diff --git a/.gitignore b/.gitignore index 7d9fed1..306ff81 100644 --- a/.gitignore +++ b/.gitignore @@ -222,15 +222,3 @@ bind-9.7.2b1.tar.gz /bind-9.19.21.tar.xz.asc /bind-9.19.22.tar.xz /bind-9.19.22.tar.xz.asc -/bind-9.19.24.tar.xz -/bind-9.19.24.tar.xz.asc -/bind-9.21.0.tar.xz -/bind-9.21.0.tar.xz.asc -/bind-9.21.2.tar.xz -/bind-9.21.2.tar.xz.asc -/bind-9.21.3.tar.xz -/bind-9.21.3.tar.xz.asc -/bind-9.21.4.tar.xz -/bind-9.21.4.tar.xz.asc -/bind-9.21.*.tar.xz -/bind-9.21.*.tar.xz.asc diff --git a/README.md b/README.md index 7f59b23..b7cfab1 100644 --- a/README.md +++ b/README.md @@ -26,9 +26,13 @@ The package contains several subpackages, some of them can be disabled on rebuil * **bind9-next** -- *named* daemon providing DNS server * **bind9-next-utils** -- set of tools to analyse DNS responses or update entries (dig, host) * **bind9-next-doc** -- documentation for current bind, *BIND 9 Administrator Reference Manual*. +* **bind9-next-license** -- Shared license for all packages but bind-export-libs. * **bind9-next-libs** -- Shared libraries used by some others programs +* **bind9-next-devel** -- Development headers for libs. Can be disabled by `--without DEVEL` + ## Optional features * *GSSTSIG* -- Support for Kerberos authentication in BIND. * *LMDB* -- Support for dynamic database for managing runtime added zones. Provides faster removal of added zone with much less overhead. But requires lmdb linked to base libs. +* *DLZ* -- Support for dynamic loaded modules providing support for features *bind-sdb* provides, but only small module is required. diff --git a/bind-9.11.12.tar.gz.asc b/bind-9.11.12.tar.gz.asc new file mode 100644 index 0000000..6d7992f --- /dev/null +++ b/bind-9.11.12.tar.gz.asc @@ -0,0 +1,16 @@ +-----BEGIN PGP SIGNATURE----- + +iQIzBAABAgAdFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAl2WMooACgkQdLtrmky7 +PThv2RAAnXNLYTzXtH6ls29tRm5Hc+D6UaeqcWDNQ4BpkRVhrFxtukalGCi9mmB6 +NPJzFyXmaOW654pypCIuEgqJNFUpDtLzLzT7SUF+mhm+5plsaRSBnh4mq87l5KSp +twODAPnfCJV+HBk5RmToLEstAbGQ7xEBTyQtZoFkY+V7zEFwENKiCvWsoSWOkYR3 +zXo3sKjc83HV9ShbW/mCtbZf5L0qlbrKOAzqJfAFMhNNJi8kMbmr/Zi2sIfN+Rhv +g8HQo89Epv6r51yAdeED8idIX4rKjjcEtHrZeDmLdCcdHgSEj2sIlH92Joce6vL0 +S59A0rItIXm6fW8sz6WNpcj4tVtWYbIYjXZ4SPFNkaUrHv8cUekq+5vbI+v07Gh3 +2bhtDsDyTY5I1/AsY/EFmwkCAjUS00jZryBnuJpLB3v5JtUog4ek32yLBzPrqRBo +1876j4nlXAia8mG0OgJNWZ0gHyUPe/TgfR8fQDLmHxHHlKrJNTEwY6bLW8jzFTX1 +zk510fI1K7J9tiQgf5wcBQ2h3EBlqzDNIJDovoATzLYIf0HKyVegh/vnQdtdEhUR +1DzJAt3bsBfAP1AFfWPD/ACu5Zdm7SxY1wE/pjkwttDU3sRZqOfuwNBGeolu3cVN +O9/h1zsyVeVS0ui2vu4+V4EvNitmXsVbG2doDq9L5yBiIKGO2Ew= +=GCy6 +-----END PGP SIGNATURE----- diff --git a/bind-9.14.7.tar.gz.asc b/bind-9.14.7.tar.gz.asc new file mode 100644 index 0000000..1134ae1 --- /dev/null +++ b/bind-9.14.7.tar.gz.asc @@ -0,0 +1,16 @@ +-----BEGIN PGP SIGNATURE----- + +iQIzBAABAgAdFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAl2WMpEACgkQdLtrmky7 +PTh/sg//QbNRAQvADQfwF1PPo+JxB+3WzQ9oJAWeHbOoiubwkUwO9xE+BEnTNd5o +oM1lSLqFxNykOTaoeJlqPftPod1cxo7lSzkwflugGyB/59wliCpqCg053YV4x9mO +QggvA/E50+0FI/Om/7v4GHGADu/JE83FovOueWAB0LgqfDSD6QFcNFF9sUJJ4P7r +FcEXSWj8QbrHMWBKncZUOpD2ECotvtrYmi0DTHl1XfigESDQpWtsnTFuabCCsvkh +ch9wQRplAes2Mf/aS5tl1y0QKKBFuEjtGiTdgrDl6o9GLnx6CueX5saZehu2EVkr +fq2vEYUC2lRQSjuxSMMJ3L0TGUcl7+ixlAIISS2K9L5Xx7MhBXt/EH5KiKPfsEet +3EH+DhxV5uXjDU7MgvREnxT+ssV23e0HWTz4tVVQ9LpvYmWPIgLcSOhHCc57yoQF +c46V0f69dMWbMAlQ93EZSG274ZvpIszpK8+3hGI3/TuDFFgiQJeJJBFVtYJMle69 +3mEEclfzO7fBiXZFec6nVx2309bL64bafN7zszPKXl4XgoefOfD0v0eWqQT4fxfm +dnGC0qMqSZs5F+d0fISV5JUUNYzt9PZjvnzqLLGOeTF6l3/n9G1mmNsXcxJ1OEIF +6qh1oO7JTPjt0MFhKac4QjNQi/Bnp25O3I/PRyWZCbiwXkyvyQU= +=ZT7s +-----END PGP SIGNATURE----- diff --git a/bind-9.21-unittest-32b-mem.patch b/bind-9.21-unittest-32b-mem.patch deleted file mode 100644 index ba4e0fd..0000000 --- a/bind-9.21-unittest-32b-mem.patch +++ /dev/null @@ -1,112 +0,0 @@ -From 4623873e588c86c6add4d53708e754e2d6f3e087 Mon Sep 17 00:00:00 2001 -From: Michal Nowak -Date: Wed, 20 May 2026 08:59:49 +0000 -Subject: [PATCH] Make deleg cleanuptests memory assertions 32-bit-safe - -Each address entry stored by dns_delegset_addaddr() is an -isc_netaddrlink_t, whose size depends on sizeof(void *) via the -ISC_LINK macro (24 bytes of address + two prev/next pointers): 40 -bytes on 64-bit, 32 bytes on 32-bit. The hardcoded 4 MB / 8 MB -ranges only held on 64-bit, so dns_deleg_cleanuptests failed on -armv7l with isc_mem_inuse() returning ~3.2 MB. - -Express the expected ranges in terms of sizeof(isc_netaddrlink_t) -so they scale with pointer width, and pull the 99999 entry count -out into a NENTRIES macro. - -Assisted-by: Claude:claude-opus-4-7 ---- - tests/dns/deleg_test.c | 30 ++++++++++++++++++++++-------- - 1 file changed, 22 insertions(+), 8 deletions(-) - -diff --git a/tests/dns/deleg_test.c b/tests/dns/deleg_test.c -index d3af6aba966..9497caf2753 100644 ---- a/tests/dns/deleg_test.c -+++ b/tests/dns/deleg_test.c -@@ -52,6 +52,15 @@ isc_stdtime_now(void) { - - #include - -+/* -+ * cleanuptests adds NENTRIES address entries to a delegset; each is an -+ * isc_netaddrlink_t whose size depends on sizeof(void *) via ISC_LINK. -+ * Express memory expectations in terms of that struct so the test works -+ * on both 32-bit and 64-bit targets. -+ */ -+#define NENTRIES 99999 -+#define ENTRIES_MEM(n) ((size_t)(n) * sizeof(isc_netaddrlink_t)) -+ - static void - shutdownloop(ISC_ATTR_UNUSED void *arg) { - isc_loopmgr_shutdown(); -@@ -587,7 +596,8 @@ cleanuptests_phase3(void *arg) { - dns_delegset_t *delegset = NULL; - isc_result_t result; - -- assert_int_in_range(isc_mem_inuse(db->mctx), 8000000, 8100000); -+ assert_int_in_range(isc_mem_inuse(db->mctx), ENTRIES_MEM(2 * NENTRIES), -+ ENTRIES_MEM(2 * NENTRIES) + 100000); - - /* - * baz. is there, but bar. is gone, as it has been -@@ -612,7 +622,8 @@ cleanuptests_phase2(void *arg) { - dns_delegset_t *delegset = NULL; - isc_result_t result; - -- assert_int_in_range(isc_mem_inuse(db->mctx), 4000000, 4100000); -+ assert_int_in_range(isc_mem_inuse(db->mctx), ENTRIES_MEM(NENTRIES), -+ ENTRIES_MEM(NENTRIES) + 100000); - - /* - * bar. is there -@@ -629,10 +640,11 @@ cleanuptests_phase2(void *arg) { - dns_delegset_allocdeleg(delegset, DNS_DELEGTYPE_DELEG_ADDRESSES, - &deleg); - -- for (size_t i = 0; i < 99999; i++) { -+ for (size_t i = 0; i < NENTRIES; i++) { - addipdeleg(AF_INET6, "1111::2222", delegset, deleg); - } -- assert_int_in_range(isc_mem_inuse(db->mctx), 8000000, 8100000); -+ assert_int_in_range(isc_mem_inuse(db->mctx), ENTRIES_MEM(2 * NENTRIES), -+ ENTRIES_MEM(2 * NENTRIES) + 100000); - writedb(db, "baz.", 30, &delegset, true); - deleg = NULL; - -@@ -677,11 +689,12 @@ cleanuptests(ISC_ATTR_UNUSED void *arg) { - - assert_int_in_range(isc_mem_inuse(db->mctx), 500, 2000); - -- for (size_t i = 0; i < 99999; i++) { -+ for (size_t i = 0; i < NENTRIES; i++) { - addipdeleg(AF_INET6, "1111::2222", delegset, deleg); - } - -- assert_int_in_range(isc_mem_inuse(db->mctx), 4000000, 4100000); -+ assert_int_in_range(isc_mem_inuse(db->mctx), ENTRIES_MEM(NENTRIES), -+ ENTRIES_MEM(NENTRIES) + 100000); - - writedb(db, "stuff.", 10, &delegset, true); - deleg = NULL; -@@ -694,7 +707,7 @@ cleanuptests(ISC_ATTR_UNUSED void *arg) { - dns_delegset_allocdeleg(delegset, DNS_DELEGTYPE_DELEG_ADDRESSES, - &deleg); - -- for (size_t i = 0; i < 99999; i++) { -+ for (size_t i = 0; i < NENTRIES; i++) { - addipdeleg(AF_INET6, "1111::2222", delegset, deleg); - } - -@@ -703,7 +716,8 @@ cleanuptests(ISC_ATTR_UNUSED void *arg) { - * with DB mem context) overmem conditions will be detected, and the - * expired node will be removed - */ -- assert_int_in_range(isc_mem_inuse(db->mctx), 8000000, 8100000); -+ assert_int_in_range(isc_mem_inuse(db->mctx), ENTRIES_MEM(2 * NENTRIES), -+ ENTRIES_MEM(2 * NENTRIES) + 100000); - writedb(db, "bar.", 30, &delegset, true); - deleg = NULL; - --- -2.54.0 - diff --git a/bind-9.21-unittest-qpdb-i386.patch b/bind-9.21-unittest-qpdb-i386.patch deleted file mode 100644 index 7c84880..0000000 --- a/bind-9.21-unittest-qpdb-i386.patch +++ /dev/null @@ -1,41 +0,0 @@ -From af1e4bf375000fc532c55ff6df841661185a2451 Mon Sep 17 00:00:00 2001 -From: Petr Mensik -Date: Wed, 28 May 2025 19:40:05 +0200 -Subject: [PATCH] Try rcu_barrier - -https://gitlab.isc.org/isc-projects/bind9/-/issues/5328 ---- - tests/dns/qpdb_test.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/tests/dns/qpdb_test.c b/tests/dns/qpdb_test.c -index 1c840e2..b6ad0f4 100644 ---- a/tests/dns/qpdb_test.c -+++ b/tests/dns/qpdb_test.c -@@ -24,6 +24,7 @@ - #include - - #include -+#include - #include - - #include -@@ -170,6 +171,7 @@ ISC_LOOP_TEST_IMPL(overmempurge_bigrdata) { - - dns_db_detach(&db); - isc_mem_detach(&mctx); -+ rcu_barrier(); - isc_loopmgr_shutdown(); - } - -@@ -221,6 +223,7 @@ ISC_LOOP_TEST_IMPL(overmempurge_longname) { - - dns_db_detach(&db); - isc_mem_detach(&mctx); -+ rcu_barrier(); - isc_loopmgr_shutdown(); - } - --- -2.51.0 - diff --git a/bind9-next.spec b/bind9-next.spec index 4939fa1..3ba9159 100644 --- a/bind9-next.spec +++ b/bind9-next.spec @@ -10,6 +10,7 @@ %bcond_without SUDO %bcond_without GSSTSIG %bcond_without JSON +%bcond_without DLZ # New MaxMind GeoLite support %bcond_without GEOIP2 # Disabled temporarily until kyua is fixed on rawhide, bug #1926779 @@ -17,11 +18,10 @@ # Do not set CI environment, include more unit tests, even less stable %bcond_with UNITTEST_ALL %bcond_without DNSTAP +%bcond_without LMDB %bcond_without DOC %bcond_with TSAN %bcond_without DTRACE -%bcond_with OPENSSL_ENGINE -%bcond JEMALLOC 0%{?fedora} %{?!bind_uid: %global bind_uid 25} %{?!bind_gid: %global bind_gid 25} @@ -30,9 +30,7 @@ %global chroot_prefix %{bind_dir}/chroot %global chroot_create_directories /dev /run/named %{_localstatedir}/{log,named,tmp} \\\ %{_sysconfdir}/{crypto-policies/back-ends,pki/dnssec-keys,pki/tls,named} \\\ - %{_libdir}/bind %{_libdir}/named %{_datadir}/{GeoIP,dns-root-data} /proc/sys/net/ipv4 -%global upstream_sources 0 2 -%global pgp_signed_sources 2 + %{_libdir}/bind %{_libdir}/named %{_datadir}/GeoIP /proc/sys/net/ipv4 %global forgeurl0 https://gitlab.isc.org/isc-projects/bind9 @@ -52,9 +50,9 @@ Conflicts: %1 \ Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server Name: bind9-next -License: MPL-2.0 AND ISC AND BSD-3-clause AND MIT AND BSD-2-clause +License: MPL-2.0 AND ISC AND BSD-3-clause AND Expat AND BSD-2-clause # -Version: 9.21.22 +Version: 9.19.22 Release: %autorelease Epoch: 32 Url: https://www.isc.org/downloads/bind/ @@ -66,17 +64,22 @@ Source2: https://downloads.isc.org/isc/bind9/%{version}/%{upname}-%{version}.ta Source3: named.logrotate Source4: https://www.isc.org/docs/isc-keyblock.asc Source16: named.conf +# Refresh by command: dig @a.root-servers.net. +tcp +norec +# or from URL +Source17: https://www.internic.net/domain/named.root Source18: named.localhost Source19: named.loopback Source20: named.empty Source23: named.rfc1912.zones Source25: named.conf.sample -Source27: named-mkroot.sh +Source27: named.root.key Source35: bind.tmpfiles.d +Source36: trusted-key.key Source37: named.service Source38: named-chroot.service Source41: setup-named-chroot.sh Source42: generate-rndc-key.sh +Source43: named.rwtab Source44: named-chroot-setup.service Source46: named-setup-rndc.service Source48: setup-named-softhsm.sh @@ -85,63 +88,40 @@ Source49: named-chroot.files # Common patches # Red Hat specific documentation is not relevant to upstream Patch1: bind-9.16-redhat_doc.patch -# https://gitlab.isc.org/isc-projects/bind9/-/issues/5328 -# avoid often fails on i386, unsupported upstream -Patch4: bind-9.21-unittest-qpdb-i386.patch -# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/12061 -Patch5: bind-9.21-unittest-32b-mem.patch %{?systemd_ordering} Requires: coreutils +Requires(pre): shadow-utils Requires(post): shadow-utils Requires(post): glibc-common Requires(post): grep -Requires: dns-root-data Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release} Recommends: %{name}-utils %{name}-dnssec-utils %upname_compat %{upname} Obsoletes: %{name}-pkcs11 < 32:9.18.4-2 Conflicts: bind-dyndb-ldap -BuildRequires: gcc -BuildRequires: make -BuildRequires: openssl-devel -BuildRequires: libtool -BuildRequires: meson >= 1.3.0 -BuildRequires: ninja-build -BuildRequires: pkgconfig -BuildRequires: pkgconfig(libcap) -BuildRequires: pkgconfig(libidn2) -BuildRequires: pkgconfig(libxml-2.0) +BuildRequires: gcc, make +BuildRequires: openssl-devel, libtool, autoconf, pkgconfig, libcap-devel +BuildRequires: libidn2-devel, libxml2-devel BuildRequires: systemd-rpm-macros BuildRequires: selinux-policy -BuildRequires: findutils -BuildRequires: sed -BuildRequires: pkgconfig(libnghttp2) -BuildRequires: pkgconfig(liburcu) -BuildRequires: pkgconfig(libedit) -BuildRequires: dns-root-data -# Compress the changelog -BuildRequires: gzip -BuildRequires: pkgconfig(lmdb) -%if %{with JEMALLOC} -BuildRequires: pkgconfig(jemalloc) +BuildRequires: findutils sed +BuildRequires: libnghttp2-devel +BuildRequires: userspace-rcu-devel +%if 0%{?fedora} +BuildRequires: jemalloc-devel +BuildRequires: gnupg2 %endif -%if ! 0%{?rhel} -BuildRequires: gpgverify -%endif -BuildRequires: pkgconfig(libuv) -%if %{with OPENSSL_ENGINE} -BuildRequires: openssl-devel-engine +BuildRequires: libuv-devel +%if %{with DLZ} +BuildRequires: openldap-devel, libpq-devel, sqlite-devel, mariadb-connector-c-devel %endif %if %{with UNITTEST} # make unit dependencies -BuildRequires: pkgconfig(cmocka) +BuildRequires: libcmocka-devel # Ensure we have lscpu BuildRequires: util-linux -# Catch failing unittests coredumps -BuildRequires: gdb -BuildRequires: xz %endif %if %{with UNITTEST} || %{with SYSTEMTEST} BuildRequires: softhsm @@ -151,13 +131,8 @@ BuildRequires: softhsm BuildRequires: perl(Net::DNS) perl(Net::DNS::Nameserver) perl(Time::HiRes) perl(Getopt::Long) BuildRequires: perl(English) BuildRequires: python3-pytest -BuildRequires: python3-pytest-xdist -BuildRequires: python3-dns -BuildRequires: python3-hypothesis # manual configuration requires this tool BuildRequires: iproute -BuildRequires: python3-jinja2 -BuildRequires: lmdb-devel %if %{with SUDO} BuildRequires: libcap sudo %endif @@ -165,6 +140,9 @@ BuildRequires: libcap sudo %if %{with GSSTSIG} BuildRequires: krb5-devel %endif +%if %{with LMDB} +BuildRequires: lmdb-devel +%endif %if %{with JSON} BuildRequires: json-c-devel %endif @@ -184,9 +162,7 @@ BuildRequires: libtsan %endif %if %{with DTRACE} # https://gitlab.isc.org/isc-projects/bind9/-/issues/4041 -BuildRequires: systemtap -BuildRequires: systemtap-sdt-devel -BuildRequires: systemtap-sdt-dtrace +BuildRequires: systemtap-sdt-devel %endif %description @@ -198,8 +174,7 @@ tools for verifying that the DNS server is operating properly. %package libs Summary: Libraries used by the BIND DNS packages -Provides: %{name}-license = %{epoch}:%{version}-%{release} -Obsoletes: %{name}-license < 32:9.21.11-5 +Requires: %{name}-license = %{epoch}:%{version}-%{release} Provides: %{name}-libs-lite = %{epoch}:%{version}-%{release} Obsoletes: %{name}-libs-lite < 32:9.16.13 Obsoletes: %{name}-pkcs11-libs < 32:9.18.4-2 @@ -208,6 +183,13 @@ Obsoletes: %{name}-pkcs11-libs < 32:9.18.4-2 Contains heavyweight version of BIND suite libraries used by both named DNS server and utilities in %{name}-utils package. +%package license +Summary: License of the BIND DNS suite +BuildArch:noarch + +%description license +Contains license of the BIND DNS suite. + %package utils Summary: Utilities for querying DNS name servers Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release} @@ -247,14 +229,15 @@ Summary: Header files and libraries needed for bind-dyndb-ldap Provides: %{name}-lite-devel = %{epoch}:%{version}-%{release} Obsoletes: %{name}-lite-devel < 32:9.16.6-3 Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release} -Requires: openssl-devel%{?_isa} -Requires: libxml2-devel%{?_isa} +Requires: openssl-devel%{?_isa} libxml2-devel%{?_isa} Requires: libcap-devel%{?_isa} -Requires: lmdb-devel%{?_isa} %upname_compat %{upname}-devel %if %{with GSSTSIG} Requires: krb5-devel%{?_isa} %endif +%if %{with LMDB} +Requires: lmdb-devel%{?_isa} +%endif %if %{with JSON} Requires: json-c-devel%{?_isa} %endif @@ -283,9 +266,43 @@ chroot(2) jail for the named(8) program from the BIND package. Based on the code from Jan "Yenya" Kasprzak +%if %{with DLZ} +%package dlz-filesystem +Summary: BIND server filesystem DLZ module +Requires: %{name}%{?_isa} = %{epoch}:%{version}-%{release} + +%description dlz-filesystem +Dynamic Loadable Zones filesystem module for BIND server. + +%package dlz-ldap +Summary: BIND server ldap DLZ module +Requires: %{name}%{?_isa} = %{epoch}:%{version}-%{release} + +%description dlz-ldap +Dynamic Loadable Zones LDAP module for BIND server. + +%package dlz-mysql +Summary: BIND server mysql and mysqldyn DLZ modules +Requires: %{name}%{?_isa} = %{epoch}:%{version}-%{release} +Provides: %{name}-dlz-mysqldyn = %{epoch}:%{version}-%{release} +Obsoletes: %{name}-dlz-mysqldyn < 32:9.16.6-3 + +%description dlz-mysql +Dynamic Loadable Zones MySQL module for BIND server. +Contains also mysqldyn module with dynamic DNS updates (DDNS) support. + +%package dlz-sqlite3 +Summary: BIND server sqlite3 DLZ module +Requires: %{name}%{?_isa} = %{epoch}:%{version}-%{release} + +%description dlz-sqlite3 +Dynamic Loadable Zones sqlite3 module for BIND server. +%endif + %if %{with DOC} %package doc Summary: BIND 9 Administrator Reference Manual +Requires: %{name}-license = %{epoch}:%{version}-%{release} Requires: python3-sphinx_rtd_theme BuildArch: noarch @@ -303,25 +320,25 @@ in HTML and PDF format. %endif %prep -%if ! 0%{?rhel} || 0%{?rhel} > 10 -# RHEL does not (again?) support this verification +%if 0%{?fedora} +# RHEL does not yet support this verification %{gpgverify} --keyring='%{SOURCE4}' --signature='%{SOURCE2}' --data='%{SOURCE0}' %endif %autosetup -n %{upname}-%{version} -p1 +# Sparc and s390 arches need to use -fPIE +%ifarch sparcv9 sparc64 s390 s390x +for i in bin/named/Makefile.am; do + sed -i 's|fpie|fPIE|g' $i +done +%endif + :; -# Create a sysusers.d config file -cat >bind9-next.sysusers.conf <&1 | tee test.log + e=$? [ "$CONFIGURED" = build ] && $SUDO sh ./ifconfig.sh down + popd if [ "$e" -ne 0 ]; then - echo "ERROR: failed running 'pytest' in system tests. Aborting." - ls -1 "$(pwd)"/*_tmp_* - for TMPTEST in *_tmp_* - do - echo "# $TMPTEST" - cat $TMPTEST/pytest.log.txt - done + echo "ERROR: this build of BIND failed 'make test'. Aborting." exit $e; fi; - popd else echo 'SKIPPED: tests require root, CAP_NET_ADMIN or already configured test addresses.' fi @@ -521,7 +532,9 @@ popd touch ${RPM_BUILD_ROOT}/%{chroot_prefix}%{_sysconfdir}/named.conf #end chroot -%meson_install +pushd build +%make_install +popd # Remove unwanted files rm -f ${RPM_BUILD_ROOT}/etc/bind.keys @@ -544,8 +557,29 @@ mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/sysconfig install -pm 644 %{SOURCE1} ${RPM_BUILD_ROOT}%{_sysconfdir}/sysconfig/named install -pm 644 %{SOURCE49} ${RPM_BUILD_ROOT}%{_sysconfdir}/named-chroot.files -%if "%{_sbindir}" != "%{_bindir}" - ln -s ../bin/{named-checkconf,named-checkzone,named-compilezone} %{buildroot}%{_sbindir}/ +pushd ${RPM_BUILD_ROOT}%{_sbindir} +# Compatibility with previous major versions, only for selected binaries +for BIN in named-checkconf named-checkzone named-compilezone +do + ln -s ../bin/$BIN $BIN +done +popd + +%if %{with DLZ} + pushd build + pushd contrib/dlz/modules + for DIR in filesystem ldap mysql mysqldyn sqlite3; do + %make_install -C $DIR libdir=%{_libdir}/bind + done + pushd ${RPM_BUILD_ROOT}/%{_libdir}/named + cp -s ../bind/dlz_*.so . + popd + mkdir -p doc/{mysql,mysqldyn} + cp -p mysqldyn/testing/README doc/mysqldyn/README.testing + cp -p mysqldyn/testing/* doc/mysqldyn + cp -p mysql/testing/* doc/mysql + popd + popd %endif # Remove libtool .la files: @@ -555,6 +589,9 @@ find ${RPM_BUILD_ROOT}/%{_libdir} -name '*.la' -exec '/bin/rm' '-f' '{}' ';'; %if %{without DNSTAP} rm -f ${RPM_BUILD_ROOT}%{_mandir}/man1/dnstap-read.1* || true %endif +%if %{without LMDB} +rm -f ${RPM_BUILD_ROOT}%{_mandir}/man8/named-nzd2nzf.8* || true +%endif pushd ${RPM_BUILD_ROOT}%{_mandir}/man8 ln -s ddns-confgen.8.gz tsig-keygen.8.gz @@ -565,9 +602,8 @@ popd %if %{with DOC} mkdir -p ${RPM_BUILD_ROOT}%{_pkgdocdir} -pushd %{_vpath_builddir} -cp -a arm/ ${RPM_BUILD_ROOT}%{_pkgdocdir}/html/ -#rm -rf ${RPM_BUILD_ROOT}%{_pkgdocdir}/html/.{buildinfo,doctrees} +cp -a build/doc/arm/_build/html ${RPM_BUILD_ROOT}%{_pkgdocdir} +rm -rf ${RPM_BUILD_ROOT}%{_pkgdocdir}/html/.{buildinfo,doctrees} # Backward compatible link to 9.11 documentation (cd ${RPM_BUILD_ROOT}%{_pkgdocdir} && ln -s html/index.html Bv9ARM.html) # Share static data from original sphinx package @@ -577,13 +613,10 @@ do BINDTHEMEDIR="${RPM_BUILD_ROOT}%{_pkgdocdir}/html/_static/$BASE" if [ -d "$BINDTHEMEDIR" ]; then rm -rf "$BINDTHEMEDIR" - ln -sr "${RPM_BUILD_ROOT}${DIR}" "$BINDTHEMEDIR" + ln -s "$DIR" "$BINDTHEMEDIR" fi done -cp -p arm-epub/Bv9ARM.epub ${RPM_BUILD_ROOT}%{_pkgdocdir} -popd -cp -p doc/changelog/changelog-history.rst* doc/notes/notes-*.rst* \ - ${RPM_BUILD_ROOT}%{_pkgdocdir} +cp -p build/doc/arm/_build/epub/Bv9ARM.epub ${RPM_BUILD_ROOT}%{_pkgdocdir} %endif # Ghost config files: @@ -592,13 +625,13 @@ touch ${RPM_BUILD_ROOT}%{_localstatedir}/log/named.log # configuration files: install -m 640 %{SOURCE16} ${RPM_BUILD_ROOT}%{_sysconfdir}/named.conf touch ${RPM_BUILD_ROOT}%{_sysconfdir}/rndc.{key,conf} -install -m 644 -p named.root.key ${RPM_BUILD_ROOT}%{_sysconfdir}/named.root.key -ln -s "%{_datadir}/dns-root-data/root.key" ${RPM_BUILD_ROOT}%{_sysconfdir}/trusted-key.key +install -m 644 %{SOURCE27} ${RPM_BUILD_ROOT}%{_sysconfdir}/named.root.key +install -m 644 %{SOURCE36} ${RPM_BUILD_ROOT}%{_sysconfdir}/trusted-key.key mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/named # data files: mkdir -p ${RPM_BUILD_ROOT}%{_localstatedir}/named -ln -s "%{_datadir}/dns-root-data/root.hints" ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.ca +install -m 640 %{SOURCE17} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.ca install -m 640 %{SOURCE18} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.localhost install -m 640 %{SOURCE19} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.loopback install -m 640 %{SOURCE20} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.empty @@ -611,7 +644,7 @@ install -m 644 %{SOURCE25} sample/etc/named.conf install -m 644 %{SOURCE16} named.conf.default install -m 644 %{SOURCE23} sample/etc/named.rfc1912.zones install -m 644 %{SOURCE18} %{SOURCE19} %{SOURCE20} sample/var/named -ln -s "%{_datadir}/dns-root-data/root.hints" sample/var/named/named.ca +install -m 644 %{SOURCE17} sample/var/named/named.ca for f in my.internal.zone.db slaves/my.slave.internal.zone.db slaves/my.ddns.internal.zone.db my.external.zone.db; do echo '@ in soa localhost. root 1 3H 15M 1W 1D ns localhost.' > sample/var/named/$f; @@ -621,7 +654,15 @@ done mkdir -p ${RPM_BUILD_ROOT}%{_tmpfilesdir} install -m 644 %{SOURCE35} ${RPM_BUILD_ROOT}%{_tmpfilesdir}/named.conf -install -m0644 -D bind9-next.sysusers.conf %{buildroot}%{_sysusersdir}/bind9-next.conf +mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/rwtab.d +install -m 644 %{SOURCE43} ${RPM_BUILD_ROOT}%{_sysconfdir}/rwtab.d/named + +%pre +if [ "$1" -eq 1 ]; then + /usr/sbin/groupadd -g %{bind_gid} -f -r named >/dev/null 2>&1 || :; + /usr/sbin/useradd -u %{bind_uid} -r -N -M -g named -s /sbin/nologin -d /var/named -c Named named >/dev/null 2>&1 || :; +fi; +:; %post %?ldconfig @@ -714,25 +755,21 @@ fi; # FIXME: current build targets filters into %%_libdir/bind again? %dir %{_libdir}/bind %{_libdir}/bind/filter*.so -%{_libdir}/bind/synthrecord.so %dir %{_libdir}/named %config(noreplace) %verify(not md5 size mtime) %{_sysconfdir}/sysconfig/named %config(noreplace) %attr(0644,root,named) %{_sysconfdir}/named.root.key %config(noreplace) %{_sysconfdir}/logrotate.d/named %{_tmpfilesdir}/named.conf -%{_sysusersdir}/bind9-next.conf +%{_sysconfdir}/rwtab.d/named %{_unitdir}/named.service %{_unitdir}/named-setup-rndc.service %{_bindir}/named-journalprint %{_bindir}/named-checkconf %{_bindir}/named-rrchecker -%{_bindir}/named-makejournal %{_bindir}/mdig %{_sbindir}/named %{_sbindir}/rndc* -%if "%{_sbindir}" != "%{_bindir}" %{_sbindir}/named-checkconf -%endif %{_libexecdir}/generate-rndc-key.sh %{_libexecdir}/setup-named-softhsm.sh %{_mandir}/man1/mdig.1* @@ -744,10 +781,8 @@ fi; %{_mandir}/man1/named-checkconf.1* %{_mandir}/man8/rndc-confgen.8* %{_mandir}/man1/named-journalprint.1* -%{_mandir}/man1/named-makejournal.1* -%{_mandir}/man8/filter-*.8* -%doc README.md named.conf.default -%doc doc/changelog/changelog-9.*.rst* +%{_mandir}/man8/filter-*.8.gz +%doc CHANGES README.md named.conf.default %doc sample/ # Hide configuration @@ -781,6 +816,8 @@ fi; %{_libdir}/libdns-%{version}*.so %{_libdir}/libisc-%{version}*.so %{_libdir}/libisccfg-%{version}*.so + +%files license %{!?_licensedir:%global license %%doc} %license COPYRIGHT @@ -796,16 +833,16 @@ fi; %{_bindir}/nsec3hash %{_bindir}/named-checkzone %{_bindir}/named-compilezone -%if "%{_sbindir}" != "%{_bindir}" %{_sbindir}/named-checkzone %{_sbindir}/named-compilezone -%endif %if %{with DNSTAP} %{_bindir}/dnstap-read %{_mandir}/man1/dnstap-read.1* %endif +%if %{with LMDB} %{_bindir}/named-nzd2nzf %{_mandir}/man1/named-nzd2nzf.1* +%endif %{_mandir}/man1/host.1* %{_mandir}/man1/nsupdate.1* %{_mandir}/man1/dig.1* @@ -823,8 +860,6 @@ fi; %{_bindir}/dnssec* %{_mandir}/man1/dnssec*.1* -%if 0 -# TODO: remove devel subpackage or create custom installation part %files devel %{_libdir}/libisccc.so %{_libdir}/libns.so @@ -839,7 +874,6 @@ fi; %{_includedir}/bind9/irs %{_includedir}/bind9/isc %{_includedir}/bind9/isccfg -%endif %files chroot %config(noreplace) %{_sysconfdir}/named-chroot.files @@ -880,15 +914,32 @@ fi; %dir %{chroot_prefix}/run/named %{chroot_prefix}%{_localstatedir}/run +%if %{with DLZ} +%files dlz-filesystem +%{_libdir}/{named,bind}/dlz_filesystem_dynamic.so + +%files dlz-mysql +%{_libdir}/{named,bind}/dlz_mysql_dynamic.so +%doc build/contrib/dlz/modules/doc/mysql +%{_libdir}/{named,bind}/dlz_mysqldyn_mod.so +%doc build/contrib/dlz/modules/doc/mysqldyn + +%files dlz-ldap +%{_libdir}/{named,bind}/dlz_ldap_dynamic.so +%doc contrib/dlz/modules/ldap/testing/* + +%files dlz-sqlite3 +%{_libdir}/{named,bind}/dlz_sqlite3_dynamic.so +%doc contrib/dlz/modules/sqlite3/testing/* + +%endif + %if %{with DOC} %files doc %dir %{_pkgdocdir} %doc %{_pkgdocdir}/html %doc %{_pkgdocdir}/Bv9ARM.html %doc %{_pkgdocdir}/Bv9ARM.epub -%doc %{_pkgdocdir}/changelog-history.rst* -%doc %{_pkgdocdir}/notes-*.rst* -%license COPYRIGHT %endif %changelog diff --git a/bind97-exportlib.patch b/bind97-exportlib.patch new file mode 100644 index 0000000..4468ef5 --- /dev/null +++ b/bind97-exportlib.patch @@ -0,0 +1,226 @@ +diff -up bind-9.9.3rc2/isc-config.sh.in.exportlib bind-9.9.3rc2/isc-config.sh.in +diff -up bind-9.9.3rc2/lib/export/dns/Makefile.in.exportlib bind-9.9.3rc2/lib/export/dns/Makefile.in +--- bind-9.9.3rc2/lib/export/dns/Makefile.in.exportlib 2013-04-30 08:38:46.000000000 +0200 ++++ bind-9.9.3rc2/lib/export/dns/Makefile.in 2013-05-13 10:45:22.574089729 +0200 +@@ -35,9 +35,9 @@ CDEFINES = -DUSE_MD5 @USE_OPENSSL@ @USE_ + + CWARNINGS = + +-ISCLIBS = ../isc/libisc.@A@ ++ISCLIBS = ../isc/libisc-export.@A@ + +-ISCDEPLIBS = ../isc/libisc.@A@ ++ISCDEPLIBS = ../isc/libisc-export.@A@ + + LIBS = @LIBS@ + +@@ -116,29 +116,29 @@ version.@O@: ${srcdir}/version.c + -DLIBAGE=${LIBAGE} \ + -c ${srcdir}/version.c + +-libdns.@SA@: ${OBJS} ++libdns-export.@SA@: ${OBJS} + ${AR} ${ARFLAGS} $@ ${OBJS} + ${RANLIB} $@ + +-libdns.la: ${OBJS} ++libdns-export.la: ${OBJS} + ${LIBTOOL_MODE_LINK} \ +- ${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libdns.la \ ++ ${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libdns-export.la \ + -rpath ${export_libdir} \ + -version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \ + ${OBJS} ${ISCLIBS} @DNS_CRYPTO_LIBS@ ${LIBS} + +-timestamp: libdns.@A@ ++timestamp: libdns-export.@A@ + touch timestamp + + installdirs: + $(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${export_libdir} + + install:: timestamp installdirs +- ${LIBTOOL_MODE_INSTALL} ${INSTALL_DATA} libdns.@A@ \ ++ ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} libdns-export.@A@ \ + ${DESTDIR}${export_libdir}/ + + clean distclean:: +- rm -f libdns.@A@ timestamp ++ rm -f libdns-export.@A@ timestamp + rm -f gen code.h include/dns/enumtype.h include/dns/enumclass.h + rm -f include/dns/rdatastruct.h + +diff -up bind-9.9.3rc2/lib/export/irs/Makefile.in.exportlib bind-9.9.3rc2/lib/export/irs/Makefile.in +--- bind-9.9.3rc2/lib/export/irs/Makefile.in.exportlib 2013-04-30 08:38:46.000000000 +0200 ++++ bind-9.9.3rc2/lib/export/irs/Makefile.in 2013-05-13 10:45:22.575089729 +0200 +@@ -43,9 +43,9 @@ SRCS = context.c \ + gai_sterror.c getaddrinfo.c getnameinfo.c \ + resconf.c + +-ISCLIBS = ../isc/libisc.@A@ +-DNSLIBS = ../dns/libdns.@A@ +-ISCCFGLIBS = ../isccfg/libisccfg.@A@ ++ISCLIBS = ../isc/libisc-export.@A@ ++DNSLIBS = ../dns/libdns-export.@A@ ++ISCCFGLIBS = ../isccfg/libisccfg-export.@A@ + + LIBS = @LIBS@ + +@@ -62,26 +62,26 @@ version.@O@: ${srcdir}/version.c + -DLIBAGE=${LIBAGE} \ + -c ${srcdir}/version.c + +-libirs.@SA@: ${OBJS} version.@O@ ++libirs-export.@SA@: ${OBJS} version.@O@ + ${AR} ${ARFLAGS} $@ ${OBJS} version.@O@ + ${RANLIB} $@ + +-libirs.la: ${OBJS} version.@O@ ++libirs-export.la: ${OBJS} version.@O@ + ${LIBTOOL_MODE_LINK} \ +- ${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libirs.la \ ++ ${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libirs-export.la \ + -rpath ${export_libdir} \ + -version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \ + ${OBJS} version.@O@ ${LIBS} ${ISCCFGLIBS} ${DNSLIBS} ${ISCLIBS} + +-timestamp: libirs.@A@ ++timestamp: libirs-export.@A@ + touch timestamp + + installdirs: + $(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${export_libdir} + + install:: timestamp installdirs +- ${LIBTOOL_MODE_INSTALL} ${INSTALL_DATA} libirs.@A@ \ ++ ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} libirs-export.@A@ \ + ${DESTDIR}${export_libdir}/ + + clean distclean:: +- rm -f libirs.@A@ libirs.la timestamp ++ rm -f libirs-export.@A@ libirs-export.la timestamp +diff -up bind-9.9.3rc2/lib/export/isccfg/Makefile.in.exportlib bind-9.9.3rc2/lib/export/isccfg/Makefile.in +--- bind-9.9.3rc2/lib/export/isccfg/Makefile.in.exportlib 2013-04-30 08:38:46.000000000 +0200 ++++ bind-9.9.3rc2/lib/export/isccfg/Makefile.in 2013-05-13 10:45:22.576089729 +0200 +@@ -30,11 +30,11 @@ CINCLUDES = -I. ${DNS_INCLUDES} -I${expo + CDEFINES = + CWARNINGS = + +-ISCLIBS = ../isc/libisc.@A@ +-DNSLIBS = ../dns/libdns.@A@ @DNS_CRYPTO_LIBS@ ++ISCLIBS = ../isc/libisc-export.@A@ ++DNSLIBS = ../dns/libdns-export.@A@ @DNS_CRYPTO_LIBS@ + + ISCDEPLIBS = ../../lib/isc/libisc.@A@ +-ISCCFGDEPLIBS = libisccfg.@A@ ++ISCCFGDEPLIBS = libisccfg-export.@A@ + + LIBS = @LIBS@ + +@@ -58,26 +58,26 @@ version.@O@: ${srcdir}/version.c + -DLIBAGE=${LIBAGE} \ + -c ${srcdir}/version.c + +-libisccfg.@SA@: ${OBJS} ++libisccfg-export.@SA@: ${OBJS} + ${AR} ${ARFLAGS} $@ ${OBJS} + ${RANLIB} $@ + +-libisccfg.la: ${OBJS} ++libisccfg-export.la: ${OBJS} + ${LIBTOOL_MODE_LINK} \ +- ${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisccfg.la \ ++ ${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisccfg-export.la \ + -rpath ${export_libdir} \ + -version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \ + ${OBJS} ${LIBS} ${DNSLIBS} ${ISCLIBS} + +-timestamp: libisccfg.@A@ ++timestamp: libisccfg-export.@A@ + touch timestamp + + installdirs: + $(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${export_libdir} + + install:: timestamp installdirs +- ${LIBTOOL_MODE_INSTALL} ${INSTALL_DATA} libisccfg.@A@ \ ++ ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} libisccfg-export.@A@ \ + ${DESTDIR}${export_libdir}/ + + clean distclean:: +- rm -f libisccfg.@A@ timestamp ++ rm -f libisccfg-export.@A@ timestamp +diff -up bind-9.9.3rc2/lib/export/isc/Makefile.in.exportlib bind-9.9.3rc2/lib/export/isc/Makefile.in +--- bind-9.9.3rc2/lib/export/isc/Makefile.in.exportlib 2013-04-30 08:38:46.000000000 +0200 ++++ bind-9.9.3rc2/lib/export/isc/Makefile.in 2013-05-13 10:45:22.576089729 +0200 +@@ -100,6 +100,10 @@ SRCS = @ISC_EXTRA_SRCS@ \ + + LIBS = @LIBS@ + ++# Note: the order of SUBDIRS is important. ++# Attempt to disable parallel processing. ++.NOTPARALLEL: ++.NO_PARALLEL: + SUBDIRS = include unix nls @ISC_THREAD_DIR@ + TARGETS = timestamp + +@@ -113,26 +117,26 @@ version.@O@: ${srcdir}/version.c + -DLIBAGE=${LIBAGE} \ + -c ${srcdir}/version.c + +-libisc.@SA@: ${OBJS} ++libisc-export.@SA@: ${OBJS} + ${AR} ${ARFLAGS} $@ ${OBJS} + ${RANLIB} $@ + +-libisc.la: ${OBJS} ++libisc-export.la: ${OBJS} + ${LIBTOOL_MODE_LINK} \ +- ${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisc.la \ ++ ${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisc-export.la \ + -rpath ${export_libdir} \ + -version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \ + ${OBJS} ${LIBS} + +-timestamp: libisc.@A@ ++timestamp: libisc-export.@A@ + touch timestamp + + installdirs: + $(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${export_libdir} + + install:: timestamp installdirs +- ${LIBTOOL_MODE_INSTALL} ${INSTALL_DATA} libisc.@A@ \ ++ ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} libisc-export.@A@ \ + ${DESTDIR}${export_libdir} + + clean distclean:: +- rm -f libisc.@A@ libisc.la timestamp ++ rm -f libisc-export.@A@ libisc-export.la timestamp +diff -up bind-9.9.3rc2/lib/export/samples/Makefile.in.exportlib bind-9.9.3rc2/lib/export/samples/Makefile.in +--- bind-9.9.3rc2/lib/export/samples/Makefile.in.exportlib 2013-04-30 08:38:46.000000000 +0200 ++++ bind-9.9.3rc2/lib/export/samples/Makefile.in 2013-05-13 10:45:22.577089729 +0200 +@@ -31,15 +31,15 @@ CINCLUDES = -I${srcdir}/include -I../dns + CDEFINES = + CWARNINGS = + +-DNSLIBS = ../dns/libdns.@A@ @DNS_CRYPTO_LIBS@ +-ISCLIBS = ../isc/libisc.@A@ +-ISCCFGLIBS = ../isccfg/libisccfg.@A@ +-IRSLIBS = ../irs/libirs.@A@ ++DNSLIBS = ../dns/libdns-export.@A@ @DNS_CRYPTO_LIBS@ ++ISCLIBS = ../isc/libisc-export.@A@ ++ISCCFGLIBS = ../isccfg/libisccfg-export.@A@ ++IRSLIBS = ../irs/libirs-export.@A@ + +-DNSDEPLIBS = ../dns/libdns.@A@ +-ISCDEPLIBS = ../isc/libisc.@A@ +-ISCCFGDEPLIBS = ../isccfg/libisccfg.@A@ +-IRSDEPLIBS = ../irs/libirs.@A@ ++DNSDEPLIBS = ../dns/libdns-export.@A@ ++ISCDEPLIBS = ../isc/libisc-export.@A@ ++ISCCFGDEPLIBS = ../isccfg/libisccfg-export.@A@ ++IRSDEPLIBS = ../irs/libirs-export.@A@ + + DEPLIBS = ${DNSDEPLIBS} ${ISCCFGDEPLIBS} ${ISCDEPLIBS} + diff --git a/named-chroot.files b/named-chroot.files index c901664..c186664 100644 --- a/named-chroot.files +++ b/named-chroot.files @@ -18,7 +18,6 @@ /usr/lib64/bind /usr/lib/bind /usr/share/GeoIP -/usr/share/dns-root-data /run/named /proc/sys/net/ipv4/ip_local_port_range # Warning: the order is important diff --git a/named-chroot.service b/named-chroot.service index 4c38601..ff793f2 100644 --- a/named-chroot.service +++ b/named-chroot.service @@ -25,7 +25,6 @@ ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/r ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID' PrivateTmp=false -Restart=on-abnormal [Install] WantedBy=multi-user.target diff --git a/named-mkroot.sh b/named-mkroot.sh deleted file mode 100755 index 288725b..0000000 --- a/named-mkroot.sh +++ /dev/null @@ -1,20 +0,0 @@ -#!/bin/sh -# Create named.root.key from dns-root-data package - -ROOT_DS=/usr/share/dns-root-data/root.ds -: ${OUTPUT:=named.root.key} - -if ! [ -r "$ROOT_DS" ]; then - echo "Root trust file is not readable: $ROOT_DS" - exit 1 -fi - -echo "# Autogenerated from $ROOT_DS" > "$OUTPUT" -echo "trust-anchors {" >> "$OUTPUT" -cat "$ROOT_DS" | while read DOMAIN CLS QTYPE KEYTAG ALG DIG HASH; -do - echo "$DOMAIN initial-ds $KEYTAG $ALG $DIG \"$HASH\";" >> "$OUTPUT"; -done -echo "}; " >> "$OUTPUT" -# Set the same modification time as data source. -touch -r $ROOT_DS "$OUTPUT" diff --git a/named.conf.sample b/named.conf.sample index 61229b7..0f3ae98 100644 --- a/named.conf.sample +++ b/named.conf.sample @@ -1,11 +1,11 @@ -# vim: ft=named: /* Sample named.conf BIND DNS server 'named' configuration file for the Red Hat BIND distribution. See the BIND Administrator's Reference Manual (ARM) for details, in: - file:///usr/share/doc/bind/html/index.html - Or on upstream site: https://bind9.readthedocs.org/ + file:///usr/share/doc/bind-{version}/arm/Bv9ARM.html + Also see the BIND Configuration GUI : /usr/bin/system-config-bind and + its manual. */ options @@ -47,7 +47,6 @@ options allow-query { localhost; }; allow-query-cache { localhost; }; - allow-transfer { localhost; }; /* Enable/disable recursion - recursion yes/no; @@ -65,7 +64,7 @@ options /* DNSSEC related options. See information about keys ("Trusted keys", bellow) */ /* Enable DNSSEC validation on recursive servers */ - dnssec-validation auto; + dnssec-validation yes; /* In Fedora we use /run/named instead of default /var/run/named so we have to configure paths properly. */ @@ -166,7 +165,7 @@ view "internal" zone "my.slave.internal.zone" { type secondary; file "slaves/my.slave.internal.zone.db"; - primaries { /* put master nameserver IPs here */ 127.0.0.1; } ; + masters { /* put master nameserver IPs here */ 127.0.0.1; } ; // put slave zones in the slaves/ directory so named can update them }; zone "my.ddns.internal.zone" { @@ -180,8 +179,7 @@ view "internal" key ddns_key { algorithm hmac-sha256; - #secret "use /usr/sbin/ddns-confgen to generate TSIG keys"; - secret "dXNlIC91c3Ivc2Jpbi9kZG5zLWNvbmZnZW4gdG8gZ2VuZXJhdGUgVFNJRyBrZXlz"; + secret "use /usr/sbin/ddns-confgen to generate TSIG keys"; }; view "external" @@ -214,13 +212,19 @@ view "external" This statement contains DNSSEC keys. If you want DNSSEC aware resolver you should configure at least one trusted key. - Note that no key written below is valid. Especially root key is maintained in - /etc/named.root.key file. + Note that no key written below is valid. Especially root key because root zone + is not signed yet. */ /* trust-anchors { // Root Key -. initial-ds 38696 8 2 "683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A4C0FB2B16"; +. initial-key 257 3 8 "AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3 + +/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kv + ArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF + 0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+e + oZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfd + RUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwN + R1AkUTV74bU="; // Key for forward zone example.com. static-key 257 3 8 "AwEAAZ0aqu1rJ6orJynrRfNpPmayJZoAx9Ic2/Rl9VQW @@ -234,6 +238,6 @@ example.com. static-key 257 3 8 "AwEAAZ0aqu1rJ6orJynrRfNpPmayJZoAx9Ic2/Rl9VQW // Key for reverse zone. -2.0.192.IN-ADDRPA.NET. static-ds 31406 8 2 "F78CF3344F72137235098ECBBD08947C2C9001C7F6A085A17F518B5D8F6B916D"; +2.0.192.IN-ADDRPA.NET. initial-ds 31406 8 2 "F78CF3344F72137235098ECBBD08947C2C9001C7F6A085A17F518B5D8F6B916D"; }; */ diff --git a/named.logrotate b/named.logrotate index 17f41d9..5df448f 100644 --- a/named.logrotate +++ b/named.logrotate @@ -2,8 +2,11 @@ missingok su named named create 0644 named named - notifempty postrotate - /usr/bin/rndc closelogs > /dev/null 2>&1 || true + /usr/bin/systemctl reload named.service > /dev/null 2>&1 || true + /usr/bin/systemctl reload named-chroot.service > /dev/null 2>&1 || true + /usr/bin/systemctl reload named-sdb.service > /dev/null 2>&1 || true + /usr/bin/systemctl reload named-sdb-chroot.service > /dev/null 2>&1 || true + /usr/bin/systemctl reload named-pkcs11.service > /dev/null 2>&1 || true endscript } diff --git a/named.root b/named.root new file mode 100644 index 0000000..8b8a3b1 --- /dev/null +++ b/named.root @@ -0,0 +1,92 @@ +; This file holds the information on root name servers needed to +; initialize cache of Internet domain name servers +; (e.g. reference this file in the "cache . " +; configuration file of BIND domain name servers). +; +; This file is made available by InterNIC +; under anonymous FTP as +; file /domain/named.cache +; on server FTP.INTERNIC.NET +; -OR- RS.INTERNIC.NET +; +; last update: December 20, 2023 +; related version of root zone: 2023122001 +; +; FORMERLY NS.INTERNIC.NET +; +. 3600000 NS A.ROOT-SERVERS.NET. +A.ROOT-SERVERS.NET. 3600000 A 198.41.0.4 +A.ROOT-SERVERS.NET. 3600000 AAAA 2001:503:ba3e::2:30 +; +; FORMERLY NS1.ISI.EDU +; +. 3600000 NS B.ROOT-SERVERS.NET. +B.ROOT-SERVERS.NET. 3600000 A 170.247.170.2 +B.ROOT-SERVERS.NET. 3600000 AAAA 2801:1b8:10::b +; +; FORMERLY C.PSI.NET +; +. 3600000 NS C.ROOT-SERVERS.NET. +C.ROOT-SERVERS.NET. 3600000 A 192.33.4.12 +C.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:2::c +; +; FORMERLY TERP.UMD.EDU +; +. 3600000 NS D.ROOT-SERVERS.NET. +D.ROOT-SERVERS.NET. 3600000 A 199.7.91.13 +D.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:2d::d +; +; FORMERLY NS.NASA.GOV +; +. 3600000 NS E.ROOT-SERVERS.NET. +E.ROOT-SERVERS.NET. 3600000 A 192.203.230.10 +E.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:a8::e +; +; FORMERLY NS.ISC.ORG +; +. 3600000 NS F.ROOT-SERVERS.NET. +F.ROOT-SERVERS.NET. 3600000 A 192.5.5.241 +F.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:2f::f +; +; FORMERLY NS.NIC.DDN.MIL +; +. 3600000 NS G.ROOT-SERVERS.NET. +G.ROOT-SERVERS.NET. 3600000 A 192.112.36.4 +G.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:12::d0d +; +; FORMERLY AOS.ARL.ARMY.MIL +; +. 3600000 NS H.ROOT-SERVERS.NET. +H.ROOT-SERVERS.NET. 3600000 A 198.97.190.53 +H.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:1::53 +; +; FORMERLY NIC.NORDU.NET +; +. 3600000 NS I.ROOT-SERVERS.NET. +I.ROOT-SERVERS.NET. 3600000 A 192.36.148.17 +I.ROOT-SERVERS.NET. 3600000 AAAA 2001:7fe::53 +; +; OPERATED BY VERISIGN, INC. +; +. 3600000 NS J.ROOT-SERVERS.NET. +J.ROOT-SERVERS.NET. 3600000 A 192.58.128.30 +J.ROOT-SERVERS.NET. 3600000 AAAA 2001:503:c27::2:30 +; +; OPERATED BY RIPE NCC +; +. 3600000 NS K.ROOT-SERVERS.NET. +K.ROOT-SERVERS.NET. 3600000 A 193.0.14.129 +K.ROOT-SERVERS.NET. 3600000 AAAA 2001:7fd::1 +; +; OPERATED BY ICANN +; +. 3600000 NS L.ROOT-SERVERS.NET. +L.ROOT-SERVERS.NET. 3600000 A 199.7.83.42 +L.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:9f::42 +; +; OPERATED BY WIDE +; +. 3600000 NS M.ROOT-SERVERS.NET. +M.ROOT-SERVERS.NET. 3600000 A 202.12.27.33 +M.ROOT-SERVERS.NET. 3600000 AAAA 2001:dc3::35 +; End of file \ No newline at end of file diff --git a/named.root.key b/named.root.key index 6d0904d..fbcb5d3 100644 --- a/named.root.key +++ b/named.root.key @@ -1,5 +1,13 @@ -# Autogenerated from /usr/share/dns-root-data/root.ds -truste-anchors { -. initial-ds 20326 8 2 "E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D"; -. initial-ds 38696 8 2 "683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A4C0FB2B16"; -}; +trust-anchors { + # ROOT KEYS: See https://data.iana.org/root-anchors/root-anchors.xml + # for current trust anchor information. + # + # This key (20326) was published in the root zone in 2017. + # Servers which were already using the old key (19036) should + # roll seamlessly to this new one via RFC 5011 rollover. Servers + # being set up for the first time can use the contents of this + # file as initializing keys; thereafter, the keys in the + # managed key database will be trusted and maintained + # automatically. + . initial-ds 20326 8 2 "E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D"; +}; diff --git a/named.rwtab b/named.rwtab new file mode 100644 index 0000000..2cb3a41 --- /dev/null +++ b/named.rwtab @@ -0,0 +1,6 @@ +dirs /var/named + +files /var/named/named.ca +files /var/named/named.empty +files /var/named/named.localhost +files /var/named/named.loopback diff --git a/named.service b/named.service index 5c32fc5..252c9d5 100644 --- a/named.service +++ b/named.service @@ -20,7 +20,6 @@ ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/r ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID' PrivateTmp=true -Restart=on-abnormal [Install] WantedBy=multi-user.target diff --git a/sources b/sources index c97ab7f..8aad670 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.21.22.tar.xz) = f9e11d150162661c755dabdd7862c0565e6a10077e2a6aee04f8cefce94c262d8928ff9e42f8c8750242aee3b0992afe2f49f72f0f8cab8b7e4ae1c9fc06e0fa -SHA512 (bind-9.21.22.tar.xz.asc) = 1e0bd14fad5754e12b6a4855dbed698dba74468790948316e17442e5bc840fc81d18e590fd78186a1e26e9526870b13470dcef6a15644e91775cc8883813ad24 +SHA512 (bind-9.19.22.tar.xz) = 609f73ab7e34e9ef0e5854a0bf150009c1ae34615c5f8c7fecf0352ea65ce0d92fecc02b918a0b3b90b3c303dad659e4981a97b1413d02724b20a5ed2d1d905f +SHA512 (bind-9.19.22.tar.xz.asc) = 4839365da593ab6b924372019bbb8b8212856116c563e4f9b6d0b03681234fb855b7f3c85766919fac400be7508f7b72bc9d2a3d8496ce9ee21c6b5fb4369cf3 diff --git a/trusted-key.key b/trusted-key.key new file mode 100644 index 0000000..7b845f3 --- /dev/null +++ b/trusted-key.key @@ -0,0 +1 @@ +. 3600 IN DNSKEY 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU=