f902220094aa0c1df7b158cb22230689c06b987cea3cbe88b0f8847d0bd073fb542730ff0c879086019d2917f32
+SHA512 (bind-9.18.19.tar.xz) = 51af9a246f23afc9ac9a1ef2d793bc91f43fe835b6c4101ad557799ee3aa4253bd12b2f12d9d101c1ce616e2a852a42c5567b031adaaaf06677fcc11c98cf393
+SHA512 (bind-9.18.19.tar.xz.asc) = 3903ff0cf9af09c111572677eb9b2707aa253cf59ed22e67c7a2272ab10087ef8a2bb54b15286f86035e59a5bef02fee01e17cef71c5f8f7a38ce8ec7e1b01a3

From 00135d6b207d17ae97d0437c39762b30f813db6e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 16 Nov 2023 15:58:46 +0100
Subject: [PATCH 343/460] Update to 9.18.20 (#2249835)

- B.ROOT-SERVERS.NET address update
- lock-file fixes

https://downloads.isc.org/isc/bind9/9.18.20/doc/arm/html/notes.html#notes-for-bind-9-18-20
---
 .gitignore | 2 ++
 bind.spec  | 5 ++++-
 sources    | 4 ++--
 3 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/.gitignore b/.gitignore
index 20245ab..9916d69 100644
--- a/.gitignore
+++ b/.gitignore
@@ -216,3 +216,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.18.18.tar.xz.asc
 /bind-9.18.19.tar.xz
 /bind-9.18.19.tar.xz.asc
+/bind-9.18.20.tar.xz
+/bind-9.18.20.tar.xz.asc
diff --git a/bind.spec b/bind.spec
index e88b33c..3408c6c 100644
--- a/bind.spec
+++ b/bind.spec
@@ -76,7 +76,7 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 # ./lib/isc/string.c BSD-3-clause and/or MPL-2.0
 # ./lib/isc/tm.c BSD-2-clause and/or MPL-2.0
 # ./lib/isccfg/parser.c BSD-2-clause and/or MPL-2.0
-Version:  9.18.19
+Version:  9.18.20
 Release:  1%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
@@ -964,6 +964,9 @@ fi;
 %endif
 
 %changelog
+* Thu Nov 16 2023 Petr Menšík <pemensik@redhat.com> - 32:9.18.20-1
+- Update to 9.18.20 (#2249835)
+
 * Fri Sep 22 2023 Petr Menšík <pemensik@redhat.com> - 32:9.18.19-1
 - Update to 9.18.19 (#2232346)
 
diff --git a/sources b/sources
index cc18249..549d8ab 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.18.19.tar.xz) = 51af9a246f23afc9ac9a1ef2d793bc91f43fe835b6c4101ad557799ee3aa4253bd12b2f12d9d101c1ce616e2a852a42c5567b031adaaaf06677fcc11c98cf393
-SHA512 (bind-9.18.19.tar.xz.asc) = 3903ff0cf9af09c111572677eb9b2707aa253cf59ed22e67c7a2272ab10087ef8a2bb54b15286f86035e59a5bef02fee01e17cef71c5f8f7a38ce8ec7e1b01a3
+SHA512 (bind-9.18.20.tar.xz) = 1ad89e5aa3d83a3c6536c2931e2ecdf6aca0d9d2678cf45dca8b0fb37968f7ef7aedff5d351083e6b09aeee1329b8885fd06263b21f5ebcde959ef0d84a86ffb
+SHA512 (bind-9.18.20.tar.xz.asc) = 9e8170fb5aacb8ea3c5c5512bd18ba8739c72df1416551493d8098427c7a9b1756ffb7ce7c93bbf43d1caed6e39ecf839eac15041de37ac0a89623b79b9281a7

From db9d0ed8b69755715645e8afb6a081402605e5de Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 15 Jan 2024 16:51:36 +0100
Subject: [PATCH 344/460] Update to 9.18.21

https://downloads.isc.org/isc/bind9/9.18.21/doc/arm/html/notes.html#notes-for-bind-9-18-21

Removed Features

- Support for using AES as the DNS COOKIE algorithm (cookie-algorithm aes;) has been deprecated and will be removed in a future release. Please use the current default, SipHash-2-4, instead. [GL #4421]

- The resolver-nonbackoff-tries and resolver-retry-interval statements have been deprecated. Using them now causes a warning to be logged. [GL #4405]
---
 .gitignore | 2 ++
 bind.spec  | 5 ++++-
 sources    | 4 ++--
 3 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/.gitignore b/.gitignore
index 9916d69..907f352 100644
--- a/.gitignore
+++ b/.gitignore
@@ -218,3 +218,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.18.19.tar.xz.asc
 /bind-9.18.20.tar.xz
 /bind-9.18.20.tar.xz.asc
+/bind-9.18.21.tar.xz
+/bind-9.18.21.tar.xz.asc
diff --git a/bind.spec b/bind.spec
index 3408c6c..c8a6a36 100644
--- a/bind.spec
+++ b/bind.spec
@@ -76,7 +76,7 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 # ./lib/isc/string.c BSD-3-clause and/or MPL-2.0
 # ./lib/isc/tm.c BSD-2-clause and/or MPL-2.0
 # ./lib/isccfg/parser.c BSD-2-clause and/or MPL-2.0
-Version:  9.18.20
+Version:  9.18.21
 Release:  1%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
@@ -964,6 +964,9 @@ fi;
 %endif
 
 %changelog
+* Mon Jan 15 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.21-1
+- Update to 9.18.21 (#2255407)
+
 * Thu Nov 16 2023 Petr Menšík <pemensik@redhat.com> - 32:9.18.20-1
 - Update to 9.18.20 (#2249835)
 
diff --git a/sources b/sources
index 549d8ab..0b5b7ad 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.18.20.tar.xz) = 1ad89e5aa3d83a3c6536c2931e2ecdf6aca0d9d2678cf45dca8b0fb37968f7ef7aedff5d351083e6b09aeee1329b8885fd06263b21f5ebcde959ef0d84a86ffb
-SHA512 (bind-9.18.20.tar.xz.asc) = 9e8170fb5aacb8ea3c5c5512bd18ba8739c72df1416551493d8098427c7a9b1756ffb7ce7c93bbf43d1caed6e39ecf839eac15041de37ac0a89623b79b9281a7
+SHA512 (bind-9.18.21.tar.xz) = 3cbc1775b6ca3d5eda0c277ab1246b5baa535dac53df3e60690aa7a2529bcb0fb644f7749b21b757870e5b3bc5f53ae9f0c0db182664de1b23f7e62c3fa8757d
+SHA512 (bind-9.18.21.tar.xz.asc) = 1afa22dddb5d6c42e2dea2369cc048d548ad86e3d215c692320716488419c012ac849f1699d61451353574ec4621fc93f7111658e9de7fa286336d97e33d5de6

From 7a039e1831f1d717477ff040c2ad335cc7c088de Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 15 Jan 2024 16:55:15 +0100
Subject: [PATCH 345/460] Revert Skip failing test on i686 (#2240253)

Selective revert removing the patch, but keeping changelog.
---
 bind-9.18-tests-rbtdb_test-i686.patch | 41 ---------------------------
 bind.spec                             |  2 --
 2 files changed, 43 deletions(-)
 delete mode 100644 bind-9.18-tests-rbtdb_test-i686.patch

diff --git a/bind-9.18-tests-rbtdb_test-i686.patch b/bind-9.18-tests-rbtdb_test-i686.patch
deleted file mode 100644
index a709217..0000000
--- a/bind-9.18-tests-rbtdb_test-i686.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From 37643c9689c2dee85b453879f7145bb393b99dfa Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Fri, 22 Sep 2023 19:54:36 +0200
-Subject: [PATCH] Skip failing tests on 32 platform
-
-Reported to fail also on 32 bit arm, but skip it only on current builds.
----
- tests/dns/rbtdb_test.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/tests/dns/rbtdb_test.c b/tests/dns/rbtdb_test.c
-index 59a5786..384a26a 100644
---- a/tests/dns/rbtdb_test.c
-+++ b/tests/dns/rbtdb_test.c
-@@ -326,6 +326,7 @@ ISC_RUN_TEST_IMPL(overmempurge_bigrdata) {
- 	isc_mem_destroy(&mctx2);
- }
- 
-+#ifndef i386
- ISC_RUN_TEST_IMPL(overmempurge_longname) {
- 	size_t maxcache = 2097152U; /* 2MB - same as DNS_CACHE_MINSIZE */
- 	size_t hiwater = maxcache - (maxcache >> 3); /* borrowed from cache.c */
-@@ -370,12 +371,15 @@ ISC_RUN_TEST_IMPL(overmempurge_longname) {
- 	dns_db_detach(&db);
- 	isc_mem_destroy(&mctx2);
- }
-+#endif
- 
- ISC_TEST_LIST_START
- ISC_TEST_ENTRY(ownercase)
- ISC_TEST_ENTRY(setownercase)
- ISC_TEST_ENTRY(overmempurge_bigrdata)
-+#ifndef i386
- ISC_TEST_ENTRY(overmempurge_longname)
-+#endif
- ISC_TEST_LIST_END
- 
- ISC_TEST_MAIN
--- 
-2.41.0
-
diff --git a/bind.spec b/bind.spec
index c8a6a36..ac7d94d 100644
--- a/bind.spec
+++ b/bind.spec
@@ -114,8 +114,6 @@ Patch10: bind-9.5-PIE.patch
 Patch16: bind-9.16-redhat_doc.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=2122010
 Patch26: bind-9.18-unittest-netmgr-unstable.patch
-# https://bugzilla.redhat.com/show_bug.cgi?id=2240253
-Patch27: bind-9.18-tests-rbtdb_test-i686.patch
 
 %{?systemd_ordering}
 Requires:       coreutils

From 9899e74f4da0b423440978534cc49e26b265fc5b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 16 Jan 2024 11:14:58 +0100
Subject: [PATCH 346/460] Update changed b.root-servers.net address in hints
 (#2253460)

---
 bind.spec  |  5 ++++-
 named.root | 10 +++++-----
 2 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/bind.spec b/bind.spec
index ac7d94d..2f5ce9b 100644
--- a/bind.spec
+++ b/bind.spec
@@ -77,7 +77,7 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 # ./lib/isc/tm.c BSD-2-clause and/or MPL-2.0
 # ./lib/isccfg/parser.c BSD-2-clause and/or MPL-2.0
 Version:  9.18.21
-Release:  1%{?dist}
+Release:  2%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -962,6 +962,9 @@ fi;
 %endif
 
 %changelog
+* Tue Jan 16 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.21-2
+- Update changed b.root-servers.net address in hints (#2253460)
+
 * Mon Jan 15 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.21-1
 - Update to 9.18.21 (#2255407)
 
diff --git a/named.root b/named.root
index cd808e8..8b8a3b1 100644
--- a/named.root
+++ b/named.root
@@ -8,9 +8,9 @@
 ;           file                /domain/named.cache 
 ;           on server           FTP.INTERNIC.NET
 ;       -OR-                    RS.INTERNIC.NET
-; 
-;       last update:     June 24, 2021 
-;       related version of root zone:     2021062401
+;
+;       last update:     December 20, 2023
+;       related version of root zone:     2023122001
 ; 
 ; FORMERLY NS.INTERNIC.NET 
 ;
@@ -21,8 +21,8 @@ A.ROOT-SERVERS.NET.      3600000      AAAA  2001:503:ba3e::2:30
 ; FORMERLY NS1.ISI.EDU 
 ;
 .                        3600000      NS    B.ROOT-SERVERS.NET.
-B.ROOT-SERVERS.NET.      3600000      A     199.9.14.201
-B.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:200::b
+B.ROOT-SERVERS.NET.      3600000      A     170.247.170.2
+B.ROOT-SERVERS.NET.      3600000      AAAA  2801:1b8:10::b
 ; 
 ; FORMERLY C.PSI.NET 
 ;

From 5e93e0b0789f4175b16109a3d5030d10d7be0583 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Fri, 19 Jan 2024 14:23:22 +0000
Subject: [PATCH 347/460] Rebuilt for
 https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

---
 bind.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index 2f5ce9b..a6823c0 100644
--- a/bind.spec
+++ b/bind.spec
@@ -77,7 +77,7 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 # ./lib/isc/tm.c BSD-2-clause and/or MPL-2.0
 # ./lib/isccfg/parser.c BSD-2-clause and/or MPL-2.0
 Version:  9.18.21
-Release:  2%{?dist}
+Release:  3%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -962,6 +962,9 @@ fi;
 %endif
 
 %changelog
+* Fri Jan 19 2024 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.18.21-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
 * Tue Jan 16 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.21-2
 - Update changed b.root-servers.net address in hints (#2253460)
 

From 59820e13a52724d2f77d2ae604933ef9ce1a9c85 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Tue, 23 Jan 2024 00:22:04 +0000
Subject: [PATCH 348/460] Rebuilt for
 https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

---
 bind.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index a6823c0..591c8e3 100644
--- a/bind.spec
+++ b/bind.spec
@@ -77,7 +77,7 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 # ./lib/isc/tm.c BSD-2-clause and/or MPL-2.0
 # ./lib/isccfg/parser.c BSD-2-clause and/or MPL-2.0
 Version:  9.18.21
-Release:  3%{?dist}
+Release:  4%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -962,6 +962,9 @@ fi;
 %endif
 
 %changelog
+* Tue Jan 23 2024 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.18.21-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
 * Fri Jan 19 2024 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.18.21-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
 

From fcaee16034a3042e67d405c1759c7971fc0c5d87 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 15 Feb 2024 20:55:55 +0100
Subject: [PATCH 349/460] Update to BIND 9.18.24

https://downloads.isc.org/isc/bind9/9.18.24/doc/arm/html/notes.html#notes-for-bind-9-18-24

Resolves: CVE-2023-4408 CVE-2023-5517 CVE-2023-5679 CVE-2023-6516 CVE-2023-50387 CVE-2023-50868
---
 .gitignore | 2 ++
 bind.spec  | 7 +++++--
 sources    | 4 ++--
 3 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/.gitignore b/.gitignore
index 907f352..9444f7f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -220,3 +220,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.18.20.tar.xz.asc
 /bind-9.18.21.tar.xz
 /bind-9.18.21.tar.xz.asc
+/bind-9.18.24.tar.xz
+/bind-9.18.24.tar.xz.asc
diff --git a/bind.spec b/bind.spec
index 591c8e3..f781fbe 100644
--- a/bind.spec
+++ b/bind.spec
@@ -76,8 +76,8 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 # ./lib/isc/string.c BSD-3-clause and/or MPL-2.0
 # ./lib/isc/tm.c BSD-2-clause and/or MPL-2.0
 # ./lib/isccfg/parser.c BSD-2-clause and/or MPL-2.0
-Version:  9.18.21
-Release:  4%{?dist}
+Version:  9.18.24
+Release:  1%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -962,6 +962,9 @@ fi;
 %endif
 
 %changelog
+* Thu Feb 15 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.24-1
+- Update to 9.18.24 (#2264032)
+
 * Tue Jan 23 2024 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.18.21-4
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
 
diff --git a/sources b/sources
index 0b5b7ad..07cff5c 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.18.21.tar.xz) = 3cbc1775b6ca3d5eda0c277ab1246b5baa535dac53df3e60690aa7a2529bcb0fb644f7749b21b757870e5b3bc5f53ae9f0c0db182664de1b23f7e62c3fa8757d
-SHA512 (bind-9.18.21.tar.xz.asc) = 1afa22dddb5d6c42e2dea2369cc048d548ad86e3d215c692320716488419c012ac849f1699d61451353574ec4621fc93f7111658e9de7fa286336d97e33d5de6
+SHA512 (bind-9.18.24.tar.xz) = 465f5b01570fdde5c95adfb780f54e0585814bd25baf914bb95bf5972f15a672e3e7b743a55f1804e69e17609d5a0cd66cc2bbab9174238b3c89e5ad732dc085
+SHA512 (bind-9.18.24.tar.xz.asc) = ee16356b2f523bea1a98fb74216aafa134af3dca42e64438f1c89d8a971919614274af316a170ff9d6f952a5101f44ec1f9fe2c460de42797b06a361c994fb6d

From e79cdb27f2e4016952d8b1f16dfc715e51734f74 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 19 Feb 2024 22:26:20 +0100
Subject: [PATCH 350/460] Include dependency on python3-dns from SYSTEMTEST
 suite

---
 bind.spec | 1 +
 1 file changed, 1 insertion(+)

diff --git a/bind.spec b/bind.spec
index f781fbe..75d00c8 100644
--- a/bind.spec
+++ b/bind.spec
@@ -151,6 +151,7 @@ BuildRequires:  softhsm
 %if %{with SYSTEMTEST}
 # bin/tests/system dependencies
 BuildRequires:  perl(Net::DNS) perl(Net::DNS::Nameserver) perl(Time::HiRes) perl(Getopt::Long)
+BuildRequires:  python3-dns
 # manual configuration requires this tool
 BuildRequires:  iproute
 %endif

From 91d60335005d38c4fa34b1cc3c835a0ec15983ed Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
Date: Fri, 12 Apr 2024 18:07:33 +0200
Subject: [PATCH 351/460] Fix build and installation when %_bindir==%_sbindir

Preparation for https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin.
No change in builds with unmerged sbin.
---
 bind.spec | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/bind.spec b/bind.spec
index 75d00c8..503dcec 100644
--- a/bind.spec
+++ b/bind.spec
@@ -570,13 +570,10 @@ mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/sysconfig
 install -m 644 %{SOURCE1} ${RPM_BUILD_ROOT}%{_sysconfdir}/sysconfig/named
 install -m 644 %{SOURCE49} ${RPM_BUILD_ROOT}%{_sysconfdir}/named-chroot.files
 
-pushd ${RPM_BUILD_ROOT}%{_sbindir}
+%if "%{_sbindir}" != "%{_bindir}"
 # Compatibility with previous major versions, only for selected binaries
-for BIN in named-checkconf named-checkzone named-compilezone
-do
-  ln -s ../bin/$BIN $BIN
-done
-popd
+ln -s ../bin/{named-checkconf,named-checkzone,named-compilezone} %{buildroot}%{_sbindir}/
+%endif
 
 %if %{with DLZ}
   pushd build
@@ -784,7 +781,9 @@ fi;
 %{_bindir}/mdig
 %{_sbindir}/named
 %{_sbindir}/rndc*
+%if "%{_sbindir}" != "%{_bindir}"
 %{_sbindir}/named-checkconf
+%endif
 %{_libexecdir}/generate-rndc-key.sh
 %{_libexecdir}/setup-named-softhsm.sh
 %{_mandir}/man1/mdig.1*
@@ -850,8 +849,10 @@ fi;
 %{_bindir}/nsec3hash
 %{_bindir}/named-checkzone
 %{_bindir}/named-compilezone
+%if "%{_sbindir}" != "%{_bindir}"
 %{_sbindir}/named-checkzone
 %{_sbindir}/named-compilezone
+%endif
 %if %{with DNSTAP}
 %{_bindir}/dnstap-read
 %{_mandir}/man1/dnstap-read.1*

From 283878c63d1e5627f2fe5b608b8259f0433cd409 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 22 Apr 2024 12:13:52 +0200
Subject: [PATCH 352/460] Update to 9.18.26 (rhbz#2270476)

New Features

- The statistics channel now includes counters that indicate the number of currently connected TCP IPv4/IPv6 clients. [GL #4425]
- Added RESOLVER.ARPA to the built in empty zones. [GL #4580]

And bug fixes

https://downloads.isc.org/isc/bind9/9.18.26/doc/arm/html/notes.html#notes-for-bind-9-18-26
---
 .gitignore | 2 ++
 bind.spec  | 5 ++++-
 sources    | 4 ++--
 3 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/.gitignore b/.gitignore
index 9444f7f..8813adc 100644
--- a/.gitignore
+++ b/.gitignore
@@ -222,3 +222,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.18.21.tar.xz.asc
 /bind-9.18.24.tar.xz
 /bind-9.18.24.tar.xz.asc
+/bind-9.18.26.tar.xz
+/bind-9.18.26.tar.xz.asc
diff --git a/bind.spec b/bind.spec
index 503dcec..0c88955 100644
--- a/bind.spec
+++ b/bind.spec
@@ -76,7 +76,7 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 # ./lib/isc/string.c BSD-3-clause and/or MPL-2.0
 # ./lib/isc/tm.c BSD-2-clause and/or MPL-2.0
 # ./lib/isccfg/parser.c BSD-2-clause and/or MPL-2.0
-Version:  9.18.24
+Version:  9.18.26
 Release:  1%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
@@ -964,6 +964,9 @@ fi;
 %endif
 
 %changelog
+* Mon Apr 22 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.26-1
+- Update to 9.18.26 (rhbz#2270476)
+
 * Thu Feb 15 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.24-1
 - Update to 9.18.24 (#2264032)
 
diff --git a/sources b/sources
index 07cff5c..e87d974 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.18.24.tar.xz) = 465f5b01570fdde5c95adfb780f54e0585814bd25baf914bb95bf5972f15a672e3e7b743a55f1804e69e17609d5a0cd66cc2bbab9174238b3c89e5ad732dc085
-SHA512 (bind-9.18.24.tar.xz.asc) = ee16356b2f523bea1a98fb74216aafa134af3dca42e64438f1c89d8a971919614274af316a170ff9d6f952a5101f44ec1f9fe2c460de42797b06a361c994fb6d
+SHA512 (bind-9.18.26.tar.xz) = 517951bd462aff206706a4bbae3ef917299f90af361fb931a50d2340f0580010b8a0eedce1d4e8c99e99389fc44d71221b907e30d91be0d398acbe29688d6e55
+SHA512 (bind-9.18.26.tar.xz.asc) = f310613ec1681a0041c6528081eae2a2e02c12514f7adffd339a62929c78afacaa53cb21b126220007cea56c7748a3ea808a0db6ecdbed9502daee9608407438

From 3a874644a6a8d42790fecb18d39e2676fe45be63 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
Date: Tue, 9 Jul 2024 12:51:00 +0200
Subject: [PATCH 353/460] Rebuilt for the bin-sbin merge

https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin
---
 bind.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index 0c88955..7aaf721 100644
--- a/bind.spec
+++ b/bind.spec
@@ -77,7 +77,7 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 # ./lib/isc/tm.c BSD-2-clause and/or MPL-2.0
 # ./lib/isccfg/parser.c BSD-2-clause and/or MPL-2.0
 Version:  9.18.26
-Release:  1%{?dist}
+Release:  2%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -964,6 +964,9 @@ fi;
 %endif
 
 %changelog
+* Tue Jul 09 2024 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 32:9.18.26-2
+- Rebuilt for the bin-sbin merge
+
 * Mon Apr 22 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.26-1
 - Update to 9.18.26 (rhbz#2270476)
 

From 741c22ffcd5453dd8fe0eafbee6938ceebe1f0ad Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
Date: Tue, 9 Jul 2024 14:36:09 +0200
Subject: [PATCH 354/460] Pull in openssl-devel-engine to fix build

---
 bind.spec | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/bind.spec b/bind.spec
index 7aaf721..73efcc5 100644
--- a/bind.spec
+++ b/bind.spec
@@ -128,6 +128,9 @@ Obsoletes:      %{name}-pkcs11 < 32:9.18.4-2
 
 BuildRequires:  gcc, make
 BuildRequires:  openssl-devel, libtool, autoconf, pkgconfig, libcap-devel
+%if 0%{?fedora} >= 41
+BuildRequires:  openssl-devel-engine
+%endif
 BuildRequires:  libidn2-devel, libxml2-devel
 BuildRequires:  systemd-rpm-macros
 BuildRequires:  selinux-policy

From 245d49eb176c36cd7695b63c3343e8eedde89264 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Wed, 17 Jul 2024 18:17:04 +0000
Subject: [PATCH 355/460] Rebuilt for
 https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild

---
 bind.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index 73efcc5..0f9fa65 100644
--- a/bind.spec
+++ b/bind.spec
@@ -77,7 +77,7 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 # ./lib/isc/tm.c BSD-2-clause and/or MPL-2.0
 # ./lib/isccfg/parser.c BSD-2-clause and/or MPL-2.0
 Version:  9.18.26
-Release:  2%{?dist}
+Release:  3%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -967,6 +967,9 @@ fi;
 %endif
 
 %changelog
+* Wed Jul 17 2024 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.18.26-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
+
 * Tue Jul 09 2024 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 32:9.18.26-2
 - Rebuilt for the bin-sbin merge
 

From 41715d279a7c9a8d9ceb992a60808ff34704b3e9 Mon Sep 17 00:00:00 2001
From: Jonathan Wright <jonathan@almalinux.org>
Date: Fri, 26 Jul 2024 11:11:36 -0500
Subject: [PATCH 356/460] update to 9.18.28 rhbz#2299467 Fixes CVE-2024-4076
 Fixes CVE-2024-1975 Fixes CVE-2024-1737 Fixes CVE-2024-0760

---
 .gitignore |  2 ++
 bind.spec  | 11 +++++++++--
 sources    |  4 ++--
 3 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/.gitignore b/.gitignore
index 8813adc..22659a3 100644
--- a/.gitignore
+++ b/.gitignore
@@ -224,3 +224,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.18.24.tar.xz.asc
 /bind-9.18.26.tar.xz
 /bind-9.18.26.tar.xz.asc
+/bind-9.18.28.tar.xz
+/bind-9.18.28.tar.xz.asc
diff --git a/bind.spec b/bind.spec
index 0f9fa65..beae5d4 100644
--- a/bind.spec
+++ b/bind.spec
@@ -76,8 +76,8 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 # ./lib/isc/string.c BSD-3-clause and/or MPL-2.0
 # ./lib/isc/tm.c BSD-2-clause and/or MPL-2.0
 # ./lib/isccfg/parser.c BSD-2-clause and/or MPL-2.0
-Version:  9.18.26
-Release:  3%{?dist}
+Version:  9.18.28
+Release:  1%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -967,6 +967,13 @@ fi;
 %endif
 
 %changelog
+* Fri Jul 26 2024 Jonathan Wright <jonathan@almalinux.org> - 32:9.18.28-1
+- update to 9.18.28 rhbz#2299467
+- Fixes CVE-2024-4076
+- Fixes CVE-2024-1975
+- Fixes CVE-2024-1737
+- Fixes CVE-2024-0760
+
 * Wed Jul 17 2024 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.18.26-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
 
diff --git a/sources b/sources
index e87d974..704a085 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.18.26.tar.xz) = 517951bd462aff206706a4bbae3ef917299f90af361fb931a50d2340f0580010b8a0eedce1d4e8c99e99389fc44d71221b907e30d91be0d398acbe29688d6e55
-SHA512 (bind-9.18.26.tar.xz.asc) = f310613ec1681a0041c6528081eae2a2e02c12514f7adffd339a62929c78afacaa53cb21b126220007cea56c7748a3ea808a0db6ecdbed9502daee9608407438
+SHA512 (bind-9.18.28.tar.xz) = 19ba625f155c60dd821e3afe52adf3897b3e81289320282b3f43d604af1e7d4e67fafb98a9849782684935008bcd148f190e05234d501aa056daa6724e0119bb
+SHA512 (bind-9.18.28.tar.xz.asc) = e6efe2a9995cabd70c1d2e8e4cb97a9a146e3289d75cfdc81ff8052329db3dd920b9f8f6ad0f1552a0e4e776b01fb077edd5f3d4ea3461952f71dda64574d640

From 8346c4c3cd8d97f2c75d7a81276d95e25ce43bae Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 31 Jul 2024 18:42:05 +0200
Subject: [PATCH 357/460] Warn both in README and spec rebase is not simple

bind-libs are needed by bind-dyndb-ldap, but symbol exported by
bind-libs changes with every rebase. Make it more obvious to external
people.
---
 README.md | 7 +++++++
 bind.spec | 3 +++
 2 files changed, 10 insertions(+)

diff --git a/README.md b/README.md
index 42aad62..773d2cb 100644
--- a/README.md
+++ b/README.md
@@ -14,6 +14,13 @@ More details about upstream project can be found on their
 only upstream sources and packaging instructions for
 [Fedora Project](https://fedoraproject.org).
 
+Any rebase requires to be built together with
+[bind-dyndb-ldap](https://src.fedoraproject.org/rpms/bind-dyndb-ldap/) to prevent conflict
+at installation of [freeipa-server-dns](https://src.fedoraproject.org/rpms/freeipa).
+Stable bodhi updates are checked, but rawhide are not checked explicitly.
+Symbol of libraries in *bind-libs* changes with every minor version change of bind,
+therefore they break any package dependent on bind-libs.
+
 ## Subpackages
 
 The package contains several subpackages, some of them can be disabled on rebuild.
diff --git a/bind.spec b/bind.spec
index beae5d4..24b621c 100644
--- a/bind.spec
+++ b/bind.spec
@@ -76,6 +76,9 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 # ./lib/isc/string.c BSD-3-clause and/or MPL-2.0
 # ./lib/isc/tm.c BSD-2-clause and/or MPL-2.0
 # ./lib/isccfg/parser.c BSD-2-clause and/or MPL-2.0
+#
+# Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it.
+# Updating just bind will cause freeipa-dns-server package to be uninstallable.
 Version:  9.18.28
 Release:  1%{?dist}
 Epoch:    32

From 2616681202944a27806b03d9bb2315ed6dc794c2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 19 Jun 2024 20:36:47 +0200
Subject: [PATCH 358/460] Conflict explicitly with more bind subpackages

List conflicts for each package explicitly, if it should conflict.
---
 bind.spec | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/bind.spec b/bind.spec
index 24b621c..8f32e2c 100644
--- a/bind.spec
+++ b/bind.spec
@@ -8,8 +8,10 @@
 %bcond_with    SYSTEMTEST
 %bcond_without GSSTSIG
 %bcond_without JSON
+%if ! 0%{?rhel}
 # FIXME: Not ready. Should it be worked on?
 %bcond_without DLZ
+%endif
 # New MaxMind GeoLite support
 %bcond_without GEOIP2
 # Disabled temporarily until kyua is fixed on rawhide, bug #1926779
@@ -52,10 +54,10 @@
 
 # Upstream package name
 %global upname bind
+# Epoch is intentionally missing from Provides to be lower than bind package
 %define upname_compat() \
 %if "%{name}" != "%{upname}" \
-Provides: %1 = %{epoch}:%{version}-%{release} \
-Obsoletes: %1 < 32:9.17.0 \
+Provides: %1 = %{version}-%{release} \
 Conflicts: %1 \
 %endif
 
@@ -80,7 +82,7 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it.
 # Updating just bind will cause freeipa-dns-server package to be uninstallable.
 Version:  9.18.28
-Release:  1%{?dist}
+Release:  2%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -126,7 +128,7 @@ Requires(post): glibc-common
 Requires(post): grep
 Requires:       %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
 Recommends:     %{name}-utils %{name}-dnssec-utils
-%upname_compat %{upname}
+%upname_compat  %{upname}
 Obsoletes:      %{name}-pkcs11 < 32:9.18.4-2
 
 BuildRequires:  gcc, make
@@ -255,6 +257,7 @@ Obsoletes: %{name}-lite-devel < 32:9.16.6-3
 Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
 Requires: openssl-devel%{?_isa} libxml2-devel%{?_isa}
 Requires: libcap-devel%{?_isa}
+%upname_compat %{upname}-devel
 %if %{with GSSTSIG}
 Requires: krb5-devel%{?_isa}
 %endif
@@ -282,6 +285,10 @@ Prefix:         %{chroot_prefix}
 # grep is required due to setup-named-chroot.sh script
 Requires:       grep
 Requires:       %{name}%{?_isa} = %{epoch}:%{version}-%{release}
+%upname_compat %{upname}-chroot
+%if "%{name}" != "%{upname}"
+Conflicts:      %{upname}-sdb-chroot
+%endif
 
 %description chroot
 This package contains a tree of files which can be used as a
@@ -970,6 +977,9 @@ fi;
 %endif
 
 %changelog
+* Wed Jul 31 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.28-2
+- Conflict explicitly with more bind subpackages
+
 * Fri Jul 26 2024 Jonathan Wright <jonathan@almalinux.org> - 32:9.18.28-1
 - update to 9.18.28 rhbz#2299467
 - Fixes CVE-2024-4076

From bdfa7b950b427df26038f53402fd512f47d81702 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 19 Jun 2024 20:41:31 +0200
Subject: [PATCH 359/460] Remove separate license subpackage

Move license to libs subpackage, it is required for everything except
documentation. Include license file in docs and bind-libs, avoid extra
package just for single file.
---
 bind.spec | 15 ++++-----------
 1 file changed, 4 insertions(+), 11 deletions(-)

diff --git a/bind.spec b/bind.spec
index 8f32e2c..62a520f 100644
--- a/bind.spec
+++ b/bind.spec
@@ -200,22 +200,16 @@ tools for verifying that the DNS server is operating properly.
 
 %package libs
 Summary: Libraries used by the BIND DNS packages
-Requires: %{name}-license = %{epoch}:%{version}-%{release}
+Provides: %{name}-license = %{epoch}:%{version}-%{release}
 Provides: %{name}-libs-lite = %{epoch}:%{version}-%{release}
 Obsoletes: %{name}-libs-lite < 32:9.16.13
 Obsoletes: %{name}-pkcs11-libs < 32:9.18.4-2
+Obsoletes: %{name}-license < 32:9.18.27-2
 
 %description libs
 Contains heavyweight version of BIND suite libraries used by both named DNS
 server and utilities in %{name}-utils package.
 
-%package license
-Summary:  License of the BIND DNS suite
-BuildArch:noarch
-
-%description license
-Contains license of the BIND DNS suite.
-
 %package utils
 Summary: Utilities for querying DNS name servers
 Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
@@ -332,7 +326,6 @@ Dynamic Loadable Zones sqlite3 module for BIND server.
 %if %{with DOC}
 %package doc
 Summary:   BIND 9 Administrator Reference Manual
-Requires:  %{name}-license = %{epoch}:%{version}-%{release}
 Requires:  python3-sphinx_rtd_theme
 BuildArch: noarch
 
@@ -845,8 +838,6 @@ fi;
 %{_libdir}/libirs-%{version}*.so
 %{_libdir}/libisc-%{version}*.so
 %{_libdir}/libisccfg-%{version}*.so
-
-%files license
 %{!?_licensedir:%global license %%doc}
 %license COPYRIGHT
 
@@ -971,6 +962,7 @@ fi;
 %dir %{_pkgdocdir}
 %doc %{_pkgdocdir}/html
 %doc %{_pkgdocdir}/Bv9ARM.html
+%license COPYRIGHT
 %endif
 %if %{with DOCPDF}
 %doc %{_pkgdocdir}/Bv9ARM.pdf
@@ -979,6 +971,7 @@ fi;
 %changelog
 * Wed Jul 31 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.28-2
 - Conflict explicitly with more bind subpackages
+- Merge license subpackage into libs
 
 * Fri Jul 26 2024 Jonathan Wright <jonathan@almalinux.org> - 32:9.18.28-1
 - update to 9.18.28 rhbz#2299467

From 401d76d40df9e8f50c87b17e7588adeda4fe171d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 9 Jul 2024 14:09:06 +0200
Subject: [PATCH 360/460] Add optional QUERYTRACE feature

---
 bind.spec | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/bind.spec b/bind.spec
index 62a520f..dca1685 100644
--- a/bind.spec
+++ b/bind.spec
@@ -28,6 +28,8 @@
 %bcond_without DOCPDF
 %endif
 %bcond_with    TSAN
+# Add experimental extra verbose logging of query processing
+%bcond_with    QUERYTRACE
 
 %{?!bind_uid:  %global bind_uid  25}
 %{?!bind_gid:  %global bind_gid  25}
@@ -377,6 +379,9 @@ CPPFLAGS="$CPPFLAGS -DOPENSSL_API_COMPAT=10100"
 %if %{with TSAN}
   CFLAGS+=" -O1 -fsanitize=thread -fPIE -pie"
 %endif
+%if %{with QUERYTRACE}
+  CFLAGS+=" -DWANT_QUERYTRACE"
+%endif
 export CFLAGS CPPFLAGS
 export STD_CDEFINES="$CPPFLAGS"
 
@@ -972,6 +977,7 @@ fi;
 * Wed Jul 31 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.28-2
 - Conflict explicitly with more bind subpackages
 - Merge license subpackage into libs
+- Add optional QUERYTRACE feature
 
 * Fri Jul 26 2024 Jonathan Wright <jonathan@almalinux.org> - 32:9.18.28-1
 - update to 9.18.28 rhbz#2299467

From 9149d53bb7dba08ba0ed30884af91e3e197ed983 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 7 Jun 2024 17:57:17 +0200
Subject: [PATCH 361/460] Make documentation links relative

Do not require absolute paths, but use relative links even to
non-existent buildroot subdirectory. It should compute it correctly.
---
 bind.spec | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index dca1685..0c67061 100644
--- a/bind.spec
+++ b/bind.spec
@@ -634,7 +634,7 @@ do
   BINDTHEMEDIR="${RPM_BUILD_ROOT}%{_pkgdocdir}/html/_static/$BASE"
   if [ -d "$BINDTHEMEDIR" ]; then
     rm -rf "$BINDTHEMEDIR"
-    ln -s "$DIR" "$BINDTHEMEDIR"
+    ln -sr "${RPM_BUILD_ROOT}${DIR}" "$BINDTHEMEDIR"
   fi
 done
 %endif
@@ -978,6 +978,7 @@ fi;
 - Conflict explicitly with more bind subpackages
 - Merge license subpackage into libs
 - Add optional QUERYTRACE feature
+- Make relative documentation links
 
 * Fri Jul 26 2024 Jonathan Wright <jonathan@almalinux.org> - 32:9.18.28-1
 - update to 9.18.28 rhbz#2299467

From b57d168db4a61c6a926ecb408bedea4202b1571b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 31 Jul 2024 22:45:53 +0200
Subject: [PATCH 362/460] Drop PostgreSQL dependencies not used by DLZ anymore

---
 bind.spec | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/bind.spec b/bind.spec
index 0c67061..d298983 100644
--- a/bind.spec
+++ b/bind.spec
@@ -84,7 +84,7 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it.
 # Updating just bind will cause freeipa-dns-server package to be uninstallable.
 Version:  9.18.28
-Release:  2%{?dist}
+Release:  3%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -149,7 +149,9 @@ BuildRequires:  gnupg2
 %endif
 BuildRequires:  libuv-devel
 %if %{with DLZ}
-BuildRequires:  openldap-devel, libpq-devel, sqlite-devel, mariadb-connector-c-devel
+BuildRequires:  openldap-devel
+BuildRequires:  sqlite-devel
+BuildRequires:  mariadb-connector-c-devel
 %endif
 %if %{with UNITTEST}
 # make unit dependencies
@@ -974,6 +976,9 @@ fi;
 %endif
 
 %changelog
+* Wed Jul 31 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.28-3
+- Drop PostgreSQL dependencies not used by DLZ anymore
+
 * Wed Jul 31 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.28-2
 - Conflict explicitly with more bind subpackages
 - Merge license subpackage into libs

From 109d2c0507986c5342ae97fcee22854b3683bfba Mon Sep 17 00:00:00 2001
From: Yaakov Selkowitz <yselkowi@redhat.com>
Date: Thu, 12 Sep 2024 15:20:58 -0400
Subject: [PATCH 363/460] Fix build with OPENSSL_NO_ENGINE

Most ENGINE-related includes and code are already so guarded, this fixes
the last unguarded cases, and allows bind to build without
openssl-devel-engine (e.g. in RHEL 10 and ELN).
---
 bind-9.18-openssl-no-engine.patch | 28 ++++++++++++++++++++++++++++
 bind.spec                         |  2 ++
 2 files changed, 30 insertions(+)
 create mode 100644 bind-9.18-openssl-no-engine.patch

diff --git a/bind-9.18-openssl-no-engine.patch b/bind-9.18-openssl-no-engine.patch
new file mode 100644
index 0000000..967436d
--- /dev/null
+++ b/bind-9.18-openssl-no-engine.patch
@@ -0,0 +1,28 @@
+diff --git a/lib/isc/openssl_shim.c b/lib/isc/openssl_shim.c
+index b8dbfaa..d851857 100644
+--- a/lib/isc/openssl_shim.c
++++ b/lib/isc/openssl_shim.c
+@@ -16,7 +16,9 @@
+ #include <string.h>
+ 
+ #include <openssl/crypto.h>
++#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000
+ #include <openssl/engine.h>
++#endif
+ #include <openssl/evp.h>
+ #include <openssl/hmac.h>
+ #include <openssl/opensslv.h>
+diff --git a/lib/isc/openssl_shim.h b/lib/isc/openssl_shim.h
+index c0abd14..ec16d2f 100644
+--- a/lib/isc/openssl_shim.h
++++ b/lib/isc/openssl_shim.h
+@@ -14,7 +14,9 @@
+ #pragma once
+ 
+ #include <openssl/crypto.h>
++#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000
+ #include <openssl/engine.h>
++#endif
+ #include <openssl/evp.h>
+ #include <openssl/hmac.h>
+ #include <openssl/opensslv.h>
diff --git a/bind.spec b/bind.spec
index d298983..4e953c9 100644
--- a/bind.spec
+++ b/bind.spec
@@ -121,6 +121,8 @@ Patch10: bind-9.5-PIE.patch
 Patch16: bind-9.16-redhat_doc.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=2122010
 Patch26: bind-9.18-unittest-netmgr-unstable.patch
+# https://fedoraproject.org/wiki/Changes/OpensslDeprecateEngine
+Patch27: bind-9.18-openssl-no-engine.patch
 
 %{?systemd_ordering}
 Requires:       coreutils

From 891dc1c77c1e690debe4d803107eae2797cc58e2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 21 Aug 2024 20:41:02 +0200
Subject: [PATCH 364/460] Remove ancient triggerun and selinux boolean traces

---
 bind.spec | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/bind.spec b/bind.spec
index 4e953c9..28df52e 100644
--- a/bind.spec
+++ b/bind.spec
@@ -40,7 +40,6 @@
                                          %{_sysconfdir}/{crypto-policies/back-ends,pki/dnssec-keys,named} \\\
                                          %{_libdir}/bind %{_libdir}/named %{_datadir}/GeoIP /proc/sys/net/ipv4
 
-%global        selinuxbooleans   named_write_master_zones=1
 ## The order of libs is important. See lib/Makefile.in for details
 %define bind_export_libs isc dns isccfg irs
 %{!?_export_dir:%global _export_dir /bind9-export/}
@@ -84,7 +83,7 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it.
 # Updating just bind will cause freeipa-dns-server package to be uninstallable.
 Version:  9.18.28
-Release:  3%{?dist}
+Release:  4%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -739,16 +738,12 @@ if [ $1 -gt 1 ]; then \
   done \
 fi
 
-%triggerun -- bind < 32:9.9.0-0.6.rc1
-/sbin/chkconfig --del named >/dev/null 2>&1 || :
-/bin/systemctl try-restart named.service >/dev/null 2>&1 || :
-
 %triggerpostun -- bind < 32:9.18.4-2, selinux-policy, policycoreutils
 if [ -x %{_sbindir}/selinuxenabled ] && [ -x %{_sbindir}/getsebool ] && [ -x %{_sbindir}/setsebool ] \
    && %{_sbindir}/selinuxenabled && [ -x %{_sbindir}/named ]; then
   # Return master zones after upgrade from selinux_booleans version
   WRITEBOOL="$(LC_ALL=C %{_sbindir}/getsebool named_write_master_zones)"
-  if [ "echo ${WRITEBOOL#named_write_master_zones --> }" = "off" ]; then
+  if [ "${WRITEBOOL#named_write_master_zones --> }" = "off" ]; then
     echo "Restoring new sebool default of named_write_master_zones..."
     %{_sbindir}/setsebool -P named_write_master_zones=1 || :
   fi
@@ -978,6 +973,9 @@ fi;
 %endif
 
 %changelog
+* Wed Aug 21 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.28-4
+- Remove ancient triggerun and selinux boolean traces
+
 * Wed Jul 31 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.28-3
 - Drop PostgreSQL dependencies not used by DLZ anymore
 

From 9ac8e058afed3b1b65c6d2be00fb1465549c7aca Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 21 Aug 2024 20:50:49 +0200
Subject: [PATCH 365/460] Update to 9.18.29 (rhbz#2306542)

- Tighten max-recursion-queries and add max-query-restarts configuration statement.
- Raise the log level of priming failures.
- Bug fixes

https://downloads.isc.org/isc/bind9/9.18.29/doc/arm/html/notes.html#notes-for-bind-9-18-29
---
 .gitignore | 2 ++
 bind.spec  | 7 +++++--
 sources    | 4 ++--
 3 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/.gitignore b/.gitignore
index 22659a3..cb7e3ee 100644
--- a/.gitignore
+++ b/.gitignore
@@ -226,3 +226,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.18.26.tar.xz.asc
 /bind-9.18.28.tar.xz
 /bind-9.18.28.tar.xz.asc
+/bind-9.18.29.tar.xz
+/bind-9.18.29.tar.xz.asc
diff --git a/bind.spec b/bind.spec
index 28df52e..d1fcba4 100644
--- a/bind.spec
+++ b/bind.spec
@@ -82,8 +82,8 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 #
 # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it.
 # Updating just bind will cause freeipa-dns-server package to be uninstallable.
-Version:  9.18.28
-Release:  4%{?dist}
+Version:  9.18.29
+Release:  1%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -973,6 +973,9 @@ fi;
 %endif
 
 %changelog
+* Wed Aug 21 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.29-1
+- Update to 9.18.29 (rhbz#2306542)
+
 * Wed Aug 21 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.28-4
 - Remove ancient triggerun and selinux boolean traces
 
diff --git a/sources b/sources
index 704a085..f0ecde1 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.18.28.tar.xz) = 19ba625f155c60dd821e3afe52adf3897b3e81289320282b3f43d604af1e7d4e67fafb98a9849782684935008bcd148f190e05234d501aa056daa6724e0119bb
-SHA512 (bind-9.18.28.tar.xz.asc) = e6efe2a9995cabd70c1d2e8e4cb97a9a146e3289d75cfdc81ff8052329db3dd920b9f8f6ad0f1552a0e4e776b01fb077edd5f3d4ea3461952f71dda64574d640
+SHA512 (bind-9.18.29.tar.xz) = 6c2676e2e2cb90f3bd73afb367813c54d1c961e12df1e12e41b9d0ee5a1d5cdf368d81410469753eaef37e43358b56796f078f3b2f20c3b247c4bef91d56c716
+SHA512 (bind-9.18.29.tar.xz.asc) = 6612c7151c4c1736e0237b8219cefbafbc1dcd4b04ad9b12b99cba703e6debde90d2f9838dd1465a47b9a002a598d9b8f3221dfe1a3bdc41436a92e6d06db472

From 170a2ffa18541bb575345841eb31f3cda6c55c39 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Sat, 5 Oct 2024 00:24:27 +0200
Subject: [PATCH 366/460] Update to 9.18.30 (rhbz#2306542)

- Print the full path of the working directory in startup log messages.
- Follow the number of CPUs set by taskset/cpuset.
- Verification of the privacy of an EDDSA key was broken.
- Fix algorithm rollover bug when there are two keys with the same keytag.

https://downloads.isc.org/isc/bind9/9.18.30/doc/arm/html/notes.html#notes-for-bind-9-18-30

Update to 9.18.29

Feature Changes:

- Tighten max-recursion-queries and add max-query-restarts configuration statement.
- Raise the log level of priming failures.
- Add a compatibility shim for older libuv versions (< 1.19.0)

Bug Fixes:

Return SERVFAIL for a too long CNAME chain.
- Reconfigure catz member zones during named reconfiguration.
- Update key lifetime and metadata after dnssec-policy reconfiguration.
- Fix generation of 6to4-self name expansion from IPv4 address.
- dig +yaml was producing unexpected and/or invalid YAML. output. [GL #4796] [GL !9214]
- SVBC ALPN text parsing failed to reject zero-length ALPN. [GL #4775] [GL !9210]
- Fix false QNAME minimisation error being reported.
- Fix dig +timeout argument when using +https.

https://downloads.isc.org/isc/bind9/9.18.30/doc/arm/html/notes.html#notes-for-bind-9-18-29
---
 .gitignore | 2 ++
 bind.spec  | 5 ++++-
 sources    | 4 ++--
 3 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/.gitignore b/.gitignore
index cb7e3ee..1eb72ca 100644
--- a/.gitignore
+++ b/.gitignore
@@ -228,3 +228,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.18.28.tar.xz.asc
 /bind-9.18.29.tar.xz
 /bind-9.18.29.tar.xz.asc
+/bind-9.18.30.tar.xz
+/bind-9.18.30.tar.xz.asc
diff --git a/bind.spec b/bind.spec
index d1fcba4..152e7c0 100644
--- a/bind.spec
+++ b/bind.spec
@@ -82,7 +82,7 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 #
 # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it.
 # Updating just bind will cause freeipa-dns-server package to be uninstallable.
-Version:  9.18.29
+Version:  9.18.30
 Release:  1%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
@@ -973,6 +973,9 @@ fi;
 %endif
 
 %changelog
+* Fri Oct 04 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.30-1
+- Update to 9.18.30 (rhbz#2306542)
+
 * Wed Aug 21 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.29-1
 - Update to 9.18.29 (rhbz#2306542)
 
diff --git a/sources b/sources
index f0ecde1..1b80d6a 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.18.29.tar.xz) = 6c2676e2e2cb90f3bd73afb367813c54d1c961e12df1e12e41b9d0ee5a1d5cdf368d81410469753eaef37e43358b56796f078f3b2f20c3b247c4bef91d56c716
-SHA512 (bind-9.18.29.tar.xz.asc) = 6612c7151c4c1736e0237b8219cefbafbc1dcd4b04ad9b12b99cba703e6debde90d2f9838dd1465a47b9a002a598d9b8f3221dfe1a3bdc41436a92e6d06db472
+SHA512 (bind-9.18.30.tar.xz) = 7a7d4524cf7449bdd215c4139f2345644dbcd6e009e841702beb58223ebda82ba2e46a291cf51c9c76c37781a1d89fc7c8a526763b7c3b3e43f47ee3d1a6e142
+SHA512 (bind-9.18.30.tar.xz.asc) = b419e36f6ed5afef72df64283926f45c1c0a7a375258079a92b4ae11726316a74981a5072928f708a2fd8b07108051abec65dbe6a84ab4ecfb015120d1ff375c

From f25b47caaa43de1c55ce754d93062b3ce4bd56fa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Sat, 3 Aug 2024 00:16:12 +0200
Subject: [PATCH 367/460] Make OpenSSL engine support optional and disabled

openssl-devel-engine is now needed on rawhide to have engine header
present. Make it enabled by default, but possible to disable built
support for it easy way.

https://fedoraproject.org/wiki/Changes/OpensslDeprecateEngine
---
 bind-9.18-openssl-no-engine.patch | 28 ------------------
 bind-9.20-openssl-no-engine.patch | 47 +++++++++++++++++++++++++++++++
 bind.spec                         | 15 ++++++++--
 3 files changed, 59 insertions(+), 31 deletions(-)
 delete mode 100644 bind-9.18-openssl-no-engine.patch
 create mode 100644 bind-9.20-openssl-no-engine.patch

diff --git a/bind-9.18-openssl-no-engine.patch b/bind-9.18-openssl-no-engine.patch
deleted file mode 100644
index 967436d..0000000
--- a/bind-9.18-openssl-no-engine.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-diff --git a/lib/isc/openssl_shim.c b/lib/isc/openssl_shim.c
-index b8dbfaa..d851857 100644
---- a/lib/isc/openssl_shim.c
-+++ b/lib/isc/openssl_shim.c
-@@ -16,7 +16,9 @@
- #include <string.h>
- 
- #include <openssl/crypto.h>
-+#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000
- #include <openssl/engine.h>
-+#endif
- #include <openssl/evp.h>
- #include <openssl/hmac.h>
- #include <openssl/opensslv.h>
-diff --git a/lib/isc/openssl_shim.h b/lib/isc/openssl_shim.h
-index c0abd14..ec16d2f 100644
---- a/lib/isc/openssl_shim.h
-+++ b/lib/isc/openssl_shim.h
-@@ -14,7 +14,9 @@
- #pragma once
- 
- #include <openssl/crypto.h>
-+#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000
- #include <openssl/engine.h>
-+#endif
- #include <openssl/evp.h>
- #include <openssl/hmac.h>
- #include <openssl/opensslv.h>
diff --git a/bind-9.20-openssl-no-engine.patch b/bind-9.20-openssl-no-engine.patch
new file mode 100644
index 0000000..adb46aa
--- /dev/null
+++ b/bind-9.20-openssl-no-engine.patch
@@ -0,0 +1,47 @@
+From b487bd340ae1b635ce5cffe76f748ddc97f301f7 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
+Date: Sat, 3 Aug 2024 01:28:36 +0200
+Subject: [PATCH] Remove unused <openssl/{hmac,engine}.h> headers from OpenSSL
+ shims
+
+The <openssl/{hmac,engine}.h> headers were unused and including the
+<openssl/engine.h> header might cause build failure when OpenSSL
+doesn't have Engines support enabled.
+
+See https://fedoraproject.org/wiki/Changes/OpensslDeprecateEngine
+---
+ lib/isc/openssl_shim.c | 2 --
+ lib/isc/openssl_shim.h | 2 --
+ 2 files changed, 4 deletions(-)
+
+diff --git a/lib/isc/openssl_shim.c b/lib/isc/openssl_shim.c
+index c39ba8c6827..02d0105eb9e 100644
+--- a/lib/isc/openssl_shim.c
++++ b/lib/isc/openssl_shim.c
+@@ -16,9 +16,7 @@
+ #include <string.h>
+ 
+ #include <openssl/crypto.h>
+-#include <openssl/engine.h>
+ #include <openssl/evp.h>
+-#include <openssl/hmac.h>
+ #include <openssl/opensslv.h>
+ #include <openssl/ssl.h>
+ 
+diff --git a/lib/isc/openssl_shim.h b/lib/isc/openssl_shim.h
+index b2916e20a90..95b2f08e231 100644
+--- a/lib/isc/openssl_shim.h
++++ b/lib/isc/openssl_shim.h
+@@ -14,9 +14,7 @@
+ #pragma once
+ 
+ #include <openssl/crypto.h>
+-#include <openssl/engine.h>
+ #include <openssl/evp.h>
+-#include <openssl/hmac.h>
+ #include <openssl/opensslv.h>
+ #include <openssl/ssl.h>
+ 
+-- 
+2.46.2
+
diff --git a/bind.spec b/bind.spec
index 152e7c0..2ef83f6 100644
--- a/bind.spec
+++ b/bind.spec
@@ -30,6 +30,10 @@
 %bcond_with    TSAN
 # Add experimental extra verbose logging of query processing
 %bcond_with    QUERYTRACE
+%if 0%{?fedora} >= 41 && ! 0%{?rhel}
+# Make this enabled on recent Fedora, but not in ELN or RHEL
+  %bcond_without OPENSSL_ENGINE
+%endif
 
 %{?!bind_uid:  %global bind_uid  25}
 %{?!bind_gid:  %global bind_gid  25}
@@ -121,7 +125,9 @@ Patch16: bind-9.16-redhat_doc.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=2122010
 Patch26: bind-9.18-unittest-netmgr-unstable.patch
 # https://fedoraproject.org/wiki/Changes/OpensslDeprecateEngine
-Patch27: bind-9.18-openssl-no-engine.patch
+# Correct support for building without openssl/engine.h header
+# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/9593
+Patch27: bind-9.20-openssl-no-engine.patch
 
 %{?systemd_ordering}
 Requires:       coreutils
@@ -136,7 +142,7 @@ Obsoletes:      %{name}-pkcs11 < 32:9.18.4-2
 
 BuildRequires:  gcc, make
 BuildRequires:  openssl-devel, libtool, autoconf, pkgconfig, libcap-devel
-%if 0%{?fedora} >= 41
+%if %{with OPENSSL_ENGINE}
 BuildRequires:  openssl-devel-engine
 %endif
 BuildRequires:  libidn2-devel, libxml2-devel
@@ -377,8 +383,11 @@ done
 %define systemtest_prepare_build() \
   cp -Tuav bin/tests "%{1}/bin/tests/" \
 
-CFLAGS="$CFLAGS $RPM_OPT_FLAGS"
+%if %{with OPENSSL_ENGINE}
 CPPFLAGS="$CPPFLAGS -DOPENSSL_API_COMPAT=10100"
+%else
+CPPFLAGS="$CPPFLAGS -DOPENSSL_NO_ENGINE=1"
+%endif
 %if %{with TSAN}
   CFLAGS+=" -O1 -fsanitize=thread -fPIE -pie"
 %endif

From ed057b3adaa2cae906d6c2845188f0a836aef6d0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 8 Oct 2024 19:45:04 +0200
Subject: [PATCH 368/460] Make OpenSSL engine support optional

Make changelog entry. Engine support is still enabled on Fedora, but
disabled for RHEL builds.
---
 bind.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index 2ef83f6..3699daf 100644
--- a/bind.spec
+++ b/bind.spec
@@ -87,7 +87,7 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it.
 # Updating just bind will cause freeipa-dns-server package to be uninstallable.
 Version:  9.18.30
-Release:  1%{?dist}
+Release:  2%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -982,6 +982,9 @@ fi;
 %endif
 
 %changelog
+* Tue Oct 08 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.30-2
+- Make OpenSSL engine support optional
+
 * Fri Oct 04 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.30-1
 - Update to 9.18.30 (rhbz#2306542)
 

From 047b52731f4fdb4a59cce8b343ee05ad044ac15f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 14 Nov 2024 21:20:38 +0100
Subject: [PATCH 369/460] Bump obsoleted license version

Resolves: rhbz#2308102
---
 bind.spec | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/bind.spec b/bind.spec
index 3699daf..7d3af4b 100644
--- a/bind.spec
+++ b/bind.spec
@@ -87,7 +87,7 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it.
 # Updating just bind will cause freeipa-dns-server package to be uninstallable.
 Version:  9.18.30
-Release:  2%{?dist}
+Release:  3%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -215,7 +215,7 @@ Provides: %{name}-license = %{epoch}:%{version}-%{release}
 Provides: %{name}-libs-lite = %{epoch}:%{version}-%{release}
 Obsoletes: %{name}-libs-lite < 32:9.16.13
 Obsoletes: %{name}-pkcs11-libs < 32:9.18.4-2
-Obsoletes: %{name}-license < 32:9.18.27-2
+Obsoletes: %{name}-license < 32:9.18.30-3
 
 %description libs
 Contains heavyweight version of BIND suite libraries used by both named DNS
@@ -982,6 +982,9 @@ fi;
 %endif
 
 %changelog
+* Thu Nov 14 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.30-3
+- Bump obsoleted license version (rhbz#2308102)
+
 * Tue Oct 08 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.30-2
 - Make OpenSSL engine support optional
 

From a4f0681ebe024a3b3327a71ba2baf76eca3bdee2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 14 Nov 2024 20:21:13 +0100
Subject: [PATCH 370/460] Update to 9.18.31 (#2319214)

New Features:

- Added WALLET type.

Feature Changes:

- Allow IXFR-to-AXFR fallback on DNS_R_TOOMANYRECORDS.

And bug fixes.

https://downloads.isc.org/isc/bind9/9.18.31/doc/arm/html/notes.html#notes-for-bind-9-18-31
---
 .gitignore | 2 ++
 bind.spec  | 7 +++++--
 sources    | 4 ++--
 3 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/.gitignore b/.gitignore
index 1eb72ca..5e41d3f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -230,3 +230,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.18.29.tar.xz.asc
 /bind-9.18.30.tar.xz
 /bind-9.18.30.tar.xz.asc
+/bind-9.18.31.tar.xz
+/bind-9.18.31.tar.xz.asc
diff --git a/bind.spec b/bind.spec
index 7d3af4b..0439976 100644
--- a/bind.spec
+++ b/bind.spec
@@ -86,8 +86,8 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 #
 # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it.
 # Updating just bind will cause freeipa-dns-server package to be uninstallable.
-Version:  9.18.30
-Release:  3%{?dist}
+Version:  9.18.31
+Release:  1%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -982,6 +982,9 @@ fi;
 %endif
 
 %changelog
+* Thu Nov 14 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.31-1
+- Update to 9.18.31 (#2319214)
+
 * Thu Nov 14 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.30-3
 - Bump obsoleted license version (rhbz#2308102)
 
diff --git a/sources b/sources
index 1b80d6a..42e8fc8 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.18.30.tar.xz) = 7a7d4524cf7449bdd215c4139f2345644dbcd6e009e841702beb58223ebda82ba2e46a291cf51c9c76c37781a1d89fc7c8a526763b7c3b3e43f47ee3d1a6e142
-SHA512 (bind-9.18.30.tar.xz.asc) = b419e36f6ed5afef72df64283926f45c1c0a7a375258079a92b4ae11726316a74981a5072928f708a2fd8b07108051abec65dbe6a84ab4ecfb015120d1ff375c
+SHA512 (bind-9.18.31.tar.xz) = e51873484be3ee367eb1e601b8e0adc45abcdb16df04021ea42ffcc51b99821f8b30f67b2a693a90ad3efa51698a651c8da9d7947ee8fa19680f627afe1f7034
+SHA512 (bind-9.18.31.tar.xz.asc) = 2c17d9a9f153264ed18b287e081b432b5310746964be3e35dfd31597622182e822e62fc3cc4034c0e1c7041949e624c43ffb10d134145d6300f8135f86e38cc6

From 87f39d667e629b29fe881d2ab73628d2a0154570 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 4 Dec 2024 17:56:42 +0100
Subject: [PATCH 371/460] Backport nsupdate TLS support

This should add working nsupdate support for -S parameter and some
others in addition.

References:
https://issues.redhat.com/browse/FREEIPA-11706
https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/6751
https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/6752

Resolves: FREEIPA-11706
---
 bind-9.20-nsupdate-tls-doc.patch |  114 +++
 bind-9.20-nsupdate-tls.patch     | 1556 ++++++++++++++++++++++++++++++
 bind.spec                        |   12 +-
 3 files changed, 1681 insertions(+), 1 deletion(-)
 create mode 100644 bind-9.20-nsupdate-tls-doc.patch
 create mode 100644 bind-9.20-nsupdate-tls.patch

diff --git a/bind-9.20-nsupdate-tls-doc.patch b/bind-9.20-nsupdate-tls-doc.patch
new file mode 100644
index 0000000..d74c706
--- /dev/null
+++ b/bind-9.20-nsupdate-tls-doc.patch
@@ -0,0 +1,114 @@
+From c5c756ce2ac4c1563d024428e148ca27c7721f71 Mon Sep 17 00:00:00 2001
+From: Aram Sargsyan <aram@isc.org>
+Date: Wed, 21 Sep 2022 15:05:11 +0000
+Subject: [PATCH 2/3] Document nsupdate options related to DoT
+
+Add documentation for the newly implemented DoT feature of the
+nsupdate program.
+
+(cherry picked from commit bd8299d7b501234263a6aee98049f879b1c700b7)
+---
+ bin/nsupdate/nsupdate.rst | 48 ++++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 47 insertions(+), 1 deletion(-)
+
+diff --git a/bin/nsupdate/nsupdate.rst b/bin/nsupdate/nsupdate.rst
+index 81bb4815cf4..f1ab5c76fa7 100644
+--- a/bin/nsupdate/nsupdate.rst
++++ b/bin/nsupdate/nsupdate.rst
+@@ -19,7 +19,7 @@ nsupdate - dynamic DNS update utility
+ Synopsis
+ ~~~~~~~~
+ 
+-:program:`nsupdate` [**-d**] [**-D**] [**-i**] [**-L** level] [ [**-g**] | [**-o**] | [**-l**] | [**-y** [hmac:]keyname:secret] | [**-k** keyfile] ] [**-t** timeout] [**-u** udptimeout] [**-r** udpretries] [**-v**] [**-T**] [**-P**] [**-V**] [ [**-4**] | [**-6**] ] [filename]
++:program:`nsupdate` [**-d**] [**-D**] [**-i**] [**-L** level] [ [**-g**] | [**-o**] | [**-l**] | [**-y** [hmac:]keyname:secret] | [**-k** keyfile] ] [ [**-S**] [**-K** tlskeyfile] [**-E** tlscertfile] [**-A** tlscafile] [**-H** tlshostname] [-O] ] [**-t** timeout] [**-u** udptimeout] [**-r** udpretries] [**-v**] [**-T**] [**-P**] [**-V**] [ [**-4**] | [**-6**] ] [filename]
+ 
+ Description
+ ~~~~~~~~~~~
+@@ -71,6 +71,15 @@ Options
+ 
+    This option sets use of IPv6 only.
+ 
++.. option:: -A tlscafile
++
++   This option specifies the file of the certificate authorities (CA) certificates
++   (in PEM format) in order to verify the remote server TLS certificate when
++   using DNS-over-TLS (DoT), to achieve Strict or Mutual TLS. When used, it will
++   override the certificates from the global certificates store, which are
++   otherwise used by default when :option:`-S` is enabled. This option can not
++   be used in conjuction with :option:`-O`, and it implies :option:`-S`.
++
+ .. option:: -C
+ 
+    Overrides the default `resolv.conf` file. This is only intended for testing.
+@@ -84,10 +93,23 @@ Options
+ 
+    This option sets extra debug mode.
+ 
++.. option:: -E tlscertfile
++
++   This option sets the certificate(s) file for authentication for the
++   DNS-over-TLS (DoT) transport to the remote server. The certificate
++   chain file is expected to be in PEM format. This option implies :option:`-S`,
++   and can only be used with :option:`-K`.
++
+ .. option:: -g
+ 
+    This option enables standard GSS-TSIG mode.
+ 
++.. option:: -H tlshostname
++
++   This option makes :program:`nsupdate` use the provided hostname during remote
++   server TLS certificate verification. Otherwise, the DNS server name
++   is used. This option implies :option:`-S`.
++
+ .. option:: -i
+ 
+    This option forces interactive mode, even when standard input is not a terminal.
+@@ -104,6 +126,13 @@ Options
+    key used to authenticate Dynamic DNS update requests. In this case,
+    the key specified is not an HMAC-MD5 key.
+ 
++.. option:: -K tlskeyfile
++
++   This option sets the key file for authenticated encryption for the
++   DNS-over-TLS (DoT) transport with the remote server. The private key file is
++   expected to be in PEM format. This option implies :option:`-S`, and can only
++   be used with :option:`-E`.
++
+ .. option:: -l
+ 
+    This option sets local-host only mode, which sets the server address to localhost
+@@ -123,6 +152,14 @@ Options
+    This option enables a non-standards-compliant variant of GSS-TSIG
+    used by Windows 2000.
+ 
++.. option:: -O
++
++   This option enables Opportunistic TLS. When used, the remote peer's TLS
++   certificate will not be verified. This option should be used for debugging
++   purposes only, and it is not recommended to use it in production. This
++   option can not be used in conjuction with :option:`-A`, and it implies
++   :option:`-S`.
++
+ .. option:: -p port
+ 
+    This option sets the port to use for connections to a name server. The default is
+@@ -138,6 +175,15 @@ Options
+    This option sets the number of UDP retries. The default is 3. If zero, only one update
+    request is made.
+ 
++.. option:: -S
++
++   This option indicates whether to use DNS-over-TLS (DoT) when querying
++   name servers specified by ``server servername port`` syntax in the input
++   file, and the primary server discovered through a SOA request. When the
++   :option:`-K` and :option:`-E` options are used, then the specified TLS
++   client certificate and private key pair are used for authentication
++   (Mutual TLS). This option implies :option:`-v`.
++
+ .. option:: -t timeout
+ 
+    This option sets the maximum time an update request can take before it is aborted. The
+-- 
+2.47.0
+
diff --git a/bind-9.20-nsupdate-tls.patch b/bind-9.20-nsupdate-tls.patch
new file mode 100644
index 0000000..183ff0b
--- /dev/null
+++ b/bind-9.20-nsupdate-tls.patch
@@ -0,0 +1,1556 @@
+From ec00ba4b215963af5e05892cf2ce1a62222ede46 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
+Date: Mon, 11 Nov 2024 18:09:07 +0100
+Subject: [PATCH 1/3] Backport nsupdate TLS support into 9.18
+
+Attempt to support TLS from nsupdate even in 9.18 release.
+
+Create few dispatch calls with 2 suffix with tls
+
+Keep original functions without changes and add new functions with
+additional tlsctx and transport pointers passed.
+
+Convert xfrin.c:get_create_tlsctx() into a library function
+
+In order to make xfrin.c:get_create_tlsctx() reusable, move the function
+into transport.c, and make changes into its prototype to not use the
+'dns_xfrin_ctx_t' type, thus making it more universal.
+
+This change prepares ground for adding transport support into the
+dispatch manager.
+
+Also, move the typedefs for 'dns_transport_t' and 'dns_transport_list_t'
+from transport.h into types.h.
+
+(cherry picked from commit 881747218ba0ad411f6f1bf361c2c09c805d4aa8)
+
+Update calls inside libdns
+
+Add remaining transport additions to request and dispatch calls. Add
+mctx into dispentry.
+
+Compilable nsupdate
+
+Implement DoT support for nsupdate
+
+Implement DNS-over-TLS support for nsupdate. Use DiG's DoT
+implementation as a model for the newly added features.
+
+(cherry picked from commit 13000c28c2e0ab2754f0f37ab8d6edb8249a1370)
+
+[pemensik] Adapted to previous 9.18 changes.
+Add usage and command line parsing
+---
+ bin/nsupdate/nsupdate.c         | 192 ++++++++++++++++++++----
+ lib/dns/dispatch.c              | 107 ++++++++++++--
+ lib/dns/include/dns/dispatch.h  |  22 +++
+ lib/dns/include/dns/request.h   |  23 +++
+ lib/dns/include/dns/transport.h |  45 +++++-
+ lib/dns/include/dns/types.h     |   2 +
+ lib/dns/request.c               |  63 ++++++--
+ lib/dns/transport.c             | 253 ++++++++++++++++++++++++++++++++
+ lib/dns/xfrin.c                 | 232 +----------------------------
+ 9 files changed, 649 insertions(+), 290 deletions(-)
+
+diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
+index 45ba90fba7b..93c7ea6cb17 100644
+--- a/bin/nsupdate/nsupdate.c
++++ b/bin/nsupdate/nsupdate.c
+@@ -45,6 +45,7 @@
+ #include <isc/stdio.h>
+ #include <isc/string.h>
+ #include <isc/task.h>
++#include <isc/tls.h>
+ #include <isc/types.h>
+ #include <isc/util.h>
+ 
+@@ -67,6 +68,7 @@
+ #include <dns/rdatatype.h>
+ #include <dns/request.h>
+ #include <dns/tkey.h>
++#include <dns/transport.h>
+ #include <dns/tsig.h>
+ 
+ #include <dst/dst.h>
+@@ -118,6 +120,7 @@ static bool memdebugging = false;
+ static bool have_ipv4 = false;
+ static bool have_ipv6 = false;
+ static bool is_dst_up = false;
++static bool use_tls = false;
+ static bool usevc = false;
+ static bool usegsstsig = false;
+ static bool use_win2k_gsstsig = false;
+@@ -145,6 +148,14 @@ static dns_tsigkey_t *tsigkey = NULL;
+ static dst_key_t *sig0key = NULL;
+ static isc_sockaddr_t *servers = NULL;
+ static isc_sockaddr_t *primary_servers = NULL;
++static dns_transport_list_t *transport_list = NULL;
++static dns_transport_t *transport = NULL;
++static isc_tlsctx_cache_t *tls_ctx_cache = NULL;
++static char *tls_hostname = NULL;
++static char *tls_client_key_file = NULL;
++static char *tls_client_cert_file = NULL;
++static char *tls_ca_file = NULL;
++static bool tls_always_verify_remote = true;
+ static bool default_servers = true;
+ static int ns_inuse = 0;
+ static int primary_inuse = 0;
+@@ -790,6 +801,19 @@ set_source_ports(dns_dispatchmgr_t *manager) {
+ 	isc_portset_destroy(gmctx, &v6portset);
+ }
+ 
++static isc_result_t
++create_name(const char *str, char *namedata, size_t len, dns_name_t *name) {
++	isc_buffer_t namesrc, namebuf;
++
++	dns_name_init(name, NULL);
++	isc_buffer_constinit(&namesrc, str, strlen(str));
++	isc_buffer_add(&namesrc, strlen(str));
++	isc_buffer_init(&namebuf, namedata, len);
++
++	return dns_name_fromtext(name, &namesrc, dns_rootname,
++				 DNS_NAME_DOWNCASE, &namebuf);
++}
++
+ static void
+ setup_system(void) {
+ 	isc_result_t result;
+@@ -797,6 +821,8 @@ setup_system(void) {
+ 	isc_sockaddrlist_t *nslist;
+ 	isc_logconfig_t *logconfig = NULL;
+ 	irs_resconf_t *resconf = NULL;
++	dns_name_t tlsname;
++	char namedata[DNS_NAME_FORMATSIZE + 1];
+ 
+ 	ddebug("setup_system()");
+ 
+@@ -942,6 +968,31 @@ setup_system(void) {
+ 		check_result(result, "dns_dispatch_createudp (v4)");
+ 	}
+ 
++	transport_list = dns_transport_list_new(gmctx);
++	isc_tlsctx_cache_create(gmctx, &tls_ctx_cache);
++
++	if (tls_client_key_file == NULL) {
++		result = create_name("tls-non-auth-client", namedata,
++				     sizeof(namedata), &tlsname);
++		check_result(result, "create_name (tls-non-auth-client)");
++		transport = dns_transport_new(&tlsname, DNS_TRANSPORT_TLS,
++					      transport_list);
++		dns_transport_set_tlsname(transport, "tls-non-auth-client");
++	} else {
++		result = create_name("tls-auth-client", namedata,
++				     sizeof(namedata), &tlsname);
++		check_result(result, "create_name (tls-auth-client)");
++		transport = dns_transport_new(&tlsname, DNS_TRANSPORT_TLS,
++					      transport_list);
++		dns_transport_set_tlsname(transport, "tls-auth-client");
++		dns_transport_set_keyfile(transport, tls_client_key_file);
++		dns_transport_set_certfile(transport, tls_client_cert_file);
++	}
++	dns_transport_set_cafile(transport, tls_ca_file);
++	dns_transport_set_remote_hostname(transport, tls_hostname);
++	dns_transport_set_always_verify_remote(transport,
++					       tls_always_verify_remote);
++
+ 	result = dns_requestmgr_create(gmctx, taskmgr, dispatchmgr, dispatchv4,
+ 				       dispatchv6, &requestmgr);
+ 	check_result(result, "dns_requestmgr_create");
+@@ -982,7 +1033,7 @@ version(void) {
+ 	fprintf(stderr, "nsupdate %s\n", PACKAGE_VERSION);
+ }
+ 
+-#define PARSE_ARGS_FMT "46C:dDghilL:Mok:p:Pr:R:t:Tu:vVy:"
++#define PARSE_ARGS_FMT "46A:C:dDE:ghH:iK:lL:MoOk:p:Pr:R:St:Tu:vVy:"
+ 
+ static void
+ pre_parse_args(int argc, char **argv) {
+@@ -1025,7 +1076,9 @@ pre_parse_args(int argc, char **argv) {
+ 			fprintf(stderr, "usage: nsupdate [-CdDi] [-L level] "
+ 					"[-l] [-g | -o | -y keyname:secret "
+ 					"| -k keyfile] [-p port] "
+-					"[-v] [-V] [-P] [-T] [-4 | -6] "
++					"[ -S [-K tlskeyfile] [-E tlscertfile] "
++					"[-A tlscafile] [-H tlshostname] "
++					"[-O] ] [-v] [-V] [-P] [-T] [-4 | -6] "
+ 					"[filename]\n");
+ 			exit(EXIT_FAILURE);
+ 
+@@ -1097,6 +1150,10 @@ parse_args(int argc, char **argv) {
+ 				fatal("can't find IPv6 networking");
+ 			}
+ 			break;
++		case 'A':
++			use_tls = true;
++			tls_ca_file = isc_commandline_argument;
++			break;
+ 		case 'C':
+ 			resolvconf = isc_commandline_argument;
+ 			break;
+@@ -1107,12 +1164,27 @@ parse_args(int argc, char **argv) {
+ 			debugging = true;
+ 			ddebugging = true;
+ 			break;
++		case 'E':
++			use_tls = true;
++			usevc = true;
++			tls_client_cert_file = isc_commandline_argument;
++			break;
++		case 'H':
++			use_tls = true;
++			usevc = true;
++			tls_hostname = isc_commandline_argument;
++			break;
+ 		case 'M':
+ 			break;
+ 		case 'i':
+ 			force_interactive = true;
+ 			interactive = true;
+ 			break;
++		case 'K':
++			use_tls = true;
++			usevc = true;
++			tls_client_key_file = isc_commandline_argument;
++			break;
+ 		case 'l':
+ 			local_only = true;
+ 			break;
+@@ -1145,6 +1217,11 @@ parse_args(int argc, char **argv) {
+ 			usegsstsig = true;
+ 			use_win2k_gsstsig = true;
+ 			break;
++		case 'O':
++			use_tls = true;
++			usevc = true;
++			tls_always_verify_remote = false;
++			break;
+ 		case 'p':
+ 			result = isc_parse_uint16(&dnsport,
+ 						  isc_commandline_argument, 10);
+@@ -1156,6 +1233,10 @@ parse_args(int argc, char **argv) {
+ 				exit(EXIT_FAILURE);
+ 			}
+ 			break;
++		case 'S':
++			use_tls = true;
++			usevc = true;
++			break;
+ 		case 't':
+ 			result = isc_parse_uint32(&timeout,
+ 						  isc_commandline_argument, 10);
+@@ -1218,6 +1299,26 @@ parse_args(int argc, char **argv) {
+ 	}
+ #endif /* HAVE_GSSAPI */
+ 
++	if (use_tls) {
++		usevc = true;
++		if ((tls_client_key_file == NULL) !=
++		    (tls_client_cert_file == NULL))
++		{
++			fprintf(stderr,
++				"%s: cannot specify the -K option without"
++				"the -E option, and vice versa.\n",
++				argv[0]);
++			exit(EXIT_FAILURE);
++		}
++		if (tls_ca_file != NULL && tls_always_verify_remote == false) {
++			fprintf(stderr,
++				"%s: cannot specify the -A option in "
++				"conjuction with the -O option.\n",
++				argv[0]);
++			exit(EXIT_FAILURE);
++		}
++	}
++
+ 	if (argv[isc_commandline_index] != NULL) {
+ 		if (strcmp(argv[isc_commandline_index], "-") == 0) {
+ 			input = stdin;
+@@ -2468,8 +2569,10 @@ static void
+ send_update(dns_name_t *zone, isc_sockaddr_t *primary) {
+ 	isc_result_t result;
+ 	dns_request_t *request = NULL;
+-	unsigned int options = DNS_REQUESTOPT_CASE;
+ 	isc_sockaddr_t *srcaddr;
++	unsigned int options = DNS_REQUESTOPT_CASE;
++	dns_transport_t *req_transport = NULL;
++	isc_tlsctx_cache_t *req_tls_ctx_cache = NULL;
+ 
+ 	ddebug("send_update()");
+ 
+@@ -2477,7 +2580,12 @@ send_update(dns_name_t *zone, isc_sockaddr_t *primary) {
+ 
+ 	if (usevc) {
+ 		options |= DNS_REQUESTOPT_TCP;
++		if (use_tls) {
++			req_transport = transport;
++			req_tls_ctx_cache = tls_ctx_cache;
++		}
+ 	}
++
+ 	if (tsigkey == NULL && sig0key != NULL) {
+ 		result = dns_message_setsig0key(updatemsg, sig0key);
+ 		check_result(result, "dns_message_setsig0key");
+@@ -2500,11 +2608,11 @@ send_update(dns_name_t *zone, isc_sockaddr_t *primary) {
+ 		updatemsg->tsigname->attributes |= DNS_NAMEATTR_NOCOMPRESS;
+ 	}
+ 
+-	result = dns_request_create(requestmgr, updatemsg, srcaddr, primary,
+-				    options, tsigkey, timeout, udp_timeout,
+-				    udp_retries, global_task, update_completed,
+-				    NULL, &request);
+-	check_result(result, "dns_request_create");
++	result = dns_request_create2(
++		requestmgr, updatemsg, srcaddr, primary, req_transport,
++		req_tls_ctx_cache, options, tsigkey, timeout, udp_timeout,
++		udp_retries, global_task, update_completed, NULL, &request);
++	check_result(result, "dns_request_create2");
+ 
+ 	if (debugging) {
+ 		show_message(stdout, updatemsg, "Outgoing update query:");
+@@ -2594,7 +2702,9 @@ recvsoa(isc_task_t *task, isc_event_t *event) {
+ 	result = dns_request_getresponse(request, rcvmsg,
+ 					 DNS_MESSAGEPARSE_PRESERVEORDER);
+ 	if (result == DNS_R_TSIGERRORSET && servers != NULL) {
+-		unsigned int options = 0;
++		unsigned int options = DNS_REQUESTOPT_CASE;
++		dns_transport_t *req_transport = NULL;
++		isc_tlsctx_cache_t *req_tls_ctx_cache = NULL;
+ 
+ 		dns_message_detach(&rcvmsg);
+ 		ddebug("Destroying request [%p]", request);
+@@ -2605,8 +2715,12 @@ recvsoa(isc_task_t *task, isc_event_t *event) {
+ 		dns_message_renderreset(soaquery);
+ 		ddebug("retrying soa request without TSIG");
+ 
+-		if (!default_servers && usevc) {
++		if (usevc) {
+ 			options |= DNS_REQUESTOPT_TCP;
++			if (!default_servers && use_tls) {
++				req_transport = transport;
++				req_tls_ctx_cache = tls_ctx_cache;
++			}
+ 		}
+ 
+ 		if (isc_sockaddr_pf(addr) == AF_INET6) {
+@@ -2615,10 +2729,10 @@ recvsoa(isc_task_t *task, isc_event_t *event) {
+ 			srcaddr = localaddr4;
+ 		}
+ 
+-		result = dns_request_create(requestmgr, soaquery, srcaddr, addr,
+-					    options, NULL, timeout, udp_timeout,
+-					    udp_retries, global_task, recvsoa,
+-					    reqinfo, &request);
++		result = dns_request_create2(
++			requestmgr, soaquery, srcaddr, addr, req_transport,
++			req_tls_ctx_cache, options, NULL, timeout, udp_timeout,
++			udp_retries, global_task, recvsoa, reqinfo, &request);
+ 		check_result(result, "dns_request_create");
+ 		requests++;
+ 		return;
+@@ -2831,10 +2945,16 @@ sendrequest(isc_sockaddr_t *destaddr, dns_message_t *msg,
+ 	isc_result_t result;
+ 	nsu_requestinfo_t *reqinfo;
+ 	isc_sockaddr_t *srcaddr;
+-	unsigned int options = 0;
++	unsigned int options = DNS_REQUESTOPT_CASE;
++	dns_transport_t *req_transport = NULL;
++	isc_tlsctx_cache_t *req_tls_ctx_cache = NULL;
+ 
+-	if (!default_servers && usevc) {
++	if (usevc) {
+ 		options |= DNS_REQUESTOPT_TCP;
++		if (!default_servers && use_tls) {
++			req_transport = transport;
++			req_tls_ctx_cache = tls_ctx_cache;
++		}
+ 	}
+ 
+ 	reqinfo = isc_mem_get(gmctx, sizeof(nsu_requestinfo_t));
+@@ -2847,11 +2967,12 @@ sendrequest(isc_sockaddr_t *destaddr, dns_message_t *msg,
+ 		srcaddr = localaddr4;
+ 	}
+ 
+-	result = dns_request_create(requestmgr, msg, srcaddr, destaddr, options,
+-				    default_servers ? NULL : tsigkey, timeout,
+-				    udp_timeout, udp_retries, global_task,
+-				    recvsoa, reqinfo, request);
+-	check_result(result, "dns_request_create");
++	result = dns_request_create2(requestmgr, msg, srcaddr, destaddr,
++				     req_transport, req_tls_ctx_cache, options,
++				     default_servers ? NULL : tsigkey, timeout,
++				     udp_timeout, udp_retries, global_task,
++				     recvsoa, reqinfo, request);
++	check_result(result, "dns_request_create2");
+ 	requests++;
+ }
+ 
+@@ -2934,7 +3055,6 @@ start_gssrequest(dns_name_t *primary) {
+ 	char namestr[DNS_NAME_FORMATSIZE];
+ 	char mykeystr[DNS_NAME_FORMATSIZE];
+ 	char *err_message = NULL;
+-
+ 	debug("start_gssrequest");
+ 	usevc = true;
+ 
+@@ -3030,8 +3150,15 @@ send_gssrequest(isc_sockaddr_t *destaddr, dns_message_t *msg,
+ 		dns_request_t **request, gss_ctx_id_t context) {
+ 	isc_result_t result;
+ 	nsu_gssinfo_t *reqinfo;
+-	unsigned int options = 0;
+ 	isc_sockaddr_t *srcaddr;
++	unsigned int options = DNS_REQUESTOPT_CASE | DNS_REQUESTOPT_TCP;
++	dns_transport_t *req_transport = NULL;
++	isc_tlsctx_cache_t *req_tls_ctx_cache = NULL;
++
++	if (!default_servers && use_tls) {
++		req_transport = transport;
++		req_tls_ctx_cache = tls_ctx_cache;
++	}
+ 
+ 	debug("send_gssrequest");
+ 	REQUIRE(destaddr != NULL);
+@@ -3041,18 +3168,17 @@ send_gssrequest(isc_sockaddr_t *destaddr, dns_message_t *msg,
+ 	reqinfo->addr = destaddr;
+ 	reqinfo->context = context;
+ 
+-	options |= DNS_REQUESTOPT_TCP;
+-
+ 	if (isc_sockaddr_pf(destaddr) == AF_INET6) {
+ 		srcaddr = localaddr6;
+ 	} else {
+ 		srcaddr = localaddr4;
+ 	}
+ 
+-	result = dns_request_create(requestmgr, msg, srcaddr, destaddr, options,
+-				    tsigkey, timeout, udp_timeout, udp_retries,
+-				    global_task, recvgss, reqinfo, request);
+-	check_result(result, "dns_request_create");
++	result = dns_request_create2(requestmgr, msg, srcaddr, destaddr,
++				     req_transport, req_tls_ctx_cache, options,
++				     tsigkey, timeout, udp_timeout, udp_retries,
++				     global_task, recvgss, reqinfo, request);
++	check_result(result, "dns_request_create2");
+ 	if (debugging) {
+ 		show_message(stdout, msg, "Outgoing update query:");
+ 	}
+@@ -3321,6 +3447,14 @@ static void
+ cleanup(void) {
+ 	ddebug("cleanup()");
+ 
++	if (tls_ctx_cache != NULL) {
++		isc_tlsctx_cache_detach(&tls_ctx_cache);
++	}
++
++	if (transport_list != NULL) {
++		dns_transport_list_detach(&transport_list);
++	}
++
+ 	LOCK(&answer_lock);
+ 	if (answer != NULL) {
+ 		dns_message_detach(&answer);
+diff --git a/lib/dns/dispatch.c b/lib/dns/dispatch.c
+index d737363fea4..44a2896cb03 100644
+--- a/lib/dns/dispatch.c
++++ b/lib/dns/dispatch.c
+@@ -30,6 +30,7 @@
+ #include <isc/stats.h>
+ #include <isc/string.h>
+ #include <isc/time.h>
++#include <isc/tls.h>
+ #include <isc/util.h>
+ 
+ #include <dns/acl.h>
+@@ -83,6 +84,10 @@ struct dns_dispentry {
+ 	dns_dispatch_t *disp;
+ 	isc_nmhandle_t *handle; /*%< netmgr handle for UDP connection */
+ 	dns_dispatchstate_t state;
++	/* TLS support for nsupdate. */
++	isc_mem_t *mctx;
++	dns_transport_t *transport;
++	isc_tlsctx_cache_t *tlsctx_cache;
+ 	unsigned int bucket;
+ 	unsigned int retries;
+ 	unsigned int timeout;
+@@ -107,11 +112,12 @@ struct dns_dispatch {
+ 	/* Unlocked. */
+ 	unsigned int magic; /*%< magic */
+ 	int tid;
+-	dns_dispatchmgr_t *mgr; /*%< dispatch manager */
+-	isc_nmhandle_t *handle; /*%< netmgr handle for TCP connection */
+-	isc_sockaddr_t local;	/*%< local address */
+-	in_port_t localport;	/*%< local UDP port */
+-	isc_sockaddr_t peer;	/*%< peer address (TCP) */
++	dns_dispatchmgr_t *mgr;	    /*%< dispatch manager */
++	isc_nmhandle_t *handle;	    /*%< netmgr handle for TCP connection */
++	isc_sockaddr_t local;	    /*%< local address */
++	in_port_t localport;	    /*%< local UDP port */
++	isc_sockaddr_t peer;	    /*%< peer address (TCP) */
++	dns_transport_t *transport; /*%< TCP transport parameters */
+ 
+ 	/*% Locked by mgr->lock. */
+ 	ISC_LINK(dns_dispatch_t) link;
+@@ -119,6 +125,7 @@ struct dns_dispatch {
+ 	/* Locked by "lock". */
+ 	isc_mutex_t lock; /*%< locks all below */
+ 	isc_socktype_t socktype;
++	dns_dispatchopt_t options;
+ 	dns_dispatchstate_t state;
+ 	isc_refcount_t references;
+ 
+@@ -220,13 +227,27 @@ udp_dispatch_getnext(dns_dispentry_t *resp, int32_t timeout);
+ 
+ static const char *
+ socktype2str(dns_dispentry_t *resp) {
++	dns_transport_type_t transport_type = DNS_TRANSPORT_UDP;
+ 	dns_dispatch_t *disp = resp->disp;
+ 
+-	switch (disp->socktype) {
+-	case isc_socktype_udp:
++	if (disp->socktype == isc_socktype_tcp) {
++		if (resp->transport != NULL) {
++			transport_type =
++				dns_transport_get_type(resp->transport);
++		} else {
++			transport_type = DNS_TRANSPORT_TCP;
++		}
++	}
++
++	switch (transport_type) {
++	case DNS_TRANSPORT_UDP:
+ 		return ("UDP");
+-	case isc_socktype_tcp:
++	case DNS_TRANSPORT_TCP:
+ 		return ("TCP");
++	case DNS_TRANSPORT_TLS:
++		return "TLS";
++	case DNS_TRANSPORT_HTTP:
++		return "HTTP";
+ 	default:
+ 		return ("<unexpected>");
+ 	}
+@@ -1161,6 +1182,15 @@ dispatch_allocate(dns_dispatchmgr_t *mgr, isc_socktype_t type,
+ isc_result_t
+ dns_dispatch_createtcp(dns_dispatchmgr_t *mgr, const isc_sockaddr_t *localaddr,
+ 		       const isc_sockaddr_t *destaddr, dns_dispatch_t **dispp) {
++	return dns_dispatch_createtcp2(mgr, localaddr, destaddr, NULL, 0,
++				       dispp);
++}
++
++isc_result_t
++dns_dispatch_createtcp2(dns_dispatchmgr_t *mgr, const isc_sockaddr_t *localaddr,
++			const isc_sockaddr_t *destaddr,
++			dns_transport_t *transport, dns_dispatchopt_t options,
++			dns_dispatch_t **dispp) {
+ 	dns_dispatch_t *disp = NULL;
+ 
+ 	REQUIRE(VALID_DISPATCHMGR(mgr));
+@@ -1170,7 +1200,11 @@ dns_dispatch_createtcp(dns_dispatchmgr_t *mgr, const isc_sockaddr_t *localaddr,
+ 
+ 	dispatch_allocate(mgr, isc_socktype_tcp, &disp);
+ 
++	disp->options = options;
+ 	disp->peer = *destaddr;
++	if (transport != NULL) {
++		dns_transport_attach(transport, &disp->transport);
++	}
+ 
+ 	if (localaddr != NULL) {
+ 		disp->local = *localaddr;
+@@ -1185,6 +1219,7 @@ dns_dispatch_createtcp(dns_dispatchmgr_t *mgr, const isc_sockaddr_t *localaddr,
+ 	 * Append it to the dispatcher list.
+ 	 */
+ 
++	/* TODO: DNS_DISPATCHOPT_UNSHARED is not backported */
+ 	/* FIXME: There should be a lookup hashtable here */
+ 	ISC_LIST_APPEND(mgr->list, disp, link);
+ 	UNLOCK(&mgr->lock);
+@@ -1208,6 +1243,13 @@ dns_dispatch_createtcp(dns_dispatchmgr_t *mgr, const isc_sockaddr_t *localaddr,
+ isc_result_t
+ dns_dispatch_gettcp(dns_dispatchmgr_t *mgr, const isc_sockaddr_t *destaddr,
+ 		    const isc_sockaddr_t *localaddr, dns_dispatch_t **dispp) {
++	return dns_dispatch_gettcp2(mgr, destaddr, localaddr, NULL, dispp);
++}
++
++isc_result_t
++dns_dispatch_gettcp2(dns_dispatchmgr_t *mgr, const isc_sockaddr_t *destaddr,
++		     const isc_sockaddr_t *localaddr,
++		     dns_transport_t *transport, dns_dispatch_t **dispp) {
+ 	dns_dispatch_t *disp_connected = NULL;
+ 	dns_dispatch_t *disp_fallback = NULL;
+ 	isc_result_t result = ISC_R_NOTFOUND;
+@@ -1248,8 +1290,10 @@ dns_dispatch_gettcp(dns_dispatchmgr_t *mgr, const isc_sockaddr_t *destaddr,
+ 		if (disp->socktype != isc_socktype_tcp ||
+ 		    !isc_sockaddr_equal(destaddr, &peeraddr) ||
+ 		    (localaddr != NULL &&
+-		     !isc_sockaddr_eqaddr(localaddr, &sockname)))
++		     !isc_sockaddr_eqaddr(localaddr, &sockname)) ||
++		    (transport != disp->transport))
+ 		{
++			// dispatch_match alternative
+ 			UNLOCK(&disp->lock);
+ 			continue;
+ 		}
+@@ -1426,7 +1470,18 @@ dns_dispatch_add(dns_dispatch_t *disp, unsigned int options,
+ 		 unsigned int timeout, const isc_sockaddr_t *dest,
+ 		 dispatch_cb_t connected, dispatch_cb_t sent,
+ 		 dispatch_cb_t response, void *arg, dns_messageid_t *idp,
+-		 dns_dispentry_t **respp) {
++		 dns_dispentry_t **resp) {
++	return dns_dispatch_add2(disp, options, timeout, dest, NULL, NULL,
++				 connected, sent, response, arg, idp, resp);
++}
++
++isc_result_t
++dns_dispatch_add2(dns_dispatch_t *disp, unsigned int options,
++		  unsigned int timeout, const isc_sockaddr_t *dest,
++		  dns_transport_t *transport, isc_tlsctx_cache_t *tlsctx_cache,
++		  dispatch_cb_t connected, dispatch_cb_t sent,
++		  dispatch_cb_t response, void *arg, dns_messageid_t *idp,
++		  dns_dispentry_t **respp) {
+ 	dns_dispentry_t *resp = NULL;
+ 	dns_qid_t *qid = NULL;
+ 	in_port_t localport;
+@@ -1444,6 +1499,7 @@ dns_dispatch_add(dns_dispatch_t *disp, unsigned int options,
+ 	REQUIRE(connected != NULL);
+ 	REQUIRE(response != NULL);
+ 	REQUIRE(sent != NULL);
++	REQUIRE(disp->transport == transport);
+ 
+ 	LOCK(&disp->lock);
+ 
+@@ -1471,6 +1527,7 @@ dns_dispatch_add(dns_dispatch_t *disp, unsigned int options,
+ 		.rlink = ISC_LINK_INITIALIZER,
+ 		.magic = RESPONSE_MAGIC,
+ 	};
++	isc_mem_attach(disp->mgr->mctx, &resp->mctx);
+ 
+ #if DNS_DISPATCH_TRACE
+ 	fprintf(stderr, "dns_dispentry__init:%s:%s:%d:%p->references = 1\n",
+@@ -1530,6 +1587,14 @@ dns_dispatch_add(dns_dispatch_t *disp, unsigned int options,
+ 		return (ISC_R_NOMORE);
+ 	}
+ 
++	if (transport != NULL) {
++		dns_transport_attach(transport, &resp->transport);
++	}
++
++	if (tlsctx_cache != NULL) {
++		isc_tlsctx_cache_attach(tlsctx_cache, &resp->tlsctx_cache);
++	}
++
+ 	dns_dispatch_attach(disp, &resp->disp); /* DISPATCH001 */
+ 
+ 	disp->requests++;
+@@ -1779,6 +1844,7 @@ dns_dispatch_done(dns_dispentry_t **respp) {
+ 	*respp = NULL;
+ 
+ 	dispentry_cancel(resp, ISC_R_CANCELED);
++	isc_mem_detach(&resp->mctx); ///< FIXME: is this ok?
+ 	dns_dispentry_detach(&resp); /* DISPENTRY000 */
+ }
+ 
+@@ -1970,6 +2036,27 @@ udp_dispatch_connect(dns_dispatch_t *disp, dns_dispentry_t *resp) {
+ 
+ static isc_result_t
+ tcp_dispatch_connect(dns_dispatch_t *disp, dns_dispentry_t *resp) {
++	dns_transport_type_t transport_type = DNS_TRANSPORT_TCP;
++	isc_tlsctx_t *tlsctx = NULL;
++	isc_tlsctx_client_session_cache_t *sess_cache = NULL;
++
++	if (resp->transport != NULL) {
++		transport_type = dns_transport_get_type(resp->transport);
++	}
++
++	if (transport_type == DNS_TRANSPORT_TLS) {
++		isc_result_t result;
++
++		result = dns_transport_get_tlsctx(
++			resp->transport, &resp->peer, resp->tlsctx_cache,
++			resp->mctx, &tlsctx, &sess_cache);
++
++		if (result != ISC_R_SUCCESS) {
++			return result;
++		}
++		INSIST(tlsctx != NULL);
++	}
++
+ 	/* Check whether the dispatch is already connecting or connected. */
+ 	LOCK(&disp->lock);
+ 	switch (disp->state) {
+diff --git a/lib/dns/include/dns/dispatch.h b/lib/dns/include/dns/dispatch.h
+index ad377f078ed..cfdc37481ce 100644
+--- a/lib/dns/include/dns/dispatch.h
++++ b/lib/dns/include/dns/dispatch.h
+@@ -56,6 +56,7 @@
+ #include <isc/refcount.h>
+ #include <isc/types.h>
+ 
++#include <dns/transport.h>
+ #include <dns/types.h>
+ 
+ /* Add -DDNS_DISPATCH_TRACE=1 to CFLAGS for detailed reference tracing */
+@@ -74,6 +75,11 @@ struct dns_dispatchset {
+ 	isc_mutex_t	 lock;
+ };
+ 
++typedef enum dns_dispatchopt {
++	DNS_DISPATCHOPT_FIXEDID = 1 << 0,
++	DNS_DISPATCHOPT_UNSHARED = 1 << 1, /* Don't share this connection */
++} dns_dispatchopt_t;
++
+ /*
+  */
+ #define DNS_DISPATCHOPT_FIXEDID 0x00000001U
+@@ -199,6 +205,11 @@ dns_dispatch_createtcp(dns_dispatchmgr_t *mgr, const isc_sockaddr_t *localaddr,
+  *
+  *\li	Anything else	-- failure.
+  */
++isc_result_t
++dns_dispatch_createtcp2(dns_dispatchmgr_t *mgr, const isc_sockaddr_t *localaddr,
++			const isc_sockaddr_t *destaddr,
++			dns_transport_t *transport, dns_dispatchopt_t options,
++			dns_dispatch_t **dispp);
+ 
+ #if DNS_DISPATCH_TRACE
+ #define dns_dispatch_ref(ptr) \
+@@ -258,6 +269,10 @@ dns_dispatch_gettcp(dns_dispatchmgr_t *mgr, const isc_sockaddr_t *destaddr,
+ /*
+  * Attempt to connect to a existing TCP connection.
+  */
++isc_result_t
++dns_dispatch_gettcp2(dns_dispatchmgr_t *mgr, const isc_sockaddr_t *destaddr,
++		     const isc_sockaddr_t *localaddr,
++		     dns_transport_t *transport, dns_dispatch_t **dispp);
+ 
+ typedef void (*dispatch_cb_t)(isc_result_t eresult, isc_region_t *region,
+ 			      void *cbarg);
+@@ -268,6 +283,13 @@ dns_dispatch_add(dns_dispatch_t *disp, unsigned int options,
+ 		 dispatch_cb_t connected, dispatch_cb_t sent,
+ 		 dispatch_cb_t response, void *arg, dns_messageid_t *idp,
+ 		 dns_dispentry_t **resp);
++isc_result_t
++dns_dispatch_add2(dns_dispatch_t *disp, unsigned int options,
++		  unsigned int timeout, const isc_sockaddr_t *dest,
++		  dns_transport_t *transport, isc_tlsctx_cache_t *tlsctx_cache,
++		  dispatch_cb_t connected, dispatch_cb_t sent,
++		  dispatch_cb_t response, void *arg, dns_messageid_t *idp,
++		  dns_dispentry_t **respp);
+ /*%<
+  * Add a response entry for this dispatch.
+  *
+diff --git a/lib/dns/include/dns/request.h b/lib/dns/include/dns/request.h
+index d00574f9827..17bcbf68c3b 100644
+--- a/lib/dns/include/dns/request.h
++++ b/lib/dns/include/dns/request.h
+@@ -44,6 +44,7 @@
+ #define DNS_REQUESTOPT_TCP     0x00000001U
+ #define DNS_REQUESTOPT_CASE    0x00000002U
+ #define DNS_REQUESTOPT_FIXEDID 0x00000004U
++#define DNS_REQUESTOPT_LARGE   0x00000008U
+ 
+ typedef struct dns_requestevent {
+ 	ISC_EVENT_COMMON(struct dns_requestevent);
+@@ -161,6 +162,17 @@ dns_request_create(dns_requestmgr_t *requestmgr, dns_message_t *message,
+ 		   unsigned int udptimeout, unsigned int udpretries,
+ 		   isc_task_t *task, isc_taskaction_t action, void *arg,
+ 		   dns_request_t **requestp);
++isc_result_t
++dns_request_create2(dns_requestmgr_t *requestmgr, dns_message_t *message,
++		   const isc_sockaddr_t *srcaddr,
++		   const isc_sockaddr_t *destaddr,
++		   dns_transport_t *req_transport,
++		   isc_tlsctx_cache_t *req_tls_ctx_cache,
++		   unsigned int options,
++		   dns_tsigkey_t *key, unsigned int timeout,
++		   unsigned int udptimeout, unsigned int udpretries,
++		   isc_task_t *task, isc_taskaction_t action, void *arg,
++		   dns_request_t **requestp);
+ /*%<
+  * Create and send a request.
+  *
+@@ -204,6 +216,17 @@ dns_request_createraw(dns_requestmgr_t *requestmgr, isc_buffer_t *msgbuf,
+ 		      unsigned int udpretries, isc_task_t *task,
+ 		      isc_taskaction_t action, void *arg,
+ 		      dns_request_t **requestp);
++isc_result_t
++dns_request_createraw2(dns_requestmgr_t *requestmgr, isc_buffer_t *msgbuf,
++		      const isc_sockaddr_t *srcaddr,
++		      const isc_sockaddr_t *destaddr,
++		      dns_transport_t *transport,
++		      isc_tlsctx_cache_t *tlsctx_cache,
++		      unsigned int options,
++		      unsigned int timeout, unsigned int udptimeout,
++		      unsigned int udpretries, isc_task_t *task,
++		      isc_taskaction_t action, void *arg,
++		      dns_request_t **requestp);
+ /*!<
+  * \brief Create and send a request.
+  *
+diff --git a/lib/dns/include/dns/transport.h b/lib/dns/include/dns/transport.h
+index e74ccd7f970..e6499a97e73 100644
+--- a/lib/dns/include/dns/transport.h
++++ b/lib/dns/include/dns/transport.h
+@@ -13,7 +13,9 @@
+ 
+ #pragma once
+ 
+-#include <dns/name.h>
++#include <isc/tls.h>
++
++#include <dns/types.h>
+ 
+ typedef enum {
+ 	DNS_TRANSPORT_NONE = 0,
+@@ -29,9 +31,6 @@ typedef enum {
+ 	DNS_HTTP_POST = 1,
+ } dns_http_mode_t;
+ 
+-typedef struct dns_transport	  dns_transport_t;
+-typedef struct dns_transport_list dns_transport_list_t;
+-
+ dns_transport_t *
+ dns_transport_new(const dns_name_t *name, dns_transport_type_t type,
+ 		  dns_transport_list_t *list);
+@@ -63,15 +62,44 @@ dns_transport_get_tls_versions(const dns_transport_t *transport);
+ bool
+ dns_transport_get_prefer_server_ciphers(const dns_transport_t *transport,
+ 					bool		      *preferp);
++bool
++dns_transport_get_always_verify_remote(dns_transport_t *transport);
+ /*%<
+  * Getter functions: return the type, cert file, key file, CA file,
+- * hostname, HTTP endpoint, or HTTP mode (GET or POST) for 'transport'.
++ * hostname, HTTP endpoint, HTTP mode (GET or POST), ciphers, TLS name,
++ * TLS version, server ciphers preference mode, and always enabling
++ * authentication mode for 'transport'.
+  *
+  * dns_transport_get_prefer_server_ciphers() returns 'true' is value
+  * was set, 'false' otherwise. The actual value is returned via
+  * 'preferp' pointer.
+  */
+ 
++isc_result_t
++dns_transport_get_tlsctx(dns_transport_t *transport, const isc_sockaddr_t *peer,
++			 isc_tlsctx_cache_t *tlsctx_cache, isc_mem_t *mctx,
++			 isc_tlsctx_t			   **pctx,
++			 isc_tlsctx_client_session_cache_t **psess_cache);
++/*%<
++ * Get the transport's TLS Context and the TLS Client Session Cache associated
++ * with it.
++ *
++ * When neither the TLS hostname, nor the TLS certificates authorities (CA)
++ * file are set for the 'transport', then Opportunistic TLS (no authentication
++ * of the remote peer) will be used, unless the 'always_verify_remote' mode is
++ * enabled on the 'transport', in which case the remote peer will be
++ * authenticated by its IP address using the system's default certificates
++ * authorities store.
++ *
++ * Requires:
++ *\li	'transport' is a valid, 'DNS_TRANSPORT_TLS' type transport.
++ *\li	'peer' is not NULL.
++ *\li	'tlsctx_cache' is not NULL.
++ *\li	'mctx' is not NULL.
++ *\li	'pctx' is not NULL and '*pctx' is NULL.
++ *\li	'psess_cache' is not NULL and '*psess_cache' is NULL.
++ */
++
+ void
+ dns_transport_set_certfile(dns_transport_t *transport, const char *certfile);
+ void
+@@ -96,9 +124,14 @@ dns_transport_set_tls_versions(dns_transport_t *transport,
+ void
+ dns_transport_set_prefer_server_ciphers(dns_transport_t *transport,
+ 					const bool	 prefer);
++void
++dns_transport_set_always_verify_remote(dns_transport_t *transport,
++				       const bool	always_verify_remote);
+ /*%<
+  * Setter functions: set the type, cert file, key file, CA file,
+- * hostname, HTTP endpoint, or HTTP mode (GET or POST) for 'transport'.
++ * hostname, HTTP endpoint, HTTP mode (GET or POST), ciphers, TLS name,
++ * TLS version, server ciphers preference mode, and always enabling
++ * authentication mode for 'transport'.
+  *
+  * Requires:
+  *\li	'transport' is valid.
+diff --git a/lib/dns/include/dns/types.h b/lib/dns/include/dns/types.h
+index 6465962bd41..f0aaa24e936 100644
+--- a/lib/dns/include/dns/types.h
++++ b/lib/dns/include/dns/types.h
+@@ -141,6 +141,8 @@ typedef struct dns_ssutable	     dns_ssutable_t;
+ typedef struct dns_stats	     dns_stats_t;
+ typedef uint32_t		     dns_rdatastatstype_t;
+ typedef struct dns_tkeyctx	     dns_tkeyctx_t;
++typedef struct dns_transport	     dns_transport_t;
++typedef struct dns_transport_list    dns_transport_list_t;
+ typedef uint16_t		     dns_trust_t;
+ typedef struct dns_tsec		     dns_tsec_t;
+ typedef struct dns_tsig_keyring	     dns_tsig_keyring_t;
+diff --git a/lib/dns/request.c b/lib/dns/request.c
+index fb17ed2262e..463a7ca6d63 100644
+--- a/lib/dns/request.c
++++ b/lib/dns/request.c
+@@ -399,12 +399,12 @@ isblackholed(dns_dispatchmgr_t *dispatchmgr, const isc_sockaddr_t *destaddr) {
+ static isc_result_t
+ tcp_dispatch(bool newtcp, dns_requestmgr_t *requestmgr,
+ 	     const isc_sockaddr_t *srcaddr, const isc_sockaddr_t *destaddr,
+-	     dns_dispatch_t **dispatchp) {
++	     dns_transport_t *transport, dns_dispatch_t **dispatchp) {
+ 	isc_result_t result;
+ 
+ 	if (!newtcp) {
+-		result = dns_dispatch_gettcp(requestmgr->dispatchmgr, destaddr,
+-					     srcaddr, dispatchp);
++		result = dns_dispatch_gettcp2(requestmgr->dispatchmgr, destaddr,
++					      srcaddr, transport, dispatchp);
+ 		if (result == ISC_R_SUCCESS) {
+ 			char peer[ISC_SOCKADDR_FORMATSIZE];
+ 
+@@ -415,8 +415,8 @@ tcp_dispatch(bool newtcp, dns_requestmgr_t *requestmgr,
+ 		}
+ 	}
+ 
+-	result = dns_dispatch_createtcp(requestmgr->dispatchmgr, srcaddr,
+-					destaddr, dispatchp);
++	result = dns_dispatch_createtcp2(requestmgr->dispatchmgr, srcaddr,
++					 destaddr, transport, 0, dispatchp);
+ 	return (result);
+ }
+ 
+@@ -452,12 +452,12 @@ udp_dispatch(dns_requestmgr_t *requestmgr, const isc_sockaddr_t *srcaddr,
+ static isc_result_t
+ get_dispatch(bool tcp, bool newtcp, dns_requestmgr_t *requestmgr,
+ 	     const isc_sockaddr_t *srcaddr, const isc_sockaddr_t *destaddr,
+-	     dns_dispatch_t **dispatchp) {
++	     dns_transport_t *transport, dns_dispatch_t **dispatchp) {
+ 	isc_result_t result;
+ 
+ 	if (tcp) {
+ 		result = tcp_dispatch(newtcp, requestmgr, srcaddr, destaddr,
+-				      dispatchp);
++				      transport, dispatchp);
+ 	} else {
+ 		result = udp_dispatch(requestmgr, srcaddr, destaddr, dispatchp);
+ 	}
+@@ -472,6 +472,21 @@ dns_request_createraw(dns_requestmgr_t *requestmgr, isc_buffer_t *msgbuf,
+ 		      unsigned int udpretries, isc_task_t *task,
+ 		      isc_taskaction_t action, void *arg,
+ 		      dns_request_t **requestp) {
++	return dns_request_createraw2(requestmgr, msgbuf, srcaddr, destaddr,
++				      NULL, NULL, options, timeout, udptimeout,
++				      udpretries, task, action, arg, requestp);
++}
++
++isc_result_t
++dns_request_createraw2(dns_requestmgr_t *requestmgr, isc_buffer_t *msgbuf,
++		       const isc_sockaddr_t *srcaddr,
++		       const isc_sockaddr_t *destaddr,
++		       dns_transport_t *transport,
++		       isc_tlsctx_cache_t *tlsctx_cache, unsigned int options,
++		       unsigned int timeout, unsigned int udptimeout,
++		       unsigned int udpretries, isc_task_t *task,
++		       isc_taskaction_t action, void *arg,
++		       dns_request_t **requestp) {
+ 	dns_request_t *request = NULL;
+ 	isc_result_t result;
+ 	isc_mem_t *mctx = NULL;
+@@ -553,7 +568,7 @@ dns_request_createraw(dns_requestmgr_t *requestmgr, isc_buffer_t *msgbuf,
+ again:
+ 
+ 	result = get_dispatch(tcp, newtcp, requestmgr, srcaddr, destaddr,
+-			      &request->dispatch);
++			      transport, &request->dispatch);
+ 	if (result != ISC_R_SUCCESS) {
+ 		goto detach;
+ 	}
+@@ -563,10 +578,10 @@ again:
+ 		dispopt |= DNS_DISPATCHOPT_FIXEDID;
+ 	}
+ 
+-	result = dns_dispatch_add(request->dispatch, dispopt, request->timeout,
+-				  destaddr, req_connected, req_senddone,
+-				  req_response, request, &id,
+-				  &request->dispentry);
++	result = dns_dispatch_add2(request->dispatch, dispopt, request->timeout,
++				   destaddr, transport, tlsctx_cache,
++				   req_connected, req_senddone, req_response,
++				   request, &id, &request->dispentry);
+ 	if (result != ISC_R_SUCCESS) {
+ 		if ((options & DNS_REQUESTOPT_FIXEDID) != 0 && !newtcp) {
+ 			newtcp = true;
+@@ -630,6 +645,21 @@ dns_request_create(dns_requestmgr_t *requestmgr, dns_message_t *message,
+ 		   unsigned int udptimeout, unsigned int udpretries,
+ 		   isc_task_t *task, isc_taskaction_t action, void *arg,
+ 		   dns_request_t **requestp) {
++	return dns_request_create2(requestmgr, message, srcaddr, destaddr, NULL,
++				   NULL, options, key, timeout, udptimeout,
++				   udpretries, task, action, arg, requestp);
++}
++
++isc_result_t
++dns_request_create2(dns_requestmgr_t *requestmgr, dns_message_t *message,
++		    const isc_sockaddr_t *srcaddr,
++		    const isc_sockaddr_t *destaddr,
++		    dns_transport_t *req_transport,
++		    isc_tlsctx_cache_t *req_tls_ctx_cache, unsigned int options,
++		    dns_tsigkey_t *key, unsigned int timeout,
++		    unsigned int udptimeout, unsigned int udpretries,
++		    isc_task_t *task, isc_taskaction_t action, void *arg,
++		    dns_request_t **requestp) {
+ 	dns_request_t *request = NULL;
+ 	isc_result_t result;
+ 	isc_mem_t *mctx = NULL;
+@@ -707,14 +737,15 @@ dns_request_create(dns_requestmgr_t *requestmgr, dns_message_t *message,
+ 
+ again:
+ 	result = get_dispatch(tcp, false, requestmgr, srcaddr, destaddr,
+-			      &request->dispatch);
++			      req_transport, &request->dispatch);
+ 	if (result != ISC_R_SUCCESS) {
+ 		goto detach;
+ 	}
+ 
+-	result = dns_dispatch_add(
+-		request->dispatch, 0, request->timeout, destaddr, req_connected,
+-		req_senddone, req_response, request, &id, &request->dispentry);
++	result = dns_dispatch_add2(request->dispatch, 0, request->timeout,
++				   destaddr, req_transport, req_tls_ctx_cache,
++				   req_connected, req_senddone, req_response,
++				   request, &id, &request->dispentry);
+ 	if (result != ISC_R_SUCCESS) {
+ 		goto detach;
+ 	}
+diff --git a/lib/dns/transport.c b/lib/dns/transport.c
+index ae1ab7415b1..59eba1db252 100644
+--- a/lib/dns/transport.c
++++ b/lib/dns/transport.c
+@@ -15,9 +15,11 @@
+ 
+ #include <isc/list.h>
+ #include <isc/mem.h>
++#include <isc/netaddr.h>
+ #include <isc/refcount.h>
+ #include <isc/result.h>
+ #include <isc/rwlock.h>
++#include <isc/sockaddr.h>
+ #include <isc/util.h>
+ 
+ #include <dns/name.h>
+@@ -54,6 +56,7 @@ struct dns_transport {
+ 		char *ciphers;
+ 		uint32_t protocol_versions;
+ 		ternary_t prefer_server_ciphers;
++		bool always_verify_remote;
+ 	} tls;
+ 	struct {
+ 		char *endpoint;
+@@ -332,6 +335,256 @@ dns_transport_get_prefer_server_ciphers(const dns_transport_t *transport,
+ 	return false;
+ }
+ 
++void
++dns_transport_set_always_verify_remote(dns_transport_t *transport,
++				       const bool always_verify_remote) {
++	REQUIRE(VALID_TRANSPORT(transport));
++	REQUIRE(transport->type == DNS_TRANSPORT_TLS ||
++		transport->type == DNS_TRANSPORT_HTTP);
++
++	transport->tls.always_verify_remote = always_verify_remote;
++}
++
++bool
++dns_transport_get_always_verify_remote(dns_transport_t *transport) {
++	REQUIRE(VALID_TRANSPORT(transport));
++	REQUIRE(transport->type == DNS_TRANSPORT_TLS ||
++		transport->type == DNS_TRANSPORT_HTTP);
++
++	return transport->tls.always_verify_remote;
++}
++
++isc_result_t
++dns_transport_get_tlsctx(dns_transport_t *transport, const isc_sockaddr_t *peer,
++			 isc_tlsctx_cache_t *tlsctx_cache, isc_mem_t *mctx,
++			 isc_tlsctx_t **pctx,
++			 isc_tlsctx_client_session_cache_t **psess_cache) {
++	isc_result_t result = ISC_R_FAILURE;
++	isc_tlsctx_t *tlsctx = NULL, *found = NULL;
++	isc_tls_cert_store_t *store = NULL, *found_store = NULL;
++	isc_tlsctx_client_session_cache_t *sess_cache = NULL;
++	isc_tlsctx_client_session_cache_t *found_sess_cache = NULL;
++	uint32_t tls_versions;
++	const char *ciphers = NULL;
++	bool prefer_server_ciphers;
++	uint16_t family;
++	const char *tlsname = NULL;
++
++	REQUIRE(VALID_TRANSPORT(transport));
++	REQUIRE(transport->type == DNS_TRANSPORT_TLS);
++	REQUIRE(peer != NULL);
++	REQUIRE(tlsctx_cache != NULL);
++	REQUIRE(mctx != NULL);
++	REQUIRE(pctx != NULL && *pctx == NULL);
++	REQUIRE(psess_cache != NULL && *psess_cache == NULL);
++
++	family = (isc_sockaddr_pf(peer) == PF_INET6) ? AF_INET6 : AF_INET;
++
++	tlsname = dns_transport_get_tlsname(transport);
++	INSIST(tlsname != NULL && *tlsname != '\0');
++
++	/*
++	 * Let's try to re-use the already created context. This way
++	 * we have a chance to resume the TLS session, bypassing the
++	 * full TLS handshake procedure, making establishing
++	 * subsequent TLS connections faster.
++	 */
++	result = isc_tlsctx_cache_find(tlsctx_cache, tlsname,
++				       isc_tlsctx_cache_tls, family, &found,
++				       &found_store, &found_sess_cache);
++	if (result != ISC_R_SUCCESS) {
++		const char *hostname =
++			dns_transport_get_remote_hostname(transport);
++		const char *ca_file = dns_transport_get_cafile(transport);
++		const char *cert_file = dns_transport_get_certfile(transport);
++		const char *key_file = dns_transport_get_keyfile(transport);
++		const bool always_verify_remote =
++			dns_transport_get_always_verify_remote(transport);
++		char peer_addr_str[INET6_ADDRSTRLEN] = { 0 };
++		isc_netaddr_t peer_netaddr = { 0 };
++		bool hostname_ignore_subject;
++
++		/*
++		 * So, no context exists. Let's create one using the
++		 * parameters from the configuration file and try to
++		 * store it for further reuse.
++		 */
++		result = isc_tlsctx_createclient(&tlsctx);
++		if (result != ISC_R_SUCCESS) {
++			goto failure;
++		}
++		tls_versions = dns_transport_get_tls_versions(transport);
++		if (tls_versions != 0) {
++			isc_tlsctx_set_protocols(tlsctx, tls_versions);
++		}
++		ciphers = dns_transport_get_ciphers(transport);
++		if (ciphers != NULL) {
++			isc_tlsctx_set_cipherlist(tlsctx, ciphers);
++		}
++
++		if (dns_transport_get_prefer_server_ciphers(
++			    transport, &prefer_server_ciphers))
++		{
++			isc_tlsctx_prefer_server_ciphers(tlsctx,
++							 prefer_server_ciphers);
++		}
++
++		if (always_verify_remote || hostname != NULL || ca_file != NULL)
++		{
++			/*
++			 * The situation when 'found_store != NULL' while
++			 * 'found == NULL' may occur as there is a one-to-many
++			 * relation between cert stores and per-transport TLS
++			 * contexts. That is, there could be one store
++			 * shared between multiple contexts.
++			 */
++			if (found_store == NULL) {
++				/*
++				 * 'ca_file' can equal 'NULL' here, in
++				 * which case the store with system-wide
++				 * CA certificates will be created.
++				 */
++				result = isc_tls_cert_store_create(ca_file,
++								   &store);
++
++				if (result != ISC_R_SUCCESS) {
++					goto failure;
++				}
++			} else {
++				store = found_store;
++			}
++
++			INSIST(store != NULL);
++			if (hostname == NULL) {
++				/*
++				 * If hostname is not specified, then use the
++				 * peer IP address for validation.
++				 */
++				isc_netaddr_fromsockaddr(&peer_netaddr, peer);
++				isc_netaddr_format(&peer_netaddr, peer_addr_str,
++						   sizeof(peer_addr_str));
++				hostname = peer_addr_str;
++			}
++
++			/*
++			 * According to RFC 8310, Subject field MUST NOT
++			 * be inspected when verifying hostname for DoT.
++			 * Only SubjectAltName must be checked.
++			 */
++			hostname_ignore_subject = true;
++			result = isc_tlsctx_enable_peer_verification(
++				tlsctx, false, store, hostname,
++				hostname_ignore_subject);
++			if (result != ISC_R_SUCCESS) {
++				goto failure;
++			}
++
++			/*
++			 * Let's load client certificate and enable
++			 * Mutual TLS. We do that only in the case when
++			 * Strict TLS is enabled, because Mutual TLS is
++			 * an extension of it.
++			 */
++			if (cert_file != NULL) {
++				INSIST(key_file != NULL);
++
++				result = isc_tlsctx_load_certificate(
++					tlsctx, key_file, cert_file);
++				if (result != ISC_R_SUCCESS) {
++					goto failure;
++				}
++			}
++		}
++
++		isc_tlsctx_enable_dot_client_alpn(tlsctx);
++
++		isc_tlsctx_client_session_cache_create(
++			mctx, tlsctx,
++			ISC_TLSCTX_CLIENT_SESSION_CACHE_DEFAULT_SIZE,
++			&sess_cache);
++
++		found_store = NULL;
++		result = isc_tlsctx_cache_add(tlsctx_cache, tlsname,
++					      isc_tlsctx_cache_tls, family,
++					      tlsctx, store, sess_cache, &found,
++					      &found_store, &found_sess_cache);
++		if (result == ISC_R_EXISTS) {
++			/*
++			 * It seems the entry has just been created from
++			 * within another thread while we were initialising
++			 * ours. Although this is unlikely, it could happen
++			 * after startup/re-initialisation. In such a case,
++			 * discard the new context and associated data and use
++			 * the already established one from now on.
++			 *
++			 * Such situation will not occur after the
++			 * initial 'warm-up', so it is not critical
++			 * performance-wise.
++			 */
++			INSIST(found != NULL);
++			isc_tlsctx_free(&tlsctx);
++			/*
++			 * The 'store' variable can be 'NULL' when remote server
++			 * verification is not enabled (that is, when Strict or
++			 * Mutual TLS are not used).
++			 *
++			 * The 'found_store' might be equal to 'store' as there
++			 * is one-to-many relation between a store and
++			 * per-transport TLS contexts. In that case, the call to
++			 * 'isc_tlsctx_cache_find()' above could have returned a
++			 * store via the 'found_store' variable, whose value we
++			 * can assign to 'store' later. In that case,
++			 * 'isc_tlsctx_cache_add()' will return the same value.
++			 * When that happens, we should not free the store
++			 * object, as it is managed by the TLS context cache.
++			 */
++			if (store != NULL && store != found_store) {
++				isc_tls_cert_store_free(&store);
++			}
++			isc_tlsctx_client_session_cache_detach(&sess_cache);
++			/* Let's return the data from the cache. */
++			*psess_cache = found_sess_cache;
++			*pctx = found;
++		} else {
++			/*
++			 * Adding the fresh values into the cache has been
++			 * successful, let's return them
++			 */
++			INSIST(result == ISC_R_SUCCESS);
++			*psess_cache = sess_cache;
++			*pctx = tlsctx;
++		}
++	} else {
++		/*
++		 * The cache lookup has been successful, let's return the
++		 * results.
++		 */
++		INSIST(result == ISC_R_SUCCESS);
++		*psess_cache = found_sess_cache;
++		*pctx = found;
++	}
++
++	return ISC_R_SUCCESS;
++
++failure:
++	if (tlsctx != NULL) {
++		isc_tlsctx_free(&tlsctx);
++	}
++
++	/*
++	 * The 'found_store' is being managed by the TLS context
++	 * cache. Thus, we should keep it as it is, as it will get
++	 * destroyed alongside the cache. As there is one store per
++	 * multiple TLS contexts, we need to handle store deletion in a
++	 * special way.
++	 */
++	if (store != NULL && store != found_store) {
++		isc_tls_cert_store_free(&store);
++	}
++
++	return result;
++}
++
+ static void
+ transport_destroy(dns_transport_t *transport) {
+ 	isc_refcount_destroy(&transport->references);
+diff --git a/lib/dns/xfrin.c b/lib/dns/xfrin.c
+index 72b24e15ac3..73bd834070c 100644
+--- a/lib/dns/xfrin.c
++++ b/lib/dns/xfrin.c
+@@ -962,234 +962,6 @@ xfrin_create(isc_mem_t *mctx, dns_zone_t *zone, dns_db_t *db, isc_nm_t *netmgr,
+ 	*xfrp = xfr;
+ }
+ 
+-static isc_result_t
+-get_create_tlsctx(const dns_xfrin_ctx_t *xfr, isc_tlsctx_t **pctx,
+-		  isc_tlsctx_client_session_cache_t **psess_cache) {
+-	isc_result_t result = ISC_R_FAILURE;
+-	isc_tlsctx_t *tlsctx = NULL, *found = NULL;
+-	isc_tls_cert_store_t *store = NULL, *found_store = NULL;
+-	isc_tlsctx_client_session_cache_t *sess_cache = NULL,
+-					  *found_sess_cache = NULL;
+-	uint32_t tls_versions;
+-	const char *ciphers = NULL;
+-	bool prefer_server_ciphers;
+-	const uint16_t family = isc_sockaddr_pf(&xfr->primaryaddr) == PF_INET6
+-					? AF_INET6
+-					: AF_INET;
+-	const char *tlsname = NULL;
+-
+-	REQUIRE(psess_cache != NULL && *psess_cache == NULL);
+-	REQUIRE(pctx != NULL && *pctx == NULL);
+-
+-	INSIST(xfr->transport != NULL);
+-	tlsname = dns_transport_get_tlsname(xfr->transport);
+-	INSIST(tlsname != NULL && *tlsname != '\0');
+-
+-	/*
+-	 * Let's try to re-use the already created context. This way
+-	 * we have a chance to resume the TLS session, bypassing the
+-	 * full TLS handshake procedure, making establishing
+-	 * subsequent TLS connections for XoT faster.
+-	 */
+-	result = isc_tlsctx_cache_find(xfr->tlsctx_cache, tlsname,
+-				       isc_tlsctx_cache_tls, family, &found,
+-				       &found_store, &found_sess_cache);
+-	if (result != ISC_R_SUCCESS) {
+-		const char *hostname =
+-			dns_transport_get_remote_hostname(xfr->transport);
+-		const char *ca_file = dns_transport_get_cafile(xfr->transport);
+-		const char *cert_file =
+-			dns_transport_get_certfile(xfr->transport);
+-		const char *key_file =
+-			dns_transport_get_keyfile(xfr->transport);
+-		char primary_addr_str[INET6_ADDRSTRLEN] = { 0 };
+-		isc_netaddr_t primary_netaddr = { 0 };
+-		bool hostname_ignore_subject;
+-		/*
+-		 * So, no context exists. Let's create one using the
+-		 * parameters from the configuration file and try to
+-		 * store it for further reuse.
+-		 */
+-		result = isc_tlsctx_createclient(&tlsctx);
+-		if (result != ISC_R_SUCCESS) {
+-			goto failure;
+-		}
+-		tls_versions = dns_transport_get_tls_versions(xfr->transport);
+-		if (tls_versions != 0) {
+-			isc_tlsctx_set_protocols(tlsctx, tls_versions);
+-		}
+-		ciphers = dns_transport_get_ciphers(xfr->transport);
+-		if (ciphers != NULL) {
+-			isc_tlsctx_set_cipherlist(tlsctx, ciphers);
+-		}
+-
+-		if (dns_transport_get_prefer_server_ciphers(
+-			    xfr->transport, &prefer_server_ciphers))
+-		{
+-			isc_tlsctx_prefer_server_ciphers(tlsctx,
+-							 prefer_server_ciphers);
+-		}
+-
+-		if (hostname != NULL || ca_file != NULL) {
+-			/*
+-			 * The situation when 'found_store != NULL' while 'found
+-			 * == NULL' might appear as there is one to many
+-			 * relation between per transport TLS contexts and cert
+-			 * stores. That is, there could be one store shared
+-			 * between multiple contexts.
+-			 */
+-			if (found_store == NULL) {
+-				/*
+-				 * 'ca_file' can equal 'NULL' here, in
+-				 * that case the store with system-wide
+-				 * CA certificates will be created, just
+-				 * as planned.
+-				 */
+-				result = isc_tls_cert_store_create(ca_file,
+-								   &store);
+-
+-				if (result != ISC_R_SUCCESS) {
+-					goto failure;
+-				}
+-			} else {
+-				store = found_store;
+-			}
+-
+-			INSIST(store != NULL);
+-			if (hostname == NULL) {
+-				/*
+-				 * If CA bundle file is specified, but
+-				 * hostname is not, then use the primary
+-				 * IP address for validation, just like
+-				 * dig does.
+-				 */
+-				INSIST(ca_file != NULL);
+-				isc_netaddr_fromsockaddr(&primary_netaddr,
+-							 &xfr->primaryaddr);
+-				isc_netaddr_format(&primary_netaddr,
+-						   primary_addr_str,
+-						   sizeof(primary_addr_str));
+-				hostname = primary_addr_str;
+-			}
+-			/*
+-			 * According to RFC 8310, Subject field MUST NOT
+-			 * be inspected when verifying hostname for DoT.
+-			 * Only SubjectAltName must be checked.
+-			 */
+-			hostname_ignore_subject = true;
+-			result = isc_tlsctx_enable_peer_verification(
+-				tlsctx, false, store, hostname,
+-				hostname_ignore_subject);
+-			if (result != ISC_R_SUCCESS) {
+-				goto failure;
+-			}
+-
+-			/*
+-			 * Let's load client certificate and enable
+-			 * Mutual TLS. We do that only in the case when
+-			 * Strict TLS is enabled, because Mutual TLS is
+-			 * an extension of it.
+-			 */
+-			if (cert_file != NULL) {
+-				INSIST(key_file != NULL);
+-
+-				result = isc_tlsctx_load_certificate(
+-					tlsctx, key_file, cert_file);
+-				if (result != ISC_R_SUCCESS) {
+-					goto failure;
+-				}
+-			}
+-		}
+-
+-		isc_tlsctx_enable_dot_client_alpn(tlsctx);
+-
+-		isc_tlsctx_client_session_cache_create(
+-			xfr->mctx, tlsctx,
+-			ISC_TLSCTX_CLIENT_SESSION_CACHE_DEFAULT_SIZE,
+-			&sess_cache);
+-
+-		found_store = NULL;
+-		result = isc_tlsctx_cache_add(xfr->tlsctx_cache, tlsname,
+-					      isc_tlsctx_cache_tls, family,
+-					      tlsctx, store, sess_cache, &found,
+-					      &found_store, &found_sess_cache);
+-		if (result == ISC_R_EXISTS) {
+-			/*
+-			 * It seems the entry has just been created from within
+-			 * another thread while we were initialising
+-			 * ours. Although this is unlikely, it could happen
+-			 * after startup/re-initialisation. In such a case,
+-			 * discard the new context and associated data and use
+-			 * the already established one from now on.
+-			 *
+-			 * Such situation will not occur after the
+-			 * initial 'warm-up', so it is not critical
+-			 * performance-wise.
+-			 */
+-			INSIST(found != NULL);
+-			isc_tlsctx_free(&tlsctx);
+-			/*
+-			 * The 'store' variable can be 'NULL' when remote server
+-			 * verification is not enabled (that is, when Strict or
+-			 * Mutual TLS are not used).
+-			 *
+-			 * The 'found_store' might be equal to 'store' as there
+-			 * is one-to-many relation between a store and
+-			 * per-transport TLS contexts. In that case, the call to
+-			 * 'isc_tlsctx_cache_find()' above could have returned a
+-			 * store via the 'found_store' variable, whose value we
+-			 * can assign to 'store' later. In that case,
+-			 * 'isc_tlsctx_cache_add()' will return the same value.
+-			 * When that happens, we should not free the store
+-			 * object, as it is managed by the TLS context cache.
+-			 */
+-			if (store != NULL && store != found_store) {
+-				isc_tls_cert_store_free(&store);
+-			}
+-			isc_tlsctx_client_session_cache_detach(&sess_cache);
+-			/* Let's return the data from the cache. */
+-			*psess_cache = found_sess_cache;
+-			*pctx = found;
+-		} else {
+-			/*
+-			 * Adding the fresh values into the cache has been
+-			 * successful, let's return them
+-			 */
+-			INSIST(result == ISC_R_SUCCESS);
+-			*psess_cache = sess_cache;
+-			*pctx = tlsctx;
+-		}
+-	} else {
+-		/*
+-		 * The cache lookup has been successful, let's return the
+-		 * results.
+-		 */
+-		INSIST(result == ISC_R_SUCCESS);
+-		*psess_cache = found_sess_cache;
+-		*pctx = found;
+-	}
+-
+-	return (ISC_R_SUCCESS);
+-
+-failure:
+-	if (tlsctx != NULL) {
+-		isc_tlsctx_free(&tlsctx);
+-	}
+-
+-	/*
+-	 * The 'found_store' is being managed by the TLS context
+-	 * cache. Thus, we should keep it as it is, as it will get
+-	 * destroyed alongside the cache. As there is one store per
+-	 * multiple TLS contexts, we need to handle store deletion in a
+-	 * special way.
+-	 */
+-	if (store != NULL && store != found_store) {
+-		isc_tls_cert_store_free(&store);
+-	}
+-
+-	return (result);
+-}
+-
+ static isc_result_t
+ xfrin_start(dns_xfrin_ctx_t *xfr) {
+ 	isc_result_t result;
+@@ -1232,7 +1004,9 @@ xfrin_start(dns_xfrin_ctx_t *xfr) {
+ 				     connect_xfr, 30000, 0);
+ 		break;
+ 	case DNS_TRANSPORT_TLS: {
+-		result = get_create_tlsctx(xfr, &tlsctx, &sess_cache);
++		result = dns_transport_get_tlsctx(
++			xfr->transport, &xfr->primaryaddr, xfr->tlsctx_cache,
++			xfr->mctx, &tlsctx, &sess_cache);
+ 		if (result != ISC_R_SUCCESS) {
+ 			goto failure;
+ 		}
+-- 
+2.47.0
+
diff --git a/bind.spec b/bind.spec
index 0439976..09d3aed 100644
--- a/bind.spec
+++ b/bind.spec
@@ -87,7 +87,7 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it.
 # Updating just bind will cause freeipa-dns-server package to be uninstallable.
 Version:  9.18.31
-Release:  1%{?dist}
+Release:  2%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -128,6 +128,13 @@ Patch26: bind-9.18-unittest-netmgr-unstable.patch
 # Correct support for building without openssl/engine.h header
 # https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/9593
 Patch27: bind-9.20-openssl-no-engine.patch
+# Downstream backport from 9.20
+# https://issues.redhat.com/browse/FREEIPA-11706
+# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/6751
+# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/6752
+Patch28: bind-9.20-nsupdate-tls.patch
+# Man change for patch28 nsupdate
+Patch29: bind-9.20-nsupdate-tls-doc.patch
 
 %{?systemd_ordering}
 Requires:       coreutils
@@ -982,6 +989,9 @@ fi;
 %endif
 
 %changelog
+* Wed Dec 04 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.31-2
+- Add nsupdate TLS support (FREEIPA-11706)
+
 * Thu Nov 14 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.31-1
 - Update to 9.18.31 (#2319214)
 

From 0dcd8bfd6d2e5f56a07889f3018a74f8736664f6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 9 Dec 2024 21:11:44 +0100
Subject: [PATCH 372/460] Include a test for nsupdate changes

---
 bind-9.20-nsupdate-tls-test.patch | 1630 +++++++++++++++++++++++++++++
 bind.spec                         |    3 +
 2 files changed, 1633 insertions(+)
 create mode 100644 bind-9.20-nsupdate-tls-test.patch

diff --git a/bind-9.20-nsupdate-tls-test.patch b/bind-9.20-nsupdate-tls-test.patch
new file mode 100644
index 0000000..65d825d
--- /dev/null
+++ b/bind-9.20-nsupdate-tls-test.patch
@@ -0,0 +1,1630 @@
+From 2e0dd9a0a3e77f21a37d894133d301afdac6db7b Mon Sep 17 00:00:00 2001
+From: Aram Sargsyan <aram@isc.org>
+Date: Wed, 21 Sep 2022 13:15:50 +0000
+Subject: [PATCH] Extend the nsupdate system test with DoT-related checks
+
+Add a simple test PKI based on the existing one in the doth test.
+
+Check ephemeral, forward-secrecy, and forward-secrecy-mutual-tls
+TLS configurations with different scenarios.
+
+(cherry picked from commit f2bb80d6ae172f6fd7943bf913d1b0566b5df352)
+---
+ bin/tests/system/nsupdate/.gitignore          |   5 +
+ bin/tests/system/nsupdate/CA/CA-other.pem     |  26 +++
+ bin/tests/system/nsupdate/CA/CA.cfg           |  77 +++++++
+ bin/tests/system/nsupdate/CA/CA.pem           |  29 +++
+ bin/tests/system/nsupdate/CA/README           |   2 +
+ .../CA/certs/srv01.client01.example.nil.key   |  40 ++++
+ .../CA/certs/srv01.client01.example.nil.pem   |  93 +++++++++
+ .../srv01.client02-expired.example.nil.key    |  40 ++++
+ .../srv01.client02-expired.example.nil.pem    |  93 +++++++++
+ .../CA/certs/srv01.crt01.example.nil.key      |  40 ++++
+ .../CA/certs/srv01.crt01.example.nil.pem      |  93 +++++++++
+ .../certs/srv01.crt02-expired.example.nil.key |  40 ++++
+ .../certs/srv01.crt02-expired.example.nil.pem |  93 +++++++++
+ bin/tests/system/nsupdate/CA/index.txt        |   4 +
+ bin/tests/system/nsupdate/CA/index.txt.attr   |   1 +
+ .../nsupdate/CA/newcerts/70B9F4EB2FA19598.pem |  93 +++++++++
+ .../nsupdate/CA/newcerts/70B9F4EB2FA19599.pem |  93 +++++++++
+ .../nsupdate/CA/newcerts/70B9F4EB2FA1959A.pem |  93 +++++++++
+ .../nsupdate/CA/newcerts/70B9F4EB2FA1959B.pem |  93 +++++++++
+ .../system/nsupdate/CA/private/CA-other.key   |  39 ++++
+ bin/tests/system/nsupdate/CA/private/CA.key   |  39 ++++
+ bin/tests/system/nsupdate/CA/serial           |   1 +
+ bin/tests/system/nsupdate/dhparam3072.pem     |  11 +
+ bin/tests/system/nsupdate/ns1/named.conf.in   |  34 +++
+ bin/tests/system/nsupdate/ns10/named.conf.in  |   2 +
+ bin/tests/system/nsupdate/tests.sh            | 193 ++++++++++++++++++
+ 26 files changed, 1367 insertions(+)
+ create mode 100644 bin/tests/system/nsupdate/.gitignore
+ create mode 100644 bin/tests/system/nsupdate/CA/CA-other.pem
+ create mode 100644 bin/tests/system/nsupdate/CA/CA.cfg
+ create mode 100644 bin/tests/system/nsupdate/CA/CA.pem
+ create mode 100644 bin/tests/system/nsupdate/CA/README
+ create mode 100644 bin/tests/system/nsupdate/CA/certs/srv01.client01.example.nil.key
+ create mode 100644 bin/tests/system/nsupdate/CA/certs/srv01.client01.example.nil.pem
+ create mode 100644 bin/tests/system/nsupdate/CA/certs/srv01.client02-expired.example.nil.key
+ create mode 100644 bin/tests/system/nsupdate/CA/certs/srv01.client02-expired.example.nil.pem
+ create mode 100644 bin/tests/system/nsupdate/CA/certs/srv01.crt01.example.nil.key
+ create mode 100644 bin/tests/system/nsupdate/CA/certs/srv01.crt01.example.nil.pem
+ create mode 100644 bin/tests/system/nsupdate/CA/certs/srv01.crt02-expired.example.nil.key
+ create mode 100644 bin/tests/system/nsupdate/CA/certs/srv01.crt02-expired.example.nil.pem
+ create mode 100644 bin/tests/system/nsupdate/CA/index.txt
+ create mode 100644 bin/tests/system/nsupdate/CA/index.txt.attr
+ create mode 100644 bin/tests/system/nsupdate/CA/newcerts/70B9F4EB2FA19598.pem
+ create mode 100644 bin/tests/system/nsupdate/CA/newcerts/70B9F4EB2FA19599.pem
+ create mode 100644 bin/tests/system/nsupdate/CA/newcerts/70B9F4EB2FA1959A.pem
+ create mode 100644 bin/tests/system/nsupdate/CA/newcerts/70B9F4EB2FA1959B.pem
+ create mode 100644 bin/tests/system/nsupdate/CA/private/CA-other.key
+ create mode 100644 bin/tests/system/nsupdate/CA/private/CA.key
+ create mode 100644 bin/tests/system/nsupdate/CA/serial
+ create mode 100644 bin/tests/system/nsupdate/dhparam3072.pem
+
+diff --git a/bin/tests/system/nsupdate/.gitignore b/bin/tests/system/nsupdate/.gitignore
+new file mode 100644
+index 0000000..df5fe68
+--- /dev/null
++++ b/bin/tests/system/nsupdate/.gitignore
+@@ -0,0 +1,5 @@
++# temporary files generated by "openssl ca"
++/CA/*.old
++# there is little point in keeping the certificate requests
++# for the issued certificates
++/CA/certs/*.csr
+diff --git a/bin/tests/system/nsupdate/CA/CA-other.pem b/bin/tests/system/nsupdate/CA/CA-other.pem
+new file mode 100644
+index 0000000..6bdbeda
+--- /dev/null
++++ b/bin/tests/system/nsupdate/CA/CA-other.pem
+@@ -0,0 +1,26 @@
++-----BEGIN CERTIFICATE-----
++MIIEZTCCAs0CFDYlin3oeYDu16bFItl9tGZz1Ra4MA0GCSqGSIb3DQEBCwUAMG4x
++CzAJBgNVBAYTAlVBMRcwFQYDVQQIDA5LaGFya2l2IE9ibGFzdDEQMA4GA1UEBwwH
++S2hhcmtpdjEMMAoGA1UECgwDSVNDMSYwJAYDVQQLDB1Tb2Z0d2FyZSBFbmdlbmVl
++cmluZyAoQklORCA5KTAgFw0yMjA5MDcyMTIzNTBaGA8yMDUyMDgzMDIxMjM1MFow
++bjELMAkGA1UEBhMCVUExFzAVBgNVBAgMDktoYXJraXYgT2JsYXN0MRAwDgYDVQQH
++DAdLaGFya2l2MQwwCgYDVQQKDANJU0MxJjAkBgNVBAsMHVNvZnR3YXJlIEVuZ2Vu
++ZWVyaW5nIChCSU5EIDkpMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEA
++10Xj8dH8/XCfUvhdL/S3E10TnrYY8IIDBmU0lkUR5IHwgP9IYVyR/0Mibg79FAs+
++rvuEDifUK+6wvkpj+BXNVZCspo9/u3cl7dqrLH+1SeUs50OeQnbbTrBl0PuNwvzE
++kbk7xwLlVDOyRmmvY/EEu7WkitQZgXSAYgttrk62CuJUQUmwUTX5Jxndsjydk/zW
++/DiulTsX+zv8kG5NiwpXCfL6QxBoMZNI4fUmDL3bX1XfHaFA+45GT2lHu07xc+cV
++eZIRCo0Nk+fIO53lDol8mmR8/5vna27gRnqEUSU7MZAMG6QBXkotnq3rHnrI/ku6
++dCJW4tbWV/ANQ+TG17g2tygzC/smqTuLqavyP9V5cRrdU9awEqwvy8uVbGkTmUZd
++tjkGWCcmBSWJvkH3MRJmijS7rDcb8m/g9+xKe79V1c8durGWvcfMRZZhWaoHyhnH
++g9+JLUCC3EUCp/1206w5vTXEQNpqi9Z3AZfgboPzJyji4OeYfcQ5eaIZ3OuIpyQz
++AgMBAAEwDQYJKoZIhvcNAQELBQADggGBAKdQkmmyUqcE1by7AeHoxkqFgqUeSAlh
++flXi5DD+j5+Op2GAUrx84LGy4+heKEwAkV5Cw2c9IMHmDDMnGe/g4FjBS+dTZsTs
++JRXXDR7t20eWiBpvO/3IMqVpPq9CAQY1L9PYAVuVM5cwdzsJXdH82z2BZ3Ttg3GX
++NPnybxzD/auC051vqEp28Jzbswd4c3VvTmRnYY7rYNNKnLD7812BIp7lnE6s5X2D
++y0PPSYdhscTqfJV0+GDF5hUduOFX1xTcPlXaXfyKLLelqtrw40p3ynww9v/J4mwt
++FBV+a8gguM7tCZMoV/VJZghObglV/wpokAQchL/pnxL7+U8JklRqaU4DlxyGZ+K4
++QlR5mJe19ZlkgHePk1MbwNZaTXjaOFirYmZzs4YynOp3iBHrW3CYY3kVlrUpKP08
++o101hce32VxkyST6i5W24MU02O/wuPdyQpN+rJjYv32Axsrh/ePkI5qKew9eZ63i
++WzNb7BW1LrHrQ/lXoJ3ekRQd10UX3xhk/w==
++-----END CERTIFICATE-----
+diff --git a/bin/tests/system/nsupdate/CA/CA.cfg b/bin/tests/system/nsupdate/CA/CA.cfg
+new file mode 100644
+index 0000000..1a3ed65
+--- /dev/null
++++ b/bin/tests/system/nsupdate/CA/CA.cfg
+@@ -0,0 +1,77 @@
++# See ../../doth/CA/ca.cfg for more information
++
++# certificate authority configuration
++[ca]
++default_ca      = CA_default               # The default ca section
++
++[CA_default]
++dir            = .
++new_certs_dir  = $dir/newcerts         # new certs dir (must be created)
++certificate    = $dir/CA.pem           # The CA cert
++private_key    = $dir/private/CA.key   # CA private key
++
++serial         = $dir/serial           # serial number file for the next certificate
++                                       # Update before issuing it:
++                                       # xxd -l 8 -u -ps /dev/urandom > ./serial
++database = $dir/index.txt                 # (must be created manually: touch ./index.txt)
++
++default_days   = 1                 # how long to certify for
++
++#default_crl_days = 30                 # the number of days before the
++default_crl_days = 10950               # next CRL is due. That is the
++                                       # days from now to place in the
++                                       # CRL nextUpdate field.  If CRL
++                                       # is expired, certificate
++                                       # verifications will fail even
++                                       # for otherwise valid
++                                       # certificates. Clients might
++                                       # cache the CRL, so the expiry
++                                       # period should normally be
++                                       # relatively short (default:
++                                       # 30) for production CAs.
++
++default_md     = sha256                # digest to use
++
++policy         = policy_default        # default policy
++email_in_dn    = no                    # Don't add the email into cert DN
++
++name_opt       = ca_default            # Subject name display option
++cert_opt       = ca_default            # Certificate display option
++
++# We need the following in order to copy Subject Alt Name(s) from a
++# request to the certificate.
++copy_extensions = copy                 # copy extensions from request
++
++[policy_default]
++countryName            = optional
++stateOrProvinceName    = optional
++organizationalUnitName = optional
++commonName             = supplied
++emailAddress           = optional
++
++# default certificate requests settings
++[req]
++# Options for the `req` tool (`man req`).
++default_bits        = 3072 # for RSA only
++distinguished_name  = req_default
++string_mask         = utf8only
++# SHA-1 is deprecated, so use SHA-256 instead.
++default_md          = sha256
++# do not encrypt the private key file
++encrypt_key         = no
++
++[req_default]
++# See <https://en.wikipedia.org/wiki/Certificate_signing_request>.
++countryName                     = Country Name (2 letter code)
++stateOrProvinceName             = State or Province Name (full name)
++localityName                    = Locality Name (e.g., city)
++0.organizationName              = Organization Name (e.g., company)
++organizationalUnitName          = Organizational Unit Name (e.g. department)
++commonName                      = Common Name (e.g. server FQDN or YOUR name)
++emailAddress                    = Email Address
++# defaults
++countryName_default                     = UA
++stateOrProvinceName_default             = Kharkiv Oblast
++localityName_default                    = Kharkiv
++0.organizationName_default              = ISC
++organizationalUnitName_default          = Software Engeneering (BIND 9)
+diff --git a/bin/tests/system/nsupdate/CA/CA.pem b/bin/tests/system/nsupdate/CA/CA.pem
+new file mode 100644
+index 0000000..1f725db
+--- /dev/null
++++ b/bin/tests/system/nsupdate/CA/CA.pem
+@@ -0,0 +1,29 @@
++-----BEGIN CERTIFICATE-----
++MIIE3TCCA0WgAwIBAgIUeZPKrvbGEBZaRc2jNczlIsJXyPYwDQYJKoZIhvcNAQEL
++BQAwfTELMAkGA1UEBhMCVUExGDAWBgNVBAgMD0toYXJraXYgT2JsYXN0JzEQMA4G
++A1UEBwwHS2hhcmtpdjEkMCIGA1UECgwbSW50ZXJuZXQgU3lzdGVtcyBDb25zb3J0
++aXVtMRwwGgYDVQQDDBNjYS50ZXN0LmV4YW1wbGUuY29tMCAXDTIyMDEyNDEyNDA1
++NFoYDzIwNTIwMTE3MTI0MDU0WjB9MQswCQYDVQQGEwJVQTEYMBYGA1UECAwPS2hh
++cmtpdiBPYmxhc3QnMRAwDgYDVQQHDAdLaGFya2l2MSQwIgYDVQQKDBtJbnRlcm5l
++dCBTeXN0ZW1zIENvbnNvcnRpdW0xHDAaBgNVBAMME2NhLnRlc3QuZXhhbXBsZS5j
++b20wggGiMA0GCSqGSIb3DQEBAQUAA4IBjwAwggGKAoIBgQCi6hEegBzpUKbE1NTo
++Z7uz7EMUY7TBckkiw/7ydTLKNa8YI4JpBguFvWQsDY0dGFJIoVwyHyNx3seW/LoI
++B5zWPZ2xbOvLLceA+t2NZpbc98E7jUOVS123yED+nqlfZjCq9Zt0r/ezwnQtjnFF
++ko1mcU4H9Jvg8aIgnU2AxE78zciU9CY8799pFFNThIjbooI8oVbfjbzbpmLzxjA5
++3rDmZBTh+ySTlMa2U2oT4WPjRltZWnJVegRRLpG95GnTbQ1fkJAbj1Iu10XTkCee
++wBOqaA1UJem0a6pby5odE414Y7c0ETKcmaJtYENQyO0IJwZWDKtVe5OTIAklakia
++eyFTCAw1h5tHCYLaJW/Yu2wlLl5RNQcRZ9+cWXnldTY+TI1iBjfmADjLdKJYUlhX
++z7kWJtTi63Sdv6WYcEXxaWpxT+R3e2kaR/R7GOo4gdkWpX1siGlRteHHH2/36CSQ
++ZD2etcTUpGW+KDHFR4grnEfL1rt9UgvCjpa4KcssmZtWSSUCAwEAAaNTMFEwHQYD
++VR0OBBYEFHyJ6Fzr5R9ySATFj/uSCJz1YCY5MB8GA1UdIwQYMBaAFHyJ6Fzr5R9y
++SATFj/uSCJz1YCY5MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggGB
++AF3y0hvzyZWtmuG1JwIcOcc1aPl1KdRy8bao/5iHYGYYrsdDgcO5/e+y9S/izalc
++TdW7SKB5iBOCiE8fBNtToCvGP+fxNxHijpAmTr37G5sWuSo1T1VYFizHWL+df/Ig
++TcSvDrEjSnAwaEdNJUWtjoIC4VzNKTLtZf16QIATTzTZa3bfgSetpWS7LhLQbHod
++CSGI2QB1LRbqGC+a1Y85QxHv81jWzPWPzXYvnOLrDdQyBMOBcxDzrN4b6zg+5Itz
++qGYt+IS71jAH0IhxAyD/U5n1jGJv02BnSq0ynLEOD6gsnZjqAwPbt/PM9pGbtbXO
++70Q9rxr+vQc1IISKAEiH3txaEPi10wU98d6LbInJvQrmgHo/ntet8skWNYuxlEzS
++wvynuE9KvvQtOTodWt5AePtKrhHdxu527a4CHVp59nYUjKSdMKjvmhMRXM1cNjFE
++rA/pyyhozR47w3RzHMJVHw2GJ2B/HeqmxpXr1CmJjoRP38QCR7N+mqiZy85Fq2j2
++8Q==
++-----END CERTIFICATE-----
+diff --git a/bin/tests/system/nsupdate/CA/README b/bin/tests/system/nsupdate/CA/README
+new file mode 100644
+index 0000000..13069ca
+--- /dev/null
++++ b/bin/tests/system/nsupdate/CA/README
+@@ -0,0 +1,2 @@
++Please take a look at the contents of the CA.cfg file for further
++instructions and configurations options.
+diff --git a/bin/tests/system/nsupdate/CA/certs/srv01.client01.example.nil.key b/bin/tests/system/nsupdate/CA/certs/srv01.client01.example.nil.key
+new file mode 100644
+index 0000000..5e3420e
+--- /dev/null
++++ b/bin/tests/system/nsupdate/CA/certs/srv01.client01.example.nil.key
+@@ -0,0 +1,40 @@
++-----BEGIN PRIVATE KEY-----
++MIIG/gIBADANBgkqhkiG9w0BAQEFAASCBugwggbkAgEAAoIBgQCrYC6cYeOJxlIr
++vOnhBf0YZUIg9lYWQDPSy5/37yJUp8lVcMpS8OKiWDh/EK0rBeARtmkhfy04Vt3V
++5PPepzI19zMqUoCut9Z8NXTDDIrDOhhhaHNiWFb/eCVXHHu+mIgh3RyKE6WaUkiY
++2T3EKKZ+mxFWfs4Ju1GJiqgbALVzK0GTsWJAMCnq9qPnvPDpngcrrqmgHU3Z+BhN
++g0dOaO5XyFUVhjxtHvUx8d7Pwn5rjiJaxXav0AHeq3oDspYzzKAmrt7EvXaFlseI
++5Ea8P8ZUyZWDh5xJDTHdxBdSmeRlSZud863OZghX9IO+XofaQloBKm1o0Y042Riu
++Xi5UcosBRZav9aPQKV0ii7TUMK8CNsUt6SnrLOpqfiezcPyHHyvEsTqmwum3wm9G
++Y7eWLlPYt83D9LVtsvxXSayfmMn+tPV8k0guk9zpGFRjXxij5xKq/jjwc+UXHv5A
++ZYGoj2BGwhbyqJ2xG7zOBd43sqiGR72Nkt7g5UKJuOP4sSQIfpkCAwEAAQKCAYEA
++i3PT2fsp3cXcvayXID3wSvayzgHF4YtS4FhEDsuvwvVZtsX2TXGo6fQh3Pvj/dtl
++DuTBPbmwQWUmVNRewbKKADHsl6bVAdekmCQjpEhDbkOK7VDCe6do+693qyAJbfnO
++5Md5Xr5IBoCohIBaa5Gskd97R0gePvsHiYWj730vKc1sKlOwoIzQv1r92yf7Xg7y
++xM/3RcwyuojQtdp6nspyEEp7Oe2mpCEJ4x9vcN5SYxEg0X5Xaw83RkuBGRsscHA0
++GN+4eJ59Ld1R9uktLYvUA06ZdoAVZyblE4xxjk2vueE3K2/kT2ooKHVWulGI+PnF
++2xYedZsZkgwLbXcEhPXBo3vMTjzRlePh668ULi9B6ntMjWpCSCvGnz142Uwatfq0
++PeasBVgRngu9Wg+smkA4kHnDi7ih3zpLh6sTcOKL7F1cBgvtjgIyzZDp9eJUEfVH
++G/89mTCswhqV1WtQ3n9zbYVbSK9vaAxCrfK50pG+IfHXG9EqnrQPzKsRxNsDpN91
++AoHBANeNLQb3gSk6sBg53smh9oFUEwwgAjHY31ZOOInO4X7udXrtRcON6SCkZjaD
++6y1N3Orjama6mr+/eHxJeDEbWBB7INOsaqHewoQF8qaOa7HHmCbXcUIlAQFvaE6e
++Qd5e+YHLmbYZbkPfntqWmXuSmk7hUxjnPPOv1P9sgv/3b4TJQJ4FEJasKpWgIOAy
++3g8UrjtbI3ITSo3SKCei3wvOCzIdnzwgcHY420jU1yU/oDzN07D4K0iODAbasUl1
++ZH5UvwKBwQDLiNual2aCUtjKAoRLnGDtP6LOYV3eXchBrywIj2tNAMlD7TXbjG04
++Le+I9O+azRorvXQ2WBBIYzka1JozK8WTsxkQYRd9AEy2AsQgPlK5hfy3xcGxSscC
++vdxSdQQQ/ASKHHbCTKhDhnA2b2fvLhWxZqsbSO4hSmvjXrSUpGrAABFipK9VqS6Y
++Sg6uEo1AlTrwsGW66LHpFeG6YQ0uj4sF0x5mzH7R50And30lVg8DjJASdClzOIWJ
++WV+3opbgSqcCgcEAvGGJhJkyrJG57LJG3vlJsmWD8AjZYi8joQ3jo6zGrmRBEBnl
++6q5PnFORcPuBwapW9IGkL/vN2t6/sf+Tp3c6U80IN3ZsCuPgI/n+w0mdHVZOx0Nq
++nGAyrMps4qi08F8YuDL0N42qLG93KZqMsM7DRUTvlsghIOf+wuxW4NWjBO3OJ0xN
++3yDAZtv3X3mVUKDGVOGl7MCnW6LbrShOvsZoSnhQ/f9ryiaOnuxEyyz8IafQ5s09
++Jr/eCu9+GbEbDr2JAoHAXUZg7Z3IupzhAOLaYhROTyvEnrP8YrWz2nY+xcWENQvR
++MLH65pyaSQ60IZ2uWND512XBZk5BWAsw1lzsNdsvdpqzN9BnBUAn55mo6+Xj32XK
++BSY5t9g/D8CWwasiq+3y3qBgxHaA/kEUF75CcVg7VMtqStzHVLZYbyCtvRkEWu0t
++CnnSaH1Z/yyhQaD63sgE9NzCIkAVmG4QvmtPsTDTU14HJrE8xVEnE28tCPlBdCzs
++sahOfqE+gU1WEkAOyMctAoHAASVc1KFfBI48tM+cr8vDt1QklVgnKn44DL6HF5tp
++iA8/xhB2fHKq6a+xuGxubXo7jo0KbKyYXPFyE5MDrzIDKp0GLUr7WtaunNVMKbKs
++B/2YSw+PELoIc5GpiH4lqP5iFYyHKmJighou4oxLcjMlHpRWUERPdxA+L6zggPyJ
++56PX2tcezcCZMVm65VpHsX3CqEQyWnFDCt0zclRNFWPKCENsl10emenBZVnxb8fc
++smxv7aRpgoWBRa5vinKvOv2T
++-----END PRIVATE KEY-----
+diff --git a/bin/tests/system/nsupdate/CA/certs/srv01.client01.example.nil.pem b/bin/tests/system/nsupdate/CA/certs/srv01.client01.example.nil.pem
+new file mode 100644
+index 0000000..f546d35
+--- /dev/null
++++ b/bin/tests/system/nsupdate/CA/certs/srv01.client01.example.nil.pem
+@@ -0,0 +1,93 @@
++Certificate:
++    Data:
++        Version: 3 (0x2)
++        Serial Number: 8122792693893010842 (0x70b9f4eb2fa1959a)
++        Signature Algorithm: sha256WithRSAEncryption
++        Issuer: C=UA, ST=Kharkiv Oblast', L=Kharkiv, O=Internet Systems Consortium, CN=ca.test.example.com
++        Validity
++            Not Before: Sep  8 08:20:17 2022 GMT
++            Not After : Aug 31 08:20:17 2052 GMT
++        Subject: CN=srv01.client01.example.nil
++        Subject Public Key Info:
++            Public Key Algorithm: rsaEncryption
++                RSA Public-Key: (3072 bit)
++                Modulus:
++                    00:ab:60:2e:9c:61:e3:89:c6:52:2b:bc:e9:e1:05:
++                    fd:18:65:42:20:f6:56:16:40:33:d2:cb:9f:f7:ef:
++                    22:54:a7:c9:55:70:ca:52:f0:e2:a2:58:38:7f:10:
++                    ad:2b:05:e0:11:b6:69:21:7f:2d:38:56:dd:d5:e4:
++                    f3:de:a7:32:35:f7:33:2a:52:80:ae:b7:d6:7c:35:
++                    74:c3:0c:8a:c3:3a:18:61:68:73:62:58:56:ff:78:
++                    25:57:1c:7b:be:98:88:21:dd:1c:8a:13:a5:9a:52:
++                    48:98:d9:3d:c4:28:a6:7e:9b:11:56:7e:ce:09:bb:
++                    51:89:8a:a8:1b:00:b5:73:2b:41:93:b1:62:40:30:
++                    29:ea:f6:a3:e7:bc:f0:e9:9e:07:2b:ae:a9:a0:1d:
++                    4d:d9:f8:18:4d:83:47:4e:68:ee:57:c8:55:15:86:
++                    3c:6d:1e:f5:31:f1:de:cf:c2:7e:6b:8e:22:5a:c5:
++                    76:af:d0:01:de:ab:7a:03:b2:96:33:cc:a0:26:ae:
++                    de:c4:bd:76:85:96:c7:88:e4:46:bc:3f:c6:54:c9:
++                    95:83:87:9c:49:0d:31:dd:c4:17:52:99:e4:65:49:
++                    9b:9d:f3:ad:ce:66:08:57:f4:83:be:5e:87:da:42:
++                    5a:01:2a:6d:68:d1:8d:38:d9:18:ae:5e:2e:54:72:
++                    8b:01:45:96:af:f5:a3:d0:29:5d:22:8b:b4:d4:30:
++                    af:02:36:c5:2d:e9:29:eb:2c:ea:6a:7e:27:b3:70:
++                    fc:87:1f:2b:c4:b1:3a:a6:c2:e9:b7:c2:6f:46:63:
++                    b7:96:2e:53:d8:b7:cd:c3:f4:b5:6d:b2:fc:57:49:
++                    ac:9f:98:c9:fe:b4:f5:7c:93:48:2e:93:dc:e9:18:
++                    54:63:5f:18:a3:e7:12:aa:fe:38:f0:73:e5:17:1e:
++                    fe:40:65:81:a8:8f:60:46:c2:16:f2:a8:9d:b1:1b:
++                    bc:ce:05:de:37:b2:a8:86:47:bd:8d:92:de:e0:e5:
++                    42:89:b8:e3:f8:b1:24:08:7e:99
++                Exponent: 65537 (0x10001)
++        X509v3 extensions:
++            X509v3 Subject Alternative Name: 
++                DNS:srv01.client01.example.nil, IP Address:10.53.0.1
++    Signature Algorithm: sha256WithRSAEncryption
++         07:97:69:51:12:50:6a:e1:02:a0:b0:dc:93:75:16:c4:38:0f:
++         5c:b3:47:da:bf:fa:9c:b6:de:c0:ef:38:f7:cc:d9:8d:71:ba:
++         51:89:e5:48:36:dd:e1:f8:73:9d:92:80:1c:42:30:69:4f:8c:
++         19:5d:f7:1d:03:e4:f2:76:e0:58:7b:c2:76:c4:0a:7e:20:69:
++         26:6c:3e:cb:31:45:93:1d:07:5f:45:44:8e:5a:fb:87:17:7b:
++         4d:5c:bf:37:bd:5e:ba:5c:22:84:bf:26:21:4a:c4:e9:f9:cb:
++         73:de:fc:62:04:96:ad:aa:fd:89:09:5c:74:d6:bd:5f:07:17:
++         ef:9c:3d:ee:b7:dc:08:11:7f:12:66:ab:c4:ff:43:6d:7f:1e:
++         01:b6:d1:19:73:53:18:e4:02:b0:7c:9e:99:63:d8:57:dd:07:
++         79:fb:83:39:09:de:76:6e:68:b7:87:81:13:b8:26:e5:1c:c9:
++         a0:23:e5:97:39:ff:93:c7:8d:08:d8:ce:97:34:fc:ad:22:14:
++         89:c0:ae:83:7d:0a:3f:cf:a0:9b:b4:6a:5c:b3:6d:5d:3b:88:
++         ca:1e:9b:99:54:64:57:58:3c:4c:bd:26:ee:11:c3:13:0b:1d:
++         f5:fd:d9:37:b0:31:72:6f:1d:e8:ba:43:37:46:f7:71:fe:6d:
++         4a:30:33:29:c5:7b:37:8b:7e:06:22:89:a4:46:36:f0:fe:c6:
++         f5:f0:53:04:c0:35:52:78:6e:10:24:3a:d8:bf:7b:13:2f:98:
++         bc:69:31:41:68:02:5a:c4:f9:11:a2:6b:3f:c8:e0:d4:b3:80:
++         af:d2:be:fe:28:70:61:18:ed:8a:de:c4:cb:da:c9:60:94:91:
++         76:63:69:8c:6e:96:f5:ba:e7:be:1e:1c:c3:84:b1:8d:e8:31:
++         f7:66:8c:0d:da:a8:78:57:19:fd:a0:8d:fa:9a:7e:51:1c:d1:
++         d0:84:07:a2:45:40:2d:c4:6b:e9:9f:86:4a:08:20:8f:9c:79:
++         97:e3:7f:2a:14:73
++-----BEGIN CERTIFICATE-----
++MIIEVTCCAr2gAwIBAgIIcLn06y+hlZowDQYJKoZIhvcNAQELBQAwfTELMAkGA1UE
++BhMCVUExGDAWBgNVBAgMD0toYXJraXYgT2JsYXN0JzEQMA4GA1UEBwwHS2hhcmtp
++djEkMCIGA1UECgwbSW50ZXJuZXQgU3lzdGVtcyBDb25zb3J0aXVtMRwwGgYDVQQD
++DBNjYS50ZXN0LmV4YW1wbGUuY29tMCAXDTIyMDkwODA4MjAxN1oYDzIwNTIwODMx
++MDgyMDE3WjAlMSMwIQYDVQQDDBpzcnYwMS5jbGllbnQwMS5leGFtcGxlLm5pbDCC
++AaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBAKtgLpxh44nGUiu86eEF/Rhl
++QiD2VhZAM9LLn/fvIlSnyVVwylLw4qJYOH8QrSsF4BG2aSF/LThW3dXk896nMjX3
++MypSgK631nw1dMMMisM6GGFoc2JYVv94JVcce76YiCHdHIoTpZpSSJjZPcQopn6b
++EVZ+zgm7UYmKqBsAtXMrQZOxYkAwKer2o+e88OmeByuuqaAdTdn4GE2DR05o7lfI
++VRWGPG0e9THx3s/CfmuOIlrFdq/QAd6regOyljPMoCau3sS9doWWx4jkRrw/xlTJ
++lYOHnEkNMd3EF1KZ5GVJm53zrc5mCFf0g75eh9pCWgEqbWjRjTjZGK5eLlRyiwFF
++lq/1o9ApXSKLtNQwrwI2xS3pKess6mp+J7Nw/IcfK8SxOqbC6bfCb0Zjt5YuU9i3
++zcP0tW2y/FdJrJ+Yyf609XyTSC6T3OkYVGNfGKPnEqr+OPBz5Rce/kBlgaiPYEbC
++FvKonbEbvM4F3jeyqIZHvY2S3uDlQom44/ixJAh+mQIDAQABoy8wLTArBgNVHREE
++JDAighpzcnYwMS5jbGllbnQwMS5leGFtcGxlLm5pbIcECjUAATANBgkqhkiG9w0B
++AQsFAAOCAYEAB5dpURJQauECoLDck3UWxDgPXLNH2r/6nLbewO8498zZjXG6UYnl
++SDbd4fhznZKAHEIwaU+MGV33HQPk8nbgWHvCdsQKfiBpJmw+yzFFkx0HX0VEjlr7
++hxd7TVy/N71eulwihL8mIUrE6fnLc978YgSWrar9iQlcdNa9XwcX75w97rfcCBF/
++EmarxP9DbX8eAbbRGXNTGOQCsHyemWPYV90HefuDOQnedm5ot4eBE7gm5RzJoCPl
++lzn/k8eNCNjOlzT8rSIUicCug30KP8+gm7RqXLNtXTuIyh6bmVRkV1g8TL0m7hHD
++Ewsd9f3ZN7Axcm8d6LpDN0b3cf5tSjAzKcV7N4t+BiKJpEY28P7G9fBTBMA1Unhu
++ECQ62L97Ey+YvGkxQWgCWsT5EaJrP8jg1LOAr9K+/ihwYRjtit7Ey9rJYJSRdmNp
++jG6W9brnvh4cw4Sxjegx92aMDdqoeFcZ/aCN+pp+URzR0IQHokVALcRr6Z+GSggg
++j5x5l+N/KhRz
++-----END CERTIFICATE-----
+diff --git a/bin/tests/system/nsupdate/CA/certs/srv01.client02-expired.example.nil.key b/bin/tests/system/nsupdate/CA/certs/srv01.client02-expired.example.nil.key
+new file mode 100644
+index 0000000..d8f68ac
+--- /dev/null
++++ b/bin/tests/system/nsupdate/CA/certs/srv01.client02-expired.example.nil.key
+@@ -0,0 +1,40 @@
++-----BEGIN PRIVATE KEY-----
++MIIG/wIBADANBgkqhkiG9w0BAQEFAASCBukwggblAgEAAoIBgQDAEScXJTqthaA7
++WQsiZGN9uwUyNU9o1RkrzUa94rZCjAjPCQ2ozVjZG3fbF4r88FXy4VD0/ZCqSRVd
++6ptaR8QvggdGh/YF7xUCpDyh2vxbdTYS9xJQVfi+DH0hkeKS2EE/cf6yF8BoHQm+
++/MQk7O/SXFKpT9ZdMLiraC456YtbxvBkQve4vbKQMiJovDhwLxSuyHxjBNURsgrx
++jhMQsjtp9P464vFYViiTwSiqpxnJkRJD+PUdNFg9Mp8RZ9EfU9Tg1Qx4LG84P+GJ
++abUJPBL0qe7lL8VHZaaC+up4SDGJEbYjiiftfB1t6KugKd5A9PKbYSLanCIy9z34
++TOE4p+LDr6Rnf5Sk/VIliU30mtY1upgg8UvJpc+sclgqzTtKPukEMeKadDLVUmA0
++rQyFAmVYQXQqV5E0VTapFFtFzCgn1226VaPdnwAEpEPCr1yvhlOm1adJqjHWXpJ9
++Jt2N9IeKm0joJfTHNMrP4/eEGTtDx2q42m5vha+NDPt86sdznJsCAwEAAQKCAYBv
++D3wTHiv3+rTUnICbuoDtSx+OENWCQPb1JRYq5tWNVXwie5GycktV/1QnFE4CRNbu
++QuuVPqpQTUJVtDtw0N7Yuc+LMUNJ2x3DEUUeMoqKOBS0krm8SnozKvWQW9MwJmxU
++S46DXMida20fSvoAgCGM+mWyEcBa0rl2JB/WzP0QbNDEqRSldsuyJctP1Mat2AuV
++pciHWVv7h4BcfVL47Jb+hfQcCO6Vrfx4s9DYHRgEPibZtzPFV2dOu97PKcD65HXL
++o30hP9xhhy8nT4oFijEQ9rPi0JvOpvB5bJQ42OAznWByR0uL9ZoXopkYDDemzt7t
++D5F9X/2iH9dv3GA0AiPCF6DjyVMwbh/NOt8oxS+NMY2RPlzA+r9SZpCcyPFk1hMi
++LHzrPU8dwC2GmaMKB3Uw/bA5ufw3IpcbJIZEBJQ5Ttf7zEFcfDo/jidTz3ZOptOT
++kSKoCN73AUlmcx8UoKF9JwcpJq63ww8eef+1HLL5Dk0uM4YSKd15gI6477RgfgEC
++gcEA48ZpMdz4mz7rO0CMyPfOLdHOcxHuZI4oJg6gJ1IBxCnIB1mhy6xn+NdkS5Mm
++/1S6eFuo+DgabXO/A2xSDrJ4Lnlf4H4OjQKCeJdO9JglHjdTzv7TB8Vm/IdGC0Jk
++eDRY1lmkSXcdSmGqPVgd2AHpkcTgLyUb+iIWkIspelsaNNQBHJzd4S/x9Pp/ftrg
++CpfwGKsmNia3n3m21lkeTLtKVsPuK8CAJnCDaEI22mhV83x6grPxA0GVFZ0VHfCL
++qZVhAoHBANfd/oVKWGTiJzlc+aHJAb4XRROQzCL4yi6uspT3h9QN5QiFD7PhgIOg
++mES35mpGocN78oc19zhfD4XLNkLbQuMQhpk0D4MjLfUS/IskFoOJWuQbIBPqrMzY
++Z93DDkiBno2As1IN7fZ9amw7Thcf8Qt6yVNFjIMcfk63VmC+AnPUj4KCes7IuGDH
++SA/LjjiKgMa3g3I5/HVB6q1dyZQggBF3dCJ/V8ecgtdibUfzvvViZ52Hd7XDs1SX
++yCas+IE3ewKBwQC/YSFYBRtZjacmFNl1rkitVQCKzMEp+guf1mAYSZ40TQrFqjj4
++obaGbavWmCCHHpDCufkh/jmuRzdyT9wufyPdoJu/Sws8zaQEYNW1S/S8C66+WHvF
++psYeXiarJTC3kvwlthIErDGPIrpgap5AtXKjyPC4jAySwXuGHXdPWCaPxqXcfa0s
++HRXGSYdAdfUS0ZCpmXw0uZlFRIYsWZrMy/ztJBkE5+yE37p5qlDeeBXnzGo/UaOq
++obr6+w4YJtmiNmECgcEAsSAPqzEgrM7AnpoCn1S+4EpZvL8wMXXw+DMSh5dAVah9
++COudwdzDxb2tk51OLF/+dderXnTSgOfHZeIjiOI+1PAHcYg9Pj5MhG5q2ITpEE9R
++TCBRxuXlmkPrnhRiEO6CudsjyK1zV7D69QoIfoMQF3pN3c0QibiEj3RyJPlkK8T7
++aHxF5ozedVKvd35wGUbUebm02rJny5Mly9FMCQZN74cTvQa+cSSkW7UAtGx1gQWY
++vbKdcIC/Eidk7Q867VQnAoHBAKqiugBoItfhuN1GUI5bqIx0ya4DSVECpSFiF8h3
++eK+bO7uG4OBH+qoAmC8EqQNVPtivxpsA2aBvdoUMTYPu/S5cVFXcMkEJ1jX8L8IZ
++ImE5LXC+SiZO3G9SyHfj+rgwr66G7NWDVJhZ2t/56s4qEdewwR4Vjm99gVvHHAFP
++rrkT9jfHVmozRroL/XAMNITZpJw+vwPMwWOaRncjzyyPp0JWt0h+Wv0+A3SjBIh2
++c+Ctg5Ig6vwr2weVc7s/4jz9Kg==
++-----END PRIVATE KEY-----
+diff --git a/bin/tests/system/nsupdate/CA/certs/srv01.client02-expired.example.nil.pem b/bin/tests/system/nsupdate/CA/certs/srv01.client02-expired.example.nil.pem
+new file mode 100644
+index 0000000..365b493
+--- /dev/null
++++ b/bin/tests/system/nsupdate/CA/certs/srv01.client02-expired.example.nil.pem
+@@ -0,0 +1,93 @@
++Certificate:
++    Data:
++        Version: 3 (0x2)
++        Serial Number: 8122792693893010843 (0x70b9f4eb2fa1959b)
++        Signature Algorithm: sha256WithRSAEncryption
++        Issuer: C=UA, ST=Kharkiv Oblast', L=Kharkiv, O=Internet Systems Consortium, CN=ca.test.example.com
++        Validity
++            Not Before: Sep  7 08:14:18 2022 GMT
++            Not After : Sep  8 08:14:18 2022 GMT
++        Subject: CN=srv01.client02-expired.example.nil
++        Subject Public Key Info:
++            Public Key Algorithm: rsaEncryption
++                RSA Public-Key: (3072 bit)
++                Modulus:
++                    00:c0:11:27:17:25:3a:ad:85:a0:3b:59:0b:22:64:
++                    63:7d:bb:05:32:35:4f:68:d5:19:2b:cd:46:bd:e2:
++                    b6:42:8c:08:cf:09:0d:a8:cd:58:d9:1b:77:db:17:
++                    8a:fc:f0:55:f2:e1:50:f4:fd:90:aa:49:15:5d:ea:
++                    9b:5a:47:c4:2f:82:07:46:87:f6:05:ef:15:02:a4:
++                    3c:a1:da:fc:5b:75:36:12:f7:12:50:55:f8:be:0c:
++                    7d:21:91:e2:92:d8:41:3f:71:fe:b2:17:c0:68:1d:
++                    09:be:fc:c4:24:ec:ef:d2:5c:52:a9:4f:d6:5d:30:
++                    b8:ab:68:2e:39:e9:8b:5b:c6:f0:64:42:f7:b8:bd:
++                    b2:90:32:22:68:bc:38:70:2f:14:ae:c8:7c:63:04:
++                    d5:11:b2:0a:f1:8e:13:10:b2:3b:69:f4:fe:3a:e2:
++                    f1:58:56:28:93:c1:28:aa:a7:19:c9:91:12:43:f8:
++                    f5:1d:34:58:3d:32:9f:11:67:d1:1f:53:d4:e0:d5:
++                    0c:78:2c:6f:38:3f:e1:89:69:b5:09:3c:12:f4:a9:
++                    ee:e5:2f:c5:47:65:a6:82:fa:ea:78:48:31:89:11:
++                    b6:23:8a:27:ed:7c:1d:6d:e8:ab:a0:29:de:40:f4:
++                    f2:9b:61:22:da:9c:22:32:f7:3d:f8:4c:e1:38:a7:
++                    e2:c3:af:a4:67:7f:94:a4:fd:52:25:89:4d:f4:9a:
++                    d6:35:ba:98:20:f1:4b:c9:a5:cf:ac:72:58:2a:cd:
++                    3b:4a:3e:e9:04:31:e2:9a:74:32:d5:52:60:34:ad:
++                    0c:85:02:65:58:41:74:2a:57:91:34:55:36:a9:14:
++                    5b:45:cc:28:27:d7:6d:ba:55:a3:dd:9f:00:04:a4:
++                    43:c2:af:5c:af:86:53:a6:d5:a7:49:aa:31:d6:5e:
++                    92:7d:26:dd:8d:f4:87:8a:9b:48:e8:25:f4:c7:34:
++                    ca:cf:e3:f7:84:19:3b:43:c7:6a:b8:da:6e:6f:85:
++                    af:8d:0c:fb:7c:ea:c7:73:9c:9b
++                Exponent: 65537 (0x10001)
++        X509v3 extensions:
++            X509v3 Subject Alternative Name: 
++                DNS:srv01.client02-expired.example.nil, IP Address:10.53.0.1
++    Signature Algorithm: sha256WithRSAEncryption
++         18:f1:7c:24:5b:d2:03:b0:60:0e:60:e6:32:f9:a7:47:d1:e4:
++         bd:3f:a3:21:53:90:84:9a:c6:2c:87:b2:16:28:95:07:a3:2a:
++         c3:33:8f:60:70:3f:26:58:be:ec:a2:6c:44:89:d3:4e:ef:bb:
++         ce:af:9b:5f:15:06:03:21:74:e3:6f:2a:dc:5c:19:4e:d3:cb:
++         ba:c3:5f:d8:76:89:59:50:82:69:5f:a1:ac:9f:be:79:e1:22:
++         12:37:f9:d3:2e:00:35:03:03:9d:08:24:45:65:7a:e9:72:31:
++         e1:67:44:32:17:25:dd:b9:72:eb:c6:40:d7:5d:8d:5f:00:48:
++         07:09:0d:3c:4c:a1:f1:05:4b:05:9b:2b:5a:21:09:46:f4:17:
++         7a:cf:34:87:ad:bf:ef:bd:56:74:d7:1a:8f:07:ce:70:b1:aa:
++         4d:82:4f:08:dc:56:27:f9:21:20:b8:06:c7:29:b4:8e:36:82:
++         b8:43:85:1c:2d:9f:be:2d:b9:9d:40:de:52:55:6a:2e:0b:28:
++         33:fc:f8:1b:70:e9:c5:46:50:f3:05:be:8d:ed:99:ec:f1:8c:
++         51:8a:1c:4b:95:f4:c4:dd:cd:42:74:bc:6f:66:64:54:b8:c1:
++         6e:c8:3d:e9:fe:10:02:61:50:77:38:b9:b0:b8:13:37:8f:0e:
++         5b:49:92:3a:9d:9a:60:51:68:99:8a:d5:7e:92:71:7e:fa:db:
++         52:37:4d:f9:0d:6c:3b:79:a3:b9:16:b7:95:00:ea:eb:17:54:
++         e2:50:d7:a5:08:54:58:2c:79:66:01:4b:95:65:ed:b8:81:f7:
++         4c:fa:f8:89:37:ad:d9:dc:c9:75:9d:02:3e:e5:92:b3:03:ab:
++         70:69:83:f5:6c:a6:27:7e:2e:fc:9d:b2:59:0a:43:ad:3f:55:
++         2f:5d:ec:ef:52:f0:3e:be:b5:d6:e2:c3:91:9d:dd:5d:e1:9e:
++         e6:18:90:0b:6a:85:f8:e3:83:2a:7c:91:c3:52:1c:6d:aa:2b:
++         44:b8:6f:2b:af:6e
++-----BEGIN CERTIFICATE-----
++MIIEYzCCAsugAwIBAgIIcLn06y+hlZswDQYJKoZIhvcNAQELBQAwfTELMAkGA1UE
++BhMCVUExGDAWBgNVBAgMD0toYXJraXYgT2JsYXN0JzEQMA4GA1UEBwwHS2hhcmtp
++djEkMCIGA1UECgwbSW50ZXJuZXQgU3lzdGVtcyBDb25zb3J0aXVtMRwwGgYDVQQD
++DBNjYS50ZXN0LmV4YW1wbGUuY29tMB4XDTIyMDkwNzA4MTQxOFoXDTIyMDkwODA4
++MTQxOFowLTErMCkGA1UEAwwic3J2MDEuY2xpZW50MDItZXhwaXJlZC5leGFtcGxl
++Lm5pbDCCAaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBAMARJxclOq2FoDtZ
++CyJkY327BTI1T2jVGSvNRr3itkKMCM8JDajNWNkbd9sXivzwVfLhUPT9kKpJFV3q
++m1pHxC+CB0aH9gXvFQKkPKHa/Ft1NhL3ElBV+L4MfSGR4pLYQT9x/rIXwGgdCb78
++xCTs79JcUqlP1l0wuKtoLjnpi1vG8GRC97i9spAyImi8OHAvFK7IfGME1RGyCvGO
++ExCyO2n0/jri8VhWKJPBKKqnGcmREkP49R00WD0ynxFn0R9T1ODVDHgsbzg/4Ylp
++tQk8EvSp7uUvxUdlpoL66nhIMYkRtiOKJ+18HW3oq6Ap3kD08pthItqcIjL3PfhM
++4Tin4sOvpGd/lKT9UiWJTfSa1jW6mCDxS8mlz6xyWCrNO0o+6QQx4pp0MtVSYDSt
++DIUCZVhBdCpXkTRVNqkUW0XMKCfXbbpVo92fAASkQ8KvXK+GU6bVp0mqMdZekn0m
++3Y30h4qbSOgl9Mc0ys/j94QZO0PHarjabm+Fr40M+3zqx3OcmwIDAQABozcwNTAz
++BgNVHREELDAqgiJzcnYwMS5jbGllbnQwMi1leHBpcmVkLmV4YW1wbGUubmlshwQK
++NQABMA0GCSqGSIb3DQEBCwUAA4IBgQAY8XwkW9IDsGAOYOYy+adH0eS9P6MhU5CE
++msYsh7IWKJUHoyrDM49gcD8mWL7somxEidNO77vOr5tfFQYDIXTjbyrcXBlO08u6
++w1/YdolZUIJpX6Gsn7554SISN/nTLgA1AwOdCCRFZXrpcjHhZ0QyFyXduXLrxkDX
++XY1fAEgHCQ08TKHxBUsFmytaIQlG9Bd6zzSHrb/vvVZ01xqPB85wsapNgk8I3FYn
+++SEguAbHKbSONoK4Q4UcLZ++LbmdQN5SVWouCygz/PgbcOnFRlDzBb6N7Zns8YxR
++ihxLlfTE3c1CdLxvZmRUuMFuyD3p/hACYVB3OLmwuBM3jw5bSZI6nZpgUWiZitV+
++knF++ttSN035DWw7eaO5FreVAOrrF1TiUNelCFRYLHlmAUuVZe24gfdM+viJN63Z
++3Ml1nQI+5ZKzA6twaYP1bKYnfi78nbJZCkOtP1UvXezvUvA+vrXW4sORnd1d4Z7m
++GJALaoX444MqfJHDUhxtqitEuG8rr24=
++-----END CERTIFICATE-----
+diff --git a/bin/tests/system/nsupdate/CA/certs/srv01.crt01.example.nil.key b/bin/tests/system/nsupdate/CA/certs/srv01.crt01.example.nil.key
+new file mode 100644
+index 0000000..8a1f5dc
+--- /dev/null
++++ b/bin/tests/system/nsupdate/CA/certs/srv01.crt01.example.nil.key
+@@ -0,0 +1,40 @@
++-----BEGIN PRIVATE KEY-----
++MIIG/AIBADANBgkqhkiG9w0BAQEFAASCBuYwggbiAgEAAoIBgQC0mmOYBK29qym/
++InBUMN/Ha3dduF4LzQ6gbHQ350t40Zbaypl9krHkGgoetBy+7syVjFIDk4XhQENo
++hoa8amJt1grK7k+TLe5r33r23PpEpjmALDh8ic3Zo5ns6CtIbYRBPQ4aH2heF4iP
++pdpNHDYmrrR+0v6iWdVnOlbCIWUN3Zdv8OW0HoeulzUN9Juu3Io+KKq4oqvunbLF
++kfZxmaWGyzGcBdablBNGqZrJpVVfbMzQhCfisbVzOQh/gC8EJpYMjSmbvl7MOa+i
++24KCVwfmskrZPch5bmdh80g3qE+fs8+EtlAIPemF6al2UIDnLG9llcviI0FYOXDn
++eCk9wtYgfCuHML2Yh2PtSq257XpLE6E9Yl62dGTvJaPdk0eq0yV+KtcJG1xZUPHU
++xpzyZIp8y8xSN1CIS4Q1QFEOoQaiYLaw44/52I5Fd30OfRGSIhUPozeExCXcFLQg
++ercWlnLUv01d0qtxQ0S+h0TSuHT3hj/SXd1e5nSr+8yjXaaEgAsCAwEAAQKCAYAG
++wzkzeglfbsdTZuC55lKazwVbNwoeewEvNKBtb3W+AmsZqjhxIUsT9X2nhKsG4z45
++41U22RFMS/G6Oj9VUs54umkRDDdilXe2Blo+YCvm4iqJCB7dWvOgUKX03wSv45nu
++L3EVvVNVIqB0cItqE8JbVHNhxFjQj3iUMvUIs+Nqz39aK7UON45xFSxhZ2Vk+NEc
++Xr11yHGTr8f/6eVGf7BZCcbDxtwwWy0Vmkg3gL9foV1R+YDc1jarJ9mPnKcmCqPH
++lW5aT5putR0kO1vO6Rh7YfbHsqw334B9v1yjB4TgaJBKVHz5Z8KTvDFHodMtLqCC
++WV61O2h7gh4mQ6lEX5tjArqYdKMuWLAhZ+9AK9sSs4k+/nlvEbqAOCbkx7UmrZoF
++QkYfDt2Gjrk7WLwb9CCFIH0a2EEB2Fms1iHBK++S3iA4w0kfbePP0mo4GTsTwA45
++DKDbYByzJzVUvGmowMaaypE548sopQ9K4kQJ9okLV+Gc1V7fjklYIIBmwDgqfIEC
++gcEA5Xt0qFjYn4H2gu2xyD0etx83CjKUx0mjwPvdwLg79HMb9P+OTTU+NzsHTa2I
++CTEJ1gA4VkqOtKxEBJQarQmJnVL/fiIp88h9fmLBQ48HLefH33S+bF3VWvKOgJeY
++uVyyWnhTwHNQv3RsO+DEcjqG3aJ2vdzCnDLBr9ATFV8uzpk1Op0h7QljUbhHv1mS
++ip2yQVeuJwtWFixjqEp7BuTluqk/UlGP39PBjgG04Tpw3MkiZNJgk/kSnN+YYOiu
++i91rAoHBAMl4/WAaIL5lHiyakHAmE0fwUm+LUKPG1rF22qvqdBFV6OE14/VgTKNP
++LfcS7Ulzmt7hM7fbcJ0FYxeyPbbQRjBRsGXFzLU96VgoUxoI/IyFXFY83UJ0s63L
++RhZmg4GNvpO0qfOjL4wQtB3N6LPhxpF+pLkkHXSdFkUyocaXGUGOBC+ZEBaCd8Lm
++2GlGoi/f+zSl4xSY4crspS7GNG2+jcXh5K/OMdjEb1/tyRYnHf0D89WNmr10EeYG
++Pe9alaDv4QKBwDROcYa1yZqB6who2W8Ez216BfejE9pg5JxmTGNTGwda/XJYlbzv
++d+Dq6X1BIpLFxLIslqrEj8aKxW4tu+7ZD672bhn3+4v/lOsr41Vc0owaGqrKV2Un
++9iumweh5pWwKvvR0HNLu9ebNyKXVU7GduYPnNh2MpicoQpGqYc8rROX+ce2MR2Fa
++FHNaB7CL4CUMUMcoDyADK3oeYBDJ+UTXA64KSc6fnKWuBJ4zsWDtCzCn/9jvQug3
++i5CKPpdIMhDbRQKBwEekz61B/UzXVnCUEjLfR1H4osfpqaZjyerXkhE6UUXs3+Be
++Mo8KTJZyTK0kvN62zmbdfG+wCA6+YKuHhayhyaPbGLhIK3Bz8KuZw1tpwK0Tq287
++O48rQs3VkDndAHysdA3AXAM4j2rmcbZ7h3mYGu2YNGll71eNmOLIi4C8MI4AO3rV
++mkP25zGWt3RQWtJdes4RA3xKlVh86IyGjRRNg8rPdmwSDeXAjL53J1/KTz6vDiFt
++to4SXV8H7zRTaQwO4QKBwBwMU2zjMYXLJq0LAmn3h4h6CVZjPrqzR8PeSd/YM831
++qdH7OvnkadqIdqMOo6BUA9PvUIY/B5c5zSSOJg9gh1PJ3vDLIZY23zkXigh7poBe
++YW6/PLvGQJ0Rzyz5pf6uPX8AWkAqTyI1Ox3NdxzirarxWDPznvA2KsVxVF/jxnvr
++TD/R5kCQUcxZuInguahGYd1JF3dArYh6NKRPyVO0r73LfVeZ+udlo/+ZMNVGlNNF
++v3Tmy/b2gUdEwuKFCxx97g==
++-----END PRIVATE KEY-----
+diff --git a/bin/tests/system/nsupdate/CA/certs/srv01.crt01.example.nil.pem b/bin/tests/system/nsupdate/CA/certs/srv01.crt01.example.nil.pem
+new file mode 100644
+index 0000000..4a4556c
+--- /dev/null
++++ b/bin/tests/system/nsupdate/CA/certs/srv01.crt01.example.nil.pem
+@@ -0,0 +1,93 @@
++Certificate:
++    Data:
++        Version: 3 (0x2)
++        Serial Number: 8122792693893010840 (0x70b9f4eb2fa19598)
++        Signature Algorithm: sha256WithRSAEncryption
++        Issuer: C=UA, ST=Kharkiv Oblast', L=Kharkiv, O=Internet Systems Consortium, CN=ca.test.example.com
++        Validity
++            Not Before: Sep  7 20:28:03 2022 GMT
++            Not After : Aug 30 20:28:03 2052 GMT
++        Subject: CN=srv01.crt01.example.nil
++        Subject Public Key Info:
++            Public Key Algorithm: rsaEncryption
++                RSA Public-Key: (3072 bit)
++                Modulus:
++                    00:b4:9a:63:98:04:ad:bd:ab:29:bf:22:70:54:30:
++                    df:c7:6b:77:5d:b8:5e:0b:cd:0e:a0:6c:74:37:e7:
++                    4b:78:d1:96:da:ca:99:7d:92:b1:e4:1a:0a:1e:b4:
++                    1c:be:ee:cc:95:8c:52:03:93:85:e1:40:43:68:86:
++                    86:bc:6a:62:6d:d6:0a:ca:ee:4f:93:2d:ee:6b:df:
++                    7a:f6:dc:fa:44:a6:39:80:2c:38:7c:89:cd:d9:a3:
++                    99:ec:e8:2b:48:6d:84:41:3d:0e:1a:1f:68:5e:17:
++                    88:8f:a5:da:4d:1c:36:26:ae:b4:7e:d2:fe:a2:59:
++                    d5:67:3a:56:c2:21:65:0d:dd:97:6f:f0:e5:b4:1e:
++                    87:ae:97:35:0d:f4:9b:ae:dc:8a:3e:28:aa:b8:a2:
++                    ab:ee:9d:b2:c5:91:f6:71:99:a5:86:cb:31:9c:05:
++                    d6:9b:94:13:46:a9:9a:c9:a5:55:5f:6c:cc:d0:84:
++                    27:e2:b1:b5:73:39:08:7f:80:2f:04:26:96:0c:8d:
++                    29:9b:be:5e:cc:39:af:a2:db:82:82:57:07:e6:b2:
++                    4a:d9:3d:c8:79:6e:67:61:f3:48:37:a8:4f:9f:b3:
++                    cf:84:b6:50:08:3d:e9:85:e9:a9:76:50:80:e7:2c:
++                    6f:65:95:cb:e2:23:41:58:39:70:e7:78:29:3d:c2:
++                    d6:20:7c:2b:87:30:bd:98:87:63:ed:4a:ad:b9:ed:
++                    7a:4b:13:a1:3d:62:5e:b6:74:64:ef:25:a3:dd:93:
++                    47:aa:d3:25:7e:2a:d7:09:1b:5c:59:50:f1:d4:c6:
++                    9c:f2:64:8a:7c:cb:cc:52:37:50:88:4b:84:35:40:
++                    51:0e:a1:06:a2:60:b6:b0:e3:8f:f9:d8:8e:45:77:
++                    7d:0e:7d:11:92:22:15:0f:a3:37:84:c4:25:dc:14:
++                    b4:20:7a:b7:16:96:72:d4:bf:4d:5d:d2:ab:71:43:
++                    44:be:87:44:d2:b8:74:f7:86:3f:d2:5d:dd:5e:e6:
++                    74:ab:fb:cc:a3:5d:a6:84:80:0b
++                Exponent: 65537 (0x10001)
++        X509v3 extensions:
++            X509v3 Subject Alternative Name: 
++                DNS:srv01.crt01.example.nil, IP Address:10.53.0.1
++    Signature Algorithm: sha256WithRSAEncryption
++         94:15:c0:4a:f1:aa:15:30:f7:cb:fe:f9:fa:ba:5f:f0:18:1f:
++         7e:44:9a:b1:d4:9c:f9:78:d3:a7:c7:65:f2:d1:48:62:f4:cb:
++         2f:20:ea:7c:af:08:cf:db:e2:0f:ab:c0:22:38:16:c5:0c:e5:
++         c7:6e:34:b1:ed:f6:02:1a:69:c0:09:d1:43:b3:30:77:fc:00:
++         07:1b:da:88:97:5b:28:4e:e6:92:ca:00:cc:86:66:a9:a9:0a:
++         75:be:74:88:7d:09:52:e7:a9:82:8f:a9:62:5e:b3:19:64:14:
++         e5:54:9e:6d:9c:98:39:8b:1f:92:92:59:f9:a2:46:75:96:11:
++         71:8a:c8:71:05:10:2a:b8:f3:a4:19:db:eb:05:17:0a:dd:98:
++         2c:58:54:3a:7f:8c:c2:26:9e:62:ca:04:dd:3c:99:1f:a0:64:
++         69:fb:d6:04:c1:0b:8c:62:f6:2d:ea:bc:6c:a9:39:7b:f1:20:
++         b8:b7:04:3c:a7:65:fa:1f:db:22:e2:5b:8b:91:75:60:be:e1:
++         1e:50:13:23:d5:4b:93:87:20:ec:46:6f:5f:94:dc:b1:60:d1:
++         79:4b:5e:76:c9:6d:0d:be:a6:9a:6b:67:8b:a7:48:7e:51:b5:
++         9b:9d:ec:a6:0c:c1:b3:d9:0b:26:8b:f2:7c:cf:61:d0:a2:a0:
++         90:90:18:6b:b4:ca:56:b8:5e:5a:8b:78:71:c4:d1:fc:15:30:
++         0a:03:26:74:85:3d:6c:ed:d3:e1:c9:c1:b0:d4:0c:b9:f3:04:
++         93:0d:e3:a6:2c:a7:ee:e0:24:0d:dd:37:fc:6b:09:d5:b5:55:
++         33:12:82:cf:f2:ba:0f:b0:e2:ce:f7:c0:ac:2c:7f:ab:f9:dd:
++         87:b1:9b:95:f2:d7:32:98:dd:4c:b3:28:b7:0d:2b:2f:62:65:
++         ce:59:fb:95:d4:5f:9d:fd:83:5a:01:3b:5f:48:5f:3c:fa:4b:
++         52:91:66:e1:49:8e:cd:09:78:f5:ce:f8:cd:5c:85:3e:ad:bd:
++         1c:4e:e0:3f:0a:8b
++-----BEGIN CERTIFICATE-----
++MIIETzCCAregAwIBAgIIcLn06y+hlZgwDQYJKoZIhvcNAQELBQAwfTELMAkGA1UE
++BhMCVUExGDAWBgNVBAgMD0toYXJraXYgT2JsYXN0JzEQMA4GA1UEBwwHS2hhcmtp
++djEkMCIGA1UECgwbSW50ZXJuZXQgU3lzdGVtcyBDb25zb3J0aXVtMRwwGgYDVQQD
++DBNjYS50ZXN0LmV4YW1wbGUuY29tMCAXDTIyMDkwNzIwMjgwM1oYDzIwNTIwODMw
++MjAyODAzWjAiMSAwHgYDVQQDDBdzcnYwMS5jcnQwMS5leGFtcGxlLm5pbDCCAaIw
++DQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBALSaY5gErb2rKb8icFQw38drd124
++XgvNDqBsdDfnS3jRltrKmX2SseQaCh60HL7uzJWMUgOTheFAQ2iGhrxqYm3WCsru
++T5Mt7mvfevbc+kSmOYAsOHyJzdmjmezoK0hthEE9DhofaF4XiI+l2k0cNiautH7S
++/qJZ1Wc6VsIhZQ3dl2/w5bQeh66XNQ30m67cij4oqriiq+6dssWR9nGZpYbLMZwF
++1puUE0apmsmlVV9szNCEJ+KxtXM5CH+ALwQmlgyNKZu+Xsw5r6LbgoJXB+ayStk9
++yHluZ2HzSDeoT5+zz4S2UAg96YXpqXZQgOcsb2WVy+IjQVg5cOd4KT3C1iB8K4cw
++vZiHY+1KrbnteksToT1iXrZ0ZO8lo92TR6rTJX4q1wkbXFlQ8dTGnPJkinzLzFI3
++UIhLhDVAUQ6hBqJgtrDjj/nYjkV3fQ59EZIiFQ+jN4TEJdwUtCB6txaWctS/TV3S
++q3FDRL6HRNK4dPeGP9Jd3V7mdKv7zKNdpoSACwIDAQABoywwKjAoBgNVHREEITAf
++ghdzcnYwMS5jcnQwMS5leGFtcGxlLm5pbIcECjUAATANBgkqhkiG9w0BAQsFAAOC
++AYEAlBXASvGqFTD3y/75+rpf8BgffkSasdSc+XjTp8dl8tFIYvTLLyDqfK8Iz9vi
++D6vAIjgWxQzlx240se32AhppwAnRQ7Mwd/wABxvaiJdbKE7mksoAzIZmqakKdb50
++iH0JUuepgo+pYl6zGWQU5VSebZyYOYsfkpJZ+aJGdZYRcYrIcQUQKrjzpBnb6wUX
++Ct2YLFhUOn+MwiaeYsoE3TyZH6BkafvWBMELjGL2Leq8bKk5e/EguLcEPKdl+h/b
++IuJbi5F1YL7hHlATI9VLk4cg7EZvX5TcsWDReUtedsltDb6mmmtni6dIflG1m53s
++pgzBs9kLJovyfM9h0KKgkJAYa7TKVrheWot4ccTR/BUwCgMmdIU9bO3T4cnBsNQM
++ufMEkw3jpiyn7uAkDd03/GsJ1bVVMxKCz/K6D7DizvfArCx/q/ndh7GblfLXMpjd
++TLMotw0rL2Jlzln7ldRfnf2DWgE7X0hfPPpLUpFm4UmOzQl49c74zVyFPq29HE7g
++PwqL
++-----END CERTIFICATE-----
+diff --git a/bin/tests/system/nsupdate/CA/certs/srv01.crt02-expired.example.nil.key b/bin/tests/system/nsupdate/CA/certs/srv01.crt02-expired.example.nil.key
+new file mode 100644
+index 0000000..307d26d
+--- /dev/null
++++ b/bin/tests/system/nsupdate/CA/certs/srv01.crt02-expired.example.nil.key
+@@ -0,0 +1,40 @@
++-----BEGIN PRIVATE KEY-----
++MIIG/gIBADANBgkqhkiG9w0BAQEFAASCBugwggbkAgEAAoIBgQDsLIgBtYs6dFYN
++V7N1/QVYBe2Kq+gpDvFSNC4iYm5BdP94M7T/FXP6zpAQpP7SZhR7C3l71iCI+UEx
++FJpJNow4dEvz4lHn5W+9ZTjmnDCAPyRW9mieCXaBW1mBRFafHD9I8JW/YEAp36xC
++PcNvhS3DDgi29xIqUQC/z/5srtd93sFy+DIDX8k/St7l+iSQRvBKXwnYk0y/HGFM
++0tzbbPivc1u3O3robRy7JiNHh/1QBg/xtYiKqCVpV+NGO9JrUvtaAfaW6SrPE+cW
++TP1a9h8Ljfclo2jXFfxcSEkF4oUkcFex2AUkriY6AJtyqEcFxfN8LfJYcjf7wYtP
++Qo/dmqxbrm8hYq0pgbmLS2z/YZkPfAnTbQAgLbEMAGyZTJLcDhEt57p7x8ixoxph
+++Mwsrxe228w2Av77ZhV3hHDNQiW3FmQorp2MgYWg4FCCqujprFH8K2NEsQi4kNeM
++HCOyGwhZhdXdOUT3R15ICDTrLN91Rwi2tuYy7XZ0d849Tf4CsTMCAwEAAQKCAYA+
++B7AtKr6HutiDJp63BZ6qsNvkCSSv7AHMAnJ/i3TD8nPK4WHPgZX1sN070eov3qnQ
++a4Ib2XCwKS9LMcsYIaCQj1MHmlDC5IsFpplcUHeYp3zm7k8p+vhKH3ERt548qhGh
++GbdrDV+s39eBinFTUBpl2cDGNXxq6t2Ug4+iggWNRL1wcenI4xabbhG/O4Tw9ADW
++t8GBRabppw2TPOrPIv7qLhVPueqdM1NRgEHR3tDUfNMhO/nB2UoCMhg6cSniEGf8
++32NDQHI7ajIcETnn9z0tAP67+w5VUYMlP3+VGr8v4UZCL6Qal9Swv4XWPqHjHoIi
++q5by4H6HEYeoUPT5hCJjMdXlHrWWUgsX/YdgY4tJJBowMR6rovA7Ypy71FxRnXkP
++2iD36jZmDI1mBQ41Yx7P5iM+veRQmBOH/x70Bd9ZbSLlmeTX5dhjAxNShjZxxeUy
++QbQGe3JLzdCGzRY9TKFMmLa/qs+Ggqxopdh4AZuHtQpKUej6g9GI9Eo0IIWTKEkC
++gcEA+EC1ms0MEIIq/JJrsN4ByEyZXbuNKny/04h8dfkT0lTXk8QihQLke6ZLLOl9
++mwgO9NOHkghtU9wdNXg/dNR2VDevUZCjIlYZT6stjEX7X0oNACJwSeBwEXxn6I94
++umuvJ9hq9WchTnQA4lrIXCETIUxThjm7jfJe9RKzghQkCfGnxzclXg0viqxvm21j
++eg0iide23y9xpFd8Qn1oq+hhzcKqHWdkHuDjRJD5gfAEPD7MJ7oT5jR4szQoIUcP
++4C+NAoHBAPOLUwAwcY5zUBAZ7oZ8wRgnAFZjHdYYWDr04ahA1DpwPeX67MczdGud
++L7hUq3APa3qcj4hrDL2jkF6FkbURhtdguMccb4hBENyYr+qjoTAfYJIZwJ9akQ/j
++x8u+5kGsN+ozaKikHFsI2xXHJhbShICL3sIfNeqGFB2onp/dv8WdywTnSf2aXGjf
++NFvVJYnaEOGiTM7uIf/F0n8Iae8HSdPZXtDTXNjnLFzzHjvFe1mfyYO55BDkxmr2
++PDnhVkbTvwKBwQCNPwQU16WNnwImQojTUP1ioXKBSjy/d8sM6BMobFdCzNL7WBTr
++6QFm+O681vyIQMWBtvjjtbe+hvZ3fbtdFaVdtXEiz1CCMMql8ZcwwICNbuyGrxGE
++dxZMXKQiRb9DEhHOcewpRExG/umh4FUvVgI0Z+D99csosEYm2kUYNa1rmvsC9fVk
++1cu+8u1tWYfH4cFM/FcoFS5revtQOVpctRMwpxlzMWhdyUaFtJbBv3YpcPFniQ/Z
++YvFpxLswc+Ysf+ECgcEAhEeMUXH+e6zOM7CiCZIBHykv2bwEHKEkawFO/6AWpZcJ
++R7y+loOwHDNIFAqJA1icvAAFRcc/KFGKvIw30+0tHBaAxkT/nzYX/nlAM2Wkywp/
++3Vr3cJY0bDj/7/5D+i+cPyylD9PzQs7QkEeWvJajOV6/Ixjoo/UnP+SyI4rB+of2
++GTe2zHPm9V8mhSqENReoS6Vnqo1VEiNUbYMYZqfCxbou8aWbrIQDaIj0RurAULGl
++NlLlOPfJfZc4pwdpYRbpAoHAJ7Vxdfn1ec+8xIpjn6dQzWDQWrOw+4pyi54sPlVb
++RUWC9nYDbTwEKkWdQ0FdyJkU7tiYIIFlVNfPAa1lkujIiC5zxe41VJ1598pXPEXn
++a6UB1yn2Ay7kmCq7/qOD6IRkAS8TKyzM6Z7nFgglMEPPdzYBkeKP/aWl75el1B4e
++mpGz7o6u6kSHXt0UWZ7VT9AspEw0oyHIoaXmYHvpXjGtWghn6MKPMngKIb87Xjvt
++bKvcUjDKJOb0BURXpKzS8Rf9
++-----END PRIVATE KEY-----
+diff --git a/bin/tests/system/nsupdate/CA/certs/srv01.crt02-expired.example.nil.pem b/bin/tests/system/nsupdate/CA/certs/srv01.crt02-expired.example.nil.pem
+new file mode 100644
+index 0000000..3fa0b9a
+--- /dev/null
++++ b/bin/tests/system/nsupdate/CA/certs/srv01.crt02-expired.example.nil.pem
+@@ -0,0 +1,93 @@
++Certificate:
++    Data:
++        Version: 3 (0x2)
++        Serial Number: 8122792693893010841 (0x70b9f4eb2fa19599)
++        Signature Algorithm: sha256WithRSAEncryption
++        Issuer: C=UA, ST=Kharkiv Oblast', L=Kharkiv, O=Internet Systems Consortium, CN=ca.test.example.com
++        Validity
++            Not Before: Sep  6 20:34:09 2022 GMT
++            Not After : Sep  7 20:34:09 2022 GMT
++        Subject: CN=srv01.crt02-expired.example.nil
++        Subject Public Key Info:
++            Public Key Algorithm: rsaEncryption
++                RSA Public-Key: (3072 bit)
++                Modulus:
++                    00:ec:2c:88:01:b5:8b:3a:74:56:0d:57:b3:75:fd:
++                    05:58:05:ed:8a:ab:e8:29:0e:f1:52:34:2e:22:62:
++                    6e:41:74:ff:78:33:b4:ff:15:73:fa:ce:90:10:a4:
++                    fe:d2:66:14:7b:0b:79:7b:d6:20:88:f9:41:31:14:
++                    9a:49:36:8c:38:74:4b:f3:e2:51:e7:e5:6f:bd:65:
++                    38:e6:9c:30:80:3f:24:56:f6:68:9e:09:76:81:5b:
++                    59:81:44:56:9f:1c:3f:48:f0:95:bf:60:40:29:df:
++                    ac:42:3d:c3:6f:85:2d:c3:0e:08:b6:f7:12:2a:51:
++                    00:bf:cf:fe:6c:ae:d7:7d:de:c1:72:f8:32:03:5f:
++                    c9:3f:4a:de:e5:fa:24:90:46:f0:4a:5f:09:d8:93:
++                    4c:bf:1c:61:4c:d2:dc:db:6c:f8:af:73:5b:b7:3b:
++                    7a:e8:6d:1c:bb:26:23:47:87:fd:50:06:0f:f1:b5:
++                    88:8a:a8:25:69:57:e3:46:3b:d2:6b:52:fb:5a:01:
++                    f6:96:e9:2a:cf:13:e7:16:4c:fd:5a:f6:1f:0b:8d:
++                    f7:25:a3:68:d7:15:fc:5c:48:49:05:e2:85:24:70:
++                    57:b1:d8:05:24:ae:26:3a:00:9b:72:a8:47:05:c5:
++                    f3:7c:2d:f2:58:72:37:fb:c1:8b:4f:42:8f:dd:9a:
++                    ac:5b:ae:6f:21:62:ad:29:81:b9:8b:4b:6c:ff:61:
++                    99:0f:7c:09:d3:6d:00:20:2d:b1:0c:00:6c:99:4c:
++                    92:dc:0e:11:2d:e7:ba:7b:c7:c8:b1:a3:1a:61:f8:
++                    cc:2c:af:17:b6:db:cc:36:02:fe:fb:66:15:77:84:
++                    70:cd:42:25:b7:16:64:28:ae:9d:8c:81:85:a0:e0:
++                    50:82:aa:e8:e9:ac:51:fc:2b:63:44:b1:08:b8:90:
++                    d7:8c:1c:23:b2:1b:08:59:85:d5:dd:39:44:f7:47:
++                    5e:48:08:34:eb:2c:df:75:47:08:b6:b6:e6:32:ed:
++                    76:74:77:ce:3d:4d:fe:02:b1:33
++                Exponent: 65537 (0x10001)
++        X509v3 extensions:
++            X509v3 Subject Alternative Name: 
++                DNS:srv01.crt02-expired.example.nil, IP Address:10.53.0.1
++    Signature Algorithm: sha256WithRSAEncryption
++         2a:52:c4:cb:a9:2f:f7:2b:ed:04:b5:03:d5:06:59:ed:5c:7c:
++         b7:00:9e:c4:33:90:fe:d0:b0:18:f3:f2:06:30:54:18:fe:34:
++         cb:ea:61:4f:9c:23:67:3c:ae:ed:20:df:82:52:ec:59:88:45:
++         ad:3c:6c:a7:34:24:1c:4d:66:ab:71:3d:59:8c:ef:cd:a0:e2:
++         7b:59:2d:43:94:cd:f5:0a:3c:4e:81:24:e8:fd:c6:d0:fd:ad:
++         6f:cc:29:5b:67:0b:b7:ee:43:38:a4:91:c2:d9:3b:f8:d6:97:
++         bc:92:dd:ec:a1:ab:85:35:44:f4:0a:df:ad:8d:8c:52:c3:49:
++         7e:39:10:a1:13:43:78:71:e2:92:aa:31:3d:d9:94:15:7f:86:
++         c8:aa:b4:a1:6d:bf:eb:55:b1:d7:41:6f:c3:7d:88:5e:9c:b7:
++         b1:4b:0d:a7:17:4f:3e:4a:46:3f:6f:48:27:8c:d0:e5:51:fc:
++         42:ba:c5:b9:4f:63:6f:2e:f2:fd:0c:c0:6e:23:b4:59:93:68:
++         a4:2d:16:ce:f4:7b:3a:45:1d:a0:6e:98:0b:f7:6a:e6:75:0c:
++         db:56:19:6b:88:f0:7f:6b:08:f8:fc:bb:d1:3f:25:25:1a:6c:
++         8e:34:cb:91:18:54:d5:2d:ce:9c:d0:b7:c3:bc:b5:0a:e0:b9:
++         73:6f:4d:ad:6b:3c:b6:49:ef:c0:10:13:c7:0a:78:4d:98:7d:
++         cb:84:a1:29:40:8c:dd:31:7d:ae:c4:f5:25:5d:b9:74:b2:f5:
++         e2:2b:e0:43:c8:50:61:a3:a8:26:1a:03:ab:1a:24:3b:13:56:
++         da:0d:ee:ff:2f:bd:d5:77:82:72:63:b8:aa:e1:18:f7:3b:c1:
++         a1:f8:51:b1:70:b9:25:39:df:a3:41:79:d7:2b:ec:32:f6:cb:
++         30:28:d2:1e:f1:b4:e1:80:03:9f:c2:0f:36:85:82:5e:39:ba:
++         9e:eb:67:76:42:93:bf:e0:df:64:b2:b5:5f:98:a1:45:3f:4a:
++         1f:5c:c5:04:10:f6
++-----BEGIN CERTIFICATE-----
++MIIEXTCCAsWgAwIBAgIIcLn06y+hlZkwDQYJKoZIhvcNAQELBQAwfTELMAkGA1UE
++BhMCVUExGDAWBgNVBAgMD0toYXJraXYgT2JsYXN0JzEQMA4GA1UEBwwHS2hhcmtp
++djEkMCIGA1UECgwbSW50ZXJuZXQgU3lzdGVtcyBDb25zb3J0aXVtMRwwGgYDVQQD
++DBNjYS50ZXN0LmV4YW1wbGUuY29tMB4XDTIyMDkwNjIwMzQwOVoXDTIyMDkwNzIw
++MzQwOVowKjEoMCYGA1UEAwwfc3J2MDEuY3J0MDItZXhwaXJlZC5leGFtcGxlLm5p
++bDCCAaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBAOwsiAG1izp0Vg1Xs3X9
++BVgF7Yqr6CkO8VI0LiJibkF0/3gztP8Vc/rOkBCk/tJmFHsLeXvWIIj5QTEUmkk2
++jDh0S/PiUeflb71lOOacMIA/JFb2aJ4JdoFbWYFEVp8cP0jwlb9gQCnfrEI9w2+F
++LcMOCLb3EipRAL/P/myu133ewXL4MgNfyT9K3uX6JJBG8EpfCdiTTL8cYUzS3Nts
+++K9zW7c7euhtHLsmI0eH/VAGD/G1iIqoJWlX40Y70mtS+1oB9pbpKs8T5xZM/Vr2
++HwuN9yWjaNcV/FxISQXihSRwV7HYBSSuJjoAm3KoRwXF83wt8lhyN/vBi09Cj92a
++rFuubyFirSmBuYtLbP9hmQ98CdNtACAtsQwAbJlMktwOES3nunvHyLGjGmH4zCyv
++F7bbzDYC/vtmFXeEcM1CJbcWZCiunYyBhaDgUIKq6OmsUfwrY0SxCLiQ14wcI7Ib
++CFmF1d05RPdHXkgINOss33VHCLa25jLtdnR3zj1N/gKxMwIDAQABozQwMjAwBgNV
++HREEKTAngh9zcnYwMS5jcnQwMi1leHBpcmVkLmV4YW1wbGUubmlshwQKNQABMA0G
++CSqGSIb3DQEBCwUAA4IBgQAqUsTLqS/3K+0EtQPVBlntXHy3AJ7EM5D+0LAY8/IG
++MFQY/jTL6mFPnCNnPK7tIN+CUuxZiEWtPGynNCQcTWarcT1ZjO/NoOJ7WS1DlM31
++CjxOgSTo/cbQ/a1vzClbZwu37kM4pJHC2Tv41pe8kt3soauFNUT0Ct+tjYxSw0l+
++ORChE0N4ceKSqjE92ZQVf4bIqrShbb/rVbHXQW/DfYhenLexSw2nF08+SkY/b0gn
++jNDlUfxCusW5T2NvLvL9DMBuI7RZk2ikLRbO9Hs6RR2gbpgL92rmdQzbVhlriPB/
++awj4/LvRPyUlGmyONMuRGFTVLc6c0LfDvLUK4Llzb02tazy2Se/AEBPHCnhNmH3L
++hKEpQIzdMX2uxPUlXbl0svXiK+BDyFBho6gmGgOrGiQ7E1baDe7/L73Vd4JyY7iq
++4Rj3O8Gh+FGxcLklOd+jQXnXK+wy9sswKNIe8bThgAOfwg82hYJeObqe62d2QpO/
++4N9ksrVfmKFFP0ofXMUEEPY=
++-----END CERTIFICATE-----
+diff --git a/bin/tests/system/nsupdate/CA/index.txt b/bin/tests/system/nsupdate/CA/index.txt
+new file mode 100644
+index 0000000..020155f
+--- /dev/null
++++ b/bin/tests/system/nsupdate/CA/index.txt
+@@ -0,0 +1,4 @@
++V	20520830202803Z		70B9F4EB2FA19598	unknown	/CN=srv01.crt01.example.nil
++V	220907203409Z		70B9F4EB2FA19599	unknown	/CN=srv01.crt02-expired.example.nil
++V	20520831082017Z		70B9F4EB2FA1959A	unknown	/CN=srv01.client01.example.nil
++V	220908081418Z		70B9F4EB2FA1959B	unknown	/CN=srv01.client02-expired.example.nil
+diff --git a/bin/tests/system/nsupdate/CA/index.txt.attr b/bin/tests/system/nsupdate/CA/index.txt.attr
+new file mode 100644
+index 0000000..8f7e63a
+--- /dev/null
++++ b/bin/tests/system/nsupdate/CA/index.txt.attr
+@@ -0,0 +1 @@
++unique_subject = yes
+diff --git a/bin/tests/system/nsupdate/CA/newcerts/70B9F4EB2FA19598.pem b/bin/tests/system/nsupdate/CA/newcerts/70B9F4EB2FA19598.pem
+new file mode 100644
+index 0000000..4a4556c
+--- /dev/null
++++ b/bin/tests/system/nsupdate/CA/newcerts/70B9F4EB2FA19598.pem
+@@ -0,0 +1,93 @@
++Certificate:
++    Data:
++        Version: 3 (0x2)
++        Serial Number: 8122792693893010840 (0x70b9f4eb2fa19598)
++        Signature Algorithm: sha256WithRSAEncryption
++        Issuer: C=UA, ST=Kharkiv Oblast', L=Kharkiv, O=Internet Systems Consortium, CN=ca.test.example.com
++        Validity
++            Not Before: Sep  7 20:28:03 2022 GMT
++            Not After : Aug 30 20:28:03 2052 GMT
++        Subject: CN=srv01.crt01.example.nil
++        Subject Public Key Info:
++            Public Key Algorithm: rsaEncryption
++                RSA Public-Key: (3072 bit)
++                Modulus:
++                    00:b4:9a:63:98:04:ad:bd:ab:29:bf:22:70:54:30:
++                    df:c7:6b:77:5d:b8:5e:0b:cd:0e:a0:6c:74:37:e7:
++                    4b:78:d1:96:da:ca:99:7d:92:b1:e4:1a:0a:1e:b4:
++                    1c:be:ee:cc:95:8c:52:03:93:85:e1:40:43:68:86:
++                    86:bc:6a:62:6d:d6:0a:ca:ee:4f:93:2d:ee:6b:df:
++                    7a:f6:dc:fa:44:a6:39:80:2c:38:7c:89:cd:d9:a3:
++                    99:ec:e8:2b:48:6d:84:41:3d:0e:1a:1f:68:5e:17:
++                    88:8f:a5:da:4d:1c:36:26:ae:b4:7e:d2:fe:a2:59:
++                    d5:67:3a:56:c2:21:65:0d:dd:97:6f:f0:e5:b4:1e:
++                    87:ae:97:35:0d:f4:9b:ae:dc:8a:3e:28:aa:b8:a2:
++                    ab:ee:9d:b2:c5:91:f6:71:99:a5:86:cb:31:9c:05:
++                    d6:9b:94:13:46:a9:9a:c9:a5:55:5f:6c:cc:d0:84:
++                    27:e2:b1:b5:73:39:08:7f:80:2f:04:26:96:0c:8d:
++                    29:9b:be:5e:cc:39:af:a2:db:82:82:57:07:e6:b2:
++                    4a:d9:3d:c8:79:6e:67:61:f3:48:37:a8:4f:9f:b3:
++                    cf:84:b6:50:08:3d:e9:85:e9:a9:76:50:80:e7:2c:
++                    6f:65:95:cb:e2:23:41:58:39:70:e7:78:29:3d:c2:
++                    d6:20:7c:2b:87:30:bd:98:87:63:ed:4a:ad:b9:ed:
++                    7a:4b:13:a1:3d:62:5e:b6:74:64:ef:25:a3:dd:93:
++                    47:aa:d3:25:7e:2a:d7:09:1b:5c:59:50:f1:d4:c6:
++                    9c:f2:64:8a:7c:cb:cc:52:37:50:88:4b:84:35:40:
++                    51:0e:a1:06:a2:60:b6:b0:e3:8f:f9:d8:8e:45:77:
++                    7d:0e:7d:11:92:22:15:0f:a3:37:84:c4:25:dc:14:
++                    b4:20:7a:b7:16:96:72:d4:bf:4d:5d:d2:ab:71:43:
++                    44:be:87:44:d2:b8:74:f7:86:3f:d2:5d:dd:5e:e6:
++                    74:ab:fb:cc:a3:5d:a6:84:80:0b
++                Exponent: 65537 (0x10001)
++        X509v3 extensions:
++            X509v3 Subject Alternative Name: 
++                DNS:srv01.crt01.example.nil, IP Address:10.53.0.1
++    Signature Algorithm: sha256WithRSAEncryption
++         94:15:c0:4a:f1:aa:15:30:f7:cb:fe:f9:fa:ba:5f:f0:18:1f:
++         7e:44:9a:b1:d4:9c:f9:78:d3:a7:c7:65:f2:d1:48:62:f4:cb:
++         2f:20:ea:7c:af:08:cf:db:e2:0f:ab:c0:22:38:16:c5:0c:e5:
++         c7:6e:34:b1:ed:f6:02:1a:69:c0:09:d1:43:b3:30:77:fc:00:
++         07:1b:da:88:97:5b:28:4e:e6:92:ca:00:cc:86:66:a9:a9:0a:
++         75:be:74:88:7d:09:52:e7:a9:82:8f:a9:62:5e:b3:19:64:14:
++         e5:54:9e:6d:9c:98:39:8b:1f:92:92:59:f9:a2:46:75:96:11:
++         71:8a:c8:71:05:10:2a:b8:f3:a4:19:db:eb:05:17:0a:dd:98:
++         2c:58:54:3a:7f:8c:c2:26:9e:62:ca:04:dd:3c:99:1f:a0:64:
++         69:fb:d6:04:c1:0b:8c:62:f6:2d:ea:bc:6c:a9:39:7b:f1:20:
++         b8:b7:04:3c:a7:65:fa:1f:db:22:e2:5b:8b:91:75:60:be:e1:
++         1e:50:13:23:d5:4b:93:87:20:ec:46:6f:5f:94:dc:b1:60:d1:
++         79:4b:5e:76:c9:6d:0d:be:a6:9a:6b:67:8b:a7:48:7e:51:b5:
++         9b:9d:ec:a6:0c:c1:b3:d9:0b:26:8b:f2:7c:cf:61:d0:a2:a0:
++         90:90:18:6b:b4:ca:56:b8:5e:5a:8b:78:71:c4:d1:fc:15:30:
++         0a:03:26:74:85:3d:6c:ed:d3:e1:c9:c1:b0:d4:0c:b9:f3:04:
++         93:0d:e3:a6:2c:a7:ee:e0:24:0d:dd:37:fc:6b:09:d5:b5:55:
++         33:12:82:cf:f2:ba:0f:b0:e2:ce:f7:c0:ac:2c:7f:ab:f9:dd:
++         87:b1:9b:95:f2:d7:32:98:dd:4c:b3:28:b7:0d:2b:2f:62:65:
++         ce:59:fb:95:d4:5f:9d:fd:83:5a:01:3b:5f:48:5f:3c:fa:4b:
++         52:91:66:e1:49:8e:cd:09:78:f5:ce:f8:cd:5c:85:3e:ad:bd:
++         1c:4e:e0:3f:0a:8b
++-----BEGIN CERTIFICATE-----
++MIIETzCCAregAwIBAgIIcLn06y+hlZgwDQYJKoZIhvcNAQELBQAwfTELMAkGA1UE
++BhMCVUExGDAWBgNVBAgMD0toYXJraXYgT2JsYXN0JzEQMA4GA1UEBwwHS2hhcmtp
++djEkMCIGA1UECgwbSW50ZXJuZXQgU3lzdGVtcyBDb25zb3J0aXVtMRwwGgYDVQQD
++DBNjYS50ZXN0LmV4YW1wbGUuY29tMCAXDTIyMDkwNzIwMjgwM1oYDzIwNTIwODMw
++MjAyODAzWjAiMSAwHgYDVQQDDBdzcnYwMS5jcnQwMS5leGFtcGxlLm5pbDCCAaIw
++DQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBALSaY5gErb2rKb8icFQw38drd124
++XgvNDqBsdDfnS3jRltrKmX2SseQaCh60HL7uzJWMUgOTheFAQ2iGhrxqYm3WCsru
++T5Mt7mvfevbc+kSmOYAsOHyJzdmjmezoK0hthEE9DhofaF4XiI+l2k0cNiautH7S
++/qJZ1Wc6VsIhZQ3dl2/w5bQeh66XNQ30m67cij4oqriiq+6dssWR9nGZpYbLMZwF
++1puUE0apmsmlVV9szNCEJ+KxtXM5CH+ALwQmlgyNKZu+Xsw5r6LbgoJXB+ayStk9
++yHluZ2HzSDeoT5+zz4S2UAg96YXpqXZQgOcsb2WVy+IjQVg5cOd4KT3C1iB8K4cw
++vZiHY+1KrbnteksToT1iXrZ0ZO8lo92TR6rTJX4q1wkbXFlQ8dTGnPJkinzLzFI3
++UIhLhDVAUQ6hBqJgtrDjj/nYjkV3fQ59EZIiFQ+jN4TEJdwUtCB6txaWctS/TV3S
++q3FDRL6HRNK4dPeGP9Jd3V7mdKv7zKNdpoSACwIDAQABoywwKjAoBgNVHREEITAf
++ghdzcnYwMS5jcnQwMS5leGFtcGxlLm5pbIcECjUAATANBgkqhkiG9w0BAQsFAAOC
++AYEAlBXASvGqFTD3y/75+rpf8BgffkSasdSc+XjTp8dl8tFIYvTLLyDqfK8Iz9vi
++D6vAIjgWxQzlx240se32AhppwAnRQ7Mwd/wABxvaiJdbKE7mksoAzIZmqakKdb50
++iH0JUuepgo+pYl6zGWQU5VSebZyYOYsfkpJZ+aJGdZYRcYrIcQUQKrjzpBnb6wUX
++Ct2YLFhUOn+MwiaeYsoE3TyZH6BkafvWBMELjGL2Leq8bKk5e/EguLcEPKdl+h/b
++IuJbi5F1YL7hHlATI9VLk4cg7EZvX5TcsWDReUtedsltDb6mmmtni6dIflG1m53s
++pgzBs9kLJovyfM9h0KKgkJAYa7TKVrheWot4ccTR/BUwCgMmdIU9bO3T4cnBsNQM
++ufMEkw3jpiyn7uAkDd03/GsJ1bVVMxKCz/K6D7DizvfArCx/q/ndh7GblfLXMpjd
++TLMotw0rL2Jlzln7ldRfnf2DWgE7X0hfPPpLUpFm4UmOzQl49c74zVyFPq29HE7g
++PwqL
++-----END CERTIFICATE-----
+diff --git a/bin/tests/system/nsupdate/CA/newcerts/70B9F4EB2FA19599.pem b/bin/tests/system/nsupdate/CA/newcerts/70B9F4EB2FA19599.pem
+new file mode 100644
+index 0000000..3fa0b9a
+--- /dev/null
++++ b/bin/tests/system/nsupdate/CA/newcerts/70B9F4EB2FA19599.pem
+@@ -0,0 +1,93 @@
++Certificate:
++    Data:
++        Version: 3 (0x2)
++        Serial Number: 8122792693893010841 (0x70b9f4eb2fa19599)
++        Signature Algorithm: sha256WithRSAEncryption
++        Issuer: C=UA, ST=Kharkiv Oblast', L=Kharkiv, O=Internet Systems Consortium, CN=ca.test.example.com
++        Validity
++            Not Before: Sep  6 20:34:09 2022 GMT
++            Not After : Sep  7 20:34:09 2022 GMT
++        Subject: CN=srv01.crt02-expired.example.nil
++        Subject Public Key Info:
++            Public Key Algorithm: rsaEncryption
++                RSA Public-Key: (3072 bit)
++                Modulus:
++                    00:ec:2c:88:01:b5:8b:3a:74:56:0d:57:b3:75:fd:
++                    05:58:05:ed:8a:ab:e8:29:0e:f1:52:34:2e:22:62:
++                    6e:41:74:ff:78:33:b4:ff:15:73:fa:ce:90:10:a4:
++                    fe:d2:66:14:7b:0b:79:7b:d6:20:88:f9:41:31:14:
++                    9a:49:36:8c:38:74:4b:f3:e2:51:e7:e5:6f:bd:65:
++                    38:e6:9c:30:80:3f:24:56:f6:68:9e:09:76:81:5b:
++                    59:81:44:56:9f:1c:3f:48:f0:95:bf:60:40:29:df:
++                    ac:42:3d:c3:6f:85:2d:c3:0e:08:b6:f7:12:2a:51:
++                    00:bf:cf:fe:6c:ae:d7:7d:de:c1:72:f8:32:03:5f:
++                    c9:3f:4a:de:e5:fa:24:90:46:f0:4a:5f:09:d8:93:
++                    4c:bf:1c:61:4c:d2:dc:db:6c:f8:af:73:5b:b7:3b:
++                    7a:e8:6d:1c:bb:26:23:47:87:fd:50:06:0f:f1:b5:
++                    88:8a:a8:25:69:57:e3:46:3b:d2:6b:52:fb:5a:01:
++                    f6:96:e9:2a:cf:13:e7:16:4c:fd:5a:f6:1f:0b:8d:
++                    f7:25:a3:68:d7:15:fc:5c:48:49:05:e2:85:24:70:
++                    57:b1:d8:05:24:ae:26:3a:00:9b:72:a8:47:05:c5:
++                    f3:7c:2d:f2:58:72:37:fb:c1:8b:4f:42:8f:dd:9a:
++                    ac:5b:ae:6f:21:62:ad:29:81:b9:8b:4b:6c:ff:61:
++                    99:0f:7c:09:d3:6d:00:20:2d:b1:0c:00:6c:99:4c:
++                    92:dc:0e:11:2d:e7:ba:7b:c7:c8:b1:a3:1a:61:f8:
++                    cc:2c:af:17:b6:db:cc:36:02:fe:fb:66:15:77:84:
++                    70:cd:42:25:b7:16:64:28:ae:9d:8c:81:85:a0:e0:
++                    50:82:aa:e8:e9:ac:51:fc:2b:63:44:b1:08:b8:90:
++                    d7:8c:1c:23:b2:1b:08:59:85:d5:dd:39:44:f7:47:
++                    5e:48:08:34:eb:2c:df:75:47:08:b6:b6:e6:32:ed:
++                    76:74:77:ce:3d:4d:fe:02:b1:33
++                Exponent: 65537 (0x10001)
++        X509v3 extensions:
++            X509v3 Subject Alternative Name: 
++                DNS:srv01.crt02-expired.example.nil, IP Address:10.53.0.1
++    Signature Algorithm: sha256WithRSAEncryption
++         2a:52:c4:cb:a9:2f:f7:2b:ed:04:b5:03:d5:06:59:ed:5c:7c:
++         b7:00:9e:c4:33:90:fe:d0:b0:18:f3:f2:06:30:54:18:fe:34:
++         cb:ea:61:4f:9c:23:67:3c:ae:ed:20:df:82:52:ec:59:88:45:
++         ad:3c:6c:a7:34:24:1c:4d:66:ab:71:3d:59:8c:ef:cd:a0:e2:
++         7b:59:2d:43:94:cd:f5:0a:3c:4e:81:24:e8:fd:c6:d0:fd:ad:
++         6f:cc:29:5b:67:0b:b7:ee:43:38:a4:91:c2:d9:3b:f8:d6:97:
++         bc:92:dd:ec:a1:ab:85:35:44:f4:0a:df:ad:8d:8c:52:c3:49:
++         7e:39:10:a1:13:43:78:71:e2:92:aa:31:3d:d9:94:15:7f:86:
++         c8:aa:b4:a1:6d:bf:eb:55:b1:d7:41:6f:c3:7d:88:5e:9c:b7:
++         b1:4b:0d:a7:17:4f:3e:4a:46:3f:6f:48:27:8c:d0:e5:51:fc:
++         42:ba:c5:b9:4f:63:6f:2e:f2:fd:0c:c0:6e:23:b4:59:93:68:
++         a4:2d:16:ce:f4:7b:3a:45:1d:a0:6e:98:0b:f7:6a:e6:75:0c:
++         db:56:19:6b:88:f0:7f:6b:08:f8:fc:bb:d1:3f:25:25:1a:6c:
++         8e:34:cb:91:18:54:d5:2d:ce:9c:d0:b7:c3:bc:b5:0a:e0:b9:
++         73:6f:4d:ad:6b:3c:b6:49:ef:c0:10:13:c7:0a:78:4d:98:7d:
++         cb:84:a1:29:40:8c:dd:31:7d:ae:c4:f5:25:5d:b9:74:b2:f5:
++         e2:2b:e0:43:c8:50:61:a3:a8:26:1a:03:ab:1a:24:3b:13:56:
++         da:0d:ee:ff:2f:bd:d5:77:82:72:63:b8:aa:e1:18:f7:3b:c1:
++         a1:f8:51:b1:70:b9:25:39:df:a3:41:79:d7:2b:ec:32:f6:cb:
++         30:28:d2:1e:f1:b4:e1:80:03:9f:c2:0f:36:85:82:5e:39:ba:
++         9e:eb:67:76:42:93:bf:e0:df:64:b2:b5:5f:98:a1:45:3f:4a:
++         1f:5c:c5:04:10:f6
++-----BEGIN CERTIFICATE-----
++MIIEXTCCAsWgAwIBAgIIcLn06y+hlZkwDQYJKoZIhvcNAQELBQAwfTELMAkGA1UE
++BhMCVUExGDAWBgNVBAgMD0toYXJraXYgT2JsYXN0JzEQMA4GA1UEBwwHS2hhcmtp
++djEkMCIGA1UECgwbSW50ZXJuZXQgU3lzdGVtcyBDb25zb3J0aXVtMRwwGgYDVQQD
++DBNjYS50ZXN0LmV4YW1wbGUuY29tMB4XDTIyMDkwNjIwMzQwOVoXDTIyMDkwNzIw
++MzQwOVowKjEoMCYGA1UEAwwfc3J2MDEuY3J0MDItZXhwaXJlZC5leGFtcGxlLm5p
++bDCCAaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBAOwsiAG1izp0Vg1Xs3X9
++BVgF7Yqr6CkO8VI0LiJibkF0/3gztP8Vc/rOkBCk/tJmFHsLeXvWIIj5QTEUmkk2
++jDh0S/PiUeflb71lOOacMIA/JFb2aJ4JdoFbWYFEVp8cP0jwlb9gQCnfrEI9w2+F
++LcMOCLb3EipRAL/P/myu133ewXL4MgNfyT9K3uX6JJBG8EpfCdiTTL8cYUzS3Nts
+++K9zW7c7euhtHLsmI0eH/VAGD/G1iIqoJWlX40Y70mtS+1oB9pbpKs8T5xZM/Vr2
++HwuN9yWjaNcV/FxISQXihSRwV7HYBSSuJjoAm3KoRwXF83wt8lhyN/vBi09Cj92a
++rFuubyFirSmBuYtLbP9hmQ98CdNtACAtsQwAbJlMktwOES3nunvHyLGjGmH4zCyv
++F7bbzDYC/vtmFXeEcM1CJbcWZCiunYyBhaDgUIKq6OmsUfwrY0SxCLiQ14wcI7Ib
++CFmF1d05RPdHXkgINOss33VHCLa25jLtdnR3zj1N/gKxMwIDAQABozQwMjAwBgNV
++HREEKTAngh9zcnYwMS5jcnQwMi1leHBpcmVkLmV4YW1wbGUubmlshwQKNQABMA0G
++CSqGSIb3DQEBCwUAA4IBgQAqUsTLqS/3K+0EtQPVBlntXHy3AJ7EM5D+0LAY8/IG
++MFQY/jTL6mFPnCNnPK7tIN+CUuxZiEWtPGynNCQcTWarcT1ZjO/NoOJ7WS1DlM31
++CjxOgSTo/cbQ/a1vzClbZwu37kM4pJHC2Tv41pe8kt3soauFNUT0Ct+tjYxSw0l+
++ORChE0N4ceKSqjE92ZQVf4bIqrShbb/rVbHXQW/DfYhenLexSw2nF08+SkY/b0gn
++jNDlUfxCusW5T2NvLvL9DMBuI7RZk2ikLRbO9Hs6RR2gbpgL92rmdQzbVhlriPB/
++awj4/LvRPyUlGmyONMuRGFTVLc6c0LfDvLUK4Llzb02tazy2Se/AEBPHCnhNmH3L
++hKEpQIzdMX2uxPUlXbl0svXiK+BDyFBho6gmGgOrGiQ7E1baDe7/L73Vd4JyY7iq
++4Rj3O8Gh+FGxcLklOd+jQXnXK+wy9sswKNIe8bThgAOfwg82hYJeObqe62d2QpO/
++4N9ksrVfmKFFP0ofXMUEEPY=
++-----END CERTIFICATE-----
+diff --git a/bin/tests/system/nsupdate/CA/newcerts/70B9F4EB2FA1959A.pem b/bin/tests/system/nsupdate/CA/newcerts/70B9F4EB2FA1959A.pem
+new file mode 100644
+index 0000000..f546d35
+--- /dev/null
++++ b/bin/tests/system/nsupdate/CA/newcerts/70B9F4EB2FA1959A.pem
+@@ -0,0 +1,93 @@
++Certificate:
++    Data:
++        Version: 3 (0x2)
++        Serial Number: 8122792693893010842 (0x70b9f4eb2fa1959a)
++        Signature Algorithm: sha256WithRSAEncryption
++        Issuer: C=UA, ST=Kharkiv Oblast', L=Kharkiv, O=Internet Systems Consortium, CN=ca.test.example.com
++        Validity
++            Not Before: Sep  8 08:20:17 2022 GMT
++            Not After : Aug 31 08:20:17 2052 GMT
++        Subject: CN=srv01.client01.example.nil
++        Subject Public Key Info:
++            Public Key Algorithm: rsaEncryption
++                RSA Public-Key: (3072 bit)
++                Modulus:
++                    00:ab:60:2e:9c:61:e3:89:c6:52:2b:bc:e9:e1:05:
++                    fd:18:65:42:20:f6:56:16:40:33:d2:cb:9f:f7:ef:
++                    22:54:a7:c9:55:70:ca:52:f0:e2:a2:58:38:7f:10:
++                    ad:2b:05:e0:11:b6:69:21:7f:2d:38:56:dd:d5:e4:
++                    f3:de:a7:32:35:f7:33:2a:52:80:ae:b7:d6:7c:35:
++                    74:c3:0c:8a:c3:3a:18:61:68:73:62:58:56:ff:78:
++                    25:57:1c:7b:be:98:88:21:dd:1c:8a:13:a5:9a:52:
++                    48:98:d9:3d:c4:28:a6:7e:9b:11:56:7e:ce:09:bb:
++                    51:89:8a:a8:1b:00:b5:73:2b:41:93:b1:62:40:30:
++                    29:ea:f6:a3:e7:bc:f0:e9:9e:07:2b:ae:a9:a0:1d:
++                    4d:d9:f8:18:4d:83:47:4e:68:ee:57:c8:55:15:86:
++                    3c:6d:1e:f5:31:f1:de:cf:c2:7e:6b:8e:22:5a:c5:
++                    76:af:d0:01:de:ab:7a:03:b2:96:33:cc:a0:26:ae:
++                    de:c4:bd:76:85:96:c7:88:e4:46:bc:3f:c6:54:c9:
++                    95:83:87:9c:49:0d:31:dd:c4:17:52:99:e4:65:49:
++                    9b:9d:f3:ad:ce:66:08:57:f4:83:be:5e:87:da:42:
++                    5a:01:2a:6d:68:d1:8d:38:d9:18:ae:5e:2e:54:72:
++                    8b:01:45:96:af:f5:a3:d0:29:5d:22:8b:b4:d4:30:
++                    af:02:36:c5:2d:e9:29:eb:2c:ea:6a:7e:27:b3:70:
++                    fc:87:1f:2b:c4:b1:3a:a6:c2:e9:b7:c2:6f:46:63:
++                    b7:96:2e:53:d8:b7:cd:c3:f4:b5:6d:b2:fc:57:49:
++                    ac:9f:98:c9:fe:b4:f5:7c:93:48:2e:93:dc:e9:18:
++                    54:63:5f:18:a3:e7:12:aa:fe:38:f0:73:e5:17:1e:
++                    fe:40:65:81:a8:8f:60:46:c2:16:f2:a8:9d:b1:1b:
++                    bc:ce:05:de:37:b2:a8:86:47:bd:8d:92:de:e0:e5:
++                    42:89:b8:e3:f8:b1:24:08:7e:99
++                Exponent: 65537 (0x10001)
++        X509v3 extensions:
++            X509v3 Subject Alternative Name: 
++                DNS:srv01.client01.example.nil, IP Address:10.53.0.1
++    Signature Algorithm: sha256WithRSAEncryption
++         07:97:69:51:12:50:6a:e1:02:a0:b0:dc:93:75:16:c4:38:0f:
++         5c:b3:47:da:bf:fa:9c:b6:de:c0:ef:38:f7:cc:d9:8d:71:ba:
++         51:89:e5:48:36:dd:e1:f8:73:9d:92:80:1c:42:30:69:4f:8c:
++         19:5d:f7:1d:03:e4:f2:76:e0:58:7b:c2:76:c4:0a:7e:20:69:
++         26:6c:3e:cb:31:45:93:1d:07:5f:45:44:8e:5a:fb:87:17:7b:
++         4d:5c:bf:37:bd:5e:ba:5c:22:84:bf:26:21:4a:c4:e9:f9:cb:
++         73:de:fc:62:04:96:ad:aa:fd:89:09:5c:74:d6:bd:5f:07:17:
++         ef:9c:3d:ee:b7:dc:08:11:7f:12:66:ab:c4:ff:43:6d:7f:1e:
++         01:b6:d1:19:73:53:18:e4:02:b0:7c:9e:99:63:d8:57:dd:07:
++         79:fb:83:39:09:de:76:6e:68:b7:87:81:13:b8:26:e5:1c:c9:
++         a0:23:e5:97:39:ff:93:c7:8d:08:d8:ce:97:34:fc:ad:22:14:
++         89:c0:ae:83:7d:0a:3f:cf:a0:9b:b4:6a:5c:b3:6d:5d:3b:88:
++         ca:1e:9b:99:54:64:57:58:3c:4c:bd:26:ee:11:c3:13:0b:1d:
++         f5:fd:d9:37:b0:31:72:6f:1d:e8:ba:43:37:46:f7:71:fe:6d:
++         4a:30:33:29:c5:7b:37:8b:7e:06:22:89:a4:46:36:f0:fe:c6:
++         f5:f0:53:04:c0:35:52:78:6e:10:24:3a:d8:bf:7b:13:2f:98:
++         bc:69:31:41:68:02:5a:c4:f9:11:a2:6b:3f:c8:e0:d4:b3:80:
++         af:d2:be:fe:28:70:61:18:ed:8a:de:c4:cb:da:c9:60:94:91:
++         76:63:69:8c:6e:96:f5:ba:e7:be:1e:1c:c3:84:b1:8d:e8:31:
++         f7:66:8c:0d:da:a8:78:57:19:fd:a0:8d:fa:9a:7e:51:1c:d1:
++         d0:84:07:a2:45:40:2d:c4:6b:e9:9f:86:4a:08:20:8f:9c:79:
++         97:e3:7f:2a:14:73
++-----BEGIN CERTIFICATE-----
++MIIEVTCCAr2gAwIBAgIIcLn06y+hlZowDQYJKoZIhvcNAQELBQAwfTELMAkGA1UE
++BhMCVUExGDAWBgNVBAgMD0toYXJraXYgT2JsYXN0JzEQMA4GA1UEBwwHS2hhcmtp
++djEkMCIGA1UECgwbSW50ZXJuZXQgU3lzdGVtcyBDb25zb3J0aXVtMRwwGgYDVQQD
++DBNjYS50ZXN0LmV4YW1wbGUuY29tMCAXDTIyMDkwODA4MjAxN1oYDzIwNTIwODMx
++MDgyMDE3WjAlMSMwIQYDVQQDDBpzcnYwMS5jbGllbnQwMS5leGFtcGxlLm5pbDCC
++AaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBAKtgLpxh44nGUiu86eEF/Rhl
++QiD2VhZAM9LLn/fvIlSnyVVwylLw4qJYOH8QrSsF4BG2aSF/LThW3dXk896nMjX3
++MypSgK631nw1dMMMisM6GGFoc2JYVv94JVcce76YiCHdHIoTpZpSSJjZPcQopn6b
++EVZ+zgm7UYmKqBsAtXMrQZOxYkAwKer2o+e88OmeByuuqaAdTdn4GE2DR05o7lfI
++VRWGPG0e9THx3s/CfmuOIlrFdq/QAd6regOyljPMoCau3sS9doWWx4jkRrw/xlTJ
++lYOHnEkNMd3EF1KZ5GVJm53zrc5mCFf0g75eh9pCWgEqbWjRjTjZGK5eLlRyiwFF
++lq/1o9ApXSKLtNQwrwI2xS3pKess6mp+J7Nw/IcfK8SxOqbC6bfCb0Zjt5YuU9i3
++zcP0tW2y/FdJrJ+Yyf609XyTSC6T3OkYVGNfGKPnEqr+OPBz5Rce/kBlgaiPYEbC
++FvKonbEbvM4F3jeyqIZHvY2S3uDlQom44/ixJAh+mQIDAQABoy8wLTArBgNVHREE
++JDAighpzcnYwMS5jbGllbnQwMS5leGFtcGxlLm5pbIcECjUAATANBgkqhkiG9w0B
++AQsFAAOCAYEAB5dpURJQauECoLDck3UWxDgPXLNH2r/6nLbewO8498zZjXG6UYnl
++SDbd4fhznZKAHEIwaU+MGV33HQPk8nbgWHvCdsQKfiBpJmw+yzFFkx0HX0VEjlr7
++hxd7TVy/N71eulwihL8mIUrE6fnLc978YgSWrar9iQlcdNa9XwcX75w97rfcCBF/
++EmarxP9DbX8eAbbRGXNTGOQCsHyemWPYV90HefuDOQnedm5ot4eBE7gm5RzJoCPl
++lzn/k8eNCNjOlzT8rSIUicCug30KP8+gm7RqXLNtXTuIyh6bmVRkV1g8TL0m7hHD
++Ewsd9f3ZN7Axcm8d6LpDN0b3cf5tSjAzKcV7N4t+BiKJpEY28P7G9fBTBMA1Unhu
++ECQ62L97Ey+YvGkxQWgCWsT5EaJrP8jg1LOAr9K+/ihwYRjtit7Ey9rJYJSRdmNp
++jG6W9brnvh4cw4Sxjegx92aMDdqoeFcZ/aCN+pp+URzR0IQHokVALcRr6Z+GSggg
++j5x5l+N/KhRz
++-----END CERTIFICATE-----
+diff --git a/bin/tests/system/nsupdate/CA/newcerts/70B9F4EB2FA1959B.pem b/bin/tests/system/nsupdate/CA/newcerts/70B9F4EB2FA1959B.pem
+new file mode 100644
+index 0000000..365b493
+--- /dev/null
++++ b/bin/tests/system/nsupdate/CA/newcerts/70B9F4EB2FA1959B.pem
+@@ -0,0 +1,93 @@
++Certificate:
++    Data:
++        Version: 3 (0x2)
++        Serial Number: 8122792693893010843 (0x70b9f4eb2fa1959b)
++        Signature Algorithm: sha256WithRSAEncryption
++        Issuer: C=UA, ST=Kharkiv Oblast', L=Kharkiv, O=Internet Systems Consortium, CN=ca.test.example.com
++        Validity
++            Not Before: Sep  7 08:14:18 2022 GMT
++            Not After : Sep  8 08:14:18 2022 GMT
++        Subject: CN=srv01.client02-expired.example.nil
++        Subject Public Key Info:
++            Public Key Algorithm: rsaEncryption
++                RSA Public-Key: (3072 bit)
++                Modulus:
++                    00:c0:11:27:17:25:3a:ad:85:a0:3b:59:0b:22:64:
++                    63:7d:bb:05:32:35:4f:68:d5:19:2b:cd:46:bd:e2:
++                    b6:42:8c:08:cf:09:0d:a8:cd:58:d9:1b:77:db:17:
++                    8a:fc:f0:55:f2:e1:50:f4:fd:90:aa:49:15:5d:ea:
++                    9b:5a:47:c4:2f:82:07:46:87:f6:05:ef:15:02:a4:
++                    3c:a1:da:fc:5b:75:36:12:f7:12:50:55:f8:be:0c:
++                    7d:21:91:e2:92:d8:41:3f:71:fe:b2:17:c0:68:1d:
++                    09:be:fc:c4:24:ec:ef:d2:5c:52:a9:4f:d6:5d:30:
++                    b8:ab:68:2e:39:e9:8b:5b:c6:f0:64:42:f7:b8:bd:
++                    b2:90:32:22:68:bc:38:70:2f:14:ae:c8:7c:63:04:
++                    d5:11:b2:0a:f1:8e:13:10:b2:3b:69:f4:fe:3a:e2:
++                    f1:58:56:28:93:c1:28:aa:a7:19:c9:91:12:43:f8:
++                    f5:1d:34:58:3d:32:9f:11:67:d1:1f:53:d4:e0:d5:
++                    0c:78:2c:6f:38:3f:e1:89:69:b5:09:3c:12:f4:a9:
++                    ee:e5:2f:c5:47:65:a6:82:fa:ea:78:48:31:89:11:
++                    b6:23:8a:27:ed:7c:1d:6d:e8:ab:a0:29:de:40:f4:
++                    f2:9b:61:22:da:9c:22:32:f7:3d:f8:4c:e1:38:a7:
++                    e2:c3:af:a4:67:7f:94:a4:fd:52:25:89:4d:f4:9a:
++                    d6:35:ba:98:20:f1:4b:c9:a5:cf:ac:72:58:2a:cd:
++                    3b:4a:3e:e9:04:31:e2:9a:74:32:d5:52:60:34:ad:
++                    0c:85:02:65:58:41:74:2a:57:91:34:55:36:a9:14:
++                    5b:45:cc:28:27:d7:6d:ba:55:a3:dd:9f:00:04:a4:
++                    43:c2:af:5c:af:86:53:a6:d5:a7:49:aa:31:d6:5e:
++                    92:7d:26:dd:8d:f4:87:8a:9b:48:e8:25:f4:c7:34:
++                    ca:cf:e3:f7:84:19:3b:43:c7:6a:b8:da:6e:6f:85:
++                    af:8d:0c:fb:7c:ea:c7:73:9c:9b
++                Exponent: 65537 (0x10001)
++        X509v3 extensions:
++            X509v3 Subject Alternative Name: 
++                DNS:srv01.client02-expired.example.nil, IP Address:10.53.0.1
++    Signature Algorithm: sha256WithRSAEncryption
++         18:f1:7c:24:5b:d2:03:b0:60:0e:60:e6:32:f9:a7:47:d1:e4:
++         bd:3f:a3:21:53:90:84:9a:c6:2c:87:b2:16:28:95:07:a3:2a:
++         c3:33:8f:60:70:3f:26:58:be:ec:a2:6c:44:89:d3:4e:ef:bb:
++         ce:af:9b:5f:15:06:03:21:74:e3:6f:2a:dc:5c:19:4e:d3:cb:
++         ba:c3:5f:d8:76:89:59:50:82:69:5f:a1:ac:9f:be:79:e1:22:
++         12:37:f9:d3:2e:00:35:03:03:9d:08:24:45:65:7a:e9:72:31:
++         e1:67:44:32:17:25:dd:b9:72:eb:c6:40:d7:5d:8d:5f:00:48:
++         07:09:0d:3c:4c:a1:f1:05:4b:05:9b:2b:5a:21:09:46:f4:17:
++         7a:cf:34:87:ad:bf:ef:bd:56:74:d7:1a:8f:07:ce:70:b1:aa:
++         4d:82:4f:08:dc:56:27:f9:21:20:b8:06:c7:29:b4:8e:36:82:
++         b8:43:85:1c:2d:9f:be:2d:b9:9d:40:de:52:55:6a:2e:0b:28:
++         33:fc:f8:1b:70:e9:c5:46:50:f3:05:be:8d:ed:99:ec:f1:8c:
++         51:8a:1c:4b:95:f4:c4:dd:cd:42:74:bc:6f:66:64:54:b8:c1:
++         6e:c8:3d:e9:fe:10:02:61:50:77:38:b9:b0:b8:13:37:8f:0e:
++         5b:49:92:3a:9d:9a:60:51:68:99:8a:d5:7e:92:71:7e:fa:db:
++         52:37:4d:f9:0d:6c:3b:79:a3:b9:16:b7:95:00:ea:eb:17:54:
++         e2:50:d7:a5:08:54:58:2c:79:66:01:4b:95:65:ed:b8:81:f7:
++         4c:fa:f8:89:37:ad:d9:dc:c9:75:9d:02:3e:e5:92:b3:03:ab:
++         70:69:83:f5:6c:a6:27:7e:2e:fc:9d:b2:59:0a:43:ad:3f:55:
++         2f:5d:ec:ef:52:f0:3e:be:b5:d6:e2:c3:91:9d:dd:5d:e1:9e:
++         e6:18:90:0b:6a:85:f8:e3:83:2a:7c:91:c3:52:1c:6d:aa:2b:
++         44:b8:6f:2b:af:6e
++-----BEGIN CERTIFICATE-----
++MIIEYzCCAsugAwIBAgIIcLn06y+hlZswDQYJKoZIhvcNAQELBQAwfTELMAkGA1UE
++BhMCVUExGDAWBgNVBAgMD0toYXJraXYgT2JsYXN0JzEQMA4GA1UEBwwHS2hhcmtp
++djEkMCIGA1UECgwbSW50ZXJuZXQgU3lzdGVtcyBDb25zb3J0aXVtMRwwGgYDVQQD
++DBNjYS50ZXN0LmV4YW1wbGUuY29tMB4XDTIyMDkwNzA4MTQxOFoXDTIyMDkwODA4
++MTQxOFowLTErMCkGA1UEAwwic3J2MDEuY2xpZW50MDItZXhwaXJlZC5leGFtcGxl
++Lm5pbDCCAaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBAMARJxclOq2FoDtZ
++CyJkY327BTI1T2jVGSvNRr3itkKMCM8JDajNWNkbd9sXivzwVfLhUPT9kKpJFV3q
++m1pHxC+CB0aH9gXvFQKkPKHa/Ft1NhL3ElBV+L4MfSGR4pLYQT9x/rIXwGgdCb78
++xCTs79JcUqlP1l0wuKtoLjnpi1vG8GRC97i9spAyImi8OHAvFK7IfGME1RGyCvGO
++ExCyO2n0/jri8VhWKJPBKKqnGcmREkP49R00WD0ynxFn0R9T1ODVDHgsbzg/4Ylp
++tQk8EvSp7uUvxUdlpoL66nhIMYkRtiOKJ+18HW3oq6Ap3kD08pthItqcIjL3PfhM
++4Tin4sOvpGd/lKT9UiWJTfSa1jW6mCDxS8mlz6xyWCrNO0o+6QQx4pp0MtVSYDSt
++DIUCZVhBdCpXkTRVNqkUW0XMKCfXbbpVo92fAASkQ8KvXK+GU6bVp0mqMdZekn0m
++3Y30h4qbSOgl9Mc0ys/j94QZO0PHarjabm+Fr40M+3zqx3OcmwIDAQABozcwNTAz
++BgNVHREELDAqgiJzcnYwMS5jbGllbnQwMi1leHBpcmVkLmV4YW1wbGUubmlshwQK
++NQABMA0GCSqGSIb3DQEBCwUAA4IBgQAY8XwkW9IDsGAOYOYy+adH0eS9P6MhU5CE
++msYsh7IWKJUHoyrDM49gcD8mWL7somxEidNO77vOr5tfFQYDIXTjbyrcXBlO08u6
++w1/YdolZUIJpX6Gsn7554SISN/nTLgA1AwOdCCRFZXrpcjHhZ0QyFyXduXLrxkDX
++XY1fAEgHCQ08TKHxBUsFmytaIQlG9Bd6zzSHrb/vvVZ01xqPB85wsapNgk8I3FYn
+++SEguAbHKbSONoK4Q4UcLZ++LbmdQN5SVWouCygz/PgbcOnFRlDzBb6N7Zns8YxR
++ihxLlfTE3c1CdLxvZmRUuMFuyD3p/hACYVB3OLmwuBM3jw5bSZI6nZpgUWiZitV+
++knF++ttSN035DWw7eaO5FreVAOrrF1TiUNelCFRYLHlmAUuVZe24gfdM+viJN63Z
++3Ml1nQI+5ZKzA6twaYP1bKYnfi78nbJZCkOtP1UvXezvUvA+vrXW4sORnd1d4Z7m
++GJALaoX444MqfJHDUhxtqitEuG8rr24=
++-----END CERTIFICATE-----
+diff --git a/bin/tests/system/nsupdate/CA/private/CA-other.key b/bin/tests/system/nsupdate/CA/private/CA-other.key
+new file mode 100644
+index 0000000..41818aa
+--- /dev/null
++++ b/bin/tests/system/nsupdate/CA/private/CA-other.key
+@@ -0,0 +1,39 @@
++-----BEGIN RSA PRIVATE KEY-----
++MIIG5AIBAAKCAYEA10Xj8dH8/XCfUvhdL/S3E10TnrYY8IIDBmU0lkUR5IHwgP9I
++YVyR/0Mibg79FAs+rvuEDifUK+6wvkpj+BXNVZCspo9/u3cl7dqrLH+1SeUs50Oe
++QnbbTrBl0PuNwvzEkbk7xwLlVDOyRmmvY/EEu7WkitQZgXSAYgttrk62CuJUQUmw
++UTX5Jxndsjydk/zW/DiulTsX+zv8kG5NiwpXCfL6QxBoMZNI4fUmDL3bX1XfHaFA
+++45GT2lHu07xc+cVeZIRCo0Nk+fIO53lDol8mmR8/5vna27gRnqEUSU7MZAMG6QB
++Xkotnq3rHnrI/ku6dCJW4tbWV/ANQ+TG17g2tygzC/smqTuLqavyP9V5cRrdU9aw
++Eqwvy8uVbGkTmUZdtjkGWCcmBSWJvkH3MRJmijS7rDcb8m/g9+xKe79V1c8durGW
++vcfMRZZhWaoHyhnHg9+JLUCC3EUCp/1206w5vTXEQNpqi9Z3AZfgboPzJyji4OeY
++fcQ5eaIZ3OuIpyQzAgMBAAECggGAD+vUWvsr2datgeZqhfR0YdM9czyGhasn7B4q
++EH8VPrA5iGDZCpJdHeLqNfeX0hau0SQ69Q0PDRy/J6O61wtNv2lOy5bLXKMIRBor
++FMRxNQDlHEmM999wgtZbAWTJbEVjiF+Jw0M8kMiuA7UnSp31uqhJfhcHt+JU6Gtt
++9jlOD2oDzzxS9P6n6bNpCRigkuRdRhQvHUxcjrE2EbyGsaTXIR4+Uh1xh1EcT9Hg
++uYqFIfzo3nkhpDk2jAL+UiUZiHfrpO6OfqpNQj27jju/35DT+2hgGuS2JApzpi91
++gJSDXwsDQYdP2a2B0y3K0+HwC7/YovAzlXkfes06ebtsiG4Nzl15vnKaTbON0vZO
++7jMkedmstKaLGM5PlLW0afls5ahr0dtrhWFs+1QKcv1JahcfeEvggeH9/gtjpunM
++MT31VuYbwleWAsRxjGG3OWKLgst4cJXqGTdM21JzBDOP43/ZIaaedl43jJzIgIM5
++b4ae9DrhsTNIboYO20XYdwtn9Q2pAoHBAPLO1xTWfqpCwZU6udtX73jMfpwhGlWW
++0jqg9gvxs9Neg4nfYMtiliBS5VT+6oID8YSKOSWXHWFGFkBN5hqfGbu5Nd94rY0J
++g6UYgGOAcNfoGOTpI2xljpEWJJfquTFgbajwFg+q3p6mL1zShkzvf6hzqENxbLxy
++OvEPkszN6cy16jgEUv5qK9qNf7ISB8Ki3yFSKAfuRlapny3TcRTYkJNZ0y398/sG
++E5vqrrYyjUWv5Uwz0mHmZpmZuZuaUJxtlwKBwQDi+BKnIiYYwdJPmCNCykRJB02Z
++QZlxtnrrajxZsXHysTopX5HkOQH80VSbH6fj287qX7vV0ux2maFLoszjM0wtfQhE
++8fsuKRPfzxR0cFtPFtncCHI5FVT2MOsdz5dZ8BsinCgsVlZ3SrUC9gxPKpVdRd21
++OUC3r+tOPvM0gdfyT560GDLhaH12iOA5KtWnE3FIEpk6y95D1a4E7zu4ZaoI98UU
++F8ezSREzF9UzAcdVn8MA3v82nlGQS8iFI9mHicUCgcACWkS1O/rQNYNgqcgBOxHj
++7r9PTfbOW36/+K1JolbmtmS54kMy1Uq1F3iHYUzuY5Fkgl5ZYeRz+9TdXKPdICuE
++qR+/gZDU7AGtiNY9oJH3VZVgKm4gb7944mkKW8jdlJybZXAhSLuNd/i/gn6woiVv
++gWdg9+lgzg6KJWd7uocIZ77UOh5/vpGcNYDGPex7U06sKPqgUQu3bT9Ql1riI9MK
++ynUEXhCOHxnzicuVklnSEgk7usjQEAZweI/W1SDw0xMCgcEAm9BQBdsEqlRNDAVW
++l6CB9lyEIiUNsSnkAr9AxRZzMngGhKauYi3ctnICkifOOzgIOZAVRDpzyQu41lLi
++M0thDY1bYvF4TX03vprL4Q/NL2NxloNZ3uRNGmIE1sdPkRermTv4vE9dNrHbyDef
++xa1nMswm4yV1z2R+to2yqqZE2H1eZyaBr4rrLrfSroxAdl17lE3oUZvpb0o/F/Yg
++Wnu4mkV2T0/v8Z3Ep/3BiC29aYOu/Gcab6WKOvQ7qWMuD8U9AoHBAJslXJMsMZVc
++UIaxRbknRMEBRBJW6X6EPbV3zGa+R9e9XRSG7jYSOWB9Yb2AbwjsvF4Qq+8VQq+V
++Ksxs7XOuwR202oZFzQDMoVj1LL4Cn60rRWlI+p6Q5SB2DQVo2kulTv1NtvdVR+U0
++ABa0xp5TKi7+jTY/e3CJGiT69sZc7v2VXptoiGytlUl9GVr0SImD1ZJdaJSJCPZX
++S+cEzfF6LVnnhlaq4puuv/vKjumNWDymv3zwZOy9D8nn/tMHqLKWSg==
++-----END RSA PRIVATE KEY-----
+diff --git a/bin/tests/system/nsupdate/CA/private/CA.key b/bin/tests/system/nsupdate/CA/private/CA.key
+new file mode 100644
+index 0000000..2d5419d
+--- /dev/null
++++ b/bin/tests/system/nsupdate/CA/private/CA.key
+@@ -0,0 +1,39 @@
++-----BEGIN RSA PRIVATE KEY-----
++MIIG5AIBAAKCAYEAouoRHoAc6VCmxNTU6Ge7s+xDFGO0wXJJIsP+8nUyyjWvGCOC
++aQYLhb1kLA2NHRhSSKFcMh8jcd7Hlvy6CAec1j2dsWzryy3HgPrdjWaW3PfBO41D
++lUtdt8hA/p6pX2YwqvWbdK/3s8J0LY5xRZKNZnFOB/Sb4PGiIJ1NgMRO/M3IlPQm
++PO/faRRTU4SI26KCPKFW342826Zi88YwOd6w5mQU4fskk5TGtlNqE+Fj40ZbWVpy
++VXoEUS6RveRp020NX5CQG49SLtdF05AnnsATqmgNVCXptGuqW8uaHRONeGO3NBEy
++nJmibWBDUMjtCCcGVgyrVXuTkyAJJWpImnshUwgMNYebRwmC2iVv2LtsJS5eUTUH
++EWffnFl55XU2PkyNYgY35gA4y3SiWFJYV8+5FibU4ut0nb+lmHBF8WlqcU/kd3tp
++Gkf0exjqOIHZFqV9bIhpUbXhxx9v9+gkkGQ9nrXE1KRlvigxxUeIK5xHy9a7fVIL
++wo6WuCnLLJmbVkklAgMBAAECggGBAI5ZV3v/FUQIZK+4CBDKEwizeClotZgR9DWc
++bDgOj8KABe5hmKGL1qWVRuH3NUYm6j7sP1LMQnxM3LjhOuupOzE3xYIyWhW+eoQI
++r23OJiQNl5ohZNweblUXdTMGD5h8AipfUOY0m4tGbZ0gyXixBTxt5HCvG0UB3VgC
++GqZY4Wujo5ADhSXZsqxuRiDDvZGr/YBcuTu87Tg/ulam5ZyrKIcnC9gpSVxqsva9
++DAMy/cSoxUjd7ukhJISK3G3AF3fV4GSslQcJTlyJ2D3+LnqPuHJKYTI4hc46lN3x
++E2g24GdSCPYf6SoEPwACXtbavV8TXwQPJrHN+f+0/ePCI4jkYe5NoA3gwVgMb/WB
++wFchxzVh3V4e8tPGiG+ofKl81DSAW8VZCJLUIbTEce9oxafPT78WJxdC0wWbh5S8
++V/qN6sW/yWnK3oY9SilWhJGRwKOZ+8xtStaDeCzyCaOqEcWi8ZR0QfC33UozlhdC
++SrMKnOXmn/rUuXGrVR56IzIl0M7YAQKBwQDM3GJDdlFuHn6L0syKYdHDS8gXD9ke
++s+ochIP6jvkEPcayaEoZGl8s7RT3iztqXod7wLaZdotktxfDAZnJfeuOcVrCu+Bx
++HLytnBvV6czMfp3REGgQAJQeusSgtlBCTHHVOsDzIjdnkY3WBa7IiFYWO5wnYrGx
++r3ucnwnHaUVDMj1r4YI7mYIpCuYQl6eGyW7mhWewyhVwoQXKbifdrXxjvOigL0Cp
++tgsoU9pql3hpphOaYMX6hLOincTfaMxfnCECgcEAy5UXp3dA0OwK+4iDGKr+cUpk
++AtGTheiE+8zEVh2KYFLt921mW/QZiB1+xtnkknp3c7u07Ugk8jAEXzCkwMnN5ZCx
++LrJ72fC+cLIAbRm6/vMMP8iz83wyttao4qNMeoOBBfE9rEiP+lrugpv282V3ZHYa
++IUZWTeugJbckUHTbD3RZQExmQcRVG3m/TzonBfoZ8HoRj/n3d7V2T911cHUhi8Xn
++RQIi2m63VofOIep86LgartlKneMWnL0oOPq4RKyFAoHAZUzpDkD4nUJZAx025Yrf
++ZfoYNEcy7vq6XmWsuX5vZoiBs4DcezNOMvH9NzdTJxMdXbV61cIHxcK/7j7hZABv
++NZ2Z6sdqgaRbLGIQZaPaEJjfwxygyKDwnY1vY6UjZNVWSMFn3hJiYUVZZKakuiao
++ow/Q9KzZ/2ot7tG5zTCh/ktekfUOKBiNg2wPPc8wGPeMblMzZflXxrzpFyOHdRev
++dcZZJbSX/hO1yrhEPgculNd5xBHsdCegiF4JlwvEW9bhAoHAZQQiy5bx03j8bhkr
++q6bVQFPAUmG5iL16lxLg7TYVPnyH1bk0DDaQIKk6CeN+dmxML2IZgY/FvWK0GKOj
++bIH2J43nTRuFNvwtEvBQI9KbpfvlvRSSriOXaoATJvoObdAoylEM4BrVTk2mgapw
++HA/h8Thk+NPU6S8ctPouC7ogJIf/7Va7erC35j0//0kEqgOSsW9wnXdUItMo1LI3
++nsiQD7Hwcp5/utErKcWTM+MNfdA0dUQesT9ILhfyCGvn2TOdAoHBAKldZkDyRcu9
++r9uDF1bhUEnpV2k4hgvTuCvQ3rzyx3WrVT8ChEmePC8Ke5A54ffu/YdbpDLbdf2c
++j4n5CQhHbMIZs3P2hB3WqDCImApCfMbXaltfBbaT0j7uLJPMp+2+f/wWYpc3R+bn
++HVnaRI2PoXXmG9OjQSQdVZ5gNpkEuemAo3dJOSS6BMqQaSxUynGy7o/a/d4izBjd
++B58Fwq3sZI/Xv90Se9+b6ICST3YJ3p0vn8RKzmlCQjLg/xynpCByiw==
++-----END RSA PRIVATE KEY-----
+diff --git a/bin/tests/system/nsupdate/CA/serial b/bin/tests/system/nsupdate/CA/serial
+new file mode 100644
+index 0000000..0a263a5
+--- /dev/null
++++ b/bin/tests/system/nsupdate/CA/serial
+@@ -0,0 +1 @@
++70B9F4EB2FA1959C
+diff --git a/bin/tests/system/nsupdate/dhparam3072.pem b/bin/tests/system/nsupdate/dhparam3072.pem
+new file mode 100644
+index 0000000..9c2e0aa
+--- /dev/null
++++ b/bin/tests/system/nsupdate/dhparam3072.pem
+@@ -0,0 +1,11 @@
++-----BEGIN DH PARAMETERS-----
++MIIBiAKCAYEA5D/Oioe+G+EMf/9RVxmcV4rZAtqZpVTFHcX0ZulvdiQGCQmopm6K
++3+0uoU2J6WVMjhna5nHD2NO9miRDI/jIxX9g9k6PedSB4o3fSTtkAnGtUbB8S+Ab
++EHtWfd7FTES8P1n16HN7BfPXVbP8zTcK+jO63KdQoxueYoETcrw0Myi9Lm8ri8os
++O4oQ+XAH7GzZ60bcYV9jge0XIRUGVnYZDjWMlnwMvZyjLivxKXTC9HPNA6FF1/0H
++0LPhsfjdoLNsVHFzfQz7QELMfHbTd0C8y0UMDQw9FqUp0esHZ5gsTlqnDHp2ZHoR
++JDfNl4yVO5Gv4HiFJ0NSdggefhESU3FRAOhMmUkctOCxk5hyPqGMsvofOajY2MBp
++eCffrKuAU6/dGUeq8inwrZlAMIZ20WyskHmbHnc4DXo2Uo6xSZo3xyEq1ofXXwTZ
++vPw4e12so3RJAT2a8UsHf7DG1tH+9ke7HCAJQWxUizRFRsMi1Nl/7ikS4f3zgIbX
++GKz9+uk5eS6jAgEC
++-----END DH PARAMETERS-----
+diff --git a/bin/tests/system/nsupdate/ns1/named.conf.in b/bin/tests/system/nsupdate/ns1/named.conf.in
+index 2c1899f..aaf1d9c 100644
+--- a/bin/tests/system/nsupdate/ns1/named.conf.in
++++ b/bin/tests/system/nsupdate/ns1/named.conf.in
+@@ -11,14 +11,48 @@
+  * information regarding copyright ownership.
+  */
+ 
++tls tls-forward-secrecy {
++    protocols { TLSv1.2; };
++    ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
++    prefer-server-ciphers yes;
++    key-file "../CA/certs/srv01.crt01.example.nil.key";
++    cert-file "../CA/certs/srv01.crt01.example.nil.pem";
++    dhparam-file "../dhparam3072.pem";
++};
++
++tls tls-forward-secrecy-mutual-tls {
++    protocols { TLSv1.2; };
++    ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
++    prefer-server-ciphers yes;
++    key-file "../CA/certs/srv01.crt01.example.nil.key";
++    cert-file "../CA/certs/srv01.crt01.example.nil.pem";
++    dhparam-file "../dhparam3072.pem";
++    ca-file "../CA/CA.pem";
++};
++
++tls tls-expired {
++    protocols { TLSv1.2; };
++    ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
++    prefer-server-ciphers yes;
++    key-file "../CA/certs/srv01.crt02-expired.example.nil.key";
++    cert-file "../CA/certs/srv01.crt02-expired.example.nil.pem";
++    dhparam-file "../dhparam3072.pem";
++};
++
++
+ options {
+ 	query-source address 10.53.0.1;
+ 	notify-source 10.53.0.1;
+ 	transfer-source 10.53.0.1;
+ 	port @PORT@;
++	tls-port @TLSPORT@;
+ 	pid-file "named.pid";
+ 	session-keyfile "session.key";
+ 	listen-on { 10.53.0.1; 127.0.0.1; };
++	listen-on tls ephemeral { 10.53.0.1; };
++	listen-on port @EXTRAPORT1@ tls tls-forward-secrecy { 10.53.0.1; };
++	listen-on port @EXTRAPORT2@ tls tls-forward-secrecy-mutual-tls { 10.53.0.1; };
++	listen-on port @EXTRAPORT3@ tls tls-expired { 10.53.0.1; };
+ 	listen-on-v6 { none; };
+ 	recursion no;
+ 	notify yes;
+diff --git a/bin/tests/system/nsupdate/ns10/named.conf.in b/bin/tests/system/nsupdate/ns10/named.conf.in
+index 25ba141..51a0b4f 100644
+--- a/bin/tests/system/nsupdate/ns10/named.conf.in
++++ b/bin/tests/system/nsupdate/ns10/named.conf.in
+@@ -16,9 +16,11 @@ options {
+ 	notify-source 10.53.0.10;
+ 	transfer-source 10.53.0.10;
+ 	port @PORT@;
++	tls-port @TLSPORT@;
+ 	pid-file "named.pid";
+ 	session-keyfile "session.key";
+ 	listen-on { 10.53.0.10; };
++	listen-on tls ephemeral { 10.53.0.10; };
+ 	listen-on-v6 { none; };
+ 	recursion no;
+ 	notify yes;
+diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh
+index 916f45b..735b659 100755
+--- a/bin/tests/system/nsupdate/tests.sh
++++ b/bin/tests/system/nsupdate/tests.sh
+@@ -1145,7 +1145,182 @@ fi
+ 
+ n=$((n + 1))
+ ret=0
++echo_i "check DoT (opportunistic-tls) ($n)"
++$NSUPDATE -D -S -O -k ns1/ddns.key <<END >nsupdate.out.test$n 2>&1 || ret=1
++server 10.53.0.1 ${TLSPORT}
++update add dot-non-auth-client-o.example.nil. 600 A 10.10.10.3
++send
++END
++sleep 2
++$DIG $DIGOPTS +short @10.53.0.1 dot-non-auth-client-o.example.nil >dig.out.test$n 2>&1 || ret=1
++grep -F "10.10.10.3" dig.out.test$n >/dev/null 2>&1 || ret=1
++if [ $ret -ne 0 ]; then
++    echo_i "failed"
++    status=1
++fi
++
++n=$((n + 1))
++ret=0
++echo_i "check DoT (strict-tls) with an implicit hostname (by IP address) ($n)"
++$NSUPDATE -D -S -A CA/CA.pem -k ns1/ddns.key <<END >nsupdate.out.test$n 2>&1 || ret=1
++server 10.53.0.1 ${EXTRAPORT1}
++update add dot-non-auth-client.example.nil. 600 A 10.10.10.3
++send
++END
++sleep 2
++$DIG $DIGOPTS +short @10.53.0.1 dot-non-auth-client.example.nil >dig.out.test$n 2>&1 || ret=1
++grep -F "10.10.10.3" dig.out.test$n >/dev/null 2>&1 || ret=1
++if [ $ret -ne 0 ]; then
++    echo_i "failed"
++    status=1
++fi
++
++n=$((n + 1))
++ret=0
++echo_i "check DoT (strict-tls) with an implicit hostname (by IP address) ($n)"
++$NSUPDATE -D -S -A CA/CA.pem -k ns1/ddns.key <<END >nsupdate.out.test$n 2>&1 || ret=1
++server 10.53.0.1 ${EXTRAPORT1}
++update add dot-fs.example.nil. 600 A 10.10.10.3
++send
++END
++sleep 2
++$DIG $DIGOPTS +short @10.53.0.1 dot-fs.example.nil >dig.out.test$n 2>&1 || ret=1
++grep -F "10.10.10.3" dig.out.test$n >/dev/null 2>&1 || ret=1
++if [ $ret -ne 0 ]; then
++    echo_i "failed"
++    status=1
++fi
++
++n=$((n + 1))
++ret=0
++echo_i "check DoT (strict-tls) with a correct hostname ($n)"
++$NSUPDATE -D -S -A CA/CA.pem -H srv01.crt01.example.nil -k ns1/ddns.key <<END >nsupdate.out.test$n 2>&1 || ret=1
++server 10.53.0.1 ${EXTRAPORT1}
++update add dot-fs-h.example.nil. 600 A 10.10.10.3
++send
++END
++sleep 2
++$DIG $DIGOPTS +short @10.53.0.1 dot-fs-h.example.nil >dig.out.test$n 2>&1 || ret=1
++grep -F "10.10.10.3" dig.out.test$n >/dev/null 2>&1 || ret=1
++if [ $ret -ne 0 ]; then
++    echo_i "failed"
++    status=1
++fi
++
++n=$((n + 1))
++ret=0
++echo_i "check DoT (strict-tls) with an incorrect hostname (failure expected) ($n)"
++$NSUPDATE -D -S -A CA/CA.pem -H srv01.crt01.example.bad -k ns1/ddns.key <<END >nsupdate.out.test$n 2>&1 && ret=1
++server 10.53.0.1 ${EXTRAPORT1}
++update add dot-fs-h-bad.example.nil. 600 A 10.10.10.3
++send
++END
++sleep 2
++$DIG $DIGOPTS +short @10.53.0.1 dot-fs-h-bad.example.nil >dig.out.test$n 2>&1 || ret=1
++grep -F "10.10.10.3" dig.out.test$n >/dev/null 2>&1 && ret=1
++if [ $ret -ne 0 ]; then
++    echo_i "failed"
++    status=1
++fi
++
++n=$((n + 1))
++ret=0
++echo_i "check DoT (strict-tls) with a wrong authority (failure expected) ($n)"
++$NSUPDATE -D -S -A CA/CA-other.pem -k ns1/ddns.key <<END >nsupdate.out.test$n 2>&1 && ret=1
++server 10.53.0.1 ${EXTRAPORT1}
++update add dot-fs-auth-bad.example.nil. 600 A 10.10.10.3
++send
++END
++sleep 2
++$DIG $DIGOPTS +short @10.53.0.1 dot-fs-auth-bad.example.nil >dig.out.test$n 2>&1 || ret=1
++grep -F "10.10.10.3" dig.out.test$n >/dev/null 2>&1 && ret=1
++if [ $ret -ne 0 ]; then
++    echo_i "failed"
++    status=1
++fi
++
++n=$((n + 1))
++ret=0
++echo_i "check DoT (mutual-tls) with a valid client certificate ($n)"
++$NSUPDATE -D -S -A CA/CA.pem -K CA/certs/srv01.client01.example.nil.key -E CA/certs/srv01.client01.example.nil.pem -k ns1/ddns.key <<END >nsupdate.out.test$n 2>&1 || ret=1
++server 10.53.0.1 ${EXTRAPORT2}
++update add dot-fsmt.example.nil. 600 A 10.10.10.3
++send
++END
++sleep 2
++$DIG $DIGOPTS +short @10.53.0.1 dot-fsmt.example.nil >dig.out.test$n 2>&1 || ret=1
++grep -F "10.10.10.3" dig.out.test$n >/dev/null 2>&1 || ret=1
++if [ $ret -ne 0 ]; then
++    echo_i "failed"
++    status=1
++fi
++
++n=$((n + 1))
++ret=0
++echo_i "check DoT (mutual-tls) with a valid client certificate but with an incorrect hostname (failure expected) ($n)"
++$NSUPDATE -D -S -A CA/CA.pem -K CA/certs/srv01.client01.example.nil.key -E CA/certs/srv01.client01.example.nil.pem -H srv01.crt01.example.bad -k ns1/ddns.key <<END >nsupdate.out.test$n 2>&1 && ret=1
++server 10.53.0.1 ${EXTRAPORT2}
++update add dot-fsmt-h-bad.example.nil. 600 A 10.10.10.3
++send
++END
++sleep 2
++$DIG $DIGOPTS +short @10.53.0.1 dot-fsmt-h-bad.example.nil >dig.out.test$n 2>&1 || ret=1
++grep -F "10.10.10.3" dig.out.test$n >/dev/null 2>&1 && ret=1
++if [ $ret -ne 0 ]; then
++    echo_i "failed"
++    status=1
++fi
+ 
++n=$((n + 1))
++ret=0
++echo_i "check DoT (mutual-tls) with a valid client certificate but with a wrong authority (failure expected) ($n)"
++$NSUPDATE -D -S -A CA/CA-other.pem -K CA/certs/srv01.client01.example.nil.key -E CA/certs/client01.crt01.example.nil.pem -k ns1/ddns.key <<END >nsupdate.out.test$n 2>&1 && ret=1
++server 10.53.0.1 ${EXTRAPORT2}
++update add dot-fsmt-auth-bad.example.nil. 600 A 10.10.10.3
++send
++END
++sleep 2
++$DIG $DIGOPTS +short @10.53.0.1 dot-fsmt-auth-bad.example.nil >dig.out.test$n 2>&1 || ret=1
++grep -F "10.10.10.3" dig.out.test$n >/dev/null 2>&1 && ret=1
++if [ $ret -ne 0 ]; then
++    echo_i "failed"
++    status=1
++fi
++
++n=$((n + 1))
++ret=0
++echo_i "check DoT (mutual-tls) with an expired client certificate (failure expected) ($n)"
++$NSUPDATE -D -S -A CA/CA.pem -K CA/certs/srv01.client02-expired.example.nil.key -E CA/certs/srv01.client02-expired.example.nil.pem -k ns1/ddns.key <<END >nsupdate.out.test$n 2>&1 && ret=1
++server 10.53.0.1 ${EXTRAPORT2}
++update add dot-fsmt-exp-bad.example.nil. 600 A 10.10.10.3
++send
++END
++sleep 2
++$DIG $DIGOPTS +short @10.53.0.1 dot-fsmt-exp-bad.example.nil >dig.out.test$n 2>&1 || ret=1
++grep -F "10.10.10.3" dig.out.test$n >/dev/null 2>&1 && ret=1
++if [ $ret -ne 0 ]; then
++    echo_i "failed"
++    status=1
++fi
++
++n=$((n + 1))
++ret=0
++echo_i "check DoT (mutual-tls) with a valid client certificate and an expired server certificate (failure expected) ($n)"
++$NSUPDATE -D -S -A CA/CA.pem -K CA/certs/srv01.client01.example.nil.key -E CA/certs/srv01.client01.example.nil.pem -k ns1/ddns.key <<END >nsupdate.out.test$n 2>&1 && ret=1
++server 10.53.0.1 ${EXTRAPORT3}
++update add dot-fsmt-exp-bad.example.nil. 600 A 10.10.10.3
++send
++END
++sleep 2
++$DIG $DIGOPTS +short @10.53.0.1 dot-fsmt-exp-bad.example.nil >dig.out.test$n 2>&1 || ret=1
++grep -F "10.10.10.3" dig.out.test$n >/dev/null 2>&1 && ret=1
++if [ $ret -ne 0 ]; then
++    echo_i "failed"
++    status=1
++fi
++
++n=$((n + 1))
++ret=0
+ echo_i "check TSIG key algorithms (nsupdate -k) ($n)"
+ if $FEATURETEST --md5; then
+   ALGS="md5 sha1 sha224 sha256 sha384 sha512"
+@@ -1409,6 +1584,7 @@ send
+ END
+ t2=$($PERL -e 'print time()')
+ grep "; Communication with 10.53.0.4#${PORT} failed: timed out" nsupdate.out.test$n >/dev/null 2>&1 || ret=1
++grep "not implemented" nsupdate.out.test$n > /dev/null 2>&1 && ret=1
+ grep "not implemented" nsupdate.out.test$n >/dev/null 2>&1 && ret=1
+ elapsed=$((t2 - t1))
+ # Check that default timeout value is respected, there should be 4 tries with 3 seconds each.
+@@ -2710,6 +2886,23 @@ EOF
+     status=1
+   }
+ 
++  n=$((n + 1))
++  ret=0
++  echo_i "check ms-selfsub match using DoT (opportunistic-tls) ($n)"
++  KRB5CCNAME="FILE:$(pwd)/ns10/machine.ccache"
++  export KRB5CCNAME
++  $NSUPDATE -d -S -O << EOF > nsupdate.out.test$n 2>&1 || ret=1
++  gsstsig
++  realm EXAMPLE.COM
++  server 10.53.0.10 ${TLSPORT}
++  zone example.com
++  update add dot.machine.example.com 3600 IN A 10.53.0.10
++  send
++EOF
++  $DIG $DIGOPTS +tcp @10.53.0.10 dot.machine.example.com A > dig.out.ns10.test$n
++  grep "status: NOERROR" dig.out.ns10.test$n > /dev/null || ret=1
++  grep "dot.machine.example.com..*A.*10.53.0.10" dig.out.ns10.test$n > /dev/null || ret=1
++  [ $ret = 0 ] || { echo_i "failed"; status=1; }
+ fi
+ 
+ echo_i "exit status: $status"
+-- 
+2.47.0
+
diff --git a/bind.spec b/bind.spec
index 09d3aed..d0e5381 100644
--- a/bind.spec
+++ b/bind.spec
@@ -135,6 +135,8 @@ Patch27: bind-9.20-openssl-no-engine.patch
 Patch28: bind-9.20-nsupdate-tls.patch
 # Man change for patch28 nsupdate
 Patch29: bind-9.20-nsupdate-tls-doc.patch
+# Test suport for patch28 nsupdate
+Patch30: bind-9.20-nsupdate-tls-test.patch
 
 %{?systemd_ordering}
 Requires:       coreutils
@@ -991,6 +993,7 @@ fi;
 %changelog
 * Wed Dec 04 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.31-2
 - Add nsupdate TLS support (FREEIPA-11706)
+- Include a test for nsupdate changes
 
 * Thu Nov 14 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.31-1
 - Update to 9.18.31 (#2319214)

From ca5d3f013159a8314cb6d6444ad00bead6b51efe Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 11 Dec 2024 21:01:49 +0100
Subject: [PATCH 373/460] Disable PDF generation on s390x

---
 bind.spec | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index d0e5381..e885e89 100644
--- a/bind.spec
+++ b/bind.spec
@@ -24,9 +24,12 @@
 # Because of issues with PDF rebuild, include only HTML pages
 # Current error: unable top find isc-logo.pdf
 %if 0%{?fedora}
+# xindy fails on s390x now. Not sure why.
+%ifnarch s390x
 # RHEL and ELN do not have all required packages
 %bcond_without DOCPDF
 %endif
+%endif
 %bcond_with    TSAN
 # Add experimental extra verbose logging of query processing
 %bcond_with    QUERYTRACE
@@ -87,7 +90,7 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it.
 # Updating just bind will cause freeipa-dns-server package to be uninstallable.
 Version:  9.18.31
-Release:  2%{?dist}
+Release:  3%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -991,6 +994,9 @@ fi;
 %endif
 
 %changelog
+* Thu Dec 12 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.31-3
+- Disable temporarily PDF generation on s390x
+
 * Wed Dec 04 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.31-2
 - Add nsupdate TLS support (FREEIPA-11706)
 - Include a test for nsupdate changes

From ad87dca169121d88a5a6040e661799109e5f2f3a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 12 Dec 2024 20:00:58 +0100
Subject: [PATCH 374/460] Disable PDF for all platforms temproarily

It fails only on s390x, but cannot be disabled just on one arch when the
package is noarch. Disable it until resolved.

Related: rhbz#2332076
---
 bind.spec | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/bind.spec b/bind.spec
index e885e89..7835e2f 100644
--- a/bind.spec
+++ b/bind.spec
@@ -24,11 +24,9 @@
 # Because of issues with PDF rebuild, include only HTML pages
 # Current error: unable top find isc-logo.pdf
 %if 0%{?fedora}
-# xindy fails on s390x now. Not sure why.
-%ifnarch s390x
 # RHEL and ELN do not have all required packages
-%bcond_without DOCPDF
-%endif
+# xindy fails on s390x now. Not sure why. rhbz#2332076
+%bcond_with    DOCPDF
 %endif
 %bcond_with    TSAN
 # Add experimental extra verbose logging of query processing
@@ -995,7 +993,7 @@ fi;
 
 %changelog
 * Thu Dec 12 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.31-3
-- Disable temporarily PDF generation on s390x
+- Disable temporarily PDF generation on all platforms
 
 * Wed Dec 04 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.31-2
 - Add nsupdate TLS support (FREEIPA-11706)

From 7d1027aabfe2bd483ad368b0dabd5341147f0047 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 12 Dec 2024 19:54:03 +0100
Subject: [PATCH 375/460] Update to 9.18.32 (rhbz#2331675)

- Remove CHANGES file from package

Removed Features:

- Disable DLZ plugins, they are not shipped with bind anymore

New Features:

- new 2024 KSK root key

Feature Changes:

- max-records-per-type and max-types-per-name improved logging when
  reached over their value

And NSEC3 and two dig bug fixes.

https://downloads.isc.org/isc/bind9/9.18.32/doc/arm/html/notes.html#notes-for-bind-9-18-32
---
 .gitignore                        |  2 ++
 bind-9.20-nsupdate-tls.patch      | 56 ++++++++++++++++++-------------
 bind-9.20-openssl-no-engine.patch | 47 --------------------------
 bind-9.5-PIE.patch                | 27 ++++++++++-----
 bind.spec                         | 17 +++++-----
 sources                           |  4 +--
 6 files changed, 64 insertions(+), 89 deletions(-)
 delete mode 100644 bind-9.20-openssl-no-engine.patch

diff --git a/.gitignore b/.gitignore
index 5e41d3f..65b7f81 100644
--- a/.gitignore
+++ b/.gitignore
@@ -232,3 +232,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.18.30.tar.xz.asc
 /bind-9.18.31.tar.xz
 /bind-9.18.31.tar.xz.asc
+/bind-9.18.32.tar.xz
+/bind-9.18.32.tar.xz.asc
diff --git a/bind-9.20-nsupdate-tls.patch b/bind-9.20-nsupdate-tls.patch
index 183ff0b..51f1b1e 100644
--- a/bind-9.20-nsupdate-tls.patch
+++ b/bind-9.20-nsupdate-tls.patch
@@ -1,7 +1,7 @@
-From ec00ba4b215963af5e05892cf2ce1a62222ede46 Mon Sep 17 00:00:00 2001
+From 5536f80f32ad22160ab98acf31e49768d3cf76fc Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Mon, 11 Nov 2024 18:09:07 +0100
-Subject: [PATCH 1/3] Backport nsupdate TLS support into 9.18
+Subject: [PATCH] Backport nsupdate TLS support into 9.18
 
 Attempt to support TLS from nsupdate even in 9.18 release.
 
@@ -40,9 +40,11 @@ implementation as a model for the newly added features.
 
 [pemensik] Adapted to previous 9.18 changes.
 Add usage and command line parsing
+
+Adapted to 9.18.32
 ---
  bin/nsupdate/nsupdate.c         | 192 ++++++++++++++++++++----
- lib/dns/dispatch.c              | 107 ++++++++++++--
+ lib/dns/dispatch.c              | 113 ++++++++++++--
  lib/dns/include/dns/dispatch.h  |  22 +++
  lib/dns/include/dns/request.h   |  23 +++
  lib/dns/include/dns/transport.h |  45 +++++-
@@ -50,10 +52,10 @@ Add usage and command line parsing
  lib/dns/request.c               |  63 ++++++--
  lib/dns/transport.c             | 253 ++++++++++++++++++++++++++++++++
  lib/dns/xfrin.c                 | 232 +----------------------------
- 9 files changed, 649 insertions(+), 290 deletions(-)
+ 9 files changed, 652 insertions(+), 293 deletions(-)
 
 diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
-index 45ba90fba7b..93c7ea6cb17 100644
+index 293ed28..819925e 100644
 --- a/bin/nsupdate/nsupdate.c
 +++ b/bin/nsupdate/nsupdate.c
 @@ -45,6 +45,7 @@
@@ -449,7 +451,7 @@ index 45ba90fba7b..93c7ea6cb17 100644
  	if (answer != NULL) {
  		dns_message_detach(&answer);
 diff --git a/lib/dns/dispatch.c b/lib/dns/dispatch.c
-index d737363fea4..44a2896cb03 100644
+index eb37198..9b263db 100644
 --- a/lib/dns/dispatch.c
 +++ b/lib/dns/dispatch.c
 @@ -30,6 +30,7 @@
@@ -497,7 +499,7 @@ index d737363fea4..44a2896cb03 100644
  	dns_dispatchstate_t state;
  	isc_refcount_t references;
  
-@@ -220,13 +227,27 @@ udp_dispatch_getnext(dns_dispentry_t *resp, int32_t timeout);
+@@ -220,16 +227,30 @@ udp_dispatch_getnext(dns_dispentry_t *resp, int32_t timeout);
  
  static const char *
  socktype2str(dns_dispentry_t *resp) {
@@ -517,17 +519,23 @@ index d737363fea4..44a2896cb03 100644
 +
 +	switch (transport_type) {
 +	case DNS_TRANSPORT_UDP:
- 		return ("UDP");
+ 		return "UDP";
 -	case isc_socktype_tcp:
 +	case DNS_TRANSPORT_TCP:
- 		return ("TCP");
+ 		return "TCP";
+-	default:
+-		return "<unexpected>";
+-	}
 +	case DNS_TRANSPORT_TLS:
 +		return "TLS";
 +	case DNS_TRANSPORT_HTTP:
 +		return "HTTP";
- 	default:
- 		return ("<unexpected>");
- 	}
++ 	default:
++ 		return ("<unexpected>");
++ 	}
+ }
+ 
+ static const char *
 @@ -1161,6 +1182,15 @@ dispatch_allocate(dns_dispatchmgr_t *mgr, isc_socktype_t type,
  isc_result_t
  dns_dispatch_createtcp(dns_dispatchmgr_t *mgr, const isc_sockaddr_t *localaddr,
@@ -627,7 +635,7 @@ index d737363fea4..44a2896cb03 100644
  #if DNS_DISPATCH_TRACE
  	fprintf(stderr, "dns_dispentry__init:%s:%s:%d:%p->references = 1\n",
 @@ -1530,6 +1587,14 @@ dns_dispatch_add(dns_dispatch_t *disp, unsigned int options,
- 		return (ISC_R_NOMORE);
+ 		return ISC_R_NOMORE;
  	}
  
 +	if (transport != NULL) {
@@ -678,7 +686,7 @@ index d737363fea4..44a2896cb03 100644
  	LOCK(&disp->lock);
  	switch (disp->state) {
 diff --git a/lib/dns/include/dns/dispatch.h b/lib/dns/include/dns/dispatch.h
-index ad377f078ed..cfdc37481ce 100644
+index ad377f0..cfdc374 100644
 --- a/lib/dns/include/dns/dispatch.h
 +++ b/lib/dns/include/dns/dispatch.h
 @@ -56,6 +56,7 @@
@@ -739,7 +747,7 @@ index ad377f078ed..cfdc37481ce 100644
   * Add a response entry for this dispatch.
   *
 diff --git a/lib/dns/include/dns/request.h b/lib/dns/include/dns/request.h
-index d00574f9827..17bcbf68c3b 100644
+index d00574f..17bcbf6 100644
 --- a/lib/dns/include/dns/request.h
 +++ b/lib/dns/include/dns/request.h
 @@ -44,6 +44,7 @@
@@ -787,7 +795,7 @@ index d00574f9827..17bcbf68c3b 100644
   * \brief Create and send a request.
   *
 diff --git a/lib/dns/include/dns/transport.h b/lib/dns/include/dns/transport.h
-index e74ccd7f970..e6499a97e73 100644
+index e74ccd7..e6499a9 100644
 --- a/lib/dns/include/dns/transport.h
 +++ b/lib/dns/include/dns/transport.h
 @@ -13,7 +13,9 @@
@@ -874,7 +882,7 @@ index e74ccd7f970..e6499a97e73 100644
   * Requires:
   *\li	'transport' is valid.
 diff --git a/lib/dns/include/dns/types.h b/lib/dns/include/dns/types.h
-index 6465962bd41..f0aaa24e936 100644
+index 6465962..f0aaa24 100644
 --- a/lib/dns/include/dns/types.h
 +++ b/lib/dns/include/dns/types.h
 @@ -141,6 +141,8 @@ typedef struct dns_ssutable	     dns_ssutable_t;
@@ -887,7 +895,7 @@ index 6465962bd41..f0aaa24e936 100644
  typedef struct dns_tsec		     dns_tsec_t;
  typedef struct dns_tsig_keyring	     dns_tsig_keyring_t;
 diff --git a/lib/dns/request.c b/lib/dns/request.c
-index fb17ed2262e..463a7ca6d63 100644
+index 8aaa29f..badedab 100644
 --- a/lib/dns/request.c
 +++ b/lib/dns/request.c
 @@ -399,12 +399,12 @@ isblackholed(dns_dispatchmgr_t *dispatchmgr, const isc_sockaddr_t *destaddr) {
@@ -914,7 +922,7 @@ index fb17ed2262e..463a7ca6d63 100644
 -					destaddr, dispatchp);
 +	result = dns_dispatch_createtcp2(requestmgr->dispatchmgr, srcaddr,
 +					 destaddr, transport, 0, dispatchp);
- 	return (result);
+ 	return result;
  }
  
 @@ -452,12 +452,12 @@ udp_dispatch(dns_requestmgr_t *requestmgr, const isc_sockaddr_t *srcaddr,
@@ -1021,7 +1029,7 @@ index fb17ed2262e..463a7ca6d63 100644
  		goto detach;
  	}
 diff --git a/lib/dns/transport.c b/lib/dns/transport.c
-index ae1ab7415b1..59eba1db252 100644
+index 88a3df4..2a779ba 100644
 --- a/lib/dns/transport.c
 +++ b/lib/dns/transport.c
 @@ -15,9 +15,11 @@
@@ -1302,7 +1310,7 @@ index ae1ab7415b1..59eba1db252 100644
  transport_destroy(dns_transport_t *transport) {
  	isc_refcount_destroy(&transport->references);
 diff --git a/lib/dns/xfrin.c b/lib/dns/xfrin.c
-index 72b24e15ac3..73bd834070c 100644
+index 3a4f761..3695815 100644
 --- a/lib/dns/xfrin.c
 +++ b/lib/dns/xfrin.c
 @@ -962,234 +962,6 @@ xfrin_create(isc_mem_t *mctx, dns_zone_t *zone, dns_db_t *db, isc_nm_t *netmgr,
@@ -1516,7 +1524,7 @@ index 72b24e15ac3..73bd834070c 100644
 -		*pctx = found;
 -	}
 -
--	return (ISC_R_SUCCESS);
+-	return ISC_R_SUCCESS;
 -
 -failure:
 -	if (tlsctx != NULL) {
@@ -1534,7 +1542,7 @@ index 72b24e15ac3..73bd834070c 100644
 -		isc_tls_cert_store_free(&store);
 -	}
 -
--	return (result);
+-	return result;
 -}
 -
  static isc_result_t
@@ -1552,5 +1560,5 @@ index 72b24e15ac3..73bd834070c 100644
  			goto failure;
  		}
 -- 
-2.47.0
+2.47.1
 
diff --git a/bind-9.20-openssl-no-engine.patch b/bind-9.20-openssl-no-engine.patch
deleted file mode 100644
index adb46aa..0000000
--- a/bind-9.20-openssl-no-engine.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From b487bd340ae1b635ce5cffe76f748ddc97f301f7 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Sat, 3 Aug 2024 01:28:36 +0200
-Subject: [PATCH] Remove unused <openssl/{hmac,engine}.h> headers from OpenSSL
- shims
-
-The <openssl/{hmac,engine}.h> headers were unused and including the
-<openssl/engine.h> header might cause build failure when OpenSSL
-doesn't have Engines support enabled.
-
-See https://fedoraproject.org/wiki/Changes/OpensslDeprecateEngine
----
- lib/isc/openssl_shim.c | 2 --
- lib/isc/openssl_shim.h | 2 --
- 2 files changed, 4 deletions(-)
-
-diff --git a/lib/isc/openssl_shim.c b/lib/isc/openssl_shim.c
-index c39ba8c6827..02d0105eb9e 100644
---- a/lib/isc/openssl_shim.c
-+++ b/lib/isc/openssl_shim.c
-@@ -16,9 +16,7 @@
- #include <string.h>
- 
- #include <openssl/crypto.h>
--#include <openssl/engine.h>
- #include <openssl/evp.h>
--#include <openssl/hmac.h>
- #include <openssl/opensslv.h>
- #include <openssl/ssl.h>
- 
-diff --git a/lib/isc/openssl_shim.h b/lib/isc/openssl_shim.h
-index b2916e20a90..95b2f08e231 100644
---- a/lib/isc/openssl_shim.h
-+++ b/lib/isc/openssl_shim.h
-@@ -14,9 +14,7 @@
- #pragma once
- 
- #include <openssl/crypto.h>
--#include <openssl/engine.h>
- #include <openssl/evp.h>
--#include <openssl/hmac.h>
- #include <openssl/opensslv.h>
- #include <openssl/ssl.h>
- 
--- 
-2.46.2
-
diff --git a/bind-9.5-PIE.patch b/bind-9.5-PIE.patch
index 1420cf3..9744f69 100644
--- a/bind-9.5-PIE.patch
+++ b/bind-9.5-PIE.patch
@@ -1,17 +1,28 @@
+From 13348a5fc64387bf53ef450688e181100d0ceddb Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Thu, 12 Dec 2024 15:56:13 +0100
+Subject: [PATCH] Harden named service build flags
+
+---
+ bin/named/Makefile.am | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
 diff --git a/bin/named/Makefile.am b/bin/named/Makefile.am
-index 57a023b..085f2f7 100644
+index 57a023b..b832e9c 100644
 --- a/bin/named/Makefile.am
 +++ b/bin/named/Makefile.am
-@@ -32,9 +32,12 @@ AM_CPPFLAGS +=				\
- endif HAVE_LIBXML2
+@@ -33,7 +33,10 @@ endif HAVE_LIBXML2
  
  AM_CPPFLAGS +=						\
-+	-fpie                                           \
  	-DNAMED_LOCALSTATEDIR=\"${localstatedir}\"	\
- 	-DNAMED_SYSCONFDIR=\"${sysconfdir}\"
- 
-+AM_LDFLAGS += -pie -Wl,-z,relro,-z,now,-z,nodlopen,-z,noexecstack
+-	-DNAMED_SYSCONFDIR=\"${sysconfdir}\"
++	-DNAMED_SYSCONFDIR=\"${sysconfdir}\"		\
++	-fpie
 +
++AM_LDFLAGS  += -pie -Wl,-z,relro,-z,now,-z,nodlopen,-z,noexecstack
+ 
  sbin_PROGRAMS = named
  
- nodist_named_SOURCES = xsl.c
+-- 
+2.47.1
+
diff --git a/bind.spec b/bind.spec
index 7835e2f..7f2619d 100644
--- a/bind.spec
+++ b/bind.spec
@@ -10,7 +10,7 @@
 %bcond_without JSON
 %if ! 0%{?rhel}
 # FIXME: Not ready. Should it be worked on?
-%bcond_without DLZ
+%bcond_with    DLZ
 %endif
 # New MaxMind GeoLite support
 %bcond_without GEOIP2
@@ -87,8 +87,8 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 #
 # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it.
 # Updating just bind will cause freeipa-dns-server package to be uninstallable.
-Version:  9.18.31
-Release:  3%{?dist}
+Version:  9.18.32
+Release:  1%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -125,10 +125,6 @@ Patch10: bind-9.5-PIE.patch
 Patch16: bind-9.16-redhat_doc.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=2122010
 Patch26: bind-9.18-unittest-netmgr-unstable.patch
-# https://fedoraproject.org/wiki/Changes/OpensslDeprecateEngine
-# Correct support for building without openssl/engine.h header
-# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/9593
-Patch27: bind-9.20-openssl-no-engine.patch
 # Downstream backport from 9.20
 # https://issues.redhat.com/browse/FREEIPA-11706
 # https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/6751
@@ -825,7 +821,7 @@ fi;
 %{_mandir}/man8/rndc-confgen.8*
 %{_mandir}/man1/named-journalprint.1*
 %{_mandir}/man8/filter-*.8.gz
-%doc CHANGES README.md named.conf.default
+%doc README.md named.conf.default
 %doc sample/
 
 # Hide configuration
@@ -992,6 +988,11 @@ fi;
 %endif
 
 %changelog
+* Thu Dec 12 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.32-1
+- Update to 9.18.32 (#2331675)
+- Remove CHANGES file from package
+- Disable DLZ plugins, they are not shipped with bind anymore
+
 * Thu Dec 12 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.31-3
 - Disable temporarily PDF generation on all platforms
 
diff --git a/sources b/sources
index 42e8fc8..36b309b 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.18.31.tar.xz) = e51873484be3ee367eb1e601b8e0adc45abcdb16df04021ea42ffcc51b99821f8b30f67b2a693a90ad3efa51698a651c8da9d7947ee8fa19680f627afe1f7034
-SHA512 (bind-9.18.31.tar.xz.asc) = 2c17d9a9f153264ed18b287e081b432b5310746964be3e35dfd31597622182e822e62fc3cc4034c0e1c7041949e624c43ffb10d134145d6300f8135f86e38cc6
+SHA512 (bind-9.18.32.tar.xz) = fa01978ca44cb5d559d8675dda4272b1327aebc0dca68b2e7b948e8c1bbd82da74f6258d40896ddccf86711d554b7ed4c0df93143e78b663724466738ac1320d
+SHA512 (bind-9.18.32.tar.xz.asc) = b1b15734a90ec2df2da4a9f881fd9f9ea217a12e521b01d2cb06ff0f3305c80c933309d2bddf926e0ab647f4b925b4950c25c5d464ed276727dfbf6824387830

From a3b1b4c6a279ec1c74cb61f0cea1de07c638b9de Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 12 Dec 2024 21:25:14 +0100
Subject: [PATCH 376/460] Add new root key 38696 into package files too

Add KSK 2024 into bind package files too.
---
 bind.spec       | 1 +
 named.root.key  | 5 +++++
 trusted-key.key | 1 +
 3 files changed, 7 insertions(+)

diff --git a/bind.spec b/bind.spec
index 7f2619d..3ed7306 100644
--- a/bind.spec
+++ b/bind.spec
@@ -992,6 +992,7 @@ fi;
 - Update to 9.18.32 (#2331675)
 - Remove CHANGES file from package
 - Disable DLZ plugins, they are not shipped with bind anymore
+- Add new root key 38696 into package files too
 
 * Thu Dec 12 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.31-3
 - Disable temporarily PDF generation on all platforms
diff --git a/named.root.key b/named.root.key
index fbcb5d3..b57e61d 100644
--- a/named.root.key
+++ b/named.root.key
@@ -10,4 +10,9 @@ trust-anchors {
         # managed key database will be trusted and maintained
         # automatically.
         . initial-ds 20326 8 2 "E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D";
+        # This key (38696) will be pre-published in the root zone in 2025
+        # and is scheduled to begin signing in late 2026. At that time,
+        # servers which were already using the old key (20326) should roll
+        # seamlessly to this new one via RFC 5011 rollover.
+        . initial-ds 38696 8 2 "683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A4C0FB2B16";
 };
diff --git a/trusted-key.key b/trusted-key.key
index 7b845f3..2ef50c7 100644
--- a/trusted-key.key
+++ b/trusted-key.key
@@ -1 +1,2 @@
 . 3600 IN DNSKEY 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU=
+. 3600 IN DNSKEY 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdpWWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwuMoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBevYtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc=

From e4107d36cea603f8ef580a2ecbf0d59b122e6b25 Mon Sep 17 00:00:00 2001
From: Adam Williamson <awilliam@redhat.com>
Date: Fri, 20 Dec 2024 09:29:12 -0800
Subject: [PATCH 377/460] No change sidetag rebuild to include bind-dyndb-ldap

---
 bind.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index 3ed7306..2f7f265 100644
--- a/bind.spec
+++ b/bind.spec
@@ -88,7 +88,7 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it.
 # Updating just bind will cause freeipa-dns-server package to be uninstallable.
 Version:  9.18.32
-Release:  1%{?dist}
+Release:  2%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -988,6 +988,9 @@ fi;
 %endif
 
 %changelog
+* Fri Dec 20 2024 Adam Williamson <awilliam@redhat.com> - 32:9.18.32-2
+- No change sidetag rebuild to include bind-dyndb-ldap
+
 * Thu Dec 12 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.32-1
 - Update to 9.18.32 (#2331675)
 - Remove CHANGES file from package

From 7ec2fb38cab2e019c74b83ad1a7901b5ade24e37 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
Date: Mon, 13 Jan 2025 09:48:53 +0100
Subject: [PATCH 378/460] Rebuilt for the bin-sbin merge (2nd attempt)

https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin
---
 bind.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index 2f7f265..691405c 100644
--- a/bind.spec
+++ b/bind.spec
@@ -88,7 +88,7 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it.
 # Updating just bind will cause freeipa-dns-server package to be uninstallable.
 Version:  9.18.32
-Release:  2%{?dist}
+Release:  3%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -988,6 +988,9 @@ fi;
 %endif
 
 %changelog
+* Mon Jan 13 2025 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 32:9.18.32-3
+- Rebuilt for the bin-sbin merge (2nd attempt)
+
 * Fri Dec 20 2024 Adam Williamson <awilliam@redhat.com> - 32:9.18.32-2
 - No change sidetag rebuild to include bind-dyndb-ldap
 

From a553c9e873cf59b79eecac0fcd4a3e9dd4032522 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Thu, 16 Jan 2025 12:29:30 +0000
Subject: [PATCH 379/460] Rebuilt for
 https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild

---
 bind.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index 691405c..10c18ea 100644
--- a/bind.spec
+++ b/bind.spec
@@ -88,7 +88,7 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it.
 # Updating just bind will cause freeipa-dns-server package to be uninstallable.
 Version:  9.18.32
-Release:  3%{?dist}
+Release:  4%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -988,6 +988,9 @@ fi;
 %endif
 
 %changelog
+* Thu Jan 16 2025 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.18.32-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
+
 * Mon Jan 13 2025 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 32:9.18.32-3
 - Rebuilt for the bin-sbin merge (2nd attempt)
 

From 5b3a19a8c2e426d65ce248be02e74131c784f117 Mon Sep 17 00:00:00 2001
From: Adam Williamson <awilliam@redhat.com>
Date: Wed, 15 Jan 2025 17:01:58 -0800
Subject: [PATCH 380/460] Add named user and group provides

Now https://src.fedoraproject.org/rpms/rpm/pull-request/61 has
landed, packages that set up users and groups must have user(x)
and group(x) provides. If bind used the mechanism recommended in
the guidelines for creating users and groups, this would happen
automatically, but it does not, so this just adds explicit
Provides as a minimal short-term fix.

Signed-off-by: Adam Williamson <awilliam@redhat.com>
---
 bind.spec | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/bind.spec b/bind.spec
index 10c18ea..ea86812 100644
--- a/bind.spec
+++ b/bind.spec
@@ -208,6 +208,12 @@ BuildRequires:  python3-sphinx-latex latexmk texlive-xetex texlive-xindy
 BuildRequires: libtsan
 %endif
 
+# https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers
+# since we don't follow the guidelines on how users and groups should
+# be created we must explicitly specify these provides
+Provides: user(named)
+Provides: group(named)
+
 %description
 BIND (Berkeley Internet Name Domain) is an implementation of the DNS
 (Domain Name System) protocols. BIND includes a DNS server (named),

From 0cd50aebbd4cf67c3b356be338d26e8bd6ef765b Mon Sep 17 00:00:00 2001
From: Adam Williamson <awilliam@redhat.com>
Date: Thu, 16 Jan 2025 10:13:24 -0800
Subject: [PATCH 381/460] Bump to -5

---
 bind.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index ea86812..8228f54 100644
--- a/bind.spec
+++ b/bind.spec
@@ -88,7 +88,7 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it.
 # Updating just bind will cause freeipa-dns-server package to be uninstallable.
 Version:  9.18.32
-Release:  4%{?dist}
+Release:  5%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -994,6 +994,9 @@ fi;
 %endif
 
 %changelog
+* Thu Jan 16 2025 Adam Williamson <awilliam@redhat.com> - 32:9.18.32-5
+- Provide user(named) and group(named)
+
 * Thu Jan 16 2025 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.18.32-4
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
 

From 549048cb0ed341402173b81e15414f75f6b7d74c Mon Sep 17 00:00:00 2001
From: Adam Williamson <awilliam@redhat.com>
Date: Thu, 16 Jan 2025 10:30:16 -0800
Subject: [PATCH 382/460] Bump to -6 and rebuild on mass rebuild tag

---
 bind.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index 8228f54..a09cf38 100644
--- a/bind.spec
+++ b/bind.spec
@@ -88,7 +88,7 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it.
 # Updating just bind will cause freeipa-dns-server package to be uninstallable.
 Version:  9.18.32
-Release:  5%{?dist}
+Release:  6%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -994,6 +994,9 @@ fi;
 %endif
 
 %changelog
+* Thu Jan 16 2025 Adam Williamson <awilliam@redhat.com> - 32:9.18.32-6
+- Rebuild again on mass rebuild tag so -4 doesn't override -5
+
 * Thu Jan 16 2025 Adam Williamson <awilliam@redhat.com> - 32:9.18.32-5
 - Provide user(named) and group(named)
 

From 071ec07d27989a8d548834292fa46ca2312b4862 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 17 Jan 2025 14:51:23 +0100
Subject: [PATCH 383/460] Add sysusers named user creation (rhbz#2105415)

Drop original user creating in favor of sysusers file definition.
---
 bind.spec      | 24 ++++++++++++------------
 named.sysusers |  3 +++
 2 files changed, 15 insertions(+), 12 deletions(-)
 create mode 100644 named.sysusers

diff --git a/bind.spec b/bind.spec
index a09cf38..f0a0750 100644
--- a/bind.spec
+++ b/bind.spec
@@ -36,8 +36,6 @@
   %bcond_without OPENSSL_ENGINE
 %endif
 
-%{?!bind_uid:  %global bind_uid  25}
-%{?!bind_gid:  %global bind_gid  25}
 %{!?_pkgdocdir:%global _pkgdocdir %{_docdir}/%{name}-%{version}}
 %global        bind_dir          /var/named
 %global        chroot_prefix     %{bind_dir}/chroot
@@ -88,7 +86,7 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it.
 # Updating just bind will cause freeipa-dns-server package to be uninstallable.
 Version:  9.18.32
-Release:  6%{?dist}
+Release:  7%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -118,6 +116,7 @@ Source44: named-chroot-setup.service
 Source46: named-setup-rndc.service
 Source48: setup-named-softhsm.sh
 Source49: named-chroot.files
+Source50: named.sysusers
 
 # Common patches
 # FIXME: Is this still required?
@@ -136,8 +135,9 @@ Patch29: bind-9.20-nsupdate-tls-doc.patch
 Patch30: bind-9.20-nsupdate-tls-test.patch
 
 %{?systemd_ordering}
+# https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers
+%{?sysusers_requires_compat}
 Requires:       coreutils
-Requires(pre):  shadow-utils
 Requires(post): shadow-utils
 Requires(post): glibc-common
 Requires(post): grep
@@ -208,12 +208,6 @@ BuildRequires:  python3-sphinx-latex latexmk texlive-xetex texlive-xindy
 BuildRequires: libtsan
 %endif
 
-# https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers
-# since we don't follow the guidelines on how users and groups should
-# be created we must explicitly specify these provides
-Provides: user(named)
-Provides: group(named)
-
 %description
 BIND (Berkeley Internet Name Domain) is an implementation of the DNS
 (Domain Name System) protocols. BIND includes a DNS server (named),
@@ -594,6 +588,9 @@ install -m 644 %{SOURCE38} ${RPM_BUILD_ROOT}%{_unitdir}
 install -m 644 %{SOURCE44} ${RPM_BUILD_ROOT}%{_unitdir}
 install -m 644 %{SOURCE46} ${RPM_BUILD_ROOT}%{_unitdir}
 
+mkdir -p ${RPM_BUILD_ROOT}%{_sysusersdir}
+install -m 644 %{SOURCE50} ${RPM_BUILD_ROOT}%{_sysusersdir}/named.conf
+
 mkdir -p ${RPM_BUILD_ROOT}%{_libexecdir}
 install -m 755 %{SOURCE41} ${RPM_BUILD_ROOT}%{_libexecdir}/setup-named-chroot.sh
 install -m 755 %{SOURCE42} ${RPM_BUILD_ROOT}%{_libexecdir}/generate-rndc-key.sh
@@ -706,8 +703,7 @@ install -m 644 %{SOURCE43} ${RPM_BUILD_ROOT}%{_sysconfdir}/rwtab.d/named
 
 %pre
 if [ "$1" -eq 1 ]; then
-  /usr/sbin/groupadd -g %{bind_gid} -f -r named >/dev/null 2>&1 || :;
-  /usr/sbin/useradd  -u %{bind_uid} -r -N -M -g named -s /sbin/nologin -d /var/named -c Named named >/dev/null 2>&1 || :;
+  %sysusers_create_compat %{SOURCE50}
 fi;
 :;
 
@@ -806,6 +802,7 @@ fi;
 %{_sysconfdir}/rwtab.d/named
 %{_unitdir}/named.service
 %{_unitdir}/named-setup-rndc.service
+%{_sysusersdir}/named.conf
 %{_bindir}/named-journalprint
 %{_bindir}/named-checkconf
 %{_bindir}/named-rrchecker
@@ -994,6 +991,9 @@ fi;
 %endif
 
 %changelog
+* Fri Jan 17 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.32-7
+- Add sysusers named user creation (rhbz#2105415)
+
 * Thu Jan 16 2025 Adam Williamson <awilliam@redhat.com> - 32:9.18.32-6
 - Rebuild again on mass rebuild tag so -4 doesn't override -5
 
diff --git a/named.sysusers b/named.sysusers
new file mode 100644
index 0000000..f173c78
--- /dev/null
+++ b/named.sysusers
@@ -0,0 +1,3 @@
+#Type Name       ID                  GECOS              Home directory Shell
+u     named      25                 "Named"             /var/named     /sbin/nologin
+g     named      25

From c72c74cce0cd07603de978d0b65b0b93e672ae18 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Sun, 2 Feb 2025 15:34:28 +0100
Subject: [PATCH 384/460] Update to 9.16.33 (rhbz#2342784)

Security Fixes:

- DNS-over-HTTPS flooding fixes. (CVE-2024-12705)
- Limit additional section processing for large RDATA sets. (CVE-2024-11187)

New Features:

- Add a new option to configure the maximum number of outgoing queries per client request.

Bug Fixes:

- Fix nsupdate hang when processing a large update.
- Fix possible assertion failure when reloading server while processing update policy rules. [GL #5006]
- Fix dnssec-signzone signing non-DNSKEY RRsets with revoked keys.
- Fix improper handling of unknown directives in resolv.conf.

https://downloads.isc.org/isc/bind9/9.18.33/doc/arm/html/notes.html#notes-for-bind-9-18-33
---
 .gitignore | 2 ++
 bind.spec  | 7 +++++--
 sources    | 4 ++--
 3 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/.gitignore b/.gitignore
index 65b7f81..6abb2ea 100644
--- a/.gitignore
+++ b/.gitignore
@@ -234,3 +234,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.18.31.tar.xz.asc
 /bind-9.18.32.tar.xz
 /bind-9.18.32.tar.xz.asc
+/bind-9.18.33.tar.xz
+/bind-9.18.33.tar.xz.asc
diff --git a/bind.spec b/bind.spec
index f0a0750..b4c74a3 100644
--- a/bind.spec
+++ b/bind.spec
@@ -85,8 +85,8 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 #
 # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it.
 # Updating just bind will cause freeipa-dns-server package to be uninstallable.
-Version:  9.18.32
-Release:  7%{?dist}
+Version:  9.18.33
+Release:  1%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -991,6 +991,9 @@ fi;
 %endif
 
 %changelog
+* Sun Feb 02 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.33-1
+- Update to 9.16.33 (rhbz#2342784)
+
 * Fri Jan 17 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.32-7
 - Add sysusers named user creation (rhbz#2105415)
 
diff --git a/sources b/sources
index 36b309b..b3d92ee 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.18.32.tar.xz) = fa01978ca44cb5d559d8675dda4272b1327aebc0dca68b2e7b948e8c1bbd82da74f6258d40896ddccf86711d554b7ed4c0df93143e78b663724466738ac1320d
-SHA512 (bind-9.18.32.tar.xz.asc) = b1b15734a90ec2df2da4a9f881fd9f9ea217a12e521b01d2cb06ff0f3305c80c933309d2bddf926e0ab647f4b925b4950c25c5d464ed276727dfbf6824387830
+SHA512 (bind-9.18.33.tar.xz) = 874465ccc7af92561dccf2bd596e13513048c4f1da730a6f38103eeb1d5b67178c1e2e2a56612946eba6edb9dad34851b9826055bcb7c0dad7ec64f7df9c10b9
+SHA512 (bind-9.18.33.tar.xz.asc) = 248490e576b00672497be77e2aeaf47b2c6c2fc745c729d76521443ed7bbd9cd64447cf949aafb820f021653efda7fe77aff32e756d76115e5a3dcf69aadc0a3

From 201205375b809867017489ca19a717868c54386f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 10 Feb 2025 16:33:43 +0100
Subject: [PATCH 385/460] Use common pattern in gitignore for every minor
 update

Do not need to update .gitignore on every update of version. Use
wildcard for everything from now.
---
 .gitignore | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.gitignore b/.gitignore
index 6abb2ea..eae2ca9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -236,3 +236,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.18.32.tar.xz.asc
 /bind-9.18.33.tar.xz
 /bind-9.18.33.tar.xz.asc
+/bind-9.18.*.tar.xz
+/bind-9.18.*.tar.xz.asc

From a28c475b98edd0619f838061382372529094c05d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 10 Feb 2025 17:31:24 +0100
Subject: [PATCH 386/460] Updates to nsupdate TLS backport fixing memory

Properly release memory when TLS is used.
---
 bind-9.20-nsupdate-tls.patch | 92 ++++++++++++++++++++++++++----------
 1 file changed, 66 insertions(+), 26 deletions(-)

diff --git a/bind-9.20-nsupdate-tls.patch b/bind-9.20-nsupdate-tls.patch
index 51f1b1e..ccf46e4 100644
--- a/bind-9.20-nsupdate-tls.patch
+++ b/bind-9.20-nsupdate-tls.patch
@@ -1,4 +1,4 @@
-From 5536f80f32ad22160ab98acf31e49768d3cf76fc Mon Sep 17 00:00:00 2001
+From b44dc4ed5c34445511f06d4b972407d539f8e9da Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Mon, 11 Nov 2024 18:09:07 +0100
 Subject: [PATCH] Backport nsupdate TLS support into 9.18
@@ -41,10 +41,14 @@ implementation as a model for the newly added features.
 [pemensik] Adapted to previous 9.18 changes.
 Add usage and command line parsing
 
-Adapted to 9.18.32
+Fixup tls initialization from nsupdate
+
+Detach transport also on dispatch_destroy properly.
+
+Adapted to 9.18.33.
 ---
  bin/nsupdate/nsupdate.c         | 192 ++++++++++++++++++++----
- lib/dns/dispatch.c              | 113 ++++++++++++--
+ lib/dns/dispatch.c              | 128 ++++++++++++++--
  lib/dns/include/dns/dispatch.h  |  22 +++
  lib/dns/include/dns/request.h   |  23 +++
  lib/dns/include/dns/transport.h |  45 +++++-
@@ -52,7 +56,7 @@ Adapted to 9.18.32
  lib/dns/request.c               |  63 ++++++--
  lib/dns/transport.c             | 253 ++++++++++++++++++++++++++++++++
  lib/dns/xfrin.c                 | 232 +----------------------------
- 9 files changed, 652 insertions(+), 293 deletions(-)
+ 9 files changed, 668 insertions(+), 292 deletions(-)
 
 diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
 index 293ed28..819925e 100644
@@ -451,7 +455,7 @@ index 293ed28..819925e 100644
  	if (answer != NULL) {
  		dns_message_detach(&answer);
 diff --git a/lib/dns/dispatch.c b/lib/dns/dispatch.c
-index eb37198..9b263db 100644
+index eb37198..8273c32 100644
 --- a/lib/dns/dispatch.c
 +++ b/lib/dns/dispatch.c
 @@ -30,6 +30,7 @@
@@ -499,7 +503,7 @@ index eb37198..9b263db 100644
  	dns_dispatchstate_t state;
  	isc_refcount_t references;
  
-@@ -220,16 +227,30 @@ udp_dispatch_getnext(dns_dispentry_t *resp, int32_t timeout);
+@@ -220,13 +227,27 @@ udp_dispatch_getnext(dns_dispentry_t *resp, int32_t timeout);
  
  static const char *
  socktype2str(dns_dispentry_t *resp) {
@@ -523,20 +527,29 @@ index eb37198..9b263db 100644
 -	case isc_socktype_tcp:
 +	case DNS_TRANSPORT_TCP:
  		return "TCP";
--	default:
--		return "<unexpected>";
--	}
 +	case DNS_TRANSPORT_TLS:
 +		return "TLS";
 +	case DNS_TRANSPORT_HTTP:
 +		return "HTTP";
-+ 	default:
-+ 		return ("<unexpected>");
-+ 	}
- }
+ 	default:
+ 		return "<unexpected>";
+ 	}
+@@ -457,6 +478,14 @@ dispentry_destroy(dns_dispentry_t *resp) {
+ 		isc_nmhandle_detach(&resp->handle);
+ 	}
  
- static const char *
-@@ -1161,6 +1182,15 @@ dispatch_allocate(dns_dispatchmgr_t *mgr, isc_socktype_t type,
++	if (resp->tlsctx_cache != NULL) {
++		isc_tlsctx_cache_detach(&resp->tlsctx_cache);
++	}
++
++	if (resp->transport != NULL) {
++		dns_transport_detach(&resp->transport);
++	}
++
+ 	isc_mem_put(disp->mgr->mctx, resp, sizeof(*resp));
+ 
+ 	dns_dispatch_detach(&disp); /* DISPATCH001 */
+@@ -1161,6 +1190,15 @@ dispatch_allocate(dns_dispatchmgr_t *mgr, isc_socktype_t type,
  isc_result_t
  dns_dispatch_createtcp(dns_dispatchmgr_t *mgr, const isc_sockaddr_t *localaddr,
  		       const isc_sockaddr_t *destaddr, dns_dispatch_t **dispp) {
@@ -552,7 +565,7 @@ index eb37198..9b263db 100644
  	dns_dispatch_t *disp = NULL;
  
  	REQUIRE(VALID_DISPATCHMGR(mgr));
-@@ -1170,7 +1200,11 @@ dns_dispatch_createtcp(dns_dispatchmgr_t *mgr, const isc_sockaddr_t *localaddr,
+@@ -1170,7 +1208,11 @@ dns_dispatch_createtcp(dns_dispatchmgr_t *mgr, const isc_sockaddr_t *localaddr,
  
  	dispatch_allocate(mgr, isc_socktype_tcp, &disp);
  
@@ -564,7 +577,7 @@ index eb37198..9b263db 100644
  
  	if (localaddr != NULL) {
  		disp->local = *localaddr;
-@@ -1185,6 +1219,7 @@ dns_dispatch_createtcp(dns_dispatchmgr_t *mgr, const isc_sockaddr_t *localaddr,
+@@ -1185,6 +1227,7 @@ dns_dispatch_createtcp(dns_dispatchmgr_t *mgr, const isc_sockaddr_t *localaddr,
  	 * Append it to the dispatcher list.
  	 */
  
@@ -572,7 +585,7 @@ index eb37198..9b263db 100644
  	/* FIXME: There should be a lookup hashtable here */
  	ISC_LIST_APPEND(mgr->list, disp, link);
  	UNLOCK(&mgr->lock);
-@@ -1208,6 +1243,13 @@ dns_dispatch_createtcp(dns_dispatchmgr_t *mgr, const isc_sockaddr_t *localaddr,
+@@ -1208,6 +1251,13 @@ dns_dispatch_createtcp(dns_dispatchmgr_t *mgr, const isc_sockaddr_t *localaddr,
  isc_result_t
  dns_dispatch_gettcp(dns_dispatchmgr_t *mgr, const isc_sockaddr_t *destaddr,
  		    const isc_sockaddr_t *localaddr, dns_dispatch_t **dispp) {
@@ -586,7 +599,7 @@ index eb37198..9b263db 100644
  	dns_dispatch_t *disp_connected = NULL;
  	dns_dispatch_t *disp_fallback = NULL;
  	isc_result_t result = ISC_R_NOTFOUND;
-@@ -1248,8 +1290,10 @@ dns_dispatch_gettcp(dns_dispatchmgr_t *mgr, const isc_sockaddr_t *destaddr,
+@@ -1248,8 +1298,10 @@ dns_dispatch_gettcp(dns_dispatchmgr_t *mgr, const isc_sockaddr_t *destaddr,
  		if (disp->socktype != isc_socktype_tcp ||
  		    !isc_sockaddr_equal(destaddr, &peeraddr) ||
  		    (localaddr != NULL &&
@@ -598,7 +611,17 @@ index eb37198..9b263db 100644
  			UNLOCK(&disp->lock);
  			continue;
  		}
-@@ -1426,7 +1470,18 @@ dns_dispatch_add(dns_dispatch_t *disp, unsigned int options,
+@@ -1403,6 +1455,9 @@ dispatch_destroy(dns_dispatch_t *disp) {
+ 			     disp->handle, &disp->handle);
+ 		isc_nmhandle_detach(&disp->handle);
+ 	}
++	if (disp->transport != NULL) {
++		dns_transport_detach(&disp->transport);
++	}
+ 
+ 	isc_mutex_destroy(&disp->lock);
+ 
+@@ -1426,7 +1481,18 @@ dns_dispatch_add(dns_dispatch_t *disp, unsigned int options,
  		 unsigned int timeout, const isc_sockaddr_t *dest,
  		 dispatch_cb_t connected, dispatch_cb_t sent,
  		 dispatch_cb_t response, void *arg, dns_messageid_t *idp,
@@ -618,7 +641,7 @@ index eb37198..9b263db 100644
  	dns_dispentry_t *resp = NULL;
  	dns_qid_t *qid = NULL;
  	in_port_t localport;
-@@ -1444,6 +1499,7 @@ dns_dispatch_add(dns_dispatch_t *disp, unsigned int options,
+@@ -1444,6 +1510,7 @@ dns_dispatch_add(dns_dispatch_t *disp, unsigned int options,
  	REQUIRE(connected != NULL);
  	REQUIRE(response != NULL);
  	REQUIRE(sent != NULL);
@@ -626,7 +649,7 @@ index eb37198..9b263db 100644
  
  	LOCK(&disp->lock);
  
-@@ -1471,6 +1527,7 @@ dns_dispatch_add(dns_dispatch_t *disp, unsigned int options,
+@@ -1471,6 +1538,7 @@ dns_dispatch_add(dns_dispatch_t *disp, unsigned int options,
  		.rlink = ISC_LINK_INITIALIZER,
  		.magic = RESPONSE_MAGIC,
  	};
@@ -634,7 +657,7 @@ index eb37198..9b263db 100644
  
  #if DNS_DISPATCH_TRACE
  	fprintf(stderr, "dns_dispentry__init:%s:%s:%d:%p->references = 1\n",
-@@ -1530,6 +1587,14 @@ dns_dispatch_add(dns_dispatch_t *disp, unsigned int options,
+@@ -1530,6 +1598,14 @@ dns_dispatch_add(dns_dispatch_t *disp, unsigned int options,
  		return ISC_R_NOMORE;
  	}
  
@@ -649,7 +672,7 @@ index eb37198..9b263db 100644
  	dns_dispatch_attach(disp, &resp->disp); /* DISPATCH001 */
  
  	disp->requests++;
-@@ -1779,6 +1844,7 @@ dns_dispatch_done(dns_dispentry_t **respp) {
+@@ -1779,6 +1855,7 @@ dns_dispatch_done(dns_dispentry_t **respp) {
  	*respp = NULL;
  
  	dispentry_cancel(resp, ISC_R_CANCELED);
@@ -657,7 +680,7 @@ index eb37198..9b263db 100644
  	dns_dispentry_detach(&resp); /* DISPENTRY000 */
  }
  
-@@ -1970,6 +2036,27 @@ udp_dispatch_connect(dns_dispatch_t *disp, dns_dispentry_t *resp) {
+@@ -1970,6 +2047,27 @@ udp_dispatch_connect(dns_dispatch_t *disp, dns_dispentry_t *resp) {
  
  static isc_result_t
  tcp_dispatch_connect(dns_dispatch_t *disp, dns_dispentry_t *resp) {
@@ -685,6 +708,23 @@ index eb37198..9b263db 100644
  	/* Check whether the dispatch is already connecting or connected. */
  	LOCK(&disp->lock);
  	switch (disp->state) {
+@@ -1995,8 +2093,14 @@ tcp_dispatch_connect(dns_dispatch_t *disp, dns_dispentry_t *resp) {
+ 			      "connecting from %s to %s, timeout %u", localbuf,
+ 			      peerbuf, resp->timeout);
+ 
+-		isc_nm_tcpdnsconnect(disp->mgr->nm, &disp->local, &disp->peer,
+-				     tcp_connected, disp, resp->timeout, 0);
++		if (tlsctx != NULL) {
++			isc_nm_tlsdnsconnect(disp->mgr->nm, &disp->local, &disp->peer,
++					     tcp_connected, disp, resp->timeout, 0,
++					     tlsctx, sess_cache);
++		} else {
++			isc_nm_tcpdnsconnect(disp->mgr->nm, &disp->local, &disp->peer,
++					     tcp_connected, disp, resp->timeout, 0);
++		}
+ 		break;
+ 
+ 	case DNS_DISPATCHSTATE_CONNECTING:
 diff --git a/lib/dns/include/dns/dispatch.h b/lib/dns/include/dns/dispatch.h
 index ad377f0..cfdc374 100644
 --- a/lib/dns/include/dns/dispatch.h
@@ -1560,5 +1600,5 @@ index 3a4f761..3695815 100644
  			goto failure;
  		}
 -- 
-2.47.1
+2.48.1
 

From c7c0f860f49a040c10b56ea650f42198f98e175a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 10 Feb 2025 20:08:55 +0100
Subject: [PATCH 387/460] Permanently remove DLZ parts build

---
 bind.spec | 98 +++----------------------------------------------------
 1 file changed, 4 insertions(+), 94 deletions(-)

diff --git a/bind.spec b/bind.spec
index b4c74a3..e51e9f9 100644
--- a/bind.spec
+++ b/bind.spec
@@ -8,10 +8,6 @@
 %bcond_with    SYSTEMTEST
 %bcond_without GSSTSIG
 %bcond_without JSON
-%if ! 0%{?rhel}
-# FIXME: Not ready. Should it be worked on?
-%bcond_with    DLZ
-%endif
 # New MaxMind GeoLite support
 %bcond_without GEOIP2
 # Disabled temporarily until kyua is fixed on rawhide, bug #1926779
@@ -86,7 +82,7 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it.
 # Updating just bind will cause freeipa-dns-server package to be uninstallable.
 Version:  9.18.33
-Release:  1%{?dist}
+Release:  2%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -161,11 +157,6 @@ BuildRequires:  jemalloc-devel
 BuildRequires:  gnupg2
 %endif
 BuildRequires:  libuv-devel
-%if %{with DLZ}
-BuildRequires:  openldap-devel
-BuildRequires:  sqlite-devel
-BuildRequires:  mariadb-connector-c-devel
-%endif
 %if %{with UNITTEST}
 # make unit dependencies
 BuildRequires:  libcmocka-devel
@@ -306,40 +297,6 @@ This package contains a tree of files which can be used as a
 chroot(2) jail for the named(8) program from the BIND package.
 Based on the code from Jan "Yenya" Kasprzak <kas@fi.muni.cz>
 
-
-%if %{with DLZ}
-%package dlz-filesystem
-Summary: BIND server filesystem DLZ module
-Requires: %{name}%{?_isa} = %{epoch}:%{version}-%{release}
-
-%description dlz-filesystem
-Dynamic Loadable Zones filesystem module for BIND server.
-
-%package dlz-ldap
-Summary: BIND server ldap DLZ module
-Requires: %{name}%{?_isa} = %{epoch}:%{version}-%{release}
-
-%description dlz-ldap
-Dynamic Loadable Zones LDAP module for BIND server.
-
-%package dlz-mysql
-Summary: BIND server mysql and mysqldyn DLZ modules
-Requires: %{name}%{?_isa} = %{epoch}:%{version}-%{release}
-Provides: %{name}-dlz-mysqldyn = %{epoch}:%{version}-%{release}
-Obsoletes: %{name}-dlz-mysqldyn < 32:9.16.6-3
-
-%description dlz-mysql
-Dynamic Loadable Zones MySQL module for BIND server.
-Contains also mysqldyn module with dynamic DNS updates (DDNS) support.
-
-%package dlz-sqlite3
-Summary: BIND server sqlite3 DLZ module
-Requires: %{name}%{?_isa} = %{epoch}:%{version}-%{release}
-
-%description dlz-sqlite3
-Dynamic Loadable Zones sqlite3 module for BIND server.
-%endif
-
 %if %{with DOC}
 %package doc
 Summary:   BIND 9 Administrator Reference Manual
@@ -412,12 +369,6 @@ autoreconf --force --install
 
 mkdir build
 
-%if %{with DLZ}
-# DLZ modules do not support oot builds. Copy files into build
-mkdir -p build/contrib/dlz
-cp -frp contrib/dlz/modules build/contrib/dlz/modules
-%endif
-
 pushd build
 LIBDIR_SUFFIX=
 export LIBDIR_SUFFIX
@@ -473,13 +424,6 @@ fmtutil-user --missing || :
   make doc
 %endif
 
-%if %{with DLZ}
-  pushd contrib/dlz/modules
-  for DIR in filesystem ldap mysql mysqldyn sqlite3; do
-    make -C $DIR CFLAGS="-fPIC -I../include $CFLAGS $LDFLAGS -DPTHREADS=1" LDFLAGS="$LDFLAGS"
-  done
-  popd
-%endif
 popd # build
 
 %unit_prepare_build build
@@ -607,23 +551,6 @@ install -m 644 %{SOURCE49} ${RPM_BUILD_ROOT}%{_sysconfdir}/named-chroot.files
 ln -s ../bin/{named-checkconf,named-checkzone,named-compilezone} %{buildroot}%{_sbindir}/
 %endif
 
-%if %{with DLZ}
-  pushd build
-  pushd contrib/dlz/modules
-  for DIR in filesystem ldap mysql mysqldyn sqlite3; do
-    %make_install -C $DIR libdir=%{_libdir}/bind
-  done
-  pushd ${RPM_BUILD_ROOT}/%{_libdir}/named
-    cp -s ../bind/dlz_*.so .
-  popd
-  mkdir -p doc/{mysql,mysqldyn}
-  cp -p mysqldyn/testing/README doc/mysqldyn/README.testing
-  cp -p mysqldyn/testing/* doc/mysqldyn
-  cp -p mysql/testing/* doc/mysql
-  popd
-  popd
-%endif
-
 # Remove libtool .la files:
 find ${RPM_BUILD_ROOT}/%{_libdir} -name '*.la' -exec '/bin/rm' '-f' '{}' ';';
 
@@ -959,26 +886,6 @@ fi;
 %dir %{chroot_prefix}/run/named
 %{chroot_prefix}%{_localstatedir}/run
 
-%if %{with DLZ}
-%files dlz-filesystem
-%{_libdir}/{named,bind}/dlz_filesystem_dynamic.so
-
-%files dlz-mysql
-%{_libdir}/{named,bind}/dlz_mysql_dynamic.so
-%doc build/contrib/dlz/modules/doc/mysql
-%{_libdir}/{named,bind}/dlz_mysqldyn_mod.so
-%doc build/contrib/dlz/modules/doc/mysqldyn
-
-%files dlz-ldap
-%{_libdir}/{named,bind}/dlz_ldap_dynamic.so
-%doc contrib/dlz/modules/ldap/testing/*
-
-%files dlz-sqlite3
-%{_libdir}/{named,bind}/dlz_sqlite3_dynamic.so
-%doc contrib/dlz/modules/sqlite3/testing/*
-
-%endif
-
 %if %{with DOC}
 %files doc
 %dir %{_pkgdocdir}
@@ -991,6 +898,9 @@ fi;
 %endif
 
 %changelog
+* Mon Feb 10 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.33-2
+- Permanently remove DLZ parts build
+
 * Sun Feb 02 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.33-1
 - Update to 9.16.33 (rhbz#2342784)
 

From f2aec3c2c1bba29d3f53eed41c528f2779b4615c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 21 Mar 2025 20:31:43 +0100
Subject: [PATCH 388/460] Remove pre scriptlet

It generates to empty if, which fails on invalid syntax.
---
 bind.spec | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/bind.spec b/bind.spec
index e51e9f9..c78dd93 100644
--- a/bind.spec
+++ b/bind.spec
@@ -82,7 +82,7 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it.
 # Updating just bind will cause freeipa-dns-server package to be uninstallable.
 Version:  9.18.33
-Release:  2%{?dist}
+Release:  3%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -628,12 +628,6 @@ install -m 644 %{SOURCE35} ${RPM_BUILD_ROOT}%{_tmpfilesdir}/named.conf
 mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/rwtab.d
 install -m 644 %{SOURCE43} ${RPM_BUILD_ROOT}%{_sysconfdir}/rwtab.d/named
 
-%pre
-if [ "$1" -eq 1 ]; then
-  %sysusers_create_compat %{SOURCE50}
-fi;
-:;
-
 %post
 %?ldconfig
 if [ "$1" -eq 1 ]; then
@@ -898,6 +892,9 @@ fi;
 %endif
 
 %changelog
+* Thu Mar 20 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.33-3
+- Remove pre scriptlet
+
 * Mon Feb 10 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.33-2
 - Permanently remove DLZ parts build
 

From 0b6554ff3d27a6c970d05b3522785e5e7ad43c95 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 26 Mar 2025 13:08:21 +0100
Subject: [PATCH 389/460] Update to 9.18.35 (rhbz#2346607)

---
 bind.spec | 7 +++++--
 sources   | 4 ++--
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/bind.spec b/bind.spec
index c78dd93..b7e4a33 100644
--- a/bind.spec
+++ b/bind.spec
@@ -81,8 +81,8 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 #
 # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it.
 # Updating just bind will cause freeipa-dns-server package to be uninstallable.
-Version:  9.18.33
-Release:  3%{?dist}
+Version:  9.18.35
+Release:  1%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -892,6 +892,9 @@ fi;
 %endif
 
 %changelog
+* Wed Mar 26 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.35-1
+- Update to 9.18.35 (rhbz#2346607)
+
 * Thu Mar 20 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.33-3
 - Remove pre scriptlet
 
diff --git a/sources b/sources
index b3d92ee..988458c 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.18.33.tar.xz) = 874465ccc7af92561dccf2bd596e13513048c4f1da730a6f38103eeb1d5b67178c1e2e2a56612946eba6edb9dad34851b9826055bcb7c0dad7ec64f7df9c10b9
-SHA512 (bind-9.18.33.tar.xz.asc) = 248490e576b00672497be77e2aeaf47b2c6c2fc745c729d76521443ed7bbd9cd64447cf949aafb820f021653efda7fe77aff32e756d76115e5a3dcf69aadc0a3
+SHA512 (bind-9.18.35.tar.xz) = 81764e1e4acb87e498cfce9e683dbdcadac13a5a5f2a517c988ff17967b34efb312ec0a9e94d7f9261e1e9bebbcfa295da6e37985c69961ef43031a8b99e8fc9
+SHA512 (bind-9.18.35.tar.xz.asc) = f2a237dda1f1f828bdc6c4b13f190c316fc26381ab7baf8f0101680898eb0a1a6518a7bc8baac0cf8c52356c6032e5d3c2c66d50e28b91054ee7066f76cd9009

From 273ea431d5c8738219294a96d2fe5e25d421a87e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 13 Feb 2025 16:08:50 +0100
Subject: [PATCH 390/460] Attempt to backport OpenSSL provider support with
 labels

Should allow PKCS11 provider used from dnssec-keyfromlabel and then from
signing tools or named daemon.

Resolves: rhbz#2123076
---
 bind-9.18-pkcs11-provider.patch | 870 ++++++++++++++++++++++++++++++++
 bind.spec                       |   9 +-
 2 files changed, 877 insertions(+), 2 deletions(-)
 create mode 100644 bind-9.18-pkcs11-provider.patch

diff --git a/bind-9.18-pkcs11-provider.patch b/bind-9.18-pkcs11-provider.patch
new file mode 100644
index 0000000..256980a
--- /dev/null
+++ b/bind-9.18-pkcs11-provider.patch
@@ -0,0 +1,870 @@
+From 099621c2769b934d0e1b02c0b085df86ae951780 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
+Date: Thu, 13 Feb 2025 13:20:28 +0100
+Subject: [PATCH] Backport OpenSSL 3 provider support
+
+Use gist of 451edf324281d30fbbe5669223dcea331670847c and
+5fd6cfc625aa84005618236f4cd699c07367a3dc upstream commits, but do not do
+significant rebase together. Move engine loading of EVP_PKEY from label to
+openssl_link and copy provider variant from newer.
+
+Remove legacy RSA calls from _fromlabel to separate engine handling
+code. Make rsa_check accepting EVP_PKEY pair only and use conditional
+compilation to verify them. Move checking of max exponent bits to
+rsa_check too, because it is done from all usages anyway.
+
+Use rsa_check_legacy in places where bit checking is not necessary.
+
+Fix keyfromlabel to not use engine parameter for provider keys
+
+- Rework key checks to not require 'engine' tag, private key
+  is valid with 'label' tag alone
+
+- Fix _fromlabel() functions to work with engine == NULL
+
+- Update dst__openssl_fromlabel_engine() to do provider lookup
+  only when engine is not set
+
+(cherry picked from commit de486d0ec5d5642ddb1820a1269f5406a2bb1c64)
+
+Use dst_key_t label to signal isprivate property as a downstream
+alternative to upstream commit 74361b0b6e5a6b17ebeea6afe1ca990395d7a6dd.
+That would require additional heavier changes.
+---
+ lib/dns/dst_openssl.h       |   4 +
+ lib/dns/dst_parse.c         |  21 ++---
+ lib/dns/openssl_link.c      | 160 ++++++++++++++++++++++++++++-----
+ lib/dns/openssldh_link.c    |   5 ++
+ lib/dns/opensslecdsa_link.c | 110 ++++++++++++-----------
+ lib/dns/openssleddsa_link.c |  40 +++------
+ lib/dns/opensslrsa_link.c   | 173 ++++++++++++++----------------------
+ 7 files changed, 294 insertions(+), 219 deletions(-)
+
+diff --git a/lib/dns/dst_openssl.h b/lib/dns/dst_openssl.h
+index 819af0fee1..cd386c0019 100644
+--- a/lib/dns/dst_openssl.h
++++ b/lib/dns/dst_openssl.h
+@@ -64,4 +64,8 @@ ENGINE *
+ dst__openssl_getengine(const char *engine);
+ #endif /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */
+ 
++isc_result_t
++dst__openssl_fromlabel(int key_base_id, const char *engine, const char *label,
++		       const char *pin, EVP_PKEY **ppub, EVP_PKEY **ppriv);
++
+ ISC_LANG_ENDDECLS
+diff --git a/lib/dns/dst_parse.c b/lib/dns/dst_parse.c
+index d5ea0e418b..addb65ec5a 100644
+--- a/lib/dns/dst_parse.c
++++ b/lib/dns/dst_parse.c
+@@ -195,10 +195,9 @@ check_rsa(const dst_private_t *priv, bool external) {
+ 
+ 	mask = (1ULL << TAG_SHIFT) - 1;
+ 
+-	if (have[TAG_RSA_ENGINE & mask]) {
++	if (have[TAG_RSA_LABEL & mask]) {
+ 		ok = have[TAG_RSA_MODULUS & mask] &&
+-		     have[TAG_RSA_PUBLICEXPONENT & mask] &&
+-		     have[TAG_RSA_LABEL & mask];
++		     have[TAG_RSA_PUBLICEXPONENT & mask];
+ 	} else {
+ 		ok = have[TAG_RSA_MODULUS & mask] &&
+ 		     have[TAG_RSA_PUBLICEXPONENT & mask] &&
+@@ -259,11 +258,9 @@ check_ecdsa(const dst_private_t *priv, bool external) {
+ 
+ 	mask = (1ULL << TAG_SHIFT) - 1;
+ 
+-	if (have[TAG_ECDSA_ENGINE & mask]) {
+-		ok = have[TAG_ECDSA_LABEL & mask];
+-	} else {
+-		ok = have[TAG_ECDSA_PRIVATEKEY & mask];
+-	}
++	ok = have[TAG_ECDSA_LABEL & mask] ||
++	     have[TAG_ECDSA_PRIVATEKEY & mask];
++
+ 	return ok ? 0 : -1;
+ }
+ 
+@@ -295,11 +292,9 @@ check_eddsa(const dst_private_t *priv, bool external) {
+ 
+ 	mask = (1ULL << TAG_SHIFT) - 1;
+ 
+-	if (have[TAG_EDDSA_ENGINE & mask]) {
+-		ok = have[TAG_EDDSA_LABEL & mask];
+-	} else {
+-		ok = have[TAG_EDDSA_PRIVATEKEY & mask];
+-	}
++	ok = have[TAG_EDDSA_LABEL & mask] ||
++	     have[TAG_EDDSA_PRIVATEKEY & mask];
++
+ 	return ok ? 0 : -1;
+ }
+ 
+diff --git a/lib/dns/openssl_link.c b/lib/dns/openssl_link.c
+index e3a89f4406..5be6116985 100644
+--- a/lib/dns/openssl_link.c
++++ b/lib/dns/openssl_link.c
+@@ -44,6 +44,9 @@
+ #if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000
+ #include <openssl/engine.h>
+ #endif /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */
++#if OPENSSL_VERSION_NUMBER >= 0x30000000L
++#include <openssl/store.h>
++#endif
+ 
+ #include "openssl_shim.h"
+ 
+@@ -51,6 +54,12 @@
+ static ENGINE *e = NULL;
+ #endif /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */
+ 
++#define DST_RET(a)        \
++	{                 \
++		ret = a;  \
++		goto err; \
++	}
++
+ static void
+ enable_fips_mode(void) {
+ #ifdef HAVE_FIPS_MODE
+@@ -70,32 +79,28 @@ enable_fips_mode(void) {
+ 
+ isc_result_t
+ dst__openssl_init(const char *engine) {
+-	isc_result_t result = ISC_R_SUCCESS;
+-
+ 	enable_fips_mode();
+ 
+-#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000
+ 	if (engine != NULL && *engine == '\0') {
+ 		engine = NULL;
+ 	}
+ 
+-	if (engine != NULL) {
+-		e = ENGINE_by_id(engine);
+-		if (e == NULL) {
+-			result = DST_R_NOENGINE;
+-			goto cleanup_rm;
+-		}
+-		if (!ENGINE_init(e)) {
+-			result = DST_R_NOENGINE;
+-			goto cleanup_rm;
+-		}
+-		/* This will init the engine. */
+-		if (!ENGINE_set_default(e, ENGINE_METHOD_ALL)) {
+-			result = DST_R_NOENGINE;
+-			goto cleanup_init;
+-		}
++	if (engine == NULL) {
++		return (ISC_R_SUCCESS);
+ 	}
+ 
++#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000
++	e = ENGINE_by_id(engine);
++	if (e == NULL) {
++		goto cleanup_rm;
++	}
++		if (!ENGINE_init(e)) {
++		goto cleanup_rm;
++	}
++	/* This will init the engine. */
++	if (!ENGINE_set_default(e, ENGINE_METHOD_ALL)) {
++		goto cleanup_init;
++	}
+ 	return ISC_R_SUCCESS;
+ cleanup_init:
+ 	ENGINE_finish(e);
+@@ -105,10 +110,8 @@ cleanup_rm:
+ 	}
+ 	e = NULL;
+ 	ERR_clear_error();
+-#else
+-	UNUSED(engine);
+ #endif /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */
+-	return result;
++	return (DST_R_NOENGINE);
+ }
+ 
+ void
+@@ -220,4 +223,119 @@ dst__openssl_getengine(const char *engine) {
+ }
+ #endif /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */
+ 
++static isc_result_t
++dst__openssl_fromlabel_engine(int key_base_id, const char *engine,
++			      const char *label,
++			      EVP_PKEY **ppub, EVP_PKEY **ppriv) {
++#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000
++	isc_result_t ret = ISC_R_SUCCESS;
++	ENGINE *e = NULL;
++	EVP_PKEY *pkey = NULL, *pubpkey = NULL;
++
++	UNUSED(key_base_id);
++
++	e = dst__openssl_getengine(engine);
++	if (e == NULL) {
++		DST_RET(dst__openssl_toresult(DST_R_NOENGINE));
++	}
++
++	pubpkey = ENGINE_load_public_key(e, label, NULL, NULL);
++	if (pubpkey == NULL) {
++		DST_RET(dst__openssl_toresult2("ENGINE_load_public_key",
++					       DST_R_OPENSSLFAILURE));
++	}
++	if (EVP_PKEY_get_base_id(pubpkey) != key_base_id) {
++		DST_RET(DST_R_BADKEYTYPE);
++	}
++	pkey = ENGINE_load_private_key(e, label, NULL, NULL);
++	if (pkey == NULL) {
++		DST_RET(dst__openssl_toresult2("ENGINE_load_private_key",
++					       DST_R_OPENSSLFAILURE));
++	}
++	if (EVP_PKEY_base_id(pkey) != key_base_id) {
++		DST_RET(DST_R_INVALIDPRIVATEKEY);
++	}
++	*ppub = pubpkey;
++	*ppriv = pkey;
++err:
++	return ret;
++#else
++	UNUSED(key_base_id);
++	UNUSED(engine);
++	UNUSED(label);
++	UNUSED(ppub);
++	UNUSED(ppriv);
++	return DST_R_NOENGINE;
++#endif
++}
++
++
++static isc_result_t
++dst__openssl_fromlabel_provider(int key_base_id, const char *label, const char *pin,
++				EVP_PKEY **ppub, EVP_PKEY **ppriv) {
++#if OPENSSL_VERSION_NUMBER >= 0x30000000L
++	isc_result_t ret = DST_R_OPENSSLFAILURE;
++	OSSL_STORE_CTX *ctx = NULL;
++
++
++	ctx = OSSL_STORE_open(label, NULL, NULL, NULL, NULL);
++	if (!ctx) {
++		DST_RET(dst__openssl_toresult2("OSSL_STORE_open_ex",
++					       DST_R_OPENSSLFAILURE));
++	}
++
++	while (!OSSL_STORE_eof(ctx)) {
++		OSSL_STORE_INFO *info = OSSL_STORE_load(ctx);
++		if (info == NULL) {
++			continue;
++		}
++		switch (OSSL_STORE_INFO_get_type(info)) {
++		case OSSL_STORE_INFO_PKEY:
++			if (*ppriv != NULL) {
++				DST_RET(DST_R_INVALIDPRIVATEKEY);
++			}
++			*ppriv = OSSL_STORE_INFO_get1_PKEY(info);
++			if (EVP_PKEY_get_base_id(*ppriv) != key_base_id) {
++				DST_RET(DST_R_BADKEYTYPE);
++			}
++			break;
++		case OSSL_STORE_INFO_PUBKEY:
++			if (*ppub != NULL) {
++				DST_RET(DST_R_INVALIDPUBLICKEY);
++			}
++			*ppub = OSSL_STORE_INFO_get1_PUBKEY(info);
++			if (EVP_PKEY_get_base_id(*ppub) != key_base_id) {
++				DST_RET(DST_R_BADKEYTYPE);
++			}
++			break;
++		}
++		OSSL_STORE_INFO_free(info);
++	}
++	if (*ppriv != NULL && *ppub != NULL) {
++		ret = ISC_R_SUCCESS;
++	}
++err:
++	OSSL_STORE_close(ctx);
++	return (ret);
++#else
++	UNUSED(key_base_id);
++	UNUSED(label);
++	UNUSED(ppub);
++	UNUSED(ppriv);
++	return (DST_R_OPENSSLFAILURE);
++#endif
++}
++
++isc_result_t
++dst__openssl_fromlabel(int key_base_id, const char *engine, const char *label,
++		       const char *pin, EVP_PKEY **ppub, EVP_PKEY **ppriv) {
++	if (engine == NULL) {
++		return (dst__openssl_fromlabel_provider(key_base_id, label,
++						        pin, ppub, ppriv));
++	}
++
++	return (dst__openssl_fromlabel_engine(key_base_id, engine, label,
++					      ppub, ppriv));
++}
++
+ /*! \file */
+diff --git a/lib/dns/openssldh_link.c b/lib/dns/openssldh_link.c
+index a4ba0f78d3..38345e6bfd 100644
+--- a/lib/dns/openssldh_link.c
++++ b/lib/dns/openssldh_link.c
+@@ -610,6 +610,11 @@ err:
+ 
+ static bool
+ openssldh_isprivate(const dst_key_t *key) {
++	if (key->label != NULL) {
++		/* assume that _fromlabel will not pass without loading private key,
++		 * but for non-exportable key cannot get d value on the object. */
++		return true;
++	}
+ #if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	DH *dh = key->keydata.dh;
+ 	const BIGNUM *priv_key = NULL;
+diff --git a/lib/dns/opensslecdsa_link.c b/lib/dns/opensslecdsa_link.c
+index ca12bb5620..5d070140c5 100644
+--- a/lib/dns/opensslecdsa_link.c
++++ b/lib/dns/opensslecdsa_link.c
+@@ -617,6 +617,12 @@ opensslecdsa_isprivate(const dst_key_t *key) {
+ 		return false;
+ 	}
+ 
++	if (key->label != NULL) {
++		/* assume that _fromlabel will not pass without loading private key,
++		 * but for non-exportable key cannot get d value on the object. */
++		return true;
++	}
++
+ #if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	eckey = EVP_PKEY_get1_EC_KEY(pkey);
+ 
+@@ -916,7 +922,7 @@ err:
+ 
+ #if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ static isc_result_t
+-ecdsa_check(EC_KEY *eckey, EC_KEY *pubeckey) {
++ecdsa_check_legacy(EC_KEY *eckey, EC_KEY *pubeckey) {
+ 	const EC_POINT *pubkey;
+ 
+ 	pubkey = EC_KEY_get0_public_key(eckey);
+@@ -937,9 +943,42 @@ ecdsa_check(EC_KEY *eckey, EC_KEY *pubeckey) {
+ 
+ 	return ISC_R_FAILURE;
+ }
++
++static isc_result_t
++ecdsa_check(EVP_PKEY **pkey, EVP_PKEY *pubpkey, int group_nid) {
++	isc_result_t ret = ISC_R_FAILURE;
++	EC_KEY *eckey;
++	EC_KEY *pubeckey;
++
++	eckey = EVP_PKEY_get1_EC_KEY(*pkey);
++	if (eckey == NULL) {
++		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
++	}
++	if (EC_GROUP_get_curve_name(EC_KEY_get0_group(eckey)) != group_nid) {
++		DST_RET(DST_R_INVALIDPRIVATEKEY);
++	}
++
++	pubeckey = EVP_PKEY_get1_EC_KEY(pubpkey);
++	if (pubeckey == NULL) {
++		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
++	}
++	if (EC_GROUP_get_curve_name(EC_KEY_get0_group(pubeckey)) != group_nid) {
++		DST_RET(DST_R_INVALIDPUBLICKEY);
++	}
++
++	ret = ecdsa_check_legacy(eckey, pubeckey);
++err:
++	if (pubeckey != NULL) {
++		EC_KEY_free(pubeckey);
++	}
++	if (eckey != NULL) {
++		EC_KEY_free(eckey);
++	}
++	return ret;
++}
+ #else
+ static isc_result_t
+-ecdsa_check(EVP_PKEY **pkey, EVP_PKEY *pubpkey) {
++ecdsa_check(EVP_PKEY **pkey, EVP_PKEY *pubpkey, int group_nid) {
+ 	isc_result_t ret = ISC_R_FAILURE;
+ 	int status;
+ 	size_t pkey_len = 0;
+@@ -954,6 +993,8 @@ ecdsa_check(EVP_PKEY **pkey, EVP_PKEY *pubpkey) {
+ 	EVP_PKEY_CTX *ctx = NULL;
+ 	EVP_PKEY *pkey_new = NULL;
+ 
++	UNUSED(group_nid);
++
+ 	/* Check if `pkey` has a public key. */
+ 	status = EVP_PKEY_get_octet_string_param(*pkey, OSSL_PKEY_PARAM_PUB_KEY,
+ 						 NULL, 0, &pkey_len);
+@@ -1279,7 +1320,7 @@ opensslecdsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
+ 		pubeckey = EVP_PKEY_get1_EC_KEY(pub->keydata.pkey);
+ 	}
+ 
+-	if (ecdsa_check(eckey, pubeckey) != ISC_R_SUCCESS) {
++	if (ecdsa_check_legacy(eckey, pubeckey) != ISC_R_SUCCESS) {
+ 		DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
+ 	}
+ 
+@@ -1288,7 +1329,7 @@ opensslecdsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
+ 	}
+ #else
+ 	if (ecdsa_check(&key->keydata.pkey,
+-			pub == NULL ? NULL : pub->keydata.pkey) !=
++			pub == NULL ? NULL : pub->keydata.pkey, NID_undef) !=
+ 	    ISC_R_SUCCESS)
+ 	{
+ 		DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
+@@ -1321,11 +1362,7 @@ err:
+ static isc_result_t
+ opensslecdsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
+ 		       const char *pin) {
+-#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000
+ 	isc_result_t ret = ISC_R_SUCCESS;
+-	ENGINE *e;
+-	EC_KEY *eckey = NULL;
+-	EC_KEY *pubeckey = NULL;
+ 	int group_nid;
+ 	EVP_PKEY *pkey = NULL;
+ 	EVP_PKEY *pubpkey = NULL;
+@@ -1335,13 +1372,9 @@ opensslecdsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
+ 
+ 	UNUSED(pin);
+ 
+-	if (engine == NULL || label == NULL) {
++	if (label == NULL) {
+ 		return DST_R_NOENGINE;
+ 	}
+-	e = dst__openssl_getengine(engine);
+-	if (e == NULL) {
+-		DST_RET(DST_R_NOENGINE);
+-	}
+ 
+ 	if (key->key_alg == DST_ALG_ECDSA256) {
+ 		group_nid = NID_X9_62_prime256v1;
+@@ -1349,48 +1382,30 @@ opensslecdsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
+ 		group_nid = NID_secp384r1;
+ 	}
+ 
+-	/* Load private key. */
+-	pkey = ENGINE_load_private_key(e, label, NULL, NULL);
+-	if (pkey == NULL) {
+-		DST_RET(dst__openssl_toresult2("ENGINE_load_private_key",
+-					       DST_R_OPENSSLFAILURE));
++	ret = dst__openssl_fromlabel(EVP_PKEY_EC, engine, label, pin,
++				       &pubpkey, &pkey);
++	if (ret != ISC_R_SUCCESS) {
++		goto err;
+ 	}
++
+ 	/* Check base id, group nid */
+ 	if (EVP_PKEY_base_id(pkey) != EVP_PKEY_EC) {
+ 		DST_RET(DST_R_INVALIDPRIVATEKEY);
+ 	}
+-	eckey = EVP_PKEY_get1_EC_KEY(pkey);
+-	if (eckey == NULL) {
+-		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
+-	}
+-	if (EC_GROUP_get_curve_name(EC_KEY_get0_group(eckey)) != group_nid) {
+-		DST_RET(DST_R_INVALIDPRIVATEKEY);
+-	}
+-
+-	/* Load public key. */
+-	pubpkey = ENGINE_load_public_key(e, label, NULL, NULL);
+-	if (pubpkey == NULL) {
+-		DST_RET(dst__openssl_toresult2("ENGINE_load_public_key",
+-					       DST_R_OPENSSLFAILURE));
+-	}
+ 	/* Check base id, group nid */
+ 	if (EVP_PKEY_base_id(pubpkey) != EVP_PKEY_EC) {
+ 		DST_RET(DST_R_INVALIDPUBLICKEY);
+ 	}
+-	pubeckey = EVP_PKEY_get1_EC_KEY(pubpkey);
+-	if (pubeckey == NULL) {
+-		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
+-	}
+-	if (EC_GROUP_get_curve_name(EC_KEY_get0_group(pubeckey)) != group_nid) {
+-		DST_RET(DST_R_INVALIDPUBLICKEY);
+-	}
+ 
+-	if (ecdsa_check(eckey, pubeckey) != ISC_R_SUCCESS) {
++	if (ecdsa_check(&pkey, pubpkey, group_nid) != ISC_R_SUCCESS) {
+ 		DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
+ 	}
+ 
++	if (engine != NULL)
++		key->engine = isc_mem_strdup(key->mctx, engine);
++	else
++		key->engine = NULL;
+ 	key->label = isc_mem_strdup(key->mctx, label);
+-	key->engine = isc_mem_strdup(key->mctx, engine);
+ 	key->key_size = EVP_PKEY_bits(pkey);
+ 	key->keydata.pkey = pkey;
+ 	pkey = NULL;
+@@ -1402,21 +1417,8 @@ err:
+ 	if (pkey != NULL) {
+ 		EVP_PKEY_free(pkey);
+ 	}
+-	if (pubeckey != NULL) {
+-		EC_KEY_free(pubeckey);
+-	}
+-	if (eckey != NULL) {
+-		EC_KEY_free(eckey);
+-	}
+ 
+ 	return ret;
+-#else
+-	UNUSED(key);
+-	UNUSED(engine);
+-	UNUSED(label);
+-	UNUSED(pin);
+-	return DST_R_NOENGINE;
+-#endif /* !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */
+ }
+ 
+ static dst_func_t opensslecdsa_functions = {
+diff --git a/lib/dns/openssleddsa_link.c b/lib/dns/openssleddsa_link.c
+index 74dac17bc6..04457fbfc3 100644
+--- a/lib/dns/openssleddsa_link.c
++++ b/lib/dns/openssleddsa_link.c
+@@ -361,6 +361,12 @@ openssleddsa_isprivate(const dst_key_t *key) {
+ 		return false;
+ 	}
+ 
++	if (key->label != NULL) {
++		/* assume that _fromlabel will not pass without loading private key,
++		 * but for non-exportable key cannot get d value on the object. */
++		return true;
++	}
++
+ 	/* Must have a buffer to actually check if there is a private key. */
+ 	if (EVP_PKEY_get_raw_private_key(pkey, buf, &len) == 1) {
+ 		return true;
+@@ -603,9 +609,7 @@ err:
+ static isc_result_t
+ openssleddsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
+ 		       const char *pin) {
+-#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000
+ 	isc_result_t ret;
+-	ENGINE *e;
+ 	EVP_PKEY *pkey = NULL, *pubpkey = NULL;
+ 	int baseid = EVP_PKEY_NONE;
+ 
+@@ -628,28 +632,17 @@ openssleddsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
+ 		return ISC_R_NOTIMPLEMENTED;
+ 	}
+ 
+-	if (engine == NULL) {
+-		return DST_R_NOENGINE;
+-	}
+-	e = dst__openssl_getengine(engine);
+-	if (e == NULL) {
+-		return DST_R_NOENGINE;
+-	}
+-	pkey = ENGINE_load_private_key(e, label, NULL, NULL);
+-	if (pkey == NULL) {
+-		return dst__openssl_toresult2("ENGINE_load_private_key",
+-					      ISC_R_NOTFOUND);
+-	}
+-	if (EVP_PKEY_base_id(pkey) != baseid) {
+-		DST_RET(DST_R_INVALIDPRIVATEKEY);
+-	}
++	DST_RET(dst__openssl_fromlabel(baseid, engine, label, pin,
++				       &pubpkey, &pkey));
+ 
+-	pubpkey = ENGINE_load_public_key(e, label, NULL, NULL);
+-	if (eddsa_check(pkey, pubpkey) != ISC_R_SUCCESS) {
++	if (EVP_PKEY_base_id(pkey) != baseid) {
+ 		DST_RET(DST_R_INVALIDPRIVATEKEY);
+ 	}
+ 
+-	key->engine = isc_mem_strdup(key->mctx, engine);
++	if (engine != NULL)
++		key->engine = isc_mem_strdup(key->mctx, engine);
++	else
++		key->engine = NULL;
+ 	key->label = isc_mem_strdup(key->mctx, label);
+ 	key->key_size = EVP_PKEY_bits(pkey);
+ 	key->keydata.pkey = pkey;
+@@ -664,13 +657,6 @@ err:
+ 		EVP_PKEY_free(pkey);
+ 	}
+ 	return ret;
+-#else  /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */
+-	UNUSED(key);
+-	UNUSED(engine);
+-	UNUSED(label);
+-	UNUSED(pin);
+-	return DST_R_NOENGINE;
+-#endif /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */
+ }
+ 
+ static dst_func_t openssleddsa_functions = {
+diff --git a/lib/dns/opensslrsa_link.c b/lib/dns/opensslrsa_link.c
+index 37e8a63a61..1ffae888e1 100644
+--- a/lib/dns/opensslrsa_link.c
++++ b/lib/dns/opensslrsa_link.c
+@@ -545,6 +545,12 @@ opensslrsa_isprivate(const dst_key_t *key) {
+ 		return false;
+ 	}
+ 
++	if (key->label != NULL) {
++		/* assume that _fromlabel will not pass without loading private key,
++		 * but for non-exportable key cannot get d value on the object. */
++		return true;
++	}
++
+ #if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	rsa = EVP_PKEY_get1_RSA(pkey);
+ 	INSIST(rsa != NULL);
+@@ -995,7 +1001,7 @@ err:
+ 
+ #if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ static isc_result_t
+-rsa_check(RSA *rsa, RSA *pub) {
++rsa_check_legacy(RSA *rsa, RSA *pub) {
+ 	const BIGNUM *n1 = NULL, *n2 = NULL;
+ 	const BIGNUM *e1 = NULL, *e2 = NULL;
+ 	BIGNUM *n = NULL, *e = NULL;
+@@ -1050,6 +1056,46 @@ rsa_check(RSA *rsa, RSA *pub) {
+ 
+ 	return ISC_R_SUCCESS;
+ }
++
++static isc_result_t
++rsa_check(EVP_PKEY *pkey, EVP_PKEY *pubpkey) {
++	isc_result_t ret = ISC_R_FAILURE;
++	RSA *rsa = NULL, *pubrsa = NULL;
++	const BIGNUM *ex = NULL;
++
++	pubrsa = EVP_PKEY_get1_RSA(pubpkey);
++	if (pubrsa == NULL) {
++		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
++	}
++
++	rsa = EVP_PKEY_get1_RSA(pkey);
++	if (rsa == NULL) {
++		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
++	}
++
++	ret = rsa_check_legacy(rsa, pubrsa);
++	if (ret != ISC_R_SUCCESS) {
++		DST_RET(ret);
++	}
++
++	RSA_get0_key(rsa, NULL, &ex, NULL);
++
++	if (ex == NULL) {
++		DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
++	}
++	if (BN_num_bits(ex) > RSA_MAX_PUBEXP_BITS) {
++		DST_RET(ISC_R_RANGE);
++	}
++
++err:
++	if (rsa != NULL) {
++		RSA_free(rsa);
++	}
++	if (pubrsa != NULL) {
++		RSA_free(pubrsa);
++	}
++	return ret;
++}
+ #else
+ static isc_result_t
+ rsa_check(EVP_PKEY *pkey, EVP_PKEY *pubpkey) {
+@@ -1097,6 +1143,10 @@ rsa_check(EVP_PKEY *pkey, EVP_PKEY *pubpkey) {
+ 		}
+ 	}
+ 
++	if (BN_num_bits(e1) > RSA_MAX_PUBEXP_BITS) {
++		DST_RET(ISC_R_RANGE);
++	}
++
+ 	if (EVP_PKEY_eq(pkey, pubpkey) == 1) {
+ 		DST_RET(ISC_R_SUCCESS);
+ 	}
+@@ -1119,6 +1169,10 @@ err:
+ }
+ #endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
++static isc_result_t
++opensslrsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
++		     const char *pin);
++
+ static isc_result_t
+ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
+ 	dst_private_t priv;
+@@ -1131,12 +1185,8 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
+ 	OSSL_PARAM *params = NULL;
+ 	EVP_PKEY_CTX *ctx = NULL;
+ #endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+-#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000
+-	const BIGNUM *ex = NULL;
+-	ENGINE *ep = NULL;
+-	const char *engine = NULL;
+-#endif /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */
+ 	isc_mem_t *mctx = NULL;
++	const char *engine = NULL;
+ 	const char *label = NULL;
+ 	EVP_PKEY *pkey = NULL;
+ 	BIGNUM *n = NULL, *e = NULL, *d = NULL;
+@@ -1193,46 +1243,7 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
+ 	 * See if we can fetch it.
+ 	 */
+ 	if (label != NULL) {
+-#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000
+-		if (engine == NULL) {
+-			DST_RET(DST_R_NOENGINE);
+-		}
+-		ep = dst__openssl_getengine(engine);
+-		if (ep == NULL) {
+-			DST_RET(dst__openssl_toresult(DST_R_NOENGINE));
+-		}
+-		pkey = ENGINE_load_private_key(ep, label, NULL, NULL);
+-		if (pkey == NULL) {
+-			DST_RET(dst__openssl_toresult2("ENGINE_load_private_"
+-						       "key",
+-						       ISC_R_NOTFOUND));
+-		}
+-		key->engine = isc_mem_strdup(key->mctx, engine);
+-		key->label = isc_mem_strdup(key->mctx, label);
+-
+-		rsa = EVP_PKEY_get1_RSA(pkey);
+-		if (rsa == NULL) {
+-			DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
+-		}
+-		if (rsa_check(rsa, pubrsa) != ISC_R_SUCCESS) {
+-			DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
+-		}
+-		RSA_get0_key(rsa, NULL, &ex, NULL);
+-
+-		if (ex == NULL) {
+-			DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
+-		}
+-		if (BN_num_bits(ex) > RSA_MAX_PUBEXP_BITS) {
+-			DST_RET(ISC_R_RANGE);
+-		}
+-
+-		key->key_size = EVP_PKEY_bits(pkey);
+-		key->keydata.pkey = pkey;
+-		pkey = NULL;
+-		DST_RET(ISC_R_SUCCESS);
+-#else  /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */
+-		DST_RET(DST_R_NOENGINE);
+-#endif /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */
++		DST_RET(opensslrsa_fromlabel(key, engine, label, NULL));
+ 	}
+ 
+ 	for (i = 0; i < priv.nelements; i++) {
+@@ -1321,7 +1332,7 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
+ 			BN_clear_free(iqmp);
+ 		}
+ 	}
+-	if (rsa_check(rsa, pubrsa) != ISC_R_SUCCESS) {
++	if (rsa_check_legacy(rsa, pubrsa) != ISC_R_SUCCESS) {
+ 		DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
+ 	}
+ #else
+@@ -1464,69 +1475,30 @@ err:
+ static isc_result_t
+ opensslrsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
+ 		     const char *pin) {
+-#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000
+-	ENGINE *e = NULL;
+ 	isc_result_t ret = ISC_R_SUCCESS;
+ 	EVP_PKEY *pkey = NULL, *pubpkey = NULL;
+-	RSA *rsa = NULL, *pubrsa = NULL;
+-	const BIGNUM *ex = NULL;
+ 
+ 	UNUSED(pin);
+ 
+-	if (engine == NULL) {
+-		DST_RET(DST_R_NOENGINE);
+-	}
+-	e = dst__openssl_getengine(engine);
+-	if (e == NULL) {
+-		DST_RET(dst__openssl_toresult(DST_R_NOENGINE));
+-	}
++	ret = dst__openssl_fromlabel(EVP_PKEY_RSA, engine, label, pin,
++				       &pubpkey, &pkey);
++	if (ret != ISC_R_SUCCESS)
++		DST_RET(ret);
+ 
+-	pubpkey = ENGINE_load_public_key(e, label, NULL, NULL);
+-	if (pubpkey == NULL) {
+-		DST_RET(dst__openssl_toresult2("ENGINE_load_public_key",
+-					       DST_R_OPENSSLFAILURE));
+-	}
+-	pubrsa = EVP_PKEY_get1_RSA(pubpkey);
+-	if (pubrsa == NULL) {
+-		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
+-	}
+-
+-	pkey = ENGINE_load_private_key(e, label, NULL, NULL);
+-	if (pkey == NULL) {
+-		DST_RET(dst__openssl_toresult2("ENGINE_load_private_key",
+-					       DST_R_OPENSSLFAILURE));
+-	}
++	ret = rsa_check(pkey, pubpkey);
++	if (ret != ISC_R_SUCCESS)
++		DST_RET(ret);
+ 
+-	key->engine = isc_mem_strdup(key->mctx, engine);
++	if (engine != NULL)
++		key->engine = isc_mem_strdup(key->mctx, engine);
++	else
++		key->engine = NULL;
+ 	key->label = isc_mem_strdup(key->mctx, label);
+-
+-	rsa = EVP_PKEY_get1_RSA(pkey);
+-	if (rsa == NULL) {
+-		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
+-	}
+-	if (rsa_check(rsa, pubrsa) != ISC_R_SUCCESS) {
+-		DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
+-	}
+-	RSA_get0_key(rsa, NULL, &ex, NULL);
+-
+-	if (ex == NULL) {
+-		DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
+-	}
+-	if (BN_num_bits(ex) > RSA_MAX_PUBEXP_BITS) {
+-		DST_RET(ISC_R_RANGE);
+-	}
+-
+ 	key->key_size = EVP_PKEY_bits(pkey);
+ 	key->keydata.pkey = pkey;
+ 	pkey = NULL;
+ 
+ err:
+-	if (rsa != NULL) {
+-		RSA_free(rsa);
+-	}
+-	if (pubrsa != NULL) {
+-		RSA_free(pubrsa);
+-	}
+ 	if (pkey != NULL) {
+ 		EVP_PKEY_free(pkey);
+ 	}
+@@ -1534,13 +1506,6 @@ err:
+ 		EVP_PKEY_free(pubpkey);
+ 	}
+ 	return ret;
+-#else  /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */
+-	UNUSED(key);
+-	UNUSED(engine);
+-	UNUSED(label);
+-	UNUSED(pin);
+-	return DST_R_NOENGINE;
+-#endif /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */
+ }
+ 
+ static dst_func_t opensslrsa_functions = {
+-- 
+2.49.0
+
diff --git a/bind.spec b/bind.spec
index b7e4a33..d80916d 100644
--- a/bind.spec
+++ b/bind.spec
@@ -29,7 +29,7 @@
 %bcond_with    QUERYTRACE
 %if 0%{?fedora} >= 41 && ! 0%{?rhel}
 # Make this enabled on recent Fedora, but not in ELN or RHEL
-  %bcond_without OPENSSL_ENGINE
+  %bcond_with  OPENSSL_ENGINE
 %endif
 
 %{!?_pkgdocdir:%global _pkgdocdir %{_docdir}/%{name}-%{version}}
@@ -82,7 +82,7 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it.
 # Updating just bind will cause freeipa-dns-server package to be uninstallable.
 Version:  9.18.35
-Release:  1%{?dist}
+Release:  2%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -129,6 +129,8 @@ Patch28: bind-9.20-nsupdate-tls.patch
 Patch29: bind-9.20-nsupdate-tls-doc.patch
 # Test suport for patch28 nsupdate
 Patch30: bind-9.20-nsupdate-tls-test.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=2123076
+Patch31: bind-9.18-pkcs11-provider.patch
 
 %{?systemd_ordering}
 # https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers
@@ -892,6 +894,9 @@ fi;
 %endif
 
 %changelog
+* Wed Mar 26 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.35-2
+- Backport support for OpenSSL provider required for PKCS11 labels
+
 * Wed Mar 26 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.35-1
 - Update to 9.18.35 (rhbz#2346607)
 

From 8bc9ab3888f8b059c85a094f1bbaa3d21f1fcf9f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 14 Feb 2025 21:16:11 +0100
Subject: [PATCH 391/460] Improve a bit ability to run testsuite from mockbuild

Intended to be run like:
centpkg mockbuild --with SYSTEMTEST -N --enable-network

Do fail when it does not pass. But allow running tests as root.
---
 bind.spec | 23 ++++++++++++++++++++++-
 1 file changed, 22 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index d80916d..c5b48bb 100644
--- a/bind.spec
+++ b/bind.spec
@@ -6,6 +6,8 @@
 # bcond_without is built by default, unless --without X is passed
 # bcond_with is built only when --with X is passed to build
 %bcond_with    SYSTEMTEST
+# enable RSA1 during SYSTEMTEST
+%bcond_with    CRYPTO_POLICY_RSA1
 %bcond_without GSSTSIG
 %bcond_without JSON
 # New MaxMind GeoLite support
@@ -169,6 +171,7 @@ BuildRequires:  softhsm
 %if %{with SYSTEMTEST}
 # bin/tests/system dependencies
 BuildRequires:  perl(Net::DNS) perl(Net::DNS::Nameserver) perl(Time::HiRes) perl(Getopt::Long)
+BuildRequires:  perl(English)
 BuildRequires:  python3-dns
 # manual configuration requires this tool
 BuildRequires:  iproute
@@ -332,6 +335,10 @@ for i in bin/named/Makefile.am; do
 done
 %endif
 
+# allow running as root from mock or test machines
+sed -e 's, "enable-developer",& \&\& systemctl is-system-running \&>/dev/null \&\& ! [ -e /mnt/tests ],' \
+    -i bin/tests/system/run.sh
+
 :;
 
 
@@ -477,15 +484,29 @@ else
   sh bin/tests/system/ifconfig.sh up
   perl bin/tests/system/testsock.pl && CONFIGURED=build
 fi
+
 if [ -n "$CONFIGURED" ]
 then
   set -e
+  %if %{with CRYPTO_POLICY_RSA1}
+    # Override crypto-policy to allow RSASHA1 key operations
+    OPENSSL_CONF="$(mktemp openssl-XXXXXX.cnf)"
+    cat > "$OPENSSL_CONF" << 'EOF'
+.include = /etc/ssl/openssl.cnf
+[evp_properties]
+rh-allow-sha1-signatures = yes
+EOF
+    export OPENSSL_CONF
+  %endif
   pushd build/bin/tests
   chown -R ${USER} . # Can be unknown user
-  %make_build test 2>&1 | tee test.log
+  %make_build test
   e=$?
   popd
   [ "$CONFIGURED" = build ] && sh bin/tests/system/ifconfig.sh down
+  %if %{with CRYPTO_POLICY_RSA1}
+    export -b OPENSSL_CONF
+  %endif
   if [ "$e" -ne 0 ]; then
     echo "ERROR: this build of BIND failed 'make test'. Aborting."
     exit $e;

From feddafc9cfb7d67c816c375db4b64e4f2a5783de Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 26 Mar 2025 21:20:00 +0100
Subject: [PATCH 392/460] Deactivate jemalloc linking

---
 bind.spec | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index c5b48bb..e0464e2 100644
--- a/bind.spec
+++ b/bind.spec
@@ -12,6 +12,8 @@
 %bcond_without JSON
 # New MaxMind GeoLite support
 %bcond_without GEOIP2
+# Jemalloc linked together
+%bcond_with    JEMALLOC
 # Disabled temporarily until kyua is fixed on rawhide, bug #1926779
 %bcond_without UNITTEST
 # Do not set CI environment, include more unit tests, even less stable
@@ -156,8 +158,10 @@ BuildRequires:  systemd-rpm-macros
 BuildRequires:  selinux-policy
 BuildRequires:  findutils sed
 BuildRequires:  libnghttp2-devel
-%if 0%{?fedora}
+%if %{with JEMALLOC} && 0%{?fedora}
 BuildRequires:  jemalloc-devel
+%endif
+%if 0%{?fedora}
 BuildRequires:  gnupg2
 %endif
 BuildRequires:  libuv-devel
@@ -407,6 +411,9 @@ export LIBDIR_SUFFIX
 %endif
 %if %{with UNITTEST}
   --with-cmocka \
+%endif
+%if %{without JEMALLOC}
+  --without-jemalloc \
 %endif
   --enable-fixed-rrset \
   --enable-full-report \
@@ -917,6 +924,7 @@ fi;
 %changelog
 * Wed Mar 26 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.35-2
 - Backport support for OpenSSL provider required for PKCS11 labels
+- Deactivate jemalloc default linking
 
 * Wed Mar 26 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.35-1
 - Update to 9.18.35 (rhbz#2346607)

From 0f0106cb47a89057b3bf5cdac3ea78ff804f74e8 Mon Sep 17 00:00:00 2001
From: Petr Mensik <pemensik@redhat.com>
Date: Fri, 25 Apr 2025 14:17:41 +0200
Subject: [PATCH 393/460] Update to 9.18.36 (rhbz#2346607)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Feature Changes:

- Make TLS data processing more reliable in various network conditions.

Bug Fixes:

- Stop caching lack of EDNS support
- Fix resolver statistics counters for timed-out responses.
- Don’t enforce NOAUTH/NOCONF flags in DNSKEYs.
- Fix inconsistency in CNAME/DNAME handling during resolution.

https://downloads.isc.org/isc/bind9/9.18.36/doc/arm/html/notes.html#notes-for-bind-9-18-36
---
 bind.spec | 7 +++++--
 sources   | 4 ++--
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/bind.spec b/bind.spec
index e0464e2..bc465bc 100644
--- a/bind.spec
+++ b/bind.spec
@@ -85,8 +85,8 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 #
 # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it.
 # Updating just bind will cause freeipa-dns-server package to be uninstallable.
-Version:  9.18.35
-Release:  2%{?dist}
+Version:  9.18.36
+Release:  1%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -922,6 +922,9 @@ fi;
 %endif
 
 %changelog
+* Fri Apr 25 2025 Petr Mensik <pemensik@redhat.com> - 32:9.18.36-1
+- Update to 9.18.36 (rhbz#2346607)
+
 * Wed Mar 26 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.35-2
 - Backport support for OpenSSL provider required for PKCS11 labels
 - Deactivate jemalloc default linking
diff --git a/sources b/sources
index 988458c..86507ea 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.18.35.tar.xz) = 81764e1e4acb87e498cfce9e683dbdcadac13a5a5f2a517c988ff17967b34efb312ec0a9e94d7f9261e1e9bebbcfa295da6e37985c69961ef43031a8b99e8fc9
-SHA512 (bind-9.18.35.tar.xz.asc) = f2a237dda1f1f828bdc6c4b13f190c316fc26381ab7baf8f0101680898eb0a1a6518a7bc8baac0cf8c52356c6032e5d3c2c66d50e28b91054ee7066f76cd9009
+SHA512 (bind-9.18.36.tar.xz) = a95af586ee752705fa164c4d2f41b988e044a86ba9f078d1647d10025ca8f2872c95544dc5515717862b8fcb46b24e9cf6669d719196b6734a50d7a4c16a1288
+SHA512 (bind-9.18.36.tar.xz.asc) = a5d76c060d088ac53b9fdde00eb44c09acaf12a2e25cb5e39281062fdfd5128a5665b771f424159938c284bc888b78575d9757f4b44e8518e446b45a8c889e5a

From ea2fc21f015a0ba2db470fb774d8d387e59eab04 Mon Sep 17 00:00:00 2001
From: Petr Mensik <pemensik@redhat.com>
Date: Wed, 30 Apr 2025 12:57:07 +0200
Subject: [PATCH 394/460] Hide warning about unused pin variable

Created by downstream backport of openssl provider support.
---
 bind-9.18-pkcs11-provider.patch | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/bind-9.18-pkcs11-provider.patch b/bind-9.18-pkcs11-provider.patch
index 256980a..24a216b 100644
--- a/bind-9.18-pkcs11-provider.patch
+++ b/bind-9.18-pkcs11-provider.patch
@@ -1,4 +1,4 @@
-From 099621c2769b934d0e1b02c0b085df86ae951780 Mon Sep 17 00:00:00 2001
+From 0869590a0c182cbf546df190616f56f790fa32aa Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 13 Feb 2025 13:20:28 +0100
 Subject: [PATCH] Backport OpenSSL 3 provider support
@@ -33,12 +33,12 @@ That would require additional heavier changes.
 ---
  lib/dns/dst_openssl.h       |   4 +
  lib/dns/dst_parse.c         |  21 ++---
- lib/dns/openssl_link.c      | 160 ++++++++++++++++++++++++++++-----
+ lib/dns/openssl_link.c      | 161 ++++++++++++++++++++++++++++-----
  lib/dns/openssldh_link.c    |   5 ++
  lib/dns/opensslecdsa_link.c | 110 ++++++++++++-----------
  lib/dns/openssleddsa_link.c |  40 +++------
  lib/dns/opensslrsa_link.c   | 173 ++++++++++++++----------------------
- 7 files changed, 294 insertions(+), 219 deletions(-)
+ 7 files changed, 295 insertions(+), 219 deletions(-)
 
 diff --git a/lib/dns/dst_openssl.h b/lib/dns/dst_openssl.h
 index 819af0fee1..cd386c0019 100644
@@ -101,7 +101,7 @@ index d5ea0e418b..addb65ec5a 100644
  }
  
 diff --git a/lib/dns/openssl_link.c b/lib/dns/openssl_link.c
-index e3a89f4406..5be6116985 100644
+index e3a89f4406..62077b6f81 100644
 --- a/lib/dns/openssl_link.c
 +++ b/lib/dns/openssl_link.c
 @@ -44,6 +44,9 @@
@@ -186,7 +186,7 @@ index e3a89f4406..5be6116985 100644
  }
  
  void
-@@ -220,4 +223,119 @@ dst__openssl_getengine(const char *engine) {
+@@ -220,4 +223,120 @@ dst__openssl_getengine(const char *engine) {
  }
  #endif /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */
  
@@ -240,6 +240,7 @@ index e3a89f4406..5be6116985 100644
 +static isc_result_t
 +dst__openssl_fromlabel_provider(int key_base_id, const char *label, const char *pin,
 +				EVP_PKEY **ppub, EVP_PKEY **ppriv) {
++	UNUSED(pin);
 +#if OPENSSL_VERSION_NUMBER >= 0x30000000L
 +	isc_result_t ret = DST_R_OPENSSLFAILURE;
 +	OSSL_STORE_CTX *ctx = NULL;

From 988c021cf383f5db28c6d05f617b65f8345f44a7 Mon Sep 17 00:00:00 2001
From: Petr Mensik <pemensik@redhat.com>
Date: Tue, 10 Jun 2025 15:34:02 +0200
Subject: [PATCH 395/460] Prevent name.c:670: REQUIRE((name1->attributes &
 0x00000001) == (name2->attributes & 0x00000001)) failed

resume_qmin did not handle special case of recursing query hit
unexpected DNS_R_CNAME result. Change result to SERVFAIL in case
of a zone loaded after the recursion started. That prevents crashing
later in query_setorder, where there is uninitialized foundname compared
with absolute order names.

https://gitlab.isc.org/isc-projects/bind9/-/issues/5357
Related: RHEL-30407
---
 bind-9.21-resume-qmin-cname.patch | 44 +++++++++++++++++++++++++++++++
 bind.spec                         |  4 +++
 2 files changed, 48 insertions(+)
 create mode 100644 bind-9.21-resume-qmin-cname.patch

diff --git a/bind-9.21-resume-qmin-cname.patch b/bind-9.21-resume-qmin-cname.patch
new file mode 100644
index 0000000..05fd4b4
--- /dev/null
+++ b/bind-9.21-resume-qmin-cname.patch
@@ -0,0 +1,44 @@
+From ac0c3b0477d97fe5c968910f603bb8d04c740da7 Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Tue, 3 Jun 2025 21:00:58 +0200
+Subject: [PATCH] Handle CNAME and DNAME in resume_min in a special way
+
+When authoritative zone is loaded when query minimization query for the
+same zone is already pending, it might receive unexpected result codes.
+
+Normally DNS_R_CNAME would follow to query_cname after processing sent
+events, but dns_view_findzonecut does not fill CNAME target into
+event->foundevent. Usual lookup via query_lookup would always have that
+filled.
+
+Ideally we would restart the query with unmodified search name, if
+unexpected change from recursing to local zone cut were detected. Until
+dns_view_findzonecut is modified to export zone/cache source of the cut,
+at least fail queries which went into unexpected state.
+---
+ lib/dns/resolver.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
+index 795791246b..39a294437e 100644
+--- a/lib/dns/resolver.c
++++ b/lib/dns/resolver.c
+@@ -4497,6 +4497,15 @@ resume_qmin(isc_task_t *task, isc_event_t *event) {
+ 	if (result == DNS_R_NXDOMAIN) {
+ 		result = DNS_R_SERVFAIL;
+ 	}
++	/*
++	 * CNAME or DNAME means zone were added with that record
++	 * after the start of query minimization queries. It means
++	 * we do not have initialized correct hevent->foundname
++	 * and have to fail.
++	 */
++	if (result == DNS_R_CNAME || result == DNS_R_DNAME) {
++		result = DNS_R_SERVFAIL;
++	}
+ 
+ 	if (result != ISC_R_SUCCESS) {
+ 		goto cleanup;
+-- 
+2.49.0
+
diff --git a/bind.spec b/bind.spec
index bc465bc..71dd56f 100644
--- a/bind.spec
+++ b/bind.spec
@@ -135,6 +135,10 @@ Patch29: bind-9.20-nsupdate-tls-doc.patch
 Patch30: bind-9.20-nsupdate-tls-test.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=2123076
 Patch31: bind-9.18-pkcs11-provider.patch
+# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/10562
+# https://gitlab.isc.org/isc-projects/bind9/-/issues/5357
+# downstream patch fixing bind-dyndb-ldap causing issue
+Patch32: bind-9.21-resume-qmin-cname.patch
 
 %{?systemd_ordering}
 # https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers

From 21cc8ba4e6c8be585eacfe639afbb649dd763c4b Mon Sep 17 00:00:00 2001
From: Petr Mensik <pemensik@redhat.com>
Date: Tue, 10 Jun 2025 16:12:23 +0200
Subject: [PATCH 396/460] Prevent name.c:670 attributes assertion failed

Bump changelog.
---
 bind.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index 71dd56f..ecd6bdd 100644
--- a/bind.spec
+++ b/bind.spec
@@ -86,7 +86,7 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it.
 # Updating just bind will cause freeipa-dns-server package to be uninstallable.
 Version:  9.18.36
-Release:  1%{?dist}
+Release:  2%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -926,6 +926,9 @@ fi;
 %endif
 
 %changelog
+* Tue Jun 10 2025 'Petr Mensik' <<pemensik@redhat.com>> - 32:9.18.36-2
+- Prevent name.c:670 attributes assertion failed
+
 * Fri Apr 25 2025 Petr Mensik <pemensik@redhat.com> - 32:9.18.36-1
 - Update to 9.18.36 (rhbz#2346607)
 

From 0b246d18dfa60bac2c46da88832f61cd58093f73 Mon Sep 17 00:00:00 2001
From: Petr Mensik <pemensik@redhat.com>
Date: Tue, 10 Jun 2025 18:52:35 +0200
Subject: [PATCH 397/460] Add extra protections to places needing absolute
 names

Insert just potential protection in case Patch32 does not cover all
possible cases.
---
 bind-9.18-query-fname-relative.patch | 90 ++++++++++++++++++++++++++++
 bind.spec                            |  3 +
 2 files changed, 93 insertions(+)
 create mode 100644 bind-9.18-query-fname-relative.patch

diff --git a/bind-9.18-query-fname-relative.patch b/bind-9.18-query-fname-relative.patch
new file mode 100644
index 0000000..f29d501
--- /dev/null
+++ b/bind-9.18-query-fname-relative.patch
@@ -0,0 +1,90 @@
+From 12c16aac02a4f58575eb125cbd37a7f05d7cc245 Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Fri, 25 Apr 2025 02:00:00 +0200
+Subject: [PATCH] Insert additional checks ensuring name is not relative
+
+Mitigation for crashes put in various places, where obviously relative
+uninitialized name must not appear. This seems unnecessary once true
+cause were identified, but may prevent similar places.
+---
+ lib/ns/query.c | 35 +++++++++++++++++++++++++++++++++++
+ 1 file changed, 35 insertions(+)
+
+diff --git a/lib/ns/query.c b/lib/ns/query.c
+index 5a75601160..44adb220e3 100644
+--- a/lib/ns/query.c
++++ b/lib/ns/query.c
+@@ -2203,6 +2203,20 @@ regular:
+ 	CTRACE(ISC_LOG_DEBUG(3), "query_additional: done");
+ }
+ 
++static isc_result_t
++log_query_relative(query_ctx_t *qctx, const char *func, const dns_name_t *name) {
++	if (isc_log_wouldlog(ns_lctx, ISC_LOG_DEBUG(1))) {
++		char namebuf[DNS_NAME_FORMATSIZE] = "!";
++		dns_name_format(name, namebuf, sizeof(namebuf));
++		ns_client_log(
++			qctx->client, NS_LOGCATEGORY_CLIENT, NS_LOGMODULE_QUERY,
++			ISC_LOG_DEBUG(1),
++			"%s: fname=%s leading to relative name, aborting query.",
++			func, namebuf
++		);
++	}
++}
++
+ static void
+ query_addrrset(query_ctx_t *qctx, dns_name_t **namep,
+ 	       dns_rdataset_t **rdatasetp, dns_rdataset_t **sigrdatasetp,
+@@ -2275,6 +2289,11 @@ query_addrrset(query_ctx_t *qctx, dns_name_t **namep,
+ 		client->query.attributes &= ~NS_QUERYATTR_SECURE;
+ 	}
+ 
++	if (!qctx->is_zone && mname && !dns_name_isabsolute(mname)) {
++		log_query_relative(qctx, "query_addrrset", mname);
++		QUERY_ERROR(qctx, DNS_R_SERVFAIL);
++		return;
++	}
+ 	/*
+ 	 * Update message name, set rdataset order, and do additional
+ 	 * section processing if needed.
+@@ -8079,6 +8098,11 @@ query_respond_any(query_ctx_t *qctx) {
+ 							     : qctx->tname;
+ 				query_prefetch(qctx->client, name,
+ 					       qctx->rdataset);
++				if (name && !dns_name_isabsolute(name)) {
++					log_query_relative(qctx, "query_respond_any", name);
++					result = DNS_R_DROP;
++					break;
++				}
+ 			}
+ 
+ 			/*
+@@ -10701,6 +10725,11 @@ query_cname(query_ctx_t *qctx) {
+ 
+ 	if (!qctx->is_zone && RECURSIONOK(qctx->client)) {
+ 		query_prefetch(qctx->client, qctx->fname, qctx->rdataset);
++		if (qctx->fname && !dns_name_isabsolute(qctx->fname)) {
++			log_query_relative(qctx, "query_cname", qctx->fname);
++			QUERY_ERROR(qctx, DNS_R_SERVFAIL);
++			return (ns_query_done(qctx));
++		}
+ 	}
+ 
+ 	query_addrrset(qctx, &qctx->fname, &qctx->rdataset, sigrdatasetp,
+@@ -10806,7 +10835,13 @@ query_dname(query_ctx_t *qctx) {
+ 
+ 	if (!qctx->is_zone && RECURSIONOK(qctx->client)) {
+ 		query_prefetch(qctx->client, qctx->fname, qctx->rdataset);
++		if (qctx->fname && !dns_name_isabsolute(qctx->fname)) {
++			log_query_relative(qctx, "query_dname", qctx->fname);
++			QUERY_ERROR(qctx, DNS_R_SERVFAIL);
++			return (ns_query_done(qctx));
++		}
+ 	}
++
+ 	query_addrrset(qctx, &qctx->fname, &qctx->rdataset, sigrdatasetp,
+ 		       qctx->dbuf, DNS_SECTION_ANSWER);
+ 
+-- 
+2.49.0
+
diff --git a/bind.spec b/bind.spec
index ecd6bdd..b0e195f 100644
--- a/bind.spec
+++ b/bind.spec
@@ -139,6 +139,8 @@ Patch31: bind-9.18-pkcs11-provider.patch
 # https://gitlab.isc.org/isc-projects/bind9/-/issues/5357
 # downstream patch fixing bind-dyndb-ldap causing issue
 Patch32: bind-9.21-resume-qmin-cname.patch
+# downstream only, extra check for above change, RHEL-30407
+Patch33: bind-9.18-query-fname-relative.patch
 
 %{?systemd_ordering}
 # https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers
@@ -928,6 +930,7 @@ fi;
 %changelog
 * Tue Jun 10 2025 'Petr Mensik' <<pemensik@redhat.com>> - 32:9.18.36-2
 - Prevent name.c:670 attributes assertion failed
+- Add extra checks for relative names
 
 * Fri Apr 25 2025 Petr Mensik <pemensik@redhat.com> - 32:9.18.36-1
 - Update to 9.18.36 (rhbz#2346607)

From ed27e3714ce83b5c3c7f90d044d0697a41f664d5 Mon Sep 17 00:00:00 2001
From: "psklenar@redhat.com" <psklenar@redhat.com>
Date: Mon, 9 Jun 2025 16:52:26 +0200
Subject: [PATCH 398/460] fedora CI plans move to gitlab for centos-stream test
 space https://issues.redhat.com/browse/RHELMISC-13073

---
 plans/all.fmf          | 2 +-
 plans/tier1-public.fmf | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/plans/all.fmf b/plans/all.fmf
index 03bf500..a798d87 100644
--- a/plans/all.fmf
+++ b/plans/all.fmf
@@ -3,7 +3,7 @@ environment+:
     PACKAGE: bind
 discover:
     how: fmf
-    url: https://src.fedoraproject.org/tests/bind.git
+    url: https://gitlab.com/redhat/centos-stream/tests/bind.git
 execute:
     how: tmt
 context:
diff --git a/plans/tier1-public.fmf b/plans/tier1-public.fmf
index e5b273a..4970855 100644
--- a/plans/tier1-public.fmf
+++ b/plans/tier1-public.fmf
@@ -3,7 +3,7 @@ environment+:
     PACKAGE: bind
 discover:
     how: fmf
-    url: https://src.fedoraproject.org/tests/bind.git
+    url: https://gitlab.com/redhat/centos-stream/tests/bind.git
     filter: 'tier: 1'
 execute:
     how: tmt

From 2e5ec7e2b88b6f012bd68fecf5c607cf11eb1269 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Wed, 23 Jul 2025 17:41:39 +0000
Subject: [PATCH 399/460] Rebuilt for
 https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild

---
 bind.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index b0e195f..58c7267 100644
--- a/bind.spec
+++ b/bind.spec
@@ -86,7 +86,7 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it.
 # Updating just bind will cause freeipa-dns-server package to be uninstallable.
 Version:  9.18.36
-Release:  2%{?dist}
+Release:  3%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -928,6 +928,9 @@ fi;
 %endif
 
 %changelog
+* Wed Jul 23 2025 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.18.36-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
+
 * Tue Jun 10 2025 'Petr Mensik' <<pemensik@redhat.com>> - 32:9.18.36-2
 - Prevent name.c:670 attributes assertion failed
 - Add extra checks for relative names

From 3088af74e3484ca80f36d1677eabc06dc4636154 Mon Sep 17 00:00:00 2001
From: Petr Mensik <pemensik@redhat.com>
Date: Tue, 10 Jun 2025 19:26:28 +0200
Subject: [PATCH 400/460] Fix new added warning

---
 bind-9.18-query-fname-relative.patch | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/bind-9.18-query-fname-relative.patch b/bind-9.18-query-fname-relative.patch
index f29d501..43fea36 100644
--- a/bind-9.18-query-fname-relative.patch
+++ b/bind-9.18-query-fname-relative.patch
@@ -1,4 +1,4 @@
-From 12c16aac02a4f58575eb125cbd37a7f05d7cc245 Mon Sep 17 00:00:00 2001
+From 4ac85ace54798ba8ea0d3ef12926730ed4f55fac Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Fri, 25 Apr 2025 02:00:00 +0200
 Subject: [PATCH] Insert additional checks ensuring name is not relative
@@ -11,14 +11,14 @@ cause were identified, but may prevent similar places.
  1 file changed, 35 insertions(+)
 
 diff --git a/lib/ns/query.c b/lib/ns/query.c
-index 5a75601160..44adb220e3 100644
+index 5a75601160..d45c66c86d 100644
 --- a/lib/ns/query.c
 +++ b/lib/ns/query.c
 @@ -2203,6 +2203,20 @@ regular:
  	CTRACE(ISC_LOG_DEBUG(3), "query_additional: done");
  }
  
-+static isc_result_t
++static void
 +log_query_relative(query_ctx_t *qctx, const char *func, const dns_name_t *name) {
 +	if (isc_log_wouldlog(ns_lctx, ISC_LOG_DEBUG(1))) {
 +		char namebuf[DNS_NAME_FORMATSIZE] = "!";

From c5b2e69f0c55061a822be262e4476294a8842f9b Mon Sep 17 00:00:00 2001
From: Petr Mensik <pemensik@redhat.com>
Date: Wed, 30 Jul 2025 12:20:02 +0200
Subject: [PATCH 401/460] Update to 9.18.38 (rhbz#2367771)

Security Fixes:

- Fix an issue when some specific queries could remain unanswered with serve-stale enabled.

New Features:

- Add support for the CO flag to dig.

Bug fixes:

- Correct the default interface-interval from 60s to 60m.
- Fix a purge-keys bug when using multiple views of a zone.
---
 bind.spec | 7 +++++--
 sources   | 4 ++--
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/bind.spec b/bind.spec
index 58c7267..705a8c9 100644
--- a/bind.spec
+++ b/bind.spec
@@ -85,8 +85,8 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 #
 # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it.
 # Updating just bind will cause freeipa-dns-server package to be uninstallable.
-Version:  9.18.36
-Release:  3%{?dist}
+Version:  9.18.38
+Release:  1%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -928,6 +928,9 @@ fi;
 %endif
 
 %changelog
+* Wed Jul 30 2025 'Petr Mensik' <<pemensik@redhat.com>> - 32:9.18.38-1
+- Update to 9.18.38 (rhbz#2367771)
+
 * Wed Jul 23 2025 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.18.36-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
 
diff --git a/sources b/sources
index 86507ea..5c4fb7d 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.18.36.tar.xz) = a95af586ee752705fa164c4d2f41b988e044a86ba9f078d1647d10025ca8f2872c95544dc5515717862b8fcb46b24e9cf6669d719196b6734a50d7a4c16a1288
-SHA512 (bind-9.18.36.tar.xz.asc) = a5d76c060d088ac53b9fdde00eb44c09acaf12a2e25cb5e39281062fdfd5128a5665b771f424159938c284bc888b78575d9757f4b44e8518e446b45a8c889e5a
+SHA512 (bind-9.18.38.tar.xz) = 38710646a817dca0df6247b660cd244c79da13d0fed2898da139ae206bc8732fddd93af6fc2cbeca805c0c0d0789ec22eacf26789db288154581478ab2eaf44c
+SHA512 (bind-9.18.38.tar.xz.asc) = 52a06f8357aab7a4a100e17ae3168b368b7e8c623c47ddd90b605ab4175fa9a182bedca8aebaebce1aa6d013b32bec5651fdd4f38be99225c0716c6dddea3fa9

From a324aa90fddebd318f4368c244d9bcb0462dce75 Mon Sep 17 00:00:00 2001
From: Petr Mensik <pemensik@redhat.com>
Date: Thu, 14 Aug 2025 16:02:17 +0200
Subject: [PATCH 402/460] Fix rsabigexponent upstream test after pkcs11
 provider support

Related: https://issues.redhat.com/browse/RHEL-33729
---
 bind-9.18-pkcs11-provider.patch | 79 +++++++++++++++++++++++----------
 1 file changed, 56 insertions(+), 23 deletions(-)

diff --git a/bind-9.18-pkcs11-provider.patch b/bind-9.18-pkcs11-provider.patch
index 24a216b..4a48182 100644
--- a/bind-9.18-pkcs11-provider.patch
+++ b/bind-9.18-pkcs11-provider.patch
@@ -1,4 +1,4 @@
-From 0869590a0c182cbf546df190616f56f790fa32aa Mon Sep 17 00:00:00 2001
+From ec38a39feabea02eb75f257e8b81cf16aac9d184 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 13 Feb 2025 13:20:28 +0100
 Subject: [PATCH] Backport OpenSSL 3 provider support
@@ -30,18 +30,23 @@ Fix keyfromlabel to not use engine parameter for provider keys
 Use dst_key_t label to signal isprivate property as a downstream
 alternative to upstream commit 74361b0b6e5a6b17ebeea6afe1ca990395d7a6dd.
 That would require additional heavier changes.
+
+Downstream change:
+Move RSA bits check to legacy, let it use rsa_check for newer
+
+rsabigexponent tests got broken by this change.
 ---
  lib/dns/dst_openssl.h       |   4 +
- lib/dns/dst_parse.c         |  21 ++---
- lib/dns/openssl_link.c      | 161 ++++++++++++++++++++++++++++-----
- lib/dns/openssldh_link.c    |   5 ++
- lib/dns/opensslecdsa_link.c | 110 ++++++++++++-----------
- lib/dns/openssleddsa_link.c |  40 +++------
- lib/dns/opensslrsa_link.c   | 173 ++++++++++++++----------------------
- 7 files changed, 295 insertions(+), 219 deletions(-)
+ lib/dns/dst_parse.c         |  21 ++--
+ lib/dns/openssl_link.c      | 161 ++++++++++++++++++++++++++----
+ lib/dns/openssldh_link.c    |   5 +
+ lib/dns/opensslecdsa_link.c | 110 ++++++++++-----------
+ lib/dns/openssleddsa_link.c |  40 +++-----
+ lib/dns/opensslrsa_link.c   | 189 +++++++++++++++---------------------
+ 7 files changed, 303 insertions(+), 227 deletions(-)
 
 diff --git a/lib/dns/dst_openssl.h b/lib/dns/dst_openssl.h
-index 819af0fee1..cd386c0019 100644
+index 819af0f..cd386c0 100644
 --- a/lib/dns/dst_openssl.h
 +++ b/lib/dns/dst_openssl.h
 @@ -64,4 +64,8 @@ ENGINE *
@@ -54,7 +59,7 @@ index 819af0fee1..cd386c0019 100644
 +
  ISC_LANG_ENDDECLS
 diff --git a/lib/dns/dst_parse.c b/lib/dns/dst_parse.c
-index d5ea0e418b..addb65ec5a 100644
+index d5ea0e4..addb65e 100644
 --- a/lib/dns/dst_parse.c
 +++ b/lib/dns/dst_parse.c
 @@ -195,10 +195,9 @@ check_rsa(const dst_private_t *priv, bool external) {
@@ -101,7 +106,7 @@ index d5ea0e418b..addb65ec5a 100644
  }
  
 diff --git a/lib/dns/openssl_link.c b/lib/dns/openssl_link.c
-index e3a89f4406..62077b6f81 100644
+index e3a89f4..62077b6 100644
 --- a/lib/dns/openssl_link.c
 +++ b/lib/dns/openssl_link.c
 @@ -44,6 +44,9 @@
@@ -308,7 +313,7 @@ index e3a89f4406..62077b6f81 100644
 +
  /*! \file */
 diff --git a/lib/dns/openssldh_link.c b/lib/dns/openssldh_link.c
-index a4ba0f78d3..38345e6bfd 100644
+index a4ba0f7..38345e6 100644
 --- a/lib/dns/openssldh_link.c
 +++ b/lib/dns/openssldh_link.c
 @@ -610,6 +610,11 @@ err:
@@ -324,7 +329,7 @@ index a4ba0f78d3..38345e6bfd 100644
  	DH *dh = key->keydata.dh;
  	const BIGNUM *priv_key = NULL;
 diff --git a/lib/dns/opensslecdsa_link.c b/lib/dns/opensslecdsa_link.c
-index ca12bb5620..5d070140c5 100644
+index ca12bb5..5d07014 100644
 --- a/lib/dns/opensslecdsa_link.c
 +++ b/lib/dns/opensslecdsa_link.c
 @@ -617,6 +617,12 @@ opensslecdsa_isprivate(const dst_key_t *key) {
@@ -529,7 +534,7 @@ index ca12bb5620..5d070140c5 100644
  
  static dst_func_t opensslecdsa_functions = {
 diff --git a/lib/dns/openssleddsa_link.c b/lib/dns/openssleddsa_link.c
-index 74dac17bc6..04457fbfc3 100644
+index 74dac17..04457fb 100644
 --- a/lib/dns/openssleddsa_link.c
 +++ b/lib/dns/openssleddsa_link.c
 @@ -361,6 +361,12 @@ openssleddsa_isprivate(const dst_key_t *key) {
@@ -606,7 +611,7 @@ index 74dac17bc6..04457fbfc3 100644
  
  static dst_func_t openssleddsa_functions = {
 diff --git a/lib/dns/opensslrsa_link.c b/lib/dns/opensslrsa_link.c
-index 37e8a63a61..1ffae888e1 100644
+index 37e8a63..d4fbe97 100644
 --- a/lib/dns/opensslrsa_link.c
 +++ b/lib/dns/opensslrsa_link.c
 @@ -545,6 +545,12 @@ opensslrsa_isprivate(const dst_key_t *key) {
@@ -762,7 +767,7 @@ index 37e8a63a61..1ffae888e1 100644
  	}
  
  	for (i = 0; i < priv.nelements; i++) {
-@@ -1321,7 +1332,7 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
+@@ -1321,9 +1332,14 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
  			BN_clear_free(iqmp);
  		}
  	}
@@ -770,7 +775,35 @@ index 37e8a63a61..1ffae888e1 100644
 +	if (rsa_check_legacy(rsa, pubrsa) != ISC_R_SUCCESS) {
  		DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
  	}
++
++	if (BN_num_bits(e) > RSA_MAX_PUBEXP_BITS) {
++		DST_RET(ISC_R_RANGE);
++	}
++
  #else
+ 	bld = OSSL_PARAM_BLD_new();
+ 	if (bld == NULL) {
+@@ -1390,17 +1406,12 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
+ 		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
+ 	}
+ 
+-	if (rsa_check(pkey, pub != NULL ? pub->keydata.pkey : NULL) !=
+-	    ISC_R_SUCCESS)
+-	{
+-		DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
++	ret = rsa_check(pkey, pub != NULL ? pub->keydata.pkey : NULL);
++	if (ret != ISC_R_SUCCESS) {
++		DST_RET(ret);
+ 	}
+ #endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+-	if (BN_num_bits(e) > RSA_MAX_PUBEXP_BITS) {
+-		DST_RET(ISC_R_RANGE);
+-	}
+-
+ 	key->key_size = BN_num_bits(n);
+ 	key->keydata.pkey = pkey;
+ 	pkey = NULL;
 @@ -1464,69 +1475,30 @@ err:
  static isc_result_t
  opensslrsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
@@ -791,11 +824,7 @@ index 37e8a63a61..1ffae888e1 100644
 -	if (e == NULL) {
 -		DST_RET(dst__openssl_toresult(DST_R_NOENGINE));
 -	}
-+	ret = dst__openssl_fromlabel(EVP_PKEY_RSA, engine, label, pin,
-+				       &pubpkey, &pkey);
-+	if (ret != ISC_R_SUCCESS)
-+		DST_RET(ret);
- 
+-
 -	pubpkey = ENGINE_load_public_key(e, label, NULL, NULL);
 -	if (pubpkey == NULL) {
 -		DST_RET(dst__openssl_toresult2("ENGINE_load_public_key",
@@ -805,7 +834,11 @@ index 37e8a63a61..1ffae888e1 100644
 -	if (pubrsa == NULL) {
 -		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
 -	}
--
++	ret = dst__openssl_fromlabel(EVP_PKEY_RSA, engine, label, pin,
++				       &pubpkey, &pkey);
++	if (ret != ISC_R_SUCCESS)
++		DST_RET(ret);
+ 
 -	pkey = ENGINE_load_private_key(e, label, NULL, NULL);
 -	if (pkey == NULL) {
 -		DST_RET(dst__openssl_toresult2("ENGINE_load_private_key",
@@ -867,5 +900,5 @@ index 37e8a63a61..1ffae888e1 100644
  
  static dst_func_t opensslrsa_functions = {
 -- 
-2.49.0
+2.50.1
 

From 4cc7c36636962199fb37fcbbd4b1c8b8614b60ee Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 21 Aug 2025 11:39:44 +0200
Subject: [PATCH 403/460] Update to 9.18.39 (rhbz#2389765)

New Features:

- Support for parsing the DSYNC record has been added.

Feature Changes:

- Add deprecation warnings for RSASHA1, RSASHA1-NSEC3SHA1, and DS digest type 1.

Bug Fixes:

- Clean enough memory when adding new ADB names/entries under memory pressure.
- Rescan the interfaces again when reconfiguring the server.

https://downloads.isc.org/isc/bind9/9.18.39/doc/arm/html/notes.html#notes-for-bind-9-18-39
---
 bind-9.18-query-fname-relative.patch | 90 ----------------------------
 bind-9.21-resume-qmin-cname.patch    | 44 --------------
 bind.spec                            | 11 ++--
 sources                              |  4 +-
 4 files changed, 6 insertions(+), 143 deletions(-)
 delete mode 100644 bind-9.18-query-fname-relative.patch
 delete mode 100644 bind-9.21-resume-qmin-cname.patch

diff --git a/bind-9.18-query-fname-relative.patch b/bind-9.18-query-fname-relative.patch
deleted file mode 100644
index 43fea36..0000000
--- a/bind-9.18-query-fname-relative.patch
+++ /dev/null
@@ -1,90 +0,0 @@
-From 4ac85ace54798ba8ea0d3ef12926730ed4f55fac Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Fri, 25 Apr 2025 02:00:00 +0200
-Subject: [PATCH] Insert additional checks ensuring name is not relative
-
-Mitigation for crashes put in various places, where obviously relative
-uninitialized name must not appear. This seems unnecessary once true
-cause were identified, but may prevent similar places.
----
- lib/ns/query.c | 35 +++++++++++++++++++++++++++++++++++
- 1 file changed, 35 insertions(+)
-
-diff --git a/lib/ns/query.c b/lib/ns/query.c
-index 5a75601160..d45c66c86d 100644
---- a/lib/ns/query.c
-+++ b/lib/ns/query.c
-@@ -2203,6 +2203,20 @@ regular:
- 	CTRACE(ISC_LOG_DEBUG(3), "query_additional: done");
- }
- 
-+static void
-+log_query_relative(query_ctx_t *qctx, const char *func, const dns_name_t *name) {
-+	if (isc_log_wouldlog(ns_lctx, ISC_LOG_DEBUG(1))) {
-+		char namebuf[DNS_NAME_FORMATSIZE] = "!";
-+		dns_name_format(name, namebuf, sizeof(namebuf));
-+		ns_client_log(
-+			qctx->client, NS_LOGCATEGORY_CLIENT, NS_LOGMODULE_QUERY,
-+			ISC_LOG_DEBUG(1),
-+			"%s: fname=%s leading to relative name, aborting query.",
-+			func, namebuf
-+		);
-+	}
-+}
-+
- static void
- query_addrrset(query_ctx_t *qctx, dns_name_t **namep,
- 	       dns_rdataset_t **rdatasetp, dns_rdataset_t **sigrdatasetp,
-@@ -2275,6 +2289,11 @@ query_addrrset(query_ctx_t *qctx, dns_name_t **namep,
- 		client->query.attributes &= ~NS_QUERYATTR_SECURE;
- 	}
- 
-+	if (!qctx->is_zone && mname && !dns_name_isabsolute(mname)) {
-+		log_query_relative(qctx, "query_addrrset", mname);
-+		QUERY_ERROR(qctx, DNS_R_SERVFAIL);
-+		return;
-+	}
- 	/*
- 	 * Update message name, set rdataset order, and do additional
- 	 * section processing if needed.
-@@ -8079,6 +8098,11 @@ query_respond_any(query_ctx_t *qctx) {
- 							     : qctx->tname;
- 				query_prefetch(qctx->client, name,
- 					       qctx->rdataset);
-+				if (name && !dns_name_isabsolute(name)) {
-+					log_query_relative(qctx, "query_respond_any", name);
-+					result = DNS_R_DROP;
-+					break;
-+				}
- 			}
- 
- 			/*
-@@ -10701,6 +10725,11 @@ query_cname(query_ctx_t *qctx) {
- 
- 	if (!qctx->is_zone && RECURSIONOK(qctx->client)) {
- 		query_prefetch(qctx->client, qctx->fname, qctx->rdataset);
-+		if (qctx->fname && !dns_name_isabsolute(qctx->fname)) {
-+			log_query_relative(qctx, "query_cname", qctx->fname);
-+			QUERY_ERROR(qctx, DNS_R_SERVFAIL);
-+			return (ns_query_done(qctx));
-+		}
- 	}
- 
- 	query_addrrset(qctx, &qctx->fname, &qctx->rdataset, sigrdatasetp,
-@@ -10806,7 +10835,13 @@ query_dname(query_ctx_t *qctx) {
- 
- 	if (!qctx->is_zone && RECURSIONOK(qctx->client)) {
- 		query_prefetch(qctx->client, qctx->fname, qctx->rdataset);
-+		if (qctx->fname && !dns_name_isabsolute(qctx->fname)) {
-+			log_query_relative(qctx, "query_dname", qctx->fname);
-+			QUERY_ERROR(qctx, DNS_R_SERVFAIL);
-+			return (ns_query_done(qctx));
-+		}
- 	}
-+
- 	query_addrrset(qctx, &qctx->fname, &qctx->rdataset, sigrdatasetp,
- 		       qctx->dbuf, DNS_SECTION_ANSWER);
- 
--- 
-2.49.0
-
diff --git a/bind-9.21-resume-qmin-cname.patch b/bind-9.21-resume-qmin-cname.patch
deleted file mode 100644
index 05fd4b4..0000000
--- a/bind-9.21-resume-qmin-cname.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-From ac0c3b0477d97fe5c968910f603bb8d04c740da7 Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Tue, 3 Jun 2025 21:00:58 +0200
-Subject: [PATCH] Handle CNAME and DNAME in resume_min in a special way
-
-When authoritative zone is loaded when query minimization query for the
-same zone is already pending, it might receive unexpected result codes.
-
-Normally DNS_R_CNAME would follow to query_cname after processing sent
-events, but dns_view_findzonecut does not fill CNAME target into
-event->foundevent. Usual lookup via query_lookup would always have that
-filled.
-
-Ideally we would restart the query with unmodified search name, if
-unexpected change from recursing to local zone cut were detected. Until
-dns_view_findzonecut is modified to export zone/cache source of the cut,
-at least fail queries which went into unexpected state.
----
- lib/dns/resolver.c | 9 +++++++++
- 1 file changed, 9 insertions(+)
-
-diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
-index 795791246b..39a294437e 100644
---- a/lib/dns/resolver.c
-+++ b/lib/dns/resolver.c
-@@ -4497,6 +4497,15 @@ resume_qmin(isc_task_t *task, isc_event_t *event) {
- 	if (result == DNS_R_NXDOMAIN) {
- 		result = DNS_R_SERVFAIL;
- 	}
-+	/*
-+	 * CNAME or DNAME means zone were added with that record
-+	 * after the start of query minimization queries. It means
-+	 * we do not have initialized correct hevent->foundname
-+	 * and have to fail.
-+	 */
-+	if (result == DNS_R_CNAME || result == DNS_R_DNAME) {
-+		result = DNS_R_SERVFAIL;
-+	}
- 
- 	if (result != ISC_R_SUCCESS) {
- 		goto cleanup;
--- 
-2.49.0
-
diff --git a/bind.spec b/bind.spec
index 705a8c9..89a6ab5 100644
--- a/bind.spec
+++ b/bind.spec
@@ -85,7 +85,7 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 #
 # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it.
 # Updating just bind will cause freeipa-dns-server package to be uninstallable.
-Version:  9.18.38
+Version:  9.18.39
 Release:  1%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
@@ -135,12 +135,6 @@ Patch29: bind-9.20-nsupdate-tls-doc.patch
 Patch30: bind-9.20-nsupdate-tls-test.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=2123076
 Patch31: bind-9.18-pkcs11-provider.patch
-# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/10562
-# https://gitlab.isc.org/isc-projects/bind9/-/issues/5357
-# downstream patch fixing bind-dyndb-ldap causing issue
-Patch32: bind-9.21-resume-qmin-cname.patch
-# downstream only, extra check for above change, RHEL-30407
-Patch33: bind-9.18-query-fname-relative.patch
 
 %{?systemd_ordering}
 # https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers
@@ -928,6 +922,9 @@ fi;
 %endif
 
 %changelog
+* Thu Aug 21 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.39-1
+- Update to 9.18.39 (rhbz#2389765)
+
 * Wed Jul 30 2025 'Petr Mensik' <<pemensik@redhat.com>> - 32:9.18.38-1
 - Update to 9.18.38 (rhbz#2367771)
 
diff --git a/sources b/sources
index 5c4fb7d..aa55f1d 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.18.38.tar.xz) = 38710646a817dca0df6247b660cd244c79da13d0fed2898da139ae206bc8732fddd93af6fc2cbeca805c0c0d0789ec22eacf26789db288154581478ab2eaf44c
-SHA512 (bind-9.18.38.tar.xz.asc) = 52a06f8357aab7a4a100e17ae3168b368b7e8c623c47ddd90b605ab4175fa9a182bedca8aebaebce1aa6d013b32bec5651fdd4f38be99225c0716c6dddea3fa9
+SHA512 (bind-9.18.39.tar.xz) = fd6d45c9cb9c599d8770c18801fad2f177faf3a8af82948800d186ae6dc9eb2c894b61802def0841eb722c615c93c077b55368204f0cf2737a3c50d949efca07
+SHA512 (bind-9.18.39.tar.xz.asc) = 17e8aad74f1eaa42119f84ab3df05e85a1775f97c628259e00f7224d4f0d250050d022db670bc036b0ba05a3cd586de331da0b77c42ab58307711fed36c7ee9e

From a5e89554c928a1caa090faf9424ebe6101d17768 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 1 Sep 2025 16:58:27 +0200
Subject: [PATCH 404/460] Offer up to 13 additional servers records

Downstream only patch for now. Required to work together with Microsoft
DNS server Stub zone entry.

Related: RHEL-84006
Resolves: rhbz#2392413
---
 bind-9.18-partial-additional-records.patch | 54 ++++++++++++++++++++++
 bind.spec                                  |  7 ++-
 2 files changed, 60 insertions(+), 1 deletion(-)
 create mode 100644 bind-9.18-partial-additional-records.patch

diff --git a/bind-9.18-partial-additional-records.patch b/bind-9.18-partial-additional-records.patch
new file mode 100644
index 0000000..6834616
--- /dev/null
+++ b/bind-9.18-partial-additional-records.patch
@@ -0,0 +1,54 @@
+From 3f686891729c7d39d879e8b5bb1aa17d874d265d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
+Date: Thu, 19 Jun 2025 19:51:43 +0200
+Subject: [PATCH] Limit number of additional records fetched
+
+Limit number of started fetches for additional zone instead of doing
+none. Keep limit of NS filled with additional records, but present at
+least some if possible.
+
+Might help broken implementations relying on receiving addresses in the
+response for NS query in authoritative zone.
+---
+ lib/dns/rdataset.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/lib/dns/rdataset.c b/lib/dns/rdataset.c
+index 532e49a..bfa8e37 100644
+--- a/lib/dns/rdataset.c
++++ b/lib/dns/rdataset.c
+@@ -581,6 +581,7 @@ dns_rdataset_additionaldata(dns_rdataset_t *rdataset,
+ 			    size_t limit) {
+ 	dns_rdata_t rdata = DNS_RDATA_INIT;
+ 	isc_result_t result;
++	size_t n = 0;
+ 
+ 	/*
+ 	 * For each rdata in rdataset, call 'add' for each name and type in the
+@@ -590,10 +591,6 @@ dns_rdataset_additionaldata(dns_rdataset_t *rdataset,
+ 	REQUIRE(DNS_RDATASET_VALID(rdataset));
+ 	REQUIRE((rdataset->attributes & DNS_RDATASETATTR_QUESTION) == 0);
+ 
+-	if (limit != 0 && dns_rdataset_count(rdataset) > limit) {
+-		return DNS_R_TOOMANYRECORDS;
+-	}
+-
+ 	result = dns_rdataset_first(rdataset);
+ 	if (result != ISC_R_SUCCESS) {
+ 		return result;
+@@ -603,7 +600,11 @@ dns_rdataset_additionaldata(dns_rdataset_t *rdataset,
+ 		dns_rdataset_current(rdataset, &rdata);
+ 		result = dns_rdata_additionaldata(&rdata, owner_name, add, arg);
+ 		if (result == ISC_R_SUCCESS) {
+-			result = dns_rdataset_next(rdataset);
++			if (limit != 0 && ++n >= limit) {
++				result = DNS_R_TOOMANYRECORDS;
++			} else {
++				result = dns_rdataset_next(rdataset);
++			}
+ 		}
+ 		dns_rdata_reset(&rdata);
+ 	} while (result == ISC_R_SUCCESS);
+-- 
+2.50.1
+
diff --git a/bind.spec b/bind.spec
index 89a6ab5..7c00b54 100644
--- a/bind.spec
+++ b/bind.spec
@@ -86,7 +86,7 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it.
 # Updating just bind will cause freeipa-dns-server package to be uninstallable.
 Version:  9.18.39
-Release:  1%{?dist}
+Release:  2%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -135,6 +135,8 @@ Patch29: bind-9.20-nsupdate-tls-doc.patch
 Patch30: bind-9.20-nsupdate-tls-test.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=2123076
 Patch31: bind-9.18-pkcs11-provider.patch
+# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/10611
+Patch32: bind-9.18-partial-additional-records.patch
 
 %{?systemd_ordering}
 # https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers
@@ -922,6 +924,9 @@ fi;
 %endif
 
 %changelog
+* Mon Sep 01 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.39-2
+- Offer up to 13 additional servers records if there are more servers
+
 * Thu Aug 21 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.39-1
 - Update to 9.18.39 (rhbz#2389765)
 

From 3f3e0c1c5858153db61418017e697bd7535aa895 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 3 Sep 2025 18:33:35 +0200
Subject: [PATCH 405/460] Decode IDN names on input in all situations in
 utilities (rhbz#2324186)

Use the same name in dig or host utilities when stdout is not a
terminal. Until now it disabled IDN processing when stdout were not a
terminal. Disable just IDN output in that case and try to decode input
name with IDN. Keep failing in interactive sessions, but send even
undecoded name query when output is redirected.

That should limit new surprises and keep most of behaviour without
changes. But do not break in when input name failed to decode and
it were not trying to decode it before.

Related: RHEL-66172
---
 bind-9.18-dig-idn-input-always.patch | 98 ++++++++++++++++++++++++++++
 bind.spec                            |  8 ++-
 2 files changed, 105 insertions(+), 1 deletion(-)
 create mode 100644 bind-9.18-dig-idn-input-always.patch

diff --git a/bind-9.18-dig-idn-input-always.patch b/bind-9.18-dig-idn-input-always.patch
new file mode 100644
index 0000000..7c72269
--- /dev/null
+++ b/bind-9.18-dig-idn-input-always.patch
@@ -0,0 +1,98 @@
+From fcc50604359a05e24003f3ff51c3812d8f307814 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
+Date: Wed, 6 Nov 2024 21:29:47 +0100
+Subject: [PATCH] Allow always IDN input in dig
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Even when stdout is non-interactive terminal, allow unicode characters
+to be encoded into ACE form. Still disable IDN output, but unless
++noidnin or IDN_DISABLE=1 env is detected, consider input as locale
+defined name.
+
+Provides more isolated change, which issue #3527 introduced similar
+behavior into 9.19 with more changes.
+
+Ignore input IDN errors when stdout is not terminal
+
+Attempt to prevent visible regressions when enabling IDN on input
+always. Instead of new hard failures preventing IDN decoding of input
+name just use original input.
+
+Should make the change backward compatible. When on interactive terminal
+behave the same way as before and emit hard errors. Become more
+forgiving in scripts where stdout leads to script. Decoding output is
+not enabled there and if input decoding fails, just use input as it was.
+
+Change dig manual +idnin
+
+Note in manual IDN input is always enabled. But it silently ignores
+errors when stdout is not a terminal to prevent regressions.
+
+Signed-off-by: Petr Menšík <pemensik@redhat.com>
+---
+ bin/dig/dig.rst   |  5 ++---
+ bin/dig/dighost.c | 16 ++++++++++++----
+ 2 files changed, 14 insertions(+), 7 deletions(-)
+
+diff --git a/bin/dig/dig.rst b/bin/dig/dig.rst
+index 88b0a40307..e2bf3764d3 100644
+--- a/bin/dig/dig.rst
++++ b/bin/dig/dig.rst
+@@ -453,9 +453,8 @@ abbreviation is unambiguous; for example, :option:`+cd` is equivalent to
+    This option processes [or does not process] IDN domain names on input. This requires
+    ``IDN SUPPORT`` to have been enabled at compile time.
+ 
+-   The default is to process IDN input when standard output is a tty.
+-   The IDN processing on input is disabled when :program:`dig` output is redirected
+-   to files, pipes, and other non-tty file descriptors.
++   The default is to process IDN input. The input IDN processing errors are ignored
++   when :program:`dig` output is redirected to files, pipes, and other non-tty file descriptors.
+ 
+ .. option:: +idnout, +noidnout
+ 
+diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
+index 0f8ac1335c..1307346192 100644
+--- a/bin/dig/dighost.c
++++ b/bin/dig/dighost.c
+@@ -604,7 +604,7 @@ dig_lookup_t *
+ make_empty_lookup(void) {
+ 	dig_lookup_t *looknew;
+ #ifdef HAVE_LIBIDN2
+-	bool idn_allowed = isatty(1) ? (getenv("IDN_DISABLE") == NULL) : false;
++	bool idn_allowed = (getenv("IDN_DISABLE") == NULL);
+ #endif /* HAVE_LIBIDN2 */
+ 
+ 	debug("make_empty_lookup()");
+@@ -623,7 +623,7 @@ make_empty_lookup(void) {
+ 		.badcookie = true,
+ #ifdef HAVE_LIBIDN2
+ 		.idnin = idn_allowed,
+-		.idnout = idn_allowed,
++		.idnout = isatty(1) && idn_allowed,
+ #endif /* HAVE_LIBIDN2 */
+ 		.udpsize = -1,
+ 		.edns = -1,
+@@ -4871,8 +4871,16 @@ idn_locale_to_ace(const char *src, char *dst, size_t dstlen) {
+ 		res = idn2_to_ascii_lz(src, &ascii_src, IDN2_TRANSITIONAL);
+ 	}
+ 	if (res != IDN2_OK) {
+-		fatal("'%s' is not a legal IDNA2008 name (%s), use +noidnin",
+-		      src, idn2_strerror(res));
++		if (isatty(1)) {
++			fatal("'%s' is not a legal IDNA2008 name (%s), use +noidnin",
++			      src, idn2_strerror(res));
++		} else {
++			/* In case of non-terminal output silently ignore errors
++			 * in IDN input decoding. */
++			(void)strlcpy(dst, src, dstlen);
++			resetlocale(LC_ALL);
++			return;
++		}
+ 	}
+ 
+ 	/*
+-- 
+2.50.1
+
diff --git a/bind.spec b/bind.spec
index 7c00b54..07578c3 100644
--- a/bind.spec
+++ b/bind.spec
@@ -86,7 +86,7 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it.
 # Updating just bind will cause freeipa-dns-server package to be uninstallable.
 Version:  9.18.39
-Release:  2%{?dist}
+Release:  3%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -137,6 +137,9 @@ Patch30: bind-9.20-nsupdate-tls-test.patch
 Patch31: bind-9.18-pkcs11-provider.patch
 # https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/10611
 Patch32: bind-9.18-partial-additional-records.patch
+# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/9723
+# downstream only
+Patch33: bind-9.18-dig-idn-input-always.patch
 
 %{?systemd_ordering}
 # https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers
@@ -924,6 +927,9 @@ fi;
 %endif
 
 %changelog
+* Wed Sep 03 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.39-3
+- Decode IDN names on input in all situations in utilities (rhbz#2324186)
+
 * Mon Sep 01 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.39-2
 - Offer up to 13 additional servers records if there are more servers
 

From 4d97d1689acf5a94f81751b21909c8735e4540ee Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 5 Sep 2025 15:21:19 +0200
Subject: [PATCH 406/460] logrotate: skip if empty and remove old variants

Many variants are never built anymore. Clean actions to just those still
shipped. But do not trigger named reload when named.run file is empty.
That is common on freeipa installation, where configuration changes
logging to put it elsewhere. named reload is disruptive because how
bind-dyndb-ldap behaves during reloads. Avoid unnecessary reloads with
visible service disruption.
---
 named.logrotate | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/named.logrotate b/named.logrotate
index 5df448f..5934e52 100644
--- a/named.logrotate
+++ b/named.logrotate
@@ -2,11 +2,9 @@
     missingok
     su named named
     create 0644 named named
+    notifempty
     postrotate
         /usr/bin/systemctl reload named.service > /dev/null 2>&1 || true
         /usr/bin/systemctl reload named-chroot.service > /dev/null 2>&1 || true
-        /usr/bin/systemctl reload named-sdb.service > /dev/null 2>&1 || true
-        /usr/bin/systemctl reload named-sdb-chroot.service > /dev/null 2>&1 || true
-        /usr/bin/systemctl reload named-pkcs11.service > /dev/null 2>&1 || true
     endscript
 }

From 8b224f4fa80997db130645b151ca4330eecb3e66 Mon Sep 17 00:00:00 2001
From: Adam Williamson <awilliam@redhat.com>
Date: Wed, 10 Sep 2025 17:39:08 -0700
Subject: [PATCH 407/460] No-change rebuild to fix F43 update

---
 bind.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index 07578c3..56753e1 100644
--- a/bind.spec
+++ b/bind.spec
@@ -86,7 +86,7 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it.
 # Updating just bind will cause freeipa-dns-server package to be uninstallable.
 Version:  9.18.39
-Release:  3%{?dist}
+Release:  4%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -927,6 +927,9 @@ fi;
 %endif
 
 %changelog
+* Wed Sep 10 2025 Adam Williamson <awilliam@redhat.com> - 32:9.18.39-4
+- No-change rebuild to fix F43 update
+
 * Wed Sep 03 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.39-3
 - Decode IDN names on input in all situations in utilities (rhbz#2324186)
 

From 6800e4413458b892130fef685adfe19479eca0bf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 12 Sep 2025 11:02:37 +0200
Subject: [PATCH 408/460] Remove permanently removed parts from README

[skip changelog]
---
 README.md | 2 --
 1 file changed, 2 deletions(-)

diff --git a/README.md b/README.md
index 773d2cb..cf33403 100644
--- a/README.md
+++ b/README.md
@@ -28,7 +28,6 @@ The package contains several subpackages, some of them can be disabled on rebuil
 * **bind** -- *named* daemon providing DNS server
 * **bind-utils** -- set of tools to analyse DNS responses or update entries (dig, host)
 * **bind-doc** -- documentation for current bind, *BIND 9 Administrator Reference Manual*.
-* **bind-license** -- Shared license for all packages but bind-export-libs.
 * **bind-libs** -- Shared libraries used by some others programs
 * **bind-devel** -- Development headers for libs. Can be disabled by `--without DEVEL`
 
@@ -37,4 +36,3 @@ The package contains several subpackages, some of them can be disabled on rebuil
 
 * *GSSTSIG* -- Support for Kerberos authentication in BIND.
 * *LMDB* -- Support for dynamic database for managing runtime added zones. Provides faster removal of added zone with much less overhead. But requires lmdb linked to base libs.
-* *DLZ* -- Support for dynamic loaded modules providing support for features *bind-sdb* provides, but only small module is required.

From 4a8dd5ccc3d2c27de11473afd9062e064e867f55 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 16 Sep 2025 12:03:49 +0200
Subject: [PATCH 409/460] Fix expectations on idna system test

IDNA tests always redirect output into the file. That means its
behaviour has changed and is now processing IDN input by default and
just disables IDN output by default.

New behaviour when redirected is the same as +idnin +noidnout, but does
not fail hard on input errors.

Related: RHEL-112765
Resolves: rhbz#2324186
---
 bind-9.18-dig-idn-input-always-test.patch | 76 +++++++++++++++++++++++
 bind.spec                                 |  7 ++-
 2 files changed, 82 insertions(+), 1 deletion(-)
 create mode 100644 bind-9.18-dig-idn-input-always-test.patch

diff --git a/bind-9.18-dig-idn-input-always-test.patch b/bind-9.18-dig-idn-input-always-test.patch
new file mode 100644
index 0000000..c2a287b
--- /dev/null
+++ b/bind-9.18-dig-idn-input-always-test.patch
@@ -0,0 +1,76 @@
+From 12f50726b6bd8f6b3ed6709695e0f6893bc865c6 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
+Date: Tue, 16 Sep 2025 11:46:03 +0200
+Subject: [PATCH] Fix expectations on idna system test
+
+IDNA tests always redirect output into the file. That means its
+behaviour has changed and is now processing IDN input by default and
+just disables IDN output by default.
+
+New behaviour when redirected is the same as +idnin +noidnout, but does
+not fail hard on input errors.
+---
+ bin/tests/system/idna/tests.sh | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/bin/tests/system/idna/tests.sh b/bin/tests/system/idna/tests.sh
+index 398b7e1..37f02b1 100644
+--- a/bin/tests/system/idna/tests.sh
++++ b/bin/tests/system/idna/tests.sh
+@@ -194,7 +194,7 @@ idna_enabled_test() {
+   # Note that ASCII characters are converted to lower-case.
+ 
+   text="Checking valid non-ASCII label"
+-  idna_test "$text" "" "München" "M\195\188nchen."
++  idna_test "$text" "" "München" "xn--mnchen-3ya."
+   idna_test "$text" "+noidnin +noidnout" "München" "M\195\188nchen."
+   idna_test "$text" "+noidnin +idnout" "München" "M\195\188nchen."
+   idna_test "$text" "+idnin   +noidnout" "München" "xn--mnchen-3ya."
+@@ -218,7 +218,7 @@ idna_enabled_test() {
+   # for the valid U-label.
+ 
+   text="Checking that non-transitional IDNA processing is used"
+-  idna_test "$text" "" "faß.de" "fa\195\159.de."
++  idna_test "$text" "" "faß.de" "xn--fa-hia.de."
+   idna_test "$text" "+noidnin +noidnout" "faß.de" "fa\195\159.de."
+   idna_test "$text" "+noidnin +idnout" "faß.de" "fa\195\159.de."
+   idna_test "$text" "+idnin   +noidnout" "faß.de" "xn--fa-hia.de."
+@@ -228,7 +228,7 @@ idna_enabled_test() {
+   # onto the Greek sigma character ("σ") in IDNA2003.
+ 
+   text="Second check that non-transitional IDNA processing is used"
+-  idna_test "$text" "" "βόλος.com" "\206\178\207\140\206\187\206\191\207\130.com."
++  idna_test "$text" "" "βόλος.com"  "xn--nxasmm1c.com."
+   idna_test "$text" "+noidnin +noidnout" "βόλος.com" "\206\178\207\140\206\187\206\191\207\130.com."
+   idna_test "$text" "+noidnin +idnout" "βόλος.com" "\206\178\207\140\206\187\206\191\207\130.com."
+   idna_test "$text" "+idnin   +noidnout" "βόλος.com" "xn--nxasmm1c.com."
+@@ -288,7 +288,7 @@ idna_enabled_test() {
+   idna_test "$text" "" "xn--xx" "xn--xx."
+   idna_test "$text" "+noidnin +noidnout" "xn--xx" "xn--xx."
+   idna_fail "$text" "+noidnin   +idnout" "xn--xx"
+-  idna_fail "$text" "+idnin   +noidnout" "xn--xx"
++  idna_test "$text" "+idnin   +noidnout" "xn--xx" "xn--xx."
+   idna_fail "$text" "+idnin     +idnout" "xn--xx"
+ 
+   # Fake A-label - the string does not translate to anything.
+@@ -297,7 +297,7 @@ idna_enabled_test() {
+   idna_test "$text" "" "xn--ahahah" "xn--ahahah."
+   idna_test "$text" "+noidnin +noidnout" "xn--ahahah" "xn--ahahah."
+   idna_fail "$text" "+noidnin   +idnout" "xn--ahahah"
+-  idna_fail "$text" "+idnin   +noidnout" "xn--ahahah"
++  idna_test "$text" "+idnin   +noidnout" "xn--ahahah" "xn--ahahah."
+   idna_fail "$text" "+idnin     +idnout" "xn--ahahah"
+ 
+   # Too long a label. The punycode string is too long (at 64 characters).
+@@ -324,7 +324,7 @@ idna_enabled_test() {
+   # The +[no]idnout options should not have any effect on the test.
+ 
+   text="Checking invalid input U-label"
+-  idna_test "$text" "" "√.com" "\226\136\154.com."
++  idna_test "$text" "" "√.com" "xn--19g.com."
+   idna_test "$text" "+noidnin +noidnout" "√.com" "\226\136\154.com."
+   idna_test "$text" "+noidnin +idnout" "√.com" "\226\136\154.com."
+   idna_test "$text" "+idnin   +noidnout" "√.com" "xn--19g.com."
+-- 
+2.51.0
+
diff --git a/bind.spec b/bind.spec
index 56753e1..3741c7a 100644
--- a/bind.spec
+++ b/bind.spec
@@ -86,7 +86,7 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it.
 # Updating just bind will cause freeipa-dns-server package to be uninstallable.
 Version:  9.18.39
-Release:  4%{?dist}
+Release:  5%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -140,6 +140,8 @@ Patch32: bind-9.18-partial-additional-records.patch
 # https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/9723
 # downstream only
 Patch33: bind-9.18-dig-idn-input-always.patch
+# downstream only too
+Patch34: bind-9.18-dig-idn-input-always-test.patch
 
 %{?systemd_ordering}
 # https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers
@@ -927,6 +929,9 @@ fi;
 %endif
 
 %changelog
+* Tue Sep 16 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.39-5
+- Fix failures in idna system test (rhbz#2324186)
+
 * Wed Sep 10 2025 Adam Williamson <awilliam@redhat.com> - 32:9.18.39-4
 - No-change rebuild to fix F43 update
 

From 54750e536007a5b744f7c516b032276f77b12a81 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 3 Oct 2025 15:43:05 +0200
Subject: [PATCH 410/460] Move named.local* and named.empty into
 /usr/share/named

Imagemode might have separate /var partition not properly initialized by
package installation. Add creation of compat files into tmpfiles.d
definition.

Move primary place of those files from /var/named to /usr/shared/named, so we
even have some place to symlink them from. Originally it had only copy
in sample documentation, which may not be installed.

These source file should be read-only from named and not modified
anyway. Move them to /usr/share/named as read-only, always present
sources. Change compat symlinks in /var/named to point to them instead
of /etc.

Make the doc files only symlinks to those files too, have them there
just once.

Keep named.ca config file in /etc/named.ca

The rest can stay in _datadir, but named.ca can be potentially updated
and as such should remain in /etc and its modification kept.

Move primary copy into /etc and keep just legacy symlink inside
/var/named. Configuration should stay working if the file were modified.

Related: RHEL-97443
---
 bind.spec          | 42 ++++++++++++++++++++++++++++++------------
 bind.tmpfiles.d    |  9 +++++++++
 named-chroot.files |  2 ++
 3 files changed, 41 insertions(+), 12 deletions(-)

diff --git a/bind.spec b/bind.spec
index 3741c7a..2a2d029 100644
--- a/bind.spec
+++ b/bind.spec
@@ -41,7 +41,7 @@
 %global        chroot_prefix     %{bind_dir}/chroot
 %global        chroot_create_directories /dev /run/named %{_localstatedir}/{log,named,tmp} \\\
                                          %{_sysconfdir}/{crypto-policies/back-ends,pki/dnssec-keys,named} \\\
-                                         %{_libdir}/bind %{_libdir}/named %{_datadir}/GeoIP /proc/sys/net/ipv4
+                                         %{_libdir}/bind %{_libdir}/named %{_datadir}/{GeoIP,named} /proc/sys/net/ipv4
 
 ## The order of libs is important. See lib/Makefile.in for details
 %define bind_export_libs isc dns isccfg irs
@@ -86,7 +86,7 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it.
 # Updating just bind will cause freeipa-dns-server package to be uninstallable.
 Version:  9.18.39
-Release:  5%{?dist}
+Release:  6%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -636,23 +636,33 @@ touch ${RPM_BUILD_ROOT}%{_sysconfdir}/rndc.{key,conf}
 install -m 644 %{SOURCE27} ${RPM_BUILD_ROOT}%{_sysconfdir}/named.root.key
 install -m 644 %{SOURCE36} ${RPM_BUILD_ROOT}%{_sysconfdir}/trusted-key.key
 mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/named
+install -p -m 644 %{SOURCE17} ${RPM_BUILD_ROOT}%{_sysconfdir}/named.ca
+ln -sr ${RPM_BUILD_ROOT}%{_sysconfdir}/named.ca \
+       ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.ca
+mkdir -p ${RPM_BUILD_ROOT}%{_datadir}/named
+install -p -m 644 %{SOURCE18} ${RPM_BUILD_ROOT}%{_datadir}/named/named.localhost
+install -p -m 644 %{SOURCE19} ${RPM_BUILD_ROOT}%{_datadir}/named/named.loopback
+install -p -m 644 %{SOURCE20} ${RPM_BUILD_ROOT}%{_datadir}/named/named.empty
 
 # data files:
 mkdir -p ${RPM_BUILD_ROOT}%{_localstatedir}/named
-install -m 640 %{SOURCE17} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.ca
-install -m 640 %{SOURCE18} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.localhost
-install -m 640 %{SOURCE19} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.loopback
-install -m 640 %{SOURCE20} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.empty
-install -m 640 %{SOURCE23} ${RPM_BUILD_ROOT}%{_sysconfdir}/named.rfc1912.zones
+for FILE in named.{localhost,loopback,empty}
+do
+  ln -sr "${RPM_BUILD_ROOT}%{_datadir}/named/$FILE" \
+         "${RPM_BUILD_ROOT}%{_localstatedir}/named/$FILE"
+done
+install -p -m 640 %{SOURCE23} ${RPM_BUILD_ROOT}%{_sysconfdir}/named.rfc1912.zones
 
 # sample bind configuration files for %%doc:
 mkdir -p sample/etc sample/var/named/{data,slaves}
 install -m 644 %{SOURCE25} sample/etc/named.conf
-# Copy default configuration to %%doc to make it usable from system-config-bind
+# Copy default configuration to %%doc
 install -m 644 %{SOURCE16} named.conf.default
 install -m 644 %{SOURCE23} sample/etc/named.rfc1912.zones
-install -m 644 %{SOURCE18} %{SOURCE19} %{SOURCE20}  sample/var/named
-install -m 644 %{SOURCE17} sample/var/named/named.ca
+ln -s %{_sysconfdir}/named.ca sample/var/named/named.ca
+for FILE in named.{localhost,loopback,empty}; do
+  ln -s %{_datadir}/named/$FILE sample/var/named/$FILE
+done
 for f in my.internal.zone.db slaves/my.slave.internal.zone.db slaves/my.ddns.internal.zone.db my.external.zone.db; do 
   echo '@ in soa localhost. root 1 3H 15M 1W 1D
   ns localhost.' > sample/var/named/$f; 
@@ -660,10 +670,10 @@ done
 :;
 
 mkdir -p ${RPM_BUILD_ROOT}%{_tmpfilesdir}
-install -m 644 %{SOURCE35} ${RPM_BUILD_ROOT}%{_tmpfilesdir}/named.conf
+install -p -m 644 %{SOURCE35} ${RPM_BUILD_ROOT}%{_tmpfilesdir}/named.conf
 
 mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/rwtab.d
-install -m 644 %{SOURCE43} ${RPM_BUILD_ROOT}%{_sysconfdir}/rwtab.d/named
+install -p -m 644 %{SOURCE43} ${RPM_BUILD_ROOT}%{_sysconfdir}/rwtab.d/named
 
 %post
 %?ldconfig
@@ -755,6 +765,7 @@ fi;
 %dir %{_libdir}/named
 %config(noreplace) %verify(not md5 size mtime) %{_sysconfdir}/sysconfig/named
 %config(noreplace) %attr(0644,root,named) %{_sysconfdir}/named.root.key
+%config(noreplace) %attr(0644,root,named) %{_sysconfdir}/named.ca
 %config(noreplace) %{_sysconfdir}/logrotate.d/named
 %{_tmpfilesdir}/named.conf
 %{_sysconfdir}/rwtab.d/named
@@ -798,7 +809,9 @@ fi;
 %dir %{_localstatedir}/named/dynamic
 %ghost %{_localstatedir}/log/named.log
 %defattr(0640,root,named,0750)
+%{_datadir}/named/
 %config %verify(not link) %{_localstatedir}/named/named.ca
+# Moved to %%_datadir/named, keep compat symlinks
 %config %verify(not link) %{_localstatedir}/named/named.localhost
 %config %verify(not link) %{_localstatedir}/named/named.loopback
 %config %verify(not link) %{_localstatedir}/named/named.empty
@@ -907,6 +920,7 @@ fi;
 %dir %{chroot_prefix}/%{_libdir}
 %dir %{chroot_prefix}/%{_libdir}/bind
 %dir %{chroot_prefix}/%{_datadir}/GeoIP
+%dir %{chroot_prefix}/%{_datadir}/named
 %{chroot_prefix}/proc
 %defattr(0660,root,named,01770)
 %dir %{chroot_prefix}%{_localstatedir}/named
@@ -929,6 +943,10 @@ fi;
 %endif
 
 %changelog
+* Fri Oct 03 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.39-6
+- Move named.* files from /var/named into /usr/share/named
+- Move named.ca into /etc/named.ca
+
 * Tue Sep 16 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.39-5
 - Fix failures in idna system test (rhbz#2324186)
 
diff --git a/bind.tmpfiles.d b/bind.tmpfiles.d
index 640a656..dc0b555 100644
--- a/bind.tmpfiles.d
+++ b/bind.tmpfiles.d
@@ -1 +1,10 @@
+# vim: ft=conf:
 d /run/named 0755 named named -
+d /var/named 01770 root named -
+d /var/named/slaves  0770 named named -
+d /var/named/data    0770 named named -
+d /var/named/dynamic 0770 named named -
+L /var/named/named.ca        0640 named named - ../../../etc/named.ca
+L /var/named/named.localhost 0640 named named - ../../../usr/share/named/named.localhost
+L /var/named/named.loopback  0640 named named - ../../../usr/share/named/named.loopback
+L /var/named/named.empty     0640 named named - ../../../usr/share/named/named.empty
diff --git a/named-chroot.files b/named-chroot.files
index 08c21b2..10f04b6 100644
--- a/named-chroot.files
+++ b/named-chroot.files
@@ -3,6 +3,7 @@
 # if they are missing or empty in target directory.
 /etc/localtime
 /etc/named.root.key
+/etc/named.ca
 /etc/named.conf
 /etc/named.rfc1912.zones
 /etc/rndc.conf
@@ -17,6 +18,7 @@
 /usr/lib64/bind
 /usr/lib/bind
 /usr/share/GeoIP
+/usr/share/named
 /run/named
 /proc/sys/net/ipv4/ip_local_port_range
 # Warning: the order is important

From 666db3a14e01939dcbb331952069db339921039b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 3 Oct 2025 17:18:55 +0200
Subject: [PATCH 411/460] Reference to absolute config names from
 named.rfc1912.zones

Make the reference to primary source in absolute path, rather than
relative to working directory.

Potentially could start using different files than it used before.

Dot not cherry-pick this into stable branches. Could be considered
breaking change, keep it just in rawhide only.
---
 bind.spec           |  5 ++++-
 named.conf          |  2 +-
 named.rfc1912.zones | 11 ++++++-----
 3 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/bind.spec b/bind.spec
index 2a2d029..9e8222a 100644
--- a/bind.spec
+++ b/bind.spec
@@ -86,7 +86,7 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it.
 # Updating just bind will cause freeipa-dns-server package to be uninstallable.
 Version:  9.18.39
-Release:  6%{?dist}
+Release:  7%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -943,6 +943,9 @@ fi;
 %endif
 
 %changelog
+* Fri Oct 10 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.39-7
+- Reference to absolute config names from named.rfc1912.zones
+
 * Fri Oct 03 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.39-6
 - Move named.* files from /var/named into /usr/share/named
 - Move named.ca into /etc/named.ca
diff --git a/named.conf b/named.conf
index c906875..30fb249 100644
--- a/named.conf
+++ b/named.conf
@@ -51,7 +51,7 @@ logging {
 
 zone "." IN {
 	type hint;
-	file "named.ca";
+	file "/etc/named.ca";
 };
 
 include "/etc/named.rfc1912.zones";
diff --git a/named.rfc1912.zones b/named.rfc1912.zones
index 2c3c2a8..d04510d 100644
--- a/named.rfc1912.zones
+++ b/named.rfc1912.zones
@@ -1,4 +1,5 @@
 // named.rfc1912.zones:
+// vim: ft=named:
 //
 // Provided by Red Hat caching-nameserver package 
 //
@@ -16,30 +17,30 @@
 
 zone "localhost.localdomain" IN {
 	type primary;
-	file "named.localhost";
+	file "/usr/share/named/named.localhost";
 	allow-update { none; };
 };
 
 zone "localhost" IN {
 	type primary;
-	file "named.localhost";
+	file "/usr/share/named/named.localhost";
 	allow-update { none; };
 };
 
 zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" IN {
 	type primary;
-	file "named.loopback";
+	file "/usr/share/named/named.loopback";
 	allow-update { none; };
 };
 
 zone "1.0.0.127.in-addr.arpa" IN {
 	type primary;
-	file "named.loopback";
+	file "/usr/share/named/named.loopback";
 	allow-update { none; };
 };
 
 zone "0.in-addr.arpa" IN {
 	type primary;
-	file "named.empty";
+	file "/usr/share/named/named.empty";
 	allow-update { none; };
 };

From 6853a348fc37c57a0e7960f64ee052e2f8a34fe8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 24 Oct 2025 15:15:56 +0200
Subject: [PATCH 412/460] Update to 9.18.41 (rhbz#2405786, CVE-2025-8677
 CVE-2025-40778 CVE-2025-40780)

Security fixes:
- DNSSEC validation fails if matching but invalid DNSKEY is found. (CVE-2025-8677)
- Address various spoofing attacks. (CVE-2025-40778)
- Cache-poisoning due to weak pseudo-random number generator.
  (CVE-2025-40780)

New Features:
- Support for parsing HHIT and BRID records has been added.

Removed Features:
- Deprecate the "tkey-domain" statement.
- Deprecate the "tkey-gssapi-credential" statement.

Bug Fixes:
- Prevent spurious SERVFAILs for certain 0-TTL resource records.
- Missing DNSSEC information when CD bit is set in query.

https://downloads.isc.org/isc/bind9/9.18.41/doc/arm/html/notes.html#notes-for-bind-9-18-41
---
 bind.spec | 7 +++++--
 sources   | 4 ++--
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/bind.spec b/bind.spec
index 9e8222a..62b1925 100644
--- a/bind.spec
+++ b/bind.spec
@@ -85,8 +85,8 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 #
 # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it.
 # Updating just bind will cause freeipa-dns-server package to be uninstallable.
-Version:  9.18.39
-Release:  7%{?dist}
+Version:  9.18.41
+Release:  1%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -943,6 +943,9 @@ fi;
 %endif
 
 %changelog
+* Fri Oct 24 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.41-1
+- Update to 9.18.41 (rhbz#2405786, CVE-2025-8677 CVE-2025-40778 CVE-2025-40780)
+
 * Fri Oct 10 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.39-7
 - Reference to absolute config names from named.rfc1912.zones
 
diff --git a/sources b/sources
index aa55f1d..df9609f 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.18.39.tar.xz) = fd6d45c9cb9c599d8770c18801fad2f177faf3a8af82948800d186ae6dc9eb2c894b61802def0841eb722c615c93c077b55368204f0cf2737a3c50d949efca07
-SHA512 (bind-9.18.39.tar.xz.asc) = 17e8aad74f1eaa42119f84ab3df05e85a1775f97c628259e00f7224d4f0d250050d022db670bc036b0ba05a3cd586de331da0b77c42ab58307711fed36c7ee9e
+SHA512 (bind-9.18.41.tar.xz) = aba4a0add07f1feb2825852faeed14bc946628b818adac93401890cd67ead17c2fd8d820bca70ba7f8c2788dc65195baccc93f87249fb7e47077354341ff0839
+SHA512 (bind-9.18.41.tar.xz.asc) = 5b5a2f969e6da6a64908dba7f94f9877ce2d729e59c3b9c23fa3459cc74059b10479df63b3223c738b4fbfecde5e51dd9906fb34e6763c0b5909dda195afb71b

From d7ce29383b5197319a9d7154ae315dc1fd271034 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 31 Oct 2025 17:47:07 +0100
Subject: [PATCH 413/460] Fix regression in upstream CVE-2025-8677 fix

https://gitlab.isc.org/isc-projects/bind9/-/issues/5570

Related: rhbz#2405830
---
 bind-9.20-CVE-2025-8677-dual-signing.patch | 36 ++++++++++++++++++++++
 bind.spec                                  |  7 ++++-
 2 files changed, 42 insertions(+), 1 deletion(-)
 create mode 100644 bind-9.20-CVE-2025-8677-dual-signing.patch

diff --git a/bind-9.20-CVE-2025-8677-dual-signing.patch b/bind-9.20-CVE-2025-8677-dual-signing.patch
new file mode 100644
index 0000000..40ad87e
--- /dev/null
+++ b/bind-9.20-CVE-2025-8677-dual-signing.patch
@@ -0,0 +1,36 @@
+From 5126c74ec19f56294cbfdc312f75778d8f249e59 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
+Date: Mon, 3 Nov 2025 22:03:54 +0100
+Subject: [PATCH] Do not abort key search on unsupported algorithm
+
+When supported and unsupported algorithm rrsig is present, some keys may
+return unsupported algorithm error. Continue to next key without
+counting this to validation failures.
+
+(cherry picked from commit 38ddff3336e08983a4c0b5f3ea4eb35bb0f6ac81)
+---
+ lib/dns/validator.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/lib/dns/validator.c b/lib/dns/validator.c
+index 15e177e4d7..a9db844c27 100644
+--- a/lib/dns/validator.c
++++ b/lib/dns/validator.c
+@@ -1163,7 +1163,13 @@ select_signing_key(dns_validator_t *val, dns_rdataset_t *rdataset) {
+ 				goto done;
+ 			}
+ 			dst_key_free(&val->key);
+-		} else {
++		} else if (result != DST_R_UNSUPPORTEDALG) {
++			/* Unsupported alg happens when RRset is signed by both
++			 * supported and unsupported alg. */
++			validator_log(val, ISC_LOG_DEBUG(3),
++				      "select_signing_key alg %d keyid %d: %s",
++				      siginfo->algorithm, siginfo->keyid,
++				      isc_result_totext(result));
+ 			break;
+ 		}
+ 		dns_rdata_reset(&rdata);
+-- 
+2.51.1
+
diff --git a/bind.spec b/bind.spec
index 62b1925..793cad2 100644
--- a/bind.spec
+++ b/bind.spec
@@ -86,7 +86,7 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it.
 # Updating just bind will cause freeipa-dns-server package to be uninstallable.
 Version:  9.18.41
-Release:  1%{?dist}
+Release:  2%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -142,6 +142,8 @@ Patch32: bind-9.18-partial-additional-records.patch
 Patch33: bind-9.18-dig-idn-input-always.patch
 # downstream only too
 Patch34: bind-9.18-dig-idn-input-always-test.patch
+# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/11194
+Patch35: bind-9.20-CVE-2025-8677-dual-signing.patch
 
 %{?systemd_ordering}
 # https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers
@@ -943,6 +945,9 @@ fi;
 %endif
 
 %changelog
+* Fri Oct 31 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.41-2
+- Fix upstream reported regression in recent CVE fix (CVE-2025-8677)
+
 * Fri Oct 24 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.41-1
 - Update to 9.18.41 (rhbz#2405786, CVE-2025-8677 CVE-2025-40778 CVE-2025-40780)
 

From 9f78615eb41d60ffa2bda4b7fecf979e5f45a43c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 4 Nov 2025 14:24:41 +0100
Subject: [PATCH 414/460] Add test case into dnssec system test for new
 regression

https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/11195

Related: rhbz#2405830
---
 ...9.20-CVE-2025-8677-dual-signing-test.patch | 172 ++++++++++++++++++
 bind.spec                                     |   3 +
 2 files changed, 175 insertions(+)
 create mode 100644 bind-9.20-CVE-2025-8677-dual-signing-test.patch

diff --git a/bind-9.20-CVE-2025-8677-dual-signing-test.patch b/bind-9.20-CVE-2025-8677-dual-signing-test.patch
new file mode 100644
index 0000000..19740a2
--- /dev/null
+++ b/bind-9.20-CVE-2025-8677-dual-signing-test.patch
@@ -0,0 +1,172 @@
+From 1cbe670c421ca866fe8cbde661801e89e254a46d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
+Date: Sat, 1 Nov 2025 12:00:59 +0100
+Subject: [PATCH] Add a system test with one good and one bad algorithm
+
+The case where there would be one supported algorithm and one already
+unsupported (like RSAMD5 or RSASHA1) was missing.
+
+(cherry picked from commit 3aa6f585e0466700e5d4b64fffccf883bb1c21dd)
+---
+ bin/tests/system/dnssec/ns2/example.db.in  |  4 +++
+ bin/tests/system/dnssec/ns2/sign.sh        |  3 ++-
+ bin/tests/system/dnssec/ns3/named.conf.in  |  6 +++++
+ bin/tests/system/dnssec/ns3/sign.sh        | 31 ++++++++++++++++++++++
+ bin/tests/system/dnssec/ns3/template.db.in | 27 +++++++++++++++++++
+ bin/tests/system/dnssec/tests.sh           | 11 ++++++++
+ bin/tests/system/dnssec/tests_sh_dnssec.py |  1 +
+ 7 files changed, 82 insertions(+), 1 deletion(-)
+ create mode 100644 bin/tests/system/dnssec/ns3/template.db.in
+
+diff --git a/bin/tests/system/dnssec/ns2/example.db.in b/bin/tests/system/dnssec/ns2/example.db.in
+index f711f5823f..63d41e5e00 100644
+--- a/bin/tests/system/dnssec/ns2/example.db.in
++++ b/bin/tests/system/dnssec/ns2/example.db.in
+@@ -168,4 +168,8 @@ ns.managed-future	A	10.53.0.3
+ revkey			NS	ns.revkey
+ ns.revkey		A	10.53.0.3
+ 
++; A secure subdomain with extra bad key
++extrabadkey		NS	ns3.extrabadkey
++ns3.extrabadkey		A	10.53.0.3
++
+ dname-at-apex-nsec3	NS	ns3
+diff --git a/bin/tests/system/dnssec/ns2/sign.sh b/bin/tests/system/dnssec/ns2/sign.sh
+index b60e82a631..eb008067a4 100644
+--- a/bin/tests/system/dnssec/ns2/sign.sh
++++ b/bin/tests/system/dnssec/ns2/sign.sh
+@@ -62,7 +62,8 @@ for subdomain in secure badds bogus dynamic keyless nsec3 optout \
+   ttlpatch split-dnssec split-smart expired expiring upper lower \
+   dnskey-unknown dnskey-unsupported dnskey-unsupported-2 \
+   dnskey-nsec3-unknown managed-future revkey \
+-  dname-at-apex-nsec3 occluded; do
++  dname-at-apex-nsec3 occluded rsasha1 rsasha1-1024 \
++  extrabadkey; do
+   cp "../ns3/dsset-$subdomain.example." .
+ done
+ 
+diff --git a/bin/tests/system/dnssec/ns3/named.conf.in b/bin/tests/system/dnssec/ns3/named.conf.in
+index 680cff58d5..3536046319 100644
+--- a/bin/tests/system/dnssec/ns3/named.conf.in
++++ b/bin/tests/system/dnssec/ns3/named.conf.in
+@@ -84,6 +84,12 @@ zone "insecure2.example" {
+ 	allow-update { any; };
+ };
+ 
++zone "extrabadkey.example" {
++	type primary;
++	file "extrabadkey.example.db.signed";
++	allow-update { any; };
++};
++
+ zone "insecure.nsec3.example" {
+ 	type primary;
+ 	file "insecure.nsec3.example.db";
+diff --git a/bin/tests/system/dnssec/ns3/sign.sh b/bin/tests/system/dnssec/ns3/sign.sh
+index 14fc709bfb..743a0e4121 100644
+--- a/bin/tests/system/dnssec/ns3/sign.sh
++++ b/bin/tests/system/dnssec/ns3/sign.sh
+@@ -673,3 +673,34 @@ $DSFROMKEY "$dnskeyname.key" >"dsset-delegation.${zone}."
+ cat "$infile" "${kskname}.key" "${zskname}.key" "${keyname}.key" \
+   "${dnskeyname}.key" "dsset-delegation.${zone}." >"$zonefile"
+ "$SIGNER" -P -o "$zone" "$zonefile" >/dev/null
++
++#
++#
++#
++zone=extrabadkey.example.
++infile=template.db.in
++zonefile=extrabadkey.example.db
++
++# Add KSK and ZSK that we will mangle to RSAMD5
++ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
++zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
++cat "$infile" "$ksk.key" "$zsk.key" > "$zonefile"
++"$SIGNER" -g -O full -o "$zone" "$zonefile" >/dev/null 2>&1
++
++# Mangle the signatures to RSAMD5 and save them for future use
++sed -ne "s/\(IN[[:space:]]*RRSIG[[:space:]]*[A-Z]*\) $DEFAULT_ALGORITHM_NUMBER /\1 1 /p" < "$zonefile.signed" > "$zonefile.signed.rsamd5"
++
++# Now add normal KSK and ZSK to the zone file
++ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
++zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
++cat "$infile" "$ksk.key" "$zsk.key" > "$zonefile"
++
++# Mangle the DNSKEY algorithm numbers and add them to the signed zone file
++cat "$ksk.key" "$zsk.key" | sed -e "s/\(IN[[:space:]]*DNSKEY[[:space:]]*[0-9]* 3\) $DEFAULT_ALGORITHM_NUMBER /\1 1 /" >> "$zonefile"
++
++# Sign normally
++"$SIGNER" -g -o "$zone" "$zonefile" >/dev/null 2>&1
++
++# Add the mangled signatures to signed zone file
++cat "$zonefile.signed.rsamd5" >> "$zonefile.signed"
++rm "$zonefile.signed.rsamd5"
+diff --git a/bin/tests/system/dnssec/ns3/template.db.in b/bin/tests/system/dnssec/ns3/template.db.in
+new file mode 100644
+index 0000000000..f603e448ff
+--- /dev/null
++++ b/bin/tests/system/dnssec/ns3/template.db.in
+@@ -0,0 +1,27 @@
++; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
++;
++; SPDX-License-Identifier: MPL-2.0
++;
++; This Source Code Form is subject to the terms of the Mozilla Public
++; License, v. 2.0.  If a copy of the MPL was not distributed with this
++; file, you can obtain one at https://mozilla.org/MPL/2.0/.
++;
++; See the COPYRIGHT file distributed with this work for additional
++; information regarding copyright ownership.
++
++$TTL 300	; 5 minutes
++@			IN SOA	mname1. . (
++				2000042407 ; serial
++				20         ; refresh (20 seconds)
++				20         ; retry (20 seconds)
++				1814400    ; expire (3 weeks)
++				3600       ; minimum (1 hour)
++				)
++			NS	ns3
++ns3			A	10.53.0.3
++
++a			A	10.0.0.1
++a.b			A	10.0.0.1
++b			A	10.0.0.2
++d			A	10.0.0.4
++z			A	10.0.0.26
+diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh
+index b58b11a5c7..d3690eee6b 100644
+--- a/bin/tests/system/dnssec/tests.sh
++++ b/bin/tests/system/dnssec/tests.sh
+@@ -4497,5 +4497,16 @@ n=$((n + 1))
+ if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
+ status=$((status + ret))
+ 
++echo_i "checking extra-bad-algorithm positive validation ($n)"
++ret=0
++dig_with_opts +noauth a.extrabadkey.example. @10.53.0.3 A >dig.out.ns3.test$n || ret=1
++dig_with_opts +noauth a.extrabadkey.example. @10.53.0.4 A >dig.out.ns4.test$n || ret=1
++digcomp --lc dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
++grep "status: NOERROR" dig.out.ns4.test$n >/dev/null || ret=1
++grep "flags:.*ad.*QUERY" dig.out.ns4.test$n >/dev/null || ret=1
++n=$((n + 1))
++test "$ret" -eq 0 || echo_i "failed"
++status=$((status + ret))
++
+ echo_i "exit status: $status"
+ [ $status -eq 0 ] || exit 1
+diff --git a/bin/tests/system/dnssec/tests_sh_dnssec.py b/bin/tests/system/dnssec/tests_sh_dnssec.py
+index 529a4a0e10..f731ea2ab4 100644
+--- a/bin/tests/system/dnssec/tests_sh_dnssec.py
++++ b/bin/tests/system/dnssec/tests_sh_dnssec.py
+@@ -92,6 +92,7 @@ pytestmark = pytest.mark.extra_artifacts(
+         "ns3/example.bk",
+         "ns3/expired.example.db",
+         "ns3/expiring.example.db",
++        "ns3/extrabadkey.example.db",
+         "ns3/future.example.db",
+         "ns3/keyless.example.db",
+         "ns3/kskonly.example.db",
+-- 
+2.51.1
+
diff --git a/bind.spec b/bind.spec
index 793cad2..9079b37 100644
--- a/bind.spec
+++ b/bind.spec
@@ -144,6 +144,8 @@ Patch33: bind-9.18-dig-idn-input-always.patch
 Patch34: bind-9.18-dig-idn-input-always-test.patch
 # https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/11194
 Patch35: bind-9.20-CVE-2025-8677-dual-signing.patch
+# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/11195
+Patch36: bind-9.20-CVE-2025-8677-dual-signing-test.patch
 
 %{?systemd_ordering}
 # https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers
@@ -947,6 +949,7 @@ fi;
 %changelog
 * Fri Oct 31 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.41-2
 - Fix upstream reported regression in recent CVE fix (CVE-2025-8677)
+- Add upstream dnssec system test testcase for this problem
 
 * Fri Oct 24 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.41-1
 - Update to 9.18.41 (rhbz#2405786, CVE-2025-8677 CVE-2025-40778 CVE-2025-40780)

From aef7570bb8ae32ef253dd27a3ee7818bdf8cd853 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 17 Dec 2025 19:05:30 +0100
Subject: [PATCH 415/460] Update to 9.18.43 (rhbz#2415842)

Bug fixes:

- Adding NSEC3 opt-out records could leave invalid records in chain.
- AMTRELAY type 0 presentation format handling was wrong.

Release 9.18.42 bug fixes:

- Skip unsupported algorithms when looking for a signing key.

https://downloads.isc.org/isc/bind9/9.18.43/doc/arm/html/notes.html#notes-for-bind-9-18-43
---
 bind-9.18-pkcs11-provider.patch               | 139 +++++----
 ...9.20-CVE-2025-8677-dual-signing-test.patch | 172 -----------
 bind-9.20-CVE-2025-8677-dual-signing.patch    |  36 ---
 bind-9.20-nsupdate-tls.patch                  | 272 ++----------------
 bind.spec                                     |  11 +-
 sources                                       |   4 +-
 6 files changed, 100 insertions(+), 534 deletions(-)
 delete mode 100644 bind-9.20-CVE-2025-8677-dual-signing-test.patch
 delete mode 100644 bind-9.20-CVE-2025-8677-dual-signing.patch

diff --git a/bind-9.18-pkcs11-provider.patch b/bind-9.18-pkcs11-provider.patch
index 4a48182..57463b0 100644
--- a/bind-9.18-pkcs11-provider.patch
+++ b/bind-9.18-pkcs11-provider.patch
@@ -1,4 +1,4 @@
-From ec38a39feabea02eb75f257e8b81cf16aac9d184 Mon Sep 17 00:00:00 2001
+From 5bd1369eb7781ad2b349b99f783a7ed07fb7d6ac Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 13 Feb 2025 13:20:28 +0100
 Subject: [PATCH] Backport OpenSSL 3 provider support
@@ -37,13 +37,13 @@ Move RSA bits check to legacy, let it use rsa_check for newer
 rsabigexponent tests got broken by this change.
 ---
  lib/dns/dst_openssl.h       |   4 +
- lib/dns/dst_parse.c         |  21 ++--
- lib/dns/openssl_link.c      | 161 ++++++++++++++++++++++++++----
+ lib/dns/dst_parse.c         |  21 ++---
+ lib/dns/openssl_link.c      | 161 +++++++++++++++++++++++++++-----
  lib/dns/openssldh_link.c    |   5 +
- lib/dns/opensslecdsa_link.c | 110 ++++++++++-----------
+ lib/dns/opensslecdsa_link.c | 109 +++++++++++-----------
  lib/dns/openssleddsa_link.c |  40 +++-----
- lib/dns/opensslrsa_link.c   | 189 +++++++++++++++---------------------
- 7 files changed, 303 insertions(+), 227 deletions(-)
+ lib/dns/opensslrsa_link.c   | 181 ++++++++++++++----------------------
+ 7 files changed, 296 insertions(+), 225 deletions(-)
 
 diff --git a/lib/dns/dst_openssl.h b/lib/dns/dst_openssl.h
 index 819af0f..cd386c0 100644
@@ -59,7 +59,7 @@ index 819af0f..cd386c0 100644
 +
  ISC_LANG_ENDDECLS
 diff --git a/lib/dns/dst_parse.c b/lib/dns/dst_parse.c
-index d5ea0e4..addb65e 100644
+index a353b86..7f3fe51 100644
 --- a/lib/dns/dst_parse.c
 +++ b/lib/dns/dst_parse.c
 @@ -195,10 +195,9 @@ check_rsa(const dst_private_t *priv, bool external) {
@@ -106,7 +106,7 @@ index d5ea0e4..addb65e 100644
  }
  
 diff --git a/lib/dns/openssl_link.c b/lib/dns/openssl_link.c
-index e3a89f4..62077b6 100644
+index e3a89f4..2495be4 100644
 --- a/lib/dns/openssl_link.c
 +++ b/lib/dns/openssl_link.c
 @@ -44,6 +44,9 @@
@@ -125,8 +125,8 @@ index e3a89f4..62077b6 100644
  
 +#define DST_RET(a)        \
 +	{                 \
-+		ret = a;  \
-+		goto err; \
++		result = a;  \
++		goto cleanup; \
 +	}
 +
  static void
@@ -200,7 +200,7 @@ index e3a89f4..62077b6 100644
 +			      const char *label,
 +			      EVP_PKEY **ppub, EVP_PKEY **ppriv) {
 +#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000
-+	isc_result_t ret = ISC_R_SUCCESS;
++	isc_result_t result = ISC_R_SUCCESS;
 +	ENGINE *e = NULL;
 +	EVP_PKEY *pkey = NULL, *pubpkey = NULL;
 +
@@ -229,8 +229,8 @@ index e3a89f4..62077b6 100644
 +	}
 +	*ppub = pubpkey;
 +	*ppriv = pkey;
-+err:
-+	return ret;
++cleanup:
++	return result;
 +#else
 +	UNUSED(key_base_id);
 +	UNUSED(engine);
@@ -247,7 +247,7 @@ index e3a89f4..62077b6 100644
 +				EVP_PKEY **ppub, EVP_PKEY **ppriv) {
 +	UNUSED(pin);
 +#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-+	isc_result_t ret = DST_R_OPENSSLFAILURE;
++	isc_result_t result = DST_R_OPENSSLFAILURE;
 +	OSSL_STORE_CTX *ctx = NULL;
 +
 +
@@ -285,11 +285,11 @@ index e3a89f4..62077b6 100644
 +		OSSL_STORE_INFO_free(info);
 +	}
 +	if (*ppriv != NULL && *ppub != NULL) {
-+		ret = ISC_R_SUCCESS;
++		result = ISC_R_SUCCESS;
 +	}
-+err:
++cleanup:
 +	OSSL_STORE_close(ctx);
-+	return (ret);
++	return result;
 +#else
 +	UNUSED(key_base_id);
 +	UNUSED(label);
@@ -329,7 +329,7 @@ index a4ba0f7..38345e6 100644
  	DH *dh = key->keydata.dh;
  	const BIGNUM *priv_key = NULL;
 diff --git a/lib/dns/opensslecdsa_link.c b/lib/dns/opensslecdsa_link.c
-index ca12bb5..5d07014 100644
+index af45fdc..8b49b5d 100644
 --- a/lib/dns/opensslecdsa_link.c
 +++ b/lib/dns/opensslecdsa_link.c
 @@ -617,6 +617,12 @@ opensslecdsa_isprivate(const dst_key_t *key) {
@@ -345,7 +345,7 @@ index ca12bb5..5d07014 100644
  #if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
  	eckey = EVP_PKEY_get1_EC_KEY(pkey);
  
-@@ -916,7 +922,7 @@ err:
+@@ -916,7 +922,7 @@ cleanup:
  
  #if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
  static isc_result_t
@@ -361,7 +361,7 @@ index ca12bb5..5d07014 100644
 +
 +static isc_result_t
 +ecdsa_check(EVP_PKEY **pkey, EVP_PKEY *pubpkey, int group_nid) {
-+	isc_result_t ret = ISC_R_FAILURE;
++	isc_result_t result = ISC_R_FAILURE;
 +	EC_KEY *eckey;
 +	EC_KEY *pubeckey;
 +
@@ -381,21 +381,21 @@ index ca12bb5..5d07014 100644
 +		DST_RET(DST_R_INVALIDPUBLICKEY);
 +	}
 +
-+	ret = ecdsa_check_legacy(eckey, pubeckey);
-+err:
++	CHECK(ecdsa_check_legacy(eckey, pubeckey));
++cleanup:
 +	if (pubeckey != NULL) {
 +		EC_KEY_free(pubeckey);
 +	}
 +	if (eckey != NULL) {
 +		EC_KEY_free(eckey);
 +	}
-+	return ret;
++	return result;
 +}
  #else
  static isc_result_t
 -ecdsa_check(EVP_PKEY **pkey, EVP_PKEY *pubpkey) {
 +ecdsa_check(EVP_PKEY **pkey, EVP_PKEY *pubpkey, int group_nid) {
- 	isc_result_t ret = ISC_R_FAILURE;
+ 	isc_result_t result = ISC_R_FAILURE;
  	int status;
  	size_t pkey_len = 0;
 @@ -954,6 +993,8 @@ ecdsa_check(EVP_PKEY **pkey, EVP_PKEY *pubpkey) {
@@ -407,7 +407,7 @@ index ca12bb5..5d07014 100644
  	/* Check if `pkey` has a public key. */
  	status = EVP_PKEY_get_octet_string_param(*pkey, OSSL_PKEY_PARAM_PUB_KEY,
  						 NULL, 0, &pkey_len);
-@@ -1279,7 +1320,7 @@ opensslecdsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
+@@ -1267,7 +1308,7 @@ opensslecdsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
  		pubeckey = EVP_PKEY_get1_EC_KEY(pub->keydata.pkey);
  	}
  
@@ -416,7 +416,7 @@ index ca12bb5..5d07014 100644
  		DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
  	}
  
-@@ -1288,7 +1329,7 @@ opensslecdsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
+@@ -1276,7 +1317,7 @@ opensslecdsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
  	}
  #else
  	if (ecdsa_check(&key->keydata.pkey,
@@ -425,19 +425,19 @@ index ca12bb5..5d07014 100644
  	    ISC_R_SUCCESS)
  	{
  		DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
-@@ -1321,11 +1362,7 @@ err:
+@@ -1309,11 +1350,7 @@ cleanup:
  static isc_result_t
  opensslecdsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
  		       const char *pin) {
 -#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000
- 	isc_result_t ret = ISC_R_SUCCESS;
+ 	isc_result_t result = ISC_R_SUCCESS;
 -	ENGINE *e;
 -	EC_KEY *eckey = NULL;
 -	EC_KEY *pubeckey = NULL;
  	int group_nid;
  	EVP_PKEY *pkey = NULL;
  	EVP_PKEY *pubpkey = NULL;
-@@ -1335,13 +1372,9 @@ opensslecdsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
+@@ -1323,13 +1360,9 @@ opensslecdsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
  
  	UNUSED(pin);
  
@@ -452,7 +452,7 @@ index ca12bb5..5d07014 100644
  
  	if (key->key_alg == DST_ALG_ECDSA256) {
  		group_nid = NID_X9_62_prime256v1;
-@@ -1349,48 +1382,30 @@ opensslecdsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
+@@ -1337,48 +1370,27 @@ opensslecdsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
  		group_nid = NID_secp384r1;
  	}
  
@@ -461,11 +461,9 @@ index ca12bb5..5d07014 100644
 -	if (pkey == NULL) {
 -		DST_RET(dst__openssl_toresult2("ENGINE_load_private_key",
 -					       DST_R_OPENSSLFAILURE));
-+	ret = dst__openssl_fromlabel(EVP_PKEY_EC, engine, label, pin,
-+				       &pubpkey, &pkey);
-+	if (ret != ISC_R_SUCCESS) {
-+		goto err;
- 	}
+-	}
++	CHECK(dst__openssl_fromlabel(EVP_PKEY_EC, engine, label, pin,
++				       &pubpkey, &pkey));
 +
  	/* Check base id, group nid */
  	if (EVP_PKEY_base_id(pkey) != EVP_PKEY_EC) {
@@ -511,7 +509,7 @@ index ca12bb5..5d07014 100644
  	key->key_size = EVP_PKEY_bits(pkey);
  	key->keydata.pkey = pkey;
  	pkey = NULL;
-@@ -1402,21 +1417,8 @@ err:
+@@ -1390,21 +1402,8 @@ cleanup:
  	if (pkey != NULL) {
  		EVP_PKEY_free(pkey);
  	}
@@ -522,7 +520,7 @@ index ca12bb5..5d07014 100644
 -		EC_KEY_free(eckey);
 -	}
  
- 	return ret;
+ 	return result;
 -#else
 -	UNUSED(key);
 -	UNUSED(engine);
@@ -534,10 +532,10 @@ index ca12bb5..5d07014 100644
  
  static dst_func_t opensslecdsa_functions = {
 diff --git a/lib/dns/openssleddsa_link.c b/lib/dns/openssleddsa_link.c
-index 74dac17..04457fb 100644
+index 6301db4..08d505b 100644
 --- a/lib/dns/openssleddsa_link.c
 +++ b/lib/dns/openssleddsa_link.c
-@@ -361,6 +361,12 @@ openssleddsa_isprivate(const dst_key_t *key) {
+@@ -362,6 +362,12 @@ openssleddsa_isprivate(const dst_key_t *key) {
  		return false;
  	}
  
@@ -550,17 +548,17 @@ index 74dac17..04457fb 100644
  	/* Must have a buffer to actually check if there is a private key. */
  	if (EVP_PKEY_get_raw_private_key(pkey, buf, &len) == 1) {
  		return true;
-@@ -603,9 +609,7 @@ err:
+@@ -591,9 +597,7 @@ cleanup:
  static isc_result_t
  openssleddsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
  		       const char *pin) {
 -#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000
- 	isc_result_t ret;
+ 	isc_result_t result;
 -	ENGINE *e;
  	EVP_PKEY *pkey = NULL, *pubpkey = NULL;
  	int baseid = EVP_PKEY_NONE;
  
-@@ -628,28 +632,17 @@ openssleddsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
+@@ -616,28 +620,17 @@ openssleddsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
  		return ISC_R_NOTIMPLEMENTED;
  	}
  
@@ -596,10 +594,10 @@ index 74dac17..04457fb 100644
  	key->label = isc_mem_strdup(key->mctx, label);
  	key->key_size = EVP_PKEY_bits(pkey);
  	key->keydata.pkey = pkey;
-@@ -664,13 +657,6 @@ err:
+@@ -652,13 +645,6 @@ cleanup:
  		EVP_PKEY_free(pkey);
  	}
- 	return ret;
+ 	return result;
 -#else  /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */
 -	UNUSED(key);
 -	UNUSED(engine);
@@ -611,7 +609,7 @@ index 74dac17..04457fb 100644
  
  static dst_func_t openssleddsa_functions = {
 diff --git a/lib/dns/opensslrsa_link.c b/lib/dns/opensslrsa_link.c
-index 37e8a63..d4fbe97 100644
+index b92e1bf..12210e8 100644
 --- a/lib/dns/opensslrsa_link.c
 +++ b/lib/dns/opensslrsa_link.c
 @@ -545,6 +545,12 @@ opensslrsa_isprivate(const dst_key_t *key) {
@@ -627,7 +625,7 @@ index 37e8a63..d4fbe97 100644
  #if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
  	rsa = EVP_PKEY_get1_RSA(pkey);
  	INSIST(rsa != NULL);
-@@ -995,7 +1001,7 @@ err:
+@@ -995,7 +1001,7 @@ cleanup:
  
  #if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
  static isc_result_t
@@ -694,7 +692,7 @@ index 37e8a63..d4fbe97 100644
  	if (EVP_PKEY_eq(pkey, pubpkey) == 1) {
  		DST_RET(ISC_R_SUCCESS);
  	}
-@@ -1119,6 +1169,10 @@ err:
+@@ -1119,6 +1169,10 @@ cleanup:
  }
  #endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
  
@@ -719,7 +717,7 @@ index 37e8a63..d4fbe97 100644
  	const char *label = NULL;
  	EVP_PKEY *pkey = NULL;
  	BIGNUM *n = NULL, *e = NULL, *d = NULL;
-@@ -1193,46 +1243,7 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
+@@ -1190,46 +1240,7 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
  	 * See if we can fetch it.
  	 */
  	if (label != NULL) {
@@ -767,7 +765,7 @@ index 37e8a63..d4fbe97 100644
  	}
  
  	for (i = 0; i < priv.nelements; i++) {
-@@ -1321,9 +1332,14 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
+@@ -1318,9 +1329,14 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
  			BN_clear_free(iqmp);
  		}
  	}
@@ -783,7 +781,7 @@ index 37e8a63..d4fbe97 100644
  #else
  	bld = OSSL_PARAM_BLD_new();
  	if (bld == NULL) {
-@@ -1390,17 +1406,12 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
+@@ -1387,17 +1403,9 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
  		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
  	}
  
@@ -791,10 +789,8 @@ index 37e8a63..d4fbe97 100644
 -	    ISC_R_SUCCESS)
 -	{
 -		DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
-+	ret = rsa_check(pkey, pub != NULL ? pub->keydata.pkey : NULL);
-+	if (ret != ISC_R_SUCCESS) {
-+		DST_RET(ret);
- 	}
+-	}
++	CHECK(rsa_check(pkey, pub != NULL ? pub->keydata.pkey : NULL));
  #endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
  
 -	if (BN_num_bits(e) > RSA_MAX_PUBEXP_BITS) {
@@ -804,13 +800,13 @@ index 37e8a63..d4fbe97 100644
  	key->key_size = BN_num_bits(n);
  	key->keydata.pkey = pkey;
  	pkey = NULL;
-@@ -1464,69 +1475,30 @@ err:
+@@ -1461,69 +1469,31 @@ cleanup:
  static isc_result_t
  opensslrsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
  		     const char *pin) {
 -#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000
 -	ENGINE *e = NULL;
- 	isc_result_t ret = ISC_R_SUCCESS;
+ 	isc_result_t result = ISC_R_SUCCESS;
  	EVP_PKEY *pkey = NULL, *pubpkey = NULL;
 -	RSA *rsa = NULL, *pubrsa = NULL;
 -	const BIGNUM *ex = NULL;
@@ -824,7 +820,10 @@ index 37e8a63..d4fbe97 100644
 -	if (e == NULL) {
 -		DST_RET(dst__openssl_toresult(DST_R_NOENGINE));
 -	}
--
++	CHECK(dst__openssl_fromlabel(EVP_PKEY_RSA, engine, label, pin,
++				       &pubpkey, &pkey));
++	CHECK(rsa_check(pkey, pubpkey));
+ 
 -	pubpkey = ENGINE_load_public_key(e, label, NULL, NULL);
 -	if (pubpkey == NULL) {
 -		DST_RET(dst__openssl_toresult2("ENGINE_load_public_key",
@@ -834,19 +833,13 @@ index 37e8a63..d4fbe97 100644
 -	if (pubrsa == NULL) {
 -		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
 -	}
-+	ret = dst__openssl_fromlabel(EVP_PKEY_RSA, engine, label, pin,
-+				       &pubpkey, &pkey);
-+	if (ret != ISC_R_SUCCESS)
-+		DST_RET(ret);
- 
+-
 -	pkey = ENGINE_load_private_key(e, label, NULL, NULL);
--	if (pkey == NULL) {
+ 	if (pkey == NULL) {
 -		DST_RET(dst__openssl_toresult2("ENGINE_load_private_key",
--					       DST_R_OPENSSLFAILURE));
--	}
-+	ret = rsa_check(pkey, pubpkey);
-+	if (ret != ISC_R_SUCCESS)
-+		DST_RET(ret);
++		DST_RET(dst__openssl_toresult2("dst__openssl_fromlabel",
+ 					       DST_R_OPENSSLFAILURE));
+ 	}
  
 -	key->engine = isc_mem_strdup(key->mctx, engine);
 +	if (engine != NULL)
@@ -854,7 +847,7 @@ index 37e8a63..d4fbe97 100644
 +	else
 +		key->engine = NULL;
  	key->label = isc_mem_strdup(key->mctx, label);
--
+ 
 -	rsa = EVP_PKEY_get1_RSA(pkey);
 -	if (rsa == NULL) {
 -		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
@@ -875,7 +868,7 @@ index 37e8a63..d4fbe97 100644
  	key->keydata.pkey = pkey;
  	pkey = NULL;
  
- err:
+ cleanup:
 -	if (rsa != NULL) {
 -		RSA_free(rsa);
 -	}
@@ -885,10 +878,10 @@ index 37e8a63..d4fbe97 100644
  	if (pkey != NULL) {
  		EVP_PKEY_free(pkey);
  	}
-@@ -1534,13 +1506,6 @@ err:
+@@ -1531,13 +1501,6 @@ cleanup:
  		EVP_PKEY_free(pubpkey);
  	}
- 	return ret;
+ 	return result;
 -#else  /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */
 -	UNUSED(key);
 -	UNUSED(engine);
@@ -900,5 +893,5 @@ index 37e8a63..d4fbe97 100644
  
  static dst_func_t opensslrsa_functions = {
 -- 
-2.50.1
+2.52.0
 
diff --git a/bind-9.20-CVE-2025-8677-dual-signing-test.patch b/bind-9.20-CVE-2025-8677-dual-signing-test.patch
deleted file mode 100644
index 19740a2..0000000
--- a/bind-9.20-CVE-2025-8677-dual-signing-test.patch
+++ /dev/null
@@ -1,172 +0,0 @@
-From 1cbe670c421ca866fe8cbde661801e89e254a46d Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
-Date: Sat, 1 Nov 2025 12:00:59 +0100
-Subject: [PATCH] Add a system test with one good and one bad algorithm
-
-The case where there would be one supported algorithm and one already
-unsupported (like RSAMD5 or RSASHA1) was missing.
-
-(cherry picked from commit 3aa6f585e0466700e5d4b64fffccf883bb1c21dd)
----
- bin/tests/system/dnssec/ns2/example.db.in  |  4 +++
- bin/tests/system/dnssec/ns2/sign.sh        |  3 ++-
- bin/tests/system/dnssec/ns3/named.conf.in  |  6 +++++
- bin/tests/system/dnssec/ns3/sign.sh        | 31 ++++++++++++++++++++++
- bin/tests/system/dnssec/ns3/template.db.in | 27 +++++++++++++++++++
- bin/tests/system/dnssec/tests.sh           | 11 ++++++++
- bin/tests/system/dnssec/tests_sh_dnssec.py |  1 +
- 7 files changed, 82 insertions(+), 1 deletion(-)
- create mode 100644 bin/tests/system/dnssec/ns3/template.db.in
-
-diff --git a/bin/tests/system/dnssec/ns2/example.db.in b/bin/tests/system/dnssec/ns2/example.db.in
-index f711f5823f..63d41e5e00 100644
---- a/bin/tests/system/dnssec/ns2/example.db.in
-+++ b/bin/tests/system/dnssec/ns2/example.db.in
-@@ -168,4 +168,8 @@ ns.managed-future	A	10.53.0.3
- revkey			NS	ns.revkey
- ns.revkey		A	10.53.0.3
- 
-+; A secure subdomain with extra bad key
-+extrabadkey		NS	ns3.extrabadkey
-+ns3.extrabadkey		A	10.53.0.3
-+
- dname-at-apex-nsec3	NS	ns3
-diff --git a/bin/tests/system/dnssec/ns2/sign.sh b/bin/tests/system/dnssec/ns2/sign.sh
-index b60e82a631..eb008067a4 100644
---- a/bin/tests/system/dnssec/ns2/sign.sh
-+++ b/bin/tests/system/dnssec/ns2/sign.sh
-@@ -62,7 +62,8 @@ for subdomain in secure badds bogus dynamic keyless nsec3 optout \
-   ttlpatch split-dnssec split-smart expired expiring upper lower \
-   dnskey-unknown dnskey-unsupported dnskey-unsupported-2 \
-   dnskey-nsec3-unknown managed-future revkey \
--  dname-at-apex-nsec3 occluded; do
-+  dname-at-apex-nsec3 occluded rsasha1 rsasha1-1024 \
-+  extrabadkey; do
-   cp "../ns3/dsset-$subdomain.example." .
- done
- 
-diff --git a/bin/tests/system/dnssec/ns3/named.conf.in b/bin/tests/system/dnssec/ns3/named.conf.in
-index 680cff58d5..3536046319 100644
---- a/bin/tests/system/dnssec/ns3/named.conf.in
-+++ b/bin/tests/system/dnssec/ns3/named.conf.in
-@@ -84,6 +84,12 @@ zone "insecure2.example" {
- 	allow-update { any; };
- };
- 
-+zone "extrabadkey.example" {
-+	type primary;
-+	file "extrabadkey.example.db.signed";
-+	allow-update { any; };
-+};
-+
- zone "insecure.nsec3.example" {
- 	type primary;
- 	file "insecure.nsec3.example.db";
-diff --git a/bin/tests/system/dnssec/ns3/sign.sh b/bin/tests/system/dnssec/ns3/sign.sh
-index 14fc709bfb..743a0e4121 100644
---- a/bin/tests/system/dnssec/ns3/sign.sh
-+++ b/bin/tests/system/dnssec/ns3/sign.sh
-@@ -673,3 +673,34 @@ $DSFROMKEY "$dnskeyname.key" >"dsset-delegation.${zone}."
- cat "$infile" "${kskname}.key" "${zskname}.key" "${keyname}.key" \
-   "${dnskeyname}.key" "dsset-delegation.${zone}." >"$zonefile"
- "$SIGNER" -P -o "$zone" "$zonefile" >/dev/null
-+
-+#
-+#
-+#
-+zone=extrabadkey.example.
-+infile=template.db.in
-+zonefile=extrabadkey.example.db
-+
-+# Add KSK and ZSK that we will mangle to RSAMD5
-+ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
-+zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
-+cat "$infile" "$ksk.key" "$zsk.key" > "$zonefile"
-+"$SIGNER" -g -O full -o "$zone" "$zonefile" >/dev/null 2>&1
-+
-+# Mangle the signatures to RSAMD5 and save them for future use
-+sed -ne "s/\(IN[[:space:]]*RRSIG[[:space:]]*[A-Z]*\) $DEFAULT_ALGORITHM_NUMBER /\1 1 /p" < "$zonefile.signed" > "$zonefile.signed.rsamd5"
-+
-+# Now add normal KSK and ZSK to the zone file
-+ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
-+zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
-+cat "$infile" "$ksk.key" "$zsk.key" > "$zonefile"
-+
-+# Mangle the DNSKEY algorithm numbers and add them to the signed zone file
-+cat "$ksk.key" "$zsk.key" | sed -e "s/\(IN[[:space:]]*DNSKEY[[:space:]]*[0-9]* 3\) $DEFAULT_ALGORITHM_NUMBER /\1 1 /" >> "$zonefile"
-+
-+# Sign normally
-+"$SIGNER" -g -o "$zone" "$zonefile" >/dev/null 2>&1
-+
-+# Add the mangled signatures to signed zone file
-+cat "$zonefile.signed.rsamd5" >> "$zonefile.signed"
-+rm "$zonefile.signed.rsamd5"
-diff --git a/bin/tests/system/dnssec/ns3/template.db.in b/bin/tests/system/dnssec/ns3/template.db.in
-new file mode 100644
-index 0000000000..f603e448ff
---- /dev/null
-+++ b/bin/tests/system/dnssec/ns3/template.db.in
-@@ -0,0 +1,27 @@
-+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-+;
-+; SPDX-License-Identifier: MPL-2.0
-+;
-+; This Source Code Form is subject to the terms of the Mozilla Public
-+; License, v. 2.0.  If a copy of the MPL was not distributed with this
-+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-+;
-+; See the COPYRIGHT file distributed with this work for additional
-+; information regarding copyright ownership.
-+
-+$TTL 300	; 5 minutes
-+@			IN SOA	mname1. . (
-+				2000042407 ; serial
-+				20         ; refresh (20 seconds)
-+				20         ; retry (20 seconds)
-+				1814400    ; expire (3 weeks)
-+				3600       ; minimum (1 hour)
-+				)
-+			NS	ns3
-+ns3			A	10.53.0.3
-+
-+a			A	10.0.0.1
-+a.b			A	10.0.0.1
-+b			A	10.0.0.2
-+d			A	10.0.0.4
-+z			A	10.0.0.26
-diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh
-index b58b11a5c7..d3690eee6b 100644
---- a/bin/tests/system/dnssec/tests.sh
-+++ b/bin/tests/system/dnssec/tests.sh
-@@ -4497,5 +4497,16 @@ n=$((n + 1))
- if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
- status=$((status + ret))
- 
-+echo_i "checking extra-bad-algorithm positive validation ($n)"
-+ret=0
-+dig_with_opts +noauth a.extrabadkey.example. @10.53.0.3 A >dig.out.ns3.test$n || ret=1
-+dig_with_opts +noauth a.extrabadkey.example. @10.53.0.4 A >dig.out.ns4.test$n || ret=1
-+digcomp --lc dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
-+grep "status: NOERROR" dig.out.ns4.test$n >/dev/null || ret=1
-+grep "flags:.*ad.*QUERY" dig.out.ns4.test$n >/dev/null || ret=1
-+n=$((n + 1))
-+test "$ret" -eq 0 || echo_i "failed"
-+status=$((status + ret))
-+
- echo_i "exit status: $status"
- [ $status -eq 0 ] || exit 1
-diff --git a/bin/tests/system/dnssec/tests_sh_dnssec.py b/bin/tests/system/dnssec/tests_sh_dnssec.py
-index 529a4a0e10..f731ea2ab4 100644
---- a/bin/tests/system/dnssec/tests_sh_dnssec.py
-+++ b/bin/tests/system/dnssec/tests_sh_dnssec.py
-@@ -92,6 +92,7 @@ pytestmark = pytest.mark.extra_artifacts(
-         "ns3/example.bk",
-         "ns3/expired.example.db",
-         "ns3/expiring.example.db",
-+        "ns3/extrabadkey.example.db",
-         "ns3/future.example.db",
-         "ns3/keyless.example.db",
-         "ns3/kskonly.example.db",
--- 
-2.51.1
-
diff --git a/bind-9.20-CVE-2025-8677-dual-signing.patch b/bind-9.20-CVE-2025-8677-dual-signing.patch
deleted file mode 100644
index 40ad87e..0000000
--- a/bind-9.20-CVE-2025-8677-dual-signing.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From 5126c74ec19f56294cbfdc312f75778d8f249e59 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Mon, 3 Nov 2025 22:03:54 +0100
-Subject: [PATCH] Do not abort key search on unsupported algorithm
-
-When supported and unsupported algorithm rrsig is present, some keys may
-return unsupported algorithm error. Continue to next key without
-counting this to validation failures.
-
-(cherry picked from commit 38ddff3336e08983a4c0b5f3ea4eb35bb0f6ac81)
----
- lib/dns/validator.c | 8 +++++++-
- 1 file changed, 7 insertions(+), 1 deletion(-)
-
-diff --git a/lib/dns/validator.c b/lib/dns/validator.c
-index 15e177e4d7..a9db844c27 100644
---- a/lib/dns/validator.c
-+++ b/lib/dns/validator.c
-@@ -1163,7 +1163,13 @@ select_signing_key(dns_validator_t *val, dns_rdataset_t *rdataset) {
- 				goto done;
- 			}
- 			dst_key_free(&val->key);
--		} else {
-+		} else if (result != DST_R_UNSUPPORTEDALG) {
-+			/* Unsupported alg happens when RRset is signed by both
-+			 * supported and unsupported alg. */
-+			validator_log(val, ISC_LOG_DEBUG(3),
-+				      "select_signing_key alg %d keyid %d: %s",
-+				      siginfo->algorithm, siginfo->keyid,
-+				      isc_result_totext(result));
- 			break;
- 		}
- 		dns_rdata_reset(&rdata);
--- 
-2.51.1
-
diff --git a/bind-9.20-nsupdate-tls.patch b/bind-9.20-nsupdate-tls.patch
index ccf46e4..5404bd3 100644
--- a/bind-9.20-nsupdate-tls.patch
+++ b/bind-9.20-nsupdate-tls.patch
@@ -1,4 +1,4 @@
-From b44dc4ed5c34445511f06d4b972407d539f8e9da Mon Sep 17 00:00:00 2001
+From b0a417393f6a656758f40f30234086e1017faa7a Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Mon, 11 Nov 2024 18:09:07 +0100
 Subject: [PATCH] Backport nsupdate TLS support into 9.18
@@ -55,8 +55,8 @@ Adapted to 9.18.33.
  lib/dns/include/dns/types.h     |   2 +
  lib/dns/request.c               |  63 ++++++--
  lib/dns/transport.c             | 253 ++++++++++++++++++++++++++++++++
- lib/dns/xfrin.c                 | 232 +----------------------------
- 9 files changed, 668 insertions(+), 292 deletions(-)
+ lib/dns/xfrin.c                 |   7 +-
+ 9 files changed, 671 insertions(+), 64 deletions(-)
 
 diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
 index 293ed28..819925e 100644
@@ -455,7 +455,7 @@ index 293ed28..819925e 100644
  	if (answer != NULL) {
  		dns_message_detach(&answer);
 diff --git a/lib/dns/dispatch.c b/lib/dns/dispatch.c
-index eb37198..8273c32 100644
+index bd53763..5722fe2 100644
 --- a/lib/dns/dispatch.c
 +++ b/lib/dns/dispatch.c
 @@ -30,6 +30,7 @@
@@ -922,10 +922,10 @@ index e74ccd7..e6499a9 100644
   * Requires:
   *\li	'transport' is valid.
 diff --git a/lib/dns/include/dns/types.h b/lib/dns/include/dns/types.h
-index 6465962..f0aaa24 100644
+index 8ddcbeb..7ba4801 100644
 --- a/lib/dns/include/dns/types.h
 +++ b/lib/dns/include/dns/types.h
-@@ -141,6 +141,8 @@ typedef struct dns_ssutable	     dns_ssutable_t;
+@@ -142,6 +142,8 @@ typedef struct dns_ssutable	     dns_ssutable_t;
  typedef struct dns_stats	     dns_stats_t;
  typedef uint32_t		     dns_rdatastatstype_t;
  typedef struct dns_tkeyctx	     dns_tkeyctx_t;
@@ -1350,255 +1350,37 @@ index 88a3df4..2a779ba 100644
  transport_destroy(dns_transport_t *transport) {
  	isc_refcount_destroy(&transport->references);
 diff --git a/lib/dns/xfrin.c b/lib/dns/xfrin.c
-index 3a4f761..3695815 100644
+index 6a46ea3..ae2b70f 100644
 --- a/lib/dns/xfrin.c
 +++ b/lib/dns/xfrin.c
-@@ -962,234 +962,6 @@ xfrin_create(isc_mem_t *mctx, dns_zone_t *zone, dns_db_t *db, isc_nm_t *netmgr,
+@@ -938,6 +938,7 @@ xfrin_create(isc_mem_t *mctx, dns_zone_t *zone, dns_db_t *db, isc_nm_t *netmgr,
  	*xfrp = xfr;
  }
  
--static isc_result_t
--get_create_tlsctx(const dns_xfrin_ctx_t *xfr, isc_tlsctx_t **pctx,
--		  isc_tlsctx_client_session_cache_t **psess_cache) {
--	isc_result_t result = ISC_R_FAILURE;
--	isc_tlsctx_t *tlsctx = NULL, *found = NULL;
--	isc_tls_cert_store_t *store = NULL, *found_store = NULL;
--	isc_tlsctx_client_session_cache_t *sess_cache = NULL,
--					  *found_sess_cache = NULL;
--	uint32_t tls_versions;
--	const char *ciphers = NULL;
--	bool prefer_server_ciphers;
--	const uint16_t family = isc_sockaddr_pf(&xfr->primaryaddr) == PF_INET6
--					? AF_INET6
--					: AF_INET;
--	const char *tlsname = NULL;
--
--	REQUIRE(psess_cache != NULL && *psess_cache == NULL);
--	REQUIRE(pctx != NULL && *pctx == NULL);
--
--	INSIST(xfr->transport != NULL);
--	tlsname = dns_transport_get_tlsname(xfr->transport);
--	INSIST(tlsname != NULL && *tlsname != '\0');
--
--	/*
--	 * Let's try to re-use the already created context. This way
--	 * we have a chance to resume the TLS session, bypassing the
--	 * full TLS handshake procedure, making establishing
--	 * subsequent TLS connections for XoT faster.
--	 */
--	result = isc_tlsctx_cache_find(xfr->tlsctx_cache, tlsname,
--				       isc_tlsctx_cache_tls, family, &found,
--				       &found_store, &found_sess_cache);
--	if (result != ISC_R_SUCCESS) {
--		const char *hostname =
--			dns_transport_get_remote_hostname(xfr->transport);
--		const char *ca_file = dns_transport_get_cafile(xfr->transport);
--		const char *cert_file =
--			dns_transport_get_certfile(xfr->transport);
--		const char *key_file =
--			dns_transport_get_keyfile(xfr->transport);
--		char primary_addr_str[INET6_ADDRSTRLEN] = { 0 };
--		isc_netaddr_t primary_netaddr = { 0 };
--		bool hostname_ignore_subject;
--		/*
--		 * So, no context exists. Let's create one using the
--		 * parameters from the configuration file and try to
--		 * store it for further reuse.
--		 */
--		result = isc_tlsctx_createclient(&tlsctx);
--		if (result != ISC_R_SUCCESS) {
--			goto failure;
--		}
--		tls_versions = dns_transport_get_tls_versions(xfr->transport);
--		if (tls_versions != 0) {
--			isc_tlsctx_set_protocols(tlsctx, tls_versions);
--		}
--		ciphers = dns_transport_get_ciphers(xfr->transport);
--		if (ciphers != NULL) {
--			isc_tlsctx_set_cipherlist(tlsctx, ciphers);
--		}
--
--		if (dns_transport_get_prefer_server_ciphers(
--			    xfr->transport, &prefer_server_ciphers))
--		{
--			isc_tlsctx_prefer_server_ciphers(tlsctx,
--							 prefer_server_ciphers);
--		}
--
--		if (hostname != NULL || ca_file != NULL) {
--			/*
--			 * The situation when 'found_store != NULL' while 'found
--			 * == NULL' might appear as there is one to many
--			 * relation between per transport TLS contexts and cert
--			 * stores. That is, there could be one store shared
--			 * between multiple contexts.
--			 */
--			if (found_store == NULL) {
--				/*
--				 * 'ca_file' can equal 'NULL' here, in
--				 * that case the store with system-wide
--				 * CA certificates will be created, just
--				 * as planned.
--				 */
--				result = isc_tls_cert_store_create(ca_file,
--								   &store);
--
--				if (result != ISC_R_SUCCESS) {
--					goto failure;
--				}
--			} else {
--				store = found_store;
--			}
--
--			INSIST(store != NULL);
--			if (hostname == NULL) {
--				/*
--				 * If CA bundle file is specified, but
--				 * hostname is not, then use the primary
--				 * IP address for validation, just like
--				 * dig does.
--				 */
--				INSIST(ca_file != NULL);
--				isc_netaddr_fromsockaddr(&primary_netaddr,
--							 &xfr->primaryaddr);
--				isc_netaddr_format(&primary_netaddr,
--						   primary_addr_str,
--						   sizeof(primary_addr_str));
--				hostname = primary_addr_str;
--			}
--			/*
--			 * According to RFC 8310, Subject field MUST NOT
--			 * be inspected when verifying hostname for DoT.
--			 * Only SubjectAltName must be checked.
--			 */
--			hostname_ignore_subject = true;
--			result = isc_tlsctx_enable_peer_verification(
--				tlsctx, false, store, hostname,
--				hostname_ignore_subject);
--			if (result != ISC_R_SUCCESS) {
--				goto failure;
--			}
--
--			/*
--			 * Let's load client certificate and enable
--			 * Mutual TLS. We do that only in the case when
--			 * Strict TLS is enabled, because Mutual TLS is
--			 * an extension of it.
--			 */
--			if (cert_file != NULL) {
--				INSIST(key_file != NULL);
--
--				result = isc_tlsctx_load_certificate(
--					tlsctx, key_file, cert_file);
--				if (result != ISC_R_SUCCESS) {
--					goto failure;
--				}
--			}
--		}
--
--		isc_tlsctx_enable_dot_client_alpn(tlsctx);
--
--		isc_tlsctx_client_session_cache_create(
--			xfr->mctx, tlsctx,
--			ISC_TLSCTX_CLIENT_SESSION_CACHE_DEFAULT_SIZE,
--			&sess_cache);
--
--		found_store = NULL;
--		result = isc_tlsctx_cache_add(xfr->tlsctx_cache, tlsname,
--					      isc_tlsctx_cache_tls, family,
--					      tlsctx, store, sess_cache, &found,
--					      &found_store, &found_sess_cache);
--		if (result == ISC_R_EXISTS) {
--			/*
--			 * It seems the entry has just been created from within
--			 * another thread while we were initialising
--			 * ours. Although this is unlikely, it could happen
--			 * after startup/re-initialisation. In such a case,
--			 * discard the new context and associated data and use
--			 * the already established one from now on.
--			 *
--			 * Such situation will not occur after the
--			 * initial 'warm-up', so it is not critical
--			 * performance-wise.
--			 */
--			INSIST(found != NULL);
--			isc_tlsctx_free(&tlsctx);
--			/*
--			 * The 'store' variable can be 'NULL' when remote server
--			 * verification is not enabled (that is, when Strict or
--			 * Mutual TLS are not used).
--			 *
--			 * The 'found_store' might be equal to 'store' as there
--			 * is one-to-many relation between a store and
--			 * per-transport TLS contexts. In that case, the call to
--			 * 'isc_tlsctx_cache_find()' above could have returned a
--			 * store via the 'found_store' variable, whose value we
--			 * can assign to 'store' later. In that case,
--			 * 'isc_tlsctx_cache_add()' will return the same value.
--			 * When that happens, we should not free the store
--			 * object, as it is managed by the TLS context cache.
--			 */
--			if (store != NULL && store != found_store) {
--				isc_tls_cert_store_free(&store);
--			}
--			isc_tlsctx_client_session_cache_detach(&sess_cache);
--			/* Let's return the data from the cache. */
--			*psess_cache = found_sess_cache;
--			*pctx = found;
--		} else {
--			/*
--			 * Adding the fresh values into the cache has been
--			 * successful, let's return them
--			 */
--			INSIST(result == ISC_R_SUCCESS);
--			*psess_cache = sess_cache;
--			*pctx = tlsctx;
--		}
--	} else {
--		/*
--		 * The cache lookup has been successful, let's return the
--		 * results.
--		 */
--		INSIST(result == ISC_R_SUCCESS);
--		*psess_cache = found_sess_cache;
--		*pctx = found;
--	}
--
--	return ISC_R_SUCCESS;
--
--failure:
--	if (tlsctx != NULL) {
--		isc_tlsctx_free(&tlsctx);
--	}
--
--	/*
--	 * The 'found_store' is being managed by the TLS context
--	 * cache. Thus, we should keep it as it is, as it will get
--	 * destroyed alongside the cache. As there is one store per
--	 * multiple TLS contexts, we need to handle store deletion in a
--	 * special way.
--	 */
--	if (store != NULL && store != found_store) {
--		isc_tls_cert_store_free(&store);
--	}
--
--	return result;
--}
--
++#if 0
+ static isc_result_t
+ get_create_tlsctx(const dns_xfrin_ctx_t *xfr, isc_tlsctx_t **pctx,
+ 		  isc_tlsctx_client_session_cache_t **psess_cache) {
+@@ -1152,6 +1153,8 @@ cleanup:
+ 
+ 	return result;
+ }
++/* if 0 */
++#endif
+ 
  static isc_result_t
  xfrin_start(dns_xfrin_ctx_t *xfr) {
- 	isc_result_t result;
-@@ -1232,7 +1004,9 @@ xfrin_start(dns_xfrin_ctx_t *xfr) {
+@@ -1195,7 +1198,9 @@ xfrin_start(dns_xfrin_ctx_t *xfr) {
  				     connect_xfr, 30000, 0);
  		break;
  	case DNS_TRANSPORT_TLS: {
--		result = get_create_tlsctx(xfr, &tlsctx, &sess_cache);
-+		result = dns_transport_get_tlsctx(
+-		CHECK(get_create_tlsctx(xfr, &tlsctx, &sess_cache));
++		CHECK(dns_transport_get_tlsctx(
 +			xfr->transport, &xfr->primaryaddr, xfr->tlsctx_cache,
-+			xfr->mctx, &tlsctx, &sess_cache);
- 		if (result != ISC_R_SUCCESS) {
- 			goto failure;
- 		}
++			xfr->mctx, &tlsctx, &sess_cache));
+ 		INSIST(tlsctx != NULL);
+ 		isc_nm_tlsdnsconnect(xfr->netmgr, &xfr->sourceaddr,
+ 				     &xfr->primaryaddr, xfrin_connect_done,
 -- 
-2.48.1
+2.52.0
 
diff --git a/bind.spec b/bind.spec
index 9079b37..41c8525 100644
--- a/bind.spec
+++ b/bind.spec
@@ -85,8 +85,8 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 #
 # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it.
 # Updating just bind will cause freeipa-dns-server package to be uninstallable.
-Version:  9.18.41
-Release:  2%{?dist}
+Version:  9.18.43
+Release:  1%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -142,10 +142,6 @@ Patch32: bind-9.18-partial-additional-records.patch
 Patch33: bind-9.18-dig-idn-input-always.patch
 # downstream only too
 Patch34: bind-9.18-dig-idn-input-always-test.patch
-# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/11194
-Patch35: bind-9.20-CVE-2025-8677-dual-signing.patch
-# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/11195
-Patch36: bind-9.20-CVE-2025-8677-dual-signing-test.patch
 
 %{?systemd_ordering}
 # https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers
@@ -947,6 +943,9 @@ fi;
 %endif
 
 %changelog
+* Wed Dec 17 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.43-1
+- Update to 9.18.43 (rhbz#2415842)
+
 * Fri Oct 31 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.41-2
 - Fix upstream reported regression in recent CVE fix (CVE-2025-8677)
 - Add upstream dnssec system test testcase for this problem
diff --git a/sources b/sources
index df9609f..e0ce143 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.18.41.tar.xz) = aba4a0add07f1feb2825852faeed14bc946628b818adac93401890cd67ead17c2fd8d820bca70ba7f8c2788dc65195baccc93f87249fb7e47077354341ff0839
-SHA512 (bind-9.18.41.tar.xz.asc) = 5b5a2f969e6da6a64908dba7f94f9877ce2d729e59c3b9c23fa3459cc74059b10479df63b3223c738b4fbfecde5e51dd9906fb34e6763c0b5909dda195afb71b
+SHA512 (bind-9.18.43.tar.xz) = 4f0e6849e883110f275739a03de20465c91563f26be94d380d28454f27d7c68fdc3ba0e1eaa8d25a6790cadc8228ee981dceb0a6fcf46ab4ffd24b8c76f42e25
+SHA512 (bind-9.18.43.tar.xz.asc) = 82ecbbba5043793c5f5c6d7fd0166dbc60a9e7a349e396bb28f1be0c7643683e91e98cf2a84635d6c707c52273dd8df438df5601d06ea3a6be8293860d552f22

From 463e7a3d2dff4acfadf9df5ee14db80320d5e6d1 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Fri, 16 Jan 2026 04:23:48 +0000
Subject: [PATCH 416/460] Rebuilt for
 https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild

---
 bind.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index 41c8525..869a016 100644
--- a/bind.spec
+++ b/bind.spec
@@ -86,7 +86,7 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it.
 # Updating just bind will cause freeipa-dns-server package to be uninstallable.
 Version:  9.18.43
-Release:  1%{?dist}
+Release:  2%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -943,6 +943,9 @@ fi;
 %endif
 
 %changelog
+* Fri Jan 16 2026 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.18.43-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
+
 * Wed Dec 17 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.43-1
 - Update to 9.18.43 (rhbz#2415842)
 

From 159d742c215ea9d3dd625a88168633643ea29786 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Fri, 16 Jan 2026 08:20:40 +0000
Subject: [PATCH 417/460] Rebuilt for
 https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild

---
 bind.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index 869a016..825d96b 100644
--- a/bind.spec
+++ b/bind.spec
@@ -86,7 +86,7 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it.
 # Updating just bind will cause freeipa-dns-server package to be uninstallable.
 Version:  9.18.43
-Release:  2%{?dist}
+Release:  3%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -943,6 +943,9 @@ fi;
 %endif
 
 %changelog
+* Fri Jan 16 2026 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.18.43-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
+
 * Fri Jan 16 2026 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.18.43-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
 

From d82283632119f3a886b3d317c7c302c95b8bb4dc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 22 Jan 2026 11:15:47 +0100
Subject: [PATCH 418/460] Update to 9.18.44 (rhbz#2431609)

Security Fixes:

- Fix incorrect length checks for BRID and HHIT records. (CVE-2025-13878)

Bug Fixes:

- Allow glue in delegations with QTYPE=ANY.
- Reconfiguring an NSEC3 opt-out zone to NSEC caused the zone to be invalid.

https://downloads.isc.org/isc/bind9/9.18.44/doc/arm/html/notes.html#notes-for-bind-9-18-44
---
 bind.spec | 7 +++++--
 sources   | 4 ++--
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/bind.spec b/bind.spec
index 825d96b..827994d 100644
--- a/bind.spec
+++ b/bind.spec
@@ -85,8 +85,8 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 #
 # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it.
 # Updating just bind will cause freeipa-dns-server package to be uninstallable.
-Version:  9.18.43
-Release:  3%{?dist}
+Version:  9.18.44
+Release:  1%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -943,6 +943,9 @@ fi;
 %endif
 
 %changelog
+* Thu Jan 22 2026 Petr Menšík <pemensik@redhat.com> - 32:9.18.44-1
+- Update to 9.18.44 (rhbz#2431609)
+
 * Fri Jan 16 2026 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.18.43-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
 
diff --git a/sources b/sources
index e0ce143..c7529d6 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.18.43.tar.xz) = 4f0e6849e883110f275739a03de20465c91563f26be94d380d28454f27d7c68fdc3ba0e1eaa8d25a6790cadc8228ee981dceb0a6fcf46ab4ffd24b8c76f42e25
-SHA512 (bind-9.18.43.tar.xz.asc) = 82ecbbba5043793c5f5c6d7fd0166dbc60a9e7a349e396bb28f1be0c7643683e91e98cf2a84635d6c707c52273dd8df438df5601d06ea3a6be8293860d552f22
+SHA512 (bind-9.18.44.tar.xz) = 767bc313995576c008c00e073568d5d9bebb2e1dcc7e9e3f7ea128e6dca4358d7879de70fa1cb2980ded0b8db362f4d9eb71875dda2d45898e5607dbb4093a9f
+SHA512 (bind-9.18.44.tar.xz.asc) = 6fa084c028e5af89f6ca9e5f205d78fb1423b2e9000bd7859e28d42134738c24d7e26c29261e597fe71aaa0e8c09b2f0563ad1d7e415ee8ebf5ec4d00725c678

From fa6f9dbbd115992b73c21095af39047611e9c862 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 12 Dec 2025 16:52:32 +0100
Subject: [PATCH 419/460] Create /var/named directories for bind-chroot

Fixes bind-chroot in Image Mode. Include even subdirectories.

Related: RHEL-132053
---
 bind-chroot.tmpfiles.d | 37 +++++++++++++++++++++++++++++++++++++
 bind.spec              |  8 +++++++-
 2 files changed, 44 insertions(+), 1 deletion(-)
 create mode 100644 bind-chroot.tmpfiles.d

diff --git a/bind-chroot.tmpfiles.d b/bind-chroot.tmpfiles.d
new file mode 100644
index 0000000..ba13ee1
--- /dev/null
+++ b/bind-chroot.tmpfiles.d
@@ -0,0 +1,37 @@
+# vim: ft=conf:
+# TODO: these definitions are in different form in rpm spec %files chroot section
+# find a way to have it defined only once
+#defattr(0664,root,named,-)
+c /var/named/chroot/dev/null    0664 root named - 1:3
+c /var/named/chroot/dev/random  0664 root named - 1:8
+c /var/named/chroot/dev/urandom 0664 root named - 1:9
+c /var/named/chroot/dev/zero    0664 root named - 1:5
+#defattr(0640,root,named,0750)
+d /var/named/chroot             0750 root named -
+d /var/named/chroot/dev         0750 root named -
+d /var/named/chroot/etc         0750 root named -
+d /var/named/chroot/etc/named   0750 root named -
+d /var/named/chroot/etc/pki     0750 root named -
+d /var/named/chroot/etc/pki/dnssec-keys 0750 root named -
+d /var/named/chroot/etc/crypto-policies 0750 root named -
+d /var/named/chroot/etc/crypto-policies/back-ends 0750 root named -
+d /var/named/chroot/var         0750 root named -
+d /var/named/chroot/run         0750 root named -
+#defattr(-,root,root,-)
+d /var/named/chroot/usr             - root root -
+d /var/named/chroot/usr/lib64       - root root -
+d /var/named/chroot/usr/lib64/bind  - root root -
+d /var/named/chroot/usr/share/GeoIP - root root -
+d /var/named/chroot/usr/share/named - root root -
+d /var/named/chroot/proc            - root root -
+d /var/named/chroot/proc/sys        - root root -
+d /var/named/chroot/proc/sys/net    - root root -
+d /var/named/chroot/proc/sys/net/ipv4 - root root -
+#defattr(0660,root,named,01770)
+d /var/named/chroot/var/named   01770 root named -
+#defattr(0660,named,named,0770)
+d /var/named/chroot/var/tmp      0770 named named -
+d /var/named/chroot/var/log      0770 named named -
+#defattr(-,named,named,-)
+d /var/named/chroot/run/named       - named named -
+L /var/named/chroot/var/run         - named named - ../run
diff --git a/bind.spec b/bind.spec
index 827994d..25a0c69 100644
--- a/bind.spec
+++ b/bind.spec
@@ -86,7 +86,7 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it.
 # Updating just bind will cause freeipa-dns-server package to be uninstallable.
 Version:  9.18.44
-Release:  1%{?dist}
+Release:  2%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -117,6 +117,7 @@ Source46: named-setup-rndc.service
 Source48: setup-named-softhsm.sh
 Source49: named-chroot.files
 Source50: named.sysusers
+Source51: bind-chroot.tmpfiles.d
 
 # Common patches
 # FIXME: Is this still required?
@@ -671,6 +672,7 @@ done
 
 mkdir -p ${RPM_BUILD_ROOT}%{_tmpfilesdir}
 install -p -m 644 %{SOURCE35} ${RPM_BUILD_ROOT}%{_tmpfilesdir}/named.conf
+install -p -m 644 %{SOURCE51} ${RPM_BUILD_ROOT}%{_tmpfilesdir}/%{name}-chroot.conf
 
 mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/rwtab.d
 install -p -m 644 %{SOURCE43} ${RPM_BUILD_ROOT}%{_sysconfdir}/rwtab.d/named
@@ -898,6 +900,7 @@ fi;
 %{_unitdir}/named-chroot.service
 %{_unitdir}/named-chroot-setup.service
 %{_libexecdir}/setup-named-chroot.sh
+%{_tmpfilesdir}/%{name}-chroot.conf
 %defattr(0664,root,named,-)
 %ghost %dev(c,1,3) %verify(not mtime) %{chroot_prefix}/dev/null
 %ghost %dev(c,1,8) %verify(not mtime) %{chroot_prefix}/dev/random
@@ -943,6 +946,9 @@ fi;
 %endif
 
 %changelog
+* Fri Dec 12 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.44-2
+- Create /var/named directories for bind-chroot (RHEL-132053)
+
 * Thu Jan 22 2026 Petr Menšík <pemensik@redhat.com> - 32:9.18.44-1
 - Update to 9.18.44 (rhbz#2431609)
 

From c92030d6aabf59165bee67af13eddecb6e14c82d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 28 Jan 2026 11:47:33 +0100
Subject: [PATCH 420/460] Add forgotten _libdir/named into bind-chroot tmpfiles

One of libdir directories was forgotten. It is the directory containing
the actual plugin, might cause issues if filter-aaaa.so plugin is used.

Related: RHEL-132054
---
 bind-chroot.tmpfiles.d | 1 +
 bind.spec              | 1 +
 2 files changed, 2 insertions(+)

diff --git a/bind-chroot.tmpfiles.d b/bind-chroot.tmpfiles.d
index ba13ee1..13992fd 100644
--- a/bind-chroot.tmpfiles.d
+++ b/bind-chroot.tmpfiles.d
@@ -21,6 +21,7 @@ d /var/named/chroot/run         0750 root named -
 d /var/named/chroot/usr             - root root -
 d /var/named/chroot/usr/lib64       - root root -
 d /var/named/chroot/usr/lib64/bind  - root root -
+d /var/named/chroot/usr/lib64/named - root root -
 d /var/named/chroot/usr/share/GeoIP - root root -
 d /var/named/chroot/usr/share/named - root root -
 d /var/named/chroot/proc            - root root -
diff --git a/bind.spec b/bind.spec
index 25a0c69..00ce5c7 100644
--- a/bind.spec
+++ b/bind.spec
@@ -948,6 +948,7 @@ fi;
 %changelog
 * Fri Dec 12 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.44-2
 - Create /var/named directories for bind-chroot (RHEL-132053)
+- Add forgotten _libdir/named into bind-chroot tmpfiles
 
 * Thu Jan 22 2026 Petr Menšík <pemensik@redhat.com> - 32:9.18.44-1
 - Update to 9.18.44 (rhbz#2431609)

From cc844e18efa4e671f1ef0c6a09796d527a8ab7eb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 3 Mar 2026 19:56:51 +0100
Subject: [PATCH 421/460] Fix changelog date ordering

---
 bind.spec | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index 00ce5c7..de6e974 100644
--- a/bind.spec
+++ b/bind.spec
@@ -946,7 +946,7 @@ fi;
 %endif
 
 %changelog
-* Fri Dec 12 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.44-2
+* Wed Jan 28 2026 Petr Menšík <pemensik@redhat.com> - 32:9.18.44-2
 - Create /var/named directories for bind-chroot (RHEL-132053)
 - Add forgotten _libdir/named into bind-chroot tmpfiles
 

From 3bda563fa3683129976c3f979d5fd045e86aa9d3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 3 Mar 2026 19:54:55 +0100
Subject: [PATCH 422/460] Update to 9.18.46 (rhbz#2440561)

Bug Fixes:

- Stale answer could be served when following CNAME and failures
  occured. [GL #5751]

https://downloads.isc.org/isc/bind9/9.18.46/doc/arm/html/notes.html#notes-for-bind-9-18-46
---
 bind.spec | 7 +++++--
 sources   | 4 ++--
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/bind.spec b/bind.spec
index de6e974..38470dd 100644
--- a/bind.spec
+++ b/bind.spec
@@ -85,8 +85,8 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 #
 # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it.
 # Updating just bind will cause freeipa-dns-server package to be uninstallable.
-Version:  9.18.44
-Release:  2%{?dist}
+Version:  9.18.46
+Release:  1%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -946,6 +946,9 @@ fi;
 %endif
 
 %changelog
+* Tue Mar 03 2026 Petr Menšík <pemensik@redhat.com> - 32:9.18.46-1
+- Update to 9.18.46 (rhbz#2440561)
+
 * Wed Jan 28 2026 Petr Menšík <pemensik@redhat.com> - 32:9.18.44-2
 - Create /var/named directories for bind-chroot (RHEL-132053)
 - Add forgotten _libdir/named into bind-chroot tmpfiles
diff --git a/sources b/sources
index c7529d6..71b30b7 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.18.44.tar.xz) = 767bc313995576c008c00e073568d5d9bebb2e1dcc7e9e3f7ea128e6dca4358d7879de70fa1cb2980ded0b8db362f4d9eb71875dda2d45898e5607dbb4093a9f
-SHA512 (bind-9.18.44.tar.xz.asc) = 6fa084c028e5af89f6ca9e5f205d78fb1423b2e9000bd7859e28d42134738c24d7e26c29261e597fe71aaa0e8c09b2f0563ad1d7e415ee8ebf5ec4d00725c678
+SHA512 (bind-9.18.46.tar.xz) = 92cd1ac5f65ed6f400191f8b81bc4501fc590c9ebe8ffdd1310e67ec784b00d5977a78106b0c2221c90f4b69b9050aae054bad0def0f6d03de94ea98686ad166
+SHA512 (bind-9.18.46.tar.xz.asc) = c208ba214e574079814869a5186a84b1bc2362404baf42d2606dece2d11f948bc458fd32abb579c6cb0385294e6b8fce4fe97a3da6ca0c1a9feb93a1394c31d7

From a3ca8b5f928187b3769d5b9383cb6d5f2d63aee1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 25 Mar 2026 19:27:51 +0100
Subject: [PATCH 423/460] Update to 9.18.47 (rhbz#2440561)

Security Fixes:
- Fix unbounded NSEC3 iterations when validating referrals to unsigned delegations. (CVE-2026-1519)

Source: https://downloads.isc.org/isc/bind9/9.18.47/doc/arm/html/notes.html#notes-for-bind-9-18-47
---
 bind.spec | 7 ++++++-
 sources   | 4 ++--
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/bind.spec b/bind.spec
index 38470dd..1b223ea 100644
--- a/bind.spec
+++ b/bind.spec
@@ -42,6 +42,8 @@
 %global        chroot_create_directories /dev /run/named %{_localstatedir}/{log,named,tmp} \\\
                                          %{_sysconfdir}/{crypto-policies/back-ends,pki/dnssec-keys,named} \\\
                                          %{_libdir}/bind %{_libdir}/named %{_datadir}/{GeoIP,named} /proc/sys/net/ipv4
+%global        upstream_sources 0 2
+%global        pgp_signature_sources 2
 
 ## The order of libs is important. See lib/Makefile.in for details
 %define bind_export_libs isc dns isccfg irs
@@ -85,7 +87,7 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 #
 # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it.
 # Updating just bind will cause freeipa-dns-server package to be uninstallable.
-Version:  9.18.46
+Version:  9.18.47
 Release:  1%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
@@ -946,6 +948,9 @@ fi;
 %endif
 
 %changelog
+* Wed Mar 25 2026 Petr Menšík <pemensik@redhat.com> - 32:9.18.47-1
+- Update to 9.18.47 (rhbz#2440561)
+
 * Tue Mar 03 2026 Petr Menšík <pemensik@redhat.com> - 32:9.18.46-1
 - Update to 9.18.46 (rhbz#2440561)
 
diff --git a/sources b/sources
index 71b30b7..4df8f96 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.18.46.tar.xz) = 92cd1ac5f65ed6f400191f8b81bc4501fc590c9ebe8ffdd1310e67ec784b00d5977a78106b0c2221c90f4b69b9050aae054bad0def0f6d03de94ea98686ad166
-SHA512 (bind-9.18.46.tar.xz.asc) = c208ba214e574079814869a5186a84b1bc2362404baf42d2606dece2d11f948bc458fd32abb579c6cb0385294e6b8fce4fe97a3da6ca0c1a9feb93a1394c31d7
+SHA512 (bind-9.18.47.tar.xz) = 8135d453c0dd99947c93b9fb8fe1a52c5657f1c675b503dbfb745dfc9bb278121dc307d590bae99b439b093e87cb2bd0bf07d0a32ffd8a39841752559a0df1e8
+SHA512 (bind-9.18.47.tar.xz.asc) = 225075bccee8b39366c0eca40a58c3c81296a86187b976ddab730d880388f6ed00c70f8c30ffa6e9f180159296fc41c9d204facc6f53260209ea27626b60ced8

From 492a790266c2fe44062f31221f5e4ac9a37a443d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 7 Apr 2026 16:31:04 +0200
Subject: [PATCH 424/460] Update to 9.18.48 (rhbz#2453853)

Security Fixes:

- Fix crash when reconfiguring zone update policy during active updates.

Bug Fixes:

- Fix a crash triggered by rndc modzone on a zone from a configuration file.
- Fix a crash triggered by rndc modzone on zone that already existed in NZF file.

Source: https://downloads.isc.org/isc/bind9/9.18.48/doc/arm/html/notes.html#notes-for-bind-9-18-48
---
 bind.spec | 6 +++++-
 sources   | 4 ++--
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/bind.spec b/bind.spec
index 1b223ea..76862cc 100644
--- a/bind.spec
+++ b/bind.spec
@@ -87,7 +87,7 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 #
 # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it.
 # Updating just bind will cause freeipa-dns-server package to be uninstallable.
-Version:  9.18.47
+Version:  9.18.48
 Release:  1%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
@@ -187,6 +187,7 @@ BuildRequires:  softhsm
 BuildRequires:  perl(Net::DNS) perl(Net::DNS::Nameserver) perl(Time::HiRes) perl(Getopt::Long)
 BuildRequires:  perl(English)
 BuildRequires:  python3-dns
+BuildRequires:  python3-hypothesis
 # manual configuration requires this tool
 BuildRequires:  iproute
 %endif
@@ -948,6 +949,9 @@ fi;
 %endif
 
 %changelog
+* Tue Apr 07 2026 Petr Menšík <pemensik@redhat.com> - 32:9.18.48-1
+- Update to 9.18.48 (rhbz#2453853)
+
 * Wed Mar 25 2026 Petr Menšík <pemensik@redhat.com> - 32:9.18.47-1
 - Update to 9.18.47 (rhbz#2440561)
 
diff --git a/sources b/sources
index 4df8f96..6412bed 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.18.47.tar.xz) = 8135d453c0dd99947c93b9fb8fe1a52c5657f1c675b503dbfb745dfc9bb278121dc307d590bae99b439b093e87cb2bd0bf07d0a32ffd8a39841752559a0df1e8
-SHA512 (bind-9.18.47.tar.xz.asc) = 225075bccee8b39366c0eca40a58c3c81296a86187b976ddab730d880388f6ed00c70f8c30ffa6e9f180159296fc41c9d204facc6f53260209ea27626b60ced8
+SHA512 (bind-9.18.48.tar.xz) = 9c93fe60e8fdfa140cfd535beaf42b368aed885aa97669f990f100c8d75d02cb2b0423f87e8b0f36315fda5bb998e18b7bf8d3d649e9ffe32a4724947a5bebe7
+SHA512 (bind-9.18.48.tar.xz.asc) = 45e98a05b48ea094c3d1acdf1f46975fad2aea6bbb182f49f0a897f276ef709a9a4cce025bfbac1f7049a497b47306be33e9d5e7230034e730e6de97ce0256f3

From 7c5c8f76adfb2ce5a82c4a45c0c229847f287de9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 20 May 2026 14:05:28 +0200
Subject: [PATCH 425/460] Update to 9.18.49 (rhbz#2480121)

Security Fixes:

- Limit resolver server list size. (CVE-2026-3592)
- Fix GSS-API resource leak. (CVE-2026-3039)
- Disable recursion, UPDATE, and NOTIFY for non-IN views. (CVE-2026-5946)
- Avoid unbounded recursion loop. (CVE-2026-5950)
- Fix outgoing zone transfers' quota issue.

Feature Changes:

- Fix CPU spikes and slow queries when cache approaches memory limit.

Bug Fixes:

- Fix named crash when processing SIG records in dynamic updates.
- Fix rndc modzone behavior for a zone in named.conf.
- Fix zone verification of NSEC3 signed zones.
- Prevent a crash when using both dns64 and filter-aaaa.
- Fixed an assertion failure when processing catalog zones.
- Prevent malicious DNSSEC zones from exhausting validator CPU.
- Fix rndc-confgen aborting on HMAC-SHA-384/512 keys above 512 bits.
- Prevent crafted queries from degrading RRL performance.
- Fix a bug in allow-query/allow-transfer catalog zone custom properties.
- Fix a memory leak issue in catalog zones.
- Fix suppressed missing-glue check in named-checkzone.
- Reject record sets too large to serve in DNS.

Source: https://downloads.isc.org/isc/bind9/9.18.49/doc/arm/html/notes.html#notes-for-bind-9-18-49
---
 bind.spec | 5 ++++-
 sources   | 4 ++--
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/bind.spec b/bind.spec
index 76862cc..e1c9b9d 100644
--- a/bind.spec
+++ b/bind.spec
@@ -87,7 +87,7 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 #
 # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it.
 # Updating just bind will cause freeipa-dns-server package to be uninstallable.
-Version:  9.18.48
+Version:  9.18.49
 Release:  1%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
@@ -949,6 +949,9 @@ fi;
 %endif
 
 %changelog
+* Wed May 20 2026 Petr Menšík <pemensik@redhat.com> - 32:9.18.49-1
+- Update to 9.18.49 (rhbz#2480121)
+
 * Tue Apr 07 2026 Petr Menšík <pemensik@redhat.com> - 32:9.18.48-1
 - Update to 9.18.48 (rhbz#2453853)
 
diff --git a/sources b/sources
index 6412bed..ce795fc 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.18.48.tar.xz) = 9c93fe60e8fdfa140cfd535beaf42b368aed885aa97669f990f100c8d75d02cb2b0423f87e8b0f36315fda5bb998e18b7bf8d3d649e9ffe32a4724947a5bebe7
-SHA512 (bind-9.18.48.tar.xz.asc) = 45e98a05b48ea094c3d1acdf1f46975fad2aea6bbb182f49f0a897f276ef709a9a4cce025bfbac1f7049a497b47306be33e9d5e7230034e730e6de97ce0256f3
+SHA512 (bind-9.18.49.tar.xz) = e5259db8b9fdb3940d4e1d95978514692777a3675fc85a83db30e049d80d8150d10e672d51eeb885a94c6bbd4573ff8fe49248117c24ff155197a24a26b09544
+SHA512 (bind-9.18.49.tar.xz.asc) = eec896781f8bcfcc2b2aba884047d35656a0e9d215b06ca1b69ad7e3c6f4b3730ed8e8067514e6818e97e2c119edb8e5a84855d614c14b7e07a98bc3ec26bfa1

From 4fc3a0f1fa067710c976c55d94c8e869893a8e53 Mon Sep 17 00:00:00 2001
From: Yaakov Selkowitz <yselkowi@redhat.com>
Date: Fri, 12 Jun 2026 16:28:34 -0400
Subject: [PATCH 426/460] Rebuilt for openssl 4.0

---
 bind.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index e1c9b9d..bd07d01 100644
--- a/bind.spec
+++ b/bind.spec
@@ -88,7 +88,7 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it.
 # Updating just bind will cause freeipa-dns-server package to be uninstallable.
 Version:  9.18.49
-Release:  1%{?dist}
+Release:  2%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -949,6 +949,9 @@ fi;
 %endif
 
 %changelog
+* Fri Jun 12 2026 Yaakov Selkowitz <yselkowi@redhat.com> - 32:9.18.49-2
+- Rebuilt for openssl 4.0
+
 * Wed May 20 2026 Petr Menšík <pemensik@redhat.com> - 32:9.18.49-1
 - Update to 9.18.49 (rhbz#2480121)
 

From 88cf659c1d52f2035fe01bbef3f2c508c6584c50 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 17 Jun 2026 21:57:29 +0200
Subject: [PATCH 427/460] Update to 9.18.50 (rhbz#2489833)

Removed Features:

- Remove ineffective TCP fallback after repeated UDP timeouts.

Feature Changes:

- Fall back to TCP on receipt of a UDP response with a mismatched query ID.

Bug Fixes:

- Fix DNS64 owner case after DNAME restart.
- Clear REDIRECT flag when it isn't needed.

This should be final release of BIND 9.18 line. That version is now
marked EOL.

Source: https://downloads.isc.org/isc/bind9/9.18.50/doc/arm/html/notes.html#notes-for-bind-9-18-50
---
 bind.spec | 7 +++++--
 sources   | 4 ++--
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/bind.spec b/bind.spec
index bd07d01..4b6fca8 100644
--- a/bind.spec
+++ b/bind.spec
@@ -87,8 +87,8 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 #
 # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it.
 # Updating just bind will cause freeipa-dns-server package to be uninstallable.
-Version:  9.18.49
-Release:  2%{?dist}
+Version:  9.18.50
+Release:  1%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -949,6 +949,9 @@ fi;
 %endif
 
 %changelog
+* Wed Jun 17 2026 Petr Menšík <pemensik@redhat.com> - 32:9.18.50-1
+- Update to 9.18.50 (rhbz#2489833)
+
 * Fri Jun 12 2026 Yaakov Selkowitz <yselkowi@redhat.com> - 32:9.18.49-2
 - Rebuilt for openssl 4.0
 
diff --git a/sources b/sources
index ce795fc..9f75241 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.18.49.tar.xz) = e5259db8b9fdb3940d4e1d95978514692777a3675fc85a83db30e049d80d8150d10e672d51eeb885a94c6bbd4573ff8fe49248117c24ff155197a24a26b09544
-SHA512 (bind-9.18.49.tar.xz.asc) = eec896781f8bcfcc2b2aba884047d35656a0e9d215b06ca1b69ad7e3c6f4b3730ed8e8067514e6818e97e2c119edb8e5a84855d614c14b7e07a98bc3ec26bfa1
+SHA512 (bind-9.18.50.tar.xz) = 5ae70c95f19868f41fd609bf34a908c38769401ee5b89e4782b94081032a579c00ba9010b2feb2789a95cfd12289cfe250e6488b3b47ff666bfa8cd7edf74d43
+SHA512 (bind-9.18.50.tar.xz.asc) = 41df6df786cd33055a3fd6632ffd2968d6600e314140c547bba3452ec9f7726f44df27c3bd53a5a937ad11407d7391641e0b7b1aff7ebf87f25c65e2a76707b6

From c5a273aaa5fd90e6eb9a231b4aa0e202a0dd805a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 15 Jun 2026 16:52:42 +0200
Subject: [PATCH 428/460] Remove /etc/rwtab from the package

---
 bind.spec   | 6 +-----
 named.rwtab | 6 ------
 2 files changed, 1 insertion(+), 11 deletions(-)
 delete mode 100644 named.rwtab

diff --git a/bind.spec b/bind.spec
index 4b6fca8..b4f8094 100644
--- a/bind.spec
+++ b/bind.spec
@@ -113,7 +113,6 @@ Source37: named.service
 Source38: named-chroot.service
 Source41: setup-named-chroot.sh
 Source42: generate-rndc-key.sh
-Source43: named.rwtab
 Source44: named-chroot-setup.service
 Source46: named-setup-rndc.service
 Source48: setup-named-softhsm.sh
@@ -677,9 +676,6 @@ mkdir -p ${RPM_BUILD_ROOT}%{_tmpfilesdir}
 install -p -m 644 %{SOURCE35} ${RPM_BUILD_ROOT}%{_tmpfilesdir}/named.conf
 install -p -m 644 %{SOURCE51} ${RPM_BUILD_ROOT}%{_tmpfilesdir}/%{name}-chroot.conf
 
-mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/rwtab.d
-install -p -m 644 %{SOURCE43} ${RPM_BUILD_ROOT}%{_sysconfdir}/rwtab.d/named
-
 %post
 %?ldconfig
 if [ "$1" -eq 1 ]; then
@@ -773,7 +769,6 @@ fi;
 %config(noreplace) %attr(0644,root,named) %{_sysconfdir}/named.ca
 %config(noreplace) %{_sysconfdir}/logrotate.d/named
 %{_tmpfilesdir}/named.conf
-%{_sysconfdir}/rwtab.d/named
 %{_unitdir}/named.service
 %{_unitdir}/named-setup-rndc.service
 %{_sysusersdir}/named.conf
@@ -951,6 +946,7 @@ fi;
 %changelog
 * Wed Jun 17 2026 Petr Menšík <pemensik@redhat.com> - 32:9.18.50-1
 - Update to 9.18.50 (rhbz#2489833)
+- Remove rwtab files
 
 * Fri Jun 12 2026 Yaakov Selkowitz <yselkowi@redhat.com> - 32:9.18.49-2
 - Rebuilt for openssl 4.0
diff --git a/named.rwtab b/named.rwtab
deleted file mode 100644
index 2cb3a41..0000000
--- a/named.rwtab
+++ /dev/null
@@ -1,6 +0,0 @@
-dirs    /var/named
-
-files	/var/named/named.ca
-files	/var/named/named.empty
-files	/var/named/named.localhost
-files	/var/named/named.loopback

From a166e83cd089c6181cb2c46693b1e9797aae149c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 21 Apr 2026 14:25:50 +0200
Subject: [PATCH 429/460] Prepare devel subpackage installable multiple times

Only bind-dyndb-ldap uses devel package. Move includes and libraries to
contain major version. That should allow to install both bind9.18-devel
and bind9.20-devel at the same time. Needed to build multiple
bind-dyndb-ldap plugin versions for different variants.

Adjusted to bind 9.18 main component.
---
 bind.spec | 63 +++++++++++++++++++++++++++++++++++++++----------------
 1 file changed, 45 insertions(+), 18 deletions(-)

diff --git a/bind.spec b/bind.spec
index b4f8094..6856c08 100644
--- a/bind.spec
+++ b/bind.spec
@@ -48,6 +48,16 @@
 ## The order of libs is important. See lib/Makefile.in for details
 %define bind_export_libs isc dns isccfg irs
 %{!?_export_dir:%global _export_dir /bind9-export/}
+
+%define major_ver() %{lua: \
+  local ver = rpm.expand("%{1}"); \
+  local s, e; \
+  s, e = string.find(ver, "^%d+[.]%d+"); \
+  if (s and e) then \
+    print(string.sub(ver, s, e)); \
+  end; \
+}
+
 # libisc-nosym requires to be linked with unresolved symbols
 # When libisc-nosym linking is fixed, it can be defined to 1
 # Visit https://bugzilla.redhat.com/show_bug.cgi?id=1540300
@@ -88,7 +98,7 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it.
 # Updating just bind will cause freeipa-dns-server package to be uninstallable.
 Version:  9.18.50
-Release:  1%{?dist}
+Release:  2%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -335,6 +345,13 @@ in HTML and PDF format.
 
 %endif
 
+# Extract major version 9.x
+%global mver %{major_ver %{version}}
+
+# customize include directory
+%global bind_include %{_includedir}/bind%{mver}
+
+
 %prep
 %if 0%{?fedora}
 # RHEL does not yet support this verification
@@ -399,7 +416,7 @@ export LIBDIR_SUFFIX
   --localstatedir=%{_var} \
   --with-pic \
   --disable-static \
-  --includedir=%{_includedir}/bind9 \
+  --includedir=%{bind_include} \
   --with-tuning=large \
   --with-libidn2 \
 %if %{with GEOIP2}
@@ -594,6 +611,12 @@ ln -s ../bin/{named-checkconf,named-checkzone,named-compilezone} %{buildroot}%{_
 # Remove libtool .la files:
 find ${RPM_BUILD_ROOT}/%{_libdir} -name '*.la' -exec '/bin/rm' '-f' '{}' ';';
 
+pushd ${RPM_BUILD_ROOT}/%{_libdir}
+  for LIB in isccc ns dns isc isccfg irs bind9; do
+    mv "lib${LIB}.so" "lib${LIB}-%{mver}.so"
+  done
+popd
+
 # 9.16.4 installs even manual pages for tools not generated
 %if %{without DNSTAP}
 rm -f ${RPM_BUILD_ROOT}%{_mandir}/man1/dnstap-read.1* || true
@@ -876,22 +899,23 @@ fi;
 %{_mandir}/man1/dnssec*.1*
 
 %files devel
-%{_libdir}/libbind9.so
-%{_libdir}/libisccc.so
-%{_libdir}/libns.so
-%{_libdir}/libdns.so
-%{_libdir}/libirs.so
-%{_libdir}/libisc.so
-%{_libdir}/libisccfg.so
-%dir %{_includedir}/bind9
-%{_includedir}/bind9/bind9
-%{_includedir}/bind9/isccc
-%{_includedir}/bind9/ns
-%{_includedir}/bind9/dns
-%{_includedir}/bind9/dst
-%{_includedir}/bind9/irs
-%{_includedir}/bind9/isc
-%{_includedir}/bind9/isccfg
+%{_libdir}/libbind9-%{mver}.so
+%{_libdir}/libisccc-%{mver}.so
+%{_libdir}/libns-%{mver}.so
+%{_libdir}/libdns-%{mver}.so
+%{_libdir}/libisc-%{mver}.so
+%{_libdir}/libisccfg-%{mver}.so
+%{_libdir}/libirs-%{mver}.so
+%dir %{bind_include}
+%{bind_include}/isccc
+%{bind_include}/ns
+%{bind_include}/bind9
+%{bind_include}/dns
+%{bind_include}/dst
+%{bind_include}/irs
+%{bind_include}/isc
+%{bind_include}/isccfg
+%{bind_include}/bind9
 
 %files chroot
 %config(noreplace) %{_sysconfdir}/named-chroot.files
@@ -944,6 +968,9 @@ fi;
 %endif
 
 %changelog
+* Wed Jun 17 2026 Petr Menšík <pemensik@redhat.com> - 32:9.18.50-2
+- Prepare devel subpackage installable multiple times
+
 * Wed Jun 17 2026 Petr Menšík <pemensik@redhat.com> - 32:9.18.50-1
 - Update to 9.18.50 (rhbz#2489833)
 - Remove rwtab files

From 7911863b8994d2b5fc3f45a43c88660215d4813b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 30 Apr 2026 19:49:10 +0200
Subject: [PATCH 430/460] Make binaries contain minor version

---
 ...ble-PROGRAM_SUFFIX-in-install-target.patch |  61 +++++++++
 bind.spec                                     | 126 ++++++++++--------
 2 files changed, 128 insertions(+), 59 deletions(-)
 create mode 100644 0001-Use-variable-PROGRAM_SUFFIX-in-install-target.patch

diff --git a/0001-Use-variable-PROGRAM_SUFFIX-in-install-target.patch b/0001-Use-variable-PROGRAM_SUFFIX-in-install-target.patch
new file mode 100644
index 0000000..a6e700a
--- /dev/null
+++ b/0001-Use-variable-PROGRAM_SUFFIX-in-install-target.patch
@@ -0,0 +1,61 @@
+From 31bd3a0996a85c0fced0c6ace3da1241b30dc397 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
+Date: Thu, 30 Apr 2026 17:28:40 +0200
+Subject: [PATCH] Use variable PROGRAM_SUFFIX in install target
+
+--program-suffix is handled by configure itself. But some makefile rules
+need to know it by a special value. Provide that to make multiple
+versions installable together on a single system.
+---
+ Makefile.top            | 1 +
+ bin/check/Makefile.am   | 6 +++---
+ bin/confgen/Makefile.am | 6 +++---
+ 3 files changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/Makefile.top b/Makefile.top
+index e186d15..91c076b 100644
+--- a/Makefile.top
++++ b/Makefile.top
+@@ -14,6 +14,7 @@ AM_CPPFLAGS =					\
+ AM_LDFLAGS =					\
+ 	$(STD_LDFLAGS)
+ LDADD =
++PROGRAM_SUFFIX =
+ 
+ if HOST_MACOS
+ AM_LDFLAGS +=					\
+diff --git a/bin/check/Makefile.am b/bin/check/Makefile.am
+index 8f63c35..36f232c 100644
+--- a/bin/check/Makefile.am
++++ b/bin/check/Makefile.am
+@@ -27,8 +27,8 @@ LDADD +=			\
+ bin_PROGRAMS = named-checkconf named-checkzone
+ 
+ install-exec-hook:
+-	ln -f $(DESTDIR)$(bindir)/named-checkzone \
+-	      $(DESTDIR)$(bindir)/named-compilezone
++	ln -f $(DESTDIR)$(bindir)/named-checkzone$(PROGRAM_SUFFIX) \
++	      $(DESTDIR)$(bindir)/named-compilezone$(PROGRAM_SUFFIX)
+ 
+ uninstall-hook:
+-	-rm -f $(DESTDIR)$(bindir)/named-compilezone
++	-rm -f $(DESTDIR)$(bindir)/named-compilezone$(PROGRAM_SUFFIX)
+diff --git a/bin/confgen/Makefile.am b/bin/confgen/Makefile.am
+index c1dca43..fe86dd7 100644
+--- a/bin/confgen/Makefile.am
++++ b/bin/confgen/Makefile.am
+@@ -23,8 +23,8 @@ libconfgen_la_SOURCES =		\
+ sbin_PROGRAMS = tsig-keygen rndc-confgen
+ 
+ install-exec-hook:
+-	ln -f $(DESTDIR)$(sbindir)/tsig-keygen \
+-	      $(DESTDIR)$(sbindir)/ddns-confgen
++	ln -f $(DESTDIR)$(sbindir)/tsig-keygen$(PROGRAM_SUFFIX) \
++	      $(DESTDIR)$(sbindir)/ddns-confgen$(PROGRAM_SUFFIX)
+ 
+ uninstall-hook:
+-	-rm -f $(DESTDIR)$(sbindir)/ddns-confgen
++	-rm -f $(DESTDIR)$(sbindir)/ddns-confgen$(PROGRAM_SUFFIX)
+-- 
+2.54.0
+
diff --git a/bind.spec b/bind.spec
index 6856c08..2b6eb76 100644
--- a/bind.spec
+++ b/bind.spec
@@ -154,6 +154,8 @@ Patch32: bind-9.18-partial-additional-records.patch
 Patch33: bind-9.18-dig-idn-input-always.patch
 # downstream only too
 Patch34: bind-9.18-dig-idn-input-always-test.patch
+# downstream only, https://redhat.atlassian.net/browse/IDM-6189
+Patch35: 0001-Use-variable-PROGRAM_SUFFIX-in-install-target.patch
 
 %{?systemd_ordering}
 # https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers
@@ -351,6 +353,9 @@ in HTML and PDF format.
 # customize include directory
 %global bind_include %{_includedir}/bind%{mver}
 
+# use this suffix for binaries
+%global program_suffix -%{mver}
+
 
 %prep
 %if 0%{?fedora}
@@ -419,6 +424,7 @@ export LIBDIR_SUFFIX
   --includedir=%{bind_include} \
   --with-tuning=large \
   --with-libidn2 \
+  --program-suffix=%{program_suffix} \
 %if %{with GEOIP2}
   --with-maxminddb \
 %endif
@@ -444,7 +450,7 @@ export LIBDIR_SUFFIX
 %endif
   --enable-fixed-rrset \
   --enable-full-report \
-  CPPFLAGS="$CPPFLAGS" \
+  CPPFLAGS="$CPPFLAGS" PROGRAM_SUFFIX="%{program_suffix}" \
 ;
 %if %{with DNSTAP}
   pushd lib
@@ -461,7 +467,7 @@ fmtutil-user --listcfg || :
 fmtutil-user --missing || :
 %endif
 
-%make_build
+%make_build PROGRAM_SUFFIX="%{program_suffix}"
 
 %if %{with DOC}
   make doc
@@ -576,7 +582,7 @@ touch ${RPM_BUILD_ROOT}/%{chroot_prefix}%{_sysconfdir}/named.conf
 #end chroot
 
 pushd build
-%make_install
+%make_install PROGRAM_SUFFIX="%{program_suffix}"
 popd
 
 # Remove unwanted files
@@ -592,11 +598,10 @@ install -m 644 %{SOURCE46} ${RPM_BUILD_ROOT}%{_unitdir}
 mkdir -p ${RPM_BUILD_ROOT}%{_sysusersdir}
 install -m 644 %{SOURCE50} ${RPM_BUILD_ROOT}%{_sysusersdir}/named.conf
 
-mkdir -p ${RPM_BUILD_ROOT}%{_libexecdir}
-install -m 755 %{SOURCE41} ${RPM_BUILD_ROOT}%{_libexecdir}/setup-named-chroot.sh
-install -m 755 %{SOURCE42} ${RPM_BUILD_ROOT}%{_libexecdir}/generate-rndc-key.sh
-
-install -m 755 %{SOURCE48} ${RPM_BUILD_ROOT}%{_libexecdir}/setup-named-softhsm.sh
+mkdir -p ${RPM_BUILD_ROOT}%{_libexecdir}/%{name}
+install -m 755 %{SOURCE41} ${RPM_BUILD_ROOT}%{_libexecdir}/%{name}/setup-named-chroot.sh
+install -m 755 %{SOURCE42} ${RPM_BUILD_ROOT}%{_libexecdir}/%{name}/generate-rndc-key.sh
+install -m 755 %{SOURCE48} ${RPM_BUILD_ROOT}%{_libexecdir}/%{name}/setup-named-softhsm.sh
 
 install -m 644 %SOURCE3 ${RPM_BUILD_ROOT}/etc/logrotate.d/named
 mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/sysconfig
@@ -619,17 +624,20 @@ popd
 
 # 9.16.4 installs even manual pages for tools not generated
 %if %{without DNSTAP}
-rm -f ${RPM_BUILD_ROOT}%{_mandir}/man1/dnstap-read.1* || true
+rm -f ${RPM_BUILD_ROOT}%{_mandir}/man1/dnstap-read%{program_suffix}.1* || true
 %endif
 %if %{without LMDB}
-rm -f ${RPM_BUILD_ROOT}%{_mandir}/man8/named-nzd2nzf.8* || true
+rm -f ${RPM_BUILD_ROOT}%{_mandir}/man8/named-nzd2nzf%{program_suffix}.8* || true
 %endif
 
 pushd ${RPM_BUILD_ROOT}%{_mandir}/man8
-ln -s ddns-confgen.8.gz tsig-keygen.8.gz
+ln -s ddns-confgen%{program_suffix}.8.gz tsig-keygen%{program_suffix}.8.gz
 popd
 pushd ${RPM_BUILD_ROOT}%{_mandir}/man1
-ln -s named-checkzone.1.gz named-compilezone.1.gz
+ln -s named-checkzone%{program_suffix}.1.gz named-compilezone%{program_suffix}.1.gz
+popd
+pushd ${RPM_BUILD_ROOT}%{_mandir}/man5
+  mv named.conf%{program_suffix}.5.gz named.conf.5.gz
 popd
 
 %if %{with DOC}
@@ -657,7 +665,7 @@ cp -p build/doc/arm/_build/latex/Bv9ARM.pdf ${RPM_BUILD_ROOT}%{_pkgdocdir}
 touch ${RPM_BUILD_ROOT}%{_localstatedir}/log/named.log
 
 # configuration files:
-install -m 640 %{SOURCE16} ${RPM_BUILD_ROOT}%{_sysconfdir}/named.conf
+install -m 640 %{SOURCE16} ${RPM_BUILD_ROOT}%{_sysconfdir}/named%{program_suffix}.conf
 touch ${RPM_BUILD_ROOT}%{_sysconfdir}/rndc.{key,conf}
 install -m 644 %{SOURCE27} ${RPM_BUILD_ROOT}%{_sysconfdir}/named.root.key
 install -m 644 %{SOURCE36} ${RPM_BUILD_ROOT}%{_sysconfdir}/trusted-key.key
@@ -696,7 +704,7 @@ done
 :;
 
 mkdir -p ${RPM_BUILD_ROOT}%{_tmpfilesdir}
-install -p -m 644 %{SOURCE35} ${RPM_BUILD_ROOT}%{_tmpfilesdir}/named.conf
+install -p -m 644 %{SOURCE35} ${RPM_BUILD_ROOT}%{_tmpfilesdir}/%{name}.conf
 install -p -m 644 %{SOURCE51} ${RPM_BUILD_ROOT}%{_tmpfilesdir}/%{name}-chroot.conf
 
 %post
@@ -791,30 +799,30 @@ fi;
 %config(noreplace) %attr(0644,root,named) %{_sysconfdir}/named.root.key
 %config(noreplace) %attr(0644,root,named) %{_sysconfdir}/named.ca
 %config(noreplace) %{_sysconfdir}/logrotate.d/named
-%{_tmpfilesdir}/named.conf
+%{_tmpfilesdir}/%{name}.conf
 %{_unitdir}/named.service
 %{_unitdir}/named-setup-rndc.service
-%{_sysusersdir}/named.conf
-%{_bindir}/named-journalprint
-%{_bindir}/named-checkconf
-%{_bindir}/named-rrchecker
-%{_bindir}/mdig
-%{_sbindir}/named
+%{_sysusersdir}/%{name}.conf
+%{_bindir}/named-journalprint%{program_suffix}
+%{_bindir}/named-checkconf%{program_suffix}
+%{_bindir}/named-rrchecker%{program_suffix}
+%{_bindir}/mdig%{program_suffix}
+%{_sbindir}/named%{program_suffix}
 %{_sbindir}/rndc*
 %if "%{_sbindir}" != "%{_bindir}"
-%{_sbindir}/named-checkconf
+%{_sbindir}/named-checkconf%{program_suffix}
 %endif
 %{_libexecdir}/generate-rndc-key.sh
 %{_libexecdir}/setup-named-softhsm.sh
-%{_mandir}/man1/mdig.1*
-%{_mandir}/man1/named-rrchecker.1*
+%{_mandir}/man1/mdig%{program_suffix}.1*
+%{_mandir}/man1/named-rrchecker%{program_suffix}.1*
 %{_mandir}/man5/named.conf.5*
-%{_mandir}/man5/rndc.conf.5*
-%{_mandir}/man8/rndc.8*
-%{_mandir}/man8/named.8*
-%{_mandir}/man1/named-checkconf.1*
-%{_mandir}/man8/rndc-confgen.8*
-%{_mandir}/man1/named-journalprint.1*
+%{_mandir}/man5/rndc.conf%{program_suffix}.5*
+%{_mandir}/man8/rndc%{program_suffix}.8*
+%{_mandir}/man8/named%{program_suffix}.8*
+%{_mandir}/man1/named-checkconf%{program_suffix}.1*
+%{_mandir}/man8/rndc-confgen%{program_suffix}.8*
+%{_mandir}/man1/named-journalprint%{program_suffix}.1*
 %{_mandir}/man8/filter-*.8.gz
 %doc README.md named.conf.default
 %doc sample/
@@ -822,7 +830,7 @@ fi;
 # Hide configuration
 %defattr(0640,root,named,0750)
 %dir %{_sysconfdir}/named
-%config(noreplace) %verify(not link) %{_sysconfdir}/named.conf
+%config(noreplace) %verify(not link) %{_sysconfdir}/named%{program_suffix}.conf
 %config(noreplace) %verify(not link) %{_sysconfdir}/named.rfc1912.zones
 %defattr(0660,root,named,01770)
 %dir %{_localstatedir}/named
@@ -858,40 +866,40 @@ fi;
 %license COPYRIGHT
 
 %files utils
-%{_bindir}/dig
-%{_bindir}/delv
-%{_bindir}/host
-%{_bindir}/nslookup
-%{_bindir}/nsupdate
-%{_bindir}/arpaname
-%{_sbindir}/ddns-confgen
-%{_sbindir}/tsig-keygen
-%{_bindir}/nsec3hash
-%{_bindir}/named-checkzone
-%{_bindir}/named-compilezone
+%{_bindir}/dig%{program_suffix}
+%{_bindir}/delv%{program_suffix}
+%{_bindir}/host%{program_suffix}
+%{_bindir}/nslookup%{program_suffix}
+%{_bindir}/nsupdate%{program_suffix}
+%{_bindir}/arpaname%{program_suffix}
+%{_sbindir}/ddns-confgen%{program_suffix}
+%{_sbindir}/tsig-keygen%{program_suffix}
+%{_bindir}/nsec3hash%{program_suffix}
+%{_bindir}/named-checkzone%{program_suffix}
+%{_bindir}/named-compilezone%{program_suffix}
 %if "%{_sbindir}" != "%{_bindir}"
-%{_sbindir}/named-checkzone
-%{_sbindir}/named-compilezone
+%{_sbindir}/named-checkzone%{program_suffix}
+%{_sbindir}/named-compilezone%{program_suffix}
 %endif
 %if %{with DNSTAP}
-%{_bindir}/dnstap-read
-%{_mandir}/man1/dnstap-read.1*
+%{_bindir}/dnstap-read%{program_suffix}
+%{_mandir}/man1/dnstap-read%{program_suffix}.1*
 %endif
 %if %{with LMDB}
-%{_bindir}/named-nzd2nzf
-%{_mandir}/man1/named-nzd2nzf.1*
+%{_bindir}/named-nzd2nzf%{program_suffix}
+%{_mandir}/man1/named-nzd2nzf%{program_suffix}.1*
 %endif
-%{_mandir}/man1/host.1*
-%{_mandir}/man1/nsupdate.1*
-%{_mandir}/man1/dig.1*
-%{_mandir}/man1/delv.1*
-%{_mandir}/man1/nslookup.1*
-%{_mandir}/man1/arpaname.1*
-%{_mandir}/man8/ddns-confgen.8*
-%{_mandir}/man8/tsig-keygen.8*
-%{_mandir}/man1/nsec3hash.1*
-%{_mandir}/man1/named-checkzone.1*
-%{_mandir}/man1/named-compilezone.1*
+%{_mandir}/man1/host%{program_suffix}.1*
+%{_mandir}/man1/nsupdate%{program_suffix}.1*
+%{_mandir}/man1/dig%{program_suffix}.1*
+%{_mandir}/man1/delv%{program_suffix}.1*
+%{_mandir}/man1/nslookup%{program_suffix}.1*
+%{_mandir}/man1/arpaname%{program_suffix}.1*
+%{_mandir}/man8/ddns-confgen%{program_suffix}.8*
+%{_mandir}/man8/tsig-keygen%{program_suffix}.8*
+%{_mandir}/man1/nsec3hash%{program_suffix}.1*
+%{_mandir}/man1/named-checkzone%{program_suffix}.1*
+%{_mandir}/man1/named-compilezone%{program_suffix}.1*
 %{_sysconfdir}/trusted-key.key
 
 %files dnssec-utils

From 743cc89bef3cab7a83d58c9763800e50ac717fe6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 30 Apr 2026 19:49:43 +0200
Subject: [PATCH 431/460] Use subdirectory in helper services too

Fixed with actually building version
---
 bind.spec                  | 30 ++++++++++++++++--------------
 named-chroot-setup.service |  4 ++--
 named-setup-rndc.service   |  2 +-
 3 files changed, 19 insertions(+), 17 deletions(-)

diff --git a/bind.spec b/bind.spec
index 2b6eb76..4950e2f 100644
--- a/bind.spec
+++ b/bind.spec
@@ -590,23 +590,25 @@ rm -f ${RPM_BUILD_ROOT}/etc/bind.keys
 
 # Systemd unit files
 mkdir -p ${RPM_BUILD_ROOT}%{_unitdir}
-install -m 644 %{SOURCE37} ${RPM_BUILD_ROOT}%{_unitdir}
-install -m 644 %{SOURCE38} ${RPM_BUILD_ROOT}%{_unitdir}
-install -m 644 %{SOURCE44} ${RPM_BUILD_ROOT}%{_unitdir}
-install -m 644 %{SOURCE46} ${RPM_BUILD_ROOT}%{_unitdir}
+install -p -m 644 %{SOURCE37} ${RPM_BUILD_ROOT}%{_unitdir}
+install -p -m 644 %{SOURCE38} ${RPM_BUILD_ROOT}%{_unitdir}
+install -p -m 644 %{SOURCE44} ${RPM_BUILD_ROOT}%{_unitdir}
+install -p -m 644 %{SOURCE46} ${RPM_BUILD_ROOT}%{_unitdir}
+
+sed -e "s|\%{name}|%{name}|" -i ${RPM_BUILD_ROOT}%{_unitdir}/named-*.service
 
 mkdir -p ${RPM_BUILD_ROOT}%{_sysusersdir}
-install -m 644 %{SOURCE50} ${RPM_BUILD_ROOT}%{_sysusersdir}/named.conf
+install -p -m 644 %{SOURCE50} ${RPM_BUILD_ROOT}%{_sysusersdir}/%{name}.conf
 
 mkdir -p ${RPM_BUILD_ROOT}%{_libexecdir}/%{name}
-install -m 755 %{SOURCE41} ${RPM_BUILD_ROOT}%{_libexecdir}/%{name}/setup-named-chroot.sh
-install -m 755 %{SOURCE42} ${RPM_BUILD_ROOT}%{_libexecdir}/%{name}/generate-rndc-key.sh
-install -m 755 %{SOURCE48} ${RPM_BUILD_ROOT}%{_libexecdir}/%{name}/setup-named-softhsm.sh
+install -p -m 755 %{SOURCE41} ${RPM_BUILD_ROOT}%{_libexecdir}/%{name}/setup-named-chroot.sh
+install -p -m 755 %{SOURCE42} ${RPM_BUILD_ROOT}%{_libexecdir}/%{name}/generate-rndc-key.sh
+install -p -m 755 %{SOURCE48} ${RPM_BUILD_ROOT}%{_libexecdir}/%{name}/setup-named-softhsm.sh
 
 install -m 644 %SOURCE3 ${RPM_BUILD_ROOT}/etc/logrotate.d/named
 mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/sysconfig
-install -m 644 %{SOURCE1} ${RPM_BUILD_ROOT}%{_sysconfdir}/sysconfig/named
-install -m 644 %{SOURCE49} ${RPM_BUILD_ROOT}%{_sysconfdir}/named-chroot.files
+install -p -m 644 %{SOURCE1} ${RPM_BUILD_ROOT}%{_sysconfdir}/sysconfig/named
+install -p -m 644 %{SOURCE49} ${RPM_BUILD_ROOT}%{_sysconfdir}/named-chroot.files
 
 %if "%{_sbindir}" != "%{_bindir}"
 # Compatibility with previous major versions, only for selected binaries
@@ -637,7 +639,7 @@ pushd ${RPM_BUILD_ROOT}%{_mandir}/man1
 ln -s named-checkzone%{program_suffix}.1.gz named-compilezone%{program_suffix}.1.gz
 popd
 pushd ${RPM_BUILD_ROOT}%{_mandir}/man5
-  mv named.conf%{program_suffix}.5.gz named.conf.5.gz
+  mv named.conf%{program_suffix}.5 named.conf.5
 popd
 
 %if %{with DOC}
@@ -812,8 +814,8 @@ fi;
 %if "%{_sbindir}" != "%{_bindir}"
 %{_sbindir}/named-checkconf%{program_suffix}
 %endif
-%{_libexecdir}/generate-rndc-key.sh
-%{_libexecdir}/setup-named-softhsm.sh
+%{_libexecdir}/%{name}/generate-rndc-key.sh
+%{_libexecdir}/%{name}/setup-named-softhsm.sh
 %{_mandir}/man1/mdig%{program_suffix}.1*
 %{_mandir}/man1/named-rrchecker%{program_suffix}.1*
 %{_mandir}/man5/named.conf.5*
@@ -929,7 +931,7 @@ fi;
 %config(noreplace) %{_sysconfdir}/named-chroot.files
 %{_unitdir}/named-chroot.service
 %{_unitdir}/named-chroot-setup.service
-%{_libexecdir}/setup-named-chroot.sh
+%{_libexecdir}/%{name}/setup-named-chroot.sh
 %{_tmpfilesdir}/%{name}-chroot.conf
 %defattr(0664,root,named,-)
 %ghost %dev(c,1,3) %verify(not mtime) %{chroot_prefix}/dev/null
diff --git a/named-chroot-setup.service b/named-chroot-setup.service
index 237a909..1aae6e4 100644
--- a/named-chroot-setup.service
+++ b/named-chroot-setup.service
@@ -8,5 +8,5 @@ After=named-setup-rndc.service
 [Service]
 Type=oneshot
 RemainAfterExit=yes
-ExecStart=/usr/libexec/setup-named-chroot.sh /var/named/chroot on /etc/named-chroot.files
-ExecStop=/usr/libexec/setup-named-chroot.sh /var/named/chroot off /etc/named-chroot.files
+ExecStart=/usr/libexec/%{name}/setup-named-chroot.sh /var/named/chroot on /etc/named-chroot.files
+ExecStop=/usr/libexec/%{name}/setup-named-chroot.sh /var/named/chroot off /etc/named-chroot.files
diff --git a/named-setup-rndc.service b/named-setup-rndc.service
index ff85e3c..9abab08 100644
--- a/named-setup-rndc.service
+++ b/named-setup-rndc.service
@@ -4,4 +4,4 @@ Description=Generate rndc key for BIND (DNS)
 [Service]
 Type=oneshot
 
-ExecStart=/usr/libexec/generate-rndc-key.sh
+ExecStart=/usr/libexec/%{name}/generate-rndc-key.sh

From 3c1d216595d8820d5a7347a6ab72df8a5d1f7fb5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 30 Apr 2026 20:30:26 +0200
Subject: [PATCH 432/460] Move binaries to versioned executables spec bump

Only bump release. Provide some explanation in changelog.
bind-chroot package remains conflicting and can be installed only once.
---
 bind.spec | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/bind.spec b/bind.spec
index 4950e2f..61844a0 100644
--- a/bind.spec
+++ b/bind.spec
@@ -980,6 +980,10 @@ fi;
 %changelog
 * Wed Jun 17 2026 Petr Menšík <pemensik@redhat.com> - 32:9.18.50-2
 - Prepare devel subpackage installable multiple times
+- Move binaries to versioned executables in main package, utils and dnssec-utils subpackages
+- Use alternatives symlinks to provide original names
+- Allow installation of multiple major versions at the same time
+- chroot package still conflicts, might be fixed later
 
 * Wed Jun 17 2026 Petr Menšík <pemensik@redhat.com> - 32:9.18.50-1
 - Update to 9.18.50 (rhbz#2489833)

From 8d6979fcf3db0b078819ba7a7c8b94e2407a5292 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 15 May 2026 16:00:53 +0200
Subject: [PATCH 433/460] Update systemd unit files with %name and
 %program_suffix

Move creation of systemd units into build phase. Replace not only %name,
also program_suffix.

Change services to use template for systemd unit files

To execute correctly systemd services, make them templates fixed at the
build time. Still conflicts with potential alternatives.

Solve also filter plugins to have suffix also.
---
 bind.spec                                     | 56 +++++++++++--------
 ...p.service => named-chroot-setup.service.in |  0
 ...-chroot.service => named-chroot.service.in |  9 +--
 ...ndc.service => named-setup-rndc.service.in |  0
 named.service                                 | 26 ---------
 named.service.in                              | 28 ++++++++++
 6 files changed, 67 insertions(+), 52 deletions(-)
 rename named-chroot-setup.service => named-chroot-setup.service.in (100%)
 rename named-chroot.service => named-chroot.service.in (57%)
 rename named-setup-rndc.service => named-setup-rndc.service.in (100%)
 delete mode 100644 named.service
 create mode 100644 named.service.in

diff --git a/bind.spec b/bind.spec
index 61844a0..eec79dd 100644
--- a/bind.spec
+++ b/bind.spec
@@ -119,12 +119,12 @@ Source25: named.conf.sample
 Source27: named.root.key
 Source35: bind.tmpfiles.d
 Source36: trusted-key.key
-Source37: named.service
-Source38: named-chroot.service
+Source37: named.service.in
+Source38: named-chroot.service.in
 Source41: setup-named-chroot.sh
 Source42: generate-rndc-key.sh
-Source44: named-chroot-setup.service
-Source46: named-setup-rndc.service
+Source44: named-chroot-setup.service.in
+Source46: named-setup-rndc.service.in
 Source48: setup-named-softhsm.sh
 Source49: named-chroot.files
 Source50: named.sysusers
@@ -355,6 +355,8 @@ in HTML and PDF format.
 
 # use this suffix for binaries
 %global program_suffix -%{mver}
+# preparation scripts directory
+%global bind_libexecdir %{_libexecdir}/%{name}
 
 
 %prep
@@ -475,6 +477,18 @@ fmtutil-user --missing || :
 
 popd # build
 
+# Prepare unit files
+for SERVICEFILE in %{SOURCE37} %{SOURCE38} %{SOURCE44} %{SOURCE46}; do
+  NEWNAME="$(basename -- "$SERVICEFILE" .in)"
+  sed -e "s|%%{program_suffix}|%{program_suffix}|g" \
+      -e "s|%%{name}|%{name}|g" \
+      -e "s|%%{bind_libexecdir}|%{bind_libexecdir}|g" \
+      -e "s|%%{_bindir}|%{_bindir}|g" \
+      -e "s|%%{_sbindir}|%{_sbindir}|g" \
+      "$SERVICEFILE" > "$NEWNAME"
+  touch -r "$SERVICEFILE" "$NEWNAME" # Set change time to time of template
+done
+
 %unit_prepare_build build
 %systemtest_prepare_build build
 
@@ -589,13 +603,8 @@ popd
 rm -f ${RPM_BUILD_ROOT}/etc/bind.keys
 
 # Systemd unit files
-mkdir -p ${RPM_BUILD_ROOT}%{_unitdir}
-install -p -m 644 %{SOURCE37} ${RPM_BUILD_ROOT}%{_unitdir}
-install -p -m 644 %{SOURCE38} ${RPM_BUILD_ROOT}%{_unitdir}
-install -p -m 644 %{SOURCE44} ${RPM_BUILD_ROOT}%{_unitdir}
-install -p -m 644 %{SOURCE46} ${RPM_BUILD_ROOT}%{_unitdir}
-
-sed -e "s|\%{name}|%{name}|" -i ${RPM_BUILD_ROOT}%{_unitdir}/named-*.service
+mkdir -p "${RPM_BUILD_ROOT}%{_unitdir}"
+install -p -m 644 *.service "${RPM_BUILD_ROOT}%{_unitdir}"
 
 mkdir -p ${RPM_BUILD_ROOT}%{_sysusersdir}
 install -p -m 644 %{SOURCE50} ${RPM_BUILD_ROOT}%{_sysusersdir}/%{name}.conf
@@ -605,7 +614,9 @@ install -p -m 755 %{SOURCE41} ${RPM_BUILD_ROOT}%{_libexecdir}/%{name}/setup-name
 install -p -m 755 %{SOURCE42} ${RPM_BUILD_ROOT}%{_libexecdir}/%{name}/generate-rndc-key.sh
 install -p -m 755 %{SOURCE48} ${RPM_BUILD_ROOT}%{_libexecdir}/%{name}/setup-named-softhsm.sh
 
-install -m 644 %SOURCE3 ${RPM_BUILD_ROOT}/etc/logrotate.d/named
+mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/logrotate.d
+install -m 644 %{SOURCE3} ${RPM_BUILD_ROOT}%{_sysconfdir}/logrotate.d/named
+
 mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/sysconfig
 install -p -m 644 %{SOURCE1} ${RPM_BUILD_ROOT}%{_sysconfdir}/sysconfig/named
 install -p -m 644 %{SOURCE49} ${RPM_BUILD_ROOT}%{_sysconfdir}/named-chroot.files
@@ -620,7 +631,11 @@ find ${RPM_BUILD_ROOT}/%{_libdir} -name '*.la' -exec '/bin/rm' '-f' '{}' ';';
 
 pushd ${RPM_BUILD_ROOT}/%{_libdir}
   for LIB in isccc ns dns isc isccfg irs bind9; do
-    mv "lib${LIB}.so" "lib${LIB}-%{mver}.so"
+    mv "lib${LIB}.so" "lib${LIB}%{program_suffix}.so"
+  done
+  for PLUGIN in bind/*.so; do
+    TARGET="$(echo "$PLUGIN" | sed -e "s/\.so$/%{program_suffix}&/")"
+    mv "${PLUGIN}" "${TARGET}"
   done
 popd
 
@@ -633,13 +648,10 @@ rm -f ${RPM_BUILD_ROOT}%{_mandir}/man8/named-nzd2nzf%{program_suffix}.8* || true
 %endif
 
 pushd ${RPM_BUILD_ROOT}%{_mandir}/man8
-ln -s ddns-confgen%{program_suffix}.8.gz tsig-keygen%{program_suffix}.8.gz
+  ln -s ddns-confgen%{program_suffix}.8.gz tsig-keygen%{program_suffix}.8.gz
 popd
 pushd ${RPM_BUILD_ROOT}%{_mandir}/man1
-ln -s named-checkzone%{program_suffix}.1.gz named-compilezone%{program_suffix}.1.gz
-popd
-pushd ${RPM_BUILD_ROOT}%{_mandir}/man5
-  mv named.conf%{program_suffix}.5 named.conf.5
+  ln -s named-checkzone%{program_suffix}.1.gz named-compilezone%{program_suffix}.1.gz
 popd
 
 %if %{with DOC}
@@ -667,7 +679,7 @@ cp -p build/doc/arm/_build/latex/Bv9ARM.pdf ${RPM_BUILD_ROOT}%{_pkgdocdir}
 touch ${RPM_BUILD_ROOT}%{_localstatedir}/log/named.log
 
 # configuration files:
-install -m 640 %{SOURCE16} ${RPM_BUILD_ROOT}%{_sysconfdir}/named%{program_suffix}.conf
+install -m 640 %{SOURCE16} ${RPM_BUILD_ROOT}%{_sysconfdir}/named.conf
 touch ${RPM_BUILD_ROOT}%{_sysconfdir}/rndc.{key,conf}
 install -m 644 %{SOURCE27} ${RPM_BUILD_ROOT}%{_sysconfdir}/named.root.key
 install -m 644 %{SOURCE36} ${RPM_BUILD_ROOT}%{_sysconfdir}/trusted-key.key
@@ -818,21 +830,21 @@ fi;
 %{_libexecdir}/%{name}/setup-named-softhsm.sh
 %{_mandir}/man1/mdig%{program_suffix}.1*
 %{_mandir}/man1/named-rrchecker%{program_suffix}.1*
-%{_mandir}/man5/named.conf.5*
+%{_mandir}/man5/named.conf%{program_suffix}.5*
 %{_mandir}/man5/rndc.conf%{program_suffix}.5*
 %{_mandir}/man8/rndc%{program_suffix}.8*
 %{_mandir}/man8/named%{program_suffix}.8*
 %{_mandir}/man1/named-checkconf%{program_suffix}.1*
 %{_mandir}/man8/rndc-confgen%{program_suffix}.8*
 %{_mandir}/man1/named-journalprint%{program_suffix}.1*
-%{_mandir}/man8/filter-*.8.gz
+%{_mandir}/man8/filter-*%{program_suffix}.8.gz
 %doc README.md named.conf.default
 %doc sample/
 
 # Hide configuration
 %defattr(0640,root,named,0750)
 %dir %{_sysconfdir}/named
-%config(noreplace) %verify(not link) %{_sysconfdir}/named%{program_suffix}.conf
+%config(noreplace) %verify(not link) %{_sysconfdir}/named.conf
 %config(noreplace) %verify(not link) %{_sysconfdir}/named.rfc1912.zones
 %defattr(0660,root,named,01770)
 %dir %{_localstatedir}/named
diff --git a/named-chroot-setup.service b/named-chroot-setup.service.in
similarity index 100%
rename from named-chroot-setup.service
rename to named-chroot-setup.service.in
diff --git a/named-chroot.service b/named-chroot.service.in
similarity index 57%
rename from named-chroot.service
rename to named-chroot.service.in
index 4c38601..f9f2a3e 100644
--- a/named-chroot.service
+++ b/named-chroot.service.in
@@ -12,17 +12,18 @@ After=network.target
 
 [Service]
 Type=forking
+Environment=OPTIONS=
 Environment=NAMEDCONF=/etc/named.conf
 EnvironmentFile=-/etc/sysconfig/named
 Environment=KRB5_KTNAME=/etc/named.keytab
 PIDFile=/var/named/chroot/run/named/named.pid
 
-ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/bin/named-checkconf -t /var/named/chroot -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
-ExecStart=/usr/sbin/named -u named -c ${NAMEDCONF} -t /var/named/chroot $OPTIONS
+ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then %{_bindir}/named-checkconf%{program_suffix} -t /var/named/chroot -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
+ExecStart=%{_sbindir}/named%{program_suffix} -u named -c ${NAMEDCONF} -t /var/named/chroot $OPTIONS
 
-ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
+ExecReload=/bin/sh -c 'if %{_sbindir}/rndc%{program_suffix} null > /dev/null 2>&1; then %{_sbindir}/rndc%{program_suffix} reload; else %{_bindir}/kill -HUP $MAINPID; fi'
 
-ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'
+ExecStop=/bin/sh -c '%{_sbindir}/rndc%{program_suffix} stop > /dev/null 2>&1 || %{_bindir}/kill -TERM $MAINPID'
 
 PrivateTmp=false
 Restart=on-abnormal
diff --git a/named-setup-rndc.service b/named-setup-rndc.service.in
similarity index 100%
rename from named-setup-rndc.service
rename to named-setup-rndc.service.in
diff --git a/named.service b/named.service
deleted file mode 100644
index 5c32fc5..0000000
--- a/named.service
+++ /dev/null
@@ -1,26 +0,0 @@
-[Unit]
-Description=Berkeley Internet Name Domain (DNS)
-Wants=nss-lookup.target
-Wants=named-setup-rndc.service
-Before=nss-lookup.target
-After=named-setup-rndc.service
-After=network.target
-
-[Service]
-Type=forking
-Environment=NAMEDCONF=/etc/named.conf
-EnvironmentFile=-/etc/sysconfig/named
-Environment=KRB5_KTNAME=/etc/named.keytab
-PIDFile=/run/named/named.pid
-
-ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/bin/named-checkconf -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
-ExecStart=/usr/sbin/named -u named -c ${NAMEDCONF} $OPTIONS
-ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
-
-ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'
-
-PrivateTmp=true
-Restart=on-abnormal
-
-[Install]
-WantedBy=multi-user.target
diff --git a/named.service.in b/named.service.in
new file mode 100644
index 0000000..de9a915
--- /dev/null
+++ b/named.service.in
@@ -0,0 +1,28 @@
+[Unit]
+Description=Berkeley Internet Name Domain (DNS)
+Wants=nss-lookup.target
+Wants=named-setup-rndc.service
+Before=nss-lookup.target
+After=named-setup-rndc.service
+After=network.target
+
+[Service]
+Type=forking
+Environment=OPTIONS=
+Environment=NAMEDCONF=/etc/named.conf
+EnvironmentFile=-/etc/sysconfig/named
+Environment=KRB5_KTNAME=/etc/named.keytab
+PIDFile=/run/named/named.pid
+
+ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then %{_sbindir}/named-checkconf%{program_suffix} -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
+ExecStart=%{_sbindir}/named%{program_suffix} -u named -c ${NAMEDCONF} $OPTIONS
+
+ExecReload=/bin/sh -c 'if %{_sbindir}/rndc%{program_suffix} null > /dev/null 2>&1; then %{_sbindir}/rndc%{program_suffix} reload; else %{_bindir}/kill -HUP $MAINPID; fi'
+
+ExecStop=/bin/sh -c '%{_sbindir}/rndc%{program_suffix} stop > /dev/null 2>&1 || %{_bindir}/kill -TERM $MAINPID'
+
+PrivateTmp=true
+Restart=on-abnormal
+
+[Install]
+WantedBy=multi-user.target

From 448bd64587914a981f858b710b60dc69793acf59 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 8 Jun 2026 23:17:32 +0200
Subject: [PATCH 434/460] Seemingly working alternatives including unit files

Support basic systemd unit handling

Fix double inclusion of bind9 include subdirectory

Fix bind-dnssec-utils ghost files

Make permissions match target binaries too.

Do not use alternatives for named-checkzone and named-compilezone

Use alternatives, prefix name with %{upname}-

Add also usage of --initscript %{name}. Not use if named service name
should not be used there instead. Match also remove names.

Define reusable variables with tool names

Use it to define common lists, reuse them multiple times.
Add named-{checkzone,compilezone}. Fix utils man8 typo.
Handle mans and units too.
---
 bind.spec | 320 +++++++++++++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 290 insertions(+), 30 deletions(-)

diff --git a/bind.spec b/bind.spec
index eec79dd..8b0c29c 100644
--- a/bind.spec
+++ b/bind.spec
@@ -36,6 +36,7 @@
   %bcond_with  OPENSSL_ENGINE
 %endif
 
+%{!?manext:%global     manext .gz}
 %{!?_pkgdocdir:%global _pkgdocdir %{_docdir}/%{name}-%{version}}
 %global        bind_dir          /var/named
 %global        chroot_prefix     %{bind_dir}/chroot
@@ -68,6 +69,9 @@
 # lib*.so.X versions of selected libraries no longer provided,
 # lib*-%%{version}-RH.so is provided as an internal implementation detail
 
+# priority of this srpm executables
+%global alternatives_prio 10
+
 # Upstream package name
 %global upname bind
 # Epoch is intentionally missing from Provides to be lower than bind package
@@ -164,6 +168,8 @@ Requires:       coreutils
 Requires(post): shadow-utils
 Requires(post): glibc-common
 Requires(post): grep
+Requires(post):   %{_bindir}/alternatives
+Requires(postun): %{_bindir}/alternatives
 Requires:       %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
 Recommends:     %{name}-utils %{name}-dnssec-utils
 %upname_compat  %{upname}
@@ -255,6 +261,8 @@ Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
 # For compatibility with Debian package
 Provides: dnsutils = %{epoch}:%{version}-%{release}
 Obsoletes: %{name}-pkcs11-utils < 32:9.18.4-2
+Requires(post):   %{_bindir}/alternatives
+Requires(postun): %{_bindir}/alternatives
 %upname_compat %{upname}-utils
 
 %description utils
@@ -273,6 +281,8 @@ Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
 Recommends: %{name}-utils
 Obsoletes: python3-%{name} < 32:9.18.0
 Obsoletes: %{name}-dnssec-doc < 32:9.18.4-2
+Requires(post):   %{_bindir}/alternatives
+Requires(postun): %{_bindir}/alternatives
 %upname_compat %{upname}-dnssec-utils
 
 %description dnssec-utils
@@ -480,6 +490,9 @@ popd # build
 # Prepare unit files
 for SERVICEFILE in %{SOURCE37} %{SOURCE38} %{SOURCE44} %{SOURCE46}; do
   NEWNAME="$(basename -- "$SERVICEFILE" .in)"
+  if ! echo "$NEWNAME" | grep -q -- -chroot; then
+    NEWNAME="$(echo "$NEWNAME" | sed -e "s,^named,%{name},")"
+  fi
   sed -e "s|%%{program_suffix}|%{program_suffix}|g" \
       -e "s|%%{name}|%{name}|g" \
       -e "s|%%{bind_libexecdir}|%{bind_libexecdir}|g" \
@@ -721,8 +734,117 @@ mkdir -p ${RPM_BUILD_ROOT}%{_tmpfilesdir}
 install -p -m 644 %{SOURCE35} ${RPM_BUILD_ROOT}%{_tmpfilesdir}/%{name}.conf
 install -p -m 644 %{SOURCE51} ${RPM_BUILD_ROOT}%{_tmpfilesdir}/%{name}-chroot.conf
 
+
+%if %{with DNSTAP}
+  %global utils_bin1_dnstap  dnstap-read
+%endif
+%if %{with LMDB}
+  %global utils_bin1_lmdb    named-nzd2nzf
+%endif
+
+%global utils_bin1 dig host delv nslookup nsupdate arpaname nsec3hash named-{checkzone,compilezone} %{?utils_bin1_dnstap} %{?utils_bin1_lmdb}
+%global utils_bin8 ddns-confgen tsig-keygen
+%global main_bin8 named rndc{,-confgen}
+%global main_bin1 named{-journalprint,-checkconf,-rrchecker} mdig
+%global dnssec_utils_bin1 dnssec-{cds,dsfromkey,importkey,keyfromlabel,keygen,revoke,verify}
+%global main_man5 named.conf rndc.conf
+%global main_unit named.service named-setup-rndc.service
+%global main_lib filter-{a,aaaa}
+
+# Alternatives touches symlinks targets
+for BIN in %{utils_bin1} %{main_bin1} %{dnssec_utils_bin1}; do
+  install -m 0755 /dev/null ${RPM_BUILD_ROOT}%{_bindir}/${BIN}
+  touch ${RPM_BUILD_ROOT}%{_mandir}/man1/${BIN}.1
+done
+
+for BIN in %{main_bin8}; do
+  install -m 0755 /dev/null ${RPM_BUILD_ROOT}%{_sbindir}/${BIN}
+  touch ${RPM_BUILD_ROOT}%{_mandir}/man8/${BIN}.8
+done
+
+for MAN in %{main_man5}; do
+  touch ${RPM_BUILD_ROOT}%{_mandir}/man5/$MAN.5
+done
+for MAN in %{utils_bin8}; do
+  touch ${RPM_BUILD_ROOT}%{_mandir}/man8/$MAN.8
+done
+
+# named-chroot*.service are missing intentionally now
+# let bind*-chroot conflict
+for UNIT in %{main_unit}; do
+  touch ${RPM_BUILD_ROOT}%{_unitdir}/$UNIT
+done
+
+
+%define altfbin() \\\
+  --follower %{_bindir}/%{1} %{upname}-%{1} %{_bindir}/%{1}%{program_suffix}
+%define altfman() \\\
+  --follower %{_mandir}/man%{2}/%{1}.%{2}%{manext} %{upname}-%{1}.%{2} %{_mandir}/man%{2}/%{1}%{program_suffix}.%{2}%{manext}
+# {1} (_unitdir/)compat-service {2} new-version-specific-service
+%define altfunit() \\\
+  --follower %{_unitdir}/%{1} %{upname}-%{1} %{_unitdir}/%{2}
+
+# {1} (_bindir/)exec-name {2} man-category
+%define altfbinman() \\\
+  --follower %{_bindir}/%{1} %{upname}-%{1} %{_bindir}/%{1}%{program_suffix} \\\
+  --follower %{_mandir}/man%{2}/%{1}.%{2}%{manext} %{upname}-%{1}.%{2} %{_mandir}/man%{2}/%{1}%{program_suffix}.%{2}%{manext}
+
+%define altfsbin() \\\
+  --follower %{_sbindir}/%{1} %{upname}-%{1} %{_sbindir}/%{1}%{program_suffix}
+
+# {1} (_sbindir/)exec-name {2} man-category
+%define altfsbinman() \\\
+  --follower %{_sbindir}/%{1} %{upname}-%{1} %{_sbindir}/%{1}%{program_suffix} \\\
+  --follower %{_mandir}/man%{2}/%{1}.%{2}%{manext} %{upname}-%{1}.%{2} %{_mandir}/man%{2}/%{1}%{program_suffix}.%{2}%{manext}
+
+%define altflibman() \\\
+  --follower %{_libdir}/bind/%{1}.so %{upname}-%{1}.so %{_libdir}/bind/%{1}.so%{program_suffix} \\\
+  --follower %{_mandir}/man%{2}/%{1}.%{2}%{manext} %{upname}-%{1}.%{2} %{_mandir}/man%{2}/%{1}%{program_suffix}.%{2}%{manext}
+
+%define altrmbinman() \
+    BINX="%{_bindir}/%{1}"; \
+    MANX="%{_mandir}/man%{2}/%{1}.%{2}%{?manext}"; \
+    if ! [ -L "$BINX" ] && [ -f "$BINX" ] && [ -x "$BINX" ]; then \
+      rm -f -- "$BINX"; \
+    fi; \
+    if ! [ -L "$MANX" ] && [ -f "$MANX" ]; then \
+      rm -f -- "$MANX"; \
+    fi
+%define altrmsbinman() \
+    BINX="%{_sbindir}/%{1}"; \
+    MANX="%{_mandir}/man%{2}/%{1}.%{2}%{?manext}"; \
+    if ! [ -L "$BINX" ] && [ -f "$BINX" ] && [ -x "$BINX" ]; then \
+      rm -f -- "$BINX"; \
+    fi; \
+    if ! [ -L "$MANX" ] && [ -f "$MANX" ]; then \
+      rm -f -- "$MANX"; \
+    fi
+
+%define altrmlibman() \
+    BINX="%{_libdir}/bind/%{1}.so"; \
+    MANX="%{_mandir}/man%{2}/%{1}.%{2}%{?manext}"; \
+    if ! [ -L "$BINX" ] && [ -f "$BINX" ] && [ -x "$BINX" ]; then \
+      rm -f -- "$BINX"; \
+    fi; \
+    if ! [ -L "$MANX" ] && [ -f "$MANX" ]; then \
+      rm -f -- "$MANX"; \
+    fi
+
+%define altrmman() \
+    MANX="%{_mandir}/man%{2}/%{1}.%{2}%{?manext}"; \
+    if ! [ -L "$MANX" ] && [ -f "$MANX" ]; then \
+      rm -f -- "$MANX"; \
+    fi
+
+%define altrmunit() \
+    UNITX="%{_unitdir}/%{1}" \
+    if ! [ -L "$UNITX" ] && [ -f "$UNITX" ]; then \
+      rm -f -- "$UNITX"; \
+    fi
+
+
 %post
-%?ldconfig
+%{?ldconfig}
 if [ "$1" -eq 1 ]; then
   # Initial installation
   [ -x /sbin/restorecon ] && /sbin/restorecon /etc/rndc.* /etc/named.* >/dev/null 2>&1 ;
@@ -745,17 +867,105 @@ else
     fi
   fi
 fi
-%systemd_post named.service
+%if "%{program_suffix}" != ""
+  ALTS=""
+  for BIN in %{main_bin1}; do
+    ALTS+="%{altfbinman $BIN 1}"
+    %{altrmbinman $BIN 1}
+  done
+  for BIN in %{main_bin8}; do
+    ALTS+="%{altfsbinman $BIN 8}"
+    %{altrmsbinman $BIN 8}
+  done
+  for MAN in %{main_man5}; do
+    %{altrmman $MAN 5}
+    ALTS+="%{altfman $MAN 5}"
+  done
+  for LIB in %{main_lib}; do
+    %{altrmlibman $LIB 8}
+    ALTS+="%{altflibman $LIB 8}"
+  done
+  for UNIT in %{main_unit}; do
+    %{altrmunit $UNIT}
+  done
+  alternatives --install %{_sbindir}/named %{upname}-named %{_sbindir}/named%{program_suffix} %{alternatives_prio} \
+                      %{altfman named 8}                 \
+                      %{altfunit named.service %{name}.service} \
+                      %{altfunit named-setup-rndc.service %{name}-setup-rndc.service} \
+                      --initscript %{name} \
+                      ${ALTS}
+%endif
+%systemd_post %{name}.service
 :;
 
 %preun
 # Package removal, not upgrade
-%systemd_preun named.service
+%systemd_preun %{name}.service
 
 %postun
-%?ldconfig
+%{?ldconfig}
 # Package upgrade, not uninstall
-%systemd_postun_with_restart named.service
+%systemd_postun_with_restart %{name}.service
+%if "%{program_suffix}" != ""
+if [ $1 -eq 0 ] ; then
+  alternatives --remove %{upname}-named %{_sbindir}/named%{program_suffix}
+fi
+%endif
+%end
+
+%post utils
+%if "%{program_suffix}" != ""
+  ALTS=""
+  for BIN in %{utils_bin1}; do
+    %{altrmbinman ${BIN} 1}
+    [ "$BIN" != dig ] && ALTS+="%{altfbinman $BIN 1}"
+  done
+  for BIN in %{utils_bin8}; do
+    %{altrmsbinman ${BIN} 8}
+    ALTS+="%{altfbinman $BIN 8}"
+  done
+  alternatives --install %{_bindir}/dig %{upname}-utils-dig %{_bindir}/dig%{program_suffix} %{alternatives_prio} \
+  %{altfman dig 1}          \
+  ${ALTS}
+%endif
+%end
+
+%postun utils
+%if "%{program_suffix}" != ""
+if [ $1 -eq 0 ] ; then
+  alternatives --remove %{upname}-utils-dig %{_bindir}/dig%{program_suffix}
+fi
+%endif
+%end
+
+%post dnssec-utils
+%if "%{program_suffix}" != ""
+  ALTS=""
+  for BIN in %{dnssec_utils_bin1}; do
+    BINX="%{_bindir}/${BIN}"
+    MANX="%{_mandir}/man1/${BIN}.1%{manext}"
+    if ! [ -L "$BINX" ] && [ -f "$BINX" ] && [ -x "$BINX" ]; then
+      rm -f -- "$BINX"
+    fi
+    if ! [ -L "$MANX" ] && [ -f "$MANX" ]; then
+      rm -f -- "$MANX"
+    fi
+    [ "$BIN" != dnssec-verify ] && ALTS+="%{altfbinman $BIN 1}"
+  done
+  alternatives --install %{_bindir}/dnssec-verify %{upname}-dnssec-utils %{_bindir}/dnssec-verify%{program_suffix} %{alternatives_prio} \
+  %{altfman dnssec-verify 1}          \
+  $ALTS
+%endif
+%end
+
+%postun dnssec-utils
+%if "%{program_suffix}" != ""
+if [ $1 -eq 0 ] ; then
+  alternatives --remove %{upname}-dnssec-utils %{_bindir}/dnssec-verify%{program_suffix}
+fi
+%endif
+%end
+
 
 # Fix permissions on existing device files on upgrade
 %define chroot_fix_devices() \
@@ -807,37 +1017,60 @@ fi;
 # TODO: Move from lib/bind to lib/named, as used by upstream
 # FIXME: current build targets filters into %%_libdir/bind again?
 %dir %{_libdir}/bind
-%{_libdir}/bind/filter*.so
+%{_libdir}/bind/filter-{a,aaaa}%{program_suffix}.so
 %dir %{_libdir}/named
 %config(noreplace) %verify(not md5 size mtime) %{_sysconfdir}/sysconfig/named
 %config(noreplace) %attr(0644,root,named) %{_sysconfdir}/named.root.key
 %config(noreplace) %attr(0644,root,named) %{_sysconfdir}/named.ca
 %config(noreplace) %{_sysconfdir}/logrotate.d/named
 %{_tmpfilesdir}/%{name}.conf
-%{_unitdir}/named.service
-%{_unitdir}/named-setup-rndc.service
+%{_unitdir}/%{name}.service
+%{_unitdir}/%{name}-setup-rndc.service
 %{_sysusersdir}/%{name}.conf
 %{_bindir}/named-journalprint%{program_suffix}
 %{_bindir}/named-checkconf%{program_suffix}
 %{_bindir}/named-rrchecker%{program_suffix}
 %{_bindir}/mdig%{program_suffix}
 %{_sbindir}/named%{program_suffix}
-%{_sbindir}/rndc*
+%{_sbindir}/rndc%{program_suffix}
+%{_sbindir}/rndc-confgen%{program_suffix}
+%ghost %{_unitdir}/named.service
+%ghost %{_unitdir}/named-setup-rndc.service
+%ghost %{_libdir}/bind/filter-{a,aaaa}.so
+%ghost %{_bindir}/named-checkconf
+%ghost %{_bindir}/named-journalprint
+%ghost %{_bindir}/named-rrchecker
+%ghost %{_bindir}/mdig
+%ghost %{_sbindir}/named
+%ghost %{_sbindir}/rndc
+%ghost %{_sbindir}/rndc-confgen
 %if "%{_sbindir}" != "%{_bindir}"
 %{_sbindir}/named-checkconf%{program_suffix}
+%ghost %{_sbindir}/named-checkconf
 %endif
 %{_libexecdir}/%{name}/generate-rndc-key.sh
 %{_libexecdir}/%{name}/setup-named-softhsm.sh
+# man pages
 %{_mandir}/man1/mdig%{program_suffix}.1*
+%{_mandir}/man1/named-checkconf%{program_suffix}.1*
+%{_mandir}/man1/named-journalprint%{program_suffix}.1*
 %{_mandir}/man1/named-rrchecker%{program_suffix}.1*
 %{_mandir}/man5/named.conf%{program_suffix}.5*
 %{_mandir}/man5/rndc.conf%{program_suffix}.5*
 %{_mandir}/man8/rndc%{program_suffix}.8*
 %{_mandir}/man8/named%{program_suffix}.8*
-%{_mandir}/man1/named-checkconf%{program_suffix}.1*
 %{_mandir}/man8/rndc-confgen%{program_suffix}.8*
-%{_mandir}/man1/named-journalprint%{program_suffix}.1*
-%{_mandir}/man8/filter-*%{program_suffix}.8.gz
+%{_mandir}/man8/filter-{a,aaaa}%{program_suffix}.8*
+%ghost %{_mandir}/man1/mdig.1*
+%ghost %{_mandir}/man1/named-checkconf.1*
+%ghost %{_mandir}/man1/named-journalprint.1*
+%ghost %{_mandir}/man1/named-rrchecker.1*
+%ghost %{_mandir}/man5/named.conf.5*
+%ghost %{_mandir}/man5/rndc.conf.5*
+%ghost %{_mandir}/man8/rndc.8*
+%ghost %{_mandir}/man8/named.8*
+%ghost %{_mandir}/man8/rndc-confgen.8*
+%ghost %{_mandir}/man8/filter-{a,aaaa}.8*
 %doc README.md named.conf.default
 %doc sample/
 
@@ -866,7 +1099,7 @@ fi;
 # ^- The default rndc.conf which uses rndc.key is in named's default internal config -
 #    so rndc.conf is not necessary.
 %defattr(-,named,named,-)
-%dir /run/named
+%dir %{_rundir}/named
 
 %files libs
 %{_libdir}/libbind9-%{version}*.so
@@ -880,45 +1113,73 @@ fi;
 %license COPYRIGHT
 
 %files utils
-%{_bindir}/dig%{program_suffix}
+%{_bindir}/arpaname%{program_suffix}
 %{_bindir}/delv%{program_suffix}
+%{_bindir}/dig%{program_suffix}
 %{_bindir}/host%{program_suffix}
+%{_bindir}/nsec3hash%{program_suffix}
 %{_bindir}/nslookup%{program_suffix}
 %{_bindir}/nsupdate%{program_suffix}
-%{_bindir}/arpaname%{program_suffix}
-%{_sbindir}/ddns-confgen%{program_suffix}
-%{_sbindir}/tsig-keygen%{program_suffix}
-%{_bindir}/nsec3hash%{program_suffix}
 %{_bindir}/named-checkzone%{program_suffix}
 %{_bindir}/named-compilezone%{program_suffix}
+%{_sbindir}/ddns-confgen%{program_suffix}
+%{_sbindir}/tsig-keygen%{program_suffix}
+%ghost %{_bindir}/arpaname
+%ghost %{_bindir}/delv
+%ghost %{_bindir}/dig
+%ghost %{_bindir}/host
+%ghost %{_bindir}/nsec3hash
+%ghost %{_bindir}/nslookup
+%ghost %{_bindir}/nsupdate
+%ghost %{_bindir}/named-checkzone
+%ghost %{_bindir}/named-compilezone
+%ghost %{_sbindir}/ddns-confgen
+%ghost %{_sbindir}/tsig-keygen
 %if "%{_sbindir}" != "%{_bindir}"
-%{_sbindir}/named-checkzone%{program_suffix}
-%{_sbindir}/named-compilezone%{program_suffix}
+%{_sbindir}/named-checkzone
+%{_sbindir}/named-compilezone
 %endif
 %if %{with DNSTAP}
 %{_bindir}/dnstap-read%{program_suffix}
 %{_mandir}/man1/dnstap-read%{program_suffix}.1*
+%ghost %{_bindir}/dnstap-read
+%ghost %{_mandir}/man1/dnstap-read.1*
 %endif
 %if %{with LMDB}
 %{_bindir}/named-nzd2nzf%{program_suffix}
 %{_mandir}/man1/named-nzd2nzf%{program_suffix}.1*
+%ghost %{_bindir}/named-nzd2nzf
+%ghost %{_mandir}/man1/named-nzd2nzf.1*
 %endif
-%{_mandir}/man1/host%{program_suffix}.1*
-%{_mandir}/man1/nsupdate%{program_suffix}.1*
-%{_mandir}/man1/dig%{program_suffix}.1*
-%{_mandir}/man1/delv%{program_suffix}.1*
-%{_mandir}/man1/nslookup%{program_suffix}.1*
 %{_mandir}/man1/arpaname%{program_suffix}.1*
-%{_mandir}/man8/ddns-confgen%{program_suffix}.8*
-%{_mandir}/man8/tsig-keygen%{program_suffix}.8*
+%{_mandir}/man1/delv%{program_suffix}.1*
+%{_mandir}/man1/dig%{program_suffix}.1*
+%{_mandir}/man1/host%{program_suffix}.1*
+%{_mandir}/man1/nslookup%{program_suffix}.1*
+%{_mandir}/man1/nsupdate%{program_suffix}.1*
 %{_mandir}/man1/nsec3hash%{program_suffix}.1*
 %{_mandir}/man1/named-checkzone%{program_suffix}.1*
 %{_mandir}/man1/named-compilezone%{program_suffix}.1*
+%{_mandir}/man8/ddns-confgen%{program_suffix}.8*
+%{_mandir}/man8/tsig-keygen%{program_suffix}.8*
+%ghost %{_mandir}/man1/arpaname.1*
+%ghost %{_mandir}/man1/delv.1*
+%ghost %{_mandir}/man1/dig.1*
+%ghost %{_mandir}/man1/host.1*
+%ghost %{_mandir}/man1/nslookup.1*
+%ghost %{_mandir}/man1/nsupdate.1*
+%ghost %{_mandir}/man1/nsec3hash.1*
+%ghost %{_mandir}/man1/named-checkzone.1*
+%ghost %{_mandir}/man1/named-compilezone.1*
+%ghost %{_mandir}/man8/ddns-confgen.8*
+%ghost %{_mandir}/man8/tsig-keygen.8*
 %{_sysconfdir}/trusted-key.key
 
 %files dnssec-utils
-%{_bindir}/dnssec*
-%{_mandir}/man1/dnssec*.1*
+%{_bindir}/dnssec-{cds,dsfromkey,importkey,keyfromlabel,keygen,revoke,settime,signzone,verify}%{program_suffix}
+%{_mandir}/man1/dnssec-{cds,dsfromkey,importkey,keyfromlabel,keygen,revoke,settime,signzone,verify}%{program_suffix}.1*
+%ghost %{_bindir}/dnssec-{cds,dsfromkey,importkey,keyfromlabel,keygen,revoke,settime,signzone,verify}
+%ghost %{_mandir}/man1/dnssec-{cds,dsfromkey,importkey,keyfromlabel,keygen,revoke,settime,signzone,verify}.1*
 
 %files devel
 %{_libdir}/libbind9-%{mver}.so
@@ -937,7 +1198,6 @@ fi;
 %{bind_include}/irs
 %{bind_include}/isc
 %{bind_include}/isccfg
-%{bind_include}/bind9
 
 %files chroot
 %config(noreplace) %{_sysconfdir}/named-chroot.files

From 3d0ec5111755a2669aa32df30861db2d518abfea Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 11 Jun 2026 20:44:34 +0200
Subject: [PATCH 435/460] Reuse %{dnssec_utils_bin1} instead copy&paste

Take advantage it is defined in single value. Can be reused in %files
section as it is.
---
 bind.spec | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/bind.spec b/bind.spec
index 8b0c29c..743a497 100644
--- a/bind.spec
+++ b/bind.spec
@@ -746,7 +746,7 @@ install -p -m 644 %{SOURCE51} ${RPM_BUILD_ROOT}%{_tmpfilesdir}/%{name}-chroot.co
 %global utils_bin8 ddns-confgen tsig-keygen
 %global main_bin8 named rndc{,-confgen}
 %global main_bin1 named{-journalprint,-checkconf,-rrchecker} mdig
-%global dnssec_utils_bin1 dnssec-{cds,dsfromkey,importkey,keyfromlabel,keygen,revoke,verify}
+%global dnssec_utils_bin1 dnssec-{cds,dsfromkey,importkey,keyfromlabel,keygen,revoke,settime,signzone,verify}
 %global main_man5 named.conf rndc.conf
 %global main_unit named.service named-setup-rndc.service
 %global main_lib filter-{a,aaaa}
@@ -1176,10 +1176,10 @@ fi;
 %{_sysconfdir}/trusted-key.key
 
 %files dnssec-utils
-%{_bindir}/dnssec-{cds,dsfromkey,importkey,keyfromlabel,keygen,revoke,settime,signzone,verify}%{program_suffix}
-%{_mandir}/man1/dnssec-{cds,dsfromkey,importkey,keyfromlabel,keygen,revoke,settime,signzone,verify}%{program_suffix}.1*
-%ghost %{_bindir}/dnssec-{cds,dsfromkey,importkey,keyfromlabel,keygen,revoke,settime,signzone,verify}
-%ghost %{_mandir}/man1/dnssec-{cds,dsfromkey,importkey,keyfromlabel,keygen,revoke,settime,signzone,verify}.1*
+%{_bindir}/%{dnssec_utils_bin1}%{program_suffix}
+%{_mandir}/man1/%{dnssec_utils_bin1}%{program_suffix}.1*
+%ghost %{_bindir}/%{dnssec_utils_bin1}
+%ghost %{_mandir}/man1/%{dnssec_utils_bin1}.1*
 
 %files devel
 %{_libdir}/libbind9-%{mver}.so

From c84bc8187a4607882bf27b2db47dd445a0506bd8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 12 Jun 2026 13:11:34 +0200
Subject: [PATCH 436/460] Stop explicitly conflicting with original bind
 package

---
 bind.spec | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index 743a497..9f4d8c5 100644
--- a/bind.spec
+++ b/bind.spec
@@ -78,7 +78,7 @@
 %define upname_compat() \
 %if "%{name}" != "%{upname}" \
 Provides: %1 = %{version}-%{release} \
-Conflicts: %1 \
+Provides: alternative(%1) = %{version}-%{release} \
 %endif
 
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
@@ -330,6 +330,7 @@ Requires:       grep
 Requires:       %{name}%{?_isa} = %{epoch}:%{version}-%{release}
 %upname_compat %{upname}-chroot
 %if "%{name}" != "%{upname}"
+Conflicts:      %{upname}-chroot != %{epoch}:%{version}-%{release}
 Conflicts:      %{upname}-sdb-chroot
 %endif
 

From a7c81a2e29803a962ef0ee022930580bd31d4823 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 24 Jun 2026 15:57:41 +0200
Subject: [PATCH 437/460] Stop using build subdirectory and out-of-tree builds

Multiple variants are not built in single build for a long time. Using
different builddir causes a lot of issues in test suite. We do not need
nor want subdirectory anymore. Use source directory for building and
test running.

Might need additional adjusts in tests repository on running test suite.
---
 bind.spec | 37 ++++---------------------------------
 1 file changed, 4 insertions(+), 33 deletions(-)

diff --git a/bind.spec b/bind.spec
index 9f4d8c5..31b5cde 100644
--- a/bind.spec
+++ b/bind.spec
@@ -392,18 +392,6 @@ sed -e 's, "enable-developer",& \&\& systemctl is-system-running \&>/dev/null \&
 
 
 %build
-## We use out of tree configure/build for export libs
-%define _configure "../configure"
-
-# normal and pkcs11 unit tests
-%define unit_prepare_build() \
-  find lib -name 'K*.key' -exec cp -uv '{}' "%{1}/{}" ';' \
-  find lib -name 'testdata' -type d -exec cp -Tav '{}' "%{1}/{}" ';' \
-  find lib -name 'testkeys' -type d -exec cp -Tav '{}' "%{1}/{}" ';' \
-
-%define systemtest_prepare_build() \
-  cp -Tuav bin/tests "%{1}/bin/tests/" \
-
 %if %{with OPENSSL_ENGINE}
 CPPFLAGS="$CPPFLAGS -DOPENSSL_API_COMPAT=10100"
 %else
@@ -425,9 +413,6 @@ configure.ac
 
 autoreconf --force --install
 
-mkdir build
-
-pushd build
 LIBDIR_SUFFIX=
 export LIBDIR_SUFFIX
 %configure \
@@ -465,12 +450,6 @@ export LIBDIR_SUFFIX
   --enable-full-report \
   CPPFLAGS="$CPPFLAGS" PROGRAM_SUFFIX="%{program_suffix}" \
 ;
-%if %{with DNSTAP}
-  pushd lib
-  SRCLIB="../../../lib"
-  (cd dns && ln -s ${SRCLIB}/dns/dnstap.proto)
-  popd
-%endif
 
 %if %{with DOCPDF}
 # avoid using home for pdf latex files
@@ -486,8 +465,6 @@ fmtutil-user --missing || :
   make doc
 %endif
 
-popd # build
-
 # Prepare unit files
 for SERVICEFILE in %{SOURCE37} %{SOURCE38} %{SOURCE44} %{SOURCE46}; do
   NEWNAME="$(basename -- "$SERVICEFILE" .in)"
@@ -503,9 +480,6 @@ for SERVICEFILE in %{SOURCE37} %{SOURCE38} %{SOURCE44} %{SOURCE46}; do
   touch -r "$SERVICEFILE" "$NEWNAME" # Set change time to time of template
 done
 
-%unit_prepare_build build
-%systemtest_prepare_build build
-
 %check
 %if %{with UNITTEST} || %{with SYSTEMTEST}
   # Tests require initialization of pkcs11 token
@@ -517,7 +491,6 @@ export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0"
 %endif
 
 %if %{with UNITTEST}
-  pushd build
   CPUS=$(lscpu -p=cpu,core | grep -v '^#' | wc -l)
   THREADS="$CPUS"
 %if %{without UNITTEST_ALL}
@@ -537,7 +510,6 @@ export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0"
     exit $e;
   fi;
   [ "$CPUS" -gt 16 ] && ulimit -n $ORIGFILES || :
-  popd
 ## End of UNITTEST
 %endif
 
@@ -566,7 +538,7 @@ rh-allow-sha1-signatures = yes
 EOF
     export OPENSSL_CONF
   %endif
-  pushd build/bin/tests
+  pushd bin/tests
   chown -R ${USER} . # Can be unknown user
   %make_build test
   e=$?
@@ -609,9 +581,7 @@ popd
 touch ${RPM_BUILD_ROOT}/%{chroot_prefix}%{_sysconfdir}/named.conf
 #end chroot
 
-pushd build
 %make_install PROGRAM_SUFFIX="%{program_suffix}"
-popd
 
 # Remove unwanted files
 rm -f ${RPM_BUILD_ROOT}/etc/bind.keys
@@ -670,7 +640,7 @@ popd
 
 %if %{with DOC}
 mkdir -p ${RPM_BUILD_ROOT}%{_pkgdocdir}
-cp -a build/doc/arm/_build/html ${RPM_BUILD_ROOT}%{_pkgdocdir}
+cp -a doc/arm/_build/html ${RPM_BUILD_ROOT}%{_pkgdocdir}
 rm -rf ${RPM_BUILD_ROOT}%{_pkgdocdir}/html/.{buildinfo,doctrees}
 # Backward compatible link to 9.11 documentation
 (cd ${RPM_BUILD_ROOT}%{_pkgdocdir} && ln -s html/index.html Bv9ARM.html)
@@ -686,7 +656,7 @@ do
 done
 %endif
 %if %{with DOCPDF}
-cp -p build/doc/arm/_build/latex/Bv9ARM.pdf ${RPM_BUILD_ROOT}%{_pkgdocdir}
+cp -p doc/arm/_build/latex/Bv9ARM.pdf ${RPM_BUILD_ROOT}%{_pkgdocdir}
 %endif
 
 # Ghost config files:
@@ -1257,6 +1227,7 @@ fi;
 - Use alternatives symlinks to provide original names
 - Allow installation of multiple major versions at the same time
 - chroot package still conflicts, might be fixed later
+- Stop using build subdirectory and out-of-tree builds
 
 * Wed Jun 17 2026 Petr Menšík <pemensik@redhat.com> - 32:9.18.50-1
 - Update to 9.18.50 (rhbz#2489833)

From dcf19cde8d39d93b458809d5ea1eafb6737337c3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 1 Jul 2026 12:11:07 +0200
Subject: [PATCH 438/460] Convert to %autorelease and %autochangelog

[skip changelog]
---
 bind.spec | 3193 +----------------------------------------------------
 changelog | 3190 ++++++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 3192 insertions(+), 3191 deletions(-)
 create mode 100644 changelog

diff --git a/bind.spec b/bind.spec
index 31b5cde..d7b44b9 100644
--- a/bind.spec
+++ b/bind.spec
@@ -102,7 +102,7 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it.
 # Updating just bind will cause freeipa-dns-server package to be uninstallable.
 Version:  9.18.50
-Release:  2%{?dist}
+Release:  %autorelease
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1221,3193 +1221,4 @@ fi;
 %endif
 
 %changelog
-* Wed Jun 17 2026 Petr Menšík <pemensik@redhat.com> - 32:9.18.50-2
-- Prepare devel subpackage installable multiple times
-- Move binaries to versioned executables in main package, utils and dnssec-utils subpackages
-- Use alternatives symlinks to provide original names
-- Allow installation of multiple major versions at the same time
-- chroot package still conflicts, might be fixed later
-- Stop using build subdirectory and out-of-tree builds
-
-* Wed Jun 17 2026 Petr Menšík <pemensik@redhat.com> - 32:9.18.50-1
-- Update to 9.18.50 (rhbz#2489833)
-- Remove rwtab files
-
-* Fri Jun 12 2026 Yaakov Selkowitz <yselkowi@redhat.com> - 32:9.18.49-2
-- Rebuilt for openssl 4.0
-
-* Wed May 20 2026 Petr Menšík <pemensik@redhat.com> - 32:9.18.49-1
-- Update to 9.18.49 (rhbz#2480121)
-
-* Tue Apr 07 2026 Petr Menšík <pemensik@redhat.com> - 32:9.18.48-1
-- Update to 9.18.48 (rhbz#2453853)
-
-* Wed Mar 25 2026 Petr Menšík <pemensik@redhat.com> - 32:9.18.47-1
-- Update to 9.18.47 (rhbz#2440561)
-
-* Tue Mar 03 2026 Petr Menšík <pemensik@redhat.com> - 32:9.18.46-1
-- Update to 9.18.46 (rhbz#2440561)
-
-* Wed Jan 28 2026 Petr Menšík <pemensik@redhat.com> - 32:9.18.44-2
-- Create /var/named directories for bind-chroot (RHEL-132053)
-- Add forgotten _libdir/named into bind-chroot tmpfiles
-
-* Thu Jan 22 2026 Petr Menšík <pemensik@redhat.com> - 32:9.18.44-1
-- Update to 9.18.44 (rhbz#2431609)
-
-* Fri Jan 16 2026 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.18.43-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
-
-* Fri Jan 16 2026 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.18.43-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
-
-* Wed Dec 17 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.43-1
-- Update to 9.18.43 (rhbz#2415842)
-
-* Fri Oct 31 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.41-2
-- Fix upstream reported regression in recent CVE fix (CVE-2025-8677)
-- Add upstream dnssec system test testcase for this problem
-
-* Fri Oct 24 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.41-1
-- Update to 9.18.41 (rhbz#2405786, CVE-2025-8677 CVE-2025-40778 CVE-2025-40780)
-
-* Fri Oct 10 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.39-7
-- Reference to absolute config names from named.rfc1912.zones
-
-* Fri Oct 03 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.39-6
-- Move named.* files from /var/named into /usr/share/named
-- Move named.ca into /etc/named.ca
-
-* Tue Sep 16 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.39-5
-- Fix failures in idna system test (rhbz#2324186)
-
-* Wed Sep 10 2025 Adam Williamson <awilliam@redhat.com> - 32:9.18.39-4
-- No-change rebuild to fix F43 update
-
-* Wed Sep 03 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.39-3
-- Decode IDN names on input in all situations in utilities (rhbz#2324186)
-
-* Mon Sep 01 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.39-2
-- Offer up to 13 additional servers records if there are more servers
-
-* Thu Aug 21 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.39-1
-- Update to 9.18.39 (rhbz#2389765)
-
-* Wed Jul 30 2025 'Petr Mensik' <<pemensik@redhat.com>> - 32:9.18.38-1
-- Update to 9.18.38 (rhbz#2367771)
-
-* Wed Jul 23 2025 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.18.36-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
-
-* Tue Jun 10 2025 'Petr Mensik' <<pemensik@redhat.com>> - 32:9.18.36-2
-- Prevent name.c:670 attributes assertion failed
-- Add extra checks for relative names
-
-* Fri Apr 25 2025 Petr Mensik <pemensik@redhat.com> - 32:9.18.36-1
-- Update to 9.18.36 (rhbz#2346607)
-
-* Wed Mar 26 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.35-2
-- Backport support for OpenSSL provider required for PKCS11 labels
-- Deactivate jemalloc default linking
-
-* Wed Mar 26 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.35-1
-- Update to 9.18.35 (rhbz#2346607)
-
-* Thu Mar 20 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.33-3
-- Remove pre scriptlet
-
-* Mon Feb 10 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.33-2
-- Permanently remove DLZ parts build
-
-* Sun Feb 02 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.33-1
-- Update to 9.16.33 (rhbz#2342784)
-
-* Fri Jan 17 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.32-7
-- Add sysusers named user creation (rhbz#2105415)
-
-* Thu Jan 16 2025 Adam Williamson <awilliam@redhat.com> - 32:9.18.32-6
-- Rebuild again on mass rebuild tag so -4 doesn't override -5
-
-* Thu Jan 16 2025 Adam Williamson <awilliam@redhat.com> - 32:9.18.32-5
-- Provide user(named) and group(named)
-
-* Thu Jan 16 2025 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.18.32-4
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
-
-* Mon Jan 13 2025 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 32:9.18.32-3
-- Rebuilt for the bin-sbin merge (2nd attempt)
-
-* Fri Dec 20 2024 Adam Williamson <awilliam@redhat.com> - 32:9.18.32-2
-- No change sidetag rebuild to include bind-dyndb-ldap
-
-* Thu Dec 12 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.32-1
-- Update to 9.18.32 (#2331675)
-- Remove CHANGES file from package
-- Disable DLZ plugins, they are not shipped with bind anymore
-- Add new root key 38696 into package files too
-
-* Thu Dec 12 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.31-3
-- Disable temporarily PDF generation on all platforms
-
-* Wed Dec 04 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.31-2
-- Add nsupdate TLS support (FREEIPA-11706)
-- Include a test for nsupdate changes
-
-* Thu Nov 14 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.31-1
-- Update to 9.18.31 (#2319214)
-
-* Thu Nov 14 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.30-3
-- Bump obsoleted license version (rhbz#2308102)
-
-* Tue Oct 08 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.30-2
-- Make OpenSSL engine support optional
-
-* Fri Oct 04 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.30-1
-- Update to 9.18.30 (rhbz#2306542)
-
-* Wed Aug 21 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.29-1
-- Update to 9.18.29 (rhbz#2306542)
-
-* Wed Aug 21 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.28-4
-- Remove ancient triggerun and selinux boolean traces
-
-* Wed Jul 31 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.28-3
-- Drop PostgreSQL dependencies not used by DLZ anymore
-
-* Wed Jul 31 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.28-2
-- Conflict explicitly with more bind subpackages
-- Merge license subpackage into libs
-- Add optional QUERYTRACE feature
-- Make relative documentation links
-
-* Fri Jul 26 2024 Jonathan Wright <jonathan@almalinux.org> - 32:9.18.28-1
-- update to 9.18.28 rhbz#2299467
-- Fixes CVE-2024-4076
-- Fixes CVE-2024-1975
-- Fixes CVE-2024-1737
-- Fixes CVE-2024-0760
-
-* Wed Jul 17 2024 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.18.26-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
-
-* Tue Jul 09 2024 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 32:9.18.26-2
-- Rebuilt for the bin-sbin merge
-
-* Mon Apr 22 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.26-1
-- Update to 9.18.26 (rhbz#2270476)
-
-* Thu Feb 15 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.24-1
-- Update to 9.18.24 (#2264032)
-
-* Tue Jan 23 2024 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.18.21-4
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Fri Jan 19 2024 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.18.21-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Tue Jan 16 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.21-2
-- Update changed b.root-servers.net address in hints (#2253460)
-
-* Mon Jan 15 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.21-1
-- Update to 9.18.21 (#2255407)
-
-* Thu Nov 16 2023 Petr Menšík <pemensik@redhat.com> - 32:9.18.20-1
-- Update to 9.18.20 (#2249835)
-
-* Fri Sep 22 2023 Petr Menšík <pemensik@redhat.com> - 32:9.18.19-1
-- Update to 9.18.19 (#2232346)
-
-* Fri Sep 22 2023 Petr Menšík <pemensik@redhat.com> - 32:9.18.18-2
-- Skip failing rbtdb_test unit test on i686 (#2240253)
-
-* Wed Sep 06 2023 Petr Menšík <pemensik@redhat.com> - 32:9.18.18-1
-- Update to 9.18.18 (#2232346)
-
-* Wed Jul 19 2023 Petr Menšík <pemensik@redhat.com> - 32:9.18.17-1
-- Update to 9.18.17 (#2223913)
-
-* Wed Jul 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.18.16-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
-
-* Wed Jun 21 2023 Petr Menšík <pemensik@redhat.com> - 32:9.18.16-1
-- Update to 9.18.16 (#2216462)
-
-* Wed May 17 2023 Petr Menšík <pemensik@redhat.com> - 32:9.18.15-1
-- Update to 9.18.15 (#2207908)
-
-* Fri Apr 21 2023 Petr Menšík <pemensik@redhat.com> - 32:9.18.14-1
-- Update to 9.18.14 (#2187996)
-
-* Wed Apr 05 2023 Petr Menšík <pemensik@redhat.com> - 32:9.18.13-2
-- Enumerate all SPDX licenses used
-
-* Sat Mar 18 2023 Petr Menšík <pemensik@redhat.com> - 32:9.18.13-1
-- Update to 9.18.3 (#2178717)
-
-* Thu Feb 16 2023 Petr Menšík <pemensik@redhat.com> - 32:9.18.12-1
-- Update to 9.18.12 (#2170096)
-
-* Fri Jan 27 2023 Petr Menšík <pemensik@redhat.com> - 32:9.18.11-1
-- Update to 9.18.11 (#2164395)
-
-* Wed Jan 18 2023 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.18.10-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
-
-* Mon Jan 16 2023 Petr Menšík <pemensik@redhat.com> - 32:9.18.10-1
-- Update to 9.18.10 (#2143258)
-- Include rwlock.h from dns/zt.h
-
-* Mon Nov 21 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.9-1
-- Update to 9.18.9 (#2143258)
-
-* Sat Oct 22 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.8-1
-- Update to 9.18.8 (#2136100)
-
-* Fri Sep 30 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.7-3
-- Update License to SPDX identifier
-- Enable automatic restart on crashes
-
-* Sat Sep 24 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.7-2
-- Build ARM documentation also with older sphinx on RHEL9
-
-* Wed Sep 21 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.7-1
-- Update to 9.18.7 (#2128609)
-
-* Wed Sep 14 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.6-4
-- Disable yet another test (##2122010)
-
-* Tue Sep 06 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.6-3
-- Return OpenSSL engine implementation for pkcs11 interface (#2122841)
-- Skip problematic netmgr unit tests (#2122010)
-- Properly obsolete bind-dnssec-doc
-
-* Thu Sep 01 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.6-2
-- Always show error details for failed unittests (#2122010)
-
-* Tue Aug 30 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.6-1
-- Update to 9.18.6 (#2119132)
-- Report unit tests detailed results
-
-* Thu Aug 04 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.5-2
-- Use multiple threads on unit tests, but 16 at most
-
-* Wed Aug 03 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.5-1
-- Update to 9.18.5 (#2109170)
-- Return doc symlink to main page
-
-* Wed Jul 20 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.4-2
-- Stop enabling selinux booleans on every upgrade
-- Deprecate python3-bind for smooth upgrade
-- Remove PKCS1111 native utilities, libs and daemon
-
-* Wed Jul 20 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.4-1
-- Update to 9.18.4 (#2057493)
-
-* Wed Jul 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.16.30-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
-
-* Mon Jun 20 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.30-1
-- Update to 9.16.30 (#2097312)
-
-* Mon Jun 13 2022 Python Maint <python-maint@redhat.com> - 32:9.16.29-2
-- Rebuilt for Python 3.11
-
-* Thu May 26 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.29-1
-- Update to 9.16.29 (#2087920)
-- Fix netmgr_test fails on s390x (#2088125)
-
-* Tue May 17 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.28-2
-- Parse again timeout and attempts from resolv.conf (#2087156)
-- Reenable unit tests during build
-
-* Wed Apr 20 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.28-1
-- Update to 9.16.28 (#2076941)
-
-* Thu Mar 17 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.27-1
-- Upgrade to 9.16.27 (#2055120)
-
-* Tue Mar 01 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.26-2
-- Switch to locked queue (#2048235)
-
-* Thu Feb 17 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.26-1
-- Update to 9.16.26 (#2055120)
-
-* Fri Feb 11 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.25-3
-- Allow reservation of extra hp threads (#2048235)
-
-* Tue Jan 25 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.25-2
-- Replace master with primary in configuration
-
-* Fri Jan 21 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.25-1
-- Update to 9.16.25 (#2042504)
-
-* Wed Jan 19 2022 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.16.24-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
-
-* Wed Dec 22 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.24-2
-- Build with OpenLDAP 2.6 (#2032704)
-
-* Wed Dec 15 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.24-1
-- Update to 9.16.24 (#2032934)
-
-* Fri Nov 26 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-2
-- Correct with GEOIP2 condition (#2026823)
-
-* Fri Nov 19 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-1
-- Update to 9.16.23 (#2024210)
-
-* Sat Nov 06 2021 Adrian Reber <adrian@lisas.de> - 32:9.16.22-2
-- Rebuilt for protobuf 3.19.0
-
-* Wed Oct 27 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.22-1
-- Update to 9.16.22
-
-* Sun Oct 24 2021 Adrian Reber <adrian@lisas.de> - 32:9.16.21-3
-- Rebuilt for protobuf 3.18.1
-
-* Wed Oct 13 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.21-2
-- Propagate ephemeral port ranges to chroot (#2013597)
-
-* Wed Sep 15 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.21-1
-- Update to 9.16.21
-
-* Tue Sep 14 2021 Sahana Prasad <sahana@redhat.com> - 32:9.16.20-4
-- Rebuilt with OpenSSL 3.0.0
-
-* Wed Aug 25 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.20-3
-- Increase map format version, lower memory consuption a bit (#1997504)
-- Remove unneeded test variants changes
-- Include documentation of dig return codes
-
-* Thu Aug 19 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.20-2
-- Fix map file format regression
-
-* Tue Aug 17 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.20-1
-- Update to 9.16.20
-
-* Thu Aug 05 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.19-4
-- Do not depend on systemd package
-
-* Tue Aug 03 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.19-3
-- Reenable PDF building again (#1984687)
-
-* Fri Jul 23 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.19-2
-- Include backward compatible html symlink in doc subpackage
-
-* Wed Jul 21 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.19-1
-- Update to 9.16.19 (#1984627)
-- Disable PDF rebuild on Rawhide (#1984687)
-
-* Wed Jul 21 2021 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.16.18-5
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
-
-* Sat Jul 10 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.18-4
-- Disable PDF building on ELN
-
-* Sat Jul 10 2021 Björn Esser <besser82@fedoraproject.org> - 32:9.16.18-3
-- Rebuild for versioned symbols in json-c
-
-* Tue Jun 22 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.18-2
-- Re-enable building of PDF ARM documentation
-
-* Fri Jun 18 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.18-1
-- Update to 9.16.18
-
-* Fri Jun 18 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.17-2
-- Fix wildcard expansion not working with 'w' (#1973587)
-
-* Thu Jun 17 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.17-1
-- Update to 9.16.17
-
-* Fri Jun 04 2021 Python Maint <python-maint@redhat.com> - 32:9.16.16-2
-- Rebuilt for Python 3.10
-
-* Thu May 20 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.16-1
-- Update to 9.16.16 (#1954827)
-
-* Thu Apr 29 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.15-1
-- Update to 9.16.15
-
-* Thu Mar 25 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.13-1
-- Update to 9.16.13
-- Changed displayed version just to include -RH suffix, not release
-- Version is now part of library names, soname versions are no longer provided
-- Removed bind-libs-lite subpackage
-
-* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 32:9.16.11-6
-- Rebuilt for updated systemd-rpm-macros
-  See https://pagure.io/fesco/issue/2583.
-
-* Fri Feb 26 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.11-5
-- Make logrotate.d world-readable (#1917061)
-
-* Mon Feb 22 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.11-4
-- Fix off-by-one bug in ISC SPNEGO implementation (#1929965)
-
-* Mon Feb 08 2021 Pavel Raiskup <praiskup@redhat.com> - 32:9.16.11-3
-- rebuild for libpq ABI fix rhbz#1908268
-
-* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.16.11-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
-
-* Thu Jan 21 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.11-1
-- Update to 9.16.11 (#1827602)
-- Avoid unit test failures on machines with many cores
-
-* Thu Jan 14 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.10-2
-- Update to 9.16.10
-- Remove bind-sdb package
-- https://fedoraproject.org/wiki/Changes/BIND9.16
-
-* Wed Jan 13 08:55:11 CET 2021 Adrian Reber <adrian@lisas.de> - 32:9.11.26-3
-- Rebuilt for protobuf 3.14
-
-* Wed Jan 06 2021 Petr Menšík <pemensik@redhat.com> - 32:9.11.26-2
-- Use make macros
-- https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro
-
-* Mon Jan 04 2021 Petr Menšík <pemensik@redhat.com> - 32:9.11.26-1
-- Update to 9.11.26
-
-* Mon Nov 30 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.25-2
-- Regenerate all manual pages on build
-
-* Thu Nov 26 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.25-1
-- Update to 9.11.25
-
-* Wed Nov 04 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.24-2
-- Fix crash on NTA recheck failure (#1893761)
-
-* Fri Oct 23 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.24-1
-- Update to 9.11.24
-
-* Wed Sep 23 2020 Adrian Reber <adrian@lisas.de> - 32:9.11.23-2
-- Rebuilt for protobuf 3.13
-
-* Thu Sep 17 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.23-1
-- Update to 9.11.23
-- Merge bind-lite-devel into devel package
-
-* Tue Sep 01 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.22-2
-- Require libcap from devel package
-
-* Thu Aug 20 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.22-1
-- Update to 9.11.22
-
-* Sat Aug 01 2020 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.11.21-3
-- Second attempt - Rebuilt for
-  https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
-
-* Mon Jul 27 2020 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.11.21-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
-
-* Wed Jul 15 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.21-1
-- Update to 9.11.21
-
-* Tue Jun 23 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.20-3
-- Move documentation to separate bind-doc package
-
-* Sat Jun 20 2020 Adrian Reber <adrian@lisas.de> - 32:9.11.20-2
-- Rebuilt for protobuf 3.12
-
-* Wed Jun 17 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.20-1
-- Update to 9.11.20
-
-* Tue May 26 2020 Miro Hrončok <mhroncok@redhat.com> - 32:9.11.19-2
-- Rebuilt for Python 3.9
-
-* Fri May 15 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.19-1
-- Update to 9.11.19 (CVE-2020-8616, CVE-2020-8617)
-- Make initscripts just optional dependency
-
-* Tue Apr 21 2020 Björn Esser <besser82@fedoraproject.org> - 32:9.11.18-2
-- Rebuild (json-c)
-
-* Thu Apr 16 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.18-1
-- Update to 9.11.18
-
-* Tue Mar 31 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.17-1
-- Update to 9.11.17
-
-* Tue Jan 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.11.14-5
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
-
- * Wed Jan 08 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.14-4
-- Remove libmaxminddb-devel from devel package dependencies
-
-* Fri Jan 03 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.14-3
-- Preserve symlinks to named.conf on iscdlv modification (#1786626)
-
-* Thu Dec 19 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.14-2
-- Include more Thread Sanitizer detected changes (#1736762)
-
-* Thu Dec 19 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.14-1
-- Update to 9.11.14
-
-* Tue Dec 03 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.13-4
-- Disable Berkeley DB support (#1779190)
-
-* Mon Dec 02 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.13-3
-- Backport few thread safety related fixed from upstream (#1736762)
-
-* Tue Nov 26 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.13-2
-- Complete explicit disabling of RSAMD5 in FIPS mode (#1709553)
-
-* Tue Nov 19 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.13-1
-- Update to 9.11.13
-
-* Tue Nov 19 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.12-6
-- Report failures on systemctl reload
-
-* Tue Nov 12 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.12-5
-- Fix binary compatibility after serve-stale patch (#1770492)
-
-* Wed Nov 06 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.12-4
-- Backported serve-stale feature
-
-* Wed Nov 06 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.12-3
-- Fix wrong default GeoIP directory (#1768258)
-
-* Mon Nov 04 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.12-2
-- Move data files outside config archive
-- Specify geoip data directory in config file (#1768258)
-
-* Mon Oct 21 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.12-1
-- Update to 9.11.12 (#1557762)
-
-* Wed Sep 25 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.11-1
-- Update to 9.11.11
-
-* Wed Sep 04 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.10-3
-- Share pkcs11-utils and dnssec-utils manuals instead of recommend
-
-* Tue Sep 03 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.10-2
-- Move some administration utilities back to bind-utils (#1720380)
-- Add GeoIP to bind-chroot (#1497646)
-- Recommend bind-dnssec-utils from bind-pkcs11-utils
-
-* Tue Aug 27 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.10-1
-- Update to 9.11.10
-
-* Mon Aug 19 2019 Miro Hrončok <mhroncok@redhat.com> - 32:9.11.9-4
-- Rebuilt for Python 3.8
-
-* Fri Aug 09 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.9-3
-- Display errors from rndc reload (#1739441)
-
-* Thu Aug 08 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.9-2
-- Permit explicit disabling of RSAMD5 in FIPS mode (#1709553)
-
-* Wed Jul 24 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.9-1
-- Update to 9.11.9
-- Add GeoLite2 support
-- Disable export-libs
-
-* Wed Jul 24 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.8-2
-- Use monotonic time in export library (#1732883)
-
-* Wed Jul 24 2019 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.11.8-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
-
-* Tue Jul 02 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.8-1
-- Update to 9.11.8
-
-* Mon Jun 17 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.7-2
-- Fix OpenSSL random generator initialization
-
-* Mon Jun 10 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.7-1
-- Update to 9.11.7
-
-* Mon May 06 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.6-5.P1
-- Fix also postun script
-
-* Mon May 06 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.6-4.P1
-- Fix error in scriptlet condition
-
-* Thu May 02 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.6-3.P1
-- Fix inefective limit of TCP clients (CVE-2018-5743)
-
-* Thu Mar 14 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.6-2
-- Fix dnstap and timer issues in unit test
-- Enable DLZ modules
-
-* Tue Mar 05 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.6-1
-- Update to 9.11.6
-
-* Fri Mar 01 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.5-15.P4
-- Support testing of named variants
-
-* Thu Feb 28 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.5-14.P4
-- Modify feature-test detection of dlz-filesystem
-
-* Fri Feb 22 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.5-13.P4
-- Update to 9.11.5-P4
-
-* Fri Feb 22 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.5-12.P1
-- Enable DNSTAP support (#1564776)
-- Enable LMDB support for rndc addzone
-- Enable json format in statistics-channel
-
-* Thu Feb 21 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.5-11.P1
-- Disable often failing unit test random_test
-
-* Thu Feb 21 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.5-10.P1
-- Disable autodetected eddsa algorithm ED448
-
-* Thu Jan 31 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.5-9.P1
-- dig prints ASCII name instead of failure (#1647829)
-- disable IDN output from scripts
-- Update project URL
-- Removed revoked KSK 19164 from trusted keys
-
-* Thu Jan 31 2019 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.11.5-8.P1
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
-
-* Sun Jan 27 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.5-7.P1
-- Update to 9.11.5-P1
-
-* Wed Jan 23 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.5-6
-- Reenable crypto rand for DHCP, disable just entropy check (#1663318)
-
-* Thu Jan 17 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.5-5
-- Move dnssec related tools from bind-utils to bind-dnssec-utils (#1649398)
-
-* Wed Jan 16 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.5-4
-- Reject invalid binary file (#1666814)
-
-* Mon Jan 14 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.5-3
-- Disable crypto rand for DHCP (#1663318)
-
-* Thu Oct 25 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.5-2
-- Add optional support for JSON statistics
-- Add optional DNSTAP support (#1564776), new dnstap-read tool
-
-* Wed Oct 24 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.5-1
-- Update to 9.11.5
-
-* Tue Oct 02 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.4-12.P2
-- Add Requires to devel packages referenced by bind-devel
-
-* Sat Sep 29 2018 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 32:9.11.4-11.P2
-- Fix export-libs macro & scriptlet
-
-* Wed Sep 26 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.4-10.P2
-- Reenable IDN output but allow turning it off (#1580200)
-
-* Thu Sep 20 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.4-9.P2
-- Update to bind-9.11.4-P2
-- Add /dev/urandom to chroot (#1631515)
-
-* Fri Aug 24 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.4-8.P1
-- Replace unoptimized code by OpenSSL counterparts
-- Fix multilib conflicts of devel package
-- Add versioned depends to all library subpackages
-
-* Fri Aug 24 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.4-7.P1
-- Add support for OpenSSL provided random data
-
-* Mon Aug 13 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.4-6.P1
-- Fix sdb-chroot devices upgrade (#1592873)
-- Automatically replace obsoleted ISC DLV key with root key (#1595782)
-
-* Thu Aug 09 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.4-5.P1
-- Update to 9.11.4-P1
-- Adds root key sentinel support
-- Large IXFR zone transfers are rejected to prevent journal corruption
-
-* Thu Aug 02 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.4-4
-- Support unavailable MD5 in FIPS mode
-
-* Thu Aug 02 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.4-3
-- Use OpenSSL for digest operations (#1611537)
-
-* Tue Jul 31 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.4-2
-- Install generated manual pages
-
-* Thu Jul 12 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.4-1
-- Update to 9.11.4
-- Use kyua instead of kyua-cli for unit tests
-
-* Thu Jul 12 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.3-15
-- Use new config file named-chroot.files for chroot setup (#1429656)
-- Fix chroot devices file verification (#1592873)
-- Prevent errors on bind-chroot uninstall when running (#1600583)
-
-* Thu Jul 12 2018 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.11.3-14
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
-
-* Mon Jul 02 2018 Miro Hrončok <mhroncok@redhat.com> - 32:9.11.3-13
-- Rebuilt for Python 3.7
-
-* Wed Jun 27 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.3-12
-- Require utils instead of library
-
-* Wed Jun 27 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.3-11
-- Remove named.iscdlv.key file (#1595782)
-- Fix CVE-2018-5738
-
-* Tue Jun 19 2018 Miro Hrončok <mhroncok@redhat.com> - 32:9.11.3-10
-- Rebuilt for Python 3.7
-
-* Fri May 25 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.3-9
-- Make named home writeable (#1422680)
-- Change named shell to /bin/false
-
-* Fri May 25 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.3-8
-- Require C++ on build when shipped atf library is used
-
-* Mon Apr 09 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.3-7
-- Run tests also without kyua
-
-* Thu Apr 05 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.3-6
-- Do not link libidn2 to all libraries (#1098783)
-- Update named.ca
-
-* Tue Apr 03 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.3-5
-- Enable libidn2 support (#1098783)
-- Make +noidnout default
-- Compile export libs without GSSAPI
-
-* Wed Mar 21 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.3-4
-- Rebase to 9.11.3
-- Add dig support for libidn2 (#1098783)
-
-* Wed Mar 21 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.3-3.b1
-- Fix build with disabled unittest
-- Recommend softhsm from pkcs11 variant
-
-* Thu Feb 22 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.3-2.b1
-- Require openssl-devel and libcap-devel from bind-export-devel
-- Conflict with bind99-devel
-- Change spec globals to rpmbuild --with feature
-
-* Thu Feb 15 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.3-1.b1
-- Rebase to 9.11.3b1
-
-* Wed Feb 07 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.2-11.P1
-- Use versioned provides
-- Fix starting of unit tests
-- Forward export libs path to isc-config
-- Rename export devel subpackage to bind-export-devel
-
-* Wed Feb 07 2018 Pavel Zhukov <pzhukov@redhat.com> - 32:9.11.2-10.P1
-- Add obsoletes/provides tags for smooth update
-
-* Wed Feb 07 2018 Pavel Zhukov <pzhukov@redhat.com> - 32:9.11.2-9.P1
-- Build devel package for export-libs
-
-* Wed Feb 07 2018 Pavel Zhukov <pzhukov@redhat.com> - 32:9.11.2-8.P1
-- Build export libraries with disabled threads and selects
-
-* Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.11.2-7.P1
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
-
-* Tue Jan 30 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.2-6.P1
-- Remove ldconfig calls where possible
-- Note -z defs cannot be enabled until more work
-
-* Tue Jan 16 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.2-5.P1
-- Fix CVE-2017-3145, rebase to 9.11.2-P1
-
-* Tue Jan 02 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.2-4
-- Enable unit tests with kyua tool (#1532694)
-- Provide internal tool to prepare softhsm token storage
-- Proper fix for python3-bind subpackage directory ownership (#1522944)
-
-* Fri Dec 15 2017 Petr Menšík <pemensik@redhat.com> - 32:9.11.2-3
-- Own python3-bind isc directory (#1522944)
-- Make tsstsig system test pass again (#1500017)
-
-* Mon Oct 23 2017 Petr Menšík <pemensik@redhat.com> - 32:9.11.2-2
-- Build against mariadb-connector-c-devel (#1493615)
-- Include DNSKEY 20326 also in trusted-key.key (#1505476)
-- Fix dynamic symbols conflict with ldap (#1205168)
-- Use hmac-sha256 for new RNDC keys (#1508003)
-- Include protocols and services in chroot
-
-* Wed Aug 02 2017 Petr Menšík <pemensik@redhat.com> - 32:9.11.2-1
-- Update to 9.11.2
-- Add recursing and secroots file into default and sample config
-- Fix nsupdate GSSAPI auth against AD server (#1484451)
-
-* Wed Aug 02 2017 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.11.1-6.P3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
-
-* Wed Jul 26 2017 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.11.1-5.P3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
-
-* Fri Jul 14 2017 Petr Menšík <pemensik@redhat.com> - 32:9.11.1-4.P3
-- Simplify change of default configuration file path
-
-* Thu Jul 13 2017 Petr Menšík <pemensik@redhat.com> - 32:9.11.1-3.P3
-- Use mysql_config for SDB variant, build against mariadb-devel
-
-* Mon Jul 10 2017 Petr Menšík <pemensik@redhat.com> - 32:9.11.1-2.P3
-- Update to 9.11.1-P3
-
-* Fri Jun 30 2017 Petr Menšík <pemensik@redhat.com> - 32:9.11.1-2.P2
-- Update to 9.11.1-P2
-
-* Thu Jun 29 2017 Petr Menšík <pemensik@redhat.com> - 32:9.11.1-2.P1
-- dnssec-checkds and dnssec-coverage requires python module (#1466183)
-
-* Thu Jun 15 2017 Petr Menšík <pemensik@redhat.com> - 32:9.11.1-1.P1
-- Update to 9.11.1-P1
-
-* Fri Apr 21 2017 Petr Menšík <pemensik@redhat.com> - 32:9.11.0-8.P5
-- Fix queries for TKEY in nsupdate, when using GSSAPI (#1236087)
-
-* Thu Apr 13 2017 Petr Menšík <pemensik@redhat.com> - 32:9.11.0-7.P5
-- Update to 9.11.0-P5
-- Use BINDVERSION for upstream version
-
-* Fri Feb 10 2017 Petr Menšík <pemensik@redhat.com> - 32:9.11.0-7.P3
-- Update to 9.11.0-P3
-
-* Fri Feb 10 2017 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.11.0-7.P2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
-
-* Wed Jan 18 2017 Petr Menšík <pemensik@redhat.com> - 32:9.11.0-6.P2
-- RTLD_DEEPBIND conflicts with pkcs11 libraries, skip it for dyndb (#1410433)
-- Fix some rpm warnings
-
-* Mon Jan 16 2017 Petr Menšík <pemensik@redhat.com> - 32:9.11.0-5.P2
-- Fix manual pages generated by recent docbook-style-xsl (#1397186)
-
-* Thu Jan 12 2017 Petr Menšík <pemensik@redhat.com> - 32:9.11.0-4.P2
-- Update to 9.11.0-P2
-
-* Mon Dec 19 2016 Miro Hrončok <mhroncok@redhat.com> - 32:9.11.0-4.P1
-- Rebuild for Python 3.6
-
-* Tue Nov 22 2016 Petr Menšík <pemensik@redhat.com> - 32:9.11.0-3.P1
-- Split pk11 includes, include real functions only in pkcs11 variant
-
-* Wed Nov 16 2016 Petr Menšík <pemensik@redhat.com> - 32:9.11.0-2.P1
-- Do not change lib permissions in chroot
-
-* Wed Nov 16 2016 Michal Ruprich <mruprich@redhat.com> - 32:9.11.0-1.P1
-- Update to 9.11.0-P1
-
-* Tue Nov 08 2016 Petr Menšík <pemensik@redhat.com> - 32:9.10.4-3.P4
-- Build with OpenSSL 1.1
-
-* Thu Nov 03 2016 Petr Menšík <pemensik@redhat.com> - 32:9.10.4-2.P4
-- Update to 9.10.4-P4
-
-* Thu Sep 29 2016 Tomas Hozza <thozza@redhat.com> - 32:9.10.4-2.P3
-- Update to 9.10.4-P3
-
-* Wed Jul 20 2016 Michal Ruprich <mruprich@redhat.com> - 32:9.10.4-1.P2
-- Update to 9.10.4-P2
-
-* Thu May 26 2016 Tomas Hozza <thozza@redhat.com> - 32:9.10.4-1.P1
-- Update to 9.10.4-P1
-
-* Fri May 20 2016 Tomas Hozza <thozza@redhat.com> - 32:9.10.3-14.P4
-- (un)mount /var/named in -chroot packages as the last directory (Related: #1279188)
-
-* Thu May 12 2016 Tomas Hozza <thozza@redhat.com> - 32:9.10.3-13.P4
-- Remove NM dispatcher script, since it is not needed any more (#1277257)
-- Replaced After=network-online.target with After=network.target in all unit files
-
-* Fri Mar 11 2016 Tomas Hozza <thozza@redhat.com> - 32:9.10.3-12.P4
-- Update to 9.10.3-P4 due to CVE-2016-1285 CVE-2016-1286 CVE-2016-2088
-
-* Wed Feb 03 2016 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.10.3-11.P3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
-
-* Thu Jan 21 2016 Tomas Hozza <thozza@redhat.com> - 32:9.10.3-10.P3
-- Update to 9.10.3-P3 due to CVE-2015-8704 and CVE-2015-8705 (#1300051)
-
-* Wed Jan 06 2016 Tomas Hozza <thozza@redhat.com> - 32:9.10.3-9.P2
-- Commented out bindkeys-file statement in default configuration (#1223365#c3)
-- Removed unrecognized configure option --enable-developer
-- Added configure option --enable-full-report to get report on enabled features
-
-* Sat Dec 26 2015 Robert Scheck <robert@fedoraproject.org> - 32:9.10.3-8.P2
-- Remove unrecognized build options for %%configure
-- Own %%{_includedir}/bind9 directory in -lite-devel
-- Fixed building without (optional) PKCS#11 support
-
-* Wed Dec 16 2015 Tomas Hozza <thozza@redhat.com> - 32:9.10.3-7.P2
-- bump release to maintain update path
-
-* Wed Dec 16 2015 Tomas Hozza <thozza@redhat.com> - 32:9.10.3-4.P2
-- Update to 9.10.3-P2
-
-* Tue Nov 10 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 32:9.10.3-3
-- Rebuilt for https://fedoraproject.org/wiki/Changes/python3.5
-
-* Wed Nov 04 2015 Tomas Hozza <thozza@redhat.com> - 32:9.10.3-2
-- Fixed named-checkconf call in *-chroot.service files (#1277820)
-
-* Thu Sep 17 2015 Tomas Hozza <thozza@redhat.com> - 32:9.10.3-1
-- Update to 9.10.3 stable
-
-* Thu Sep 03 2015 Tomas Hozza <thozza@redhat.com>
-- Update to 9.10.3rc1
-
-* Wed Jul 29 2015 Tomas Hozza <thozza@redhat.com> - 32:9.10.2-9.P3
-- Update to 9.10.2-P3 to fix CVE-2015-5477
-
-* Thu Jul 09 2015 Tomas Hozza <thozza@redhat.com> - 32:9.10.2-8.P2
-- Update to 9.10.2-P2
-
-* Mon Jun 29 2015 Tomas Hozza <thozza@redhat.com> - 32:9.10.2-7.P1
-- Reintroduce the DISABLE_ZONE_CHECKING into /etc/sysconfig/named
-
-* Fri Jun 19 2015 Tomas Hozza <thozza@redhat.com> - 32:9.10.2-6.P1
-- Update to 9.10.2-P1
-
-* Wed Jun 17 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 32:9.10.2-5
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
-
-* Wed May 27 2015 Tomas Hozza <thozza@redhat.com> - 32:9.10.2-4
-- Don't copy /etc/localtime on -chroot package installation
-
-* Fri May 22 2015 Tomas Hozza <thozza@redhat.com> - 32:9.10.2-3
-- Don't use ISC's DLV by default (#1223365)
-- Utilize system-wide crypto-policies (#1179925)
-
-* Thu May 21 2015 Tomas Hozza <thozza@redhat.com> - 32:9.10.2-2
-- enable tuning for large systems - increases hardcoded internal limits
-- enable GeoIP access control feature
-
-* Thu Feb 26 2015 Tomas Hozza <thozza@redhat.com> - 32:9.10.2-1
-- update to 9.10.2 stable
-- remove parallel-build patch after discussion with upstream [ISC-Bugs #38739]
-
-* Wed Feb 25 2015 Tomas Hozza <thozza@redhat.com> - 32:9.10.2-0.3.rc1
-- update to 9.10.2rc2
-- call ldconfig for pkcs11-libs
-- Use Python3 by default (#1186791)
-
-* Sat Feb 21 2015 Till Maas <opensource@till.name> - 32:9.10.2-0.2.rc1
-- Rebuilt for Fedora 23 Change
-  https://fedoraproject.org/wiki/Changes/Harden_all_packages_with_position-independent_code
-
-* Mon Feb 02 2015 Tomas Hozza <thozza@redhat.com> - 32:9.10.2-0.1.rc1
-- update to 9.10.2rc1
-- fix nsupdate server auto-detection (#1184151)
-- drop merged patch bind99-rh985918.patch
-
-* Fri Jan 16 2015 Tomas Hozza <thozza@redhat.com> - 32:9.10.1-2.P1
-- Install config for tmpfiles under %%{_tmpfilesdir} (#1181020)
-
-* Tue Jan 13 2015 Tomas Hozza <thozza@redhat.com> - 32:9.10.1-1.P1
-- Update to 9.10.1-P1 stable
-
-* Fri Dec 12 2014 Tomas Hozza <thozza@redhat.com> - 32:9.9.6-6.P1
-- Drop downstream patch for nslookup/host rejected by upstream
-
-* Tue Dec 09 2014 Tomas Hozza <thozza@redhat.com> - 32:9.9.6-5.P1
-- Update to 9.9.6-P1 (CVE-2014-8500)
-
-* Fri Nov 14 2014 Tomas Hozza <thozza@redhat.com> - 32:9.9.6-4
-- Fixed systemctl path in logrotate configuration (#1148360)
-- drop engine_pkcs11 dependency, since we use native PKCS#11 implementation
-
-* Wed Oct 22 2014 Petr Spacek <pspacek@redhat.com> - 32:9.9.6-3
-- Fix crash during GSS-TSIG processing (#1155334, #1155127)
-  introduced in 32:9.9.6-2
-
-* Tue Oct 14 2014 Tomas Hozza <thozza@redhat.com> - 32:9.9.6-2
-- Added native PKCS#11 functionality (#1097752)
-- bind-sdb now requires bind due to configuration and other utilities
-- bind-pkcs11 now requires bind due to configuration and other utilities
-
-* Thu Oct 02 2014 Tomas Hozza <thozza@redhat.com> - 32:9.9.6-1
-- Update to 9.9.6
-- drop merged patches and rebase some of existing patches
-- Add architecture specific dependencies.
-- Fix assert in dig when using +sigchase (#985918)
-
-* Fri Aug 15 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 32:9.9.5-9.P1
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
-
-* Fri Jul 18 2014 Tomas Hozza <thozza@redhat.com> 32:9.9.5-8.P1
-- Use network-online.target instead of network.target (#1117086)
-
-* Fri Jul 11 2014 Tom Callaway <spot@fedoraproject.org> 32:9.9.5-7.P1
-- fix license handling
-
-* Thu Jun 12 2014 Tomas Hozza <thozza@redhat.com> 32:9.9.5-6.P1
-- Update to 9.9.5-P1
-
-* Mon Jun 09 2014 Tomas Hozza <thozza@redhat.com> 32:9.9.5-5
-- Use /dev/urandom for generation of rndc.key (#1079799)
-
-* Sat Jun 07 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 32:9.9.5-4
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
-
-* Tue Apr 22 2014 Tomas Hozza <thozza@redhat.com> 32:9.9.5-3
-- configure bind with --with-dlopen=yes to support dynamically loadable DLZ drivers
-
-* Wed Mar 05 2014 Tomas Hozza <thozza@redhat.com> 32:9.9.5-2
-- dlz_dlopen driver could return the wrong error leading to a segfault (#1052781)
-- Fix race condition when freeing fetch object (ISC-Bugs #35385)
-
-* Thu Feb 13 2014 Tomas Hozza <thozza@redhat.com> 32:9.9.5-1
-- Update to 9.9.5 stable
-
-* Sun Jan 26 2014 Rex Dieter <rdieter@fedoraproject.org> 32:9.9.5-0.5.rc2
-- -libs, -libs-lite: track sonames, so abi bumps aren't a surprise
-
-* Fri Jan 24 2014 Tomas Hozza <thozza@redhat.com> 32:9.9.5-0.4.rc2
-- update to 9.9.5rc2
-- merged patches dropped
-- some patches rebased to the new version
-
-* Wed Jan 15 2014 Tomas Hozza <thozza@redhat.com> 32:9.9.5-0.3.b1
-- non-existance of resolv.conf should not be fatal (#1052343)
-
-* Tue Jan 14 2014 Tomas Hozza <thozza@redhat.com> 32:9.9.5-0.2.b1
-- Fix CVE-2014-0591
-
-* Mon Jan 06 2014 Tomas Hozza <thozza@redhat.com> 32:9.9.5-0.1.b1
-- Update to bind-9.9.5b1
-- Build bind-sdb against libdb instead of libdb4
-
-* Wed Dec 18 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.4-11
-- Fix crash in rbtdb after two sucessive getoriginnode() calls
-
-* Tue Dec 17 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.4-10
-- Split chroot package for named and named-sdb
-- Extract setting-up/destroying of chroot to a separate systemd service (#997030)
-
-* Thu Nov 28 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.4-9
-- Fixed memory leak in nsupdate if 'realm' was used multiple times (#984687)
-
-* Tue Nov 12 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.4-8
-- Install configuration for rwtab and fix chroot setup script
-
-* Thu Oct 31 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.4-7
-- Correct the upstream patch for #794940
-
-* Thu Oct 31 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.4-6
-- use --enable-filter-aaaa when building bind to enable use of filter-aaaa-on-v4 option
-
-* Wed Oct 30 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.4-5
-- Create symlink /var/named/chroot/var/run -> /var/named/chroot/run
-- Added session-keyfile statement into default named.conf since we use /run/named
-
-* Tue Oct 29 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.4-4
-- Use upstream version of patch for previously fixed #794940
-
-* Fri Oct 18 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.4-3
-- Fix race condition on send buffers in dighost.c (#794940)
-
-* Tue Oct 08 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.4-2
-- install isc/errno2result.h header
-
-* Fri Sep 20 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.4-1
-- Update to bind-9.9.4 stable
-
-* Tue Sep 10 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.4-0.9.rc2
-- Fix [ISC-Bugs #34738] dns_journal_open() returns a pointer to stack
-
-* Mon Sep 09 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.4-0.8.rc2
-- update to bind-9.9.4rc2
-
-* Tue Aug 20 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.4-0.7.rc1
-- Move named-checkzone and named-compilezone to bind-utils package
-
-* Tue Aug 20 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.4-0.6.rc1
-- Move tools that don't need the server to run, from main package to bind-utils (#964313)
-
-* Fri Aug 16 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.4-0.5.rc1
-- Don't generate rndc.key if there exists rndc.conf
-
-* Fri Aug 16 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.4-0.4.rc1
-- don't install named-sdb.service if SDB macro is defined to zero
-
-* Mon Aug 05 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.4-0.3.rc1
-- Fix setup-named-chroot.sh to mount/umount everything successfully
-- update to bind-9.9.4rc1
-
-* Sat Aug 03 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 32:9.9.4-0.2.b1
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
-
-* Mon Jul 15 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.4-0.1.b1
-- update to bind-9.9.4b1
-- drop merged RRL patch
-- drop merged stat.h patch
-
-* Wed Jun 05 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.3-3.P1
-- update to 9.9.3-P1 (fix for CVE-2013-3919)
-- update RRL patch to 9.9.3-P1-rl.156.01
-
-* Mon Jun 03 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.3-2
-- bump release to prevent update path issues
-
-* Mon Jun 03 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.3-1
-- update to 9.9.3
-- install dns/update.h header
-- update RRL patch to the latest version 9.9.3-rl.150.20
-
-* Fri May 17 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.3-0.7.rc2
-- Fix segfault in host/nslookup (#878139)
-
-* Mon May 13 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.3-0.6.rc2
-- update to 9.9.3rc2
-- part of bind97-exportlib.patch not needed any more
-- bind-9.9.1-P2-multlib-conflict.patch modified to reflect latest source
-- rl-9.9.3rc1.patch -> rl-9.9.3rc2.patch
-- bind99-opts.patch merged
-
-* Fri May 03 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.3-0.5.rc1
-- Include recursion Warning in named.conf and named.conf.sample (#740894)
-- Include managed-keys-directory statement in named.conf.sample (#948026)
-
-* Thu May 02 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.3-0.4.rc1
-- Fix zone2sqlite to quote table names when creating/dropping/inserting (#919417)
-
-* Fri Apr 19 2013 Adam Tkac <atkac redhat com> 32:9.9.3-0.3.rc1
-- fix crash in nsupdate when processing "-r" parameter (#949544)
-
-* Tue Apr 16 2013 Adam Tkac <atkac redhat com> 32:9.9.3-0.2.rc1
-- ship dns/rrl.h in -devel subpkg
-
-* Tue Apr 16 2013 Adam Tkac <atkac redhat com> 32:9.9.3-0.1.rc1
-- update to 9.9.3rc1
-- bind-96-libtool2.patch has been merged
-- fix bind tmpfiles.d for named.pid /run migration (#920713)
-
-* Wed Mar 27 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.2-12.P2
-- New upstream patch version fixing CVE-2013-2266 (#928032)
-
-* Tue Mar 19 2013 Adam Tkac <atkac redhat com> 32:9.9.2-11.P1
-- move pidfile to /run/named/named.pid
-
-* Wed Mar 06 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.2-10.P1
-- Fix Makefile.in to include header added by rate limiting patch (#918330)
-
-* Tue Mar 05 2013 Adam Tkac <atkac redhat com> 32:9.9.2-9.P1
-- drop some developer-only documentation and move ARM to %%docdir
-
-* Mon Feb 18 2013 Adam Tkac <atkac redhat com> 32:9.9.2-8.P1
-- include rate limiting patch
-
-* Tue Jan 29 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.2-7.P1
-- Corrected IP addresses in named.ca (#901741)
-- mount/umount /var/named in setup-named-chroot.sh as the last one (#904666)
-
-* Thu Dec 20 2012 Adam Tkac <atkac redhat com> 32:9.9.2-6.P1
-- generate /etc/rndc.key during named service startup if doesn't exist
-- increase startup timeout in systemd units to 90sec (default)
-- fix IDN related statement in dig.1 manpage
-
-* Wed Dec 05 2012 Tomas Hozza <thozza@redhat.com> 32:9.9.2-5.P1
-- update to bind-9.9.2-P1
-
-* Mon Nov 12 2012 Adam Tkac <atkac redhat com> 32:9.9.2-4
-- document dig exit codes in manpage
-- ignore empty "search" options in resolv.conf
-
-* Mon Nov 12 2012 Adam Tkac <atkac redhat com> 32:9.9.2-3
-- drop PKCS11 support on rhel
-
-* Thu Oct 11 2012 Adam Tkac <atkac redhat com> 32:9.9.2-2
-- install isc/stat.h
-
-* Thu Oct 11 2012 Adam Tkac <atkac redhat com> 32:9.9.2-1
-- update to 9.9.2
-- bind97-rh714049.patch has been dropped
-- patches merged
-  - bind98-rh816164.patch
-
-* Thu Sep 13 2012 Adam Tkac <atkac redhat com> 32:9.9.1-10.P3
-- update to bind-9.9.1-P3
-
-* Wed Aug 22 2012 Tomas Hozza <thozza@redhat.com> 32:9.9.1-9.P2
-- fixed SPEC file so it comply with new systemd-rpm macros guidelines (#850045)
-- changed %%define macros to %%global and fixed several rpmlint warnings
-
-* Wed Aug 08 2012 Tomas Hozza <thozza@redhat.com> 32:9.9.1-8.P2
-- Changed PrivateTmp to "false" in *-chroot.service unit files (#825869)
-
-* Wed Aug 01 2012 Tomas Hozza <thozza@redhat.com> 32:9.9.1-7.P2
-- Fixed bind-devel multilib conflict (#478718)
-
-* Mon Jul 30 2012 Tomas Hozza <thozza@redhat.com> 32:9.9.1-6.P2
-- Fixed bad path to systemctl in /etc/NetworkManager/dispatcher.d/13-named (#844047)
-- Fixed path to libdb.so in config.dlz.in
-
-* Thu Jul 26 2012 Adam Tkac <atkac redhat com> 32:9.9.1-5.P2
-- update to 9.9.1-P2
-
-* Wed Jul 18 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 32:9.9.1-4.P1
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
-
-* Wed Jul 11 2012 Ville Skyttä <ville.skytta@iki.fi> - 32:9.9.1-3.P1
-- Avoid shell invocation and dep for -libs-lite %%postun.
-
-* Mon Jun 04 2012 Adam Tkac <atkac redhat com> 32:9.9.1-2.P1
-- update to 9.9.1-P1 (CVE-2012-1667)
-
-* Thu May 24 2012 Adam Tkac <atkac redhat com> 32:9.9.1-1
-- update to 9.9.1
-- bind99-coverity.patch merged
-- bind-9.5-overflow.patch merged
-
-* Mon May 07 2012 Adam Tkac <atkac redhat com> 32:9.9.0-6
-- nslookup: return non-zero exit code when fail to get answer (#816164)
-
-* Thu Apr 26 2012 Adam Tkac <atkac redhat com> 32:9.9.0-5
-- initscript: don't umount /var/named when didn't mount it
-
-* Tue Apr 24 2012 Adam Tkac <atkac redhat com> 32:9.9.0-4
-- apply all non-SDB patches before SDB ones (#804475)
-- enable Berkeley DB DLZ backend (#804478)
-
-* Thu Apr 12 2012 Adam Tkac <atkac redhat com> 32:9.9.0-3
-- bind97-rh699951.patch is no longer needed (different fix is in 9.9.0)
-
-* Mon Mar 26 2012 Adam Tkac <atkac redhat com> 32:9.9.0-2
-- remove unneeded bind99-v6only.patch
-
-* Mon Mar 05 2012 Adam Tkac <atkac redhat com> 32:9.9.0-1
-- update to 9.9.0
-- load dynamic DBs later (and update dyndb patch)
-- fix memory leak in named during processing of rndc command
-- don't call `rndc-confgen -a` in "post" section
-- fix some packaging bugs in bind-chroot
-
-* Wed Feb 15 2012 Adam Tkac <atkac redhat com> 32:9.9.0-0.8.rc2
-- build with "--enable-fixed-rrset"
-
-* Wed Feb 01 2012 Adam Tkac <atkac redhat com> 32:9.9.0-0.7.rc2
-- update to 9.9.0rc2
-- doc/rfc and doc/draft are no longer shipped in tarball
-
-* Mon Jan 30 2012 Adam Tkac <atkac redhat com> 32:9.9.0-0.6.rc1
-- retire initscript in favour of systemd unit files (#719419)
-
-* Thu Jan 12 2012 Adam Tkac <atkac redhat com> 32:9.9.0-0.5.rc1
-- update to 9.9.0rc1
-
-* Wed Dec 07 2011 Adam Tkac <atkac redhat com> 32:9.9.0-0.4.b2
-- ship dns/forward.h in -devel subpkg
-
-* Tue Nov 22 2011 Adam Tkac <atkac redhat com> 32:9.9.0-0.3.b2
-- update to 9.9.0b2 (CVE-2011-4313)
-- patches merged
-  - bind97-rh700097.patch
-  - bind99-cinfo.patch
-
-* Mon Nov 14 2011 Adam Tkac <atkac redhat com> 32:9.9.0-0.2.b1
-- ship dns/clientinfo.h in bind-devel
-
-* Fri Nov 11 2011 Adam Tkac <atkac redhat com> 32:9.9.0-0.1.b1
-- update to 9.9.0b1
-- bind98-dlz_buildfix.patch merged
-
-* Fri Oct 28 2011 Adam Tkac <atkac redhat com> 32:9.8.1-4
-- nslookup failed to resolve name in certain cases
-
-* Mon Sep 26 2011 Adam Tkac <atkac redhat com> 32:9.8.1-3
-- remove deps filter, it is no longer needed (#739663)
-
-* Fri Sep 09 2011 Adam Tkac <atkac redhat com> 32:9.8.1-2
-- fix logrotate config file (#725256)
-
-* Wed Sep 07 2011 Adam Tkac <atkac redhat com> 32:9.8.1-1
-- update to 9.8.1
-- ship /etc/trusted-key.key (needed by dig)
-- use select instead of epoll in export libs (#735103)
-
-* Wed Aug 31 2011 Adam Tkac <atkac redhat com> 32:9.8.1-0.3.rc1
-- fix DLZ related compilation issues
-- make /etc/named.{root,iscdlv}.key world-readable
-- add bind-libs versioned requires to bind pkg
-
-* Wed Aug 31 2011 Adam Tkac <atkac redhat com> 32:9.8.1-0.2.rc1
-- fix rare race condition in request.c
-- print "the working directory is not writable" as debug message
-- re-add configtest target to initscript
-- initscript: sybsys name is always named, not named-sdb
-- nsupdate returned zero when target zone didn't exist (#700097)
-- nsupdate could have failed if server has multiple IPs and the first
-  was unreachable (#714049)
-
-* Wed Aug 31 2011 Adam Tkac <atkac redhat com> 32:9.8.1-0.1.rc1
-- update to 9.8.1rc1
-- patches merged
-  - bind97-rh674334.patch
-  - bind97-cleanup.patch
-  - bind98-includes.patch
-
-* Wed Aug 03 2011 Adam Tkac <atkac redhat com> 32:9.8.0-9.P4
-- improve patch for #725741
-
-* Tue Jul 26 2011 Adam Tkac <atkac redhat com> 32:9.8.0-8.P4
-- named could have crashed during reload when dyndb module is used (#725741)
-
-* Tue Jul 05 2011 Adam Tkac <atkac redhat com> 32:9.8.0-7.P4
-- update to 9.8.0-P4
-  - bind98-libdns-export.patch merged
-
-* Thu Jun 02 2011 Adam Tkac <atkac redhat com> 32:9.8.0-6.P2
-- update the dyndb patch
-
-* Fri May 27 2011 Adam Tkac <atkac redhat com> 32:9.8.0-5.P2
-- fix compilation of libdns-export.so
-
-* Fri May 27 2011 Adam Tkac <atkac redhat com> 32:9.8.0-4.P2
-- update to 9.8.0-P2 (CVE-2011-1910)
-
-* Fri May 06 2011 Adam Tkac <atkac redhat com> 32:9.8.0-3.P1
-- update to 9.8.0-P1 (CVE-2011-1907)
-
-* Wed Mar 23 2011 Dan Horák <dan@danny.cz> - 32:9.8.0-2
-- rebuilt for mysql 5.5.10 (soname bump in libmysqlclient)
-
-* Thu Mar 03 2011 Adam Tkac <atkac redhat com> 32:9.8.0-1
-- update to 9.8.0
-- bind97-rh665971.patch merged
-
-* Thu Mar 03 2011 Adam Tkac <atkac redhat com> 32:9.8.0-0.4.rc1
-- revert previous change (integration with libnmserver)
-
-* Tue Feb 22 2011 Adam Tkac <atkac redhat com> 32:9.8.0-0.3.rc1
-- integrate named with libnmserver library
-
-* Tue Feb 22 2011 Adam Tkac <atkac redhat com> 32:9.8.0-0.2.rc1
-- include dns/rpz.h in -devel subpkg
-
-* Mon Feb 21 2011 Adam Tkac <atkac redhat com> 32:9.8.0-0.1.rc1
-- update to 9.8.0rc1
-
-* Fri Feb 18 2011 Adam Tkac <atkac redhat com> 32:9.7.3-1
-- update to 9.7.3
-- fix dig +trace on dualstack systems (#674334)
-- fix linkage order when building on system with older BIND (#665971)
-- reduce number of gcc warnings
-
-* Mon Feb 07 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 32:9.7.3-0.6.rc1
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
-
-* Tue Jan 25 2011 Adam Tkac <atkac redhat com> 32:9.7.3-0.5.rc1
-- update to 9.7.3rc1
-  - bind97-krb5-self.patch merged
-
-* Wed Jan 12 2011 Adam Tkac <atkac redhat com> 32:9.7.3-0.4.b1
-- fix typo in initscript
-
-* Thu Jan 06 2011 Adam Tkac <atkac redhat com> 32:9.7.3-0.3.b1
-- fix "service named status" when used with named-sdb
-- don't check MD5, size and mtime of sysconfig/named
-
-* Wed Jan 05 2011 Adam Tkac <atkac redhat com> 32:9.7.3-0.2.b1
-- add new option DISABLE_ZONE_CHECKING to sysconfig/named
-
-* Wed Jan 05 2011 Adam Tkac <atkac redhat com> 32:9.7.3-0.1.b1
-- update to 9.7.3b1
-
-* Wed Jan 05 2011 Adam Tkac <atkac redhat com> 32:9.7.2-10.P3
-- initscript should terminate only the correct "named" process (#622785)
-
-* Mon Dec 20 2010 Adam Tkac <atkac redhat com> 32:9.7.2-9.P3
-- fix "krb5-self" update-policy rule processing
-
-* Thu Dec 02 2010 Adam Tkac <atkac redhat com> 32:9.7.2-8.P3
-- update to 9.7.2-P3
-
-* Mon Nov 29 2010 Jan Görig <jgorig redhat com> 32:9.7.2-7.P2
-- added tmpfiles.d support (#656550)
-- removed old PID checking in initscript
-
-* Mon Nov 08 2010 Adam Tkac <atkac redhat com> 32:9.7.2-6.P2
-- don't emit various informational messages by default (#645544)
-
-* Wed Oct 20 2010 Adam Tkac <atkac redhat com> 32:9.7.2-5.P2
-- move BIND9 internal libs back to %%{_libdir}
-- add "-export" suffix to public libraries (-lite subpkg)
-
-* Thu Oct 07 2010 Adam Tkac <atkac redhat com> 32:9.7.2-4.P2
-- ship -devel subpkg for internal libs, dnsperf needs it
-
-* Thu Oct 07 2010 Adam Tkac <atkac redhat com> 32:9.7.2-3.P2
-- new bind-libs-lite and bind-lite-devel subpkgs which contain
-  public version of BIND 9 libraries
-- don't ship devel files for internal version of BIND 9 libraries
-
-* Wed Sep 29 2010 Adam Tkac <atkac redhat com> 32:9.7.2-2.P2
-- update to 9.7.2-P2
-
-* Thu Sep 16 2010 Adam Tkac <atkac redhat com> 32:9.7.2-1
-- update to 9.7.2
-
-* Fri Aug 27 2010 Adam Tkac <atkac redhat com> 32:9.7.2-0.3.rc1
-- update to 9.7.2rc1
-
-* Tue Aug 10 2010 Adam Tkac <atkac redhat com> 32:9.7.2-0.2.b1
-- host: handle "debug", "attempts" and "timeout" options in resolv.conf well
-
-* Tue Aug 03 2010 Adam Tkac <atkac redhat com> 32:9.7.2-0.1.b1
-- update to 9.7.2b1
-- patches merged
-  - bind97-rh507429.patch
-
-* Mon Jul 19 2010 Adam Tkac <atkac redhat com> 32:9.7.1-5.P2
-- supply root zone DNSKEY in default configuration
-
-* Mon Jul 19 2010 Adam Tkac <atkac redhat com> 32:9.7.1-4.P2
-- update to 9.7.1-P2 (CVE-2010-0213)
-
-* Mon Jul 12 2010 Adam Tkac <atkac redhat com> 32:9.7.1-3.P1
-- remove outdated Copyright.caching-nameserver file
-- remove rfc1912.txt, it is already located in %%doc/rfc directory
-- move COPYRIGHT to the bind-libs subpkg
-- add COPYRIGHT to the -pkcs11 subpkg
-
-* Fri Jul 09 2010 Adam Tkac <atkac redhat com> 32:9.7.1-2.P1
-- update to 9.7.1-P1
-
-* Mon Jun 28 2010 Adam Tkac <atkac redhat com> 32:9.7.1-1
-- update to 9.7.1
-- improve the "dnssec-conf" trigger
-
-* Wed Jun 09 2010 Adam Tkac <atkac redhat com> 32:9.7.1-0.2.rc1
-- update to 9.7.1rc1
-- patches merged
-  - bind97-keysdir.patch
-
-* Mon May 31 2010 Adam Tkac <atkac redhat com> 32:9.7.1-0.1.b1
-- update to 9.7.1b1
-- make /var/named/dynamic as a default directory for managed DNSSEC keys
-- add patch to get "managed-keys-directory" option working
-- patches merged
-  - bind97-managed-keyfile.patch
-  - bind97-rh554316.patch
-
-* Fri May 21 2010 Adam Tkac <atkac redhat com> 32:9.7.0-11.P2
-- update dnssec-conf Obsoletes/Provides
-
-* Thu May 20 2010 Adam Tkac <atkac redhat com> 32:9.7.0-10.P2
-- update to 9.7.0-P2
-
-* Fri Mar 26 2010 Adam Tkac <atkac redhat com> 32:9.7.0-9.P1
-- added lost patch for #554316 (occasional crash in keytable.c)
-
-* Fri Mar 26 2010 Adam Tkac <atkac redhat com> 32:9.7.0-8.P1
-- active query might be destroyed in resume_dslookup() which triggered REQUIRE
-  failure (#507429)
-
-* Mon Mar 22 2010 Adam Tkac <atkac redhat com> 32:9.7.0-7.P1
-- install SDB related manpages only when build with SDB
-
-* Fri Mar 19 2010 Adam Tkac <atkac redhat com> 32:9.7.0-6.P1
-- update to 9.7.0-P1
-
-* Tue Mar 16 2010 Jan Görig <jgorig redhat com> 32:9.7.0-5
-- bind-sdb now requires bind
-
-* Mon Mar 15 2010 Jan Görig <jgorig redhat com> 32:9.7.0-4
-- add man-pages ldap2zone.1 zonetodb.1 zone2sqlite.1 named-sdb.8 (#525655)
-
-* Mon Mar 01 2010 Adam Tkac <atkac redhat com> 32:9.7.0-3
-- fix multilib issue (#478718) [jgorig]
-
-* Mon Mar 01 2010 Adam Tkac <atkac redhat com> 32:9.7.0-2
-- improve automatic DNSSEC reconfiguration trigger
-- initscript now returns 2 in case that action doesn't exist (#523435)
-- enable/disable chroot when bind-chroot is installed/uninstalled
-
-* Wed Feb 17 2010 Adam Tkac <atkac redhat com> 32:9.7.0-1
-- update to 9.7.0 final
-
-* Mon Feb 15 2010 Adam Tkac <atkac redhat com> 32:9.7.0-0.14.rc2
-- obsolete dnssec-conf
-- automatically update configuration from old dnssec-conf based
-- improve default configuration; enable DLV by default
-- remove obsolete triggerpostun from bind-libs subpackage
-
-* Thu Jan 28 2010 Adam Tkac <atkac redhat com> 32:9.7.0-0.13.rc2
-- update to 9.7.0rc2
-
-* Wed Jan 27 2010 Adam Tkac <atkac redhat com> 32:9.7.0-0.12.rc1
-- initscript LSB related fixes (#523435)
-
-* Wed Jan 27 2010 Adam Tkac <atkac redhat com> 32:9.7.0-0.11.rc1
-- revert the "DEBUG" feature (#510283), it causes too many problems (#545128)
-
-* Tue Dec 15 2009 Adam Tkac <atkac redhat com> 32:9.7.0-0.10.rc1
-- update to 9.7.0rc1
-- bind97-headers.patch merged
-- update default configuration
-
-* Tue Dec 01 2009 Adam Tkac <atkac redhat com> 32:9.7.0-0.9.b3
-- update to 9.7.0b3
-
-* Thu Nov 26 2009 Adam Tkac <atkac redhat com> 32:9.7.0-0.8.b2
-- install isc/namespace.h header
-
-* Fri Nov 06 2009 Adam Tkac <atkac redhat com> 32:9.7.0-0.7.b2
-- update to 9.7.0b2
-
-* Tue Nov 03 2009 Adam Tkac <atkac redhat com> 32:9.7.0-0.6.b1
-- update to 9.7.0b1
-- add bind-pkcs11 subpackage to support PKCS11 compatible keystores for DNSSEC
-  keys
-
-* Thu Oct 08 2009 Adam Tkac <atkac redhat com> 32:9.7.0-0.5.a3
-- don't package named-bootconf utility, it is very outdated and unneeded
-
-* Mon Sep 21 2009 Adam Tkac <atkac redhat com> 32:9.7.0-0.4.a3
-- determine file size via `stat` instead of `ls` (#523682)
-
-* Wed Sep 16 2009 Adam Tkac <atkac redhat com> 32:9.7.0-0.3.a3
-- update to 9.7.0a3
-
-* Tue Sep 15 2009 Adam Tkac <atkac redhat com> 32:9.7.0-0.2.a2
-- improve chroot related documentation (#507795)
-- add NetworkManager dispatcher script to reload named when network interface is
-  activated/deactivated (#490275)
-- don't set/unset named_write_master_zones SELinux boolean every time in
-  initscript, modify it only when it's actually needed
-
-* Tue Sep 15 2009 Adam Tkac <atkac redhat com> 32:9.7.0-0.1.a2
-- update to 9.7.0a2
-- merged patches
-  - bind-96-db_unregister.patch
-  - bind96-rh507469.patch
-
-* Tue Sep 01 2009 Adam Tkac <atkac redhat com> 32:9.6.1-9.P1
-- next attempt to fix the postun trigger (#520385)
-- remove obsolete bind-9.3.1rc1-fix_libbind_includedir.patch
-
-* Fri Aug 21 2009 Tomas Mraz <tmraz@redhat.com> - 32:9.6.1-8.P1
-- rebuilt with new openssl
-
-* Tue Aug 04 2009 Martin Nagy <mnagy redhat com> 32:9.6.1-7.P1
-- update the patch for dynamic loading of database backends
-
-* Wed Jul 29 2009 Adam Tkac <atkac redhat com> 32:9.6.1-6.P1
-- 9.6.1-P1 release (CVE-2009-0696)
-- fix postun trigger (#513016, hopefully)
-
-* Fri Jul 24 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 32:9.6.1-5
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
-
-* Mon Jul 20 2009 Adam Tkac <atkac redhat com> 32:9.6.1-4
-- remove useless bind-9.3.3rc2-rndckey.patch
-
-* Mon Jul 13 2009 Adam Tkac <atkac redhat com> 32:9.6.1-3
-- fix broken symlinks in bind-libs (#509635)
-- fix typos in /etc/sysconfig/named (#509650)
-- add DEBUG option to /etc/sysconfig/named (#510283)
-
-* Wed Jun 24 2009 Adam Tkac <atkac redhat com> 32:9.6.1-2
-- improved "chroot automount" patches (#504596)
-- host should fail if specified server doesn't respond (#507469)
-
-* Wed Jun 17 2009 Adam Tkac <atkac redhat com> 32:9.6.1-1
-- 9.6.1 release
-- simplify chroot maintenance. Important files and directories are mounted into
-  chroot (see /etc/sysconfig/named for more info, #504596)
-- fix doc/named.conf.default perms
-
-* Wed May 27 2009 Adam Tkac <atkac redhat com> 32:9.6.1-0.4.rc1
-- 9.6.1rc1 release
-
-* Wed Apr 29 2009 Martin Nagy <mnagy redhat com> 32:9.6.1-0.3.b1
-- update the patch for dynamic loading of database backends
-- create %%{_libdir}/bind directory
-- copy default named.conf to doc directory, shared with s-c-bind (atkac)
-
-* Fri Apr 24 2009 Martin Nagy <mnagy redhat com> 32:9.6.1-0.2.b1
-- update the patch for dynamic loading of database backends
-- fix dns_db_unregister()
-- useradd now takes "-N" instead of "-n" (atkac, #495726)
-- print nicer error msg when zone file is actually a directory (atkac, #490837)
-
-* Mon Mar 30 2009 Adam Tkac <atkac redhat com> 32:9.6.1-0.1.b1
-- 9.6.1b1 release
-- patches merged
-  - bind-96-isc_header.patch
-  - bind-95-rh469440.patch
-  - bind-96-realloc.patch
-  - bind9-fedora-0001.diff
-- use -version-number instead of -version-info libtool param
-
-* Mon Mar 23 2009 Adam Tkac <atkac redhat com> 32:9.6.0-11.1.P1
-- logrotate configuration file now points to /var/named/data/named.run by
-  default (#489986)
-
-* Tue Mar 17 2009 Adam Tkac <atkac redhat com> 32:9.6.0-11.P1
-- fall back to insecure mode when no supported DNSSEC algorithm is found
-  instead of SERVFAIL
-- don't fall back to non-EDNS0 queries when DO bit is set
-
-* Tue Mar 10 2009 Adam Tkac <atkac redhat com> 32:9.6.0-10.P1
-- enable DNSSEC only if it is enabled in sysconfig/dnssec
-
-* Mon Mar 09 2009 Adam Tkac <atkac redhat com> 32:9.6.0-9.P1
-- add DNSSEC support to initscript, enabled it per default
-- add requires dnssec-conf
-
-* Mon Mar 09 2009 Adam Tkac <atkac redhat com> 32:9.6.0-8.P1
-- fire away libbind, it is now separate package
-
-* Wed Mar 04 2009 Adam Tkac <atkac redhat com> 32:9.6.0-7.P1
-- fixed some read buffer overflows (upstream)
-
-* Mon Feb 23 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> 32:9.6.0-6.P1
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
-
-* Thu Feb 12 2009 Martin Nagy <mnagy redhat com> 32:9.6.0-5.P1
-- update the patch for dynamic loading of database backends
-- include iterated_hash.h
-
-* Sat Jan 24 2009 Caolán McNamara <caolanm@redhat.com> 32:9.6.0-4.P1
-- rebuild for dependencies
-
-* Wed Jan 21 2009 Adam Tkac <atkac redhat com> 32:9.6.0-3.P1
-- rebuild against new openssl
-
-* Thu Jan 08 2009 Adam Tkac <atkac redhat com> 32:9.6.0-2.P1
-- 9.6.0-P1 release (CVE-2009-0025)
-
-* Mon Jan 05 2009 Adam Tkac <atkac redhat com> 32:9.6.0-1
-- Happy new year
-- 9.6.0 release
-
-* Thu Dec 18 2008 Adam Tkac <atkac redhat com> 32:9.6.0-0.7.rc2
-- 9.6.0rc2 release
-- bind-96-rh475120.patch merged
-
-* Tue Dec 16 2008 Martin Nagy <mnagy redhat com> 32:9.6.0-0.6.rc1
-- add patch for dynamic loading of database backends
-
-* Tue Dec 09 2008 Adam Tkac <atkac redhat com> 32:9.6.0-0.5.1.rc1
-- allow to reuse address for non-random query-source ports (#475120)
-
-* Wed Dec 03 2008 Adam Tkac <atkac redhat com> 32:9.6.0-0.5.rc1
-- 9.6.0rc1 release
-- patches merged
-  - bind-9.2.0rc3-varrun.patch
-  - bind-95-sdlz-include.patch
-  - bind-96-libxml2.patch
-- fixed rare use-after-free problem in host utility (#452060)
-- enabled chase of DNSSEC signature chains in dig
-
-* Mon Dec 01 2008 Adam Tkac <atkac redhat com> 32:9.6.0-0.4.1.b1
-- improved sample config file (#473586)
-
-* Wed Nov 26 2008 Adam Tkac <atkac redhat com> 32:9.6.0-0.4.b1
-- reverted previous change, koji doesn't like it
-
-* Wed Nov 26 2008 Adam Tkac <atkac redhat com> 32:9.6.0-0.3.b1
-- build bind-chroot as noarch
-
-* Mon Nov 24 2008 Adam Tkac <atkac redhat com> 32:9.6.0-0.2.1.b1
-- updates due libtool 2.2.6
-- don't pass -DLDAP_DEPRECATED to cpp, handle it directly in sources
-
-* Tue Nov 11 2008 Adam Tkac <atkac redhat com> 32:9.6.0-0.2.b1
-- make statistics http server working, patch backported from 9.6 HEAD
-
-* Mon Nov 10 2008 Adam Tkac <atkac redhat com> 32:9.6.0-0.1.b1
-- 9.6.0b1 release
-- don't build ODBC and Berkeley DB DLZ drivers
-- end of bind-chroot-admin script, copy config files to chroot manually
-- /proc doesn't have to be mounted to chroot
-- temporary use libbind from 9.5 series, noone has been released for 9.6 yet
-
-* Mon Nov 03 2008 Adam Tkac <atkac redhat com> 32:9.5.1-0.8.4.b2
-- dig/host: use only IPv4 addresses when -4 option is specified (#469440)
-
-* Thu Oct 30 2008 Adam Tkac <atkac redhat com> 32:9.5.1-0.8.2.b2
-- removed unneeded bind-9.4.1-ldap-api.patch
-
-* Thu Oct 30 2008 Adam Tkac <atkac redhat com> 32:9.5.1-0.8.1.b2
-- ship dns/{s,}dlz.h and isc/radix.h in bind-devel
-
-* Tue Oct 07 2008 Adam Tkac <atkac redhat com> 32:9.5.1-0.8.b2
-- removed bind-9.4.0-dnssec-directory.patch, it is wrong
-
-* Wed Sep 24 2008 Adam Tkac <atkac redhat com> 32:9.5.1-0.7.b2
-- 9.5.1b2 release
-- patches merged
-  - bind95-rh454783.patch
-  - bind-9.5-edns.patch
-  - bind95-rh450995.patch
-  - bind95-rh457175.patch
-
-* Wed Sep 17 2008 Adam Tkac <atkac redhat com> 32:9.5.1-0.6.b1
-- IDN output strings didn't honour locale settings (#461409)
-
-* Tue Aug 05 2008 Adam Tkac <atkac redhat com> 32:9.5.1-0.5.b1
-- disable transfer stats on DLZ zones (#454783)
-
-* Mon Aug 04 2008 Adam Tkac <atkac redhat com> 32:9.5.1-0.4.b1
-- add forgotten patch for #457175
-- build with -O2
-
-* Thu Jul 31 2008 Adam Tkac <atkac redhat com> 32:9.5.1-0.3.b1
-- static libraries are no longer supported
-- IP acls weren't merged correctly (#457175)
-- use fPIE on sparcv9/sparc64 (Dennis Gilmore)
-- add sparc64 to list of 64bit arches in spec (Dennis Gilmore)
-
-* Mon Jul 21 2008 Adam Tkac <atkac redhat com> 32:9.5.1-0.2.b1
-- updated patches due new rpm (--fuzz=0 patch parameter)
-
-* Mon Jul 14 2008 Adam Tkac <atkac redhat com> 32:9.5.1-0.1.1.b1
-- use %%patch0 for Patch0 (#455061)
-- correct source address (#455118)
-
-* Tue Jul 08 2008 Adam Tkac <atkac redhat com> 32:9.5.1-0.1.b1
-- 9.5.1b1 release (CVE-2008-1447)
-- dropped bind-9.5-recv-race.patch because upstream doesn't want it
-
-* Mon Jun 30 2008 Adam Tkac <atkac redhat com> 32:9.5.0-37.1
-- update default named.conf statements (#452708)
-
-* Thu Jun 26 2008 Adam Tkac <atkac redhat com> 32:9.5.0-37
-- some compat changes to fix building on RHEL4
-
-* Mon Jun 23 2008 Adam Tkac <atkac redhat com> 32:9.5.0-36.3
-- fixed typo in %%posttrans script
-
-* Wed Jun 18 2008 Adam Tkac <atkac redhat com> 32:9.5.0-36.2
-- parse inner acls correctly (#450995)
-
-* Mon Jun 02 2008 Adam Tkac <atkac redhat com> 32:9.5.0-36.1
-- removed dns-keygen utility in favour of rndc-confgen -a (#449287)
-- some minor sample fixes (#449274)
-
-* Thu May 29 2008 Adam Tkac <atkac redhat com> 32:9.5.0-36
-- updated to 9.5.0 final
-- use getifaddrs to find available interfaces
-
-* Mon May 26 2008 Adam Tkac <atkac redhat com> 32:9.5.0-35.rc1
-- make /var/run/named writable by named (#448277)
-- fixed one non-utf8 file
-
-* Thu May 22 2008 Adam Tkac <atkac redhat com> 32:9.5.0-34.rc1
-- fixes needed to pass package review (#225614)
-
-* Wed May 21 2008 Adam Tkac <atkac redhat com> 32:9.5.0-33.1.rc1
-- bind-chroot now depends on bind (#446477)
-
-* Wed May 14 2008 Adam Tkac <atkac redhat com> 32:9.5.0-33.rc1
-- updated to 9.5.0rc1
-- merged patches
-  - bind-9.5-libcap.patch
-- make binaries readable by others (#427826)
-
-* Tue May 13 2008 Adam Tkac <atkac redhat com> 32:9.5.0-32.b3
-- reverted "any" patch, upstream says not needed
-- log EDNS failure only when we really switch to plain EDNS (#275091)
-- detect configuration file better
-
-* Tue May 06 2008 Adam Tkac <atkac redhat com> 32:9.5.0-31.1.b3
-- addresses 0.0.0.0 and ::0 really match any (#275091, comment #28)
-
-* Mon May 05 2008 Adam Tkac <atkac redhat com> 32:9.5.0-31.b3
-- readded bind-9.5-libcap.patch
-- added bind-9.5-recv-race.patch from F8 branch (#400461)
-
-* Wed Apr 23 2008 Adam Tkac <atkac redhat com> 32:9.5.0-30.1.b3
-- build Berkeley DB DLZ backend
-
-* Mon Apr 21 2008 Adam Tkac <atkac redhat com> 32:9.5.0-30.b3
-- 9.5.0b3 release
-- dropped patches (upstream)
-  - bind-9.5-transfer-segv.patch
-  - bind-9.5-mudflap.patch
-  - bind-9.5.0-generate-xml.patch
-  - bind-9.5-libcap.patch
-
-* Wed Apr 02 2008 Adam Tkac <atkac redhat com> 32:9.5.0-29.3.b2
-- fixed named.conf.sample file (#437569)
-
-* Fri Mar 14 2008 Adam Tkac <atkac redhat com> 32:9.5.0-29.2.b2
-- fixed URLs
-
-* Mon Feb 25 2008 Adam Tkac <atkac redhat com> 32:9.5.0-29.1.b2
-- BuildRequires cleanup
-
-* Sun Feb 24 2008 Adam Tkac <atkac redhat com> 32:9.5.0-29.b2
-- rebuild without mudflap (#434159)
-
-* Wed Feb 20 2008 Adam Tkac <atkac redhat com> 32:9.5.0-28.b2
-- port named to use libcap library, enable threads (#433102)
-- removed some unneeded Requires
-
-* Tue Feb 19 2008 Adam Tkac <atkac redhat com> 32:9.5.0-27.b2
-- removed conditional build with libefence (use -fmudflapth instead)
-- fixed building of DLZ stuff (#432497)
-- do not build Berkeley DB DLZ backend
-- temporary build with --disable-linux-caps and without threads (#433102)
-- update named.ca file to affect IPv6 changes in root zone
-
-* Mon Feb 11 2008 Adam Tkac <atkac redhat com> 32:9.5.0-26.b2
-- build with -D_GNU_SOURCE (#431734)
-- improved fix for #253537, posttrans script is now used
-- improved fix for #400461
-- 9.5.0b2
-  - bind-9.3.2b1-PIE.patch replaced by bind-9.5-PIE.patch
-    - only named, named-sdb and lwresd are PIE
-  - bind-9.5-sdb.patch has been updated
-  - bind-9.5-libidn.patch has been updated
-  - bind-9.4.0-sdb-sqlite-bld.patch replaced by bind-9.5-sdb-sqlite-bld.patch
-  - removed bind-9.5-gssapi-header.patch (upstream)
-  - removed bind-9.5-CVE-2008-0122.patch (upstream)
-- removed bind-9.2.2-nsl.patch
-- improved sdb_tools Makefile.in
-
-* Mon Feb 04 2008 Adam Tkac <atkac redhat com> 32:9.5.0-25.b1
-- fixed segfault during sending notifies (#400461)
-- rebuild with gcc 4.3 series
-
-* Tue Jan 22 2008 Adam Tkac <atkac redhat com> 32:9.5.0-24.b1
-- removed bind-9.3.2-prctl_set_dumpable.patch (upstream)
-- allow parallel building of libdns library
-- CVE-2008-0122
-
-* Thu Dec 27 2007 Adam Tkac <atkac redhat com> 32:9.5.0-23.b1
-- fixed initscript wait loop (#426382)
-- removed dependency on policycoreutils and libselinux (#426515)
-
-* Thu Dec 20 2007 Adam Tkac <atkac redhat com> 32:9.5.0-22.b1
-- fixed regression caused by libidn2 patch (#426348)
-
-* Wed Dec 19 2007 Adam Tkac <atkac redhat com> 32:9.5.0-21.b1
-- fixed typo in post section (CVE-2007-6283)
-
-* Wed Dec 19 2007 Adam Tkac <atkac redhat com> 32:9.5.0-20.b1
-- removed obsoleted triggers
-- CVE-2007-6283
-
-* Wed Dec 12 2007 Adam Tkac <atkac redhat com> 32:9.5.0-19.2.b1
-- added dst/gssapi.h to -devel subpackage (#419091)
-- improved fix for (#417431)
-
-* Mon Dec 10 2007 Adam Tkac <atkac redhat com> 32:9.5.0-19.1.b1
-- fixed shutdown with initscript when rndc doesn't work (#417431)
-- fixed IDN patch (#412241)
-
-* Thu Dec 06 2007 Adam Tkac <atkac redhat com> 32:9.5.0-19.b1
-- 9.5.0b1 (#405281, #392491)
-
-* Thu Dec 06 2007 Release Engineering <rel-eng at fedoraproject dot org> 32:9.5.0-18.6.a7
-- Rebuild for deps
-
-* Wed Dec 05 2007 Adam Tkac <atkac redhat com> 32:9.5.0-18.5.a7
-- build with -O0
-
-* Mon Dec 03 2007 Adam Tkac <atkac redhat com> 32:9.5.0-18.4.a7
-- bind-9.5-random_ports.patch was removed because upstream doesn't
-  like it. query-source{,v6} options are sufficient (#391931)
-- bind-chroot-admin called restorecon on /proc filesystem (#405281)
-
-* Mon Nov 26 2007 Adam Tkac <atkac redhat com> 32:9.5.0-18.3.a7
-- removed edns patch to keep compatibility with vanilla bind
-  (#275091, comment #20)
-
-* Wed Nov 21 2007 Adam Tkac <atkac redhat com> 32:9.5.0-18.2.a7
-- use system port selector instead ISC's (#391931)
-
-* Mon Nov 19 2007 Adam Tkac <atkac redhat com> 32:9.5.0-18.a7
-- removed statement from initscript which passes -D to named
-
-* Thu Nov 15 2007 Adam Tkac <atkac redhat com> 32:9.5.0-17.a7
-- 9.5.0a7
-- dropped patches (upstream)
-  - bind-9.5-update.patch
-  - bind-9.5-pool_badfree.patch
-  - bind-9.5-_res_errno.patch
-
-* Thu Nov 15 2007 Adam Tkac <atkac redhat com> 32:9.5.0-16.5.a6
-- added bind-sdb again, contains SDB modules and DLZ modules
-- bind-9.3.1rc1-sdb.patch replaced by bind-9.5-sdb.patch
-
-* Mon Nov 12 2007 Adam Tkac <atkac redhat com> 32:9.5.0-16.4.a6
-- removed Requires: openldap, postgresql, mysql, db4, unixODBC
-- new L.ROOT-SERVERS.NET address
-
-* Mon Oct 29 2007 Adam Tkac <atkac redhat com> 32:9.5.0-16.3.a6
-- completely disable DBUS
-
-* Fri Oct 26 2007 Adam Tkac <atkac redhat com> 32:9.5.0-16.2.a6
-- minor cleanup in bind-chroot-admin
-
-* Thu Oct 25 2007 Adam Tkac <atkac redhat com> 32:9.5.0-16.1.a6
-- fixed typo in initscript
-
-* Tue Oct 23 2007 Adam Tkac <atkac redhat com> 32:9.5.0-16.a6
-- disabled DBUS (dhcdbd doesn't exist & #339191)
-
-* Thu Oct 18 2007 Adam Tkac <atkac redhat com> 32:9.5.0-15.1.a6
-- fixed missing va_end () functions (#336601)
-- fixed memory leak when dbus initialization fails
-
-* Tue Oct 16 2007 Adam Tkac <atkac redhat com> 32:9.5.0-15.a6
-- corrected named.5 SDB statement (#326051)
-
-* Mon Sep 24 2007 Adam Tkac <atkac redhat com> 32:9.5.0-14.a6
-- added edns patch again (#275091)
-
-* Mon Sep 24 2007 Adam Tkac <atkac redhat com> 32:9.5.0-13.a6
-- removed bind-9.3.3-edns.patch patch (see #275091 for reasons)
-
-* Thu Sep 20 2007 Adam Tkac <atkac redhat com> 32:9.5.0-12.4.a6
-- build with O2
-- removed "autotools" patch
-- bugfixing in bind-chroot-admin (#279901)
-
-* Thu Sep 06 2007 Adam Tkac <atkac redhat com> 32:9.5.0-12.a6
-- bind-9.5-2119_revert.patch and bind-9.5-fix_h_errno.patch are
-  obsoleted by upstream bind-9.5-_res_errno.patch
-
-* Wed Sep 05 2007 Adam Tkac <atkac redhat com> 32:9.5.0-11.9.a6
-- fixed wrong resolver's dispatch pool cleanup (#275011, patch from 
-  tmraz redhat com)
-
-* Wed Sep 05 2007 Adam Tkac <atkac redhat com> 32:9.5.0-11.3.a6
-- initscript failure message is now printed correctly (#277981,
-  Quentin Armitage (quentin armitage org uk) )
-
-* Mon Sep 03 2007 Adam Tkac <atkac redhat com> 32:9.5.0-11.2.a6
-- temporary revert ISC 2119 change and add "libbind-errno" patch
-  (#254501) again
-
-* Thu Aug 23 2007 Adam Tkac <atkac redhat com> 32:9.5.0-11.1.a6
-- removed end dots from Summary sections (skasal@redhat.com)
-- fixed wrong file creation by autotools patch (skasal@redhat.com)
-
-* Thu Aug 23 2007 Adam Tkac <atkac redhat com> 32:9.5.0-11.a6
-- start using --disable-isc-spnego configure option
-  - remove bind-9.5-spnego-memory_management.patch (source isn't
-    compiled)
-
-* Wed Aug 22 2007 Adam Tkac <atkac redhat com> 32:9.5.0-10.2.a6
-- added new initscript option KEYTAB_FILE which specified where
-  is located kerberos .keytab file for named service
-- obsolete temporary bind-9.5-spnego-memory_management.patch by
-  bind-9.5-gssapictx-free.patch which conforms BIND coding standards
-  (#251853)
-
-* Tue Aug 21 2007 Adam Tkac <atkac redhat com> 32:9.5.0-10.a6
-- dropped direct dependency to /etc/openldap/schema directory
-- changed hardcoded paths to macros
-- fired away code which configure LDAP server
-
-* Tue Aug 14 2007 Adam Tkac <atkac redhat com> 32:9.5.0-9.1.a6
-- named could crash with SRV record UPDATE (#251336)
-
-* Mon Aug 13 2007 Adam Tkac <atkac redhat com> 32:9.5.0-9.a6
-- disable 64bit dlz driver patch on alpha and ia64 (#251298)
-- remove wrong malloc functions from lib/dns/spnego.c (#251853)
-
-* Mon Aug 06 2007 Adam Tkac <atkac redhat com> 32:9.5.0-8.2.a6
-- changed licence from BSD-like to ISC
-
-* Tue Jul 31 2007 Adam Tkac <atkac redhat com> 32:9.5.0-8.1.a6
-- disabled named on all runlevels by default
-
-* Mon Jul 30 2007 Adam Tkac <atkac redhat com> 32:9.5.0-8.a6
-- minor next improvements on autotools patch
-- dig and host utilities now using libidn instead idnkit for
-  IDN support
-
-* Wed Jul 25 2007 Warren Togami <wtogami@redhat.com> 32:9.5.0-7.a6
-- binutils/gcc bug rebuild (#249435)
-
-* Tue Jul 24 2007 Adam Tkac <atkac redhat com> 32:9.5.0-6.a6
-- updated to 9.5.0a6 which contains fixes for CVE-2007-2925 and
-  CVE-2007-2926
-- fixed building on 64bits
-
-* Mon Jul 23 2007 Adam Tkac <atkac redhat com> 31:9.5.0a5-5
-- integrated "autotools" patch for testing purposes (upstream will
-  accept it in future, for easier building)
-
-* Mon Jul 23 2007 Adam Tkac <atkac redhat com> 31:9.5.0a5-4.1
-- fixed DLZ drivers building on 64bit systems
-
-* Fri Jul 20 2007 Adam Tkac <atkac redhat com> 31:9.5.0a5-4
-- fixed relation between logrotated and chroot-ed named
-
-* Wed Jul 18 2007 Adam Tkac <atkac redhat com> 31:9.5.0a5-3.9
-- removed bind-sdb package (default named has compiled SDB backend now)
-- integrated DLZ (Dynamically loadable zones) drivers
-- integrated GSS-TSIG support (RFC 3645)
-- build with -O0 (many new features, potential core dumps will be more useful)
-
-* Tue Jul 17 2007 Adam Tkac <atkac redhat com> 31:9.5.0a5-3.2
-- initscript should be ready for parallel booting (#246878)
-
-* Tue Jul 17 2007 Adam Tkac <atkac redhat com> 31:9.5.0a5-3
-- handle integer overflow in isc_time_secondsastimet function gracefully (#247856)
-
-* Mon Jul 16 2007 Adam Tkac <atkac redhat com> 31:9.5.0a5-2.2
-- moved chroot configfiles into chroot subpackage (#248306)
-
-* Mon Jul 02 2007 Adam Tkac <atkac redhat com> 31:9.5.0a5-2
-- minor changes in default configuration
-- fix h_errno assigment during resolver initialization (unbounded recursion, #245857)
-- removed wrong patch to #150288
-
-* Tue Jun 19 2007 Adam Tkac <atkac redhat com> 31:9.5.0a5-1
-- updated to latest upstream
-
-* Wed Jun 13 2007 Adam Tkac <atkac redhat com> 31:9.4.1-7
-- marked caching-nameserver as obsolete (#244604)
-- fixed typo in initscript (causes that named doesn't detect NetworkManager
-  correctly)
-- next cleanup in configuration - moved configfiles into config.tar
-- removed delay between start & stop in restart function in named.init
-
-* Tue Jun 12 2007 Adam Tkac <atkac redhat com> 31:9.4.1-6
-- major changes in initscript. Could be LSB compatible now
-- removed caching-nameserver subpackage. Move configs from this
-  package to main bind package as default configuration and major
-  configuration cleanup
-
-* Mon Jun 04 2007 Adam Tkac <atkac redhat com> 31:9.4.1-5
-- very minor compatibility change in bind-chroot-admin (line 215)
-- enabled IDN support by default and don't distribute IDN libraries
-- specfile cleanup
-- add dynamic directory to /var/named. This directory will be primarily used for
-  dynamic DNS zones. ENABLE_ZONE_WRITE and SELinux's named_write_master_zones no longer exist
-
-* Thu May 24 2007 Adam Tkac <atkac redhat com> 31:9.4.1-4
-- removed ldap-api patch and start using deprecated API
-- fixed minor problem in bind-chroot-admin script (#241103)
-
-* Tue May 22 2007 Adam Tkac <atkac redhat com> 31:9.4.1-3
-- fixed bind-chroot-admin dynamic DNS handling (#239149)
-- updated zone-freeze patch to latest upstream
-- ldap sdb has been rewriten to latest api (#239802)
-
-* Mon May 07 2007 Adam Tkac <atkac redhat com> 31:9.4.1-2.fc7
-- test build on new build system
-
-* Wed May 02 2007 Adam Tkac <atkac redhat com> 31:9.4.1-1.fc7
-- updated to 9.4.1 which contains fix to CVE-2007-2241
-
-* Fri Apr 27 2007 Adam Tkac <atkac redhat com> 31:9.4.0-8.fc7
-- improved "zone freeze patch" - if multiple zone with same name exists
-  no zone is freezed
-- minor cleanup in caching-nameserver's config file
-- fixed race-condition in dbus code (#235809)
-- added forgotten restorecon statement in bind-chroot-admin
-
-* Tue Apr 17 2007 Adam Tkac <atkac redhat com> 31:9.4.0-7.fc7
-- removed DEBUGINFO option because with this option (default) was bind
-  builded with -O0 and without this flag no debuginfo package was produced.
-  (I want faster bind => -O2 + debuginfo)
-- fixed zone finding (#236426)
-
-* Mon Apr 16 2007 Adam Tkac <atkac redhat com> 31:9.4.0-6.fc7
-- added idn support (still under development with upstream, disabled by default)
-
-* Wed Apr 11 2007 Adam Tkac <atkac redhat com> 31:9.4.0-5.fc7
-- dnssec-signzone utility now doesn't ignore -d parameter
-
-* Tue Apr 10 2007 Adam Tkac <atkac redhat com> 31:9.4.0-4.fc7
-- removed query-source[-v6] options from caching-nameserver config
-  (#209954, increase security)
-- throw away idn. It won't be ready in fc7
-
-* Tue Mar 13 2007 Adam Tkac <atkac redhat com> 31:9.4.0-3.fc7
-- prepared bind to merge review
-- added experimental idn support to bind-utils utils (not enabled by default yet)
-- change chroot policy in caching-nameserver post section
-- fixed bug in bind-chroot-admin - rootdir function is called properly now
-
-* Mon Mar 12 2007 Adam Tkac <atkac redhat com> 31:9.4.0-2.fc7
-- added experimental SQLite support (written by John Boyd <jaboydjr@netwalk.com>)
-- moved bind-chroot-admin script to chroot package
-- bind-9.3.2-redhat_doc.patch is always applied (#231738)
-
-* Tue Mar 06 2007 Adam Tkac <atkac@redhat.com> 31:9.4.0-1.fc7
-- updated to 9.4.0
-- bind-chroot-admin now sets EAs correctly (#213926)
-- throw away next_server_on_referral and no_servfail_stops patches (fixed in 9.4.0)
-
-* Thu Feb 15 2007 Adam Tkac <atkac@redhat.com> 31:9.3.4-7.fc7
-- minor cleanup in bind-chroot-admin script
-
-* Fri Feb 09 2007 Adam Tkac <atkac@redhat.com> 31:9.3.4-6.fc7
-- fixed broken bind-chroot-admin script (#227995)
-
-* Wed Feb 07 2007 Adam Tkac <atkac@redhat.com> 31:9.3.4-5.fc7
-- bind-chroot-admin now uses correct chroot path (#227600)
-
-* Mon Feb 05 2007 Adam Tkac <atkac@redhat.com> 31:9.3.4-4.fc7
-- fixed conflict between bind-sdb and ldap
-- removed duplicated bind directory in bind-libs
-
-* Thu Feb 01 2007 Adam Tkac <atkac@redhat.com> 31:9.3.4-3.fc7
-- fixed building without libbind
-- fixed post section (selinux commands is now in if-endif statement)
-- prever macro has been removed from version
-
-* Mon Jan 29 2007 Adam Tkac <atkac@redhat.com> 31:9.3.4-2.fc7
-- redirected output from bind-chroot prep and %%preun stages to /dev/null
-
-* Thu Jan 25 2007 Adam Tkac <atkac@redhat.com> 31:9.3.4-1.fc7
-- updated to version 9.3.4 which contains security bugfixes
-
-* Tue Jan 23 2007 Adam Tkac <atkac@redhat.com> 31:9.3.3-5.fc7
-- package bind-libbind-devel has been marked as obsolete
-
-* Mon Jan 22 2007 Adam Tkac <atkac@redhat.com> 31:9.3.3-4.fc7
-- package bind-libbind-devel has beed removed (libs has been moved to bind-devel & bind-libs)
-- Resolves: #214208
-
-* Tue Jan 16 2007 Martin Stransky <stransky@redhat.com> - 31:9.3.3-3
-- fixed a multi-lib issue
-- Resolves: rhbz#222717
-
-* Thu Jan 4 2007 Martin Stransky <stransky@redhat.com> - 31:9.3.3-2
-- added namedGetForwarders written in shell (#176100),
-  created by Baris Cicek <baris@nerd.com.tr>.
-
-* Sun Dec 10 2006 Martin Stransky <stransky@redhat.com> - 31:9.3.3-1
-- update to 9.3.3 final
-- fix for #219069: file included twice in src.rpm
-
-* Wed Dec 6 2006 Martin Stransky <stransky@redhat.com> - 31:9.3.3-0.1.rc3
-- added back an interval to restart
-- renamed package, it should meet the N-V-R criteria
-- fix for #216185: bind-chroot-admin able to change root mode 750
-- added fix from #215997: incorrect permissions on dnszone.schema
-- added a notice to init script when /etc/named.conf doesn't exist (#216075)
-
-* Mon Oct 30 2006 Martin Stransky <stransky@redhat.com> - 30:9.3.3-6
-- fix for #200465: named-checkzone and co. cannot be run as non-root user
-- fix for #212348: chroot'd named causes df permission denied error
-- fix for #211249, #211083 - problems with stopping named
-- fix for #212549: init script does not unmount /proc filesystem
-- fix for #211282: EDNS is globally enabled, crashing CheckPoint FW-1,
-    added edns-enable options to named configuration file which can suppress
-    EDNS in queries to DNS servers (see /usr/share/doc/bind-9.3.3/misc/options)
-- fix for #212961: bind-chroot doesn't clean up its mess on %%preun
-- update to 9.3.3rc3, removed already merged patches
-
-* Fri Oct 13 2006 Martin Stransky <stransky@redhat.com> - 30:9.3.3-5
-- fix for #209359: bind-libs from compatlayer CD will not 
-  install on ia64
-
-* Tue Oct 10 2006 Martin Stransky <stransky@redhat.com> - 30:9.3.3-4
-- added fix for #210096: warning: group named does not exist - using root
-
-* Thu Oct  5 2006 Martin Stransky <stransky@redhat.com> - 30:9.3.3-3
-- added fix from #209400 - Bind Init Script does not create 
-  the PID file always, created by Jeff Means
-- added timeout to stop section of init script. 
-  The default is 100 sec. and can be adjusted by NAMED_SHUTDOWN_TIMEOUT
-  shell variable.
-
-* Mon Oct  2 2006 Martin Stransky <stransky@redhat.com> - 30:9.3.3-2
-- removed chcon from %%post script, replaced by restorecon 
-  (Bug 202547, comment no. 37)
-
-* Fri Sep 15 2006 Martin Stransky <stransky@redhat.com> - 30:9.3.3-1
-- updated to the latest upstream (9.3.3rc2)
-
-* Wed Sep  6 2006 Martin Stransky <stransky@redhat.com> - 30:9.3.2-41
-- added upstream patch for correct SIG handling - CVE-2006-4095
-
-* Tue Sep  5 2006 Martin Stransky <stransky@redhat.com> - 30:9.3.2-40
-- suppressed messages from bind-chroot-admin
-- cleared notes about bind-config
-
-* Tue Aug 22 2006 Martin Stransky <stransky@redhat.com> - 30:9.3.2-39
-- added fix for #203522 - "bind-chroot-admin -e" command fails
-
-* Mon Aug 21 2006 Martin Stransky <stransky@redhat.com> - 30:9.3.2-38
-- fix for #203194 - tmpfile usage
-
-* Thu Aug 17 2006 Martin Stransky <stransky@redhat.com> - 30:9.3.2-37
-- fix for #202542 - /usr/sbin/bind-chroot-admin: No such file or directory
-- fix for #202547 - file_contexts: invalid context
-
-* Fri Aug 11 2006 Martin Stransky <stransky@redhat.com> - 30:9.3.2-36
-- added Provides: bind-config
-
-* Fri Aug 11 2006 Martin Stransky <stransky@redhat.com> - 30:9.3.2-35
-- fix bug 197493: renaming subpackage bind-config to caching-nameserver
-
-* Mon Jul 24 2006 Jason Vas Dias <jvdias@redhat.com> - 30:9.3.2-34
-- fix bug 199876: make '%%exclude libbbind.*' conditional on %%{LIBBIND}
-
-* Mon Jul 24 2006 Florian La Roche <laroche@redhat.com> - 30:9.3.2-33
-- fix #195881, perms are not packaged correctly
-
-* Fri Jul 21 2006 Jason Vas Dias <jvdias@redhat.com> - 30:9.3.2-32
-- fix addenda to bug 189789: 
-  determination of selinux enabled was still not 100% correct in bind-chroot-admin
-- fix addenda to bug 196398:
-  make named.init test for NetworkManager being enabled AFTER testing for -D absence;
-  named.init now supports a 'DISABLE_NAMED_DBUS' /etc/sysconfig/named setting to disable
-  auto-enable of named dbus support if NetworkManager enabled.
-
-* Wed Jul 19 2006 Jason Vas Dias <jvdias@redhat.com> - 30:9.3.2-30
-- fix bug 196398 - Enable -D option automatically in initscript
-  if NetworkManager enabled in any runlevel.
-- fix namedGetForwarders for new dbus
-- fix bug 195881 - libbind.so should be owned by bind-libbind-devel
-
-* Wed Jul 19 2006 Matthias Clasen <mclasen@redhat.com> - 30:9.3.2-28.FC6
-- Rebuild against new dbus
-
-* Wed Jul 12 2006 Jason Vas Dias <jvdias@redhat.com> - 30:9.3.2-27.FC6
-- rebuild with fixed glibc-kernheaders
-
-* Wed Jul 12 2006 Jesse Keating <jkeating@redhat.com> - 30:9.3.2-26.FC6.1
-- rebuild
-
-* Wed Jun 14 2006 Jason Vas Dias <jvdias@redhat.com> - 30:9.3.2-26.FC6
-- fix bugs 191093, 189789
-- backport selected fixes from upstream bind9 'v9_3_3b1' CVS version:
-  ( see http://www.isc.org/sw/bind9.3.php "Fixes" ): 
-  o change 2024 / bug 16027:
-    named emitted spurious "zone serial unchanged" messages on reload
-  o change 2013 / bug 15941:
-    handle unexpected TSIGs on unsigned AXFR/IXFR responses more gracefully
-  o change 2009 / bug 15808: coverity fixes
-  o change 1997 / bug 15818: 
-    named was failing to replace negative cache entries when a positive one
-    for the type was learnt
-  o change 1994 / bug 15694: OpenSSL 0.9.8 support
-  o change 1991 / bug 15813:
-    The configuration data, once read, should be treated as readonly.
-  o misc. validator fixes 
-  o misc. resolver fixes
-  o misc. dns fixes
-  o misc. isc fixes
-  o misc. libbind fixes
-  o misc. isccfg fix
-  o misc. lwres fix
-  o misc. named fixes
-  o misc. dig fixes
-  o misc. nsupdate fix
-  o misc. tests fixes
-
-* Wed Jun  7 2006 Jeremy Katz <katzj@redhat.com> - 30:9.3.2-24.FC6
-- and actually put the devel symlinks in the right subpackage
-
-* Thu May 25 2006 Jeremy Katz <katzj@redhat.com> - 30:9.3.2-23.FC6
-- rebuild for -devel deps
-
-* Tue Apr 18 2006 Jason Vas Dias <jvdias@redhat.com> - 30:9.3.2-22
-- apply upstream patch for ncache_adderesult segfault bug 173961 addenda
-- fix bug 188382: rpm --verify permissions inconsistencies
-- fix bug 189186: use /sbin/service instead of initscript
-- rebuild for new gcc, glibc-kernheaders
-
-* Tue Apr 04 2006 Jason Vas Dias <jvdias@redhat.com> - 30:9.3.2-20
-- fix resolver.c ncache_adderesult segfault reported in addenda to bug 173961 
-  (upstream bugs #15642, #15528 ?)
-- allow named ability to generate core dumps after setuid (upstream bug #15753)
-
-* Mon Apr 03 2006 Jason Vas Dias <jvdias@redhat.com> - 30:9.3.2-18
-- fix bug 187529: make bind-chroot-admin deal with subdirectories properly
-
-* Thu Mar 30 2006 Jason Vas Dias <jvdias@redhat.com> - 30:9.3.2-16
-- fix bug 187286: 
-     prevent host(1) printing duplicate 'is an alias for' messages
-     for the default AAAA and MX lookups as well as for the A lookup
-     (it now uses the CNAME returned for the A lookup for the AAAA and MX lookups).
-     This is upstream bug #15702 fixed in the unreleased bind-9.3.3
-- fix bug 187333: fix SOURCE24 and SOURCE25 transposition
-
-* Wed Mar 29 2006 Jason Vas Dias <jvdias@redhat.com> - 30:9.3.2-14
-- fix bug 186577: remove -L/usr/lib from libbind.pc and more .spec file cleanup
-- add '%%doc' sample configuration files in /usr/share/doc/bind*/sample
-- rebuild with new gcc and glibc
-
-* Wed Mar 22 2006 Jason Vas Dias <jvdias@redhat.com> - 30:9.3.2-12
-- fix typo in initscript
-- fix Requires(post): policycoreutils in sub-packages
-
-* Mon Mar 20 2006 Jason Vas Dias <jvdias@redhat.com> - 30.9.3.2-10
-- fix bug 185969: more .spec file cleanup
-
-* Wed Mar 08 2006 Jason Vas Dias <jvdias@redhat.com> - 30.9.3.2-8
-- Do not allow package to be installed if named:25 userid creation fails
-- Give libbind a pkg-config file
-- remove restorecon from bind-chroot-admin (not required).
-- fix named.caching-nameserver.conf (listen-on-v6 port 53 { ::1 };)
-
-* Tue Mar 07 2006 Jason Vas Dias <jvdias@redhat.com> - 30:9.3.2-7
-- fix issues with bind-chroot-admin
-
-* Mon Mar 06 2006 Jason Vas Dias <jvdias@redhat.com> - 30:9.3.2-6
-- replace caching-nameserver with bind-config sub-package
-- fix bug 177595: handle case where $ROOTDIR is a link in initscript
-- fix bug 177001: bind-config creates symlinks OK now
-- fix bug 176388: named.conf is now never replaced by any RPM
-- fix bug 176248: remove unecessary creation of rpmsave links
-- fix bug 174925: no replacement of named.conf
-- fix bug 173963: existing named.conf never modified
-- major .spec file cleanup
-
-* Fri Feb 10 2006 Jesse Keating <jkeating@redhat.com> - 30:9.3.2-4.1
-- bump again for double-long bug on ppc(64)
-
-* Tue Feb 07 2006 Jason Vas Dias <jvdias@redhat.com> - 30:9.3.2-4
-- regenerate redhat_doc patch for non-DBUS builds
-- allow dbus builds to work with dbus version < 0.6 (bz #179816)
-
-* Tue Feb 07 2006 Florian La Roche <laroche@redhat.com> 30:9.3.2-3
-- try supporting without dbus support
-
-* Mon Feb 06 2006 Jason Vas Dias <jvdias@redhat.com> - 30:9.3.2-2.1
-- Rebuild for new gcc, glibc, glibc-kernheaders
-
-* Mon Jan 16 2006 Jason Vas Dias <jvdias@redhat.com> - 30:9.3.2-2
-- fix bug 177854: temporary fix for broken kernel-2.6.15-1854+
-  /proc/net/if_inet6 format
-
-* Wed Dec 21 2005 Jason Vas Dias <jvdias@redhat.com> - 30:9.3.2-1
-- Upgrade to 9.3.2, released today
-
-* Tue Dec 20 2005 Jason Vas Dias <jvdias@redhat.com> - 28:9.3.2rc1-2
-- fix bug 176100: do not Require: perl just for namedGetForwarders !
-
-* Fri Dec 09 2005 Jesse Keating <jkeating@redhat.com>
-- rebuilt
-
-* Fri Dec 02 2005 Jason Vas Dias <jvdias@redhat.com> - 28:9.3.2rc-1
-- Upgrade to upstream version 9.3.2rc1
-- fix namedSetForwarders -> namedGetForwarders SOURCE14 typo
-
-* Thu Dec 01 2005 Jason Vas Dias <jvdias@redhat.com> - 24:9.3.1-26
-- rebuild for new dbus 0.6 dependency; remove use of
-  DBUS_NAME_FLAG_PROHIBIT_REPLACEMENT
-
-* Wed Nov 23 2005 Jason Vas Dias <jvdias@redhat.com> - 24:9.3.1-24
-- allow D-BUS support to work in bind-chroot environment:
-  workaround latest selinux policy by mounting /var/run/dbus/
-  under chroot instead of /var/run/dbus/system-bus-socket
-
-* Sun Nov 13 2005 Jason Vas Dias <jvdias@redhat.com> - 24:9.3.1-22
-- fix bug 172632 - remove .la files
-- ship namedGetForwarders and namedSetForwarders scripts
-- fix detection of -D option in chroot
-
-* Tue Nov  8 2005 Tomas Mraz <tmraz@redhat.com> - 24:9.3.1-21
-- rebuilt with new openssl
-
-* Wed Oct 19 2005 Jason Vas Dias <jvdias@redhat.com> - 24.9.3.1-20
-- Allow the -D enable D-BUS option to be used within bind-chroot .
-- fix bug 171226: supply some documentation for pgsql SDB .
-
-* Thu Oct 06 2005 Jason Vas Dias <jvdias@redhat.com> - 24:9.3.1-18
-- fix bug 169969: do NOT call dbus_svc_dispatch() in dbus_mgr_init_dbus() -
-      task->state != task_ready and will cause Abort in task.c if process
-      is waiting for NameOwnerChanged to do a SetForwarders
-
-* Wed Oct 05 2005 Jason Vas Dias <jvdias@redhat.com> - 24:9.3.1-16
-- Fix reconnecting to dbus-daemon after it stops & restarts .
-
-* Tue Sep 27 2005 Jason Vas Dias <jvdias@redhat.com> - 24:9.3.1-14
-- When forwarder nameservers are changed with D-BUS, flush the cache.
-
-* Mon Sep 26 2005 Jason Vas Dias <jvdias@redhat.com> - 24:9.3.1-12
-- fix bug 168302: use %%{__cc} for compiling dns-keygen
-- fix bug 167682: bind-chroot directory permissions
-- fix issues with -D dbus option when dbus service not running or disabled
-
-* Tue Aug 30 2005 Jason Vas Dias <jvdias@redhat.com> - 24:9.3.1-12
-- fix bug 167062: named should be started after syslogd by default
-
-* Mon Aug 22 2005 Jason Vas Dias <jvdias@redhat.com> - 24:9.3.1-11
-- fix bug 166227: host: don't do default AAAA and MX lookups with '-t a' option
-
-* Tue Aug 16 2005 Jason Vas Dias <jvdias@redhat.com> - 24:9.3.1-10
-- Build with D-BUS patch by default; D-BUS support enabled with named -D option
-- Enable D-BUS for named_sdb also
-- fix sdb pgsql's zonetodb.c: must use isc_hash_create() before dns_db_create()
-- update fix for bug 160914 : test for RD=1 and ARCOUNT=0 also before trying next server
-- fix named.init script to handle named_sdb properly
-- fix named.init script checkconfig() to handle named '-c' option
-  and make configtest, test, check configcheck synonyms
-
-* Tue Jul 19 2005 Jason Vas Dias <jvdias@redhat.com> - 24:9.3.1-8
-- fix named.init script bugs 163598, 163409, 151852(addendum)
-
-* Tue Jul 12 2005 Jason Vas Dias <jvdias@redhat.com> - 24:9.3.1-7
-- fix bug 160914: resolver utilities should try next server on empty referral
-                  (now that glibc bug 162625 is fixed)
-                  host and nslookup now by default try next server on SERVFAIL
-                  (host now has '-s' option to disable, and nslookup given
-                   '[no]fail' option similar to dig's [no]fail option).
-- rebuild and re-test with new glibc & gcc (all tests passed).
-
-* Tue May 31 2005 Jason Vas Dias <jvdias@redhat.com> - 24:9.3.1-6
-- fix bug 157950: dig / host / nslookup should reject invalid resolv.conf
-                  files and not use uninitialized garbage nameserver values
-                  (ISC bug 14841 raised).
-
-* Mon May 23 2005 Jason Vas Dias <jvdias@redhat.com> - 24:9.3.1-4_FC4
-- Fix SDB LDAP
-
-* Mon May 16 2005 Jason Vas Dias <jvdias@redhat.com> - 24:9.3.1-4
-- Fix bug 157601: give named.init a configtest function
-- Fix bug 156797: named.init should check SELinux booleans.local before booleans
-- Fix bug 154335: if no controls in named.conf, stop named with -TERM sig, not rndc
-- Fix bug 155848: add NOTES section to named.8 man-page with info on all Red Hat
-                  BIND quirks and SELinux DDNS / slave zone file configuration
-- D-BUS patches NOT applied until dhcdbd is in FC
-
-* Sun May 15 2005 Jason Vas Dias <jvdias@redhat.com> - 24:9.3.1-4_dbus
-- Enhancement to allow dynamic forwarder table management and
-- DHCP forwarder auto-configuration with D-BUS
-
-* Thu Apr 14 2005 Jason Vas Dias <jvdias@redhat.com> - 24:9.3.1-2_FC4
-- Rebuild for bind-sdb libpq.so.3 dependency
-- fix bug 150981: don't install libbind man-pages if no libbind
-- fix bug 151852: mount proc on $ROOTDIR/proc to allow sysconf(...)
-  to work and correct number of CPUs to be determined
-
-* Fri Mar 11 2005 Jason Vas Dias <jvdias@redhat.com> - 24:9.3.1-1_FC4
-- Upgrade to ISC BIND 9.3.1 (final release) released today.
-
-* Wed Mar  9 2005 Jason Vas Dias <jvdias@redhat.com> - 22.9.3.1rc1-5
-- fix bug 150288: h_errno not being accessed / set correctly in libbind
-- add libbind man-pages from bind-8.4.6
-
-* Mon Mar  7 2005 Jason Vas Dias <jvdias@redhat.com> - 22:9.3.1rc1-4
-- Rebuild with gcc4 / glibc-2.3.4-14.
-
-* Tue Mar  1 2005 Nalin Dahyabhai <nalin@redhat.com> - 22:9.3.1rc1-3
-- configure with --with-pic to get PIC libraries
-
-* Sun Feb 20 2005 Jason Vas Dias <jvdias@redhat.com> - 22:9.3.1rc1-2
-- fix bug 149183: don't use getifaddrs() .
-
-* Wed Feb 16 2005 Jason Vas Dias <jvdias@redhat.com> - 22:9.3.1rc1-1
-- Upgrade to 9.3.1rc1
-- Add Simplified Database Backend (SDB) sub-package ( bind-sdb )
--     add named_sdb - ldap + pgsql + dir database backend support with
--     'ENABLE_SDB' named.sysconfig option
-- Add BIND resolver library & includes sub-package ( libbind-devel)
-- fix bug 147824 / 147073 / 145664: ENABLE_ZONE_WRITE in named.init
-- fix bug 146084 : shutup restorecon
-
-* Tue Jan 11 2005 Jason Vas Dias <jvdias@redhat.com> - 22:9.3.0-2
-- Fix bug 143438: named.init will now make correct ownership of $ROOTDIR/var/named
--                 based on 'named_write_master_zones' SELinux boolean.
-- Fix bug 143744: dig & nsupdate IPv6 timeout  (dup of 140528)
-
-* Mon Nov 29 2004 Jason Vas Dias <jvdias@redhat.com> - 9.3.0-1
-- Upgrade BIND to 9.3.0 in Rawhide / FC4 (bugs 134529, 133654...)
-
-* Mon Nov 29 2004 Jason Vas Dias <jvdias@redhat.com> - 20:9.2.4-4
-- Fix bugs 140528 and 141113:
-- 2 second timeouts when IPv6 not configured and root nameserver's
-- AAAA addresses are queried
-
-* Mon Oct 18 2004 Jason Vas Dias <jvdias@redhat.com> - 20:9.2.4-2
-- Fix bug 136243: bind-chroot %%post must run restorecon -R %%{prefix}
-- Fix bug 135175: named.init must return non-zero if named is not run
-- Fix bug 134060: bind-chroot %%post must use mktemp, not /tmp/named
-- Fix bug 133423: bind-chroot %%files entries should have been %%dirs
-
-* Thu Sep 23 2004 Jason Vas Dias <jvdias@redhat.com> - 20:9.2.4-1
-- BIND 9.2.4 (final release) released - source code actually
-- identical to 9.2.4rc8, with only version number change.
-
-* Mon Sep 20 2004 Jason Vas Dias <jvdias@redhat.com> - 10:9.2.4rc8-14
-- Upgrade to upstream bind-9.2.4rc8 .
-- Progress: Finally! Hooray! ISC bind now distributes:
-- o named.conf(5) and nslookup(8) manpages
--    'bind-manpages.bz2' source can now disappear
--    (could this have something to do with ISC bug I raised about this?)
-- o 'deprecation_msg' global has vanished
--     bind-9.2.3rc3-deprecation_msg_shut_up.diff.bz2 can disappear
-
-* Mon Sep 20 2004 Jason Vas Dias <jvdias@redhat.com> - 10:9.2.4rc8-14
-- Fix bug 106572/132385: copy /etc/localtime to chroot on start
-
-* Fri Sep 10 2004 Jason Vas Dias <jvdias@redhat.com> - 10:9.2.4rc7-12_EL3
-- Fix bug 132303: if ROOTDIR line was replaced after upgrade from
-- bind-chroot-9.2.2-21, restart named
-
-* Wed Sep 8  2004 Jason Vas Dias <jvdias@redhat.com> - 10:9.2.4rc7-11_EL3
-- Fix bug 131803: replace ROOTDIR line removed by broken
-- bind-chroot 9.2.2-21's '%%postun'; added %%triggerpostun for bind-chroot
-
-* Tue Sep 7  2004 Jason Vas Dias <jvdias@redhat.com> - 10:9.2.4rc7-10_EL3
-- Fix bugs 130121 & 130981 for RHEL-3
-
-* Mon Aug 30 2004 Jason Vas Dias <jvdias@redhat.com> - 10:9.2.4rc7-10
-- Fix bug 130121: add '%%ghost' entries for files included in previous
-- bind-chroot & not in current - ie. named.conf, rndc.key, dev/* -
-- that RPM removed after upgrade .
-
-* Thu Aug 26 2004 Jason Vas Dias <jvdias@redhat.com>
-- Fix bug 130981: add '-t' option to named-checkconf invocation in
-- named.init if chroot installed.
-
-* Wed Aug 25 2004 Jason Vas Dias <jvdias@redhat.com>
-- Remove resolver(5) manpage now in man-pages (bug 130792);
-- Don't create /dev/ entries in bind-chroot if already there (bug 127556);
-- fix bind-devel Requires (bug 130919)
-- Set default location for dumpdb & stats files to /var/named/data
-
-* Tue Aug 24 2004 Jason Vas Dias <jvdias@redhat.com>
-- Fix devel Requires for bug 130738 & fix version
-
-* Tue Aug 24 2004 Jason Vas Dias <jvdias@redhat.com>
-- Fix errors on clean install if named group does not exist
-- (bug 130777)
-
-* Thu Aug 19 2004 Jason Vas Dias <jvdias@redhat.com>
-- Upgrade to bind-9.2.4rc7; applied initscript fix
-- for bug 102035.
-
-* Mon Aug  9 2004 Jason Vas Dias <jvdias@redhat.com>
-- Fixed bug 129289: bind-chroot install / deinstall
-- on install, existing config files 'safe_replace'd
-- with links to chroot copies; on uninstall, moved back.
-
-* Fri Aug  6 2004 Jason Vas Dias <jvdias@redhat.com>
-- Fixed bug 129258: "${prefix}/var/tmp" typo in spec
-
-* Wed Jul 28 2004 Jason Vas Dias <jvdias@redhat.com>
-- Fixed bug 127124 : 'Requires: kernel >= 2.4'
-- causes problems with Linux VServers
-
-* Tue Jul 27 2004 Jason Vas Dias <jvdias@redhat.com>
-- Fixed bug 127555 : chroot tar missing var/named/slaves
-
-* Fri Jul 16 2004 Jason Vas Dias <jvdias@redhat.com>
-- Upgraded to ISC version 9.2.4rc6
-
-* Fri Jul 16 2004 Jason Vas Dias <jvdias@redhat.com>
-- Fixed named.init generation of error messages on
-- 'service named stop' and 'service named reload'
-- as per bug 127775
-
-* Wed Jun 23 2004 Daniel Walsh <dwalsh@redhat.com> 9.2.3-19
-- Bump for rhel 3.0  U3
-
-* Wed Jun 23 2004 Daniel Walsh <dwalsh@redhat.com> 9.2.3-18
-- remove disable-linux-caps
-
-* Wed Jun 16 2004 Daniel Walsh <dwalsh@redhat.com> 9.2.3-17
-- Update RHEL3 to latest bind
-
-* Tue Jun 15 2004 Elliot Lee <sopwith@redhat.com>
-- rebuilt
-
-* Tue Jun 8 2004 Daniel Walsh <dwalsh@redhat.com> 9.2.3-15
-- Remove device files from chroot,  Named uses the system one
-
-* Fri Mar 26 2004 Daniel Walsh <dwalsh@redhat.com> 9.2.3-14
-- Move RFC to devel package
-
-* Fri Mar 26 2004 Daniel Walsh <dwalsh@redhat.com> 9.2.3-13
-- Fix location of restorecon
-
-* Thu Mar 25 2004 Daniel Walsh <dwalsh@redhat.com> 9.2.3-12
-- Tighten security on config files.  Should be owned by root
-
-* Thu Mar 25 2004 Daniel Walsh <dwalsh@redhat.com> 9.2.3-11
-- Update key patch to include conf-keygen
-
-* Tue Mar 23 2004 Daniel Walsh <dwalsh@redhat.com> 9.2.3-10
-- fix chroot to only happen once.
-- fix init script to do kill insteall of killall
-
-* Mon Mar 15 2004 Daniel Walsh <dwalsh@redhat.com> 9.2.3-9
-- Add fix for SELinux security context
-
-* Tue Mar 02 2004 Elliot Lee <sopwith@redhat.com>
-- rebuilt
-
-* Sat Feb 28 2004 Florian La Roche <Florian.LaRoche@redhat.de>
-- run ldconfig for libs subrpm
-
-* Mon Feb 23 2004 Tim Waugh <twaugh@redhat.com>
-- Use ':' instead of '.' as separator for chown.
-
-* Tue Feb 17 2004 Daniel Walsh <dwalsh@redhat.com> 9.2.3-7
-- Add COPYRIGHT
-
-* Fri Feb 13 2004 Elliot Lee <sopwith@redhat.com>
-- rebuilt
-
-* Tue Dec 30 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.3-5
-- Add defattr to libs
-
-* Mon Dec 29 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.3-4
-- Break out library package
-
-* Mon Dec 22 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.3-3
-- Fix condrestart
-
-* Wed Nov 12 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.3-2
-- Move libisc and libdns to bind from bind-util
-
-* Tue Nov 11 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.3-1
-- Move to 9.2.3
-
-* Mon Oct 27 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.2.P3-10
-- Add PIE support
-
-* Fri Oct 17 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.2.P3-9
-- Add /var/named/slaves directory
-
-* Sun Oct 12 2003 Florian La Roche <Florian.LaRoche@redhat.de>
-- do not link against libnsl, not needed for Linux
-
-* Wed Oct 8 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.2.P3-6
-- Fix local time in log file
-
-* Tue Oct 7 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.2.P3-5
-- Try again
-
-* Mon Oct 6 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.2.P3-4
-- Fix handling of chroot -/dev/random
-
-* Thu Oct 2 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.2.P3-3
-- Stop hammering stuff on update of chroot environment
-
-* Mon Sep 29 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.2.P3-2
-- Fix chroot directory to grab all subdirectories
-
-* Wed Sep 24 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.2.P3-1
-- New patch to support for "delegation-only"
-
-* Wed Sep 17 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.2-23
-- patch support for "delegation-only"
-
-* Wed Jul 30 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.2-22
-- Update to build on RHL
-
-* Wed Jul 30 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.2-21
-- Install libraries as exec so debug info will be pulled
-
-* Sat Jul 19 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.2-20
-- Remove BSDCOMPAT (BZ 99454)
-
-* Tue Jul 15 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.2-19
-- Update to build on RHL
-
-* Tue Jul 15 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.2-18
-- Change protections on /var/named and /var/chroot/named
-
-* Tue Jun 17 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.2-17
-- Update to build on RHL
-
-* Tue Jun 17 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.2-16
-- Update to build on RHEL
-
-* Wed Jun 04 2003 Elliot Lee <sopwith@redhat.com>
-- rebuilt
-
-* Tue Apr 22 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.2-14
-- Update to build on RHEL
-
-* Tue Apr 22 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.2-13
-- Fix config description of named.conf in chroot
-- Change named.init script to check for existence of /etc/sysconfig/network
-
-* Fri Apr 18 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.2-12
-- Update to build on RHEL
-
-* Fri Apr 18 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.2-11
-- Update to build on RHEL
-
-* Fri Apr 18 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.2-10
-- Fix echo OK on starting/stopping service
-
-* Fri Mar 28 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.2-9
-- Update to build on RHEL
-
-* Fri Mar 28 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.2-8
-- Fix echo on startup
-
-* Tue Mar 25 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.2-7
-- Fix problems with chroot environment
-- Eliminate posix threads
-
-* Mon Mar 24 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.2-6
-- Fix build problems
-
-* Fri Mar 14 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.2-5
-- Fix build on beehive
-
-* Thu Mar 13 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.2-4
-- build bind-chroot kit
-
-* Tue Mar 11 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.2-3
-- Change configure to use proper threads model
-
-* Fri Mar 7 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.2-2
-- update to 9.2.2
-
-* Tue Mar 4 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.2-1
-- update to 9.2.2
-
-* Fri Jan 24 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.1-16
-- Put a sleep in restart to make sure stop completes
-
-* Wed Jan 22 2003 Tim Powers <timp@redhat.com>
-- rebuilt
-
-* Tue Jan 7 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.1-14
-- Separate /etc/rndc.key to separate file
-
-* Tue Jan 7 2003 Nalin Dahyabhai <nalin@redhat.com> 9.2.1-13
-- Use openssl's pkgconfig data, if available, at build-time.
-
-* Mon Jan 6 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.1-12
-- Fix log rotate to use service named reload
-- Change service named reload to give success/failure message [73770]
-- Fix File checking [75710]
-- Begin change to automatically run in CHROOT environment
-
-* Tue Dec 24 2002 Daniel Walsh <dwalsh@redhat.com> 9.2.1-10
-- Fix startup script to work like all others.
-
-* Mon Dec 16 2002 Daniel Walsh <dwalsh@redhat.com> 9.2.1-9
-- Fix configure to build on x86_64 platforms
-
-* Wed Aug 07 2002 Karsten Hopp <karsten@redhat.de>
-- fix #70583,  doesn't build on IA64
-
-* Tue Jul 30 2002 Karsten Hopp <karsten@redhat.de> 9.2.1-8
-- bind-utils shouldn't require bind
-
-* Mon Jul 22 2002 Karsten Hopp <karsten@redhat.de> 9.2.1-7
-- fix name of pidfine in logrotate script (#68842)
-- fix owner of logfile in logrotate script (#41391)
-- fix nslookup and named.conf man pages (output on stderr)
-  (#63553, #63560, #63561, #54889, #57457)
-- add rfc1912 (#50005)
-- gzip all rfc's
-- fix typo in keygen.c (#54870)
-- added missing manpages (#64065)
-- shutdown named properly with rndc stop (#62492)
-- /sbin/nologin instead of /bin/false (#68607)
-- move nsupdate to bind-utils (where the manpage already was) (#66209, #66381)
-- don't kill initscript when rndc fails (reload)    (#58750)
-
-
-* Mon Jun 24 2002 Bernhard Rosenkraenzer <bero@redhat.com> 9.2.1-5
-- Fix #65975
-
-* Fri Jun 21 2002 Tim Powers <timp@redhat.com>
-- automated rebuild
-
-* Thu May 23 2002 Tim Powers <timp@redhat.com>
-- automated rebuild
-
-* Thu May  9 2002 Bernhard Rosenkraenzer <bero@redhat.com> 9.2.1-2
-- Move libisccc, lib isccfg and liblwres from bind-utils to bind,
-  they're not required if you aren't running a nameserver.
-
-* Fri May 03 2002 Florian La Roche <Florian.LaRoche@redhat.de>
-- update to 9.2.1 release
-
-* Thu Mar 14 2002 Bernhard Rosenkraenzer <bero@redhat.com> 9.2.0-8
-- Merge 30+ bug fixes from 9.2.1rc1 code
-
-* Mon Mar 11 2002 Bernhard Rosenkraenzer <bero@redhat.com> 9.2.0-7
-- Don't exit if /etc/named.conf doesn't exist if we're running
-  chroot (#60868)
-- Revert Elliot's changes, we do require specific glibc/glibc-kernheaders
-  versions or bug #58335 will be back. "It compiles, therefore it works"
-  isn't always true.
-
-* Thu Feb 28 2002 Elliot Lee <sopwith@redhat.com> 9.2.0-6
-- Fix BuildRequires (we don't need specific glibc/glibc-kernheaders
-versions).
-- Use _smp_mflags
-
-* Wed Feb 20 2002 Bernhard Rosenkraenzer <bero@redhat.com> 9.2.0-4
-- rebuild, require recent autoconf, automake (#58335)
-
-* Fri Jan 25 2002 Tim Powers <timp@redhat.com>
-- rebuild against new libssl
-
-* Wed Jan 09 2002 Tim Powers <timp@redhat.com>
-- automated rebuild
-
-* Tue Nov 27 2001 Bernhard Rosenkraenzer <bero@redhat.com> 9.2.0-1
-- 9.2.0
-
-* Thu Nov 22 2001 Bernhard Rosenkraenzer <bero@redhat.com> 9.2.0-0.rc10.2
-- 9.2.0rc10
-
-* Mon Nov  5 2001 Bernhard Rosenkraenzer <bero@redhat.com> 9.2.0-0.rc8.2
-- Fix up rndc.conf (#55574)
-
-* Thu Oct 25 2001 Bernhard Rosenkraenzer <bero@redhat.com> 9.2.0-0.rc8.1
-- rc8
-- Enforce --enable-threads
-
-* Mon Oct 22 2001 Bernhard Rosenkraenzer <bero@redhat.com> 9.2.0-0.rc7.1
-- 9.2.0rc7
-- Use rndc status for "service named status", it's supposed to actually
-  work in 9.2.x.
-
-* Wed Oct  3 2001 Bernhard Rosenkraenzer <bero@redhat.com> 9.2.0-0.rc5.1
-- 9.2.0rc5
-- Fix rpm --rebuild with ancient libtool versions (#53938, #54257)
-
-* Tue Sep 25 2001 Bernhard Rosenkraenzer <bero@redhat.com> 9.2.0-0.rc4.1
-- 9.2.0rc4
-
-* Fri Sep 14 2001 Bernhard Rosenkraenzer <bero@redhat.com> 9.2.0-0.rc3.1
-- 9.2.0rc3
-- remove ttl patch, I don't think we need this for 8.0.
-- remove dig.1.bz2 from the bind8-manpages tar file, 9.2 has a new dig man page
-- add lwres* man pages to -devel
-
-* Mon Sep  3 2001 Bernhard Rosenkraenzer <bero@redhat.com> 9.1.3-4
-- Make sure /etc/rndc.conf isn't world-readable even after the
-  %%post script inserted a random key (#53009)
-
-* Thu Jul 19 2001 Bernhard Rosenkraenzer <bero@redhat.com> 9.1.3-3
-- Add build dependencies (#49368)
-- Make sure running service named start several times doesn't create
-  useless processes (#47596)
-- Work around the named parent process returning 0 even if the config
-  file is broken (it's parsed later by the child processes) (#45484)
-
-* Mon Jul 16 2001 Bernhard Rosenkraenzer <bero@redhat.com> 9.1.3-2
-- Don't use rndc status, it's not yet implemented (#48839)
-
-* Sun Jul 08 2001 Florian La Roche <Florian.LaRoche@redhat.de>
-- update to 9.1.3 release
-
-* Tue Jul  3 2001 Bernhard Rosenkraenzer <bero@redhat.com> 9.1.3-0.rc3.1
-- Fix up rndc configuration and improve security (#46586)
-
-* Tue Jun 26 2001 Bernhard Rosenkraenzer <bero@redhat.com> 9.1.3-0.rc2.2
-- Sync with caching-nameserver-7.1-6
-
-* Mon Jun 25 2001 Bernhard Rosenkraenzer <bero@redhat.com> 9.1.3-0.rc2.1
-- Update to rc2
-
-* Fri Jun  1 2001 Bernhard Rosenkraenzer <bero@redhat.com> 9.1.3-0.rc1.3
-- Remove resolv.conf(5) man page, it's now in man-pages
-
-* Thu May 31 2001 Bernhard Rosenkraenzer <bero@redhat.com> 9.1.3-0.rc1.2
-- Add named.conf man page from bind 8.x (outdated, but better than nothing,
-  #42732)
-- Rename the rndc key (#42895)
-- Add dnssec* man pages
-
-* Mon May 28 2001 Bernhard Rosenkraenzer <bero@redhat.com> 9.1.3-0.rc1.1
-- 9.1.3rc1
-- s/Copyright/License/
-
-* Mon May  7 2001 Bernhard Rosenkraenzer <bero@redhat.com> 9.1.2-1
-- 9.1.2 final. No changes between 9.1.2-0.rc1.1 and this one, except for
-  the version number, though.
-
-* Thu May  3 2001 Bernhard Rosenkraenzer <bero@redhat.com> 9.1.2-0.rc1.1
-- 9.1.2rc1
-
-* Thu Mar 29 2001 Bernhard Rosenkraenzer <bero@redhat.com> 9.1.1-1
-- 9.1.1
-
-* Thu Mar 15 2001 Bernhard Rosenkraenzer <bero@redhat.com> 9.1.0-10
-- Merge fixes from 9.1.1rc5
-
-* Sun Mar 11 2001 Bernhard Rosenkraenzer <bero@redhat.com> 9.1.0-9
-- Work around bind 8 -> bind 9 migration problem when using buggy zone files:
-  accept zones without a TTL, but spew out a big fat warning. (#31393)
-
-* Thu Mar  8 2001 Bernhard Rosenkraenzer <bero@redhat.com>
-- Add fixes from rc4
-
-* Fri Mar  2 2001 Nalin Dahyabhai <nalin@redhat.com>
-- rebuild in new environment
-
-* Thu Mar  1 2001 Bernhard Rosenkraenzer <bero@redhat.com>
-- killall -HUP named if rndc reload fails (#30113)
-
-* Tue Feb 27 2001 Bernhard Rosenkraenzer <bero@redhat.com>
-- Merge some fixes from 9.1.1rc3
-
-* Tue Feb 20 2001 Bernhard Rosenkraenzer <bero@redhat.com>
-- Don't use the standard rndc key from the documentation, instead, create a random one
-  at installation time (#26358)
-- Make /etc/rndc.conf readable by user named only, it contains secret keys
-
-* Tue Feb 20 2001 Bernhard Rosenkraenzer <bero@redhat.com>
-- 9.1.1 probably won't be out in time, revert to 9.1.0 and apply fixes
-  from 9.1.1rc2
-- bind requires bind-utils (#28317)
-
-* Tue Feb 13 2001 Bernhard Rosenkraenzer <bero@redhat.com>
-- Update to rc2, fixes 2 more bugs
-- Fix build with glibc >= 2.2.1-7
-
-* Thu Feb  8 2001 Bernhard Rosenkraenzer <bero@redhat.com>
-- Update to 9.1.1rc1; fixes 17 bugs (14 of them affecting us;
-  1 was fixed in a Red Hat patch already, 2 others are portability
-  improvements)
-
-* Wed Feb  7 2001 Bernhard Rosenkraenzer <bero@redhat.com>
-- Remove initscripts 5.54 requirement (#26489)
-
-* Mon Jan 29 2001 Bernhard Rosenkraenzer <bero@redhat.com>
-- Add named-checkconf, named-checkzone (#25170)
-
-* Mon Jan 29 2001 Trond Eivind Glomsrod <teg@redhat.com>
-- use echo, not gprintf
-
-* Wed Jan 24 2001 Bernhard Rosenkraenzer <bero@redhat.com>
-- Fix problems with $GENERATE
-  Patch from Daniel Roesen <droesen@entire-systems.com>
-  Bug #24890
-
-* Thu Jan 18 2001 Bernhard Rosenkraenzer <bero@redhat.com>
-- 9.1.0 final
-
-* Sat Jan 13 2001 Bernhard Rosenkraenzer <bero@redhat.com>
-- 9.1.0rc1
-- i18nify init script
-- bzip2 source to save space
-
-* Thu Jan 11 2001 Bernhard Rosenkraenzer <bero@redhat.com>
-- Fix %%postun script
-
-* Tue Jan  9 2001 Bernhard Rosenkraenzer <bero@redhat.com>
-- 9.1.0b3
-
-* Mon Jan  8 2001 Bernhard Rosenkraenzer <bero@redhat.com>
-- Add named.conf man page from bind8 (#23503)
-
-* Sun Jan  7 2001 Bernhard Rosenkraenzer <bero@redhat.com>
-- Make /etc/rndc.conf and /etc/sysconfig/named noreplace
-- Make devel require bind = %%{version} rather than just bind
-
-* Sun Jan  7 2001 Bernhard Rosenkraenzer <bero@redhat.com>
-- Fix init script for real
-
-* Sat Jan  6 2001 Bernhard Rosenkraenzer <bero@redhat.com>
-- Fix init script when ROOTDIR is not set
-
-* Thu Jan  4 2001 Bernhard Rosenkraenzer <bero@redhat.com>
-- Add hooks for setting up named to run chroot (RFE #23246)
-- Fix up requirements
-
-* Fri Dec 29 2000 Bernhard Rosenkraenzer <bero@redhat.com>
-- 9.1.0b2
-
-* Wed Dec 20 2000 Bernhard Rosenkraenzer <bero@redhat.com>
-- Move run files to /var/run/named/ - /var/run isn't writable
-  by the user we're running as. (Bug #20665)
-
-* Tue Dec 19 2000 Bernhard Rosenkraenzer <bero@redhat.com>
-- Fix reverse lookups (#22272)
-- Run ldconfig in %%post utils
-
-* Tue Dec 12 2000 Karsten Hopp <karsten@redhat.de>
-- fixed logrotate script (wrong path to kill)
-- include header files in -devel package
-- bugzilla #22049, #19147, 21606
-
-* Fri Dec  8 2000 Bernhard Rosenkraenzer <bero@redhat.com>
-- 9.1.0b1 (9.1.0 is in our timeframe and less buggy)
-
-* Mon Nov 13 2000 Bernhard Rosenkraenzer <bero@redhat.com>
-- 9.0.1
-
-* Mon Oct 30 2000 Bernhard Rosenkraenzer <bero@redhat.com>
-- Fix initscript (Bug #19956)
-- Add sample rndc.conf (Bug #19956)
-- Fix build with tar 1.13.18
-
-* Tue Oct 10 2000 Bernhard Rosenkraenzer <bero@redhat.com>
-- Add some missing man pages (taken from bind8) (Bug #18794)
-
-* Sun Sep 17 2000 Bernhard Rosenkraenzer <bero@redhat.com>
-- 9.0.0 final
-
-* Wed Aug 30 2000 Bernhard Rosenkraenzer <bero@redhat.com>
-- rc5
-- fix up nslookup
-
-* Thu Aug 24 2000 Bernhard Rosenkraenzer <bero@redhat.com>
-- rc4
-
-* Thu Jul 13 2000 Bernhard Rosenkraenzer <bero@redhat.com>
-- 9.0.0rc1
-
-* Wed Jul 12 2000 Prospector <bugzilla@redhat.com>
-- automatic rebuild
-
-* Sun Jul  9 2000 Florian La Roche <Florian.LaRoche@redhat.de>
-- add "exit 0" for uninstall case
-
-* Fri Jul  7 2000 Florian La Roche <Florian.LaRoche@redhat.de>
-- add prereq init.d and cleanup install section
-
-* Fri Jun 30 2000 Trond Eivind Glomsrod <teg@redhat.com>
-- fix the init script
-
-* Wed Jun 28 2000 Nalin Dahyabhai <nalin@redhat.com>
-- make libbind.a and nslookup.help readable again by setting INSTALL_LIB to ""
-
-* Mon Jun 26 2000 Bernhard Rosenkranzer <bero@redhat.com>
-- Fix up the initscript (Bug #13033)
-- Fix build with current glibc (Bug #12755)
-- /etc/rc.d/init.d -> /etc/init.d
-- use %%{_mandir} rather than /usr/share/man
-
-* Mon Jun 19 2000 Bill Nottingham <notting@redhat.com>
-- fix conflict with man-pages
-- remove compatibilty chkconfig links
-- initscript munging
-
-* Wed Jun 14 2000 Nalin Dahyabhai <nalin@redhat.com>
-- modify logrotate setup to use PID file
-- temporarily disable optimization by unsetting $RPM_OPT_FLAGS at build-time
-- actually bump the release this time
-
-* Sun Jun  4 2000 Bernhard Rosenkraenzer <bero@redhat.com>
-- FHS compliance
-
-* Mon Apr 17 2000 Nalin Dahyabhai <nalin@redhat.com>
-- clean up restart patch
-
-* Mon Apr 10 2000 Nalin Dahyabhai <nalin@redhat.com>
-- provide /var/named (fix for bugs #9847, #10205)
-- preserve args when restarted via ndc(8) (bug #10227)
-- make resolv.conf(5) a link to resolver(5) (bug #10245)
-- fix SYSTYPE bug in all makefiles
-- move creation of named user from %%post into %%pre
-
-* Mon Feb 28 2000 Bernhard Rosenkranzer <bero@redhat.com>
-- Fix TTL (patch from ISC, Bug #9820)
-
-* Wed Feb 16 2000 Bernhard Rosenkranzer <bero@redhat.com>
-- fix typo in spec (it's %%post, without a leading blank) introduced in -6
-- change SYSTYPE to linux
-
-* Fri Feb 11 2000 Bill Nottingham <notting@redhat.com>
-- pick a standard < 100 uid/gid for named
-
-* Fri Feb 04 2000 Elliot Lee <sopwith@redhat.com>
-- Pass named a '-u named' parameter by default, and add/remove user.
-
-* Thu Feb  3 2000 Bernhard Rosenkraenzer <bero@redhat.com>
-- fix host mx bug (Bug #9021)
-
-* Mon Jan 31 2000 Cristian Gafton <gafton@redhat.com>
-- rebuild to fix dependencies
-- man pages are compressed
-
-* Wed Jan 19 2000 Bernhard Rosenkraenzer <bero@redhat.com>
-- It's /usr/bin/killall, not /usr/sbin/killall (Bug #8063)
-
-* Mon Jan 17 2000 Bernhard Rosenkraenzer <bero@redhat.com>
-- Fix up location of named-bootconf.pl and make it executable
-  (Bug #8028)
-- bind-devel requires bind
-
-* Mon Nov 15 1999 Bernhard Rosenkraenzer <bero@redhat.com>
-- update to 8.2.2-P5
-
-* Wed Nov 10 1999 Bill Nottingham <notting@redhat.com>
-- update to 8.2.2-P3
-
-* Tue Oct 12 1999 Cristian Gafton <gafton@redhat.com>
-- add patch to stop a cache only server from complaining about lame servers
-  on every request.
-
-* Fri Sep 24 1999 Preston Brown <pbrown@redhat.com>
-- use real stop and start in named.init for restart, not ndc restart, it has
-  problems when named has changed during a package update... (# 4890)
-
-* Fri Sep 10 1999 Bill Nottingham <notting@redhat.com>
-- chkconfig --del in %%preun, not %%postun
-
-* Mon Aug 16 1999 Bill Nottingham <notting@redhat.com>
-- initscript munging
-
-* Mon Jul 26 1999 Bill Nottingham <notting@redhat.com>
-- fix installed chkconfig links to match init file
-
-* Sat Jul  3 1999 Jeff Johnson <jbj@redhat.com>
-- conflict with new (in man-1.24) man pages (#3876,#3877).
-
-* Tue Jun 29 1999 Bill Nottingham <notting@redhat.com>
-- fix named.logrotate (wrong %%SOURCE)
-
-* Fri Jun 25 1999 Jeff Johnson <jbj@redhat.com>
-- update to 8.2.1.
-- add named.logrotate (#3571).
-- hack around egcs-1.1.2 -m486 bug (#3413, #3485).
-- vet file list.
-
-* Fri Jun 18 1999 Bill Nottingham <notting@redhat.com>
-- don't run by default
-
-* Sun May 30 1999 Jeff Johnson <jbj@redhat.com>
-- nslookup fixes (#2463).
-- missing files (#3152).
-
-* Sat May  1 1999 Stepan Kasal <kasal@math.cas.cz>
-- nslookup patched:
-  to count numRecords properly
-  to fix subsequent calls to ls -d
-  to parse "view" and "finger" commands properly
-  the view hack updated for bind-8 (using sed)
-
-* Wed Mar 31 1999 Bill Nottingham <notting@redhat.com>
-- add ISC patch
-- add quick hack to make host not crash
-- add more docs
-
-* Fri Mar 26 1999 Cristian Gafton <gafton@redhat.com>
-- add probing information in the init file to keep linuxconf happy
-- dont strip libbind
-
-* Sun Mar 21 1999 Cristian Gafton <gafton@redhat.com>
-- auto rebuild in the new build environment (release 3)
-
-* Wed Mar 17 1999 Preston Brown <pbrown@redhat.com>
-- removed 'done' output at named shutdown.
-
-* Tue Mar 16 1999 Cristian Gafton <gafton@redhat.com>
-- version 8.2
-
-* Wed Dec 30 1998 Cristian Gafton <gafton@redhat.com>
-- patch to use the __FDS_BITS macro
-- build for glibc 2.1
-
-* Wed Sep 23 1998 Jeff Johnson <jbj@redhat.com>
-- change named.restart to /usr/sbin/ndc restart
-
-* Sat Sep 19 1998 Jeff Johnson <jbj@redhat.com>
-- install man pages correctly.
-- change K10named to K45named.
-
-* Wed Aug 12 1998 Jeff Johnson <jbj@redhat.com>
-- don't start if /etc/named.conf doesn't exist.
-
-* Sat Aug  8 1998 Jeff Johnson <jbj@redhat.com>
-- autmagically create /etc/named.conf from /etc/named.boot in %%post
-- remove echo in %%post
-
-* Wed Jun 10 1998 Jeff Johnson <jbj@redhat.com>
-- merge in 5.1 mods
-
-* Sun Apr 12 1998 Manuel J. Galan <manolow@step.es>
-- Several essential modifications to build and install correctly.
-- Modified 'ndc' to avoid deprecated use of '-'
-
-* Mon Dec 22 1997 Scott Lampert <fortunato@heavymetal.org>
-- Used buildroot
-- patched bin/named/ns_udp.c to use <libelf/nlist.h> for include
-  on Redhat 5.0 instead of <nlist.h>
+%autochangelog
diff --git a/changelog b/changelog
new file mode 100644
index 0000000..da3bb7c
--- /dev/null
+++ b/changelog
@@ -0,0 +1,3190 @@
+* Wed Jun 17 2026 Petr Menšík <pemensik@redhat.com> - 32:9.18.50-2
+- Prepare devel subpackage installable multiple times
+- Move binaries to versioned executables in main package, utils and dnssec-utils subpackages
+- Use alternatives symlinks to provide original names
+- Allow installation of multiple major versions at the same time
+- chroot package still conflicts, might be fixed later
+- Stop using build subdirectory and out-of-tree builds
+
+* Wed Jun 17 2026 Petr Menšík <pemensik@redhat.com> - 32:9.18.50-1
+- Update to 9.18.50 (rhbz#2489833)
+- Remove rwtab files
+
+* Fri Jun 12 2026 Yaakov Selkowitz <yselkowi@redhat.com> - 32:9.18.49-2
+- Rebuilt for openssl 4.0
+
+* Wed May 20 2026 Petr Menšík <pemensik@redhat.com> - 32:9.18.49-1
+- Update to 9.18.49 (rhbz#2480121)
+
+* Tue Apr 07 2026 Petr Menšík <pemensik@redhat.com> - 32:9.18.48-1
+- Update to 9.18.48 (rhbz#2453853)
+
+* Wed Mar 25 2026 Petr Menšík <pemensik@redhat.com> - 32:9.18.47-1
+- Update to 9.18.47 (rhbz#2440561)
+
+* Tue Mar 03 2026 Petr Menšík <pemensik@redhat.com> - 32:9.18.46-1
+- Update to 9.18.46 (rhbz#2440561)
+
+* Wed Jan 28 2026 Petr Menšík <pemensik@redhat.com> - 32:9.18.44-2
+- Create /var/named directories for bind-chroot (RHEL-132053)
+- Add forgotten _libdir/named into bind-chroot tmpfiles
+
+* Thu Jan 22 2026 Petr Menšík <pemensik@redhat.com> - 32:9.18.44-1
+- Update to 9.18.44 (rhbz#2431609)
+
+* Fri Jan 16 2026 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.18.43-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
+
+* Fri Jan 16 2026 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.18.43-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
+
+* Wed Dec 17 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.43-1
+- Update to 9.18.43 (rhbz#2415842)
+
+* Fri Oct 31 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.41-2
+- Fix upstream reported regression in recent CVE fix (CVE-2025-8677)
+- Add upstream dnssec system test testcase for this problem
+
+* Fri Oct 24 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.41-1
+- Update to 9.18.41 (rhbz#2405786, CVE-2025-8677 CVE-2025-40778 CVE-2025-40780)
+
+* Fri Oct 10 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.39-7
+- Reference to absolute config names from named.rfc1912.zones
+
+* Fri Oct 03 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.39-6
+- Move named.* files from /var/named into /usr/share/named
+- Move named.ca into /etc/named.ca
+
+* Tue Sep 16 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.39-5
+- Fix failures in idna system test (rhbz#2324186)
+
+* Wed Sep 10 2025 Adam Williamson <awilliam@redhat.com> - 32:9.18.39-4
+- No-change rebuild to fix F43 update
+
+* Wed Sep 03 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.39-3
+- Decode IDN names on input in all situations in utilities (rhbz#2324186)
+
+* Mon Sep 01 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.39-2
+- Offer up to 13 additional servers records if there are more servers
+
+* Thu Aug 21 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.39-1
+- Update to 9.18.39 (rhbz#2389765)
+
+* Wed Jul 30 2025 'Petr Mensik' <<pemensik@redhat.com>> - 32:9.18.38-1
+- Update to 9.18.38 (rhbz#2367771)
+
+* Wed Jul 23 2025 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.18.36-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
+
+* Tue Jun 10 2025 'Petr Mensik' <<pemensik@redhat.com>> - 32:9.18.36-2
+- Prevent name.c:670 attributes assertion failed
+- Add extra checks for relative names
+
+* Fri Apr 25 2025 Petr Mensik <pemensik@redhat.com> - 32:9.18.36-1
+- Update to 9.18.36 (rhbz#2346607)
+
+* Wed Mar 26 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.35-2
+- Backport support for OpenSSL provider required for PKCS11 labels
+- Deactivate jemalloc default linking
+
+* Wed Mar 26 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.35-1
+- Update to 9.18.35 (rhbz#2346607)
+
+* Thu Mar 20 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.33-3
+- Remove pre scriptlet
+
+* Mon Feb 10 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.33-2
+- Permanently remove DLZ parts build
+
+* Sun Feb 02 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.33-1
+- Update to 9.16.33 (rhbz#2342784)
+
+* Fri Jan 17 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.32-7
+- Add sysusers named user creation (rhbz#2105415)
+
+* Thu Jan 16 2025 Adam Williamson <awilliam@redhat.com> - 32:9.18.32-6
+- Rebuild again on mass rebuild tag so -4 doesn't override -5
+
+* Thu Jan 16 2025 Adam Williamson <awilliam@redhat.com> - 32:9.18.32-5
+- Provide user(named) and group(named)
+
+* Thu Jan 16 2025 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.18.32-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
+
+* Mon Jan 13 2025 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 32:9.18.32-3
+- Rebuilt for the bin-sbin merge (2nd attempt)
+
+* Fri Dec 20 2024 Adam Williamson <awilliam@redhat.com> - 32:9.18.32-2
+- No change sidetag rebuild to include bind-dyndb-ldap
+
+* Thu Dec 12 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.32-1
+- Update to 9.18.32 (#2331675)
+- Remove CHANGES file from package
+- Disable DLZ plugins, they are not shipped with bind anymore
+- Add new root key 38696 into package files too
+
+* Thu Dec 12 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.31-3
+- Disable temporarily PDF generation on all platforms
+
+* Wed Dec 04 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.31-2
+- Add nsupdate TLS support (FREEIPA-11706)
+- Include a test for nsupdate changes
+
+* Thu Nov 14 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.31-1
+- Update to 9.18.31 (#2319214)
+
+* Thu Nov 14 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.30-3
+- Bump obsoleted license version (rhbz#2308102)
+
+* Tue Oct 08 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.30-2
+- Make OpenSSL engine support optional
+
+* Fri Oct 04 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.30-1
+- Update to 9.18.30 (rhbz#2306542)
+
+* Wed Aug 21 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.29-1
+- Update to 9.18.29 (rhbz#2306542)
+
+* Wed Aug 21 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.28-4
+- Remove ancient triggerun and selinux boolean traces
+
+* Wed Jul 31 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.28-3
+- Drop PostgreSQL dependencies not used by DLZ anymore
+
+* Wed Jul 31 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.28-2
+- Conflict explicitly with more bind subpackages
+- Merge license subpackage into libs
+- Add optional QUERYTRACE feature
+- Make relative documentation links
+
+* Fri Jul 26 2024 Jonathan Wright <jonathan@almalinux.org> - 32:9.18.28-1
+- update to 9.18.28 rhbz#2299467
+- Fixes CVE-2024-4076
+- Fixes CVE-2024-1975
+- Fixes CVE-2024-1737
+- Fixes CVE-2024-0760
+
+* Wed Jul 17 2024 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.18.26-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
+
+* Tue Jul 09 2024 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 32:9.18.26-2
+- Rebuilt for the bin-sbin merge
+
+* Mon Apr 22 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.26-1
+- Update to 9.18.26 (rhbz#2270476)
+
+* Thu Feb 15 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.24-1
+- Update to 9.18.24 (#2264032)
+
+* Tue Jan 23 2024 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.18.21-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Fri Jan 19 2024 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.18.21-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Tue Jan 16 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.21-2
+- Update changed b.root-servers.net address in hints (#2253460)
+
+* Mon Jan 15 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.21-1
+- Update to 9.18.21 (#2255407)
+
+* Thu Nov 16 2023 Petr Menšík <pemensik@redhat.com> - 32:9.18.20-1
+- Update to 9.18.20 (#2249835)
+
+* Fri Sep 22 2023 Petr Menšík <pemensik@redhat.com> - 32:9.18.19-1
+- Update to 9.18.19 (#2232346)
+
+* Fri Sep 22 2023 Petr Menšík <pemensik@redhat.com> - 32:9.18.18-2
+- Skip failing rbtdb_test unit test on i686 (#2240253)
+
+* Wed Sep 06 2023 Petr Menšík <pemensik@redhat.com> - 32:9.18.18-1
+- Update to 9.18.18 (#2232346)
+
+* Wed Jul 19 2023 Petr Menšík <pemensik@redhat.com> - 32:9.18.17-1
+- Update to 9.18.17 (#2223913)
+
+* Wed Jul 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.18.16-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
+
+* Wed Jun 21 2023 Petr Menšík <pemensik@redhat.com> - 32:9.18.16-1
+- Update to 9.18.16 (#2216462)
+
+* Wed May 17 2023 Petr Menšík <pemensik@redhat.com> - 32:9.18.15-1
+- Update to 9.18.15 (#2207908)
+
+* Fri Apr 21 2023 Petr Menšík <pemensik@redhat.com> - 32:9.18.14-1
+- Update to 9.18.14 (#2187996)
+
+* Wed Apr 05 2023 Petr Menšík <pemensik@redhat.com> - 32:9.18.13-2
+- Enumerate all SPDX licenses used
+
+* Sat Mar 18 2023 Petr Menšík <pemensik@redhat.com> - 32:9.18.13-1
+- Update to 9.18.3 (#2178717)
+
+* Thu Feb 16 2023 Petr Menšík <pemensik@redhat.com> - 32:9.18.12-1
+- Update to 9.18.12 (#2170096)
+
+* Fri Jan 27 2023 Petr Menšík <pemensik@redhat.com> - 32:9.18.11-1
+- Update to 9.18.11 (#2164395)
+
+* Wed Jan 18 2023 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.18.10-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
+
+* Mon Jan 16 2023 Petr Menšík <pemensik@redhat.com> - 32:9.18.10-1
+- Update to 9.18.10 (#2143258)
+- Include rwlock.h from dns/zt.h
+
+* Mon Nov 21 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.9-1
+- Update to 9.18.9 (#2143258)
+
+* Sat Oct 22 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.8-1
+- Update to 9.18.8 (#2136100)
+
+* Fri Sep 30 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.7-3
+- Update License to SPDX identifier
+- Enable automatic restart on crashes
+
+* Sat Sep 24 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.7-2
+- Build ARM documentation also with older sphinx on RHEL9
+
+* Wed Sep 21 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.7-1
+- Update to 9.18.7 (#2128609)
+
+* Wed Sep 14 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.6-4
+- Disable yet another test (##2122010)
+
+* Tue Sep 06 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.6-3
+- Return OpenSSL engine implementation for pkcs11 interface (#2122841)
+- Skip problematic netmgr unit tests (#2122010)
+- Properly obsolete bind-dnssec-doc
+
+* Thu Sep 01 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.6-2
+- Always show error details for failed unittests (#2122010)
+
+* Tue Aug 30 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.6-1
+- Update to 9.18.6 (#2119132)
+- Report unit tests detailed results
+
+* Thu Aug 04 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.5-2
+- Use multiple threads on unit tests, but 16 at most
+
+* Wed Aug 03 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.5-1
+- Update to 9.18.5 (#2109170)
+- Return doc symlink to main page
+
+* Wed Jul 20 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.4-2
+- Stop enabling selinux booleans on every upgrade
+- Deprecate python3-bind for smooth upgrade
+- Remove PKCS1111 native utilities, libs and daemon
+
+* Wed Jul 20 2022 Petr Menšík <pemensik@redhat.com> - 32:9.18.4-1
+- Update to 9.18.4 (#2057493)
+
+* Wed Jul 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.16.30-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
+
+* Mon Jun 20 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.30-1
+- Update to 9.16.30 (#2097312)
+
+* Mon Jun 13 2022 Python Maint <python-maint@redhat.com> - 32:9.16.29-2
+- Rebuilt for Python 3.11
+
+* Thu May 26 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.29-1
+- Update to 9.16.29 (#2087920)
+- Fix netmgr_test fails on s390x (#2088125)
+
+* Tue May 17 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.28-2
+- Parse again timeout and attempts from resolv.conf (#2087156)
+- Reenable unit tests during build
+
+* Wed Apr 20 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.28-1
+- Update to 9.16.28 (#2076941)
+
+* Thu Mar 17 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.27-1
+- Upgrade to 9.16.27 (#2055120)
+
+* Tue Mar 01 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.26-2
+- Switch to locked queue (#2048235)
+
+* Thu Feb 17 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.26-1
+- Update to 9.16.26 (#2055120)
+
+* Fri Feb 11 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.25-3
+- Allow reservation of extra hp threads (#2048235)
+
+* Tue Jan 25 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.25-2
+- Replace master with primary in configuration
+
+* Fri Jan 21 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.25-1
+- Update to 9.16.25 (#2042504)
+
+* Wed Jan 19 2022 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.16.24-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
+
+* Wed Dec 22 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.24-2
+- Build with OpenLDAP 2.6 (#2032704)
+
+* Wed Dec 15 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.24-1
+- Update to 9.16.24 (#2032934)
+
+* Fri Nov 26 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-2
+- Correct with GEOIP2 condition (#2026823)
+
+* Fri Nov 19 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-1
+- Update to 9.16.23 (#2024210)
+
+* Sat Nov 06 2021 Adrian Reber <adrian@lisas.de> - 32:9.16.22-2
+- Rebuilt for protobuf 3.19.0
+
+* Wed Oct 27 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.22-1
+- Update to 9.16.22
+
+* Sun Oct 24 2021 Adrian Reber <adrian@lisas.de> - 32:9.16.21-3
+- Rebuilt for protobuf 3.18.1
+
+* Wed Oct 13 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.21-2
+- Propagate ephemeral port ranges to chroot (#2013597)
+
+* Wed Sep 15 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.21-1
+- Update to 9.16.21
+
+* Tue Sep 14 2021 Sahana Prasad <sahana@redhat.com> - 32:9.16.20-4
+- Rebuilt with OpenSSL 3.0.0
+
+* Wed Aug 25 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.20-3
+- Increase map format version, lower memory consuption a bit (#1997504)
+- Remove unneeded test variants changes
+- Include documentation of dig return codes
+
+* Thu Aug 19 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.20-2
+- Fix map file format regression
+
+* Tue Aug 17 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.20-1
+- Update to 9.16.20
+
+* Thu Aug 05 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.19-4
+- Do not depend on systemd package
+
+* Tue Aug 03 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.19-3
+- Reenable PDF building again (#1984687)
+
+* Fri Jul 23 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.19-2
+- Include backward compatible html symlink in doc subpackage
+
+* Wed Jul 21 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.19-1
+- Update to 9.16.19 (#1984627)
+- Disable PDF rebuild on Rawhide (#1984687)
+
+* Wed Jul 21 2021 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.16.18-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
+
+* Sat Jul 10 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.18-4
+- Disable PDF building on ELN
+
+* Sat Jul 10 2021 Björn Esser <besser82@fedoraproject.org> - 32:9.16.18-3
+- Rebuild for versioned symbols in json-c
+
+* Tue Jun 22 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.18-2
+- Re-enable building of PDF ARM documentation
+
+* Fri Jun 18 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.18-1
+- Update to 9.16.18
+
+* Fri Jun 18 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.17-2
+- Fix wildcard expansion not working with 'w' (#1973587)
+
+* Thu Jun 17 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.17-1
+- Update to 9.16.17
+
+* Fri Jun 04 2021 Python Maint <python-maint@redhat.com> - 32:9.16.16-2
+- Rebuilt for Python 3.10
+
+* Thu May 20 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.16-1
+- Update to 9.16.16 (#1954827)
+
+* Thu Apr 29 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.15-1
+- Update to 9.16.15
+
+* Thu Mar 25 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.13-1
+- Update to 9.16.13
+- Changed displayed version just to include -RH suffix, not release
+- Version is now part of library names, soname versions are no longer provided
+- Removed bind-libs-lite subpackage
+
+* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 32:9.16.11-6
+- Rebuilt for updated systemd-rpm-macros
+  See https://pagure.io/fesco/issue/2583.
+
+* Fri Feb 26 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.11-5
+- Make logrotate.d world-readable (#1917061)
+
+* Mon Feb 22 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.11-4
+- Fix off-by-one bug in ISC SPNEGO implementation (#1929965)
+
+* Mon Feb 08 2021 Pavel Raiskup <praiskup@redhat.com> - 32:9.16.11-3
+- rebuild for libpq ABI fix rhbz#1908268
+
+* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.16.11-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
+
+* Thu Jan 21 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.11-1
+- Update to 9.16.11 (#1827602)
+- Avoid unit test failures on machines with many cores
+
+* Thu Jan 14 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.10-2
+- Update to 9.16.10
+- Remove bind-sdb package
+- https://fedoraproject.org/wiki/Changes/BIND9.16
+
+* Wed Jan 13 08:55:11 CET 2021 Adrian Reber <adrian@lisas.de> - 32:9.11.26-3
+- Rebuilt for protobuf 3.14
+
+* Wed Jan 06 2021 Petr Menšík <pemensik@redhat.com> - 32:9.11.26-2
+- Use make macros
+- https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro
+
+* Mon Jan 04 2021 Petr Menšík <pemensik@redhat.com> - 32:9.11.26-1
+- Update to 9.11.26
+
+* Mon Nov 30 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.25-2
+- Regenerate all manual pages on build
+
+* Thu Nov 26 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.25-1
+- Update to 9.11.25
+
+* Wed Nov 04 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.24-2
+- Fix crash on NTA recheck failure (#1893761)
+
+* Fri Oct 23 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.24-1
+- Update to 9.11.24
+
+* Wed Sep 23 2020 Adrian Reber <adrian@lisas.de> - 32:9.11.23-2
+- Rebuilt for protobuf 3.13
+
+* Thu Sep 17 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.23-1
+- Update to 9.11.23
+- Merge bind-lite-devel into devel package
+
+* Tue Sep 01 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.22-2
+- Require libcap from devel package
+
+* Thu Aug 20 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.22-1
+- Update to 9.11.22
+
+* Sat Aug 01 2020 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.11.21-3
+- Second attempt - Rebuilt for
+  https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Mon Jul 27 2020 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.11.21-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Wed Jul 15 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.21-1
+- Update to 9.11.21
+
+* Tue Jun 23 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.20-3
+- Move documentation to separate bind-doc package
+
+* Sat Jun 20 2020 Adrian Reber <adrian@lisas.de> - 32:9.11.20-2
+- Rebuilt for protobuf 3.12
+
+* Wed Jun 17 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.20-1
+- Update to 9.11.20
+
+* Tue May 26 2020 Miro Hrončok <mhroncok@redhat.com> - 32:9.11.19-2
+- Rebuilt for Python 3.9
+
+* Fri May 15 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.19-1
+- Update to 9.11.19 (CVE-2020-8616, CVE-2020-8617)
+- Make initscripts just optional dependency
+
+* Tue Apr 21 2020 Björn Esser <besser82@fedoraproject.org> - 32:9.11.18-2
+- Rebuild (json-c)
+
+* Thu Apr 16 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.18-1
+- Update to 9.11.18
+
+* Tue Mar 31 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.17-1
+- Update to 9.11.17
+
+* Tue Jan 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.11.14-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
+
+ * Wed Jan 08 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.14-4
+- Remove libmaxminddb-devel from devel package dependencies
+
+* Fri Jan 03 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.14-3
+- Preserve symlinks to named.conf on iscdlv modification (#1786626)
+
+* Thu Dec 19 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.14-2
+- Include more Thread Sanitizer detected changes (#1736762)
+
+* Thu Dec 19 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.14-1
+- Update to 9.11.14
+
+* Tue Dec 03 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.13-4
+- Disable Berkeley DB support (#1779190)
+
+* Mon Dec 02 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.13-3
+- Backport few thread safety related fixed from upstream (#1736762)
+
+* Tue Nov 26 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.13-2
+- Complete explicit disabling of RSAMD5 in FIPS mode (#1709553)
+
+* Tue Nov 19 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.13-1
+- Update to 9.11.13
+
+* Tue Nov 19 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.12-6
+- Report failures on systemctl reload
+
+* Tue Nov 12 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.12-5
+- Fix binary compatibility after serve-stale patch (#1770492)
+
+* Wed Nov 06 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.12-4
+- Backported serve-stale feature
+
+* Wed Nov 06 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.12-3
+- Fix wrong default GeoIP directory (#1768258)
+
+* Mon Nov 04 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.12-2
+- Move data files outside config archive
+- Specify geoip data directory in config file (#1768258)
+
+* Mon Oct 21 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.12-1
+- Update to 9.11.12 (#1557762)
+
+* Wed Sep 25 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.11-1
+- Update to 9.11.11
+
+* Wed Sep 04 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.10-3
+- Share pkcs11-utils and dnssec-utils manuals instead of recommend
+
+* Tue Sep 03 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.10-2
+- Move some administration utilities back to bind-utils (#1720380)
+- Add GeoIP to bind-chroot (#1497646)
+- Recommend bind-dnssec-utils from bind-pkcs11-utils
+
+* Tue Aug 27 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.10-1
+- Update to 9.11.10
+
+* Mon Aug 19 2019 Miro Hrončok <mhroncok@redhat.com> - 32:9.11.9-4
+- Rebuilt for Python 3.8
+
+* Fri Aug 09 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.9-3
+- Display errors from rndc reload (#1739441)
+
+* Thu Aug 08 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.9-2
+- Permit explicit disabling of RSAMD5 in FIPS mode (#1709553)
+
+* Wed Jul 24 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.9-1
+- Update to 9.11.9
+- Add GeoLite2 support
+- Disable export-libs
+
+* Wed Jul 24 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.8-2
+- Use monotonic time in export library (#1732883)
+
+* Wed Jul 24 2019 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.11.8-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
+
+* Tue Jul 02 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.8-1
+- Update to 9.11.8
+
+* Mon Jun 17 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.7-2
+- Fix OpenSSL random generator initialization
+
+* Mon Jun 10 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.7-1
+- Update to 9.11.7
+
+* Mon May 06 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.6-5.P1
+- Fix also postun script
+
+* Mon May 06 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.6-4.P1
+- Fix error in scriptlet condition
+
+* Thu May 02 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.6-3.P1
+- Fix inefective limit of TCP clients (CVE-2018-5743)
+
+* Thu Mar 14 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.6-2
+- Fix dnstap and timer issues in unit test
+- Enable DLZ modules
+
+* Tue Mar 05 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.6-1
+- Update to 9.11.6
+
+* Fri Mar 01 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.5-15.P4
+- Support testing of named variants
+
+* Thu Feb 28 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.5-14.P4
+- Modify feature-test detection of dlz-filesystem
+
+* Fri Feb 22 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.5-13.P4
+- Update to 9.11.5-P4
+
+* Fri Feb 22 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.5-12.P1
+- Enable DNSTAP support (#1564776)
+- Enable LMDB support for rndc addzone
+- Enable json format in statistics-channel
+
+* Thu Feb 21 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.5-11.P1
+- Disable often failing unit test random_test
+
+* Thu Feb 21 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.5-10.P1
+- Disable autodetected eddsa algorithm ED448
+
+* Thu Jan 31 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.5-9.P1
+- dig prints ASCII name instead of failure (#1647829)
+- disable IDN output from scripts
+- Update project URL
+- Removed revoked KSK 19164 from trusted keys
+
+* Thu Jan 31 2019 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.11.5-8.P1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
+
+* Sun Jan 27 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.5-7.P1
+- Update to 9.11.5-P1
+
+* Wed Jan 23 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.5-6
+- Reenable crypto rand for DHCP, disable just entropy check (#1663318)
+
+* Thu Jan 17 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.5-5
+- Move dnssec related tools from bind-utils to bind-dnssec-utils (#1649398)
+
+* Wed Jan 16 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.5-4
+- Reject invalid binary file (#1666814)
+
+* Mon Jan 14 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.5-3
+- Disable crypto rand for DHCP (#1663318)
+
+* Thu Oct 25 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.5-2
+- Add optional support for JSON statistics
+- Add optional DNSTAP support (#1564776), new dnstap-read tool
+
+* Wed Oct 24 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.5-1
+- Update to 9.11.5
+
+* Tue Oct 02 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.4-12.P2
+- Add Requires to devel packages referenced by bind-devel
+
+* Sat Sep 29 2018 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 32:9.11.4-11.P2
+- Fix export-libs macro & scriptlet
+
+* Wed Sep 26 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.4-10.P2
+- Reenable IDN output but allow turning it off (#1580200)
+
+* Thu Sep 20 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.4-9.P2
+- Update to bind-9.11.4-P2
+- Add /dev/urandom to chroot (#1631515)
+
+* Fri Aug 24 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.4-8.P1
+- Replace unoptimized code by OpenSSL counterparts
+- Fix multilib conflicts of devel package
+- Add versioned depends to all library subpackages
+
+* Fri Aug 24 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.4-7.P1
+- Add support for OpenSSL provided random data
+
+* Mon Aug 13 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.4-6.P1
+- Fix sdb-chroot devices upgrade (#1592873)
+- Automatically replace obsoleted ISC DLV key with root key (#1595782)
+
+* Thu Aug 09 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.4-5.P1
+- Update to 9.11.4-P1
+- Adds root key sentinel support
+- Large IXFR zone transfers are rejected to prevent journal corruption
+
+* Thu Aug 02 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.4-4
+- Support unavailable MD5 in FIPS mode
+
+* Thu Aug 02 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.4-3
+- Use OpenSSL for digest operations (#1611537)
+
+* Tue Jul 31 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.4-2
+- Install generated manual pages
+
+* Thu Jul 12 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.4-1
+- Update to 9.11.4
+- Use kyua instead of kyua-cli for unit tests
+
+* Thu Jul 12 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.3-15
+- Use new config file named-chroot.files for chroot setup (#1429656)
+- Fix chroot devices file verification (#1592873)
+- Prevent errors on bind-chroot uninstall when running (#1600583)
+
+* Thu Jul 12 2018 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.11.3-14
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
+
+* Mon Jul 02 2018 Miro Hrončok <mhroncok@redhat.com> - 32:9.11.3-13
+- Rebuilt for Python 3.7
+
+* Wed Jun 27 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.3-12
+- Require utils instead of library
+
+* Wed Jun 27 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.3-11
+- Remove named.iscdlv.key file (#1595782)
+- Fix CVE-2018-5738
+
+* Tue Jun 19 2018 Miro Hrončok <mhroncok@redhat.com> - 32:9.11.3-10
+- Rebuilt for Python 3.7
+
+* Fri May 25 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.3-9
+- Make named home writeable (#1422680)
+- Change named shell to /bin/false
+
+* Fri May 25 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.3-8
+- Require C++ on build when shipped atf library is used
+
+* Mon Apr 09 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.3-7
+- Run tests also without kyua
+
+* Thu Apr 05 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.3-6
+- Do not link libidn2 to all libraries (#1098783)
+- Update named.ca
+
+* Tue Apr 03 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.3-5
+- Enable libidn2 support (#1098783)
+- Make +noidnout default
+- Compile export libs without GSSAPI
+
+* Wed Mar 21 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.3-4
+- Rebase to 9.11.3
+- Add dig support for libidn2 (#1098783)
+
+* Wed Mar 21 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.3-3.b1
+- Fix build with disabled unittest
+- Recommend softhsm from pkcs11 variant
+
+* Thu Feb 22 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.3-2.b1
+- Require openssl-devel and libcap-devel from bind-export-devel
+- Conflict with bind99-devel
+- Change spec globals to rpmbuild --with feature
+
+* Thu Feb 15 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.3-1.b1
+- Rebase to 9.11.3b1
+
+* Wed Feb 07 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.2-11.P1
+- Use versioned provides
+- Fix starting of unit tests
+- Forward export libs path to isc-config
+- Rename export devel subpackage to bind-export-devel
+
+* Wed Feb 07 2018 Pavel Zhukov <pzhukov@redhat.com> - 32:9.11.2-10.P1
+- Add obsoletes/provides tags for smooth update
+
+* Wed Feb 07 2018 Pavel Zhukov <pzhukov@redhat.com> - 32:9.11.2-9.P1
+- Build devel package for export-libs
+
+* Wed Feb 07 2018 Pavel Zhukov <pzhukov@redhat.com> - 32:9.11.2-8.P1
+- Build export libraries with disabled threads and selects
+
+* Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.11.2-7.P1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
+
+* Tue Jan 30 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.2-6.P1
+- Remove ldconfig calls where possible
+- Note -z defs cannot be enabled until more work
+
+* Tue Jan 16 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.2-5.P1
+- Fix CVE-2017-3145, rebase to 9.11.2-P1
+
+* Tue Jan 02 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.2-4
+- Enable unit tests with kyua tool (#1532694)
+- Provide internal tool to prepare softhsm token storage
+- Proper fix for python3-bind subpackage directory ownership (#1522944)
+
+* Fri Dec 15 2017 Petr Menšík <pemensik@redhat.com> - 32:9.11.2-3
+- Own python3-bind isc directory (#1522944)
+- Make tsstsig system test pass again (#1500017)
+
+* Mon Oct 23 2017 Petr Menšík <pemensik@redhat.com> - 32:9.11.2-2
+- Build against mariadb-connector-c-devel (#1493615)
+- Include DNSKEY 20326 also in trusted-key.key (#1505476)
+- Fix dynamic symbols conflict with ldap (#1205168)
+- Use hmac-sha256 for new RNDC keys (#1508003)
+- Include protocols and services in chroot
+
+* Wed Aug 02 2017 Petr Menšík <pemensik@redhat.com> - 32:9.11.2-1
+- Update to 9.11.2
+- Add recursing and secroots file into default and sample config
+- Fix nsupdate GSSAPI auth against AD server (#1484451)
+
+* Wed Aug 02 2017 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.11.1-6.P3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
+
+* Wed Jul 26 2017 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.11.1-5.P3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
+
+* Fri Jul 14 2017 Petr Menšík <pemensik@redhat.com> - 32:9.11.1-4.P3
+- Simplify change of default configuration file path
+
+* Thu Jul 13 2017 Petr Menšík <pemensik@redhat.com> - 32:9.11.1-3.P3
+- Use mysql_config for SDB variant, build against mariadb-devel
+
+* Mon Jul 10 2017 Petr Menšík <pemensik@redhat.com> - 32:9.11.1-2.P3
+- Update to 9.11.1-P3
+
+* Fri Jun 30 2017 Petr Menšík <pemensik@redhat.com> - 32:9.11.1-2.P2
+- Update to 9.11.1-P2
+
+* Thu Jun 29 2017 Petr Menšík <pemensik@redhat.com> - 32:9.11.1-2.P1
+- dnssec-checkds and dnssec-coverage requires python module (#1466183)
+
+* Thu Jun 15 2017 Petr Menšík <pemensik@redhat.com> - 32:9.11.1-1.P1
+- Update to 9.11.1-P1
+
+* Fri Apr 21 2017 Petr Menšík <pemensik@redhat.com> - 32:9.11.0-8.P5
+- Fix queries for TKEY in nsupdate, when using GSSAPI (#1236087)
+
+* Thu Apr 13 2017 Petr Menšík <pemensik@redhat.com> - 32:9.11.0-7.P5
+- Update to 9.11.0-P5
+- Use BINDVERSION for upstream version
+
+* Fri Feb 10 2017 Petr Menšík <pemensik@redhat.com> - 32:9.11.0-7.P3
+- Update to 9.11.0-P3
+
+* Fri Feb 10 2017 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.11.0-7.P2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
+
+* Wed Jan 18 2017 Petr Menšík <pemensik@redhat.com> - 32:9.11.0-6.P2
+- RTLD_DEEPBIND conflicts with pkcs11 libraries, skip it for dyndb (#1410433)
+- Fix some rpm warnings
+
+* Mon Jan 16 2017 Petr Menšík <pemensik@redhat.com> - 32:9.11.0-5.P2
+- Fix manual pages generated by recent docbook-style-xsl (#1397186)
+
+* Thu Jan 12 2017 Petr Menšík <pemensik@redhat.com> - 32:9.11.0-4.P2
+- Update to 9.11.0-P2
+
+* Mon Dec 19 2016 Miro Hrončok <mhroncok@redhat.com> - 32:9.11.0-4.P1
+- Rebuild for Python 3.6
+
+* Tue Nov 22 2016 Petr Menšík <pemensik@redhat.com> - 32:9.11.0-3.P1
+- Split pk11 includes, include real functions only in pkcs11 variant
+
+* Wed Nov 16 2016 Petr Menšík <pemensik@redhat.com> - 32:9.11.0-2.P1
+- Do not change lib permissions in chroot
+
+* Wed Nov 16 2016 Michal Ruprich <mruprich@redhat.com> - 32:9.11.0-1.P1
+- Update to 9.11.0-P1
+
+* Tue Nov 08 2016 Petr Menšík <pemensik@redhat.com> - 32:9.10.4-3.P4
+- Build with OpenSSL 1.1
+
+* Thu Nov 03 2016 Petr Menšík <pemensik@redhat.com> - 32:9.10.4-2.P4
+- Update to 9.10.4-P4
+
+* Thu Sep 29 2016 Tomas Hozza <thozza@redhat.com> - 32:9.10.4-2.P3
+- Update to 9.10.4-P3
+
+* Wed Jul 20 2016 Michal Ruprich <mruprich@redhat.com> - 32:9.10.4-1.P2
+- Update to 9.10.4-P2
+
+* Thu May 26 2016 Tomas Hozza <thozza@redhat.com> - 32:9.10.4-1.P1
+- Update to 9.10.4-P1
+
+* Fri May 20 2016 Tomas Hozza <thozza@redhat.com> - 32:9.10.3-14.P4
+- (un)mount /var/named in -chroot packages as the last directory (Related: #1279188)
+
+* Thu May 12 2016 Tomas Hozza <thozza@redhat.com> - 32:9.10.3-13.P4
+- Remove NM dispatcher script, since it is not needed any more (#1277257)
+- Replaced After=network-online.target with After=network.target in all unit files
+
+* Fri Mar 11 2016 Tomas Hozza <thozza@redhat.com> - 32:9.10.3-12.P4
+- Update to 9.10.3-P4 due to CVE-2016-1285 CVE-2016-1286 CVE-2016-2088
+
+* Wed Feb 03 2016 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.10.3-11.P3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
+
+* Thu Jan 21 2016 Tomas Hozza <thozza@redhat.com> - 32:9.10.3-10.P3
+- Update to 9.10.3-P3 due to CVE-2015-8704 and CVE-2015-8705 (#1300051)
+
+* Wed Jan 06 2016 Tomas Hozza <thozza@redhat.com> - 32:9.10.3-9.P2
+- Commented out bindkeys-file statement in default configuration (#1223365#c3)
+- Removed unrecognized configure option --enable-developer
+- Added configure option --enable-full-report to get report on enabled features
+
+* Sat Dec 26 2015 Robert Scheck <robert@fedoraproject.org> - 32:9.10.3-8.P2
+- Remove unrecognized build options for %%configure
+- Own %%{_includedir}/bind9 directory in -lite-devel
+- Fixed building without (optional) PKCS#11 support
+
+* Wed Dec 16 2015 Tomas Hozza <thozza@redhat.com> - 32:9.10.3-7.P2
+- bump release to maintain update path
+
+* Wed Dec 16 2015 Tomas Hozza <thozza@redhat.com> - 32:9.10.3-4.P2
+- Update to 9.10.3-P2
+
+* Tue Nov 10 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 32:9.10.3-3
+- Rebuilt for https://fedoraproject.org/wiki/Changes/python3.5
+
+* Wed Nov 04 2015 Tomas Hozza <thozza@redhat.com> - 32:9.10.3-2
+- Fixed named-checkconf call in *-chroot.service files (#1277820)
+
+* Thu Sep 17 2015 Tomas Hozza <thozza@redhat.com> - 32:9.10.3-1
+- Update to 9.10.3 stable
+
+* Thu Sep 03 2015 Tomas Hozza <thozza@redhat.com>
+- Update to 9.10.3rc1
+
+* Wed Jul 29 2015 Tomas Hozza <thozza@redhat.com> - 32:9.10.2-9.P3
+- Update to 9.10.2-P3 to fix CVE-2015-5477
+
+* Thu Jul 09 2015 Tomas Hozza <thozza@redhat.com> - 32:9.10.2-8.P2
+- Update to 9.10.2-P2
+
+* Mon Jun 29 2015 Tomas Hozza <thozza@redhat.com> - 32:9.10.2-7.P1
+- Reintroduce the DISABLE_ZONE_CHECKING into /etc/sysconfig/named
+
+* Fri Jun 19 2015 Tomas Hozza <thozza@redhat.com> - 32:9.10.2-6.P1
+- Update to 9.10.2-P1
+
+* Wed Jun 17 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 32:9.10.2-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
+
+* Wed May 27 2015 Tomas Hozza <thozza@redhat.com> - 32:9.10.2-4
+- Don't copy /etc/localtime on -chroot package installation
+
+* Fri May 22 2015 Tomas Hozza <thozza@redhat.com> - 32:9.10.2-3
+- Don't use ISC's DLV by default (#1223365)
+- Utilize system-wide crypto-policies (#1179925)
+
+* Thu May 21 2015 Tomas Hozza <thozza@redhat.com> - 32:9.10.2-2
+- enable tuning for large systems - increases hardcoded internal limits
+- enable GeoIP access control feature
+
+* Thu Feb 26 2015 Tomas Hozza <thozza@redhat.com> - 32:9.10.2-1
+- update to 9.10.2 stable
+- remove parallel-build patch after discussion with upstream [ISC-Bugs #38739]
+
+* Wed Feb 25 2015 Tomas Hozza <thozza@redhat.com> - 32:9.10.2-0.3.rc1
+- update to 9.10.2rc2
+- call ldconfig for pkcs11-libs
+- Use Python3 by default (#1186791)
+
+* Sat Feb 21 2015 Till Maas <opensource@till.name> - 32:9.10.2-0.2.rc1
+- Rebuilt for Fedora 23 Change
+  https://fedoraproject.org/wiki/Changes/Harden_all_packages_with_position-independent_code
+
+* Mon Feb 02 2015 Tomas Hozza <thozza@redhat.com> - 32:9.10.2-0.1.rc1
+- update to 9.10.2rc1
+- fix nsupdate server auto-detection (#1184151)
+- drop merged patch bind99-rh985918.patch
+
+* Fri Jan 16 2015 Tomas Hozza <thozza@redhat.com> - 32:9.10.1-2.P1
+- Install config for tmpfiles under %%{_tmpfilesdir} (#1181020)
+
+* Tue Jan 13 2015 Tomas Hozza <thozza@redhat.com> - 32:9.10.1-1.P1
+- Update to 9.10.1-P1 stable
+
+* Fri Dec 12 2014 Tomas Hozza <thozza@redhat.com> - 32:9.9.6-6.P1
+- Drop downstream patch for nslookup/host rejected by upstream
+
+* Tue Dec 09 2014 Tomas Hozza <thozza@redhat.com> - 32:9.9.6-5.P1
+- Update to 9.9.6-P1 (CVE-2014-8500)
+
+* Fri Nov 14 2014 Tomas Hozza <thozza@redhat.com> - 32:9.9.6-4
+- Fixed systemctl path in logrotate configuration (#1148360)
+- drop engine_pkcs11 dependency, since we use native PKCS#11 implementation
+
+* Wed Oct 22 2014 Petr Spacek <pspacek@redhat.com> - 32:9.9.6-3
+- Fix crash during GSS-TSIG processing (#1155334, #1155127)
+  introduced in 32:9.9.6-2
+
+* Tue Oct 14 2014 Tomas Hozza <thozza@redhat.com> - 32:9.9.6-2
+- Added native PKCS#11 functionality (#1097752)
+- bind-sdb now requires bind due to configuration and other utilities
+- bind-pkcs11 now requires bind due to configuration and other utilities
+
+* Thu Oct 02 2014 Tomas Hozza <thozza@redhat.com> - 32:9.9.6-1
+- Update to 9.9.6
+- drop merged patches and rebase some of existing patches
+- Add architecture specific dependencies.
+- Fix assert in dig when using +sigchase (#985918)
+
+* Fri Aug 15 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 32:9.9.5-9.P1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
+
+* Fri Jul 18 2014 Tomas Hozza <thozza@redhat.com> 32:9.9.5-8.P1
+- Use network-online.target instead of network.target (#1117086)
+
+* Fri Jul 11 2014 Tom Callaway <spot@fedoraproject.org> 32:9.9.5-7.P1
+- fix license handling
+
+* Thu Jun 12 2014 Tomas Hozza <thozza@redhat.com> 32:9.9.5-6.P1
+- Update to 9.9.5-P1
+
+* Mon Jun 09 2014 Tomas Hozza <thozza@redhat.com> 32:9.9.5-5
+- Use /dev/urandom for generation of rndc.key (#1079799)
+
+* Sat Jun 07 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 32:9.9.5-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
+
+* Tue Apr 22 2014 Tomas Hozza <thozza@redhat.com> 32:9.9.5-3
+- configure bind with --with-dlopen=yes to support dynamically loadable DLZ drivers
+
+* Wed Mar 05 2014 Tomas Hozza <thozza@redhat.com> 32:9.9.5-2
+- dlz_dlopen driver could return the wrong error leading to a segfault (#1052781)
+- Fix race condition when freeing fetch object (ISC-Bugs #35385)
+
+* Thu Feb 13 2014 Tomas Hozza <thozza@redhat.com> 32:9.9.5-1
+- Update to 9.9.5 stable
+
+* Sun Jan 26 2014 Rex Dieter <rdieter@fedoraproject.org> 32:9.9.5-0.5.rc2
+- -libs, -libs-lite: track sonames, so abi bumps aren't a surprise
+
+* Fri Jan 24 2014 Tomas Hozza <thozza@redhat.com> 32:9.9.5-0.4.rc2
+- update to 9.9.5rc2
+- merged patches dropped
+- some patches rebased to the new version
+
+* Wed Jan 15 2014 Tomas Hozza <thozza@redhat.com> 32:9.9.5-0.3.b1
+- non-existance of resolv.conf should not be fatal (#1052343)
+
+* Tue Jan 14 2014 Tomas Hozza <thozza@redhat.com> 32:9.9.5-0.2.b1
+- Fix CVE-2014-0591
+
+* Mon Jan 06 2014 Tomas Hozza <thozza@redhat.com> 32:9.9.5-0.1.b1
+- Update to bind-9.9.5b1
+- Build bind-sdb against libdb instead of libdb4
+
+* Wed Dec 18 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.4-11
+- Fix crash in rbtdb after two sucessive getoriginnode() calls
+
+* Tue Dec 17 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.4-10
+- Split chroot package for named and named-sdb
+- Extract setting-up/destroying of chroot to a separate systemd service (#997030)
+
+* Thu Nov 28 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.4-9
+- Fixed memory leak in nsupdate if 'realm' was used multiple times (#984687)
+
+* Tue Nov 12 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.4-8
+- Install configuration for rwtab and fix chroot setup script
+
+* Thu Oct 31 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.4-7
+- Correct the upstream patch for #794940
+
+* Thu Oct 31 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.4-6
+- use --enable-filter-aaaa when building bind to enable use of filter-aaaa-on-v4 option
+
+* Wed Oct 30 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.4-5
+- Create symlink /var/named/chroot/var/run -> /var/named/chroot/run
+- Added session-keyfile statement into default named.conf since we use /run/named
+
+* Tue Oct 29 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.4-4
+- Use upstream version of patch for previously fixed #794940
+
+* Fri Oct 18 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.4-3
+- Fix race condition on send buffers in dighost.c (#794940)
+
+* Tue Oct 08 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.4-2
+- install isc/errno2result.h header
+
+* Fri Sep 20 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.4-1
+- Update to bind-9.9.4 stable
+
+* Tue Sep 10 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.4-0.9.rc2
+- Fix [ISC-Bugs #34738] dns_journal_open() returns a pointer to stack
+
+* Mon Sep 09 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.4-0.8.rc2
+- update to bind-9.9.4rc2
+
+* Tue Aug 20 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.4-0.7.rc1
+- Move named-checkzone and named-compilezone to bind-utils package
+
+* Tue Aug 20 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.4-0.6.rc1
+- Move tools that don't need the server to run, from main package to bind-utils (#964313)
+
+* Fri Aug 16 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.4-0.5.rc1
+- Don't generate rndc.key if there exists rndc.conf
+
+* Fri Aug 16 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.4-0.4.rc1
+- don't install named-sdb.service if SDB macro is defined to zero
+
+* Mon Aug 05 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.4-0.3.rc1
+- Fix setup-named-chroot.sh to mount/umount everything successfully
+- update to bind-9.9.4rc1
+
+* Sat Aug 03 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 32:9.9.4-0.2.b1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
+
+* Mon Jul 15 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.4-0.1.b1
+- update to bind-9.9.4b1
+- drop merged RRL patch
+- drop merged stat.h patch
+
+* Wed Jun 05 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.3-3.P1
+- update to 9.9.3-P1 (fix for CVE-2013-3919)
+- update RRL patch to 9.9.3-P1-rl.156.01
+
+* Mon Jun 03 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.3-2
+- bump release to prevent update path issues
+
+* Mon Jun 03 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.3-1
+- update to 9.9.3
+- install dns/update.h header
+- update RRL patch to the latest version 9.9.3-rl.150.20
+
+* Fri May 17 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.3-0.7.rc2
+- Fix segfault in host/nslookup (#878139)
+
+* Mon May 13 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.3-0.6.rc2
+- update to 9.9.3rc2
+- part of bind97-exportlib.patch not needed any more
+- bind-9.9.1-P2-multlib-conflict.patch modified to reflect latest source
+- rl-9.9.3rc1.patch -> rl-9.9.3rc2.patch
+- bind99-opts.patch merged
+
+* Fri May 03 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.3-0.5.rc1
+- Include recursion Warning in named.conf and named.conf.sample (#740894)
+- Include managed-keys-directory statement in named.conf.sample (#948026)
+
+* Thu May 02 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.3-0.4.rc1
+- Fix zone2sqlite to quote table names when creating/dropping/inserting (#919417)
+
+* Fri Apr 19 2013 Adam Tkac <atkac redhat com> 32:9.9.3-0.3.rc1
+- fix crash in nsupdate when processing "-r" parameter (#949544)
+
+* Tue Apr 16 2013 Adam Tkac <atkac redhat com> 32:9.9.3-0.2.rc1
+- ship dns/rrl.h in -devel subpkg
+
+* Tue Apr 16 2013 Adam Tkac <atkac redhat com> 32:9.9.3-0.1.rc1
+- update to 9.9.3rc1
+- bind-96-libtool2.patch has been merged
+- fix bind tmpfiles.d for named.pid /run migration (#920713)
+
+* Wed Mar 27 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.2-12.P2
+- New upstream patch version fixing CVE-2013-2266 (#928032)
+
+* Tue Mar 19 2013 Adam Tkac <atkac redhat com> 32:9.9.2-11.P1
+- move pidfile to /run/named/named.pid
+
+* Wed Mar 06 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.2-10.P1
+- Fix Makefile.in to include header added by rate limiting patch (#918330)
+
+* Tue Mar 05 2013 Adam Tkac <atkac redhat com> 32:9.9.2-9.P1
+- drop some developer-only documentation and move ARM to %%docdir
+
+* Mon Feb 18 2013 Adam Tkac <atkac redhat com> 32:9.9.2-8.P1
+- include rate limiting patch
+
+* Tue Jan 29 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.2-7.P1
+- Corrected IP addresses in named.ca (#901741)
+- mount/umount /var/named in setup-named-chroot.sh as the last one (#904666)
+
+* Thu Dec 20 2012 Adam Tkac <atkac redhat com> 32:9.9.2-6.P1
+- generate /etc/rndc.key during named service startup if doesn't exist
+- increase startup timeout in systemd units to 90sec (default)
+- fix IDN related statement in dig.1 manpage
+
+* Wed Dec 05 2012 Tomas Hozza <thozza@redhat.com> 32:9.9.2-5.P1
+- update to bind-9.9.2-P1
+
+* Mon Nov 12 2012 Adam Tkac <atkac redhat com> 32:9.9.2-4
+- document dig exit codes in manpage
+- ignore empty "search" options in resolv.conf
+
+* Mon Nov 12 2012 Adam Tkac <atkac redhat com> 32:9.9.2-3
+- drop PKCS11 support on rhel
+
+* Thu Oct 11 2012 Adam Tkac <atkac redhat com> 32:9.9.2-2
+- install isc/stat.h
+
+* Thu Oct 11 2012 Adam Tkac <atkac redhat com> 32:9.9.2-1
+- update to 9.9.2
+- bind97-rh714049.patch has been dropped
+- patches merged
+  - bind98-rh816164.patch
+
+* Thu Sep 13 2012 Adam Tkac <atkac redhat com> 32:9.9.1-10.P3
+- update to bind-9.9.1-P3
+
+* Wed Aug 22 2012 Tomas Hozza <thozza@redhat.com> 32:9.9.1-9.P2
+- fixed SPEC file so it comply with new systemd-rpm macros guidelines (#850045)
+- changed %%define macros to %%global and fixed several rpmlint warnings
+
+* Wed Aug 08 2012 Tomas Hozza <thozza@redhat.com> 32:9.9.1-8.P2
+- Changed PrivateTmp to "false" in *-chroot.service unit files (#825869)
+
+* Wed Aug 01 2012 Tomas Hozza <thozza@redhat.com> 32:9.9.1-7.P2
+- Fixed bind-devel multilib conflict (#478718)
+
+* Mon Jul 30 2012 Tomas Hozza <thozza@redhat.com> 32:9.9.1-6.P2
+- Fixed bad path to systemctl in /etc/NetworkManager/dispatcher.d/13-named (#844047)
+- Fixed path to libdb.so in config.dlz.in
+
+* Thu Jul 26 2012 Adam Tkac <atkac redhat com> 32:9.9.1-5.P2
+- update to 9.9.1-P2
+
+* Wed Jul 18 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 32:9.9.1-4.P1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
+
+* Wed Jul 11 2012 Ville Skyttä <ville.skytta@iki.fi> - 32:9.9.1-3.P1
+- Avoid shell invocation and dep for -libs-lite %%postun.
+
+* Mon Jun 04 2012 Adam Tkac <atkac redhat com> 32:9.9.1-2.P1
+- update to 9.9.1-P1 (CVE-2012-1667)
+
+* Thu May 24 2012 Adam Tkac <atkac redhat com> 32:9.9.1-1
+- update to 9.9.1
+- bind99-coverity.patch merged
+- bind-9.5-overflow.patch merged
+
+* Mon May 07 2012 Adam Tkac <atkac redhat com> 32:9.9.0-6
+- nslookup: return non-zero exit code when fail to get answer (#816164)
+
+* Thu Apr 26 2012 Adam Tkac <atkac redhat com> 32:9.9.0-5
+- initscript: don't umount /var/named when didn't mount it
+
+* Tue Apr 24 2012 Adam Tkac <atkac redhat com> 32:9.9.0-4
+- apply all non-SDB patches before SDB ones (#804475)
+- enable Berkeley DB DLZ backend (#804478)
+
+* Thu Apr 12 2012 Adam Tkac <atkac redhat com> 32:9.9.0-3
+- bind97-rh699951.patch is no longer needed (different fix is in 9.9.0)
+
+* Mon Mar 26 2012 Adam Tkac <atkac redhat com> 32:9.9.0-2
+- remove unneeded bind99-v6only.patch
+
+* Mon Mar 05 2012 Adam Tkac <atkac redhat com> 32:9.9.0-1
+- update to 9.9.0
+- load dynamic DBs later (and update dyndb patch)
+- fix memory leak in named during processing of rndc command
+- don't call `rndc-confgen -a` in "post" section
+- fix some packaging bugs in bind-chroot
+
+* Wed Feb 15 2012 Adam Tkac <atkac redhat com> 32:9.9.0-0.8.rc2
+- build with "--enable-fixed-rrset"
+
+* Wed Feb 01 2012 Adam Tkac <atkac redhat com> 32:9.9.0-0.7.rc2
+- update to 9.9.0rc2
+- doc/rfc and doc/draft are no longer shipped in tarball
+
+* Mon Jan 30 2012 Adam Tkac <atkac redhat com> 32:9.9.0-0.6.rc1
+- retire initscript in favour of systemd unit files (#719419)
+
+* Thu Jan 12 2012 Adam Tkac <atkac redhat com> 32:9.9.0-0.5.rc1
+- update to 9.9.0rc1
+
+* Wed Dec 07 2011 Adam Tkac <atkac redhat com> 32:9.9.0-0.4.b2
+- ship dns/forward.h in -devel subpkg
+
+* Tue Nov 22 2011 Adam Tkac <atkac redhat com> 32:9.9.0-0.3.b2
+- update to 9.9.0b2 (CVE-2011-4313)
+- patches merged
+  - bind97-rh700097.patch
+  - bind99-cinfo.patch
+
+* Mon Nov 14 2011 Adam Tkac <atkac redhat com> 32:9.9.0-0.2.b1
+- ship dns/clientinfo.h in bind-devel
+
+* Fri Nov 11 2011 Adam Tkac <atkac redhat com> 32:9.9.0-0.1.b1
+- update to 9.9.0b1
+- bind98-dlz_buildfix.patch merged
+
+* Fri Oct 28 2011 Adam Tkac <atkac redhat com> 32:9.8.1-4
+- nslookup failed to resolve name in certain cases
+
+* Mon Sep 26 2011 Adam Tkac <atkac redhat com> 32:9.8.1-3
+- remove deps filter, it is no longer needed (#739663)
+
+* Fri Sep 09 2011 Adam Tkac <atkac redhat com> 32:9.8.1-2
+- fix logrotate config file (#725256)
+
+* Wed Sep 07 2011 Adam Tkac <atkac redhat com> 32:9.8.1-1
+- update to 9.8.1
+- ship /etc/trusted-key.key (needed by dig)
+- use select instead of epoll in export libs (#735103)
+
+* Wed Aug 31 2011 Adam Tkac <atkac redhat com> 32:9.8.1-0.3.rc1
+- fix DLZ related compilation issues
+- make /etc/named.{root,iscdlv}.key world-readable
+- add bind-libs versioned requires to bind pkg
+
+* Wed Aug 31 2011 Adam Tkac <atkac redhat com> 32:9.8.1-0.2.rc1
+- fix rare race condition in request.c
+- print "the working directory is not writable" as debug message
+- re-add configtest target to initscript
+- initscript: sybsys name is always named, not named-sdb
+- nsupdate returned zero when target zone didn't exist (#700097)
+- nsupdate could have failed if server has multiple IPs and the first
+  was unreachable (#714049)
+
+* Wed Aug 31 2011 Adam Tkac <atkac redhat com> 32:9.8.1-0.1.rc1
+- update to 9.8.1rc1
+- patches merged
+  - bind97-rh674334.patch
+  - bind97-cleanup.patch
+  - bind98-includes.patch
+
+* Wed Aug 03 2011 Adam Tkac <atkac redhat com> 32:9.8.0-9.P4
+- improve patch for #725741
+
+* Tue Jul 26 2011 Adam Tkac <atkac redhat com> 32:9.8.0-8.P4
+- named could have crashed during reload when dyndb module is used (#725741)
+
+* Tue Jul 05 2011 Adam Tkac <atkac redhat com> 32:9.8.0-7.P4
+- update to 9.8.0-P4
+  - bind98-libdns-export.patch merged
+
+* Thu Jun 02 2011 Adam Tkac <atkac redhat com> 32:9.8.0-6.P2
+- update the dyndb patch
+
+* Fri May 27 2011 Adam Tkac <atkac redhat com> 32:9.8.0-5.P2
+- fix compilation of libdns-export.so
+
+* Fri May 27 2011 Adam Tkac <atkac redhat com> 32:9.8.0-4.P2
+- update to 9.8.0-P2 (CVE-2011-1910)
+
+* Fri May 06 2011 Adam Tkac <atkac redhat com> 32:9.8.0-3.P1
+- update to 9.8.0-P1 (CVE-2011-1907)
+
+* Wed Mar 23 2011 Dan Horák <dan@danny.cz> - 32:9.8.0-2
+- rebuilt for mysql 5.5.10 (soname bump in libmysqlclient)
+
+* Thu Mar 03 2011 Adam Tkac <atkac redhat com> 32:9.8.0-1
+- update to 9.8.0
+- bind97-rh665971.patch merged
+
+* Thu Mar 03 2011 Adam Tkac <atkac redhat com> 32:9.8.0-0.4.rc1
+- revert previous change (integration with libnmserver)
+
+* Tue Feb 22 2011 Adam Tkac <atkac redhat com> 32:9.8.0-0.3.rc1
+- integrate named with libnmserver library
+
+* Tue Feb 22 2011 Adam Tkac <atkac redhat com> 32:9.8.0-0.2.rc1
+- include dns/rpz.h in -devel subpkg
+
+* Mon Feb 21 2011 Adam Tkac <atkac redhat com> 32:9.8.0-0.1.rc1
+- update to 9.8.0rc1
+
+* Fri Feb 18 2011 Adam Tkac <atkac redhat com> 32:9.7.3-1
+- update to 9.7.3
+- fix dig +trace on dualstack systems (#674334)
+- fix linkage order when building on system with older BIND (#665971)
+- reduce number of gcc warnings
+
+* Mon Feb 07 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 32:9.7.3-0.6.rc1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
+
+* Tue Jan 25 2011 Adam Tkac <atkac redhat com> 32:9.7.3-0.5.rc1
+- update to 9.7.3rc1
+  - bind97-krb5-self.patch merged
+
+* Wed Jan 12 2011 Adam Tkac <atkac redhat com> 32:9.7.3-0.4.b1
+- fix typo in initscript
+
+* Thu Jan 06 2011 Adam Tkac <atkac redhat com> 32:9.7.3-0.3.b1
+- fix "service named status" when used with named-sdb
+- don't check MD5, size and mtime of sysconfig/named
+
+* Wed Jan 05 2011 Adam Tkac <atkac redhat com> 32:9.7.3-0.2.b1
+- add new option DISABLE_ZONE_CHECKING to sysconfig/named
+
+* Wed Jan 05 2011 Adam Tkac <atkac redhat com> 32:9.7.3-0.1.b1
+- update to 9.7.3b1
+
+* Wed Jan 05 2011 Adam Tkac <atkac redhat com> 32:9.7.2-10.P3
+- initscript should terminate only the correct "named" process (#622785)
+
+* Mon Dec 20 2010 Adam Tkac <atkac redhat com> 32:9.7.2-9.P3
+- fix "krb5-self" update-policy rule processing
+
+* Thu Dec 02 2010 Adam Tkac <atkac redhat com> 32:9.7.2-8.P3
+- update to 9.7.2-P3
+
+* Mon Nov 29 2010 Jan Görig <jgorig redhat com> 32:9.7.2-7.P2
+- added tmpfiles.d support (#656550)
+- removed old PID checking in initscript
+
+* Mon Nov 08 2010 Adam Tkac <atkac redhat com> 32:9.7.2-6.P2
+- don't emit various informational messages by default (#645544)
+
+* Wed Oct 20 2010 Adam Tkac <atkac redhat com> 32:9.7.2-5.P2
+- move BIND9 internal libs back to %%{_libdir}
+- add "-export" suffix to public libraries (-lite subpkg)
+
+* Thu Oct 07 2010 Adam Tkac <atkac redhat com> 32:9.7.2-4.P2
+- ship -devel subpkg for internal libs, dnsperf needs it
+
+* Thu Oct 07 2010 Adam Tkac <atkac redhat com> 32:9.7.2-3.P2
+- new bind-libs-lite and bind-lite-devel subpkgs which contain
+  public version of BIND 9 libraries
+- don't ship devel files for internal version of BIND 9 libraries
+
+* Wed Sep 29 2010 Adam Tkac <atkac redhat com> 32:9.7.2-2.P2
+- update to 9.7.2-P2
+
+* Thu Sep 16 2010 Adam Tkac <atkac redhat com> 32:9.7.2-1
+- update to 9.7.2
+
+* Fri Aug 27 2010 Adam Tkac <atkac redhat com> 32:9.7.2-0.3.rc1
+- update to 9.7.2rc1
+
+* Tue Aug 10 2010 Adam Tkac <atkac redhat com> 32:9.7.2-0.2.b1
+- host: handle "debug", "attempts" and "timeout" options in resolv.conf well
+
+* Tue Aug 03 2010 Adam Tkac <atkac redhat com> 32:9.7.2-0.1.b1
+- update to 9.7.2b1
+- patches merged
+  - bind97-rh507429.patch
+
+* Mon Jul 19 2010 Adam Tkac <atkac redhat com> 32:9.7.1-5.P2
+- supply root zone DNSKEY in default configuration
+
+* Mon Jul 19 2010 Adam Tkac <atkac redhat com> 32:9.7.1-4.P2
+- update to 9.7.1-P2 (CVE-2010-0213)
+
+* Mon Jul 12 2010 Adam Tkac <atkac redhat com> 32:9.7.1-3.P1
+- remove outdated Copyright.caching-nameserver file
+- remove rfc1912.txt, it is already located in %%doc/rfc directory
+- move COPYRIGHT to the bind-libs subpkg
+- add COPYRIGHT to the -pkcs11 subpkg
+
+* Fri Jul 09 2010 Adam Tkac <atkac redhat com> 32:9.7.1-2.P1
+- update to 9.7.1-P1
+
+* Mon Jun 28 2010 Adam Tkac <atkac redhat com> 32:9.7.1-1
+- update to 9.7.1
+- improve the "dnssec-conf" trigger
+
+* Wed Jun 09 2010 Adam Tkac <atkac redhat com> 32:9.7.1-0.2.rc1
+- update to 9.7.1rc1
+- patches merged
+  - bind97-keysdir.patch
+
+* Mon May 31 2010 Adam Tkac <atkac redhat com> 32:9.7.1-0.1.b1
+- update to 9.7.1b1
+- make /var/named/dynamic as a default directory for managed DNSSEC keys
+- add patch to get "managed-keys-directory" option working
+- patches merged
+  - bind97-managed-keyfile.patch
+  - bind97-rh554316.patch
+
+* Fri May 21 2010 Adam Tkac <atkac redhat com> 32:9.7.0-11.P2
+- update dnssec-conf Obsoletes/Provides
+
+* Thu May 20 2010 Adam Tkac <atkac redhat com> 32:9.7.0-10.P2
+- update to 9.7.0-P2
+
+* Fri Mar 26 2010 Adam Tkac <atkac redhat com> 32:9.7.0-9.P1
+- added lost patch for #554316 (occasional crash in keytable.c)
+
+* Fri Mar 26 2010 Adam Tkac <atkac redhat com> 32:9.7.0-8.P1
+- active query might be destroyed in resume_dslookup() which triggered REQUIRE
+  failure (#507429)
+
+* Mon Mar 22 2010 Adam Tkac <atkac redhat com> 32:9.7.0-7.P1
+- install SDB related manpages only when build with SDB
+
+* Fri Mar 19 2010 Adam Tkac <atkac redhat com> 32:9.7.0-6.P1
+- update to 9.7.0-P1
+
+* Tue Mar 16 2010 Jan Görig <jgorig redhat com> 32:9.7.0-5
+- bind-sdb now requires bind
+
+* Mon Mar 15 2010 Jan Görig <jgorig redhat com> 32:9.7.0-4
+- add man-pages ldap2zone.1 zonetodb.1 zone2sqlite.1 named-sdb.8 (#525655)
+
+* Mon Mar 01 2010 Adam Tkac <atkac redhat com> 32:9.7.0-3
+- fix multilib issue (#478718) [jgorig]
+
+* Mon Mar 01 2010 Adam Tkac <atkac redhat com> 32:9.7.0-2
+- improve automatic DNSSEC reconfiguration trigger
+- initscript now returns 2 in case that action doesn't exist (#523435)
+- enable/disable chroot when bind-chroot is installed/uninstalled
+
+* Wed Feb 17 2010 Adam Tkac <atkac redhat com> 32:9.7.0-1
+- update to 9.7.0 final
+
+* Mon Feb 15 2010 Adam Tkac <atkac redhat com> 32:9.7.0-0.14.rc2
+- obsolete dnssec-conf
+- automatically update configuration from old dnssec-conf based
+- improve default configuration; enable DLV by default
+- remove obsolete triggerpostun from bind-libs subpackage
+
+* Thu Jan 28 2010 Adam Tkac <atkac redhat com> 32:9.7.0-0.13.rc2
+- update to 9.7.0rc2
+
+* Wed Jan 27 2010 Adam Tkac <atkac redhat com> 32:9.7.0-0.12.rc1
+- initscript LSB related fixes (#523435)
+
+* Wed Jan 27 2010 Adam Tkac <atkac redhat com> 32:9.7.0-0.11.rc1
+- revert the "DEBUG" feature (#510283), it causes too many problems (#545128)
+
+* Tue Dec 15 2009 Adam Tkac <atkac redhat com> 32:9.7.0-0.10.rc1
+- update to 9.7.0rc1
+- bind97-headers.patch merged
+- update default configuration
+
+* Tue Dec 01 2009 Adam Tkac <atkac redhat com> 32:9.7.0-0.9.b3
+- update to 9.7.0b3
+
+* Thu Nov 26 2009 Adam Tkac <atkac redhat com> 32:9.7.0-0.8.b2
+- install isc/namespace.h header
+
+* Fri Nov 06 2009 Adam Tkac <atkac redhat com> 32:9.7.0-0.7.b2
+- update to 9.7.0b2
+
+* Tue Nov 03 2009 Adam Tkac <atkac redhat com> 32:9.7.0-0.6.b1
+- update to 9.7.0b1
+- add bind-pkcs11 subpackage to support PKCS11 compatible keystores for DNSSEC
+  keys
+
+* Thu Oct 08 2009 Adam Tkac <atkac redhat com> 32:9.7.0-0.5.a3
+- don't package named-bootconf utility, it is very outdated and unneeded
+
+* Mon Sep 21 2009 Adam Tkac <atkac redhat com> 32:9.7.0-0.4.a3
+- determine file size via `stat` instead of `ls` (#523682)
+
+* Wed Sep 16 2009 Adam Tkac <atkac redhat com> 32:9.7.0-0.3.a3
+- update to 9.7.0a3
+
+* Tue Sep 15 2009 Adam Tkac <atkac redhat com> 32:9.7.0-0.2.a2
+- improve chroot related documentation (#507795)
+- add NetworkManager dispatcher script to reload named when network interface is
+  activated/deactivated (#490275)
+- don't set/unset named_write_master_zones SELinux boolean every time in
+  initscript, modify it only when it's actually needed
+
+* Tue Sep 15 2009 Adam Tkac <atkac redhat com> 32:9.7.0-0.1.a2
+- update to 9.7.0a2
+- merged patches
+  - bind-96-db_unregister.patch
+  - bind96-rh507469.patch
+
+* Tue Sep 01 2009 Adam Tkac <atkac redhat com> 32:9.6.1-9.P1
+- next attempt to fix the postun trigger (#520385)
+- remove obsolete bind-9.3.1rc1-fix_libbind_includedir.patch
+
+* Fri Aug 21 2009 Tomas Mraz <tmraz@redhat.com> - 32:9.6.1-8.P1
+- rebuilt with new openssl
+
+* Tue Aug 04 2009 Martin Nagy <mnagy redhat com> 32:9.6.1-7.P1
+- update the patch for dynamic loading of database backends
+
+* Wed Jul 29 2009 Adam Tkac <atkac redhat com> 32:9.6.1-6.P1
+- 9.6.1-P1 release (CVE-2009-0696)
+- fix postun trigger (#513016, hopefully)
+
+* Fri Jul 24 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 32:9.6.1-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
+
+* Mon Jul 20 2009 Adam Tkac <atkac redhat com> 32:9.6.1-4
+- remove useless bind-9.3.3rc2-rndckey.patch
+
+* Mon Jul 13 2009 Adam Tkac <atkac redhat com> 32:9.6.1-3
+- fix broken symlinks in bind-libs (#509635)
+- fix typos in /etc/sysconfig/named (#509650)
+- add DEBUG option to /etc/sysconfig/named (#510283)
+
+* Wed Jun 24 2009 Adam Tkac <atkac redhat com> 32:9.6.1-2
+- improved "chroot automount" patches (#504596)
+- host should fail if specified server doesn't respond (#507469)
+
+* Wed Jun 17 2009 Adam Tkac <atkac redhat com> 32:9.6.1-1
+- 9.6.1 release
+- simplify chroot maintenance. Important files and directories are mounted into
+  chroot (see /etc/sysconfig/named for more info, #504596)
+- fix doc/named.conf.default perms
+
+* Wed May 27 2009 Adam Tkac <atkac redhat com> 32:9.6.1-0.4.rc1
+- 9.6.1rc1 release
+
+* Wed Apr 29 2009 Martin Nagy <mnagy redhat com> 32:9.6.1-0.3.b1
+- update the patch for dynamic loading of database backends
+- create %%{_libdir}/bind directory
+- copy default named.conf to doc directory, shared with s-c-bind (atkac)
+
+* Fri Apr 24 2009 Martin Nagy <mnagy redhat com> 32:9.6.1-0.2.b1
+- update the patch for dynamic loading of database backends
+- fix dns_db_unregister()
+- useradd now takes "-N" instead of "-n" (atkac, #495726)
+- print nicer error msg when zone file is actually a directory (atkac, #490837)
+
+* Mon Mar 30 2009 Adam Tkac <atkac redhat com> 32:9.6.1-0.1.b1
+- 9.6.1b1 release
+- patches merged
+  - bind-96-isc_header.patch
+  - bind-95-rh469440.patch
+  - bind-96-realloc.patch
+  - bind9-fedora-0001.diff
+- use -version-number instead of -version-info libtool param
+
+* Mon Mar 23 2009 Adam Tkac <atkac redhat com> 32:9.6.0-11.1.P1
+- logrotate configuration file now points to /var/named/data/named.run by
+  default (#489986)
+
+* Tue Mar 17 2009 Adam Tkac <atkac redhat com> 32:9.6.0-11.P1
+- fall back to insecure mode when no supported DNSSEC algorithm is found
+  instead of SERVFAIL
+- don't fall back to non-EDNS0 queries when DO bit is set
+
+* Tue Mar 10 2009 Adam Tkac <atkac redhat com> 32:9.6.0-10.P1
+- enable DNSSEC only if it is enabled in sysconfig/dnssec
+
+* Mon Mar 09 2009 Adam Tkac <atkac redhat com> 32:9.6.0-9.P1
+- add DNSSEC support to initscript, enabled it per default
+- add requires dnssec-conf
+
+* Mon Mar 09 2009 Adam Tkac <atkac redhat com> 32:9.6.0-8.P1
+- fire away libbind, it is now separate package
+
+* Wed Mar 04 2009 Adam Tkac <atkac redhat com> 32:9.6.0-7.P1
+- fixed some read buffer overflows (upstream)
+
+* Mon Feb 23 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> 32:9.6.0-6.P1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
+
+* Thu Feb 12 2009 Martin Nagy <mnagy redhat com> 32:9.6.0-5.P1
+- update the patch for dynamic loading of database backends
+- include iterated_hash.h
+
+* Sat Jan 24 2009 Caolán McNamara <caolanm@redhat.com> 32:9.6.0-4.P1
+- rebuild for dependencies
+
+* Wed Jan 21 2009 Adam Tkac <atkac redhat com> 32:9.6.0-3.P1
+- rebuild against new openssl
+
+* Thu Jan 08 2009 Adam Tkac <atkac redhat com> 32:9.6.0-2.P1
+- 9.6.0-P1 release (CVE-2009-0025)
+
+* Mon Jan 05 2009 Adam Tkac <atkac redhat com> 32:9.6.0-1
+- Happy new year
+- 9.6.0 release
+
+* Thu Dec 18 2008 Adam Tkac <atkac redhat com> 32:9.6.0-0.7.rc2
+- 9.6.0rc2 release
+- bind-96-rh475120.patch merged
+
+* Tue Dec 16 2008 Martin Nagy <mnagy redhat com> 32:9.6.0-0.6.rc1
+- add patch for dynamic loading of database backends
+
+* Tue Dec 09 2008 Adam Tkac <atkac redhat com> 32:9.6.0-0.5.1.rc1
+- allow to reuse address for non-random query-source ports (#475120)
+
+* Wed Dec 03 2008 Adam Tkac <atkac redhat com> 32:9.6.0-0.5.rc1
+- 9.6.0rc1 release
+- patches merged
+  - bind-9.2.0rc3-varrun.patch
+  - bind-95-sdlz-include.patch
+  - bind-96-libxml2.patch
+- fixed rare use-after-free problem in host utility (#452060)
+- enabled chase of DNSSEC signature chains in dig
+
+* Mon Dec 01 2008 Adam Tkac <atkac redhat com> 32:9.6.0-0.4.1.b1
+- improved sample config file (#473586)
+
+* Wed Nov 26 2008 Adam Tkac <atkac redhat com> 32:9.6.0-0.4.b1
+- reverted previous change, koji doesn't like it
+
+* Wed Nov 26 2008 Adam Tkac <atkac redhat com> 32:9.6.0-0.3.b1
+- build bind-chroot as noarch
+
+* Mon Nov 24 2008 Adam Tkac <atkac redhat com> 32:9.6.0-0.2.1.b1
+- updates due libtool 2.2.6
+- don't pass -DLDAP_DEPRECATED to cpp, handle it directly in sources
+
+* Tue Nov 11 2008 Adam Tkac <atkac redhat com> 32:9.6.0-0.2.b1
+- make statistics http server working, patch backported from 9.6 HEAD
+
+* Mon Nov 10 2008 Adam Tkac <atkac redhat com> 32:9.6.0-0.1.b1
+- 9.6.0b1 release
+- don't build ODBC and Berkeley DB DLZ drivers
+- end of bind-chroot-admin script, copy config files to chroot manually
+- /proc doesn't have to be mounted to chroot
+- temporary use libbind from 9.5 series, noone has been released for 9.6 yet
+
+* Mon Nov 03 2008 Adam Tkac <atkac redhat com> 32:9.5.1-0.8.4.b2
+- dig/host: use only IPv4 addresses when -4 option is specified (#469440)
+
+* Thu Oct 30 2008 Adam Tkac <atkac redhat com> 32:9.5.1-0.8.2.b2
+- removed unneeded bind-9.4.1-ldap-api.patch
+
+* Thu Oct 30 2008 Adam Tkac <atkac redhat com> 32:9.5.1-0.8.1.b2
+- ship dns/{s,}dlz.h and isc/radix.h in bind-devel
+
+* Tue Oct 07 2008 Adam Tkac <atkac redhat com> 32:9.5.1-0.8.b2
+- removed bind-9.4.0-dnssec-directory.patch, it is wrong
+
+* Wed Sep 24 2008 Adam Tkac <atkac redhat com> 32:9.5.1-0.7.b2
+- 9.5.1b2 release
+- patches merged
+  - bind95-rh454783.patch
+  - bind-9.5-edns.patch
+  - bind95-rh450995.patch
+  - bind95-rh457175.patch
+
+* Wed Sep 17 2008 Adam Tkac <atkac redhat com> 32:9.5.1-0.6.b1
+- IDN output strings didn't honour locale settings (#461409)
+
+* Tue Aug 05 2008 Adam Tkac <atkac redhat com> 32:9.5.1-0.5.b1
+- disable transfer stats on DLZ zones (#454783)
+
+* Mon Aug 04 2008 Adam Tkac <atkac redhat com> 32:9.5.1-0.4.b1
+- add forgotten patch for #457175
+- build with -O2
+
+* Thu Jul 31 2008 Adam Tkac <atkac redhat com> 32:9.5.1-0.3.b1
+- static libraries are no longer supported
+- IP acls weren't merged correctly (#457175)
+- use fPIE on sparcv9/sparc64 (Dennis Gilmore)
+- add sparc64 to list of 64bit arches in spec (Dennis Gilmore)
+
+* Mon Jul 21 2008 Adam Tkac <atkac redhat com> 32:9.5.1-0.2.b1
+- updated patches due new rpm (--fuzz=0 patch parameter)
+
+* Mon Jul 14 2008 Adam Tkac <atkac redhat com> 32:9.5.1-0.1.1.b1
+- use %%patch0 for Patch0 (#455061)
+- correct source address (#455118)
+
+* Tue Jul 08 2008 Adam Tkac <atkac redhat com> 32:9.5.1-0.1.b1
+- 9.5.1b1 release (CVE-2008-1447)
+- dropped bind-9.5-recv-race.patch because upstream doesn't want it
+
+* Mon Jun 30 2008 Adam Tkac <atkac redhat com> 32:9.5.0-37.1
+- update default named.conf statements (#452708)
+
+* Thu Jun 26 2008 Adam Tkac <atkac redhat com> 32:9.5.0-37
+- some compat changes to fix building on RHEL4
+
+* Mon Jun 23 2008 Adam Tkac <atkac redhat com> 32:9.5.0-36.3
+- fixed typo in %%posttrans script
+
+* Wed Jun 18 2008 Adam Tkac <atkac redhat com> 32:9.5.0-36.2
+- parse inner acls correctly (#450995)
+
+* Mon Jun 02 2008 Adam Tkac <atkac redhat com> 32:9.5.0-36.1
+- removed dns-keygen utility in favour of rndc-confgen -a (#449287)
+- some minor sample fixes (#449274)
+
+* Thu May 29 2008 Adam Tkac <atkac redhat com> 32:9.5.0-36
+- updated to 9.5.0 final
+- use getifaddrs to find available interfaces
+
+* Mon May 26 2008 Adam Tkac <atkac redhat com> 32:9.5.0-35.rc1
+- make /var/run/named writable by named (#448277)
+- fixed one non-utf8 file
+
+* Thu May 22 2008 Adam Tkac <atkac redhat com> 32:9.5.0-34.rc1
+- fixes needed to pass package review (#225614)
+
+* Wed May 21 2008 Adam Tkac <atkac redhat com> 32:9.5.0-33.1.rc1
+- bind-chroot now depends on bind (#446477)
+
+* Wed May 14 2008 Adam Tkac <atkac redhat com> 32:9.5.0-33.rc1
+- updated to 9.5.0rc1
+- merged patches
+  - bind-9.5-libcap.patch
+- make binaries readable by others (#427826)
+
+* Tue May 13 2008 Adam Tkac <atkac redhat com> 32:9.5.0-32.b3
+- reverted "any" patch, upstream says not needed
+- log EDNS failure only when we really switch to plain EDNS (#275091)
+- detect configuration file better
+
+* Tue May 06 2008 Adam Tkac <atkac redhat com> 32:9.5.0-31.1.b3
+- addresses 0.0.0.0 and ::0 really match any (#275091, comment #28)
+
+* Mon May 05 2008 Adam Tkac <atkac redhat com> 32:9.5.0-31.b3
+- readded bind-9.5-libcap.patch
+- added bind-9.5-recv-race.patch from F8 branch (#400461)
+
+* Wed Apr 23 2008 Adam Tkac <atkac redhat com> 32:9.5.0-30.1.b3
+- build Berkeley DB DLZ backend
+
+* Mon Apr 21 2008 Adam Tkac <atkac redhat com> 32:9.5.0-30.b3
+- 9.5.0b3 release
+- dropped patches (upstream)
+  - bind-9.5-transfer-segv.patch
+  - bind-9.5-mudflap.patch
+  - bind-9.5.0-generate-xml.patch
+  - bind-9.5-libcap.patch
+
+* Wed Apr 02 2008 Adam Tkac <atkac redhat com> 32:9.5.0-29.3.b2
+- fixed named.conf.sample file (#437569)
+
+* Fri Mar 14 2008 Adam Tkac <atkac redhat com> 32:9.5.0-29.2.b2
+- fixed URLs
+
+* Mon Feb 25 2008 Adam Tkac <atkac redhat com> 32:9.5.0-29.1.b2
+- BuildRequires cleanup
+
+* Sun Feb 24 2008 Adam Tkac <atkac redhat com> 32:9.5.0-29.b2
+- rebuild without mudflap (#434159)
+
+* Wed Feb 20 2008 Adam Tkac <atkac redhat com> 32:9.5.0-28.b2
+- port named to use libcap library, enable threads (#433102)
+- removed some unneeded Requires
+
+* Tue Feb 19 2008 Adam Tkac <atkac redhat com> 32:9.5.0-27.b2
+- removed conditional build with libefence (use -fmudflapth instead)
+- fixed building of DLZ stuff (#432497)
+- do not build Berkeley DB DLZ backend
+- temporary build with --disable-linux-caps and without threads (#433102)
+- update named.ca file to affect IPv6 changes in root zone
+
+* Mon Feb 11 2008 Adam Tkac <atkac redhat com> 32:9.5.0-26.b2
+- build with -D_GNU_SOURCE (#431734)
+- improved fix for #253537, posttrans script is now used
+- improved fix for #400461
+- 9.5.0b2
+  - bind-9.3.2b1-PIE.patch replaced by bind-9.5-PIE.patch
+    - only named, named-sdb and lwresd are PIE
+  - bind-9.5-sdb.patch has been updated
+  - bind-9.5-libidn.patch has been updated
+  - bind-9.4.0-sdb-sqlite-bld.patch replaced by bind-9.5-sdb-sqlite-bld.patch
+  - removed bind-9.5-gssapi-header.patch (upstream)
+  - removed bind-9.5-CVE-2008-0122.patch (upstream)
+- removed bind-9.2.2-nsl.patch
+- improved sdb_tools Makefile.in
+
+* Mon Feb 04 2008 Adam Tkac <atkac redhat com> 32:9.5.0-25.b1
+- fixed segfault during sending notifies (#400461)
+- rebuild with gcc 4.3 series
+
+* Tue Jan 22 2008 Adam Tkac <atkac redhat com> 32:9.5.0-24.b1
+- removed bind-9.3.2-prctl_set_dumpable.patch (upstream)
+- allow parallel building of libdns library
+- CVE-2008-0122
+
+* Thu Dec 27 2007 Adam Tkac <atkac redhat com> 32:9.5.0-23.b1
+- fixed initscript wait loop (#426382)
+- removed dependency on policycoreutils and libselinux (#426515)
+
+* Thu Dec 20 2007 Adam Tkac <atkac redhat com> 32:9.5.0-22.b1
+- fixed regression caused by libidn2 patch (#426348)
+
+* Wed Dec 19 2007 Adam Tkac <atkac redhat com> 32:9.5.0-21.b1
+- fixed typo in post section (CVE-2007-6283)
+
+* Wed Dec 19 2007 Adam Tkac <atkac redhat com> 32:9.5.0-20.b1
+- removed obsoleted triggers
+- CVE-2007-6283
+
+* Wed Dec 12 2007 Adam Tkac <atkac redhat com> 32:9.5.0-19.2.b1
+- added dst/gssapi.h to -devel subpackage (#419091)
+- improved fix for (#417431)
+
+* Mon Dec 10 2007 Adam Tkac <atkac redhat com> 32:9.5.0-19.1.b1
+- fixed shutdown with initscript when rndc doesn't work (#417431)
+- fixed IDN patch (#412241)
+
+* Thu Dec 06 2007 Adam Tkac <atkac redhat com> 32:9.5.0-19.b1
+- 9.5.0b1 (#405281, #392491)
+
+* Thu Dec 06 2007 Release Engineering <rel-eng at fedoraproject dot org> 32:9.5.0-18.6.a7
+- Rebuild for deps
+
+* Wed Dec 05 2007 Adam Tkac <atkac redhat com> 32:9.5.0-18.5.a7
+- build with -O0
+
+* Mon Dec 03 2007 Adam Tkac <atkac redhat com> 32:9.5.0-18.4.a7
+- bind-9.5-random_ports.patch was removed because upstream doesn't
+  like it. query-source{,v6} options are sufficient (#391931)
+- bind-chroot-admin called restorecon on /proc filesystem (#405281)
+
+* Mon Nov 26 2007 Adam Tkac <atkac redhat com> 32:9.5.0-18.3.a7
+- removed edns patch to keep compatibility with vanilla bind
+  (#275091, comment #20)
+
+* Wed Nov 21 2007 Adam Tkac <atkac redhat com> 32:9.5.0-18.2.a7
+- use system port selector instead ISC's (#391931)
+
+* Mon Nov 19 2007 Adam Tkac <atkac redhat com> 32:9.5.0-18.a7
+- removed statement from initscript which passes -D to named
+
+* Thu Nov 15 2007 Adam Tkac <atkac redhat com> 32:9.5.0-17.a7
+- 9.5.0a7
+- dropped patches (upstream)
+  - bind-9.5-update.patch
+  - bind-9.5-pool_badfree.patch
+  - bind-9.5-_res_errno.patch
+
+* Thu Nov 15 2007 Adam Tkac <atkac redhat com> 32:9.5.0-16.5.a6
+- added bind-sdb again, contains SDB modules and DLZ modules
+- bind-9.3.1rc1-sdb.patch replaced by bind-9.5-sdb.patch
+
+* Mon Nov 12 2007 Adam Tkac <atkac redhat com> 32:9.5.0-16.4.a6
+- removed Requires: openldap, postgresql, mysql, db4, unixODBC
+- new L.ROOT-SERVERS.NET address
+
+* Mon Oct 29 2007 Adam Tkac <atkac redhat com> 32:9.5.0-16.3.a6
+- completely disable DBUS
+
+* Fri Oct 26 2007 Adam Tkac <atkac redhat com> 32:9.5.0-16.2.a6
+- minor cleanup in bind-chroot-admin
+
+* Thu Oct 25 2007 Adam Tkac <atkac redhat com> 32:9.5.0-16.1.a6
+- fixed typo in initscript
+
+* Tue Oct 23 2007 Adam Tkac <atkac redhat com> 32:9.5.0-16.a6
+- disabled DBUS (dhcdbd doesn't exist & #339191)
+
+* Thu Oct 18 2007 Adam Tkac <atkac redhat com> 32:9.5.0-15.1.a6
+- fixed missing va_end () functions (#336601)
+- fixed memory leak when dbus initialization fails
+
+* Tue Oct 16 2007 Adam Tkac <atkac redhat com> 32:9.5.0-15.a6
+- corrected named.5 SDB statement (#326051)
+
+* Mon Sep 24 2007 Adam Tkac <atkac redhat com> 32:9.5.0-14.a6
+- added edns patch again (#275091)
+
+* Mon Sep 24 2007 Adam Tkac <atkac redhat com> 32:9.5.0-13.a6
+- removed bind-9.3.3-edns.patch patch (see #275091 for reasons)
+
+* Thu Sep 20 2007 Adam Tkac <atkac redhat com> 32:9.5.0-12.4.a6
+- build with O2
+- removed "autotools" patch
+- bugfixing in bind-chroot-admin (#279901)
+
+* Thu Sep 06 2007 Adam Tkac <atkac redhat com> 32:9.5.0-12.a6
+- bind-9.5-2119_revert.patch and bind-9.5-fix_h_errno.patch are
+  obsoleted by upstream bind-9.5-_res_errno.patch
+
+* Wed Sep 05 2007 Adam Tkac <atkac redhat com> 32:9.5.0-11.9.a6
+- fixed wrong resolver's dispatch pool cleanup (#275011, patch from
+  tmraz redhat com)
+
+* Wed Sep 05 2007 Adam Tkac <atkac redhat com> 32:9.5.0-11.3.a6
+- initscript failure message is now printed correctly (#277981,
+  Quentin Armitage (quentin armitage org uk) )
+
+* Mon Sep 03 2007 Adam Tkac <atkac redhat com> 32:9.5.0-11.2.a6
+- temporary revert ISC 2119 change and add "libbind-errno" patch
+  (#254501) again
+
+* Thu Aug 23 2007 Adam Tkac <atkac redhat com> 32:9.5.0-11.1.a6
+- removed end dots from Summary sections (skasal@redhat.com)
+- fixed wrong file creation by autotools patch (skasal@redhat.com)
+
+* Thu Aug 23 2007 Adam Tkac <atkac redhat com> 32:9.5.0-11.a6
+- start using --disable-isc-spnego configure option
+  - remove bind-9.5-spnego-memory_management.patch (source isn't
+    compiled)
+
+* Wed Aug 22 2007 Adam Tkac <atkac redhat com> 32:9.5.0-10.2.a6
+- added new initscript option KEYTAB_FILE which specified where
+  is located kerberos .keytab file for named service
+- obsolete temporary bind-9.5-spnego-memory_management.patch by
+  bind-9.5-gssapictx-free.patch which conforms BIND coding standards
+  (#251853)
+
+* Tue Aug 21 2007 Adam Tkac <atkac redhat com> 32:9.5.0-10.a6
+- dropped direct dependency to /etc/openldap/schema directory
+- changed hardcoded paths to macros
+- fired away code which configure LDAP server
+
+* Tue Aug 14 2007 Adam Tkac <atkac redhat com> 32:9.5.0-9.1.a6
+- named could crash with SRV record UPDATE (#251336)
+
+* Mon Aug 13 2007 Adam Tkac <atkac redhat com> 32:9.5.0-9.a6
+- disable 64bit dlz driver patch on alpha and ia64 (#251298)
+- remove wrong malloc functions from lib/dns/spnego.c (#251853)
+
+* Mon Aug 06 2007 Adam Tkac <atkac redhat com> 32:9.5.0-8.2.a6
+- changed licence from BSD-like to ISC
+
+* Tue Jul 31 2007 Adam Tkac <atkac redhat com> 32:9.5.0-8.1.a6
+- disabled named on all runlevels by default
+
+* Mon Jul 30 2007 Adam Tkac <atkac redhat com> 32:9.5.0-8.a6
+- minor next improvements on autotools patch
+- dig and host utilities now using libidn instead idnkit for
+  IDN support
+
+* Wed Jul 25 2007 Warren Togami <wtogami@redhat.com> 32:9.5.0-7.a6
+- binutils/gcc bug rebuild (#249435)
+
+* Tue Jul 24 2007 Adam Tkac <atkac redhat com> 32:9.5.0-6.a6
+- updated to 9.5.0a6 which contains fixes for CVE-2007-2925 and
+  CVE-2007-2926
+- fixed building on 64bits
+
+* Mon Jul 23 2007 Adam Tkac <atkac redhat com> 31:9.5.0a5-5
+- integrated "autotools" patch for testing purposes (upstream will
+  accept it in future, for easier building)
+
+* Mon Jul 23 2007 Adam Tkac <atkac redhat com> 31:9.5.0a5-4.1
+- fixed DLZ drivers building on 64bit systems
+
+* Fri Jul 20 2007 Adam Tkac <atkac redhat com> 31:9.5.0a5-4
+- fixed relation between logrotated and chroot-ed named
+
+* Wed Jul 18 2007 Adam Tkac <atkac redhat com> 31:9.5.0a5-3.9
+- removed bind-sdb package (default named has compiled SDB backend now)
+- integrated DLZ (Dynamically loadable zones) drivers
+- integrated GSS-TSIG support (RFC 3645)
+- build with -O0 (many new features, potential core dumps will be more useful)
+
+* Tue Jul 17 2007 Adam Tkac <atkac redhat com> 31:9.5.0a5-3.2
+- initscript should be ready for parallel booting (#246878)
+
+* Tue Jul 17 2007 Adam Tkac <atkac redhat com> 31:9.5.0a5-3
+- handle integer overflow in isc_time_secondsastimet function gracefully (#247856)
+
+* Mon Jul 16 2007 Adam Tkac <atkac redhat com> 31:9.5.0a5-2.2
+- moved chroot configfiles into chroot subpackage (#248306)
+
+* Mon Jul 02 2007 Adam Tkac <atkac redhat com> 31:9.5.0a5-2
+- minor changes in default configuration
+- fix h_errno assigment during resolver initialization (unbounded recursion, #245857)
+- removed wrong patch to #150288
+
+* Tue Jun 19 2007 Adam Tkac <atkac redhat com> 31:9.5.0a5-1
+- updated to latest upstream
+
+* Wed Jun 13 2007 Adam Tkac <atkac redhat com> 31:9.4.1-7
+- marked caching-nameserver as obsolete (#244604)
+- fixed typo in initscript (causes that named doesn't detect NetworkManager
+  correctly)
+- next cleanup in configuration - moved configfiles into config.tar
+- removed delay between start & stop in restart function in named.init
+
+* Tue Jun 12 2007 Adam Tkac <atkac redhat com> 31:9.4.1-6
+- major changes in initscript. Could be LSB compatible now
+- removed caching-nameserver subpackage. Move configs from this
+  package to main bind package as default configuration and major
+  configuration cleanup
+
+* Mon Jun 04 2007 Adam Tkac <atkac redhat com> 31:9.4.1-5
+- very minor compatibility change in bind-chroot-admin (line 215)
+- enabled IDN support by default and don't distribute IDN libraries
+- specfile cleanup
+- add dynamic directory to /var/named. This directory will be primarily used for
+  dynamic DNS zones. ENABLE_ZONE_WRITE and SELinux's named_write_master_zones no longer exist
+
+* Thu May 24 2007 Adam Tkac <atkac redhat com> 31:9.4.1-4
+- removed ldap-api patch and start using deprecated API
+- fixed minor problem in bind-chroot-admin script (#241103)
+
+* Tue May 22 2007 Adam Tkac <atkac redhat com> 31:9.4.1-3
+- fixed bind-chroot-admin dynamic DNS handling (#239149)
+- updated zone-freeze patch to latest upstream
+- ldap sdb has been rewriten to latest api (#239802)
+
+* Mon May 07 2007 Adam Tkac <atkac redhat com> 31:9.4.1-2.fc7
+- test build on new build system
+
+* Wed May 02 2007 Adam Tkac <atkac redhat com> 31:9.4.1-1.fc7
+- updated to 9.4.1 which contains fix to CVE-2007-2241
+
+* Fri Apr 27 2007 Adam Tkac <atkac redhat com> 31:9.4.0-8.fc7
+- improved "zone freeze patch" - if multiple zone with same name exists
+  no zone is freezed
+- minor cleanup in caching-nameserver's config file
+- fixed race-condition in dbus code (#235809)
+- added forgotten restorecon statement in bind-chroot-admin
+
+* Tue Apr 17 2007 Adam Tkac <atkac redhat com> 31:9.4.0-7.fc7
+- removed DEBUGINFO option because with this option (default) was bind
+  builded with -O0 and without this flag no debuginfo package was produced.
+  (I want faster bind => -O2 + debuginfo)
+- fixed zone finding (#236426)
+
+* Mon Apr 16 2007 Adam Tkac <atkac redhat com> 31:9.4.0-6.fc7
+- added idn support (still under development with upstream, disabled by default)
+
+* Wed Apr 11 2007 Adam Tkac <atkac redhat com> 31:9.4.0-5.fc7
+- dnssec-signzone utility now doesn't ignore -d parameter
+
+* Tue Apr 10 2007 Adam Tkac <atkac redhat com> 31:9.4.0-4.fc7
+- removed query-source[-v6] options from caching-nameserver config
+  (#209954, increase security)
+- throw away idn. It won't be ready in fc7
+
+* Tue Mar 13 2007 Adam Tkac <atkac redhat com> 31:9.4.0-3.fc7
+- prepared bind to merge review
+- added experimental idn support to bind-utils utils (not enabled by default yet)
+- change chroot policy in caching-nameserver post section
+- fixed bug in bind-chroot-admin - rootdir function is called properly now
+
+* Mon Mar 12 2007 Adam Tkac <atkac redhat com> 31:9.4.0-2.fc7
+- added experimental SQLite support (written by John Boyd <jaboydjr@netwalk.com>)
+- moved bind-chroot-admin script to chroot package
+- bind-9.3.2-redhat_doc.patch is always applied (#231738)
+
+* Tue Mar 06 2007 Adam Tkac <atkac@redhat.com> 31:9.4.0-1.fc7
+- updated to 9.4.0
+- bind-chroot-admin now sets EAs correctly (#213926)
+- throw away next_server_on_referral and no_servfail_stops patches (fixed in 9.4.0)
+
+* Thu Feb 15 2007 Adam Tkac <atkac@redhat.com> 31:9.3.4-7.fc7
+- minor cleanup in bind-chroot-admin script
+
+* Fri Feb 09 2007 Adam Tkac <atkac@redhat.com> 31:9.3.4-6.fc7
+- fixed broken bind-chroot-admin script (#227995)
+
+* Wed Feb 07 2007 Adam Tkac <atkac@redhat.com> 31:9.3.4-5.fc7
+- bind-chroot-admin now uses correct chroot path (#227600)
+
+* Mon Feb 05 2007 Adam Tkac <atkac@redhat.com> 31:9.3.4-4.fc7
+- fixed conflict between bind-sdb and ldap
+- removed duplicated bind directory in bind-libs
+
+* Thu Feb 01 2007 Adam Tkac <atkac@redhat.com> 31:9.3.4-3.fc7
+- fixed building without libbind
+- fixed post section (selinux commands is now in if-endif statement)
+- prever macro has been removed from version
+
+* Mon Jan 29 2007 Adam Tkac <atkac@redhat.com> 31:9.3.4-2.fc7
+- redirected output from bind-chroot prep and %%preun stages to /dev/null
+
+* Thu Jan 25 2007 Adam Tkac <atkac@redhat.com> 31:9.3.4-1.fc7
+- updated to version 9.3.4 which contains security bugfixes
+
+* Tue Jan 23 2007 Adam Tkac <atkac@redhat.com> 31:9.3.3-5.fc7
+- package bind-libbind-devel has been marked as obsolete
+
+* Mon Jan 22 2007 Adam Tkac <atkac@redhat.com> 31:9.3.3-4.fc7
+- package bind-libbind-devel has beed removed (libs has been moved to bind-devel & bind-libs)
+- Resolves: #214208
+
+* Tue Jan 16 2007 Martin Stransky <stransky@redhat.com> - 31:9.3.3-3
+- fixed a multi-lib issue
+- Resolves: rhbz#222717
+
+* Thu Jan 4 2007 Martin Stransky <stransky@redhat.com> - 31:9.3.3-2
+- added namedGetForwarders written in shell (#176100),
+  created by Baris Cicek <baris@nerd.com.tr>.
+
+* Sun Dec 10 2006 Martin Stransky <stransky@redhat.com> - 31:9.3.3-1
+- update to 9.3.3 final
+- fix for #219069: file included twice in src.rpm
+
+* Wed Dec 6 2006 Martin Stransky <stransky@redhat.com> - 31:9.3.3-0.1.rc3
+- added back an interval to restart
+- renamed package, it should meet the N-V-R criteria
+- fix for #216185: bind-chroot-admin able to change root mode 750
+- added fix from #215997: incorrect permissions on dnszone.schema
+- added a notice to init script when /etc/named.conf doesn't exist (#216075)
+
+* Mon Oct 30 2006 Martin Stransky <stransky@redhat.com> - 30:9.3.3-6
+- fix for #200465: named-checkzone and co. cannot be run as non-root user
+- fix for #212348: chroot'd named causes df permission denied error
+- fix for #211249, #211083 - problems with stopping named
+- fix for #212549: init script does not unmount /proc filesystem
+- fix for #211282: EDNS is globally enabled, crashing CheckPoint FW-1,
+    added edns-enable options to named configuration file which can suppress
+    EDNS in queries to DNS servers (see /usr/share/doc/bind-9.3.3/misc/options)
+- fix for #212961: bind-chroot doesn't clean up its mess on %%preun
+- update to 9.3.3rc3, removed already merged patches
+
+* Fri Oct 13 2006 Martin Stransky <stransky@redhat.com> - 30:9.3.3-5
+- fix for #209359: bind-libs from compatlayer CD will not
+  install on ia64
+
+* Tue Oct 10 2006 Martin Stransky <stransky@redhat.com> - 30:9.3.3-4
+- added fix for #210096: warning: group named does not exist - using root
+
+* Thu Oct  5 2006 Martin Stransky <stransky@redhat.com> - 30:9.3.3-3
+- added fix from #209400 - Bind Init Script does not create
+  the PID file always, created by Jeff Means
+- added timeout to stop section of init script.
+  The default is 100 sec. and can be adjusted by NAMED_SHUTDOWN_TIMEOUT
+  shell variable.
+
+* Mon Oct  2 2006 Martin Stransky <stransky@redhat.com> - 30:9.3.3-2
+- removed chcon from %%post script, replaced by restorecon
+  (Bug 202547, comment no. 37)
+
+* Fri Sep 15 2006 Martin Stransky <stransky@redhat.com> - 30:9.3.3-1
+- updated to the latest upstream (9.3.3rc2)
+
+* Wed Sep  6 2006 Martin Stransky <stransky@redhat.com> - 30:9.3.2-41
+- added upstream patch for correct SIG handling - CVE-2006-4095
+
+* Tue Sep  5 2006 Martin Stransky <stransky@redhat.com> - 30:9.3.2-40
+- suppressed messages from bind-chroot-admin
+- cleared notes about bind-config
+
+* Tue Aug 22 2006 Martin Stransky <stransky@redhat.com> - 30:9.3.2-39
+- added fix for #203522 - "bind-chroot-admin -e" command fails
+
+* Mon Aug 21 2006 Martin Stransky <stransky@redhat.com> - 30:9.3.2-38
+- fix for #203194 - tmpfile usage
+
+* Thu Aug 17 2006 Martin Stransky <stransky@redhat.com> - 30:9.3.2-37
+- fix for #202542 - /usr/sbin/bind-chroot-admin: No such file or directory
+- fix for #202547 - file_contexts: invalid context
+
+* Fri Aug 11 2006 Martin Stransky <stransky@redhat.com> - 30:9.3.2-36
+- added Provides: bind-config
+
+* Fri Aug 11 2006 Martin Stransky <stransky@redhat.com> - 30:9.3.2-35
+- fix bug 197493: renaming subpackage bind-config to caching-nameserver
+
+* Mon Jul 24 2006 Jason Vas Dias <jvdias@redhat.com> - 30:9.3.2-34
+- fix bug 199876: make '%%exclude libbbind.*' conditional on %%{LIBBIND}
+
+* Mon Jul 24 2006 Florian La Roche <laroche@redhat.com> - 30:9.3.2-33
+- fix #195881, perms are not packaged correctly
+
+* Fri Jul 21 2006 Jason Vas Dias <jvdias@redhat.com> - 30:9.3.2-32
+- fix addenda to bug 189789:
+  determination of selinux enabled was still not 100% correct in bind-chroot-admin
+- fix addenda to bug 196398:
+  make named.init test for NetworkManager being enabled AFTER testing for -D absence;
+  named.init now supports a 'DISABLE_NAMED_DBUS' /etc/sysconfig/named setting to disable
+  auto-enable of named dbus support if NetworkManager enabled.
+
+* Wed Jul 19 2006 Jason Vas Dias <jvdias@redhat.com> - 30:9.3.2-30
+- fix bug 196398 - Enable -D option automatically in initscript
+  if NetworkManager enabled in any runlevel.
+- fix namedGetForwarders for new dbus
+- fix bug 195881 - libbind.so should be owned by bind-libbind-devel
+
+* Wed Jul 19 2006 Matthias Clasen <mclasen@redhat.com> - 30:9.3.2-28.FC6
+- Rebuild against new dbus
+
+* Wed Jul 12 2006 Jason Vas Dias <jvdias@redhat.com> - 30:9.3.2-27.FC6
+- rebuild with fixed glibc-kernheaders
+
+* Wed Jul 12 2006 Jesse Keating <jkeating@redhat.com> - 30:9.3.2-26.FC6.1
+- rebuild
+
+* Wed Jun 14 2006 Jason Vas Dias <jvdias@redhat.com> - 30:9.3.2-26.FC6
+- fix bugs 191093, 189789
+- backport selected fixes from upstream bind9 'v9_3_3b1' CVS version:
+  ( see http://www.isc.org/sw/bind9.3.php "Fixes" ):
+  o change 2024 / bug 16027:
+    named emitted spurious "zone serial unchanged" messages on reload
+  o change 2013 / bug 15941:
+    handle unexpected TSIGs on unsigned AXFR/IXFR responses more gracefully
+  o change 2009 / bug 15808: coverity fixes
+  o change 1997 / bug 15818:
+    named was failing to replace negative cache entries when a positive one
+    for the type was learnt
+  o change 1994 / bug 15694: OpenSSL 0.9.8 support
+  o change 1991 / bug 15813:
+    The configuration data, once read, should be treated as readonly.
+  o misc. validator fixes
+  o misc. resolver fixes
+  o misc. dns fixes
+  o misc. isc fixes
+  o misc. libbind fixes
+  o misc. isccfg fix
+  o misc. lwres fix
+  o misc. named fixes
+  o misc. dig fixes
+  o misc. nsupdate fix
+  o misc. tests fixes
+
+* Wed Jun  7 2006 Jeremy Katz <katzj@redhat.com> - 30:9.3.2-24.FC6
+- and actually put the devel symlinks in the right subpackage
+
+* Thu May 25 2006 Jeremy Katz <katzj@redhat.com> - 30:9.3.2-23.FC6
+- rebuild for -devel deps
+
+* Tue Apr 18 2006 Jason Vas Dias <jvdias@redhat.com> - 30:9.3.2-22
+- apply upstream patch for ncache_adderesult segfault bug 173961 addenda
+- fix bug 188382: rpm --verify permissions inconsistencies
+- fix bug 189186: use /sbin/service instead of initscript
+- rebuild for new gcc, glibc-kernheaders
+
+* Tue Apr 04 2006 Jason Vas Dias <jvdias@redhat.com> - 30:9.3.2-20
+- fix resolver.c ncache_adderesult segfault reported in addenda to bug 173961
+  (upstream bugs #15642, #15528 ?)
+- allow named ability to generate core dumps after setuid (upstream bug #15753)
+
+* Mon Apr 03 2006 Jason Vas Dias <jvdias@redhat.com> - 30:9.3.2-18
+- fix bug 187529: make bind-chroot-admin deal with subdirectories properly
+
+* Thu Mar 30 2006 Jason Vas Dias <jvdias@redhat.com> - 30:9.3.2-16
+- fix bug 187286:
+     prevent host(1) printing duplicate 'is an alias for' messages
+     for the default AAAA and MX lookups as well as for the A lookup
+     (it now uses the CNAME returned for the A lookup for the AAAA and MX lookups).
+     This is upstream bug #15702 fixed in the unreleased bind-9.3.3
+- fix bug 187333: fix SOURCE24 and SOURCE25 transposition
+
+* Wed Mar 29 2006 Jason Vas Dias <jvdias@redhat.com> - 30:9.3.2-14
+- fix bug 186577: remove -L/usr/lib from libbind.pc and more .spec file cleanup
+- add '%%doc' sample configuration files in /usr/share/doc/bind*/sample
+- rebuild with new gcc and glibc
+
+* Wed Mar 22 2006 Jason Vas Dias <jvdias@redhat.com> - 30:9.3.2-12
+- fix typo in initscript
+- fix Requires(post): policycoreutils in sub-packages
+
+* Mon Mar 20 2006 Jason Vas Dias <jvdias@redhat.com> - 30.9.3.2-10
+- fix bug 185969: more .spec file cleanup
+
+* Wed Mar 08 2006 Jason Vas Dias <jvdias@redhat.com> - 30.9.3.2-8
+- Do not allow package to be installed if named:25 userid creation fails
+- Give libbind a pkg-config file
+- remove restorecon from bind-chroot-admin (not required).
+- fix named.caching-nameserver.conf (listen-on-v6 port 53 { ::1 };)
+
+* Tue Mar 07 2006 Jason Vas Dias <jvdias@redhat.com> - 30:9.3.2-7
+- fix issues with bind-chroot-admin
+
+* Mon Mar 06 2006 Jason Vas Dias <jvdias@redhat.com> - 30:9.3.2-6
+- replace caching-nameserver with bind-config sub-package
+- fix bug 177595: handle case where $ROOTDIR is a link in initscript
+- fix bug 177001: bind-config creates symlinks OK now
+- fix bug 176388: named.conf is now never replaced by any RPM
+- fix bug 176248: remove unecessary creation of rpmsave links
+- fix bug 174925: no replacement of named.conf
+- fix bug 173963: existing named.conf never modified
+- major .spec file cleanup
+
+* Fri Feb 10 2006 Jesse Keating <jkeating@redhat.com> - 30:9.3.2-4.1
+- bump again for double-long bug on ppc(64)
+
+* Tue Feb 07 2006 Jason Vas Dias <jvdias@redhat.com> - 30:9.3.2-4
+- regenerate redhat_doc patch for non-DBUS builds
+- allow dbus builds to work with dbus version < 0.6 (bz #179816)
+
+* Tue Feb 07 2006 Florian La Roche <laroche@redhat.com> 30:9.3.2-3
+- try supporting without dbus support
+
+* Mon Feb 06 2006 Jason Vas Dias <jvdias@redhat.com> - 30:9.3.2-2.1
+- Rebuild for new gcc, glibc, glibc-kernheaders
+
+* Mon Jan 16 2006 Jason Vas Dias <jvdias@redhat.com> - 30:9.3.2-2
+- fix bug 177854: temporary fix for broken kernel-2.6.15-1854+
+  /proc/net/if_inet6 format
+
+* Wed Dec 21 2005 Jason Vas Dias <jvdias@redhat.com> - 30:9.3.2-1
+- Upgrade to 9.3.2, released today
+
+* Tue Dec 20 2005 Jason Vas Dias <jvdias@redhat.com> - 28:9.3.2rc1-2
+- fix bug 176100: do not Require: perl just for namedGetForwarders !
+
+* Fri Dec 09 2005 Jesse Keating <jkeating@redhat.com>
+- rebuilt
+
+* Fri Dec 02 2005 Jason Vas Dias <jvdias@redhat.com> - 28:9.3.2rc-1
+- Upgrade to upstream version 9.3.2rc1
+- fix namedSetForwarders -> namedGetForwarders SOURCE14 typo
+
+* Thu Dec 01 2005 Jason Vas Dias <jvdias@redhat.com> - 24:9.3.1-26
+- rebuild for new dbus 0.6 dependency; remove use of
+  DBUS_NAME_FLAG_PROHIBIT_REPLACEMENT
+
+* Wed Nov 23 2005 Jason Vas Dias <jvdias@redhat.com> - 24:9.3.1-24
+- allow D-BUS support to work in bind-chroot environment:
+  workaround latest selinux policy by mounting /var/run/dbus/
+  under chroot instead of /var/run/dbus/system-bus-socket
+
+* Sun Nov 13 2005 Jason Vas Dias <jvdias@redhat.com> - 24:9.3.1-22
+- fix bug 172632 - remove .la files
+- ship namedGetForwarders and namedSetForwarders scripts
+- fix detection of -D option in chroot
+
+* Tue Nov  8 2005 Tomas Mraz <tmraz@redhat.com> - 24:9.3.1-21
+- rebuilt with new openssl
+
+* Wed Oct 19 2005 Jason Vas Dias <jvdias@redhat.com> - 24.9.3.1-20
+- Allow the -D enable D-BUS option to be used within bind-chroot .
+- fix bug 171226: supply some documentation for pgsql SDB .
+
+* Thu Oct 06 2005 Jason Vas Dias <jvdias@redhat.com> - 24:9.3.1-18
+- fix bug 169969: do NOT call dbus_svc_dispatch() in dbus_mgr_init_dbus() -
+      task->state != task_ready and will cause Abort in task.c if process
+      is waiting for NameOwnerChanged to do a SetForwarders
+
+* Wed Oct 05 2005 Jason Vas Dias <jvdias@redhat.com> - 24:9.3.1-16
+- Fix reconnecting to dbus-daemon after it stops & restarts .
+
+* Tue Sep 27 2005 Jason Vas Dias <jvdias@redhat.com> - 24:9.3.1-14
+- When forwarder nameservers are changed with D-BUS, flush the cache.
+
+* Mon Sep 26 2005 Jason Vas Dias <jvdias@redhat.com> - 24:9.3.1-12
+- fix bug 168302: use %%{__cc} for compiling dns-keygen
+- fix bug 167682: bind-chroot directory permissions
+- fix issues with -D dbus option when dbus service not running or disabled
+
+* Tue Aug 30 2005 Jason Vas Dias <jvdias@redhat.com> - 24:9.3.1-12
+- fix bug 167062: named should be started after syslogd by default
+
+* Mon Aug 22 2005 Jason Vas Dias <jvdias@redhat.com> - 24:9.3.1-11
+- fix bug 166227: host: don't do default AAAA and MX lookups with '-t a' option
+
+* Tue Aug 16 2005 Jason Vas Dias <jvdias@redhat.com> - 24:9.3.1-10
+- Build with D-BUS patch by default; D-BUS support enabled with named -D option
+- Enable D-BUS for named_sdb also
+- fix sdb pgsql's zonetodb.c: must use isc_hash_create() before dns_db_create()
+- update fix for bug 160914 : test for RD=1 and ARCOUNT=0 also before trying next server
+- fix named.init script to handle named_sdb properly
+- fix named.init script checkconfig() to handle named '-c' option
+  and make configtest, test, check configcheck synonyms
+
+* Tue Jul 19 2005 Jason Vas Dias <jvdias@redhat.com> - 24:9.3.1-8
+- fix named.init script bugs 163598, 163409, 151852(addendum)
+
+* Tue Jul 12 2005 Jason Vas Dias <jvdias@redhat.com> - 24:9.3.1-7
+- fix bug 160914: resolver utilities should try next server on empty referral
+                  (now that glibc bug 162625 is fixed)
+                  host and nslookup now by default try next server on SERVFAIL
+                  (host now has '-s' option to disable, and nslookup given
+                   '[no]fail' option similar to dig's [no]fail option).
+- rebuild and re-test with new glibc & gcc (all tests passed).
+
+* Tue May 31 2005 Jason Vas Dias <jvdias@redhat.com> - 24:9.3.1-6
+- fix bug 157950: dig / host / nslookup should reject invalid resolv.conf
+                  files and not use uninitialized garbage nameserver values
+                  (ISC bug 14841 raised).
+
+* Mon May 23 2005 Jason Vas Dias <jvdias@redhat.com> - 24:9.3.1-4_FC4
+- Fix SDB LDAP
+
+* Mon May 16 2005 Jason Vas Dias <jvdias@redhat.com> - 24:9.3.1-4
+- Fix bug 157601: give named.init a configtest function
+- Fix bug 156797: named.init should check SELinux booleans.local before booleans
+- Fix bug 154335: if no controls in named.conf, stop named with -TERM sig, not rndc
+- Fix bug 155848: add NOTES section to named.8 man-page with info on all Red Hat
+                  BIND quirks and SELinux DDNS / slave zone file configuration
+- D-BUS patches NOT applied until dhcdbd is in FC
+
+* Sun May 15 2005 Jason Vas Dias <jvdias@redhat.com> - 24:9.3.1-4_dbus
+- Enhancement to allow dynamic forwarder table management and
+- DHCP forwarder auto-configuration with D-BUS
+
+* Thu Apr 14 2005 Jason Vas Dias <jvdias@redhat.com> - 24:9.3.1-2_FC4
+- Rebuild for bind-sdb libpq.so.3 dependency
+- fix bug 150981: don't install libbind man-pages if no libbind
+- fix bug 151852: mount proc on $ROOTDIR/proc to allow sysconf(...)
+  to work and correct number of CPUs to be determined
+
+* Fri Mar 11 2005 Jason Vas Dias <jvdias@redhat.com> - 24:9.3.1-1_FC4
+- Upgrade to ISC BIND 9.3.1 (final release) released today.
+
+* Wed Mar  9 2005 Jason Vas Dias <jvdias@redhat.com> - 22.9.3.1rc1-5
+- fix bug 150288: h_errno not being accessed / set correctly in libbind
+- add libbind man-pages from bind-8.4.6
+
+* Mon Mar  7 2005 Jason Vas Dias <jvdias@redhat.com> - 22:9.3.1rc1-4
+- Rebuild with gcc4 / glibc-2.3.4-14.
+
+* Tue Mar  1 2005 Nalin Dahyabhai <nalin@redhat.com> - 22:9.3.1rc1-3
+- configure with --with-pic to get PIC libraries
+
+* Sun Feb 20 2005 Jason Vas Dias <jvdias@redhat.com> - 22:9.3.1rc1-2
+- fix bug 149183: don't use getifaddrs() .
+
+* Wed Feb 16 2005 Jason Vas Dias <jvdias@redhat.com> - 22:9.3.1rc1-1
+- Upgrade to 9.3.1rc1
+- Add Simplified Database Backend (SDB) sub-package ( bind-sdb )
+-     add named_sdb - ldap + pgsql + dir database backend support with
+-     'ENABLE_SDB' named.sysconfig option
+- Add BIND resolver library & includes sub-package ( libbind-devel)
+- fix bug 147824 / 147073 / 145664: ENABLE_ZONE_WRITE in named.init
+- fix bug 146084 : shutup restorecon
+
+* Tue Jan 11 2005 Jason Vas Dias <jvdias@redhat.com> - 22:9.3.0-2
+- Fix bug 143438: named.init will now make correct ownership of $ROOTDIR/var/named
+-                 based on 'named_write_master_zones' SELinux boolean.
+- Fix bug 143744: dig & nsupdate IPv6 timeout  (dup of 140528)
+
+* Mon Nov 29 2004 Jason Vas Dias <jvdias@redhat.com> - 9.3.0-1
+- Upgrade BIND to 9.3.0 in Rawhide / FC4 (bugs 134529, 133654...)
+
+* Mon Nov 29 2004 Jason Vas Dias <jvdias@redhat.com> - 20:9.2.4-4
+- Fix bugs 140528 and 141113:
+- 2 second timeouts when IPv6 not configured and root nameserver's
+- AAAA addresses are queried
+
+* Mon Oct 18 2004 Jason Vas Dias <jvdias@redhat.com> - 20:9.2.4-2
+- Fix bug 136243: bind-chroot %%post must run restorecon -R %%{prefix}
+- Fix bug 135175: named.init must return non-zero if named is not run
+- Fix bug 134060: bind-chroot %%post must use mktemp, not /tmp/named
+- Fix bug 133423: bind-chroot %%files entries should have been %%dirs
+
+* Thu Sep 23 2004 Jason Vas Dias <jvdias@redhat.com> - 20:9.2.4-1
+- BIND 9.2.4 (final release) released - source code actually
+- identical to 9.2.4rc8, with only version number change.
+
+* Mon Sep 20 2004 Jason Vas Dias <jvdias@redhat.com> - 10:9.2.4rc8-14
+- Upgrade to upstream bind-9.2.4rc8 .
+- Progress: Finally! Hooray! ISC bind now distributes:
+- o named.conf(5) and nslookup(8) manpages
+-    'bind-manpages.bz2' source can now disappear
+-    (could this have something to do with ISC bug I raised about this?)
+- o 'deprecation_msg' global has vanished
+-     bind-9.2.3rc3-deprecation_msg_shut_up.diff.bz2 can disappear
+
+* Mon Sep 20 2004 Jason Vas Dias <jvdias@redhat.com> - 10:9.2.4rc8-14
+- Fix bug 106572/132385: copy /etc/localtime to chroot on start
+
+* Fri Sep 10 2004 Jason Vas Dias <jvdias@redhat.com> - 10:9.2.4rc7-12_EL3
+- Fix bug 132303: if ROOTDIR line was replaced after upgrade from
+- bind-chroot-9.2.2-21, restart named
+
+* Wed Sep 8  2004 Jason Vas Dias <jvdias@redhat.com> - 10:9.2.4rc7-11_EL3
+- Fix bug 131803: replace ROOTDIR line removed by broken
+- bind-chroot 9.2.2-21's '%%postun'; added %%triggerpostun for bind-chroot
+
+* Tue Sep 7  2004 Jason Vas Dias <jvdias@redhat.com> - 10:9.2.4rc7-10_EL3
+- Fix bugs 130121 & 130981 for RHEL-3
+
+* Mon Aug 30 2004 Jason Vas Dias <jvdias@redhat.com> - 10:9.2.4rc7-10
+- Fix bug 130121: add '%%ghost' entries for files included in previous
+- bind-chroot & not in current - ie. named.conf, rndc.key, dev/* -
+- that RPM removed after upgrade .
+
+* Thu Aug 26 2004 Jason Vas Dias <jvdias@redhat.com>
+- Fix bug 130981: add '-t' option to named-checkconf invocation in
+- named.init if chroot installed.
+
+* Wed Aug 25 2004 Jason Vas Dias <jvdias@redhat.com>
+- Remove resolver(5) manpage now in man-pages (bug 130792);
+- Don't create /dev/ entries in bind-chroot if already there (bug 127556);
+- fix bind-devel Requires (bug 130919)
+- Set default location for dumpdb & stats files to /var/named/data
+
+* Tue Aug 24 2004 Jason Vas Dias <jvdias@redhat.com>
+- Fix devel Requires for bug 130738 & fix version
+
+* Tue Aug 24 2004 Jason Vas Dias <jvdias@redhat.com>
+- Fix errors on clean install if named group does not exist
+- (bug 130777)
+
+* Thu Aug 19 2004 Jason Vas Dias <jvdias@redhat.com>
+- Upgrade to bind-9.2.4rc7; applied initscript fix
+- for bug 102035.
+
+* Mon Aug  9 2004 Jason Vas Dias <jvdias@redhat.com>
+- Fixed bug 129289: bind-chroot install / deinstall
+- on install, existing config files 'safe_replace'd
+- with links to chroot copies; on uninstall, moved back.
+
+* Fri Aug  6 2004 Jason Vas Dias <jvdias@redhat.com>
+- Fixed bug 129258: "${prefix}/var/tmp" typo in spec
+
+* Wed Jul 28 2004 Jason Vas Dias <jvdias@redhat.com>
+- Fixed bug 127124 : 'Requires: kernel >= 2.4'
+- causes problems with Linux VServers
+
+* Tue Jul 27 2004 Jason Vas Dias <jvdias@redhat.com>
+- Fixed bug 127555 : chroot tar missing var/named/slaves
+
+* Fri Jul 16 2004 Jason Vas Dias <jvdias@redhat.com>
+- Upgraded to ISC version 9.2.4rc6
+
+* Fri Jul 16 2004 Jason Vas Dias <jvdias@redhat.com>
+- Fixed named.init generation of error messages on
+- 'service named stop' and 'service named reload'
+- as per bug 127775
+
+* Wed Jun 23 2004 Daniel Walsh <dwalsh@redhat.com> 9.2.3-19
+- Bump for rhel 3.0  U3
+
+* Wed Jun 23 2004 Daniel Walsh <dwalsh@redhat.com> 9.2.3-18
+- remove disable-linux-caps
+
+* Wed Jun 16 2004 Daniel Walsh <dwalsh@redhat.com> 9.2.3-17
+- Update RHEL3 to latest bind
+
+* Tue Jun 15 2004 Elliot Lee <sopwith@redhat.com>
+- rebuilt
+
+* Tue Jun 8 2004 Daniel Walsh <dwalsh@redhat.com> 9.2.3-15
+- Remove device files from chroot,  Named uses the system one
+
+* Fri Mar 26 2004 Daniel Walsh <dwalsh@redhat.com> 9.2.3-14
+- Move RFC to devel package
+
+* Fri Mar 26 2004 Daniel Walsh <dwalsh@redhat.com> 9.2.3-13
+- Fix location of restorecon
+
+* Thu Mar 25 2004 Daniel Walsh <dwalsh@redhat.com> 9.2.3-12
+- Tighten security on config files.  Should be owned by root
+
+* Thu Mar 25 2004 Daniel Walsh <dwalsh@redhat.com> 9.2.3-11
+- Update key patch to include conf-keygen
+
+* Tue Mar 23 2004 Daniel Walsh <dwalsh@redhat.com> 9.2.3-10
+- fix chroot to only happen once.
+- fix init script to do kill insteall of killall
+
+* Mon Mar 15 2004 Daniel Walsh <dwalsh@redhat.com> 9.2.3-9
+- Add fix for SELinux security context
+
+* Tue Mar 02 2004 Elliot Lee <sopwith@redhat.com>
+- rebuilt
+
+* Sat Feb 28 2004 Florian La Roche <Florian.LaRoche@redhat.de>
+- run ldconfig for libs subrpm
+
+* Mon Feb 23 2004 Tim Waugh <twaugh@redhat.com>
+- Use ':' instead of '.' as separator for chown.
+
+* Tue Feb 17 2004 Daniel Walsh <dwalsh@redhat.com> 9.2.3-7
+- Add COPYRIGHT
+
+* Fri Feb 13 2004 Elliot Lee <sopwith@redhat.com>
+- rebuilt
+
+* Tue Dec 30 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.3-5
+- Add defattr to libs
+
+* Mon Dec 29 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.3-4
+- Break out library package
+
+* Mon Dec 22 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.3-3
+- Fix condrestart
+
+* Wed Nov 12 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.3-2
+- Move libisc and libdns to bind from bind-util
+
+* Tue Nov 11 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.3-1
+- Move to 9.2.3
+
+* Mon Oct 27 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.2.P3-10
+- Add PIE support
+
+* Fri Oct 17 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.2.P3-9
+- Add /var/named/slaves directory
+
+* Sun Oct 12 2003 Florian La Roche <Florian.LaRoche@redhat.de>
+- do not link against libnsl, not needed for Linux
+
+* Wed Oct 8 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.2.P3-6
+- Fix local time in log file
+
+* Tue Oct 7 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.2.P3-5
+- Try again
+
+* Mon Oct 6 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.2.P3-4
+- Fix handling of chroot -/dev/random
+
+* Thu Oct 2 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.2.P3-3
+- Stop hammering stuff on update of chroot environment
+
+* Mon Sep 29 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.2.P3-2
+- Fix chroot directory to grab all subdirectories
+
+* Wed Sep 24 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.2.P3-1
+- New patch to support for "delegation-only"
+
+* Wed Sep 17 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.2-23
+- patch support for "delegation-only"
+
+* Wed Jul 30 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.2-22
+- Update to build on RHL
+
+* Wed Jul 30 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.2-21
+- Install libraries as exec so debug info will be pulled
+
+* Sat Jul 19 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.2-20
+- Remove BSDCOMPAT (BZ 99454)
+
+* Tue Jul 15 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.2-19
+- Update to build on RHL
+
+* Tue Jul 15 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.2-18
+- Change protections on /var/named and /var/chroot/named
+
+* Tue Jun 17 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.2-17
+- Update to build on RHL
+
+* Tue Jun 17 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.2-16
+- Update to build on RHEL
+
+* Wed Jun 04 2003 Elliot Lee <sopwith@redhat.com>
+- rebuilt
+
+* Tue Apr 22 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.2-14
+- Update to build on RHEL
+
+* Tue Apr 22 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.2-13
+- Fix config description of named.conf in chroot
+- Change named.init script to check for existence of /etc/sysconfig/network
+
+* Fri Apr 18 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.2-12
+- Update to build on RHEL
+
+* Fri Apr 18 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.2-11
+- Update to build on RHEL
+
+* Fri Apr 18 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.2-10
+- Fix echo OK on starting/stopping service
+
+* Fri Mar 28 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.2-9
+- Update to build on RHEL
+
+* Fri Mar 28 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.2-8
+- Fix echo on startup
+
+* Tue Mar 25 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.2-7
+- Fix problems with chroot environment
+- Eliminate posix threads
+
+* Mon Mar 24 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.2-6
+- Fix build problems
+
+* Fri Mar 14 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.2-5
+- Fix build on beehive
+
+* Thu Mar 13 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.2-4
+- build bind-chroot kit
+
+* Tue Mar 11 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.2-3
+- Change configure to use proper threads model
+
+* Fri Mar 7 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.2-2
+- update to 9.2.2
+
+* Tue Mar 4 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.2-1
+- update to 9.2.2
+
+* Fri Jan 24 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.1-16
+- Put a sleep in restart to make sure stop completes
+
+* Wed Jan 22 2003 Tim Powers <timp@redhat.com>
+- rebuilt
+
+* Tue Jan 7 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.1-14
+- Separate /etc/rndc.key to separate file
+
+* Tue Jan 7 2003 Nalin Dahyabhai <nalin@redhat.com> 9.2.1-13
+- Use openssl's pkgconfig data, if available, at build-time.
+
+* Mon Jan 6 2003 Daniel Walsh <dwalsh@redhat.com> 9.2.1-12
+- Fix log rotate to use service named reload
+- Change service named reload to give success/failure message [73770]
+- Fix File checking [75710]
+- Begin change to automatically run in CHROOT environment
+
+* Tue Dec 24 2002 Daniel Walsh <dwalsh@redhat.com> 9.2.1-10
+- Fix startup script to work like all others.
+
+* Mon Dec 16 2002 Daniel Walsh <dwalsh@redhat.com> 9.2.1-9
+- Fix configure to build on x86_64 platforms
+
+* Wed Aug 07 2002 Karsten Hopp <karsten@redhat.de>
+- fix #70583,  doesn't build on IA64
+
+* Tue Jul 30 2002 Karsten Hopp <karsten@redhat.de> 9.2.1-8
+- bind-utils shouldn't require bind
+
+* Mon Jul 22 2002 Karsten Hopp <karsten@redhat.de> 9.2.1-7
+- fix name of pidfine in logrotate script (#68842)
+- fix owner of logfile in logrotate script (#41391)
+- fix nslookup and named.conf man pages (output on stderr)
+  (#63553, #63560, #63561, #54889, #57457)
+- add rfc1912 (#50005)
+- gzip all rfc's
+- fix typo in keygen.c (#54870)
+- added missing manpages (#64065)
+- shutdown named properly with rndc stop (#62492)
+- /sbin/nologin instead of /bin/false (#68607)
+- move nsupdate to bind-utils (where the manpage already was) (#66209, #66381)
+- don't kill initscript when rndc fails (reload)    (#58750)
+
+
+* Mon Jun 24 2002 Bernhard Rosenkraenzer <bero@redhat.com> 9.2.1-5
+- Fix #65975
+
+* Fri Jun 21 2002 Tim Powers <timp@redhat.com>
+- automated rebuild
+
+* Thu May 23 2002 Tim Powers <timp@redhat.com>
+- automated rebuild
+
+* Thu May  9 2002 Bernhard Rosenkraenzer <bero@redhat.com> 9.2.1-2
+- Move libisccc, lib isccfg and liblwres from bind-utils to bind,
+  they're not required if you aren't running a nameserver.
+
+* Fri May 03 2002 Florian La Roche <Florian.LaRoche@redhat.de>
+- update to 9.2.1 release
+
+* Thu Mar 14 2002 Bernhard Rosenkraenzer <bero@redhat.com> 9.2.0-8
+- Merge 30+ bug fixes from 9.2.1rc1 code
+
+* Mon Mar 11 2002 Bernhard Rosenkraenzer <bero@redhat.com> 9.2.0-7
+- Don't exit if /etc/named.conf doesn't exist if we're running
+  chroot (#60868)
+- Revert Elliot's changes, we do require specific glibc/glibc-kernheaders
+  versions or bug #58335 will be back. "It compiles, therefore it works"
+  isn't always true.
+
+* Thu Feb 28 2002 Elliot Lee <sopwith@redhat.com> 9.2.0-6
+- Fix BuildRequires (we don't need specific glibc/glibc-kernheaders
+versions).
+- Use _smp_mflags
+
+* Wed Feb 20 2002 Bernhard Rosenkraenzer <bero@redhat.com> 9.2.0-4
+- rebuild, require recent autoconf, automake (#58335)
+
+* Fri Jan 25 2002 Tim Powers <timp@redhat.com>
+- rebuild against new libssl
+
+* Wed Jan 09 2002 Tim Powers <timp@redhat.com>
+- automated rebuild
+
+* Tue Nov 27 2001 Bernhard Rosenkraenzer <bero@redhat.com> 9.2.0-1
+- 9.2.0
+
+* Thu Nov 22 2001 Bernhard Rosenkraenzer <bero@redhat.com> 9.2.0-0.rc10.2
+- 9.2.0rc10
+
+* Mon Nov  5 2001 Bernhard Rosenkraenzer <bero@redhat.com> 9.2.0-0.rc8.2
+- Fix up rndc.conf (#55574)
+
+* Thu Oct 25 2001 Bernhard Rosenkraenzer <bero@redhat.com> 9.2.0-0.rc8.1
+- rc8
+- Enforce --enable-threads
+
+* Mon Oct 22 2001 Bernhard Rosenkraenzer <bero@redhat.com> 9.2.0-0.rc7.1
+- 9.2.0rc7
+- Use rndc status for "service named status", it's supposed to actually
+  work in 9.2.x.
+
+* Wed Oct  3 2001 Bernhard Rosenkraenzer <bero@redhat.com> 9.2.0-0.rc5.1
+- 9.2.0rc5
+- Fix rpm --rebuild with ancient libtool versions (#53938, #54257)
+
+* Tue Sep 25 2001 Bernhard Rosenkraenzer <bero@redhat.com> 9.2.0-0.rc4.1
+- 9.2.0rc4
+
+* Fri Sep 14 2001 Bernhard Rosenkraenzer <bero@redhat.com> 9.2.0-0.rc3.1
+- 9.2.0rc3
+- remove ttl patch, I don't think we need this for 8.0.
+- remove dig.1.bz2 from the bind8-manpages tar file, 9.2 has a new dig man page
+- add lwres* man pages to -devel
+
+* Mon Sep  3 2001 Bernhard Rosenkraenzer <bero@redhat.com> 9.1.3-4
+- Make sure /etc/rndc.conf isn't world-readable even after the
+  %%post script inserted a random key (#53009)
+
+* Thu Jul 19 2001 Bernhard Rosenkraenzer <bero@redhat.com> 9.1.3-3
+- Add build dependencies (#49368)
+- Make sure running service named start several times doesn't create
+  useless processes (#47596)
+- Work around the named parent process returning 0 even if the config
+  file is broken (it's parsed later by the child processes) (#45484)
+
+* Mon Jul 16 2001 Bernhard Rosenkraenzer <bero@redhat.com> 9.1.3-2
+- Don't use rndc status, it's not yet implemented (#48839)
+
+* Sun Jul 08 2001 Florian La Roche <Florian.LaRoche@redhat.de>
+- update to 9.1.3 release
+
+* Tue Jul  3 2001 Bernhard Rosenkraenzer <bero@redhat.com> 9.1.3-0.rc3.1
+- Fix up rndc configuration and improve security (#46586)
+
+* Tue Jun 26 2001 Bernhard Rosenkraenzer <bero@redhat.com> 9.1.3-0.rc2.2
+- Sync with caching-nameserver-7.1-6
+
+* Mon Jun 25 2001 Bernhard Rosenkraenzer <bero@redhat.com> 9.1.3-0.rc2.1
+- Update to rc2
+
+* Fri Jun  1 2001 Bernhard Rosenkraenzer <bero@redhat.com> 9.1.3-0.rc1.3
+- Remove resolv.conf(5) man page, it's now in man-pages
+
+* Thu May 31 2001 Bernhard Rosenkraenzer <bero@redhat.com> 9.1.3-0.rc1.2
+- Add named.conf man page from bind 8.x (outdated, but better than nothing,
+  #42732)
+- Rename the rndc key (#42895)
+- Add dnssec* man pages
+
+* Mon May 28 2001 Bernhard Rosenkraenzer <bero@redhat.com> 9.1.3-0.rc1.1
+- 9.1.3rc1
+- s/Copyright/License/
+
+* Mon May  7 2001 Bernhard Rosenkraenzer <bero@redhat.com> 9.1.2-1
+- 9.1.2 final. No changes between 9.1.2-0.rc1.1 and this one, except for
+  the version number, though.
+
+* Thu May  3 2001 Bernhard Rosenkraenzer <bero@redhat.com> 9.1.2-0.rc1.1
+- 9.1.2rc1
+
+* Thu Mar 29 2001 Bernhard Rosenkraenzer <bero@redhat.com> 9.1.1-1
+- 9.1.1
+
+* Thu Mar 15 2001 Bernhard Rosenkraenzer <bero@redhat.com> 9.1.0-10
+- Merge fixes from 9.1.1rc5
+
+* Sun Mar 11 2001 Bernhard Rosenkraenzer <bero@redhat.com> 9.1.0-9
+- Work around bind 8 -> bind 9 migration problem when using buggy zone files:
+  accept zones without a TTL, but spew out a big fat warning. (#31393)
+
+* Thu Mar  8 2001 Bernhard Rosenkraenzer <bero@redhat.com>
+- Add fixes from rc4
+
+* Fri Mar  2 2001 Nalin Dahyabhai <nalin@redhat.com>
+- rebuild in new environment
+
+* Thu Mar  1 2001 Bernhard Rosenkraenzer <bero@redhat.com>
+- killall -HUP named if rndc reload fails (#30113)
+
+* Tue Feb 27 2001 Bernhard Rosenkraenzer <bero@redhat.com>
+- Merge some fixes from 9.1.1rc3
+
+* Tue Feb 20 2001 Bernhard Rosenkraenzer <bero@redhat.com>
+- Don't use the standard rndc key from the documentation, instead, create a random one
+  at installation time (#26358)
+- Make /etc/rndc.conf readable by user named only, it contains secret keys
+
+* Tue Feb 20 2001 Bernhard Rosenkraenzer <bero@redhat.com>
+- 9.1.1 probably won't be out in time, revert to 9.1.0 and apply fixes
+  from 9.1.1rc2
+- bind requires bind-utils (#28317)
+
+* Tue Feb 13 2001 Bernhard Rosenkraenzer <bero@redhat.com>
+- Update to rc2, fixes 2 more bugs
+- Fix build with glibc >= 2.2.1-7
+
+* Thu Feb  8 2001 Bernhard Rosenkraenzer <bero@redhat.com>
+- Update to 9.1.1rc1; fixes 17 bugs (14 of them affecting us;
+  1 was fixed in a Red Hat patch already, 2 others are portability
+  improvements)
+
+* Wed Feb  7 2001 Bernhard Rosenkraenzer <bero@redhat.com>
+- Remove initscripts 5.54 requirement (#26489)
+
+* Mon Jan 29 2001 Bernhard Rosenkraenzer <bero@redhat.com>
+- Add named-checkconf, named-checkzone (#25170)
+
+* Mon Jan 29 2001 Trond Eivind Glomsrod <teg@redhat.com>
+- use echo, not gprintf
+
+* Wed Jan 24 2001 Bernhard Rosenkraenzer <bero@redhat.com>
+- Fix problems with $GENERATE
+  Patch from Daniel Roesen <droesen@entire-systems.com>
+  Bug #24890
+
+* Thu Jan 18 2001 Bernhard Rosenkraenzer <bero@redhat.com>
+- 9.1.0 final
+
+* Sat Jan 13 2001 Bernhard Rosenkraenzer <bero@redhat.com>
+- 9.1.0rc1
+- i18nify init script
+- bzip2 source to save space
+
+* Thu Jan 11 2001 Bernhard Rosenkraenzer <bero@redhat.com>
+- Fix %%postun script
+
+* Tue Jan  9 2001 Bernhard Rosenkraenzer <bero@redhat.com>
+- 9.1.0b3
+
+* Mon Jan  8 2001 Bernhard Rosenkraenzer <bero@redhat.com>
+- Add named.conf man page from bind8 (#23503)
+
+* Sun Jan  7 2001 Bernhard Rosenkraenzer <bero@redhat.com>
+- Make /etc/rndc.conf and /etc/sysconfig/named noreplace
+- Make devel require bind = %%{version} rather than just bind
+
+* Sun Jan  7 2001 Bernhard Rosenkraenzer <bero@redhat.com>
+- Fix init script for real
+
+* Sat Jan  6 2001 Bernhard Rosenkraenzer <bero@redhat.com>
+- Fix init script when ROOTDIR is not set
+
+* Thu Jan  4 2001 Bernhard Rosenkraenzer <bero@redhat.com>
+- Add hooks for setting up named to run chroot (RFE #23246)
+- Fix up requirements
+
+* Fri Dec 29 2000 Bernhard Rosenkraenzer <bero@redhat.com>
+- 9.1.0b2
+
+* Wed Dec 20 2000 Bernhard Rosenkraenzer <bero@redhat.com>
+- Move run files to /var/run/named/ - /var/run isn't writable
+  by the user we're running as. (Bug #20665)
+
+* Tue Dec 19 2000 Bernhard Rosenkraenzer <bero@redhat.com>
+- Fix reverse lookups (#22272)
+- Run ldconfig in %%post utils
+
+* Tue Dec 12 2000 Karsten Hopp <karsten@redhat.de>
+- fixed logrotate script (wrong path to kill)
+- include header files in -devel package
+- bugzilla #22049, #19147, 21606
+
+* Fri Dec  8 2000 Bernhard Rosenkraenzer <bero@redhat.com>
+- 9.1.0b1 (9.1.0 is in our timeframe and less buggy)
+
+* Mon Nov 13 2000 Bernhard Rosenkraenzer <bero@redhat.com>
+- 9.0.1
+
+* Mon Oct 30 2000 Bernhard Rosenkraenzer <bero@redhat.com>
+- Fix initscript (Bug #19956)
+- Add sample rndc.conf (Bug #19956)
+- Fix build with tar 1.13.18
+
+* Tue Oct 10 2000 Bernhard Rosenkraenzer <bero@redhat.com>
+- Add some missing man pages (taken from bind8) (Bug #18794)
+
+* Sun Sep 17 2000 Bernhard Rosenkraenzer <bero@redhat.com>
+- 9.0.0 final
+
+* Wed Aug 30 2000 Bernhard Rosenkraenzer <bero@redhat.com>
+- rc5
+- fix up nslookup
+
+* Thu Aug 24 2000 Bernhard Rosenkraenzer <bero@redhat.com>
+- rc4
+
+* Thu Jul 13 2000 Bernhard Rosenkraenzer <bero@redhat.com>
+- 9.0.0rc1
+
+* Wed Jul 12 2000 Prospector <bugzilla@redhat.com>
+- automatic rebuild
+
+* Sun Jul  9 2000 Florian La Roche <Florian.LaRoche@redhat.de>
+- add "exit 0" for uninstall case
+
+* Fri Jul  7 2000 Florian La Roche <Florian.LaRoche@redhat.de>
+- add prereq init.d and cleanup install section
+
+* Fri Jun 30 2000 Trond Eivind Glomsrod <teg@redhat.com>
+- fix the init script
+
+* Wed Jun 28 2000 Nalin Dahyabhai <nalin@redhat.com>
+- make libbind.a and nslookup.help readable again by setting INSTALL_LIB to ""
+
+* Mon Jun 26 2000 Bernhard Rosenkranzer <bero@redhat.com>
+- Fix up the initscript (Bug #13033)
+- Fix build with current glibc (Bug #12755)
+- /etc/rc.d/init.d -> /etc/init.d
+- use %%{_mandir} rather than /usr/share/man
+
+* Mon Jun 19 2000 Bill Nottingham <notting@redhat.com>
+- fix conflict with man-pages
+- remove compatibilty chkconfig links
+- initscript munging
+
+* Wed Jun 14 2000 Nalin Dahyabhai <nalin@redhat.com>
+- modify logrotate setup to use PID file
+- temporarily disable optimization by unsetting $RPM_OPT_FLAGS at build-time
+- actually bump the release this time
+
+* Sun Jun  4 2000 Bernhard Rosenkraenzer <bero@redhat.com>
+- FHS compliance
+
+* Mon Apr 17 2000 Nalin Dahyabhai <nalin@redhat.com>
+- clean up restart patch
+
+* Mon Apr 10 2000 Nalin Dahyabhai <nalin@redhat.com>
+- provide /var/named (fix for bugs #9847, #10205)
+- preserve args when restarted via ndc(8) (bug #10227)
+- make resolv.conf(5) a link to resolver(5) (bug #10245)
+- fix SYSTYPE bug in all makefiles
+- move creation of named user from %%post into %%pre
+
+* Mon Feb 28 2000 Bernhard Rosenkranzer <bero@redhat.com>
+- Fix TTL (patch from ISC, Bug #9820)
+
+* Wed Feb 16 2000 Bernhard Rosenkranzer <bero@redhat.com>
+- fix typo in spec (it's %%post, without a leading blank) introduced in -6
+- change SYSTYPE to linux
+
+* Fri Feb 11 2000 Bill Nottingham <notting@redhat.com>
+- pick a standard < 100 uid/gid for named
+
+* Fri Feb 04 2000 Elliot Lee <sopwith@redhat.com>
+- Pass named a '-u named' parameter by default, and add/remove user.
+
+* Thu Feb  3 2000 Bernhard Rosenkraenzer <bero@redhat.com>
+- fix host mx bug (Bug #9021)
+
+* Mon Jan 31 2000 Cristian Gafton <gafton@redhat.com>
+- rebuild to fix dependencies
+- man pages are compressed
+
+* Wed Jan 19 2000 Bernhard Rosenkraenzer <bero@redhat.com>
+- It's /usr/bin/killall, not /usr/sbin/killall (Bug #8063)
+
+* Mon Jan 17 2000 Bernhard Rosenkraenzer <bero@redhat.com>
+- Fix up location of named-bootconf.pl and make it executable
+  (Bug #8028)
+- bind-devel requires bind
+
+* Mon Nov 15 1999 Bernhard Rosenkraenzer <bero@redhat.com>
+- update to 8.2.2-P5
+
+* Wed Nov 10 1999 Bill Nottingham <notting@redhat.com>
+- update to 8.2.2-P3
+
+* Tue Oct 12 1999 Cristian Gafton <gafton@redhat.com>
+- add patch to stop a cache only server from complaining about lame servers
+  on every request.
+
+* Fri Sep 24 1999 Preston Brown <pbrown@redhat.com>
+- use real stop and start in named.init for restart, not ndc restart, it has
+  problems when named has changed during a package update... (# 4890)
+
+* Fri Sep 10 1999 Bill Nottingham <notting@redhat.com>
+- chkconfig --del in %%preun, not %%postun
+
+* Mon Aug 16 1999 Bill Nottingham <notting@redhat.com>
+- initscript munging
+
+* Mon Jul 26 1999 Bill Nottingham <notting@redhat.com>
+- fix installed chkconfig links to match init file
+
+* Sat Jul  3 1999 Jeff Johnson <jbj@redhat.com>
+- conflict with new (in man-1.24) man pages (#3876,#3877).
+
+* Tue Jun 29 1999 Bill Nottingham <notting@redhat.com>
+- fix named.logrotate (wrong %%SOURCE)
+
+* Fri Jun 25 1999 Jeff Johnson <jbj@redhat.com>
+- update to 8.2.1.
+- add named.logrotate (#3571).
+- hack around egcs-1.1.2 -m486 bug (#3413, #3485).
+- vet file list.
+
+* Fri Jun 18 1999 Bill Nottingham <notting@redhat.com>
+- don't run by default
+
+* Sun May 30 1999 Jeff Johnson <jbj@redhat.com>
+- nslookup fixes (#2463).
+- missing files (#3152).
+
+* Sat May  1 1999 Stepan Kasal <kasal@math.cas.cz>
+- nslookup patched:
+  to count numRecords properly
+  to fix subsequent calls to ls -d
+  to parse "view" and "finger" commands properly
+  the view hack updated for bind-8 (using sed)
+
+* Wed Mar 31 1999 Bill Nottingham <notting@redhat.com>
+- add ISC patch
+- add quick hack to make host not crash
+- add more docs
+
+* Fri Mar 26 1999 Cristian Gafton <gafton@redhat.com>
+- add probing information in the init file to keep linuxconf happy
+- dont strip libbind
+
+* Sun Mar 21 1999 Cristian Gafton <gafton@redhat.com>
+- auto rebuild in the new build environment (release 3)
+
+* Wed Mar 17 1999 Preston Brown <pbrown@redhat.com>
+- removed 'done' output at named shutdown.
+
+* Tue Mar 16 1999 Cristian Gafton <gafton@redhat.com>
+- version 8.2
+
+* Wed Dec 30 1998 Cristian Gafton <gafton@redhat.com>
+- patch to use the __FDS_BITS macro
+- build for glibc 2.1
+
+* Wed Sep 23 1998 Jeff Johnson <jbj@redhat.com>
+- change named.restart to /usr/sbin/ndc restart
+
+* Sat Sep 19 1998 Jeff Johnson <jbj@redhat.com>
+- install man pages correctly.
+- change K10named to K45named.
+
+* Wed Aug 12 1998 Jeff Johnson <jbj@redhat.com>
+- don't start if /etc/named.conf doesn't exist.
+
+* Sat Aug  8 1998 Jeff Johnson <jbj@redhat.com>
+- autmagically create /etc/named.conf from /etc/named.boot in %%post
+- remove echo in %%post
+
+* Wed Jun 10 1998 Jeff Johnson <jbj@redhat.com>
+- merge in 5.1 mods
+
+* Sun Apr 12 1998 Manuel J. Galan <manolow@step.es>
+- Several essential modifications to build and install correctly.
+- Modified 'ndc' to avoid deprecated use of '-'
+
+* Mon Dec 22 1997 Scott Lampert <fortunato@heavymetal.org>
+- Used buildroot
+- patched bin/named/ns_udp.c to use <libelf/nlist.h> for include
+  on Redhat 5.0 instead of <nlist.h>

From 5cc93baa3a419963f211c74608b36f7ca5430899 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 2 Jul 2026 11:32:39 +0200
Subject: [PATCH 439/460] _libexec/generate-rndc-key.sh is used by freeipa

Provide compatibility symlink until it is replaced. Freeipa calls the
original place for script used to generate /etc/rndc.key. Preferred
variant should be "systemctl restart named-setup-rndc.service" command.
Until that is used everywhere, provide compatibility fix.
---
 bind.spec | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/bind.spec b/bind.spec
index d7b44b9..d82e505 100644
--- a/bind.spec
+++ b/bind.spec
@@ -721,6 +721,7 @@ install -p -m 644 %{SOURCE51} ${RPM_BUILD_ROOT}%{_tmpfilesdir}/%{name}-chroot.co
 %global main_man5 named.conf rndc.conf
 %global main_unit named.service named-setup-rndc.service
 %global main_lib filter-{a,aaaa}
+%global main_libexec generate-rndc-key.sh
 
 # Alternatives touches symlinks targets
 for BIN in %{utils_bin1} %{main_bin1} %{dnssec_utils_bin1}; do
@@ -768,6 +769,9 @@ done
   --follower %{_sbindir}/%{1} %{upname}-%{1} %{_sbindir}/%{1}%{program_suffix} \\\
   --follower %{_mandir}/man%{2}/%{1}.%{2}%{manext} %{upname}-%{1}.%{2} %{_mandir}/man%{2}/%{1}%{program_suffix}.%{2}%{manext}
 
+%define altflibexec() \\\
+  --follower %{_libexecdir}/%{1} %{upname}-%{1} %{_libexecdir}/%{name}/%{1}
+
 %define altflibman() \\\
   --follower %{_libdir}/bind/%{1}.so %{upname}-%{1}.so %{_libdir}/bind/%{1}.so%{program_suffix} \\\
   --follower %{_mandir}/man%{2}/%{1}.%{2}%{manext} %{upname}-%{1}.%{2} %{_mandir}/man%{2}/%{1}%{program_suffix}.%{2}%{manext}
@@ -801,6 +805,12 @@ done
       rm -f -- "$MANX"; \
     fi
 
+%define altrmlibexec() \
+    BINX="%{_libexecdir}/%{1}"; \
+    if ! [ -L "$BINX" ] && [ -f "$BINX" ] && [ -x "$BINX" ]; then \
+      rm -f -- "$BINX"; \
+    fi
+
 %define altrmman() \
     MANX="%{_mandir}/man%{2}/%{1}.%{2}%{?manext}"; \
     if ! [ -L "$MANX" ] && [ -f "$MANX" ]; then \
@@ -856,6 +866,10 @@ fi
     %{altrmlibman $LIB 8}
     ALTS+="%{altflibman $LIB 8}"
   done
+  for LIBEXEC in %{main_libexec}; do
+    %{altrmlibexec $LIBEXEC}
+    ALTS+="%{altflibexec $LIBEXEC}"
+  done
   for UNIT in %{main_unit}; do
     %{altrmunit $UNIT}
   done
@@ -1021,6 +1035,7 @@ fi;
 %endif
 %{_libexecdir}/%{name}/generate-rndc-key.sh
 %{_libexecdir}/%{name}/setup-named-softhsm.sh
+%ghost %{_libexecdir}/generate-rndc-key.sh
 # man pages
 %{_mandir}/man1/mdig%{program_suffix}.1*
 %{_mandir}/man1/named-checkconf%{program_suffix}.1*

From f4645b66ad1a8d04c6430ea2ce1e4fdec7bf3792 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 2 Jul 2026 11:48:38 +0200
Subject: [PATCH 440/460] Create compat symlink also for bind-devel includes

Try to preserve original _includedir/bind9 directory. Replace it with
alternatives symlink leading to version explicit includes.
---
 bind.spec | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/bind.spec b/bind.spec
index d82e505..d2af2fb 100644
--- a/bind.spec
+++ b/bind.spec
@@ -300,6 +300,8 @@ Obsoletes: %{name}-lite-devel < 32:9.16.6-3
 Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
 Requires: openssl-devel%{?_isa} libxml2-devel%{?_isa}
 Requires: libcap-devel%{?_isa}
+Requires(post):   %{_bindir}/alternatives
+Requires(postun): %{_bindir}/alternatives
 %upname_compat %{upname}-devel
 %if %{with GSSTSIG}
 Requires: krb5-devel%{?_isa}
@@ -705,6 +707,7 @@ mkdir -p ${RPM_BUILD_ROOT}%{_tmpfilesdir}
 install -p -m 644 %{SOURCE35} ${RPM_BUILD_ROOT}%{_tmpfilesdir}/%{name}.conf
 install -p -m 644 %{SOURCE51} ${RPM_BUILD_ROOT}%{_tmpfilesdir}/%{name}-chroot.conf
 
+mkdir -p ${RPM_BUILD_ROOT}%{_includedir}/bind9
 
 %if %{with DNSTAP}
   %global utils_bin1_dnstap  dnstap-read
@@ -975,6 +978,19 @@ if [ -x %{_sbindir}/selinuxenabled ] && [ -x %{_sbindir}/getsebool ] && [ -x %{_
   fi
 fi
 
+%post devel
+%if "%{program_suffix}" != ""
+  alternatives --install %{_includedir}/bind9 %{upname}-includedir %{_includedir}/bind-%{mver} %{alternatives_prio}
+%endif
+
+%postun devel
+%if "%{program_suffix}" != ""
+if [ $1 -eq 0 ] ; then
+  alternatives --remove %{upname}-includedir %{_includedir}/bind9
+fi
+%endif
+%end
+
 %ldconfig_scriptlets libs
 
 %post chroot
@@ -1175,6 +1191,7 @@ fi;
 %{_libdir}/libisc-%{mver}.so
 %{_libdir}/libisccfg-%{mver}.so
 %{_libdir}/libirs-%{mver}.so
+%ghost %{_includedir}/bind9
 %dir %{bind_include}
 %{bind_include}/isccc
 %{bind_include}/ns

From c42426f28997b5b1b80e0a72b4a0082559c68d99 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 2 Jul 2026 12:42:06 +0200
Subject: [PATCH 441/460] Replace direct dependencies with pkgconfig symbolic
 names

In this case it should help with protobuf-c-devel dependency, because it
is now provided by protobuf3-c-devel. But pkgconfig is used by bind
anyway and it should make it more safe.

Break requires onto separate lines, if they are provided by different
packages. Stylistic change only.
---
 bind.spec | 53 ++++++++++++++++++++++++++++++++---------------------
 1 file changed, 32 insertions(+), 21 deletions(-)

diff --git a/bind.spec b/bind.spec
index d2af2fb..ecd0d0d 100644
--- a/bind.spec
+++ b/bind.spec
@@ -175,26 +175,33 @@ Recommends:     %{name}-utils %{name}-dnssec-utils
 %upname_compat  %{upname}
 Obsoletes:      %{name}-pkcs11 < 32:9.18.4-2
 
-BuildRequires:  gcc, make
-BuildRequires:  openssl-devel, libtool, autoconf, pkgconfig, libcap-devel
+BuildRequires:  gcc
+BuildRequires:  make
+BuildRequires:  pkgconfig(libcrypto) pkgconfig(libssl)
+BuildRequires:  libtool
+BuildRequires:  autoconf
+BuildRequires:  pkgconfig
+BuildRequires:  pkgconfig(libcap)
 %if %{with OPENSSL_ENGINE}
 BuildRequires:  openssl-devel-engine
 %endif
-BuildRequires:  libidn2-devel, libxml2-devel
+BuildRequires:  pkgconfig(libidn2)
+BuildRequires:  pkgconfig(libxml-2.0)
 BuildRequires:  systemd-rpm-macros
 BuildRequires:  selinux-policy
-BuildRequires:  findutils sed
-BuildRequires:  libnghttp2-devel
+BuildRequires:  findutils
+BuildRequires:  sed
+BuildRequires:  pkgconfig(libnghttp2)
 %if %{with JEMALLOC} && 0%{?fedora}
-BuildRequires:  jemalloc-devel
+BuildRequires:  pkgconfig(jemalloc)
 %endif
 %if 0%{?fedora}
 BuildRequires:  gnupg2
 %endif
-BuildRequires:  libuv-devel
+BuildRequires:  pkgconfig(libuv)
 %if %{with UNITTEST}
 # make unit dependencies
-BuildRequires:  libcmocka-devel
+BuildRequires:  pkgconfig(cmocka)
 %endif
 %if %{with UNITTEST} || %{with SYSTEMTEST}
 BuildRequires:  softhsm
@@ -209,23 +216,25 @@ BuildRequires:  python3-hypothesis
 BuildRequires:  iproute
 %endif
 %if %{with GSSTSIG}
-BuildRequires:  krb5-devel
+BuildRequires:  pkgconfig(krb5)
 %endif
 %if %{with LMDB}
-BuildRequires:  lmdb-devel
+BuildRequires:  pkgconfig(lmdb)
 %endif
 %if %{with JSON}
-BuildRequires:  json-c-devel
+BuildRequires:  pkgconfig(json-c)
 %endif
 %if %{with GEOIP2}
-BuildRequires:  libmaxminddb-devel
+BuildRequires:  pkgconfig(libmaxminddb)
 %endif
 %if %{with DNSTAP}
-BuildRequires:  fstrm-devel protobuf-c-devel
+BuildRequires:  pkgconfig(libfstrm)
+BuildRequires:  pkgconfig(libprotobuf-c)
 %endif
 # Needed to regenerate dig.1 manpage
 %if %{with DOC}
-BuildRequires:  python3-sphinx python3-sphinx_rtd_theme
+BuildRequires:  python3-sphinx
+BuildRequires:  python3-sphinx_rtd_theme
 BuildRequires:  doxygen
 %endif
 %if %{with DOCPDF}
@@ -298,25 +307,27 @@ Summary:  Header files and libraries needed for bind-dyndb-ldap
 Provides: %{name}-lite-devel = %{epoch}:%{version}-%{release}
 Obsoletes: %{name}-lite-devel < 32:9.16.6-3
 Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
-Requires: openssl-devel%{?_isa} libxml2-devel%{?_isa}
-Requires: libcap-devel%{?_isa}
+Requires: pkgconfig(libcrypto) pkgconfig(libssl)
+Requires: pkgconfig(libxml-2.0)
+Requires: pkgconfig(libpcap)
 Requires(post):   %{_bindir}/alternatives
 Requires(postun): %{_bindir}/alternatives
 %upname_compat %{upname}-devel
 %if %{with GSSTSIG}
-Requires: krb5-devel%{?_isa}
+Requires: pkgconfig(krb5)
 %endif
 %if %{with LMDB}
-Requires: lmdb-devel%{?_isa}
+Requires: pkgconfig(lmdb)
 %endif
 %if %{with JSON}
-Requires:  json-c-devel%{?_isa}
+Requires:  pkgconfig(json-c)
 %endif
 %if %{with DNSTAP}
-Requires:  fstrm-devel%{?_isa} protobuf-c-devel%{?_isa}
+Requires:  pkgconfig(libfstrm)
+Requires:  pkgconfig(libprotobuf-c)
 %endif
 %if %{with GEOIP2}
-Requires:  libmaxminddb-devel%{?_isa}
+Requires:  pkgconfig(libmaxminddb)
 %endif
 
 %description devel

From 94cc562d63874de562927ffb9a69b9c1172ba9a7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 3 Jul 2026 17:49:24 +0200
Subject: [PATCH 442/460] Fix bind-devel compat link

It points to the non-existent directory. Correct the path to point to
actually used directory for headers.
---
 bind.spec | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/bind.spec b/bind.spec
index ecd0d0d..c42fda4 100644
--- a/bind.spec
+++ b/bind.spec
@@ -991,13 +991,13 @@ fi
 
 %post devel
 %if "%{program_suffix}" != ""
-  alternatives --install %{_includedir}/bind9 %{upname}-includedir %{_includedir}/bind-%{mver} %{alternatives_prio}
+  alternatives --install %{_includedir}/bind9 %{upname}-includedir %{bind_include} %{alternatives_prio}
 %endif
 
 %postun devel
 %if "%{program_suffix}" != ""
 if [ $1 -eq 0 ] ; then
-  alternatives --remove %{upname}-includedir %{_includedir}/bind9
+  alternatives --remove %{upname}-includedir %{bind_include}
 fi
 %endif
 %end

From 78e7e9e5ff4c8f5d4a112f99945ce5c1973566d5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 8 Jul 2026 19:53:21 +0200
Subject: [PATCH 443/460] Fix filter-{a,aaaa}.so unexpanded with ghost flag

The same trick that worked fine for normal files does not work on ghost
file. %ghost flag seems to require only single file after it. Shell is
not expanded, but used in the name.
---
 bind.spec | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/bind.spec b/bind.spec
index c42fda4..ef4be45 100644
--- a/bind.spec
+++ b/bind.spec
@@ -1048,7 +1048,8 @@ fi;
 %{_sbindir}/rndc-confgen%{program_suffix}
 %ghost %{_unitdir}/named.service
 %ghost %{_unitdir}/named-setup-rndc.service
-%ghost %{_libdir}/bind/filter-{a,aaaa}.so
+%ghost %attr(0755,-,-) %{_libdir}/bind/filter-a.so
+%ghost %attr(0755,-,-) %{_libdir}/bind/filter-aaaa.so
 %ghost %{_bindir}/named-checkconf
 %ghost %{_bindir}/named-journalprint
 %ghost %{_bindir}/named-rrchecker
@@ -1083,7 +1084,8 @@ fi;
 %ghost %{_mandir}/man8/rndc.8*
 %ghost %{_mandir}/man8/named.8*
 %ghost %{_mandir}/man8/rndc-confgen.8*
-%ghost %{_mandir}/man8/filter-{a,aaaa}.8*
+%ghost %attr(0644,-,-) %{_mandir}/man8/filter-a.8*
+%ghost %attr(0644,-,-) %{_mandir}/man8/filter-aaaa.8*
 %doc README.md named.conf.default
 %doc sample/
 

From 0049ee45a47d990c4678ba8af1c00e8723192b01 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 8 Jul 2026 20:32:23 +0200
Subject: [PATCH 444/460] Ghost files do not need explicit touch anymore

Touches for ghost files are not necessary for a long time. Drop extra
touches. Use %attr instead to generate good permissions on such files.

Found at:
https://github.com/rpm-software-management/rpm/discussions/3380
---
 bind.spec | 131 ++++++++++++++++++++++--------------------------------
 1 file changed, 52 insertions(+), 79 deletions(-)

diff --git a/bind.spec b/bind.spec
index ef4be45..f8d0be2 100644
--- a/bind.spec
+++ b/bind.spec
@@ -672,9 +672,6 @@ done
 cp -p doc/arm/_build/latex/Bv9ARM.pdf ${RPM_BUILD_ROOT}%{_pkgdocdir}
 %endif
 
-# Ghost config files:
-touch ${RPM_BUILD_ROOT}%{_localstatedir}/log/named.log
-
 # configuration files:
 install -m 640 %{SOURCE16} ${RPM_BUILD_ROOT}%{_sysconfdir}/named.conf
 touch ${RPM_BUILD_ROOT}%{_sysconfdir}/rndc.{key,conf}
@@ -737,30 +734,6 @@ mkdir -p ${RPM_BUILD_ROOT}%{_includedir}/bind9
 %global main_lib filter-{a,aaaa}
 %global main_libexec generate-rndc-key.sh
 
-# Alternatives touches symlinks targets
-for BIN in %{utils_bin1} %{main_bin1} %{dnssec_utils_bin1}; do
-  install -m 0755 /dev/null ${RPM_BUILD_ROOT}%{_bindir}/${BIN}
-  touch ${RPM_BUILD_ROOT}%{_mandir}/man1/${BIN}.1
-done
-
-for BIN in %{main_bin8}; do
-  install -m 0755 /dev/null ${RPM_BUILD_ROOT}%{_sbindir}/${BIN}
-  touch ${RPM_BUILD_ROOT}%{_mandir}/man8/${BIN}.8
-done
-
-for MAN in %{main_man5}; do
-  touch ${RPM_BUILD_ROOT}%{_mandir}/man5/$MAN.5
-done
-for MAN in %{utils_bin8}; do
-  touch ${RPM_BUILD_ROOT}%{_mandir}/man8/$MAN.8
-done
-
-# named-chroot*.service are missing intentionally now
-# let bind*-chroot conflict
-for UNIT in %{main_unit}; do
-  touch ${RPM_BUILD_ROOT}%{_unitdir}/$UNIT
-done
-
 
 %define altfbin() \\\
   --follower %{_bindir}/%{1} %{upname}-%{1} %{_bindir}/%{1}%{program_suffix}
@@ -1046,24 +1019,24 @@ fi;
 %{_sbindir}/named%{program_suffix}
 %{_sbindir}/rndc%{program_suffix}
 %{_sbindir}/rndc-confgen%{program_suffix}
-%ghost %{_unitdir}/named.service
-%ghost %{_unitdir}/named-setup-rndc.service
+%ghost %attr(0644,-,-) %{_unitdir}/named.service
+%ghost %attr(0644,-,-) %{_unitdir}/named-setup-rndc.service
 %ghost %attr(0755,-,-) %{_libdir}/bind/filter-a.so
 %ghost %attr(0755,-,-) %{_libdir}/bind/filter-aaaa.so
-%ghost %{_bindir}/named-checkconf
-%ghost %{_bindir}/named-journalprint
-%ghost %{_bindir}/named-rrchecker
-%ghost %{_bindir}/mdig
-%ghost %{_sbindir}/named
-%ghost %{_sbindir}/rndc
-%ghost %{_sbindir}/rndc-confgen
+%ghost %attr(0755,-,-) %{_bindir}/named-checkconf
+%ghost %attr(0755,-,-) %{_bindir}/named-journalprint
+%ghost %attr(0755,-,-) %{_bindir}/named-rrchecker
+%ghost %attr(0755,-,-) %{_bindir}/mdig
+%ghost %attr(0755,-,-) %{_sbindir}/named
+%ghost %attr(0755,-,-) %{_sbindir}/rndc
+%ghost %attr(0755,-,-) %{_sbindir}/rndc-confgen
 %if "%{_sbindir}" != "%{_bindir}"
 %{_sbindir}/named-checkconf%{program_suffix}
-%ghost %{_sbindir}/named-checkconf
+%ghost %attr(0755,-,-) %{_sbindir}/named-checkconf
 %endif
 %{_libexecdir}/%{name}/generate-rndc-key.sh
 %{_libexecdir}/%{name}/setup-named-softhsm.sh
-%ghost %{_libexecdir}/generate-rndc-key.sh
+%ghost %attr(0755,-,-) %{_libexecdir}/generate-rndc-key.sh
 # man pages
 %{_mandir}/man1/mdig%{program_suffix}.1*
 %{_mandir}/man1/named-checkconf%{program_suffix}.1*
@@ -1075,15 +1048,15 @@ fi;
 %{_mandir}/man8/named%{program_suffix}.8*
 %{_mandir}/man8/rndc-confgen%{program_suffix}.8*
 %{_mandir}/man8/filter-{a,aaaa}%{program_suffix}.8*
-%ghost %{_mandir}/man1/mdig.1*
-%ghost %{_mandir}/man1/named-checkconf.1*
-%ghost %{_mandir}/man1/named-journalprint.1*
-%ghost %{_mandir}/man1/named-rrchecker.1*
-%ghost %{_mandir}/man5/named.conf.5*
-%ghost %{_mandir}/man5/rndc.conf.5*
-%ghost %{_mandir}/man8/rndc.8*
-%ghost %{_mandir}/man8/named.8*
-%ghost %{_mandir}/man8/rndc-confgen.8*
+%ghost %attr(0644,-,-) %{_mandir}/man1/mdig.1*
+%ghost %attr(0644,-,-) %{_mandir}/man1/named-checkconf.1*
+%ghost %attr(0644,-,-) %{_mandir}/man1/named-journalprint.1*
+%ghost %attr(0644,-,-) %{_mandir}/man1/named-rrchecker.1*
+%ghost %attr(0644,-,-) %{_mandir}/man5/named.conf.5*
+%ghost %attr(0644,-,-) %{_mandir}/man5/rndc.conf.5*
+%ghost %attr(0644,-,-) %{_mandir}/man8/rndc.8*
+%ghost %attr(0644,-,-) %{_mandir}/man8/named.8*
+%ghost %attr(0644,-,-) %{_mandir}/man8/rndc-confgen.8*
 %ghost %attr(0644,-,-) %{_mandir}/man8/filter-a.8*
 %ghost %attr(0644,-,-) %{_mandir}/man8/filter-aaaa.8*
 %doc README.md named.conf.default
@@ -1100,7 +1073,7 @@ fi;
 %dir %{_localstatedir}/named/slaves
 %dir %{_localstatedir}/named/data
 %dir %{_localstatedir}/named/dynamic
-%ghost %{_localstatedir}/log/named.log
+%ghost %attr(0644,named,named) %{_localstatedir}/log/named.log
 %defattr(0640,root,named,0750)
 %{_datadir}/named/
 %config %verify(not link) %{_localstatedir}/named/named.ca
@@ -1108,9 +1081,9 @@ fi;
 %config %verify(not link) %{_localstatedir}/named/named.localhost
 %config %verify(not link) %{_localstatedir}/named/named.loopback
 %config %verify(not link) %{_localstatedir}/named/named.empty
-%ghost %config(noreplace) %{_sysconfdir}/rndc.key
+%ghost %attr(0640,root,named) %config(noreplace) %{_sysconfdir}/rndc.key
 # ^- rndc.key now created on first install only if it does not exist
-%ghost %config(noreplace) %{_sysconfdir}/rndc.conf
+%ghost %attr(0640,root,named) %config(noreplace) %{_sysconfdir}/rndc.conf
 # ^- The default rndc.conf which uses rndc.key is in named's default internal config -
 #    so rndc.conf is not necessary.
 %defattr(-,named,named,-)
@@ -1139,17 +1112,17 @@ fi;
 %{_bindir}/named-compilezone%{program_suffix}
 %{_sbindir}/ddns-confgen%{program_suffix}
 %{_sbindir}/tsig-keygen%{program_suffix}
-%ghost %{_bindir}/arpaname
-%ghost %{_bindir}/delv
-%ghost %{_bindir}/dig
-%ghost %{_bindir}/host
-%ghost %{_bindir}/nsec3hash
-%ghost %{_bindir}/nslookup
-%ghost %{_bindir}/nsupdate
-%ghost %{_bindir}/named-checkzone
-%ghost %{_bindir}/named-compilezone
-%ghost %{_sbindir}/ddns-confgen
-%ghost %{_sbindir}/tsig-keygen
+%ghost %attr(0755,-,-) %{_bindir}/arpaname
+%ghost %attr(0755,-,-) %{_bindir}/delv
+%ghost %attr(0755,-,-) %{_bindir}/dig
+%ghost %attr(0755,-,-) %{_bindir}/host
+%ghost %attr(0755,-,-) %{_bindir}/nsec3hash
+%ghost %attr(0755,-,-) %{_bindir}/nslookup
+%ghost %attr(0755,-,-) %{_bindir}/nsupdate
+%ghost %attr(0755,-,-) %{_bindir}/named-checkzone
+%ghost %attr(0755,-,-) %{_bindir}/named-compilezone
+%ghost %attr(0755,-,-) %{_sbindir}/ddns-confgen
+%ghost %attr(0755,-,-) %{_sbindir}/tsig-keygen
 %if "%{_sbindir}" != "%{_bindir}"
 %{_sbindir}/named-checkzone
 %{_sbindir}/named-compilezone
@@ -1157,14 +1130,14 @@ fi;
 %if %{with DNSTAP}
 %{_bindir}/dnstap-read%{program_suffix}
 %{_mandir}/man1/dnstap-read%{program_suffix}.1*
-%ghost %{_bindir}/dnstap-read
-%ghost %{_mandir}/man1/dnstap-read.1*
+%ghost %attr(0755,-,-) %{_bindir}/dnstap-read
+%ghost %attr(0644,-,-) %{_mandir}/man1/dnstap-read.1*
 %endif
 %if %{with LMDB}
 %{_bindir}/named-nzd2nzf%{program_suffix}
 %{_mandir}/man1/named-nzd2nzf%{program_suffix}.1*
-%ghost %{_bindir}/named-nzd2nzf
-%ghost %{_mandir}/man1/named-nzd2nzf.1*
+%ghost %attr(0755,-,-) %{_bindir}/named-nzd2nzf
+%ghost %attr(0644,-,-) %{_mandir}/man1/named-nzd2nzf.1*
 %endif
 %{_mandir}/man1/arpaname%{program_suffix}.1*
 %{_mandir}/man1/delv%{program_suffix}.1*
@@ -1177,24 +1150,24 @@ fi;
 %{_mandir}/man1/named-compilezone%{program_suffix}.1*
 %{_mandir}/man8/ddns-confgen%{program_suffix}.8*
 %{_mandir}/man8/tsig-keygen%{program_suffix}.8*
-%ghost %{_mandir}/man1/arpaname.1*
-%ghost %{_mandir}/man1/delv.1*
-%ghost %{_mandir}/man1/dig.1*
-%ghost %{_mandir}/man1/host.1*
-%ghost %{_mandir}/man1/nslookup.1*
-%ghost %{_mandir}/man1/nsupdate.1*
-%ghost %{_mandir}/man1/nsec3hash.1*
-%ghost %{_mandir}/man1/named-checkzone.1*
-%ghost %{_mandir}/man1/named-compilezone.1*
-%ghost %{_mandir}/man8/ddns-confgen.8*
-%ghost %{_mandir}/man8/tsig-keygen.8*
+%ghost %attr(0644,-,-) %{_mandir}/man1/arpaname.1*
+%ghost %attr(0644,-,-) %{_mandir}/man1/delv.1*
+%ghost %attr(0644,-,-) %{_mandir}/man1/dig.1*
+%ghost %attr(0644,-,-) %{_mandir}/man1/host.1*
+%ghost %attr(0644,-,-) %{_mandir}/man1/nslookup.1*
+%ghost %attr(0644,-,-) %{_mandir}/man1/nsupdate.1*
+%ghost %attr(0644,-,-) %{_mandir}/man1/nsec3hash.1*
+%ghost %attr(0644,-,-) %{_mandir}/man1/named-checkzone.1*
+%ghost %attr(0644,-,-) %{_mandir}/man1/named-compilezone.1*
+%ghost %attr(0644,-,-) %{_mandir}/man8/ddns-confgen.8*
+%ghost %attr(0644,-,-) %{_mandir}/man8/tsig-keygen.8*
 %{_sysconfdir}/trusted-key.key
 
 %files dnssec-utils
 %{_bindir}/%{dnssec_utils_bin1}%{program_suffix}
 %{_mandir}/man1/%{dnssec_utils_bin1}%{program_suffix}.1*
-%ghost %{_bindir}/%{dnssec_utils_bin1}
-%ghost %{_mandir}/man1/%{dnssec_utils_bin1}.1*
+%ghost %attr(0755,-,-) %{_bindir}/%{dnssec_utils_bin1}
+%ghost %attr(0644,-,-) %{_mandir}/man1/%{dnssec_utils_bin1}.1*
 
 %files devel
 %{_libdir}/libbind9-%{mver}.so
@@ -1204,7 +1177,7 @@ fi;
 %{_libdir}/libisc-%{mver}.so
 %{_libdir}/libisccfg-%{mver}.so
 %{_libdir}/libirs-%{mver}.so
-%ghost %{_includedir}/bind9
+%ghost %attr(0755,-,-) %{_includedir}/bind9
 %dir %{bind_include}
 %{bind_include}/isccc
 %{bind_include}/ns

From 046122bd9e39a537b004b89517bbeb575c3fe7cd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 8 Jul 2026 20:43:09 +0200
Subject: [PATCH 445/460] Fix ghost man pages suffix

Classic shell glob star does not work on non-existing files. Use
explicit man page suffix. It needs to be defined for use in alternatives
anyway.
---
 bind.spec | 46 +++++++++++++++++++++++-----------------------
 1 file changed, 23 insertions(+), 23 deletions(-)

diff --git a/bind.spec b/bind.spec
index f8d0be2..f69351a 100644
--- a/bind.spec
+++ b/bind.spec
@@ -1048,17 +1048,17 @@ fi;
 %{_mandir}/man8/named%{program_suffix}.8*
 %{_mandir}/man8/rndc-confgen%{program_suffix}.8*
 %{_mandir}/man8/filter-{a,aaaa}%{program_suffix}.8*
-%ghost %attr(0644,-,-) %{_mandir}/man1/mdig.1*
-%ghost %attr(0644,-,-) %{_mandir}/man1/named-checkconf.1*
-%ghost %attr(0644,-,-) %{_mandir}/man1/named-journalprint.1*
-%ghost %attr(0644,-,-) %{_mandir}/man1/named-rrchecker.1*
-%ghost %attr(0644,-,-) %{_mandir}/man5/named.conf.5*
-%ghost %attr(0644,-,-) %{_mandir}/man5/rndc.conf.5*
-%ghost %attr(0644,-,-) %{_mandir}/man8/rndc.8*
-%ghost %attr(0644,-,-) %{_mandir}/man8/named.8*
-%ghost %attr(0644,-,-) %{_mandir}/man8/rndc-confgen.8*
-%ghost %attr(0644,-,-) %{_mandir}/man8/filter-a.8*
-%ghost %attr(0644,-,-) %{_mandir}/man8/filter-aaaa.8*
+%ghost %attr(0644,-,-) %{_mandir}/man1/mdig.1%{manext}
+%ghost %attr(0644,-,-) %{_mandir}/man1/named-checkconf.1%{manext}
+%ghost %attr(0644,-,-) %{_mandir}/man1/named-journalprint.1%{manext}
+%ghost %attr(0644,-,-) %{_mandir}/man1/named-rrchecker.1%{manext}
+%ghost %attr(0644,-,-) %{_mandir}/man5/named.conf.5%{manext}
+%ghost %attr(0644,-,-) %{_mandir}/man5/rndc.conf.5%{manext}
+%ghost %attr(0644,-,-) %{_mandir}/man8/rndc.8%{manext}
+%ghost %attr(0644,-,-) %{_mandir}/man8/named.8%{manext}
+%ghost %attr(0644,-,-) %{_mandir}/man8/rndc-confgen.8%{manext}
+%ghost %attr(0644,-,-) %{_mandir}/man8/filter-a.8%{manext}
+%ghost %attr(0644,-,-) %{_mandir}/man8/filter-aaaa.8%{manext}
 %doc README.md named.conf.default
 %doc sample/
 
@@ -1150,24 +1150,24 @@ fi;
 %{_mandir}/man1/named-compilezone%{program_suffix}.1*
 %{_mandir}/man8/ddns-confgen%{program_suffix}.8*
 %{_mandir}/man8/tsig-keygen%{program_suffix}.8*
-%ghost %attr(0644,-,-) %{_mandir}/man1/arpaname.1*
-%ghost %attr(0644,-,-) %{_mandir}/man1/delv.1*
-%ghost %attr(0644,-,-) %{_mandir}/man1/dig.1*
-%ghost %attr(0644,-,-) %{_mandir}/man1/host.1*
-%ghost %attr(0644,-,-) %{_mandir}/man1/nslookup.1*
-%ghost %attr(0644,-,-) %{_mandir}/man1/nsupdate.1*
-%ghost %attr(0644,-,-) %{_mandir}/man1/nsec3hash.1*
-%ghost %attr(0644,-,-) %{_mandir}/man1/named-checkzone.1*
-%ghost %attr(0644,-,-) %{_mandir}/man1/named-compilezone.1*
-%ghost %attr(0644,-,-) %{_mandir}/man8/ddns-confgen.8*
-%ghost %attr(0644,-,-) %{_mandir}/man8/tsig-keygen.8*
+%ghost %attr(0644,-,-) %{_mandir}/man1/arpaname.1%{manext}
+%ghost %attr(0644,-,-) %{_mandir}/man1/delv.1%{manext}
+%ghost %attr(0644,-,-) %{_mandir}/man1/dig.1%{manext}
+%ghost %attr(0644,-,-) %{_mandir}/man1/host.1%{manext}
+%ghost %attr(0644,-,-) %{_mandir}/man1/nslookup.1%{manext}
+%ghost %attr(0644,-,-) %{_mandir}/man1/nsupdate.1%{manext}
+%ghost %attr(0644,-,-) %{_mandir}/man1/nsec3hash.1%{manext}
+%ghost %attr(0644,-,-) %{_mandir}/man1/named-checkzone.1%{manext}
+%ghost %attr(0644,-,-) %{_mandir}/man1/named-compilezone.1%{manext}
+%ghost %attr(0644,-,-) %{_mandir}/man8/ddns-confgen.8%{manext}
+%ghost %attr(0644,-,-) %{_mandir}/man8/tsig-keygen.8%{manext}
 %{_sysconfdir}/trusted-key.key
 
 %files dnssec-utils
 %{_bindir}/%{dnssec_utils_bin1}%{program_suffix}
 %{_mandir}/man1/%{dnssec_utils_bin1}%{program_suffix}.1*
 %ghost %attr(0755,-,-) %{_bindir}/%{dnssec_utils_bin1}
-%ghost %attr(0644,-,-) %{_mandir}/man1/%{dnssec_utils_bin1}.1*
+%ghost %attr(0644,-,-) %{_mandir}/man1/%{dnssec_utils_bin1}.1%{manext}
 
 %files devel
 %{_libdir}/libbind9-%{mver}.so

From 211a5b09a632dccafcca84067e5ef4361f5b92d5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 13 Jul 2026 16:58:28 +0200
Subject: [PATCH 446/460] Switch to _sbindir/alternatives

It is in sbin in CentOS. But on Fedora it is equivalent.
---
 bind.spec | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/bind.spec b/bind.spec
index f69351a..2cdd2fe 100644
--- a/bind.spec
+++ b/bind.spec
@@ -168,8 +168,8 @@ Requires:       coreutils
 Requires(post): shadow-utils
 Requires(post): glibc-common
 Requires(post): grep
-Requires(post):   %{_bindir}/alternatives
-Requires(postun): %{_bindir}/alternatives
+Requires(post):   %{_sbindir}/alternatives
+Requires(postun): %{_sbindir}/alternatives
 Requires:       %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
 Recommends:     %{name}-utils %{name}-dnssec-utils
 %upname_compat  %{upname}
@@ -270,8 +270,8 @@ Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
 # For compatibility with Debian package
 Provides: dnsutils = %{epoch}:%{version}-%{release}
 Obsoletes: %{name}-pkcs11-utils < 32:9.18.4-2
-Requires(post):   %{_bindir}/alternatives
-Requires(postun): %{_bindir}/alternatives
+Requires(post):   %{_sbindir}/alternatives
+Requires(postun): %{_sbindir}/alternatives
 %upname_compat %{upname}-utils
 
 %description utils
@@ -290,8 +290,8 @@ Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
 Recommends: %{name}-utils
 Obsoletes: python3-%{name} < 32:9.18.0
 Obsoletes: %{name}-dnssec-doc < 32:9.18.4-2
-Requires(post):   %{_bindir}/alternatives
-Requires(postun): %{_bindir}/alternatives
+Requires(post):   %{_sbindir}/alternatives
+Requires(postun): %{_sbindir}/alternatives
 %upname_compat %{upname}-dnssec-utils
 
 %description dnssec-utils
@@ -310,8 +310,8 @@ Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
 Requires: pkgconfig(libcrypto) pkgconfig(libssl)
 Requires: pkgconfig(libxml-2.0)
 Requires: pkgconfig(libpcap)
-Requires(post):   %{_bindir}/alternatives
-Requires(postun): %{_bindir}/alternatives
+Requires(post):   %{_sbindir}/alternatives
+Requires(postun): %{_sbindir}/alternatives
 %upname_compat %{upname}-devel
 %if %{with GSSTSIG}
 Requires: pkgconfig(krb5)

From fbbe880e062e9e0937f6f5e1f90e35c8be370cf2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 13 Jul 2026 17:02:01 +0200
Subject: [PATCH 447/460] fixup! Replace direct dependencies with pkgconfig
 symbolic names

---
 bind.spec | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index 2cdd2fe..a29bad8 100644
--- a/bind.spec
+++ b/bind.spec
@@ -309,7 +309,7 @@ Obsoletes: %{name}-lite-devel < 32:9.16.6-3
 Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
 Requires: pkgconfig(libcrypto) pkgconfig(libssl)
 Requires: pkgconfig(libxml-2.0)
-Requires: pkgconfig(libpcap)
+Requires: pkgconfig(libcap)
 Requires(post):   %{_sbindir}/alternatives
 Requires(postun): %{_sbindir}/alternatives
 %upname_compat %{upname}-devel

From 55c3f8e6d3577eeeaa80d74ddf2c872ce213e86d Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Wed, 15 Jul 2026 20:11:13 +0000
Subject: [PATCH 448/460] Rebuilt for
 https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild


From 3a99b5a25e4ce9e1ff97709cf96a9150b02bb2bb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 25 Aug 2026 12:19:35 +0200
Subject: [PATCH 449/460] Potential wildcard CNAME RPZ policy bypass
 (CVE-2026-11331)

[9.18] [CVE-2026-11331] sec: usr: Fix handling of rpz CNAME expansion that returns name too long

Previously, if the expansion of a wildcard CNAME RPZ policy resulted in a name that exceeded the length limit, a self referential CNAME and the original address record were returned, allowing the policy to be bypassed.  In branches up to 9.20, this also left query processing in an inconsistent state which could trigger an assertion failure.  We now return a YXDOMAIN response, without the address.

ISC would like to thank Laith Mash'al (0xmshal) for bringing this issue to our attention.

Closes https://gitlab.isc.org/isc-projects/bind9/-/issues/5856
---
 bind-9.18-CVE-2026-11331-test.patch | 69 +++++++++++++++++++++++++++++
 bind-9.18-CVE-2026-11331.patch      | 31 +++++++++++++
 bind.spec                           |  4 ++
 3 files changed, 104 insertions(+)
 create mode 100644 bind-9.18-CVE-2026-11331-test.patch
 create mode 100644 bind-9.18-CVE-2026-11331.patch

diff --git a/bind-9.18-CVE-2026-11331-test.patch b/bind-9.18-CVE-2026-11331-test.patch
new file mode 100644
index 0000000..27aa6cc
--- /dev/null
+++ b/bind-9.18-CVE-2026-11331-test.patch
@@ -0,0 +1,69 @@
+From cde8bb21e09205a7bd1f41fd07ed011fc80d8d71 Mon Sep 17 00:00:00 2001
+From: Mark Andrews <marka@isc.org>
+Date: Fri, 10 Apr 2026 10:24:06 +1000
+Subject: [PATCH] Fix TTL extraction from A/AAAA record
+
+(cherry picked from commit 89c86e338db2492b92e6618c586f146c6928dc6d)
+(cherry picked from commit adc8285d23e2eac6ec463f5dbc5a9596fdd36c60)
+
+Check rpz name too long wildcard CNAME expansion handling
+
+(cherry picked from commit 9345394e2097031b55b3ef34ceaadf5a7ebbeef2)
+(cherry picked from commit 095b11f20f911f5b8059bdc349b256d6c64ece30)
+---
+ bin/tests/system/rpz/ns2/tld2.db | 2 ++
+ bin/tests/system/rpz/ns4/tld4.db | 2 ++
+ bin/tests/system/rpz/tests.sh    | 7 +++++--
+ 3 files changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/bin/tests/system/rpz/ns2/tld2.db b/bin/tests/system/rpz/ns2/tld2.db
+index c6f2556db5..c091ee27b7 100644
+--- a/bin/tests/system/rpz/ns2/tld2.db
++++ b/bin/tests/system/rpz/ns2/tld2.db
+@@ -123,3 +123,5 @@ a7-1		A	192.168.7.1
+ 
+ a7-2		A	192.168.7.2
+ 		TXT	"a7-2 tld2 text"
++
++*.wild		A	192.168.9.1
+diff --git a/bin/tests/system/rpz/ns4/tld4.db b/bin/tests/system/rpz/ns4/tld4.db
+index fca419c6dd..8accd76baf 100644
+--- a/bin/tests/system/rpz/ns4/tld4.db
++++ b/bin/tests/system/rpz/ns4/tld4.db
+@@ -59,6 +59,8 @@ a3-6.tld2	A	56.56.56.56
+ 
+ a3-7.sub1.tld2	A	57.57.57.57
+ 
++*.wild.sub1.tld2	A	57.57.57.57
++
+ a3-8.tld2	A	58.58.58.58
+ 
+ a3-9.sub9.tld2	A	59.59.59.59
+diff --git a/bin/tests/system/rpz/tests.sh b/bin/tests/system/rpz/tests.sh
+index 87e4118ca3..5297437694 100644
+--- a/bin/tests/system/rpz/tests.sh
++++ b/bin/tests/system/rpz/tests.sh
+@@ -391,7 +391,7 @@ addr() {
+   digcmd $2 >$DIGNM
+   #ckalive "$2" "server crashed by 'dig $2'" || return 1
+   ADDR_ESC=$(echo "$ADDR" | sed -e 's/\./\\./g')
+-  ADDR_TTL=$(sed -n -e "s/^[-.a-z0-9]\{1,\}[	 ]*\([0-9]*\)	IN	AA*	${ADDR_ESC}\$/\1/p" $DIGNM)
++  ADDR_TTL=$(sed -n -e "s/^[-.a-z0-9]\{1,\}[	 ]*\([0-9]*\)[ 	]IN[ 	]AA*[ 	]${ADDR_ESC}\$/\1/p" $DIGNM)
+   if test -z "$ADDR_TTL"; then
+     setret "'dig $2' wrong; no address $ADDR record in $DIGNM"
+     return 0
+@@ -516,7 +516,10 @@ nochange TCP a3-9.tld2                # 33 tcp-only
+ here x.servfail <<'EOF'               # 34 qname-wait-recurse yes
+   ;; status: SERVFAIL, x
+ EOF
+-addr 35.35.35.35 "x.servfail @$ns5" # 35 qname-wait-recurse no
++addr 35.35.35.35 "x.servfail @$ns5"                                                                                                                                                                                                                                    # 35 qname-wait-recurse no
++here aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.wild.sub1.tld2 <<'EOF' # 36 wildcard CNAME name to long
++    ;; status: YXDOMAIN, x
++EOF
+ end_group
+ ckstats $ns3 test1 ns3 22
+ ckstats $ns5 test1 ns5 1
+-- 
+2.55.0
+
diff --git a/bind-9.18-CVE-2026-11331.patch b/bind-9.18-CVE-2026-11331.patch
new file mode 100644
index 0000000..8baa98c
--- /dev/null
+++ b/bind-9.18-CVE-2026-11331.patch
@@ -0,0 +1,31 @@
+From 49f4cc4e93f14f1d5b6a472124e6aa457167fede Mon Sep 17 00:00:00 2001
+From: Mark Andrews <marka@isc.org>
+Date: Fri, 10 Apr 2026 10:26:14 +1000
+Subject: [PATCH] Properly handle rpz name to long wildcard expansion
+
+Previously a self referential CNAME and the original address
+record were returned.  We now return a YXDOMAIN response.
+
+(cherry picked from commit cfc4c4f69870ce492deaaa429453563d1621ded3)
+(cherry picked from commit dc328a199f96222e0c30cc20b7b795bfc2c9b2e4)
+---
+ lib/ns/query.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/lib/ns/query.c b/lib/ns/query.c
+index d3a10be9ba..3bd7daf79c 100644
+--- a/lib/ns/query.c
++++ b/lib/ns/query.c
+@@ -7591,7 +7591,8 @@ query_rpzcname(query_ctx_t *qctx, dns_name_t *cname) {
+ 					      qctx->fname, NULL);
+ 		if (result == DNS_R_NAMETOOLONG) {
+ 			client->message->rcode = dns_rcode_yxdomain;
+-		} else if (result != ISC_R_SUCCESS) {
++		}
++		if (result != ISC_R_SUCCESS) {
+ 			return result;
+ 		}
+ 	} else {
+-- 
+2.55.0
+
diff --git a/bind.spec b/bind.spec
index a29bad8..bbe677d 100644
--- a/bind.spec
+++ b/bind.spec
@@ -160,6 +160,10 @@ Patch33: bind-9.18-dig-idn-input-always.patch
 Patch34: bind-9.18-dig-idn-input-always-test.patch
 # downstream only, https://redhat.atlassian.net/browse/IDM-6189
 Patch35: 0001-Use-variable-PROGRAM_SUFFIX-in-install-target.patch
+# https://gitlab.isc.org/isc-projects/bind9/commit/4fd0755bdd08471f74e6e4c76cd2326f356e0a61
+# https://gitlab.isc.org/isc-projects/bind9/-/work_items/5856
+Patch36: bind-9.18-CVE-2026-11331.patch
+Patch37: bind-9.18-CVE-2026-11331-test.patch
 
 %{?systemd_ordering}
 # https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers

From c72c35866e76095ca27413a6473f31d1fb8fd4c1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 25 Aug 2026 12:25:22 +0200
Subject: [PATCH 450/460] Key Record using PRIVATEDNS algorithm may lead to
 exit (CVE-2026-10822)

[9.18] [CVE-2026-10822] sec: usr: Fix dns_name_fromwire to record boundaries

Previously, `dns_name_fromwire()` did not honor the record boundary when reading names from the wire, allowing malformed records to be accepted when they should not have been. This has been fixed.

Closes: https://gitlab.isc.org/isc-projects/bind9/-/issues/6004
---
 bind-9.18-CVE-2026-10822-test.patch | 320 ++++++++++++++++++++++++++++
 bind-9.18-CVE-2026-10822.patch      |  54 +++++
 bind.spec                           |   3 +
 3 files changed, 377 insertions(+)
 create mode 100644 bind-9.18-CVE-2026-10822-test.patch
 create mode 100644 bind-9.18-CVE-2026-10822.patch

diff --git a/bind-9.18-CVE-2026-10822-test.patch b/bind-9.18-CVE-2026-10822-test.patch
new file mode 100644
index 0000000..f95514f
--- /dev/null
+++ b/bind-9.18-CVE-2026-10822-test.patch
@@ -0,0 +1,320 @@
+From a4ce4c0ce5b8d7630417730dc1b98bf554e0801f Mon Sep 17 00:00:00 2001
+From: Mark Andrews <marka@isc.org>
+Date: Tue, 19 May 2026 10:44:04 +1000
+Subject: [PATCH] Check that dns_name_fromwire honours the active region
+
+When reading DNS records from the wire the active region of the
+source buffer is set to the end of the current record. dns_name_fromwire
+should fail if it attempts to read past this setting.
+
+(cherry picked from commit 3ed821d68b15fe4e6288e3054397d6bce7e65968)
+(cherry picked from commit d413c9ac2e29a728531354a69c8c8234c01b7d1e)
+
+Check that a short PRIVATEDNS record is rejected
+
+A bug in dns_name_fromwire meant that short PRIVATEDNS key
+records where being accepted.  Test that this is no longer
+the case.
+
+(cherry picked from commit f48d48027384d8c2210b5ce9e3eac7af101ead3d)
+(cherry picked from commit 19ac8b8e46aeb0a15e217bc7bdf485b31b87d9b4)
+
+POC for PRIVATEDNS DNSKEY overrun not being detected
+
+Construct a DNS message where a PRIVATEDNS DNSKEY identifier
+overruns the record boundary by 3 byte so that the label ends
+at the end of the compression pointer for the next record. The
+next type is less than 256 so the next octet is 00 terminating
+the identifier name.  The transfered zone is then written to
+disk using master-format text triggering the assertion when the
+truncated identier is discovered.
+
+Note this test will produce a false result in versions of
+BIND that do not check the PRIVATEDNS identifier as it looks
+for the error message when the transfer is aborted.
+
+(cherry picked from commit 9ce3bce8bc8b4e9c6a9b1e84b5849c33eb27830e)
+(cherry picked from commit 8e066d3fc369e3346f22bb5cfb67a7ab08a74034)
+---
+ bin/tests/system/xfer/ans9/ans.py       | 142 ++++++++++++++++++++++++
+ bin/tests/system/xfer/ns6/named.conf.in |   9 ++
+ bin/tests/system/xfer/tests.sh          |  16 +++
+ tests/dns/name_test.c                   |  30 +++++
+ tests/dns/rdata_test.c                  |  21 ++++
+ 5 files changed, 218 insertions(+)
+ create mode 100644 bin/tests/system/xfer/ans9/ans.py
+
+diff --git a/bin/tests/system/xfer/ans9/ans.py b/bin/tests/system/xfer/ans9/ans.py
+new file mode 100644
+index 0000000000..a9e73953ee
+--- /dev/null
++++ b/bin/tests/system/xfer/ans9/ans.py
+@@ -0,0 +1,142 @@
++"""
++Copyright (C) Internet Systems Consortium, Inc. ("ISC")
++
++SPDX-License-Identifier: MPL-2.0
++
++This Source Code Form is subject to the terms of the Mozilla Public
++License, v. 2.0.  If a copy of the MPL was not distributed with this
++file, you can obtain one at https://mozilla.org/MPL/2.0/.
++
++See the COPYRIGHT file distributed with this work for additional
++information regarding copyright ownership.
++"""
++
++from collections.abc import AsyncGenerator
++
++import dns.name
++import dns.rcode
++import dns.rdatatype
++import dns.rrset
++
++from isctest.asyncserver import (
++    ControllableAsyncDnsServer,
++    DnsResponseSend,
++    DomainHandler,
++    QueryContext,
++    ResponseAction,
++    ToggleResponsesCommand,
++)
++
++
++class AXFRServer(DomainHandler):
++    """
++    Yield SOA and AXFR responses. Every new AXFR response increments the SOA
++    version.
++    """
++
++    domains = ["xfr-and-reconfig", "private-dns-overrun"]
++
++    def __init__(self) -> None:
++        super().__init__()
++        self.soa_version = 0
++
++    async def get_responses(
++        self, qctx: QueryContext
++    ) -> AsyncGenerator[ResponseAction, None]:
++        # This is oversimplified because I am lazy - we are appending the SOA
++        # RRset to the ANSWER section for _every_ QTYPE.  named is only
++        # expected to send a SOA query over UDP and then an AXFR query over
++        # TCP.  Responses to both of those start with a SOA RRset in the ANSWER
++        # section :-)
++        soa_message = qctx.response
++        soa_rrset = dns.rrset.from_text(
++            qctx.qname,
++            300,
++            qctx.qclass,
++            dns.rdatatype.SOA,
++            f". . {self.soa_version} 0 0 0 0",
++        )
++        soa_message.answer.append(soa_rrset)
++
++        yield DnsResponseSend(soa_message)
++
++        if qctx.qtype == dns.rdatatype.SOA:
++            # If QTYPE=SOA, the SOA record is the complete response.
++            return
++
++        if qctx.qtype != dns.rdatatype.AXFR:
++            # If QTYPE=AXFR, we will continue cramming RRsets into the ANSWER
++            # section of a subsequent DNS message below.
++            #
++            # If QTYPE was not SOA or AXFR, abort.  Yeah, we just sent a broken
++            # response by yielding DnsResponseSend() with a SOA RRset in the
++            # ANSWER section above.  We will have to carry that burden for the
++            # rest of our lives.
++            return
++
++        # Send just the obligatory NS RRset at zone apex in the next message.
++        # This is stupidly inefficient, but makes looping below simpler as we
++        # will already have been done with the mandatory stuff by then.
++        ns_message = qctx.prepare_new_response()
++        ns_rrset = dns.rrset.from_text(
++            qctx.qname, 300, qctx.qclass, dns.rdatatype.NS, "."
++        )
++        ns_message.answer.append(ns_rrset)
++
++        yield DnsResponseSend(ns_message)
++
++        # Generate the AXFR with a txt rrset.
++        txt_message = qctx.prepare_new_response()
++        txt_rrset = dns.rrset.from_text(
++            qctx.qname,
++            300,
++            qctx.qclass,
++            dns.rdatatype.TXT,
++            "foo bar",
++        )
++        txt_message.answer.append(txt_rrset)
++
++        yield DnsResponseSend(txt_message)
++
++        if qctx.qname == dns.name.from_text("private-dns-overrun"):
++            # A message where the malformed DNSKEY algorithm identifier
++            # finishes on a 00 byte in the next record. Assumes the
++            # next record starts with a compression pointer which is
++            # followed by the type which starts with 00.
++
++            # Generate malformed PRIVATE DNS DNSKEY
++            dnskey_message = qctx.prepare_new_response()
++            dnskey_rrset = dns.rrset.from_text(
++                qctx.qname,
++                300,
++                qctx.qclass,
++                dns.rdatatype.DNSKEY,
++                "\\# 12 00 00 00 fd 09 00 00 00 00 00 00 00",
++            )
++            dnskey_message.answer.append(dnskey_rrset)
++            # Generate well formed PRIVATE DNS DNSKEY
++            dnskey_rrset = dns.rrset.from_text(
++                qctx.qname,
++                300,
++                qctx.qclass,
++                dns.rdatatype.DNSKEY,
++                "\\# 12 00 00 00 fd 06 00 00 00 00 00 00 00",
++            )
++            dnskey_message.answer.append(dnskey_rrset)
++
++            yield DnsResponseSend(dnskey_message)
++
++        # Finish the AXFR transaction by sending the second SOA RRset.
++        yield DnsResponseSend(soa_message)
++
++        # This makes sure that the next SOA request causes a new zone transfer
++        self.soa_version += 1
++
++
++if __name__ == "__main__":
++    server = ControllableAsyncDnsServer(
++        default_aa=True, default_rcode=dns.rcode.NOERROR
++    )
++    server.install_control_command(ToggleResponsesCommand())
++    server.install_response_handler(AXFRServer())
++    server.run()
+diff --git a/bin/tests/system/xfer/ns6/named.conf.in b/bin/tests/system/xfer/ns6/named.conf.in
+index 142383c89a..63809448f0 100644
+--- a/bin/tests/system/xfer/ns6/named.conf.in
++++ b/bin/tests/system/xfer/ns6/named.conf.in
+@@ -83,3 +83,12 @@ zone "ixfr-too-big" {
+ 	primaries { 10.53.0.1; };
+ 	file "ixfr-too-big.bk";
+ };
++
++# GL#6004
++zone "private-dns-overrun" {
++	type secondary;
++	primaries { 10.53.0.9; };
++	file "private-dns-overrun.bk";
++	masterfile-format text; # force bug to be exercised
++	request-ixfr no; # ans9 supports only axfr
++};
+diff --git a/bin/tests/system/xfer/tests.sh b/bin/tests/system/xfer/tests.sh
+index a2c0adbc28..e08be175b7 100755
+--- a/bin/tests/system/xfer/tests.sh
++++ b/bin/tests/system/xfer/tests.sh
+@@ -622,5 +622,21 @@ if [ $tmp -eq 0 ]; then
+ fi
+ status=$((status + tmp))
+ 
++# def test_malformed_private_dns_identifier_overrun(ns6):
++#    isctest.log.info(
++#        "Check that a malformed PRIVATEDNS DNSKEY which overruns the record is rejected"
++#    )
++#    with ns6.watch_log_from_start(timeout=60) as watcher_transfer_completed:
++#        watcher_transfer_completed.wait_for_line(
++#            "zone private-dns-overrun/IN: zone transfer finished: unexpected end of input"
++#        )
++n=$((n + 1))
++echo_i "Check that a malformed PRIVATEDNS DNSKEY which overruns the record is rejected ($n)"
++tmp=0
++nextpartreset ns6/named.run
++retry 60 wait_for_message "zone private-dns-overrun/IN: zone transfer finished: unexpected end of input" || tmp=1
++if test $tmp != 0; then echo_i "failed"; fi
++status=$((status + tmp))
++
+ echo_i "exit status: $status"
+ [ $status -eq 0 ] || exit 1
+diff --git a/tests/dns/name_test.c b/tests/dns/name_test.c
+index fb34dcace1..95f6598eb8 100644
+--- a/tests/dns/name_test.c
++++ b/tests/dns/name_test.c
+@@ -335,6 +335,35 @@ ISC_RUN_TEST_IMPL(fromregion) {
+ 	assert_false(dns_name_isabsolute(&name));
+ }
+ 
++ISC_RUN_TEST_IMPL(fromwire) {
++	dns_decompress_t dctx;
++	dns_fixedname_t fixed;
++	dns_name_t *name = dns_fixedname_initname(&fixed);
++	isc_buffer_t b;
++	unsigned char source[] = { 0x03, 'o', 'n', 'e',	 0x00, 0x03,
++				   't',	 'w', 'o', 0x00, 0x05, 't',
++				   'h',	 'r', 'e', 'e',	 0x00 };
++	isc_result_t result;
++
++	isc_buffer_init(&b, source, sizeof(source));
++	isc_buffer_add(&b, sizeof(source));
++	isc_buffer_setactive(&b, 10); /* names 'one.' and 'two.' */
++
++	/*
++	 * We should only be able to read two names from the buffer
++	 * as the active region has been set to cover only the first
++	 * two.
++	 */
++	dns_decompress_init(&dctx, -1, DNS_DECOMPRESS_STRICT);
++	dns_decompress_setmethods(&dctx, DNS_COMPRESS_NONE);
++	result = dns_name_fromwire(name, &b, &dctx, 0, NULL);
++	assert_int_equal(result, ISC_R_SUCCESS);
++	result = dns_name_fromwire(name, &b, &dctx, 0, NULL);
++	assert_int_equal(result, ISC_R_SUCCESS);
++	result = dns_name_fromwire(name, &b, &dctx, 0, NULL);
++	assert_int_not_equal(result, ISC_R_SUCCESS);
++}
++
+ /* is trust-anchor-telemetry test */
+ ISC_RUN_TEST_IMPL(istat) {
+ 	dns_fixedname_t fixed;
+@@ -778,6 +807,7 @@ ISC_TEST_LIST_START
+ ISC_TEST_ENTRY(fullcompare)
+ ISC_TEST_ENTRY(compression)
+ ISC_TEST_ENTRY(fromregion)
++ISC_TEST_ENTRY(fromwire)
+ ISC_TEST_ENTRY(istat)
+ ISC_TEST_ENTRY(init)
+ ISC_TEST_ENTRY(invalidate)
+diff --git a/tests/dns/rdata_test.c b/tests/dns/rdata_test.c
+index 6354819d10..7f0df6e046 100644
+--- a/tests/dns/rdata_test.c
++++ b/tests/dns/rdata_test.c
+@@ -2199,6 +2199,27 @@ ISC_RUN_TEST_IMPL(key) {
+ 
+ 	check_rdata(NULL, wire_ok, NULL, false, dns_rdataclass_in,
+ 		    dns_rdatatype_key, sizeof(dns_rdata_key_t));
++
++	/*
++	 * A valid PRIVATEDNS record with an active region shorter than the
++	 * actual record length.  A bug in dns_name_fromwire meant that this
++	 * was previously accepted.
++	 */
++	dns_decompress_t dctx;
++	unsigned char key[] = { 0x00, 0x00, 0x00, 253, 0x07, 'e', 'x',
++				'a',  'm',  'p',  'l', 'e',  0x00 };
++	unsigned char buf[sizeof(key)];
++	isc_buffer_t source, target;
++	isc_result_t result;
++
++	isc_buffer_init(&source, key, sizeof(key));
++	isc_buffer_add(&source, sizeof(key));
++	isc_buffer_setactive(&source, sizeof(key) - 1);
++	isc_buffer_init(&target, buf, sizeof(buf));
++	dns_decompress_init(&dctx, -1, DNS_DECOMPRESS_ANY);
++	result = dns_rdata_fromwire(NULL, dns_rdataclass_in, dns_rdatatype_key,
++				    &source, &dctx, 0, &target);
++	assert_int_not_equal(result, ISC_R_SUCCESS);
+ }
+ 
+ /*
+-- 
+2.55.0
+
diff --git a/bind-9.18-CVE-2026-10822.patch b/bind-9.18-CVE-2026-10822.patch
new file mode 100644
index 0000000..22cdbdd
--- /dev/null
+++ b/bind-9.18-CVE-2026-10822.patch
@@ -0,0 +1,54 @@
+From 7596cbc240b0492461943f7c34d040fb66a7554c Mon Sep 17 00:00:00 2001
+From: Mark Andrews <marka@isc.org>
+Date: Tue, 19 May 2026 15:00:17 +1000
+Subject: [PATCH] Fix the yaml query zone name code in dnstap-read
+
+When the buffer to read the query zone name was constructed
+isc_buffer_setactive was not called.  This is now needed as
+dns_name_fromwire is being corrected to check the active region.
+
+(cherry picked from commit a25522c28c46655a81d2bf1d96374c81d834b157)
+(cherry picked from commit a5f1a9d0d2ec021618924b14202ac96ead8299c1)
+
+Fix dns_name_fromwire to honour the active region
+
+dns_name_fromwire was not honouring the source buffer's active
+region when reading names from the wire.  This allowed malformed
+records to be accepted when they shouldn't have been.  This has
+been corrected.
+
+(cherry picked from commit 7c4f07a7ef6b571073327b02209df7f75b9363ff)
+(cherry picked from commit e73b70a64453e7d97a11cb5f0afe8bb02d34aaf8)
+---
+ bin/tools/dnstap-read.c | 1 +
+ lib/dns/name.c          | 2 +-
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/bin/tools/dnstap-read.c b/bin/tools/dnstap-read.c
+index a1d0243a1a..bb78ae12b1 100644
+--- a/bin/tools/dnstap-read.c
++++ b/bin/tools/dnstap-read.c
+@@ -298,6 +298,7 @@ print_yaml(dns_dtdata_t *dt) {
+ 
+ 		isc_buffer_init(&b, m->query_zone.data, m->query_zone.len);
+ 		isc_buffer_add(&b, m->query_zone.len);
++		isc_buffer_setactive(&b, m->query_zone.len);
+ 
+ 		dns_decompress_init(&dctx, -1, DNS_DECOMPRESS_NONE);
+ 		result = dns_name_fromwire(name, &b, &dctx, 0, NULL);
+diff --git a/lib/dns/name.c b/lib/dns/name.c
+index cc0e30e5b5..2ce868a2ba 100644
+--- a/lib/dns/name.c
++++ b/lib/dns/name.c
+@@ -1833,7 +1833,7 @@ dns_name_fromwire(dns_name_t *const name, isc_buffer_t *const source,
+ 	 * The amount of the source we consumed is set once.
+ 	 */
+ 	const uint8_t *const source_buf = isc_buffer_base(source);
+-	const uint8_t *const source_max = isc_buffer_used(source);
++	const uint8_t *const source_max = isc_buffer_active(source);
+ 	const uint8_t *const start = isc_buffer_current(source);
+ 	const uint8_t *marker = start;
+ 	const uint8_t *cursor = start;
+-- 
+2.55.0
+
diff --git a/bind.spec b/bind.spec
index bbe677d..c8f2ddf 100644
--- a/bind.spec
+++ b/bind.spec
@@ -164,6 +164,9 @@ Patch35: 0001-Use-variable-PROGRAM_SUFFIX-in-install-target.patch
 # https://gitlab.isc.org/isc-projects/bind9/-/work_items/5856
 Patch36: bind-9.18-CVE-2026-11331.patch
 Patch37: bind-9.18-CVE-2026-11331-test.patch
+# https://gitlab.isc.org/isc-projects/bind9/commit/c5d2fc706ca3635d9928c1cc68db73bffb35d772
+Patch38: bind-9.18-CVE-2026-10822.patch
+Patch40: bind-9.18-CVE-2026-10822-test.patch
 
 %{?systemd_ordering}
 # https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers

From f792799c7db49e99b04b2bd9a8400ee8ec54a1a1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 25 Aug 2026 12:28:58 +0200
Subject: [PATCH 451/460] Record ordering based unexpected exit with CNAME or
 DNAME (CVE-2026-12617)

[9.18] [CVE-2026-12617] sec: usr: Do no assert for some specifics CNAME and DNAME queries

A bug in the resolver's handling of certain cached DNAME and CNAME responses could cause named to trigger an assertion failure and exit. An attacker controlling a domain name and the authoritative DNS server it is hosted on could exploit this behavior to cause a denial-of-service. This vulnerability has been fixed.

ISC thanks Qifan Zhang of Palo Alto Networks for bringing this issue to our attention.

Closes: isc-projects/bind9#5946

[9.18] fix: test: Stabilize the cname_dname_negcache test

The test proved unstable due to timing-related race condition, which could produce both false positive and false negative results. Use a more reliable mechanism to reproduce the issue.

Human-effort-level: low
---
 bind-9.18-CVE-2026-12617-test.patch | 435 ++++++++++++++++++++++++++++
 bind-9.18-CVE-2026-12617.patch      | 280 ++++++++++++++++++
 bind.spec                           |   4 +
 3 files changed, 719 insertions(+)
 create mode 100644 bind-9.18-CVE-2026-12617-test.patch
 create mode 100644 bind-9.18-CVE-2026-12617.patch

diff --git a/bind-9.18-CVE-2026-12617-test.patch b/bind-9.18-CVE-2026-12617-test.patch
new file mode 100644
index 0000000..b2add78
--- /dev/null
+++ b/bind-9.18-CVE-2026-12617-test.patch
@@ -0,0 +1,435 @@
+From a31296b120efc985fb1fc3c932882e965156473b Mon Sep 17 00:00:00 2001
+From: Colin Vidal <colin@isc.org>
+Date: Mon, 15 Jun 2026 11:34:08 +0200
+Subject: [PATCH] Reproducer for #5946 (assertion in some CNAME/DNAME queries)
+
+Add a system test reproducing the issue reported by #5946, which
+is also CVE-2026-12617. There are two scenarios:
+
+- A client send queries for a DNAME and A record to the resolver (ns3),
+  and the authoritative server (ans2) responds positively to the A query
+  but delay the DNAME response and respond later negatively;
+
+- A client send queries for a CNAME and A record to the resolver (ns3),
+  and the authoritative server (ans2) responds positively to the A query
+  but delay the CNAME response and respond later with a self-referential
+  CNAME.
+
+The test does not check the results of the queries, however, it expects
+the resolver to correctly handle those and do not assert.
+
+(cherry picked from commit e88271f2e584010157b068cc998dd76451273562)
+(cherry picked from commit bb92832fb6ae899bee7206c2d8966258461c2f71)
+
+Stabilize timing in the cname_dname_negcache test
+
+The #5946 reproducer relied on ans2 answering the negative DNAME/CNAME
+query a fixed second after receiving it, racing that delay against the
+resolver's per-query timeout.  When the timeout fired first -- which
+happens under load, most notably under ThreadSanitizer, where named is
+slowed but ans2 (wall-clock) is not -- the resolver dropped the late
+answer, never processed the negative response, and the watched SOA never
+appeared, so the test timed out.  This made it flaky on the
+security-bind-9.20 CI.  Merely shortening the fixed delay would trade
+that for the opposite, worse failure: the negative answer arriving
+before the positive one is cached, silently not exercising the bug.
+
+Release the negative answer based on the resolver's progress instead of
+a wall-clock deadline: hold it until ans2 has sent the positive answer
+(a shared event), then wait a short settle for the resolver to cache it.
+Both queries traverse the same delegation, so any latency reaching ans2
+shifts the positive send and the negative fetch's deadline together and
+cancels out; only the settle, kept well under MINIMUM_QUERY_TIMEOUT
+(301 ms), has to fit inside the per-query timeout.
+
+Verified that the stabilized test still triggers the
+INSIST(namereln == dns_namereln_subdomain) assertion when the resolver
+fix is reverted.
+
+Assisted-by: Claude:claude-opus-4-8
+(cherry picked from commit 738456d91564526e6f15c3858b4c809cd6749e1e)
+(cherry picked from commit 0c20ee4e8e68999ca617434cde65dd3808f57d8c)
+
+Split cname_dname_negcache into per-scenario modules
+
+The DNAME and CNAME scenarios shared a single module, hence a single
+module-scoped ns3 (the framework sets servers up per module, not per
+test function).  test_dname_negcache cached foo.test. DNAME bar.test.;
+when test_cname_negcache ran next against the same resolver,
+cname.foo.test. was DNAME-mapped to cname.bar.test., so the resolver
+never queried ans2 for the self-referential CNAME and that half of the
+bug was never exercised.  The hardcoded, unanchored "foo.test." watcher
+still matched test_dname's leftover SOA, so test_cname passed without
+testing anything -- the CNAME assertion had no coverage.
+
+Give each scenario its own module so each gets a fresh server set, and
+anchor the watcher to the queried name so a test cannot pass on an
+unrelated record.
+
+With the resolver fix reverted, each module now independently triggers
+its own assertion:
+
+    DNAME  query.c INSIST(namereln == dns_namereln_subdomain)
+    CNAME  query.c INSIST(qctx->rdataset == NULL || qctx->qtype == dname)
+
+Assisted-by: Claude:claude-opus-4-8
+(cherry picked from commit 3ef0b8d04a1653407cfb9ee88772ae18689b1318)
+(cherry picked from commit 887124315f03a006c4dc76e48ae3d0d8aac3c407)
+---
+ .../system/cname_dname_negcache/ans2/ans.py   | 148 ++++++++++++++++++
+ .../system/cname_dname_negcache/common.py     |  46 ++++++
+ .../cname_dname_negcache/ns1/bar.test.db      |   5 +
+ .../cname_dname_negcache/ns1/named.conf.j2    |  24 +++
+ .../system/cname_dname_negcache/ns1/root.db   |   6 +
+ .../system/cname_dname_negcache/ns1/test.db   |   8 +
+ .../cname_dname_negcache/ns3/named.conf.j2    |  11 ++
+ .../tests_cname_negcache.py                   |  16 ++
+ .../tests_dname_negcache.py                   |  16 ++
+ 9 files changed, 280 insertions(+)
+ create mode 100644 bin/tests/system/cname_dname_negcache/ans2/ans.py
+ create mode 100644 bin/tests/system/cname_dname_negcache/common.py
+ create mode 100644 bin/tests/system/cname_dname_negcache/ns1/bar.test.db
+ create mode 100644 bin/tests/system/cname_dname_negcache/ns1/named.conf.j2
+ create mode 100644 bin/tests/system/cname_dname_negcache/ns1/root.db
+ create mode 100644 bin/tests/system/cname_dname_negcache/ns1/test.db
+ create mode 100644 bin/tests/system/cname_dname_negcache/ns3/named.conf.j2
+ create mode 100644 bin/tests/system/cname_dname_negcache/tests_cname_negcache.py
+ create mode 100644 bin/tests/system/cname_dname_negcache/tests_dname_negcache.py
+
+diff --git a/bin/tests/system/cname_dname_negcache/ans2/ans.py b/bin/tests/system/cname_dname_negcache/ans2/ans.py
+new file mode 100644
+index 0000000000..392fe1e088
+--- /dev/null
++++ b/bin/tests/system/cname_dname_negcache/ans2/ans.py
+@@ -0,0 +1,148 @@
++"""
++Copyright (C) Internet Systems Consortium, Inc. ("ISC")
++
++SPDX-License-Identifier: MPL-2.0
++
++This Source Code Form is subject to the terms of the Mozilla Public
++License, v. 2.0.  If a copy of the MPL was not distributed with this
++file, you can obtain one at https://mozilla.org/MPL/2.0/.
++
++See the COPYRIGHT file distributed with this work for additional
++information regarding copyright ownership.
++"""
++
++from collections.abc import AsyncGenerator
++
++import asyncio
++
++from dns import name, rcode, rdataclass, rdatatype, rrset
++
++from isctest.asyncserver import (
++    AsyncDnsServer,
++    DnsResponseSend,
++    QnameQtypeHandler,
++    QueryContext,
++    StaticResponseHandler,
++)
++
++# The attack relies on the resolver caching the positive CNAME/DNAME answer
++# *before* it processes the negative answer for the same name.  The negative
++# answer must therefore be held back until the positive one has been sent, but
++# released again while the negative fetch is still waiting for it.
++#
++# Releasing it at a fixed wall-clock delay (the original approach) is racy: the
++# delay must be larger than the time it takes the resolver to cache the
++# positive answer, yet smaller than the resolver's per-query timeout.  Under
++# load -- most notably ThreadSanitizer, which slows down `named` but not this
++# (wall-clock) server -- those bounds can be violated in either direction,
++# making the test either time out (#5946 CI failures) or, worse, silently stop
++# exercising the bug.
++#
++# Instead, gate the negative answer on an event set right after the positive
++# answer is sent.  Both queries traverse the same delegation, so any latency in
++# reaching this server shifts the positive send and the negative fetch's
++# deadline together and cancels out; only the small settle below has to fit
++# inside the per-query timeout.
++#
++# _SETTLE must be longer than the few milliseconds the resolver needs to cache
++# the positive answer, and shorter than MINIMUM_QUERY_TIMEOUT (301 ms in
++# lib/dns/resolver.c) so the in-flight negative fetch has not given up yet.
++_SETTLE = 0.1
++
++_dname_positive_sent = asyncio.Event()
++_cname_positive_sent = asyncio.Event()
++
++
++async def _hold_until_positive_cached(positive_sent: asyncio.Event) -> None:
++    await positive_sent.wait()
++    await asyncio.sleep(_SETTLE)
++
++
++def build_rrset(
++    qname: name.Name | str,
++    rtype: rdatatype.RdataType,
++    rdata: str,
++    ttl: int = 300,
++) -> rrset.RRset:
++    return rrset.from_text(qname, ttl, rdataclass.IN, rtype, rdata)
++
++
++class FooTestNsHandler(QnameQtypeHandler, StaticResponseHandler):
++    qnames = ["foo.test."]
++    qtypes = [rdatatype.NS]
++    answer = [build_rrset("foo.test.", rdatatype.NS, "ns.foo.test.")]
++    additional = [build_rrset("ns.foo.test.", rdatatype.A, "10.53.0.2")]
++
++
++class DelayedDnameNegHandler(QnameQtypeHandler, StaticResponseHandler):
++    qnames = ["foo.test."]
++    qtypes = [rdatatype.DNAME]
++    authority = [
++        build_rrset(
++            "foo.test.",
++            rdatatype.SOA,
++            "ns.test. op.ns.test. 2081509183 86400 3600 3600000 300",
++        )
++    ]
++
++    async def get_responses(
++        self, qctx: QueryContext
++    ) -> AsyncGenerator[DnsResponseSend, None]:
++        await _hold_until_positive_cached(_dname_positive_sent)
++        async for response in super().get_responses(qctx):
++            yield response
++
++
++class DnamePosHandler(QnameQtypeHandler, StaticResponseHandler):
++    qnames = ["a.foo.test."]
++    qtypes = [rdatatype.A]
++    answer = [
++        build_rrset("foo.test.", rdatatype.DNAME, "bar.test."),
++        build_rrset("a.foo.test.", rdatatype.CNAME, "a.bar.test."),
++    ]
++
++    async def get_responses(
++        self, qctx: QueryContext
++    ) -> AsyncGenerator[DnsResponseSend, None]:
++        async for response in super().get_responses(qctx):
++            yield response
++        _dname_positive_sent.set()
++
++
++class CnameHandler(QnameQtypeHandler):
++    qnames = ["cname.foo.test."]
++    qtypes = [rdatatype.CNAME, rdatatype.A]
++    answer = [build_rrset("cname.foo.test.", rdatatype.CNAME, "cname.foo.test.")]
++    authority = [
++        build_rrset(
++            "cname.foo.test.",
++            rdatatype.SOA,
++            "ns.test. op.ns.test. 2081509183 86400 3600 3600000 300",
++        )
++    ]
++
++    async def get_responses(
++        self, qctx: QueryContext
++    ) -> AsyncGenerator[DnsResponseSend, None]:
++        if qctx.qtype == rdatatype.CNAME:
++            await _hold_until_positive_cached(_cname_positive_sent)
++            qctx.prepare_new_response(with_zone_data=False)
++            qctx.response.authority.extend(self.authority)
++            yield DnsResponseSend(qctx.response, authoritative=True)
++        else:
++            qctx.prepare_new_response(with_zone_data=False)
++            qctx.response.answer.extend(self.answer)
++            yield DnsResponseSend(qctx.response, authoritative=True)
++            _cname_positive_sent.set()
++
++
++def main() -> None:
++    server = AsyncDnsServer(default_aa=True, default_rcode=rcode.NOERROR)
++    server.install_response_handlers(
++        FooTestNsHandler(), DelayedDnameNegHandler(), DnamePosHandler(), CnameHandler()
++    )
++    server.run()
++
++
++if __name__ == "__main__":
++    main()
+diff --git a/bin/tests/system/cname_dname_negcache/common.py b/bin/tests/system/cname_dname_negcache/common.py
+new file mode 100644
+index 0000000000..397cfdfa3d
+--- /dev/null
++++ b/bin/tests/system/cname_dname_negcache/common.py
+@@ -0,0 +1,46 @@
++# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
++#
++# SPDX-License-Identifier: MPL-2.0
++#
++# This Source Code Form is subject to the terms of the Mozilla Public
++# License, v. 2.0.  If a copy of the MPL was not distributed with this
++# file, you can obtain one at https://mozilla.org/MPL/2.0/.
++#
++# See the COPYRIGHT file distributed with this work for additional
++# information regarding copyright ownership.
++
++from os import environ
++from re import compile as Re
++from re import escape
++from socket import AF_INET, SOCK_DGRAM, socket
++
++import isctest
++
++
++def run_attack(ns, name1, type1, name2, type2):
++    msg1 = isctest.query.create(name1, type1, cd=True)
++    msg2 = isctest.query.create(name2, type2, cd=True)
++    port = int(environ["PORT"])
++
++    with socket(AF_INET, SOCK_DGRAM) as sock:
++        # The order the requests go out doesn't matter. What is important is
++        # that the first query starts recursion before the second query returns
++        # the answer, and the second query returns the answer before the first
++        # query returns the answer. (So, when the NOERROR/NODATA comes back from
++        # the first query, the cache is queried and we get the positive response
++        # cached from the second query attached to the fresp rdataset of the
++        # response of the first query.)
++        # That ordering is enforced by ans2, which holds back the negative
++        # answer to the first query until it has answered the second one (see
++        # ans2/ans.py); the resolver must not crash while reconciling them.
++        sock.sendto(msg1.to_wire(), (ns.ip, port))
++        sock.sendto(msg2.to_wire(), (ns.ip, port))
++
++    # The second query comes back immediately, the resolver caches the DNAME.
++    # The first query comes back shortly after, once ans2 has released the
++    # negative answer, and should not crash the server.  Wait for the negative
++    # SOA for this specific name (not just any foo.test. one) so the test cannot
++    # pass on an unrelated record.
++    soa = Re(rf"(?<![\w.]){escape(name1)}.*IN\s+SOA\s+ns\.test\.\s+op\.ns\.test\.")
++    with ns.watch_log_from_start(timeout=15) as watcher:
++        watcher.wait_for_sequence([soa])
+diff --git a/bin/tests/system/cname_dname_negcache/ns1/bar.test.db b/bin/tests/system/cname_dname_negcache/ns1/bar.test.db
+new file mode 100644
+index 0000000000..840b9c3a2c
+--- /dev/null
++++ b/bin/tests/system/cname_dname_negcache/ns1/bar.test.db
+@@ -0,0 +1,5 @@
++$TTL 300
++bar.test.        IN SOA  ns.bar.test. hostmaster.bar.test. 1 600 600 1200 600
++bar.test.        NS      ns.bar.test.
++ns    		 A       10.53.0.1
++a      		 A       10.0.0.1
+diff --git a/bin/tests/system/cname_dname_negcache/ns1/named.conf.j2 b/bin/tests/system/cname_dname_negcache/ns1/named.conf.j2
+new file mode 100644
+index 0000000000..d72dd1181d
+--- /dev/null
++++ b/bin/tests/system/cname_dname_negcache/ns1/named.conf.j2
+@@ -0,0 +1,24 @@
++options {
++    query-source address @ns.ip@;
++    port @PORT@;
++    pid-file "named.pid";
++    listen-on { @ns.ip@; };
++    listen-on-v6 { none; };
++    recursion no;
++    dnssec-validation no;
++};
++
++zone "." {
++	type primary;
++	file "root.db";
++};
++
++zone "test." {
++	type primary;
++	file "test.db";
++};
++
++zone "bar.test." {
++	type primary;
++	file "bar.test.db";
++};
+diff --git a/bin/tests/system/cname_dname_negcache/ns1/root.db b/bin/tests/system/cname_dname_negcache/ns1/root.db
+new file mode 100644
+index 0000000000..c456c45b9d
+--- /dev/null
++++ b/bin/tests/system/cname_dname_negcache/ns1/root.db
+@@ -0,0 +1,6 @@
++$TTL 300
++.        IN SOA  ns. hostmaster. 1 600 600 1200 600
++.	         	NS      a.root-servers.nil.
++a.root-servers.nil.    	A       10.53.0.1
++test    	 	NS      ns.test
++ns.test		 	A	 10.53.0.1
+diff --git a/bin/tests/system/cname_dname_negcache/ns1/test.db b/bin/tests/system/cname_dname_negcache/ns1/test.db
+new file mode 100644
+index 0000000000..acb68e00f8
+--- /dev/null
++++ b/bin/tests/system/cname_dname_negcache/ns1/test.db
+@@ -0,0 +1,8 @@
++$TTL 300
++test.        IN SOA  ns.test. hostmaster.test. 1 600 600 1200 600
++test.	         NS      ns.test.
++ns    		 A       10.53.0.1
++bar    		 NS      ns.bar
++ns.bar		 A	 10.53.0.1
++foo		 NS	 ns.foo
++ns.foo		 A	 10.53.0.2
+diff --git a/bin/tests/system/cname_dname_negcache/ns3/named.conf.j2 b/bin/tests/system/cname_dname_negcache/ns3/named.conf.j2
+new file mode 100644
+index 0000000000..197d72756b
+--- /dev/null
++++ b/bin/tests/system/cname_dname_negcache/ns3/named.conf.j2
+@@ -0,0 +1,11 @@
++options {
++    query-source address @ns.ip@;
++    port @PORT@;
++    pid-file "named.pid";
++    listen-on { @ns.ip@; };
++    listen-on-v6 { none; };
++    recursion yes;
++    dnssec-validation no;
++};
++
++{% include "_common/root.hint.conf" %}
+diff --git a/bin/tests/system/cname_dname_negcache/tests_cname_negcache.py b/bin/tests/system/cname_dname_negcache/tests_cname_negcache.py
+new file mode 100644
+index 0000000000..a546d29109
+--- /dev/null
++++ b/bin/tests/system/cname_dname_negcache/tests_cname_negcache.py
+@@ -0,0 +1,16 @@
++# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
++#
++# SPDX-License-Identifier: MPL-2.0
++#
++# This Source Code Form is subject to the terms of the Mozilla Public
++# License, v. 2.0.  If a copy of the MPL was not distributed with this
++# file, you can obtain one at https://mozilla.org/MPL/2.0/.
++#
++# See the COPYRIGHT file distributed with this work for additional
++# information regarding copyright ownership.
++
++from cname_dname_negcache.common import run_attack
++
++
++def test_cname_negcache(ns3):
++    run_attack(ns3, "cname.foo.test.", "CNAME", "cname.foo.test.", "A")
+diff --git a/bin/tests/system/cname_dname_negcache/tests_dname_negcache.py b/bin/tests/system/cname_dname_negcache/tests_dname_negcache.py
+new file mode 100644
+index 0000000000..41a80b4e05
+--- /dev/null
++++ b/bin/tests/system/cname_dname_negcache/tests_dname_negcache.py
+@@ -0,0 +1,16 @@
++# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
++#
++# SPDX-License-Identifier: MPL-2.0
++#
++# This Source Code Form is subject to the terms of the Mozilla Public
++# License, v. 2.0.  If a copy of the MPL was not distributed with this
++# file, you can obtain one at https://mozilla.org/MPL/2.0/.
++#
++# See the COPYRIGHT file distributed with this work for additional
++# information regarding copyright ownership.
++
++from cname_dname_negcache.common import run_attack
++
++
++def test_dname_negcache(ns3):
++    run_attack(ns3, "foo.test.", "DNAME", "a.foo.test.", "A")
+-- 
+2.55.0
+
diff --git a/bind-9.18-CVE-2026-12617.patch b/bind-9.18-CVE-2026-12617.patch
new file mode 100644
index 0000000..1c8079e
--- /dev/null
+++ b/bind-9.18-CVE-2026-12617.patch
@@ -0,0 +1,280 @@
+From 3138886f3767c0a6b933fd147c5465472209bac6 Mon Sep 17 00:00:00 2001
+From: Colin Vidal <colin@isc.org>
+Date: Thu, 18 Jun 2026 18:17:05 +0200
+Subject: [PATCH] Do not assert in some CNAME/DNAME queries
+
+Fix a `named` crash because of a fail assertion for certains types of
+CNAME and DNAME queries:
+
+- If a client queries for a DNAME and A record to the resolver, and the
+  authoritative server responds positively to the A query but delay the
+  DNAME response and respond later negatively;
+
+- If a client queries for a CNAME and A record to the resolver, and the
+  authoritative server responds positively to the A query but delay the
+  CNAME response and respond later with a self-referential CNAME.
+
+The first scenario consists of sending two queries: `foo.test./DNAME`
+and `a.foo.test./A`. The authoritative server delays the answer for
+`foo.test./DNAME` but immediately answers the DNAME record for the
+second query: `foo.test. DNAME bar.test.`. The resolver caches it,
+follows the DNAME, and resolves `a.bar.test./A`. The authoritative
+server eventually answers negatively for `foo.test./DNAME`
+(NOERROR/NODATA, with only an SOA in the authority section). The
+resolver pulls out the previously cached rdataset (because it has a
+higher trust level than the received negative answer), and wrongly (this
+is the first bug) sets the result to `DNS_R_DNAME` instead of
+`ISC_R_SUCCESS`. The code in `ns/query.c` that handles the resolver
+result interprets this as "this is a non-DNAME query and we got a DNAME
+rdataset, so follow the chain". It goes into the `query_dname()`
+function, which asserts that the qname is a subdomain of the owner name
+in the rdataset. That assertion fails because the qname (`foo.test.`) is
+exactly equal to the owner name of the DNAME (`foo.test.`), rather than
+being a subdomain of it. `DNS_R_DNAME` must only be set when the qtype
+is something other than DNAME and the resolver has obtained a DNAME that
+needs to be followed.
+
+The second scenario consists of sending two queries:
+`cname.foo.test./CNAME` and `cname.foo.test./A`. The authoritative
+server delays the answer for `cname.foo.test./CNAME` but immediately
+answers the CNAME record for the second query: `cname.foo.test. CNAME
+cname.foo.test.`. Note that the CNAME is self-referential. The resolver
+caches it and sets the result code to `DNS_R_CNAME`. Then `ns/query.c`
+interprets this as "this is a non-CNAME query and we got a CNAME
+rdataset, so follow the chain" (which is correct in this case; however,
+because the CNAME rdataset is self-referential, the resolver responds
+with SERVFAIL, which is expected). The authoritative server eventually
+answers negatively for `cname.foo.test./CNAME`. The resolver then pulls
+out the previously cached CNAME rdataset (obtained from the A answer,
+even though it was self-referential, the resolver cached it) and wrongly
+sets the result to `DNS_R_CNAME` (this is the second bug). As noted
+above, `ns/query.c` interprets this as "this is a non-CNAME query and we
+got a CNAME rdataset, so follow the chain". The internals here are
+slightly more subtle: it first goes into `query_cname()` and sets the
+CNAME rdataset in the message answer section, then restarts the query to
+follow the CNAME. The restart retrieves the CNAME rdataset from the
+cache directly (without going to the resolver), and this time the query
+context result is `ISC_R_SUCCESS` (since it was found) and
+`qctx->rdataset` points to the same CNAME again (as it is
+self-referential), so it goes directly into the
+`query_prepresponse()/query_respond()` flow, which attempts to add the
+rdataset to the message answer again. However, this fails because the
+rdataset is already in the message, and the assertion which expects that
+operation to succeed fails (due to `qctx->rdataset` being set to `NULL`
+when ownership of the rdataset was transferred). `DNS_R_CNAME` must only
+be set when the qtype is something other than CNAME and the resolver has
+obtained a CNAME that needs to be followed.
+
+In both cases, the correct answer from the resolver should have been
+`ISC_R_SUCCESS` (instead of respectively `DNS_R_DNAME` and
+`DNS_R_CNAME`) becuase the rdataset that has been looked up was found.
+
+(cherry picked from commit 773d46d58c693047a5945c8fe40512edd0ac214e)
+(cherry picked from commit c740c37689f234e21a9b0ef760471ef2cf1133f5)
+---
+ lib/dns/resolver.c | 137 ++++++++++++++++++++-------------------------
+ 1 file changed, 60 insertions(+), 77 deletions(-)
+
+diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
+index edc9c207e1..1f8b5058d1 100644
+--- a/lib/dns/resolver.c
++++ b/lib/dns/resolver.c
+@@ -692,10 +692,10 @@ fctx_destroy(fetchctx_t *fctx, bool exiting);
+ static void
+ send_shutdown_events(dns_resolver_t *res);
+ static isc_result_t
+-ncache_adderesult(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
+-		  dns_rdatatype_t covers, isc_stdtime_t now, dns_ttl_t minttl,
+-		  dns_ttl_t maxttl, bool optout, bool secure,
+-		  dns_rdataset_t *ardataset, isc_result_t *eresultp);
++ncache_adderesult(fetchctx_t *fctx, dns_message_t *message, dns_dbnode_t *node,
++		  dns_rdatatype_t covers, isc_stdtime_t now, dns_ttl_t maxttl,
++		  bool optout, bool secure, dns_rdataset_t *ardataset,
++		  isc_result_t *eresultp);
+ static void
+ validated(isc_task_t *task, isc_event_t *event);
+ static void
+@@ -5563,6 +5563,46 @@ has_000_label(dns_rdataset_t *nsecset) {
+ 	return false;
+ }
+ 
++/*
++ * After a (non-error) negative-cache add, 'rdataset' is bound to whatever
++ * rdataset the cache authoritatively holds for the queried name and type.
++ * Map that to the result code the fetch should report:
++ *
++ *   - A negative cache entry (the one we just added, or a pre-existing one):
++ *     DNS_R_NCACHENXDOMAIN or DNS_R_NCACHENXRRSET, depending on NXDOMAIN vs
++ *     NODATA.
++ *
++ *   - A positive rdataset that was already cached at higher trust, which
++ *     caused our negative entry to be discarded (e.g. a CNAME or DNAME cached
++ *     by a concurrent query): ISC_R_SUCCESS, because that cached positive
++ *     answer is what gets returned.  Note the specific case for CNAME and
++ *     DNAME *if* the query type is not the same as the rdataset type. There
++ *     is a chain to follow *only* if the query type doesn't ask for the CNAME
++ *     or the DNAME.
++ */
++static isc_result_t
++fctx_setresult(fetchctx_t *fctx, dns_rdataset_t *rdataset) {
++	isc_result_t result = ISC_R_SUCCESS;
++
++	if (NEGATIVE(rdataset)) {
++		result = NXDOMAIN(rdataset) ? DNS_R_NCACHENXDOMAIN
++					    : DNS_R_NCACHENXRRSET;
++	} else if (result == ISC_R_SUCCESS && rdataset->type != fctx->type) {
++		switch (rdataset->type) {
++		case dns_rdatatype_cname:
++			result = DNS_R_CNAME;
++			break;
++		case dns_rdatatype_dname:
++			result = DNS_R_DNAME;
++			break;
++		default:
++			break;
++		}
++	}
++
++	return result;
++}
++
+ /*
+  * The validator has finished.
+  */
+@@ -5836,8 +5876,7 @@ validated(isc_task_t *task, isc_event_t *event) {
+ 			ttl = 0;
+ 		}
+ 
+-		result = ncache_adderesult(message, fctx->cache, node, covers,
+-					   now, fctx->res->view->minncachettl,
++		result = ncache_adderesult(fctx, message, node, covers, now,
+ 					   ttl, vevent->optout, vevent->secure,
+ 					   ardataset, &eresult);
+ 		if (result != ISC_R_SUCCESS) {
+@@ -6081,23 +6120,7 @@ answer_response:
+ 		 */
+ 		INSIST(hevent->rdataset != NULL);
+ 		if (dns_rdataset_isassociated(hevent->rdataset)) {
+-			if (NEGATIVE(hevent->rdataset)) {
+-				INSIST(eresult == DNS_R_NCACHENXDOMAIN ||
+-				       eresult == DNS_R_NCACHENXRRSET);
+-			} else if (eresult == ISC_R_SUCCESS &&
+-				   hevent->rdataset->type != fctx->type)
+-			{
+-				switch (hevent->rdataset->type) {
+-				case dns_rdatatype_cname:
+-					eresult = DNS_R_CNAME;
+-					break;
+-				case dns_rdatatype_dname:
+-					eresult = DNS_R_DNAME;
+-					break;
+-				default:
+-					break;
+-				}
+-			}
++			eresult = fctx_setresult(fctx, hevent->rdataset);
+ 		}
+ 
+ 		hevent->result = eresult;
+@@ -6747,24 +6770,7 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, dns_message_t *message,
+ 			 * event->result.
+ 			 */
+ 			if (dns_rdataset_isassociated(event->rdataset)) {
+-				if (NEGATIVE(event->rdataset)) {
+-					INSIST(eresult ==
+-						       DNS_R_NCACHENXDOMAIN ||
+-					       eresult == DNS_R_NCACHENXRRSET);
+-				} else if (eresult == ISC_R_SUCCESS &&
+-					   event->rdataset->type != fctx->type)
+-				{
+-					switch (event->rdataset->type) {
+-					case dns_rdatatype_cname:
+-						eresult = DNS_R_CNAME;
+-						break;
+-					case dns_rdatatype_dname:
+-						eresult = DNS_R_DNAME;
+-						break;
+-					default:
+-						break;
+-					}
+-				}
++				eresult = fctx_setresult(fctx, event->rdataset);
+ 			}
+ 			event->result = eresult;
+ 			if (adbp != NULL && *adbp != NULL) {
+@@ -6833,12 +6839,14 @@ cache_message(fetchctx_t *fctx, dns_message_t *message,
+  * eresult.
+  */
+ static isc_result_t
+-ncache_adderesult(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
+-		  dns_rdatatype_t covers, isc_stdtime_t now, dns_ttl_t minttl,
+-		  dns_ttl_t maxttl, bool optout, bool secure,
+-		  dns_rdataset_t *ardataset, isc_result_t *eresultp) {
++ncache_adderesult(fetchctx_t *fctx, dns_message_t *message, dns_dbnode_t *node,
++		  dns_rdatatype_t covers, isc_stdtime_t now, dns_ttl_t maxttl,
++		  bool optout, bool secure, dns_rdataset_t *ardataset,
++		  isc_result_t *eresultp) {
+ 	isc_result_t result;
+ 	dns_rdataset_t rdataset;
++	dns_db_t *cache = fctx->cache;
++	dns_ttl_t minttl = fctx->res->view->minncachettl;
+ 
+ 	if (ardataset == NULL) {
+ 		dns_rdataset_init(&rdataset);
+@@ -6854,37 +6862,13 @@ ncache_adderesult(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
+ 	}
+ 	if (result == DNS_R_UNCHANGED || result == ISC_R_SUCCESS) {
+ 		/*
+-		 * If the cache now contains a negative entry and we
+-		 * care about whether it is DNS_R_NCACHENXDOMAIN or
+-		 * DNS_R_NCACHENXRRSET then extract it.
++		 * The cache settled successfully (DNS_R_UNCHANGED means our
++		 * negative entry was discarded in favour of existing
++		 * higher-trust data).  Either way 'ardataset' is now bound to
++		 * the rdataset the cache holds for this name and type; derive
++		 * the result code from it.
+ 		 */
+-		if (NEGATIVE(ardataset)) {
+-			/*
+-			 * The cache data is a negative cache entry.
+-			 */
+-			if (NXDOMAIN(ardataset)) {
+-				*eresultp = DNS_R_NCACHENXDOMAIN;
+-			} else {
+-				*eresultp = DNS_R_NCACHENXRRSET;
+-			}
+-		} else {
+-			/*
+-			 * The attempt to add a negative cache entry
+-			 * was rejected.  Set *eresultp to reflect
+-			 * the type of the dataset being returned.
+-			 */
+-			switch (ardataset->type) {
+-			case dns_rdatatype_cname:
+-				*eresultp = DNS_R_CNAME;
+-				break;
+-			case dns_rdatatype_dname:
+-				*eresultp = DNS_R_DNAME;
+-				break;
+-			default:
+-				*eresultp = ISC_R_SUCCESS;
+-				break;
+-			}
+-		}
++		*eresultp = fctx_setresult(fctx, ardataset);
+ 		result = ISC_R_SUCCESS;
+ 	}
+ 	if (ardataset == &rdataset && dns_rdataset_isassociated(ardataset)) {
+@@ -7029,8 +7013,7 @@ ncache_message(fetchctx_t *fctx, dns_message_t *message,
+ 		ttl = 0;
+ 	}
+ 
+-	result = ncache_adderesult(message, fctx->cache, node, covers, now,
+-				   fctx->res->view->minncachettl, ttl, false,
++	result = ncache_adderesult(fctx, message, node, covers, now, ttl, false,
+ 				   false, ardataset, &eresult);
+ 	if (result != ISC_R_SUCCESS) {
+ 		goto unlock;
+-- 
+2.55.0
+
diff --git a/bind.spec b/bind.spec
index c8f2ddf..eaf5eb9 100644
--- a/bind.spec
+++ b/bind.spec
@@ -167,6 +167,10 @@ Patch37: bind-9.18-CVE-2026-11331-test.patch
 # https://gitlab.isc.org/isc-projects/bind9/commit/c5d2fc706ca3635d9928c1cc68db73bffb35d772
 Patch38: bind-9.18-CVE-2026-10822.patch
 Patch40: bind-9.18-CVE-2026-10822-test.patch
+# https://gitlab.isc.org/isc-projects/bind9/commit/5a0cef5bdb077df73fa59504efb8ca4c8b0a84c5
+Patch41: bind-9.18-CVE-2026-12617.patch
+# https://gitlab.isc.org/isc-projects/bind9/commit/26437be900c68bbe0974ec9ab804c2894c19c419
+Patch42: bind-9.18-CVE-2026-12617-test.patch
 
 %{?systemd_ordering}
 # https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers

From a0805bd05d20a1739e273febe90e6f17c7c79e65 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 25 Aug 2026 12:38:04 +0200
Subject: [PATCH 452/460] Potential memory usage beyond configured limits
 (CVE-2026-11622)

[9.18] [CVE-2026-11622] sec: usr: Prevent cache exhaustion under sustained attack

The cache memory can become exhausted with expired entries whose memory
is not released due to a sustained attack on the same DNS name that
prevents the cleanup.  This has been fixed.

Closes: https://gitlab.isc.org/isc-projects/bind9/-/work_items/4760
---
 bind-9.18-CVE-2026-11622.patch | 280 +++++++++++++++++++++++++++++++++
 bind.spec                      |   2 +
 2 files changed, 282 insertions(+)
 create mode 100644 bind-9.18-CVE-2026-11622.patch

diff --git a/bind-9.18-CVE-2026-11622.patch b/bind-9.18-CVE-2026-11622.patch
new file mode 100644
index 0000000..8600070
--- /dev/null
+++ b/bind-9.18-CVE-2026-11622.patch
@@ -0,0 +1,280 @@
+From d7e1f4495d6bac8c29b332e04e9b27140339375b Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@sury.org>
+Date: Tue, 23 Jun 2026 10:59:38 +0200
+Subject: [PATCH] Make the dns_slabheaders in the cache reference counted
+
+Instead of only reference counting the enclosing qpcnode, add the
+reference counting directly to the slabheaders.  The reference is
+incremented when an rdataset is bound to the header and decremented when
+the rdataset is disassociated, so a stale slabheader can be removed from
+the node's down chain as soon as its own reference count reaches zero,
+instead of waiting for the whole qpcnode to become unreferenced.
+
+Building on that, clean up the ancient headers eagerly: mark_ancient()
+is made idempotent, releases the header's own (container) reference and
+reaps the stale headers from the node's down chain as soon as their
+references reach zero.  A header evicted over the per-name type limit is
+expired only after the new rdataset has been bound, so the bind's
+increment always precedes mark_ancient()'s decrement.
+
+Because a header can now be reclaimed independently of its node, the
+rdataset iterators must keep the header they are positioned on alive:
+each iterator takes a reference on its current header and releases it
+when it advances or is destroyed.  Iteration otherwise stays lazy and
+re-reads the node on every step, so it still observes records added to
+the node while the iterator is live, as zone signing requires.
+
+The slab headers are shared with the zone databases, so the matching
+increment is added to every bind path.  The noqname/closest proofs hand
+out rdatasets backed by bare slabs that have no header, so they are
+given a separate dns_rdataproof_rdatasetmethods that leaves the
+reference count untouched.
+
+(cherry picked from commit 2dabf117e1264fd13fb33096f87e78a039fd1c6c)
+(cherry picked from commit 231b1ca3edfb26389e1af39181aa6b4413e87ec4)
+---
+ bin/tests/system/reclimit/tests.sh |  4 +-
+ lib/dns/include/dns/rdataslab.h    |  1 +
+ lib/dns/rbtdb.c                    | 77 +++++++++++++++++++++++++-----
+ 3 files changed, 69 insertions(+), 13 deletions(-)
+
+diff --git a/bin/tests/system/reclimit/tests.sh b/bin/tests/system/reclimit/tests.sh
+index c15225488f..55ccac7759 100644
+--- a/bin/tests/system/reclimit/tests.sh
++++ b/bin/tests/system/reclimit/tests.sh
+@@ -338,13 +338,13 @@ echo_i "checking that NXDOMAIN names over the max-types-per-name limit don't get
+ 
+ # Query for 10 NXDOMAIN types
+ for ntype in $(seq 65270 65279); do
+-  check_manytypes 1 manytypes.big "TYPE${ntype}" NOERROR big SOA 0 || ret=1
++  check_manytypes 1 manytypes.big "TYPE${ntype}" NOERROR big SOA 120 || ret=1
+ done
+ # Wait at least 1 second
+ sleep 1
+ # Query for 10 NXDOMAIN types again - these should not be cached
+ for ntype in $(seq 65270 65279); do
+-  check_manytypes 2 manytypes.big "TYPE${ntype}" NOERROR big SOA 0 || ret=1
++  check_manytypes 2 manytypes.big "TYPE${ntype}" NOERROR big SOA 120 || ret=1
+ done
+ 
+ if [ $ret -ne 0 ]; then echo_i "failed"; fi
+diff --git a/lib/dns/include/dns/rdataslab.h b/lib/dns/include/dns/rdataslab.h
+index 5729c004ca..6bd3b5997d 100644
+--- a/lib/dns/include/dns/rdataslab.h
++++ b/lib/dns/include/dns/rdataslab.h
+@@ -44,6 +44,7 @@
+ #include <stdbool.h>
+ 
+ #include <isc/lang.h>
++#include <isc/refcount.h>
+ 
+ #include <dns/types.h>
+ 
+diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
+index 62bc97d783..0b8547950f 100644
+--- a/lib/dns/rbtdb.c
++++ b/lib/dns/rbtdb.c
+@@ -158,6 +158,7 @@ struct noqname {
+ };
+ 
+ typedef struct rdatasetheader {
++	isc_refcount_t references;
+ 	/*%
+ 	 * Locked by the owning node's lock.
+ 	 */
+@@ -1447,6 +1448,7 @@ init_rdataset(dns_rbtdb_t *rbtdb, rdatasetheader_t *h) {
+ 	h->heap_index = 0;
+ 	atomic_init(&h->attributes, 0);
+ 	atomic_init(&h->last_refresh_fail_ts, 0);
++	isc_refcount_init(&h->references, 1);
+ 
+ 	STATIC_ASSERT(sizeof(h->attributes) == 2,
+ 		      "The .attributes field of rdatasetheader_t needs to be "
+@@ -1559,6 +1561,9 @@ rollback_node(dns_rbtnode_t *node, rbtdb_serial_t serial) {
+ 	}
+ }
+ 
++static void
++clean_stale_headers(dns_rbtdb_t *rbtdb, isc_mem_t *mctx, rdatasetheader_t *top);
++
+ static void
+ mark_header_ancient(dns_rbtdb_t *rbtdb, rdatasetheader_t *header) {
+ 	uint_least16_t attributes = atomic_load_acquire(&header->attributes);
+@@ -1584,8 +1589,12 @@ mark_header_ancient(dns_rbtdb_t *rbtdb, rdatasetheader_t *header) {
+ 	update_rrsetstats(rbtdb, header->type, attributes, false);
+ 	header->node->dirty = 1;
+ 
++	isc_refcount_decrement(&header->references);
++
+ 	/* Increment the stats counter for the ancient RRtype. */
+ 	update_rrsetstats(rbtdb, header->type, newattributes, true);
++
++	clean_stale_headers(rbtdb, rbtdb->common.mctx, header);
+ }
+ 
+ static void
+@@ -1621,12 +1630,19 @@ static void
+ clean_stale_headers(dns_rbtdb_t *rbtdb, isc_mem_t *mctx,
+ 		    rdatasetheader_t *top) {
+ 	rdatasetheader_t *d, *down_next;
++	rdatasetheader_t *down_parent = top;
+ 
+ 	for (d = top->down; d != NULL; d = down_next) {
+ 		down_next = d->down;
+-		free_rdataset(rbtdb, mctx, d);
++		d->next = down_parent;
++
++		if (isc_refcount_current(&d->references) == 0) {
++			free_rdataset(rbtdb, mctx, d);
++			down_parent->down = down_next;
++		} else {
++			down_parent = d;
++		}
+ 	}
+-	top->down = NULL;
+ }
+ 
+ static void
+@@ -1642,6 +1658,7 @@ clean_cache_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node) {
+ 	for (current = node->data; current != NULL; current = top_next) {
+ 		top_next = current->next;
+ 		clean_stale_headers(rbtdb, mctx, current);
++		INSIST(current->down == NULL);
+ 		/*
+ 		 * If current is nonexistent, ancient, or stale and
+ 		 * we are not keeping stale, we can clean it up.
+@@ -3114,6 +3131,8 @@ bind_rdataset(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node, rdatasetheader_t *header,
+ 		return;
+ 	}
+ 
++	isc_refcount_increment(&header->references);
++
+ 	dns__rbtnode_acquire(rbtdb, node, locktype);
+ 
+ 	INSIST(rdataset->methods == NULL); /* We must be disassociated. */
+@@ -6307,6 +6326,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, const dns_name_t *nodename,
+ 	bool header_nx;
+ 	bool newheader_nx;
+ 	bool merge;
++	bool do_expireheader = false;
+ 	dns_rdatatype_t rdtype, covers;
+ 	rbtdb_rdatatype_t negtype, sigtype;
+ 	dns_trust_t trust;
+@@ -6856,6 +6876,7 @@ find_header:
+ 			}
+ 
+ 			if (IS_CACHE(rbtdb) && overmaxtype(rbtdb, ntypes)) {
++				do_expireheader = true;
+ 				if (expireheader == NULL) {
+ 					expireheader = newheader;
+ 				}
+@@ -6869,15 +6890,6 @@ find_header:
+ 					 */
+ 					expireheader = newheader;
+ 				}
+-
+-				set_ttl(rbtdb, expireheader, 0);
+-				mark_header_ancient(rbtdb, expireheader);
+-				/*
+-				 * FIXME: In theory, we should mark the RRSIG
+-				 * and the header at the same time, but there is
+-				 * no direct link between those two header, so
+-				 * we would have to check the whole list again.
+-				 */
+ 			}
+ 		}
+ 	}
+@@ -6901,6 +6913,15 @@ find_header:
+ 			      isc_rwlocktype_write, addedrdataset);
+ 	}
+ 
++	/*
++	 * We need to delay the expiration of the header until we are bound to
++	 * it to prevent decrement-then-increment on the header references.
++	 */
++	if (do_expireheader) {
++		set_ttl(rbtdb, expireheader, 0);
++		mark_header_ancient(rbtdb, expireheader);
++	}
++
+ 	return ISC_R_SUCCESS;
+ }
+ 
+@@ -8692,6 +8713,12 @@ rdataset_disassociate(dns_rdataset_t *rdataset) {
+ 	dns_db_t *db = rdataset->private1;
+ 	dns_dbnode_t *node = rdataset->private2;
+ 
++	if (rdataset->methods == &rdataset_methods) {
++		rdatasetheader_t *header = rdataset->private3;
++		header--;
++		isc_refcount_decrement(&header->references);
++	}
++
+ 	detachnode(db, &node);
+ }
+ 
+@@ -8806,6 +8833,11 @@ rdataset_clone(dns_rdataset_t *source, dns_rdataset_t *target) {
+ 	dns_dbnode_t *cloned_node = NULL;
+ 
+ 	attachnode(db, node, &cloned_node);
++	if (source->methods == &rdataset_methods) {
++		rdatasetheader_t *header = source->private3;
++		header--;
++		isc_refcount_increment(&header->references);
++	}
+ 	INSIST(!ISC_LINK_LINKED(target, link));
+ 	*target = *source;
+ 	ISC_LINK_INIT(target, link);
+@@ -8969,6 +9001,11 @@ rdatasetiter_destroy(dns_rdatasetiter_t **iteratorp) {
+ 
+ 	rbtiterator = (rbtdb_rdatasetiter_t *)(*iteratorp);
+ 
++	if (rbtiterator->current != NULL) {
++		isc_refcount_decrement(&rbtiterator->current->references);
++		rbtiterator->current = NULL;
++	}
++
+ 	if (rbtiterator->common.version != NULL) {
+ 		closeversion(rbtiterator->common.db,
+ 			     &rbtiterator->common.version, false);
+@@ -9046,9 +9083,18 @@ rdatasetiter_first(dns_rdatasetiter_t *iterator) {
+ 		}
+ 	}
+ 
++	if (header != NULL) {
++		isc_refcount_increment0(&header->references);
++	}
++
+ 	NODE_UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
+ 		    isc_rwlocktype_read);
+ 
++	if (rbtiterator->current != NULL) {
++		isc_refcount_decrement(&rbtiterator->current->references);
++		rbtiterator->current = NULL;
++	}
++
+ 	rbtiterator->current = header;
+ 
+ 	if (header == NULL) {
+@@ -9140,9 +9186,18 @@ rdatasetiter_next(dns_rdatasetiter_t *iterator) {
+ 		}
+ 	}
+ 
++	if (header != NULL) {
++		isc_refcount_increment0(&header->references);
++	}
++
+ 	NODE_UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
+ 		    isc_rwlocktype_read);
+ 
++	if (rbtiterator->current != NULL) {
++		isc_refcount_decrement(&rbtiterator->current->references);
++		rbtiterator->current = NULL;
++	}
++
+ 	rbtiterator->current = header;
+ 
+ 	if (header == NULL) {
+-- 
+2.55.0
+
diff --git a/bind.spec b/bind.spec
index eaf5eb9..dce493d 100644
--- a/bind.spec
+++ b/bind.spec
@@ -171,6 +171,8 @@ Patch40: bind-9.18-CVE-2026-10822-test.patch
 Patch41: bind-9.18-CVE-2026-12617.patch
 # https://gitlab.isc.org/isc-projects/bind9/commit/26437be900c68bbe0974ec9ab804c2894c19c419
 Patch42: bind-9.18-CVE-2026-12617-test.patch
+# https://gitlab.isc.org/isc-projects/bind9/commit/14d23a4955c62efe974266a8e96a8c5d7caad040
+Patch43: bind-9.18-CVE-2026-11622.patch
 
 %{?systemd_ordering}
 # https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers

From 238ad5761b1f91463a9845296d13483cd08d7593 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 25 Aug 2026 12:46:33 +0200
Subject: [PATCH 453/460] Cache poisoning via label count discrepancy, RRSIG,
 wildcards (CVE-2026-11721)

[9.18] [CVE-2026-11721] sec: usr: Invalid signed wildcard records were being accepted

Signed wildcard responses in which the Labels field in the `RRSIG` record was less than the number of labels in the Signer Name field were being incorrectly accepted. This in turn broke `synth-from-dnssec`, which depends on such records being correctly validated. This has been fixed.

ISC thanks Qifan Zhang of Palo Alto Networks for bringing this issue to our attention.

Closes https://gitlab.isc.org/isc-projects/bind9/-/issues/5871
---
 bind-9.18-CVE-2026-11721-test.patch | 144 +++++++++++++++
 bind-9.18-CVE-2026-11721.patch      | 267 ++++++++++++++++++++++++++++
 bind.spec                           |   3 +
 3 files changed, 414 insertions(+)
 create mode 100644 bind-9.18-CVE-2026-11721-test.patch
 create mode 100644 bind-9.18-CVE-2026-11721.patch

diff --git a/bind-9.18-CVE-2026-11721-test.patch b/bind-9.18-CVE-2026-11721-test.patch
new file mode 100644
index 0000000..7c54994
--- /dev/null
+++ b/bind-9.18-CVE-2026-11721-test.patch
@@ -0,0 +1,144 @@
+From b08e0876639ab9f3dae3813202861fd1098f2611 Mon Sep 17 00:00:00 2001
+From: Mark Andrews <marka@isc.org>
+Date: Tue, 14 Apr 2026 13:46:22 +1000
+Subject: [PATCH] Test RRSIG record parsing
+
+In particular test that labels and signer fields are consistent.
+
+(cherry picked from commit 5a95e64731afe63d348d272cc4d3b2f9847150c2)
+(cherry picked from commit 19e496ca260b6a756ae1378e8ebcbdb666b7d9ed)
+---
+ tests/dns/rdata_test.c | 110 +++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 110 insertions(+)
+
+diff --git a/tests/dns/rdata_test.c b/tests/dns/rdata_test.c
+index 7f0df6e046..c704d98ed1 100644
+--- a/tests/dns/rdata_test.c
++++ b/tests/dns/rdata_test.c
+@@ -2504,6 +2504,115 @@ ISC_RUN_TEST_IMPL(rkey) {
+ 		    dns_rdatatype_rkey, sizeof(dns_rdata_rkey_t));
+ }
+ 
++ISC_RUN_TEST_IMPL(rrsig) {
++	text_ok_t text_ok[] = {
++		TEXT_VALID("SOA 8 0 86400 20260426170000 20260413160000 54393 "
++			   ". "
++			   "tFbcoVP8MnpecUquJ/aj+XeNgV7ts9GSHVkXaXRJrJ/"
++			   "TEkOZApVG0F6E "
++			   "9sYpxGk2ItweLL43ujioGj0HWwZDRR+vbur+O/"
++			   "dIdheiig1VvU+9HXLi "
++			   "QOViY9Kc64ixdyJhYCC5K+bO1qsHxd+"
++			   "KJXOaxyHbqchYkDFy4PL6qftE "
++			   "VaLkueRgjXgOsq/"
++			   "NxvCXDgAa5xy0+3Sl0myxIs8rJ5KeXfJQFe7qxgaw "
++			   "VjJsJTKw8neOTw2rQfLaigWu2LIWw+"
++			   "IyVrLjZJdLqGkiLBGd1w4X3U12 "
++			   "fFxoY3eqzNgBEtduoGKPZ/"
++			   "NpP9cuKJORJ18283aV8hR4WO91VR0q1zcM jLwqUg=="),
++		/* labels too short for signer */
++		TEXT_INVALID("SOA 8 0 86400 20260426170000 20260413160000 "
++			     "54393 example. "
++			     "tFbcoVP8MnpecUquJ/aj+XeNgV7ts9GSHVkXaXRJrJ/"
++			     "TEkOZApVG0F6E "
++			     "9sYpxGk2ItweLL43ujioGj0HWwZDRR+vbur+O/"
++			     "dIdheiig1VvU+9HXLi "
++			     "QOViY9Kc64ixdyJhYCC5K+bO1qsHxd+"
++			     "KJXOaxyHbqchYkDFy4PL6qftE "
++			     "VaLkueRgjXgOsq/"
++			     "NxvCXDgAa5xy0+3Sl0myxIs8rJ5KeXfJQFe7qxgaw "
++			     "VjJsJTKw8neOTw2rQfLaigWu2LIWw+"
++			     "IyVrLjZJdLqGkiLBGd1w4X3U12 "
++			     "fFxoY3eqzNgBEtduoGKPZ/"
++			     "NpP9cuKJORJ18283aV8hR4WO91VR0q1zcM jLwqUg=="),
++		/*
++		 * Sentinel.
++		 */
++		TEXT_SENTINEL()
++	};
++	wire_ok_t wire_ok[] = {
++		WIRE_VALID(0x00, 0x06, 0x08, 0x00, 0x00, 0x01, 0x51, 0x80, 0x69,
++			   0xee, 0x44, 0x90, 0x69, 0xdd, 0x13, 0x00, 0xd4, 0x79,
++			   0x00, 0xb4, 0x56, 0xdc, 0xa1, 0x53, 0xfc, 0x32, 0x7a,
++			   0x5e, 0x71, 0x4a, 0xae, 0x27, 0xf6, 0xa3, 0xf9, 0x77,
++			   0x8d, 0x81, 0x5e, 0xed, 0xb3, 0xd1, 0x92, 0x1d, 0x59,
++			   0x17, 0x69, 0x74, 0x49, 0xac, 0x9f, 0xd3, 0x12, 0x43,
++			   0x99, 0x02, 0x95, 0x46, 0xd0, 0x5e, 0x84, 0xf6, 0xc6,
++			   0x29, 0xc4, 0x69, 0x36, 0x22, 0xdc, 0x1e, 0x2c, 0xbe,
++			   0x37, 0xba, 0x38, 0xa8, 0x1a, 0x3d, 0x07, 0x5b, 0x06,
++			   0x43, 0x45, 0x1f, 0xaf, 0x6e, 0xea, 0xfe, 0x3b, 0xf7,
++			   0x48, 0x76, 0x17, 0xa2, 0x8a, 0x0d, 0x55, 0xbd, 0x4f,
++			   0xbd, 0x1d, 0x72, 0xe2, 0x40, 0xe5, 0x62, 0x63, 0xd2,
++			   0x9c, 0xeb, 0x88, 0xb1, 0x77, 0x22, 0x61, 0x60, 0x20,
++			   0xb9, 0x2b, 0xe6, 0xce, 0xd6, 0xab, 0x07, 0xc5, 0xdf,
++			   0x8a, 0x25, 0x73, 0x9a, 0xc7, 0x21, 0xdb, 0xa9, 0xc8,
++			   0x58, 0x90, 0x31, 0x72, 0xe0, 0xf2, 0xfa, 0xa9, 0xfb,
++			   0x44, 0x55, 0xa2, 0xe4, 0xb9, 0xe4, 0x60, 0x8d, 0x78,
++			   0x0e, 0xb2, 0xaf, 0xcd, 0xc6, 0xf0, 0x97, 0x0e, 0x00,
++			   0x1a, 0xe7, 0x1c, 0xb4, 0xfb, 0x74, 0xa5, 0xd2, 0x6c,
++			   0xb1, 0x22, 0xcf, 0x2b, 0x27, 0x92, 0x9e, 0x5d, 0xf2,
++			   0x50, 0x15, 0xee, 0xea, 0xc6, 0x06, 0xb0, 0x56, 0x32,
++			   0x6c, 0x25, 0x32, 0xb0, 0xf2, 0x77, 0x8e, 0x4f, 0x0d,
++			   0xab, 0x41, 0xf2, 0xda, 0x8a, 0x05, 0xae, 0xd8, 0xb2,
++			   0x16, 0xc3, 0xe2, 0x32, 0x56, 0xb2, 0xe3, 0x64, 0x97,
++			   0x4b, 0xa8, 0x69, 0x22, 0x2c, 0x11, 0x9d, 0xd7, 0x0e,
++			   0x17, 0xdd, 0x4d, 0x76, 0x7c, 0x5c, 0x68, 0x63, 0x77,
++			   0xaa, 0xcc, 0xd8, 0x01, 0x12, 0xd7, 0x6e, 0xa0, 0x62,
++			   0x8f, 0x67, 0xf3, 0x69, 0x3f, 0xd7, 0x2e, 0x28, 0x93,
++			   0x91, 0x27, 0x5f, 0x36, 0xf3, 0x76, 0x95, 0xf2, 0x14,
++			   0x78, 0x58, 0xef, 0x75, 0x55, 0x1d, 0x2a, 0xd7, 0x37,
++			   0x0c, 0x8c, 0xbc, 0x2a, 0x52),
++		/* labels too short for signer */
++		WIRE_INVALID(
++			0x00, 0x06, 0x08, 0x00, 0x00, 0x01, 0x51, 0x80, 0x69,
++			0xee, 0x44, 0x90, 0x69, 0xdd, 0x13, 0x00, 0xd4, 0x79,
++			0x07, 0x65, 0x78, 0x61, 0x6d, 0x70, 0x6c, 0x65, 0x00,
++			0xb4, 0x56, 0xdc, 0xa1, 0x53, 0xfc, 0x32, 0x7a, 0x5e,
++			0x71, 0x4a, 0xae, 0x27, 0xf6, 0xa3, 0xf9, 0x77, 0x8d,
++			0x81, 0x5e, 0xed, 0xb3, 0xd1, 0x92, 0x1d, 0x59, 0x17,
++			0x69, 0x74, 0x49, 0xac, 0x9f, 0xd3, 0x12, 0x43, 0x99,
++			0x02, 0x95, 0x46, 0xd0, 0x5e, 0x84, 0xf6, 0xc6, 0x29,
++			0xc4, 0x69, 0x36, 0x22, 0xdc, 0x1e, 0x2c, 0xbe, 0x37,
++			0xba, 0x38, 0xa8, 0x1a, 0x3d, 0x07, 0x5b, 0x06, 0x43,
++			0x45, 0x1f, 0xaf, 0x6e, 0xea, 0xfe, 0x3b, 0xf7, 0x48,
++			0x76, 0x17, 0xa2, 0x8a, 0x0d, 0x55, 0xbd, 0x4f, 0xbd,
++			0x1d, 0x72, 0xe2, 0x40, 0xe5, 0x62, 0x63, 0xd2, 0x9c,
++			0xeb, 0x88, 0xb1, 0x77, 0x22, 0x61, 0x60, 0x20, 0xb9,
++			0x2b, 0xe6, 0xce, 0xd6, 0xab, 0x07, 0xc5, 0xdf, 0x8a,
++			0x25, 0x73, 0x9a, 0xc7, 0x21, 0xdb, 0xa9, 0xc8, 0x58,
++			0x90, 0x31, 0x72, 0xe0, 0xf2, 0xfa, 0xa9, 0xfb, 0x44,
++			0x55, 0xa2, 0xe4, 0xb9, 0xe4, 0x60, 0x8d, 0x78, 0x0e,
++			0xb2, 0xaf, 0xcd, 0xc6, 0xf0, 0x97, 0x0e, 0x00, 0x1a,
++			0xe7, 0x1c, 0xb4, 0xfb, 0x74, 0xa5, 0xd2, 0x6c, 0xb1,
++			0x22, 0xcf, 0x2b, 0x27, 0x92, 0x9e, 0x5d, 0xf2, 0x50,
++			0x15, 0xee, 0xea, 0xc6, 0x06, 0xb0, 0x56, 0x32, 0x6c,
++			0x25, 0x32, 0xb0, 0xf2, 0x77, 0x8e, 0x4f, 0x0d, 0xab,
++			0x41, 0xf2, 0xda, 0x8a, 0x05, 0xae, 0xd8, 0xb2, 0x16,
++			0xc3, 0xe2, 0x32, 0x56, 0xb2, 0xe3, 0x64, 0x97, 0x4b,
++			0xa8, 0x69, 0x22, 0x2c, 0x11, 0x9d, 0xd7, 0x0e, 0x17,
++			0xdd, 0x4d, 0x76, 0x7c, 0x5c, 0x68, 0x63, 0x77, 0xaa,
++			0xcc, 0xd8, 0x01, 0x12, 0xd7, 0x6e, 0xa0, 0x62, 0x8f,
++			0x67, 0xf3, 0x69, 0x3f, 0xd7, 0x2e, 0x28, 0x93, 0x91,
++			0x27, 0x5f, 0x36, 0xf3, 0x76, 0x95, 0xf2, 0x14, 0x78,
++			0x58, 0xef, 0x75, 0x55, 0x1d, 0x2a, 0xd7, 0x37, 0x0c,
++			0x8c, 0xbc, 0x2a, 0x52),
++
++		WIRE_SENTINEL()
++	};
++	check_rdata(text_ok, wire_ok, NULL, false, dns_rdataclass_in,
++		    dns_rdatatype_rrsig, sizeof(dns_rdata_rrsig_t));
++}
++
+ ISC_RUN_TEST_IMPL(resinfo) {
+ 	text_ok_t text_ok[] = {
+ 		TEXT_VALID_CHANGED("qnamemin exterr=15,16,17 "
+@@ -3357,6 +3466,7 @@ ISC_TEST_ENTRY(nsec3)
+ ISC_TEST_ENTRY(nxt)
+ ISC_TEST_ENTRY(resinfo)
+ ISC_TEST_ENTRY(rkey)
++ISC_TEST_ENTRY(rrsig)
+ ISC_TEST_ENTRY(sshfp)
+ ISC_TEST_ENTRY(wallet)
+ ISC_TEST_ENTRY(wks)
+-- 
+2.55.0
+
diff --git a/bind-9.18-CVE-2026-11721.patch b/bind-9.18-CVE-2026-11721.patch
new file mode 100644
index 0000000..d59130b
--- /dev/null
+++ b/bind-9.18-CVE-2026-11721.patch
@@ -0,0 +1,267 @@
+From 7a8a1f74c742e98fb5e105b013e7c2bd7af4a76c Mon Sep 17 00:00:00 2001
+From: Mark Andrews <marka@isc.org>
+Date: Tue, 14 Apr 2026 15:14:06 +1000
+Subject: [PATCH] Don't sign out of zone records in dnssec-signzone
+
+dnssec-signzone was signing extraneous records that were not within
+the namespace of the zone.  This no longer occurs.
+
+(cherry picked from commit e45c9af7051421fd370f20ba8325199c606223fd)
+
+Don't sign out of zone records in dnssec-signzone
+
+dnssec-signzone was signing extraneous records that were not within
+the namespace of the zone.  This no longer occurs.
+
+(cherry picked from commit e45c9af7051421fd370f20ba8325199c606223fd)
+(cherry picked from commit 1a4986e2533f87e80eb21da3f06708d335aff1e2)
+
+Invalid signed wildcard records were being accepted
+
+An RRSIG whose Labels field indicates fewer labels than its signer
+name requires was being accepted.  When such a record covers a
+wildcard, the validator reconstructs a wildcard owner name above the
+signer's zone and caches it as secure.  RFC 8198 cache synthesis
+(synth-from-dnssec) then serves that forged wildcard for unrelated
+names, poisoning the cache.
+
+These records are now rejected, both when an RRSIG is parsed and when
+its signature is verified.
+
+(cherry picked from commit 084ca5ee10515e461d46b63df9660b8394bc7de9)
+(cherry picked from commit 15089066b15f826d7487c3d160b5872820f84b83)
+---
+ bin/dnssec/dnssec-signzone.c     |  5 ++++
+ lib/dns/dnssec.c                 | 43 +++++++++++++++++++++++---------
+ lib/dns/rdata/generic/rrsig_46.c | 37 ++++++++++++++++++++-------
+ 3 files changed, 64 insertions(+), 21 deletions(-)
+
+diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c
+index 73855e6284..9e3a48a592 100644
+--- a/bin/dnssec/dnssec-signzone.c
++++ b/bin/dnssec/dnssec-signzone.c
+@@ -1643,6 +1643,11 @@ assignwork(isc_task_t *task, isc_task_t *worker) {
+ 			dns_db_detachnode(gdb, &node);
+ 			goto next;
+ 		}
++		if (!dns_name_issubdomain(name, gorigin)) {
++			dumpnode(name, node);
++			dns_db_detachnode(gdb, &node);
++			goto next;
++		}
+ 		/*
+ 		 * Sort the zone data from the glue and out-of-zone data.
+ 		 * For NSEC zones nodes with zone data have NSEC records.
+diff --git a/lib/dns/dnssec.c b/lib/dns/dnssec.c
+index c7e922437c..b12529b5d5 100644
+--- a/lib/dns/dnssec.c
++++ b/lib/dns/dnssec.c
+@@ -130,11 +130,11 @@ dns_dnssec_keyfromrdata(const dns_name_t *name, const dns_rdata_t *rdata,
+ 	isc_buffer_t b;
+ 	isc_region_t r;
+ 
+-	INSIST(name != NULL);
+-	INSIST(rdata != NULL);
+-	INSIST(mctx != NULL);
+-	INSIST(key != NULL);
+-	INSIST(*key == NULL);
++	REQUIRE(name != NULL);
++	REQUIRE(rdata != NULL);
++	REQUIRE(mctx != NULL);
++	REQUIRE(key != NULL);
++	REQUIRE(*key == NULL);
+ 	REQUIRE(rdata->type == dns_rdatatype_key ||
+ 		rdata->type == dns_rdatatype_dnskey);
+ 
+@@ -187,12 +187,14 @@ dns_dnssec_sign(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
+ 	isc_result_t ret;
+ 	isc_buffer_t *databuf = NULL;
+ 	char data[256 + 8];
++	unsigned int labels;
+ 	unsigned int sigsize;
+ 	dns_fixedname_t fnewname;
+ 	dns_fixedname_t fsigner;
+ 
+ 	REQUIRE(name != NULL);
+-	REQUIRE(dns_name_countlabels(name) <= 255);
++	labels = dns_name_countlabels(name);
++	REQUIRE(labels <= 255 && labels > 0);
+ 	REQUIRE(set != NULL);
+ 	REQUIRE(key != NULL);
+ 	REQUIRE(inception != NULL);
+@@ -221,7 +223,7 @@ dns_dnssec_sign(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
+ 
+ 	sig.covered = set->type;
+ 	sig.algorithm = dst_key_alg(key);
+-	sig.labels = dns_name_countlabels(name) - 1;
++	sig.labels = labels - 1;
+ 	if (dns_name_iswildcard(name)) {
+ 		sig.labels--;
+ 	}
+@@ -365,10 +367,13 @@ dns_dnssec_verify(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
+ 	isc_result_t ret;
+ 	unsigned char data[300];
+ 	dst_context_t *ctx = NULL;
+-	int labels = 0;
++	unsigned int labels;
++	unsigned int siglabels;
+ 	bool downcase = false;
+ 
+ 	REQUIRE(name != NULL);
++	labels = dns_name_countlabels(name);
++	REQUIRE(labels > 0);
+ 	REQUIRE(set != NULL);
+ 	REQUIRE(key != NULL);
+ 	REQUIRE(mctx != NULL);
+@@ -383,6 +388,21 @@ dns_dnssec_verify(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
+ 		return DNS_R_SIGINVALID;
+ 	}
+ 
++	/*
++	 * The RRSIG labels field can't indicate fewer labels than the
++	 * signer.  Also the labels shouldn't be greater than that of
++	 * the owner name.
++	 *
++	 * sig.labels doesn't include the root label, so add 1 to account
++	 * for it.
++	 */
++	siglabels = sig.labels + 1;
++	if (siglabels < dns_name_countlabels(&sig.signer) || siglabels > labels)
++	{
++		inc_stat(dns_dnssecstats_fail);
++		return DNS_R_SIGINVALID;
++	}
++
+ 	if (isc_serial_lt(sig.timeexpire, sig.timesigned)) {
+ 		inc_stat(dns_dnssecstats_fail);
+ 		return DNS_R_SIGINVALID;
+@@ -449,10 +469,9 @@ again:
+ 	 * If the name is an expanded wildcard, use the wildcard name.
+ 	 */
+ 	dns_fixedname_init(&fnewname);
+-	labels = dns_name_countlabels(name) - 1;
+ 	RUNTIME_CHECK(dns_name_downcase(name, dns_fixedname_name(&fnewname),
+ 					NULL) == ISC_R_SUCCESS);
+-	if (labels - sig.labels > 0) {
++	if (labels > siglabels) {
+ 		dns_name_split(dns_fixedname_name(&fnewname), sig.labels + 1,
+ 			       NULL, dns_fixedname_name(&fnewname));
+ 	}
+@@ -463,7 +482,7 @@ again:
+ 	 * Create an envelope for each rdata: <name|type|class|ttl>.
+ 	 */
+ 	isc_buffer_init(&envbuf, data, sizeof(data));
+-	if (labels - sig.labels > 0) {
++	if (labels > siglabels) {
+ 		isc_buffer_putuint8(&envbuf, 1);
+ 		isc_buffer_putuint8(&envbuf, '*');
+ 		memmove(data + 2, r.base, r.length);
+@@ -559,7 +578,7 @@ cleanup_struct:
+ 		inc_stat(dns_dnssecstats_fail);
+ 	}
+ 
+-	if (ret == ISC_R_SUCCESS && labels - sig.labels > 0) {
++	if (ret == ISC_R_SUCCESS && labels > siglabels) {
+ 		if (wild != NULL) {
+ 			RUNTIME_CHECK(dns_name_concatenate(
+ 					      dns_wildcardname,
+diff --git a/lib/dns/rdata/generic/rrsig_46.c b/lib/dns/rdata/generic/rrsig_46.c
+index 10bc039e93..4cf4259c2b 100644
+--- a/lib/dns/rdata/generic/rrsig_46.c
++++ b/lib/dns/rdata/generic/rrsig_46.c
+@@ -23,12 +23,12 @@
+ static isc_result_t
+ fromtext_rrsig(ARGS_FROMTEXT) {
+ 	isc_token_t token;
+-	unsigned char c;
++	unsigned char alg, labels;
+ 	long i;
+ 	dns_rdatatype_t covered;
+-	char *e;
++	char *e = NULL;
+ 	isc_result_t result;
+-	dns_name_t name;
++	dns_name_t signer;
+ 	isc_buffer_t buffer;
+ 	uint32_t time_signed, time_expire;
+ 
+@@ -61,8 +61,8 @@ fromtext_rrsig(ARGS_FROMTEXT) {
+ 	 */
+ 	RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_string,
+ 				      false));
+-	RETTOK(dns_secalg_fromtext(&c, &token.value.as_textregion));
+-	RETERR(mem_tobuffer(target, &c, 1));
++	RETTOK(dns_secalg_fromtext(&alg, &token.value.as_textregion));
++	RETERR(mem_tobuffer(target, &alg, 1));
+ 
+ 	/*
+ 	 * Labels.
+@@ -72,8 +72,8 @@ fromtext_rrsig(ARGS_FROMTEXT) {
+ 	if (token.value.as_ulong > 0xffU) {
+ 		RETTOK(ISC_R_RANGE);
+ 	}
+-	c = (unsigned char)token.value.as_ulong;
+-	RETERR(mem_tobuffer(target, &c, 1));
++	labels = (unsigned char)token.value.as_ulong;
++	RETERR(mem_tobuffer(target, &labels, 1));
+ 
+ 	/*
+ 	 * Original ttl.
+@@ -144,12 +144,20 @@ fromtext_rrsig(ARGS_FROMTEXT) {
+ 	 */
+ 	RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_string,
+ 				      false));
+-	dns_name_init(&name, NULL);
++	dns_name_init(&signer, NULL);
+ 	buffer_fromregion(&buffer, &token.value.as_region);
+ 	if (origin == NULL) {
+ 		origin = dns_rootname;
+ 	}
+-	RETTOK(dns_name_fromtext(&name, &buffer, origin, options, target));
++	RETTOK(dns_name_fromtext(&signer, &buffer, origin, options, target));
++
++	/*
++	 * (RRSIG labels doesn't include the root label, so add one
++	 * to normalize it before checking against the signer.)
++	 */
++	if ((unsigned int)(labels + 1) < dns_name_countlabels(&signer)) {
++		RETTOK(ISC_R_RANGE);
++	}
+ 
+ 	/*
+ 	 * Sig.
+@@ -278,6 +286,7 @@ static isc_result_t
+ fromwire_rrsig(ARGS_FROMWIRE) {
+ 	isc_region_t sr;
+ 	dns_name_t name;
++	unsigned char labels;
+ 
+ 	REQUIRE(type == dns_rdatatype_rrsig);
+ 
+@@ -300,6 +309,8 @@ fromwire_rrsig(ARGS_FROMWIRE) {
+ 		return ISC_R_UNEXPECTEDEND;
+ 	}
+ 
++	labels = sr.base[3];
++
+ 	isc_buffer_forward(source, 18);
+ 	RETERR(mem_tobuffer(target, sr.base, 18));
+ 
+@@ -309,6 +320,14 @@ fromwire_rrsig(ARGS_FROMWIRE) {
+ 	dns_name_init(&name, NULL);
+ 	RETERR(dns_name_fromwire(&name, source, dctx, options, target));
+ 
++	/*
++	 * (RRSIG labels doesn't include the root label, so add one
++	 * to normalize it before checking against the signer.)
++	 */
++	if ((unsigned int)(labels + 1) < dns_name_countlabels(&name)) {
++		RETERR(DNS_R_FORMERR);
++	}
++
+ 	/*
+ 	 * Sig.
+ 	 */
+-- 
+2.55.0
+
diff --git a/bind.spec b/bind.spec
index dce493d..97c1f00 100644
--- a/bind.spec
+++ b/bind.spec
@@ -173,6 +173,9 @@ Patch41: bind-9.18-CVE-2026-12617.patch
 Patch42: bind-9.18-CVE-2026-12617-test.patch
 # https://gitlab.isc.org/isc-projects/bind9/commit/14d23a4955c62efe974266a8e96a8c5d7caad040
 Patch43: bind-9.18-CVE-2026-11622.patch
+# https://gitlab.isc.org/isc-projects/bind9/commit/58812f64bf14b3930f5bb90a2d0e1f59bc8260b4
+Patch44: bind-9.18-CVE-2026-11721.patch
+Patch45: bind-9.18-CVE-2026-11721-test.patch
 
 %{?systemd_ordering}
 # https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers

From 7e9f5e27cccd5bc7d917505c4ab025e6c36aa11e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 25 Aug 2026 13:22:35 +0200
Subject: [PATCH 454/460] Incorrect acceptance of NSEC3 records
 (CVE-2026-10723)

[9.18] [CVE-2026-10723] sec: usr: Correct verification of NSEC3 signer name

BIND 9 accepted child-zone NSEC3 records where the first label equals the hash of the parent zone as valid parent-zone closest encloser proofs. This has been fixed.

ISC thanks Qifan Zhang of Palo Alto Networks for reporting the issue.

Closes isc-projects/bind9#5874
---
 bind-9.18-CVE-2026-10723-test.patch | 854 ++++++++++++++++++++++++++++
 bind-9.18-CVE-2026-10723.patch      |  67 +++
 bind.spec                           |   3 +
 3 files changed, 924 insertions(+)
 create mode 100644 bind-9.18-CVE-2026-10723-test.patch
 create mode 100644 bind-9.18-CVE-2026-10723.patch

diff --git a/bind-9.18-CVE-2026-10723-test.patch b/bind-9.18-CVE-2026-10723-test.patch
new file mode 100644
index 0000000..04bff8a
--- /dev/null
+++ b/bind-9.18-CVE-2026-10723-test.patch
@@ -0,0 +1,854 @@
+From 2a4786b0edde59274f682c9bd4ae4026c2d08218 Mon Sep 17 00:00:00 2001
+From: Evan Hunt <each@isc.org>
+Date: Wed, 1 Jul 2026 22:56:02 -0700
+Subject: [PATCH] add isctest.mark method for ecdsa_deterinistic
+
+This checks support for ECDSA deterministic mode in the cryptography
+library.
+
+(cherry picked from commit 6e44151466864d3dd783a20da83d01028781d3e2)
+(cherry picked from commit dc3f52388427f4f94087d984d5a2088b925810e2)
+
+Reproducer for #5874 NSEC3 impersonation
+
+LLM generated.
+
+(cherry picked from commit f3e2eb333be3ac636f745aa13cfb8d9ee8af87d8)
+(cherry picked from commit 35e3d49d2222c13786a06021c7ed583d2a656e51)
+
+Update reproducer #5874
+
+Update the llm generated reproducer:
+- Move server.py into ans1/ans.py
+- Remove unnecessary named.conf configuration options
+- Add comments describing the steps (copied from GL issue)
+- Rename system test
+
+(cherry picked from commit c1321fef165a2ef8c2bff971901c58941e8e694c)
+(cherry picked from commit 833dd3b230b92596074e8da15b12298f46c939f2)
+---
+ bin/tests/system/chain/ans3/ans.py            |  10 +-
+ bin/tests/system/chain/ans4/ans.py            |   8 +-
+ bin/tests/system/cookie/ans9/ans.py           |   7 +-
+ bin/tests/system/digdelv/ans8/ans.py          |   7 +-
+ bin/tests/system/dnssec/ans10/ans.py          |  11 +-
+ bin/tests/system/forward/ans11/ans.py         |  12 +-
+ bin/tests/system/isctest/mark.py              |  12 +
+ .../system/nsec3_impersonation/ans1/ans.py    | 280 ++++++++++++++++++
+ .../nsec3_impersonation/ns2/named.conf.j2     |  33 +++
+ .../tests_nsec3_impersonation.py              | 152 ++++++++++
+ bin/tests/system/qmin/ans2/ans.py             |  11 +-
+ bin/tests/system/qmin/ans3/ans.py             |  11 +-
+ bin/tests/system/qmin/ans4/ans.py             |  11 +-
+ bin/tests/system/resolver/ans10/ans.py        |  12 +-
+ 14 files changed, 529 insertions(+), 48 deletions(-)
+ create mode 100644 bin/tests/system/nsec3_impersonation/ans1/ans.py
+ create mode 100644 bin/tests/system/nsec3_impersonation/ns2/named.conf.j2
+ create mode 100644 bin/tests/system/nsec3_impersonation/tests_nsec3_impersonation.py
+
+diff --git a/bin/tests/system/chain/ans3/ans.py b/bin/tests/system/chain/ans3/ans.py
+index 0a031c1145..7c54c3c51a 100644
+--- a/bin/tests/system/chain/ans3/ans.py
++++ b/bin/tests/system/chain/ans3/ans.py
+@@ -19,10 +19,10 @@ import sys
+ import signal
+ import socket
+ import select
+-from datetime import datetime, timedelta
+-import functools
+ 
+-import dns, dns.message, dns.query
++import dns
++import dns.message
++import dns.query
+ from dns.rdatatype import *
+ from dns.rdataclass import *
+ from dns.rcode import *
+@@ -173,9 +173,9 @@ else:
+ while running:
+     try:
+         inputready, outputready, exceptready = select.select(input, [], [])
+-    except select.error as e:
++    except select.error:
+         break
+-    except socket.error as e:
++    except socket.error:
+         break
+     except KeyboardInterrupt:
+         break
+diff --git a/bin/tests/system/chain/ans4/ans.py b/bin/tests/system/chain/ans4/ans.py
+index c969117368..de536b25bd 100755
+--- a/bin/tests/system/chain/ans4/ans.py
++++ b/bin/tests/system/chain/ans4/ans.py
+@@ -22,7 +22,9 @@ import select
+ from datetime import datetime, timedelta
+ import functools
+ 
+-import dns, dns.message, dns.query
++import dns
++import dns.message
++import dns.query
+ from dns.rdatatype import *
+ from dns.rdataclass import *
+ from dns.rcode import *
+@@ -371,9 +373,9 @@ else:
+ while running:
+     try:
+         inputready, outputready, exceptready = select.select(input, [], [])
+-    except select.error as e:
++    except select.error:
+         break
+-    except socket.error as e:
++    except socket.error:
+         break
+     except KeyboardInterrupt:
+         break
+diff --git a/bin/tests/system/cookie/ans9/ans.py b/bin/tests/system/cookie/ans9/ans.py
+index 3b0f82cc1d..2710386d74 100644
+--- a/bin/tests/system/cookie/ans9/ans.py
++++ b/bin/tests/system/cookie/ans9/ans.py
+@@ -15,9 +15,6 @@ import sys
+ import signal
+ import socket
+ import select
+-from datetime import datetime, timedelta
+-import time
+-import functools
+ 
+ import dns
+ import dns.edns
+@@ -257,9 +254,9 @@ else:
+ while running:
+     try:
+         inputready, outputready, exceptready = select.select(input, [], [])
+-    except select.error as e:
++    except select.error:
+         break
+-    except socket.error as e:
++    except socket.error:
+         break
+     except KeyboardInterrupt:
+         break
+diff --git a/bin/tests/system/digdelv/ans8/ans.py b/bin/tests/system/digdelv/ans8/ans.py
+index 3e18edc1cc..1896a2bafc 100644
+--- a/bin/tests/system/digdelv/ans8/ans.py
++++ b/bin/tests/system/digdelv/ans8/ans.py
+@@ -17,7 +17,8 @@ import socket
+ import select
+ import struct
+ 
+-import dns, dns.message
++import dns
++import dns.message
+ from dns.rcode import *
+ 
+ modes = [
+@@ -109,9 +110,9 @@ hung_conns = []
+ while running:
+     try:
+         inputready, outputready, exceptready = select.select(input, [], [])
+-    except select.error as e:
++    except select.error:
+         break
+-    except socket.error as e:
++    except socket.error:
+         break
+     except KeyboardInterrupt:
+         break
+diff --git a/bin/tests/system/dnssec/ans10/ans.py b/bin/tests/system/dnssec/ans10/ans.py
+index 84bf0a2642..46af72a147 100644
+--- a/bin/tests/system/dnssec/ans10/ans.py
++++ b/bin/tests/system/dnssec/ans10/ans.py
+@@ -16,10 +16,11 @@ import signal
+ import socket
+ import select
+ from datetime import datetime, timedelta
+-import time
+-import functools
+ 
+-import dns, dns.message, dns.query, dns.flags
++import dns
++import dns.message
++import dns.query
++import dns.flags
+ from dns.rdatatype import *
+ from dns.rdataclass import *
+ from dns.rcode import *
+@@ -140,9 +141,9 @@ else:
+ while running:
+     try:
+         inputready, outputready, exceptready = select.select(input, [], [])
+-    except select.error as e:
++    except select.error:
+         break
+-    except socket.error as e:
++    except socket.error:
+         break
+     except KeyboardInterrupt:
+         break
+diff --git a/bin/tests/system/forward/ans11/ans.py b/bin/tests/system/forward/ans11/ans.py
+index 00b5895f76..d5b8a5b037 100644
+--- a/bin/tests/system/forward/ans11/ans.py
++++ b/bin/tests/system/forward/ans11/ans.py
+@@ -16,11 +16,11 @@ import signal
+ import socket
+ import select
+ import struct
+-from datetime import datetime, timedelta
+-import time
+-import functools
+ 
+-import dns, dns.message, dns.query, dns.flags
++import dns
++import dns.message
++import dns.query
++import dns.flags
+ from dns.rdatatype import *
+ from dns.rdataclass import *
+ from dns.rcode import *
+@@ -192,9 +192,9 @@ hung_conns = []
+ while running:
+     try:
+         inputready, outputready, exceptready = select.select(input, [], [])
+-    except select.error as e:
++    except select.error:
+         break
+-    except socket.error as e:
++    except socket.error:
+         break
+     except KeyboardInterrupt:
+         break
+diff --git a/bin/tests/system/isctest/mark.py b/bin/tests/system/isctest/mark.py
+index 53860a806c..098af5acfc 100644
+--- a/bin/tests/system/isctest/mark.py
++++ b/bin/tests/system/isctest/mark.py
+@@ -88,3 +88,15 @@ softhsm2_environment = pytest.mark.skipif(
+     ),
+     reason="SOFTHSM2_CONF and SOFTHSM2_MODULE environmental variables must be set and pkcs11-tool and softhsm2-util tools present",
+ )
++
++ecdsa_deterministic = False
++try:
++    from cryptography.hazmat.backends import default_backend
++
++    ecdsa_deterministic = default_backend().ecdsa_deterministic_supported()
++except Exception:  # pylint: disable=broad-except
++    pass
++
++with_ecdsa_deterministic = pytest.mark.skipif(
++    not ecdsa_deterministic, reason="ECDSA deterministic signing is not supported"
++)
+diff --git a/bin/tests/system/nsec3_impersonation/ans1/ans.py b/bin/tests/system/nsec3_impersonation/ans1/ans.py
+new file mode 100644
+index 0000000000..177e79c195
+--- /dev/null
++++ b/bin/tests/system/nsec3_impersonation/ans1/ans.py
+@@ -0,0 +1,280 @@
++#!/usr/bin/python3
++
++# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
++#
++# SPDX-License-Identifier: MPL-2.0
++#
++# This Source Code Form is subject to the terms of the Mozilla Public
++# License, v. 2.0.  If a copy of the MPL was not distributed with this
++# file, you can obtain one at https://mozilla.org/MPL/2.0/.
++#
++# See the COPYRIGHT file distributed with this work for additional
++# information regarding copyright ownership.
++
++from collections.abc import AsyncGenerator
++from dataclasses import dataclass
++from pathlib import Path
++
++import json
++
++from cryptography.hazmat.primitives import serialization
++
++import dns.dnssec
++import dns.flags
++import dns.message
++import dns.name
++import dns.rcode
++import dns.rdata
++import dns.rdataclass
++import dns.rdatatype
++import dns.rrset
++
++from isctest.asyncserver import (
++    AsyncDnsServer,
++    DnsResponseSend,
++    QueryContext,
++    ResponseHandler,
++)
++
++TTL = 300
++TLD = "tld.test."
++APEX_HASH = "1B40241KFORIOG780N4IKSCRLVETPCTQ"
++ATTACKER = f"{APEX_HASH.lower()}.{TLD}"
++VICTIM = f"victim.{TLD}"
++AUTH_IP = "10.53.0.1"
++
++
++@dataclass(frozen=True)
++class Key:
++    zone: dns.name.Name
++    private_key: object
++    dnskey: dns.rdata.Rdata
++    ds: dns.rdata.Rdata
++
++
++def name(text: str) -> dns.name.Name:
++    return dns.name.from_text(text)
++
++
++def load_keys() -> dict[str, Key]:
++    path = Path(__file__).resolve().parent / "keys.json"
++    with path.open(encoding="utf-8") as keys_file:
++        raw_keys = json.load(keys_file)
++
++    keys = {}
++    for zone, raw_key in raw_keys.items():
++        private_key = serialization.load_pem_private_key(
++            raw_key["private_pem"].encode("ascii"),
++            password=None,
++        )
++        dnskey = dns.rdata.from_text(
++            dns.rdataclass.IN, dns.rdatatype.DNSKEY, raw_key["dnskey"]
++        )
++        ds = dns.rdata.from_text(dns.rdataclass.IN, dns.rdatatype.DS, raw_key["ds"])
++        keys[zone] = Key(name(zone), private_key, dnskey, ds)
++
++    return keys
++
++
++def rrset(owner: str, rdtype: dns.rdatatype.RdataType, *rdatas: str) -> dns.rrset.RRset:
++    return dns.rrset.from_text(owner, TTL, dns.rdataclass.IN, rdtype, *rdatas)
++
++
++def rrset_from_rdata(owner: str, rdata: dns.rdata.Rdata) -> dns.rrset.RRset:
++    return dns.rrset.from_rdata(name(owner), TTL, rdata)
++
++
++def rrsig_rrset(covered: dns.rrset.RRset, signer: Key) -> dns.rrset.RRset:
++    rrsig = dns.dnssec.sign(
++        covered,
++        signer.private_key,
++        signer.zone,
++        signer.dnskey,
++        lifetime=86400,
++        verify=True,
++    )
++    return dns.rrset.from_rdata(covered.name, covered.ttl, rrsig)
++
++
++def add_signed(
++    section: list[dns.rrset.RRset], covered: dns.rrset.RRset, signer: Key
++) -> None:
++    section.append(covered)
++    section.append(rrsig_rrset(covered, signer))
++
++
++def dnskey_rrset(zone: str, zone_key: Key) -> dns.rrset.RRset:
++    return rrset_from_rdata(zone, zone_key.dnskey)
++
++
++def ds_rrset(zone: str, zone_key: Key) -> dns.rrset.RRset:
++    return rrset_from_rdata(zone, zone_key.ds)
++
++
++def soa_rrset(zone: str) -> dns.rrset.RRset:
++    return rrset(
++        zone,
++        dns.rdatatype.SOA,
++        f"ns.{zone} hostmaster.{zone} 1 3600 600 86400 300",
++    )
++
++
++def ns_rrset(zone: str, ns_target: str) -> dns.rrset.RRset:
++    return rrset(zone, dns.rdatatype.NS, ns_target)
++
++
++def glue_rrset(ns_target: str, address: str) -> dns.rrset.RRset:
++    return rrset(ns_target, dns.rdatatype.A, address)
++
++
++def answer_dnskey(response: dns.message.Message, zone: str, zone_key: Key) -> None:
++    add_signed(response.answer, dnskey_rrset(zone, zone_key), zone_key)
++
++
++def answer_soa(response: dns.message.Message, zone: str, zone_key: Key) -> None:
++    add_signed(response.answer, soa_rrset(zone), zone_key)
++
++
++def answer_ns(
++    response: dns.message.Message, zone: str, ns_target: str, zone_key: Key
++) -> None:
++    add_signed(response.answer, ns_rrset(zone, ns_target), zone_key)
++
++
++class SignedResponseHandler(ResponseHandler):
++    def __init__(self, keys: dict[str, Key]) -> None:
++        self.keys = keys
++
++    async def get_responses(
++        self, qctx: QueryContext
++    ) -> AsyncGenerator[DnsResponseSend, None]:
++        qctx.prepare_new_response(with_zone_data=False)
++        qctx.response.flags |= dns.flags.AA
++        qctx.response.set_rcode(dns.rcode.NOERROR)
++        self.respond(qctx)
++        yield DnsResponseSend(qctx.response, authoritative=True)
++
++    def respond(self, qctx: QueryContext) -> None:
++        raise NotImplementedError
++
++
++def child_nsec3_rrset() -> dns.rrset.RRset:
++    rdata = dns.rdata.from_text(
++        dns.rdataclass.IN,
++        dns.rdatatype.NSEC3,
++        f"1 0 0 - {APEX_HASH} NS SOA RRSIG DNSKEY NSEC3PARAM",
++    )
++    return dns.rrset.from_rdata(name(f"{APEX_HASH}.{TLD}"), TTL, rdata)
++
++
++def forged_nxdomain(response: dns.message.Message, keys: dict[str, Key]) -> None:
++    response.set_rcode(dns.rcode.NXDOMAIN)
++
++    add_signed(response.authority, soa_rrset(TLD), keys[TLD])
++
++    # The owner name derives zone "tld.test.", but the RRSIG signer is the
++    # malicious child zone "1b40241kforiog780n4ikscrlvetpctq.tld.test.".
++    add_signed(response.authority, child_nsec3_rrset(), keys[ATTACKER])
++
++
++class VictimForgedNxdomainHandler(SignedResponseHandler):
++    """
++    This serves the forged response for the victim's domain.
++    """
++
++    def match(self, qctx: QueryContext) -> bool:
++        return qctx.qname == name(VICTIM) and qctx.qtype == dns.rdatatype.A
++
++    def respond(self, qctx: QueryContext) -> None:
++        forged_nxdomain(qctx.response, self.keys)
++
++
++class ChildDsHandler(SignedResponseHandler):
++    """
++    This will spoof the response for the malicious zone when qtype is DS.
++    It is actually a validly signed DS response.
++    """
++
++    def match(self, qctx: QueryContext) -> bool:
++        return qctx.qname == name(ATTACKER) and qctx.qtype == dns.rdatatype.DS
++
++    def respond(self, qctx: QueryContext) -> None:
++        response = qctx.response
++        zone = ATTACKER
++        child_key = self.keys[ATTACKER]
++        parent_key = self.keys[TLD]
++
++        add_signed(response.answer, ds_rrset(zone, child_key), parent_key)
++
++
++class AttackerZoneHandler(SignedResponseHandler):
++    """
++    Acts as the malicious authoritative name server. The zone being served
++    is the hashed label of the parent zone (tld.test). This will respond
++    for all queries qtype SOA, DNSKEY, NS at the apex. Any names below
++    the apex are answered with an NXDOMAIN with no NSEC or NSEC3 present.
++    """
++
++    def match(self, qctx: QueryContext) -> bool:
++        return qctx.qname.is_subdomain(name(ATTACKER))
++
++    def respond(self, qctx: QueryContext) -> None:
++        if qctx.qname == name(ATTACKER):
++            if qctx.qtype == dns.rdatatype.DNSKEY:
++                answer_dnskey(qctx.response, ATTACKER, self.keys[ATTACKER])
++            elif qctx.qtype == dns.rdatatype.SOA:
++                answer_soa(qctx.response, ATTACKER, self.keys[ATTACKER])
++            else:
++                answer_ns(
++                    qctx.response, ATTACKER, f"ns.{ATTACKER}", self.keys[ATTACKER]
++                )
++                qctx.response.additional.append(glue_rrset(f"ns.{ATTACKER}", AUTH_IP))
++            return
++
++        qctx.response.set_rcode(dns.rcode.NXDOMAIN)
++        add_signed(qctx.response.authority, soa_rrset(ATTACKER), self.keys[ATTACKER])
++
++
++class TldZoneHandler(SignedResponseHandler):
++    """
++    Acts as the TLD who is being used in the attack, but is not a standard
++    name server. It only responds with validly signed records for DNSKEY, SOA
++    and NS on the apex. Any names below the apex are answered with an NXDOMAIN
++    with no NSEC or NSEC3 present.
++
++    If we turn this into a regular name server than the attack won't work.
++    The attack assumes that the adversary can inject these responses on-path.
++    """
++
++    def match(self, qctx: QueryContext) -> bool:
++        return qctx.qname.is_subdomain(name(TLD))
++
++    def respond(self, qctx: QueryContext) -> None:
++        if qctx.qname == name(TLD):
++            if qctx.qtype == dns.rdatatype.DNSKEY:
++                answer_dnskey(qctx.response, TLD, self.keys[TLD])
++            elif qctx.qtype == dns.rdatatype.SOA:
++                answer_soa(qctx.response, TLD, self.keys[TLD])
++            else:
++                answer_ns(qctx.response, TLD, "ns.tld.test.", self.keys[TLD])
++                qctx.response.additional.append(glue_rrset("ns.tld.test.", AUTH_IP))
++            return
++
++        qctx.response.set_rcode(dns.rcode.NXDOMAIN)
++        add_signed(qctx.response.authority, soa_rrset(TLD), self.keys[TLD])
++
++
++def main() -> None:
++    keys = load_keys()
++    server = AsyncDnsServer(default_aa=True)
++    server.install_response_handlers(
++        VictimForgedNxdomainHandler(keys),
++        ChildDsHandler(keys),
++        AttackerZoneHandler(keys),
++        TldZoneHandler(keys),
++    )
++    server.run()
++
++
++if __name__ == "__main__":
++    main()
+diff --git a/bin/tests/system/nsec3_impersonation/ns2/named.conf.j2 b/bin/tests/system/nsec3_impersonation/ns2/named.conf.j2
+new file mode 100644
+index 0000000000..2c9b0bba9e
+--- /dev/null
++++ b/bin/tests/system/nsec3_impersonation/ns2/named.conf.j2
+@@ -0,0 +1,33 @@
++// validating resolver
++
++options {
++	query-source address 10.53.0.2;
++	notify-source 10.53.0.2;
++	transfer-source 10.53.0.2;
++	port @PORT@;
++	pid-file "named.pid";
++	listen-on { 10.53.0.2; };
++	listen-on-v6 { none; };
++	recursion yes;
++	dnssec-validation yes;
++};
++
++controls {
++	inet 10.53.0.2 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
++};
++
++include "../../_common/rndc.key";
++
++zone "." {
++	type hint;
++	file "../../_common/root.hint";
++};
++
++zone "tld.test" {
++	type static-stub;
++	server-addresses { 10.53.0.1; };
++};
++
++trust-anchors {
++	tld.test. static-key 257 3 13 "@TLD_DNSKEY@";
++};
+diff --git a/bin/tests/system/nsec3_impersonation/tests_nsec3_impersonation.py b/bin/tests/system/nsec3_impersonation/tests_nsec3_impersonation.py
+new file mode 100644
+index 0000000000..bd9bd275b6
+--- /dev/null
++++ b/bin/tests/system/nsec3_impersonation/tests_nsec3_impersonation.py
+@@ -0,0 +1,152 @@
++#!/usr/bin/python3
++
++# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
++#
++# SPDX-License-Identifier: MPL-2.0
++#
++# This Source Code Form is subject to the terms of the Mozilla Public
++# License, v. 2.0.  If a copy of the MPL was not distributed with this
++# file, you can obtain one at https://mozilla.org/MPL/2.0/.
++#
++# See the COPYRIGHT file distributed with this work for additional
++# information regarding copyright ownership.
++
++from pathlib import Path
++
++import json
++
++from cryptography.hazmat.primitives import serialization
++from cryptography.hazmat.primitives.asymmetric import ec
++
++import dns.dnssec
++import dns.flags
++import dns.name
++import dns.rdataclass
++import dns.rdatatype
++import pytest
++
++import isctest
++import isctest.mark
++
++APEX_HASH = "1B40241KFORIOG780N4IKSCRLVETPCTQ"
++ATTACKER = f"{APEX_HASH.lower()}.tld.test."
++VICTIM = "victim.tld.test."
++AUTH = "10.53.0.1"
++RESOLVER = "10.53.0.2"
++
++pytestmark = [
++    isctest.mark.with_ecdsa_deterministic,
++    pytest.mark.extra_artifacts(
++        [
++            "ans*/ans.run",
++            "ans*/keys.json",
++        ]
++    ),
++]
++
++
++def _make_key(zone):
++    private_key = ec.generate_private_key(ec.SECP256R1())
++    dnskey = dns.dnssec.make_dnskey(
++        private_key.public_key(),
++        algorithm="ECDSAP256SHA256",
++        flags=257,
++    )
++    ds = dns.dnssec.make_ds(dns.name.from_text(zone), dnskey, "SHA256")
++    private_pem = private_key.private_bytes(
++        encoding=serialization.Encoding.PEM,
++        format=serialization.PrivateFormat.PKCS8,
++        encryption_algorithm=serialization.NoEncryption(),
++    ).decode("ascii")
++    return {
++        "private_pem": private_pem,
++        "dnskey": dnskey.to_text(),
++        "ds": ds.to_text(),
++    }
++
++
++def bootstrap():
++    zones = ["tld.test.", ATTACKER]
++    keys = {zone: _make_key(zone) for zone in zones}
++
++    Path("ans1/keys.json").write_text(json.dumps(keys, indent=2), encoding="ascii")
++
++    tld_dnskey = "".join(keys["tld.test."]["dnskey"].split()[3:])
++    return {"TLD_DNSKEY": tld_dnskey}
++
++
++def check_dnskey_response(zone):
++    query = isctest.query.create(zone, "DNSKEY")
++    response = isctest.query.tcp(query, AUTH)
++
++    isctest.check.noerror(response)
++    assert response.flags & dns.flags.AA
++    assert (
++        response.get_rrset(
++            response.answer,
++            dns.name.from_text(zone),
++            dns.rdataclass.IN,
++            dns.rdatatype.DNSKEY,
++        )
++        is not None
++    ), response
++
++
++def check_ds_response(zone):
++    query = isctest.query.create(zone, "DS")
++    response = isctest.query.tcp(query, AUTH)
++
++    isctest.check.noerror(response)
++    assert response.flags & dns.flags.AA
++    assert (
++        response.get_rrset(
++            response.answer,
++            dns.name.from_text(zone),
++            dns.rdataclass.IN,
++            dns.rdatatype.DS,
++        )
++        is not None
++    ), response
++
++
++def test_attack_responses():
++    check_dnskey_response("tld.test.")
++    check_dnskey_response(ATTACKER)
++    check_ds_response(ATTACKER)
++
++    query = isctest.query.create(VICTIM, "A")
++    response = isctest.query.tcp(query, AUTH)
++
++    isctest.check.nxdomain(response)
++    assert response.flags & dns.flags.AA
++
++    nsec3_owner = dns.name.from_text(f"{APEX_HASH}.tld.test.")
++    nsec3 = response.get_rrset(
++        response.authority,
++        nsec3_owner,
++        dns.rdataclass.IN,
++        dns.rdatatype.NSEC3,
++    )
++    rrsig = response.get_rrset(
++        response.authority,
++        nsec3_owner,
++        dns.rdataclass.IN,
++        dns.rdatatype.RRSIG,
++        covers=dns.rdatatype.NSEC3,
++    )
++
++    assert nsec3 is not None, response
++    assert rrsig is not None, response
++    assert rrsig[0].signer == dns.name.from_text(ATTACKER)
++
++
++def test_nsec3_impersonation():
++    """
++    Reproducer for #5874:
++    F-006 DNSSEC Validation Bypass NSEC3 Apex Hash Label Parent Impersonation
++    """
++    query = isctest.query.create(VICTIM, "A")
++    response = isctest.query.tcp(query, RESOLVER)
++
++    isctest.check.noadflag(response)
++    isctest.check.servfail(response)
+diff --git a/bin/tests/system/qmin/ans2/ans.py b/bin/tests/system/qmin/ans2/ans.py
+index d372c2003b..9343fbc8ef 100755
+--- a/bin/tests/system/qmin/ans2/ans.py
++++ b/bin/tests/system/qmin/ans2/ans.py
+@@ -15,11 +15,12 @@ import sys
+ import signal
+ import socket
+ import select
+-from datetime import datetime, timedelta
+ import time
+-import functools
+ 
+-import dns, dns.message, dns.query, dns.flags
++import dns
++import dns.message
++import dns.query
++import dns.flags
+ from dns.rdatatype import *
+ from dns.rdataclass import *
+ from dns.rcode import *
+@@ -432,9 +433,9 @@ else:
+ while running:
+     try:
+         inputready, outputready, exceptready = select.select(input, [], [])
+-    except select.error as e:
++    except select.error:
+         break
+-    except socket.error as e:
++    except socket.error:
+         break
+     except KeyboardInterrupt:
+         break
+diff --git a/bin/tests/system/qmin/ans3/ans.py b/bin/tests/system/qmin/ans3/ans.py
+index b5ae73c3fa..4e7250790f 100755
+--- a/bin/tests/system/qmin/ans3/ans.py
++++ b/bin/tests/system/qmin/ans3/ans.py
+@@ -15,11 +15,12 @@ import sys
+ import signal
+ import socket
+ import select
+-from datetime import datetime, timedelta
+ import time
+-import functools
+ 
+-import dns, dns.message, dns.query, dns.flags
++import dns
++import dns.message
++import dns.query
++import dns.flags
+ from dns.rdatatype import *
+ from dns.rdataclass import *
+ from dns.rcode import *
+@@ -261,9 +262,9 @@ else:
+ while running:
+     try:
+         inputready, outputready, exceptready = select.select(input, [], [])
+-    except select.error as e:
++    except select.error:
+         break
+-    except socket.error as e:
++    except socket.error:
+         break
+     except KeyboardInterrupt:
+         break
+diff --git a/bin/tests/system/qmin/ans4/ans.py b/bin/tests/system/qmin/ans4/ans.py
+index 517217aec1..2d5556daff 100755
+--- a/bin/tests/system/qmin/ans4/ans.py
++++ b/bin/tests/system/qmin/ans4/ans.py
+@@ -15,11 +15,12 @@ import sys
+ import signal
+ import socket
+ import select
+-from datetime import datetime, timedelta
+ import time
+-import functools
+ 
+-import dns, dns.message, dns.query, dns.flags
++import dns
++import dns.message
++import dns.query
++import dns.flags
+ from dns.rdatatype import *
+ from dns.rdataclass import *
+ from dns.rcode import *
+@@ -320,9 +321,9 @@ else:
+ while running:
+     try:
+         inputready, outputready, exceptready = select.select(input, [], [])
+-    except select.error as e:
++    except select.error:
+         break
+-    except socket.error as e:
++    except socket.error:
+         break
+     except KeyboardInterrupt:
+         break
+diff --git a/bin/tests/system/resolver/ans10/ans.py b/bin/tests/system/resolver/ans10/ans.py
+index 6e95dbbfc6..d637c63e5a 100644
+--- a/bin/tests/system/resolver/ans10/ans.py
++++ b/bin/tests/system/resolver/ans10/ans.py
+@@ -15,11 +15,11 @@ import sys
+ import signal
+ import socket
+ import select
+-from datetime import datetime, timedelta
+-import time
+-import functools
+ 
+-import dns, dns.message, dns.query, dns.flags
++import dns
++import dns.message
++import dns.query
++import dns.flags
+ from dns.rdatatype import *
+ from dns.rdataclass import *
+ from dns.rcode import *
+@@ -128,9 +128,9 @@ else:
+ while running:
+     try:
+         inputready, outputready, exceptready = select.select(input, [], [])
+-    except select.error as e:
++    except select.error:
+         break
+-    except socket.error as e:
++    except socket.error:
+         break
+     except KeyboardInterrupt:
+         break
+-- 
+2.55.0
+
diff --git a/bind-9.18-CVE-2026-10723.patch b/bind-9.18-CVE-2026-10723.patch
new file mode 100644
index 0000000..a519b38
--- /dev/null
+++ b/bind-9.18-CVE-2026-10723.patch
@@ -0,0 +1,67 @@
+From 608026780a43abe5b23a9af3af21808369032158 Mon Sep 17 00:00:00 2001
+From: Evan Hunt <each@isc.org>
+Date: Thu, 21 May 2026 14:41:55 -0700
+Subject: [PATCH] Check NSEC3 signer matches the owning zone
+
+When validating NSEC3 records, reject any signature whose signer field
+does not match the zone owning the NSEC3.
+
+This ensures that a child zone cannot impersonate its parent and forge
+NXDOMAIN responses for sibling domains.
+
+Fixes: isc-projects/bind9#5874
+(cherry picked from commit 6e5066bb1f0f12d090e8707adb7d6ccf74f8012b)
+(cherry picked from commit c9cb6a5e24e43489cf3fd4d4cc2193b6a74499cb)
+---
+ lib/dns/dnssec.c | 19 +++++++++++++++++--
+ lib/isc/result.c |  2 +-
+ 2 files changed, 18 insertions(+), 3 deletions(-)
+
+diff --git a/lib/dns/dnssec.c b/lib/dns/dnssec.c
+index b12529b5d5..9b9b1f2bb2 100644
+--- a/lib/dns/dnssec.c
++++ b/lib/dns/dnssec.c
+@@ -424,10 +424,25 @@ dns_dnssec_verify(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
+ 	}
+ 
+ 	/*
+-	 * NS, SOA and DNSKEY records are signed by their owner.
+-	 * DS records are signed by the parent.
++	 * NS, SOA and DNSKEY records are signed by their owners.
++	 * NSEC3 records are signed by the apex, exactly one level up
++	 * from their owner names.
++	 * DS records are signed by the parent zone.
+ 	 */
+ 	switch (set->type) {
++	case dns_rdatatype_nsec3: {
++		dns_name_t apex = DNS_NAME_INITEMPTY;
++		labels = dns_name_countlabels(name);
++		if (labels <= 1) {
++			inc_stat(dns_dnssecstats_fail);
++			return DNS_R_INVALIDNSEC3;
++		}
++		dns_name_split(name, labels - 1, NULL, &apex);
++		if (!dns_name_equal(&apex, &sig.signer)) {
++			inc_stat(dns_dnssecstats_fail);
++			return DNS_R_SIGINVALID;
++		}
++	} break;
+ 	case dns_rdatatype_ns:
+ 	case dns_rdatatype_soa:
+ 	case dns_rdatatype_dnskey:
+diff --git a/lib/isc/result.c b/lib/isc/result.c
+index 83e8cfeed7..b76c3d1f7b 100644
+--- a/lib/isc/result.c
++++ b/lib/isc/result.c
+@@ -198,7 +198,7 @@ static const char *description[ISC_R_NRESULTS] = {
+ 	[DNS_R_COVERINGNSEC] = "covering NSEC record returned",
+ 	[DNS_R_MXISADDRESS] = "MX is an address",
+ 	[DNS_R_DUPLICATE] = "duplicate query",
+-	[DNS_R_INVALIDNSEC3] = "invalid NSEC3 owner name (wildcard)",
++	[DNS_R_INVALIDNSEC3] = "invalid NSEC3 owner name",
+ 	[DNS_R_NOTPRIMARY] = "not primary",
+ 	[DNS_R_BROKENCHAIN] = "broken trust chain",
+ 	[DNS_R_EXPIRED] = "expired",
+-- 
+2.55.0
+
diff --git a/bind.spec b/bind.spec
index 97c1f00..08b85ad 100644
--- a/bind.spec
+++ b/bind.spec
@@ -176,6 +176,9 @@ Patch43: bind-9.18-CVE-2026-11622.patch
 # https://gitlab.isc.org/isc-projects/bind9/commit/58812f64bf14b3930f5bb90a2d0e1f59bc8260b4
 Patch44: bind-9.18-CVE-2026-11721.patch
 Patch45: bind-9.18-CVE-2026-11721-test.patch
+# https://gitlab.isc.org/isc-projects/bind9/commit/348fd47f7636f610a39ba98427fcacab8e62389b
+Patch46: bind-9.18-CVE-2026-10723.patch
+Patch47: bind-9.18-CVE-2026-10723-test.patch
 
 %{?systemd_ordering}
 # https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers

From 711c5c46ba5a4ac6163a69bda924cbf4410bf01c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 25 Aug 2026 13:28:00 +0200
Subject: [PATCH 455/460] Unexpected exit with NSEC and NSEC3 both present
 (CVE-2026-13204)

[9.18] [CVE-2026-13204] fix: usr: Prevent crash from malformed NSEC/NSEC3 response

An assertion could be triggered by an improperly signed NOQNAME proof. This has been fixed.

ISC thanks Qifan Zhang of Palo Alto Networks for reporting the issue.

Closes https://gitlab.isc.org/isc-projects/bind9/-/issues/5985
---
 bind-9.18-CVE-2026-13204-test.patch | 416 ++++++++++++++++++++++++++++
 bind-9.18-CVE-2026-13204.patch      | 158 +++++++++++
 bind.spec                           |   3 +
 3 files changed, 577 insertions(+)
 create mode 100644 bind-9.18-CVE-2026-13204-test.patch
 create mode 100644 bind-9.18-CVE-2026-13204.patch

diff --git a/bind-9.18-CVE-2026-13204-test.patch b/bind-9.18-CVE-2026-13204-test.patch
new file mode 100644
index 0000000..fc86b42
--- /dev/null
+++ b/bind-9.18-CVE-2026-13204-test.patch
@@ -0,0 +1,416 @@
+From 89e950d215e9922e5af6e3c69b9d6a8750346bb6 Mon Sep 17 00:00:00 2001
+From: Alessio Podda <alessio@isc.org>
+Date: Fri, 12 Jun 2026 11:16:01 +0200
+Subject: [PATCH] Reproducer for #5985 addnoqname mismatch
+
+LLM generated.
+
+(cherry picked from commit 5f4de929b3e4749b6e32c51660be11c47c2514e6)
+(cherry picked from commit 0cf010c153518f1f9831e201891ecba8d8ba65e1)
+
+Update reproducer #5985
+
+Update the llm generated reproducer:
+- Move server.py into ans/ans1.py
+- Remove unncessary named.conf configuration options
+- Add comments describing the steps
+- Rename system test
+
+(cherry picked from commit fd539807829dd7d2eb76c8b503083f5d84fec6f0)
+(cherry picked from commit 6c0e599ea85c0c53a4af09742e64e193da089bb4)
+---
+ .../dnssec_findnoqname_mismatch/ans1/ans.py   | 207 ++++++++++++++++++
+ .../ns2/named.conf.j2                         |  33 +++
+ .../tests_findnoqname_mismatch.py             | 126 +++++++++++
+ 3 files changed, 366 insertions(+)
+ create mode 100644 bin/tests/system/dnssec_findnoqname_mismatch/ans1/ans.py
+ create mode 100644 bin/tests/system/dnssec_findnoqname_mismatch/ns2/named.conf.j2
+ create mode 100644 bin/tests/system/dnssec_findnoqname_mismatch/tests_findnoqname_mismatch.py
+
+diff --git a/bin/tests/system/dnssec_findnoqname_mismatch/ans1/ans.py b/bin/tests/system/dnssec_findnoqname_mismatch/ans1/ans.py
+new file mode 100644
+index 0000000000..b36fc831c8
+--- /dev/null
++++ b/bin/tests/system/dnssec_findnoqname_mismatch/ans1/ans.py
+@@ -0,0 +1,207 @@
++#!/usr/bin/python3
++
++# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
++#
++# SPDX-License-Identifier: MPL-2.0
++
++from collections.abc import AsyncGenerator
++from dataclasses import dataclass
++from datetime import datetime, timedelta, timezone
++from pathlib import Path
++
++import base64
++import json
++
++from cryptography.hazmat.primitives import serialization
++
++import dns.dnssec
++import dns.flags
++import dns.message
++import dns.name
++import dns.rdata
++import dns.rdataclass
++import dns.rcode
++import dns.rdatatype
++import dns.rrset
++
++from isctest.asyncserver import (
++    AsyncDnsServer,
++    DnsResponseSend,
++    QueryContext,
++    ResponseHandler,
++)
++
++TTL = 300
++ZONE = "f217.test."
++CHILD = f"evil.{ZONE}"
++ATTACK = f"www.{CHILD}"
++NSEC_OWNER = f"00000000.{CHILD}"
++NSEC_NEXT = f"zzz.{CHILD}"
++FORGED_A = "192.0.2.217"
++
++
++@dataclass(frozen=True)
++class Key:
++    zone: dns.name.Name
++    private_key: object
++    dnskey: dns.rdata.Rdata
++
++
++def name(text: str) -> dns.name.Name:
++    return dns.name.from_text(text)
++
++
++def load_key() -> Key:
++    path = Path(__file__).resolve().parent / "keys.json"
++    with path.open(encoding="utf-8") as keys_file:
++        raw_key = json.load(keys_file)[ZONE]
++
++    private_key = serialization.load_pem_private_key(
++        raw_key["private_pem"].encode("ascii"),
++        password=None,
++    )
++    dnskey = dns.rdata.from_text(
++        dns.rdataclass.IN, dns.rdatatype.DNSKEY, raw_key["dnskey"]
++    )
++    return Key(name(ZONE), private_key, dnskey)
++
++
++def rrset(owner: str, rdtype: dns.rdatatype.RdataType, *rdatas: str) -> dns.rrset.RRset:
++    return dns.rrset.from_text(owner, TTL, dns.rdataclass.IN, rdtype, *rdatas)
++
++
++def rrset_from_rdata(owner: str, rdata: dns.rdata.Rdata) -> dns.rrset.RRset:
++    return dns.rrset.from_rdata(name(owner), TTL, rdata)
++
++
++def add_signed(
++    section: list[dns.rrset.RRset], covered: dns.rrset.RRset, signer: Key
++) -> None:
++    rrsig = dns.dnssec.sign(
++        covered,
++        signer.private_key,
++        signer.zone,
++        signer.dnskey,
++        lifetime=86400,
++        verify=True,
++    )
++    section.append(covered)
++    section.append(dns.rrset.from_rdata(covered.name, covered.ttl, rrsig))
++
++
++def soa_rrset(zone: str) -> dns.rrset.RRset:
++    return rrset(
++        zone,
++        dns.rdatatype.SOA,
++        f"ns.{ZONE} hostmaster.{ZONE} 1 7200 3600 1209600 300",
++    )
++
++
++def garbage_rrsig(
++    owner: str, covered: dns.rdatatype.RdataType, labels: int, signer: str
++) -> dns.rrset.RRset:
++    now = datetime.now(timezone.utc)
++    inception = (now - timedelta(hours=1)).strftime("%Y%m%d%H%M%S")
++    expiration = (now + timedelta(days=1)).strftime("%Y%m%d%H%M%S")
++    signature = base64.b64encode(bytes(64)).decode("ascii")
++    text = (
++        f"{dns.rdatatype.to_text(covered)} 13 {labels} {TTL} "
++        f"{expiration} {inception} 12345 {signer} {signature}"
++    )
++    rdata = dns.rdata.from_text(dns.rdataclass.IN, dns.rdatatype.RRSIG, text)
++    return dns.rrset.from_rdata(name(owner), TTL, rdata)
++
++
++def add_ds_denial(response: dns.message.Message, key: Key) -> None:
++    add_signed(response.authority, soa_rrset(ZONE), key)
++    nsec = rrset(CHILD, dns.rdatatype.NSEC, f"ns.{ZONE} NS RRSIG NSEC")
++    add_signed(response.authority, nsec, key)
++
++
++def add_attack_answer(response: dns.message.Message) -> None:
++    """
++    Crafted authoritative response to <q>.evil.f217.hack./A
++
++        ;; ANSWER
++        <q>.evil.f217.hack.        300 IN A     192.0.2.217
++        <q>.evil.f217.hack.        300 IN RRSIG A 13 1 300 <exp> <inc> 12345 evil.f217.hack. <base64 of 64×0x00>
++                                                    ^^^ Labels = 1, qname has 4 labels, wildcard heuristic fires
++
++        ;; AUTHORITY (single owner, three rdatasets in this wire order)
++        00000000.evil.f217.hack.   300 IN NSEC  zzz.evil.f217.hack. A RRSIG NSEC
++        00000000.evil.f217.hack.   300 IN RRSIG NSEC 13 4 300 <exp> <inc> 12345 evil.f217.hack. <base64 of 64×0x00>
++        00000000.evil.f217.hack.   300 IN NSEC3 1 0 0 - VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV A RRSIG
++    """
++    # A + RRSIG
++    response.answer.append(rrset(ATTACK, dns.rdatatype.A, FORGED_A))
++    response.answer.append(garbage_rrsig(ATTACK, dns.rdatatype.A, 1, CHILD))
++    # NSEC
++    nsec = rrset(
++        NSEC_OWNER,
++        dns.rdatatype.NSEC,
++        f"{NSEC_NEXT} A RRSIG NSEC",
++    )
++    response.authority.append(nsec)
++    # RRSIG(NSEC)
++    response.authority.append(
++        garbage_rrsig(
++            NSEC_OWNER,
++            dns.rdatatype.NSEC,
++            len(name(NSEC_OWNER).labels) - 1,
++            CHILD,
++        )
++    )
++    # NSEC3
++    nsec3 = rrset(
++        NSEC_OWNER,
++        dns.rdatatype.NSEC3,
++        "1 0 0 - VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV A RRSIG",
++    )
++    response.authority.append(nsec3)
++
++
++class RuntimeCheckHandler(ResponseHandler):
++    def __init__(self, key: Key) -> None:
++        self.key = key
++        self.zone = name(ZONE)
++        self.child = name(CHILD)
++        self.attack = name(ATTACK)
++
++    def match(self, qctx: QueryContext) -> bool:
++        return qctx.qname.is_subdomain(self.zone)
++
++    async def get_responses(
++        self, qctx: QueryContext
++    ) -> AsyncGenerator[DnsResponseSend, None]:
++        qctx.prepare_new_response(with_zone_data=False)
++        qctx.response.flags |= dns.flags.AA
++        qctx.response.set_rcode(dns.rcode.NOERROR)
++
++        if qctx.qname == self.zone and qctx.qtype == dns.rdatatype.DNSKEY:
++            add_signed(
++                qctx.response.answer,
++                rrset_from_rdata(ZONE, self.key.dnskey),
++                self.key,
++            )
++        elif qctx.qname == self.zone and qctx.qtype == dns.rdatatype.SOA:
++            add_signed(qctx.response.answer, soa_rrset(ZONE), self.key)
++        elif qctx.qname == self.child and qctx.qtype == dns.rdatatype.DS:
++            add_ds_denial(qctx.response, self.key)
++        elif qctx.qname == self.child and qctx.qtype == dns.rdatatype.DNSKEY:
++            qctx.response.authority.append(soa_rrset(CHILD))
++        elif qctx.qname == self.attack and qctx.qtype == dns.rdatatype.A:
++            add_attack_answer(qctx.response)
++        else:
++            add_signed(qctx.response.authority, soa_rrset(ZONE), self.key)
++
++        yield DnsResponseSend(qctx.response, authoritative=True)
++
++
++def main() -> None:
++    server = AsyncDnsServer(default_aa=True)
++    server.install_response_handlers(RuntimeCheckHandler(load_key()))
++    server.run()
++
++
++if __name__ == "__main__":
++    main()
+diff --git a/bin/tests/system/dnssec_findnoqname_mismatch/ns2/named.conf.j2 b/bin/tests/system/dnssec_findnoqname_mismatch/ns2/named.conf.j2
+new file mode 100644
+index 0000000000..f4fbd8a617
+--- /dev/null
++++ b/bin/tests/system/dnssec_findnoqname_mismatch/ns2/named.conf.j2
+@@ -0,0 +1,33 @@
++// validating resolver
++
++options {
++	query-source address 10.53.0.2;
++	notify-source 10.53.0.2;
++	transfer-source 10.53.0.2;
++	port @PORT@;
++	pid-file "named.pid";
++	listen-on { 10.53.0.2; };
++	listen-on-v6 { none; };
++	recursion yes;
++	dnssec-validation yes;
++};
++
++controls {
++	inet 10.53.0.2 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
++};
++
++include "../../_common/rndc.key";
++
++zone "." {
++	type hint;
++	file "../../_common/root.hint";
++};
++
++zone "f217.test" {
++	type static-stub;
++	server-addresses { 10.53.0.1; };
++};
++
++trust-anchors {
++	f217.test. static-key 257 3 13 "@ZONE_DNSKEY@";
++};
+diff --git a/bin/tests/system/dnssec_findnoqname_mismatch/tests_findnoqname_mismatch.py b/bin/tests/system/dnssec_findnoqname_mismatch/tests_findnoqname_mismatch.py
+new file mode 100644
+index 0000000000..f3e332a360
+--- /dev/null
++++ b/bin/tests/system/dnssec_findnoqname_mismatch/tests_findnoqname_mismatch.py
+@@ -0,0 +1,126 @@
++#!/usr/bin/python3
++
++# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
++#
++# SPDX-License-Identifier: MPL-2.0
++
++from pathlib import Path
++
++import json
++
++from cryptography.hazmat.primitives import serialization
++from cryptography.hazmat.primitives.asymmetric import ec
++
++import dns.dnssec
++import dns.name
++import dns.rdataclass
++import dns.rdatatype
++import pytest
++
++import isctest
++import isctest.mark
++
++ZONE = "f217.test."
++CHILD = f"evil.{ZONE}"
++ATTACK = f"www.{CHILD}"
++NSEC_OWNER = f"00000000.{CHILD}"
++FORGED_A = "192.0.2.217"
++AUTH = "10.53.0.1"
++RESOLVER = "10.53.0.2"
++
++pytestmark = [
++    isctest.mark.with_ecdsa_deterministic,
++    pytest.mark.extra_artifacts(
++        [
++            "ans1/ans.run",
++            "ans1/keys.json",
++        ]
++    ),
++]
++
++
++def _make_key():
++    private_key = ec.generate_private_key(ec.SECP256R1())
++    dnskey = dns.dnssec.make_dnskey(
++        private_key.public_key(),
++        algorithm="ECDSAP256SHA256",
++        flags=257,
++    )
++    private_pem = private_key.private_bytes(
++        encoding=serialization.Encoding.PEM,
++        format=serialization.PrivateFormat.PKCS8,
++        encryption_algorithm=serialization.NoEncryption(),
++    ).decode("ascii")
++    return {
++        "private_pem": private_pem,
++        "dnskey": dnskey.to_text(),
++    }
++
++
++def bootstrap():
++    keys = {ZONE: _make_key()}
++    Path("ans1/keys.json").write_text(json.dumps(keys, indent=2), encoding="ascii")
++    zone_dnskey = "".join(keys[ZONE]["dnskey"].split()[3:])
++    return {"ZONE_DNSKEY": zone_dnskey}
++
++
++def _query(server, qname, qtype):
++    query = isctest.query.create(qname, qtype)
++    return isctest.query.tcp(query, server, attempts=1, timeout=5)
++
++
++def _rrset(response, section, owner, rdtype, covers=None):
++    if covers is None:
++        return response.get_rrset(
++            section, dns.name.from_text(owner), dns.rdataclass.IN, rdtype
++        )
++    return response.get_rrset(
++        section,
++        dns.name.from_text(owner),
++        dns.rdataclass.IN,
++        rdtype,
++        covers=covers,
++    )
++
++
++def _has_a(response, section, owner, address):
++    rrset = _rrset(response, section, owner, dns.rdatatype.A)
++    return rrset is not None and any(rdata.address == address for rdata in rrset)
++
++
++def _check_rrsig(response, section, owner, rdtype, signer, labels=None):
++    rrsig = _rrset(response, section, owner, dns.rdatatype.RRSIG, covers=rdtype)
++    assert rrsig is not None, response.to_text()
++    assert rrsig[0].signer == dns.name.from_text(signer), response.to_text()
++    if labels is not None:
++        assert rrsig[0].labels == labels, response.to_text()
++
++
++def test_malicious_findnoqname_addnoqname_mismatch():
++    response = _query(AUTH, ATTACK, "A")
++    isctest.check.noerror(response)
++    assert _has_a(response, response.answer, ATTACK, FORGED_A), response.to_text()
++    _check_rrsig(response, response.answer, ATTACK, dns.rdatatype.A, CHILD, labels=1)
++
++    # Has NSEC
++    assert _rrset(response, response.authority, NSEC_OWNER, dns.rdatatype.NSEC)
++    _check_rrsig(response, response.authority, NSEC_OWNER, dns.rdatatype.NSEC, CHILD)
++    # Has NSEC3
++    assert _rrset(response, response.authority, NSEC_OWNER, dns.rdatatype.NSEC3)
++    assert (
++        _rrset(
++            response,
++            response.authority,
++            NSEC_OWNER,
++            dns.rdatatype.RRSIG,
++            covers=dns.rdatatype.NSEC3,
++        )
++        is None
++    )
++
++
++def test_resolver_findnoqname_addnoqname_mismatch():
++    # Send one trigger query
++    _query(RESOLVER, ATTACK, "A")
++    response = _query(RESOLVER, ZONE, "SOA")
++    isctest.check.noerror(response)
+-- 
+2.55.0
+
diff --git a/bind-9.18-CVE-2026-13204.patch b/bind-9.18-CVE-2026-13204.patch
new file mode 100644
index 0000000..d8ff262
--- /dev/null
+++ b/bind-9.18-CVE-2026-13204.patch
@@ -0,0 +1,158 @@
+From 895cac04332d85489ddf881b28e18e9956f6e348 Mon Sep 17 00:00:00 2001
+From: Evan Hunt <each@isc.org>
+Date: Wed, 13 May 2026 20:45:57 -0700
+Subject: [PATCH] dns_rdataset_addnoqname() could find unsigned NSEC/NSEC3
+
+The dns_rdatalist addnoqname() implementation searches for the first
+NSEC or NSEC3 record in a message, then for the first RRSIG covering
+that type in the same message.  Previously, if no RRSIG for the type was
+found, the function accepted the unsigned record. Now, it will instead
+continue searching until an NSEC or NSEC3 that does have a matching
+signature is found.
+
+When this function is called from validated() in resolver.c, a
+non-success return code is now treated as an error instead of triggering
+an assertion failure.
+
+Fixes: isc-projects/bind9#5985
+(cherry picked from commit 57cba571ee31311e54d8a11cb38094d439f04e09)
+(cherry picked from commit 48f5aa5fb3746d6194edcc57e8792a8b3cc3b454)
+---
+ lib/dns/rbtdb.c     | 10 +++++++---
+ lib/dns/rdatalist.c | 33 ++++++++++++++++-----------------
+ lib/dns/resolver.c  |  4 +++-
+ lib/ns/query.c      |  3 +--
+ 4 files changed, 27 insertions(+), 23 deletions(-)
+
+diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
+index 0b8547950f..c922df557b 100644
+--- a/lib/dns/rbtdb.c
++++ b/lib/dns/rbtdb.c
+@@ -6946,7 +6946,7 @@ delegating_type(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
+ static isc_result_t
+ addnoqname(dns_rbtdb_t *rbtdb, rdatasetheader_t *newheader,
+ 	   uint32_t maxrrperset, dns_rdataset_t *rdataset) {
+-	struct noqname *noqname;
++	struct noqname *noqname = NULL;
+ 	isc_mem_t *mctx = rbtdb->common.mctx;
+ 	dns_name_t name;
+ 	dns_rdataset_t neg, negsig;
+@@ -6958,7 +6958,9 @@ addnoqname(dns_rbtdb_t *rbtdb, rdatasetheader_t *newheader,
+ 	dns_rdataset_init(&negsig);
+ 
+ 	result = dns_rdataset_getnoqname(rdataset, &name, &neg, &negsig);
+-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
++	if (result != ISC_R_SUCCESS) {
++		goto cleanup;
++	}
+ 
+ 	noqname = isc_mem_get(mctx, sizeof(*noqname));
+ 	dns_name_init(&noqname->name, NULL);
+@@ -6984,7 +6986,9 @@ addnoqname(dns_rbtdb_t *rbtdb, rdatasetheader_t *newheader,
+ cleanup:
+ 	dns_rdataset_disassociate(&neg);
+ 	dns_rdataset_disassociate(&negsig);
+-	free_noqname(mctx, &noqname);
++	if (noqname != NULL) {
++		free_noqname(mctx, &noqname);
++	}
+ 	return result;
+ }
+ 
+diff --git a/lib/dns/rdatalist.c b/lib/dns/rdatalist.c
+index 98036f9cb3..2cca8d64be 100644
+--- a/lib/dns/rdatalist.c
++++ b/lib/dns/rdatalist.c
+@@ -192,6 +192,7 @@ isc__rdatalist_addnoqname(dns_rdataset_t *rdataset, const dns_name_t *name) {
+ 	dns_rdataset_t *neg = NULL;
+ 	dns_rdataset_t *negsig = NULL;
+ 	dns_rdataset_t *rdset;
++	dns_rdataset_t *sigset;
+ 	dns_ttl_t ttl;
+ 
+ 	REQUIRE(rdataset != NULL);
+@@ -199,30 +200,27 @@ isc__rdatalist_addnoqname(dns_rdataset_t *rdataset, const dns_name_t *name) {
+ 	for (rdset = ISC_LIST_HEAD(name->list); rdset != NULL;
+ 	     rdset = ISC_LIST_NEXT(rdset, link))
+ 	{
+-		if (rdset->rdclass != rdataset->rdclass) {
+-			continue;
+-		}
+-		if (rdset->type == dns_rdatatype_nsec ||
+-		    rdset->type == dns_rdatatype_nsec3)
++		if (rdset->rdclass != rdataset->rdclass ||
++		    (rdset->type != dns_rdatatype_nsec &&
++		     rdset->type != dns_rdatatype_nsec3))
+ 		{
+-			neg = rdset;
++			continue;
+ 		}
+-	}
+-	if (neg == NULL) {
+-		return ISC_R_NOTFOUND;
+-	}
+ 
+-	for (rdset = ISC_LIST_HEAD(name->list); rdset != NULL;
+-	     rdset = ISC_LIST_NEXT(rdset, link))
+-	{
+-		if (rdset->type == dns_rdatatype_rrsig &&
+-		    rdset->covers == neg->type)
++		for (sigset = ISC_LIST_HEAD(name->list); sigset != NULL;
++		     sigset = ISC_LIST_NEXT(sigset, link))
+ 		{
+-			negsig = rdset;
++			if (sigset->type == dns_rdatatype_rrsig &&
++			    sigset->covers == rdset->type)
++			{
++				neg = rdset;
++				negsig = sigset;
++				break;
++			}
+ 		}
+ 	}
+ 
+-	if (negsig == NULL) {
++	if (neg == NULL || negsig == NULL) {
+ 		return ISC_R_NOTFOUND;
+ 	}
+ 	/*
+@@ -238,6 +236,7 @@ isc__rdatalist_addnoqname(dns_rdataset_t *rdataset, const dns_name_t *name) {
+ 	rdataset->ttl = neg->ttl = negsig->ttl = ttl;
+ 	rdataset->attributes |= DNS_RDATASETATTR_NOQNAME;
+ 	rdataset->private6 = name;
++
+ 	return ISC_R_SUCCESS;
+ }
+ 
+diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
+index 1f8b5058d1..059ce53a9e 100644
+--- a/lib/dns/resolver.c
++++ b/lib/dns/resolver.c
+@@ -5893,7 +5893,9 @@ validated(isc_task_t *task, isc_event_t *event) {
+ 		result = dns_rdataset_addnoqname(
+ 			vevent->rdataset,
+ 			vevent->proofs[DNS_VALIDATOR_NOQNAMEPROOF]);
+-		RUNTIME_CHECK(result == ISC_R_SUCCESS);
++		if (result != ISC_R_SUCCESS) {
++			goto noanswer_response;
++		}
+ 		INSIST(vevent->sigrdataset != NULL);
+ 		vevent->sigrdataset->ttl = vevent->rdataset->ttl;
+ 		if (vevent->proofs[DNS_VALIDATOR_CLOSESTENCLOSER] != NULL) {
+diff --git a/lib/ns/query.c b/lib/ns/query.c
+index 3bd7daf79c..2a2ba1daba 100644
+--- a/lib/ns/query.c
++++ b/lib/ns/query.c
+@@ -7953,8 +7953,7 @@ query_addnoqnameproof(query_ctx_t *qctx) {
+ 		goto cleanup;
+ 	}
+ 
+-	result = dns_rdataset_getnoqname(qctx->noqname, fname, neg, negsig);
+-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
++	CHECK(dns_rdataset_getnoqname(qctx->noqname, fname, neg, negsig));
+ 
+ 	query_addrrset(qctx, &fname, &neg, &negsig, dbuf,
+ 		       DNS_SECTION_AUTHORITY);
+-- 
+2.55.0
+
diff --git a/bind.spec b/bind.spec
index 08b85ad..80cdb0a 100644
--- a/bind.spec
+++ b/bind.spec
@@ -179,6 +179,9 @@ Patch45: bind-9.18-CVE-2026-11721-test.patch
 # https://gitlab.isc.org/isc-projects/bind9/commit/348fd47f7636f610a39ba98427fcacab8e62389b
 Patch46: bind-9.18-CVE-2026-10723.patch
 Patch47: bind-9.18-CVE-2026-10723-test.patch
+# https://gitlab.isc.org/isc-projects/bind9/commit/b9ff2c9a36bb678fd1393d4f932b35a6882cd2a8
+Patch48: bind-9.18-CVE-2026-13204.patch
+Patch49: bind-9.18-CVE-2026-13204-test.patch
 
 %{?systemd_ordering}
 # https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers

From a859b5175e62cc137d3e021d0b3342498db9faee Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 25 Aug 2026 13:33:29 +0200
Subject: [PATCH 456/460] DNSSEC Validation Bypass via Out-of-Zone NSEC Next
 Field (CVE-2026-13321)

[9.18] [CVE-2026-13321] sec: usr: Fix DNSSEC validation bypass via out-of-zone NSEC Next Field

A malicious zone with out-of-zone NSEC next owner names can cause a DNSSEC validating resolver to cache such record and, if `synth-from-dnssec` is enabled, to generate negative answers for any zone that is covered by the range.

ISC would like to thank Qifan Zhang of Palo Alto Networks for reporting the issue.

Closes isc-projects/bind9#5873
---
 bind-9.18-CVE-2026-13321-test.patch | 445 ++++++++++++++++++++++++++++
 bind-9.18-CVE-2026-13321.patch      | 277 +++++++++++++++++
 bind.spec                           |   3 +
 3 files changed, 725 insertions(+)
 create mode 100644 bind-9.18-CVE-2026-13321-test.patch
 create mode 100644 bind-9.18-CVE-2026-13321.patch

diff --git a/bind-9.18-CVE-2026-13321-test.patch b/bind-9.18-CVE-2026-13321-test.patch
new file mode 100644
index 0000000..df6ba04
--- /dev/null
+++ b/bind-9.18-CVE-2026-13321-test.patch
@@ -0,0 +1,445 @@
+From eaa35628f4a201049295a8944f4d28e8a1013199 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ayd=C4=B1n=20Mercan?= <aydin@isc.org>
+Date: Wed, 6 May 2026 16:54:57 +0300
+Subject: [PATCH] Add system test for out-of-zone nsec dnssec bypass
+
+A malicious zone with out-of-zone NSEC entries can get a DNSSEC
+validating resolver's cache to cover the victim zone for non-existence
+and prevent nameserver queries without DNSSEC failure.
+
+Test for this case with an `evil.test` zone that tries to cover the
+`victim.test` zone.
+
+(cherry picked from commit 654f9773c0af59965c343bdfeb096b3dffe9dd53)
+(cherry picked from commit c969ad2c17b43dd999e358bfeb280d3df6fab822)
+---
+ .../system/dnssec_bypass/ns1/named.conf.j2    |  31 ++++
+ bin/tests/system/dnssec_bypass/ns1/root.db    |  19 +++
+ bin/tests/system/dnssec_bypass/ns1/test.db    |  23 +++
+ .../system/dnssec_bypass/ns2/named.conf.j2    |  26 +++
+ bin/tests/system/dnssec_bypass/ns2/victim.db  |  18 +++
+ bin/tests/system/dnssec_bypass/ns3/evil.db    |  23 +++
+ .../system/dnssec_bypass/ns3/named.conf.j2    |  26 +++
+ .../system/dnssec_bypass/ns4/named.conf.j2    |  35 ++++
+ .../system/dnssec_bypass/tests_bypass.py      | 152 ++++++++++++++++++
+ 9 files changed, 353 insertions(+)
+ create mode 100644 bin/tests/system/dnssec_bypass/ns1/named.conf.j2
+ create mode 100644 bin/tests/system/dnssec_bypass/ns1/root.db
+ create mode 100644 bin/tests/system/dnssec_bypass/ns1/test.db
+ create mode 100644 bin/tests/system/dnssec_bypass/ns2/named.conf.j2
+ create mode 100644 bin/tests/system/dnssec_bypass/ns2/victim.db
+ create mode 100644 bin/tests/system/dnssec_bypass/ns3/evil.db
+ create mode 100644 bin/tests/system/dnssec_bypass/ns3/named.conf.j2
+ create mode 100644 bin/tests/system/dnssec_bypass/ns4/named.conf.j2
+ create mode 100644 bin/tests/system/dnssec_bypass/tests_bypass.py
+
+diff --git a/bin/tests/system/dnssec_bypass/ns1/named.conf.j2 b/bin/tests/system/dnssec_bypass/ns1/named.conf.j2
+new file mode 100644
+index 0000000000..59ced1831a
+--- /dev/null
++++ b/bin/tests/system/dnssec_bypass/ns1/named.conf.j2
+@@ -0,0 +1,31 @@
++/*
++ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
++ *
++ * SPDX-License-Identifier: MPL-2.0
++ *
++ * This Source Code Form is subject to the terms of the Mozilla Public
++ * License, v. 2.0.  If a copy of the MPL was not distributed with this
++ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
++ *
++ * See the COPYRIGHT file distributed with this work for additional
++ * information regarding copyright ownership.
++ */
++
++options {
++	port @PORT@;
++	pid-file "named.pid";
++	listen-on { 10.53.0.1; };
++	listen-on-v6 { none; };
++	recursion no;
++	dnssec-validation no;
++};
++
++zone "test." {
++	type primary;
++	file "test.db.signed";
++};
++
++zone "." {
++	type primary;
++	file "root.db.signed";
++};
+diff --git a/bin/tests/system/dnssec_bypass/ns1/root.db b/bin/tests/system/dnssec_bypass/ns1/root.db
+new file mode 100644
+index 0000000000..8d98a0456c
+--- /dev/null
++++ b/bin/tests/system/dnssec_bypass/ns1/root.db
+@@ -0,0 +1,19 @@
++; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
++;
++; SPDX-License-Identifier: MPL-2.0
++;
++; This Source Code Form is subject to the terms of the Mozilla Public
++; License, v. 2.0.  If a copy of the MPL was not distributed with this
++; file, you can obtain one at https://mozilla.org/MPL/2.0/.
++;
++; See the COPYRIGHT file distributed with this work for additional
++; information regarding copyright ownership.
++
++$TTL 3600
++.			IN SOA	a.nil. a.nil. 1 3600 600 86400 300
++.			IN NS	a.root-servers.nil.
++
++a.root-servers.nil.	IN A	10.53.0.1
++
++test.			IN NS	ns1.test.
++ns1.test.		IN A	10.53.0.1
+diff --git a/bin/tests/system/dnssec_bypass/ns1/test.db b/bin/tests/system/dnssec_bypass/ns1/test.db
+new file mode 100644
+index 0000000000..6efcd95e42
+--- /dev/null
++++ b/bin/tests/system/dnssec_bypass/ns1/test.db
+@@ -0,0 +1,23 @@
++; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
++;
++; SPDX-License-Identifier: MPL-2.0
++;
++; This Source Code Form is subject to the terms of the Mozilla Public
++; License, v. 2.0.  If a copy of the MPL was not distributed with this
++; file, you can obtain one at https://mozilla.org/MPL/2.0/.
++;
++; See the COPYRIGHT file distributed with this work for additional
++; information regarding copyright ownership.
++
++$ORIGIN test.
++$TTL 3600
++
++@		IN SOA a a 1 3600 600 86400 300
++		IN NS	ns1.test.
++ns1		IN A	10.53.0.1
++
++evil		IN NS	ns1.evil
++ns1.evil	IN A	10.53.0.3
++
++victim		IN NS	ns1.victim
++ns1.victim	IN A	10.53.0.2
+diff --git a/bin/tests/system/dnssec_bypass/ns2/named.conf.j2 b/bin/tests/system/dnssec_bypass/ns2/named.conf.j2
+new file mode 100644
+index 0000000000..e81cee7cac
+--- /dev/null
++++ b/bin/tests/system/dnssec_bypass/ns2/named.conf.j2
+@@ -0,0 +1,26 @@
++/*
++ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
++ *
++ * SPDX-License-Identifier: MPL-2.0
++ *
++ * This Source Code Form is subject to the terms of the Mozilla Public
++ * License, v. 2.0.  If a copy of the MPL was not distributed with this
++ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
++ *
++ * See the COPYRIGHT file distributed with this work for additional
++ * information regarding copyright ownership.
++ */
++
++options {
++	port @PORT@;
++	pid-file "named.pid";
++	listen-on { 10.53.0.2; };
++	listen-on-v6 { none; };
++	recursion no;
++	dnssec-validation no;
++};
++
++zone "victim.test." {
++	type primary;
++	file "victim.db.signed";
++};
+diff --git a/bin/tests/system/dnssec_bypass/ns2/victim.db b/bin/tests/system/dnssec_bypass/ns2/victim.db
+new file mode 100644
+index 0000000000..edcc234322
+--- /dev/null
++++ b/bin/tests/system/dnssec_bypass/ns2/victim.db
+@@ -0,0 +1,18 @@
++; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
++;
++; SPDX-License-Identifier: MPL-2.0
++;
++; This Source Code Form is subject to the terms of the Mozilla Public
++; License, v. 2.0.  If a copy of the MPL was not distributed with this
++; file, you can obtain one at https://mozilla.org/MPL/2.0/.
++;
++; See the COPYRIGHT file distributed with this work for additional
++; information regarding copyright ownership.
++
++$ORIGIN victim.test.
++$TTL 3600
++
++@		IN SOA	ns1 hostmaster 1 3600 600 86400 2147483647
++		IN NS	ns1
++
++ns1		IN A	10.53.0.2
+diff --git a/bin/tests/system/dnssec_bypass/ns3/evil.db b/bin/tests/system/dnssec_bypass/ns3/evil.db
+new file mode 100644
+index 0000000000..618f9d3e85
+--- /dev/null
++++ b/bin/tests/system/dnssec_bypass/ns3/evil.db
+@@ -0,0 +1,23 @@
++; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
++;
++; SPDX-License-Identifier: MPL-2.0
++;
++; This Source Code Form is subject to the terms of the Mozilla Public
++; License, v. 2.0.  If a copy of the MPL was not distributed with this
++; file, you can obtain one at https://mozilla.org/MPL/2.0/.
++;
++; See the COPYRIGHT file distributed with this work for additional
++; information regarding copyright ownership.
++
++$ORIGIN evil.test.
++$TTL 300
++
++@		IN SOA	ns1 hostmaster 1 3600 600 86400 300
++		IN NS	ns1
++; Try to poison the victim zone in a resolver cache.
++; If admitted, the aggressive NSEC cache will accept a range such as
++; [evil.test, b.victim.test) and will cause the victim nameserver to
++; be never queried.
++		IN NSEC	b.victim.test. NS SOA RRSIG NSEC DNSKEY
++
++ns1		IN A	10.53.0.3
+diff --git a/bin/tests/system/dnssec_bypass/ns3/named.conf.j2 b/bin/tests/system/dnssec_bypass/ns3/named.conf.j2
+new file mode 100644
+index 0000000000..17d3e18e4e
+--- /dev/null
++++ b/bin/tests/system/dnssec_bypass/ns3/named.conf.j2
+@@ -0,0 +1,26 @@
++/*
++ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
++ *
++ * SPDX-License-Identifier: MPL-2.0
++ *
++ * This Source Code Form is subject to the terms of the Mozilla Public
++ * License, v. 2.0.  If a copy of the MPL was not distributed with this
++ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
++ *
++ * See the COPYRIGHT file distributed with this work for additional
++ * information regarding copyright ownership.
++ */
++
++options {
++	port @PORT@;
++	pid-file "named.pid";
++	listen-on { 10.53.0.3; };
++	listen-on-v6 { none; };
++	recursion no;
++	dnssec-validation no;
++};
++
++zone "evil.test." {
++	type primary;
++	file "evil.db.signed";
++};
+diff --git a/bin/tests/system/dnssec_bypass/ns4/named.conf.j2 b/bin/tests/system/dnssec_bypass/ns4/named.conf.j2
+new file mode 100644
+index 0000000000..039695d9b7
+--- /dev/null
++++ b/bin/tests/system/dnssec_bypass/ns4/named.conf.j2
+@@ -0,0 +1,35 @@
++/*
++ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
++ *
++ * SPDX-License-Identifier: MPL-2.0
++ *
++ * This Source Code Form is subject to the terms of the Mozilla Public
++ * License, v. 2.0.  If a copy of the MPL was not distributed with this
++ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
++ *
++ * See the COPYRIGHT file distributed with this work for additional
++ * information regarding copyright ownership.
++ */
++
++options {
++	query-source address 10.53.0.4;
++	notify-source 10.53.0.4;
++	transfer-source 10.53.0.4;
++	port @PORT@;
++	pid-file "named.pid";
++	listen-on { 10.53.0.4; };
++	listen-on-v6 { none; };
++	allow-transfer { any; };
++	recursion yes;
++	dnssec-validation yes;
++	synth-from-dnssec yes;
++};
++
++trust-anchors {
++	@root.domain@ @root.type@ @root.contents@;
++};
++
++zone "." {
++	type hint;
++	file "../../_common/root.hint";
++};
+diff --git a/bin/tests/system/dnssec_bypass/tests_bypass.py b/bin/tests/system/dnssec_bypass/tests_bypass.py
+new file mode 100644
+index 0000000000..c41bb7e016
+--- /dev/null
++++ b/bin/tests/system/dnssec_bypass/tests_bypass.py
+@@ -0,0 +1,152 @@
++# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
++#
++# SPDX-License-Identifier: MPL-2.0
++#
++# This Source Code Form is subject to the terms of the Mozilla Public
++# License, v. 2.0.  If a copy of the MPL was not distributed with this
++# file, you can obtain one at https://mozilla.org/MPL/2.0/.
++#
++# See the COPYRIGHT file distributed with this work for additional
++# information regarding copyright ownership.
++
++from datetime import datetime, timedelta, timezone
++
++import shutil
++
++from cryptography.hazmat.primitives.asymmetric import ec
++
++import dns.dnssec
++import dns.name
++import dns.rdataclass
++import dns.rdataset
++import dns.rdatatype
++import dns.rrset
++import dns.zone
++
++from isctest.run import EnvCmd
++
++import isctest
++
++TTL = 3600
++
++
++def bootstrap():
++    keygen = EnvCmd("KEYGEN", "-q -a ECDSA256")
++    signer = EnvCmd("SIGNER", "-S -g -O full")
++
++    def sign_regular_zone(ns: str, zone: str, database: str) -> isctest.kasp.Key:
++        isctest.log.info(f"{zone}: generate keys")
++        keygen(zone, cwd=ns).out.strip()
++        ksk = keygen(f"-f KSK {zone}", cwd=ns).out.strip()
++
++        isctest.log.info(f"{zone}: sign zone")
++        signer(f"-o {zone} {database}", cwd=ns)
++
++        if ns != "ns1":
++            shutil.copy(f"{ns}/dsset-{zone}", f"ns1/dsset-{zone}")
++            shutil.copy(f"{ns}/{ksk}.key", f"ns1/{ksk}.key")
++
++        return isctest.kasp.Key(ksk, keydir=ns)
++
++    # dnssec-signzone and `dns.dnssec.sign_zone` correctly disregard the invalid
++    # NSEC entries when signing the zone. However, for this test we actualy *want*
++    # to serve invalid yet signed zones. To accomplish this we sign the zone and then
++    # replace the correct entries with the faulty ones accompanied by its RRSIG.
++    #
++    # TODO(aydin): move this to `isctest` to sign broken zones
++    def sign_rogue_zone(ns: str, zone: str, database: str) -> None:
++        # Read zone.
++        origin = dns.name.from_text(zone)
++        data = dns.zone.from_file(f"{ns}/{database}", origin=origin, relativize=False)
++
++        # Get key for signing.
++        isctest.log.info(f"{zone}: generate keys")
++        private_key = ec.generate_private_key(ec.SECP256R1())
++        dnskey = dns.dnssec.make_dnskey(
++            public_key=private_key.public_key(),
++            algorithm=dns.dnssec.Algorithm.ECDSAP256SHA256,
++            flags=257,
++        )
++
++        # Sign zone.
++        isctest.log.info(f"{zone}: sign zone")
++        now = datetime.now(timezone.utc)
++        inception = now - timedelta(hours=1)
++        expiration = now + timedelta(days=30)
++
++        for name, node in data.nodes.items():
++            owner = name.derelativize(origin)
++            rdatasets = list(node.rdatasets)
++
++            for rdataset in rdatasets:
++                rrset = dns.rrset.RRset(owner, rdataset.rdclass, rdataset.rdtype)
++                rrset.update(rdataset)
++
++                rrsig = dns.dnssec.sign(
++                    rrset=rrset,
++                    private_key=private_key,
++                    signer=origin,
++                    dnskey=dnskey,
++                    inception=inception,
++                    expiration=expiration,
++                    deterministic=False,
++                )
++
++                rdataset = dns.rdataset.Rdataset(rrset.rdclass, dns.rdatatype.RRSIG)
++                rdataset.add(rrsig, rrset.ttl)
++                node.replace_rdataset(rdataset)
++
++        # Sign DNSKEY RRset.
++        dnskey_rrset = dns.rrset.RRset(origin, dns.rdataclass.IN, dns.rdatatype.DNSKEY)
++        dnskey_rrset.add(dnskey, ttl=TTL)
++
++        apex_node = data.nodes[origin]
++        apex_node.replace_rdataset(dnskey_rrset)
++
++        rrsig = dns.dnssec.sign(
++            rrset=dnskey_rrset,
++            private_key=private_key,
++            signer=origin,
++            dnskey=dnskey,
++            inception=inception,
++            expiration=expiration,
++            deterministic=False,
++        )
++        rdataset = dns.rdataset.Rdataset(rrset.rdclass, dns.rdatatype.RRSIG)
++        rdataset.add(rrsig, dnskey_rrset.ttl)
++        apex_node.replace_rdataset(rdataset)
++
++        # Output zone.
++        data.to_file(f"{ns}/{database}.signed", relativize=False)
++
++        # Output DS.
++        ds = dns.dnssec.make_ds(name=origin, key=dnskey, algorithm="SHA256")
++        with open(f"ns1/dsset-{zone}", "w", encoding="utf-8") as f:
++            f.write(f"{zone} {TTL} IN DS {ds.to_text()}\n")
++
++    sign_rogue_zone("ns3", "evil.test.", "evil.db")
++    sign_regular_zone("ns2", "victim.test.", "victim.db")
++    sign_regular_zone("ns1", "test.", "test.db")
++    root_ksk = sign_regular_zone("ns1", ".", "root.db")
++
++    return {
++        "root": root_ksk.into_ta("static-key"),
++    }
++
++
++def test_out_of_zone_nsec(ns4):
++    isctest.log.info("trying to poison aggressive nsec cache")
++    msg = isctest.query.create("nx.evil.test", "A")
++    res = isctest.query.tcp(msg, ns4.ip)
++    isctest.check.noadflag(res)
++
++    isctest.log.info("query victim from recursive")
++    msg = isctest.query.create("victim.test", "SOA")
++    res = isctest.query.tcp(msg, ns4.ip, attempts=1)
++    isctest.check.noerror(res)
++    isctest.check.adflag(res)
++    isctest.check.rr_count_eq(res.answer, 2)
++
++    isctest.log.info("checking for query history on victim nameserver")
++    with open("ns2/named.run", "r", encoding="utf-8") as f:
++        assert "(victim.test): query 'victim.test/SOA/IN' approved" in f.read()
+-- 
+2.55.0
+
diff --git a/bind-9.18-CVE-2026-13321.patch b/bind-9.18-CVE-2026-13321.patch
new file mode 100644
index 0000000..8a09ff1
--- /dev/null
+++ b/bind-9.18-CVE-2026-13321.patch
@@ -0,0 +1,277 @@
+From 72967445f37a01d28b4ecb0e8f907e22fddd5087 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ayd=C4=B1n=20Mercan?= <aydin@isc.org>
+Date: Thu, 7 May 2026 18:59:20 +0300
+Subject: [PATCH] Reject out-of-zone NSEC next owner names
+
+When verifying DNSSEC records, make sure that a next owner name of
+an NSEC record is a subdomain of the signer field.
+
+This follows the specification RFC 4034, section 4.1.1:
+
+ Owner names of RRsets for which the given zone is not authoritative
+ (such as glue records) MUST NOT be listed in the Next Domain Name
+ unless at least one authoritative RRset exists at the same owner
+ name.
+
+While the above paragraph is intended for glue records, it also
+applies to out-of-zone data.
+
+(cherry picked from commit 4065512d25b71605b9502bb69dfb903776d35aa9)
+(cherry picked from commit 058023c66f11d78590d4aa8c4f98946c4c965e21)
+
+change dns_nsec_requiredtypespresent to dns_nsec_is_legal
+
+Change `dns_nsec_requiredtypespresent` to `dns_nsec_is_legal` as a
+function for checking multiple NSEC validity rules.
+
+Currently we now additionally check for out-of-zone NSEC entries.
+
+(cherry picked from commit be2a6a497312469890b552907d039d2de0b44ccc)
+(cherry picked from commit f751e19a30d107f04c2f644aff9f8dab8fed03ab)
+---
+ lib/dns/dnssec.c             | 13 ++++++++++
+ lib/dns/include/dns/dnssec.h |  6 +++++
+ lib/dns/include/dns/nsec.h   | 18 ++++++++++----
+ lib/dns/nsec.c               | 17 ++++++++++---
+ lib/dns/resolver.c           | 48 ++++++++++++++++++++++++++++++++++--
+ lib/ns/query.c               |  6 ++---
+ 6 files changed, 94 insertions(+), 14 deletions(-)
+
+diff --git a/lib/dns/dnssec.c b/lib/dns/dnssec.c
+index 9b9b1f2bb2..5acaea9ecb 100644
+--- a/lib/dns/dnssec.c
++++ b/lib/dns/dnssec.c
+@@ -357,8 +357,10 @@ isc_result_t
+ dns_dnssec_verify(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
+ 		  bool ignoretime, unsigned int maxbits, isc_mem_t *mctx,
+ 		  dns_rdata_t *sigrdata, dns_name_t *wild) {
++	dns_rdata_nsec_t nsec;
+ 	dns_rdata_rrsig_t sig;
+ 	dns_fixedname_t fnewname;
++	dns_rdata_t rdata = DNS_RDATA_INIT;
+ 	isc_region_t r;
+ 	isc_buffer_t envbuf;
+ 	dns_rdata_t *rdatas;
+@@ -464,6 +466,17 @@ dns_dnssec_verify(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
+ 		}
+ 		break;
+ 	}
++	/*
++	 * Check for out of zone NSEC entries.
++	 */
++	if (set->type == dns_rdatatype_nsec) {
++		RETERR(dns_rdataset_first(set));
++		dns_rdataset_current(set, &rdata);
++		RETERR(dns_rdata_tostruct(&rdata, &nsec, NULL));
++		if (!dns_name_issubdomain(&nsec.next, &sig.signer)) {
++			return DNS_R_NOVALIDNSEC;
++		}
++	}
+ 
+ again:
+ 	ret = dst_context_create(key, mctx, DNS_LOGCATEGORY_DNSSEC, false,
+diff --git a/lib/dns/include/dns/dnssec.h b/lib/dns/include/dns/dnssec.h
+index cb8fd9dc20..2be11b9144 100644
+--- a/lib/dns/include/dns/dnssec.h
++++ b/lib/dns/include/dns/dnssec.h
+@@ -151,6 +151,9 @@ dns_dnssec_verify(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
+  *	this record, as this requires a resolver or database.
+  *	If 'ignoretime' is true, temporal validity will not be checked.
+  *
++ *	If 'set' is of type NSEC, this function also verifies that the
++ *	Next Name is a subdomain of the Signer's Name from 'sigrdata'.
++ *
+  *	'maxbits' specifies the maximum number of rsa exponent bits accepted.
+  *
+  *	Requires:
+@@ -173,6 +176,9 @@ dns_dnssec_verify(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
+  *\li		#DNS_R_KEYUNAUTHORIZED - the key cannot sign this data (either
+  *			it is not a zone key or its flags prevent
+  *			authentication)
++ *
++ *\li		#DNS_R_NOVALIDNSEC - the NSEC rdata is not valid
++ *\li		#DNS_R_KEYUNAUTHORIZED - the key cannot sign this data
+  *\li		DST_R_*
+  */
+ 
+diff --git a/lib/dns/include/dns/nsec.h b/lib/dns/include/dns/nsec.h
+index 50df8e45f1..1e71bf14e8 100644
+--- a/lib/dns/include/dns/nsec.h
++++ b/lib/dns/include/dns/nsec.h
+@@ -119,13 +119,21 @@ dns_nsec_noexistnodata(dns_rdatatype_t type, const dns_name_t *name,
+  */
+ 
+ bool
+-dns_nsec_requiredtypespresent(dns_rdataset_t *rdataset);
+-/*
+- * Return true if all the NSEC records in rdataset have both
+- * NSEC and RRSIG present.
++dns_nsec_is_legal(dns_rdataset_t *rdataset, const dns_name_t *name);
++/**<
++ * \brief
++ * Validates a rdataset of type NSEC.
+  *
+- * Requires:
++ * This functions checks for the following in the given rdataset:
++ * \li All NSEC records have both NSEC and RRSIG present
++ * \li All NSEC entries are under the `name`
++ *
++ * \par Requires:
+  * \li	rdataset to be a NSEC rdataset.
++ * \li  `name` is a valid dns_name_t
++ *
++ * \retval true if all the checks pass
++ * \retval false otherwise
+  */
+ 
+ ISC_LANG_ENDDECLS
+diff --git a/lib/dns/nsec.c b/lib/dns/nsec.c
+index 80ee8d7d58..5abcce5f7f 100644
+--- a/lib/dns/nsec.c
++++ b/lib/dns/nsec.c
+@@ -21,6 +21,7 @@
+ #include <isc/util.h>
+ 
+ #include <dns/db.h>
++#include <dns/name.h>
+ #include <dns/nsec.h>
+ #include <dns/rdata.h>
+ #include <dns/rdatalist.h>
+@@ -497,8 +498,9 @@ dns_nsec_noexistnodata(dns_rdatatype_t type, const dns_name_t *name,
+ }
+ 
+ bool
+-dns_nsec_requiredtypespresent(dns_rdataset_t *nsecset) {
+-	dns_rdataset_t rdataset;
++dns_nsec_is_legal(dns_rdataset_t *nsecset, const dns_name_t *name) {
++	dns_rdataset_t rdataset = DNS_RDATASET_INIT;
++	dns_rdata_nsec_t nsec;
+ 	isc_result_t result;
+ 	bool found = false;
+ 
+@@ -513,12 +515,19 @@ dns_nsec_requiredtypespresent(dns_rdataset_t *nsecset) {
+ 	{
+ 		dns_rdata_t rdata = DNS_RDATA_INIT;
+ 		dns_rdataset_current(&rdataset, &rdata);
+-		if (!dns_nsec_typepresent(&rdata, dns_rdatatype_nsec) ||
+-		    !dns_nsec_typepresent(&rdata, dns_rdatatype_rrsig))
++
++		/* must never fail */
++		result = dns_rdata_tostruct(&rdata, &nsec, NULL);
++		INSIST(result == ISC_R_SUCCESS);
++
++		if (!dns_name_issubdomain(&nsec.next, name) ||
++		    !dns_nsec_typepresent(&rdata, dns_rdatatype_rrsig) ||
++		    !dns_nsec_typepresent(&rdata, dns_rdatatype_nsec))
+ 		{
+ 			dns_rdataset_disassociate(&rdataset);
+ 			return false;
+ 		}
++
+ 		found = true;
+ 	}
+ 	dns_rdataset_disassociate(&rdataset);
+diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
+index 059ce53a9e..eac67f7a19 100644
+--- a/lib/dns/resolver.c
++++ b/lib/dns/resolver.c
+@@ -65,7 +65,9 @@
+ #include <dns/rootns.h>
+ #include <dns/stats.h>
+ #include <dns/tsig.h>
++#include <dns/types.h>
+ #include <dns/validator.h>
++#include <dns/view.h>
+ #include <dns/zone.h>
+ 
+ /* Detailed logging of fctx attach/detach */
+@@ -5603,6 +5605,36 @@ fctx_setresult(fetchctx_t *fctx, dns_rdataset_t *rdataset) {
+ 	return result;
+ }
+ 
++static bool
++get_and_check_signer_name(dns_name_t *signer, dns_rdataset_t *sigrdataset) {
++	dns_rdata_rrsig_t rrsig;
++	isc_result_t result;
++	dns_rdata_t rdata;
++
++	if (dns_rdataset_first(sigrdataset) != ISC_R_SUCCESS) {
++		return false;
++	}
++
++	rdata = (dns_rdata_t)DNS_RDATA_INIT;
++	dns_rdataset_current(sigrdataset, &rdata);
++	result = dns_rdata_tostruct(&rdata, &rrsig, NULL);
++	INSIST(result == ISC_R_SUCCESS);
++	dns_name_copy(&rrsig.signer, signer);
++
++	while (dns_rdataset_next(sigrdataset) == ISC_R_SUCCESS) {
++		rdata = (dns_rdata_t)DNS_RDATA_INIT;
++		dns_rdataset_current(sigrdataset, &rdata);
++		result = dns_rdata_tostruct(&rdata, &rrsig, NULL);
++		INSIST(result == ISC_R_SUCCESS);
++
++		if (!dns_name_equal(signer, &rrsig.signer)) {
++			return false;
++		}
++	}
++
++	return true;
++}
++
+ /*
+  * The validator has finished.
+  */
+@@ -5633,6 +5665,8 @@ validated(isc_task_t *task, isc_event_t *event) {
+ 	dns_fixedname_t fwild;
+ 	dns_name_t *wild = NULL;
+ 	dns_message_t *message = NULL;
++	dns_fixedname_t fsigner;
++	dns_name_t *signer = NULL;
+ 
+ 	UNUSED(task); /* for now */
+ 
+@@ -6021,10 +6055,20 @@ answer_response:
+ 			}
+ 
+ 			/*
+-			 * Don't cache NSEC if missing NSEC or RRSIG types.
++			 * Don't cache if all the RRSIGs don't have the same
++			 * signer.
++			 */
++			signer = dns_fixedname_initname(&fsigner);
++			if (!get_and_check_signer_name(signer, sigrdataset)) {
++				continue;
++			}
++
++			/*
++			 * Don't cache NSEC if missing NSEC or RRSIG
++			 * types.
+ 			 */
+ 			if (rdataset->type == dns_rdatatype_nsec &&
+-			    !dns_nsec_requiredtypespresent(rdataset))
++			    !dns_nsec_is_legal(rdataset, signer))
+ 			{
+ 				continue;
+ 			}
+diff --git a/lib/ns/query.c b/lib/ns/query.c
+index 2a2ba1daba..8bbcd7ff30 100644
+--- a/lib/ns/query.c
++++ b/lib/ns/query.c
+@@ -10370,10 +10370,10 @@ query_coveringnsec(query_ctx_t *qctx) {
+ 	}
+ 
+ 	/*
+-	 * If NSEC or RRSIG are missing from the type map
+-	 * reject the NSEC RRset.
++	 * Check that the NSEC entry is legal.
++	 * (NSEC + RRSIG present and the entry isn't out-of-zone)
+ 	 */
+-	if (!dns_nsec_requiredtypespresent(qctx->rdataset)) {
++	if (!dns_nsec_is_legal(qctx->rdataset, signer)) {
+ 		goto cleanup;
+ 	}
+ 
+-- 
+2.55.0
+
diff --git a/bind.spec b/bind.spec
index 80cdb0a..4bac975 100644
--- a/bind.spec
+++ b/bind.spec
@@ -182,6 +182,9 @@ Patch47: bind-9.18-CVE-2026-10723-test.patch
 # https://gitlab.isc.org/isc-projects/bind9/commit/b9ff2c9a36bb678fd1393d4f932b35a6882cd2a8
 Patch48: bind-9.18-CVE-2026-13204.patch
 Patch49: bind-9.18-CVE-2026-13204-test.patch
+# https://gitlab.isc.org/isc-projects/bind9/commit/36f3d50f9c8ebc8d25ee033e707ca502e20b083f
+Patch50: bind-9.18-CVE-2026-13321.patch
+Patch51: bind-9.18-CVE-2026-13321-test.patch
 
 %{?systemd_ordering}
 # https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers

From 8c2399e1628abe39f5c801b72a61af6af04dba63 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 17 Jul 2026 20:09:43 +0200
Subject: [PATCH 457/460] Fix tsig-keygen and named-checkzone

Found out that multiple programs require fixed name and cannot contain
suffixes. This will fix those programs to run as designed and switch
versions. It affects:
- tsig-keygen
- ddns-confgen
- named-checkzone
- named-compilezone

This should make those tools to decide only based or starting part of
the program. Upstream supported suffix .exe, but we need support of
different suffixes. This change should work for both.
---
 bind-9.20-tsig-keygen-suffix.patch | 45 ++++++++++++++++++++++++++++++
 bind.spec                          |  3 ++
 2 files changed, 48 insertions(+)
 create mode 100644 bind-9.20-tsig-keygen-suffix.patch

diff --git a/bind-9.20-tsig-keygen-suffix.patch b/bind-9.20-tsig-keygen-suffix.patch
new file mode 100644
index 0000000..6c1c465
--- /dev/null
+++ b/bind-9.20-tsig-keygen-suffix.patch
@@ -0,0 +1,45 @@
+From 32f203d4e3c711cde5b1546a054be42b16436822 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
+Date: Fri, 17 Jul 2026 19:42:39 +0200
+Subject: [PATCH] Support program suffixes of tsig-confgen and ddns-confgen
+
+Suffixes different than .exe are used on Fedora. But those commands
+require exact names only. Allow switching between two variants only from
+prefix. That should work on all platforms. It should support also names
+like tsig-confgen-9.18 or tsig-confgen-9.20.
+
+The same case applies to named-checkzone and named-compilezone.
+---
+ bin/check/named-checkzone.c | 2 +-
+ bin/confgen/tsig-keygen.c   | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/bin/check/named-checkzone.c b/bin/check/named-checkzone.c
+index ae8feafc8c..5a1f712463 100644
+--- a/bin/check/named-checkzone.c
++++ b/bin/check/named-checkzone.c
+@@ -137,7 +137,7 @@ main(int argc, char **argv) {
+ 	}
+ 
+ #define PROGCMP(X) \
+-	(strcasecmp(prog_name, X) == 0 || strcasecmp(prog_name, X ".exe") == 0)
++	(strncasecmp(prog_name, X, strlen(X)) == 0)
+ 
+ 	if (PROGCMP("named-checkzone")) {
+ 		progmode = progmode_check;
+diff --git a/bin/confgen/tsig-keygen.c b/bin/confgen/tsig-keygen.c
+index f0d2f9a245..9b13312b5b 100644
+--- a/bin/confgen/tsig-keygen.c
++++ b/bin/confgen/tsig-keygen.c
+@@ -113,7 +113,7 @@ main(int argc, char **argv) {
+ 	}
+ 
+ #define PROGCMP(X) \
+-	(strcasecmp(progname, X) == 0 || strcasecmp(progname, X ".exe") == 0)
++	(strncasecmp(progname, X, strlen(X)) == 0)
+ 
+ 	if (PROGCMP("tsig-keygen")) {
+ 		progmode = progmode_keygen;
+-- 
+2.54.0
+
diff --git a/bind.spec b/bind.spec
index 4bac975..08979b6 100644
--- a/bind.spec
+++ b/bind.spec
@@ -185,6 +185,9 @@ Patch49: bind-9.18-CVE-2026-13204-test.patch
 # https://gitlab.isc.org/isc-projects/bind9/commit/36f3d50f9c8ebc8d25ee033e707ca502e20b083f
 Patch50: bind-9.18-CVE-2026-13321.patch
 Patch51: bind-9.18-CVE-2026-13321-test.patch
+# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/12420
+Patch52: bind-9.20-tsig-keygen-suffix.patch
+
 
 %{?systemd_ordering}
 # https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers

From 2e2533ed0cc1f74d40d315d439bcc5e003f12fa6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 28 Jul 2026 16:59:39 +0200
Subject: [PATCH 458/460] Fix plugin path, add alternatives to devel libs

Devel libs detection from bind-dyndb-ldap needs working
_libdir/libdns.so. Provide extra symlink to that. But requires
additional change on bind-dyndb-ldap change to follow those links.
---
 bind.spec | 40 ++++++++++++++++++++++++++++------------
 1 file changed, 28 insertions(+), 12 deletions(-)

diff --git a/bind.spec b/bind.spec
index 08979b6..37d3425 100644
--- a/bind.spec
+++ b/bind.spec
@@ -757,6 +757,7 @@ mkdir -p ${RPM_BUILD_ROOT}%{_includedir}/bind9
 %global main_bin8 named rndc{,-confgen}
 %global main_bin1 named{-journalprint,-checkconf,-rrchecker} mdig
 %global dnssec_utils_bin1 dnssec-{cds,dsfromkey,importkey,keyfromlabel,keygen,revoke,settime,signzone,verify}
+%global devel_lib lib{bind9,dns,irs,isc,isccc,isccfg,ns}
 %global main_man5 named.conf rndc.conf
 %global main_unit named.service named-setup-rndc.service
 %global main_lib filter-{a,aaaa}
@@ -787,8 +788,13 @@ mkdir -p ${RPM_BUILD_ROOT}%{_includedir}/bind9
 %define altflibexec() \\\
   --follower %{_libexecdir}/%{1} %{upname}-%{1} %{_libexecdir}/%{name}/%{1}
 
+# This is for devel subpackage only, not plugins {1} (_libdir/)libname.so
+%define altflib() \\\
+  --follower %{_libdir}/%{1}.so %{upname}-%{1}.so %{_libdir}/%{1}%{program_suffix}.so
+
+# This is only for bind plugins, which have also man page
 %define altflibman() \\\
-  --follower %{_libdir}/bind/%{1}.so %{upname}-%{1}.so %{_libdir}/bind/%{1}.so%{program_suffix} \\\
+  --follower %{_libdir}/bind/%{1}.so %{upname}-%{1}.so %{_libdir}/bind/%{1}%{program_suffix}.so \\\
   --follower %{_mandir}/man%{2}/%{1}.%{2}%{manext} %{upname}-%{1}.%{2} %{_mandir}/man%{2}/%{1}%{program_suffix}.%{2}%{manext}
 
 %define altrmbinman() \
@@ -992,13 +998,22 @@ fi
 
 %post devel
 %if "%{program_suffix}" != ""
-  alternatives --install %{_includedir}/bind9 %{upname}-includedir %{bind_include} %{alternatives_prio}
+  ALTS=""
+  for BIN in %{devel_lib}; do
+    BINX="%{_libdir}/${BIN}.so"
+    if ! [ -L "$BINX" ] && [ -f "$BINX" ] && [ -x "$BINX" ]; then
+      rm -f -- "$BINX"
+    fi
+    ALTS+="%{altflib $BIN}"
+  done
+  alternatives --install %{_includedir}/bind9 %{upname}-devel %{bind_include} %{alternatives_prio} \
+    ${ALTS}
 %endif
 
 %postun devel
 %if "%{program_suffix}" != ""
 if [ $1 -eq 0 ] ; then
-  alternatives --remove %{upname}-includedir %{bind_include}
+  alternatives --remove %{upname}-devel %{bind_include}
 fi
 %endif
 %end
@@ -1198,23 +1213,24 @@ fi;
 %ghost %attr(0644,-,-) %{_mandir}/man1/%{dnssec_utils_bin1}.1%{manext}
 
 %files devel
-%{_libdir}/libbind9-%{mver}.so
-%{_libdir}/libisccc-%{mver}.so
-%{_libdir}/libns-%{mver}.so
-%{_libdir}/libdns-%{mver}.so
-%{_libdir}/libisc-%{mver}.so
-%{_libdir}/libisccfg-%{mver}.so
-%{_libdir}/libirs-%{mver}.so
+%{_libdir}/%{devel_lib}%{program_suffix}.so
 %ghost %attr(0755,-,-) %{_includedir}/bind9
+%ghost %attr(0755,-,-) %{_libdir}/libbind9.so
+%ghost %attr(0755,-,-) %{_libdir}/libdns.so
+%ghost %attr(0755,-,-) %{_libdir}/libirs.so
+%ghost %attr(0755,-,-) %{_libdir}/libisc.so
+%ghost %attr(0755,-,-) %{_libdir}/libisccc.so
+%ghost %attr(0755,-,-) %{_libdir}/libisccfg.so
+%ghost %attr(0755,-,-) %{_libdir}/libns.so
 %dir %{bind_include}
-%{bind_include}/isccc
-%{bind_include}/ns
 %{bind_include}/bind9
 %{bind_include}/dns
 %{bind_include}/dst
 %{bind_include}/irs
 %{bind_include}/isc
+%{bind_include}/isccc
 %{bind_include}/isccfg
+%{bind_include}/ns
 
 %files chroot
 %config(noreplace) %{_sysconfdir}/named-chroot.files

From 65771b447c5187f22c6845030151ad59a8534784 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 28 Jul 2026 21:10:58 +0200
Subject: [PATCH 459/460] Provide include file bind9/config.h again

It got removed somewhere in repeated rebasing process. Get it packaged
again, bind-dyndb-ldap cannot compile without it.
---
 bind.spec | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/bind.spec b/bind.spec
index 37d3425..659d5c9 100644
--- a/bind.spec
+++ b/bind.spec
@@ -624,6 +624,10 @@ touch ${RPM_BUILD_ROOT}/%{chroot_prefix}%{_sysconfdir}/named.conf
 
 %make_install PROGRAM_SUFFIX="%{program_suffix}"
 
+# Provide again bind's config.h
+mkdir -p ${RPM_BUILD_ROOT}%{bind_include}/bind9
+sed -e 's/PACKAGE_/BIND9_/' config.h > ${RPM_BUILD_ROOT}%{bind_include}/bind9/config.h
+
 # Remove unwanted files
 rm -f ${RPM_BUILD_ROOT}/etc/bind.keys
 

From 1faffc32a8bde4db4ae9446586dcab77727ffd67 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 25 Aug 2026 15:06:59 +0200
Subject: [PATCH 460/460] Remove non-matching version from conflict

---
 bind.spec | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index 659d5c9..e0523a9 100644
--- a/bind.spec
+++ b/bind.spec
@@ -371,7 +371,7 @@ Requires:       grep
 Requires:       %{name}%{?_isa} = %{epoch}:%{version}-%{release}
 %upname_compat %{upname}-chroot
 %if "%{name}" != "%{upname}"
-Conflicts:      %{upname}-chroot != %{epoch}:%{version}-%{release}
+Conflicts:      %{upname}-chroot
 Conflicts:      %{upname}-sdb-chroot
 %endif