SOURCES/bind-9.11-CVE-2023-2828.patch

@@ -1,193 +0,0 @@
-From f3aa755ba5ae5148dd0567357f8c538072e2eabc Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
-Date: Tue, 30 May 2023 08:46:17 +0200
-Subject: [PATCH] Improve RBT overmem cache cleaning
-
-When cache memory usage is over the configured cache size (overmem) and
-we are cleaning unused entries, it might not be enough to clean just two
-entries if the entries to be expired are smaller than the newly added
-rdata.  This could be abused by an attacker to cause a remote Denial of
-Service by possibly running out of the operating system memory.
-
-Currently, the addrdataset() tries to do a single TTL-based cleaning
-considering the serve-stale TTL and then optionally moves to overmem
-cleaning if we are in that condition.  Then the overmem_purge() tries to
-do another single TTL based cleaning from the TTL heap and then continue
-with LRU-based cleaning up to 2 entries cleaned.
-
-Squash the TTL-cleaning mechanism into single call from addrdataset(),
-but ignore the serve-stale TTL if we are currently overmem.
-
-Then instead of having a fixed number of entries to clean, pass the size
-of newly added rdatasetheader to the overmem_purge() function and
-cleanup at least the size of the newly added data.  This prevents the
-cache going over the configured memory limit (`max-cache-size`).
-
-Additionally, refactor the overmem_purge() function to reduce for-loop
-nesting for readability.
----
- lib/dns/rbtdb.c | 109 +++++++++++++++++++++++++++++-------------------
- 1 file changed, 67 insertions(+), 42 deletions(-)
-
-diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
-index 11203e4..cc40eae 100644
---- a/lib/dns/rbtdb.c
-+++ b/lib/dns/rbtdb.c
-@@ -834,7 +834,7 @@ static void update_header(dns_rbtdb_t *rbtdb, rdatasetheader_t *header,
- static void expire_header(dns_rbtdb_t *rbtdb, rdatasetheader_t *header,
- 			  bool tree_locked, expire_t reason);
- static void overmem_purge(dns_rbtdb_t *rbtdb, unsigned int locknum_start,
--			  isc_stdtime_t now, bool tree_locked);
-+			  size_t purgesize, bool tree_locked);
- static isc_result_t resign_insert(dns_rbtdb_t *rbtdb, int idx,
- 				  rdatasetheader_t *newheader);
- static void resign_delete(dns_rbtdb_t *rbtdb, rbtdb_version_t *version,
-@@ -6937,6 +6937,16 @@ addclosest(dns_rbtdb_t *rbtdb, rdatasetheader_t *newheader,
- 
- static dns_dbmethods_t zone_methods;
- 
-+static size_t
-+rdataset_size(rdatasetheader_t *header) {
-+	if (!NONEXISTENT(header)) {
-+		return (dns_rdataslab_size((unsigned char *)header,
-+					   sizeof(*header)));
-+	}
-+
-+	return (sizeof(*header));
-+}
-+
- static isc_result_t
- addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
- 	    isc_stdtime_t now, dns_rdataset_t *rdataset, unsigned int options,
-@@ -7091,7 +7101,8 @@ addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
- 	}
- 
- 	if (cache_is_overmem)
--		overmem_purge(rbtdb, rbtnode->locknum, now, tree_locked);
-+		overmem_purge(rbtdb, rbtnode->locknum, rdataset_size(newheader),
-+			      tree_locked);
- 
- 	NODE_LOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
- 		  isc_rwlocktype_write);
-@@ -7106,9 +7117,19 @@ addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
- 			cleanup_dead_nodes(rbtdb, rbtnode->locknum);
- 
- 		header = isc_heap_element(rbtdb->heaps[rbtnode->locknum], 1);
--		if (header && header->rdh_ttl < now - RBTDB_VIRTUAL)
--			expire_header(rbtdb, header, tree_locked,
--				      expire_ttl);
-+		if (header != NULL) {
-+			dns_ttl_t rdh_ttl = header->rdh_ttl;
-+
-+			/* Only account for stale TTL if cache is not overmem */
-+			if (!cache_is_overmem) {
-+				rdh_ttl += rbtdb->serve_stale_ttl;
-+			}
-+
-+			if (rdh_ttl < now - RBTDB_VIRTUAL) {
-+				expire_header(rbtdb, header, tree_locked,
-+					      expire_ttl);
-+			}
-+		}
- 
- 		/*
- 		 * If we've been holding a write lock on the tree just for
-@@ -10643,54 +10664,58 @@ update_header(dns_rbtdb_t *rbtdb, rdatasetheader_t *header,
- 	ISC_LIST_PREPEND(rbtdb->rdatasets[header->node->locknum], header, link);
- }
- 
-+static size_t
-+expire_lru_headers(dns_rbtdb_t *rbtdb, unsigned int locknum, size_t purgesize,
-+		   bool tree_locked) {
-+	rdatasetheader_t *header, *header_prev;
-+	size_t purged = 0;
-+
-+	for (header = ISC_LIST_TAIL(rbtdb->rdatasets[locknum]);
-+	     header != NULL && purged <= purgesize; header = header_prev)
-+	{
-+		header_prev = ISC_LIST_PREV(header, link);
-+		/*
-+		 * Unlink the entry at this point to avoid checking it
-+		 * again even if it's currently used someone else and
-+		 * cannot be purged at this moment.  This entry won't be
-+		 * referenced any more (so unlinking is safe) since the
-+		 * TTL was reset to 0.
-+		 */
-+		ISC_LIST_UNLINK(rbtdb->rdatasets[locknum], header, link);
-+		size_t header_size = rdataset_size(header);
-+		expire_header(rbtdb, header, tree_locked, expire_lru);
-+		purged += header_size;
-+	}
-+
-+	return (purged);
-+}
-+
- /*%
-- * Purge some expired and/or stale (i.e. unused for some period) cache entries
-- * under an overmem condition.  To recover from this condition quickly, up to
-- * 2 entries will be purged.  This process is triggered while adding a new
-- * entry, and we specifically avoid purging entries in the same LRU bucket as
-- * the one to which the new entry will belong.  Otherwise, we might purge
-- * entries of the same name of different RR types while adding RRsets from a
-- * single response (consider the case where we're adding A and AAAA glue records
-- * of the same NS name).
-+ * Purge some stale (i.e. unused for some period - LRU based cleaning) cache
-+ * entries under the overmem condition.  To recover from this condition quickly,
-+ * we cleanup entries up to the size of newly added rdata (passed as purgesize).
-+ *
-+ * This process is triggered while adding a new entry, and we specifically avoid
-+ * purging entries in the same LRU bucket as the one to which the new entry will
-+ * belong.  Otherwise, we might purge entries of the same name of different RR
-+ * types while adding RRsets from a single response (consider the case where
-+ * we're adding A and AAAA glue records of the same NS name).
-  */
- static void
--overmem_purge(dns_rbtdb_t *rbtdb, unsigned int locknum_start,
--	      isc_stdtime_t now, bool tree_locked)
-+overmem_purge(dns_rbtdb_t *rbtdb, unsigned int locknum_start, size_t purgesize,
-+	      bool tree_locked)
- {
--	rdatasetheader_t *header, *header_prev;
- 	unsigned int locknum;
--	int purgecount = 2;
-+	size_t purged = 0;
- 
- 	for (locknum = (locknum_start + 1) % rbtdb->node_lock_count;
--	     locknum != locknum_start && purgecount > 0;
-+	     locknum != locknum_start && purged <= purgesize;
- 	     locknum = (locknum + 1) % rbtdb->node_lock_count) {
- 		NODE_LOCK(&rbtdb->node_locks[locknum].lock,
- 			  isc_rwlocktype_write);
- 
--		header = isc_heap_element(rbtdb->heaps[locknum], 1);
--		if (header && header->rdh_ttl < now - RBTDB_VIRTUAL) {
--			expire_header(rbtdb, header, tree_locked,
--				      expire_ttl);
--			purgecount--;
--		}
--
--		for (header = ISC_LIST_TAIL(rbtdb->rdatasets[locknum]);
--		     header != NULL && purgecount > 0;
--		     header = header_prev) {
--			header_prev = ISC_LIST_PREV(header, link);
--			/*
--			 * Unlink the entry at this point to avoid checking it
--			 * again even if it's currently used someone else and
--			 * cannot be purged at this moment.  This entry won't be
--			 * referenced any more (so unlinking is safe) since the
--			 * TTL was reset to 0.
--			 */
--			ISC_LIST_UNLINK(rbtdb->rdatasets[locknum], header,
--					link);
--			expire_header(rbtdb, header, tree_locked,
--				      expire_lru);
--			purgecount--;
--		}
-+		purged += expire_lru_headers(rbtdb, locknum, purgesize - purged,
-+					     tree_locked);
- 
- 		NODE_UNLOCK(&rbtdb->node_locks[locknum].lock,
- 				    isc_rwlocktype_write);
--- 
-2.40.1
-

SOURCES/bind-9.16-CVE-2022-3094-1.patch

@@ -1,240 +0,0 @@
-From 128b3b676eb9413b4d25fb29c560895cfbbfa92e Mon Sep 17 00:00:00 2001
-From: Evan Hunt <each@isc.org>
-Date: Thu, 1 Sep 2022 16:05:04 -0700
-Subject: [PATCH] add an update quota
-
-limit the number of simultaneous DNS UPDATE events that can be
-processed by adding a quota for update and update forwarding.
-this quota currently, arbitrarily, defaults to 100.
-
-also add a statistics counter to record when the update quota
-has been exceeded.
-
-(cherry picked from commit 7c47254a140c3e9cf383cda73c7b6a55c4782826)
----
- bin/named/bind9.xsl              |  2 +-
- bin/named/bind9.xsl.h            |  8 +++++++-
- bin/named/include/named/server.h |  7 ++++++-
- bin/named/server.c               |  3 +++
- bin/named/statschannel.c         |  5 +++--
- bin/named/update.c               | 34 +++++++++++++++++++++++++++++++-
- doc/arm/Bv9ARM-book.xml          | 15 ++++++++++++++
- 7 files changed, 68 insertions(+), 6 deletions(-)
-
-diff --git a/bin/named/bind9.xsl b/bin/named/bind9.xsl
-index 9a1c6ff..85fd4c4 100644
---- a/bin/named/bind9.xsl
-+++ b/bin/named/bind9.xsl
-@@ -12,7 +12,7 @@
- 
- <xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns="http://www.w3.org/1999/xhtml" version="1.0">
-   <xsl:output method="html" indent="yes" version="4.0"/>
--  <xsl:template match="statistics[@version=&quot;3.8&quot;]">
-+  <xsl:template match="statistics[@version=&quot;3.8.1&quot;]">
-     <html>
-       <head>
-         <script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js"></script>
-diff --git a/bin/named/bind9.xsl.h b/bin/named/bind9.xsl.h
-index 9ce8cd7..5e0a892 100644
---- a/bin/named/bind9.xsl.h
-+++ b/bin/named/bind9.xsl.h
-@@ -17,7 +17,13 @@ static char xslmsg[] =
- 	"\n"
- 	"<xsl:stylesheet xmlns:xsl=\"http://www.w3.org/1999/XSL/Transform\" xmlns=\"http://www.w3.org/1999/xhtml\" version=\"1.0\">\n"
- 	" <xsl:output method=\"html\" indent=\"yes\" version=\"4.0\"/>\n"
--	" <xsl:template match=\"statistics[@version=&quot;3.8&quot;]\">\n"
-+#if 0
-+	" <!-- the version number **below** must match version in "
-+	"bin/named/statschannel.c -->\n"
-+	" <!-- don't forget to update \"/xml/v<STATS_XML_VERSION_MAJOR>\" in "
-+	"the HTTP endpoints listed below -->\n"
-+#endif
-+	" <xsl:template match=\"statistics[@version=&quot;3.8.1&quot;]\">\n"
- 	" <html>\n"
- 	" <head>\n"
- 	" <script type=\"text/javascript\" src=\"https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js\"></script>\n"
-diff --git a/bin/named/include/named/server.h b/bin/named/include/named/server.h
-index 08a02dc..259acc7 100644
---- a/bin/named/include/named/server.h
-+++ b/bin/named/include/named/server.h
-@@ -137,6 +137,9 @@ struct ns_server {
- 
- 	uint16_t		transfer_tcp_message_size;
- 	isc_rng_t *		rngctx;
-+
-+/* CVE-2022-3094 */
-+	isc_quota_t		updquota;
- };
- 
- struct ns_altsecret {
-@@ -230,7 +233,9 @@ enum {
- 	dns_nsstatscounter_trystale = 59,
- 	dns_nsstatscounter_usedstale = 60,
- 
--	dns_nsstatscounter_max = 61
-+	dns_nsstatscounter_updatequota = 61,
-+
-+	dns_nsstatscounter_max = 62
- };
- 
- /*%
-diff --git a/bin/named/server.c b/bin/named/server.c
-index 2d2fa0e..f09b895 100644
---- a/bin/named/server.c
-+++ b/bin/named/server.c
-@@ -9143,6 +9143,8 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
- 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
- 	result = isc_quota_init(&server->recursionquota, 100);
- 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
-+	result = isc_quota_init(&server->updquota, 100);
-+	RUNTIME_CHECK(result == ISC_R_SUCCESS);
- 
- 	result = dns_aclenv_init(mctx, &server->aclenv);
- 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
-@@ -9410,6 +9412,7 @@ ns_server_destroy(ns_server_t **serverp) {
- 
- 	dns_aclenv_destroy(&server->aclenv);
- 
-+	isc_quota_destroy(&server->updquota);
- 	isc_quota_destroy(&server->recursionquota);
- 	isc_quota_destroy(&server->tcpquota);
- 	isc_quota_destroy(&server->xfroutquota);
-diff --git a/bin/named/statschannel.c b/bin/named/statschannel.c
-index 56a9c21..1e8723c 100644
---- a/bin/named/statschannel.c
-+++ b/bin/named/statschannel.c
-@@ -300,6 +300,7 @@ init_desc(void) {
- 	SET_NSSTATDESC(reclimitdropped,
- 		       "queries dropped due to recursive client limit",
- 		       "RecLimitDropped");
-+	SET_NSSTATDESC(updatequota, "Update quota exceeded", "UpdateQuota");
- 	SET_NSSTATDESC(trystale,
- 		       "attempts to use stale cache data after lookup failure",
- 		       "QryTryStale");
-@@ -1546,7 +1547,7 @@ generatexml(ns_server_t *server, uint32_t flags,
- 			ISC_XMLCHAR "type=\"text/xsl\" href=\"/bind9.xsl\""));
- 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "statistics"));
- 	TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "version",
--					 ISC_XMLCHAR "3.8"));
-+					 ISC_XMLCHAR "3.8.1"));
- 
- 	/* Set common fields for statistics dump */
- 	dumparg.type = isc_statsformat_xml;
-@@ -2303,7 +2304,7 @@ generatejson(ns_server_t *server, size_t *msglen,
- 	/*
- 	 * These statistics are included no matter which URL we use.
- 	 */
--	obj = json_object_new_string("1.2");
-+	obj = json_object_new_string("1.2.1");
- 	CHECKMEM(obj);
- 	json_object_object_add(bindstats, "json-stats-version", obj);
- 
-diff --git a/bin/named/update.c b/bin/named/update.c
-index 6ad7d27..dccc543 100644
---- a/bin/named/update.c
-+++ b/bin/named/update.c
-@@ -1526,6 +1526,17 @@ send_update_event(ns_client_t *client, dns_zone_t *zone) {
- 	isc_task_t *zonetask = NULL;
- 	ns_client_t *evclient;
- 
-+	result = isc_quota_attach(&ns_g_server->updquota,
-+				  &(isc_quota_t *){ NULL });
-+	if (result != ISC_R_SUCCESS) {
-+		update_log(client, zone, LOGLEVEL_PROTOCOL,
-+			   "update failed: too many DNS UPDATEs queued (%s)",
-+			   isc_result_totext(result));
-+		isc_stats_increment(ns_g_server->nsstats,
-+				    dns_nsstatscounter_updatequota);
-+		CHECK(DNS_R_DROP);
-+	}
-+
- 	event = (update_event_t *)
- 		isc_event_allocate(client->mctx, client, DNS_EVENT_UPDATE,
- 				   update_action, NULL, sizeof(*event));
-@@ -1652,7 +1663,12 @@ ns_update_start(ns_client_t *client, isc_result_t sigresult) {
- 	 * We are still in the client task context, so we can
- 	 * simply give an error response without switching tasks.
- 	 */
--	respond(client, result);
-+	if (result == DNS_R_DROP) {
-+		ns_client_next(client, result);
-+	} else {
-+		respond(client, result);
-+	}
-+
- 	if (zone != NULL)
- 		dns_zone_detach(&zone);
- }
-@@ -3385,6 +3401,7 @@ updatedone_action(isc_task_t *task, isc_event_t *event) {
- 		dns_zone_detach(&uev->zone);
- 	client->nupdates--;
- 	respond(client, uev->result);
-+	isc_quota_detach(&(isc_quota_t *){ &ns_g_server->updquota });
- 	isc_event_free(&event);
- 	ns_client_detach(&client);
- }
-@@ -3402,6 +3419,8 @@ forward_fail(isc_task_t *task, isc_event_t *event) {
- 	INSIST(client->nupdates > 0);
- 	client->nupdates--;
- 	respond(client, DNS_R_SERVFAIL);
-+
-+	isc_quota_detach(&(isc_quota_t *){ &ns_g_server->updquota });
- 	isc_event_free(&event);
- 	ns_client_detach(&client);
- }
-@@ -3439,6 +3458,8 @@ forward_done(isc_task_t *task, isc_event_t *event) {
- 	client->nupdates--;
- 	ns_client_sendraw(client, uev->answer);
- 	dns_message_detach(&uev->answer);
-+
-+	isc_quota_detach(&(isc_quota_t *){ &ns_g_server->updquota });
- 	isc_event_free(&event);
- 	ns_client_detach(&client);
- }
-@@ -3472,6 +3493,17 @@ send_forward_event(ns_client_t *client, dns_zone_t *zone) {
- 	isc_task_t *zonetask = NULL;
- 	ns_client_t *evclient;
- 
-+	result = isc_quota_attach(&ns_g_server->updquota,
-+				  &(isc_quota_t *){ NULL });
-+	if (result != ISC_R_SUCCESS) {
-+		update_log(client, zone, LOGLEVEL_PROTOCOL,
-+			   "update failed: too many DNS UPDATEs queued (%s)",
-+			   isc_result_totext(result));
-+		isc_stats_increment(ns_g_server->nsstats,
-+				    dns_nsstatscounter_updatequota);
-+		return (DNS_R_DROP);
-+	}
-+
- 	/*
- 	 * This may take some time so replace this client.
- 	 */
-diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
-index c17f168..9aca6d7 100644
---- a/doc/arm/Bv9ARM-book.xml
-+++ b/doc/arm/Bv9ARM-book.xml
-@@ -15105,6 +15105,21 @@ HOST-127.EXAMPLE. MX 0 .
- 		      </para>
- 		    </entry>
- 		  </row>
-+		  <row rowsep="0">
-+		    <entry colname="1">
-+		      <para><command>UpdateQuota</command></para>
-+		    </entry>
-+		    <entry colname="2">
-+		      <para><command/></para>
-+		    </entry>
-+		    <entry colname="3">
-+		      <para>
-+			This indicates the number of times a dynamic update or update
-+			forwarding request was rejected because the number of pending
-+			requests exceeded the update quota.
-+		      </para>
-+		    </entry>
-+		  </row>
- 		  <row rowsep="0">
- 		    <entry colname="1">
- 		      <para><command>RateDropped</command></para>
--- 
-2.39.2
-

SOURCES/bind-9.16-CVE-2022-3094-2.patch

@@ -1,136 +0,0 @@
-From d9a03233c6ea11f20c2fbeca87b763673859f8b2 Mon Sep 17 00:00:00 2001
-From: Evan Hunt <each@isc.org>
-Date: Thu, 1 Sep 2022 16:22:46 -0700
-Subject: [PATCH] add a configuration option for the update quota
-
-add an "update-quota" option to configure the update quota.
-
-(cherry picked from commit f57758a7303ad0034ff2ff08eaaf2ef899630f19)
----
- bin/named/config.c                   |  1 +
- bin/named/named.conf.docbook         |  2 ++
- bin/named/server.c                   |  1 +
- bin/tests/system/checkconf/good.conf |  1 +
- doc/arm/Bv9ARM-book.xml              | 11 +++++++++++
- doc/arm/options.grammar.xml          |  1 +
- doc/misc/options                     |  1 +
- lib/isccfg/namedconf.c               |  1 +
- 8 files changed, 19 insertions(+)
-
-diff --git a/bin/named/config.c b/bin/named/config.c
-index 62d1e88..e3731cf 100644
---- a/bin/named/config.c
-+++ b/bin/named/config.c
-@@ -134,6 +134,7 @@ options {\n\
- 	transfers-per-ns 2;\n\
- #	treat-cr-as-space <obsolete>;\n\
- 	trust-anchor-telemetry yes;\n\
-+	update-quota 100;\n\
- #	use-id-pool <obsolete>;\n\
- #	use-ixfr <obsolete>;\n\
- \n\
-diff --git a/bin/named/named.conf.docbook b/bin/named/named.conf.docbook
-index 6565fce..5842cb5 100644
---- a/bin/named/named.conf.docbook
-+++ b/bin/named/named.conf.docbook
-@@ -455,6 +455,7 @@ options {
- 	trust-anchor-telemetry <replaceable>boolean</replaceable>; // experimental
- 	try-tcp-refresh <replaceable>boolean</replaceable>;
- 	update-check-ksk <replaceable>boolean</replaceable>;
-+	update-quota <replaceable>integer</replaceable>;
- 	use-alt-transfer-source <replaceable>boolean</replaceable>;
- 	use-v4-udp-ports { <replaceable>portrange</replaceable>; ... };
- 	use-v6-udp-ports { <replaceable>portrange</replaceable>; ... };
-@@ -864,6 +865,7 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
- 		type ( delegation-only | forward | hint | master | redirect
- 		    | slave | static-stub | stub );
- 		update-check-ksk <replaceable>boolean</replaceable>;
-+		update-quota <replaceable>integer</replaceable>;
- 		update-policy ( local | { ( deny | grant ) <replaceable>string</replaceable> (
- 		    6to4-self | external | krb5-self | krb5-selfsub |
- 		    krb5-subdomain | ms-self | ms-selfsub | ms-subdomain |
-diff --git a/bin/named/server.c b/bin/named/server.c
-index f09b895..7af90d0 100644
---- a/bin/named/server.c
-+++ b/bin/named/server.c
-@@ -7792,6 +7792,7 @@ load_configuration(const char *filename, ns_server_t *server,
- 	configure_server_quota(maps, "tcp-clients", &server->tcpquota);
- 	configure_server_quota(maps, "recursive-clients",
- 			       &server->recursionquota);
-+	configure_server_quota(maps, "update-quota", &server->updquota);
- 
- 	if (server->recursionquota.max > 1000) {
- 		int margin = ISC_MAX(100, ns_g_cpus + 1);
-diff --git a/bin/tests/system/checkconf/good.conf b/bin/tests/system/checkconf/good.conf
-index 1359cf3..5d9b292 100644
---- a/bin/tests/system/checkconf/good.conf
-+++ b/bin/tests/system/checkconf/good.conf
-@@ -63,6 +63,7 @@ options {
- 	serial-queries 10;
- 	serial-query-rate 100;
- 	server-id none;
-+	update-quota 200;
- 	max-cache-size 20000000000000;
- 	nta-lifetime 604800;
- 	nta-recheck 604800;
-diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
-index 9aca6d7..acf772b 100644
---- a/doc/arm/Bv9ARM-book.xml
-+++ b/doc/arm/Bv9ARM-book.xml
-@@ -8599,6 +8599,17 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
- 	      </listitem>
- 	    </varlistentry>
- 
-+	    <varlistentry>
-+	      <term><command>update-quota</command></term>
-+	      <listitem>
-+		<para>
-+		This is the maximum number of simultaneous DNS UPDATE messages that
-+		the server will accept for updating local authoritiative zones or
-+			forwarding to a primary server. The default is <userinput>100</userinput>.
-+		</para>
-+	      </listitem>
-+	    </varlistentry>
-+
- 	  </variablelist>
- 
- 	</section>
-diff --git a/doc/arm/options.grammar.xml b/doc/arm/options.grammar.xml
-index 793ac0b..1d17ea8 100644
---- a/doc/arm/options.grammar.xml
-+++ b/doc/arm/options.grammar.xml
-@@ -277,6 +277,7 @@
- 	<command>trust-anchor-telemetry</command> <replaceable>boolean</replaceable>; // experimental
- 	<command>try-tcp-refresh</command> <replaceable>boolean</replaceable>;
- 	<command>update-check-ksk</command> <replaceable>boolean</replaceable>;
-+	<command>update-quota</command> <replaceable>integer</replaceable>;
- 	<command>use-alt-transfer-source</command> <replaceable>boolean</replaceable>;
- 	<command>use-v4-udp-ports</command> { <replaceable>portrange</replaceable>; ... };
- 	<command>use-v6-udp-ports</command> { <replaceable>portrange</replaceable>; ... };
-diff --git a/doc/misc/options b/doc/misc/options
-index fde93c7..e6d6ba6 100644
---- a/doc/misc/options
-+++ b/doc/misc/options
-@@ -357,6 +357,7 @@ options {
-         trust-anchor-telemetry <boolean>; // experimental
-         try-tcp-refresh <boolean>;
-         update-check-ksk <boolean>;
-+        update-quota <integer>;
-         use-alt-transfer-source <boolean>;
-         use-id-pool <boolean>; // obsolete
-         use-ixfr <boolean>; // obsolete
-diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
-index b562f95..667111c 100644
---- a/lib/isccfg/namedconf.c
-+++ b/lib/isccfg/namedconf.c
-@@ -1136,6 +1136,7 @@ options_clauses[] = {
- 	{ "transfers-out", &cfg_type_uint32, 0 },
- 	{ "transfers-per-ns", &cfg_type_uint32, 0 },
- 	{ "treat-cr-as-space", &cfg_type_boolean, CFG_CLAUSEFLAG_OBSOLETE },
-+	{ "update-quota", &cfg_type_uint32, 0 },
- 	{ "use-id-pool", &cfg_type_boolean, CFG_CLAUSEFLAG_OBSOLETE },
- 	{ "use-ixfr", &cfg_type_boolean, CFG_CLAUSEFLAG_OBSOLETE },
- 	{ "use-v4-udp-ports", &cfg_type_bracketed_portlist, 0 },
--- 
-2.39.2
-

SOURCES/bind-9.16-CVE-2022-3094-3.patch

@@ -1,553 +0,0 @@
-From cba333b262b7ee0034a66cc93cf27f6c4918eea2 Mon Sep 17 00:00:00 2001
-From: Evan Hunt <each@isc.org>
-Date: Tue, 8 Nov 2022 17:32:41 -0800
-Subject: [PATCH] move update ACL and update-policy checks before quota
-
-check allow-update, update-policy, and allow-update-forwarding before
-consuming quota slots, so that unauthorized clients can't fill the
-quota.
-
-(this moves the access check before the prerequisite check, which
-violates the precise wording of RFC 2136. however, RFC co-author Paul
-Vixie has stated that the RFC is mistaken on this point; it should have
-said that access checking must happen *no later than* the completion of
-prerequisite checks, not that it must happen exactly then.)
-
-(cherry picked from commit 964f559edb5036880b8e463b8f190b9007ee055d)
----
- bin/named/update.c | 440 ++++++++++++++++++++++++++++++---------------
- 1 file changed, 298 insertions(+), 142 deletions(-)
-
-diff --git a/bin/named/update.c b/bin/named/update.c
-index 8853ee7..4d1fe78 100644
---- a/bin/named/update.c
-+++ b/bin/named/update.c
-@@ -251,6 +251,9 @@ static void updatedone_action(isc_task_t *task, isc_event_t *event);
- static isc_result_t send_forward_event(ns_client_t *client, dns_zone_t *zone);
- static void forward_done(isc_task_t *task, isc_event_t *event);
- static isc_result_t add_rr_prepare_action(void *data, rr_t *rr);
-+static isc_result_t
-+rr_exists(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
-+	  const dns_rdata_t *rdata, bool *flag);
- 
- /**************************************************************************/
- 
-@@ -328,23 +331,24 @@ checkqueryacl(ns_client_t *client, dns_acl_t *queryacl, dns_name_t *zonename,
- {
- 	char namebuf[DNS_NAME_FORMATSIZE];
- 	char classbuf[DNS_RDATACLASS_FORMATSIZE];
--	int level;
- 	isc_result_t result;
-+	bool update_possible =
-+		((updateacl != NULL && !dns_acl_isnone(updateacl)) ||
-+		 ssutable != NULL);
- 
- 	result = ns_client_checkaclsilent(client, NULL, queryacl, true);
- 	if (result != ISC_R_SUCCESS) {
-+		int level = update_possible ? ISC_LOG_ERROR : ISC_LOG_INFO;
-+
- 		dns_name_format(zonename, namebuf, sizeof(namebuf));
- 		dns_rdataclass_format(client->view->rdclass, classbuf,
- 				      sizeof(classbuf));
- 
--		level = (updateacl == NULL && ssutable == NULL) ?
--				ISC_LOG_INFO : ISC_LOG_ERROR;
--
- 		ns_client_log(client, NS_LOGCATEGORY_UPDATE_SECURITY,
- 			      NS_LOGMODULE_UPDATE, level,
- 			      "update '%s/%s' denied due to allow-query",
- 			      namebuf, classbuf);
--	} else if (updateacl == NULL && ssutable == NULL) {
-+	} else if (!update_possible) {
- 		dns_name_format(zonename, namebuf, sizeof(namebuf));
- 		dns_rdataclass_format(client->view->rdclass, classbuf,
- 				      sizeof(classbuf));
-@@ -1525,6 +1529,277 @@ send_update_event(ns_client_t *client, dns_zone_t *zone) {
- 	update_event_t *event = NULL;
- 	isc_task_t *zonetask = NULL;
- 	ns_client_t *evclient;
-+#if 1
-+	dns_ssutable_t *ssutable = NULL;
-+	dns_message_t *request = client->message;
-+	dns_rdataclass_t zoneclass;
-+	dns_rdatatype_t covers;
-+	dns_name_t *zonename = NULL;
-+	dns_db_t *db = NULL;
-+	dns_dbversion_t *ver = NULL;
-+
-+	CHECK(dns_zone_getdb(zone, &db));
-+	zonename = dns_db_origin(db);
-+	zoneclass = dns_db_class(db);
-+	dns_zone_getssutable(zone, &ssutable);
-+	dns_db_currentversion(db, &ver);
-+
-+	/*
-+	 * Update message processing can leak record existence information
-+	 * so check that we are allowed to query this zone.  Additionally,
-+	 * if we would refuse all updates for this zone, we bail out here.
-+	 */
-+	CHECK(checkqueryacl(client, dns_zone_getqueryacl(zone),
-+			    dns_zone_getorigin(zone),
-+			    dns_zone_getupdateacl(zone), ssutable));
-+
-+	/*
-+	 * Check requestor's permissions.
-+	 */
-+	if (ssutable == NULL)
-+		CHECK(checkupdateacl(client, dns_zone_getupdateacl(zone),
-+				     "update", zonename, false, false));
-+	else if (client->signer == NULL && !TCPCLIENT(client))
-+		CHECK(checkupdateacl(client, NULL, "update", zonename,
-+				     false, true));
-+
-+	if (dns_zone_getupdatedisabled(zone))
-+		FAILC(DNS_R_REFUSED, "dynamic update temporarily disabled "
-+				     "because the zone is frozen.  Use "
-+				     "'rndc thaw' to re-enable updates.");
-+
-+	/*
-+	 * Perform the Update Section Prescan.
-+	 */
-+
-+	for (result = dns_message_firstname(request, DNS_SECTION_UPDATE);
-+	     result == ISC_R_SUCCESS;
-+	     result = dns_message_nextname(request, DNS_SECTION_UPDATE))
-+	{
-+		dns_name_t *name = NULL;
-+		dns_rdata_t rdata = DNS_RDATA_INIT;
-+		dns_ttl_t ttl;
-+		dns_rdataclass_t update_class;
-+		get_current_rr(request, DNS_SECTION_UPDATE, zoneclass,
-+			       &name, &rdata, &covers, &ttl, &update_class);
-+
-+		if (! dns_name_issubdomain(name, zonename))
-+			FAILC(DNS_R_NOTZONE,
-+			      "update RR is outside zone");
-+		if (update_class == zoneclass) {
-+			/*
-+			 * Check for meta-RRs.  The RFC2136 pseudocode says
-+			 * check for ANY|AXFR|MAILA|MAILB, but the text adds
-+			 * "or any other QUERY metatype"
-+			 */
-+			if (dns_rdatatype_ismeta(rdata.type)) {
-+				FAILC(DNS_R_FORMERR,
-+				      "meta-RR in update");
-+			}
-+			result = dns_zone_checknames(zone, name, &rdata);
-+			if (result != ISC_R_SUCCESS)
-+				FAIL(DNS_R_REFUSED);
-+		} else if (update_class == dns_rdataclass_any) {
-+			if (ttl != 0 || rdata.length != 0 ||
-+			    (dns_rdatatype_ismeta(rdata.type) &&
-+			     rdata.type != dns_rdatatype_any))
-+				FAILC(DNS_R_FORMERR,
-+				      "meta-RR in update");
-+		} else if (update_class == dns_rdataclass_none) {
-+			if (ttl != 0 ||
-+			    dns_rdatatype_ismeta(rdata.type))
-+				FAILC(DNS_R_FORMERR,
-+				      "meta-RR in update");
-+		} else {
-+			update_log(client, zone, ISC_LOG_WARNING,
-+				   "update RR has incorrect class %d",
-+				   update_class);
-+			FAIL(DNS_R_FORMERR);
-+		}
-+
-+		/*
-+		 * draft-ietf-dnsind-simple-secure-update-01 says
-+		 * "Unlike traditional dynamic update, the client
-+		 * is forbidden from updating NSEC records."
-+		 */
-+		if (rdata.type == dns_rdatatype_nsec3) {
-+			FAILC(DNS_R_REFUSED,
-+			      "explicit NSEC3 updates are not allowed "
-+			      "in secure zones");
-+		} else if (rdata.type == dns_rdatatype_nsec) {
-+			FAILC(DNS_R_REFUSED,
-+			      "explicit NSEC updates are not allowed "
-+			      "in secure zones");
-+		} else if (rdata.type == dns_rdatatype_rrsig &&
-+			   !dns_name_equal(name, zonename)) {
-+			FAILC(DNS_R_REFUSED,
-+			      "explicit RRSIG updates are currently "
-+			      "not supported in secure zones except "
-+			      "at the apex");
-+		}
-+
-+		if (ssutable != NULL) {
-+			isc_netaddr_t netaddr;
-+			dst_key_t *tsigkey = NULL;
-+			isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
-+
-+			if (client->message->tsigkey != NULL)
-+				tsigkey = client->message->tsigkey->key;
-+
-+			if (rdata.type != dns_rdatatype_any) {
-+				if (!dns_ssutable_checkrules2
-+				    (ssutable, client->signer, name, &netaddr,
-+				     TCPCLIENT(client),
-+				     &ns_g_server->aclenv,
-+				     rdata.type, tsigkey))
-+				{
-+					FAILC(DNS_R_REFUSED,
-+					      "rejected by secure update");
-+				}
-+			} else {
-+				if (!ssu_checkall(db, ver, name, ssutable,
-+						  client->signer,
-+						  &netaddr,
-+						  TCPCLIENT(client),
-+						  tsigkey))
-+				{
-+					FAILC(DNS_R_REFUSED,
-+					      "rejected by secure update");
-+				}
-+			}
-+		}
-+	}
-+	if (result != ISC_R_NOMORE)
-+		FAIL(result);
-+
-+	update_log(client, zone, LOGLEVEL_DEBUG,
-+		   "update section prescan OK");
-+#if 0
-+	if (ssutable == NULL) {
-+		CHECK(checkupdateacl(client, dns_zone_getupdateacl(zone),
-+						// zonename
-+				     "update", dns_zone_getorigin(zone), false,
-+				     false));
-+	} else if (client->signer == NULL && !TCPCLIENT(client)) {
-+		CHECK(checkupdateacl(client, NULL, "update",
-+				     dns_zone_getorigin(zone), false, true));
-+	}
-+
-+	if (dns_zone_getupdatedisabled(zone)) {
-+		FAILC(DNS_R_REFUSED, "dynamic update temporarily disabled "
-+				     "because the zone is frozen.  Use "
-+				     "'rndc thaw' to re-enable updates.");
-+	}
-+
-+	/*
-+	 * Prescan the update section, checking for updates that
-+	 * are illegal or violate policy.
-+	 */
-+	for (result = dns_message_firstname(request, DNS_SECTION_UPDATE);
-+	     result == ISC_R_SUCCESS;
-+	     result = dns_message_nextname(request, DNS_SECTION_UPDATE))
-+	{
-+		dns_name_t *name = NULL;
-+		dns_rdata_t rdata = DNS_RDATA_INIT;
-+		dns_ttl_t ttl;
-+		dns_rdataclass_t update_class;
-+
-+		get_current_rr(request, DNS_SECTION_UPDATE, zoneclass, &name,
-+			       &rdata, &covers, &ttl, &update_class);
-+
-+		if (!dns_name_issubdomain(name, zonename)) {
-+			FAILC(DNS_R_NOTZONE, "update RR is outside zone");
-+		}
-+		if (update_class == zoneclass) {
-+			/*
-+			 * Check for meta-RRs.  The RFC2136 pseudocode says
-+			 * check for ANY|AXFR|MAILA|MAILB, but the text adds
-+			 * "or any other QUERY metatype"
-+			 */
-+			if (dns_rdatatype_ismeta(rdata.type)) {
-+				FAILC(DNS_R_FORMERR, "meta-RR in update");
-+			}
-+			result = dns_zone_checknames(zone, name, &rdata);
-+			if (result != ISC_R_SUCCESS) {
-+				FAIL(DNS_R_REFUSED);
-+			}
-+		} else if (update_class == dns_rdataclass_any) {
-+			if (ttl != 0 || rdata.length != 0 ||
-+			    (dns_rdatatype_ismeta(rdata.type) &&
-+			     rdata.type != dns_rdatatype_any))
-+			{
-+				FAILC(DNS_R_FORMERR, "meta-RR in update");
-+			}
-+		} else if (update_class == dns_rdataclass_none) {
-+			if (ttl != 0 || dns_rdatatype_ismeta(rdata.type)) {
-+				FAILC(DNS_R_FORMERR, "meta-RR in update");
-+			}
-+		} else {
-+			update_log(client, zone, ISC_LOG_WARNING,
-+				   "update RR has incorrect class %d",
-+				   update_class);
-+			FAIL(DNS_R_FORMERR);
-+		}
-+
-+		/*
-+		 * draft-ietf-dnsind-simple-secure-update-01 says
-+		 * "Unlike traditional dynamic update, the client
-+		 * is forbidden from updating NSEC records."
-+		 */
-+		if (rdata.type == dns_rdatatype_nsec3) {
-+			FAILC(DNS_R_REFUSED, "explicit NSEC3 updates are not "
-+					     "allowed "
-+					     "in secure zones");
-+		} else if (rdata.type == dns_rdatatype_nsec) {
-+			FAILC(DNS_R_REFUSED, "explicit NSEC updates are not "
-+					     "allowed "
-+					     "in secure zones");
-+		} else if (rdata.type == dns_rdatatype_rrsig &&
-+			   !dns_name_equal(name, zonename))
-+		{
-+			FAILC(DNS_R_REFUSED, "explicit RRSIG updates are "
-+					     "currently "
-+					     "not supported in secure zones "
-+					     "except "
-+					     "at the apex");
-+		}
-+
-+		if (ssutable != NULL) {
-+			isc_netaddr_t netaddr;
-+			dst_key_t *tsigkey = NULL;
-+			isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
-+
-+			if (client->message->tsigkey != NULL) {
-+				tsigkey = client->message->tsigkey->key;
-+			}
-+
-+			if (rdata.type != dns_rdatatype_any) {
-+				if (!dns_ssutable_checkrules(
-+					    ssutable, client->signer, name,
-+					    &netaddr, TCPCLIENT(client), env,
-+					    rdata.type, tsigkey))
-+				{
-+					FAILC(DNS_R_REFUSED, "rejected by "
-+							     "secure update");
-+				}
-+			} else {
-+				if (!ssu_checkall(db, ver, name, ssutable,
-+						  client->signer, &netaddr, env,
-+						  TCPCLIENT(client), tsigkey))
-+				{
-+					FAILC(DNS_R_REFUSED, "rejected by "
-+							     "secure update");
-+				}
-+			}
-+		}
-+	}
-+	if (result != ISC_R_NOMORE) {
-+		FAIL(result);
-+	}
-+
-+	update_log(client, zone, LOGLEVEL_DEBUG, "update section prescan OK");
-+#endif
-+#endif
- 
- 	result = isc_quota_attach(&ns_g_server->updquota,
- 				  &(isc_quota_t *){ NULL });
-@@ -1558,6 +1833,15 @@ send_update_event(ns_client_t *client, dns_zone_t *zone) {
-  failure:
- 	if (event != NULL)
- 		isc_event_free(ISC_EVENT_PTR(&event));
-+	if (db != NULL) {
-+		dns_db_closeversion(db, &ver, false);
-+		dns_db_detach(&db);
-+	}
-+
-+	if (ssutable != NULL) {
-+		dns_ssutable_detach(&ssutable);
-+	}
-+
- 	return (result);
- }
- 
-@@ -1644,9 +1928,6 @@ ns_update_start(ns_client_t *client, isc_result_t sigresult) {
- 		CHECK(send_update_event(client, zone));
- 		break;
- 	case dns_zone_slave:
--		CHECK(checkupdateacl(client, dns_zone_getforwardacl(zone),
--				     "update forwarding", zonename, true,
--				     false));
- 		CHECK(send_forward_event(client, zone));
- 		break;
- 	default:
-@@ -1656,7 +1937,6 @@ ns_update_start(ns_client_t *client, isc_result_t sigresult) {
- 
-  failure:
- 	if (result == DNS_R_REFUSED) {
--		INSIST(dns_zone_gettype(zone) == dns_zone_slave);
- 		inc_stats(zone, dns_nsstatscounter_updaterej);
- 	}
- 	/*
-@@ -2520,7 +2800,7 @@ update_action(isc_task_t *task, isc_event_t *event) {
- 	dns_rdatatype_t covers;
- 	dns_message_t *request = client->message;
- 	dns_rdataclass_t zoneclass;
--	dns_name_t *zonename;
-+	dns_name_t *zonename = NULL;
- 	dns_ssutable_t *ssutable = NULL;
- 	dns_fixedname_t tmpnamefixed;
- 	dns_name_t *tmpname = NULL;
-@@ -2542,14 +2822,7 @@ update_action(isc_task_t *task, isc_event_t *event) {
- 	zonename = dns_db_origin(db);
- 	zoneclass = dns_db_class(db);
- 	dns_zone_getssutable(zone, &ssutable);
--
--	/*
--	 * Update message processing can leak record existence information
--	 * so check that we are allowed to query this zone.  Additionally
--	 * if we would refuse all updates for this zone we bail out here.
--	 */
--	CHECK(checkqueryacl(client, dns_zone_getqueryacl(zone), zonename,
--			    dns_zone_getupdateacl(zone), ssutable));
-+	options = dns_zone_getoptions(zone);
- 
- 	/*
- 	 * Get old and new versions now that queryacl has been checked.
-@@ -2673,134 +2946,10 @@ update_action(isc_task_t *task, isc_event_t *event) {
- 	update_log(client, zone, LOGLEVEL_DEBUG,
- 		   "prerequisites are OK");
- 
--	/*
--	 * Check Requestor's Permissions.  It seems a bit silly to do this
--	 * only after prerequisite testing, but that is what RFC2136 says.
--	 */
--	if (ssutable == NULL)
--		CHECK(checkupdateacl(client, dns_zone_getupdateacl(zone),
--				     "update", zonename, false, false));
--	else if (client->signer == NULL && !TCPCLIENT(client))
--		CHECK(checkupdateacl(client, NULL, "update", zonename,
--				     false, true));
--
--	if (dns_zone_getupdatedisabled(zone))
--		FAILC(DNS_R_REFUSED, "dynamic update temporarily disabled "
--				     "because the zone is frozen.  Use "
--				     "'rndc thaw' to re-enable updates.");
--
--	/*
--	 * Perform the Update Section Prescan.
--	 */
--
--	for (result = dns_message_firstname(request, DNS_SECTION_UPDATE);
--	     result == ISC_R_SUCCESS;
--	     result = dns_message_nextname(request, DNS_SECTION_UPDATE))
--	{
--		dns_name_t *name = NULL;
--		dns_rdata_t rdata = DNS_RDATA_INIT;
--		dns_ttl_t ttl;
--		dns_rdataclass_t update_class;
--		get_current_rr(request, DNS_SECTION_UPDATE, zoneclass,
--			       &name, &rdata, &covers, &ttl, &update_class);
--
--		if (! dns_name_issubdomain(name, zonename))
--			FAILC(DNS_R_NOTZONE,
--			      "update RR is outside zone");
--		if (update_class == zoneclass) {
--			/*
--			 * Check for meta-RRs.  The RFC2136 pseudocode says
--			 * check for ANY|AXFR|MAILA|MAILB, but the text adds
--			 * "or any other QUERY metatype"
--			 */
--			if (dns_rdatatype_ismeta(rdata.type)) {
--				FAILC(DNS_R_FORMERR,
--				      "meta-RR in update");
--			}
--			result = dns_zone_checknames(zone, name, &rdata);
--			if (result != ISC_R_SUCCESS)
--				FAIL(DNS_R_REFUSED);
--		} else if (update_class == dns_rdataclass_any) {
--			if (ttl != 0 || rdata.length != 0 ||
--			    (dns_rdatatype_ismeta(rdata.type) &&
--			     rdata.type != dns_rdatatype_any))
--				FAILC(DNS_R_FORMERR,
--				      "meta-RR in update");
--		} else if (update_class == dns_rdataclass_none) {
--			if (ttl != 0 ||
--			    dns_rdatatype_ismeta(rdata.type))
--				FAILC(DNS_R_FORMERR,
--				      "meta-RR in update");
--		} else {
--			update_log(client, zone, ISC_LOG_WARNING,
--				   "update RR has incorrect class %d",
--				   update_class);
--			FAIL(DNS_R_FORMERR);
--		}
--
--		/*
--		 * draft-ietf-dnsind-simple-secure-update-01 says
--		 * "Unlike traditional dynamic update, the client
--		 * is forbidden from updating NSEC records."
--		 */
--		if (rdata.type == dns_rdatatype_nsec3) {
--			FAILC(DNS_R_REFUSED,
--			      "explicit NSEC3 updates are not allowed "
--			      "in secure zones");
--		} else if (rdata.type == dns_rdatatype_nsec) {
--			FAILC(DNS_R_REFUSED,
--			      "explicit NSEC updates are not allowed "
--			      "in secure zones");
--		} else if (rdata.type == dns_rdatatype_rrsig &&
--			   !dns_name_equal(name, zonename)) {
--			FAILC(DNS_R_REFUSED,
--			      "explicit RRSIG updates are currently "
--			      "not supported in secure zones except "
--			      "at the apex");
--		}
--
--		if (ssutable != NULL) {
--			isc_netaddr_t netaddr;
--			dst_key_t *tsigkey = NULL;
--			isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
--
--			if (client->message->tsigkey != NULL)
--				tsigkey = client->message->tsigkey->key;
--
--			if (rdata.type != dns_rdatatype_any) {
--				if (!dns_ssutable_checkrules2
--				    (ssutable, client->signer, name, &netaddr,
--				     TCPCLIENT(client),
--				     &ns_g_server->aclenv,
--				     rdata.type, tsigkey))
--				{
--					FAILC(DNS_R_REFUSED,
--					      "rejected by secure update");
--				}
--			} else {
--				if (!ssu_checkall(db, ver, name, ssutable,
--						  client->signer,
--						  &netaddr,
--						  TCPCLIENT(client),
--						  tsigkey))
--				{
--					FAILC(DNS_R_REFUSED,
--					      "rejected by secure update");
--				}
--			}
--		}
--	}
--	if (result != ISC_R_NOMORE)
--		FAIL(result);
--
--	update_log(client, zone, LOGLEVEL_DEBUG,
--		   "update section prescan OK");
--
- 	/*
- 	 * Process the Update Section.
- 	 */
- 
--	options = dns_zone_getoptions(zone);
- 	options2 = dns_zone_getoptions2(zone);
- 	for (result = dns_message_firstname(request, DNS_SECTION_UPDATE);
- 	     result == ISC_R_SUCCESS;
-@@ -3494,6 +3643,13 @@ send_forward_event(ns_client_t *client, dns_zone_t *zone) {
- 	isc_task_t *zonetask = NULL;
- 	ns_client_t *evclient;
- 
-+	result = checkupdateacl(client, dns_zone_getforwardacl(zone),
-+				"update forwarding", dns_zone_getorigin(zone),
-+				true, false);
-+	if (result != ISC_R_SUCCESS) {
-+		return (result);
-+	}
-+
- 	result = isc_quota_attach(&ns_g_server->updquota,
- 				  &(isc_quota_t *){ NULL });
- 	if (result != ISC_R_SUCCESS) {
--- 
-2.39.2
-

SOURCES/bind-9.16-CVE-2022-3094-test.patch

@@ -1,266 +0,0 @@
-From 3d84c651f823cb90b73fd736d32ad6de57b11610 Mon Sep 17 00:00:00 2001
-From: Evan Hunt <each@isc.org>
-Date: Wed, 9 Nov 2022 21:56:16 -0800
-Subject: [PATCH] test failure conditions
-
-verify that updates are refused when the client is disallowed by
-allow-query, and update forwarding is refused when the client is
-is disallowed by update-forwarding.
-
-verify that "too many DNS UPDATEs" appears in the log file when too
-many simultaneous updates are processing.
-
-(cherry picked from commit b91339b80e5b82a56622c93cc1e3cca2d0c11bc0)
----
- bin/tests/system/nsupdate/ns1/named.conf.in   |  2 +
- bin/tests/system/nsupdate/tests.sh            | 28 +++++++++++++
- bin/tests/system/upforwd/clean.sh             |  2 +
- .../ns3/{named.conf.in => named1.conf.in}     |  7 +++-
- bin/tests/system/upforwd/ns3/named2.conf.in   | 41 +++++++++++++++++++
- bin/tests/system/upforwd/setup.sh             |  2 +-
- bin/tests/system/upforwd/tests.sh             | 40 ++++++++++++++++++
- 7 files changed, 120 insertions(+), 2 deletions(-)
- rename bin/tests/system/upforwd/ns3/{named.conf.in => named1.conf.in} (85%)
- create mode 100644 bin/tests/system/upforwd/ns3/named2.conf.in
-
-diff --git a/bin/tests/system/nsupdate/ns1/named.conf.in b/bin/tests/system/nsupdate/ns1/named.conf.in
-index cb80269..228ad6a 100644
---- a/bin/tests/system/nsupdate/ns1/named.conf.in
-+++ b/bin/tests/system/nsupdate/ns1/named.conf.in
-@@ -20,6 +20,7 @@ options {
- 	listen-on-v6 { none; };
- 	recursion no;
- 	notify yes;
-+	update-quota 1;
- };
- 
- key rndc_key {
-@@ -76,6 +77,7 @@ zone "other.nil" {
- 	check-integrity no;
- 	check-mx warn;
- 	update-policy local;
-+	allow-query { !10.53.0.2; any; };
- 	allow-query-on { 10.53.0.1; 127.0.0.1; };
- 	allow-transfer { any; };
- };
-diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh
-index f8994ff..4cabf8d 100755
---- a/bin/tests/system/nsupdate/tests.sh
-+++ b/bin/tests/system/nsupdate/tests.sh
-@@ -1069,6 +1069,34 @@ END
- grep "NSEC3PARAM has excessive iterations (> 150)" nsupdate.out-$n >/dev/null || ret=1
- [ $ret = 0 ] || { echo_i "failed"; status=1; }
- 
-+n=$((n + 1))
-+ret=0
-+echo_i "check that update is rejected if query is not allowed ($n)"
-+{
-+  $NSUPDATE -d <<END
-+  local 10.53.0.2
-+  server 10.53.0.1 ${PORT}
-+  update add reject.other.nil 3600 IN TXT Whatever
-+  send
-+END
-+} > nsupdate.out.test$n 2>&1
-+grep 'status: REFUSED' nsupdate.out.test$n > /dev/null || ret=1
-+[ $ret = 0 ] || { echo_i "failed"; status=1; }
-+
-+n=$((n + 1))
-+ret=0
-+echo_i "check that update is rejected if quota is exceeded ($n)"
-+for loop in 1 2 3 4 5 6 7 8 9 10; do
-+{
-+  $NSUPDATE -l -p ${PORT} -k ns1/session.key > nsupdate.out.test$n-${loop} 2>&1 <<END
-+  update add txt-$loop.other.nil 3600 IN TXT Whatever
-+  send
-+END
-+} &
-+done
-+wait_for_log 10 "too many DNS UPDATEs queued" ns1/named.run || ret=1
-+[ $ret = 0 ] || { echo_i "failed"; status=1; }
-+
- if $FEATURETEST --gssapi ; then
-   n=`expr $n + 1`
-   ret=0
-diff --git a/bin/tests/system/upforwd/clean.sh b/bin/tests/system/upforwd/clean.sh
-index 15cf423..832c727 100644
---- a/bin/tests/system/upforwd/clean.sh
-+++ b/bin/tests/system/upforwd/clean.sh
-@@ -24,3 +24,5 @@ rm -f Ksig0.example2.*
- rm -f keyname
- rm -f ns*/named.lock
- rm -f ns1/example2.db
-+rm -f nsupdate.out.*
-+rm -f ns*/named.run.prev
-diff --git a/bin/tests/system/upforwd/ns3/named.conf.in b/bin/tests/system/upforwd/ns3/named1.conf.in
-similarity index 85%
-rename from bin/tests/system/upforwd/ns3/named.conf.in
-rename to bin/tests/system/upforwd/ns3/named1.conf.in
-index e81cd1a..83a490f 100644
---- a/bin/tests/system/upforwd/ns3/named.conf.in
-+++ b/bin/tests/system/upforwd/ns3/named1.conf.in
-@@ -22,10 +22,15 @@ options {
- 	notify yes;
- };
- 
-+include "../../common/rndc.key";
-+controls {
-+	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-+};
-+
- zone "example" {
- 	type slave;
- 	file "example.bk";
--	allow-update-forwarding { any; };
-+	allow-update-forwarding { 10.53.0.1; };
- 	masters { 10.53.0.1; };
- };
- 
-diff --git a/bin/tests/system/upforwd/ns3/named2.conf.in b/bin/tests/system/upforwd/ns3/named2.conf.in
-new file mode 100644
-index 0000000..992cd69
---- /dev/null
-+++ b/bin/tests/system/upforwd/ns3/named2.conf.in
-@@ -0,0 +1,41 @@
-+/*
-+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-+ *
-+ * SPDX-License-Identifier: MPL-2.0
-+ *
-+ * This Source Code Form is subject to the terms of the Mozilla Public
-+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
-+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
-+ *
-+ * See the COPYRIGHT file distributed with this work for additional
-+ * information regarding copyright ownership.
-+ */
-+
-+options {
-+	query-source address 10.53.0.3;
-+	notify-source 10.53.0.3;
-+	transfer-source 10.53.0.3;
-+	port @PORT@;
-+	pid-file "named.pid";
-+	listen-on { 10.53.0.3; };
-+	listen-on-v6 { none; };
-+	recursion no;
-+	notify yes;
-+	update-quota 1;
-+};
-+
-+key rndc_key {
-+	secret "1234abcd8765";
-+	algorithm hmac-sha256;
-+};
-+
-+controls {
-+	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-+};
-+
-+zone "example" {
-+	type slave;
-+	file "example.bk";
-+	allow-update-forwarding { any; };
-+	masters { 10.53.0.1; };
-+};
-diff --git a/bin/tests/system/upforwd/setup.sh b/bin/tests/system/upforwd/setup.sh
-index 74c7ba3..928902b 100644
---- a/bin/tests/system/upforwd/setup.sh
-+++ b/bin/tests/system/upforwd/setup.sh
-@@ -17,7 +17,7 @@ cp -f ns3/nomaster.db ns3/nomaster1.db
- 
- copy_setports ns1/named.conf.in ns1/named.conf
- copy_setports ns2/named.conf.in ns2/named.conf
--copy_setports ns3/named.conf.in ns3/named.conf
-+copy_setports ns3/named1.conf.in ns3/named.conf
- 
- #
- # SIG(0) required cryptographic support which may not be configured.
-diff --git a/bin/tests/system/upforwd/tests.sh b/bin/tests/system/upforwd/tests.sh
-index f4c3216..ebc9ded 100644
---- a/bin/tests/system/upforwd/tests.sh
-+++ b/bin/tests/system/upforwd/tests.sh
-@@ -17,6 +17,7 @@ SYSTEMTESTTOP=..
- . $SYSTEMTESTTOP/conf.sh
- 
- DIGOPTS="+tcp +noadd +nosea +nostat +noquest +nocomm +nocmd -p ${PORT}"
-+RNDCCMD="$RNDC -c $SYSTEMTESTTOP/common/rndc.conf -p ${CONTROLPORT} -s"
- 
- status=0
- n=1
-@@ -69,6 +70,7 @@ if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
- echo_i "updating zone (signed) ($n)"
- ret=0
- $NSUPDATE -y hmac-sha256:update.example:c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K -- - <<EOF || ret=1
-+local 10.53.0.1
- server 10.53.0.3 ${PORT}
- update add updated.example. 600 A 10.10.10.1
- update add updated.example. 600 TXT Foo
-@@ -116,6 +118,7 @@ n=`expr $n + 1`
- echo_i "updating zone (unsigned) ($n)"
- ret=0
- $NSUPDATE -- - <<EOF || ret=1
-+local 10.53.0.1
- server 10.53.0.3 ${PORT}
- update add unsigned.example. 600 A 10.10.10.1
- update add unsigned.example. 600 TXT Foo
-@@ -161,6 +164,7 @@ while [ $count -lt 5 -a $ret -eq 0 ]
- do
- (
- $NSUPDATE -- - <<EOF 
-+local 10.53.0.1
- server 10.53.0.3 ${PORT}
- zone nomaster
- update add unsigned.nomaster. 600 A 10.10.10.1
-@@ -181,6 +185,7 @@ then
- 	ret=0
- 	keyname=`cat keyname`
- 	$NSUPDATE -k $keyname.private -- - <<EOF
-+	local 10.53.0.1
- 	server 10.53.0.3 ${PORT}
- 	zone example2
- 	update add unsigned.example2. 600 A 10.10.10.1
-@@ -194,5 +199,40 @@ EOF
- 	n=`expr $n + 1`
- fi
- 
-+echo_i "attempting an update that should be rejected by ACL ($n)"
-+ret=0
-+{
-+        $NSUPDATE -- - << EOF
-+        local 10.53.0.2
-+        server 10.53.0.3 ${PORT}
-+        update add another.unsigned.example. 600 A 10.10.10.2
-+        update add another.unsigned.example. 600 TXT Bar
-+        send
-+EOF
-+} > nsupdate.out.$n 2>&1
-+grep REFUSED nsupdate.out.$n > /dev/null || ret=1
-+if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
-+n=`expr $n + 1`
-+
-+n=$((n + 1))
-+ret=0
-+echo_i "attempting updates that should exceed quota ($n)"
-+# lower the update quota to 1.
-+copy_setports ns3/named2.conf.in ns3/named.conf
-+$RNDCCMD 10.53.0.3 reconfig
-+nextpart ns3/named.run > /dev/null
-+for loop in 1 2 3 4 5 6 7 8 9 10; do
-+{
-+  $NSUPDATE -- - > /dev/null 2>&1 <<END
-+  local 10.53.0.1
-+  server 10.53.0.3 ${PORT}
-+  update add txt-$loop.unsigned.example 300 IN TXT Whatever
-+  send
-+END
-+} &
-+done
-+wait_for_log 10 "too many DNS UPDATEs queued" ns3/named.run || ret=1
-+[ $ret = 0 ] || { echo_i "failed"; status=1; }
-+
- echo_i "exit status: $status"
- [ $status -eq 0 ] || exit 1
--- 
-2.39.2
-

SOURCES/bind-9.16-CVE-2023-3341.patch

@@ -1,166 +0,0 @@
-From 3883ec072e5feed1237dc864854ab95ded7302d6 Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Tue, 19 Sep 2023 13:14:52 +0200
-Subject: [PATCH] Backport of CVE-2023-3341 fix
-
-Taken from BIND 9.16.44 change.
----
- lib/isccc/cc.c                   | 36 +++++++++++++++++++++++---------
- lib/isccc/include/isccc/result.h |  4 +++-
- lib/isccc/result.c               |  4 +++-
- 3 files changed, 32 insertions(+), 12 deletions(-)
-
-diff --git a/lib/isccc/cc.c b/lib/isccc/cc.c
-index 463a053..a54e60c 100644
---- a/lib/isccc/cc.c
-+++ b/lib/isccc/cc.c
-@@ -53,6 +53,10 @@
- 
- #define MAX_TAGS		256
- #define DUP_LIFETIME		900
-+#ifndef ISCCC_MAXDEPTH
-+#define ISCCC_MAXDEPTH \
-+	10 /* Big enough for rndc which just sends a string each way. */
-+#endif
- 
- typedef isccc_sexpr_t *sexpr_ptr;
- 
-@@ -573,19 +577,23 @@ verify(isccc_sexpr_t *alist, unsigned char *data, unsigned int length,
- 
- static isc_result_t
- table_fromwire(isccc_region_t *source, isccc_region_t *secret,
--	       uint32_t algorithm, isccc_sexpr_t **alistp);
-+	       uint32_t algorithm, unsigned int depth, isccc_sexpr_t **alistp);
- 
- static isc_result_t
--list_fromwire(isccc_region_t *source, isccc_sexpr_t **listp);
-+list_fromwire(isccc_region_t *source, unsigned int depth, isccc_sexpr_t **listp);
- 
- static isc_result_t
--value_fromwire(isccc_region_t *source, isccc_sexpr_t **valuep) {
-+value_fromwire(isccc_region_t *source, unsigned int depth, isccc_sexpr_t **valuep) {
- 	unsigned int msgtype;
- 	uint32_t len;
- 	isccc_sexpr_t *value;
- 	isccc_region_t active;
- 	isc_result_t result;
- 
-+	if (depth > ISCCC_MAXDEPTH) {
-+		return (ISCCC_R_MAXDEPTH);
-+	}
-+
- 	if (REGION_SIZE(*source) < 1 + 4)
- 		return (ISC_R_UNEXPECTEDEND);
- 	GET8(msgtype, source->rstart);
-@@ -603,9 +611,9 @@ value_fromwire(isccc_region_t *source, isccc_sexpr_t **valuep) {
- 		} else
- 			result = ISC_R_NOMEMORY;
- 	} else if (msgtype == ISCCC_CCMSGTYPE_TABLE)
--		result = table_fromwire(&active, NULL, 0, valuep);
-+		result = table_fromwire(&active, NULL, 0, depth + 1, valuep);
- 	else if (msgtype == ISCCC_CCMSGTYPE_LIST)
--		result = list_fromwire(&active, valuep);
-+		result = list_fromwire(&active, depth + 1, valuep);
- 	else
- 		result = ISCCC_R_SYNTAX;
- 
-@@ -614,7 +622,7 @@ value_fromwire(isccc_region_t *source, isccc_sexpr_t **valuep) {
- 
- static isc_result_t
- table_fromwire(isccc_region_t *source, isccc_region_t *secret,
--	       uint32_t algorithm, isccc_sexpr_t **alistp)
-+	       uint32_t algorithm, unsigned int depth, isccc_sexpr_t **alistp)
- {
- 	char key[256];
- 	uint32_t len;
-@@ -625,6 +633,10 @@ table_fromwire(isccc_region_t *source, isccc_region_t *secret,
- 
- 	REQUIRE(alistp != NULL && *alistp == NULL);
- 
-+	if (depth > ISCCC_MAXDEPTH) {
-+		return (ISCCC_R_MAXDEPTH);
-+	}
-+
- 	checksum_rstart = NULL;
- 	first_tag = true;
- 	alist = isccc_alist_create();
-@@ -640,7 +652,7 @@ table_fromwire(isccc_region_t *source, isccc_region_t *secret,
- 		GET_MEM(key, len, source->rstart);
- 		key[len] = '\0';	/* Ensure NUL termination. */
- 		value = NULL;
--		result = value_fromwire(source, &value);
-+		result = value_fromwire(source, depth + 1, &value);
- 		if (result != ISC_R_SUCCESS)
- 			goto bad;
- 		if (isccc_alist_define(alist, key, value) == NULL) {
-@@ -673,14 +685,18 @@ table_fromwire(isccc_region_t *source, isccc_region_t *secret,
- }
- 
- static isc_result_t
--list_fromwire(isccc_region_t *source, isccc_sexpr_t **listp) {
-+list_fromwire(isccc_region_t *source, unsigned int depth, isccc_sexpr_t **listp) {
- 	isccc_sexpr_t *list, *value;
- 	isc_result_t result;
- 
-+	if (depth > ISCCC_MAXDEPTH) {
-+		return (ISCCC_R_MAXDEPTH);
-+	}
-+
- 	list = NULL;
- 	while (!REGION_EMPTY(*source)) {
- 		value = NULL;
--		result = value_fromwire(source, &value);
-+		result = value_fromwire(source, depth + 1, &value);
- 		if (result != ISC_R_SUCCESS) {
- 			isccc_sexpr_free(&list);
- 			return (result);
-@@ -711,7 +727,7 @@ isccc_cc_fromwire(isccc_region_t *source, isccc_sexpr_t **alistp,
- 	if (version != 1)
- 		return (ISCCC_R_UNKNOWNVERSION);
- 
--	return (table_fromwire(source, secret, algorithm, alistp));
-+	return (table_fromwire(source, secret, algorithm, 0, alistp));
- }
- 
- static isc_result_t
-diff --git a/lib/isccc/include/isccc/result.h b/lib/isccc/include/isccc/result.h
-index 6c79dd7..b30b08a 100644
---- a/lib/isccc/include/isccc/result.h
-+++ b/lib/isccc/include/isccc/result.h
-@@ -47,8 +47,10 @@
- #define ISCCC_R_CLOCKSKEW		(ISC_RESULTCLASS_ISCCC + 4)
- /*% Duplicate */
- #define ISCCC_R_DUPLICATE		(ISC_RESULTCLASS_ISCCC + 5)
-+/*% Maximum recursion depth */
-+#define ISCCC_R_MAXDEPTH		(ISC_RESULTCLASS_ISCCC + 6)
- 
--#define ISCCC_R_NRESULTS 		6	/*%< Number of results */
-+#define ISCCC_R_NRESULTS 		7	/*%< Number of results */
- 
- ISC_LANG_BEGINDECLS
- 
-diff --git a/lib/isccc/result.c b/lib/isccc/result.c
-index 8419bbb..a3a3b9a 100644
---- a/lib/isccc/result.c
-+++ b/lib/isccc/result.c
-@@ -40,7 +40,8 @@ static const char *text[ISCCC_R_NRESULTS] = {
- 	"bad auth",				/* 3 */
- 	"expired",				/* 4 */
- 	"clock skew",				/* 5 */
--	"duplicate"				/* 6 */
-+	"duplicate",				/* 6 */
-+	"max depth",				/* 7 */
- };
- 
- static const char *ids[ISCCC_R_NRESULTS] = {
-@@ -50,6 +51,7 @@ static const char *ids[ISCCC_R_NRESULTS] = {
- 	"ISCCC_R_EXPIRED",
- 	"ISCCC_R_CLOCKSKEW",
- 	"ISCCC_R_DUPLICATE",
-+	"ISCCC_R_MAXDEPTH"
- };
- 
- #define ISCCC_RESULT_RESULTSET			2
--- 
-2.41.0
-

SPECS/bind.spec

@@ -68,7 +68,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.11.36
-Release:  11%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  8%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -167,14 +167,6 @@ Patch190: bind-9.11-rh2101712.patch
 Patch191: bind-9.11-CVE-2022-2795.patch
 # https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/7376
 Patch192: bind-9.11-rh2133889.patch
-# https://gitlab.isc.org/isc-projects/bind9/commit/82185f4f80d2fa39a4569f6740cb360ffff8f5c4
-Patch193: bind-9.16-CVE-2022-3094-1.patch
-Patch194: bind-9.16-CVE-2022-3094-2.patch
-Patch195: bind-9.16-CVE-2022-3094-3.patch
-Patch196: bind-9.16-CVE-2022-3094-test.patch
-# https://gitlab.isc.org/isc-projects/bind9/commit/f1d9e9ee3859976f403914d20ad2a10855343702
-Patch197: bind-9.11-CVE-2023-2828.patch
-Patch198: bind-9.16-CVE-2023-3341.patch
 
 # SDB patches
 Patch11: bind-9.3.2b2-sdbsrc.patch
@@ -577,12 +569,6 @@ are used for building ISC DHCP.
 %patch190 -p1 -b .rh2101712
 %patch191 -p1 -b .CVE-2022-2795
 %patch192 -p1 -b .rh2133889
-%patch193 -p1 -b .CVE-2022-3094
-%patch194 -p1 -b .CVE-2022-3094
-%patch195 -p1 -b .CVE-2022-3094
-%patch196 -p1 -b .CVE-2022-3094-test
-%patch197 -p1 -b .CVE-2023-2828
-%patch198 -p1 -b .CVE-2023-3341
 
 mkdir lib/dns/tests/testdata/dstrandom
 cp -a %{SOURCE50} lib/dns/tests/testdata/dstrandom/random.data
@@ -1635,16 +1621,6 @@ rm -rf ${RPM_BUILD_ROOT}
 %endif
 
 %changelog
-* Tue Sep 19 2023 Petr Menšík <pemensik@redhat.com> - 32:9.11.36-11
-- Prevent exahustion of memory from control channel (CVE-2023-3341)
-
-* Thu Jun 22 2023 Petr Menšík <pemensik@redhat.com> - 32:9.11.36-10
-- Prevent the cache going over the configured limit (CVE-2023-2828)
-
-* Wed Feb 08 2023 Petr Menšík <pemensik@redhat.com> - 32:9.11.36-9
-- Prevent flooding with UPDATE requests (CVE-2022-3094)
-- include upstream test for that change
-
 * Thu Oct 13 2022 Petr Menšík <pemensik@redhat.com> - 32:9.11.36-8
 - Correct regression preventing bind-dyndb-ldap build (#2133889)