Update to bind-9.11.4-P2

- Fixes CVE-2018-5740
- Adds root key sentinel mechanism support
- incremental zone transfer limit to prevent journal corruption
- rndc reload memory leak

.gitignore

@@ -75,3 +75,11 @@ bind-9.7.2b1.tar.gz
 /bind-9.11.1-P1.tar.gz
 /bind-9.11.1-P2.tar.gz
 /bind-9.11.1-P3.tar.gz
+/bind-9.11.2-P1.tar.gz
+/bind-9.11.3b1.tar.gz
+/bind-9.11.3.tar.gz
+/config-18.tar.bz2
+/bind-9.11.4rc1.tar.gz
+/bind-9.11.4.tar.gz
+/bind-9.11.4-P1.tar.gz
+/bind-9.11.4-P2.tar.gz

bind-9.10-dist-native-pkcs11.patch

@@ -1,21 +1,23 @@
 diff --git a/bin/Makefile.in b/bin/Makefile.in
-index f3cbed3..7d21984 100644
+index f0c504a..ce7a2da 100644
 --- a/bin/Makefile.in
 +++ b/bin/Makefile.in
-@@ -10,7 +10,7 @@ srcdir =	@srcdir@
+@@ -11,8 +11,8 @@ srcdir =	@srcdir@
  VPATH =		@srcdir@
  top_srcdir =	@top_srcdir@
  
--SUBDIRS =	named rndc dig delv dnssec tools tests nsupdate \
-+SUBDIRS =	named named-pkcs11 rndc dig delv dnssec dnssec-pkcs11 tools tests nsupdate \
- 		check confgen @NZD_TOOLS@ @PYTHON_TOOLS@ @PKCS11_TOOLS@
+-SUBDIRS =	named rndc dig delv dnssec tools nsupdate check confgen \
+-		@NZD_TOOLS@ @PYTHON_TOOLS@ @PKCS11_TOOLS@ tests
++SUBDIRS =	named named-pkcs11 rndc dig delv dnssec dnssec-pkcs11 tools nsupdate \
++		check confgen @NZD_TOOLS@ @PYTHON_TOOLS@ @PKCS11_TOOLS@ tests
  TARGETS =
  
+ @BIND9_MAKE_RULES@
 diff --git a/bin/dnssec-pkcs11/Makefile.in b/bin/dnssec-pkcs11/Makefile.in
-index 8c6627a..0427349 100644
+index 1be1d5f..0f09216 100644
 --- a/bin/dnssec-pkcs11/Makefile.in
 +++ b/bin/dnssec-pkcs11/Makefile.in
-@@ -14,18 +14,18 @@ VERSION=@BIND9_VERSION@
+@@ -17,18 +17,18 @@ VERSION=@BIND9_VERSION@
  
  @BIND9_MAKE_INCLUDES@
  
@@ -41,7 +43,7 @@ index 8c6627a..0427349 100644
  
  DEPLIBS =	${DNSDEPLIBS} ${ISCDEPLIBS}
  
-@@ -34,10 +34,10 @@ LIBS =		${DNSLIBS} ${ISCLIBS} @LIBS@
+@@ -37,10 +37,10 @@ LIBS =		${DNSLIBS} ${ISCLIBS} @LIBS@
  NOSYMLIBS =	${DNSLIBS} ${ISCNOSYMLIBS} @LIBS@
  
  # Alphabetically
@@ -56,7 +58,7 @@ index 8c6627a..0427349 100644
  
  OBJS =		dnssectool.@O@
  
-@@ -58,15 +58,15 @@ MANOBJS =	${MANPAGES} ${HTMLPAGES}
+@@ -61,15 +61,15 @@ MANOBJS =	${MANPAGES} ${HTMLPAGES}
  
  @BIND9_MAKE_RULES@
  
@@ -75,7 +77,7 @@ index 8c6627a..0427349 100644
  	export BASEOBJS="dnssec-keygen.@O@ ${OBJS}"; \
  	${FINALBUILDCMD}
  
-@@ -74,7 +74,7 @@ dnssec-signzone.@O@: dnssec-signzone.c
+@@ -77,7 +77,7 @@ dnssec-signzone.@O@: dnssec-signzone.c
  	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} -DVERSION=\"${VERSION}\" \
  		-c ${srcdir}/dnssec-signzone.c
  
@@ -84,7 +86,7 @@ index 8c6627a..0427349 100644
  	export BASEOBJS="dnssec-signzone.@O@ ${OBJS}"; \
  	${FINALBUILDCMD}
  
-@@ -82,19 +82,19 @@ dnssec-verify.@O@: dnssec-verify.c
+@@ -85,19 +85,19 @@ dnssec-verify.@O@: dnssec-verify.c
  	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} -DVERSION=\"${VERSION}\" \
  		-c ${srcdir}/dnssec-verify.c
  
@@ -108,7 +110,7 @@ index 8c6627a..0427349 100644
  	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \
  	dnssec-importkey.@O@ ${OBJS} ${LIBS}
  
-@@ -105,14 +105,11 @@ docclean manclean maintainer-clean::
+@@ -108,14 +108,11 @@ docclean manclean maintainer-clean::
  
  installdirs:
  	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
@@ -124,10 +126,10 @@ index 8c6627a..0427349 100644
  
  clean distclean::
 diff --git a/bin/dnssec/Makefile.in b/bin/dnssec/Makefile.in
-index 8c6627a..c070881 100644
+index 1be1d5f..fc983bf 100644
 --- a/bin/dnssec/Makefile.in
 +++ b/bin/dnssec/Makefile.in
-@@ -16,7 +16,7 @@ VERSION=@BIND9_VERSION@
+@@ -19,7 +19,7 @@ VERSION=@BIND9_VERSION@
  
  CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} @DST_OPENSSL_INC@
  
@@ -137,10 +139,10 @@ index 8c6627a..c070881 100644
  CWARNINGS =
  
 diff --git a/bin/named-pkcs11/Makefile.in b/bin/named-pkcs11/Makefile.in
-index 903023b..b40303d 100644
+index e1f85a9..2effa69 100644
 --- a/bin/named-pkcs11/Makefile.in
 +++ b/bin/named-pkcs11/Makefile.in
-@@ -36,26 +36,26 @@ DLZDRIVER_INCLUDES =	@DLZ_DRIVER_INCLUDES@
+@@ -43,26 +43,26 @@ DLZDRIVER_INCLUDES =	@DLZ_DRIVER_INCLUDES@
  DLZDRIVER_LIBS =	@DLZ_DRIVER_LIBS@
  
  CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
@@ -174,7 +176,7 @@ index 903023b..b40303d 100644
  LWRESDEPLIBS =	../../lib/lwres/liblwres.@A@
  BIND9DEPLIBS =	../../lib/bind9/libbind9.@A@
  
-@@ -64,15 +64,15 @@ DEPLIBS =	${LWRESDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
+@@ -71,15 +71,15 @@ DEPLIBS =	${LWRESDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
  
  LIBS =		${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
  		${ISCCFGLIBS} ${ISCCCLIBS} ${ISCLIBS} \
@@ -193,7 +195,7 @@ index 903023b..b40303d 100644
  
  GEOIPLINKOBJS = geoip.@O@
  
-@@ -83,8 +83,7 @@ OBJS =		builtin.@O@ client.@O@ config.@O@ control.@O@ \
+@@ -90,8 +90,7 @@ OBJS =		builtin.@O@ client.@O@ config.@O@ control.@O@ \
  		tkeyconf.@O@ tsigconf.@O@ update.@O@ xfrout.@O@ \
  		zoneconf.@O@ \
  		lwaddr.@O@ lwresd.@O@ lwdclient.@O@ lwderror.@O@ lwdgabn.@O@ \
@@ -203,7 +205,7 @@ index 903023b..b40303d 100644
  
  UOBJS =		unix/os.@O@ unix/dlz_dlopen_driver.@O@
  
-@@ -99,8 +98,7 @@ SRCS =		builtin.c client.c config.c control.c \
+@@ -106,8 +105,7 @@ SRCS =		builtin.c client.c config.c control.c \
  		tkeyconf.c tsigconf.c update.c xfrout.c \
  		zoneconf.c \
  		lwaddr.c lwresd.c lwdclient.c lwderror.c lwdgabn.c \
@@ -213,16 +215,25 @@ index 903023b..b40303d 100644
  
  MANPAGES =	named.8 lwresd.8 named.conf.5
  
-@@ -139,7 +137,7 @@ server.@O@: server.c
+@@ -146,14 +144,14 @@ server.@O@: server.c
  		-DPRODUCT=\"${PRODUCT}\" \
  		-DVERSION=\"${VERSION}\" -c ${srcdir}/server.c
  
--named@EXEEXT@: ${OBJS} ${UOBJS} ${DEPLIBS}
-+named-pkcs11@EXEEXT@: ${OBJS} ${UOBJS} ${DEPLIBS}
+-named@EXEEXT@: ${OBJS} ${DEPLIBS}
++named-pkcs11@EXEEXT@: ${OBJS} ${DEPLIBS}
  	export MAKE_SYMTABLE="yes"; \
  	export BASEOBJS="${OBJS} ${UOBJS}"; \
  	${FINALBUILDCMD}
-@@ -166,22 +164,12 @@ statschannel.@O@: bind9.xsl.h
+ 
+-lwresd@EXEEXT@: named@EXEEXT@
++lwresd@EXEEXT@: named-pkcs11@EXEEXT@
+ 	rm -f lwresd@EXEEXT@
+-	@LN@ named@EXEEXT@ lwresd@EXEEXT@
++	@LN@ named-pkcs11@EXEEXT@ lwresd@EXEEXT@
+ 
+ doc man:: ${MANOBJS}
+ 
+@@ -173,22 +171,12 @@ statschannel.@O@: bind9.xsl.h
  
  installdirs:
  	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
@@ -249,10 +260,10 @@ index 903023b..b40303d 100644
  @DLZ_DRIVER_RULES@
  
 diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
-index 903023b..9c14b73 100644
+index e1f85a9..b7493c5 100644
 --- a/bin/named/Makefile.in
 +++ b/bin/named/Makefile.in
-@@ -40,7 +40,7 @@ CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
+@@ -47,7 +47,7 @@ CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
  		${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} ${ISC_INCLUDES} \
  		${DLZDRIVER_INCLUDES} ${DBDRIVER_INCLUDES} @DST_OPENSSL_INC@
  
@@ -262,10 +273,10 @@ index 903023b..9c14b73 100644
  CWARNINGS =
  
 diff --git a/bin/pkcs11/Makefile.in b/bin/pkcs11/Makefile.in
-index d9aa66b..1900e3c 100644
+index ae90616..4bc1256 100644
 --- a/bin/pkcs11/Makefile.in
 +++ b/bin/pkcs11/Makefile.in
-@@ -12,13 +12,13 @@ top_srcdir =	@top_srcdir@
+@@ -15,13 +15,13 @@ top_srcdir =	@top_srcdir@
  
  @BIND9_MAKE_INCLUDES@
  
@@ -283,10 +294,10 @@ index d9aa66b..1900e3c 100644
  DEPLIBS =	${ISCDEPLIBS}
  
 diff --git a/configure.in b/configure.in
-index 0bde24d..6435274 100644
+index 9a1d16d..2f13059 100644
 --- a/configure.in
 +++ b/configure.in
-@@ -1116,12 +1116,14 @@ AC_SUBST(USE_GSSAPI)
+@@ -1164,12 +1164,14 @@ AC_SUBST(USE_GSSAPI)
  AC_SUBST(DST_GSSAPI_INC)
  AC_SUBST(DNS_GSSAPI_LIBS)
  DNS_CRYPTO_LIBS="$DNS_GSSAPI_LIBS $DNS_CRYPTO_LIBS"
@@ -301,7 +312,7 @@ index 0bde24d..6435274 100644
  
  #
  # was --with-randomdev specified?
-@@ -1489,11 +1491,11 @@ fi
+@@ -1554,11 +1556,11 @@ fi
  AC_MSG_CHECKING(for OpenSSL library)
  OPENSSL_WARNING=
  openssldirs="/usr /usr/local /usr/local/ssl /usr/pkg /usr/sfw"
@@ -318,15 +329,15 @@ index 0bde24d..6435274 100644
  
  if test "auto" = "$use_openssl"
  then
-@@ -1506,6 +1508,7 @@ then
+@@ -1571,6 +1573,7 @@ then
  		fi
  	done
  fi
 +CRYPTO_PK11=""
  OPENSSL_ECDSA=""
  OPENSSL_GOST=""
- gosttype="raw"
-@@ -1526,16 +1529,17 @@ case "$with_gost" in
+ OPENSSL_ED25519=""
+@@ -1592,11 +1595,10 @@ case "$with_gost" in
  		;;
  esac
  
@@ -338,8 +349,11 @@ index 0bde24d..6435274 100644
  		DST_OPENSSL_INC=""
 -		CRYPTO="-DPKCS11CRYPTO"
 +		CRYPTO_PK11="-DPKCS11CRYPTO"
- 		OPENSSLGOSTLINKOBJS=""
- 		OPENSSLGOSTLINKSRS=""
+ 		OPENSSLECDSALINKOBJS=""
+ 		OPENSSLECDSALINKSRCS=""
+ 		OPENSSLEDDSALINKOBJS=""
+@@ -1605,7 +1607,9 @@ case "$use_openssl" in
+ 		OPENSSLGOSTLINKSRCS=""
  		OPENSSLLINKOBJS=""
  		OPENSSLLINKSRCS=""
 -		;;
@@ -349,24 +363,24 @@ index 0bde24d..6435274 100644
  	no)
  		AC_MSG_RESULT(no)
  		DST_OPENSSL_INC=""
-@@ -1557,11 +1561,11 @@ case "$use_openssl" in
+@@ -1635,11 +1639,11 @@ case "$use_openssl" in
  If you don't want OpenSSL, use --without-openssl])
  		;;
  	*)
 -		if test "yes" = "$want_native_pkcs11"
 -		then
--                        AC_MSG_RESULT()
+-			AC_MSG_RESULT()
 -			AC_MSG_ERROR([OpenSSL and native PKCS11 cannot be used together.])
 -		fi
-+# 		if test "yes" = "$want_native_pkcs11"
-+# 		then
-+#                         AC_MSG_RESULT()
-+# 			AC_MSG_ERROR([OpenSSL and native PKCS11 cannot be used together.])
-+# 		fi
++		# if test "yes" = "$want_native_pkcs11"
++		# then
++		# 	AC_MSG_RESULT()
++		# 	AC_MSG_ERROR([OpenSSL and native PKCS11 cannot be used together.])
++		# fi
  		if test "yes" = "$use_openssl"
  		then
  			# User did not specify a path - guess it
-@@ -1917,6 +1921,7 @@ AC_SUBST(OPENSSL_ECDSA)
+@@ -2062,6 +2066,7 @@ AC_SUBST(OPENSSL_ED25519)
  AC_SUBST(OPENSSL_GOST)
  
  DNS_CRYPTO_LIBS="$DNS_CRYPTO_LIBS $DST_OPENSSL_LIBS"
@@ -374,15 +388,15 @@ index 0bde24d..6435274 100644
  
  ISC_PLATFORM_WANTAES="#undef ISC_PLATFORM_WANTAES"
  if test "yes" = "$with_aes"
-@@ -2212,6 +2217,7 @@ esac
+@@ -2381,6 +2386,7 @@ esac
  AC_SUBST(PKCS11LINKOBJS)
  AC_SUBST(PKCS11LINKSRCS)
  AC_SUBST(CRYPTO)
 +AC_SUBST(CRYPTO_PK11)
  AC_SUBST(PKCS11_ECDSA)
  AC_SUBST(PKCS11_GOST)
- AC_SUBST(PKCS11_TEST)
-@@ -5114,8 +5120,11 @@ AC_CONFIG_FILES([
+ AC_SUBST(PKCS11_ED25519)
+@@ -5434,8 +5440,11 @@ AC_CONFIG_FILES([
  	bin/delv/Makefile
  	bin/dig/Makefile
  	bin/dnssec/Makefile
@@ -394,7 +408,7 @@ index 0bde24d..6435274 100644
  	bin/nsupdate/Makefile
  	bin/pkcs11/Makefile
  	bin/python/Makefile
-@@ -5216,6 +5225,10 @@ AC_CONFIG_FILES([
+@@ -5509,6 +5518,10 @@ AC_CONFIG_FILES([
  	lib/dns/include/dns/Makefile
  	lib/dns/include/dst/Makefile
  	lib/dns/tests/Makefile
@@ -405,7 +419,7 @@ index 0bde24d..6435274 100644
  	lib/irs/Makefile
  	lib/irs/include/Makefile
  	lib/irs/include/irs/Makefile
-@@ -5240,6 +5253,24 @@ AC_CONFIG_FILES([
+@@ -5533,6 +5546,24 @@ AC_CONFIG_FILES([
  	lib/isc/unix/include/Makefile
  	lib/isc/unix/include/isc/Makefile
  	lib/isc/unix/include/pkcs11/Makefile
@@ -431,23 +445,23 @@ index 0bde24d..6435274 100644
  	lib/isccc/include/Makefile
  	lib/isccc/include/isccc/Makefile
 diff --git a/lib/Makefile.in b/lib/Makefile.in
-index 318450c..87cde21 100644
+index 81270a0..bcb5312 100644
 --- a/lib/Makefile.in
 +++ b/lib/Makefile.in
-@@ -14,7 +14,7 @@ top_srcdir =	@top_srcdir@
+@@ -15,7 +15,7 @@ top_srcdir =	@top_srcdir@
  # Attempt to disable parallel processing.
  .NOTPARALLEL:
  .NO_PARALLEL:
--SUBDIRS =	isc isccc dns isccfg bind9 lwres irs tests samples
-+SUBDIRS =	isc isc-pkcs11 isccc dns dns-pkcs11 isccfg bind9 lwres irs tests samples
+-SUBDIRS =	isc isccc dns isccfg bind9 lwres irs samples
++SUBDIRS =	isc isc-pkcs11 isccc dns dns-pkcs11 isccfg bind9 lwres irs samples
  TARGETS =
  
  @BIND9_MAKE_RULES@
 diff --git a/lib/dns-pkcs11/Makefile.in b/lib/dns-pkcs11/Makefile.in
-index a22b721..a38960b 100644
+index 4a8549e..6a19906 100644
 --- a/lib/dns-pkcs11/Makefile.in
 +++ b/lib/dns-pkcs11/Makefile.in
-@@ -23,16 +23,16 @@ VERSION=@BIND9_VERSION@
+@@ -26,16 +26,16 @@ VERSION=@BIND9_VERSION@
  
  USE_ISC_SPNEGO = @USE_ISC_SPNEGO@
  
@@ -469,7 +483,7 @@ index a22b721..a38960b 100644
  
  LIBS =		@LIBS@
  
-@@ -136,30 +136,30 @@ version.@O@: version.c
+@@ -146,15 +146,15 @@ version.@O@: version.c
  		-DLIBAGE=${LIBAGE} \
  		-c ${srcdir}/version.c
  
@@ -487,10 +501,23 @@ index a22b721..a38960b 100644
 -		${OBJS} ${ISCLIBS} @DNS_CRYPTO_LIBS@ ${LIBS}
 +		${OBJS} ${ISCLIBS} @DNS_CRYPTO_PK11_LIBS@ ${LIBS}
  
--timestamp: libdns.@A@
-+timestamp: libdns-pkcs11.@A@
+ include: gen
+ 	${MAKE} include/dns/enumtype.h
+@@ -180,25 +180,25 @@ code.h:	gen
+ 	./gen -s ${srcdir} > code.h || { rm -f $@ ; exit 1; }
+ 
+ gen: gen.c
+-	${BUILD_CC} ${BUILD_CFLAGS} -I${top_srcdir}/lib/isc/include \
++	${BUILD_CC} ${BUILD_CFLAGS} -I${top_srcdir}/lib/isc-pkcs11/include \
+ 	${BUILD_CPPFLAGS} ${BUILD_LDFLAGS} -o $@ ${srcdir}/gen.c ${BUILD_LIBS}
+ 
+-timestamp: include libdns.@A@
++timestamp: include libdns-pkcs11.@A@
  	touch timestamp
  
+-testdirs: libdns.@A@
++testdirs: libdns-pkcs11.@A@
+ 
  installdirs:
  	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${libdir}
  
@@ -508,31 +535,22 @@ index a22b721..a38960b 100644
  	rm -f gen code.h include/dns/enumtype.h include/dns/enumclass.h
  	rm -f include/dns/rdatastruct.h
  	rm -f dnstap.pb-c.c dnstap.pb-c.h include/dns/dnstap.pb-c.h
-@@ -191,7 +191,7 @@ code.h:	gen
- 	./gen -s ${srcdir} > code.h || { rm -f $@ ; exit 1; }
- 
- gen: gen.c
--	${BUILD_CC} ${BUILD_CFLAGS} -I${top_srcdir}/lib/isc/include \
-+	${BUILD_CC} ${BUILD_CFLAGS} -I${top_srcdir}/lib/isc-pkcs11/include \
- 	${BUILD_CPPFLAGS} ${BUILD_LDFLAGS} -o $@ ${srcdir}/gen.c ${BUILD_LIBS}
- 
- rbtdb64.@O@: rbtdb64.c rbtdb.c
 diff --git a/lib/isc-pkcs11/Makefile.in b/lib/isc-pkcs11/Makefile.in
-index e5c4db0..c7a623c 100644
+index ba53ef1..d1f1771 100644
 --- a/lib/isc-pkcs11/Makefile.in
 +++ b/lib/isc-pkcs11/Makefile.in
-@@ -20,8 +20,8 @@ CINCLUDES =	-I${srcdir}/unix/include \
+@@ -23,8 +23,8 @@ CINCLUDES =	-I${srcdir}/unix/include \
  		-I${srcdir}/@ISC_THREAD_DIR@/include \
  		-I${srcdir}/@ISC_ARCH_DIR@/include \
  		-I./include \
--		-I${srcdir}/include @ISC_OPENSSL_INC@ ${DNS_INCLUDES}
+-		-I${srcdir}/include ${DNS_INCLUDES} @ISC_OPENSSL_INC@
 -CDEFINES =	@CRYPTO@ -DPK11_LIB_LOCATION=\"${PROVIDER}\"
 +		-I${srcdir}/include ${DNS_PKCS11_INCLUDES}
 +CDEFINES =	@CRYPTO_PK11@ -DPK11_LIB_LOCATION=\"${PROVIDER}\"
  CWARNINGS =
  
  # Alphabetically
-@@ -104,38 +104,38 @@ version.@O@: version.c
+@@ -107,40 +107,40 @@ version.@O@: version.c
  		-DLIBAGE=${LIBAGE} \
  		-c ${srcdir}/version.c
  
@@ -566,6 +584,9 @@ index e5c4db0..c7a623c 100644
 +timestamp: libisc-pkcs11.@A@ libisc-pkcs11-nosymtbl.@A@
  	touch timestamp
  
+-testdirs: libisc.@A@ libisc-nosymtbl.@A@
++testdirs: libisc-pkcs11.@A@ libisc-pkcs11-nosymtbl.@A@
+ 
  installdirs:
  	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${libdir}
  
@@ -583,10 +604,10 @@ index e5c4db0..c7a623c 100644
 +	rm -f libisc-pkcs11.@A@ libisc-pkcs11-nosymtbl.@A@ libisc-pkcs11.la \
 +	libisc-pkcs11-nosymtbl.la timestamp
 diff --git a/make/includes.in b/make/includes.in
-index f41e3cd..b97534c 100644
+index fa86ad1..3cfbe9f 100644
 --- a/make/includes.in
 +++ b/make/includes.in
-@@ -40,3 +40,13 @@ BIND9_INCLUDES = @BIND9_BIND9_BUILDINCLUDE@ \
+@@ -43,3 +43,13 @@ BIND9_INCLUDES = @BIND9_BIND9_BUILDINCLUDE@ \
  
  TEST_INCLUDES = \
  	-I${top_srcdir}/lib/tests/include

bind-9.10-sdb.patch

@@ -1,23 +1,23 @@
 diff --git a/bin/Makefile.in b/bin/Makefile.in
-index 7d21984..015ff45 100644
+index ce7a2da..4e6a824 100644
 --- a/bin/Makefile.in
 +++ b/bin/Makefile.in
-@@ -10,8 +10,8 @@ srcdir =	@srcdir@
+@@ -11,8 +11,8 @@ srcdir =	@srcdir@
  VPATH =		@srcdir@
  top_srcdir =	@top_srcdir@
  
--SUBDIRS =	named named-pkcs11 rndc dig delv dnssec dnssec-pkcs11 tools tests nsupdate \
--		check confgen @NZD_TOOLS@ @PYTHON_TOOLS@ @PKCS11_TOOLS@
-+SUBDIRS =	named named-sdb named-pkcs11 rndc dig delv dnssec dnssec-pkcs11 tools tests nsupdate \
-+		check confgen @NZD_TOOLS@ @PYTHON_TOOLS@ @PKCS11_TOOLS@ sdb_tools
+-SUBDIRS =	named named-pkcs11 rndc dig delv dnssec dnssec-pkcs11 tools nsupdate \
+-		check confgen @NZD_TOOLS@ @PYTHON_TOOLS@ @PKCS11_TOOLS@ tests
++SUBDIRS =	named named-sdb named-pkcs11 rndc dig delv dnssec dnssec-pkcs11 tools nsupdate \
++		check confgen @NZD_TOOLS@ @PYTHON_TOOLS@ @PKCS11_TOOLS@ sdb_tools tests
  TARGETS =
  
  @BIND9_MAKE_RULES@
 diff --git a/bin/named-sdb/Makefile.in b/bin/named-sdb/Makefile.in
-index 9c14b73..36e7916 100644
+index b7493c5..93f9a33 100644
 --- a/bin/named-sdb/Makefile.in
 +++ b/bin/named-sdb/Makefile.in
-@@ -23,10 +23,10 @@ VERSION=@BIND9_VERSION@
+@@ -30,10 +30,10 @@ VERSION=@BIND9_VERSION@
  #
  # Add database drivers here.
  #
@@ -31,7 +31,7 @@ index 9c14b73..36e7916 100644
  
  DLZ_DRIVER_DIR =	${top_srcdir}/contrib/dlz/drivers
  
-@@ -72,7 +72,7 @@ NOSYMLIBS =	${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
+@@ -79,7 +79,7 @@ NOSYMLIBS =	${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
  
  SUBDIRS =	unix
  
@@ -40,16 +40,16 @@ index 9c14b73..36e7916 100644
  
  GEOIPLINKOBJS = geoip.@O@
  
-@@ -139,7 +139,7 @@ server.@O@: server.c
+@@ -146,7 +146,7 @@ server.@O@: server.c
  		-DPRODUCT=\"${PRODUCT}\" \
  		-DVERSION=\"${VERSION}\" -c ${srcdir}/server.c
  
--named@EXEEXT@: ${OBJS} ${UOBJS} ${DEPLIBS}
-+named-sdb@EXEEXT@: ${OBJS} ${UOBJS} ${DEPLIBS}
+-named@EXEEXT@: ${OBJS} ${DEPLIBS}
++named-sdb@EXEEXT@: ${OBJS} ${DEPLIBS}
  	export MAKE_SYMTABLE="yes"; \
  	export BASEOBJS="${OBJS} ${UOBJS}"; \
  	${FINALBUILDCMD}
-@@ -166,22 +166,12 @@ statschannel.@O@: bind9.xsl.h
+@@ -173,22 +173,12 @@ statschannel.@O@: bind9.xsl.h
  
  installdirs:
  	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
@@ -76,10 +76,10 @@ index 9c14b73..36e7916 100644
  @DLZ_DRIVER_RULES@
  
 diff --git a/bin/named-sdb/main.c b/bin/named-sdb/main.c
-index 00002a9..cb9b5f5 100644
+index 1227ea9..febbdf5 100644
 --- a/bin/named-sdb/main.c
 +++ b/bin/named-sdb/main.c
-@@ -88,6 +88,10 @@
+@@ -91,6 +91,10 @@
   * Include header files for database drivers here.
   */
  /* #include "xxdb.h" */
@@ -90,7 +90,7 @@ index 00002a9..cb9b5f5 100644
  
  #ifdef CONTRIB_DLZ
  /*
-@@ -1052,6 +1056,11 @@ setup(void) {
+@@ -1061,6 +1065,11 @@ setup(void) {
  		ns_main_earlyfatal("isc_app_start() failed: %s",
  				   isc_result_totext(result));
  
@@ -102,7 +102,7 @@ index 00002a9..cb9b5f5 100644
  	isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
  		      ISC_LOG_NOTICE, "starting %s %s%s%s <id:%s>",
  		      ns_g_product, ns_g_version,
-@@ -1173,6 +1182,75 @@ setup(void) {
+@@ -1182,6 +1191,75 @@ setup(void) {
  				   isc_result_totext(result));
  #endif
  
@@ -178,7 +178,7 @@ index 00002a9..cb9b5f5 100644
  	ns_server_create(ns_g_mctx, &ns_g_server);
  
  #ifdef HAVE_LIBSECCOMP
-@@ -1215,6 +1293,11 @@ cleanup(void) {
+@@ -1224,6 +1302,11 @@ cleanup(void) {
  
  	dns_name_destroy();
  
@@ -191,10 +191,10 @@ index 00002a9..cb9b5f5 100644
  		      ISC_LOG_NOTICE, "exiting");
  	ns_log_shutdown();
 diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
-index 9c14b73..08318a2 100644
+index b7493c5..8231d24 100644
 --- a/bin/named/Makefile.in
 +++ b/bin/named/Makefile.in
-@@ -38,9 +38,9 @@ DLZDRIVER_LIBS =	@DLZ_DRIVER_LIBS@
+@@ -45,9 +45,9 @@ DLZDRIVER_LIBS =	@DLZ_DRIVER_LIBS@
  CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
  		${LWRES_INCLUDES} ${DNS_INCLUDES} ${BIND9_INCLUDES} \
  		${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} ${ISC_INCLUDES} \
@@ -206,7 +206,7 @@ index 9c14b73..08318a2 100644
  
  CWARNINGS =
  
-@@ -64,11 +64,11 @@ DEPLIBS =	${LWRESDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
+@@ -71,11 +71,11 @@ DEPLIBS =	${LWRESDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
  
  LIBS =		${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
  		${ISCCFGLIBS} ${ISCCCLIBS} ${ISCLIBS} \
@@ -220,7 +220,7 @@ index 9c14b73..08318a2 100644
  
  SUBDIRS =	unix
  
-@@ -83,8 +83,7 @@ OBJS =		builtin.@O@ client.@O@ config.@O@ control.@O@ \
+@@ -90,8 +90,7 @@ OBJS =		builtin.@O@ client.@O@ config.@O@ control.@O@ \
  		tkeyconf.@O@ tsigconf.@O@ update.@O@ xfrout.@O@ \
  		zoneconf.@O@ \
  		lwaddr.@O@ lwresd.@O@ lwdclient.@O@ lwderror.@O@ lwdgabn.@O@ \
@@ -230,7 +230,7 @@ index 9c14b73..08318a2 100644
  
  UOBJS =		unix/os.@O@ unix/dlz_dlopen_driver.@O@
  
-@@ -99,8 +98,7 @@ SRCS =		builtin.c client.c config.c control.c \
+@@ -106,8 +105,7 @@ SRCS =		builtin.c client.c config.c control.c \
  		tkeyconf.c tsigconf.c update.c xfrout.c \
  		zoneconf.c \
  		lwaddr.c lwresd.c lwdclient.c lwderror.c lwdgabn.c \
@@ -240,7 +240,7 @@ index 9c14b73..08318a2 100644
  
  MANPAGES =	named.8 lwresd.8 named.conf.5
  
-@@ -183,7 +181,5 @@ uninstall::
+@@ -190,7 +188,5 @@ uninstall::
  	rm -f ${DESTDIR}${sbindir}/lwresd@EXEEXT@
  	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/named@EXEEXT@
  
@@ -284,10 +284,10 @@ index c7e0868..95ab742 100644
 +	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zone2sqlite@EXEEXT@ ${DESTDIR}${sbindir}
  	${INSTALL_DATA} ${srcdir}/zone2ldap.1 ${DESTDIR}${mandir}/man1/zone2ldap.1
 diff --git a/configure.in b/configure.in
-index 6435274..5e614a7 100644
+index 62536a6..f571a4f 100644
 --- a/configure.in
 +++ b/configure.in
-@@ -5125,6 +5125,8 @@ AC_CONFIG_FILES([
+@@ -5445,6 +5445,8 @@ AC_CONFIG_FILES([
  	bin/named/unix/Makefile
  	bin/named-pkcs11/Makefile
  	bin/named-pkcs11/unix/Makefile
@@ -296,11 +296,11 @@ index 6435274..5e614a7 100644
  	bin/nsupdate/Makefile
  	bin/pkcs11/Makefile
  	bin/python/Makefile
-@@ -5149,6 +5151,7 @@ AC_CONFIG_FILES([
+@@ -5469,6 +5471,7 @@ AC_CONFIG_FILES([
  	bin/python/isc/tests/dnskey_test.py
  	bin/python/isc/tests/policy_test.py
  	bin/rndc/Makefile
 +	bin/sdb_tools/Makefile
  	bin/tests/Makefile
- 	bin/tests/atomic/Makefile
- 	bin/tests/db/Makefile
+ 	bin/tests/headerdep_test.sh
+ 	bin/tests/optional/Makefile

bind-9.11-dlz-mysql-modules.patch

@@ -1,86 +0,0 @@
-diff --git a/configure.in b/configure.in
-index 0bde24d..3272e8e 100644
---- a/configure.in
-+++ b/configure.in
-@@ -4813,6 +4813,8 @@ DLZ_DRIVER_LIBS=""
- DLZ_DRIVER_SRCS=""
- DLZ_DRIVER_OBJS=""
- DLZ_SYSTEM_TEST=""
-+DLZ_DRIVER_MYSQL_INCLUDES=""
-+DLZ_DRIVER_MYSQL_LIBS=""
- 
- # 
- # Configure support for building a shared library object
-@@ -4935,7 +4937,9 @@ if test -n "$CONTRIB_DLZ"
- then
- 	AC_MSG_RESULT(yes)
- 	DLZ_DRIVER_RULES=contrib/dlz/drivers/rules
--	AC_CONFIG_FILES([$DLZ_DRIVER_RULES])
-+	AC_CONFIG_FILES([$DLZ_DRIVER_RULES
-+		contrib/dlz/modules/mysql/Makefile
-+		contrib/dlz/modules/mysqldyn/Makefile])
- else
- 	AC_MSG_RESULT(no)
- 	DLZ_DRIVER_RULES=/dev/null
-@@ -4947,6 +4951,8 @@ AC_SUBST(DLZ_DRIVER_LIBS)
- AC_SUBST(DLZ_DRIVER_SRCS)
- AC_SUBST(DLZ_DRIVER_OBJS)
- AC_SUBST(DLZ_SYSTEM_TEST)
-+AC_SUBST(DLZ_DRIVER_MYSQL_INCLUDES)
-+AC_SUBST(DLZ_DRIVER_MYSQL_LIBS)
- AC_SUBST_FILE(DLZ_DRIVER_RULES)
- 
- if test "yes" = "$cross_compiling"; then
-diff --git a/contrib/dlz/config.dlz.in b/contrib/dlz/config.dlz.in
-index db8af01..8a13306 100644
---- a/contrib/dlz/config.dlz.in
-+++ b/contrib/dlz/config.dlz.in
-@@ -45,10 +45,12 @@ AC_DEFUN(DLZ_ADD_DRIVER, [
- 	if test -n "$3"
- 	then
- 		DLZ_DRIVER_INCLUDES="$DLZ_DRIVER_INCLUDES $3"
-+		DLZ_DRIVER_$1_INCLUDES="$3"
- 	fi
- 	if test -n "$4"
- 	then
- 		DLZ_DRIVER_LIBS="$DLZ_DRIVER_LIBS $4"
-+		DLZ_DRIVER_$1_LIBS="$4"
- 	fi
- ])
- 
-diff --git a/contrib/dlz/modules/mysql/Makefile b/contrib/dlz/modules/mysql/Makefile.in
-similarity index 81%
-rename from contrib/dlz/modules/mysql/Makefile
-rename to contrib/dlz/modules/mysql/Makefile.in
-index ad3876c..5ab31be 100644
---- a/contrib/dlz/modules/mysql/Makefile
-+++ b/contrib/dlz/modules/mysql/Makefile.in
-@@ -1,8 +1,8 @@
- prefix = /usr
- libdir = $(prefix)/lib/bind9
- 
--CFLAGS=-fPIC -g -I../include
--MYSQL_LIBS=-lmysqlclient
-+CFLAGS=-fPIC -Wall -g -I../include @DLZ_DRIVER_MYSQL_INCLUDES@
-+MYSQL_LIBS=@DLZ_DRIVER_MYSQL_LIBS@
- 
- all: dlz_mysql_dynamic.so
- 
-diff --git a/contrib/dlz/modules/mysqldyn/Makefile b/contrib/dlz/modules/mysqldyn/Makefile.in
-similarity index 81%
-rename from contrib/dlz/modules/mysqldyn/Makefile
-rename to contrib/dlz/modules/mysqldyn/Makefile.in
-index bba91af..248e3da 100644
---- a/contrib/dlz/modules/mysqldyn/Makefile
-+++ b/contrib/dlz/modules/mysqldyn/Makefile.in
-@@ -1,8 +1,8 @@
- prefix = /usr
- libdir = $(prefix)/lib/bind9
- 
--CFLAGS=-fPIC -Wall -g -I../include
--MYSQL_LIBS=-lmysqlclient
-+CFLAGS=-fPIC -Wall -g -I../include @DLZ_DRIVER_MYSQL_INCLUDES@
-+MYSQL_LIBS=@DLZ_DRIVER_MYSQL_LIBS@
- 
- all: dlz_mysqldyn_mod.so
- 

bind-9.11-dlz-mysql.patch

@@ -1,93 +0,0 @@
-diff --git a/contrib/dlz/config.dlz.in b/contrib/dlz/config.dlz.in
-index 9b1464c..d1fe16e 100644
---- a/contrib/dlz/config.dlz.in
-+++ b/contrib/dlz/config.dlz.in
-@@ -135,38 +135,48 @@ AC_ARG_WITH(dlz_mysql,
- 			       (Required to use MySQL with DLZ)],
-     use_dlz_mysql="$withval", use_dlz_mysql="no")
- 
-+AC_CHECK_PROGS(MYSQL_CONFIG, mysql_config)
-+
- mysql_include=""
- mysql_lib=""
- if test "$use_dlz_mysql" = "yes"
- then
--	# User did not specify a path - guess it
--	mysqldirs="/usr /usr/local /usr/local/mysql /usr/pkg"
--	for d in $mysqldirs
--	do
--		if test -f $d/include/mysql/mysql.h
--		then
--			use_dlz_mysql=$d
--			mysql_include=$d/include/mysql
--			if test -d $d/${target_lib}/mysql
-+	if test -n "$MYSQL_CONFIG"
-+	then
-+		mysql_include=`${MYSQL_CONFIG} --include`
-+		mysql_lib=`${MYSQL_CONFIG} --libs`
-+		use_dlz_mysql="config"
-+
-+	else
-+		# User did not specify a path - guess it
-+		mysqldirs="/usr /usr/local /usr/local/mysql /usr/pkg"
-+		for d in $mysqldirs
-+		do
-+			if test -f $d/include/mysql/mysql.h
- 			then
--				mysql_lib=$d/${target_lib}/mysql
--			else
--				mysql_lib=$d/lib
--			fi
--			break
--		elif test -f $d/include/mysql.h
--		then
--			use_dlz_mysql=$d
--			mysql_include=$d/include
--			if test -d $d/lib/mysql
-+				use_dlz_mysql=$d
-+				mysql_include=$d/include/mysql
-+				if test -d $d/${target_lib}/mysql
-+				then
-+					mysql_lib=$d/${target_lib}/mysql
-+				else
-+					mysql_lib=$d/lib
-+				fi
-+				break
-+			elif test -f $d/include/mysql.h
- 			then
--				mysql_lib=$d/lib/mysql
--			else
--				mysql_lib=$d/lib
-+				use_dlz_mysql=$d
-+				mysql_include=$d/include
-+				if test -d $d/lib/mysql
-+				then
-+					mysql_lib=$d/lib/mysql
-+				else
-+					mysql_lib=$d/lib
-+				fi
-+				break
- 			fi
--			break
--		fi
--	done
-+		done
-+	fi
- elif test "$use_dlz_mysql" != "no"
- then
- 	d=$use_dlz_mysql
-@@ -202,6 +212,14 @@ case "$use_dlz_mysql" in
- 	no)
- 		AC_MSG_RESULT(no)
- 		;;
-+	config)
-+		DLZ_ADD_DRIVER(MYSQL, dlz_mysql_driver,
-+				[${mysql_include}],
-+				[${mysql_lib}])
-+
-+		AC_MSG_RESULT(
-+[using mysql with libs ${mysql_lib} and includes ${mysql_include}])
-+		;;
- 	*)
- 		DLZ_ADD_DRIVER(MYSQL, dlz_mysql_driver,
- 				[-I${mysql_include}],

bind-9.11-libidn2-noout.patch

@@ -0,0 +1,16 @@
+diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
+index c179b62..cdf8826 100644
+--- a/bin/dig/dighost.c
++++ b/bin/dig/dighost.c
+@@ -823,11 +823,7 @@ make_empty_lookup(void) {
+ #else
+ 	looknew->idnin = ISC_FALSE;
+ #endif
+-#ifdef WITH_IDN_OUT_SUPPORT
+-	looknew->idnout = ISC_TRUE;
+-#else
+ 	looknew->idnout = ISC_FALSE;
+-#endif
+ #ifdef DIG_SIGCHASE
+ 	looknew->sigchase = ISC_FALSE;
+ #if DIG_SIGCHASE_TD

bind-9.11-rh1205168.patch

@@ -0,0 +1,120 @@
+From 90416594843a56550e40b11561807786219ce1c4 Mon Sep 17 00:00:00 2001
+From: Evan Hunt <each@isc.org>
+Date: Mon, 11 Sep 2017 15:01:36 -0700
+Subject: [PATCH] remap getaddrinfo() to irs_getgetaddrinfo()
+
+The libirs version of getaddrinfo() cannot be called from within BIND9.
+
+fix prototypes
+---
+ lib/irs/include/irs/netdb.h.in | 94 ++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 94 insertions(+)
+
+diff --git a/lib/irs/include/irs/netdb.h.in b/lib/irs/include/irs/netdb.h.in
+index 23dcd37..f36113d 100644
+--- a/lib/irs/include/irs/netdb.h.in
++++ b/lib/irs/include/irs/netdb.h.in
+@@ -150,6 +150,100 @@ struct addrinfo {
+ #define	NI_DGRAM	0x00000010
+ 
+ /*
++ * Define to map into irs_ namespace.
++ */
++
++#define IRS_NAMESPACE
++
++#ifdef IRS_NAMESPACE
++
++/*
++ * Use our versions not the ones from the C library.
++ */
++
++#ifdef getnameinfo
++#undef getnameinfo
++#endif
++#define getnameinfo irs_getnameinfo
++
++#ifdef getaddrinfo
++#undef getaddrinfo
++#endif
++#define getaddrinfo irs_getaddrinfo
++
++#ifdef freeaddrinfo
++#undef freeaddrinfo
++#endif
++#define freeaddrinfo irs_freeaddrinfo
++
++#ifdef gai_strerror
++#undef gai_strerror
++#endif
++#define gai_strerror irs_gai_strerror
++
++#endif
++
++extern int getaddrinfo (const char *name,
++			const char *service,
++			const struct addrinfo *req,
++			struct addrinfo **pai);
++extern int getnameinfo (const struct sockaddr *sa,
++			socklen_t salen, char *host,
++			socklen_t hostlen, char *serv,
++			socklen_t servlen, int flags);
++extern void freeaddrinfo (struct addrinfo *ai);
++extern const char *gai_strerror (int ecode);
++
++/*
++ * Define to map into irs_ namespace.
++ */
++
++#define IRS_NAMESPACE
++
++#ifdef IRS_NAMESPACE
++
++/*
++ * Use our versions not the ones from the C library.
++ */
++
++#ifdef getnameinfo
++#undef getnameinfo
++#endif
++#define getnameinfo irs_getnameinfo
++
++#ifdef getaddrinfo
++#undef getaddrinfo
++#endif
++#define getaddrinfo irs_getaddrinfo
++
++#ifdef freeaddrinfo
++#undef freeaddrinfo
++#endif
++#define freeaddrinfo irs_freeaddrinfo
++
++#ifdef gai_strerror
++#undef gai_strerror
++#endif
++#define gai_strerror irs_gai_strerror
++
++int
++getaddrinfo(const char *hostname, const char *servname,
++	    const struct addrinfo *hints, struct addrinfo **res);
++
++int
++getnameinfo(const struct sockaddr *sa, IRS_GETNAMEINFO_SOCKLEN_T salen,
++	    char *host, IRS_GETNAMEINFO_BUFLEN_T hostlen,
++	    char *serv, IRS_GETNAMEINFO_BUFLEN_T servlen,
++	    IRS_GETNAMEINFO_FLAGS_T flags);
++
++void freeaddrinfo (struct addrinfo *ai);
++
++IRS_GAISTRERROR_RETURN_T
++gai_strerror(int ecode);
++
++#endif
++
++/*
+  * Tell Emacs to use C mode on this file.
+  * Local variables:
+  * mode: c
+-- 
+2.9.5
+

bind-9.11-rh1236087.patch

@@ -1,46 +0,0 @@
-From 66b71679b78ad6cf2c4e5c8c1216b602e0fe1e9b Mon Sep 17 00:00:00 2001
-From: Evan Hunt <each@isc.org>
-Date: Thu, 20 Apr 2017 09:28:37 -0700
-Subject: [PATCH] [master] nsupdate: send tkey queries to the right server
-
-4588.	[bug]		nsupdate could send queries for TKEY to the wrong
-			server when using GSSAPI. Thanks to Tomas Hozza.
-			[RT #39893]
----
- bin/nsupdate/nsupdate.c | 10 ++++------
- 1 file changed, 4 insertions(+), 6 deletions(-)
-
-diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
-index 9572fd8..8fc5b20 100644
---- a/bin/nsupdate/nsupdate.c
-+++ b/bin/nsupdate/nsupdate.c
-@@ -2799,10 +2799,8 @@ start_gssrequest(dns_name_t *master) {
- 		if (kserver == NULL)
- 			fatal("out of memory");
- 	}
--	if (servers == NULL)
--		get_addresses(namestr, dnsport, kserver, 1);
--	else
--		memmove(kserver, &servers[ns_inuse], sizeof(isc_sockaddr_t));
-+
-+	memmove(kserver, &master_servers[master_inuse], sizeof(isc_sockaddr_t));
- 
- 	dns_fixedname_init(&fname);
- 	servname = dns_fixedname_name(&fname);
-@@ -2947,11 +2945,11 @@ recvgss(isc_task_t *task, isc_event_t *event) {
- 	}
- 
- 	if (eresult != ISC_R_SUCCESS) {
--		next_server("recvgss", addr, eresult);
-+		next_master("recvgss", addr, eresult);
- 		ddebug("Destroying request [%p]", request);
- 		dns_request_destroy(&request);
- 		dns_message_renderreset(tsigquery);
--		sendrequest(&servers[ns_inuse], tsigquery, &request);
-+		sendrequest(&master_servers[master_inuse], tsigquery, &request);
- 		isc_mem_put(gmctx, reqinfo, sizeof(nsu_gssinfo_t));
- 		isc_event_free(&event);
- 		return;
--- 
-2.9.3
-

bind-9.5-dlz-64bit.patch

@@ -1,6 +1,7 @@
-diff -up bind-9.10.1b1/contrib/dlz/config.dlz.in.64bit bind-9.10.1b1/contrib/dlz/config.dlz.in
---- bind-9.10.1b1/contrib/dlz/config.dlz.in.64bit	2014-06-23 06:47:35.000000000 +0200
-+++ bind-9.10.1b1/contrib/dlz/config.dlz.in	2014-07-29 15:29:06.956527598 +0200
+diff --git a/contrib/dlz/config.dlz.in b/contrib/dlz/config.dlz.in
+index 47525af..eefe3c3 100644
+--- a/contrib/dlz/config.dlz.in
++++ b/contrib/dlz/config.dlz.in
 @@ -17,6 +17,13 @@
  #
  dlzdir='${DLZ_DRIVER_DIR}'
@@ -15,19 +16,7 @@ diff -up bind-9.10.1b1/contrib/dlz/config.dlz.in.64bit bind-9.10.1b1/contrib/dlz
  #
  # Private autoconf macro to simplify configuring drivers:
  #
-@@ -140,9 +147,9 @@ then
- 		then
- 			use_dlz_mysql=$d
- 			mysql_include=$d/include/mysql
--			if test -d $d/lib/mysql
-+			if test -d $d/${target_lib}/mysql
- 			then
--				mysql_lib=$d/lib/mysql
-+				mysql_lib=$d/${target_lib}/mysql
- 			else
- 				mysql_lib=$d/lib
- 			fi
-@@ -288,9 +295,9 @@ case "$use_dlz_bdb" in
+@@ -292,9 +299,9 @@ case "$use_dlz_bdb" in
  					then
  						break
  					fi
@@ -39,7 +28,7 @@ diff -up bind-9.10.1b1/contrib/dlz/config.dlz.in.64bit bind-9.10.1b1/contrib/dlz
  					break
  				fi
  			done
-@@ -390,7 +397,7 @@ case "$use_dlz_ldap" in
+@@ -396,7 +403,7 @@ case "$use_dlz_ldap" in
  	*)
  		DLZ_ADD_DRIVER(LDAP, dlz_ldap_driver,
  				[-I$use_dlz_ldap/include],
@@ -48,7 +37,7 @@ diff -up bind-9.10.1b1/contrib/dlz/config.dlz.in.64bit bind-9.10.1b1/contrib/dlz
  
  		AC_MSG_RESULT(
  [using LDAP from $use_dlz_ldap/lib and $use_dlz_ldap/include])
-@@ -425,11 +432,11 @@ then
+@@ -432,11 +439,11 @@ then
  		odbcdirs="/usr /usr/local /usr/pkg"
  		for d in $odbcdirs
  		do

bind-99-libidn.patch

@@ -1,297 +0,0 @@
-diff --git a/bin/dig/Makefile.in b/bin/dig/Makefile.in
-index bd219c5..f71685b 100644
---- a/bin/dig/Makefile.in
-+++ b/bin/dig/Makefile.in
-@@ -38,10 +38,10 @@ DEPLIBS =	${DNSDEPLIBS} ${BIND9DEPLIBS} ${ISCDEPLIBS} \
- 		${ISCCFGDEPLIBS} ${LWRESDEPLIBS}
- 
- LIBS =		${LWRESLIBS} ${BIND9LIBS} ${ISCCFGLIBS} \
--		${ISCLIBS} @IDNLIBS@ @LIBS@
-+		${ISCLIBS} @IDNLIBS@ @LIBS@ -lidn
- 
- NOSYMLIBS =	${LWRESLIBS} ${BIND9LIBS} ${ISCCFGLIBS} \
--		${ISCNOSYMLIBS} @IDNLIBS@ @LIBS@
-+		${ISCNOSYMLIBS} @IDNLIBS@ @LIBS@ -lidn
- 
- SUBDIRS =
- 
-@@ -59,6 +59,8 @@ HTMLPAGES =	dig.html host.html nslookup.html
- 
- MANOBJS =	${MANPAGES} ${HTMLPAGES}
- 
-+EXT_CFLAGS = -DWITH_LIBIDN
-+
- @BIND9_MAKE_RULES@
- 
- dig@EXEEXT@: dig.@O@ dighost.@O@ ${UOBJS} ${DEPLIBS}
-diff --git a/bin/dig/dig.docbook b/bin/dig/dig.docbook
-index 7a7e8e4..b36047f 100644
---- a/bin/dig/dig.docbook
-+++ b/bin/dig/dig.docbook
-@@ -1251,8 +1251,8 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
-       <command>dig</command> appropriately converts character encoding of
-       domain name before sending a request to DNS server or displaying a
-       reply from the server.
--      If you'd like to turn off the IDN support for some reason, defines
--      the <envar>IDN_DISABLE</envar> environment variable.
-+      If you'd like to turn off the IDN support for some reason, define
-+      the <envar>CHARSET=ASCII</envar> environment variable.
-       The IDN support is disabled if the variable is set when
-       <command>dig</command> runs.
-     </para>
-diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
-index 1f8bcf2..f657c30 100644
---- a/bin/dig/dighost.c
-+++ b/bin/dig/dighost.c
-@@ -33,6 +33,11 @@
- #include <idn/api.h>
- #endif
- 
-+#ifdef WITH_LIBIDN
-+#include <stringprep.h>
-+#include <idna.h>
-+#endif
-+
- #include <dns/byaddr.h>
- #ifdef DIG_SIGCHASE
- #include <dns/callbacks.h>
-@@ -158,6 +163,14 @@ static void		idn_check_result(idn_result_t r, const char *msg);
- int  idnoptions	= 0;
- #endif
- 
-+#ifdef WITH_LIBIDN
-+static isc_result_t	libidn_locale_to_utf8 (const char* from, char *to);
-+static isc_result_t	libidn_utf8_to_ascii (const char* from, char *to);
-+static isc_result_t	output_filter (isc_buffer_t *buffer,
-+				       unsigned int used_org,
-+				       isc_boolean_t absolute);
-+#endif
-+
- isc_socket_t *keep = NULL;
- isc_sockaddr_t keepaddr;
- 
-@@ -1448,8 +1461,15 @@ setup_system(isc_boolean_t ipv4only, isc_boolean_t ipv6only) {
- 
- #ifdef WITH_IDN
- 	initialize_idn();
-+	
-+#endif
-+#ifdef WITH_LIBIDN
-+	result = dns_name_settotextfilter(output_filter);
-+	check_result(result, "dns_name_settotextfilter");
-+#ifdef HAVE_SETLOCALE
-+	setlocale (LC_ALL, "");
-+#endif
- #endif
--
- 	if (keyfile[0] != 0)
- 		setup_file_key();
- 	else if (keysecret[0] != 0)
-@@ -2231,8 +2251,11 @@ setup_lookup(dig_lookup_t *lookup) {
- 	idn_result_t mr;
- 	char utf8_textname[MXNAME], utf8_origin[MXNAME], idn_textname[MXNAME];
- #endif
-+#ifdef WITH_LIBIDN
-+	char utf8_str[MXNAME], utf8_name[MXNAME], ascii_name[MXNAME];
-+#endif
- 
--#ifdef WITH_IDN
-+#if defined (WITH_IDN) || defined (WITH_LIBIDN)
- 	result = dns_name_settotextfilter(lookup->idnout ?
- 					  output_filter : NULL);
- 	check_result(result, "dns_name_settotextfilter");
-@@ -2274,6 +2297,14 @@ setup_lookup(dig_lookup_t *lookup) {
- 	mr = idn_encodename(IDN_LOCALCONV | IDN_DELIMMAP, lookup->textname,
- 			    utf8_textname, sizeof(utf8_textname));
- 	idn_check_result(mr, "convert textname to UTF-8");
-+#elif defined (WITH_LIBIDN)
-+	result = libidn_locale_to_utf8 (lookup->textname, utf8_str);
-+	check_result (result, "convert textname to UTF-8");
-+	len = strlen (utf8_str);
-+	if (len < MXNAME)
-+		(void) strcpy (utf8_name, utf8_str);
-+	else
-+		fatal ("Too long name");
- #endif
- 
- 	/*
-@@ -2286,15 +2317,11 @@ setup_lookup(dig_lookup_t *lookup) {
- 	if (lookup->new_search) {
- #ifdef WITH_IDN
- 		if ((count_dots(utf8_textname) >= ndots) || !usesearch) {
--			lookup->origin = NULL; /* Force abs lookup */
--			lookup->done_as_is = ISC_TRUE;
--			lookup->need_search = usesearch;
--		} else if (lookup->origin == NULL && usesearch) {
--			lookup->origin = ISC_LIST_HEAD(search_list);
--			lookup->need_search = ISC_FALSE;
--		}
-+#elif defined (WITH_LIBIDN)
-+		if ((count_dots(utf8_name) >= ndots) || !usesearch) {
- #else
- 		if ((count_dots(lookup->textname) >= ndots) || !usesearch) {
-+#endif
- 			lookup->origin = NULL; /* Force abs lookup */
- 			lookup->done_as_is = ISC_TRUE;
- 			lookup->need_search = usesearch;
-@@ -2302,7 +2329,6 @@ setup_lookup(dig_lookup_t *lookup) {
- 			lookup->origin = ISC_LIST_HEAD(search_list);
- 			lookup->need_search = ISC_FALSE;
- 		}
--#endif
- 	}
- 
- #ifdef WITH_IDN
-@@ -2319,6 +2345,20 @@ setup_lookup(dig_lookup_t *lookup) {
- 			    IDN_IDNCONV | IDN_LENCHECK, utf8_textname,
- 			    idn_textname, sizeof(idn_textname));
- 	idn_check_result(mr, "convert UTF-8 textname to IDN encoding");
-+#elif defined (WITH_LIBIDN)
-+	if (lookup->origin != NULL) {
-+		result = libidn_locale_to_utf8 (lookup->origin->origin, utf8_str);
-+		check_result (result, "convert origin to UTF-8");
-+		if (len > 0 && utf8_name[len - 1] != '.') {
-+			utf8_name[len++] = '.';
-+			if (len + strlen (utf8_str) < MXNAME)
-+				(void) strcpy (utf8_name + len, utf8_str);
-+			else
-+				fatal ("Too long name + origin");
-+		}
-+	}
-+
-+	result = libidn_utf8_to_ascii (utf8_name, ascii_name);
- #else
- 	if (lookup->origin != NULL) {
- 		debug("trying origin %s", lookup->origin->origin);
-@@ -2389,6 +2429,13 @@ setup_lookup(dig_lookup_t *lookup) {
- 			result = dns_name_fromtext(lookup->name, &b,
- 						   dns_rootname, 0,
- 						   &lookup->namebuf);
-+#elif defined (WITH_LIBIDN)
-+			len = strlen (ascii_name);
-+			isc_buffer_init(&b, ascii_name, len);
-+			isc_buffer_add(&b, len);
-+			result = dns_name_fromtext(lookup->name, &b,
-+						   dns_rootname, 0,
-+						   &lookup->namebuf);
- #else
- 			len = (unsigned int) strlen(lookup->textname);
- 			isc_buffer_init(&b, lookup->textname, len);
-@@ -4377,7 +4424,7 @@ destroy_libs(void) {
- 	void * ptr;
- 	dig_message_t *chase_msg;
- #endif
--#ifdef WITH_IDN
-+#if defined (WITH_IDN) || defined (WITH_LIBIDN)
- 	isc_result_t result;
- #endif
- 
-@@ -4418,6 +4465,10 @@ destroy_libs(void) {
- 	result = dns_name_settotextfilter(NULL);
- 	check_result(result, "dns_name_settotextfilter");
- #endif
-+#ifdef WITH_LIBIDN
-+	result = dns_name_settotextfilter (NULL);
-+	check_result(result, "clearing dns_name_settotextfilter");
-+#endif
- 	dns_name_destroy();
- 
- 	if (commctx != NULL) {
-@@ -4603,6 +4654,97 @@ idn_check_result(idn_result_t r, const char *msg) {
- 	}
- }
- #endif /* WITH_IDN */
-+#ifdef WITH_LIBIDN
-+static isc_result_t
-+libidn_locale_to_utf8 (const char *from, char *to) {
-+	char *utf8_str;
-+
-+	debug ("libidn_locale_to_utf8");
-+	utf8_str = stringprep_locale_to_utf8 (from);
-+	if (utf8_str != NULL) {
-+		(void) strcpy (to, utf8_str);
-+		free (utf8_str);
-+		return ISC_R_SUCCESS;
-+	}
-+
-+	debug ("libidn_locale_to_utf8: failure");
-+	return ISC_R_FAILURE;
-+}
-+static isc_result_t
-+libidn_utf8_to_ascii (const char *from, char *to) {
-+	char *ascii;
-+	int iresult;
-+
-+	debug ("libidn_utf8_to_ascii");
-+	iresult = idna_to_ascii_8z (from, &ascii, 0);
-+	if (iresult != IDNA_SUCCESS) {
-+		debug ("idna_to_ascii_8z: %s", idna_strerror (iresult));
-+		return ISC_R_FAILURE;
-+	}
-+
-+	(void) strcpy (to, ascii);
-+	free (ascii);
-+	return ISC_R_SUCCESS;
-+}
-+
-+static isc_result_t
-+output_filter (isc_buffer_t *buffer, unsigned int used_org,
-+	       isc_boolean_t absolute) {
-+
-+	char tmp1[MXNAME], *tmp2;
-+        size_t fromlen, tolen;
-+        isc_boolean_t end_with_dot;
-+	int iresult;
-+
-+	debug ("output_filter");
-+
-+        fromlen = isc_buffer_usedlength (buffer) - used_org;
-+	if (fromlen >= MXNAME)
-+		return ISC_R_SUCCESS;
-+        memcpy (tmp1, (char *) isc_buffer_base (buffer) + used_org, fromlen);
-+        end_with_dot = (tmp1[fromlen - 1] == '.') ? ISC_TRUE : ISC_FALSE;
-+        if (absolute && !end_with_dot) {
-+                fromlen++;
-+		if (fromlen >= MXNAME)
-+			return ISC_R_SUCCESS;
-+                tmp1[fromlen - 1] = '.';
-+        }
-+        tmp1[fromlen] = '\0';
-+
-+	iresult = idna_to_unicode_8z8z (tmp1, &tmp2, 0);
-+	if (iresult != IDNA_SUCCESS) {
-+		debug ("output_filter: %s", idna_strerror (iresult));
-+		return ISC_R_SUCCESS;
-+	}
-+
-+	(void) strcpy (tmp1, tmp2);
-+	free (tmp2);
-+
-+	tmp2 = stringprep_utf8_to_locale (tmp1);
-+	if (tmp2 == NULL) {
-+		debug ("output_filter: stringprep_utf8_to_locale failed");
-+		return ISC_R_SUCCESS;
-+	}
-+
-+	(void) strcpy (tmp1, tmp2);
-+	free (tmp2);
-+
-+        tolen = strlen (tmp1);
-+        if (absolute && !end_with_dot && tmp1[tolen - 1] == '.')
-+                tolen--;
-+
-+        if (isc_buffer_length (buffer) < used_org + tolen)
-+                return ISC_R_NOSPACE;
-+
-+	debug ("%s", tmp1);
-+
-+        isc_buffer_subtract (buffer, isc_buffer_usedlength (buffer) - used_org);
-+        memcpy (isc_buffer_used (buffer), tmp1, tolen);
-+        isc_buffer_add (buffer, tolen);
-+
-+        return ISC_R_SUCCESS;
-+}
-+#endif /* WITH_LIBIDN*/
- 
- #ifdef DIG_SIGCHASE
- void

bind.spec

@@ -2,7 +2,7 @@
 # Red Hat BIND package .spec file
 #
 
-%global PATCHVER P3
+%global PATCHVER P2
 #%%global PREVER rc1
 %global BINDVERSION %{version}%{?PREVER}%{?PATCHVER:-%{PATCHVER}}
 
@@ -21,12 +21,20 @@
 %if %{SDB}
 %global        chroot_sdb_prefix %{bind_dir}/chroot_sdb
 %endif
+%global        selinuxbooleans   named_write_master_zones=1
 #
+
+# lib*.so.X versions of selected libraries
+%global sover_dns 1102
+%global sover_isc 169
+%global sover_irs 160
+%global sover_isccfg 160
+
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.11.1
-Release:  6%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Version:  9.11.4
+Release:  3%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      http://www.isc.org/products/BIND/
 Buildroot:%{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
@@ -39,7 +47,8 @@ Source7:  bind-9.3.1rc1-sdb_tools-Makefile.in
 Source8:  dnszone.schema
 Source12: README.sdb_pgsql
 Source25: named.conf.sample
-Source28: config-16.tar.bz2
+Source26: named.conf
+Source28: config-18.tar.bz2
 Source30: ldap2zone.c
 Source31: ldap2zone.1
 Source32: named-sdb.8
@@ -58,6 +67,7 @@ Source44: named-chroot-setup.service
 Source45: named-sdb-chroot-setup.service
 Source46: named-setup-rndc.service
 Source47: named-pkcs11.service
+Source49: named-chroot.files
 
 # Common patches
 Patch10: bind-9.5-PIE.patch
@@ -68,7 +78,6 @@ Patch102:bind-95-rh452060.patch
 Patch106:bind93-rh490837.patch
 Patch109:bind97-rh478718.patch
 Patch112:bind97-rh645544.patch
-Patch119:bind97-rh693982.patch
 Patch130:bind-9.9.1-P2-dlz-libdb.patch
 Patch131:bind-9.9.1-P2-multlib-conflict.patch
 Patch133:bind99-rh640538.patch
@@ -80,9 +89,7 @@ Patch136:bind-9.10-dist-native-pkcs11.patch
 # introduced by https://source.isc.org/cgi-bin/gitweb.cgi?p=bind9.git;a=commit;h=fc9f0ac5778f78003a7acc957a23711811fec122
 Patch137:bind-9.10-use-of-strlcat.patch
 Patch140:bind-9.11-rh1410433.patch
-Patch141:bind-9.11-rh1236087.patch
-Patch142: bind-9.11-dlz-mysql.patch
-Patch143: bind-9.11-dlz-mysql-modules.patch
+Patch145:bind-9.11-rh1205168.patch
 
 # SDB patches
 Patch11: bind-9.3.2b2-sdbsrc.patch
@@ -91,8 +98,8 @@ Patch12: bind-9.10-sdb.patch
 # needs inpection
 Patch17: bind-9.3.2b1-fix_sdb_ldap.patch
 
-# [ISC-Bugs #36101] IDN support in host/dig/nslookup using GNU libidn(2)
-Patch73: bind-99-libidn.patch
+# make +noidnout default
+Patch74: bind-9.11-libidn2-noout.patch
 
 
 Requires(post):   systemd
@@ -100,6 +107,9 @@ Requires(preun):  systemd
 Requires(postun): systemd
 Requires:       coreutils
 Requires(pre):  shadow-utils
+Requires(post): shadow-utils
+Requires(post): glibc-common
+Requires(post): grep
 Requires:       bind-libs%{?_isa} = %{epoch}:%{version}-%{release}
 Obsoletes:      bind-config < 30:9.3.2-34.fc6
 Provides:       bind-config = 30:9.3.2-34.fc6
@@ -107,9 +117,13 @@ Obsoletes:      caching-nameserver < 31:9.4.1-7.fc8
 Provides:       caching-nameserver = 31:9.4.1-7.fc8
 Obsoletes:      dnssec-conf < 1.27-2
 Provides:       dnssec-conf = 1.27-2
+Requires(post): policycoreutils-python-utils
+Requires(post): libselinux-utils
+Requires(post): selinux-policy
 BuildRequires:  openssl-devel, libtool, autoconf, pkgconfig, libcap-devel
-BuildRequires:  libidn-devel, libxml2-devel, GeoIP-devel
+BuildRequires:  libidn2-devel, libxml2-devel, GeoIP-devel
 BuildRequires:  systemd
+BuildRequires:  selinux-policy
 # needed for %%{__python3} macro
 BuildRequires:  python3-devel
 BuildRequires:  python3-ply
@@ -366,18 +380,15 @@ This package provides a module which allows commands to be sent to rndc directly
 %ifnarch alpha ia64
 %patch72 -p1 -b .64bit
 %endif
-%patch73 -p1 -b .libidn
+%patch74 -p1 -b .idn-noout
 %patch102 -p1 -b .rh452060
 %patch106 -p0 -b .rh490837
 %patch109 -p1 -b .rh478718
 %patch112 -p1 -b .rh645544
-%patch119 -p1 -b .rh693982
 %patch130 -p1 -b .libdb
 %patch131 -p1 -b .multlib-conflict
 %patch140 -p1 -b .rh1410433
-%patch141 -p1 -b .rh1236087
-%patch142 -p1 -b .mysql_config
-%patch143 -p1 -b .mysql_modules
+%patch145 -p1 -b .rh1205168
 
 %if %{PKCS11}
 cp -r bin/named{,-pkcs11}
@@ -451,6 +462,7 @@ libtoolize -c -f; aclocal -I libtool.m4 --force; autoconf -f
   --includedir=%{_includedir}/bind9 \
   --with-tuning=large \
   --with-geoip \
+  --with-libidn2 \
 %if %{PKCS11}
   --enable-native-pkcs11 \
   --with-pkcs11=%{_libdir}/pkcs11/libsofthsm2.so \
@@ -541,9 +553,6 @@ popd
 mkdir -p ${RPM_BUILD_ROOT}/%{chroot_prefix}/etc/{pki/dnssec-keys,named}
 mkdir -p ${RPM_BUILD_ROOT}/%{chroot_prefix}/%{_libdir}/bind
 # these are required to prevent them being erased during upgrade of previous
-touch ${RPM_BUILD_ROOT}/%{chroot_prefix}/dev/null
-touch ${RPM_BUILD_ROOT}/%{chroot_prefix}/dev/random
-touch ${RPM_BUILD_ROOT}/%{chroot_prefix}/dev/zero
 touch ${RPM_BUILD_ROOT}/%{chroot_prefix}/etc/named.conf
 #end chroot
 
@@ -561,9 +570,6 @@ popd
 mkdir -p ${RPM_BUILD_ROOT}/%{chroot_sdb_prefix}/etc/{pki/dnssec-keys,named}
 mkdir -p ${RPM_BUILD_ROOT}/%{chroot_sdb_prefix}/%{_libdir}/bind
 # these are required to prevent them being erased during upgrade of previous
-touch ${RPM_BUILD_ROOT}/%{chroot_sdb_prefix}/dev/null
-touch ${RPM_BUILD_ROOT}/%{chroot_sdb_prefix}/dev/random
-touch ${RPM_BUILD_ROOT}/%{chroot_sdb_prefix}/dev/zero
 touch ${RPM_BUILD_ROOT}/%{chroot_sdb_prefix}/etc/named.conf
 %endif
 #end sdb-chroot
@@ -597,6 +603,7 @@ install -m 755 %{SOURCE42} ${RPM_BUILD_ROOT}%{_libexecdir}/generate-rndc-key.sh
 install -m 644 %SOURCE3 ${RPM_BUILD_ROOT}/etc/logrotate.d/named
 mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/sysconfig
 install -m 644 %{SOURCE1} ${RPM_BUILD_ROOT}%{_sysconfdir}/sysconfig/named
+install -m 644 %{SOURCE49} ${RPM_BUILD_ROOT}%{_sysconfdir}/named-chroot.files
 %if %{SDB}
 mkdir -p ${RPM_BUILD_ROOT}/etc/openldap/schema
 install -m 644 %{SOURCE8} ${RPM_BUILD_ROOT}/etc/openldap/schema/dnszone.schema
@@ -664,17 +671,17 @@ touch ${RPM_BUILD_ROOT}%{_localstatedir}/log/named.log
 
 # configuration files:
 tar -C ${RPM_BUILD_ROOT} -xjf %{SOURCE28}
+install -m 640 %{SOURCE26} ${RPM_BUILD_ROOT}/etc/named.conf
 touch ${RPM_BUILD_ROOT}/etc/rndc.key
 touch ${RPM_BUILD_ROOT}/etc/rndc.conf
 mkdir ${RPM_BUILD_ROOT}/etc/named
-install -m 644 bind.keys ${RPM_BUILD_ROOT}/etc/named.iscdlv.key
 install -m 644 %{SOURCE36} ${RPM_BUILD_ROOT}/etc/trusted-key.key
 
 # sample bind configuration files for %%doc:
 mkdir -p sample/etc sample/var/named/{data,slaves}
 install -m 644 %{SOURCE25} sample/etc/named.conf
 # Copy default configuration to %%doc to make it usable from system-config-bind
-install -m 644 ${RPM_BUILD_ROOT}/etc/named.conf named.conf.default
+install -m 644 %{SOURCE26} named.conf.default
 install -m 644 ${RPM_BUILD_ROOT}/etc/named.rfc1912.zones sample/etc/named.rfc1912.zones
 install -m 644 ${RPM_BUILD_ROOT}/var/named/{named.ca,named.localhost,named.loopback,named.empty}  sample/var/named
 for f in my.internal.zone.db slaves/my.slave.internal.zone.db slaves/my.ddns.internal.zone.db my.external.zone.db; do 
@@ -692,20 +699,26 @@ install -m 644 %{SOURCE43} ${RPM_BUILD_ROOT}%{_sysconfdir}/rwtab.d/named
 %pre
 if [ "$1" -eq 1 ]; then
   /usr/sbin/groupadd -g %{bind_gid} -f -r named >/dev/null 2>&1 || :;
-  /usr/sbin/useradd  -u %{bind_uid} -r -N -M -g named -s /sbin/nologin -d /var/named -c Named named >/dev/null 2>&1 || :;
+  /usr/sbin/useradd  -u %{bind_uid} -r -N -M -g named -s /bin/false -d /var/named -c Named named >/dev/null 2>&1 || :;
 fi;
 :;
 
 %post
 /sbin/ldconfig
-%systemd_post named.service
+%selinux_set_booleans %{selinuxbooleans}
 if [ "$1" -eq 1 ]; then
   # Initial installation
   [ -x /sbin/restorecon ] && /sbin/restorecon /etc/rndc.* /etc/named.* >/dev/null 2>&1 ;
   # rndc.key has to have correct perms and ownership, CVE-2007-6283
   [ -e /etc/rndc.key ] && chown root:named /etc/rndc.key
   [ -e /etc/rndc.key ] && chmod 0640 /etc/rndc.key
+else
+  # Upgrade, use invalid shell
+  if getent passwd named | grep ':/sbin/nologin$' >/dev/null; then
+    usermod -s /bin/false named
+  fi
 fi
+%systemd_post named.service
 :;
 
 %preun
@@ -714,6 +727,7 @@ fi
 
 %postun
 /sbin/ldconfig
+%selinux_unset_booleans %{selinuxbooleans}
 # Package upgrade, not uninstall
 %systemd_postun_with_restart named.service
 
@@ -772,28 +786,26 @@ fi
 
 %post chroot
 %systemd_post named-chroot.service
-if [ "$1" -gt 0 ]; then
-  [ -e %{chroot_prefix}/dev/random ] || \
-    /bin/mknod %{chroot_prefix}/dev/random c 1 8
-  [ -e %{chroot_prefix}/dev/zero ] || \
-    /bin/mknod %{chroot_prefix}/dev/zero c 1 5
-  [ -e %{chroot_prefix}/dev/null ] || \
-    /bin/mknod %{chroot_prefix}/dev/null c 1 3
-fi;
+if [ $1 -gt 1 ]; then
+  # Fix permissions on existing device files on upgrade
+  for DEV in "%{chroot_prefix}/dev"/{null,random,dev}; do
+    if [ -e "$DEV" -a "$(stat --printf="%G %a" "$DEV")" = "root 644" ]; then
+      chmod 0664 "$DEV"
+      chgrp named "$DEV"
+    fi
+  done
+fi
 :;
 
 %posttrans chroot
 if [ -x /usr/sbin/selinuxenabled ] && /usr/sbin/selinuxenabled; then
   [ -x /sbin/restorecon ] && /sbin/restorecon %{chroot_prefix}/dev/* > /dev/null 2>&1;
 fi;
-:;
 
 %preun chroot
-%systemd_preun named-chroot.service 
-if [ "$1" -eq 0 ]; then
-  # Package removal, not upgrade
-  rm -f %{chroot_prefix}/dev/{random,zero,null}
-fi
+# wait for stop of both named-chroot and named-chroot-setup services
+# on uninstall
+%systemd_preun named-chroot.service named-chroot-setup.service
 :;
 
 %postun chroot
@@ -805,14 +817,15 @@ fi
 
 %post sdb-chroot
 %systemd_post named-sdb-chroot.service
-if [ "$1" -gt 0 ]; then
-  [ -e %{chroot_sdb_prefix}/dev/random ] || \
-    /bin/mknod %{chroot_sdb_prefix}/dev/random c 1 8
-  [ -e %{chroot_sdb_prefix}/dev/zero ] || \
-    /bin/mknod %{chroot_sdb_prefix}/dev/zero c 1 5
-  [ -e %{chroot_sdb_prefix}/dev/null ] || \
-    /bin/mknod %{chroot_sdb_prefix}/dev/null c 1 3
-fi;
+if [ $1 -gt 1 ]; then
+  # Fix permissions on existing device files on upgrade
+  for DEV in "%{chroot_prefix}/dev"/{null,random,dev}; do
+    if [ -e "$DEV" -a "$(stat --printf="%G %a" "$DEV")" = "root 644" ]; then
+      chmod 0664 "$DEV"
+      chgrp named "$DEV"
+    fi
+  done
+fi
 :;
 
 %posttrans sdb-chroot
@@ -823,10 +836,6 @@ fi;
 
 %preun sdb-chroot
 %systemd_preun named-sdb-chroot.service 
-if [ "$1" -eq 0 ]; then
-  # Package removal, not upgrade
-  rm -f %{chroot_sdb_prefix}/dev/{random,zero,null}
-fi
 :;
 
 %postun sdb-chroot
@@ -843,7 +852,6 @@ rm -rf ${RPM_BUILD_ROOT}
 %defattr(-,root,root,-)
 %{_libdir}/bind
 %config(noreplace) %verify(not md5 size mtime) %{_sysconfdir}/sysconfig/named
-%config(noreplace) %attr(0644,root,named) %{_sysconfdir}/named.iscdlv.key
 %config(noreplace) %attr(0644,root,named) %{_sysconfdir}/named.root.key
 %{_tmpfilesdir}/named.conf
 %{_sysconfdir}/rwtab.d/named
@@ -874,19 +882,20 @@ rm -rf ${RPM_BUILD_ROOT}
 # Hide configuration
 %defattr(0640,root,named,0750)
 %dir %{_sysconfdir}/named
-%dir %{_localstatedir}/named
 %config(noreplace) %verify(not link) %{_sysconfdir}/named.conf
 %config(noreplace) %verify(not link) %{_sysconfdir}/named.rfc1912.zones
-%config %verify(not link) %{_localstatedir}/named/named.ca
-%config %verify(not link) %{_localstatedir}/named/named.localhost
-%config %verify(not link) %{_localstatedir}/named/named.loopback
-%config %verify(not link) %{_localstatedir}/named/named.empty
+%defattr(0660,root,named,01770)
+%dir %{_localstatedir}/named
 %defattr(0660,named,named,0770)
 %dir %{_localstatedir}/named/slaves
 %dir %{_localstatedir}/named/data
 %dir %{_localstatedir}/named/dynamic
 %ghost %{_localstatedir}/log/named.log
 %defattr(0640,root,named,0750)
+%config %verify(not link) %{_localstatedir}/named/named.ca
+%config %verify(not link) %{_localstatedir}/named/named.localhost
+%config %verify(not link) %{_localstatedir}/named/named.loopback
+%config %verify(not link) %{_localstatedir}/named/named.empty
 %ghost %config(noreplace) %{_sysconfdir}/rndc.key
 # ^- rndc.key now created on first install only if it does not exist
 %ghost %config(noreplace) %{_sysconfdir}/rndc.conf
@@ -898,7 +907,6 @@ rm -rf ${RPM_BUILD_ROOT}
 
 %if %{SDB}
 %files sdb
-%defattr(-,root,root,-)
 %{_unitdir}/named-sdb.service
 %{_mandir}/man1/zone2ldap.1*
 %{_mandir}/man1/ldap2zone.1*
@@ -916,17 +924,15 @@ rm -rf ${RPM_BUILD_ROOT}
 %endif
 
 %files libs
-%defattr(-,root,root,-)
 %{_libdir}/libbind9.so.160*
 %{_libdir}/libisccc.so.160*
 %{_libdir}/liblwres.so.160*
 
 %files libs-lite
-%defattr(-,root,root,-)
-%{_libdir}/libdns.so.168*
-%{_libdir}/libirs.so.160*
-%{_libdir}/libisc.so.166*
-%{_libdir}/libisccfg.so.160*
+%{_libdir}/libdns.so.%{sover_dns}*
+%{_libdir}/libirs.so.%{sover_irs}*
+%{_libdir}/libisc.so.%{sover_isc}*
+%{_libdir}/libisccfg.so.%{sover_isccfg}*
 
 %files license
 %defattr(-,root,root,-)
@@ -1004,13 +1010,14 @@ rm -rf ${RPM_BUILD_ROOT}
 %{_includedir}/bind9/isccfg
 
 %files chroot
-%defattr(-,root,root,-)
+%config(noreplace) %{_sysconfdir}/named-chroot.files
 %{_unitdir}/named-chroot.service
 %{_unitdir}/named-chroot-setup.service
 %{_libexecdir}/setup-named-chroot.sh
-%ghost %{chroot_prefix}/dev/null
-%ghost %{chroot_prefix}/dev/random
-%ghost %{chroot_prefix}/dev/zero
+%defattr(0664,root,named,-)
+%ghost %dev(c,1,3) %verify(not mtime) %{chroot_prefix}/dev/null
+%ghost %dev(c,1,8) %verify(not mtime) %{chroot_prefix}/dev/random
+%ghost %dev(c,1,5) %verify(not mtime) %{chroot_prefix}/dev/zero
 %defattr(0640,root,named,0750)
 %dir %{chroot_prefix}
 %dir %{chroot_prefix}/dev
@@ -1022,12 +1029,13 @@ rm -rf ${RPM_BUILD_ROOT}
 %dir %{chroot_prefix}/etc/crypto-policies/back-ends
 %dir %{chroot_prefix}/var
 %dir %{chroot_prefix}/run
-%dir %{chroot_prefix}/var/named
 %ghost %config(noreplace) %{chroot_prefix}/etc/named.conf
 %defattr(-,root,root,-)
 %dir %{chroot_prefix}/usr
 %dir %{chroot_prefix}/%{_libdir}
 %dir %{chroot_prefix}/%{_libdir}/bind
+%defattr(0660,root,named,01770)
+%dir %{chroot_prefix}/var/named
 %defattr(0660,named,named,0770)
 %dir %{chroot_prefix}/var/tmp
 %dir %{chroot_prefix}/var/log
@@ -1037,13 +1045,14 @@ rm -rf ${RPM_BUILD_ROOT}
 
 %if %{SDB}
 %files sdb-chroot
-%defattr(-,root,root,-)
+%config(noreplace) %{_sysconfdir}/named-chroot.files
 %{_unitdir}/named-sdb-chroot.service
 %{_unitdir}/named-sdb-chroot-setup.service
 %{_libexecdir}/setup-named-chroot.sh
-%ghost %{chroot_sdb_prefix}/dev/null
-%ghost %{chroot_sdb_prefix}/dev/random
-%ghost %{chroot_sdb_prefix}/dev/zero
+%defattr(0664,root,named,-)
+%ghost %dev(c,1,3) %verify(not mtime) %{chroot_sdb_prefix}/dev/null
+%ghost %dev(c,1,8) %verify(not mtime) %{chroot_sdb_prefix}/dev/random
+%ghost %dev(c,1,5) %verify(not mtime) %{chroot_sdb_prefix}/dev/zero
 %defattr(0640,root,named,0750)
 %dir %{chroot_sdb_prefix}
 %dir %{chroot_sdb_prefix}/dev
@@ -1055,8 +1064,9 @@ rm -rf ${RPM_BUILD_ROOT}
 %dir %{chroot_sdb_prefix}/etc/crypto-policies/back-ends
 %dir %{chroot_sdb_prefix}/var
 %dir %{chroot_sdb_prefix}/run
-%dir %{chroot_sdb_prefix}/var/named
 %ghost %config(noreplace) %{chroot_sdb_prefix}/etc/named.conf
+%defattr(0660,root,named,01770)
+%dir %{chroot_sdb_prefix}/var/named
 %defattr(-,root,root,-)
 %dir %{chroot_sdb_prefix}/usr
 %dir %{chroot_sdb_prefix}/%{_libdir}
@@ -1071,7 +1081,6 @@ rm -rf ${RPM_BUILD_ROOT}
 
 %if %{PKCS11}
 %files pkcs11
-%defattr(-,root,root,-)
 %{_sbindir}/named-pkcs11
 %{_unitdir}/named-pkcs11.service
 %{_mandir}/man8/named-pkcs11.8*
@@ -1087,9 +1096,8 @@ rm -rf ${RPM_BUILD_ROOT}
 %{_mandir}/man8/dnssec*-pkcs11.8*
 
 %files pkcs11-libs
-%defattr(-,root,root,-)
-%{_libdir}/libdns-pkcs11.so.168*
-%{_libdir}/libisc-pkcs11.so.166*
+%{_libdir}/libdns-pkcs11.so.%{sover_dns}*
+%{_libdir}/libisc-pkcs11.so.%{sover_isc}*
 
 %files pkcs11-devel
 %defattr(-,root,root,-)
@@ -1130,11 +1138,68 @@ rm -rf ${RPM_BUILD_ROOT}
 
 %files -n python3-bind
 %defattr(-,root,root,-)
-%{python3_sitelib}/*py*
-%{python3_sitelib}/isc/*py
-%{python3_sitelib}/isc/__pycache__/*py*
+%{python3_sitelib}/*.egg-info
+%{python3_sitelib}/isc/
 
 %changelog
+* Thu Sep 20 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.4-3.P2
+- Update to bind-9.11.4-P2
+
+* Thu Aug 09 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.4-2.P1
+- Update to 9.11.4-P1
+- Adds root key sentinel support
+- Large IXFR zone transfers are rejected to prevent journal corruption
+
+* Thu Jul 12 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.4-1
+- Update to 9.11.4
+
+* Thu Jul 12 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.3-7
+- Use new config file named-chroot.files for chroot setup (#1429656)
+- Fix chroot devices file verification (#1592873)
+- Prevent errors on bind-chroot uninstall when running (#1600583)
+
+* Wed Jun 27 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.3-6
+- Require utils instead of library
+
+* Fri May 25 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.3-5
+- Remove named.iscdlv.key file (#1595782)
+- Fix CVE-2018-5738
+- Make named home writeable (#1422680)
+- Change named shell to /bin/false
+
+* Thu Apr 05 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.3-4
+- Do not link libidn2 to all libraries (#1098783)
+- Update named.ca
+
+* Tue Apr 03 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.3-3
+- Enable libidn2 support (#1098783)
+- Make +noidnout default
+
+* Wed Mar 21 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.3-2
+- Rebase to 9.11.3
+- Add dig support for libidn2 (#1098783)
+
+* Thu Feb 15 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.3-1.b1
+- Rebase to 9.11.3b1
+
+* Thu Jan 18 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.2-1.P1
+- Fix CVE-2017-3145, rebase to 9.11.2-P1
+
+* Wed Jan 10 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.1-10.P3
+- Proper fix for python3-bind subpackage directory ownership (#1522944)
+
+* Fri Dec 15 2017 Petr Menšík <pemensik@redhat.com> - 32:9.11.1-9.P3
+- Own python3-bind isc directory (#1522944)
+- Make tsstsig system test pass again (#1500017)
+
+* Mon Oct 23 2017 Petr Menšík <pemensik@redhat.com> - 32:9.11.1-8.P3
+- Include DNSKEY 20326 also in trusted-key.key (#1505476)
+- Fix dynamic symbols conflict with ldap (#1205168)
+- Use hmac-sha256 for new RNDC keys (#1508003)
+
+* Wed Sep 13 2017 Petr Menšík <pemensik@redhat.com> - 32:9.11.1-7.P3
+- Fix nsupdate GSSAPI auth against AD server (#1484451)
+
 * Wed Aug 02 2017 Fedora Release Engineering <releng@fedoraproject.org> - 32:9.11.1-6.P3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
 

bind97-rh693982.patch

@@ -1,35 +0,0 @@
-diff -up bind-9.7.3-P3/bin/named/server.c.rh693982 bind-9.7.3-P3/bin/named/server.c
---- bind-9.7.3-P3/bin/named/server.c.rh693982	2011-08-12 17:18:55.611978110 +0200
-+++ bind-9.7.3-P3/bin/named/server.c	2011-08-12 17:19:36.009975303 +0200
-@@ -4444,15 +4444,6 @@ load_configuration(const char *filename,
- 		ns_os_changeuser();
- 
- 	/*
--	 * Check that the working directory is writable.
--	 */
--	if (access(".", W_OK) != 0) {
--		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
--			      NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
--			      "the working directory is not writable");
--	}
--
--	/*
- 	 * Configure the logging system.
- 	 *
- 	 * Do this after changing UID to make sure that any log
-@@ -4498,6 +4489,15 @@ load_configuration(const char *filename,
- 	}
- 
- 	/*
-+	 * Check that the working directory is writable.
-+	 */
-+	if (access(".", W_OK) != 0) {
-+		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
-+			      NS_LOGMODULE_SERVER, ISC_LOG_DEBUG(1),
-+			      "the working directory is not writable");
-+	}
-+
-+	/*
- 	 * Set the default value of the query logging flag depending
- 	 * whether a "queries" category has been defined.  This is
- 	 * a disgusting hack, but we need to do this for BIND 8

generate-rndc-key.sh

@@ -6,9 +6,10 @@
 
 if [ ! -s /etc/rndc.key -a ! -s /etc/rndc.conf ]; then
   echo -n $"Generating /etc/rndc.key:"
-  if /usr/sbin/rndc-confgen -a -r /dev/urandom > /dev/null 2>&1; then
+  if /usr/sbin/rndc-confgen -a -A hmac-sha256 -r /dev/urandom > /dev/null 2>&1
+  then
     chmod 640 /etc/rndc.key
-    chown root.named /etc/rndc.key
+    chown root:named /etc/rndc.key
     [ -x /sbin/restorecon ] && /sbin/restorecon /etc/rndc.key
     success $"/etc/rndc.key generation"
     echo

named-chroot-setup.service

@@ -8,5 +8,5 @@ After=named-setup-rndc.service
 [Service]
 Type=oneshot
 RemainAfterExit=yes
-ExecStart=/usr/libexec/setup-named-chroot.sh /var/named/chroot on
-ExecStop=/usr/libexec/setup-named-chroot.sh /var/named/chroot off
+ExecStart=/usr/libexec/setup-named-chroot.sh /var/named/chroot on /etc/named-chroot.files
+ExecStop=/usr/libexec/setup-named-chroot.sh /var/named/chroot off /etc/named-chroot.files

named-chroot.files

@@ -0,0 +1,23 @@
+# Configuration of files used in chroot
+# Following files are made available after named-chroot.service start
+# if they are missing or empty in target directory.
+/etc/localtime
+/etc/named.root.key
+/etc/named.conf
+/etc/named.rfc1912.zones
+/etc/rndc.conf
+/etc/rndc.key
+/etc/named.iscdlv.key
+/etc/crypto-policies/back-ends/bind.config
+/etc/protocols
+/etc/services
+/etc/named.dnssec.keys
+/etc/pki/dnssec-keys
+/etc/named
+/usr/lib64/bind
+/usr/lib/bind
+/run/named
+# Warning: the order is important
+# If a directory containing $ROOTDIR is listed here,
+# it MUST be listed last. (/var/named contains /var/named/chroot)
+/var/named

named-sdb-chroot-setup.service

@@ -8,5 +8,5 @@ After=named-setup-rndc.service
 [Service]
 Type=oneshot
 RemainAfterExit=yes
-ExecStart=/usr/libexec/setup-named-chroot.sh /var/named/chroot_sdb on
-ExecStop=/usr/libexec/setup-named-chroot.sh /var/named/chroot_sdb off
+ExecStart=/usr/libexec/setup-named-chroot.sh /var/named/chroot_sdb on /etc/named-chroot.files
+ExecStop=/usr/libexec/setup-named-chroot.sh /var/named/chroot_sdb off /etc/named-chroot.files

named.conf

@@ -0,0 +1,57 @@
+//
+// named.conf
+//
+// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
+// server as a caching only nameserver (as a localhost DNS resolver only).
+//
+// See /usr/share/doc/bind*/sample/ for example named configuration files.
+//
+
+options {
+	listen-on port 53 { 127.0.0.1; };
+	listen-on-v6 port 53 { ::1; };
+	directory 	"/var/named";
+	dump-file 	"/var/named/data/cache_dump.db";
+	statistics-file "/var/named/data/named_stats.txt";
+	memstatistics-file "/var/named/data/named_mem_stats.txt";
+	allow-query     { localhost; };
+
+	/* 
+	 - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
+	 - If you are building a RECURSIVE (caching) DNS server, you need to enable 
+	   recursion. 
+	 - If your recursive DNS server has a public IP address, you MUST enable access 
+	   control to limit queries to your legitimate users. Failing to do so will
+	   cause your server to become part of large scale DNS amplification 
+	   attacks. Implementing BCP38 within your network would greatly
+	   reduce such attack surface 
+	*/
+	recursion yes;
+
+	dnssec-enable yes;
+	dnssec-validation yes;
+
+	managed-keys-directory "/var/named/dynamic";
+
+	pid-file "/run/named/named.pid";
+	session-keyfile "/run/named/session.key";
+
+	/* https://fedoraproject.org/wiki/Changes/CryptoPolicy */
+	include "/etc/crypto-policies/back-ends/bind.config";
+};
+
+logging {
+        channel default_debug {
+                file "data/named.run";
+                severity dynamic;
+        };
+};
+
+zone "." IN {
+	type hint;
+	file "named.ca";
+};
+
+include "/etc/named.rfc1912.zones";
+include "/etc/named.root.key";
+

named.conf.sample

@@ -143,7 +143,7 @@ view "internal"
 	 * not leak to the other nameservers:
 	 */
 	include "/etc/named.rfc1912.zones";
- 
+
 	// These are your "authoritative" internal zones, and would probably
 	// also be included in the "localhost_resolver" view above :
 

setup-named-chroot.sh

@@ -1,24 +1,21 @@
 #!/bin/bash
 
-ROOTDIR_MOUNT='/etc/localtime /etc/named /etc/pki/dnssec-keys /etc/named.root.key /etc/named.conf
-/etc/named.dnssec.keys /etc/named.rfc1912.zones /etc/rndc.conf /etc/rndc.key
-/usr/lib64/bind /usr/lib/bind /etc/named.iscdlv.key /run/named
-/etc/crypto-policies/back-ends/bind.config /var/named'
 
 usage()
 {
   echo
   echo 'This script setups chroot environment for BIND'
-  echo 'Usage: setup-named-chroot.sh ROOTDIR [on|off]'
+  echo 'Usage: setup-named-chroot.sh ROOTDIR <on|off> <config.files>'
 }
 
-if ! [ "$#" -eq 2 ]; then
+if ! [ "$#" -eq 3 ]; then
   echo 'Wrong number of arguments'
   usage
   exit 1
 fi
 
 ROOTDIR="$1"
+CONFIG_FILES="$3"
 
 # Exit if ROOTDIR doesn't exist
 if ! [ -d "$ROOTDIR" ]; then
@@ -27,10 +24,41 @@ if ! [ -d "$ROOTDIR" ]; then
   exit 1
 fi
 
+dev_create()
+{
+  DEVNAME="$ROOTDIR/dev/$1"
+  shift
+  if ! [ -e "$DEVNAME" ]; then
+    /bin/mknod -m 0664 "$DEVNAME" $@
+    /bin/chgrp named "$DEVNAME"
+    if [ -x /usr/sbin/selinuxenabled -a -x /sbin/restorecon ]; then
+      /usr/sbin/selinuxenabled && /sbin/restorecon "$DEVNAME" > /dev/null || :
+    fi
+  fi
+}
+
+dev_chroot_prep()
+{
+  dev_create random c 1 8
+  dev_create zero   c 1 5
+  dev_create null   c 1 3
+}
+
+files_comment_filter()
+{
+  if [ -d "$1" ]; then
+    grep -v '^[[:space:]]*#' "$1"/*.files
+  else
+    grep -v '^[[:space:]]*#' "$1"
+  fi
+}
+
 mount_chroot_conf()
 {
   if [ -n "$ROOTDIR" ]; then
-    for all in $ROOTDIR_MOUNT; do
+    # Check devices are prepared
+    dev_chroot_prep
+    files_comment_filter "$CONFIG_FILES" | while read -r all; do
       # Skip nonexistant files
       [ -e "$all" ] || continue
 
@@ -55,7 +83,7 @@ mount_chroot_conf()
 umount_chroot_conf()
 {
   if [ -n "$ROOTDIR" ]; then
-    for all in $ROOTDIR_MOUNT; do
+    files_comment_filter "$CONFIG_FILES" | while read -r all; do
       # Check if file is mount target. Do not use /proc/mounts because detecting
       # of modified mounted files can fail.
       if mount | grep -q '.* on '"$ROOTDIR$all"' .*'; then

sources

@@ -1,2 +1,2 @@
-SHA512 (bind-9.11.1-P3.tar.gz) = bf92ce1e07e5c84cc42b413bdbd3ad97f37712a6dc330dc10182992d948b7a393d5446efa188379b39020c34d810cebe2a7acccc9b8aa6bb564e1f3e6be42e96
-SHA512 (config-16.tar.bz2) = 983e0a8de3bb0c16fb21331894cc97ea516233796158eb5d1c932608227b31889496d0467c3e43953bf504dbf8b5f19210d2c9f8e0e3742aea2c7609245bf3f7
+SHA512 (bind-9.11.4-P2.tar.gz) = 6c01810526fc40485a6c0403d1ddc3b76d2e59b3426b5789436bd671f158d2fa0ea7c0aef2de81998ec715dabd06683fed7b17224d5c794c61e7100a69d4cb60
+SHA512 (config-18.tar.bz2) = c0a0a1fd58a7e2c09fe69915b9a4c682d1b6c96e78583f63ce5355f663c9509d28facfd3aa078b228b69954d0af4bfa484ef661a9568aaafe6eade97dda3c3d9

trusted-key.key

@@ -1 +1,2 @@
 . 3600 IN DNSKEY 257 3 8 AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjFFVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoXbfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaDX6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpzW5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relSQageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulqQxA+Uk1ihz0=
+. 3600 IN DNSKEY 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU=