diff --git a/bind-9.16-CVE-2026-5946.patch b/bind-9.16-CVE-2026-5946.patch index b4eab87..a371020 100644 --- a/bind-9.16-CVE-2026-5946.patch +++ b/bind-9.16-CVE-2026-5946.patch @@ -1,4 +1,4 @@ -From f215b6bb4a2a2bbed98195be7aa25e81d6e13b5c Mon Sep 17 00:00:00 2001 +From fdadded4959eec655fded3ddfeacec47d2250274 Mon Sep 17 00:00:00 2001 From: Evan Hunt Date: Tue, 3 Mar 2026 14:00:38 -0800 Subject: [PATCH] Disable recursion for non-IN classes @@ -111,10 +111,10 @@ dump. %RH fixed resolver, checkconf test --- - bin/named/server.c | 41 ++++-------- + bin/named/server.c | 42 ++++-------- bin/tests/system/checkconf/tests.sh | 14 +++- .../checkconf/warn-chaos-recursion.conf | 25 ++++++++ - bin/tests/system/resolver/tests.sh | 12 +++- + bin/tests/system/resolver/tests.sh | 8 ++- bin/tests/system/unknown/tests.sh | 12 ++-- lib/bind9/check.c | 22 ++++++- lib/dns/adb.c | 3 +- @@ -122,14 +122,14 @@ fixed resolver, checkconf test lib/dns/resolver.c | 13 +++- lib/ns/client.c | 64 ++++++++++++++++--- lib/ns/update.c | 38 +++++------ - 11 files changed, 181 insertions(+), 74 deletions(-) + 11 files changed, 177 insertions(+), 75 deletions(-) create mode 100644 bin/tests/system/checkconf/warn-chaos-recursion.conf diff --git a/bin/named/server.c b/bin/named/server.c -index 4cc69b5..c61de53 100644 +index 098e21d0ac..9e33dc6349 100644 --- a/bin/named/server.c +++ b/bin/named/server.c -@@ -1925,10 +1925,12 @@ dlzconfigure_callback(dns_view_t *view, dns_dlzdb_t *dlzdb, dns_zone_t *zone) { +@@ -1932,10 +1932,12 @@ dlzconfigure_callback(dns_view_t *view, dns_dlzdb_t *dlzdb, dns_zone_t *zone) { dns_rdataclass_t zclass = view->rdclass; isc_result_t result; @@ -142,7 +142,7 @@ index 4cc69b5..c61de53 100644 dns_zone_setstats(zone, named_g_server->zonestats); return (named_zone_configure_writeable_dlz(dlzdb, zone, zclass, -@@ -4180,6 +4182,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config, +@@ -4215,6 +4217,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config, obj = NULL; result = named_config_get(maps, "max-cache-size", &obj); INSIST(result == ISC_R_SUCCESS); @@ -150,7 +150,7 @@ index 4cc69b5..c61de53 100644 /* * If "-T maxcachesize=..." is in effect, it overrides any other * "max-cache-size" setting found in configuration, either implicit or -@@ -4930,34 +4933,15 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config, +@@ -4965,34 +4968,15 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config, } /* @@ -189,7 +189,7 @@ index 4cc69b5..c61de53 100644 /* * Configure the view's TSIG keys. */ -@@ -5067,7 +5051,8 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config, +@@ -5102,7 +5086,8 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config, obj = NULL; result = named_config_get(maps, "recursion", &obj); INSIST(result == ISC_R_SUCCESS); @@ -199,12 +199,13 @@ index 4cc69b5..c61de53 100644 obj = NULL; result = named_config_get(maps, "qname-minimization", &obj); -@@ -5168,13 +5153,13 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config, +@@ -5201,14 +5186,13 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config, CHECK(configure_view_acl(vconfig, config, NULL, "allow-query-cache-on", NULL, actx, named_g_mctx, &view->cacheonacl)); - if (strcmp(view->name, "_bind") != 0 && -- view->rdclass != dns_rdataclass_chaos) { +- view->rdclass != dns_rdataclass_chaos) +- { - /* named.conf only */ + if (view->rdclass != dns_rdataclass_in) { + dns_acl_none(named_g_mctx, &view->recursionacl); @@ -218,20 +219,20 @@ index 4cc69b5..c61de53 100644 "allow-recursion-on", NULL, actx, named_g_mctx, &view->recursiononacl)); diff --git a/bin/tests/system/checkconf/tests.sh b/bin/tests/system/checkconf/tests.sh -index c1feed1..921707e 100644 +index c8f883e38d..34d2aebf24 100644 --- a/bin/tests/system/checkconf/tests.sh +++ b/bin/tests/system/checkconf/tests.sh -@@ -402,7 +402,8 @@ $CHECKCONF -l good.conf | - grep -v "is not implemented" | - grep -v "is not recommended" | - grep -v "no longer exists" | --grep -v "is obsolete" > checkconf.out$n || ret=1 -+grep -v "is obsolete" | -+grep -v "recursion will be disabled" > checkconf.out$n || ret=1 - diff good.zonelist checkconf.out$n > diff.out$n || ret=1 - if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi - status=`expr $status + $ret` -@@ -603,5 +604,16 @@ status=$((status+ret)) +@@ -481,7 +481,8 @@ $CHECKCONF -l good.conf \ + | grep -v "is not implemented" \ + | grep -v "is not recommended" \ + | grep -v "no longer exists" \ +- | grep -v "is obsolete" >checkconf.out$n || ret=1 ++ | grep -v "is obsolete" \ ++ | grep -v "recursion will be disabled" >checkconf.out$n || ret=1 + diff good.zonelist checkconf.out$n >diff.out$n || ret=1 + if [ $ret -ne 0 ]; then + echo_i "failed" +@@ -763,5 +764,16 @@ status=$(expr $status + $ret) rmdir keys @@ -250,7 +251,7 @@ index c1feed1..921707e 100644 [ $status -eq 0 ] || exit 1 diff --git a/bin/tests/system/checkconf/warn-chaos-recursion.conf b/bin/tests/system/checkconf/warn-chaos-recursion.conf new file mode 100644 -index 0000000..e384533 +index 0000000000..e384533c0a --- /dev/null +++ b/bin/tests/system/checkconf/warn-chaos-recursion.conf @@ -0,0 +1,25 @@ @@ -280,78 +281,67 @@ index 0000000..e384533 + }; +}; diff --git a/bin/tests/system/resolver/tests.sh b/bin/tests/system/resolver/tests.sh -index 2eae16f..30e86bc 100755 +index fc05635e31..6e1fdaddfa 100755 --- a/bin/tests/system/resolver/tests.sh +++ b/bin/tests/system/resolver/tests.sh -@@ -16,6 +16,10 @@ DIGOPTS="-p ${PORT}" - RESOLVOPTS="-p ${PORT}" - RNDCCMD="$RNDC -c $SYSTEMTESTTOP/common/rndc.conf -p ${CONTROLPORT} -s" +@@ -897,10 +897,12 @@ if [ $ret != 0 ]; then echo_i "failed"; fi + status=$((status + ret)) -+dig_with_opts() { -+ "$DIG" $DIGOPTS "$@" -+} -+ - status=0 - n=0 - -@@ -853,10 +857,12 @@ if [ $ret != 0 ]; then echo_i "failed"; fi - status=`expr $status + $ret` - - n=`expr $n + 1` + n=$((n + 1)) -echo_i "checking NXDOMAIN is returned when querying non existing domain in CH class ($n)" +echo_i "checking REFUSED is returned when querying non existing domain in CH class ($n)" ret=0 --$DIG $DIGOPTS @10.53.0.1 id.hostname txt ch > dig.ns1.out.${n} || ret=1 --grep "status: NXDOMAIN" dig.ns1.out.${n} > /dev/null || ret=1 +-dig_with_opts @10.53.0.1 id.hostname txt ch >dig.ns1.out.${n} || ret=1 +-grep "status: NXDOMAIN" dig.ns1.out.${n} >/dev/null || ret=1 +dig_with_opts @10.53.0.1 hostname.chaostest txt ch >dig.ns1.out.1.${n} || ret=1 +grep "status: NOERROR" dig.ns1.out.1.${n} >/dev/null || ret=1 +dig_with_opts @10.53.0.1 id.hostname txt ch >dig.ns1.out.2.