Update to 9.18.49 (rhbz#2480121)

Security Fixes:

- Limit resolver server list size. (CVE-2026-3592)
- Fix GSS-API resource leak. (CVE-2026-3039)
- Disable recursion, UPDATE, and NOTIFY for non-IN views. (CVE-2026-5946)
- Avoid unbounded recursion loop. (CVE-2026-5950)
- Fix outgoing zone transfers' quota issue.

Feature Changes:

- Fix CPU spikes and slow queries when cache approaches memory limit.

Bug Fixes:

- Fix named crash when processing SIG records in dynamic updates.
- Fix rndc modzone behavior for a zone in named.conf.
- Fix zone verification of NSEC3 signed zones.
- Prevent a crash when using both dns64 and filter-aaaa.
- Fixed an assertion failure when processing catalog zones.
- Prevent malicious DNSSEC zones from exhausting validator CPU.
- Fix rndc-confgen aborting on HMAC-SHA-384/512 keys above 512 bits.
- Prevent crafted queries from degrading RRL performance.
- Fix a bug in allow-query/allow-transfer catalog zone custom properties.
- Fix a memory leak issue in catalog zones.
- Fix suppressed missing-glue check in named-checkzone.
- Reject record sets too large to serve in DNS.

Source: https://downloads.isc.org/isc/bind9/9.18.49/doc/arm/html/notes.html#notes-for-bind-9-18-49

bind-9.18-dig-idn-input-always.patch

@@ -0,0 +1,98 @@
+From fcc50604359a05e24003f3ff51c3812d8f307814 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
+Date: Wed, 6 Nov 2024 21:29:47 +0100
+Subject: [PATCH] Allow always IDN input in dig
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Even when stdout is non-interactive terminal, allow unicode characters
+to be encoded into ACE form. Still disable IDN output, but unless
++noidnin or IDN_DISABLE=1 env is detected, consider input as locale
+defined name.
+
+Provides more isolated change, which issue #3527 introduced similar
+behavior into 9.19 with more changes.
+
+Ignore input IDN errors when stdout is not terminal
+
+Attempt to prevent visible regressions when enabling IDN on input
+always. Instead of new hard failures preventing IDN decoding of input
+name just use original input.
+
+Should make the change backward compatible. When on interactive terminal
+behave the same way as before and emit hard errors. Become more
+forgiving in scripts where stdout leads to script. Decoding output is
+not enabled there and if input decoding fails, just use input as it was.
+
+Change dig manual +idnin
+
+Note in manual IDN input is always enabled. But it silently ignores
+errors when stdout is not a terminal to prevent regressions.
+
+Signed-off-by: Petr Menšík <pemensik@redhat.com>
+---
+ bin/dig/dig.rst   |  5 ++---
+ bin/dig/dighost.c | 16 ++++++++++++----
+ 2 files changed, 14 insertions(+), 7 deletions(-)
+
+diff --git a/bin/dig/dig.rst b/bin/dig/dig.rst
+index 88b0a40307..e2bf3764d3 100644
+--- a/bin/dig/dig.rst
++++ b/bin/dig/dig.rst
+@@ -453,9 +453,8 @@ abbreviation is unambiguous; for example, :option:`+cd` is equivalent to
+    This option processes [or does not process] IDN domain names on input. This requires
+    ``IDN SUPPORT`` to have been enabled at compile time.
+ 
+-   The default is to process IDN input when standard output is a tty.
+-   The IDN processing on input is disabled when :program:`dig` output is redirected
+-   to files, pipes, and other non-tty file descriptors.
++   The default is to process IDN input. The input IDN processing errors are ignored
++   when :program:`dig` output is redirected to files, pipes, and other non-tty file descriptors.
+ 
+ .. option:: +idnout, +noidnout
+ 
+diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
+index 0f8ac1335c..1307346192 100644
+--- a/bin/dig/dighost.c
++++ b/bin/dig/dighost.c
+@@ -604,7 +604,7 @@ dig_lookup_t *
+ make_empty_lookup(void) {
+ 	dig_lookup_t *looknew;
+ #ifdef HAVE_LIBIDN2
+-	bool idn_allowed = isatty(1) ? (getenv("IDN_DISABLE") == NULL) : false;
++	bool idn_allowed = (getenv("IDN_DISABLE") == NULL);
+ #endif /* HAVE_LIBIDN2 */
+ 
+ 	debug("make_empty_lookup()");
+@@ -623,7 +623,7 @@ make_empty_lookup(void) {
+ 		.badcookie = true,
+ #ifdef HAVE_LIBIDN2
+ 		.idnin = idn_allowed,
+-		.idnout = idn_allowed,
++		.idnout = isatty(1) && idn_allowed,
+ #endif /* HAVE_LIBIDN2 */
+ 		.udpsize = -1,
+ 		.edns = -1,
+@@ -4871,8 +4871,16 @@ idn_locale_to_ace(const char *src, char *dst, size_t dstlen) {
+ 		res = idn2_to_ascii_lz(src, &ascii_src, IDN2_TRANSITIONAL);
+ 	}
+ 	if (res != IDN2_OK) {
+-		fatal("'%s' is not a legal IDNA2008 name (%s), use +noidnin",
+-		      src, idn2_strerror(res));
++		if (isatty(1)) {
++			fatal("'%s' is not a legal IDNA2008 name (%s), use +noidnin",
++			      src, idn2_strerror(res));
++		} else {
++			/* In case of non-terminal output silently ignore errors
++			 * in IDN input decoding. */
++			(void)strlcpy(dst, src, dstlen);
++			resetlocale(LC_ALL);
++			return;
++		}
+ 	}
+ 
+ 	/*
+-- 
+2.50.1
+

bind-9.18-partial-additional-records.patch

@@ -0,0 +1,54 @@
+From 3f686891729c7d39d879e8b5bb1aa17d874d265d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
+Date: Thu, 19 Jun 2025 19:51:43 +0200
+Subject: [PATCH] Limit number of additional records fetched
+
+Limit number of started fetches for additional zone instead of doing
+none. Keep limit of NS filled with additional records, but present at
+least some if possible.
+
+Might help broken implementations relying on receiving addresses in the
+response for NS query in authoritative zone.
+---
+ lib/dns/rdataset.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/lib/dns/rdataset.c b/lib/dns/rdataset.c
+index 532e49a..bfa8e37 100644
+--- a/lib/dns/rdataset.c
++++ b/lib/dns/rdataset.c
+@@ -581,6 +581,7 @@ dns_rdataset_additionaldata(dns_rdataset_t *rdataset,
+ 			    size_t limit) {
+ 	dns_rdata_t rdata = DNS_RDATA_INIT;
+ 	isc_result_t result;
++	size_t n = 0;
+ 
+ 	/*
+ 	 * For each rdata in rdataset, call 'add' for each name and type in the
+@@ -590,10 +591,6 @@ dns_rdataset_additionaldata(dns_rdataset_t *rdataset,
+ 	REQUIRE(DNS_RDATASET_VALID(rdataset));
+ 	REQUIRE((rdataset->attributes & DNS_RDATASETATTR_QUESTION) == 0);
+ 
+-	if (limit != 0 && dns_rdataset_count(rdataset) > limit) {
+-		return DNS_R_TOOMANYRECORDS;
+-	}
+-
+ 	result = dns_rdataset_first(rdataset);
+ 	if (result != ISC_R_SUCCESS) {
+ 		return result;
+@@ -603,7 +600,11 @@ dns_rdataset_additionaldata(dns_rdataset_t *rdataset,
+ 		dns_rdataset_current(rdataset, &rdata);
+ 		result = dns_rdata_additionaldata(&rdata, owner_name, add, arg);
+ 		if (result == ISC_R_SUCCESS) {
+-			result = dns_rdataset_next(rdataset);
++			if (limit != 0 && ++n >= limit) {
++				result = DNS_R_TOOMANYRECORDS;
++			} else {
++				result = dns_rdataset_next(rdataset);
++			}
+ 		}
+ 		dns_rdata_reset(&rdata);
+ 	} while (result == ISC_R_SUCCESS);
+-- 
+2.50.1
+

bind-9.18-pkcs11-provider.patch

@@ -1,4 +1,4 @@
-From 0869590a0c182cbf546df190616f56f790fa32aa Mon Sep 17 00:00:00 2001
+From 5bd1369eb7781ad2b349b99f783a7ed07fb7d6ac Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 13 Feb 2025 13:20:28 +0100
 Subject: [PATCH] Backport OpenSSL 3 provider support
@@ -30,18 +30,23 @@ Fix keyfromlabel to not use engine parameter for provider keys
 Use dst_key_t label to signal isprivate property as a downstream
 alternative to upstream commit 74361b0b6e5a6b17ebeea6afe1ca990395d7a6dd.
 That would require additional heavier changes.
+
+Downstream change:
+Move RSA bits check to legacy, let it use rsa_check for newer
+
+rsabigexponent tests got broken by this change.
 ---
  lib/dns/dst_openssl.h       |   4 +
  lib/dns/dst_parse.c         |  21 ++---
- lib/dns/openssl_link.c      | 161 ++++++++++++++++++++++++++++-----
- lib/dns/openssldh_link.c    |   5 ++
- lib/dns/opensslecdsa_link.c | 110 ++++++++++++-----------
- lib/dns/openssleddsa_link.c |  40 +++------
- lib/dns/opensslrsa_link.c   | 173 ++++++++++++++----------------------
- 7 files changed, 295 insertions(+), 219 deletions(-)
+ lib/dns/openssl_link.c      | 161 +++++++++++++++++++++++++++-----
+ lib/dns/openssldh_link.c    |   5 +
+ lib/dns/opensslecdsa_link.c | 109 +++++++++++-----------
+ lib/dns/openssleddsa_link.c |  40 +++-----
+ lib/dns/opensslrsa_link.c   | 181 ++++++++++++++----------------------
+ 7 files changed, 296 insertions(+), 225 deletions(-)
 
 diff --git a/lib/dns/dst_openssl.h b/lib/dns/dst_openssl.h
-index 819af0fee1..cd386c0019 100644
+index 819af0f..cd386c0 100644
 --- a/lib/dns/dst_openssl.h
 +++ b/lib/dns/dst_openssl.h
 @@ -64,4 +64,8 @@ ENGINE *
@@ -54,7 +59,7 @@ index 819af0fee1..cd386c0019 100644
 +
  ISC_LANG_ENDDECLS
 diff --git a/lib/dns/dst_parse.c b/lib/dns/dst_parse.c
-index d5ea0e418b..addb65ec5a 100644
+index a353b86..7f3fe51 100644
 --- a/lib/dns/dst_parse.c
 +++ b/lib/dns/dst_parse.c
 @@ -195,10 +195,9 @@ check_rsa(const dst_private_t *priv, bool external) {
@@ -101,7 +106,7 @@ index d5ea0e418b..addb65ec5a 100644
  }
  
 diff --git a/lib/dns/openssl_link.c b/lib/dns/openssl_link.c
-index e3a89f4406..62077b6f81 100644
+index e3a89f4..2495be4 100644
 --- a/lib/dns/openssl_link.c
 +++ b/lib/dns/openssl_link.c
 @@ -44,6 +44,9 @@
@@ -120,8 +125,8 @@ index e3a89f4406..62077b6f81 100644
  
 +#define DST_RET(a)        \
 +	{                 \
-+		ret = a;  \
-+		goto err; \
++		result = a;  \
++		goto cleanup; \
 +	}
 +
  static void
@@ -195,7 +200,7 @@ index e3a89f4406..62077b6f81 100644
 +			      const char *label,
 +			      EVP_PKEY **ppub, EVP_PKEY **ppriv) {
 +#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000
-+	isc_result_t ret = ISC_R_SUCCESS;
++	isc_result_t result = ISC_R_SUCCESS;
 +	ENGINE *e = NULL;
 +	EVP_PKEY *pkey = NULL, *pubpkey = NULL;
 +
@@ -224,8 +229,8 @@ index e3a89f4406..62077b6f81 100644
 +	}
 +	*ppub = pubpkey;
 +	*ppriv = pkey;
-+err:
-+	return ret;
++cleanup:
++	return result;
 +#else
 +	UNUSED(key_base_id);
 +	UNUSED(engine);
@@ -242,7 +247,7 @@ index e3a89f4406..62077b6f81 100644
 +				EVP_PKEY **ppub, EVP_PKEY **ppriv) {
 +	UNUSED(pin);
 +#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-+	isc_result_t ret = DST_R_OPENSSLFAILURE;
++	isc_result_t result = DST_R_OPENSSLFAILURE;
 +	OSSL_STORE_CTX *ctx = NULL;
 +
 +
@@ -280,11 +285,11 @@ index e3a89f4406..62077b6f81 100644
 +		OSSL_STORE_INFO_free(info);
 +	}
 +	if (*ppriv != NULL && *ppub != NULL) {
-+		ret = ISC_R_SUCCESS;
++		result = ISC_R_SUCCESS;
 +	}
-+err:
++cleanup:
 +	OSSL_STORE_close(ctx);
-+	return (ret);
++	return result;
 +#else
 +	UNUSED(key_base_id);
 +	UNUSED(label);
@@ -308,7 +313,7 @@ index e3a89f4406..62077b6f81 100644
 +
  /*! \file */
 diff --git a/lib/dns/openssldh_link.c b/lib/dns/openssldh_link.c
-index a4ba0f78d3..38345e6bfd 100644
+index a4ba0f7..38345e6 100644
 --- a/lib/dns/openssldh_link.c
 +++ b/lib/dns/openssldh_link.c
 @@ -610,6 +610,11 @@ err:
@@ -324,7 +329,7 @@ index a4ba0f78d3..38345e6bfd 100644
  	DH *dh = key->keydata.dh;
  	const BIGNUM *priv_key = NULL;
 diff --git a/lib/dns/opensslecdsa_link.c b/lib/dns/opensslecdsa_link.c
-index ca12bb5620..5d070140c5 100644
+index af45fdc..8b49b5d 100644
 --- a/lib/dns/opensslecdsa_link.c
 +++ b/lib/dns/opensslecdsa_link.c
 @@ -617,6 +617,12 @@ opensslecdsa_isprivate(const dst_key_t *key) {
@@ -340,7 +345,7 @@ index ca12bb5620..5d070140c5 100644
  #if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
  	eckey = EVP_PKEY_get1_EC_KEY(pkey);
  
-@@ -916,7 +922,7 @@ err:
+@@ -916,7 +922,7 @@ cleanup:
  
  #if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
  static isc_result_t
@@ -356,7 +361,7 @@ index ca12bb5620..5d070140c5 100644
 +
 +static isc_result_t
 +ecdsa_check(EVP_PKEY **pkey, EVP_PKEY *pubpkey, int group_nid) {
-+	isc_result_t ret = ISC_R_FAILURE;
++	isc_result_t result = ISC_R_FAILURE;
 +	EC_KEY *eckey;
 +	EC_KEY *pubeckey;
 +
@@ -376,21 +381,21 @@ index ca12bb5620..5d070140c5 100644
 +		DST_RET(DST_R_INVALIDPUBLICKEY);
 +	}
 +
-+	ret = ecdsa_check_legacy(eckey, pubeckey);
-+err:
++	CHECK(ecdsa_check_legacy(eckey, pubeckey));
++cleanup:
 +	if (pubeckey != NULL) {
 +		EC_KEY_free(pubeckey);
 +	}
 +	if (eckey != NULL) {
 +		EC_KEY_free(eckey);
 +	}
-+	return ret;
++	return result;
 +}
  #else
  static isc_result_t
 -ecdsa_check(EVP_PKEY **pkey, EVP_PKEY *pubpkey) {
 +ecdsa_check(EVP_PKEY **pkey, EVP_PKEY *pubpkey, int group_nid) {
- 	isc_result_t ret = ISC_R_FAILURE;
+ 	isc_result_t result = ISC_R_FAILURE;
  	int status;
  	size_t pkey_len = 0;
 @@ -954,6 +993,8 @@ ecdsa_check(EVP_PKEY **pkey, EVP_PKEY *pubpkey) {
@@ -402,7 +407,7 @@ index ca12bb5620..5d070140c5 100644
  	/* Check if `pkey` has a public key. */
  	status = EVP_PKEY_get_octet_string_param(*pkey, OSSL_PKEY_PARAM_PUB_KEY,
  						 NULL, 0, &pkey_len);
-@@ -1279,7 +1320,7 @@ opensslecdsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
+@@ -1267,7 +1308,7 @@ opensslecdsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
  		pubeckey = EVP_PKEY_get1_EC_KEY(pub->keydata.pkey);
  	}
  
@@ -411,7 +416,7 @@ index ca12bb5620..5d070140c5 100644
  		DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
  	}
  
-@@ -1288,7 +1329,7 @@ opensslecdsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
+@@ -1276,7 +1317,7 @@ opensslecdsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
  	}
  #else
  	if (ecdsa_check(&key->keydata.pkey,
@@ -420,19 +425,19 @@ index ca12bb5620..5d070140c5 100644
  	    ISC_R_SUCCESS)
  	{
  		DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
-@@ -1321,11 +1362,7 @@ err:
+@@ -1309,11 +1350,7 @@ cleanup:
  static isc_result_t
  opensslecdsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
  		       const char *pin) {
 -#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000
- 	isc_result_t ret = ISC_R_SUCCESS;
+ 	isc_result_t result = ISC_R_SUCCESS;
 -	ENGINE *e;
 -	EC_KEY *eckey = NULL;
 -	EC_KEY *pubeckey = NULL;
  	int group_nid;
  	EVP_PKEY *pkey = NULL;
  	EVP_PKEY *pubpkey = NULL;
-@@ -1335,13 +1372,9 @@ opensslecdsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
+@@ -1323,13 +1360,9 @@ opensslecdsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
  
  	UNUSED(pin);
  
@@ -447,7 +452,7 @@ index ca12bb5620..5d070140c5 100644
  
  	if (key->key_alg == DST_ALG_ECDSA256) {
  		group_nid = NID_X9_62_prime256v1;
-@@ -1349,48 +1382,30 @@ opensslecdsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
+@@ -1337,48 +1370,27 @@ opensslecdsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
  		group_nid = NID_secp384r1;
  	}
  
@@ -456,11 +461,9 @@ index ca12bb5620..5d070140c5 100644
 -	if (pkey == NULL) {
 -		DST_RET(dst__openssl_toresult2("ENGINE_load_private_key",
 -					       DST_R_OPENSSLFAILURE));
-+	ret = dst__openssl_fromlabel(EVP_PKEY_EC, engine, label, pin,
-+				       &pubpkey, &pkey);
-+	if (ret != ISC_R_SUCCESS) {
-+		goto err;
- 	}
+-	}
++	CHECK(dst__openssl_fromlabel(EVP_PKEY_EC, engine, label, pin,
++				       &pubpkey, &pkey));
 +
  	/* Check base id, group nid */
  	if (EVP_PKEY_base_id(pkey) != EVP_PKEY_EC) {
@@ -506,7 +509,7 @@ index ca12bb5620..5d070140c5 100644
  	key->key_size = EVP_PKEY_bits(pkey);
  	key->keydata.pkey = pkey;
  	pkey = NULL;
-@@ -1402,21 +1417,8 @@ err:
+@@ -1390,21 +1402,8 @@ cleanup:
  	if (pkey != NULL) {
  		EVP_PKEY_free(pkey);
  	}
@@ -517,7 +520,7 @@ index ca12bb5620..5d070140c5 100644
 -		EC_KEY_free(eckey);
 -	}
  
- 	return ret;
+ 	return result;
 -#else
 -	UNUSED(key);
 -	UNUSED(engine);
@@ -529,10 +532,10 @@ index ca12bb5620..5d070140c5 100644
  
  static dst_func_t opensslecdsa_functions = {
 diff --git a/lib/dns/openssleddsa_link.c b/lib/dns/openssleddsa_link.c
-index 74dac17bc6..04457fbfc3 100644
+index 6301db4..08d505b 100644
 --- a/lib/dns/openssleddsa_link.c
 +++ b/lib/dns/openssleddsa_link.c
-@@ -361,6 +361,12 @@ openssleddsa_isprivate(const dst_key_t *key) {
+@@ -362,6 +362,12 @@ openssleddsa_isprivate(const dst_key_t *key) {
  		return false;
  	}
  
@@ -545,17 +548,17 @@ index 74dac17bc6..04457fbfc3 100644
  	/* Must have a buffer to actually check if there is a private key. */
  	if (EVP_PKEY_get_raw_private_key(pkey, buf, &len) == 1) {
  		return true;
-@@ -603,9 +609,7 @@ err:
+@@ -591,9 +597,7 @@ cleanup:
  static isc_result_t
  openssleddsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
  		       const char *pin) {
 -#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000
- 	isc_result_t ret;
+ 	isc_result_t result;
 -	ENGINE *e;
  	EVP_PKEY *pkey = NULL, *pubpkey = NULL;
  	int baseid = EVP_PKEY_NONE;
  
-@@ -628,28 +632,17 @@ openssleddsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
+@@ -616,28 +620,17 @@ openssleddsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
  		return ISC_R_NOTIMPLEMENTED;
  	}
  
@@ -591,10 +594,10 @@ index 74dac17bc6..04457fbfc3 100644
  	key->label = isc_mem_strdup(key->mctx, label);
  	key->key_size = EVP_PKEY_bits(pkey);
  	key->keydata.pkey = pkey;
-@@ -664,13 +657,6 @@ err:
+@@ -652,13 +645,6 @@ cleanup:
  		EVP_PKEY_free(pkey);
  	}
- 	return ret;
+ 	return result;
 -#else  /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */
 -	UNUSED(key);
 -	UNUSED(engine);
@@ -606,7 +609,7 @@ index 74dac17bc6..04457fbfc3 100644
  
  static dst_func_t openssleddsa_functions = {
 diff --git a/lib/dns/opensslrsa_link.c b/lib/dns/opensslrsa_link.c
-index 37e8a63a61..1ffae888e1 100644
+index b92e1bf..12210e8 100644
 --- a/lib/dns/opensslrsa_link.c
 +++ b/lib/dns/opensslrsa_link.c
 @@ -545,6 +545,12 @@ opensslrsa_isprivate(const dst_key_t *key) {
@@ -622,7 +625,7 @@ index 37e8a63a61..1ffae888e1 100644
  #if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
  	rsa = EVP_PKEY_get1_RSA(pkey);
  	INSIST(rsa != NULL);
-@@ -995,7 +1001,7 @@ err:
+@@ -995,7 +1001,7 @@ cleanup:
  
  #if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
  static isc_result_t
@@ -689,7 +692,7 @@ index 37e8a63a61..1ffae888e1 100644
  	if (EVP_PKEY_eq(pkey, pubpkey) == 1) {
  		DST_RET(ISC_R_SUCCESS);
  	}
-@@ -1119,6 +1169,10 @@ err:
+@@ -1119,6 +1169,10 @@ cleanup:
  }
  #endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
  
@@ -714,7 +717,7 @@ index 37e8a63a61..1ffae888e1 100644
  	const char *label = NULL;
  	EVP_PKEY *pkey = NULL;
  	BIGNUM *n = NULL, *e = NULL, *d = NULL;
-@@ -1193,46 +1243,7 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
+@@ -1190,46 +1240,7 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
  	 * See if we can fetch it.
  	 */
  	if (label != NULL) {
@@ -762,7 +765,7 @@ index 37e8a63a61..1ffae888e1 100644
  	}
  
  	for (i = 0; i < priv.nelements; i++) {
-@@ -1321,7 +1332,7 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
+@@ -1318,9 +1329,14 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
  			BN_clear_free(iqmp);
  		}
  	}
@@ -770,14 +773,40 @@ index 37e8a63a61..1ffae888e1 100644
 +	if (rsa_check_legacy(rsa, pubrsa) != ISC_R_SUCCESS) {
  		DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
  	}
++
++	if (BN_num_bits(e) > RSA_MAX_PUBEXP_BITS) {
++		DST_RET(ISC_R_RANGE);
++	}
++
  #else
-@@ -1464,69 +1475,30 @@ err:
+ 	bld = OSSL_PARAM_BLD_new();
+ 	if (bld == NULL) {
+@@ -1387,17 +1403,9 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
+ 		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
+ 	}
+ 
+-	if (rsa_check(pkey, pub != NULL ? pub->keydata.pkey : NULL) !=
+-	    ISC_R_SUCCESS)
+-	{
+-		DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
+-	}
++	CHECK(rsa_check(pkey, pub != NULL ? pub->keydata.pkey : NULL));
+ #endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+-	if (BN_num_bits(e) > RSA_MAX_PUBEXP_BITS) {
+-		DST_RET(ISC_R_RANGE);
+-	}
+-
+ 	key->key_size = BN_num_bits(n);
+ 	key->keydata.pkey = pkey;
+ 	pkey = NULL;
+@@ -1461,69 +1469,31 @@ cleanup:
  static isc_result_t
  opensslrsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
  		     const char *pin) {
 -#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000
 -	ENGINE *e = NULL;
- 	isc_result_t ret = ISC_R_SUCCESS;
+ 	isc_result_t result = ISC_R_SUCCESS;
  	EVP_PKEY *pkey = NULL, *pubpkey = NULL;
 -	RSA *rsa = NULL, *pubrsa = NULL;
 -	const BIGNUM *ex = NULL;
@@ -791,10 +820,9 @@ index 37e8a63a61..1ffae888e1 100644
 -	if (e == NULL) {
 -		DST_RET(dst__openssl_toresult(DST_R_NOENGINE));
 -	}
-+	ret = dst__openssl_fromlabel(EVP_PKEY_RSA, engine, label, pin,
-+				       &pubpkey, &pkey);
-+	if (ret != ISC_R_SUCCESS)
-+		DST_RET(ret);
++	CHECK(dst__openssl_fromlabel(EVP_PKEY_RSA, engine, label, pin,
++				       &pubpkey, &pkey));
++	CHECK(rsa_check(pkey, pubpkey));
  
 -	pubpkey = ENGINE_load_public_key(e, label, NULL, NULL);
 -	if (pubpkey == NULL) {
@@ -807,13 +835,11 @@ index 37e8a63a61..1ffae888e1 100644
 -	}
 -
 -	pkey = ENGINE_load_private_key(e, label, NULL, NULL);
--	if (pkey == NULL) {
+ 	if (pkey == NULL) {
 -		DST_RET(dst__openssl_toresult2("ENGINE_load_private_key",
--					       DST_R_OPENSSLFAILURE));
--	}
-+	ret = rsa_check(pkey, pubpkey);
-+	if (ret != ISC_R_SUCCESS)
-+		DST_RET(ret);
++		DST_RET(dst__openssl_toresult2("dst__openssl_fromlabel",
+ 					       DST_R_OPENSSLFAILURE));
+ 	}
  
 -	key->engine = isc_mem_strdup(key->mctx, engine);
 +	if (engine != NULL)
@@ -821,7 +847,7 @@ index 37e8a63a61..1ffae888e1 100644
 +	else
 +		key->engine = NULL;
  	key->label = isc_mem_strdup(key->mctx, label);
--
+ 
 -	rsa = EVP_PKEY_get1_RSA(pkey);
 -	if (rsa == NULL) {
 -		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
@@ -842,7 +868,7 @@ index 37e8a63a61..1ffae888e1 100644
  	key->keydata.pkey = pkey;
  	pkey = NULL;
  
- err:
+ cleanup:
 -	if (rsa != NULL) {
 -		RSA_free(rsa);
 -	}
@@ -852,10 +878,10 @@ index 37e8a63a61..1ffae888e1 100644
  	if (pkey != NULL) {
  		EVP_PKEY_free(pkey);
  	}
-@@ -1534,13 +1506,6 @@ err:
+@@ -1531,13 +1501,6 @@ cleanup:
  		EVP_PKEY_free(pubpkey);
  	}
- 	return ret;
+ 	return result;
 -#else  /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */
 -	UNUSED(key);
 -	UNUSED(engine);
@@ -867,5 +893,5 @@ index 37e8a63a61..1ffae888e1 100644
  
  static dst_func_t opensslrsa_functions = {
 -- 
-2.49.0
+2.52.0
 

bind-9.18-query-fname-relative.patch

@@ -1,90 +0,0 @@
-From 12c16aac02a4f58575eb125cbd37a7f05d7cc245 Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Fri, 25 Apr 2025 02:00:00 +0200
-Subject: [PATCH] Insert additional checks ensuring name is not relative
-
-Mitigation for crashes put in various places, where obviously relative
-uninitialized name must not appear. This seems unnecessary once true
-cause were identified, but may prevent similar places.
----
- lib/ns/query.c | 35 +++++++++++++++++++++++++++++++++++
- 1 file changed, 35 insertions(+)
-
-diff --git a/lib/ns/query.c b/lib/ns/query.c
-index 5a75601160..44adb220e3 100644
---- a/lib/ns/query.c
-+++ b/lib/ns/query.c
-@@ -2203,6 +2203,20 @@ regular:
- 	CTRACE(ISC_LOG_DEBUG(3), "query_additional: done");
- }
- 
-+static isc_result_t
-+log_query_relative(query_ctx_t *qctx, const char *func, const dns_name_t *name) {
-+	if (isc_log_wouldlog(ns_lctx, ISC_LOG_DEBUG(1))) {
-+		char namebuf[DNS_NAME_FORMATSIZE] = "!";
-+		dns_name_format(name, namebuf, sizeof(namebuf));
-+		ns_client_log(
-+			qctx->client, NS_LOGCATEGORY_CLIENT, NS_LOGMODULE_QUERY,
-+			ISC_LOG_DEBUG(1),
-+			"%s: fname=%s leading to relative name, aborting query.",
-+			func, namebuf
-+		);
-+	}
-+}
-+
- static void
- query_addrrset(query_ctx_t *qctx, dns_name_t **namep,
- 	       dns_rdataset_t **rdatasetp, dns_rdataset_t **sigrdatasetp,
-@@ -2275,6 +2289,11 @@ query_addrrset(query_ctx_t *qctx, dns_name_t **namep,
- 		client->query.attributes &= ~NS_QUERYATTR_SECURE;
- 	}
- 
-+	if (!qctx->is_zone && mname && !dns_name_isabsolute(mname)) {
-+		log_query_relative(qctx, "query_addrrset", mname);
-+		QUERY_ERROR(qctx, DNS_R_SERVFAIL);
-+		return;
-+	}
- 	/*
- 	 * Update message name, set rdataset order, and do additional
- 	 * section processing if needed.
-@@ -8079,6 +8098,11 @@ query_respond_any(query_ctx_t *qctx) {
- 							     : qctx->tname;
- 				query_prefetch(qctx->client, name,
- 					       qctx->rdataset);
-+				if (name && !dns_name_isabsolute(name)) {
-+					log_query_relative(qctx, "query_respond_any", name);
-+					result = DNS_R_DROP;
-+					break;
-+				}
- 			}
- 
- 			/*
-@@ -10701,6 +10725,11 @@ query_cname(query_ctx_t *qctx) {
- 
- 	if (!qctx->is_zone && RECURSIONOK(qctx->client)) {
- 		query_prefetch(qctx->client, qctx->fname, qctx->rdataset);
-+		if (qctx->fname && !dns_name_isabsolute(qctx->fname)) {
-+			log_query_relative(qctx, "query_cname", qctx->fname);
-+			QUERY_ERROR(qctx, DNS_R_SERVFAIL);
-+			return (ns_query_done(qctx));
-+		}
- 	}
- 
- 	query_addrrset(qctx, &qctx->fname, &qctx->rdataset, sigrdatasetp,
-@@ -10806,7 +10835,13 @@ query_dname(query_ctx_t *qctx) {
- 
- 	if (!qctx->is_zone && RECURSIONOK(qctx->client)) {
- 		query_prefetch(qctx->client, qctx->fname, qctx->rdataset);
-+		if (qctx->fname && !dns_name_isabsolute(qctx->fname)) {
-+			log_query_relative(qctx, "query_dname", qctx->fname);
-+			QUERY_ERROR(qctx, DNS_R_SERVFAIL);
-+			return (ns_query_done(qctx));
-+		}
- 	}
-+
- 	query_addrrset(qctx, &qctx->fname, &qctx->rdataset, sigrdatasetp,
- 		       qctx->dbuf, DNS_SECTION_ANSWER);
- 
--- 
-2.49.0
-

bind-9.20-nsupdate-tls.patch

@@ -1,4 +1,4 @@
-From b44dc4ed5c34445511f06d4b972407d539f8e9da Mon Sep 17 00:00:00 2001
+From b0a417393f6a656758f40f30234086e1017faa7a Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Mon, 11 Nov 2024 18:09:07 +0100
 Subject: [PATCH] Backport nsupdate TLS support into 9.18
@@ -55,8 +55,8 @@ Adapted to 9.18.33.
  lib/dns/include/dns/types.h     |   2 +
  lib/dns/request.c               |  63 ++++++--
  lib/dns/transport.c             | 253 ++++++++++++++++++++++++++++++++
- lib/dns/xfrin.c                 | 232 +----------------------------
- 9 files changed, 668 insertions(+), 292 deletions(-)
+ lib/dns/xfrin.c                 |   7 +-
+ 9 files changed, 671 insertions(+), 64 deletions(-)
 
 diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
 index 293ed28..819925e 100644
@@ -455,7 +455,7 @@ index 293ed28..819925e 100644
  	if (answer != NULL) {
  		dns_message_detach(&answer);
 diff --git a/lib/dns/dispatch.c b/lib/dns/dispatch.c
-index eb37198..8273c32 100644
+index bd53763..5722fe2 100644
 --- a/lib/dns/dispatch.c
 +++ b/lib/dns/dispatch.c
 @@ -30,6 +30,7 @@
@@ -922,10 +922,10 @@ index e74ccd7..e6499a9 100644
   * Requires:
   *\li	'transport' is valid.
 diff --git a/lib/dns/include/dns/types.h b/lib/dns/include/dns/types.h
-index 6465962..f0aaa24 100644
+index 8ddcbeb..7ba4801 100644
 --- a/lib/dns/include/dns/types.h
 +++ b/lib/dns/include/dns/types.h
-@@ -141,6 +141,8 @@ typedef struct dns_ssutable	     dns_ssutable_t;
+@@ -142,6 +142,8 @@ typedef struct dns_ssutable	     dns_ssutable_t;
  typedef struct dns_stats	     dns_stats_t;
  typedef uint32_t		     dns_rdatastatstype_t;
  typedef struct dns_tkeyctx	     dns_tkeyctx_t;
@@ -1350,255 +1350,37 @@ index 88a3df4..2a779ba 100644
  transport_destroy(dns_transport_t *transport) {
  	isc_refcount_destroy(&transport->references);
 diff --git a/lib/dns/xfrin.c b/lib/dns/xfrin.c
-index 3a4f761..3695815 100644
+index 6a46ea3..ae2b70f 100644
 --- a/lib/dns/xfrin.c
 +++ b/lib/dns/xfrin.c
-@@ -962,234 +962,6 @@ xfrin_create(isc_mem_t *mctx, dns_zone_t *zone, dns_db_t *db, isc_nm_t *netmgr,
+@@ -938,6 +938,7 @@ xfrin_create(isc_mem_t *mctx, dns_zone_t *zone, dns_db_t *db, isc_nm_t *netmgr,
  	*xfrp = xfr;
  }
  
--static isc_result_t
--get_create_tlsctx(const dns_xfrin_ctx_t *xfr, isc_tlsctx_t **pctx,
--		  isc_tlsctx_client_session_cache_t **psess_cache) {
--	isc_result_t result = ISC_R_FAILURE;
--	isc_tlsctx_t *tlsctx = NULL, *found = NULL;
--	isc_tls_cert_store_t *store = NULL, *found_store = NULL;
--	isc_tlsctx_client_session_cache_t *sess_cache = NULL,
--					  *found_sess_cache = NULL;
--	uint32_t tls_versions;
--	const char *ciphers = NULL;
--	bool prefer_server_ciphers;
--	const uint16_t family = isc_sockaddr_pf(&xfr->primaryaddr) == PF_INET6
--					? AF_INET6
--					: AF_INET;
--	const char *tlsname = NULL;
--
--	REQUIRE(psess_cache != NULL && *psess_cache == NULL);
--	REQUIRE(pctx != NULL && *pctx == NULL);
--
--	INSIST(xfr->transport != NULL);
--	tlsname = dns_transport_get_tlsname(xfr->transport);
--	INSIST(tlsname != NULL && *tlsname != '\0');
--
--	/*
--	 * Let's try to re-use the already created context. This way
--	 * we have a chance to resume the TLS session, bypassing the
--	 * full TLS handshake procedure, making establishing
--	 * subsequent TLS connections for XoT faster.
--	 */
--	result = isc_tlsctx_cache_find(xfr->tlsctx_cache, tlsname,
--				       isc_tlsctx_cache_tls, family, &found,
--				       &found_store, &found_sess_cache);
--	if (result != ISC_R_SUCCESS) {
--		const char *hostname =
--			dns_transport_get_remote_hostname(xfr->transport);
--		const char *ca_file = dns_transport_get_cafile(xfr->transport);
--		const char *cert_file =
--			dns_transport_get_certfile(xfr->transport);
--		const char *key_file =
--			dns_transport_get_keyfile(xfr->transport);
--		char primary_addr_str[INET6_ADDRSTRLEN] = { 0 };
--		isc_netaddr_t primary_netaddr = { 0 };
--		bool hostname_ignore_subject;
--		/*
--		 * So, no context exists. Let's create one using the
--		 * parameters from the configuration file and try to
--		 * store it for further reuse.
--		 */
--		result = isc_tlsctx_createclient(&tlsctx);
--		if (result != ISC_R_SUCCESS) {
--			goto failure;
--		}
--		tls_versions = dns_transport_get_tls_versions(xfr->transport);
--		if (tls_versions != 0) {
--			isc_tlsctx_set_protocols(tlsctx, tls_versions);
--		}
--		ciphers = dns_transport_get_ciphers(xfr->transport);
--		if (ciphers != NULL) {
--			isc_tlsctx_set_cipherlist(tlsctx, ciphers);
--		}
--
--		if (dns_transport_get_prefer_server_ciphers(
--			    xfr->transport, &prefer_server_ciphers))
--		{
--			isc_tlsctx_prefer_server_ciphers(tlsctx,
--							 prefer_server_ciphers);
--		}
--
--		if (hostname != NULL || ca_file != NULL) {
--			/*
--			 * The situation when 'found_store != NULL' while 'found
--			 * == NULL' might appear as there is one to many
--			 * relation between per transport TLS contexts and cert
--			 * stores. That is, there could be one store shared
--			 * between multiple contexts.
--			 */
--			if (found_store == NULL) {
--				/*
--				 * 'ca_file' can equal 'NULL' here, in
--				 * that case the store with system-wide
--				 * CA certificates will be created, just
--				 * as planned.
--				 */
--				result = isc_tls_cert_store_create(ca_file,
--								   &store);
--
--				if (result != ISC_R_SUCCESS) {
--					goto failure;
--				}
--			} else {
--				store = found_store;
--			}
--
--			INSIST(store != NULL);
--			if (hostname == NULL) {
--				/*
--				 * If CA bundle file is specified, but
--				 * hostname is not, then use the primary
--				 * IP address for validation, just like
--				 * dig does.
--				 */
--				INSIST(ca_file != NULL);
--				isc_netaddr_fromsockaddr(&primary_netaddr,
--							 &xfr->primaryaddr);
--				isc_netaddr_format(&primary_netaddr,
--						   primary_addr_str,
--						   sizeof(primary_addr_str));
--				hostname = primary_addr_str;
--			}
--			/*
--			 * According to RFC 8310, Subject field MUST NOT
--			 * be inspected when verifying hostname for DoT.
--			 * Only SubjectAltName must be checked.
--			 */
--			hostname_ignore_subject = true;
--			result = isc_tlsctx_enable_peer_verification(
--				tlsctx, false, store, hostname,
--				hostname_ignore_subject);
--			if (result != ISC_R_SUCCESS) {
--				goto failure;
--			}
--
--			/*
--			 * Let's load client certificate and enable
--			 * Mutual TLS. We do that only in the case when
--			 * Strict TLS is enabled, because Mutual TLS is
--			 * an extension of it.
--			 */
--			if (cert_file != NULL) {
--				INSIST(key_file != NULL);
--
--				result = isc_tlsctx_load_certificate(
--					tlsctx, key_file, cert_file);
--				if (result != ISC_R_SUCCESS) {
--					goto failure;
--				}
--			}
--		}
--
--		isc_tlsctx_enable_dot_client_alpn(tlsctx);
--
--		isc_tlsctx_client_session_cache_create(
--			xfr->mctx, tlsctx,
--			ISC_TLSCTX_CLIENT_SESSION_CACHE_DEFAULT_SIZE,
--			&sess_cache);
--
--		found_store = NULL;
--		result = isc_tlsctx_cache_add(xfr->tlsctx_cache, tlsname,
--					      isc_tlsctx_cache_tls, family,
--					      tlsctx, store, sess_cache, &found,
--					      &found_store, &found_sess_cache);
--		if (result == ISC_R_EXISTS) {
--			/*
--			 * It seems the entry has just been created from within
--			 * another thread while we were initialising
--			 * ours. Although this is unlikely, it could happen
--			 * after startup/re-initialisation. In such a case,
--			 * discard the new context and associated data and use
--			 * the already established one from now on.
--			 *
--			 * Such situation will not occur after the
--			 * initial 'warm-up', so it is not critical
--			 * performance-wise.
--			 */
--			INSIST(found != NULL);
--			isc_tlsctx_free(&tlsctx);
--			/*
--			 * The 'store' variable can be 'NULL' when remote server
--			 * verification is not enabled (that is, when Strict or
--			 * Mutual TLS are not used).
--			 *
--			 * The 'found_store' might be equal to 'store' as there
--			 * is one-to-many relation between a store and
--			 * per-transport TLS contexts. In that case, the call to
--			 * 'isc_tlsctx_cache_find()' above could have returned a
--			 * store via the 'found_store' variable, whose value we
--			 * can assign to 'store' later. In that case,
--			 * 'isc_tlsctx_cache_add()' will return the same value.
--			 * When that happens, we should not free the store
--			 * object, as it is managed by the TLS context cache.
--			 */
--			if (store != NULL && store != found_store) {
--				isc_tls_cert_store_free(&store);
--			}
--			isc_tlsctx_client_session_cache_detach(&sess_cache);
--			/* Let's return the data from the cache. */
--			*psess_cache = found_sess_cache;
--			*pctx = found;
--		} else {
--			/*
--			 * Adding the fresh values into the cache has been
--			 * successful, let's return them
--			 */
--			INSIST(result == ISC_R_SUCCESS);
--			*psess_cache = sess_cache;
--			*pctx = tlsctx;
--		}
--	} else {
--		/*
--		 * The cache lookup has been successful, let's return the
--		 * results.
--		 */
--		INSIST(result == ISC_R_SUCCESS);
--		*psess_cache = found_sess_cache;
--		*pctx = found;
--	}
--
--	return ISC_R_SUCCESS;
--
--failure:
--	if (tlsctx != NULL) {
--		isc_tlsctx_free(&tlsctx);
--	}
--
--	/*
--	 * The 'found_store' is being managed by the TLS context
--	 * cache. Thus, we should keep it as it is, as it will get
--	 * destroyed alongside the cache. As there is one store per
--	 * multiple TLS contexts, we need to handle store deletion in a
--	 * special way.
--	 */
--	if (store != NULL && store != found_store) {
--		isc_tls_cert_store_free(&store);
--	}
--
--	return result;
--}
--
++#if 0
+ static isc_result_t
+ get_create_tlsctx(const dns_xfrin_ctx_t *xfr, isc_tlsctx_t **pctx,
+ 		  isc_tlsctx_client_session_cache_t **psess_cache) {
+@@ -1152,6 +1153,8 @@ cleanup:
+ 
+ 	return result;
+ }
++/* if 0 */
++#endif
+ 
  static isc_result_t
  xfrin_start(dns_xfrin_ctx_t *xfr) {
- 	isc_result_t result;
-@@ -1232,7 +1004,9 @@ xfrin_start(dns_xfrin_ctx_t *xfr) {
+@@ -1195,7 +1198,9 @@ xfrin_start(dns_xfrin_ctx_t *xfr) {
  				     connect_xfr, 30000, 0);
  		break;
  	case DNS_TRANSPORT_TLS: {
--		result = get_create_tlsctx(xfr, &tlsctx, &sess_cache);
-+		result = dns_transport_get_tlsctx(
+-		CHECK(get_create_tlsctx(xfr, &tlsctx, &sess_cache));
++		CHECK(dns_transport_get_tlsctx(
 +			xfr->transport, &xfr->primaryaddr, xfr->tlsctx_cache,
-+			xfr->mctx, &tlsctx, &sess_cache);
- 		if (result != ISC_R_SUCCESS) {
- 			goto failure;
- 		}
++			xfr->mctx, &tlsctx, &sess_cache));
+ 		INSIST(tlsctx != NULL);
+ 		isc_nm_tlsdnsconnect(xfr->netmgr, &xfr->sourceaddr,
+ 				     &xfr->primaryaddr, xfrin_connect_done,
 -- 
-2.48.1
+2.52.0
 

bind-9.21-resume-qmin-cname.patch

@@ -1,44 +0,0 @@
-From ac0c3b0477d97fe5c968910f603bb8d04c740da7 Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Tue, 3 Jun 2025 21:00:58 +0200
-Subject: [PATCH] Handle CNAME and DNAME in resume_min in a special way
-
-When authoritative zone is loaded when query minimization query for the
-same zone is already pending, it might receive unexpected result codes.
-
-Normally DNS_R_CNAME would follow to query_cname after processing sent
-events, but dns_view_findzonecut does not fill CNAME target into
-event->foundevent. Usual lookup via query_lookup would always have that
-filled.
-
-Ideally we would restart the query with unmodified search name, if
-unexpected change from recursing to local zone cut were detected. Until
-dns_view_findzonecut is modified to export zone/cache source of the cut,
-at least fail queries which went into unexpected state.
----
- lib/dns/resolver.c | 9 +++++++++
- 1 file changed, 9 insertions(+)
-
-diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
-index 795791246b..39a294437e 100644
---- a/lib/dns/resolver.c
-+++ b/lib/dns/resolver.c
-@@ -4497,6 +4497,15 @@ resume_qmin(isc_task_t *task, isc_event_t *event) {
- 	if (result == DNS_R_NXDOMAIN) {
- 		result = DNS_R_SERVFAIL;
- 	}
-+	/*
-+	 * CNAME or DNAME means zone were added with that record
-+	 * after the start of query minimization queries. It means
-+	 * we do not have initialized correct hevent->foundname
-+	 * and have to fail.
-+	 */
-+	if (result == DNS_R_CNAME || result == DNS_R_DNAME) {
-+		result = DNS_R_SERVFAIL;
-+	}
- 
- 	if (result != ISC_R_SUCCESS) {
- 		goto cleanup;
--- 
-2.49.0
-

bind-chroot.tmpfiles.d

@@ -0,0 +1,38 @@
+# vim: ft=conf:
+# TODO: these definitions are in different form in rpm spec %files chroot section
+# find a way to have it defined only once
+#defattr(0664,root,named,-)
+c /var/named/chroot/dev/null    0664 root named - 1:3
+c /var/named/chroot/dev/random  0664 root named - 1:8
+c /var/named/chroot/dev/urandom 0664 root named - 1:9
+c /var/named/chroot/dev/zero    0664 root named - 1:5
+#defattr(0640,root,named,0750)
+d /var/named/chroot             0750 root named -
+d /var/named/chroot/dev         0750 root named -
+d /var/named/chroot/etc         0750 root named -
+d /var/named/chroot/etc/named   0750 root named -
+d /var/named/chroot/etc/pki     0750 root named -
+d /var/named/chroot/etc/pki/dnssec-keys 0750 root named -
+d /var/named/chroot/etc/crypto-policies 0750 root named -
+d /var/named/chroot/etc/crypto-policies/back-ends 0750 root named -
+d /var/named/chroot/var         0750 root named -
+d /var/named/chroot/run         0750 root named -
+#defattr(-,root,root,-)
+d /var/named/chroot/usr             - root root -
+d /var/named/chroot/usr/lib64       - root root -
+d /var/named/chroot/usr/lib64/bind  - root root -
+d /var/named/chroot/usr/lib64/named - root root -
+d /var/named/chroot/usr/share/GeoIP - root root -
+d /var/named/chroot/usr/share/named - root root -
+d /var/named/chroot/proc            - root root -
+d /var/named/chroot/proc/sys        - root root -
+d /var/named/chroot/proc/sys/net    - root root -
+d /var/named/chroot/proc/sys/net/ipv4 - root root -
+#defattr(0660,root,named,01770)
+d /var/named/chroot/var/named   01770 root named -
+#defattr(0660,named,named,0770)
+d /var/named/chroot/var/tmp      0770 named named -
+d /var/named/chroot/var/log      0770 named named -
+#defattr(-,named,named,-)
+d /var/named/chroot/run/named       - named named -
+L /var/named/chroot/var/run         - named named - ../run

bind.spec

@@ -42,6 +42,8 @@
 %global        chroot_create_directories /dev /run/named %{_localstatedir}/{log,named,tmp} \\\
                                          %{_sysconfdir}/{crypto-policies/back-ends,pki/dnssec-keys,named} \\\
                                          %{_libdir}/bind %{_libdir}/named %{_datadir}/GeoIP /proc/sys/net/ipv4
+%global        upstream_sources 0 2
+%global        pgp_signature_sources 2
 
 ## The order of libs is important. See lib/Makefile.in for details
 %define bind_export_libs isc dns isccfg irs
@@ -85,8 +87,8 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 #
 # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it.
 # Updating just bind will cause freeipa-dns-server package to be uninstallable.
-Version:  9.18.36
-Release:  2%{?dist}
+Version:  9.18.49
+Release:  1%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -117,6 +119,7 @@ Source46: named-setup-rndc.service
 Source48: setup-named-softhsm.sh
 Source49: named-chroot.files
 Source50: named.sysusers
+Source51: bind-chroot.tmpfiles.d
 
 # Common patches
 # FIXME: Is this still required?
@@ -135,12 +138,11 @@ Patch29: bind-9.20-nsupdate-tls-doc.patch
 Patch30: bind-9.20-nsupdate-tls-test.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=2123076
 Patch31: bind-9.18-pkcs11-provider.patch
-# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/10562
-# https://gitlab.isc.org/isc-projects/bind9/-/issues/5357
-# downstream patch fixing bind-dyndb-ldap causing issue
-Patch32: bind-9.21-resume-qmin-cname.patch
-# downstream only, extra check for above change, RHEL-30407
-Patch33: bind-9.18-query-fname-relative.patch
+# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/10611
+Patch32: bind-9.18-partial-additional-records.patch
+# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/9723
+# downstream only
+Patch33: bind-9.18-dig-idn-input-always.patch
 
 %{?systemd_ordering}
 # https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers
@@ -183,6 +185,7 @@ BuildRequires:  softhsm
 BuildRequires:  perl(Net::DNS) perl(Net::DNS::Nameserver) perl(Time::HiRes) perl(Getopt::Long)
 BuildRequires:  perl(English)
 BuildRequires:  python3-dns
+BuildRequires:  python3-hypothesis
 # manual configuration requires this tool
 BuildRequires:  iproute
 %endif
@@ -660,6 +663,7 @@ done
 
 mkdir -p ${RPM_BUILD_ROOT}%{_tmpfilesdir}
 install -m 644 %{SOURCE35} ${RPM_BUILD_ROOT}%{_tmpfilesdir}/named.conf
+install -p -m 644 %{SOURCE51} ${RPM_BUILD_ROOT}%{_tmpfilesdir}/%{name}-chroot.conf
 
 mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/rwtab.d
 install -m 644 %{SOURCE43} ${RPM_BUILD_ROOT}%{_sysconfdir}/rwtab.d/named
@@ -884,6 +888,7 @@ fi;
 %{_unitdir}/named-chroot.service
 %{_unitdir}/named-chroot-setup.service
 %{_libexecdir}/setup-named-chroot.sh
+%{_tmpfilesdir}/%{name}-chroot.conf
 %defattr(0664,root,named,-)
 %ghost %dev(c,1,3) %verify(not mtime) %{chroot_prefix}/dev/null
 %ghost %dev(c,1,8) %verify(not mtime) %{chroot_prefix}/dev/random
@@ -928,6 +933,44 @@ fi;
 %endif
 
 %changelog
+* Wed May 20 2026 Petr Menšík <pemensik@redhat.com> - 32:9.18.49-1
+- Update to 9.18.49 (rhbz#2480121)
+
+* Tue Apr 07 2026 Petr Menšík <pemensik@redhat.com> - 32:9.18.48-1
+- Update to 9.18.48 (rhbz#2453853)
+
+* Wed Mar 25 2026 Petr Menšík <pemensik@redhat.com> - 32:9.18.47-1
+- Update to 9.18.47 (rhbz#2440561)
+
+* Wed Jan 28 2026 Petr Menšík <pemensik@redhat.com> - 32:9.18.44-2
+- Create /var/named directories for bind-chroot (RHEL-132053)
+- Add forgotten _libdir/named into bind-chroot tmpfiles
+
+* Thu Jan 22 2026 Petr Menšík <pemensik@redhat.com> - 32:9.18.44-1
+- Update to 9.18.44 (rhbz#2431609)
+
+* Wed Dec 17 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.43-1
+- Update to 9.18.43 (rhbz#2415842)
+
+* Fri Oct 31 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.41-2
+- Fix upstream reported regression in recent CVE fix (CVE-2025-8677)
+- Add upstream dnssec system test testcase for this problem
+
+* Fri Oct 24 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.41-1
+- Update to 9.18.41 (rhbz#2405786, CVE-2025-8677 CVE-2025-40778 CVE-2025-40780)
+
+* Wed Sep 03 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.39-3
+- Decode IDN names on input in all situations in utilities (rhbz#2324186)
+
+* Mon Sep 01 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.39-2
+- Offer up to 13 additional servers records if there are more servers
+
+* Thu Aug 21 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.39-1
+- Update to 9.18.39 (rhbz#2389765)
+
+* Wed Jul 30 2025 'Petr Mensik' <<pemensik@redhat.com>> - 32:9.18.38-1
+- Update to 9.18.38 (rhbz#2367771)
+
 * Tue Jun 10 2025 'Petr Mensik' <<pemensik@redhat.com>> - 32:9.18.36-2
 - Prevent name.c:670 attributes assertion failed
 - Add extra checks for relative names

named.logrotate

@@ -2,11 +2,9 @@
     missingok
     su named named
     create 0644 named named
+    notifempty
     postrotate
         /usr/bin/systemctl reload named.service > /dev/null 2>&1 || true
         /usr/bin/systemctl reload named-chroot.service > /dev/null 2>&1 || true
-        /usr/bin/systemctl reload named-sdb.service > /dev/null 2>&1 || true
-        /usr/bin/systemctl reload named-sdb-chroot.service > /dev/null 2>&1 || true
-        /usr/bin/systemctl reload named-pkcs11.service > /dev/null 2>&1 || true
     endscript
 }

sources

@@ -1,2 +1,2 @@
-SHA512 (bind-9.18.36.tar.xz) = a95af586ee752705fa164c4d2f41b988e044a86ba9f078d1647d10025ca8f2872c95544dc5515717862b8fcb46b24e9cf6669d719196b6734a50d7a4c16a1288
-SHA512 (bind-9.18.36.tar.xz.asc) = a5d76c060d088ac53b9fdde00eb44c09acaf12a2e25cb5e39281062fdfd5128a5665b771f424159938c284bc888b78575d9757f4b44e8518e446b45a8c889e5a
+SHA512 (bind-9.18.49.tar.xz) = e5259db8b9fdb3940d4e1d95978514692777a3675fc85a83db30e049d80d8150d10e672d51eeb885a94c6bbd4573ff8fe49248117c24ff155197a24a26b09544
+SHA512 (bind-9.18.49.tar.xz.asc) = eec896781f8bcfcc2b2aba884047d35656a0e9d215b06ca1b69ad7e3c6f4b3730ed8e8067514e6818e97e2c119edb8e5a84855d614c14b7e07a98bc3ec26bfa1