diff --git a/bind-9.10-dist-native-pkcs11.patch b/bind-9.10-dist-native-pkcs11.patch
index df0d896..a3ef6e4 100644
--- a/bind-9.10-dist-native-pkcs11.patch
+++ b/bind-9.10-dist-native-pkcs11.patch
@@ -1,41 +1,36 @@
 diff --git a/bin/Makefile.in b/bin/Makefile.in
-index f0c504a..ce7a2da 100644
+index 9ad7f62..094775a 100644
 --- a/bin/Makefile.in
 +++ b/bin/Makefile.in
-@@ -11,8 +11,8 @@ srcdir =	@srcdir@
+@@ -11,7 +11,7 @@ srcdir =	@srcdir@
  VPATH =		@srcdir@
  top_srcdir =	@top_srcdir@
  
 -SUBDIRS =	named rndc dig delv dnssec tools nsupdate check confgen \
--		@NZD_TOOLS@ @PYTHON_TOOLS@ @PKCS11_TOOLS@ tests
-+SUBDIRS =	named named-pkcs11 rndc dig delv dnssec dnssec-pkcs11 tools nsupdate \
-+		check confgen @NZD_TOOLS@ @PYTHON_TOOLS@ @PKCS11_TOOLS@ tests
++SUBDIRS =	named named-pkcs11 rndc dig delv dnssec dnssec-pkcs11 tools nsupdate check confgen \
+ 		@NZD_TOOLS@ @PYTHON_TOOLS@ @PKCS11_TOOLS@ plugins tests
  TARGETS =
  
- @BIND9_MAKE_RULES@
 diff --git a/bin/dnssec-pkcs11/Makefile.in b/bin/dnssec-pkcs11/Makefile.in
-index 4b8ca13..32f4470 100644
+index be1ac3b..c1ee27c 100644
 --- a/bin/dnssec-pkcs11/Makefile.in
 +++ b/bin/dnssec-pkcs11/Makefile.in
-@@ -15,18 +15,18 @@ VERSION=@BIND9_VERSION@
+@@ -15,17 +15,17 @@ VERSION=@BIND9_VERSION@
  
  @BIND9_MAKE_INCLUDES@
  
--CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} @DST_OPENSSL_INC@
-+CINCLUDES =	${DNS_PKCS11_INCLUDES} ${ISC_PKCS11_INCLUDES}
+-CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} @OPENSSL_INCLUDES@
++CINCLUDES =	${DNS_PKCS11_INCLUDES} ${ISC_PKCS11_INCLUDES} @OPENSSL_INCLUDES@
  
--CDEFINES =	-DVERSION=\"${VERSION}\" @USE_PKCS11@ @PKCS11_ENGINE@ \
--		@CRYPTO@ -DPK11_LIB_LOCATION=\"@PKCS11_PROVIDER@\"
-+CDEFINES =	-DVERSION=\"${VERSION}\" @PKCS11_ENGINE@ \
-+		@CRYPTO_PK11@ -DPK11_LIB_LOCATION=\"@PKCS11_PROVIDER@\"
+ CDEFINES =	-DVERSION=\"${VERSION}\"
  CWARNINGS =
  
--DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
--ISCLIBS =	../../lib/isc/libisc.@A@
--ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@
-+DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
-+ISCLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
-+ISCNOSYMLIBS =	../../lib/isc-pkcs11/libisc-pkcs11-nosymtbl.@A@
+-DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
+-ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
+-ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @OPENSSL_LIBS@
++DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ @DNS_CRYPTO_LIBS@
++ISCLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@ @OPENSSL_LIBS@
++ISCNOSYMLIBS =	../../lib/isc-pkcs11/libisc-pkcs11-nosymtbl.@A@ @OPENSSL_LIBS@
  
 -DNSDEPLIBS =	../../lib/dns/libdns.@A@
 -ISCDEPLIBS =	../../lib/isc/libisc.@A@
@@ -44,25 +39,32 @@ index 4b8ca13..32f4470 100644
  
  DEPLIBS =	${DNSDEPLIBS} ${ISCDEPLIBS}
  
-@@ -35,10 +35,10 @@ LIBS =		${DNSLIBS} ${ISCLIBS} @LIBS@
+@@ -34,11 +34,11 @@ LIBS =		${DNSLIBS} ${ISCLIBS} @LIBS@
  NOSYMLIBS =	${DNSLIBS} ${ISCNOSYMLIBS} @LIBS@
  
  # Alphabetically
--TARGETS =	dnssec-keygen@EXEEXT@ dnssec-signzone@EXEEXT@ \
--		dnssec-keyfromlabel@EXEEXT@ dnssec-dsfromkey@EXEEXT@ \
--		dnssec-revoke@EXEEXT@ dnssec-settime@EXEEXT@ \
--		dnssec-verify@EXEEXT@ dnssec-importkey@EXEEXT@
-+TARGETS =	dnssec-keygen-pkcs11@EXEEXT@ dnssec-signzone-pkcs11@EXEEXT@ \
-+		dnssec-keyfromlabel-pkcs11@EXEEXT@ dnssec-dsfromkey-pkcs11@EXEEXT@ \
-+		dnssec-revoke-pkcs11@EXEEXT@ dnssec-settime-pkcs11@EXEEXT@ \
-+		dnssec-verify-pkcs11@EXEEXT@ dnssec-importkey-pkcs11@EXEEXT@
+-TARGETS =	dnssec-cds@EXEEXT@ dnssec-dsfromkey@EXEEXT@ \
+-		dnssec-importkey@EXEEXT@ dnssec-keyfromlabel@EXEEXT@ \
+-		dnssec-keygen@EXEEXT@ dnssec-revoke@EXEEXT@ \
+-		dnssec-settime@EXEEXT@ dnssec-signzone@EXEEXT@ \
+-		dnssec-verify@EXEEXT@
++TARGETS =	dnssec-cds-pkcs11@EXEEXT@ dnssec-dsfromkey-pkcs11@EXEEXT@ \
++		dnssec-importkey-pkcs11@EXEEXT@ dnssec-keyfromlabel-pkcs11@EXEEXT@ \
++		dnssec-keygen-pkcs11@EXEEXT@ dnssec-revoke-pkcs11@EXEEXT@ \
++		dnssec-settime-pkcs11@EXEEXT@ dnssec-signzone-pkcs11@EXEEXT@ \
++		dnssec-verify-pkcs11@EXEEXT@
  
  OBJS =		dnssectool.@O@
  
-@@ -59,15 +59,15 @@ MANOBJS =	${MANPAGES} ${HTMLPAGES}
+@@ -61,19 +61,19 @@ MANOBJS =	${MANPAGES} ${HTMLPAGES}
  
  @BIND9_MAKE_RULES@
  
+-dnssec-cds@EXEEXT@: dnssec-cds.@O@ ${OBJS} ${DEPLIBS}
++dnssec-cds-pkcs11@EXEEXT@: dnssec-cds.@O@ ${OBJS} ${DEPLIBS}
+ 	export BASEOBJS="dnssec-cds.@O@ ${OBJS}"; \
+ 	${FINALBUILDCMD}
+ 
 -dnssec-dsfromkey@EXEEXT@: dnssec-dsfromkey.@O@ ${OBJS} ${DEPLIBS}
 +dnssec-dsfromkey-pkcs11@EXEEXT@: dnssec-dsfromkey.@O@ ${OBJS} ${DEPLIBS}
  	export BASEOBJS="dnssec-dsfromkey.@O@ ${OBJS}"; \
@@ -78,7 +80,7 @@ index 4b8ca13..32f4470 100644
  	export BASEOBJS="dnssec-keygen.@O@ ${OBJS}"; \
  	${FINALBUILDCMD}
  
-@@ -75,7 +75,7 @@ dnssec-signzone.@O@: dnssec-signzone.c
+@@ -81,7 +81,7 @@ dnssec-signzone.@O@: dnssec-signzone.c
  	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} -DVERSION=\"${VERSION}\" \
  		-c ${srcdir}/dnssec-signzone.c
  
@@ -87,7 +89,7 @@ index 4b8ca13..32f4470 100644
  	export BASEOBJS="dnssec-signzone.@O@ ${OBJS}"; \
  	${FINALBUILDCMD}
  
-@@ -83,19 +83,19 @@ dnssec-verify.@O@: dnssec-verify.c
+@@ -89,19 +89,19 @@ dnssec-verify.@O@: dnssec-verify.c
  	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} -DVERSION=\"${VERSION}\" \
  		-c ${srcdir}/dnssec-verify.c
  
@@ -111,7 +113,7 @@ index 4b8ca13..32f4470 100644
  	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \
  	dnssec-importkey.@O@ ${OBJS} ${LIBS}
  
-@@ -106,16 +106,14 @@ docclean manclean maintainer-clean::
+@@ -112,16 +112,14 @@ docclean manclean maintainer-clean::
  
  installdirs:
  	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
@@ -129,49 +131,35 @@ index 4b8ca13..32f4470 100644
  	for t in ${TARGETS}; do ${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/$$t || exit 1; done
  
  clean distclean::
-diff --git a/bin/dnssec/Makefile.in b/bin/dnssec/Makefile.in
-index 4b8ca13..4175996 100644
---- a/bin/dnssec/Makefile.in
-+++ b/bin/dnssec/Makefile.in
-@@ -17,7 +17,7 @@ VERSION=@BIND9_VERSION@
- 
- CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} @DST_OPENSSL_INC@
- 
--CDEFINES =	-DVERSION=\"${VERSION}\" @USE_PKCS11@ @PKCS11_ENGINE@ \
-+CDEFINES =	-DVERSION=\"${VERSION}\" \
- 		@CRYPTO@ -DPK11_LIB_LOCATION=\"@PKCS11_PROVIDER@\"
- CWARNINGS =
- 
 diff --git a/bin/named-pkcs11/Makefile.in b/bin/named-pkcs11/Makefile.in
-index 70e5571..b5a4a6b 100644
+index 856463f..dc826dd 100644
 --- a/bin/named-pkcs11/Makefile.in
 +++ b/bin/named-pkcs11/Makefile.in
 @@ -43,27 +43,27 @@ DLZDRIVER_INCLUDES =	@DLZ_DRIVER_INCLUDES@
  DLZDRIVER_LIBS =	@DLZ_DRIVER_LIBS@
  
  CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
--		${LWRES_INCLUDES} ${DNS_INCLUDES} ${BIND9_INCLUDES} \
--		${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} ${ISC_INCLUDES} \
-+		${LWRES_INCLUDES} ${DNS_PKCS11_INCLUDES} ${BIND9_INCLUDES} \
-+		${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} ${ISC_PKCS11_INCLUDES} \
- 		${DLZDRIVER_INCLUDES} ${DBDRIVER_INCLUDES} ${MAXMINDDB_CFLAGS} \
- 		@DST_OPENSSL_INC@
+-		${NS_INCLUDES} ${DNS_INCLUDES} \
++		${NS_INCLUDES} ${DNS_PKCS11_INCLUDES} \
+ 		${BIND9_INCLUDES} ${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} \
+-		${ISC_INCLUDES} ${DLZDRIVER_INCLUDES} \
++		${ISC_PKCS11_INCLUDES} ${DLZDRIVER_INCLUDES} \
+ 		${DBDRIVER_INCLUDES} @OPENSSL_INCLUDES@
  
--CDEFINES =      @CONTRIB_DLZ@ @USE_PKCS11@ @PKCS11_ENGINE@ @USE_GSSAPI@ @CRYPTO@
-+CDEFINES =      @USE_PKCS11@ @PKCS11_ENGINE@ @CRYPTO_PK11@ @USE_GSSAPI@
+ CDEFINES =      @CONTRIB_DLZ@
  
  CWARNINGS =
  
--DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
-+DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
+-DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
++DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ @DNS_CRYPTO_LIBS@
  ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
  ISCCCLIBS =	../../lib/isccc/libisccc.@A@
--ISCLIBS =	../../lib/isc/libisc.@A@
--ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@
-+ISCLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
-+ISCNOSYMLIBS =	../../lib/isc-pkcs11/libisc-pkcs11-nosymtbl.@A@
- LWRESLIBS =	../../lib/lwres/liblwres.@A@
+-ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
+-ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @OPENSSL_LIBS@
++ISCLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@ @OPENSSL_LIBS@
++ISCNOSYMLIBS =	../../lib/isc-pkcs11/libisc-pkcs11-nosymtbl.@A@ @OPENSSL_LIBS@
  BIND9LIBS =	../../lib/bind9/libbind9.@A@
+ NSLIBS =	../../lib/ns/libns.@A@
  
 -DNSDEPLIBS =	../../lib/dns/libdns.@A@
 +DNSDEPLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@
@@ -179,49 +167,51 @@ index 70e5571..b5a4a6b 100644
  ISCCCDEPLIBS =	../../lib/isccc/libisccc.@A@
 -ISCDEPLIBS =	../../lib/isc/libisc.@A@
 +ISCDEPLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
- LWRESDEPLIBS =	../../lib/lwres/liblwres.@A@
  BIND9DEPLIBS =	../../lib/bind9/libbind9.@A@
+ NSDEPLIBS =	../../lib/ns/libns.@A@
  
-@@ -72,15 +72,15 @@ DEPLIBS =	${LWRESDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
+@@ -72,17 +72,17 @@ DEPLIBS =	${NSDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
  
- LIBS =		${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
+ LIBS =		${NSLIBS} ${DNSLIBS} ${BIND9LIBS} \
  		${ISCCFGLIBS} ${ISCCCLIBS} ${ISCLIBS} \
--		${DLZDRIVER_LIBS} ${DBDRIVER_LIBS} @LIBS@
-+		@LIBS@
+-		${DLZDRIVER_LIBS} ${DBDRIVER_LIBS} @LIBCAP_LIBS@ \
++		@LIBCAP_LIBS@ \
+ 		@LIBS@
  
- NOSYMLIBS =	${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
+ NOSYMLIBS =	${NSLIBS} ${DNSLIBS} ${BIND9LIBS} \
  		${ISCCFGLIBS} ${ISCCCLIBS} ${ISCNOSYMLIBS} \
--		${DLZDRIVER_LIBS} ${DBDRIVER_LIBS} @LIBS@
-+		@LIBS@
+-		${DLZDRIVER_LIBS} ${DBDRIVER_LIBS} @LIBCAP_LIBS@ \
++		@LIBCAP_LIBS@ \
+ 		@LIBS@
  
  SUBDIRS =	unix
  
--TARGETS =	named@EXEEXT@ lwresd@EXEEXT@ feature-test@EXEEXT@
+-TARGETS =	named@EXEEXT@ feature-test@EXEEXT@
 +TARGETS =	named-pkcs11@EXEEXT@ feature-test-pkcs11@EXEEXT@
  
  GEOIPLINKOBJS = geoip.@O@
- GEOIP2LINKOBJS = geoip.@O@
-@@ -94,8 +94,7 @@ OBJS =		builtin.@O@ client.@O@ config.@O@ control.@O@ \
- 		tkeyconf.@O@ tsigconf.@O@ update.@O@ xfrout.@O@ \
- 		zoneconf.@O@ \
- 		lwaddr.@O@ lwresd.@O@ lwdclient.@O@ lwderror.@O@ lwdgabn.@O@ \
--		lwdgnba.@O@ lwdgrbn.@O@ lwdnoop.@O@ lwsearch.@O@ \
+ 
+@@ -90,8 +90,7 @@ OBJS =		builtin.@O@ config.@O@ control.@O@ \
+ 		controlconf.@O@ fuzz.@O@ @GEOIPLINKOBJS@ \
+ 		log.@O@ logconf.@O@ main.@O@ \
+ 		server.@O@ statschannel.@O@ \
+-		tkeyconf.@O@ tsigconf.@O@ zoneconf.@O@ \
 -		${DLZDRIVER_OBJS} ${DBDRIVER_OBJS}
-+        lwdgnba.@O@ lwdgrbn.@O@ lwdnoop.@O@ lwsearch.@O@
++		tkeyconf.@O@ tsigconf.@O@ zoneconf.@O@
  
  UOBJS =		unix/os.@O@ unix/dlz_dlopen_driver.@O@
  
-@@ -113,8 +112,7 @@ SRCS =		builtin.c client.c config.c control.c \
- 		tkeyconf.c tsigconf.c update.c xfrout.c \
- 		zoneconf.c \
- 		lwaddr.c lwresd.c lwdclient.c lwderror.c lwdgabn.c \
--		lwdgnba.c lwdgrbn.c lwdnoop.c lwsearch.c \
+@@ -103,8 +102,7 @@ SRCS =		builtin.c config.c control.c \
+ 		controlconf.c fuzz.c @GEOIPLINKSRCS@ \
+ 		log.c logconf.c main.c \
+ 		server.c statschannel.c \
+-		tkeyconf.c tsigconf.c zoneconf.c \
 -		${DLZDRIVER_SRCS} ${DBDRIVER_SRCS}
-+        lwdgnba.c lwdgrbn.c lwdnoop.c lwsearch.c
++		tkeyconf.c tsigconf.c zoneconf.c
  
- MANPAGES =	named.8 lwresd.8 named.conf.5
+ MANPAGES =	named.8 named.conf.5
  
-@@ -154,21 +152,21 @@ server.@O@: server.c
+@@ -143,7 +141,7 @@ server.@O@: server.c
  		-DPRODUCT=\"${PRODUCT}\" \
  		-DVERSION=\"${VERSION}\" -c ${srcdir}/server.c
  
@@ -230,15 +220,7 @@ index 70e5571..b5a4a6b 100644
  	export MAKE_SYMTABLE="yes"; \
  	export BASEOBJS="${OBJS} ${UOBJS}"; \
  	${FINALBUILDCMD}
- 
--lwresd@EXEEXT@: named@EXEEXT@
-+lwresd@EXEEXT@: named-pkcs11@EXEEXT@
- 	rm -f lwresd@EXEEXT@
--	@LN@ named@EXEEXT@ lwresd@EXEEXT@
-+	@LN@ named-pkcs11@EXEEXT@ lwresd@EXEEXT@
- 
- # Bit of hack, do not produce intermediate .o object for featuretest
- feature-test.@O@: ${top_srcdir}/bin/tests/system/feature-test.c
+@@ -153,7 +151,7 @@ feature-test.@O@: ${top_srcdir}/bin/tests/system/feature-test.c
  	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} \
  		-c ${top_srcdir}/bin/tests/system/feature-test.c
  
@@ -247,44 +229,28 @@ index 70e5571..b5a4a6b 100644
  	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} \
  		-o $@ feature-test.@O@ ${ISCLIBS} ${LIBS}
  
-@@ -201,16 +199,11 @@ install-man8: named.8 lwresd.8
+@@ -186,13 +184,13 @@ install-man8: named.8
  
  install-man: install-man5 install-man8
  
--install:: named@EXEEXT@ lwresd@EXEEXT@ installdirs install-man
+-install:: named@EXEEXT@ installdirs install-man
 -	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named@EXEEXT@ ${DESTDIR}${sbindir}
--	(cd ${DESTDIR}${sbindir}; rm -f lwresd@EXEEXT@; @LN@ named@EXEEXT@ lwresd@EXEEXT@)
-+install:: named-pkcs11@EXEEXT@ installdirs
++install:: named-pkcs11@EXEEXT@ installdirs install-man
 +	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named-pkcs11@EXEEXT@ ${DESTDIR}${sbindir}
  
  uninstall::
--	rm -f ${DESTDIR}${mandir}/man5/named.conf.5
--	rm -f ${DESTDIR}${mandir}/man8/lwresd.8
--	rm -f ${DESTDIR}${mandir}/man8/named.8
--	rm -f ${DESTDIR}${sbindir}/lwresd@EXEEXT@
+ 	rm -f ${DESTDIR}${mandir}/man5/named.conf.5
+ 	rm -f ${DESTDIR}${mandir}/man8/named.8
 -	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/named@EXEEXT@
 +	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/named-pkcs11@EXEEXT@
  
  @DLZ_DRIVER_RULES@
  
-diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
-index 70e5571..4cfed4d 100644
---- a/bin/named/Makefile.in
-+++ b/bin/named/Makefile.in
-@@ -48,7 +48,7 @@ CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
- 		${DLZDRIVER_INCLUDES} ${DBDRIVER_INCLUDES} ${MAXMINDDB_CFLAGS} \
- 		@DST_OPENSSL_INC@
- 
--CDEFINES =      @CONTRIB_DLZ@ @USE_PKCS11@ @PKCS11_ENGINE@ @USE_GSSAPI@ @CRYPTO@
-+CDEFINES =      @CONTRIB_DLZ@ @USE_GSSAPI@ @CRYPTO@
- 
- CWARNINGS =
- 
 diff --git a/bin/pkcs11/Makefile.in b/bin/pkcs11/Makefile.in
-index a058c91..d4b689a 100644
+index 454d145..0e542f3 100644
 --- a/bin/pkcs11/Makefile.in
 +++ b/bin/pkcs11/Makefile.in
-@@ -15,13 +15,13 @@ top_srcdir =	@top_srcdir@
+@@ -13,13 +13,13 @@ top_srcdir =	@top_srcdir@
  
  @BIND9_MAKE_INCLUDES@
  
@@ -293,8 +259,7 @@ index a058c91..d4b689a 100644
  
  CDEFINES =
  
--ISCLIBS =	../../lib/isc/libisc.@A@ @ISC_OPENSSL_LIBS@
-+ISCLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@ @ISC_OPENSSL_LIBS@
+ ISCLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@ @OPENSSL_LIBS@
  
 -ISCDEPLIBS =	../../lib/isc/libisc.@A@
 +ISCDEPLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
@@ -302,13 +267,13 @@ index a058c91..d4b689a 100644
  DEPLIBS =	${ISCDEPLIBS}
  
 diff --git a/configure.ac b/configure.ac
-index 9b7d778..59ba20b 100644
+index 6e17d3a..0f7c850 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -1139,12 +1139,14 @@ AC_SUBST(USE_GSSAPI)
+@@ -1188,12 +1188,14 @@ AC_SUBST(USE_GSSAPI)
  AC_SUBST(DST_GSSAPI_INC)
  AC_SUBST(DNS_GSSAPI_LIBS)
- DNS_CRYPTO_LIBS="$DNS_GSSAPI_LIBS $DNS_CRYPTO_LIBS"
+ DNS_CRYPTO_LIBS="$DNS_GSSAPI_LIBS"
 +DNS_CRYPTO_PK11_LIBS="$DNS_GSSAPI_LIBS $DNS_CRYPTO_PK11_LIBS"
  
  #
@@ -319,96 +284,50 @@ index 9b7d778..59ba20b 100644
 +AC_SUBST(DNS_CRYPTO_PK11_LIBS)
  
  #
- # was --with-randomdev specified?
-@@ -1494,11 +1496,11 @@ AC_ARG_ENABLE(openssl-hash,
- AC_MSG_CHECKING(for OpenSSL library)
- OPENSSL_WARNING=
- openssldirs="/usr /usr/local /usr/local/ssl /opt/local /usr/pkg /usr/sfw"
--if test "yes" = "$want_native_pkcs11"
--then
--	use_openssl="native_pkcs11"
--	AC_MSG_RESULT(use of native PKCS11 instead)
--fi
-+# if test "yes" = "$want_native_pkcs11"
-+# then
-+# 	use_openssl="native_pkcs11"
-+# 	AC_MSG_RESULT(use of native PKCS11 instead)
-+# fi
- 
- if test "auto" = "$use_openssl"
- then
-@@ -1511,6 +1513,7 @@ then
- 		fi
- 	done
+ # was --with-lmdb specified?
+@@ -2466,6 +2468,9 @@ AC_SUBST(BIND9_DNS_BUILDINCLUDE)
+ AC_SUBST(BIND9_NS_BUILDINCLUDE)
+ AC_SUBST(BIND9_BIND9_BUILDINCLUDE)
+ AC_SUBST(BIND9_IRS_BUILDINCLUDE)
++AC_SUBST(BIND9_ISC_PKCS11_BUILDINCLUDE)
++AC_SUBST(BIND9_DNS_PKCS11_BUILDINCLUDE)
++AC_SUBST(BIND9_NS_PKCS11_BUILDINCLUDE)
+ if test "X$srcdir" != "X"; then
+ 	BIND9_ISC_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/isc/include"
+ 	BIND9_ISCCC_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/isccc/include"
+@@ -2474,6 +2479,9 @@ if test "X$srcdir" != "X"; then
+ 	BIND9_NS_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/ns/include"
+ 	BIND9_BIND9_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/bind9/include"
+ 	BIND9_IRS_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/irs/include"
++	BIND9_ISC_PKCS11_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/isc-pkcs11/include"
++	BIND9_DNS_PKCS11_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/dns-pkcs11/include"
++	BIND9_NS_PKCS11_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/ns-pkcs11/include"
+ else
+ 	BIND9_ISC_BUILDINCLUDE=""
+ 	BIND9_ISCCC_BUILDINCLUDE=""
+@@ -2482,6 +2490,9 @@ else
+ 	BIND9_NS_BUILDINCLUDE=""
+ 	BIND9_BIND9_BUILDINCLUDE=""
+ 	BIND9_IRS_BUILDINCLUDE=""
++	BIND9_ISC_PKCS11_BUILDINCLUDE=""
++	BIND9_DNS_PKCS11_BUILDINCLUDE=""
++	BIND9_NS_PKCS11_BUILDINCLUDE=""
  fi
-+CRYPTO_PK11=""
- OPENSSL_ECDSA=""
- OPENSSL_GOST=""
- OPENSSL_ED25519=""
-@@ -1532,11 +1535,10 @@ case "$with_gost" in
- 		;;
- esac
  
--case "$use_openssl" in
--	native_pkcs11)
--		AC_MSG_RESULT(disabled because of native PKCS11)
-+if test "$want_native_pkcs11" = "yes"
-+then
- 		DST_OPENSSL_INC=""
--		CRYPTO="-DPKCS11CRYPTO"
-+		CRYPTO_PK11="-DPKCS11CRYPTO"
- 		CRYPTOLIB="pkcs11"
- 		OPENSSLECDSALINKOBJS=""
- 		OPENSSLECDSALINKSRCS=""
-@@ -1546,7 +1548,9 @@ case "$use_openssl" in
- 		OPENSSLGOSTLINKSRCS=""
- 		OPENSSLLINKOBJS=""
- 		OPENSSLLINKSRCS=""
--		;;
-+fi
-+
-+case "$use_openssl" in
- 	no)
- 		AC_MSG_RESULT(no)
- 		DST_OPENSSL_INC=""
-@@ -1578,7 +1582,7 @@ case "$use_openssl" in
- If you do not want OpenSSL, use --without-openssl])
- 		;;
- 	*)
--		if test "yes" = "$want_native_pkcs11"
-+		if false # test "yes" = "$want_native_pkcs11"
- 		then
- 			AC_MSG_RESULT()
- 			AC_MSG_ERROR([OpenSSL and native PKCS11 cannot be used together.])
-@@ -2006,6 +2010,7 @@ AC_SUBST(OPENSSL_ED25519)
- AC_SUBST(OPENSSL_GOST)
- 
- DNS_CRYPTO_LIBS="$DNS_CRYPTO_LIBS $DST_OPENSSL_LIBS"
-+DNS_CRYPTO_PK11_LIBS="$DNS_CRYPTO_LIBS"
- 
- ISC_PLATFORM_WANTAES="#undef ISC_PLATFORM_WANTAES"
- if test "yes" = "$with_aes"
-@@ -2291,6 +2296,7 @@ esac
- AC_SUBST(PKCS11LINKOBJS)
- AC_SUBST(PKCS11LINKSRCS)
- AC_SUBST(CRYPTO)
-+AC_SUBST(CRYPTO_PK11)
- AC_SUBST(PKCS11_ECDSA)
- AC_SUBST(PKCS11_GOST)
- AC_SUBST(PKCS11_ED25519)
-@@ -5405,8 +5411,11 @@ AC_CONFIG_FILES([
+ AC_SUBST_FILE(BIND9_MAKE_INCLUDES)
+@@ -2940,8 +2951,11 @@ AC_CONFIG_FILES([
  	bin/delv/Makefile
  	bin/dig/Makefile
  	bin/dnssec/Makefile
-+	bin/dnssec-pkcs11/Makefile	
++	bin/dnssec-pkcs11/Makefile
  	bin/named/Makefile
  	bin/named/unix/Makefile
 +	bin/named-pkcs11/Makefile
 +	bin/named-pkcs11/unix/Makefile
  	bin/nsupdate/Makefile
  	bin/pkcs11/Makefile
- 	bin/python/Makefile
-@@ -5479,6 +5488,10 @@ AC_CONFIG_FILES([
+ 	bin/plugins/Makefile
+@@ -3014,6 +3028,10 @@ AC_CONFIG_FILES([
  	lib/dns/include/dns/Makefile
  	lib/dns/include/dst/Makefile
  	lib/dns/tests/Makefile
@@ -419,16 +338,13 @@ index 9b7d778..59ba20b 100644
  	lib/irs/Makefile
  	lib/irs/include/Makefile
  	lib/irs/include/irs/Makefile
-@@ -5503,6 +5516,24 @@ AC_CONFIG_FILES([
+@@ -3034,6 +3052,20 @@ AC_CONFIG_FILES([
  	lib/isc/unix/include/Makefile
  	lib/isc/unix/include/isc/Makefile
  	lib/isc/unix/include/pkcs11/Makefile
-+	lib/isc-pkcs11/$arch/Makefile
-+	lib/isc-pkcs11/$arch/include/Makefile
-+	lib/isc-pkcs11/$arch/include/isc/Makefile
-+	lib/isc-pkcs11/$thread_dir/Makefile
-+	lib/isc-pkcs11/$thread_dir/include/Makefile
-+	lib/isc-pkcs11/$thread_dir/include/isc/Makefile
++	lib/isc-pkcs11/pthreads/Makefile
++	lib/isc-pkcs11/pthreads/include/Makefile
++	lib/isc-pkcs11/pthreads/include/isc/Makefile
 +	lib/isc-pkcs11/Makefile
 +	lib/isc-pkcs11/include/Makefile
 +	lib/isc-pkcs11/include/isc/Makefile
@@ -436,7 +352,6 @@ index 9b7d778..59ba20b 100644
 +	lib/isc-pkcs11/include/pk11/Makefile
 +	lib/isc-pkcs11/include/pkcs11/Makefile
 +	lib/isc-pkcs11/tests/Makefile
-+	lib/isc-pkcs11/nls/Makefile
 +	lib/isc-pkcs11/unix/Makefile
 +	lib/isc-pkcs11/unix/include/Makefile
 +	lib/isc-pkcs11/unix/include/isc/Makefile
@@ -445,46 +360,44 @@ index 9b7d778..59ba20b 100644
  	lib/isccc/include/Makefile
  	lib/isccc/include/isccc/Makefile
 diff --git a/lib/Makefile.in b/lib/Makefile.in
-index 81270a0..bcb5312 100644
+index ffa2d5a..439d748 100644
 --- a/lib/Makefile.in
 +++ b/lib/Makefile.in
 @@ -15,7 +15,7 @@ top_srcdir =	@top_srcdir@
  # Attempt to disable parallel processing.
  .NOTPARALLEL:
  .NO_PARALLEL:
--SUBDIRS =	isc isccc dns isccfg bind9 lwres irs samples
-+SUBDIRS =	isc isc-pkcs11 isccc dns dns-pkcs11 isccfg bind9 lwres irs samples
+-SUBDIRS =	isc isccc dns ns isccfg bind9 irs samples
++SUBDIRS =	isc isc-pkcs11 isccc dns dns-pkcs11 ns isccfg bind9 irs samples
  TARGETS =
  
  @BIND9_MAKE_RULES@
 diff --git a/lib/dns-pkcs11/Makefile.in b/lib/dns-pkcs11/Makefile.in
-index 7f09bd6..c388d9e 100644
+index eb3346a..c9e4960 100644
 --- a/lib/dns-pkcs11/Makefile.in
 +++ b/lib/dns-pkcs11/Makefile.in
-@@ -26,17 +26,16 @@ VERSION=@BIND9_VERSION@
+@@ -26,16 +26,16 @@ VERSION=@BIND9_VERSION@
  
  USE_ISC_SPNEGO = @USE_ISC_SPNEGO@
  
 -CINCLUDES =	-I. -I${top_srcdir}/lib/dns -Iinclude ${DNS_INCLUDES} \
--		${ISC_INCLUDES} ${MAXMINDDB_CFLAGS} \
--		@DST_OPENSSL_INC@ @DST_GSSAPI_INC@
+-		${ISC_INCLUDES} @OPENSSL_INCLUDES@ @DST_GSSAPI_INC@
 +CINCLUDES =	-I. -I${top_srcdir}/lib/dns-pkcs11 -Iinclude ${DNS_PKCS11_INCLUDES} \
-+		${ISC_PKCS11_INCLUDES} ${MAXMINDDB_CFLAGS} @DST_OPENSSL_INC@ @DST_GSSAPI_INC@
++		${ISC_PKCS11_INCLUDES} @OPENSSL_INCLUDES@ @DST_GSSAPI_INC@
  
--CDEFINES =	-DUSE_MD5 @CRYPTO@ @USE_GSSAPI@ ${USE_ISC_SPNEGO}
-+CDEFINES =	-DUSE_MD5 @CRYPTO_PK11@ @USE_GSSAPI@ ${USE_ISC_SPNEGO}
+ CDEFINES =	@USE_GSSAPI@ ${USE_ISC_SPNEGO}
  
  CWARNINGS =
  
--ISCLIBS =	../../lib/isc/libisc.@A@
-+ISCLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
+-ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
++ISCLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@ @OPENSSL_LIBS@
  
 -ISCDEPLIBS =	../../lib/isc/libisc.@A@
 +ISCDEPLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
  
- LIBS =		${MAXMINDDB_LIBS} @LIBS@
+ LIBS =		@LIBS@
  
-@@ -150,15 +149,15 @@ version.@O@: version.c
+@@ -134,15 +134,15 @@ version.@O@: version.c
  		-DLIBAGE=${LIBAGE} \
  		-c ${srcdir}/version.c
  
@@ -504,9 +417,13 @@ index 7f09bd6..c388d9e 100644
  
  include: gen
  	${MAKE} include/dns/enumtype.h
-@@ -189,22 +188,22 @@ gen: gen.c
- 	${BUILD_CPPFLAGS} ${BUILD_LDFLAGS} -o $@ ${srcdir}/gen.c \
- 	${BUILD_LIBS} ${LFS_LIBS}
+@@ -168,25 +168,25 @@ code.h:	gen
+ 	./gen -s ${srcdir} > code.h || { rm -f $@ ; exit 1; }
+ 
+ gen: gen.c
+-	${BUILD_CC} ${BUILD_CFLAGS} -I${top_srcdir}/lib/isc/include \
++	${BUILD_CC} ${BUILD_CFLAGS} -I${top_srcdir}/lib/isc-pkcs11/include \
+ 	${BUILD_CPPFLAGS} ${BUILD_LDFLAGS} -o $@ ${srcdir}/gen.c ${BUILD_LIBS}
  
 -timestamp: include libdns.@A@
 +timestamp: include libdns-pkcs11.@A@
@@ -531,23 +448,21 @@ index 7f09bd6..c388d9e 100644
 +	rm -f libdns-pkcs11.@A@ timestamp
  	rm -f gen code.h include/dns/enumtype.h include/dns/enumclass.h
  	rm -f include/dns/rdatastruct.h
- 	rm -f dnstap.pb-c.c dnstap.pb-c.h
+ 	rm -f dnstap.pb-c.c dnstap.pb-c.h include/dns/dnstap.pb-c.h
 diff --git a/lib/isc-pkcs11/Makefile.in b/lib/isc-pkcs11/Makefile.in
-index 8ad54bb..a3ecdfb 100644
+index ed87279..3171b48 100644
 --- a/lib/isc-pkcs11/Makefile.in
 +++ b/lib/isc-pkcs11/Makefile.in
-@@ -23,8 +23,8 @@ CINCLUDES =	-I${srcdir}/unix/include \
- 		-I${srcdir}/@ISC_THREAD_DIR@/include \
- 		-I${srcdir}/@ISC_ARCH_DIR@/include \
+@@ -20,7 +20,7 @@ VERSION=@BIND9_VERSION@
+ CINCLUDES =	-I${srcdir}/unix/include \
+ 		-I${srcdir}/pthreads/include \
  		-I./include \
--		-I${srcdir}/include ${DNS_INCLUDES} @ISC_OPENSSL_INC@
--CDEFINES =	@CRYPTO@ -DPK11_LIB_LOCATION=\"${PROVIDER}\"
-+		-I${srcdir}/include ${DNS_PKCS11_INCLUDES}
-+CDEFINES =	@CRYPTO_PK11@ -DPK11_LIB_LOCATION=\"${PROVIDER}\"
+-		-I${srcdir}/include ${DNS_INCLUDES} @OPENSSL_INCLUDES@
++		-I${srcdir}/include ${DNS_PKCS11_INCLUDES} @OPENSSL_INCLUDES@
+ CDEFINES =
  CWARNINGS =
  
- # Alphabetically
-@@ -103,40 +103,40 @@ version.@O@: version.c
+@@ -94,40 +94,40 @@ version.@O@: version.c
  		-DLIBAGE=${LIBAGE} \
  		-c ${srcdir}/version.c
  
@@ -600,21 +515,37 @@ index 8ad54bb..a3ecdfb 100644
 -	libisc-nosymtbl.la timestamp
 +	rm -f libisc-pkcs11.@A@ libisc-pkcs11-nosymtbl.@A@ libisc-pkcs11.la \
 +	libisc-pkcs11-nosymtbl.la timestamp
+diff --git a/lib/isc-pkcs11/tests/Makefile.in b/lib/isc-pkcs11/tests/Makefile.in
+index 5735829..7e62737 100644
+--- a/lib/isc-pkcs11/tests/Makefile.in
++++ b/lib/isc-pkcs11/tests/Makefile.in
+@@ -18,7 +18,7 @@ VERSION=@BIND9_VERSION@
+ CINCLUDES =	-I. -Iinclude ${ISC_INCLUDES} @OPENSSL_INCLUDES@ @CMOCKA_CFLAGS@
+ CDEFINES =	-DTESTS="\"${top_builddir}/lib/isc/tests/\""
+ 
+-ISCLIBS =	../libisc.@A@ @OPENSSL_LIBS@
++ISCLIBS =	../libisc-pkcs11.@A@ @OPENSSL_LIBS@
+ ISCDEPLIBS =	../libisc.@A@
+ 
+ LIBS =		@LIBS@ @CMOCKA_LIBS@
 diff --git a/make/includes.in b/make/includes.in
-index fa86ad1..3cfbe9f 100644
+index 48cdaf7..6e6572b 100644
 --- a/make/includes.in
 +++ b/make/includes.in
-@@ -43,3 +43,13 @@ BIND9_INCLUDES = @BIND9_BIND9_BUILDINCLUDE@ \
+@@ -39,3 +39,16 @@ BIND9_INCLUDES = @BIND9_BIND9_BUILDINCLUDE@ \
  
  TEST_INCLUDES = \
  	-I${top_srcdir}/lib/tests/include
 +
-+ISC_PKCS11_INCLUDES = @BIND9_ISC_BUILDINCLUDE@ \
++ISC_PKCS11_INCLUDES = @BIND9_ISC_PKCS11_BUILDINCLUDE@ \
 +	-I${top_srcdir}/lib/isc-pkcs11 \
 +	-I${top_srcdir}/lib/isc-pkcs11/include \
 +	-I${top_srcdir}/lib/isc-pkcs11/unix/include \
-+	-I${top_srcdir}/lib/isc-pkcs11/@ISC_THREAD_DIR@/include \
-+	-I${top_srcdir}/lib/isc-pkcs11/@ISC_ARCH_DIR@/include
++	-I${top_srcdir}/lib/isc-pkcs11/pthreads/include
 +
-+DNS_PKCS11_INCLUDES = @BIND9_DNS_BUILDINCLUDE@ \
++DNS_PKCS11_INCLUDES = @BIND9_DNS_PKCS11_BUILDINCLUDE@ \
 +	-I${top_srcdir}/lib/dns-pkcs11/include
++
++NS_PKCS11_INCLUDES = @BIND9_NS_PKCS11_BUILDINCLUDE@ \
++	-I${top_srcdir}/lib/ns-pkcs11/include
++
diff --git a/bind-9.11-feature-test-named.patch b/bind-9.11-feature-test-named.patch
index c8e6d57..1b89e1b 100644
--- a/bind-9.11-feature-test-named.patch
+++ b/bind-9.11-feature-test-named.patch
@@ -1,4 +1,4 @@
-From 3f2fafe5368655225eddf0537e58e425bbc297be Mon Sep 17 00:00:00 2001
+From b45cc1caf018d46753a03d59bb9e75cdeef1deeb Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Wed, 30 Jan 2019 14:37:17 +0100
 Subject: [PATCH] Create feature-test in source directory
@@ -6,40 +6,27 @@ Subject: [PATCH] Create feature-test in source directory
 Feature-test tool is used in system tests to test compiled in changes.
 Because we build more variants of named with different configuration,
 compile feature-test for each of them this way.
-
-Named variant specific feature-test does not have defined gss support,
-even when it was enabled by configure. bin/tests/system Makefile defines
-it, so define it also in named variants.
 ---
- bin/named/Makefile.in       | 13 +++++++++++--
+ bin/named/Makefile.in       | 11 ++++++++++-
  bin/tests/system/conf.sh.in |  2 +-
- 2 files changed, 12 insertions(+), 3 deletions(-)
+ 2 files changed, 11 insertions(+), 2 deletions(-)
 
 diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
-index 3166368..70e5571 100644
+index 10d568f..856463f 100644
 --- a/bin/named/Makefile.in
 +++ b/bin/named/Makefile.in
-@@ -48,7 +48,7 @@ CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
- 		${DLZDRIVER_INCLUDES} ${DBDRIVER_INCLUDES} ${MAXMINDDB_CFLAGS} \
- 		@DST_OPENSSL_INC@
- 
--CDEFINES =      @CONTRIB_DLZ@ @USE_PKCS11@ @PKCS11_ENGINE@ @CRYPTO@
-+CDEFINES =      @CONTRIB_DLZ@ @USE_PKCS11@ @PKCS11_ENGINE@ @USE_GSSAPI@ @CRYPTO@
- 
- CWARNINGS =
- 
-@@ -80,7 +80,7 @@ NOSYMLIBS =	${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
+@@ -82,7 +82,7 @@ NOSYMLIBS =	${NSLIBS} ${DNSLIBS} ${BIND9LIBS} \
  
  SUBDIRS =	unix
  
--TARGETS =	named@EXEEXT@ lwresd@EXEEXT@
-+TARGETS =	named@EXEEXT@ lwresd@EXEEXT@ feature-test@EXEEXT@
+-TARGETS =	named@EXEEXT@
++TARGETS =	named@EXEEXT@ feature-test@EXEEXT@
  
  GEOIPLINKOBJS = geoip.@O@
- GEOIP2LINKOBJS = geoip.@O@
-@@ -163,6 +163,15 @@ lwresd@EXEEXT@: named@EXEEXT@
- 	rm -f lwresd@EXEEXT@
- 	@LN@ named@EXEEXT@ lwresd@EXEEXT@
+ 
+@@ -148,6 +148,15 @@ named@EXEEXT@: ${OBJS} ${DEPLIBS}
+ 	export BASEOBJS="${OBJS} ${UOBJS}"; \
+ 	${FINALBUILDCMD}
  
 +# Bit of hack, do not produce intermediate .o object for featuretest
 +feature-test.@O@: ${top_srcdir}/bin/tests/system/feature-test.c
@@ -54,18 +41,18 @@ index 3166368..70e5571 100644
  
  docclean manclean maintainer-clean::
 diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
-index cedabbe..e1bf5da 100644
+index d9efc63..0f4ead0 100644
 --- a/bin/tests/system/conf.sh.in
 +++ b/bin/tests/system/conf.sh.in
-@@ -71,7 +71,7 @@ DNSTAPREAD=$TOP/bin/tools/dnstap-read
- MDIG=$TOP/bin/tools/mdig
- NZD2NZF=$TOP/bin/tools/named-nzd2nzf
- FSTRM_CAPTURE=@FSTRM_CAPTURE@
+@@ -38,7 +38,7 @@ DELV=$TOP/bin/delv/delv
+ DIG=$TOP/bin/dig/dig
+ DNSTAPREAD=$TOP/bin/tools/dnstap-read
+ DSFROMKEY=$TOP/bin/dnssec/dnssec-dsfromkey
 -FEATURETEST=$TOP/bin/tests/system/feature-test
 +FEATURETEST=$TOP/bin/named/feature-test
- 
- RANDFILE=$TOP/bin/tests/system/random.data
- 
+ FSTRM_CAPTURE=@FSTRM_CAPTURE@
+ IMPORTKEY=$TOP/bin/dnssec/dnssec-importkey
+ JOURNALPRINT=$TOP/bin/tools/named-journalprint
 -- 
 2.20.1
 
diff --git a/bind-9.11-kyua-pkcs11.patch b/bind-9.11-kyua-pkcs11.patch
index ac15d22..cb9fe4c 100644
--- a/bind-9.11-kyua-pkcs11.patch
+++ b/bind-9.11-kyua-pkcs11.patch
@@ -1,4 +1,4 @@
-From eb38d2278937ec3fe45d0af30cd080953bbb5b54 Mon Sep 17 00:00:00 2001
+From 9b9087cce00acd8f1fc2ce8e5c89d1dab1158683 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Tue, 2 Jan 2018 18:13:07 +0100
 Subject: [PATCH] Fix pkcs11 variants atf tests
@@ -9,17 +9,16 @@ Add pkcs11 Kyuafile, fix dh_test to pass in pkcs11 mode
 ---
  configure.ac                     |  1 +
  lib/Kyuafile                     |  2 ++
- lib/dns-pkcs11/tests/Makefile.in | 10 +++++-----
+ lib/dns-pkcs11/tests/Makefile.in | 12 ++++++------
  lib/dns-pkcs11/tests/dh_test.c   |  3 ++-
  lib/isc-pkcs11/tests/Makefile.in |  6 +++---
- lib/isc-pkcs11/tests/hash_test.c | 32 +++++++++++++++++++++++++-------
- 6 files changed, 38 insertions(+), 16 deletions(-)
+ 5 files changed, 14 insertions(+), 10 deletions(-)
 
 diff --git a/configure.ac b/configure.ac
-index 0532feb..a83ddd5 100644
+index b7dd8e5..e9dbbba 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -5578,6 +5578,7 @@ AC_CONFIG_FILES([
+@@ -3023,6 +3023,7 @@ AC_CONFIG_FILES([
  	lib/dns-pkcs11/include/Makefile
  	lib/dns-pkcs11/include/dns/Makefile
  	lib/dns-pkcs11/include/dst/Makefile
@@ -28,7 +27,7 @@ index 0532feb..a83ddd5 100644
  	lib/irs/include/Makefile
  	lib/irs/include/irs/Makefile
 diff --git a/lib/Kyuafile b/lib/Kyuafile
-index 7c8bab0..eec9564 100644
+index 39ce986..dcfb139 100644
 --- a/lib/Kyuafile
 +++ b/lib/Kyuafile
 @@ -2,8 +2,10 @@ syntax(2)
@@ -41,34 +40,37 @@ index 7c8bab0..eec9564 100644
 +include('isc-pkcs11/Kyuafile')
  include('isccc/Kyuafile')
  include('isccfg/Kyuafile')
- include('lwres/Kyuafile')
+ include('ns/Kyuafile')
 diff --git a/lib/dns-pkcs11/tests/Makefile.in b/lib/dns-pkcs11/tests/Makefile.in
-index 7671e1d..e237d5c 100644
+index 7b35b93..c95d1c8 100644
 --- a/lib/dns-pkcs11/tests/Makefile.in
 +++ b/lib/dns-pkcs11/tests/Makefile.in
-@@ -17,12 +17,12 @@ VERSION=@BIND9_VERSION@
+@@ -15,14 +15,14 @@ VERSION=@BIND9_VERSION@
  
- CINCLUDES =	-I. -Iinclude ${DNS_INCLUDES} ${ISC_INCLUDES} \
- 		@DST_OPENSSL_INC@
--CDEFINES =	@CRYPTO@ -DTESTS="\"${top_builddir}/lib/dns/tests/\""
-+CDEFINES =	@CRYPTO_PK11@ -DTESTS="\"${top_builddir}/lib/dns-pkcs11/tests/\""
+ @BIND9_MAKE_INCLUDES@
  
--ISCLIBS =	../../isc/libisc.@A@
+-CINCLUDES =	-I. -Iinclude ${DNS_INCLUDES} ${ISC_INCLUDES} \
++CINCLUDES =	-I. -Iinclude ${DNS_PKCS11_INCLUDES} ${ISC_PKCS11_INCLUDES} \
+ 		@OPENSSL_INCLUDES@ @CMOCKA_CFLAGS@
+-CDEFINES =	-DTESTS="\"${top_builddir}/lib/dns/tests/\""
++CDEFINES =	-DTESTS="\"${top_builddir}/lib/dns-pkcs11/tests/\""
+ 
+-ISCLIBS =	../../isc/libisc.@A@ @OPENSSL_LIBS@
 -ISCDEPLIBS =	../../isc/libisc.@A@
--DNSLIBS =	../libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
+-DNSLIBS =	../libdns.@A@ @DNS_CRYPTO_LIBS@
 -DNSDEPLIBS =	../libdns.@A@
 +ISCLIBS =	../../isc-pkcs11/libisc-pkcs11.@A@
 +ISCDEPLIBS =	../../isc-pkcs11/libisc-pkcs11.@A@
-+DNSLIBS =	../libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
++DNSLIBS =	../libdns-pkcs11.@A@ @DNS_CRYPTO_LIBS@
 +DNSDEPLIBS =	../libdns-pkcs11.@A@
  
  LIBS =		@LIBS@ @CMOCKA_LIBS@
- CFLAGS =	@CFLAGS@ @CMOCKA_CFLAGS@
+ 
 diff --git a/lib/dns-pkcs11/tests/dh_test.c b/lib/dns-pkcs11/tests/dh_test.c
-index 4dbfd82..a383b8e 100644
+index d83d9f5..d5bda29 100644
 --- a/lib/dns-pkcs11/tests/dh_test.c
 +++ b/lib/dns-pkcs11/tests/dh_test.c
-@@ -86,7 +86,8 @@ dh_computesecret(void **state) {
+@@ -85,7 +85,8 @@ dh_computesecret(void **state) {
  	result = dst_key_computesecret(key, key, &buf);
  	assert_int_equal(result, DST_R_NOTPRIVATEKEY);
  	result = key->func->computesecret(key, key, &buf);
@@ -79,114 +81,23 @@ index 4dbfd82..a383b8e 100644
  	dst_key_free(&key);
  }
 diff --git a/lib/isc-pkcs11/tests/Makefile.in b/lib/isc-pkcs11/tests/Makefile.in
-index 2fdee0b..a263b35 100644
+index 5735829..97b26c1 100644
 --- a/lib/isc-pkcs11/tests/Makefile.in
 +++ b/lib/isc-pkcs11/tests/Makefile.in
 @@ -16,10 +16,10 @@ VERSION=@BIND9_VERSION@
  @BIND9_MAKE_INCLUDES@
  
- CINCLUDES =	-I. -Iinclude ${ISC_INCLUDES} @ISC_OPENSSL_INC@
--CDEFINES =	@CRYPTO@ -DTESTS="\"${top_builddir}/lib/isc/tests/\""
-+CDEFINES =	@CRYPTO_PK11@ -DTESTS="\"${top_builddir}/lib/isc-pkcs11/tests/\""
+ CINCLUDES =	-I. -Iinclude ${ISC_INCLUDES} @OPENSSL_INCLUDES@ @CMOCKA_CFLAGS@
+-CDEFINES =	-DTESTS="\"${top_builddir}/lib/isc/tests/\""
++CDEFINES =	-DTESTS="\"${top_builddir}/lib/isc-pkcs11/tests/\""
  
--ISCLIBS =	../libisc.@A@ @ISC_OPENSSL_LIBS@
+-ISCLIBS =	../libisc.@A@ @OPENSSL_LIBS@
 -ISCDEPLIBS =	../libisc.@A@
 +ISCLIBS =	../libisc-pkcs11.@A@ @ISC_OPENSSL_LIBS@
 +ISCDEPLIBS =	../libisc-pkcs11.@A@
  
  LIBS =		@LIBS@ @CMOCKA_LIBS@
- CFLAGS =	@CFLAGS@ @CMOCKA_CFLAGS@
-diff --git a/lib/isc-pkcs11/tests/hash_test.c b/lib/isc-pkcs11/tests/hash_test.c
-index 9c4d299..d9deba2 100644
---- a/lib/isc-pkcs11/tests/hash_test.c
-+++ b/lib/isc-pkcs11/tests/hash_test.c
-@@ -85,7 +85,7 @@ typedef struct hash_testcase {
  
- typedef struct hash_test_key {
- 	const char *key;
--	const int len;
-+	const unsigned len;
- } hash_test_key_t;
- 
- /* non-hmac tests */
-@@ -956,8 +956,11 @@ isc_hmacsha1_test(void **state) {
- 	hash_test_key_t *test_key = test_keys;
- 
- 	while (testcase->input != NULL && testcase->result != NULL) {
-+		int len = ISC_MAX(test_key->len, ISC_SHA1_DIGESTLENGTH);
-+
-+		memset(buffer, 0, ISC_SHA1_DIGESTLENGTH);
- 		memmove(buffer, test_key->key, test_key->len);
--		isc_hmacsha1_init(&hmacsha1, buffer, test_key->len);
-+		isc_hmacsha1_init(&hmacsha1, buffer, len);
- 		isc_hmacsha1_update(&hmacsha1,
- 				    (const uint8_t *) testcase->input,
- 				    testcase->input_len);
-@@ -1116,8 +1119,11 @@ isc_hmacsha224_test(void **state) {
- 	hash_test_key_t *test_key = test_keys;
- 
- 	while (testcase->input != NULL && testcase->result != NULL) {
-+		int len = ISC_MAX(test_key->len, ISC_SHA224_DIGESTLENGTH);
-+
-+		memset(buffer, 0, ISC_SHA224_DIGESTLENGTH);
- 		memmove(buffer, test_key->key, test_key->len);
--		isc_hmacsha224_init(&hmacsha224, buffer, test_key->len);
-+		isc_hmacsha224_init(&hmacsha224, buffer, len);
- 		isc_hmacsha224_update(&hmacsha224,
- 				      (const uint8_t *) testcase->input,
- 				      testcase->input_len);
-@@ -1277,8 +1283,11 @@ isc_hmacsha256_test(void **state) {
- 	hash_test_key_t *test_key = test_keys;
- 
- 	while (testcase->input != NULL && testcase->result != NULL) {
-+		int len = ISC_MAX(test_key->len, ISC_SHA256_DIGESTLENGTH);
-+
-+		memset(buffer, 0, ISC_SHA256_DIGESTLENGTH);
- 		memmove(buffer, test_key->key, test_key->len);
--		isc_hmacsha256_init(&hmacsha256, buffer, test_key->len);
-+		isc_hmacsha256_init(&hmacsha256, buffer, len);
- 		isc_hmacsha256_update(&hmacsha256,
- 				      (const uint8_t *) testcase->input,
- 				      testcase->input_len);
-@@ -1444,8 +1453,11 @@ isc_hmacsha384_test(void **state) {
- 	hash_test_key_t *test_key = test_keys;
- 
- 	while (testcase->input != NULL && testcase->result != NULL) {
-+		int len = ISC_MAX(test_key->len, ISC_SHA384_DIGESTLENGTH);
-+
-+		memset(buffer, 0, ISC_SHA384_DIGESTLENGTH);
- 		memmove(buffer, test_key->key, test_key->len);
--		isc_hmacsha384_init(&hmacsha384, buffer, test_key->len);
-+		isc_hmacsha384_init(&hmacsha384, buffer, len);
- 		isc_hmacsha384_update(&hmacsha384,
- 				      (const uint8_t *) testcase->input,
- 				      testcase->input_len);
-@@ -1611,8 +1623,11 @@ isc_hmacsha512_test(void **state) {
- 	hash_test_key_t *test_key = test_keys;
- 
- 	while (testcase->input != NULL && testcase->result != NULL) {
-+		int len = ISC_MAX(test_key->len, ISC_SHA512_DIGESTLENGTH);
-+
-+		memset(buffer, 0, ISC_SHA512_DIGESTLENGTH);
- 		memmove(buffer, test_key->key, test_key->len);
--		isc_hmacsha512_init(&hmacsha512, buffer, test_key->len);
-+		isc_hmacsha512_init(&hmacsha512, buffer, len);
- 		isc_hmacsha512_update(&hmacsha512,
- 				      (const uint8_t *) testcase->input,
- 				      testcase->input_len);
-@@ -1755,8 +1770,11 @@ isc_hmacmd5_test(void **state) {
- 	hash_test_key_t *test_key = test_keys;
- 
- 	while (testcase->input != NULL && testcase->result != NULL) {
-+		int len = ISC_MAX(test_key->len, ISC_MD5_DIGESTLENGTH);
-+
-+		memset(buffer, 0, ISC_MD5_DIGESTLENGTH);
- 		memmove(buffer, test_key->key, test_key->len);
--		isc_hmacmd5_init(&hmacmd5, buffer, test_key->len);
-+		isc_hmacmd5_init(&hmacmd5, buffer, len);
- 		isc_hmacmd5_update(&hmacmd5,
- 				   (const uint8_t *) testcase->input,
- 				   testcase->input_len);
 -- 
 2.20.1
 
diff --git a/bind-9.11-tests-pkcs11.patch b/bind-9.11-tests-pkcs11.patch
index 79c55b2..cdba1b0 100644
--- a/bind-9.11-tests-pkcs11.patch
+++ b/bind-9.11-tests-pkcs11.patch
@@ -1,4 +1,4 @@
-From 66298a12b09784eab2c052ab22f87bb2b2f1267b Mon Sep 17 00:00:00 2001
+From 84fc64b556d5b5145eb7831393b856a26a818dc1 Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Fri, 1 Mar 2019 15:55:46 +0100
 Subject: [PATCH] Detect correctly pkcs11 support
@@ -23,17 +23,17 @@ index b974708..3bbef4c 100644
  
  $PK11DEL -w0 > /dev/null 2>&1
 diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
-index a446c18..ede1203 100644
+index e7831d8..aa2d841 100644
 --- a/bin/tests/system/conf.sh.in
 +++ b/bin/tests/system/conf.sh.in
-@@ -46,6 +46,7 @@ CHECKZONE=$TOP/bin/check/named-checkzone
- CHECKCONF=$TOP/bin/check/named-checkconf
+@@ -52,6 +52,7 @@ NSLOOKUP=$TOP/bin/dig/nslookup
+ NSUPDATE=$TOP/bin/nsupdate/nsupdate
+ NZD2NZF=$TOP/bin/tools/named-nzd2nzf
+ PK11DEL="$TOP/bin/pkcs11/pkcs11-destroy -s ${SLOT:-0} -p ${HSMPIN:-1234} -w 0"
++PK11DESTROY=$TOP/bin/pkcs11/pkcs11-destroy
  PK11GEN="$TOP/bin/pkcs11/pkcs11-keygen -q -s ${SLOT:-0} -p ${HSMPIN:-1234}"
  PK11LIST="$TOP/bin/pkcs11/pkcs11-list -s ${SLOT:-0} -p ${HSMPIN:-1234}"
-+PK11DESTROY=$TOP/bin/pkcs11/pkcs11-destroy
- PK11DEL="$TOP/bin/pkcs11/pkcs11-destroy -s ${SLOT:-0} -p ${HSMPIN:-1234} -w 0"
- JOURNALPRINT=$TOP/bin/tools/named-journalprint
- VERIFY=$TOP/bin/dnssec/dnssec-verify
+ RESOLVE=$TOP/lib/samples/resolve
 -- 
 2.20.1
 
diff --git a/bind-9.11-tests-variants.patch b/bind-9.11-tests-variants.patch
index d983671..275f3cb 100644
--- a/bind-9.11-tests-variants.patch
+++ b/bind-9.11-tests-variants.patch
@@ -1,4 +1,4 @@
-From 06a22ff20ac3d68fa1f995c91068b43392425e43 Mon Sep 17 00:00:00 2001
+From e706bb1dccf0b3492664c591f99f698a2a40fce7 Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Fri, 1 Mar 2019 15:48:20 +0100
 Subject: [PATCH] Make alternative named builds testable in system tests
@@ -13,53 +13,52 @@ export NAMED_VARIANT=-sdb DNSSEC_VARIANT=
 For pkcs variant use:
 export NAMED_VARIANT=-pkcs11 DNSSEC_VARIANT=-pkcs11
 ---
- bin/tests/system/conf.sh.in | 19 ++++++++++---------
- 1 file changed, 10 insertions(+), 9 deletions(-)
+ bin/tests/system/conf.sh.in | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
 
 diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
-index 4b0fe39..f135af6 100644
+index 0f4ead0..e7831d8 100644
 --- a/bin/tests/system/conf.sh.in
 +++ b/bin/tests/system/conf.sh.in
-@@ -34,7 +34,7 @@ DISABLED_ALGORITHM=ECDSAP384SHA384
- DISABLED_ALGORITHM_NUMBER=14
- DISABLED_BITS=384
- 
+@@ -37,16 +37,16 @@ DDNSCONFGEN=$TOP/bin/confgen/ddns-confgen
+ DELV=$TOP/bin/delv/delv
+ DIG=$TOP/bin/dig/dig
+ DNSTAPREAD=$TOP/bin/tools/dnstap-read
+-DSFROMKEY=$TOP/bin/dnssec/dnssec-dsfromkey
+-FEATURETEST=$TOP/bin/named/feature-test
++DSFROMKEY=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-dsfromkey${DNSSEC_VARIANT}
++FEATURETEST=$TOP/bin/named${NAMED_VARIANT}/feature-test${NAMED_VARIANT}
+ FSTRM_CAPTURE=@FSTRM_CAPTURE@
+-IMPORTKEY=$TOP/bin/dnssec/dnssec-importkey
++IMPORTKEY=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-importkey${DNSSEC_VARIANT}
+ JOURNALPRINT=$TOP/bin/tools/named-journalprint
+-KEYFRLAB=$TOP/bin/dnssec/dnssec-keyfromlabel
+-KEYGEN=$TOP/bin/dnssec/dnssec-keygen
++KEYFRLAB=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-keyfromlabel${DNSSEC_VARIANT}
++KEYGEN=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-keygen${DNSSEC_VARIANT}
+ KEYMGR=$TOP/bin/python/dnssec-keymgr
+ MDIG=$TOP/bin/tools/mdig
 -NAMED=$TOP/bin/named/named
 +NAMED=$TOP/bin/named${NAMED_VARIANT}/named${NAMED_VARIANT}
- # We must use "named -l" instead of "lwresd" because argv[0] is lost
- # if the program is libtoolized.
- LWRESD="$TOP/bin/named/named -l"
-@@ -45,13 +45,14 @@ NSUPDATE=$TOP/bin/nsupdate/nsupdate
- DDNSCONFGEN=$TOP/bin/confgen/ddns-confgen
- TSIGKEYGEN=$TOP/bin/confgen/tsig-keygen
- RNDCCONFGEN=$TOP/bin/confgen/rndc-confgen
--KEYGEN=$TOP/bin/dnssec/dnssec-keygen
--KEYFRLAB=$TOP/bin/dnssec/dnssec-keyfromlabel
--SIGNER=$TOP/bin/dnssec/dnssec-signzone
+ NSEC3HASH=$TOP/bin/tools/nsec3hash
+ NSLOOKUP=$TOP/bin/dig/nslookup
+ NSUPDATE=$TOP/bin/nsupdate/nsupdate
+@@ -55,12 +55,12 @@ PK11DEL="$TOP/bin/pkcs11/pkcs11-destroy -s ${SLOT:-0} -p ${HSMPIN:-1234} -w 0"
+ PK11GEN="$TOP/bin/pkcs11/pkcs11-keygen -q -s ${SLOT:-0} -p ${HSMPIN:-1234}"
+ PK11LIST="$TOP/bin/pkcs11/pkcs11-list -s ${SLOT:-0} -p ${HSMPIN:-1234}"
+ RESOLVE=$TOP/lib/samples/resolve
 -REVOKE=$TOP/bin/dnssec/dnssec-revoke
--SETTIME=$TOP/bin/dnssec/dnssec-settime
--DSFROMKEY=$TOP/bin/dnssec/dnssec-dsfromkey
--IMPORTKEY=$TOP/bin/dnssec/dnssec-importkey
-+KEYGEN=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-keygen${DNSSEC_VARIANT}
-+KEYFRLAB=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-keyfromlabel${DNSSEC_VARIANT}
-+SIGNER=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-signzone${DNSSEC_VARIANT}
 +REVOKE=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-revoke${DNSSEC_VARIANT}
+ RNDC=$TOP/bin/rndc/rndc
+ RNDCCONFGEN=$TOP/bin/confgen/rndc-confgen
+ RRCHECKER=$TOP/bin/tools/named-rrchecker
+-SETTIME=$TOP/bin/dnssec/dnssec-settime
+-SIGNER=$TOP/bin/dnssec/dnssec-signzone
 +SETTIME=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-settime${DNSSEC_VARIANT}
-+DSFROMKEY=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-dsfromkey${DNSSEC_VARIANT}
-+IMPORTKEY=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-importkey${DNSSEC_VARIANT}
-+CHECKDS=$TOP/bin/python/dnssec-checkds
- CHECKDS=$TOP/bin/python/dnssec-checkds
- COVERAGE=$TOP/bin/python/dnssec-coverage
- KEYMGR=$TOP/bin/python/dnssec-keymgr
-@@ -71,7 +72,7 @@ DNSTAPREAD=$TOP/bin/tools/dnstap-read
- MDIG=$TOP/bin/tools/mdig
- NZD2NZF=$TOP/bin/tools/named-nzd2nzf
- FSTRM_CAPTURE=@FSTRM_CAPTURE@
--FEATURETEST=$TOP/bin/named/feature-test
-+FEATURETEST=$TOP/bin/named${NAMED_VARIANT}/feature-test${NAMED_VARIANT}
- 
- RANDFILE=$TOP/bin/tests/system/random.data
- 
++SIGNER=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-signzone${DNSSEC_VARIANT}
+ TSIGKEYGEN=$TOP/bin/confgen/tsig-keygen
+ VERIFY=$TOP/bin/dnssec/dnssec-verify
+ WIRETEST=$TOP/bin/tests/wire_test
 -- 
 2.20.1
 
diff --git a/bind.spec b/bind.spec
index c35e15d..1e83ecd 100644
--- a/bind.spec
+++ b/bind.spec
@@ -10,7 +10,9 @@
 # bcond_without is built by default, unless --without X is passed
 # bcond_with is built only when --with X is passed to build
 %bcond_with    SYSTEMTEST
-%bcond_without SDB
+# TODO: sdb tools from contrib were removed.
+# Disable SDB for now
+%bcond_with SDB
 %bcond_without GSSTSIG
 # it is not possible to build the package without PKCS11 sub-package
 # due to extensive changes to Makefiles
@@ -55,10 +57,10 @@
 #
 
 # lib*.so.X versions of selected libraries
-%global sover_dns 1107
-%global sover_isc 1104
-%global sover_irs 161
-%global sover_isccfg 163
+%global sover_dns 1306
+%global sover_isc 1306
+%global sover_irs 1301
+%global sover_isccfg 1302
 
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
@@ -106,7 +108,6 @@ Source46: named-setup-rndc.service
 Source47: named-pkcs11.service
 Source48: setup-named-softhsm.sh
 Source49: named-chroot.files
-Source50: random.data
 
 # Common patches
 Patch10: bind-9.5-PIE.patch
@@ -118,7 +119,7 @@ Patch112:bind97-rh645544.patch
 Patch130:bind-9.9.1-P2-dlz-libdb.patch
 Patch131:bind-9.9.1-P2-multlib-conflict.patch
 Patch133:bind99-rh640538.patch
-Patch134:bind97-rh669163.patch
+#Patch134:bind97-rh669163.patch # lwres discontinued
 # Fedora specific patch to distribute native-pkcs#11 functionality
 Patch136:bind-9.10-dist-native-pkcs11.patch
 
@@ -153,10 +154,12 @@ Patch164:bind-9.11-rh1666814.patch
 # random_test fails too often by random, disable it
 # not present on 9.14.0
 Patch168:bind-9.11-unit-disable-random.patch
+#Patch169:bind-9.11-feature-test-dlz.patch
 Patch170:bind-9.11-feature-test-named.patch
 Patch171:bind-9.11-tests-variants.patch
 Patch172:bind-9.11-tests-pkcs11.patch
 Patch173:bind-9.11-rh1732883.patch
+#Patch174: bind-9.11-unit-timer-nothread.patch
 # Make sure jsonccp-devel does not interfere
 Patch174:bind-9.11-json-c.patch
 Patch175:bind-9.11-fips-disable.patch
@@ -556,10 +559,12 @@ are used for building ISC DHCP.
 #%patch163 -p1 -b .rh1663318
 %patch164 -p1 -b .rh1666814
 %patch168 -p1 -b .random_test-disable
+#%patch169 -p1 -b .featuretest-dlz
 %patch170 -p1 -b .featuretest-named
 %patch171 -p1 -b .test-variant
 %patch172 -p1 -b .test-pkcs11
 %patch173 -p1 -b .rh1732883
+#%patch174 -p1 -b .unit-timer
 %patch174 -p1 -b .json-c
 %patch175 -p1 -b .rh1709553
 %patch177 -p1 -b .serve-stale
@@ -570,9 +575,6 @@ are used for building ISC DHCP.
 %patch186 -p1 -b .rh1736762-8
 %patch187 -p1 -b .oot-gen
 
-mkdir lib/dns/tests/testdata/dstrandom
-cp -a %{SOURCE50} lib/dns/tests/testdata/dstrandom/random.data
-
 %if %{with PKCS11}
 cp -r bin/named{,-pkcs11}
 cp -r bin/dnssec{,-pkcs11}
@@ -612,7 +614,7 @@ cp -fp contrib/sdb/sqlite/zone2sqlite.c bin/sdb_tools
 %endif
 
 %patch133 -p1 -b .rh640538
-%patch134 -p1 -b .rh669163
+#%patch134 -p1 -b .rh669163
 
 # Sparc and s390 arches need to use -fPIE
 %ifarch sparcv9 sparc64 s390 s390x
@@ -669,15 +671,11 @@ export LIBDIR_SUFFIX
   --with-python=%{__python3} \
   --with-libtool \
   --localstatedir=/var \
-  --enable-threads \
-  --enable-ipv6 \
-  --enable-filter-aaaa \
   --with-pic \
   --disable-static \
   --includedir=%{_includedir}/bind9 \
   --with-tuning=large \
   --with-libidn2 \
-  --enable-openssl-hash \
 %if %{with GEOIP}
   --with-geoip \
 %endif
@@ -785,7 +783,6 @@ export LIBDIR_SUFFIX
         --libdir=%{_libdir}%{_export_dir} \
         --includedir=%{_includedir}%{_export_dir}/ \
         --disable-threads \
-        --enable-openssl-hash \
 %if %{with GSSTSIG}
         --with-gssapi=yes \
         --disable-isc-spnego \
@@ -1341,9 +1338,9 @@ fi;
 %endif
 
 %files libs
-%{_libdir}/libbind9.so.161*
-%{_libdir}/libisccc.so.161*
-%{_libdir}/liblwres.so.161*
+%{_libdir}/libbind9.so.1302*
+%{_libdir}/libisccc.so.1302*
+%{_libdir}/libns.so.1304*
 
 %files libs-lite
 %{_libdir}/libdns.so.%{sover_dns}*
@@ -1408,7 +1405,7 @@ fi;
 %{_includedir}/bind9/config.h
 %{_includedir}/bind9/bind9
 %{_includedir}/bind9/isccc
-%{_includedir}/bind9/lwres
+%{_includedir}/bind9/ns
 %{_mandir}/man1/isc-config.sh.1*
 %{_mandir}/man1/bind9-config.1*
 %{_mandir}/man3/lwres*
@@ -1569,7 +1566,9 @@ fi;
 
 %if %{with DLZ} && %{with BDB}
 %files dlz-bdb
+%if %{with SDB}
 %{_sbindir}/dlzbdb
+%endif
 %{_libdir}/bind/dlz_bdbhpt_dynamic.so
 %doc contrib/dlz/modules/bdbhpt/testing/*
 %doc contrib/dlz/modules/bdbhpt/README*