${n} || ret=1 +grep "status: REFUSED" dig.ns1.out.2.${n} >/dev/null || ret=1 if [ $ret != 0 ]; then echo_i "failed"; fi - status=`expr $status + $ret` + status=$((status + ret)) diff --git a/bin/tests/system/unknown/tests.sh b/bin/tests/system/unknown/tests.sh -index e480f66..5576216 100644 +index b14548a039..092ae2d308 100644 --- a/bin/tests/system/unknown/tests.sh +++ b/bin/tests/system/unknown/tests.sh -@@ -80,8 +80,8 @@ echo_i "querying for various representations of a CLASS10 TYPE1 record ($n)" - for i in 1 2 - do - ret=0 -- $DIG +short $DIGOPTS @10.53.0.1 a$i.example a class10 > dig.out.$i.test$n || ret=1 -- echo '\# 4 0A000001' | $DIFF - dig.out.$i.test$n || ret=1 -+ $DIG $DIGOPTS @10.53.0.1 a$i.example a class10 >dig.out.$i.test$n || ret=1 -+ grep -q "NOTIMP" dig.out.$i.test$n || ret=1 - if [ $ret != 0 ] - then - echo_i "#$i failed" -@@ -94,8 +94,8 @@ echo_i "querying for various representations of a CLASS10 TXT record ($n)" - for i in 1 2 3 4 - do - ret=0 -- $DIG +short $DIGOPTS @10.53.0.1 txt$i.example txt class10 > dig.out.$i.test$n || ret=1 -- echo '"hello"' | $DIFF - dig.out.$i.test$n || ret=1 -+ $DIG $DIGOPTS @10.53.0.1 txt$i.example txt class10 >dig.out.$i.test$n || ret=1 -+ grep -q "NOTIMP" dig.out.$i.test$n || ret=1 - if [ $ret != 0 ] - then - echo_i "#$i failed" -@@ -108,8 +108,8 @@ echo_i "querying for various representations of a CLASS10 TYPE123 record ($n)" - for i in 1 2 - do - ret=0 -- $DIG +short $DIGOPTS @10.53.0.1 unk$i.example type123 class10 > dig.out.$i.test$n || ret=1 -- echo '\# 1 00' | $DIFF - dig.out.$i.test$n || ret=1 -+ $DIG $DIGOPTS @10.53.0.1 unk$i.example type123 class10 >dig.out.$i.test$n || ret=1 -+ grep -q "NOTIMP" dig.out.$i.test$n || ret=1 - if [ $ret != 0 ] - then - echo_i "#$i failed" +@@ -75,8 +75,8 @@ n=$((n + 1)) + echo_i "querying for various representations of a CLASS10 TYPE1 record ($n)" + for i in 1 2; do + ret=0 +- $DIG +short $DIGOPTS @10.53.0.1 a$i.example a class10 >dig.out.$i.test$n || ret=1 +- echo '\# 4 0A000001' | $DIFF - dig.out.$i.test$n || ret=1 ++ $DIG $DIGOPTS @10.53.0.1 a$i.example a class10 >dig.out.$i.test$n || ret=1 ++ grep -q "NOTIMP" dig.out.$i.test$n || ret=1 + if [ $ret != 0 ]; then + echo_i "#$i failed" + fi +@@ -87,8 +87,8 @@ n=$((n + 1)) + echo_i "querying for various representations of a CLASS10 TXT record ($n)" + for i in 1 2 3 4; do + ret=0 +- $DIG +short $DIGOPTS @10.53.0.1 txt$i.example txt class10 >dig.out.$i.test$n || ret=1 +- echo '"hello"' | $DIFF - dig.out.$i.test$n || ret=1 ++ $DIG $DIGOPTS @10.53.0.1 txt$i.example txt class10 >dig.out.$i.test$n || ret=1 ++ grep -q "NOTIMP" dig.out.$i.test$n || ret=1 + if [ $ret != 0 ]; then + echo_i "#$i failed" + fi +@@ -99,8 +99,8 @@ n=$((n + 1)) + echo_i "querying for various representations of a CLASS10 TYPE123 record ($n)" + for i in 1 2; do + ret=0 +- $DIG +short $DIGOPTS @10.53.0.1 unk$i.example type123 class10 >dig.out.$i.test$n || ret=1 +- echo '\# 1 00' | $DIFF - dig.out.$i.test$n || ret=1 ++ $DIG $DIGOPTS @10.53.0.1 unk$i.example type123 class10 >dig.out.$i.test$n || ret=1 ++ grep -q "NOTIMP" dig.out.