From fcb909a9a9640619647f7f6421dc0704e51fb0ae Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 16 Jan 2026 04:24:06 +0000 Subject: [PATCH 01/21] Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild From 8b3576433e13bc1a5839e2f568cd52ad3ae4982a Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 16 Jan 2026 08:20:58 +0000 Subject: [PATCH 02/21] Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild From 5d8736bccddfcbdafecc161c3aa390473a287b1f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Tue, 11 Nov 2025 12:07:48 +0100 Subject: [PATCH 03/21] Fix running SYSTEMTEST during build Needs prepared network scripts. Can be used like: fedpkg mockbuild --enable-network --with SYSTEMTEST --- bind9-next.spec | 22 ++++++++++++++++------ 1 file changed, 16 insertions(+), 6 deletions(-) diff --git a/bind9-next.spec b/bind9-next.spec index 5d27915..fd0bb15 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -151,6 +151,8 @@ BuildRequires: softhsm BuildRequires: perl(Net::DNS) perl(Net::DNS::Nameserver) perl(Time::HiRes) perl(Getopt::Long) BuildRequires: perl(English) BuildRequires: python3-pytest +BuildRequires: python3-pytest-xdist +BuildRequires: python3-dns # manual configuration requires this tool BuildRequires: iproute BuildRequires: python3-jinja2 @@ -394,6 +396,9 @@ export LIBDIR_SUFFIX %if %{with DOC} %meson_build man arm arm-epub %endif +%if %{with SYSTEMTEST} + %meson_build system-test-dependencies +%endif # Compress changelog by default gzip doc/changelog/changelog-*.rst @@ -460,18 +465,23 @@ export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0" if [ -n "$CONFIGURED" ] then - set -e - pushd bin/tests + pushd bin/tests/system export CI_SYSTEM=yes # allow running tests as root chown -R ${USER} . # Can be unknown user - %meson_build test 2>&1 | tee test.log - e=$? + e=0 + pytest -n ${THREADS} --capture=tee-sys || e=$? [ "$CONFIGURED" = build ] && $SUDO sh ./ifconfig.sh down - popd if [ "$e" -ne 0 ]; then - echo "ERROR: this build of BIND failed 'make test'. Aborting." + echo "ERROR: failed running 'pytest' in system tests. Aborting." + ls -1 "$(pwd)"/*_tmp_* + for TMPTEST in *_tmp_* + do + echo "# $TMPTEST" + cat $TMPTEST/pytest.log.txt + done exit $e; fi; + popd else echo 'SKIPPED: tests require root, CAP_NET_ADMIN or already configured test addresses.' fi From 8ac024600e0649a582af044cfe54e5ba0fa10878 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Fri, 21 Nov 2025 22:32:42 +0100 Subject: [PATCH 04/21] Update to 9.21.15 (rhbz#2415843) New features: - New rndc showconf command. - named-checkconf -b dumps the built-in configuration. - named-checkconf -e prints the effective configuration. - Add support for Extended DNS Error 24 (Invalid Data). Removed features: - Remove the tkey-domain statement. - Remove the tkey-gssapi-credential statement. Feature changes: - Minimal Meson version required is 1.3.0. Bug fixes: - Skip unsupported algorithms when looking for a signing key. - Report when a zone reload is already in progress. - Fix dnssec-keygen key collision checking for KEY RRtype keys. - dnssec-verify now uses exit code 1 when failing due to illegal options. - Prevent assertion failures of dig when a server is specified before the -b option. - Skip buffer allocations if not logging. https://downloads.isc.org/isc/bind9/9.21.15/doc/arm/html/notes.html#notes-for-bind-9-21-15 --- bind-9.21-dual-sign-continue-test.patch | 115 ------------------------ bind-9.21-dual-sign-continue.patch | 42 --------- bind9-next.spec | 6 +- sources | 4 +- 4 files changed, 4 insertions(+), 163 deletions(-) delete mode 100644 bind-9.21-dual-sign-continue-test.patch delete mode 100644 bind-9.21-dual-sign-continue.patch diff --git a/bind-9.21-dual-sign-continue-test.patch b/bind-9.21-dual-sign-continue-test.patch deleted file mode 100644 index 18408af..0000000 --- a/bind-9.21-dual-sign-continue-test.patch +++ /dev/null @@ -1,115 +0,0 @@ -From 488d7bfc75f2988c6e461b8677bc0e27e58bd82e Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= -Date: Sat, 1 Nov 2025 12:00:59 +0100 -Subject: [PATCH] Add a system test with one good and one bad algorithm - -The case where there would be one supported algorithm and one already -unsupported (like RSAMD5 or RSASHA1) was missing. ---- - bin/tests/system/dnssec/ns2/example.db.in | 4 +++ - bin/tests/system/dnssec/ns2/sign.sh | 2 +- - bin/tests/system/dnssec/ns3/named.conf.j2 | 6 ++++ - bin/tests/system/dnssec/ns3/sign.sh | 31 +++++++++++++++++++++ - bin/tests/system/dnssec/tests_validation.py | 8 ++++++ - 5 files changed, 50 insertions(+), 1 deletion(-) - -diff --git a/bin/tests/system/dnssec/ns2/example.db.in b/bin/tests/system/dnssec/ns2/example.db.in -index 47c2eb7f0e..07429366ee 100644 ---- a/bin/tests/system/dnssec/ns2/example.db.in -+++ b/bin/tests/system/dnssec/ns2/example.db.in -@@ -202,3 +202,7 @@ ns3.extradsunknownoid A 10.53.0.3 - - extended-ds-unknown-oid NS ns3.extended-ds-unknown-oid - ns3.extended-ds-unknown-oid A 10.53.0.3 -+ -+; A secure subdomain with extra bad key -+extrabadkey NS ns3.extrabadkey -+ns3.extrabadkey A 10.53.0.3 -diff --git a/bin/tests/system/dnssec/ns2/sign.sh b/bin/tests/system/dnssec/ns2/sign.sh -index e3f18af15e..da9f5f07fc 100644 ---- a/bin/tests/system/dnssec/ns2/sign.sh -+++ b/bin/tests/system/dnssec/ns2/sign.sh -@@ -92,7 +92,7 @@ for subdomain in digest-alg-unsupported ds-unsupported secure badds \ - dnskey-nsec3-unknown managed-future future revkey \ - dname-at-apex-nsec3 occluded rsasha1 rsasha1-1024 \ - rsasha256oid rsasha512oid unknownoid extradsoid extradsunknownoid \ -- extended-ds-unknown-oid; do -+ extended-ds-unknown-oid extrabadkey; do - cp "../ns3/dsset-$subdomain.example." . - done - -diff --git a/bin/tests/system/dnssec/ns3/named.conf.j2 b/bin/tests/system/dnssec/ns3/named.conf.j2 -index 1a0edc14bb..9cbc58892c 100644 ---- a/bin/tests/system/dnssec/ns3/named.conf.j2 -+++ b/bin/tests/system/dnssec/ns3/named.conf.j2 -@@ -141,6 +141,12 @@ zone "extrakey.example" { - allow-update { any; }; - }; - -+zone "extrabadkey.example" { -+ type primary; -+ file "extrabadkey.example.db.signed"; -+ allow-update { any; }; -+}; -+ - zone "insecure.nsec3.example" { - type primary; - file "insecure.nsec3.example.db"; -diff --git a/bin/tests/system/dnssec/ns3/sign.sh b/bin/tests/system/dnssec/ns3/sign.sh -index 5512888b2f..ea81381eb2 100644 ---- a/bin/tests/system/dnssec/ns3/sign.sh -+++ b/bin/tests/system/dnssec/ns3/sign.sh -@@ -905,3 +905,34 @@ ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone") - zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone") - cat "$infile" "$ksk.key" "$zsk.key" >"$zonefile" - "$SIGNER" -g -o "$zone" "$zonefile" >/dev/null 2>&1 -+ -+# -+# -+# -+zone=extrabadkey.example. -+infile=template.db.in -+zonefile=extrabadkey.example.db -+ -+# Add KSK and ZSK that we will mangle to RSAMD5 -+ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone") -+zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone") -+cat "$infile" "$ksk.key" "$zsk.key" >"$zonefile" -+"$SIGNER" -g -O full -o "$zone" "$zonefile" >/dev/null 2>&1 -+ -+# Mangle the signatures to RSAMD5 and save them for future use -+sed -ne "s/\(IN[[:space:]]*RRSIG[[:space:]]*[A-Z]*\) $DEFAULT_ALGORITHM_NUMBER /\1 1 /p" <"$zonefile.signed" >"$zonefile.signed.rsamd5" -+ -+# Now add normal KSK and ZSK to the zone file -+ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone") -+zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone") -+cat "$infile" "$ksk.key" "$zsk.key" >"$zonefile" -+ -+# Mangle the DNSKEY algorithm numbers and add them to the signed zone file -+cat "$ksk.key" "$zsk.key" | sed -e "s/\(IN[[:space:]]*DNSKEY[[:space:]]*[0-9]* 3\) $DEFAULT_ALGORITHM_NUMBER /\1 1 /" >>"$zonefile" -+ -+# Sign normally -+"$SIGNER" -g -o "$zone" "$zonefile" >/dev/null 2>&1 -+ -+# Add the mangled signatures to signed zone file -+cat "$zonefile.signed.rsamd5" >>"$zonefile.signed" -+rm "$zonefile.signed.rsamd5" -diff --git a/bin/tests/system/dnssec/tests_validation.py b/bin/tests/system/dnssec/tests_validation.py -index e6d8ccc734..a27a899987 100644 ---- a/bin/tests/system/dnssec/tests_validation.py -+++ b/bin/tests/system/dnssec/tests_validation.py -@@ -1385,3 +1385,11 @@ def test_rrsigs_for_glue(): - record.rdtype == rdatatype.RRSIG and record.covers == rdatatype.A - for record in res.answer - ) -+ -+ -+def test_extra_bad_algorithm(): -+ msg = isctest.query.create("a.extrabadkey.example", "A") -+ res1 = isctest.query.tcp(msg, "10.53.0.3") -+ res2 = isctest.query.tcp(msg, "10.53.0.4") -+ isctest.check.same_answer(res1, res2) -+ isctest.check.adflag(res2) --- -2.51.1 - diff --git a/bind-9.21-dual-sign-continue.patch b/bind-9.21-dual-sign-continue.patch deleted file mode 100644 index 22e3cef..0000000 --- a/bind-9.21-dual-sign-continue.patch +++ /dev/null @@ -1,42 +0,0 @@ -From a94a7c1a1e6eecbead995a08bace33d23899a5da Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= -Date: Tue, 4 Nov 2025 02:09:38 +0100 -Subject: [PATCH] Skip unsupported algorithms when looking for signing key -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -When looking for a signing key in select_signing_key(), the result code -indicating unsupported algorithm would abort the search. Instead, skip -such keys and continue searching for the right key. - -Co-Authored-By: Aram Sargsyan -Co-Authored-By: Petr Menšík ---- - lib/dns/validator.c | 10 ++++++++-- - 1 file changed, 8 insertions(+), 2 deletions(-) - -diff --git a/lib/dns/validator.c b/lib/dns/validator.c -index c6781544b9..52677fbd80 100644 ---- a/lib/dns/validator.c -+++ b/lib/dns/validator.c -@@ -1092,8 +1092,14 @@ select_signing_key(dns_validator_t *val, dns_rdataset_t *rdataset) { - continue; - } - -- return dns_dnssec_keyfromrdata(&siginfo->signer, &rdata, -- val->view->mctx, &val->key); -+ result = dns_dnssec_keyfromrdata(&siginfo->signer, &rdata, -+ val->view->mctx, &val->key); -+ /* Don't count unsupported algorithm towards max fails */ -+ if (result == DST_R_UNSUPPORTEDALG) { -+ /* Continue with the next key */ -+ continue; -+ } -+ return result; - } - - return ISC_R_NOTFOUND; --- -2.51.1 - diff --git a/bind9-next.spec b/bind9-next.spec index fd0bb15..5dde8c8 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -52,7 +52,7 @@ Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv Name: bind9-next License: MPL-2.0 AND ISC AND BSD-3-clause AND MIT AND BSD-2-clause # -Version: 9.21.14 +Version: 9.21.15 Release: %autorelease Epoch: 32 Url: https://www.isc.org/downloads/bind/ @@ -93,8 +93,6 @@ Patch3: bind-9.21-unittest-isc_rwlock-s390x.patch # https://gitlab.isc.org/isc-projects/bind9/-/issues/5328 # avoid often fails on i386, unsupported upstream Patch4: bind-9.21-unittest-qpdb-i386.patch -Patch5: bind-9.21-dual-sign-continue.patch -Patch6: bind-9.21-dual-sign-continue-test.patch %{?systemd_ordering} Requires: coreutils @@ -111,7 +109,7 @@ BuildRequires: gcc BuildRequires: make BuildRequires: openssl-devel BuildRequires: libtool -BuildRequires: meson +BuildRequires: meson >= 1.3.0 BuildRequires: ninja-build BuildRequires: pkgconfig BuildRequires: libcap-devel diff --git a/sources b/sources index 714e4db..62a6afc 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.21.14.tar.xz) = bf4bd0f5613d6c6d53f749f3269a34f3a5c74a7dc81e05922d58ba30f19d418e565838dd1182dd6052b9a62b3799d2d0f12451f2797af3279259df59cfc4be05 -SHA512 (bind-9.21.14.tar.xz.asc) = 91ccc82ca54d07dba07821c3410f92b563290ead48546d605b0dbd9958a831d9b90130002fbb325e0cdc913de64813d8ba4c48ec958ebba7f5f462d43f578394 +SHA512 (bind-9.21.15.tar.xz) = 6c18c2a0a915e6c42036b6869a1d495872de7c94b67f036d8074a8d45c1cefff57d8df64b0d8a34611d3cdc1b09b2e6d3e4989d4cdf450643735e8ecb8d49d86 +SHA512 (bind-9.21.15.tar.xz.asc) = ca422a14adc3027a7301b628afad73dc2f5759456b27180402b707f30fba41dc9af4dfb2f0c8f25b1f1eed0a78dc16cabcd0ec19e5455966cf8e1b5a67296b57 From f0a10662c1d8844e0433b57a3c15211dcfcc1af2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Fri, 21 Nov 2025 23:51:11 +0100 Subject: [PATCH 05/21] Use dns-root-data package for hints source Use trusted root source and hints from separate package. --- bind9-next.spec | 26 ++++++++----- named-chroot.files | 1 + named-mkroot.sh | 20 ++++++++++ named.root | 92 ---------------------------------------------- named.root.key | 23 +++--------- trusted-key.key | 2 - 6 files changed, 42 insertions(+), 122 deletions(-) create mode 100755 named-mkroot.sh delete mode 100644 named.root delete mode 100644 trusted-key.key diff --git a/bind9-next.spec b/bind9-next.spec index 5dde8c8..3d287b6 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -30,7 +30,7 @@ %global chroot_prefix %{bind_dir}/chroot %global chroot_create_directories /dev /run/named %{_localstatedir}/{log,named,tmp} \\\ %{_sysconfdir}/{crypto-policies/back-ends,pki/dnssec-keys,pki/tls,named} \\\ - %{_libdir}/bind %{_libdir}/named %{_datadir}/GeoIP /proc/sys/net/ipv4 + %{_libdir}/bind %{_libdir}/named %{_datadir}/{GeoIP,dns-root-data} /proc/sys/net/ipv4 %global forgeurl0 https://gitlab.isc.org/isc-projects/bind9 @@ -64,17 +64,13 @@ Source2: https://downloads.isc.org/isc/bind9/%{version}/%{upname}-%{version}.ta Source3: named.logrotate Source4: https://www.isc.org/docs/isc-keyblock.asc Source16: named.conf -# Refresh by command: dig @a.root-servers.net. +tcp +norec -# or from URL -Source17: https://www.internic.net/domain/named.root Source18: named.localhost Source19: named.loopback Source20: named.empty Source23: named.rfc1912.zones Source25: named.conf.sample -Source27: named.root.key +Source27: named-mkroot.sh Source35: bind.tmpfiles.d -Source36: trusted-key.key Source37: named.service Source38: named-chroot.service Source41: setup-named-chroot.sh @@ -99,6 +95,7 @@ Requires: coreutils Requires(post): shadow-utils Requires(post): glibc-common Requires(post): grep +Requires: dns-root-data Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release} Recommends: %{name}-utils %{name}-dnssec-utils %upname_compat %{upname} @@ -122,6 +119,7 @@ BuildRequires: sed BuildRequires: libnghttp2-devel BuildRequires: userspace-rcu-devel BuildRequires: pkgconfig(libedit) +BuildRequires: dns-root-data # Compress the changelog BuildRequires: gzip %if 0%{?fedora} @@ -347,6 +345,10 @@ export STD_CDEFINES="$CPPFLAGS" #'s/([bind_VERSION_EXTRA],\s*\([^)]*\))/([bind_VERSION_EXTRA], \1-RH)/' \ #configure.ac +install -p -m 0755 %{SOURCE27} ./named-mkroot.sh # create named.root.key +./named-mkroot.sh +[ -f named.root.key ] + LIBDIR_SUFFIX= export LIBDIR_SUFFIX @@ -414,6 +416,10 @@ gzip doc/changelog/changelog-*.rst export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0" %endif +# We produce it runtime. Check it has valid syntax. +LD_LIBRARY_PATH="$LD_LIBRARY_PATH:${RPM_BUILD_ROOT}%{_libdir}" \ + ${RPM_BUILD_ROOT}%{_bindir}/named-checkconf ${RPM_BUILD_ROOT}%{_sysconfdir}/named.root.key + %if %{with UNITTEST} CPUS=$(lscpu -p=cpu,core | grep -v '^#' | wc -l) THREADS="$CPUS" @@ -584,13 +590,13 @@ touch ${RPM_BUILD_ROOT}%{_localstatedir}/log/named.log # configuration files: install -m 640 %{SOURCE16} ${RPM_BUILD_ROOT}%{_sysconfdir}/named.conf touch ${RPM_BUILD_ROOT}%{_sysconfdir}/rndc.{key,conf} -install -m 644 %{SOURCE27} ${RPM_BUILD_ROOT}%{_sysconfdir}/named.root.key -install -m 644 %{SOURCE36} ${RPM_BUILD_ROOT}%{_sysconfdir}/trusted-key.key +install -m 644 -p named.root.key ${RPM_BUILD_ROOT}%{_sysconfdir}/named.root.key +ln -s "%{_datadir}/dns-root-data/root.key" ${RPM_BUILD_ROOT}%{_sysconfdir}/trusted-key.key mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/named # data files: mkdir -p ${RPM_BUILD_ROOT}%{_localstatedir}/named -install -m 640 %{SOURCE17} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.ca +ln -s "%{_datadir}/dns-root-data/root.hints" ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.ca install -m 640 %{SOURCE18} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.localhost install -m 640 %{SOURCE19} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.loopback install -m 640 %{SOURCE20} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.empty @@ -603,7 +609,7 @@ install -m 644 %{SOURCE25} sample/etc/named.conf install -m 644 %{SOURCE16} named.conf.default install -m 644 %{SOURCE23} sample/etc/named.rfc1912.zones install -m 644 %{SOURCE18} %{SOURCE19} %{SOURCE20} sample/var/named -install -m 644 %{SOURCE17} sample/var/named/named.ca +ln -s "%{_datadir}/dns-root-data/root.hints" sample/var/named/named.ca for f in my.internal.zone.db slaves/my.slave.internal.zone.db slaves/my.ddns.internal.zone.db my.external.zone.db; do echo '@ in soa localhost. root 1 3H 15M 1W 1D ns localhost.' > sample/var/named/$f; diff --git a/named-chroot.files b/named-chroot.files index c186664..c901664 100644 --- a/named-chroot.files +++ b/named-chroot.files @@ -18,6 +18,7 @@ /usr/lib64/bind /usr/lib/bind /usr/share/GeoIP +/usr/share/dns-root-data /run/named /proc/sys/net/ipv4/ip_local_port_range # Warning: the order is important diff --git a/named-mkroot.sh b/named-mkroot.sh new file mode 100755 index 0000000..288725b --- /dev/null +++ b/named-mkroot.sh @@ -0,0 +1,20 @@ +#!/bin/sh +# Create named.root.key from dns-root-data package + +ROOT_DS=/usr/share/dns-root-data/root.ds +: ${OUTPUT:=named.root.key} + +if ! [ -r "$ROOT_DS" ]; then + echo "Root trust file is not readable: $ROOT_DS" + exit 1 +fi + +echo "# Autogenerated from $ROOT_DS" > "$OUTPUT" +echo "trust-anchors {" >> "$OUTPUT" +cat "$ROOT_DS" | while read DOMAIN CLS QTYPE KEYTAG ALG DIG HASH; +do + echo "$DOMAIN initial-ds $KEYTAG $ALG $DIG \"$HASH\";" >> "$OUTPUT"; +done +echo "}; " >> "$OUTPUT" +# Set the same modification time as data source. +touch -r $ROOT_DS "$OUTPUT" diff --git a/named.root b/named.root deleted file mode 100644 index 8b8a3b1..0000000 --- a/named.root +++ /dev/null @@ -1,92 +0,0 @@ -; This file holds the information on root name servers needed to -; initialize cache of Internet domain name servers -; (e.g. reference this file in the "cache . " -; configuration file of BIND domain name servers). -; -; This file is made available by InterNIC -; under anonymous FTP as -; file /domain/named.cache -; on server FTP.INTERNIC.NET -; -OR- RS.INTERNIC.NET -; -; last update: December 20, 2023 -; related version of root zone: 2023122001 -; -; FORMERLY NS.INTERNIC.NET -; -. 3600000 NS A.ROOT-SERVERS.NET. -A.ROOT-SERVERS.NET. 3600000 A 198.41.0.4 -A.ROOT-SERVERS.NET. 3600000 AAAA 2001:503:ba3e::2:30 -; -; FORMERLY NS1.ISI.EDU -; -. 3600000 NS B.ROOT-SERVERS.NET. -B.ROOT-SERVERS.NET. 3600000 A 170.247.170.2 -B.ROOT-SERVERS.NET. 3600000 AAAA 2801:1b8:10::b -; -; FORMERLY C.PSI.NET -; -. 3600000 NS C.ROOT-SERVERS.NET. -C.ROOT-SERVERS.NET. 3600000 A 192.33.4.12 -C.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:2::c -; -; FORMERLY TERP.UMD.EDU -; -. 3600000 NS D.ROOT-SERVERS.NET. -D.ROOT-SERVERS.NET. 3600000 A 199.7.91.13 -D.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:2d::d -; -; FORMERLY NS.NASA.GOV -; -. 3600000 NS E.ROOT-SERVERS.NET. -E.ROOT-SERVERS.NET. 3600000 A 192.203.230.10 -E.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:a8::e -; -; FORMERLY NS.ISC.ORG -; -. 3600000 NS F.ROOT-SERVERS.NET. -F.ROOT-SERVERS.NET. 3600000 A 192.5.5.241 -F.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:2f::f -; -; FORMERLY NS.NIC.DDN.MIL -; -. 3600000 NS G.ROOT-SERVERS.NET. -G.ROOT-SERVERS.NET. 3600000 A 192.112.36.4 -G.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:12::d0d -; -; FORMERLY AOS.ARL.ARMY.MIL -; -. 3600000 NS H.ROOT-SERVERS.NET. -H.ROOT-SERVERS.NET. 3600000 A 198.97.190.53 -H.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:1::53 -; -; FORMERLY NIC.NORDU.NET -; -. 3600000 NS I.ROOT-SERVERS.NET. -I.ROOT-SERVERS.NET. 3600000 A 192.36.148.17 -I.ROOT-SERVERS.NET. 3600000 AAAA 2001:7fe::53 -; -; OPERATED BY VERISIGN, INC. -; -. 3600000 NS J.ROOT-SERVERS.NET. -J.ROOT-SERVERS.NET. 3600000 A 192.58.128.30 -J.ROOT-SERVERS.NET. 3600000 AAAA 2001:503:c27::2:30 -; -; OPERATED BY RIPE NCC -; -. 3600000 NS K.ROOT-SERVERS.NET. -K.ROOT-SERVERS.NET. 3600000 A 193.0.14.129 -K.ROOT-SERVERS.NET. 3600000 AAAA 2001:7fd::1 -; -; OPERATED BY ICANN -; -. 3600000 NS L.ROOT-SERVERS.NET. -L.ROOT-SERVERS.NET. 3600000 A 199.7.83.42 -L.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:9f::42 -; -; OPERATED BY WIDE -; -. 3600000 NS M.ROOT-SERVERS.NET. -M.ROOT-SERVERS.NET. 3600000 A 202.12.27.33 -M.ROOT-SERVERS.NET. 3600000 AAAA 2001:dc3::35 -; End of file \ No newline at end of file diff --git a/named.root.key b/named.root.key index b57e61d..6d0904d 100644 --- a/named.root.key +++ b/named.root.key @@ -1,18 +1,5 @@ -trust-anchors { - # ROOT KEYS: See https://data.iana.org/root-anchors/root-anchors.xml - # for current trust anchor information. - # - # This key (20326) was published in the root zone in 2017. - # Servers which were already using the old key (19036) should - # roll seamlessly to this new one via RFC 5011 rollover. Servers - # being set up for the first time can use the contents of this - # file as initializing keys; thereafter, the keys in the - # managed key database will be trusted and maintained - # automatically. - . initial-ds 20326 8 2 "E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D"; - # This key (38696) will be pre-published in the root zone in 2025 - # and is scheduled to begin signing in late 2026. At that time, - # servers which were already using the old key (20326) should roll - # seamlessly to this new one via RFC 5011 rollover. - . initial-ds 38696 8 2 "683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A4C0FB2B16"; -}; +# Autogenerated from /usr/share/dns-root-data/root.ds +truste-anchors { +. initial-ds 20326 8 2 "E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D"; +. initial-ds 38696 8 2 "683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A4C0FB2B16"; +}; diff --git a/trusted-key.key b/trusted-key.key deleted file mode 100644 index 2ef50c7..0000000 --- a/trusted-key.key +++ /dev/null @@ -1,2 +0,0 @@ -. 3600 IN DNSKEY 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= -. 3600 IN DNSKEY 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdpWWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwuMoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBevYtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= From 6059fcadaa19d8625ea5534e43d27b81253b1687 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Fri, 16 Jan 2026 15:15:39 +0100 Subject: [PATCH 06/21] Update to 9.21.16 (rhbz#2415843) New Features: - Add +[no]showtruncated and +[no]showallmessages to dig. Feature Changes: - Reduce the number of outgoing queries. - Improve output of rndc dnssec -status - Change the QNAME minimization algorithm to follow the standard. - Enforce bounds of prefetch configuration option. - Enforce the fact that catalog zones cannot be used in non-IN views. - Provide more information when memory allocation fails. Bug Fixes: - Adding NSEC3 opt-out records could leave invalid records in chain. - Fix spurious timeouts while resolving names. - Fix bug where zone switches from NSEC3 to NSEC after retransfer. - Fix caching RRSIG covering cached NODATA record. - AMTRELAY type 0 presentation format handling was wrong. - Fix parsing bug in remote-servers with key or TLS. - Fix allow-recursion/allow-query-cache inheritance. - Fix DoT reconfigure/reload bug in the resolver. https://downloads.isc.org/isc/bind9/9.21.16/doc/arm/html/notes.html#notes-for-bind-9-21-16 --- bind9-next.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/bind9-next.spec b/bind9-next.spec index 3d287b6..f38af33 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -52,7 +52,7 @@ Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv Name: bind9-next License: MPL-2.0 AND ISC AND BSD-3-clause AND MIT AND BSD-2-clause # -Version: 9.21.15 +Version: 9.21.16 Release: %autorelease Epoch: 32 Url: https://www.isc.org/downloads/bind/ diff --git a/sources b/sources index 62a6afc..d0edb5d 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.21.15.tar.xz) = 6c18c2a0a915e6c42036b6869a1d495872de7c94b67f036d8074a8d45c1cefff57d8df64b0d8a34611d3cdc1b09b2e6d3e4989d4cdf450643735e8ecb8d49d86 -SHA512 (bind-9.21.15.tar.xz.asc) = ca422a14adc3027a7301b628afad73dc2f5759456b27180402b707f30fba41dc9af4dfb2f0c8f25b1f1eed0a78dc16cabcd0ec19e5455966cf8e1b5a67296b57 +SHA512 (bind-9.21.16.tar.xz) = 9536de96f80efe092e149fef9c4f71f022b3d9b8cbfa2ecf4aaa3bcf5afdc6b8a2d201d00b35f3c909161eb02b96fa587fd674c4fe292f96ba9ad91d6d86248e +SHA512 (bind-9.21.16.tar.xz.asc) = db21fc697957090055a9cc4f42aea78cb9c4d692c0754d96fb47ca38a76fdba227a3731c44fb5e4f129cfdf9301ffbe529305a4de1e49bdfb8ed5850e005cc6a From a4fb8fbe496e07da6afa8e5cb73129f95965381c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Mon, 19 Jan 2026 13:26:29 +0100 Subject: [PATCH 07/21] Fix build for RHEL, disable JEMALLOC there --- bind9-next.spec | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/bind9-next.spec b/bind9-next.spec index f38af33..b5253ed 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -22,6 +22,7 @@ %bcond_with TSAN %bcond_without DTRACE %bcond_with OPENSSL_ENGINE +%bcond JEMALLOC 0%{?fedora} %{?!bind_uid: %global bind_uid 25} %{?!bind_gid: %global bind_gid 25} @@ -122,9 +123,11 @@ BuildRequires: pkgconfig(libedit) BuildRequires: dns-root-data # Compress the changelog BuildRequires: gzip -%if 0%{?fedora} +%if %{with JEMALLOC} BuildRequires: jemalloc-devel -BuildRequires: gnupg2 +%endif +%if ! 0%{?rhel} +BuildRequires: gpgverify %endif BuildRequires: libuv-devel %if %{with OPENSSL_ENGINE} @@ -301,8 +304,8 @@ in HTML and PDF format. %endif %prep -%if 0%{?fedora} -# RHEL does not yet support this verification +%if ! 0%{?rhel} || 0%{?rhel} > 10 +# RHEL does not (again?) support this verification %{gpgverify} --keyring='%{SOURCE4}' --signature='%{SOURCE2}' --data='%{SOURCE0}' %endif %autosetup -n %{upname}-%{version} -p1 @@ -383,6 +386,9 @@ export LIBDIR_SUFFIX %if %{with DOC} -Ddoc=enabled \ %endif +%if %{without JEMALLOC} + -Djemalloc=disabled \ +%endif ; %if %{with DNSTAP} pushd lib From 7238eb8b29341bb8a4b7694223141ea6c19481de Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Thu, 22 Jan 2026 10:58:43 +0100 Subject: [PATCH 08/21] Update to 9.21.17 (rhbz#2415843) Security Fixes: - Fix incorrect length checks for BRID and HHIT records. (CVE-2025-13878) New Features: - Add support for Extended DNS Error 9 (Missing DNSKEY). - Add support for Extended DNS Error 13 (Cached Error). - Add support for Generalized DNS Notifications. Features Changes: - Add more information to the rndc recursing output about fetches. - Enforce bounds of multiple configuration options. Bug Fixes: - Fix inbound IXFR performance regression. - Make DNSSEC key rollovers more robust. - Fix a catalog zone issue, where member zones could fail to load. - Fix slow speed when signing a large delegation zone with NSEC3 opt-out. - Reconfiguring an NSEC3 opt-out zone to NSEC caused the zone to be invalid. - Fix a possible catalog zone issue during reconfiguration. - Fix the charts in the statistics channel. https://downloads.isc.org/isc/bind9/9.21.17/doc/arm/html/notes.html#notes-for-bind-9-21-17 --- bind9-next.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/bind9-next.spec b/bind9-next.spec index b5253ed..39018bf 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -53,7 +53,7 @@ Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv Name: bind9-next License: MPL-2.0 AND ISC AND BSD-3-clause AND MIT AND BSD-2-clause # -Version: 9.21.16 +Version: 9.21.17 Release: %autorelease Epoch: 32 Url: https://www.isc.org/downloads/bind/ diff --git a/sources b/sources index d0edb5d..5eede3e 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.21.16.tar.xz) = 9536de96f80efe092e149fef9c4f71f022b3d9b8cbfa2ecf4aaa3bcf5afdc6b8a2d201d00b35f3c909161eb02b96fa587fd674c4fe292f96ba9ad91d6d86248e -SHA512 (bind-9.21.16.tar.xz.asc) = db21fc697957090055a9cc4f42aea78cb9c4d692c0754d96fb47ca38a76fdba227a3731c44fb5e4f129cfdf9301ffbe529305a4de1e49bdfb8ed5850e005cc6a +SHA512 (bind-9.21.17.tar.xz) = b53fcea8db7d1b4e8fba7055f175289a7d1e3380be77e0899986101ffc3ff9222be5bf249b8f0162b0c88b0b463f42b778fa11f3ed86f913e17cd62561c65063 +SHA512 (bind-9.21.17.tar.xz.asc) = 62e344ae5deae40c4f647f4b99bee56d63cc7be5dd882f24993771c537eb7817dd2a5d2b8f6396fd906df9ef11afb4c1f874f61bd25329f50f7ca952d508482c From 6e8f7344bd22a90cfbafad5d93c90d6a0f6d56d1 Mon Sep 17 00:00:00 2001 From: Yanko Kaneti Date: Mon, 2 Feb 2026 18:27:38 +0200 Subject: [PATCH 09/21] Reduce test loops for tests/isc/{mutex/spinlock/rwlock} Allow rwlock(isc_rwlock_benchmark) to finish within the 300 seconds timeout limit on platforms (riscv64,s390x) where it is slow TODO: find out why it is slow --- bind-9.21-unittest-isc_rwlock-s390x.patch | 29 ----------------------- bind9-next.spec | 7 ++++-- 2 files changed, 5 insertions(+), 31 deletions(-) delete mode 100644 bind-9.21-unittest-isc_rwlock-s390x.patch diff --git a/bind-9.21-unittest-isc_rwlock-s390x.patch b/bind-9.21-unittest-isc_rwlock-s390x.patch deleted file mode 100644 index 5697450..0000000 --- a/bind-9.21-unittest-isc_rwlock-s390x.patch +++ /dev/null @@ -1,29 +0,0 @@ -From b8bc86834311e4ea27fe75052db08279045f027b Mon Sep 17 00:00:00 2001 -From: Petr Mensik -Date: Wed, 20 Nov 2024 15:34:29 +0100 -Subject: [PATCH] Skip isc_rwlock_benchmark on s390x - -Not sure why, but it repeatedly failed on isc_rwlock_benchmark function. -Not sure if it requires more time only or there is some strange error. ---- - tests/isc/rwlock_test.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/tests/isc/rwlock_test.c b/tests/isc/rwlock_test.c -index 4c5b8e0..a28b7d9 100644 ---- a/tests/isc/rwlock_test.c -+++ b/tests/isc/rwlock_test.c -@@ -340,7 +340,10 @@ ISC_TEST_ENTRY_CUSTOM(isc_rwlock_wrlock, rwlock_setup, rwlock_teardown) - #if !defined(__SANITIZE_THREAD__) - ISC_TEST_ENTRY_CUSTOM(isc_rwlock_tryupgrade, rwlock_setup, rwlock_teardown) - ISC_TEST_ENTRY_CUSTOM(isc_rwlock_trylock, rwlock_setup, rwlock_teardown) -+#ifndef __s390x__ -+// TODO: find why this stucks. - ISC_TEST_ENTRY_CUSTOM(isc_rwlock_benchmark, rwlock_setup, rwlock_teardown) -+#endif - #endif /* __SANITIZE_THREAD__ */ - - ISC_TEST_LIST_END --- -2.47.0 - diff --git a/bind9-next.spec b/bind9-next.spec index 39018bf..f941085 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -85,8 +85,6 @@ Source49: named-chroot.files # Common patches # Red Hat specific documentation is not relevant to upstream Patch1: bind-9.16-redhat_doc.patch -# Downstream only. TODO: find a cause and remove this workaround -Patch3: bind-9.21-unittest-isc_rwlock-s390x.patch # https://gitlab.isc.org/isc-projects/bind9/-/issues/5328 # avoid often fails on i386, unsupported upstream Patch4: bind-9.21-unittest-qpdb-i386.patch @@ -413,6 +411,11 @@ gzip doc/changelog/changelog-*.rst #systemtest_prepare_build build %check +# reduce test loops (from default 100) for isc/{mutex/spinlock/rwlock} +# to allow rwlock(isc_rwlock_benchmark) to finish within the 300 seconds +# timeout limit on platforms (riscv64,s390x) where it is slow +# TODO: find out why it is slow +export ISC_BENCHMARK_LOOPS=20 %if %{with UNITTEST} || %{with SYSTEMTEST} # Tests require initialization of pkcs11 token eval "$(bash %{SOURCE48} -A "`pwd`/softhsm-tokens")" From ad180eead35da6dfdcb4e65f7b60b32814ac18d1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Wed, 25 Mar 2026 19:36:24 +0100 Subject: [PATCH 10/21] Update to 9.21.20 (rhbz#2440560) Security Fixes: - Fix unbounded NSEC3 iterations when validating referrals to unsigned delegations. (CVE-2026-1519) - Fix memory leaks in code preparing DNSSEC proofs of non-existence. (CVE-2026-3104) - Prevent a crash in code processing queries containing a TKEY record. (CVE-2026-3119) - Fix a stack use-after-return flaw in SIG(0) handling code. (CVE-2026-3591) New Features: - Provide response round-trip time (RTT) counters via statistics channel. - Introduce max-delegation-servers configuration option. Bug Fixes: - Fix parsing key inactivation time in KASP code. - Fix the handling of key statements defined inside views. Source: https://downloads.isc.org/isc/bind9/9.21.20/doc/arm/html/notes.html#notes-for-bind-9-21-20 --- bind9-next.spec | 4 +++- sources | 4 ++-- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/bind9-next.spec b/bind9-next.spec index f941085..96bd47e 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -32,6 +32,8 @@ %global chroot_create_directories /dev /run/named %{_localstatedir}/{log,named,tmp} \\\ %{_sysconfdir}/{crypto-policies/back-ends,pki/dnssec-keys,pki/tls,named} \\\ %{_libdir}/bind %{_libdir}/named %{_datadir}/{GeoIP,dns-root-data} /proc/sys/net/ipv4 +%global upstream_sources 0 2 +%global pgp_signed_sources 2 %global forgeurl0 https://gitlab.isc.org/isc-projects/bind9 @@ -53,7 +55,7 @@ Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv Name: bind9-next License: MPL-2.0 AND ISC AND BSD-3-clause AND MIT AND BSD-2-clause # -Version: 9.21.17 +Version: 9.21.20 Release: %autorelease Epoch: 32 Url: https://www.isc.org/downloads/bind/ diff --git a/sources b/sources index 5eede3e..fa2afc0 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.21.17.tar.xz) = b53fcea8db7d1b4e8fba7055f175289a7d1e3380be77e0899986101ffc3ff9222be5bf249b8f0162b0c88b0b463f42b778fa11f3ed86f913e17cd62561c65063 -SHA512 (bind-9.21.17.tar.xz.asc) = 62e344ae5deae40c4f647f4b99bee56d63cc7be5dd882f24993771c537eb7817dd2a5d2b8f6396fd906df9ef11afb4c1f874f61bd25329f50f7ca952d508482c +SHA512 (bind-9.21.20.tar.xz) = 4bd65612ff851720eba7f88495d51eb8a41b6a946c377b9dcd62f58f8c5a3e9338af44abc9df76b2ead9461eca4eb81f088619e3cc481f35fa0fc5d0926a93e3 +SHA512 (bind-9.21.20.tar.xz.asc) = 7431540d942fe23222b2812f9d80e67d0fa38516f9d536095a6544b156dc0306aba5752ba6c03cc2935d92a74860e70e8fc53b4cb481b8afe226e49dd51f695f From 70ecf4eb59b2a7b9bc2f7026d297e149ee122963 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Wed, 8 Apr 2026 14:13:17 +0200 Subject: [PATCH 11/21] Update to 9.21.21 (rhbz#2453811) Security Fixes: - Fix crash when reconfiguring zone update policy during active updates. New Features: - Add switch to disable cookie checking in delv. Removed Features: - Remove -C option from dnssec-keygen and dnssec-keyfromlabel. - Remove NZF file support in favor of NZD. Feature Changes: - Parent-centric resolver. - Switch to LRU-only cache eviction, enforce minimum cache size. Bug Fixes: - Fix intermittent named crashes during asynchronous zone operations. - Count temporal problems with DNSSEC validation as attempts. - Fix a possible deadlock in RPZ processing. - Fix update-policy per-type max quota bypass via crafted UPDATE messages. - Fix a crash triggered by rndc modzone on a zone from a configuration file. - Fix the processing of empty catalog zone ACLs. - Fix potential resource leak during resolver error handling. Source: https://downloads.isc.org/isc/bind9/9.21.21/doc/arm/html/notes.html#notes-for-bind-9-21-21 --- bind9-next.spec | 9 +++------ sources | 4 ++-- 2 files changed, 5 insertions(+), 8 deletions(-) diff --git a/bind9-next.spec b/bind9-next.spec index 96bd47e..bb62fba 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -55,7 +55,7 @@ Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv Name: bind9-next License: MPL-2.0 AND ISC AND BSD-3-clause AND MIT AND BSD-2-clause # -Version: 9.21.20 +Version: 9.21.21 Release: %autorelease Epoch: 32 Url: https://www.isc.org/downloads/bind/ @@ -123,6 +123,7 @@ BuildRequires: pkgconfig(libedit) BuildRequires: dns-root-data # Compress the changelog BuildRequires: gzip +BuildRequires: pkgconfig(lmdb) %if %{with JEMALLOC} BuildRequires: jemalloc-devel %endif @@ -152,6 +153,7 @@ BuildRequires: perl(English) BuildRequires: python3-pytest BuildRequires: python3-pytest-xdist BuildRequires: python3-dns +BuildRequires: python3-hypothesis # manual configuration requires this tool BuildRequires: iproute BuildRequires: python3-jinja2 @@ -369,11 +371,6 @@ export LIBDIR_SUFFIX %if %{with GSSTSIG} -Dgssapi=enabled \ %endif -%if %{with LMDB} - -Dlmdb=enabled \ -%else - -Dlmdb=disabled \ -%endif %if %{with JSON} -Dstats-json=enabled \ %endif diff --git a/sources b/sources index fa2afc0..4641049 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.21.20.tar.xz) = 4bd65612ff851720eba7f88495d51eb8a41b6a946c377b9dcd62f58f8c5a3e9338af44abc9df76b2ead9461eca4eb81f088619e3cc481f35fa0fc5d0926a93e3 -SHA512 (bind-9.21.20.tar.xz.asc) = 7431540d942fe23222b2812f9d80e67d0fa38516f9d536095a6544b156dc0306aba5752ba6c03cc2935d92a74860e70e8fc53b4cb481b8afe226e49dd51f695f +SHA512 (bind-9.21.21.tar.xz) = ebb05d1141d38bd1897bb0de1475194ca6e9335e1a295ab388376d880de1a0569279b734433f469565eccdea91cc8e6e3603b2879be700bf27082ff075bdbe49 +SHA512 (bind-9.21.21.tar.xz.asc) = bad3fa0355742b57bc711c2f3f6bddd220bf5a5d4f5fa3b3ef9f2172247f184e637688080b0fc8cc67d37e1ee41bf484062f3a529d9942454b243a46091761b3 From 3fb06e6ad0706bffa43db6c9037cd7f7159c62e4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Wed, 8 Apr 2026 14:54:35 +0200 Subject: [PATCH 12/21] Remove LMDB conditional builds LMDB is now required, no conditional will help. Remove always present condition. --- bind9-next.spec | 14 ++------------ 1 file changed, 2 insertions(+), 12 deletions(-) diff --git a/bind9-next.spec b/bind9-next.spec index bb62fba..2562b0b 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -17,7 +17,6 @@ # Do not set CI environment, include more unit tests, even less stable %bcond_with UNITTEST_ALL %bcond_without DNSTAP -%bcond_without LMDB %bcond_without DOC %bcond_with TSAN %bcond_without DTRACE @@ -157,6 +156,7 @@ BuildRequires: python3-hypothesis # manual configuration requires this tool BuildRequires: iproute BuildRequires: python3-jinja2 +BuildRequires: lmdb-devel %if %{with SUDO} BuildRequires: libcap sudo %endif @@ -164,9 +164,6 @@ BuildRequires: libcap sudo %if %{with GSSTSIG} BuildRequires: krb5-devel %endif -%if %{with LMDB} -BuildRequires: lmdb-devel -%endif %if %{with JSON} BuildRequires: json-c-devel %endif @@ -251,13 +248,11 @@ Obsoletes: %{name}-lite-devel < 32:9.16.6-3 Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release} Requires: openssl-devel%{?_isa} libxml2-devel%{?_isa} Requires: libcap-devel%{?_isa} +Requires: lmdb-devel%{?_isa} %upname_compat %{upname}-devel %if %{with GSSTSIG} Requires: krb5-devel%{?_isa} %endif -%if %{with LMDB} -Requires: lmdb-devel%{?_isa} -%endif %if %{with JSON} Requires: json-c-devel%{?_isa} %endif @@ -558,9 +553,6 @@ find ${RPM_BUILD_ROOT}/%{_libdir} -name '*.la' -exec '/bin/rm' '-f' '{}' ';'; %if %{without DNSTAP} rm -f ${RPM_BUILD_ROOT}%{_mandir}/man1/dnstap-read.1* || true %endif -%if %{without LMDB} -rm -f ${RPM_BUILD_ROOT}%{_mandir}/man8/named-nzd2nzf.8* || true -%endif pushd ${RPM_BUILD_ROOT}%{_mandir}/man8 ln -s ddns-confgen.8.gz tsig-keygen.8.gz @@ -814,10 +806,8 @@ fi; %{_bindir}/dnstap-read %{_mandir}/man1/dnstap-read.1* %endif -%if %{with LMDB} %{_bindir}/named-nzd2nzf %{_mandir}/man1/named-nzd2nzf.1* -%endif %{_mandir}/man1/host.1* %{_mandir}/man1/nsupdate.1* %{_mandir}/man1/dig.1* From 33dbe7720fb0490e581b0a623a8486075db2821b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Thu, 9 Apr 2026 11:52:10 +0200 Subject: [PATCH 13/21] Switch devel libraries to pkgconfig dependencies Should be more portable across different distributions. --- bind9-next.spec | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/bind9-next.spec b/bind9-next.spec index 2562b0b..6b06eda 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -109,33 +109,33 @@ BuildRequires: libtool BuildRequires: meson >= 1.3.0 BuildRequires: ninja-build BuildRequires: pkgconfig -BuildRequires: libcap-devel -BuildRequires: libidn2-devel -BuildRequires: libxml2-devel +BuildRequires: pkgconfig(libcap) +BuildRequires: pkgconfig(libidn2) +BuildRequires: pkgconfig(libxml-2.0) BuildRequires: systemd-rpm-macros BuildRequires: selinux-policy BuildRequires: findutils BuildRequires: sed -BuildRequires: libnghttp2-devel -BuildRequires: userspace-rcu-devel +BuildRequires: pkgconfig(libnghttp2) +BuildRequires: pkgconfig(liburcu) BuildRequires: pkgconfig(libedit) BuildRequires: dns-root-data # Compress the changelog BuildRequires: gzip BuildRequires: pkgconfig(lmdb) %if %{with JEMALLOC} -BuildRequires: jemalloc-devel +BuildRequires: pkgconfig(jemalloc) %endif %if ! 0%{?rhel} BuildRequires: gpgverify %endif -BuildRequires: libuv-devel +BuildRequires: pkgconfig(libuv) %if %{with OPENSSL_ENGINE} BuildRequires: openssl-devel-engine %endif %if %{with UNITTEST} # make unit dependencies -BuildRequires: libcmocka-devel +BuildRequires: pkgconfig(cmocka) # Ensure we have lscpu BuildRequires: util-linux # Catch failing unittests coredumps @@ -246,7 +246,8 @@ Summary: Header files and libraries needed for bind-dyndb-ldap Provides: %{name}-lite-devel = %{epoch}:%{version}-%{release} Obsoletes: %{name}-lite-devel < 32:9.16.6-3 Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release} -Requires: openssl-devel%{?_isa} libxml2-devel%{?_isa} +Requires: openssl-devel%{?_isa} +Requires: libxml2-devel%{?_isa} Requires: libcap-devel%{?_isa} Requires: lmdb-devel%{?_isa} %upname_compat %{upname}-devel From e1d95fa29846dece9befcf2f4ad8543034d08c94 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Thu, 9 Apr 2026 11:52:58 +0200 Subject: [PATCH 14/21] Fix failing unittest on 32 bits --- bind-9.21-unittest-32b-mem.patch | 94 ++++++++++++++++++++++++++++++++ bind9-next.spec | 2 + 2 files changed, 96 insertions(+) create mode 100644 bind-9.21-unittest-32b-mem.patch diff --git a/bind-9.21-unittest-32b-mem.patch b/bind-9.21-unittest-32b-mem.patch new file mode 100644 index 0000000..ba968d8 --- /dev/null +++ b/bind-9.21-unittest-32b-mem.patch @@ -0,0 +1,94 @@ +From 0ec3954222bab0c7a74b379fc1982c55f89a90e4 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= +Date: Thu, 9 Apr 2026 10:51:57 +0200 +Subject: [PATCH] Accept significantly lower memory consumption on 32b system +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Memory usage might be significantly lower on legacy platforms. Allow +testing of them and pass there. Move repeated checks to shared +functions, include phase in minimal range to simplify identification of +failed place. + +Signed-off-by: Petr Menšík +--- + tests/dns/deleg_test.c | 27 +++++++++++++++++++++------ + 1 file changed, 21 insertions(+), 6 deletions(-) + +diff --git a/tests/dns/deleg_test.c b/tests/dns/deleg_test.c +index 904eaeef00..cc4772977f 100644 +--- a/tests/dns/deleg_test.c ++++ b/tests/dns/deleg_test.c +@@ -567,6 +567,22 @@ typedef struct { + isc_stdtime_t now; + } cleanup_ctx_t; + ++static void cleanuptests_memcheck1(isc_mem_t *mctx, unsigned int phase) { ++ size_t inuse = isc_mem_inuse(mctx); ++ if (sizeof(void *) == 4) ++ assert_int_in_range(inuse, 3100000+phase, 3300000); ++ else ++ assert_int_in_range(inuse, 4000000+phase, 4100000); ++} ++ ++static void cleanuptests_memcheck2(isc_mem_t *mctx, unsigned int phase) { ++ size_t inuse = isc_mem_inuse(mctx); ++ if (sizeof(void *) == 4) ++ assert_int_in_range(inuse, 6400000+phase, 6500000); ++ else ++ assert_int_in_range(inuse, 8000000+phase, 8100000); ++} ++ + static void + cleanuptests_phase3(void *arg) { + cleanup_ctx_t *ctx = arg; +@@ -575,7 +591,7 @@ cleanuptests_phase3(void *arg) { + dns_delegset_t *delegset = NULL; + isc_result_t result; + +- assert_int_in_range(isc_mem_inuse(db->mctx), 4000000, 4100000); ++ cleanuptests_memcheck1(db->mctx, 3); + + /* + * baz. is there, but bar. is gone, as it has been +@@ -600,7 +616,7 @@ cleanuptests_phase2(void *arg) { + dns_delegset_t *delegset = NULL; + isc_result_t result; + +- assert_int_in_range(isc_mem_inuse(db->mctx), 4000000, 4100000); ++ cleanuptests_memcheck1(db->mctx, 2); + + /* + * bar. is there +@@ -620,7 +636,7 @@ cleanuptests_phase2(void *arg) { + for (size_t i = 0; i < 99999; i++) { + addipdeleg(AF_INET6, "1111::2222", delegset, deleg); + } +- assert_int_in_range(isc_mem_inuse(db->mctx), 8000000, 8100000); ++ cleanuptests_memcheck2(db->mctx, 2); + writedb(db, "baz.", 30, &delegset, true); + deleg = NULL; + +@@ -669,8 +685,7 @@ cleanuptests(ISC_ATTR_UNUSED void *arg) { + addipdeleg(AF_INET6, "1111::2222", delegset, deleg); + } + +- assert_int_in_range(isc_mem_inuse(db->mctx), 4000000, 4100000); +- ++ cleanuptests_memcheck1(db->mctx, 1); + writedb(db, "stuff.", 10, &delegset, true); + deleg = NULL; + stdtime_now += 10; +@@ -691,7 +706,7 @@ cleanuptests(ISC_ATTR_UNUSED void *arg) { + * with DB mem context) overmem conditions will be detected, and the + * expired node will be removed + */ +- assert_int_in_range(isc_mem_inuse(db->mctx), 8000000, 8100000); ++ cleanuptests_memcheck2(db->mctx, 1); + writedb(db, "bar.", 30, &delegset, true); + deleg = NULL; + +-- +2.53.0 + diff --git a/bind9-next.spec b/bind9-next.spec index 6b06eda..aaac824 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -89,6 +89,8 @@ Patch1: bind-9.16-redhat_doc.patch # https://gitlab.isc.org/isc-projects/bind9/-/issues/5328 # avoid often fails on i386, unsupported upstream Patch4: bind-9.21-unittest-qpdb-i386.patch +# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/11825 +Patch5: bind-9.21-unittest-32b-mem.patch %{?systemd_ordering} Requires: coreutils From cd2cf2d5762b95546c8b3b31427edd9be026df26 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Thu, 30 Apr 2026 19:05:23 +0200 Subject: [PATCH 15/21] Stop publishing rwtab.d/named It is not used for anything interesting anymore. Stop providing it. --- bind9-next.spec | 5 ----- named.rwtab | 6 ------ 2 files changed, 11 deletions(-) delete mode 100644 named.rwtab diff --git a/bind9-next.spec b/bind9-next.spec index aaac824..0696d42 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -77,7 +77,6 @@ Source37: named.service Source38: named-chroot.service Source41: setup-named-chroot.sh Source42: generate-rndc-key.sh -Source43: named.rwtab Source44: named-chroot-setup.service Source46: named-setup-rndc.service Source48: setup-named-softhsm.sh @@ -622,9 +621,6 @@ done mkdir -p ${RPM_BUILD_ROOT}%{_tmpfilesdir} install -m 644 %{SOURCE35} ${RPM_BUILD_ROOT}%{_tmpfilesdir}/named.conf -mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/rwtab.d -install -m 644 %{SOURCE43} ${RPM_BUILD_ROOT}%{_sysconfdir}/rwtab.d/named - install -m0644 -D bind9-next.sysusers.conf %{buildroot}%{_sysusersdir}/bind9-next.conf %post @@ -725,7 +721,6 @@ fi; %config(noreplace) %{_sysconfdir}/logrotate.d/named %{_tmpfilesdir}/named.conf %{_sysusersdir}/bind9-next.conf -%{_sysconfdir}/rwtab.d/named %{_unitdir}/named.service %{_unitdir}/named-setup-rndc.service %{_bindir}/named-journalprint diff --git a/named.rwtab b/named.rwtab deleted file mode 100644 index 2cb3a41..0000000 --- a/named.rwtab +++ /dev/null @@ -1,6 +0,0 @@ -dirs /var/named - -files /var/named/named.ca -files /var/named/named.empty -files /var/named/named.localhost -files /var/named/named.loopback From 683924bd6091ab2419c742025b7154bcc8f7633a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Wed, 29 Apr 2026 18:16:07 +0200 Subject: [PATCH 16/21] Remove unused forgotten files --- bind-9.11.12.tar.gz.asc | 16 --- bind-9.14.7.tar.gz.asc | 16 --- bind97-exportlib.patch | 226 ---------------------------------------- 3 files changed, 258 deletions(-) delete mode 100644 bind-9.11.12.tar.gz.asc delete mode 100644 bind-9.14.7.tar.gz.asc delete mode 100644 bind97-exportlib.patch diff --git a/bind-9.11.12.tar.gz.asc b/bind-9.11.12.tar.gz.asc deleted file mode 100644 index 6d7992f..0000000 --- a/bind-9.11.12.tar.gz.asc +++ /dev/null @@ -1,16 +0,0 @@ ------BEGIN PGP SIGNATURE----- - -iQIzBAABAgAdFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAl2WMooACgkQdLtrmky7 -PThv2RAAnXNLYTzXtH6ls29tRm5Hc+D6UaeqcWDNQ4BpkRVhrFxtukalGCi9mmB6 -NPJzFyXmaOW654pypCIuEgqJNFUpDtLzLzT7SUF+mhm+5plsaRSBnh4mq87l5KSp -twODAPnfCJV+HBk5RmToLEstAbGQ7xEBTyQtZoFkY+V7zEFwENKiCvWsoSWOkYR3 -zXo3sKjc83HV9ShbW/mCtbZf5L0qlbrKOAzqJfAFMhNNJi8kMbmr/Zi2sIfN+Rhv -g8HQo89Epv6r51yAdeED8idIX4rKjjcEtHrZeDmLdCcdHgSEj2sIlH92Joce6vL0 -S59A0rItIXm6fW8sz6WNpcj4tVtWYbIYjXZ4SPFNkaUrHv8cUekq+5vbI+v07Gh3 -2bhtDsDyTY5I1/AsY/EFmwkCAjUS00jZryBnuJpLB3v5JtUog4ek32yLBzPrqRBo -1876j4nlXAia8mG0OgJNWZ0gHyUPe/TgfR8fQDLmHxHHlKrJNTEwY6bLW8jzFTX1 -zk510fI1K7J9tiQgf5wcBQ2h3EBlqzDNIJDovoATzLYIf0HKyVegh/vnQdtdEhUR -1DzJAt3bsBfAP1AFfWPD/ACu5Zdm7SxY1wE/pjkwttDU3sRZqOfuwNBGeolu3cVN -O9/h1zsyVeVS0ui2vu4+V4EvNitmXsVbG2doDq9L5yBiIKGO2Ew= -=GCy6 ------END PGP SIGNATURE----- diff --git a/bind-9.14.7.tar.gz.asc b/bind-9.14.7.tar.gz.asc deleted file mode 100644 index 1134ae1..0000000 --- a/bind-9.14.7.tar.gz.asc +++ /dev/null @@ -1,16 +0,0 @@ ------BEGIN PGP SIGNATURE----- - -iQIzBAABAgAdFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAl2WMpEACgkQdLtrmky7 -PTh/sg//QbNRAQvADQfwF1PPo+JxB+3WzQ9oJAWeHbOoiubwkUwO9xE+BEnTNd5o -oM1lSLqFxNykOTaoeJlqPftPod1cxo7lSzkwflugGyB/59wliCpqCg053YV4x9mO -QggvA/E50+0FI/Om/7v4GHGADu/JE83FovOueWAB0LgqfDSD6QFcNFF9sUJJ4P7r -FcEXSWj8QbrHMWBKncZUOpD2ECotvtrYmi0DTHl1XfigESDQpWtsnTFuabCCsvkh -ch9wQRplAes2Mf/aS5tl1y0QKKBFuEjtGiTdgrDl6o9GLnx6CueX5saZehu2EVkr -fq2vEYUC2lRQSjuxSMMJ3L0TGUcl7+ixlAIISS2K9L5Xx7MhBXt/EH5KiKPfsEet -3EH+DhxV5uXjDU7MgvREnxT+ssV23e0HWTz4tVVQ9LpvYmWPIgLcSOhHCc57yoQF -c46V0f69dMWbMAlQ93EZSG274ZvpIszpK8+3hGI3/TuDFFgiQJeJJBFVtYJMle69 -3mEEclfzO7fBiXZFec6nVx2309bL64bafN7zszPKXl4XgoefOfD0v0eWqQT4fxfm -dnGC0qMqSZs5F+d0fISV5JUUNYzt9PZjvnzqLLGOeTF6l3/n9G1mmNsXcxJ1OEIF -6qh1oO7JTPjt0MFhKac4QjNQi/Bnp25O3I/PRyWZCbiwXkyvyQU= -=ZT7s ------END PGP SIGNATURE----- diff --git a/bind97-exportlib.patch b/bind97-exportlib.patch deleted file mode 100644 index 4468ef5..0000000 --- a/bind97-exportlib.patch +++ /dev/null @@ -1,226 +0,0 @@ -diff -up bind-9.9.3rc2/isc-config.sh.in.exportlib bind-9.9.3rc2/isc-config.sh.in -diff -up bind-9.9.3rc2/lib/export/dns/Makefile.in.exportlib bind-9.9.3rc2/lib/export/dns/Makefile.in ---- bind-9.9.3rc2/lib/export/dns/Makefile.in.exportlib 2013-04-30 08:38:46.000000000 +0200 -+++ bind-9.9.3rc2/lib/export/dns/Makefile.in 2013-05-13 10:45:22.574089729 +0200 -@@ -35,9 +35,9 @@ CDEFINES = -DUSE_MD5 @USE_OPENSSL@ @USE_ - - CWARNINGS = - --ISCLIBS = ../isc/libisc.@A@ -+ISCLIBS = ../isc/libisc-export.@A@ - --ISCDEPLIBS = ../isc/libisc.@A@ -+ISCDEPLIBS = ../isc/libisc-export.@A@ - - LIBS = @LIBS@ - -@@ -116,29 +116,29 @@ version.@O@: ${srcdir}/version.c - -DLIBAGE=${LIBAGE} \ - -c ${srcdir}/version.c - --libdns.@SA@: ${OBJS} -+libdns-export.@SA@: ${OBJS} - ${AR} ${ARFLAGS} $@ ${OBJS} - ${RANLIB} $@ - --libdns.la: ${OBJS} -+libdns-export.la: ${OBJS} - ${LIBTOOL_MODE_LINK} \ -- ${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libdns.la \ -+ ${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libdns-export.la \ - -rpath ${export_libdir} \ - -version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \ - ${OBJS} ${ISCLIBS} @DNS_CRYPTO_LIBS@ ${LIBS} - --timestamp: libdns.@A@ -+timestamp: libdns-export.@A@ - touch timestamp - - installdirs: - $(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${export_libdir} - - install:: timestamp installdirs -- ${LIBTOOL_MODE_INSTALL} ${INSTALL_DATA} libdns.@A@ \ -+ ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} libdns-export.@A@ \ - ${DESTDIR}${export_libdir}/ - - clean distclean:: -- rm -f libdns.@A@ timestamp -+ rm -f libdns-export.@A@ timestamp - rm -f gen code.h include/dns/enumtype.h include/dns/enumclass.h - rm -f include/dns/rdatastruct.h - -diff -up bind-9.9.3rc2/lib/export/irs/Makefile.in.exportlib bind-9.9.3rc2/lib/export/irs/Makefile.in ---- bind-9.9.3rc2/lib/export/irs/Makefile.in.exportlib 2013-04-30 08:38:46.000000000 +0200 -+++ bind-9.9.3rc2/lib/export/irs/Makefile.in 2013-05-13 10:45:22.575089729 +0200 -@@ -43,9 +43,9 @@ SRCS = context.c \ - gai_sterror.c getaddrinfo.c getnameinfo.c \ - resconf.c - --ISCLIBS = ../isc/libisc.@A@ --DNSLIBS = ../dns/libdns.@A@ --ISCCFGLIBS = ../isccfg/libisccfg.@A@ -+ISCLIBS = ../isc/libisc-export.@A@ -+DNSLIBS = ../dns/libdns-export.@A@ -+ISCCFGLIBS = ../isccfg/libisccfg-export.@A@ - - LIBS = @LIBS@ - -@@ -62,26 +62,26 @@ version.@O@: ${srcdir}/version.c - -DLIBAGE=${LIBAGE} \ - -c ${srcdir}/version.c - --libirs.@SA@: ${OBJS} version.@O@ -+libirs-export.@SA@: ${OBJS} version.@O@ - ${AR} ${ARFLAGS} $@ ${OBJS} version.@O@ - ${RANLIB} $@ - --libirs.la: ${OBJS} version.@O@ -+libirs-export.la: ${OBJS} version.@O@ - ${LIBTOOL_MODE_LINK} \ -- ${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libirs.la \ -+ ${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libirs-export.la \ - -rpath ${export_libdir} \ - -version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \ - ${OBJS} version.@O@ ${LIBS} ${ISCCFGLIBS} ${DNSLIBS} ${ISCLIBS} - --timestamp: libirs.@A@ -+timestamp: libirs-export.@A@ - touch timestamp - - installdirs: - $(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${export_libdir} - - install:: timestamp installdirs -- ${LIBTOOL_MODE_INSTALL} ${INSTALL_DATA} libirs.@A@ \ -+ ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} libirs-export.@A@ \ - ${DESTDIR}${export_libdir}/ - - clean distclean:: -- rm -f libirs.@A@ libirs.la timestamp -+ rm -f libirs-export.@A@ libirs-export.la timestamp -diff -up bind-9.9.3rc2/lib/export/isccfg/Makefile.in.exportlib bind-9.9.3rc2/lib/export/isccfg/Makefile.in ---- bind-9.9.3rc2/lib/export/isccfg/Makefile.in.exportlib 2013-04-30 08:38:46.000000000 +0200 -+++ bind-9.9.3rc2/lib/export/isccfg/Makefile.in 2013-05-13 10:45:22.576089729 +0200 -@@ -30,11 +30,11 @@ CINCLUDES = -I. ${DNS_INCLUDES} -I${expo - CDEFINES = - CWARNINGS = - --ISCLIBS = ../isc/libisc.@A@ --DNSLIBS = ../dns/libdns.@A@ @DNS_CRYPTO_LIBS@ -+ISCLIBS = ../isc/libisc-export.@A@ -+DNSLIBS = ../dns/libdns-export.@A@ @DNS_CRYPTO_LIBS@ - - ISCDEPLIBS = ../../lib/isc/libisc.@A@ --ISCCFGDEPLIBS = libisccfg.@A@ -+ISCCFGDEPLIBS = libisccfg-export.@A@ - - LIBS = @LIBS@ - -@@ -58,26 +58,26 @@ version.@O@: ${srcdir}/version.c - -DLIBAGE=${LIBAGE} \ - -c ${srcdir}/version.c - --libisccfg.@SA@: ${OBJS} -+libisccfg-export.@SA@: ${OBJS} - ${AR} ${ARFLAGS} $@ ${OBJS} - ${RANLIB} $@ - --libisccfg.la: ${OBJS} -+libisccfg-export.la: ${OBJS} - ${LIBTOOL_MODE_LINK} \ -- ${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisccfg.la \ -+ ${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisccfg-export.la \ - -rpath ${export_libdir} \ - -version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \ - ${OBJS} ${LIBS} ${DNSLIBS} ${ISCLIBS} - --timestamp: libisccfg.@A@ -+timestamp: libisccfg-export.@A@ - touch timestamp - - installdirs: - $(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${export_libdir} - - install:: timestamp installdirs -- ${LIBTOOL_MODE_INSTALL} ${INSTALL_DATA} libisccfg.@A@ \ -+ ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} libisccfg-export.@A@ \ - ${DESTDIR}${export_libdir}/ - - clean distclean:: -- rm -f libisccfg.@A@ timestamp -+ rm -f libisccfg-export.@A@ timestamp -diff -up bind-9.9.3rc2/lib/export/isc/Makefile.in.exportlib bind-9.9.3rc2/lib/export/isc/Makefile.in ---- bind-9.9.3rc2/lib/export/isc/Makefile.in.exportlib 2013-04-30 08:38:46.000000000 +0200 -+++ bind-9.9.3rc2/lib/export/isc/Makefile.in 2013-05-13 10:45:22.576089729 +0200 -@@ -100,6 +100,10 @@ SRCS = @ISC_EXTRA_SRCS@ \ - - LIBS = @LIBS@ - -+# Note: the order of SUBDIRS is important. -+# Attempt to disable parallel processing. -+.NOTPARALLEL: -+.NO_PARALLEL: - SUBDIRS = include unix nls @ISC_THREAD_DIR@ - TARGETS = timestamp - -@@ -113,26 +117,26 @@ version.@O@: ${srcdir}/version.c - -DLIBAGE=${LIBAGE} \ - -c ${srcdir}/version.c - --libisc.@SA@: ${OBJS} -+libisc-export.@SA@: ${OBJS} - ${AR} ${ARFLAGS} $@ ${OBJS} - ${RANLIB} $@ - --libisc.la: ${OBJS} -+libisc-export.la: ${OBJS} - ${LIBTOOL_MODE_LINK} \ -- ${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisc.la \ -+ ${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisc-export.la \ - -rpath ${export_libdir} \ - -version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \ - ${OBJS} ${LIBS} - --timestamp: libisc.@A@ -+timestamp: libisc-export.@A@ - touch timestamp - - installdirs: - $(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${export_libdir} - - install:: timestamp installdirs -- ${LIBTOOL_MODE_INSTALL} ${INSTALL_DATA} libisc.@A@ \ -+ ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} libisc-export.@A@ \ - ${DESTDIR}${export_libdir} - - clean distclean:: -- rm -f libisc.@A@ libisc.la timestamp -+ rm -f libisc-export.@A@ libisc-export.la timestamp -diff -up bind-9.9.3rc2/lib/export/samples/Makefile.in.exportlib bind-9.9.3rc2/lib/export/samples/Makefile.in ---- bind-9.9.3rc2/lib/export/samples/Makefile.in.exportlib 2013-04-30 08:38:46.000000000 +0200 -+++ bind-9.9.3rc2/lib/export/samples/Makefile.in 2013-05-13 10:45:22.577089729 +0200 -@@ -31,15 +31,15 @@ CINCLUDES = -I${srcdir}/include -I../dns - CDEFINES = - CWARNINGS = - --DNSLIBS = ../dns/libdns.@A@ @DNS_CRYPTO_LIBS@ --ISCLIBS = ../isc/libisc.@A@ --ISCCFGLIBS = ../isccfg/libisccfg.@A@ --IRSLIBS = ../irs/libirs.@A@ -+DNSLIBS = ../dns/libdns-export.@A@ @DNS_CRYPTO_LIBS@ -+ISCLIBS = ../isc/libisc-export.@A@ -+ISCCFGLIBS = ../isccfg/libisccfg-export.@A@ -+IRSLIBS = ../irs/libirs-export.@A@ - --DNSDEPLIBS = ../dns/libdns.@A@ --ISCDEPLIBS = ../isc/libisc.@A@ --ISCCFGDEPLIBS = ../isccfg/libisccfg.@A@ --IRSDEPLIBS = ../irs/libirs.@A@ -+DNSDEPLIBS = ../dns/libdns-export.@A@ -+ISCDEPLIBS = ../isc/libisc-export.@A@ -+ISCCFGDEPLIBS = ../isccfg/libisccfg-export.@A@ -+IRSDEPLIBS = ../irs/libirs-export.@A@ - - DEPLIBS = ${DNSDEPLIBS} ${ISCCFGDEPLIBS} ${ISCDEPLIBS} - From 4f4bfde477ee9f5686374bd72be0a782913421dc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Tue, 5 May 2026 12:23:31 +0200 Subject: [PATCH 17/21] Fix build with openssl4 (rhbz#2463851) Use upstream way to fix problem with openssl 4.0. That is removing whole openssl crypto tracking. --- bind-9.21-openssl4-malloc.patch | 150 ++++++++++++++++++++++++++++++++ bind9-next.spec | 2 + 2 files changed, 152 insertions(+) create mode 100644 bind-9.21-openssl4-malloc.patch diff --git a/bind-9.21-openssl4-malloc.patch b/bind-9.21-openssl4-malloc.patch new file mode 100644 index 0000000..693cad4 --- /dev/null +++ b/bind-9.21-openssl4-malloc.patch @@ -0,0 +1,150 @@ +From c4b7f67b7d79150007412e370de3c21cc80057d6 Mon Sep 17 00:00:00 2001 +From: Aram Sargsyan +Date: Thu, 16 Apr 2026 17:31:04 +0000 +Subject: [PATCH] Remove OpenSSL memory tracking support from the ossl3.c + module + +OPENSSL_cleanup() in OpenSSL 4 doesn't free the memory, and that is +not compatible with BIND 9's memory leak detection code. Don't use +custom allocation/deallocation functions for OpenSSL's internal memory +management in the ossl3.c module. + +See https://github.com/openssl/openssl/pull/29721 + +(cherry picked from commit 4ede6edc547109af81dc5c5ec25cf3ff7991bc10) +--- + lib/isc/crypto/ossl3.c | 90 +++++------------------------------------- + 1 file changed, 9 insertions(+), 81 deletions(-) + +diff --git a/lib/isc/crypto/ossl3.c b/lib/isc/crypto/ossl3.c +index 1c2f3cab9d..35344dc8b1 100644 +--- a/lib/isc/crypto/ossl3.c ++++ b/lib/isc/crypto/ossl3.c +@@ -44,8 +44,6 @@ struct isc_hmac_key { + + constexpr uint32_t hmac_key_magic = ISC_MAGIC('H', 'M', 'A', 'C'); + +-static isc_mem_t *isc__crypto_mctx = NULL; +- + static OSSL_PROVIDER *base = NULL, *fips = NULL; + + static EVP_MAC *evp_hmac = NULL; +@@ -320,69 +318,6 @@ isc_hmac_final(isc_hmac_t *hmac, isc_buffer_t *out) { + return ISC_R_SUCCESS; + } + +-#if ISC_MEM_TRACKLINES +-/* +- * We use the internal isc__mem API here, so we can pass the file and line +- * arguments passed from OpenSSL >= 1.1.0 to our memory functions for better +- * tracking of the OpenSSL allocations. Without this, we would always just see +- * isc__crypto_{malloc,realloc,free} in the tracking output, but with this in +- * place we get to see the places in the OpenSSL code where the allocations +- * happen. +- */ +- +-static void * +-isc__crypto_malloc_ex(size_t size, const char *file, int line) { +- return isc__mem_allocate(isc__crypto_mctx, size, 0, __func__, file, +- (unsigned int)line); +-} +- +-static void * +-isc__crypto_realloc_ex(void *ptr, size_t size, const char *file, int line) { +- return isc__mem_reallocate(isc__crypto_mctx, ptr, size, 0, __func__, +- file, (unsigned int)line); +-} +- +-static void +-isc__crypto_free_ex(void *ptr, const char *file, int line) { +- if (ptr == NULL) { +- return; +- } +- if (isc__crypto_mctx != NULL) { +- isc__mem_free(isc__crypto_mctx, ptr, 0, __func__, file, +- (unsigned int)line); +- } +-} +- +-#else /* ISC_MEM_TRACKLINES */ +- +-static void * +-isc__crypto_malloc_ex(size_t size, const char *file, int line) { +- UNUSED(file); +- UNUSED(line); +- return isc_mem_allocate(isc__crypto_mctx, size); +-} +- +-static void * +-isc__crypto_realloc_ex(void *ptr, size_t size, const char *file, int line) { +- UNUSED(file); +- UNUSED(line); +- return isc_mem_reallocate(isc__crypto_mctx, ptr, size); +-} +- +-static void +-isc__crypto_free_ex(void *ptr, const char *file, int line) { +- UNUSED(file); +- UNUSED(line); +- if (ptr == NULL) { +- return; +- } +- if (isc__crypto_mctx != NULL) { +- isc__mem_free(isc__crypto_mctx, ptr, 0); +- } +-} +- +-#endif /* ISC_MEM_TRACKLINES */ +- + bool + isc_crypto_fips_mode(void) { + return EVP_default_properties_is_fips_enabled(NULL) != 0; +@@ -424,9 +359,17 @@ isc_crypto_fips_enable(void) { + return ISC_R_SUCCESS; + } + ++/* ++ * OPENSSL_cleanup() in OpenSSL 4 doesn't free the memory, which is not ++ * compatible with BIND 9's memory leak detection code, that is why the memory ++ * tracking has been disabled in this module, and this function is a no-op. ++ * This can be cleaned up once OpenSSL 1.1.x support is removed. ++ * ++ * See https://github.com/openssl/openssl/pull/29721 ++ */ + void + isc__crypto_setdestroycheck(bool check) { +- isc_mem_setdestroycheck(isc__crypto_mctx, check); ++ UNUSED(check); + } + + void +@@ -437,19 +380,6 @@ isc__crypto_initialize(void) { + */ + uint64_t opts = OPENSSL_INIT_LOAD_CONFIG | OPENSSL_INIT_NO_ATEXIT; + +- isc_mem_create("OpenSSL", &isc__crypto_mctx); +- isc_mem_setdebugging(isc__crypto_mctx, 0); +- isc_mem_setdestroycheck(isc__crypto_mctx, false); +- +- /* +- * CRYPTO_set_mem_(_ex)_functions() returns 1 on success or 0 on +- * failure, which means OpenSSL already allocated some memory. There's +- * nothing we can do about it. +- */ +- (void)CRYPTO_set_mem_functions(isc__crypto_malloc_ex, +- isc__crypto_realloc_ex, +- isc__crypto_free_ex); +- + RUNTIME_CHECK(OPENSSL_init_ssl(opts, NULL) == 1); + + register_algorithms(); +@@ -486,6 +416,4 @@ isc__crypto_shutdown(void) { + } + + OPENSSL_cleanup(); +- +- isc_mem_detach(&isc__crypto_mctx); + } +-- +2.54.0 + diff --git a/bind9-next.spec b/bind9-next.spec index 0696d42..c7343da 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -90,6 +90,8 @@ Patch1: bind-9.16-redhat_doc.patch Patch4: bind-9.21-unittest-qpdb-i386.patch # https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/11825 Patch5: bind-9.21-unittest-32b-mem.patch +# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/11865 +Patch6: bind-9.21-openssl4-malloc.patch %{?systemd_ordering} Requires: coreutils From 7ec75a1e1cf5c78d7fbddc15e415d63e0cfde575 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Wed, 3 Jun 2026 12:05:47 +0200 Subject: [PATCH 18/21] Update to 9.21.22 (rhbz#2480122) Security Fixes: - Limit resolver server list size. (CVE-2026-3592) - Fix GSS-API resource leak. (CVE-2026-3039) - Disable recursion, UPDATE, and NOTIFY for non-IN views. (CVE-2026-5946) - Avoid unbounded recursion loop. (CVE-2026-5950) - Fix crash in resolver when SIG(0)-signed responses are received under load. (CVE-2026-5947) - Fix use-after-free error in DNS-over-HTTPS when processing HTTP/2 SETTINGS frames. (CVE-2026-3593) - Fix outgoing zone transfers' quota issue. Feature Changes: - Fix CPU spikes and slow queries when cache approaches memory limit. - Implement RFC 3645 Section 4.1.1 key expiry check in TKEY. - Reduce memory footprint by actively returning unused memory to the OS. An multiple bugfixes. Source: https://downloads.isc.org/isc/bind9/9.21.22/doc/arm/html/notes.html#notes-for-bind-9-21-22 --- bind-9.21-openssl4-malloc.patch | 150 ------------------------------- bind-9.21-unittest-32b-mem.patch | 20 ++--- bind9-next.spec | 4 +- sources | 4 +- 4 files changed, 13 insertions(+), 165 deletions(-) delete mode 100644 bind-9.21-openssl4-malloc.patch diff --git a/bind-9.21-openssl4-malloc.patch b/bind-9.21-openssl4-malloc.patch deleted file mode 100644 index 693cad4..0000000 --- a/bind-9.21-openssl4-malloc.patch +++ /dev/null @@ -1,150 +0,0 @@ -From c4b7f67b7d79150007412e370de3c21cc80057d6 Mon Sep 17 00:00:00 2001 -From: Aram Sargsyan -Date: Thu, 16 Apr 2026 17:31:04 +0000 -Subject: [PATCH] Remove OpenSSL memory tracking support from the ossl3.c - module - -OPENSSL_cleanup() in OpenSSL 4 doesn't free the memory, and that is -not compatible with BIND 9's memory leak detection code. Don't use -custom allocation/deallocation functions for OpenSSL's internal memory -management in the ossl3.c module. - -See https://github.com/openssl/openssl/pull/29721 - -(cherry picked from commit 4ede6edc547109af81dc5c5ec25cf3ff7991bc10) ---- - lib/isc/crypto/ossl3.c | 90 +++++------------------------------------- - 1 file changed, 9 insertions(+), 81 deletions(-) - -diff --git a/lib/isc/crypto/ossl3.c b/lib/isc/crypto/ossl3.c -index 1c2f3cab9d..35344dc8b1 100644 ---- a/lib/isc/crypto/ossl3.c -+++ b/lib/isc/crypto/ossl3.c -@@ -44,8 +44,6 @@ struct isc_hmac_key { - - constexpr uint32_t hmac_key_magic = ISC_MAGIC('H', 'M', 'A', 'C'); - --static isc_mem_t *isc__crypto_mctx = NULL; -- - static OSSL_PROVIDER *base = NULL, *fips = NULL; - - static EVP_MAC *evp_hmac = NULL; -@@ -320,69 +318,6 @@ isc_hmac_final(isc_hmac_t *hmac, isc_buffer_t *out) { - return ISC_R_SUCCESS; - } - --#if ISC_MEM_TRACKLINES --/* -- * We use the internal isc__mem API here, so we can pass the file and line -- * arguments passed from OpenSSL >= 1.1.0 to our memory functions for better -- * tracking of the OpenSSL allocations. Without this, we would always just see -- * isc__crypto_{malloc,realloc,free} in the tracking output, but with this in -- * place we get to see the places in the OpenSSL code where the allocations -- * happen. -- */ -- --static void * --isc__crypto_malloc_ex(size_t size, const char *file, int line) { -- return isc__mem_allocate(isc__crypto_mctx, size, 0, __func__, file, -- (unsigned int)line); --} -- --static void * --isc__crypto_realloc_ex(void *ptr, size_t size, const char *file, int line) { -- return isc__mem_reallocate(isc__crypto_mctx, ptr, size, 0, __func__, -- file, (unsigned int)line); --} -- --static void --isc__crypto_free_ex(void *ptr, const char *file, int line) { -- if (ptr == NULL) { -- return; -- } -- if (isc__crypto_mctx != NULL) { -- isc__mem_free(isc__crypto_mctx, ptr, 0, __func__, file, -- (unsigned int)line); -- } --} -- --#else /* ISC_MEM_TRACKLINES */ -- --static void * --isc__crypto_malloc_ex(size_t size, const char *file, int line) { -- UNUSED(file); -- UNUSED(line); -- return isc_mem_allocate(isc__crypto_mctx, size); --} -- --static void * --isc__crypto_realloc_ex(void *ptr, size_t size, const char *file, int line) { -- UNUSED(file); -- UNUSED(line); -- return isc_mem_reallocate(isc__crypto_mctx, ptr, size); --} -- --static void --isc__crypto_free_ex(void *ptr, const char *file, int line) { -- UNUSED(file); -- UNUSED(line); -- if (ptr == NULL) { -- return; -- } -- if (isc__crypto_mctx != NULL) { -- isc__mem_free(isc__crypto_mctx, ptr, 0); -- } --} -- --#endif /* ISC_MEM_TRACKLINES */ -- - bool - isc_crypto_fips_mode(void) { - return EVP_default_properties_is_fips_enabled(NULL) != 0; -@@ -424,9 +359,17 @@ isc_crypto_fips_enable(void) { - return ISC_R_SUCCESS; - } - -+/* -+ * OPENSSL_cleanup() in OpenSSL 4 doesn't free the memory, which is not -+ * compatible with BIND 9's memory leak detection code, that is why the memory -+ * tracking has been disabled in this module, and this function is a no-op. -+ * This can be cleaned up once OpenSSL 1.1.x support is removed. -+ * -+ * See https://github.com/openssl/openssl/pull/29721 -+ */ - void - isc__crypto_setdestroycheck(bool check) { -- isc_mem_setdestroycheck(isc__crypto_mctx, check); -+ UNUSED(check); - } - - void -@@ -437,19 +380,6 @@ isc__crypto_initialize(void) { - */ - uint64_t opts = OPENSSL_INIT_LOAD_CONFIG | OPENSSL_INIT_NO_ATEXIT; - -- isc_mem_create("OpenSSL", &isc__crypto_mctx); -- isc_mem_setdebugging(isc__crypto_mctx, 0); -- isc_mem_setdestroycheck(isc__crypto_mctx, false); -- -- /* -- * CRYPTO_set_mem_(_ex)_functions() returns 1 on success or 0 on -- * failure, which means OpenSSL already allocated some memory. There's -- * nothing we can do about it. -- */ -- (void)CRYPTO_set_mem_functions(isc__crypto_malloc_ex, -- isc__crypto_realloc_ex, -- isc__crypto_free_ex); -- - RUNTIME_CHECK(OPENSSL_init_ssl(opts, NULL) == 1); - - register_algorithms(); -@@ -486,6 +416,4 @@ isc__crypto_shutdown(void) { - } - - OPENSSL_cleanup(); -- -- isc_mem_detach(&isc__crypto_mctx); - } --- -2.54.0 - diff --git a/bind-9.21-unittest-32b-mem.patch b/bind-9.21-unittest-32b-mem.patch index ba968d8..90dee92 100644 --- a/bind-9.21-unittest-32b-mem.patch +++ b/bind-9.21-unittest-32b-mem.patch @@ -1,4 +1,4 @@ -From 0ec3954222bab0c7a74b379fc1982c55f89a90e4 Mon Sep 17 00:00:00 2001 +From e81b125a9c7eb9222b5f8298bec689e23287969b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Thu, 9 Apr 2026 10:51:57 +0200 Subject: [PATCH] Accept significantly lower memory consumption on 32b system @@ -17,10 +17,10 @@ Signed-off-by: Petr Menšík 1 file changed, 21 insertions(+), 6 deletions(-) diff --git a/tests/dns/deleg_test.c b/tests/dns/deleg_test.c -index 904eaeef00..cc4772977f 100644 +index d3af6ab..cbab065 100644 --- a/tests/dns/deleg_test.c +++ b/tests/dns/deleg_test.c -@@ -567,6 +567,22 @@ typedef struct { +@@ -579,6 +579,22 @@ typedef struct { isc_stdtime_t now; } cleanup_ctx_t; @@ -43,16 +43,16 @@ index 904eaeef00..cc4772977f 100644 static void cleanuptests_phase3(void *arg) { cleanup_ctx_t *ctx = arg; -@@ -575,7 +591,7 @@ cleanuptests_phase3(void *arg) { +@@ -587,7 +603,7 @@ cleanuptests_phase3(void *arg) { dns_delegset_t *delegset = NULL; isc_result_t result; -- assert_int_in_range(isc_mem_inuse(db->mctx), 4000000, 4100000); +- assert_int_in_range(isc_mem_inuse(db->mctx), 8000000, 8100000); + cleanuptests_memcheck1(db->mctx, 3); /* * baz. is there, but bar. is gone, as it has been -@@ -600,7 +616,7 @@ cleanuptests_phase2(void *arg) { +@@ -612,7 +628,7 @@ cleanuptests_phase2(void *arg) { dns_delegset_t *delegset = NULL; isc_result_t result; @@ -61,7 +61,7 @@ index 904eaeef00..cc4772977f 100644 /* * bar. is there -@@ -620,7 +636,7 @@ cleanuptests_phase2(void *arg) { +@@ -632,7 +648,7 @@ cleanuptests_phase2(void *arg) { for (size_t i = 0; i < 99999; i++) { addipdeleg(AF_INET6, "1111::2222", delegset, deleg); } @@ -70,7 +70,7 @@ index 904eaeef00..cc4772977f 100644 writedb(db, "baz.", 30, &delegset, true); deleg = NULL; -@@ -669,8 +685,7 @@ cleanuptests(ISC_ATTR_UNUSED void *arg) { +@@ -681,8 +697,7 @@ cleanuptests(ISC_ATTR_UNUSED void *arg) { addipdeleg(AF_INET6, "1111::2222", delegset, deleg); } @@ -80,7 +80,7 @@ index 904eaeef00..cc4772977f 100644 writedb(db, "stuff.", 10, &delegset, true); deleg = NULL; stdtime_now += 10; -@@ -691,7 +706,7 @@ cleanuptests(ISC_ATTR_UNUSED void *arg) { +@@ -703,7 +718,7 @@ cleanuptests(ISC_ATTR_UNUSED void *arg) { * with DB mem context) overmem conditions will be detected, and the * expired node will be removed */ @@ -90,5 +90,5 @@ index 904eaeef00..cc4772977f 100644 deleg = NULL; -- -2.53.0 +2.54.0 diff --git a/bind9-next.spec b/bind9-next.spec index c7343da..2dc204d 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -54,7 +54,7 @@ Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv Name: bind9-next License: MPL-2.0 AND ISC AND BSD-3-clause AND MIT AND BSD-2-clause # -Version: 9.21.21 +Version: 9.21.22 Release: %autorelease Epoch: 32 Url: https://www.isc.org/downloads/bind/ @@ -90,8 +90,6 @@ Patch1: bind-9.16-redhat_doc.patch Patch4: bind-9.21-unittest-qpdb-i386.patch # https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/11825 Patch5: bind-9.21-unittest-32b-mem.patch -# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/11865 -Patch6: bind-9.21-openssl4-malloc.patch %{?systemd_ordering} Requires: coreutils diff --git a/sources b/sources index 4641049..c97ab7f 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.21.21.tar.xz) = ebb05d1141d38bd1897bb0de1475194ca6e9335e1a295ab388376d880de1a0569279b734433f469565eccdea91cc8e6e3603b2879be700bf27082ff075bdbe49 -SHA512 (bind-9.21.21.tar.xz.asc) = bad3fa0355742b57bc711c2f3f6bddd220bf5a5d4f5fa3b3ef9f2172247f184e637688080b0fc8cc67d37e1ee41bf484062f3a529d9942454b243a46091761b3 +SHA512 (bind-9.21.22.tar.xz) = f9e11d150162661c755dabdd7862c0565e6a10077e2a6aee04f8cefce94c262d8928ff9e42f8c8750242aee3b0992afe2f49f72f0f8cab8b7e4ae1c9fc06e0fa +SHA512 (bind-9.21.22.tar.xz.asc) = 1e0bd14fad5754e12b6a4855dbed698dba74468790948316e17442e5bc840fc81d18e590fd78186a1e26e9526870b13470dcef6a15644e91775cc8883813ad24 From e6c0c1b6974349b4dd6f99d6f72c8df0659fb9b9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Wed, 3 Jun 2026 16:36:26 +0200 Subject: [PATCH 19/21] Switch downstream change to upstream for 32b mem check Downstream fix was not working anymore and upstream fix is better. --- bind-9.21-unittest-32b-mem.patch | 114 ++++++++++++++++++------------- bind9-next.spec | 2 +- 2 files changed, 67 insertions(+), 49 deletions(-) diff --git a/bind-9.21-unittest-32b-mem.patch b/bind-9.21-unittest-32b-mem.patch index 90dee92..ba4e0fd 100644 --- a/bind-9.21-unittest-32b-mem.patch +++ b/bind-9.21-unittest-32b-mem.patch @@ -1,91 +1,109 @@ -From e81b125a9c7eb9222b5f8298bec689e23287969b Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= -Date: Thu, 9 Apr 2026 10:51:57 +0200 -Subject: [PATCH] Accept significantly lower memory consumption on 32b system -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit +From 4623873e588c86c6add4d53708e754e2d6f3e087 Mon Sep 17 00:00:00 2001 +From: Michal Nowak +Date: Wed, 20 May 2026 08:59:49 +0000 +Subject: [PATCH] Make deleg cleanuptests memory assertions 32-bit-safe -Memory usage might be significantly lower on legacy platforms. Allow -testing of them and pass there. Move repeated checks to shared -functions, include phase in minimal range to simplify identification of -failed place. +Each address entry stored by dns_delegset_addaddr() is an +isc_netaddrlink_t, whose size depends on sizeof(void *) via the +ISC_LINK macro (24 bytes of address + two prev/next pointers): 40 +bytes on 64-bit, 32 bytes on 32-bit. The hardcoded 4 MB / 8 MB +ranges only held on 64-bit, so dns_deleg_cleanuptests failed on +armv7l with isc_mem_inuse() returning ~3.2 MB. -Signed-off-by: Petr Menšík +Express the expected ranges in terms of sizeof(isc_netaddrlink_t) +so they scale with pointer width, and pull the 99999 entry count +out into a NENTRIES macro. + +Assisted-by: Claude:claude-opus-4-7 --- - tests/dns/deleg_test.c | 27 +++++++++++++++++++++------ - 1 file changed, 21 insertions(+), 6 deletions(-) + tests/dns/deleg_test.c | 30 ++++++++++++++++++++++-------- + 1 file changed, 22 insertions(+), 8 deletions(-) diff --git a/tests/dns/deleg_test.c b/tests/dns/deleg_test.c -index d3af6ab..cbab065 100644 +index d3af6aba966..9497caf2753 100644 --- a/tests/dns/deleg_test.c +++ b/tests/dns/deleg_test.c -@@ -579,6 +579,22 @@ typedef struct { - isc_stdtime_t now; - } cleanup_ctx_t; +@@ -52,6 +52,15 @@ isc_stdtime_now(void) { -+static void cleanuptests_memcheck1(isc_mem_t *mctx, unsigned int phase) { -+ size_t inuse = isc_mem_inuse(mctx); -+ if (sizeof(void *) == 4) -+ assert_int_in_range(inuse, 3100000+phase, 3300000); -+ else -+ assert_int_in_range(inuse, 4000000+phase, 4100000); -+} -+ -+static void cleanuptests_memcheck2(isc_mem_t *mctx, unsigned int phase) { -+ size_t inuse = isc_mem_inuse(mctx); -+ if (sizeof(void *) == 4) -+ assert_int_in_range(inuse, 6400000+phase, 6500000); -+ else -+ assert_int_in_range(inuse, 8000000+phase, 8100000); -+} + #include + ++/* ++ * cleanuptests adds NENTRIES address entries to a delegset; each is an ++ * isc_netaddrlink_t whose size depends on sizeof(void *) via ISC_LINK. ++ * Express memory expectations in terms of that struct so the test works ++ * on both 32-bit and 64-bit targets. ++ */ ++#define NENTRIES 99999 ++#define ENTRIES_MEM(n) ((size_t)(n) * sizeof(isc_netaddrlink_t)) + static void - cleanuptests_phase3(void *arg) { - cleanup_ctx_t *ctx = arg; -@@ -587,7 +603,7 @@ cleanuptests_phase3(void *arg) { + shutdownloop(ISC_ATTR_UNUSED void *arg) { + isc_loopmgr_shutdown(); +@@ -587,7 +596,8 @@ cleanuptests_phase3(void *arg) { dns_delegset_t *delegset = NULL; isc_result_t result; - assert_int_in_range(isc_mem_inuse(db->mctx), 8000000, 8100000); -+ cleanuptests_memcheck1(db->mctx, 3); ++ assert_int_in_range(isc_mem_inuse(db->mctx), ENTRIES_MEM(2 * NENTRIES), ++ ENTRIES_MEM(2 * NENTRIES) + 100000); /* * baz. is there, but bar. is gone, as it has been -@@ -612,7 +628,7 @@ cleanuptests_phase2(void *arg) { +@@ -612,7 +622,8 @@ cleanuptests_phase2(void *arg) { dns_delegset_t *delegset = NULL; isc_result_t result; - assert_int_in_range(isc_mem_inuse(db->mctx), 4000000, 4100000); -+ cleanuptests_memcheck1(db->mctx, 2); ++ assert_int_in_range(isc_mem_inuse(db->mctx), ENTRIES_MEM(NENTRIES), ++ ENTRIES_MEM(NENTRIES) + 100000); /* * bar. is there -@@ -632,7 +648,7 @@ cleanuptests_phase2(void *arg) { - for (size_t i = 0; i < 99999; i++) { +@@ -629,10 +640,11 @@ cleanuptests_phase2(void *arg) { + dns_delegset_allocdeleg(delegset, DNS_DELEGTYPE_DELEG_ADDRESSES, + &deleg); + +- for (size_t i = 0; i < 99999; i++) { ++ for (size_t i = 0; i < NENTRIES; i++) { addipdeleg(AF_INET6, "1111::2222", delegset, deleg); } - assert_int_in_range(isc_mem_inuse(db->mctx), 8000000, 8100000); -+ cleanuptests_memcheck2(db->mctx, 2); ++ assert_int_in_range(isc_mem_inuse(db->mctx), ENTRIES_MEM(2 * NENTRIES), ++ ENTRIES_MEM(2 * NENTRIES) + 100000); writedb(db, "baz.", 30, &delegset, true); deleg = NULL; -@@ -681,8 +697,7 @@ cleanuptests(ISC_ATTR_UNUSED void *arg) { +@@ -677,11 +689,12 @@ cleanuptests(ISC_ATTR_UNUSED void *arg) { + + assert_int_in_range(isc_mem_inuse(db->mctx), 500, 2000); + +- for (size_t i = 0; i < 99999; i++) { ++ for (size_t i = 0; i < NENTRIES; i++) { addipdeleg(AF_INET6, "1111::2222", delegset, deleg); } - assert_int_in_range(isc_mem_inuse(db->mctx), 4000000, 4100000); -- -+ cleanuptests_memcheck1(db->mctx, 1); ++ assert_int_in_range(isc_mem_inuse(db->mctx), ENTRIES_MEM(NENTRIES), ++ ENTRIES_MEM(NENTRIES) + 100000); + writedb(db, "stuff.", 10, &delegset, true); deleg = NULL; - stdtime_now += 10; -@@ -703,7 +718,7 @@ cleanuptests(ISC_ATTR_UNUSED void *arg) { +@@ -694,7 +707,7 @@ cleanuptests(ISC_ATTR_UNUSED void *arg) { + dns_delegset_allocdeleg(delegset, DNS_DELEGTYPE_DELEG_ADDRESSES, + &deleg); + +- for (size_t i = 0; i < 99999; i++) { ++ for (size_t i = 0; i < NENTRIES; i++) { + addipdeleg(AF_INET6, "1111::2222", delegset, deleg); + } + +@@ -703,7 +716,8 @@ cleanuptests(ISC_ATTR_UNUSED void *arg) { * with DB mem context) overmem conditions will be detected, and the * expired node will be removed */ - assert_int_in_range(isc_mem_inuse(db->mctx), 8000000, 8100000); -+ cleanuptests_memcheck2(db->mctx, 1); ++ assert_int_in_range(isc_mem_inuse(db->mctx), ENTRIES_MEM(2 * NENTRIES), ++ ENTRIES_MEM(2 * NENTRIES) + 100000); writedb(db, "bar.", 30, &delegset, true); deleg = NULL; diff --git a/bind9-next.spec b/bind9-next.spec index 2dc204d..4939fa1 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -88,7 +88,7 @@ Patch1: bind-9.16-redhat_doc.patch # https://gitlab.isc.org/isc-projects/bind9/-/issues/5328 # avoid often fails on i386, unsupported upstream Patch4: bind-9.21-unittest-qpdb-i386.patch -# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/11825 +# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/12061 Patch5: bind-9.21-unittest-32b-mem.patch %{?systemd_ordering} From dd3ddef0d0c5480d099f3f47d6d92140406a7b23 Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Fri, 12 Jun 2026 18:19:38 -0400 Subject: [PATCH 20/21] Rebuilt for openssl 4.0 From d3d83b7ded86392d3de557a0dd090868f4523e67 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 15 Jul 2026 20:11:31 +0000 Subject: [PATCH 21/21] Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild