From 36d37531c94aae8f885e664b03aacd5a4d9ecb6d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 3 May 2019 12:51:18 +0200
Subject: [PATCH 01/55] Revert "Enable optional features by default"

This reverts commit ae423dfbebbd150c56df1c7c1954ac6ba3090bc8.
---
 bind.spec | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/bind.spec b/bind.spec
index d80a7e0..f5ba390 100644
--- a/bind.spec
+++ b/bind.spec
@@ -18,7 +18,7 @@
 %bcond_without LMDB
 %bcond_without JSON
 %bcond_without DNSTAP
-%bcond_without DLZ
+%bcond_with    DLZ
 %bcond_without EXPORT_LIBS
 %if 0%{?fedora} >= 28
 %bcond_without UNITTEST
@@ -1524,7 +1524,6 @@ fi;
 
 * Thu Mar 14 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.6-2
 - Fix dnstap and timer issues in unit test
-- Enable DLZ modules
 
 * Tue Mar 05 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.6-1
 - Update to 9.11.6

From 6402a7906bc63d69d9139856efcf7cf21714fd18 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 11 Jun 2019 11:34:52 +0200
Subject: [PATCH 02/55] Update patches to new sources

Modify current and remove already merged patches.
Adjust versions of so libs.
---
 bind-9.10-dist-native-pkcs11.patch   |  36 +--
 bind-9.11-CVE-2018-5741-atomic.patch | 132 ---------
 bind-9.11-feature-test-dlz.patch     |  85 ------
 bind-9.11-fips-code.patch            |  32 +-
 bind-9.11-fips-tests.patch           | 429 +++------------------------
 bind-9.11-rt31459.patch              | 138 ++++-----
 bind-9.11-tests-variants.patch       |  14 +-
 bind-9.11-unit-dnstap-pkcs11.patch   |  38 ---
 bind-9.11-unit-timer-nothread.patch  |  49 ---
 bind-9.3.2b1-fix_sdb_ldap.patch      |  50 ++--
 bind.spec                            |  12 +-
 11 files changed, 171 insertions(+), 844 deletions(-)
 delete mode 100644 bind-9.11-CVE-2018-5741-atomic.patch
 delete mode 100644 bind-9.11-feature-test-dlz.patch
 delete mode 100644 bind-9.11-unit-dnstap-pkcs11.patch
 delete mode 100644 bind-9.11-unit-timer-nothread.patch

diff --git a/bind-9.10-dist-native-pkcs11.patch b/bind-9.10-dist-native-pkcs11.patch
index bd8e74d..65a2e83 100644
--- a/bind-9.10-dist-native-pkcs11.patch
+++ b/bind-9.10-dist-native-pkcs11.patch
@@ -300,10 +300,10 @@ index a058c91..d4b689a 100644
  DEPLIBS =	${ISCDEPLIBS}
  
 diff --git a/configure.ac b/configure.ac
-index 5e1ba8c..7aff0e6 100644
+index 5e4e839..0ef2c8f 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -1070,12 +1070,14 @@ AC_SUBST(USE_GSSAPI)
+@@ -1081,12 +1081,14 @@ AC_SUBST(USE_GSSAPI)
  AC_SUBST(DST_GSSAPI_INC)
  AC_SUBST(DNS_GSSAPI_LIBS)
  DNS_CRYPTO_LIBS="$DNS_GSSAPI_LIBS $DNS_CRYPTO_LIBS"
@@ -318,7 +318,7 @@ index 5e1ba8c..7aff0e6 100644
  
  #
  # was --with-randomdev specified?
-@@ -1460,11 +1462,11 @@ fi
+@@ -1471,11 +1473,11 @@ fi
  AC_MSG_CHECKING(for OpenSSL library)
  OPENSSL_WARNING=
  openssldirs="/usr /usr/local /usr/local/ssl /usr/pkg /usr/sfw"
@@ -335,7 +335,7 @@ index 5e1ba8c..7aff0e6 100644
  
  if test "auto" = "$use_openssl"
  then
-@@ -1477,6 +1479,7 @@ then
+@@ -1488,6 +1490,7 @@ then
  		fi
  	done
  fi
@@ -343,7 +343,7 @@ index 5e1ba8c..7aff0e6 100644
  OPENSSL_ECDSA=""
  OPENSSL_GOST=""
  OPENSSL_ED25519=""
-@@ -1498,11 +1501,10 @@ case "$with_gost" in
+@@ -1509,11 +1512,10 @@ case "$with_gost" in
  		;;
  esac
  
@@ -358,7 +358,7 @@ index 5e1ba8c..7aff0e6 100644
  		CRYPTOLIB="pkcs11"
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
-@@ -1512,7 +1514,9 @@ case "$use_openssl" in
+@@ -1523,7 +1525,9 @@ case "$use_openssl" in
  		OPENSSLGOSTLINKSRCS=""
  		OPENSSLLINKOBJS=""
  		OPENSSLLINKSRCS=""
@@ -369,7 +369,7 @@ index 5e1ba8c..7aff0e6 100644
  	no)
  		AC_MSG_RESULT(no)
  		DST_OPENSSL_INC=""
-@@ -1544,7 +1548,7 @@ case "$use_openssl" in
+@@ -1555,7 +1559,7 @@ case "$use_openssl" in
  If you do not want OpenSSL, use --without-openssl])
  		;;
  	*)
@@ -378,7 +378,7 @@ index 5e1ba8c..7aff0e6 100644
  		then
  			AC_MSG_RESULT()
  			AC_MSG_ERROR([OpenSSL and native PKCS11 cannot be used together.])
-@@ -1972,6 +1976,7 @@ AC_SUBST(OPENSSL_ED25519)
+@@ -1983,6 +1987,7 @@ AC_SUBST(OPENSSL_ED25519)
  AC_SUBST(OPENSSL_GOST)
  
  DNS_CRYPTO_LIBS="$DNS_CRYPTO_LIBS $DST_OPENSSL_LIBS"
@@ -386,7 +386,7 @@ index 5e1ba8c..7aff0e6 100644
  
  ISC_PLATFORM_WANTAES="#undef ISC_PLATFORM_WANTAES"
  if test "yes" = "$with_aes"
-@@ -2295,6 +2300,7 @@ esac
+@@ -2306,6 +2311,7 @@ esac
  AC_SUBST(PKCS11LINKOBJS)
  AC_SUBST(PKCS11LINKSRCS)
  AC_SUBST(CRYPTO)
@@ -394,7 +394,7 @@ index 5e1ba8c..7aff0e6 100644
  AC_SUBST(PKCS11_ECDSA)
  AC_SUBST(PKCS11_GOST)
  AC_SUBST(PKCS11_ED25519)
-@@ -5425,8 +5431,11 @@ AC_CONFIG_FILES([
+@@ -5428,8 +5434,11 @@ AC_CONFIG_FILES([
  	bin/delv/Makefile
  	bin/dig/Makefile
  	bin/dnssec/Makefile
@@ -406,7 +406,7 @@ index 5e1ba8c..7aff0e6 100644
  	bin/nsupdate/Makefile
  	bin/pkcs11/Makefile
  	bin/python/Makefile
-@@ -5499,6 +5508,10 @@ AC_CONFIG_FILES([
+@@ -5502,6 +5511,10 @@ AC_CONFIG_FILES([
  	lib/dns/include/dns/Makefile
  	lib/dns/include/dst/Makefile
  	lib/dns/tests/Makefile
@@ -417,7 +417,7 @@ index 5e1ba8c..7aff0e6 100644
  	lib/irs/Makefile
  	lib/irs/include/Makefile
  	lib/irs/include/irs/Makefile
-@@ -5523,6 +5536,24 @@ AC_CONFIG_FILES([
+@@ -5526,6 +5539,24 @@ AC_CONFIG_FILES([
  	lib/isc/unix/include/Makefile
  	lib/isc/unix/include/isc/Makefile
  	lib/isc/unix/include/pkcs11/Makefile
@@ -456,7 +456,7 @@ index 81270a0..bcb5312 100644
  
  @BIND9_MAKE_RULES@
 diff --git a/lib/dns-pkcs11/Makefile.in b/lib/dns-pkcs11/Makefile.in
-index 068bbac..d7f3d95 100644
+index 56dd259..f9aa782 100644
 --- a/lib/dns-pkcs11/Makefile.in
 +++ b/lib/dns-pkcs11/Makefile.in
 @@ -26,16 +26,16 @@ VERSION=@BIND9_VERSION@
@@ -501,12 +501,8 @@ index 068bbac..d7f3d95 100644
  
  include: gen
  	${MAKE} include/dns/enumtype.h
-@@ -180,25 +180,25 @@ code.h:	gen
- 	./gen -s ${srcdir} > code.h || { rm -f $@ ; exit 1; }
- 
- gen: gen.c
--	${BUILD_CC} ${BUILD_CFLAGS} -I${top_srcdir}/lib/isc/include \
-+	${BUILD_CC} ${BUILD_CFLAGS} -I${top_srcdir}/lib/isc-pkcs11/include \
+@@ -183,22 +183,22 @@ gen: gen.c
+ 	${BUILD_CC} ${BUILD_CFLAGS} -I${top_srcdir}/lib/isc/include \
  	${BUILD_CPPFLAGS} ${BUILD_LDFLAGS} -o $@ ${srcdir}/gen.c ${BUILD_LIBS}
  
 -timestamp: include libdns.@A@
@@ -532,7 +528,7 @@ index 068bbac..d7f3d95 100644
 +	rm -f libdns-pkcs11.@A@ timestamp
  	rm -f gen code.h include/dns/enumtype.h include/dns/enumclass.h
  	rm -f include/dns/rdatastruct.h
- 	rm -f dnstap.pb-c.c dnstap.pb-c.h include/dns/dnstap.pb-c.h
+ 	rm -f dnstap.pb-c.c dnstap.pb-c.h
 diff --git a/lib/isc-pkcs11/Makefile.in b/lib/isc-pkcs11/Makefile.in
 index 98acfff..2fd6981 100644
 --- a/lib/isc-pkcs11/Makefile.in
diff --git a/bind-9.11-CVE-2018-5741-atomic.patch b/bind-9.11-CVE-2018-5741-atomic.patch
deleted file mode 100644
index cfbded6..0000000
--- a/bind-9.11-CVE-2018-5741-atomic.patch
+++ /dev/null
@@ -1,132 +0,0 @@
-From ef49780d30d3ddc5735cfc32561b678a634fa72f Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@sury.org>
-Date: Wed, 17 Apr 2019 15:22:27 +0200
-Subject: [PATCH] Replace atomic operations in bin/named/client.c with
- isc_refcount reference counting
-
----
- bin/named/client.c                     | 18 +++++++-----------
- bin/named/include/named/interfacemgr.h |  5 +++--
- bin/named/interfacemgr.c               |  7 +++++--
- 3 files changed, 15 insertions(+), 15 deletions(-)
-
-diff --git a/bin/named/client.c b/bin/named/client.c
-index 845326abc0..29fecadca8 100644
---- a/bin/named/client.c
-+++ b/bin/named/client.c
-@@ -402,12 +402,10 @@ tcpconn_detach(ns_client_t *client) {
- static void
- mark_tcp_active(ns_client_t *client, bool active) {
- 	if (active && !client->tcpactive) {
--		isc_atomic_xadd(&client->interface->ntcpactive, 1);
-+		isc_refcount_increment0(&client->interface->ntcpactive, NULL);
- 		client->tcpactive = active;
- 	} else if (!active && client->tcpactive) {
--		uint32_t old =
--			isc_atomic_xadd(&client->interface->ntcpactive, -1);
--		INSIST(old > 0);
-+		isc_refcount_decrement(&client->interface->ntcpactive, NULL);
- 		client->tcpactive = active;
- 	}
- }
-@@ -554,7 +552,7 @@ exit_check(ns_client_t *client) {
- 		if (client->mortal && TCP_CLIENT(client) &&
- 		    client->newstate != NS_CLIENTSTATE_FREED &&
- 		    !ns_g_clienttest &&
--		    isc_atomic_xadd(&client->interface->ntcpaccepting, 0) == 0)
-+		    isc_refcount_current(&client->interface->ntcpaccepting) == 0)
- 		{
- 			/* Nobody else is accepting */
- 			client->mortal = false;
-@@ -3328,7 +3326,6 @@ client_newconn(isc_task_t *task, isc_event_t *event) {
- 	isc_result_t result;
- 	ns_client_t *client = event->ev_arg;
- 	isc_socket_newconnev_t *nevent = (isc_socket_newconnev_t *)event;
--	uint32_t old;
- 
- 	REQUIRE(event->ev_type == ISC_SOCKEVENT_NEWCONN);
- 	REQUIRE(NS_CLIENT_VALID(client));
-@@ -3348,8 +3345,7 @@ client_newconn(isc_task_t *task, isc_event_t *event) {
- 	INSIST(client->naccepts == 1);
- 	client->naccepts--;
- 
--	old = isc_atomic_xadd(&client->interface->ntcpaccepting, -1);
--	INSIST(old > 0);
-+	isc_refcount_decrement(&client->interface->ntcpaccepting, NULL);
- 
- 	/*
- 	 * We must take ownership of the new socket before the exit
-@@ -3480,8 +3476,8 @@ client_accept(ns_client_t *client) {
- 		 * quota is tcp-clients plus the number of listening
- 		 * interfaces plus 1.)
- 		 */
--		exit = (isc_atomic_xadd(&client->interface->ntcpactive, 0) >
--			(client->tcpactive ? 1 : 0));
-+		exit = (isc_refcount_current(&client->interface->ntcpactive) >
-+			(client->tcpactive ? 1U : 0U));
- 		if (exit) {
- 			client->newstate = NS_CLIENTSTATE_INACTIVE;
- 			(void)exit_check(client);
-@@ -3539,7 +3535,7 @@ client_accept(ns_client_t *client) {
- 	 * listening for connections itself to prevent the interface
- 	 * going dead.
- 	 */
--	isc_atomic_xadd(&client->interface->ntcpaccepting, 1);
-+	isc_refcount_increment0(&client->interface->ntcpaccepting, NULL);
- }
- 
- static void
-diff --git a/bin/named/include/named/interfacemgr.h b/bin/named/include/named/interfacemgr.h
-index 3535ef22a8..6e10f210fd 100644
---- a/bin/named/include/named/interfacemgr.h
-+++ b/bin/named/include/named/interfacemgr.h
-@@ -45,6 +45,7 @@
- #include <isc/magic.h>
- #include <isc/mem.h>
- #include <isc/socket.h>
-+#include <isc/refcount.h>
- 
- #include <dns/result.h>
- 
-@@ -75,11 +76,11 @@ struct ns_interface {
- 						/*%< UDP dispatchers. */
- 	isc_socket_t *		tcpsocket;	/*%< TCP socket. */
- 	isc_dscp_t		dscp;		/*%< "listen-on" DSCP value */
--	int32_t			ntcpaccepting;	/*%< Number of clients
-+	isc_refcount_t		ntcpaccepting;	/*%< Number of clients
- 						     ready to accept new
- 						     TCP connections on this
- 						     interface */
--	int32_t			ntcpactive;	/*%< Number of clients
-+	isc_refcount_t		ntcpactive;	/*%< Number of clients
- 						     servicing TCP queries
- 						     (whether accepting or
- 						     connected) */
-diff --git a/bin/named/interfacemgr.c b/bin/named/interfacemgr.c
-index d9f6df5802..135533be6b 100644
---- a/bin/named/interfacemgr.c
-+++ b/bin/named/interfacemgr.c
-@@ -386,8 +386,8 @@ ns_interface_create(ns_interfacemgr_t *mgr, isc_sockaddr_t *addr,
- 	 * connections will be handled in parallel even though there is
- 	 * only one client initially.
- 	 */
--	ifp->ntcpaccepting = 0;
--	ifp->ntcpactive = 0;
-+	isc_refcount_init(&ifp->ntcpaccepting, 0);
-+	isc_refcount_init(&ifp->ntcpactive, 0);
- 
- 	ifp->nudpdispatch = 0;
- 
-@@ -618,6 +618,9 @@ ns_interface_destroy(ns_interface_t *ifp) {
- 
- 	ns_interfacemgr_detach(&ifp->mgr);
- 
-+	isc_refcount_destroy(&ifp->ntcpactive);
-+	isc_refcount_destroy(&ifp->ntcpaccepting);
-+
- 	ifp->magic = 0;
- 	isc_mem_put(mctx, ifp, sizeof(*ifp));
- }
--- 
-2.18.1
-
diff --git a/bind-9.11-feature-test-dlz.patch b/bind-9.11-feature-test-dlz.patch
deleted file mode 100644
index 39e46c8..0000000
--- a/bind-9.11-feature-test-dlz.patch
+++ /dev/null
@@ -1,85 +0,0 @@
-From 71627db6c8852d7805ec559506f5f3cb8d89a131 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Wed, 30 Jan 2019 15:12:54 +0100
-Subject: [PATCH] Support DLZ filesystem detection in feature-test
-
-Do not use variable from configure to detect the feature.
----
- bin/tests/system/Makefile.in                     | 2 +-
- bin/tests/system/dlz/{prereq.sh.in => prereq.sh} | 2 +-
- bin/tests/system/feature-test.c                  | 9 +++++++++
- configure.ac                                     | 1 -
- 4 files changed, 11 insertions(+), 3 deletions(-)
- rename bin/tests/system/dlz/{prereq.sh.in => prereq.sh} (91%)
-
-diff --git a/bin/tests/system/Makefile.in b/bin/tests/system/Makefile.in
-index c18b4c5..dea2f75 100644
---- a/bin/tests/system/Makefile.in
-+++ b/bin/tests/system/Makefile.in
-@@ -19,7 +19,7 @@ SUBDIRS =	dlzexternal dyndb lwresd pipelined rndc rsabigexponent tkey
- 
- CINCLUDES =	${ISC_INCLUDES} ${DNS_INCLUDES}
- 
--CDEFINES =	@USE_GSSAPI@
-+CDEFINES =	@USE_GSSAPI@ @CONTRIB_DLZ@
- CWARNINGS =
- 
- DNSLIBS =
-diff --git a/bin/tests/system/dlz/prereq.sh.in b/bin/tests/system/dlz/prereq.sh
-similarity index 91%
-rename from bin/tests/system/dlz/prereq.sh.in
-rename to bin/tests/system/dlz/prereq.sh
-index afec653..fb3328e 100644
---- a/bin/tests/system/dlz/prereq.sh.in
-+++ b/bin/tests/system/dlz/prereq.sh
-@@ -12,7 +12,7 @@
- SYSTEMTESTTOP=..
- . $SYSTEMTESTTOP/conf.sh
- 
--if [ "@DLZ_SYSTEM_TEST@" != "filesystem" ]; then
-+if ! $FEATURETEST --with-dlz-filesystem; then
-         echo_i "DLZ filesystem driver not supported"
-         exit 255
- fi
-diff --git a/bin/tests/system/feature-test.c b/bin/tests/system/feature-test.c
-index 11863a3..428d107 100644
---- a/bin/tests/system/feature-test.c
-+++ b/bin/tests/system/feature-test.c
-@@ -51,6 +51,7 @@ usage() {
- 	fprintf(stderr, "	--rpz-nsip\n");
- 	fprintf(stderr, "	--with-idn\n");
- 	fprintf(stderr, "	--with-lmdb\n");
-+	fprintf(stderr, "	--with-dlz-filesystem\n");
- }
- 
- int
-@@ -182,6 +183,14 @@ main(int argc, char **argv) {
- #endif
- 	}
- 
-+	if (strcmp(argv[1], "--with-dlz-filesystem") == 0) {
-+#ifdef DLZ_FILESYSTEM
-+		return (0);
-+#else
-+		return (1);
-+#endif
-+	}
-+
- 	if (strcmp(argv[1], "--ipv6only=no") == 0) {
- #ifdef WIN32
- 		return (0);
-diff --git a/configure.ac b/configure.ac
-index fddc63a..5e1ba8c 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -5458,7 +5458,6 @@ AC_CONFIG_FILES([
- 	bin/tests/pkcs11/benchmarks/Makefile
- 	bin/tests/system/Makefile
- 	bin/tests/system/conf.sh
--	bin/tests/system/dlz/prereq.sh
- 	bin/tests/system/dlzexternal/Makefile
- 	bin/tests/system/dlzexternal/ns1/dlzs.conf
- 	bin/tests/system/dyndb/Makefile
--- 
-2.20.1
-
diff --git a/bind-9.11-fips-code.patch b/bind-9.11-fips-code.patch
index 1640b3e..74dbb05 100644
--- a/bind-9.11-fips-code.patch
+++ b/bind-9.11-fips-code.patch
@@ -1,4 +1,4 @@
-From 9ff202072b286ef57e0ffcd7c55777f2994d3985 Mon Sep 17 00:00:00 2001
+From b8485528f5098e3360560d5b85c9ffc592619c55 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 2 Aug 2018 23:34:45 +0200
 Subject: [PATCH] FIPS code changes
@@ -267,7 +267,7 @@ index 2063a3b..8e856c5 100644
  			digestbits = 0;
  		}
 diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
-index 011b118..5eabc1f 100644
+index e75b8b7..9234d35 100644
 --- a/bin/dig/dighost.c
 +++ b/bin/dig/dighost.c
 @@ -80,6 +80,7 @@
@@ -396,7 +396,7 @@ index 7584efb..a153172 100644
  		case hmacsha1: *name = dns_tsig_hmacsha1_name; break;
  		case hmacsha224: *name = dns_tsig_hmacsha224_name; break;
 diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
-index 548e0ce..509784c 100644
+index de60313..bbb3936 100644
 --- a/bin/nsupdate/nsupdate.c
 +++ b/bin/nsupdate/nsupdate.c
 @@ -31,6 +31,7 @@
@@ -406,8 +406,8 @@ index 548e0ce..509784c 100644
 +#include <isc/md5.h>
  #include <isc/mem.h>
  #include <isc/parseint.h>
- #include <isc/print.h>
-@@ -476,9 +477,10 @@ parse_hmac(dns_name_t **hmac, const char *hmacstr, size_t len,
+ #include <isc/portset.h>
+@@ -477,9 +478,10 @@ parse_hmac(dns_name_t **hmac, const char *hmacstr, size_t len,
  	strlcpy(buf, hmacstr, ISC_MIN(len + 1, sizeof(buf)));
  
  #ifndef PK11_MD5_DISABLE
@@ -420,7 +420,7 @@ index 548e0ce..509784c 100644
  		*hmac = DNS_TSIG_HMACMD5_NAME;
  		result = isc_parse_uint16(&digestbits, &buf[9], 10);
  		if (result != ISC_R_SUCCESS || digestbits > 128) {
-@@ -591,10 +593,10 @@ setup_keystr(void) {
+@@ -592,10 +594,10 @@ setup_keystr(void) {
  			exit(1);
  		}
  	} else {
@@ -434,7 +434,7 @@ index 548e0ce..509784c 100644
  #endif
  		name = keystr;
  		n = s;
-@@ -731,7 +733,8 @@ setup_keyfile(isc_mem_t *mctx, isc_log_t *lctx) {
+@@ -732,7 +734,8 @@ setup_keyfile(isc_mem_t *mctx, isc_log_t *lctx) {
  	switch (dst_key_alg(dstkey)) {
  #ifndef PK11_MD5_DISABLE
  	case DST_ALG_HMACMD5:
@@ -444,7 +444,7 @@ index 548e0ce..509784c 100644
  		break;
  #endif
  	case DST_ALG_HMACSHA1:
-@@ -1606,12 +1609,13 @@ evaluate_key(char *cmdline) {
+@@ -1637,12 +1640,13 @@ evaluate_key(char *cmdline) {
  			return (STATUS_SYNTAX);
  		}
  		namestr = n + 1;
@@ -622,7 +622,7 @@ index bde66a4..70a40c3 100644
  	dst_key_free(&dstkey);
  	CHECK("MD5 was disabled", ISC_R_NOTIMPLEMENTED);
 diff --git a/lib/bind9/check.c b/lib/bind9/check.c
-index d6fba22..ac60ba8 100644
+index 2a0e735..dc80018 100644
 --- a/lib/bind9/check.c
 +++ b/lib/bind9/check.c
 @@ -23,6 +23,7 @@
@@ -633,7 +633,7 @@ index d6fba22..ac60ba8 100644
  #include <isc/mem.h>
  #include <isc/netaddr.h>
  #include <isc/parseint.h>
-@@ -2589,6 +2590,15 @@ bind9_check_key(const cfg_obj_t *key, isc_log_t *logctx) {
+@@ -2590,6 +2591,15 @@ bind9_check_key(const cfg_obj_t *key, isc_log_t *logctx) {
  	}
  
  	algorithm = cfg_obj_asstring(algobj);
@@ -966,7 +966,7 @@ index 16214c6..9b235ba 100644
  
  	/* RSASHA256 */
 diff --git a/lib/dns/tests/tsig_test.c b/lib/dns/tests/tsig_test.c
-index 4d6847e..1a208b5 100644
+index 8e5250e..9accc53 100644
 --- a/lib/dns/tests/tsig_test.c
 +++ b/lib/dns/tests/tsig_test.c
 @@ -24,6 +24,7 @@
@@ -1115,7 +1115,7 @@ index 4d29398..e3f5cec 100644
  
  #endif /* !PK11_MD5_DISABLE */
 diff --git a/lib/isc/md5.c b/lib/isc/md5.c
-index 920aed5..a086a57 100644
+index 249f3da..628a414 100644
 --- a/lib/isc/md5.c
 +++ b/lib/isc/md5.c
 @@ -37,6 +37,7 @@
@@ -1126,7 +1126,7 @@ index 920aed5..a086a57 100644
  #include <isc/platform.h>
  #include <isc/safe.h>
  #include <isc/string.h>
-@@ -55,6 +56,9 @@
+@@ -54,6 +55,9 @@
  #define EVP_MD_CTX_free(ptr) EVP_MD_CTX_cleanup(ptr)
  #endif
  
@@ -1136,7 +1136,7 @@ index 920aed5..a086a57 100644
  void
  isc_md5_init(isc_md5_t *ctx) {
  	ctx->ctx = EVP_MD_CTX_new();
-@@ -86,8 +90,33 @@ isc_md5_final(isc_md5_t *ctx, unsigned char *digest) {
+@@ -85,8 +89,33 @@ isc_md5_final(isc_md5_t *ctx, unsigned char *digest) {
  	ctx->ctx = NULL;
  }
  
@@ -1170,7 +1170,7 @@ index 920aed5..a086a57 100644
  void
  isc_md5_init(isc_md5_t *ctx) {
  	CK_RV rv;
-@@ -130,6 +159,31 @@ isc_md5_final(isc_md5_t *ctx, unsigned char *digest) {
+@@ -129,6 +158,31 @@ isc_md5_final(isc_md5_t *ctx, unsigned char *digest) {
  	pk11_return_session(ctx);
  }
  
@@ -1202,7 +1202,7 @@ index 920aed5..a086a57 100644
  #else
  
  static void
-@@ -339,6 +393,11 @@ isc_md5_final(isc_md5_t *ctx, unsigned char *digest) {
+@@ -338,6 +392,11 @@ isc_md5_final(isc_md5_t *ctx, unsigned char *digest) {
  	memmove(digest, ctx->buf, 16);
  	isc_safe_memwipe(ctx, sizeof(*ctx));	/* In case it's sensitive */
  }
diff --git a/bind-9.11-fips-tests.patch b/bind-9.11-fips-tests.patch
index b86b783..b33e1bc 100644
--- a/bind-9.11-fips-tests.patch
+++ b/bind-9.11-fips-tests.patch
@@ -1,4 +1,4 @@
-From 4e6888c1d32071ead4b7faeeb0f1774a6d8a1120 Mon Sep 17 00:00:00 2001
+From 230ca0ddbc95a043933c36c1d182f85cf0dcc971 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 2 Aug 2018 23:46:45 +0200
 Subject: [PATCH] FIPS tests changes
@@ -76,17 +76,14 @@ Date:   Wed Mar 7 10:44:23 2018 +0100
  bin/tests/system/catz/ns2/named.conf.in       |  2 +-
  bin/tests/system/checkconf/bad-tsig.conf      |  2 +-
  bin/tests/system/checkconf/good.conf          |  2 +-
- bin/tests/system/digdelv/ns2/example.db       | 15 ++--
+ bin/tests/system/digdelv/ns2/example.db       | 15 +++--
  bin/tests/system/digdelv/tests.sh             | 28 ++++----
  bin/tests/system/dlv/ns1/sign.sh              |  4 +-
  bin/tests/system/dlv/ns2/sign.sh              |  4 +-
- bin/tests/system/dlv/ns3/sign.sh              | 69 ++++++++++---------
  bin/tests/system/dlv/ns6/sign.sh              | 66 +++++++++---------
- bin/tests/system/dnssec/ns1/sign.sh           |  4 +-
- bin/tests/system/dnssec/ns2/sign.sh           | 12 ++--
- bin/tests/system/dnssec/ns3/sign.sh           | 20 +++---
+ bin/tests/system/dnssec/ns2/sign.sh           |  8 +--
  bin/tests/system/dnssec/ns5/trusted.conf.bad  |  2 +-
- bin/tests/system/dnssec/tests.sh              |  8 +--
+ bin/tests/system/dnssec/tests.sh              |  4 +-
  bin/tests/system/feature-test.c               | 14 ++++
  bin/tests/system/filter-aaaa/ns1/sign.sh      |  4 +-
  bin/tests/system/filter-aaaa/ns4/sign.sh      |  4 +-
@@ -101,11 +98,11 @@ Date:   Wed Mar 7 10:44:23 2018 +0100
  bin/tests/system/tsig/clean.sh                |  1 +
  bin/tests/system/tsig/ns1/named.conf.in       | 10 +--
  bin/tests/system/tsig/setup.sh                |  5 ++
- bin/tests/system/tsig/tests.sh                | 67 +++++++++++-------
+ bin/tests/system/tsig/tests.sh                | 67 ++++++++++++-------
  bin/tests/system/tsiggss/setup.sh             |  2 +-
  bin/tests/system/upforwd/ns1/named.conf.in    |  2 +-
  bin/tests/system/upforwd/tests.sh             |  2 +-
- 47 files changed, 277 insertions(+), 225 deletions(-)
+ 44 files changed, 226 insertions(+), 175 deletions(-)
 
 diff --git a/bin/tests/system/acl/ns2/named1.conf.in b/bin/tests/system/acl/ns2/named1.conf.in
 index 0ea6502..026db3f 100644
@@ -602,37 +599,37 @@ index f4e30f5..9f53e31 100644
  ; TTL of 3 weeks
  weeks		1814400	A	10.53.0.2
 diff --git a/bin/tests/system/digdelv/tests.sh b/bin/tests/system/digdelv/tests.sh
-index 24aa7b3..54a3e2a 100644
+index 1657dfd..299ba94 100644
 --- a/bin/tests/system/digdelv/tests.sh
 +++ b/bin/tests/system/digdelv/tests.sh
-@@ -61,7 +61,7 @@ if [ -x ${DIG} ] ; then
+@@ -88,7 +88,7 @@ if [ -x "$DIG" ] ; then
    echo_i "checking dig +multi +norrcomments works for dnskey (when default is rrcomments)($n)"
    ret=0
    $DIG $DIGOPTS +tcp @10.53.0.3 +multi +norrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1
 -  grep "; ZSK; alg = RSAMD5 ; key id = 30795" < dig.out.test$n > /dev/null && ret=1
 +  grep "; ZSK; alg = RSASHA256 ; key id = 36895" < dig.out.test$n > /dev/null && ret=1
+   check_ttl_range dig.out.test$n "DNSKEY" 300 || ret=1
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
- 
-@@ -69,7 +69,7 @@ if [ -x ${DIG} ] ; then
+@@ -97,7 +97,7 @@ if [ -x "$DIG" ] ; then
    echo_i "checking dig +multi +norrcomments works for soa (when default is rrcomments)($n)"
    ret=0
    $DIG $DIGOPTS +tcp @10.53.0.3 +multi +norrcomments SOA example > dig.out.test$n || ret=1
 -  grep "; ZSK; alg = RSAMD5 ; key id = 30795" < dig.out.test$n > /dev/null && ret=1
 +  grep "; ZSK; alg = RSASHA256 ; key id = 36895" < dig.out.test$n > /dev/null && ret=1
+   check_ttl_range dig.out.test$n "SOA" 300 || ret=1
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
- 
-@@ -77,7 +77,7 @@ if [ -x ${DIG} ] ; then
+@@ -106,7 +106,7 @@ if [ -x "$DIG" ] ; then
    echo_i "checking dig +rrcomments works for DNSKEY($n)"
    ret=0
    $DIG $DIGOPTS +tcp @10.53.0.3 +rrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1
 -  grep "; ZSK; alg = RSAMD5 ; key id = 30795" < dig.out.test$n > /dev/null || ret=1
 +  grep "; ZSK; alg = RSASHA256 ; key id = 36895$" < dig.out.test$n > /dev/null || ret=1
+   check_ttl_range dig.out.test$n "DNSKEY" 300 || ret=1
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
- 
-@@ -85,7 +85,7 @@ if [ -x ${DIG} ] ; then
+@@ -115,7 +115,7 @@ if [ -x "$DIG" ] ; then
    echo_i "checking dig +short +rrcomments works for DNSKEY ($n)"
    ret=0
    $DIG $DIGOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1
@@ -641,7 +638,7 @@ index 24aa7b3..54a3e2a 100644
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
  
-@@ -93,7 +93,7 @@ if [ -x ${DIG} ] ; then
+@@ -123,7 +123,7 @@ if [ -x "$DIG" ] ; then
    echo_i "checking dig +short +nosplit works($n)"
    ret=0
    $DIG $DIGOPTS +tcp @10.53.0.3 +short +nosplit DNSKEY dnskey.example > dig.out.test$n || ret=1
@@ -650,7 +647,7 @@ index 24aa7b3..54a3e2a 100644
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
  
-@@ -101,7 +101,7 @@ if [ -x ${DIG} ] ; then
+@@ -131,7 +131,7 @@ if [ -x "$DIG" ] ; then
    echo_i "checking dig +short +rrcomments works($n)"
    ret=0
    $DIG $DIGOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1
@@ -659,7 +656,7 @@ index 24aa7b3..54a3e2a 100644
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
  
-@@ -117,7 +117,7 @@ if [ -x ${DIG} ] ; then
+@@ -148,7 +148,7 @@ if [ -x "$DIG" ] ; then
    echo_i "checking dig +short +rrcomments works($n)"
    ret=0
    $DIG $DIGOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1
@@ -668,34 +665,34 @@ index 24aa7b3..54a3e2a 100644
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
  
-@@ -564,7 +564,7 @@ if [ -x ${DELV} ] ; then
+@@ -661,7 +661,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +multi +norrcomments works for dnskey (when default is rrcomments)($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +multi +norrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
 -  grep "; ZSK; alg = RSAMD5 ; key id = 30795" < delv.out.test$n > /dev/null && ret=1
 +  grep "; ZSK; alg = RSASHA256 ; key id = 36895" < delv.out.test$n > /dev/null && ret=1
+   check_ttl_range delv.out.test$n "DNSKEY" 300 || ret=1
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
- 
-@@ -572,7 +572,7 @@ if [ -x ${DELV} ] ; then
+@@ -670,7 +670,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +multi +norrcomments works for soa (when default is rrcomments)($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +multi +norrcomments SOA example > delv.out.test$n || ret=1
 -  grep "; ZSK; alg = RSAMD5 ; key id = 30795" < delv.out.test$n > /dev/null && ret=1
 +  grep "; ZSK; alg = RSASHA256 ; key id = 36895" < delv.out.test$n > /dev/null && ret=1
+   check_ttl_range delv.out.test$n "SOA" 300 || ret=1
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
- 
-@@ -580,7 +580,7 @@ if [ -x ${DELV} ] ; then
+@@ -679,7 +679,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +rrcomments works for DNSKEY($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +rrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
 -  grep "; ZSK; alg = RSAMD5 ; key id = 30795" < delv.out.test$n > /dev/null || ret=1
 +  grep "; ZSK; alg = RSASHA256 ; key id = 36895" < delv.out.test$n > /dev/null || ret=1
+   check_ttl_range delv.out.test$n "DNSKEY" 300 || ret=1
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
- 
-@@ -588,7 +588,7 @@ if [ -x ${DELV} ] ; then
+@@ -688,7 +688,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +short +rrcomments works for DNSKEY ($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
@@ -704,7 +701,7 @@ index 24aa7b3..54a3e2a 100644
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
  
-@@ -596,7 +596,7 @@ if [ -x ${DELV} ] ; then
+@@ -696,7 +696,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +short +rrcomments works ($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
@@ -713,7 +710,7 @@ index 24aa7b3..54a3e2a 100644
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
  
-@@ -604,7 +604,7 @@ if [ -x ${DELV} ] ; then
+@@ -704,7 +704,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +short +nosplit works ($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +short +nosplit DNSKEY dnskey.example > delv.out.test$n || ret=1
@@ -722,7 +719,7 @@ index 24aa7b3..54a3e2a 100644
    if test `wc -l < delv.out.test$n` != 1 ; then ret=1 ; fi
    f=`awk '{print NF}' < delv.out.test$n`
    test "${f:-0}" -eq 14 || ret=1
-@@ -615,7 +615,7 @@ if [ -x ${DELV} ] ; then
+@@ -715,7 +715,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +short +nosplit +norrcomments works ($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +short +nosplit +norrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
@@ -732,22 +729,22 @@ index 24aa7b3..54a3e2a 100644
    f=`awk '{print NF}' < delv.out.test$n`
    test "${f:-0}" -eq 4 || ret=1
 diff --git a/bin/tests/system/dlv/ns1/sign.sh b/bin/tests/system/dlv/ns1/sign.sh
-index b815162..2a62e58 100755
+index 606e7cc..a3a0d60 100755
 --- a/bin/tests/system/dlv/ns1/sign.sh
 +++ b/bin/tests/system/dlv/ns1/sign.sh
 @@ -23,8 +23,8 @@ infile=root.db.in
  zonefile=root.db
  outfile=root.signed
  
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` 
+-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
 -keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 1024 -n zone $zone 2> /dev/null` 
++keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 1024 -n zone $zone 2> /dev/null`
 +keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 1024 -n zone $zone 2> /dev/null`
  
  cat $infile $keyname1.key $keyname2.key >$zonefile
  
 diff --git a/bin/tests/system/dlv/ns2/sign.sh b/bin/tests/system/dlv/ns2/sign.sh
-index 6f84d7a..e128303 100755
+index 9825c57..202c978 100755
 --- a/bin/tests/system/dlv/ns2/sign.sh
 +++ b/bin/tests/system/dlv/ns2/sign.sh
 @@ -24,8 +24,8 @@ zonefile=druz.db
@@ -761,205 +758,6 @@ index 6f84d7a..e128303 100755
  
  cat $infile $keyname1.key $keyname2.key >$zonefile
  
-diff --git a/bin/tests/system/dlv/ns3/sign.sh b/bin/tests/system/dlv/ns3/sign.sh
-index bcc9922..846dbcc 100755
---- a/bin/tests/system/dlv/ns3/sign.sh
-+++ b/bin/tests/system/dlv/ns3/sign.sh
-@@ -19,6 +19,7 @@ echo_i "dlv/ns3/sign.sh"
- dlvzone=dlv.utld.
- dlvsets=
- dssets=
-+bits=1024
- 
- zone=child1.utld.
- infile=child.db.in
-@@ -26,8 +27,8 @@ zonefile=child1.utld.db
- outfile=child1.signed
- dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` 
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null` 
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
- cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
-@@ -42,8 +43,8 @@ zonefile=child3.utld.db
- outfile=child3.signed
- dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
- cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
-@@ -58,8 +59,8 @@ zonefile=child4.utld.db
- outfile=child4.signed
- dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- 
-@@ -73,8 +74,8 @@ zonefile=child5.utld.db
- outfile=child5.signed
- dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
- cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
-@@ -88,8 +89,8 @@ infile=child.db.in
- zonefile=child7.utld.db
- outfile=child7.signed
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
- cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
-@@ -103,8 +104,8 @@ infile=child.db.in
- zonefile=child8.utld.db
- outfile=child8.signed
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- 
-@@ -118,8 +119,8 @@ zonefile=child9.utld.db
- outfile=child9.signed
- dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- 
-@@ -132,8 +133,8 @@ zonefile=child10.utld.db
- outfile=child10.signed
- dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- 
-@@ -147,8 +148,8 @@ outfile=child1.druz.signed
- dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
- dssets="$dssets dsset-`echo $zone |sed -e "s/.$//g"`$TP"
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` 
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null` 
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
- cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
-@@ -164,8 +165,8 @@ outfile=child3.druz.signed
- dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
- dssets="$dssets dsset-`echo $zone |sed -e "s/.$//g"`$TP"
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
- cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
-@@ -181,8 +182,8 @@ outfile=child4.druz.signed
- dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
- dssets="$dssets dsset-`echo $zone |sed -e "s/.$//g"`$TP"
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- 
-@@ -197,8 +198,8 @@ outfile=child5.druz.signed
- dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
- dssets="$dssets dsset-`echo $zone |sed -e "s/.$//g"`$TP"
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
- cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
-@@ -213,8 +214,8 @@ zonefile=child7.druz.db
- outfile=child7.druz.signed
- dssets="$dssets dsset-`echo $zone |sed -e "s/.$//g"`$TP"
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
- cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
-@@ -228,8 +229,8 @@ infile=child.db.in
- zonefile=child8.druz.db
- outfile=child8.druz.signed
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- 
-@@ -243,8 +244,8 @@ zonefile=child9.druz.db
- outfile=child9.druz.signed
- dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- 
-@@ -258,8 +259,8 @@ outfile=child10.druz.signed
- dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
- dssets="$dssets dsset-`echo $zone |sed -e "s/.$//g"`$TP"
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- 
-@@ -272,8 +273,8 @@ infile=dlv.db.in
- zonefile=dlv.utld.db
- outfile=dlv.signed
- 
--keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
--keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- cat $infile $dlvsets $keyname1.key $keyname2.key >$zonefile
- 
 diff --git a/bin/tests/system/dlv/ns6/sign.sh b/bin/tests/system/dlv/ns6/sign.sh
 index 1e39862..4ed19ac 100755
 --- a/bin/tests/system/dlv/ns6/sign.sh
@@ -1147,43 +945,11 @@ index 1e39862..4ed19ac 100755
  
  cat $infile $keyname1.key $keyname2.key >$zonefile
  
-diff --git a/bin/tests/system/dnssec/ns1/sign.sh b/bin/tests/system/dnssec/ns1/sign.sh
-index 198d60a..d89a539 100644
---- a/bin/tests/system/dnssec/ns1/sign.sh
-+++ b/bin/tests/system/dnssec/ns1/sign.sh
-@@ -27,7 +27,7 @@ cp ../ns2/dsset-in-addr.arpa$TP .
- grep "8 [12] " ../ns2/dsset-algroll$TP > dsset-algroll$TP
- cp ../ns6/dsset-optout-tld$TP .
- 
--keyname=`$KEYGEN -q -r $RANDFILE -a RSAMD5 -b 768 -n zone $zone`
-+keyname=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 1024 -n zone $zone`
- 
- cat $infile $keyname.key > $zonefile
- 
-@@ -48,6 +48,6 @@ cp managed.conf ../ns4/managed.conf
- #
- #  Save keyid for managed key id test.
- #
--keyid=`expr $keyname : 'K.+001+\(.*\)'`
-+keyid=`expr $keyname : 'K.+008+\([0-9]*\)'`
- keyid=`expr $keyid + 0`
- echo "$keyid" > managed.key.id
 diff --git a/bin/tests/system/dnssec/ns2/sign.sh b/bin/tests/system/dnssec/ns2/sign.sh
-index ca18608..25b6cab 100644
+index b93651a..09b12ba 100644
 --- a/bin/tests/system/dnssec/ns2/sign.sh
 +++ b/bin/tests/system/dnssec/ns2/sign.sh
-@@ -30,8 +30,8 @@ do
- 	cp ../ns3/dsset-$subdomain.example$TP .
- done
- 
--keyname1=`$KEYGEN -q -r $RANDFILE -a DSA -b 768 -n zone $zone`
--keyname2=`$KEYGEN -q -r $RANDFILE -a DSA -b 768 -n zone $zone`
-+keyname1=`$KEYGEN -q -r $RANDFILE -a DSA -b 1024 -n zone $zone`
-+keyname2=`$KEYGEN -q -r $RANDFILE -a DSA -b 1024 -n zone $zone`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- 
-@@ -91,8 +91,8 @@ zone=in-addr.arpa.
+@@ -126,8 +126,8 @@ zone=in-addr.arpa.
  infile=in-addr.arpa.db.in
  zonefile=in-addr.arpa.db
  
@@ -1194,7 +960,7 @@ index ca18608..25b6cab 100644
  
  cat $infile $keyname1.key $keyname2.key >$zonefile
  $SIGNER -P -g -r $RANDFILE -o $zone -k $keyname1 $zonefile $keyname2 > /dev/null
-@@ -103,7 +103,7 @@ privzone=private.secure.example.
+@@ -138,7 +138,7 @@ privzone=private.secure.example
  privinfile=private.secure.example.db.in
  privzonefile=private.secure.example.db
  
@@ -1203,102 +969,15 @@ index ca18608..25b6cab 100644
  
  cat $privinfile $privkeyname.key >$privzonefile
  
-@@ -117,7 +117,7 @@ dlvinfile=dlv.db.in
+@@ -152,7 +152,7 @@ dlvinfile=dlv.db.in
  dlvzonefile=dlv.db
- dlvsetfile=dlvset-`echo $privzone |sed -e "s/\.$//g"`$TP
+ dlvsetfile=dlvset-${privzone}${TP}
  
 -dlvkeyname=`$KEYGEN -q -r $RANDFILE -a RSAMD5 -b 768 -n zone $dlvzone`
 +dlvkeyname=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 1024 -n zone $dlvzone`
  
  cat $dlvinfile $dlvkeyname.key $dlvsetfile > $dlvzonefile
  
-diff --git a/bin/tests/system/dnssec/ns3/sign.sh b/bin/tests/system/dnssec/ns3/sign.sh
-index ff55d84..4f6a251 100644
---- a/bin/tests/system/dnssec/ns3/sign.sh
-+++ b/bin/tests/system/dnssec/ns3/sign.sh
-@@ -28,7 +28,7 @@ zone=bogus.example.
- infile=bogus.example.db.in
- zonefile=bogus.example.db
- 
--keyname=`$KEYGEN -q -r $RANDFILE -a RSAMD5 -b 768 -n zone $zone`
-+keyname=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 2048 -n zone $zone`
- 
- cat $infile $keyname.key >$zonefile
- 
-@@ -38,8 +38,8 @@ zone=dynamic.example.
- infile=dynamic.example.db.in
- zonefile=dynamic.example.db
- 
--keyname1=`$KEYGEN -q -r $RANDFILE -a RSAMD5 -b 768 -n zone $zone`
--keyname2=`$KEYGEN -q -r $RANDFILE -a RSAMD5 -b 1024 -n zone -f KSK $zone`
-+keyname1=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 2048 -n zone $zone`
-+keyname2=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 2048 -n zone -f KSK $zone`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- 
-@@ -49,7 +49,7 @@ zone=keyless.example.
- infile=generic.example.db.in
- zonefile=keyless.example.db
- 
--keyname=`$KEYGEN -q -r $RANDFILE -a RSAMD5 -b 768 -n zone $zone`
-+keyname=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 2048 -n zone $zone`
- 
- cat $infile $keyname.key >$zonefile
- 
-@@ -69,7 +69,7 @@ zone=secure.nsec3.example.
- infile=secure.nsec3.example.db.in
- zonefile=secure.nsec3.example.db
- 
--keyname=`$KEYGEN -q -r $RANDFILE -a RSAMD5 -b 768 -n zone $zone`
-+keyname=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 2048 -n zone $zone`
- 
- cat $infile $keyname.key >$zonefile
- 
-@@ -82,7 +82,7 @@ zone=nsec3.nsec3.example.
- infile=nsec3.nsec3.example.db.in
- zonefile=nsec3.nsec3.example.db
- 
--keyname=`$KEYGEN -q -r $RANDFILE -a NSEC3RSASHA1 -b 768 -n zone $zone`
-+keyname=`$KEYGEN -q -r $RANDFILE -a NSEC3RSASHA1 -b 1024 -n zone $zone`
- 
- cat $infile $keyname.key >$zonefile
- 
-@@ -95,7 +95,7 @@ zone=optout.nsec3.example.
- infile=optout.nsec3.example.db.in
- zonefile=optout.nsec3.example.db
- 
--keyname=`$KEYGEN -q -r $RANDFILE -a NSEC3RSASHA1 -b 768 -n zone $zone`
-+keyname=`$KEYGEN -q -r $RANDFILE -a NSEC3RSASHA1 -b 1024 -n zone $zone`
- 
- cat $infile $keyname.key >$zonefile
- 
-@@ -108,7 +108,7 @@ zone=nsec3.example.
- infile=nsec3.example.db.in
- zonefile=nsec3.example.db
- 
--keyname=`$KEYGEN -q -r $RANDFILE -a NSEC3RSASHA1 -b 768 -n zone $zone`
-+keyname=`$KEYGEN -q -r $RANDFILE -a NSEC3RSASHA1 -b 1024 -n zone $zone`
- 
- cat $infile $keyname.key >$zonefile
- 
-@@ -121,7 +121,7 @@ zone=secure.optout.example.
- infile=secure.optout.example.db.in
- zonefile=secure.optout.example.db
- 
--keyname=`$KEYGEN -q -r $RANDFILE -a RSAMD5 -b 768 -n zone $zone`
-+keyname=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 2048 -n zone $zone`
- 
- cat $infile $keyname.key >$zonefile
- 
-@@ -533,7 +533,7 @@ zone=badds.example.
- infile=bogus.example.db.in
- zonefile=badds.example.db
- 
--keyname=`$KEYGEN -q -r $RANDFILE -a RSAMD5 -b 768 -n zone $zone`
-+keyname=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 2048 -n zone $zone`
- 
- cat $infile $keyname.key >$zonefile
- 
 diff --git a/bin/tests/system/dnssec/ns5/trusted.conf.bad b/bin/tests/system/dnssec/ns5/trusted.conf.bad
 index ed30460..e6b1126 100644
 --- a/bin/tests/system/dnssec/ns5/trusted.conf.bad
@@ -1311,28 +990,10 @@ index ed30460..e6b1126 100644
 +    "." 256 3 8 "AwEAAarwAdjV4gIhpBCjXVAScRFEx3co7k8smJdxrnqoGsl5NB7EZ9jRdgvCXbJn6v8y9jlNWVHvaC8ilhfhLh0A1vLWiWv4ijd/12xcnrY7xpG7Cu3YkxUxaXJ7Jdg/Iw1+9mGgXF1v4UbCIcw/3U3cxyk7OxYg+VSb5KBAQSR0upxV";
  };
 diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh
-index 646434f..9a10f9f 100644
+index 51dc117..48cb34b 100644
 --- a/bin/tests/system/dnssec/tests.sh
 +++ b/bin/tests/system/dnssec/tests.sh
-@@ -1688,7 +1688,7 @@ ret=0
- $RNDCCMD 10.53.0.4 secroots 2>&1 | sed 's/^/ns4 /' | cat_i
- keyid=`cat ns1/managed.key.id`
- cp ns4/named.secroots named.secroots.test$n
--linecount=`grep "./RSAMD5/$keyid ; trusted" named.secroots.test$n | wc -l`
-+linecount=`grep "./RSASHA256/$keyid ; trusted" named.secroots.test$n | wc -l`
- [ "$linecount" -eq 1 ] || ret=1
- linecount=`cat named.secroots.test$n | wc -l`
- [ "$linecount" -eq 10 ] || ret=1
-@@ -3016,7 +3016,7 @@ echo_i "check dig's +nocrypto flag ($n)"
- ret=0
- $DIG $DIGOPTS +norec +nocrypto DNSKEY . \
- 	@10.53.0.1 > dig.out.dnskey.ns1.test$n || ret=1
--grep '256 3 1 \[key id = [1-9][0-9]*]' dig.out.dnskey.ns1.test$n > /dev/null || ret=1
-+grep '256 3 8 \[key id = [1-9][0-9]*]' dig.out.dnskey.ns1.test$n > /dev/null || ret=1
- grep 'RRSIG.* \[omitted]' dig.out.dnskey.ns1.test$n > /dev/null || ret=1
- $DIG $DIGOPTS +norec +nocrypto DS example \
- 	@10.53.0.1 > dig.out.ds.ns1.test$n || ret=1
-@@ -3128,8 +3128,8 @@ do
+@@ -3227,8 +3227,8 @@ do
  	   alg=`expr $alg + 1`
  	   continue;;
  	3) size="-b 512";;
@@ -1344,7 +1005,7 @@ index 646434f..9a10f9f 100644
  	8) size="-b 512";;
  	10) size="-b 1024";;
 diff --git a/bin/tests/system/feature-test.c b/bin/tests/system/feature-test.c
-index f934b63..11863a3 100644
+index 3ac34e8..428d107 100644
 --- a/bin/tests/system/feature-test.c
 +++ b/bin/tests/system/feature-test.c
 @@ -19,6 +19,7 @@
@@ -1363,7 +1024,7 @@ index f934b63..11863a3 100644
  	fprintf(stderr, "	--rpz-nsdname\n");
  	fprintf(stderr, "	--rpz-nsip\n");
  	fprintf(stderr, "	--with-idn\n");
-@@ -136,6 +138,18 @@ main(int argc, char **argv) {
+@@ -137,6 +139,18 @@ main(int argc, char **argv) {
  #endif
  	}
  
@@ -1488,10 +1149,10 @@ index 4549184..cb7dccd 100644
  };
  
 diff --git a/bin/tests/system/nsupdate/setup.sh b/bin/tests/system/nsupdate/setup.sh
-index 45dfeeb..594db77 100644
+index 21805c5..0d3d85c 100644
 --- a/bin/tests/system/nsupdate/setup.sh
 +++ b/bin/tests/system/nsupdate/setup.sh
-@@ -63,7 +63,12 @@ EOF
+@@ -58,7 +58,12 @@ EOF
  
  $DDNSCONFGEN -q -r $RANDFILE -z example.nil > ns1/ddns.key
  
@@ -1506,10 +1167,10 @@ index 45dfeeb..594db77 100644
  $DDNSCONFGEN -q -r $RANDFILE -a hmac-sha224 -k sha224-key -z keytests.nil > ns1/sha224.key
  $DDNSCONFGEN -q -r $RANDFILE -a hmac-sha256 -k sha256-key -z keytests.nil > ns1/sha256.key
 diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh
-index 901cd22..b72b59c 100755
+index 4da4849..b3bc807 100755
 --- a/bin/tests/system/nsupdate/tests.sh
 +++ b/bin/tests/system/nsupdate/tests.sh
-@@ -700,7 +700,14 @@ fi
+@@ -708,7 +708,14 @@ fi
  n=`expr $n + 1`
  ret=0
  echo_i "check TSIG key algorithms ($n)"
@@ -1525,7 +1186,7 @@ index 901cd22..b72b59c 100755
      $NSUPDATE -k ns1/${alg}.key <<END > /dev/null || ret=1
  server 10.53.0.1 ${PORT}
  update add ${alg}.keytests.nil. 600 A 10.10.10.3
-@@ -708,7 +715,7 @@ send
+@@ -716,7 +723,7 @@ send
  END
  done
  sleep 2
diff --git a/bind-9.11-rt31459.patch b/bind-9.11-rt31459.patch
index e24aa8d..1eee414 100644
--- a/bind-9.11-rt31459.patch
+++ b/bind-9.11-rt31459.patch
@@ -1,4 +1,4 @@
-From 99fc89de7b96713a7c82ea9b98d5bc0c70ad1f6e Mon Sep 17 00:00:00 2001
+From 255fdf0b549ab2f138443ead0ac81bf864612217 Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Tue, 12 Sep 2017 19:05:46 -0700
 Subject: [PATCH] rebased rt31459c
@@ -22,7 +22,7 @@ Include new unit test
  bin/dnssec/dnssec-verify.c               |   8 +-
  bin/dnssec/dnssectool.c                  |  11 +-
  bin/named/server.c                       |   6 +
- bin/nsupdate/nsupdate.c                  |  18 +-
+ bin/nsupdate/nsupdate.c                  |  14 +-
  bin/tests/makejournal.c                  |   6 +-
  bin/tests/system/pipelined/pipequeries.c |  21 +-
  bin/tests/system/pipelined/tests.sh      |   4 +-
@@ -49,7 +49,7 @@ Include new unit test
  lib/isc/pk11.c                           |  12 +-
  lib/isc/win32/include/isc/platform.h.in  |   5 +
  win32utils/Configure                     |  29 ++-
- 36 files changed, 707 insertions(+), 175 deletions(-)
+ 36 files changed, 703 insertions(+), 175 deletions(-)
  create mode 100644 lib/dns/tests/dstrandom_test.c
 
 diff --git a/bin/confgen/keygen.c b/bin/confgen/keygen.c
@@ -71,7 +71,7 @@ index 5015abb..295e16f 100644
  							     &entropy_source,
  							     randomfile,
 diff --git a/bin/dnssec/dnssec-dsfromkey.c b/bin/dnssec/dnssec-dsfromkey.c
-index 931d5de..864f2ad 100644
+index 060892b..c2cc9c7 100644
 --- a/bin/dnssec/dnssec-dsfromkey.c
 +++ b/bin/dnssec/dnssec-dsfromkey.c
 @@ -494,14 +494,14 @@ main(int argc, char **argv) {
@@ -293,7 +293,7 @@ index fbc7ece..31a99e7 100644
  					   usekeyboard);
  
 diff --git a/bin/named/server.c b/bin/named/server.c
-index b63a386..30e7eac 100644
+index 0abbbed..405ff71 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
 @@ -36,6 +36,7 @@
@@ -324,18 +324,10 @@ index b63a386..30e7eac 100644
  		}
  	}
 diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
-index 509784c..6d7a02e 100644
+index bbb3936..0286987 100644
 --- a/bin/nsupdate/nsupdate.c
 +++ b/bin/nsupdate/nsupdate.c
-@@ -35,6 +35,7 @@
- #include <isc/mem.h>
- #include <isc/parseint.h>
- #include <isc/print.h>
-+#include <isc/platform.h>
- #include <isc/random.h>
- #include <isc/region.h>
- #include <isc/sockaddr.h>
-@@ -271,7 +272,8 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
+@@ -272,7 +272,8 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
  	if (*ectx == NULL) {
  		result = isc_entropy_create(mctx, ectx);
  		if (result != ISC_R_SUCCESS)
@@ -345,7 +337,7 @@ index 509784c..6d7a02e 100644
  		ISC_LIST_INIT(sources);
  	}
  
-@@ -280,6 +282,13 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
+@@ -281,6 +282,13 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
  		randomfile = NULL;
  	}
  
@@ -359,7 +351,7 @@ index 509784c..6d7a02e 100644
  	result = isc_entropy_usebestsource(*ectx, &source, randomfile,
  					   usekeyboard);
  
-@@ -950,11 +959,11 @@ setup_system(void) {
+@@ -979,11 +987,11 @@ setup_system(void) {
  		}
  	}
  
@@ -373,16 +365,6 @@ index 509784c..6d7a02e 100644
  
  	result = dns_dispatchmgr_create(gmctx, entropy, &dispatchmgr);
  	check_result(result, "dns_dispatchmgr_create");
-@@ -978,6 +987,9 @@ setup_system(void) {
- 	check_result(result, "dst_lib_init");
- 	is_dst_up = true;
- 
-+	/* moved after dst_lib_init() */
-+	isc_hash_init();
-+
- 	attrmask = DNS_DISPATCHATTR_UDP | DNS_DISPATCHATTR_TCP;
- 	attrmask |= DNS_DISPATCHATTR_IPV4 | DNS_DISPATCHATTR_IPV6;
- 
 diff --git a/bin/tests/makejournal.c b/bin/tests/makejournal.c
 index 61a41b0..acc71a1 100644
 --- a/bin/tests/makejournal.c
@@ -707,7 +689,7 @@ index b27fc1d..e28871b 100644
  	parse_args(false, argc, argv);
  	if (server == NULL)
 diff --git a/configure b/configure
-index e425720..4f09c96 100755
+index b219e16..4da30b9 100755
 --- a/configure
 +++ b/configure
 @@ -640,6 +640,7 @@ ac_includes_default="\
@@ -718,7 +700,7 @@ index e425720..4f09c96 100755
  BUILD_LIBS
  BUILD_LDFLAGS
  BUILD_CPPFLAGS
-@@ -824,6 +825,7 @@ XMLSTATS
+@@ -823,6 +824,7 @@ XMLSTATS
  NZDTARGETS
  NZDSRCS
  NZD_TOOLS
@@ -726,7 +708,7 @@ index e425720..4f09c96 100755
  PKCS11_TEST
  PKCS11_ED25519
  PKCS11_GOST
-@@ -1039,6 +1041,7 @@ with_eddsa
+@@ -1038,6 +1040,7 @@ with_eddsa
  with_aes
  enable_openssl_hash
  with_cc_alg
@@ -734,7 +716,7 @@ index e425720..4f09c96 100755
  with_lmdb
  with_libxml2
  with_libjson
-@@ -1735,6 +1738,7 @@ Optional Features:
+@@ -1734,6 +1737,7 @@ Optional Features:
    --enable-threads        enable multithreading
    --enable-native-pkcs11  use native PKCS11 for all crypto [default=no]
    --enable-openssl-hash   use OpenSSL for hash functions [default=no]
@@ -742,7 +724,7 @@ index e425720..4f09c96 100755
    --enable-largefile      64-bit file support
    --enable-backtrace      log stack backtrace on abort [default=yes]
    --enable-symtable       use internal symbol table for backtrace
-@@ -16684,6 +16688,7 @@ case "$use_openssl" in
+@@ -16686,6 +16690,7 @@ case "$use_openssl" in
  $as_echo "disabled because of native PKCS11" >&6; }
  		DST_OPENSSL_INC=""
  		CRYPTO="-DPKCS11CRYPTO"
@@ -750,7 +732,7 @@ index e425720..4f09c96 100755
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -16698,6 +16703,7 @@ $as_echo "disabled because of native PKCS11" >&6; }
+@@ -16700,6 +16705,7 @@ $as_echo "disabled because of native PKCS11" >&6; }
  $as_echo "no" >&6; }
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -758,7 +740,7 @@ index e425720..4f09c96 100755
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -16710,6 +16716,7 @@ $as_echo "no" >&6; }
+@@ -16712,6 +16718,7 @@ $as_echo "no" >&6; }
  	auto)
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -766,7 +748,7 @@ index e425720..4f09c96 100755
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -16719,7 +16726,7 @@ $as_echo "no" >&6; }
+@@ -16721,7 +16728,7 @@ $as_echo "no" >&6; }
  		OPENSSLLINKOBJS=""
  		OPENSSLLINKSRCS=""
  		as_fn_error $? "OpenSSL was not found in any of $openssldirs; use --with-openssl=/path
@@ -775,7 +757,7 @@ index e425720..4f09c96 100755
  		;;
  	*)
  		if test "yes" = "$want_native_pkcs11"
-@@ -16750,6 +16757,7 @@ $as_echo "not found" >&6; }
+@@ -16752,6 +16759,7 @@ $as_echo "not found" >&6; }
  			as_fn_error $? "\"$use_openssl/include/openssl/opensslv.h\" not found" "$LINENO" 5
  		fi
  		CRYPTO='-DOPENSSL'
@@ -783,7 +765,7 @@ index e425720..4f09c96 100755
  		if test "/usr" = "$use_openssl"
  		then
  			DST_OPENSSL_INC=""
-@@ -17411,8 +17419,6 @@ fi
+@@ -17413,8 +17421,6 @@ fi
  # Use OpenSSL for hash functions
  #
  
@@ -792,7 +774,7 @@ index e425720..4f09c96 100755
  ISC_PLATFORM_OPENSSLHASH="#undef ISC_PLATFORM_OPENSSLHASH"
  case $want_openssl_hash in
  	yes)
-@@ -17787,6 +17793,86 @@ if test "rt" = "$have_clock_gt"; then
+@@ -17789,6 +17795,86 @@ if test "rt" = "$have_clock_gt"; then
  	LIBS="-lrt $LIBS"
  fi
  
@@ -879,7 +861,7 @@ index e425720..4f09c96 100755
  #
  # was --with-lmdb specified?
  #
-@@ -19869,9 +19955,12 @@ _ACEOF
+@@ -19871,9 +19957,12 @@ _ACEOF
  if ac_fn_c_try_compile "$LINENO"; then :
    { $as_echo "$as_me:${as_lineno-$LINENO}: result: size_t for buflen; int for flags" >&5
  $as_echo "size_t for buflen; int for flags" >&6; }
@@ -894,7 +876,7 @@ index e425720..4f09c96 100755
  
  	 $as_echo "#define IRS_GETNAMEINFO_FLAGS_T int" >>confdefs.h
  
-@@ -21186,12 +21275,7 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
+@@ -21188,12 +21277,7 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
  ISC_PLATFORM_USESTDASM="#undef ISC_PLATFORM_USESTDASM"
  ISC_PLATFORM_USEMACASM="#undef ISC_PLATFORM_USEMACASM"
  if test "yes" = "$use_atomic"; then
@@ -908,7 +890,7 @@ index e425720..4f09c96 100755
  # version HP92453-01 B.11.11.23709.GP, which incorrectly rejects
  # declarations like `int a3[[(sizeof (unsigned char)) >= 0]];'.
  # This bug is HP SR number 8606223364.
-@@ -21224,6 +21308,11 @@ cat >>confdefs.h <<_ACEOF
+@@ -21226,6 +21310,11 @@ cat >>confdefs.h <<_ACEOF
  _ACEOF
  
  
@@ -920,7 +902,7 @@ index e425720..4f09c96 100755
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -21232,39 +21321,6 @@ _ACEOF
+@@ -21234,39 +21323,6 @@ _ACEOF
  		fi
  	;;
  	x86_64-*|amd64-*)
@@ -960,7 +942,7 @@ index e425720..4f09c96 100755
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -21295,6 +21351,10 @@ $as_echo_n "checking architecture type for atomic operations... " >&6; }
+@@ -21297,6 +21353,10 @@ $as_echo_n "checking architecture type for atomic operations... " >&6; }
  $as_echo "$arch" >&6; }
  fi
  
@@ -971,7 +953,7 @@ index e425720..4f09c96 100755
  if test "yes" = "$have_atomic"; then
  	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking compiler support for inline assembly code" >&5
  $as_echo_n "checking compiler support for inline assembly code... " >&6; }
-@@ -23848,6 +23908,30 @@ CFLAGS="$CFLAGS $SO_CFLAGS"
+@@ -23896,6 +23956,30 @@ CFLAGS="$CFLAGS $SO_CFLAGS"
  #
  dlzdir='${DLZ_DRIVER_DIR}'
  
@@ -1002,7 +984,7 @@ index e425720..4f09c96 100755
  #
  # Private autoconf macro to simplify configuring drivers:
  #
-@@ -24178,11 +24262,11 @@ $as_echo "no" >&6; }
+@@ -24226,11 +24310,11 @@ $as_echo "no" >&6; }
  $as_echo "using mysql with libs ${mysql_lib} and includes ${mysql_include}" >&6; }
  		;;
  	*)
@@ -1017,7 +999,7 @@ index e425720..4f09c96 100755
  		fi
  
  	CONTRIB_DLZ="$CONTRIB_DLZ -DDLZ_MYSQL"
-@@ -24267,7 +24351,7 @@ $as_echo "" >&6; }
+@@ -24315,7 +24399,7 @@ $as_echo "" >&6; }
  			# Check other locations for includes.
  			# Order is important (sigh).
  
@@ -1026,7 +1008,7 @@ index e425720..4f09c96 100755
  			# include a blank element first
  			for d in "" $bdb_incdirs
  			do
-@@ -24292,57 +24376,9 @@ $as_echo "" >&6; }
+@@ -24340,57 +24424,9 @@ $as_echo "" >&6; }
  			bdb_libnames="db53 db-5.3 db51 db-5.1 db48 db-4.8 db47 db-4.7 db46 db-4.6 db45 db-4.5 db44 db-4.4 db43 db-4.3 db42 db-4.2 db41 db-4.1 db"
  			for d in $bdb_libnames
  			do
@@ -1086,7 +1068,7 @@ index e425720..4f09c96 100755
  					break
  				fi
  			done
-@@ -24501,10 +24537,10 @@ $as_echo "no" >&6; }
+@@ -24549,10 +24585,10 @@ $as_echo "no" >&6; }
  		DLZ_DRIVER_INCLUDES="$DLZ_DRIVER_INCLUDES -I$use_dlz_ldap/include"
  		DLZ_DRIVER_LDAP_INCLUDES="-I$use_dlz_ldap/include"
  	fi
@@ -1100,7 +1082,7 @@ index e425720..4f09c96 100755
  	fi
  
  
-@@ -24590,11 +24626,11 @@ fi
+@@ -24638,11 +24674,11 @@ fi
  		odbcdirs="/usr /usr/local /usr/pkg"
  		for d in $odbcdirs
  		do
@@ -1114,7 +1096,7 @@ index e425720..4f09c96 100755
  				break
  			fi
  		done
-@@ -24869,6 +24905,8 @@ DNS_CRYPTO_LIBS="$NEWFLAGS"
+@@ -24917,6 +24953,8 @@ DNS_CRYPTO_LIBS="$NEWFLAGS"
  
  
  
@@ -1123,7 +1105,7 @@ index e425720..4f09c96 100755
  #
  # Commands to run at the end of config.status.
  # Don't just put these into configure, it won't work right if somebody
-@@ -27248,6 +27286,8 @@ report() {
+@@ -27295,6 +27333,8 @@ report() {
  	    echo "    IPv6 support (--enable-ipv6)"
  	test "X$CRYPTO" = "X" -o "yes" = "$want_native_pkcs11" || \
  		echo "    OpenSSL cryptography/DNSSEC (--with-openssl)"
@@ -1132,7 +1114,7 @@ index e425720..4f09c96 100755
  	test "X$PYTHON" = "X" || echo "    Python tools (--with-python)"
  	test "X$XMLSTATS" = "X" || echo "    XML statistics (--with-libxml2)"
  	test "X$JSONSTATS" = "X" || echo "    JSON statistics (--with-libjson)"
-@@ -27288,6 +27328,8 @@ report() {
+@@ -27335,6 +27375,8 @@ report() {
  	echo "    Very verbose query trace logging (--enable-querytrace)"
      test "no" = "$with_cmocka" || echo "    CMocka Unit Testing Framework (--with-cmocka)"
  
@@ -1141,7 +1123,7 @@ index e425720..4f09c96 100755
      echo "    Dynamically loadable zone (DLZ) drivers:"
      test "no" = "$use_dlz_bdb" || \
  	echo "        Berkeley DB (--with-dlz-bdb)"
-@@ -27335,6 +27377,8 @@ report() {
+@@ -27382,6 +27424,8 @@ report() {
  	echo "    ECDSA algorithm support (--with-ecdsa)"
      test "X$CRYPTO" = "X" -o "yes" = "$OPENSSL_ED25519" -o "yes" = "$PKCS11_ED25519" || \
  	echo "    EDDSA algorithm support (--with-eddsa)"
@@ -1151,10 +1133,10 @@ index e425720..4f09c96 100755
      test "yes" = "$enable_seccomp" || \
  	echo "    Use libseccomp system call filtering (--enable-seccomp)"
 diff --git a/configure.ac b/configure.ac
-index 7c5ad51..fddc63a 100644
+index 7fd192c..5e4e839 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -1503,6 +1503,7 @@ case "$use_openssl" in
+@@ -1514,6 +1514,7 @@ case "$use_openssl" in
  		AC_MSG_RESULT(disabled because of native PKCS11)
  		DST_OPENSSL_INC=""
  		CRYPTO="-DPKCS11CRYPTO"
@@ -1162,7 +1144,7 @@ index 7c5ad51..fddc63a 100644
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -1516,6 +1517,7 @@ case "$use_openssl" in
+@@ -1527,6 +1528,7 @@ case "$use_openssl" in
  		AC_MSG_RESULT(no)
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -1170,7 +1152,7 @@ index 7c5ad51..fddc63a 100644
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -1528,6 +1530,7 @@ case "$use_openssl" in
+@@ -1539,6 +1541,7 @@ case "$use_openssl" in
  	auto)
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -1178,7 +1160,7 @@ index 7c5ad51..fddc63a 100644
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -1538,7 +1541,7 @@ case "$use_openssl" in
+@@ -1549,7 +1552,7 @@ case "$use_openssl" in
  		OPENSSLLINKSRCS=""
  		AC_MSG_ERROR(
  [OpenSSL was not found in any of $openssldirs; use --with-openssl=/path
@@ -1187,7 +1169,7 @@ index 7c5ad51..fddc63a 100644
  		;;
  	*)
  		if test "yes" = "$want_native_pkcs11"
-@@ -1568,6 +1571,7 @@ If you don't want OpenSSL, use --without-openssl])
+@@ -1579,6 +1582,7 @@ If you don't want OpenSSL, use --without-openssl])
  			AC_MSG_ERROR(["$use_openssl/include/openssl/opensslv.h" not found])
  		fi
  		CRYPTO='-DOPENSSL'
@@ -1195,7 +1177,7 @@ index 7c5ad51..fddc63a 100644
  		if test "/usr" = "$use_openssl"
  		then
  			DST_OPENSSL_INC=""
-@@ -2041,7 +2045,6 @@ fi
+@@ -2052,7 +2056,6 @@ fi
  # Use OpenSSL for hash functions
  #
  
@@ -1203,7 +1185,7 @@ index 7c5ad51..fddc63a 100644
  ISC_PLATFORM_OPENSSLHASH="#undef ISC_PLATFORM_OPENSSLHASH"
  case $want_openssl_hash in
  	yes)
-@@ -2313,6 +2316,67 @@ if test "rt" = "$have_clock_gt"; then
+@@ -2324,6 +2327,67 @@ if test "rt" = "$have_clock_gt"; then
  	LIBS="-lrt $LIBS"
  fi
  
@@ -1271,7 +1253,7 @@ index 7c5ad51..fddc63a 100644
  #
  # was --with-lmdb specified?
  #
-@@ -4109,12 +4173,12 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
+@@ -4120,12 +4184,12 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
  ISC_PLATFORM_USESTDASM="#undef ISC_PLATFORM_USESTDASM"
  ISC_PLATFORM_USEMACASM="#undef ISC_PLATFORM_USEMACASM"
  if test "yes" = "$use_atomic"; then
@@ -1285,7 +1267,7 @@ index 7c5ad51..fddc63a 100644
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -4123,7 +4187,6 @@ if test "yes" = "$use_atomic"; then
+@@ -4134,7 +4198,6 @@ if test "yes" = "$use_atomic"; then
  		fi
  	;;
  	x86_64-*|amd64-*)
@@ -1293,7 +1275,7 @@ index 7c5ad51..fddc63a 100644
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -5541,6 +5604,8 @@ report() {
+@@ -5543,6 +5606,8 @@ report() {
  	    echo "    IPv6 support (--enable-ipv6)"
  	test "X$CRYPTO" = "X" -o "yes" = "$want_native_pkcs11" || \
  		echo "    OpenSSL cryptography/DNSSEC (--with-openssl)"
@@ -1302,7 +1284,7 @@ index 7c5ad51..fddc63a 100644
  	test "X$PYTHON" = "X" || echo "    Python tools (--with-python)"
  	test "X$XMLSTATS" = "X" || echo "    XML statistics (--with-libxml2)"
  	test "X$JSONSTATS" = "X" || echo "    JSON statistics (--with-libjson)"
-@@ -5581,6 +5646,8 @@ report() {
+@@ -5583,6 +5648,8 @@ report() {
  	echo "    Very verbose query trace logging (--enable-querytrace)"
      test "no" = "$with_cmocka" || echo "    CMocka Unit Testing Framework (--with-cmocka)"
  
@@ -1311,7 +1293,7 @@ index 7c5ad51..fddc63a 100644
      echo "    Dynamically loadable zone (DLZ) drivers:"
      test "no" = "$use_dlz_bdb" || \
  	echo "        Berkeley DB (--with-dlz-bdb)"
-@@ -5628,6 +5695,8 @@ report() {
+@@ -5630,6 +5697,8 @@ report() {
  	echo "    ECDSA algorithm support (--with-ecdsa)"
      test "X$CRYPTO" = "X" -o "yes" = "$OPENSSL_ED25519" -o "yes" = "$PKCS11_ED25519" || \
  	echo "    EDDSA algorithm support (--with-eddsa)"
@@ -2034,10 +2016,10 @@ index 5b8a2c9..913a2ce 100644
   * Define if the hash functions must be provided by OpenSSL.
   */
 diff --git a/win32utils/Configure b/win32utils/Configure
-index ad99f89..2c55946 100644
+index 27b00af..7e35d60 100644
 --- a/win32utils/Configure
 +++ b/win32utils/Configure
-@@ -381,6 +381,7 @@ my @substdefh = ("AES_CC",
+@@ -380,6 +380,7 @@ my @substdefh = ("AES_CC",
  my %configdefp;
  
  my @substdefp = ("ISC_PLATFORM_BUSYWAITNOP",
@@ -2045,7 +2027,7 @@ index ad99f89..2c55946 100644
                   "ISC_PLATFORM_HAVEATOMICSTORE",
                   "ISC_PLATFORM_HAVEATOMICSTOREQ",
                   "ISC_PLATFORM_HAVECMPXCHG",
-@@ -510,7 +511,8 @@ my @allcond = (@substcond, "NOTYET", "NOLONGER");
+@@ -509,7 +510,8 @@ my @allcond = (@substcond, "NOTYET", "NOLONGER");
  
  # enable-xxx/disable-xxx
  
@@ -2055,7 +2037,7 @@ index ad99f89..2c55946 100644
                    "fixed-rrset",
                    "intrinsics",
                    "isc-spnego",
-@@ -573,6 +575,7 @@ my @help = (
+@@ -572,6 +574,7 @@ my @help = (
  "\nOptional Features:\n",
  "  enable-intrinsics     enable instrinsic/atomic functions [default=yes]\n",
  "  enable-native-pkcs11  use native PKCS#11 for all crypto [default=no]\n",
@@ -2063,7 +2045,7 @@ index ad99f89..2c55946 100644
  "  enable-openssl-hash   use OpenSSL for hash functions [default=yes]\n",
  "  enable-isc-spnego     use SPNEGO from lib/dns [default=yes]\n",
  "  enable-filter-aaaa    enable filtering of AAAA records [default=yes]\n",
-@@ -617,7 +620,9 @@ my $want_clean = "no";
+@@ -616,7 +619,9 @@ my $want_clean = "no";
  my $want_unknown = "no";
  my $unknown_value;
  my $enable_intrinsics = "yes";
@@ -2073,7 +2055,7 @@ index ad99f89..2c55946 100644
  my $enable_openssl_hash = "auto";
  my $enable_filter_aaaa = "yes";
  my $enable_isc_spnego = "yes";
-@@ -828,6 +833,10 @@ sub myenable {
+@@ -834,6 +839,10 @@ sub myenable {
          if ($val =~ /^yes$/i) {
              $enable_native_pkcs11 = "yes";
          }
@@ -2084,7 +2066,7 @@ index ad99f89..2c55946 100644
      } elsif ($key =~ /^openssl-hash$/i) {
          if ($val =~ /^yes$/i) {
              $enable_openssl_hash = "yes";
-@@ -1119,6 +1128,11 @@ if ($verbose) {
+@@ -1125,6 +1134,11 @@ if ($verbose) {
      } else {
          print "native-pkcs11: disabled\n";
      }
@@ -2096,7 +2078,7 @@ index ad99f89..2c55946 100644
      if ($enable_openssl_hash eq "yes") {
          print "openssl-hash: enabled\n";
      } else {
-@@ -1472,6 +1486,7 @@ if ($enable_intrinsics eq "yes") {
+@@ -1478,6 +1492,7 @@ if ($enable_intrinsics eq "yes") {
  
  # enable-native-pkcs11
  if ($enable_native_pkcs11 eq "yes") {
@@ -2104,7 +2086,7 @@ index ad99f89..2c55946 100644
      if ($use_openssl eq "auto") {
          $use_openssl = "no";
      }
-@@ -1681,6 +1696,7 @@ if ($use_openssl eq "yes") {
+@@ -1687,6 +1702,7 @@ if ($use_openssl eq "yes") {
          $openssl_dll = File::Spec->catdir($openssl_path, "@dirlist[0]");
      }   
  
@@ -2112,7 +2094,7 @@ index ad99f89..2c55946 100644
      $configcond{"OPENSSL"} = 1;
      $configdefd{"CRYPTO"} = "OPENSSL";
      $configvar{"OPENSSL_PATH"} = "$openssl_path";
-@@ -2232,6 +2248,15 @@ if ($cookie_algorithm eq "sha1") {
+@@ -2238,6 +2254,15 @@ if ($cookie_algorithm eq "sha1") {
      die "Unrecognized cookie algorithm: $cookie_algorithm\n";
  }
  
@@ -2128,7 +2110,7 @@ index ad99f89..2c55946 100644
  # enable-openssl-hash
  if ($enable_openssl_hash eq "yes") {
      if ($use_openssl eq "no") {
-@@ -3558,6 +3583,7 @@ exit 0;
+@@ -3564,6 +3589,7 @@ exit 0;
  #  --enable-developer partially supported
  #  --enable-newstats (9.9/9.9sub only)
  #  --enable-native-pkcs11 supported
@@ -2136,7 +2118,7 @@ index ad99f89..2c55946 100644
  #  --enable-openssl-version-check included without a way to disable it
  #  --enable-openssl-hash supported
  #  --enable-threads included without a way to disable it
-@@ -3583,6 +3609,7 @@ exit 0;
+@@ -3589,6 +3615,7 @@ exit 0;
  #  --with-gost supported
  #  --with-aes supported
  #  --with-cc-alg supported
diff --git a/bind-9.11-tests-variants.patch b/bind-9.11-tests-variants.patch
index 55f4491..d983671 100644
--- a/bind-9.11-tests-variants.patch
+++ b/bind-9.11-tests-variants.patch
@@ -1,4 +1,4 @@
-From 7d689f77714430a4ef6cead040ec304dca0b8bd3 Mon Sep 17 00:00:00 2001
+From 06a22ff20ac3d68fa1f995c91068b43392425e43 Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Fri, 1 Mar 2019 15:48:20 +0100
 Subject: [PATCH] Make alternative named builds testable in system tests
@@ -17,19 +17,19 @@ export NAMED_VARIANT=-pkcs11 DNSSEC_VARIANT=-pkcs11
  1 file changed, 10 insertions(+), 9 deletions(-)
 
 diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
-index b072af8..d2cb8ed 100644
+index 4b0fe39..f135af6 100644
 --- a/bin/tests/system/conf.sh.in
 +++ b/bin/tests/system/conf.sh.in
-@@ -27,7 +27,7 @@ ALTERNATIVE_ALGORITHM=RSASHA1
- ALTERNATIVE_ALGORITHM_NUMBER=5
- ALTERNATIVE_BITS=1280
+@@ -34,7 +34,7 @@ DISABLED_ALGORITHM=ECDSAP384SHA384
+ DISABLED_ALGORITHM_NUMBER=14
+ DISABLED_BITS=384
  
 -NAMED=$TOP/bin/named/named
 +NAMED=$TOP/bin/named${NAMED_VARIANT}/named${NAMED_VARIANT}
  # We must use "named -l" instead of "lwresd" because argv[0] is lost
  # if the program is libtoolized.
  LWRESD="$TOP/bin/named/named -l"
-@@ -38,13 +38,14 @@ NSUPDATE=$TOP/bin/nsupdate/nsupdate
+@@ -45,13 +45,14 @@ NSUPDATE=$TOP/bin/nsupdate/nsupdate
  DDNSCONFGEN=$TOP/bin/confgen/ddns-confgen
  TSIGKEYGEN=$TOP/bin/confgen/tsig-keygen
  RNDCCONFGEN=$TOP/bin/confgen/rndc-confgen
@@ -51,7 +51,7 @@ index b072af8..d2cb8ed 100644
  CHECKDS=$TOP/bin/python/dnssec-checkds
  COVERAGE=$TOP/bin/python/dnssec-coverage
  KEYMGR=$TOP/bin/python/dnssec-keymgr
-@@ -64,7 +65,7 @@ DNSTAPREAD=$TOP/bin/tools/dnstap-read
+@@ -71,7 +72,7 @@ DNSTAPREAD=$TOP/bin/tools/dnstap-read
  MDIG=$TOP/bin/tools/mdig
  NZD2NZF=$TOP/bin/tools/named-nzd2nzf
  FSTRM_CAPTURE=@FSTRM_CAPTURE@
diff --git a/bind-9.11-unit-dnstap-pkcs11.patch b/bind-9.11-unit-dnstap-pkcs11.patch
deleted file mode 100644
index 60cc1cd..0000000
--- a/bind-9.11-unit-dnstap-pkcs11.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From dca9eea70cb33062905aefc389266da931e9d0d6 Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Thu, 14 Mar 2019 15:48:37 +0100
-Subject: [PATCH] Set TZ again before dns library is initialized
-
-PKCS11 uses it, initializes TZ offset from dst init. Setting environment
-in test is too late since use of cmocka.
----
- lib/dns/tests/dnstap_test.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/lib/dns/tests/dnstap_test.c b/lib/dns/tests/dnstap_test.c
-index 22d6dc3..5a60b12 100644
---- a/lib/dns/tests/dnstap_test.c
-+++ b/lib/dns/tests/dnstap_test.c
-@@ -309,9 +309,6 @@ totext_test(void **state) {
- 
- 	UNUSED(state);
- 
--	/* make sure text conversion gets the right local time */
--	setenv("TZ", "PST8", 1);
--
- 	result = dns_dt_open(TAPSAVED, dns_dtmode_file, mctx, &handle);
- 	assert_int_equal(result, ISC_R_SUCCESS);
- 
-@@ -378,6 +375,9 @@ main(void) {
- 		cmocka_unit_test_setup_teardown(totext_test, _setup, _teardown),
- 	};
- 
-+	/* make sure text conversion gets the right local time */
-+	setenv("TZ", "PST8", 1);
-+
- 	return (cmocka_run_group_tests(tests, dns_test_init, dns_test_final));
- #else
- 	print_message("1..0 # Skip dnstap not enabled\n");
--- 
-2.20.1
-
diff --git a/bind-9.11-unit-timer-nothread.patch b/bind-9.11-unit-timer-nothread.patch
deleted file mode 100644
index f913724..0000000
--- a/bind-9.11-unit-timer-nothread.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From c88ba11ced1311e91a73ffdf42114ed14a805725 Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Thu, 14 Mar 2019 21:05:34 +0100
-Subject: [PATCH] Workaround to kyua bug
-
-Kyua 0.13 is not able to correctly handle whole test skipping.
-Make workaround to it, include skipping message.
----
- lib/isc/tests/timer_test.c | 11 +++++++++--
- 1 file changed, 9 insertions(+), 2 deletions(-)
-
-diff --git a/lib/isc/tests/timer_test.c b/lib/isc/tests/timer_test.c
-index f69f2b3..050cf6d 100644
---- a/lib/isc/tests/timer_test.c
-+++ b/lib/isc/tests/timer_test.c
-@@ -573,14 +573,13 @@ purge(void **state) {
- 
- int
- main(int argc, char **argv) {
--	const struct CMUnitTest tests[] = {
- #ifdef ISC_PLATFORM_USETHREADS
-+	const struct CMUnitTest tests[] = {
- 		cmocka_unit_test_setup_teardown(ticker, _setup, _teardown),
- 		cmocka_unit_test_setup_teardown(once_life, _setup, _teardown),
- 		cmocka_unit_test_setup_teardown(once_idle, _setup, _teardown),
- 		cmocka_unit_test_setup_teardown(reset, _setup, _teardown),
- 		cmocka_unit_test_setup_teardown(purge, _setup, _teardown),
--#endif
- 	};
- 	int c;
- 
-@@ -595,6 +594,14 @@ main(int argc, char **argv) {
- 	}
- 
- 	return (cmocka_run_group_tests(tests, NULL, NULL));
-+#else
-+	UNUSED(argc);
-+	UNUSED(argv);
-+	UNUSED(verbose);
-+
-+	printf("1..0 # Skipped: threads disabled\n");
-+	return (0);
-+#endif
- }
- 
- #else /* HAVE_CMOCKA */
--- 
-2.20.1
-
diff --git a/bind-9.3.2b1-fix_sdb_ldap.patch b/bind-9.3.2b1-fix_sdb_ldap.patch
index d027bb9..35c8542 100644
--- a/bind-9.3.2b1-fix_sdb_ldap.patch
+++ b/bind-9.3.2b1-fix_sdb_ldap.patch
@@ -36,10 +36,10 @@ index 95ab742..6069f09 100644
  	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zone2sqlite@EXEEXT@ ${DESTDIR}${sbindir}
  	${INSTALL_DATA} ${srcdir}/zone2ldap.1 ${DESTDIR}${mandir}/man1/zone2ldap.1
 diff --git a/bin/sdb_tools/zone2ldap.c b/bin/sdb_tools/zone2ldap.c
-index 23dd873..d56bc56 100644
+index aa2c711..76186b5 100644
 --- a/bin/sdb_tools/zone2ldap.c
 +++ b/bin/sdb_tools/zone2ldap.c
-@@ -65,6 +66,9 @@ ldap_info;
+@@ -66,6 +66,9 @@ ldap_info;
  /* usage Info */
  void usage (void);
  
@@ -49,7 +49,7 @@ index 23dd873..d56bc56 100644
  /* Add to the ldap dit */
  void add_ldap_values (ldap_info * ldinfo);
  
-@@ -81,7 +85,7 @@ char **hostname_to_dn_list (char *hostname, char *zone, unsigned int flags);
+@@ -82,7 +85,7 @@ char **hostname_to_dn_list (char *hostname, char *zone, unsigned int flags);
  int get_attr_list_size (char **tmp);
  
  /* Get a DN */
@@ -58,7 +58,7 @@ index 23dd873..d56bc56 100644
  
  /* Add to RR list */
  void add_to_rr_list (char *dn, char *name, char *type, char *data,
-@@ -103,11 +107,27 @@ void
+@@ -104,11 +107,27 @@ void
  init_ldap_conn ();
  void usage();
  
@@ -91,7 +91,7 @@ index 23dd873..d56bc56 100644
  LDAP *conn;
  unsigned int debug = 0;
  
-@@ -131,12 +151,12 @@ main (int argc, char **argv)
+@@ -132,12 +151,12 @@ main (int argc, char **argv)
    isc_result_t result;
    char *basedn;
    ldap_info *tmp;
@@ -107,7 +107,7 @@ index 23dd873..d56bc56 100644
    dns_fixedname_t fixedzone, fixedname;
    dns_rdataset_t rdataset;
    char **dc_list;
-@@ -149,7 +169,7 @@ main (int argc, char **argv)
+@@ -150,7 +169,7 @@ main (int argc, char **argv)
    extern char *optarg;
    extern int optind, opterr, optopt;
    int create_base = 0;
@@ -116,7 +116,7 @@ index 23dd873..d56bc56 100644
  
    if (argc < 2)
      {
-@@ -157,7 +177,7 @@ main (int argc, char **argv)
+@@ -158,7 +177,7 @@ main (int argc, char **argv)
        exit (-1);
      }
  
@@ -125,7 +125,7 @@ index 23dd873..d56bc56 100644
      {
        switch (topt)
  	{
-@@ -180,6 +200,9 @@ main (int argc, char **argv)
+@@ -181,6 +200,9 @@ main (int argc, char **argv)
  	  if (bindpw == NULL)
  	    fatal("strdup");
  	  break;
@@ -135,7 +135,7 @@ index 23dd873..d56bc56 100644
  	case 'b':
  	  ldapbase = strdup (optarg);
  	  if (ldapbase == NULL)
-@@ -301,27 +324,62 @@ main (int argc, char **argv)
+@@ -300,27 +322,62 @@ main (int argc, char **argv)
      {
        if (debug)
  	printf ("Creating base zone DN %s\n", argzone);
@@ -208,7 +208,7 @@ index 23dd873..d56bc56 100644
  		}
  	      else
  		{
-@@ -330,8 +388,13 @@ main (int argc, char **argv)
+@@ -329,8 +386,13 @@ main (int argc, char **argv)
  		  else
  		    sprintf (fullbasedn, "%s", ctmp);
  		}
@@ -222,7 +222,7 @@ index 23dd873..d56bc56 100644
  	    }
  
  	}
-@@ -409,14 +472,14 @@ generate_ldap (dns_name_t * dnsname, dns_rdata_t * rdata, unsigned int ttl)
+@@ -408,14 +470,14 @@ generate_ldap (dns_name_t * dnsname, dns_rdata_t * rdata, unsigned int ttl)
    isc_result_check (result, "dns_rdata_totext");
    data[isc_buffer_usedlength (&buff)] = 0;
  
@@ -240,7 +240,7 @@ index 23dd873..d56bc56 100644
  }
  
  
-@@ -456,7 +519,8 @@ add_to_rr_list (char *dn, char *name, char *type,
+@@ -455,7 +517,8 @@ add_to_rr_list (char *dn, char *name, char *type,
    int attrlist;
    char ldap_type_buffer[128];
    char charttl[64];
@@ -250,7 +250,7 @@ index 23dd873..d56bc56 100644
  
    if ((tmp = locate_by_dn (dn)) == NULL)
      {
-@@ -483,13 +547,13 @@ add_to_rr_list (char *dn, char *name, char *type,
+@@ -482,13 +545,13 @@ add_to_rr_list (char *dn, char *name, char *type,
  	    fatal("malloc");
  	}
        tmp->attrs[0]->mod_op = LDAP_MOD_ADD;
@@ -267,7 +267,7 @@ index 23dd873..d56bc56 100644
  	  tmp->attrs[1] = NULL;
  	  tmp->attrcnt = 2;
  	  tmp->next = ldap_info_base;
-@@ -498,7 +562,7 @@ add_to_rr_list (char *dn, char *name, char *type,
+@@ -497,7 +560,7 @@ add_to_rr_list (char *dn, char *name, char *type,
  	}
  
        tmp->attrs[1]->mod_op = LDAP_MOD_ADD;
@@ -276,7 +276,7 @@ index 23dd873..d56bc56 100644
        tmp->attrs[1]->mod_values = (char **) calloc (sizeof (char *), 2);
  
        if (tmp->attrs[1]->mod_values == (char **)NULL)
-@@ -527,7 +591,7 @@ add_to_rr_list (char *dn, char *name, char *type,
+@@ -526,7 +589,7 @@ add_to_rr_list (char *dn, char *name, char *type,
  	 fatal("strdup");
  
        tmp->attrs[3]->mod_op = LDAP_MOD_ADD;
@@ -285,7 +285,7 @@ index 23dd873..d56bc56 100644
        tmp->attrs[3]->mod_values = (char **) calloc (sizeof (char *), 2);
  
        if (tmp->attrs[3]->mod_values == (char **)NULL)
-@@ -540,14 +604,25 @@ add_to_rr_list (char *dn, char *name, char *type,
+@@ -539,14 +602,25 @@ add_to_rr_list (char *dn, char *name, char *type,
        if (tmp->attrs[3]->mod_values[0] == NULL)
  	 fatal("strdup");
  
@@ -313,7 +313,7 @@ index 23dd873..d56bc56 100644
        tmp->attrs[4]->mod_values[1] = NULL;
  
        tmp->attrs[5] = NULL;
-@@ -558,7 +633,7 @@ add_to_rr_list (char *dn, char *name, char *type,
+@@ -557,7 +631,7 @@ add_to_rr_list (char *dn, char *name, char *type,
    else
      {
  
@@ -322,7 +322,7 @@ index 23dd873..d56bc56 100644
  	{
  	  sprintf (ldap_type_buffer, "%sRecord", type);
  	  if (!strncmp
-@@ -632,44 +707,70 @@ char **
+@@ -631,44 +705,70 @@ char **
  hostname_to_dn_list (char *hostname, char *zone, unsigned int flags)
  {
    char *tmp;
@@ -430,7 +430,7 @@ index 23dd873..d56bc56 100644
    dn_buffer[i] = NULL;
  
    return dn_buffer;
-@@ -681,24 +782,32 @@ hostname_to_dn_list (char *hostname, char *zone, unsigned int flags)
+@@ -680,24 +780,32 @@ hostname_to_dn_list (char *hostname, char *zone, unsigned int flags)
   * exception of "@"/SOA. */
  
  char *
@@ -459,7 +459,7 @@ index 23dd873..d56bc56 100644
      if (flag == WI_SPEC)
      {
        if (x == (size - 2) && (strncmp (dc_list[x], "@", 1) == 0) && (ttl))
--	sprintf (tmp, "relativeDomainName=%s + dNSTTL=%d,", dc_list[x], ttl);
+-	sprintf (tmp, "relativeDomainName=%s + dNSTTL=%u,", dc_list[x], ttl);
 +	sprintf (tmp, "zoneName=%s + relativeDomainName=%s,", zone, dc_list[x]);
        else if (x == (size - 2))
 -	      sprintf(tmp, "relativeDomainName=%s,",dc_list[x]);
@@ -467,7 +467,7 @@ index 23dd873..d56bc56 100644
        else
  	      sprintf(tmp,"dc=%s,", dc_list[x]);
      }
-@@ -724,6 +833,7 @@ void
+@@ -723,6 +831,7 @@ void
  init_ldap_conn ()
  {
    int result;
@@ -475,7 +475,7 @@ index 23dd873..d56bc56 100644
    conn = ldap_open (ldapsystem, LDAP_PORT);
    if (conn == NULL)
      {
-@@ -733,7 +843,7 @@ init_ldap_conn ()
+@@ -732,7 +841,7 @@ init_ldap_conn ()
      }
  
    result = ldap_simple_bind_s (conn, binddn, bindpw);
@@ -484,7 +484,7 @@ index 23dd873..d56bc56 100644
  }
  
  /* Like isc_result_check, only for LDAP */
-@@ -750,8 +860,6 @@ ldap_result_check (const char *msg, char *dn, int err)
+@@ -749,8 +858,6 @@ ldap_result_check (const char *msg, char *dn, int err)
      }
  }
  
@@ -493,7 +493,7 @@ index 23dd873..d56bc56 100644
  /* For running the ldap_info run queue. */
  void
  add_ldap_values (ldap_info * ldinfo)
-@@ -759,14 +867,14 @@ add_ldap_values (ldap_info * ldinfo)
+@@ -758,14 +865,14 @@ add_ldap_values (ldap_info * ldinfo)
    int result;
    char dnbuffer[1024];
  
@@ -510,7 +510,7 @@ index 23dd873..d56bc56 100644
  }
  
  
-@@ -777,5 +885,5 @@ void
+@@ -776,5 +883,5 @@ void
  usage ()
  {
    fprintf (stderr,
diff --git a/bind.spec b/bind.spec
index d9b8314..26277cc 100644
--- a/bind.spec
+++ b/bind.spec
@@ -44,8 +44,8 @@
 #
 
 # lib*.so.X versions of selected libraries
-%global sover_dns 1105
-%global sover_isc 1100
+%global sover_dns 1106
+%global sover_isc 1102
 %global sover_irs 161
 %global sover_isccfg 163
 
@@ -135,13 +135,9 @@ Patch164:bind-9.11-rh1666814.patch
 Patch165:bind-9.11-rh1647829.patch
 # random_test fails too often by random, disable it
 Patch168:bind-9.11-unit-disable-random.patch
-Patch169:bind-9.11-feature-test-dlz.patch
 Patch170:bind-9.11-feature-test-named.patch
 Patch171:bind-9.11-tests-variants.patch
 Patch172:bind-9.11-tests-pkcs11.patch
-Patch173: bind-9.11-unit-dnstap-pkcs11.patch
-Patch174: bind-9.11-unit-timer-nothread.patch
-Patch175: bind-9.11-CVE-2018-5741-atomic.patch
 
 # SDB patches
 Patch11: bind-9.3.2b2-sdbsrc.patch
@@ -518,13 +514,9 @@ are used for building ISC DHCP.
 %patch164 -p1 -b .rh1666814
 %patch165 -p1 -b .rh1647829
 %patch168 -p1 -b .random_test-disable
-%patch169 -p1 -b .featuretest-dlz
 %patch170 -p1 -b .featuretest-named
 %patch171 -p1 -b .test-variant
 %patch172 -p1 -b .test-pkcs11
-%patch173 -p1 -b .unit-dnstap
-%patch174 -p1 -b .unit-timer
-%patch175 -p1 -b .CVE-2018-5741-atomic
 
 mkdir lib/dns/tests/testdata/dstrandom
 cp -a %{SOURCE50} lib/dns/tests/testdata/dstrandom/random.data

From 7729230caf2d6dd626a994e42a8987d542e7a3a4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 13 Jun 2019 22:39:01 +0200
Subject: [PATCH 03/55] Fix OpenSSL random generator initialization

Also fix warning in test.
---
 bind-9.11-rt46047.patch | 67 ++++++++++++++++++++++++++---------------
 bind.spec               |  5 ++-
 2 files changed, 46 insertions(+), 26 deletions(-)

diff --git a/bind-9.11-rt46047.patch b/bind-9.11-rt46047.patch
index c5725f7..4f8181d 100644
--- a/bind-9.11-rt46047.patch
+++ b/bind-9.11-rt46047.patch
@@ -1,4 +1,4 @@
-From 55e649d82a1adc5209738fb8402624f03287ca87 Mon Sep 17 00:00:00 2001
+From ab9ee91f596c14cfc55a67ba3523b42a54e3e244 Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Thu, 28 Sep 2017 10:09:22 -0700
 Subject: [PATCH] completed and corrected the crypto-random change
@@ -33,11 +33,11 @@ Subject: [PATCH] completed and corrected the crypto-random change
  bin/named/include/named/server.h         |  2 +
  bin/named/interfacemgr.c                 |  1 +
  bin/named/query.c                        |  1 +
- bin/named/server.c                       | 51 ++++++++++++++--------
+ bin/named/server.c                       | 52 ++++++++++++++--------
  bin/nsupdate/nsupdate.c                  |  4 +-
  bin/tests/system/pipelined/pipequeries.c |  4 +-
  bin/tests/system/tkey/keycreate.c        |  4 +-
- bin/tests/system/tkey/keydelete.c        |  4 +-
+ bin/tests/system/tkey/keydelete.c        |  5 +--
  doc/arm/Bv9ARM-book.xml                  | 55 +++++++++++++++++-------
  doc/arm/notes.xml                        | 31 +++++++++++++
  lib/dns/dst_api.c                        |  4 +-
@@ -46,7 +46,7 @@ Subject: [PATCH] completed and corrected the crypto-random change
  lib/isc/include/isc/entropy.h            | 50 +++++++++++++++------
  lib/isc/include/isc/random.h             | 28 +++++++-----
  lib/isccfg/namedconf.c                   |  2 +-
- 22 files changed, 225 insertions(+), 107 deletions(-)
+ 22 files changed, 228 insertions(+), 106 deletions(-)
 
 diff --git a/bin/confgen/keygen.c b/bin/confgen/keygen.c
 index 295e16f..0f79aa8 100644
@@ -76,10 +76,10 @@ index 295e16f..0f79aa8 100644
  							     &entropy_source,
  							     randomfile,
 diff --git a/bin/dnssec/dnssec-keygen.docbook b/bin/dnssec/dnssec-keygen.docbook
-index ee6a489..17dddb6 100644
+index 0ae6b41..4562430 100644
 --- a/bin/dnssec/dnssec-keygen.docbook
 +++ b/bin/dnssec/dnssec-keygen.docbook
-@@ -350,15 +350,23 @@
+@@ -348,15 +348,23 @@
  	<term>-r <replaceable class="parameter">randomdev</replaceable></term>
  	<listitem>
  	  <para>
@@ -140,10 +140,10 @@ index 31a99e7..38c83ed 100644
  					   usekeyboard);
  
 diff --git a/bin/named/client.c b/bin/named/client.c
-index ce24670..0ce02a9 100644
+index 29fecad..a12623a 100644
 --- a/bin/named/client.c
 +++ b/bin/named/client.c
-@@ -1754,7 +1754,8 @@ ns_client_addopt(ns_client_t *client, dns_message_t *message,
+@@ -1752,7 +1752,8 @@ ns_client_addopt(ns_client_t *client, dns_message_t *message,
  
  		isc_buffer_init(&buf, cookie, sizeof(cookie));
  		isc_stdtime_get(&now);
@@ -241,7 +241,7 @@ index f5ed2b7..b2c1d05 100644
  
  struct ns_altsecret {
 diff --git a/bin/named/interfacemgr.c b/bin/named/interfacemgr.c
-index d9f6df5..662eb6c 100644
+index 135533b..4546831 100644
 --- a/bin/named/interfacemgr.c
 +++ b/bin/named/interfacemgr.c
 @@ -17,6 +17,7 @@
@@ -253,7 +253,7 @@ index d9f6df5..662eb6c 100644
  #include <isc/task.h>
  #include <isc/util.h>
 diff --git a/bin/named/query.c b/bin/named/query.c
-index 1d3edbc..193efde 100644
+index f85cc76..43a3661 100644
 --- a/bin/named/query.c
 +++ b/bin/named/query.c
 @@ -19,6 +19,7 @@
@@ -265,10 +265,10 @@ index 1d3edbc..193efde 100644
  #include <isc/serial.h>
  #include <isc/stats.h>
 diff --git a/bin/named/server.c b/bin/named/server.c
-index 30e7eac..27ea3bf 100644
+index 405ff71..700f83d 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
-@@ -8203,21 +8203,30 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8203,21 +8203,32 @@ load_configuration(const char *filename, ns_server_t *server,
  	 * Open the source of entropy.
  	 */
  	if (first_time) {
@@ -304,12 +304,13 @@ index 30e7eac..27ea3bf 100644
 -				isc_entropy_usehook(ns_g_entropy, true);
 -#else
 -			int level = ISC_LOG_ERROR;
--			result = isc_entropy_createfilesource(ns_g_entropy,
+ 			result = isc_entropy_createfilesource(ns_g_entropy,
 -							      randomdev);
++			                                      randomdev);
  #ifdef PATH_RANDOMDEV
  			if (ns_g_fallbackentropy != NULL) {
  				level = ISC_LOG_INFO;
-@@ -8228,8 +8237,8 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8228,8 +8239,8 @@ load_configuration(const char *filename, ns_server_t *server,
  					      NS_LOGCATEGORY_GENERAL,
  					      NS_LOGMODULE_SERVER,
  					      level,
@@ -320,7 +321,7 @@ index 30e7eac..27ea3bf 100644
  					      randomdev,
  					      isc_result_totext(result));
  			}
-@@ -8249,7 +8258,6 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8249,7 +8260,6 @@ load_configuration(const char *filename, ns_server_t *server,
  				}
  				isc_entropy_detach(&ns_g_fallbackentropy);
  			}
@@ -328,7 +329,15 @@ index 30e7eac..27ea3bf 100644
  #endif
  		}
  	}
-@@ -9040,6 +9048,9 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
+@@ -9014,6 +9024,7 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
+ 	server->in_roothints = NULL;
+ 	server->blackholeacl = NULL;
+ 	server->keepresporder = NULL;
++	server->rngctx = NULL;
+ 
+ 	/* Must be first. */
+ 	CHECKFATAL(dst_lib_init2(ns_g_mctx, ns_g_entropy,
+@@ -9040,6 +9051,9 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
  	CHECKFATAL(dns_tkeyctx_create(ns_g_mctx, ns_g_entropy,
  				      &server->tkeyctx),
  		   "creating TKEY context");
@@ -338,7 +347,7 @@ index 30e7eac..27ea3bf 100644
  
  	/*
  	 * Setup the server task, which is responsible for coordinating
-@@ -9246,7 +9257,8 @@ ns_server_destroy(ns_server_t **serverp) {
+@@ -9246,7 +9260,8 @@ ns_server_destroy(ns_server_t **serverp) {
  
  	if (server->zonemgr != NULL)
  		dns_zonemgr_detach(&server->zonemgr);
@@ -348,7 +357,7 @@ index 30e7eac..27ea3bf 100644
  	if (server->tkeyctx != NULL)
  		dns_tkeyctx_destroy(&server->tkeyctx);
  
-@@ -13197,10 +13209,10 @@ newzone_cfgctx_destroy(void **cfgp) {
+@@ -13197,10 +13212,10 @@ newzone_cfgctx_destroy(void **cfgp) {
  
  static isc_result_t
  generate_salt(unsigned char *salt, size_t saltlen) {
@@ -361,7 +370,7 @@ index 30e7eac..27ea3bf 100644
  	} rnd;
  	unsigned char text[512 + 1];
  	isc_region_t r;
-@@ -13210,9 +13222,10 @@ generate_salt(unsigned char *salt, size_t saltlen) {
+@@ -13210,9 +13225,10 @@ generate_salt(unsigned char *salt, size_t saltlen) {
  	if (saltlen > 256U)
  		return (ISC_R_RANGE);
  
@@ -376,7 +385,7 @@ index 30e7eac..27ea3bf 100644
  	memmove(salt, rnd.rnd, saltlen);
  
 diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
-index 6d7a02e..626b1cf 100644
+index 0286987..0376377 100644
 --- a/bin/nsupdate/nsupdate.c
 +++ b/bin/nsupdate/nsupdate.c
 @@ -283,9 +283,7 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
@@ -421,10 +430,18 @@ index fe8698e..937fcc3 100644
  	}
  #endif
 diff --git a/bin/tests/system/tkey/keydelete.c b/bin/tests/system/tkey/keydelete.c
-index 2146f9b..ac2c311 100644
+index 2146f9b..64b8e74 100644
 --- a/bin/tests/system/tkey/keydelete.c
 +++ b/bin/tests/system/tkey/keydelete.c
-@@ -182,9 +182,7 @@ main(int argc, char **argv) {
+@@ -171,6 +171,7 @@ main(int argc, char **argv) {
+ 		randomfile = argv[2];
+ 		argv += 2;
+ 		argc -= 2;
++		POST(argc);
+ 	}
+ 	keyname = argv[1];
+ 
+@@ -182,9 +183,7 @@ main(int argc, char **argv) {
  	ectx = NULL;
  	RUNCHECK(isc_entropy_create(mctx, &ectx));
  #ifdef ISC_PLATFORM_CRYPTORANDOM
@@ -436,7 +453,7 @@ index 2146f9b..ac2c311 100644
  	}
  #endif
 diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
-index bb79723..888959c 100644
+index b40cb05..8a81438 100644
 --- a/doc/arm/Bv9ARM-book.xml
 +++ b/doc/arm/Bv9ARM-book.xml
 @@ -5071,22 +5071,45 @@ badresp:1,adberr:0,findfail:0,valfail:0]
@@ -502,10 +519,10 @@ index bb79723..888959c 100644
  	    </listitem>
  	  </varlistentry>
 diff --git a/doc/arm/notes.xml b/doc/arm/notes.xml
-index ba9a7cf..c0256f1 100644
+index 00ce8f1..527135a 100644
 --- a/doc/arm/notes.xml
 +++ b/doc/arm/notes.xml
-@@ -117,6 +117,37 @@
+@@ -124,6 +124,37 @@
      </itemizedlist>
    </section>
  
diff --git a/bind.spec b/bind.spec
index 26277cc..f7a6b6d 100644
--- a/bind.spec
+++ b/bind.spec
@@ -53,7 +53,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.11.6
-Release:  5%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1511,6 +1511,9 @@ fi;
 
 
 %changelog
+* Mon Jun 17 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.7-2
+- Fix OpenSSL random generator initialization
+
 * Mon May 06 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.6-5.P1
 - Fix also postun script
 

From d032099ab8edaef71d7a41e14a3e0df6acff56f9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 11 Jun 2019 14:56:08 +0200
Subject: [PATCH 04/55] Fix libisc so version

---
 bind.spec | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index f7a6b6d..737c418 100644
--- a/bind.spec
+++ b/bind.spec
@@ -45,7 +45,7 @@
 
 # lib*.so.X versions of selected libraries
 %global sover_dns 1106
-%global sover_isc 1102
+%global sover_isc 1100
 %global sover_irs 161
 %global sover_isccfg 163
 

From aea68014445fd1b2c75c3a9c63c03cf48f1fbdbc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 2 Jul 2019 11:10:03 +0200
Subject: [PATCH 05/55] Update to 9.11.8

Contains:
5244.	[security]	Fixed a race condition in dns_dispatch_getnext()
			that could cause an assertion failure if a
			significant number of incoming packets were
			rejected. (CVE-2019-6471) [GL #942]

5241.	[bug]		Fix Ed448 private and public key ASN.1 prefix blobs.
			[GL #225]

5237.	[bug]		Recurse to find the root server list with 'dig +trace'.
			[GL #1028]
---
 .gitignore                         |  1 +
 bind-9.10-dist-native-pkcs11.patch | 32 +++++++++++++++---------------
 bind-9.11.8.tar.gz.asc             | 16 +++++++++++++++
 bind.spec                          |  9 ++++++---
 sources                            |  2 +-
 5 files changed, 40 insertions(+), 20 deletions(-)
 create mode 100644 bind-9.11.8.tar.gz.asc

diff --git a/.gitignore b/.gitignore
index 9775b64..ecd31fd 100644
--- a/.gitignore
+++ b/.gitignore
@@ -92,3 +92,4 @@ bind-9.7.2b1.tar.gz
 /bind-9.11.5-P4.tar.gz
 /bind-9.11.6.tar.gz
 /bind-9.11.6-P1.tar.gz
+/bind-9.11.8.tar.gz
diff --git a/bind-9.10-dist-native-pkcs11.patch b/bind-9.10-dist-native-pkcs11.patch
index 65a2e83..9468850 100644
--- a/bind-9.10-dist-native-pkcs11.patch
+++ b/bind-9.10-dist-native-pkcs11.patch
@@ -300,10 +300,10 @@ index a058c91..d4b689a 100644
  DEPLIBS =	${ISCDEPLIBS}
  
 diff --git a/configure.ac b/configure.ac
-index 5e4e839..0ef2c8f 100644
+index d48fd51..79c96f8 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -1081,12 +1081,14 @@ AC_SUBST(USE_GSSAPI)
+@@ -1089,12 +1089,14 @@ AC_SUBST(USE_GSSAPI)
  AC_SUBST(DST_GSSAPI_INC)
  AC_SUBST(DNS_GSSAPI_LIBS)
  DNS_CRYPTO_LIBS="$DNS_GSSAPI_LIBS $DNS_CRYPTO_LIBS"
@@ -318,7 +318,7 @@ index 5e4e839..0ef2c8f 100644
  
  #
  # was --with-randomdev specified?
-@@ -1471,11 +1473,11 @@ fi
+@@ -1479,11 +1481,11 @@ fi
  AC_MSG_CHECKING(for OpenSSL library)
  OPENSSL_WARNING=
  openssldirs="/usr /usr/local /usr/local/ssl /usr/pkg /usr/sfw"
@@ -335,7 +335,7 @@ index 5e4e839..0ef2c8f 100644
  
  if test "auto" = "$use_openssl"
  then
-@@ -1488,6 +1490,7 @@ then
+@@ -1496,6 +1498,7 @@ then
  		fi
  	done
  fi
@@ -343,7 +343,7 @@ index 5e4e839..0ef2c8f 100644
  OPENSSL_ECDSA=""
  OPENSSL_GOST=""
  OPENSSL_ED25519=""
-@@ -1509,11 +1512,10 @@ case "$with_gost" in
+@@ -1517,11 +1520,10 @@ case "$with_gost" in
  		;;
  esac
  
@@ -358,7 +358,7 @@ index 5e4e839..0ef2c8f 100644
  		CRYPTOLIB="pkcs11"
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
-@@ -1523,7 +1525,9 @@ case "$use_openssl" in
+@@ -1531,7 +1533,9 @@ case "$use_openssl" in
  		OPENSSLGOSTLINKSRCS=""
  		OPENSSLLINKOBJS=""
  		OPENSSLLINKSRCS=""
@@ -369,7 +369,7 @@ index 5e4e839..0ef2c8f 100644
  	no)
  		AC_MSG_RESULT(no)
  		DST_OPENSSL_INC=""
-@@ -1555,7 +1559,7 @@ case "$use_openssl" in
+@@ -1563,7 +1567,7 @@ case "$use_openssl" in
  If you do not want OpenSSL, use --without-openssl])
  		;;
  	*)
@@ -378,7 +378,7 @@ index 5e4e839..0ef2c8f 100644
  		then
  			AC_MSG_RESULT()
  			AC_MSG_ERROR([OpenSSL and native PKCS11 cannot be used together.])
-@@ -1983,6 +1987,7 @@ AC_SUBST(OPENSSL_ED25519)
+@@ -1991,6 +1995,7 @@ AC_SUBST(OPENSSL_ED25519)
  AC_SUBST(OPENSSL_GOST)
  
  DNS_CRYPTO_LIBS="$DNS_CRYPTO_LIBS $DST_OPENSSL_LIBS"
@@ -386,7 +386,7 @@ index 5e4e839..0ef2c8f 100644
  
  ISC_PLATFORM_WANTAES="#undef ISC_PLATFORM_WANTAES"
  if test "yes" = "$with_aes"
-@@ -2306,6 +2311,7 @@ esac
+@@ -2314,6 +2319,7 @@ esac
  AC_SUBST(PKCS11LINKOBJS)
  AC_SUBST(PKCS11LINKSRCS)
  AC_SUBST(CRYPTO)
@@ -394,7 +394,7 @@ index 5e4e839..0ef2c8f 100644
  AC_SUBST(PKCS11_ECDSA)
  AC_SUBST(PKCS11_GOST)
  AC_SUBST(PKCS11_ED25519)
-@@ -5428,8 +5434,11 @@ AC_CONFIG_FILES([
+@@ -5441,8 +5447,11 @@ AC_CONFIG_FILES([
  	bin/delv/Makefile
  	bin/dig/Makefile
  	bin/dnssec/Makefile
@@ -406,7 +406,7 @@ index 5e4e839..0ef2c8f 100644
  	bin/nsupdate/Makefile
  	bin/pkcs11/Makefile
  	bin/python/Makefile
-@@ -5502,6 +5511,10 @@ AC_CONFIG_FILES([
+@@ -5515,6 +5524,10 @@ AC_CONFIG_FILES([
  	lib/dns/include/dns/Makefile
  	lib/dns/include/dst/Makefile
  	lib/dns/tests/Makefile
@@ -417,7 +417,7 @@ index 5e4e839..0ef2c8f 100644
  	lib/irs/Makefile
  	lib/irs/include/Makefile
  	lib/irs/include/irs/Makefile
-@@ -5526,6 +5539,24 @@ AC_CONFIG_FILES([
+@@ -5539,6 +5552,24 @@ AC_CONFIG_FILES([
  	lib/isc/unix/include/Makefile
  	lib/isc/unix/include/isc/Makefile
  	lib/isc/unix/include/pkcs11/Makefile
@@ -456,7 +456,7 @@ index 81270a0..bcb5312 100644
  
  @BIND9_MAKE_RULES@
 diff --git a/lib/dns-pkcs11/Makefile.in b/lib/dns-pkcs11/Makefile.in
-index 56dd259..f9aa782 100644
+index f6868d1..ea6fd36 100644
 --- a/lib/dns-pkcs11/Makefile.in
 +++ b/lib/dns-pkcs11/Makefile.in
 @@ -26,16 +26,16 @@ VERSION=@BIND9_VERSION@
@@ -501,9 +501,9 @@ index 56dd259..f9aa782 100644
  
  include: gen
  	${MAKE} include/dns/enumtype.h
-@@ -183,22 +183,22 @@ gen: gen.c
- 	${BUILD_CC} ${BUILD_CFLAGS} -I${top_srcdir}/lib/isc/include \
- 	${BUILD_CPPFLAGS} ${BUILD_LDFLAGS} -o $@ ${srcdir}/gen.c ${BUILD_LIBS}
+@@ -185,22 +185,22 @@ gen: gen.c
+ 	${BUILD_CPPFLAGS} ${BUILD_LDFLAGS} -o $@ ${srcdir}/gen.c \
+ 	${BUILD_LIBS} ${LFS_LIBS}
  
 -timestamp: include libdns.@A@
 +timestamp: include libdns-pkcs11.@A@
diff --git a/bind-9.11.8.tar.gz.asc b/bind-9.11.8.tar.gz.asc
new file mode 100644
index 0000000..fb0ac3b
--- /dev/null
+++ b/bind-9.11.8.tar.gz.asc
@@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABAgAdFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAlz45qgACgkQdLtrmky7
+PThZoxAAuqUxL9JV1NsvODkJ049F8hRrrzhN8Vgx19D/w6oLWawaHuOahU67RYWh
+OGa3D72G0mClVFBABTV9YiAwkNnbkq3Nkclh6riWDjAO3RPKMo50yiAhLKSt2Z4N
+i0dMSIzZb8T9nq19T9JI1loyEG3oU+I97uWLyzrLe2WqCpSmdCTNd8PsD/0r+MxV
+QnBt1RFHda4z7r0fYLMw5oALXiNttPg6JdKByssgmYB6DYYw4f9ywMj1e8Jnn307
+6BXMweF0uOpGgy18HzgdfSjMNc3g9WKU86gTyAblAd1HALtdwe/VKgH1ZVJZoflT
+QnxzJDDjNbKE5OP7TOgzN9pLPCGwvQhpHDqGTTn+cTj5h9pQZcfq0vQQJ+MGzFWF
+kj0TUeLYs9FNnJt91Rpk+T96sOUypOrpPM9RdAEKp38qSMmZN8DJ83sga2b1OCqr
+zIcuQOBuXlKu9uD9g2cTquGGSG0vGvVSx0OXogUYEPS635AZbyZ9IqSntlDE+cnS
+mJt7jCQv+DVFVDUiyfLcdmPZk0U88hHdruKTbN3dc+a+OMddukPM4AepLKgdAWkQ
+F9et7SJ5VeiGiHgIwJaeu04VhD4DuQILo6xx7wxJIiPQ8H1sazdrikcn70hxMQwB
+yq1tBfQHTUfHmZBCytMVRR3sEQscv/7MBEhS9DXmNRYfIXrXKIE=
+=j1R3
+-----END PGP SIGNATURE-----
diff --git a/bind.spec b/bind.spec
index 737c418..6d3ac25 100644
--- a/bind.spec
+++ b/bind.spec
@@ -2,7 +2,7 @@
 # Red Hat BIND package .spec file
 #
 
-%global PATCHVER P1
+#%%global PATCHVER P1
 #%%global PREVER rc1
 %global BINDVERSION %{version}%{?PREVER}%{?PATCHVER:-%{PATCHVER}}
 
@@ -52,8 +52,8 @@
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.11.6
-Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Version:  9.11.8
+Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1511,6 +1511,9 @@ fi;
 
 
 %changelog
+* Tue Jul 02 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.8-1
+- Update to 9.11.8
+
 * Mon Jun 17 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.7-2
 - Fix OpenSSL random generator initialization
 
diff --git a/sources b/sources
index 413be45..a8b7813 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.11.6-P1.tar.gz) = 419aeeddeab7aef818b9043db7b21a847993444f663dca04e58ee97a0ebee0610cbc5a9422d17a6f0ee5d44598a2cbb5651e3b4e8c56708eaf923dca0a5c4c03
+SHA512 (bind-9.11.8.tar.gz) = 0192d6e087cdbdebec171869d908c4326c2575d65ee5367a78ed9da26de357e017b0306349d66a6016a7ec80ad27f5f7f9f2db25002c6d0c78589dc473a015fc
 SHA512 (config-19.tar.bz2) = 36aa38a0c7c33267ae594b31c81681290ac58dde7ca6749bd599da531380b5b1428330813dbe983e01071ccaed83e83f6a9cd92179a53b7d0ccbb6851a0b017c

From cf411e66ff9261ad2c1d049c776f3131a01893b9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 24 Jul 2019 17:30:34 +0200
Subject: [PATCH 06/55] Use monotonic time in export library (#1732883)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Petr Menšík <pemensik@redhat.com>
---
 bind-9.11-rh1732883.patch | 202 ++++++++++++++++++++++++++++++++++++++
 bind.spec                 |   7 +-
 2 files changed, 208 insertions(+), 1 deletion(-)
 create mode 100644 bind-9.11-rh1732883.patch

diff --git a/bind-9.11-rh1732883.patch b/bind-9.11-rh1732883.patch
new file mode 100644
index 0000000..b312e63
--- /dev/null
+++ b/bind-9.11-rh1732883.patch
@@ -0,0 +1,202 @@
+From 9ac315c16bf8441145f5b4b8a3308ae9f03582ab Mon Sep 17 00:00:00 2001
+From: Pavel Zhukov <pzhukov@redhat.com>
+Date: Wed, 24 Jul 2019 17:15:55 +0200
+Subject: [PATCH] Detect system time jumps
+
+In case if system time was changed backward it's possible to have ip
+address dropped by the kernel due to lifetime expirity. Try to detect
+this situation using either monotonic time or saved timestamp and execute
+go_reboot() procedure to request lease extention
+---
+ lib/isc/include/isc/result.h    |  4 ++--
+ lib/isc/include/isc/util.h      |  4 ++++
+ lib/isc/result.c                |  2 ++
+ lib/isc/unix/app.c              | 41 +++++++++++++++++++++++++++++++--
+ lib/isc/unix/include/isc/time.h | 20 ++++++++++++++++
+ lib/isc/unix/time.c             | 22 ++++++++++++++++++
+ 6 files changed, 89 insertions(+), 4 deletions(-)
+
+diff --git a/lib/isc/include/isc/result.h b/lib/isc/include/isc/result.h
+index 246aefb..70d4b64 100644
+--- a/lib/isc/include/isc/result.h
++++ b/lib/isc/include/isc/result.h
+@@ -83,9 +83,9 @@
+ #define ISC_R_UNSET			61	/*%< unset */
+ #define ISC_R_MULTIPLE			62	/*%< multiple */
+ #define ISC_R_WOULDBLOCK		63	/*%< would block */
+-
++#define ISC_R_TIMESHIFTED               64      /*%< system time changed */
+ /*% Not a result code: the number of results. */
+-#define ISC_R_NRESULTS 			64
++#define ISC_R_NRESULTS 			65
+ 
+ ISC_LANG_BEGINDECLS
+ 
+diff --git a/lib/isc/include/isc/util.h b/lib/isc/include/isc/util.h
+index 332dc0c..f81967d 100644
+--- a/lib/isc/include/isc/util.h
++++ b/lib/isc/include/isc/util.h
+@@ -233,6 +233,10 @@
+  * Time
+  */
+ #define TIME_NOW(tp) 	RUNTIME_CHECK(isc_time_now((tp)) == ISC_R_SUCCESS)
++#ifdef CLOCK_BOOTTIME
++#define TIME_MONOTONIC(tp) 	RUNTIME_CHECK(isc_time_boottime((tp)) == ISC_R_SUCCESS)
++#endif
++
+ 
+ /*%
+  * Misc
+diff --git a/lib/isc/result.c b/lib/isc/result.c
+index a707c32..6776fc6 100644
+--- a/lib/isc/result.c
++++ b/lib/isc/result.c
+@@ -99,6 +99,7 @@ static const char *description[ISC_R_NRESULTS] = {
+ 	"unset",				/*%< 61 */
+ 	"multiple",				/*%< 62 */
+ 	"would block",				/*%< 63 */
++        "time changed",                         /*%< 64 */
+ };
+ 
+ static const char *identifier[ISC_R_NRESULTS] = {
+@@ -166,6 +167,7 @@ static const char *identifier[ISC_R_NRESULTS] = {
+ 	"ISC_R_UNSET",
+ 	"ISC_R_MULTIPLE",
+ 	"ISC_R_WOULDBLOCK",
++        "ISC_R_TIMESHIFTED",
+ };
+ 
+ #define ISC_RESULT_RESULTSET			2
+diff --git a/lib/isc/unix/app.c b/lib/isc/unix/app.c
+index bace2bd..e9814d2 100644
+--- a/lib/isc/unix/app.c
++++ b/lib/isc/unix/app.c
+@@ -441,15 +441,51 @@ isc__app_ctxonrun(isc_appctx_t *ctx0, isc_mem_t *mctx, isc_task_t *task,
+ static isc_result_t
+ evloop(isc__appctx_t *ctx) {
+ 	isc_result_t result;
++        isc_time_t now;
++#ifdef CLOCK_BOOTTIME
++        isc_time_t monotonic;
++        isc_uint64_t diff  = 0;
++#else
++        isc_time_t prev;
++        TIME_NOW(&prev);
++#endif
++
++
++
+ 
+ 	while (!ctx->want_shutdown) {
+ 		int n;
+-		isc_time_t when, now;
++		isc_time_t when;
++                
+ 		struct timeval tv, *tvp;
+ 		isc_socketwait_t *swait;
+ 		isc_boolean_t readytasks;
+ 		isc_boolean_t call_timer_dispatch = ISC_FALSE;
+ 
++                isc_uint64_t us; 
++
++#ifdef CLOCK_BOOTTIME
++                // TBD macros for following three lines
++                TIME_NOW(&now);
++                TIME_MONOTONIC(&monotonic);
++                INSIST(now.seconds > monotonic.seconds)
++                us = isc_time_microdiff (&now, &monotonic);
++                if (us < diff){ 
++                  us = diff - us;
++                  if (us > 1000000){ // ignoring shifts less than one second
++                    return ISC_R_TIMESHIFTED;
++                  };
++                  diff = isc_time_microdiff (&now, &monotonic);
++                } else {
++                  diff = isc_time_microdiff (&now, &monotonic);
++                  // not implemented
++                }
++#else
++                TIME_NOW(&now);
++                if (isc_time_compare (&now, &prev) < 0)
++                  return ISC_R_TIMESHIFTED;
++                TIME_NOW(&prev);
++#endif                
+ 		/*
+ 		 * Check the reload (or suspend) case first for exiting the
+ 		 * loop as fast as possible in case:
+@@ -474,9 +510,10 @@ evloop(isc__appctx_t *ctx) {
+ 			if (result != ISC_R_SUCCESS)
+ 				tvp = NULL;
+ 			else {
+-				isc_uint64_t us;
++
+ 
+ 				TIME_NOW(&now);
++
+ 				us = isc_time_microdiff(&when, &now);
+ 				if (us == 0)
+ 					call_timer_dispatch = ISC_TRUE;
+diff --git a/lib/isc/unix/include/isc/time.h b/lib/isc/unix/include/isc/time.h
+index 75e24b9..de8b399 100644
+--- a/lib/isc/unix/include/isc/time.h
++++ b/lib/isc/unix/include/isc/time.h
+@@ -129,6 +129,26 @@ isc_time_isepoch(const isc_time_t *t);
+  *\li	't' is a valid pointer.
+  */
+ 
++#ifdef CLOCK_BOOTTIME
++isc_result_t
++isc_time_boottime(isc_time_t *t);
++/*%<
++ * Set 't' to monotonic time from previous boot
++ * it's not affected by system time change. It also
++ * includes the time system was suspended
++ *
++ * Requires:
++ *\li	't' is a valid pointer.
++ *
++ * Returns:
++ *
++ *\li	Success
++ *\li	Unexpected error
++ *		Getting the time from the system failed.
++ */
++#endif /* CLOCK_BOOTTIME */
++ 
++
+ isc_result_t
+ isc_time_now(isc_time_t *t);
+ /*%<
+diff --git a/lib/isc/unix/time.c b/lib/isc/unix/time.c
+index 2210240..d7613b8 100644
+--- a/lib/isc/unix/time.c
++++ b/lib/isc/unix/time.c
+@@ -496,3 +496,25 @@ isc_time_formatISO8601ms(const isc_time_t *t, char *buf, unsigned int len) {
+ 			 t->nanoseconds / NS_PER_MS);
+ 	}
+ }
++
++
++#ifdef CLOCK_BOOTTIME
++isc_result_t
++isc_time_boottime(isc_time_t *t) {
++  struct timespec ts;
++  
++  char strbuf[ISC_STRERRORSIZE];
++
++  if (clock_gettime (CLOCK_BOOTTIME, &ts) != 0){
++    isc__strerror(errno, strbuf, sizeof(strbuf));
++    UNEXPECTED_ERROR(__FILE__, __LINE__, "%s", strbuf);
++    return (ISC_R_UNEXPECTED);    
++  }
++
++  t->seconds = ts.tv_sec;
++  t->nanoseconds = ts.tv_nsec;
++
++  return (ISC_R_SUCCESS);
++  
++};
++#endif
+-- 
+2.20.1
+
diff --git a/bind.spec b/bind.spec
index 6d3ac25..f15db2b 100644
--- a/bind.spec
+++ b/bind.spec
@@ -53,7 +53,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.11.8
-Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -138,6 +138,7 @@ Patch168:bind-9.11-unit-disable-random.patch
 Patch170:bind-9.11-feature-test-named.patch
 Patch171:bind-9.11-tests-variants.patch
 Patch172:bind-9.11-tests-pkcs11.patch
+Patch173:bind-9.11-rh1732883.patch
 
 # SDB patches
 Patch11: bind-9.3.2b2-sdbsrc.patch
@@ -517,6 +518,7 @@ are used for building ISC DHCP.
 %patch170 -p1 -b .featuretest-named
 %patch171 -p1 -b .test-variant
 %patch172 -p1 -b .test-pkcs11
+%patch173 -p1 -b .rh1732883
 
 mkdir lib/dns/tests/testdata/dstrandom
 cp -a %{SOURCE50} lib/dns/tests/testdata/dstrandom/random.data
@@ -1511,6 +1513,9 @@ fi;
 
 
 %changelog
+* Wed Jul 24 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.8-2
+- Use monotonic time in export library (#1732883)
+
 * Tue Jul 02 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.8-1
 - Update to 9.11.8
 

From 30676f9c5fe7c07429609e42f11ca32261f72b2a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 24 Jul 2019 17:37:04 +0200
Subject: [PATCH 07/55] Update to 9.11.9

---
 .gitignore             |  1 +
 bind-9.11.8.tar.gz.asc | 16 ----------------
 bind-9.11.9.tar.gz.asc | 16 ++++++++++++++++
 bind.spec              |  7 +++++--
 sources                |  2 +-
 5 files changed, 23 insertions(+), 19 deletions(-)
 delete mode 100644 bind-9.11.8.tar.gz.asc
 create mode 100644 bind-9.11.9.tar.gz.asc

diff --git a/.gitignore b/.gitignore
index ecd31fd..08ffa36 100644
--- a/.gitignore
+++ b/.gitignore
@@ -93,3 +93,4 @@ bind-9.7.2b1.tar.gz
 /bind-9.11.6.tar.gz
 /bind-9.11.6-P1.tar.gz
 /bind-9.11.8.tar.gz
+/bind-9.11.9.tar.gz
diff --git a/bind-9.11.8.tar.gz.asc b/bind-9.11.8.tar.gz.asc
deleted file mode 100644
index fb0ac3b..0000000
--- a/bind-9.11.8.tar.gz.asc
+++ /dev/null
@@ -1,16 +0,0 @@
------BEGIN PGP SIGNATURE-----
-
-iQIzBAABAgAdFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAlz45qgACgkQdLtrmky7
-PThZoxAAuqUxL9JV1NsvODkJ049F8hRrrzhN8Vgx19D/w6oLWawaHuOahU67RYWh
-OGa3D72G0mClVFBABTV9YiAwkNnbkq3Nkclh6riWDjAO3RPKMo50yiAhLKSt2Z4N
-i0dMSIzZb8T9nq19T9JI1loyEG3oU+I97uWLyzrLe2WqCpSmdCTNd8PsD/0r+MxV
-QnBt1RFHda4z7r0fYLMw5oALXiNttPg6JdKByssgmYB6DYYw4f9ywMj1e8Jnn307
-6BXMweF0uOpGgy18HzgdfSjMNc3g9WKU86gTyAblAd1HALtdwe/VKgH1ZVJZoflT
-QnxzJDDjNbKE5OP7TOgzN9pLPCGwvQhpHDqGTTn+cTj5h9pQZcfq0vQQJ+MGzFWF
-kj0TUeLYs9FNnJt91Rpk+T96sOUypOrpPM9RdAEKp38qSMmZN8DJ83sga2b1OCqr
-zIcuQOBuXlKu9uD9g2cTquGGSG0vGvVSx0OXogUYEPS635AZbyZ9IqSntlDE+cnS
-mJt7jCQv+DVFVDUiyfLcdmPZk0U88hHdruKTbN3dc+a+OMddukPM4AepLKgdAWkQ
-F9et7SJ5VeiGiHgIwJaeu04VhD4DuQILo6xx7wxJIiPQ8H1sazdrikcn70hxMQwB
-yq1tBfQHTUfHmZBCytMVRR3sEQscv/7MBEhS9DXmNRYfIXrXKIE=
-=j1R3
------END PGP SIGNATURE-----
diff --git a/bind-9.11.9.tar.gz.asc b/bind-9.11.9.tar.gz.asc
new file mode 100644
index 0000000..9e9ad71
--- /dev/null
+++ b/bind-9.11.9.tar.gz.asc
@@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABAgAdFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAl0u4wIACgkQdLtrmky7
+PTgO+A/8DtA5xbbJZx6ifx/AXS+0TBwnyRt1qkDplCRMq4/G+/r9iHh2Z3JYiznV
+NKHkV7JV+d4p9pygOo0s563DsFTg3A6OtzhU7n8QxFS4e3T6S+vKBX1s0Iixu/hN
+q9pxhhefeGejVUjhKqAHbNvoCO2stMAgZi02qhqECJPvu8YtyOPEPNW/K+2aWLH3
+P3gNwIbj1+NjNBWAAhiSEK+px7do4499AxGOZcCPUUmhEAWckcQ1wyC94tDC3uQi
+XY3asr6Ph7WWXkM0qnUDx9+ZPKKDOMevX11W+5cNw1qioss8dWcs3l7mhUuRITVx
+u/yaQYt7F9BY5XjtbaBtTWBDRbpCrrt2YpMhNJ/aedSbCoRT/ZYiDqNwKCEes10s
+hJK4LG4pCtVWQnwi4xFeCxI+NJK5b5gRj5NZ/cwKqGMnEmO0hg3aiDtEUF424t1i
+IdJvDs+NaMjHqitpvc8hlJpTpiefCuGTYjrrJLjnAsA3r72z4aLb8M6ivBNmpEiJ
+x5LFyBZusHzuCSfFV23tBZvZ1VQf53Netz0PXbOCdnKKYlibUGzD3pC8LdoMoj5m
+/s4BYes5ET4xA867yZg7y/A0x0Ezuw+7NLXhpMSAQh/OZwWQ1CzspvYUxl8hHx67
+r1aH0dkAtN8BtaR5lTrXtFfRTJvEqNQ9lFQwljwEJqfwFN4dJBc=
+=m4su
+-----END PGP SIGNATURE-----
diff --git a/bind.spec b/bind.spec
index f15db2b..1819d65 100644
--- a/bind.spec
+++ b/bind.spec
@@ -52,8 +52,8 @@
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.11.8
-Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Version:  9.11.9
+Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1513,6 +1513,9 @@ fi;
 
 
 %changelog
+* Wed Jul 24 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.9-1
+- Update to 9.11.9
+
 * Wed Jul 24 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.8-2
 - Use monotonic time in export library (#1732883)
 
diff --git a/sources b/sources
index a8b7813..78dba7f 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.11.8.tar.gz) = 0192d6e087cdbdebec171869d908c4326c2575d65ee5367a78ed9da26de357e017b0306349d66a6016a7ec80ad27f5f7f9f2db25002c6d0c78589dc473a015fc
+SHA512 (bind-9.11.9.tar.gz) = 4fa975b83986480a12138a3cf7ccf3bcd2251d194e0c04e3fad0787fc8b2a5dee241179fbb25b0283fa6fcb749d7a15fad036039dbc81250defcba0108823ef8
 SHA512 (config-19.tar.bz2) = 36aa38a0c7c33267ae594b31c81681290ac58dde7ca6749bd599da531380b5b1428330813dbe983e01071ccaed83e83f6a9cd92179a53b7d0ccbb6851a0b017c

From af22b4c83676f722a3a0fd34734e30c548bfd1ee Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 24 Jul 2019 19:05:06 +0200
Subject: [PATCH 08/55] Update patches to 9.11.9

Maxmind library and defines modifies many patches changing flags.
Conflicts a lot especially with PKCS11 build.
---
 bind-9.10-dist-native-pkcs11.patch | 107 ++++++++++++-------------
 bind-9.10-sdb.patch                |  45 +++++------
 bind-9.11-feature-test-named.patch |  16 ++--
 bind-9.11-fips-tests.patch         |  14 ++--
 bind-9.11-kyua-pkcs11.patch        |  12 +--
 bind-9.11-rh1732883.patch          |  96 +++++++++++------------
 bind-9.11-rt31459.patch            | 120 ++++++++++++++---------------
 7 files changed, 200 insertions(+), 210 deletions(-)

diff --git a/bind-9.10-dist-native-pkcs11.patch b/bind-9.10-dist-native-pkcs11.patch
index 9468850..0ba7ccc 100644
--- a/bind-9.10-dist-native-pkcs11.patch
+++ b/bind-9.10-dist-native-pkcs11.patch
@@ -14,10 +14,10 @@ index f0c504a..ce7a2da 100644
  
  @BIND9_MAKE_RULES@
 diff --git a/bin/dnssec-pkcs11/Makefile.in b/bin/dnssec-pkcs11/Makefile.in
-index ce0a177..8908a45 100644
+index 4b8ca13..32f4470 100644
 --- a/bin/dnssec-pkcs11/Makefile.in
 +++ b/bin/dnssec-pkcs11/Makefile.in
-@@ -17,18 +17,18 @@ VERSION=@BIND9_VERSION@
+@@ -15,18 +15,18 @@ VERSION=@BIND9_VERSION@
  
  @BIND9_MAKE_INCLUDES@
  
@@ -30,10 +30,10 @@ index ce0a177..8908a45 100644
 +		@CRYPTO_PK11@ -DPK11_LIB_LOCATION=\"@PKCS11_PROVIDER@\"
  CWARNINGS =
  
--DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
+-DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
 -ISCLIBS =	../../lib/isc/libisc.@A@
 -ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@
-+DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ @DNS_CRYPTO_LIBS@
++DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
 +ISCLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
 +ISCNOSYMLIBS =	../../lib/isc-pkcs11/libisc-pkcs11-nosymtbl.@A@
  
@@ -44,7 +44,7 @@ index ce0a177..8908a45 100644
  
  DEPLIBS =	${DNSDEPLIBS} ${ISCDEPLIBS}
  
-@@ -37,10 +37,10 @@ LIBS =		${DNSLIBS} ${ISCLIBS} @LIBS@
+@@ -35,10 +35,10 @@ LIBS =		${DNSLIBS} ${ISCLIBS} @LIBS@
  NOSYMLIBS =	${DNSLIBS} ${ISCNOSYMLIBS} @LIBS@
  
  # Alphabetically
@@ -59,7 +59,7 @@ index ce0a177..8908a45 100644
  
  OBJS =		dnssectool.@O@
  
-@@ -61,15 +61,15 @@ MANOBJS =	${MANPAGES} ${HTMLPAGES}
+@@ -59,15 +59,15 @@ MANOBJS =	${MANPAGES} ${HTMLPAGES}
  
  @BIND9_MAKE_RULES@
  
@@ -78,7 +78,7 @@ index ce0a177..8908a45 100644
  	export BASEOBJS="dnssec-keygen.@O@ ${OBJS}"; \
  	${FINALBUILDCMD}
  
-@@ -77,7 +77,7 @@ dnssec-signzone.@O@: dnssec-signzone.c
+@@ -75,7 +75,7 @@ dnssec-signzone.@O@: dnssec-signzone.c
  	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} -DVERSION=\"${VERSION}\" \
  		-c ${srcdir}/dnssec-signzone.c
  
@@ -87,7 +87,7 @@ index ce0a177..8908a45 100644
  	export BASEOBJS="dnssec-signzone.@O@ ${OBJS}"; \
  	${FINALBUILDCMD}
  
-@@ -85,19 +85,19 @@ dnssec-verify.@O@: dnssec-verify.c
+@@ -83,19 +83,19 @@ dnssec-verify.@O@: dnssec-verify.c
  	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} -DVERSION=\"${VERSION}\" \
  		-c ${srcdir}/dnssec-verify.c
  
@@ -111,7 +111,7 @@ index ce0a177..8908a45 100644
  	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \
  	dnssec-importkey.@O@ ${OBJS} ${LIBS}
  
-@@ -108,16 +108,14 @@ docclean manclean maintainer-clean::
+@@ -106,16 +106,14 @@ docclean manclean maintainer-clean::
  
  installdirs:
  	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
@@ -130,10 +130,10 @@ index ce0a177..8908a45 100644
  
  clean distclean::
 diff --git a/bin/dnssec/Makefile.in b/bin/dnssec/Makefile.in
-index ce0a177..7cede84 100644
+index 4b8ca13..4175996 100644
 --- a/bin/dnssec/Makefile.in
 +++ b/bin/dnssec/Makefile.in
-@@ -19,7 +19,7 @@ VERSION=@BIND9_VERSION@
+@@ -17,7 +17,7 @@ VERSION=@BIND9_VERSION@
  
  CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} @DST_OPENSSL_INC@
  
@@ -143,44 +143,46 @@ index ce0a177..7cede84 100644
  CWARNINGS =
  
 diff --git a/bin/named-pkcs11/Makefile.in b/bin/named-pkcs11/Makefile.in
-index c0861f6..df80f81 100644
+index df1f7ee..f397ab0 100644
 --- a/bin/named-pkcs11/Makefile.in
 +++ b/bin/named-pkcs11/Makefile.in
-@@ -43,26 +43,26 @@ DLZDRIVER_INCLUDES =	@DLZ_DRIVER_INCLUDES@
+@@ -43,27 +43,28 @@ DLZDRIVER_INCLUDES =	@DLZ_DRIVER_INCLUDES@
  DLZDRIVER_LIBS =	@DLZ_DRIVER_LIBS@
  
  CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
 -		${LWRES_INCLUDES} ${DNS_INCLUDES} ${BIND9_INCLUDES} \
 -		${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} ${ISC_INCLUDES} \
-+        ${LWRES_INCLUDES} ${DNS_PKCS11_INCLUDES} ${BIND9_INCLUDES} \
-+        ${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} ${ISC_PKCS11_INCLUDES} \
- 		${DLZDRIVER_INCLUDES} ${DBDRIVER_INCLUDES} @DST_OPENSSL_INC@
++		${LWRES_INCLUDES} ${DNS_PKCS11_INCLUDES} ${BIND9_INCLUDES} \
++		${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} ${ISC_PKCS11_INCLUDES} \
+ 		${DLZDRIVER_INCLUDES} ${DBDRIVER_INCLUDES} ${MAXMINDDB_CFLAGS} \
+ 		@DST_OPENSSL_INC@
  
 -CDEFINES =      @CONTRIB_DLZ@ @USE_PKCS11@ @PKCS11_ENGINE@ @CRYPTO@
 +CDEFINES =      @USE_PKCS11@ @PKCS11_ENGINE@ @CRYPTO_PK11@
  
  CWARNINGS =
  
--DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
-+DNSLIBS =  ../../lib/dns-pkcs11/libdns-pkcs11.@A@ @DNS_CRYPTO_LIBS@
+ DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
++DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
  ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
  ISCCCLIBS =	../../lib/isccc/libisccc.@A@
 -ISCLIBS =	../../lib/isc/libisc.@A@
-+ISCLIBS =  ../../lib/isc-pkcs11/libisc-pkcs11.@A@
- ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@
+-ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@
++ISCLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
++ISCNOSYMLIBS =	../../lib/isc-pkcs11/libisc-pkcs11-nosymtbl.@A@
  LWRESLIBS =	../../lib/lwres/liblwres.@A@
  BIND9LIBS =	../../lib/bind9/libbind9.@A@
  
 -DNSDEPLIBS =	../../lib/dns/libdns.@A@
-+DNSDEPLIBS =   ../../lib/dns-pkcs11/libdns-pkcs11.@A@
++DNSDEPLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@
  ISCCFGDEPLIBS =	../../lib/isccfg/libisccfg.@A@
  ISCCCDEPLIBS =	../../lib/isccc/libisccc.@A@
 -ISCDEPLIBS =	../../lib/isc/libisc.@A@
-+ISCDEPLIBS =   ../../lib/isc-pkcs11/libisc-pkcs11.@A@
++ISCDEPLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
  LWRESDEPLIBS =	../../lib/lwres/liblwres.@A@
  BIND9DEPLIBS =	../../lib/bind9/libbind9.@A@
  
-@@ -71,15 +71,15 @@ DEPLIBS =	${LWRESDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
+@@ -72,15 +73,15 @@ DEPLIBS =	${LWRESDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
  
  LIBS =		${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
  		${ISCCFGLIBS} ${ISCCCLIBS} ${ISCLIBS} \
@@ -198,8 +200,8 @@ index c0861f6..df80f81 100644
 +TARGETS =	named-pkcs11@EXEEXT@ feature-test-pkcs11@EXEEXT@
  
  GEOIPLINKOBJS = geoip.@O@
- 
-@@ -90,8 +90,7 @@ OBJS =		builtin.@O@ client.@O@ config.@O@ control.@O@ \
+ GEOIP2LINKOBJS = geoip.@O@
+@@ -94,8 +95,7 @@ OBJS =		builtin.@O@ client.@O@ config.@O@ control.@O@ \
  		tkeyconf.@O@ tsigconf.@O@ update.@O@ xfrout.@O@ \
  		zoneconf.@O@ \
  		lwaddr.@O@ lwresd.@O@ lwdclient.@O@ lwderror.@O@ lwdgabn.@O@ \
@@ -209,7 +211,7 @@ index c0861f6..df80f81 100644
  
  UOBJS =		unix/os.@O@ unix/dlz_dlopen_driver.@O@
  
-@@ -106,8 +105,7 @@ SRCS =		builtin.c client.c config.c control.c \
+@@ -113,8 +113,7 @@ SRCS =		builtin.c client.c config.c control.c \
  		tkeyconf.c tsigconf.c update.c xfrout.c \
  		zoneconf.c \
  		lwaddr.c lwresd.c lwdclient.c lwderror.c lwdgabn.c \
@@ -219,7 +221,7 @@ index c0861f6..df80f81 100644
  
  MANPAGES =	named.8 lwresd.8 named.conf.5
  
-@@ -146,21 +144,21 @@ server.@O@: server.c
+@@ -154,21 +153,21 @@ server.@O@: server.c
  		-DPRODUCT=\"${PRODUCT}\" \
  		-DVERSION=\"${VERSION}\" -c ${srcdir}/server.c
  
@@ -245,7 +247,7 @@ index c0861f6..df80f81 100644
  	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} \
  		-o $@ feature-test.@O@ ${ISCLIBS} ${LIBS}
  
-@@ -193,16 +191,11 @@ install-man8: named.8 lwresd.8
+@@ -201,16 +200,11 @@ install-man8: named.8 lwresd.8
  
  install-man: install-man5 install-man8
  
@@ -266,12 +268,12 @@ index c0861f6..df80f81 100644
  @DLZ_DRIVER_RULES@
  
 diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
-index c0861f6..04dea99 100644
+index df1f7ee..9660965 100644
 --- a/bin/named/Makefile.in
 +++ b/bin/named/Makefile.in
-@@ -47,7 +47,7 @@ CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
- 		${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} ${ISC_INCLUDES} \
- 		${DLZDRIVER_INCLUDES} ${DBDRIVER_INCLUDES} @DST_OPENSSL_INC@
+@@ -48,7 +48,7 @@ CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
+ 		${DLZDRIVER_INCLUDES} ${DBDRIVER_INCLUDES} ${MAXMINDDB_CFLAGS} \
+ 		@DST_OPENSSL_INC@
  
 -CDEFINES =      @CONTRIB_DLZ@ @USE_PKCS11@ @PKCS11_ENGINE@ @CRYPTO@
 +CDEFINES =      @CONTRIB_DLZ@ @CRYPTO@
@@ -300,10 +302,10 @@ index a058c91..d4b689a 100644
  DEPLIBS =	${ISCDEPLIBS}
  
 diff --git a/configure.ac b/configure.ac
-index d48fd51..79c96f8 100644
+index 3b88105..0532feb 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -1089,12 +1089,14 @@ AC_SUBST(USE_GSSAPI)
+@@ -1139,12 +1139,14 @@ AC_SUBST(USE_GSSAPI)
  AC_SUBST(DST_GSSAPI_INC)
  AC_SUBST(DNS_GSSAPI_LIBS)
  DNS_CRYPTO_LIBS="$DNS_GSSAPI_LIBS $DNS_CRYPTO_LIBS"
@@ -318,10 +320,10 @@ index d48fd51..79c96f8 100644
  
  #
  # was --with-randomdev specified?
-@@ -1479,11 +1481,11 @@ fi
+@@ -1529,11 +1531,11 @@ fi
  AC_MSG_CHECKING(for OpenSSL library)
  OPENSSL_WARNING=
- openssldirs="/usr /usr/local /usr/local/ssl /usr/pkg /usr/sfw"
+ openssldirs="/usr /usr/local /usr/local/ssl /opt/local /usr/pkg /usr/sfw"
 -if test "yes" = "$want_native_pkcs11"
 -then
 -	use_openssl="native_pkcs11"
@@ -335,7 +337,7 @@ index d48fd51..79c96f8 100644
  
  if test "auto" = "$use_openssl"
  then
-@@ -1496,6 +1498,7 @@ then
+@@ -1546,6 +1548,7 @@ then
  		fi
  	done
  fi
@@ -343,7 +345,7 @@ index d48fd51..79c96f8 100644
  OPENSSL_ECDSA=""
  OPENSSL_GOST=""
  OPENSSL_ED25519=""
-@@ -1517,11 +1520,10 @@ case "$with_gost" in
+@@ -1567,11 +1570,10 @@ case "$with_gost" in
  		;;
  esac
  
@@ -358,7 +360,7 @@ index d48fd51..79c96f8 100644
  		CRYPTOLIB="pkcs11"
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
-@@ -1531,7 +1533,9 @@ case "$use_openssl" in
+@@ -1581,7 +1583,9 @@ case "$use_openssl" in
  		OPENSSLGOSTLINKSRCS=""
  		OPENSSLLINKOBJS=""
  		OPENSSLLINKSRCS=""
@@ -369,7 +371,7 @@ index d48fd51..79c96f8 100644
  	no)
  		AC_MSG_RESULT(no)
  		DST_OPENSSL_INC=""
-@@ -1563,7 +1567,7 @@ case "$use_openssl" in
+@@ -1613,7 +1617,7 @@ case "$use_openssl" in
  If you do not want OpenSSL, use --without-openssl])
  		;;
  	*)
@@ -378,7 +380,7 @@ index d48fd51..79c96f8 100644
  		then
  			AC_MSG_RESULT()
  			AC_MSG_ERROR([OpenSSL and native PKCS11 cannot be used together.])
-@@ -1991,6 +1995,7 @@ AC_SUBST(OPENSSL_ED25519)
+@@ -2041,6 +2045,7 @@ AC_SUBST(OPENSSL_ED25519)
  AC_SUBST(OPENSSL_GOST)
  
  DNS_CRYPTO_LIBS="$DNS_CRYPTO_LIBS $DST_OPENSSL_LIBS"
@@ -386,7 +388,7 @@ index d48fd51..79c96f8 100644
  
  ISC_PLATFORM_WANTAES="#undef ISC_PLATFORM_WANTAES"
  if test "yes" = "$with_aes"
-@@ -2314,6 +2319,7 @@ esac
+@@ -2364,6 +2369,7 @@ esac
  AC_SUBST(PKCS11LINKOBJS)
  AC_SUBST(PKCS11LINKSRCS)
  AC_SUBST(CRYPTO)
@@ -394,7 +396,7 @@ index d48fd51..79c96f8 100644
  AC_SUBST(PKCS11_ECDSA)
  AC_SUBST(PKCS11_GOST)
  AC_SUBST(PKCS11_ED25519)
-@@ -5441,8 +5447,11 @@ AC_CONFIG_FILES([
+@@ -5491,8 +5497,11 @@ AC_CONFIG_FILES([
  	bin/delv/Makefile
  	bin/dig/Makefile
  	bin/dnssec/Makefile
@@ -406,7 +408,7 @@ index d48fd51..79c96f8 100644
  	bin/nsupdate/Makefile
  	bin/pkcs11/Makefile
  	bin/python/Makefile
-@@ -5515,6 +5524,10 @@ AC_CONFIG_FILES([
+@@ -5565,6 +5574,10 @@ AC_CONFIG_FILES([
  	lib/dns/include/dns/Makefile
  	lib/dns/include/dst/Makefile
  	lib/dns/tests/Makefile
@@ -417,7 +419,7 @@ index d48fd51..79c96f8 100644
  	lib/irs/Makefile
  	lib/irs/include/Makefile
  	lib/irs/include/irs/Makefile
-@@ -5539,6 +5552,24 @@ AC_CONFIG_FILES([
+@@ -5589,6 +5602,24 @@ AC_CONFIG_FILES([
  	lib/isc/unix/include/Makefile
  	lib/isc/unix/include/isc/Makefile
  	lib/isc/unix/include/pkcs11/Makefile
@@ -456,17 +458,18 @@ index 81270a0..bcb5312 100644
  
  @BIND9_MAKE_RULES@
 diff --git a/lib/dns-pkcs11/Makefile.in b/lib/dns-pkcs11/Makefile.in
-index f6868d1..ea6fd36 100644
+index 7f09bd6..c388d9e 100644
 --- a/lib/dns-pkcs11/Makefile.in
 +++ b/lib/dns-pkcs11/Makefile.in
-@@ -26,16 +26,16 @@ VERSION=@BIND9_VERSION@
+@@ -26,17 +26,16 @@ VERSION=@BIND9_VERSION@
  
  USE_ISC_SPNEGO = @USE_ISC_SPNEGO@
  
 -CINCLUDES =	-I. -I${top_srcdir}/lib/dns -Iinclude ${DNS_INCLUDES} \
--		${ISC_INCLUDES} @DST_OPENSSL_INC@ @DST_GSSAPI_INC@
+-		${ISC_INCLUDES} ${MAXMINDDB_CFLAGS} \
+-		@DST_OPENSSL_INC@ @DST_GSSAPI_INC@
 +CINCLUDES =	-I. -I${top_srcdir}/lib/dns-pkcs11 -Iinclude ${DNS_PKCS11_INCLUDES} \
-+		${ISC_PKCS11_INCLUDES} @DST_OPENSSL_INC@ @DST_GSSAPI_INC@
++		${ISC_PKCS11_INCLUDES} ${MAXMINDDB_CFLAGS} @DST_OPENSSL_INC@ @DST_GSSAPI_INC@
  
 -CDEFINES =	-DUSE_MD5 @CRYPTO@ @USE_GSSAPI@ ${USE_ISC_SPNEGO}
 +CDEFINES =	-DUSE_MD5 @CRYPTO_PK11@ @USE_GSSAPI@ ${USE_ISC_SPNEGO}
@@ -479,9 +482,9 @@ index f6868d1..ea6fd36 100644
 -ISCDEPLIBS =	../../lib/isc/libisc.@A@
 +ISCDEPLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
  
- LIBS =		@LIBS@
+ LIBS =		${MAXMINDDB_LIBS} @LIBS@
  
-@@ -146,15 +146,15 @@ version.@O@: version.c
+@@ -150,15 +149,15 @@ version.@O@: version.c
  		-DLIBAGE=${LIBAGE} \
  		-c ${srcdir}/version.c
  
@@ -501,7 +504,7 @@ index f6868d1..ea6fd36 100644
  
  include: gen
  	${MAKE} include/dns/enumtype.h
-@@ -185,22 +185,22 @@ gen: gen.c
+@@ -189,22 +188,22 @@ gen: gen.c
  	${BUILD_CPPFLAGS} ${BUILD_LDFLAGS} -o $@ ${srcdir}/gen.c \
  	${BUILD_LIBS} ${LFS_LIBS}
  
diff --git a/bind-9.10-sdb.patch b/bind-9.10-sdb.patch
index 485e241..c72906c 100644
--- a/bind-9.10-sdb.patch
+++ b/bind-9.10-sdb.patch
@@ -14,7 +14,7 @@ index ce7a2da..4e6a824 100644
  
  @BIND9_MAKE_RULES@
 diff --git a/bin/named-sdb/Makefile.in b/bin/named-sdb/Makefile.in
-index 04dea99..4ff053e 100644
+index 9660965..184fbb2 100644
 --- a/bin/named-sdb/Makefile.in
 +++ b/bin/named-sdb/Makefile.in
 @@ -30,10 +30,10 @@ VERSION=@BIND9_VERSION@
@@ -31,7 +31,7 @@ index 04dea99..4ff053e 100644
  
  DLZ_DRIVER_DIR =	${top_srcdir}/contrib/dlz/drivers
  
-@@ -79,7 +79,7 @@ NOSYMLIBS =	${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
+@@ -80,7 +80,7 @@ NOSYMLIBS =	${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
  
  SUBDIRS =	unix
  
@@ -39,8 +39,8 @@ index 04dea99..4ff053e 100644
 +TARGETS =	named-sdb@EXEEXT@ feature-test-sdb@EXEEXT@
  
  GEOIPLINKOBJS = geoip.@O@
- 
-@@ -146,7 +146,7 @@ server.@O@: server.c
+ GEOIP2LINKOBJS = geoip.@O@
+@@ -154,7 +154,7 @@ server.@O@: server.c
  		-DPRODUCT=\"${PRODUCT}\" \
  		-DVERSION=\"${VERSION}\" -c ${srcdir}/server.c
  
@@ -49,7 +49,7 @@ index 04dea99..4ff053e 100644
  	export MAKE_SYMTABLE="yes"; \
  	export BASEOBJS="${OBJS} ${UOBJS}"; \
  	${FINALBUILDCMD}
-@@ -160,7 +160,7 @@ feature-test.@O@: ${top_srcdir}/bin/tests/system/feature-test.c
+@@ -168,7 +168,7 @@ feature-test.@O@: ${top_srcdir}/bin/tests/system/feature-test.c
  	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} \
  		-c ${top_srcdir}/bin/tests/system/feature-test.c
  
@@ -58,7 +58,7 @@ index 04dea99..4ff053e 100644
  	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} \
  		-o $@ feature-test.@O@ ${ISCLIBS} ${LIBS}
  
-@@ -182,8 +182,6 @@ statschannel.@O@: bind9.xsl.h
+@@ -190,8 +190,6 @@ statschannel.@O@: bind9.xsl.h
  
  installdirs:
  	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
@@ -67,7 +67,7 @@ index 04dea99..4ff053e 100644
  
  install-man5: named.conf.5
  	${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man5
-@@ -193,16 +191,11 @@ install-man8: named.8 lwresd.8
+@@ -201,16 +199,11 @@ install-man8: named.8 lwresd.8
  
  install-man: install-man5 install-man8
  
@@ -88,7 +88,7 @@ index 04dea99..4ff053e 100644
  @DLZ_DRIVER_RULES@
  
 diff --git a/bin/named-sdb/main.c b/bin/named-sdb/main.c
-index 17f2daa..1bb9d79 100644
+index 108b8d6..a943421 100644
 --- a/bin/named-sdb/main.c
 +++ b/bin/named-sdb/main.c
 @@ -93,6 +93,10 @@
@@ -102,7 +102,7 @@ index 17f2daa..1bb9d79 100644
  
  #ifdef CONTRIB_DLZ
  /*
-@@ -1063,6 +1067,11 @@ setup(void) {
+@@ -1069,6 +1073,11 @@ setup(void) {
  		ns_main_earlyfatal("isc_app_start() failed: %s",
  				   isc_result_totext(result));
  
@@ -114,7 +114,7 @@ index 17f2daa..1bb9d79 100644
  	isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
  		      ISC_LOG_NOTICE, "starting %s %s%s%s <id:%s>",
  		      ns_g_product, ns_g_version,
-@@ -1263,6 +1272,75 @@ setup(void) {
+@@ -1269,6 +1278,75 @@ setup(void) {
  				   isc_result_totext(result));
  #endif
  
@@ -190,7 +190,7 @@ index 17f2daa..1bb9d79 100644
  	ns_server_create(ns_g_mctx, &ns_g_server);
  
  #ifdef HAVE_LIBSECCOMP
-@@ -1305,6 +1383,11 @@ cleanup(void) {
+@@ -1311,6 +1389,11 @@ cleanup(void) {
  
  	dns_name_destroy();
  
@@ -203,22 +203,23 @@ index 17f2daa..1bb9d79 100644
  		      ISC_LOG_NOTICE, "exiting");
  	ns_log_shutdown();
 diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
-index 04dea99..9ed9637 100644
+index 9660965..03f7c05 100644
 --- a/bin/named/Makefile.in
 +++ b/bin/named/Makefile.in
-@@ -45,9 +45,9 @@ DLZDRIVER_LIBS =	@DLZ_DRIVER_LIBS@
+@@ -45,10 +45,10 @@ DLZDRIVER_LIBS =	@DLZ_DRIVER_LIBS@
  CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
  		${LWRES_INCLUDES} ${DNS_INCLUDES} ${BIND9_INCLUDES} \
  		${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} ${ISC_INCLUDES} \
--		${DLZDRIVER_INCLUDES} ${DBDRIVER_INCLUDES} @DST_OPENSSL_INC@
-+		@DST_OPENSSL_INC@
+-		${DLZDRIVER_INCLUDES} ${DBDRIVER_INCLUDES} ${MAXMINDDB_CFLAGS} \
++		${MAXMINDDB_CFLAGS} \
+ 		@DST_OPENSSL_INC@
  
 -CDEFINES =      @CONTRIB_DLZ@ @CRYPTO@
 +CDEFINES =      @CRYPTO@
  
  CWARNINGS =
  
-@@ -71,11 +71,11 @@ DEPLIBS =	${LWRESDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
+@@ -72,11 +72,11 @@ DEPLIBS =	${LWRESDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
  
  LIBS =		${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
  		${ISCCFGLIBS} ${ISCCCLIBS} ${ISCLIBS} \
@@ -232,7 +233,7 @@ index 04dea99..9ed9637 100644
  
  SUBDIRS =	unix
  
-@@ -90,8 +90,7 @@ OBJS =		builtin.@O@ client.@O@ config.@O@ control.@O@ \
+@@ -94,8 +94,7 @@ OBJS =		builtin.@O@ client.@O@ config.@O@ control.@O@ \
  		tkeyconf.@O@ tsigconf.@O@ update.@O@ xfrout.@O@ \
  		zoneconf.@O@ \
  		lwaddr.@O@ lwresd.@O@ lwdclient.@O@ lwderror.@O@ lwdgabn.@O@ \
@@ -242,7 +243,7 @@ index 04dea99..9ed9637 100644
  
  UOBJS =		unix/os.@O@ unix/dlz_dlopen_driver.@O@
  
-@@ -106,8 +105,7 @@ SRCS =		builtin.c client.c config.c control.c \
+@@ -113,8 +112,7 @@ SRCS =		builtin.c client.c config.c control.c \
  		tkeyconf.c tsigconf.c update.c xfrout.c \
  		zoneconf.c \
  		lwaddr.c lwresd.c lwdclient.c lwderror.c lwdgabn.c \
@@ -252,7 +253,7 @@ index 04dea99..9ed9637 100644
  
  MANPAGES =	named.8 lwresd.8 named.conf.5
  
-@@ -204,7 +202,5 @@ uninstall::
+@@ -212,7 +210,5 @@ uninstall::
  	rm -f ${DESTDIR}${sbindir}/lwresd@EXEEXT@
  	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/named@EXEEXT@
  
@@ -296,10 +297,10 @@ index c7e0868..95ab742 100644
 +	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zone2sqlite@EXEEXT@ ${DESTDIR}${sbindir}
  	${INSTALL_DATA} ${srcdir}/zone2ldap.1 ${DESTDIR}${mandir}/man1/zone2ldap.1
 diff --git a/configure.ac b/configure.ac
-index 8374385..0af9b71 100644
+index d8147ae..930cd1c 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -5436,6 +5436,8 @@ AC_CONFIG_FILES([
+@@ -5532,6 +5532,8 @@ AC_CONFIG_FILES([
  	bin/named/unix/Makefile
  	bin/named-pkcs11/Makefile
  	bin/named-pkcs11/unix/Makefile
@@ -308,7 +309,7 @@ index 8374385..0af9b71 100644
  	bin/nsupdate/Makefile
  	bin/pkcs11/Makefile
  	bin/python/Makefile
-@@ -5460,6 +5462,7 @@ AC_CONFIG_FILES([
+@@ -5556,6 +5558,7 @@ AC_CONFIG_FILES([
  	bin/python/isc/tests/dnskey_test.py
  	bin/python/isc/tests/policy_test.py
  	bin/rndc/Makefile
diff --git a/bind-9.11-feature-test-named.patch b/bind-9.11-feature-test-named.patch
index 9758c38..8d5ef9a 100644
--- a/bind-9.11-feature-test-named.patch
+++ b/bind-9.11-feature-test-named.patch
@@ -1,7 +1,7 @@
-From 4293078b294cbb766abe84d3b1618b1cb5413c82 Mon Sep 17 00:00:00 2001
+From d394129acaa40ec7fc68ab27802f0a01fcd50f3d Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Wed, 30 Jan 2019 14:37:17 +0100
-Subject: [PATCH 2/2] Create feature-test in source directory
+Subject: [PATCH] Create feature-test in source directory
 
 Feature-test tool is used in system tests to test compiled in changes.
 Because we build more variants of named with different configuration,
@@ -12,10 +12,10 @@ compile feature-test for each of them this way.
  2 files changed, 11 insertions(+), 2 deletions(-)
 
 diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
-index 1c413973d0..b31df9a718 100644
+index 3166368..df1f7ee 100644
 --- a/bin/named/Makefile.in
 +++ b/bin/named/Makefile.in
-@@ -79,7 +79,7 @@ NOSYMLIBS =	${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
+@@ -80,7 +80,7 @@ NOSYMLIBS =	${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
  
  SUBDIRS =	unix
  
@@ -23,8 +23,8 @@ index 1c413973d0..b31df9a718 100644
 +TARGETS =	named@EXEEXT@ lwresd@EXEEXT@ feature-test@EXEEXT@
  
  GEOIPLINKOBJS = geoip.@O@
- 
-@@ -151,6 +151,15 @@ lwresd@EXEEXT@: named@EXEEXT@
+ GEOIP2LINKOBJS = geoip.@O@
+@@ -163,6 +163,15 @@ lwresd@EXEEXT@: named@EXEEXT@
  	rm -f lwresd@EXEEXT@
  	@LN@ named@EXEEXT@ lwresd@EXEEXT@
  
@@ -41,10 +41,10 @@ index 1c413973d0..b31df9a718 100644
  
  docclean manclean maintainer-clean::
 diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
-index 2236f0a151..b072af8467 100644
+index 65c0c5a..117d6ec 100644
 --- a/bin/tests/system/conf.sh.in
 +++ b/bin/tests/system/conf.sh.in
-@@ -64,7 +64,7 @@ DNSTAPREAD=$TOP/bin/tools/dnstap-read
+@@ -71,7 +71,7 @@ DNSTAPREAD=$TOP/bin/tools/dnstap-read
  MDIG=$TOP/bin/tools/mdig
  NZD2NZF=$TOP/bin/tools/named-nzd2nzf
  FSTRM_CAPTURE=@FSTRM_CAPTURE@
diff --git a/bind-9.11-fips-tests.patch b/bind-9.11-fips-tests.patch
index b33e1bc..920440b 100644
--- a/bind-9.11-fips-tests.patch
+++ b/bind-9.11-fips-tests.patch
@@ -1,4 +1,4 @@
-From 230ca0ddbc95a043933c36c1d182f85cf0dcc971 Mon Sep 17 00:00:00 2001
+From d0e3f8be48c8031ebe3d7e1bf2a32cb03c79484e Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 2 Aug 2018 23:46:45 +0200
 Subject: [PATCH] FIPS tests changes
@@ -946,7 +946,7 @@ index 1e39862..4ed19ac 100755
  cat $infile $keyname1.key $keyname2.key >$zonefile
  
 diff --git a/bin/tests/system/dnssec/ns2/sign.sh b/bin/tests/system/dnssec/ns2/sign.sh
-index b93651a..09b12ba 100644
+index 13fb924..1ffa279 100644
 --- a/bin/tests/system/dnssec/ns2/sign.sh
 +++ b/bin/tests/system/dnssec/ns2/sign.sh
 @@ -126,8 +126,8 @@ zone=in-addr.arpa.
@@ -990,7 +990,7 @@ index ed30460..e6b1126 100644
 +    "." 256 3 8 "AwEAAarwAdjV4gIhpBCjXVAScRFEx3co7k8smJdxrnqoGsl5NB7EZ9jRdgvCXbJn6v8y9jlNWVHvaC8ilhfhLh0A1vLWiWv4ijd/12xcnrY7xpG7Cu3YkxUxaXJ7Jdg/Iw1+9mGgXF1v4UbCIcw/3U3cxyk7OxYg+VSb5KBAQSR0upxV";
  };
 diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh
-index 51dc117..48cb34b 100644
+index d07881d..17ad256 100644
 --- a/bin/tests/system/dnssec/tests.sh
 +++ b/bin/tests/system/dnssec/tests.sh
 @@ -3227,8 +3227,8 @@ do
@@ -1005,7 +1005,7 @@ index 51dc117..48cb34b 100644
  	8) size="-b 512";;
  	10) size="-b 1024";;
 diff --git a/bin/tests/system/feature-test.c b/bin/tests/system/feature-test.c
-index 3ac34e8..428d107 100644
+index 27a02d0..caf4166 100644
 --- a/bin/tests/system/feature-test.c
 +++ b/bin/tests/system/feature-test.c
 @@ -19,6 +19,7 @@
@@ -1016,15 +1016,15 @@ index 3ac34e8..428d107 100644
  #include <dns/edns.h>
  
  #ifdef WIN32
-@@ -45,6 +46,7 @@ usage() {
- 	fprintf(stderr, "	--have-geoip\n");
+@@ -46,6 +47,7 @@ usage() {
+ 	fprintf(stderr, "	--have-geoip2\n");
  	fprintf(stderr, "	--have-libxml2\n");
  	fprintf(stderr, "	--ipv6only=no\n");
 +	fprintf(stderr, "       --md5\n");
  	fprintf(stderr, "	--rpz-nsdname\n");
  	fprintf(stderr, "	--rpz-nsip\n");
  	fprintf(stderr, "	--with-idn\n");
-@@ -137,6 +139,18 @@ main(int argc, char **argv) {
+@@ -146,6 +148,18 @@ main(int argc, char **argv) {
  #endif
  	}
  
diff --git a/bind-9.11-kyua-pkcs11.patch b/bind-9.11-kyua-pkcs11.patch
index caf57bb..ac15d22 100644
--- a/bind-9.11-kyua-pkcs11.patch
+++ b/bind-9.11-kyua-pkcs11.patch
@@ -1,4 +1,4 @@
-From 17998f4feb9590522a0b50943075d9e8c97ec69d Mon Sep 17 00:00:00 2001
+From eb38d2278937ec3fe45d0af30cd080953bbb5b54 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Tue, 2 Jan 2018 18:13:07 +0100
 Subject: [PATCH] Fix pkcs11 variants atf tests
@@ -16,10 +16,10 @@ Add pkcs11 Kyuafile, fix dh_test to pass in pkcs11 mode
  6 files changed, 38 insertions(+), 16 deletions(-)
 
 diff --git a/configure.ac b/configure.ac
-index 7aff0e6..8374385 100644
+index 0532feb..a83ddd5 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -5512,6 +5512,7 @@ AC_CONFIG_FILES([
+@@ -5578,6 +5578,7 @@ AC_CONFIG_FILES([
  	lib/dns-pkcs11/include/Makefile
  	lib/dns-pkcs11/include/dns/Makefile
  	lib/dns-pkcs11/include/dst/Makefile
@@ -43,7 +43,7 @@ index 7c8bab0..eec9564 100644
  include('isccfg/Kyuafile')
  include('lwres/Kyuafile')
 diff --git a/lib/dns-pkcs11/tests/Makefile.in b/lib/dns-pkcs11/tests/Makefile.in
-index 9f1781a..e50463d 100644
+index 7671e1d..e237d5c 100644
 --- a/lib/dns-pkcs11/tests/Makefile.in
 +++ b/lib/dns-pkcs11/tests/Makefile.in
 @@ -17,12 +17,12 @@ VERSION=@BIND9_VERSION@
@@ -55,11 +55,11 @@ index 9f1781a..e50463d 100644
  
 -ISCLIBS =	../../isc/libisc.@A@
 -ISCDEPLIBS =	../../isc/libisc.@A@
--DNSLIBS =	../libdns.@A@ @DNS_CRYPTO_LIBS@
+-DNSLIBS =	../libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
 -DNSDEPLIBS =	../libdns.@A@
 +ISCLIBS =	../../isc-pkcs11/libisc-pkcs11.@A@
 +ISCDEPLIBS =	../../isc-pkcs11/libisc-pkcs11.@A@
-+DNSLIBS =	../libdns-pkcs11.@A@ @DNS_CRYPTO_LIBS@
++DNSLIBS =	../libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
 +DNSDEPLIBS =	../libdns-pkcs11.@A@
  
  LIBS =		@LIBS@ @CMOCKA_LIBS@
diff --git a/bind-9.11-rh1732883.patch b/bind-9.11-rh1732883.patch
index b312e63..80820b5 100644
--- a/bind-9.11-rh1732883.patch
+++ b/bind-9.11-rh1732883.patch
@@ -1,4 +1,4 @@
-From 9ac315c16bf8441145f5b4b8a3308ae9f03582ab Mon Sep 17 00:00:00 2001
+From 348947b3d573e2187db61fb43919d2260dcfc135 Mon Sep 17 00:00:00 2001
 From: Pavel Zhukov <pzhukov@redhat.com>
 Date: Wed, 24 Jul 2019 17:15:55 +0200
 Subject: [PATCH] Detect system time jumps
@@ -8,96 +8,93 @@ address dropped by the kernel due to lifetime expirity. Try to detect
 this situation using either monotonic time or saved timestamp and execute
 go_reboot() procedure to request lease extention
 ---
- lib/isc/include/isc/result.h    |  4 ++--
- lib/isc/include/isc/util.h      |  4 ++++
+ lib/isc/include/isc/result.h    |  3 ++-
+ lib/isc/include/isc/util.h      |  3 +++
  lib/isc/result.c                |  2 ++
- lib/isc/unix/app.c              | 41 +++++++++++++++++++++++++++++++--
- lib/isc/unix/include/isc/time.h | 20 ++++++++++++++++
- lib/isc/unix/time.c             | 22 ++++++++++++++++++
- 6 files changed, 89 insertions(+), 4 deletions(-)
+ lib/isc/unix/app.c              | 39 +++++++++++++++++++++++++++++----
+ lib/isc/unix/include/isc/time.h | 20 +++++++++++++++++
+ lib/isc/unix/time.c             | 22 +++++++++++++++++++
+ 6 files changed, 84 insertions(+), 5 deletions(-)
 
 diff --git a/lib/isc/include/isc/result.h b/lib/isc/include/isc/result.h
-index 246aefb..70d4b64 100644
+index 0fd4971..2add549 100644
 --- a/lib/isc/include/isc/result.h
 +++ b/lib/isc/include/isc/result.h
-@@ -83,9 +83,9 @@
- #define ISC_R_UNSET			61	/*%< unset */
- #define ISC_R_MULTIPLE			62	/*%< multiple */
- #define ISC_R_WOULDBLOCK		63	/*%< would block */
--
-+#define ISC_R_TIMESHIFTED               64      /*%< system time changed */
+@@ -87,9 +87,10 @@
+ #define ISC_R_CRYPTOFAILURE		65	/*%< cryptography library failure */
+ #define ISC_R_DISCQUOTA			66	/*%< disc quota */
+ #define ISC_R_DISCFULL			67	/*%< disc full */
++#define ISC_R_TIMESHIFTED               68      /*%< system time changed */
+ 
  /*% Not a result code: the number of results. */
--#define ISC_R_NRESULTS 			64
-+#define ISC_R_NRESULTS 			65
+-#define ISC_R_NRESULTS 			68
++#define ISC_R_NRESULTS 			69
  
  ISC_LANG_BEGINDECLS
  
 diff --git a/lib/isc/include/isc/util.h b/lib/isc/include/isc/util.h
-index 332dc0c..f81967d 100644
+index 973c348..8160dd3 100644
 --- a/lib/isc/include/isc/util.h
 +++ b/lib/isc/include/isc/util.h
-@@ -233,6 +233,10 @@
+@@ -289,6 +289,9 @@ extern void mock_assert(const int result, const char* const expression,
   * Time
   */
  #define TIME_NOW(tp) 	RUNTIME_CHECK(isc_time_now((tp)) == ISC_R_SUCCESS)
 +#ifdef CLOCK_BOOTTIME
 +#define TIME_MONOTONIC(tp) 	RUNTIME_CHECK(isc_time_boottime((tp)) == ISC_R_SUCCESS)
 +#endif
-+
  
  /*%
-  * Misc
+  * Alignment
 diff --git a/lib/isc/result.c b/lib/isc/result.c
-index a707c32..6776fc6 100644
+index abb6ed2..8c95a93 100644
 --- a/lib/isc/result.c
 +++ b/lib/isc/result.c
-@@ -99,6 +99,7 @@ static const char *description[ISC_R_NRESULTS] = {
- 	"unset",				/*%< 61 */
- 	"multiple",				/*%< 62 */
- 	"would block",				/*%< 63 */
-+        "time changed",                         /*%< 64 */
+@@ -103,6 +103,7 @@ static const char *description[ISC_R_NRESULTS] = {
+ 	"crypto failure",			/*%< 65 */
+ 	"disc quota",				/*%< 66 */
+ 	"disc full",				/*%< 67 */
++        "time changed",                         /*%< 68 */
  };
  
  static const char *identifier[ISC_R_NRESULTS] = {
-@@ -166,6 +167,7 @@ static const char *identifier[ISC_R_NRESULTS] = {
- 	"ISC_R_UNSET",
- 	"ISC_R_MULTIPLE",
- 	"ISC_R_WOULDBLOCK",
+@@ -174,6 +175,7 @@ static const char *identifier[ISC_R_NRESULTS] = {
+ 	"ISC_R_CRYPTOFAILURE",
+ 	"ISC_R_DISCQUOTA",
+ 	"ISC_R_DISCFULL",
 +        "ISC_R_TIMESHIFTED",
  };
  
  #define ISC_RESULT_RESULTSET			2
 diff --git a/lib/isc/unix/app.c b/lib/isc/unix/app.c
-index bace2bd..e9814d2 100644
+index 7e5a0ee..ceab74e 100644
 --- a/lib/isc/unix/app.c
 +++ b/lib/isc/unix/app.c
-@@ -441,15 +441,51 @@ isc__app_ctxonrun(isc_appctx_t *ctx0, isc_mem_t *mctx, isc_task_t *task,
+@@ -442,15 +442,48 @@ isc__app_ctxonrun(isc_appctx_t *ctx0, isc_mem_t *mctx, isc_task_t *task,
  static isc_result_t
  evloop(isc__appctx_t *ctx) {
  	isc_result_t result;
 +        isc_time_t now;
 +#ifdef CLOCK_BOOTTIME
 +        isc_time_t monotonic;
-+        isc_uint64_t diff  = 0;
++        uint64_t diff  = 0;
 +#else
 +        isc_time_t prev;
 +        TIME_NOW(&prev);
 +#endif
 +
-+
 +
  
  	while (!ctx->want_shutdown) {
  		int n;
 -		isc_time_t when, now;
 +		isc_time_t when;
-+                
  		struct timeval tv, *tvp;
  		isc_socketwait_t *swait;
- 		isc_boolean_t readytasks;
- 		isc_boolean_t call_timer_dispatch = ISC_FALSE;
- 
-+                isc_uint64_t us; 
+ 		bool readytasks;
+ 		bool call_timer_dispatch = false;
+-
++                uint64_t us;
 +
 +#ifdef CLOCK_BOOTTIME
 +                // TBD macros for following three lines
@@ -105,7 +102,7 @@ index bace2bd..e9814d2 100644
 +                TIME_MONOTONIC(&monotonic);
 +                INSIST(now.seconds > monotonic.seconds)
 +                us = isc_time_microdiff (&now, &monotonic);
-+                if (us < diff){ 
++                if (us < diff){
 +                  us = diff - us;
 +                  if (us > 1000000){ // ignoring shifts less than one second
 +                    return ISC_R_TIMESHIFTED;
@@ -120,27 +117,24 @@ index bace2bd..e9814d2 100644
 +                if (isc_time_compare (&now, &prev) < 0)
 +                  return ISC_R_TIMESHIFTED;
 +                TIME_NOW(&prev);
-+#endif                
++#endif
  		/*
  		 * Check the reload (or suspend) case first for exiting the
  		 * loop as fast as possible in case:
-@@ -474,9 +510,10 @@ evloop(isc__appctx_t *ctx) {
+@@ -475,8 +508,6 @@ evloop(isc__appctx_t *ctx) {
  			if (result != ISC_R_SUCCESS)
  				tvp = NULL;
  			else {
--				isc_uint64_t us;
-+
- 
+-				uint64_t us;
+-
  				TIME_NOW(&now);
-+
  				us = isc_time_microdiff(&when, &now);
  				if (us == 0)
- 					call_timer_dispatch = ISC_TRUE;
 diff --git a/lib/isc/unix/include/isc/time.h b/lib/isc/unix/include/isc/time.h
-index 75e24b9..de8b399 100644
+index b864c29..5dd43c9 100644
 --- a/lib/isc/unix/include/isc/time.h
 +++ b/lib/isc/unix/include/isc/time.h
-@@ -129,6 +129,26 @@ isc_time_isepoch(const isc_time_t *t);
+@@ -132,6 +132,26 @@ isc_time_isepoch(const isc_time_t *t);
   *\li	't' is a valid pointer.
   */
  
@@ -168,10 +162,10 @@ index 75e24b9..de8b399 100644
  isc_time_now(isc_time_t *t);
  /*%<
 diff --git a/lib/isc/unix/time.c b/lib/isc/unix/time.c
-index 2210240..d7613b8 100644
+index 8edc9df..fe0bb91 100644
 --- a/lib/isc/unix/time.c
 +++ b/lib/isc/unix/time.c
-@@ -496,3 +496,25 @@ isc_time_formatISO8601ms(const isc_time_t *t, char *buf, unsigned int len) {
+@@ -498,3 +498,25 @@ isc_time_formatISO8601ms(const isc_time_t *t, char *buf, unsigned int len) {
  			 t->nanoseconds / NS_PER_MS);
  	}
  }
diff --git a/bind-9.11-rt31459.patch b/bind-9.11-rt31459.patch
index 1eee414..bbb8948 100644
--- a/bind-9.11-rt31459.patch
+++ b/bind-9.11-rt31459.patch
@@ -1,4 +1,4 @@
-From 255fdf0b549ab2f138443ead0ac81bf864612217 Mon Sep 17 00:00:00 2001
+From f0eee3c150b9b913819ecd864581ba50dd4ae9cf Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Tue, 12 Sep 2017 19:05:46 -0700
 Subject: [PATCH] rebased rt31459c
@@ -48,8 +48,8 @@ Include new unit test
  lib/isc/include/isc/types.h              |   2 +
  lib/isc/pk11.c                           |  12 +-
  lib/isc/win32/include/isc/platform.h.in  |   5 +
- win32utils/Configure                     |  29 ++-
- 36 files changed, 703 insertions(+), 175 deletions(-)
+ win32utils/Configure                     |  28 ++-
+ 36 files changed, 702 insertions(+), 175 deletions(-)
  create mode 100644 lib/dns/tests/dstrandom_test.c
 
 diff --git a/bin/confgen/keygen.c b/bin/confgen/keygen.c
@@ -293,7 +293,7 @@ index fbc7ece..31a99e7 100644
  					   usekeyboard);
  
 diff --git a/bin/named/server.c b/bin/named/server.c
-index 0abbbed..405ff71 100644
+index 767d83f..d3c2f9d 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
 @@ -36,6 +36,7 @@
@@ -304,7 +304,7 @@ index 0abbbed..405ff71 100644
  #include <isc/portset.h>
  #include <isc/print.h>
  #include <isc/random.h>
-@@ -8210,6 +8211,10 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8208,6 +8209,10 @@ load_configuration(const char *filename, ns_server_t *server,
  				      "no source of entropy found");
  		} else {
  			const char *randomdev = cfg_obj_asstring(obj);
@@ -315,7 +315,7 @@ index 0abbbed..405ff71 100644
  			int level = ISC_LOG_ERROR;
  			result = isc_entropy_createfilesource(ns_g_entropy,
  							      randomdev);
-@@ -8244,6 +8249,7 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8242,6 +8247,7 @@ load_configuration(const char *filename, ns_server_t *server,
  				}
  				isc_entropy_detach(&ns_g_fallbackentropy);
  			}
@@ -689,7 +689,7 @@ index b27fc1d..e28871b 100644
  	parse_args(false, argc, argv);
  	if (server == NULL)
 diff --git a/configure b/configure
-index b219e16..4da30b9 100755
+index 4a5db6c..64aca10 100755
 --- a/configure
 +++ b/configure
 @@ -640,6 +640,7 @@ ac_includes_default="\
@@ -708,7 +708,7 @@ index b219e16..4da30b9 100755
  PKCS11_TEST
  PKCS11_ED25519
  PKCS11_GOST
-@@ -1038,6 +1040,7 @@ with_eddsa
+@@ -1047,6 +1049,7 @@ with_eddsa
  with_aes
  enable_openssl_hash
  with_cc_alg
@@ -716,7 +716,7 @@ index b219e16..4da30b9 100755
  with_lmdb
  with_libxml2
  with_libjson
-@@ -1734,6 +1737,7 @@ Optional Features:
+@@ -1746,6 +1749,7 @@ Optional Features:
    --enable-threads        enable multithreading
    --enable-native-pkcs11  use native PKCS11 for all crypto [default=no]
    --enable-openssl-hash   use OpenSSL for hash functions [default=no]
@@ -724,7 +724,7 @@ index b219e16..4da30b9 100755
    --enable-largefile      64-bit file support
    --enable-backtrace      log stack backtrace on abort [default=yes]
    --enable-symtable       use internal symbol table for backtrace
-@@ -16686,6 +16690,7 @@ case "$use_openssl" in
+@@ -17156,6 +17160,7 @@ case "$use_openssl" in
  $as_echo "disabled because of native PKCS11" >&6; }
  		DST_OPENSSL_INC=""
  		CRYPTO="-DPKCS11CRYPTO"
@@ -732,7 +732,7 @@ index b219e16..4da30b9 100755
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -16700,6 +16705,7 @@ $as_echo "disabled because of native PKCS11" >&6; }
+@@ -17170,6 +17175,7 @@ $as_echo "disabled because of native PKCS11" >&6; }
  $as_echo "no" >&6; }
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -740,7 +740,7 @@ index b219e16..4da30b9 100755
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -16712,6 +16718,7 @@ $as_echo "no" >&6; }
+@@ -17182,6 +17188,7 @@ $as_echo "no" >&6; }
  	auto)
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -748,7 +748,7 @@ index b219e16..4da30b9 100755
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -16721,7 +16728,7 @@ $as_echo "no" >&6; }
+@@ -17191,7 +17198,7 @@ $as_echo "no" >&6; }
  		OPENSSLLINKOBJS=""
  		OPENSSLLINKSRCS=""
  		as_fn_error $? "OpenSSL was not found in any of $openssldirs; use --with-openssl=/path
@@ -757,7 +757,7 @@ index b219e16..4da30b9 100755
  		;;
  	*)
  		if test "yes" = "$want_native_pkcs11"
-@@ -16752,6 +16759,7 @@ $as_echo "not found" >&6; }
+@@ -17222,6 +17229,7 @@ $as_echo "not found" >&6; }
  			as_fn_error $? "\"$use_openssl/include/openssl/opensslv.h\" not found" "$LINENO" 5
  		fi
  		CRYPTO='-DOPENSSL'
@@ -765,7 +765,7 @@ index b219e16..4da30b9 100755
  		if test "/usr" = "$use_openssl"
  		then
  			DST_OPENSSL_INC=""
-@@ -17413,8 +17421,6 @@ fi
+@@ -17883,8 +17891,6 @@ fi
  # Use OpenSSL for hash functions
  #
  
@@ -774,7 +774,7 @@ index b219e16..4da30b9 100755
  ISC_PLATFORM_OPENSSLHASH="#undef ISC_PLATFORM_OPENSSLHASH"
  case $want_openssl_hash in
  	yes)
-@@ -17789,6 +17795,86 @@ if test "rt" = "$have_clock_gt"; then
+@@ -18259,6 +18265,86 @@ if test "rt" = "$have_clock_gt"; then
  	LIBS="-lrt $LIBS"
  fi
  
@@ -861,7 +861,7 @@ index b219e16..4da30b9 100755
  #
  # was --with-lmdb specified?
  #
-@@ -19871,9 +19957,12 @@ _ACEOF
+@@ -20341,9 +20427,12 @@ _ACEOF
  if ac_fn_c_try_compile "$LINENO"; then :
    { $as_echo "$as_me:${as_lineno-$LINENO}: result: size_t for buflen; int for flags" >&5
  $as_echo "size_t for buflen; int for flags" >&6; }
@@ -876,7 +876,7 @@ index b219e16..4da30b9 100755
  
  	 $as_echo "#define IRS_GETNAMEINFO_FLAGS_T int" >>confdefs.h
  
-@@ -21188,12 +21277,7 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
+@@ -21658,12 +21747,7 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
  ISC_PLATFORM_USESTDASM="#undef ISC_PLATFORM_USESTDASM"
  ISC_PLATFORM_USEMACASM="#undef ISC_PLATFORM_USEMACASM"
  if test "yes" = "$use_atomic"; then
@@ -890,7 +890,7 @@ index b219e16..4da30b9 100755
  # version HP92453-01 B.11.11.23709.GP, which incorrectly rejects
  # declarations like `int a3[[(sizeof (unsigned char)) >= 0]];'.
  # This bug is HP SR number 8606223364.
-@@ -21226,6 +21310,11 @@ cat >>confdefs.h <<_ACEOF
+@@ -21696,6 +21780,11 @@ cat >>confdefs.h <<_ACEOF
  _ACEOF
  
  
@@ -902,7 +902,7 @@ index b219e16..4da30b9 100755
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -21234,39 +21323,6 @@ _ACEOF
+@@ -21704,39 +21793,6 @@ _ACEOF
  		fi
  	;;
  	x86_64-*|amd64-*)
@@ -942,7 +942,7 @@ index b219e16..4da30b9 100755
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -21297,6 +21353,10 @@ $as_echo_n "checking architecture type for atomic operations... " >&6; }
+@@ -21767,6 +21823,10 @@ $as_echo_n "checking architecture type for atomic operations... " >&6; }
  $as_echo "$arch" >&6; }
  fi
  
@@ -953,7 +953,7 @@ index b219e16..4da30b9 100755
  if test "yes" = "$have_atomic"; then
  	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking compiler support for inline assembly code" >&5
  $as_echo_n "checking compiler support for inline assembly code... " >&6; }
-@@ -23896,6 +23956,30 @@ CFLAGS="$CFLAGS $SO_CFLAGS"
+@@ -24372,6 +24432,30 @@ CFLAGS="$CFLAGS $SO_CFLAGS"
  #
  dlzdir='${DLZ_DRIVER_DIR}'
  
@@ -984,7 +984,7 @@ index b219e16..4da30b9 100755
  #
  # Private autoconf macro to simplify configuring drivers:
  #
-@@ -24226,11 +24310,11 @@ $as_echo "no" >&6; }
+@@ -24702,11 +24786,11 @@ $as_echo "no" >&6; }
  $as_echo "using mysql with libs ${mysql_lib} and includes ${mysql_include}" >&6; }
  		;;
  	*)
@@ -999,7 +999,7 @@ index b219e16..4da30b9 100755
  		fi
  
  	CONTRIB_DLZ="$CONTRIB_DLZ -DDLZ_MYSQL"
-@@ -24315,7 +24399,7 @@ $as_echo "" >&6; }
+@@ -24791,7 +24875,7 @@ $as_echo "" >&6; }
  			# Check other locations for includes.
  			# Order is important (sigh).
  
@@ -1008,7 +1008,7 @@ index b219e16..4da30b9 100755
  			# include a blank element first
  			for d in "" $bdb_incdirs
  			do
-@@ -24340,57 +24424,9 @@ $as_echo "" >&6; }
+@@ -24816,57 +24900,9 @@ $as_echo "" >&6; }
  			bdb_libnames="db53 db-5.3 db51 db-5.1 db48 db-4.8 db47 db-4.7 db46 db-4.6 db45 db-4.5 db44 db-4.4 db43 db-4.3 db42 db-4.2 db41 db-4.1 db"
  			for d in $bdb_libnames
  			do
@@ -1068,7 +1068,7 @@ index b219e16..4da30b9 100755
  					break
  				fi
  			done
-@@ -24549,10 +24585,10 @@ $as_echo "no" >&6; }
+@@ -25025,10 +25061,10 @@ $as_echo "no" >&6; }
  		DLZ_DRIVER_INCLUDES="$DLZ_DRIVER_INCLUDES -I$use_dlz_ldap/include"
  		DLZ_DRIVER_LDAP_INCLUDES="-I$use_dlz_ldap/include"
  	fi
@@ -1082,7 +1082,7 @@ index b219e16..4da30b9 100755
  	fi
  
  
-@@ -24638,11 +24674,11 @@ fi
+@@ -25114,11 +25150,11 @@ fi
  		odbcdirs="/usr /usr/local /usr/pkg"
  		for d in $odbcdirs
  		do
@@ -1096,7 +1096,7 @@ index b219e16..4da30b9 100755
  				break
  			fi
  		done
-@@ -24917,6 +24953,8 @@ DNS_CRYPTO_LIBS="$NEWFLAGS"
+@@ -25393,6 +25429,8 @@ DNS_CRYPTO_LIBS="$NEWFLAGS"
  
  
  
@@ -1105,7 +1105,7 @@ index b219e16..4da30b9 100755
  #
  # Commands to run at the end of config.status.
  # Don't just put these into configure, it won't work right if somebody
-@@ -27295,6 +27333,8 @@ report() {
+@@ -27772,6 +27810,8 @@ report() {
  	    echo "    IPv6 support (--enable-ipv6)"
  	test "X$CRYPTO" = "X" -o "yes" = "$want_native_pkcs11" || \
  		echo "    OpenSSL cryptography/DNSSEC (--with-openssl)"
@@ -1114,7 +1114,7 @@ index b219e16..4da30b9 100755
  	test "X$PYTHON" = "X" || echo "    Python tools (--with-python)"
  	test "X$XMLSTATS" = "X" || echo "    XML statistics (--with-libxml2)"
  	test "X$JSONSTATS" = "X" || echo "    JSON statistics (--with-libjson)"
-@@ -27335,6 +27375,8 @@ report() {
+@@ -27812,6 +27852,8 @@ report() {
  	echo "    Very verbose query trace logging (--enable-querytrace)"
      test "no" = "$with_cmocka" || echo "    CMocka Unit Testing Framework (--with-cmocka)"
  
@@ -1123,7 +1123,7 @@ index b219e16..4da30b9 100755
      echo "    Dynamically loadable zone (DLZ) drivers:"
      test "no" = "$use_dlz_bdb" || \
  	echo "        Berkeley DB (--with-dlz-bdb)"
-@@ -27382,6 +27424,8 @@ report() {
+@@ -27859,6 +27901,8 @@ report() {
  	echo "    ECDSA algorithm support (--with-ecdsa)"
      test "X$CRYPTO" = "X" -o "yes" = "$OPENSSL_ED25519" -o "yes" = "$PKCS11_ED25519" || \
  	echo "    EDDSA algorithm support (--with-eddsa)"
@@ -1133,10 +1133,10 @@ index b219e16..4da30b9 100755
      test "yes" = "$enable_seccomp" || \
  	echo "    Use libseccomp system call filtering (--enable-seccomp)"
 diff --git a/configure.ac b/configure.ac
-index 7fd192c..5e4e839 100644
+index 0dc552c..3b88105 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -1514,6 +1514,7 @@ case "$use_openssl" in
+@@ -1572,6 +1572,7 @@ case "$use_openssl" in
  		AC_MSG_RESULT(disabled because of native PKCS11)
  		DST_OPENSSL_INC=""
  		CRYPTO="-DPKCS11CRYPTO"
@@ -1144,7 +1144,7 @@ index 7fd192c..5e4e839 100644
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -1527,6 +1528,7 @@ case "$use_openssl" in
+@@ -1585,6 +1586,7 @@ case "$use_openssl" in
  		AC_MSG_RESULT(no)
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -1152,7 +1152,7 @@ index 7fd192c..5e4e839 100644
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -1539,6 +1541,7 @@ case "$use_openssl" in
+@@ -1597,6 +1599,7 @@ case "$use_openssl" in
  	auto)
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -1160,7 +1160,7 @@ index 7fd192c..5e4e839 100644
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -1549,7 +1552,7 @@ case "$use_openssl" in
+@@ -1607,7 +1610,7 @@ case "$use_openssl" in
  		OPENSSLLINKSRCS=""
  		AC_MSG_ERROR(
  [OpenSSL was not found in any of $openssldirs; use --with-openssl=/path
@@ -1169,7 +1169,7 @@ index 7fd192c..5e4e839 100644
  		;;
  	*)
  		if test "yes" = "$want_native_pkcs11"
-@@ -1579,6 +1582,7 @@ If you don't want OpenSSL, use --without-openssl])
+@@ -1637,6 +1640,7 @@ If you don't want OpenSSL, use --without-openssl])
  			AC_MSG_ERROR(["$use_openssl/include/openssl/opensslv.h" not found])
  		fi
  		CRYPTO='-DOPENSSL'
@@ -1177,7 +1177,7 @@ index 7fd192c..5e4e839 100644
  		if test "/usr" = "$use_openssl"
  		then
  			DST_OPENSSL_INC=""
-@@ -2052,7 +2056,6 @@ fi
+@@ -2110,7 +2114,6 @@ fi
  # Use OpenSSL for hash functions
  #
  
@@ -1185,7 +1185,7 @@ index 7fd192c..5e4e839 100644
  ISC_PLATFORM_OPENSSLHASH="#undef ISC_PLATFORM_OPENSSLHASH"
  case $want_openssl_hash in
  	yes)
-@@ -2324,6 +2327,67 @@ if test "rt" = "$have_clock_gt"; then
+@@ -2382,6 +2385,67 @@ if test "rt" = "$have_clock_gt"; then
  	LIBS="-lrt $LIBS"
  fi
  
@@ -1253,7 +1253,7 @@ index 7fd192c..5e4e839 100644
  #
  # was --with-lmdb specified?
  #
-@@ -4120,12 +4184,12 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
+@@ -4178,12 +4242,12 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
  ISC_PLATFORM_USESTDASM="#undef ISC_PLATFORM_USESTDASM"
  ISC_PLATFORM_USEMACASM="#undef ISC_PLATFORM_USEMACASM"
  if test "yes" = "$use_atomic"; then
@@ -1267,7 +1267,7 @@ index 7fd192c..5e4e839 100644
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -4134,7 +4198,6 @@ if test "yes" = "$use_atomic"; then
+@@ -4192,7 +4256,6 @@ if test "yes" = "$use_atomic"; then
  		fi
  	;;
  	x86_64-*|amd64-*)
@@ -1275,7 +1275,7 @@ index 7fd192c..5e4e839 100644
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -5543,6 +5606,8 @@ report() {
+@@ -5607,6 +5670,8 @@ report() {
  	    echo "    IPv6 support (--enable-ipv6)"
  	test "X$CRYPTO" = "X" -o "yes" = "$want_native_pkcs11" || \
  		echo "    OpenSSL cryptography/DNSSEC (--with-openssl)"
@@ -1284,7 +1284,7 @@ index 7fd192c..5e4e839 100644
  	test "X$PYTHON" = "X" || echo "    Python tools (--with-python)"
  	test "X$XMLSTATS" = "X" || echo "    XML statistics (--with-libxml2)"
  	test "X$JSONSTATS" = "X" || echo "    JSON statistics (--with-libjson)"
-@@ -5583,6 +5648,8 @@ report() {
+@@ -5647,6 +5712,8 @@ report() {
  	echo "    Very verbose query trace logging (--enable-querytrace)"
      test "no" = "$with_cmocka" || echo "    CMocka Unit Testing Framework (--with-cmocka)"
  
@@ -1293,7 +1293,7 @@ index 7fd192c..5e4e839 100644
      echo "    Dynamically loadable zone (DLZ) drivers:"
      test "no" = "$use_dlz_bdb" || \
  	echo "        Berkeley DB (--with-dlz-bdb)"
-@@ -5630,6 +5697,8 @@ report() {
+@@ -5694,6 +5761,8 @@ report() {
  	echo "    ECDSA algorithm support (--with-ecdsa)"
      test "X$CRYPTO" = "X" -o "yes" = "$OPENSSL_ED25519" -o "yes" = "$PKCS11_ED25519" || \
  	echo "    EDDSA algorithm support (--with-eddsa)"
@@ -1693,7 +1693,7 @@ index 937b548..f3c0e38 100644
  tap_test_program{name='gost_test'}
  tap_test_program{name='keytable_test'}
 diff --git a/lib/dns/tests/Makefile.in b/lib/dns/tests/Makefile.in
-index 0897579..9f1781a 100644
+index 90dc3a6..7671e1d 100644
 --- a/lib/dns/tests/Makefile.in
 +++ b/lib/dns/tests/Makefile.in
 @@ -37,6 +37,7 @@ SRCS =		acl_test.c \
@@ -2016,10 +2016,10 @@ index 5b8a2c9..913a2ce 100644
   * Define if the hash functions must be provided by OpenSSL.
   */
 diff --git a/win32utils/Configure b/win32utils/Configure
-index 27b00af..7e35d60 100644
+index 93939f3..8bacf54 100644
 --- a/win32utils/Configure
 +++ b/win32utils/Configure
-@@ -380,6 +380,7 @@ my @substdefh = ("AES_CC",
+@@ -381,6 +381,7 @@ my @substdefh = ("AES_CC",
  my %configdefp;
  
  my @substdefp = ("ISC_PLATFORM_BUSYWAITNOP",
@@ -2027,7 +2027,7 @@ index 27b00af..7e35d60 100644
                   "ISC_PLATFORM_HAVEATOMICSTORE",
                   "ISC_PLATFORM_HAVEATOMICSTOREQ",
                   "ISC_PLATFORM_HAVECMPXCHG",
-@@ -509,7 +510,8 @@ my @allcond = (@substcond, "NOTYET", "NOLONGER");
+@@ -511,7 +512,8 @@ my @allcond = (@substcond, "NOTYET", "NOLONGER");
  
  # enable-xxx/disable-xxx
  
@@ -2037,7 +2037,7 @@ index 27b00af..7e35d60 100644
                    "fixed-rrset",
                    "intrinsics",
                    "isc-spnego",
-@@ -572,6 +574,7 @@ my @help = (
+@@ -575,6 +577,7 @@ my @help = (
  "\nOptional Features:\n",
  "  enable-intrinsics     enable instrinsic/atomic functions [default=yes]\n",
  "  enable-native-pkcs11  use native PKCS#11 for all crypto [default=no]\n",
@@ -2045,7 +2045,7 @@ index 27b00af..7e35d60 100644
  "  enable-openssl-hash   use OpenSSL for hash functions [default=yes]\n",
  "  enable-isc-spnego     use SPNEGO from lib/dns [default=yes]\n",
  "  enable-filter-aaaa    enable filtering of AAAA records [default=yes]\n",
-@@ -616,7 +619,9 @@ my $want_clean = "no";
+@@ -620,7 +623,9 @@ my $want_clean = "no";
  my $want_unknown = "no";
  my $unknown_value;
  my $enable_intrinsics = "yes";
@@ -2055,7 +2055,7 @@ index 27b00af..7e35d60 100644
  my $enable_openssl_hash = "auto";
  my $enable_filter_aaaa = "yes";
  my $enable_isc_spnego = "yes";
-@@ -834,6 +839,10 @@ sub myenable {
+@@ -840,6 +845,10 @@ sub myenable {
          if ($val =~ /^yes$/i) {
              $enable_native_pkcs11 = "yes";
          }
@@ -2066,7 +2066,7 @@ index 27b00af..7e35d60 100644
      } elsif ($key =~ /^openssl-hash$/i) {
          if ($val =~ /^yes$/i) {
              $enable_openssl_hash = "yes";
-@@ -1125,6 +1134,11 @@ if ($verbose) {
+@@ -1142,6 +1151,11 @@ if ($verbose) {
      } else {
          print "native-pkcs11: disabled\n";
      }
@@ -2078,7 +2078,7 @@ index 27b00af..7e35d60 100644
      if ($enable_openssl_hash eq "yes") {
          print "openssl-hash: enabled\n";
      } else {
-@@ -1478,6 +1492,7 @@ if ($enable_intrinsics eq "yes") {
+@@ -1500,6 +1514,7 @@ if ($enable_intrinsics eq "yes") {
  
  # enable-native-pkcs11
  if ($enable_native_pkcs11 eq "yes") {
@@ -2086,7 +2086,7 @@ index 27b00af..7e35d60 100644
      if ($use_openssl eq "auto") {
          $use_openssl = "no";
      }
-@@ -1687,6 +1702,7 @@ if ($use_openssl eq "yes") {
+@@ -1709,6 +1724,7 @@ if ($use_openssl eq "yes") {
          $openssl_dll = File::Spec->catdir($openssl_path, "@dirlist[0]");
      }   
  
@@ -2094,7 +2094,7 @@ index 27b00af..7e35d60 100644
      $configcond{"OPENSSL"} = 1;
      $configdefd{"CRYPTO"} = "OPENSSL";
      $configvar{"OPENSSL_PATH"} = "$openssl_path";
-@@ -2238,6 +2254,15 @@ if ($cookie_algorithm eq "sha1") {
+@@ -2260,6 +2276,15 @@ if ($cookie_algorithm eq "sha1") {
      die "Unrecognized cookie algorithm: $cookie_algorithm\n";
  }
  
@@ -2110,7 +2110,7 @@ index 27b00af..7e35d60 100644
  # enable-openssl-hash
  if ($enable_openssl_hash eq "yes") {
      if ($use_openssl eq "no") {
-@@ -3564,6 +3589,7 @@ exit 0;
+@@ -3635,6 +3660,7 @@ exit 0;
  #  --enable-developer partially supported
  #  --enable-newstats (9.9/9.9sub only)
  #  --enable-native-pkcs11 supported
@@ -2118,14 +2118,6 @@ index 27b00af..7e35d60 100644
  #  --enable-openssl-version-check included without a way to disable it
  #  --enable-openssl-hash supported
  #  --enable-threads included without a way to disable it
-@@ -3589,6 +3615,7 @@ exit 0;
- #  --with-gost supported
- #  --with-aes supported
- #  --with-cc-alg supported
-+#  --with-randomdev not supported on WIN32 (makes no sense)
- #  --with-geoip supported
- #  --with-gssapi supported with MIT (K)erberos (f)or (W)indows
- #  --with-lmdb no supported on WIN32 (port is not reliable)
 -- 
 2.20.1
 

From ed5314b647c999725f00da26ba5c57885076d364 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 24 Jul 2019 19:20:21 +0200
Subject: [PATCH 09/55] Solve conflicting jsoncpp-devel and json-c-devel

---
 bind-9.11-json-c.patch | 50 ++++++++++++++++++++++++++++++++++++++++++
 bind.spec              |  3 +++
 2 files changed, 53 insertions(+)
 create mode 100644 bind-9.11-json-c.patch

diff --git a/bind-9.11-json-c.patch b/bind-9.11-json-c.patch
new file mode 100644
index 0000000..95e5597
--- /dev/null
+++ b/bind-9.11-json-c.patch
@@ -0,0 +1,50 @@
+From cb6d2019766a6c8c5516fd8859cedf0052f03293 Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Thu, 25 Jul 2019 11:37:57 +0200
+Subject: [PATCH] Skip support of jsoncpp
+
+Bind cannot be compiled when jsoncpp-devel is installed. Remove support
+for jsoncpp, use only json-c-devel. Bind 9.15 has already support for
+--with-json-c, do not yet introduce it.
+---
+ configure.ac | 17 ++---------------
+ 1 file changed, 2 insertions(+), 15 deletions(-)
+
+diff --git a/configure.ac b/configure.ac
+index 6d05337..5ce83b5 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -2594,15 +2594,7 @@ case "$use_libjson" in
+ 	auto|yes)
+ 		for d in /usr /usr/local /opt/local
+ 		do
+-			if test -f "${d}/include/json/json.h"
+-			then
+-				if test ${d} != /usr
+-				then
+-					libjson_cflags="-I ${d}/include"
+-					LIBS="$LIBS -L${d}/lib"
+-				fi
+-				have_libjson="yes"
+-			elif test -f "${d}/include/json-c/json.h"
++			if test -f "${d}/include/json-c/json.h"
+ 			then
+ 				if test ${d} != /usr
+ 				then
+@@ -2615,12 +2607,7 @@ case "$use_libjson" in
+ 		done
+ 		;;
+ 	*)
+-		if test -f "${use_libjson}/include/json/json.h"
+-		then
+-			libjson_cflags="-I${use_libjson}/include"
+-			LIBS="$LIBS -L${use_libjson}/lib"
+-			have_libjson="yes"
+-		elif test -f "${use_libjson}/include/json-c/json.h"
++		if test -f "${use_libjson}/include/json-c/json.h"
+ 		then
+ 			libjson_cflags="-I${use_libjson}/include"
+ 			LIBS="$LIBS -L${use_libjson}/lib"
+-- 
+2.20.1
+
diff --git a/bind.spec b/bind.spec
index 1819d65..0bfa7a3 100644
--- a/bind.spec
+++ b/bind.spec
@@ -139,6 +139,8 @@ Patch170:bind-9.11-feature-test-named.patch
 Patch171:bind-9.11-tests-variants.patch
 Patch172:bind-9.11-tests-pkcs11.patch
 Patch173:bind-9.11-rh1732883.patch
+# Make sure jsonccp-devel does not interfere
+Patch174:bind-9.11-json-c.patch
 
 # SDB patches
 Patch11: bind-9.3.2b2-sdbsrc.patch
@@ -519,6 +521,7 @@ are used for building ISC DHCP.
 %patch171 -p1 -b .test-variant
 %patch172 -p1 -b .test-pkcs11
 %patch173 -p1 -b .rh1732883
+%patch174 -p1 -b .json-c
 
 mkdir lib/dns/tests/testdata/dstrandom
 cp -a %{SOURCE50} lib/dns/tests/testdata/dstrandom/random.data

From b40bc8c8c4afeb07bdcac899fcb9d2cb2e59fb51 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 8 Aug 2019 13:51:16 +0200
Subject: [PATCH 10/55] Permit explicit disabling of RSAMD5 in FIPS mode
 (#1709553)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When MD5 is disabled in library, it behaved like RSAMD5 were unknown.
But security-policy disables it explicitly. It failed to even start in
FIPS mode, because such algorithm were unknown. Fix disabled algorithm
to return disabled result code. Accept such algorithm only when
disabling it.

