Use CI from master branch

Use just the same tests.yml as master. Do not use whole history.
Fix oot build
2020-04-14 14:16:41 +02:00 · 2020-01-06 11:34:32 +01:00 · 2020-01-06 11:34:32 +01:00 · 2020-01-06 11:34:32 +01:00 · 2020-01-06 11:34:32 +01:00 · 2020-01-06 11:34:32 +01:00
50 changed files with 2159 additions and 1365 deletions
--- a/.gitignore
+++ b/.gitignore
@ -92,3 +92,12 @@ bind-9.7.2b1.tar.gz
 /bind-9.11.5-P4.tar.gz
 /bind-9.11.6.tar.gz
 /bind-9.11.6-P1.tar.gz
+/bind-9.11.8.tar.gz
+/bind-9.11.9.tar.gz
+/bind-9.11.10.tar.gz
+/bind-9.11.11.tar.gz
+/bind-9.11.12.tar.gz
+/bind-9.11.13.tar.gz
+/bind-9.11.13.tar.gz.asc
+/bind-9.11.14.tar.gz
+/bind-9.11.14.tar.gz.asc
--- a/bind-9.10-dist-native-pkcs11.patch
+++ b/bind-9.10-dist-native-pkcs11.patch
@ -14,10 +14,10 @@ index f0c504a..ce7a2da 100644
 
 @BIND9_MAKE_RULES@
 diff --git a/bin/dnssec-pkcs11/Makefile.in b/bin/dnssec-pkcs11/Makefile.in
-index ce0a177..8908a45 100644
+index 4b8ca13..32f4470 100644
 --- a/bin/dnssec-pkcs11/Makefile.in
 +++ b/bin/dnssec-pkcs11/Makefile.in
-@@ -17,18 +17,18 @@ VERSION=@BIND9_VERSION@
+@@ -15,18 +15,18 @@ VERSION=@BIND9_VERSION@
 
 @BIND9_MAKE_INCLUDES@
 
@ -30,10 +30,10 @@ index ce0a177..8908a45 100644
 +		@CRYPTO_PK11@ -DPK11_LIB_LOCATION=\"@PKCS11_PROVIDER@\"
 CWARNINGS =
 
-DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
+-DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
 -ISCLIBS =	../../lib/isc/libisc.@A@
 -ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@
-+DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ @DNS_CRYPTO_LIBS@
+DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
 +ISCLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
 +ISCNOSYMLIBS =	../../lib/isc-pkcs11/libisc-pkcs11-nosymtbl.@A@
 
@ -44,7 +44,7 @@ index ce0a177..8908a45 100644
 
 DEPLIBS =	${DNSDEPLIBS} ${ISCDEPLIBS}
 
-@@ -37,10 +37,10 @@ LIBS =		${DNSLIBS} ${ISCLIBS} @LIBS@
+@@ -35,10 +35,10 @@ LIBS =		${DNSLIBS} ${ISCLIBS} @LIBS@
 NOSYMLIBS =	${DNSLIBS} ${ISCNOSYMLIBS} @LIBS@
 
 # Alphabetically
@ -59,7 +59,7 @@ index ce0a177..8908a45 100644
 
 OBJS =		dnssectool.@O@
 
-@@ -61,15 +61,15 @@ MANOBJS =	${MANPAGES} ${HTMLPAGES}
+@@ -59,15 +59,15 @@ MANOBJS =	${MANPAGES} ${HTMLPAGES}
 
 @BIND9_MAKE_RULES@
 
@ -78,7 +78,7 @@ index ce0a177..8908a45 100644
 	export BASEOBJS="dnssec-keygen.@O@ ${OBJS}"; \
 	${FINALBUILDCMD}
 
-@@ -77,7 +77,7 @@ dnssec-signzone.@O@: dnssec-signzone.c
+@@ -75,7 +75,7 @@ dnssec-signzone.@O@: dnssec-signzone.c
 	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} -DVERSION=\"${VERSION}\" \
 		-c ${srcdir}/dnssec-signzone.c
 
@ -87,7 +87,7 @@ index ce0a177..8908a45 100644
 	export BASEOBJS="dnssec-signzone.@O@ ${OBJS}"; \
 	${FINALBUILDCMD}
 
-@@ -85,19 +85,19 @@ dnssec-verify.@O@: dnssec-verify.c
+@@ -83,19 +83,19 @@ dnssec-verify.@O@: dnssec-verify.c
 	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} -DVERSION=\"${VERSION}\" \
 		-c ${srcdir}/dnssec-verify.c
 
@ -111,7 +111,7 @@ index ce0a177..8908a45 100644
 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \
 	dnssec-importkey.@O@ ${OBJS} ${LIBS}
 
-@@ -108,16 +108,14 @@ docclean manclean maintainer-clean::
+@@ -106,16 +106,14 @@ docclean manclean maintainer-clean::
 
 installdirs:
 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
@ -130,10 +130,10 @@ index ce0a177..8908a45 100644
 
 clean distclean::
 diff --git a/bin/dnssec/Makefile.in b/bin/dnssec/Makefile.in
-index ce0a177..7cede84 100644
+index 4b8ca13..4175996 100644
 --- a/bin/dnssec/Makefile.in
 +++ b/bin/dnssec/Makefile.in
-@@ -19,7 +19,7 @@ VERSION=@BIND9_VERSION@
+@@ -17,7 +17,7 @@ VERSION=@BIND9_VERSION@
 
 CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} @DST_OPENSSL_INC@
 
@ -143,44 +143,46 @@ index ce0a177..7cede84 100644
 CWARNINGS =
 
 diff --git a/bin/named-pkcs11/Makefile.in b/bin/named-pkcs11/Makefile.in
-index c0861f6..df80f81 100644
+index 70e5571..b5a4a6b 100644
 --- a/bin/named-pkcs11/Makefile.in
 +++ b/bin/named-pkcs11/Makefile.in
-@@ -43,26 +43,26 @@ DLZDRIVER_INCLUDES =	@DLZ_DRIVER_INCLUDES@
+@@ -43,27 +43,27 @@ DLZDRIVER_INCLUDES =	@DLZ_DRIVER_INCLUDES@
 DLZDRIVER_LIBS =	@DLZ_DRIVER_LIBS@
 
 CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
 -		${LWRES_INCLUDES} ${DNS_INCLUDES} ${BIND9_INCLUDES} \
 -		${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} ${ISC_INCLUDES} \
-+        ${LWRES_INCLUDES} ${DNS_PKCS11_INCLUDES} ${BIND9_INCLUDES} \
-+        ${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} ${ISC_PKCS11_INCLUDES} \
- 		${DLZDRIVER_INCLUDES} ${DBDRIVER_INCLUDES} @DST_OPENSSL_INC@
+		${LWRES_INCLUDES} ${DNS_PKCS11_INCLUDES} ${BIND9_INCLUDES} \
+		${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} ${ISC_PKCS11_INCLUDES} \
+ 		${DLZDRIVER_INCLUDES} ${DBDRIVER_INCLUDES} ${MAXMINDDB_CFLAGS} \
+ 		@DST_OPENSSL_INC@
 
-CDEFINES =      @CONTRIB_DLZ@ @USE_PKCS11@ @PKCS11_ENGINE@ @CRYPTO@
-+CDEFINES =      @USE_PKCS11@ @PKCS11_ENGINE@ @CRYPTO_PK11@
+-CDEFINES =      @CONTRIB_DLZ@ @USE_PKCS11@ @PKCS11_ENGINE@ @USE_GSSAPI@ @CRYPTO@
+CDEFINES =      @USE_PKCS11@ @PKCS11_ENGINE@ @CRYPTO_PK11@ @USE_GSSAPI@
 
 CWARNINGS =
 
-DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
-+DNSLIBS =  ../../lib/dns-pkcs11/libdns-pkcs11.@A@ @DNS_CRYPTO_LIBS@
+-DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
+DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
 ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
 ISCCCLIBS =	../../lib/isccc/libisccc.@A@
 -ISCLIBS =	../../lib/isc/libisc.@A@
-+ISCLIBS =  ../../lib/isc-pkcs11/libisc-pkcs11.@A@
- ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@
+-ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@
+ISCLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
+ISCNOSYMLIBS =	../../lib/isc-pkcs11/libisc-pkcs11-nosymtbl.@A@
 LWRESLIBS =	../../lib/lwres/liblwres.@A@
 BIND9LIBS =	../../lib/bind9/libbind9.@A@
 
 -DNSDEPLIBS =	../../lib/dns/libdns.@A@
-+DNSDEPLIBS =   ../../lib/dns-pkcs11/libdns-pkcs11.@A@
+DNSDEPLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@
 ISCCFGDEPLIBS =	../../lib/isccfg/libisccfg.@A@
 ISCCCDEPLIBS =	../../lib/isccc/libisccc.@A@
 -ISCDEPLIBS =	../../lib/isc/libisc.@A@
-+ISCDEPLIBS =   ../../lib/isc-pkcs11/libisc-pkcs11.@A@
+ISCDEPLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
 LWRESDEPLIBS =	../../lib/lwres/liblwres.@A@
 BIND9DEPLIBS =	../../lib/bind9/libbind9.@A@
 
-@@ -71,15 +71,15 @@ DEPLIBS =	${LWRESDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
+@@ -72,15 +72,15 @@ DEPLIBS =	${LWRESDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
 
 LIBS =		${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
 		${ISCCFGLIBS} ${ISCCCLIBS} ${ISCLIBS} \
@ -198,8 +200,8 @@ index c0861f6..df80f81 100644
 +TARGETS =	named-pkcs11@EXEEXT@ feature-test-pkcs11@EXEEXT@
 
 GEOIPLINKOBJS = geoip.@O@
- 
-@@ -90,8 +90,7 @@ OBJS =		builtin.@O@ client.@O@ config.@O@ control.@O@ \
+ GEOIP2LINKOBJS = geoip.@O@
+@@ -94,8 +94,7 @@ OBJS =		builtin.@O@ client.@O@ config.@O@ control.@O@ \
 		tkeyconf.@O@ tsigconf.@O@ update.@O@ xfrout.@O@ \
 		zoneconf.@O@ \
 		lwaddr.@O@ lwresd.@O@ lwdclient.@O@ lwderror.@O@ lwdgabn.@O@ \
@ -209,7 +211,7 @@ index c0861f6..df80f81 100644
 
 UOBJS =		unix/os.@O@ unix/dlz_dlopen_driver.@O@
 
-@@ -106,8 +105,7 @@ SRCS =		builtin.c client.c config.c control.c \
+@@ -113,8 +112,7 @@ SRCS =		builtin.c client.c config.c control.c \
 		tkeyconf.c tsigconf.c update.c xfrout.c \
 		zoneconf.c \
 		lwaddr.c lwresd.c lwdclient.c lwderror.c lwdgabn.c \
@ -219,7 +221,7 @@ index c0861f6..df80f81 100644
 
 MANPAGES =	named.8 lwresd.8 named.conf.5
 
-@@ -146,21 +144,21 @@ server.@O@: server.c
+@@ -154,21 +152,21 @@ server.@O@: server.c
 		-DPRODUCT=\"${PRODUCT}\" \
 		-DVERSION=\"${VERSION}\" -c ${srcdir}/server.c
 
@ -245,7 +247,7 @@ index c0861f6..df80f81 100644
 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} \
 		-o $@ feature-test.@O@ ${ISCLIBS} ${LIBS}
 
-@@ -193,16 +191,11 @@ install-man8: named.8 lwresd.8
+@@ -201,16 +199,11 @@ install-man8: named.8 lwresd.8
 
 install-man: install-man5 install-man8
 
@ -266,15 +268,15 @@ index c0861f6..df80f81 100644
 @DLZ_DRIVER_RULES@
 
 diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
-index c0861f6..04dea99 100644
+index 70e5571..4cfed4d 100644
 --- a/bin/named/Makefile.in
 +++ b/bin/named/Makefile.in
-@@ -47,7 +47,7 @@ CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
- 		${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} ${ISC_INCLUDES} \
- 		${DLZDRIVER_INCLUDES} ${DBDRIVER_INCLUDES} @DST_OPENSSL_INC@
+@@ -48,7 +48,7 @@ CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
+ 		${DLZDRIVER_INCLUDES} ${DBDRIVER_INCLUDES} ${MAXMINDDB_CFLAGS} \
+ 		@DST_OPENSSL_INC@
 
-CDEFINES =      @CONTRIB_DLZ@ @USE_PKCS11@ @PKCS11_ENGINE@ @CRYPTO@
-+CDEFINES =      @CONTRIB_DLZ@ @CRYPTO@
+-CDEFINES =      @CONTRIB_DLZ@ @USE_PKCS11@ @PKCS11_ENGINE@ @USE_GSSAPI@ @CRYPTO@
+CDEFINES =      @CONTRIB_DLZ@ @USE_GSSAPI@ @CRYPTO@
 
 CWARNINGS =
 
@ -300,10 +302,10 @@ index a058c91..d4b689a 100644
 DEPLIBS =	${ISCDEPLIBS}
 
 diff --git a/configure.ac b/configure.ac
-index 5e1ba8c..7aff0e6 100644
+index 9b7d778..59ba20b 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -1070,12 +1070,14 @@ AC_SUBST(USE_GSSAPI)
+@@ -1139,12 +1139,14 @@ AC_SUBST(USE_GSSAPI)
 AC_SUBST(DST_GSSAPI_INC)
 AC_SUBST(DNS_GSSAPI_LIBS)
 DNS_CRYPTO_LIBS="$DNS_GSSAPI_LIBS $DNS_CRYPTO_LIBS"
@ -318,10 +320,10 @@ index 5e1ba8c..7aff0e6 100644
 
 #
 # was --with-randomdev specified?
-@@ -1460,11 +1462,11 @@ fi
+@@ -1494,11 +1496,11 @@ AC_ARG_ENABLE(openssl-hash,
 AC_MSG_CHECKING(for OpenSSL library)
 OPENSSL_WARNING=
- openssldirs="/usr /usr/local /usr/local/ssl /usr/pkg /usr/sfw"
+ openssldirs="/usr /usr/local /usr/local/ssl /opt/local /usr/pkg /usr/sfw"
 -if test "yes" = "$want_native_pkcs11"
 -then
 -	use_openssl="native_pkcs11"
@ -335,7 +337,7 @@ index 5e1ba8c..7aff0e6 100644
 
 if test "auto" = "$use_openssl"
 then
-@@ -1477,6 +1479,7 @@ then
+@@ -1511,6 +1513,7 @@ then
 		fi
 	done
 fi
@ -343,7 +345,7 @@ index 5e1ba8c..7aff0e6 100644
 OPENSSL_ECDSA=""
 OPENSSL_GOST=""
 OPENSSL_ED25519=""
-@@ -1498,11 +1501,10 @@ case "$with_gost" in
+@@ -1532,11 +1535,10 @@ case "$with_gost" in
 		;;
 esac
 
@ -358,7 +360,7 @@ index 5e1ba8c..7aff0e6 100644
 		CRYPTOLIB="pkcs11"
 		OPENSSLECDSALINKOBJS=""
 		OPENSSLECDSALINKSRCS=""
-@@ -1512,7 +1514,9 @@ case "$use_openssl" in
+@@ -1546,7 +1548,9 @@ case "$use_openssl" in
 		OPENSSLGOSTLINKSRCS=""
 		OPENSSLLINKOBJS=""
 		OPENSSLLINKSRCS=""
@ -369,7 +371,7 @@ index 5e1ba8c..7aff0e6 100644
 	no)
 		AC_MSG_RESULT(no)
 		DST_OPENSSL_INC=""
-@@ -1544,7 +1548,7 @@ case "$use_openssl" in
+@@ -1578,7 +1582,7 @@ case "$use_openssl" in
 If you do not want OpenSSL, use --without-openssl])
 		;;
 	*)
@ -378,7 +380,7 @@ index 5e1ba8c..7aff0e6 100644
 		then
 			AC_MSG_RESULT()
 			AC_MSG_ERROR([OpenSSL and native PKCS11 cannot be used together.])
-@@ -1972,6 +1976,7 @@ AC_SUBST(OPENSSL_ED25519)
+@@ -2006,6 +2010,7 @@ AC_SUBST(OPENSSL_ED25519)
 AC_SUBST(OPENSSL_GOST)
 
 DNS_CRYPTO_LIBS="$DNS_CRYPTO_LIBS $DST_OPENSSL_LIBS"
@ -386,7 +388,7 @@ index 5e1ba8c..7aff0e6 100644
 
 ISC_PLATFORM_WANTAES="#undef ISC_PLATFORM_WANTAES"
 if test "yes" = "$with_aes"
-@@ -2295,6 +2300,7 @@ esac
+@@ -2291,6 +2296,7 @@ esac
 AC_SUBST(PKCS11LINKOBJS)
 AC_SUBST(PKCS11LINKSRCS)
 AC_SUBST(CRYPTO)
@ -394,7 +396,7 @@ index 5e1ba8c..7aff0e6 100644
 AC_SUBST(PKCS11_ECDSA)
 AC_SUBST(PKCS11_GOST)
 AC_SUBST(PKCS11_ED25519)
-@@ -5425,8 +5431,11 @@ AC_CONFIG_FILES([
+@@ -5405,8 +5411,11 @@ AC_CONFIG_FILES([
 	bin/delv/Makefile
 	bin/dig/Makefile
 	bin/dnssec/Makefile
@ -406,7 +408,7 @@ index 5e1ba8c..7aff0e6 100644
 	bin/nsupdate/Makefile
 	bin/pkcs11/Makefile
 	bin/python/Makefile
-@@ -5499,6 +5508,10 @@ AC_CONFIG_FILES([
+@@ -5479,6 +5488,10 @@ AC_CONFIG_FILES([
 	lib/dns/include/dns/Makefile
 	lib/dns/include/dst/Makefile
 	lib/dns/tests/Makefile
@ -417,7 +419,7 @@ index 5e1ba8c..7aff0e6 100644
 	lib/irs/Makefile
 	lib/irs/include/Makefile
 	lib/irs/include/irs/Makefile
-@@ -5523,6 +5536,24 @@ AC_CONFIG_FILES([
+@@ -5503,6 +5516,24 @@ AC_CONFIG_FILES([
 	lib/isc/unix/include/Makefile
 	lib/isc/unix/include/isc/Makefile
 	lib/isc/unix/include/pkcs11/Makefile
@ -456,17 +458,18 @@ index 81270a0..bcb5312 100644
 
 @BIND9_MAKE_RULES@
 diff --git a/lib/dns-pkcs11/Makefile.in b/lib/dns-pkcs11/Makefile.in
-index 068bbac..d7f3d95 100644
+index 7f09bd6..c388d9e 100644
 --- a/lib/dns-pkcs11/Makefile.in
 +++ b/lib/dns-pkcs11/Makefile.in
-@@ -26,16 +26,16 @@ VERSION=@BIND9_VERSION@
+@@ -26,17 +26,16 @@ VERSION=@BIND9_VERSION@
 
 USE_ISC_SPNEGO = @USE_ISC_SPNEGO@
 
 -CINCLUDES =	-I. -I${top_srcdir}/lib/dns -Iinclude ${DNS_INCLUDES} \
-		${ISC_INCLUDES} @DST_OPENSSL_INC@ @DST_GSSAPI_INC@
+-		${ISC_INCLUDES} ${MAXMINDDB_CFLAGS} \
+-		@DST_OPENSSL_INC@ @DST_GSSAPI_INC@
 +CINCLUDES =	-I. -I${top_srcdir}/lib/dns-pkcs11 -Iinclude ${DNS_PKCS11_INCLUDES} \
-+		${ISC_PKCS11_INCLUDES} @DST_OPENSSL_INC@ @DST_GSSAPI_INC@
+		${ISC_PKCS11_INCLUDES} ${MAXMINDDB_CFLAGS} @DST_OPENSSL_INC@ @DST_GSSAPI_INC@
 
 -CDEFINES =	-DUSE_MD5 @CRYPTO@ @USE_GSSAPI@ ${USE_ISC_SPNEGO}
 +CDEFINES =	-DUSE_MD5 @CRYPTO_PK11@ @USE_GSSAPI@ ${USE_ISC_SPNEGO}
@ -479,9 +482,9 @@ index 068bbac..d7f3d95 100644
 -ISCDEPLIBS =	../../lib/isc/libisc.@A@
 +ISCDEPLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
 
- LIBS =		@LIBS@
+ LIBS =		${MAXMINDDB_LIBS} @LIBS@
 
-@@ -146,15 +146,15 @@ version.@O@: version.c
+@@ -150,15 +149,15 @@ version.@O@: version.c
 		-DLIBAGE=${LIBAGE} \
 		-c ${srcdir}/version.c
 
@ -501,13 +504,9 @@ index 068bbac..d7f3d95 100644
 
 include: gen
 	${MAKE} include/dns/enumtype.h
-@@ -180,25 +180,25 @@ code.h:	gen
- 	./gen -s ${srcdir} > code.h || { rm -f $@ ; exit 1; }
- 
- gen: gen.c
-	${BUILD_CC} ${BUILD_CFLAGS} -I${top_srcdir}/lib/isc/include \
-+	${BUILD_CC} ${BUILD_CFLAGS} -I${top_srcdir}/lib/isc-pkcs11/include \
- 	${BUILD_CPPFLAGS} ${BUILD_LDFLAGS} -o $@ ${srcdir}/gen.c ${BUILD_LIBS}
+@@ -189,22 +188,22 @@ gen: gen.c
+ 	${BUILD_CPPFLAGS} ${BUILD_LDFLAGS} -o $@ ${srcdir}/gen.c \
+ 	${BUILD_LIBS} ${LFS_LIBS}
 
 -timestamp: include libdns.@A@
 +timestamp: include libdns-pkcs11.@A@
@ -532,9 +531,9 @@ index 068bbac..d7f3d95 100644
 +	rm -f libdns-pkcs11.@A@ timestamp
 	rm -f gen code.h include/dns/enumtype.h include/dns/enumclass.h
 	rm -f include/dns/rdatastruct.h
- 	rm -f dnstap.pb-c.c dnstap.pb-c.h include/dns/dnstap.pb-c.h
+ 	rm -f dnstap.pb-c.c dnstap.pb-c.h
 diff --git a/lib/isc-pkcs11/Makefile.in b/lib/isc-pkcs11/Makefile.in
-index 98acfff..2fd6981 100644
+index 8ad54bb..a3ecdfb 100644
 --- a/lib/isc-pkcs11/Makefile.in
 +++ b/lib/isc-pkcs11/Makefile.in
@@ -23,8 +23,8 @@ CINCLUDES =	-I${srcdir}/unix/include \
--- a/bind-9.10-sdb.patch
+++ b/bind-9.10-sdb.patch
@ -14,7 +14,7 @@ index ce7a2da..4e6a824 100644
 
 @BIND9_MAKE_RULES@
 diff --git a/bin/named-sdb/Makefile.in b/bin/named-sdb/Makefile.in
-index 04dea99..4ff053e 100644
+index 4cfed4d..c6b42b2 100644
 --- a/bin/named-sdb/Makefile.in
 +++ b/bin/named-sdb/Makefile.in
@@ -30,10 +30,10 @@ VERSION=@BIND9_VERSION@
@ -31,7 +31,7 @@ index 04dea99..4ff053e 100644
 
 DLZ_DRIVER_DIR =	${top_srcdir}/contrib/dlz/drivers
 
-@@ -79,7 +79,7 @@ NOSYMLIBS =	${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
+@@ -80,7 +80,7 @@ NOSYMLIBS =	${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
 
 SUBDIRS =	unix
 
@ -39,8 +39,8 @@ index 04dea99..4ff053e 100644
 +TARGETS =	named-sdb@EXEEXT@ feature-test-sdb@EXEEXT@
 
 GEOIPLINKOBJS = geoip.@O@
- 
-@@ -146,7 +146,7 @@ server.@O@: server.c
+ GEOIP2LINKOBJS = geoip.@O@
+@@ -154,7 +154,7 @@ server.@O@: server.c
 		-DPRODUCT=\"${PRODUCT}\" \
 		-DVERSION=\"${VERSION}\" -c ${srcdir}/server.c
 
@ -49,7 +49,7 @@ index 04dea99..4ff053e 100644
 	export MAKE_SYMTABLE="yes"; \
 	export BASEOBJS="${OBJS} ${UOBJS}"; \
 	${FINALBUILDCMD}
-@@ -160,7 +160,7 @@ feature-test.@O@: ${top_srcdir}/bin/tests/system/feature-test.c
+@@ -168,7 +168,7 @@ feature-test.@O@: ${top_srcdir}/bin/tests/system/feature-test.c
 	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} \
 		-c ${top_srcdir}/bin/tests/system/feature-test.c
 
@ -58,7 +58,7 @@ index 04dea99..4ff053e 100644
 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} \
 		-o $@ feature-test.@O@ ${ISCLIBS} ${LIBS}
 
-@@ -182,8 +182,6 @@ statschannel.@O@: bind9.xsl.h
+@@ -190,8 +190,6 @@ statschannel.@O@: bind9.xsl.h
 
 installdirs:
 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
@ -67,7 +67,7 @@ index 04dea99..4ff053e 100644
 
 install-man5: named.conf.5
 	${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man5
-@@ -193,16 +191,11 @@ install-man8: named.8 lwresd.8
+@@ -201,16 +199,11 @@ install-man8: named.8 lwresd.8
 
 install-man: install-man5 install-man8
 
@ -88,7 +88,7 @@ index 04dea99..4ff053e 100644
 @DLZ_DRIVER_RULES@
 
 diff --git a/bin/named-sdb/main.c b/bin/named-sdb/main.c
-index 17f2daa..1bb9d79 100644
+index 108b8d6..a943421 100644
 --- a/bin/named-sdb/main.c
 +++ b/bin/named-sdb/main.c
@@ -93,6 +93,10 @@
@ -102,7 +102,7 @@ index 17f2daa..1bb9d79 100644
 
 #ifdef CONTRIB_DLZ
 /*
-@@ -1063,6 +1067,11 @@ setup(void) {
+@@ -1069,6 +1073,11 @@ setup(void) {
 		ns_main_earlyfatal("isc_app_start() failed: %s",
 				   isc_result_totext(result));
 
@ -114,7 +114,7 @@ index 17f2daa..1bb9d79 100644
 	isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
 		      ISC_LOG_NOTICE, "starting %s %s%s%s <id:%s>",
 		      ns_g_product, ns_g_version,
-@@ -1263,6 +1272,75 @@ setup(void) {
+@@ -1269,6 +1278,75 @@ setup(void) {
 				   isc_result_totext(result));
 #endif
 
@ -190,7 +190,7 @@ index 17f2daa..1bb9d79 100644
 	ns_server_create(ns_g_mctx, &ns_g_server);
 
 #ifdef HAVE_LIBSECCOMP
-@@ -1305,6 +1383,11 @@ cleanup(void) {
+@@ -1311,6 +1389,11 @@ cleanup(void) {
 
 	dns_name_destroy();
 
@ -203,22 +203,23 @@ index 17f2daa..1bb9d79 100644
 		      ISC_LOG_NOTICE, "exiting");
 	ns_log_shutdown();
 diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
-index 04dea99..9ed9637 100644
+index 4cfed4d..f4bce7b 100644
 --- a/bin/named/Makefile.in
 +++ b/bin/named/Makefile.in
-@@ -45,9 +45,9 @@ DLZDRIVER_LIBS =	@DLZ_DRIVER_LIBS@
+@@ -45,10 +45,10 @@ DLZDRIVER_LIBS =	@DLZ_DRIVER_LIBS@
 CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
 		${LWRES_INCLUDES} ${DNS_INCLUDES} ${BIND9_INCLUDES} \
 		${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} ${ISC_INCLUDES} \
-		${DLZDRIVER_INCLUDES} ${DBDRIVER_INCLUDES} @DST_OPENSSL_INC@
-+		@DST_OPENSSL_INC@
+-		${DLZDRIVER_INCLUDES} ${DBDRIVER_INCLUDES} ${MAXMINDDB_CFLAGS} \
+		${MAXMINDDB_CFLAGS} \
+ 		@DST_OPENSSL_INC@
 
-CDEFINES =      @CONTRIB_DLZ@ @CRYPTO@
-+CDEFINES =      @CRYPTO@
+-CDEFINES =      @CONTRIB_DLZ@ @USE_GSSAPI@ @CRYPTO@
+CDEFINES =      @USE_GSSAPI@ @CRYPTO@
 
 CWARNINGS =
 
-@@ -71,11 +71,11 @@ DEPLIBS =	${LWRESDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
+@@ -72,11 +72,11 @@ DEPLIBS =	${LWRESDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
 
 LIBS =		${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
 		${ISCCFGLIBS} ${ISCCCLIBS} ${ISCLIBS} \
@ -232,7 +233,7 @@ index 04dea99..9ed9637 100644
 
 SUBDIRS =	unix
 
-@@ -90,8 +90,7 @@ OBJS =		builtin.@O@ client.@O@ config.@O@ control.@O@ \
+@@ -94,8 +94,7 @@ OBJS =		builtin.@O@ client.@O@ config.@O@ control.@O@ \
 		tkeyconf.@O@ tsigconf.@O@ update.@O@ xfrout.@O@ \
 		zoneconf.@O@ \
 		lwaddr.@O@ lwresd.@O@ lwdclient.@O@ lwderror.@O@ lwdgabn.@O@ \
@ -242,7 +243,7 @@ index 04dea99..9ed9637 100644
 
 UOBJS =		unix/os.@O@ unix/dlz_dlopen_driver.@O@
 
-@@ -106,8 +105,7 @@ SRCS =		builtin.c client.c config.c control.c \
+@@ -113,8 +112,7 @@ SRCS =		builtin.c client.c config.c control.c \
 		tkeyconf.c tsigconf.c update.c xfrout.c \
 		zoneconf.c \
 		lwaddr.c lwresd.c lwdclient.c lwderror.c lwdgabn.c \
@ -252,7 +253,7 @@ index 04dea99..9ed9637 100644
 
 MANPAGES =	named.8 lwresd.8 named.conf.5
 
-@@ -204,7 +202,5 @@ uninstall::
+@@ -212,7 +210,5 @@ uninstall::
 	rm -f ${DESTDIR}${sbindir}/lwresd@EXEEXT@
 	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/named@EXEEXT@
 
@ -296,10 +297,10 @@ index c7e0868..95ab742 100644
 +	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zone2sqlite@EXEEXT@ ${DESTDIR}${sbindir}
 	${INSTALL_DATA} ${srcdir}/zone2ldap.1 ${DESTDIR}${mandir}/man1/zone2ldap.1
 diff --git a/configure.ac b/configure.ac
-index 8374385..0af9b71 100644
+index f6380b1..318e533 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -5436,6 +5436,8 @@ AC_CONFIG_FILES([
+@@ -5416,6 +5416,8 @@ AC_CONFIG_FILES([
 	bin/named/unix/Makefile
 	bin/named-pkcs11/Makefile
 	bin/named-pkcs11/unix/Makefile
@ -308,7 +309,7 @@ index 8374385..0af9b71 100644
 	bin/nsupdate/Makefile
 	bin/pkcs11/Makefile
 	bin/python/Makefile
-@@ -5460,6 +5462,7 @@ AC_CONFIG_FILES([
+@@ -5440,6 +5442,7 @@ AC_CONFIG_FILES([
 	bin/python/isc/tests/dnskey_test.py
 	bin/python/isc/tests/policy_test.py
 	bin/rndc/Makefile
--- a/bind-9.11-CVE-2018-5741-atomic.patch
+++ b/bind-9.11-CVE-2018-5741-atomic.patch
@ -1,132 +0,0 @@
-From ef49780d30d3ddc5735cfc32561b678a634fa72f Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@sury.org>
-Date: Wed, 17 Apr 2019 15:22:27 +0200
-Subject: [PATCH] Replace atomic operations in bin/named/client.c with
- isc_refcount reference counting
-
---
- bin/named/client.c                     | 18 +++++++-----------
- bin/named/include/named/interfacemgr.h |  5 +++--
- bin/named/interfacemgr.c               |  7 +++++--
- 3 files changed, 15 insertions(+), 15 deletions(-)
-
-diff --git a/bin/named/client.c b/bin/named/client.c
-index 845326abc0..29fecadca8 100644
--- a/bin/named/client.c
-+++ b/bin/named/client.c
-@@ -402,12 +402,10 @@ tcpconn_detach(ns_client_t *client) {
- static void
- mark_tcp_active(ns_client_t *client, bool active) {
- 	if (active && !client->tcpactive) {
-		isc_atomic_xadd(&client->interface->ntcpactive, 1);
-+		isc_refcount_increment0(&client->interface->ntcpactive, NULL);
- 		client->tcpactive = active;
- 	} else if (!active && client->tcpactive) {
-		uint32_t old =
-			isc_atomic_xadd(&client->interface->ntcpactive, -1);
-		INSIST(old > 0);
-+		isc_refcount_decrement(&client->interface->ntcpactive, NULL);
- 		client->tcpactive = active;
- 	}
- }
-@@ -554,7 +552,7 @@ exit_check(ns_client_t *client) {
- 		if (client->mortal && TCP_CLIENT(client) &&
- 		    client->newstate != NS_CLIENTSTATE_FREED &&
- 		    !ns_g_clienttest &&
-		    isc_atomic_xadd(&client->interface->ntcpaccepting, 0) == 0)
-+		    isc_refcount_current(&client->interface->ntcpaccepting) == 0)
- 		{
- 			/* Nobody else is accepting */
- 			client->mortal = false;
-@@ -3328,7 +3326,6 @@ client_newconn(isc_task_t *task, isc_event_t *event) {
- 	isc_result_t result;
- 	ns_client_t *client = event->ev_arg;
- 	isc_socket_newconnev_t *nevent = (isc_socket_newconnev_t *)event;
-	uint32_t old;
- 
- 	REQUIRE(event->ev_type == ISC_SOCKEVENT_NEWCONN);
- 	REQUIRE(NS_CLIENT_VALID(client));
-@@ -3348,8 +3345,7 @@ client_newconn(isc_task_t *task, isc_event_t *event) {
- 	INSIST(client->naccepts == 1);
- 	client->naccepts--;
- 
-	old = isc_atomic_xadd(&client->interface->ntcpaccepting, -1);
-	INSIST(old > 0);
-+	isc_refcount_decrement(&client->interface->ntcpaccepting, NULL);
- 
- 	/*
- 	 * We must take ownership of the new socket before the exit
-@@ -3480,8 +3476,8 @@ client_accept(ns_client_t *client) {
- 		 * quota is tcp-clients plus the number of listening
- 		 * interfaces plus 1.)
- 		 */
-		exit = (isc_atomic_xadd(&client->interface->ntcpactive, 0) >
-			(client->tcpactive ? 1 : 0));
-+		exit = (isc_refcount_current(&client->interface->ntcpactive) >
-+			(client->tcpactive ? 1U : 0U));
- 		if (exit) {
- 			client->newstate = NS_CLIENTSTATE_INACTIVE;
- 			(void)exit_check(client);
-@@ -3539,7 +3535,7 @@ client_accept(ns_client_t *client) {
- 	 * listening for connections itself to prevent the interface
- 	 * going dead.
- 	 */
-	isc_atomic_xadd(&client->interface->ntcpaccepting, 1);
-+	isc_refcount_increment0(&client->interface->ntcpaccepting, NULL);
- }
- 
- static void
-diff --git a/bin/named/include/named/interfacemgr.h b/bin/named/include/named/interfacemgr.h
-index 3535ef22a8..6e10f210fd 100644
--- a/bin/named/include/named/interfacemgr.h
-+++ b/bin/named/include/named/interfacemgr.h
-@@ -45,6 +45,7 @@
- #include <isc/magic.h>
- #include <isc/mem.h>
- #include <isc/socket.h>
-+#include <isc/refcount.h>
- 
- #include <dns/result.h>
- 
-@@ -75,11 +76,11 @@ struct ns_interface {
- 						/*%< UDP dispatchers. */
- 	isc_socket_t *		tcpsocket;	/*%< TCP socket. */
- 	isc_dscp_t		dscp;		/*%< "listen-on" DSCP value */
-	int32_t			ntcpaccepting;	/*%< Number of clients
-+	isc_refcount_t		ntcpaccepting;	/*%< Number of clients
- 						     ready to accept new
- 						     TCP connections on this
- 						     interface */
-	int32_t			ntcpactive;	/*%< Number of clients
-+	isc_refcount_t		ntcpactive;	/*%< Number of clients
- 						     servicing TCP queries
- 						     (whether accepting or
- 						     connected) */
-diff --git a/bin/named/interfacemgr.c b/bin/named/interfacemgr.c
-index d9f6df5802..135533be6b 100644
--- a/bin/named/interfacemgr.c
-+++ b/bin/named/interfacemgr.c
-@@ -386,8 +386,8 @@ ns_interface_create(ns_interfacemgr_t *mgr, isc_sockaddr_t *addr,
- 	 * connections will be handled in parallel even though there is
- 	 * only one client initially.
- 	 */
-	ifp->ntcpaccepting = 0;
-	ifp->ntcpactive = 0;
-+	isc_refcount_init(&ifp->ntcpaccepting, 0);
-+	isc_refcount_init(&ifp->ntcpactive, 0);
- 
- 	ifp->nudpdispatch = 0;
- 
-@@ -618,6 +618,9 @@ ns_interface_destroy(ns_interface_t *ifp) {
- 
- 	ns_interfacemgr_detach(&ifp->mgr);
- 
-+	isc_refcount_destroy(&ifp->ntcpactive);
-+	isc_refcount_destroy(&ifp->ntcpaccepting);
-+
- 	ifp->magic = 0;
- 	isc_mem_put(mctx, ifp, sizeof(*ifp));
- }
-- 
-2.18.1
-
--- a/bind-9.11-engine-pkcs11.patch
+++ b/bind-9.11-engine-pkcs11.patch
@ -0,0 +1,27 @@
+From 37f89ccfc439f8d86c401d9ae10e94e53b924961 Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Tue, 27 Aug 2019 20:39:59 +0200
+Subject: [PATCH] Do not set engine for native PKCS11
+
+It resets already set lib_path to pkcs11, which is invalid in native
+pkcs11 crypto. Engine has to be path to PKCS#11 module.
+---
+ bin/named/include/named/globals.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/bin/named/include/named/globals.h b/bin/named/include/named/globals.h
+index eda2214..2a611d5 100644
+--- a/bin/named/include/named/globals.h
+++ b/bin/named/include/named/globals.h
+@@ -160,7 +160,7 @@ EXTERN const char *		ns_g_defaultdnstap	INIT(NULL);
+ 
+ EXTERN const char *		ns_g_username		INIT(NULL);
+ 
+-#if defined(USE_PKCS11)
+#if defined(USE_PKCS11) && !defined(PKCS11CRYPTO)
+ EXTERN const char *		ns_g_engine		INIT(PKCS11_ENGINE);
+ #else
+ EXTERN const char *		ns_g_engine		INIT(NULL);
+-- 
+2.20.1
+
--- a/bind-9.11-feature-test-dlz.patch
+++ b/bind-9.11-feature-test-dlz.patch
@ -1,85 +0,0 @@
-From 71627db6c8852d7805ec559506f5f3cb8d89a131 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Wed, 30 Jan 2019 15:12:54 +0100
-Subject: [PATCH] Support DLZ filesystem detection in feature-test
-
-Do not use variable from configure to detect the feature.
---
- bin/tests/system/Makefile.in                     | 2 +-
- bin/tests/system/dlz/{prereq.sh.in => prereq.sh} | 2 +-
- bin/tests/system/feature-test.c                  | 9 +++++++++
- configure.ac                                     | 1 -
- 4 files changed, 11 insertions(+), 3 deletions(-)
- rename bin/tests/system/dlz/{prereq.sh.in => prereq.sh} (91%)
-
-diff --git a/bin/tests/system/Makefile.in b/bin/tests/system/Makefile.in
-index c18b4c5..dea2f75 100644
--- a/bin/tests/system/Makefile.in
-+++ b/bin/tests/system/Makefile.in
-@@ -19,7 +19,7 @@ SUBDIRS =	dlzexternal dyndb lwresd pipelined rndc rsabigexponent tkey
- 
- CINCLUDES =	${ISC_INCLUDES} ${DNS_INCLUDES}
- 
-CDEFINES =	@USE_GSSAPI@
-+CDEFINES =	@USE_GSSAPI@ @CONTRIB_DLZ@
- CWARNINGS =
- 
- DNSLIBS =
-diff --git a/bin/tests/system/dlz/prereq.sh.in b/bin/tests/system/dlz/prereq.sh
-similarity index 91%
-rename from bin/tests/system/dlz/prereq.sh.in
-rename to bin/tests/system/dlz/prereq.sh
-index afec653..fb3328e 100644
--- a/bin/tests/system/dlz/prereq.sh.in
-+++ b/bin/tests/system/dlz/prereq.sh
-@@ -12,7 +12,7 @@
- SYSTEMTESTTOP=..
- . $SYSTEMTESTTOP/conf.sh
- 
-if [ "@DLZ_SYSTEM_TEST@" != "filesystem" ]; then
-+if ! $FEATURETEST --with-dlz-filesystem; then
-         echo_i "DLZ filesystem driver not supported"
-         exit 255
- fi
-diff --git a/bin/tests/system/feature-test.c b/bin/tests/system/feature-test.c
-index 11863a3..428d107 100644
--- a/bin/tests/system/feature-test.c
-+++ b/bin/tests/system/feature-test.c
-@@ -51,6 +51,7 @@ usage() {
- 	fprintf(stderr, "	--rpz-nsip\n");
- 	fprintf(stderr, "	--with-idn\n");
- 	fprintf(stderr, "	--with-lmdb\n");
-+	fprintf(stderr, "	--with-dlz-filesystem\n");
- }
- 
- int
-@@ -182,6 +183,14 @@ main(int argc, char **argv) {
- #endif
- 	}
- 
-+	if (strcmp(argv[1], "--with-dlz-filesystem") == 0) {
-+#ifdef DLZ_FILESYSTEM
-+		return (0);
-+#else
-+		return (1);
-+#endif
-+	}
-+
- 	if (strcmp(argv[1], "--ipv6only=no") == 0) {
- #ifdef WIN32
- 		return (0);
-diff --git a/configure.ac b/configure.ac
-index fddc63a..5e1ba8c 100644
--- a/configure.ac
-+++ b/configure.ac
-@@ -5458,7 +5458,6 @@ AC_CONFIG_FILES([
- 	bin/tests/pkcs11/benchmarks/Makefile
- 	bin/tests/system/Makefile
- 	bin/tests/system/conf.sh
-	bin/tests/system/dlz/prereq.sh
- 	bin/tests/system/dlzexternal/Makefile
- 	bin/tests/system/dlzexternal/ns1/dlzs.conf
- 	bin/tests/system/dyndb/Makefile
-- 
-2.20.1
-
--- a/bind-9.11-feature-test-named.patch
+++ b/bind-9.11-feature-test-named.patch
@ -1,21 +1,34 @@
-From 4293078b294cbb766abe84d3b1618b1cb5413c82 Mon Sep 17 00:00:00 2001
+From 3f2fafe5368655225eddf0537e58e425bbc297be Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Wed, 30 Jan 2019 14:37:17 +0100
-Subject: [PATCH 2/2] Create feature-test in source directory
+Subject: [PATCH] Create feature-test in source directory

 Feature-test tool is used in system tests to test compiled in changes.
 Because we build more variants of named with different configuration,
 compile feature-test for each of them this way.
+
+Named variant specific feature-test does not have defined gss support,
+even when it was enabled by configure. bin/tests/system Makefile defines
+it, so define it also in named variants.
 ---
- bin/named/Makefile.in       | 11 ++++++++++-
+ bin/named/Makefile.in       | 13 +++++++++++--
 bin/tests/system/conf.sh.in |  2 +-
- 2 files changed, 11 insertions(+), 2 deletions(-)
+ 2 files changed, 12 insertions(+), 3 deletions(-)

 diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
-index 1c413973d0..b31df9a718 100644
+index 3166368..70e5571 100644
 --- a/bin/named/Makefile.in
 +++ b/bin/named/Makefile.in
-@@ -79,7 +79,7 @@ NOSYMLIBS =	${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
+@@ -48,7 +48,7 @@ CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
+ 		${DLZDRIVER_INCLUDES} ${DBDRIVER_INCLUDES} ${MAXMINDDB_CFLAGS} \
+ 		@DST_OPENSSL_INC@
+ 
+-CDEFINES =      @CONTRIB_DLZ@ @USE_PKCS11@ @PKCS11_ENGINE@ @CRYPTO@
+CDEFINES =      @CONTRIB_DLZ@ @USE_PKCS11@ @PKCS11_ENGINE@ @USE_GSSAPI@ @CRYPTO@
+ 
+ CWARNINGS =
+ 
+@@ -80,7 +80,7 @@ NOSYMLIBS =	${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
 
 SUBDIRS =	unix
 
@ -23,8 +36,8 @@ index 1c413973d0..b31df9a718 100644
 +TARGETS =	named@EXEEXT@ lwresd@EXEEXT@ feature-test@EXEEXT@
 
 GEOIPLINKOBJS = geoip.@O@
- 
-@@ -151,6 +151,15 @@ lwresd@EXEEXT@: named@EXEEXT@
+ GEOIP2LINKOBJS = geoip.@O@
+@@ -163,6 +163,15 @@ lwresd@EXEEXT@: named@EXEEXT@
 	rm -f lwresd@EXEEXT@
 	@LN@ named@EXEEXT@ lwresd@EXEEXT@
 
@ -41,10 +54,10 @@ index 1c413973d0..b31df9a718 100644
 
 docclean manclean maintainer-clean::
 diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
-index 2236f0a151..b072af8467 100644
+index cedabbe..e1bf5da 100644
 --- a/bin/tests/system/conf.sh.in
 +++ b/bin/tests/system/conf.sh.in
-@@ -64,7 +64,7 @@ DNSTAPREAD=$TOP/bin/tools/dnstap-read
+@@ -71,7 +71,7 @@ DNSTAPREAD=$TOP/bin/tools/dnstap-read
 MDIG=$TOP/bin/tools/mdig
 NZD2NZF=$TOP/bin/tools/named-nzd2nzf
 FSTRM_CAPTURE=@FSTRM_CAPTURE@
--- a/bind-9.11-fips-code.patch
+++ b/bind-9.11-fips-code.patch
@ -1,4 +1,4 @@
-From 9ff202072b286ef57e0ffcd7c55777f2994d3985 Mon Sep 17 00:00:00 2001
+From eff6dcb62f3cea6df0a848c2220a49bc02cb4a0e Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 2 Aug 2018 23:34:45 +0200
 Subject: [PATCH] FIPS code changes
@ -241,7 +241,7 @@ index 5ca3d76..6b7790a 100644
 	port = DEFAULT_PORT;
 
 diff --git a/bin/dig/dig.c b/bin/dig/dig.c
-index 2063a3b..8e856c5 100644
+index 706299e..aaf22e7 100644
 --- a/bin/dig/dig.c
 +++ b/bin/dig/dig.c
@@ -20,6 +20,7 @@
@ -252,7 +252,7 @@ index 2063a3b..8e856c5 100644
 #include <isc/netaddr.h>
 #include <isc/parseint.h>
 #include <isc/platform.h>
-@@ -1767,10 +1768,10 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
+@@ -1774,10 +1775,10 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 			ptr = ptr2;
 			ptr2 = ptr3;
 		} else  {
@ -267,7 +267,7 @@ index 2063a3b..8e856c5 100644
 			digestbits = 0;
 		}
 diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
-index 011b118..5eabc1f 100644
+index 93e5b40..afd2700 100644
 --- a/bin/dig/dighost.c
 +++ b/bin/dig/dighost.c
@@ -80,6 +80,7 @@
@ -339,7 +339,7 @@ index 1476d0d..f5c9316 100644
 			alg = DST_ALG_HMACMD5;
 #else
 diff --git a/bin/named/config.c b/bin/named/config.c
-index 7584efb..a153172 100644
+index 32c454a..dff826b 100644
 --- a/bin/named/config.c
 +++ b/bin/named/config.c
@@ -18,6 +18,7 @@
@ -350,7 +350,7 @@ index 7584efb..a153172 100644
 #include <isc/mem.h>
 #include <isc/parseint.h>
 #include <isc/region.h>
-@@ -969,6 +970,21 @@ ns_config_getkeyalgorithm(const char *str, dns_name_t **name,
+@@ -974,6 +975,21 @@ ns_config_getkeyalgorithm(const char *str, dns_name_t **name,
 	return (ns_config_getkeyalgorithm2(str, name, NULL, digestbits));
 }
 
@ -372,7 +372,7 @@ index 7584efb..a153172 100644
 isc_result_t
 ns_config_getkeyalgorithm2(const char *str, dns_name_t **name,
 			   unsigned int *typep, uint16_t *digestbits)
-@@ -978,7 +994,7 @@ ns_config_getkeyalgorithm2(const char *str, dns_name_t **name,
+@@ -983,7 +999,7 @@ ns_config_getkeyalgorithm2(const char *str, dns_name_t **name,
 	uint16_t bits;
 	isc_result_t result;
 
@ -381,7 +381,7 @@ index 7584efb..a153172 100644
 		len = strlen(algorithms[i].str);
 		if (strncasecmp(algorithms[i].str, str, len) == 0 &&
 		    (str[len] == '\0' ||
-@@ -1001,7 +1017,12 @@ ns_config_getkeyalgorithm2(const char *str, dns_name_t **name,
+@@ -1006,7 +1022,12 @@ ns_config_getkeyalgorithm2(const char *str, dns_name_t **name,
 	if (name != NULL) {
 		switch (algorithms[i].hmac) {
 #ifndef PK11_MD5_DISABLE
@ -396,7 +396,7 @@ index 7584efb..a153172 100644
 		case hmacsha1: *name = dns_tsig_hmacsha1_name; break;
 		case hmacsha224: *name = dns_tsig_hmacsha224_name; break;
 diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
-index 548e0ce..509784c 100644
+index de60313..bbb3936 100644
 --- a/bin/nsupdate/nsupdate.c
 +++ b/bin/nsupdate/nsupdate.c
@@ -31,6 +31,7 @@
@ -406,8 +406,8 @@ index 548e0ce..509784c 100644
 +#include <isc/md5.h>
 #include <isc/mem.h>
 #include <isc/parseint.h>
- #include <isc/print.h>
-@@ -476,9 +477,10 @@ parse_hmac(dns_name_t **hmac, const char *hmacstr, size_t len,
+ #include <isc/portset.h>
+@@ -477,9 +478,10 @@ parse_hmac(dns_name_t **hmac, const char *hmacstr, size_t len,
 	strlcpy(buf, hmacstr, ISC_MIN(len + 1, sizeof(buf)));
 
 #ifndef PK11_MD5_DISABLE
@ -420,7 +420,7 @@ index 548e0ce..509784c 100644
 		*hmac = DNS_TSIG_HMACMD5_NAME;
 		result = isc_parse_uint16(&digestbits, &buf[9], 10);
 		if (result != ISC_R_SUCCESS || digestbits > 128) {
-@@ -591,10 +593,10 @@ setup_keystr(void) {
+@@ -592,10 +594,10 @@ setup_keystr(void) {
 			exit(1);
 		}
 	} else {
@ -434,7 +434,7 @@ index 548e0ce..509784c 100644
 #endif
 		name = keystr;
 		n = s;
-@@ -731,7 +733,8 @@ setup_keyfile(isc_mem_t *mctx, isc_log_t *lctx) {
+@@ -732,7 +734,8 @@ setup_keyfile(isc_mem_t *mctx, isc_log_t *lctx) {
 	switch (dst_key_alg(dstkey)) {
 #ifndef PK11_MD5_DISABLE
 	case DST_ALG_HMACMD5:
@ -444,7 +444,7 @@ index 548e0ce..509784c 100644
 		break;
 #endif
 	case DST_ALG_HMACSHA1:
-@@ -1606,12 +1609,13 @@ evaluate_key(char *cmdline) {
+@@ -1637,12 +1640,13 @@ evaluate_key(char *cmdline) {
 			return (STATUS_SYNTAX);
 		}
 		namestr = n + 1;
@ -622,7 +622,7 @@ index bde66a4..70a40c3 100644
 	dst_key_free(&dstkey);
 	CHECK("MD5 was disabled", ISC_R_NOTIMPLEMENTED);
 diff --git a/lib/bind9/check.c b/lib/bind9/check.c
-index d6fba22..ac60ba8 100644
+index ec0ab6d..e0803d4 100644
 --- a/lib/bind9/check.c
 +++ b/lib/bind9/check.c
@@ -23,6 +23,7 @@
@ -633,7 +633,7 @@ index d6fba22..ac60ba8 100644
 #include <isc/mem.h>
 #include <isc/netaddr.h>
 #include <isc/parseint.h>
-@@ -2589,6 +2590,15 @@ bind9_check_key(const cfg_obj_t *key, isc_log_t *logctx) {
+@@ -2618,6 +2619,15 @@ bind9_check_key(const cfg_obj_t *key, isc_log_t *logctx) {
 	}
 
 	algorithm = cfg_obj_asstring(algobj);
@ -937,10 +937,10 @@ index 9c42c50..f51d548 100644
 
 void
 diff --git a/lib/dns/tests/rsa_test.c b/lib/dns/tests/rsa_test.c
-index 16214c6..9b235ba 100644
+index f9ac6d0..241e17e 100644
 --- a/lib/dns/tests/rsa_test.c
 +++ b/lib/dns/tests/rsa_test.c
-@@ -26,6 +26,7 @@
+@@ -27,6 +27,7 @@
 #define UNIT_TESTING
 #include <cmocka.h>
 
@ -948,7 +948,7 @@ index 16214c6..9b235ba 100644
 #include <isc/util.h>
 #include <isc/print.h>
 
-@@ -247,6 +248,8 @@ isc_rsa_verify_test(void **state) {
+@@ -248,6 +249,8 @@ isc_rsa_verify_test(void **state) {
 	/* RSAMD5 */
 
 #ifndef PK11_MD5_DISABLE
@ -957,7 +957,7 @@ index 16214c6..9b235ba 100644
 	key->key_alg = DST_ALG_RSAMD5;
 
 	ret = dst_context_create3(key, mctx, DNS_LOGCATEGORY_DNSSEC,
-@@ -264,6 +267,7 @@ isc_rsa_verify_test(void **state) {
+@@ -265,6 +268,7 @@ isc_rsa_verify_test(void **state) {
 	assert_int_equal(ret, ISC_R_SUCCESS);
 
 	dst_context_destroy(&ctx);
@ -966,10 +966,10 @@ index 16214c6..9b235ba 100644
 
 	/* RSASHA256 */
 diff --git a/lib/dns/tests/tsig_test.c b/lib/dns/tests/tsig_test.c
-index 4d6847e..1a208b5 100644
+index 11d011a..feb2068 100644
 --- a/lib/dns/tests/tsig_test.c
 +++ b/lib/dns/tests/tsig_test.c
-@@ -24,6 +24,7 @@
+@@ -25,6 +25,7 @@
 #define UNIT_TESTING
 #include <cmocka.h>
 
@ -1115,7 +1115,7 @@ index 4d29398..e3f5cec 100644
 
 #endif /* !PK11_MD5_DISABLE */
 diff --git a/lib/isc/md5.c b/lib/isc/md5.c
-index 920aed5..a086a57 100644
+index 249f3da..628a414 100644
 --- a/lib/isc/md5.c
 +++ b/lib/isc/md5.c
@@ -37,6 +37,7 @@
@ -1126,7 +1126,7 @@ index 920aed5..a086a57 100644
 #include <isc/platform.h>
 #include <isc/safe.h>
 #include <isc/string.h>
-@@ -55,6 +56,9 @@
+@@ -54,6 +55,9 @@
 #define EVP_MD_CTX_free(ptr) EVP_MD_CTX_cleanup(ptr)
 #endif
 
@ -1136,7 +1136,7 @@ index 920aed5..a086a57 100644
 void
 isc_md5_init(isc_md5_t *ctx) {
 	ctx->ctx = EVP_MD_CTX_new();
-@@ -86,8 +90,33 @@ isc_md5_final(isc_md5_t *ctx, unsigned char *digest) {
+@@ -85,8 +89,33 @@ isc_md5_final(isc_md5_t *ctx, unsigned char *digest) {
 	ctx->ctx = NULL;
 }
 
@ -1170,7 +1170,7 @@ index 920aed5..a086a57 100644
 void
 isc_md5_init(isc_md5_t *ctx) {
 	CK_RV rv;
-@@ -130,6 +159,31 @@ isc_md5_final(isc_md5_t *ctx, unsigned char *digest) {
+@@ -129,6 +158,31 @@ isc_md5_final(isc_md5_t *ctx, unsigned char *digest) {
 	pk11_return_session(ctx);
 }
 
@ -1202,7 +1202,7 @@ index 920aed5..a086a57 100644
 #else
 
 static void
-@@ -339,6 +393,11 @@ isc_md5_final(isc_md5_t *ctx, unsigned char *digest) {
+@@ -338,6 +392,11 @@ isc_md5_final(isc_md5_t *ctx, unsigned char *digest) {
 	memmove(digest, ctx->buf, 16);
 	isc_safe_memwipe(ctx, sizeof(*ctx));	/* In case it's sensitive */
 }
@ -1215,7 +1215,7 @@ index 920aed5..a086a57 100644
 
 /*
 diff --git a/lib/isc/pk11.c b/lib/isc/pk11.c
-index 0d5b009..bb9912b 100644
+index 0d5b009..7809e7b 100644
 --- a/lib/isc/pk11.c
 +++ b/lib/isc/pk11.c
@@ -197,8 +197,6 @@ pk11_initialize(isc_mem_t *mctx, const char *engine) {
@ -1227,14 +1227,14 @@ index 0d5b009..bb9912b 100644
 	}
 
 	ISC_LIST_INIT(tokens);
-@@ -236,6 +234,7 @@ pk11_initialize(isc_mem_t *mctx, const char *engine) {
- 		result = PK11_R_NOAESSERVICE;
- 		goto unlock;
+@@ -238,6 +236,7 @@ pk11_initialize(isc_mem_t *mctx, const char *engine) {
 	}
-+	initialized = true;
 #endif
 #endif /* PKCS11CRYPTO */
+	initialized = true;
  unlock:
+ 	UNLOCK(&sessionlock);
+ 	return (result);
@@ -589,6 +588,8 @@ scan_slots(void) {
 	pk11_token_t *token;
 	unsigned int i;
@ -1334,10 +1334,10 @@ index 0d5b009..bb9912b 100644
 
 		/* ECDSA requires digest */
 diff --git a/lib/isc/tests/hash_test.c b/lib/isc/tests/hash_test.c
-index 8ddfe70..9c4d299 100644
+index 31ced94..421131e 100644
 --- a/lib/isc/tests/hash_test.c
 +++ b/lib/isc/tests/hash_test.c
-@@ -776,6 +776,9 @@ isc_md5_test(void **state) {
+@@ -775,6 +775,9 @@ isc_md5_test(void **state) {
 
 	UNUSED(state);
 
@ -1347,7 +1347,7 @@ index 8ddfe70..9c4d299 100644
 	/*
 	 * These are the various test vectors.  All of these are passed
 	 * through the hash function and the results are compared to the
-@@ -1631,6 +1634,9 @@ isc_hmacmd5_test(void **state) {
+@@ -1630,6 +1633,9 @@ isc_hmacmd5_test(void **state) {
 
 	UNUSED(state);
 
@ -1357,7 +1357,7 @@ index 8ddfe70..9c4d299 100644
 	/*
 	 * These are the various test vectors.  All of these are passed
 	 * through the hash function and the results are compared to the
-@@ -1941,6 +1947,9 @@ static void
+@@ -1940,6 +1946,9 @@ static void
 md5_check_test(void **state) {
 	UNUSED(state);
 
--- a/bind-9.11-fips-disable.patch
+++ b/bind-9.11-fips-disable.patch
@ -0,0 +1,121 @@
+From 83b889c238282b210f874a3ad81bb56299767495 Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Mon, 5 Aug 2019 11:54:03 +0200
+Subject: [PATCH] Allow explicit disabling of autodisabled MD5
+
+Default security policy might include explicitly disabled RSAMD5
+algorithm. Current FIPS code automatically disables in FIPS mode. But if
+RSAMD5 is included in security policy, it fails to start, because that
+algorithm is not recognized. Allow it disabled, but fail on any
+other usage.
+---
+ bin/named/server.c |  4 ++--
+ lib/bind9/check.c  |  4 ++++
+ lib/dns/rcode.c    | 33 +++++++++++++++------------------
+ 3 files changed, 21 insertions(+), 20 deletions(-)
+
+diff --git a/bin/named/server.c b/bin/named/server.c
+index 5b57371..51702ab 100644
+--- a/bin/named/server.c
+++ b/bin/named/server.c
+@@ -1547,12 +1547,12 @@ disable_algorithms(const cfg_obj_t *disabled, dns_resolver_t *resolver) {
+ 		r.length = strlen(r.base);
+ 
+ 		result = dns_secalg_fromtext(&alg, &r);
+-		if (result != ISC_R_SUCCESS) {
+		if (result != ISC_R_SUCCESS && result != ISC_R_DISABLED) {
+ 			uint8_t ui;
+ 			result = isc_parse_uint8(&ui, r.base, 10);
+ 			alg = ui;
+ 		}
+-		if (result != ISC_R_SUCCESS) {
+		if (result != ISC_R_SUCCESS && result != ISC_R_DISABLED) {
+ 			cfg_obj_log(cfg_listelt_value(element),
+ 				    ns_g_lctx, ISC_LOG_ERROR,
+ 				    "invalid algorithm");
+diff --git a/lib/bind9/check.c b/lib/bind9/check.c
+index e0803d4..8023784 100644
+--- a/lib/bind9/check.c
+++ b/lib/bind9/check.c
+@@ -302,6 +302,10 @@ disabled_algorithms(const cfg_obj_t *disabled, isc_log_t *logctx) {
+ 		r.length = strlen(r.base);
+ 
+ 		tresult = dns_secalg_fromtext(&alg, &r);
+		if (tresult == ISC_R_DISABLED) {
+			// Recognize disabled algorithms, disable it explicitly
+			tresult = ISC_R_SUCCESS;
+		}
+ 		if (tresult != ISC_R_SUCCESS) {
+ 			cfg_obj_log(cfg_listelt_value(element), logctx,
+ 				    ISC_LOG_ERROR, "invalid algorithm '%s'",
+diff --git a/lib/dns/rcode.c b/lib/dns/rcode.c
+index f51d548..c49b8d1 100644
+--- a/lib/dns/rcode.c
+++ b/lib/dns/rcode.c
+@@ -126,7 +126,6 @@
+ #endif
+ 
+ #define SECALGNAMES \
+-	MD5_SECALGNAMES \
+ 	DH_SECALGNAMES \
+ 	DSA_SECALGNAMES \
+ 	{ DNS_KEYALG_ECC, "ECC", 0 }, \
+@@ -178,6 +177,7 @@ static struct tbl rcodes[] = { RCODENAMES ERCODENAMES };
+ static struct tbl tsigrcodes[] = { RCODENAMES TSIGRCODENAMES };
+ static struct tbl certs[] = { CERTNAMES };
+ static struct tbl secalgs[] = { SECALGNAMES };
+static struct tbl md5_secalgs[] = { MD5_SECALGNAMES };
+ static struct tbl secprotos[] = { SECPROTONAMES };
+ static struct tbl hashalgs[] = { HASHALGNAMES };
+ static struct tbl dsdigests[] = { DSDIGESTNAMES };
+@@ -358,33 +358,30 @@ dns_cert_totext(dns_cert_t cert, isc_buffer_t *target) {
+ 	return (dns_mnemonic_totext(cert, target, certs));
+ }
+ 
+-static inline struct tbl *
+-secalgs_tbl_start() {
+-	struct tbl *algs = secalgs;
+-
+-#ifndef PK11_MD5_DISABLE
+-	if (!isc_md5_available()) {
+-		while (algs->name != NULL &&
+-		       algs->value == DNS_KEYALG_RSAMD5)
+-			++algs;
+-	}
+-#endif
+-	return algs;
+-}
+-
+ isc_result_t
+ dns_secalg_fromtext(dns_secalg_t *secalgp, isc_textregion_t *source) {
+ 	unsigned int value;
+	isc_result_t result;
+ 
+-	RETERR(dns_mnemonic_fromtext(&value, source,
+-	                             secalgs_tbl_start(), 0xff));
+	result = dns_mnemonic_fromtext(&value, source,
+	                               secalgs, 0xff);
+	if (result != ISC_R_SUCCESS) {
+		result = dns_mnemonic_fromtext(&value, source,
+	                                       md5_secalgs, 0xff);
+		if (result != ISC_R_SUCCESS) {
+			return (result);
+		} else if (!isc_md5_available()) {
+			*secalgp = value;
+			return (ISC_R_DISABLED);
+		}
+	}
+ 	*secalgp = value;
+ 	return (ISC_R_SUCCESS);
+ }
+ 
+ isc_result_t
+ dns_secalg_totext(dns_secalg_t secalg, isc_buffer_t *target) {
+-	return (dns_mnemonic_totext(secalg, target, secalgs_tbl_start()));
+	return (dns_mnemonic_totext(secalg, target, secalgs));
+ }
+ 
+ void
+-- 
+2.20.1
+
--- a/bind-9.11-fips-tests.patch
+++ b/bind-9.11-fips-tests.patch
@ -1,4 +1,4 @@
-From 4e6888c1d32071ead4b7faeeb0f1774a6d8a1120 Mon Sep 17 00:00:00 2001
+From c23daf334d5487fa53fef88c82312e439a2d8523 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 2 Aug 2018 23:46:45 +0200
 Subject: [PATCH] FIPS tests changes
@ -76,17 +76,14 @@ Date:   Wed Mar 7 10:44:23 2018 +0100
 bin/tests/system/catz/ns2/named.conf.in       |  2 +-
 bin/tests/system/checkconf/bad-tsig.conf      |  2 +-
 bin/tests/system/checkconf/good.conf          |  2 +-
- bin/tests/system/digdelv/ns2/example.db       | 15 ++--
- bin/tests/system/digdelv/tests.sh             | 28 ++++----
+ bin/tests/system/digdelv/ns2/example.db       | 15 +++--
+ bin/tests/system/digdelv/tests.sh             | 20 +++---
 bin/tests/system/dlv/ns1/sign.sh              |  4 +-
 bin/tests/system/dlv/ns2/sign.sh              |  4 +-
- bin/tests/system/dlv/ns3/sign.sh              | 69 ++++++++++---------
 bin/tests/system/dlv/ns6/sign.sh              | 66 +++++++++---------
- bin/tests/system/dnssec/ns1/sign.sh           |  4 +-
- bin/tests/system/dnssec/ns2/sign.sh           | 12 ++--
- bin/tests/system/dnssec/ns3/sign.sh           | 20 +++---
+ bin/tests/system/dnssec/ns2/sign.sh           |  8 +--
 bin/tests/system/dnssec/ns5/trusted.conf.bad  |  2 +-
- bin/tests/system/dnssec/tests.sh              |  8 +--
+ bin/tests/system/dnssec/tests.sh              |  4 +-
 bin/tests/system/feature-test.c               | 14 ++++
 bin/tests/system/filter-aaaa/ns1/sign.sh      |  4 +-
 bin/tests/system/filter-aaaa/ns4/sign.sh      |  4 +-
@ -101,11 +98,13 @@ Date:   Wed Mar 7 10:44:23 2018 +0100
 bin/tests/system/tsig/clean.sh                |  1 +
 bin/tests/system/tsig/ns1/named.conf.in       | 10 +--
 bin/tests/system/tsig/setup.sh                |  5 ++
- bin/tests/system/tsig/tests.sh                | 67 +++++++++++-------
+ bin/tests/system/tsig/tests.sh                | 67 ++++++++++++-------
 bin/tests/system/tsiggss/setup.sh             |  2 +-
 bin/tests/system/upforwd/ns1/named.conf.in    |  2 +-
 bin/tests/system/upforwd/tests.sh             |  2 +-
- 47 files changed, 277 insertions(+), 225 deletions(-)
+ bin/tests/system/tsig/ns1/rndc5.conf.in | 10 +++
+ 45 files changed, 232 insertions(+), 171 deletions(-)
+ create mode 100644 bin/tests/system/tsig/ns1/rndc5.conf.in

 diff --git a/bin/tests/system/acl/ns2/named1.conf.in b/bin/tests/system/acl/ns2/named1.conf.in
 index 0ea6502..026db3f 100644
@ -602,37 +601,19 @@ index f4e30f5..9f53e31 100644
 ; TTL of 3 weeks
 weeks		1814400	A	10.53.0.2
 diff --git a/bin/tests/system/digdelv/tests.sh b/bin/tests/system/digdelv/tests.sh
-index 24aa7b3..54a3e2a 100644
+index ade45ce..d3aff24 100644
 --- a/bin/tests/system/digdelv/tests.sh
 +++ b/bin/tests/system/digdelv/tests.sh
-@@ -61,7 +61,7 @@ if [ -x ${DIG} ] ; then
-   echo_i "checking dig +multi +norrcomments works for dnskey (when default is rrcomments)($n)"
-   ret=0
-   $DIG $DIGOPTS +tcp @10.53.0.3 +multi +norrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1
-  grep "; ZSK; alg = RSAMD5 ; key id = 30795" < dig.out.test$n > /dev/null && ret=1
-+  grep "; ZSK; alg = RSASHA256 ; key id = 36895" < dig.out.test$n > /dev/null && ret=1
-   if [ $ret != 0 ]; then echo_i "failed"; fi
-   status=`expr $status + $ret`
- 
-@@ -69,7 +69,7 @@ if [ -x ${DIG} ] ; then
-   echo_i "checking dig +multi +norrcomments works for soa (when default is rrcomments)($n)"
-   ret=0
-   $DIG $DIGOPTS +tcp @10.53.0.3 +multi +norrcomments SOA example > dig.out.test$n || ret=1
-  grep "; ZSK; alg = RSAMD5 ; key id = 30795" < dig.out.test$n > /dev/null && ret=1
-+  grep "; ZSK; alg = RSASHA256 ; key id = 36895" < dig.out.test$n > /dev/null && ret=1
-   if [ $ret != 0 ]; then echo_i "failed"; fi
-   status=`expr $status + $ret`
- 
-@@ -77,7 +77,7 @@ if [ -x ${DIG} ] ; then
+@@ -106,7 +106,7 @@ if [ -x "$DIG" ] ; then
   echo_i "checking dig +rrcomments works for DNSKEY($n)"
   ret=0
   $DIG $DIGOPTS +tcp @10.53.0.3 +rrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1
 -  grep "; ZSK; alg = RSAMD5 ; key id = 30795" < dig.out.test$n > /dev/null || ret=1
 +  grep "; ZSK; alg = RSASHA256 ; key id = 36895$" < dig.out.test$n > /dev/null || ret=1
+   check_ttl_range dig.out.test$n "DNSKEY" 300 || ret=1
   if [ $ret != 0 ]; then echo_i "failed"; fi
   status=`expr $status + $ret`
- 
-@@ -85,7 +85,7 @@ if [ -x ${DIG} ] ; then
+@@ -115,7 +115,7 @@ if [ -x "$DIG" ] ; then
   echo_i "checking dig +short +rrcomments works for DNSKEY ($n)"
   ret=0
   $DIG $DIGOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1
@ -641,7 +622,7 @@ index 24aa7b3..54a3e2a 100644
   if [ $ret != 0 ]; then echo_i "failed"; fi
   status=`expr $status + $ret`
 
-@@ -93,7 +93,7 @@ if [ -x ${DIG} ] ; then
+@@ -123,7 +123,7 @@ if [ -x "$DIG" ] ; then
   echo_i "checking dig +short +nosplit works($n)"
   ret=0
   $DIG $DIGOPTS +tcp @10.53.0.3 +short +nosplit DNSKEY dnskey.example > dig.out.test$n || ret=1
@ -650,7 +631,7 @@ index 24aa7b3..54a3e2a 100644
   if [ $ret != 0 ]; then echo_i "failed"; fi
   status=`expr $status + $ret`
 
-@@ -101,7 +101,7 @@ if [ -x ${DIG} ] ; then
+@@ -131,7 +131,7 @@ if [ -x "$DIG" ] ; then
   echo_i "checking dig +short +rrcomments works($n)"
   ret=0
   $DIG $DIGOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1
@ -659,7 +640,7 @@ index 24aa7b3..54a3e2a 100644
   if [ $ret != 0 ]; then echo_i "failed"; fi
   status=`expr $status + $ret`
 
-@@ -117,7 +117,7 @@ if [ -x ${DIG} ] ; then
+@@ -148,7 +148,7 @@ if [ -x "$DIG" ] ; then
   echo_i "checking dig +short +rrcomments works($n)"
   ret=0
   $DIG $DIGOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1
@ -668,34 +649,16 @@ index 24aa7b3..54a3e2a 100644
   if [ $ret != 0 ]; then echo_i "failed"; fi
   status=`expr $status + $ret`
 
-@@ -564,7 +564,7 @@ if [ -x ${DELV} ] ; then
-   echo_i "checking delv +multi +norrcomments works for dnskey (when default is rrcomments)($n)"
-   ret=0
-   $DELV $DELVOPTS +tcp @10.53.0.3 +multi +norrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
-  grep "; ZSK; alg = RSAMD5 ; key id = 30795" < delv.out.test$n > /dev/null && ret=1
-+  grep "; ZSK; alg = RSASHA256 ; key id = 36895" < delv.out.test$n > /dev/null && ret=1
-   if [ $ret != 0 ]; then echo_i "failed"; fi
-   status=`expr $status + $ret`
- 
-@@ -572,7 +572,7 @@ if [ -x ${DELV} ] ; then
-   echo_i "checking delv +multi +norrcomments works for soa (when default is rrcomments)($n)"
-   ret=0
-   $DELV $DELVOPTS +tcp @10.53.0.3 +multi +norrcomments SOA example > delv.out.test$n || ret=1
-  grep "; ZSK; alg = RSAMD5 ; key id = 30795" < delv.out.test$n > /dev/null && ret=1
-+  grep "; ZSK; alg = RSASHA256 ; key id = 36895" < delv.out.test$n > /dev/null && ret=1
-   if [ $ret != 0 ]; then echo_i "failed"; fi
-   status=`expr $status + $ret`
- 
-@@ -580,7 +580,7 @@ if [ -x ${DELV} ] ; then
+@@ -695,7 +695,7 @@ if [ -x ${DELV} ] ; then
   echo_i "checking delv +rrcomments works for DNSKEY($n)"
   ret=0
   $DELV $DELVOPTS +tcp @10.53.0.3 +rrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
 -  grep "; ZSK; alg = RSAMD5 ; key id = 30795" < delv.out.test$n > /dev/null || ret=1
 +  grep "; ZSK; alg = RSASHA256 ; key id = 36895" < delv.out.test$n > /dev/null || ret=1
+   check_ttl_range delv.out.test$n "DNSKEY" 300 || ret=1
   if [ $ret != 0 ]; then echo_i "failed"; fi
   status=`expr $status + $ret`
- 
-@@ -588,7 +588,7 @@ if [ -x ${DELV} ] ; then
+@@ -704,7 +704,7 @@ if [ -x ${DELV} ] ; then
   echo_i "checking delv +short +rrcomments works for DNSKEY ($n)"
   ret=0
   $DELV $DELVOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
@ -704,7 +667,7 @@ index 24aa7b3..54a3e2a 100644
   if [ $ret != 0 ]; then echo_i "failed"; fi
   status=`expr $status + $ret`
 
-@@ -596,7 +596,7 @@ if [ -x ${DELV} ] ; then
+@@ -712,7 +712,7 @@ if [ -x ${DELV} ] ; then
   echo_i "checking delv +short +rrcomments works ($n)"
   ret=0
   $DELV $DELVOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
@ -713,7 +676,7 @@ index 24aa7b3..54a3e2a 100644
   if [ $ret != 0 ]; then echo_i "failed"; fi
   status=`expr $status + $ret`
 
-@@ -604,7 +604,7 @@ if [ -x ${DELV} ] ; then
+@@ -720,7 +720,7 @@ if [ -x ${DELV} ] ; then
   echo_i "checking delv +short +nosplit works ($n)"
   ret=0
   $DELV $DELVOPTS +tcp @10.53.0.3 +short +nosplit DNSKEY dnskey.example > delv.out.test$n || ret=1
@ -722,7 +685,7 @@ index 24aa7b3..54a3e2a 100644
   if test `wc -l < delv.out.test$n` != 1 ; then ret=1 ; fi
   f=`awk '{print NF}' < delv.out.test$n`
   test "${f:-0}" -eq 14 || ret=1
-@@ -615,7 +615,7 @@ if [ -x ${DELV} ] ; then
+@@ -731,7 +731,7 @@ if [ -x ${DELV} ] ; then
   echo_i "checking delv +short +nosplit +norrcomments works ($n)"
   ret=0
   $DELV $DELVOPTS +tcp @10.53.0.3 +short +nosplit +norrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
@ -732,22 +695,22 @@ index 24aa7b3..54a3e2a 100644
   f=`awk '{print NF}' < delv.out.test$n`
   test "${f:-0}" -eq 4 || ret=1
 diff --git a/bin/tests/system/dlv/ns1/sign.sh b/bin/tests/system/dlv/ns1/sign.sh
-index b815162..2a62e58 100755
+index 606e7cc..a3a0d60 100755
 --- a/bin/tests/system/dlv/ns1/sign.sh
 +++ b/bin/tests/system/dlv/ns1/sign.sh
@@ -23,8 +23,8 @@ infile=root.db.in
 zonefile=root.db
 outfile=root.signed
 
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` 
+-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
 -keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 1024 -n zone $zone 2> /dev/null` 
+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 1024 -n zone $zone 2> /dev/null`
 +keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 1024 -n zone $zone 2> /dev/null`
 
 cat $infile $keyname1.key $keyname2.key >$zonefile
 
 diff --git a/bin/tests/system/dlv/ns2/sign.sh b/bin/tests/system/dlv/ns2/sign.sh
-index 6f84d7a..e128303 100755
+index 9825c57..202c978 100755
 --- a/bin/tests/system/dlv/ns2/sign.sh
 +++ b/bin/tests/system/dlv/ns2/sign.sh
@@ -24,8 +24,8 @@ zonefile=druz.db
@ -761,205 +724,6 @@ index 6f84d7a..e128303 100755
 
 cat $infile $keyname1.key $keyname2.key >$zonefile
 
-diff --git a/bin/tests/system/dlv/ns3/sign.sh b/bin/tests/system/dlv/ns3/sign.sh
-index bcc9922..846dbcc 100755
--- a/bin/tests/system/dlv/ns3/sign.sh
-+++ b/bin/tests/system/dlv/ns3/sign.sh
-@@ -19,6 +19,7 @@ echo_i "dlv/ns3/sign.sh"
- dlvzone=dlv.utld.
- dlvsets=
- dssets=
-+bits=1024
- 
- zone=child1.utld.
- infile=child.db.in
-@@ -26,8 +27,8 @@ zonefile=child1.utld.db
- outfile=child1.signed
- dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
- 
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` 
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null` 
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
- cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
-@@ -42,8 +43,8 @@ zonefile=child3.utld.db
- outfile=child3.signed
- dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
- 
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
- cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
-@@ -58,8 +59,8 @@ zonefile=child4.utld.db
- outfile=child4.signed
- dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
- 
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- 
-@@ -73,8 +74,8 @@ zonefile=child5.utld.db
- outfile=child5.signed
- dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
- 
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
- cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
-@@ -88,8 +89,8 @@ infile=child.db.in
- zonefile=child7.utld.db
- outfile=child7.signed
- 
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
- cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
-@@ -103,8 +104,8 @@ infile=child.db.in
- zonefile=child8.utld.db
- outfile=child8.signed
- 
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- 
-@@ -118,8 +119,8 @@ zonefile=child9.utld.db
- outfile=child9.signed
- dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
- 
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- 
-@@ -132,8 +133,8 @@ zonefile=child10.utld.db
- outfile=child10.signed
- dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
- 
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- 
-@@ -147,8 +148,8 @@ outfile=child1.druz.signed
- dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
- dssets="$dssets dsset-`echo $zone |sed -e "s/.$//g"`$TP"
- 
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` 
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null` 
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
- cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
-@@ -164,8 +165,8 @@ outfile=child3.druz.signed
- dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
- dssets="$dssets dsset-`echo $zone |sed -e "s/.$//g"`$TP"
- 
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
- cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
-@@ -181,8 +182,8 @@ outfile=child4.druz.signed
- dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
- dssets="$dssets dsset-`echo $zone |sed -e "s/.$//g"`$TP"
- 
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- 
-@@ -197,8 +198,8 @@ outfile=child5.druz.signed
- dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
- dssets="$dssets dsset-`echo $zone |sed -e "s/.$//g"`$TP"
- 
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
- cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
-@@ -213,8 +214,8 @@ zonefile=child7.druz.db
- outfile=child7.druz.signed
- dssets="$dssets dsset-`echo $zone |sed -e "s/.$//g"`$TP"
- 
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
- cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
-@@ -228,8 +229,8 @@ infile=child.db.in
- zonefile=child8.druz.db
- outfile=child8.druz.signed
- 
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- 
-@@ -243,8 +244,8 @@ zonefile=child9.druz.db
- outfile=child9.druz.signed
- dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
- 
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- 
-@@ -258,8 +259,8 @@ outfile=child10.druz.signed
- dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
- dssets="$dssets dsset-`echo $zone |sed -e "s/.$//g"`$TP"
- 
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- 
-@@ -272,8 +273,8 @@ infile=dlv.db.in
- zonefile=dlv.utld.db
- outfile=dlv.signed
- 
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
-+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
- 
- cat $infile $dlvsets $keyname1.key $keyname2.key >$zonefile
- 
 diff --git a/bin/tests/system/dlv/ns6/sign.sh b/bin/tests/system/dlv/ns6/sign.sh
 index 1e39862..4ed19ac 100755
 --- a/bin/tests/system/dlv/ns6/sign.sh
@ -1147,43 +911,11 @@ index 1e39862..4ed19ac 100755
 
 cat $infile $keyname1.key $keyname2.key >$zonefile
 
-diff --git a/bin/tests/system/dnssec/ns1/sign.sh b/bin/tests/system/dnssec/ns1/sign.sh
-index 198d60a..d89a539 100644
--- a/bin/tests/system/dnssec/ns1/sign.sh
-+++ b/bin/tests/system/dnssec/ns1/sign.sh
-@@ -27,7 +27,7 @@ cp ../ns2/dsset-in-addr.arpa$TP .
- grep "8 [12] " ../ns2/dsset-algroll$TP > dsset-algroll$TP
- cp ../ns6/dsset-optout-tld$TP .
- 
-keyname=`$KEYGEN -q -r $RANDFILE -a RSAMD5 -b 768 -n zone $zone`
-+keyname=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 1024 -n zone $zone`
- 
- cat $infile $keyname.key > $zonefile
- 
-@@ -48,6 +48,6 @@ cp managed.conf ../ns4/managed.conf
- #
- #  Save keyid for managed key id test.
- #
-keyid=`expr $keyname : 'K.+001+\(.*\)'`
-+keyid=`expr $keyname : 'K.+008+\([0-9]*\)'`
- keyid=`expr $keyid + 0`
- echo "$keyid" > managed.key.id
 diff --git a/bin/tests/system/dnssec/ns2/sign.sh b/bin/tests/system/dnssec/ns2/sign.sh
-index ca18608..25b6cab 100644
+index 13fb924..1ffa279 100644
 --- a/bin/tests/system/dnssec/ns2/sign.sh
 +++ b/bin/tests/system/dnssec/ns2/sign.sh
-@@ -30,8 +30,8 @@ do
- 	cp ../ns3/dsset-$subdomain.example$TP .
- done
- 
-keyname1=`$KEYGEN -q -r $RANDFILE -a DSA -b 768 -n zone $zone`
-keyname2=`$KEYGEN -q -r $RANDFILE -a DSA -b 768 -n zone $zone`
-+keyname1=`$KEYGEN -q -r $RANDFILE -a DSA -b 1024 -n zone $zone`
-+keyname2=`$KEYGEN -q -r $RANDFILE -a DSA -b 1024 -n zone $zone`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- 
-@@ -91,8 +91,8 @@ zone=in-addr.arpa.
+@@ -126,8 +126,8 @@ zone=in-addr.arpa.
 infile=in-addr.arpa.db.in
 zonefile=in-addr.arpa.db
 
@ -1194,7 +926,7 @@ index ca18608..25b6cab 100644
 
 cat $infile $keyname1.key $keyname2.key >$zonefile
 $SIGNER -P -g -r $RANDFILE -o $zone -k $keyname1 $zonefile $keyname2 > /dev/null
-@@ -103,7 +103,7 @@ privzone=private.secure.example.
+@@ -138,7 +138,7 @@ privzone=private.secure.example
 privinfile=private.secure.example.db.in
 privzonefile=private.secure.example.db
 
@ -1203,102 +935,15 @@ index ca18608..25b6cab 100644
 
 cat $privinfile $privkeyname.key >$privzonefile
 
-@@ -117,7 +117,7 @@ dlvinfile=dlv.db.in
+@@ -152,7 +152,7 @@ dlvinfile=dlv.db.in
 dlvzonefile=dlv.db
- dlvsetfile=dlvset-`echo $privzone |sed -e "s/\.$//g"`$TP
+ dlvsetfile=dlvset-${privzone}${TP}
 
 -dlvkeyname=`$KEYGEN -q -r $RANDFILE -a RSAMD5 -b 768 -n zone $dlvzone`
 +dlvkeyname=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 1024 -n zone $dlvzone`
 
 cat $dlvinfile $dlvkeyname.key $dlvsetfile > $dlvzonefile
 
-diff --git a/bin/tests/system/dnssec/ns3/sign.sh b/bin/tests/system/dnssec/ns3/sign.sh
-index ff55d84..4f6a251 100644
--- a/bin/tests/system/dnssec/ns3/sign.sh
-+++ b/bin/tests/system/dnssec/ns3/sign.sh
-@@ -28,7 +28,7 @@ zone=bogus.example.
- infile=bogus.example.db.in
- zonefile=bogus.example.db
- 
-keyname=`$KEYGEN -q -r $RANDFILE -a RSAMD5 -b 768 -n zone $zone`
-+keyname=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 2048 -n zone $zone`
- 
- cat $infile $keyname.key >$zonefile
- 
-@@ -38,8 +38,8 @@ zone=dynamic.example.
- infile=dynamic.example.db.in
- zonefile=dynamic.example.db
- 
-keyname1=`$KEYGEN -q -r $RANDFILE -a RSAMD5 -b 768 -n zone $zone`
-keyname2=`$KEYGEN -q -r $RANDFILE -a RSAMD5 -b 1024 -n zone -f KSK $zone`
-+keyname1=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 2048 -n zone $zone`
-+keyname2=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 2048 -n zone -f KSK $zone`
- 
- cat $infile $keyname1.key $keyname2.key >$zonefile
- 
-@@ -49,7 +49,7 @@ zone=keyless.example.
- infile=generic.example.db.in
- zonefile=keyless.example.db
- 
-keyname=`$KEYGEN -q -r $RANDFILE -a RSAMD5 -b 768 -n zone $zone`
-+keyname=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 2048 -n zone $zone`
- 
- cat $infile $keyname.key >$zonefile
- 
-@@ -69,7 +69,7 @@ zone=secure.nsec3.example.
- infile=secure.nsec3.example.db.in
- zonefile=secure.nsec3.example.db
- 
-keyname=`$KEYGEN -q -r $RANDFILE -a RSAMD5 -b 768 -n zone $zone`
-+keyname=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 2048 -n zone $zone`
- 
- cat $infile $keyname.key >$zonefile
- 
-@@ -82,7 +82,7 @@ zone=nsec3.nsec3.example.
- infile=nsec3.nsec3.example.db.in
- zonefile=nsec3.nsec3.example.db
- 
-keyname=`$KEYGEN -q -r $RANDFILE -a NSEC3RSASHA1 -b 768 -n zone $zone`
-+keyname=`$KEYGEN -q -r $RANDFILE -a NSEC3RSASHA1 -b 1024 -n zone $zone`
- 
- cat $infile $keyname.key >$zonefile
- 
-@@ -95,7 +95,7 @@ zone=optout.nsec3.example.
- infile=optout.nsec3.example.db.in
- zonefile=optout.nsec3.example.db
- 
-keyname=`$KEYGEN -q -r $RANDFILE -a NSEC3RSASHA1 -b 768 -n zone $zone`
-+keyname=`$KEYGEN -q -r $RANDFILE -a NSEC3RSASHA1 -b 1024 -n zone $zone`
- 
- cat $infile $keyname.key >$zonefile
- 
-@@ -108,7 +108,7 @@ zone=nsec3.example.
- infile=nsec3.example.db.in
- zonefile=nsec3.example.db
- 
-keyname=`$KEYGEN -q -r $RANDFILE -a NSEC3RSASHA1 -b 768 -n zone $zone`
-+keyname=`$KEYGEN -q -r $RANDFILE -a NSEC3RSASHA1 -b 1024 -n zone $zone`
- 
- cat $infile $keyname.key >$zonefile
- 
-@@ -121,7 +121,7 @@ zone=secure.optout.example.
- infile=secure.optout.example.db.in
- zonefile=secure.optout.example.db
- 
-keyname=`$KEYGEN -q -r $RANDFILE -a RSAMD5 -b 768 -n zone $zone`
-+keyname=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 2048 -n zone $zone`
- 
- cat $infile $keyname.key >$zonefile
- 
-@@ -533,7 +533,7 @@ zone=badds.example.
- infile=bogus.example.db.in
- zonefile=badds.example.db
- 
-keyname=`$KEYGEN -q -r $RANDFILE -a RSAMD5 -b 768 -n zone $zone`
-+keyname=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 2048 -n zone $zone`
- 
- cat $infile $keyname.key >$zonefile
- 
 diff --git a/bin/tests/system/dnssec/ns5/trusted.conf.bad b/bin/tests/system/dnssec/ns5/trusted.conf.bad
 index ed30460..e6b1126 100644
 --- a/bin/tests/system/dnssec/ns5/trusted.conf.bad
@ -1311,28 +956,10 @@ index ed30460..e6b1126 100644
 +    "." 256 3 8 "AwEAAarwAdjV4gIhpBCjXVAScRFEx3co7k8smJdxrnqoGsl5NB7EZ9jRdgvCXbJn6v8y9jlNWVHvaC8ilhfhLh0A1vLWiWv4ijd/12xcnrY7xpG7Cu3YkxUxaXJ7Jdg/Iw1+9mGgXF1v4UbCIcw/3U3cxyk7OxYg+VSb5KBAQSR0upxV";
 };
 diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh
-index 646434f..9a10f9f 100644
+index b31c1b4..a5e237b 100644
 --- a/bin/tests/system/dnssec/tests.sh
 +++ b/bin/tests/system/dnssec/tests.sh
-@@ -1688,7 +1688,7 @@ ret=0
- $RNDCCMD 10.53.0.4 secroots 2>&1 | sed 's/^/ns4 /' | cat_i
- keyid=`cat ns1/managed.key.id`
- cp ns4/named.secroots named.secroots.test$n
-linecount=`grep "./RSAMD5/$keyid ; trusted" named.secroots.test$n | wc -l`
-+linecount=`grep "./RSASHA256/$keyid ; trusted" named.secroots.test$n | wc -l`
- [ "$linecount" -eq 1 ] || ret=1
- linecount=`cat named.secroots.test$n | wc -l`
- [ "$linecount" -eq 10 ] || ret=1
-@@ -3016,7 +3016,7 @@ echo_i "check dig's +nocrypto flag ($n)"
- ret=0
- $DIG $DIGOPTS +norec +nocrypto DNSKEY . \
- 	@10.53.0.1 > dig.out.dnskey.ns1.test$n || ret=1
-grep '256 3 1 \[key id = [1-9][0-9]*]' dig.out.dnskey.ns1.test$n > /dev/null || ret=1
-+grep '256 3 8 \[key id = [1-9][0-9]*]' dig.out.dnskey.ns1.test$n > /dev/null || ret=1
- grep 'RRSIG.* \[omitted]' dig.out.dnskey.ns1.test$n > /dev/null || ret=1
- $DIG $DIGOPTS +norec +nocrypto DS example \
- 	@10.53.0.1 > dig.out.ds.ns1.test$n || ret=1
-@@ -3128,8 +3128,8 @@ do
+@@ -3235,8 +3235,8 @@ do
 	   alg=`expr $alg + 1`
 	   continue;;
 	3) size="-b 512";;
@ -1344,7 +971,7 @@ index 646434f..9a10f9f 100644
 	8) size="-b 512";;
 	10) size="-b 1024";;
 diff --git a/bin/tests/system/feature-test.c b/bin/tests/system/feature-test.c
-index f934b63..11863a3 100644
+index c1249ed..20a3139 100644
 --- a/bin/tests/system/feature-test.c
 +++ b/bin/tests/system/feature-test.c
@@ -19,6 +19,7 @@
@ -1355,15 +982,15 @@ index f934b63..11863a3 100644
 #include <dns/edns.h>
 
 #ifdef WIN32
-@@ -45,6 +46,7 @@ usage() {
- 	fprintf(stderr, "	--have-geoip\n");
+@@ -47,6 +48,7 @@ usage() {
+ 	fprintf(stderr, "	--have-geoip2\n");
 	fprintf(stderr, "	--have-libxml2\n");
 	fprintf(stderr, "	--ipv6only=no\n");
 +	fprintf(stderr, "       --md5\n");
 	fprintf(stderr, "	--rpz-nsdname\n");
 	fprintf(stderr, "	--rpz-nsip\n");
 	fprintf(stderr, "	--with-idn\n");
-@@ -136,6 +138,18 @@ main(int argc, char **argv) {
+@@ -155,6 +157,18 @@ main(int argc, char **argv) {
 #endif
 	}
 
@ -1488,10 +1115,10 @@ index 4549184..cb7dccd 100644
 };
 
 diff --git a/bin/tests/system/nsupdate/setup.sh b/bin/tests/system/nsupdate/setup.sh
-index 45dfeeb..594db77 100644
+index 21805c5..0d3d85c 100644
 --- a/bin/tests/system/nsupdate/setup.sh
 +++ b/bin/tests/system/nsupdate/setup.sh
-@@ -63,7 +63,12 @@ EOF
+@@ -58,7 +58,12 @@ EOF
 
 $DDNSCONFGEN -q -r $RANDFILE -z example.nil > ns1/ddns.key
 
@ -1506,10 +1133,10 @@ index 45dfeeb..594db77 100644
 $DDNSCONFGEN -q -r $RANDFILE -a hmac-sha224 -k sha224-key -z keytests.nil > ns1/sha224.key
 $DDNSCONFGEN -q -r $RANDFILE -a hmac-sha256 -k sha256-key -z keytests.nil > ns1/sha256.key
 diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh
-index 901cd22..b72b59c 100755
+index 4da4849..b3bc807 100755
 --- a/bin/tests/system/nsupdate/tests.sh
 +++ b/bin/tests/system/nsupdate/tests.sh
-@@ -700,7 +700,14 @@ fi
+@@ -708,7 +708,14 @@ fi
 n=`expr $n + 1`
 ret=0
 echo_i "check TSIG key algorithms ($n)"
@ -1525,7 +1152,7 @@ index 901cd22..b72b59c 100755
     $NSUPDATE -k ns1/${alg}.key <<END > /dev/null || ret=1
 server 10.53.0.1 ${PORT}
 update add ${alg}.keytests.nil. 600 A 10.10.10.3
-@@ -708,7 +715,7 @@ send
+@@ -716,7 +723,7 @@ send
 END
 done
 sleep 2
@ -1548,10 +1175,10 @@ index 343869e..c30efb0 100644
 make_key 3 ${EXTRAPORT3} hmac-sha224
 make_key 4 ${EXTRAPORT4} hmac-sha256
 diff --git a/bin/tests/system/rndc/tests.sh b/bin/tests/system/rndc/tests.sh
-index b00056c..f7fad91 100644
+index 57e066d..186a723 100644
 --- a/bin/tests/system/rndc/tests.sh
 +++ b/bin/tests/system/rndc/tests.sh
-@@ -356,15 +356,20 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
+@@ -348,15 +348,20 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
 n=`expr $n + 1`
@ -1760,6 +1387,22 @@ index b0694bb..9adae82 100644
 server 10.53.0.3 ${PORT}
 update add updated.example. 600 A 10.10.10.1
 update add updated.example. 600 TXT Foo
+diff --git a/bin/tests/system/tsig/ns1/rndc5.conf.in b/bin/tests/system/tsig/ns1/rndc5.conf.in
+new file mode 100644
+index 0000000..0682194
+--- /dev/null
+++ b/bin/tests/system/tsig/ns1/rndc5.conf.in
+@@ -0,0 +1,10 @@
+# Conditionally included when support for MD5 is available
+key "md5" {
+	secret "97rnFx24Tfna4mHPfgnerA==";
+	algorithm hmac-md5;
+};
+
+key "md5-trunc" {
+	secret "97rnFx24Tfna4mHPfgnerA==";
+	algorithm hmac-md5-80;
+};
 -- 
 2.20.1

--- a/bind-9.11-json-c.patch
+++ b/bind-9.11-json-c.patch
@ -0,0 +1,50 @@
+From cb6d2019766a6c8c5516fd8859cedf0052f03293 Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Thu, 25 Jul 2019 11:37:57 +0200
+Subject: [PATCH] Skip support of jsoncpp
+
+Bind cannot be compiled when jsoncpp-devel is installed. Remove support
+for jsoncpp, use only json-c-devel. Bind 9.15 has already support for
+--with-json-c, do not yet introduce it.
+---
+ configure.ac | 17 ++---------------
+ 1 file changed, 2 insertions(+), 15 deletions(-)
+
+diff --git a/configure.ac b/configure.ac
+index 6d05337..5ce83b5 100644
+--- a/configure.ac
+++ b/configure.ac
+@@ -2594,15 +2594,7 @@ case "$use_libjson" in
+ 	auto|yes)
+ 		for d in /usr /usr/local /opt/local
+ 		do
+-			if test -f "${d}/include/json/json.h"
+-			then
+-				if test ${d} != /usr
+-				then
+-					libjson_cflags="-I ${d}/include"
+-					LIBS="$LIBS -L${d}/lib"
+-				fi
+-				have_libjson="yes"
+-			elif test -f "${d}/include/json-c/json.h"
+			if test -f "${d}/include/json-c/json.h"
+ 			then
+ 				if test ${d} != /usr
+ 				then
+@@ -2615,12 +2607,7 @@ case "$use_libjson" in
+ 		done
+ 		;;
+ 	*)
+-		if test -f "${use_libjson}/include/json/json.h"
+-		then
+-			libjson_cflags="-I${use_libjson}/include"
+-			LIBS="$LIBS -L${use_libjson}/lib"
+-			have_libjson="yes"
+-		elif test -f "${use_libjson}/include/json-c/json.h"
+		if test -f "${use_libjson}/include/json-c/json.h"
+ 		then
+ 			libjson_cflags="-I${use_libjson}/include"
+ 			LIBS="$LIBS -L${use_libjson}/lib"
+-- 
+2.20.1
+
--- a/bind-9.11-kyua-pkcs11.patch
+++ b/bind-9.11-kyua-pkcs11.patch
@ -1,4 +1,4 @@
-From 17998f4feb9590522a0b50943075d9e8c97ec69d Mon Sep 17 00:00:00 2001
+From eb38d2278937ec3fe45d0af30cd080953bbb5b54 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Tue, 2 Jan 2018 18:13:07 +0100
 Subject: [PATCH] Fix pkcs11 variants atf tests
@ -16,10 +16,10 @@ Add pkcs11 Kyuafile, fix dh_test to pass in pkcs11 mode
 6 files changed, 38 insertions(+), 16 deletions(-)

 diff --git a/configure.ac b/configure.ac
-index 7aff0e6..8374385 100644
+index 0532feb..a83ddd5 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -5512,6 +5512,7 @@ AC_CONFIG_FILES([
+@@ -5578,6 +5578,7 @@ AC_CONFIG_FILES([
 	lib/dns-pkcs11/include/Makefile
 	lib/dns-pkcs11/include/dns/Makefile
 	lib/dns-pkcs11/include/dst/Makefile
@ -43,7 +43,7 @@ index 7c8bab0..eec9564 100644
 include('isccfg/Kyuafile')
 include('lwres/Kyuafile')
 diff --git a/lib/dns-pkcs11/tests/Makefile.in b/lib/dns-pkcs11/tests/Makefile.in
-index 9f1781a..e50463d 100644
+index 7671e1d..e237d5c 100644
 --- a/lib/dns-pkcs11/tests/Makefile.in
 +++ b/lib/dns-pkcs11/tests/Makefile.in
@@ -17,12 +17,12 @@ VERSION=@BIND9_VERSION@
@ -55,11 +55,11 @@ index 9f1781a..e50463d 100644
 
 -ISCLIBS =	../../isc/libisc.@A@
 -ISCDEPLIBS =	../../isc/libisc.@A@
-DNSLIBS =	../libdns.@A@ @DNS_CRYPTO_LIBS@
+-DNSLIBS =	../libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
 -DNSDEPLIBS =	../libdns.@A@
 +ISCLIBS =	../../isc-pkcs11/libisc-pkcs11.@A@
 +ISCDEPLIBS =	../../isc-pkcs11/libisc-pkcs11.@A@
-+DNSLIBS =	../libdns-pkcs11.@A@ @DNS_CRYPTO_LIBS@
+DNSLIBS =	../libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
 +DNSDEPLIBS =	../libdns-pkcs11.@A@
 
 LIBS =		@LIBS@ @CMOCKA_LIBS@
--- a/bind-9.11-oot-gen.patch
+++ b/bind-9.11-oot-gen.patch
@ -0,0 +1,47 @@
+From cb654ddde5953cab9dfde7173ea1ed14b51c3727 Mon Sep 17 00:00:00 2001
+From: Mark Andrews <marka@isc.org>
+Date: Sun, 22 Dec 2019 21:51:21 +0000
+Subject: [PATCH] Merge branch
+ '1530-lib-dns-gen-c-29-26-fatal-error-isc-platform-h-no-such-file-or-directory-v9_11'
+ into 'v9_11'
+
+Resolve "lib/dns/gen.c:29:26: fatal error: isc/platform.h: No such file or directory"
+
+See merge request isc-projects/bind9!2794
+
+(cherry picked from commit 335ab375d6a0227fb362722acad22f2a5b75d8b7)
+---
+ lib/dns/gen.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/lib/dns/gen.c b/lib/dns/gen.c
+index 81bc7ada1d..5fbdc3bfd3 100644
+--- a/lib/dns/gen.c
+++ b/lib/dns/gen.c
+@@ -26,18 +26,18 @@
+ 
+ #include <sys/types.h>
+ 
+-#include <isc/platform.h>
+-
+ #include <ctype.h>
+#include <errno.h>
+ #include <limits.h>
+ #include <stdint.h>
+-#include <stdlib.h>
+ #include <stdio.h>
+ #include <stdlib.h>
+ #include <string.h>
+ #include <time.h>
+-#include <errno.h>
+-#include <limits.h>
+
+#ifndef PATH_MAX
+#define PATH_MAX 1024
+#endif
+ 
+ #ifdef WIN32
+ #include "gen-win32.h"
+-- 
+2.21.0
+
--- a/bind-9.11-rh1624100.patch
+++ b/bind-9.11-rh1624100.patch
@ -1,4 +1,4 @@
-From 292a0ca28f2e8a49f8c7e62c39ad7160234ce23d Mon Sep 17 00:00:00 2001
+From 76594cba9a1e910bb36160d96fc3872349341799 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@sury.org>
 Date: Wed, 25 Apr 2018 14:04:31 +0200
 Subject: [PATCH] Replace isc_safe routines with their OpenSSL counter parts
@ -81,15 +81,15 @@ index ad77f24..670982a 100644
 
 /* accept_sec_context.c */
 diff --git a/lib/isc/Makefile.in b/lib/isc/Makefile.in
-index ba53ef1..98acfff 100644
+index 0fd0837..8ad54bb 100644
 --- a/lib/isc/Makefile.in
 +++ b/lib/isc/Makefile.in
@@ -60,7 +60,7 @@ OBJS =		@ISC_EXTRA_OBJS@ @ISC_PK11_O@ @ISC_PK11_RESULT_O@ \
 		parseint.@O@ portset.@O@ quota.@O@ radix.@O@ random.@O@ \
 		ratelimiter.@O@ refcount.@O@ region.@O@ regex.@O@ result.@O@ \
 		rwlock.@O@ \
-		safe.@O@ serial.@O@ sha1.@O@ sha2.@O@ sockaddr.@O@ stats.@O@ \
-+		serial.@O@ sha1.@O@ sha2.@O@ sockaddr.@O@ stats.@O@ \
+-		safe.@O@ serial.@O@ siphash.@O@ sha1.@O@ sha2.@O@ sockaddr.@O@ stats.@O@ \
+		serial.@O@ siphash.@O@ sha1.@O@ sha2.@O@ sockaddr.@O@ stats.@O@ \
 		string.@O@ strtoul.@O@ symtab.@O@ task.@O@ taskpool.@O@ \
 		tm.@O@ timer.@O@ version.@O@ \
 		${UNIXOBJS} ${NLSOBJS} ${THREADOBJS}
@ -97,8 +97,8 @@ index ba53ef1..98acfff 100644
 		netaddr.c netscope.c pool.c ondestroy.c \
 		parseint.c portset.c quota.c radix.c random.c ${CHACHASRCS} \
 		ratelimiter.c refcount.c region.c regex.c result.c rwlock.c \
-		safe.c serial.c sha1.c sha2.c sockaddr.c stats.c string.c \
-+		serial.c sha1.c sha2.c sockaddr.c stats.c string.c \
+-		safe.c serial.c siphash.c sha1.c sha2.c sockaddr.c stats.c string.c \
+		serial.c siphash.c sha1.c sha2.c sockaddr.c stats.c string.c \
 		strtoul.c symtab.c task.c taskpool.c timer.c \
 		tm.c version.c
 
@ -241,10 +241,10 @@ index 7a464b6..0000000
 -#endif
 -}
 diff --git a/lib/isc/tests/safe_test.c b/lib/isc/tests/safe_test.c
-index 5775b6e..3451b5d 100644
+index 266ac75..60e9181 100644
 --- a/lib/isc/tests/safe_test.c
 +++ b/lib/isc/tests/safe_test.c
-@@ -44,22 +44,6 @@ isc_safe_memequal_test(void **state) {
+@@ -45,22 +45,6 @@ isc_safe_memequal_test(void **state) {
 				       "\x00\x00\x00\x00", 4));
 }
 
@ -267,7 +267,7 @@ index 5775b6e..3451b5d 100644
 /* test isc_safe_memwipe() */
 static void
 isc_safe_memwipe_test(void **state) {
-@@ -68,7 +52,6 @@ isc_safe_memwipe_test(void **state) {
+@@ -69,7 +53,6 @@ isc_safe_memwipe_test(void **state) {
 	/* These should pass. */
 	isc_safe_memwipe(NULL, 0);
 	isc_safe_memwipe((void *) -1, 0);
@ -275,7 +275,7 @@ index 5775b6e..3451b5d 100644
 
 	/*
 	 * isc_safe_memwipe(ptr, size) should function same as
-@@ -107,7 +90,6 @@ main(void) {
+@@ -108,7 +91,6 @@ main(void) {
 	const struct CMUnitTest tests[] = {
 		cmocka_unit_test(isc_safe_memequal_test),
 		cmocka_unit_test(isc_safe_memwipe_test),
--- a/bind-9.11-rh1647829.patch
+++ b/bind-9.11-rh1647829.patch
@ -1,86 +0,0 @@
-From 2eca7f5fa97a24997e4d8f900460ba43ae167e97 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Tue, 29 Jan 2019 18:07:44 +0100
-Subject: [PATCH] Fallback to ASCII on output IDN conversion error
-
-It is possible dig used ACE encoded name in locale, which does not
-support converting it to unicode. Instead of fatal error, fallback to
-ACE name on output.
-
-(cherry picked from commit 7f4cb8f9584597fea16de6557124ac8b1bd47440)
-
-Modify idna test to fallback to ACE
-
-Test valid A-label on input would be displayed as A-label on output if
-locale does not allow U-label.
-
-(cherry picked from commit 4ce232f8605bdbe0594ebe5a71383c9d4e6f263b)
-
-Emit warning on IDN output failure
-
-Warning is emitted before any dig headers.
-
-(cherry picked from commit 4b410038c531fbb902cd5fb83174eed1f06cb7d7)
---
- bin/dig/dighost.c              | 15 +++++++++++++--
- bin/tests/system/idna/tests.sh | 17 +++++++++++++++++
- 2 files changed, 30 insertions(+), 2 deletions(-)
-
-diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
-index bb8702c..d7cfc33 100644
--- a/bin/dig/dighost.c
-+++ b/bin/dig/dighost.c
-@@ -4860,9 +4860,20 @@ idn_ace_to_locale(const char *from, char *to, size_t tolen) {
- 	 */
- 	res = idn2_to_unicode_8zlz(utf8_src, &tmp_str, 0);
- 	if (res != IDN2_OK) {
-		fatal("Cannot represent '%s' in the current locale (%s), "
-		      "use +noidnout or a different locale",
-+		static bool warned = false;
-+
-+		res = idn2_to_ascii_8z(utf8_src, &tmp_str, 0);
-+		if (res != IDN2_OK) {
-+			fatal("Cannot represent '%s' "
-+			      "in the current locale nor ascii (%s), "
-+			      "use +noidnout or a different locale",
- 		      from, idn2_strerror(res));
-+		} else if (!warned) {
-+			fprintf(stderr, ";; Warning: cannot represent '%s' "
-+			      "in the current locale",
-+			      tmp_str);
-+			warned = true;
-+		}
- 	}
- 
- 	/*
-diff --git a/bin/tests/system/idna/tests.sh b/bin/tests/system/idna/tests.sh
-index 6637bf6..215a9d5 100644
--- a/bin/tests/system/idna/tests.sh
-+++ b/bin/tests/system/idna/tests.sh
-@@ -244,6 +244,23 @@ idna_enabled_test() {
-     idna_test "$text" "+idnin +noidnout"   "xn--nxasmq6b.com" "xn--nxasmq6b.com."
-     idna_test "$text" "+idnin +idnout"     "xn--nxasmq6b.com" "βόλοσ.com."
- 
-+    # Test of valid A-label in locale that cannot display it
-+    #
-+    # +noidnout: The string is sent as-is to the server and the returned qname
-+    #            is displayed in the same form.
-+    # +idnout:   The string is sent as-is to the server and the returned qname
-+    #            is displayed as the corresponding A-label.
-+    #
-+    # The "+[no]idnout" flag has no effect in these cases.
-+    text="Checking valid A-label in C locale"
-+    label="xn--nxasmq6b.com"
-+    LC_ALL=C idna_test "$text" ""                   "$label" "$label."
-+    LC_ALL=C idna_test "$text" "+noidnin +noidnout" "$label" "$label."
-+    LC_ALL=C idna_test "$text" "+noidnin +idnout"   "$label" "$label."
-+    LC_ALL=C idna_test "$text" "+idnin +noidnout"   "$label" "$label."
-+    LC_ALL=C idna_test "$text" "+idnin +idnout"     "$label" "$label."
-+    LC_ALL=C idna_test "$text" "+noidnin +idnout"   "$label" "$label."
-+
- 
- 
-     # Tests of invalid A-labels
-- 
-2.20.1
-
--- a/bind-9.11-rh1732883.patch
+++ b/bind-9.11-rh1732883.patch
@ -0,0 +1,194 @@
+From 6010876e561b4345e569ffd11eaec9ea52725817 Mon Sep 17 00:00:00 2001
+From: Pavel Zhukov <pzhukov@redhat.com>
+Date: Wed, 24 Jul 2019 17:15:55 +0200
+Subject: [PATCH] Detect system time jumps
+
+In case if system time was changed backward it's possible to have ip
+address dropped by the kernel due to lifetime expirity. Try to detect
+this situation using either monotonic time or saved timestamp and execute
+go_reboot() procedure to request lease extention
+---
+ lib/isc/include/isc/result.h    |  3 ++-
+ lib/isc/include/isc/util.h      |  3 +++
+ lib/isc/result.c                |  2 ++
+ lib/isc/unix/app.c              | 39 +++++++++++++++++++++++++++++----
+ lib/isc/unix/include/isc/time.h | 20 +++++++++++++++++
+ lib/isc/unix/time.c             | 22 +++++++++++++++++++
+ 6 files changed, 84 insertions(+), 5 deletions(-)
+
+diff --git a/lib/isc/include/isc/result.h b/lib/isc/include/isc/result.h
+index 0389efa..149cde5 100644
+--- a/lib/isc/include/isc/result.h
+++ b/lib/isc/include/isc/result.h
+@@ -89,7 +89,8 @@
+ #define ISC_R_DISCFULL			67	/*%< disc full */
+ #define ISC_R_DEFAULT			68	/*%< default */
+ #define ISC_R_IPV4PREFIX		69	/*%< IPv4 prefix */
+-#define ISC_R_NRESULTS 			70
+#define ISC_R_TIMESHIFTED               70      /*%< system time changed */
+#define ISC_R_NRESULTS 			71
+ 
+ ISC_LANG_BEGINDECLS
+ 
+diff --git a/lib/isc/include/isc/util.h b/lib/isc/include/isc/util.h
+index 973c348..8160dd3 100644
+--- a/lib/isc/include/isc/util.h
+++ b/lib/isc/include/isc/util.h
+@@ -289,6 +289,9 @@ extern void mock_assert(const int result, const char* const expression,
+  * Time
+  */
+ #define TIME_NOW(tp) 	RUNTIME_CHECK(isc_time_now((tp)) == ISC_R_SUCCESS)
+#ifdef CLOCK_BOOTTIME
+#define TIME_MONOTONIC(tp) 	RUNTIME_CHECK(isc_time_boottime((tp)) == ISC_R_SUCCESS)
+#endif
+ 
+ /*%
+  * Alignment
+diff --git a/lib/isc/result.c b/lib/isc/result.c
+index a9db132..7c04831 100644
+--- a/lib/isc/result.c
+++ b/lib/isc/result.c
+@@ -105,6 +105,7 @@ static const char *description[ISC_R_NRESULTS] = {
+ 	"disc full",				/*%< 67 */
+ 	"default",				/*%< 68 */
+ 	"IPv4 prefix",				/*%< 69 */
+        "time changed",                         /*%< 70 */
+ };
+ 
+ static const char *identifier[ISC_R_NRESULTS] = {
+@@ -178,6 +179,7 @@ static const char *identifier[ISC_R_NRESULTS] = {
+ 	"ISC_R_DISCFULL",
+ 	"ISC_R_DEFAULT",
+ 	"ISC_R_IPV4PREFIX",
+        "ISC_R_TIMESHIFTED",
+ };
+ 
+ #define ISC_RESULT_RESULTSET			2
+diff --git a/lib/isc/unix/app.c b/lib/isc/unix/app.c
+index a6e9882..52eb3e0 100644
+--- a/lib/isc/unix/app.c
+++ b/lib/isc/unix/app.c
+@@ -442,15 +442,48 @@ isc__app_ctxonrun(isc_appctx_t *ctx0, isc_mem_t *mctx, isc_task_t *task,
+ static isc_result_t
+ evloop(isc__appctx_t *ctx) {
+ 	isc_result_t result;
+        isc_time_t now;
+#ifdef CLOCK_BOOTTIME
+        isc_time_t monotonic;
+        uint64_t diff  = 0;
+#else
+        isc_time_t prev;
+        TIME_NOW(&prev);
+#endif
+
+
+ 
+ 	while (!ctx->want_shutdown) {
+ 		int n;
+-		isc_time_t when, now;
+		isc_time_t when;
+ 		struct timeval tv, *tvp;
+ 		isc_socketwait_t *swait;
+ 		bool readytasks;
+ 		bool call_timer_dispatch = false;
+-
+                uint64_t us;
+
+#ifdef CLOCK_BOOTTIME
+                // TBD macros for following three lines
+                TIME_NOW(&now);
+                TIME_MONOTONIC(&monotonic);
+                INSIST(now.seconds > monotonic.seconds)
+                us = isc_time_microdiff (&now, &monotonic);
+                if (us < diff){
+                  us = diff - us;
+                  if (us > 1000000){ // ignoring shifts less than one second
+                    return ISC_R_TIMESHIFTED;
+                  };
+                  diff = isc_time_microdiff (&now, &monotonic);
+                } else {
+                  diff = isc_time_microdiff (&now, &monotonic);
+                  // not implemented
+                }
+#else
+                TIME_NOW(&now);
+                if (isc_time_compare (&now, &prev) < 0)
+                  return ISC_R_TIMESHIFTED;
+                TIME_NOW(&prev);
+#endif
+ 		/*
+ 		 * Check the reload (or suspend) case first for exiting the
+ 		 * loop as fast as possible in case:
+@@ -475,8 +508,6 @@ evloop(isc__appctx_t *ctx) {
+ 			if (result != ISC_R_SUCCESS)
+ 				tvp = NULL;
+ 			else {
+-				uint64_t us;
+-
+ 				TIME_NOW(&now);
+ 				us = isc_time_microdiff(&when, &now);
+ 				if (us == 0)
+diff --git a/lib/isc/unix/include/isc/time.h b/lib/isc/unix/include/isc/time.h
+index b864c29..5dd43c9 100644
+--- a/lib/isc/unix/include/isc/time.h
+++ b/lib/isc/unix/include/isc/time.h
+@@ -132,6 +132,26 @@ isc_time_isepoch(const isc_time_t *t);
+  *\li	't' is a valid pointer.
+  */
+ 
+#ifdef CLOCK_BOOTTIME
+isc_result_t
+isc_time_boottime(isc_time_t *t);
+/*%<
+ * Set 't' to monotonic time from previous boot
+ * it's not affected by system time change. It also
+ * includes the time system was suspended
+ *
+ * Requires:
+ *\li	't' is a valid pointer.
+ *
+ * Returns:
+ *
+ *\li	Success
+ *\li	Unexpected error
+ *		Getting the time from the system failed.
+ */
+#endif /* CLOCK_BOOTTIME */
+ 
+
+ isc_result_t
+ isc_time_now(isc_time_t *t);
+ /*%<
+diff --git a/lib/isc/unix/time.c b/lib/isc/unix/time.c
+index 8edc9df..fe0bb91 100644
+--- a/lib/isc/unix/time.c
+++ b/lib/isc/unix/time.c
+@@ -498,3 +498,25 @@ isc_time_formatISO8601ms(const isc_time_t *t, char *buf, unsigned int len) {
+ 			 t->nanoseconds / NS_PER_MS);
+ 	}
+ }
+
+
+#ifdef CLOCK_BOOTTIME
+isc_result_t
+isc_time_boottime(isc_time_t *t) {
+  struct timespec ts;
+  
+  char strbuf[ISC_STRERRORSIZE];
+
+  if (clock_gettime (CLOCK_BOOTTIME, &ts) != 0){
+    isc__strerror(errno, strbuf, sizeof(strbuf));
+    UNEXPECTED_ERROR(__FILE__, __LINE__, "%s", strbuf);
+    return (ISC_R_UNEXPECTED);    
+  }
+
+  t->seconds = ts.tv_sec;
+  t->nanoseconds = ts.tv_nsec;
+
+  return (ISC_R_SUCCESS);
+  
+};
+#endif
+-- 
+2.20.1
+
--- a/bind-9.11-rh1736762-5.patch
+++ b/bind-9.11-rh1736762-5.patch
@ -0,0 +1,59 @@
+From 6257d829c9d7e71ac51bcdc6b5b981c7a19200e2 Mon Sep 17 00:00:00 2001
+From: Mark Andrews <marka@isc.org>
+Date: Mon, 25 Nov 2019 05:46:55 +0000
+Subject: [PATCH] Merge branch
+ '1373-threadsanitizer-data-race-rbtdb-c-5193-in-detachnode' into 'master'
+
+Resolve "ThreadSanitizer: data race rbtdb.c:5193 in detachnode"
+
+Closes #1373
+
+See merge request isc-projects/bind9!2598
+---
+ lib/dns/include/dns/rbt.h | 22 +++++++++-------------
+ 1 file changed, 9 insertions(+), 13 deletions(-)
+
+diff --git a/lib/dns/include/dns/rbt.h b/lib/dns/include/dns/rbt.h
+index 67ac3e4d8a..a084bd6193 100644
+--- a/lib/dns/include/dns/rbt.h
+++ b/lib/dns/include/dns/rbt.h
+@@ -49,10 +49,7 @@ ISC_LANG_BEGINDECLS
+ 
+ #define DNS_RBT_USEMAGIC 1
+ 
+-/*
+- * These should add up to 30.
+- */
+-#define DNS_RBT_LOCKLENGTH                      10
+#define DNS_RBT_LOCKLENGTH		(sizeof(((dns_rbtnode_t *)0)->locknum)*8)
+ #define DNS_RBT_REFLENGTH                       20
+ 
+ #define DNS_RBTNODE_MAGIC               ISC_MAGIC('R','B','N','O')
+@@ -159,16 +156,15 @@ struct dns_rbtnode {
+ 	 * separate region of memory.
+ 	 */
+ 	void *data;
+-	unsigned int :0;                /* start of bitfields c/o node lock */
+-	unsigned int dirty:1;
+-	unsigned int wild:1;
+-	unsigned int locknum:DNS_RBT_LOCKLENGTH;
+-#ifndef DNS_RBT_USEISCREFCOUNT
+-	unsigned int references:DNS_RBT_REFLENGTH;
+-#endif
+-	unsigned int :0;                /* end of bitfields c/o node lock */
+	uint8_t :0;                /* start of bitfields c/o node lock */
+	uint8_t dirty:1;
+	uint8_t wild:1;
+	uint8_t :0;                /* end of bitfields c/o node lock */
+	uint16_t locknum;	   /* note that this is not in the bitfield */
+ #ifdef DNS_RBT_USEISCREFCOUNT
+-	isc_refcount_t references; /* note that this is not in the bitfield */
+	isc_refcount_t references;
+#else
+	unsigned int references:DNS_RBT_REFLENGTH;
+ #endif
+ 	/*@}*/
+ };
+-- 
+2.21.0
+
--- a/bind-9.11-rh1736762-6.patch
+++ b/bind-9.11-rh1736762-6.patch
@ -0,0 +1,157 @@
+From c163f23146d03c91f13162b03f90b72f1941cf30 Mon Sep 17 00:00:00 2001
+From: Mark Andrews <marka@isc.org>
+Date: Thu, 12 Dec 2019 20:41:44 +1100
+Subject: [PATCH] give zspill its own lock
+
+(cherry picked from commit a52189e8e67a20097539fe3e6f7da4e4c01dc340)
+---
+ lib/dns/resolver.c | 45 +++++++++++++++++++++++++++++----------------
+ 1 file changed, 29 insertions(+), 16 deletions(-)
+
+diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
+index 8db9845..62a1ae5 100644
+--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
+@@ -459,20 +459,21 @@ struct dns_resolver {
+ 	isc_mutex_t			lock;
+ 	isc_mutex_t			nlock;
+ 	isc_mutex_t			primelock;
+	isc_mutex_t			zspill_lock;
+ 	dns_rdataclass_t		rdclass;
+ 	isc_socketmgr_t *		socketmgr;
+ 	isc_timermgr_t *		timermgr;
+ 	isc_taskmgr_t *			taskmgr;
+ 	dns_view_t *			view;
+-	bool			frozen;
+	bool				frozen;
+ 	unsigned int			options;
+ 	dns_dispatchmgr_t *		dispatchmgr;
+ 	dns_dispatchset_t *		dispatches4;
+-	bool			exclusivev4;
+	bool				exclusivev4;
+ 	dns_dispatchset_t *		dispatches6;
+ 	isc_dscp_t			querydscp4;
+ 	isc_dscp_t			querydscp6;
+-	bool			exclusivev6;
+	bool				exclusivev6;
+ 	unsigned int			nbuckets;
+ 	fctxbucket_t *			buckets;
+ 	zonebucket_t *			dbuckets;
+@@ -491,20 +492,22 @@ struct dns_resolver {
+ 	unsigned int			spillatmax;
+ 	unsigned int			spillatmin;
+ 	isc_timer_t *			spillattimer;
+-	bool			zero_no_soa_ttl;
+	bool				zero_no_soa_ttl;
+ 	unsigned int			query_timeout;
+ 	unsigned int			maxdepth;
+ 	unsigned int			maxqueries;
+ 	isc_result_t			quotaresp[2];
+ 
+	/* Locked by zspill_lock. */
+	unsigned int			zspill;		/* fetches-per-zone */
+
+ 	/* Locked by lock. */
+ 	unsigned int			references;
+-	bool			exiting;
+	bool				exiting;
+ 	isc_eventlist_t			whenshutdown;
+ 	unsigned int			activebuckets;
+-	bool			priming;
+	bool				priming;
+ 	unsigned int			spillat;	/* clients-per-query */
+-	unsigned int			zspill;		/* fetches-per-zone */
+ 
+ 	dns_badcache_t  * 		badcache;	 /* Bad cache. */
+ 
+@@ -1252,7 +1255,7 @@ fcount_incr(fetchctx_t *fctx, bool force) {
+ 	isc_result_t result = ISC_R_SUCCESS;
+ 	zonebucket_t *dbucket;
+ 	fctxcount_t *counter;
+-	unsigned int bucketnum, spill;
+	unsigned int bucketnum;
+ 
+ 	REQUIRE(fctx != NULL);
+ 	REQUIRE(fctx->res != NULL);
+@@ -1261,10 +1264,6 @@ fcount_incr(fetchctx_t *fctx, bool force) {
+ 	bucketnum = dns_name_fullhash(&fctx->domain, false)
+ 			% RES_DOMAIN_BUCKETS;
+ 
+-	LOCK(&fctx->res->lock);
+-	spill = fctx->res->zspill;
+-	UNLOCK(&fctx->res->lock);
+-
+ 	dbucket = &fctx->res->dbuckets[bucketnum];
+ 
+ 	LOCK(&dbucket->lock);
+@@ -1292,6 +1291,12 @@ fcount_incr(fetchctx_t *fctx, bool force) {
+ 			ISC_LIST_APPEND(dbucket->list, counter, link);
+ 		}
+ 	} else {
+		unsigned int spill;
+
+		LOCK(&fctx->res->zspill_lock);
+		spill = fctx->res->zspill;
+		UNLOCK(&fctx->res->zspill_lock);
+
+ 		if (!force && spill != 0 && counter->count >= spill) {
+ 			counter->dropped++;
+ 			fcount_logspill(fctx, counter);
+@@ -8807,6 +8812,7 @@ destroy(dns_resolver_t *res) {
+ 
+ 	INSIST(res->nfctx == 0);
+ 
+	DESTROYLOCK(&res->zspill_lock);
+ 	DESTROYLOCK(&res->primelock);
+ 	DESTROYLOCK(&res->nlock);
+ 	DESTROYLOCK(&res->lock);
+@@ -9083,10 +9089,14 @@ dns_resolver_create(dns_view_t *view,
+ 	if (result != ISC_R_SUCCESS)
+ 		goto cleanup_nlock;
+ 
+	result = isc_mutex_init(&res->zspill_lock);
+	if (result != ISC_R_SUCCESS)
+		goto cleanup_primelock;
+
+ 	task = NULL;
+ 	result = isc_task_create(taskmgr, 0, &task);
+ 	if (result != ISC_R_SUCCESS)
+-		goto cleanup_primelock;
+		goto cleanup_zspill_lock;
+ 	isc_task_setname(task, "resolver_task", NULL);
+ 
+ 	result = isc_timer_create(timermgr, isc_timertype_inactive, NULL, NULL,
+@@ -9094,7 +9104,7 @@ dns_resolver_create(dns_view_t *view,
+ 				  &res->spillattimer);
+ 	isc_task_detach(&task);
+ 	if (result != ISC_R_SUCCESS)
+-		goto cleanup_primelock;
+		goto cleanup_zspill_lock;
+ 
+ #if USE_ALGLOCK
+ 	result = isc_rwlock_init(&res->alglock, 0, 0);
+@@ -9127,6 +9137,9 @@ dns_resolver_create(dns_view_t *view,
+ 	isc_timer_detach(&res->spillattimer);
+ #endif
+ 
+ cleanup_zspill_lock:
+	DESTROYLOCK(&res->zspill_lock);
+
+  cleanup_primelock:
+ 	DESTROYLOCK(&res->primelock);
+ 
+@@ -10269,9 +10282,9 @@ dns_resolver_setfetchesperzone(dns_resolver_t *resolver, uint32_t clients)
+ {
+ 	REQUIRE(VALID_RESOLVER(resolver));
+ 
+-	LOCK(&resolver->lock);
+	LOCK(&resolver->zspill_lock);
+ 	resolver->zspill = clients;
+-	UNLOCK(&resolver->lock);
+	UNLOCK(&resolver->zspill_lock);
+ }
+ 
+ 
+-- 
+2.21.0
+
--- a/bind-9.11-rh1736762-7.patch
+++ b/bind-9.11-rh1736762-7.patch
@ -0,0 +1,77 @@
+From 23a6775f62deeee63e9f7927be387fecf23a8074 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
+Date: Tue, 10 Dec 2019 10:02:09 +0100
+Subject: [PATCH] Ensure all zone_settimer() calls are done on locked zone
+
+(cherry picked from commit cf48e8eb326f824170f2069e5d5c33992b1783a4)
+(cherry picked from commit 3bac7e98074643ff62582545e5840e4195517b07)
+---
+ lib/dns/zone.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/lib/dns/zone.c b/lib/dns/zone.c
+index e8cff77588..db837aae50 100644
+--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
+@@ -10291,7 +10291,9 @@ zone_maintenance(dns_zone_t *zone) {
+ 	default:
+ 		break;
+ 	}
+	LOCK_ZONE(zone);
+ 	zone_settimer(zone, &now);
+	UNLOCK_ZONE(zone);
+ }
+ 
+ void
+@@ -13081,6 +13083,7 @@ zone_settimer(dns_zone_t *zone, isc_time_t *now) {
+ 	isc_result_t result;
+ 
+ 	REQUIRE(DNS_ZONE_VALID(zone));
+	REQUIRE(LOCKED_ZONE(zone));
+ 	ENTER;
+ 
+ 	if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_EXITING))
+@@ -18405,6 +18408,7 @@ zone_rekey(dns_zone_t *zone) {
+ 		UNLOCK_ZONE(zone);
+ 	}
+ 
+	LOCK_ZONE(zone);
+ 	isc_time_settoepoch(&zone->refreshkeytime);
+ 
+ 	/*
+@@ -18416,11 +18420,9 @@ zone_rekey(dns_zone_t *zone) {
+ 		isc_time_t timethen;
+ 		isc_stdtime_t then;
+ 
+-		LOCK_ZONE(zone);
+ 		DNS_ZONE_TIME_ADD(&timenow, zone->refreshkeyinterval,
+ 				  &timethen);
+ 		zone->refreshkeytime = timethen;
+-		UNLOCK_ZONE(zone);
+ 
+ 		for (key = ISC_LIST_HEAD(dnskeys);
+ 		     key != NULL;
+@@ -18431,12 +18433,10 @@ zone_rekey(dns_zone_t *zone) {
+ 				continue;
+ 
+ 			DNS_ZONE_TIME_ADD(&timenow, then - now, &timethen);
+-			LOCK_ZONE(zone);
+ 			if (isc_time_compare(&timethen,
+ 					     &zone->refreshkeytime) < 0) {
+ 				zone->refreshkeytime = timethen;
+ 			}
+-			UNLOCK_ZONE(zone);
+ 		}
+ 
+ 		zone_settimer(zone, &timenow);
+@@ -18444,6 +18444,7 @@ zone_rekey(dns_zone_t *zone) {
+ 		isc_time_formattimestamp(&zone->refreshkeytime, timebuf, 80);
+ 		dns_zone_log(zone, ISC_LOG_INFO, "next key event: %s", timebuf);
+ 	}
+	UNLOCK_ZONE(zone);
+ 
+  done:
+ 	dns_diff_clear(&diff);
+-- 
+2.21.0
+
--- a/bind-9.11-rh1736762-8.patch
+++ b/bind-9.11-rh1736762-8.patch
@ -0,0 +1,38 @@
+From 7e844b093b0442bdc5cdc5aefd56fdc05f9be88f Mon Sep 17 00:00:00 2001
+From: Mark Andrews <marka@isc.org>
+Date: Thu, 12 Dec 2019 19:17:39 +1100
+Subject: [PATCH] acquire task lock before calling push_readyq for task->flags
+ access
+
+(cherry picked from commit 7c94d2cd7dfaa3f04cd86ad9ed97e8366a774a4c)
+---
+ lib/isc/task.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/lib/isc/task.c b/lib/isc/task.c
+index 329604a465..f9c4354bd2 100644
+--- a/lib/isc/task.c
+++ b/lib/isc/task.c
+@@ -473,7 +473,9 @@ task_ready(isc__task_t *task) {
+ 	XTRACE("task_ready");
+ 
+ 	LOCK(&manager->lock);
+	LOCK(&task->lock);
+ 	push_readyq(manager, task);
+	UNLOCK(&task->lock);
+ #ifdef USE_WORKER_THREADS
+ 	if (manager->mode == isc_taskmgrmode_normal || has_privilege)
+ 		SIGNAL(&manager->work_available);
+@@ -1263,7 +1265,9 @@ dispatch(isc__taskmgr_t *manager) {
+ 				 * might even hurt rather than help.
+ 				 */
+ #ifdef USE_WORKER_THREADS
+				LOCK(&task->lock);
+ 				push_readyq(manager, task);
+				UNLOCK(&task->lock);
+ #else
+ 				ENQUEUE(new_ready_tasks, task, ready_link);
+ 				if ((task->flags & TASK_F_PRIVILEGED) != 0)
+-- 
+2.21.0
+
--- a/bind-9.11-rh1768258.patch
+++ b/bind-9.11-rh1768258.patch
@ -0,0 +1,28 @@
+From 3466dfd7d44940821f195a36fceb0f1100f77c4e Mon Sep 17 00:00:00 2001
+From: Mark Andrews <marka@isc.org>
+Date: Tue, 5 Nov 2019 12:56:18 +1100
+Subject: [PATCH] The default geoip-directory should be
+ <MAXMINDDB_PREFIX>/share/GeoIP
+
+(cherry picked from commit fcd765a59db9b9a2b187448a90f3dbe6aa72fb84)
+(cherry picked from commit 7e79ebeebada6bcca81e8368eef72efbaae3c8c7)
+---
+ bin/named/config.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/bin/named/config.c b/bin/named/config.c
+index 833c1dc9d3..63da4b03f6 100644
+--- a/bin/named/config.c
+++ b/bin/named/config.c
+@@ -72,7 +72,7 @@ options {\n\
+ "	files unlimited;\n"
+ #endif
+ #if defined(HAVE_GEOIP2) && !defined(WIN32)
+-"	geoip-directory \"" MAXMINDDB_PREFIX "/share/GeoIP2\";\n"
+"	geoip-directory \"" MAXMINDDB_PREFIX "/share/GeoIP\";\n"
+ #elif defined(HAVE_GEOIP2)
+ "	geoip-directory \".\";\n"
+ #endif
+-- 
+2.20.1
+
--- a/bind-9.11-rt31459.patch
+++ b/bind-9.11-rt31459.patch
@ -1,4 +1,4 @@
-From 99fc89de7b96713a7c82ea9b98d5bc0c70ad1f6e Mon Sep 17 00:00:00 2001
+From e83a6723d84e4c4400ca646077393a24b092c623 Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Tue, 12 Sep 2017 19:05:46 -0700
 Subject: [PATCH] rebased rt31459c
@ -22,9 +22,9 @@ Include new unit test
 bin/dnssec/dnssec-verify.c               |   8 +-
 bin/dnssec/dnssectool.c                  |  11 +-
 bin/named/server.c                       |   6 +
- bin/nsupdate/nsupdate.c                  |  18 +-
+ bin/nsupdate/nsupdate.c                  |  14 +-
 bin/tests/makejournal.c                  |   6 +-
- bin/tests/system/pipelined/pipequeries.c |  21 +-
+ bin/tests/system/pipelined/pipequeries.c |  20 +-
 bin/tests/system/pipelined/tests.sh      |   4 +-
 bin/tests/system/rsabigexponent/bigkey.c |   4 +
 bin/tests/system/tkey/keycreate.c        |  26 ++-
@ -48,8 +48,8 @@ Include new unit test
 lib/isc/include/isc/types.h              |   2 +
 lib/isc/pk11.c                           |  12 +-
 lib/isc/win32/include/isc/platform.h.in  |   5 +
- win32utils/Configure                     |  29 ++-
- 36 files changed, 707 insertions(+), 175 deletions(-)
+ win32utils/Configure                     |  28 ++-
+ 36 files changed, 701 insertions(+), 175 deletions(-)
 create mode 100644 lib/dns/tests/dstrandom_test.c

 diff --git a/bin/confgen/keygen.c b/bin/confgen/keygen.c
@ -71,10 +71,10 @@ index 5015abb..295e16f 100644
 							     &entropy_source,
 							     randomfile,
 diff --git a/bin/dnssec/dnssec-dsfromkey.c b/bin/dnssec/dnssec-dsfromkey.c
-index 931d5de..864f2ad 100644
+index d9d6bb9..de4b15f 100644
 --- a/bin/dnssec/dnssec-dsfromkey.c
 +++ b/bin/dnssec/dnssec-dsfromkey.c
-@@ -494,14 +494,14 @@ main(int argc, char **argv) {
+@@ -498,14 +498,14 @@ main(int argc, char **argv) {
 
 	if (ectx == NULL)
 		setup_entropy(mctx, NULL, &ectx);
@ -92,7 +92,7 @@ index 931d5de..864f2ad 100644
 	isc_entropy_stopcallbacksources(ectx);
 
 	setup_logging(mctx, &log);
-@@ -563,8 +563,8 @@ main(int argc, char **argv) {
+@@ -574,8 +574,8 @@ main(int argc, char **argv) {
 	if (dns_rdataset_isassociated(&rdataset))
 		dns_rdataset_disassociate(&rdataset);
 	cleanup_logging(&log);
@ -103,10 +103,10 @@ index 931d5de..864f2ad 100644
 	dns_name_destroy();
 	if (verbose > 10)
 diff --git a/bin/dnssec/dnssec-importkey.c b/bin/dnssec/dnssec-importkey.c
-index 0d1e7f8..79c4d74 100644
+index d65a514..04b3094 100644
 --- a/bin/dnssec/dnssec-importkey.c
 +++ b/bin/dnssec/dnssec-importkey.c
-@@ -407,14 +407,14 @@ main(int argc, char **argv) {
+@@ -404,14 +404,14 @@ main(int argc, char **argv) {
 
 	if (ectx == NULL)
 		setup_entropy(mctx, NULL, &ectx);
@ -124,7 +124,7 @@ index 0d1e7f8..79c4d74 100644
 	isc_entropy_stopcallbacksources(ectx);
 
 	setup_logging(mctx, &log);
-@@ -458,8 +458,8 @@ main(int argc, char **argv) {
+@@ -455,8 +455,8 @@ main(int argc, char **argv) {
 	if (dns_rdataset_isassociated(&rdataset))
 		dns_rdataset_disassociate(&rdataset);
 	cleanup_logging(&log);
@ -167,10 +167,10 @@ index 7d82dbf..10f9359 100644
 	if (verbose > 10)
 		isc_mem_stats(mctx, stdout);
 diff --git a/bin/dnssec/dnssec-settime.c b/bin/dnssec/dnssec-settime.c
-index f355903..6a2ca59 100644
+index 7afcaee..1cfa511 100644
 --- a/bin/dnssec/dnssec-settime.c
 +++ b/bin/dnssec/dnssec-settime.c
-@@ -382,14 +382,14 @@ main(int argc, char **argv) {
+@@ -380,14 +380,14 @@ main(int argc, char **argv) {
 
 	if (ectx == NULL)
 		setup_entropy(mctx, NULL, &ectx);
@ -188,7 +188,7 @@ index f355903..6a2ca59 100644
 	isc_entropy_stopcallbacksources(ectx);
 
 	if (predecessor != NULL) {
-@@ -674,8 +674,8 @@ main(int argc, char **argv) {
+@@ -672,8 +672,8 @@ main(int argc, char **argv) {
 	if (prevkey != NULL)
 		dst_key_free(&prevkey);
 	dst_key_free(&key);
@ -199,7 +199,7 @@ index f355903..6a2ca59 100644
 	if (verbose > 10)
 		isc_mem_stats(mctx, stdout);
 diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c
-index c6a0313..6ddaebe 100644
+index 71f5672..9b100ca 100644
 --- a/bin/dnssec/dnssec-signzone.c
 +++ b/bin/dnssec/dnssec-signzone.c
@@ -3460,14 +3460,15 @@ main(int argc, char *argv[]) {
@ -257,7 +257,7 @@ index 4c293bf..3263cbc 100644
 
 	rdclass = strtoclass(classname);
 diff --git a/bin/dnssec/dnssectool.c b/bin/dnssec/dnssectool.c
-index fbc7ece..31a99e7 100644
+index 9d2a016..a9f90b6 100644
 --- a/bin/dnssec/dnssectool.c
 +++ b/bin/dnssec/dnssectool.c
@@ -34,6 +34,7 @@
@ -293,7 +293,7 @@ index fbc7ece..31a99e7 100644
 					   usekeyboard);
 
 diff --git a/bin/named/server.c b/bin/named/server.c
-index b63a386..30e7eac 100644
+index 5a860e4..21c340c 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
@@ -36,6 +36,7 @@
@ -304,7 +304,7 @@ index b63a386..30e7eac 100644
 #include <isc/portset.h>
 #include <isc/print.h>
 #include <isc/random.h>
-@@ -8210,6 +8211,10 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8217,6 +8218,10 @@ load_configuration(const char *filename, ns_server_t *server,
 				      "no source of entropy found");
 		} else {
 			const char *randomdev = cfg_obj_asstring(obj);
@ -315,27 +315,19 @@ index b63a386..30e7eac 100644
 			int level = ISC_LOG_ERROR;
 			result = isc_entropy_createfilesource(ns_g_entropy,
 							      randomdev);
-@@ -8244,6 +8249,7 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8251,6 +8256,7 @@ load_configuration(const char *filename, ns_server_t *server,
 				}
 				isc_entropy_detach(&ns_g_fallbackentropy);
 			}
 +#endif
 #endif
 		}
- 	}
+ 
 diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
-index 509784c..6d7a02e 100644
+index bbb3936..0286987 100644
 --- a/bin/nsupdate/nsupdate.c
 +++ b/bin/nsupdate/nsupdate.c
-@@ -35,6 +35,7 @@
- #include <isc/mem.h>
- #include <isc/parseint.h>
- #include <isc/print.h>
-+#include <isc/platform.h>
- #include <isc/random.h>
- #include <isc/region.h>
- #include <isc/sockaddr.h>
-@@ -271,7 +272,8 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
+@@ -272,7 +272,8 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
 	if (*ectx == NULL) {
 		result = isc_entropy_create(mctx, ectx);
 		if (result != ISC_R_SUCCESS)
@ -345,7 +337,7 @@ index 509784c..6d7a02e 100644
 		ISC_LIST_INIT(sources);
 	}
 
-@@ -280,6 +282,13 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
+@@ -281,6 +282,13 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
 		randomfile = NULL;
 	}
 
@ -359,7 +351,7 @@ index 509784c..6d7a02e 100644
 	result = isc_entropy_usebestsource(*ectx, &source, randomfile,
 					   usekeyboard);
 
-@@ -950,11 +959,11 @@ setup_system(void) {
+@@ -979,11 +987,11 @@ setup_system(void) {
 		}
 	}
 
@ -373,16 +365,6 @@ index 509784c..6d7a02e 100644
 
 	result = dns_dispatchmgr_create(gmctx, entropy, &dispatchmgr);
 	check_result(result, "dns_dispatchmgr_create");
-@@ -978,6 +987,9 @@ setup_system(void) {
- 	check_result(result, "dst_lib_init");
- 	is_dst_up = true;
- 
-+	/* moved after dst_lib_init() */
-+	isc_hash_init();
-+
- 	attrmask = DNS_DISPATCHATTR_UDP | DNS_DISPATCHATTR_TCP;
- 	attrmask |= DNS_DISPATCHATTR_IPV4 | DNS_DISPATCHATTR_IPV6;
- 
 diff --git a/bin/tests/makejournal.c b/bin/tests/makejournal.c
 index 61a41b0..acc71a1 100644
 --- a/bin/tests/makejournal.c
@ -404,7 +386,7 @@ index 61a41b0..acc71a1 100644
 	isc_log_registercategories(lctx, categories);
 	isc_log_setcontext(lctx);
 diff --git a/bin/tests/system/pipelined/pipequeries.c b/bin/tests/system/pipelined/pipequeries.c
-index 2fcc064..7b4f617 100644
+index c6ab7f8..f0a6ff2 100644
 --- a/bin/tests/system/pipelined/pipequeries.c
 +++ b/bin/tests/system/pipelined/pipequeries.c
@@ -204,6 +204,7 @@ sendqueries(isc_task_t *task, isc_event_t *event) {
@ -415,17 +397,16 @@ index 2fcc064..7b4f617 100644
 	isc_sockaddr_t bind_any;
 	struct in_addr inaddr;
 	isc_result_t result;
-@@ -224,7 +225,8 @@ main(int argc, char *argv[]) {
- 	UNUSED(argv);
+@@ -222,7 +223,7 @@ main(int argc, char *argv[]) {
+ 	int c;
 
 	isc_commandline_errprint = false;
 -	while ((c = isc_commandline_parse(argc, argv, "p:")) != -1) {
-+	while ((c = isc_commandline_parse(argc, argv, "p:r:")) != -1)
-+	{
+	while ((c = isc_commandline_parse(argc, argv, "p:r:")) != -1) {
 		switch (c) {
 		case 'p':
 			result = isc_parse_uint16(&port,
-@@ -235,6 +237,9 @@ main(int argc, char *argv[]) {
+@@ -233,6 +234,9 @@ main(int argc, char *argv[]) {
 				exit(1);
 			}
 			break;
@ -435,7 +416,7 @@ index 2fcc064..7b4f617 100644
 		case '?':
 			fprintf(stderr, "%s: invalid argument '%c'",
 				argv[0], c);
-@@ -276,10 +281,18 @@ main(int argc, char *argv[]) {
+@@ -275,10 +279,18 @@ main(int argc, char *argv[]) {
 
 	ectx = NULL;
 	RUNCHECK(isc_entropy_create(mctx, &ectx));
@ -456,7 +437,7 @@ index 2fcc064..7b4f617 100644
 
 	taskmgr = NULL;
 	RUNCHECK(isc_taskmgr_create(mctx, 1, 0, &taskmgr));
-@@ -332,8 +345,8 @@ main(int argc, char *argv[]) {
+@@ -331,8 +343,8 @@ main(int argc, char *argv[]) {
 	isc_task_detach(&task);
 	isc_taskmgr_destroy(&taskmgr);
 
@ -689,10 +670,10 @@ index 9f90dd7..fad6c83 100644
         echo "I:failed"
 	status=`expr $status + $ret`
 diff --git a/bin/tools/mdig.c b/bin/tools/mdig.c
-index b27fc1d..e28871b 100644
+index bf6dbb6..0416b21 100644
 --- a/bin/tools/mdig.c
 +++ b/bin/tools/mdig.c
-@@ -1969,12 +1969,11 @@ main(int argc, char *argv[]) {
+@@ -1972,12 +1972,11 @@ main(int argc, char *argv[]) {
 
 	ectx = NULL;
 	RUNCHECK(isc_entropy_create(mctx, &ectx));
@ -707,7 +688,7 @@ index b27fc1d..e28871b 100644
 	parse_args(false, argc, argv);
 	if (server == NULL)
 diff --git a/configure b/configure
-index e425720..4f09c96 100755
+index aab472a..b686178 100755
 --- a/configure
 +++ b/configure
@@ -640,6 +640,7 @@ ac_includes_default="\
@ -718,7 +699,7 @@ index e425720..4f09c96 100755
 BUILD_LIBS
 BUILD_LDFLAGS
 BUILD_CPPFLAGS
-@@ -824,6 +825,7 @@ XMLSTATS
+@@ -821,6 +822,7 @@ XMLSTATS
 NZDTARGETS
 NZDSRCS
 NZD_TOOLS
@ -726,7 +707,7 @@ index e425720..4f09c96 100755
 PKCS11_TEST
 PKCS11_ED25519
 PKCS11_GOST
-@@ -1039,6 +1041,7 @@ with_eddsa
+@@ -1045,6 +1047,7 @@ with_eddsa
 with_aes
 enable_openssl_hash
 with_cc_alg
@ -734,7 +715,7 @@ index e425720..4f09c96 100755
 with_lmdb
 with_libxml2
 with_libjson
-@@ -1735,6 +1738,7 @@ Optional Features:
+@@ -1745,6 +1748,7 @@ Optional Features:
   --enable-threads        enable multithreading
   --enable-native-pkcs11  use native PKCS11 for all crypto [default=no]
   --enable-openssl-hash   use OpenSSL for hash functions [default=no]
@ -742,7 +723,7 @@ index e425720..4f09c96 100755
   --enable-largefile      64-bit file support
   --enable-backtrace      log stack backtrace on abort [default=yes]
   --enable-symtable       use internal symbol table for backtrace
-@@ -16684,6 +16688,7 @@ case "$use_openssl" in
+@@ -17135,6 +17139,7 @@ case "$use_openssl" in
 $as_echo "disabled because of native PKCS11" >&6; }
 		DST_OPENSSL_INC=""
 		CRYPTO="-DPKCS11CRYPTO"
@ -750,7 +731,7 @@ index e425720..4f09c96 100755
 		OPENSSLECDSALINKOBJS=""
 		OPENSSLECDSALINKSRCS=""
 		OPENSSLEDDSALINKOBJS=""
-@@ -16698,6 +16703,7 @@ $as_echo "disabled because of native PKCS11" >&6; }
+@@ -17149,6 +17154,7 @@ $as_echo "disabled because of native PKCS11" >&6; }
 $as_echo "no" >&6; }
 		DST_OPENSSL_INC=""
 		CRYPTO=""
@ -758,7 +739,7 @@ index e425720..4f09c96 100755
 		OPENSSLECDSALINKOBJS=""
 		OPENSSLECDSALINKSRCS=""
 		OPENSSLEDDSALINKOBJS=""
-@@ -16710,6 +16716,7 @@ $as_echo "no" >&6; }
+@@ -17161,6 +17167,7 @@ $as_echo "no" >&6; }
 	auto)
 		DST_OPENSSL_INC=""
 		CRYPTO=""
@ -766,7 +747,7 @@ index e425720..4f09c96 100755
 		OPENSSLECDSALINKOBJS=""
 		OPENSSLECDSALINKSRCS=""
 		OPENSSLEDDSALINKOBJS=""
-@@ -16719,7 +16726,7 @@ $as_echo "no" >&6; }
+@@ -17170,7 +17177,7 @@ $as_echo "no" >&6; }
 		OPENSSLLINKOBJS=""
 		OPENSSLLINKSRCS=""
 		as_fn_error $? "OpenSSL was not found in any of $openssldirs; use --with-openssl=/path
@ -775,7 +756,7 @@ index e425720..4f09c96 100755
 		;;
 	*)
 		if test "yes" = "$want_native_pkcs11"
-@@ -16750,6 +16757,7 @@ $as_echo "not found" >&6; }
+@@ -17201,6 +17208,7 @@ $as_echo "not found" >&6; }
 			as_fn_error $? "\"$use_openssl/include/openssl/opensslv.h\" not found" "$LINENO" 5
 		fi
 		CRYPTO='-DOPENSSL'
@ -783,7 +764,7 @@ index e425720..4f09c96 100755
 		if test "/usr" = "$use_openssl"
 		then
 			DST_OPENSSL_INC=""
-@@ -17411,8 +17419,6 @@ fi
+@@ -17826,8 +17834,6 @@ fi
 # Use OpenSSL for hash functions
 #
 
@ -792,7 +773,7 @@ index e425720..4f09c96 100755
 ISC_PLATFORM_OPENSSLHASH="#undef ISC_PLATFORM_OPENSSLHASH"
 case $want_openssl_hash in
 	yes)
-@@ -17787,6 +17793,86 @@ if test "rt" = "$have_clock_gt"; then
+@@ -18202,6 +18208,86 @@ if test "rt" = "$have_clock_gt"; then
 	LIBS="-lrt $LIBS"
 fi
 
@ -879,7 +860,7 @@ index e425720..4f09c96 100755
 #
 # was --with-lmdb specified?
 #
-@@ -19869,9 +19955,12 @@ _ACEOF
+@@ -20284,9 +20370,12 @@ _ACEOF
 if ac_fn_c_try_compile "$LINENO"; then :
   { $as_echo "$as_me:${as_lineno-$LINENO}: result: size_t for buflen; int for flags" >&5
 $as_echo "size_t for buflen; int for flags" >&6; }
@ -894,7 +875,7 @@ index e425720..4f09c96 100755
 
 	 $as_echo "#define IRS_GETNAMEINFO_FLAGS_T int" >>confdefs.h
 
-@@ -21186,12 +21275,7 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
+@@ -21601,12 +21690,7 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
 ISC_PLATFORM_USESTDASM="#undef ISC_PLATFORM_USESTDASM"
 ISC_PLATFORM_USEMACASM="#undef ISC_PLATFORM_USEMACASM"
 if test "yes" = "$use_atomic"; then
@ -908,7 +889,7 @@ index e425720..4f09c96 100755
 # version HP92453-01 B.11.11.23709.GP, which incorrectly rejects
 # declarations like `int a3[[(sizeof (unsigned char)) >= 0]];'.
 # This bug is HP SR number 8606223364.
-@@ -21224,6 +21308,11 @@ cat >>confdefs.h <<_ACEOF
+@@ -21639,6 +21723,11 @@ cat >>confdefs.h <<_ACEOF
 _ACEOF
 
 
@ -920,7 +901,7 @@ index e425720..4f09c96 100755
 		if test $ac_cv_sizeof_void_p = 8; then
 			arch=x86_64
 			have_xaddq=yes
-@@ -21232,39 +21321,6 @@ _ACEOF
+@@ -21647,39 +21736,6 @@ _ACEOF
 		fi
 	;;
 	x86_64-*|amd64-*)
@ -960,7 +941,7 @@ index e425720..4f09c96 100755
 		if test $ac_cv_sizeof_void_p = 8; then
 			arch=x86_64
 			have_xaddq=yes
-@@ -21295,6 +21351,10 @@ $as_echo_n "checking architecture type for atomic operations... " >&6; }
+@@ -21710,6 +21766,10 @@ $as_echo_n "checking architecture type for atomic operations... " >&6; }
 $as_echo "$arch" >&6; }
 fi
 
@ -971,7 +952,7 @@ index e425720..4f09c96 100755
 if test "yes" = "$have_atomic"; then
 	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking compiler support for inline assembly code" >&5
 $as_echo_n "checking compiler support for inline assembly code... " >&6; }
-@@ -23848,6 +23908,30 @@ CFLAGS="$CFLAGS $SO_CFLAGS"
+@@ -24264,6 +24324,30 @@ CFLAGS="$CFLAGS $SO_CFLAGS"
 #
 dlzdir='${DLZ_DRIVER_DIR}'
 
@ -1002,7 +983,7 @@ index e425720..4f09c96 100755
 #
 # Private autoconf macro to simplify configuring drivers:
 #
-@@ -24178,11 +24262,11 @@ $as_echo "no" >&6; }
+@@ -24594,11 +24678,11 @@ $as_echo "no" >&6; }
 $as_echo "using mysql with libs ${mysql_lib} and includes ${mysql_include}" >&6; }
 		;;
 	*)
@ -1017,7 +998,7 @@ index e425720..4f09c96 100755
 		fi
 
 	CONTRIB_DLZ="$CONTRIB_DLZ -DDLZ_MYSQL"
-@@ -24267,7 +24351,7 @@ $as_echo "" >&6; }
+@@ -24683,7 +24767,7 @@ $as_echo "" >&6; }
 			# Check other locations for includes.
 			# Order is important (sigh).
 
@ -1026,7 +1007,7 @@ index e425720..4f09c96 100755
 			# include a blank element first
 			for d in "" $bdb_incdirs
 			do
-@@ -24292,57 +24376,9 @@ $as_echo "" >&6; }
+@@ -24708,57 +24792,9 @@ $as_echo "" >&6; }
 			bdb_libnames="db53 db-5.3 db51 db-5.1 db48 db-4.8 db47 db-4.7 db46 db-4.6 db45 db-4.5 db44 db-4.4 db43 db-4.3 db42 db-4.2 db41 db-4.1 db"
 			for d in $bdb_libnames
 			do
@ -1086,7 +1067,7 @@ index e425720..4f09c96 100755
 					break
 				fi
 			done
-@@ -24501,10 +24537,10 @@ $as_echo "no" >&6; }
+@@ -24917,10 +24953,10 @@ $as_echo "no" >&6; }
 		DLZ_DRIVER_INCLUDES="$DLZ_DRIVER_INCLUDES -I$use_dlz_ldap/include"
 		DLZ_DRIVER_LDAP_INCLUDES="-I$use_dlz_ldap/include"
 	fi
@ -1100,7 +1081,7 @@ index e425720..4f09c96 100755
 	fi
 
 
-@@ -24590,11 +24626,11 @@ fi
+@@ -25006,11 +25042,11 @@ fi
 		odbcdirs="/usr /usr/local /usr/pkg"
 		for d in $odbcdirs
 		do
@ -1114,7 +1095,7 @@ index e425720..4f09c96 100755
 				break
 			fi
 		done
-@@ -24869,6 +24905,8 @@ DNS_CRYPTO_LIBS="$NEWFLAGS"
+@@ -25285,6 +25321,8 @@ DNS_CRYPTO_LIBS="$NEWFLAGS"
 
 
 
@ -1123,7 +1104,7 @@ index e425720..4f09c96 100755
 #
 # Commands to run at the end of config.status.
 # Don't just put these into configure, it won't work right if somebody
-@@ -27248,6 +27286,8 @@ report() {
+@@ -27661,6 +27699,8 @@ report() {
 	    echo "    IPv6 support (--enable-ipv6)"
 	test "X$CRYPTO" = "X" -o "yes" = "$want_native_pkcs11" || \
 		echo "    OpenSSL cryptography/DNSSEC (--with-openssl)"
@ -1132,7 +1113,7 @@ index e425720..4f09c96 100755
 	test "X$PYTHON" = "X" || echo "    Python tools (--with-python)"
 	test "X$XMLSTATS" = "X" || echo "    XML statistics (--with-libxml2)"
 	test "X$JSONSTATS" = "X" || echo "    JSON statistics (--with-libjson)"
-@@ -27288,6 +27328,8 @@ report() {
+@@ -27701,6 +27741,8 @@ report() {
 	echo "    Very verbose query trace logging (--enable-querytrace)"
     test "no" = "$with_cmocka" || echo "    CMocka Unit Testing Framework (--with-cmocka)"
 
@ -1141,7 +1122,7 @@ index e425720..4f09c96 100755
     echo "    Dynamically loadable zone (DLZ) drivers:"
     test "no" = "$use_dlz_bdb" || \
 	echo "        Berkeley DB (--with-dlz-bdb)"
-@@ -27335,6 +27377,8 @@ report() {
+@@ -27748,6 +27790,8 @@ report() {
 	echo "    ECDSA algorithm support (--with-ecdsa)"
     test "X$CRYPTO" = "X" -o "yes" = "$OPENSSL_ED25519" -o "yes" = "$PKCS11_ED25519" || \
 	echo "    EDDSA algorithm support (--with-eddsa)"
@ -1151,10 +1132,10 @@ index e425720..4f09c96 100755
     test "yes" = "$enable_seccomp" || \
 	echo "    Use libseccomp system call filtering (--enable-seccomp)"
 diff --git a/configure.ac b/configure.ac
-index 7c5ad51..fddc63a 100644
+index 0e16cc8..dd0055d 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -1503,6 +1503,7 @@ case "$use_openssl" in
+@@ -1550,6 +1550,7 @@ case "$use_openssl" in
 		AC_MSG_RESULT(disabled because of native PKCS11)
 		DST_OPENSSL_INC=""
 		CRYPTO="-DPKCS11CRYPTO"
@ -1162,7 +1143,7 @@ index 7c5ad51..fddc63a 100644
 		OPENSSLECDSALINKOBJS=""
 		OPENSSLECDSALINKSRCS=""
 		OPENSSLEDDSALINKOBJS=""
-@@ -1516,6 +1517,7 @@ case "$use_openssl" in
+@@ -1563,6 +1564,7 @@ case "$use_openssl" in
 		AC_MSG_RESULT(no)
 		DST_OPENSSL_INC=""
 		CRYPTO=""
@ -1170,7 +1151,7 @@ index 7c5ad51..fddc63a 100644
 		OPENSSLECDSALINKOBJS=""
 		OPENSSLECDSALINKSRCS=""
 		OPENSSLEDDSALINKOBJS=""
-@@ -1528,6 +1530,7 @@ case "$use_openssl" in
+@@ -1575,6 +1577,7 @@ case "$use_openssl" in
 	auto)
 		DST_OPENSSL_INC=""
 		CRYPTO=""
@ -1178,7 +1159,7 @@ index 7c5ad51..fddc63a 100644
 		OPENSSLECDSALINKOBJS=""
 		OPENSSLECDSALINKSRCS=""
 		OPENSSLEDDSALINKOBJS=""
-@@ -1538,7 +1541,7 @@ case "$use_openssl" in
+@@ -1585,7 +1588,7 @@ case "$use_openssl" in
 		OPENSSLLINKSRCS=""
 		AC_MSG_ERROR(
 [OpenSSL was not found in any of $openssldirs; use --with-openssl=/path
@ -1187,7 +1168,7 @@ index 7c5ad51..fddc63a 100644
 		;;
 	*)
 		if test "yes" = "$want_native_pkcs11"
-@@ -1568,6 +1571,7 @@ If you don't want OpenSSL, use --without-openssl])
+@@ -1615,6 +1618,7 @@ If you don't want OpenSSL, use --without-openssl])
 			AC_MSG_ERROR(["$use_openssl/include/openssl/opensslv.h" not found])
 		fi
 		CRYPTO='-DOPENSSL'
@ -1195,7 +1176,7 @@ index 7c5ad51..fddc63a 100644
 		if test "/usr" = "$use_openssl"
 		then
 			DST_OPENSSL_INC=""
-@@ -2041,7 +2045,6 @@ fi
+@@ -2050,7 +2054,6 @@ fi
 # Use OpenSSL for hash functions
 #
 
@ -1203,7 +1184,7 @@ index 7c5ad51..fddc63a 100644
 ISC_PLATFORM_OPENSSLHASH="#undef ISC_PLATFORM_OPENSSLHASH"
 case $want_openssl_hash in
 	yes)
-@@ -2313,6 +2316,67 @@ if test "rt" = "$have_clock_gt"; then
+@@ -2322,6 +2325,67 @@ if test "rt" = "$have_clock_gt"; then
 	LIBS="-lrt $LIBS"
 fi
 
@ -1271,7 +1252,7 @@ index 7c5ad51..fddc63a 100644
 #
 # was --with-lmdb specified?
 #
-@@ -4109,12 +4173,12 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
+@@ -4118,12 +4182,12 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
 ISC_PLATFORM_USESTDASM="#undef ISC_PLATFORM_USESTDASM"
 ISC_PLATFORM_USEMACASM="#undef ISC_PLATFORM_USEMACASM"
 if test "yes" = "$use_atomic"; then
@ -1285,7 +1266,7 @@ index 7c5ad51..fddc63a 100644
 		if test $ac_cv_sizeof_void_p = 8; then
 			arch=x86_64
 			have_xaddq=yes
-@@ -4123,7 +4187,6 @@ if test "yes" = "$use_atomic"; then
+@@ -4132,7 +4196,6 @@ if test "yes" = "$use_atomic"; then
 		fi
 	;;
 	x86_64-*|amd64-*)
@ -1293,7 +1274,7 @@ index 7c5ad51..fddc63a 100644
 		if test $ac_cv_sizeof_void_p = 8; then
 			arch=x86_64
 			have_xaddq=yes
-@@ -5541,6 +5604,8 @@ report() {
+@@ -5537,6 +5600,8 @@ report() {
 	    echo "    IPv6 support (--enable-ipv6)"
 	test "X$CRYPTO" = "X" -o "yes" = "$want_native_pkcs11" || \
 		echo "    OpenSSL cryptography/DNSSEC (--with-openssl)"
@ -1302,7 +1283,7 @@ index 7c5ad51..fddc63a 100644
 	test "X$PYTHON" = "X" || echo "    Python tools (--with-python)"
 	test "X$XMLSTATS" = "X" || echo "    XML statistics (--with-libxml2)"
 	test "X$JSONSTATS" = "X" || echo "    JSON statistics (--with-libjson)"
-@@ -5581,6 +5646,8 @@ report() {
+@@ -5577,6 +5642,8 @@ report() {
 	echo "    Very verbose query trace logging (--enable-querytrace)"
     test "no" = "$with_cmocka" || echo "    CMocka Unit Testing Framework (--with-cmocka)"
 
@ -1311,7 +1292,7 @@ index 7c5ad51..fddc63a 100644
     echo "    Dynamically loadable zone (DLZ) drivers:"
     test "no" = "$use_dlz_bdb" || \
 	echo "        Berkeley DB (--with-dlz-bdb)"
-@@ -5628,6 +5695,8 @@ report() {
+@@ -5624,6 +5691,8 @@ report() {
 	echo "    ECDSA algorithm support (--with-ecdsa)"
     test "X$CRYPTO" = "X" -o "yes" = "$OPENSSL_ED25519" -o "yes" = "$PKCS11_ED25519" || \
 	echo "    EDDSA algorithm support (--with-eddsa)"
@ -1321,10 +1302,10 @@ index 7c5ad51..fddc63a 100644
     test "yes" = "$enable_seccomp" || \
 	echo "    Use libseccomp system call filtering (--enable-seccomp)"
 diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c
-index 320c0f8..b55ebe0 100644
+index 65bf25d..1eccbe7 100644
 --- a/lib/dns/dst_api.c
 +++ b/lib/dns/dst_api.c
-@@ -276,6 +276,12 @@ dst_lib_init2(isc_mem_t *mctx, isc_entropy_t *ectx,
+@@ -277,6 +277,12 @@ dst_lib_init2(isc_mem_t *mctx, isc_entropy_t *ectx,
 #ifdef GSSAPI
 	RETERR(dst__gssapi_init(&dst_t_func[DST_ALG_GSSAPI]));
 #endif
@ -1337,7 +1318,7 @@ index 320c0f8..b55ebe0 100644
 	dst_initialized = true;
 	return (ISC_R_SUCCESS);
 
-@@ -295,11 +301,19 @@ dst_lib_destroy(void) {
+@@ -296,11 +302,19 @@ dst_lib_destroy(void) {
 	for (i = 0; i < DST_MAX_ALGS; i++)
 		if (dst_t_func[i] != NULL && dst_t_func[i]->cleanup != NULL)
 			dst_t_func[i]->cleanup();
@ -1357,7 +1338,7 @@ index 320c0f8..b55ebe0 100644
 	if (dst__memory_pool != NULL)
 		isc_mem_detach(&dst__memory_pool);
 	if (dst_entropy_pool != NULL)
-@@ -2001,13 +2015,17 @@ dst__entropy_getdata(void *buf, unsigned int len, bool pseudo) {
+@@ -2002,13 +2016,17 @@ dst__entropy_getdata(void *buf, unsigned int len, bool pseudo) {
 		flags &= ~ISC_ENTROPY_GOODONLY;
 	else
 		flags |= ISC_ENTROPY_BLOCKING;
@ -1376,7 +1357,7 @@ index 320c0f8..b55ebe0 100644
 #ifdef GSSAPI
 	unsigned int flags = dst_entropy_flags;
 	isc_result_t ret;
-@@ -2030,6 +2048,7 @@ dst__entropy_status(void) {
+@@ -2031,6 +2049,7 @@ dst__entropy_status(void) {
 #endif
 	return (isc_entropy_status(dst_entropy_pool));
 #else
@ -1459,7 +1440,7 @@ index 304814b..60543c4 100644
 	isc_hash_destroy();
   cleanup_db:
 diff --git a/lib/dns/openssl_link.c b/lib/dns/openssl_link.c
-index d65ce26..6849732 100644
+index 13e838f..ffe0a69 100644
 --- a/lib/dns/openssl_link.c
 +++ b/lib/dns/openssl_link.c
@@ -31,6 +31,7 @@
@ -1495,7 +1476,7 @@ index d65ce26..6849732 100644
 #endif
 +#endif /* !ISC_PLATFORM_CRYPTORANDOM */
 
- #if OPENSSL_VERSION_NUMBER >= 0x10000000L && OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
+ #if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
 static void
@@ -192,7 +195,7 @@ _set_thread_id(CRYPTO_THREADID *id)
 isc_result_t
@ -1711,7 +1692,7 @@ index 937b548..f3c0e38 100644
 tap_test_program{name='gost_test'}
 tap_test_program{name='keytable_test'}
 diff --git a/lib/dns/tests/Makefile.in b/lib/dns/tests/Makefile.in
-index 0897579..9f1781a 100644
+index 90dc3a6..7671e1d 100644
 --- a/lib/dns/tests/Makefile.in
 +++ b/lib/dns/tests/Makefile.in
@@ -37,6 +37,7 @@ SRCS =		acl_test.c \
@ -1864,10 +1845,10 @@ index 0000000..bd3d164
 +
 +#endif
 diff --git a/lib/dns/win32/libdns.def.in b/lib/dns/win32/libdns.def.in
-index 5c45d59..34b660c 100644
+index 63be973..40b21fa 100644
 --- a/lib/dns/win32/libdns.def.in
 +++ b/lib/dns/win32/libdns.def.in
-@@ -1484,6 +1484,13 @@ dst_lib_destroy
+@@ -1485,6 +1485,13 @@ dst_lib_destroy
 dst_lib_init
 dst_lib_init2
 dst_lib_initmsgcat
@ -1963,10 +1944,10 @@ index 4bba8e1..632166a 100644
 
 #endif /* ISC_ENTROPY_H */
 diff --git a/lib/isc/include/isc/platform.h.in b/lib/isc/include/isc/platform.h.in
-index 9c7c342..ee8dc3e 100644
+index 4192946..dbd1560 100644
 --- a/lib/isc/include/isc/platform.h.in
 +++ b/lib/isc/include/isc/platform.h.in
-@@ -341,6 +341,11 @@
+@@ -359,6 +359,11 @@
  */
 @ISC_PLATFORM_HAVESTRINGSH@
 
@ -1979,10 +1960,10 @@ index 9c7c342..ee8dc3e 100644
  * Define if the hash functions must be provided by OpenSSL.
  */
 diff --git a/lib/isc/include/isc/types.h b/lib/isc/include/isc/types.h
-index 42ff7e0..8d87c44 100644
+index da9d66f..4205400 100644
 --- a/lib/isc/include/isc/types.h
 +++ b/lib/isc/include/isc/types.h
-@@ -93,6 +93,8 @@ typedef struct isc_time			isc_time_t;		/*%< Time */
+@@ -97,6 +97,8 @@ typedef struct isc_time			isc_time_t;		/*%< Time */
 typedef struct isc_timer		isc_timer_t;		/*%< Timer */
 typedef struct isc_timermgr		isc_timermgr_t;		/*%< Timer Manager */
 
@ -1992,7 +1973,7 @@ index 42ff7e0..8d87c44 100644
 typedef int (*isc_sockfdwatch_t)(isc_task_t *, isc_socket_t *, void *, int);
 
 diff --git a/lib/isc/pk11.c b/lib/isc/pk11.c
-index bb9912b..1f583a3 100644
+index 68aebdc..4b85527 100644
 --- a/lib/isc/pk11.c
 +++ b/lib/isc/pk11.c
@@ -321,14 +321,16 @@ pk11_rand_seed_fromfile(const char *randomfile) {
@ -2018,10 +1999,10 @@ index bb9912b..1f583a3 100644
     cleanup:
 	if (stream != NULL)
 diff --git a/lib/isc/win32/include/isc/platform.h.in b/lib/isc/win32/include/isc/platform.h.in
-index 5b8a2c9..913a2ce 100644
+index 8ade705..fa72f9d 100644
 --- a/lib/isc/win32/include/isc/platform.h.in
 +++ b/lib/isc/win32/include/isc/platform.h.in
-@@ -69,6 +69,11 @@
+@@ -73,6 +73,11 @@
 #define ISC_PLATFORM_NORETURN_PRE __declspec(noreturn)
 #define ISC_PLATFORM_NORETURN_POST
 
@ -2034,10 +2015,10 @@ index 5b8a2c9..913a2ce 100644
  * Define if the hash functions must be provided by OpenSSL.
  */
 diff --git a/win32utils/Configure b/win32utils/Configure
-index ad99f89..2c55946 100644
+index 953f2aa..55cc929 100644
 --- a/win32utils/Configure
 +++ b/win32utils/Configure
-@@ -381,6 +381,7 @@ my @substdefh = ("AES_CC",
+@@ -382,6 +382,7 @@ my @substdefh = ("ALLOW_FILTER_AAAA",
 my %configdefp;
 
 my @substdefp = ("ISC_PLATFORM_BUSYWAITNOP",
@ -2045,7 +2026,7 @@ index ad99f89..2c55946 100644
                  "ISC_PLATFORM_HAVEATOMICSTORE",
                  "ISC_PLATFORM_HAVEATOMICSTOREQ",
                  "ISC_PLATFORM_HAVECMPXCHG",
-@@ -510,7 +511,8 @@ my @allcond = (@substcond, "NOTYET", "NOLONGER");
+@@ -517,7 +518,8 @@ my @allcond = (@substcond, "NOTYET", "NOLONGER");
 
 # enable-xxx/disable-xxx
 
@ -2055,7 +2036,7 @@ index ad99f89..2c55946 100644
                   "fixed-rrset",
                   "intrinsics",
                   "isc-spnego",
-@@ -573,6 +575,7 @@ my @help = (
+@@ -580,6 +582,7 @@ my @help = (
 "\nOptional Features:\n",
 "  enable-intrinsics     enable instrinsic/atomic functions [default=yes]\n",
 "  enable-native-pkcs11  use native PKCS#11 for all crypto [default=no]\n",
@ -2063,7 +2044,7 @@ index ad99f89..2c55946 100644
 "  enable-openssl-hash   use OpenSSL for hash functions [default=yes]\n",
 "  enable-isc-spnego     use SPNEGO from lib/dns [default=yes]\n",
 "  enable-filter-aaaa    enable filtering of AAAA records [default=yes]\n",
-@@ -617,7 +620,9 @@ my $want_clean = "no";
+@@ -628,7 +631,9 @@ my $want_clean = "no";
 my $want_unknown = "no";
 my $unknown_value;
 my $enable_intrinsics = "yes";
@ -2073,7 +2054,7 @@ index ad99f89..2c55946 100644
 my $enable_openssl_hash = "auto";
 my $enable_filter_aaaa = "yes";
 my $enable_isc_spnego = "yes";
-@@ -828,6 +833,10 @@ sub myenable {
+@@ -847,6 +852,10 @@ sub myenable {
         if ($val =~ /^yes$/i) {
             $enable_native_pkcs11 = "yes";
         }
@ -2084,7 +2065,7 @@ index ad99f89..2c55946 100644
     } elsif ($key =~ /^openssl-hash$/i) {
         if ($val =~ /^yes$/i) {
             $enable_openssl_hash = "yes";
-@@ -1119,6 +1128,11 @@ if ($verbose) {
+@@ -1153,6 +1162,11 @@ if ($verbose) {
     } else {
         print "native-pkcs11: disabled\n";
     }
@ -2096,7 +2077,7 @@ index ad99f89..2c55946 100644
     if ($enable_openssl_hash eq "yes") {
         print "openssl-hash: enabled\n";
     } else {
-@@ -1472,6 +1486,7 @@ if ($enable_intrinsics eq "yes") {
+@@ -1510,6 +1524,7 @@ if ($enable_intrinsics eq "yes") {
 
 # enable-native-pkcs11
 if ($enable_native_pkcs11 eq "yes") {
@ -2104,7 +2085,7 @@ index ad99f89..2c55946 100644
     if ($use_openssl eq "auto") {
         $use_openssl = "no";
     }
-@@ -1681,6 +1696,7 @@ if ($use_openssl eq "yes") {
+@@ -1719,6 +1734,7 @@ if ($use_openssl eq "yes") {
         $openssl_dll = File::Spec->catdir($openssl_path, "@dirlist[0]");
     }   
 
@ -2112,10 +2093,10 @@ index ad99f89..2c55946 100644
     $configcond{"OPENSSL"} = 1;
     $configdefd{"CRYPTO"} = "OPENSSL";
     $configvar{"OPENSSL_PATH"} = "$openssl_path";
-@@ -2232,6 +2248,15 @@ if ($cookie_algorithm eq "sha1") {
-     die "Unrecognized cookie algorithm: $cookie_algorithm\n";
+@@ -2290,6 +2306,15 @@ if ($use_aes eq "yes") {
 }
 
+ 
 +# enable-crypto-rand
 +if ($enable_crypto_rand eq "yes") {
 +    if (($use_openssl eq "no") && ($enable_native_pkcs11 eq "no")) {
@ -2128,7 +2109,7 @@ index ad99f89..2c55946 100644
 # enable-openssl-hash
 if ($enable_openssl_hash eq "yes") {
     if ($use_openssl eq "no") {
-@@ -3558,6 +3583,7 @@ exit 0;
+@@ -3665,6 +3690,7 @@ exit 0;
 #  --enable-developer partially supported
 #  --enable-newstats (9.9/9.9sub only)
 #  --enable-native-pkcs11 supported
@ -2136,14 +2117,6 @@ index ad99f89..2c55946 100644
 #  --enable-openssl-version-check included without a way to disable it
 #  --enable-openssl-hash supported
 #  --enable-threads included without a way to disable it
-@@ -3583,6 +3609,7 @@ exit 0;
- #  --with-gost supported
- #  --with-aes supported
- #  --with-cc-alg supported
-+#  --with-randomdev not supported on WIN32 (makes no sense)
- #  --with-geoip supported
- #  --with-gssapi supported with MIT (K)erberos (f)or (W)indows
- #  --with-lmdb no supported on WIN32 (port is not reliable)
 -- 
-2.20.1
+2.21.0

--- a/bind-9.11-rt46047.patch
+++ b/bind-9.11-rt46047.patch
@ -1,4 +1,4 @@
-From 55e649d82a1adc5209738fb8402624f03287ca87 Mon Sep 17 00:00:00 2001
+From 5a465424f5249ceaf0547ab90361a16eb08f7a2b Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Thu, 28 Sep 2017 10:09:22 -0700
 Subject: [PATCH] completed and corrected the crypto-random change
@ -33,20 +33,22 @@ Subject: [PATCH] completed and corrected the crypto-random change
 bin/named/include/named/server.h         |  2 +
 bin/named/interfacemgr.c                 |  1 +
 bin/named/query.c                        |  1 +
- bin/named/server.c                       | 51 ++++++++++++++--------
+ bin/named/server.c                       | 52 ++++++++++++++--------
 bin/nsupdate/nsupdate.c                  |  4 +-
 bin/tests/system/pipelined/pipequeries.c |  4 +-
 bin/tests/system/tkey/keycreate.c        |  4 +-
- bin/tests/system/tkey/keydelete.c        |  4 +-
+ bin/tests/system/tkey/keydelete.c        |  5 +--
 doc/arm/Bv9ARM-book.xml                  | 55 +++++++++++++++++-------
- doc/arm/notes.xml                        | 31 +++++++++++++
+ doc/arm/notes-rh-changes.xml             | 43 ++++++++++++++++++
+ doc/arm/notes.xml                        |  1 +
 lib/dns/dst_api.c                        |  4 +-
 lib/dns/include/dst/dst.h                | 14 +++++-
 lib/dns/openssl_link.c                   |  3 +-
 lib/isc/include/isc/entropy.h            | 50 +++++++++++++++------
 lib/isc/include/isc/random.h             | 28 +++++++-----
 lib/isccfg/namedconf.c                   |  2 +-
- 22 files changed, 225 insertions(+), 107 deletions(-)
+ 23 files changed, 241 insertions(+), 106 deletions(-)
+ create mode 100644 doc/arm/notes-rh-changes.xml

 diff --git a/bin/confgen/keygen.c b/bin/confgen/keygen.c
 index 295e16f..0f79aa8 100644
@ -76,10 +78,10 @@ index 295e16f..0f79aa8 100644
 							     &entropy_source,
 							     randomfile,
 diff --git a/bin/dnssec/dnssec-keygen.docbook b/bin/dnssec/dnssec-keygen.docbook
-index ee6a489..17dddb6 100644
+index 0ae6b41..4562430 100644
 --- a/bin/dnssec/dnssec-keygen.docbook
 +++ b/bin/dnssec/dnssec-keygen.docbook
-@@ -350,15 +350,23 @@
+@@ -348,15 +348,23 @@
 	<term>-r <replaceable class="parameter">randomdev</replaceable></term>
 	<listitem>
 	  <para>
@ -140,10 +142,10 @@ index 31a99e7..38c83ed 100644
 					   usekeyboard);
 
 diff --git a/bin/named/client.c b/bin/named/client.c
-index ce24670..0ce02a9 100644
+index 50fa2cd..524d9a3 100644
 --- a/bin/named/client.c
 +++ b/bin/named/client.c
-@@ -1754,7 +1754,8 @@ ns_client_addopt(ns_client_t *client, dns_message_t *message,
+@@ -1762,7 +1762,8 @@ ns_client_addopt(ns_client_t *client, dns_message_t *message,
 
 		isc_buffer_init(&buf, cookie, sizeof(cookie));
 		isc_stdtime_get(&now);
@ -154,10 +156,10 @@ index ce24670..0ce02a9 100644
 		compute_cookie(client, now, nonce, ns_g_server->secret, &buf);
 
 diff --git a/bin/named/config.c b/bin/named/config.c
-index a153172..8d46bc3 100644
+index dbdff64..63da4b0 100644
 --- a/bin/named/config.c
 +++ b/bin/named/config.c
-@@ -93,7 +93,9 @@ options {\n\
+@@ -98,7 +98,9 @@ options {\n\
 #	pid-file \"" NS_LOCALSTATEDIR "/run/named/named.pid\"; /* or /lwresd.pid */\n\
 	port 53;\n\
 	prefetch 2 9;\n"
@ -221,7 +223,7 @@ index d955c2f..40621f2 100644
 	} else
 		eresult = ns_control_docommand(request, listener->readonly, &text);
 diff --git a/bin/named/include/named/server.h b/bin/named/include/named/server.h
-index f5ed2b7..b2c1d05 100644
+index 7ee8f66..8982d26 100644
 --- a/bin/named/include/named/server.h
 +++ b/bin/named/include/named/server.h
@@ -20,6 +20,7 @@
@ -241,7 +243,7 @@ index f5ed2b7..b2c1d05 100644
 
 struct ns_altsecret {
 diff --git a/bin/named/interfacemgr.c b/bin/named/interfacemgr.c
-index d9f6df5..662eb6c 100644
+index 9dea7c1..272d300 100644
 --- a/bin/named/interfacemgr.c
 +++ b/bin/named/interfacemgr.c
@@ -17,6 +17,7 @@
@ -253,7 +255,7 @@ index d9f6df5..662eb6c 100644
 #include <isc/task.h>
 #include <isc/util.h>
 diff --git a/bin/named/query.c b/bin/named/query.c
-index 1d3edbc..193efde 100644
+index c9e5469..0940714 100644
 --- a/bin/named/query.c
 +++ b/bin/named/query.c
@@ -19,6 +19,7 @@
@ -265,10 +267,10 @@ index 1d3edbc..193efde 100644
 #include <isc/serial.h>
 #include <isc/stats.h>
 diff --git a/bin/named/server.c b/bin/named/server.c
-index 30e7eac..27ea3bf 100644
+index 36fc047..3c1eec0 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
-@@ -8203,21 +8203,30 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8208,21 +8208,32 @@ load_configuration(const char *filename, ns_server_t *server,
 	 * Open the source of entropy.
 	 */
 	if (first_time) {
@ -304,12 +306,13 @@ index 30e7eac..27ea3bf 100644
 -				isc_entropy_usehook(ns_g_entropy, true);
 -#else
 -			int level = ISC_LOG_ERROR;
-			result = isc_entropy_createfilesource(ns_g_entropy,
+ 			result = isc_entropy_createfilesource(ns_g_entropy,
 -							      randomdev);
+			                                      randomdev);
 #ifdef PATH_RANDOMDEV
 			if (ns_g_fallbackentropy != NULL) {
 				level = ISC_LOG_INFO;
-@@ -8228,8 +8237,8 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8233,8 +8244,8 @@ load_configuration(const char *filename, ns_server_t *server,
 					      NS_LOGCATEGORY_GENERAL,
 					      NS_LOGMODULE_SERVER,
 					      level,
@ -320,15 +323,23 @@ index 30e7eac..27ea3bf 100644
 					      randomdev,
 					      isc_result_totext(result));
 			}
-@@ -8249,7 +8258,6 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8254,7 +8265,6 @@ load_configuration(const char *filename, ns_server_t *server,
 				}
 				isc_entropy_detach(&ns_g_fallbackentropy);
 			}
 -#endif
 #endif
 		}
- 	}
-@@ -9040,6 +9048,9 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
+ 
+@@ -9022,6 +9032,7 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
+ 	server->in_roothints = NULL;
+ 	server->blackholeacl = NULL;
+ 	server->keepresporder = NULL;
+	server->rngctx = NULL;
+ 
+ 	/* Must be first. */
+ 	CHECKFATAL(dst_lib_init2(ns_g_mctx, ns_g_entropy,
+@@ -9048,6 +9059,9 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
 	CHECKFATAL(dns_tkeyctx_create(ns_g_mctx, ns_g_entropy,
 				      &server->tkeyctx),
 		   "creating TKEY context");
@ -338,7 +349,7 @@ index 30e7eac..27ea3bf 100644
 
 	/*
 	 * Setup the server task, which is responsible for coordinating
-@@ -9246,7 +9257,8 @@ ns_server_destroy(ns_server_t **serverp) {
+@@ -9254,7 +9268,8 @@ ns_server_destroy(ns_server_t **serverp) {
 
 	if (server->zonemgr != NULL)
 		dns_zonemgr_detach(&server->zonemgr);
@ -348,7 +359,7 @@ index 30e7eac..27ea3bf 100644
 	if (server->tkeyctx != NULL)
 		dns_tkeyctx_destroy(&server->tkeyctx);
 
-@@ -13197,10 +13209,10 @@ newzone_cfgctx_destroy(void **cfgp) {
+@@ -13230,10 +13245,10 @@ newzone_cfgctx_destroy(void **cfgp) {
 
 static isc_result_t
 generate_salt(unsigned char *salt, size_t saltlen) {
@ -361,7 +372,7 @@ index 30e7eac..27ea3bf 100644
 	} rnd;
 	unsigned char text[512 + 1];
 	isc_region_t r;
-@@ -13210,9 +13222,10 @@ generate_salt(unsigned char *salt, size_t saltlen) {
+@@ -13243,9 +13258,10 @@ generate_salt(unsigned char *salt, size_t saltlen) {
 	if (saltlen > 256U)
 		return (ISC_R_RANGE);
 
@ -376,7 +387,7 @@ index 30e7eac..27ea3bf 100644
 	memmove(salt, rnd.rnd, saltlen);
 
 diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
-index 6d7a02e..626b1cf 100644
+index 0286987..0376377 100644
 --- a/bin/nsupdate/nsupdate.c
 +++ b/bin/nsupdate/nsupdate.c
@@ -283,9 +283,7 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
@ -391,10 +402,10 @@ index 6d7a02e..626b1cf 100644
 	}
 #endif
 diff --git a/bin/tests/system/pipelined/pipequeries.c b/bin/tests/system/pipelined/pipequeries.c
-index 7b4f617..507bf0a 100644
+index f0a6ff2..55064f6 100644
 --- a/bin/tests/system/pipelined/pipequeries.c
 +++ b/bin/tests/system/pipelined/pipequeries.c
-@@ -282,9 +282,7 @@ main(int argc, char *argv[]) {
+@@ -280,9 +280,7 @@ main(int argc, char *argv[]) {
 	ectx = NULL;
 	RUNCHECK(isc_entropy_create(mctx, &ectx));
 #ifdef ISC_PLATFORM_CRYPTORANDOM
@ -421,10 +432,18 @@ index fe8698e..937fcc3 100644
 	}
 #endif
 diff --git a/bin/tests/system/tkey/keydelete.c b/bin/tests/system/tkey/keydelete.c
-index 2146f9b..ac2c311 100644
+index 2146f9b..64b8e74 100644
 --- a/bin/tests/system/tkey/keydelete.c
 +++ b/bin/tests/system/tkey/keydelete.c
-@@ -182,9 +182,7 @@ main(int argc, char **argv) {
+@@ -171,6 +171,7 @@ main(int argc, char **argv) {
+ 		randomfile = argv[2];
+ 		argv += 2;
+ 		argc -= 2;
+		POST(argc);
+ 	}
+ 	keyname = argv[1];
+ 
+@@ -182,9 +183,7 @@ main(int argc, char **argv) {
 	ectx = NULL;
 	RUNCHECK(isc_entropy_create(mctx, &ectx));
 #ifdef ISC_PLATFORM_CRYPTORANDOM
@ -436,10 +455,10 @@ index 2146f9b..ac2c311 100644
 	}
 #endif
 diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
-index bb79723..888959c 100644
+index 33e06e6..539973c 100644
 --- a/doc/arm/Bv9ARM-book.xml
 +++ b/doc/arm/Bv9ARM-book.xml
-@@ -5071,22 +5071,45 @@ badresp:1,adberr:0,findfail:0,valfail:0]
+@@ -5076,22 +5076,45 @@ badresp:1,adberr:0,findfail:0,valfail:0]
 	    <term><command>random-device</command></term>
 	    <listitem>
 	      <para>
@ -501,53 +520,72 @@ index bb79723..888959c 100644
 	      </para>
 	    </listitem>
 	  </varlistentry>
+diff --git a/doc/arm/notes-rh-changes.xml b/doc/arm/notes-rh-changes.xml
+new file mode 100644
+index 0000000..11c3a7c
+--- /dev/null
+++ b/doc/arm/notes-rh-changes.xml
+@@ -0,0 +1,43 @@
+
+<!--
+ - Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ -
+ - This Source Code Form is subject to the terms of the Mozilla Public
+ - License, v. 2.0. If a copy of the MPL was not distributed with this
+ - file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ -
+ - See the COPYRIGHT file distributed with this work for additional
+ - information regarding copyright ownership.
+-->
+
+<section xml:id="relnotes_rh_changes"><info><title>Red Hat Specific Changes</title></info>
+  <itemizedlist>
+     <listitem>
+      <para>
+        By default, BIND now uses the random number generation functions
+        in the cryptographic library (i.e., OpenSSL or a PKCS#11
+        provider) as a source of high-quality randomness rather than
+        <filename>/dev/random</filename>.  This is suitable for virtual
+        machine environments, which may have limited entropy pools and
+        lack hardware random number generators.
+      </para>
+      <para>
+        This can be overridden by specifying another entropy source via
+        the <command>random-device</command> option in
+        <filename>named.conf</filename>, or via the <command>-r</command>
+        command line option.  However, for functions requiring full
+        cryptographic strength, such as DNSSEC key generation, this
+        <emphasis>cannot</emphasis> be overridden. In particular, the
+        <command>-r</command> command line option no longer has any
+        effect on <command>dnssec-keygen</command>.
+      </para>
+      <para>
+        This can be disabled by building with
+        <command>configure --disable-crypto-rand</command>, in which
+        case <filename>/dev/random</filename> will be the default
+        entropy source.  [RT #31459] [RT #46047]
+      </para>
+    </listitem>
+  </itemizedlist>
+</section>
+
 diff --git a/doc/arm/notes.xml b/doc/arm/notes.xml
-index ba9a7cf..c0256f1 100644
+index b16dab6..763ff7e 100644
 --- a/doc/arm/notes.xml
 +++ b/doc/arm/notes.xml
-@@ -117,6 +117,37 @@
-     </itemizedlist>
-   </section>
+@@ -36,6 +36,7 @@
+   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-9.11.1.xml"/>
+   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-9.11.0.xml"/>
 
-+  <section xml:id="relnotes_rh_changes"><info><title>Red Hat Specific Changes</title></info>
-+    <itemizedlist>
-+       <listitem>
-+	<para>
-+	  By default, BIND now uses the random number generation functions
-+	  in the cryptographic library (i.e., OpenSSL or a PKCS#11
-+	  provider) as a source of high-quality randomness rather than
-+	  <filename>/dev/random</filename>.  This is suitable for virtual
-+	  machine environments, which may have limited entropy pools and
-+	  lack hardware random number generators.
-+	</para>
-+	<para>
-+	  This can be overridden by specifying another entropy source via
-+	  the <command>random-device</command> option in
-+	  <filename>named.conf</filename>, or via the <command>-r</command>
-+	  command line option.  However, for functions requiring full
-+	  cryptographic strength, such as DNSSEC key generation, this
-+	  <emphasis>cannot</emphasis> be overridden. In particular, the
-+	  <command>-r</command> command line option no longer has any
-+	  effect on <command>dnssec-keygen</command>.
-+	</para>
-+	<para>
-+	  This can be disabled by building with
-+	  <command>configure --disable-crypto-rand</command>, in which
-+	  case <filename>/dev/random</filename> will be the default
-+	  entropy source.  [RT #31459] [RT #46047]
-+	</para>
-+      </listitem>
-+    </itemizedlist>
-+  </section>
-+
-   <section xml:id="end_of_life"><info><title>End of Life</title></info>
-     <para>
-       BIND 9.11 (Extended Support Version) will be supported until at
+  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-rh-changes.xml"/>
+   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-eol.xml"/>
+   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-thankyou.xml"/>
+ </section>
 diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c
-index b55ebe0..d2b43d3 100644
+index 1614afa..0f52df9 100644
 --- a/lib/dns/dst_api.c
 +++ b/lib/dns/dst_api.c
-@@ -2016,10 +2016,12 @@ dst__entropy_getdata(void *buf, unsigned int len, bool pseudo) {
+@@ -2017,10 +2017,12 @@ dst__entropy_getdata(void *buf, unsigned int len, bool pseudo) {
 	else
 		flags |= ISC_ENTROPY_BLOCKING;
 #ifdef ISC_PLATFORM_CRYPTORANDOM
@ -744,7 +782,7 @@ index f8aed34..17c551b 100644
 
 ISC_LANG_ENDDECLS
 diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
-index fbc62cc..9cad61d 100644
+index 03890a3..7bad989 100644
 --- a/lib/isccfg/namedconf.c
 +++ b/lib/isccfg/namedconf.c
@@ -1109,7 +1109,7 @@ options_clauses[] = {
--- a/bind-9.11-tests-variants.patch
+++ b/bind-9.11-tests-variants.patch
@ -1,4 +1,4 @@
-From 7d689f77714430a4ef6cead040ec304dca0b8bd3 Mon Sep 17 00:00:00 2001
+From 06a22ff20ac3d68fa1f995c91068b43392425e43 Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Fri, 1 Mar 2019 15:48:20 +0100
 Subject: [PATCH] Make alternative named builds testable in system tests
@ -17,19 +17,19 @@ export NAMED_VARIANT=-pkcs11 DNSSEC_VARIANT=-pkcs11
 1 file changed, 10 insertions(+), 9 deletions(-)

 diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
-index b072af8..d2cb8ed 100644
+index 4b0fe39..f135af6 100644
 --- a/bin/tests/system/conf.sh.in
 +++ b/bin/tests/system/conf.sh.in
-@@ -27,7 +27,7 @@ ALTERNATIVE_ALGORITHM=RSASHA1
- ALTERNATIVE_ALGORITHM_NUMBER=5
- ALTERNATIVE_BITS=1280
+@@ -34,7 +34,7 @@ DISABLED_ALGORITHM=ECDSAP384SHA384
+ DISABLED_ALGORITHM_NUMBER=14
+ DISABLED_BITS=384
 
 -NAMED=$TOP/bin/named/named
 +NAMED=$TOP/bin/named${NAMED_VARIANT}/named${NAMED_VARIANT}
 # We must use "named -l" instead of "lwresd" because argv[0] is lost
 # if the program is libtoolized.
 LWRESD="$TOP/bin/named/named -l"
-@@ -38,13 +38,14 @@ NSUPDATE=$TOP/bin/nsupdate/nsupdate
+@@ -45,13 +45,14 @@ NSUPDATE=$TOP/bin/nsupdate/nsupdate
 DDNSCONFGEN=$TOP/bin/confgen/ddns-confgen
 TSIGKEYGEN=$TOP/bin/confgen/tsig-keygen
 RNDCCONFGEN=$TOP/bin/confgen/rndc-confgen
@ -51,7 +51,7 @@ index b072af8..d2cb8ed 100644
 CHECKDS=$TOP/bin/python/dnssec-checkds
 COVERAGE=$TOP/bin/python/dnssec-coverage
 KEYMGR=$TOP/bin/python/dnssec-keymgr
-@@ -64,7 +65,7 @@ DNSTAPREAD=$TOP/bin/tools/dnstap-read
+@@ -71,7 +72,7 @@ DNSTAPREAD=$TOP/bin/tools/dnstap-read
 MDIG=$TOP/bin/tools/mdig
 NZD2NZF=$TOP/bin/tools/named-nzd2nzf
 FSTRM_CAPTURE=@FSTRM_CAPTURE@
--- a/bind-9.11-unit-dnstap-pkcs11.patch
+++ b/bind-9.11-unit-dnstap-pkcs11.patch
@ -1,38 +0,0 @@
-From dca9eea70cb33062905aefc389266da931e9d0d6 Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Thu, 14 Mar 2019 15:48:37 +0100
-Subject: [PATCH] Set TZ again before dns library is initialized
-
-PKCS11 uses it, initializes TZ offset from dst init. Setting environment
-in test is too late since use of cmocka.
---
- lib/dns/tests/dnstap_test.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/lib/dns/tests/dnstap_test.c b/lib/dns/tests/dnstap_test.c
-index 22d6dc3..5a60b12 100644
--- a/lib/dns/tests/dnstap_test.c
-+++ b/lib/dns/tests/dnstap_test.c
-@@ -309,9 +309,6 @@ totext_test(void **state) {
- 
- 	UNUSED(state);
- 
-	/* make sure text conversion gets the right local time */
-	setenv("TZ", "PST8", 1);
-
- 	result = dns_dt_open(TAPSAVED, dns_dtmode_file, mctx, &handle);
- 	assert_int_equal(result, ISC_R_SUCCESS);
- 
-@@ -378,6 +375,9 @@ main(void) {
- 		cmocka_unit_test_setup_teardown(totext_test, _setup, _teardown),
- 	};
- 
-+	/* make sure text conversion gets the right local time */
-+	setenv("TZ", "PST8", 1);
-+
- 	return (cmocka_run_group_tests(tests, dns_test_init, dns_test_final));
- #else
- 	print_message("1..0 # Skip dnstap not enabled\n");
-- 
-2.20.1
-
--- a/bind-9.11-unit-timer-nothread.patch
+++ b/bind-9.11-unit-timer-nothread.patch
@ -1,49 +0,0 @@
-From c88ba11ced1311e91a73ffdf42114ed14a805725 Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Thu, 14 Mar 2019 21:05:34 +0100
-Subject: [PATCH] Workaround to kyua bug
-
-Kyua 0.13 is not able to correctly handle whole test skipping.
-Make workaround to it, include skipping message.
---
- lib/isc/tests/timer_test.c | 11 +++++++++--
- 1 file changed, 9 insertions(+), 2 deletions(-)
-
-diff --git a/lib/isc/tests/timer_test.c b/lib/isc/tests/timer_test.c
-index f69f2b3..050cf6d 100644
--- a/lib/isc/tests/timer_test.c
-+++ b/lib/isc/tests/timer_test.c
-@@ -573,14 +573,13 @@ purge(void **state) {
- 
- int
- main(int argc, char **argv) {
-	const struct CMUnitTest tests[] = {
- #ifdef ISC_PLATFORM_USETHREADS
-+	const struct CMUnitTest tests[] = {
- 		cmocka_unit_test_setup_teardown(ticker, _setup, _teardown),
- 		cmocka_unit_test_setup_teardown(once_life, _setup, _teardown),
- 		cmocka_unit_test_setup_teardown(once_idle, _setup, _teardown),
- 		cmocka_unit_test_setup_teardown(reset, _setup, _teardown),
- 		cmocka_unit_test_setup_teardown(purge, _setup, _teardown),
-#endif
- 	};
- 	int c;
- 
-@@ -595,6 +594,14 @@ main(int argc, char **argv) {
- 	}
- 
- 	return (cmocka_run_group_tests(tests, NULL, NULL));
-+#else
-+	UNUSED(argc);
-+	UNUSED(argv);
-+	UNUSED(verbose);
-+
-+	printf("1..0 # Skipped: threads disabled\n");
-+	return (0);
-+#endif
- }
- 
- #else /* HAVE_CMOCKA */
-- 
-2.20.1
-
--- a/bind-9.11.12.tar.gz.asc
+++ b/bind-9.11.12.tar.gz.asc
@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABAgAdFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAl2WMooACgkQdLtrmky7
+PThv2RAAnXNLYTzXtH6ls29tRm5Hc+D6UaeqcWDNQ4BpkRVhrFxtukalGCi9mmB6
+NPJzFyXmaOW654pypCIuEgqJNFUpDtLzLzT7SUF+mhm+5plsaRSBnh4mq87l5KSp
+twODAPnfCJV+HBk5RmToLEstAbGQ7xEBTyQtZoFkY+V7zEFwENKiCvWsoSWOkYR3
+zXo3sKjc83HV9ShbW/mCtbZf5L0qlbrKOAzqJfAFMhNNJi8kMbmr/Zi2sIfN+Rhv
+g8HQo89Epv6r51yAdeED8idIX4rKjjcEtHrZeDmLdCcdHgSEj2sIlH92Joce6vL0
+S59A0rItIXm6fW8sz6WNpcj4tVtWYbIYjXZ4SPFNkaUrHv8cUekq+5vbI+v07Gh3
+2bhtDsDyTY5I1/AsY/EFmwkCAjUS00jZryBnuJpLB3v5JtUog4ek32yLBzPrqRBo
+1876j4nlXAia8mG0OgJNWZ0gHyUPe/TgfR8fQDLmHxHHlKrJNTEwY6bLW8jzFTX1
+zk510fI1K7J9tiQgf5wcBQ2h3EBlqzDNIJDovoATzLYIf0HKyVegh/vnQdtdEhUR
+1DzJAt3bsBfAP1AFfWPD/ACu5Zdm7SxY1wE/pjkwttDU3sRZqOfuwNBGeolu3cVN
+O9/h1zsyVeVS0ui2vu4+V4EvNitmXsVbG2doDq9L5yBiIKGO2Ew=
+=GCy6
+-----END PGP SIGNATURE-----
--- a/bind-9.3.2b1-fix_sdb_ldap.patch
+++ b/bind-9.3.2b1-fix_sdb_ldap.patch
@ -36,10 +36,10 @@ index 95ab742..6069f09 100644
 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zone2sqlite@EXEEXT@ ${DESTDIR}${sbindir}
 	${INSTALL_DATA} ${srcdir}/zone2ldap.1 ${DESTDIR}${mandir}/man1/zone2ldap.1
 diff --git a/bin/sdb_tools/zone2ldap.c b/bin/sdb_tools/zone2ldap.c
-index 23dd873..d56bc56 100644
+index aa2c711..76186b5 100644
 --- a/bin/sdb_tools/zone2ldap.c
 +++ b/bin/sdb_tools/zone2ldap.c
-@@ -65,6 +66,9 @@ ldap_info;
+@@ -66,6 +66,9 @@ ldap_info;
 /* usage Info */
 void usage (void);
 
@ -49,7 +49,7 @@ index 23dd873..d56bc56 100644
 /* Add to the ldap dit */
 void add_ldap_values (ldap_info * ldinfo);
 
-@@ -81,7 +85,7 @@ char **hostname_to_dn_list (char *hostname, char *zone, unsigned int flags);
+@@ -82,7 +85,7 @@ char **hostname_to_dn_list (char *hostname, char *zone, unsigned int flags);
 int get_attr_list_size (char **tmp);
 
 /* Get a DN */
@ -58,7 +58,7 @@ index 23dd873..d56bc56 100644
 
 /* Add to RR list */
 void add_to_rr_list (char *dn, char *name, char *type, char *data,
-@@ -103,11 +107,27 @@ void
+@@ -104,11 +107,27 @@ void
 init_ldap_conn ();
 void usage();
 
@ -91,7 +91,7 @@ index 23dd873..d56bc56 100644
 LDAP *conn;
 unsigned int debug = 0;
 
-@@ -131,12 +151,12 @@ main (int argc, char **argv)
+@@ -132,12 +151,12 @@ main (int argc, char **argv)
   isc_result_t result;
   char *basedn;
   ldap_info *tmp;
@ -107,7 +107,7 @@ index 23dd873..d56bc56 100644
   dns_fixedname_t fixedzone, fixedname;
   dns_rdataset_t rdataset;
   char **dc_list;
-@@ -149,7 +169,7 @@ main (int argc, char **argv)
+@@ -150,7 +169,7 @@ main (int argc, char **argv)
   extern char *optarg;
   extern int optind, opterr, optopt;
   int create_base = 0;
@ -116,7 +116,7 @@ index 23dd873..d56bc56 100644
 
   if (argc < 2)
     {
-@@ -157,7 +177,7 @@ main (int argc, char **argv)
+@@ -158,7 +177,7 @@ main (int argc, char **argv)
       exit (-1);
     }
 
@ -125,7 +125,7 @@ index 23dd873..d56bc56 100644
     {
       switch (topt)
 	{
-@@ -180,6 +200,9 @@ main (int argc, char **argv)
+@@ -181,6 +200,9 @@ main (int argc, char **argv)
 	  if (bindpw == NULL)
 	    fatal("strdup");
 	  break;
@ -135,7 +135,7 @@ index 23dd873..d56bc56 100644
 	case 'b':
 	  ldapbase = strdup (optarg);
 	  if (ldapbase == NULL)
-@@ -301,27 +324,62 @@ main (int argc, char **argv)
+@@ -300,27 +322,62 @@ main (int argc, char **argv)
     {
       if (debug)
 	printf ("Creating base zone DN %s\n", argzone);
@ -208,7 +208,7 @@ index 23dd873..d56bc56 100644
 		}
 	      else
 		{
-@@ -330,8 +388,13 @@ main (int argc, char **argv)
+@@ -329,8 +386,13 @@ main (int argc, char **argv)
 		  else
 		    sprintf (fullbasedn, "%s", ctmp);
 		}
@ -222,7 +222,7 @@ index 23dd873..d56bc56 100644
 	    }
 
 	}
-@@ -409,14 +472,14 @@ generate_ldap (dns_name_t * dnsname, dns_rdata_t * rdata, unsigned int ttl)
+@@ -408,14 +470,14 @@ generate_ldap (dns_name_t * dnsname, dns_rdata_t * rdata, unsigned int ttl)
   isc_result_check (result, "dns_rdata_totext");
   data[isc_buffer_usedlength (&buff)] = 0;
 
@ -240,7 +240,7 @@ index 23dd873..d56bc56 100644
 }
 
 
-@@ -456,7 +519,8 @@ add_to_rr_list (char *dn, char *name, char *type,
+@@ -455,7 +517,8 @@ add_to_rr_list (char *dn, char *name, char *type,
   int attrlist;
   char ldap_type_buffer[128];
   char charttl[64];
@ -250,7 +250,7 @@ index 23dd873..d56bc56 100644
 
   if ((tmp = locate_by_dn (dn)) == NULL)
     {
-@@ -483,13 +547,13 @@ add_to_rr_list (char *dn, char *name, char *type,
+@@ -482,13 +545,13 @@ add_to_rr_list (char *dn, char *name, char *type,
 	    fatal("malloc");
 	}
       tmp->attrs[0]->mod_op = LDAP_MOD_ADD;
@ -267,7 +267,7 @@ index 23dd873..d56bc56 100644
 	  tmp->attrs[1] = NULL;
 	  tmp->attrcnt = 2;
 	  tmp->next = ldap_info_base;
-@@ -498,7 +562,7 @@ add_to_rr_list (char *dn, char *name, char *type,
+@@ -497,7 +560,7 @@ add_to_rr_list (char *dn, char *name, char *type,
 	}
 
       tmp->attrs[1]->mod_op = LDAP_MOD_ADD;
@ -276,7 +276,7 @@ index 23dd873..d56bc56 100644
       tmp->attrs[1]->mod_values = (char **) calloc (sizeof (char *), 2);
 
       if (tmp->attrs[1]->mod_values == (char **)NULL)
-@@ -527,7 +591,7 @@ add_to_rr_list (char *dn, char *name, char *type,
+@@ -526,7 +589,7 @@ add_to_rr_list (char *dn, char *name, char *type,
 	 fatal("strdup");
 
       tmp->attrs[3]->mod_op = LDAP_MOD_ADD;
@ -285,7 +285,7 @@ index 23dd873..d56bc56 100644
       tmp->attrs[3]->mod_values = (char **) calloc (sizeof (char *), 2);
 
       if (tmp->attrs[3]->mod_values == (char **)NULL)
-@@ -540,14 +604,25 @@ add_to_rr_list (char *dn, char *name, char *type,
+@@ -539,14 +602,25 @@ add_to_rr_list (char *dn, char *name, char *type,
       if (tmp->attrs[3]->mod_values[0] == NULL)
 	 fatal("strdup");
 
@ -313,7 +313,7 @@ index 23dd873..d56bc56 100644
       tmp->attrs[4]->mod_values[1] = NULL;
 
       tmp->attrs[5] = NULL;
-@@ -558,7 +633,7 @@ add_to_rr_list (char *dn, char *name, char *type,
+@@ -557,7 +631,7 @@ add_to_rr_list (char *dn, char *name, char *type,
   else
     {
 
@ -322,7 +322,7 @@ index 23dd873..d56bc56 100644
 	{
 	  sprintf (ldap_type_buffer, "%sRecord", type);
 	  if (!strncmp
-@@ -632,44 +707,70 @@ char **
+@@ -631,44 +705,70 @@ char **
 hostname_to_dn_list (char *hostname, char *zone, unsigned int flags)
 {
   char *tmp;
@ -430,7 +430,7 @@ index 23dd873..d56bc56 100644
   dn_buffer[i] = NULL;
 
   return dn_buffer;
-@@ -681,24 +782,32 @@ hostname_to_dn_list (char *hostname, char *zone, unsigned int flags)
+@@ -680,24 +780,32 @@ hostname_to_dn_list (char *hostname, char *zone, unsigned int flags)
  * exception of "@"/SOA. */
 
 char *
@ -459,7 +459,7 @@ index 23dd873..d56bc56 100644
     if (flag == WI_SPEC)
     {
       if (x == (size - 2) && (strncmp (dc_list[x], "@", 1) == 0) && (ttl))
-	sprintf (tmp, "relativeDomainName=%s + dNSTTL=%d,", dc_list[x], ttl);
+-	sprintf (tmp, "relativeDomainName=%s + dNSTTL=%u,", dc_list[x], ttl);
 +	sprintf (tmp, "zoneName=%s + relativeDomainName=%s,", zone, dc_list[x]);
       else if (x == (size - 2))
 -	      sprintf(tmp, "relativeDomainName=%s,",dc_list[x]);
@ -467,7 +467,7 @@ index 23dd873..d56bc56 100644
       else
 	      sprintf(tmp,"dc=%s,", dc_list[x]);
     }
-@@ -724,6 +833,7 @@ void
+@@ -723,6 +831,7 @@ void
 init_ldap_conn ()
 {
   int result;
@ -475,7 +475,7 @@ index 23dd873..d56bc56 100644
   conn = ldap_open (ldapsystem, LDAP_PORT);
   if (conn == NULL)
     {
-@@ -733,7 +843,7 @@ init_ldap_conn ()
+@@ -732,7 +841,7 @@ init_ldap_conn ()
     }
 
   result = ldap_simple_bind_s (conn, binddn, bindpw);
@ -484,7 +484,7 @@ index 23dd873..d56bc56 100644
 }
 
 /* Like isc_result_check, only for LDAP */
-@@ -750,8 +860,6 @@ ldap_result_check (const char *msg, char *dn, int err)
+@@ -749,8 +858,6 @@ ldap_result_check (const char *msg, char *dn, int err)
     }
 }
 
@ -493,7 +493,7 @@ index 23dd873..d56bc56 100644
 /* For running the ldap_info run queue. */
 void
 add_ldap_values (ldap_info * ldinfo)
-@@ -759,14 +867,14 @@ add_ldap_values (ldap_info * ldinfo)
+@@ -758,14 +865,14 @@ add_ldap_values (ldap_info * ldinfo)
   int result;
   char dnbuffer[1024];
 
@ -510,7 +510,7 @@ index 23dd873..d56bc56 100644
 }
 
 
-@@ -777,5 +885,5 @@ void
+@@ -776,5 +883,5 @@ void
 usage ()
 {
   fprintf (stderr,
--- a/bind.spec
+++ b/bind.spec
@ -1,8 +1,9 @@
 #
 # Red Hat BIND package .spec file
 #
+# vim:expandtab ts=2:

-%global PATCHVER P1
+#%%global PATCHVER P1
 #%%global PREVER rc1
 %global BINDVERSION %{version}%{?PREVER}%{?PATCHVER:-%{PATCHVER}}

@ -18,13 +19,14 @@
 %bcond_without LMDB
 %bcond_without JSON
 %bcond_without DNSTAP
-%bcond_without DLZ
+%bcond_with    DLZ
 %bcond_without EXPORT_LIBS
 %if 0%{?fedora} >= 28
 %bcond_without UNITTEST
 %else
 %bcond_with    UNITTEST
 %endif
+%bcond_with    TSAN

 %{?!bind_uid:  %global bind_uid  25}
 %{?!bind_gid:  %global bind_gid  25}
@ -33,6 +35,10 @@
 %if %{with SDB}
 %global        chroot_sdb_prefix %{bind_dir}/chroot_sdb
 %endif
+%global        chroot_create_directories /dev /run/named %{_localstatedir}/{log,named,tmp} \\\
+                                         %{_sysconfdir}/{crypto-policies/back-ends,pki/dnssec-keys,named} \\\
+                                         %{_libdir}/bind %{_datadir}/GeoIP
+
 %global        selinuxbooleans   named_write_master_zones=1
 ## The order of libs is important. See lib/Makefile.in for details
 %define bind_export_libs isc dns isccfg irs
@ -44,16 +50,16 @@
 #

 # lib*.so.X versions of selected libraries
-%global sover_dns 1105
-%global sover_isc 1100
+%global sover_dns 1107
+%global sover_isc 1104
 %global sover_irs 161
 %global sover_isccfg 163

 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.11.6
-Release:  5%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Version:  9.11.14
+Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@ -61,12 +67,20 @@ Source:   https://ftp.isc.org/isc/bind9/%{BINDVERSION}/bind-%{BINDVERSION}.tar.g
 Source1:  named.sysconfig
 Source2:  https://ftp.isc.org/isc/bind9/%{BINDVERSION}/bind-%{BINDVERSION}.tar.gz.asc
 Source3:  named.logrotate
+Source4:  https://downloads.isc.org/isc/pgpkeys/codesign2019.txt
 Source7:  bind-9.3.1rc1-sdb_tools-Makefile.in
 Source8:  dnszone.schema
 Source12: README.sdb_pgsql
+Source16: named.conf
+# Refresh by command: dig @a.root-servers.net. +tcp +norec
+# or from URL
+Source17: https://www.internic.net/domain/named.root
+Source18: named.localhost
+Source19: named.loopback
+Source20: named.empty
+Source23: named.rfc1912.zones
 Source25: named.conf.sample
-Source26: named.conf
-Source28: config-19.tar.bz2
+Source27: named.root.key
 Source30: ldap2zone.c
 Source31: ldap2zone.1
 Source32: named-sdb.8
@ -112,6 +126,8 @@ Patch140:bind-9.11-rh1410433.patch
 Patch145:bind-9.11-rh1205168.patch
 # [ISC-Bugs #46853] commit cb616c6d5c2ece1fac37fa6e0bca2b53d4043098 ISC 4851
 Patch149:bind-9.11-kyua-pkcs11.patch
+# Avoid conflicts with OpenSSL PKCS11 engine
+Patch150:bind-9.11-engine-pkcs11.patch
 Patch153:bind-9.11-export-suffix.patch
 Patch154:bind-9.11-oot-manual.patch
 Patch155:bind-9.11-pk11.patch
@ -131,17 +147,21 @@ Patch161:bind-9.11-host-idn-disable.patch
 Patch163:bind-9.11-rh1663318.patch
 # https://gitlab.isc.org/isc-projects/bind9/issues/819
 Patch164:bind-9.11-rh1666814.patch
-# https://bugzilla.redhat.com/show_bug.cgi?id=1647829
-Patch165:bind-9.11-rh1647829.patch
 # random_test fails too often by random, disable it
 Patch168:bind-9.11-unit-disable-random.patch
-Patch169:bind-9.11-feature-test-dlz.patch
 Patch170:bind-9.11-feature-test-named.patch
 Patch171:bind-9.11-tests-variants.patch
 Patch172:bind-9.11-tests-pkcs11.patch
-Patch173: bind-9.11-unit-dnstap-pkcs11.patch
-Patch174: bind-9.11-unit-timer-nothread.patch
-Patch175: bind-9.11-CVE-2018-5741-atomic.patch
+Patch173:bind-9.11-rh1732883.patch
+# Make sure jsonccp-devel does not interfere
+Patch174:bind-9.11-json-c.patch
+Patch175:bind-9.11-fips-disable.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=1736762
+Patch180: bind-9.11-rh1736762-5.patch
+Patch181: bind-9.11-rh1736762-6.patch
+Patch182: bind-9.11-rh1736762-7.patch
+Patch183: bind-9.11-rh1736762-8.patch
+Patch184: bind-9.11-oot-gen.patch

 # SDB patches
 Patch11: bind-9.3.2b2-sdbsrc.patch
@ -165,7 +185,7 @@ Obsoletes:      caching-nameserver < 31:9.4.1-7.fc8
 Provides:       caching-nameserver = 31:9.4.1-7.fc8
 Obsoletes:      dnssec-conf < 1.27-2
 Provides:       dnssec-conf = 1.27-2
-# This wild require should satisfy %selinux_set_boolean macro only
+# This wild require should satisfy %%selinux_set_boolean macro only
 # in case it needs to be used
 Requires(post): ((policycoreutils-python-utils and libselinux-utils) if (selinux-policy-targeted or selinux-policy-mls))
 Requires(post): ((selinux-policy and selinux-policy-base) if (selinux-policy-targeted or selinux-policy-mls))
@ -179,6 +199,7 @@ BuildRequires:  selinux-policy
 BuildRequires:  python3-devel
 BuildRequires:  python3-ply
 BuildRequires:  findutils sed
+BuildRequires:  gnupg2
 %if %{with SDB}
 BuildRequires:  openldap-devel, libpq-devel, sqlite-devel, mariadb-connector-c-devel
 BuildRequires:  libdb-devel
@ -192,7 +213,9 @@ BuildRequires:  softhsm
 %endif
 %if %{with SYSTEMTEST}
 # bin/tests/system dependencies
-BuildRequires:  net-tools perl(Net::DNS) perl(Net::DNS::Nameserver)
+BuildRequires:  perl(Net::DNS) perl(Net::DNS::Nameserver) perl(Time::HiRes) perl(Getopt::Long)
+# manual configuration requires this tool
+BuildRequires:  iproute
 %endif
 %if %{with GSSTSIG}
 BuildRequires:  krb5-devel
@ -208,6 +231,9 @@ BuildRequires:  fstrm-devel protobuf-c-devel
 %endif
 # Needed to regenerate dig.1 manpage
 BuildRequires: docbook-style-xsl, libxslt
+%if %{with TSAN}
+BuildRequires: libtsan
+%endif

 %description
 BIND (Berkeley Internet Name Domain) is an implementation of the DNS
@ -309,10 +335,6 @@ Contains license of the BIND DNS suite.
 Summary: Utilities for querying DNS name servers
 Requires: bind-libs-lite%{?_isa} = %{epoch}:%{version}-%{release}
 Requires: bind-libs%{?_isa} = %{epoch}:%{version}-%{release}
-# TODO: this is just temporary workaround until all packages depending on
-# bind-utils can be satisfied without dnssec-utils
-# It will be removed after some time, or changed to Recommends
-Suggests: bind-dnssec-utils
 # For compatibility with Debian package
 Provides: dnsutils = %{epoch}:%{version}-%{release}

@ -491,6 +513,7 @@ are used for building ISC DHCP.
 %endif

 %prep
+%{gpgverify} --keyring='%{SOURCE4}' --signature='%{SOURCE2}' --data='%{SOURCE0}'
 %setup -q -n %{name}-%{BINDVERSION}

 # Common patches
@ -516,15 +539,18 @@ are used for building ISC DHCP.
 %patch161 -p1 -b .host-idn-disable
 %patch163 -p1 -b .rh1663318
 %patch164 -p1 -b .rh1666814
-%patch165 -p1 -b .rh1647829
 %patch168 -p1 -b .random_test-disable
-%patch169 -p1 -b .featuretest-dlz
 %patch170 -p1 -b .featuretest-named
 %patch171 -p1 -b .test-variant
 %patch172 -p1 -b .test-pkcs11
-%patch173 -p1 -b .unit-dnstap
-%patch174 -p1 -b .unit-timer
-%patch175 -p1 -b .CVE-2018-5741-atomic
+%patch173 -p1 -b .rh1732883
+%patch174 -p1 -b .json-c
+%patch175 -p1 -b .rh1709553
+%patch180 -p1 -b .rh1736762-5
+%patch181 -p1 -b .rh1736762-6
+%patch182 -p1 -b .rh1736762-7
+%patch183 -p1 -b .rh1736762-8
+%patch184 -p1 -b .oot-gen

 mkdir lib/dns/tests/testdata/dstrandom
 cp -a %{SOURCE50} lib/dns/tests/testdata/dstrandom/random.data
@ -536,6 +562,7 @@ cp -r lib/isc{,-pkcs11}
 cp -r lib/dns{,-pkcs11}
 %patch136 -p1 -b .dist_pkcs11
 %patch149 -p1 -b .kyua-pkcs11
+%patch150 -p1 -b .engine-pkcs11
 %endif

 %if %{with SDB}
@ -594,10 +621,15 @@ done
  cp -Tuav bin/tests "%{1}/bin/tests/" \
  cp -uv version "%{1}" \

-export CFLAGS="$CFLAGS $RPM_OPT_FLAGS"
+CFLAGS="$CFLAGS $RPM_OPT_FLAGS"
+%if %{with TSAN}
+  CFLAGS+=" -O1 -fsanitize=thread -fPIE -pie"
+%endif
+export CFLAGS
 export CPPFLAGS="$CPPFLAGS -DDIG_SIGCHASE"
 export STD_CDEFINES="$CPPFLAGS"

+
 sed -i -e \
 's/RELEASEVER=\(.*\)/RELEASEVER=\1-RedHat-%{version}-%{release}/' \
 version
@ -776,12 +808,12 @@ popd
 # Test just compiled libraries
 for lib in %{bind_export_libs}
 do
-	sed -e "s,^\s*include(.*${lib}/.*,-- use &," \
-        	-i export-libs/lib/Kyuafile
+  sed -e "s,^\s*include(.*${lib}/.*,-- use &," \
+      -i export-libs/lib/Kyuafile
 done

 sed -e "/^\s*include(/ d" -e 's/^-- use //' \
-       	-i export-libs/lib/Kyuafile
+    -i export-libs/lib/Kyuafile

 ## End of export libs
 %endif
@ -792,6 +824,10 @@ sed -e "/^\s*include(/ d" -e 's/^-- use //' \
  eval "$(bash %{SOURCE48} -A "`pwd`/softhsm-tokens")"
 %endif

+%if %{with TSAN}
+export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0"
+%endif
+
 %if %{with UNITTEST}
  pushd build
  make unit
@ -814,68 +850,73 @@ sed -e "/^\s*include(/ d" -e 's/^-- use //' \
 %endif

 %if %{with SYSTEMTEST}
-if [ "`whoami`" = 'root' ]; then
+# Runs system test if ip addresses are already configured
+# or it is able to configure them
+if perl bin/tests/system/testsock.pl
+then
+  CONFIGURED=already
+else
+  CONFIGURED=
+  sh bin/tests/system/ifconfig.sh up
+  perl bin/tests/system/testsock.pl && CONFIGURED=build
+fi
+if [ -n "$CONFIGURED" ]
+then
  set -e
-  chmod -R a+rwX .
-  pushd bin/tests
-  pushd system
-  ./ifconfig.sh up
-  popd
-  make test
+  pushd build/bin/tests
+  chown -R ${USER} . # Can be unknown user
+  make test %{?_smp_mflags} 2>&1 | tee test.log
  e=$?
-  pushd system
-  ./ifconfig.sh down
-  popd
  popd
+  [ "$CONFIGURED" = build ] && sh bin/tests/system/ifconfig.sh down
  if [ "$e" -ne 0 ]; then
    echo "ERROR: this build of BIND failed 'make test'. Aborting."
    exit $e;
  fi;
 else
-  echo 'only root can run the tests (they require an ifconfig).'
+  echo 'SKIPPED: tests require root, CAP_NET_ADMIN or already configured test addresses.'
+fi
 %endif
 :

 %install
 # Build directory hierarchy
-mkdir -p ${RPM_BUILD_ROOT}/etc/logrotate.d
+mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/logrotate.d
 mkdir -p ${RPM_BUILD_ROOT}%{_libdir}/bind
-mkdir -p ${RPM_BUILD_ROOT}/var/named/{slaves,data,dynamic}
+mkdir -p ${RPM_BUILD_ROOT}%{_localstatedir}/named/{slaves,data,dynamic}
 mkdir -p ${RPM_BUILD_ROOT}%{_mandir}/{man1,man5,man8}
 mkdir -p ${RPM_BUILD_ROOT}/run/named
-mkdir -p ${RPM_BUILD_ROOT}/var/log
+mkdir -p ${RPM_BUILD_ROOT}%{_localstatedir}/log

 #chroot
-mkdir -p ${RPM_BUILD_ROOT}/%{chroot_prefix}/{dev,etc,var,run/named}
-mkdir -p ${RPM_BUILD_ROOT}/%{chroot_prefix}/var/{log,named,tmp}
-mkdir -p ${RPM_BUILD_ROOT}/%{chroot_prefix}/etc/crypto-policies/back-ends
+for D in %{chroot_create_directories}
+do
+  mkdir -p ${RPM_BUILD_ROOT}/%{chroot_prefix}${D}
+done

 # create symlink as it is on real filesystem
 pushd ${RPM_BUILD_ROOT}/%{chroot_prefix}/var
 ln -s ../run run
 popd

-mkdir -p ${RPM_BUILD_ROOT}/%{chroot_prefix}/etc/{pki/dnssec-keys,named}
-mkdir -p ${RPM_BUILD_ROOT}/%{chroot_prefix}/%{_libdir}/bind
 # these are required to prevent them being erased during upgrade of previous
-touch ${RPM_BUILD_ROOT}/%{chroot_prefix}/etc/named.conf
+touch ${RPM_BUILD_ROOT}/%{chroot_prefix}%{_sysconfdir}/named.conf
 #end chroot

 #sdb-chroot
 %if %{with SDB}
-mkdir -p ${RPM_BUILD_ROOT}/%{chroot_sdb_prefix}/{dev,etc,var,run/named}
-mkdir -p ${RPM_BUILD_ROOT}/%{chroot_sdb_prefix}/var/{log,named,tmp}
-mkdir -p ${RPM_BUILD_ROOT}/%{chroot_sdb_prefix}/etc/crypto-policies/back-ends
+for D in %{chroot_create_directories}
+do
+  mkdir -p ${RPM_BUILD_ROOT}/%{chroot_sdb_prefix}${D}
+done

 # create symlink as it is on real filesystem
-pushd ${RPM_BUILD_ROOT}/%{chroot_sdb_prefix}/var
+pushd ${RPM_BUILD_ROOT}/%{chroot_sdb_prefix}%{_localstatedir}
 ln -s ../run run
 popd

-mkdir -p ${RPM_BUILD_ROOT}/%{chroot_sdb_prefix}/etc/{pki/dnssec-keys,named}
-mkdir -p ${RPM_BUILD_ROOT}/%{chroot_sdb_prefix}/%{_libdir}/bind
 # these are required to prevent them being erased during upgrade of previous
-touch ${RPM_BUILD_ROOT}/%{chroot_sdb_prefix}/etc/named.conf
+touch ${RPM_BUILD_ROOT}/%{chroot_sdb_prefix}%{_sysconfdir}/named.conf
 %endif
 #end sdb-chroot

@ -981,7 +1022,6 @@ install -m 644 %{SOURCE34} ${RPM_BUILD_ROOT}%{_mandir}/man1/zone2sqlite.1
 pushd ${RPM_BUILD_ROOT}%{_mandir}/man8
 ln -s named.8.gz named-pkcs11.8.gz
 ln -s dnssec-checkds.8.gz dnssec-checkds-pkcs11.8.gz
-ln -s dnssec-coverage.8.gz dnssec-coverage-pkcs11.8.gz
 ln -s dnssec-dsfromkey.8.gz dnssec-dsfromkey-pkcs11.8.gz
 ln -s dnssec-importkey.8.gz dnssec-importkey-pkcs11.8.gz
 ln -s dnssec-keyfromlabel.8.gz dnssec-keyfromlabel-pkcs11.8.gz
@ -997,20 +1037,28 @@ popd
 touch ${RPM_BUILD_ROOT}%{_localstatedir}/log/named.log

 # configuration files:
-tar -C ${RPM_BUILD_ROOT} -xjf %{SOURCE28}
-install -m 640 %{SOURCE26} ${RPM_BUILD_ROOT}/etc/named.conf
-touch ${RPM_BUILD_ROOT}/etc/rndc.key
-touch ${RPM_BUILD_ROOT}/etc/rndc.conf
-mkdir ${RPM_BUILD_ROOT}/etc/named
-install -m 644 %{SOURCE36} ${RPM_BUILD_ROOT}/etc/trusted-key.key
+install -m 640 %{SOURCE16} ${RPM_BUILD_ROOT}%{_sysconfdir}/named.conf
+touch ${RPM_BUILD_ROOT}%{_sysconfdir}/rndc.{key,conf}
+install -m 644 %{SOURCE27} ${RPM_BUILD_ROOT}%{_sysconfdir}/named.root.key
+install -m 644 %{SOURCE36} ${RPM_BUILD_ROOT}%{_sysconfdir}/trusted-key.key
+mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/named
+
+# data files:
+mkdir -p ${RPM_BUILD_ROOT}%{_localstatedir}/named
+install -m 640 %{SOURCE17} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.ca
+install -m 640 %{SOURCE18} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.localhost
+install -m 640 %{SOURCE19} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.loopback
+install -m 640 %{SOURCE20} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.empty
+install -m 640 %{SOURCE23} ${RPM_BUILD_ROOT}%{_sysconfdir}/named.rfc1912.zones

 # sample bind configuration files for %%doc:
 mkdir -p sample/etc sample/var/named/{data,slaves}
 install -m 644 %{SOURCE25} sample/etc/named.conf
 # Copy default configuration to %%doc to make it usable from system-config-bind
-install -m 644 %{SOURCE26} named.conf.default
-install -m 644 ${RPM_BUILD_ROOT}/etc/named.rfc1912.zones sample/etc/named.rfc1912.zones
-install -m 644 ${RPM_BUILD_ROOT}/var/named/{named.ca,named.localhost,named.loopback,named.empty}  sample/var/named
+install -m 644 %{SOURCE16} named.conf.default
+install -m 644 %{SOURCE23} sample/etc/named.rfc1912.zones
+install -m 644 %{SOURCE18} %{SOURCE19} %{SOURCE20}  sample/var/named
+install -m 644 %{SOURCE17} sample/var/named/named.ca
 for f in my.internal.zone.db slaves/my.slave.internal.zone.db slaves/my.ddns.internal.zone.db my.external.zone.db; do 
  echo '@ in soa localhost. root 1 3H 15M 1W 1D
  ns localhost.' > sample/var/named/$f; 
@ -1280,46 +1328,42 @@ fi;
 %{_bindir}/nslookup
 %{_bindir}/nsupdate
 %{_bindir}/arpaname
+%{_sbindir}/ddns-confgen
+%{_sbindir}/tsig-keygen
+%{_sbindir}/genrandom
+%{_sbindir}/nsec3hash
+%{_sbindir}/isc-hmac-fixup
+%{_sbindir}/named-checkzone
+%{_sbindir}/named-compilezone
 %if %{with DNSTAP}
 %{_bindir}/dnstap-read
 %{_mandir}/man1/dnstap-read.1*
 %endif
+%if %{with LMDB}
+%{_sbindir}/named-nzd2nzf
+%{_mandir}/man8/named-nzd2nzf.8*
+%endif
 %{_mandir}/man1/host.1*
 %{_mandir}/man1/nsupdate.1*
 %{_mandir}/man1/dig.1*
 %{_mandir}/man1/delv.1*
 %{_mandir}/man1/nslookup.1*
 %{_mandir}/man1/arpaname.1*
-%{_sysconfdir}/trusted-key.key
-
-%files dnssec-utils
-%{_sbindir}/ddns-confgen
-%{_sbindir}/tsig-keygen
-%{_sbindir}/genrandom
-%{_sbindir}/nsec3hash
-%{_sbindir}/dnssec*
-%if %{with PKCS11}
-%exclude %{_sbindir}/dnssec*pkcs11
-%endif
-%{_sbindir}/isc-hmac-fixup
-%{_sbindir}/named-checkzone
-%{_sbindir}/named-compilezone
-%if %{with LMDB}
-%{_sbindir}/named-nzd2nzf
-%endif
 %{_mandir}/man8/ddns-confgen.8*
 %{_mandir}/man8/tsig-keygen.8*
 %{_mandir}/man8/genrandom.8*
 %{_mandir}/man8/nsec3hash.8*
-%{_mandir}/man8/dnssec*.8*
-%if %{with PKCS11}
-%exclude %{_mandir}/man8/dnssec*-pkcs11.8*
-%endif
 %{_mandir}/man8/isc-hmac-fixup.8*
 %{_mandir}/man8/named-checkzone.8*
 %{_mandir}/man8/named-compilezone.8*
-%if %{with LMDB}
-%{_mandir}/man8/named-nzd2nzf.8*
+%{_sysconfdir}/trusted-key.key
+
+%files dnssec-utils
+%{_sbindir}/dnssec*
+%{_mandir}/man8/dnssec*.8*
+%if %{with PKCS11}
+%exclude %{_sbindir}/dnssec*pkcs11
+%exclude %{_mandir}/man8/dnssec*-pkcs11.8*
 %endif

 %if %{with DEVEL}
@ -1365,27 +1409,28 @@ fi;
 %defattr(0640,root,named,0750)
 %dir %{chroot_prefix}
 %dir %{chroot_prefix}/dev
-%dir %{chroot_prefix}/etc
-%dir %{chroot_prefix}/etc/named
-%dir %{chroot_prefix}/etc/pki
-%dir %{chroot_prefix}/etc/pki/dnssec-keys
-%dir %{chroot_prefix}/etc/crypto-policies
-%dir %{chroot_prefix}/etc/crypto-policies/back-ends
-%dir %{chroot_prefix}/var
+%dir %{chroot_prefix}%{_sysconfdir}
+%dir %{chroot_prefix}%{_sysconfdir}/named
+%dir %{chroot_prefix}%{_sysconfdir}/pki
+%dir %{chroot_prefix}%{_sysconfdir}/pki/dnssec-keys
+%dir %{chroot_prefix}%{_sysconfdir}/crypto-policies
+%dir %{chroot_prefix}%{_sysconfdir}/crypto-policies/back-ends
+%dir %{chroot_prefix}%{_localstatedir}
 %dir %{chroot_prefix}/run
-%ghost %config(noreplace) %{chroot_prefix}/etc/named.conf
+%ghost %config(noreplace) %{chroot_prefix}%{_sysconfdir}/named.conf
 %defattr(-,root,root,-)
 %dir %{chroot_prefix}/usr
 %dir %{chroot_prefix}/%{_libdir}
 %dir %{chroot_prefix}/%{_libdir}/bind
+%dir %{chroot_prefix}/%{_datadir}/GeoIP
 %defattr(0660,root,named,01770)
-%dir %{chroot_prefix}/var/named
+%dir %{chroot_prefix}%{_localstatedir}/named
 %defattr(0660,named,named,0770)
-%dir %{chroot_prefix}/var/tmp
-%dir %{chroot_prefix}/var/log
+%dir %{chroot_prefix}%{_localstatedir}/tmp
+%dir %{chroot_prefix}%{_localstatedir}/log
 %defattr(-,named,named,-)
 %dir %{chroot_prefix}/run/named
-%{chroot_prefix}/var/run
+%{chroot_prefix}%{_localstatedir}/run

 %if %{with SDB}
 %files sdb-chroot
@ -1401,27 +1446,28 @@ fi;
 %defattr(0640,root,named,0750)
 %dir %{chroot_sdb_prefix}
 %dir %{chroot_sdb_prefix}/dev
-%dir %{chroot_sdb_prefix}/etc
-%dir %{chroot_sdb_prefix}/etc/named
-%dir %{chroot_sdb_prefix}/etc/pki
-%dir %{chroot_sdb_prefix}/etc/pki/dnssec-keys
-%dir %{chroot_sdb_prefix}/etc/crypto-policies
-%dir %{chroot_sdb_prefix}/etc/crypto-policies/back-ends
-%dir %{chroot_sdb_prefix}/var
+%dir %{chroot_sdb_prefix}%{_sysconfdir}
+%dir %{chroot_sdb_prefix}%{_sysconfdir}/named
+%dir %{chroot_sdb_prefix}%{_sysconfdir}/pki
+%dir %{chroot_sdb_prefix}%{_sysconfdir}/pki/dnssec-keys
+%dir %{chroot_sdb_prefix}%{_sysconfdir}/crypto-policies
+%dir %{chroot_sdb_prefix}%{_sysconfdir}/crypto-policies/back-ends
+%dir %{chroot_sdb_prefix}%{_localstatedir}
 %dir %{chroot_sdb_prefix}/run
-%ghost %config(noreplace) %{chroot_sdb_prefix}/etc/named.conf
+%ghost %config(noreplace) %{chroot_sdb_prefix}%{_sysconfdir}/named.conf
 %defattr(0660,root,named,01770)
-%dir %{chroot_sdb_prefix}/var/named
+%dir %{chroot_sdb_prefix}%{_localstatedir}/named
 %defattr(-,root,root,-)
 %dir %{chroot_sdb_prefix}/usr
 %dir %{chroot_sdb_prefix}/%{_libdir}
 %dir %{chroot_sdb_prefix}/%{_libdir}/bind
+%dir %{chroot_sdb_prefix}/%{_datadir}/GeoIP
 %defattr(0660,named,named,0770)
-%dir %{chroot_sdb_prefix}/var/tmp
-%dir %{chroot_sdb_prefix}/var/log
+%dir %{chroot_sdb_prefix}%{_localstatedir}/tmp
+%dir %{chroot_sdb_prefix}%{_localstatedir}/log
 %defattr(-,named,named,-)
 %dir %{chroot_sdb_prefix}/run/named
-%{chroot_sdb_prefix}/var/run
+%{chroot_sdb_prefix}%{_localstatedir}/run
 %endif

 %if %{with PKCS11}
@ -1439,6 +1485,9 @@ fi;
 %{_sbindir}/pkcs11-tokens
 %{_mandir}/man8/pkcs11*.8*
 %{_mandir}/man8/dnssec*-pkcs11.8*
+%{_mandir}/man8/dnssec*.8*
+%exclude %{_mandir}/man8/dnssec-coverage.8*
+%exclude %{_mandir}/man8/dnssec-keymgr.8*

 %files pkcs11-libs
 %{_libdir}/libdns-pkcs11.so.%{sover_dns}*
@ -1519,6 +1568,65 @@ fi;


 %changelog
+* Thu Dec 19 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.14-2
+- Include more Thread Sanitizer detected changes (#1736762)
+
+* Thu Dec 19 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.14-1
+- Update to 9.11.14
+
+* Mon Dec 02 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.13-3
+- Backport few thread safety related fixed from upstream (#1736762)
+
+* Tue Nov 26 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.13-2
+- Complete explicit disabling of RSAMD5 in FIPS mode (#1709553)
+
+* Tue Nov 19 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.13-1
+- Update to 9.11.13
+
+* Tue Nov 19 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.12-4
+- Report failures on systemctl reload (#1739441)
+
+* Wed Nov 06 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.12-3
+- Fix wrong default GeoIP directory (#1768258)
+
+* Mon Nov 04 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.12-2
+- Move data files outside config archive
+- Specify geoip data directory in config file (#1768258)
+
+* Mon Oct 21 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.12-1
+- Update to 9.11.12 (#1557762)
+
+* Wed Sep 25 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.11-1
+- Update to 9.11.11
+
+* Wed Sep 04 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.10-3
+- Share pkcs11-utils and dnssec-utils manuals instead of recommend
+
+* Tue Sep 03 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.10-2
+- Move some administration utilities back to bind-utils (#1720380)
+- Add GeoIP to bind-chroot (#1497646)
+
+* Tue Aug 27 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.10-1
+- Update to 9.11.10
+
+* Fri Aug 09 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.9-3
+- Display errors from rndc reload (#1739441)
+
+* Thu Aug 08 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.9-2
+- Permit explicit disabling of RSAMD5 in FIPS mode (#1709553)
+
+* Wed Jul 24 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.9-1
+- Update to 9.11.9
+
+* Wed Jul 24 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.8-2
+- Use monotonic time in export library (#1732883)
+
+* Tue Jul 02 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.8-1
+- Update to 9.11.8
+
+* Mon Jun 17 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.7-2
+- Fix OpenSSL random generator initialization
+
 * Mon May 06 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.6-5.P1
 - Fix also postun script

@ -1530,7 +1638,6 @@ fi;

 * Thu Mar 14 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.6-2
 - Fix dnstap and timer issues in unit test
- Enable DLZ modules

 * Tue Mar 05 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.6-1
 - Update to 9.11.6
--- a/codesign2019.txt
+++ b/codesign2019.txt
@ -0,0 +1,252 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Comment: GPGTools - http://gpgtools.org
+
+mQINBFwq9BQBEADHjPDCwsHVtxnMNilgu187W8a9rYTMLgLfQwioSbjsF7dUJu8m
+r1w2stcsatRs7HBk/j26RNJagY2Jt0QufOQLlTePpTl6UPU8EeiJ8c15DNf45TMk
+pa/3MdIVpDnBioyD1JNqsI4z+yCYZ7p/TRVCyh5vCcwmt5pdKjKMTcu7aD2PtTtI
+yhTIetJavy1HQmgOl4/t/nKL7Lll2xtZ56JFUt7epo0h69fiUvPewkhykzoEf4UG
+ZFHSLZKqdMNPs/Jr9n7zS+iOgEXJnKDkp8SoXpAcgJ5fncROMXpxgY2U+G5rB9n0
+/hvV1zG+EP6OLIGqekiDUga84LdmR/8Cyc7DimUmaoIZXrAo0Alpt0aZ8GimdKmh
+qirIguJOSrrsZTeZLilCWu37fRIjCQ3dSMNyhHJaOhRJQpQOEDG7jHxFak7627aF
+UnVwBAOK3NlFfbomapXQm64lYNoONGrpV0ctueD3VoPipxIyzNHHgcsXDZ6C00sv
+SbuuS9jlFEDonA6S8tApKgkEJuToBuopM4xqqwHNJ4e6QoXYjERIgIBTco3r/76D
+o22ZxSK1m2m2i+p0gnWTlFn6RH+r6gfLwZRj8iR4fa0yMn3DztyTO6H8AiaslONt
+LV2kvkhBar1/6dzlBvMdiRBejrVnw+Jg2bOmYTncFN00szPOXbEalps8wwARAQAB
+tE1JbnRlcm5ldCBTeXN0ZW1zIENvbnNvcnRpdW0sIEluYy4gKFNpZ25pbmcga2V5
+LCAyMDE5LTIwMjApIDxjb2Rlc2lnbkBpc2Mub3JnPokCVAQTAQgAPhYhBK4/rHln
+EexZ/AB6pHS7a5pMuz04BQJcKvQUAhsDBQkD7JcABQsJCAcCBhUKCQgLAgQWAgMB
+Ah4BAheAAAoJEHS7a5pMuz0476oP/1+UaSHfe4WVHV43QaQ/z1rw7vg2aHEwyWJA
+1D1tBr9+LvfohswwWBLIjcKRaoXZ4pLBFjuiYHBTsdaAQFeQQvQTXMmBx21ZyUZj
+tjim8f9T1JhmIrMx6tF14NbqFpjw82Mv0rc8y74pdRvkdnFigqLKUoN2tFQlKeG+
+5T24zNwrGrlR3S7gnM47nD1JqKwt4GnczLnMBW/0gbLscMUpAeNo/gY4g0GV/zkn
+Rt91bLpcEyDAv+ZhQZbkJ49dnNzl5cTK5+uQWnlAZAdPecdLkvBNRNgj/FKL41RF
+JGN6eqq3+jlPbyj9okeJoGQ64Ibv1ZHVTQIx5vT1+PuVX/Nm0GqSUZdLqR33daKI
+hjpgUdUK/D0AnN5ulVuE1NnZWjVDTXVEeU8DFvi4lxZVHnZixejxFIZ7vRMvyaHa
+xLwbevwEUuPLzWn3XhC5yQeqCe6zmzzaPhPlg6NTnM5wgzcKORqCXgxzmtnX+Pbd
+gXTwNKAJId/141vj1OtZQKJexG9QLufMjBg5rg/qdKooozremeM+FovIocbdFnmX
+pzP8it8r8FKi7FpXRE3fwxwba4Y9AS2/owtuixlJ2+7M2OXwZEtxyXTXw2v5GFOP
+vN64G/b71l9c3yKVlQ3BXD0jErv9XcieeFDR9PK0XGlsxykPcIXZYVy2KSWptkSf
+6f2op3tMiQEzBBABCAAdFiEEFcm6uMUTPAcGawLtlumWUDlMmawFAlwuSqAACgkQ
+lumWUDlMmaz+igf/ZW8OY5aWjRk7QiXp93jkWRIbMi8kB9jW5u6tfYXFjMADpqiQ
+yYdzEHFayRF92PQwj81UzIWzOWjErFWLDE2xol9sP5LdzeqoyED+XTqKggpVsIs+
+Lq672qnumQoZKp1YGb8MDocU2DNg/VsMdi7kCnEnPbcSuBxksmxGYomusXNrAF94
+1OJ2sqd9BuFamLIyn8XUCGGYlsvMoe4kTCg6Cc1sQvx0lDG8urKN57jBKWbP4alV
+JBV5KQcf74gzPmE3ypgY1tMEwxyH/WyS9ekDbai0qauX6eUAsM1bduH8fIcknLS
+Zl5hrJTrzWFF9/DKOth8QOwhJ9zoIF1fcAsx9okBMwQQAQgAHRYhBHpqR7X54SM6
+0lUrXL2X3GOe6MR7BQJcLktcAAoJEL2X3GOe6MR7jwEH/iaolMeno1oeWAgzN6Mg
+bx3maweh/9Vqty1fwk7Crq1G78X5i1OCkknEL2p0Bfle4ApwcC4HZVcqCgoYpRV3
+/EEXtwkMNy3plWdBbLCQSev/E1D39GzgAHiMnv7NUJnkoJbvMrvrAiUTXPTtARMM
+gjEpvgEs60wuJxS8ESomRhe/KW4myxDoBxF+K+e5bOkOvvWVcAYJHWZ1BIZs4n6b
+C2vO8q5aKTkQ/XvNT7utbTOqj1SGhItRaAQKXHBdzkQ1Et3wTA4+uRg4gK12624
+9LperYs26w9X9UzApl+qVxQhtWUw3tnUXMastDfQrRcvJgq1xpv++OqX5Uc93RTf
+SNWJAjMEEAEIAB0WIQS+DpdItxglOii7if/xsRvwXPAuVwUCXC5LlQAKCRDxsRvw
+XPAuV29KEACEwlTVVKe4gnBYHnlAD7csoQ0+gJ6C+Ofzlw+UItRIcFeVCAknSGBs
+NPxr9JStIvKpmsbSKpCNUEAYnRP2immh94y/C6BuTe1uUUmqBGr1f4OAUwZpmI29
+ixYeY/uUs9FZO3bS0/WtG46tdcJK41qtM0DYAGT3oeZhJMTW15dfvMGlFukauSOU
+BbR+6sZhqdbWl/AOTE/6x5otnAaW0GObY/BW240Xq/KTgBrzVdK5qNoYsMVsiTd
+0im0JKvFG08ED+ZfcILhlO6G9jRhoTkhtYuf8CKN1dPf2IoB5FrRFf0xqRr9hNlk
+X7ViNMP9OPb8i3BubWvRi5rNSquCwrFATSiAgaA9Yi1BNzQsmQxOql9lsh7eCH7m
+8zzUg9umWI6PkSv8vHBo2kPX73wmtEsF6vxJlk0yDBuQw7y0uuKh406tEEk4cP2
+8U4baq+ihpioupDhNuEII1h1Eh/RBE408RAOpcr+2F0m/fKOoJyz7u+AxyV81Ia6
+fyBnUfZnlfKo16w87c1HJRs9dKkRa5yGziBf9TcED3sru58Pftes2Nr80/iOh26i
+P2pRihcIyrmeAqDWnneErVCmPMDTe6zkMrm/0iZ25/Jfq+M8IHEzFEw3Y1FBOeFg
+9TyMDwYG2biJPTNTDO0BQ+Rrvs4SjFWEYSxgJSvG1jMfSPt5AR6MJrkCDQRcKvQU
+ARAAufZX5WzJr0lZAhxaGpHY6JMBr4jVOCP4TrDZhwC2K4CXNM/PLLNisWzquiWa
+FvUDhB89kCxrEhipwVFYhBr16CDQxrr8yhah3RIxrBMYhRTxgIAkANgkhGWfDJSE
+zXauA7krYtS3rYwhfXe4cNsTkLPbnMUlyLJcqj2wnZcZIt97aL+NFRPyfIw1KfUb
+9u3tB9seDYbvTEULeL07aTnHpWM5f3bTwJrJ2OFPzXseCCzPiVNh3Bv+YtJ1pMTr
+c/UHO5DoJuHLsF0wicPSrpD0twspFdR/0rT6eNycsaCtV4GQzBcMPvY7qai5XrZm
+Cqgluo1W6l6+F5YrKvRMtyyFkUNGcPywdjSlP44JyRrS2uzvFUViSsJArcmFG2TJ
+LCohnse8wqjw0dIUVbmDbE4zjaG56zkvu0k+04Wwp3XPgOZrbl6cbhX3yLhu/Gt0
+dzd9EReoNfKXk32hBzKas/vdeB5DZejbOOOWYftqyZC1LvDvvrYFhFK6VGozfZ6L
+Fml1hzn+xPahp5tRv93/T9zXeVPm9zilGMqm/gjRgh8ojWxNQoNzJyqTPWIvWmbu
+EIP3T3cTFq6lJpJsg3+sfzofGWZCGnBZQGqm8rEOoUWiaKe1BvQCX1x8p4/x8/tX
+TaVDpQCGoqxXt09plkDuGMuiDICxBlaHWUR2jLoHc2cLrB8AEQEAAYkCPAQYAQgA
+JhYhBK4/rHlnEexZ/AB6pHS7a5pMuz04BQJcKvQUAhsMBQkD7JcAAAoJEHS7a5pM
+uz04pB8P/Amfg54IFeALiPOrKbjC3bVAQzrsf09IL8sUln/LCZIx9HgGAJj/f35S
+Q35sK2ucjWiDX6qCxVrWmC6caQXFgXOFSKIlqladmmgj4sIdLM5wj4nbomHChpB5
+rqV/GgkFwWBQ3kPCatXvc8Bg+zKJ+wXgTuPFXefyE9R+SLuas2grQ9hAjvTGHYbq
+iYxSlNDFc1aHLAQ3bS76351MHuMHOpLzoB0OkZDCVNW4GNEqrLbINdr50RAK+Loo
+Z2UBIobEZjXYor9A2FWkSvdjyz6X1QKMdQMath6R91k/O0abBa7ly4/805eAGXM3
+w1Xf2eMlpiUs69BeYoJBklK8aNMntpDREunJjhiPU4JoDzSxl5Qv7LuXylyo0YJA
+9YmydKhTTcRdwsKc//nGr/ckg4BRl+VbtJBYvd3xGB7IQ+pT/TOakv9qCospAhr3
+EQjVP/XpnWJRd+x+dq8UXqwWmTenWDE42cNr7BDFJdOqS5ZWy4sIz4sdjpSxXMB9
+8iiRtKSpKRCJgXScB7SYebh835EgG2YyQGdhJMO7C6ok9POYQBqL8sBqRzImJKoT
+VDvOH42WArKwJWTHa4mPdiDHEIZlkONerec3JXtl4Mfv8cwZ5Lb8fSiB/x8AWvqs
+puc/7hQtkus4TcgutS1fwhAwpnFItpVF6+73CMQrJsblBdTjW0T+uQINBFxbVHwB
+EADebZOJbhPdhHeBPdlZYE3rRjB8scDpWdjrCupfmeTC9MM6JgCE4DEMBtBXk+h1
+7wfpblYYNFwGVFvytG5nvGRDtHWxwd1Z9O8Fx4Zqu0Fx/wAn7ZL3ryE+tdHR7JK
+7SLxOa2X49T/8LY0U8Q65I4ZRo/b4VMcXApCmncw3QSRqHT/mYdNnf+HHPvi3jza
+md3iVptCS4Iaisc079DFda+htWXspBc13lmPi2vGQkWjjS3B4yO8JackyQPVhpsg
+KYbRBzOH0Kii8bXmyA6O5uIJYEddp5Veged4FE/ej3CrgGP1D0Yk1epx8lLbi9RB
+kwFS7DA5rQ23UnbSy1WyV1ZgPrWqQAWuGpjMTVTWN0ElI3AGxAnE8lZlSXyE+XyV
+uHjjIVrayBjLKVqDuSLdKZeCvI4QsyHH6F0NKJQkngvXxLZYxO6s0c2EFFLzdVWT
+1V9GMP8UsDrrb+JsZjUVmPR1tTP4xqEQG6KjfFoQm5XWpGtFwh91OK1lwf/Bx2/C
+j+PquLLFcj7hEP79VDTUZPQAduTTxIeTzHXH+x1PCHFB10xxH3e82VSdJeBUrJxn
+riXzK50SKTTmF+uYpHqE8Jg1N2Y1n5ksuxeYUy8PFjhAeBCqZ6ZcldUDf4999e/z
+PT8bwfCDr8jRdqJHrq7RxTJiP5RsMudWpKeohzJGwQ5uZwARAQABiQRyBBgBCAAm
+FiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAlxbVHwCGwIFCQO9IQACQAkQdLtrmky7
+PTjBdCAEGQEIAB0WIQSVztolaxygoV8wL7WVIaftXazpGAUCXFtUfAAKCRCVIaft
+XazpGPeMEACm9nxA/VKf8RxDo2ZuTgyuSwlR8tCjAE4k3+UoiYUbamkW4pjx9Vgd
+1zC5bNxSWZ5vlJ4CH8ArKFqNK5LBVDZqhYureAo/1Af2b9vRJw0/QQHhuXz/jqeT
+wwrLuKpy796Gpt+aFfcmS0ZC4QXfxJERhAP6tu1p6YmAsSb+bjziQVkKrt9mhOrL
+dtz6WP0Fg1joRj33FgnnLtayHvtgQrNFI3ztCjk/B2FjYZxqbBGfk5gyo0cTE2Fi
+oLhG/XrxIoZepFMJkGYETnYQXrOt2KuJLvawV70YQmG8EqHYY8drKA0XDZs8TVdT
+5cvGvtm8ERz5znsssRBxQMI5Ml6O2ahrXp8Eq4htCzlvO8t2MOtzvqAJRiyAd6bA
+Uo+MGVRpnvePOR1SAgBXCd416rF0iCXc1utZxnqwdq9kJAZ+8mCLx4N4jk6AdGpX
+zcNkLg7QmUzXn75RxZ6GrIUYZJNMlswXq5XhSW4o8ePlaxWjh9+QTtU964AZhpA1
+uoHsKGTBxHJs0w6McZm14kb2PuaO2/rpf8s8IZyc93+Y5O/gHZ6/agBjA9qN6wkQ
+R1d5UhJC4QS/m35rBGBKK9X3fqQxaBCio6Qz+m4A3GchrztJpq+2P+ma5ylsTq5j
+V4njky26WNtrV7+N0C4Moj3I4Qn6YU/eSManTXzHzoiPZCEH/IOxgXIiD/9Zm3Zz
+I+h4NCfSGyP11/w1gEzlTHQ4at/FXIIDh0Y2ZNpWPffuFQLtcER2vyKPwhDYpGMy
+NNHXks4azfrXVCv0wmSNBbeS8pJrYtopZpCEBrAbg/YLv9m5lpDSRHaR3gv/qMZ7
+QxY+NwqciqTwGq68PuF4mDSvtfuFmbEES9Iybiie+eL/6DU2knfBjgshUe6vElR+
+LYoPQ45GY2IxRTJ1pMXaZw1+evwH3UvseRGkRygiaBgoU/qR4prynvjMQcacCa+C
+aRnXZJYp/usVBeY0xut9toc9/OcLGoBr5h9l5YjruO2vu8VHou8N0tarVQn3YbQR
+Fi+YtNtclWJa8Pq1AsKRTCFwDwP6eODv6mNOrEFydNRcpiQmzp47VWF/YHRfHzCq
+A1wHLxLUrpQTaVw6J4FqedAQ31aAO4faA7MS+ZMNBqZCZ7lTGC6TvojqqBAN2yX7
+AnnYpZHM+lGpi2/ukVzLqSkGmdNOgbu+UZvoej3YnHYig4yWP+z2xrlJl8bkhU/d
+r9IQE5aRCEPB/JWhHJ2/GqYl9qjshlB52+6X2KDarwptOtzT9ooArYhpMwKIYh34
+c7X8tlAKYk7V5j7txIRFDKKAftC7dM82PntXJxSkWyR70GYnYjiXyrqqerqT7xIC
+mDEQgFOPpy09zFW62paO9uiZw6qwybwqgGpoX7kCDQRcW1TbARAA3ERo2mPv2VVg
+ZUFr4MtPDm4UG00YJW/LYa3D3k0e9tdSScACXprk1sAoxUlQx/CSdErPKwXG4rax
+iN4t5nICUUNYSC0dh09G25jC7nwsWc0AYyZu+h/FzfvpOm3fBwmBlzILlGh0URwH
+Ffj9fHt6hos4C+3PFZZ/X24aMJF/cov1oYi9rqFwt/l0mgtPE88Iyj2/Vp3Lergg
+QMzKfEuyluj9fL2cgU0Qa7oAPXmaxhHtua4cvbM5SXGo3FXjIgzH9OfM+2orebeN
+wH1M3ec6w+nPmRmCJLvPKGOeS7GVXL5/aOyPlDWzSXYnpCKS2ntw4K4nt0IA8n8z
+1db109l/C2noDrDSJEqOo843ShNGTYOMVUrj3a+Y7o2ATc9pNZalf0PwnKas7NDb
+IJ152PEQw665iYXcv2awjLF6W0yuSq8kfiaAxIrsie2Dto0zgqOs0Ot9Y74u11Hh
+wBSHUO3mEZJScAAcI/yDF2PvjvCQSzu4mdXb77t6X2O6YHULz4A7bVQCMazcTDI9
+/S0W2+ixPnnJVnE3xgjK9zuizji8JDJw1hJCQM+yTLVqq9pfvcRfQ6uwpMRzz/O3
+S0zDRiA69/GyfNwkpgz5QaGpY02IK5WrQU1doRjIz4BHAYzoIOkMkRqTtjdElQZw
+/D3wSO2uwsEMNwRzibR/Lz1JF2aGn6EAEQEAAYkEcgQYAQgAJhYhBK4/rHlnEexZ
+/AB6pHS7a5pMuz04BQJcW1TbAhsCBQkDvSEAAkAJEHS7a5pMuz04wXQgBBkBCAAd
+FiEE1wyE5ktVjlvM7AchMuIXXx11eioFAlxbVNsACgkQMuIXXx11eiqCfQ//SFDf
+rOIEoslp6n6vlCuavOg02wvjskKQGP1P1Q4v40Fw1Gl87n9uXAoMpeF4H+pzUxOi
+BHYCQi+EemwocSThzaWfPzd3JG/0OcRymf+ZOcBb+58VJL7p88QdMFIAi5J+KMuA
+fEG0zLkc9anEnXoVMmQJX5K+6PyeVDvBbYGjLjQAsWTZTiVuQI0w3WxFtDGWqQII
+8e/qE0DA7c/auGn7j2hid308+FcdfpmLefW9YesWjE1yYvHoCRdFOJ/7Sft4MQCI
+Re7UET3TRMBvtisP2DcqyzGPp22s4ZYFCCJJNiB92bXdEl5zXe4Ff7JTfNE/QrR7
+Wg5R9hZHgHdbp8p8bA3f0y29YCx3puYg7BbmQWiMh3rXWE5b090pSpw0K9BQU3vO
+irr+5/2TaFOJXHl4VF03GrWsSncShCbdsdRIv4TB0lY2mN4q+e7bjlAzJJeoaS97
+GIqu3DBlAJyx/ZwWW23DXXwoQ4jNuJhpl2jaCE7rVQB0uLjbp0i9Zdd4SdYZxmO/
+Y+JfgoJz8eyx8wZi4eDz1ijN0WKsIGjxJH5VUK9STjijDMeG6ZZRLc6b1QCGhe97
+ZbDkEUTdQGoeu4L5Fiqoma13NEsf8ofBDv+myJm/O67Va9JI3gxhIrhmF7LMzQQp
+lYx2peZC1CmhEnn83dtt83mhXvX6Dth657BW/Qd+GQ//SVuTPuNkBXfrTi4dbnv+
+cU6IsoIBodTF/WsQ6h4kbtsPhO5DbrsLNuNumrqVEN8jw+HUsEeNvFNeMrTPdG2V
+87ShQ4BQGkCf+GFRBj0myxxXOFZYQx6RpY5fCe7yOcTzpkbnPWmm7V8HdOuZ0NnL
+JNQ5YogOI6UvXVKv35R9qBo+G9jkhhb0eaAu6BERzKVANKfsGN7545ElZ1qlffMh
+AQhXGb6TsvCeSg2cWGb2cnVL2d58uVukD4PDiq4qqwgClkF3bOO70SIgGrCteHbi
+4Hseopex5m6GqqjoUYXr7QQBwSaQdc+gKtEjMHCsHbUyHRk0qEHdEe+2RmL0d0ra
+QMJfKyYQjcCR7tnrgN4WD1h4NKRdC/KRW31MDmH9XVPrkOMQCUCnArXkOwdKWsKf
+h8af9HqweXOT1FHJN/M3tWaBpv6KoduF2f2pj1VhPZ2EqFUycJ26lrHyOpsynQR6
+TD+c1uXotDwKN5RW+YL1cydk6mhib64fdOyPUeTcHehjMAFgM2f5wi35Ujcj8id
+37cWOqRsggSbMnGO4AUA/YtcVNG8TjZbakson8ENK7e8q4sEiNFUZ7/CtzNokwHQ
+5uOG1+qB85Y4ImGnIZVeiBpjt73VVawg4Zvm/omtW50P9R+4rVhMJZZFAgrWg8BH
+H/KNznW0vUuShG8B+2FA/eu5Ag0EXFtVDAEQAL5ftI1GgVJEFgX5VsuFnfBnH95c
+zqmwEXaTP4s7Xm3O0Wy579EzRUD1eEw/UaD/q2OHScwvMP65cZYQ9w4hnCN6H96P
+96Teo7LOMCssvSXIO7gqP33LKTqDzsIoAFHwWE3dq1jbyP6T1Je85mr0Edvk8kOC
+B1hudswAARno/7X9zGulhhwuEHk5Iey7R59yRUQqBctdNcetGyaiFjjX0evuVADi
+/z/s07XhDLDt7+3Vglh1/7XGC64QhB9QjZ8j0u7+0xfmLLjhi+7EpkDlAHIJXX1H
+0wAsPOGKlYruQUmIsMNfBINZeulHEBZ4cAd30xsM296DzJ6QL9sAGfYMhRs0YHB/
+EJ10Zv0iw1pU2jCCUv/9Kf4F4nwgHQWQP7JAbfhOIUOUq/YlxjTLnkd25+7vD3KH
+NQ6UiRDROR9Jwetpd/zokpf5O5iTBpVL+sCq+NsTZyDOjITve2sY0V8v10M+Z+pL
+cp/cUZ4JEDS/WJ4/ovBNJP8b+YwN/RBgCjl8UBX/N+e7AA52eYP2H9GK9XPkzSCE
+VxEf5PyjGrwedpoLkzagrHsDuWo3uBquLyneT/ozihqKQAuInUy5B7rWU4mpKHe5
+Vto5o6Zuj+6MgHgIQzRK6Da2ziMNEmroxwZibcYCtUPdvcvxGh+byclnzBclKjOw
+kAalFPx0SxEbHmzPABEBAAGJBHIEGAEIACYWIQSuP6x5ZxHsWfwAeqR0u2uaTLs9
+OAUCXFtVDAIbAgUJA70hAAJACRB0u2uaTLs9OMF0IAQZAQgAHRYhBK7WIv4CB360
+tcFGwUKiedJIzcMQBQJcW1UMAAoJEEKiedJIzcMQH+cQAIQYXDnqi4Hl21LtAgky
+pZxug+x/LECVlwkrIfaQF337+fG+H9J7SdU87Sn1Xe/YUgQnF0XP/fjIVFM0e/Tb
+xVlmTFqiejLnIwJJDgUaHO3POT2sGEyO3tc0mqSzyRBxtMQ8yvApccBhL5QODv3h
+hlRWgk5MXU0IPeXw134IWm+o/PRiPBoXPawvVfEVIBlUFaiSZASf4BAiSad4aJQe
+P8PyP7FPvQB1xiib0iSetn6ZmNeN2OSUJPiPA8aE9JCKuFtomVQEDM0BqQDl5A7h
+5O2uyf0Li+/ArqBvfBjrH03e5zbID02dO3D2BjsV3jUeVPQ5WDgVg8LH+nfg/rRy
+wfCsx9zFp1mt3K4xN2v7IKwxGndApgCcx17gsjzMvLz0J7sSGov4MNjzqvGEDKCl
+uUvNKXqy7je9xcQLpoyvWtoWFXWTbQAcK5Vv+hC67r9bHpjI1KuqA8hYqNKxsv7s
+wiLZdd4SK9SIuwf0j8/XTZwmoFfGolJil0ZNxyqBF39+CMVpaHdLM1qKZz99TVzS
+h4obOOjkUjK458xSo0XCbJ4qXYp7PgxyWK6GIbTozbbG/1ldw+LUnqxt8Shf797L
+J9lbI3ICuR2P5PYlKJf3b6D9GyfqyrP387fKAKhHsYkZ1XD54/8wIgTrdfeNPtL0
+1mjWDjw5KvO9kuPBjcmzgt+NrtsQAJwKeZsiqLLcY8kJ9xP+/xtTlh2iVuZMfxwq
+hwlo4MMCzpobLDZ/JKU398m77eboTKJSBfeUYxQd4ATn1L8NLKjLxKAaBkjEk0nN
+8w9OUQbFlhQ/asLzzF7Z9IGGh9/SEgBZ8V67a0O3Qw9Xdi3ARK3bbZ8RIVJ0+P9G
+CGrfq9j4ZmGA2L4irLjsvDAv7CSMb4WBKW8j0Jz5LFMwOMJgG1TT5c6lNqFj6y09
+rZcVLnt8+lUv2Bw3LC0oI1TjFkrrCzIdfg++mPi3K/ZFc50bvnWF4eCOjgZ5U9Vb
+sxFZq3+vTRcIfI9z2lZ9CNDRA1O5jGvuVtEGLiSLF2aJ6kiNriLuuGTlXfg/Fpgh
+GTvyppOTzF7PtHzHBQ/ZjnhWojnc/jyJRwLK8cCl6+EOc887v8BDmqgFWtmycsE2
+5fDJ7UFGP13g/eDL3ZUgMDty5dQaUOTX145t2KT+lMqpY6ZK2EC+eoqrnIGJ+tYy
+0l4RRxi10mbNhuPIIDdph7X+mUHgCeA9gyF0Y+LqiB6CX+zFg7ovLvnCbMPxdGXq
+z7AjfwqZBKI+BVuBeDtyW4onmElCu5cXNKsg3W0IlQlZf9PMDU6Ht0XLUs7EPfbQ
+sH1Vqi1XE1W/tGnkmjcpG/qlt9Gx1uwFGLP6iomqUBc2c0GZ6R1xplXvd3w3yC8d
+8lAgPGImuQINBFxbVToBEADkuxhQx9gxlzzCc0nUu2v82XsD+GzONp9irt14gslx
+te96eKaTXTi0t5eya0X5TIY3wbREwjlfAeM9AfcAmWcsM4izrfPtANM6WOxB2Tbz
+EY2cqv7NBQii7Z5aqPyjcIiT0b0Gs2evlDkn3xEBBqTSrNcnGSA29bZPIkaUb7Qo
+p/Ani0S3/tgcR21gXsJwkgpfNKwvPT03Lz3/o5rXAyag0M/25adgk9SVKNcXc8h2
+HSGv5ENjwUKNNnowVbNLw4287mFUM2Vd6unGJ2MBj7aUwTrfBl7gNV96mMdDJWcB
+hGKYkxUvibuHCa2KH7gTrnV6X7sdrgD5CbJMPq6OZNSP6n6bUVg22eHxoETplFwT
+4NvV3clRMWIAG1XgXR1l99LAh7PPnPMM1pHQGPwYHQskoBFS4g5knzHpB9h9TfZ3
+MM4cDZR5NgWmE0fYVnWe5ax+wW0/IOklUoHv3qoL4yiN9wFJq2oLzUNQd9+tsqiy
+vxSTh8iYmHegyn5KuBPsrMPgvqiKOdalTZKkak9DOx4cGQL2qHspKxiBOb6uox2v
+fjMQ5bDeUn+4DYMdnZNHeywCUegJmDakUtlfvN+136IDHGwfdGcitqzswzd3+PI2
+qlwPE19gkrp9NUaD3Qj2ZtDP7sU2cThc6Gra5KRFW8f98bI77j1Wu6pCnYFLqPz4
+QQARAQABiQRyBBgBCAAmFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAlxbVToCGwIF
+CQO9IQACQAkQdLtrmky7PTjBdCAEGQEIAB0WIQR5HX64jryNAThDSqwz3zWa56YK
+eQUCXFtVOgAKCRAz3zWa56YKeSWOEADK8u03LESGSQlZQqnnCAI8iYs1s+XRMEnG
+2tAQ1OK7/4eNgr1yZckmaW4FBMgeEgYIBJ7v3SlW7Hf7dE10TYPNGbP6UxVW8HIP
+rA4CINcGZXWWwpS374JNMS6A5eb6viuEgEMEi00jx0MmLvCMZKypmwXQUl5YJ5nB
+ytpQ1681mCQxGBMhT1eKQt3B4nAsoEnP+HnqVM/nKxBemSBNXX+C0b/YeQoLC3sD
+L+Z0NRI8U6PZl9Rokod3uynH0vfBYCEJd6MvsjtnJlVVaseYIA3ESNrFG12tw95I
+wKNrVCANZ1DBSyK4ovmmWsDrH+uFTHSLNjlxIuVxUfmXcLfgcepVCmd/7Z7UrWYr
+SXSvP0VG4ZmEPE7tNb8bfyADftO1cVsmcHBQeSrgvpSrTv9L8MocojpR5vJc1f+a
+sBT7rAeGzZP9riz1GmryXawaZgdLfaaJfzRQkc1uTChb7kMN+UMhVUdCAXmho0XO
+SfcsW84u/LpjdYh2Ww41xQO6EWvbZDNgD/Fdmp8Uh1MqJ1Dejri6kjNn6wPImXJd
+Eu6nHqWDRdYsfT4XUB18tB+4aIpFzCyIgpf7p1uaVU7Oqip5sZkc/WXKr77lV23m
+PQvpGRNCzgU2TJY7ktR3LOvUVN6wNfLMHzeQk18NdmcEGUrJ0YYtl9vE5/Eg9L6x
+LBH9PKt17IQ8D/9DLwQX8pl3fuTM8ZbzIPLxiXhbgzBBTXKRE2u1888+RIq9xE7c
+aVFjwq4qpgqZ5SFonTcG4Pi5ck3mFAzyA5zLRF+ckpmBpwSPMpLwCpv10369D1jh
+AF3JsUwt6DIb2BISMhh2ThSUMSKO75q8GSotsKjJyjD6vl1x4L7WXubTWxEiNuwD
+3kAjFWS1Z1VWtA9SURWAbsDaCV4VmwCCpSIwRr9OTbyu9XuMdMxGNpl8SwW7MVQb
+x4aYNvR7Hl/wIR71AHAXoSfrKp3p12anXjYYASHmbm16ugP4H7HLMBfznKet2f76
+gIxJr1CsAMTSqypcC1UoVb6Gz8djeIR+GU+6efHI4TIUMy5uMIUx8tYbwSEeo/y6
+NnjpJFYYjJa671iSABInNxs4+X+1zrFa+wl45EnaFxziEet2Qzv/VsusoLvLwnYi
+BZckclAS5xoVGFW0WJ01OfLUDHxGMt9GSheL8c+GLMaMtaCWunpmmt9zZ9WdpBOu
+AGluMG1Cee50TrhXaGE8CdNr8nOdSeLNAveBAPmuVa0JDSe20/D/RuYJLKeG9Vsq
+BZvjuGlOUsfl6UjtiGRbgS9OWpxeez5ugc9yyV+rBGIpmnIb+9quz2HmGxE65eA2
+cRNsZRIjFLzeAx/0RMaT1nlLFTBbUuZ+tJ+fgFtRGMhifZn1pb2dMQo0N7kCDQRc
+W1VuARAAv4LYaNq2Zev/v7M5DnxLpgHRcMkG7TOQpycrlK5653llpZzTy3mh5peW
+vcq3IDmdeUIJxQ+WDh2f0vS+NIKDC/HAddfHrZPbhO7zLxLcMW5KmV05ancaRSP0
+s0+IyQmvVxUNrgPinZiphlvRGoLXS6pdgfc4jIR9B2umPecfvfu/6EWFPnXZgG8K
+yY3Z+mwrmEO0FaXHBQuu6nactiPe79N4bLe8hk9RW6yIxLBeJzIoOlIcJmuRHapt
+nS2lV3mfhZdFnkAp1o6a2TL5BwgMY0wZUKZr78HEMKh6LbPN9rPepf0neUeq/k1l
+NJU7V6XMS+rezF31vgSJ5KoNGYhxtWZ54uksH2rcw7+ltpSVtqY91G/vibpRCJG3
+LdX/kxHni1NEWyZlpS/6ntuH6HSoNYsR9IMsbESs3QVCH74ApK88CxYCRB0SEo0M
+yAElbQ3bfEKCKl/FwC4IzAYAJ2arWKwBHRSJlsrNCtczrjG7j3EyJrn8+Tm5yjO6
+0THQjvc/nBxrNE09r1Lzz7jrDWC9Rl+BH6wqdniymoYyUAQsX2rZ+Jhah1Zkf+Gu
+76qtY+EH494dPM+0FazcBlgBd6/J5mh3Wk9JuecXLTEUGtzd1GmI9CENPAklCauX
+tNOWeTop27djuKWsZxuP1GyV6UYixFVOSWteyAbA32cncVv/2ZUAEQEAAYkEcgQY
+AQgAJhYhBK4/rHlnEexZ/AB6pHS7a5pMuz04BQJcW1VuAhsCBQkDvSEAAkAJEHS7
+a5pMuz04wXQgBBkBCAAdFiEEFWiQaF6g32oTce8gF8xdsfAIhAcFAlxbVW4ACgkQ
+F8xdsfAIhAd4jxAAiO9+VRQQ3eBOsJRgANdgL/l51kq7qE3u8xnSqNkrmdYDdT2H
+TYH5W4n2AmGo50BDafdjd6tut0qtzA3/hGWCooydxKFOsnIYziUeoHvlICj3RkHO
+y7utcFhAgRWi+kzFwnnXGf13dMU9iG7yvKrCrCEw44gzoQ1KnY1Xsj18n5JkqxeT
+94bzcSbz20OpOSIMfSQPrpy18WrZYwHodcIZ3IUUACCpMZdfTa9c/qHRQ/rcwl+B
+0JlHx0V4AYiSAsiMVgflO1Eqi7apPuwxPPd5nnHkrdDM9CYC3LdBORBXwncG3oZ5
+eTSXmsvFxHXH41JHsm/1QFcVmFAYhu9qJFCGiD+8UeTFtT+nnHU69BszgtUskqX8
+k9PqLdK7Vxkp16wc6WOp1NeIQ6Fd4PxTGrPqs9bJk7TlYtTFWpA0X+EMj/San+Ku
+PxqLEa4Ab12R4vs1pCrn/g1z3C/6ujH4B70HOrRTIeTjULJ6xdwXGtwUA09hio0r
+pHhtyZhAh5irUJNto4ZOk/Qyd+dfMsNvRJfbVIK2mmeRaBnp902AsQNgYVdi2Aki
+0h4kz3bVLGw7iD/xV2hV69+JwLSijkkmOpz/EjMwj0hDDYrHH3Y3o0dV3dNdk/5i
+6lQgcxSVsl9kWlHcoEllKbf0Hb1muKVwoGGYxFYna2jsLFVjG29M7iPSgrHjmg/+
+I3fmsLZ0VI9kmxniUlZ6gz5NB5PJ3RXmwKO9LkBgE5C1wpuZbNEQ1NsR2bprlJPm
++GNSo8HaheuTRJn42kkOgfIJwjuvXih3FE/NtRA/W8H2uF6YLDjBKGZJbxQcmsd
+CTEuCRCVP8X7C5n3rl1YqzfWfNr8QFxvH7ivG7KOlSxvyTKcYatWb9uDUPrnr74f
+ZaMljHGsNyKj70MzZcrrsmt61yWGR0h+02rmIKlskl4hkh+qF5ehI+Bkd7eblsBy
+rxEREHq/ij2Vd7l0Z606YCE8vj8WfcsJj8JjwR3A+nND/oNJTTbQ3b8OvasvqIey
+WqqmGg73nbHjd/VIAUsfvnsEYatDk4pAA/wQr9c4T4s5Q/QRwDrAsa4J89FrDjWC
+hQBPL7TaP8Af/3Y3/86jLCN4lnW1qjPXv5rhBFeI0EVi1k1qdV06qr5HOk7CwQTT
+uc4rCdFcEnw8kVKZa/yFnlJfRa0Z4IwSahdp5fdFEuad6LpOcFFnYxWtIWhcg4GT
+RcMha/OZnsfqOqiAt6In+1IwuJBz3uMM7xw2AMaxzAejGEL63F81C5iJ6Ld6kQK+
+XblDW0G643bVbzkBb46MAT+UnLuWQUs3NDtk1FEioJyWUgbO/srMH4MoWM7rG8ZT
+nQPohNmPBrqL2phmE27HQsQ0rTjH2Z2ol7iy9OFMtT0=
+=MkGo
+-----END PGP PUBLIC KEY BLOCK-----
--- a/makefile-replace-libs.py
+++ b/makefile-replace-libs.py
@ -0,0 +1,143 @@
+#!/usr/bin/python3
+#
+# Makefile modificator
+#
+# Should help in building bin/tests/system tests standalone,
+# linked to libraries installed into the system.
+# TODO:
+# - Fix top_srcdir, because dyndb/driver/Makefile uses $TOPSRC/mkinstalldirs
+# - Fix conf.sh to contain paths to system tools
+# - Export $TOP/version somewhere, where it would be used
+# - system tests needs bin/tests code. Do not include just bin/tests/system
+#
+# Possible solution:
+#
+# sed -e 's/$TOP\/s\?bin\/\(delv\|confgen\|named\|nsupdate\|pkcs11\|python\|rndc\|check\|dig\|dnssec\|tools\)\/\([[:alnum:]-]\+\)/`type -p \2`/' conf.sh
+# sed -e 's,../../../../\(isc-config.sh\),\1,' builtin/tests.sh
+# or use: $NAMED -V | head -1 | cut -d ' ' -f 2
+
+import re
+import argparse
+
+"""
+Script for replacing Makefile ISC_INCLUDES with runtime flags.
+
+Should translate part of Makefile to use isc-config.sh instead static linked sources.
+ISC_INCLUDES = -I/home/pemensik/rhel/bind/bind-9.11.12/build/lib/isc/include \
+        -I${top_srcdir}/lib/isc \
+        -I${top_srcdir}/lib/isc/include \
+        -I${top_srcdir}/lib/isc/unix/include \
+        -I${top_srcdir}/lib/isc/pthreads/include \
+        -I${top_srcdir}/lib/isc/x86_32/include
+
+Should be translated to:
+ISC_INCLUDES = $(shell isc-config.sh --cflags isc)
+"""
+
+def isc_config(mode, lib):
+    if mode:
+        return '$(shell isc-config.sh {mode} {lib})'.format(mode=mode, lib=lib)
+    else:
+        return ''
+
+def check_match(match, debug=False):
+    """
+    Check this definition is handled by internal library
+    """
+    if not match:
+        return False
+    lib = match.group(2).lower()
+    ok = not lib_filter or lib in lib_filter
+    if debug:
+        print('{status} {lib}: {text}'.format(status=ok, lib=lib, text=match.group(1)))
+    return ok
+
+def fix_line(match, mode):
+    lib = match.group(2).lower()
+    return match.group(1)+isc_config(mode, lib)+"\n"
+
+def fix_file_lines(path, debug=False):
+    """
+    Opens file and scans fixes selected parameters
+
+    Returns list of lines if something should be changed,
+    None if no action is required
+    """
+    fixed = []
+    changed = False
+    with open(path, 'r') as fin:
+        fout = None
+
+        line = next(fin, None)
+        while line:
+            appended = False
+            while line.endswith("\\\n"):
+                line += next(fin, None)
+
+            inc = re_includes.match(line)
+            deplibs = re_deplibs.match(line)
+            libs = re_libs.match(line)
+            newline = None
+            if check_match(inc, debug=debug):
+                newline = fix_line(inc, '--cflags')
+            elif check_match(deplibs, debug=debug):
+                newline = fix_line(libs, None)
+            elif check_match(libs, debug=debug):
+                newline = fix_line(libs, '--libs')
+
+            if newline and line != newline:
+                changed = True
+                line = newline
+
+            fixed.append(line)
+            line = next(fin, None)
+
+    if not changed:
+        return None
+    else:
+        return fixed
+
+def write_lines(path, lines):
+    fout = open(path, 'w')
+    for line in lines:
+        fout.write(line)
+    fout.close()
+
+def print_lines(lines):
+    for line in lines:
+        print(line, end='')
+
+if __name__ == '__main__':
+    parser = argparse.ArgumentParser(description='Makefile multiline include replacer')
+    parser.add_argument('files', nargs='+')
+    parser.add_argument('--filter', type=str,
+            default='isc isccc isccfg dns lwres bind9 irs',
+            help='List of libraries supported by isc-config.sh')
+    parser.add_argument('--check', action='store_true',
+            help='Test file only')
+    parser.add_argument('--print', action='store_true',
+            help='Print changed file only')
+    parser.add_argument('--debug', action='store_true',
+            help='Enable debug outputs')
+
+    args = parser.parse_args()
+    lib_filter = None
+
+    re_includes = re.compile(r'^\s*((\w+)_INCLUDES\s+=\s*).*')
+    re_deplibs = re.compile(r'^\s*((\w+)DEPLIBS\s*=).*')
+    re_libs = re.compile(r'^\s*((\w+)LIBS\s*=).*')
+
+    if args.filter:
+        lib_filter = set(args.filter.split(' '))
+        pass
+
+    for path in args.files:
+        lines = fix_file_lines(path, debug=args.debug)
+        if lines:
+            if args.print:
+                print_lines(lines)
+            elif not args.check:
+                write_lines(path, lines)
+                print('File {path} was fixed'.format(path=path))
+        else:
+            print('File {path} does not need fixing'.format(path=path))
--- a/named-chroot.files
+++ b/named-chroot.files
@ -16,6 +16,7 @@
 /etc/named
 /usr/lib64/bind
 /usr/lib/bind
+/usr/share/GeoIP
 /run/named
 # Warning: the order is important
 # If a directory containing $ROOTDIR is listed here,
--- a/named-chroot.service
+++ b/named-chroot.service
@ -20,7 +20,7 @@ PIDFile=/var/named/chroot/run/named/named.pid
 ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf -t /var/named/chroot -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
 ExecStart=/usr/sbin/named -u named -c ${NAMEDCONF} -t /var/named/chroot $OPTIONS

-ExecReload=/bin/sh -c '/usr/sbin/rndc reload > /dev/null 2>&1 || /bin/kill -HUP $MAINPID'
+ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'

 ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'

--- a/named-pkcs11.service
+++ b/named-pkcs11.service
@ -16,7 +16,7 @@ PIDFile=/run/named/named.pid
 ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
 ExecStart=/usr/sbin/named-pkcs11 -u named -c ${NAMEDCONF} $OPTIONS

-ExecReload=/bin/sh -c '/usr/sbin/rndc reload > /dev/null 2>&1 || /bin/kill -HUP $MAINPID'
+ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'

 ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'

--- a/named-sdb-chroot.service
+++ b/named-sdb-chroot.service
@ -20,7 +20,7 @@ PIDFile=/var/named/chroot_sdb/run/named/named.pid
 ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf -t /var/named/chroot_sdb -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
 ExecStart=/usr/sbin/named-sdb -u named -c ${NAMEDCONF} -t /var/named/chroot_sdb $OPTIONS

-ExecReload=/bin/sh -c '/usr/sbin/rndc reload > /dev/null 2>&1 || /bin/kill -HUP $MAINPID'
+ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'

 ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'

--- a/named-sdb.service
+++ b/named-sdb.service
@ -16,7 +16,7 @@ PIDFile=/run/named/named.pid
 ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
 ExecStart=/usr/sbin/named-sdb -u named -c ${NAMEDCONF} $OPTIONS

-ExecReload=/bin/sh -c '/usr/sbin/rndc reload > /dev/null 2>&1 || /bin/kill -HUP $MAINPID'
+ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'

 ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'

--- a/named.conf
+++ b/named.conf
@ -34,6 +34,7 @@ options {
 	dnssec-validation yes;

 	managed-keys-directory "/var/named/dynamic";
+	geoip-directory "/usr/share/GeoIP";

 	pid-file "/run/named/named.pid";
 	session-keyfile "/run/named/session.key";
--- a/named.empty
+++ b/named.empty
@ -1,8 +1,10 @@
-$TTL 1D
-@	IN SOA	localhost. root.localhost. (
-						0	; serial
-						3H	; refresh
-						1H	; retry
-						1W	; expire
-						3H )	; minimum
-	IN	NS	localhost.
+$TTL 3H
+@	IN SOA	@ rname.invalid. (
+					0	; serial
+					1D	; refresh
+					1H	; retry
+					1W	; expire
+					3H )	; minimum
+	NS	@
+	A	127.0.0.1
+	AAAA	::1
--- a/named.localhost
+++ b/named.localhost
@ -0,0 +1,10 @@
+$TTL 1D
+@	IN SOA	@ rname.invalid. (
+					0	; serial
+					1D	; refresh
+					1H	; retry
+					1W	; expire
+					3H )	; minimum
+	NS	@
+	A	127.0.0.1
+	AAAA	::1
--- a/named.loopback
+++ b/named.loopback
@ -0,0 +1,11 @@
+$TTL 1D
+@	IN SOA	@ rname.invalid. (
+					0	; serial
+					1D	; refresh
+					1H	; retry
+					1W	; expire
+					3H )	; minimum
+	NS	@
+	A	127.0.0.1
+	AAAA	::1
+	PTR	localhost.
--- a/named.rfc1912.zones
+++ b/named.rfc1912.zones
@ -0,0 +1,45 @@
+// named.rfc1912.zones:
+//
+// Provided by Red Hat caching-nameserver package 
+//
+// ISC BIND named zone configuration for zones recommended by
+// RFC 1912 section 4.1 : localhost TLDs and address zones
+// and https://tools.ietf.org/html/rfc6303
+// (c)2007 R W Franks
+// 
+// See /usr/share/doc/bind*/sample/ for example named configuration files.
+//
+// Note: empty-zones-enable yes; option is default.
+// If private ranges should be forwarded, add 
+// disable-empty-zone "."; into options
+// 
+
+zone "localhost.localdomain" IN {
+	type master;
+	file "named.localhost";
+	allow-update { none; };
+};
+
+zone "localhost" IN {
+	type master;
+	file "named.localhost";
+	allow-update { none; };
+};
+
+zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" IN {
+	type master;
+	file "named.loopback";
+	allow-update { none; };
+};
+
+zone "1.0.0.127.in-addr.arpa" IN {
+	type master;
+	file "named.loopback";
+	allow-update { none; };
+};
+
+zone "0.in-addr.arpa" IN {
+	type master;
+	file "named.empty";
+	allow-update { none; };
+};
--- a/named.root
+++ b/named.root
@ -0,0 +1,61 @@
+
+; <<>> DiG 9.11.3-RedHat-9.11.3-3.fc27 <<>> +bufsize=1200 +norec @a.root-servers.net
+; (2 servers found)
+;; global options: +cmd
+;; Got answer:
+;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 46900
+;; flags: qr aa; QUERY: 1, ANSWER: 13, AUTHORITY: 0, ADDITIONAL: 27
+
+;; OPT PSEUDOSECTION:
+; EDNS: version: 0, flags:; udp: 1472
+;; QUESTION SECTION:
+;.				IN	NS
+
+;; ANSWER SECTION:
+.			518400	IN	NS	a.root-servers.net.
+.			518400	IN	NS	b.root-servers.net.
+.			518400	IN	NS	c.root-servers.net.
+.			518400	IN	NS	d.root-servers.net.
+.			518400	IN	NS	e.root-servers.net.
+.			518400	IN	NS	f.root-servers.net.
+.			518400	IN	NS	g.root-servers.net.
+.			518400	IN	NS	h.root-servers.net.
+.			518400	IN	NS	i.root-servers.net.
+.			518400	IN	NS	j.root-servers.net.
+.			518400	IN	NS	k.root-servers.net.
+.			518400	IN	NS	l.root-servers.net.
+.			518400	IN	NS	m.root-servers.net.
+
+;; ADDITIONAL SECTION:
+a.root-servers.net.	518400	IN	A	198.41.0.4
+b.root-servers.net.	518400	IN	A	199.9.14.201
+c.root-servers.net.	518400	IN	A	192.33.4.12
+d.root-servers.net.	518400	IN	A	199.7.91.13
+e.root-servers.net.	518400	IN	A	192.203.230.10
+f.root-servers.net.	518400	IN	A	192.5.5.241
+g.root-servers.net.	518400	IN	A	192.112.36.4
+h.root-servers.net.	518400	IN	A	198.97.190.53
+i.root-servers.net.	518400	IN	A	192.36.148.17
+j.root-servers.net.	518400	IN	A	192.58.128.30
+k.root-servers.net.	518400	IN	A	193.0.14.129
+l.root-servers.net.	518400	IN	A	199.7.83.42
+m.root-servers.net.	518400	IN	A	202.12.27.33
+a.root-servers.net.	518400	IN	AAAA	2001:503:ba3e::2:30
+b.root-servers.net.	518400	IN	AAAA	2001:500:200::b
+c.root-servers.net.	518400	IN	AAAA	2001:500:2::c
+d.root-servers.net.	518400	IN	AAAA	2001:500:2d::d
+e.root-servers.net.	518400	IN	AAAA	2001:500:a8::e
+f.root-servers.net.	518400	IN	AAAA	2001:500:2f::f
+g.root-servers.net.	518400	IN	AAAA	2001:500:12::d0d
+h.root-servers.net.	518400	IN	AAAA	2001:500:1::53
+i.root-servers.net.	518400	IN	AAAA	2001:7fe::53
+j.root-servers.net.	518400	IN	AAAA	2001:503:c27::2:30
+k.root-servers.net.	518400	IN	AAAA	2001:7fd::1
+l.root-servers.net.	518400	IN	AAAA	2001:500:9f::42
+m.root-servers.net.	518400	IN	AAAA	2001:dc3::35
+
+;; Query time: 24 msec
+;; SERVER: 198.41.0.4#53(198.41.0.4)
+;; WHEN: Thu Apr 05 15:57:34 CEST 2018
+;; MSG SIZE  rcvd: 811
+
--- a/named.root.key
+++ b/named.root.key
@ -0,0 +1,19 @@
+managed-keys {
+        # ROOT KEYS: See https://data.iana.org/root-anchors/root-anchors.xml
+        # for current trust anchor information.
+        #
+        # This key (20326) was published in the root zone in 2017.
+        # Servers which were already using the old key (19036) should
+        # roll seamlessly to this new one via RFC 5011 rollover. Servers
+        # being set up for the first time can use the contents of this
+        # file as initializing keys; thereafter, the keys in the
+        # managed key database will be trusted and maintained
+        # automatically.
+        . initial-key 257 3 8 "AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3
+                +/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kv
+                ArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF
+                0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+e
+                oZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfd
+                RUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwN
+                R1AkUTV74bU=";
+};
--- a/named.service
+++ b/named.service
@ -15,8 +15,7 @@ PIDFile=/run/named/named.pid

 ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
 ExecStart=/usr/sbin/named -u named -c ${NAMEDCONF} $OPTIONS
-
-ExecReload=/bin/sh -c '/usr/sbin/rndc reload > /dev/null 2>&1 || /bin/kill -HUP $MAINPID'
+ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'

 ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'

--- a/4
+++ b/4
@ -1,2 +1,2 @@
-SHA512 (bind-9.11.6-P1.tar.gz) = 419aeeddeab7aef818b9043db7b21a847993444f663dca04e58ee97a0ebee0610cbc5a9422d17a6f0ee5d44598a2cbb5651e3b4e8c56708eaf923dca0a5c4c03
-SHA512 (config-19.tar.bz2) = 36aa38a0c7c33267ae594b31c81681290ac58dde7ca6749bd599da531380b5b1428330813dbe983e01071ccaed83e83f6a9cd92179a53b7d0ccbb6851a0b017c
+SHA512 (bind-9.11.14.tar.gz) = fc7729e780e44c3c4e50059032fdae2af3d0e07b492b5088b2fefc15354829d3c9a83fab4f2ecaa9323cd7a37b1f7eb94890c149ba1df5c4fbea7a145095cbe9
+SHA512 (bind-9.11.14.tar.gz.asc) = fd28a1ebd4adf8c2854de434cc6f5f4d47d982eaad73fbb42dce8df97f7b069feb6e7c374178e203a07fff83f2cd021dfd10fb77dd6e8c5201ee4d299df98b89
--- a/tests/Master-server-chrooted/PURPOSE
+++ b/tests/Master-server-chrooted/PURPOSE
@ -1,3 +1,6 @@
 PURPOSE of /CoreOS/tests/Sanity/Master-server-chrooted
 Description: Run basic empty named-chroot service and try to resolve localhost on it
 Author: Petr Mensik <pemensik@redhat.com>
+
+Check also clean package both when running and finished.
+https://bugzilla.redhat.com/show_bug.cgi?id=1592873
--- a/tests/Master-server-chrooted/runtest.sh
+++ b/tests/Master-server-chrooted/runtest.sh
@ -34,10 +34,13 @@ PACKAGE="bind"
 test_service()
 {
    local SERVICE="$1"
+    local PACKAGE="$2"
 	rlRun "rlServiceStart $SERVICE"
 	rlRun "dig @localhost localhost | grep '^localhost'"
 	rlRun "dig @localhost -x 127.0.0.1 | grep 'PTR[[:space:]]\+localhost.$'" 0 "Reverse address works"
+	rlRun "rpm -V $PACKAGE" 0 "Checking $SERVICE package when running"
 	rlRun "rlServiceRestore $SERVICE"
+	rlRun "rpm -V $PACKAGE" 0 "Checking $SERVICE package when stopped"
 }

 rlJournalStart
@ -48,16 +51,16 @@ rlJournalStart
    rlPhaseEnd

    rlPhaseStartTest "Testing named"
-    	test_service named
+	test_service named bind
    rlPhaseEnd

    rlPhaseStartTest "Testing named-chroot"
-    	test_service named-chroot
+	test_service named-chroot bind-chroot
    rlPhaseEnd

    rlPhaseStartTest "Testing named-sdb-chroot"
 	    if rpm -q bind-sdb-chroot; then
-		test_service named-sdb-chroot
+		test_service named-sdb-chroot bind-sdb-chroot
 	    else
 		rlLog "bind-sdb-chroot not installed, skipping it"
 	    fi
--- a/tests/Run-internal-BIND-test-suite/Makefile
+++ b/tests/Run-internal-BIND-test-suite/Makefile
@ -57,14 +57,17 @@ $(METADATA): Makefile
 	@echo "RunFor:          bind" >> $(METADATA)
 	@echo "Requires:        bind rpm-build bind-utils" >> $(METADATA)
 	@echo "Requires:        perl-Net-DNS perl-Net-DNS-Nameserver" >> $(METADATA)
+	@echo "Requires:        perl-Time-HiRes" >> $(METADATA)
 	@echo "Requires:        bind-pkcs11 bind-pkcs11-utils softhsm" >> $(METADATA)
 	@echo "Requires:        openssl-devel libtool autoconf" >> $(METADATA)
-	@echo "Requires:        libcap-devel libidn-devel libxml2-devel" >> $(METADATA) 
-	@echo "Requires:        openldap-devel postgresql-devel" >> $(METADATA)
-	@echo "Requires:        sqlite-devel krb5-devel net-tools" >> $(METADATA)
+# Try to satisfy all build dependencies from here
+	@echo "Requires:        bind-devel" >> $(METADATA)
+	@echo "Requires:        net-tools" >> $(METADATA)
 	@echo "Requires:        dnf-utils" >> $(METADATA)
-	@echo "Requires:        kyua libatf-c" >> $(METADATA)
-	@echo "Requires:        gcc-c++" >> $(METADATA)
+	@echo "Requires:        kyua" >> $(METADATA)
+	@echo "Requires:        libcmocka-devel" >> $(METADATA)
+# Obsolete, uses cmocka
+#	@echo "Requires:        libatf-c gcc-c++" >> $(METADATA)
 	@echo "Priority:        Normal" >> $(METADATA)
 	@echo "License:         GPLv2" >> $(METADATA)
 	@echo "Confidential:    no" >> $(METADATA)
--- a/tests/Run-internal-BIND-test-suite/runtest.sh
+++ b/tests/Run-internal-BIND-test-suite/runtest.sh
@ -32,6 +32,45 @@

 PACKAGE="bind"

+# Set those variables to n to skip tests on variants
+#DEFAULT_VARIANTS="normal pkcs11 sdb"
+DEFAULT_VARIANTS="normal"
+#TEST_VARIANTS="normal"
+
+#
+# Runs test suite and checks known errors
+# Prepared to be repeated with another variants
+run_testsuite()
+{
+	local RESULT_TEXT="$TMPDIR/test${NAMED_VARIANT}.txt"
+	local FOUNDERROR=`mktemp found-XXXXXXXX.err`
+	local KNOWNERROR=/dev/null
+
+	if [ -f "$ORIG/knownerror${NAMED_VARIANT}.$TAG" ]; then
+		KNOWNERROR=`readlink -f $ORIG/knownerror.$TAG`
+	elif [ -f "$ORIG/knownerror${NAMED_VARIANT}" ]; then
+		KNOWNERROR=`readlink -f $ORIG/knownerror`
+	fi
+
+	# Sometime it can fail. Report just failures that are not known
+        rlRun "make test -j${CORES:-1} &> $RESULT_TEXT" 0-255 "Perform the test."
+        rlRun "grep -C 10 FAIL $RESULT_TEXT" 0-255 "Quickly show the test error (if any)."
+
+	rlRun "$FILTER $RESULT_TEXT" 0 "Showing unsuccessful tests"
+	rlRun "$FILTER -s $RESULT_TEXT > $FOUNDERROR" 0
+	rlRun "ls $KNOWNERROR $FOUNDERROR $RESULT_TEXT" 0 'check if there is needed files'
+	rlLog "`cat $FOUNDERROR`"
+
+	rlAssertLesserOrEqual "Checking number of found errors is in limits" "$(grep '^FAIL' $FOUNDERROR | wc -l)" "$(wc -l <$KNOWNERROR)"
+        cat $FOUNDERROR | while read STATUS TEST ; do
+		if [ "$STATUS" = FAIL ]; then
+			rlRun "grep '$TEST' $KNOWNERROR" 0 "Check $TEST failure is expected"
+		else
+			rlLog "$STATUS $TEST"
+		fi
+        done
+}
+
 rlJournalStart
    rlPhaseStartSetup
        # package assertions
@ -41,9 +80,9 @@ rlJournalStart

 	#pwd
 	ORIG=`pwd`
-	FOUNDERROR=`mktemp`
 	SETUP_SOFTHSM=`readlink -f setup-named-softhsm.sh`
 	FILTER=`readlink -f bind-systest-filter.sh`
+	CORES=`grep 'processor\s*:' /proc/cpuinfo | wc -l`

 	TAG=generic
 	if [ -f /etc/os-release ]; then
@ -51,12 +90,6 @@ rlJournalStart
 		TAG=`(source /etc/os-release && echo ${PLATFORM_ID#platform:})`
 	fi

-	if [ -f "knownerror.$TAG" ]; then
-		KNOWNERROR=`readlink -f knownerror.$TAG`
-	elif [ -f "knownerror" ]; then
-		KNOWNERROR=`readlink -f knownerror`
-	fi
-
        #tempdir
        rlRun "TMPDIR=\`mktemp -d\`" 0 "Creating tmp directory"
        rlRun "pushd $TMPDIR"
@ -70,7 +103,7 @@ rlJournalStart

        # download src rpm
 	if ! ls bind*.src.rpm; then
-		rlRun "dnf --enablerepo='*-source' download bind.src" 0 "Fetch source from repository"
+		rlRun "dnf --enablerepo='*-source' download --source bind" 0 "Fetch source from repository"
 		rlRun "rpm -i bind*.src.rpm"
 	fi
 	
@ -113,34 +146,40 @@ rlJournalStart
 	export LC_ALL=en_US.UTF-8

        rlRun "pushd $BUILD"
-        rlRun "make test &> $TMPDIR/test.txt" 0-255 "Perform the test."
-        rlRun "popd"

-        rlRun "grep -C 10 FAIL $TMPDIR/test.txt" 0-255 "Quickly show the test error (if any)."
+	if echo "${TEST_VARIANTS:-$DEFAULT_VARIANTS}" | grep -q normal; then
+		rlLog "Running normal variant"
+		export NAMED_VARIANT= DNSSEC_VARIANT=
+		run_testsuite
+		rlLog "Finished normal variant"
+	fi
+
+	if echo "${TEST_VARIANTS:-$DEFAULT_VARIANTS}" | grep -q sdb; then
+		rlLog "Running sdb variant"
+		export NAMED_VARIANT=-sdb DNSSEC_VARIANT=
+		run_testsuite
+		rlLog "Finished sdb variant"
+	fi
+
+	if echo "${TEST_VARIANTS:-$DEFAULT_VARIANTS}" | grep -q pkcs11; then
+		rlLog "Running pkcs11 variant"
+		# Unfortunately, PKCS11 variant uses shared key storage
+		# It cannot use more threads for that reason
+		export NAMED_VARIANT=-pkcs11 DNSSEC_VARIANT=-pkcs11
+		CORES=1 run_testsuite
+		rlLog "Finished pkcs11 variant"
+	fi
+
+        rlRun "popd"

        rlRun "./bin/tests/system/ifconfig.sh down" 0 "Remove fake network interfaces."

-
-	#list of failures:
-	rlRun "$FILTER $TMPDIR/test.txt" 0 "Showing unsuccessful tests"
-	rlRun "$FILTER -s $TMPDIR/test.txt > $FOUNDERROR" 0
-	rlRun "ls $KNOWNERROR $FOUNDERROR $TMPDIR/test.txt" 0 'check if there is needed files'
-	rlLog "`cat $FOUNDERROR`"
-
-	rlAssertLesserOrEqual "Checking number of found errors is in limits" "$(grep '^FAIL' $FOUNDERROR | wc -l)" "$(wc -l <$KNOWNERROR)"
-        cat $FOUNDERROR | while read STATUS TEST ; do
-		if [ "$STATUS" = FAIL ]; then
-			rlRun "grep '$TEST' $KNOWNERROR" 0 "Check $TEST failure is expected"
-		else
-			rlLog "$STATUS $TEST"
-		fi
-        done
    rlPhaseEnd

    rlPhaseStartCleanup
-        rlBundleLogs "TEST_LOGS" "$TMPDIR/install.txt" "$TMPDIR/builddeps.txt" "$TMPDIR/build.txt" "$TMPDIR/test.txt"
+        rlBundleLogs "BUILD_LOGS" "$TMPDIR/install.txt" "$TMPDIR/builddeps.txt" "$TMPDIR/build.txt"
+        rlBundleLogs "TEST_LOGS" "$TMPDIR"/test*.txt
        rlRun "popd"
        rlRun "rm -r $TMPDIR" 0 "Removing tmp directory"
-	rlRun "rm -rf $FOUNDERROR"
    rlPhaseEnd
 rlJournalEnd
--- a/tests/tests.yml
+++ b/tests/tests.yml
@ -5,12 +5,7 @@
  - role: standard-test-beakerlib
    tags:
    - classic
-    tests:
-    - Master-server-chrooted
-    - Master-server-not-chrooted
-    required_packages:
-    - bind
-    - bind-chroot
-    - bind-sdb-chroot
-    - redhat-lsb
-    - bind-utils
+    repositories:
+    - repo: "https://github.com/InfrastructureServices/bind-tests.git"
+      dest: "bind-tests"
+      fmf_filter: "tier: 1"
Author	SHA1	Message	Date
Petr Menšík	389eeac3cd	Use CI from master branch Use just the same tests.yml as master. Do not use whole history.	2020-04-14 14:16:41 +02:00
Petr Menšík	f260be7dd6	Fix oot build gen would not compile under oot build	2020-01-06 11:34:32 +01:00
Petr Menšík	22bb34a78f	Include more Thread Sanitizer changes Fix as much race conditions as possible.	2020-01-06 11:34:32 +01:00
Petr Menšík	ee2381e310	Update to 9.11.14 Includes ThreadSanitizer fixes already included as downstream patches. Adjusts serve-stale patch, one new statistics.	2020-01-06 11:34:32 +01:00
Petr Menšík	58f8c59cb1	Add one more candidate for issue fixing Imported from upstream commit 6eed12605154b8ce10e9be0f51253e6ec318550e	2020-01-06 11:34:32 +01:00
Petr Menšík	50f15f4c56	Add ThreadSanitizer support Has to be enabled in build by --with TSAN. Would make build fail unit tests and print many warnings about possible race conditions. Not useful for production build, but useful for debugging thread related problems in system tests.	2020-01-06 11:34:32 +01:00
Petr Menšík	5ca9d90d47	Bump spec for bug #1736762	2019-12-02 21:41:52 +01:00
Petr Menšík	b774c5d4c4	Backport a few upstream thread safety fixes It might not fix all issues, but was detected by upstream using automated tool. Should not break anything new, but might fix issue triggered usually on ppc64le platform.	2019-12-02 21:41:52 +01:00
Petr Menšík	3e7ddcd8f9	Complete explicit disabling of RSAMD5 in FIPS mode (#1709553 ) Previous fix included just part inside named. However, checking part would check algorithm support also in check library. The code is almost the same. Permit already disabled algoritms also in libbind9. Use the same change as RHEL.	2019-11-26 20:20:30 +01:00
Petr Menšík	c4505c5f54	Remove tabs from spec rpmlint complains about mixed spaces and tabs. Set vim mode and remove tabs added by recent commit.	2019-11-26 20:20:30 +01:00
Petr Menšík	e72f4e4ce7	Add source verification on build Include verification on build time, with link to GPG keys on upstream site. Signed-off-by: Petr Menšík <pemensik@redhat.com>	2019-11-26 20:20:30 +01:00
Petr Menšík	ac73aa78f3	Update to 9.11.13 Includes fix for: * CVE-2019-6477 bind: TCP Pipelining doesn't limit TCP clients on a single connection	2019-11-26 20:20:30 +01:00
Petr Menšík	dd1eccb8ef	Remove reload related comments from services Seems systemd already fixes reload return codes. Remove comment from systemd service files.	2019-11-26 20:20:30 +01:00
Petr Menšík	de801506e8	Report error on reload failure (#1739441 ) Return failed status code to command. Not only report error message to the log, but also report reload success. Must not terminate running service on failed reload.	2019-11-26 20:20:30 +01:00
Petr Menšík	56116c1216	Add helper for testing system daemons Modifies already generated Makefiles to link against system libraries, instead of static built artifacts.	2019-11-26 20:20:30 +01:00
Petr Menšík	32dfaf988b	Fix wrong default GeoIP directory (#1768258 )	2019-11-26 20:20:30 +01:00
Petr Menšík	7ae9f7782c	Update chroot test to check RPM verify In bug #1592873, error on chroot was reported. Ensure it does not reappear.	2019-11-26 20:20:30 +01:00
Petr Menšík	06e308431a	Improve SYSTEMTEST running on build time Use parallel execution on test run. Support already configured interfaces without special permissions on build. It can either use already present addresses or configure it on build time. If it has no rights to configure it, just skip the test and continue.	2019-11-26 20:20:30 +01:00
Petr Menšík	c5d2555ae3	Add GeoIP configuration into config file Upstream has wrong default path of GeoIP2. Use it explicitly.	2019-11-26 20:20:30 +01:00
Petr Menšík	ae74ad7013	Remove config archive with zone files Few configuration and zone files were moved into tarball by commit `55b04de09a`. It makes tracking of changes difficult, hardens rebases, makes difficult building without proper lookaside cache. Those files are tiny, no need to hold them inside compressed binary archive. Move them out. Replaces also few places with proper directory macros.	2019-11-26 20:20:30 +01:00
Petr Menšík	bf6ee26309	Adjust patches to 9.11.12 Few changes occured, remove one upstream applied patch.	2019-11-26 20:20:30 +01:00
Petr Menšík	8632dab80a	Update to 9.11.12 (#1557762 )	2019-11-26 20:20:30 +01:00
Petr Menšík	8259847d33	Adjust downstream patches to 9.11.11	2019-09-26 17:33:36 +02:00
Petr Menšík	8fd9eb990f	Update to 9.11.11 - Interaction between DNS64 and RPZ No Data rule (CNAME *.) could cause unexpected results; this has been fixed. [GL #1106] - named-checkconf now checks DNS64 prefixes to ensure bits 64-71 are zero. [GL #1159] - named-checkconf could crash during configuration if configured to use "geoip continent" ACLs with legacy GeoIP. [GL #1163] - named-checkconf now correctly reports missing dnstap-output option when dnstap is set. [GL #1136 - Handle ETIMEDOUT error on connect() with a non-blocking socket. [GL #1133]	2019-09-26 17:33:36 +02:00
Petr Menšík	730f052905	Use just normal variant by default Testing takes quite long. For now, use by default only normal variant. SDB variant is not much used and pkcs11 variant is failing now. Keep ability to enable variants by parameter: TEST_VARIANTS="normal sdb pkcs11"	2019-09-26 17:33:36 +02:00
Petr Menšík	a4a464984e	Add internal test suite to set of tests	2019-09-26 17:33:36 +02:00
Petr Menšík	d26ba37ec9	Update and simplify package requirements bind-devel should now provide all dependencies required. Omit explicitl requirements for building. Drop atf building support, since upstream moved to cmocka.	2019-09-26 17:33:36 +02:00
Petr Menšík	5110c5b011	Use also termination logs to measure time Might use different approach to display grouped results.	2019-09-26 17:33:36 +02:00
Petr Menšík	ec1d8fb14f	Make tests optional Make it possible to skip some test using parameter. In some cases, just single pass is required. Also fix case when no known defects are specified for a variant.	2019-09-26 17:33:36 +02:00
Petr Menšík	4bb648c19e	Modify test suite to include also variants Run system tests for each variants.	2019-09-26 17:33:36 +02:00
Petr Menšík	b95c9e042f	Precise timing perl package is required	2019-09-26 17:33:36 +02:00
Petr Menšík	4a22ca2122	Fix source fetching	2019-09-26 17:33:36 +02:00
Petr Menšík	aa3e9e47d8	Do not skip gsstsig test in any named variants Feature was skipped by mistake when moving feature-test into separate directory.	2019-09-26 17:32:59 +02:00
Petr Menšík	dbf171bc06	Share pkcs11-utils and dnssec-utils manuals Previous build recommended bind-dnssec-utils just to provide manual for pkcs11 variants. Instead, share the same files between pkcs11-utils and dnssec-utils. Skip unnecessary manual of non-existent dnssec-coverage-pkcs11 tool.	2019-09-26 17:32:39 +02:00
Petr Menšík	a2a1e000c5	Add GeoIP to bind-chroot (#1497646 ) named can use ACLs defined by GeoIP of request. Such information is not available by default under named-chroot service. Enable GeoIP databases under chroot without explicit configuration.	2019-09-26 17:31:06 +02:00
Petr Menšík	6c5cdca7f8	Move created empty directories to single define Make it easier to manage list of used directories in chroot. Use appropriate macros for system directories everywhere in chroot package. Share common variable with -sdb-chroot and -chroot packages.	2019-09-26 17:30:43 +02:00
Petr Menšík	24eefb0147	Move some administration utilities back to utils (#1720380 ) Some utilities are not related DNSSEC at all, but are just bind related tools. Because they do not require additional dependencies, they do not save any space in containers.	2019-09-26 17:22:21 +02:00
Petr Menšík	8b8b3e97d6	Avoid conflicts between OpenSSL and native PKCS#11 Do not set default engine when native module should be used.	2019-08-28 20:04:17 +02:00
Petr Menšík	290a5eb9ab	Fix broken pkcs11 initialization Broken by commit `2a466330c5`	2019-08-28 20:04:17 +02:00
Petr Menšík	4e4f8c8518	Fix broken system/tsig test On rebases, md5 keys were accidentally dropped. Put them back.	2019-08-28 20:04:17 +02:00
Petr Menšík	00db7f45fd	Update patches to 9.11.10	2019-08-28 20:04:17 +02:00
Petr Menšík	aca3c550fd	Update to BIND 9.11.10	2019-08-28 20:04:14 +02:00
Petr Menšík	a815d5ceb5	Add changelog and bump spec	2019-08-28 20:03:21 +02:00
Petr Menšík	4378f987b4	Report errors from rndc reload (#1739441 ) Success status has to be ignored until systemd is fixed. Now it would kill service on reload failure, which is far worse than reload error.	2019-08-28 20:03:21 +02:00
Petr Menšík	ff25a45a41	Fix rpmlint warnings Clean whitespace to satisfy rpmlint	2019-08-28 20:03:21 +02:00
Petr Menšík	b40bc8c8c4	Permit explicit disabling of RSAMD5 in FIPS mode (#1709553 ) When MD5 is disabled in library, it behaved like RSAMD5 were unknown. But security-policy disables it explicitly. It failed to even start in FIPS mode, because such algorithm were unknown. Fix disabled algorithm to return disabled result code. Accept such algorithm only when disabling it. Signed-off-by: Petr Menšík <pemensik@redhat.com>	2019-08-28 20:03:21 +02:00
Petr Menšík	ed5314b647	Solve conflicting jsoncpp-devel and json-c-devel	2019-07-30 15:52:32 +02:00
Petr Menšík	af22b4c836	Update patches to 9.11.9 Maxmind library and defines modifies many patches changing flags. Conflicts a lot especially with PKCS11 build.	2019-07-30 15:52:32 +02:00
Petr Menšík	30676f9c5f	Update to 9.11.9	2019-07-30 15:52:32 +02:00
Petr Menšík	cf411e66ff	Use monotonic time in export library (#1732883 ) Signed-off-by: Petr Menšík <pemensik@redhat.com>	2019-07-24 17:30:34 +02:00
Petr Menšík	aea6801444	Update to 9.11.8 Contains: 5244. [security] Fixed a race condition in dns_dispatch_getnext() that could cause an assertion failure if a significant number of incoming packets were rejected. (CVE-2019-6471) [GL #942] 5241. [bug] Fix Ed448 private and public key ASN.1 prefix blobs. [GL #225] 5237. [bug] Recurse to find the root server list with 'dig +trace'. [GL #1028]	2019-07-17 12:08:23 +02:00
Petr Menšík	d032099ab8	Fix libisc so version	2019-07-17 12:06:51 +02:00
Petr Menšík	7729230caf	Fix OpenSSL random generator initialization Also fix warning in test.	2019-07-17 12:06:25 +02:00
Petr Menšík	6402a7906b	Update patches to new sources Modify current and remove already merged patches. Adjust versions of so libs.	2019-07-17 12:03:35 +02:00
Petr Menšík	efad4ae8c3	Merge branch 'master' into f30	2019-05-06 14:09:00 +02:00
Petr Menšík	b51b7b6266	Merge branch 'master' into f30	2019-05-06 13:08:33 +02:00
Petr Menšík	36d37531c9	Revert "Enable optional features by default" This reverts commit `ae423dfbeb`.	2019-05-03 12:51:18 +02:00