From b6274d5ac8eb4e2362af33bd93320829b4d087b7 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 19 Jan 2024 14:23:51 +0000 Subject: [PATCH 01/72] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From ffe5e990359aeefebcf193c4c1fb8b90a170d1a0 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Tue, 23 Jan 2024 00:23:27 +0000 Subject: [PATCH 02/72] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From 9e2712401f256d219c33382ab961cf7922c4345d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Fri, 16 Feb 2024 22:21:11 +0100 Subject: [PATCH 03/72] Update to 9.19.21 (#2264048) https://downloads.isc.org/isc/bind9/9.19.21/RELEASE-NOTES-bind-9.19.21.html Security Fixes - Validating DNS messages containing a lot of DNSSEC signatures could cause excessive CPU load, leading to a denial-of-service condition. This has been fixed. (CVE-2023-50387) ISC would like to thank Elias Heftrig, Haya Schulmann, Niklas Vogel, and Michael Waidner from the German National Research Center for Applied Cybersecurity ATHENE for bringing this vulnerability to our attention. [GL #4424] - Parsing DNS messages with many different names could cause excessive CPU load. This has been fixed. (CVE-2023-4408) ISC would like to thank Shoham Danino from Reichman University, Anat Bremler-Barr from Tel-Aviv University, Yehuda Afek from Tel-Aviv University, and Yuval Shavitt from Tel-Aviv University for bringing this vulnerability to our attention. [GL #4234] - Specific queries could cause named to crash with an assertion failure when nxdomain-redirect was enabled. This has been fixed. (CVE-2023-5517) [GL #4281] - A bad interaction between DNS64 and serve-stale could cause named to crash with an assertion failure, when both of these features were enabled. This has been fixed. (CVE-2023-5679) [GL #4334] Resolves: CVE-2023-50387 CVE-2023-4408 CVE-2023-5517 CVE-2023-5679 --- .gitignore | 2 ++ bind9-next.spec | 2 +- sources | 4 ++-- 3 files changed, 5 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 7908c20..76f5ce8 100644 --- a/.gitignore +++ b/.gitignore @@ -218,3 +218,5 @@ bind-9.7.2b1.tar.gz /bind-9.19.18.tar.xz.asc /bind-9.19.19.tar.xz /bind-9.19.19.tar.xz.asc +/bind-9.19.21.tar.xz +/bind-9.19.21.tar.xz.asc diff --git a/bind9-next.spec b/bind9-next.spec index 666db68..20f6bb3 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -52,7 +52,7 @@ Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv Name: bind9-next License: MPL-2.0 AND ISC AND BSD-3-clause AND Expat AND BSD-2-clause # -Version: 9.19.19 +Version: 9.19.21 Release: %autorelease Epoch: 32 Url: https://www.isc.org/downloads/bind/ diff --git a/sources b/sources index 0bd72f0..b02d3ed 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.19.19.tar.xz) = 51ce55bade3a9b239d0ab21d19a0870b91aba1e4c93050f89f1940d322319521631b3b0389eaf5f03e3fc110852e11549365b0efa92536bf5d835510d73c1aa6 -SHA512 (bind-9.19.19.tar.xz.asc) = 3217a33be6a885bb42ca972e57c21bfe3000b7cfeaede72aa302750ce9643d4820372f4b147e85ce97409bbc500b40d9b8bc82c12fb13c5c0a2d21fad86712f8 +SHA512 (bind-9.19.21.tar.xz) = 8a5bae4619b0093f5c81376b65a143499d4942c7624ecd7770d62244d88d5a695c1edede59b5f06665fae8bef784f774b144822ac541ebe826d1b267f7c40236 +SHA512 (bind-9.19.21.tar.xz.asc) = 4cb12493197be5ff81bf76b6f0c5adb4369248beccbf3bb33d3d16e29082e7e6f8d761db8ae8f1c6754149434ff35a9e8cca80abc2aab63bfb059b023a34a215 From fd35959cbfbe635d90d71e18456720601c7720d4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Sat, 17 Feb 2024 04:17:16 +0100 Subject: [PATCH 04/72] Skip failing quota_test on i686 platform (#2261010) --- bind9-next.spec | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/bind9-next.spec b/bind9-next.spec index 20f6bb3..05d9f0e 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -333,6 +333,11 @@ for i in bin/named/Makefile.am; do done %endif +%ifarch %{ix86} +# f40 FTBFS on quota_test, bug #2261010 + sed -e '/^\s*quota_test/ d' -i tests/isc/Makefile.am +%endif + :; From 71e202e573bbb8f2580afaf7cf88529426b0340a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Mon, 15 Apr 2024 20:45:54 +0200 Subject: [PATCH 05/72] Fix build and installation when %_bindir==%_sbindir Preparation for https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin. No change in builds with unmerged sbin. Cherry-pick the change from bind package --- bind9-next.spec | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/bind9-next.spec b/bind9-next.spec index 05d9f0e..850d6e3 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -562,13 +562,9 @@ mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/sysconfig install -pm 644 %{SOURCE1} ${RPM_BUILD_ROOT}%{_sysconfdir}/sysconfig/named install -pm 644 %{SOURCE49} ${RPM_BUILD_ROOT}%{_sysconfdir}/named-chroot.files -pushd ${RPM_BUILD_ROOT}%{_sbindir} -# Compatibility with previous major versions, only for selected binaries -for BIN in named-checkconf named-checkzone named-compilezone -do - ln -s ../bin/$BIN $BIN -done -popd +%if "%{_sbindir}" != "%{_bindir}" + ln -s ../bin/{named-checkconf,named-checkzone,named-compilezone} %{buildroot}%{_sbindir}/ +%endif %if %{with DLZ} pushd build @@ -774,7 +770,9 @@ fi; %{_bindir}/mdig %{_sbindir}/named %{_sbindir}/rndc* +%if "%{_sbindir}" != "%{_bindir}" %{_sbindir}/named-checkconf +%endif %{_libexecdir}/generate-rndc-key.sh %{_libexecdir}/setup-named-softhsm.sh %{_mandir}/man1/mdig.1* @@ -838,8 +836,10 @@ fi; %{_bindir}/nsec3hash %{_bindir}/named-checkzone %{_bindir}/named-compilezone +%if "%{_sbindir}" != "%{_bindir}" %{_sbindir}/named-checkzone %{_sbindir}/named-compilezone +%endif %if %{with DNSTAP} %{_bindir}/dnstap-read %{_mandir}/man1/dnstap-read.1* From 5db3348c93fa52416a40e89365ad4ed6a3f07fcc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Mon, 15 Apr 2024 20:53:49 +0200 Subject: [PATCH 06/72] Update to 9.19.22 (rhbz#2270475) https://downloads.isc.org/isc/bind9/9.19.22/doc/arm/html/notes.html#notes-for-bind-9-19-22 --- .gitignore | 2 ++ bind9-next.spec | 2 +- sources | 4 ++-- 3 files changed, 5 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 76f5ce8..306ff81 100644 --- a/.gitignore +++ b/.gitignore @@ -220,3 +220,5 @@ bind-9.7.2b1.tar.gz /bind-9.19.19.tar.xz.asc /bind-9.19.21.tar.xz /bind-9.19.21.tar.xz.asc +/bind-9.19.22.tar.xz +/bind-9.19.22.tar.xz.asc diff --git a/bind9-next.spec b/bind9-next.spec index 850d6e3..4e3991d 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -52,7 +52,7 @@ Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv Name: bind9-next License: MPL-2.0 AND ISC AND BSD-3-clause AND Expat AND BSD-2-clause # -Version: 9.19.21 +Version: 9.19.22 Release: %autorelease Epoch: 32 Url: https://www.isc.org/downloads/bind/ diff --git a/sources b/sources index b02d3ed..8aad670 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.19.21.tar.xz) = 8a5bae4619b0093f5c81376b65a143499d4942c7624ecd7770d62244d88d5a695c1edede59b5f06665fae8bef784f774b144822ac541ebe826d1b267f7c40236 -SHA512 (bind-9.19.21.tar.xz.asc) = 4cb12493197be5ff81bf76b6f0c5adb4369248beccbf3bb33d3d16e29082e7e6f8d761db8ae8f1c6754149434ff35a9e8cca80abc2aab63bfb059b023a34a215 +SHA512 (bind-9.19.22.tar.xz) = 609f73ab7e34e9ef0e5854a0bf150009c1ae34615c5f8c7fecf0352ea65ce0d92fecc02b918a0b3b90b3c303dad659e4981a97b1413d02724b20a5ed2d1d905f +SHA512 (bind-9.19.22.tar.xz.asc) = 4839365da593ab6b924372019bbb8b8212856116c563e4f9b6d0b03681234fb855b7f3c85766919fac400be7508f7b72bc9d2a3d8496ce9ee21c6b5fb4369cf3 From 466c940c643c45d67d3b7d388f82e87c69809cbd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Fri, 7 Jun 2024 17:26:32 +0200 Subject: [PATCH 07/72] Update to 9.19.24 (rhbz#2275877) https://downloads.isc.org/isc/bind9/9.19.24/doc/arm/html/notes.html#notes-for-bind-9-19-24 --- .gitignore | 2 ++ bind9-next.spec | 2 +- sources | 4 ++-- 3 files changed, 5 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 306ff81..b70ac96 100644 --- a/.gitignore +++ b/.gitignore @@ -222,3 +222,5 @@ bind-9.7.2b1.tar.gz /bind-9.19.21.tar.xz.asc /bind-9.19.22.tar.xz /bind-9.19.22.tar.xz.asc +/bind-9.19.24.tar.xz +/bind-9.19.24.tar.xz.asc diff --git a/bind9-next.spec b/bind9-next.spec index 4e3991d..5c1fdab 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -52,7 +52,7 @@ Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv Name: bind9-next License: MPL-2.0 AND ISC AND BSD-3-clause AND Expat AND BSD-2-clause # -Version: 9.19.22 +Version: 9.19.24 Release: %autorelease Epoch: 32 Url: https://www.isc.org/downloads/bind/ diff --git a/sources b/sources index 8aad670..a13ac02 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.19.22.tar.xz) = 609f73ab7e34e9ef0e5854a0bf150009c1ae34615c5f8c7fecf0352ea65ce0d92fecc02b918a0b3b90b3c303dad659e4981a97b1413d02724b20a5ed2d1d905f -SHA512 (bind-9.19.22.tar.xz.asc) = 4839365da593ab6b924372019bbb8b8212856116c563e4f9b6d0b03681234fb855b7f3c85766919fac400be7508f7b72bc9d2a3d8496ce9ee21c6b5fb4369cf3 +SHA512 (bind-9.19.24.tar.xz) = 8aa63fb0a40b5c851fdec2c1a5956e7dc2fb2cbfd2f5dbaef39b0c16d0ae54b708ea0c0971bfe6414906c03673fa2fc6e33f71dc51a0cc7f59c81d342323ebda +SHA512 (bind-9.19.24.tar.xz.asc) = f3a812a2af3ddb193751cf34dc70ecfeb31d701eedee909221ad75be69b17a0bcdcddbe2a59b6033f2aa1ec4f9a4f8140cd6a37666f10347bc4babc8c7872564 From d2b77fd8973913af7484ef169182e0d82411b2f7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Fri, 7 Jun 2024 17:57:17 +0200 Subject: [PATCH 08/72] Make documentation links relative Do not require absolute paths, but use relative links even to non-existent buildroot subdirectory. It should compute it correctly. --- bind9-next.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bind9-next.spec b/bind9-next.spec index 5c1fdab..0740fcd 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -614,7 +614,7 @@ do BINDTHEMEDIR="${RPM_BUILD_ROOT}%{_pkgdocdir}/html/_static/$BASE" if [ -d "$BINDTHEMEDIR" ]; then rm -rf "$BINDTHEMEDIR" - ln -s "$DIR" "$BINDTHEMEDIR" + ln -sr "${RPM_BUILD_ROOT}${DIR}" "$BINDTHEMEDIR" fi done cp -p build/doc/arm/_build/epub/Bv9ARM.epub ${RPM_BUILD_ROOT}%{_pkgdocdir} From 7a538b7509dcdaeebff4f3ad39ad34750ce9d7de Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 17 Jul 2024 18:17:35 +0000 Subject: [PATCH 09/72] Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild From 21fc152cf54835f09d76259a4a0083cf20cc3b05 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Sat, 3 Aug 2024 00:16:12 +0200 Subject: [PATCH 10/72] Make OpenSSL engine support optional and disabled openssl-devel-engine is now needed on rawhide to have engine header present. Make it disabled by default, but possible to built support for it easy way. https://fedoraproject.org/wiki/Changes/OpensslDeprecateEngine --- bind-9.20-openssl-no-engine.patch | 40 +++++++++++++++++++++++++++++++ bind9-next.spec | 14 +++++++++-- 2 files changed, 52 insertions(+), 2 deletions(-) create mode 100644 bind-9.20-openssl-no-engine.patch diff --git a/bind-9.20-openssl-no-engine.patch b/bind-9.20-openssl-no-engine.patch new file mode 100644 index 0000000..bafb6f2 --- /dev/null +++ b/bind-9.20-openssl-no-engine.patch @@ -0,0 +1,40 @@ +From e803ce83a1aafb84ff2b173f02cbac2de82373d9 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= +Date: Sat, 3 Aug 2024 01:28:36 +0200 +Subject: [PATCH] Do not include engine in openssl shim + +It might not be available in some version. Ensure all code that requires +it will include that header explicitly, including check for +OPENSSL_NO_ENGINE define. +--- + lib/isc/openssl_shim.c | 1 - + lib/isc/openssl_shim.h | 1 - + 2 files changed, 2 deletions(-) + +diff --git a/lib/isc/openssl_shim.c b/lib/isc/openssl_shim.c +index c39ba8c..8ffa31f 100644 +--- a/lib/isc/openssl_shim.c ++++ b/lib/isc/openssl_shim.c +@@ -16,7 +16,6 @@ + #include + + #include +-#include + #include + #include + #include +diff --git a/lib/isc/openssl_shim.h b/lib/isc/openssl_shim.h +index b2916e2..bfc44c1 100644 +--- a/lib/isc/openssl_shim.h ++++ b/lib/isc/openssl_shim.h +@@ -14,7 +14,6 @@ + #pragma once + + #include +-#include + #include + #include + #include +-- +2.45.2 + diff --git a/bind9-next.spec b/bind9-next.spec index 0740fcd..58afd7c 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -22,6 +22,7 @@ %bcond_without DOC %bcond_with TSAN %bcond_without DTRACE +%bcond_with OPENSSL_ENGINE %{?!bind_uid: %global bind_uid 25} %{?!bind_gid: %global bind_gid 25} @@ -88,6 +89,9 @@ Source49: named-chroot.files # Common patches # Red Hat specific documentation is not relevant to upstream Patch1: bind-9.16-redhat_doc.patch +# Correct support for building without openssl/engine.h header +# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/9228 +Patch2: bind-9.20-openssl-no-engine.patch %{?systemd_ordering} Requires: coreutils @@ -114,8 +118,11 @@ BuildRequires: jemalloc-devel BuildRequires: gnupg2 %endif BuildRequires: libuv-devel +%if %{with OPENSSL_ENGINE} +BuildRequires: openssl-devel-engine +%endif %if %{with DLZ} -BuildRequires: openldap-devel, libpq-devel, sqlite-devel, mariadb-connector-c-devel +BuildRequires: openldap-devel, sqlite-devel, mariadb-connector-c-devel %endif %if %{with UNITTEST} # make unit dependencies @@ -354,8 +361,11 @@ done %define systemtest_prepare_build() \ cp -Tuav bin/tests "%{1}/bin/tests/" \ -CFLAGS="$CFLAGS $RPM_OPT_FLAGS" +%if %{with OPENSSL_ENGINE} CPPFLAGS="$CPPFLAGS -DOPENSSL_API_COMPAT=10100" +%else +CPPFLAGS="$CPPFLAGS -DOPENSSL_NO_ENGINE=1" +%endif %if %{with TSAN} CFLAGS+=" -O1 -fsanitize=thread -fPIE -pie" %endif From a5b1d13fb0ac708214d7d89e0c1e02d1c7e9c63e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Wed, 21 Aug 2024 19:35:53 +0200 Subject: [PATCH 11/72] Update to 9.21.0 (rhbz#2306549) New major development version. https://downloads.isc.org/isc/bind9/9.21.0/doc/arm/html/notes.html --- .gitignore | 2 ++ bind-9.20-openssl-no-engine.patch | 40 ------------------------------- bind9-next.spec | 5 +--- sources | 4 ++-- 4 files changed, 5 insertions(+), 46 deletions(-) delete mode 100644 bind-9.20-openssl-no-engine.patch diff --git a/.gitignore b/.gitignore index b70ac96..025af5e 100644 --- a/.gitignore +++ b/.gitignore @@ -224,3 +224,5 @@ bind-9.7.2b1.tar.gz /bind-9.19.22.tar.xz.asc /bind-9.19.24.tar.xz /bind-9.19.24.tar.xz.asc +/bind-9.21.0.tar.xz +/bind-9.21.0.tar.xz.asc diff --git a/bind-9.20-openssl-no-engine.patch b/bind-9.20-openssl-no-engine.patch deleted file mode 100644 index bafb6f2..0000000 --- a/bind-9.20-openssl-no-engine.patch +++ /dev/null @@ -1,40 +0,0 @@ -From e803ce83a1aafb84ff2b173f02cbac2de82373d9 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= -Date: Sat, 3 Aug 2024 01:28:36 +0200 -Subject: [PATCH] Do not include engine in openssl shim - -It might not be available in some version. Ensure all code that requires -it will include that header explicitly, including check for -OPENSSL_NO_ENGINE define. ---- - lib/isc/openssl_shim.c | 1 - - lib/isc/openssl_shim.h | 1 - - 2 files changed, 2 deletions(-) - -diff --git a/lib/isc/openssl_shim.c b/lib/isc/openssl_shim.c -index c39ba8c..8ffa31f 100644 ---- a/lib/isc/openssl_shim.c -+++ b/lib/isc/openssl_shim.c -@@ -16,7 +16,6 @@ - #include - - #include --#include - #include - #include - #include -diff --git a/lib/isc/openssl_shim.h b/lib/isc/openssl_shim.h -index b2916e2..bfc44c1 100644 ---- a/lib/isc/openssl_shim.h -+++ b/lib/isc/openssl_shim.h -@@ -14,7 +14,6 @@ - #pragma once - - #include --#include - #include - #include - #include --- -2.45.2 - diff --git a/bind9-next.spec b/bind9-next.spec index 58afd7c..56042db 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -53,7 +53,7 @@ Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv Name: bind9-next License: MPL-2.0 AND ISC AND BSD-3-clause AND Expat AND BSD-2-clause # -Version: 9.19.24 +Version: 9.21.0 Release: %autorelease Epoch: 32 Url: https://www.isc.org/downloads/bind/ @@ -89,9 +89,6 @@ Source49: named-chroot.files # Common patches # Red Hat specific documentation is not relevant to upstream Patch1: bind-9.16-redhat_doc.patch -# Correct support for building without openssl/engine.h header -# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/9228 -Patch2: bind-9.20-openssl-no-engine.patch %{?systemd_ordering} Requires: coreutils diff --git a/sources b/sources index a13ac02..631bbc8 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.19.24.tar.xz) = 8aa63fb0a40b5c851fdec2c1a5956e7dc2fb2cbfd2f5dbaef39b0c16d0ae54b708ea0c0971bfe6414906c03673fa2fc6e33f71dc51a0cc7f59c81d342323ebda -SHA512 (bind-9.19.24.tar.xz.asc) = f3a812a2af3ddb193751cf34dc70ecfeb31d701eedee909221ad75be69b17a0bcdcddbe2a59b6033f2aa1ec4f9a4f8140cd6a37666f10347bc4babc8c7872564 +SHA512 (bind-9.21.0.tar.xz) = b1361fd88783c5b1f44483bf69a7279da557963b54faff9824ebf8f3bc30f387e47f1f7bd795cee12af0fc86462d39f01c5c3312875bb1cd7c5a6f6158e8a0f9 +SHA512 (bind-9.21.0.tar.xz.asc) = af2ec3d7f7ad233bdb108d889c23e6bbb4e393ecb2e35a2fb48a75855095d7d9bb89b2a63d9ceda9b58b32e3a1297f1ff7838c79fe835b646683d5bd05beb8b6 From 8d390d4bd9918793fe48f85e80e250ef80c1ad0d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Fri, 30 Sep 2022 12:51:19 +0200 Subject: [PATCH 12/72] Enable automatic restart on crashes named contains high number of assertions checking expected state of the daemon. That is part of defensive code style to prevent many attacks. The most common failure is failing some assertion check in rare circumstances. Even when this should not happen, try keeping the service running. If such failed assertion produces coredump just from time to time, avoid failing hard the whole service. coredumpctl will keep track of all crashes anyway. --- named-chroot.service | 1 + named.service | 1 + 2 files changed, 2 insertions(+) diff --git a/named-chroot.service b/named-chroot.service index ff793f2..4c38601 100644 --- a/named-chroot.service +++ b/named-chroot.service @@ -25,6 +25,7 @@ ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/r ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID' PrivateTmp=false +Restart=on-abnormal [Install] WantedBy=multi-user.target diff --git a/named.service b/named.service index 252c9d5..5c32fc5 100644 --- a/named.service +++ b/named.service @@ -20,6 +20,7 @@ ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/r ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID' PrivateTmp=true +Restart=on-abnormal [Install] WantedBy=multi-user.target From 9f59ae6ed0256f11c0ba4657413019e4b24f8355 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Thu, 29 Aug 2024 20:22:25 +0200 Subject: [PATCH 13/72] Use only fortify level 2 Fedora tends to crash on config generation and tests. Use just level 2. --- bind9-next.spec | 3 +++ 1 file changed, 3 insertions(+) diff --git a/bind9-next.spec b/bind9-next.spec index 56042db..7bcb1c5 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -40,6 +40,9 @@ # Visit https://bugzilla.redhat.com/show_bug.cgi?id=1540300 %undefine _strict_symbol_defs_build +# BIND9 does not work with fortify 3 level, make builds work on Fedora +%global _fortify_level 2 + # Upstream package name %global upname bind # Provide only bind-utils on f37+, it has better behaviour From 4a21f3639db17b53f9ae046df01b86d424671c12 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Thu, 7 Nov 2024 15:49:05 +0100 Subject: [PATCH 14/72] Update to 9.21.2 - WALLET type - rndc responselog https://downloads.isc.org/isc/bind9/9.21.2/doc/arm/html/notes.html#notes-for-bind-9-21-2 --- bind9-next.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bind9-next.spec b/bind9-next.spec index 7bcb1c5..f59fb53 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -56,7 +56,7 @@ Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv Name: bind9-next License: MPL-2.0 AND ISC AND BSD-3-clause AND Expat AND BSD-2-clause # -Version: 9.21.0 +Version: 9.21.2 Release: %autorelease Epoch: 32 Url: https://www.isc.org/downloads/bind/ From 028f07a95c5777516270fce9f074f3d14efcbd54 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Tue, 19 Nov 2024 21:19:08 +0100 Subject: [PATCH 15/72] Upload 9.21.2 sources --- .gitignore | 2 ++ sources | 4 ++-- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 025af5e..705490e 100644 --- a/.gitignore +++ b/.gitignore @@ -226,3 +226,5 @@ bind-9.7.2b1.tar.gz /bind-9.19.24.tar.xz.asc /bind-9.21.0.tar.xz /bind-9.21.0.tar.xz.asc +/bind-9.21.2.tar.xz +/bind-9.21.2.tar.xz.asc diff --git a/sources b/sources index 631bbc8..473be9c 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.21.0.tar.xz) = b1361fd88783c5b1f44483bf69a7279da557963b54faff9824ebf8f3bc30f387e47f1f7bd795cee12af0fc86462d39f01c5c3312875bb1cd7c5a6f6158e8a0f9 -SHA512 (bind-9.21.0.tar.xz.asc) = af2ec3d7f7ad233bdb108d889c23e6bbb4e393ecb2e35a2fb48a75855095d7d9bb89b2a63d9ceda9b58b32e3a1297f1ff7838c79fe835b646683d5bd05beb8b6 +SHA512 (bind-9.21.2.tar.xz) = d79ffc5b086def35ccee9c5fc26a6818bbdfa0153745a7bd88e1428e7af3fc64d41e77a5fb3310f3a1c6f4e0fabe214df51c0dec62ff42353e28f8b1c072bebe +SHA512 (bind-9.21.2.tar.xz.asc) = 5af0cb6a590e5c605e28a62bec9d1d2cb1ea4cf3cbb1f14282a0f7fa7aabb805b6ffe5e5523673eee7c75a18e0450ee88aaa558535e0bd6367e606d880233f06 From 0d866ac5818b1f665bde74c6dd006a3476381930 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Wed, 20 Nov 2024 13:21:50 +0100 Subject: [PATCH 16/72] Fix unittest on 32b architecture (rhbz#2306549) --- bind-9.21-unittest-isc-time-32b.patch | 25 +++++++++++++++++++++++++ bind9-next.spec | 2 ++ 2 files changed, 27 insertions(+) create mode 100644 bind-9.21-unittest-isc-time-32b.patch diff --git a/bind-9.21-unittest-isc-time-32b.patch b/bind-9.21-unittest-isc-time-32b.patch new file mode 100644 index 0000000..4f1dcee --- /dev/null +++ b/bind-9.21-unittest-isc-time-32b.patch @@ -0,0 +1,25 @@ +From 18ecdde54b42d1d4fe7583736269974356b00287 Mon Sep 17 00:00:00 2001 +From: Petr Mensik +Date: Wed, 20 Nov 2024 13:03:07 +0100 +Subject: [PATCH] Fix unit test build on 32 bit architecture + +--- + tests/isc/time_test.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tests/isc/time_test.c b/tests/isc/time_test.c +index d3a7c01..26d2775 100644 +--- a/tests/isc/time_test.c ++++ b/tests/isc/time_test.c +@@ -280,7 +280,7 @@ ISC_RUN_TEST_IMPL(isc_time_formatISO8601TZms_test) { + assert_int_equal(buf[16], ':'); + assert_int_equal(buf[19], '.'); + +- size_t plus_minus[2] = { '+', '-' }; ++ LargestIntegralType plus_minus[2] = { '+', '-' }; + assert_in_set(buf[23], plus_minus, sizeof(plus_minus)); + assert_int_equal(buf[26], ':'); + +-- +2.47.0 + diff --git a/bind9-next.spec b/bind9-next.spec index f59fb53..735c56c 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -92,6 +92,8 @@ Source49: named-chroot.files # Common patches # Red Hat specific documentation is not relevant to upstream Patch1: bind-9.16-redhat_doc.patch +# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/9753 +Patch2: bind-9.21-unittest-isc-time-32b.patch %{?systemd_ordering} Requires: coreutils From 763f5ecec5ced198955249fc4fac0692afd00f59 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Wed, 20 Nov 2024 15:36:57 +0100 Subject: [PATCH 17/72] Add workaround for stuck s390x benchmark test Avoids terminating with similar failre: [ RUN ] isc_rwlock_benchmark PID 38869 exceeded run time limit, sending SIGABRT FAIL rwlock_test (exit status: 124) --- bind-9.21-unittest-isc_rwlock-s390x.patch | 29 +++++++++++++++++++++++ bind9-next.spec | 2 ++ 2 files changed, 31 insertions(+) create mode 100644 bind-9.21-unittest-isc_rwlock-s390x.patch diff --git a/bind-9.21-unittest-isc_rwlock-s390x.patch b/bind-9.21-unittest-isc_rwlock-s390x.patch new file mode 100644 index 0000000..5697450 --- /dev/null +++ b/bind-9.21-unittest-isc_rwlock-s390x.patch @@ -0,0 +1,29 @@ +From b8bc86834311e4ea27fe75052db08279045f027b Mon Sep 17 00:00:00 2001 +From: Petr Mensik +Date: Wed, 20 Nov 2024 15:34:29 +0100 +Subject: [PATCH] Skip isc_rwlock_benchmark on s390x + +Not sure why, but it repeatedly failed on isc_rwlock_benchmark function. +Not sure if it requires more time only or there is some strange error. +--- + tests/isc/rwlock_test.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/tests/isc/rwlock_test.c b/tests/isc/rwlock_test.c +index 4c5b8e0..a28b7d9 100644 +--- a/tests/isc/rwlock_test.c ++++ b/tests/isc/rwlock_test.c +@@ -340,7 +340,10 @@ ISC_TEST_ENTRY_CUSTOM(isc_rwlock_wrlock, rwlock_setup, rwlock_teardown) + #if !defined(__SANITIZE_THREAD__) + ISC_TEST_ENTRY_CUSTOM(isc_rwlock_tryupgrade, rwlock_setup, rwlock_teardown) + ISC_TEST_ENTRY_CUSTOM(isc_rwlock_trylock, rwlock_setup, rwlock_teardown) ++#ifndef __s390x__ ++// TODO: find why this stucks. + ISC_TEST_ENTRY_CUSTOM(isc_rwlock_benchmark, rwlock_setup, rwlock_teardown) ++#endif + #endif /* __SANITIZE_THREAD__ */ + + ISC_TEST_LIST_END +-- +2.47.0 + diff --git a/bind9-next.spec b/bind9-next.spec index 735c56c..dbb0d4e 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -94,6 +94,8 @@ Source49: named-chroot.files Patch1: bind-9.16-redhat_doc.patch # https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/9753 Patch2: bind-9.21-unittest-isc-time-32b.patch +# Downstream only. TODO: find a cause and remove this workaround +Patch3: bind-9.21-unittest-isc_rwlock-s390x.patch %{?systemd_ordering} Requires: coreutils From 13782b05eb404bcec31927afce6786aa57b92535 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Thu, 12 Dec 2024 21:34:35 +0100 Subject: [PATCH 18/72] Update to 9.21.3 (rhbz##2331674) New Features: - Add separate query counters for new protocols. [GL #598] - Implement RFC 9567: EDNS Report-Channel option.[GL #3659] - Add detailed debugging of update-policy rule matching. [GL #4751] - Enable runtime selection of FIPS mode in dig and delv. [GL #5046] Removed Features: - Move contributed DLZ modules into a separate repository. DLZ modules should not be used except in testing. [GL #4865] - Remove RBTDB implementation. [GL #5027] Features Changes: - dnssec-ksr now supports KSK rollovers. [GL #4697] [GL #4705] - Add none parameter to query-source and query-source-v6 to disable IPv4 or IPv6 upstream queries but allow listening to queries from clients on IPv4 or IPv6. - Print RFC 7314: EXPIRE option in transfer summary. [GL #5013] - Add missing EDNS option mnemonics to dig. - Add new logging module for crypto errors in libisc. - Emit more helpful log messages for exceeding max-records-per-type. - Harden key management when key files have become unavailable. - Reduce memory footprint by optimizing commonly-used data structures. [GL #5022] And multiple bug fixes. https://downloads.isc.org/isc/bind9/9.21.3/doc/arm/html/notes.html#notes-for-bind-9-21-3 --- .gitignore | 2 ++ bind-9.21-unittest-isc-time-32b.patch | 25 ------------------------- bind9-next.spec | 4 +--- sources | 4 ++-- 4 files changed, 5 insertions(+), 30 deletions(-) delete mode 100644 bind-9.21-unittest-isc-time-32b.patch diff --git a/.gitignore b/.gitignore index 705490e..3672915 100644 --- a/.gitignore +++ b/.gitignore @@ -228,3 +228,5 @@ bind-9.7.2b1.tar.gz /bind-9.21.0.tar.xz.asc /bind-9.21.2.tar.xz /bind-9.21.2.tar.xz.asc +/bind-9.21.3.tar.xz +/bind-9.21.3.tar.xz.asc diff --git a/bind-9.21-unittest-isc-time-32b.patch b/bind-9.21-unittest-isc-time-32b.patch deleted file mode 100644 index 4f1dcee..0000000 --- a/bind-9.21-unittest-isc-time-32b.patch +++ /dev/null @@ -1,25 +0,0 @@ -From 18ecdde54b42d1d4fe7583736269974356b00287 Mon Sep 17 00:00:00 2001 -From: Petr Mensik -Date: Wed, 20 Nov 2024 13:03:07 +0100 -Subject: [PATCH] Fix unit test build on 32 bit architecture - ---- - tests/isc/time_test.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/tests/isc/time_test.c b/tests/isc/time_test.c -index d3a7c01..26d2775 100644 ---- a/tests/isc/time_test.c -+++ b/tests/isc/time_test.c -@@ -280,7 +280,7 @@ ISC_RUN_TEST_IMPL(isc_time_formatISO8601TZms_test) { - assert_int_equal(buf[16], ':'); - assert_int_equal(buf[19], '.'); - -- size_t plus_minus[2] = { '+', '-' }; -+ LargestIntegralType plus_minus[2] = { '+', '-' }; - assert_in_set(buf[23], plus_minus, sizeof(plus_minus)); - assert_int_equal(buf[26], ':'); - --- -2.47.0 - diff --git a/bind9-next.spec b/bind9-next.spec index dbb0d4e..e043ae5 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -56,7 +56,7 @@ Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv Name: bind9-next License: MPL-2.0 AND ISC AND BSD-3-clause AND Expat AND BSD-2-clause # -Version: 9.21.2 +Version: 9.21.3 Release: %autorelease Epoch: 32 Url: https://www.isc.org/downloads/bind/ @@ -92,8 +92,6 @@ Source49: named-chroot.files # Common patches # Red Hat specific documentation is not relevant to upstream Patch1: bind-9.16-redhat_doc.patch -# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/9753 -Patch2: bind-9.21-unittest-isc-time-32b.patch # Downstream only. TODO: find a cause and remove this workaround Patch3: bind-9.21-unittest-isc_rwlock-s390x.patch diff --git a/sources b/sources index 473be9c..4fc762b 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.21.2.tar.xz) = d79ffc5b086def35ccee9c5fc26a6818bbdfa0153745a7bd88e1428e7af3fc64d41e77a5fb3310f3a1c6f4e0fabe214df51c0dec62ff42353e28f8b1c072bebe -SHA512 (bind-9.21.2.tar.xz.asc) = 5af0cb6a590e5c605e28a62bec9d1d2cb1ea4cf3cbb1f14282a0f7fa7aabb805b6ffe5e5523673eee7c75a18e0450ee88aaa558535e0bd6367e606d880233f06 +SHA512 (bind-9.21.3.tar.xz) = cc00929f0a3923bb7486cffe6791f6a25a98e58cf2ade4bbd99d8df61380113b5e3286d82c48bed4c9af00a9affba337e16963060847a03859b89e2ce12c85ce +SHA512 (bind-9.21.3.tar.xz.asc) = e76e4158c3d269c1bbf6890a8d4cc6c78d0282e612324354e8f04b7099eb2704707cbaaf7e522b1fbea08f839bafdd4998da4d479c6f76d02df066fc83860fb7 From fc258d95af13e09eb957dd061a51f564e6fe64ee Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Fri, 13 Dec 2024 12:58:33 +0100 Subject: [PATCH 19/72] Remove DLZ support --- bind9-next.spec | 87 ------------------------------------------------- 1 file changed, 87 deletions(-) diff --git a/bind9-next.spec b/bind9-next.spec index e043ae5..8703b4a 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -10,7 +10,6 @@ %bcond_without SUDO %bcond_without GSSTSIG %bcond_without JSON -%bcond_without DLZ # New MaxMind GeoLite support %bcond_without GEOIP2 # Disabled temporarily until kyua is fixed on rawhide, bug #1926779 @@ -123,9 +122,6 @@ BuildRequires: libuv-devel %if %{with OPENSSL_ENGINE} BuildRequires: openssl-devel-engine %endif -%if %{with DLZ} -BuildRequires: openldap-devel, sqlite-devel, mariadb-connector-c-devel -%endif %if %{with UNITTEST} # make unit dependencies BuildRequires: libcmocka-devel @@ -275,39 +271,6 @@ chroot(2) jail for the named(8) program from the BIND package. Based on the code from Jan "Yenya" Kasprzak -%if %{with DLZ} -%package dlz-filesystem -Summary: BIND server filesystem DLZ module -Requires: %{name}%{?_isa} = %{epoch}:%{version}-%{release} - -%description dlz-filesystem -Dynamic Loadable Zones filesystem module for BIND server. - -%package dlz-ldap -Summary: BIND server ldap DLZ module -Requires: %{name}%{?_isa} = %{epoch}:%{version}-%{release} - -%description dlz-ldap -Dynamic Loadable Zones LDAP module for BIND server. - -%package dlz-mysql -Summary: BIND server mysql and mysqldyn DLZ modules -Requires: %{name}%{?_isa} = %{epoch}:%{version}-%{release} -Provides: %{name}-dlz-mysqldyn = %{epoch}:%{version}-%{release} -Obsoletes: %{name}-dlz-mysqldyn < 32:9.16.6-3 - -%description dlz-mysql -Dynamic Loadable Zones MySQL module for BIND server. -Contains also mysqldyn module with dynamic DNS updates (DDNS) support. - -%package dlz-sqlite3 -Summary: BIND server sqlite3 DLZ module -Requires: %{name}%{?_isa} = %{epoch}:%{version}-%{release} - -%description dlz-sqlite3 -Dynamic Loadable Zones sqlite3 module for BIND server. -%endif - %if %{with DOC} %package doc Summary: BIND 9 Administrator Reference Manual @@ -387,12 +350,6 @@ autoreconf --force --install mkdir build -%if %{with DLZ} -# DLZ modules do not support oot builds. Copy files into build -mkdir -p build/contrib/dlz -cp -frp contrib/dlz/modules build/contrib/dlz/modules -%endif - pushd build LIBDIR_SUFFIX= export LIBDIR_SUFFIX @@ -436,13 +393,6 @@ export LIBDIR_SUFFIX %make_build doc SPHINX_W='' %endif -%if %{with DLZ} - pushd contrib/dlz/modules - for DIR in filesystem ldap mysql mysqldyn sqlite3; do - %make_build -C $DIR CFLAGS="-fPIC -I../include $CFLAGS $LDFLAGS -DPTHREADS=1" LDFLAGS="$LDFLAGS" - done - popd -%endif popd # build %unit_prepare_build build @@ -578,23 +528,6 @@ install -pm 644 %{SOURCE49} ${RPM_BUILD_ROOT}%{_sysconfdir}/named-chroot.files ln -s ../bin/{named-checkconf,named-checkzone,named-compilezone} %{buildroot}%{_sbindir}/ %endif -%if %{with DLZ} - pushd build - pushd contrib/dlz/modules - for DIR in filesystem ldap mysql mysqldyn sqlite3; do - %make_install -C $DIR libdir=%{_libdir}/bind - done - pushd ${RPM_BUILD_ROOT}/%{_libdir}/named - cp -s ../bind/dlz_*.so . - popd - mkdir -p doc/{mysql,mysqldyn} - cp -p mysqldyn/testing/README doc/mysqldyn/README.testing - cp -p mysqldyn/testing/* doc/mysqldyn - cp -p mysql/testing/* doc/mysql - popd - popd -%endif - # Remove libtool .la files: find ${RPM_BUILD_ROOT}/%{_libdir} -name '*.la' -exec '/bin/rm' '-f' '{}' ';'; @@ -931,26 +864,6 @@ fi; %dir %{chroot_prefix}/run/named %{chroot_prefix}%{_localstatedir}/run -%if %{with DLZ} -%files dlz-filesystem -%{_libdir}/{named,bind}/dlz_filesystem_dynamic.so - -%files dlz-mysql -%{_libdir}/{named,bind}/dlz_mysql_dynamic.so -%doc build/contrib/dlz/modules/doc/mysql -%{_libdir}/{named,bind}/dlz_mysqldyn_mod.so -%doc build/contrib/dlz/modules/doc/mysqldyn - -%files dlz-ldap -%{_libdir}/{named,bind}/dlz_ldap_dynamic.so -%doc contrib/dlz/modules/ldap/testing/* - -%files dlz-sqlite3 -%{_libdir}/{named,bind}/dlz_sqlite3_dynamic.so -%doc contrib/dlz/modules/sqlite3/testing/* - -%endif - %if %{with DOC} %files doc %dir %{_pkgdocdir} From 05160e928ba14900b4d51a24391777a678ce1923 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Thu, 12 Dec 2024 21:25:14 +0100 Subject: [PATCH 20/72] Add new root key 38696 into package files too Add KSK 2024 into bind package files too. --- named.root.key | 5 +++++ trusted-key.key | 1 + 2 files changed, 6 insertions(+) diff --git a/named.root.key b/named.root.key index fbcb5d3..b57e61d 100644 --- a/named.root.key +++ b/named.root.key @@ -10,4 +10,9 @@ trust-anchors { # managed key database will be trusted and maintained # automatically. . initial-ds 20326 8 2 "E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D"; + # This key (38696) will be pre-published in the root zone in 2025 + # and is scheduled to begin signing in late 2026. At that time, + # servers which were already using the old key (20326) should roll + # seamlessly to this new one via RFC 5011 rollover. + . initial-ds 38696 8 2 "683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A4C0FB2B16"; }; diff --git a/trusted-key.key b/trusted-key.key index 7b845f3..2ef50c7 100644 --- a/trusted-key.key +++ b/trusted-key.key @@ -1 +1,2 @@ . 3600 IN DNSKEY 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= +. 3600 IN DNSKEY 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdpWWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwuMoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBevYtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= From 2ba9c2f961f85c5b91f091f908eb99bdccba4b11 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Fri, 13 Dec 2024 14:50:56 +0100 Subject: [PATCH 21/72] Include changelog in the new format CHANGES did not contain anything useful recently. Skip bigger changelog-history in normal package. Include also history in doc package. Include original release notes in rst format inside doc package. That format is nice to use from terminal interface, especially when syntax is highlighted by vim for example. --- bind9-next.spec | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/bind9-next.spec b/bind9-next.spec index 8703b4a..b840b44 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -114,6 +114,8 @@ BuildRequires: selinux-policy BuildRequires: findutils sed BuildRequires: libnghttp2-devel BuildRequires: userspace-rcu-devel +# Compress the changelog +BuildRequires: gzip %if 0%{?fedora} BuildRequires: jemalloc-devel BuildRequires: gnupg2 @@ -395,6 +397,9 @@ export LIBDIR_SUFFIX popd # build +# Compress changelog by default +gzip doc/changelog/changelog-*.rst + %unit_prepare_build build %systemtest_prepare_build build @@ -730,7 +735,8 @@ fi; %{_mandir}/man8/rndc-confgen.8* %{_mandir}/man1/named-journalprint.1* %{_mandir}/man8/filter-*.8.gz -%doc CHANGES README.md named.conf.default +%doc README.md named.conf.default +%doc doc/changelog/changelog-9.*.rst* %doc sample/ # Hide configuration @@ -870,6 +876,8 @@ fi; %doc %{_pkgdocdir}/html %doc %{_pkgdocdir}/Bv9ARM.html %doc %{_pkgdocdir}/Bv9ARM.epub +%doc doc/changelog/changelog-history.rst* +%doc doc/notes/notes-*.rst* %endif %changelog From 8b145852cffad6ab8fe1118922fd6c7d0cdad36b Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 16 Jan 2025 12:30:06 +0000 Subject: [PATCH 22/72] Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild From 9c6587a11f9a72dd8dc29df2daffc73f96a8199b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Thu, 23 Jan 2025 17:16:17 +0100 Subject: [PATCH 23/72] Add sysusers.d config file to allow rpm to create users/groups automatically --- bind9-next.spec | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/bind9-next.spec b/bind9-next.spec index b840b44..ffb54be 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -96,7 +96,6 @@ Patch3: bind-9.21-unittest-isc_rwlock-s390x.patch %{?systemd_ordering} Requires: coreutils -Requires(pre): shadow-utils Requires(post): shadow-utils Requires(post): glibc-common Requires(post): grep @@ -314,6 +313,12 @@ done :; +# Create a sysusers.d config file +cat >bind9-next.sysusers.conf </dev/null 2>&1 || :; - /usr/sbin/useradd -u %{bind_uid} -r -N -M -g named -s /sbin/nologin -d /var/named -c Named named >/dev/null 2>&1 || :; -fi; -:; +install -m0644 -D bind9-next.sysusers.conf %{buildroot}%{_sysusersdir}/bind9-next.conf %post %?ldconfig @@ -711,6 +711,7 @@ fi; %config(noreplace) %attr(0644,root,named) %{_sysconfdir}/named.root.key %config(noreplace) %{_sysconfdir}/logrotate.d/named %{_tmpfilesdir}/named.conf +%{_sysusersdir}/bind9-next.conf %{_sysconfdir}/rwtab.d/named %{_unitdir}/named.service %{_unitdir}/named-setup-rndc.service From 0235a187b71bbe6fada401ed3691977aa13a595a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Sun, 2 Feb 2025 14:51:12 +0100 Subject: [PATCH 24/72] Update to 9.21.4 (rhbz#2342806) --- .gitignore | 2 ++ bind9-next.spec | 2 +- sources | 4 ++-- 3 files changed, 5 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 3672915..f181ffd 100644 --- a/.gitignore +++ b/.gitignore @@ -230,3 +230,5 @@ bind-9.7.2b1.tar.gz /bind-9.21.2.tar.xz.asc /bind-9.21.3.tar.xz /bind-9.21.3.tar.xz.asc +/bind-9.21.4.tar.xz +/bind-9.21.4.tar.xz.asc diff --git a/bind9-next.spec b/bind9-next.spec index ffb54be..28b0e3e 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -55,7 +55,7 @@ Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv Name: bind9-next License: MPL-2.0 AND ISC AND BSD-3-clause AND Expat AND BSD-2-clause # -Version: 9.21.3 +Version: 9.21.4 Release: %autorelease Epoch: 32 Url: https://www.isc.org/downloads/bind/ diff --git a/sources b/sources index 4fc762b..f7b84d2 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.21.3.tar.xz) = cc00929f0a3923bb7486cffe6791f6a25a98e58cf2ade4bbd99d8df61380113b5e3286d82c48bed4c9af00a9affba337e16963060847a03859b89e2ce12c85ce -SHA512 (bind-9.21.3.tar.xz.asc) = e76e4158c3d269c1bbf6890a8d4cc6c78d0282e612324354e8f04b7099eb2704707cbaaf7e522b1fbea08f839bafdd4998da4d479c6f76d02df066fc83860fb7 +SHA512 (bind-9.21.4.tar.xz) = 7588152ec48a1964c3dd4bf6055b69cc8833377851260f80c63a2ff00b1c812b72ca9f4b930dd00a52eeaf35006692f620963e86ecbabc304a5558b78d97dc9e +SHA512 (bind-9.21.4.tar.xz.asc) = b20cc3feb7ae622dae62388d34831ed4f7311f1c984326d6e78a2c21473473aebd095930de19d30fad91df0e6c6f7355e6f390f36f2e515b566f97c7771383fd From 615731d1433421a0e5386933563fc714d759c664 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Wed, 28 May 2025 13:08:38 +0200 Subject: [PATCH 25/72] Update to 9.21.8 Security fixes: - Prevent an assertion failure when processing TSIG algorithm. (CVE-2025-40775) Feature changes: - Return DNS COOKIE and NSID with BADVERS. [GL #5235] - Use Jinja2 templates in system tests. And bug fixes https://downloads.isc.org/isc/bind9/9.21.8/doc/arm/html/notes.html#notes-for-bind-9-21-8 --- .gitignore | 2 ++ bind9-next.spec | 2 +- sources | 4 ++-- 3 files changed, 5 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index f181ffd..7d9fed1 100644 --- a/.gitignore +++ b/.gitignore @@ -232,3 +232,5 @@ bind-9.7.2b1.tar.gz /bind-9.21.3.tar.xz.asc /bind-9.21.4.tar.xz /bind-9.21.4.tar.xz.asc +/bind-9.21.*.tar.xz +/bind-9.21.*.tar.xz.asc diff --git a/bind9-next.spec b/bind9-next.spec index 28b0e3e..6aaff86 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -55,7 +55,7 @@ Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv Name: bind9-next License: MPL-2.0 AND ISC AND BSD-3-clause AND Expat AND BSD-2-clause # -Version: 9.21.4 +Version: 9.21.8 Release: %autorelease Epoch: 32 Url: https://www.isc.org/downloads/bind/ diff --git a/sources b/sources index f7b84d2..06b6126 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.21.4.tar.xz) = 7588152ec48a1964c3dd4bf6055b69cc8833377851260f80c63a2ff00b1c812b72ca9f4b930dd00a52eeaf35006692f620963e86ecbabc304a5558b78d97dc9e -SHA512 (bind-9.21.4.tar.xz.asc) = b20cc3feb7ae622dae62388d34831ed4f7311f1c984326d6e78a2c21473473aebd095930de19d30fad91df0e6c6f7355e6f390f36f2e515b566f97c7771383fd +SHA512 (bind-9.21.8.tar.xz) = 8fdba5fa9e8c4659119074b54477d22bfb7301f6244f8df8df9f4b45f0512374a071c0d0d3f0f8e06f668fa59aa8a56d269900b6f6431461a770f11e21443d19 +SHA512 (bind-9.21.8.tar.xz.asc) = c48d2e3607a4c346ff12be6da43a9103ab935058662a14bd20abe5193db8cdede38a52bc59a1ad45ff1264f72a6175c61266edab92df3a3771580fd20d0570fb From 14419036770d45319d9d1fc8429961a9f2d0cdd6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Wed, 28 May 2025 13:15:12 +0200 Subject: [PATCH 26/72] Add python3-jinja2 depenency for system tests --- bind9-next.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/bind9-next.spec b/bind9-next.spec index 6aaff86..09fb13b 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -139,6 +139,7 @@ BuildRequires: perl(English) BuildRequires: python3-pytest # manual configuration requires this tool BuildRequires: iproute +BuildRequires: python3-jinja2 %if %{with SUDO} BuildRequires: libcap sudo %endif From 36cb7f44b0e2223f9781d1f02e81a8c31bbf7e55 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Wed, 28 May 2025 19:44:46 +0200 Subject: [PATCH 27/72] Skip qpdb_test on i386 --- bind-9.21-unittest-qpdb-i386.patch | 28 ++++++++++++++++++++++++++++ bind9-next.spec | 3 +++ 2 files changed, 31 insertions(+) create mode 100644 bind-9.21-unittest-qpdb-i386.patch diff --git a/bind-9.21-unittest-qpdb-i386.patch b/bind-9.21-unittest-qpdb-i386.patch new file mode 100644 index 0000000..beebc7e --- /dev/null +++ b/bind-9.21-unittest-qpdb-i386.patch @@ -0,0 +1,28 @@ +From 24812709bd8cd55bea217090387a93773b95aac1 Mon Sep 17 00:00:00 2001 +From: Petr Mensik +Date: Wed, 28 May 2025 19:40:05 +0200 +Subject: [PATCH] Skip often failing qpdb_test on i686 + +https://gitlab.isc.org/isc-projects/bind9/-/issues/5328 +--- + tests/dns/qpdb_test.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/tests/dns/qpdb_test.c b/tests/dns/qpdb_test.c +index 4b1de18..5301eb6 100644 +--- a/tests/dns/qpdb_test.c ++++ b/tests/dns/qpdb_test.c +@@ -225,8 +225,10 @@ ISC_LOOP_TEST_IMPL(overmempurge_longname) { + } + + ISC_TEST_LIST_START ++#ifndef __i386__ + ISC_TEST_ENTRY_CUSTOM(overmempurge_bigrdata, setup_managers, teardown_managers) + ISC_TEST_ENTRY_CUSTOM(overmempurge_longname, setup_managers, teardown_managers) ++#endif + ISC_TEST_LIST_END + + ISC_TEST_MAIN +-- +2.49.0 + diff --git a/bind9-next.spec b/bind9-next.spec index 09fb13b..47fa1cb 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -93,6 +93,9 @@ Source49: named-chroot.files Patch1: bind-9.16-redhat_doc.patch # Downstream only. TODO: find a cause and remove this workaround Patch3: bind-9.21-unittest-isc_rwlock-s390x.patch +# https://gitlab.isc.org/isc-projects/bind9/-/issues/5328 +# avoid often fails on i386, unsupported upstream +Patch4: bind-9.21-unittest-qpdb-i386.patch %{?systemd_ordering} Requires: coreutils From cc6cc5e76db03ff6a6f24894f2e7f443334e3422 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Thu, 29 May 2025 13:04:17 +0200 Subject: [PATCH 28/72] Replace skip with rcu_barrier https://gitlab.isc.org/isc-projects/bind9/-/issues/5328 --- bind-9.21-unittest-qpdb-i386.patch | 41 ++++++++++++++++++++---------- 1 file changed, 28 insertions(+), 13 deletions(-) diff --git a/bind-9.21-unittest-qpdb-i386.patch b/bind-9.21-unittest-qpdb-i386.patch index beebc7e..1701ded 100644 --- a/bind-9.21-unittest-qpdb-i386.patch +++ b/bind-9.21-unittest-qpdb-i386.patch @@ -1,28 +1,43 @@ -From 24812709bd8cd55bea217090387a93773b95aac1 Mon Sep 17 00:00:00 2001 +From 574db9dac1c4bd6b19da887a58da1126e336b9e5 Mon Sep 17 00:00:00 2001 From: Petr Mensik Date: Wed, 28 May 2025 19:40:05 +0200 -Subject: [PATCH] Skip often failing qpdb_test on i686 +Subject: [PATCH] Try rcu_barrier https://gitlab.isc.org/isc-projects/bind9/-/issues/5328 --- - tests/dns/qpdb_test.c | 2 ++ - 1 file changed, 2 insertions(+) + tests/dns/qpdb_test.c | 5 +++++ + 1 file changed, 5 insertions(+) diff --git a/tests/dns/qpdb_test.c b/tests/dns/qpdb_test.c -index 4b1de18..5301eb6 100644 +index 4b1de18..a11af52 100644 --- a/tests/dns/qpdb_test.c +++ b/tests/dns/qpdb_test.c -@@ -225,8 +225,10 @@ ISC_LOOP_TEST_IMPL(overmempurge_longname) { +@@ -24,6 +24,7 @@ + #include + + #include ++#include + #include + + #include +@@ -170,6 +171,8 @@ ISC_LOOP_TEST_IMPL(overmempurge_bigrdata) { + + dns_db_detach(&db); + isc_mem_detach(&mctx2); ++ ++ rcu_barrier(); + isc_loopmgr_shutdown(loopmgr); } - ISC_TEST_LIST_START -+#ifndef __i386__ - ISC_TEST_ENTRY_CUSTOM(overmempurge_bigrdata, setup_managers, teardown_managers) - ISC_TEST_ENTRY_CUSTOM(overmempurge_longname, setup_managers, teardown_managers) -+#endif - ISC_TEST_LIST_END +@@ -221,6 +224,8 @@ ISC_LOOP_TEST_IMPL(overmempurge_longname) { + + dns_db_detach(&db); + isc_mem_detach(&mctx2); ++ ++ rcu_barrier(); + isc_loopmgr_shutdown(loopmgr); + } - ISC_TEST_MAIN -- 2.49.0 From 39dabd3e38292102209f9b7f130fec5541152540 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Thu, 29 May 2025 14:18:42 +0200 Subject: [PATCH 29/72] Try catching crashes in unit tests and reporting backtrace Also try to use base64 tool to print compressed core dump into log. --- bind9-next.spec | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/bind9-next.spec b/bind9-next.spec index 47fa1cb..1cdea6c 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -131,6 +131,9 @@ BuildRequires: openssl-devel-engine BuildRequires: libcmocka-devel # Ensure we have lscpu BuildRequires: util-linux +# Catch failing unittests coredumps +BuildRequires: gdb +BuildRequires: xz %endif %if %{with UNITTEST} || %{with SYSTEMTEST} BuildRequires: softhsm @@ -426,6 +429,7 @@ export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0" pushd build CPUS=$(lscpu -p=cpu,core | grep -v '^#' | wc -l) THREADS="$CPUS" + COREPATTERN="$(cat /proc/sys/kernel/core_pattern)" %if %{without UNITTEST_ALL} export CI=true %endif @@ -434,12 +438,24 @@ export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0" THREADS=16 ulimit -n 8092 || : # Requires on some machines with many cores fi + echo "core.%%P" > /proc/sys/kernel/core_pattern || : e=0 %make_build unit -j${THREADS} || e=$? # Display details of failure cat tests/*/test-suite.log + + echo "$COREPATTERN" > /proc/sys/kernel/core_pattern || : if [ "$e" -ne 0 ]; then echo "ERROR: this build of BIND failed 'make unit'. Aborting." + for CORE in $(find -name 'core.*'); do + echo "# Found core: $CORE" + gdb --batch -ex 'bt full' -c "$CORE" + echo + xz -k "$CORE" + echo "# core base64 begin: $CORE" + base64 "$CORE.xz" + echo "# core base64 end: $CORE" + done exit $e; fi; [ "$CPUS" -gt 16 ] && ulimit -n $ORIGFILES || : From 7fe8c161383f2bb386cd9894f9a5013c46e5ba88 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Fri, 30 May 2025 16:15:41 +0200 Subject: [PATCH 30/72] Skip qpdb_test on some builders Alternate approach, just remove the unit test from list. --- bind9-next.spec | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/bind9-next.spec b/bind9-next.spec index 1cdea6c..f149a09 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -360,6 +360,13 @@ configure.ac sed -e 's/-W\s//' -i Makefile.docs %endif +%if %{with UNITTEST} +if grep 'Intel(R) Xeon(R) CPU E5-2670 v3' /proc/cpuinfo; then + echo "Detected builder troubling unit tests, skiping some" + # https://gitlab.isc.org/isc-projects/bind9/-/issues/5328 + sed -i -e 's/\sqpdb_test//' tests/dns/Makefile.am +fi +%endif autoreconf --force --install mkdir build From ffc57d2dc5d288cf4c4fa187dc9e05b1c0420f65 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Thu, 5 Jun 2025 20:06:32 +0200 Subject: [PATCH 31/72] Try limiting maximal tasks in unit tests Limit also number of internal tasks to some smaller number. https://gitlab.isc.org/isc-projects/bind9/-/issues/5328 --- bind9-next.spec | 2 ++ 1 file changed, 2 insertions(+) diff --git a/bind9-next.spec b/bind9-next.spec index f149a09..aee73f2 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -443,6 +443,8 @@ export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0" if [ "$CPUS" -gt 16 ]; then ORIGFILES=$(ulimit -n) THREADS=16 + # https://gitlab.isc.org/isc-projects/bind9/-/issues/5328 + export ISC_TASK_WORKERS="$THREADS" ulimit -n 8092 || : # Requires on some machines with many cores fi echo "core.%%P" > /proc/sys/kernel/core_pattern || : From 07899c889d96f45ee7c48670f54ce892c57e27b0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Thu, 5 Jun 2025 20:12:44 +0200 Subject: [PATCH 32/72] Revert "Skip qpdb_test on some builders" This reverts commit 7fe8c161383f2bb386cd9894f9a5013c46e5ba88. --- bind9-next.spec | 7 ------- 1 file changed, 7 deletions(-) diff --git a/bind9-next.spec b/bind9-next.spec index aee73f2..b8b3ca5 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -360,13 +360,6 @@ configure.ac sed -e 's/-W\s//' -i Makefile.docs %endif -%if %{with UNITTEST} -if grep 'Intel(R) Xeon(R) CPU E5-2670 v3' /proc/cpuinfo; then - echo "Detected builder troubling unit tests, skiping some" - # https://gitlab.isc.org/isc-projects/bind9/-/issues/5328 - sed -i -e 's/\sqpdb_test//' tests/dns/Makefile.am -fi -%endif autoreconf --force --install mkdir build From c2d352150279d13c440e4685cd8b747473f053b6 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 23 Jul 2025 17:41:56 +0000 Subject: [PATCH 33/72] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild From 3a608aabcf98728c302e098e28ff92a1e3d6c5f6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Wed, 30 Jul 2025 14:42:06 +0200 Subject: [PATCH 34/72] Update to 9.21.10 (rhbz#2380940) Security Fixes: - Fix a possible assertion failure when stale-answer-client-timeout is set to 0. New Features: - Add code paths to fully support PRIVATEDNS and PRIVATEOID keys. - Add named-makejournal tool. - Add support for the CO flag to dig. https://downloads.isc.org/isc/bind9/9.21.10/doc/arm/html/notes.html#notes-for-bind-9-21-10 --- bind9-next.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/bind9-next.spec b/bind9-next.spec index b8b3ca5..732b92c 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -55,7 +55,7 @@ Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv Name: bind9-next License: MPL-2.0 AND ISC AND BSD-3-clause AND Expat AND BSD-2-clause # -Version: 9.21.8 +Version: 9.21.10 Release: %autorelease Epoch: 32 Url: https://www.isc.org/downloads/bind/ diff --git a/sources b/sources index 06b6126..877f116 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.21.8.tar.xz) = 8fdba5fa9e8c4659119074b54477d22bfb7301f6244f8df8df9f4b45f0512374a071c0d0d3f0f8e06f668fa59aa8a56d269900b6f6431461a770f11e21443d19 -SHA512 (bind-9.21.8.tar.xz.asc) = c48d2e3607a4c346ff12be6da43a9103ab935058662a14bd20abe5193db8cdede38a52bc59a1ad45ff1264f72a6175c61266edab92df3a3771580fd20d0570fb +SHA512 (bind-9.21.10.tar.xz) = fa814d43f0e7ec137617f0f2772ebd2e008a647d2158fa1a7765e38551506ee704cc1c6106d4c620b571d16d7cdecb40a8b03943aaeca29f984a3bf19c6205d2 +SHA512 (bind-9.21.10.tar.xz.asc) = 0f25cf6a74b3cc8df1b3c043e5aa2ad772001b2bf9aea0e3b48db2bc207b4508c2848bbe293d81b4cd82011284e5c73463a24ed489120dc9cfa59c4e7698120e From 0982292286b13309c78a3cb1a953841272f6337b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Wed, 30 Jul 2025 16:39:27 +0200 Subject: [PATCH 35/72] Attempt to switch to meson build system --- bind9-next.spec | 83 ++++++++++++++++++++++++------------------------- 1 file changed, 40 insertions(+), 43 deletions(-) diff --git a/bind9-next.spec b/bind9-next.spec index 732b92c..1a76d00 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -108,12 +108,20 @@ Recommends: %{name}-utils %{name}-dnssec-utils Obsoletes: %{name}-pkcs11 < 32:9.18.4-2 Conflicts: bind-dyndb-ldap -BuildRequires: gcc, make -BuildRequires: openssl-devel, libtool, autoconf, pkgconfig, libcap-devel -BuildRequires: libidn2-devel, libxml2-devel +BuildRequires: gcc +BuildRequires: make +BuildRequires: openssl-devel +BuildRequires: libtool +BuildRequires: meson +BuildRequires: ninja-build +BuildRequires: pkgconfig +BuildRequires: libcap-devel +BuildRequires: libidn2-devel +BuildRequires: libxml2-devel BuildRequires: systemd-rpm-macros BuildRequires: selinux-policy -BuildRequires: findutils sed +BuildRequires: findutils +BuildRequires: sed BuildRequires: libnghttp2-devel BuildRequires: userspace-rcu-devel # Compress the changelog @@ -328,8 +336,6 @@ EOF %build -## We use out of tree configure/build for export libs -%define _configure "../configure" # normal and pkcs11 unit tests %define unit_prepare_build() \ @@ -351,48 +357,45 @@ CPPFLAGS="$CPPFLAGS -DOPENSSL_NO_ENGINE=1" export CFLAGS CPPFLAGS export STD_CDEFINES="$CPPFLAGS" -sed -i -e \ -'s/([bind_VERSION_EXTRA],\s*\([^)]*\))/([bind_VERSION_EXTRA], \1-RH)/' \ -configure.ac +#sed -i -e \ +#'s/([bind_VERSION_EXTRA],\s*\([^)]*\))/([bind_VERSION_EXTRA], \1-RH)/' \ +#configure.ac %if 0%{?rhel} && 0%{?rhel} < 9 # disable Sphinx warnings as errors, epel8 does not pass cleanly sed -e 's/-W\s//' -i Makefile.docs %endif -autoreconf --force --install -mkdir build - -pushd build LIBDIR_SUFFIX= export LIBDIR_SUFFIX -%configure \ - --with-pic \ - --disable-static \ + +%meson \ --includedir=%{_includedir}/bind9 \ - --with-libidn2 \ + -Didn=enabled \ %if %{with GEOIP2} - --with-maxminddb \ + -Dgeoip=enabled \ %endif %if %{with GSSTSIG} - --with-gssapi=yes \ + -Dgssapi=enabled \ %endif %if %{with LMDB} - --with-lmdb=yes \ + -Dlmdb=enabled \ %else - --with-lmdb=no \ + -Dlmdb=disabled \ %endif %if %{with JSON} - --with-json-c \ + -Dstats-json=enabled \ %endif %if %{with DNSTAP} - --enable-dnstap \ + -Ddnstap=enabled \ %endif %if %{with UNITTEST} - --with-cmocka \ + -Dcmocka=enabled \ +%endif +%if %{with DOC} + -Ddoc=enabled \ %endif - --enable-full-report \ ; %if %{with DNSTAP} pushd lib @@ -401,19 +404,17 @@ export LIBDIR_SUFFIX popd %endif -%make_build SPHINX_W='' +%meson_build %if %{with DOC} - %make_build doc SPHINX_W='' + %meson_build man arm arm-epub %endif -popd # build - # Compress changelog by default gzip doc/changelog/changelog-*.rst -%unit_prepare_build build -%systemtest_prepare_build build +#unit_prepare_build build +#systemtest_prepare_build build %check %if %{with UNITTEST} || %{with SYSTEMTEST} @@ -426,7 +427,6 @@ export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0" %endif %if %{with UNITTEST} - pushd build CPUS=$(lscpu -p=cpu,core | grep -v '^#' | wc -l) THREADS="$CPUS" COREPATTERN="$(cat /proc/sys/kernel/core_pattern)" @@ -442,7 +442,7 @@ export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0" fi echo "core.%%P" > /proc/sys/kernel/core_pattern || : e=0 - %make_build unit -j${THREADS} || e=$? + %meson_build unit -j${THREADS} || e=$? # Display details of failure cat tests/*/test-suite.log @@ -461,7 +461,6 @@ export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0" exit $e; fi; [ "$CPUS" -gt 16 ] && ulimit -n $ORIGFILES || : - popd ## End of UNITTEST %endif @@ -469,7 +468,7 @@ export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0" # Runs system test if ip addresses are already configured # or it is able to configure them SUDO= - pushd build/bin/tests/system/ + pushd bin/tests/system/ if perl ./testsock.pl then CONFIGURED=already @@ -490,10 +489,10 @@ export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0" if [ -n "$CONFIGURED" ] then set -e - pushd build/bin/tests + pushd bin/tests export CI_SYSTEM=yes # allow running tests as root chown -R ${USER} . # Can be unknown user - %make_build test 2>&1 | tee test.log + %meson_build test 2>&1 | tee test.log e=$? [ "$CONFIGURED" = build ] && $SUDO sh ./ifconfig.sh down popd @@ -531,9 +530,7 @@ popd touch ${RPM_BUILD_ROOT}/%{chroot_prefix}%{_sysconfdir}/named.conf #end chroot -pushd build -%make_install -popd +%meson_install # Remove unwanted files rm -f ${RPM_BUILD_ROOT}/etc/bind.keys @@ -580,8 +577,8 @@ popd %if %{with DOC} mkdir -p ${RPM_BUILD_ROOT}%{_pkgdocdir} -cp -a build/doc/arm/_build/html ${RPM_BUILD_ROOT}%{_pkgdocdir} -rm -rf ${RPM_BUILD_ROOT}%{_pkgdocdir}/html/.{buildinfo,doctrees} +#cp -a doc/arm/_build/html ${RPM_BUILD_ROOT}%{_pkgdocdir} +#rm -rf ${RPM_BUILD_ROOT}%{_pkgdocdir}/html/.{buildinfo,doctrees} # Backward compatible link to 9.11 documentation (cd ${RPM_BUILD_ROOT}%{_pkgdocdir} && ln -s html/index.html Bv9ARM.html) # Share static data from original sphinx package @@ -594,7 +591,7 @@ do ln -sr "${RPM_BUILD_ROOT}${DIR}" "$BINDTHEMEDIR" fi done -cp -p build/doc/arm/_build/epub/Bv9ARM.epub ${RPM_BUILD_ROOT}%{_pkgdocdir} +#cp -p doc/arm/_build/epub/Bv9ARM.epub ${RPM_BUILD_ROOT}%{_pkgdocdir} %endif # Ghost config files: From 7d2341cfb7bc15c79a5f7aea4fb5c41750e608c7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Thu, 31 Jul 2025 20:45:46 +0200 Subject: [PATCH 36/72] WIP: Pass meson build and test Install phase not yet solved. --- bind9-next.spec | 23 ++++++++--------------- 1 file changed, 8 insertions(+), 15 deletions(-) diff --git a/bind9-next.spec b/bind9-next.spec index 1a76d00..9e5f3cd 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -122,8 +122,10 @@ BuildRequires: systemd-rpm-macros BuildRequires: selinux-policy BuildRequires: findutils BuildRequires: sed +#BuildRequires: systemtap BuildRequires: libnghttp2-devel BuildRequires: userspace-rcu-devel +BuildRequires: pkgconfig(libedit) # Compress the changelog BuildRequires: gzip %if 0%{?fedora} @@ -334,6 +336,9 @@ g named %{bind_gid} u named %{bind_uid} 'Named' /var/named - EOF +# get rid of rpath issues +sed -e '/install_rpath:/ d' -i meson.build + %build @@ -373,6 +378,7 @@ export LIBDIR_SUFFIX %meson \ --includedir=%{_includedir}/bind9 \ -Didn=enabled \ + -Dtracing=disabled \ %if %{with GEOIP2} -Dgeoip=enabled \ %endif @@ -440,24 +446,11 @@ export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0" export ISC_TASK_WORKERS="$THREADS" ulimit -n 8092 || : # Requires on some machines with many cores fi - echo "core.%%P" > /proc/sys/kernel/core_pattern || : e=0 - %meson_build unit -j${THREADS} || e=$? - # Display details of failure - cat tests/*/test-suite.log + %meson_test --num-processes ${THREADS} || e=$? - echo "$COREPATTERN" > /proc/sys/kernel/core_pattern || : if [ "$e" -ne 0 ]; then - echo "ERROR: this build of BIND failed 'make unit'. Aborting." - for CORE in $(find -name 'core.*'); do - echo "# Found core: $CORE" - gdb --batch -ex 'bt full' -c "$CORE" - echo - xz -k "$CORE" - echo "# core base64 begin: $CORE" - base64 "$CORE.xz" - echo "# core base64 end: $CORE" - done + echo "ERROR: test failed. Aborting." exit $e; fi; [ "$CPUS" -gt 16 ] && ulimit -n $ORIGFILES || : From b2f0d0c0cff12bb010b1da62a374478d2a08bfa8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Thu, 31 Jul 2025 21:13:20 +0200 Subject: [PATCH 37/72] Make versioned libraries Devel package not yet solved. --- bind9-next.spec | 2 ++ meson-libs.patch | 62 ++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 64 insertions(+) create mode 100644 meson-libs.patch diff --git a/bind9-next.spec b/bind9-next.spec index 9e5f3cd..9f6f89c 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -96,6 +96,8 @@ Patch3: bind-9.21-unittest-isc_rwlock-s390x.patch # https://gitlab.isc.org/isc-projects/bind9/-/issues/5328 # avoid often fails on i386, unsupported upstream Patch4: bind-9.21-unittest-qpdb-i386.patch +# Downstream patch to include version in libraries +Patch5: meson-libs.patch %{?systemd_ordering} Requires: coreutils diff --git a/meson-libs.patch b/meson-libs.patch new file mode 100644 index 0000000..4ba0723 --- /dev/null +++ b/meson-libs.patch @@ -0,0 +1,62 @@ +From 0e03b4c1c4fed5b149969b25df2bc6b45a089b79 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= +Date: Thu, 31 Jul 2025 20:54:08 +0200 +Subject: [PATCH] Add version to shared libraries + +Allow coexistence of different bind libraries and utilities by it. +--- + meson.build | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/meson.build b/meson.build +index 432af24..dac4212 100644 +--- a/meson.build ++++ b/meson.build +@@ -957,7 +957,7 @@ subdir('util') + isc_srcconf = isc_srcset.apply(config, strict: false) + + libisc = library( +- 'isc', ++ 'isc-'+meson.project_version(), + isc_srcconf.sources(), + objects: isc_probe_objects, + install: true, +@@ -984,7 +984,7 @@ libisc_dep = declare_dependency( + dns_srcconf = dns_srcset.apply(config, strict: false) + + libdns = library( +- 'dns', ++ 'dns-'+meson.project_version(), + dns_srcconf.sources(), + include_directories: dns_inc, + install: true, +@@ -1018,7 +1018,7 @@ libdns_dep = declare_dependency( + ns_srcconf = ns_srcset.apply(config, strict: false) + + libns = library( +- 'ns', ++ 'ns-'+meson.project_version(), + ns_srcconf.sources(), + objects: ns_probe_objects, + install: true, +@@ -1044,7 +1044,7 @@ libns_dep = declare_dependency( + isccc_srcconf = isccc_srcset.apply(config, strict: false) + + libisccc = library( +- 'isccc', ++ 'isccc-'+meson.project_version(), + isccc_srcconf.sources(), + implicit_include_directories: false, + include_directories: isccc_inc, +@@ -1065,7 +1065,7 @@ libisccc_dep = declare_dependency( + isccfg_srcconf = isccfg_srcset.apply(config, strict: false) + + libisccfg = library( +- 'isccfg', ++ 'isccfg-'+meson.project_version(), + isccfg_srcconf.sources(), + implicit_include_directories: false, + include_directories: isccfg_inc, +-- +2.50.1 + From 75731f5eabcd2d4e0c11493bfbea66b71f9380ac Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Fri, 5 Sep 2025 17:25:14 +0200 Subject: [PATCH 38/72] Use smarter action on lograte script BIND 9.21 has rndc closelogs action, which just reopens logs and nothing more. Use that from logrotate. Skip this action if the log is empty. --- named.logrotate | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/named.logrotate b/named.logrotate index 5df448f..17f41d9 100644 --- a/named.logrotate +++ b/named.logrotate @@ -2,11 +2,8 @@ missingok su named named create 0644 named named + notifempty postrotate - /usr/bin/systemctl reload named.service > /dev/null 2>&1 || true - /usr/bin/systemctl reload named-chroot.service > /dev/null 2>&1 || true - /usr/bin/systemctl reload named-sdb.service > /dev/null 2>&1 || true - /usr/bin/systemctl reload named-sdb-chroot.service > /dev/null 2>&1 || true - /usr/bin/systemctl reload named-pkcs11.service > /dev/null 2>&1 || true + /usr/bin/rndc closelogs > /dev/null 2>&1 || true endscript } From 2a3d8b5d6ce2aeb230b380379d8b81f78b0d2ef7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Fri, 5 Sep 2025 18:02:20 +0200 Subject: [PATCH 39/72] Disable devel package and fix doc building --- bind9-next.spec | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/bind9-next.spec b/bind9-next.spec index 9f6f89c..0ede6b6 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -572,7 +572,8 @@ popd %if %{with DOC} mkdir -p ${RPM_BUILD_ROOT}%{_pkgdocdir} -#cp -a doc/arm/_build/html ${RPM_BUILD_ROOT}%{_pkgdocdir} +pushd %{_vpath_builddir} +cp -a arm/ ${RPM_BUILD_ROOT}%{_pkgdocdir}/html/ #rm -rf ${RPM_BUILD_ROOT}%{_pkgdocdir}/html/.{buildinfo,doctrees} # Backward compatible link to 9.11 documentation (cd ${RPM_BUILD_ROOT}%{_pkgdocdir} && ln -s html/index.html Bv9ARM.html) @@ -586,7 +587,10 @@ do ln -sr "${RPM_BUILD_ROOT}${DIR}" "$BINDTHEMEDIR" fi done -#cp -p doc/arm/_build/epub/Bv9ARM.epub ${RPM_BUILD_ROOT}%{_pkgdocdir} +cp -p arm-epub/Bv9ARM.epub ${RPM_BUILD_ROOT}%{_pkgdocdir} +popd +cp -p doc/changelog/changelog-history.rst* doc/notes/notes-*.rst* \ + ${RPM_BUILD_ROOT}%{_pkgdocdir} %endif # Ghost config files: @@ -732,6 +736,7 @@ fi; %{_bindir}/named-journalprint %{_bindir}/named-checkconf %{_bindir}/named-rrchecker +%{_bindir}/named-makejournal %{_bindir}/mdig %{_sbindir}/named %{_sbindir}/rndc* @@ -749,7 +754,8 @@ fi; %{_mandir}/man1/named-checkconf.1* %{_mandir}/man8/rndc-confgen.8* %{_mandir}/man1/named-journalprint.1* -%{_mandir}/man8/filter-*.8.gz +#{_mandir}/man1/named-makejournal.1* +%{_mandir}/man8/filter-*.8* %doc README.md named.conf.default %doc doc/changelog/changelog-9.*.rst* %doc sample/ @@ -831,6 +837,8 @@ fi; %{_bindir}/dnssec* %{_mandir}/man1/dnssec*.1* +%if 0 +# TODO: remove devel subpackage or create custom installation part %files devel %{_libdir}/libisccc.so %{_libdir}/libns.so @@ -845,6 +853,7 @@ fi; %{_includedir}/bind9/irs %{_includedir}/bind9/isc %{_includedir}/bind9/isccfg +%endif %files chroot %config(noreplace) %{_sysconfdir}/named-chroot.files @@ -891,8 +900,8 @@ fi; %doc %{_pkgdocdir}/html %doc %{_pkgdocdir}/Bv9ARM.html %doc %{_pkgdocdir}/Bv9ARM.epub -%doc doc/changelog/changelog-history.rst* -%doc doc/notes/notes-*.rst* +%doc %{_pkgdocdir}/changelog-history.rst* +%doc %{_pkgdocdir}/notes-*.rst* %endif %changelog From f903cdb74079742b2f9765437d8a09951fb04c7a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Fri, 5 Sep 2025 18:04:49 +0200 Subject: [PATCH 40/72] Update to 9.21.11 New Features: - Support for parsing DSYNC records has been added. Feature changes: - Reword the shut down hung fetch while resolving message. - Plugin extension in plugin path is now optional. - Add deprecation warnings for RSASHA1, RSASHA1-NSEC3SHA1, and DS digest type 1. And multiple bug fixes. https://downloads.isc.org/isc/bind9/9.21.11/doc/arm/html/notes.html#notes-for-bind-9-21-11 --- bind-9.21-unittest-qpdb-i386.patch | 24 +++++++++++------------- bind9-next.spec | 4 ++-- sources | 4 ++-- 3 files changed, 15 insertions(+), 17 deletions(-) diff --git a/bind-9.21-unittest-qpdb-i386.patch b/bind-9.21-unittest-qpdb-i386.patch index 1701ded..7c84880 100644 --- a/bind-9.21-unittest-qpdb-i386.patch +++ b/bind-9.21-unittest-qpdb-i386.patch @@ -1,15 +1,15 @@ -From 574db9dac1c4bd6b19da887a58da1126e336b9e5 Mon Sep 17 00:00:00 2001 +From af1e4bf375000fc532c55ff6df841661185a2451 Mon Sep 17 00:00:00 2001 From: Petr Mensik Date: Wed, 28 May 2025 19:40:05 +0200 Subject: [PATCH] Try rcu_barrier https://gitlab.isc.org/isc-projects/bind9/-/issues/5328 --- - tests/dns/qpdb_test.c | 5 +++++ - 1 file changed, 5 insertions(+) + tests/dns/qpdb_test.c | 3 +++ + 1 file changed, 3 insertions(+) diff --git a/tests/dns/qpdb_test.c b/tests/dns/qpdb_test.c -index 4b1de18..a11af52 100644 +index 1c840e2..b6ad0f4 100644 --- a/tests/dns/qpdb_test.c +++ b/tests/dns/qpdb_test.c @@ -24,6 +24,7 @@ @@ -20,24 +20,22 @@ index 4b1de18..a11af52 100644 #include #include -@@ -170,6 +171,8 @@ ISC_LOOP_TEST_IMPL(overmempurge_bigrdata) { +@@ -170,6 +171,7 @@ ISC_LOOP_TEST_IMPL(overmempurge_bigrdata) { dns_db_detach(&db); - isc_mem_detach(&mctx2); -+ + isc_mem_detach(&mctx); + rcu_barrier(); - isc_loopmgr_shutdown(loopmgr); + isc_loopmgr_shutdown(); } -@@ -221,6 +224,8 @@ ISC_LOOP_TEST_IMPL(overmempurge_longname) { +@@ -221,6 +223,7 @@ ISC_LOOP_TEST_IMPL(overmempurge_longname) { dns_db_detach(&db); - isc_mem_detach(&mctx2); -+ + isc_mem_detach(&mctx); + rcu_barrier(); - isc_loopmgr_shutdown(loopmgr); + isc_loopmgr_shutdown(); } -- -2.49.0 +2.51.0 diff --git a/bind9-next.spec b/bind9-next.spec index 0ede6b6..5ff8976 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -55,7 +55,7 @@ Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv Name: bind9-next License: MPL-2.0 AND ISC AND BSD-3-clause AND Expat AND BSD-2-clause # -Version: 9.21.10 +Version: 9.21.11 Release: %autorelease Epoch: 32 Url: https://www.isc.org/downloads/bind/ @@ -754,7 +754,7 @@ fi; %{_mandir}/man1/named-checkconf.1* %{_mandir}/man8/rndc-confgen.8* %{_mandir}/man1/named-journalprint.1* -#{_mandir}/man1/named-makejournal.1* +%{_mandir}/man1/named-makejournal.1* %{_mandir}/man8/filter-*.8* %doc README.md named.conf.default %doc doc/changelog/changelog-9.*.rst* diff --git a/sources b/sources index 877f116..d12b4a2 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.21.10.tar.xz) = fa814d43f0e7ec137617f0f2772ebd2e008a647d2158fa1a7765e38551506ee704cc1c6106d4c620b571d16d7cdecb40a8b03943aaeca29f984a3bf19c6205d2 -SHA512 (bind-9.21.10.tar.xz.asc) = 0f25cf6a74b3cc8df1b3c043e5aa2ad772001b2bf9aea0e3b48db2bc207b4508c2848bbe293d81b4cd82011284e5c73463a24ed489120dc9cfa59c4e7698120e +SHA512 (bind-9.21.11.tar.xz) = dc4a20fc063b6dcec18d5241117eeb741a1e9e8f9e0bdac2743458b87de6a5496fff1e610c3c0676ae65e76b2741c86badb83df5b9278df8595194687359b5d6 +SHA512 (bind-9.21.11.tar.xz.asc) = 25ada3e81c3f60665f0b7f8ef24ba6e81ebd85627126e03ffcfecb02c78aa3f309fc25dce258495c1f5087072f0abad8932b2cd009f85180a27a9bd5f8ed6e80 From 602ce8cc76f3fb41cb335aa343c6b9ce5e7551e6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Fri, 5 Sep 2025 18:29:26 +0200 Subject: [PATCH 41/72] Try fixing i686 platform --- bind9-next.spec | 17 ----------------- 1 file changed, 17 deletions(-) diff --git a/bind9-next.spec b/bind9-next.spec index 5ff8976..74bffb7 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -318,18 +318,6 @@ in HTML and PDF format. %endif %autosetup -n %{upname}-%{version} -p1 -# Sparc and s390 arches need to use -fPIE -%ifarch sparcv9 sparc64 s390 s390x -for i in bin/named/Makefile.am; do - sed -i 's|fpie|fPIE|g' $i -done -%endif - -%ifarch %{ix86} -# f40 FTBFS on quota_test, bug #2261010 - sed -e '/^\s*quota_test/ d' -i tests/isc/Makefile.am -%endif - :; # Create a sysusers.d config file @@ -368,11 +356,6 @@ export STD_CDEFINES="$CPPFLAGS" #'s/([bind_VERSION_EXTRA],\s*\([^)]*\))/([bind_VERSION_EXTRA], \1-RH)/' \ #configure.ac -%if 0%{?rhel} && 0%{?rhel} < 9 -# disable Sphinx warnings as errors, epel8 does not pass cleanly -sed -e 's/-W\s//' -i Makefile.docs -%endif - LIBDIR_SUFFIX= export LIBDIR_SUFFIX From 1b3cc2301226db467215d4c37de22a7fccd6ba35 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Fri, 5 Sep 2025 18:48:00 +0200 Subject: [PATCH 42/72] Reenable systemtap and dtrace These are enabled by default, just provide dependencies to pass automatic test. --- bind9-next.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/bind9-next.spec b/bind9-next.spec index 74bffb7..618986f 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -124,7 +124,6 @@ BuildRequires: systemd-rpm-macros BuildRequires: selinux-policy BuildRequires: findutils BuildRequires: sed -#BuildRequires: systemtap BuildRequires: libnghttp2-devel BuildRequires: userspace-rcu-devel BuildRequires: pkgconfig(libedit) @@ -187,7 +186,9 @@ BuildRequires: libtsan %endif %if %{with DTRACE} # https://gitlab.isc.org/isc-projects/bind9/-/issues/4041 -BuildRequires: systemtap-sdt-devel +BuildRequires: systemtap +BuildRequires: systemtap-sdt-devel +BuildRequires: systemtap-sdt-dtrace %endif %description @@ -363,7 +364,9 @@ export LIBDIR_SUFFIX %meson \ --includedir=%{_includedir}/bind9 \ -Didn=enabled \ +%if %{without DTRACE} -Dtracing=disabled \ +%endif %if %{with GEOIP2} -Dgeoip=enabled \ %endif From bf9234893ddad754cf0b06271ab745058dad9909 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Fri, 5 Sep 2025 19:45:43 +0200 Subject: [PATCH 43/72] Replace Expat license with MIT --- bind9-next.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bind9-next.spec b/bind9-next.spec index 618986f..39e1677 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -53,7 +53,7 @@ Conflicts: %1 \ Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server Name: bind9-next -License: MPL-2.0 AND ISC AND BSD-3-clause AND Expat AND BSD-2-clause +License: MPL-2.0 AND ISC AND BSD-3-clause AND MIT AND BSD-2-clause # Version: 9.21.11 Release: %autorelease From 1cdf57678be8e31950d6df23c359fccc7986a73f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Wed, 19 Jun 2024 20:41:31 +0200 Subject: [PATCH 44/72] Remove separate license subpackage Move license to libs subpackage, it is required for everything except documentation. Include license file in docs and bind-libs, avoid extra package just for single file. --- bind9-next.spec | 14 +++----------- 1 file changed, 3 insertions(+), 11 deletions(-) diff --git a/bind9-next.spec b/bind9-next.spec index 39e1677..ab02f0b 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -200,7 +200,8 @@ tools for verifying that the DNS server is operating properly. %package libs Summary: Libraries used by the BIND DNS packages -Requires: %{name}-license = %{epoch}:%{version}-%{release} +Provides: %{name}-license = %{epoch}:%{version}-%{release} +Obsoletes: %{name}-license < 32:9.21.11-5 Provides: %{name}-libs-lite = %{epoch}:%{version}-%{release} Obsoletes: %{name}-libs-lite < 32:9.16.13 Obsoletes: %{name}-pkcs11-libs < 32:9.18.4-2 @@ -209,13 +210,6 @@ Obsoletes: %{name}-pkcs11-libs < 32:9.18.4-2 Contains heavyweight version of BIND suite libraries used by both named DNS server and utilities in %{name}-utils package. -%package license -Summary: License of the BIND DNS suite -BuildArch:noarch - -%description license -Contains license of the BIND DNS suite. - %package utils Summary: Utilities for querying DNS name servers Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release} @@ -295,7 +289,6 @@ Based on the code from Jan "Yenya" Kasprzak %if %{with DOC} %package doc Summary: BIND 9 Administrator Reference Manual -Requires: %{name}-license = %{epoch}:%{version}-%{release} Requires: python3-sphinx_rtd_theme BuildArch: noarch @@ -777,8 +770,6 @@ fi; %{_libdir}/libdns-%{version}*.so %{_libdir}/libisc-%{version}*.so %{_libdir}/libisccfg-%{version}*.so - -%files license %{!?_licensedir:%global license %%doc} %license COPYRIGHT @@ -888,6 +879,7 @@ fi; %doc %{_pkgdocdir}/Bv9ARM.epub %doc %{_pkgdocdir}/changelog-history.rst* %doc %{_pkgdocdir}/notes-*.rst* +%license COPYRIGHT %endif %changelog From 7401d29d7fe5fabd8e1846710b884a32edd3be44 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Wed, 10 Sep 2025 22:38:34 +0200 Subject: [PATCH 45/72] Return back fortify=3 source Should fix rpminspect annocheck report. --- bind9-next.spec | 3 --- 1 file changed, 3 deletions(-) diff --git a/bind9-next.spec b/bind9-next.spec index ab02f0b..6804059 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -39,9 +39,6 @@ # Visit https://bugzilla.redhat.com/show_bug.cgi?id=1540300 %undefine _strict_symbol_defs_build -# BIND9 does not work with fortify 3 level, make builds work on Fedora -%global _fortify_level 2 - # Upstream package name %global upname bind # Provide only bind-utils on f37+, it has better behaviour From f71c2455259938cb3f957e0ff20e186228e27ac9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Wed, 10 Sep 2025 22:41:05 +0200 Subject: [PATCH 46/72] Update to 9.21.12 (rhbz#2394406) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit New Features: - Add a new option manual-mode to dnssec-policy. - Add a new option servfail-until-ready to response-policy zones. - Support for parsing HHIT and BRID records has been added. Removed Features: - Deprecate the tkey-gssapi-credential statement. - Obsolete the “tkey-domain” statement. Bug Fixes: - Prevent spurious SERVFAILs for certain 0-TTL resource records. - Fix unexpected termination if catalog-zones had undefined default-primaries. https://downloads.isc.org/isc/bind9/9.21.12/doc/arm/html/notes.html#notes-for-bind-9-21-12 --- bind9-next.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/bind9-next.spec b/bind9-next.spec index 6804059..3afc27d 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -52,7 +52,7 @@ Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv Name: bind9-next License: MPL-2.0 AND ISC AND BSD-3-clause AND MIT AND BSD-2-clause # -Version: 9.21.11 +Version: 9.21.12 Release: %autorelease Epoch: 32 Url: https://www.isc.org/downloads/bind/ diff --git a/sources b/sources index d12b4a2..ef3a8e7 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.21.11.tar.xz) = dc4a20fc063b6dcec18d5241117eeb741a1e9e8f9e0bdac2743458b87de6a5496fff1e610c3c0676ae65e76b2741c86badb83df5b9278df8595194687359b5d6 -SHA512 (bind-9.21.11.tar.xz.asc) = 25ada3e81c3f60665f0b7f8ef24ba6e81ebd85627126e03ffcfecb02c78aa3f309fc25dce258495c1f5087072f0abad8932b2cd009f85180a27a9bd5f8ed6e80 +SHA512 (bind-9.21.12.tar.xz) = aa881fbef7fc4913f9ace41fd6c7c154cd0533dc790a95018fa52add77f5253f6abea8b8c34d6f11c0c065a1973cf2d83d1635046c87500203df88b5290dc55e +SHA512 (bind-9.21.12.tar.xz.asc) = 956dfda33e728215a8178f7033fd346e47f07047a03535e50ceb7765f740e6ef9db7f6221e3411e37eec2d0434a889e19330723d1a74e47faa7c4d8056c23b2f From 9c905f8e3e929b837f158243565c67fa5aa9e9c5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Wed, 10 Sep 2025 23:08:11 +0200 Subject: [PATCH 47/72] Remove license and devel packages from README Remove also reference to DLZ removed during recent updates. [skip changelog] --- README.md | 4 ---- 1 file changed, 4 deletions(-) diff --git a/README.md b/README.md index b7cfab1..7f59b23 100644 --- a/README.md +++ b/README.md @@ -26,13 +26,9 @@ The package contains several subpackages, some of them can be disabled on rebuil * **bind9-next** -- *named* daemon providing DNS server * **bind9-next-utils** -- set of tools to analyse DNS responses or update entries (dig, host) * **bind9-next-doc** -- documentation for current bind, *BIND 9 Administrator Reference Manual*. -* **bind9-next-license** -- Shared license for all packages but bind-export-libs. * **bind9-next-libs** -- Shared libraries used by some others programs -* **bind9-next-devel** -- Development headers for libs. Can be disabled by `--without DEVEL` - ## Optional features * *GSSTSIG* -- Support for Kerberos authentication in BIND. * *LMDB* -- Support for dynamic database for managing runtime added zones. Provides faster removal of added zone with much less overhead. But requires lmdb linked to base libs. -* *DLZ* -- Support for dynamic loaded modules providing support for features *bind-sdb* provides, but only small module is required. From 702274da0491b9343f3fc11f8a3fdd9fac4f0003 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Thu, 11 Sep 2025 12:34:06 +0200 Subject: [PATCH 48/72] Meson libs include version in upstream already Libraries include version name right in the upstream. No need for downstream patch doing the same. --- bind9-next.spec | 2 -- meson-libs.patch | 62 ------------------------------------------------ 2 files changed, 64 deletions(-) delete mode 100644 meson-libs.patch diff --git a/bind9-next.spec b/bind9-next.spec index 3afc27d..db14ac0 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -93,8 +93,6 @@ Patch3: bind-9.21-unittest-isc_rwlock-s390x.patch # https://gitlab.isc.org/isc-projects/bind9/-/issues/5328 # avoid often fails on i386, unsupported upstream Patch4: bind-9.21-unittest-qpdb-i386.patch -# Downstream patch to include version in libraries -Patch5: meson-libs.patch %{?systemd_ordering} Requires: coreutils diff --git a/meson-libs.patch b/meson-libs.patch deleted file mode 100644 index 4ba0723..0000000 --- a/meson-libs.patch +++ /dev/null @@ -1,62 +0,0 @@ -From 0e03b4c1c4fed5b149969b25df2bc6b45a089b79 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= -Date: Thu, 31 Jul 2025 20:54:08 +0200 -Subject: [PATCH] Add version to shared libraries - -Allow coexistence of different bind libraries and utilities by it. ---- - meson.build | 10 +++++----- - 1 file changed, 5 insertions(+), 5 deletions(-) - -diff --git a/meson.build b/meson.build -index 432af24..dac4212 100644 ---- a/meson.build -+++ b/meson.build -@@ -957,7 +957,7 @@ subdir('util') - isc_srcconf = isc_srcset.apply(config, strict: false) - - libisc = library( -- 'isc', -+ 'isc-'+meson.project_version(), - isc_srcconf.sources(), - objects: isc_probe_objects, - install: true, -@@ -984,7 +984,7 @@ libisc_dep = declare_dependency( - dns_srcconf = dns_srcset.apply(config, strict: false) - - libdns = library( -- 'dns', -+ 'dns-'+meson.project_version(), - dns_srcconf.sources(), - include_directories: dns_inc, - install: true, -@@ -1018,7 +1018,7 @@ libdns_dep = declare_dependency( - ns_srcconf = ns_srcset.apply(config, strict: false) - - libns = library( -- 'ns', -+ 'ns-'+meson.project_version(), - ns_srcconf.sources(), - objects: ns_probe_objects, - install: true, -@@ -1044,7 +1044,7 @@ libns_dep = declare_dependency( - isccc_srcconf = isccc_srcset.apply(config, strict: false) - - libisccc = library( -- 'isccc', -+ 'isccc-'+meson.project_version(), - isccc_srcconf.sources(), - implicit_include_directories: false, - include_directories: isccc_inc, -@@ -1065,7 +1065,7 @@ libisccc_dep = declare_dependency( - isccfg_srcconf = isccfg_srcset.apply(config, strict: false) - - libisccfg = library( -- 'isccfg', -+ 'isccfg-'+meson.project_version(), - isccfg_srcconf.sources(), - implicit_include_directories: false, - include_directories: isccfg_inc, --- -2.50.1 - From 3b309a9098266d8c82cda44ef9754671593a1292 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Tue, 7 Oct 2025 17:08:00 +0200 Subject: [PATCH 49/72] Update a bit sample named.conf Have it possibly checked by named-checkconf. Make there secret present. --- named.conf.sample | 28 ++++++++++++---------------- 1 file changed, 12 insertions(+), 16 deletions(-) diff --git a/named.conf.sample b/named.conf.sample index 0f3ae98..61229b7 100644 --- a/named.conf.sample +++ b/named.conf.sample @@ -1,11 +1,11 @@ +# vim: ft=named: /* Sample named.conf BIND DNS server 'named' configuration file for the Red Hat BIND distribution. See the BIND Administrator's Reference Manual (ARM) for details, in: - file:///usr/share/doc/bind-{version}/arm/Bv9ARM.html - Also see the BIND Configuration GUI : /usr/bin/system-config-bind and - its manual. + file:///usr/share/doc/bind/html/index.html + Or on upstream site: https://bind9.readthedocs.org/ */ options @@ -47,6 +47,7 @@ options allow-query { localhost; }; allow-query-cache { localhost; }; + allow-transfer { localhost; }; /* Enable/disable recursion - recursion yes/no; @@ -64,7 +65,7 @@ options /* DNSSEC related options. See information about keys ("Trusted keys", bellow) */ /* Enable DNSSEC validation on recursive servers */ - dnssec-validation yes; + dnssec-validation auto; /* In Fedora we use /run/named instead of default /var/run/named so we have to configure paths properly. */ @@ -165,7 +166,7 @@ view "internal" zone "my.slave.internal.zone" { type secondary; file "slaves/my.slave.internal.zone.db"; - masters { /* put master nameserver IPs here */ 127.0.0.1; } ; + primaries { /* put master nameserver IPs here */ 127.0.0.1; } ; // put slave zones in the slaves/ directory so named can update them }; zone "my.ddns.internal.zone" { @@ -179,7 +180,8 @@ view "internal" key ddns_key { algorithm hmac-sha256; - secret "use /usr/sbin/ddns-confgen to generate TSIG keys"; + #secret "use /usr/sbin/ddns-confgen to generate TSIG keys"; + secret "dXNlIC91c3Ivc2Jpbi9kZG5zLWNvbmZnZW4gdG8gZ2VuZXJhdGUgVFNJRyBrZXlz"; }; view "external" @@ -212,19 +214,13 @@ view "external" This statement contains DNSSEC keys. If you want DNSSEC aware resolver you should configure at least one trusted key. - Note that no key written below is valid. Especially root key because root zone - is not signed yet. + Note that no key written below is valid. Especially root key is maintained in + /etc/named.root.key file. */ /* trust-anchors { // Root Key -. initial-key 257 3 8 "AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3 - +/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kv - ArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF - 0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+e - oZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfd - RUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwN - R1AkUTV74bU="; +. initial-ds 38696 8 2 "683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A4C0FB2B16"; // Key for forward zone example.com. static-key 257 3 8 "AwEAAZ0aqu1rJ6orJynrRfNpPmayJZoAx9Ic2/Rl9VQW @@ -238,6 +234,6 @@ example.com. static-key 257 3 8 "AwEAAZ0aqu1rJ6orJynrRfNpPmayJZoAx9Ic2/Rl9VQW // Key for reverse zone. -2.0.192.IN-ADDRPA.NET. initial-ds 31406 8 2 "F78CF3344F72137235098ECBBD08947C2C9001C7F6A085A17F518B5D8F6B916D"; +2.0.192.IN-ADDRPA.NET. static-ds 31406 8 2 "F78CF3344F72137235098ECBBD08947C2C9001C7F6A085A17F518B5D8F6B916D"; }; */ From 75e66e6628e5899e6233391eb6c3e769c84a56fe Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Thu, 30 Oct 2025 13:33:48 +0100 Subject: [PATCH 50/72] Update to 9.21.14 (rhbz#2394406) Security Fixes: - DNSSEC validation fails if matching but invalid DNSKEY is found. (CVE-2025-8677) - Address various spoofing attacks. (CVE-2025-40778) - Cache-poisoning due to weak pseudo-random number generator. (CVE-2025-40780) New Features: - Add dnssec-policy keys configuration check to named-checkconf. - Add support for synthetic records. - Support for zone-specific plugins. - Support for additional tokens in the zone file name template. Removed Features: - Remove randomized RRset ordering. and bug fixes https://downloads.isc.org/isc/bind9/9.21.14/doc/arm/html/notes.html#notes-for-bind-9-21-14 --- bind9-next.spec | 4 +++- sources | 4 ++-- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/bind9-next.spec b/bind9-next.spec index db14ac0..53b72ab 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -52,7 +52,7 @@ Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv Name: bind9-next License: MPL-2.0 AND ISC AND BSD-3-clause AND MIT AND BSD-2-clause # -Version: 9.21.12 +Version: 9.21.14 Release: %autorelease Epoch: 32 Url: https://www.isc.org/downloads/bind/ @@ -352,6 +352,7 @@ export LIBDIR_SUFFIX %meson \ --includedir=%{_includedir}/bind9 \ -Didn=enabled \ + -Dfuzzing=disabled \ %if %{without DTRACE} -Dtracing=disabled \ %endif @@ -698,6 +699,7 @@ fi; # FIXME: current build targets filters into %%_libdir/bind again? %dir %{_libdir}/bind %{_libdir}/bind/filter*.so +%{_libdir}/bind/synthrecord.so %dir %{_libdir}/named %config(noreplace) %verify(not md5 size mtime) %{_sysconfdir}/sysconfig/named %config(noreplace) %attr(0644,root,named) %{_sysconfdir}/named.root.key diff --git a/sources b/sources index ef3a8e7..714e4db 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.21.12.tar.xz) = aa881fbef7fc4913f9ace41fd6c7c154cd0533dc790a95018fa52add77f5253f6abea8b8c34d6f11c0c065a1973cf2d83d1635046c87500203df88b5290dc55e -SHA512 (bind-9.21.12.tar.xz.asc) = 956dfda33e728215a8178f7033fd346e47f07047a03535e50ceb7765f740e6ef9db7f6221e3411e37eec2d0434a889e19330723d1a74e47faa7c4d8056c23b2f +SHA512 (bind-9.21.14.tar.xz) = bf4bd0f5613d6c6d53f749f3269a34f3a5c74a7dc81e05922d58ba30f19d418e565838dd1182dd6052b9a62b3799d2d0f12451f2797af3279259df59cfc4be05 +SHA512 (bind-9.21.14.tar.xz.asc) = 91ccc82ca54d07dba07821c3410f92b563290ead48546d605b0dbd9958a831d9b90130002fbb325e0cdc913de64813d8ba4c48ec958ebba7f5f462d43f578394 From 17658f2e301f8566ac9357b62846deb9db04150d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Thu, 6 Nov 2025 15:55:40 +0100 Subject: [PATCH 51/72] Prevent SERVFAIL on dual signed zones with one unsupported signature (rhbz#2413104) --- bind-9.21-dual-sign-continue-test.patch | 115 ++++++++++++++++++++++++ bind-9.21-dual-sign-continue.patch | 42 +++++++++ bind9-next.spec | 2 + 3 files changed, 159 insertions(+) create mode 100644 bind-9.21-dual-sign-continue-test.patch create mode 100644 bind-9.21-dual-sign-continue.patch diff --git a/bind-9.21-dual-sign-continue-test.patch b/bind-9.21-dual-sign-continue-test.patch new file mode 100644 index 0000000..18408af --- /dev/null +++ b/bind-9.21-dual-sign-continue-test.patch @@ -0,0 +1,115 @@ +From 488d7bfc75f2988c6e461b8677bc0e27e58bd82e Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= +Date: Sat, 1 Nov 2025 12:00:59 +0100 +Subject: [PATCH] Add a system test with one good and one bad algorithm + +The case where there would be one supported algorithm and one already +unsupported (like RSAMD5 or RSASHA1) was missing. +--- + bin/tests/system/dnssec/ns2/example.db.in | 4 +++ + bin/tests/system/dnssec/ns2/sign.sh | 2 +- + bin/tests/system/dnssec/ns3/named.conf.j2 | 6 ++++ + bin/tests/system/dnssec/ns3/sign.sh | 31 +++++++++++++++++++++ + bin/tests/system/dnssec/tests_validation.py | 8 ++++++ + 5 files changed, 50 insertions(+), 1 deletion(-) + +diff --git a/bin/tests/system/dnssec/ns2/example.db.in b/bin/tests/system/dnssec/ns2/example.db.in +index 47c2eb7f0e..07429366ee 100644 +--- a/bin/tests/system/dnssec/ns2/example.db.in ++++ b/bin/tests/system/dnssec/ns2/example.db.in +@@ -202,3 +202,7 @@ ns3.extradsunknownoid A 10.53.0.3 + + extended-ds-unknown-oid NS ns3.extended-ds-unknown-oid + ns3.extended-ds-unknown-oid A 10.53.0.3 ++ ++; A secure subdomain with extra bad key ++extrabadkey NS ns3.extrabadkey ++ns3.extrabadkey A 10.53.0.3 +diff --git a/bin/tests/system/dnssec/ns2/sign.sh b/bin/tests/system/dnssec/ns2/sign.sh +index e3f18af15e..da9f5f07fc 100644 +--- a/bin/tests/system/dnssec/ns2/sign.sh ++++ b/bin/tests/system/dnssec/ns2/sign.sh +@@ -92,7 +92,7 @@ for subdomain in digest-alg-unsupported ds-unsupported secure badds \ + dnskey-nsec3-unknown managed-future future revkey \ + dname-at-apex-nsec3 occluded rsasha1 rsasha1-1024 \ + rsasha256oid rsasha512oid unknownoid extradsoid extradsunknownoid \ +- extended-ds-unknown-oid; do ++ extended-ds-unknown-oid extrabadkey; do + cp "../ns3/dsset-$subdomain.example." . + done + +diff --git a/bin/tests/system/dnssec/ns3/named.conf.j2 b/bin/tests/system/dnssec/ns3/named.conf.j2 +index 1a0edc14bb..9cbc58892c 100644 +--- a/bin/tests/system/dnssec/ns3/named.conf.j2 ++++ b/bin/tests/system/dnssec/ns3/named.conf.j2 +@@ -141,6 +141,12 @@ zone "extrakey.example" { + allow-update { any; }; + }; + ++zone "extrabadkey.example" { ++ type primary; ++ file "extrabadkey.example.db.signed"; ++ allow-update { any; }; ++}; ++ + zone "insecure.nsec3.example" { + type primary; + file "insecure.nsec3.example.db"; +diff --git a/bin/tests/system/dnssec/ns3/sign.sh b/bin/tests/system/dnssec/ns3/sign.sh +index 5512888b2f..ea81381eb2 100644 +--- a/bin/tests/system/dnssec/ns3/sign.sh ++++ b/bin/tests/system/dnssec/ns3/sign.sh +@@ -905,3 +905,34 @@ ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone") + zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone") + cat "$infile" "$ksk.key" "$zsk.key" >"$zonefile" + "$SIGNER" -g -o "$zone" "$zonefile" >/dev/null 2>&1 ++ ++# ++# ++# ++zone=extrabadkey.example. ++infile=template.db.in ++zonefile=extrabadkey.example.db ++ ++# Add KSK and ZSK that we will mangle to RSAMD5 ++ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone") ++zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone") ++cat "$infile" "$ksk.key" "$zsk.key" >"$zonefile" ++"$SIGNER" -g -O full -o "$zone" "$zonefile" >/dev/null 2>&1 ++ ++# Mangle the signatures to RSAMD5 and save them for future use ++sed -ne "s/\(IN[[:space:]]*RRSIG[[:space:]]*[A-Z]*\) $DEFAULT_ALGORITHM_NUMBER /\1 1 /p" <"$zonefile.signed" >"$zonefile.signed.rsamd5" ++ ++# Now add normal KSK and ZSK to the zone file ++ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone") ++zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone") ++cat "$infile" "$ksk.key" "$zsk.key" >"$zonefile" ++ ++# Mangle the DNSKEY algorithm numbers and add them to the signed zone file ++cat "$ksk.key" "$zsk.key" | sed -e "s/\(IN[[:space:]]*DNSKEY[[:space:]]*[0-9]* 3\) $DEFAULT_ALGORITHM_NUMBER /\1 1 /" >>"$zonefile" ++ ++# Sign normally ++"$SIGNER" -g -o "$zone" "$zonefile" >/dev/null 2>&1 ++ ++# Add the mangled signatures to signed zone file ++cat "$zonefile.signed.rsamd5" >>"$zonefile.signed" ++rm "$zonefile.signed.rsamd5" +diff --git a/bin/tests/system/dnssec/tests_validation.py b/bin/tests/system/dnssec/tests_validation.py +index e6d8ccc734..a27a899987 100644 +--- a/bin/tests/system/dnssec/tests_validation.py ++++ b/bin/tests/system/dnssec/tests_validation.py +@@ -1385,3 +1385,11 @@ def test_rrsigs_for_glue(): + record.rdtype == rdatatype.RRSIG and record.covers == rdatatype.A + for record in res.answer + ) ++ ++ ++def test_extra_bad_algorithm(): ++ msg = isctest.query.create("a.extrabadkey.example", "A") ++ res1 = isctest.query.tcp(msg, "10.53.0.3") ++ res2 = isctest.query.tcp(msg, "10.53.0.4") ++ isctest.check.same_answer(res1, res2) ++ isctest.check.adflag(res2) +-- +2.51.1 + diff --git a/bind-9.21-dual-sign-continue.patch b/bind-9.21-dual-sign-continue.patch new file mode 100644 index 0000000..22e3cef --- /dev/null +++ b/bind-9.21-dual-sign-continue.patch @@ -0,0 +1,42 @@ +From a94a7c1a1e6eecbead995a08bace33d23899a5da Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= +Date: Tue, 4 Nov 2025 02:09:38 +0100 +Subject: [PATCH] Skip unsupported algorithms when looking for signing key +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +When looking for a signing key in select_signing_key(), the result code +indicating unsupported algorithm would abort the search. Instead, skip +such keys and continue searching for the right key. + +Co-Authored-By: Aram Sargsyan +Co-Authored-By: Petr Menšík +--- + lib/dns/validator.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/lib/dns/validator.c b/lib/dns/validator.c +index c6781544b9..52677fbd80 100644 +--- a/lib/dns/validator.c ++++ b/lib/dns/validator.c +@@ -1092,8 +1092,14 @@ select_signing_key(dns_validator_t *val, dns_rdataset_t *rdataset) { + continue; + } + +- return dns_dnssec_keyfromrdata(&siginfo->signer, &rdata, +- val->view->mctx, &val->key); ++ result = dns_dnssec_keyfromrdata(&siginfo->signer, &rdata, ++ val->view->mctx, &val->key); ++ /* Don't count unsupported algorithm towards max fails */ ++ if (result == DST_R_UNSUPPORTEDALG) { ++ /* Continue with the next key */ ++ continue; ++ } ++ return result; + } + + return ISC_R_NOTFOUND; +-- +2.51.1 + diff --git a/bind9-next.spec b/bind9-next.spec index 53b72ab..5d27915 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -93,6 +93,8 @@ Patch3: bind-9.21-unittest-isc_rwlock-s390x.patch # https://gitlab.isc.org/isc-projects/bind9/-/issues/5328 # avoid often fails on i386, unsupported upstream Patch4: bind-9.21-unittest-qpdb-i386.patch +Patch5: bind-9.21-dual-sign-continue.patch +Patch6: bind-9.21-dual-sign-continue-test.patch %{?systemd_ordering} Requires: coreutils From fcb909a9a9640619647f7f6421dc0704e51fb0ae Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 16 Jan 2026 04:24:06 +0000 Subject: [PATCH 52/72] Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild From 8b3576433e13bc1a5839e2f568cd52ad3ae4982a Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 16 Jan 2026 08:20:58 +0000 Subject: [PATCH 53/72] Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild From 5d8736bccddfcbdafecc161c3aa390473a287b1f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Tue, 11 Nov 2025 12:07:48 +0100 Subject: [PATCH 54/72] Fix running SYSTEMTEST during build Needs prepared network scripts. Can be used like: fedpkg mockbuild --enable-network --with SYSTEMTEST --- bind9-next.spec | 22 ++++++++++++++++------ 1 file changed, 16 insertions(+), 6 deletions(-) diff --git a/bind9-next.spec b/bind9-next.spec index 5d27915..fd0bb15 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -151,6 +151,8 @@ BuildRequires: softhsm BuildRequires: perl(Net::DNS) perl(Net::DNS::Nameserver) perl(Time::HiRes) perl(Getopt::Long) BuildRequires: perl(English) BuildRequires: python3-pytest +BuildRequires: python3-pytest-xdist +BuildRequires: python3-dns # manual configuration requires this tool BuildRequires: iproute BuildRequires: python3-jinja2 @@ -394,6 +396,9 @@ export LIBDIR_SUFFIX %if %{with DOC} %meson_build man arm arm-epub %endif +%if %{with SYSTEMTEST} + %meson_build system-test-dependencies +%endif # Compress changelog by default gzip doc/changelog/changelog-*.rst @@ -460,18 +465,23 @@ export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0" if [ -n "$CONFIGURED" ] then - set -e - pushd bin/tests + pushd bin/tests/system export CI_SYSTEM=yes # allow running tests as root chown -R ${USER} . # Can be unknown user - %meson_build test 2>&1 | tee test.log - e=$? + e=0 + pytest -n ${THREADS} --capture=tee-sys || e=$? [ "$CONFIGURED" = build ] && $SUDO sh ./ifconfig.sh down - popd if [ "$e" -ne 0 ]; then - echo "ERROR: this build of BIND failed 'make test'. Aborting." + echo "ERROR: failed running 'pytest' in system tests. Aborting." + ls -1 "$(pwd)"/*_tmp_* + for TMPTEST in *_tmp_* + do + echo "# $TMPTEST" + cat $TMPTEST/pytest.log.txt + done exit $e; fi; + popd else echo 'SKIPPED: tests require root, CAP_NET_ADMIN or already configured test addresses.' fi From 8ac024600e0649a582af044cfe54e5ba0fa10878 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Fri, 21 Nov 2025 22:32:42 +0100 Subject: [PATCH 55/72] Update to 9.21.15 (rhbz#2415843) New features: - New rndc showconf command. - named-checkconf -b dumps the built-in configuration. - named-checkconf -e prints the effective configuration. - Add support for Extended DNS Error 24 (Invalid Data). Removed features: - Remove the tkey-domain statement. - Remove the tkey-gssapi-credential statement. Feature changes: - Minimal Meson version required is 1.3.0. Bug fixes: - Skip unsupported algorithms when looking for a signing key. - Report when a zone reload is already in progress. - Fix dnssec-keygen key collision checking for KEY RRtype keys. - dnssec-verify now uses exit code 1 when failing due to illegal options. - Prevent assertion failures of dig when a server is specified before the -b option. - Skip buffer allocations if not logging. https://downloads.isc.org/isc/bind9/9.21.15/doc/arm/html/notes.html#notes-for-bind-9-21-15 --- bind-9.21-dual-sign-continue-test.patch | 115 ------------------------ bind-9.21-dual-sign-continue.patch | 42 --------- bind9-next.spec | 6 +- sources | 4 +- 4 files changed, 4 insertions(+), 163 deletions(-) delete mode 100644 bind-9.21-dual-sign-continue-test.patch delete mode 100644 bind-9.21-dual-sign-continue.patch diff --git a/bind-9.21-dual-sign-continue-test.patch b/bind-9.21-dual-sign-continue-test.patch deleted file mode 100644 index 18408af..0000000 --- a/bind-9.21-dual-sign-continue-test.patch +++ /dev/null @@ -1,115 +0,0 @@ -From 488d7bfc75f2988c6e461b8677bc0e27e58bd82e Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= -Date: Sat, 1 Nov 2025 12:00:59 +0100 -Subject: [PATCH] Add a system test with one good and one bad algorithm - -The case where there would be one supported algorithm and one already -unsupported (like RSAMD5 or RSASHA1) was missing. ---- - bin/tests/system/dnssec/ns2/example.db.in | 4 +++ - bin/tests/system/dnssec/ns2/sign.sh | 2 +- - bin/tests/system/dnssec/ns3/named.conf.j2 | 6 ++++ - bin/tests/system/dnssec/ns3/sign.sh | 31 +++++++++++++++++++++ - bin/tests/system/dnssec/tests_validation.py | 8 ++++++ - 5 files changed, 50 insertions(+), 1 deletion(-) - -diff --git a/bin/tests/system/dnssec/ns2/example.db.in b/bin/tests/system/dnssec/ns2/example.db.in -index 47c2eb7f0e..07429366ee 100644 ---- a/bin/tests/system/dnssec/ns2/example.db.in -+++ b/bin/tests/system/dnssec/ns2/example.db.in -@@ -202,3 +202,7 @@ ns3.extradsunknownoid A 10.53.0.3 - - extended-ds-unknown-oid NS ns3.extended-ds-unknown-oid - ns3.extended-ds-unknown-oid A 10.53.0.3 -+ -+; A secure subdomain with extra bad key -+extrabadkey NS ns3.extrabadkey -+ns3.extrabadkey A 10.53.0.3 -diff --git a/bin/tests/system/dnssec/ns2/sign.sh b/bin/tests/system/dnssec/ns2/sign.sh -index e3f18af15e..da9f5f07fc 100644 ---- a/bin/tests/system/dnssec/ns2/sign.sh -+++ b/bin/tests/system/dnssec/ns2/sign.sh -@@ -92,7 +92,7 @@ for subdomain in digest-alg-unsupported ds-unsupported secure badds \ - dnskey-nsec3-unknown managed-future future revkey \ - dname-at-apex-nsec3 occluded rsasha1 rsasha1-1024 \ - rsasha256oid rsasha512oid unknownoid extradsoid extradsunknownoid \ -- extended-ds-unknown-oid; do -+ extended-ds-unknown-oid extrabadkey; do - cp "../ns3/dsset-$subdomain.example." . - done - -diff --git a/bin/tests/system/dnssec/ns3/named.conf.j2 b/bin/tests/system/dnssec/ns3/named.conf.j2 -index 1a0edc14bb..9cbc58892c 100644 ---- a/bin/tests/system/dnssec/ns3/named.conf.j2 -+++ b/bin/tests/system/dnssec/ns3/named.conf.j2 -@@ -141,6 +141,12 @@ zone "extrakey.example" { - allow-update { any; }; - }; - -+zone "extrabadkey.example" { -+ type primary; -+ file "extrabadkey.example.db.signed"; -+ allow-update { any; }; -+}; -+ - zone "insecure.nsec3.example" { - type primary; - file "insecure.nsec3.example.db"; -diff --git a/bin/tests/system/dnssec/ns3/sign.sh b/bin/tests/system/dnssec/ns3/sign.sh -index 5512888b2f..ea81381eb2 100644 ---- a/bin/tests/system/dnssec/ns3/sign.sh -+++ b/bin/tests/system/dnssec/ns3/sign.sh -@@ -905,3 +905,34 @@ ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone") - zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone") - cat "$infile" "$ksk.key" "$zsk.key" >"$zonefile" - "$SIGNER" -g -o "$zone" "$zonefile" >/dev/null 2>&1 -+ -+# -+# -+# -+zone=extrabadkey.example. -+infile=template.db.in -+zonefile=extrabadkey.example.db -+ -+# Add KSK and ZSK that we will mangle to RSAMD5 -+ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone") -+zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone") -+cat "$infile" "$ksk.key" "$zsk.key" >"$zonefile" -+"$SIGNER" -g -O full -o "$zone" "$zonefile" >/dev/null 2>&1 -+ -+# Mangle the signatures to RSAMD5 and save them for future use -+sed -ne "s/\(IN[[:space:]]*RRSIG[[:space:]]*[A-Z]*\) $DEFAULT_ALGORITHM_NUMBER /\1 1 /p" <"$zonefile.signed" >"$zonefile.signed.rsamd5" -+ -+# Now add normal KSK and ZSK to the zone file -+ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone") -+zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone") -+cat "$infile" "$ksk.key" "$zsk.key" >"$zonefile" -+ -+# Mangle the DNSKEY algorithm numbers and add them to the signed zone file -+cat "$ksk.key" "$zsk.key" | sed -e "s/\(IN[[:space:]]*DNSKEY[[:space:]]*[0-9]* 3\) $DEFAULT_ALGORITHM_NUMBER /\1 1 /" >>"$zonefile" -+ -+# Sign normally -+"$SIGNER" -g -o "$zone" "$zonefile" >/dev/null 2>&1 -+ -+# Add the mangled signatures to signed zone file -+cat "$zonefile.signed.rsamd5" >>"$zonefile.signed" -+rm "$zonefile.signed.rsamd5" -diff --git a/bin/tests/system/dnssec/tests_validation.py b/bin/tests/system/dnssec/tests_validation.py -index e6d8ccc734..a27a899987 100644 ---- a/bin/tests/system/dnssec/tests_validation.py -+++ b/bin/tests/system/dnssec/tests_validation.py -@@ -1385,3 +1385,11 @@ def test_rrsigs_for_glue(): - record.rdtype == rdatatype.RRSIG and record.covers == rdatatype.A - for record in res.answer - ) -+ -+ -+def test_extra_bad_algorithm(): -+ msg = isctest.query.create("a.extrabadkey.example", "A") -+ res1 = isctest.query.tcp(msg, "10.53.0.3") -+ res2 = isctest.query.tcp(msg, "10.53.0.4") -+ isctest.check.same_answer(res1, res2) -+ isctest.check.adflag(res2) --- -2.51.1 - diff --git a/bind-9.21-dual-sign-continue.patch b/bind-9.21-dual-sign-continue.patch deleted file mode 100644 index 22e3cef..0000000 --- a/bind-9.21-dual-sign-continue.patch +++ /dev/null @@ -1,42 +0,0 @@ -From a94a7c1a1e6eecbead995a08bace33d23899a5da Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= -Date: Tue, 4 Nov 2025 02:09:38 +0100 -Subject: [PATCH] Skip unsupported algorithms when looking for signing key -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -When looking for a signing key in select_signing_key(), the result code -indicating unsupported algorithm would abort the search. Instead, skip -such keys and continue searching for the right key. - -Co-Authored-By: Aram Sargsyan -Co-Authored-By: Petr Menšík ---- - lib/dns/validator.c | 10 ++++++++-- - 1 file changed, 8 insertions(+), 2 deletions(-) - -diff --git a/lib/dns/validator.c b/lib/dns/validator.c -index c6781544b9..52677fbd80 100644 ---- a/lib/dns/validator.c -+++ b/lib/dns/validator.c -@@ -1092,8 +1092,14 @@ select_signing_key(dns_validator_t *val, dns_rdataset_t *rdataset) { - continue; - } - -- return dns_dnssec_keyfromrdata(&siginfo->signer, &rdata, -- val->view->mctx, &val->key); -+ result = dns_dnssec_keyfromrdata(&siginfo->signer, &rdata, -+ val->view->mctx, &val->key); -+ /* Don't count unsupported algorithm towards max fails */ -+ if (result == DST_R_UNSUPPORTEDALG) { -+ /* Continue with the next key */ -+ continue; -+ } -+ return result; - } - - return ISC_R_NOTFOUND; --- -2.51.1 - diff --git a/bind9-next.spec b/bind9-next.spec index fd0bb15..5dde8c8 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -52,7 +52,7 @@ Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv Name: bind9-next License: MPL-2.0 AND ISC AND BSD-3-clause AND MIT AND BSD-2-clause # -Version: 9.21.14 +Version: 9.21.15 Release: %autorelease Epoch: 32 Url: https://www.isc.org/downloads/bind/ @@ -93,8 +93,6 @@ Patch3: bind-9.21-unittest-isc_rwlock-s390x.patch # https://gitlab.isc.org/isc-projects/bind9/-/issues/5328 # avoid often fails on i386, unsupported upstream Patch4: bind-9.21-unittest-qpdb-i386.patch -Patch5: bind-9.21-dual-sign-continue.patch -Patch6: bind-9.21-dual-sign-continue-test.patch %{?systemd_ordering} Requires: coreutils @@ -111,7 +109,7 @@ BuildRequires: gcc BuildRequires: make BuildRequires: openssl-devel BuildRequires: libtool -BuildRequires: meson +BuildRequires: meson >= 1.3.0 BuildRequires: ninja-build BuildRequires: pkgconfig BuildRequires: libcap-devel diff --git a/sources b/sources index 714e4db..62a6afc 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.21.14.tar.xz) = bf4bd0f5613d6c6d53f749f3269a34f3a5c74a7dc81e05922d58ba30f19d418e565838dd1182dd6052b9a62b3799d2d0f12451f2797af3279259df59cfc4be05 -SHA512 (bind-9.21.14.tar.xz.asc) = 91ccc82ca54d07dba07821c3410f92b563290ead48546d605b0dbd9958a831d9b90130002fbb325e0cdc913de64813d8ba4c48ec958ebba7f5f462d43f578394 +SHA512 (bind-9.21.15.tar.xz) = 6c18c2a0a915e6c42036b6869a1d495872de7c94b67f036d8074a8d45c1cefff57d8df64b0d8a34611d3cdc1b09b2e6d3e4989d4cdf450643735e8ecb8d49d86 +SHA512 (bind-9.21.15.tar.xz.asc) = ca422a14adc3027a7301b628afad73dc2f5759456b27180402b707f30fba41dc9af4dfb2f0c8f25b1f1eed0a78dc16cabcd0ec19e5455966cf8e1b5a67296b57 From f0a10662c1d8844e0433b57a3c15211dcfcc1af2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Fri, 21 Nov 2025 23:51:11 +0100 Subject: [PATCH 56/72] Use dns-root-data package for hints source Use trusted root source and hints from separate package. --- bind9-next.spec | 26 ++++++++----- named-chroot.files | 1 + named-mkroot.sh | 20 ++++++++++ named.root | 92 ---------------------------------------------- named.root.key | 23 +++--------- trusted-key.key | 2 - 6 files changed, 42 insertions(+), 122 deletions(-) create mode 100755 named-mkroot.sh delete mode 100644 named.root delete mode 100644 trusted-key.key diff --git a/bind9-next.spec b/bind9-next.spec index 5dde8c8..3d287b6 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -30,7 +30,7 @@ %global chroot_prefix %{bind_dir}/chroot %global chroot_create_directories /dev /run/named %{_localstatedir}/{log,named,tmp} \\\ %{_sysconfdir}/{crypto-policies/back-ends,pki/dnssec-keys,pki/tls,named} \\\ - %{_libdir}/bind %{_libdir}/named %{_datadir}/GeoIP /proc/sys/net/ipv4 + %{_libdir}/bind %{_libdir}/named %{_datadir}/{GeoIP,dns-root-data} /proc/sys/net/ipv4 %global forgeurl0 https://gitlab.isc.org/isc-projects/bind9 @@ -64,17 +64,13 @@ Source2: https://downloads.isc.org/isc/bind9/%{version}/%{upname}-%{version}.ta Source3: named.logrotate Source4: https://www.isc.org/docs/isc-keyblock.asc Source16: named.conf -# Refresh by command: dig @a.root-servers.net. +tcp +norec -# or from URL -Source17: https://www.internic.net/domain/named.root Source18: named.localhost Source19: named.loopback Source20: named.empty Source23: named.rfc1912.zones Source25: named.conf.sample -Source27: named.root.key +Source27: named-mkroot.sh Source35: bind.tmpfiles.d -Source36: trusted-key.key Source37: named.service Source38: named-chroot.service Source41: setup-named-chroot.sh @@ -99,6 +95,7 @@ Requires: coreutils Requires(post): shadow-utils Requires(post): glibc-common Requires(post): grep +Requires: dns-root-data Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release} Recommends: %{name}-utils %{name}-dnssec-utils %upname_compat %{upname} @@ -122,6 +119,7 @@ BuildRequires: sed BuildRequires: libnghttp2-devel BuildRequires: userspace-rcu-devel BuildRequires: pkgconfig(libedit) +BuildRequires: dns-root-data # Compress the changelog BuildRequires: gzip %if 0%{?fedora} @@ -347,6 +345,10 @@ export STD_CDEFINES="$CPPFLAGS" #'s/([bind_VERSION_EXTRA],\s*\([^)]*\))/([bind_VERSION_EXTRA], \1-RH)/' \ #configure.ac +install -p -m 0755 %{SOURCE27} ./named-mkroot.sh # create named.root.key +./named-mkroot.sh +[ -f named.root.key ] + LIBDIR_SUFFIX= export LIBDIR_SUFFIX @@ -414,6 +416,10 @@ gzip doc/changelog/changelog-*.rst export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0" %endif +# We produce it runtime. Check it has valid syntax. +LD_LIBRARY_PATH="$LD_LIBRARY_PATH:${RPM_BUILD_ROOT}%{_libdir}" \ + ${RPM_BUILD_ROOT}%{_bindir}/named-checkconf ${RPM_BUILD_ROOT}%{_sysconfdir}/named.root.key + %if %{with UNITTEST} CPUS=$(lscpu -p=cpu,core | grep -v '^#' | wc -l) THREADS="$CPUS" @@ -584,13 +590,13 @@ touch ${RPM_BUILD_ROOT}%{_localstatedir}/log/named.log # configuration files: install -m 640 %{SOURCE16} ${RPM_BUILD_ROOT}%{_sysconfdir}/named.conf touch ${RPM_BUILD_ROOT}%{_sysconfdir}/rndc.{key,conf} -install -m 644 %{SOURCE27} ${RPM_BUILD_ROOT}%{_sysconfdir}/named.root.key -install -m 644 %{SOURCE36} ${RPM_BUILD_ROOT}%{_sysconfdir}/trusted-key.key +install -m 644 -p named.root.key ${RPM_BUILD_ROOT}%{_sysconfdir}/named.root.key +ln -s "%{_datadir}/dns-root-data/root.key" ${RPM_BUILD_ROOT}%{_sysconfdir}/trusted-key.key mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/named # data files: mkdir -p ${RPM_BUILD_ROOT}%{_localstatedir}/named -install -m 640 %{SOURCE17} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.ca +ln -s "%{_datadir}/dns-root-data/root.hints" ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.ca install -m 640 %{SOURCE18} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.localhost install -m 640 %{SOURCE19} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.loopback install -m 640 %{SOURCE20} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.empty @@ -603,7 +609,7 @@ install -m 644 %{SOURCE25} sample/etc/named.conf install -m 644 %{SOURCE16} named.conf.default install -m 644 %{SOURCE23} sample/etc/named.rfc1912.zones install -m 644 %{SOURCE18} %{SOURCE19} %{SOURCE20} sample/var/named -install -m 644 %{SOURCE17} sample/var/named/named.ca +ln -s "%{_datadir}/dns-root-data/root.hints" sample/var/named/named.ca for f in my.internal.zone.db slaves/my.slave.internal.zone.db slaves/my.ddns.internal.zone.db my.external.zone.db; do echo '@ in soa localhost. root 1 3H 15M 1W 1D ns localhost.' > sample/var/named/$f; diff --git a/named-chroot.files b/named-chroot.files index c186664..c901664 100644 --- a/named-chroot.files +++ b/named-chroot.files @@ -18,6 +18,7 @@ /usr/lib64/bind /usr/lib/bind /usr/share/GeoIP +/usr/share/dns-root-data /run/named /proc/sys/net/ipv4/ip_local_port_range # Warning: the order is important diff --git a/named-mkroot.sh b/named-mkroot.sh new file mode 100755 index 0000000..288725b --- /dev/null +++ b/named-mkroot.sh @@ -0,0 +1,20 @@ +#!/bin/sh +# Create named.root.key from dns-root-data package + +ROOT_DS=/usr/share/dns-root-data/root.ds +: ${OUTPUT:=named.root.key} + +if ! [ -r "$ROOT_DS" ]; then + echo "Root trust file is not readable: $ROOT_DS" + exit 1 +fi + +echo "# Autogenerated from $ROOT_DS" > "$OUTPUT" +echo "trust-anchors {" >> "$OUTPUT" +cat "$ROOT_DS" | while read DOMAIN CLS QTYPE KEYTAG ALG DIG HASH; +do + echo "$DOMAIN initial-ds $KEYTAG $ALG $DIG \"$HASH\";" >> "$OUTPUT"; +done +echo "}; " >> "$OUTPUT" +# Set the same modification time as data source. +touch -r $ROOT_DS "$OUTPUT" diff --git a/named.root b/named.root deleted file mode 100644 index 8b8a3b1..0000000 --- a/named.root +++ /dev/null @@ -1,92 +0,0 @@ -; This file holds the information on root name servers needed to -; initialize cache of Internet domain name servers -; (e.g. reference this file in the "cache . " -; configuration file of BIND domain name servers). -; -; This file is made available by InterNIC -; under anonymous FTP as -; file /domain/named.cache -; on server FTP.INTERNIC.NET -; -OR- RS.INTERNIC.NET -; -; last update: December 20, 2023 -; related version of root zone: 2023122001 -; -; FORMERLY NS.INTERNIC.NET -; -. 3600000 NS A.ROOT-SERVERS.NET. -A.ROOT-SERVERS.NET. 3600000 A 198.41.0.4 -A.ROOT-SERVERS.NET. 3600000 AAAA 2001:503:ba3e::2:30 -; -; FORMERLY NS1.ISI.EDU -; -. 3600000 NS B.ROOT-SERVERS.NET. -B.ROOT-SERVERS.NET. 3600000 A 170.247.170.2 -B.ROOT-SERVERS.NET. 3600000 AAAA 2801:1b8:10::b -; -; FORMERLY C.PSI.NET -; -. 3600000 NS C.ROOT-SERVERS.NET. -C.ROOT-SERVERS.NET. 3600000 A 192.33.4.12 -C.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:2::c -; -; FORMERLY TERP.UMD.EDU -; -. 3600000 NS D.ROOT-SERVERS.NET. -D.ROOT-SERVERS.NET. 3600000 A 199.7.91.13 -D.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:2d::d -; -; FORMERLY NS.NASA.GOV -; -. 3600000 NS E.ROOT-SERVERS.NET. -E.ROOT-SERVERS.NET. 3600000 A 192.203.230.10 -E.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:a8::e -; -; FORMERLY NS.ISC.ORG -; -. 3600000 NS F.ROOT-SERVERS.NET. -F.ROOT-SERVERS.NET. 3600000 A 192.5.5.241 -F.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:2f::f -; -; FORMERLY NS.NIC.DDN.MIL -; -. 3600000 NS G.ROOT-SERVERS.NET. -G.ROOT-SERVERS.NET. 3600000 A 192.112.36.4 -G.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:12::d0d -; -; FORMERLY AOS.ARL.ARMY.MIL -; -. 3600000 NS H.ROOT-SERVERS.NET. -H.ROOT-SERVERS.NET. 3600000 A 198.97.190.53 -H.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:1::53 -; -; FORMERLY NIC.NORDU.NET -; -. 3600000 NS I.ROOT-SERVERS.NET. -I.ROOT-SERVERS.NET. 3600000 A 192.36.148.17 -I.ROOT-SERVERS.NET. 3600000 AAAA 2001:7fe::53 -; -; OPERATED BY VERISIGN, INC. -; -. 3600000 NS J.ROOT-SERVERS.NET. -J.ROOT-SERVERS.NET. 3600000 A 192.58.128.30 -J.ROOT-SERVERS.NET. 3600000 AAAA 2001:503:c27::2:30 -; -; OPERATED BY RIPE NCC -; -. 3600000 NS K.ROOT-SERVERS.NET. -K.ROOT-SERVERS.NET. 3600000 A 193.0.14.129 -K.ROOT-SERVERS.NET. 3600000 AAAA 2001:7fd::1 -; -; OPERATED BY ICANN -; -. 3600000 NS L.ROOT-SERVERS.NET. -L.ROOT-SERVERS.NET. 3600000 A 199.7.83.42 -L.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:9f::42 -; -; OPERATED BY WIDE -; -. 3600000 NS M.ROOT-SERVERS.NET. -M.ROOT-SERVERS.NET. 3600000 A 202.12.27.33 -M.ROOT-SERVERS.NET. 3600000 AAAA 2001:dc3::35 -; End of file \ No newline at end of file diff --git a/named.root.key b/named.root.key index b57e61d..6d0904d 100644 --- a/named.root.key +++ b/named.root.key @@ -1,18 +1,5 @@ -trust-anchors { - # ROOT KEYS: See https://data.iana.org/root-anchors/root-anchors.xml - # for current trust anchor information. - # - # This key (20326) was published in the root zone in 2017. - # Servers which were already using the old key (19036) should - # roll seamlessly to this new one via RFC 5011 rollover. Servers - # being set up for the first time can use the contents of this - # file as initializing keys; thereafter, the keys in the - # managed key database will be trusted and maintained - # automatically. - . initial-ds 20326 8 2 "E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D"; - # This key (38696) will be pre-published in the root zone in 2025 - # and is scheduled to begin signing in late 2026. At that time, - # servers which were already using the old key (20326) should roll - # seamlessly to this new one via RFC 5011 rollover. - . initial-ds 38696 8 2 "683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A4C0FB2B16"; -}; +# Autogenerated from /usr/share/dns-root-data/root.ds +truste-anchors { +. initial-ds 20326 8 2 "E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D"; +. initial-ds 38696 8 2 "683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A4C0FB2B16"; +}; diff --git a/trusted-key.key b/trusted-key.key deleted file mode 100644 index 2ef50c7..0000000 --- a/trusted-key.key +++ /dev/null @@ -1,2 +0,0 @@ -. 3600 IN DNSKEY 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= -. 3600 IN DNSKEY 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdpWWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwuMoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBevYtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= From 6059fcadaa19d8625ea5534e43d27b81253b1687 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Fri, 16 Jan 2026 15:15:39 +0100 Subject: [PATCH 57/72] Update to 9.21.16 (rhbz#2415843) New Features: - Add +[no]showtruncated and +[no]showallmessages to dig. Feature Changes: - Reduce the number of outgoing queries. - Improve output of rndc dnssec -status - Change the QNAME minimization algorithm to follow the standard. - Enforce bounds of prefetch configuration option. - Enforce the fact that catalog zones cannot be used in non-IN views. - Provide more information when memory allocation fails. Bug Fixes: - Adding NSEC3 opt-out records could leave invalid records in chain. - Fix spurious timeouts while resolving names. - Fix bug where zone switches from NSEC3 to NSEC after retransfer. - Fix caching RRSIG covering cached NODATA record. - AMTRELAY type 0 presentation format handling was wrong. - Fix parsing bug in remote-servers with key or TLS. - Fix allow-recursion/allow-query-cache inheritance. - Fix DoT reconfigure/reload bug in the resolver. https://downloads.isc.org/isc/bind9/9.21.16/doc/arm/html/notes.html#notes-for-bind-9-21-16 --- bind9-next.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/bind9-next.spec b/bind9-next.spec index 3d287b6..f38af33 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -52,7 +52,7 @@ Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv Name: bind9-next License: MPL-2.0 AND ISC AND BSD-3-clause AND MIT AND BSD-2-clause # -Version: 9.21.15 +Version: 9.21.16 Release: %autorelease Epoch: 32 Url: https://www.isc.org/downloads/bind/ diff --git a/sources b/sources index 62a6afc..d0edb5d 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.21.15.tar.xz) = 6c18c2a0a915e6c42036b6869a1d495872de7c94b67f036d8074a8d45c1cefff57d8df64b0d8a34611d3cdc1b09b2e6d3e4989d4cdf450643735e8ecb8d49d86 -SHA512 (bind-9.21.15.tar.xz.asc) = ca422a14adc3027a7301b628afad73dc2f5759456b27180402b707f30fba41dc9af4dfb2f0c8f25b1f1eed0a78dc16cabcd0ec19e5455966cf8e1b5a67296b57 +SHA512 (bind-9.21.16.tar.xz) = 9536de96f80efe092e149fef9c4f71f022b3d9b8cbfa2ecf4aaa3bcf5afdc6b8a2d201d00b35f3c909161eb02b96fa587fd674c4fe292f96ba9ad91d6d86248e +SHA512 (bind-9.21.16.tar.xz.asc) = db21fc697957090055a9cc4f42aea78cb9c4d692c0754d96fb47ca38a76fdba227a3731c44fb5e4f129cfdf9301ffbe529305a4de1e49bdfb8ed5850e005cc6a From a4fb8fbe496e07da6afa8e5cb73129f95965381c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Mon, 19 Jan 2026 13:26:29 +0100 Subject: [PATCH 58/72] Fix build for RHEL, disable JEMALLOC there --- bind9-next.spec | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/bind9-next.spec b/bind9-next.spec index f38af33..b5253ed 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -22,6 +22,7 @@ %bcond_with TSAN %bcond_without DTRACE %bcond_with OPENSSL_ENGINE +%bcond JEMALLOC 0%{?fedora} %{?!bind_uid: %global bind_uid 25} %{?!bind_gid: %global bind_gid 25} @@ -122,9 +123,11 @@ BuildRequires: pkgconfig(libedit) BuildRequires: dns-root-data # Compress the changelog BuildRequires: gzip -%if 0%{?fedora} +%if %{with JEMALLOC} BuildRequires: jemalloc-devel -BuildRequires: gnupg2 +%endif +%if ! 0%{?rhel} +BuildRequires: gpgverify %endif BuildRequires: libuv-devel %if %{with OPENSSL_ENGINE} @@ -301,8 +304,8 @@ in HTML and PDF format. %endif %prep -%if 0%{?fedora} -# RHEL does not yet support this verification +%if ! 0%{?rhel} || 0%{?rhel} > 10 +# RHEL does not (again?) support this verification %{gpgverify} --keyring='%{SOURCE4}' --signature='%{SOURCE2}' --data='%{SOURCE0}' %endif %autosetup -n %{upname}-%{version} -p1 @@ -383,6 +386,9 @@ export LIBDIR_SUFFIX %if %{with DOC} -Ddoc=enabled \ %endif +%if %{without JEMALLOC} + -Djemalloc=disabled \ +%endif ; %if %{with DNSTAP} pushd lib From 7238eb8b29341bb8a4b7694223141ea6c19481de Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Thu, 22 Jan 2026 10:58:43 +0100 Subject: [PATCH 59/72] Update to 9.21.17 (rhbz#2415843) Security Fixes: - Fix incorrect length checks for BRID and HHIT records. (CVE-2025-13878) New Features: - Add support for Extended DNS Error 9 (Missing DNSKEY). - Add support for Extended DNS Error 13 (Cached Error). - Add support for Generalized DNS Notifications. Features Changes: - Add more information to the rndc recursing output about fetches. - Enforce bounds of multiple configuration options. Bug Fixes: - Fix inbound IXFR performance regression. - Make DNSSEC key rollovers more robust. - Fix a catalog zone issue, where member zones could fail to load. - Fix slow speed when signing a large delegation zone with NSEC3 opt-out. - Reconfiguring an NSEC3 opt-out zone to NSEC caused the zone to be invalid. - Fix a possible catalog zone issue during reconfiguration. - Fix the charts in the statistics channel. https://downloads.isc.org/isc/bind9/9.21.17/doc/arm/html/notes.html#notes-for-bind-9-21-17 --- bind9-next.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/bind9-next.spec b/bind9-next.spec index b5253ed..39018bf 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -53,7 +53,7 @@ Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv Name: bind9-next License: MPL-2.0 AND ISC AND BSD-3-clause AND MIT AND BSD-2-clause # -Version: 9.21.16 +Version: 9.21.17 Release: %autorelease Epoch: 32 Url: https://www.isc.org/downloads/bind/ diff --git a/sources b/sources index d0edb5d..5eede3e 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.21.16.tar.xz) = 9536de96f80efe092e149fef9c4f71f022b3d9b8cbfa2ecf4aaa3bcf5afdc6b8a2d201d00b35f3c909161eb02b96fa587fd674c4fe292f96ba9ad91d6d86248e -SHA512 (bind-9.21.16.tar.xz.asc) = db21fc697957090055a9cc4f42aea78cb9c4d692c0754d96fb47ca38a76fdba227a3731c44fb5e4f129cfdf9301ffbe529305a4de1e49bdfb8ed5850e005cc6a +SHA512 (bind-9.21.17.tar.xz) = b53fcea8db7d1b4e8fba7055f175289a7d1e3380be77e0899986101ffc3ff9222be5bf249b8f0162b0c88b0b463f42b778fa11f3ed86f913e17cd62561c65063 +SHA512 (bind-9.21.17.tar.xz.asc) = 62e344ae5deae40c4f647f4b99bee56d63cc7be5dd882f24993771c537eb7817dd2a5d2b8f6396fd906df9ef11afb4c1f874f61bd25329f50f7ca952d508482c From 6e8f7344bd22a90cfbafad5d93c90d6a0f6d56d1 Mon Sep 17 00:00:00 2001 From: Yanko Kaneti Date: Mon, 2 Feb 2026 18:27:38 +0200 Subject: [PATCH 60/72] Reduce test loops for tests/isc/{mutex/spinlock/rwlock} Allow rwlock(isc_rwlock_benchmark) to finish within the 300 seconds timeout limit on platforms (riscv64,s390x) where it is slow TODO: find out why it is slow --- bind-9.21-unittest-isc_rwlock-s390x.patch | 29 ----------------------- bind9-next.spec | 7 ++++-- 2 files changed, 5 insertions(+), 31 deletions(-) delete mode 100644 bind-9.21-unittest-isc_rwlock-s390x.patch diff --git a/bind-9.21-unittest-isc_rwlock-s390x.patch b/bind-9.21-unittest-isc_rwlock-s390x.patch deleted file mode 100644 index 5697450..0000000 --- a/bind-9.21-unittest-isc_rwlock-s390x.patch +++ /dev/null @@ -1,29 +0,0 @@ -From b8bc86834311e4ea27fe75052db08279045f027b Mon Sep 17 00:00:00 2001 -From: Petr Mensik -Date: Wed, 20 Nov 2024 15:34:29 +0100 -Subject: [PATCH] Skip isc_rwlock_benchmark on s390x - -Not sure why, but it repeatedly failed on isc_rwlock_benchmark function. -Not sure if it requires more time only or there is some strange error. ---- - tests/isc/rwlock_test.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/tests/isc/rwlock_test.c b/tests/isc/rwlock_test.c -index 4c5b8e0..a28b7d9 100644 ---- a/tests/isc/rwlock_test.c -+++ b/tests/isc/rwlock_test.c -@@ -340,7 +340,10 @@ ISC_TEST_ENTRY_CUSTOM(isc_rwlock_wrlock, rwlock_setup, rwlock_teardown) - #if !defined(__SANITIZE_THREAD__) - ISC_TEST_ENTRY_CUSTOM(isc_rwlock_tryupgrade, rwlock_setup, rwlock_teardown) - ISC_TEST_ENTRY_CUSTOM(isc_rwlock_trylock, rwlock_setup, rwlock_teardown) -+#ifndef __s390x__ -+// TODO: find why this stucks. - ISC_TEST_ENTRY_CUSTOM(isc_rwlock_benchmark, rwlock_setup, rwlock_teardown) -+#endif - #endif /* __SANITIZE_THREAD__ */ - - ISC_TEST_LIST_END --- -2.47.0 - diff --git a/bind9-next.spec b/bind9-next.spec index 39018bf..f941085 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -85,8 +85,6 @@ Source49: named-chroot.files # Common patches # Red Hat specific documentation is not relevant to upstream Patch1: bind-9.16-redhat_doc.patch -# Downstream only. TODO: find a cause and remove this workaround -Patch3: bind-9.21-unittest-isc_rwlock-s390x.patch # https://gitlab.isc.org/isc-projects/bind9/-/issues/5328 # avoid often fails on i386, unsupported upstream Patch4: bind-9.21-unittest-qpdb-i386.patch @@ -413,6 +411,11 @@ gzip doc/changelog/changelog-*.rst #systemtest_prepare_build build %check +# reduce test loops (from default 100) for isc/{mutex/spinlock/rwlock} +# to allow rwlock(isc_rwlock_benchmark) to finish within the 300 seconds +# timeout limit on platforms (riscv64,s390x) where it is slow +# TODO: find out why it is slow +export ISC_BENCHMARK_LOOPS=20 %if %{with UNITTEST} || %{with SYSTEMTEST} # Tests require initialization of pkcs11 token eval "$(bash %{SOURCE48} -A "`pwd`/softhsm-tokens")" From ad180eead35da6dfdcb4e65f7b60b32814ac18d1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Wed, 25 Mar 2026 19:36:24 +0100 Subject: [PATCH 61/72] Update to 9.21.20 (rhbz#2440560) Security Fixes: - Fix unbounded NSEC3 iterations when validating referrals to unsigned delegations. (CVE-2026-1519) - Fix memory leaks in code preparing DNSSEC proofs of non-existence. (CVE-2026-3104) - Prevent a crash in code processing queries containing a TKEY record. (CVE-2026-3119) - Fix a stack use-after-return flaw in SIG(0) handling code. (CVE-2026-3591) New Features: - Provide response round-trip time (RTT) counters via statistics channel. - Introduce max-delegation-servers configuration option. Bug Fixes: - Fix parsing key inactivation time in KASP code. - Fix the handling of key statements defined inside views. Source: https://downloads.isc.org/isc/bind9/9.21.20/doc/arm/html/notes.html#notes-for-bind-9-21-20 --- bind9-next.spec | 4 +++- sources | 4 ++-- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/bind9-next.spec b/bind9-next.spec index f941085..96bd47e 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -32,6 +32,8 @@ %global chroot_create_directories /dev /run/named %{_localstatedir}/{log,named,tmp} \\\ %{_sysconfdir}/{crypto-policies/back-ends,pki/dnssec-keys,pki/tls,named} \\\ %{_libdir}/bind %{_libdir}/named %{_datadir}/{GeoIP,dns-root-data} /proc/sys/net/ipv4 +%global upstream_sources 0 2 +%global pgp_signed_sources 2 %global forgeurl0 https://gitlab.isc.org/isc-projects/bind9 @@ -53,7 +55,7 @@ Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv Name: bind9-next License: MPL-2.0 AND ISC AND BSD-3-clause AND MIT AND BSD-2-clause # -Version: 9.21.17 +Version: 9.21.20 Release: %autorelease Epoch: 32 Url: https://www.isc.org/downloads/bind/ diff --git a/sources b/sources index 5eede3e..fa2afc0 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.21.17.tar.xz) = b53fcea8db7d1b4e8fba7055f175289a7d1e3380be77e0899986101ffc3ff9222be5bf249b8f0162b0c88b0b463f42b778fa11f3ed86f913e17cd62561c65063 -SHA512 (bind-9.21.17.tar.xz.asc) = 62e344ae5deae40c4f647f4b99bee56d63cc7be5dd882f24993771c537eb7817dd2a5d2b8f6396fd906df9ef11afb4c1f874f61bd25329f50f7ca952d508482c +SHA512 (bind-9.21.20.tar.xz) = 4bd65612ff851720eba7f88495d51eb8a41b6a946c377b9dcd62f58f8c5a3e9338af44abc9df76b2ead9461eca4eb81f088619e3cc481f35fa0fc5d0926a93e3 +SHA512 (bind-9.21.20.tar.xz.asc) = 7431540d942fe23222b2812f9d80e67d0fa38516f9d536095a6544b156dc0306aba5752ba6c03cc2935d92a74860e70e8fc53b4cb481b8afe226e49dd51f695f From 70ecf4eb59b2a7b9bc2f7026d297e149ee122963 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Wed, 8 Apr 2026 14:13:17 +0200 Subject: [PATCH 62/72] Update to 9.21.21 (rhbz#2453811) Security Fixes: - Fix crash when reconfiguring zone update policy during active updates. New Features: - Add switch to disable cookie checking in delv. Removed Features: - Remove -C option from dnssec-keygen and dnssec-keyfromlabel. - Remove NZF file support in favor of NZD. Feature Changes: - Parent-centric resolver. - Switch to LRU-only cache eviction, enforce minimum cache size. Bug Fixes: - Fix intermittent named crashes during asynchronous zone operations. - Count temporal problems with DNSSEC validation as attempts. - Fix a possible deadlock in RPZ processing. - Fix update-policy per-type max quota bypass via crafted UPDATE messages. - Fix a crash triggered by rndc modzone on a zone from a configuration file. - Fix the processing of empty catalog zone ACLs. - Fix potential resource leak during resolver error handling. Source: https://downloads.isc.org/isc/bind9/9.21.21/doc/arm/html/notes.html#notes-for-bind-9-21-21 --- bind9-next.spec | 9 +++------ sources | 4 ++-- 2 files changed, 5 insertions(+), 8 deletions(-) diff --git a/bind9-next.spec b/bind9-next.spec index 96bd47e..bb62fba 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -55,7 +55,7 @@ Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv Name: bind9-next License: MPL-2.0 AND ISC AND BSD-3-clause AND MIT AND BSD-2-clause # -Version: 9.21.20 +Version: 9.21.21 Release: %autorelease Epoch: 32 Url: https://www.isc.org/downloads/bind/ @@ -123,6 +123,7 @@ BuildRequires: pkgconfig(libedit) BuildRequires: dns-root-data # Compress the changelog BuildRequires: gzip +BuildRequires: pkgconfig(lmdb) %if %{with JEMALLOC} BuildRequires: jemalloc-devel %endif @@ -152,6 +153,7 @@ BuildRequires: perl(English) BuildRequires: python3-pytest BuildRequires: python3-pytest-xdist BuildRequires: python3-dns +BuildRequires: python3-hypothesis # manual configuration requires this tool BuildRequires: iproute BuildRequires: python3-jinja2 @@ -369,11 +371,6 @@ export LIBDIR_SUFFIX %if %{with GSSTSIG} -Dgssapi=enabled \ %endif -%if %{with LMDB} - -Dlmdb=enabled \ -%else - -Dlmdb=disabled \ -%endif %if %{with JSON} -Dstats-json=enabled \ %endif diff --git a/sources b/sources index fa2afc0..4641049 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.21.20.tar.xz) = 4bd65612ff851720eba7f88495d51eb8a41b6a946c377b9dcd62f58f8c5a3e9338af44abc9df76b2ead9461eca4eb81f088619e3cc481f35fa0fc5d0926a93e3 -SHA512 (bind-9.21.20.tar.xz.asc) = 7431540d942fe23222b2812f9d80e67d0fa38516f9d536095a6544b156dc0306aba5752ba6c03cc2935d92a74860e70e8fc53b4cb481b8afe226e49dd51f695f +SHA512 (bind-9.21.21.tar.xz) = ebb05d1141d38bd1897bb0de1475194ca6e9335e1a295ab388376d880de1a0569279b734433f469565eccdea91cc8e6e3603b2879be700bf27082ff075bdbe49 +SHA512 (bind-9.21.21.tar.xz.asc) = bad3fa0355742b57bc711c2f3f6bddd220bf5a5d4f5fa3b3ef9f2172247f184e637688080b0fc8cc67d37e1ee41bf484062f3a529d9942454b243a46091761b3 From 3fb06e6ad0706bffa43db6c9037cd7f7159c62e4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Wed, 8 Apr 2026 14:54:35 +0200 Subject: [PATCH 63/72] Remove LMDB conditional builds LMDB is now required, no conditional will help. Remove always present condition. --- bind9-next.spec | 14 ++------------ 1 file changed, 2 insertions(+), 12 deletions(-) diff --git a/bind9-next.spec b/bind9-next.spec index bb62fba..2562b0b 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -17,7 +17,6 @@ # Do not set CI environment, include more unit tests, even less stable %bcond_with UNITTEST_ALL %bcond_without DNSTAP -%bcond_without LMDB %bcond_without DOC %bcond_with TSAN %bcond_without DTRACE @@ -157,6 +156,7 @@ BuildRequires: python3-hypothesis # manual configuration requires this tool BuildRequires: iproute BuildRequires: python3-jinja2 +BuildRequires: lmdb-devel %if %{with SUDO} BuildRequires: libcap sudo %endif @@ -164,9 +164,6 @@ BuildRequires: libcap sudo %if %{with GSSTSIG} BuildRequires: krb5-devel %endif -%if %{with LMDB} -BuildRequires: lmdb-devel -%endif %if %{with JSON} BuildRequires: json-c-devel %endif @@ -251,13 +248,11 @@ Obsoletes: %{name}-lite-devel < 32:9.16.6-3 Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release} Requires: openssl-devel%{?_isa} libxml2-devel%{?_isa} Requires: libcap-devel%{?_isa} +Requires: lmdb-devel%{?_isa} %upname_compat %{upname}-devel %if %{with GSSTSIG} Requires: krb5-devel%{?_isa} %endif -%if %{with LMDB} -Requires: lmdb-devel%{?_isa} -%endif %if %{with JSON} Requires: json-c-devel%{?_isa} %endif @@ -558,9 +553,6 @@ find ${RPM_BUILD_ROOT}/%{_libdir} -name '*.la' -exec '/bin/rm' '-f' '{}' ';'; %if %{without DNSTAP} rm -f ${RPM_BUILD_ROOT}%{_mandir}/man1/dnstap-read.1* || true %endif -%if %{without LMDB} -rm -f ${RPM_BUILD_ROOT}%{_mandir}/man8/named-nzd2nzf.8* || true -%endif pushd ${RPM_BUILD_ROOT}%{_mandir}/man8 ln -s ddns-confgen.8.gz tsig-keygen.8.gz @@ -814,10 +806,8 @@ fi; %{_bindir}/dnstap-read %{_mandir}/man1/dnstap-read.1* %endif -%if %{with LMDB} %{_bindir}/named-nzd2nzf %{_mandir}/man1/named-nzd2nzf.1* -%endif %{_mandir}/man1/host.1* %{_mandir}/man1/nsupdate.1* %{_mandir}/man1/dig.1* From 33dbe7720fb0490e581b0a623a8486075db2821b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Thu, 9 Apr 2026 11:52:10 +0200 Subject: [PATCH 64/72] Switch devel libraries to pkgconfig dependencies Should be more portable across different distributions. --- bind9-next.spec | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/bind9-next.spec b/bind9-next.spec index 2562b0b..6b06eda 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -109,33 +109,33 @@ BuildRequires: libtool BuildRequires: meson >= 1.3.0 BuildRequires: ninja-build BuildRequires: pkgconfig -BuildRequires: libcap-devel -BuildRequires: libidn2-devel -BuildRequires: libxml2-devel +BuildRequires: pkgconfig(libcap) +BuildRequires: pkgconfig(libidn2) +BuildRequires: pkgconfig(libxml-2.0) BuildRequires: systemd-rpm-macros BuildRequires: selinux-policy BuildRequires: findutils BuildRequires: sed -BuildRequires: libnghttp2-devel -BuildRequires: userspace-rcu-devel +BuildRequires: pkgconfig(libnghttp2) +BuildRequires: pkgconfig(liburcu) BuildRequires: pkgconfig(libedit) BuildRequires: dns-root-data # Compress the changelog BuildRequires: gzip BuildRequires: pkgconfig(lmdb) %if %{with JEMALLOC} -BuildRequires: jemalloc-devel +BuildRequires: pkgconfig(jemalloc) %endif %if ! 0%{?rhel} BuildRequires: gpgverify %endif -BuildRequires: libuv-devel +BuildRequires: pkgconfig(libuv) %if %{with OPENSSL_ENGINE} BuildRequires: openssl-devel-engine %endif %if %{with UNITTEST} # make unit dependencies -BuildRequires: libcmocka-devel +BuildRequires: pkgconfig(cmocka) # Ensure we have lscpu BuildRequires: util-linux # Catch failing unittests coredumps @@ -246,7 +246,8 @@ Summary: Header files and libraries needed for bind-dyndb-ldap Provides: %{name}-lite-devel = %{epoch}:%{version}-%{release} Obsoletes: %{name}-lite-devel < 32:9.16.6-3 Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release} -Requires: openssl-devel%{?_isa} libxml2-devel%{?_isa} +Requires: openssl-devel%{?_isa} +Requires: libxml2-devel%{?_isa} Requires: libcap-devel%{?_isa} Requires: lmdb-devel%{?_isa} %upname_compat %{upname}-devel From e1d95fa29846dece9befcf2f4ad8543034d08c94 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Thu, 9 Apr 2026 11:52:58 +0200 Subject: [PATCH 65/72] Fix failing unittest on 32 bits --- bind-9.21-unittest-32b-mem.patch | 94 ++++++++++++++++++++++++++++++++ bind9-next.spec | 2 + 2 files changed, 96 insertions(+) create mode 100644 bind-9.21-unittest-32b-mem.patch diff --git a/bind-9.21-unittest-32b-mem.patch b/bind-9.21-unittest-32b-mem.patch new file mode 100644 index 0000000..ba968d8 --- /dev/null +++ b/bind-9.21-unittest-32b-mem.patch @@ -0,0 +1,94 @@ +From 0ec3954222bab0c7a74b379fc1982c55f89a90e4 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= +Date: Thu, 9 Apr 2026 10:51:57 +0200 +Subject: [PATCH] Accept significantly lower memory consumption on 32b system +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Memory usage might be significantly lower on legacy platforms. Allow +testing of them and pass there. Move repeated checks to shared +functions, include phase in minimal range to simplify identification of +failed place. + +Signed-off-by: Petr Menšík +--- + tests/dns/deleg_test.c | 27 +++++++++++++++++++++------ + 1 file changed, 21 insertions(+), 6 deletions(-) + +diff --git a/tests/dns/deleg_test.c b/tests/dns/deleg_test.c +index 904eaeef00..cc4772977f 100644 +--- a/tests/dns/deleg_test.c ++++ b/tests/dns/deleg_test.c +@@ -567,6 +567,22 @@ typedef struct { + isc_stdtime_t now; + } cleanup_ctx_t; + ++static void cleanuptests_memcheck1(isc_mem_t *mctx, unsigned int phase) { ++ size_t inuse = isc_mem_inuse(mctx); ++ if (sizeof(void *) == 4) ++ assert_int_in_range(inuse, 3100000+phase, 3300000); ++ else ++ assert_int_in_range(inuse, 4000000+phase, 4100000); ++} ++ ++static void cleanuptests_memcheck2(isc_mem_t *mctx, unsigned int phase) { ++ size_t inuse = isc_mem_inuse(mctx); ++ if (sizeof(void *) == 4) ++ assert_int_in_range(inuse, 6400000+phase, 6500000); ++ else ++ assert_int_in_range(inuse, 8000000+phase, 8100000); ++} ++ + static void + cleanuptests_phase3(void *arg) { + cleanup_ctx_t *ctx = arg; +@@ -575,7 +591,7 @@ cleanuptests_phase3(void *arg) { + dns_delegset_t *delegset = NULL; + isc_result_t result; + +- assert_int_in_range(isc_mem_inuse(db->mctx), 4000000, 4100000); ++ cleanuptests_memcheck1(db->mctx, 3); + + /* + * baz. is there, but bar. is gone, as it has been +@@ -600,7 +616,7 @@ cleanuptests_phase2(void *arg) { + dns_delegset_t *delegset = NULL; + isc_result_t result; + +- assert_int_in_range(isc_mem_inuse(db->mctx), 4000000, 4100000); ++ cleanuptests_memcheck1(db->mctx, 2); + + /* + * bar. is there +@@ -620,7 +636,7 @@ cleanuptests_phase2(void *arg) { + for (size_t i = 0; i < 99999; i++) { + addipdeleg(AF_INET6, "1111::2222", delegset, deleg); + } +- assert_int_in_range(isc_mem_inuse(db->mctx), 8000000, 8100000); ++ cleanuptests_memcheck2(db->mctx, 2); + writedb(db, "baz.", 30, &delegset, true); + deleg = NULL; + +@@ -669,8 +685,7 @@ cleanuptests(ISC_ATTR_UNUSED void *arg) { + addipdeleg(AF_INET6, "1111::2222", delegset, deleg); + } + +- assert_int_in_range(isc_mem_inuse(db->mctx), 4000000, 4100000); +- ++ cleanuptests_memcheck1(db->mctx, 1); + writedb(db, "stuff.", 10, &delegset, true); + deleg = NULL; + stdtime_now += 10; +@@ -691,7 +706,7 @@ cleanuptests(ISC_ATTR_UNUSED void *arg) { + * with DB mem context) overmem conditions will be detected, and the + * expired node will be removed + */ +- assert_int_in_range(isc_mem_inuse(db->mctx), 8000000, 8100000); ++ cleanuptests_memcheck2(db->mctx, 1); + writedb(db, "bar.", 30, &delegset, true); + deleg = NULL; + +-- +2.53.0 + diff --git a/bind9-next.spec b/bind9-next.spec index 6b06eda..aaac824 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -89,6 +89,8 @@ Patch1: bind-9.16-redhat_doc.patch # https://gitlab.isc.org/isc-projects/bind9/-/issues/5328 # avoid often fails on i386, unsupported upstream Patch4: bind-9.21-unittest-qpdb-i386.patch +# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/11825 +Patch5: bind-9.21-unittest-32b-mem.patch %{?systemd_ordering} Requires: coreutils From cd2cf2d5762b95546c8b3b31427edd9be026df26 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Thu, 30 Apr 2026 19:05:23 +0200 Subject: [PATCH 66/72] Stop publishing rwtab.d/named It is not used for anything interesting anymore. Stop providing it. --- bind9-next.spec | 5 ----- named.rwtab | 6 ------ 2 files changed, 11 deletions(-) delete mode 100644 named.rwtab diff --git a/bind9-next.spec b/bind9-next.spec index aaac824..0696d42 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -77,7 +77,6 @@ Source37: named.service Source38: named-chroot.service Source41: setup-named-chroot.sh Source42: generate-rndc-key.sh -Source43: named.rwtab Source44: named-chroot-setup.service Source46: named-setup-rndc.service Source48: setup-named-softhsm.sh @@ -622,9 +621,6 @@ done mkdir -p ${RPM_BUILD_ROOT}%{_tmpfilesdir} install -m 644 %{SOURCE35} ${RPM_BUILD_ROOT}%{_tmpfilesdir}/named.conf -mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/rwtab.d -install -m 644 %{SOURCE43} ${RPM_BUILD_ROOT}%{_sysconfdir}/rwtab.d/named - install -m0644 -D bind9-next.sysusers.conf %{buildroot}%{_sysusersdir}/bind9-next.conf %post @@ -725,7 +721,6 @@ fi; %config(noreplace) %{_sysconfdir}/logrotate.d/named %{_tmpfilesdir}/named.conf %{_sysusersdir}/bind9-next.conf -%{_sysconfdir}/rwtab.d/named %{_unitdir}/named.service %{_unitdir}/named-setup-rndc.service %{_bindir}/named-journalprint diff --git a/named.rwtab b/named.rwtab deleted file mode 100644 index 2cb3a41..0000000 --- a/named.rwtab +++ /dev/null @@ -1,6 +0,0 @@ -dirs /var/named - -files /var/named/named.ca -files /var/named/named.empty -files /var/named/named.localhost -files /var/named/named.loopback From 683924bd6091ab2419c742025b7154bcc8f7633a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Wed, 29 Apr 2026 18:16:07 +0200 Subject: [PATCH 67/72] Remove unused forgotten files --- bind-9.11.12.tar.gz.asc | 16 --- bind-9.14.7.tar.gz.asc | 16 --- bind97-exportlib.patch | 226 ---------------------------------------- 3 files changed, 258 deletions(-) delete mode 100644 bind-9.11.12.tar.gz.asc delete mode 100644 bind-9.14.7.tar.gz.asc delete mode 100644 bind97-exportlib.patch diff --git a/bind-9.11.12.tar.gz.asc b/bind-9.11.12.tar.gz.asc deleted file mode 100644 index 6d7992f..0000000 --- a/bind-9.11.12.tar.gz.asc +++ /dev/null @@ -1,16 +0,0 @@ ------BEGIN PGP SIGNATURE----- - -iQIzBAABAgAdFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAl2WMooACgkQdLtrmky7 -PThv2RAAnXNLYTzXtH6ls29tRm5Hc+D6UaeqcWDNQ4BpkRVhrFxtukalGCi9mmB6 -NPJzFyXmaOW654pypCIuEgqJNFUpDtLzLzT7SUF+mhm+5plsaRSBnh4mq87l5KSp -twODAPnfCJV+HBk5RmToLEstAbGQ7xEBTyQtZoFkY+V7zEFwENKiCvWsoSWOkYR3 -zXo3sKjc83HV9ShbW/mCtbZf5L0qlbrKOAzqJfAFMhNNJi8kMbmr/Zi2sIfN+Rhv -g8HQo89Epv6r51yAdeED8idIX4rKjjcEtHrZeDmLdCcdHgSEj2sIlH92Joce6vL0 -S59A0rItIXm6fW8sz6WNpcj4tVtWYbIYjXZ4SPFNkaUrHv8cUekq+5vbI+v07Gh3 -2bhtDsDyTY5I1/AsY/EFmwkCAjUS00jZryBnuJpLB3v5JtUog4ek32yLBzPrqRBo -1876j4nlXAia8mG0OgJNWZ0gHyUPe/TgfR8fQDLmHxHHlKrJNTEwY6bLW8jzFTX1 -zk510fI1K7J9tiQgf5wcBQ2h3EBlqzDNIJDovoATzLYIf0HKyVegh/vnQdtdEhUR -1DzJAt3bsBfAP1AFfWPD/ACu5Zdm7SxY1wE/pjkwttDU3sRZqOfuwNBGeolu3cVN -O9/h1zsyVeVS0ui2vu4+V4EvNitmXsVbG2doDq9L5yBiIKGO2Ew= -=GCy6 ------END PGP SIGNATURE----- diff --git a/bind-9.14.7.tar.gz.asc b/bind-9.14.7.tar.gz.asc deleted file mode 100644 index 1134ae1..0000000 --- a/bind-9.14.7.tar.gz.asc +++ /dev/null @@ -1,16 +0,0 @@ ------BEGIN PGP SIGNATURE----- - -iQIzBAABAgAdFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAl2WMpEACgkQdLtrmky7 -PTh/sg//QbNRAQvADQfwF1PPo+JxB+3WzQ9oJAWeHbOoiubwkUwO9xE+BEnTNd5o -oM1lSLqFxNykOTaoeJlqPftPod1cxo7lSzkwflugGyB/59wliCpqCg053YV4x9mO -QggvA/E50+0FI/Om/7v4GHGADu/JE83FovOueWAB0LgqfDSD6QFcNFF9sUJJ4P7r -FcEXSWj8QbrHMWBKncZUOpD2ECotvtrYmi0DTHl1XfigESDQpWtsnTFuabCCsvkh -ch9wQRplAes2Mf/aS5tl1y0QKKBFuEjtGiTdgrDl6o9GLnx6CueX5saZehu2EVkr -fq2vEYUC2lRQSjuxSMMJ3L0TGUcl7+ixlAIISS2K9L5Xx7MhBXt/EH5KiKPfsEet -3EH+DhxV5uXjDU7MgvREnxT+ssV23e0HWTz4tVVQ9LpvYmWPIgLcSOhHCc57yoQF -c46V0f69dMWbMAlQ93EZSG274ZvpIszpK8+3hGI3/TuDFFgiQJeJJBFVtYJMle69 -3mEEclfzO7fBiXZFec6nVx2309bL64bafN7zszPKXl4XgoefOfD0v0eWqQT4fxfm -dnGC0qMqSZs5F+d0fISV5JUUNYzt9PZjvnzqLLGOeTF6l3/n9G1mmNsXcxJ1OEIF -6qh1oO7JTPjt0MFhKac4QjNQi/Bnp25O3I/PRyWZCbiwXkyvyQU= -=ZT7s ------END PGP SIGNATURE----- diff --git a/bind97-exportlib.patch b/bind97-exportlib.patch deleted file mode 100644 index 4468ef5..0000000 --- a/bind97-exportlib.patch +++ /dev/null @@ -1,226 +0,0 @@ -diff -up bind-9.9.3rc2/isc-config.sh.in.exportlib bind-9.9.3rc2/isc-config.sh.in -diff -up bind-9.9.3rc2/lib/export/dns/Makefile.in.exportlib bind-9.9.3rc2/lib/export/dns/Makefile.in ---- bind-9.9.3rc2/lib/export/dns/Makefile.in.exportlib 2013-04-30 08:38:46.000000000 +0200 -+++ bind-9.9.3rc2/lib/export/dns/Makefile.in 2013-05-13 10:45:22.574089729 +0200 -@@ -35,9 +35,9 @@ CDEFINES = -DUSE_MD5 @USE_OPENSSL@ @USE_ - - CWARNINGS = - --ISCLIBS = ../isc/libisc.@A@ -+ISCLIBS = ../isc/libisc-export.@A@ - --ISCDEPLIBS = ../isc/libisc.@A@ -+ISCDEPLIBS = ../isc/libisc-export.@A@ - - LIBS = @LIBS@ - -@@ -116,29 +116,29 @@ version.@O@: ${srcdir}/version.c - -DLIBAGE=${LIBAGE} \ - -c ${srcdir}/version.c - --libdns.@SA@: ${OBJS} -+libdns-export.@SA@: ${OBJS} - ${AR} ${ARFLAGS} $@ ${OBJS} - ${RANLIB} $@ - --libdns.la: ${OBJS} -+libdns-export.la: ${OBJS} - ${LIBTOOL_MODE_LINK} \ -- ${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libdns.la \ -+ ${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libdns-export.la \ - -rpath ${export_libdir} \ - -version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \ - ${OBJS} ${ISCLIBS} @DNS_CRYPTO_LIBS@ ${LIBS} - --timestamp: libdns.@A@ -+timestamp: libdns-export.@A@ - touch timestamp - - installdirs: - $(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${export_libdir} - - install:: timestamp installdirs -- ${LIBTOOL_MODE_INSTALL} ${INSTALL_DATA} libdns.@A@ \ -+ ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} libdns-export.@A@ \ - ${DESTDIR}${export_libdir}/ - - clean distclean:: -- rm -f libdns.@A@ timestamp -+ rm -f libdns-export.@A@ timestamp - rm -f gen code.h include/dns/enumtype.h include/dns/enumclass.h - rm -f include/dns/rdatastruct.h - -diff -up bind-9.9.3rc2/lib/export/irs/Makefile.in.exportlib bind-9.9.3rc2/lib/export/irs/Makefile.in ---- bind-9.9.3rc2/lib/export/irs/Makefile.in.exportlib 2013-04-30 08:38:46.000000000 +0200 -+++ bind-9.9.3rc2/lib/export/irs/Makefile.in 2013-05-13 10:45:22.575089729 +0200 -@@ -43,9 +43,9 @@ SRCS = context.c \ - gai_sterror.c getaddrinfo.c getnameinfo.c \ - resconf.c - --ISCLIBS = ../isc/libisc.@A@ --DNSLIBS = ../dns/libdns.@A@ --ISCCFGLIBS = ../isccfg/libisccfg.@A@ -+ISCLIBS = ../isc/libisc-export.@A@ -+DNSLIBS = ../dns/libdns-export.@A@ -+ISCCFGLIBS = ../isccfg/libisccfg-export.@A@ - - LIBS = @LIBS@ - -@@ -62,26 +62,26 @@ version.@O@: ${srcdir}/version.c - -DLIBAGE=${LIBAGE} \ - -c ${srcdir}/version.c - --libirs.@SA@: ${OBJS} version.@O@ -+libirs-export.@SA@: ${OBJS} version.@O@ - ${AR} ${ARFLAGS} $@ ${OBJS} version.@O@ - ${RANLIB} $@ - --libirs.la: ${OBJS} version.@O@ -+libirs-export.la: ${OBJS} version.@O@ - ${LIBTOOL_MODE_LINK} \ -- ${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libirs.la \ -+ ${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libirs-export.la \ - -rpath ${export_libdir} \ - -version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \ - ${OBJS} version.@O@ ${LIBS} ${ISCCFGLIBS} ${DNSLIBS} ${ISCLIBS} - --timestamp: libirs.@A@ -+timestamp: libirs-export.@A@ - touch timestamp - - installdirs: - $(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${export_libdir} - - install:: timestamp installdirs -- ${LIBTOOL_MODE_INSTALL} ${INSTALL_DATA} libirs.@A@ \ -+ ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} libirs-export.@A@ \ - ${DESTDIR}${export_libdir}/ - - clean distclean:: -- rm -f libirs.@A@ libirs.la timestamp -+ rm -f libirs-export.@A@ libirs-export.la timestamp -diff -up bind-9.9.3rc2/lib/export/isccfg/Makefile.in.exportlib bind-9.9.3rc2/lib/export/isccfg/Makefile.in ---- bind-9.9.3rc2/lib/export/isccfg/Makefile.in.exportlib 2013-04-30 08:38:46.000000000 +0200 -+++ bind-9.9.3rc2/lib/export/isccfg/Makefile.in 2013-05-13 10:45:22.576089729 +0200 -@@ -30,11 +30,11 @@ CINCLUDES = -I. ${DNS_INCLUDES} -I${expo - CDEFINES = - CWARNINGS = - --ISCLIBS = ../isc/libisc.@A@ --DNSLIBS = ../dns/libdns.@A@ @DNS_CRYPTO_LIBS@ -+ISCLIBS = ../isc/libisc-export.@A@ -+DNSLIBS = ../dns/libdns-export.@A@ @DNS_CRYPTO_LIBS@ - - ISCDEPLIBS = ../../lib/isc/libisc.@A@ --ISCCFGDEPLIBS = libisccfg.@A@ -+ISCCFGDEPLIBS = libisccfg-export.@A@ - - LIBS = @LIBS@ - -@@ -58,26 +58,26 @@ version.@O@: ${srcdir}/version.c - -DLIBAGE=${LIBAGE} \ - -c ${srcdir}/version.c - --libisccfg.@SA@: ${OBJS} -+libisccfg-export.@SA@: ${OBJS} - ${AR} ${ARFLAGS} $@ ${OBJS} - ${RANLIB} $@ - --libisccfg.la: ${OBJS} -+libisccfg-export.la: ${OBJS} - ${LIBTOOL_MODE_LINK} \ -- ${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisccfg.la \ -+ ${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisccfg-export.la \ - -rpath ${export_libdir} \ - -version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \ - ${OBJS} ${LIBS} ${DNSLIBS} ${ISCLIBS} - --timestamp: libisccfg.@A@ -+timestamp: libisccfg-export.@A@ - touch timestamp - - installdirs: - $(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${export_libdir} - - install:: timestamp installdirs -- ${LIBTOOL_MODE_INSTALL} ${INSTALL_DATA} libisccfg.@A@ \ -+ ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} libisccfg-export.@A@ \ - ${DESTDIR}${export_libdir}/ - - clean distclean:: -- rm -f libisccfg.@A@ timestamp -+ rm -f libisccfg-export.@A@ timestamp -diff -up bind-9.9.3rc2/lib/export/isc/Makefile.in.exportlib bind-9.9.3rc2/lib/export/isc/Makefile.in ---- bind-9.9.3rc2/lib/export/isc/Makefile.in.exportlib 2013-04-30 08:38:46.000000000 +0200 -+++ bind-9.9.3rc2/lib/export/isc/Makefile.in 2013-05-13 10:45:22.576089729 +0200 -@@ -100,6 +100,10 @@ SRCS = @ISC_EXTRA_SRCS@ \ - - LIBS = @LIBS@ - -+# Note: the order of SUBDIRS is important. -+# Attempt to disable parallel processing. -+.NOTPARALLEL: -+.NO_PARALLEL: - SUBDIRS = include unix nls @ISC_THREAD_DIR@ - TARGETS = timestamp - -@@ -113,26 +117,26 @@ version.@O@: ${srcdir}/version.c - -DLIBAGE=${LIBAGE} \ - -c ${srcdir}/version.c - --libisc.@SA@: ${OBJS} -+libisc-export.@SA@: ${OBJS} - ${AR} ${ARFLAGS} $@ ${OBJS} - ${RANLIB} $@ - --libisc.la: ${OBJS} -+libisc-export.la: ${OBJS} - ${LIBTOOL_MODE_LINK} \ -- ${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisc.la \ -+ ${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisc-export.la \ - -rpath ${export_libdir} \ - -version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \ - ${OBJS} ${LIBS} - --timestamp: libisc.@A@ -+timestamp: libisc-export.@A@ - touch timestamp - - installdirs: - $(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${export_libdir} - - install:: timestamp installdirs -- ${LIBTOOL_MODE_INSTALL} ${INSTALL_DATA} libisc.@A@ \ -+ ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} libisc-export.@A@ \ - ${DESTDIR}${export_libdir} - - clean distclean:: -- rm -f libisc.@A@ libisc.la timestamp -+ rm -f libisc-export.@A@ libisc-export.la timestamp -diff -up bind-9.9.3rc2/lib/export/samples/Makefile.in.exportlib bind-9.9.3rc2/lib/export/samples/Makefile.in ---- bind-9.9.3rc2/lib/export/samples/Makefile.in.exportlib 2013-04-30 08:38:46.000000000 +0200 -+++ bind-9.9.3rc2/lib/export/samples/Makefile.in 2013-05-13 10:45:22.577089729 +0200 -@@ -31,15 +31,15 @@ CINCLUDES = -I${srcdir}/include -I../dns - CDEFINES = - CWARNINGS = - --DNSLIBS = ../dns/libdns.@A@ @DNS_CRYPTO_LIBS@ --ISCLIBS = ../isc/libisc.@A@ --ISCCFGLIBS = ../isccfg/libisccfg.@A@ --IRSLIBS = ../irs/libirs.@A@ -+DNSLIBS = ../dns/libdns-export.@A@ @DNS_CRYPTO_LIBS@ -+ISCLIBS = ../isc/libisc-export.@A@ -+ISCCFGLIBS = ../isccfg/libisccfg-export.@A@ -+IRSLIBS = ../irs/libirs-export.@A@ - --DNSDEPLIBS = ../dns/libdns.@A@ --ISCDEPLIBS = ../isc/libisc.@A@ --ISCCFGDEPLIBS = ../isccfg/libisccfg.@A@ --IRSDEPLIBS = ../irs/libirs.@A@ -+DNSDEPLIBS = ../dns/libdns-export.@A@ -+ISCDEPLIBS = ../isc/libisc-export.@A@ -+ISCCFGDEPLIBS = ../isccfg/libisccfg-export.@A@ -+IRSDEPLIBS = ../irs/libirs-export.@A@ - - DEPLIBS = ${DNSDEPLIBS} ${ISCCFGDEPLIBS} ${ISCDEPLIBS} - From 4f4bfde477ee9f5686374bd72be0a782913421dc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Tue, 5 May 2026 12:23:31 +0200 Subject: [PATCH 68/72] Fix build with openssl4 (rhbz#2463851) Use upstream way to fix problem with openssl 4.0. That is removing whole openssl crypto tracking. --- bind-9.21-openssl4-malloc.patch | 150 ++++++++++++++++++++++++++++++++ bind9-next.spec | 2 + 2 files changed, 152 insertions(+) create mode 100644 bind-9.21-openssl4-malloc.patch diff --git a/bind-9.21-openssl4-malloc.patch b/bind-9.21-openssl4-malloc.patch new file mode 100644 index 0000000..693cad4 --- /dev/null +++ b/bind-9.21-openssl4-malloc.patch @@ -0,0 +1,150 @@ +From c4b7f67b7d79150007412e370de3c21cc80057d6 Mon Sep 17 00:00:00 2001 +From: Aram Sargsyan +Date: Thu, 16 Apr 2026 17:31:04 +0000 +Subject: [PATCH] Remove OpenSSL memory tracking support from the ossl3.c + module + +OPENSSL_cleanup() in OpenSSL 4 doesn't free the memory, and that is +not compatible with BIND 9's memory leak detection code. Don't use +custom allocation/deallocation functions for OpenSSL's internal memory +management in the ossl3.c module. + +See https://github.com/openssl/openssl/pull/29721 + +(cherry picked from commit 4ede6edc547109af81dc5c5ec25cf3ff7991bc10) +--- + lib/isc/crypto/ossl3.c | 90 +++++------------------------------------- + 1 file changed, 9 insertions(+), 81 deletions(-) + +diff --git a/lib/isc/crypto/ossl3.c b/lib/isc/crypto/ossl3.c +index 1c2f3cab9d..35344dc8b1 100644 +--- a/lib/isc/crypto/ossl3.c ++++ b/lib/isc/crypto/ossl3.c +@@ -44,8 +44,6 @@ struct isc_hmac_key { + + constexpr uint32_t hmac_key_magic = ISC_MAGIC('H', 'M', 'A', 'C'); + +-static isc_mem_t *isc__crypto_mctx = NULL; +- + static OSSL_PROVIDER *base = NULL, *fips = NULL; + + static EVP_MAC *evp_hmac = NULL; +@@ -320,69 +318,6 @@ isc_hmac_final(isc_hmac_t *hmac, isc_buffer_t *out) { + return ISC_R_SUCCESS; + } + +-#if ISC_MEM_TRACKLINES +-/* +- * We use the internal isc__mem API here, so we can pass the file and line +- * arguments passed from OpenSSL >= 1.1.0 to our memory functions for better +- * tracking of the OpenSSL allocations. Without this, we would always just see +- * isc__crypto_{malloc,realloc,free} in the tracking output, but with this in +- * place we get to see the places in the OpenSSL code where the allocations +- * happen. +- */ +- +-static void * +-isc__crypto_malloc_ex(size_t size, const char *file, int line) { +- return isc__mem_allocate(isc__crypto_mctx, size, 0, __func__, file, +- (unsigned int)line); +-} +- +-static void * +-isc__crypto_realloc_ex(void *ptr, size_t size, const char *file, int line) { +- return isc__mem_reallocate(isc__crypto_mctx, ptr, size, 0, __func__, +- file, (unsigned int)line); +-} +- +-static void +-isc__crypto_free_ex(void *ptr, const char *file, int line) { +- if (ptr == NULL) { +- return; +- } +- if (isc__crypto_mctx != NULL) { +- isc__mem_free(isc__crypto_mctx, ptr, 0, __func__, file, +- (unsigned int)line); +- } +-} +- +-#else /* ISC_MEM_TRACKLINES */ +- +-static void * +-isc__crypto_malloc_ex(size_t size, const char *file, int line) { +- UNUSED(file); +- UNUSED(line); +- return isc_mem_allocate(isc__crypto_mctx, size); +-} +- +-static void * +-isc__crypto_realloc_ex(void *ptr, size_t size, const char *file, int line) { +- UNUSED(file); +- UNUSED(line); +- return isc_mem_reallocate(isc__crypto_mctx, ptr, size); +-} +- +-static void +-isc__crypto_free_ex(void *ptr, const char *file, int line) { +- UNUSED(file); +- UNUSED(line); +- if (ptr == NULL) { +- return; +- } +- if (isc__crypto_mctx != NULL) { +- isc__mem_free(isc__crypto_mctx, ptr, 0); +- } +-} +- +-#endif /* ISC_MEM_TRACKLINES */ +- + bool + isc_crypto_fips_mode(void) { + return EVP_default_properties_is_fips_enabled(NULL) != 0; +@@ -424,9 +359,17 @@ isc_crypto_fips_enable(void) { + return ISC_R_SUCCESS; + } + ++/* ++ * OPENSSL_cleanup() in OpenSSL 4 doesn't free the memory, which is not ++ * compatible with BIND 9's memory leak detection code, that is why the memory ++ * tracking has been disabled in this module, and this function is a no-op. ++ * This can be cleaned up once OpenSSL 1.1.x support is removed. ++ * ++ * See https://github.com/openssl/openssl/pull/29721 ++ */ + void + isc__crypto_setdestroycheck(bool check) { +- isc_mem_setdestroycheck(isc__crypto_mctx, check); ++ UNUSED(check); + } + + void +@@ -437,19 +380,6 @@ isc__crypto_initialize(void) { + */ + uint64_t opts = OPENSSL_INIT_LOAD_CONFIG | OPENSSL_INIT_NO_ATEXIT; + +- isc_mem_create("OpenSSL", &isc__crypto_mctx); +- isc_mem_setdebugging(isc__crypto_mctx, 0); +- isc_mem_setdestroycheck(isc__crypto_mctx, false); +- +- /* +- * CRYPTO_set_mem_(_ex)_functions() returns 1 on success or 0 on +- * failure, which means OpenSSL already allocated some memory. There's +- * nothing we can do about it. +- */ +- (void)CRYPTO_set_mem_functions(isc__crypto_malloc_ex, +- isc__crypto_realloc_ex, +- isc__crypto_free_ex); +- + RUNTIME_CHECK(OPENSSL_init_ssl(opts, NULL) == 1); + + register_algorithms(); +@@ -486,6 +416,4 @@ isc__crypto_shutdown(void) { + } + + OPENSSL_cleanup(); +- +- isc_mem_detach(&isc__crypto_mctx); + } +-- +2.54.0 + diff --git a/bind9-next.spec b/bind9-next.spec index 0696d42..c7343da 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -90,6 +90,8 @@ Patch1: bind-9.16-redhat_doc.patch Patch4: bind-9.21-unittest-qpdb-i386.patch # https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/11825 Patch5: bind-9.21-unittest-32b-mem.patch +# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/11865 +Patch6: bind-9.21-openssl4-malloc.patch %{?systemd_ordering} Requires: coreutils From 7ec75a1e1cf5c78d7fbddc15e415d63e0cfde575 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Wed, 3 Jun 2026 12:05:47 +0200 Subject: [PATCH 69/72] Update to 9.21.22 (rhbz#2480122) Security Fixes: - Limit resolver server list size. (CVE-2026-3592) - Fix GSS-API resource leak. (CVE-2026-3039) - Disable recursion, UPDATE, and NOTIFY for non-IN views. (CVE-2026-5946) - Avoid unbounded recursion loop. (CVE-2026-5950) - Fix crash in resolver when SIG(0)-signed responses are received under load. (CVE-2026-5947) - Fix use-after-free error in DNS-over-HTTPS when processing HTTP/2 SETTINGS frames. (CVE-2026-3593) - Fix outgoing zone transfers' quota issue. Feature Changes: - Fix CPU spikes and slow queries when cache approaches memory limit. - Implement RFC 3645 Section 4.1.1 key expiry check in TKEY. - Reduce memory footprint by actively returning unused memory to the OS. An multiple bugfixes. Source: https://downloads.isc.org/isc/bind9/9.21.22/doc/arm/html/notes.html#notes-for-bind-9-21-22 --- bind-9.21-openssl4-malloc.patch | 150 ------------------------------- bind-9.21-unittest-32b-mem.patch | 20 ++--- bind9-next.spec | 4 +- sources | 4 +- 4 files changed, 13 insertions(+), 165 deletions(-) delete mode 100644 bind-9.21-openssl4-malloc.patch diff --git a/bind-9.21-openssl4-malloc.patch b/bind-9.21-openssl4-malloc.patch deleted file mode 100644 index 693cad4..0000000 --- a/bind-9.21-openssl4-malloc.patch +++ /dev/null @@ -1,150 +0,0 @@ -From c4b7f67b7d79150007412e370de3c21cc80057d6 Mon Sep 17 00:00:00 2001 -From: Aram Sargsyan -Date: Thu, 16 Apr 2026 17:31:04 +0000 -Subject: [PATCH] Remove OpenSSL memory tracking support from the ossl3.c - module - -OPENSSL_cleanup() in OpenSSL 4 doesn't free the memory, and that is -not compatible with BIND 9's memory leak detection code. Don't use -custom allocation/deallocation functions for OpenSSL's internal memory -management in the ossl3.c module. - -See https://github.com/openssl/openssl/pull/29721 - -(cherry picked from commit 4ede6edc547109af81dc5c5ec25cf3ff7991bc10) ---- - lib/isc/crypto/ossl3.c | 90 +++++------------------------------------- - 1 file changed, 9 insertions(+), 81 deletions(-) - -diff --git a/lib/isc/crypto/ossl3.c b/lib/isc/crypto/ossl3.c -index 1c2f3cab9d..35344dc8b1 100644 ---- a/lib/isc/crypto/ossl3.c -+++ b/lib/isc/crypto/ossl3.c -@@ -44,8 +44,6 @@ struct isc_hmac_key { - - constexpr uint32_t hmac_key_magic = ISC_MAGIC('H', 'M', 'A', 'C'); - --static isc_mem_t *isc__crypto_mctx = NULL; -- - static OSSL_PROVIDER *base = NULL, *fips = NULL; - - static EVP_MAC *evp_hmac = NULL; -@@ -320,69 +318,6 @@ isc_hmac_final(isc_hmac_t *hmac, isc_buffer_t *out) { - return ISC_R_SUCCESS; - } - --#if ISC_MEM_TRACKLINES --/* -- * We use the internal isc__mem API here, so we can pass the file and line -- * arguments passed from OpenSSL >= 1.1.0 to our memory functions for better -- * tracking of the OpenSSL allocations. Without this, we would always just see -- * isc__crypto_{malloc,realloc,free} in the tracking output, but with this in -- * place we get to see the places in the OpenSSL code where the allocations -- * happen. -- */ -- --static void * --isc__crypto_malloc_ex(size_t size, const char *file, int line) { -- return isc__mem_allocate(isc__crypto_mctx, size, 0, __func__, file, -- (unsigned int)line); --} -- --static void * --isc__crypto_realloc_ex(void *ptr, size_t size, const char *file, int line) { -- return isc__mem_reallocate(isc__crypto_mctx, ptr, size, 0, __func__, -- file, (unsigned int)line); --} -- --static void --isc__crypto_free_ex(void *ptr, const char *file, int line) { -- if (ptr == NULL) { -- return; -- } -- if (isc__crypto_mctx != NULL) { -- isc__mem_free(isc__crypto_mctx, ptr, 0, __func__, file, -- (unsigned int)line); -- } --} -- --#else /* ISC_MEM_TRACKLINES */ -- --static void * --isc__crypto_malloc_ex(size_t size, const char *file, int line) { -- UNUSED(file); -- UNUSED(line); -- return isc_mem_allocate(isc__crypto_mctx, size); --} -- --static void * --isc__crypto_realloc_ex(void *ptr, size_t size, const char *file, int line) { -- UNUSED(file); -- UNUSED(line); -- return isc_mem_reallocate(isc__crypto_mctx, ptr, size); --} -- --static void --isc__crypto_free_ex(void *ptr, const char *file, int line) { -- UNUSED(file); -- UNUSED(line); -- if (ptr == NULL) { -- return; -- } -- if (isc__crypto_mctx != NULL) { -- isc__mem_free(isc__crypto_mctx, ptr, 0); -- } --} -- --#endif /* ISC_MEM_TRACKLINES */ -- - bool - isc_crypto_fips_mode(void) { - return EVP_default_properties_is_fips_enabled(NULL) != 0; -@@ -424,9 +359,17 @@ isc_crypto_fips_enable(void) { - return ISC_R_SUCCESS; - } - -+/* -+ * OPENSSL_cleanup() in OpenSSL 4 doesn't free the memory, which is not -+ * compatible with BIND 9's memory leak detection code, that is why the memory -+ * tracking has been disabled in this module, and this function is a no-op. -+ * This can be cleaned up once OpenSSL 1.1.x support is removed. -+ * -+ * See https://github.com/openssl/openssl/pull/29721 -+ */ - void - isc__crypto_setdestroycheck(bool check) { -- isc_mem_setdestroycheck(isc__crypto_mctx, check); -+ UNUSED(check); - } - - void -@@ -437,19 +380,6 @@ isc__crypto_initialize(void) { - */ - uint64_t opts = OPENSSL_INIT_LOAD_CONFIG | OPENSSL_INIT_NO_ATEXIT; - -- isc_mem_create("OpenSSL", &isc__crypto_mctx); -- isc_mem_setdebugging(isc__crypto_mctx, 0); -- isc_mem_setdestroycheck(isc__crypto_mctx, false); -- -- /* -- * CRYPTO_set_mem_(_ex)_functions() returns 1 on success or 0 on -- * failure, which means OpenSSL already allocated some memory. There's -- * nothing we can do about it. -- */ -- (void)CRYPTO_set_mem_functions(isc__crypto_malloc_ex, -- isc__crypto_realloc_ex, -- isc__crypto_free_ex); -- - RUNTIME_CHECK(OPENSSL_init_ssl(opts, NULL) == 1); - - register_algorithms(); -@@ -486,6 +416,4 @@ isc__crypto_shutdown(void) { - } - - OPENSSL_cleanup(); -- -- isc_mem_detach(&isc__crypto_mctx); - } --- -2.54.0 - diff --git a/bind-9.21-unittest-32b-mem.patch b/bind-9.21-unittest-32b-mem.patch index ba968d8..90dee92 100644 --- a/bind-9.21-unittest-32b-mem.patch +++ b/bind-9.21-unittest-32b-mem.patch @@ -1,4 +1,4 @@ -From 0ec3954222bab0c7a74b379fc1982c55f89a90e4 Mon Sep 17 00:00:00 2001 +From e81b125a9c7eb9222b5f8298bec689e23287969b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Thu, 9 Apr 2026 10:51:57 +0200 Subject: [PATCH] Accept significantly lower memory consumption on 32b system @@ -17,10 +17,10 @@ Signed-off-by: Petr Menšík 1 file changed, 21 insertions(+), 6 deletions(-) diff --git a/tests/dns/deleg_test.c b/tests/dns/deleg_test.c -index 904eaeef00..cc4772977f 100644 +index d3af6ab..cbab065 100644 --- a/tests/dns/deleg_test.c +++ b/tests/dns/deleg_test.c -@@ -567,6 +567,22 @@ typedef struct { +@@ -579,6 +579,22 @@ typedef struct { isc_stdtime_t now; } cleanup_ctx_t; @@ -43,16 +43,16 @@ index 904eaeef00..cc4772977f 100644 static void cleanuptests_phase3(void *arg) { cleanup_ctx_t *ctx = arg; -@@ -575,7 +591,7 @@ cleanuptests_phase3(void *arg) { +@@ -587,7 +603,7 @@ cleanuptests_phase3(void *arg) { dns_delegset_t *delegset = NULL; isc_result_t result; -- assert_int_in_range(isc_mem_inuse(db->mctx), 4000000, 4100000); +- assert_int_in_range(isc_mem_inuse(db->mctx), 8000000, 8100000); + cleanuptests_memcheck1(db->mctx, 3); /* * baz. is there, but bar. is gone, as it has been -@@ -600,7 +616,7 @@ cleanuptests_phase2(void *arg) { +@@ -612,7 +628,7 @@ cleanuptests_phase2(void *arg) { dns_delegset_t *delegset = NULL; isc_result_t result; @@ -61,7 +61,7 @@ index 904eaeef00..cc4772977f 100644 /* * bar. is there -@@ -620,7 +636,7 @@ cleanuptests_phase2(void *arg) { +@@ -632,7 +648,7 @@ cleanuptests_phase2(void *arg) { for (size_t i = 0; i < 99999; i++) { addipdeleg(AF_INET6, "1111::2222", delegset, deleg); } @@ -70,7 +70,7 @@ index 904eaeef00..cc4772977f 100644 writedb(db, "baz.", 30, &delegset, true); deleg = NULL; -@@ -669,8 +685,7 @@ cleanuptests(ISC_ATTR_UNUSED void *arg) { +@@ -681,8 +697,7 @@ cleanuptests(ISC_ATTR_UNUSED void *arg) { addipdeleg(AF_INET6, "1111::2222", delegset, deleg); } @@ -80,7 +80,7 @@ index 904eaeef00..cc4772977f 100644 writedb(db, "stuff.", 10, &delegset, true); deleg = NULL; stdtime_now += 10; -@@ -691,7 +706,7 @@ cleanuptests(ISC_ATTR_UNUSED void *arg) { +@@ -703,7 +718,7 @@ cleanuptests(ISC_ATTR_UNUSED void *arg) { * with DB mem context) overmem conditions will be detected, and the * expired node will be removed */ @@ -90,5 +90,5 @@ index 904eaeef00..cc4772977f 100644 deleg = NULL; -- -2.53.0 +2.54.0 diff --git a/bind9-next.spec b/bind9-next.spec index c7343da..2dc204d 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -54,7 +54,7 @@ Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv Name: bind9-next License: MPL-2.0 AND ISC AND BSD-3-clause AND MIT AND BSD-2-clause # -Version: 9.21.21 +Version: 9.21.22 Release: %autorelease Epoch: 32 Url: https://www.isc.org/downloads/bind/ @@ -90,8 +90,6 @@ Patch1: bind-9.16-redhat_doc.patch Patch4: bind-9.21-unittest-qpdb-i386.patch # https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/11825 Patch5: bind-9.21-unittest-32b-mem.patch -# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/11865 -Patch6: bind-9.21-openssl4-malloc.patch %{?systemd_ordering} Requires: coreutils diff --git a/sources b/sources index 4641049..c97ab7f 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.21.21.tar.xz) = ebb05d1141d38bd1897bb0de1475194ca6e9335e1a295ab388376d880de1a0569279b734433f469565eccdea91cc8e6e3603b2879be700bf27082ff075bdbe49 -SHA512 (bind-9.21.21.tar.xz.asc) = bad3fa0355742b57bc711c2f3f6bddd220bf5a5d4f5fa3b3ef9f2172247f184e637688080b0fc8cc67d37e1ee41bf484062f3a529d9942454b243a46091761b3 +SHA512 (bind-9.21.22.tar.xz) = f9e11d150162661c755dabdd7862c0565e6a10077e2a6aee04f8cefce94c262d8928ff9e42f8c8750242aee3b0992afe2f49f72f0f8cab8b7e4ae1c9fc06e0fa +SHA512 (bind-9.21.22.tar.xz.asc) = 1e0bd14fad5754e12b6a4855dbed698dba74468790948316e17442e5bc840fc81d18e590fd78186a1e26e9526870b13470dcef6a15644e91775cc8883813ad24 From e6c0c1b6974349b4dd6f99d6f72c8df0659fb9b9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Wed, 3 Jun 2026 16:36:26 +0200 Subject: [PATCH 70/72] Switch downstream change to upstream for 32b mem check Downstream fix was not working anymore and upstream fix is better. --- bind-9.21-unittest-32b-mem.patch | 114 ++++++++++++++++++------------- bind9-next.spec | 2 +- 2 files changed, 67 insertions(+), 49 deletions(-) diff --git a/bind-9.21-unittest-32b-mem.patch b/bind-9.21-unittest-32b-mem.patch index 90dee92..ba4e0fd 100644 --- a/bind-9.21-unittest-32b-mem.patch +++ b/bind-9.21-unittest-32b-mem.patch @@ -1,91 +1,109 @@ -From e81b125a9c7eb9222b5f8298bec689e23287969b Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= -Date: Thu, 9 Apr 2026 10:51:57 +0200 -Subject: [PATCH] Accept significantly lower memory consumption on 32b system -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit +From 4623873e588c86c6add4d53708e754e2d6f3e087 Mon Sep 17 00:00:00 2001 +From: Michal Nowak +Date: Wed, 20 May 2026 08:59:49 +0000 +Subject: [PATCH] Make deleg cleanuptests memory assertions 32-bit-safe -Memory usage might be significantly lower on legacy platforms. Allow -testing of them and pass there. Move repeated checks to shared -functions, include phase in minimal range to simplify identification of -failed place. +Each address entry stored by dns_delegset_addaddr() is an +isc_netaddrlink_t, whose size depends on sizeof(void *) via the +ISC_LINK macro (24 bytes of address + two prev/next pointers): 40 +bytes on 64-bit, 32 bytes on 32-bit. The hardcoded 4 MB / 8 MB +ranges only held on 64-bit, so dns_deleg_cleanuptests failed on +armv7l with isc_mem_inuse() returning ~3.2 MB. -Signed-off-by: Petr Menšík +Express the expected ranges in terms of sizeof(isc_netaddrlink_t) +so they scale with pointer width, and pull the 99999 entry count +out into a NENTRIES macro. + +Assisted-by: Claude:claude-opus-4-7 --- - tests/dns/deleg_test.c | 27 +++++++++++++++++++++------ - 1 file changed, 21 insertions(+), 6 deletions(-) + tests/dns/deleg_test.c | 30 ++++++++++++++++++++++-------- + 1 file changed, 22 insertions(+), 8 deletions(-) diff --git a/tests/dns/deleg_test.c b/tests/dns/deleg_test.c -index d3af6ab..cbab065 100644 +index d3af6aba966..9497caf2753 100644 --- a/tests/dns/deleg_test.c +++ b/tests/dns/deleg_test.c -@@ -579,6 +579,22 @@ typedef struct { - isc_stdtime_t now; - } cleanup_ctx_t; +@@ -52,6 +52,15 @@ isc_stdtime_now(void) { -+static void cleanuptests_memcheck1(isc_mem_t *mctx, unsigned int phase) { -+ size_t inuse = isc_mem_inuse(mctx); -+ if (sizeof(void *) == 4) -+ assert_int_in_range(inuse, 3100000+phase, 3300000); -+ else -+ assert_int_in_range(inuse, 4000000+phase, 4100000); -+} -+ -+static void cleanuptests_memcheck2(isc_mem_t *mctx, unsigned int phase) { -+ size_t inuse = isc_mem_inuse(mctx); -+ if (sizeof(void *) == 4) -+ assert_int_in_range(inuse, 6400000+phase, 6500000); -+ else -+ assert_int_in_range(inuse, 8000000+phase, 8100000); -+} + #include + ++/* ++ * cleanuptests adds NENTRIES address entries to a delegset; each is an ++ * isc_netaddrlink_t whose size depends on sizeof(void *) via ISC_LINK. ++ * Express memory expectations in terms of that struct so the test works ++ * on both 32-bit and 64-bit targets. ++ */ ++#define NENTRIES 99999 ++#define ENTRIES_MEM(n) ((size_t)(n) * sizeof(isc_netaddrlink_t)) + static void - cleanuptests_phase3(void *arg) { - cleanup_ctx_t *ctx = arg; -@@ -587,7 +603,7 @@ cleanuptests_phase3(void *arg) { + shutdownloop(ISC_ATTR_UNUSED void *arg) { + isc_loopmgr_shutdown(); +@@ -587,7 +596,8 @@ cleanuptests_phase3(void *arg) { dns_delegset_t *delegset = NULL; isc_result_t result; - assert_int_in_range(isc_mem_inuse(db->mctx), 8000000, 8100000); -+ cleanuptests_memcheck1(db->mctx, 3); ++ assert_int_in_range(isc_mem_inuse(db->mctx), ENTRIES_MEM(2 * NENTRIES), ++ ENTRIES_MEM(2 * NENTRIES) + 100000); /* * baz. is there, but bar. is gone, as it has been -@@ -612,7 +628,7 @@ cleanuptests_phase2(void *arg) { +@@ -612,7 +622,8 @@ cleanuptests_phase2(void *arg) { dns_delegset_t *delegset = NULL; isc_result_t result; - assert_int_in_range(isc_mem_inuse(db->mctx), 4000000, 4100000); -+ cleanuptests_memcheck1(db->mctx, 2); ++ assert_int_in_range(isc_mem_inuse(db->mctx), ENTRIES_MEM(NENTRIES), ++ ENTRIES_MEM(NENTRIES) + 100000); /* * bar. is there -@@ -632,7 +648,7 @@ cleanuptests_phase2(void *arg) { - for (size_t i = 0; i < 99999; i++) { +@@ -629,10 +640,11 @@ cleanuptests_phase2(void *arg) { + dns_delegset_allocdeleg(delegset, DNS_DELEGTYPE_DELEG_ADDRESSES, + &deleg); + +- for (size_t i = 0; i < 99999; i++) { ++ for (size_t i = 0; i < NENTRIES; i++) { addipdeleg(AF_INET6, "1111::2222", delegset, deleg); } - assert_int_in_range(isc_mem_inuse(db->mctx), 8000000, 8100000); -+ cleanuptests_memcheck2(db->mctx, 2); ++ assert_int_in_range(isc_mem_inuse(db->mctx), ENTRIES_MEM(2 * NENTRIES), ++ ENTRIES_MEM(2 * NENTRIES) + 100000); writedb(db, "baz.", 30, &delegset, true); deleg = NULL; -@@ -681,8 +697,7 @@ cleanuptests(ISC_ATTR_UNUSED void *arg) { +@@ -677,11 +689,12 @@ cleanuptests(ISC_ATTR_UNUSED void *arg) { + + assert_int_in_range(isc_mem_inuse(db->mctx), 500, 2000); + +- for (size_t i = 0; i < 99999; i++) { ++ for (size_t i = 0; i < NENTRIES; i++) { addipdeleg(AF_INET6, "1111::2222", delegset, deleg); } - assert_int_in_range(isc_mem_inuse(db->mctx), 4000000, 4100000); -- -+ cleanuptests_memcheck1(db->mctx, 1); ++ assert_int_in_range(isc_mem_inuse(db->mctx), ENTRIES_MEM(NENTRIES), ++ ENTRIES_MEM(NENTRIES) + 100000); + writedb(db, "stuff.", 10, &delegset, true); deleg = NULL; - stdtime_now += 10; -@@ -703,7 +718,7 @@ cleanuptests(ISC_ATTR_UNUSED void *arg) { +@@ -694,7 +707,7 @@ cleanuptests(ISC_ATTR_UNUSED void *arg) { + dns_delegset_allocdeleg(delegset, DNS_DELEGTYPE_DELEG_ADDRESSES, + &deleg); + +- for (size_t i = 0; i < 99999; i++) { ++ for (size_t i = 0; i < NENTRIES; i++) { + addipdeleg(AF_INET6, "1111::2222", delegset, deleg); + } + +@@ -703,7 +716,8 @@ cleanuptests(ISC_ATTR_UNUSED void *arg) { * with DB mem context) overmem conditions will be detected, and the * expired node will be removed */ - assert_int_in_range(isc_mem_inuse(db->mctx), 8000000, 8100000); -+ cleanuptests_memcheck2(db->mctx, 1); ++ assert_int_in_range(isc_mem_inuse(db->mctx), ENTRIES_MEM(2 * NENTRIES), ++ ENTRIES_MEM(2 * NENTRIES) + 100000); writedb(db, "bar.", 30, &delegset, true); deleg = NULL; diff --git a/bind9-next.spec b/bind9-next.spec index 2dc204d..4939fa1 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -88,7 +88,7 @@ Patch1: bind-9.16-redhat_doc.patch # https://gitlab.isc.org/isc-projects/bind9/-/issues/5328 # avoid often fails on i386, unsupported upstream Patch4: bind-9.21-unittest-qpdb-i386.patch -# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/11825 +# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/12061 Patch5: bind-9.21-unittest-32b-mem.patch %{?systemd_ordering} From dd3ddef0d0c5480d099f3f47d6d92140406a7b23 Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Fri, 12 Jun 2026 18:19:38 -0400 Subject: [PATCH 71/72] Rebuilt for openssl 4.0 From d3d83b7ded86392d3de557a0dd090868f4523e67 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 15 Jul 2026 20:11:31 +0000 Subject: [PATCH 72/72] Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild