Update to 9.16.33

Resolves: CVE-2022-2795 CVE-2022-3080 CVE-2022-38178 CVE-2022-38177

.gitignore

@@ -156,3 +156,23 @@ bind-9.7.2b1.tar.gz
 /bind-9.16.19.tar.xz.asc
 /bind-9.16.20.tar.xz
 /bind-9.16.20.tar.xz.asc
+/bind-9.16.21.tar.xz
+/bind-9.16.21.tar.xz.asc
+/bind-9.16.22.tar.xz
+/bind-9.16.22.tar.xz.asc
+/bind-9.16.23.tar.xz
+/bind-9.16.23.tar.xz.asc
+/bind-9.16.24.tar.xz
+/bind-9.16.24.tar.xz.asc
+/bind-9.16.27.tar.xz
+/bind-9.16.27.tar.xz.asc
+/bind-9.16.28.tar.xz
+/bind-9.16.28.tar.xz.asc
+/bind-9.16.29.tar.xz
+/bind-9.16.29.tar.xz.asc
+/bind-9.16.30.tar.xz
+/bind-9.16.30.tar.xz.asc
+/bind-9.16.31.tar.xz
+/bind-9.16.31.tar.xz.asc
+/bind-9.16.33.tar.xz
+/bind-9.16.33.tar.xz.asc

bind-9.11-fips-disable.patch

@@ -1,65 +0,0 @@
-From 2b0dce163a119f5f62eb4428b485f7575f321d6f Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Mon, 5 Aug 2019 11:54:03 +0200
-Subject: [PATCH] Allow explicit disabling of autodisabled MD5
-
-Default security policy might include explicitly disabled RSAMD5
-algorithm. Current FIPS code automatically disables in FIPS mode. But if
-RSAMD5 is included in security policy, it fails to start, because that
-algorithm is not recognized. Allow it disabled, but fail on any
-other usage.
----
- bin/named/server.c | 4 ++--
- lib/bind9/check.c  | 4 ++++
- lib/dns/rcode.c    | 1 +
- 3 files changed, 7 insertions(+), 2 deletions(-)
-
-diff --git a/bin/named/server.c b/bin/named/server.c
-index ee23f10..22a5c01 100644
---- a/bin/named/server.c
-+++ b/bin/named/server.c
-@@ -1689,12 +1689,12 @@ disable_algorithms(const cfg_obj_t *disabled, dns_resolver_t *resolver) {
- 		r.length = strlen(r.base);
- 
- 		result = dns_secalg_fromtext(&alg, &r);
--		if (result != ISC_R_SUCCESS) {
-+		if (result != ISC_R_SUCCESS && result != ISC_R_DISABLED) {
- 			uint8_t ui;
- 			result = isc_parse_uint8(&ui, r.base, 10);
- 			alg = ui;
- 		}
--		if (result != ISC_R_SUCCESS) {
-+		if (result != ISC_R_SUCCESS && result != ISC_R_DISABLED) {
- 			cfg_obj_log(cfg_listelt_value(element), named_g_lctx,
- 				    ISC_LOG_ERROR, "invalid algorithm");
- 			CHECK(result);
-diff --git a/lib/bind9/check.c b/lib/bind9/check.c
-index f49a346..dbf9ddb 100644
---- a/lib/bind9/check.c
-+++ b/lib/bind9/check.c
-@@ -317,6 +317,10 @@ disabled_algorithms(const cfg_obj_t *disabled, isc_log_t *logctx) {
- 		r.length = strlen(r.base);
- 
- 		tresult = dns_secalg_fromtext(&alg, &r);
-+		if (tresult == ISC_R_DISABLED) {
-+			// Recognize disabled algorithms, disable it explicitly
-+			tresult = ISC_R_SUCCESS;
-+		}
- 		if (tresult != ISC_R_SUCCESS) {
- 			cfg_obj_log(cfg_listelt_value(element), logctx,
- 				    ISC_LOG_ERROR, "invalid algorithm '%s'",
-diff --git a/lib/dns/rcode.c b/lib/dns/rcode.c
-index 327248e..78adf63 100644
---- a/lib/dns/rcode.c
-+++ b/lib/dns/rcode.c
-@@ -152,6 +152,7 @@ static struct tbl rcodes[] = { RCODENAMES ERCODENAMES };
- static struct tbl tsigrcodes[] = { RCODENAMES TSIGRCODENAMES };
- static struct tbl certs[] = { CERTNAMES };
- static struct tbl secalgs[] = { SECALGNAMES };
-+static struct tbl md5_secalgs[] = { MD5_SECALGNAMES };
- static struct tbl secprotos[] = { SECPROTONAMES };
- static struct tbl hashalgs[] = { HASHALGNAMES };
- static struct tbl dsdigests[] = { DSDIGESTNAMES };
--- 
-2.21.1
-

bind-9.11-fips-tests.patch

@@ -1,4 +1,4 @@
-From 3f04cf343dbeb8819197702ce1be737e26e0638a Mon Sep 17 00:00:00 2001
+From 9575852be2344244ac182d7d019869406d3bd963 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 2 Aug 2018 23:46:45 +0200
 Subject: [PATCH] FIPS tests changes
@@ -73,7 +73,8 @@ Date:   Wed Mar 7 10:44:23 2018 +0100
  .../system/allow-query/ns2/named40.conf.in    |  4 +-
  bin/tests/system/allow-query/tests.sh         | 18 ++---
  bin/tests/system/catz/ns1/named.conf.in       |  2 +-
- bin/tests/system/catz/ns2/named.conf.in       |  2 +-
+ bin/tests/system/catz/ns2/named1.conf.in      |  2 +-
+ bin/tests/system/catz/ns2/named2.conf.in      |  2 +-
  bin/tests/system/checkconf/bad-tsig.conf      |  2 +-
  bin/tests/system/checkconf/good.conf          |  2 +-
  bin/tests/system/feature-test.c               | 14 ++++
@@ -91,7 +92,7 @@ Date:   Wed Mar 7 10:44:23 2018 +0100
  bin/tests/system/tsig/tests.sh                | 65 ++++++++++++-------
  bin/tests/system/upforwd/ns1/named.conf.in    |  2 +-
  bin/tests/system/upforwd/tests.sh             |  2 +-
- 33 files changed, 162 insertions(+), 108 deletions(-)
+ 34 files changed, 163 insertions(+), 109 deletions(-)
  create mode 100644 bin/tests/system/tsig/ns1/rndc5.conf.in
 
 diff --git a/bin/tests/system/acl/ns2/named1.conf.in b/bin/tests/system/acl/ns2/named1.conf.in
@@ -526,15 +527,26 @@ index 1218669..e62715e 100644
 -	algorithm hmac-md5;
 +	algorithm hmac-sha256;
  };
-diff --git a/bin/tests/system/catz/ns2/named.conf.in b/bin/tests/system/catz/ns2/named.conf.in
+diff --git a/bin/tests/system/catz/ns2/named1.conf.in b/bin/tests/system/catz/ns2/named1.conf.in
 index 30333e6..4005152 100644
---- a/bin/tests/system/catz/ns2/named.conf.in
-+++ b/bin/tests/system/catz/ns2/named.conf.in
+--- a/bin/tests/system/catz/ns2/named1.conf.in
++++ b/bin/tests/system/catz/ns2/named1.conf.in
 @@ -70,5 +70,5 @@ zone "catalog4.example" {
  
  key tsig_key. {
  	secret "LSAnCU+Z";
 -	algorithm hmac-md5;
++	algorithm hmac-sha256;
+ };
+diff --git a/bin/tests/system/catz/ns2/named2.conf.in b/bin/tests/system/catz/ns2/named2.conf.in
+index fcd99ca..84c97ca 100644
+--- a/bin/tests/system/catz/ns2/named2.conf.in
++++ b/bin/tests/system/catz/ns2/named2.conf.in
+@@ -56,5 +56,5 @@ zone "catalog4.example" {
+ 
+ key tsig_key. {
+ 	secret "LSAnCU+Z";
+-	algorithm hmac-md5;
 +	algorithm hmac-sha256;
  };
 diff --git a/bin/tests/system/checkconf/bad-tsig.conf b/bin/tests/system/checkconf/bad-tsig.conf
@@ -551,10 +563,10 @@ index 21be03e..e57c308 100644
  };
  
 diff --git a/bin/tests/system/checkconf/good.conf b/bin/tests/system/checkconf/good.conf
-index e09b9e8..2e824b3 100644
+index 616a544..e3a59a5 100644
 --- a/bin/tests/system/checkconf/good.conf
 +++ b/bin/tests/system/checkconf/good.conf
-@@ -210,6 +210,6 @@ dyndb "name" "library.so" {
+@@ -268,6 +268,6 @@ dyndb "name" "library.so" {
  	system;
  };
  key "mykey" {
@@ -670,10 +682,10 @@ index da6b3b4..c547e47 100644
  };
  
 diff --git a/bin/tests/system/nsupdate/setup.sh b/bin/tests/system/nsupdate/setup.sh
-index c055da3..4e1242b 100644
+index 5593a2e..7cd1a74 100644
 --- a/bin/tests/system/nsupdate/setup.sh
 +++ b/bin/tests/system/nsupdate/setup.sh
-@@ -56,7 +56,11 @@ EOF
+@@ -71,7 +71,11 @@ EOF
  
  $DDNSCONFGEN -q -z example.nil > ns1/ddns.key
  
@@ -687,10 +699,10 @@ index c055da3..4e1242b 100644
  $DDNSCONFGEN -q -a hmac-sha224 -k sha224-key -z keytests.nil > ns1/sha224.key
  $DDNSCONFGEN -q -a hmac-sha256 -k sha256-key -z keytests.nil > ns1/sha256.key
 diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh
-index b35d797..41c128e 100755
+index 8839131..fde6135 100755
 --- a/bin/tests/system/nsupdate/tests.sh
 +++ b/bin/tests/system/nsupdate/tests.sh
-@@ -797,7 +797,14 @@ fi
+@@ -824,7 +824,14 @@ fi
  n=`expr $n + 1`
  ret=0
  echo_i "check TSIG key algorithms (nsupdate -k) ($n)"
@@ -706,7 +718,7 @@ index b35d797..41c128e 100755
      $NSUPDATE -k ns1/${alg}.key <<END > /dev/null || ret=1
  server 10.53.0.1 ${PORT}
  update add ${alg}.keytests.nil. 600 A 10.10.10.3
-@@ -805,7 +812,7 @@ send
+@@ -832,7 +839,7 @@ send
  END
  done
  sleep 2
@@ -715,7 +727,7 @@ index b35d797..41c128e 100755
      $DIG $DIGOPTS +short @10.53.0.1 ${alg}.keytests.nil | grep 10.10.10.3 > /dev/null 2>&1 || ret=1
  done
  if [ $ret -ne 0 ]; then
-@@ -816,7 +823,7 @@ fi
+@@ -843,7 +850,7 @@ fi
  n=`expr $n + 1`
  ret=0
  echo_i "check TSIG key algorithms (nsupdate -y) ($n)"
@@ -724,7 +736,7 @@ index b35d797..41c128e 100755
      secret=$(sed -n 's/.*secret "\(.*\)";.*/\1/p' ns1/${alg}.key)
      $NSUPDATE -y "hmac-${alg}:${alg}-key:$secret" <<END > /dev/null || ret=1
  server 10.53.0.1 ${PORT}
-@@ -825,7 +832,7 @@ send
+@@ -852,7 +859,7 @@ send
  END
  done
  sleep 2
@@ -734,10 +746,10 @@ index b35d797..41c128e 100755
  done
  if [ $ret -ne 0 ]; then
 diff --git a/bin/tests/system/rndc/setup.sh b/bin/tests/system/rndc/setup.sh
-index b59e7a7..04d5f5a 100644
+index 225722f..63ac938 100644
 --- a/bin/tests/system/rndc/setup.sh
 +++ b/bin/tests/system/rndc/setup.sh
-@@ -33,7 +33,7 @@ make_key () {
+@@ -38,7 +38,7 @@ make_key () {
              sed 's/allow { 10.53.0.4/allow { any/' >> ns4/named.conf
  }
  
@@ -747,10 +759,10 @@ index b59e7a7..04d5f5a 100644
  make_key 3 ${EXTRAPORT3} hmac-sha224
  make_key 4 ${EXTRAPORT4} hmac-sha256
 diff --git a/bin/tests/system/rndc/tests.sh b/bin/tests/system/rndc/tests.sh
-index 9fd84ed..d0b188f 100644
+index 9bf86c6..b8a7a1f 100644
 --- a/bin/tests/system/rndc/tests.sh
 +++ b/bin/tests/system/rndc/tests.sh
-@@ -348,15 +348,20 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
+@@ -349,15 +349,20 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
  status=`expr $status + $ret`
  
  n=`expr $n + 1`
@@ -955,5 +967,5 @@ index a50c896..8062d68 100644
  update add updated.example. 600 A 10.10.10.1
  update add updated.example. 600 TXT Foo
 -- 
-2.26.2
+2.31.1
 

bind-9.11-rh1666814.patch

@@ -1,4 +1,4 @@
-From a1a4730c1f02cd85680cf7608ac81e0db59ee522 Mon Sep 17 00:00:00 2001
+From d05d116da39c0a5c580ceaac6ba069899b82c5a0 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Wed, 16 Jan 2019 16:27:33 +0100
 Subject: [PATCH] Fix possible crash when loading corrupted file
@@ -6,23 +6,14 @@ Subject: [PATCH] Fix possible crash when loading corrupted file
 Some values passes internal triggers by coincidence. Fix the check and
 check also first_node_offset before even passing it further.
 ---
- lib/dns/rbt.c | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
+ lib/dns/rbt.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
 
 diff --git a/lib/dns/rbt.c b/lib/dns/rbt.c
-index ef6441b..404fd6d 100644
+index 5aee5f6..7f2c2d2 100644
 --- a/lib/dns/rbt.c
 +++ b/lib/dns/rbt.c
-@@ -754,7 +754,7 @@ treefix(dns_rbt_t *rbt, void *base, size_t filesize, dns_rbtnode_t *n,
- 	}
- 
- 	CONFIRM((void *)n >= base);
--	CONFIRM((char *)n - (char *)base <= (int)nodemax);
-+	CONFIRM((size_t)((char *)n - (char *)base) <= (int)nodemax);
- 	CONFIRM(DNS_RBTNODE_VALID(n));
- 
- 	dns_name_init(&nodename, NULL);
-@@ -911,7 +911,9 @@ dns_rbt_deserialize_tree(void *base_address, size_t filesize,
+@@ -945,7 +945,9 @@ dns_rbt_deserialize_tree(void *base_address, size_t filesize,
  	rbt->root = (dns_rbtnode_t *)((char *)base_address + header_offset +
  				      header->first_node_offset);
  
@@ -34,5 +25,5 @@ index ef6441b..404fd6d 100644
  		goto cleanup;
  	}
 -- 
-2.21.1
+2.31.1
 

bind-9.14-json-c.patch

@@ -1,95 +0,0 @@
-From 0698eb93f6e618d2882ae2c8758c5fa87524bea6 Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Tue, 23 Jul 2019 12:10:39 +0200
-Subject: [PATCH] Allow explicitly using json-c but not libjson
-
-Separate detection of json support. Allows explicit use of json-c when
-jsoncpp package is found. Have to use --without-libjson --with-json-c.
----
- configure.ac | 52 +++++++++++++++++++++++++++++++++++++++++-----------
- 1 file changed, 41 insertions(+), 11 deletions(-)
-
-diff --git a/configure.ac b/configure.ac
-index f7978e4..40b4f9f 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -1331,7 +1331,6 @@ AC_ARG_WITH(libjson,
- 	    use_libjson="$withval", use_libjson="auto")
- 
- have_libjson=""
--have_libjson_c=""
- case "$use_libjson" in
- 	no)
- 		libjson_libs=""
-@@ -1347,7 +1346,43 @@ case "$use_libjson" in
- 					LIBS="$LIBS -L${d}/lib"
- 				fi
- 				have_libjson="yes"
--			elif test -f "${d}/include/json-c/json.h"
-+			fi
-+		done
-+		;;
-+	*)
-+		if test -f "${use_libjson}/include/json/json.h"
-+		then
-+			libjson_cflags="-I${use_libjson}/include"
-+			LIBS="$LIBS -L${use_libjson}/lib"
-+			have_libjson="yes"
-+		else
-+			AC_MSG_ERROR([$use_libjson/include/json/json.h not found.])
-+		fi
-+		;;
-+esac
-+
-+#
-+# was --with-json-c specified?
-+#
-+AC_ARG_WITH(json-c,
-+	    AS_HELP_STRING([--with-json-c[=PATH]],
-+			   [build with json-c library [yes|no|path]]),
-+	    use_json_c="$withval", use_json_c="$use_libjson")
-+
-+if test "X${have_libjson}" != "X"
-+then
-+	# Do not use if libjson were found
-+	use_json_c=no
-+fi
-+
-+have_libjson_c=""
-+case "$use_json_c" in
-+	no)
-+		;;
-+	auto|yes)
-+		for d in /usr /usr/local /opt/local
-+		do
-+			if test -f "${d}/include/json-c/json.h"
- 			then
- 				if test ${d} != /usr
- 				then
-@@ -1360,19 +1395,14 @@ case "$use_libjson" in
- 		done
- 		;;
- 	*)
--		if test -f "${use_libjson}/include/json/json.h"
--		then
--			libjson_cflags="-I${use_libjson}/include"
--			LIBS="$LIBS -L${use_libjson}/lib"
--			have_libjson="yes"
--		elif test -f "${use_libjson}/include/json-c/json.h"
-+		if test -f "${use_json_c}/include/json-c/json.h"
- 		then
--			libjson_cflags="-I${use_libjson}/include"
--			LIBS="$LIBS -L${use_libjson}/lib"
-+			libjson_cflags="-I${use_json_c}/include"
-+			LIBS="$LIBS -L${use_json_c}/lib"
- 			have_libjson="yes"
- 			have_libjson_c="yes"
- 		else
--			AC_MSG_ERROR([$use_libjson/include/json{,-c}/json.h not found.])
-+			AC_MSG_ERROR([$use_json_c/include/json-c/json.h not found.])
- 		fi
- 		;;
- esac
--- 
-2.20.1
-

bind-9.16-resolv.conf-options-timeout-test.patch

@@ -0,0 +1,113 @@
+From 7270604440268bb17b39ae734ff33003a67c8343 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
+Date: Tue, 20 Jul 2021 19:34:42 +0200
+Subject: [PATCH] Check parsed resconf values
+
+Add 'attempts' check, fix 'ndots' data. Create a bunch of verification
+functions and check parsed values, not just return codes.
+---
+ lib/irs/tests/resconf_test.c                 | 46 ++++++++++++++++++--
+ lib/irs/tests/testdata/options-attempts.conf | 10 +++++
+ lib/irs/tests/testdata/options-ndots.conf    |  2 +-
+ 3 files changed, 54 insertions(+), 4 deletions(-)
+ create mode 100644 lib/irs/tests/testdata/options-attempts.conf
+
+diff --git a/lib/irs/tests/resconf_test.c b/lib/irs/tests/resconf_test.c
+index 6951758..ce94345 100644
+--- a/lib/irs/tests/resconf_test.c
++++ b/lib/irs/tests/resconf_test.c
+@@ -45,6 +45,43 @@ setup_test() {
+ 	assert_return_code(chdir(TESTS), 0);
+ }
+ 
++static isc_result_t
++check_number(unsigned int n, unsigned int expected) {
++	return ((n == expected) ? ISC_R_SUCCESS : ISC_R_BADNUMBER);
++}
++
++static isc_result_t
++check_attempts(irs_resconf_t *resconf) {
++	return (check_number(irs_resconf_getattempts(resconf), 4));
++}
++
++static isc_result_t
++check_timeout(irs_resconf_t *resconf) {
++	return (check_number(irs_resconf_gettimeout(resconf), 1));
++}
++
++static isc_result_t
++check_ndots(irs_resconf_t *resconf) {
++	return (check_number(irs_resconf_getndots(resconf), 2));
++}
++
++static isc_result_t
++check_options(irs_resconf_t *resconf) {
++	if (irs_resconf_getattempts(resconf) != 3) {
++		return ISC_R_BADNUMBER; /* default value only */
++	}
++
++	if (irs_resconf_getndots(resconf) != 2) {
++		return ISC_R_BADNUMBER;
++	}
++
++	if (irs_resconf_gettimeout(resconf) != 1) {
++		return ISC_R_BADNUMBER;
++	}
++
++	return (ISC_R_SUCCESS);
++}
++
+ /* test irs_resconf_load() */
+ static void
+ irs_resconf_load_test(void **state) {
+@@ -64,15 +101,18 @@ irs_resconf_load_test(void **state) {
+ 		  ISC_R_SUCCESS },
+ 		{ "testdata/nameserver-v6-scoped.conf", ISC_R_SUCCESS, NULL,
+ 		  ISC_R_SUCCESS },
++		{ "testdata/options-attempts.conf", ISC_R_SUCCESS,
++		  check_attempts, ISC_R_SUCCESS },
+ 		{ "testdata/options-debug.conf", ISC_R_SUCCESS, NULL,
+ 		  ISC_R_SUCCESS },
+-		{ "testdata/options-ndots.conf", ISC_R_SUCCESS, NULL,
++		{ "testdata/options-ndots.conf", ISC_R_SUCCESS, check_ndots,
+ 		  ISC_R_SUCCESS },
+-		{ "testdata/options-timeout.conf", ISC_R_SUCCESS, NULL,
++		{ "testdata/options-timeout.conf", ISC_R_SUCCESS, check_timeout,
+ 		  ISC_R_SUCCESS },
+ 		{ "testdata/options-unknown.conf", ISC_R_SUCCESS, NULL,
+ 		  ISC_R_SUCCESS },
+-		{ "testdata/options.conf", ISC_R_SUCCESS, NULL, ISC_R_SUCCESS },
++		{ "testdata/options.conf", ISC_R_SUCCESS, check_options,
++		  ISC_R_SUCCESS },
+ 		{ "testdata/options-bad-ndots.conf", ISC_R_RANGE, NULL,
+ 		  ISC_R_SUCCESS },
+ 		{ "testdata/options-empty.conf", ISC_R_UNEXPECTEDEND, NULL,
+diff --git a/lib/irs/tests/testdata/options-attempts.conf b/lib/irs/tests/testdata/options-attempts.conf
+new file mode 100644
+index 0000000..4538643
+--- /dev/null
++++ b/lib/irs/tests/testdata/options-attempts.conf
+@@ -0,0 +1,10 @@
++# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
++#
++# This Source Code Form is subject to the terms of the Mozilla Public
++# License, v. 2.0. If a copy of the MPL was not distributed with this
++# file, you can obtain one at https://mozilla.org/MPL/2.0/.
++#
++# See the COPYRIGHT file distributed with this work for additional
++# information regarding copyright ownership.
++
++options attempts:4
+diff --git a/lib/irs/tests/testdata/options-ndots.conf b/lib/irs/tests/testdata/options-ndots.conf
+index 5d18d26..f37c712 100644
+--- a/lib/irs/tests/testdata/options-ndots.conf
++++ b/lib/irs/tests/testdata/options-ndots.conf
+@@ -9,4 +9,4 @@
+ # See the COPYRIGHT file distributed with this work for additional
+ # information regarding copyright ownership.
+ 
+-option ndots:2
++options ndots:2
+-- 
+2.35.3
+