Signed-off-by: Petr Menšík <pemensik@redhat.com>
---
 bind-9.11-fips-disable.patch | 97 ++++++++++++++++++++++++++++++++++++
 bind.spec                    |  7 ++-
 2 files changed, 103 insertions(+), 1 deletion(-)
 create mode 100644 bind-9.11-fips-disable.patch

diff --git a/bind-9.11-fips-disable.patch b/bind-9.11-fips-disable.patch
new file mode 100644
index 0000000..525316a
--- /dev/null
+++ b/bind-9.11-fips-disable.patch
@@ -0,0 +1,97 @@
+From df23c869f8973bc9494dcdc86ef46070d8194897 Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Mon, 5 Aug 2019 11:54:03 +0200
+Subject: [PATCH] Allow explicit disabling of autodisabled MD5
+
+Default security policy might include explicitly disabled RSAMD5
+algorithm. Current FIPS code automatically disables in FIPS mode. But if
+RSAMD5 is included in security policy, it fails to start, because that
+algorithm is not recognized. Allow it disabled, but fail on any
+other usage.
+---
+ bin/named/server.c |  2 +-
+ lib/dns/rcode.c    | 31 +++++++++++++------------------
+ 2 files changed, 14 insertions(+), 19 deletions(-)
+
+diff --git a/bin/named/server.c b/bin/named/server.c
+index 3cd49a9..ef82d89 100644
+--- a/bin/named/server.c
++++ b/bin/named/server.c
+@@ -1551,7 +1551,7 @@ disable_algorithms(const cfg_obj_t *disabled, dns_resolver_t *resolver) {
+ 			result = isc_parse_uint8(&ui, r.base, 10);
+ 			alg = ui;
+ 		}
+-		if (result != ISC_R_SUCCESS) {
++		if (result != ISC_R_SUCCESS && result != ISC_R_DISABLED) {
+ 			cfg_obj_log(cfg_listelt_value(element),
+ 				    ns_g_lctx, ISC_LOG_ERROR,
+ 				    "invalid algorithm");
+diff --git a/lib/dns/rcode.c b/lib/dns/rcode.c
+index f51d548..8dbb12d 100644
+--- a/lib/dns/rcode.c
++++ b/lib/dns/rcode.c
+@@ -126,7 +126,6 @@
+ #endif
+ 
+ #define SECALGNAMES \
+-	MD5_SECALGNAMES \
+ 	DH_SECALGNAMES \
+ 	DSA_SECALGNAMES \
+ 	{ DNS_KEYALG_ECC, "ECC", 0 }, \
+@@ -178,6 +177,7 @@ static struct tbl rcodes[] = { RCODENAMES ERCODENAMES };
+ static struct tbl tsigrcodes[] = { RCODENAMES TSIGRCODENAMES };
+ static struct tbl certs[] = { CERTNAMES };
+ static struct tbl secalgs[] = { SECALGNAMES };
++static struct tbl md5_secalgs[] = { MD5_SECALGNAMES };
+ static struct tbl secprotos[] = { SECPROTONAMES };
+ static struct tbl hashalgs[] = { HASHALGNAMES };
+ static struct tbl dsdigests[] = { DSDIGESTNAMES };
+@@ -358,33 +358,28 @@ dns_cert_totext(dns_cert_t cert, isc_buffer_t *target) {
+ 	return (dns_mnemonic_totext(cert, target, certs));
+ }
+ 
+-static inline struct tbl *
+-secalgs_tbl_start() {
+-	struct tbl *algs = secalgs;
+-
+-#ifndef PK11_MD5_DISABLE
+-	if (!isc_md5_available()) {
+-		while (algs->name != NULL &&
+-		       algs->value == DNS_KEYALG_RSAMD5)
+-			++algs;
+-	}
+-#endif
+-	return algs;
+-}
+-
+ isc_result_t
+ dns_secalg_fromtext(dns_secalg_t *secalgp, isc_textregion_t *source) {
+ 	unsigned int value;
++	isc_result_t result;
+ 
+-	RETERR(dns_mnemonic_fromtext(&value, source,
+-	                             secalgs_tbl_start(), 0xff));
++	result = dns_mnemonic_fromtext(&value, source,
++	                             secalgs, 0xff);
++	if (result != ISC_R_SUCCESS) {
++		result = dns_mnemonic_fromtext(&value, source,
++		                               md5_secalgs, 0xff);
++		if (result != ISC_R_SUCCESS) {
++			return (result);
++		} else if (!isc_md5_available())
++			return (ISC_R_DISABLED);
++	}
+ 	*secalgp = value;
+ 	return (ISC_R_SUCCESS);
+ }
+ 
+ isc_result_t
+ dns_secalg_totext(dns_secalg_t secalg, isc_buffer_t *target) {
+-	return (dns_mnemonic_totext(secalg, target, secalgs_tbl_start()));
++	return (dns_mnemonic_totext(secalg, target, secalgs));
+ }
+ 
+ void
+-- 
+2.20.1
+
diff --git a/bind.spec b/bind.spec
index 0bfa7a3..0151e05 100644
--- a/bind.spec
+++ b/bind.spec
@@ -53,7 +53,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.11.9
-Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -141,6 +141,7 @@ Patch172:bind-9.11-tests-pkcs11.patch
 Patch173:bind-9.11-rh1732883.patch
 # Make sure jsonccp-devel does not interfere
 Patch174:bind-9.11-json-c.patch
+Patch175:bind-9.11-fips-disable.patch
 
 # SDB patches
 Patch11: bind-9.3.2b2-sdbsrc.patch
@@ -522,6 +523,7 @@ are used for building ISC DHCP.
 %patch172 -p1 -b .test-pkcs11
 %patch173 -p1 -b .rh1732883
 %patch174 -p1 -b .json-c
+%patch175 -p1 -b .rh1709553
 
 mkdir lib/dns/tests/testdata/dstrandom
 cp -a %{SOURCE50} lib/dns/tests/testdata/dstrandom/random.data
@@ -1516,6 +1518,9 @@ fi;
 
 
 %changelog
+* Thu Aug 08 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.9-2
+- Permit explicit disabling of RSAMD5 in FIPS mode (#1709553)
+
 * Wed Jul 24 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.9-1
 - Update to 9.11.9
 

From ff25a45a41c1232ded2139d7895b54729e240762 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 8 Aug 2019 15:06:43 +0200
Subject: [PATCH 11/55] Fix rpmlint warnings

Clean whitespace to satisfy rpmlint
---
 bind.spec | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/bind.spec b/bind.spec
index 0151e05..4ce8b43 100644
--- a/bind.spec
+++ b/bind.spec
@@ -165,7 +165,7 @@ Obsoletes:      caching-nameserver < 31:9.4.1-7.fc8
 Provides:       caching-nameserver = 31:9.4.1-7.fc8
 Obsoletes:      dnssec-conf < 1.27-2
 Provides:       dnssec-conf = 1.27-2
-# This wild require should satisfy %selinux_set_boolean macro only
+# This wild require should satisfy %%selinux_set_boolean macro only
 # in case it needs to be used
 Requires(post): ((policycoreutils-python-utils and libselinux-utils) if (selinux-policy-targeted or selinux-policy-mls))
 Requires(post): ((selinux-policy and selinux-policy-base) if (selinux-policy-targeted or selinux-policy-mls))
@@ -775,12 +775,12 @@ popd
 # Test just compiled libraries
 for lib in %{bind_export_libs}
 do
-	sed -e "s,^\s*include(.*${lib}/.*,-- use &," \
-        	-i export-libs/lib/Kyuafile
+  sed -e "s,^\s*include(.*${lib}/.*,-- use &," \
+      -i export-libs/lib/Kyuafile
 done
 
 sed -e "/^\s*include(/ d" -e 's/^-- use //' \
-       	-i export-libs/lib/Kyuafile
+    -i export-libs/lib/Kyuafile
 
 ## End of export libs
 %endif

From 4378f987b491a2b360af7638534a7f482d6646d2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 9 Aug 2019 12:32:48 +0200
Subject: [PATCH 12/55] Report errors from rndc reload (#1739441)

Success status has to be ignored until systemd is fixed. Now it would
kill service on reload failure, which is far worse than reload error.
---
 named-chroot.service     | 3 ++-
 named-pkcs11.service     | 3 ++-
 named-sdb-chroot.service | 3 ++-
 named-sdb.service        | 3 ++-
 named.service            | 4 ++--
 5 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/named-chroot.service b/named-chroot.service
index 5732b1c..ed9aa51 100644
--- a/named-chroot.service
+++ b/named-chroot.service
@@ -20,7 +20,8 @@ PIDFile=/var/named/chroot/run/named/named.pid
 ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf -t /var/named/chroot -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
 ExecStart=/usr/sbin/named -u named -c ${NAMEDCONF} -t /var/named/chroot $OPTIONS
 
-ExecReload=/bin/sh -c '/usr/sbin/rndc reload > /dev/null 2>&1 || /bin/kill -HUP $MAINPID'
+; until https://github.com/systemd/systemd/pull/13098 is present, ignore return value
+ExecReload=-/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
 
 ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'
 
diff --git a/named-pkcs11.service b/named-pkcs11.service
index c1a19d1..f0e8913 100644
--- a/named-pkcs11.service
+++ b/named-pkcs11.service
@@ -16,7 +16,8 @@ PIDFile=/run/named/named.pid
 ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
 ExecStart=/usr/sbin/named-pkcs11 -u named -c ${NAMEDCONF} $OPTIONS
 
-ExecReload=/bin/sh -c '/usr/sbin/rndc reload > /dev/null 2>&1 || /bin/kill -HUP $MAINPID'
+; until https://github.com/systemd/systemd/pull/13098 is present, ignore return value
+ExecReload=-/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
 
 ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'
 
diff --git a/named-sdb-chroot.service b/named-sdb-chroot.service
index 5294f47..16a080f 100644
--- a/named-sdb-chroot.service
+++ b/named-sdb-chroot.service
@@ -20,7 +20,8 @@ PIDFile=/var/named/chroot_sdb/run/named/named.pid
 ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf -t /var/named/chroot_sdb -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
 ExecStart=/usr/sbin/named-sdb -u named -c ${NAMEDCONF} -t /var/named/chroot_sdb $OPTIONS
 
-ExecReload=/bin/sh -c '/usr/sbin/rndc reload > /dev/null 2>&1 || /bin/kill -HUP $MAINPID'
+; until https://github.com/systemd/systemd/pull/13098 is present, ignore return value
+ExecReload=-/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
 
 ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'
 
diff --git a/named-sdb.service b/named-sdb.service
index b80ec17..d3ef6e5 100644
--- a/named-sdb.service
+++ b/named-sdb.service
@@ -16,7 +16,8 @@ PIDFile=/run/named/named.pid
 ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
 ExecStart=/usr/sbin/named-sdb -u named -c ${NAMEDCONF} $OPTIONS
 
-ExecReload=/bin/sh -c '/usr/sbin/rndc reload > /dev/null 2>&1 || /bin/kill -HUP $MAINPID'
+; until https://github.com/systemd/systemd/pull/13098 is present, ignore return value
+ExecReload=-/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
 
 ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'
 
diff --git a/named.service b/named.service
index 6a162ad..86737ea 100644
--- a/named.service
+++ b/named.service
@@ -15,8 +15,8 @@ PIDFile=/run/named/named.pid
 
 ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
 ExecStart=/usr/sbin/named -u named -c ${NAMEDCONF} $OPTIONS
-
-ExecReload=/bin/sh -c '/usr/sbin/rndc reload > /dev/null 2>&1 || /bin/kill -HUP $MAINPID'
+; until https://github.com/systemd/systemd/pull/13098 is present, ignore return value
+ExecReload=-/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
 
 ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'
 

From a815d5ceb5da290628bb384f777c291b706b4784 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 9 Aug 2019 12:39:58 +0200
Subject: [PATCH 13/55] Add changelog and bump spec

---
 bind.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index 4ce8b43..6393021 100644
--- a/bind.spec
+++ b/bind.spec
@@ -53,7 +53,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.11.9
-Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  3%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1518,6 +1518,9 @@ fi;
 
 
 %changelog
+* Fri Aug 09 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.9-3
+- Display errors from rndc reload (#1739441)
+
 * Thu Aug 08 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.9-2
 - Permit explicit disabling of RSAMD5 in FIPS mode (#1709553)
 

From aca3c550fd3f1e29feb4f5e85baa0e0a358905bb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 27 Aug 2019 10:07:09 +0200
Subject: [PATCH 14/55] Update to BIND 9.11.10

---
 .gitignore              |  1 +
 bind-9.11.10.tar.gz.asc | 16 ++++++++++++++++
 bind-9.11.9.tar.gz.asc  | 16 ----------------
 bind.spec               |  9 ++++++---
 sources                 |  2 +-
 5 files changed, 24 insertions(+), 20 deletions(-)
 create mode 100644 bind-9.11.10.tar.gz.asc
 delete mode 100644 bind-9.11.9.tar.gz.asc

diff --git a/.gitignore b/.gitignore
index 08ffa36..b64b4e5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -94,3 +94,4 @@ bind-9.7.2b1.tar.gz
 /bind-9.11.6-P1.tar.gz
 /bind-9.11.8.tar.gz
 /bind-9.11.9.tar.gz
+/bind-9.11.10.tar.gz
diff --git a/bind-9.11.10.tar.gz.asc b/bind-9.11.10.tar.gz.asc
new file mode 100644
index 0000000..8ea66c9
--- /dev/null
+++ b/bind-9.11.10.tar.gz.asc
@@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABAgAdFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAl1VKuIACgkQdLtrmky7
+PThvHg/+O+c3U/k/3wYB5XAmT2HSCIqIp8gdu4+0B4rsIJAN+aR1HDIsCTuJqyjw
+jw9fI61d5skxeJljbNChAMTC2Ps1W7bXHFC8B25WQvQAcL/FDJQrLtgRXCJKB9sd
+/hss07hGrrZbE5wRePJJtn4R1d6WLoA/hz1da7IcoZJpFPmlkHE9kZUd9mPAHnMv
+QYCqpl821m53UMENufyrwNMDTaIwqPM4fJ8OVBam/743ZIOP/imwMVnJws6HjRz1
+n4JPoKsMkLOTV0hDotgTl7V1qm4EXKG5xPM882frpfRkk/V/qOvEzLkgVLDF6xHR
+iuZsMvKfrc/VyrKRcQNHs2kA0EqbKfskLoSenj7B/WrvVCeQ+MA4MSg/81Rzzs6P
+gDDCMcWY3X2VlYUA521Z9DagoC49DpfKf+rfeCH/HTNjdWkfClnQoGb9n5Ggy/sM
+NP/ApLN2TOHqMIMU0RGr2U3OY8TNmpq7xfggnr3qL5Of1ez4HYlyLdmma3HPJjvY
+uYdJwVRcJ7rq510QBSf8VGK9/qERkhklh4MZvIzS5htnn+94Gk3gT8p3aZGQ5z2d
+W2RVl+4HQ7aRtQMeQeX79uccVF9vcTBTiAJhILYcp7Q6NBOVMTCabSAnRk3f0GfS
+1x+Ojt+7yVCB3pym8N+mHM3q8l7VvIw1As7QAGi6mdVAaTN8zxc=
+=ZIsR
+-----END PGP SIGNATURE-----
diff --git a/bind-9.11.9.tar.gz.asc b/bind-9.11.9.tar.gz.asc
deleted file mode 100644
index 9e9ad71..0000000
--- a/bind-9.11.9.tar.gz.asc
+++ /dev/null
@@ -1,16 +0,0 @@
------BEGIN PGP SIGNATURE-----
-
-iQIzBAABAgAdFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAl0u4wIACgkQdLtrmky7
-PTgO+A/8DtA5xbbJZx6ifx/AXS+0TBwnyRt1qkDplCRMq4/G+/r9iHh2Z3JYiznV
-NKHkV7JV+d4p9pygOo0s563DsFTg3A6OtzhU7n8QxFS4e3T6S+vKBX1s0Iixu/hN
-q9pxhhefeGejVUjhKqAHbNvoCO2stMAgZi02qhqECJPvu8YtyOPEPNW/K+2aWLH3
-P3gNwIbj1+NjNBWAAhiSEK+px7do4499AxGOZcCPUUmhEAWckcQ1wyC94tDC3uQi
-XY3asr6Ph7WWXkM0qnUDx9+ZPKKDOMevX11W+5cNw1qioss8dWcs3l7mhUuRITVx
-u/yaQYt7F9BY5XjtbaBtTWBDRbpCrrt2YpMhNJ/aedSbCoRT/ZYiDqNwKCEes10s
-hJK4LG4pCtVWQnwi4xFeCxI+NJK5b5gRj5NZ/cwKqGMnEmO0hg3aiDtEUF424t1i
-IdJvDs+NaMjHqitpvc8hlJpTpiefCuGTYjrrJLjnAsA3r72z4aLb8M6ivBNmpEiJ
-x5LFyBZusHzuCSfFV23tBZvZ1VQf53Netz0PXbOCdnKKYlibUGzD3pC8LdoMoj5m
-/s4BYes5ET4xA867yZg7y/A0x0Ezuw+7NLXhpMSAQh/OZwWQ1CzspvYUxl8hHx67
-r1aH0dkAtN8BtaR5lTrXtFfRTJvEqNQ9lFQwljwEJqfwFN4dJBc=
-=m4su
------END PGP SIGNATURE-----
diff --git a/bind.spec b/bind.spec
index 6393021..b60b2a8 100644
--- a/bind.spec
+++ b/bind.spec
@@ -44,7 +44,7 @@
 #
 
 # lib*.so.X versions of selected libraries
-%global sover_dns 1106
+%global sover_dns 1107
 %global sover_isc 1100
 %global sover_irs 161
 %global sover_isccfg 163
@@ -52,8 +52,8 @@
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.11.9
-Release:  3%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Version:  9.11.10
+Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1518,6 +1518,9 @@ fi;
 
 
 %changelog
+* Tue Aug 27 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.10-1
+- Update to 9.11.10
+
 * Fri Aug 09 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.9-3
 - Display errors from rndc reload (#1739441)
 
diff --git a/sources b/sources
index 78dba7f..c992ba3 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.11.9.tar.gz) = 4fa975b83986480a12138a3cf7ccf3bcd2251d194e0c04e3fad0787fc8b2a5dee241179fbb25b0283fa6fcb749d7a15fad036039dbc81250defcba0108823ef8
+SHA512 (bind-9.11.10.tar.gz) = b560cd6b88df0ffe0008d0559b49c28fbe4ed49da1a81e61c373faa5368ad1570c4cf945d224b451634f7506e52d9effb9aee3966c5ff66d95215fffea494f4e
 SHA512 (config-19.tar.bz2) = 36aa38a0c7c33267ae594b31c81681290ac58dde7ca6749bd599da531380b5b1428330813dbe983e01071ccaed83e83f6a9cd92179a53b7d0ccbb6851a0b017c

From 00db7f45fdafcb44486919f80b144009f071fd70 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 27 Aug 2019 10:52:49 +0200
Subject: [PATCH 15/55] Update patches to 9.11.10

---
 bind-9.11-fips-tests.patch |  68 ++++++-----------------
 bind-9.11-rh1624100.patch  |  20 +++----
 bind-9.11-rt31459.patch    | 108 ++++++++++++++++++-------------------
 3 files changed, 80 insertions(+), 116 deletions(-)

diff --git a/bind-9.11-fips-tests.patch b/bind-9.11-fips-tests.patch
index 920440b..539cdcb 100644
--- a/bind-9.11-fips-tests.patch
+++ b/bind-9.11-fips-tests.patch
@@ -1,4 +1,4 @@
-From d0e3f8be48c8031ebe3d7e1bf2a32cb03c79484e Mon Sep 17 00:00:00 2001
+From f32eb98f81b33abd5b0d3c77f8f75cc3e77425ff Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 2 Aug 2018 23:46:45 +0200
 Subject: [PATCH] FIPS tests changes
@@ -77,7 +77,7 @@ Date:   Wed Mar 7 10:44:23 2018 +0100
  bin/tests/system/checkconf/bad-tsig.conf      |  2 +-
  bin/tests/system/checkconf/good.conf          |  2 +-
  bin/tests/system/digdelv/ns2/example.db       | 15 +++--
- bin/tests/system/digdelv/tests.sh             | 28 ++++----
+ bin/tests/system/digdelv/tests.sh             | 20 +++---
  bin/tests/system/dlv/ns1/sign.sh              |  4 +-
  bin/tests/system/dlv/ns2/sign.sh              |  4 +-
  bin/tests/system/dlv/ns6/sign.sh              | 66 +++++++++---------
@@ -102,7 +102,7 @@ Date:   Wed Mar 7 10:44:23 2018 +0100
  bin/tests/system/tsiggss/setup.sh             |  2 +-
  bin/tests/system/upforwd/ns1/named.conf.in    |  2 +-
  bin/tests/system/upforwd/tests.sh             |  2 +-
- 44 files changed, 226 insertions(+), 175 deletions(-)
+ 44 files changed, 222 insertions(+), 171 deletions(-)
 
 diff --git a/bin/tests/system/acl/ns2/named1.conf.in b/bin/tests/system/acl/ns2/named1.conf.in
 index 0ea6502..026db3f 100644
@@ -599,27 +599,9 @@ index f4e30f5..9f53e31 100644
  ; TTL of 3 weeks
  weeks		1814400	A	10.53.0.2
 diff --git a/bin/tests/system/digdelv/tests.sh b/bin/tests/system/digdelv/tests.sh
-index 1657dfd..299ba94 100644
+index ade45ce..d3aff24 100644
 --- a/bin/tests/system/digdelv/tests.sh
 +++ b/bin/tests/system/digdelv/tests.sh
-@@ -88,7 +88,7 @@ if [ -x "$DIG" ] ; then
-   echo_i "checking dig +multi +norrcomments works for dnskey (when default is rrcomments)($n)"
-   ret=0
-   $DIG $DIGOPTS +tcp @10.53.0.3 +multi +norrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1
--  grep "; ZSK; alg = RSAMD5 ; key id = 30795" < dig.out.test$n > /dev/null && ret=1
-+  grep "; ZSK; alg = RSASHA256 ; key id = 36895" < dig.out.test$n > /dev/null && ret=1
-   check_ttl_range dig.out.test$n "DNSKEY" 300 || ret=1
-   if [ $ret != 0 ]; then echo_i "failed"; fi
-   status=`expr $status + $ret`
-@@ -97,7 +97,7 @@ if [ -x "$DIG" ] ; then
-   echo_i "checking dig +multi +norrcomments works for soa (when default is rrcomments)($n)"
-   ret=0
-   $DIG $DIGOPTS +tcp @10.53.0.3 +multi +norrcomments SOA example > dig.out.test$n || ret=1
--  grep "; ZSK; alg = RSAMD5 ; key id = 30795" < dig.out.test$n > /dev/null && ret=1
-+  grep "; ZSK; alg = RSASHA256 ; key id = 36895" < dig.out.test$n > /dev/null && ret=1
-   check_ttl_range dig.out.test$n "SOA" 300 || ret=1
-   if [ $ret != 0 ]; then echo_i "failed"; fi
-   status=`expr $status + $ret`
 @@ -106,7 +106,7 @@ if [ -x "$DIG" ] ; then
    echo_i "checking dig +rrcomments works for DNSKEY($n)"
    ret=0
@@ -665,25 +647,7 @@ index 1657dfd..299ba94 100644
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
  
-@@ -661,7 +661,7 @@ if [ -x ${DELV} ] ; then
-   echo_i "checking delv +multi +norrcomments works for dnskey (when default is rrcomments)($n)"
-   ret=0
-   $DELV $DELVOPTS +tcp @10.53.0.3 +multi +norrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
--  grep "; ZSK; alg = RSAMD5 ; key id = 30795" < delv.out.test$n > /dev/null && ret=1
-+  grep "; ZSK; alg = RSASHA256 ; key id = 36895" < delv.out.test$n > /dev/null && ret=1
-   check_ttl_range delv.out.test$n "DNSKEY" 300 || ret=1
-   if [ $ret != 0 ]; then echo_i "failed"; fi
-   status=`expr $status + $ret`
-@@ -670,7 +670,7 @@ if [ -x ${DELV} ] ; then
-   echo_i "checking delv +multi +norrcomments works for soa (when default is rrcomments)($n)"
-   ret=0
-   $DELV $DELVOPTS +tcp @10.53.0.3 +multi +norrcomments SOA example > delv.out.test$n || ret=1
--  grep "; ZSK; alg = RSAMD5 ; key id = 30795" < delv.out.test$n > /dev/null && ret=1
-+  grep "; ZSK; alg = RSASHA256 ; key id = 36895" < delv.out.test$n > /dev/null && ret=1
-   check_ttl_range delv.out.test$n "SOA" 300 || ret=1
-   if [ $ret != 0 ]; then echo_i "failed"; fi
-   status=`expr $status + $ret`
-@@ -679,7 +679,7 @@ if [ -x ${DELV} ] ; then
+@@ -695,7 +695,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +rrcomments works for DNSKEY($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +rrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
@@ -692,7 +656,7 @@ index 1657dfd..299ba94 100644
    check_ttl_range delv.out.test$n "DNSKEY" 300 || ret=1
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
-@@ -688,7 +688,7 @@ if [ -x ${DELV} ] ; then
+@@ -704,7 +704,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +short +rrcomments works for DNSKEY ($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
@@ -701,7 +665,7 @@ index 1657dfd..299ba94 100644
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
  
-@@ -696,7 +696,7 @@ if [ -x ${DELV} ] ; then
+@@ -712,7 +712,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +short +rrcomments works ($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
@@ -710,7 +674,7 @@ index 1657dfd..299ba94 100644
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
  
-@@ -704,7 +704,7 @@ if [ -x ${DELV} ] ; then
+@@ -720,7 +720,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +short +nosplit works ($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +short +nosplit DNSKEY dnskey.example > delv.out.test$n || ret=1
@@ -719,7 +683,7 @@ index 1657dfd..299ba94 100644
    if test `wc -l < delv.out.test$n` != 1 ; then ret=1 ; fi
    f=`awk '{print NF}' < delv.out.test$n`
    test "${f:-0}" -eq 14 || ret=1
-@@ -715,7 +715,7 @@ if [ -x ${DELV} ] ; then
+@@ -731,7 +731,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +short +nosplit +norrcomments works ($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +short +nosplit +norrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
@@ -990,10 +954,10 @@ index ed30460..e6b1126 100644
 +    "." 256 3 8 "AwEAAarwAdjV4gIhpBCjXVAScRFEx3co7k8smJdxrnqoGsl5NB7EZ9jRdgvCXbJn6v8y9jlNWVHvaC8ilhfhLh0A1vLWiWv4ijd/12xcnrY7xpG7Cu3YkxUxaXJ7Jdg/Iw1+9mGgXF1v4UbCIcw/3U3cxyk7OxYg+VSb5KBAQSR0upxV";
  };
 diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh
-index d07881d..17ad256 100644
+index b31c1b4..a5e237b 100644
 --- a/bin/tests/system/dnssec/tests.sh
 +++ b/bin/tests/system/dnssec/tests.sh
-@@ -3227,8 +3227,8 @@ do
+@@ -3235,8 +3235,8 @@ do
  	   alg=`expr $alg + 1`
  	   continue;;
  	3) size="-b 512";;
@@ -1005,7 +969,7 @@ index d07881d..17ad256 100644
  	8) size="-b 512";;
  	10) size="-b 1024";;
 diff --git a/bin/tests/system/feature-test.c b/bin/tests/system/feature-test.c
-index 27a02d0..caf4166 100644
+index c1249ed..20a3139 100644
 --- a/bin/tests/system/feature-test.c
 +++ b/bin/tests/system/feature-test.c
 @@ -19,6 +19,7 @@
@@ -1016,7 +980,7 @@ index 27a02d0..caf4166 100644
  #include <dns/edns.h>
  
  #ifdef WIN32
-@@ -46,6 +47,7 @@ usage() {
+@@ -47,6 +48,7 @@ usage() {
  	fprintf(stderr, "	--have-geoip2\n");
  	fprintf(stderr, "	--have-libxml2\n");
  	fprintf(stderr, "	--ipv6only=no\n");
@@ -1024,7 +988,7 @@ index 27a02d0..caf4166 100644
  	fprintf(stderr, "	--rpz-nsdname\n");
  	fprintf(stderr, "	--rpz-nsip\n");
  	fprintf(stderr, "	--with-idn\n");
-@@ -146,6 +148,18 @@ main(int argc, char **argv) {
+@@ -155,6 +157,18 @@ main(int argc, char **argv) {
  #endif
  	}
  
@@ -1209,10 +1173,10 @@ index 343869e..c30efb0 100644
  make_key 3 ${EXTRAPORT3} hmac-sha224
  make_key 4 ${EXTRAPORT4} hmac-sha256
 diff --git a/bin/tests/system/rndc/tests.sh b/bin/tests/system/rndc/tests.sh
-index b00056c..f7fad91 100644
+index 57e066d..186a723 100644
 --- a/bin/tests/system/rndc/tests.sh
 +++ b/bin/tests/system/rndc/tests.sh
-@@ -356,15 +356,20 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
+@@ -348,15 +348,20 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
  status=`expr $status + $ret`
  
  n=`expr $n + 1`
diff --git a/bind-9.11-rh1624100.patch b/bind-9.11-rh1624100.patch
index 00030cc..5764ed7 100644
--- a/bind-9.11-rh1624100.patch
+++ b/bind-9.11-rh1624100.patch
@@ -1,4 +1,4 @@
-From 292a0ca28f2e8a49f8c7e62c39ad7160234ce23d Mon Sep 17 00:00:00 2001
+From 76594cba9a1e910bb36160d96fc3872349341799 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@sury.org>
 Date: Wed, 25 Apr 2018 14:04:31 +0200
 Subject: [PATCH] Replace isc_safe routines with their OpenSSL counter parts
@@ -81,15 +81,15 @@ index ad77f24..670982a 100644
  
  /* accept_sec_context.c */
 diff --git a/lib/isc/Makefile.in b/lib/isc/Makefile.in
-index ba53ef1..98acfff 100644
+index 0fd0837..8ad54bb 100644
 --- a/lib/isc/Makefile.in
 +++ b/lib/isc/Makefile.in
 @@ -60,7 +60,7 @@ OBJS =		@ISC_EXTRA_OBJS@ @ISC_PK11_O@ @ISC_PK11_RESULT_O@ \
  		parseint.@O@ portset.@O@ quota.@O@ radix.@O@ random.@O@ \
  		ratelimiter.@O@ refcount.@O@ region.@O@ regex.@O@ result.@O@ \
  		rwlock.@O@ \
--		safe.@O@ serial.@O@ sha1.@O@ sha2.@O@ sockaddr.@O@ stats.@O@ \
-+		serial.@O@ sha1.@O@ sha2.@O@ sockaddr.@O@ stats.@O@ \
+-		safe.@O@ serial.@O@ siphash.@O@ sha1.@O@ sha2.@O@ sockaddr.@O@ stats.@O@ \
++		serial.@O@ siphash.@O@ sha1.@O@ sha2.@O@ sockaddr.@O@ stats.@O@ \
  		string.@O@ strtoul.@O@ symtab.@O@ task.@O@ taskpool.@O@ \
  		tm.@O@ timer.@O@ version.@O@ \
  		${UNIXOBJS} ${NLSOBJS} ${THREADOBJS}
@@ -97,8 +97,8 @@ index ba53ef1..98acfff 100644
  		netaddr.c netscope.c pool.c ondestroy.c \
  		parseint.c portset.c quota.c radix.c random.c ${CHACHASRCS} \
  		ratelimiter.c refcount.c region.c regex.c result.c rwlock.c \
--		safe.c serial.c sha1.c sha2.c sockaddr.c stats.c string.c \
-+		serial.c sha1.c sha2.c sockaddr.c stats.c string.c \
+-		safe.c serial.c siphash.c sha1.c sha2.c sockaddr.c stats.c string.c \
++		serial.c siphash.c sha1.c sha2.c sockaddr.c stats.c string.c \
  		strtoul.c symtab.c task.c taskpool.c timer.c \
  		tm.c version.c
  
@@ -241,10 +241,10 @@ index 7a464b6..0000000
 -#endif
 -}
 diff --git a/lib/isc/tests/safe_test.c b/lib/isc/tests/safe_test.c
-index 5775b6e..3451b5d 100644
+index 266ac75..60e9181 100644
 --- a/lib/isc/tests/safe_test.c
 +++ b/lib/isc/tests/safe_test.c
-@@ -44,22 +44,6 @@ isc_safe_memequal_test(void **state) {
+@@ -45,22 +45,6 @@ isc_safe_memequal_test(void **state) {
  				       "\x00\x00\x00\x00", 4));
  }
  
@@ -267,7 +267,7 @@ index 5775b6e..3451b5d 100644
  /* test isc_safe_memwipe() */
  static void
  isc_safe_memwipe_test(void **state) {
-@@ -68,7 +52,6 @@ isc_safe_memwipe_test(void **state) {
+@@ -69,7 +53,6 @@ isc_safe_memwipe_test(void **state) {
  	/* These should pass. */
  	isc_safe_memwipe(NULL, 0);
  	isc_safe_memwipe((void *) -1, 0);
@@ -275,7 +275,7 @@ index 5775b6e..3451b5d 100644
  
  	/*
  	 * isc_safe_memwipe(ptr, size) should function same as
-@@ -107,7 +90,6 @@ main(void) {
+@@ -108,7 +91,6 @@ main(void) {
  	const struct CMUnitTest tests[] = {
  		cmocka_unit_test(isc_safe_memequal_test),
  		cmocka_unit_test(isc_safe_memwipe_test),
diff --git a/bind-9.11-rt31459.patch b/bind-9.11-rt31459.patch
index bbb8948..27d8273 100644
--- a/bind-9.11-rt31459.patch
+++ b/bind-9.11-rt31459.patch
@@ -1,4 +1,4 @@
-From f0eee3c150b9b913819ecd864581ba50dd4ae9cf Mon Sep 17 00:00:00 2001
+From 9f62d68da08d21a8b35e27aeebd00afe6e5fb7be Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Tue, 12 Sep 2017 19:05:46 -0700
 Subject: [PATCH] rebased rt31459c
@@ -293,7 +293,7 @@ index fbc7ece..31a99e7 100644
  					   usekeyboard);
  
 diff --git a/bin/named/server.c b/bin/named/server.c
-index 767d83f..d3c2f9d 100644
+index c917cad..436a93a 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
 @@ -36,6 +36,7 @@
@@ -304,7 +304,7 @@ index 767d83f..d3c2f9d 100644
  #include <isc/portset.h>
  #include <isc/print.h>
  #include <isc/random.h>
-@@ -8208,6 +8209,10 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8209,6 +8210,10 @@ load_configuration(const char *filename, ns_server_t *server,
  				      "no source of entropy found");
  		} else {
  			const char *randomdev = cfg_obj_asstring(obj);
@@ -315,7 +315,7 @@ index 767d83f..d3c2f9d 100644
  			int level = ISC_LOG_ERROR;
  			result = isc_entropy_createfilesource(ns_g_entropy,
  							      randomdev);
-@@ -8242,6 +8247,7 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8243,6 +8248,7 @@ load_configuration(const char *filename, ns_server_t *server,
  				}
  				isc_entropy_detach(&ns_g_fallbackentropy);
  			}
@@ -671,10 +671,10 @@ index 9f90dd7..fad6c83 100644
          echo "I:failed"
  	status=`expr $status + $ret`
 diff --git a/bin/tools/mdig.c b/bin/tools/mdig.c
-index b27fc1d..e28871b 100644
+index 53579d4..e2f6810 100644
 --- a/bin/tools/mdig.c
 +++ b/bin/tools/mdig.c
-@@ -1969,12 +1969,11 @@ main(int argc, char *argv[]) {
+@@ -1972,12 +1972,11 @@ main(int argc, char *argv[]) {
  
  	ectx = NULL;
  	RUNCHECK(isc_entropy_create(mctx, &ectx));
@@ -689,7 +689,7 @@ index b27fc1d..e28871b 100644
  	parse_args(false, argc, argv);
  	if (server == NULL)
 diff --git a/configure b/configure
-index 4a5db6c..64aca10 100755
+index 2a4d9ed..e4e8ea6 100755
 --- a/configure
 +++ b/configure
 @@ -640,6 +640,7 @@ ac_includes_default="\
@@ -724,7 +724,7 @@ index 4a5db6c..64aca10 100755
    --enable-largefile      64-bit file support
    --enable-backtrace      log stack backtrace on abort [default=yes]
    --enable-symtable       use internal symbol table for backtrace
-@@ -17156,6 +17160,7 @@ case "$use_openssl" in
+@@ -17117,6 +17121,7 @@ case "$use_openssl" in
  $as_echo "disabled because of native PKCS11" >&6; }
  		DST_OPENSSL_INC=""
  		CRYPTO="-DPKCS11CRYPTO"
@@ -732,7 +732,7 @@ index 4a5db6c..64aca10 100755
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -17170,6 +17175,7 @@ $as_echo "disabled because of native PKCS11" >&6; }
+@@ -17131,6 +17136,7 @@ $as_echo "disabled because of native PKCS11" >&6; }
  $as_echo "no" >&6; }
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -740,7 +740,7 @@ index 4a5db6c..64aca10 100755
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -17182,6 +17188,7 @@ $as_echo "no" >&6; }
+@@ -17143,6 +17149,7 @@ $as_echo "no" >&6; }
  	auto)
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -748,7 +748,7 @@ index 4a5db6c..64aca10 100755
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -17191,7 +17198,7 @@ $as_echo "no" >&6; }
+@@ -17152,7 +17159,7 @@ $as_echo "no" >&6; }
  		OPENSSLLINKOBJS=""
  		OPENSSLLINKSRCS=""
  		as_fn_error $? "OpenSSL was not found in any of $openssldirs; use --with-openssl=/path
@@ -757,7 +757,7 @@ index 4a5db6c..64aca10 100755
  		;;
  	*)
  		if test "yes" = "$want_native_pkcs11"
-@@ -17222,6 +17229,7 @@ $as_echo "not found" >&6; }
+@@ -17183,6 +17190,7 @@ $as_echo "not found" >&6; }
  			as_fn_error $? "\"$use_openssl/include/openssl/opensslv.h\" not found" "$LINENO" 5
  		fi
  		CRYPTO='-DOPENSSL'
@@ -765,7 +765,7 @@ index 4a5db6c..64aca10 100755
  		if test "/usr" = "$use_openssl"
  		then
  			DST_OPENSSL_INC=""
-@@ -17883,8 +17891,6 @@ fi
+@@ -17808,8 +17816,6 @@ fi
  # Use OpenSSL for hash functions
  #
  
@@ -774,7 +774,7 @@ index 4a5db6c..64aca10 100755
  ISC_PLATFORM_OPENSSLHASH="#undef ISC_PLATFORM_OPENSSLHASH"
  case $want_openssl_hash in
  	yes)
-@@ -18259,6 +18265,86 @@ if test "rt" = "$have_clock_gt"; then
+@@ -18184,6 +18190,86 @@ if test "rt" = "$have_clock_gt"; then
  	LIBS="-lrt $LIBS"
  fi
  
@@ -861,7 +861,7 @@ index 4a5db6c..64aca10 100755
  #
  # was --with-lmdb specified?
  #
-@@ -20341,9 +20427,12 @@ _ACEOF
+@@ -20266,9 +20352,12 @@ _ACEOF
  if ac_fn_c_try_compile "$LINENO"; then :
    { $as_echo "$as_me:${as_lineno-$LINENO}: result: size_t for buflen; int for flags" >&5
  $as_echo "size_t for buflen; int for flags" >&6; }
@@ -876,7 +876,7 @@ index 4a5db6c..64aca10 100755
  
  	 $as_echo "#define IRS_GETNAMEINFO_FLAGS_T int" >>confdefs.h
  
-@@ -21658,12 +21747,7 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
+@@ -21583,12 +21672,7 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
  ISC_PLATFORM_USESTDASM="#undef ISC_PLATFORM_USESTDASM"
  ISC_PLATFORM_USEMACASM="#undef ISC_PLATFORM_USEMACASM"
  if test "yes" = "$use_atomic"; then
@@ -890,7 +890,7 @@ index 4a5db6c..64aca10 100755
  # version HP92453-01 B.11.11.23709.GP, which incorrectly rejects
  # declarations like `int a3[[(sizeof (unsigned char)) >= 0]];'.
  # This bug is HP SR number 8606223364.
-@@ -21696,6 +21780,11 @@ cat >>confdefs.h <<_ACEOF
+@@ -21621,6 +21705,11 @@ cat >>confdefs.h <<_ACEOF
  _ACEOF
  
  
@@ -902,7 +902,7 @@ index 4a5db6c..64aca10 100755
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -21704,39 +21793,6 @@ _ACEOF
+@@ -21629,39 +21718,6 @@ _ACEOF
  		fi
  	;;
  	x86_64-*|amd64-*)
@@ -942,7 +942,7 @@ index 4a5db6c..64aca10 100755
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -21767,6 +21823,10 @@ $as_echo_n "checking architecture type for atomic operations... " >&6; }
+@@ -21692,6 +21748,10 @@ $as_echo_n "checking architecture type for atomic operations... " >&6; }
  $as_echo "$arch" >&6; }
  fi
  
@@ -953,7 +953,7 @@ index 4a5db6c..64aca10 100755
  if test "yes" = "$have_atomic"; then
  	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking compiler support for inline assembly code" >&5
  $as_echo_n "checking compiler support for inline assembly code... " >&6; }
-@@ -24372,6 +24432,30 @@ CFLAGS="$CFLAGS $SO_CFLAGS"
+@@ -24297,6 +24357,30 @@ CFLAGS="$CFLAGS $SO_CFLAGS"
  #
  dlzdir='${DLZ_DRIVER_DIR}'
  
@@ -984,7 +984,7 @@ index 4a5db6c..64aca10 100755
  #
  # Private autoconf macro to simplify configuring drivers:
  #
-@@ -24702,11 +24786,11 @@ $as_echo "no" >&6; }
+@@ -24627,11 +24711,11 @@ $as_echo "no" >&6; }
  $as_echo "using mysql with libs ${mysql_lib} and includes ${mysql_include}" >&6; }
  		;;
  	*)
@@ -999,7 +999,7 @@ index 4a5db6c..64aca10 100755
  		fi
  
  	CONTRIB_DLZ="$CONTRIB_DLZ -DDLZ_MYSQL"
-@@ -24791,7 +24875,7 @@ $as_echo "" >&6; }
+@@ -24716,7 +24800,7 @@ $as_echo "" >&6; }
  			# Check other locations for includes.
  			# Order is important (sigh).
  
@@ -1008,7 +1008,7 @@ index 4a5db6c..64aca10 100755
  			# include a blank element first
  			for d in "" $bdb_incdirs
  			do
-@@ -24816,57 +24900,9 @@ $as_echo "" >&6; }
+@@ -24741,57 +24825,9 @@ $as_echo "" >&6; }
  			bdb_libnames="db53 db-5.3 db51 db-5.1 db48 db-4.8 db47 db-4.7 db46 db-4.6 db45 db-4.5 db44 db-4.4 db43 db-4.3 db42 db-4.2 db41 db-4.1 db"
  			for d in $bdb_libnames
  			do
@@ -1068,7 +1068,7 @@ index 4a5db6c..64aca10 100755
  					break
  				fi
  			done
-@@ -25025,10 +25061,10 @@ $as_echo "no" >&6; }
+@@ -24950,10 +24986,10 @@ $as_echo "no" >&6; }
  		DLZ_DRIVER_INCLUDES="$DLZ_DRIVER_INCLUDES -I$use_dlz_ldap/include"
  		DLZ_DRIVER_LDAP_INCLUDES="-I$use_dlz_ldap/include"
  	fi
@@ -1082,7 +1082,7 @@ index 4a5db6c..64aca10 100755
  	fi
  
  
-@@ -25114,11 +25150,11 @@ fi
+@@ -25039,11 +25075,11 @@ fi
  		odbcdirs="/usr /usr/local /usr/pkg"
  		for d in $odbcdirs
  		do
@@ -1096,7 +1096,7 @@ index 4a5db6c..64aca10 100755
  				break
  			fi
  		done
-@@ -25393,6 +25429,8 @@ DNS_CRYPTO_LIBS="$NEWFLAGS"
+@@ -25318,6 +25354,8 @@ DNS_CRYPTO_LIBS="$NEWFLAGS"
  
  
  
@@ -1105,7 +1105,7 @@ index 4a5db6c..64aca10 100755
  #
  # Commands to run at the end of config.status.
  # Don't just put these into configure, it won't work right if somebody
-@@ -27772,6 +27810,8 @@ report() {
+@@ -27697,6 +27735,8 @@ report() {
  	    echo "    IPv6 support (--enable-ipv6)"
  	test "X$CRYPTO" = "X" -o "yes" = "$want_native_pkcs11" || \
  		echo "    OpenSSL cryptography/DNSSEC (--with-openssl)"
@@ -1114,7 +1114,7 @@ index 4a5db6c..64aca10 100755
  	test "X$PYTHON" = "X" || echo "    Python tools (--with-python)"
  	test "X$XMLSTATS" = "X" || echo "    XML statistics (--with-libxml2)"
  	test "X$JSONSTATS" = "X" || echo "    JSON statistics (--with-libjson)"
-@@ -27812,6 +27852,8 @@ report() {
+@@ -27737,6 +27777,8 @@ report() {
  	echo "    Very verbose query trace logging (--enable-querytrace)"
      test "no" = "$with_cmocka" || echo "    CMocka Unit Testing Framework (--with-cmocka)"
  
@@ -1123,7 +1123,7 @@ index 4a5db6c..64aca10 100755
      echo "    Dynamically loadable zone (DLZ) drivers:"
      test "no" = "$use_dlz_bdb" || \
  	echo "        Berkeley DB (--with-dlz-bdb)"
-@@ -27859,6 +27901,8 @@ report() {
+@@ -27784,6 +27826,8 @@ report() {
  	echo "    ECDSA algorithm support (--with-ecdsa)"
      test "X$CRYPTO" = "X" -o "yes" = "$OPENSSL_ED25519" -o "yes" = "$PKCS11_ED25519" || \
  	echo "    EDDSA algorithm support (--with-eddsa)"
@@ -1133,10 +1133,10 @@ index 4a5db6c..64aca10 100755
      test "yes" = "$enable_seccomp" || \
  	echo "    Use libseccomp system call filtering (--enable-seccomp)"
 diff --git a/configure.ac b/configure.ac
-index 0dc552c..3b88105 100644
+index 0e22d02..828581e 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -1572,6 +1572,7 @@ case "$use_openssl" in
+@@ -1537,6 +1537,7 @@ case "$use_openssl" in
  		AC_MSG_RESULT(disabled because of native PKCS11)
  		DST_OPENSSL_INC=""
  		CRYPTO="-DPKCS11CRYPTO"
@@ -1144,7 +1144,7 @@ index 0dc552c..3b88105 100644
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -1585,6 +1586,7 @@ case "$use_openssl" in
+@@ -1550,6 +1551,7 @@ case "$use_openssl" in
  		AC_MSG_RESULT(no)
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -1152,7 +1152,7 @@ index 0dc552c..3b88105 100644
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -1597,6 +1599,7 @@ case "$use_openssl" in
+@@ -1562,6 +1564,7 @@ case "$use_openssl" in
  	auto)
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -1160,7 +1160,7 @@ index 0dc552c..3b88105 100644
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -1607,7 +1610,7 @@ case "$use_openssl" in
+@@ -1572,7 +1575,7 @@ case "$use_openssl" in
  		OPENSSLLINKSRCS=""
  		AC_MSG_ERROR(
  [OpenSSL was not found in any of $openssldirs; use --with-openssl=/path
@@ -1169,7 +1169,7 @@ index 0dc552c..3b88105 100644
  		;;
  	*)
  		if test "yes" = "$want_native_pkcs11"
-@@ -1637,6 +1640,7 @@ If you don't want OpenSSL, use --without-openssl])
+@@ -1602,6 +1605,7 @@ If you don't want OpenSSL, use --without-openssl])
  			AC_MSG_ERROR(["$use_openssl/include/openssl/opensslv.h" not found])
  		fi
  		CRYPTO='-DOPENSSL'
@@ -1177,7 +1177,7 @@ index 0dc552c..3b88105 100644
  		if test "/usr" = "$use_openssl"
  		then
  			DST_OPENSSL_INC=""
-@@ -2110,7 +2114,6 @@ fi
+@@ -2037,7 +2041,6 @@ fi
  # Use OpenSSL for hash functions
  #
  
@@ -1185,7 +1185,7 @@ index 0dc552c..3b88105 100644
  ISC_PLATFORM_OPENSSLHASH="#undef ISC_PLATFORM_OPENSSLHASH"
  case $want_openssl_hash in
  	yes)
-@@ -2382,6 +2385,67 @@ if test "rt" = "$have_clock_gt"; then
+@@ -2309,6 +2312,67 @@ if test "rt" = "$have_clock_gt"; then
  	LIBS="-lrt $LIBS"
  fi
  
@@ -1253,7 +1253,7 @@ index 0dc552c..3b88105 100644
  #
  # was --with-lmdb specified?
  #
-@@ -4178,12 +4242,12 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
+@@ -4105,12 +4169,12 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
  ISC_PLATFORM_USESTDASM="#undef ISC_PLATFORM_USESTDASM"
  ISC_PLATFORM_USEMACASM="#undef ISC_PLATFORM_USEMACASM"
  if test "yes" = "$use_atomic"; then
@@ -1267,7 +1267,7 @@ index 0dc552c..3b88105 100644
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -4192,7 +4256,6 @@ if test "yes" = "$use_atomic"; then
+@@ -4119,7 +4183,6 @@ if test "yes" = "$use_atomic"; then
  		fi
  	;;
  	x86_64-*|amd64-*)
@@ -1275,7 +1275,7 @@ index 0dc552c..3b88105 100644
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -5607,6 +5670,8 @@ report() {
+@@ -5534,6 +5597,8 @@ report() {
  	    echo "    IPv6 support (--enable-ipv6)"
  	test "X$CRYPTO" = "X" -o "yes" = "$want_native_pkcs11" || \
  		echo "    OpenSSL cryptography/DNSSEC (--with-openssl)"
@@ -1284,7 +1284,7 @@ index 0dc552c..3b88105 100644
  	test "X$PYTHON" = "X" || echo "    Python tools (--with-python)"
  	test "X$XMLSTATS" = "X" || echo "    XML statistics (--with-libxml2)"
  	test "X$JSONSTATS" = "X" || echo "    JSON statistics (--with-libjson)"
-@@ -5647,6 +5712,8 @@ report() {
+@@ -5574,6 +5639,8 @@ report() {
  	echo "    Very verbose query trace logging (--enable-querytrace)"
      test "no" = "$with_cmocka" || echo "    CMocka Unit Testing Framework (--with-cmocka)"
  
@@ -1293,7 +1293,7 @@ index 0dc552c..3b88105 100644
      echo "    Dynamically loadable zone (DLZ) drivers:"
      test "no" = "$use_dlz_bdb" || \
  	echo "        Berkeley DB (--with-dlz-bdb)"
-@@ -5694,6 +5761,8 @@ report() {
+@@ -5621,6 +5688,8 @@ report() {
  	echo "    ECDSA algorithm support (--with-ecdsa)"
      test "X$CRYPTO" = "X" -o "yes" = "$OPENSSL_ED25519" -o "yes" = "$PKCS11_ED25519" || \
  	echo "    EDDSA algorithm support (--with-eddsa)"
@@ -2016,10 +2016,10 @@ index 5b8a2c9..913a2ce 100644
   * Define if the hash functions must be provided by OpenSSL.
   */
 diff --git a/win32utils/Configure b/win32utils/Configure
-index 93939f3..8bacf54 100644
+index 6f93814..4286baf 100644
 --- a/win32utils/Configure
 +++ b/win32utils/Configure
-@@ -381,6 +381,7 @@ my @substdefh = ("AES_CC",
+@@ -378,6 +378,7 @@ my @substdefh = ("ALLOW_FILTER_AAAA",
  my %configdefp;
  
  my @substdefp = ("ISC_PLATFORM_BUSYWAITNOP",
@@ -2027,7 +2027,7 @@ index 93939f3..8bacf54 100644
                   "ISC_PLATFORM_HAVEATOMICSTORE",
                   "ISC_PLATFORM_HAVEATOMICSTOREQ",
                   "ISC_PLATFORM_HAVECMPXCHG",
-@@ -511,7 +512,8 @@ my @allcond = (@substcond, "NOTYET", "NOLONGER");
+@@ -508,7 +509,8 @@ my @allcond = (@substcond, "NOTYET", "NOLONGER");
  
  # enable-xxx/disable-xxx
  
@@ -2037,7 +2037,7 @@ index 93939f3..8bacf54 100644
                    "fixed-rrset",
                    "intrinsics",
                    "isc-spnego",
-@@ -575,6 +577,7 @@ my @help = (
+@@ -572,6 +574,7 @@ my @help = (
  "\nOptional Features:\n",
  "  enable-intrinsics     enable instrinsic/atomic functions [default=yes]\n",
  "  enable-native-pkcs11  use native PKCS#11 for all crypto [default=no]\n",
@@ -2045,7 +2045,7 @@ index 93939f3..8bacf54 100644
  "  enable-openssl-hash   use OpenSSL for hash functions [default=yes]\n",
  "  enable-isc-spnego     use SPNEGO from lib/dns [default=yes]\n",
  "  enable-filter-aaaa    enable filtering of AAAA records [default=yes]\n",
-@@ -620,7 +623,9 @@ my $want_clean = "no";
+@@ -617,7 +620,9 @@ my $want_clean = "no";
  my $want_unknown = "no";
  my $unknown_value;
  my $enable_intrinsics = "yes";
@@ -2055,7 +2055,7 @@ index 93939f3..8bacf54 100644
  my $enable_openssl_hash = "auto";
  my $enable_filter_aaaa = "yes";
  my $enable_isc_spnego = "yes";
-@@ -840,6 +845,10 @@ sub myenable {
+@@ -837,6 +842,10 @@ sub myenable {
          if ($val =~ /^yes$/i) {
              $enable_native_pkcs11 = "yes";
          }
@@ -2066,7 +2066,7 @@ index 93939f3..8bacf54 100644
      } elsif ($key =~ /^openssl-hash$/i) {
          if ($val =~ /^yes$/i) {
              $enable_openssl_hash = "yes";
-@@ -1142,6 +1151,11 @@ if ($verbose) {
+@@ -1139,6 +1148,11 @@ if ($verbose) {
      } else {
          print "native-pkcs11: disabled\n";
      }
@@ -2078,7 +2078,7 @@ index 93939f3..8bacf54 100644
      if ($enable_openssl_hash eq "yes") {
          print "openssl-hash: enabled\n";
      } else {
-@@ -1500,6 +1514,7 @@ if ($enable_intrinsics eq "yes") {
+@@ -1497,6 +1511,7 @@ if ($enable_intrinsics eq "yes") {
  
  # enable-native-pkcs11
  if ($enable_native_pkcs11 eq "yes") {
@@ -2086,7 +2086,7 @@ index 93939f3..8bacf54 100644
      if ($use_openssl eq "auto") {
          $use_openssl = "no";
      }
-@@ -1709,6 +1724,7 @@ if ($use_openssl eq "yes") {
+@@ -1706,6 +1721,7 @@ if ($use_openssl eq "yes") {
          $openssl_dll = File::Spec->catdir($openssl_path, "@dirlist[0]");
      }   
  
@@ -2094,10 +2094,10 @@ index 93939f3..8bacf54 100644
      $configcond{"OPENSSL"} = 1;
      $configdefd{"CRYPTO"} = "OPENSSL";
      $configvar{"OPENSSL_PATH"} = "$openssl_path";
-@@ -2260,6 +2276,15 @@ if ($cookie_algorithm eq "sha1") {
-     die "Unrecognized cookie algorithm: $cookie_algorithm\n";
+@@ -2242,6 +2258,15 @@ if ($use_aes eq "yes") {
  }
  
+ 
 +# enable-crypto-rand
 +if ($enable_crypto_rand eq "yes") {
 +    if (($use_openssl eq "no") && ($enable_native_pkcs11 eq "no")) {
@@ -2110,7 +2110,7 @@ index 93939f3..8bacf54 100644
  # enable-openssl-hash
  if ($enable_openssl_hash eq "yes") {
      if ($use_openssl eq "no") {
-@@ -3635,6 +3660,7 @@ exit 0;
+@@ -3617,6 +3642,7 @@ exit 0;
  #  --enable-developer partially supported
  #  --enable-newstats (9.9/9.9sub only)
  #  --enable-native-pkcs11 supported

From 4e4f8c8518d7dcbab3ad18ae86e79e2952378d54 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 27 Aug 2019 10:53:03 +0200
Subject: [PATCH 16/55] Fix broken system/tsig test

On rebases, md5 keys were accidentally dropped. Put them back.
---
 bind-9.11-fips-tests.patch | 22 ++++++++++++++++++++--
 1 file changed, 20 insertions(+), 2 deletions(-)

diff --git a/bind-9.11-fips-tests.patch b/bind-9.11-fips-tests.patch
index 539cdcb..29dda07 100644
--- a/bind-9.11-fips-tests.patch
+++ b/bind-9.11-fips-tests.patch
@@ -1,4 +1,4 @@
-From f32eb98f81b33abd5b0d3c77f8f75cc3e77425ff Mon Sep 17 00:00:00 2001
+From c23daf334d5487fa53fef88c82312e439a2d8523 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 2 Aug 2018 23:46:45 +0200
 Subject: [PATCH] FIPS tests changes
@@ -102,7 +102,9 @@ Date:   Wed Mar 7 10:44:23 2018 +0100
  bin/tests/system/tsiggss/setup.sh             |  2 +-
  bin/tests/system/upforwd/ns1/named.conf.in    |  2 +-
  bin/tests/system/upforwd/tests.sh             |  2 +-
- 44 files changed, 222 insertions(+), 171 deletions(-)
+ bin/tests/system/tsig/ns1/rndc5.conf.in | 10 +++
+ 45 files changed, 232 insertions(+), 171 deletions(-)
+ create mode 100644 bin/tests/system/tsig/ns1/rndc5.conf.in
 
 diff --git a/bin/tests/system/acl/ns2/named1.conf.in b/bin/tests/system/acl/ns2/named1.conf.in
 index 0ea6502..026db3f 100644
@@ -1385,6 +1387,22 @@ index b0694bb..9adae82 100644
  server 10.53.0.3 ${PORT}
  update add updated.example. 600 A 10.10.10.1
  update add updated.example. 600 TXT Foo
+diff --git a/bin/tests/system/tsig/ns1/rndc5.conf.in b/bin/tests/system/tsig/ns1/rndc5.conf.in
+new file mode 100644
+index 0000000..0682194
+--- /dev/null
++++ b/bin/tests/system/tsig/ns1/rndc5.conf.in
+@@ -0,0 +1,10 @@
++# Conditionally included when support for MD5 is available
++key "md5" {
++	secret "97rnFx24Tfna4mHPfgnerA==";
++	algorithm hmac-md5;
++};
++
++key "md5-trunc" {
++	secret "97rnFx24Tfna4mHPfgnerA==";
++	algorithm hmac-md5-80;
++};
 -- 
 2.20.1
 

From 290a5eb9ab92470db9c0f1016ec14c84e42a8868 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 27 Aug 2019 15:49:57 +0200
Subject: [PATCH 17/55] Fix broken pkcs11 initialization

Broken by commit 2a466330c5379150b781709140e8c837d0a95328
---
 bind-9.11-fips-code.patch | 50 +++++++++++++++++++--------------------
 1 file changed, 25 insertions(+), 25 deletions(-)

diff --git a/bind-9.11-fips-code.patch b/bind-9.11-fips-code.patch
index 74dbb05..cf00104 100644
--- a/bind-9.11-fips-code.patch
+++ b/bind-9.11-fips-code.patch
@@ -1,4 +1,4 @@
-From b8485528f5098e3360560d5b85c9ffc592619c55 Mon Sep 17 00:00:00 2001
+From eff6dcb62f3cea6df0a848c2220a49bc02cb4a0e Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 2 Aug 2018 23:34:45 +0200
 Subject: [PATCH] FIPS code changes
@@ -241,7 +241,7 @@ index 5ca3d76..6b7790a 100644
  	port = DEFAULT_PORT;
  
 diff --git a/bin/dig/dig.c b/bin/dig/dig.c
-index 2063a3b..8e856c5 100644
+index 706299e..aaf22e7 100644
 --- a/bin/dig/dig.c
 +++ b/bin/dig/dig.c
 @@ -20,6 +20,7 @@
@@ -252,7 +252,7 @@ index 2063a3b..8e856c5 100644
  #include <isc/netaddr.h>
  #include <isc/parseint.h>
  #include <isc/platform.h>
-@@ -1767,10 +1768,10 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
+@@ -1774,10 +1775,10 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
  			ptr = ptr2;
  			ptr2 = ptr3;
  		} else  {
@@ -267,7 +267,7 @@ index 2063a3b..8e856c5 100644
  			digestbits = 0;
  		}
 diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
-index e75b8b7..9234d35 100644
+index 93e5b40..afd2700 100644
 --- a/bin/dig/dighost.c
 +++ b/bin/dig/dighost.c
 @@ -80,6 +80,7 @@
@@ -339,7 +339,7 @@ index 1476d0d..f5c9316 100644
  			alg = DST_ALG_HMACMD5;
  #else
 diff --git a/bin/named/config.c b/bin/named/config.c
-index 7584efb..a153172 100644
+index 32c454a..dff826b 100644
 --- a/bin/named/config.c
 +++ b/bin/named/config.c
 @@ -18,6 +18,7 @@
@@ -350,7 +350,7 @@ index 7584efb..a153172 100644
  #include <isc/mem.h>
  #include <isc/parseint.h>
  #include <isc/region.h>
-@@ -969,6 +970,21 @@ ns_config_getkeyalgorithm(const char *str, dns_name_t **name,
+@@ -974,6 +975,21 @@ ns_config_getkeyalgorithm(const char *str, dns_name_t **name,
  	return (ns_config_getkeyalgorithm2(str, name, NULL, digestbits));
  }
  
@@ -372,7 +372,7 @@ index 7584efb..a153172 100644
  isc_result_t
  ns_config_getkeyalgorithm2(const char *str, dns_name_t **name,
  			   unsigned int *typep, uint16_t *digestbits)
-@@ -978,7 +994,7 @@ ns_config_getkeyalgorithm2(const char *str, dns_name_t **name,
+@@ -983,7 +999,7 @@ ns_config_getkeyalgorithm2(const char *str, dns_name_t **name,
  	uint16_t bits;
  	isc_result_t result;
  
@@ -381,7 +381,7 @@ index 7584efb..a153172 100644
  		len = strlen(algorithms[i].str);
  		if (strncasecmp(algorithms[i].str, str, len) == 0 &&
  		    (str[len] == '\0' ||
-@@ -1001,7 +1017,12 @@ ns_config_getkeyalgorithm2(const char *str, dns_name_t **name,
+@@ -1006,7 +1022,12 @@ ns_config_getkeyalgorithm2(const char *str, dns_name_t **name,
  	if (name != NULL) {
  		switch (algorithms[i].hmac) {
  #ifndef PK11_MD5_DISABLE
@@ -622,7 +622,7 @@ index bde66a4..70a40c3 100644
  	dst_key_free(&dstkey);
  	CHECK("MD5 was disabled", ISC_R_NOTIMPLEMENTED);
 diff --git a/lib/bind9/check.c b/lib/bind9/check.c
-index 2a0e735..dc80018 100644
+index ec0ab6d..e0803d4 100644
 --- a/lib/bind9/check.c
 +++ b/lib/bind9/check.c
 @@ -23,6 +23,7 @@
@@ -633,7 +633,7 @@ index 2a0e735..dc80018 100644
  #include <isc/mem.h>
  #include <isc/netaddr.h>
  #include <isc/parseint.h>
-@@ -2590,6 +2591,15 @@ bind9_check_key(const cfg_obj_t *key, isc_log_t *logctx) {
+@@ -2618,6 +2619,15 @@ bind9_check_key(const cfg_obj_t *key, isc_log_t *logctx) {
  	}
  
  	algorithm = cfg_obj_asstring(algobj);
@@ -937,10 +937,10 @@ index 9c42c50..f51d548 100644
  
  void
 diff --git a/lib/dns/tests/rsa_test.c b/lib/dns/tests/rsa_test.c
-index 16214c6..9b235ba 100644
+index f9ac6d0..241e17e 100644
 --- a/lib/dns/tests/rsa_test.c
 +++ b/lib/dns/tests/rsa_test.c
-@@ -26,6 +26,7 @@
+@@ -27,6 +27,7 @@
  #define UNIT_TESTING
  #include <cmocka.h>
  
@@ -948,7 +948,7 @@ index 16214c6..9b235ba 100644
  #include <isc/util.h>
  #include <isc/print.h>
  
-@@ -247,6 +248,8 @@ isc_rsa_verify_test(void **state) {
+@@ -248,6 +249,8 @@ isc_rsa_verify_test(void **state) {
  	/* RSAMD5 */
  
  #ifndef PK11_MD5_DISABLE
@@ -957,7 +957,7 @@ index 16214c6..9b235ba 100644
  	key->key_alg = DST_ALG_RSAMD5;
  
  	ret = dst_context_create3(key, mctx, DNS_LOGCATEGORY_DNSSEC,
-@@ -264,6 +267,7 @@ isc_rsa_verify_test(void **state) {
+@@ -265,6 +268,7 @@ isc_rsa_verify_test(void **state) {
  	assert_int_equal(ret, ISC_R_SUCCESS);
  
  	dst_context_destroy(&ctx);
@@ -966,10 +966,10 @@ index 16214c6..9b235ba 100644
  
  	/* RSASHA256 */
 diff --git a/lib/dns/tests/tsig_test.c b/lib/dns/tests/tsig_test.c
-index 8e5250e..9accc53 100644
+index 11d011a..feb2068 100644
 --- a/lib/dns/tests/tsig_test.c
 +++ b/lib/dns/tests/tsig_test.c
-@@ -24,6 +24,7 @@
+@@ -25,6 +25,7 @@
  #define UNIT_TESTING
  #include <cmocka.h>
  
@@ -1215,7 +1215,7 @@ index 249f3da..628a414 100644
  
  /*
 diff --git a/lib/isc/pk11.c b/lib/isc/pk11.c
-index 0d5b009..bb9912b 100644
+index 0d5b009..7809e7b 100644
 --- a/lib/isc/pk11.c
 +++ b/lib/isc/pk11.c
 @@ -197,8 +197,6 @@ pk11_initialize(isc_mem_t *mctx, const char *engine) {
@@ -1227,14 +1227,14 @@ index 0d5b009..bb9912b 100644
  	}
  
  	ISC_LIST_INIT(tokens);
-@@ -236,6 +234,7 @@ pk11_initialize(isc_mem_t *mctx, const char *engine) {
- 		result = PK11_R_NOAESSERVICE;
- 		goto unlock;
+@@ -238,6 +236,7 @@ pk11_initialize(isc_mem_t *mctx, const char *engine) {
  	}
-+	initialized = true;
  #endif
  #endif /* PKCS11CRYPTO */
++	initialized = true;
   unlock:
+ 	UNLOCK(&sessionlock);
+ 	return (result);
 @@ -589,6 +588,8 @@ scan_slots(void) {
  	pk11_token_t *token;
  	unsigned int i;
@@ -1334,10 +1334,10 @@ index 0d5b009..bb9912b 100644
  
  		/* ECDSA requires digest */
 diff --git a/lib/isc/tests/hash_test.c b/lib/isc/tests/hash_test.c
-index 8ddfe70..9c4d299 100644
+index 31ced94..421131e 100644
 --- a/lib/isc/tests/hash_test.c
 +++ b/lib/isc/tests/hash_test.c
-@@ -776,6 +776,9 @@ isc_md5_test(void **state) {
+@@ -775,6 +775,9 @@ isc_md5_test(void **state) {
  
  	UNUSED(state);
  
@@ -1347,7 +1347,7 @@ index 8ddfe70..9c4d299 100644
  	/*
  	 * These are the various test vectors.  All of these are passed
  	 * through the hash function and the results are compared to the
-@@ -1631,6 +1634,9 @@ isc_hmacmd5_test(void **state) {
+@@ -1630,6 +1633,9 @@ isc_hmacmd5_test(void **state) {
  
  	UNUSED(state);
  
@@ -1357,7 +1357,7 @@ index 8ddfe70..9c4d299 100644
  	/*
  	 * These are the various test vectors.  All of these are passed
  	 * through the hash function and the results are compared to the
-@@ -1941,6 +1947,9 @@ static void
+@@ -1940,6 +1946,9 @@ static void
  md5_check_test(void **state) {
  	UNUSED(state);
  

From 8b8b3e97d61ab3a4286d796bd0159dd6ea268717 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 27 Aug 2019 20:46:46 +0200
Subject: [PATCH 18/55] Avoid conflicts between OpenSSL and native PKCS#11

Do not set default engine when native module should be used.
---
 bind-9.11-engine-pkcs11.patch | 27 +++++++++++++++++++++++++++
 bind.spec                     |  3 +++
 2 files changed, 30 insertions(+)
 create mode 100644 bind-9.11-engine-pkcs11.patch

diff --git a/bind-9.11-engine-pkcs11.patch b/bind-9.11-engine-pkcs11.patch
new file mode 100644
index 0000000..4a6290d
--- /dev/null
+++ b/bind-9.11-engine-pkcs11.patch
@@ -0,0 +1,27 @@
+From 37f89ccfc439f8d86c401d9ae10e94e53b924961 Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Tue, 27 Aug 2019 20:39:59 +0200
+Subject: [PATCH] Do not set engine for native PKCS11
+
+It resets already set lib_path to pkcs11, which is invalid in native
+pkcs11 crypto. Engine has to be path to PKCS#11 module.
+---
+ bin/named/include/named/globals.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/bin/named/include/named/globals.h b/bin/named/include/named/globals.h
+index eda2214..2a611d5 100644
+--- a/bin/named/include/named/globals.h
++++ b/bin/named/include/named/globals.h
+@@ -160,7 +160,7 @@ EXTERN const char *		ns_g_defaultdnstap	INIT(NULL);
+ 
+ EXTERN const char *		ns_g_username		INIT(NULL);
+ 
+-#if defined(USE_PKCS11)
++#if defined(USE_PKCS11) && !defined(PKCS11CRYPTO)
+ EXTERN const char *		ns_g_engine		INIT(PKCS11_ENGINE);
+ #else
+ EXTERN const char *		ns_g_engine		INIT(NULL);
+-- 
+2.20.1
+
diff --git a/bind.spec b/bind.spec
index b60b2a8..847fdcc 100644
--- a/bind.spec
+++ b/bind.spec
@@ -112,6 +112,8 @@ Patch140:bind-9.11-rh1410433.patch
 Patch145:bind-9.11-rh1205168.patch
 # [ISC-Bugs #46853] commit cb616c6d5c2ece1fac37fa6e0bca2b53d4043098 ISC 4851
 Patch149:bind-9.11-kyua-pkcs11.patch
+# Avoid conflicts with OpenSSL PKCS11 engine
+Patch150:bind-9.11-engine-pkcs11.patch
 Patch153:bind-9.11-export-suffix.patch
 Patch154:bind-9.11-oot-manual.patch
 Patch155:bind-9.11-pk11.patch
@@ -535,6 +537,7 @@ cp -r lib/isc{,-pkcs11}
 cp -r lib/dns{,-pkcs11}
 %patch136 -p1 -b .dist_pkcs11
 %patch149 -p1 -b .kyua-pkcs11
+%patch150 -p1 -b .engine-pkcs11
 %endif
 
 %if %{with SDB}

From 24eefb0147581938ea1335bddf2c1ee6745e3b40 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 3 Sep 2019 11:30:50 +0200
Subject: [PATCH 19/55] Move some administration utilities back to utils
 (#1720380)

Some utilities are not related DNSSEC at all, but are just bind related
tools. Because they do not require additional dependencies, they do not
save any space in containers.
---
 bind.spec | 51 +++++++++++++++++++++++----------------------------
 1 file changed, 23 insertions(+), 28 deletions(-)

diff --git a/bind.spec b/bind.spec
index 847fdcc..1243422 100644
--- a/bind.spec
+++ b/bind.spec
@@ -53,7 +53,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.11.10
-Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -311,10 +311,6 @@ Contains license of the BIND DNS suite.
 Summary: Utilities for querying DNS name servers
 Requires: bind-libs-lite%{?_isa} = %{epoch}:%{version}-%{release}
 Requires: bind-libs%{?_isa} = %{epoch}:%{version}-%{release}
-# TODO: this is just temporary workaround until all packages depending on
-# bind-utils can be satisfied without dnssec-utils
-# It will be removed after some time, or changed to Recommends
-Suggests: bind-dnssec-utils
 # For compatibility with Debian package
 Provides: dnsutils = %{epoch}:%{version}-%{release}
 
@@ -1282,46 +1278,42 @@ fi;
 %{_bindir}/nslookup
 %{_bindir}/nsupdate
 %{_bindir}/arpaname
+%{_sbindir}/ddns-confgen
+%{_sbindir}/tsig-keygen
+%{_sbindir}/genrandom
+%{_sbindir}/nsec3hash
+%{_sbindir}/isc-hmac-fixup
+%{_sbindir}/named-checkzone
+%{_sbindir}/named-compilezone
 %if %{with DNSTAP}
 %{_bindir}/dnstap-read
 %{_mandir}/man1/dnstap-read.1*
 %endif
+%if %{with LMDB}
+%{_sbindir}/named-nzd2nzf
+%{_mandir}/man8/named-nzd2nzf.8*
+%endif
 %{_mandir}/man1/host.1*
 %{_mandir}/man1/nsupdate.1*
 %{_mandir}/man1/dig.1*
 %{_mandir}/man1/delv.1*
 %{_mandir}/man1/nslookup.1*
 %{_mandir}/man1/arpaname.1*
-%{_sysconfdir}/trusted-key.key
-
-%files dnssec-utils
-%{_sbindir}/ddns-confgen
-%{_sbindir}/tsig-keygen
-%{_sbindir}/genrandom
-%{_sbindir}/nsec3hash
-%{_sbindir}/dnssec*
-%if %{with PKCS11}
-%exclude %{_sbindir}/dnssec*pkcs11
-%endif
-%{_sbindir}/isc-hmac-fixup
-%{_sbindir}/named-checkzone
-%{_sbindir}/named-compilezone
-%if %{with LMDB}
-%{_sbindir}/named-nzd2nzf
-%endif
 %{_mandir}/man8/ddns-confgen.8*
 %{_mandir}/man8/tsig-keygen.8*
 %{_mandir}/man8/genrandom.8*
 %{_mandir}/man8/nsec3hash.8*
-%{_mandir}/man8/dnssec*.8*
-%if %{with PKCS11}
-%exclude %{_mandir}/man8/dnssec*-pkcs11.8*
-%endif
 %{_mandir}/man8/isc-hmac-fixup.8*
 %{_mandir}/man8/named-checkzone.8*
 %{_mandir}/man8/named-compilezone.8*
-%if %{with LMDB}
-%{_mandir}/man8/named-nzd2nzf.8*
+%{_sysconfdir}/trusted-key.key
+
+%files dnssec-utils
+%{_sbindir}/dnssec*
+%{_mandir}/man8/dnssec*.8*
+%if %{with PKCS11}
+%exclude %{_sbindir}/dnssec*pkcs11
+%exclude %{_mandir}/man8/dnssec*-pkcs11.8*
 %endif
 
 %if %{with DEVEL}
@@ -1521,6 +1513,9 @@ fi;
 
 
 %changelog
+* Tue Sep 03 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.10-2
+- Move some administration utilities back to bind-utils (#1720380)
+
 * Tue Aug 27 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.10-1
 - Update to 9.11.10
 

From 6c5cdca7f807988c6492591d792ab915b504d55b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 3 Sep 2019 13:07:57 +0200
Subject: [PATCH 20/55] Move created empty directories to single define

Make it easier to manage list of used directories in chroot. Use
appropriate macros for system directories everywhere in chroot package.
Share common variable with -sdb-chroot and -chroot packages.
---
 bind.spec | 82 ++++++++++++++++++++++++++++---------------------------
 1 file changed, 42 insertions(+), 40 deletions(-)

diff --git a/bind.spec b/bind.spec
index 1243422..93e24a5 100644
--- a/bind.spec
+++ b/bind.spec
@@ -33,6 +33,10 @@
 %if %{with SDB}
 %global        chroot_sdb_prefix %{bind_dir}/chroot_sdb
 %endif
+%global        chroot_create_directories /dev /run/named %{_localstatedir}/{log,named,tmp} \\\
+                                         %{_sysconfdir}/{crypto-policies/back-ends,pki/dnssec-keys,named} \\\
+                                         %{_libdir}/bind
+
 %global        selinuxbooleans   named_write_master_zones=1
 ## The order of libs is important. See lib/Makefile.in for details
 %define bind_export_libs isc dns isccfg irs
@@ -836,44 +840,42 @@ else
 
 %install
 # Build directory hierarchy
-mkdir -p ${RPM_BUILD_ROOT}/etc/logrotate.d
+mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/logrotate.d
 mkdir -p ${RPM_BUILD_ROOT}%{_libdir}/bind
-mkdir -p ${RPM_BUILD_ROOT}/var/named/{slaves,data,dynamic}
+mkdir -p ${RPM_BUILD_ROOT}%{_localstatedir}/named/{slaves,data,dynamic}
 mkdir -p ${RPM_BUILD_ROOT}%{_mandir}/{man1,man5,man8}
 mkdir -p ${RPM_BUILD_ROOT}/run/named
-mkdir -p ${RPM_BUILD_ROOT}/var/log
+mkdir -p ${RPM_BUILD_ROOT}%{_localstatedir}/log
 
 #chroot
-mkdir -p ${RPM_BUILD_ROOT}/%{chroot_prefix}/{dev,etc,var,run/named}
-mkdir -p ${RPM_BUILD_ROOT}/%{chroot_prefix}/var/{log,named,tmp}
-mkdir -p ${RPM_BUILD_ROOT}/%{chroot_prefix}/etc/crypto-policies/back-ends
+for D in %{chroot_create_directories}
+do
+  mkdir -p ${RPM_BUILD_ROOT}/%{chroot_prefix}${D}
+done
 
 # create symlink as it is on real filesystem
 pushd ${RPM_BUILD_ROOT}/%{chroot_prefix}/var
 ln -s ../run run
 popd
 
-mkdir -p ${RPM_BUILD_ROOT}/%{chroot_prefix}/etc/{pki/dnssec-keys,named}
-mkdir -p ${RPM_BUILD_ROOT}/%{chroot_prefix}/%{_libdir}/bind
 # these are required to prevent them being erased during upgrade of previous
-touch ${RPM_BUILD_ROOT}/%{chroot_prefix}/etc/named.conf
+touch ${RPM_BUILD_ROOT}/%{chroot_prefix}%{_sysconfdir}/named.conf
 #end chroot
 
 #sdb-chroot
 %if %{with SDB}
-mkdir -p ${RPM_BUILD_ROOT}/%{chroot_sdb_prefix}/{dev,etc,var,run/named}
-mkdir -p ${RPM_BUILD_ROOT}/%{chroot_sdb_prefix}/var/{log,named,tmp}
-mkdir -p ${RPM_BUILD_ROOT}/%{chroot_sdb_prefix}/etc/crypto-policies/back-ends
+for D in %{chroot_create_directories}
+do
+  mkdir -p ${RPM_BUILD_ROOT}/%{chroot_sdb_prefix}${D}
+done
 
 # create symlink as it is on real filesystem
-pushd ${RPM_BUILD_ROOT}/%{chroot_sdb_prefix}/var
+pushd ${RPM_BUILD_ROOT}/%{chroot_sdb_prefix}%{_localstatedir}
 ln -s ../run run
 popd
 
-mkdir -p ${RPM_BUILD_ROOT}/%{chroot_sdb_prefix}/etc/{pki/dnssec-keys,named}
-mkdir -p ${RPM_BUILD_ROOT}/%{chroot_sdb_prefix}/%{_libdir}/bind
 # these are required to prevent them being erased during upgrade of previous
-touch ${RPM_BUILD_ROOT}/%{chroot_sdb_prefix}/etc/named.conf
+touch ${RPM_BUILD_ROOT}/%{chroot_sdb_prefix}%{_sysconfdir}/named.conf
 %endif
 #end sdb-chroot
 
@@ -1359,27 +1361,27 @@ fi;
 %defattr(0640,root,named,0750)
 %dir %{chroot_prefix}
 %dir %{chroot_prefix}/dev
-%dir %{chroot_prefix}/etc
-%dir %{chroot_prefix}/etc/named
-%dir %{chroot_prefix}/etc/pki
-%dir %{chroot_prefix}/etc/pki/dnssec-keys
-%dir %{chroot_prefix}/etc/crypto-policies
-%dir %{chroot_prefix}/etc/crypto-policies/back-ends
-%dir %{chroot_prefix}/var
+%dir %{chroot_prefix}%{_sysconfdir}
+%dir %{chroot_prefix}%{_sysconfdir}/named
+%dir %{chroot_prefix}%{_sysconfdir}/pki
+%dir %{chroot_prefix}%{_sysconfdir}/pki/dnssec-keys
+%dir %{chroot_prefix}%{_sysconfdir}/crypto-policies
+%dir %{chroot_prefix}%{_sysconfdir}/crypto-policies/back-ends
+%dir %{chroot_prefix}%{_localstatedir}
 %dir %{chroot_prefix}/run
-%ghost %config(noreplace) %{chroot_prefix}/etc/named.conf
+%ghost %config(noreplace) %{chroot_prefix}%{_sysconfdir}/named.conf
 %defattr(-,root,root,-)
 %dir %{chroot_prefix}/usr
 %dir %{chroot_prefix}/%{_libdir}
 %dir %{chroot_prefix}/%{_libdir}/bind
 %defattr(0660,root,named,01770)
-%dir %{chroot_prefix}/var/named
+%dir %{chroot_prefix}%{_localstatedir}/named
 %defattr(0660,named,named,0770)
-%dir %{chroot_prefix}/var/tmp
-%dir %{chroot_prefix}/var/log
+%dir %{chroot_prefix}%{_localstatedir}/tmp
+%dir %{chroot_prefix}%{_localstatedir}/log
 %defattr(-,named,named,-)
 %dir %{chroot_prefix}/run/named
-%{chroot_prefix}/var/run
+%{chroot_prefix}%{_localstatedir}/run
 
 %if %{with SDB}
 %files sdb-chroot
@@ -1395,27 +1397,27 @@ fi;
 %defattr(0640,root,named,0750)
 %dir %{chroot_sdb_prefix}
 %dir %{chroot_sdb_prefix}/dev
-%dir %{chroot_sdb_prefix}/etc
-%dir %{chroot_sdb_prefix}/etc/named
-%dir %{chroot_sdb_prefix}/etc/pki
-%dir %{chroot_sdb_prefix}/etc/pki/dnssec-keys
-%dir %{chroot_sdb_prefix}/etc/crypto-policies
-%dir %{chroot_sdb_prefix}/etc/crypto-policies/back-ends
-%dir %{chroot_sdb_prefix}/var
+%dir %{chroot_sdb_prefix}%{_sysconfdir}
+%dir %{chroot_sdb_prefix}%{_sysconfdir}/named
+%dir %{chroot_sdb_prefix}%{_sysconfdir}/pki
+%dir %{chroot_sdb_prefix}%{_sysconfdir}/pki/dnssec-keys
+%dir %{chroot_sdb_prefix}%{_sysconfdir}/crypto-policies
+%dir %{chroot_sdb_prefix}%{_sysconfdir}/crypto-policies/back-ends
+%dir %{chroot_sdb_prefix}%{_localstatedir}
 %dir %{chroot_sdb_prefix}/run
-%ghost %config(noreplace) %{chroot_sdb_prefix}/etc/named.conf
+%ghost %config(noreplace) %{chroot_sdb_prefix}%{_sysconfdir}/named.conf
 %defattr(0660,root,named,01770)
-%dir %{chroot_sdb_prefix}/var/named
+%dir %{chroot_sdb_prefix}%{_localstatedir}/named
 %defattr(-,root,root,-)
 %dir %{chroot_sdb_prefix}/usr
 %dir %{chroot_sdb_prefix}/%{_libdir}
 %dir %{chroot_sdb_prefix}/%{_libdir}/bind
 %defattr(0660,named,named,0770)
-%dir %{chroot_sdb_prefix}/var/tmp
-%dir %{chroot_sdb_prefix}/var/log
+%dir %{chroot_sdb_prefix}%{_localstatedir}/tmp
+%dir %{chroot_sdb_prefix}%{_localstatedir}/log
 %defattr(-,named,named,-)
 %dir %{chroot_sdb_prefix}/run/named
-%{chroot_sdb_prefix}/var/run
+%{chroot_sdb_prefix}%{_localstatedir}/run
 %endif
 
 %if %{with PKCS11}

From a2a1e000c5a4b2bb21b3e6f72388b1960519854e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 3 Sep 2019 13:12:13 +0200
Subject: [PATCH 21/55] Add GeoIP to bind-chroot (#1497646)

named can use ACLs defined by GeoIP of request. Such information is not
available by default under named-chroot service. Enable GeoIP databases
under chroot without explicit configuration.
---
 bind.spec          | 5 ++++-
 named-chroot.files | 1 +
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index 93e24a5..f45e8bc 100644
--- a/bind.spec
+++ b/bind.spec
@@ -35,7 +35,7 @@
 %endif
 %global        chroot_create_directories /dev /run/named %{_localstatedir}/{log,named,tmp} \\\
                                          %{_sysconfdir}/{crypto-policies/back-ends,pki/dnssec-keys,named} \\\
-                                         %{_libdir}/bind
+                                         %{_libdir}/bind %{_datadir}/GeoIP
 
 %global        selinuxbooleans   named_write_master_zones=1
 ## The order of libs is important. See lib/Makefile.in for details
@@ -1374,6 +1374,7 @@ fi;
 %dir %{chroot_prefix}/usr
 %dir %{chroot_prefix}/%{_libdir}
 %dir %{chroot_prefix}/%{_libdir}/bind
+%dir %{chroot_prefix}/%{_datadir}/GeoIP
 %defattr(0660,root,named,01770)
 %dir %{chroot_prefix}%{_localstatedir}/named
 %defattr(0660,named,named,0770)
@@ -1412,6 +1413,7 @@ fi;
 %dir %{chroot_sdb_prefix}/usr
 %dir %{chroot_sdb_prefix}/%{_libdir}
 %dir %{chroot_sdb_prefix}/%{_libdir}/bind
+%dir %{chroot_sdb_prefix}/%{_datadir}/GeoIP
 %defattr(0660,named,named,0770)
 %dir %{chroot_sdb_prefix}%{_localstatedir}/tmp
 %dir %{chroot_sdb_prefix}%{_localstatedir}/log
@@ -1517,6 +1519,7 @@ fi;
 %changelog
 * Tue Sep 03 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.10-2
 - Move some administration utilities back to bind-utils (#1720380)
+- Add GeoIP to bind-chroot (#1497646)
 
 * Tue Aug 27 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.10-1
 - Update to 9.11.10
diff --git a/named-chroot.files b/named-chroot.files
index b38cbe6..43c559a 100644
--- a/named-chroot.files
+++ b/named-chroot.files
@@ -16,6 +16,7 @@
 /etc/named
 /usr/lib64/bind
 /usr/lib/bind
+/usr/share/GeoIP
 /run/named
 # Warning: the order is important
 # If a directory containing $ROOTDIR is listed here,

From dbf171bc06bd7dd307743a373d14a3b319ed7e6b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 4 Sep 2019 19:12:36 +0200
Subject: [PATCH 22/55] Share pkcs11-utils and dnssec-utils manuals

Previous build recommended bind-dnssec-utils just to provide manual for
pkcs11 variants. Instead, share the same files between pkcs11-utils and
dnssec-utils. Skip unnecessary manual of non-existent dnssec-coverage-pkcs11 tool.
---
 bind.spec | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/bind.spec b/bind.spec
index f45e8bc..9086800 100644
--- a/bind.spec
+++ b/bind.spec
@@ -57,7 +57,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.11.10
-Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  3%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -981,7 +981,6 @@ install -m 644 %{SOURCE34} ${RPM_BUILD_ROOT}%{_mandir}/man1/zone2sqlite.1
 pushd ${RPM_BUILD_ROOT}%{_mandir}/man8
 ln -s named.8.gz named-pkcs11.8.gz
 ln -s dnssec-checkds.8.gz dnssec-checkds-pkcs11.8.gz
-ln -s dnssec-coverage.8.gz dnssec-coverage-pkcs11.8.gz
 ln -s dnssec-dsfromkey.8.gz dnssec-dsfromkey-pkcs11.8.gz
 ln -s dnssec-importkey.8.gz dnssec-importkey-pkcs11.8.gz
 ln -s dnssec-keyfromlabel.8.gz dnssec-keyfromlabel-pkcs11.8.gz
@@ -1437,6 +1436,9 @@ fi;
 %{_sbindir}/pkcs11-tokens
 %{_mandir}/man8/pkcs11*.8*
 %{_mandir}/man8/dnssec*-pkcs11.8*
+%{_mandir}/man8/dnssec*.8*
+%exclude %{_mandir}/man8/dnssec-coverage.8*
+%exclude %{_mandir}/man8/dnssec-keymgr.8*
 
 %files pkcs11-libs
 %{_libdir}/libdns-pkcs11.so.%{sover_dns}*
@@ -1517,6 +1519,9 @@ fi;
 
 
 %changelog
+* Wed Sep 04 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.10-3
+- Share pkcs11-utils and dnssec-utils manuals instead of recommend
+
 * Tue Sep 03 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.10-2
 - Move some administration utilities back to bind-utils (#1720380)
 - Add GeoIP to bind-chroot (#1497646)

From aa3e9e47d825e9af0f66f8533a9a52ee6f7fd879 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 5 Sep 2019 11:17:26 +0200
Subject: [PATCH 23/55] Do not skip gsstsig test in any named variants

Feature was skipped by mistake when moving feature-test into separate
directory.
---
 bind-9.10-dist-native-pkcs11.patch | 50 +++++++++++++++---------------
 bind-9.10-sdb.patch                | 14 ++++-----
 bind-9.11-feature-test-named.patch | 23 +++++++++++---
 3 files changed, 50 insertions(+), 37 deletions(-)

diff --git a/bind-9.10-dist-native-pkcs11.patch b/bind-9.10-dist-native-pkcs11.patch
index 0ba7ccc..df0d896 100644
--- a/bind-9.10-dist-native-pkcs11.patch
+++ b/bind-9.10-dist-native-pkcs11.patch
@@ -143,10 +143,10 @@ index 4b8ca13..4175996 100644
  CWARNINGS =
  
 diff --git a/bin/named-pkcs11/Makefile.in b/bin/named-pkcs11/Makefile.in
-index df1f7ee..f397ab0 100644
+index 70e5571..b5a4a6b 100644
 --- a/bin/named-pkcs11/Makefile.in
 +++ b/bin/named-pkcs11/Makefile.in
-@@ -43,27 +43,28 @@ DLZDRIVER_INCLUDES =	@DLZ_DRIVER_INCLUDES@
+@@ -43,27 +43,27 @@ DLZDRIVER_INCLUDES =	@DLZ_DRIVER_INCLUDES@
  DLZDRIVER_LIBS =	@DLZ_DRIVER_LIBS@
  
  CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
@@ -157,12 +157,12 @@ index df1f7ee..f397ab0 100644
  		${DLZDRIVER_INCLUDES} ${DBDRIVER_INCLUDES} ${MAXMINDDB_CFLAGS} \
  		@DST_OPENSSL_INC@
  
--CDEFINES =      @CONTRIB_DLZ@ @USE_PKCS11@ @PKCS11_ENGINE@ @CRYPTO@
-+CDEFINES =      @USE_PKCS11@ @PKCS11_ENGINE@ @CRYPTO_PK11@
+-CDEFINES =      @CONTRIB_DLZ@ @USE_PKCS11@ @PKCS11_ENGINE@ @USE_GSSAPI@ @CRYPTO@
++CDEFINES =      @USE_PKCS11@ @PKCS11_ENGINE@ @CRYPTO_PK11@ @USE_GSSAPI@
  
  CWARNINGS =
  
- DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
+-DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
 +DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
  ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
  ISCCCLIBS =	../../lib/isccc/libisccc.@A@
@@ -182,7 +182,7 @@ index df1f7ee..f397ab0 100644
  LWRESDEPLIBS =	../../lib/lwres/liblwres.@A@
  BIND9DEPLIBS =	../../lib/bind9/libbind9.@A@
  
-@@ -72,15 +73,15 @@ DEPLIBS =	${LWRESDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
+@@ -72,15 +72,15 @@ DEPLIBS =	${LWRESDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
  
  LIBS =		${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
  		${ISCCFGLIBS} ${ISCCCLIBS} ${ISCLIBS} \
@@ -201,7 +201,7 @@ index df1f7ee..f397ab0 100644
  
  GEOIPLINKOBJS = geoip.@O@
  GEOIP2LINKOBJS = geoip.@O@
-@@ -94,8 +95,7 @@ OBJS =		builtin.@O@ client.@O@ config.@O@ control.@O@ \
+@@ -94,8 +94,7 @@ OBJS =		builtin.@O@ client.@O@ config.@O@ control.@O@ \
  		tkeyconf.@O@ tsigconf.@O@ update.@O@ xfrout.@O@ \
  		zoneconf.@O@ \
  		lwaddr.@O@ lwresd.@O@ lwdclient.@O@ lwderror.@O@ lwdgabn.@O@ \
@@ -211,7 +211,7 @@ index df1f7ee..f397ab0 100644
  
  UOBJS =		unix/os.@O@ unix/dlz_dlopen_driver.@O@
  
-@@ -113,8 +113,7 @@ SRCS =		builtin.c client.c config.c control.c \
+@@ -113,8 +112,7 @@ SRCS =		builtin.c client.c config.c control.c \
  		tkeyconf.c tsigconf.c update.c xfrout.c \
  		zoneconf.c \
  		lwaddr.c lwresd.c lwdclient.c lwderror.c lwdgabn.c \
@@ -221,7 +221,7 @@ index df1f7ee..f397ab0 100644
  
  MANPAGES =	named.8 lwresd.8 named.conf.5
  
-@@ -154,21 +153,21 @@ server.@O@: server.c
+@@ -154,21 +152,21 @@ server.@O@: server.c
  		-DPRODUCT=\"${PRODUCT}\" \
  		-DVERSION=\"${VERSION}\" -c ${srcdir}/server.c
  
@@ -247,7 +247,7 @@ index df1f7ee..f397ab0 100644
  	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} \
  		-o $@ feature-test.@O@ ${ISCLIBS} ${LIBS}
  
-@@ -201,16 +200,11 @@ install-man8: named.8 lwresd.8
+@@ -201,16 +199,11 @@ install-man8: named.8 lwresd.8
  
  install-man: install-man5 install-man8
  
@@ -268,15 +268,15 @@ index df1f7ee..f397ab0 100644
  @DLZ_DRIVER_RULES@
  
 diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
-index df1f7ee..9660965 100644
+index 70e5571..4cfed4d 100644
 --- a/bin/named/Makefile.in
 +++ b/bin/named/Makefile.in
 @@ -48,7 +48,7 @@ CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
  		${DLZDRIVER_INCLUDES} ${DBDRIVER_INCLUDES} ${MAXMINDDB_CFLAGS} \
  		@DST_OPENSSL_INC@
  
--CDEFINES =      @CONTRIB_DLZ@ @USE_PKCS11@ @PKCS11_ENGINE@ @CRYPTO@
-+CDEFINES =      @CONTRIB_DLZ@ @CRYPTO@
+-CDEFINES =      @CONTRIB_DLZ@ @USE_PKCS11@ @PKCS11_ENGINE@ @USE_GSSAPI@ @CRYPTO@
++CDEFINES =      @CONTRIB_DLZ@ @USE_GSSAPI@ @CRYPTO@
  
  CWARNINGS =
  
@@ -302,7 +302,7 @@ index a058c91..d4b689a 100644
  DEPLIBS =	${ISCDEPLIBS}
  
 diff --git a/configure.ac b/configure.ac
-index 3b88105..0532feb 100644
+index 9b7d778..59ba20b 100644
 --- a/configure.ac
 +++ b/configure.ac
 @@ -1139,12 +1139,14 @@ AC_SUBST(USE_GSSAPI)
@@ -320,7 +320,7 @@ index 3b88105..0532feb 100644
  
  #
  # was --with-randomdev specified?
-@@ -1529,11 +1531,11 @@ fi
+@@ -1494,11 +1496,11 @@ AC_ARG_ENABLE(openssl-hash,
  AC_MSG_CHECKING(for OpenSSL library)
  OPENSSL_WARNING=
  openssldirs="/usr /usr/local /usr/local/ssl /opt/local /usr/pkg /usr/sfw"
@@ -337,7 +337,7 @@ index 3b88105..0532feb 100644
  
  if test "auto" = "$use_openssl"
  then
-@@ -1546,6 +1548,7 @@ then
+@@ -1511,6 +1513,7 @@ then
  		fi
  	done
  fi
@@ -345,7 +345,7 @@ index 3b88105..0532feb 100644
  OPENSSL_ECDSA=""
  OPENSSL_GOST=""
  OPENSSL_ED25519=""
-@@ -1567,11 +1570,10 @@ case "$with_gost" in
+@@ -1532,11 +1535,10 @@ case "$with_gost" in
  		;;
  esac
  
@@ -360,7 +360,7 @@ index 3b88105..0532feb 100644
  		CRYPTOLIB="pkcs11"
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
-@@ -1581,7 +1583,9 @@ case "$use_openssl" in
+@@ -1546,7 +1548,9 @@ case "$use_openssl" in
  		OPENSSLGOSTLINKSRCS=""
  		OPENSSLLINKOBJS=""
  		OPENSSLLINKSRCS=""
@@ -371,7 +371,7 @@ index 3b88105..0532feb 100644
  	no)
  		AC_MSG_RESULT(no)
  		DST_OPENSSL_INC=""
-@@ -1613,7 +1617,7 @@ case "$use_openssl" in
+@@ -1578,7 +1582,7 @@ case "$use_openssl" in
  If you do not want OpenSSL, use --without-openssl])
  		;;
  	*)
@@ -380,7 +380,7 @@ index 3b88105..0532feb 100644
  		then
  			AC_MSG_RESULT()
  			AC_MSG_ERROR([OpenSSL and native PKCS11 cannot be used together.])
-@@ -2041,6 +2045,7 @@ AC_SUBST(OPENSSL_ED25519)
+@@ -2006,6 +2010,7 @@ AC_SUBST(OPENSSL_ED25519)
  AC_SUBST(OPENSSL_GOST)
  
  DNS_CRYPTO_LIBS="$DNS_CRYPTO_LIBS $DST_OPENSSL_LIBS"
@@ -388,7 +388,7 @@ index 3b88105..0532feb 100644
  
  ISC_PLATFORM_WANTAES="#undef ISC_PLATFORM_WANTAES"
  if test "yes" = "$with_aes"
-@@ -2364,6 +2369,7 @@ esac
+@@ -2291,6 +2296,7 @@ esac
  AC_SUBST(PKCS11LINKOBJS)
  AC_SUBST(PKCS11LINKSRCS)
  AC_SUBST(CRYPTO)
@@ -396,7 +396,7 @@ index 3b88105..0532feb 100644
  AC_SUBST(PKCS11_ECDSA)
  AC_SUBST(PKCS11_GOST)
  AC_SUBST(PKCS11_ED25519)
-@@ -5491,8 +5497,11 @@ AC_CONFIG_FILES([
+@@ -5405,8 +5411,11 @@ AC_CONFIG_FILES([
  	bin/delv/Makefile
  	bin/dig/Makefile
  	bin/dnssec/Makefile
@@ -408,7 +408,7 @@ index 3b88105..0532feb 100644
  	bin/nsupdate/Makefile
  	bin/pkcs11/Makefile
  	bin/python/Makefile
-@@ -5565,6 +5574,10 @@ AC_CONFIG_FILES([
+@@ -5479,6 +5488,10 @@ AC_CONFIG_FILES([
  	lib/dns/include/dns/Makefile
  	lib/dns/include/dst/Makefile
  	lib/dns/tests/Makefile
@@ -419,7 +419,7 @@ index 3b88105..0532feb 100644
  	lib/irs/Makefile
  	lib/irs/include/Makefile
  	lib/irs/include/irs/Makefile
-@@ -5589,6 +5602,24 @@ AC_CONFIG_FILES([
+@@ -5503,6 +5516,24 @@ AC_CONFIG_FILES([
  	lib/isc/unix/include/Makefile
  	lib/isc/unix/include/isc/Makefile
  	lib/isc/unix/include/pkcs11/Makefile
@@ -533,7 +533,7 @@ index 7f09bd6..c388d9e 100644
  	rm -f include/dns/rdatastruct.h
  	rm -f dnstap.pb-c.c dnstap.pb-c.h
 diff --git a/lib/isc-pkcs11/Makefile.in b/lib/isc-pkcs11/Makefile.in
-index 98acfff..2fd6981 100644
+index 8ad54bb..a3ecdfb 100644
 --- a/lib/isc-pkcs11/Makefile.in
 +++ b/lib/isc-pkcs11/Makefile.in
 @@ -23,8 +23,8 @@ CINCLUDES =	-I${srcdir}/unix/include \
diff --git a/bind-9.10-sdb.patch b/bind-9.10-sdb.patch
index c72906c..ef9a8dc 100644
--- a/bind-9.10-sdb.patch
+++ b/bind-9.10-sdb.patch
@@ -14,7 +14,7 @@ index ce7a2da..4e6a824 100644
  
  @BIND9_MAKE_RULES@
 diff --git a/bin/named-sdb/Makefile.in b/bin/named-sdb/Makefile.in
-index 9660965..184fbb2 100644
+index 4cfed4d..c6b42b2 100644
 --- a/bin/named-sdb/Makefile.in
 +++ b/bin/named-sdb/Makefile.in
 @@ -30,10 +30,10 @@ VERSION=@BIND9_VERSION@
@@ -203,7 +203,7 @@ index 108b8d6..a943421 100644
  		      ISC_LOG_NOTICE, "exiting");
  	ns_log_shutdown();
 diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
-index 9660965..03f7c05 100644
+index 4cfed4d..f4bce7b 100644
 --- a/bin/named/Makefile.in
 +++ b/bin/named/Makefile.in
 @@ -45,10 +45,10 @@ DLZDRIVER_LIBS =	@DLZ_DRIVER_LIBS@
@@ -214,8 +214,8 @@ index 9660965..03f7c05 100644
 +		${MAXMINDDB_CFLAGS} \
  		@DST_OPENSSL_INC@
  
--CDEFINES =      @CONTRIB_DLZ@ @CRYPTO@
-+CDEFINES =      @CRYPTO@
+-CDEFINES =      @CONTRIB_DLZ@ @USE_GSSAPI@ @CRYPTO@
++CDEFINES =      @USE_GSSAPI@ @CRYPTO@
  
  CWARNINGS =
  
@@ -297,10 +297,10 @@ index c7e0868..95ab742 100644
 +	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zone2sqlite@EXEEXT@ ${DESTDIR}${sbindir}
  	${INSTALL_DATA} ${srcdir}/zone2ldap.1 ${DESTDIR}${mandir}/man1/zone2ldap.1
 diff --git a/configure.ac b/configure.ac
-index d8147ae..930cd1c 100644
+index f6380b1..318e533 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -5532,6 +5532,8 @@ AC_CONFIG_FILES([
+@@ -5416,6 +5416,8 @@ AC_CONFIG_FILES([
  	bin/named/unix/Makefile
  	bin/named-pkcs11/Makefile
  	bin/named-pkcs11/unix/Makefile
@@ -309,7 +309,7 @@ index d8147ae..930cd1c 100644
  	bin/nsupdate/Makefile
  	bin/pkcs11/Makefile
  	bin/python/Makefile
-@@ -5556,6 +5558,7 @@ AC_CONFIG_FILES([
+@@ -5440,6 +5442,7 @@ AC_CONFIG_FILES([
  	bin/python/isc/tests/dnskey_test.py
  	bin/python/isc/tests/policy_test.py
  	bin/rndc/Makefile
diff --git a/bind-9.11-feature-test-named.patch b/bind-9.11-feature-test-named.patch
index 8d5ef9a..c8e6d57 100644
--- a/bind-9.11-feature-test-named.patch
+++ b/bind-9.11-feature-test-named.patch
@@ -1,4 +1,4 @@
-From d394129acaa40ec7fc68ab27802f0a01fcd50f3d Mon Sep 17 00:00:00 2001
+From 3f2fafe5368655225eddf0537e58e425bbc297be Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Wed, 30 Jan 2019 14:37:17 +0100
 Subject: [PATCH] Create feature-test in source directory
@@ -6,15 +6,28 @@ Subject: [PATCH] Create feature-test in source directory
 Feature-test tool is used in system tests to test compiled in changes.
 Because we build more variants of named with different configuration,
 compile feature-test for each of them this way.
+
+Named variant specific feature-test does not have defined gss support,
+even when it was enabled by configure. bin/tests/system Makefile defines
+it, so define it also in named variants.
 ---
- bin/named/Makefile.in       | 11 ++++++++++-
+ bin/named/Makefile.in       | 13 +++++++++++--
  bin/tests/system/conf.sh.in |  2 +-
- 2 files changed, 11 insertions(+), 2 deletions(-)
+ 2 files changed, 12 insertions(+), 3 deletions(-)
 
 diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
-index 3166368..df1f7ee 100644
+index 3166368..70e5571 100644
 --- a/bin/named/Makefile.in
 +++ b/bin/named/Makefile.in
+@@ -48,7 +48,7 @@ CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
+ 		${DLZDRIVER_INCLUDES} ${DBDRIVER_INCLUDES} ${MAXMINDDB_CFLAGS} \
+ 		@DST_OPENSSL_INC@
+ 
+-CDEFINES =      @CONTRIB_DLZ@ @USE_PKCS11@ @PKCS11_ENGINE@ @CRYPTO@
++CDEFINES =      @CONTRIB_DLZ@ @USE_PKCS11@ @PKCS11_ENGINE@ @USE_GSSAPI@ @CRYPTO@
+ 
+ CWARNINGS =
+ 
 @@ -80,7 +80,7 @@ NOSYMLIBS =	${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
  
  SUBDIRS =	unix
@@ -41,7 +54,7 @@ index 3166368..df1f7ee 100644
  
  docclean manclean maintainer-clean::
 diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
-index 65c0c5a..117d6ec 100644
+index cedabbe..e1bf5da 100644
 --- a/bin/tests/system/conf.sh.in
 +++ b/bin/tests/system/conf.sh.in
 @@ -71,7 +71,7 @@ DNSTAPREAD=$TOP/bin/tools/dnstap-read

From 4a22ca2122691ae4abf0a665aa7647a92e45b361 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 27 Aug 2019 22:40:23 +0200
Subject: [PATCH 24/55] Fix source fetching

---
 tests/Run-internal-BIND-test-suite/runtest.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/Run-internal-BIND-test-suite/runtest.sh b/tests/Run-internal-BIND-test-suite/runtest.sh
index 7f4d212..123c321 100755
--- a/tests/Run-internal-BIND-test-suite/runtest.sh
+++ b/tests/Run-internal-BIND-test-suite/runtest.sh
@@ -70,7 +70,7 @@ rlJournalStart
 
         # download src rpm
 	if ! ls bind*.src.rpm; then
-		rlRun "dnf --enablerepo='*-source' download bind.src" 0 "Fetch source from repository"
+		rlRun "dnf --enablerepo='*-source' download --source bind" 0 "Fetch source from repository"
 		rlRun "rpm -i bind*.src.rpm"
 	fi
 	

From b95c9e042ff524a77c79d8384bca598181f7ea1e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 27 Aug 2019 23:30:55 +0200
Subject: [PATCH 25/55] Precise timing perl package is required

---
 tests/Run-internal-BIND-test-suite/Makefile | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tests/Run-internal-BIND-test-suite/Makefile b/tests/Run-internal-BIND-test-suite/Makefile
index 2343d3d..401971c 100644
--- a/tests/Run-internal-BIND-test-suite/Makefile
+++ b/tests/Run-internal-BIND-test-suite/Makefile
@@ -57,6 +57,7 @@ $(METADATA): Makefile
 	@echo "RunFor:          bind" >> $(METADATA)
 	@echo "Requires:        bind rpm-build bind-utils" >> $(METADATA)
 	@echo "Requires:        perl-Net-DNS perl-Net-DNS-Nameserver" >> $(METADATA)
+	@echo "Requires:        perl-Time-HiRes" >> $(METADATA)
 	@echo "Requires:        bind-pkcs11 bind-pkcs11-utils softhsm" >> $(METADATA)
 	@echo "Requires:        openssl-devel libtool autoconf" >> $(METADATA)
 	@echo "Requires:        libcap-devel libidn-devel libxml2-devel" >> $(METADATA) 

From 4bb648c19ebfc390e63420d348db025e78ca7c96 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 27 Aug 2019 21:27:47 +0200
Subject: [PATCH 26/55] Modify test suite to include also variants

Run system tests for each variants.
---
 tests/Run-internal-BIND-test-suite/runtest.sh | 77 ++++++++++++-------
 1 file changed, 50 insertions(+), 27 deletions(-)

diff --git a/tests/Run-internal-BIND-test-suite/runtest.sh b/tests/Run-internal-BIND-test-suite/runtest.sh
index 123c321..92d96a2 100755
--- a/tests/Run-internal-BIND-test-suite/runtest.sh
+++ b/tests/Run-internal-BIND-test-suite/runtest.sh
@@ -32,6 +32,40 @@
 
 PACKAGE="bind"
 
+#
+# Runs test suite and checks known errors
+# Prepared to be repeated with another variants
+run_testsuite()
+{
+	local RESULT_TEXT="$TMPDIR/test${NAMED_VARIANT}.txt"
+	local FOUNDERROR=`mktemp found-XXXXXXXX.err`
+	local KNOWNERROR
+
+	if [ -f "$ORIG/knownerror${NAMED_VARIANT}.$TAG" ]; then
+		KNOWNERROR=`readlink -f $ORIG/knownerror.$TAG`
+	elif [ -f "$ORIG/knownerror${NAMED_VARIANT}" ]; then
+		KNOWNERROR=`readlink -f $ORIG/knownerror`
+	fi
+
+	# Sometime it can fail. Report just failures that are not known
+        rlRun "make test -j${CORES:-1} &> $RESULT_TEXT" 0-255 "Perform the test."
+        rlRun "grep -C 10 FAIL $RESULT_TEXT" 0-255 "Quickly show the test error (if any)."
+
+	rlRun "$FILTER $RESULT_TEXT" 0 "Showing unsuccessful tests"
+	rlRun "$FILTER -s $RESULT_TEXT > $FOUNDERROR" 0
+	rlRun "ls $KNOWNERROR $FOUNDERROR $RESULT_TEXT" 0 'check if there is needed files'
+	rlLog "`cat $FOUNDERROR`"
+
+	rlAssertLesserOrEqual "Checking number of found errors is in limits" "$(grep '^FAIL' $FOUNDERROR | wc -l)" "$(wc -l <$KNOWNERROR)"
+        cat $FOUNDERROR | while read STATUS TEST ; do
+		if [ "$STATUS" = FAIL ]; then
+			rlRun "grep '$TEST' $KNOWNERROR" 0 "Check $TEST failure is expected"
+		else
+			rlLog "$STATUS $TEST"
+		fi
+        done
+}
+
 rlJournalStart
     rlPhaseStartSetup
         # package assertions
@@ -41,9 +75,9 @@ rlJournalStart
 
 	#pwd
 	ORIG=`pwd`
-	FOUNDERROR=`mktemp`
 	SETUP_SOFTHSM=`readlink -f setup-named-softhsm.sh`
 	FILTER=`readlink -f bind-systest-filter.sh`
+	CORES=`grep 'processor\s*:' /proc/cpuinfo | wc -l`
 
 	TAG=generic
 	if [ -f /etc/os-release ]; then
@@ -51,12 +85,6 @@ rlJournalStart
 		TAG=`(source /etc/os-release && echo ${PLATFORM_ID#platform:})`
 	fi
 
-	if [ -f "knownerror.$TAG" ]; then
-		KNOWNERROR=`readlink -f knownerror.$TAG`
-	elif [ -f "knownerror" ]; then
-		KNOWNERROR=`readlink -f knownerror`
-	fi
-
         #tempdir
         rlRun "TMPDIR=\`mktemp -d\`" 0 "Creating tmp directory"
         rlRun "pushd $TMPDIR"
@@ -113,34 +141,29 @@ rlJournalStart
 	export LC_ALL=en_US.UTF-8
 
         rlRun "pushd $BUILD"
-        rlRun "make test &> $TMPDIR/test.txt" 0-255 "Perform the test."
-        rlRun "popd"
 
-        rlRun "grep -C 10 FAIL $TMPDIR/test.txt" 0-255 "Quickly show the test error (if any)."
+	rlLog "Running normal variant"
+	export NAMED_VARIANT= DNSSEC_VARIANT=
+	run_testsuite
+
+	rlLog "Running pkcs11 variant"
+	export NAMED_VARIANT=-pkcs11 DNSSEC_VARIANT=-pkcs11
+	run_testsuite
+
+	rlLog "Running sdb variant"
+	export NAMED_VARIANT=-sdb DNSSEC_VARIANT=
+	run_testsuite
+
+        rlRun "popd"
 
         rlRun "./bin/tests/system/ifconfig.sh down" 0 "Remove fake network interfaces."
 
-
-	#list of failures:
-	rlRun "$FILTER $TMPDIR/test.txt" 0 "Showing unsuccessful tests"
-	rlRun "$FILTER -s $TMPDIR/test.txt > $FOUNDERROR" 0
-	rlRun "ls $KNOWNERROR $FOUNDERROR $TMPDIR/test.txt" 0 'check if there is needed files'
-	rlLog "`cat $FOUNDERROR`"
-
-	rlAssertLesserOrEqual "Checking number of found errors is in limits" "$(grep '^FAIL' $FOUNDERROR | wc -l)" "$(wc -l <$KNOWNERROR)"
-        cat $FOUNDERROR | while read STATUS TEST ; do
-		if [ "$STATUS" = FAIL ]; then
-			rlRun "grep '$TEST' $KNOWNERROR" 0 "Check $TEST failure is expected"
-		else
-			rlLog "$STATUS $TEST"
-		fi
-        done
     rlPhaseEnd
 
     rlPhaseStartCleanup
-        rlBundleLogs "TEST_LOGS" "$TMPDIR/install.txt" "$TMPDIR/builddeps.txt" "$TMPDIR/build.txt" "$TMPDIR/test.txt"
+        rlBundleLogs "BUILD_LOGS" "$TMPDIR/install.txt" "$TMPDIR/builddeps.txt" "$TMPDIR/build.txt"
+        rlBundleLogs "TEST_LOGS" "$TMPDIR"/test*.txt
         rlRun "popd"
         rlRun "rm -r $TMPDIR" 0 "Removing tmp directory"
-	rlRun "rm -rf $FOUNDERROR"
     rlPhaseEnd
 rlJournalEnd

From ec1d8fb14fb578c0ddd8a559ec99d1573c98cf4a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 28 Aug 2019 00:16:40 +0200
Subject: [PATCH 27/55] Make tests optional

Make it possible to skip some test using parameter. In some cases, just
single pass is required.
Also fix case when no known defects are specified for a variant.
---
 tests/Run-internal-BIND-test-suite/runtest.sh | 32 +++++++++++++------
 1 file changed, 22 insertions(+), 10 deletions(-)

diff --git a/tests/Run-internal-BIND-test-suite/runtest.sh b/tests/Run-internal-BIND-test-suite/runtest.sh
index 92d96a2..be5ef5b 100755
--- a/tests/Run-internal-BIND-test-suite/runtest.sh
+++ b/tests/Run-internal-BIND-test-suite/runtest.sh
@@ -32,6 +32,10 @@
 
 PACKAGE="bind"
 
+# Set those variables to n to skip tests on variants
+DEFAULT_VARIANTS="normal pkcs11 sdb"
+#TEST_VARIANTS="normal"
+
 #
 # Runs test suite and checks known errors
 # Prepared to be repeated with another variants
@@ -39,7 +43,7 @@ run_testsuite()
 {
 	local RESULT_TEXT="$TMPDIR/test${NAMED_VARIANT}.txt"
 	local FOUNDERROR=`mktemp found-XXXXXXXX.err`
-	local KNOWNERROR
+	local KNOWNERROR=/dev/null
 
 	if [ -f "$ORIG/knownerror${NAMED_VARIANT}.$TAG" ]; then
 		KNOWNERROR=`readlink -f $ORIG/knownerror.$TAG`
@@ -142,17 +146,25 @@ rlJournalStart
 
         rlRun "pushd $BUILD"
 
-	rlLog "Running normal variant"
-	export NAMED_VARIANT= DNSSEC_VARIANT=
-	run_testsuite
+	if echo "${TEST_VARIANTS:-$DEFAULT_VARIANTS}" | grep -q normal; then
+		rlLog "Running normal variant"
+		export NAMED_VARIANT= DNSSEC_VARIANT=
+		run_testsuite
+	fi
 
-	rlLog "Running pkcs11 variant"
-	export NAMED_VARIANT=-pkcs11 DNSSEC_VARIANT=-pkcs11
-	run_testsuite
+	if echo "${TEST_VARIANTS:-$DEFAULT_VARIANTS}" | grep -q sdb; then
+		rlLog "Running sdb variant"
+		export NAMED_VARIANT=-sdb DNSSEC_VARIANT=
+		run_testsuite
+	fi
 
-	rlLog "Running sdb variant"
-	export NAMED_VARIANT=-sdb DNSSEC_VARIANT=
-	run_testsuite
+	if echo "${TEST_VARIANTS:-$DEFAULT_VARIANTS}" | grep -q pkcs11; then
+		rlLog "Running pkcs11 variant"
+		# Unfortunately, PKCS11 variant uses shared key storage
+		# It cannot use more threads for that reason
+		export NAMED_VARIANT=-pkcs11 DNSSEC_VARIANT=-pkcs11
+		CORES=1 run_testsuite
+	fi
 
         rlRun "popd"
 

From 5110c5b01182c9dab960bf49050c26f14d481e19 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 28 Aug 2019 00:42:54 +0200
Subject: [PATCH 28/55] Use also termination logs to measure time

Might use different approach to display grouped results.
---
 tests/Run-internal-BIND-test-suite/runtest.sh | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/tests/Run-internal-BIND-test-suite/runtest.sh b/tests/Run-internal-BIND-test-suite/runtest.sh
index be5ef5b..0286d6c 100755
--- a/tests/Run-internal-BIND-test-suite/runtest.sh
+++ b/tests/Run-internal-BIND-test-suite/runtest.sh
@@ -150,12 +150,14 @@ rlJournalStart
 		rlLog "Running normal variant"
 		export NAMED_VARIANT= DNSSEC_VARIANT=
 		run_testsuite
+		rlLog "Finished normal variant"
 	fi
 
 	if echo "${TEST_VARIANTS:-$DEFAULT_VARIANTS}" | grep -q sdb; then
 		rlLog "Running sdb variant"
 		export NAMED_VARIANT=-sdb DNSSEC_VARIANT=
 		run_testsuite
+		rlLog "Finished sdb variant"
 	fi
 
 	if echo "${TEST_VARIANTS:-$DEFAULT_VARIANTS}" | grep -q pkcs11; then
@@ -164,6 +166,7 @@ rlJournalStart
 		# It cannot use more threads for that reason
 		export NAMED_VARIANT=-pkcs11 DNSSEC_VARIANT=-pkcs11
 		CORES=1 run_testsuite
+		rlLog "Finished pkcs11 variant"
 	fi
 
         rlRun "popd"

From d26ba37ec9944a2112f4878c341520d32d2fb77f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 28 Aug 2019 09:50:44 +0200
Subject: [PATCH 29/55] Update and simplify package requirements

bind-devel should now provide all dependencies required. Omit explicitl
requirements for building. Drop atf building support, since upstream
moved to cmocka.
---
 tests/Run-internal-BIND-test-suite/Makefile | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/tests/Run-internal-BIND-test-suite/Makefile b/tests/Run-internal-BIND-test-suite/Makefile
index 401971c..0b90930 100644
--- a/tests/Run-internal-BIND-test-suite/Makefile
+++ b/tests/Run-internal-BIND-test-suite/Makefile
@@ -60,12 +60,14 @@ $(METADATA): Makefile
 	@echo "Requires:        perl-Time-HiRes" >> $(METADATA)
 	@echo "Requires:        bind-pkcs11 bind-pkcs11-utils softhsm" >> $(METADATA)
 	@echo "Requires:        openssl-devel libtool autoconf" >> $(METADATA)
-	@echo "Requires:        libcap-devel libidn-devel libxml2-devel" >> $(METADATA) 
-	@echo "Requires:        openldap-devel postgresql-devel" >> $(METADATA)
-	@echo "Requires:        sqlite-devel krb5-devel net-tools" >> $(METADATA)
+# Try to satisfy all build dependencies from here
+	@echo "Requires:        bind-devel" >> $(METADATA)
+	@echo "Requires:        net-tools" >> $(METADATA)
 	@echo "Requires:        dnf-utils" >> $(METADATA)
-	@echo "Requires:        kyua libatf-c" >> $(METADATA)
-	@echo "Requires:        gcc-c++" >> $(METADATA)
+	@echo "Requires:        kyua" >> $(METADATA)
+	@echo "Requires:        libcmocka-devel" >> $(METADATA)
+# Obsolete, uses cmocka
+#	@echo "Requires:        libatf-c gcc-c++" >> $(METADATA)
 	@echo "Priority:        Normal" >> $(METADATA)
 	@echo "License:         GPLv2" >> $(METADATA)
 	@echo "Confidential:    no" >> $(METADATA)

From a4a464984eedc3f2e3b343c37bd2d7def984df12 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 28 Aug 2019 09:52:49 +0200
Subject: [PATCH 30/55] Add internal test suite to set of tests

---
 tests/tests.yml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/tests/tests.yml b/tests/tests.yml
index cc363a0..15360ed 100644
--- a/tests/tests.yml
+++ b/tests/tests.yml
@@ -8,9 +8,19 @@
     tests:
     - Master-server-chrooted
     - Master-server-not-chrooted
+    - Run-internal-BIND-test-suite
     required_packages:
     - bind
     - bind-chroot
     - bind-sdb-chroot
     - redhat-lsb
     - bind-utils
+    - dnf-utils
+    - kyua
+    - bind-devel
+    - perl-Net-DNS
+    - perl-Net-DNS-Nameserver
+    - perl-Time-HiRes
+    - softhsm
+    - bind-pkcs11
+    - bind-pkcs11-utils

From 730f052905766eb6b553d35f460108966f175c9c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 25 Sep 2019 20:33:26 +0200
Subject: [PATCH 31/55] Use just normal variant by default

Testing takes quite long. For now, use by default only normal variant.
SDB variant is not much used and pkcs11 variant is failing now. Keep
ability to enable variants by parameter:
   TEST_VARIANTS="normal sdb pkcs11"
---
 tests/Run-internal-BIND-test-suite/runtest.sh | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tests/Run-internal-BIND-test-suite/runtest.sh b/tests/Run-internal-BIND-test-suite/runtest.sh
index 0286d6c..7066344 100755
--- a/tests/Run-internal-BIND-test-suite/runtest.sh
+++ b/tests/Run-internal-BIND-test-suite/runtest.sh
@@ -33,7 +33,8 @@
 PACKAGE="bind"
 
 # Set those variables to n to skip tests on variants
-DEFAULT_VARIANTS="normal pkcs11 sdb"
+#DEFAULT_VARIANTS="normal pkcs11 sdb"
+DEFAULT_VARIANTS="normal"
 #TEST_VARIANTS="normal"
 
 #

From 8fd9eb990fc0ab440ffc3f5fae18d5e5eed6250e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 25 Sep 2019 21:24:23 +0200
Subject: [PATCH 32/55] Update to 9.11.11

- Interaction between DNS64 and RPZ No Data rule (CNAME *.) could
  cause unexpected results; this has been fixed. [GL #1106]

- named-checkconf now checks DNS64 prefixes
  to ensure bits 64-71 are zero. [GL #1159]

- named-checkconf could crash during configuration
  if configured to use "geoip continent" ACLs with
  legacy GeoIP. [GL #1163]

- named-checkconf now correctly reports missing
  dnstap-output option when
  dnstap is set. [GL #1136

- Handle ETIMEDOUT error on connect() with a non-blocking
  socket. [GL #1133]
---
 .gitignore              |  1 +
 bind-9.11.10.tar.gz.asc | 16 ----------------
 bind-9.11.11.tar.gz.asc | 16 ++++++++++++++++
 sources                 |  2 +-
 4 files changed, 18 insertions(+), 17 deletions(-)
 delete mode 100644 bind-9.11.10.tar.gz.asc
 create mode 100644 bind-9.11.11.tar.gz.asc

diff --git a/.gitignore b/.gitignore
index b64b4e5..356fdd9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -95,3 +95,4 @@ bind-9.7.2b1.tar.gz
 /bind-9.11.8.tar.gz
 /bind-9.11.9.tar.gz
 /bind-9.11.10.tar.gz
+/bind-9.11.11.tar.gz
diff --git a/bind-9.11.10.tar.gz.asc b/bind-9.11.10.tar.gz.asc
deleted file mode 100644
index 8ea66c9..0000000
--- a/bind-9.11.10.tar.gz.asc
+++ /dev/null
@@ -1,16 +0,0 @@
------BEGIN PGP SIGNATURE-----
-
-iQIzBAABAgAdFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAl1VKuIACgkQdLtrmky7
-PThvHg/+O+c3U/k/3wYB5XAmT2HSCIqIp8gdu4+0B4rsIJAN+aR1HDIsCTuJqyjw
-jw9fI61d5skxeJljbNChAMTC2Ps1W7bXHFC8B25WQvQAcL/FDJQrLtgRXCJKB9sd
-/hss07hGrrZbE5wRePJJtn4R1d6WLoA/hz1da7IcoZJpFPmlkHE9kZUd9mPAHnMv
-QYCqpl821m53UMENufyrwNMDTaIwqPM4fJ8OVBam/743ZIOP/imwMVnJws6HjRz1
-n4JPoKsMkLOTV0hDotgTl7V1qm4EXKG5xPM882frpfRkk/V/qOvEzLkgVLDF6xHR
-iuZsMvKfrc/VyrKRcQNHs2kA0EqbKfskLoSenj7B/WrvVCeQ+MA4MSg/81Rzzs6P
-gDDCMcWY3X2VlYUA521Z9DagoC49DpfKf+rfeCH/HTNjdWkfClnQoGb9n5Ggy/sM
-NP/ApLN2TOHqMIMU0RGr2U3OY8TNmpq7xfggnr3qL5Of1ez4HYlyLdmma3HPJjvY
-uYdJwVRcJ7rq510QBSf8VGK9/qERkhklh4MZvIzS5htnn+94Gk3gT8p3aZGQ5z2d
-W2RVl+4HQ7aRtQMeQeX79uccVF9vcTBTiAJhILYcp7Q6NBOVMTCabSAnRk3f0GfS
-1x+Ojt+7yVCB3pym8N+mHM3q8l7VvIw1As7QAGi6mdVAaTN8zxc=
-=ZIsR
------END PGP SIGNATURE-----
diff --git a/bind-9.11.11.tar.gz.asc b/bind-9.11.11.tar.gz.asc
new file mode 100644
index 0000000..1ad0c7b
--- /dev/null
+++ b/bind-9.11.11.tar.gz.asc
@@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABAgAdFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAl16E/oACgkQdLtrmky7
+PTj5wQ//ZzItGqypNVGqYlocyQZRjvzjqJiPwIfgp7qpvDxQp7CPNuPqx35G0Xu6
+UJNKGZfJRKCoIrnN1QdBCXe+6ggl2O7iB3LJAeOiWz7oPj4DI2xTDu2oKKBkqLwF
+OimFr5B3F8wn59Bn2WgBpqjM3rv+kW2sQpahfBaYSYhqg0hmgOtn3Ksiopy+32l9
+0SNVhXtI+s1x2MCEdGweb24FJ663VC2rx5PJaD/59VPW3tXanemmTq6rLvdht+OE
+8zmTTQDPTu3CJFBnOwxBLvuvQDHvbVqiaU0o6nVHBow5D3FxL2R9ybNGBETY5af0
+7NqH9XEoeKFFRRdsEcTIRuLVQMdPl3dHWjCW0LeGjdOOwN5H8Yc1DGhfAaS3cD26
+d6L3cr6X9M7zTbKPTCYeNh/ydA3o4HRZV2LW3txac4qz2wxNaXytfsIGKb0Ag08U
+5MdGBdBbavDsX8aaRUHB0uiLL2U6rIm9dHeXWeed4B45YWMQ/kyEWqV5LYCHLq4F
+Hl2Tnjmp3YeE5qJHJtyXpOhhMYTVm6xACe72djyifxlJZlagBZihEc1D7xy/+Dmg
+JsBoA/X9C8RYGR/uAfxFiTQRNJtRdbPg168m/fV3cqo7m9mZGUdJOF51TSEOzfxx
+6RFuOl+R0YvyTtjBZaY2eeKRLdSc0uLHETRh+NmBHDx8bxSm8DM=
+=/ZDI
+-----END PGP SIGNATURE-----
diff --git a/sources b/sources
index c992ba3..31c6abf 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.11.10.tar.gz) = b560cd6b88df0ffe0008d0559b49c28fbe4ed49da1a81e61c373faa5368ad1570c4cf945d224b451634f7506e52d9effb9aee3966c5ff66d95215fffea494f4e
+SHA512 (bind-9.11.11.tar.gz) = 52a3e94b686bb8a9c5ec327bb9a23c6f94762a9c6f2080bfe06feb07ec432ece5f6554bdd4f5e9f39cc77e7da4c8330449d89e3dc92716e133c5be41a867d7a0
 SHA512 (config-19.tar.bz2) = 36aa38a0c7c33267ae594b31c81681290ac58dde7ca6749bd599da531380b5b1428330813dbe983e01071ccaed83e83f6a9cd92179a53b7d0ccbb6851a0b017c

From 8259847d3327121396db5cbe48b3bc9378464b16 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 25 Sep 2019 21:30:47 +0200
Subject: [PATCH 33/55] Adjust downstream patches to 9.11.11

---
 bind-9.11-rt31459.patch | 23 +++++++++++------------
 bind.spec               |  7 +++++--
 2 files changed, 16 insertions(+), 14 deletions(-)

diff --git a/bind-9.11-rt31459.patch b/bind-9.11-rt31459.patch
index 27d8273..8413061 100644
--- a/bind-9.11-rt31459.patch
+++ b/bind-9.11-rt31459.patch
@@ -1,4 +1,4 @@
-From 9f62d68da08d21a8b35e27aeebd00afe6e5fb7be Mon Sep 17 00:00:00 2001
+From 108a0f57f423a27995ac96272832278f4aa3a612 Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Tue, 12 Sep 2017 19:05:46 -0700
 Subject: [PATCH] rebased rt31459c
@@ -24,7 +24,7 @@ Include new unit test
  bin/named/server.c                       |   6 +
  bin/nsupdate/nsupdate.c                  |  14 +-
  bin/tests/makejournal.c                  |   6 +-
- bin/tests/system/pipelined/pipequeries.c |  21 +-
+ bin/tests/system/pipelined/pipequeries.c |  20 +-
  bin/tests/system/pipelined/tests.sh      |   4 +-
  bin/tests/system/rsabigexponent/bigkey.c |   4 +
  bin/tests/system/tkey/keycreate.c        |  26 ++-
@@ -49,7 +49,7 @@ Include new unit test
  lib/isc/pk11.c                           |  12 +-
  lib/isc/win32/include/isc/platform.h.in  |   5 +
  win32utils/Configure                     |  28 ++-
- 36 files changed, 702 insertions(+), 175 deletions(-)
+ 36 files changed, 701 insertions(+), 175 deletions(-)
  create mode 100644 lib/dns/tests/dstrandom_test.c
 
 diff --git a/bin/confgen/keygen.c b/bin/confgen/keygen.c
@@ -386,7 +386,7 @@ index 61a41b0..acc71a1 100644
  	isc_log_registercategories(lctx, categories);
  	isc_log_setcontext(lctx);
 diff --git a/bin/tests/system/pipelined/pipequeries.c b/bin/tests/system/pipelined/pipequeries.c
-index 2fcc064..7b4f617 100644
+index c6ab7f8..f0a6ff2 100644
 --- a/bin/tests/system/pipelined/pipequeries.c
 +++ b/bin/tests/system/pipelined/pipequeries.c
 @@ -204,6 +204,7 @@ sendqueries(isc_task_t *task, isc_event_t *event) {
@@ -397,17 +397,16 @@ index 2fcc064..7b4f617 100644
  	isc_sockaddr_t bind_any;
  	struct in_addr inaddr;
  	isc_result_t result;
-@@ -224,7 +225,8 @@ main(int argc, char *argv[]) {
- 	UNUSED(argv);
+@@ -222,7 +223,7 @@ main(int argc, char *argv[]) {
+ 	int c;
  
  	isc_commandline_errprint = false;
 -	while ((c = isc_commandline_parse(argc, argv, "p:")) != -1) {
-+	while ((c = isc_commandline_parse(argc, argv, "p:r:")) != -1)
-+	{
++	while ((c = isc_commandline_parse(argc, argv, "p:r:")) != -1) {
  		switch (c) {
  		case 'p':
  			result = isc_parse_uint16(&port,
-@@ -235,6 +237,9 @@ main(int argc, char *argv[]) {
+@@ -233,6 +234,9 @@ main(int argc, char *argv[]) {
  				exit(1);
  			}
  			break;
@@ -417,7 +416,7 @@ index 2fcc064..7b4f617 100644
  		case '?':
  			fprintf(stderr, "%s: invalid argument '%c'",
  				argv[0], c);
-@@ -276,10 +281,18 @@ main(int argc, char *argv[]) {
+@@ -275,10 +279,18 @@ main(int argc, char *argv[]) {
  
  	ectx = NULL;
  	RUNCHECK(isc_entropy_create(mctx, &ectx));
@@ -438,7 +437,7 @@ index 2fcc064..7b4f617 100644
  
  	taskmgr = NULL;
  	RUNCHECK(isc_taskmgr_create(mctx, 1, 0, &taskmgr));
-@@ -332,8 +345,8 @@ main(int argc, char *argv[]) {
+@@ -331,8 +343,8 @@ main(int argc, char *argv[]) {
  	isc_task_detach(&task);
  	isc_taskmgr_destroy(&taskmgr);
  
@@ -1974,7 +1973,7 @@ index 42ff7e0..8d87c44 100644
  typedef int (*isc_sockfdwatch_t)(isc_task_t *, isc_socket_t *, void *, int);
  
 diff --git a/lib/isc/pk11.c b/lib/isc/pk11.c
-index bb9912b..1f583a3 100644
+index 7809e7b..c43357a 100644
 --- a/lib/isc/pk11.c
 +++ b/lib/isc/pk11.c
 @@ -321,14 +321,16 @@ pk11_rand_seed_fromfile(const char *randomfile) {
diff --git a/bind.spec b/bind.spec
index 9086800..fc316b2 100644
--- a/bind.spec
+++ b/bind.spec
@@ -56,8 +56,8 @@
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.11.10
-Release:  3%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Version:  9.11.11
+Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1519,6 +1519,9 @@ fi;
 
 
 %changelog
+* Wed Sep 25 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.11-1
+- Update to 9.11.11
+
 * Wed Sep 04 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.10-3
 - Share pkcs11-utils and dnssec-utils manuals instead of recommend
 

From 8632dab80ac496f67e77f5df42aba383102e883f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 21 Oct 2019 14:25:02 +0200
Subject: [PATCH 34/55] Update to 9.11.12 (#1557762)

---
 .gitignore              |  1 +
 bind-9.11.11.tar.gz.asc | 16 ----------------
 bind-9.11.12.tar.gz.asc | 16 ++++++++++++++++
 bind.spec               |  5 ++++-
 sources                 |  2 +-
 5 files changed, 22 insertions(+), 18 deletions(-)
 delete mode 100644 bind-9.11.11.tar.gz.asc
 create mode 100644 bind-9.11.12.tar.gz.asc

diff --git a/.gitignore b/.gitignore
index 356fdd9..fbc6f9b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -96,3 +96,4 @@ bind-9.7.2b1.tar.gz
 /bind-9.11.9.tar.gz
 /bind-9.11.10.tar.gz
 /bind-9.11.11.tar.gz
+/bind-9.11.12.tar.gz
diff --git a/bind-9.11.11.tar.gz.asc b/bind-9.11.11.tar.gz.asc
deleted file mode 100644
index 1ad0c7b..0000000
--- a/bind-9.11.11.tar.gz.asc
+++ /dev/null
@@ -1,16 +0,0 @@
------BEGIN PGP SIGNATURE-----
-
-iQIzBAABAgAdFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAl16E/oACgkQdLtrmky7
-PTj5wQ//ZzItGqypNVGqYlocyQZRjvzjqJiPwIfgp7qpvDxQp7CPNuPqx35G0Xu6
-UJNKGZfJRKCoIrnN1QdBCXe+6ggl2O7iB3LJAeOiWz7oPj4DI2xTDu2oKKBkqLwF
-OimFr5B3F8wn59Bn2WgBpqjM3rv+kW2sQpahfBaYSYhqg0hmgOtn3Ksiopy+32l9
-0SNVhXtI+s1x2MCEdGweb24FJ663VC2rx5PJaD/59VPW3tXanemmTq6rLvdht+OE
-8zmTTQDPTu3CJFBnOwxBLvuvQDHvbVqiaU0o6nVHBow5D3FxL2R9ybNGBETY5af0
-7NqH9XEoeKFFRRdsEcTIRuLVQMdPl3dHWjCW0LeGjdOOwN5H8Yc1DGhfAaS3cD26
-d6L3cr6X9M7zTbKPTCYeNh/ydA3o4HRZV2LW3txac4qz2wxNaXytfsIGKb0Ag08U
-5MdGBdBbavDsX8aaRUHB0uiLL2U6rIm9dHeXWeed4B45YWMQ/kyEWqV5LYCHLq4F
-Hl2Tnjmp3YeE5qJHJtyXpOhhMYTVm6xACe72djyifxlJZlagBZihEc1D7xy/+Dmg
-JsBoA/X9C8RYGR/uAfxFiTQRNJtRdbPg168m/fV3cqo7m9mZGUdJOF51TSEOzfxx
-6RFuOl+R0YvyTtjBZaY2eeKRLdSc0uLHETRh+NmBHDx8bxSm8DM=
-=/ZDI
------END PGP SIGNATURE-----
diff --git a/bind-9.11.12.tar.gz.asc b/bind-9.11.12.tar.gz.asc
new file mode 100644
index 0000000..6d7992f
--- /dev/null
+++ b/bind-9.11.12.tar.gz.asc
@@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABAgAdFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAl2WMooACgkQdLtrmky7
+PThv2RAAnXNLYTzXtH6ls29tRm5Hc+D6UaeqcWDNQ4BpkRVhrFxtukalGCi9mmB6
+NPJzFyXmaOW654pypCIuEgqJNFUpDtLzLzT7SUF+mhm+5plsaRSBnh4mq87l5KSp
+twODAPnfCJV+HBk5RmToLEstAbGQ7xEBTyQtZoFkY+V7zEFwENKiCvWsoSWOkYR3
+zXo3sKjc83HV9ShbW/mCtbZf5L0qlbrKOAzqJfAFMhNNJi8kMbmr/Zi2sIfN+Rhv
+g8HQo89Epv6r51yAdeED8idIX4rKjjcEtHrZeDmLdCcdHgSEj2sIlH92Joce6vL0
+S59A0rItIXm6fW8sz6WNpcj4tVtWYbIYjXZ4SPFNkaUrHv8cUekq+5vbI+v07Gh3
+2bhtDsDyTY5I1/AsY/EFmwkCAjUS00jZryBnuJpLB3v5JtUog4ek32yLBzPrqRBo
+1876j4nlXAia8mG0OgJNWZ0gHyUPe/TgfR8fQDLmHxHHlKrJNTEwY6bLW8jzFTX1
+zk510fI1K7J9tiQgf5wcBQ2h3EBlqzDNIJDovoATzLYIf0HKyVegh/vnQdtdEhUR
+1DzJAt3bsBfAP1AFfWPD/ACu5Zdm7SxY1wE/pjkwttDU3sRZqOfuwNBGeolu3cVN
+O9/h1zsyVeVS0ui2vu4+V4EvNitmXsVbG2doDq9L5yBiIKGO2Ew=
+=GCy6
+-----END PGP SIGNATURE-----
diff --git a/bind.spec b/bind.spec
index fc316b2..e9805d0 100644
--- a/bind.spec
+++ b/bind.spec
@@ -56,7 +56,7 @@
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.11.11
+Version:  9.11.12
 Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
@@ -1519,6 +1519,9 @@ fi;
 
 
 %changelog
+* Mon Oct 21 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.12-1
+- Update to 9.11.12 (#1557762)
+
 * Wed Sep 25 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.11-1
 - Update to 9.11.11
 
diff --git a/sources b/sources
index 31c6abf..592049d 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.11.11.tar.gz) = 52a3e94b686bb8a9c5ec327bb9a23c6f94762a9c6f2080bfe06feb07ec432ece5f6554bdd4f5e9f39cc77e7da4c8330449d89e3dc92716e133c5be41a867d7a0
+SHA512 (bind-9.11.12.tar.gz) = 7e2b9ef4ed5a00c2e5310c932c177887aed330d94eefc87d732dda010f2b71477e2f9d6ea89422ccbc8f6f04ceb83419b758218bcc02f25b34751bad974174e8
 SHA512 (config-19.tar.bz2) = 36aa38a0c7c33267ae594b31c81681290ac58dde7ca6749bd599da531380b5b1428330813dbe983e01071ccaed83e83f6a9cd92179a53b7d0ccbb6851a0b017c

From bf6ee26309c2a3236ec264962fc19356dcca7548 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 21 Oct 2019 14:40:42 +0200
Subject: [PATCH 35/55] Adjust patches to 9.11.12

Few changes occured, remove one upstream applied patch.
---
 bind-9.11-rh1647829.patch |  86 ----------------------
 bind-9.11-rt31459.patch   | 110 +++++++++++++--------------
 bind-9.11-rt46047.patch   | 151 ++++++++++++++++++++++----------------
 bind.spec                 |   3 -
 4 files changed, 141 insertions(+), 209 deletions(-)
 delete mode 100644 bind-9.11-rh1647829.patch

diff --git a/bind-9.11-rh1647829.patch b/bind-9.11-rh1647829.patch
deleted file mode 100644
index ceec7fc..0000000
--- a/bind-9.11-rh1647829.patch
+++ /dev/null
@@ -1,86 +0,0 @@
-From 2eca7f5fa97a24997e4d8f900460ba43ae167e97 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Tue, 29 Jan 2019 18:07:44 +0100
-Subject: [PATCH] Fallback to ASCII on output IDN conversion error
-
-It is possible dig used ACE encoded name in locale, which does not
-support converting it to unicode. Instead of fatal error, fallback to
-ACE name on output.
-
-(cherry picked from commit 7f4cb8f9584597fea16de6557124ac8b1bd47440)
-
-Modify idna test to fallback to ACE
-
-Test valid A-label on input would be displayed as A-label on output if
-locale does not allow U-label.
-
-(cherry picked from commit 4ce232f8605bdbe0594ebe5a71383c9d4e6f263b)
-
-Emit warning on IDN output failure
-
-Warning is emitted before any dig headers.
-
-(cherry picked from commit 4b410038c531fbb902cd5fb83174eed1f06cb7d7)
----
- bin/dig/dighost.c              | 15 +++++++++++++--
- bin/tests/system/idna/tests.sh | 17 +++++++++++++++++
- 2 files changed, 30 insertions(+), 2 deletions(-)
-
-diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
-index bb8702c..d7cfc33 100644
---- a/bin/dig/dighost.c
-+++ b/bin/dig/dighost.c
-@@ -4860,9 +4860,20 @@ idn_ace_to_locale(const char *from, char *to, size_t tolen) {
- 	 */
- 	res = idn2_to_unicode_8zlz(utf8_src, &tmp_str, 0);
- 	if (res != IDN2_OK) {
--		fatal("Cannot represent '%s' in the current locale (%s), "
--		      "use +noidnout or a different locale",
-+		static bool warned = false;
-+
-+		res = idn2_to_ascii_8z(utf8_src, &tmp_str, 0);
-+		if (res != IDN2_OK) {
-+			fatal("Cannot represent '%s' "
-+			      "in the current locale nor ascii (%s), "
-+			      "use +noidnout or a different locale",
- 		      from, idn2_strerror(res));
-+		} else if (!warned) {
-+			fprintf(stderr, ";; Warning: cannot represent '%s' "
-+			      "in the current locale",
-+			      tmp_str);
-+			warned = true;
-+		}
- 	}
- 
- 	/*
-diff --git a/bin/tests/system/idna/tests.sh b/bin/tests/system/idna/tests.sh
-index 6637bf6..215a9d5 100644
---- a/bin/tests/system/idna/tests.sh
-+++ b/bin/tests/system/idna/tests.sh
-@@ -244,6 +244,23 @@ idna_enabled_test() {
-     idna_test "$text" "+idnin +noidnout"   "xn--nxasmq6b.com" "xn--nxasmq6b.com."
-     idna_test "$text" "+idnin +idnout"     "xn--nxasmq6b.com" "βόλοσ.com."
- 
-+    # Test of valid A-label in locale that cannot display it
-+    #
-+    # +noidnout: The string is sent as-is to the server and the returned qname
-+    #            is displayed in the same form.
-+    # +idnout:   The string is sent as-is to the server and the returned qname
-+    #            is displayed as the corresponding A-label.
-+    #
-+    # The "+[no]idnout" flag has no effect in these cases.
-+    text="Checking valid A-label in C locale"
-+    label="xn--nxasmq6b.com"
-+    LC_ALL=C idna_test "$text" ""                   "$label" "$label."
-+    LC_ALL=C idna_test "$text" "+noidnin +noidnout" "$label" "$label."
-+    LC_ALL=C idna_test "$text" "+noidnin +idnout"   "$label" "$label."
-+    LC_ALL=C idna_test "$text" "+idnin +noidnout"   "$label" "$label."
-+    LC_ALL=C idna_test "$text" "+idnin +idnout"     "$label" "$label."
-+    LC_ALL=C idna_test "$text" "+noidnin +idnout"   "$label" "$label."
-+
- 
- 
-     # Tests of invalid A-labels
--- 
-2.20.1
-
diff --git a/bind-9.11-rt31459.patch b/bind-9.11-rt31459.patch
index 8413061..ea25abe 100644
--- a/bind-9.11-rt31459.patch
+++ b/bind-9.11-rt31459.patch
@@ -1,4 +1,4 @@
-From 108a0f57f423a27995ac96272832278f4aa3a612 Mon Sep 17 00:00:00 2001
+From 7e61714a5d1509ec79af42391e41eb1afc53063a Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Tue, 12 Sep 2017 19:05:46 -0700
 Subject: [PATCH] rebased rt31459c
@@ -71,7 +71,7 @@ index 5015abb..295e16f 100644
  							     &entropy_source,
  							     randomfile,
 diff --git a/bin/dnssec/dnssec-dsfromkey.c b/bin/dnssec/dnssec-dsfromkey.c
-index 060892b..c2cc9c7 100644
+index 2c0c308..3e585af 100644
 --- a/bin/dnssec/dnssec-dsfromkey.c
 +++ b/bin/dnssec/dnssec-dsfromkey.c
 @@ -494,14 +494,14 @@ main(int argc, char **argv) {
@@ -92,7 +92,7 @@ index 060892b..c2cc9c7 100644
  	isc_entropy_stopcallbacksources(ectx);
  
  	setup_logging(mctx, &log);
-@@ -563,8 +563,8 @@ main(int argc, char **argv) {
+@@ -571,8 +571,8 @@ main(int argc, char **argv) {
  	if (dns_rdataset_isassociated(&rdataset))
  		dns_rdataset_disassociate(&rdataset);
  	cleanup_logging(&log);
@@ -293,7 +293,7 @@ index fbc7ece..31a99e7 100644
  					   usekeyboard);
  
 diff --git a/bin/named/server.c b/bin/named/server.c
-index c917cad..436a93a 100644
+index 7d85d3b..c782073 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
 @@ -36,6 +36,7 @@
@@ -304,7 +304,7 @@ index c917cad..436a93a 100644
  #include <isc/portset.h>
  #include <isc/print.h>
  #include <isc/random.h>
-@@ -8209,6 +8210,10 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8211,6 +8212,10 @@ load_configuration(const char *filename, ns_server_t *server,
  				      "no source of entropy found");
  		} else {
  			const char *randomdev = cfg_obj_asstring(obj);
@@ -315,14 +315,14 @@ index c917cad..436a93a 100644
  			int level = ISC_LOG_ERROR;
  			result = isc_entropy_createfilesource(ns_g_entropy,
  							      randomdev);
-@@ -8243,6 +8248,7 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8245,6 +8250,7 @@ load_configuration(const char *filename, ns_server_t *server,
  				}
  				isc_entropy_detach(&ns_g_fallbackentropy);
  			}
 +#endif
  #endif
  		}
- 	}
+ 
 diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
 index bbb3936..0286987 100644
 --- a/bin/nsupdate/nsupdate.c
@@ -670,7 +670,7 @@ index 9f90dd7..fad6c83 100644
          echo "I:failed"
  	status=`expr $status + $ret`
 diff --git a/bin/tools/mdig.c b/bin/tools/mdig.c
-index 53579d4..e2f6810 100644
+index bf6dbb6..0416b21 100644
 --- a/bin/tools/mdig.c
 +++ b/bin/tools/mdig.c
 @@ -1972,12 +1972,11 @@ main(int argc, char *argv[]) {
@@ -688,7 +688,7 @@ index 53579d4..e2f6810 100644
  	parse_args(false, argc, argv);
  	if (server == NULL)
 diff --git a/configure b/configure
-index 2a4d9ed..e4e8ea6 100755
+index ed002e0..a578874 100755
 --- a/configure
 +++ b/configure
 @@ -640,6 +640,7 @@ ac_includes_default="\
@@ -699,7 +699,7 @@ index 2a4d9ed..e4e8ea6 100755
  BUILD_LIBS
  BUILD_LDFLAGS
  BUILD_CPPFLAGS
-@@ -823,6 +824,7 @@ XMLSTATS
+@@ -821,6 +822,7 @@ XMLSTATS
  NZDTARGETS
  NZDSRCS
  NZD_TOOLS
@@ -707,7 +707,7 @@ index 2a4d9ed..e4e8ea6 100755
  PKCS11_TEST
  PKCS11_ED25519
  PKCS11_GOST
-@@ -1047,6 +1049,7 @@ with_eddsa
+@@ -1045,6 +1047,7 @@ with_eddsa
  with_aes
  enable_openssl_hash
  with_cc_alg
@@ -715,7 +715,7 @@ index 2a4d9ed..e4e8ea6 100755
  with_lmdb
  with_libxml2
  with_libjson
-@@ -1746,6 +1749,7 @@ Optional Features:
+@@ -1744,6 +1747,7 @@ Optional Features:
    --enable-threads        enable multithreading
    --enable-native-pkcs11  use native PKCS11 for all crypto [default=no]
    --enable-openssl-hash   use OpenSSL for hash functions [default=no]
@@ -723,7 +723,7 @@ index 2a4d9ed..e4e8ea6 100755
    --enable-largefile      64-bit file support
    --enable-backtrace      log stack backtrace on abort [default=yes]
    --enable-symtable       use internal symbol table for backtrace
-@@ -17117,6 +17121,7 @@ case "$use_openssl" in
+@@ -17115,6 +17119,7 @@ case "$use_openssl" in
  $as_echo "disabled because of native PKCS11" >&6; }
  		DST_OPENSSL_INC=""
  		CRYPTO="-DPKCS11CRYPTO"
@@ -731,7 +731,7 @@ index 2a4d9ed..e4e8ea6 100755
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -17131,6 +17136,7 @@ $as_echo "disabled because of native PKCS11" >&6; }
+@@ -17129,6 +17134,7 @@ $as_echo "disabled because of native PKCS11" >&6; }
  $as_echo "no" >&6; }
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -739,7 +739,7 @@ index 2a4d9ed..e4e8ea6 100755
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -17143,6 +17149,7 @@ $as_echo "no" >&6; }
+@@ -17141,6 +17147,7 @@ $as_echo "no" >&6; }
  	auto)
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -747,7 +747,7 @@ index 2a4d9ed..e4e8ea6 100755
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -17152,7 +17159,7 @@ $as_echo "no" >&6; }
+@@ -17150,7 +17157,7 @@ $as_echo "no" >&6; }
  		OPENSSLLINKOBJS=""
  		OPENSSLLINKSRCS=""
  		as_fn_error $? "OpenSSL was not found in any of $openssldirs; use --with-openssl=/path
@@ -756,7 +756,7 @@ index 2a4d9ed..e4e8ea6 100755
  		;;
  	*)
  		if test "yes" = "$want_native_pkcs11"
-@@ -17183,6 +17190,7 @@ $as_echo "not found" >&6; }
+@@ -17181,6 +17188,7 @@ $as_echo "not found" >&6; }
  			as_fn_error $? "\"$use_openssl/include/openssl/opensslv.h\" not found" "$LINENO" 5
  		fi
  		CRYPTO='-DOPENSSL'
@@ -764,7 +764,7 @@ index 2a4d9ed..e4e8ea6 100755
  		if test "/usr" = "$use_openssl"
  		then
  			DST_OPENSSL_INC=""
-@@ -17808,8 +17816,6 @@ fi
+@@ -17806,8 +17814,6 @@ fi
  # Use OpenSSL for hash functions
  #
  
@@ -773,7 +773,7 @@ index 2a4d9ed..e4e8ea6 100755
  ISC_PLATFORM_OPENSSLHASH="#undef ISC_PLATFORM_OPENSSLHASH"
  case $want_openssl_hash in
  	yes)
-@@ -18184,6 +18190,86 @@ if test "rt" = "$have_clock_gt"; then
+@@ -18182,6 +18188,86 @@ if test "rt" = "$have_clock_gt"; then
  	LIBS="-lrt $LIBS"
  fi
  
@@ -860,7 +860,7 @@ index 2a4d9ed..e4e8ea6 100755
  #
  # was --with-lmdb specified?
  #
-@@ -20266,9 +20352,12 @@ _ACEOF
+@@ -20264,9 +20350,12 @@ _ACEOF
  if ac_fn_c_try_compile "$LINENO"; then :
    { $as_echo "$as_me:${as_lineno-$LINENO}: result: size_t for buflen; int for flags" >&5
  $as_echo "size_t for buflen; int for flags" >&6; }
@@ -875,7 +875,7 @@ index 2a4d9ed..e4e8ea6 100755
  
  	 $as_echo "#define IRS_GETNAMEINFO_FLAGS_T int" >>confdefs.h
  
-@@ -21583,12 +21672,7 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
+@@ -21581,12 +21670,7 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
  ISC_PLATFORM_USESTDASM="#undef ISC_PLATFORM_USESTDASM"
  ISC_PLATFORM_USEMACASM="#undef ISC_PLATFORM_USEMACASM"
  if test "yes" = "$use_atomic"; then
@@ -889,7 +889,7 @@ index 2a4d9ed..e4e8ea6 100755
  # version HP92453-01 B.11.11.23709.GP, which incorrectly rejects
  # declarations like `int a3[[(sizeof (unsigned char)) >= 0]];'.
  # This bug is HP SR number 8606223364.
-@@ -21621,6 +21705,11 @@ cat >>confdefs.h <<_ACEOF
+@@ -21619,6 +21703,11 @@ cat >>confdefs.h <<_ACEOF
  _ACEOF
  
  
@@ -901,7 +901,7 @@ index 2a4d9ed..e4e8ea6 100755
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -21629,39 +21718,6 @@ _ACEOF
+@@ -21627,39 +21716,6 @@ _ACEOF
  		fi
  	;;
  	x86_64-*|amd64-*)
@@ -941,7 +941,7 @@ index 2a4d9ed..e4e8ea6 100755
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -21692,6 +21748,10 @@ $as_echo_n "checking architecture type for atomic operations... " >&6; }
+@@ -21690,6 +21746,10 @@ $as_echo_n "checking architecture type for atomic operations... " >&6; }
  $as_echo "$arch" >&6; }
  fi
  
@@ -952,7 +952,7 @@ index 2a4d9ed..e4e8ea6 100755
  if test "yes" = "$have_atomic"; then
  	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking compiler support for inline assembly code" >&5
  $as_echo_n "checking compiler support for inline assembly code... " >&6; }
-@@ -24297,6 +24357,30 @@ CFLAGS="$CFLAGS $SO_CFLAGS"
+@@ -24244,6 +24304,30 @@ CFLAGS="$CFLAGS $SO_CFLAGS"
  #
  dlzdir='${DLZ_DRIVER_DIR}'
  
@@ -983,7 +983,7 @@ index 2a4d9ed..e4e8ea6 100755
  #
  # Private autoconf macro to simplify configuring drivers:
  #
-@@ -24627,11 +24711,11 @@ $as_echo "no" >&6; }
+@@ -24574,11 +24658,11 @@ $as_echo "no" >&6; }
  $as_echo "using mysql with libs ${mysql_lib} and includes ${mysql_include}" >&6; }
  		;;
  	*)
@@ -998,7 +998,7 @@ index 2a4d9ed..e4e8ea6 100755
  		fi
  
  	CONTRIB_DLZ="$CONTRIB_DLZ -DDLZ_MYSQL"
-@@ -24716,7 +24800,7 @@ $as_echo "" >&6; }
+@@ -24663,7 +24747,7 @@ $as_echo "" >&6; }
  			# Check other locations for includes.
  			# Order is important (sigh).
  
@@ -1007,7 +1007,7 @@ index 2a4d9ed..e4e8ea6 100755
  			# include a blank element first
  			for d in "" $bdb_incdirs
  			do
-@@ -24741,57 +24825,9 @@ $as_echo "" >&6; }
+@@ -24688,57 +24772,9 @@ $as_echo "" >&6; }
  			bdb_libnames="db53 db-5.3 db51 db-5.1 db48 db-4.8 db47 db-4.7 db46 db-4.6 db45 db-4.5 db44 db-4.4 db43 db-4.3 db42 db-4.2 db41 db-4.1 db"
  			for d in $bdb_libnames
  			do
@@ -1067,7 +1067,7 @@ index 2a4d9ed..e4e8ea6 100755
  					break
  				fi
  			done
-@@ -24950,10 +24986,10 @@ $as_echo "no" >&6; }
+@@ -24897,10 +24933,10 @@ $as_echo "no" >&6; }
  		DLZ_DRIVER_INCLUDES="$DLZ_DRIVER_INCLUDES -I$use_dlz_ldap/include"
  		DLZ_DRIVER_LDAP_INCLUDES="-I$use_dlz_ldap/include"
  	fi
@@ -1081,7 +1081,7 @@ index 2a4d9ed..e4e8ea6 100755
  	fi
  
  
-@@ -25039,11 +25075,11 @@ fi
+@@ -24986,11 +25022,11 @@ fi
  		odbcdirs="/usr /usr/local /usr/pkg"
  		for d in $odbcdirs
  		do
@@ -1095,7 +1095,7 @@ index 2a4d9ed..e4e8ea6 100755
  				break
  			fi
  		done
-@@ -25318,6 +25354,8 @@ DNS_CRYPTO_LIBS="$NEWFLAGS"
+@@ -25265,6 +25301,8 @@ DNS_CRYPTO_LIBS="$NEWFLAGS"
  
  
  
@@ -1104,7 +1104,7 @@ index 2a4d9ed..e4e8ea6 100755
  #
  # Commands to run at the end of config.status.
  # Don't just put these into configure, it won't work right if somebody
-@@ -27697,6 +27735,8 @@ report() {
+@@ -27644,6 +27682,8 @@ report() {
  	    echo "    IPv6 support (--enable-ipv6)"
  	test "X$CRYPTO" = "X" -o "yes" = "$want_native_pkcs11" || \
  		echo "    OpenSSL cryptography/DNSSEC (--with-openssl)"
@@ -1113,7 +1113,7 @@ index 2a4d9ed..e4e8ea6 100755
  	test "X$PYTHON" = "X" || echo "    Python tools (--with-python)"
  	test "X$XMLSTATS" = "X" || echo "    XML statistics (--with-libxml2)"
  	test "X$JSONSTATS" = "X" || echo "    JSON statistics (--with-libjson)"
-@@ -27737,6 +27777,8 @@ report() {
+@@ -27684,6 +27724,8 @@ report() {
  	echo "    Very verbose query trace logging (--enable-querytrace)"
      test "no" = "$with_cmocka" || echo "    CMocka Unit Testing Framework (--with-cmocka)"
  
@@ -1122,7 +1122,7 @@ index 2a4d9ed..e4e8ea6 100755
      echo "    Dynamically loadable zone (DLZ) drivers:"
      test "no" = "$use_dlz_bdb" || \
  	echo "        Berkeley DB (--with-dlz-bdb)"
-@@ -27784,6 +27826,8 @@ report() {
+@@ -27731,6 +27773,8 @@ report() {
  	echo "    ECDSA algorithm support (--with-ecdsa)"
      test "X$CRYPTO" = "X" -o "yes" = "$OPENSSL_ED25519" -o "yes" = "$PKCS11_ED25519" || \
  	echo "    EDDSA algorithm support (--with-eddsa)"
@@ -1132,7 +1132,7 @@ index 2a4d9ed..e4e8ea6 100755
      test "yes" = "$enable_seccomp" || \
  	echo "    Use libseccomp system call filtering (--enable-seccomp)"
 diff --git a/configure.ac b/configure.ac
-index 0e22d02..828581e 100644
+index 45a8126..bb1345b 100644
 --- a/configure.ac
 +++ b/configure.ac
 @@ -1537,6 +1537,7 @@ case "$use_openssl" in
@@ -1274,7 +1274,7 @@ index 0e22d02..828581e 100644
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -5534,6 +5597,8 @@ report() {
+@@ -5527,6 +5590,8 @@ report() {
  	    echo "    IPv6 support (--enable-ipv6)"
  	test "X$CRYPTO" = "X" -o "yes" = "$want_native_pkcs11" || \
  		echo "    OpenSSL cryptography/DNSSEC (--with-openssl)"
@@ -1283,7 +1283,7 @@ index 0e22d02..828581e 100644
  	test "X$PYTHON" = "X" || echo "    Python tools (--with-python)"
  	test "X$XMLSTATS" = "X" || echo "    XML statistics (--with-libxml2)"
  	test "X$JSONSTATS" = "X" || echo "    JSON statistics (--with-libjson)"
-@@ -5574,6 +5639,8 @@ report() {
+@@ -5567,6 +5632,8 @@ report() {
  	echo "    Very verbose query trace logging (--enable-querytrace)"
      test "no" = "$with_cmocka" || echo "    CMocka Unit Testing Framework (--with-cmocka)"
  
@@ -1292,7 +1292,7 @@ index 0e22d02..828581e 100644
      echo "    Dynamically loadable zone (DLZ) drivers:"
      test "no" = "$use_dlz_bdb" || \
  	echo "        Berkeley DB (--with-dlz-bdb)"
-@@ -5621,6 +5688,8 @@ report() {
+@@ -5614,6 +5681,8 @@ report() {
  	echo "    ECDSA algorithm support (--with-ecdsa)"
      test "X$CRYPTO" = "X" -o "yes" = "$OPENSSL_ED25519" -o "yes" = "$PKCS11_ED25519" || \
  	echo "    EDDSA algorithm support (--with-eddsa)"
@@ -1302,10 +1302,10 @@ index 0e22d02..828581e 100644
      test "yes" = "$enable_seccomp" || \
  	echo "    Use libseccomp system call filtering (--enable-seccomp)"
 diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c
-index 320c0f8..b55ebe0 100644
+index ec6e00e..1614afa 100644
 --- a/lib/dns/dst_api.c
 +++ b/lib/dns/dst_api.c
-@@ -276,6 +276,12 @@ dst_lib_init2(isc_mem_t *mctx, isc_entropy_t *ectx,
+@@ -277,6 +277,12 @@ dst_lib_init2(isc_mem_t *mctx, isc_entropy_t *ectx,
  #ifdef GSSAPI
  	RETERR(dst__gssapi_init(&dst_t_func[DST_ALG_GSSAPI]));
  #endif
@@ -1318,7 +1318,7 @@ index 320c0f8..b55ebe0 100644
  	dst_initialized = true;
  	return (ISC_R_SUCCESS);
  
-@@ -295,11 +301,19 @@ dst_lib_destroy(void) {
+@@ -296,11 +302,19 @@ dst_lib_destroy(void) {
  	for (i = 0; i < DST_MAX_ALGS; i++)
  		if (dst_t_func[i] != NULL && dst_t_func[i]->cleanup != NULL)
  			dst_t_func[i]->cleanup();
@@ -1338,7 +1338,7 @@ index 320c0f8..b55ebe0 100644
  	if (dst__memory_pool != NULL)
  		isc_mem_detach(&dst__memory_pool);
  	if (dst_entropy_pool != NULL)
-@@ -2001,13 +2015,17 @@ dst__entropy_getdata(void *buf, unsigned int len, bool pseudo) {
+@@ -2002,13 +2016,17 @@ dst__entropy_getdata(void *buf, unsigned int len, bool pseudo) {
  		flags &= ~ISC_ENTROPY_GOODONLY;
  	else
  		flags |= ISC_ENTROPY_BLOCKING;
@@ -1357,7 +1357,7 @@ index 320c0f8..b55ebe0 100644
  #ifdef GSSAPI
  	unsigned int flags = dst_entropy_flags;
  	isc_result_t ret;
-@@ -2030,6 +2048,7 @@ dst__entropy_status(void) {
+@@ -2031,6 +2049,7 @@ dst__entropy_status(void) {
  #endif
  	return (isc_entropy_status(dst_entropy_pool));
  #else
@@ -1973,7 +1973,7 @@ index 42ff7e0..8d87c44 100644
  typedef int (*isc_sockfdwatch_t)(isc_task_t *, isc_socket_t *, void *, int);
  
 diff --git a/lib/isc/pk11.c b/lib/isc/pk11.c
-index 7809e7b..c43357a 100644
+index 8e6ed93..ceb5a2c 100644
 --- a/lib/isc/pk11.c
 +++ b/lib/isc/pk11.c
 @@ -321,14 +321,16 @@ pk11_rand_seed_fromfile(const char *randomfile) {
@@ -2015,10 +2015,10 @@ index 5b8a2c9..913a2ce 100644
   * Define if the hash functions must be provided by OpenSSL.
   */
 diff --git a/win32utils/Configure b/win32utils/Configure
-index 6f93814..4286baf 100644
+index ccaf067..240fb80 100644
 --- a/win32utils/Configure
 +++ b/win32utils/Configure
-@@ -378,6 +378,7 @@ my @substdefh = ("ALLOW_FILTER_AAAA",
+@@ -382,6 +382,7 @@ my @substdefh = ("ALLOW_FILTER_AAAA",
  my %configdefp;
  
  my @substdefp = ("ISC_PLATFORM_BUSYWAITNOP",
@@ -2026,7 +2026,7 @@ index 6f93814..4286baf 100644
                   "ISC_PLATFORM_HAVEATOMICSTORE",
                   "ISC_PLATFORM_HAVEATOMICSTOREQ",
                   "ISC_PLATFORM_HAVECMPXCHG",
-@@ -508,7 +509,8 @@ my @allcond = (@substcond, "NOTYET", "NOLONGER");
+@@ -517,7 +518,8 @@ my @allcond = (@substcond, "NOTYET", "NOLONGER");
  
  # enable-xxx/disable-xxx
  
@@ -2036,7 +2036,7 @@ index 6f93814..4286baf 100644
                    "fixed-rrset",
                    "intrinsics",
                    "isc-spnego",
-@@ -572,6 +574,7 @@ my @help = (
+@@ -581,6 +583,7 @@ my @help = (
  "\nOptional Features:\n",
  "  enable-intrinsics     enable instrinsic/atomic functions [default=yes]\n",
  "  enable-native-pkcs11  use native PKCS#11 for all crypto [default=no]\n",
@@ -2044,7 +2044,7 @@ index 6f93814..4286baf 100644
  "  enable-openssl-hash   use OpenSSL for hash functions [default=yes]\n",
  "  enable-isc-spnego     use SPNEGO from lib/dns [default=yes]\n",
  "  enable-filter-aaaa    enable filtering of AAAA records [default=yes]\n",
-@@ -617,7 +620,9 @@ my $want_clean = "no";
+@@ -630,7 +633,9 @@ my $want_clean = "no";
  my $want_unknown = "no";
  my $unknown_value;
  my $enable_intrinsics = "yes";
@@ -2054,7 +2054,7 @@ index 6f93814..4286baf 100644
  my $enable_openssl_hash = "auto";
  my $enable_filter_aaaa = "yes";
  my $enable_isc_spnego = "yes";
-@@ -837,6 +842,10 @@ sub myenable {
+@@ -850,6 +855,10 @@ sub myenable {
          if ($val =~ /^yes$/i) {
              $enable_native_pkcs11 = "yes";
          }
@@ -2065,7 +2065,7 @@ index 6f93814..4286baf 100644
      } elsif ($key =~ /^openssl-hash$/i) {
          if ($val =~ /^yes$/i) {
              $enable_openssl_hash = "yes";
-@@ -1139,6 +1148,11 @@ if ($verbose) {
+@@ -1158,6 +1167,11 @@ if ($verbose) {
      } else {
          print "native-pkcs11: disabled\n";
      }
@@ -2077,7 +2077,7 @@ index 6f93814..4286baf 100644
      if ($enable_openssl_hash eq "yes") {
          print "openssl-hash: enabled\n";
      } else {
-@@ -1497,6 +1511,7 @@ if ($enable_intrinsics eq "yes") {
+@@ -1516,6 +1530,7 @@ if ($enable_intrinsics eq "yes") {
  
  # enable-native-pkcs11
  if ($enable_native_pkcs11 eq "yes") {
@@ -2085,7 +2085,7 @@ index 6f93814..4286baf 100644
      if ($use_openssl eq "auto") {
          $use_openssl = "no";
      }
-@@ -1706,6 +1721,7 @@ if ($use_openssl eq "yes") {
+@@ -1725,6 +1740,7 @@ if ($use_openssl eq "yes") {
          $openssl_dll = File::Spec->catdir($openssl_path, "@dirlist[0]");
      }   
  
@@ -2093,7 +2093,7 @@ index 6f93814..4286baf 100644
      $configcond{"OPENSSL"} = 1;
      $configdefd{"CRYPTO"} = "OPENSSL";
      $configvar{"OPENSSL_PATH"} = "$openssl_path";
-@@ -2242,6 +2258,15 @@ if ($use_aes eq "yes") {
+@@ -2296,6 +2312,15 @@ if ($use_aes eq "yes") {
  }
  
  
@@ -2109,7 +2109,7 @@ index 6f93814..4286baf 100644
  # enable-openssl-hash
  if ($enable_openssl_hash eq "yes") {
      if ($use_openssl eq "no") {
-@@ -3617,6 +3642,7 @@ exit 0;
+@@ -3671,6 +3696,7 @@ exit 0;
  #  --enable-developer partially supported
  #  --enable-newstats (9.9/9.9sub only)
  #  --enable-native-pkcs11 supported
diff --git a/bind-9.11-rt46047.patch b/bind-9.11-rt46047.patch
index 4f8181d..4bb47e8 100644
--- a/bind-9.11-rt46047.patch
+++ b/bind-9.11-rt46047.patch
@@ -1,4 +1,4 @@
-From ab9ee91f596c14cfc55a67ba3523b42a54e3e244 Mon Sep 17 00:00:00 2001
+From 4c7b644910e21e690e5f51d5596a9fe46d9c7b7a Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Thu, 28 Sep 2017 10:09:22 -0700
 Subject: [PATCH] completed and corrected the crypto-random change
@@ -39,14 +39,16 @@ Subject: [PATCH] completed and corrected the crypto-random change
  bin/tests/system/tkey/keycreate.c        |  4 +-
  bin/tests/system/tkey/keydelete.c        |  5 +--
  doc/arm/Bv9ARM-book.xml                  | 55 +++++++++++++++++-------
- doc/arm/notes.xml                        | 31 +++++++++++++
+ doc/arm/notes-rh-changes.xml             | 43 ++++++++++++++++++
+ doc/arm/notes.xml                        |  1 +
  lib/dns/dst_api.c                        |  4 +-
  lib/dns/include/dst/dst.h                | 14 +++++-
  lib/dns/openssl_link.c                   |  3 +-
  lib/isc/include/isc/entropy.h            | 50 +++++++++++++++------
  lib/isc/include/isc/random.h             | 28 +++++++-----
  lib/isccfg/namedconf.c                   |  2 +-
- 22 files changed, 228 insertions(+), 106 deletions(-)
+ 23 files changed, 241 insertions(+), 106 deletions(-)
+ create mode 100644 doc/arm/notes-rh-changes.xml
 
 diff --git a/bin/confgen/keygen.c b/bin/confgen/keygen.c
 index 295e16f..0f79aa8 100644
@@ -140,10 +142,10 @@ index 31a99e7..38c83ed 100644
  					   usekeyboard);
  
 diff --git a/bin/named/client.c b/bin/named/client.c
-index 29fecad..a12623a 100644
+index 2169954..c6c59f7 100644
 --- a/bin/named/client.c
 +++ b/bin/named/client.c
-@@ -1752,7 +1752,8 @@ ns_client_addopt(ns_client_t *client, dns_message_t *message,
+@@ -1754,7 +1754,8 @@ ns_client_addopt(ns_client_t *client, dns_message_t *message,
  
  		isc_buffer_init(&buf, cookie, sizeof(cookie));
  		isc_stdtime_get(&now);
@@ -154,10 +156,10 @@ index 29fecad..a12623a 100644
  		compute_cookie(client, now, nonce, ns_g_server->secret, &buf);
  
 diff --git a/bin/named/config.c b/bin/named/config.c
-index a153172..8d46bc3 100644
+index de64ca5..833c1dc 100644
 --- a/bin/named/config.c
 +++ b/bin/named/config.c
-@@ -93,7 +93,9 @@ options {\n\
+@@ -98,7 +98,9 @@ options {\n\
  #	pid-file \"" NS_LOCALSTATEDIR "/run/named/named.pid\"; /* or /lwresd.pid */\n\
  	port 53;\n\
  	prefetch 2 9;\n"
@@ -241,7 +243,7 @@ index f5ed2b7..b2c1d05 100644
  
  struct ns_altsecret {
 diff --git a/bin/named/interfacemgr.c b/bin/named/interfacemgr.c
-index 135533b..4546831 100644
+index 9bd1f93..851d3c9 100644
 --- a/bin/named/interfacemgr.c
 +++ b/bin/named/interfacemgr.c
 @@ -17,6 +17,7 @@
@@ -253,7 +255,7 @@ index 135533b..4546831 100644
  #include <isc/task.h>
  #include <isc/util.h>
 diff --git a/bin/named/query.c b/bin/named/query.c
-index f85cc76..43a3661 100644
+index 86417c7..55b7b7c 100644
 --- a/bin/named/query.c
 +++ b/bin/named/query.c
 @@ -19,6 +19,7 @@
@@ -265,10 +267,10 @@ index f85cc76..43a3661 100644
  #include <isc/serial.h>
  #include <isc/stats.h>
 diff --git a/bin/named/server.c b/bin/named/server.c
-index 405ff71..700f83d 100644
+index c782073..bc59cbc 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
-@@ -8203,21 +8203,32 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8204,21 +8204,32 @@ load_configuration(const char *filename, ns_server_t *server,
  	 * Open the source of entropy.
  	 */
  	if (first_time) {
@@ -310,7 +312,7 @@ index 405ff71..700f83d 100644
  #ifdef PATH_RANDOMDEV
  			if (ns_g_fallbackentropy != NULL) {
  				level = ISC_LOG_INFO;
-@@ -8228,8 +8239,8 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8229,8 +8240,8 @@ load_configuration(const char *filename, ns_server_t *server,
  					      NS_LOGCATEGORY_GENERAL,
  					      NS_LOGMODULE_SERVER,
  					      level,
@@ -321,15 +323,15 @@ index 405ff71..700f83d 100644
  					      randomdev,
  					      isc_result_totext(result));
  			}
-@@ -8249,7 +8260,6 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8250,7 +8261,6 @@ load_configuration(const char *filename, ns_server_t *server,
  				}
  				isc_entropy_detach(&ns_g_fallbackentropy);
  			}
 -#endif
  #endif
  		}
- 	}
-@@ -9014,6 +9024,7 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
+ 
+@@ -9018,6 +9028,7 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
  	server->in_roothints = NULL;
  	server->blackholeacl = NULL;
  	server->keepresporder = NULL;
@@ -337,7 +339,7 @@ index 405ff71..700f83d 100644
  
  	/* Must be first. */
  	CHECKFATAL(dst_lib_init2(ns_g_mctx, ns_g_entropy,
-@@ -9040,6 +9051,9 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
+@@ -9044,6 +9055,9 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
  	CHECKFATAL(dns_tkeyctx_create(ns_g_mctx, ns_g_entropy,
  				      &server->tkeyctx),
  		   "creating TKEY context");
@@ -347,7 +349,7 @@ index 405ff71..700f83d 100644
  
  	/*
  	 * Setup the server task, which is responsible for coordinating
-@@ -9246,7 +9260,8 @@ ns_server_destroy(ns_server_t **serverp) {
+@@ -9250,7 +9264,8 @@ ns_server_destroy(ns_server_t **serverp) {
  
  	if (server->zonemgr != NULL)
  		dns_zonemgr_detach(&server->zonemgr);
@@ -357,7 +359,7 @@ index 405ff71..700f83d 100644
  	if (server->tkeyctx != NULL)
  		dns_tkeyctx_destroy(&server->tkeyctx);
  
-@@ -13197,10 +13212,10 @@ newzone_cfgctx_destroy(void **cfgp) {
+@@ -13221,10 +13236,10 @@ newzone_cfgctx_destroy(void **cfgp) {
  
  static isc_result_t
  generate_salt(unsigned char *salt, size_t saltlen) {
@@ -370,7 +372,7 @@ index 405ff71..700f83d 100644
  	} rnd;
  	unsigned char text[512 + 1];
  	isc_region_t r;
-@@ -13210,9 +13225,10 @@ generate_salt(unsigned char *salt, size_t saltlen) {
+@@ -13234,9 +13249,10 @@ generate_salt(unsigned char *salt, size_t saltlen) {
  	if (saltlen > 256U)
  		return (ISC_R_RANGE);
  
@@ -400,10 +402,10 @@ index 0286987..0376377 100644
  	}
  #endif
 diff --git a/bin/tests/system/pipelined/pipequeries.c b/bin/tests/system/pipelined/pipequeries.c
-index 7b4f617..507bf0a 100644
+index f0a6ff2..55064f6 100644
 --- a/bin/tests/system/pipelined/pipequeries.c
 +++ b/bin/tests/system/pipelined/pipequeries.c
-@@ -282,9 +282,7 @@ main(int argc, char *argv[]) {
+@@ -280,9 +280,7 @@ main(int argc, char *argv[]) {
  	ectx = NULL;
  	RUNCHECK(isc_entropy_create(mctx, &ectx));
  #ifdef ISC_PLATFORM_CRYPTORANDOM
@@ -453,10 +455,10 @@ index 2146f9b..64b8e74 100644
  	}
  #endif
 diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
-index b40cb05..8a81438 100644
+index 9bf100f..c161e71 100644
 --- a/doc/arm/Bv9ARM-book.xml
 +++ b/doc/arm/Bv9ARM-book.xml
-@@ -5071,22 +5071,45 @@ badresp:1,adberr:0,findfail:0,valfail:0]
+@@ -5076,22 +5076,45 @@ badresp:1,adberr:0,findfail:0,valfail:0]
  	    <term><command>random-device</command></term>
  	    <listitem>
  	      <para>
@@ -518,53 +520,72 @@ index b40cb05..8a81438 100644
  	      </para>
  	    </listitem>
  	  </varlistentry>
+diff --git a/doc/arm/notes-rh-changes.xml b/doc/arm/notes-rh-changes.xml
+new file mode 100644
+index 0000000..11c3a7c
+--- /dev/null
++++ b/doc/arm/notes-rh-changes.xml
+@@ -0,0 +1,43 @@
++
++<!--
++ - Copyright (C) Internet Systems Consortium, Inc. ("ISC")
++ -
++ - This Source Code Form is subject to the terms of the Mozilla Public
++ - License, v. 2.0. If a copy of the MPL was not distributed with this
++ - file, You can obtain one at http://mozilla.org/MPL/2.0/.
++ -
++ - See the COPYRIGHT file distributed with this work for additional
++ - information regarding copyright ownership.
++-->
++
++<section xml:id="relnotes_rh_changes"><info><title>Red Hat Specific Changes</title></info>
++  <itemizedlist>
++     <listitem>
++      <para>
++        By default, BIND now uses the random number generation functions
++        in the cryptographic library (i.e., OpenSSL or a PKCS#11
++        provider) as a source of high-quality randomness rather than
++        <filename>/dev/random</filename>.  This is suitable for virtual
++        machine environments, which may have limited entropy pools and
++        lack hardware random number generators.
++      </para>
++      <para>
++        This can be overridden by specifying another entropy source via
++        the <command>random-device</command> option in
++        <filename>named.conf</filename>, or via the <command>-r</command>
++        command line option.  However, for functions requiring full
++        cryptographic strength, such as DNSSEC key generation, this
++        <emphasis>cannot</emphasis> be overridden. In particular, the
++        <command>-r</command> command line option no longer has any
++        effect on <command>dnssec-keygen</command>.
++      </para>
++      <para>
++        This can be disabled by building with
++        <command>configure --disable-crypto-rand</command>, in which
++        case <filename>/dev/random</filename> will be the default
++        entropy source.  [RT #31459] [RT #46047]
++      </para>
++    </listitem>
++  </itemizedlist>
++</section>
++
 diff --git a/doc/arm/notes.xml b/doc/arm/notes.xml
-index 00ce8f1..527135a 100644
+index 3a9cfcf..ded2000 100644
 --- a/doc/arm/notes.xml
 +++ b/doc/arm/notes.xml
-@@ -124,6 +124,37 @@
-     </itemizedlist>
-   </section>
- 
-+  <section xml:id="relnotes_rh_changes"><info><title>Red Hat Specific Changes</title></info>
-+    <itemizedlist>
-+       <listitem>
-+	<para>
-+	  By default, BIND now uses the random number generation functions
-+	  in the cryptographic library (i.e., OpenSSL or a PKCS#11
-+	  provider) as a source of high-quality randomness rather than
-+	  <filename>/dev/random</filename>.  This is suitable for virtual
-+	  machine environments, which may have limited entropy pools and
-+	  lack hardware random number generators.
-+	</para>
-+	<para>
-+	  This can be overridden by specifying another entropy source via
-+	  the <command>random-device</command> option in
-+	  <filename>named.conf</filename>, or via the <command>-r</command>
-+	  command line option.  However, for functions requiring full
-+	  cryptographic strength, such as DNSSEC key generation, this
-+	  <emphasis>cannot</emphasis> be overridden. In particular, the
-+	  <command>-r</command> command line option no longer has any
-+	  effect on <command>dnssec-keygen</command>.
-+	</para>
-+	<para>
-+	  This can be disabled by building with
-+	  <command>configure --disable-crypto-rand</command>, in which
-+	  case <filename>/dev/random</filename> will be the default
-+	  entropy source.  [RT #31459] [RT #46047]
-+	</para>
-+      </listitem>
-+    </itemizedlist>
-+  </section>
-+
-   <section xml:id="end_of_life"><info><title>End of Life</title></info>
-     <para>
-       BIND 9.11 (Extended Support Version) will be supported until at
+@@ -23,6 +23,7 @@
+   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-sec-fixes.xml"/>
+   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-new-features.xml"/>
+   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-bug-fixes.xml"/>
++  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-rh-changes.xml"/>
+   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-eol.xml"/>
+   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-thankyou.xml"/>
+ </section>
 diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c
-index b55ebe0..d2b43d3 100644
+index 1614afa..0f52df9 100644
 --- a/lib/dns/dst_api.c
 +++ b/lib/dns/dst_api.c
-@@ -2016,10 +2016,12 @@ dst__entropy_getdata(void *buf, unsigned int len, bool pseudo) {
+@@ -2017,10 +2017,12 @@ dst__entropy_getdata(void *buf, unsigned int len, bool pseudo) {
  	else
  		flags |= ISC_ENTROPY_BLOCKING;
  #ifdef ISC_PLATFORM_CRYPTORANDOM
@@ -761,7 +782,7 @@ index f8aed34..17c551b 100644
  
  ISC_LANG_ENDDECLS
 diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
-index fbc62cc..9cad61d 100644
+index 03890a3..7bad989 100644
 --- a/lib/isccfg/namedconf.c
 +++ b/lib/isccfg/namedconf.c
 @@ -1109,7 +1109,7 @@ options_clauses[] = {
diff --git a/bind.spec b/bind.spec
index e9805d0..7bb38f5 100644
--- a/bind.spec
+++ b/bind.spec
@@ -137,8 +137,6 @@ Patch161:bind-9.11-host-idn-disable.patch
 Patch163:bind-9.11-rh1663318.patch
 # https://gitlab.isc.org/isc-projects/bind9/issues/819
 Patch164:bind-9.11-rh1666814.patch
-# https://bugzilla.redhat.com/show_bug.cgi?id=1647829
-Patch165:bind-9.11-rh1647829.patch
 # random_test fails too often by random, disable it
 Patch168:bind-9.11-unit-disable-random.patch
 Patch170:bind-9.11-feature-test-named.patch
@@ -518,7 +516,6 @@ are used for building ISC DHCP.
 %patch161 -p1 -b .host-idn-disable
 %patch163 -p1 -b .rh1663318
 %patch164 -p1 -b .rh1666814
-%patch165 -p1 -b .rh1647829
 %patch168 -p1 -b .random_test-disable
 %patch170 -p1 -b .featuretest-named
 %patch171 -p1 -b .test-variant

From ae74ad70137d5b45e8df8cf4023f5a1fd03e59d7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 4 Nov 2019 19:56:54 +0100
Subject: [PATCH 36/55] Remove config archive with zone files

Few configuration and zone files were moved into tarball by commit
55b04de09a6. It makes tracking of changes difficult, hardens rebases,
makes difficult building without proper lookaside cache. Those files are
tiny, no need to hold them inside compressed binary archive. Move them
out.

Replaces also few places with proper directory macros.
---
 bind.spec           | 42 ++++++++++++++++++++++---------
 named.empty         | 18 +++++++------
 named.localhost     | 10 ++++++++
 named.loopback      | 11 ++++++++
 named.rfc1912.zones | 45 +++++++++++++++++++++++++++++++++
 named.root          | 61 +++++++++++++++++++++++++++++++++++++++++++++
 named.root.key      | 19 ++++++++++++++
 sources             |  1 -
 8 files changed, 186 insertions(+), 21 deletions(-)
 create mode 100644 named.localhost
 create mode 100644 named.loopback
 create mode 100644 named.rfc1912.zones
 create mode 100644 named.root
 create mode 100644 named.root.key

diff --git a/bind.spec b/bind.spec
index 7bb38f5..1526771 100644
--- a/bind.spec
+++ b/bind.spec
@@ -57,7 +57,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.11.12
-Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -68,9 +68,16 @@ Source3:  named.logrotate
 Source7:  bind-9.3.1rc1-sdb_tools-Makefile.in
 Source8:  dnszone.schema
 Source12: README.sdb_pgsql
+Source16: named.conf
+# Refresh by command: dig @a.root-servers.net. +tcp +norec
+# or from URL
+Source17: https://www.internic.net/domain/named.root
+Source18: named.localhost
+Source19: named.loopback
+Source20: named.empty
+Source23: named.rfc1912.zones
 Source25: named.conf.sample
-Source26: named.conf
-Source28: config-19.tar.bz2
+Source27: named.root.key
 Source30: ldap2zone.c
 Source31: ldap2zone.1
 Source32: named-sdb.8
@@ -993,20 +1000,28 @@ popd
 touch ${RPM_BUILD_ROOT}%{_localstatedir}/log/named.log
 
 # configuration files:
-tar -C ${RPM_BUILD_ROOT} -xjf %{SOURCE28}
-install -m 640 %{SOURCE26} ${RPM_BUILD_ROOT}/etc/named.conf
-touch ${RPM_BUILD_ROOT}/etc/rndc.key
-touch ${RPM_BUILD_ROOT}/etc/rndc.conf
-mkdir ${RPM_BUILD_ROOT}/etc/named
-install -m 644 %{SOURCE36} ${RPM_BUILD_ROOT}/etc/trusted-key.key
+install -m 640 %{SOURCE16} ${RPM_BUILD_ROOT}%{_sysconfdir}/named.conf
+touch ${RPM_BUILD_ROOT}%{_sysconfdir}/rndc.{key,conf}
+install -m 644 %{SOURCE27} ${RPM_BUILD_ROOT}%{_sysconfdir}/named.root.key
+install -m 644 %{SOURCE36} ${RPM_BUILD_ROOT}%{_sysconfdir}/trusted-key.key
+mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/named
+
+# data files:
+mkdir -p ${RPM_BUILD_ROOT}%{_localstatedir}/named
+install -m 640 %{SOURCE17} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.ca
+install -m 640 %{SOURCE18} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.localhost
+install -m 640 %{SOURCE19} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.loopback
+install -m 640 %{SOURCE20} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.empty
+install -m 640 %{SOURCE23} ${RPM_BUILD_ROOT}%{_sysconfdir}/named.rfc1912.zones
 
 # sample bind configuration files for %%doc:
 mkdir -p sample/etc sample/var/named/{data,slaves}
 install -m 644 %{SOURCE25} sample/etc/named.conf
 # Copy default configuration to %%doc to make it usable from system-config-bind
-install -m 644 %{SOURCE26} named.conf.default
-install -m 644 ${RPM_BUILD_ROOT}/etc/named.rfc1912.zones sample/etc/named.rfc1912.zones
-install -m 644 ${RPM_BUILD_ROOT}/var/named/{named.ca,named.localhost,named.loopback,named.empty}  sample/var/named
+install -m 644 %{SOURCE16} named.conf.default
+install -m 644 %{SOURCE23} sample/etc/named.rfc1912.zones
+install -m 644 %{SOURCE18} %{SOURCE19} %{SOURCE20}  sample/var/named
+install -m 644 %{SOURCE17} sample/var/named/named.ca
 for f in my.internal.zone.db slaves/my.slave.internal.zone.db slaves/my.ddns.internal.zone.db my.external.zone.db; do 
   echo '@ in soa localhost. root 1 3H 15M 1W 1D
   ns localhost.' > sample/var/named/$f; 
@@ -1516,6 +1531,9 @@ fi;
 
 
 %changelog
+* Mon Nov 04 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.12-2
+- Move data files outside config archive
+
 * Mon Oct 21 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.12-1
 - Update to 9.11.12 (#1557762)
 
diff --git a/named.empty b/named.empty
index fa858eb..8e271e7 100644
--- a/named.empty
+++ b/named.empty
@@ -1,8 +1,10 @@
-$TTL 1D
-@	IN SOA	localhost. root.localhost. (
-						0	; serial
-						3H	; refresh
-						1H	; retry
-						1W	; expire
-						3H )	; minimum
-	IN	NS	localhost.
+$TTL 3H
+@	IN SOA	@ rname.invalid. (
+					0	; serial
+					1D	; refresh
+					1H	; retry
+					1W	; expire
+					3H )	; minimum
+	NS	@
+	A	127.0.0.1
+	AAAA	::1
diff --git a/named.localhost b/named.localhost
new file mode 100644
index 0000000..6fe6a52
--- /dev/null
+++ b/named.localhost
@@ -0,0 +1,10 @@
+$TTL 1D
+@	IN SOA	@ rname.invalid. (
+					0	; serial
+					1D	; refresh
+					1H	; retry
+					1W	; expire
+					3H )	; minimum
+	NS	@
+	A	127.0.0.1
+	AAAA	::1
diff --git a/named.loopback b/named.loopback
new file mode 100644
index 0000000..7f3d862
--- /dev/null
+++ b/named.loopback
@@ -0,0 +1,11 @@
+$TTL 1D
+@	IN SOA	@ rname.invalid. (
+					0	; serial
+					1D	; refresh
+					1H	; retry
+					1W	; expire
+					3H )	; minimum
+	NS	@
+	A	127.0.0.1
+	AAAA	::1
+	PTR	localhost.
diff --git a/named.rfc1912.zones b/named.rfc1912.zones
new file mode 100644
index 0000000..fa8caf5
--- /dev/null
+++ b/named.rfc1912.zones
@@ -0,0 +1,45 @@
+// named.rfc1912.zones:
+//
+// Provided by Red Hat caching-nameserver package 
+//
+// ISC BIND named zone configuration for zones recommended by
+// RFC 1912 section 4.1 : localhost TLDs and address zones
+// and https://tools.ietf.org/html/rfc6303
+// (c)2007 R W Franks
+// 
+// See /usr/share/doc/bind*/sample/ for example named configuration files.
+//
+// Note: empty-zones-enable yes; option is default.
+// If private ranges should be forwarded, add 
+// disable-empty-zone "."; into options
+// 
+
+zone "localhost.localdomain" IN {
+	type master;
+	file "named.localhost";
+	allow-update { none; };
+};
+
+zone "localhost" IN {
+	type master;
+	file "named.localhost";
+	allow-update { none; };
+};
+
+zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" IN {
+	type master;
+	file "named.loopback";
+	allow-update { none; };
+};
+
+zone "1.0.0.127.in-addr.arpa" IN {
+	type master;
+	file "named.loopback";
+	allow-update { none; };
+};
+
+zone "0.in-addr.arpa" IN {
+	type master;
+	file "named.empty";
+	allow-update { none; };
+};
diff --git a/named.root b/named.root
new file mode 100644
index 0000000..532d4ff
--- /dev/null
+++ b/named.root
@@ -0,0 +1,61 @@
+
+; <<>> DiG 9.11.3-RedHat-9.11.3-3.fc27 <<>> +bufsize=1200 +norec @a.root-servers.net
+; (2 servers found)
+;; global options: +cmd
+;; Got answer:
+;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 46900
+;; flags: qr aa; QUERY: 1, ANSWER: 13, AUTHORITY: 0, ADDITIONAL: 27
+
+;; OPT PSEUDOSECTION:
+; EDNS: version: 0, flags:; udp: 1472
+;; QUESTION SECTION:
+;.				IN	NS
+
+;; ANSWER SECTION:
+.			518400	IN	NS	a.root-servers.net.
+.			518400	IN	NS	b.root-servers.net.
+.			518400	IN	NS	c.root-servers.net.
+.			518400	IN	NS	d.root-servers.net.
+.			518400	IN	NS	e.root-servers.net.
+.			518400	IN	NS	f.root-servers.net.
+.			518400	IN	NS	g.root-servers.net.
+.			518400	IN	NS	h.root-servers.net.
+.			518400	IN	NS	i.root-servers.net.
+.			518400	IN	NS	j.root-servers.net.
+.			518400	IN	NS	k.root-servers.net.
+.			518400	IN	NS	l.root-servers.net.
+.			518400	IN	NS	m.root-servers.net.
+
+;; ADDITIONAL SECTION:
+a.root-servers.net.	518400	IN	A	198.41.0.4
+b.root-servers.net.	518400	IN	A	199.9.14.201
+c.root-servers.net.	518400	IN	A	192.33.4.12
+d.root-servers.net.	518400	IN	A	199.7.91.13
+e.root-servers.net.	518400	IN	A	192.203.230.10
+f.root-servers.net.	518400	IN	A	192.5.5.241
+g.root-servers.net.	518400	IN	A	192.112.36.4
+h.root-servers.net.	518400	IN	A	198.97.190.53
+i.root-servers.net.	518400	IN	A	192.36.148.17
+j.root-servers.net.	518400	IN	A	192.58.128.30
+k.root-servers.net.	518400	IN	A	193.0.14.129
+l.root-servers.net.	518400	IN	A	199.7.83.42
+m.root-servers.net.	518400	IN	A	202.12.27.33
+a.root-servers.net.	518400	IN	AAAA	2001:503:ba3e::2:30
+b.root-servers.net.	518400	IN	AAAA	2001:500:200::b
+c.root-servers.net.	518400	IN	AAAA	2001:500:2::c
+d.root-servers.net.	518400	IN	AAAA	2001:500:2d::d
+e.root-servers.net.	518400	IN	AAAA	2001:500:a8::e
+f.root-servers.net.	518400	IN	AAAA	2001:500:2f::f
+g.root-servers.net.	518400	IN	AAAA	2001:500:12::d0d
+h.root-servers.net.	518400	IN	AAAA	2001:500:1::53
+i.root-servers.net.	518400	IN	AAAA	2001:7fe::53
+j.root-servers.net.	518400	IN	AAAA	2001:503:c27::2:30
+k.root-servers.net.	518400	IN	AAAA	2001:7fd::1
+l.root-servers.net.	518400	IN	AAAA	2001:500:9f::42
+m.root-servers.net.	518400	IN	AAAA	2001:dc3::35
+
+;; Query time: 24 msec
+;; SERVER: 198.41.0.4#53(198.41.0.4)
+;; WHEN: Thu Apr 05 15:57:34 CEST 2018
+;; MSG SIZE  rcvd: 811
+
diff --git a/named.root.key b/named.root.key
new file mode 100644
index 0000000..48449a8
--- /dev/null
+++ b/named.root.key
@@ -0,0 +1,19 @@
+managed-keys {
+        # ROOT KEYS: See https://data.iana.org/root-anchors/root-anchors.xml
+        # for current trust anchor information.
+        #
+        # This key (20326) was published in the root zone in 2017.
+        # Servers which were already using the old key (19036) should
+        # roll seamlessly to this new one via RFC 5011 rollover. Servers
+        # being set up for the first time can use the contents of this
+        # file as initializing keys; thereafter, the keys in the
+        # managed key database will be trusted and maintained
+        # automatically.
+        . initial-key 257 3 8 "AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3
+                +/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kv
+                ArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF
+                0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+e
+                oZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfd
+                RUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwN
+                R1AkUTV74bU=";
+};
diff --git a/sources b/sources
index 592049d..29d4646 100644
--- a/sources
+++ b/sources
@@ -1,2 +1 @@
 SHA512 (bind-9.11.12.tar.gz) = 7e2b9ef4ed5a00c2e5310c932c177887aed330d94eefc87d732dda010f2b71477e2f9d6ea89422ccbc8f6f04ceb83419b758218bcc02f25b34751bad974174e8
-SHA512 (config-19.tar.bz2) = 36aa38a0c7c33267ae594b31c81681290ac58dde7ca6749bd599da531380b5b1428330813dbe983e01071ccaed83e83f6a9cd92179a53b7d0ccbb6851a0b017c

From c5d2555ae3fef86ba500a1296bb05f9c88d07536 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 4 Nov 2019 21:46:55 +0100
Subject: [PATCH 37/55] Add GeoIP configuration into config file

Upstream has wrong default path of GeoIP2. Use it explicitly.
---
 bind.spec  | 1 +
 named.conf | 1 +
 2 files changed, 2 insertions(+)

diff --git a/bind.spec b/bind.spec
index 1526771..c263aca 100644
--- a/bind.spec
+++ b/bind.spec
@@ -1533,6 +1533,7 @@ fi;
 %changelog
 * Mon Nov 04 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.12-2
 - Move data files outside config archive
+- Specify geoip data directory in config file (#1768258)
 
 * Mon Oct 21 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.12-1
 - Update to 9.11.12 (#1557762)
diff --git a/named.conf b/named.conf
index 1dc9d15..cea9782 100644
--- a/named.conf
+++ b/named.conf
@@ -34,6 +34,7 @@ options {
 	dnssec-validation yes;
 
 	managed-keys-directory "/var/named/dynamic";
+	geoip-directory "/usr/share/GeoIP";
 
 	pid-file "/run/named/named.pid";
 	session-keyfile "/run/named/session.key";

From 06e308431ac1b52f94301ab11ecdc09ddf76a6d3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 5 Nov 2019 12:15:58 +0100
Subject: [PATCH 38/55] Improve SYSTEMTEST running on build time

Use parallel execution on test run. Support already configured
interfaces without special permissions on build. It can either use
already present addresses or configure it on build time. If it has no
rights to configure it, just skip the test and continue.
---
 bind.spec | 33 +++++++++++++++++++++------------
 1 file changed, 21 insertions(+), 12 deletions(-)

diff --git a/bind.spec b/bind.spec
index c263aca..70a4100 100644
--- a/bind.spec
+++ b/bind.spec
@@ -203,7 +203,9 @@ BuildRequires:  softhsm
 %endif
 %if %{with SYSTEMTEST}
 # bin/tests/system dependencies
-BuildRequires:  net-tools perl(Net::DNS) perl(Net::DNS::Nameserver)
+BuildRequires:  perl(Net::DNS) perl(Net::DNS::Nameserver) perl(Time::HiRes) perl(Getopt::Long)
+# manual configuration requires this tool
+BuildRequires:  iproute
 %endif
 %if %{with GSSTSIG}
 BuildRequires:  krb5-devel
@@ -820,25 +822,32 @@ sed -e "/^\s*include(/ d" -e 's/^-- use //' \
 %endif
 
 %if %{with SYSTEMTEST}
-if [ "`whoami`" = 'root' ]; then
+# Runs system test if ip addresses are already configured
+# or it is able to configure them
+if perl bin/tests/system/testsock.pl
+then
+	CONFIGURED=already
+else
+	CONFIGURED=
+	sh bin/tests/system/ifconfig.sh up
+	perl bin/tests/system/testsock.pl && CONFIGURED=build
+fi
+if [ -n "$CONFIGURED" ]
+then
   set -e
-  chmod -R a+rwX .
-  pushd bin/tests
-  pushd system
-  ./ifconfig.sh up
-  popd
-  make test
+  pushd build/bin/tests
+  chown -R ${USER} . # Can be unknown user
+  make test %{?_smp_mflags} 2>&1 | tee test.log
   e=$?
-  pushd system
-  ./ifconfig.sh down
-  popd
   popd
+  [ "$CONFIGURED" = build ] && sh bin/tests/system/ifconfig.sh down
   if [ "$e" -ne 0 ]; then
     echo "ERROR: this build of BIND failed 'make test'. Aborting."
     exit $e;
   fi;
 else
-  echo 'only root can run the tests (they require an ifconfig).'
+  echo 'SKIPPED: tests require root, CAP_NET_ADMIN or already configured test addresses.'
+fi
 %endif
 :
 

From 7ae9f7782caec27db8b14da4308671930cdf6494 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 6 Nov 2019 13:33:49 +0100
Subject: [PATCH 39/55] Update chroot test to check RPM verify

In bug #1592873, error on chroot was reported. Ensure it does not
reappear.
---
 tests/Master-server-chrooted/PURPOSE    | 3 +++
 tests/Master-server-chrooted/runtest.sh | 9 ++++++---
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/tests/Master-server-chrooted/PURPOSE b/tests/Master-server-chrooted/PURPOSE
index 1d01992..c5468a4 100644
--- a/tests/Master-server-chrooted/PURPOSE
+++ b/tests/Master-server-chrooted/PURPOSE
@@ -1,3 +1,6 @@
 PURPOSE of /CoreOS/tests/Sanity/Master-server-chrooted
 Description: Run basic empty named-chroot service and try to resolve localhost on it
 Author: Petr Mensik <pemensik@redhat.com>
+
+Check also clean package both when running and finished.
+https://bugzilla.redhat.com/show_bug.cgi?id=1592873
diff --git a/tests/Master-server-chrooted/runtest.sh b/tests/Master-server-chrooted/runtest.sh
index 9ab80d2..15ebc12 100755
--- a/tests/Master-server-chrooted/runtest.sh
+++ b/tests/Master-server-chrooted/runtest.sh
@@ -34,10 +34,13 @@ PACKAGE="bind"
 test_service()
 {
     local SERVICE="$1"
+    local PACKAGE="$2"
 	rlRun "rlServiceStart $SERVICE"
 	rlRun "dig @localhost localhost | grep '^localhost'"
 	rlRun "dig @localhost -x 127.0.0.1 | grep 'PTR[[:space:]]\+localhost.$'" 0 "Reverse address works"
+	rlRun "rpm -V $PACKAGE" 0 "Checking $SERVICE package when running"
 	rlRun "rlServiceRestore $SERVICE"
+	rlRun "rpm -V $PACKAGE" 0 "Checking $SERVICE package when stopped"
 }
 
 rlJournalStart
@@ -48,16 +51,16 @@ rlJournalStart
     rlPhaseEnd
 
     rlPhaseStartTest "Testing named"
-    	test_service named
+	test_service named bind
     rlPhaseEnd
 
     rlPhaseStartTest "Testing named-chroot"
-    	test_service named-chroot
+	test_service named-chroot bind-chroot
     rlPhaseEnd
 
     rlPhaseStartTest "Testing named-sdb-chroot"
 	    if rpm -q bind-sdb-chroot; then
-		test_service named-sdb-chroot
+		test_service named-sdb-chroot bind-sdb-chroot
 	    else
 		rlLog "bind-sdb-chroot not installed, skipping it"
 	    fi

From 32dfaf988b6e74b009607258c0d7942d8a1778b0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 6 Nov 2019 21:31:14 +0100
Subject: [PATCH 40/55] Fix wrong default GeoIP directory (#1768258)

---
 bind-9.11-rh1768258.patch | 28 ++++++++++++++++++++++++++++
 bind.spec                 |  7 ++++++-
 2 files changed, 34 insertions(+), 1 deletion(-)
 create mode 100644 bind-9.11-rh1768258.patch

diff --git a/bind-9.11-rh1768258.patch b/bind-9.11-rh1768258.patch
new file mode 100644
index 0000000..71cd57f
--- /dev/null
+++ b/bind-9.11-rh1768258.patch
@@ -0,0 +1,28 @@
+From 3466dfd7d44940821f195a36fceb0f1100f77c4e Mon Sep 17 00:00:00 2001
+From: Mark Andrews <marka@isc.org>
+Date: Tue, 5 Nov 2019 12:56:18 +1100
+Subject: [PATCH] The default geoip-directory should be
+ <MAXMINDDB_PREFIX>/share/GeoIP
+
+(cherry picked from commit fcd765a59db9b9a2b187448a90f3dbe6aa72fb84)
+(cherry picked from commit 7e79ebeebada6bcca81e8368eef72efbaae3c8c7)
+---
+ bin/named/config.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/bin/named/config.c b/bin/named/config.c
+index 833c1dc9d3..63da4b03f6 100644
+--- a/bin/named/config.c
++++ b/bin/named/config.c
+@@ -72,7 +72,7 @@ options {\n\
+ "	files unlimited;\n"
+ #endif
+ #if defined(HAVE_GEOIP2) && !defined(WIN32)
+-"	geoip-directory \"" MAXMINDDB_PREFIX "/share/GeoIP2\";\n"
++"	geoip-directory \"" MAXMINDDB_PREFIX "/share/GeoIP\";\n"
+ #elif defined(HAVE_GEOIP2)
+ "	geoip-directory \".\";\n"
+ #endif
+-- 
+2.20.1
+
diff --git a/bind.spec b/bind.spec
index 70a4100..2bc5c5a 100644
--- a/bind.spec
+++ b/bind.spec
@@ -57,7 +57,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.11.12
-Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  3%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -153,6 +153,7 @@ Patch173:bind-9.11-rh1732883.patch
 # Make sure jsonccp-devel does not interfere
 Patch174:bind-9.11-json-c.patch
 Patch175:bind-9.11-fips-disable.patch
+Patch176: bind-9.11-rh1768258.patch
 
 # SDB patches
 Patch11: bind-9.3.2b2-sdbsrc.patch
@@ -532,6 +533,7 @@ are used for building ISC DHCP.
 %patch173 -p1 -b .rh1732883
 %patch174 -p1 -b .json-c
 %patch175 -p1 -b .rh1709553
+%patch176 -p1 -b .rh1768258
 
 mkdir lib/dns/tests/testdata/dstrandom
 cp -a %{SOURCE50} lib/dns/tests/testdata/dstrandom/random.data
@@ -1540,6 +1542,9 @@ fi;
 
 
 %changelog
+* Wed Nov 06 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.12-3
+- Fix wrong default GeoIP directory (#1768258)
+
 * Mon Nov 04 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.12-2
 - Move data files outside config archive
 - Specify geoip data directory in config file (#1768258)

From 56116c1216226dc1215504a46d5e544736d99dd7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 5 Nov 2019 21:41:12 +0100
Subject: [PATCH 41/55] Add helper for testing system daemons

Modifies already generated Makefiles to link against system libraries,
instead of static built artifacts.
---
 makefile-replace-libs.py | 143 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 143 insertions(+)
 create mode 100755 makefile-replace-libs.py

diff --git a/makefile-replace-libs.py b/makefile-replace-libs.py
new file mode 100755
index 0000000..90cb0de
--- /dev/null
+++ b/makefile-replace-libs.py
@@ -0,0 +1,143 @@
+#!/usr/bin/python3
+#
+# Makefile modificator
+#
+# Should help in building bin/tests/system tests standalone,
+# linked to libraries installed into the system.
+# TODO:
+# - Fix top_srcdir, because dyndb/driver/Makefile uses $TOPSRC/mkinstalldirs
+# - Fix conf.sh to contain paths to system tools
+# - Export $TOP/version somewhere, where it would be used
+# - system tests needs bin/tests code. Do not include just bin/tests/system
+#
+# Possible solution:
+#
+# sed -e 's/$TOP\/s\?bin\/\(delv\|confgen\|named\|nsupdate\|pkcs11\|python\|rndc\|check\|dig\|dnssec\|tools\)\/\([[:alnum:]-]\+\)/`type -p \2`/' conf.sh
+# sed -e 's,../../../../\(isc-config.sh\),\1,' builtin/tests.sh
+# or use: $NAMED -V | head -1 | cut -d ' ' -f 2
+
+import re
+import argparse
+
+"""
+Script for replacing Makefile ISC_INCLUDES with runtime flags.
+
+Should translate part of Makefile to use isc-config.sh instead static linked sources.
+ISC_INCLUDES = -I/home/pemensik/rhel/bind/bind-9.11.12/build/lib/isc/include \
+        -I${top_srcdir}/lib/isc \
+        -I${top_srcdir}/lib/isc/include \
+        -I${top_srcdir}/lib/isc/unix/include \
+        -I${top_srcdir}/lib/isc/pthreads/include \
+        -I${top_srcdir}/lib/isc/x86_32/include
+
+Should be translated to:
+ISC_INCLUDES = $(shell isc-config.sh --cflags isc)
+"""
+
+def isc_config(mode, lib):
+    if mode:
+        return '$(shell isc-config.sh {mode} {lib})'.format(mode=mode, lib=lib)
+    else:
+        return ''
+
+def check_match(match, debug=False):
+    """
+    Check this definition is handled by internal library
+    """
+    if not match:
+        return False
+    lib = match.group(2).lower()
+    ok = not lib_filter or lib in lib_filter
+    if debug:
+        print('{status} {lib}: {text}'.format(status=ok, lib=lib, text=match.group(1)))
+    return ok
+
+def fix_line(match, mode):
+    lib = match.group(2).lower()
+    return match.group(1)+isc_config(mode, lib)+"\n"
+
+def fix_file_lines(path, debug=False):
+    """
+    Opens file and scans fixes selected parameters
+
+    Returns list of lines if something should be changed,
+    None if no action is required
+    """
+    fixed = []
+    changed = False
+    with open(path, 'r') as fin:
+        fout = None
+
+        line = next(fin, None)
+        while line:
+            appended = False
+            while line.endswith("\\\n"):
+                line += next(fin, None)
+
+            inc = re_includes.match(line)
+            deplibs = re_deplibs.match(line)
+            libs = re_libs.match(line)
+            newline = None
+            if check_match(inc, debug=debug):
+                newline = fix_line(inc, '--cflags')
+            elif check_match(deplibs, debug=debug):
+                newline = fix_line(libs, None)
+            elif check_match(libs, debug=debug):
+                newline = fix_line(libs, '--libs')
+
+            if newline and line != newline:
+                changed = True
+                line = newline
+
+            fixed.append(line)
+            line = next(fin, None)
+
+    if not changed:
+        return None
+    else:
+        return fixed
+
+def write_lines(path, lines):
+    fout = open(path, 'w')
+    for line in lines:
+        fout.write(line)
+    fout.close()
+
+def print_lines(lines):
+    for line in lines:
+        print(line, end='')
+
+if __name__ == '__main__':
+    parser = argparse.ArgumentParser(description='Makefile multiline include replacer')
+    parser.add_argument('files', nargs='+')
+    parser.add_argument('--filter', type=str,
+            default='isc isccc isccfg dns lwres bind9 irs',
+            help='List of libraries supported by isc-config.sh')
+    parser.add_argument('--check', action='store_true',
+            help='Test file only')
+    parser.add_argument('--print', action='store_true',
+            help='Print changed file only')
+    parser.add_argument('--debug', action='store_true',
+            help='Enable debug outputs')
+
+    args = parser.parse_args()
+    lib_filter = None
+
+    re_includes = re.compile(r'^\s*((\w+)_INCLUDES\s+=\s*).*')
+    re_deplibs = re.compile(r'^\s*((\w+)DEPLIBS\s*=).*')
+    re_libs = re.compile(r'^\s*((\w+)LIBS\s*=).*')
+
+    if args.filter:
+        lib_filter = set(args.filter.split(' '))
+        pass
+
+    for path in args.files:
+        lines = fix_file_lines(path, debug=args.debug)
+        if lines:
+            if args.print:
+                print_lines(lines)
+            elif not args.check:
+                write_lines(path, lines)
+                print('File {path} was fixed'.format(path=path))
+        else:
+            print('File {path} does not need fixing'.format(path=path))

From de801506e861c2122864eb83c931deacb412aab2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 19 Nov 2019 13:37:14 +0100
Subject: [PATCH 42/55] Report error on reload failure (#1739441)

Return failed status code to command. Not only report error message to
the log, but also report reload success. Must not terminate running
service on failed reload.
---
 bind.spec                | 5 ++++-
 named-chroot.service     | 2 +-
 named-pkcs11.service     | 2 +-
 named-sdb-chroot.service | 2 +-
 named-sdb.service        | 2 +-
 named.service            | 2 +-
 6 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/bind.spec b/bind.spec
index 2bc5c5a..4e39e54 100644
--- a/bind.spec
+++ b/bind.spec
@@ -57,7 +57,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.11.12
-Release:  3%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  4%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1542,6 +1542,9 @@ fi;
 
 
 %changelog
+* Tue Nov 19 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.12-4
+- Report failures on systemctl reload (#1739441)
+
 * Wed Nov 06 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.12-3
 - Fix wrong default GeoIP directory (#1768258)
 
diff --git a/named-chroot.service b/named-chroot.service
index ed9aa51..6898039 100644
--- a/named-chroot.service
+++ b/named-chroot.service
@@ -21,7 +21,7 @@ ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr
 ExecStart=/usr/sbin/named -u named -c ${NAMEDCONF} -t /var/named/chroot $OPTIONS
 
 ; until https://github.com/systemd/systemd/pull/13098 is present, ignore return value
-ExecReload=-/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
+ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
 
 ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'
 
diff --git a/named-pkcs11.service b/named-pkcs11.service
index f0e8913..895383a 100644
--- a/named-pkcs11.service
+++ b/named-pkcs11.service
@@ -17,7 +17,7 @@ ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr
 ExecStart=/usr/sbin/named-pkcs11 -u named -c ${NAMEDCONF} $OPTIONS
 
 ; until https://github.com/systemd/systemd/pull/13098 is present, ignore return value
-ExecReload=-/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
+ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
 
 ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'
 
diff --git a/named-sdb-chroot.service b/named-sdb-chroot.service
index 16a080f..112b835 100644
--- a/named-sdb-chroot.service
+++ b/named-sdb-chroot.service
@@ -21,7 +21,7 @@ ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr
 ExecStart=/usr/sbin/named-sdb -u named -c ${NAMEDCONF} -t /var/named/chroot_sdb $OPTIONS
 
 ; until https://github.com/systemd/systemd/pull/13098 is present, ignore return value
-ExecReload=-/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
+ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
 
 ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'
 
diff --git a/named-sdb.service b/named-sdb.service
index d3ef6e5..ced2b46 100644
--- a/named-sdb.service
+++ b/named-sdb.service
@@ -17,7 +17,7 @@ ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr
 ExecStart=/usr/sbin/named-sdb -u named -c ${NAMEDCONF} $OPTIONS
 
 ; until https://github.com/systemd/systemd/pull/13098 is present, ignore return value
-ExecReload=-/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
+ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
 
 ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'
 
diff --git a/named.service b/named.service
index 86737ea..dd753b5 100644
--- a/named.service
+++ b/named.service
@@ -16,7 +16,7 @@ PIDFile=/run/named/named.pid
 ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
 ExecStart=/usr/sbin/named -u named -c ${NAMEDCONF} $OPTIONS
 ; until https://github.com/systemd/systemd/pull/13098 is present, ignore return value
-ExecReload=-/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
+ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
 
 ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'
 

From dd1eccb8ef5e5aed3aae60b534b30eeff287aaf3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 19 Nov 2019 14:01:06 +0100
Subject: [PATCH 43/55] Remove reload related comments from services

Seems systemd already fixes reload return codes. Remove comment from
systemd service files.
---
 named-chroot.service     | 1 -
 named-pkcs11.service     | 1 -
 named-sdb-chroot.service | 1 -
 named-sdb.service        | 1 -
 named.service            | 1 -
 5 files changed, 5 deletions(-)

diff --git a/named-chroot.service b/named-chroot.service
index 6898039..a49df15 100644
--- a/named-chroot.service
+++ b/named-chroot.service
@@ -20,7 +20,6 @@ PIDFile=/var/named/chroot/run/named/named.pid
 ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf -t /var/named/chroot -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
 ExecStart=/usr/sbin/named -u named -c ${NAMEDCONF} -t /var/named/chroot $OPTIONS
 
-; until https://github.com/systemd/systemd/pull/13098 is present, ignore return value
 ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
 
 ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'
diff --git a/named-pkcs11.service b/named-pkcs11.service
index 895383a..27e0693 100644
--- a/named-pkcs11.service
+++ b/named-pkcs11.service
@@ -16,7 +16,6 @@ PIDFile=/run/named/named.pid
 ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
 ExecStart=/usr/sbin/named-pkcs11 -u named -c ${NAMEDCONF} $OPTIONS
 
-; until https://github.com/systemd/systemd/pull/13098 is present, ignore return value
 ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
 
 ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'
diff --git a/named-sdb-chroot.service b/named-sdb-chroot.service
index 112b835..acf88ba 100644
--- a/named-sdb-chroot.service
+++ b/named-sdb-chroot.service
@@ -20,7 +20,6 @@ PIDFile=/var/named/chroot_sdb/run/named/named.pid
 ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf -t /var/named/chroot_sdb -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
 ExecStart=/usr/sbin/named-sdb -u named -c ${NAMEDCONF} -t /var/named/chroot_sdb $OPTIONS
 
-; until https://github.com/systemd/systemd/pull/13098 is present, ignore return value
 ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
 
 ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'
diff --git a/named-sdb.service b/named-sdb.service
index ced2b46..cdf3a62 100644
--- a/named-sdb.service
+++ b/named-sdb.service
@@ -16,7 +16,6 @@ PIDFile=/run/named/named.pid
 ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
 ExecStart=/usr/sbin/named-sdb -u named -c ${NAMEDCONF} $OPTIONS
 
-; until https://github.com/systemd/systemd/pull/13098 is present, ignore return value
 ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
 
 ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'
diff --git a/named.service b/named.service
index dd753b5..7cd6d34 100644
--- a/named.service
+++ b/named.service
@@ -15,7 +15,6 @@ PIDFile=/run/named/named.pid
 
 ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
 ExecStart=/usr/sbin/named -u named -c ${NAMEDCONF} $OPTIONS
-; until https://github.com/systemd/systemd/pull/13098 is present, ignore return value
 ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
 
 ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'

From ac73aa78f364cbdfc4c6a97aeb6c9ec25213b9ad Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 18 Nov 2019 20:01:52 +0100
Subject: [PATCH 44/55] Update to 9.11.13

Includes fix for:
* CVE-2019-6477 bind: TCP Pipelining doesn't limit TCP clients on a single connection
---
 .gitignore                |  2 ++
 bind-9.11-rh1732883.patch | 36 +++++++++++++++-----------------
 bind-9.11-rt46047.patch   | 44 +++++++++++++++++++--------------------
 bind.spec                 | 11 +++++-----
 sources                   |  3 ++-
 5 files changed, 49 insertions(+), 47 deletions(-)

diff --git a/.gitignore b/.gitignore
index fbc6f9b..ebe1d83 100644
--- a/.gitignore
+++ b/.gitignore
@@ -97,3 +97,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.11.10.tar.gz
 /bind-9.11.11.tar.gz
 /bind-9.11.12.tar.gz
+/bind-9.11.13.tar.gz
+/bind-9.11.13.tar.gz.asc
diff --git a/bind-9.11-rh1732883.patch b/bind-9.11-rh1732883.patch
index 80820b5..14bf265 100644
--- a/bind-9.11-rh1732883.patch
+++ b/bind-9.11-rh1732883.patch
@@ -1,4 +1,4 @@
-From 348947b3d573e2187db61fb43919d2260dcfc135 Mon Sep 17 00:00:00 2001
+From 6010876e561b4345e569ffd11eaec9ea52725817 Mon Sep 17 00:00:00 2001
 From: Pavel Zhukov <pzhukov@redhat.com>
 Date: Wed, 24 Jul 2019 17:15:55 +0200
 Subject: [PATCH] Detect system time jumps
@@ -17,18 +17,16 @@ go_reboot() procedure to request lease extention
  6 files changed, 84 insertions(+), 5 deletions(-)
 
 diff --git a/lib/isc/include/isc/result.h b/lib/isc/include/isc/result.h
-index 0fd4971..2add549 100644
+index 0389efa..149cde5 100644
 --- a/lib/isc/include/isc/result.h
 +++ b/lib/isc/include/isc/result.h
-@@ -87,9 +87,10 @@
- #define ISC_R_CRYPTOFAILURE		65	/*%< cryptography library failure */
- #define ISC_R_DISCQUOTA			66	/*%< disc quota */
+@@ -89,7 +89,8 @@
  #define ISC_R_DISCFULL			67	/*%< disc full */
-+#define ISC_R_TIMESHIFTED               68      /*%< system time changed */
- 
- /*% Not a result code: the number of results. */
--#define ISC_R_NRESULTS 			68
-+#define ISC_R_NRESULTS 			69
+ #define ISC_R_DEFAULT			68	/*%< default */
+ #define ISC_R_IPV4PREFIX		69	/*%< IPv4 prefix */
+-#define ISC_R_NRESULTS 			70
++#define ISC_R_TIMESHIFTED               70      /*%< system time changed */
++#define ISC_R_NRESULTS 			71
  
  ISC_LANG_BEGINDECLS
  
@@ -47,27 +45,27 @@ index 973c348..8160dd3 100644
  /*%
   * Alignment
 diff --git a/lib/isc/result.c b/lib/isc/result.c
-index abb6ed2..8c95a93 100644
+index a9db132..7c04831 100644
 --- a/lib/isc/result.c
 +++ b/lib/isc/result.c
-@@ -103,6 +103,7 @@ static const char *description[ISC_R_NRESULTS] = {
- 	"crypto failure",			/*%< 65 */
- 	"disc quota",				/*%< 66 */
+@@ -105,6 +105,7 @@ static const char *description[ISC_R_NRESULTS] = {
  	"disc full",				/*%< 67 */
-+        "time changed",                         /*%< 68 */
+ 	"default",				/*%< 68 */
+ 	"IPv4 prefix",				/*%< 69 */
++        "time changed",                         /*%< 70 */
  };
  
  static const char *identifier[ISC_R_NRESULTS] = {
-@@ -174,6 +175,7 @@ static const char *identifier[ISC_R_NRESULTS] = {
- 	"ISC_R_CRYPTOFAILURE",
- 	"ISC_R_DISCQUOTA",
+@@ -178,6 +179,7 @@ static const char *identifier[ISC_R_NRESULTS] = {
  	"ISC_R_DISCFULL",
+ 	"ISC_R_DEFAULT",
+ 	"ISC_R_IPV4PREFIX",
 +        "ISC_R_TIMESHIFTED",
  };
  
  #define ISC_RESULT_RESULTSET			2
 diff --git a/lib/isc/unix/app.c b/lib/isc/unix/app.c
-index 7e5a0ee..ceab74e 100644
+index a6e9882..52eb3e0 100644
 --- a/lib/isc/unix/app.c
 +++ b/lib/isc/unix/app.c
 @@ -442,15 +442,48 @@ isc__app_ctxonrun(isc_appctx_t *ctx0, isc_mem_t *mctx, isc_task_t *task,
diff --git a/bind-9.11-rt46047.patch b/bind-9.11-rt46047.patch
index 4bb47e8..8f413f6 100644
--- a/bind-9.11-rt46047.patch
+++ b/bind-9.11-rt46047.patch
@@ -1,4 +1,4 @@
-From 4c7b644910e21e690e5f51d5596a9fe46d9c7b7a Mon Sep 17 00:00:00 2001
+From 5a465424f5249ceaf0547ab90361a16eb08f7a2b Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Thu, 28 Sep 2017 10:09:22 -0700
 Subject: [PATCH] completed and corrected the crypto-random change
@@ -142,10 +142,10 @@ index 31a99e7..38c83ed 100644
  					   usekeyboard);
  
 diff --git a/bin/named/client.c b/bin/named/client.c
-index 2169954..c6c59f7 100644
+index 50fa2cd..524d9a3 100644
 --- a/bin/named/client.c
 +++ b/bin/named/client.c
-@@ -1754,7 +1754,8 @@ ns_client_addopt(ns_client_t *client, dns_message_t *message,
+@@ -1762,7 +1762,8 @@ ns_client_addopt(ns_client_t *client, dns_message_t *message,
  
  		isc_buffer_init(&buf, cookie, sizeof(cookie));
  		isc_stdtime_get(&now);
@@ -156,7 +156,7 @@ index 2169954..c6c59f7 100644
  		compute_cookie(client, now, nonce, ns_g_server->secret, &buf);
  
 diff --git a/bin/named/config.c b/bin/named/config.c
-index de64ca5..833c1dc 100644
+index dbdff64..63da4b0 100644
 --- a/bin/named/config.c
 +++ b/bin/named/config.c
 @@ -98,7 +98,9 @@ options {\n\
@@ -223,7 +223,7 @@ index d955c2f..40621f2 100644
  	} else
  		eresult = ns_control_docommand(request, listener->readonly, &text);
 diff --git a/bin/named/include/named/server.h b/bin/named/include/named/server.h
-index f5ed2b7..b2c1d05 100644
+index 7ee8f66..8982d26 100644
 --- a/bin/named/include/named/server.h
 +++ b/bin/named/include/named/server.h
 @@ -20,6 +20,7 @@
@@ -243,7 +243,7 @@ index f5ed2b7..b2c1d05 100644
  
  struct ns_altsecret {
 diff --git a/bin/named/interfacemgr.c b/bin/named/interfacemgr.c
-index 9bd1f93..851d3c9 100644
+index 9dea7c1..272d300 100644
 --- a/bin/named/interfacemgr.c
 +++ b/bin/named/interfacemgr.c
 @@ -17,6 +17,7 @@
@@ -255,7 +255,7 @@ index 9bd1f93..851d3c9 100644
  #include <isc/task.h>
  #include <isc/util.h>
 diff --git a/bin/named/query.c b/bin/named/query.c
-index 86417c7..55b7b7c 100644
+index c9e5469..0940714 100644
 --- a/bin/named/query.c
 +++ b/bin/named/query.c
 @@ -19,6 +19,7 @@
@@ -267,10 +267,10 @@ index 86417c7..55b7b7c 100644
  #include <isc/serial.h>
  #include <isc/stats.h>
 diff --git a/bin/named/server.c b/bin/named/server.c
-index c782073..bc59cbc 100644
+index 36fc047..3c1eec0 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
-@@ -8204,21 +8204,32 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8208,21 +8208,32 @@ load_configuration(const char *filename, ns_server_t *server,
  	 * Open the source of entropy.
  	 */
  	if (first_time) {
@@ -312,7 +312,7 @@ index c782073..bc59cbc 100644
  #ifdef PATH_RANDOMDEV
  			if (ns_g_fallbackentropy != NULL) {
  				level = ISC_LOG_INFO;
-@@ -8229,8 +8240,8 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8233,8 +8244,8 @@ load_configuration(const char *filename, ns_server_t *server,
  					      NS_LOGCATEGORY_GENERAL,
  					      NS_LOGMODULE_SERVER,
  					      level,
@@ -323,7 +323,7 @@ index c782073..bc59cbc 100644
  					      randomdev,
  					      isc_result_totext(result));
  			}
-@@ -8250,7 +8261,6 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8254,7 +8265,6 @@ load_configuration(const char *filename, ns_server_t *server,
  				}
  				isc_entropy_detach(&ns_g_fallbackentropy);
  			}
@@ -331,7 +331,7 @@ index c782073..bc59cbc 100644
  #endif
  		}
  
-@@ -9018,6 +9028,7 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
+@@ -9022,6 +9032,7 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
  	server->in_roothints = NULL;
  	server->blackholeacl = NULL;
  	server->keepresporder = NULL;
@@ -339,7 +339,7 @@ index c782073..bc59cbc 100644
  
  	/* Must be first. */
  	CHECKFATAL(dst_lib_init2(ns_g_mctx, ns_g_entropy,
-@@ -9044,6 +9055,9 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
+@@ -9048,6 +9059,9 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
  	CHECKFATAL(dns_tkeyctx_create(ns_g_mctx, ns_g_entropy,
  				      &server->tkeyctx),
  		   "creating TKEY context");
@@ -349,7 +349,7 @@ index c782073..bc59cbc 100644
  
  	/*
  	 * Setup the server task, which is responsible for coordinating
-@@ -9250,7 +9264,8 @@ ns_server_destroy(ns_server_t **serverp) {
+@@ -9254,7 +9268,8 @@ ns_server_destroy(ns_server_t **serverp) {
  
  	if (server->zonemgr != NULL)
  		dns_zonemgr_detach(&server->zonemgr);
@@ -359,7 +359,7 @@ index c782073..bc59cbc 100644
  	if (server->tkeyctx != NULL)
  		dns_tkeyctx_destroy(&server->tkeyctx);
  
-@@ -13221,10 +13236,10 @@ newzone_cfgctx_destroy(void **cfgp) {
+@@ -13230,10 +13245,10 @@ newzone_cfgctx_destroy(void **cfgp) {
  
  static isc_result_t
  generate_salt(unsigned char *salt, size_t saltlen) {
@@ -372,7 +372,7 @@ index c782073..bc59cbc 100644
  	} rnd;
  	unsigned char text[512 + 1];
  	isc_region_t r;
-@@ -13234,9 +13249,10 @@ generate_salt(unsigned char *salt, size_t saltlen) {
+@@ -13243,9 +13258,10 @@ generate_salt(unsigned char *salt, size_t saltlen) {
  	if (saltlen > 256U)
  		return (ISC_R_RANGE);
  
@@ -455,7 +455,7 @@ index 2146f9b..64b8e74 100644
  	}
  #endif
 diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
-index 9bf100f..c161e71 100644
+index 33e06e6..539973c 100644
 --- a/doc/arm/Bv9ARM-book.xml
 +++ b/doc/arm/Bv9ARM-book.xml
 @@ -5076,22 +5076,45 @@ badresp:1,adberr:0,findfail:0,valfail:0]
@@ -570,13 +570,13 @@ index 0000000..11c3a7c
 +</section>
 +
 diff --git a/doc/arm/notes.xml b/doc/arm/notes.xml
-index 3a9cfcf..ded2000 100644
+index b16dab6..763ff7e 100644
 --- a/doc/arm/notes.xml
 +++ b/doc/arm/notes.xml
-@@ -23,6 +23,7 @@
-   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-sec-fixes.xml"/>
-   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-new-features.xml"/>
-   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-bug-fixes.xml"/>
+@@ -36,6 +36,7 @@
+   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-9.11.1.xml"/>
+   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-9.11.0.xml"/>
+ 
 +  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-rh-changes.xml"/>
    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-eol.xml"/>
    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-thankyou.xml"/>
diff --git a/bind.spec b/bind.spec
index 4e39e54..83485c8 100644
--- a/bind.spec
+++ b/bind.spec
@@ -49,15 +49,15 @@
 
 # lib*.so.X versions of selected libraries
 %global sover_dns 1107
-%global sover_isc 1100
+%global sover_isc 1104
 %global sover_irs 161
 %global sover_isccfg 163
 
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.11.12
-Release:  4%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Version:  9.11.13
+Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -153,7 +153,6 @@ Patch173:bind-9.11-rh1732883.patch
 # Make sure jsonccp-devel does not interfere
 Patch174:bind-9.11-json-c.patch
 Patch175:bind-9.11-fips-disable.patch
-Patch176: bind-9.11-rh1768258.patch
 
 # SDB patches
 Patch11: bind-9.3.2b2-sdbsrc.patch
@@ -533,7 +532,6 @@ are used for building ISC DHCP.
 %patch173 -p1 -b .rh1732883
 %patch174 -p1 -b .json-c
 %patch175 -p1 -b .rh1709553
-%patch176 -p1 -b .rh1768258
 
 mkdir lib/dns/tests/testdata/dstrandom
 cp -a %{SOURCE50} lib/dns/tests/testdata/dstrandom/random.data
@@ -1542,6 +1540,9 @@ fi;
 
 
 %changelog
+* Tue Nov 19 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.13-1
+- Update to 9.11.13
+
 * Tue Nov 19 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.12-4
 - Report failures on systemctl reload (#1739441)
 
diff --git a/sources b/sources
index 29d4646..d213c25 100644
--- a/sources
+++ b/sources
@@ -1 +1,2 @@
-SHA512 (bind-9.11.12.tar.gz) = 7e2b9ef4ed5a00c2e5310c932c177887aed330d94eefc87d732dda010f2b71477e2f9d6ea89422ccbc8f6f04ceb83419b758218bcc02f25b34751bad974174e8
+SHA512 (bind-9.11.13.tar.gz) = 6e5289ff231b8d7d2f02ae02a1cf43abff3e507e1d96d8ec002dc71097fc77dc5514762ff1ea5918159c88319b1d5eed78c6dc1a7835173db234d4ee887644bc
+SHA512 (bind-9.11.13.tar.gz.asc) = 5b32adee7d45cdd2921126e898824839f6a0a5574c0ae5a441fc7df78681ebf872a276d6e434e8043cf9ec504f57c2b8fdf79fdb141e32dac5c4fa57c18d52f4

From e72f4e4ce78448e45e52754043f966249ebfc1b2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 25 Nov 2019 21:00:46 +0100
Subject: [PATCH 45/55] Add source verification on build
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Include verification on build time, with link to GPG keys on upstream
site.

Signed-off-by: Petr Menšík <pemensik@redhat.com>
---
 bind.spec        |   3 +
 codesign2019.txt | 252 +++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 255 insertions(+)
 create mode 100644 codesign2019.txt

diff --git a/bind.spec b/bind.spec
index 83485c8..0229ae2 100644
--- a/bind.spec
+++ b/bind.spec
@@ -65,6 +65,7 @@ Source:   https://ftp.isc.org/isc/bind9/%{BINDVERSION}/bind-%{BINDVERSION}.tar.g
 Source1:  named.sysconfig
 Source2:  https://ftp.isc.org/isc/bind9/%{BINDVERSION}/bind-%{BINDVERSION}.tar.gz.asc
 Source3:  named.logrotate
+Source4:  https://downloads.isc.org/isc/pgpkeys/codesign2019.txt
 Source7:  bind-9.3.1rc1-sdb_tools-Makefile.in
 Source8:  dnszone.schema
 Source12: README.sdb_pgsql
@@ -190,6 +191,7 @@ BuildRequires:  selinux-policy
 BuildRequires:  python3-devel
 BuildRequires:  python3-ply
 BuildRequires:  findutils sed
+BuildRequires:  gnupg2
 %if %{with SDB}
 BuildRequires:  openldap-devel, libpq-devel, sqlite-devel, mariadb-connector-c-devel
 BuildRequires:  libdb-devel
@@ -500,6 +502,7 @@ are used for building ISC DHCP.
 %endif
 
 %prep
+%{gpgverify} --keyring='%{SOURCE4}' --signature='%{SOURCE2}' --data='%{SOURCE0}'
 %setup -q -n %{name}-%{BINDVERSION}
 
 # Common patches
diff --git a/codesign2019.txt b/codesign2019.txt
new file mode 100644
index 0000000..1807b58
--- /dev/null
+++ b/codesign2019.txt
@@ -0,0 +1,252 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Comment: GPGTools - http://gpgtools.org
+
+mQINBFwq9BQBEADHjPDCwsHVtxnMNilgu187W8a9rYTMLgLfQwioSbjsF7dUJu8m
+r1w2stcsatRs7HBk/j26RNJagY2Jt0QufOQLlTePpTl6UPU8EeiJ8c15DNf45TMk
+pa/3MdIVpDnBioyD1JNqsI4z+yCYZ7p/TRVCyh5vCcwmt5pdKjKMTcu7aD2PtTtI
+yhTIetJavy1HQmgOl4/t/nKL7Lll2xtZ56JFUt7epo0h69fiUvPewkhykzoEf4UG
+ZFHSLZKqdMNPs/Jr9n7zS+iOgEXJnKDkp8SoXpAcgJ5fncROMXpxgY2U+G5rB9n0
+/hvV1zG+EP6OLIGqekiDUga84LdmR/8Cyc7DimUmaoIZXrAo0Alpt0aZ8GimdKmh
+qirIguJOSrrsZTeZLilCWu37fRIjCQ3dSMNyhHJaOhRJQpQOEDG7jHxFak7627aF
+UnVwBAOK3NlFfbomapXQm64lYNoONGrpV0ctueD3VoPipxIyzNHHgcsXDZ6C00sv
+SbuuS9jlFEDonA6S8tApKgkEJuToBuopM4xqqwHNJ4e6QoXYjERIgIBTco3r/76D
+o22ZxSK1m2m2i+p0gnWTlFn6RH+r6gfLwZRj8iR4fa0yMn3DztyTO6H8AiaslONt
+LV2kvkhBar1/6dzlBvMdiRBejrVnw+Jg2bOmYTncFN00szPOXbEalps8wwARAQAB
+tE1JbnRlcm5ldCBTeXN0ZW1zIENvbnNvcnRpdW0sIEluYy4gKFNpZ25pbmcga2V5
+LCAyMDE5LTIwMjApIDxjb2Rlc2lnbkBpc2Mub3JnPokCVAQTAQgAPhYhBK4/rHln
+EexZ/AB6pHS7a5pMuz04BQJcKvQUAhsDBQkD7JcABQsJCAcCBhUKCQgLAgQWAgMB
+Ah4BAheAAAoJEHS7a5pMuz0476oP/1+UaSHfe4WVHV43QaQ/z1rw7vg2aHEwyWJA
+1D1tBr9+LvfohswwWBLIjcKRaoXZ4pLBFjuiYHBTsdaAQFeQQvQTXMmBx21ZyUZj
+tjim8f9T1JhmIrMx6tF14NbqFpjw82Mv0rc8y74pdRvkdnFigqLKUoN2tFQlKeG+
+5T24zNwrGrlR3S7gnM47nD1JqKwt4GnczLnMBW/0gbLscMUpAeNo/gY4g0GV/zkn
+Rt91bLpcEyDAv+ZhQZbkJ49dnNzl5cTK5+uQWnlAZAdPecdLkvBNRNgj/FKL41RF
+JGN6eqq3+jlPbyj9okeJoGQ64Ibv1ZHVTQIx5vT1+PuVX/Nm0GqSUZdLqR33daKI
+hjpgUdUK/D0AnN5ulVuE1NnZWjVDTXVEeU8DFvi4lxZVHnZixejxFIZ7vRMvyaHa
+xLwbevwEUuPLzWn3XhC5yQeqCe6zmzzaPhPlg6NTnM5wgzcKORqCXgxzmtnX+Pbd
+gXTwNKAJId/141vj1OtZQKJexG9QLufMjBg5rg/qdKooozremeM+FovIocbdFnmX
+pzP8it8r8FKi7FpXRE3fwxwba4Y9AS2/owtuixlJ2+7M2OXwZEtxyXTXw2v5GFOP
+vN64G/b71l9c3yKVlQ3BXD0jErv9XcieeFDR9PK0XGlsxykPcIXZYVy2KSWptkSf
+6f2op3tMiQEzBBABCAAdFiEEFcm6uMUTPAcGawLtlumWUDlMmawFAlwuSqAACgkQ
+lumWUDlMmaz+igf/ZW8OY5aWjRk7QiXp93jkWRIbMi8kB9jW5u6tfYXFjMADpqiQ
+yYdzEHFayRF92PQwj81UzIWzOWjErFWLDE2xol9sP5LdzeqoyED+XTqKggpVsIs+
+Lq672qnumQoZKp1YGb8MDocU2DNg/VsMdi7kCnEnPbcSuBxksmxGYomusXNrAF94
+1OJ2sqd9BuFamLIyn8XUCGGYlsvMoe4kTCg6Cc1sQvx0lDG8urKN57jBKWbP4alV
++JBV5KQcf74gzPmE3ypgY1tMEwxyH/WyS9ekDbai0qauX6eUAsM1bduH8fIcknLS
+Zl5hrJTrzWFF9/DKOth8QOwhJ9zoIF1fcAsx9okBMwQQAQgAHRYhBHpqR7X54SM6
+0lUrXL2X3GOe6MR7BQJcLktcAAoJEL2X3GOe6MR7jwEH/iaolMeno1oeWAgzN6Mg
+bx3maweh/9Vqty1fwk7Crq1G78X5i1OCkknEL2p0Bfle4ApwcC4HZVcqCgoYpRV3
+/EEXtwkMNy3plWdBbLCQSev/E1D39GzgAHiMnv7NUJnkoJbvMrvrAiUTXPTtARMM
+gjEpvgEs60wuJxS8ESomRhe/KW4myxDoBxF+K+e5bOkOvvWVcAYJHWZ1BIZs4n6b
++C2vO8q5aKTkQ/XvNT7utbTOqj1SGhItRaAQKXHBdzkQ1Et3wTA4+uRg4gK12624
+9LperYs26w9X9UzApl+qVxQhtWUw3tnUXMastDfQrRcvJgq1xpv++OqX5Uc93RTf
+SNWJAjMEEAEIAB0WIQS+DpdItxglOii7if/xsRvwXPAuVwUCXC5LlQAKCRDxsRvw
+XPAuV29KEACEwlTVVKe4gnBYHnlAD7csoQ0+gJ6C+Ofzlw+UItRIcFeVCAknSGBs
+NPxr9JStIvKpmsbSKpCNUEAYnRP2immh94y/C6BuTe1uUUmqBGr1f4OAUwZpmI29
+ixYeY/uUs9FZO3bS0/WtG46tdcJK41qtM0DYAGT3oeZhJMTW15dfvMGlFukauSOU
++BbR+6sZhqdbWl/AOTE/6x5otnAaW0GObY/BW240Xq/KTgBrzVdK5qNoYsMVsiTd
+0im0JKvFG08ED+ZfcILhlO6G9jRhoTkhtYuf8CKN1dPf2IoB5FrRFf0xqRr9hNlk
+X7ViNMP9OPb8i3BubWvRi5rNSquCwrFATSiAgaA9Yi1BNzQsmQxOql9lsh7eCH7m
++8zzUg9umWI6PkSv8vHBo2kPX73wmtEsF6vxJlk0yDBuQw7y0uuKh406tEEk4cP2
+8U4baq+ihpioupDhNuEII1h1Eh/RBE408RAOpcr+2F0m/fKOoJyz7u+AxyV81Ia6
+fyBnUfZnlfKo16w87c1HJRs9dKkRa5yGziBf9TcED3sru58Pftes2Nr80/iOh26i
+P2pRihcIyrmeAqDWnneErVCmPMDTe6zkMrm/0iZ25/Jfq+M8IHEzFEw3Y1FBOeFg
+9TyMDwYG2biJPTNTDO0BQ+Rrvs4SjFWEYSxgJSvG1jMfSPt5AR6MJrkCDQRcKvQU
+ARAAufZX5WzJr0lZAhxaGpHY6JMBr4jVOCP4TrDZhwC2K4CXNM/PLLNisWzquiWa
+FvUDhB89kCxrEhipwVFYhBr16CDQxrr8yhah3RIxrBMYhRTxgIAkANgkhGWfDJSE
+zXauA7krYtS3rYwhfXe4cNsTkLPbnMUlyLJcqj2wnZcZIt97aL+NFRPyfIw1KfUb
+9u3tB9seDYbvTEULeL07aTnHpWM5f3bTwJrJ2OFPzXseCCzPiVNh3Bv+YtJ1pMTr
+c/UHO5DoJuHLsF0wicPSrpD0twspFdR/0rT6eNycsaCtV4GQzBcMPvY7qai5XrZm
+Cqgluo1W6l6+F5YrKvRMtyyFkUNGcPywdjSlP44JyRrS2uzvFUViSsJArcmFG2TJ
+LCohnse8wqjw0dIUVbmDbE4zjaG56zkvu0k+04Wwp3XPgOZrbl6cbhX3yLhu/Gt0
+dzd9EReoNfKXk32hBzKas/vdeB5DZejbOOOWYftqyZC1LvDvvrYFhFK6VGozfZ6L
+Fml1hzn+xPahp5tRv93/T9zXeVPm9zilGMqm/gjRgh8ojWxNQoNzJyqTPWIvWmbu
+EIP3T3cTFq6lJpJsg3+sfzofGWZCGnBZQGqm8rEOoUWiaKe1BvQCX1x8p4/x8/tX
+TaVDpQCGoqxXt09plkDuGMuiDICxBlaHWUR2jLoHc2cLrB8AEQEAAYkCPAQYAQgA
+JhYhBK4/rHlnEexZ/AB6pHS7a5pMuz04BQJcKvQUAhsMBQkD7JcAAAoJEHS7a5pM
+uz04pB8P/Amfg54IFeALiPOrKbjC3bVAQzrsf09IL8sUln/LCZIx9HgGAJj/f35S
+Q35sK2ucjWiDX6qCxVrWmC6caQXFgXOFSKIlqladmmgj4sIdLM5wj4nbomHChpB5
+rqV/GgkFwWBQ3kPCatXvc8Bg+zKJ+wXgTuPFXefyE9R+SLuas2grQ9hAjvTGHYbq
+iYxSlNDFc1aHLAQ3bS76351MHuMHOpLzoB0OkZDCVNW4GNEqrLbINdr50RAK+Loo
+Z2UBIobEZjXYor9A2FWkSvdjyz6X1QKMdQMath6R91k/O0abBa7ly4/805eAGXM3
+w1Xf2eMlpiUs69BeYoJBklK8aNMntpDREunJjhiPU4JoDzSxl5Qv7LuXylyo0YJA
+9YmydKhTTcRdwsKc//nGr/ckg4BRl+VbtJBYvd3xGB7IQ+pT/TOakv9qCospAhr3
+EQjVP/XpnWJRd+x+dq8UXqwWmTenWDE42cNr7BDFJdOqS5ZWy4sIz4sdjpSxXMB9
+8iiRtKSpKRCJgXScB7SYebh835EgG2YyQGdhJMO7C6ok9POYQBqL8sBqRzImJKoT
+VDvOH42WArKwJWTHa4mPdiDHEIZlkONerec3JXtl4Mfv8cwZ5Lb8fSiB/x8AWvqs
+puc/7hQtkus4TcgutS1fwhAwpnFItpVF6+73CMQrJsblBdTjW0T+uQINBFxbVHwB
+EADebZOJbhPdhHeBPdlZYE3rRjB8scDpWdjrCupfmeTC9MM6JgCE4DEMBtBXk+h1
++7wfpblYYNFwGVFvytG5nvGRDtHWxwd1Z9O8Fx4Zqu0Fx/wAn7ZL3ryE+tdHR7JK
+7SLxOa2X49T/8LY0U8Q65I4ZRo/b4VMcXApCmncw3QSRqHT/mYdNnf+HHPvi3jza
+md3iVptCS4Iaisc079DFda+htWXspBc13lmPi2vGQkWjjS3B4yO8JackyQPVhpsg
+KYbRBzOH0Kii8bXmyA6O5uIJYEddp5Veged4FE/ej3CrgGP1D0Yk1epx8lLbi9RB
+kwFS7DA5rQ23UnbSy1WyV1ZgPrWqQAWuGpjMTVTWN0ElI3AGxAnE8lZlSXyE+XyV
+uHjjIVrayBjLKVqDuSLdKZeCvI4QsyHH6F0NKJQkngvXxLZYxO6s0c2EFFLzdVWT
+1V9GMP8UsDrrb+JsZjUVmPR1tTP4xqEQG6KjfFoQm5XWpGtFwh91OK1lwf/Bx2/C
+j+PquLLFcj7hEP79VDTUZPQAduTTxIeTzHXH+x1PCHFB10xxH3e82VSdJeBUrJxn
+riXzK50SKTTmF+uYpHqE8Jg1N2Y1n5ksuxeYUy8PFjhAeBCqZ6ZcldUDf4999e/z
+PT8bwfCDr8jRdqJHrq7RxTJiP5RsMudWpKeohzJGwQ5uZwARAQABiQRyBBgBCAAm
+FiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAlxbVHwCGwIFCQO9IQACQAkQdLtrmky7
+PTjBdCAEGQEIAB0WIQSVztolaxygoV8wL7WVIaftXazpGAUCXFtUfAAKCRCVIaft
+XazpGPeMEACm9nxA/VKf8RxDo2ZuTgyuSwlR8tCjAE4k3+UoiYUbamkW4pjx9Vgd
+1zC5bNxSWZ5vlJ4CH8ArKFqNK5LBVDZqhYureAo/1Af2b9vRJw0/QQHhuXz/jqeT
+wwrLuKpy796Gpt+aFfcmS0ZC4QXfxJERhAP6tu1p6YmAsSb+bjziQVkKrt9mhOrL
+dtz6WP0Fg1joRj33FgnnLtayHvtgQrNFI3ztCjk/B2FjYZxqbBGfk5gyo0cTE2Fi
+oLhG/XrxIoZepFMJkGYETnYQXrOt2KuJLvawV70YQmG8EqHYY8drKA0XDZs8TVdT
+5cvGvtm8ERz5znsssRBxQMI5Ml6O2ahrXp8Eq4htCzlvO8t2MOtzvqAJRiyAd6bA
+Uo+MGVRpnvePOR1SAgBXCd416rF0iCXc1utZxnqwdq9kJAZ+8mCLx4N4jk6AdGpX
+zcNkLg7QmUzXn75RxZ6GrIUYZJNMlswXq5XhSW4o8ePlaxWjh9+QTtU964AZhpA1
+uoHsKGTBxHJs0w6McZm14kb2PuaO2/rpf8s8IZyc93+Y5O/gHZ6/agBjA9qN6wkQ
+R1d5UhJC4QS/m35rBGBKK9X3fqQxaBCio6Qz+m4A3GchrztJpq+2P+ma5ylsTq5j
+V4njky26WNtrV7+N0C4Moj3I4Qn6YU/eSManTXzHzoiPZCEH/IOxgXIiD/9Zm3Zz
+I+h4NCfSGyP11/w1gEzlTHQ4at/FXIIDh0Y2ZNpWPffuFQLtcER2vyKPwhDYpGMy
+NNHXks4azfrXVCv0wmSNBbeS8pJrYtopZpCEBrAbg/YLv9m5lpDSRHaR3gv/qMZ7
+QxY+NwqciqTwGq68PuF4mDSvtfuFmbEES9Iybiie+eL/6DU2knfBjgshUe6vElR+
+LYoPQ45GY2IxRTJ1pMXaZw1+evwH3UvseRGkRygiaBgoU/qR4prynvjMQcacCa+C
+aRnXZJYp/usVBeY0xut9toc9/OcLGoBr5h9l5YjruO2vu8VHou8N0tarVQn3YbQR
+Fi+YtNtclWJa8Pq1AsKRTCFwDwP6eODv6mNOrEFydNRcpiQmzp47VWF/YHRfHzCq
+A1wHLxLUrpQTaVw6J4FqedAQ31aAO4faA7MS+ZMNBqZCZ7lTGC6TvojqqBAN2yX7
+AnnYpZHM+lGpi2/ukVzLqSkGmdNOgbu+UZvoej3YnHYig4yWP+z2xrlJl8bkhU/d
+r9IQE5aRCEPB/JWhHJ2/GqYl9qjshlB52+6X2KDarwptOtzT9ooArYhpMwKIYh34
+c7X8tlAKYk7V5j7txIRFDKKAftC7dM82PntXJxSkWyR70GYnYjiXyrqqerqT7xIC
+mDEQgFOPpy09zFW62paO9uiZw6qwybwqgGpoX7kCDQRcW1TbARAA3ERo2mPv2VVg
+ZUFr4MtPDm4UG00YJW/LYa3D3k0e9tdSScACXprk1sAoxUlQx/CSdErPKwXG4rax
+iN4t5nICUUNYSC0dh09G25jC7nwsWc0AYyZu+h/FzfvpOm3fBwmBlzILlGh0URwH
+Ffj9fHt6hos4C+3PFZZ/X24aMJF/cov1oYi9rqFwt/l0mgtPE88Iyj2/Vp3Lergg
+QMzKfEuyluj9fL2cgU0Qa7oAPXmaxhHtua4cvbM5SXGo3FXjIgzH9OfM+2orebeN
+wH1M3ec6w+nPmRmCJLvPKGOeS7GVXL5/aOyPlDWzSXYnpCKS2ntw4K4nt0IA8n8z
+1db109l/C2noDrDSJEqOo843ShNGTYOMVUrj3a+Y7o2ATc9pNZalf0PwnKas7NDb
+IJ152PEQw665iYXcv2awjLF6W0yuSq8kfiaAxIrsie2Dto0zgqOs0Ot9Y74u11Hh
+wBSHUO3mEZJScAAcI/yDF2PvjvCQSzu4mdXb77t6X2O6YHULz4A7bVQCMazcTDI9
+/S0W2+ixPnnJVnE3xgjK9zuizji8JDJw1hJCQM+yTLVqq9pfvcRfQ6uwpMRzz/O3
+S0zDRiA69/GyfNwkpgz5QaGpY02IK5WrQU1doRjIz4BHAYzoIOkMkRqTtjdElQZw
+/D3wSO2uwsEMNwRzibR/Lz1JF2aGn6EAEQEAAYkEcgQYAQgAJhYhBK4/rHlnEexZ
+/AB6pHS7a5pMuz04BQJcW1TbAhsCBQkDvSEAAkAJEHS7a5pMuz04wXQgBBkBCAAd
+FiEE1wyE5ktVjlvM7AchMuIXXx11eioFAlxbVNsACgkQMuIXXx11eiqCfQ//SFDf
+rOIEoslp6n6vlCuavOg02wvjskKQGP1P1Q4v40Fw1Gl87n9uXAoMpeF4H+pzUxOi
+BHYCQi+EemwocSThzaWfPzd3JG/0OcRymf+ZOcBb+58VJL7p88QdMFIAi5J+KMuA
+fEG0zLkc9anEnXoVMmQJX5K+6PyeVDvBbYGjLjQAsWTZTiVuQI0w3WxFtDGWqQII
+8e/qE0DA7c/auGn7j2hid308+FcdfpmLefW9YesWjE1yYvHoCRdFOJ/7Sft4MQCI
+Re7UET3TRMBvtisP2DcqyzGPp22s4ZYFCCJJNiB92bXdEl5zXe4Ff7JTfNE/QrR7
+Wg5R9hZHgHdbp8p8bA3f0y29YCx3puYg7BbmQWiMh3rXWE5b090pSpw0K9BQU3vO
+irr+5/2TaFOJXHl4VF03GrWsSncShCbdsdRIv4TB0lY2mN4q+e7bjlAzJJeoaS97
+GIqu3DBlAJyx/ZwWW23DXXwoQ4jNuJhpl2jaCE7rVQB0uLjbp0i9Zdd4SdYZxmO/
+Y+JfgoJz8eyx8wZi4eDz1ijN0WKsIGjxJH5VUK9STjijDMeG6ZZRLc6b1QCGhe97
+ZbDkEUTdQGoeu4L5Fiqoma13NEsf8ofBDv+myJm/O67Va9JI3gxhIrhmF7LMzQQp
+lYx2peZC1CmhEnn83dtt83mhXvX6Dth657BW/Qd+GQ//SVuTPuNkBXfrTi4dbnv+
+cU6IsoIBodTF/WsQ6h4kbtsPhO5DbrsLNuNumrqVEN8jw+HUsEeNvFNeMrTPdG2V
+87ShQ4BQGkCf+GFRBj0myxxXOFZYQx6RpY5fCe7yOcTzpkbnPWmm7V8HdOuZ0NnL
+JNQ5YogOI6UvXVKv35R9qBo+G9jkhhb0eaAu6BERzKVANKfsGN7545ElZ1qlffMh
+AQhXGb6TsvCeSg2cWGb2cnVL2d58uVukD4PDiq4qqwgClkF3bOO70SIgGrCteHbi
+4Hseopex5m6GqqjoUYXr7QQBwSaQdc+gKtEjMHCsHbUyHRk0qEHdEe+2RmL0d0ra
+QMJfKyYQjcCR7tnrgN4WD1h4NKRdC/KRW31MDmH9XVPrkOMQCUCnArXkOwdKWsKf
+h8af9HqweXOT1FHJN/M3tWaBpv6KoduF2f2pj1VhPZ2EqFUycJ26lrHyOpsynQR6
++TD+c1uXotDwKN5RW+YL1cydk6mhib64fdOyPUeTcHehjMAFgM2f5wi35Ujcj8id
+37cWOqRsggSbMnGO4AUA/YtcVNG8TjZbakson8ENK7e8q4sEiNFUZ7/CtzNokwHQ
+5uOG1+qB85Y4ImGnIZVeiBpjt73VVawg4Zvm/omtW50P9R+4rVhMJZZFAgrWg8BH
+H/KNznW0vUuShG8B+2FA/eu5Ag0EXFtVDAEQAL5ftI1GgVJEFgX5VsuFnfBnH95c
+zqmwEXaTP4s7Xm3O0Wy579EzRUD1eEw/UaD/q2OHScwvMP65cZYQ9w4hnCN6H96P
+96Teo7LOMCssvSXIO7gqP33LKTqDzsIoAFHwWE3dq1jbyP6T1Je85mr0Edvk8kOC
+B1hudswAARno/7X9zGulhhwuEHk5Iey7R59yRUQqBctdNcetGyaiFjjX0evuVADi
+/z/s07XhDLDt7+3Vglh1/7XGC64QhB9QjZ8j0u7+0xfmLLjhi+7EpkDlAHIJXX1H
+0wAsPOGKlYruQUmIsMNfBINZeulHEBZ4cAd30xsM296DzJ6QL9sAGfYMhRs0YHB/
+EJ10Zv0iw1pU2jCCUv/9Kf4F4nwgHQWQP7JAbfhOIUOUq/YlxjTLnkd25+7vD3KH
+NQ6UiRDROR9Jwetpd/zokpf5O5iTBpVL+sCq+NsTZyDOjITve2sY0V8v10M+Z+pL
+cp/cUZ4JEDS/WJ4/ovBNJP8b+YwN/RBgCjl8UBX/N+e7AA52eYP2H9GK9XPkzSCE
+VxEf5PyjGrwedpoLkzagrHsDuWo3uBquLyneT/ozihqKQAuInUy5B7rWU4mpKHe5
+Vto5o6Zuj+6MgHgIQzRK6Da2ziMNEmroxwZibcYCtUPdvcvxGh+byclnzBclKjOw
+kAalFPx0SxEbHmzPABEBAAGJBHIEGAEIACYWIQSuP6x5ZxHsWfwAeqR0u2uaTLs9
+OAUCXFtVDAIbAgUJA70hAAJACRB0u2uaTLs9OMF0IAQZAQgAHRYhBK7WIv4CB360
+tcFGwUKiedJIzcMQBQJcW1UMAAoJEEKiedJIzcMQH+cQAIQYXDnqi4Hl21LtAgky
+pZxug+x/LECVlwkrIfaQF337+fG+H9J7SdU87Sn1Xe/YUgQnF0XP/fjIVFM0e/Tb
+xVlmTFqiejLnIwJJDgUaHO3POT2sGEyO3tc0mqSzyRBxtMQ8yvApccBhL5QODv3h
+hlRWgk5MXU0IPeXw134IWm+o/PRiPBoXPawvVfEVIBlUFaiSZASf4BAiSad4aJQe
+P8PyP7FPvQB1xiib0iSetn6ZmNeN2OSUJPiPA8aE9JCKuFtomVQEDM0BqQDl5A7h
+5O2uyf0Li+/ArqBvfBjrH03e5zbID02dO3D2BjsV3jUeVPQ5WDgVg8LH+nfg/rRy
+wfCsx9zFp1mt3K4xN2v7IKwxGndApgCcx17gsjzMvLz0J7sSGov4MNjzqvGEDKCl
+uUvNKXqy7je9xcQLpoyvWtoWFXWTbQAcK5Vv+hC67r9bHpjI1KuqA8hYqNKxsv7s
+wiLZdd4SK9SIuwf0j8/XTZwmoFfGolJil0ZNxyqBF39+CMVpaHdLM1qKZz99TVzS
+h4obOOjkUjK458xSo0XCbJ4qXYp7PgxyWK6GIbTozbbG/1ldw+LUnqxt8Shf797L
+J9lbI3ICuR2P5PYlKJf3b6D9GyfqyrP387fKAKhHsYkZ1XD54/8wIgTrdfeNPtL0
+1mjWDjw5KvO9kuPBjcmzgt+NrtsQAJwKeZsiqLLcY8kJ9xP+/xtTlh2iVuZMfxwq
+hwlo4MMCzpobLDZ/JKU398m77eboTKJSBfeUYxQd4ATn1L8NLKjLxKAaBkjEk0nN
+8w9OUQbFlhQ/asLzzF7Z9IGGh9/SEgBZ8V67a0O3Qw9Xdi3ARK3bbZ8RIVJ0+P9G
+CGrfq9j4ZmGA2L4irLjsvDAv7CSMb4WBKW8j0Jz5LFMwOMJgG1TT5c6lNqFj6y09
+rZcVLnt8+lUv2Bw3LC0oI1TjFkrrCzIdfg++mPi3K/ZFc50bvnWF4eCOjgZ5U9Vb
+sxFZq3+vTRcIfI9z2lZ9CNDRA1O5jGvuVtEGLiSLF2aJ6kiNriLuuGTlXfg/Fpgh
+GTvyppOTzF7PtHzHBQ/ZjnhWojnc/jyJRwLK8cCl6+EOc887v8BDmqgFWtmycsE2
+5fDJ7UFGP13g/eDL3ZUgMDty5dQaUOTX145t2KT+lMqpY6ZK2EC+eoqrnIGJ+tYy
+0l4RRxi10mbNhuPIIDdph7X+mUHgCeA9gyF0Y+LqiB6CX+zFg7ovLvnCbMPxdGXq
+z7AjfwqZBKI+BVuBeDtyW4onmElCu5cXNKsg3W0IlQlZf9PMDU6Ht0XLUs7EPfbQ
+sH1Vqi1XE1W/tGnkmjcpG/qlt9Gx1uwFGLP6iomqUBc2c0GZ6R1xplXvd3w3yC8d
+8lAgPGImuQINBFxbVToBEADkuxhQx9gxlzzCc0nUu2v82XsD+GzONp9irt14gslx
+te96eKaTXTi0t5eya0X5TIY3wbREwjlfAeM9AfcAmWcsM4izrfPtANM6WOxB2Tbz
+EY2cqv7NBQii7Z5aqPyjcIiT0b0Gs2evlDkn3xEBBqTSrNcnGSA29bZPIkaUb7Qo
+p/Ani0S3/tgcR21gXsJwkgpfNKwvPT03Lz3/o5rXAyag0M/25adgk9SVKNcXc8h2
+HSGv5ENjwUKNNnowVbNLw4287mFUM2Vd6unGJ2MBj7aUwTrfBl7gNV96mMdDJWcB
+hGKYkxUvibuHCa2KH7gTrnV6X7sdrgD5CbJMPq6OZNSP6n6bUVg22eHxoETplFwT
+4NvV3clRMWIAG1XgXR1l99LAh7PPnPMM1pHQGPwYHQskoBFS4g5knzHpB9h9TfZ3
+MM4cDZR5NgWmE0fYVnWe5ax+wW0/IOklUoHv3qoL4yiN9wFJq2oLzUNQd9+tsqiy
+vxSTh8iYmHegyn5KuBPsrMPgvqiKOdalTZKkak9DOx4cGQL2qHspKxiBOb6uox2v
+fjMQ5bDeUn+4DYMdnZNHeywCUegJmDakUtlfvN+136IDHGwfdGcitqzswzd3+PI2
+qlwPE19gkrp9NUaD3Qj2ZtDP7sU2cThc6Gra5KRFW8f98bI77j1Wu6pCnYFLqPz4
+QQARAQABiQRyBBgBCAAmFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAlxbVToCGwIF
+CQO9IQACQAkQdLtrmky7PTjBdCAEGQEIAB0WIQR5HX64jryNAThDSqwz3zWa56YK
+eQUCXFtVOgAKCRAz3zWa56YKeSWOEADK8u03LESGSQlZQqnnCAI8iYs1s+XRMEnG
+2tAQ1OK7/4eNgr1yZckmaW4FBMgeEgYIBJ7v3SlW7Hf7dE10TYPNGbP6UxVW8HIP
+rA4CINcGZXWWwpS374JNMS6A5eb6viuEgEMEi00jx0MmLvCMZKypmwXQUl5YJ5nB
+ytpQ1681mCQxGBMhT1eKQt3B4nAsoEnP+HnqVM/nKxBemSBNXX+C0b/YeQoLC3sD
+L+Z0NRI8U6PZl9Rokod3uynH0vfBYCEJd6MvsjtnJlVVaseYIA3ESNrFG12tw95I
+wKNrVCANZ1DBSyK4ovmmWsDrH+uFTHSLNjlxIuVxUfmXcLfgcepVCmd/7Z7UrWYr
+SXSvP0VG4ZmEPE7tNb8bfyADftO1cVsmcHBQeSrgvpSrTv9L8MocojpR5vJc1f+a
+sBT7rAeGzZP9riz1GmryXawaZgdLfaaJfzRQkc1uTChb7kMN+UMhVUdCAXmho0XO
+SfcsW84u/LpjdYh2Ww41xQO6EWvbZDNgD/Fdmp8Uh1MqJ1Dejri6kjNn6wPImXJd
+Eu6nHqWDRdYsfT4XUB18tB+4aIpFzCyIgpf7p1uaVU7Oqip5sZkc/WXKr77lV23m
+PQvpGRNCzgU2TJY7ktR3LOvUVN6wNfLMHzeQk18NdmcEGUrJ0YYtl9vE5/Eg9L6x
+LBH9PKt17IQ8D/9DLwQX8pl3fuTM8ZbzIPLxiXhbgzBBTXKRE2u1888+RIq9xE7c
+aVFjwq4qpgqZ5SFonTcG4Pi5ck3mFAzyA5zLRF+ckpmBpwSPMpLwCpv10369D1jh
+AF3JsUwt6DIb2BISMhh2ThSUMSKO75q8GSotsKjJyjD6vl1x4L7WXubTWxEiNuwD
+3kAjFWS1Z1VWtA9SURWAbsDaCV4VmwCCpSIwRr9OTbyu9XuMdMxGNpl8SwW7MVQb
+x4aYNvR7Hl/wIR71AHAXoSfrKp3p12anXjYYASHmbm16ugP4H7HLMBfznKet2f76
+gIxJr1CsAMTSqypcC1UoVb6Gz8djeIR+GU+6efHI4TIUMy5uMIUx8tYbwSEeo/y6
+NnjpJFYYjJa671iSABInNxs4+X+1zrFa+wl45EnaFxziEet2Qzv/VsusoLvLwnYi
+BZckclAS5xoVGFW0WJ01OfLUDHxGMt9GSheL8c+GLMaMtaCWunpmmt9zZ9WdpBOu
+AGluMG1Cee50TrhXaGE8CdNr8nOdSeLNAveBAPmuVa0JDSe20/D/RuYJLKeG9Vsq
+BZvjuGlOUsfl6UjtiGRbgS9OWpxeez5ugc9yyV+rBGIpmnIb+9quz2HmGxE65eA2
+cRNsZRIjFLzeAx/0RMaT1nlLFTBbUuZ+tJ+fgFtRGMhifZn1pb2dMQo0N7kCDQRc
+W1VuARAAv4LYaNq2Zev/v7M5DnxLpgHRcMkG7TOQpycrlK5653llpZzTy3mh5peW
+vcq3IDmdeUIJxQ+WDh2f0vS+NIKDC/HAddfHrZPbhO7zLxLcMW5KmV05ancaRSP0
+s0+IyQmvVxUNrgPinZiphlvRGoLXS6pdgfc4jIR9B2umPecfvfu/6EWFPnXZgG8K
+yY3Z+mwrmEO0FaXHBQuu6nactiPe79N4bLe8hk9RW6yIxLBeJzIoOlIcJmuRHapt
+nS2lV3mfhZdFnkAp1o6a2TL5BwgMY0wZUKZr78HEMKh6LbPN9rPepf0neUeq/k1l
+NJU7V6XMS+rezF31vgSJ5KoNGYhxtWZ54uksH2rcw7+ltpSVtqY91G/vibpRCJG3
+LdX/kxHni1NEWyZlpS/6ntuH6HSoNYsR9IMsbESs3QVCH74ApK88CxYCRB0SEo0M
+yAElbQ3bfEKCKl/FwC4IzAYAJ2arWKwBHRSJlsrNCtczrjG7j3EyJrn8+Tm5yjO6
+0THQjvc/nBxrNE09r1Lzz7jrDWC9Rl+BH6wqdniymoYyUAQsX2rZ+Jhah1Zkf+Gu
+76qtY+EH494dPM+0FazcBlgBd6/J5mh3Wk9JuecXLTEUGtzd1GmI9CENPAklCauX
+tNOWeTop27djuKWsZxuP1GyV6UYixFVOSWteyAbA32cncVv/2ZUAEQEAAYkEcgQY
+AQgAJhYhBK4/rHlnEexZ/AB6pHS7a5pMuz04BQJcW1VuAhsCBQkDvSEAAkAJEHS7
+a5pMuz04wXQgBBkBCAAdFiEEFWiQaF6g32oTce8gF8xdsfAIhAcFAlxbVW4ACgkQ
+F8xdsfAIhAd4jxAAiO9+VRQQ3eBOsJRgANdgL/l51kq7qE3u8xnSqNkrmdYDdT2H
+TYH5W4n2AmGo50BDafdjd6tut0qtzA3/hGWCooydxKFOsnIYziUeoHvlICj3RkHO
+y7utcFhAgRWi+kzFwnnXGf13dMU9iG7yvKrCrCEw44gzoQ1KnY1Xsj18n5JkqxeT
+94bzcSbz20OpOSIMfSQPrpy18WrZYwHodcIZ3IUUACCpMZdfTa9c/qHRQ/rcwl+B
+0JlHx0V4AYiSAsiMVgflO1Eqi7apPuwxPPd5nnHkrdDM9CYC3LdBORBXwncG3oZ5
+eTSXmsvFxHXH41JHsm/1QFcVmFAYhu9qJFCGiD+8UeTFtT+nnHU69BszgtUskqX8
+k9PqLdK7Vxkp16wc6WOp1NeIQ6Fd4PxTGrPqs9bJk7TlYtTFWpA0X+EMj/San+Ku
+PxqLEa4Ab12R4vs1pCrn/g1z3C/6ujH4B70HOrRTIeTjULJ6xdwXGtwUA09hio0r
+pHhtyZhAh5irUJNto4ZOk/Qyd+dfMsNvRJfbVIK2mmeRaBnp902AsQNgYVdi2Aki
+0h4kz3bVLGw7iD/xV2hV69+JwLSijkkmOpz/EjMwj0hDDYrHH3Y3o0dV3dNdk/5i
+6lQgcxSVsl9kWlHcoEllKbf0Hb1muKVwoGGYxFYna2jsLFVjG29M7iPSgrHjmg/+
+I3fmsLZ0VI9kmxniUlZ6gz5NB5PJ3RXmwKO9LkBgE5C1wpuZbNEQ1NsR2bprlJPm
+++GNSo8HaheuTRJn42kkOgfIJwjuvXih3FE/NtRA/W8H2uF6YLDjBKGZJbxQcmsd
+CTEuCRCVP8X7C5n3rl1YqzfWfNr8QFxvH7ivG7KOlSxvyTKcYatWb9uDUPrnr74f
+ZaMljHGsNyKj70MzZcrrsmt61yWGR0h+02rmIKlskl4hkh+qF5ehI+Bkd7eblsBy
+rxEREHq/ij2Vd7l0Z606YCE8vj8WfcsJj8JjwR3A+nND/oNJTTbQ3b8OvasvqIey
+WqqmGg73nbHjd/VIAUsfvnsEYatDk4pAA/wQr9c4T4s5Q/QRwDrAsa4J89FrDjWC
+hQBPL7TaP8Af/3Y3/86jLCN4lnW1qjPXv5rhBFeI0EVi1k1qdV06qr5HOk7CwQTT
+uc4rCdFcEnw8kVKZa/yFnlJfRa0Z4IwSahdp5fdFEuad6LpOcFFnYxWtIWhcg4GT
+RcMha/OZnsfqOqiAt6In+1IwuJBz3uMM7xw2AMaxzAejGEL63F81C5iJ6Ld6kQK+
+XblDW0G643bVbzkBb46MAT+UnLuWQUs3NDtk1FEioJyWUgbO/srMH4MoWM7rG8ZT
+nQPohNmPBrqL2phmE27HQsQ0rTjH2Z2ol7iy9OFMtT0=
+=MkGo
+-----END PGP PUBLIC KEY BLOCK-----

From c4505c5f54807ad50fac708e8cd537e3a431ad81 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 25 Nov 2019 21:32:36 +0100
Subject: [PATCH 46/55] Remove tabs from spec

rpmlint complains about mixed spaces and tabs. Set vim mode and remove
tabs added by recent commit.
---
 bind.spec | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/bind.spec b/bind.spec
index 0229ae2..0598d71 100644
--- a/bind.spec
+++ b/bind.spec
@@ -1,6 +1,7 @@
 #
 # Red Hat BIND package .spec file
 #
+# vim:expandtab ts=2:
 
 #%%global PATCHVER P1
 #%%global PREVER rc1
@@ -829,11 +830,11 @@ sed -e "/^\s*include(/ d" -e 's/^-- use //' \
 # or it is able to configure them
 if perl bin/tests/system/testsock.pl
 then
-	CONFIGURED=already
+  CONFIGURED=already
 else
-	CONFIGURED=
-	sh bin/tests/system/ifconfig.sh up
-	perl bin/tests/system/testsock.pl && CONFIGURED=build
+  CONFIGURED=
+  sh bin/tests/system/ifconfig.sh up
+  perl bin/tests/system/testsock.pl && CONFIGURED=build
 fi
 if [ -n "$CONFIGURED" ]
 then

From 3e7ddcd8f996ff8d2e6378f7646d311790022835 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 26 Nov 2019 18:42:25 +0100
Subject: [PATCH 47/55] Complete explicit disabling of RSAMD5 in FIPS mode
 (#1709553)

Previous fix included just part inside named. However, checking part
would check algorithm support also in check library. The code is almost
the same. Permit already disabled algoritms also in libbind9.

Use the same change as RHEL.
---
 bind-9.11-fips-disable.patch | 46 +++++++++++++++++++++++++++---------
 bind.spec                    |  5 +++-
 2 files changed, 39 insertions(+), 12 deletions(-)

diff --git a/bind-9.11-fips-disable.patch b/bind-9.11-fips-disable.patch
index 525316a..afe9564 100644
--- a/bind-9.11-fips-disable.patch
+++ b/bind-9.11-fips-disable.patch
@@ -1,4 +1,4 @@
-From df23c869f8973bc9494dcdc86ef46070d8194897 Mon Sep 17 00:00:00 2001
+From 83b889c238282b210f874a3ad81bb56299767495 Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Mon, 5 Aug 2019 11:54:03 +0200
 Subject: [PATCH] Allow explicit disabling of autodisabled MD5
@@ -9,15 +9,22 @@ RSAMD5 is included in security policy, it fails to start, because that
 algorithm is not recognized. Allow it disabled, but fail on any
 other usage.
 ---
- bin/named/server.c |  2 +-
- lib/dns/rcode.c    | 31 +++++++++++++------------------
- 2 files changed, 14 insertions(+), 19 deletions(-)
+ bin/named/server.c |  4 ++--
+ lib/bind9/check.c  |  4 ++++
+ lib/dns/rcode.c    | 33 +++++++++++++++------------------
+ 3 files changed, 21 insertions(+), 20 deletions(-)
 
 diff --git a/bin/named/server.c b/bin/named/server.c
-index 3cd49a9..ef82d89 100644
+index 5b57371..51702ab 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
-@@ -1551,7 +1551,7 @@ disable_algorithms(const cfg_obj_t *disabled, dns_resolver_t *resolver) {
+@@ -1547,12 +1547,12 @@ disable_algorithms(const cfg_obj_t *disabled, dns_resolver_t *resolver) {
+ 		r.length = strlen(r.base);
+ 
+ 		result = dns_secalg_fromtext(&alg, &r);
+-		if (result != ISC_R_SUCCESS) {
++		if (result != ISC_R_SUCCESS && result != ISC_R_DISABLED) {
+ 			uint8_t ui;
  			result = isc_parse_uint8(&ui, r.base, 10);
  			alg = ui;
  		}
@@ -26,8 +33,23 @@ index 3cd49a9..ef82d89 100644
  			cfg_obj_log(cfg_listelt_value(element),
  				    ns_g_lctx, ISC_LOG_ERROR,
  				    "invalid algorithm");
+diff --git a/lib/bind9/check.c b/lib/bind9/check.c
+index e0803d4..8023784 100644
+--- a/lib/bind9/check.c
++++ b/lib/bind9/check.c
+@@ -302,6 +302,10 @@ disabled_algorithms(const cfg_obj_t *disabled, isc_log_t *logctx) {
+ 		r.length = strlen(r.base);
+ 
+ 		tresult = dns_secalg_fromtext(&alg, &r);
++		if (tresult == ISC_R_DISABLED) {
++			// Recognize disabled algorithms, disable it explicitly
++			tresult = ISC_R_SUCCESS;
++		}
+ 		if (tresult != ISC_R_SUCCESS) {
+ 			cfg_obj_log(cfg_listelt_value(element), logctx,
+ 				    ISC_LOG_ERROR, "invalid algorithm '%s'",
 diff --git a/lib/dns/rcode.c b/lib/dns/rcode.c
-index f51d548..8dbb12d 100644
+index f51d548..c49b8d1 100644
 --- a/lib/dns/rcode.c
 +++ b/lib/dns/rcode.c
 @@ -126,7 +126,6 @@
@@ -46,7 +68,7 @@ index f51d548..8dbb12d 100644
  static struct tbl secprotos[] = { SECPROTONAMES };
  static struct tbl hashalgs[] = { HASHALGNAMES };
  static struct tbl dsdigests[] = { DSDIGESTNAMES };
-@@ -358,33 +358,28 @@ dns_cert_totext(dns_cert_t cert, isc_buffer_t *target) {
+@@ -358,33 +358,30 @@ dns_cert_totext(dns_cert_t cert, isc_buffer_t *target) {
  	return (dns_mnemonic_totext(cert, target, certs));
  }
  
@@ -72,14 +94,16 @@ index f51d548..8dbb12d 100644
 -	RETERR(dns_mnemonic_fromtext(&value, source,
 -	                             secalgs_tbl_start(), 0xff));
 +	result = dns_mnemonic_fromtext(&value, source,
-+	                             secalgs, 0xff);
++	                               secalgs, 0xff);
 +	if (result != ISC_R_SUCCESS) {
 +		result = dns_mnemonic_fromtext(&value, source,
-+		                               md5_secalgs, 0xff);
++	                                       md5_secalgs, 0xff);
 +		if (result != ISC_R_SUCCESS) {
 +			return (result);
-+		} else if (!isc_md5_available())
++		} else if (!isc_md5_available()) {
++			*secalgp = value;
 +			return (ISC_R_DISABLED);
++		}
 +	}
  	*secalgp = value;
  	return (ISC_R_SUCCESS);
diff --git a/bind.spec b/bind.spec
index 0598d71..1cf9e03 100644
--- a/bind.spec
+++ b/bind.spec
@@ -58,7 +58,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.11.13
-Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1544,6 +1544,9 @@ fi;
 
 
 %changelog
+* Tue Nov 26 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.13-2
+- Complete explicit disabling of RSAMD5 in FIPS mode (#1709553)
+
 * Tue Nov 19 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.13-1
 - Update to 9.11.13
 

From b774c5d4c4bbec051cac2f9cf61a13083d951928 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 2 Dec 2019 20:34:08 +0100
Subject: [PATCH 48/55] Backport a few upstream thread safety fixes

It might not fix all issues, but was detected by upstream using
automated tool. Should not break anything new, but might fix issue
triggered usually on ppc64le platform.
---
 bind-9.11-rh1736762-1.patch |  56 ++++++++++++++++++
 bind-9.11-rh1736762-2.patch |  38 +++++++++++++
 bind-9.11-rh1736762-3.patch | 105 ++++++++++++++++++++++++++++++++++
 bind-9.11-rh1736762-4.patch | 110 ++++++++++++++++++++++++++++++++++++
 bind.spec                   |   9 +++
 5 files changed, 318 insertions(+)
 create mode 100644 bind-9.11-rh1736762-1.patch
 create mode 100644 bind-9.11-rh1736762-2.patch
 create mode 100644 bind-9.11-rh1736762-3.patch
 create mode 100644 bind-9.11-rh1736762-4.patch

diff --git a/bind-9.11-rh1736762-1.patch b/bind-9.11-rh1736762-1.patch
new file mode 100644
index 0000000..272177f
--- /dev/null
+++ b/bind-9.11-rh1736762-1.patch
@@ -0,0 +1,56 @@
+From 312bd133f75c54d51196060c573e29aabbb0b842 Mon Sep 17 00:00:00 2001
+From: Mark Andrews <marka@isc.org>
+Date: Tue, 26 Nov 2019 02:30:14 +0000
+Subject: [PATCH 1/4] Merge branch
+ '1367-threadsanitizer-data-race-dispatch-c-901-in-free_buffer-v9_11' into
+ 'v9_11'
+
+Resolve "ThreadSanitizer: data race dispatch.c:901 in free_buffer"
+
+See merge request isc-projects/bind9!2628
+
+(cherry picked from commit 0455351802cb915e7961dad9cf14977a19162d38)
+---
+ lib/dns/dispatch.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/lib/dns/dispatch.c b/lib/dns/dispatch.c
+index 3278db4a07..ea5cf102f2 100644
+--- a/lib/dns/dispatch.c
++++ b/lib/dns/dispatch.c
+@@ -927,6 +927,10 @@ allocate_udp_buffer(dns_dispatch_t *disp) {
+ 	void *temp;
+ 
+ 	LOCK(&disp->mgr->buffer_lock);
++	if (disp->mgr->buffers >= disp->mgr->maxbuffers) {
++		UNLOCK(&disp->mgr->buffer_lock);
++		return (NULL);
++	}
+ 	bpool = disp->mgr->bpool;
+ 	disp->mgr->buffers++;
+ 	UNLOCK(&disp->mgr->buffer_lock);
+@@ -1058,9 +1062,11 @@ udp_recv(isc_event_t *ev_in, dns_dispatch_t *disp, dispsocket_t *dispsock) {
+ 	mgr = disp->mgr;
+ 	qid = mgr->qid;
+ 
++	LOCK(&disp->mgr->buffer_lock);
+ 	dispatch_log(disp, LVL(90),
+ 		     "got packet: requests %d, buffers %d, recvs %d",
+ 		     disp->requests, disp->mgr->buffers, disp->recv_pending);
++	UNLOCK(&disp->mgr->buffer_lock);
+ 
+ 	if (dispsock == NULL && ev->ev_type == ISC_SOCKEVENT_RECVDONE) {
+ 		/*
+@@ -1511,9 +1517,6 @@ startrecv(dns_dispatch_t *disp, dispsocket_t *dispsock) {
+ 	if (disp->recv_pending != 0 && dispsock == NULL)
+ 		return (ISC_R_SUCCESS);
+ 
+-	if (disp->mgr->buffers >= disp->mgr->maxbuffers)
+-		return (ISC_R_NOMEMORY);
+-
+ 	if ((disp->attributes & DNS_DISPATCHATTR_EXCLUSIVE) != 0 &&
+ 	    dispsock == NULL)
+ 		return (ISC_R_SUCCESS);
+-- 
+2.21.0
+
diff --git a/bind-9.11-rh1736762-2.patch b/bind-9.11-rh1736762-2.patch
new file mode 100644
index 0000000..7d16138
--- /dev/null
+++ b/bind-9.11-rh1736762-2.patch
@@ -0,0 +1,38 @@
+From 8e1900b79d854e22ec6b5cea152ff363ce9a461c Mon Sep 17 00:00:00 2001
+From: Mark Andrews <marka@isc.org>
+Date: Fri, 22 Nov 2019 21:48:12 +0000
+Subject: [PATCH 2/4] Merge branch
+ '1334-threadsanitizer-data-race-dispatch-c-1339-in-tcp_recv-v9_11' into
+ 'v9_11'
+
+lock dispatch before reporting state
+
+See merge request isc-projects/bind9!2619
+
+(cherry picked from commit e36730076af3190fe5930a6406dd414b87e1e178)
+---
+ lib/dns/dispatch.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/lib/dns/dispatch.c b/lib/dns/dispatch.c
+index ea5cf102f2..94df6bab9a 100644
+--- a/lib/dns/dispatch.c
++++ b/lib/dns/dispatch.c
+@@ -1353,12 +1353,12 @@ tcp_recv(isc_task_t *task, isc_event_t *ev_in) {
+ 
+ 	qid = disp->qid;
+ 
++	LOCK(&disp->lock);
++
+ 	dispatch_log(disp, LVL(90),
+ 		     "got TCP packet: requests %d, buffers %d, recvs %d",
+ 		     disp->requests, disp->tcpbuffers, disp->recv_pending);
+ 
+-	LOCK(&disp->lock);
+-
+ 	INSIST(disp->recv_pending != 0);
+ 	disp->recv_pending = 0;
+ 
+-- 
+2.21.0
+
diff --git a/bind-9.11-rh1736762-3.patch b/bind-9.11-rh1736762-3.patch
new file mode 100644
index 0000000..ed4dc93
--- /dev/null
+++ b/bind-9.11-rh1736762-3.patch
@@ -0,0 +1,105 @@
+From 651fc773a6e154466998424e975bce3fdb8566d8 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
+Date: Wed, 27 Nov 2019 17:06:28 +0000
+Subject: [PATCH 3/4] Merge branch
+ '1350-threadsanitizer-data-race-rbt-c-1312-in-dns_rbt_addnode-v9_11' into
+ 'v9_11'
+
+Resolve "ThreadSanitizer: data race rbt.c:1312 in dns_rbt_addnode"
+
+See merge request isc-projects/bind9!2651
+
+(cherry picked from commit a5fb8c812728cb5fc923f60d6707d953d704719f)
+---
+ lib/dns/rbtdb.c | 24 +++++++++++++++++++++---
+ 1 file changed, 21 insertions(+), 3 deletions(-)
+
+diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
+index 738aa203ec..d3bb8d7fe7 100644
+--- a/lib/dns/rbtdb.c
++++ b/lib/dns/rbtdb.c
+@@ -1972,6 +1972,9 @@ clean_zone_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
+ 		node->dirty = 0;
+ }
+ 
++/*
++ * tree_lock(write) must be held.
++ */
+ static void
+ delete_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node) {
+ 	dns_rbtnode_t *nsecnode;
+@@ -2955,6 +2958,8 @@ closeversion(dns_db_t *db, dns_dbversion_t **versionp, bool commit) {
+  * E.g. if the wildcard name is "*.sub.example." then we
+  * must ensure that "sub.example." exists and is marked as
+  * a wildcard level.
++ *
++ * tree_lock(write) must be held.
+  */
+ static isc_result_t
+ add_wildcard_magic(dns_rbtdb_t *rbtdb, dns_name_t *name) {
+@@ -2979,6 +2984,9 @@ add_wildcard_magic(dns_rbtdb_t *rbtdb, dns_name_t *name) {
+ 	return (ISC_R_SUCCESS);
+ }
+ 
++/*
++ * tree_lock(write) must be held.
++ */
+ static isc_result_t
+ add_empty_wildcards(dns_rbtdb_t *rbtdb, dns_name_t *name) {
+ 	isc_result_t result;
+@@ -6756,13 +6764,16 @@ addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
+ 	REQUIRE(VALID_RBTDB(rbtdb));
+ 	INSIST(rbtversion == NULL || rbtversion->rbtdb == rbtdb);
+ 
+-	if (rbtdb->common.methods == &zone_methods)
++	if (rbtdb->common.methods == &zone_methods) {
++		RWLOCK(&rbtdb->tree_lock, isc_rwlocktype_read);
+ 		REQUIRE(((rbtnode->nsec == DNS_RBT_NSEC_NSEC3 &&
+ 			  (rdataset->type == dns_rdatatype_nsec3 ||
+ 			   rdataset->covers == dns_rdatatype_nsec3)) ||
+ 			 (rbtnode->nsec != DNS_RBT_NSEC_NSEC3 &&
+ 			   rdataset->type != dns_rdatatype_nsec3 &&
+ 			   rdataset->covers != dns_rdatatype_nsec3)));
++		RWUNLOCK(&rbtdb->tree_lock, isc_rwlocktype_read);
++	}
+ 
+ 	if (rbtversion == NULL) {
+ 		if (now == 0)
+@@ -6854,11 +6865,15 @@ addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
+ 	/*
+ 	 * Add to the auxiliary NSEC tree if we're adding an NSEC record.
+ 	 */
++	RWLOCK(&rbtdb->tree_lock, isc_rwlocktype_read);
+ 	if (rbtnode->nsec != DNS_RBT_NSEC_HAS_NSEC &&
+ 	    rdataset->type == dns_rdatatype_nsec)
++	{
+ 		newnsec = true;
+-	else
++	} else {
+ 		newnsec = false;
++	}
++	RWUNLOCK(&rbtdb->tree_lock, isc_rwlocktype_read);
+ 
+ 	/*
+ 	 * If we're adding a delegation type, adding to the auxiliary NSEC tree,
+@@ -6959,13 +6974,16 @@ subtractrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
+ 	REQUIRE(VALID_RBTDB(rbtdb));
+ 	REQUIRE(rbtversion != NULL && rbtversion->rbtdb == rbtdb);
+ 
+-	if (rbtdb->common.methods == &zone_methods)
++	if (rbtdb->common.methods == &zone_methods) {
++		RWLOCK(&rbtdb->tree_lock, isc_rwlocktype_read);
+ 		REQUIRE(((rbtnode->nsec == DNS_RBT_NSEC_NSEC3 &&
+ 			  (rdataset->type == dns_rdatatype_nsec3 ||
+ 			   rdataset->covers == dns_rdatatype_nsec3)) ||
+ 			 (rbtnode->nsec != DNS_RBT_NSEC_NSEC3 &&
+ 			   rdataset->type != dns_rdatatype_nsec3 &&
+ 			   rdataset->covers != dns_rdatatype_nsec3)));
++		RWUNLOCK(&rbtdb->tree_lock, isc_rwlocktype_read);
++	}
+ 
+ 	result = dns_rdataslab_fromrdataset(rdataset, rbtdb->common.mctx,
+ 					    &region, sizeof(rdatasetheader_t));
+-- 
+2.21.0
+
diff --git a/bind-9.11-rh1736762-4.patch b/bind-9.11-rh1736762-4.patch
new file mode 100644
index 0000000..61afe9d
--- /dev/null
+++ b/bind-9.11-rh1736762-4.patch
@@ -0,0 +1,110 @@
+From 9c1f74400c04267dea4f1bd7f62de8ba5e8d2b0e Mon Sep 17 00:00:00 2001
+From: Mark Andrews <marka@isc.org>
+Date: Thu, 28 Nov 2019 10:24:12 +1100
+Subject: [PATCH 4/4] rdataset_setownercase and rdataset_getownercase need to
+ obtain a node lock
+
+(cherry picked from commit 637b2c4e517b466900a8c00b52f7a15727e12ae9)
+(cherry picked from commit 1c61f129c3b12071723a2154d33f74628bf80998)
+---
+ lib/dns/rbtdb.c | 35 ++++++++++++++++++++++++++++-------
+ 1 file changed, 28 insertions(+), 7 deletions(-)
+
+diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
+index d3bb8d7fe7..199ff08011 100644
+--- a/lib/dns/rbtdb.c
++++ b/lib/dns/rbtdb.c
+@@ -10109,11 +10109,18 @@ setownercase(rdatasetheader_t *header, const dns_name_t *name) {
+ 
+ static void
+ rdataset_setownercase(dns_rdataset_t *rdataset, const dns_name_t *name) {
++	dns_rbtdb_t *rbtdb = rdataset->private1;
++	dns_rbtnode_t *rbtnode = rdataset->private2;
+ 	unsigned char *raw = rdataset->private3;        /* RDATASLAB */
+ 	rdatasetheader_t *header;
+ 
+ 	header = (struct rdatasetheader *)(raw - sizeof(*header));
++
++	NODE_LOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
++		  isc_rwlocktype_write);
+ 	setownercase(header, name);
++	NODE_UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
++		    isc_rwlocktype_write);
+ }
+ 
+ static const unsigned char charmask[] = {
+@@ -10188,6 +10195,8 @@ static unsigned char maptolower[] = {
+ 
+ static void
+ rdataset_getownercase(const dns_rdataset_t *rdataset, dns_name_t *name) {
++	dns_rbtdb_t *rbtdb = rdataset->private1;
++	dns_rbtnode_t *rbtnode = rdataset->private2;
+ 	const unsigned char *raw = rdataset->private3;        /* RDATASLAB */
+ 	const rdatasetheader_t *header;
+ 	unsigned int i, j;
+@@ -10196,8 +10205,12 @@ rdataset_getownercase(const dns_rdataset_t *rdataset, dns_name_t *name) {
+ 
+ 	header = (const struct rdatasetheader *)(raw - sizeof(*header));
+ 
+-	if (!CASESET(header))
+-		return;
++	NODE_LOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
++		  isc_rwlocktype_read);
++
++	if (!CASESET(header)) {
++		goto unlock;
++	}
+ 
+ #if 0
+ 	/*
+@@ -10210,10 +10223,13 @@ rdataset_getownercase(const dns_rdataset_t *rdataset, dns_name_t *name) {
+ 		 */
+ 		if (name->ndata[i] >= 0x61 && name->ndata[i] <= 0x7a &&
+ 		    (header->upper[i/8] & (1 << (i%8))) != 0)
++		{
+ 			name->ndata[i] &= ~0x20; /* clear the lower case bit */
+-		else if (name->ndata[i] >= 0x41 && name->ndata[i] <= 0x5a &&
+-			 (header->upper[i/8] & (1 << (i%8))) == 0)
++		} else if (name->ndata[i] >= 0x41 && name->ndata[i] <= 0x5a &&
++			   (header->upper[i/8] & (1 << (i%8))) == 0)
++		{
+ 			name->ndata[i] |= 0x20; /* set the lower case bit */
++		}
+ 	}
+ #else
+ 	if (ISC_LIKELY(CASEFULLYLOWER(header))) {
+@@ -10236,7 +10252,7 @@ rdataset_getownercase(const dns_rdataset_t *rdataset, dns_name_t *name) {
+ 			c = *bp;
+ 			*bp++ = maptolower[c];
+ 		}
+-		return;
++		goto unlock;
+ 	}
+ 
+ 	i = 0;
+@@ -10257,8 +10273,9 @@ rdataset_getownercase(const dns_rdataset_t *rdataset, dns_name_t *name) {
+ 		}
+ 	}
+ 
+-	if (ISC_UNLIKELY(i == name->length))
+-		return;
++	if (ISC_UNLIKELY(i == name->length)) {
++		goto unlock;
++	}
+ 
+ 	bits = ~(header->upper[j]);
+ 
+@@ -10272,6 +10289,10 @@ rdataset_getownercase(const dns_rdataset_t *rdataset, dns_name_t *name) {
+ 		bits >>= 1;
+ 	}
+ #endif
++
++ unlock:
++	NODE_UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
++		    isc_rwlocktype_read);
+ }
+ 
+ /*%
+-- 
+2.21.0
+
diff --git a/bind.spec b/bind.spec
index 1cf9e03..813b09b 100644
--- a/bind.spec
+++ b/bind.spec
@@ -155,6 +155,11 @@ Patch173:bind-9.11-rh1732883.patch
 # Make sure jsonccp-devel does not interfere
 Patch174:bind-9.11-json-c.patch
 Patch175:bind-9.11-fips-disable.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=1736762
+Patch176: bind-9.11-rh1736762-1.patch
+Patch177: bind-9.11-rh1736762-2.patch
+Patch178: bind-9.11-rh1736762-3.patch
+Patch179: bind-9.11-rh1736762-4.patch
 
 # SDB patches
 Patch11: bind-9.3.2b2-sdbsrc.patch
@@ -536,6 +541,10 @@ are used for building ISC DHCP.
 %patch173 -p1 -b .rh1732883
 %patch174 -p1 -b .json-c
 %patch175 -p1 -b .rh1709553
+%patch176 -p1 -b .rh1736762-1
+%patch177 -p1 -b .rh1736762-2
+%patch178 -p1 -b .rh1736762-3
+%patch179 -p1 -b .rh1736762-4
 
 mkdir lib/dns/tests/testdata/dstrandom
 cp -a %{SOURCE50} lib/dns/tests/testdata/dstrandom/random.data

From 5ca9d90d4747acb39c1329001161b86284976e74 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 2 Dec 2019 20:35:43 +0100
Subject: [PATCH 49/55] Bump spec for bug #1736762

---
 bind.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index 813b09b..b8b7557 100644
--- a/bind.spec
+++ b/bind.spec
@@ -58,7 +58,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.11.13
-Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  3%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1553,6 +1553,9 @@ fi;
 
 
 %changelog
+* Mon Dec 02 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.13-3
+- Backport few thread safety related fixed from upstream (#1736762)
+
 * Tue Nov 26 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.13-2
 - Complete explicit disabling of RSAMD5 in FIPS mode (#1709553)
 

From 50f15f4c5620519574f6389e6341667b615d6ebd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 4 Dec 2019 17:09:24 +0100
Subject: [PATCH 50/55] Add ThreadSanitizer support

Has to be enabled in build by --with TSAN.
Would make build fail unit tests and print many warnings about possible
race conditions. Not useful for production build, but useful for
debugging thread related problems in system tests.
---
 bind.spec | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/bind.spec b/bind.spec
index b8b7557..3772acc 100644
--- a/bind.spec
+++ b/bind.spec
@@ -26,6 +26,7 @@
 %else
 %bcond_with    UNITTEST
 %endif
+%bcond_with    TSAN
 
 %{?!bind_uid:  %global bind_uid  25}
 %{?!bind_gid:  %global bind_gid  25}
@@ -229,6 +230,9 @@ BuildRequires:  fstrm-devel protobuf-c-devel
 %endif
 # Needed to regenerate dig.1 manpage
 BuildRequires: docbook-style-xsl, libxslt
+%if %{with TSAN}
+BuildRequires: libtsan
+%endif
 
 %description
 BIND (Berkeley Internet Name Domain) is an implementation of the DNS
@@ -615,10 +619,15 @@ done
   cp -Tuav bin/tests "%{1}/bin/tests/" \
   cp -uv version "%{1}" \
 
-export CFLAGS="$CFLAGS $RPM_OPT_FLAGS"
+CFLAGS="$CFLAGS $RPM_OPT_FLAGS"
+%if %{with TSAN}
+  CFLAGS+=" -O1 -fsanitize=thread -fPIE -pie"
+%endif
+export CFLAGS
 export CPPFLAGS="$CPPFLAGS -DDIG_SIGCHASE"
 export STD_CDEFINES="$CPPFLAGS"
 
+
 sed -i -e \
 's/RELEASEVER=\(.*\)/RELEASEVER=\1-RedHat-%{version}-%{release}/' \
 version
@@ -813,6 +822,10 @@ sed -e "/^\s*include(/ d" -e 's/^-- use //' \
   eval "$(bash %{SOURCE48} -A "`pwd`/softhsm-tokens")"
 %endif
 
+%if %{with TSAN}
+export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0"
+%endif
+
 %if %{with UNITTEST}
   pushd build
   make unit

From 58f8c59cb1e2e7d62bbddafd6971f29fbfccc27f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 9 Dec 2019 21:27:17 +0100
Subject: [PATCH 51/55] Add one more candidate for issue fixing

Imported from upstream commit 6eed12605154b8ce10e9be0f51253e6ec318550e
---
 bind-9.11-rh1736762-5.patch | 59 +++++++++++++++++++++++++++++++++++++
 bind.spec                   |  2 ++
 2 files changed, 61 insertions(+)
 create mode 100644 bind-9.11-rh1736762-5.patch

diff --git a/bind-9.11-rh1736762-5.patch b/bind-9.11-rh1736762-5.patch
new file mode 100644
index 0000000..e14efca
--- /dev/null
+++ b/bind-9.11-rh1736762-5.patch
@@ -0,0 +1,59 @@
+From 6257d829c9d7e71ac51bcdc6b5b981c7a19200e2 Mon Sep 17 00:00:00 2001
+From: Mark Andrews <marka@isc.org>
+Date: Mon, 25 Nov 2019 05:46:55 +0000
+Subject: [PATCH] Merge branch
+ '1373-threadsanitizer-data-race-rbtdb-c-5193-in-detachnode' into 'master'
+
+Resolve "ThreadSanitizer: data race rbtdb.c:5193 in detachnode"
+
+Closes #1373
+
+See merge request isc-projects/bind9!2598
+---
+ lib/dns/include/dns/rbt.h | 22 +++++++++-------------
+ 1 file changed, 9 insertions(+), 13 deletions(-)
+
+diff --git a/lib/dns/include/dns/rbt.h b/lib/dns/include/dns/rbt.h
+index 67ac3e4d8a..a084bd6193 100644
+--- a/lib/dns/include/dns/rbt.h
++++ b/lib/dns/include/dns/rbt.h
+@@ -49,10 +49,7 @@ ISC_LANG_BEGINDECLS
+ 
+ #define DNS_RBT_USEMAGIC 1
+ 
+-/*
+- * These should add up to 30.
+- */
+-#define DNS_RBT_LOCKLENGTH                      10
++#define DNS_RBT_LOCKLENGTH		(sizeof(((dns_rbtnode_t *)0)->locknum)*8)
+ #define DNS_RBT_REFLENGTH                       20
+ 
+ #define DNS_RBTNODE_MAGIC               ISC_MAGIC('R','B','N','O')
+@@ -159,16 +156,15 @@ struct dns_rbtnode {
+ 	 * separate region of memory.
+ 	 */
+ 	void *data;
+-	unsigned int :0;                /* start of bitfields c/o node lock */
+-	unsigned int dirty:1;
+-	unsigned int wild:1;
+-	unsigned int locknum:DNS_RBT_LOCKLENGTH;
+-#ifndef DNS_RBT_USEISCREFCOUNT
+-	unsigned int references:DNS_RBT_REFLENGTH;
+-#endif
+-	unsigned int :0;                /* end of bitfields c/o node lock */
++	uint8_t :0;                /* start of bitfields c/o node lock */
++	uint8_t dirty:1;
++	uint8_t wild:1;
++	uint8_t :0;                /* end of bitfields c/o node lock */
++	uint16_t locknum;	   /* note that this is not in the bitfield */
+ #ifdef DNS_RBT_USEISCREFCOUNT
+-	isc_refcount_t references; /* note that this is not in the bitfield */
++	isc_refcount_t references;
++#else
++	unsigned int references:DNS_RBT_REFLENGTH;
+ #endif
+ 	/*@}*/
+ };
+-- 
+2.21.0
+
diff --git a/bind.spec b/bind.spec
index 3772acc..b028d81 100644
--- a/bind.spec
+++ b/bind.spec
@@ -161,6 +161,7 @@ Patch176: bind-9.11-rh1736762-1.patch
 Patch177: bind-9.11-rh1736762-2.patch
 Patch178: bind-9.11-rh1736762-3.patch
 Patch179: bind-9.11-rh1736762-4.patch
+Patch180: bind-9.11-rh1736762-5.patch
 
 # SDB patches
 Patch11: bind-9.3.2b2-sdbsrc.patch
@@ -549,6 +550,7 @@ are used for building ISC DHCP.
 %patch177 -p1 -b .rh1736762-2
 %patch178 -p1 -b .rh1736762-3
 %patch179 -p1 -b .rh1736762-4
+%patch180 -p1 -b .rh1736762-5
 
 mkdir lib/dns/tests/testdata/dstrandom
 cp -a %{SOURCE50} lib/dns/tests/testdata/dstrandom/random.data

From ee2381e3105e1bb7ed5d025f0cd406d676be1975 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 19 Dec 2019 18:39:21 +0100
Subject: [PATCH 52/55] Update to 9.11.14

Includes ThreadSanitizer fixes already included as downstream patches.
Adjusts serve-stale patch, one new statistics.
---
 .gitignore                  |   2 +
 bind-9.11-rh1736762-1.patch |  56 --------------
 bind-9.11-rh1736762-2.patch |  38 ---------
 bind-9.11-rh1736762-3.patch | 105 -------------------------
 bind-9.11-rh1736762-4.patch | 110 ---------------------------
 bind-9.11-rt31459.patch     | 148 ++++++++++++++++++------------------
 bind.spec                   |  15 ++--
 sources                     |   4 +-
 8 files changed, 83 insertions(+), 395 deletions(-)
 delete mode 100644 bind-9.11-rh1736762-1.patch
 delete mode 100644 bind-9.11-rh1736762-2.patch
 delete mode 100644 bind-9.11-rh1736762-3.patch
 delete mode 100644 bind-9.11-rh1736762-4.patch

diff --git a/.gitignore b/.gitignore
index ebe1d83..10b3381 100644
--- a/.gitignore
+++ b/.gitignore
@@ -99,3 +99,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.11.12.tar.gz
 /bind-9.11.13.tar.gz
 /bind-9.11.13.tar.gz.asc
+/bind-9.11.14.tar.gz
+/bind-9.11.14.tar.gz.asc
diff --git a/bind-9.11-rh1736762-1.patch b/bind-9.11-rh1736762-1.patch
deleted file mode 100644
index 272177f..0000000
--- a/bind-9.11-rh1736762-1.patch
+++ /dev/null
@@ -1,56 +0,0 @@
-From 312bd133f75c54d51196060c573e29aabbb0b842 Mon Sep 17 00:00:00 2001
-From: Mark Andrews <marka@isc.org>
-Date: Tue, 26 Nov 2019 02:30:14 +0000
-Subject: [PATCH 1/4] Merge branch
- '1367-threadsanitizer-data-race-dispatch-c-901-in-free_buffer-v9_11' into
- 'v9_11'
-
-Resolve "ThreadSanitizer: data race dispatch.c:901 in free_buffer"
-
-See merge request isc-projects/bind9!2628
-
-(cherry picked from commit 0455351802cb915e7961dad9cf14977a19162d38)
----
- lib/dns/dispatch.c | 9 ++++++---
- 1 file changed, 6 insertions(+), 3 deletions(-)
-
-diff --git a/lib/dns/dispatch.c b/lib/dns/dispatch.c
-index 3278db4a07..ea5cf102f2 100644
---- a/lib/dns/dispatch.c
-+++ b/lib/dns/dispatch.c
-@@ -927,6 +927,10 @@ allocate_udp_buffer(dns_dispatch_t *disp) {
- 	void *temp;
- 
- 	LOCK(&disp->mgr->buffer_lock);
-+	if (disp->mgr->buffers >= disp->mgr->maxbuffers) {
-+		UNLOCK(&disp->mgr->buffer_lock);
-+		return (NULL);
-+	}
- 	bpool = disp->mgr->bpool;
- 	disp->mgr->buffers++;
- 	UNLOCK(&disp->mgr->buffer_lock);
-@@ -1058,9 +1062,11 @@ udp_recv(isc_event_t *ev_in, dns_dispatch_t *disp, dispsocket_t *dispsock) {
- 	mgr = disp->mgr;
- 	qid = mgr->qid;
- 
-+	LOCK(&disp->mgr->buffer_lock);
- 	dispatch_log(disp, LVL(90),
- 		     "got packet: requests %d, buffers %d, recvs %d",
- 		     disp->requests, disp->mgr->buffers, disp->recv_pending);
-+	UNLOCK(&disp->mgr->buffer_lock);
- 
- 	if (dispsock == NULL && ev->ev_type == ISC_SOCKEVENT_RECVDONE) {
- 		/*
-@@ -1511,9 +1517,6 @@ startrecv(dns_dispatch_t *disp, dispsocket_t *dispsock) {
- 	if (disp->recv_pending != 0 && dispsock == NULL)
- 		return (ISC_R_SUCCESS);
- 
--	if (disp->mgr->buffers >= disp->mgr->maxbuffers)
--		return (ISC_R_NOMEMORY);
--
- 	if ((disp->attributes & DNS_DISPATCHATTR_EXCLUSIVE) != 0 &&
- 	    dispsock == NULL)
- 		return (ISC_R_SUCCESS);
--- 
-2.21.0
-
diff --git a/bind-9.11-rh1736762-2.patch b/bind-9.11-rh1736762-2.patch
deleted file mode 100644
index 7d16138..0000000
--- a/bind-9.11-rh1736762-2.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From 8e1900b79d854e22ec6b5cea152ff363ce9a461c Mon Sep 17 00:00:00 2001
-From: Mark Andrews <marka@isc.org>
-Date: Fri, 22 Nov 2019 21:48:12 +0000
-Subject: [PATCH 2/4] Merge branch
- '1334-threadsanitizer-data-race-dispatch-c-1339-in-tcp_recv-v9_11' into
- 'v9_11'
-
-lock dispatch before reporting state
-
-See merge request isc-projects/bind9!2619
-
-(cherry picked from commit e36730076af3190fe5930a6406dd414b87e1e178)
----
- lib/dns/dispatch.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/lib/dns/dispatch.c b/lib/dns/dispatch.c
-index ea5cf102f2..94df6bab9a 100644
---- a/lib/dns/dispatch.c
-+++ b/lib/dns/dispatch.c
-@@ -1353,12 +1353,12 @@ tcp_recv(isc_task_t *task, isc_event_t *ev_in) {
- 
- 	qid = disp->qid;
- 
-+	LOCK(&disp->lock);
-+
- 	dispatch_log(disp, LVL(90),
- 		     "got TCP packet: requests %d, buffers %d, recvs %d",
- 		     disp->requests, disp->tcpbuffers, disp->recv_pending);
- 
--	LOCK(&disp->lock);
--
- 	INSIST(disp->recv_pending != 0);
- 	disp->recv_pending = 0;
- 
--- 
-2.21.0
-
diff --git a/bind-9.11-rh1736762-3.patch b/bind-9.11-rh1736762-3.patch
deleted file mode 100644
index ed4dc93..0000000
--- a/bind-9.11-rh1736762-3.patch
+++ /dev/null
@@ -1,105 +0,0 @@
-From 651fc773a6e154466998424e975bce3fdb8566d8 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
-Date: Wed, 27 Nov 2019 17:06:28 +0000
-Subject: [PATCH 3/4] Merge branch
- '1350-threadsanitizer-data-race-rbt-c-1312-in-dns_rbt_addnode-v9_11' into
- 'v9_11'
-
-Resolve "ThreadSanitizer: data race rbt.c:1312 in dns_rbt_addnode"
-
-See merge request isc-projects/bind9!2651
-
-(cherry picked from commit a5fb8c812728cb5fc923f60d6707d953d704719f)
----
- lib/dns/rbtdb.c | 24 +++++++++++++++++++++---
- 1 file changed, 21 insertions(+), 3 deletions(-)
-
-diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
-index 738aa203ec..d3bb8d7fe7 100644
---- a/lib/dns/rbtdb.c
-+++ b/lib/dns/rbtdb.c
-@@ -1972,6 +1972,9 @@ clean_zone_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
- 		node->dirty = 0;
- }
- 
-+/*
-+ * tree_lock(write) must be held.
-+ */
- static void
- delete_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node) {
- 	dns_rbtnode_t *nsecnode;
-@@ -2955,6 +2958,8 @@ closeversion(dns_db_t *db, dns_dbversion_t **versionp, bool commit) {
-  * E.g. if the wildcard name is "*.sub.example." then we
-  * must ensure that "sub.example." exists and is marked as
-  * a wildcard level.
-+ *
-+ * tree_lock(write) must be held.
-  */
- static isc_result_t
- add_wildcard_magic(dns_rbtdb_t *rbtdb, dns_name_t *name) {
-@@ -2979,6 +2984,9 @@ add_wildcard_magic(dns_rbtdb_t *rbtdb, dns_name_t *name) {
- 	return (ISC_R_SUCCESS);
- }
- 
-+/*
-+ * tree_lock(write) must be held.
-+ */
- static isc_result_t
- add_empty_wildcards(dns_rbtdb_t *rbtdb, dns_name_t *name) {
- 	isc_result_t result;
-@@ -6756,13 +6764,16 @@ addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
- 	REQUIRE(VALID_RBTDB(rbtdb));
- 	INSIST(rbtversion == NULL || rbtversion->rbtdb == rbtdb);
- 
--	if (rbtdb->common.methods == &zone_methods)
-+	if (rbtdb->common.methods == &zone_methods) {
-+		RWLOCK(&rbtdb->tree_lock, isc_rwlocktype_read);
- 		REQUIRE(((rbtnode->nsec == DNS_RBT_NSEC_NSEC3 &&
- 			  (rdataset->type == dns_rdatatype_nsec3 ||
- 			   rdataset->covers == dns_rdatatype_nsec3)) ||
- 			 (rbtnode->nsec != DNS_RBT_NSEC_NSEC3 &&
- 			   rdataset->type != dns_rdatatype_nsec3 &&
- 			   rdataset->covers != dns_rdatatype_nsec3)));
-+		RWUNLOCK(&rbtdb->tree_lock, isc_rwlocktype_read);
-+	}
- 
- 	if (rbtversion == NULL) {
- 		if (now == 0)
-@@ -6854,11 +6865,15 @@ addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
- 	/*
- 	 * Add to the auxiliary NSEC tree if we're adding an NSEC record.
- 	 */
-+	RWLOCK(&rbtdb->tree_lock, isc_rwlocktype_read);
- 	if (rbtnode->nsec != DNS_RBT_NSEC_HAS_NSEC &&
- 	    rdataset->type == dns_rdatatype_nsec)
-+	{
- 		newnsec = true;
--	else
-+	} else {
- 		newnsec = false;
-+	}
-+	RWUNLOCK(&rbtdb->tree_lock, isc_rwlocktype_read);
- 
- 	/*
- 	 * If we're adding a delegation type, adding to the auxiliary NSEC tree,
-@@ -6959,13 +6974,16 @@ subtractrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
- 	REQUIRE(VALID_RBTDB(rbtdb));
- 	REQUIRE(rbtversion != NULL && rbtversion->rbtdb == rbtdb);
- 
--	if (rbtdb->common.methods == &zone_methods)
-+	if (rbtdb->common.methods == &zone_methods) {
-+		RWLOCK(&rbtdb->tree_lock, isc_rwlocktype_read);
- 		REQUIRE(((rbtnode->nsec == DNS_RBT_NSEC_NSEC3 &&
- 			  (rdataset->type == dns_rdatatype_nsec3 ||
- 			   rdataset->covers == dns_rdatatype_nsec3)) ||
- 			 (rbtnode->nsec != DNS_RBT_NSEC_NSEC3 &&
- 			   rdataset->type != dns_rdatatype_nsec3 &&
- 			   rdataset->covers != dns_rdatatype_nsec3)));
-+		RWUNLOCK(&rbtdb->tree_lock, isc_rwlocktype_read);
-+	}
- 
- 	result = dns_rdataslab_fromrdataset(rdataset, rbtdb->common.mctx,
- 					    &region, sizeof(rdatasetheader_t));
--- 
-2.21.0
-
diff --git a/bind-9.11-rh1736762-4.patch b/bind-9.11-rh1736762-4.patch
deleted file mode 100644
index 61afe9d..0000000
--- a/bind-9.11-rh1736762-4.patch
+++ /dev/null
@@ -1,110 +0,0 @@
-From 9c1f74400c04267dea4f1bd7f62de8ba5e8d2b0e Mon Sep 17 00:00:00 2001
-From: Mark Andrews <marka@isc.org>
-Date: Thu, 28 Nov 2019 10:24:12 +1100
-Subject: [PATCH 4/4] rdataset_setownercase and rdataset_getownercase need to
- obtain a node lock
-
-(cherry picked from commit 637b2c4e517b466900a8c00b52f7a15727e12ae9)
-(cherry picked from commit 1c61f129c3b12071723a2154d33f74628bf80998)
----
- lib/dns/rbtdb.c | 35 ++++++++++++++++++++++++++++-------
- 1 file changed, 28 insertions(+), 7 deletions(-)
-
-diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
-index d3bb8d7fe7..199ff08011 100644
---- a/lib/dns/rbtdb.c
-+++ b/lib/dns/rbtdb.c
-@@ -10109,11 +10109,18 @@ setownercase(rdatasetheader_t *header, const dns_name_t *name) {
- 
- static void
- rdataset_setownercase(dns_rdataset_t *rdataset, const dns_name_t *name) {
-+	dns_rbtdb_t *rbtdb = rdataset->private1;
-+	dns_rbtnode_t *rbtnode = rdataset->private2;
- 	unsigned char *raw = rdataset->private3;        /* RDATASLAB */
- 	rdatasetheader_t *header;
- 
- 	header = (struct rdatasetheader *)(raw - sizeof(*header));
-+
-+	NODE_LOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
-+		  isc_rwlocktype_write);
- 	setownercase(header, name);
-+	NODE_UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
-+		    isc_rwlocktype_write);
- }
- 
- static const unsigned char charmask[] = {
-@@ -10188,6 +10195,8 @@ static unsigned char maptolower[] = {
- 
- static void
- rdataset_getownercase(const dns_rdataset_t *rdataset, dns_name_t *name) {
-+	dns_rbtdb_t *rbtdb = rdataset->private1;
-+	dns_rbtnode_t *rbtnode = rdataset->private2;
- 	const unsigned char *raw = rdataset->private3;        /* RDATASLAB */
- 	const rdatasetheader_t *header;
- 	unsigned int i, j;
-@@ -10196,8 +10205,12 @@ rdataset_getownercase(const dns_rdataset_t *rdataset, dns_name_t *name) {
- 
- 	header = (const struct rdatasetheader *)(raw - sizeof(*header));
- 
--	if (!CASESET(header))
--		return;
-+	NODE_LOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
-+		  isc_rwlocktype_read);
-+
-+	if (!CASESET(header)) {
-+		goto unlock;
-+	}
- 
- #if 0
- 	/*
-@@ -10210,10 +10223,13 @@ rdataset_getownercase(const dns_rdataset_t *rdataset, dns_name_t *name) {
- 		 */
- 		if (name->ndata[i] >= 0x61 && name->ndata[i] <= 0x7a &&
- 		    (header->upper[i/8] & (1 << (i%8))) != 0)
-+		{
- 			name->ndata[i] &= ~0x20; /* clear the lower case bit */
--		else if (name->ndata[i] >= 0x41 && name->ndata[i] <= 0x5a &&
--			 (header->upper[i/8] & (1 << (i%8))) == 0)
-+		} else if (name->ndata[i] >= 0x41 && name->ndata[i] <= 0x5a &&
-+			   (header->upper[i/8] & (1 << (i%8))) == 0)
-+		{
- 			name->ndata[i] |= 0x20; /* set the lower case bit */
-+		}
- 	}
- #else
- 	if (ISC_LIKELY(CASEFULLYLOWER(header))) {
-@@ -10236,7 +10252,7 @@ rdataset_getownercase(const dns_rdataset_t *rdataset, dns_name_t *name) {
- 			c = *bp;
- 			*bp++ = maptolower[c];
- 		}
--		return;
-+		goto unlock;
- 	}
- 
- 	i = 0;
-@@ -10257,8 +10273,9 @@ rdataset_getownercase(const dns_rdataset_t *rdataset, dns_name_t *name) {
- 		}
- 	}
- 
--	if (ISC_UNLIKELY(i == name->length))
--		return;
-+	if (ISC_UNLIKELY(i == name->length)) {
-+		goto unlock;
-+	}
- 
- 	bits = ~(header->upper[j]);
- 
-@@ -10272,6 +10289,10 @@ rdataset_getownercase(const dns_rdataset_t *rdataset, dns_name_t *name) {
- 		bits >>= 1;
- 	}
- #endif
-+
-+ unlock:
-+	NODE_UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
-+		    isc_rwlocktype_read);
- }
- 
- /*%
--- 
-2.21.0
-
diff --git a/bind-9.11-rt31459.patch b/bind-9.11-rt31459.patch
index ea25abe..efcc6fa 100644
--- a/bind-9.11-rt31459.patch
+++ b/bind-9.11-rt31459.patch
@@ -1,4 +1,4 @@
-From 7e61714a5d1509ec79af42391e41eb1afc53063a Mon Sep 17 00:00:00 2001
+From e83a6723d84e4c4400ca646077393a24b092c623 Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Tue, 12 Sep 2017 19:05:46 -0700
 Subject: [PATCH] rebased rt31459c
@@ -71,10 +71,10 @@ index 5015abb..295e16f 100644
  							     &entropy_source,
  							     randomfile,
 diff --git a/bin/dnssec/dnssec-dsfromkey.c b/bin/dnssec/dnssec-dsfromkey.c
-index 2c0c308..3e585af 100644
+index d9d6bb9..de4b15f 100644
 --- a/bin/dnssec/dnssec-dsfromkey.c
 +++ b/bin/dnssec/dnssec-dsfromkey.c
-@@ -494,14 +494,14 @@ main(int argc, char **argv) {
+@@ -498,14 +498,14 @@ main(int argc, char **argv) {
  
  	if (ectx == NULL)
  		setup_entropy(mctx, NULL, &ectx);
@@ -92,7 +92,7 @@ index 2c0c308..3e585af 100644
  	isc_entropy_stopcallbacksources(ectx);
  
  	setup_logging(mctx, &log);
-@@ -571,8 +571,8 @@ main(int argc, char **argv) {
+@@ -574,8 +574,8 @@ main(int argc, char **argv) {
  	if (dns_rdataset_isassociated(&rdataset))
  		dns_rdataset_disassociate(&rdataset);
  	cleanup_logging(&log);
@@ -103,10 +103,10 @@ index 2c0c308..3e585af 100644
  	dns_name_destroy();
  	if (verbose > 10)
 diff --git a/bin/dnssec/dnssec-importkey.c b/bin/dnssec/dnssec-importkey.c
-index 0d1e7f8..79c4d74 100644
+index d65a514..04b3094 100644
 --- a/bin/dnssec/dnssec-importkey.c
 +++ b/bin/dnssec/dnssec-importkey.c
-@@ -407,14 +407,14 @@ main(int argc, char **argv) {
+@@ -404,14 +404,14 @@ main(int argc, char **argv) {
  
  	if (ectx == NULL)
  		setup_entropy(mctx, NULL, &ectx);
@@ -124,7 +124,7 @@ index 0d1e7f8..79c4d74 100644
  	isc_entropy_stopcallbacksources(ectx);
  
  	setup_logging(mctx, &log);
-@@ -458,8 +458,8 @@ main(int argc, char **argv) {
+@@ -455,8 +455,8 @@ main(int argc, char **argv) {
  	if (dns_rdataset_isassociated(&rdataset))
  		dns_rdataset_disassociate(&rdataset);
  	cleanup_logging(&log);
@@ -167,10 +167,10 @@ index 7d82dbf..10f9359 100644
  	if (verbose > 10)
  		isc_mem_stats(mctx, stdout);
 diff --git a/bin/dnssec/dnssec-settime.c b/bin/dnssec/dnssec-settime.c
-index f355903..6a2ca59 100644
+index 7afcaee..1cfa511 100644
 --- a/bin/dnssec/dnssec-settime.c
 +++ b/bin/dnssec/dnssec-settime.c
-@@ -382,14 +382,14 @@ main(int argc, char **argv) {
+@@ -380,14 +380,14 @@ main(int argc, char **argv) {
  
  	if (ectx == NULL)
  		setup_entropy(mctx, NULL, &ectx);
@@ -188,7 +188,7 @@ index f355903..6a2ca59 100644
  	isc_entropy_stopcallbacksources(ectx);
  
  	if (predecessor != NULL) {
-@@ -674,8 +674,8 @@ main(int argc, char **argv) {
+@@ -672,8 +672,8 @@ main(int argc, char **argv) {
  	if (prevkey != NULL)
  		dst_key_free(&prevkey);
  	dst_key_free(&key);
@@ -199,7 +199,7 @@ index f355903..6a2ca59 100644
  	if (verbose > 10)
  		isc_mem_stats(mctx, stdout);
 diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c
-index c6a0313..6ddaebe 100644
+index 71f5672..9b100ca 100644
 --- a/bin/dnssec/dnssec-signzone.c
 +++ b/bin/dnssec/dnssec-signzone.c
 @@ -3460,14 +3460,15 @@ main(int argc, char *argv[]) {
@@ -257,7 +257,7 @@ index 4c293bf..3263cbc 100644
  
  	rdclass = strtoclass(classname);
 diff --git a/bin/dnssec/dnssectool.c b/bin/dnssec/dnssectool.c
-index fbc7ece..31a99e7 100644
+index 9d2a016..a9f90b6 100644
 --- a/bin/dnssec/dnssectool.c
 +++ b/bin/dnssec/dnssectool.c
 @@ -34,6 +34,7 @@
@@ -293,7 +293,7 @@ index fbc7ece..31a99e7 100644
  					   usekeyboard);
  
 diff --git a/bin/named/server.c b/bin/named/server.c
-index 7d85d3b..c782073 100644
+index 5a860e4..21c340c 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
 @@ -36,6 +36,7 @@
@@ -304,7 +304,7 @@ index 7d85d3b..c782073 100644
  #include <isc/portset.h>
  #include <isc/print.h>
  #include <isc/random.h>
-@@ -8211,6 +8212,10 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8217,6 +8218,10 @@ load_configuration(const char *filename, ns_server_t *server,
  				      "no source of entropy found");
  		} else {
  			const char *randomdev = cfg_obj_asstring(obj);
@@ -315,7 +315,7 @@ index 7d85d3b..c782073 100644
  			int level = ISC_LOG_ERROR;
  			result = isc_entropy_createfilesource(ns_g_entropy,
  							      randomdev);
-@@ -8245,6 +8250,7 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8251,6 +8256,7 @@ load_configuration(const char *filename, ns_server_t *server,
  				}
  				isc_entropy_detach(&ns_g_fallbackentropy);
  			}
@@ -688,7 +688,7 @@ index bf6dbb6..0416b21 100644
  	parse_args(false, argc, argv);
  	if (server == NULL)
 diff --git a/configure b/configure
-index ed002e0..a578874 100755
+index aab472a..b686178 100755
 --- a/configure
 +++ b/configure
 @@ -640,6 +640,7 @@ ac_includes_default="\
@@ -715,7 +715,7 @@ index ed002e0..a578874 100755
  with_lmdb
  with_libxml2
  with_libjson
-@@ -1744,6 +1747,7 @@ Optional Features:
+@@ -1745,6 +1748,7 @@ Optional Features:
    --enable-threads        enable multithreading
    --enable-native-pkcs11  use native PKCS11 for all crypto [default=no]
    --enable-openssl-hash   use OpenSSL for hash functions [default=no]
@@ -723,7 +723,7 @@ index ed002e0..a578874 100755
    --enable-largefile      64-bit file support
    --enable-backtrace      log stack backtrace on abort [default=yes]
    --enable-symtable       use internal symbol table for backtrace
-@@ -17115,6 +17119,7 @@ case "$use_openssl" in
+@@ -17135,6 +17139,7 @@ case "$use_openssl" in
  $as_echo "disabled because of native PKCS11" >&6; }
  		DST_OPENSSL_INC=""
  		CRYPTO="-DPKCS11CRYPTO"
@@ -731,7 +731,7 @@ index ed002e0..a578874 100755
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -17129,6 +17134,7 @@ $as_echo "disabled because of native PKCS11" >&6; }
+@@ -17149,6 +17154,7 @@ $as_echo "disabled because of native PKCS11" >&6; }
  $as_echo "no" >&6; }
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -739,7 +739,7 @@ index ed002e0..a578874 100755
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -17141,6 +17147,7 @@ $as_echo "no" >&6; }
+@@ -17161,6 +17167,7 @@ $as_echo "no" >&6; }
  	auto)
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -747,7 +747,7 @@ index ed002e0..a578874 100755
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -17150,7 +17157,7 @@ $as_echo "no" >&6; }
+@@ -17170,7 +17177,7 @@ $as_echo "no" >&6; }
  		OPENSSLLINKOBJS=""
  		OPENSSLLINKSRCS=""
  		as_fn_error $? "OpenSSL was not found in any of $openssldirs; use --with-openssl=/path
@@ -756,7 +756,7 @@ index ed002e0..a578874 100755
  		;;
  	*)
  		if test "yes" = "$want_native_pkcs11"
-@@ -17181,6 +17188,7 @@ $as_echo "not found" >&6; }
+@@ -17201,6 +17208,7 @@ $as_echo "not found" >&6; }
  			as_fn_error $? "\"$use_openssl/include/openssl/opensslv.h\" not found" "$LINENO" 5
  		fi
  		CRYPTO='-DOPENSSL'
@@ -764,7 +764,7 @@ index ed002e0..a578874 100755
  		if test "/usr" = "$use_openssl"
  		then
  			DST_OPENSSL_INC=""
-@@ -17806,8 +17814,6 @@ fi
+@@ -17826,8 +17834,6 @@ fi
  # Use OpenSSL for hash functions
  #
  
@@ -773,7 +773,7 @@ index ed002e0..a578874 100755
  ISC_PLATFORM_OPENSSLHASH="#undef ISC_PLATFORM_OPENSSLHASH"
  case $want_openssl_hash in
  	yes)
-@@ -18182,6 +18188,86 @@ if test "rt" = "$have_clock_gt"; then
+@@ -18202,6 +18208,86 @@ if test "rt" = "$have_clock_gt"; then
  	LIBS="-lrt $LIBS"
  fi
  
@@ -860,7 +860,7 @@ index ed002e0..a578874 100755
  #
  # was --with-lmdb specified?
  #
-@@ -20264,9 +20350,12 @@ _ACEOF
+@@ -20284,9 +20370,12 @@ _ACEOF
  if ac_fn_c_try_compile "$LINENO"; then :
    { $as_echo "$as_me:${as_lineno-$LINENO}: result: size_t for buflen; int for flags" >&5
  $as_echo "size_t for buflen; int for flags" >&6; }
@@ -875,7 +875,7 @@ index ed002e0..a578874 100755
  
  	 $as_echo "#define IRS_GETNAMEINFO_FLAGS_T int" >>confdefs.h
  
-@@ -21581,12 +21670,7 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
+@@ -21601,12 +21690,7 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
  ISC_PLATFORM_USESTDASM="#undef ISC_PLATFORM_USESTDASM"
  ISC_PLATFORM_USEMACASM="#undef ISC_PLATFORM_USEMACASM"
  if test "yes" = "$use_atomic"; then
@@ -889,7 +889,7 @@ index ed002e0..a578874 100755
  # version HP92453-01 B.11.11.23709.GP, which incorrectly rejects
  # declarations like `int a3[[(sizeof (unsigned char)) >= 0]];'.
  # This bug is HP SR number 8606223364.
-@@ -21619,6 +21703,11 @@ cat >>confdefs.h <<_ACEOF
+@@ -21639,6 +21723,11 @@ cat >>confdefs.h <<_ACEOF
  _ACEOF
  
  
@@ -901,7 +901,7 @@ index ed002e0..a578874 100755
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -21627,39 +21716,6 @@ _ACEOF
+@@ -21647,39 +21736,6 @@ _ACEOF
  		fi
  	;;
  	x86_64-*|amd64-*)
@@ -941,7 +941,7 @@ index ed002e0..a578874 100755
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -21690,6 +21746,10 @@ $as_echo_n "checking architecture type for atomic operations... " >&6; }
+@@ -21710,6 +21766,10 @@ $as_echo_n "checking architecture type for atomic operations... " >&6; }
  $as_echo "$arch" >&6; }
  fi
  
@@ -952,7 +952,7 @@ index ed002e0..a578874 100755
  if test "yes" = "$have_atomic"; then
  	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking compiler support for inline assembly code" >&5
  $as_echo_n "checking compiler support for inline assembly code... " >&6; }
-@@ -24244,6 +24304,30 @@ CFLAGS="$CFLAGS $SO_CFLAGS"
+@@ -24264,6 +24324,30 @@ CFLAGS="$CFLAGS $SO_CFLAGS"
  #
  dlzdir='${DLZ_DRIVER_DIR}'
  
@@ -983,7 +983,7 @@ index ed002e0..a578874 100755
  #
  # Private autoconf macro to simplify configuring drivers:
  #
-@@ -24574,11 +24658,11 @@ $as_echo "no" >&6; }
+@@ -24594,11 +24678,11 @@ $as_echo "no" >&6; }
  $as_echo "using mysql with libs ${mysql_lib} and includes ${mysql_include}" >&6; }
  		;;
  	*)
@@ -998,7 +998,7 @@ index ed002e0..a578874 100755
  		fi
  
  	CONTRIB_DLZ="$CONTRIB_DLZ -DDLZ_MYSQL"
-@@ -24663,7 +24747,7 @@ $as_echo "" >&6; }
+@@ -24683,7 +24767,7 @@ $as_echo "" >&6; }
  			# Check other locations for includes.
  			# Order is important (sigh).
  
@@ -1007,7 +1007,7 @@ index ed002e0..a578874 100755
  			# include a blank element first
  			for d in "" $bdb_incdirs
  			do
-@@ -24688,57 +24772,9 @@ $as_echo "" >&6; }
+@@ -24708,57 +24792,9 @@ $as_echo "" >&6; }
  			bdb_libnames="db53 db-5.3 db51 db-5.1 db48 db-4.8 db47 db-4.7 db46 db-4.6 db45 db-4.5 db44 db-4.4 db43 db-4.3 db42 db-4.2 db41 db-4.1 db"
  			for d in $bdb_libnames
  			do
@@ -1067,7 +1067,7 @@ index ed002e0..a578874 100755
  					break
  				fi
  			done
-@@ -24897,10 +24933,10 @@ $as_echo "no" >&6; }
+@@ -24917,10 +24953,10 @@ $as_echo "no" >&6; }
  		DLZ_DRIVER_INCLUDES="$DLZ_DRIVER_INCLUDES -I$use_dlz_ldap/include"
  		DLZ_DRIVER_LDAP_INCLUDES="-I$use_dlz_ldap/include"
  	fi
@@ -1081,7 +1081,7 @@ index ed002e0..a578874 100755
  	fi
  
  
-@@ -24986,11 +25022,11 @@ fi
+@@ -25006,11 +25042,11 @@ fi
  		odbcdirs="/usr /usr/local /usr/pkg"
  		for d in $odbcdirs
  		do
@@ -1095,7 +1095,7 @@ index ed002e0..a578874 100755
  				break
  			fi
  		done
-@@ -25265,6 +25301,8 @@ DNS_CRYPTO_LIBS="$NEWFLAGS"
+@@ -25285,6 +25321,8 @@ DNS_CRYPTO_LIBS="$NEWFLAGS"
  
  
  
@@ -1104,7 +1104,7 @@ index ed002e0..a578874 100755
  #
  # Commands to run at the end of config.status.
  # Don't just put these into configure, it won't work right if somebody
-@@ -27644,6 +27682,8 @@ report() {
+@@ -27661,6 +27699,8 @@ report() {
  	    echo "    IPv6 support (--enable-ipv6)"
  	test "X$CRYPTO" = "X" -o "yes" = "$want_native_pkcs11" || \
  		echo "    OpenSSL cryptography/DNSSEC (--with-openssl)"
@@ -1113,7 +1113,7 @@ index ed002e0..a578874 100755
  	test "X$PYTHON" = "X" || echo "    Python tools (--with-python)"
  	test "X$XMLSTATS" = "X" || echo "    XML statistics (--with-libxml2)"
  	test "X$JSONSTATS" = "X" || echo "    JSON statistics (--with-libjson)"
-@@ -27684,6 +27724,8 @@ report() {
+@@ -27701,6 +27741,8 @@ report() {
  	echo "    Very verbose query trace logging (--enable-querytrace)"
      test "no" = "$with_cmocka" || echo "    CMocka Unit Testing Framework (--with-cmocka)"
  
@@ -1122,7 +1122,7 @@ index ed002e0..a578874 100755
      echo "    Dynamically loadable zone (DLZ) drivers:"
      test "no" = "$use_dlz_bdb" || \
  	echo "        Berkeley DB (--with-dlz-bdb)"
-@@ -27731,6 +27773,8 @@ report() {
+@@ -27748,6 +27790,8 @@ report() {
  	echo "    ECDSA algorithm support (--with-ecdsa)"
      test "X$CRYPTO" = "X" -o "yes" = "$OPENSSL_ED25519" -o "yes" = "$PKCS11_ED25519" || \
  	echo "    EDDSA algorithm support (--with-eddsa)"
@@ -1132,10 +1132,10 @@ index ed002e0..a578874 100755
      test "yes" = "$enable_seccomp" || \
  	echo "    Use libseccomp system call filtering (--enable-seccomp)"
 diff --git a/configure.ac b/configure.ac
-index 45a8126..bb1345b 100644
+index 0e16cc8..dd0055d 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -1537,6 +1537,7 @@ case "$use_openssl" in
+@@ -1550,6 +1550,7 @@ case "$use_openssl" in
  		AC_MSG_RESULT(disabled because of native PKCS11)
  		DST_OPENSSL_INC=""
  		CRYPTO="-DPKCS11CRYPTO"
@@ -1143,7 +1143,7 @@ index 45a8126..bb1345b 100644
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -1550,6 +1551,7 @@ case "$use_openssl" in
+@@ -1563,6 +1564,7 @@ case "$use_openssl" in
  		AC_MSG_RESULT(no)
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -1151,7 +1151,7 @@ index 45a8126..bb1345b 100644
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -1562,6 +1564,7 @@ case "$use_openssl" in
+@@ -1575,6 +1577,7 @@ case "$use_openssl" in
  	auto)
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -1159,7 +1159,7 @@ index 45a8126..bb1345b 100644
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -1572,7 +1575,7 @@ case "$use_openssl" in
+@@ -1585,7 +1588,7 @@ case "$use_openssl" in
  		OPENSSLLINKSRCS=""
  		AC_MSG_ERROR(
  [OpenSSL was not found in any of $openssldirs; use --with-openssl=/path
@@ -1168,7 +1168,7 @@ index 45a8126..bb1345b 100644
  		;;
  	*)
  		if test "yes" = "$want_native_pkcs11"
-@@ -1602,6 +1605,7 @@ If you don't want OpenSSL, use --without-openssl])
+@@ -1615,6 +1618,7 @@ If you don't want OpenSSL, use --without-openssl])
  			AC_MSG_ERROR(["$use_openssl/include/openssl/opensslv.h" not found])
  		fi
  		CRYPTO='-DOPENSSL'
@@ -1176,7 +1176,7 @@ index 45a8126..bb1345b 100644
  		if test "/usr" = "$use_openssl"
  		then
  			DST_OPENSSL_INC=""
-@@ -2037,7 +2041,6 @@ fi
+@@ -2050,7 +2054,6 @@ fi
  # Use OpenSSL for hash functions
  #
  
@@ -1184,7 +1184,7 @@ index 45a8126..bb1345b 100644
  ISC_PLATFORM_OPENSSLHASH="#undef ISC_PLATFORM_OPENSSLHASH"
  case $want_openssl_hash in
  	yes)
-@@ -2309,6 +2312,67 @@ if test "rt" = "$have_clock_gt"; then
+@@ -2322,6 +2325,67 @@ if test "rt" = "$have_clock_gt"; then
  	LIBS="-lrt $LIBS"
  fi
  
@@ -1252,7 +1252,7 @@ index 45a8126..bb1345b 100644
  #
  # was --with-lmdb specified?
  #
-@@ -4105,12 +4169,12 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
+@@ -4118,12 +4182,12 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
  ISC_PLATFORM_USESTDASM="#undef ISC_PLATFORM_USESTDASM"
  ISC_PLATFORM_USEMACASM="#undef ISC_PLATFORM_USEMACASM"
  if test "yes" = "$use_atomic"; then
@@ -1266,7 +1266,7 @@ index 45a8126..bb1345b 100644
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -4119,7 +4183,6 @@ if test "yes" = "$use_atomic"; then
+@@ -4132,7 +4196,6 @@ if test "yes" = "$use_atomic"; then
  		fi
  	;;
  	x86_64-*|amd64-*)
@@ -1274,7 +1274,7 @@ index 45a8126..bb1345b 100644
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -5527,6 +5590,8 @@ report() {
+@@ -5537,6 +5600,8 @@ report() {
  	    echo "    IPv6 support (--enable-ipv6)"
  	test "X$CRYPTO" = "X" -o "yes" = "$want_native_pkcs11" || \
  		echo "    OpenSSL cryptography/DNSSEC (--with-openssl)"
@@ -1283,7 +1283,7 @@ index 45a8126..bb1345b 100644
  	test "X$PYTHON" = "X" || echo "    Python tools (--with-python)"
  	test "X$XMLSTATS" = "X" || echo "    XML statistics (--with-libxml2)"
  	test "X$JSONSTATS" = "X" || echo "    JSON statistics (--with-libjson)"
-@@ -5567,6 +5632,8 @@ report() {
+@@ -5577,6 +5642,8 @@ report() {
  	echo "    Very verbose query trace logging (--enable-querytrace)"
      test "no" = "$with_cmocka" || echo "    CMocka Unit Testing Framework (--with-cmocka)"
  
@@ -1292,7 +1292,7 @@ index 45a8126..bb1345b 100644
      echo "    Dynamically loadable zone (DLZ) drivers:"
      test "no" = "$use_dlz_bdb" || \
  	echo "        Berkeley DB (--with-dlz-bdb)"
-@@ -5614,6 +5681,8 @@ report() {
+@@ -5624,6 +5691,8 @@ report() {
  	echo "    ECDSA algorithm support (--with-ecdsa)"
      test "X$CRYPTO" = "X" -o "yes" = "$OPENSSL_ED25519" -o "yes" = "$PKCS11_ED25519" || \
  	echo "    EDDSA algorithm support (--with-eddsa)"
@@ -1302,7 +1302,7 @@ index 45a8126..bb1345b 100644
      test "yes" = "$enable_seccomp" || \
  	echo "    Use libseccomp system call filtering (--enable-seccomp)"
 diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c
-index ec6e00e..1614afa 100644
+index 65bf25d..1eccbe7 100644
 --- a/lib/dns/dst_api.c
 +++ b/lib/dns/dst_api.c
 @@ -277,6 +277,12 @@ dst_lib_init2(isc_mem_t *mctx, isc_entropy_t *ectx,
@@ -1440,7 +1440,7 @@ index 304814b..60543c4 100644
  	isc_hash_destroy();
    cleanup_db:
 diff --git a/lib/dns/openssl_link.c b/lib/dns/openssl_link.c
-index d65ce26..6849732 100644
+index 13e838f..ffe0a69 100644
 --- a/lib/dns/openssl_link.c
 +++ b/lib/dns/openssl_link.c
 @@ -31,6 +31,7 @@
@@ -1476,7 +1476,7 @@ index d65ce26..6849732 100644
  #endif
 +#endif /* !ISC_PLATFORM_CRYPTORANDOM */
  
- #if OPENSSL_VERSION_NUMBER >= 0x10000000L && OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
+ #if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
  static void
 @@ -192,7 +195,7 @@ _set_thread_id(CRYPTO_THREADID *id)
  isc_result_t
@@ -1845,10 +1845,10 @@ index 0000000..bd3d164
 +
 +#endif
 diff --git a/lib/dns/win32/libdns.def.in b/lib/dns/win32/libdns.def.in
-index 5c45d59..34b660c 100644
+index 63be973..40b21fa 100644
 --- a/lib/dns/win32/libdns.def.in
 +++ b/lib/dns/win32/libdns.def.in
-@@ -1484,6 +1484,13 @@ dst_lib_destroy
+@@ -1485,6 +1485,13 @@ dst_lib_destroy
  dst_lib_init
  dst_lib_init2
  dst_lib_initmsgcat
@@ -1944,10 +1944,10 @@ index 4bba8e1..632166a 100644
  
  #endif /* ISC_ENTROPY_H */
 diff --git a/lib/isc/include/isc/platform.h.in b/lib/isc/include/isc/platform.h.in
-index 9c7c342..ee8dc3e 100644
+index 4192946..dbd1560 100644
 --- a/lib/isc/include/isc/platform.h.in
 +++ b/lib/isc/include/isc/platform.h.in
-@@ -341,6 +341,11 @@
+@@ -359,6 +359,11 @@
   */
  @ISC_PLATFORM_HAVESTRINGSH@
  
@@ -1960,10 +1960,10 @@ index 9c7c342..ee8dc3e 100644
   * Define if the hash functions must be provided by OpenSSL.
   */
 diff --git a/lib/isc/include/isc/types.h b/lib/isc/include/isc/types.h
-index 42ff7e0..8d87c44 100644
+index da9d66f..4205400 100644
 --- a/lib/isc/include/isc/types.h
 +++ b/lib/isc/include/isc/types.h
-@@ -93,6 +93,8 @@ typedef struct isc_time			isc_time_t;		/*%< Time */
+@@ -97,6 +97,8 @@ typedef struct isc_time			isc_time_t;		/*%< Time */
  typedef struct isc_timer		isc_timer_t;		/*%< Timer */
  typedef struct isc_timermgr		isc_timermgr_t;		/*%< Timer Manager */
  
@@ -1973,7 +1973,7 @@ index 42ff7e0..8d87c44 100644
  typedef int (*isc_sockfdwatch_t)(isc_task_t *, isc_socket_t *, void *, int);
  
 diff --git a/lib/isc/pk11.c b/lib/isc/pk11.c
-index 8e6ed93..ceb5a2c 100644
+index 68aebdc..4b85527 100644
 --- a/lib/isc/pk11.c
 +++ b/lib/isc/pk11.c
 @@ -321,14 +321,16 @@ pk11_rand_seed_fromfile(const char *randomfile) {
@@ -1999,10 +1999,10 @@ index 8e6ed93..ceb5a2c 100644
      cleanup:
  	if (stream != NULL)
 diff --git a/lib/isc/win32/include/isc/platform.h.in b/lib/isc/win32/include/isc/platform.h.in
-index 5b8a2c9..913a2ce 100644
+index 8ade705..fa72f9d 100644
 --- a/lib/isc/win32/include/isc/platform.h.in
 +++ b/lib/isc/win32/include/isc/platform.h.in
-@@ -69,6 +69,11 @@
+@@ -73,6 +73,11 @@
  #define ISC_PLATFORM_NORETURN_PRE __declspec(noreturn)
  #define ISC_PLATFORM_NORETURN_POST
  
@@ -2015,7 +2015,7 @@ index 5b8a2c9..913a2ce 100644
   * Define if the hash functions must be provided by OpenSSL.
   */
 diff --git a/win32utils/Configure b/win32utils/Configure
-index ccaf067..240fb80 100644
+index 953f2aa..55cc929 100644
 --- a/win32utils/Configure
 +++ b/win32utils/Configure
 @@ -382,6 +382,7 @@ my @substdefh = ("ALLOW_FILTER_AAAA",
@@ -2036,7 +2036,7 @@ index ccaf067..240fb80 100644
                    "fixed-rrset",
                    "intrinsics",
                    "isc-spnego",
-@@ -581,6 +583,7 @@ my @help = (
+@@ -580,6 +582,7 @@ my @help = (
  "\nOptional Features:\n",
  "  enable-intrinsics     enable instrinsic/atomic functions [default=yes]\n",
  "  enable-native-pkcs11  use native PKCS#11 for all crypto [default=no]\n",
@@ -2044,7 +2044,7 @@ index ccaf067..240fb80 100644
  "  enable-openssl-hash   use OpenSSL for hash functions [default=yes]\n",
  "  enable-isc-spnego     use SPNEGO from lib/dns [default=yes]\n",
  "  enable-filter-aaaa    enable filtering of AAAA records [default=yes]\n",
-@@ -630,7 +633,9 @@ my $want_clean = "no";
+@@ -628,7 +631,9 @@ my $want_clean = "no";
  my $want_unknown = "no";
  my $unknown_value;
  my $enable_intrinsics = "yes";
@@ -2054,7 +2054,7 @@ index ccaf067..240fb80 100644
  my $enable_openssl_hash = "auto";
  my $enable_filter_aaaa = "yes";
  my $enable_isc_spnego = "yes";
-@@ -850,6 +855,10 @@ sub myenable {
+@@ -847,6 +852,10 @@ sub myenable {
          if ($val =~ /^yes$/i) {
              $enable_native_pkcs11 = "yes";
          }
@@ -2065,7 +2065,7 @@ index ccaf067..240fb80 100644
      } elsif ($key =~ /^openssl-hash$/i) {
          if ($val =~ /^yes$/i) {
              $enable_openssl_hash = "yes";
-@@ -1158,6 +1167,11 @@ if ($verbose) {
+@@ -1153,6 +1162,11 @@ if ($verbose) {
      } else {
          print "native-pkcs11: disabled\n";
      }
@@ -2077,7 +2077,7 @@ index ccaf067..240fb80 100644
      if ($enable_openssl_hash eq "yes") {
          print "openssl-hash: enabled\n";
      } else {
-@@ -1516,6 +1530,7 @@ if ($enable_intrinsics eq "yes") {
+@@ -1510,6 +1524,7 @@ if ($enable_intrinsics eq "yes") {
  
  # enable-native-pkcs11
  if ($enable_native_pkcs11 eq "yes") {
@@ -2085,7 +2085,7 @@ index ccaf067..240fb80 100644
      if ($use_openssl eq "auto") {
          $use_openssl = "no";
      }
-@@ -1725,6 +1740,7 @@ if ($use_openssl eq "yes") {
+@@ -1719,6 +1734,7 @@ if ($use_openssl eq "yes") {
          $openssl_dll = File::Spec->catdir($openssl_path, "@dirlist[0]");
      }   
  
@@ -2093,7 +2093,7 @@ index ccaf067..240fb80 100644
      $configcond{"OPENSSL"} = 1;
      $configdefd{"CRYPTO"} = "OPENSSL";
      $configvar{"OPENSSL_PATH"} = "$openssl_path";
-@@ -2296,6 +2312,15 @@ if ($use_aes eq "yes") {
+@@ -2290,6 +2306,15 @@ if ($use_aes eq "yes") {
  }
  
  
@@ -2109,7 +2109,7 @@ index ccaf067..240fb80 100644
  # enable-openssl-hash
  if ($enable_openssl_hash eq "yes") {
      if ($use_openssl eq "no") {
-@@ -3671,6 +3696,7 @@ exit 0;
+@@ -3665,6 +3690,7 @@ exit 0;
  #  --enable-developer partially supported
  #  --enable-newstats (9.9/9.9sub only)
  #  --enable-native-pkcs11 supported
@@ -2118,5 +2118,5 @@ index ccaf067..240fb80 100644
  #  --enable-openssl-hash supported
  #  --enable-threads included without a way to disable it
 -- 
-2.20.1
+2.21.0
 
diff --git a/bind.spec b/bind.spec
index b028d81..b5f911c 100644
--- a/bind.spec
+++ b/bind.spec
@@ -58,8 +58,8 @@
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.11.13
-Release:  3%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Version:  9.11.14
+Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -157,10 +157,6 @@ Patch173:bind-9.11-rh1732883.patch
 Patch174:bind-9.11-json-c.patch
 Patch175:bind-9.11-fips-disable.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=1736762
-Patch176: bind-9.11-rh1736762-1.patch
-Patch177: bind-9.11-rh1736762-2.patch
-Patch178: bind-9.11-rh1736762-3.patch
-Patch179: bind-9.11-rh1736762-4.patch
 Patch180: bind-9.11-rh1736762-5.patch
 
 # SDB patches
@@ -546,10 +542,6 @@ are used for building ISC DHCP.
 %patch173 -p1 -b .rh1732883
 %patch174 -p1 -b .json-c
 %patch175 -p1 -b .rh1709553
-%patch176 -p1 -b .rh1736762-1
-%patch177 -p1 -b .rh1736762-2
-%patch178 -p1 -b .rh1736762-3
-%patch179 -p1 -b .rh1736762-4
 %patch180 -p1 -b .rh1736762-5
 
 mkdir lib/dns/tests/testdata/dstrandom
@@ -1568,6 +1560,9 @@ fi;
 
 
 %changelog
+* Thu Dec 19 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.14-1
+- Update to 9.11.14
+
 * Mon Dec 02 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.13-3
 - Backport few thread safety related fixed from upstream (#1736762)
 
diff --git a/sources b/sources
index d213c25..d7c9b81 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.11.13.tar.gz) = 6e5289ff231b8d7d2f02ae02a1cf43abff3e507e1d96d8ec002dc71097fc77dc5514762ff1ea5918159c88319b1d5eed78c6dc1a7835173db234d4ee887644bc
-SHA512 (bind-9.11.13.tar.gz.asc) = 5b32adee7d45cdd2921126e898824839f6a0a5574c0ae5a441fc7df78681ebf872a276d6e434e8043cf9ec504f57c2b8fdf79fdb141e32dac5c4fa57c18d52f4
+SHA512 (bind-9.11.14.tar.gz) = fc7729e780e44c3c4e50059032fdae2af3d0e07b492b5088b2fefc15354829d3c9a83fab4f2ecaa9323cd7a37b1f7eb94890c149ba1df5c4fbea7a145095cbe9
+SHA512 (bind-9.11.14.tar.gz.asc) = fd28a1ebd4adf8c2854de434cc6f5f4d47d982eaad73fbb42dce8df97f7b069feb6e7c374178e203a07fff83f2cd021dfd10fb77dd6e8c5201ee4d299df98b89

From 22bb34a78f7ca3e570804eed1385728d3c4a344b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 19 Dec 2019 19:20:36 +0100
Subject: [PATCH 53/55] Include more Thread Sanitizer changes

Fix as much race conditions as possible.
---
 bind-9.11-rh1736762-6.patch | 157 ++++++++++++++++++++++++++++++++++++
 bind-9.11-rh1736762-7.patch |  77 ++++++++++++++++++
 bind-9.11-rh1736762-8.patch |  38 +++++++++
 bind.spec                   |  11 ++-
 4 files changed, 282 insertions(+), 1 deletion(-)
 create mode 100644 bind-9.11-rh1736762-6.patch
 create mode 100644 bind-9.11-rh1736762-7.patch
 create mode 100644 bind-9.11-rh1736762-8.patch

diff --git a/bind-9.11-rh1736762-6.patch b/bind-9.11-rh1736762-6.patch
new file mode 100644
index 0000000..550c617
--- /dev/null
+++ b/bind-9.11-rh1736762-6.patch
@@ -0,0 +1,157 @@
+From c163f23146d03c91f13162b03f90b72f1941cf30 Mon Sep 17 00:00:00 2001
+From: Mark Andrews <marka@isc.org>
+Date: Thu, 12 Dec 2019 20:41:44 +1100
+Subject: [PATCH] give zspill its own lock
+
+(cherry picked from commit a52189e8e67a20097539fe3e6f7da4e4c01dc340)
+---
+ lib/dns/resolver.c | 45 +++++++++++++++++++++++++++++----------------
+ 1 file changed, 29 insertions(+), 16 deletions(-)
+
+diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
+index 8db9845..62a1ae5 100644
+--- a/lib/dns/resolver.c
++++ b/lib/dns/resolver.c
+@@ -459,20 +459,21 @@ struct dns_resolver {
+ 	isc_mutex_t			lock;
+ 	isc_mutex_t			nlock;
+ 	isc_mutex_t			primelock;
++	isc_mutex_t			zspill_lock;
+ 	dns_rdataclass_t		rdclass;
+ 	isc_socketmgr_t *		socketmgr;
+ 	isc_timermgr_t *		timermgr;
+ 	isc_taskmgr_t *			taskmgr;
+ 	dns_view_t *			view;
+-	bool			frozen;
++	bool				frozen;
+ 	unsigned int			options;
+ 	dns_dispatchmgr_t *		dispatchmgr;
+ 	dns_dispatchset_t *		dispatches4;
+-	bool			exclusivev4;
++	bool				exclusivev4;
+ 	dns_dispatchset_t *		dispatches6;
+ 	isc_dscp_t			querydscp4;
+ 	isc_dscp_t			querydscp6;
+-	bool			exclusivev6;
++	bool				exclusivev6;
+ 	unsigned int			nbuckets;
+ 	fctxbucket_t *			buckets;
+ 	zonebucket_t *			dbuckets;
+@@ -491,20 +492,22 @@ struct dns_resolver {
+ 	unsigned int			spillatmax;
+ 	unsigned int			spillatmin;
+ 	isc_timer_t *			spillattimer;
+-	bool			zero_no_soa_ttl;
++	bool				zero_no_soa_ttl;
+ 	unsigned int			query_timeout;
+ 	unsigned int			maxdepth;
+ 	unsigned int			maxqueries;
+ 	isc_result_t			quotaresp[2];
+ 
++	/* Locked by zspill_lock. */
++	unsigned int			zspill;		/* fetches-per-zone */
++
+ 	/* Locked by lock. */
+ 	unsigned int			references;
+-	bool			exiting;
++	bool				exiting;
+ 	isc_eventlist_t			whenshutdown;
+ 	unsigned int			activebuckets;
+-	bool			priming;
++	bool				priming;
+ 	unsigned int			spillat;	/* clients-per-query */
+-	unsigned int			zspill;		/* fetches-per-zone */
+ 
+ 	dns_badcache_t  * 		badcache;	 /* Bad cache. */
+ 
+@@ -1252,7 +1255,7 @@ fcount_incr(fetchctx_t *fctx, bool force) {
+ 	isc_result_t result = ISC_R_SUCCESS;
+ 	zonebucket_t *dbucket;
+ 	fctxcount_t *counter;
+-	unsigned int bucketnum, spill;
++	unsigned int bucketnum;
+ 
+ 	REQUIRE(fctx != NULL);
+ 	REQUIRE(fctx->res != NULL);
+@@ -1261,10 +1264,6 @@ fcount_incr(fetchctx_t *fctx, bool force) {
+ 	bucketnum = dns_name_fullhash(&fctx->domain, false)
+ 			% RES_DOMAIN_BUCKETS;
+ 
+-	LOCK(&fctx->res->lock);
+-	spill = fctx->res->zspill;
+-	UNLOCK(&fctx->res->lock);
+-
+ 	dbucket = &fctx->res->dbuckets[bucketnum];
+ 
+ 	LOCK(&dbucket->lock);
+@@ -1292,6 +1291,12 @@ fcount_incr(fetchctx_t *fctx, bool force) {
+ 			ISC_LIST_APPEND(dbucket->list, counter, link);
+ 		}
+ 	} else {
++		unsigned int spill;
++
++		LOCK(&fctx->res->zspill_lock);
++		spill = fctx->res->zspill;
++		UNLOCK(&fctx->res->zspill_lock);
++
+ 		if (!force && spill != 0 && counter->count >= spill) {
+ 			counter->dropped++;
+ 			fcount_logspill(fctx, counter);
+@@ -8807,6 +8812,7 @@ destroy(dns_resolver_t *res) {
+ 
+ 	INSIST(res->nfctx == 0);
+ 
++	DESTROYLOCK(&res->zspill_lock);
+ 	DESTROYLOCK(&res->primelock);
+ 	DESTROYLOCK(&res->nlock);
+ 	DESTROYLOCK(&res->lock);
+@@ -9083,10 +9089,14 @@ dns_resolver_create(dns_view_t *view,
+ 	if (result != ISC_R_SUCCESS)
+ 		goto cleanup_nlock;
+ 
++	result = isc_mutex_init(&res->zspill_lock);
++	if (result != ISC_R_SUCCESS)
++		goto cleanup_primelock;
++
+ 	task = NULL;
+ 	result = isc_task_create(taskmgr, 0, &task);
+ 	if (result != ISC_R_SUCCESS)
+-		goto cleanup_primelock;
++		goto cleanup_zspill_lock;
+ 	isc_task_setname(task, "resolver_task", NULL);
+ 
+ 	result = isc_timer_create(timermgr, isc_timertype_inactive, NULL, NULL,
+@@ -9094,7 +9104,7 @@ dns_resolver_create(dns_view_t *view,
+ 				  &res->spillattimer);
+ 	isc_task_detach(&task);
+ 	if (result != ISC_R_SUCCESS)
+-		goto cleanup_primelock;
++		goto cleanup_zspill_lock;
+ 
+ #if USE_ALGLOCK
+ 	result = isc_rwlock_init(&res->alglock, 0, 0);
+@@ -9127,6 +9137,9 @@ dns_resolver_create(dns_view_t *view,
+ 	isc_timer_detach(&res->spillattimer);
+ #endif
+ 
++ cleanup_zspill_lock:
++	DESTROYLOCK(&res->zspill_lock);
++
+  cleanup_primelock:
+ 	DESTROYLOCK(&res->primelock);
+ 
+@@ -10269,9 +10282,9 @@ dns_resolver_setfetchesperzone(dns_resolver_t *resolver, uint32_t clients)
+ {
+ 	REQUIRE(VALID_RESOLVER(resolver));
+ 
+-	LOCK(&resolver->lock);
++	LOCK(&resolver->zspill_lock);
+ 	resolver->zspill = clients;
+-	UNLOCK(&resolver->lock);
++	UNLOCK(&resolver->zspill_lock);
+ }
+ 
+ 
+-- 
+2.21.0
+
diff --git a/bind-9.11-rh1736762-7.patch b/bind-9.11-rh1736762-7.patch
new file mode 100644
index 0000000..38617a2
--- /dev/null
+++ b/bind-9.11-rh1736762-7.patch
@@ -0,0 +1,77 @@
+From 23a6775f62deeee63e9f7927be387fecf23a8074 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
+Date: Tue, 10 Dec 2019 10:02:09 +0100
+Subject: [PATCH] Ensure all zone_settimer() calls are done on locked zone
+
+(cherry picked from commit cf48e8eb326f824170f2069e5d5c33992b1783a4)
+(cherry picked from commit 3bac7e98074643ff62582545e5840e4195517b07)
+---
+ lib/dns/zone.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/lib/dns/zone.c b/lib/dns/zone.c
+index e8cff77588..db837aae50 100644
+--- a/lib/dns/zone.c
++++ b/lib/dns/zone.c
+@@ -10291,7 +10291,9 @@ zone_maintenance(dns_zone_t *zone) {
+ 	default:
+ 		break;
+ 	}
++	LOCK_ZONE(zone);
+ 	zone_settimer(zone, &now);
++	UNLOCK_ZONE(zone);
+ }
+ 
+ void
+@@ -13081,6 +13083,7 @@ zone_settimer(dns_zone_t *zone, isc_time_t *now) {
+ 	isc_result_t result;
+ 
+ 	REQUIRE(DNS_ZONE_VALID(zone));
++	REQUIRE(LOCKED_ZONE(zone));
+ 	ENTER;
+ 
+ 	if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_EXITING))
+@@ -18405,6 +18408,7 @@ zone_rekey(dns_zone_t *zone) {
+ 		UNLOCK_ZONE(zone);
+ 	}
+ 
++	LOCK_ZONE(zone);
+ 	isc_time_settoepoch(&zone->refreshkeytime);
+ 
+ 	/*
+@@ -18416,11 +18420,9 @@ zone_rekey(dns_zone_t *zone) {
+ 		isc_time_t timethen;
+ 		isc_stdtime_t then;
+ 
+-		LOCK_ZONE(zone);
+ 		DNS_ZONE_TIME_ADD(&timenow, zone->refreshkeyinterval,
+ 				  &timethen);
+ 		zone->refreshkeytime = timethen;
+-		UNLOCK_ZONE(zone);
+ 
+ 		for (key = ISC_LIST_HEAD(dnskeys);
+ 		     key != NULL;
+@@ -18431,12 +18433,10 @@ zone_rekey(dns_zone_t *zone) {
+ 				continue;
+ 
+ 			DNS_ZONE_TIME_ADD(&timenow, then - now, &timethen);
+-			LOCK_ZONE(zone);
+ 			if (isc_time_compare(&timethen,
+ 					     &zone->refreshkeytime) < 0) {
+ 				zone->refreshkeytime = timethen;
+ 			}
+-			UNLOCK_ZONE(zone);
+ 		}
+ 
+ 		zone_settimer(zone, &timenow);
+@@ -18444,6 +18444,7 @@ zone_rekey(dns_zone_t *zone) {
+ 		isc_time_formattimestamp(&zone->refreshkeytime, timebuf, 80);
+ 		dns_zone_log(zone, ISC_LOG_INFO, "next key event: %s", timebuf);
+ 	}
++	UNLOCK_ZONE(zone);
+ 
+  done:
+ 	dns_diff_clear(&diff);
+-- 
+2.21.0
+
diff --git a/bind-9.11-rh1736762-8.patch b/bind-9.11-rh1736762-8.patch
new file mode 100644
index 0000000..f04a98a
--- /dev/null
+++ b/bind-9.11-rh1736762-8.patch
@@ -0,0 +1,38 @@
+From 7e844b093b0442bdc5cdc5aefd56fdc05f9be88f Mon Sep 17 00:00:00 2001
+From: Mark Andrews <marka@isc.org>
+Date: Thu, 12 Dec 2019 19:17:39 +1100
+Subject: [PATCH] acquire task lock before calling push_readyq for task->flags
+ access
+
+(cherry picked from commit 7c94d2cd7dfaa3f04cd86ad9ed97e8366a774a4c)
+---
+ lib/isc/task.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/lib/isc/task.c b/lib/isc/task.c
+index 329604a465..f9c4354bd2 100644
+--- a/lib/isc/task.c
++++ b/lib/isc/task.c
+@@ -473,7 +473,9 @@ task_ready(isc__task_t *task) {
+ 	XTRACE("task_ready");
+ 
+ 	LOCK(&manager->lock);
++	LOCK(&task->lock);
+ 	push_readyq(manager, task);
++	UNLOCK(&task->lock);
+ #ifdef USE_WORKER_THREADS
+ 	if (manager->mode == isc_taskmgrmode_normal || has_privilege)
+ 		SIGNAL(&manager->work_available);
+@@ -1263,7 +1265,9 @@ dispatch(isc__taskmgr_t *manager) {
+ 				 * might even hurt rather than help.
+ 				 */
+ #ifdef USE_WORKER_THREADS
++				LOCK(&task->lock);
+ 				push_readyq(manager, task);
++				UNLOCK(&task->lock);
+ #else
+ 				ENQUEUE(new_ready_tasks, task, ready_link);
+ 				if ((task->flags & TASK_F_PRIVILEGED) != 0)
+-- 
+2.21.0
+
diff --git a/bind.spec b/bind.spec
index b5f911c..7a3e462 100644
--- a/bind.spec
+++ b/bind.spec
@@ -59,7 +59,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.11.14
-Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -158,6 +158,9 @@ Patch174:bind-9.11-json-c.patch
 Patch175:bind-9.11-fips-disable.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=1736762
 Patch180: bind-9.11-rh1736762-5.patch
+Patch181: bind-9.11-rh1736762-6.patch
+Patch182: bind-9.11-rh1736762-7.patch
+Patch183: bind-9.11-rh1736762-8.patch
 
 # SDB patches
 Patch11: bind-9.3.2b2-sdbsrc.patch
@@ -543,6 +546,9 @@ are used for building ISC DHCP.
 %patch174 -p1 -b .json-c
 %patch175 -p1 -b .rh1709553
 %patch180 -p1 -b .rh1736762-5
+%patch181 -p1 -b .rh1736762-6
+%patch182 -p1 -b .rh1736762-7
+%patch183 -p1 -b .rh1736762-8
 
 mkdir lib/dns/tests/testdata/dstrandom
 cp -a %{SOURCE50} lib/dns/tests/testdata/dstrandom/random.data
@@ -1560,6 +1566,9 @@ fi;
 
 
 %changelog
+* Thu Dec 19 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.14-2
+- Include more Thread Sanitizer detected changes (#1736762)
+
 * Thu Dec 19 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.14-1
 - Update to 9.11.14
 

From f260be7dd61f0c315d455224674e822adf4d8616 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 19 Dec 2019 19:39:39 +0100
Subject: [PATCH 54/55] Fix oot build

gen would not compile under oot build
---
 bind-9.11-oot-gen.patch | 47 +++++++++++++++++++++++++++++++++++++++++
 bind.spec               |  2 ++
 2 files changed, 49 insertions(+)
 create mode 100644 bind-9.11-oot-gen.patch

diff --git a/bind-9.11-oot-gen.patch b/bind-9.11-oot-gen.patch
new file mode 100644
index 0000000..9a7f991
--- /dev/null
+++ b/bind-9.11-oot-gen.patch
@@ -0,0 +1,47 @@
+From cb654ddde5953cab9dfde7173ea1ed14b51c3727 Mon Sep 17 00:00:00 2001
+From: Mark Andrews <marka@isc.org>
+Date: Sun, 22 Dec 2019 21:51:21 +0000
+Subject: [PATCH] Merge branch
+ '1530-lib-dns-gen-c-29-26-fatal-error-isc-platform-h-no-such-file-or-directory-v9_11'
+ into 'v9_11'
+
+Resolve "lib/dns/gen.c:29:26: fatal error: isc/platform.h: No such file or directory"
+
+See merge request isc-projects/bind9!2794
+
+(cherry picked from commit 335ab375d6a0227fb362722acad22f2a5b75d8b7)
+---
+ lib/dns/gen.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/lib/dns/gen.c b/lib/dns/gen.c
+index 81bc7ada1d..5fbdc3bfd3 100644
+--- a/lib/dns/gen.c
++++ b/lib/dns/gen.c
+@@ -26,18 +26,18 @@
+ 
+ #include <sys/types.h>
+ 
+-#include <isc/platform.h>
+-
+ #include <ctype.h>
++#include <errno.h>
+ #include <limits.h>
+ #include <stdint.h>
+-#include <stdlib.h>
+ #include <stdio.h>
+ #include <stdlib.h>
+ #include <string.h>
+ #include <time.h>
+-#include <errno.h>
+-#include <limits.h>
++
++#ifndef PATH_MAX
++#define PATH_MAX 1024
++#endif
+ 
+ #ifdef WIN32
+ #include "gen-win32.h"
+-- 
+2.21.0
+
diff --git a/bind.spec b/bind.spec
index 7a3e462..6937e14 100644
--- a/bind.spec
+++ b/bind.spec
@@ -161,6 +161,7 @@ Patch180: bind-9.11-rh1736762-5.patch
 Patch181: bind-9.11-rh1736762-6.patch
 Patch182: bind-9.11-rh1736762-7.patch
 Patch183: bind-9.11-rh1736762-8.patch
+Patch184: bind-9.11-oot-gen.patch
 
 # SDB patches
 Patch11: bind-9.3.2b2-sdbsrc.patch
@@ -549,6 +550,7 @@ are used for building ISC DHCP.
 %patch181 -p1 -b .rh1736762-6
 %patch182 -p1 -b .rh1736762-7
 %patch183 -p1 -b .rh1736762-8
+%patch184 -p1 -b .oot-gen
 
 mkdir lib/dns/tests/testdata/dstrandom
 cp -a %{SOURCE50} lib/dns/tests/testdata/dstrandom/random.data

From 389eeac3cd62be479259f59a27e1b516daf43909 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 14 Apr 2020 14:14:40 +0200
Subject: [PATCH 55/55] Use CI from master branch

Use just the same tests.yml as master. Do not use whole history.
---
 tests/tests.yml | 23 ++++-------------------
 1 file changed, 4 insertions(+), 19 deletions(-)

diff --git a/tests/tests.yml b/tests/tests.yml
index 15360ed..c3d8fcd 100644
--- a/tests/tests.yml
+++ b/tests/tests.yml
@@ -5,22 +5,7 @@
   - role: standard-test-beakerlib
     tags:
     - classic
-    tests:
-    - Master-server-chrooted
-    - Master-server-not-chrooted
-    - Run-internal-BIND-test-suite
-    required_packages:
-    - bind
-    - bind-chroot
-    - bind-sdb-chroot
-    - redhat-lsb
-    - bind-utils
-    - dnf-utils
-    - kyua
-    - bind-devel
-    - perl-Net-DNS
-    - perl-Net-DNS-Nameserver
-    - perl-Time-HiRes
-    - softhsm
-    - bind-pkcs11
-    - bind-pkcs11-utils
+    repositories:
+    - repo: "https://github.com/InfrastructureServices/bind-tests.git"
+      dest: "bind-tests"
+      fmf_filter: "tier: 1"