Switch downstream change to upstream for 32b mem check

Downstream fix was not working anymore and upstream fix is better.
Update to 9.21.22 (rhbz#2480122)
2026-06-05 12:32:14 +02:00 · 2026-06-05 12:32:14 +02:00 · 2026-04-29 19:56:59 +02:00 · 2026-04-29 19:56:59 +02:00 · 2026-04-29 19:56:59 +02:00 · 2026-04-29 19:56:59 +02:00
6 changed files with 300 additions and 5 deletions
--- a/bind-9.11.12.tar.gz.asc
+++ b/bind-9.11.12.tar.gz.asc
@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABAgAdFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAl2WMooACgkQdLtrmky7
+PThv2RAAnXNLYTzXtH6ls29tRm5Hc+D6UaeqcWDNQ4BpkRVhrFxtukalGCi9mmB6
+NPJzFyXmaOW654pypCIuEgqJNFUpDtLzLzT7SUF+mhm+5plsaRSBnh4mq87l5KSp
+twODAPnfCJV+HBk5RmToLEstAbGQ7xEBTyQtZoFkY+V7zEFwENKiCvWsoSWOkYR3
+zXo3sKjc83HV9ShbW/mCtbZf5L0qlbrKOAzqJfAFMhNNJi8kMbmr/Zi2sIfN+Rhv
+g8HQo89Epv6r51yAdeED8idIX4rKjjcEtHrZeDmLdCcdHgSEj2sIlH92Joce6vL0
+S59A0rItIXm6fW8sz6WNpcj4tVtWYbIYjXZ4SPFNkaUrHv8cUekq+5vbI+v07Gh3
+2bhtDsDyTY5I1/AsY/EFmwkCAjUS00jZryBnuJpLB3v5JtUog4ek32yLBzPrqRBo
+1876j4nlXAia8mG0OgJNWZ0gHyUPe/TgfR8fQDLmHxHHlKrJNTEwY6bLW8jzFTX1
+zk510fI1K7J9tiQgf5wcBQ2h3EBlqzDNIJDovoATzLYIf0HKyVegh/vnQdtdEhUR
+1DzJAt3bsBfAP1AFfWPD/ACu5Zdm7SxY1wE/pjkwttDU3sRZqOfuwNBGeolu3cVN
+O9/h1zsyVeVS0ui2vu4+V4EvNitmXsVbG2doDq9L5yBiIKGO2Ew=
+=GCy6
+-----END PGP SIGNATURE-----
--- a/bind-9.14.7.tar.gz.asc
+++ b/bind-9.14.7.tar.gz.asc
@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABAgAdFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAl2WMpEACgkQdLtrmky7
+PTh/sg//QbNRAQvADQfwF1PPo+JxB+3WzQ9oJAWeHbOoiubwkUwO9xE+BEnTNd5o
+oM1lSLqFxNykOTaoeJlqPftPod1cxo7lSzkwflugGyB/59wliCpqCg053YV4x9mO
+QggvA/E50+0FI/Om/7v4GHGADu/JE83FovOueWAB0LgqfDSD6QFcNFF9sUJJ4P7r
+FcEXSWj8QbrHMWBKncZUOpD2ECotvtrYmi0DTHl1XfigESDQpWtsnTFuabCCsvkh
+ch9wQRplAes2Mf/aS5tl1y0QKKBFuEjtGiTdgrDl6o9GLnx6CueX5saZehu2EVkr
+fq2vEYUC2lRQSjuxSMMJ3L0TGUcl7+ixlAIISS2K9L5Xx7MhBXt/EH5KiKPfsEet
+3EH+DhxV5uXjDU7MgvREnxT+ssV23e0HWTz4tVVQ9LpvYmWPIgLcSOhHCc57yoQF
+c46V0f69dMWbMAlQ93EZSG274ZvpIszpK8+3hGI3/TuDFFgiQJeJJBFVtYJMle69
+3mEEclfzO7fBiXZFec6nVx2309bL64bafN7zszPKXl4XgoefOfD0v0eWqQT4fxfm
+dnGC0qMqSZs5F+d0fISV5JUUNYzt9PZjvnzqLLGOeTF6l3/n9G1mmNsXcxJ1OEIF
+6qh1oO7JTPjt0MFhKac4QjNQi/Bnp25O3I/PRyWZCbiwXkyvyQU=
+=ZT7s
+-----END PGP SIGNATURE-----
--- a/bind-9.21-unittest-isc_rwlock-s390x.patch
+++ b/bind-9.21-unittest-isc_rwlock-s390x.patch
@ -0,0 +1,29 @@
+From b8bc86834311e4ea27fe75052db08279045f027b Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Wed, 20 Nov 2024 15:34:29 +0100
+Subject: [PATCH] Skip isc_rwlock_benchmark on s390x
+
+Not sure why, but it repeatedly failed on isc_rwlock_benchmark function.
+Not sure if it requires more time only or there is some strange error.
+---
+ tests/isc/rwlock_test.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/tests/isc/rwlock_test.c b/tests/isc/rwlock_test.c
+index 4c5b8e0..a28b7d9 100644
+--- a/tests/isc/rwlock_test.c
+++ b/tests/isc/rwlock_test.c
+@@ -340,7 +340,10 @@ ISC_TEST_ENTRY_CUSTOM(isc_rwlock_wrlock, rwlock_setup, rwlock_teardown)
+ #if !defined(__SANITIZE_THREAD__)
+ ISC_TEST_ENTRY_CUSTOM(isc_rwlock_tryupgrade, rwlock_setup, rwlock_teardown)
+ ISC_TEST_ENTRY_CUSTOM(isc_rwlock_trylock, rwlock_setup, rwlock_teardown)
+#ifndef __s390x__
+// TODO: find why this stucks.
+ ISC_TEST_ENTRY_CUSTOM(isc_rwlock_benchmark, rwlock_setup, rwlock_teardown)
+#endif
+ #endif /* __SANITIZE_THREAD__ */
+ 
+ ISC_TEST_LIST_END
+-- 
+2.47.0
+
--- a/bind9-next.spec
+++ b/bind9-next.spec
@ -77,6 +77,7 @@ Source37: named.service
 Source38: named-chroot.service
 Source41: setup-named-chroot.sh
 Source42: generate-rndc-key.sh
+Source43: named.rwtab
 Source44: named-chroot-setup.service
 Source46: named-setup-rndc.service
 Source48: setup-named-softhsm.sh
@ -85,6 +86,8 @@ Source49: named-chroot.files
 # Common patches
 # Red Hat specific documentation is not relevant to upstream
 Patch1: bind-9.16-redhat_doc.patch
+# Downstream only. TODO: find a cause and remove this workaround
+Patch3: bind-9.21-unittest-isc_rwlock-s390x.patch
 # https://gitlab.isc.org/isc-projects/bind9/-/issues/5328
 # avoid often fails on i386, unsupported upstream
 Patch4: bind-9.21-unittest-qpdb-i386.patch
@ -407,11 +410,6 @@ gzip doc/changelog/changelog-*.rst
 #systemtest_prepare_build build

 %check
-# reduce test loops (from default 100) for isc/{mutex/spinlock/rwlock}
-# to allow rwlock(isc_rwlock_benchmark) to finish within the 300 seconds
-# timeout limit on platforms (riscv64,s390x) where it is slow
-# TODO: find out why it is slow
-export ISC_BENCHMARK_LOOPS=20
 %if %{with UNITTEST} || %{with SYSTEMTEST}
  # Tests require initialization of pkcs11 token
  eval "$(bash %{SOURCE48} -A "`pwd`/softhsm-tokens")"
@ -621,6 +619,9 @@ done
 mkdir -p ${RPM_BUILD_ROOT}%{_tmpfilesdir}
 install -m 644 %{SOURCE35} ${RPM_BUILD_ROOT}%{_tmpfilesdir}/named.conf

+mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/rwtab.d
+install -m 644 %{SOURCE43} ${RPM_BUILD_ROOT}%{_sysconfdir}/rwtab.d/named
+
 install -m0644 -D bind9-next.sysusers.conf %{buildroot}%{_sysusersdir}/bind9-next.conf

 %post
@ -721,6 +722,7 @@ fi;
 %config(noreplace) %{_sysconfdir}/logrotate.d/named
 %{_tmpfilesdir}/named.conf
 %{_sysusersdir}/bind9-next.conf
+%{_sysconfdir}/rwtab.d/named
 %{_unitdir}/named.service
 %{_unitdir}/named-setup-rndc.service
 %{_bindir}/named-journalprint
--- a/bind97-exportlib.patch
+++ b/bind97-exportlib.patch
@ -0,0 +1,226 @@
+diff -up bind-9.9.3rc2/isc-config.sh.in.exportlib bind-9.9.3rc2/isc-config.sh.in
+diff -up bind-9.9.3rc2/lib/export/dns/Makefile.in.exportlib bind-9.9.3rc2/lib/export/dns/Makefile.in
+--- bind-9.9.3rc2/lib/export/dns/Makefile.in.exportlib	2013-04-30 08:38:46.000000000 +0200
+++ bind-9.9.3rc2/lib/export/dns/Makefile.in	2013-05-13 10:45:22.574089729 +0200
+@@ -35,9 +35,9 @@ CDEFINES =	-DUSE_MD5 @USE_OPENSSL@ @USE_
+ 
+ CWARNINGS =
+ 
+-ISCLIBS =	../isc/libisc.@A@
+ISCLIBS =	../isc/libisc-export.@A@
+ 
+-ISCDEPLIBS =	../isc/libisc.@A@
+ISCDEPLIBS =	../isc/libisc-export.@A@
+ 
+ LIBS =		@LIBS@
+ 
+@@ -116,29 +116,29 @@ version.@O@: ${srcdir}/version.c
+ 		-DLIBAGE=${LIBAGE} \
+ 		-c ${srcdir}/version.c
+ 
+-libdns.@SA@: ${OBJS}
+libdns-export.@SA@: ${OBJS}
+ 	${AR} ${ARFLAGS} $@ ${OBJS}
+ 	${RANLIB} $@
+ 
+-libdns.la: ${OBJS}
+libdns-export.la: ${OBJS}
+ 	${LIBTOOL_MODE_LINK} \
+-		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libdns.la \
+		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libdns-export.la \
+ 		-rpath ${export_libdir} \
+ 		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
+ 		${OBJS} ${ISCLIBS} @DNS_CRYPTO_LIBS@ ${LIBS}
+ 
+-timestamp: libdns.@A@
+timestamp: libdns-export.@A@
+ 	touch timestamp
+ 
+ installdirs:
+ 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${export_libdir}
+ 
+ install:: timestamp installdirs
+-	${LIBTOOL_MODE_INSTALL} ${INSTALL_DATA} libdns.@A@ \
+	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} libdns-export.@A@ \
+ 	${DESTDIR}${export_libdir}/
+ 
+ clean distclean::
+-	rm -f libdns.@A@ timestamp
+	rm -f libdns-export.@A@ timestamp
+ 	rm -f gen code.h include/dns/enumtype.h include/dns/enumclass.h
+ 	rm -f include/dns/rdatastruct.h
+ 
+diff -up bind-9.9.3rc2/lib/export/irs/Makefile.in.exportlib bind-9.9.3rc2/lib/export/irs/Makefile.in
+--- bind-9.9.3rc2/lib/export/irs/Makefile.in.exportlib	2013-04-30 08:38:46.000000000 +0200
+++ bind-9.9.3rc2/lib/export/irs/Makefile.in	2013-05-13 10:45:22.575089729 +0200
+@@ -43,9 +43,9 @@ SRCS =		context.c \
+ 		gai_sterror.c getaddrinfo.c getnameinfo.c \
+ 		resconf.c
+ 
+-ISCLIBS =	../isc/libisc.@A@
+-DNSLIBS =	../dns/libdns.@A@
+-ISCCFGLIBS =	../isccfg/libisccfg.@A@
+ISCLIBS =	../isc/libisc-export.@A@
+DNSLIBS =	../dns/libdns-export.@A@
+ISCCFGLIBS =	../isccfg/libisccfg-export.@A@
+ 
+ LIBS =		@LIBS@
+ 
+@@ -62,26 +62,26 @@ version.@O@: ${srcdir}/version.c
+ 		-DLIBAGE=${LIBAGE} \
+ 		-c ${srcdir}/version.c
+ 
+-libirs.@SA@: ${OBJS} version.@O@
+libirs-export.@SA@: ${OBJS} version.@O@
+ 	${AR} ${ARFLAGS} $@ ${OBJS} version.@O@
+ 	${RANLIB} $@
+ 
+-libirs.la: ${OBJS} version.@O@
+libirs-export.la: ${OBJS} version.@O@
+ 	${LIBTOOL_MODE_LINK} \
+-		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libirs.la \
+		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libirs-export.la \
+ 		-rpath ${export_libdir} \
+ 		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
+ 		${OBJS} version.@O@ ${LIBS} ${ISCCFGLIBS} ${DNSLIBS} ${ISCLIBS}
+ 
+-timestamp: libirs.@A@
+timestamp: libirs-export.@A@
+ 	touch timestamp
+ 
+ installdirs:
+ 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${export_libdir}
+ 
+ install:: timestamp installdirs
+-	${LIBTOOL_MODE_INSTALL} ${INSTALL_DATA} libirs.@A@ \
+	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} libirs-export.@A@ \
+ 	${DESTDIR}${export_libdir}/
+ 
+ clean distclean::
+-	rm -f libirs.@A@ libirs.la timestamp
+	rm -f libirs-export.@A@ libirs-export.la timestamp
+diff -up bind-9.9.3rc2/lib/export/isccfg/Makefile.in.exportlib bind-9.9.3rc2/lib/export/isccfg/Makefile.in
+--- bind-9.9.3rc2/lib/export/isccfg/Makefile.in.exportlib	2013-04-30 08:38:46.000000000 +0200
+++ bind-9.9.3rc2/lib/export/isccfg/Makefile.in	2013-05-13 10:45:22.576089729 +0200
+@@ -30,11 +30,11 @@ CINCLUDES =	-I. ${DNS_INCLUDES} -I${expo
+ CDEFINES =
+ CWARNINGS =
+ 
+-ISCLIBS =	../isc/libisc.@A@
+-DNSLIBS =	../dns/libdns.@A@ @DNS_CRYPTO_LIBS@
+ISCLIBS =	../isc/libisc-export.@A@
+DNSLIBS =	../dns/libdns-export.@A@ @DNS_CRYPTO_LIBS@
+ 
+ ISCDEPLIBS =	../../lib/isc/libisc.@A@
+-ISCCFGDEPLIBS =	libisccfg.@A@
+ISCCFGDEPLIBS =	libisccfg-export.@A@
+ 
+ LIBS =		@LIBS@
+ 
+@@ -58,26 +58,26 @@ version.@O@: ${srcdir}/version.c
+ 		-DLIBAGE=${LIBAGE} \
+ 		-c ${srcdir}/version.c
+ 
+-libisccfg.@SA@: ${OBJS}
+libisccfg-export.@SA@: ${OBJS}
+ 	${AR} ${ARFLAGS} $@ ${OBJS}
+ 	${RANLIB} $@
+ 
+-libisccfg.la: ${OBJS}
+libisccfg-export.la: ${OBJS}
+ 	 ${LIBTOOL_MODE_LINK} \
+-		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisccfg.la \
+		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisccfg-export.la \
+ 		-rpath ${export_libdir} \
+ 		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
+ 		${OBJS} ${LIBS} ${DNSLIBS} ${ISCLIBS}
+ 
+-timestamp: libisccfg.@A@
+timestamp: libisccfg-export.@A@
+ 	touch timestamp
+ 
+ installdirs:
+ 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${export_libdir}
+ 
+ install:: timestamp installdirs
+-	${LIBTOOL_MODE_INSTALL} ${INSTALL_DATA} libisccfg.@A@ \
+	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} libisccfg-export.@A@ \
+ 	${DESTDIR}${export_libdir}/
+ 
+ clean distclean::
+-	rm -f libisccfg.@A@ timestamp
+	rm -f libisccfg-export.@A@ timestamp
+diff -up bind-9.9.3rc2/lib/export/isc/Makefile.in.exportlib bind-9.9.3rc2/lib/export/isc/Makefile.in
+--- bind-9.9.3rc2/lib/export/isc/Makefile.in.exportlib	2013-04-30 08:38:46.000000000 +0200
+++ bind-9.9.3rc2/lib/export/isc/Makefile.in	2013-05-13 10:45:22.576089729 +0200
+@@ -100,6 +100,10 @@ SRCS =		@ISC_EXTRA_SRCS@ \
+ 
+ LIBS =		@LIBS@
+ 
+# Note: the order of SUBDIRS is important.
+# Attempt to disable parallel processing.
+.NOTPARALLEL:
+.NO_PARALLEL:
+ SUBDIRS =	include unix nls @ISC_THREAD_DIR@
+ TARGETS =	timestamp
+ 
+@@ -113,26 +117,26 @@ version.@O@: ${srcdir}/version.c
+ 		-DLIBAGE=${LIBAGE} \
+ 		-c ${srcdir}/version.c
+ 
+-libisc.@SA@: ${OBJS}
+libisc-export.@SA@: ${OBJS}
+ 	${AR} ${ARFLAGS} $@ ${OBJS}
+ 	${RANLIB} $@
+ 
+-libisc.la: ${OBJS}
+libisc-export.la: ${OBJS}
+ 	${LIBTOOL_MODE_LINK} \
+-		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisc.la \
+		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisc-export.la \
+ 		-rpath ${export_libdir} \
+ 		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
+ 		${OBJS} ${LIBS}
+ 
+-timestamp: libisc.@A@
+timestamp: libisc-export.@A@
+ 	touch timestamp
+ 
+ installdirs:
+ 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${export_libdir}
+ 
+ install:: timestamp installdirs
+-	${LIBTOOL_MODE_INSTALL} ${INSTALL_DATA} libisc.@A@ \
+	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} libisc-export.@A@ \
+ 	${DESTDIR}${export_libdir}
+ 
+ clean distclean::
+-	rm -f libisc.@A@ libisc.la timestamp
+	rm -f libisc-export.@A@ libisc-export.la timestamp
+diff -up bind-9.9.3rc2/lib/export/samples/Makefile.in.exportlib bind-9.9.3rc2/lib/export/samples/Makefile.in
+--- bind-9.9.3rc2/lib/export/samples/Makefile.in.exportlib	2013-04-30 08:38:46.000000000 +0200
+++ bind-9.9.3rc2/lib/export/samples/Makefile.in	2013-05-13 10:45:22.577089729 +0200
+@@ -31,15 +31,15 @@ CINCLUDES =	-I${srcdir}/include -I../dns
+ CDEFINES =
+ CWARNINGS =
+ 
+-DNSLIBS =	../dns/libdns.@A@ @DNS_CRYPTO_LIBS@
+-ISCLIBS =	../isc/libisc.@A@
+-ISCCFGLIBS =	../isccfg/libisccfg.@A@
+-IRSLIBS =	../irs/libirs.@A@
+DNSLIBS =	../dns/libdns-export.@A@ @DNS_CRYPTO_LIBS@
+ISCLIBS =	../isc/libisc-export.@A@
+ISCCFGLIBS =	../isccfg/libisccfg-export.@A@
+IRSLIBS =	../irs/libirs-export.@A@
+ 
+-DNSDEPLIBS =	../dns/libdns.@A@
+-ISCDEPLIBS =	../isc/libisc.@A@
+-ISCCFGDEPLIBS =	../isccfg/libisccfg.@A@
+-IRSDEPLIBS =	../irs/libirs.@A@
+DNSDEPLIBS =	../dns/libdns-export.@A@
+ISCDEPLIBS =	../isc/libisc-export.@A@
+ISCCFGDEPLIBS =	../isccfg/libisccfg-export.@A@
+IRSDEPLIBS =	../irs/libirs-export.@A@
+ 
+ DEPLIBS =	${DNSDEPLIBS} ${ISCCFGDEPLIBS} ${ISCDEPLIBS}
+ 
--- a/named.rwtab
+++ b/named.rwtab
@ -0,0 +1,6 @@
+dirs    /var/named
+
+files	/var/named/named.ca
+files	/var/named/named.empty
+files	/var/named/named.localhost
+files	/var/named/named.loopback
Author	SHA1	Message	Date
Petr Menšík	25d3d5e459	Switch downstream change to upstream for 32b mem check Downstream fix was not working anymore and upstream fix is better.	2026-06-05 12:32:14 +02:00
Petr Menšík	8136762a95	Update to 9.21.22 (rhbz#2480122) Security Fixes: - Limit resolver server list size. (CVE-2026-3592) - Fix GSS-API resource leak. (CVE-2026-3039) - Disable recursion, UPDATE, and NOTIFY for non-IN views. (CVE-2026-5946) - Avoid unbounded recursion loop. (CVE-2026-5950) - Fix crash in resolver when SIG(0)-signed responses are received under load. (CVE-2026-5947) - Fix use-after-free error in DNS-over-HTTPS when processing HTTP/2 SETTINGS frames. (CVE-2026-3593) - Fix outgoing zone transfers' quota issue. Feature Changes: - Fix CPU spikes and slow queries when cache approaches memory limit. - Implement RFC 3645 Section 4.1.1 key expiry check in TKEY. - Reduce memory footprint by actively returning unused memory to the OS. An multiple bugfixes. Source: https://downloads.isc.org/isc/bind9/9.21.22/doc/arm/html/notes.html#notes-for-bind-9-21-22	2026-06-05 12:32:14 +02:00
Petr Menšík	a5bdfab2ad	Fix failing unittest on 32 bits	2026-04-29 19:56:59 +02:00
Petr Menšík	fd81016e5c	Switch devel libraries to pkgconfig dependencies Should be more portable across different distributions.	2026-04-29 19:56:59 +02:00
Petr Menšík	fcdfc58880	Remove LMDB conditional builds LMDB is now required, no conditional will help. Remove always present condition.	2026-04-29 19:56:59 +02:00
Petr Menšík	d5c5c64bfb	Update to 9.21.21 (rhbz#2453811) Security Fixes: - Fix crash when reconfiguring zone update policy during active updates. New Features: - Add switch to disable cookie checking in delv. Removed Features: - Remove -C option from dnssec-keygen and dnssec-keyfromlabel. - Remove NZF file support in favor of NZD. Feature Changes: - Parent-centric resolver. - Switch to LRU-only cache eviction, enforce minimum cache size. Bug Fixes: - Fix intermittent named crashes during asynchronous zone operations. - Count temporal problems with DNSSEC validation as attempts. - Fix a possible deadlock in RPZ processing. - Fix update-policy per-type max quota bypass via crafted UPDATE messages. - Fix a crash triggered by rndc modzone on a zone from a configuration file. - Fix the processing of empty catalog zone ACLs. - Fix potential resource leak during resolver error handling. Source: https://downloads.isc.org/isc/bind9/9.21.21/doc/arm/html/notes.html#notes-for-bind-9-21-21	2026-04-29 19:56:59 +02:00
Petr Menšík	cfcac9d28d	Update to 9.21.20 (rhbz#2440560) Security Fixes: - Fix unbounded NSEC3 iterations when validating referrals to unsigned delegations. (CVE-2026-1519) - Fix memory leaks in code preparing DNSSEC proofs of non-existence. (CVE-2026-3104) - Prevent a crash in code processing queries containing a TKEY record. (CVE-2026-3119) - Fix a stack use-after-return flaw in SIG(0) handling code. (CVE-2026-3591) New Features: - Provide response round-trip time (RTT) counters via statistics channel. - Introduce max-delegation-servers configuration option. Bug Fixes: - Fix parsing key inactivation time in KASP code. - Fix the handling of key statements defined inside views. Source: https://downloads.isc.org/isc/bind9/9.21.20/doc/arm/html/notes.html#notes-for-bind-9-21-20	2026-03-25 20:06:56 +01:00
Petr Menšík	26f39c0b26	Update to 9.21.17 (rhbz#2415843) Security Fixes: - Fix incorrect length checks for BRID and HHIT records. (CVE-2025-13878) New Features: - Add support for Extended DNS Error 9 (Missing DNSKEY). - Add support for Extended DNS Error 13 (Cached Error). - Add support for Generalized DNS Notifications. Features Changes: - Add more information to the rndc recursing output about fetches. - Enforce bounds of multiple configuration options. Bug Fixes: - Fix inbound IXFR performance regression. - Make DNSSEC key rollovers more robust. - Fix a catalog zone issue, where member zones could fail to load. - Fix slow speed when signing a large delegation zone with NSEC3 opt-out. - Reconfiguring an NSEC3 opt-out zone to NSEC caused the zone to be invalid. - Fix a possible catalog zone issue during reconfiguration. - Fix the charts in the statistics channel. https://downloads.isc.org/isc/bind9/9.21.17/doc/arm/html/notes.html#notes-for-bind-9-21-17	2026-01-22 15:43:54 +01:00
Petr Menšík	b8ee1a2044	Fix build for RHEL, disable JEMALLOC there	2026-01-22 15:43:54 +01:00
Petr Menšík	584a3dff4f	Update to 9.21.16 (rhbz#2415843) New Features: - Add +[no]showtruncated and +[no]showallmessages to dig. Feature Changes: - Reduce the number of outgoing queries. - Improve output of rndc dnssec -status - Change the QNAME minimization algorithm to follow the standard. - Enforce bounds of prefetch configuration option. - Enforce the fact that catalog zones cannot be used in non-IN views. - Provide more information when memory allocation fails. Bug Fixes: - Adding NSEC3 opt-out records could leave invalid records in chain. - Fix spurious timeouts while resolving names. - Fix bug where zone switches from NSEC3 to NSEC after retransfer. - Fix caching RRSIG covering cached NODATA record. - AMTRELAY type 0 presentation format handling was wrong. - Fix parsing bug in remote-servers with key or TLS. - Fix allow-recursion/allow-query-cache inheritance. - Fix DoT reconfigure/reload bug in the resolver. https://downloads.isc.org/isc/bind9/9.21.16/doc/arm/html/notes.html#notes-for-bind-9-21-16	2026-01-22 15:43:54 +01:00
Petr Menšík	9315af6f9d	Use dns-root-data package for hints source Use trusted root source and hints from separate package.	2026-01-22 15:43:54 +01:00
Petr Menšík	b3bece5114	Update to 9.21.15 (rhbz#2415843) New features: - New rndc showconf command. - named-checkconf -b dumps the built-in configuration. - named-checkconf -e prints the effective configuration. - Add support for Extended DNS Error 24 (Invalid Data). Removed features: - Remove the tkey-domain statement. - Remove the tkey-gssapi-credential statement. Feature changes: - Minimal Meson version required is 1.3.0. Bug fixes: - Skip unsupported algorithms when looking for a signing key. - Report when a zone reload is already in progress. - Fix dnssec-keygen key collision checking for KEY RRtype keys. - dnssec-verify now uses exit code 1 when failing due to illegal options. - Prevent assertion failures of dig when a server is specified before the -b option. - Skip buffer allocations if not logging. https://downloads.isc.org/isc/bind9/9.21.15/doc/arm/html/notes.html#notes-for-bind-9-21-15	2026-01-22 15:43:54 +01:00
Petr Menšík	09e47bcad7	Fix running SYSTEMTEST during build Needs prepared network scripts. Can be used like: fedpkg mockbuild --enable-network --with SYSTEMTEST	2026-01-22 15:43:54 +01:00