Update to 9.11.22

https://downloads.isc.org/isc/bind9/9.11.22/RELEASE-NOTES-bind-9.11.22.html (cherry picked from commit 745f43ac05)
Update to 9.11.21
2020-08-21 19:14:19 +02:00 · 2020-07-17 11:27:15 +02:00 · 2020-06-17 22:58:40 +02:00 · 2020-05-25 23:16:40 +02:00 · 2020-05-25 23:16:40 +02:00 · 2020-05-25 23:16:40 +02:00
38 changed files with 1274 additions and 774 deletions
--- a/.gitignore
+++ b/.gitignore
@ -97,3 +97,20 @@ bind-9.7.2b1.tar.gz
 /bind-9.11.9.tar.gz
 /bind-9.11.10.tar.gz
 /bind-9.11.11.tar.gz
+/bind-9.11.12.tar.gz
+/bind-9.11.13.tar.gz
+/bind-9.11.13.tar.gz.asc
+/bind-9.11.14.tar.gz
+/bind-9.11.14.tar.gz.asc
+/bind-9.11.17.tar.gz
+/bind-9.11.17.tar.gz.asc
+/bind-9.11.18.tar.gz
+/bind-9.11.18.tar.gz.asc
+/bind-9.11.19.tar.gz
+/bind-9.11.19.tar.gz.asc
+/bind-9.11.20.tar.gz
+/bind-9.11.20.tar.gz.asc
+/bind-9.11.21.tar.gz
+/bind-9.11.21.tar.gz.asc
+/bind-9.11.22.tar.gz
+/bind-9.11.22.tar.gz.asc
--- a/bind-9.10-sdb-sqlite-bld.patch
+++ b/bind-9.10-sdb-sqlite-bld.patch
@ -1,53 +0,0 @@
-diff --git a/bin/named-sdb/Makefile.in b/bin/named-sdb/Makefile.in
-index 1894830..445182a 100644
--- a/bin/named-sdb/Makefile.in
-+++ b/bin/named-sdb/Makefile.in
-@@ -34,10 +34,10 @@ top_srcdir =	@top_srcdir@
- #
- # Add database drivers here.
- #
-DBDRIVER_OBJS =	ldapdb.@O@ pgsqldb.@O@ dirdb.@O@
-DBDRIVER_SRCS =	ldapdb.c pgsqldb.c dirdb.c
-+DBDRIVER_OBJS =	ldapdb.@O@ pgsqldb.@O@ sqlitedb.@O@ dirdb.@O@
-+DBDRIVER_SRCS =	ldapdb.c pgsqldb.c sqlitedb.c dirdb.c
- DBDRIVER_INCLUDES =
-DBDRIVER_LIBS =	-lldap -llber -lpq
-+DBDRIVER_LIBS =	-lldap -llber -lsqlite3 -lpq
- 
- DLZ_DRIVER_DIR =	${top_srcdir}/contrib/dlz/drivers
- 
-diff --git a/bin/sdb_tools/Makefile.in b/bin/sdb_tools/Makefile.in
-index 7f3c5e2..b1bca66 100644
--- a/bin/sdb_tools/Makefile.in
-+++ b/bin/sdb_tools/Makefile.in
-@@ -32,11 +32,11 @@ DEPLIBS =	${LWRESDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
- LIBS =		${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
- 		${ISCCFGLIBS} ${ISCCCLIBS} ${ISCLIBS} ${DBDRIVER_LIBS} @LIBS@
- 
-TARGETS =	zone2ldap@EXEEXT@ zonetodb@EXEEXT@
-+TARGETS =	zone2ldap@EXEEXT@ zonetodb@EXEEXT@ zone2sqlite@EXEEXT@
- 
-OBJS	=	zone2ldap.@O@ zonetodb.@O@
-+OBJS	=	zone2ldap.@O@ zonetodb.@O@ zone2sqlite.@O@
- 
-SRCS    =       zone2ldap.c zonetodb.c
-+SRCS    =       zone2ldap.c zonetodb.c zone2sqlite.c
- 
- MANPAGES =      zone2ldap.1
- 
-@@ -50,6 +50,9 @@ zone2ldap@EXEEXT@: zone2ldap.@O@ ${DEPLIBS}
- zonetodb@EXEEXT@: zonetodb.@O@  ${DEPLIBS}
- 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ zonetodb.@O@ -lpq ${LIBS}
- 
-+zone2sqlite@EXEEXT@: zone2sqlite.@O@  ${DEPLIBS}
-+	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${ALL_CFLAGS} ${LDFLAGS} -o $@ zone2sqlite.@O@ -lsqlite3 -lssl ${LIBS}
-+
- clean distclean manclean maintainer-clean::
- 	rm -f ${TARGETS} ${OBJS}
- 
-@@ -60,4 +63,5 @@ installdirs:
- install:: ${TARGETS} installdirs
- 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zone2ldap@EXEEXT@ ${DESTDIR}${sbindir}
- 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zonetodb@EXEEXT@  ${DESTDIR}${sbindir}
-+	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zone2sqlite@EXEEXT@ ${DESTDIR}${sbindir}
- 	${INSTALL_DATA} ${srcdir}/zone2ldap.1 ${DESTDIR}${mandir}/man1/zone2ldap.1
--- a/bind-9.10-sdb.patch
+++ b/bind-9.10-sdb.patch
@ -88,10 +88,10 @@ index 4cfed4d..c6b42b2 100644
 @DLZ_DRIVER_RULES@
 
 diff --git a/bin/named-sdb/main.c b/bin/named-sdb/main.c
-index 108b8d6..a943421 100644
+index c9fc3cc..148ebb3 100644
 --- a/bin/named-sdb/main.c
 +++ b/bin/named-sdb/main.c
-@@ -93,6 +93,10 @@
+@@ -97,6 +97,10 @@
  * Include header files for database drivers here.
  */
 /* #include "xxdb.h" */
@ -102,7 +102,7 @@ index 108b8d6..a943421 100644
 
 #ifdef CONTRIB_DLZ
 /*
-@@ -1069,6 +1073,11 @@ setup(void) {
+@@ -1134,6 +1138,11 @@ setup(void) {
 		ns_main_earlyfatal("isc_app_start() failed: %s",
 				   isc_result_totext(result));
 
@ -114,7 +114,7 @@ index 108b8d6..a943421 100644
 	isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
 		      ISC_LOG_NOTICE, "starting %s %s%s%s <id:%s>",
 		      ns_g_product, ns_g_version,
-@@ -1269,6 +1278,75 @@ setup(void) {
+@@ -1334,6 +1343,75 @@ setup(void) {
 				   isc_result_totext(result));
 #endif
 
@ -190,7 +190,7 @@ index 108b8d6..a943421 100644
 	ns_server_create(ns_g_mctx, &ns_g_server);
 
 #ifdef HAVE_LIBSECCOMP
-@@ -1311,6 +1389,11 @@ cleanup(void) {
+@@ -1376,6 +1454,11 @@ cleanup(void) {
 
 	dns_name_destroy();
 
@ -297,10 +297,10 @@ index c7e0868..95ab742 100644
 +	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zone2sqlite@EXEEXT@ ${DESTDIR}${sbindir}
 	${INSTALL_DATA} ${srcdir}/zone2ldap.1 ${DESTDIR}${mandir}/man1/zone2ldap.1
 diff --git a/configure.ac b/configure.ac
-index f6380b1..318e533 100644
+index f85f45f..7d28c52 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -5416,6 +5416,8 @@ AC_CONFIG_FILES([
+@@ -5400,6 +5400,8 @@ AC_CONFIG_FILES([
 	bin/named/unix/Makefile
 	bin/named-pkcs11/Makefile
 	bin/named-pkcs11/unix/Makefile
@ -309,9 +309,9 @@ index f6380b1..318e533 100644
 	bin/nsupdate/Makefile
 	bin/pkcs11/Makefile
 	bin/python/Makefile
-@@ -5440,6 +5442,7 @@ AC_CONFIG_FILES([
- 	bin/python/isc/tests/dnskey_test.py
+@@ -5424,6 +5426,7 @@ AC_CONFIG_FILES([
 	bin/python/isc/tests/policy_test.py
+ 	bin/python/isc/utils.py
 	bin/rndc/Makefile
 +	bin/sdb_tools/Makefile
 	bin/tests/Makefile
--- a/bind-9.11-fips-disable.patch
+++ b/bind-9.11-fips-disable.patch
@ -1,4 +1,4 @@
-From df23c869f8973bc9494dcdc86ef46070d8194897 Mon Sep 17 00:00:00 2001
+From 83b889c238282b210f874a3ad81bb56299767495 Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Mon, 5 Aug 2019 11:54:03 +0200
 Subject: [PATCH] Allow explicit disabling of autodisabled MD5
@ -9,15 +9,22 @@ RSAMD5 is included in security policy, it fails to start, because that
 algorithm is not recognized. Allow it disabled, but fail on any
 other usage.
 ---
- bin/named/server.c |  2 +-
- lib/dns/rcode.c    | 31 +++++++++++++------------------
- 2 files changed, 14 insertions(+), 19 deletions(-)
+ bin/named/server.c |  4 ++--
+ lib/bind9/check.c  |  4 ++++
+ lib/dns/rcode.c    | 33 +++++++++++++++------------------
+ 3 files changed, 21 insertions(+), 20 deletions(-)

 diff --git a/bin/named/server.c b/bin/named/server.c
-index 3cd49a9..ef82d89 100644
+index 5b57371..51702ab 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
-@@ -1551,7 +1551,7 @@ disable_algorithms(const cfg_obj_t *disabled, dns_resolver_t *resolver) {
+@@ -1547,12 +1547,12 @@ disable_algorithms(const cfg_obj_t *disabled, dns_resolver_t *resolver) {
+ 		r.length = strlen(r.base);
+ 
+ 		result = dns_secalg_fromtext(&alg, &r);
+-		if (result != ISC_R_SUCCESS) {
+		if (result != ISC_R_SUCCESS && result != ISC_R_DISABLED) {
+ 			uint8_t ui;
 			result = isc_parse_uint8(&ui, r.base, 10);
 			alg = ui;
 		}
@ -26,8 +33,23 @@ index 3cd49a9..ef82d89 100644
 			cfg_obj_log(cfg_listelt_value(element),
 				    ns_g_lctx, ISC_LOG_ERROR,
 				    "invalid algorithm");
+diff --git a/lib/bind9/check.c b/lib/bind9/check.c
+index e0803d4..8023784 100644
+--- a/lib/bind9/check.c
+++ b/lib/bind9/check.c
+@@ -302,6 +302,10 @@ disabled_algorithms(const cfg_obj_t *disabled, isc_log_t *logctx) {
+ 		r.length = strlen(r.base);
+ 
+ 		tresult = dns_secalg_fromtext(&alg, &r);
+		if (tresult == ISC_R_DISABLED) {
+			// Recognize disabled algorithms, disable it explicitly
+			tresult = ISC_R_SUCCESS;
+		}
+ 		if (tresult != ISC_R_SUCCESS) {
+ 			cfg_obj_log(cfg_listelt_value(element), logctx,
+ 				    ISC_LOG_ERROR, "invalid algorithm '%s'",
 diff --git a/lib/dns/rcode.c b/lib/dns/rcode.c
-index f51d548..8dbb12d 100644
+index f51d548..c49b8d1 100644
 --- a/lib/dns/rcode.c
 +++ b/lib/dns/rcode.c
@@ -126,7 +126,6 @@
@ -46,7 +68,7 @@ index f51d548..8dbb12d 100644
 static struct tbl secprotos[] = { SECPROTONAMES };
 static struct tbl hashalgs[] = { HASHALGNAMES };
 static struct tbl dsdigests[] = { DSDIGESTNAMES };
-@@ -358,33 +358,28 @@ dns_cert_totext(dns_cert_t cert, isc_buffer_t *target) {
+@@ -358,33 +358,30 @@ dns_cert_totext(dns_cert_t cert, isc_buffer_t *target) {
 	return (dns_mnemonic_totext(cert, target, certs));
 }
 
@ -72,14 +94,16 @@ index f51d548..8dbb12d 100644
 -	RETERR(dns_mnemonic_fromtext(&value, source,
 -	                             secalgs_tbl_start(), 0xff));
 +	result = dns_mnemonic_fromtext(&value, source,
-+	                             secalgs, 0xff);
+	                               secalgs, 0xff);
 +	if (result != ISC_R_SUCCESS) {
 +		result = dns_mnemonic_fromtext(&value, source,
-+		                               md5_secalgs, 0xff);
+	                                       md5_secalgs, 0xff);
 +		if (result != ISC_R_SUCCESS) {
 +			return (result);
-+		} else if (!isc_md5_available())
+		} else if (!isc_md5_available()) {
+			*secalgp = value;
 +			return (ISC_R_DISABLED);
+		}
 +	}
 	*secalgp = value;
 	return (ISC_R_SUCCESS);
--- a/bind-9.11-fips-tests.patch
+++ b/bind-9.11-fips-tests.patch
@ -1,4 +1,4 @@
-From c23daf334d5487fa53fef88c82312e439a2d8523 Mon Sep 17 00:00:00 2001
+From da45a97312a63f815b295167c3f3abb9fe8941a3 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 2 Aug 2018 23:46:45 +0200
 Subject: [PATCH] FIPS tests changes
@ -80,7 +80,7 @@ Date:   Wed Mar 7 10:44:23 2018 +0100
 bin/tests/system/digdelv/tests.sh             | 20 +++---
 bin/tests/system/dlv/ns1/sign.sh              |  4 +-
 bin/tests/system/dlv/ns2/sign.sh              |  4 +-
- bin/tests/system/dlv/ns6/sign.sh              | 66 +++++++++---------
+ bin/tests/system/dlv/ns6/sign.sh              | 66 ++++++++++---------
 bin/tests/system/dnssec/ns2/sign.sh           |  8 +--
 bin/tests/system/dnssec/ns5/trusted.conf.bad  |  2 +-
 bin/tests/system/dnssec/tests.sh              |  4 +-
@ -92,18 +92,17 @@ Date:   Wed Mar 7 10:44:23 2018 +0100
 bin/tests/system/nsupdate/ns1/named.conf.in   |  2 +-
 bin/tests/system/nsupdate/ns2/named.conf.in   |  2 +-
 bin/tests/system/nsupdate/setup.sh            |  7 +-
- bin/tests/system/nsupdate/tests.sh            | 11 ++-
+ bin/tests/system/nsupdate/tests.sh            | 11 +++-
 bin/tests/system/rndc/setup.sh                |  2 +-
 bin/tests/system/rndc/tests.sh                | 23 ++++---
- bin/tests/system/tsig/clean.sh                |  1 +
 bin/tests/system/tsig/ns1/named.conf.in       | 10 +--
+ bin/tests/system/tsig/ns1/rndc5.conf.in       | 10 +++
 bin/tests/system/tsig/setup.sh                |  5 ++
- bin/tests/system/tsig/tests.sh                | 67 ++++++++++++-------
+ bin/tests/system/tsig/tests.sh                | 65 +++++++++++-------
 bin/tests/system/tsiggss/setup.sh             |  2 +-
 bin/tests/system/upforwd/ns1/named.conf.in    |  2 +-
 bin/tests/system/upforwd/tests.sh             |  2 +-
- bin/tests/system/tsig/ns1/rndc5.conf.in | 10 +++
- 45 files changed, 232 insertions(+), 171 deletions(-)
+ 44 files changed, 230 insertions(+), 170 deletions(-)
 create mode 100644 bin/tests/system/tsig/ns1/rndc5.conf.in

 diff --git a/bin/tests/system/acl/ns2/named1.conf.in b/bin/tests/system/acl/ns2/named1.conf.in
@ -563,10 +562,10 @@ index 21be03e..e57c308 100644
 };
 
 diff --git a/bin/tests/system/checkconf/good.conf b/bin/tests/system/checkconf/good.conf
-index 9ab35b3..486551a 100644
+index 09d188a..7cf4030 100644
 --- a/bin/tests/system/checkconf/good.conf
 +++ b/bin/tests/system/checkconf/good.conf
-@@ -153,6 +153,6 @@ dyndb "name" "library.so" {
+@@ -159,6 +159,6 @@ dyndb "name" "library.so" {
 	system;
 };
 key "mykey" {
@ -601,10 +600,10 @@ index f4e30f5..9f53e31 100644
 ; TTL of 3 weeks
 weeks		1814400	A	10.53.0.2
 diff --git a/bin/tests/system/digdelv/tests.sh b/bin/tests/system/digdelv/tests.sh
-index ade45ce..d3aff24 100644
+index 3d1010e..fa9eb92 100644
 --- a/bin/tests/system/digdelv/tests.sh
 +++ b/bin/tests/system/digdelv/tests.sh
-@@ -106,7 +106,7 @@ if [ -x "$DIG" ] ; then
+@@ -155,7 +155,7 @@ if [ -x "$DIG" ] ; then
   echo_i "checking dig +rrcomments works for DNSKEY($n)"
   ret=0
   $DIG $DIGOPTS +tcp @10.53.0.3 +rrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1
@ -613,7 +612,7 @@ index ade45ce..d3aff24 100644
   check_ttl_range dig.out.test$n "DNSKEY" 300 || ret=1
   if [ $ret != 0 ]; then echo_i "failed"; fi
   status=`expr $status + $ret`
-@@ -115,7 +115,7 @@ if [ -x "$DIG" ] ; then
+@@ -164,7 +164,7 @@ if [ -x "$DIG" ] ; then
   echo_i "checking dig +short +rrcomments works for DNSKEY ($n)"
   ret=0
   $DIG $DIGOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1
@ -622,7 +621,7 @@ index ade45ce..d3aff24 100644
   if [ $ret != 0 ]; then echo_i "failed"; fi
   status=`expr $status + $ret`
 
-@@ -123,7 +123,7 @@ if [ -x "$DIG" ] ; then
+@@ -172,7 +172,7 @@ if [ -x "$DIG" ] ; then
   echo_i "checking dig +short +nosplit works($n)"
   ret=0
   $DIG $DIGOPTS +tcp @10.53.0.3 +short +nosplit DNSKEY dnskey.example > dig.out.test$n || ret=1
@ -631,7 +630,7 @@ index ade45ce..d3aff24 100644
   if [ $ret != 0 ]; then echo_i "failed"; fi
   status=`expr $status + $ret`
 
-@@ -131,7 +131,7 @@ if [ -x "$DIG" ] ; then
+@@ -180,7 +180,7 @@ if [ -x "$DIG" ] ; then
   echo_i "checking dig +short +rrcomments works($n)"
   ret=0
   $DIG $DIGOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1
@ -640,7 +639,7 @@ index ade45ce..d3aff24 100644
   if [ $ret != 0 ]; then echo_i "failed"; fi
   status=`expr $status + $ret`
 
-@@ -148,7 +148,7 @@ if [ -x "$DIG" ] ; then
+@@ -197,7 +197,7 @@ if [ -x "$DIG" ] ; then
   echo_i "checking dig +short +rrcomments works($n)"
   ret=0
   $DIG $DIGOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1
@ -649,7 +648,7 @@ index ade45ce..d3aff24 100644
   if [ $ret != 0 ]; then echo_i "failed"; fi
   status=`expr $status + $ret`
 
-@@ -695,7 +695,7 @@ if [ -x ${DELV} ] ; then
+@@ -799,7 +799,7 @@ if [ -x ${DELV} ] ; then
   echo_i "checking delv +rrcomments works for DNSKEY($n)"
   ret=0
   $DELV $DELVOPTS +tcp @10.53.0.3 +rrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
@ -658,7 +657,7 @@ index ade45ce..d3aff24 100644
   check_ttl_range delv.out.test$n "DNSKEY" 300 || ret=1
   if [ $ret != 0 ]; then echo_i "failed"; fi
   status=`expr $status + $ret`
-@@ -704,7 +704,7 @@ if [ -x ${DELV} ] ; then
+@@ -808,7 +808,7 @@ if [ -x ${DELV} ] ; then
   echo_i "checking delv +short +rrcomments works for DNSKEY ($n)"
   ret=0
   $DELV $DELVOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
@ -667,7 +666,7 @@ index ade45ce..d3aff24 100644
   if [ $ret != 0 ]; then echo_i "failed"; fi
   status=`expr $status + $ret`
 
-@@ -712,7 +712,7 @@ if [ -x ${DELV} ] ; then
+@@ -816,7 +816,7 @@ if [ -x ${DELV} ] ; then
   echo_i "checking delv +short +rrcomments works ($n)"
   ret=0
   $DELV $DELVOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
@ -676,7 +675,7 @@ index ade45ce..d3aff24 100644
   if [ $ret != 0 ]; then echo_i "failed"; fi
   status=`expr $status + $ret`
 
-@@ -720,7 +720,7 @@ if [ -x ${DELV} ] ; then
+@@ -824,7 +824,7 @@ if [ -x ${DELV} ] ; then
   echo_i "checking delv +short +nosplit works ($n)"
   ret=0
   $DELV $DELVOPTS +tcp @10.53.0.3 +short +nosplit DNSKEY dnskey.example > delv.out.test$n || ret=1
@ -685,7 +684,7 @@ index ade45ce..d3aff24 100644
   if test `wc -l < delv.out.test$n` != 1 ; then ret=1 ; fi
   f=`awk '{print NF}' < delv.out.test$n`
   test "${f:-0}" -eq 14 || ret=1
-@@ -731,7 +731,7 @@ if [ -x ${DELV} ] ; then
+@@ -835,7 +835,7 @@ if [ -x ${DELV} ] ; then
   echo_i "checking delv +short +nosplit +norrcomments works ($n)"
   ret=0
   $DELV $DELVOPTS +tcp @10.53.0.3 +short +nosplit +norrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
@ -912,7 +911,7 @@ index 1e39862..4ed19ac 100755
 cat $infile $keyname1.key $keyname2.key >$zonefile
 
 diff --git a/bin/tests/system/dnssec/ns2/sign.sh b/bin/tests/system/dnssec/ns2/sign.sh
-index 13fb924..1ffa279 100644
+index 7f95c8a..3a9251b 100644
 --- a/bin/tests/system/dnssec/ns2/sign.sh
 +++ b/bin/tests/system/dnssec/ns2/sign.sh
@@ -126,8 +126,8 @@ zone=in-addr.arpa.
@ -956,10 +955,10 @@ index ed30460..e6b1126 100644
 +    "." 256 3 8 "AwEAAarwAdjV4gIhpBCjXVAScRFEx3co7k8smJdxrnqoGsl5NB7EZ9jRdgvCXbJn6v8y9jlNWVHvaC8ilhfhLh0A1vLWiWv4ijd/12xcnrY7xpG7Cu3YkxUxaXJ7Jdg/Iw1+9mGgXF1v4UbCIcw/3U3cxyk7OxYg+VSb5KBAQSR0upxV";
 };
 diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh
-index b31c1b4..a5e237b 100644
+index 6f7eaa7..bd2778b 100644
 --- a/bin/tests/system/dnssec/tests.sh
 +++ b/bin/tests/system/dnssec/tests.sh
-@@ -3235,8 +3235,8 @@ do
+@@ -3257,8 +3257,8 @@ do
 	   alg=`expr $alg + 1`
 	   continue;;
 	3) size="-b 512";;
@ -1065,7 +1064,7 @@ index cfcfe8f..0a1614d 100644
 };
 
 diff --git a/bin/tests/system/notify/tests.sh b/bin/tests/system/notify/tests.sh
-index 1f6e6d0..c08bd25 100644
+index c112d2c..987b6de 100644
 --- a/bin/tests/system/notify/tests.sh
 +++ b/bin/tests/system/notify/tests.sh
@@ -212,16 +212,16 @@ ret=0
@ -1089,7 +1088,7 @@ index 1f6e6d0..c08bd25 100644
 	grep "test string" dig.out.b.ns5.test$n > /dev/null &&
 	grep "test string" dig.out.c.ns5.test$n > /dev/null &&
 diff --git a/bin/tests/system/nsupdate/ns1/named.conf.in b/bin/tests/system/nsupdate/ns1/named.conf.in
-index 1d999ad..26b6b7c 100644
+index e90907a..540a984 100644
 --- a/bin/tests/system/nsupdate/ns1/named.conf.in
 +++ b/bin/tests/system/nsupdate/ns1/named.conf.in
@@ -32,7 +32,7 @@ controls {
@ -1115,10 +1114,10 @@ index 4549184..cb7dccd 100644
 };
 
 diff --git a/bin/tests/system/nsupdate/setup.sh b/bin/tests/system/nsupdate/setup.sh
-index 21805c5..0d3d85c 100644
+index a35b8ee..8383162 100644
 --- a/bin/tests/system/nsupdate/setup.sh
 +++ b/bin/tests/system/nsupdate/setup.sh
-@@ -58,7 +58,12 @@ EOF
+@@ -53,7 +53,12 @@ EOF
 
 $DDNSCONFGEN -q -r $RANDFILE -z example.nil > ns1/ddns.key
 
@ -1133,10 +1132,10 @@ index 21805c5..0d3d85c 100644
 $DDNSCONFGEN -q -r $RANDFILE -a hmac-sha224 -k sha224-key -z keytests.nil > ns1/sha224.key
 $DDNSCONFGEN -q -r $RANDFILE -a hmac-sha256 -k sha256-key -z keytests.nil > ns1/sha256.key
 diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh
-index 4da4849..b3bc807 100755
+index 14952c8..5c51972 100755
 --- a/bin/tests/system/nsupdate/tests.sh
 +++ b/bin/tests/system/nsupdate/tests.sh
-@@ -708,7 +708,14 @@ fi
+@@ -760,7 +760,14 @@ fi
 n=`expr $n + 1`
 ret=0
 echo_i "check TSIG key algorithms ($n)"
@ -1152,7 +1151,7 @@ index 4da4849..b3bc807 100755
     $NSUPDATE -k ns1/${alg}.key <<END > /dev/null || ret=1
 server 10.53.0.1 ${PORT}
 update add ${alg}.keytests.nil. 600 A 10.10.10.3
-@@ -716,7 +723,7 @@ send
+@@ -768,7 +775,7 @@ send
 END
 done
 sleep 2
@ -1162,10 +1161,10 @@ index 4da4849..b3bc807 100755
 done
 if [ $ret -ne 0 ]; then
 diff --git a/bin/tests/system/rndc/setup.sh b/bin/tests/system/rndc/setup.sh
-index 343869e..c30efb0 100644
+index 8521ff8..565a1d7 100644
 --- a/bin/tests/system/rndc/setup.sh
 +++ b/bin/tests/system/rndc/setup.sh
-@@ -37,7 +37,7 @@ make_key () {
+@@ -35,7 +35,7 @@ make_key () {
             sed 's/allow { 10.53.0.4/allow { any/' >> ns4/named.conf
 }
 
@ -1208,15 +1207,6 @@ index 57e066d..186a723 100644
 
 n=`expr $n + 1`
 echo_i "testing rndc with hmac-sha1 ($n)"
-diff --git a/bin/tests/system/tsig/clean.sh b/bin/tests/system/tsig/clean.sh
-index 576ec70..cb7a852 100644
--- a/bin/tests/system/tsig/clean.sh
-+++ b/bin/tests/system/tsig/clean.sh
-@@ -20,3 +20,4 @@ rm -f */named.run
- rm -f ns*/named.lock
- rm -f Kexample.net.+163+*
- rm -f keygen.out?
-+rm -f ns1/named.conf
 diff --git a/bin/tests/system/tsig/ns1/named.conf.in b/bin/tests/system/tsig/ns1/named.conf.in
 index fbf30c6..f61657d 100644
 --- a/bin/tests/system/tsig/ns1/named.conf.in
@ -1245,11 +1235,27 @@ index fbf30c6..f61657d 100644
 
 key "sha1-trunc" {
 	secret "FrSt77yPTFx6hTs4i2tKLB9LmE0=";
+diff --git a/bin/tests/system/tsig/ns1/rndc5.conf.in b/bin/tests/system/tsig/ns1/rndc5.conf.in
+new file mode 100644
+index 0000000..0682194
+--- /dev/null
+++ b/bin/tests/system/tsig/ns1/rndc5.conf.in
+@@ -0,0 +1,10 @@
+# Conditionally included when support for MD5 is available
+key "md5" {
+	secret "97rnFx24Tfna4mHPfgnerA==";
+	algorithm hmac-md5;
+};
+
+key "md5-trunc" {
+	secret "97rnFx24Tfna4mHPfgnerA==";
+	algorithm hmac-md5-80;
+};
 diff --git a/bin/tests/system/tsig/setup.sh b/bin/tests/system/tsig/setup.sh
-index 4dd4a25..aa0f966 100644
+index 9a8ab2e..1311689 100644
 --- a/bin/tests/system/tsig/setup.sh
 +++ b/bin/tests/system/tsig/setup.sh
-@@ -17,3 +17,8 @@ $SHELL clean.sh
+@@ -15,3 +15,8 @@ SYSTEMTESTTOP=..
 copy_setports ns1/named.conf.in ns1/named.conf
 
 test -r $RANDFILE || $GENRANDOM $RANDOMSIZE $RANDFILE
@ -1259,7 +1265,7 @@ index 4dd4a25..aa0f966 100644
 +	cat ns1/rndc5.conf.in >> ns1/named.conf
 +fi
 diff --git a/bin/tests/system/tsig/tests.sh b/bin/tests/system/tsig/tests.sh
-index f731fa6..cade35b 100644
+index 526dbca..bf359a4 100644
 --- a/bin/tests/system/tsig/tests.sh
 +++ b/bin/tests/system/tsig/tests.sh
@@ -26,20 +26,25 @@ sha512="jI/Pa4qRu96t76Pns5Z/Ndxbn3QCkwcxLOgt9vgvnJw5wqTRvNyk3FtD6yIMd1dWVlqZ+Y4f
@ -1273,13 +1279,6 @@ index f731fa6..cade35b 100644
 -if [ $ret -eq 1 ] ; then
 -	echo_i "failed"; status=1
 -fi
-
-echo_i "fetching using hmac-md5 (new form)"
-ret=0
-$DIG $DIGOPTS example.nil. -y "hmac-md5:md5:$md5" @10.53.0.1 soa > dig.out.md5.new || ret=1
-grep -i "md5.*TSIG.*NOERROR" dig.out.md5.new > /dev/null || ret=1
-if [ $ret -eq 1 ] ; then
-	echo_i "failed"; status=1
 +if $FEATURETEST --md5
 +then
 +	echo_i "fetching using hmac-md5 (old form)"
@ -1289,7 +1288,13 @@ index f731fa6..cade35b 100644
 +	if [ $ret -eq 1 ] ; then
 +		echo_i "failed"; status=1
 +	fi
-+
+ 
+-echo_i "fetching using hmac-md5 (new form)"
+-ret=0
+-$DIG $DIGOPTS example.nil. -y "hmac-md5:md5:$md5" @10.53.0.1 soa > dig.out.md5.new || ret=1
+-grep -i "md5.*TSIG.*NOERROR" dig.out.md5.new > /dev/null || ret=1
+-if [ $ret -eq 1 ] ; then
+-	echo_i "failed"; status=1
 +	echo_i "fetching using hmac-md5 (new form)"
 +	ret=0
 +	$DIG $DIGOPTS example.nil. -y "hmac-md5:md5:$md5" @10.53.0.1 soa > dig.out.md5.new || ret=1
@ -1351,10 +1356,10 @@ index f731fa6..cade35b 100644
 
 echo_i "fetching using hmac-sha1-80 (BADTRUNC)"
 diff --git a/bin/tests/system/tsiggss/setup.sh b/bin/tests/system/tsiggss/setup.sh
-index 0d21c7b..dbcb7b4 100644
+index 49510b4..8d8bb2a 100644
 --- a/bin/tests/system/tsiggss/setup.sh
 +++ b/bin/tests/system/tsiggss/setup.sh
-@@ -18,5 +18,5 @@ test -r $RANDFILE || $GENRANDOM $RANDOMSIZE $RANDFILE
+@@ -16,5 +16,5 @@ test -r $RANDFILE || $GENRANDOM $RANDOMSIZE $RANDFILE
 
 copy_setports ns1/named.conf.in ns1/named.conf
 
@ -1387,22 +1392,6 @@ index b0694bb..9adae82 100644
 server 10.53.0.3 ${PORT}
 update add updated.example. 600 A 10.10.10.1
 update add updated.example. 600 TXT Foo
-diff --git a/bin/tests/system/tsig/ns1/rndc5.conf.in b/bin/tests/system/tsig/ns1/rndc5.conf.in
-new file mode 100644
-index 0000000..0682194
--- /dev/null
-+++ b/bin/tests/system/tsig/ns1/rndc5.conf.in
-@@ -0,0 +1,10 @@
-+# Conditionally included when support for MD5 is available
-+key "md5" {
-+	secret "97rnFx24Tfna4mHPfgnerA==";
-+	algorithm hmac-md5;
-+};
-+
-+key "md5-trunc" {
-+	secret "97rnFx24Tfna4mHPfgnerA==";
-+	algorithm hmac-md5-80;
-+};
 -- 
-2.20.1
+2.26.2

--- a/bind-9.11-kyua-pkcs11.patch
+++ b/bind-9.11-kyua-pkcs11.patch
@ -1,4 +1,4 @@
-From eb38d2278937ec3fe45d0af30cd080953bbb5b54 Mon Sep 17 00:00:00 2001
+From a9b5785f174cf7fd74891fa64f6b69b9a9b55466 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Tue, 2 Jan 2018 18:13:07 +0100
 Subject: [PATCH] Fix pkcs11 variants atf tests
@ -16,10 +16,10 @@ Add pkcs11 Kyuafile, fix dh_test to pass in pkcs11 mode
 6 files changed, 38 insertions(+), 16 deletions(-)

 diff --git a/configure.ac b/configure.ac
-index 0532feb..a83ddd5 100644
+index 62ecf56..0940a7d 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -5578,6 +5578,7 @@ AC_CONFIG_FILES([
+@@ -5476,6 +5476,7 @@ AC_CONFIG_FILES([
 	lib/dns-pkcs11/include/Makefile
 	lib/dns-pkcs11/include/dns/Makefile
 	lib/dns-pkcs11/include/dst/Makefile
@ -43,13 +43,13 @@ index 7c8bab0..eec9564 100644
 include('isccfg/Kyuafile')
 include('lwres/Kyuafile')
 diff --git a/lib/dns-pkcs11/tests/Makefile.in b/lib/dns-pkcs11/tests/Makefile.in
-index 7671e1d..e237d5c 100644
+index 22a06a8..5df5b15 100644
 --- a/lib/dns-pkcs11/tests/Makefile.in
 +++ b/lib/dns-pkcs11/tests/Makefile.in
@@ -17,12 +17,12 @@ VERSION=@BIND9_VERSION@
 
 CINCLUDES =	-I. -Iinclude ${DNS_INCLUDES} ${ISC_INCLUDES} \
- 		@DST_OPENSSL_INC@
+ 		@DST_OPENSSL_INC@ ${MAXMINDDB_CFLAGS}
 -CDEFINES =	@CRYPTO@ -DTESTS="\"${top_builddir}/lib/dns/tests/\""
 +CDEFINES =	@CRYPTO_PK11@ -DTESTS="\"${top_builddir}/lib/dns-pkcs11/tests/\""
 
@ -65,10 +65,10 @@ index 7671e1d..e237d5c 100644
 LIBS =		@LIBS@ @CMOCKA_LIBS@
 CFLAGS =	@CFLAGS@ @CMOCKA_CFLAGS@
 diff --git a/lib/dns-pkcs11/tests/dh_test.c b/lib/dns-pkcs11/tests/dh_test.c
-index 4dbfd82..a383b8e 100644
+index a5bf46c..9ff2b76 100644
 --- a/lib/dns-pkcs11/tests/dh_test.c
 +++ b/lib/dns-pkcs11/tests/dh_test.c
-@@ -86,7 +86,8 @@ dh_computesecret(void **state) {
+@@ -88,7 +88,8 @@ dh_computesecret(void **state) {
 	result = dst_key_computesecret(key, key, &buf);
 	assert_int_equal(result, DST_R_NOTPRIVATEKEY);
 	result = key->func->computesecret(key, key, &buf);
@ -79,7 +79,7 @@ index 4dbfd82..a383b8e 100644
 	dst_key_free(&key);
 }
 diff --git a/lib/isc-pkcs11/tests/Makefile.in b/lib/isc-pkcs11/tests/Makefile.in
-index 2fdee0b..a263b35 100644
+index 36d2207..00dfbc9 100644
 --- a/lib/isc-pkcs11/tests/Makefile.in
 +++ b/lib/isc-pkcs11/tests/Makefile.in
@@ -16,10 +16,10 @@ VERSION=@BIND9_VERSION@
@ -97,10 +97,10 @@ index 2fdee0b..a263b35 100644
 LIBS =		@LIBS@ @CMOCKA_LIBS@
 CFLAGS =	@CFLAGS@ @CMOCKA_CFLAGS@
 diff --git a/lib/isc-pkcs11/tests/hash_test.c b/lib/isc-pkcs11/tests/hash_test.c
-index 9c4d299..d9deba2 100644
+index 4fafc38..5eb2be2 100644
 --- a/lib/isc-pkcs11/tests/hash_test.c
 +++ b/lib/isc-pkcs11/tests/hash_test.c
-@@ -85,7 +85,7 @@ typedef struct hash_testcase {
+@@ -84,7 +84,7 @@ typedef struct hash_testcase {
 
 typedef struct hash_test_key {
 	const char *key;
@ -109,7 +109,7 @@ index 9c4d299..d9deba2 100644
 } hash_test_key_t;
 
 /* non-hmac tests */
-@@ -956,8 +956,11 @@ isc_hmacsha1_test(void **state) {
+@@ -955,8 +955,11 @@ isc_hmacsha1_test(void **state) {
 	hash_test_key_t *test_key = test_keys;
 
 	while (testcase->input != NULL && testcase->result != NULL) {
@ -122,7 +122,7 @@ index 9c4d299..d9deba2 100644
 		isc_hmacsha1_update(&hmacsha1,
 				    (const uint8_t *) testcase->input,
 				    testcase->input_len);
-@@ -1116,8 +1119,11 @@ isc_hmacsha224_test(void **state) {
+@@ -1115,8 +1118,11 @@ isc_hmacsha224_test(void **state) {
 	hash_test_key_t *test_key = test_keys;
 
 	while (testcase->input != NULL && testcase->result != NULL) {
@ -135,7 +135,7 @@ index 9c4d299..d9deba2 100644
 		isc_hmacsha224_update(&hmacsha224,
 				      (const uint8_t *) testcase->input,
 				      testcase->input_len);
-@@ -1277,8 +1283,11 @@ isc_hmacsha256_test(void **state) {
+@@ -1276,8 +1282,11 @@ isc_hmacsha256_test(void **state) {
 	hash_test_key_t *test_key = test_keys;
 
 	while (testcase->input != NULL && testcase->result != NULL) {
@ -148,7 +148,7 @@ index 9c4d299..d9deba2 100644
 		isc_hmacsha256_update(&hmacsha256,
 				      (const uint8_t *) testcase->input,
 				      testcase->input_len);
-@@ -1444,8 +1453,11 @@ isc_hmacsha384_test(void **state) {
+@@ -1443,8 +1452,11 @@ isc_hmacsha384_test(void **state) {
 	hash_test_key_t *test_key = test_keys;
 
 	while (testcase->input != NULL && testcase->result != NULL) {
@ -161,7 +161,7 @@ index 9c4d299..d9deba2 100644
 		isc_hmacsha384_update(&hmacsha384,
 				      (const uint8_t *) testcase->input,
 				      testcase->input_len);
-@@ -1611,8 +1623,11 @@ isc_hmacsha512_test(void **state) {
+@@ -1610,8 +1622,11 @@ isc_hmacsha512_test(void **state) {
 	hash_test_key_t *test_key = test_keys;
 
 	while (testcase->input != NULL && testcase->result != NULL) {
@ -174,7 +174,7 @@ index 9c4d299..d9deba2 100644
 		isc_hmacsha512_update(&hmacsha512,
 				      (const uint8_t *) testcase->input,
 				      testcase->input_len);
-@@ -1755,8 +1770,11 @@ isc_hmacmd5_test(void **state) {
+@@ -1754,8 +1769,11 @@ isc_hmacmd5_test(void **state) {
 	hash_test_key_t *test_key = test_keys;
 
 	while (testcase->input != NULL && testcase->result != NULL) {
@ -188,5 +188,5 @@ index 9c4d299..d9deba2 100644
 				   (const uint8_t *) testcase->input,
 				   testcase->input_len);
 -- 
-2.20.1
+2.21.1

--- a/bind-9.11-rh1624100.patch
+++ b/bind-9.11-rh1624100.patch
@ -1,4 +1,4 @@
-From 76594cba9a1e910bb36160d96fc3872349341799 Mon Sep 17 00:00:00 2001
+From f27598743ab6e03271e26f23da4beba748d19c60 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@sury.org>
 Date: Wed, 25 Apr 2018 14:04:31 +0200
 Subject: [PATCH] Replace isc_safe routines with their OpenSSL counter parts
@ -24,10 +24,10 @@ Fix the isc_safe_memwipe() usage with (NULL, >0)
 delete mode 100644 lib/isc/safe.c

 diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c
-index 6ddaebe..d921870 100644
+index 6dded0c..a9c5557 100644
 --- a/bin/dnssec/dnssec-signzone.c
 +++ b/bin/dnssec/dnssec-signzone.c
-@@ -787,7 +787,7 @@ hashlist_add_dns_name(hashlist_t *l, /*const*/ dns_name_t *name,
+@@ -784,7 +784,7 @@ hashlist_add_dns_name(hashlist_t *l, /*const*/ dns_name_t *name,
 
 static int
 hashlist_comp(const void *a, const void *b) {
@ -81,7 +81,7 @@ index ad77f24..670982a 100644
 
 /* accept_sec_context.c */
 diff --git a/lib/isc/Makefile.in b/lib/isc/Makefile.in
-index 0fd0837..8ad54bb 100644
+index 149552a..8529a86 100644
 --- a/lib/isc/Makefile.in
 +++ b/lib/isc/Makefile.in
@@ -60,7 +60,7 @@ OBJS =		@ISC_EXTRA_OBJS@ @ISC_PK11_O@ @ISC_PK11_RESULT_O@ \
@ -91,7 +91,7 @@ index 0fd0837..8ad54bb 100644
 -		safe.@O@ serial.@O@ siphash.@O@ sha1.@O@ sha2.@O@ sockaddr.@O@ stats.@O@ \
 +		serial.@O@ siphash.@O@ sha1.@O@ sha2.@O@ sockaddr.@O@ stats.@O@ \
 		string.@O@ strtoul.@O@ symtab.@O@ task.@O@ taskpool.@O@ \
- 		tm.@O@ timer.@O@ version.@O@ \
+ 		tm.@O@ timer.@O@ utf8.@O@ version.@O@ \
 		${UNIXOBJS} ${NLSOBJS} ${THREADOBJS}
@@ -79,7 +79,7 @@ SRCS =		@ISC_EXTRA_SRCS@ @ISC_PK11_C@ @ISC_PK11_RESULT_C@ \
 		netaddr.c netscope.c pool.c ondestroy.c \
@ -100,7 +100,7 @@ index 0fd0837..8ad54bb 100644
 -		safe.c serial.c siphash.c sha1.c sha2.c sockaddr.c stats.c string.c \
 +		serial.c siphash.c sha1.c sha2.c sockaddr.c stats.c string.c \
 		strtoul.c symtab.c task.c taskpool.c timer.c \
- 		tm.c version.c
+ 		tm.c utf8.c version.c
 
@@ -95,10 +95,6 @@ TESTDIRS =	@UNITTESTS@
 
@ -284,5 +284,5 @@ index 266ac75..60e9181 100644
 
 	return (cmocka_run_group_tests(tests, NULL, NULL));
 -- 
-2.20.1
+2.26.2

--- a/bind-9.11-rh1647829-2.patch
+++ b/bind-9.11-rh1647829-2.patch
@ -1,86 +0,0 @@
-From fdfc8ad6a1069eea6b012972c972798003d58312 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Tue, 29 Jan 2019 18:07:44 +0100
-Subject: [PATCH] Fallback to ASCII on output IDN conversion error
-
-It is possible dig used ACE encoded name in locale, which does not
-support converting it to unicode. Instead of fatal error, fallback to
-ACE name on output.
-
-(cherry picked from commit 7f4cb8f9584597fea16de6557124ac8b1bd47440)
-
-Modify idna test to fallback to ACE
-
-Test valid A-label on input would be displayed as A-label on output if
-locale does not allow U-label.
-
-(cherry picked from commit 4ce232f8605bdbe0594ebe5a71383c9d4e6f263b)
-
-Emit warning on IDN output failure
-
-Warning is emitted before any dig headers.
-
-(cherry picked from commit 4b410038c531fbb902cd5fb83174eed1f06cb7d7)
---
- bin/dig/dighost.c              | 15 +++++++++++++--
- bin/tests/system/idna/tests.sh | 17 +++++++++++++++++
- 2 files changed, 30 insertions(+), 2 deletions(-)
-
-diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
-index 73aaab8..375f99f 100644
--- a/bin/dig/dighost.c
-+++ b/bin/dig/dighost.c
-@@ -4877,9 +4877,20 @@ idn_ace_to_locale(const char *from, char *to, size_t tolen) {
- 	 */
- 	res = idn2_to_unicode_8zlz(utf8_src, &tmp_str, 0);
- 	if (res != IDN2_OK) {
-		fatal("Cannot represent '%s' in the current locale (%s), "
-		      "use +noidnout or a different locale",
-+		static bool warned = false;
-+
-+		res = idn2_to_ascii_8z(utf8_src, &tmp_str, 0);
-+		if (res != IDN2_OK) {
-+			fatal("Cannot represent '%s' "
-+			      "in the current locale nor ascii (%s), "
-+			      "use +noidnout or a different locale",
- 		      from, idn2_strerror(res));
-+		} else if (!warned) {
-+			fprintf(stderr, ";; Warning: cannot represent '%s' "
-+			      "in the current locale",
-+			      tmp_str);
-+			warned = true;
-+		}
- 	}
- 
- 	/*
-diff --git a/bin/tests/system/idna/tests.sh b/bin/tests/system/idna/tests.sh
-index 7acb0fa..0269bcd 100644
--- a/bin/tests/system/idna/tests.sh
-+++ b/bin/tests/system/idna/tests.sh
-@@ -244,6 +244,23 @@ idna_enabled_test() {
-     idna_test "$text" "+idnin +noidnout"   "xn--nxasmq6b.com" "xn--nxasmq6b.com."
-     idna_test "$text" "+idnin +idnout"     "xn--nxasmq6b.com" "βόλοσ.com."
- 
-+    # Test of valid A-label in locale that cannot display it
-+    #
-+    # +noidnout: The string is sent as-is to the server and the returned qname
-+    #            is displayed in the same form.
-+    # +idnout:   The string is sent as-is to the server and the returned qname
-+    #            is displayed as the corresponding A-label.
-+    #
-+    # The "+[no]idnout" flag has no effect in these cases.
-+    text="Checking valid A-label in C locale"
-+    label="xn--nxasmq6b.com"
-+    LC_ALL=C idna_test "$text" ""                   "$label" "$label."
-+    LC_ALL=C idna_test "$text" "+noidnin +noidnout" "$label" "$label."
-+    LC_ALL=C idna_test "$text" "+noidnin +idnout"   "$label" "$label."
-+    LC_ALL=C idna_test "$text" "+idnin +noidnout"   "$label" "$label."
-+    LC_ALL=C idna_test "$text" "+idnin +idnout"     "$label" "$label."
-+    LC_ALL=C idna_test "$text" "+noidnin +idnout"   "$label" "$label."
-+
- 
- 
-     # Tests of invalid A-labels
-- 
-2.20.1
-
--- a/bind-9.11-rh1647829.patch
+++ b/bind-9.11-rh1647829.patch
@ -1,86 +0,0 @@
-From 2eca7f5fa97a24997e4d8f900460ba43ae167e97 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Tue, 29 Jan 2019 18:07:44 +0100
-Subject: [PATCH] Fallback to ASCII on output IDN conversion error
-
-It is possible dig used ACE encoded name in locale, which does not
-support converting it to unicode. Instead of fatal error, fallback to
-ACE name on output.
-
-(cherry picked from commit 7f4cb8f9584597fea16de6557124ac8b1bd47440)
-
-Modify idna test to fallback to ACE
-
-Test valid A-label on input would be displayed as A-label on output if
-locale does not allow U-label.
-
-(cherry picked from commit 4ce232f8605bdbe0594ebe5a71383c9d4e6f263b)
-
-Emit warning on IDN output failure
-
-Warning is emitted before any dig headers.
-
-(cherry picked from commit 4b410038c531fbb902cd5fb83174eed1f06cb7d7)
---
- bin/dig/dighost.c              | 15 +++++++++++++--
- bin/tests/system/idna/tests.sh | 17 +++++++++++++++++
- 2 files changed, 30 insertions(+), 2 deletions(-)
-
-diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
-index bb8702c..d7cfc33 100644
--- a/bin/dig/dighost.c
-+++ b/bin/dig/dighost.c
-@@ -4860,9 +4860,20 @@ idn_ace_to_locale(const char *from, char *to, size_t tolen) {
- 	 */
- 	res = idn2_to_unicode_8zlz(utf8_src, &tmp_str, 0);
- 	if (res != IDN2_OK) {
-		fatal("Cannot represent '%s' in the current locale (%s), "
-		      "use +noidnout or a different locale",
-+		static bool warned = false;
-+
-+		res = idn2_to_ascii_8z(utf8_src, &tmp_str, 0);
-+		if (res != IDN2_OK) {
-+			fatal("Cannot represent '%s' "
-+			      "in the current locale nor ascii (%s), "
-+			      "use +noidnout or a different locale",
- 		      from, idn2_strerror(res));
-+		} else if (!warned) {
-+			fprintf(stderr, ";; Warning: cannot represent '%s' "
-+			      "in the current locale",
-+			      tmp_str);
-+			warned = true;
-+		}
- 	}
- 
- 	/*
-diff --git a/bin/tests/system/idna/tests.sh b/bin/tests/system/idna/tests.sh
-index 6637bf6..215a9d5 100644
--- a/bin/tests/system/idna/tests.sh
-+++ b/bin/tests/system/idna/tests.sh
-@@ -244,6 +244,23 @@ idna_enabled_test() {
-     idna_test "$text" "+idnin +noidnout"   "xn--nxasmq6b.com" "xn--nxasmq6b.com."
-     idna_test "$text" "+idnin +idnout"     "xn--nxasmq6b.com" "βόλοσ.com."
- 
-+    # Test of valid A-label in locale that cannot display it
-+    #
-+    # +noidnout: The string is sent as-is to the server and the returned qname
-+    #            is displayed in the same form.
-+    # +idnout:   The string is sent as-is to the server and the returned qname
-+    #            is displayed as the corresponding A-label.
-+    #
-+    # The "+[no]idnout" flag has no effect in these cases.
-+    text="Checking valid A-label in C locale"
-+    label="xn--nxasmq6b.com"
-+    LC_ALL=C idna_test "$text" ""                   "$label" "$label."
-+    LC_ALL=C idna_test "$text" "+noidnin +noidnout" "$label" "$label."
-+    LC_ALL=C idna_test "$text" "+noidnin +idnout"   "$label" "$label."
-+    LC_ALL=C idna_test "$text" "+idnin +noidnout"   "$label" "$label."
-+    LC_ALL=C idna_test "$text" "+idnin +idnout"     "$label" "$label."
-+    LC_ALL=C idna_test "$text" "+noidnin +idnout"   "$label" "$label."
-+
- 
- 
-     # Tests of invalid A-labels
-- 
-2.20.1
-
--- a/bind-9.11-rh1732883.patch
+++ b/bind-9.11-rh1732883.patch
@ -1,4 +1,4 @@
-From 348947b3d573e2187db61fb43919d2260dcfc135 Mon Sep 17 00:00:00 2001
+From 6010876e561b4345e569ffd11eaec9ea52725817 Mon Sep 17 00:00:00 2001
 From: Pavel Zhukov <pzhukov@redhat.com>
 Date: Wed, 24 Jul 2019 17:15:55 +0200
 Subject: [PATCH] Detect system time jumps
@ -17,18 +17,16 @@ go_reboot() procedure to request lease extention
 6 files changed, 84 insertions(+), 5 deletions(-)

 diff --git a/lib/isc/include/isc/result.h b/lib/isc/include/isc/result.h
-index 0fd4971..2add549 100644
+index 0389efa..149cde5 100644
 --- a/lib/isc/include/isc/result.h
 +++ b/lib/isc/include/isc/result.h
-@@ -87,9 +87,10 @@
- #define ISC_R_CRYPTOFAILURE		65	/*%< cryptography library failure */
- #define ISC_R_DISCQUOTA			66	/*%< disc quota */
+@@ -89,7 +89,8 @@
 #define ISC_R_DISCFULL			67	/*%< disc full */
-+#define ISC_R_TIMESHIFTED               68      /*%< system time changed */
- 
- /*% Not a result code: the number of results. */
-#define ISC_R_NRESULTS 			68
-+#define ISC_R_NRESULTS 			69
+ #define ISC_R_DEFAULT			68	/*%< default */
+ #define ISC_R_IPV4PREFIX		69	/*%< IPv4 prefix */
+-#define ISC_R_NRESULTS 			70
+#define ISC_R_TIMESHIFTED               70      /*%< system time changed */
+#define ISC_R_NRESULTS 			71
 
 ISC_LANG_BEGINDECLS
 
@ -47,27 +45,27 @@ index 973c348..8160dd3 100644
 /*%
  * Alignment
 diff --git a/lib/isc/result.c b/lib/isc/result.c
-index abb6ed2..8c95a93 100644
+index a9db132..7c04831 100644
 --- a/lib/isc/result.c
 +++ b/lib/isc/result.c
-@@ -103,6 +103,7 @@ static const char *description[ISC_R_NRESULTS] = {
- 	"crypto failure",			/*%< 65 */
- 	"disc quota",				/*%< 66 */
+@@ -105,6 +105,7 @@ static const char *description[ISC_R_NRESULTS] = {
 	"disc full",				/*%< 67 */
-+        "time changed",                         /*%< 68 */
+ 	"default",				/*%< 68 */
+ 	"IPv4 prefix",				/*%< 69 */
+        "time changed",                         /*%< 70 */
 };
 
 static const char *identifier[ISC_R_NRESULTS] = {
-@@ -174,6 +175,7 @@ static const char *identifier[ISC_R_NRESULTS] = {
- 	"ISC_R_CRYPTOFAILURE",
- 	"ISC_R_DISCQUOTA",
+@@ -178,6 +179,7 @@ static const char *identifier[ISC_R_NRESULTS] = {
 	"ISC_R_DISCFULL",
+ 	"ISC_R_DEFAULT",
+ 	"ISC_R_IPV4PREFIX",
 +        "ISC_R_TIMESHIFTED",
 };
 
 #define ISC_RESULT_RESULTSET			2
 diff --git a/lib/isc/unix/app.c b/lib/isc/unix/app.c
-index 7e5a0ee..ceab74e 100644
+index a6e9882..52eb3e0 100644
 --- a/lib/isc/unix/app.c
 +++ b/lib/isc/unix/app.c
@@ -442,15 +442,48 @@ isc__app_ctxonrun(isc_appctx_t *ctx0, isc_mem_t *mctx, isc_task_t *task,
--- a/bind-9.11-rh1736762-5.patch
+++ b/bind-9.11-rh1736762-5.patch
@ -0,0 +1,59 @@
+From 6257d829c9d7e71ac51bcdc6b5b981c7a19200e2 Mon Sep 17 00:00:00 2001
+From: Mark Andrews <marka@isc.org>
+Date: Mon, 25 Nov 2019 05:46:55 +0000
+Subject: [PATCH] Merge branch
+ '1373-threadsanitizer-data-race-rbtdb-c-5193-in-detachnode' into 'master'
+
+Resolve "ThreadSanitizer: data race rbtdb.c:5193 in detachnode"
+
+Closes #1373
+
+See merge request isc-projects/bind9!2598
+---
+ lib/dns/include/dns/rbt.h | 22 +++++++++-------------
+ 1 file changed, 9 insertions(+), 13 deletions(-)
+
+diff --git a/lib/dns/include/dns/rbt.h b/lib/dns/include/dns/rbt.h
+index 67ac3e4d8a..a084bd6193 100644
+--- a/lib/dns/include/dns/rbt.h
+++ b/lib/dns/include/dns/rbt.h
+@@ -49,10 +49,7 @@ ISC_LANG_BEGINDECLS
+ 
+ #define DNS_RBT_USEMAGIC 1
+ 
+-/*
+- * These should add up to 30.
+- */
+-#define DNS_RBT_LOCKLENGTH                      10
+#define DNS_RBT_LOCKLENGTH		(sizeof(((dns_rbtnode_t *)0)->locknum)*8)
+ #define DNS_RBT_REFLENGTH                       20
+ 
+ #define DNS_RBTNODE_MAGIC               ISC_MAGIC('R','B','N','O')
+@@ -159,16 +156,15 @@ struct dns_rbtnode {
+ 	 * separate region of memory.
+ 	 */
+ 	void *data;
+-	unsigned int :0;                /* start of bitfields c/o node lock */
+-	unsigned int dirty:1;
+-	unsigned int wild:1;
+-	unsigned int locknum:DNS_RBT_LOCKLENGTH;
+-#ifndef DNS_RBT_USEISCREFCOUNT
+-	unsigned int references:DNS_RBT_REFLENGTH;
+-#endif
+-	unsigned int :0;                /* end of bitfields c/o node lock */
+	uint8_t :0;                /* start of bitfields c/o node lock */
+	uint8_t dirty:1;
+	uint8_t wild:1;
+	uint8_t :0;                /* end of bitfields c/o node lock */
+	uint16_t locknum;	   /* note that this is not in the bitfield */
+ #ifdef DNS_RBT_USEISCREFCOUNT
+-	isc_refcount_t references; /* note that this is not in the bitfield */
+	isc_refcount_t references;
+#else
+	unsigned int references:DNS_RBT_REFLENGTH;
+ #endif
+ 	/*@}*/
+ };
+-- 
+2.21.0
+
--- a/bind-9.11-rt31459.patch
+++ b/bind-9.11-rt31459.patch
@ -1,4 +1,4 @@
-From 108a0f57f423a27995ac96272832278f4aa3a612 Mon Sep 17 00:00:00 2001
+From 5c29299e43db5a4e6f8b1b07af84dfe1687c4c2b Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Tue, 12 Sep 2017 19:05:46 -0700
 Subject: [PATCH] rebased rt31459c
@ -71,10 +71,10 @@ index 5015abb..295e16f 100644
 							     &entropy_source,
 							     randomfile,
 diff --git a/bin/dnssec/dnssec-dsfromkey.c b/bin/dnssec/dnssec-dsfromkey.c
-index 060892b..c2cc9c7 100644
+index d9d6bb9..de4b15f 100644
 --- a/bin/dnssec/dnssec-dsfromkey.c
 +++ b/bin/dnssec/dnssec-dsfromkey.c
-@@ -494,14 +494,14 @@ main(int argc, char **argv) {
+@@ -498,14 +498,14 @@ main(int argc, char **argv) {
 
 	if (ectx == NULL)
 		setup_entropy(mctx, NULL, &ectx);
@ -92,7 +92,7 @@ index 060892b..c2cc9c7 100644
 	isc_entropy_stopcallbacksources(ectx);
 
 	setup_logging(mctx, &log);
-@@ -563,8 +563,8 @@ main(int argc, char **argv) {
+@@ -574,8 +574,8 @@ main(int argc, char **argv) {
 	if (dns_rdataset_isassociated(&rdataset))
 		dns_rdataset_disassociate(&rdataset);
 	cleanup_logging(&log);
@ -103,10 +103,10 @@ index 060892b..c2cc9c7 100644
 	dns_name_destroy();
 	if (verbose > 10)
 diff --git a/bin/dnssec/dnssec-importkey.c b/bin/dnssec/dnssec-importkey.c
-index 0d1e7f8..79c4d74 100644
+index d65a514..04b3094 100644
 --- a/bin/dnssec/dnssec-importkey.c
 +++ b/bin/dnssec/dnssec-importkey.c
-@@ -407,14 +407,14 @@ main(int argc, char **argv) {
+@@ -404,14 +404,14 @@ main(int argc, char **argv) {
 
 	if (ectx == NULL)
 		setup_entropy(mctx, NULL, &ectx);
@ -124,7 +124,7 @@ index 0d1e7f8..79c4d74 100644
 	isc_entropy_stopcallbacksources(ectx);
 
 	setup_logging(mctx, &log);
-@@ -458,8 +458,8 @@ main(int argc, char **argv) {
+@@ -455,8 +455,8 @@ main(int argc, char **argv) {
 	if (dns_rdataset_isassociated(&rdataset))
 		dns_rdataset_disassociate(&rdataset);
 	cleanup_logging(&log);
@ -167,10 +167,10 @@ index 7d82dbf..10f9359 100644
 	if (verbose > 10)
 		isc_mem_stats(mctx, stdout);
 diff --git a/bin/dnssec/dnssec-settime.c b/bin/dnssec/dnssec-settime.c
-index f355903..6a2ca59 100644
+index 7afcaee..1cfa511 100644
 --- a/bin/dnssec/dnssec-settime.c
 +++ b/bin/dnssec/dnssec-settime.c
-@@ -382,14 +382,14 @@ main(int argc, char **argv) {
+@@ -380,14 +380,14 @@ main(int argc, char **argv) {
 
 	if (ectx == NULL)
 		setup_entropy(mctx, NULL, &ectx);
@ -188,7 +188,7 @@ index f355903..6a2ca59 100644
 	isc_entropy_stopcallbacksources(ectx);
 
 	if (predecessor != NULL) {
-@@ -674,8 +674,8 @@ main(int argc, char **argv) {
+@@ -672,8 +672,8 @@ main(int argc, char **argv) {
 	if (prevkey != NULL)
 		dst_key_free(&prevkey);
 	dst_key_free(&key);
@ -199,7 +199,7 @@ index f355903..6a2ca59 100644
 	if (verbose > 10)
 		isc_mem_stats(mctx, stdout);
 diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c
-index c6a0313..6ddaebe 100644
+index 319a805..27ae4d4 100644
 --- a/bin/dnssec/dnssec-signzone.c
 +++ b/bin/dnssec/dnssec-signzone.c
@@ -3460,14 +3460,15 @@ main(int argc, char *argv[]) {
@ -257,7 +257,7 @@ index 4c293bf..3263cbc 100644
 
 	rdclass = strtoclass(classname);
 diff --git a/bin/dnssec/dnssectool.c b/bin/dnssec/dnssectool.c
-index fbc7ece..31a99e7 100644
+index 618ec5b..5654435 100644
 --- a/bin/dnssec/dnssectool.c
 +++ b/bin/dnssec/dnssectool.c
@@ -34,6 +34,7 @@
@ -293,7 +293,7 @@ index fbc7ece..31a99e7 100644
 					   usekeyboard);
 
 diff --git a/bin/named/server.c b/bin/named/server.c
-index c917cad..436a93a 100644
+index 4e503e5..f27071f 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
@@ -36,6 +36,7 @@
@ -304,7 +304,7 @@ index c917cad..436a93a 100644
 #include <isc/portset.h>
 #include <isc/print.h>
 #include <isc/random.h>
-@@ -8209,6 +8210,10 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8217,6 +8218,10 @@ load_configuration(const char *filename, ns_server_t *server,
 				      "no source of entropy found");
 		} else {
 			const char *randomdev = cfg_obj_asstring(obj);
@ -315,14 +315,14 @@ index c917cad..436a93a 100644
 			int level = ISC_LOG_ERROR;
 			result = isc_entropy_createfilesource(ns_g_entropy,
 							      randomdev);
-@@ -8243,6 +8248,7 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8251,6 +8256,7 @@ load_configuration(const char *filename, ns_server_t *server,
 				}
 				isc_entropy_detach(&ns_g_fallbackentropy);
 			}
 +#endif
 #endif
 		}
- 	}
+ 
 diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
 index bbb3936..0286987 100644
 --- a/bin/nsupdate/nsupdate.c
@ -670,7 +670,7 @@ index 9f90dd7..fad6c83 100644
         echo "I:failed"
 	status=`expr $status + $ret`
 diff --git a/bin/tools/mdig.c b/bin/tools/mdig.c
-index 53579d4..e2f6810 100644
+index bf6dbb6..0416b21 100644
 --- a/bin/tools/mdig.c
 +++ b/bin/tools/mdig.c
@@ -1972,12 +1972,11 @@ main(int argc, char *argv[]) {
@ -688,7 +688,7 @@ index 53579d4..e2f6810 100644
 	parse_args(false, argc, argv);
 	if (server == NULL)
 diff --git a/configure b/configure
-index 2a4d9ed..e4e8ea6 100755
+index 6d05371..33689c9 100755
 --- a/configure
 +++ b/configure
@@ -640,6 +640,7 @@ ac_includes_default="\
@ -699,7 +699,7 @@ index 2a4d9ed..e4e8ea6 100755
 BUILD_LIBS
 BUILD_LDFLAGS
 BUILD_CPPFLAGS
-@@ -823,6 +824,7 @@ XMLSTATS
+@@ -823,6 +824,7 @@ LIBXML2_CFLAGS
 NZDTARGETS
 NZDSRCS
 NZD_TOOLS
@ -715,7 +715,7 @@ index 2a4d9ed..e4e8ea6 100755
 with_lmdb
 with_libxml2
 with_libjson
-@@ -1746,6 +1749,7 @@ Optional Features:
+@@ -1749,6 +1752,7 @@ Optional Features:
   --enable-threads        enable multithreading
   --enable-native-pkcs11  use native PKCS11 for all crypto [default=no]
   --enable-openssl-hash   use OpenSSL for hash functions [default=no]
@ -723,7 +723,7 @@ index 2a4d9ed..e4e8ea6 100755
   --enable-largefile      64-bit file support
   --enable-backtrace      log stack backtrace on abort [default=yes]
   --enable-symtable       use internal symbol table for backtrace
-@@ -17117,6 +17121,7 @@ case "$use_openssl" in
+@@ -17144,6 +17148,7 @@ case "$use_openssl" in
 $as_echo "disabled because of native PKCS11" >&6; }
 		DST_OPENSSL_INC=""
 		CRYPTO="-DPKCS11CRYPTO"
@ -731,7 +731,7 @@ index 2a4d9ed..e4e8ea6 100755
 		OPENSSLECDSALINKOBJS=""
 		OPENSSLECDSALINKSRCS=""
 		OPENSSLEDDSALINKOBJS=""
-@@ -17131,6 +17136,7 @@ $as_echo "disabled because of native PKCS11" >&6; }
+@@ -17158,6 +17163,7 @@ $as_echo "disabled because of native PKCS11" >&6; }
 $as_echo "no" >&6; }
 		DST_OPENSSL_INC=""
 		CRYPTO=""
@ -739,7 +739,7 @@ index 2a4d9ed..e4e8ea6 100755
 		OPENSSLECDSALINKOBJS=""
 		OPENSSLECDSALINKSRCS=""
 		OPENSSLEDDSALINKOBJS=""
-@@ -17143,6 +17149,7 @@ $as_echo "no" >&6; }
+@@ -17170,6 +17176,7 @@ $as_echo "no" >&6; }
 	auto)
 		DST_OPENSSL_INC=""
 		CRYPTO=""
@ -747,7 +747,7 @@ index 2a4d9ed..e4e8ea6 100755
 		OPENSSLECDSALINKOBJS=""
 		OPENSSLECDSALINKSRCS=""
 		OPENSSLEDDSALINKOBJS=""
-@@ -17152,7 +17159,7 @@ $as_echo "no" >&6; }
+@@ -17179,7 +17186,7 @@ $as_echo "no" >&6; }
 		OPENSSLLINKOBJS=""
 		OPENSSLLINKSRCS=""
 		as_fn_error $? "OpenSSL was not found in any of $openssldirs; use --with-openssl=/path
@ -756,7 +756,7 @@ index 2a4d9ed..e4e8ea6 100755
 		;;
 	*)
 		if test "yes" = "$want_native_pkcs11"
-@@ -17183,6 +17190,7 @@ $as_echo "not found" >&6; }
+@@ -17210,6 +17217,7 @@ $as_echo "not found" >&6; }
 			as_fn_error $? "\"$use_openssl/include/openssl/opensslv.h\" not found" "$LINENO" 5
 		fi
 		CRYPTO='-DOPENSSL'
@ -764,7 +764,7 @@ index 2a4d9ed..e4e8ea6 100755
 		if test "/usr" = "$use_openssl"
 		then
 			DST_OPENSSL_INC=""
-@@ -17808,8 +17816,6 @@ fi
+@@ -17835,8 +17843,6 @@ fi
 # Use OpenSSL for hash functions
 #
 
@ -773,7 +773,7 @@ index 2a4d9ed..e4e8ea6 100755
 ISC_PLATFORM_OPENSSLHASH="#undef ISC_PLATFORM_OPENSSLHASH"
 case $want_openssl_hash in
 	yes)
-@@ -18184,6 +18190,86 @@ if test "rt" = "$have_clock_gt"; then
+@@ -18211,6 +18217,86 @@ if test "rt" = "$have_clock_gt"; then
 	LIBS="-lrt $LIBS"
 fi
 
@ -860,7 +860,7 @@ index 2a4d9ed..e4e8ea6 100755
 #
 # was --with-lmdb specified?
 #
-@@ -20266,9 +20352,12 @@ _ACEOF
+@@ -20441,9 +20527,12 @@ _ACEOF
 if ac_fn_c_try_compile "$LINENO"; then :
   { $as_echo "$as_me:${as_lineno-$LINENO}: result: size_t for buflen; int for flags" >&5
 $as_echo "size_t for buflen; int for flags" >&6; }
@ -875,7 +875,7 @@ index 2a4d9ed..e4e8ea6 100755
 
 	 $as_echo "#define IRS_GETNAMEINFO_FLAGS_T int" >>confdefs.h
 
-@@ -21583,12 +21672,7 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
+@@ -21758,12 +21847,7 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
 ISC_PLATFORM_USESTDASM="#undef ISC_PLATFORM_USESTDASM"
 ISC_PLATFORM_USEMACASM="#undef ISC_PLATFORM_USEMACASM"
 if test "yes" = "$use_atomic"; then
@ -889,7 +889,7 @@ index 2a4d9ed..e4e8ea6 100755
 # version HP92453-01 B.11.11.23709.GP, which incorrectly rejects
 # declarations like `int a3[[(sizeof (unsigned char)) >= 0]];'.
 # This bug is HP SR number 8606223364.
-@@ -21621,6 +21705,11 @@ cat >>confdefs.h <<_ACEOF
+@@ -21796,6 +21880,11 @@ cat >>confdefs.h <<_ACEOF
 _ACEOF
 
 
@ -901,7 +901,7 @@ index 2a4d9ed..e4e8ea6 100755
 		if test $ac_cv_sizeof_void_p = 8; then
 			arch=x86_64
 			have_xaddq=yes
-@@ -21629,39 +21718,6 @@ _ACEOF
+@@ -21804,39 +21893,6 @@ _ACEOF
 		fi
 	;;
 	x86_64-*|amd64-*)
@ -941,7 +941,7 @@ index 2a4d9ed..e4e8ea6 100755
 		if test $ac_cv_sizeof_void_p = 8; then
 			arch=x86_64
 			have_xaddq=yes
-@@ -21692,6 +21748,10 @@ $as_echo_n "checking architecture type for atomic operations... " >&6; }
+@@ -21867,6 +21923,10 @@ $as_echo_n "checking architecture type for atomic operations... " >&6; }
 $as_echo "$arch" >&6; }
 fi
 
@ -952,7 +952,7 @@ index 2a4d9ed..e4e8ea6 100755
 if test "yes" = "$have_atomic"; then
 	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking compiler support for inline assembly code" >&5
 $as_echo_n "checking compiler support for inline assembly code... " >&6; }
-@@ -24297,6 +24357,30 @@ CFLAGS="$CFLAGS $SO_CFLAGS"
+@@ -24421,6 +24481,30 @@ CFLAGS="$CFLAGS $SO_CFLAGS"
 #
 dlzdir='${DLZ_DRIVER_DIR}'
 
@ -983,7 +983,7 @@ index 2a4d9ed..e4e8ea6 100755
 #
 # Private autoconf macro to simplify configuring drivers:
 #
-@@ -24627,11 +24711,11 @@ $as_echo "no" >&6; }
+@@ -24751,11 +24835,11 @@ $as_echo "no" >&6; }
 $as_echo "using mysql with libs ${mysql_lib} and includes ${mysql_include}" >&6; }
 		;;
 	*)
@ -998,7 +998,7 @@ index 2a4d9ed..e4e8ea6 100755
 		fi
 
 	CONTRIB_DLZ="$CONTRIB_DLZ -DDLZ_MYSQL"
-@@ -24716,7 +24800,7 @@ $as_echo "" >&6; }
+@@ -24840,7 +24924,7 @@ $as_echo "" >&6; }
 			# Check other locations for includes.
 			# Order is important (sigh).
 
@ -1007,7 +1007,7 @@ index 2a4d9ed..e4e8ea6 100755
 			# include a blank element first
 			for d in "" $bdb_incdirs
 			do
-@@ -24741,57 +24825,9 @@ $as_echo "" >&6; }
+@@ -24865,57 +24949,9 @@ $as_echo "" >&6; }
 			bdb_libnames="db53 db-5.3 db51 db-5.1 db48 db-4.8 db47 db-4.7 db46 db-4.6 db45 db-4.5 db44 db-4.4 db43 db-4.3 db42 db-4.2 db41 db-4.1 db"
 			for d in $bdb_libnames
 			do
@ -1067,7 +1067,7 @@ index 2a4d9ed..e4e8ea6 100755
 					break
 				fi
 			done
-@@ -24950,10 +24986,10 @@ $as_echo "no" >&6; }
+@@ -25074,10 +25110,10 @@ $as_echo "no" >&6; }
 		DLZ_DRIVER_INCLUDES="$DLZ_DRIVER_INCLUDES -I$use_dlz_ldap/include"
 		DLZ_DRIVER_LDAP_INCLUDES="-I$use_dlz_ldap/include"
 	fi
@ -1081,7 +1081,7 @@ index 2a4d9ed..e4e8ea6 100755
 	fi
 
 
-@@ -25039,11 +25075,11 @@ fi
+@@ -25163,11 +25199,11 @@ fi
 		odbcdirs="/usr /usr/local /usr/pkg"
 		for d in $odbcdirs
 		do
@ -1095,7 +1095,7 @@ index 2a4d9ed..e4e8ea6 100755
 				break
 			fi
 		done
-@@ -25318,6 +25354,8 @@ DNS_CRYPTO_LIBS="$NEWFLAGS"
+@@ -25442,6 +25478,8 @@ DNS_CRYPTO_LIBS="$NEWFLAGS"
 
 
 
@ -1104,7 +1104,7 @@ index 2a4d9ed..e4e8ea6 100755
 #
 # Commands to run at the end of config.status.
 # Don't just put these into configure, it won't work right if somebody
-@@ -27697,6 +27735,8 @@ report() {
+@@ -27819,6 +27857,8 @@ report() {
 	    echo "    IPv6 support (--enable-ipv6)"
 	test "X$CRYPTO" = "X" -o "yes" = "$want_native_pkcs11" || \
 		echo "    OpenSSL cryptography/DNSSEC (--with-openssl)"
@ -1113,7 +1113,7 @@ index 2a4d9ed..e4e8ea6 100755
 	test "X$PYTHON" = "X" || echo "    Python tools (--with-python)"
 	test "X$XMLSTATS" = "X" || echo "    XML statistics (--with-libxml2)"
 	test "X$JSONSTATS" = "X" || echo "    JSON statistics (--with-libjson)"
-@@ -27737,6 +27777,8 @@ report() {
+@@ -27859,6 +27899,8 @@ report() {
 	echo "    Very verbose query trace logging (--enable-querytrace)"
     test "no" = "$with_cmocka" || echo "    CMocka Unit Testing Framework (--with-cmocka)"
 
@ -1122,7 +1122,7 @@ index 2a4d9ed..e4e8ea6 100755
     echo "    Dynamically loadable zone (DLZ) drivers:"
     test "no" = "$use_dlz_bdb" || \
 	echo "        Berkeley DB (--with-dlz-bdb)"
-@@ -27784,6 +27826,8 @@ report() {
+@@ -27906,6 +27948,8 @@ report() {
 	echo "    ECDSA algorithm support (--with-ecdsa)"
     test "X$CRYPTO" = "X" -o "yes" = "$OPENSSL_ED25519" -o "yes" = "$PKCS11_ED25519" || \
 	echo "    EDDSA algorithm support (--with-eddsa)"
@ -1132,10 +1132,10 @@ index 2a4d9ed..e4e8ea6 100755
     test "yes" = "$enable_seccomp" || \
 	echo "    Use libseccomp system call filtering (--enable-seccomp)"
 diff --git a/configure.ac b/configure.ac
-index 0e22d02..828581e 100644
+index d10cde5..68bead8 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -1537,6 +1537,7 @@ case "$use_openssl" in
+@@ -1550,6 +1550,7 @@ case "$use_openssl" in
 		AC_MSG_RESULT(disabled because of native PKCS11)
 		DST_OPENSSL_INC=""
 		CRYPTO="-DPKCS11CRYPTO"
@ -1143,7 +1143,7 @@ index 0e22d02..828581e 100644
 		OPENSSLECDSALINKOBJS=""
 		OPENSSLECDSALINKSRCS=""
 		OPENSSLEDDSALINKOBJS=""
-@@ -1550,6 +1551,7 @@ case "$use_openssl" in
+@@ -1563,6 +1564,7 @@ case "$use_openssl" in
 		AC_MSG_RESULT(no)
 		DST_OPENSSL_INC=""
 		CRYPTO=""
@ -1151,7 +1151,7 @@ index 0e22d02..828581e 100644
 		OPENSSLECDSALINKOBJS=""
 		OPENSSLECDSALINKSRCS=""
 		OPENSSLEDDSALINKOBJS=""
-@@ -1562,6 +1564,7 @@ case "$use_openssl" in
+@@ -1575,6 +1577,7 @@ case "$use_openssl" in
 	auto)
 		DST_OPENSSL_INC=""
 		CRYPTO=""
@ -1159,7 +1159,7 @@ index 0e22d02..828581e 100644
 		OPENSSLECDSALINKOBJS=""
 		OPENSSLECDSALINKSRCS=""
 		OPENSSLEDDSALINKOBJS=""
-@@ -1572,7 +1575,7 @@ case "$use_openssl" in
+@@ -1585,7 +1588,7 @@ case "$use_openssl" in
 		OPENSSLLINKSRCS=""
 		AC_MSG_ERROR(
 [OpenSSL was not found in any of $openssldirs; use --with-openssl=/path
@ -1168,7 +1168,7 @@ index 0e22d02..828581e 100644
 		;;
 	*)
 		if test "yes" = "$want_native_pkcs11"
-@@ -1602,6 +1605,7 @@ If you don't want OpenSSL, use --without-openssl])
+@@ -1615,6 +1618,7 @@ If you don't want OpenSSL, use --without-openssl])
 			AC_MSG_ERROR(["$use_openssl/include/openssl/opensslv.h" not found])
 		fi
 		CRYPTO='-DOPENSSL'
@ -1176,7 +1176,7 @@ index 0e22d02..828581e 100644
 		if test "/usr" = "$use_openssl"
 		then
 			DST_OPENSSL_INC=""
-@@ -2037,7 +2041,6 @@ fi
+@@ -2050,7 +2054,6 @@ fi
 # Use OpenSSL for hash functions
 #
 
@ -1184,7 +1184,7 @@ index 0e22d02..828581e 100644
 ISC_PLATFORM_OPENSSLHASH="#undef ISC_PLATFORM_OPENSSLHASH"
 case $want_openssl_hash in
 	yes)
-@@ -2309,6 +2312,67 @@ if test "rt" = "$have_clock_gt"; then
+@@ -2322,6 +2325,67 @@ if test "rt" = "$have_clock_gt"; then
 	LIBS="-lrt $LIBS"
 fi
 
@ -1252,7 +1252,7 @@ index 0e22d02..828581e 100644
 #
 # was --with-lmdb specified?
 #
-@@ -4105,12 +4169,12 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
+@@ -4098,12 +4162,12 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
 ISC_PLATFORM_USESTDASM="#undef ISC_PLATFORM_USESTDASM"
 ISC_PLATFORM_USEMACASM="#undef ISC_PLATFORM_USEMACASM"
 if test "yes" = "$use_atomic"; then
@ -1266,7 +1266,7 @@ index 0e22d02..828581e 100644
 		if test $ac_cv_sizeof_void_p = 8; then
 			arch=x86_64
 			have_xaddq=yes
-@@ -4119,7 +4183,6 @@ if test "yes" = "$use_atomic"; then
+@@ -4112,7 +4176,6 @@ if test "yes" = "$use_atomic"; then
 		fi
 	;;
 	x86_64-*|amd64-*)
@ -1274,7 +1274,7 @@ index 0e22d02..828581e 100644
 		if test $ac_cv_sizeof_void_p = 8; then
 			arch=x86_64
 			have_xaddq=yes
-@@ -5534,6 +5597,8 @@ report() {
+@@ -5518,6 +5581,8 @@ report() {
 	    echo "    IPv6 support (--enable-ipv6)"
 	test "X$CRYPTO" = "X" -o "yes" = "$want_native_pkcs11" || \
 		echo "    OpenSSL cryptography/DNSSEC (--with-openssl)"
@ -1283,7 +1283,7 @@ index 0e22d02..828581e 100644
 	test "X$PYTHON" = "X" || echo "    Python tools (--with-python)"
 	test "X$XMLSTATS" = "X" || echo "    XML statistics (--with-libxml2)"
 	test "X$JSONSTATS" = "X" || echo "    JSON statistics (--with-libjson)"
-@@ -5574,6 +5639,8 @@ report() {
+@@ -5558,6 +5623,8 @@ report() {
 	echo "    Very verbose query trace logging (--enable-querytrace)"
     test "no" = "$with_cmocka" || echo "    CMocka Unit Testing Framework (--with-cmocka)"
 
@ -1292,7 +1292,7 @@ index 0e22d02..828581e 100644
     echo "    Dynamically loadable zone (DLZ) drivers:"
     test "no" = "$use_dlz_bdb" || \
 	echo "        Berkeley DB (--with-dlz-bdb)"
-@@ -5621,6 +5688,8 @@ report() {
+@@ -5605,6 +5672,8 @@ report() {
 	echo "    ECDSA algorithm support (--with-ecdsa)"
     test "X$CRYPTO" = "X" -o "yes" = "$OPENSSL_ED25519" -o "yes" = "$PKCS11_ED25519" || \
 	echo "    EDDSA algorithm support (--with-eddsa)"
@ -1302,10 +1302,10 @@ index 0e22d02..828581e 100644
     test "yes" = "$enable_seccomp" || \
 	echo "    Use libseccomp system call filtering (--enable-seccomp)"
 diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c
-index 320c0f8..b55ebe0 100644
+index 65bf25d..1eccbe7 100644
 --- a/lib/dns/dst_api.c
 +++ b/lib/dns/dst_api.c
-@@ -276,6 +276,12 @@ dst_lib_init2(isc_mem_t *mctx, isc_entropy_t *ectx,
+@@ -277,6 +277,12 @@ dst_lib_init2(isc_mem_t *mctx, isc_entropy_t *ectx,
 #ifdef GSSAPI
 	RETERR(dst__gssapi_init(&dst_t_func[DST_ALG_GSSAPI]));
 #endif
@ -1318,7 +1318,7 @@ index 320c0f8..b55ebe0 100644
 	dst_initialized = true;
 	return (ISC_R_SUCCESS);
 
-@@ -295,11 +301,19 @@ dst_lib_destroy(void) {
+@@ -296,11 +302,19 @@ dst_lib_destroy(void) {
 	for (i = 0; i < DST_MAX_ALGS; i++)
 		if (dst_t_func[i] != NULL && dst_t_func[i]->cleanup != NULL)
 			dst_t_func[i]->cleanup();
@ -1338,7 +1338,7 @@ index 320c0f8..b55ebe0 100644
 	if (dst__memory_pool != NULL)
 		isc_mem_detach(&dst__memory_pool);
 	if (dst_entropy_pool != NULL)
-@@ -2001,13 +2015,17 @@ dst__entropy_getdata(void *buf, unsigned int len, bool pseudo) {
+@@ -2002,13 +2016,17 @@ dst__entropy_getdata(void *buf, unsigned int len, bool pseudo) {
 		flags &= ~ISC_ENTROPY_GOODONLY;
 	else
 		flags |= ISC_ENTROPY_BLOCKING;
@ -1357,7 +1357,7 @@ index 320c0f8..b55ebe0 100644
 #ifdef GSSAPI
 	unsigned int flags = dst_entropy_flags;
 	isc_result_t ret;
-@@ -2030,6 +2048,7 @@ dst__entropy_status(void) {
+@@ -2031,6 +2049,7 @@ dst__entropy_status(void) {
 #endif
 	return (isc_entropy_status(dst_entropy_pool));
 #else
@ -1440,7 +1440,7 @@ index 304814b..60543c4 100644
 	isc_hash_destroy();
   cleanup_db:
 diff --git a/lib/dns/openssl_link.c b/lib/dns/openssl_link.c
-index d65ce26..6849732 100644
+index 13e838f..ffe0a69 100644
 --- a/lib/dns/openssl_link.c
 +++ b/lib/dns/openssl_link.c
@@ -31,6 +31,7 @@
@ -1476,7 +1476,7 @@ index d65ce26..6849732 100644
 #endif
 +#endif /* !ISC_PLATFORM_CRYPTORANDOM */
 
- #if OPENSSL_VERSION_NUMBER >= 0x10000000L && OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
+ #if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
 static void
@@ -192,7 +195,7 @@ _set_thread_id(CRYPTO_THREADID *id)
 isc_result_t
@ -1845,10 +1845,10 @@ index 0000000..bd3d164
 +
 +#endif
 diff --git a/lib/dns/win32/libdns.def.in b/lib/dns/win32/libdns.def.in
-index 5c45d59..34b660c 100644
+index 63be973..40b21fa 100644
 --- a/lib/dns/win32/libdns.def.in
 +++ b/lib/dns/win32/libdns.def.in
-@@ -1484,6 +1484,13 @@ dst_lib_destroy
+@@ -1485,6 +1485,13 @@ dst_lib_destroy
 dst_lib_init
 dst_lib_init2
 dst_lib_initmsgcat
@ -1863,7 +1863,7 @@ index 5c45d59..34b660c 100644
 dst_region_computerid
 dst_result_register
 diff --git a/lib/isc/entropy.c b/lib/isc/entropy.c
-index ab2f617..ed05ed6 100644
+index 907e470..451544d 100644
 --- a/lib/isc/entropy.c
 +++ b/lib/isc/entropy.c
@@ -104,11 +104,15 @@ struct isc_entropy {
@ -1921,10 +1921,10 @@ index ab2f617..ed05ed6 100644
 +	hook = myhook;
 +}
 diff --git a/lib/isc/include/isc/entropy.h b/lib/isc/include/isc/entropy.h
-index 4bba8e1..632166a 100644
+index e8733db..c40a18c 100644
 --- a/lib/isc/include/isc/entropy.h
 +++ b/lib/isc/include/isc/entropy.h
-@@ -304,6 +304,18 @@ isc_entropy_usebestsource(isc_entropy_t *ectx, isc_entropysource_t **source,
+@@ -302,6 +302,18 @@ isc_entropy_usebestsource(isc_entropy_t *ectx, isc_entropysource_t **source,
  *	isc_entropy_createcallbacksource().
  */
 
@ -1944,10 +1944,10 @@ index 4bba8e1..632166a 100644
 
 #endif /* ISC_ENTROPY_H */
 diff --git a/lib/isc/include/isc/platform.h.in b/lib/isc/include/isc/platform.h.in
-index 9c7c342..ee8dc3e 100644
+index 61960f1..d22993d 100644
 --- a/lib/isc/include/isc/platform.h.in
 +++ b/lib/isc/include/isc/platform.h.in
-@@ -341,6 +341,11 @@
+@@ -359,6 +359,11 @@
  */
 @ISC_PLATFORM_HAVESTRINGSH@
 
@ -1960,10 +1960,10 @@ index 9c7c342..ee8dc3e 100644
  * Define if the hash functions must be provided by OpenSSL.
  */
 diff --git a/lib/isc/include/isc/types.h b/lib/isc/include/isc/types.h
-index 42ff7e0..8d87c44 100644
+index da9d66f..4205400 100644
 --- a/lib/isc/include/isc/types.h
 +++ b/lib/isc/include/isc/types.h
-@@ -93,6 +93,8 @@ typedef struct isc_time			isc_time_t;		/*%< Time */
+@@ -97,6 +97,8 @@ typedef struct isc_time			isc_time_t;		/*%< Time */
 typedef struct isc_timer		isc_timer_t;		/*%< Timer */
 typedef struct isc_timermgr		isc_timermgr_t;		/*%< Timer Manager */
 
@ -1973,7 +1973,7 @@ index 42ff7e0..8d87c44 100644
 typedef int (*isc_sockfdwatch_t)(isc_task_t *, isc_socket_t *, void *, int);
 
 diff --git a/lib/isc/pk11.c b/lib/isc/pk11.c
-index 7809e7b..c43357a 100644
+index 68aebdc..4b85527 100644
 --- a/lib/isc/pk11.c
 +++ b/lib/isc/pk11.c
@@ -321,14 +321,16 @@ pk11_rand_seed_fromfile(const char *randomfile) {
@ -1999,10 +1999,10 @@ index 7809e7b..c43357a 100644
     cleanup:
 	if (stream != NULL)
 diff --git a/lib/isc/win32/include/isc/platform.h.in b/lib/isc/win32/include/isc/platform.h.in
-index 5b8a2c9..913a2ce 100644
+index 8ade705..fa72f9d 100644
 --- a/lib/isc/win32/include/isc/platform.h.in
 +++ b/lib/isc/win32/include/isc/platform.h.in
-@@ -69,6 +69,11 @@
+@@ -73,6 +73,11 @@
 #define ISC_PLATFORM_NORETURN_PRE __declspec(noreturn)
 #define ISC_PLATFORM_NORETURN_POST
 
@ -2015,10 +2015,10 @@ index 5b8a2c9..913a2ce 100644
  * Define if the hash functions must be provided by OpenSSL.
  */
 diff --git a/win32utils/Configure b/win32utils/Configure
-index 6f93814..4286baf 100644
+index 79d682e..6c78cb2 100644
 --- a/win32utils/Configure
 +++ b/win32utils/Configure
-@@ -378,6 +378,7 @@ my @substdefh = ("ALLOW_FILTER_AAAA",
+@@ -382,6 +382,7 @@ my @substdefh = ("ALLOW_FILTER_AAAA",
 my %configdefp;
 
 my @substdefp = ("ISC_PLATFORM_BUSYWAITNOP",
@ -2026,7 +2026,7 @@ index 6f93814..4286baf 100644
                  "ISC_PLATFORM_HAVEATOMICSTORE",
                  "ISC_PLATFORM_HAVEATOMICSTOREQ",
                  "ISC_PLATFORM_HAVECMPXCHG",
-@@ -508,7 +509,8 @@ my @allcond = (@substcond, "NOTYET", "NOLONGER");
+@@ -517,7 +518,8 @@ my @allcond = (@substcond, "NOTYET", "NOLONGER");
 
 # enable-xxx/disable-xxx
 
@ -2036,15 +2036,15 @@ index 6f93814..4286baf 100644
                   "fixed-rrset",
                   "intrinsics",
                   "isc-spnego",
-@@ -572,6 +574,7 @@ my @help = (
+@@ -580,6 +582,7 @@ my @help = (
 "\nOptional Features:\n",
- "  enable-intrinsics     enable instrinsic/atomic functions [default=yes]\n",
+ "  enable-intrinsics     enable intrinsic/atomic functions [default=yes]\n",
 "  enable-native-pkcs11  use native PKCS#11 for all crypto [default=no]\n",
 +"  enable-crypto-rand    use crypto provider for random [default=yes]\n",
 "  enable-openssl-hash   use OpenSSL for hash functions [default=yes]\n",
 "  enable-isc-spnego     use SPNEGO from lib/dns [default=yes]\n",
 "  enable-filter-aaaa    enable filtering of AAAA records [default=yes]\n",
-@@ -617,7 +620,9 @@ my $want_clean = "no";
+@@ -628,7 +631,9 @@ my $want_clean = "no";
 my $want_unknown = "no";
 my $unknown_value;
 my $enable_intrinsics = "yes";
@ -2054,7 +2054,7 @@ index 6f93814..4286baf 100644
 my $enable_openssl_hash = "auto";
 my $enable_filter_aaaa = "yes";
 my $enable_isc_spnego = "yes";
-@@ -837,6 +842,10 @@ sub myenable {
+@@ -847,6 +852,10 @@ sub myenable {
         if ($val =~ /^yes$/i) {
             $enable_native_pkcs11 = "yes";
         }
@ -2065,7 +2065,7 @@ index 6f93814..4286baf 100644
     } elsif ($key =~ /^openssl-hash$/i) {
         if ($val =~ /^yes$/i) {
             $enable_openssl_hash = "yes";
-@@ -1139,6 +1148,11 @@ if ($verbose) {
+@@ -1153,6 +1162,11 @@ if ($verbose) {
     } else {
         print "native-pkcs11: disabled\n";
     }
@ -2077,7 +2077,7 @@ index 6f93814..4286baf 100644
     if ($enable_openssl_hash eq "yes") {
         print "openssl-hash: enabled\n";
     } else {
-@@ -1497,6 +1511,7 @@ if ($enable_intrinsics eq "yes") {
+@@ -1510,6 +1524,7 @@ if ($enable_intrinsics eq "yes") {
 
 # enable-native-pkcs11
 if ($enable_native_pkcs11 eq "yes") {
@ -2085,7 +2085,7 @@ index 6f93814..4286baf 100644
     if ($use_openssl eq "auto") {
         $use_openssl = "no";
     }
-@@ -1706,6 +1721,7 @@ if ($use_openssl eq "yes") {
+@@ -1719,6 +1734,7 @@ if ($use_openssl eq "yes") {
         $openssl_dll = File::Spec->catdir($openssl_path, "@dirlist[0]");
     }   
 
@ -2093,7 +2093,7 @@ index 6f93814..4286baf 100644
     $configcond{"OPENSSL"} = 1;
     $configdefd{"CRYPTO"} = "OPENSSL";
     $configvar{"OPENSSL_PATH"} = "$openssl_path";
-@@ -2242,6 +2258,15 @@ if ($use_aes eq "yes") {
+@@ -2290,6 +2306,15 @@ if ($use_aes eq "yes") {
 }
 
 
@ -2109,7 +2109,7 @@ index 6f93814..4286baf 100644
 # enable-openssl-hash
 if ($enable_openssl_hash eq "yes") {
     if ($use_openssl eq "no") {
-@@ -3617,6 +3642,7 @@ exit 0;
+@@ -3665,6 +3690,7 @@ exit 0;
 #  --enable-developer partially supported
 #  --enable-newstats (9.9/9.9sub only)
 #  --enable-native-pkcs11 supported
@ -2118,5 +2118,5 @@ index 6f93814..4286baf 100644
 #  --enable-openssl-hash supported
 #  --enable-threads included without a way to disable it
 -- 
-2.20.1
+2.21.1

--- a/bind-9.11-rt46047.patch
+++ b/bind-9.11-rt46047.patch
@ -1,4 +1,4 @@
-From ab9ee91f596c14cfc55a67ba3523b42a54e3e244 Mon Sep 17 00:00:00 2001
+From 8a064944dc10421a387725a365650d656d2a97f1 Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Thu, 28 Sep 2017 10:09:22 -0700
 Subject: [PATCH] completed and corrected the crypto-random change
@ -39,14 +39,16 @@ Subject: [PATCH] completed and corrected the crypto-random change
 bin/tests/system/tkey/keycreate.c        |  4 +-
 bin/tests/system/tkey/keydelete.c        |  5 +--
 doc/arm/Bv9ARM-book.xml                  | 55 +++++++++++++++++-------
- doc/arm/notes.xml                        | 31 +++++++++++++
+ doc/arm/notes-rh-changes.xml             | 42 ++++++++++++++++++
+ doc/arm/notes.xml                        |  1 +
 lib/dns/dst_api.c                        |  4 +-
 lib/dns/include/dst/dst.h                | 14 +++++-
 lib/dns/openssl_link.c                   |  3 +-
- lib/isc/include/isc/entropy.h            | 50 +++++++++++++++------
+ lib/isc/include/isc/entropy.h            | 48 +++++++++++++++------
 lib/isc/include/isc/random.h             | 28 +++++++-----
 lib/isccfg/namedconf.c                   |  2 +-
- 22 files changed, 228 insertions(+), 106 deletions(-)
+ 23 files changed, 240 insertions(+), 104 deletions(-)
+ create mode 100644 doc/arm/notes-rh-changes.xml

 diff --git a/bin/confgen/keygen.c b/bin/confgen/keygen.c
 index 295e16f..0f79aa8 100644
@ -76,10 +78,10 @@ index 295e16f..0f79aa8 100644
 							     &entropy_source,
 							     randomfile,
 diff --git a/bin/dnssec/dnssec-keygen.docbook b/bin/dnssec/dnssec-keygen.docbook
-index 0ae6b41..4562430 100644
+index 1826919..96543fc 100644
 --- a/bin/dnssec/dnssec-keygen.docbook
 +++ b/bin/dnssec/dnssec-keygen.docbook
-@@ -348,15 +348,23 @@
+@@ -349,15 +349,23 @@
 	<term>-r <replaceable class="parameter">randomdev</replaceable></term>
 	<listitem>
 	  <para>
@ -112,7 +114,7 @@ index 0ae6b41..4562430 100644
 	</listitem>
       </varlistentry>
 diff --git a/bin/dnssec/dnssectool.c b/bin/dnssec/dnssectool.c
-index 31a99e7..38c83ed 100644
+index 5654435..24c0d5a 100644
 --- a/bin/dnssec/dnssectool.c
 +++ b/bin/dnssec/dnssectool.c
@@ -241,18 +241,16 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
@ -140,10 +142,10 @@ index 31a99e7..38c83ed 100644
 					   usekeyboard);
 
 diff --git a/bin/named/client.c b/bin/named/client.c
-index 29fecad..a12623a 100644
+index f4a5ff9..58549d3 100644
 --- a/bin/named/client.c
 +++ b/bin/named/client.c
-@@ -1752,7 +1752,8 @@ ns_client_addopt(ns_client_t *client, dns_message_t *message,
+@@ -1765,7 +1765,8 @@ ns_client_addopt(ns_client_t *client, dns_message_t *message,
 
 		isc_buffer_init(&buf, cookie, sizeof(cookie));
 		isc_stdtime_get(&now);
@ -154,10 +156,10 @@ index 29fecad..a12623a 100644
 		compute_cookie(client, now, nonce, ns_g_server->secret, &buf);
 
 diff --git a/bin/named/config.c b/bin/named/config.c
-index a153172..8d46bc3 100644
+index eef8181..ff868b8 100644
 --- a/bin/named/config.c
 +++ b/bin/named/config.c
-@@ -93,7 +93,9 @@ options {\n\
+@@ -98,7 +98,9 @@ options {\n\
 #	pid-file \"" NS_LOCALSTATEDIR "/run/named/named.pid\"; /* or /lwresd.pid */\n\
 	port 53;\n\
 	prefetch 2 9;\n"
@ -221,7 +223,7 @@ index d955c2f..40621f2 100644
 	} else
 		eresult = ns_control_docommand(request, listener->readonly, &text);
 diff --git a/bin/named/include/named/server.h b/bin/named/include/named/server.h
-index f5ed2b7..b2c1d05 100644
+index 3f96b7b..c92922e 100644
 --- a/bin/named/include/named/server.h
 +++ b/bin/named/include/named/server.h
@@ -20,6 +20,7 @@
@ -241,7 +243,7 @@ index f5ed2b7..b2c1d05 100644
 
 struct ns_altsecret {
 diff --git a/bin/named/interfacemgr.c b/bin/named/interfacemgr.c
-index 135533b..4546831 100644
+index 9dea7c1..272d300 100644
 --- a/bin/named/interfacemgr.c
 +++ b/bin/named/interfacemgr.c
@@ -17,6 +17,7 @@
@ -253,7 +255,7 @@ index 135533b..4546831 100644
 #include <isc/task.h>
 #include <isc/util.h>
 diff --git a/bin/named/query.c b/bin/named/query.c
-index f85cc76..43a3661 100644
+index 203f1e6..25eeced 100644
 --- a/bin/named/query.c
 +++ b/bin/named/query.c
@@ -19,6 +19,7 @@
@ -265,10 +267,10 @@ index f85cc76..43a3661 100644
 #include <isc/serial.h>
 #include <isc/stats.h>
 diff --git a/bin/named/server.c b/bin/named/server.c
-index 405ff71..700f83d 100644
+index 7b3b736..4aaa92f 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
-@@ -8203,21 +8203,32 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8234,21 +8234,32 @@ load_configuration(const char *filename, ns_server_t *server,
 	 * Open the source of entropy.
 	 */
 	if (first_time) {
@ -310,7 +312,7 @@ index 405ff71..700f83d 100644
 #ifdef PATH_RANDOMDEV
 			if (ns_g_fallbackentropy != NULL) {
 				level = ISC_LOG_INFO;
-@@ -8228,8 +8239,8 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8259,8 +8270,8 @@ load_configuration(const char *filename, ns_server_t *server,
 					      NS_LOGCATEGORY_GENERAL,
 					      NS_LOGMODULE_SERVER,
 					      level,
@ -321,15 +323,15 @@ index 405ff71..700f83d 100644
 					      randomdev,
 					      isc_result_totext(result));
 			}
-@@ -8249,7 +8260,6 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8280,7 +8291,6 @@ load_configuration(const char *filename, ns_server_t *server,
 				}
 				isc_entropy_detach(&ns_g_fallbackentropy);
 			}
 -#endif
 #endif
 		}
- 	}
-@@ -9014,6 +9024,7 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
+ 
+@@ -9049,6 +9059,7 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
 	server->in_roothints = NULL;
 	server->blackholeacl = NULL;
 	server->keepresporder = NULL;
@ -337,7 +339,7 @@ index 405ff71..700f83d 100644
 
 	/* Must be first. */
 	CHECKFATAL(dst_lib_init2(ns_g_mctx, ns_g_entropy,
-@@ -9040,6 +9051,9 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
+@@ -9075,6 +9086,9 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
 	CHECKFATAL(dns_tkeyctx_create(ns_g_mctx, ns_g_entropy,
 				      &server->tkeyctx),
 		   "creating TKEY context");
@ -347,7 +349,7 @@ index 405ff71..700f83d 100644
 
 	/*
 	 * Setup the server task, which is responsible for coordinating
-@@ -9246,7 +9260,8 @@ ns_server_destroy(ns_server_t **serverp) {
+@@ -9281,7 +9295,8 @@ ns_server_destroy(ns_server_t **serverp) {
 
 	if (server->zonemgr != NULL)
 		dns_zonemgr_detach(&server->zonemgr);
@ -357,7 +359,7 @@ index 405ff71..700f83d 100644
 	if (server->tkeyctx != NULL)
 		dns_tkeyctx_destroy(&server->tkeyctx);
 
-@@ -13197,10 +13212,10 @@ newzone_cfgctx_destroy(void **cfgp) {
+@@ -13316,10 +13331,10 @@ newzone_cfgctx_destroy(void **cfgp) {
 
 static isc_result_t
 generate_salt(unsigned char *salt, size_t saltlen) {
@ -370,7 +372,7 @@ index 405ff71..700f83d 100644
 	} rnd;
 	unsigned char text[512 + 1];
 	isc_region_t r;
-@@ -13210,9 +13225,10 @@ generate_salt(unsigned char *salt, size_t saltlen) {
+@@ -13329,9 +13344,10 @@ generate_salt(unsigned char *salt, size_t saltlen) {
 	if (saltlen > 256U)
 		return (ISC_R_RANGE);
 
@ -385,10 +387,10 @@ index 405ff71..700f83d 100644
 	memmove(salt, rnd.rnd, saltlen);
 
 diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
-index 0286987..0376377 100644
+index 2436731..6f59456 100644
 --- a/bin/nsupdate/nsupdate.c
 +++ b/bin/nsupdate/nsupdate.c
-@@ -283,9 +283,7 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
+@@ -284,9 +284,7 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
 	}
 
 #ifdef ISC_PLATFORM_CRYPTORANDOM
@ -400,10 +402,10 @@ index 0286987..0376377 100644
 	}
 #endif
 diff --git a/bin/tests/system/pipelined/pipequeries.c b/bin/tests/system/pipelined/pipequeries.c
-index 7b4f617..507bf0a 100644
+index f0a6ff2..55064f6 100644
 --- a/bin/tests/system/pipelined/pipequeries.c
 +++ b/bin/tests/system/pipelined/pipequeries.c
-@@ -282,9 +282,7 @@ main(int argc, char *argv[]) {
+@@ -280,9 +280,7 @@ main(int argc, char *argv[]) {
 	ectx = NULL;
 	RUNCHECK(isc_entropy_create(mctx, &ectx));
 #ifdef ISC_PLATFORM_CRYPTORANDOM
@ -453,22 +455,22 @@ index 2146f9b..64b8e74 100644
 	}
 #endif
 diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
-index b40cb05..8a81438 100644
+index 1da0565..7eef5b2 100644
 --- a/doc/arm/Bv9ARM-book.xml
 +++ b/doc/arm/Bv9ARM-book.xml
-@@ -5071,22 +5071,45 @@ badresp:1,adberr:0,findfail:0,valfail:0]
+@@ -5034,22 +5034,45 @@ badresp:1,adberr:0,findfail:0,valfail:0]
 	    <term><command>random-device</command></term>
 	    <listitem>
 	      <para>
-		The source of entropy to be used by the server.  Entropy is
+-		This specifies a source of entropy to be used by the server.  Entropy is
 -		primarily needed
 -		for DNSSEC operations, such as TKEY transactions and dynamic
 -		update of signed
-		zones.  This options specifies the device (or file) from which
+-		zones.  This option specifies the device (or file) from which
 -		to read
-		entropy.  If this is a file, operations requiring entropy will
+-		entropy.  If it is a file, operations requiring entropy will
 -		fail when the
-		file has been exhausted.  If not specified, the default value
+-		file has been exhausted.  If <command>random-device</command> is not specified, the default value
 -		is
 -		<filename>/dev/random</filename>
 -		(or equivalent) when present, and none otherwise.  The
@ -518,53 +520,71 @@ index b40cb05..8a81438 100644
 	      </para>
 	    </listitem>
 	  </varlistentry>
+diff --git a/doc/arm/notes-rh-changes.xml b/doc/arm/notes-rh-changes.xml
+new file mode 100644
+index 0000000..89a4961
+--- /dev/null
+++ b/doc/arm/notes-rh-changes.xml
+@@ -0,0 +1,42 @@
+<!--
+ - Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ -
+ - This Source Code Form is subject to the terms of the Mozilla Public
+ - License, v. 2.0. If a copy of the MPL was not distributed with this
+ - file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ -
+ - See the COPYRIGHT file distributed with this work for additional
+ - information regarding copyright ownership.
+-->
+
+<section xml:id="relnotes_rh_changes"><info><title>Red Hat Specific Changes</title></info>
+  <itemizedlist>
+     <listitem>
+      <para>
+        By default, BIND now uses the random number generation functions
+        in the cryptographic library (i.e., OpenSSL or a PKCS#11
+        provider) as a source of high-quality randomness rather than
+        <filename>/dev/random</filename>.  This is suitable for virtual
+        machine environments, which may have limited entropy pools and
+        lack hardware random number generators.
+      </para>
+      <para>
+        This can be overridden by specifying another entropy source via
+        the <command>random-device</command> option in
+        <filename>named.conf</filename>, or via the <command>-r</command>
+        command line option.  However, for functions requiring full
+        cryptographic strength, such as DNSSEC key generation, this
+        <emphasis>cannot</emphasis> be overridden. In particular, the
+        <command>-r</command> command line option no longer has any
+        effect on <command>dnssec-keygen</command>.
+      </para>
+      <para>
+        This can be disabled by building with
+        <command>configure --disable-crypto-rand</command>, in which
+        case <filename>/dev/random</filename> will be the default
+        entropy source.  [RT #31459] [RT #46047]
+      </para>
+    </listitem>
+  </itemizedlist>
+</section>
+
 diff --git a/doc/arm/notes.xml b/doc/arm/notes.xml
-index 00ce8f1..527135a 100644
+index adffaa0..2ffe344 100644
 --- a/doc/arm/notes.xml
 +++ b/doc/arm/notes.xml
-@@ -124,6 +124,37 @@
-     </itemizedlist>
-   </section>
+@@ -45,6 +45,7 @@
+   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-9.11.1.xml"/>
+   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-9.11.0.xml"/>
 
-+  <section xml:id="relnotes_rh_changes"><info><title>Red Hat Specific Changes</title></info>
-+    <itemizedlist>
-+       <listitem>
-+	<para>
-+	  By default, BIND now uses the random number generation functions
-+	  in the cryptographic library (i.e., OpenSSL or a PKCS#11
-+	  provider) as a source of high-quality randomness rather than
-+	  <filename>/dev/random</filename>.  This is suitable for virtual
-+	  machine environments, which may have limited entropy pools and
-+	  lack hardware random number generators.
-+	</para>
-+	<para>
-+	  This can be overridden by specifying another entropy source via
-+	  the <command>random-device</command> option in
-+	  <filename>named.conf</filename>, or via the <command>-r</command>
-+	  command line option.  However, for functions requiring full
-+	  cryptographic strength, such as DNSSEC key generation, this
-+	  <emphasis>cannot</emphasis> be overridden. In particular, the
-+	  <command>-r</command> command line option no longer has any
-+	  effect on <command>dnssec-keygen</command>.
-+	</para>
-+	<para>
-+	  This can be disabled by building with
-+	  <command>configure --disable-crypto-rand</command>, in which
-+	  case <filename>/dev/random</filename> will be the default
-+	  entropy source.  [RT #31459] [RT #46047]
-+	</para>
-+      </listitem>
-+    </itemizedlist>
-+  </section>
-+
-   <section xml:id="end_of_life"><info><title>End of Life</title></info>
-     <para>
-       BIND 9.11 (Extended Support Version) will be supported until at
+  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-rh-changes.xml"/>
+   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-eol.xml"/>
+   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-thankyou.xml"/>
+ </section>
 diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c
-index b55ebe0..d2b43d3 100644
+index 1eccbe7..1933993 100644
 --- a/lib/dns/dst_api.c
 +++ b/lib/dns/dst_api.c
-@@ -2016,10 +2016,12 @@ dst__entropy_getdata(void *buf, unsigned int len, bool pseudo) {
+@@ -2017,10 +2017,12 @@ dst__entropy_getdata(void *buf, unsigned int len, bool pseudo) {
 	else
 		flags |= ISC_ENTROPY_BLOCKING;
 #ifdef ISC_PLATFORM_CRYPTORANDOM
@ -604,7 +624,7 @@ index 6813c96..665574d 100644
 
 bool
 diff --git a/lib/dns/openssl_link.c b/lib/dns/openssl_link.c
-index 6849732..e00a0e4 100644
+index ffe0a69..5e48686 100644
 --- a/lib/dns/openssl_link.c
 +++ b/lib/dns/openssl_link.c
@@ -484,7 +484,8 @@ dst__openssl_getengine(const char *engine) {
@ -618,19 +638,10 @@ index 6849732..e00a0e4 100644
 #ifndef DONT_REQUIRE_DST_LIB_INIT
 	INSIST(dst__memory_pool != NULL);
 diff --git a/lib/isc/include/isc/entropy.h b/lib/isc/include/isc/entropy.h
-index 632166a..c7cb17d 100644
+index c40a18c..c7cb17d 100644
 --- a/lib/isc/include/isc/entropy.h
 +++ b/lib/isc/include/isc/entropy.h
-@@ -9,8 +9,6 @@
-  * information regarding copyright ownership.
-  */
- 
-/* $Id: entropy.h,v 1.35 2009/10/19 02:37:08 marka Exp $ */
-
- #ifndef ISC_ENTROPY_H
- #define ISC_ENTROPY_H 1
- 
-@@ -191,9 +189,8 @@ isc_entropy_createcallbacksource(isc_entropy_t *ent,
+@@ -189,9 +189,8 @@ isc_entropy_createcallbacksource(isc_entropy_t *ent,
 /*!<
  * \brief Create an entropy source that is polled via a callback.
  *
@ -642,18 +653,23 @@ index 632166a..c7cb17d 100644
  *
  * Samples are added via isc_entropy_addcallbacksample(), below.
  * _addcallbacksample() is the only function which may be called from
-@@ -234,15 +231,32 @@ isc_result_t
+@@ -232,15 +231,32 @@ isc_result_t
 isc_entropy_getdata(isc_entropy_t *ent, void *data, unsigned int length,
 		    unsigned int *returned, unsigned int flags);
 /*!<
 - * \brief Extract data from the entropy pool.  This may load the pool from various
 - * sources.
 + * \brief Get random data from entropy pool 'ent'.
-+ *
+  *
+- * Do this by stirring the pool and returning a part of hash as randomness.
+- * Note that no secrets are given away here since parts of the hash are
+- * xored together before returned.
 + * If a hook has been set up using isc_entropy_sethook() and
 + * isc_entropy_usehook(), then the hook function will be called to get
 + * random data.
-+ *
+  *
+- * Honor the request from the caller to only return good data, any data,
+- * etc.
 + * Otherwise, randomness is extracted from the entropy pool set up in BIND.
 + * This may cause the pool to be loaded from various sources. Ths is done
 + * by stirring the pool and returning a part of hash as randomness.
@ -664,17 +680,12 @@ index 632166a..c7cb17d 100644
 + * ISC_ENTROPY_BLOCKING. These will be honored if the hook function is
 + * not in use. If it is, the flags will be passed to the hook function
 + * but it may ignore them.
-  *
- * Do this by stiring the pool and returning a part of hash as randomness.
- * Note that no secrets are given away here since parts of the hash are
- * xored together before returned.
+ *
 + * Up to 'length' bytes of randomness are retrieved and copied into 'data'.
 + * (If 'returned' is not NULL, and the number of bytes copied is less than
 + * 'length' - which may happen if ISC_ENTROPY_PARTIAL was used - then the
 + * number of bytes copied will be stored in *returned.)
-  *
- * Honor the request from the caller to only return good data, any data,
- * etc.
+ *
 + * Returns:
 + * \li	ISC_R_SUCCESS on success
 + * \li	ISC_R_NOENTROPY if entropy pool is empty
@ -682,7 +693,7 @@ index 632166a..c7cb17d 100644
  */
 
 void
-@@ -307,13 +321,21 @@ isc_entropy_usebestsource(isc_entropy_t *ectx, isc_entropysource_t **source,
+@@ -305,13 +321,21 @@ isc_entropy_usebestsource(isc_entropy_t *ectx, isc_entropysource_t **source,
 void
 isc_entropy_usehook(isc_entropy_t *ectx, bool onoff);
 /*!<
@ -761,7 +772,7 @@ index f8aed34..17c551b 100644
 
 ISC_LANG_ENDDECLS
 diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
-index fbc62cc..9cad61d 100644
+index 1c45d5c..91693b5 100644
 --- a/lib/isccfg/namedconf.c
 +++ b/lib/isccfg/namedconf.c
@@ -1109,7 +1109,7 @@ options_clauses[] = {
@ -774,5 +785,5 @@ index fbc62cc..9cad61d 100644
 	{ "recursive-clients", &cfg_type_uint32, 0 },
 	{ "reserved-sockets", &cfg_type_uint32, 0 },
 -- 
-2.20.1
+2.26.2

--- a/bind-9.11-tests-variants.patch
+++ b/bind-9.11-tests-variants.patch
@ -1,4 +1,4 @@
-From 06a22ff20ac3d68fa1f995c91068b43392425e43 Mon Sep 17 00:00:00 2001
+From 9576e960ad3719aa9c1707734ad7ba0eccf16e5f Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Fri, 1 Mar 2019 15:48:20 +0100
 Subject: [PATCH] Make alternative named builds testable in system tests
@ -13,14 +13,14 @@ export NAMED_VARIANT=-sdb DNSSEC_VARIANT=
 For pkcs variant use:
 export NAMED_VARIANT=-pkcs11 DNSSEC_VARIANT=-pkcs11
 ---
- bin/tests/system/conf.sh.in | 19 ++++++++++---------
- 1 file changed, 10 insertions(+), 9 deletions(-)
+ bin/tests/system/conf.sh.in | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)

 diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
-index 4b0fe39..f135af6 100644
+index 6f2dbcd..05605ae 100644
 --- a/bin/tests/system/conf.sh.in
 +++ b/bin/tests/system/conf.sh.in
-@@ -34,7 +34,7 @@ DISABLED_ALGORITHM=ECDSAP384SHA384
+@@ -37,7 +37,7 @@ DISABLED_ALGORITHM=ECDSAP384SHA384
 DISABLED_ALGORITHM_NUMBER=14
 DISABLED_BITS=384
 
@ -29,7 +29,7 @@ index 4b0fe39..f135af6 100644
 # We must use "named -l" instead of "lwresd" because argv[0] is lost
 # if the program is libtoolized.
 LWRESD="$TOP/bin/named/named -l"
-@@ -45,13 +45,14 @@ NSUPDATE=$TOP/bin/nsupdate/nsupdate
+@@ -48,14 +48,14 @@ NSUPDATE=$TOP/bin/nsupdate/nsupdate
 DDNSCONFGEN=$TOP/bin/confgen/ddns-confgen
 TSIGKEYGEN=$TOP/bin/confgen/tsig-keygen
 RNDCCONFGEN=$TOP/bin/confgen/rndc-confgen
@ -39,19 +39,19 @@ index 4b0fe39..f135af6 100644
 -REVOKE=$TOP/bin/dnssec/dnssec-revoke
 -SETTIME=$TOP/bin/dnssec/dnssec-settime
 -DSFROMKEY=$TOP/bin/dnssec/dnssec-dsfromkey
-IMPORTKEY=$TOP/bin/dnssec/dnssec-importkey
 +KEYGEN=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-keygen${DNSSEC_VARIANT}
 +KEYFRLAB=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-keyfromlabel${DNSSEC_VARIANT}
 +SIGNER=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-signzone${DNSSEC_VARIANT}
 +REVOKE=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-revoke${DNSSEC_VARIANT}
 +SETTIME=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-settime${DNSSEC_VARIANT}
 +DSFROMKEY=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-dsfromkey${DNSSEC_VARIANT}
+ HOST=$TOP/bin/dig/host
+-IMPORTKEY=$TOP/bin/dnssec/dnssec-importkey
 +IMPORTKEY=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-importkey${DNSSEC_VARIANT}
-+CHECKDS=$TOP/bin/python/dnssec-checkds
 CHECKDS=$TOP/bin/python/dnssec-checkds
 COVERAGE=$TOP/bin/python/dnssec-coverage
 KEYMGR=$TOP/bin/python/dnssec-keymgr
-@@ -71,7 +72,7 @@ DNSTAPREAD=$TOP/bin/tools/dnstap-read
+@@ -75,7 +75,7 @@ DNSTAPREAD=$TOP/bin/tools/dnstap-read
 MDIG=$TOP/bin/tools/mdig
 NZD2NZF=$TOP/bin/tools/named-nzd2nzf
 FSTRM_CAPTURE=@FSTRM_CAPTURE@
@ -61,5 +61,5 @@ index 4b0fe39..f135af6 100644
 RANDFILE=$TOP/bin/tests/system/random.data
 
 -- 
-2.20.1
+2.21.1

--- a/bind-9.11.11.tar.gz.asc
+++ b/bind-9.11.11.tar.gz.asc
@ -1,16 +0,0 @@
-----BEGIN PGP SIGNATURE-----
-
-iQIzBAABAgAdFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAl16E/oACgkQdLtrmky7
-PTj5wQ//ZzItGqypNVGqYlocyQZRjvzjqJiPwIfgp7qpvDxQp7CPNuPqx35G0Xu6
-UJNKGZfJRKCoIrnN1QdBCXe+6ggl2O7iB3LJAeOiWz7oPj4DI2xTDu2oKKBkqLwF
-OimFr5B3F8wn59Bn2WgBpqjM3rv+kW2sQpahfBaYSYhqg0hmgOtn3Ksiopy+32l9
-0SNVhXtI+s1x2MCEdGweb24FJ663VC2rx5PJaD/59VPW3tXanemmTq6rLvdht+OE
-8zmTTQDPTu3CJFBnOwxBLvuvQDHvbVqiaU0o6nVHBow5D3FxL2R9ybNGBETY5af0
-7NqH9XEoeKFFRRdsEcTIRuLVQMdPl3dHWjCW0LeGjdOOwN5H8Yc1DGhfAaS3cD26
-d6L3cr6X9M7zTbKPTCYeNh/ydA3o4HRZV2LW3txac4qz2wxNaXytfsIGKb0Ag08U
-5MdGBdBbavDsX8aaRUHB0uiLL2U6rIm9dHeXWeed4B45YWMQ/kyEWqV5LYCHLq4F
-Hl2Tnjmp3YeE5qJHJtyXpOhhMYTVm6xACe72djyifxlJZlagBZihEc1D7xy/+Dmg
-JsBoA/X9C8RYGR/uAfxFiTQRNJtRdbPg168m/fV3cqo7m9mZGUdJOF51TSEOzfxx
-6RFuOl+R0YvyTtjBZaY2eeKRLdSc0uLHETRh+NmBHDx8bxSm8DM=
-=/ZDI
-----END PGP SIGNATURE-----
--- a/bind-9.11.12.tar.gz.asc
+++ b/bind-9.11.12.tar.gz.asc
@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABAgAdFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAl2WMooACgkQdLtrmky7
+PThv2RAAnXNLYTzXtH6ls29tRm5Hc+D6UaeqcWDNQ4BpkRVhrFxtukalGCi9mmB6
+NPJzFyXmaOW654pypCIuEgqJNFUpDtLzLzT7SUF+mhm+5plsaRSBnh4mq87l5KSp
+twODAPnfCJV+HBk5RmToLEstAbGQ7xEBTyQtZoFkY+V7zEFwENKiCvWsoSWOkYR3
+zXo3sKjc83HV9ShbW/mCtbZf5L0qlbrKOAzqJfAFMhNNJi8kMbmr/Zi2sIfN+Rhv
+g8HQo89Epv6r51yAdeED8idIX4rKjjcEtHrZeDmLdCcdHgSEj2sIlH92Joce6vL0
+S59A0rItIXm6fW8sz6WNpcj4tVtWYbIYjXZ4SPFNkaUrHv8cUekq+5vbI+v07Gh3
+2bhtDsDyTY5I1/AsY/EFmwkCAjUS00jZryBnuJpLB3v5JtUog4ek32yLBzPrqRBo
+1876j4nlXAia8mG0OgJNWZ0gHyUPe/TgfR8fQDLmHxHHlKrJNTEwY6bLW8jzFTX1
+zk510fI1K7J9tiQgf5wcBQ2h3EBlqzDNIJDovoATzLYIf0HKyVegh/vnQdtdEhUR
+1DzJAt3bsBfAP1AFfWPD/ACu5Zdm7SxY1wE/pjkwttDU3sRZqOfuwNBGeolu3cVN
+O9/h1zsyVeVS0ui2vu4+V4EvNitmXsVbG2doDq9L5yBiIKGO2Ew=
+=GCy6
+-----END PGP SIGNATURE-----
--- a/bind-9.3.2b1-fix_sdb_ldap.patch
+++ b/bind-9.3.2b1-fix_sdb_ldap.patch
@ -1,5 +1,5 @@
 diff --git a/bin/sdb_tools/Makefile.in b/bin/sdb_tools/Makefile.in
-index 95ab742..6069f09 100644
+index 95ab742..5059a17 100644
 --- a/bin/sdb_tools/Makefile.in
 +++ b/bin/sdb_tools/Makefile.in
@@ -32,11 +32,11 @@ DEPLIBS =	${LWRESDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
@ -7,49 +7,46 @@ index 95ab742..6069f09 100644
 		${ISCCFGLIBS} ${ISCCCLIBS} ${ISCLIBS} ${DBDRIVER_LIBS} @LIBS@
 
 -TARGETS =	zone2ldap@EXEEXT@ zonetodb@EXEEXT@ zone2sqlite@EXEEXT@
-+TARGETS =	zone2ldap@EXEEXT@ ldap2zone@EXEEXT@ zonetodb@EXEEXT@ zone2sqlite@EXEEXT@
+TARGETS =	zone2ldap@EXEEXT@ zonetodb@EXEEXT@ zone2sqlite@EXEEXT@ ldap2zone@EXEEXT@
 
 -OBJS	=	zone2ldap.@O@ zonetodb.@O@ zone2sqlite.@O@
-+OBJS	=	zone2ldap.@O@ ldap2zone.@O@ zonetodb.@O@ zone2sqlite.@O@
+OBJS	=	zone2ldap.@O@ zonetodb.@O@ zone2sqlite.@O@ ldap2zone.@O@
 
 -SRCS    =       zone2ldap.c zonetodb.c zone2sqlite.c
-+SRCS    =       zone2ldap.c ldap2zone.c zonetodb.c zone2sqlite.c
+SRCS    =       zone2ldap.c zonetodb.c zone2sqlite.c ldap2zone.c
 
 MANPAGES =      zone2ldap.1
 
-@@ -53,6 +53,9 @@ zonetodb@EXEEXT@: zonetodb.@O@  ${DEPLIBS}
- zone2sqlite@EXEEXT@: zone2sqlite.@O@  ${DEPLIBS}
- 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${ALL_CFLAGS} ${LDFLAGS} -o $@ zone2sqlite.@O@ -lsqlite3 -lssl ${LIBS}
+@@ -47,6 +47,9 @@ EXT_CFLAGS =
+ zone2ldap@EXEEXT@: zone2ldap.@O@ ${DEPLIBS}
+ 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ zone2ldap.@O@ -lldap -llber ${LIBS}
 
 +ldap2zone@EXEEXT@: ldap2zone.@O@ ${DEPLIBS}
 +	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${ALL_CFLAGS} ${LDFLAGS} -o $@ ldap2zone.@O@ -lldap -llber ${LIBS}
 +
- clean distclean manclean maintainer-clean::
- 	rm -f ${TARGETS} ${OBJS}
+ zonetodb@EXEEXT@: zonetodb.@O@  ${DEPLIBS}
+ 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ zonetodb.@O@ -lpq ${LIBS}
 
-@@ -62,6 +65,7 @@ installdirs:
- 
- install:: ${TARGETS} installdirs
+@@ -64,4 +67,5 @@ install:: ${TARGETS} installdirs
 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zone2ldap@EXEEXT@ ${DESTDIR}${sbindir}
-+	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} ldap2zone@EXEEXT@ ${DESTDIR}${sbindir}
 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zonetodb@EXEEXT@  ${DESTDIR}${sbindir}
 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zone2sqlite@EXEEXT@ ${DESTDIR}${sbindir}
+	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} ldap2zone@EXEEXT@ ${DESTDIR}${sbindir}
 	${INSTALL_DATA} ${srcdir}/zone2ldap.1 ${DESTDIR}${mandir}/man1/zone2ldap.1
 diff --git a/bin/sdb_tools/zone2ldap.c b/bin/sdb_tools/zone2ldap.c
-index aa2c711..76186b5 100644
+index e0e9207..d59936c 100644
 --- a/bin/sdb_tools/zone2ldap.c
 +++ b/bin/sdb_tools/zone2ldap.c
-@@ -66,6 +66,9 @@ ldap_info;
- /* usage Info */
- void usage (void);
+@@ -73,7 +73,7 @@ void add_ldap_values (ldap_info * ldinfo);
+ void init_ldap_conn (void);
 
-+/* Check for existence of (and possibly add) containing dNSZone objects */
-+int lookup_dns_zones( ldap_info *ldinfo);
-+
- /* Add to the ldap dit */
- void add_ldap_values (ldap_info * ldinfo);
+ /* Ldap error checking */
+-void ldap_result_check (const char *msg, char *dn, int err);
+void ldap_result_check (const char *msg, const char *dn, int err);
 
-@@ -82,7 +85,7 @@ char **hostname_to_dn_list (char *hostname, char *zone, unsigned int flags);
+ /* Put a hostname into a char ** array */
+ char **hostname_to_dn_list (char *hostname, char *zone, unsigned int flags);
+@@ -82,7 +82,7 @@ char **hostname_to_dn_list (char *hostname, char *zone, unsigned int flags);
 int get_attr_list_size (char **tmp);
 
 /* Get a DN */
@ -58,7 +55,7 @@ index aa2c711..76186b5 100644
 
 /* Add to RR list */
 void add_to_rr_list (char *dn, char *name, char *type, char *data,
-@@ -104,11 +107,27 @@ void
+@@ -104,11 +104,26 @@ void
 init_ldap_conn ();
 void usage();
 
@ -87,11 +84,19 @@ index aa2c711..76186b5 100644
 +static char *objectClasses    []= { &(topClass[0]), &(dNSZoneClass[0]), NULL };
 +static char *topObjectClasses []= { &(topClass[0]), &(dcObjectClass[0]), &(dNSZoneClass[0]), NULL };
 +static char *dn_buffer      [64]={NULL};
-+
 LDAP *conn;
 unsigned int debug = 0;
 
-@@ -132,12 +151,12 @@ main (int argc, char **argv)
+@@ -120,7 +135,7 @@ static void
+ fatal(const char *msg) {
+   perror(msg);
+   if (conn != NULL)
+-    ldap_unbind_s(conn);
+    ldap_unbind_ext_s(conn, NULL, NULL);
+   exit(1);
+ }
+ 
+@@ -132,12 +147,13 @@ main (int argc, char **argv)
   isc_result_t result;
   char *basedn;
   ldap_info *tmp;
@ -102,12 +107,12 @@ index aa2c711..76186b5 100644
   isc_buffer_t buff;
   char *zonefile=0L;
   char fullbasedn[1024];
-  char *ctmp;
-+  char *ctmp, *zn, *dcp[2], *znp[2], *rdn[2];
+   char *ctmp;
+  char *zn, *dcp[2], *znp[2], *rdn[2];
   dns_fixedname_t fixedzone, fixedname;
   dns_rdataset_t rdataset;
   char **dc_list;
-@@ -150,7 +169,7 @@ main (int argc, char **argv)
+@@ -150,7 +166,7 @@ main (int argc, char **argv)
   extern char *optarg;
   extern int optind, opterr, optopt;
   int create_base = 0;
@ -116,7 +121,7 @@ index aa2c711..76186b5 100644
 
   if (argc < 2)
     {
-@@ -158,7 +177,7 @@ main (int argc, char **argv)
+@@ -158,7 +174,7 @@ main (int argc, char **argv)
       exit (-1);
     }
 
@ -125,7 +130,7 @@ index aa2c711..76186b5 100644
     {
       switch (topt)
 	{
-@@ -181,6 +200,9 @@ main (int argc, char **argv)
+@@ -181,6 +197,9 @@ main (int argc, char **argv)
 	  if (bindpw == NULL)
 	    fatal("strdup");
 	  break;
@ -135,35 +140,27 @@ index aa2c711..76186b5 100644
 	case 'b':
 	  ldapbase = strdup (optarg);
 	  if (ldapbase == NULL)
-@@ -300,27 +322,62 @@ main (int argc, char **argv)
-     {
-       if (debug)
+@@ -302,17 +321,51 @@ main (int argc, char **argv)
 	printf ("Creating base zone DN %s\n", argzone);
-
-+      
+ 
       dc_list = hostname_to_dn_list (argzone, argzone, DNS_TOP);
 -      basedn = build_dn_from_dc_list (dc_list, 0, NO_SPEC);
- 
-      for (ctmp = &basedn[strlen (basedn)]; ctmp >= &basedn[0]; ctmp--)
 +      basedn = build_dn_from_dc_list (dc_list, 0, NO_SPEC, argzone);
 +      if (debug)
 +	printf ("base DN %s\n", basedn);
-+
+ 
+-      for (ctmp = &basedn[strlen (basedn)]; ctmp >= &basedn[0]; ctmp--)
 +      for (ctmp = &basedn[strlen (basedn)], dcn=0; ctmp >= &basedn[0]; ctmp--)
 	{
-	  if ((*ctmp == ',') || (ctmp == &basedn[0]))
-+	    if ((*ctmp == ',') || (ctmp == &basedn[0]))
+ 	  if ((*ctmp == ',') || (ctmp == &basedn[0]))
 	    {
-+
 	      base.mod_op = LDAP_MOD_ADD;
 -	      base.mod_type = (char*)"objectClass";
-	      base.mod_values = (char**)topObjectClasses;
 +	      base.mod_type = objectClass;
-+	      base.mod_values = topObjectClasses;
+ 	      base.mod_values = (char**)topObjectClasses;
 	      base_attrs[0] = (void*)&base;
 -	      base_attrs[1] = NULL;
-
-+	     
+
 +	      dcBase.mod_op = LDAP_MOD_ADD;
 +	      dcBase.mod_type = dc;
 +	      dcp[0]=dc_list[dcn];
@ -172,13 +169,13 @@ index aa2c711..76186b5 100644
 +	      base_attrs[1] = (void*)&dcBase;
 +
 +	      znBase.mod_op = LDAP_MOD_ADD;
-+	      znBase.mod_type = zoneName;	      
+	      znBase.mod_type = zoneName;
 +	      for( zdn = dcn, znlen = 0; zdn >= 0; zdn-- )
 +		  znlen += strlen(dc_list[zdn])+1;
 +	      znp[0] = (char*)malloc(znlen+1);
 +	      znp[1] = 0L;
-+	      for( zdn = dcn, zn=znp[0]; zdn >= 0; zdn-- )		  
-+		  zn+=sprintf(zn,"%s%s",dc_list[zdn], 
+	      for( zdn = dcn, zn=znp[0]; zdn >= 0; zdn-- )
+		  zn+=sprintf(zn,"%s%s",dc_list[zdn],
 +			      ((zdn > 0) && (*(dc_list[zdn-1])!='.')) ? "." : ""
 +		             );
 +
@ -191,24 +188,15 @@ index aa2c711..76186b5 100644
 +	      rdn[1] = 0L;
 +	      rdnBase.mod_values = rdn;
 +	      base_attrs[3] = (void*)&rdnBase;
-+	      
+
 +	      dcn++;
 +
 +	      base.mod_values = topObjectClasses;
-+	      base_attrs[4] = NULL;	      
-+	      
+	      base_attrs[4] = NULL;
+ 
 	      if (ldapbase)
 		{
- 		  if (ctmp != &basedn[0])
- 		    sprintf (fullbasedn, "%s,%s", ctmp + 1, ldapbase);
- 		  else
-		    sprintf (fullbasedn, "%s,%s", ctmp, ldapbase);
-
-+		    sprintf (fullbasedn, "%s,%s", ctmp, ldapbase);		  
- 		}
- 	      else
- 		{
-@@ -329,8 +386,13 @@ main (int argc, char **argv)
+@@ -329,6 +382,10 @@ main (int argc, char **argv)
 		  else
 		    sprintf (fullbasedn, "%s", ctmp);
 		}
@ -217,12 +205,9 @@ index aa2c711..76186b5 100644
 +		  printf("Full base dn: %s\n", fullbasedn);
 +
 	      result = ldap_add_s (conn, fullbasedn, base_attrs);
- 	      ldap_result_check ("intial ldap_add_s", fullbasedn, result);
-+
+ 	      ldap_result_check ("initial ldap_add_s", fullbasedn, result);
 	    }
- 
- 	}
-@@ -408,14 +470,14 @@ generate_ldap (dns_name_t * dnsname, dns_rdata_t * rdata, unsigned int ttl)
+@@ -408,14 +465,14 @@ generate_ldap (dns_name_t * dnsname, dns_rdata_t * rdata, unsigned int ttl)
   isc_result_check (result, "dns_rdata_totext");
   data[isc_buffer_usedlength (&buff)] = 0;
 
@ -240,7 +225,7 @@ index aa2c711..76186b5 100644
 }
 
 
-@@ -455,7 +517,8 @@ add_to_rr_list (char *dn, char *name, char *type,
+@@ -455,7 +512,8 @@ add_to_rr_list (char *dn, char *name, char *type,
   int attrlist;
   char ldap_type_buffer[128];
   char charttl[64];
@ -250,7 +235,7 @@ index aa2c711..76186b5 100644
 
   if ((tmp = locate_by_dn (dn)) == NULL)
     {
-@@ -482,13 +545,13 @@ add_to_rr_list (char *dn, char *name, char *type,
+@@ -482,10 +540,10 @@ add_to_rr_list (char *dn, char *name, char *type,
 	    fatal("malloc");
 	}
       tmp->attrs[0]->mod_op = LDAP_MOD_ADD;
@ -262,12 +247,8 @@ index aa2c711..76186b5 100644
 +	tmp->attrs[0]->mod_values = objectClasses;
       else
 	{
-	  tmp->attrs[0]->mod_values = (char**)topObjectClasses;
-+	  tmp->attrs[0]->mod_values =topObjectClasses;
- 	  tmp->attrs[1] = NULL;
- 	  tmp->attrcnt = 2;
- 	  tmp->next = ldap_info_base;
-@@ -497,7 +560,7 @@ add_to_rr_list (char *dn, char *name, char *type,
+ 	  tmp->attrs[0]->mod_values = (char**)topObjectClasses;
+@@ -497,7 +555,7 @@ add_to_rr_list (char *dn, char *name, char *type,
 	}
 
       tmp->attrs[1]->mod_op = LDAP_MOD_ADD;
@ -276,7 +257,7 @@ index aa2c711..76186b5 100644
       tmp->attrs[1]->mod_values = (char **) calloc (sizeof (char *), 2);
 
       if (tmp->attrs[1]->mod_values == (char **)NULL)
-@@ -526,7 +589,7 @@ add_to_rr_list (char *dn, char *name, char *type,
+@@ -526,7 +584,7 @@ add_to_rr_list (char *dn, char *name, char *type,
 	 fatal("strdup");
 
       tmp->attrs[3]->mod_op = LDAP_MOD_ADD;
@ -285,16 +266,16 @@ index aa2c711..76186b5 100644
       tmp->attrs[3]->mod_values = (char **) calloc (sizeof (char *), 2);
 
       if (tmp->attrs[3]->mod_values == (char **)NULL)
-@@ -539,14 +602,25 @@ add_to_rr_list (char *dn, char *name, char *type,
+@@ -539,14 +597,25 @@ add_to_rr_list (char *dn, char *name, char *type,
       if (tmp->attrs[3]->mod_values[0] == NULL)
 	 fatal("strdup");
 
-+      znlen=strlen(gbl_zone);      
-+      if ( *(gbl_zone + (znlen-1)) == '.' )
+      znlen=strlen(gbl_zone);
+      if ( gbl_zone[znlen-1] == '.' )
 +      { /* ldapdb MUST search by relative zone name */
 +	  zn = (char*)malloc(znlen);
-+	  strncpy(zn,gbl_zone,znlen-1);
-+	  *(zn + (znlen-1))='\0';	  
+	  memcpy(zn, gbl_zone, znlen-1);
+	  zn[znlen-1]='\0';
 +      }else
 +      {
 +	  zn = gbl_zone;
@ -313,7 +294,7 @@ index aa2c711..76186b5 100644
       tmp->attrs[4]->mod_values[1] = NULL;
 
       tmp->attrs[5] = NULL;
-@@ -557,7 +631,7 @@ add_to_rr_list (char *dn, char *name, char *type,
+@@ -557,7 +626,7 @@ add_to_rr_list (char *dn, char *name, char *type,
   else
     {
 
@ -322,7 +303,7 @@ index aa2c711..76186b5 100644
 	{
 	  sprintf (ldap_type_buffer, "%sRecord", type);
 	  if (!strncmp
-@@ -631,44 +705,70 @@ char **
+@@ -631,44 +700,70 @@ char **
 hostname_to_dn_list (char *hostname, char *zone, unsigned int flags)
 {
   char *tmp;
@ -382,10 +363,10 @@ index aa2c711..76186b5 100644
 +      {
 +	  if( hname == 0 )
 +	      hname=strdup(hostname);
-+  	  last = strdup(sameZone);
+	  last = strdup(sameZone);
 +      }else
-+      {	   
-+	  if(  (hlen < zlen) 
+      {
+	  if(  (hlen < zlen)
 +	     ||( strcmp( hostname + (hlen - zlen), zone ) != 0)
 +	    )
 +	  {
@ -422,7 +403,7 @@ index aa2c711..76186b5 100644
 +	  *tmp = '\0';
 +	  if( tmp == hname )
 +	      break;
-+      }	  
+      }
 +  }
 +  if( ( last != hname ) && (tmp != hname) )
 +      dn_buffer[i++] = hname;
@ -430,7 +411,7 @@ index aa2c711..76186b5 100644
   dn_buffer[i] = NULL;
 
   return dn_buffer;
-@@ -680,24 +780,32 @@ hostname_to_dn_list (char *hostname, char *zone, unsigned int flags)
+@@ -680,30 +775,38 @@ hostname_to_dn_list (char *hostname, char *zone, unsigned int flags)
  * exception of "@"/SOA. */
 
 char *
@ -439,19 +420,21 @@ index aa2c711..76186b5 100644
 {
   int size;
 -  int x;
+-  static char dn[1024];
+-  char tmp[128];
 +  int x, znlen;
-   static char dn[1024];
-   char tmp[128];
+  static char dn[DNS_NAME_MAXTEXT*3/2];
+  char tmp[DNS_NAME_MAXTEXT*3/2];
 +  char zn[DNS_NAME_MAXTEXT+1];
 
   bzero (tmp, sizeof (tmp));
   bzero (dn, sizeof (dn));
   size = get_attr_list_size (dc_list);
 +  znlen = strlen(zone);
-+  if ( *(zone + (znlen-1)) == '.' )
+  if ( zone[znlen-1] == '.' )
 +  { /* ldapdb MUST search by relative zone name */
 +      memcpy(&(zn[0]),zone,znlen-1);
-+      *(zn + (znlen-1))='\0';
+      zn[znlen-1]='\0';
 +      zone = zn;
 +  }
   for (x = size - 2; x > 0; x--)
@ -460,40 +443,47 @@ index aa2c711..76186b5 100644
     {
       if (x == (size - 2) && (strncmp (dc_list[x], "@", 1) == 0) && (ttl))
 -	sprintf (tmp, "relativeDomainName=%s + dNSTTL=%u,", dc_list[x], ttl);
-+	sprintf (tmp, "zoneName=%s + relativeDomainName=%s,", zone, dc_list[x]);
+	snprintf (tmp, sizeof(tmp), "zoneName=%s + relativeDomainName=%s,", zone, dc_list[x]);
       else if (x == (size - 2))
 -	      sprintf(tmp, "relativeDomainName=%s,",dc_list[x]);
-+	      sprintf(tmp, "zoneName=%s + relativeDomainName=%s,", zone, dc_list[x]);
+	      snprintf(tmp, sizeof(tmp), "zoneName=%s + relativeDomainName=%s,", zone, dc_list[x]);
       else
- 	      sprintf(tmp,"dc=%s,", dc_list[x]);
+-	      sprintf(tmp,"dc=%s,", dc_list[x]);
+	      snprintf(tmp, sizeof(tmp), "dc=%s,", dc_list[x]);
     }
-@@ -723,6 +831,7 @@ void
- init_ldap_conn ()
- {
-   int result;
-+  char ldb_tag[]="LDAP Bind";
-   conn = ldap_open (ldapsystem, LDAP_PORT);
-   if (conn == NULL)
+     else
     {
-@@ -732,7 +841,7 @@ init_ldap_conn ()
+-	    sprintf(tmp, "dc=%s,", dc_list[x]);
+	    snprintf(tmp, sizeof(tmp), "dc=%s,", dc_list[x]);
+     }
+ 
+ 
+@@ -732,19 +835,18 @@ init_ldap_conn ()
     }
 
   result = ldap_simple_bind_s (conn, binddn, bindpw);
 -  ldap_result_check ("ldap_simple_bind_s", (char*)"LDAP Bind", result);
-+  ldap_result_check ("ldap_simple_bind_s", ldb_tag , result);
+  ldap_result_check ("ldap_simple_bind_s", "LDAP Bind", result);
 }
 
 /* Like isc_result_check, only for LDAP */
-@@ -749,8 +858,6 @@ ldap_result_check (const char *msg, char *dn, int err)
+ void
+-ldap_result_check (const char *msg, char *dn, int err)
+ldap_result_check (const char *msg, const char *dn, int err)
+ {
+   if ((err != LDAP_SUCCESS) && (err != LDAP_ALREADY_EXISTS))
+     {
+-      fprintf(stderr, "Error while adding %s (%s):\n",
+-		      dn, msg);
+-      ldap_perror (conn, dn);
+-      ldap_unbind_s (conn);
+      fprintf(stderr, "Error while adding %s (%s):\n%s",
+		      dn, msg, ldap_err2string(err));
+      ldap_unbind_ext_s (conn, NULL, NULL);
+       exit (-1);
     }
 }
- 
-
-
- /* For running the ldap_info run queue. */
- void
- add_ldap_values (ldap_info * ldinfo)
-@@ -758,14 +865,14 @@ add_ldap_values (ldap_info * ldinfo)
+@@ -758,16 +860,15 @@ add_ldap_values (ldap_info * ldinfo)
   int result;
   char dnbuffer[1024];
 
@ -505,12 +495,14 @@ index aa2c711..76186b5 100644
 
   result = ldap_add_s (conn, dnbuffer, ldinfo->attrs);
 -  ldap_result_check ("ldap_add_s", dnbuffer, result);
+-}
 +    ldap_result_check ("ldap_add_s", dnbuffer, result);
-+
- }
+ 
+}
 
 
-@@ -776,5 +883,5 @@ void
+ 
+@@ -776,5 +877,5 @@ void
 usage ()
 {
   fprintf (stderr,
--- a/bind.spec
+++ b/bind.spec
@ -1,6 +1,7 @@
 #
 # Red Hat BIND package .spec file
 #
+# vim:expandtab ts=2:

 #%%global PATCHVER P1
 #%%global PREVER rc1
@ -15,9 +16,7 @@
 # due to extensive changes to Makefiles
 %bcond_without PKCS11
 %bcond_without DEVEL
-%bcond_without LMDB
 %bcond_without JSON
-%bcond_without DNSTAP
 %bcond_without DLZ
 %bcond_with    EXPORT_LIBS
 # Legacy GeoIP support
@ -26,9 +25,14 @@
 %bcond_without GEOIP2
 %if 0%{?fedora} >= 28
 %bcond_without UNITTEST
+%bcond_without DNSTAP
+%bcond_without LMDB
 %else
 %bcond_with    UNITTEST
+%bcond_with    DNSTAP
+%bcond_with    LMDB
 %endif
+%bcond_with    TSAN

 %{?!bind_uid:  %global bind_uid  25}
 %{?!bind_gid:  %global bind_gid  25}
@ -52,15 +56,15 @@
 #

 # lib*.so.X versions of selected libraries
-%global sover_dns 1107
-%global sover_isc 1100
+%global sover_dns 1110
+%global sover_isc 1107
 %global sover_irs 161
 %global sover_isccfg 163

 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.11.11
+Version:  9.11.22
 Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
@ -69,12 +73,20 @@ Source:   https://ftp.isc.org/isc/bind9/%{BINDVERSION}/bind-%{BINDVERSION}.tar.g
 Source1:  named.sysconfig
 Source2:  https://ftp.isc.org/isc/bind9/%{BINDVERSION}/bind-%{BINDVERSION}.tar.gz.asc
 Source3:  named.logrotate
+Source4:  https://downloads.isc.org/isc/pgpkeys/codesign2019.txt
 Source7:  bind-9.3.1rc1-sdb_tools-Makefile.in
 Source8:  dnszone.schema
 Source12: README.sdb_pgsql
+Source16: named.conf
+# Refresh by command: dig @a.root-servers.net. +tcp +norec
+# or from URL
+Source17: https://www.internic.net/domain/named.root
+Source18: named.localhost
+Source19: named.loopback
+Source20: named.empty
+Source23: named.rfc1912.zones
 Source25: named.conf.sample
-Source26: named.conf
-Source28: config-19.tar.bz2
+Source27: named.root.key
 Source30: ldap2zone.c
 Source31: ldap2zone.1
 Source32: named-sdb.8
@ -141,8 +153,6 @@ Patch161:bind-9.11-host-idn-disable.patch
 Patch163:bind-9.11-rh1663318.patch
 # https://gitlab.isc.org/isc-projects/bind9/issues/819
 Patch164:bind-9.11-rh1666814.patch
-# https://bugzilla.redhat.com/show_bug.cgi?id=1647829
-Patch165:bind-9.11-rh1647829.patch
 # random_test fails too often by random, disable it
 Patch168:bind-9.11-unit-disable-random.patch
 Patch170:bind-9.11-feature-test-named.patch
@ -152,13 +162,14 @@ Patch173:bind-9.11-rh1732883.patch
 # Make sure jsonccp-devel does not interfere
 Patch174:bind-9.11-json-c.patch
 Patch175:bind-9.11-fips-disable.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=1736762
+Patch180: bind-9.11-rh1736762-5.patch

 # SDB patches
 Patch11: bind-9.3.2b2-sdbsrc.patch
 Patch12: bind-9.10-sdb.patch
-
 # needs inpection
-Patch17: bind-9.3.2b1-fix_sdb_ldap.patch
+Patch13: bind-9.3.2b1-fix_sdb_ldap.patch

 Requires(post):   systemd
 Requires(preun):  systemd
@ -189,6 +200,7 @@ BuildRequires:  selinux-policy
 BuildRequires:  python3-devel
 BuildRequires:  python3-ply
 BuildRequires:  findutils sed
+BuildRequires:  gnupg2
 %if %{with SDB}
 BuildRequires:  openldap-devel, libpq-devel, sqlite-devel, mariadb-connector-c-devel
 BuildRequires:  libdb-devel
@ -202,7 +214,9 @@ BuildRequires:  softhsm
 %endif
 %if %{with SYSTEMTEST}
 # bin/tests/system dependencies
-BuildRequires:  net-tools perl(Net::DNS) perl(Net::DNS::Nameserver)
+BuildRequires:  perl(Net::DNS) perl(Net::DNS::Nameserver) perl(Time::HiRes) perl(Getopt::Long)
+# manual configuration requires this tool
+BuildRequires:  iproute
 %endif
 %if %{with GSSTSIG}
 BuildRequires:  krb5-devel
@ -224,6 +238,9 @@ BuildRequires:  fstrm-devel protobuf-c-devel
 %endif
 # Needed to regenerate dig.1 manpage
 BuildRequires: docbook-style-xsl, libxslt
+%if %{with TSAN}
+BuildRequires: libtsan
+%endif

 %description
 BIND (Berkeley Internet Name Domain) is an implementation of the DNS
@ -509,6 +526,9 @@ are used for building ISC DHCP.
 %endif

 %prep
+%if 0%{?gpgverify:1}
+%{gpgverify} --keyring='%{SOURCE4}' --signature='%{SOURCE2}' --data='%{SOURCE0}'
+%endif
 %setup -q -n %{name}-%{BINDVERSION}

 # Common patches
@ -534,7 +554,6 @@ are used for building ISC DHCP.
 %patch161 -p1 -b .host-idn-disable
 %patch163 -p1 -b .rh1663318
 %patch164 -p1 -b .rh1666814
-%patch165 -p1 -b .rh1647829
 %patch168 -p1 -b .random_test-disable
 %patch170 -p1 -b .featuretest-named
 %patch171 -p1 -b .test-variant
@ -542,6 +561,7 @@ are used for building ISC DHCP.
 %patch173 -p1 -b .rh1732883
 %patch174 -p1 -b .json-c
 %patch175 -p1 -b .rh1709553
+%patch180 -p1 -b .rh1736762-5

 mkdir lib/dns/tests/testdata/dstrandom
 cp -a %{SOURCE50} lib/dns/tests/testdata/dstrandom/random.data
@ -580,7 +600,7 @@ cp -fp contrib/sdb/ldap/{zone2ldap.1,zone2ldap.c} bin/sdb_tools
 cp -fp contrib/sdb/pgsql/zonetodb.c bin/sdb_tools
 cp -fp contrib/sdb/sqlite/zone2sqlite.c bin/sdb_tools
 %patch12 -p1 -b .sdb
-%patch17 -p1 -b .fix_sdb_ldap
+%patch13 -p1 -b .fix_sdb_ldap
 %patch137 -p1 -b .strlcat_fix
 %endif

@ -612,10 +632,15 @@ done
  cp -Tuav bin/tests "%{1}/bin/tests/" \
  cp -uv version "%{1}" \

-export CFLAGS="$CFLAGS $RPM_OPT_FLAGS"
+CFLAGS="$CFLAGS $RPM_OPT_FLAGS"
+%if %{with TSAN}
+  CFLAGS+=" -O1 -fsanitize=thread -fPIE -pie"
+%endif
+export CFLAGS
 export CPPFLAGS="$CPPFLAGS -DDIG_SIGCHASE"
 export STD_CDEFINES="$CPPFLAGS"

+
 sed -i -e \
 's/RELEASEVER=\(.*\)/RELEASEVER=\1-RedHat-%{version}-%{release}/' \
 version
@ -815,6 +840,10 @@ sed -e "/^\s*include(/ d" -e 's/^-- use //' \
  eval "$(bash %{SOURCE48} -A "`pwd`/softhsm-tokens")"
 %endif

+%if %{with TSAN}
+export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0"
+%endif
+
 %if %{with UNITTEST}
  pushd build
  make unit
@ -839,25 +868,32 @@ sed -e "/^\s*include(/ d" -e 's/^-- use //' \
 %endif

 %if %{with SYSTEMTEST}
-if [ "`whoami`" = 'root' ]; then
+# Runs system test if ip addresses are already configured
+# or it is able to configure them
+if perl bin/tests/system/testsock.pl
+then
+  CONFIGURED=already
+else
+  CONFIGURED=
+  sh bin/tests/system/ifconfig.sh up
+  perl bin/tests/system/testsock.pl && CONFIGURED=build
+fi
+if [ -n "$CONFIGURED" ]
+then
  set -e
-  chmod -R a+rwX .
-  pushd bin/tests
-  pushd system
-  ./ifconfig.sh up
-  popd
-  make test
+  pushd build/bin/tests
+  chown -R ${USER} . # Can be unknown user
+  make test %{?_smp_mflags} 2>&1 | tee test.log
  e=$?
-  pushd system
-  ./ifconfig.sh down
-  popd
  popd
+  [ "$CONFIGURED" = build ] && sh bin/tests/system/ifconfig.sh down
  if [ "$e" -ne 0 ]; then
    echo "ERROR: this build of BIND failed 'make test'. Aborting."
    exit $e;
  fi;
 else
-  echo 'only root can run the tests (they require an ifconfig).'
+  echo 'SKIPPED: tests require root, CAP_NET_ADMIN or already configured test addresses.'
+fi
 %endif
 :

@ -1019,20 +1055,28 @@ popd
 touch ${RPM_BUILD_ROOT}%{_localstatedir}/log/named.log

 # configuration files:
-tar -C ${RPM_BUILD_ROOT} -xjf %{SOURCE28}
-install -m 640 %{SOURCE26} ${RPM_BUILD_ROOT}/etc/named.conf
-touch ${RPM_BUILD_ROOT}/etc/rndc.key
-touch ${RPM_BUILD_ROOT}/etc/rndc.conf
-mkdir ${RPM_BUILD_ROOT}/etc/named
-install -m 644 %{SOURCE36} ${RPM_BUILD_ROOT}/etc/trusted-key.key
+install -m 640 %{SOURCE16} ${RPM_BUILD_ROOT}%{_sysconfdir}/named.conf
+touch ${RPM_BUILD_ROOT}%{_sysconfdir}/rndc.{key,conf}
+install -m 644 %{SOURCE27} ${RPM_BUILD_ROOT}%{_sysconfdir}/named.root.key
+install -m 644 %{SOURCE36} ${RPM_BUILD_ROOT}%{_sysconfdir}/trusted-key.key
+mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/named
+
+# data files:
+mkdir -p ${RPM_BUILD_ROOT}%{_localstatedir}/named
+install -m 640 %{SOURCE17} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.ca
+install -m 640 %{SOURCE18} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.localhost
+install -m 640 %{SOURCE19} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.loopback
+install -m 640 %{SOURCE20} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.empty
+install -m 640 %{SOURCE23} ${RPM_BUILD_ROOT}%{_sysconfdir}/named.rfc1912.zones

 # sample bind configuration files for %%doc:
 mkdir -p sample/etc sample/var/named/{data,slaves}
 install -m 644 %{SOURCE25} sample/etc/named.conf
 # Copy default configuration to %%doc to make it usable from system-config-bind
-install -m 644 %{SOURCE26} named.conf.default
-install -m 644 ${RPM_BUILD_ROOT}/etc/named.rfc1912.zones sample/etc/named.rfc1912.zones
-install -m 644 ${RPM_BUILD_ROOT}/var/named/{named.ca,named.localhost,named.loopback,named.empty}  sample/var/named
+install -m 644 %{SOURCE16} named.conf.default
+install -m 644 %{SOURCE23} sample/etc/named.rfc1912.zones
+install -m 644 %{SOURCE18} %{SOURCE19} %{SOURCE20}  sample/var/named
+install -m 644 %{SOURCE17} sample/var/named/named.ca
 for f in my.internal.zone.db slaves/my.slave.internal.zone.db slaves/my.ddns.internal.zone.db my.external.zone.db; do 
  echo '@ in soa localhost. root 1 3H 15M 1W 1D
  ns localhost.' > sample/var/named/$f; 
@ -1542,6 +1586,53 @@ fi;


 %changelog
+* Thu Aug 20 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.22-1
+- Update to 9.11.22
+
+* Wed Jul 15 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.21-1
+- Update to 9.11.21
+
+* Wed Jun 17 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.20-1
+- Update to 9.11.20
+
+* Fri May 15 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.19-1
+- Update to 9.11.19 (CVE-2020-8616, CVE-2020-8617)
+- Make initscripts just optional dependency
+
+* Thu Apr 16 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.18-1
+- Update to 9.11.18
+
+* Tue Mar 31 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.17-1
+- Update to 9.11.17
+
+* Thu Dec 19 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.14-2
+- Include more Thread Sanitizer detected changes (#1736762)
+
+* Thu Dec 19 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.14-1
+- Update to 9.11.14
+
+* Mon Dec 02 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.13-3
+- Backport few thread safety related fixed from upstream (#1736762)
+
+* Tue Nov 26 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.13-2
+- Complete explicit disabling of RSAMD5 in FIPS mode (#1709553)
+
+* Tue Nov 19 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.13-1
+- Update to 9.11.13
+
+* Tue Nov 19 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.12-4
+- Report failures on systemctl reload (#1739441)
+
+* Wed Nov 06 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.12-3
+- Fix wrong default GeoIP directory (#1768258)
+
+* Mon Nov 04 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.12-2
+- Move data files outside config archive
+- Specify geoip data directory in config file (#1768258)
+
+* Mon Oct 21 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.12-1
+- Update to 9.11.12 (#1557762)
+
 * Wed Sep 25 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.11-1
 - Update to 9.11.11

--- a/bind97-rh645544.patch
+++ b/bind97-rh645544.patch
@ -1,7 +1,8 @@
-diff -up bind-9.9.4rc2/lib/dns/resolver.c.rh645544 bind-9.9.4rc2/lib/dns/resolver.c
--- bind-9.9.4rc2/lib/dns/resolver.c.rh645544	2013-08-19 10:30:52.000000000 +0200
-+++ bind-9.9.4rc2/lib/dns/resolver.c	2013-09-06 17:58:03.864165823 +0200
-@@ -1138,7 +1138,7 @@ log_edns(fetchctx_t *fctx) {
+diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
+index ecb3ddb..f7f73cd 100644
+--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
+@@ -1456,7 +1456,7 @@ log_edns(fetchctx_t *fctx) {
 	 */
 	dns_name_format(&fctx->domain, domainbuf, sizeof(domainbuf));
 	isc_log_write(dns_lctx, DNS_LOGCATEGORY_EDNS_DISABLED,
@ -10,7 +11,7 @@ diff -up bind-9.9.4rc2/lib/dns/resolver.c.rh645544 bind-9.9.4rc2/lib/dns/resolve
 		      "success resolving '%s' (in '%s'?) after %s",
 		      fctx->info, domainbuf, fctx->reason);
 
-@@ -3804,7 +3804,7 @@ log_lame(fetchctx_t *fctx, dns_adbaddrin
+@@ -4667,7 +4667,7 @@ log_lame(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo) {
 	dns_name_format(&fctx->domain, domainbuf, sizeof(domainbuf));
 	isc_sockaddr_format(&addrinfo->sockaddr, addrbuf, sizeof(addrbuf));
 	isc_log_write(dns_lctx, DNS_LOGCATEGORY_LAME_SERVERS,
@ -19,12 +20,12 @@ diff -up bind-9.9.4rc2/lib/dns/resolver.c.rh645544 bind-9.9.4rc2/lib/dns/resolve
 		      "lame server resolving '%s' (in '%s'?): %s",
 		      namebuf, domainbuf, addrbuf);
 }
-@@ -3831,7 +3831,7 @@ log_formerr(fetchctx_t *fctx, const char
- 	}
+@@ -4685,7 +4685,7 @@ log_formerr(fetchctx_t *fctx, const char *format, ...) {
+ 	isc_sockaddr_format(&fctx->addrinfo->sockaddr, nsbuf, sizeof(nsbuf));
 
 	isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
 -		      DNS_LOGMODULE_RESOLVER, ISC_LOG_NOTICE,
 +		      DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(1),
- 		      "DNS format error from %s resolving %s%s%s: %s",
- 		      nsbuf, fctx->info, clmsg, clbuf, msgbuf);
+ 		      "DNS format error from %s resolving %s for %s: %s",
+ 		      nsbuf, fctx->info, fctx->clientstr, msgbuf);
 }
--- a/codesign2019.txt
+++ b/codesign2019.txt
@ -0,0 +1,252 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Comment: GPGTools - http://gpgtools.org
+
+mQINBFwq9BQBEADHjPDCwsHVtxnMNilgu187W8a9rYTMLgLfQwioSbjsF7dUJu8m
+r1w2stcsatRs7HBk/j26RNJagY2Jt0QufOQLlTePpTl6UPU8EeiJ8c15DNf45TMk
+pa/3MdIVpDnBioyD1JNqsI4z+yCYZ7p/TRVCyh5vCcwmt5pdKjKMTcu7aD2PtTtI
+yhTIetJavy1HQmgOl4/t/nKL7Lll2xtZ56JFUt7epo0h69fiUvPewkhykzoEf4UG
+ZFHSLZKqdMNPs/Jr9n7zS+iOgEXJnKDkp8SoXpAcgJ5fncROMXpxgY2U+G5rB9n0
+/hvV1zG+EP6OLIGqekiDUga84LdmR/8Cyc7DimUmaoIZXrAo0Alpt0aZ8GimdKmh
+qirIguJOSrrsZTeZLilCWu37fRIjCQ3dSMNyhHJaOhRJQpQOEDG7jHxFak7627aF
+UnVwBAOK3NlFfbomapXQm64lYNoONGrpV0ctueD3VoPipxIyzNHHgcsXDZ6C00sv
+SbuuS9jlFEDonA6S8tApKgkEJuToBuopM4xqqwHNJ4e6QoXYjERIgIBTco3r/76D
+o22ZxSK1m2m2i+p0gnWTlFn6RH+r6gfLwZRj8iR4fa0yMn3DztyTO6H8AiaslONt
+LV2kvkhBar1/6dzlBvMdiRBejrVnw+Jg2bOmYTncFN00szPOXbEalps8wwARAQAB
+tE1JbnRlcm5ldCBTeXN0ZW1zIENvbnNvcnRpdW0sIEluYy4gKFNpZ25pbmcga2V5
+LCAyMDE5LTIwMjApIDxjb2Rlc2lnbkBpc2Mub3JnPokCVAQTAQgAPhYhBK4/rHln
+EexZ/AB6pHS7a5pMuz04BQJcKvQUAhsDBQkD7JcABQsJCAcCBhUKCQgLAgQWAgMB
+Ah4BAheAAAoJEHS7a5pMuz0476oP/1+UaSHfe4WVHV43QaQ/z1rw7vg2aHEwyWJA
+1D1tBr9+LvfohswwWBLIjcKRaoXZ4pLBFjuiYHBTsdaAQFeQQvQTXMmBx21ZyUZj
+tjim8f9T1JhmIrMx6tF14NbqFpjw82Mv0rc8y74pdRvkdnFigqLKUoN2tFQlKeG+
+5T24zNwrGrlR3S7gnM47nD1JqKwt4GnczLnMBW/0gbLscMUpAeNo/gY4g0GV/zkn
+Rt91bLpcEyDAv+ZhQZbkJ49dnNzl5cTK5+uQWnlAZAdPecdLkvBNRNgj/FKL41RF
+JGN6eqq3+jlPbyj9okeJoGQ64Ibv1ZHVTQIx5vT1+PuVX/Nm0GqSUZdLqR33daKI
+hjpgUdUK/D0AnN5ulVuE1NnZWjVDTXVEeU8DFvi4lxZVHnZixejxFIZ7vRMvyaHa
+xLwbevwEUuPLzWn3XhC5yQeqCe6zmzzaPhPlg6NTnM5wgzcKORqCXgxzmtnX+Pbd
+gXTwNKAJId/141vj1OtZQKJexG9QLufMjBg5rg/qdKooozremeM+FovIocbdFnmX
+pzP8it8r8FKi7FpXRE3fwxwba4Y9AS2/owtuixlJ2+7M2OXwZEtxyXTXw2v5GFOP
+vN64G/b71l9c3yKVlQ3BXD0jErv9XcieeFDR9PK0XGlsxykPcIXZYVy2KSWptkSf
+6f2op3tMiQEzBBABCAAdFiEEFcm6uMUTPAcGawLtlumWUDlMmawFAlwuSqAACgkQ
+lumWUDlMmaz+igf/ZW8OY5aWjRk7QiXp93jkWRIbMi8kB9jW5u6tfYXFjMADpqiQ
+yYdzEHFayRF92PQwj81UzIWzOWjErFWLDE2xol9sP5LdzeqoyED+XTqKggpVsIs+
+Lq672qnumQoZKp1YGb8MDocU2DNg/VsMdi7kCnEnPbcSuBxksmxGYomusXNrAF94
+1OJ2sqd9BuFamLIyn8XUCGGYlsvMoe4kTCg6Cc1sQvx0lDG8urKN57jBKWbP4alV
+JBV5KQcf74gzPmE3ypgY1tMEwxyH/WyS9ekDbai0qauX6eUAsM1bduH8fIcknLS
+Zl5hrJTrzWFF9/DKOth8QOwhJ9zoIF1fcAsx9okBMwQQAQgAHRYhBHpqR7X54SM6
+0lUrXL2X3GOe6MR7BQJcLktcAAoJEL2X3GOe6MR7jwEH/iaolMeno1oeWAgzN6Mg
+bx3maweh/9Vqty1fwk7Crq1G78X5i1OCkknEL2p0Bfle4ApwcC4HZVcqCgoYpRV3
+/EEXtwkMNy3plWdBbLCQSev/E1D39GzgAHiMnv7NUJnkoJbvMrvrAiUTXPTtARMM
+gjEpvgEs60wuJxS8ESomRhe/KW4myxDoBxF+K+e5bOkOvvWVcAYJHWZ1BIZs4n6b
+C2vO8q5aKTkQ/XvNT7utbTOqj1SGhItRaAQKXHBdzkQ1Et3wTA4+uRg4gK12624
+9LperYs26w9X9UzApl+qVxQhtWUw3tnUXMastDfQrRcvJgq1xpv++OqX5Uc93RTf
+SNWJAjMEEAEIAB0WIQS+DpdItxglOii7if/xsRvwXPAuVwUCXC5LlQAKCRDxsRvw
+XPAuV29KEACEwlTVVKe4gnBYHnlAD7csoQ0+gJ6C+Ofzlw+UItRIcFeVCAknSGBs
+NPxr9JStIvKpmsbSKpCNUEAYnRP2immh94y/C6BuTe1uUUmqBGr1f4OAUwZpmI29
+ixYeY/uUs9FZO3bS0/WtG46tdcJK41qtM0DYAGT3oeZhJMTW15dfvMGlFukauSOU
+BbR+6sZhqdbWl/AOTE/6x5otnAaW0GObY/BW240Xq/KTgBrzVdK5qNoYsMVsiTd
+0im0JKvFG08ED+ZfcILhlO6G9jRhoTkhtYuf8CKN1dPf2IoB5FrRFf0xqRr9hNlk
+X7ViNMP9OPb8i3BubWvRi5rNSquCwrFATSiAgaA9Yi1BNzQsmQxOql9lsh7eCH7m
+8zzUg9umWI6PkSv8vHBo2kPX73wmtEsF6vxJlk0yDBuQw7y0uuKh406tEEk4cP2
+8U4baq+ihpioupDhNuEII1h1Eh/RBE408RAOpcr+2F0m/fKOoJyz7u+AxyV81Ia6
+fyBnUfZnlfKo16w87c1HJRs9dKkRa5yGziBf9TcED3sru58Pftes2Nr80/iOh26i
+P2pRihcIyrmeAqDWnneErVCmPMDTe6zkMrm/0iZ25/Jfq+M8IHEzFEw3Y1FBOeFg
+9TyMDwYG2biJPTNTDO0BQ+Rrvs4SjFWEYSxgJSvG1jMfSPt5AR6MJrkCDQRcKvQU
+ARAAufZX5WzJr0lZAhxaGpHY6JMBr4jVOCP4TrDZhwC2K4CXNM/PLLNisWzquiWa
+FvUDhB89kCxrEhipwVFYhBr16CDQxrr8yhah3RIxrBMYhRTxgIAkANgkhGWfDJSE
+zXauA7krYtS3rYwhfXe4cNsTkLPbnMUlyLJcqj2wnZcZIt97aL+NFRPyfIw1KfUb
+9u3tB9seDYbvTEULeL07aTnHpWM5f3bTwJrJ2OFPzXseCCzPiVNh3Bv+YtJ1pMTr
+c/UHO5DoJuHLsF0wicPSrpD0twspFdR/0rT6eNycsaCtV4GQzBcMPvY7qai5XrZm
+Cqgluo1W6l6+F5YrKvRMtyyFkUNGcPywdjSlP44JyRrS2uzvFUViSsJArcmFG2TJ
+LCohnse8wqjw0dIUVbmDbE4zjaG56zkvu0k+04Wwp3XPgOZrbl6cbhX3yLhu/Gt0
+dzd9EReoNfKXk32hBzKas/vdeB5DZejbOOOWYftqyZC1LvDvvrYFhFK6VGozfZ6L
+Fml1hzn+xPahp5tRv93/T9zXeVPm9zilGMqm/gjRgh8ojWxNQoNzJyqTPWIvWmbu
+EIP3T3cTFq6lJpJsg3+sfzofGWZCGnBZQGqm8rEOoUWiaKe1BvQCX1x8p4/x8/tX
+TaVDpQCGoqxXt09plkDuGMuiDICxBlaHWUR2jLoHc2cLrB8AEQEAAYkCPAQYAQgA
+JhYhBK4/rHlnEexZ/AB6pHS7a5pMuz04BQJcKvQUAhsMBQkD7JcAAAoJEHS7a5pM
+uz04pB8P/Amfg54IFeALiPOrKbjC3bVAQzrsf09IL8sUln/LCZIx9HgGAJj/f35S
+Q35sK2ucjWiDX6qCxVrWmC6caQXFgXOFSKIlqladmmgj4sIdLM5wj4nbomHChpB5
+rqV/GgkFwWBQ3kPCatXvc8Bg+zKJ+wXgTuPFXefyE9R+SLuas2grQ9hAjvTGHYbq
+iYxSlNDFc1aHLAQ3bS76351MHuMHOpLzoB0OkZDCVNW4GNEqrLbINdr50RAK+Loo
+Z2UBIobEZjXYor9A2FWkSvdjyz6X1QKMdQMath6R91k/O0abBa7ly4/805eAGXM3
+w1Xf2eMlpiUs69BeYoJBklK8aNMntpDREunJjhiPU4JoDzSxl5Qv7LuXylyo0YJA
+9YmydKhTTcRdwsKc//nGr/ckg4BRl+VbtJBYvd3xGB7IQ+pT/TOakv9qCospAhr3
+EQjVP/XpnWJRd+x+dq8UXqwWmTenWDE42cNr7BDFJdOqS5ZWy4sIz4sdjpSxXMB9
+8iiRtKSpKRCJgXScB7SYebh835EgG2YyQGdhJMO7C6ok9POYQBqL8sBqRzImJKoT
+VDvOH42WArKwJWTHa4mPdiDHEIZlkONerec3JXtl4Mfv8cwZ5Lb8fSiB/x8AWvqs
+puc/7hQtkus4TcgutS1fwhAwpnFItpVF6+73CMQrJsblBdTjW0T+uQINBFxbVHwB
+EADebZOJbhPdhHeBPdlZYE3rRjB8scDpWdjrCupfmeTC9MM6JgCE4DEMBtBXk+h1
+7wfpblYYNFwGVFvytG5nvGRDtHWxwd1Z9O8Fx4Zqu0Fx/wAn7ZL3ryE+tdHR7JK
+7SLxOa2X49T/8LY0U8Q65I4ZRo/b4VMcXApCmncw3QSRqHT/mYdNnf+HHPvi3jza
+md3iVptCS4Iaisc079DFda+htWXspBc13lmPi2vGQkWjjS3B4yO8JackyQPVhpsg
+KYbRBzOH0Kii8bXmyA6O5uIJYEddp5Veged4FE/ej3CrgGP1D0Yk1epx8lLbi9RB
+kwFS7DA5rQ23UnbSy1WyV1ZgPrWqQAWuGpjMTVTWN0ElI3AGxAnE8lZlSXyE+XyV
+uHjjIVrayBjLKVqDuSLdKZeCvI4QsyHH6F0NKJQkngvXxLZYxO6s0c2EFFLzdVWT
+1V9GMP8UsDrrb+JsZjUVmPR1tTP4xqEQG6KjfFoQm5XWpGtFwh91OK1lwf/Bx2/C
+j+PquLLFcj7hEP79VDTUZPQAduTTxIeTzHXH+x1PCHFB10xxH3e82VSdJeBUrJxn
+riXzK50SKTTmF+uYpHqE8Jg1N2Y1n5ksuxeYUy8PFjhAeBCqZ6ZcldUDf4999e/z
+PT8bwfCDr8jRdqJHrq7RxTJiP5RsMudWpKeohzJGwQ5uZwARAQABiQRyBBgBCAAm
+FiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAlxbVHwCGwIFCQO9IQACQAkQdLtrmky7
+PTjBdCAEGQEIAB0WIQSVztolaxygoV8wL7WVIaftXazpGAUCXFtUfAAKCRCVIaft
+XazpGPeMEACm9nxA/VKf8RxDo2ZuTgyuSwlR8tCjAE4k3+UoiYUbamkW4pjx9Vgd
+1zC5bNxSWZ5vlJ4CH8ArKFqNK5LBVDZqhYureAo/1Af2b9vRJw0/QQHhuXz/jqeT
+wwrLuKpy796Gpt+aFfcmS0ZC4QXfxJERhAP6tu1p6YmAsSb+bjziQVkKrt9mhOrL
+dtz6WP0Fg1joRj33FgnnLtayHvtgQrNFI3ztCjk/B2FjYZxqbBGfk5gyo0cTE2Fi
+oLhG/XrxIoZepFMJkGYETnYQXrOt2KuJLvawV70YQmG8EqHYY8drKA0XDZs8TVdT
+5cvGvtm8ERz5znsssRBxQMI5Ml6O2ahrXp8Eq4htCzlvO8t2MOtzvqAJRiyAd6bA
+Uo+MGVRpnvePOR1SAgBXCd416rF0iCXc1utZxnqwdq9kJAZ+8mCLx4N4jk6AdGpX
+zcNkLg7QmUzXn75RxZ6GrIUYZJNMlswXq5XhSW4o8ePlaxWjh9+QTtU964AZhpA1
+uoHsKGTBxHJs0w6McZm14kb2PuaO2/rpf8s8IZyc93+Y5O/gHZ6/agBjA9qN6wkQ
+R1d5UhJC4QS/m35rBGBKK9X3fqQxaBCio6Qz+m4A3GchrztJpq+2P+ma5ylsTq5j
+V4njky26WNtrV7+N0C4Moj3I4Qn6YU/eSManTXzHzoiPZCEH/IOxgXIiD/9Zm3Zz
+I+h4NCfSGyP11/w1gEzlTHQ4at/FXIIDh0Y2ZNpWPffuFQLtcER2vyKPwhDYpGMy
+NNHXks4azfrXVCv0wmSNBbeS8pJrYtopZpCEBrAbg/YLv9m5lpDSRHaR3gv/qMZ7
+QxY+NwqciqTwGq68PuF4mDSvtfuFmbEES9Iybiie+eL/6DU2knfBjgshUe6vElR+
+LYoPQ45GY2IxRTJ1pMXaZw1+evwH3UvseRGkRygiaBgoU/qR4prynvjMQcacCa+C
+aRnXZJYp/usVBeY0xut9toc9/OcLGoBr5h9l5YjruO2vu8VHou8N0tarVQn3YbQR
+Fi+YtNtclWJa8Pq1AsKRTCFwDwP6eODv6mNOrEFydNRcpiQmzp47VWF/YHRfHzCq
+A1wHLxLUrpQTaVw6J4FqedAQ31aAO4faA7MS+ZMNBqZCZ7lTGC6TvojqqBAN2yX7
+AnnYpZHM+lGpi2/ukVzLqSkGmdNOgbu+UZvoej3YnHYig4yWP+z2xrlJl8bkhU/d
+r9IQE5aRCEPB/JWhHJ2/GqYl9qjshlB52+6X2KDarwptOtzT9ooArYhpMwKIYh34
+c7X8tlAKYk7V5j7txIRFDKKAftC7dM82PntXJxSkWyR70GYnYjiXyrqqerqT7xIC
+mDEQgFOPpy09zFW62paO9uiZw6qwybwqgGpoX7kCDQRcW1TbARAA3ERo2mPv2VVg
+ZUFr4MtPDm4UG00YJW/LYa3D3k0e9tdSScACXprk1sAoxUlQx/CSdErPKwXG4rax
+iN4t5nICUUNYSC0dh09G25jC7nwsWc0AYyZu+h/FzfvpOm3fBwmBlzILlGh0URwH
+Ffj9fHt6hos4C+3PFZZ/X24aMJF/cov1oYi9rqFwt/l0mgtPE88Iyj2/Vp3Lergg
+QMzKfEuyluj9fL2cgU0Qa7oAPXmaxhHtua4cvbM5SXGo3FXjIgzH9OfM+2orebeN
+wH1M3ec6w+nPmRmCJLvPKGOeS7GVXL5/aOyPlDWzSXYnpCKS2ntw4K4nt0IA8n8z
+1db109l/C2noDrDSJEqOo843ShNGTYOMVUrj3a+Y7o2ATc9pNZalf0PwnKas7NDb
+IJ152PEQw665iYXcv2awjLF6W0yuSq8kfiaAxIrsie2Dto0zgqOs0Ot9Y74u11Hh
+wBSHUO3mEZJScAAcI/yDF2PvjvCQSzu4mdXb77t6X2O6YHULz4A7bVQCMazcTDI9
+/S0W2+ixPnnJVnE3xgjK9zuizji8JDJw1hJCQM+yTLVqq9pfvcRfQ6uwpMRzz/O3
+S0zDRiA69/GyfNwkpgz5QaGpY02IK5WrQU1doRjIz4BHAYzoIOkMkRqTtjdElQZw
+/D3wSO2uwsEMNwRzibR/Lz1JF2aGn6EAEQEAAYkEcgQYAQgAJhYhBK4/rHlnEexZ
+/AB6pHS7a5pMuz04BQJcW1TbAhsCBQkDvSEAAkAJEHS7a5pMuz04wXQgBBkBCAAd
+FiEE1wyE5ktVjlvM7AchMuIXXx11eioFAlxbVNsACgkQMuIXXx11eiqCfQ//SFDf
+rOIEoslp6n6vlCuavOg02wvjskKQGP1P1Q4v40Fw1Gl87n9uXAoMpeF4H+pzUxOi
+BHYCQi+EemwocSThzaWfPzd3JG/0OcRymf+ZOcBb+58VJL7p88QdMFIAi5J+KMuA
+fEG0zLkc9anEnXoVMmQJX5K+6PyeVDvBbYGjLjQAsWTZTiVuQI0w3WxFtDGWqQII
+8e/qE0DA7c/auGn7j2hid308+FcdfpmLefW9YesWjE1yYvHoCRdFOJ/7Sft4MQCI
+Re7UET3TRMBvtisP2DcqyzGPp22s4ZYFCCJJNiB92bXdEl5zXe4Ff7JTfNE/QrR7
+Wg5R9hZHgHdbp8p8bA3f0y29YCx3puYg7BbmQWiMh3rXWE5b090pSpw0K9BQU3vO
+irr+5/2TaFOJXHl4VF03GrWsSncShCbdsdRIv4TB0lY2mN4q+e7bjlAzJJeoaS97
+GIqu3DBlAJyx/ZwWW23DXXwoQ4jNuJhpl2jaCE7rVQB0uLjbp0i9Zdd4SdYZxmO/
+Y+JfgoJz8eyx8wZi4eDz1ijN0WKsIGjxJH5VUK9STjijDMeG6ZZRLc6b1QCGhe97
+ZbDkEUTdQGoeu4L5Fiqoma13NEsf8ofBDv+myJm/O67Va9JI3gxhIrhmF7LMzQQp
+lYx2peZC1CmhEnn83dtt83mhXvX6Dth657BW/Qd+GQ//SVuTPuNkBXfrTi4dbnv+
+cU6IsoIBodTF/WsQ6h4kbtsPhO5DbrsLNuNumrqVEN8jw+HUsEeNvFNeMrTPdG2V
+87ShQ4BQGkCf+GFRBj0myxxXOFZYQx6RpY5fCe7yOcTzpkbnPWmm7V8HdOuZ0NnL
+JNQ5YogOI6UvXVKv35R9qBo+G9jkhhb0eaAu6BERzKVANKfsGN7545ElZ1qlffMh
+AQhXGb6TsvCeSg2cWGb2cnVL2d58uVukD4PDiq4qqwgClkF3bOO70SIgGrCteHbi
+4Hseopex5m6GqqjoUYXr7QQBwSaQdc+gKtEjMHCsHbUyHRk0qEHdEe+2RmL0d0ra
+QMJfKyYQjcCR7tnrgN4WD1h4NKRdC/KRW31MDmH9XVPrkOMQCUCnArXkOwdKWsKf
+h8af9HqweXOT1FHJN/M3tWaBpv6KoduF2f2pj1VhPZ2EqFUycJ26lrHyOpsynQR6
+TD+c1uXotDwKN5RW+YL1cydk6mhib64fdOyPUeTcHehjMAFgM2f5wi35Ujcj8id
+37cWOqRsggSbMnGO4AUA/YtcVNG8TjZbakson8ENK7e8q4sEiNFUZ7/CtzNokwHQ
+5uOG1+qB85Y4ImGnIZVeiBpjt73VVawg4Zvm/omtW50P9R+4rVhMJZZFAgrWg8BH
+H/KNznW0vUuShG8B+2FA/eu5Ag0EXFtVDAEQAL5ftI1GgVJEFgX5VsuFnfBnH95c
+zqmwEXaTP4s7Xm3O0Wy579EzRUD1eEw/UaD/q2OHScwvMP65cZYQ9w4hnCN6H96P
+96Teo7LOMCssvSXIO7gqP33LKTqDzsIoAFHwWE3dq1jbyP6T1Je85mr0Edvk8kOC
+B1hudswAARno/7X9zGulhhwuEHk5Iey7R59yRUQqBctdNcetGyaiFjjX0evuVADi
+/z/s07XhDLDt7+3Vglh1/7XGC64QhB9QjZ8j0u7+0xfmLLjhi+7EpkDlAHIJXX1H
+0wAsPOGKlYruQUmIsMNfBINZeulHEBZ4cAd30xsM296DzJ6QL9sAGfYMhRs0YHB/
+EJ10Zv0iw1pU2jCCUv/9Kf4F4nwgHQWQP7JAbfhOIUOUq/YlxjTLnkd25+7vD3KH
+NQ6UiRDROR9Jwetpd/zokpf5O5iTBpVL+sCq+NsTZyDOjITve2sY0V8v10M+Z+pL
+cp/cUZ4JEDS/WJ4/ovBNJP8b+YwN/RBgCjl8UBX/N+e7AA52eYP2H9GK9XPkzSCE
+VxEf5PyjGrwedpoLkzagrHsDuWo3uBquLyneT/ozihqKQAuInUy5B7rWU4mpKHe5
+Vto5o6Zuj+6MgHgIQzRK6Da2ziMNEmroxwZibcYCtUPdvcvxGh+byclnzBclKjOw
+kAalFPx0SxEbHmzPABEBAAGJBHIEGAEIACYWIQSuP6x5ZxHsWfwAeqR0u2uaTLs9
+OAUCXFtVDAIbAgUJA70hAAJACRB0u2uaTLs9OMF0IAQZAQgAHRYhBK7WIv4CB360
+tcFGwUKiedJIzcMQBQJcW1UMAAoJEEKiedJIzcMQH+cQAIQYXDnqi4Hl21LtAgky
+pZxug+x/LECVlwkrIfaQF337+fG+H9J7SdU87Sn1Xe/YUgQnF0XP/fjIVFM0e/Tb
+xVlmTFqiejLnIwJJDgUaHO3POT2sGEyO3tc0mqSzyRBxtMQ8yvApccBhL5QODv3h
+hlRWgk5MXU0IPeXw134IWm+o/PRiPBoXPawvVfEVIBlUFaiSZASf4BAiSad4aJQe
+P8PyP7FPvQB1xiib0iSetn6ZmNeN2OSUJPiPA8aE9JCKuFtomVQEDM0BqQDl5A7h
+5O2uyf0Li+/ArqBvfBjrH03e5zbID02dO3D2BjsV3jUeVPQ5WDgVg8LH+nfg/rRy
+wfCsx9zFp1mt3K4xN2v7IKwxGndApgCcx17gsjzMvLz0J7sSGov4MNjzqvGEDKCl
+uUvNKXqy7je9xcQLpoyvWtoWFXWTbQAcK5Vv+hC67r9bHpjI1KuqA8hYqNKxsv7s
+wiLZdd4SK9SIuwf0j8/XTZwmoFfGolJil0ZNxyqBF39+CMVpaHdLM1qKZz99TVzS
+h4obOOjkUjK458xSo0XCbJ4qXYp7PgxyWK6GIbTozbbG/1ldw+LUnqxt8Shf797L
+J9lbI3ICuR2P5PYlKJf3b6D9GyfqyrP387fKAKhHsYkZ1XD54/8wIgTrdfeNPtL0
+1mjWDjw5KvO9kuPBjcmzgt+NrtsQAJwKeZsiqLLcY8kJ9xP+/xtTlh2iVuZMfxwq
+hwlo4MMCzpobLDZ/JKU398m77eboTKJSBfeUYxQd4ATn1L8NLKjLxKAaBkjEk0nN
+8w9OUQbFlhQ/asLzzF7Z9IGGh9/SEgBZ8V67a0O3Qw9Xdi3ARK3bbZ8RIVJ0+P9G
+CGrfq9j4ZmGA2L4irLjsvDAv7CSMb4WBKW8j0Jz5LFMwOMJgG1TT5c6lNqFj6y09
+rZcVLnt8+lUv2Bw3LC0oI1TjFkrrCzIdfg++mPi3K/ZFc50bvnWF4eCOjgZ5U9Vb
+sxFZq3+vTRcIfI9z2lZ9CNDRA1O5jGvuVtEGLiSLF2aJ6kiNriLuuGTlXfg/Fpgh
+GTvyppOTzF7PtHzHBQ/ZjnhWojnc/jyJRwLK8cCl6+EOc887v8BDmqgFWtmycsE2
+5fDJ7UFGP13g/eDL3ZUgMDty5dQaUOTX145t2KT+lMqpY6ZK2EC+eoqrnIGJ+tYy
+0l4RRxi10mbNhuPIIDdph7X+mUHgCeA9gyF0Y+LqiB6CX+zFg7ovLvnCbMPxdGXq
+z7AjfwqZBKI+BVuBeDtyW4onmElCu5cXNKsg3W0IlQlZf9PMDU6Ht0XLUs7EPfbQ
+sH1Vqi1XE1W/tGnkmjcpG/qlt9Gx1uwFGLP6iomqUBc2c0GZ6R1xplXvd3w3yC8d
+8lAgPGImuQINBFxbVToBEADkuxhQx9gxlzzCc0nUu2v82XsD+GzONp9irt14gslx
+te96eKaTXTi0t5eya0X5TIY3wbREwjlfAeM9AfcAmWcsM4izrfPtANM6WOxB2Tbz
+EY2cqv7NBQii7Z5aqPyjcIiT0b0Gs2evlDkn3xEBBqTSrNcnGSA29bZPIkaUb7Qo
+p/Ani0S3/tgcR21gXsJwkgpfNKwvPT03Lz3/o5rXAyag0M/25adgk9SVKNcXc8h2
+HSGv5ENjwUKNNnowVbNLw4287mFUM2Vd6unGJ2MBj7aUwTrfBl7gNV96mMdDJWcB
+hGKYkxUvibuHCa2KH7gTrnV6X7sdrgD5CbJMPq6OZNSP6n6bUVg22eHxoETplFwT
+4NvV3clRMWIAG1XgXR1l99LAh7PPnPMM1pHQGPwYHQskoBFS4g5knzHpB9h9TfZ3
+MM4cDZR5NgWmE0fYVnWe5ax+wW0/IOklUoHv3qoL4yiN9wFJq2oLzUNQd9+tsqiy
+vxSTh8iYmHegyn5KuBPsrMPgvqiKOdalTZKkak9DOx4cGQL2qHspKxiBOb6uox2v
+fjMQ5bDeUn+4DYMdnZNHeywCUegJmDakUtlfvN+136IDHGwfdGcitqzswzd3+PI2
+qlwPE19gkrp9NUaD3Qj2ZtDP7sU2cThc6Gra5KRFW8f98bI77j1Wu6pCnYFLqPz4
+QQARAQABiQRyBBgBCAAmFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAlxbVToCGwIF
+CQO9IQACQAkQdLtrmky7PTjBdCAEGQEIAB0WIQR5HX64jryNAThDSqwz3zWa56YK
+eQUCXFtVOgAKCRAz3zWa56YKeSWOEADK8u03LESGSQlZQqnnCAI8iYs1s+XRMEnG
+2tAQ1OK7/4eNgr1yZckmaW4FBMgeEgYIBJ7v3SlW7Hf7dE10TYPNGbP6UxVW8HIP
+rA4CINcGZXWWwpS374JNMS6A5eb6viuEgEMEi00jx0MmLvCMZKypmwXQUl5YJ5nB
+ytpQ1681mCQxGBMhT1eKQt3B4nAsoEnP+HnqVM/nKxBemSBNXX+C0b/YeQoLC3sD
+L+Z0NRI8U6PZl9Rokod3uynH0vfBYCEJd6MvsjtnJlVVaseYIA3ESNrFG12tw95I
+wKNrVCANZ1DBSyK4ovmmWsDrH+uFTHSLNjlxIuVxUfmXcLfgcepVCmd/7Z7UrWYr
+SXSvP0VG4ZmEPE7tNb8bfyADftO1cVsmcHBQeSrgvpSrTv9L8MocojpR5vJc1f+a
+sBT7rAeGzZP9riz1GmryXawaZgdLfaaJfzRQkc1uTChb7kMN+UMhVUdCAXmho0XO
+SfcsW84u/LpjdYh2Ww41xQO6EWvbZDNgD/Fdmp8Uh1MqJ1Dejri6kjNn6wPImXJd
+Eu6nHqWDRdYsfT4XUB18tB+4aIpFzCyIgpf7p1uaVU7Oqip5sZkc/WXKr77lV23m
+PQvpGRNCzgU2TJY7ktR3LOvUVN6wNfLMHzeQk18NdmcEGUrJ0YYtl9vE5/Eg9L6x
+LBH9PKt17IQ8D/9DLwQX8pl3fuTM8ZbzIPLxiXhbgzBBTXKRE2u1888+RIq9xE7c
+aVFjwq4qpgqZ5SFonTcG4Pi5ck3mFAzyA5zLRF+ckpmBpwSPMpLwCpv10369D1jh
+AF3JsUwt6DIb2BISMhh2ThSUMSKO75q8GSotsKjJyjD6vl1x4L7WXubTWxEiNuwD
+3kAjFWS1Z1VWtA9SURWAbsDaCV4VmwCCpSIwRr9OTbyu9XuMdMxGNpl8SwW7MVQb
+x4aYNvR7Hl/wIR71AHAXoSfrKp3p12anXjYYASHmbm16ugP4H7HLMBfznKet2f76
+gIxJr1CsAMTSqypcC1UoVb6Gz8djeIR+GU+6efHI4TIUMy5uMIUx8tYbwSEeo/y6
+NnjpJFYYjJa671iSABInNxs4+X+1zrFa+wl45EnaFxziEet2Qzv/VsusoLvLwnYi
+BZckclAS5xoVGFW0WJ01OfLUDHxGMt9GSheL8c+GLMaMtaCWunpmmt9zZ9WdpBOu
+AGluMG1Cee50TrhXaGE8CdNr8nOdSeLNAveBAPmuVa0JDSe20/D/RuYJLKeG9Vsq
+BZvjuGlOUsfl6UjtiGRbgS9OWpxeez5ugc9yyV+rBGIpmnIb+9quz2HmGxE65eA2
+cRNsZRIjFLzeAx/0RMaT1nlLFTBbUuZ+tJ+fgFtRGMhifZn1pb2dMQo0N7kCDQRc
+W1VuARAAv4LYaNq2Zev/v7M5DnxLpgHRcMkG7TOQpycrlK5653llpZzTy3mh5peW
+vcq3IDmdeUIJxQ+WDh2f0vS+NIKDC/HAddfHrZPbhO7zLxLcMW5KmV05ancaRSP0
+s0+IyQmvVxUNrgPinZiphlvRGoLXS6pdgfc4jIR9B2umPecfvfu/6EWFPnXZgG8K
+yY3Z+mwrmEO0FaXHBQuu6nactiPe79N4bLe8hk9RW6yIxLBeJzIoOlIcJmuRHapt
+nS2lV3mfhZdFnkAp1o6a2TL5BwgMY0wZUKZr78HEMKh6LbPN9rPepf0neUeq/k1l
+NJU7V6XMS+rezF31vgSJ5KoNGYhxtWZ54uksH2rcw7+ltpSVtqY91G/vibpRCJG3
+LdX/kxHni1NEWyZlpS/6ntuH6HSoNYsR9IMsbESs3QVCH74ApK88CxYCRB0SEo0M
+yAElbQ3bfEKCKl/FwC4IzAYAJ2arWKwBHRSJlsrNCtczrjG7j3EyJrn8+Tm5yjO6
+0THQjvc/nBxrNE09r1Lzz7jrDWC9Rl+BH6wqdniymoYyUAQsX2rZ+Jhah1Zkf+Gu
+76qtY+EH494dPM+0FazcBlgBd6/J5mh3Wk9JuecXLTEUGtzd1GmI9CENPAklCauX
+tNOWeTop27djuKWsZxuP1GyV6UYixFVOSWteyAbA32cncVv/2ZUAEQEAAYkEcgQY
+AQgAJhYhBK4/rHlnEexZ/AB6pHS7a5pMuz04BQJcW1VuAhsCBQkDvSEAAkAJEHS7
+a5pMuz04wXQgBBkBCAAdFiEEFWiQaF6g32oTce8gF8xdsfAIhAcFAlxbVW4ACgkQ
+F8xdsfAIhAd4jxAAiO9+VRQQ3eBOsJRgANdgL/l51kq7qE3u8xnSqNkrmdYDdT2H
+TYH5W4n2AmGo50BDafdjd6tut0qtzA3/hGWCooydxKFOsnIYziUeoHvlICj3RkHO
+y7utcFhAgRWi+kzFwnnXGf13dMU9iG7yvKrCrCEw44gzoQ1KnY1Xsj18n5JkqxeT
+94bzcSbz20OpOSIMfSQPrpy18WrZYwHodcIZ3IUUACCpMZdfTa9c/qHRQ/rcwl+B
+0JlHx0V4AYiSAsiMVgflO1Eqi7apPuwxPPd5nnHkrdDM9CYC3LdBORBXwncG3oZ5
+eTSXmsvFxHXH41JHsm/1QFcVmFAYhu9qJFCGiD+8UeTFtT+nnHU69BszgtUskqX8
+k9PqLdK7Vxkp16wc6WOp1NeIQ6Fd4PxTGrPqs9bJk7TlYtTFWpA0X+EMj/San+Ku
+PxqLEa4Ab12R4vs1pCrn/g1z3C/6ujH4B70HOrRTIeTjULJ6xdwXGtwUA09hio0r
+pHhtyZhAh5irUJNto4ZOk/Qyd+dfMsNvRJfbVIK2mmeRaBnp902AsQNgYVdi2Aki
+0h4kz3bVLGw7iD/xV2hV69+JwLSijkkmOpz/EjMwj0hDDYrHH3Y3o0dV3dNdk/5i
+6lQgcxSVsl9kWlHcoEllKbf0Hb1muKVwoGGYxFYna2jsLFVjG29M7iPSgrHjmg/+
+I3fmsLZ0VI9kmxniUlZ6gz5NB5PJ3RXmwKO9LkBgE5C1wpuZbNEQ1NsR2bprlJPm
++GNSo8HaheuTRJn42kkOgfIJwjuvXih3FE/NtRA/W8H2uF6YLDjBKGZJbxQcmsd
+CTEuCRCVP8X7C5n3rl1YqzfWfNr8QFxvH7ivG7KOlSxvyTKcYatWb9uDUPrnr74f
+ZaMljHGsNyKj70MzZcrrsmt61yWGR0h+02rmIKlskl4hkh+qF5ehI+Bkd7eblsBy
+rxEREHq/ij2Vd7l0Z606YCE8vj8WfcsJj8JjwR3A+nND/oNJTTbQ3b8OvasvqIey
+WqqmGg73nbHjd/VIAUsfvnsEYatDk4pAA/wQr9c4T4s5Q/QRwDrAsa4J89FrDjWC
+hQBPL7TaP8Af/3Y3/86jLCN4lnW1qjPXv5rhBFeI0EVi1k1qdV06qr5HOk7CwQTT
+uc4rCdFcEnw8kVKZa/yFnlJfRa0Z4IwSahdp5fdFEuad6LpOcFFnYxWtIWhcg4GT
+RcMha/OZnsfqOqiAt6In+1IwuJBz3uMM7xw2AMaxzAejGEL63F81C5iJ6Ld6kQK+
+XblDW0G643bVbzkBb46MAT+UnLuWQUs3NDtk1FEioJyWUgbO/srMH4MoWM7rG8ZT
+nQPohNmPBrqL2phmE27HQsQ0rTjH2Z2ol7iy9OFMtT0=
+=MkGo
+-----END PGP PUBLIC KEY BLOCK-----
--- a/generate-rndc-key.sh
+++ b/generate-rndc-key.sh
@ -1,6 +1,17 @@
 #!/bin/bash

-. /etc/rc.d/init.d/functions
+if [ -r /etc/rc.d/init.d/functions ]; then
+	. /etc/rc.d/init.d/functions
+else
+success() {
+	echo $" OK "
+}
+
+failure() {
+	echo -n " "
+	echo $"FAILED"
+}
+fi

 # This script generates /etc/rndc.key if doesn't exist AND if there is no rndc.conf

@ -14,7 +25,9 @@ if [ ! -s /etc/rndc.key -a ! -s /etc/rndc.conf ]; then
    success $"/etc/rndc.key generation"
    echo
  else
+    rc=$?
    failure $"/etc/rndc.key generation"
    echo
+    exit $rc
  fi
 fi
--- a/makefile-replace-libs.py
+++ b/makefile-replace-libs.py
@ -0,0 +1,143 @@
+#!/usr/bin/python3
+#
+# Makefile modificator
+#
+# Should help in building bin/tests/system tests standalone,
+# linked to libraries installed into the system.
+# TODO:
+# - Fix top_srcdir, because dyndb/driver/Makefile uses $TOPSRC/mkinstalldirs
+# - Fix conf.sh to contain paths to system tools
+# - Export $TOP/version somewhere, where it would be used
+# - system tests needs bin/tests code. Do not include just bin/tests/system
+#
+# Possible solution:
+#
+# sed -e 's/$TOP\/s\?bin\/\(delv\|confgen\|named\|nsupdate\|pkcs11\|python\|rndc\|check\|dig\|dnssec\|tools\)\/\([[:alnum:]-]\+\)/`type -p \2`/' conf.sh
+# sed -e 's,../../../../\(isc-config.sh\),\1,' builtin/tests.sh
+# or use: $NAMED -V | head -1 | cut -d ' ' -f 2
+
+import re
+import argparse
+
+"""
+Script for replacing Makefile ISC_INCLUDES with runtime flags.
+
+Should translate part of Makefile to use isc-config.sh instead static linked sources.
+ISC_INCLUDES = -I/home/pemensik/rhel/bind/bind-9.11.12/build/lib/isc/include \
+        -I${top_srcdir}/lib/isc \
+        -I${top_srcdir}/lib/isc/include \
+        -I${top_srcdir}/lib/isc/unix/include \
+        -I${top_srcdir}/lib/isc/pthreads/include \
+        -I${top_srcdir}/lib/isc/x86_32/include
+
+Should be translated to:
+ISC_INCLUDES = $(shell isc-config.sh --cflags isc)
+"""
+
+def isc_config(mode, lib):
+    if mode:
+        return '$(shell isc-config.sh {mode} {lib})'.format(mode=mode, lib=lib)
+    else:
+        return ''
+
+def check_match(match, debug=False):
+    """
+    Check this definition is handled by internal library
+    """
+    if not match:
+        return False
+    lib = match.group(2).lower()
+    ok = not lib_filter or lib in lib_filter
+    if debug:
+        print('{status} {lib}: {text}'.format(status=ok, lib=lib, text=match.group(1)))
+    return ok
+
+def fix_line(match, mode):
+    lib = match.group(2).lower()
+    return match.group(1)+isc_config(mode, lib)+"\n"
+
+def fix_file_lines(path, debug=False):
+    """
+    Opens file and scans fixes selected parameters
+
+    Returns list of lines if something should be changed,
+    None if no action is required
+    """
+    fixed = []
+    changed = False
+    with open(path, 'r') as fin:
+        fout = None
+
+        line = next(fin, None)
+        while line:
+            appended = False
+            while line.endswith("\\\n"):
+                line += next(fin, None)
+
+            inc = re_includes.match(line)
+            deplibs = re_deplibs.match(line)
+            libs = re_libs.match(line)
+            newline = None
+            if check_match(inc, debug=debug):
+                newline = fix_line(inc, '--cflags')
+            elif check_match(deplibs, debug=debug):
+                newline = fix_line(libs, None)
+            elif check_match(libs, debug=debug):
+                newline = fix_line(libs, '--libs')
+
+            if newline and line != newline:
+                changed = True
+                line = newline
+
+            fixed.append(line)
+            line = next(fin, None)
+
+    if not changed:
+        return None
+    else:
+        return fixed
+
+def write_lines(path, lines):
+    fout = open(path, 'w')
+    for line in lines:
+        fout.write(line)
+    fout.close()
+
+def print_lines(lines):
+    for line in lines:
+        print(line, end='')
+
+if __name__ == '__main__':
+    parser = argparse.ArgumentParser(description='Makefile multiline include replacer')
+    parser.add_argument('files', nargs='+')
+    parser.add_argument('--filter', type=str,
+            default='isc isccc isccfg dns lwres bind9 irs',
+            help='List of libraries supported by isc-config.sh')
+    parser.add_argument('--check', action='store_true',
+            help='Test file only')
+    parser.add_argument('--print', action='store_true',
+            help='Print changed file only')
+    parser.add_argument('--debug', action='store_true',
+            help='Enable debug outputs')
+
+    args = parser.parse_args()
+    lib_filter = None
+
+    re_includes = re.compile(r'^\s*((\w+)_INCLUDES\s+=\s*).*')
+    re_deplibs = re.compile(r'^\s*((\w+)DEPLIBS\s*=).*')
+    re_libs = re.compile(r'^\s*((\w+)LIBS\s*=).*')
+
+    if args.filter:
+        lib_filter = set(args.filter.split(' '))
+        pass
+
+    for path in args.files:
+        lines = fix_file_lines(path, debug=args.debug)
+        if lines:
+            if args.print:
+                print_lines(lines)
+            elif not args.check:
+                write_lines(path, lines)
+                print('File {path} was fixed'.format(path=path))
+        else:
+            print('File {path} does not need fixing'.format(path=path))
--- a/named-chroot.service
+++ b/named-chroot.service
@ -20,8 +20,7 @@ PIDFile=/var/named/chroot/run/named/named.pid
 ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf -t /var/named/chroot -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
 ExecStart=/usr/sbin/named -u named -c ${NAMEDCONF} -t /var/named/chroot $OPTIONS

-; until https://github.com/systemd/systemd/pull/13098 is present, ignore return value
-ExecReload=-/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
+ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'

 ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'

--- a/named-pkcs11.service
+++ b/named-pkcs11.service
@ -16,8 +16,7 @@ PIDFile=/run/named/named.pid
 ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
 ExecStart=/usr/sbin/named-pkcs11 -u named -c ${NAMEDCONF} $OPTIONS

-; until https://github.com/systemd/systemd/pull/13098 is present, ignore return value
-ExecReload=-/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
+ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'

 ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'

--- a/named-sdb-chroot.service
+++ b/named-sdb-chroot.service
@ -20,8 +20,7 @@ PIDFile=/var/named/chroot_sdb/run/named/named.pid
 ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf -t /var/named/chroot_sdb -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
 ExecStart=/usr/sbin/named-sdb -u named -c ${NAMEDCONF} -t /var/named/chroot_sdb $OPTIONS

-; until https://github.com/systemd/systemd/pull/13098 is present, ignore return value
-ExecReload=-/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
+ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'

 ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'

--- a/named-sdb.service
+++ b/named-sdb.service
@ -16,8 +16,7 @@ PIDFile=/run/named/named.pid
 ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
 ExecStart=/usr/sbin/named-sdb -u named -c ${NAMEDCONF} $OPTIONS

-; until https://github.com/systemd/systemd/pull/13098 is present, ignore return value
-ExecReload=-/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
+ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'

 ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'

--- a/named.conf
+++ b/named.conf
@ -34,6 +34,7 @@ options {
 	dnssec-validation yes;

 	managed-keys-directory "/var/named/dynamic";
+	geoip-directory "/usr/share/GeoIP";

 	pid-file "/run/named/named.pid";
 	session-keyfile "/run/named/session.key";
--- a/named.empty
+++ b/named.empty
@ -1,8 +1,10 @@
-$TTL 1D
-@	IN SOA	localhost. root.localhost. (
-						0	; serial
-						3H	; refresh
-						1H	; retry
-						1W	; expire
-						3H )	; minimum
-	IN	NS	localhost.
+$TTL 3H
+@	IN SOA	@ rname.invalid. (
+					0	; serial
+					1D	; refresh
+					1H	; retry
+					1W	; expire
+					3H )	; minimum
+	NS	@
+	A	127.0.0.1
+	AAAA	::1
--- a/named.localhost
+++ b/named.localhost
@ -0,0 +1,10 @@
+$TTL 1D
+@	IN SOA	@ rname.invalid. (
+					0	; serial
+					1D	; refresh
+					1H	; retry
+					1W	; expire
+					3H )	; minimum
+	NS	@
+	A	127.0.0.1
+	AAAA	::1
--- a/named.loopback
+++ b/named.loopback
@ -0,0 +1,11 @@
+$TTL 1D
+@	IN SOA	@ rname.invalid. (
+					0	; serial
+					1D	; refresh
+					1H	; retry
+					1W	; expire
+					3H )	; minimum
+	NS	@
+	A	127.0.0.1
+	AAAA	::1
+	PTR	localhost.
--- a/named.rfc1912.zones
+++ b/named.rfc1912.zones
@ -0,0 +1,45 @@
+// named.rfc1912.zones:
+//
+// Provided by Red Hat caching-nameserver package 
+//
+// ISC BIND named zone configuration for zones recommended by
+// RFC 1912 section 4.1 : localhost TLDs and address zones
+// and https://tools.ietf.org/html/rfc6303
+// (c)2007 R W Franks
+// 
+// See /usr/share/doc/bind*/sample/ for example named configuration files.
+//
+// Note: empty-zones-enable yes; option is default.
+// If private ranges should be forwarded, add 
+// disable-empty-zone "."; into options
+// 
+
+zone "localhost.localdomain" IN {
+	type master;
+	file "named.localhost";
+	allow-update { none; };
+};
+
+zone "localhost" IN {
+	type master;
+	file "named.localhost";
+	allow-update { none; };
+};
+
+zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" IN {
+	type master;
+	file "named.loopback";
+	allow-update { none; };
+};
+
+zone "1.0.0.127.in-addr.arpa" IN {
+	type master;
+	file "named.loopback";
+	allow-update { none; };
+};
+
+zone "0.in-addr.arpa" IN {
+	type master;
+	file "named.empty";
+	allow-update { none; };
+};
--- a/named.root
+++ b/named.root
@ -0,0 +1,61 @@
+
+; <<>> DiG 9.11.3-RedHat-9.11.3-3.fc27 <<>> +bufsize=1200 +norec @a.root-servers.net
+; (2 servers found)
+;; global options: +cmd
+;; Got answer:
+;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 46900
+;; flags: qr aa; QUERY: 1, ANSWER: 13, AUTHORITY: 0, ADDITIONAL: 27
+
+;; OPT PSEUDOSECTION:
+; EDNS: version: 0, flags:; udp: 1472
+;; QUESTION SECTION:
+;.				IN	NS
+
+;; ANSWER SECTION:
+.			518400	IN	NS	a.root-servers.net.
+.			518400	IN	NS	b.root-servers.net.
+.			518400	IN	NS	c.root-servers.net.
+.			518400	IN	NS	d.root-servers.net.
+.			518400	IN	NS	e.root-servers.net.
+.			518400	IN	NS	f.root-servers.net.
+.			518400	IN	NS	g.root-servers.net.
+.			518400	IN	NS	h.root-servers.net.
+.			518400	IN	NS	i.root-servers.net.
+.			518400	IN	NS	j.root-servers.net.
+.			518400	IN	NS	k.root-servers.net.
+.			518400	IN	NS	l.root-servers.net.
+.			518400	IN	NS	m.root-servers.net.
+
+;; ADDITIONAL SECTION:
+a.root-servers.net.	518400	IN	A	198.41.0.4
+b.root-servers.net.	518400	IN	A	199.9.14.201
+c.root-servers.net.	518400	IN	A	192.33.4.12
+d.root-servers.net.	518400	IN	A	199.7.91.13
+e.root-servers.net.	518400	IN	A	192.203.230.10
+f.root-servers.net.	518400	IN	A	192.5.5.241
+g.root-servers.net.	518400	IN	A	192.112.36.4
+h.root-servers.net.	518400	IN	A	198.97.190.53
+i.root-servers.net.	518400	IN	A	192.36.148.17
+j.root-servers.net.	518400	IN	A	192.58.128.30
+k.root-servers.net.	518400	IN	A	193.0.14.129
+l.root-servers.net.	518400	IN	A	199.7.83.42
+m.root-servers.net.	518400	IN	A	202.12.27.33
+a.root-servers.net.	518400	IN	AAAA	2001:503:ba3e::2:30
+b.root-servers.net.	518400	IN	AAAA	2001:500:200::b
+c.root-servers.net.	518400	IN	AAAA	2001:500:2::c
+d.root-servers.net.	518400	IN	AAAA	2001:500:2d::d
+e.root-servers.net.	518400	IN	AAAA	2001:500:a8::e
+f.root-servers.net.	518400	IN	AAAA	2001:500:2f::f
+g.root-servers.net.	518400	IN	AAAA	2001:500:12::d0d
+h.root-servers.net.	518400	IN	AAAA	2001:500:1::53
+i.root-servers.net.	518400	IN	AAAA	2001:7fe::53
+j.root-servers.net.	518400	IN	AAAA	2001:503:c27::2:30
+k.root-servers.net.	518400	IN	AAAA	2001:7fd::1
+l.root-servers.net.	518400	IN	AAAA	2001:500:9f::42
+m.root-servers.net.	518400	IN	AAAA	2001:dc3::35
+
+;; Query time: 24 msec
+;; SERVER: 198.41.0.4#53(198.41.0.4)
+;; WHEN: Thu Apr 05 15:57:34 CEST 2018
+;; MSG SIZE  rcvd: 811
+
--- a/named.root.key
+++ b/named.root.key
@ -0,0 +1,19 @@
+managed-keys {
+        # ROOT KEYS: See https://data.iana.org/root-anchors/root-anchors.xml
+        # for current trust anchor information.
+        #
+        # This key (20326) was published in the root zone in 2017.
+        # Servers which were already using the old key (19036) should
+        # roll seamlessly to this new one via RFC 5011 rollover. Servers
+        # being set up for the first time can use the contents of this
+        # file as initializing keys; thereafter, the keys in the
+        # managed key database will be trusted and maintained
+        # automatically.
+        . initial-key 257 3 8 "AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3
+                +/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kv
+                ArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF
+                0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+e
+                oZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfd
+                RUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwN
+                R1AkUTV74bU=";
+};
--- a/named.service
+++ b/named.service
@ -15,8 +15,7 @@ PIDFile=/run/named/named.pid

 ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
 ExecStart=/usr/sbin/named -u named -c ${NAMEDCONF} $OPTIONS
-; until https://github.com/systemd/systemd/pull/13098 is present, ignore return value
-ExecReload=-/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
+ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'

 ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'

--- a/4
+++ b/4
@ -1,2 +1,2 @@
-SHA512 (bind-9.11.11.tar.gz) = 52a3e94b686bb8a9c5ec327bb9a23c6f94762a9c6f2080bfe06feb07ec432ece5f6554bdd4f5e9f39cc77e7da4c8330449d89e3dc92716e133c5be41a867d7a0
-SHA512 (config-19.tar.bz2) = 36aa38a0c7c33267ae594b31c81681290ac58dde7ca6749bd599da531380b5b1428330813dbe983e01071ccaed83e83f6a9cd92179a53b7d0ccbb6851a0b017c
+SHA512 (bind-9.11.22.tar.gz) = 8ed2ed661b87705bbb7ddde3076a132b4e53971d669600997abfa104404e0c8b4bf04cc04c6be1c2c701123db5e0d4645ab797e5a985a18f5a1d68824a3df3ed
+SHA512 (bind-9.11.22.tar.gz.asc) = 009c2035f8ed992771b863369f480575e91b2dbaad50fbfd5322cd8761bf4dced0870c448375ad746271717b6847012a2ba5f9dcc862f63c05ff6b1fcd77885f
--- a/tests/Master-server-chrooted/PURPOSE
+++ b/tests/Master-server-chrooted/PURPOSE
@ -1,3 +1,6 @@
 PURPOSE of /CoreOS/tests/Sanity/Master-server-chrooted
 Description: Run basic empty named-chroot service and try to resolve localhost on it
 Author: Petr Mensik <pemensik@redhat.com>
+
+Check also clean package both when running and finished.
+https://bugzilla.redhat.com/show_bug.cgi?id=1592873
--- a/tests/Master-server-chrooted/runtest.sh
+++ b/tests/Master-server-chrooted/runtest.sh
@ -34,10 +34,13 @@ PACKAGE="bind"
 test_service()
 {
    local SERVICE="$1"
+    local PACKAGE="$2"
 	rlRun "rlServiceStart $SERVICE"
 	rlRun "dig @localhost localhost | grep '^localhost'"
 	rlRun "dig @localhost -x 127.0.0.1 | grep 'PTR[[:space:]]\+localhost.$'" 0 "Reverse address works"
+	rlRun "rpm -V $PACKAGE" 0 "Checking $SERVICE package when running"
 	rlRun "rlServiceRestore $SERVICE"
+	rlRun "rpm -V $PACKAGE" 0 "Checking $SERVICE package when stopped"
 }

 rlJournalStart
@ -48,16 +51,16 @@ rlJournalStart
    rlPhaseEnd

    rlPhaseStartTest "Testing named"
-    	test_service named
+	test_service named bind
    rlPhaseEnd

    rlPhaseStartTest "Testing named-chroot"
-    	test_service named-chroot
+	test_service named-chroot bind-chroot
    rlPhaseEnd

    rlPhaseStartTest "Testing named-sdb-chroot"
 	    if rpm -q bind-sdb-chroot; then
-		test_service named-sdb-chroot
+		test_service named-sdb-chroot bind-sdb-chroot
 	    else
 		rlLog "bind-sdb-chroot not installed, skipping it"
 	    fi
--- a/tests/tests.yml
+++ b/tests/tests.yml
@ -5,22 +5,7 @@
  - role: standard-test-beakerlib
    tags:
    - classic
-    tests:
-    - Master-server-chrooted
-    - Master-server-not-chrooted
-    - Run-internal-BIND-test-suite
-    required_packages:
-    - bind
-    - bind-chroot
-    - bind-sdb-chroot
-    - redhat-lsb
-    - bind-utils
-    - dnf-utils
-    - kyua
-    - bind-devel
-    - perl-Net-DNS
-    - perl-Net-DNS-Nameserver
-    - perl-Time-HiRes
-    - softhsm
-    - bind-pkcs11
-    - bind-pkcs11-utils
+    repositories:
+    - repo: "https://github.com/InfrastructureServices/bind-tests.git"
+      dest: "bind-tests"
+      fmf_filter: "tier: 1"
Author	SHA1	Message	Date
Petr Menšík	b4d1d70e70	Update to 9.11.22 https://downloads.isc.org/isc/bind9/9.11.22/RELEASE-NOTES-bind-9.11.22.html (cherry picked from commit `745f43ac05`)	2020-08-21 19:14:19 +02:00
Petr Menšík	d1665f8bac	Update to 9.11.21 Only bugfix release without significant changes. Release notes at: https://downloads.isc.org/isc/bind9/9.11.21/RELEASE-NOTES-bind-9.11.21.html	2020-07-17 11:27:15 +02:00
Petr Menšík	300adf239e	Update to 9.11.20 Fixes CVE-2020-8619 and few more issues	2020-06-17 22:58:40 +02:00
Petr Menšík	08b764d712	Make usage of initscripts optional Do not depend hard on initscript just to provide fancy colored status. When started from systemd, it does not really matter. Return exactly the same return code as returned by the original tool. (cherry picked from commit `04ea238d47`)	2020-05-25 23:16:40 +02:00
Petr Menšík	aa1538f996	Update to 9.11.19 Includes new CVE fixes (cherry picked from commit `62efd292f1`)	2020-05-25 23:16:40 +02:00
Petr Menšík	f5643c8a71	Make spec work also on CentOS 8 Move some conditional requirements to be enabled just on Fedora. (cherry picked from commit `96e1d963a4`)	2020-05-25 23:16:40 +02:00
Petr Menšík	fbe767f651	Update to BIND 9.11.18 From Upstream Release notes: Security Fixes DNS rebinding protection was ineffective when BIND 9 is configured as a forwarding DNS server. Found and responsibly reported by Tobias Klein. [GL #1574] Known Issues We have received reports that in some circumstances, receipt of an IXFR can cause the processing of queries to slow significantly. Some of these were related to RPZ processing, which has been fixed in this release (see below). Others appear to occur where there are NSEC3-related changes (such as an operator changing the NSEC3 salt used in the hash calculation). These are being investigated. [GL #1685] (cherry picked from commit `6e3b160e37`)	2020-05-25 23:05:11 +02:00
Petr Menšík	59d7eb1e5c	Remove unused patches (cherry picked from commit `5c15ad824e`)	2020-05-25 23:02:48 +02:00
Petr Menšík	dee096aad2	Update to 9.11.17 Updated a bit SDB related patches. (cherry picked from commit `c223e3e275`)	2020-05-25 23:02:45 +02:00
Petr Menšík	d391f2e8db	Use CI from master branch Use just the same tests.yml as master. Do not use whole history.	2020-04-14 14:14:40 +02:00
Petr Menšík	51b4aa2e59	Fix oot build gen would not compile under oot build	2020-01-06 11:30:10 +01:00
Petr Menšík	5c2cd3cd99	Include more Thread Sanitizer changes Fix as much race conditions as possible.	2020-01-06 11:30:10 +01:00
Petr Menšík	01631539dd	Update to 9.11.14 Includes ThreadSanitizer fixes already included as downstream patches. Adjusts serve-stale patch, one new statistics.	2020-01-02 20:54:13 +01:00
Petr Menšík	9e73702674	Add one more candidate for issue fixing Imported from upstream commit 6eed12605154b8ce10e9be0f51253e6ec318550e	2020-01-02 20:51:54 +01:00
Petr Menšík	abb34de75c	Add ThreadSanitizer support Has to be enabled in build by --with TSAN. Would make build fail unit tests and print many warnings about possible race conditions. Not useful for production build, but useful for debugging thread related problems in system tests.	2020-01-02 19:35:54 +01:00
Petr Menšík	6e112e84d2	Bump spec for bug #1736762	2019-12-02 21:20:11 +01:00
Petr Menšík	04286fc0ca	Backport a few upstream thread safety fixes It might not fix all issues, but was detected by upstream using automated tool. Should not break anything new, but might fix issue triggered usually on ppc64le platform.	2019-12-02 21:20:09 +01:00
Petr Menšík	78984ed0ce	Complete explicit disabling of RSAMD5 in FIPS mode (#1709553 ) Previous fix included just part inside named. However, checking part would check algorithm support also in check library. The code is almost the same. Permit already disabled algoritms also in libbind9. Use the same change as RHEL.	2019-11-26 20:07:15 +01:00
Petr Menšík	a50207333e	Remove tabs from spec rpmlint complains about mixed spaces and tabs. Set vim mode and remove tabs added by recent commit.	2019-11-26 19:12:04 +01:00
Petr Menšík	3e885e2516	Add source verification on build Include verification on build time, with link to GPG keys on upstream site. Signed-off-by: Petr Menšík <pemensik@redhat.com>	2019-11-26 19:12:04 +01:00
Petr Menšík	79ec96f99d	Update to 9.11.13 Includes fix for: * CVE-2019-6477 bind: TCP Pipelining doesn't limit TCP clients on a single connection	2019-11-26 19:11:07 +01:00
Petr Menšík	7ef62cba9b	Remove reload related comments from services Seems systemd already fixes reload return codes. Remove comment from systemd service files.	2019-11-26 19:08:53 +01:00
Petr Menšík	440b4d50ee	Report error on reload failure (#1739441 ) Return failed status code to command. Not only report error message to the log, but also report reload success. Must not terminate running service on failed reload.	2019-11-26 19:08:43 +01:00
Petr Menšík	a76ab2ea75	Add helper for testing system daemons Modifies already generated Makefiles to link against system libraries, instead of static built artifacts.	2019-11-26 19:01:43 +01:00
Petr Menšík	ed36b6dd70	Fix wrong default GeoIP directory (#1768258 )	2019-11-26 19:01:43 +01:00
Petr Menšík	7f28edd514	Update chroot test to check RPM verify In bug #1592873, error on chroot was reported. Ensure it does not reappear.	2019-11-26 19:01:43 +01:00
Petr Menšík	b118fbaefa	Improve SYSTEMTEST running on build time Use parallel execution on test run. Support already configured interfaces without special permissions on build. It can either use already present addresses or configure it on build time. If it has no rights to configure it, just skip the test and continue.	2019-11-26 19:01:43 +01:00
Petr Menšík	ea6e48e0a1	Add GeoIP configuration into config file Upstream has wrong default path of GeoIP2. Use it explicitly.	2019-11-26 19:01:43 +01:00
Petr Menšík	018d2c035d	Remove config archive with zone files Few configuration and zone files were moved into tarball by commit `55b04de09a`. It makes tracking of changes difficult, hardens rebases, makes difficult building without proper lookaside cache. Those files are tiny, no need to hold them inside compressed binary archive. Move them out. Replaces also few places with proper directory macros.	2019-11-26 19:01:43 +01:00
Petr Menšík	12763cd29b	Adjust patches to 9.11.12 Few changes occured, remove one upstream applied patch.	2019-11-26 19:01:43 +01:00
Petr Menšík	497234a5e0	Update to 9.11.12 (#1557762 )	2019-11-26 19:01:43 +01:00