bind-9.16-resolv.conf-options-timeout.patch

@@ -0,0 +1,203 @@
+From b0e79979672935ff07bf23703c675ee788940c59 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
+Date: Tue, 22 Jun 2021 16:35:46 +0200
+Subject: [PATCH] Parse 'timeout' and 'attempts' from resolv.conf
+
+It was supported by lwres in BIND 9.11, and is still mentioned in
+the manual page. Restore support for it by adding it to libirs.
+---
+ bin/dig/dighost.c             | 13 ++++++-
+ lib/irs/include/irs/resconf.h | 20 +++++++++++
+ lib/irs/resconf.c             | 64 ++++++++++++++++++++++++++++-------
+ 3 files changed, 84 insertions(+), 13 deletions(-)
+
+diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
+index 0222454..274e894 100644
+--- a/bin/dig/dighost.c
++++ b/bin/dig/dighost.c
+@@ -133,7 +133,7 @@ int sendcount = 0;
+ int recvcount = 0;
+ int sockcount = 0;
+ int ndots = -1;
+-int tries = 3;
++int tries = -1;
+ int lookup_counter = 0;
+ 
+ static char servercookie[256];
+@@ -1330,6 +1330,17 @@ setup_system(bool ipv4only, bool ipv6only) {
+ 		ndots = irs_resconf_getndots(resconf);
+ 		debug("ndots is %d.", ndots);
+ 	}
++	if (timeout == 0) {
++		timeout = irs_resconf_gettimeout(resconf);
++		debug("timeout is %d.", timeout);
++	}
++	if (tries == -1) {
++		tries = irs_resconf_getattempts(resconf);
++		if (tries == 0) {
++			tries = 3;
++		}
++		debug("retries is %d.", tries);
++	}
+ 
+ 	/* If user doesn't specify server use nameservers from resolv.conf. */
+ 	if (ISC_LIST_EMPTY(server_list)) {
+diff --git a/lib/irs/include/irs/resconf.h b/lib/irs/include/irs/resconf.h
+index 424b795..74fc84a 100644
+--- a/lib/irs/include/irs/resconf.h
++++ b/lib/irs/include/irs/resconf.h
+@@ -113,6 +113,26 @@ irs_resconf_getndots(irs_resconf_t *conf);
+  *\li	'conf' is a valid resconf object.
+  */
+ 
++unsigned int
++irs_resconf_getattempts(irs_resconf_t *conf);
++/*%<
++ * Return the 'attempts' value stored in 'conf'.
++ *
++ * Requires:
++ *
++ *\li	'conf' is a valid resconf object.
++ */
++
++unsigned int
++irs_resconf_gettimeout(irs_resconf_t *conf);
++/*%<
++ * Return the 'timeout' value stored in 'conf'.
++ *
++ * Requires:
++ *
++ *\li	'conf' is a valid resconf object.
++ */
++
+ ISC_LANG_ENDDECLS
+ 
+ #endif /* IRS_RESCONF_H */
+diff --git a/lib/irs/resconf.c b/lib/irs/resconf.c
+index 096064b..dd51d71 100644
+--- a/lib/irs/resconf.c
++++ b/lib/irs/resconf.c
+@@ -80,6 +80,13 @@
+ #define RESCONFMAXLINELEN     256U /*%< max size of a line */
+ #define RESCONFMAXSORTLIST    10U  /*%< max 10 */
+ 
++#define CHECK(op)                            \
++	do {                                 \
++		result = (op);               \
++		if (result != ISC_R_SUCCESS) \
++			goto cleanup;        \
++	} while (0)
++
+ /*!
+  * configuration data structure
+  */
+@@ -114,6 +121,10 @@ struct irs_resconf {
+ 	uint8_t resdebug;
+ 	/*%< set to n in 'options ndots:n' */
+ 	uint8_t ndots;
++	/*%< set to n in 'options attempts:n' */
++	uint8_t attempts;
++	/*%< set to n in 'options timeout:n' */
++	uint8_t timeout;
+ };
+ 
+ static isc_result_t
+@@ -176,8 +187,8 @@ eatwhite(FILE *fp) {
+  */
+ static int
+ getword(FILE *fp, char *buffer, size_t size) {
++	char *p = NULL;
+ 	int ch;
+-	char *p;
+ 
+ 	REQUIRE(buffer != NULL);
+ 	REQUIRE(size > 0U);
+@@ -457,11 +468,26 @@ resconf_parsesortlist(irs_resconf_t *conf, FILE *fp) {
+ 	return (ISC_R_SUCCESS);
+ }
+ 
++static isc_result_t
++resconf_optionnumber(const char *word, uint8_t *number) {
++	char *p;
++	long n;
++
++	n = strtol(word, &p, 10);
++	if (*p != '\0') { /* Bad string. */
++		return (ISC_R_UNEXPECTEDTOKEN);
++	}
++	if (n < 0 || n > 0xff) { /* Out of range. */
++		return (ISC_R_RANGE);
++	}
++	*number = n;
++	return (ISC_R_SUCCESS);
++}
++
+ static isc_result_t
+ resconf_parseoption(irs_resconf_t *conf, FILE *fp) {
+ 	int delim;
+-	long ndots;
+-	char *p;
++	isc_result_t result = ISC_R_SUCCESS;
+ 	char word[RESCONFMAXLINELEN];
+ 
+ 	delim = getword(fp, word, sizeof(word));
+@@ -473,14 +499,11 @@ resconf_parseoption(irs_resconf_t *conf, FILE *fp) {
+ 		if (strcmp("debug", word) == 0) {
+ 			conf->resdebug = 1;
+ 		} else if (strncmp("ndots:", word, 6) == 0) {
+-			ndots = strtol(word + 6, &p, 10);
+-			if (*p != '\0') { /* Bad string. */
+-				return (ISC_R_UNEXPECTEDTOKEN);
+-			}
+-			if (ndots < 0 || ndots > 0xff) { /* Out of range. */
+-				return (ISC_R_RANGE);
+-			}
+-			conf->ndots = (uint8_t)ndots;
++			CHECK(resconf_optionnumber(word + 6, &conf->ndots));
++		} else if (strncmp("attempts:", word, 9) == 0) {
++			CHECK(resconf_optionnumber(word + 9, &conf->attempts));
++		} else if (strncmp("timeout:", word, 8) == 0) {
++			CHECK(resconf_optionnumber(word + 8, &conf->timeout));
+ 		}
+ 
+ 		if (delim == EOF || delim == '\n') {
+@@ -490,7 +513,8 @@ resconf_parseoption(irs_resconf_t *conf, FILE *fp) {
+ 		}
+ 	}
+ 
+-	return (ISC_R_SUCCESS);
++cleanup:
++	return (result);
+ }
+ 
+ static isc_result_t
+@@ -532,6 +556,8 @@ irs_resconf_load(isc_mem_t *mctx, const char *filename, irs_resconf_t **confp) {
+ 	conf->sortlistnxt = 0;
+ 	conf->resdebug = 0;
+ 	conf->ndots = 1;
++	conf->attempts = 3;
++	conf->timeout = 0;
+ 	for (i = 0; i < RESCONFMAXSEARCH; i++) {
+ 		conf->search[i] = NULL;
+ 	}
+@@ -687,3 +713,17 @@ irs_resconf_getndots(irs_resconf_t *conf) {
+ 
+ 	return ((unsigned int)conf->ndots);
+ }
++
++unsigned int
++irs_resconf_getattempts(irs_resconf_t *conf) {
++	REQUIRE(IRS_RESCONF_VALID(conf));
++
++	return ((unsigned int)conf->attempts);
++}
++
++unsigned int
++irs_resconf_gettimeout(irs_resconf_t *conf) {
++	REQUIRE(IRS_RESCONF_VALID(conf));
++
++	return ((unsigned int)conf->timeout);
++}
+-- 
+2.35.3
+

bind-9.16.20-map-format-fix.patch

@@ -1,8 +0,0 @@
---- a/lib/dns/mapapi
-+++ b/lib/dns/mapapi
-@@ -13,4 +13,4 @@
- # Whenever releasing a new major release of BIND9, set this value
- # back to 1.0 when releasing the first alpha.  Map files are *never*
- # compatible across major releases.
--MAPAPI=2.0
-+MAPAPI=3.0

bind.spec

@@ -14,8 +14,7 @@
 %bcond_without DLZ
 # New MaxMind GeoLite support
 %bcond_without GEOIP2
-# Disabled temporarily until kyua is fixed on rawhide, bug #1926779
-%bcond_with UNITTEST
+%bcond_without UNITTEST
 %bcond_without DNSTAP
 %bcond_without LMDB
 %bcond_without DOC
@@ -52,8 +51,8 @@
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.16.20
-Release:  3%{?dist}
+Version:  9.16.33
+Release:  1%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -85,26 +84,28 @@ Source47: named-pkcs11.service
 Source48: setup-named-softhsm.sh
 Source49: named-chroot.files
 
-# Common patches
-Patch10: bind-9.5-PIE.patch
-Patch16: bind-9.16-redhat_doc.patch
-Patch72: bind-9.5-dlz-64bit.patch
-Patch106:bind93-rh490837.patch
-Patch112:bind97-rh645544.patch
-Patch130:bind-9.9.1-P2-dlz-libdb.patch
-# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/2688
-Patch133:bind99-rh640538.patch
 # Make PKCS11 used only for pkcs11 parts
-Patch135:bind-9.14-config-pkcs11.patch
+Patch1:  bind-9.14-config-pkcs11.patch
 # Fedora specific patch to distribute native-pkcs#11 functionality
-Patch136:bind-9.10-dist-native-pkcs11.patch
+Patch2:  bind-9.10-dist-native-pkcs11.patch
 # Do not use isc-pkcs11.
-Patch149:bind-9.11-kyua-pkcs11.patch
+Patch3:  bind-9.11-kyua-pkcs11.patch
 
-Patch157:bind-9.11-fips-tests.patch
-Patch164:bind-9.11-rh1666814.patch
-# https://gitlab.isc.org/isc-projects/bind9/-/issues/2872
-Patch172:https://downloads.isc.org/isc/bind9/9.16.20/patches/bind-9.16.20-map-format-fix.patch
+# Common patches
+Patch18: bind-9.5-PIE.patch
+Patch19: bind-9.16-redhat_doc.patch
+Patch20: bind-9.5-dlz-64bit.patch
+# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/5601
+Patch21: bind93-rh490837.patch
+Patch22: bind-9.11-fips-tests.patch
+Patch23: bind97-rh645544.patch
+Patch24: bind-9.9.1-P2-dlz-libdb.patch
+
+# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/2689
+Patch25:bind-9.11-rh1666814.patch
+# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/5273
+Patch27: bind-9.16-resolv.conf-options-timeout.patch
+Patch28: bind-9.16-resolv.conf-options-timeout-test.patch
 
 %{?systemd_ordering}
 Requires:       coreutils
@@ -302,12 +303,12 @@ Requires:  fstrm-devel%{?_isa} protobuf-c-devel%{?_isa}
 %endif
 %if %{with GEOIP2}
 Requires:  libmaxminddb-devel%{?_isa}
+%endif
 
 %description devel
 The bind-devel package contains full version of the header files and libraries
 required for building bind-dyndb-ldap. Upstream no longer supports nor recommends
 bind libraries for third party applications.
-%endif
 
 %package chroot
 Summary:        A chroot runtime environment for the ISC BIND DNS server, named(8)
@@ -392,32 +393,17 @@ in HTML and PDF format.
 # RHEL does not yet support this verification
 %{gpgverify} --keyring='%{SOURCE4}' --signature='%{SOURCE2}' --data='%{SOURCE0}'
 %endif
-%setup -q
-
-# Common patches
-%patch10 -p1 -b .PIE
-%patch16 -p1 -b .redhat_doc
-%patch72 -p1 -b .64bit
-%patch106 -p1 -b .rh490837
-%patch112 -p1 -b .rh645544
-%patch130 -p1 -b .libdb
-%patch157 -p1 -b .fips-tests
-%patch164 -p1 -b .rh1666814
-%patch172 -p1 -b .map-format
-
+%autosetup -n %{name}-%{version} -N
+%autopatch -p1 -m 18
 %if %{with PKCS11}
-%patch135 -p1 -b .config-pkcs11
+%autopatch -p1 -m 1 -M 1
 cp -r bin/named{,-pkcs11}
 cp -r bin/dnssec{,-pkcs11}
 cp -r lib/dns{,-pkcs11}
 cp -r lib/ns{,-pkcs11}
-%patch136 -p1 -b .dist_pkcs11
-%patch149 -p1 -b .kyua-pkcs11
+%autopatch -p1 -m 2 -M 17
 %endif
 
-%patch133 -p1 -b .rh640538
-touch doc/man/dig.rst
-
 # Sparc and s390 arches need to use -fPIE
 %ifarch sparcv9 sparc64 s390 s390x
 for i in bin/named/{,unix}/Makefile.in; do
@@ -1128,6 +1114,47 @@ fi;
 %endif
 
 %changelog
+* Thu Sep 22 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.33-1
+- Update to 9.16.33 (CVE-2022-2795, CVE-2022-3080, CVE-2022-38178,
+  CVE-2022-38177)
+
+* Wed Aug 03 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.31-1
+- Update to 9.16.31
+
+* Mon Jun 20 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.30-1
+- Update to 9.16.30 (#2097312)
+
+* Thu May 26 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.29-1
+- Update to 9.16.29 (#2087920)
+- Fix netmgr_test fails on s390x (#2088125)
+
+* Tue May 17 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.28-2
+- Parse again timeout and attempts from resolv.conf (#2087156)
+- Reenable unit tests during build
+
+* Wed Apr 20 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.28-1
+- Update to 9.16.28 (#2076941)
+
+* Thu Mar 17 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.27-1
+- Upgrade to 9.16.27 (#2055120)
+
+* Tue Mar 01 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.24-2
+- Switch to locked queue (#2048235)
+
+* Wed Dec 15 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.24-1
+- Update to 9.16.24 (#2032934)
+
+* Fri Nov 26 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-2
+- Correct with GEOIP2 condition (#2026823)
+
+* Fri Nov 19 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-1
+- Update to 9.16.23 (#2024210)
+
+* Wed Oct 27 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.22-1
+- Update to 9.16.22
+
+* Wed Sep 15 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.21-1
+- Update to 9.16.21
 
 * Wed Aug 25 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.20-3
 - Increase map format version, lower memory consuption a bit (#1997504)

bind99-rh640538.patch

@@ -1,43 +0,0 @@
-From d3c58d860737f0f70eff05edad77e0b2a90d4cb9 Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Fri, 19 Jun 2020 18:48:23 +0200
-Subject: [PATCH] .rh640538
-
----
- bin/dig/dig.rst | 20 ++++++++++++++++++++
- 1 file changed, 20 insertions(+)
-
-diff --git a/bin/dig/dig.rst b/bin/dig/dig.rst
-index bef52ba..9f16607 100644
---- a/bin/dig/dig.rst
-+++ b/bin/dig/dig.rst
-@@ -615,6 +615,26 @@ To turn off IDN support, use the parameters
- ``+noidnin`` and ``+noidnout``, or define the ``IDN_DISABLE`` environment
- variable.
- 
-+Return Codes
-+~~~~~~~~~~~~
-+
-+``dig`` return codes are:
-+
-+``0``
-+   Response received, including NXDOMAIN status
-+
-+``1``
-+   Usage error
-+
-+``8``
-+   Couldn't open batch file
-+
-+``9``
-+   No reply from server
-+
-+``10``
-+   Internal error
-+
- Files
- ~~~~~
- 
--- 
-2.26.2
-

sources

@@ -1,2 +1,2 @@
-SHA512 (bind-9.16.20.tar.xz) = bd4ffcc2589ca8f1ac228576ec11e86f317d5a78d7964a0a7ae70b2fa38831d5bd65c2e8c35d8190502de7139f85d8b080b3b8ee968811a8df78e5761781525d
-SHA512 (bind-9.16.20.tar.xz.asc) = ae4fdcd0ab40ac4adce6154ef3b251a552a7cd42dc8ebfd1c38dfd0a6ead5d6e74e67cb1f4247c4a3fb25a9580043635cc946e536f2a7ec8bc9e654dde2d58bf
+SHA512 (bind-9.16.33.tar.xz) = 43fd2cea52dfd1115a4cca83830ab5b93208be401cdbbdff2bbf204b8f0d99fb434ad3156d3a21649488cc904ae09f145feba97b9b6918b0cf063ff5e2b10af5
+SHA512 (bind-9.16.33.tar.xz.asc) = 08623d5fbc95f0709ba3a548c747d37a747a1ea329412eb594cf5302f6d4891474c8a4a2ff730919986e8bb180207397782f239024fd2a9d0cc6a8104d2d5a6d