$i.test$n || ret=1 + if [ $ret != 0 ]; then + echo_i "#$i failed" + fi diff --git a/lib/bind9/check.c b/lib/bind9/check.c -index 2225bee..e55c4fc 100644 +index ee64543ab8..9935b8a8f3 100644 --- a/lib/bind9/check.c +++ b/lib/bind9/check.c -@@ -2271,13 +2271,17 @@ check_mirror_zone_notify(const cfg_obj_t *zoptions, const char *znamestr, +@@ -2292,13 +2292,17 @@ check_mirror_zone_notify(const cfg_obj_t *zoptions, const char *znamestr, */ static bool check_recursion(const cfg_obj_t *config, const cfg_obj_t *voptions, @@ -371,7 +361,7 @@ index 2225bee..e55c4fc 100644 /* * Check the "recursion" option first. */ -@@ -2831,7 +2835,8 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions, +@@ -2878,7 +2882,8 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions, * contradicts the purpose of the former. */ if (ztype == CFG_ZONE_MIRROR && @@ -381,7 +371,7 @@ index 2225bee..e55c4fc 100644 { cfg_obj_log(zoptions, logctx, ISC_LOG_ERROR, "zone '%s': mirror zones cannot be used if " -@@ -4553,6 +4558,17 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *voptions, +@@ -4631,6 +4636,17 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *voptions, cfg_aclconfctx_create(mctx, &actx); @@ -400,10 +390,10 @@ index 2225bee..e55c4fc 100644 (void)cfg_map_get(voptions, "zone", &zones); } else { diff --git a/lib/dns/adb.c b/lib/dns/adb.c -index 74fdc72..cc00798 100644 +index 6f98feca45..a97239570b 100644 --- a/lib/dns/adb.c +++ b/lib/dns/adb.c -@@ -941,7 +941,8 @@ import_rdataset(dns_adbname_t *adbname, dns_rdataset_t *rdataset, +@@ -926,7 +926,8 @@ import_rdataset(dns_adbname_t *adbname, dns_rdataset_t *rdataset, INSIST(DNS_ADB_VALID(adb)); rdtype = rdataset->type; @@ -414,10 +404,10 @@ index 74fdc72..cc00798 100644 findoptions = DNS_ADBFIND_INET; } else { diff --git a/lib/dns/message.c b/lib/dns/message.c -index aa434a7..a81943d 100644 +index 22aa552f3f..ba374c4336 100644 --- a/lib/dns/message.c +++ b/lib/dns/message.c -@@ -1085,6 +1085,17 @@ getquestions(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx, +@@ -1087,6 +1087,17 @@ getquestions(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx, rdtype = isc_buffer_getuint16(source); rdclass = isc_buffer_getuint16(source); @@ -436,10 +426,10 @@ index aa434a7..a81943d 100644 * If this class is different than the one we already read, * this is an error. diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c -index 5973bc1..460a15e 100644 +index 0952624689..0d7d0735db 100644 --- a/lib/dns/resolver.c +++ b/lib/dns/resolver.c -@@ -7369,9 +7369,16 @@ is_answeraddress_allowed(dns_view_t *view, dns_name_t *name, +@@ -7367,9 +7367,16 @@ is_answeraddress_allowed(dns_view_t *view, dns_name_t *name, } /* @@ -460,10 +450,10 @@ index 5973bc1..460a15e 100644 for (result = dns_rdataset_first(rdataset); result == ISC_R_SUCCESS; result = dns_rdataset_next(rdataset)) diff --git a/lib/ns/client.c b/lib/ns/client.c -index 87b8a18..554934f 100644 +index d4ce000be8..b1e1d6c0b9 100644 --- a/lib/ns/client.c +++ b/lib/ns/client.c -@@ -40,6 +40,7 @@ +@@ -43,6 +43,7 @@ #include #include #include @@ -471,7 +461,7 @@ index 87b8a18..554934f 100644 #include #include #include -@@ -1937,7 +1938,9 @@ ns__client_request(isc_nmhandle_t *handle, isc_result_t eresult, +@@ -1933,7 +1934,9 @@ ns__client_request(isc_nmhandle_t *handle, isc_result_t eresult, } } @@ -482,7 +472,7 @@ index 87b8a18..554934f 100644 if ((client->attributes & NS_CLIENTATTR_WANTCOOKIE) != 0 && client->message->opcode == dns_opcode_query && client->message->counts[DNS_SECTION_QUESTION] == 0U) -@@ -1958,12 +1961,49 @@ ns__client_request(isc_nmhandle_t *handle, isc_result_t eresult, +@@ -1954,12 +1957,49 @@ ns__client_request(isc_nmhandle_t *handle, isc_result_t eresult, return; } @@ -536,7 +526,7 @@ index 87b8a18..554934f 100644 isc_task_unpause(client->task); return; } -@@ -2017,7 +2057,7 @@ ns__client_request(isc_nmhandle_t *handle, isc_result_t eresult, +@@ -1998,7 +2038,7 @@ ns__client_request(isc_nmhandle_t *handle, isc_result_t eresult, ns_client_log(client, NS_LOGCATEGORY_CLIENT, NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(1), "no matching view in class '%s'", classname); @@ -545,7 +535,7 @@ index 87b8a18..554934f 100644 ns_client_error(client, notimp ? DNS_R_NOTIMP : DNS_R_REFUSED); isc_task_unpause(client->task); return; -@@ -2201,6 +2241,10 @@ ns__client_request(isc_nmhandle_t *handle, isc_result_t eresult, +@@ -2175,6 +2215,10 @@ ns__client_request(isc_nmhandle_t *handle, isc_result_t eresult, break; case dns_opcode_update: CTRACE("update"); @@ -556,7 +546,7 @@ index 87b8a18..554934f 100644 #ifdef HAVE_DNSTAP dns_dt_send(client->view, DNS_DTTYPE_UQ, &client->peeraddr, &client->destsockaddr, TCP_CLIENT(client), NULL, -@@ -2211,6 +2255,10 @@ ns__client_request(isc_nmhandle_t *handle, isc_result_t eresult, +@@ -2185,6 +2229,10 @@ ns__client_request(isc_nmhandle_t *handle, isc_result_t eresult, break; case dns_opcode_notify: CTRACE("notify"); @@ -567,7 +557,7 @@ index 87b8a18..554934f 100644 ns_client_settimeout(client, 60); ns_notify_start(client, handle); break; -@@ -2302,7 +2350,7 @@ ns__client_setup(ns_client_t *client, ns_clientmgr_t *mgr, bool new) { +@@ -2276,7 +2324,7 @@ ns__client_setup(ns_client_t *client, ns_clientmgr_t *mgr, bool new) { * The caller is responsible for that. */ @@ -576,7 +566,7 @@ index 87b8a18..554934f 100644 REQUIRE(VALID_MANAGER(mgr) || !new); if (new) { -@@ -2748,7 +2796,7 @@ ns_client_dumpmessage(ns_client_t *client, const char *reason) { +@@ -2735,7 +2783,7 @@ ns_client_dumpmessage(ns_client_t *client, const char *reason) { int len = 1024; isc_result_t result; @@ -586,10 +576,10 @@ index 87b8a18..554934f 100644 } diff --git a/lib/ns/update.c b/lib/ns/update.c -index 0e0bdc9..dc6ebdf 100644 +index 4e51cdcb77..2792058099 100644 --- a/lib/ns/update.c +++ b/lib/ns/update.c -@@ -1288,7 +1288,10 @@ replaces_p(dns_rdata_t *update_rr, dns_rdata_t *db_rr) { +@@ -1294,7 +1294,10 @@ replaces_p(dns_rdata_t *update_rr, dns_rdata_t *db_rr) { return (true); } } @@ -601,7 +591,7 @@ index 0e0bdc9..dc6ebdf 100644 /* * Compare the address and protocol fields only. These * form the first five bytes of the RR data. Do a -@@ -1432,8 +1435,7 @@ failure: +@@ -1438,8 +1441,7 @@ failure: * 'rdata', and 'ttl', respectively. */ static void @@ -611,7 +601,7 @@ index 0e0bdc9..dc6ebdf 100644 dns_rdata_t *rdata, dns_rdatatype_t *covers, dns_ttl_t *ttl, dns_rdataclass_t *update_class) { dns_rdataset_t *rdataset; -@@ -1449,7 +1451,7 @@ get_current_rr(dns_message_t *msg, dns_section_t section, +@@ -1455,7 +1457,7 @@ get_current_rr(dns_message_t *msg, dns_section_t section, dns_rdataset_current(rdataset, rdata); INSIST(dns_rdataset_next(rdataset) == ISC_R_NOMORE); *update_class = rdata->rdclass; @@ -620,7 +610,7 @@ index 0e0bdc9..dc6ebdf 100644 } /*% -@@ -1551,7 +1553,6 @@ send_update_event(ns_client_t *client, dns_zone_t *zone) { +@@ -1557,7 +1559,6 @@ send_update_event(ns_client_t *client, dns_zone_t *zone) { dns_message_t *request = client->message; dns_aclenv_t *env = ns_interfacemgr_getaclenv(client->manager->interface->mgr); @@ -628,7 +618,7 @@ index 0e0bdc9..dc6ebdf 100644 dns_rdatatype_t covers; dns_name_t *zonename = NULL; dns_db_t *db = NULL; -@@ -1559,10 +1560,12 @@ send_update_event(ns_client_t *client, dns_zone_t *zone) { +@@ -1565,10 +1566,12 @@ send_update_event(ns_client_t *client, dns_zone_t *zone) { CHECK(dns_zone_getdb(zone, &db)); zonename = dns_db_origin(db); @@ -642,7 +632,7 @@ index 0e0bdc9..dc6ebdf 100644 /* * Update message processing can leak record existence information * so check that we are allowed to query this zone. Additionally, -@@ -1603,13 +1606,13 @@ send_update_event(ns_client_t *client, dns_zone_t *zone) { +@@ -1609,13 +1612,13 @@ send_update_event(ns_client_t *client, dns_zone_t *zone) { dns_ttl_t ttl; dns_rdataclass_t update_class; @@ -658,7 +648,7 @@ index 0e0bdc9..dc6ebdf 100644 /* * Check for meta-RRs. The RFC2136 pseudocode says * check for ANY|AXFR|MAILA|MAILB, but the text adds -@@ -2733,9 +2736,7 @@ update_action(isc_task_t *task, isc_event_t *event) { +@@ -2755,9 +2758,7 @@ update_action(isc_task_t *task, isc_event_t *event) { isc_mem_t *mctx = client->mctx; dns_rdatatype_t covers; dns_message_t *request = client->message; @@ -668,7 +658,7 @@ index 0e0bdc9..dc6ebdf 100644 dns_fixedname_t tmpnamefixed; dns_name_t *tmpname = NULL; dns_zoneopt_t options; -@@ -2754,10 +2755,9 @@ update_action(isc_task_t *task, isc_event_t *event) { +@@ -2776,10 +2777,9 @@ update_action(isc_task_t *task, isc_event_t *event) { CHECK(dns_zone_getdb(zone, &db)); zonename = dns_db_origin(db); @@ -680,7 +670,7 @@ index 0e0bdc9..dc6ebdf 100644 /* * Get old and new versions now that queryacl has been checked. */ -@@ -2778,8 +2778,8 @@ update_action(isc_task_t *task, isc_event_t *event) { +@@ -2800,8 +2800,8 @@ update_action(isc_task_t *task, isc_event_t *event) { dns_rdataclass_t update_class; bool flag; @@ -691,7 +681,7 @@ index 0e0bdc9..dc6ebdf 100644 if (ttl != 0) { PREREQFAILC(DNS_R_FORMERR, "prerequisite TTL is not " -@@ -2846,7 +2846,7 @@ update_action(isc_task_t *task, isc_event_t *event) { +@@ -2868,7 +2868,7 @@ update_action(isc_task_t *task, isc_event_t *event) { "satisfied"); } } @@ -700,7 +690,7 @@ index 0e0bdc9..dc6ebdf 100644 /* "temp += rr;" */ result = temp_append(&temp, name, &rdata); if (result != ISC_R_SUCCESS) { -@@ -2906,10 +2906,10 @@ update_action(isc_task_t *task, isc_event_t *event) { +@@ -2927,10 +2927,10 @@ update_action(isc_task_t *task, isc_event_t *event) { dns_rdataclass_t update_class; bool flag; @@ -713,7 +703,7 @@ index 0e0bdc9..dc6ebdf 100644 /* * RFC1123 doesn't allow MF and MD in master zones. */ -@@ -3488,10 +3488,6 @@ common: +@@ -3507,10 +3507,6 @@ common: dns_db_detach(&db); } @@ -725,5 +715,5 @@ index 0e0bdc9..dc6ebdf 100644 uev->result = result; if (zone != NULL) { -- -2.54.0 +2.55.0