.bind.metadata

@@ -1,2 +1 @@
-4b45d15edc1e3b7902129ce27baec58a50d76b5c SOURCES/bind-9.11.36.tar.gz
-a164fcad1d64d6b5fab5034928cb7260f1fa8fdd SOURCES/random.data
+30cbd1f3e9d2d47d653498143334128aac1f8fc0 SOURCES/bind-9.16.23.tar.xz

.gitignore

@@ -1,2 +1 @@
-SOURCES/bind-9.11.36.tar.gz
-SOURCES/random.data
+SOURCES/bind-9.16.23.tar.xz

SOURCES/README.sdb_pgsql

@@ -1,79 +0,0 @@
-			PGSQL BIND SDB driver
-
-The postgresql BIND SDB driver is of experimental status and should not be 
-used for production systems.
-
-Usage:
-
-o Use the named_sdb process ( put ENABLE_SDB=yes in /etc/sysconfig/named )
-
-o Edit your named.conf to contain a database zone, eg. :
-  
-zone "pgdb.net." IN {
-        type master;
-        database "pgsql  bind        pgdb     localhost pguser pgpasswd";
-        #                ^- DB name  ^-Table  ^-host    ^-user ^-password
-};
-
-o Create the database zone table
-  The table must contain the columns "name", "rdtype", and "rdata", and
-  is expected to contain a properly constructed zone.  The program "zonetodb"
-  creates such a table.
-  
-  zonetodb usage:
-    
-    zonetodb origin file dbname dbtable
-
-    where
-	origin : zone origin, eg "pgdb.net."
-	file   : master zone database file, eg. pgdb.net.db
-	dbname : name of postgresql database 
-        dbtable: name of table in database
-
-    Eg. to import this zone in the file 'pgdb.net.db' into the 'bind' database 
-        'pgdb' table:
-
----
-#pgdb.net.db:
-$TTL 1H
-@       SOA     localhost.      root.localhost. (       1
-                                                3H
-                                                1H
-                                                1W
-                                                1H )
-        NS      localhost.
-host1   A       192.168.2.1
-host2   A       192.168.2.2
-host3   A       192.168.2.3
-host4   A       192.168.2.4
-host5   A       192.168.2.5
-host6   A       192.168.2.6
-host7   A       192.168.2.7
----
-
-Issue this command as the pgsql user authorized to update the bind database:
- 
-# zonetodb pgdb.net. pgdb.net.db bind pgdb
-
-will create / update the pgdb table in the 'bind' db:
-
-$ psql -dbind -c 'select * from pgdb;'
-      name      | ttl  | rdtype |                        rdata
-----------------+------+--------+-----------------------------------------------------
- pgdb.net       | 3600 | SOA    | localhost. root.localhost. 1 10800 3600 604800 3600
- pgdb.net       | 3600 | NS     | localhost.
- host1.pgdb.net | 3600 | A      | 192.168.2.1
- host2.pgdb.net | 3600 | A      | 192.168.2.2
- host3.pgdb.net | 3600 | A      | 192.168.2.3
- host4.pgdb.net | 3600 | A      | 192.168.2.4
- host5.pgdb.net | 3600 | A      | 192.168.2.5
- host6.pgdb.net | 3600 | A      | 192.168.2.6
- host7.pgdb.net | 3600 | A      | 192.168.2.7
-(9 rows)
-
-I've tested exactly the above configuration with bind-sdb-9.3.1+ and it works OK.
-
-NOTE: If you use pgsqldb SDB, ensure the postgresql service is started before the named
-      service .
-
-USE AT YOUR OWN RISK!

SOURCES/bind-9.10-dist-native-pkcs11.patch

@@ -1,68 +1,107 @@
+From 040227009453b3f0aa7914c7a6a94dc57ad5269b Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Thu, 21 Jan 2021 10:46:20 +0100
+Subject: [PATCH] Enable custom pkcs11 native build
+
+Share common parts like libisc, libcc and others. But provide native
+pkcs11 libraries as a new copy of libdns and libns.
+---
+ bin/Makefile.in                  |  2 +-
+ bin/confgen/Makefile.in          |  2 +-
+ bin/dnssec-pkcs11/Makefile.in    | 39 +++++++++++++++++---------------
+ bin/named-pkcs11/Makefile.in     | 33 ++++++++++++++-------------
+ configure.ac                     | 19 ++++++++++++++++
+ lib/Makefile.in                  |  2 +-
+ lib/dns-pkcs11/Makefile.in       | 22 +++++++++---------
+ lib/dns-pkcs11/tests/Makefile.in |  8 +++----
+ lib/ns-pkcs11/Makefile.in        | 26 ++++++++++-----------
+ lib/ns-pkcs11/tests/Makefile.in  | 12 +++++-----
+ make/includes.in                 |  7 ++++++
+ 11 files changed, 101 insertions(+), 71 deletions(-)
+
 diff --git a/bin/Makefile.in b/bin/Makefile.in
-index a18b222..26a7e4e 100644
+index 9ad7f62..094775a 100644
 --- a/bin/Makefile.in
 +++ b/bin/Makefile.in
-@@ -11,8 +11,8 @@ srcdir =	@srcdir@
+@@ -11,7 +11,7 @@ srcdir =	@srcdir@
  VPATH =		@srcdir@
  top_srcdir =	@top_srcdir@
  
 -SUBDIRS =	named rndc dig delv dnssec tools nsupdate check confgen \
--		@NZD_TOOLS@ @PYTHON_TOOLS@ @PKCS11_TOOLS@ tests
-+SUBDIRS =	named named-pkcs11 rndc dig delv dnssec dnssec-pkcs11 tools nsupdate \
-+		check confgen @NZD_TOOLS@ @PYTHON_TOOLS@ @PKCS11_TOOLS@ tests
++SUBDIRS =	named named-pkcs11 rndc dig delv dnssec dnssec-pkcs11 tools nsupdate check confgen \
+ 		@NZD_TOOLS@ @PYTHON_TOOLS@ @PKCS11_TOOLS@ plugins tests
  TARGETS =
  
- @BIND9_MAKE_RULES@
+diff --git a/bin/confgen/Makefile.in b/bin/confgen/Makefile.in
+index c126bf3..1b7512d 100644
+--- a/bin/confgen/Makefile.in
++++ b/bin/confgen/Makefile.in
+@@ -22,7 +22,7 @@ VERSION=@BIND9_VERSION@
+ CINCLUDES = -I${srcdir}/include ${ISC_INCLUDES} ${ISCCC_INCLUDES} \
+ 	${ISCCFG_INCLUDES} ${DNS_INCLUDES} ${BIND9_INCLUDES}
+ 
+-CDEFINES = @USE_PKCS11@
++CDEFINES =
+ CWARNINGS =
+ 
+ ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
 diff --git a/bin/dnssec-pkcs11/Makefile.in b/bin/dnssec-pkcs11/Makefile.in
-index 390aa0c..e59a118 100644
+index ace0e5a..e0f6a00 100644
 --- a/bin/dnssec-pkcs11/Makefile.in
 +++ b/bin/dnssec-pkcs11/Makefile.in
 @@ -15,18 +15,18 @@ VERSION=@BIND9_VERSION@
  
  @BIND9_MAKE_INCLUDES@
  
--CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} @DST_OPENSSL_INC@
-+CINCLUDES =	${DNS_PKCS11_INCLUDES} ${ISC_PKCS11_INCLUDES}
+-CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} ${ISCCFG_INCLUDES} \
++CINCLUDES =	${DNS_PKCS11_INCLUDES} ${ISC_INCLUDES} ${ISCCFG_INCLUDES} \
+ 		${OPENSSL_CFLAGS}
  
--CDEFINES =	-DVERSION=\"${VERSION}\" @USE_PKCS11@ @PKCS11_ENGINE@ \
--		@CRYPTO@ -DPK11_LIB_LOCATION=\"@PKCS11_PROVIDER@\"
-+CDEFINES =	-DVERSION=\"${VERSION}\" @PKCS11_ENGINE@ \
-+		@CRYPTO_PK11@ -DPK11_LIB_LOCATION=\"@PKCS11_PROVIDER@\"
+-CDEFINES =	-DVERSION=\"${VERSION}\" -DNAMED_CONFFILE=\"${sysconfdir}/named.conf\"
++CDEFINES =	-DVERSION=\"${VERSION}\" -DNAMED_CONFFILE=\"${sysconfdir}/named.conf\" -DUSE_PKCS11=1
  CWARNINGS =
  
--DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
--ISCLIBS =	../../lib/isc/libisc.@A@
--ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@
-+DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
-+ISCLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
-+ISCNOSYMLIBS =	../../lib/isc-pkcs11/libisc-pkcs11-nosymtbl.@A@
+-DNSLIBS =	../../lib/dns/libdns.@A@ @NO_LIBTOOL_DNSLIBS@
++DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ @NO_LIBTOOL_DNSLIBS@
+ ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
+ ISCLIBS =	../../lib/isc/libisc.@A@ @NO_LIBTOOL_ISCLIBS@
+ ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @NO_LIBTOOL_ISCLIBS@
  
 -DNSDEPLIBS =	../../lib/dns/libdns.@A@
--ISCDEPLIBS =	../../lib/isc/libisc.@A@
 +DNSDEPLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@
-+ISCDEPLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
+ ISCDEPLIBS =	../../lib/isc/libisc.@A@
+ ISCCFGDEPLIBS =	../../lib/isccfg/libisccfg.@A@
  
- DEPLIBS =	${DNSDEPLIBS} ${ISCDEPLIBS}
+@@ -36,12 +36,15 @@ LIBS =		${DNSLIBS} ${ISCCFGLIBS} ${ISCLIBS} @LIBS@
  
-@@ -35,10 +35,10 @@ LIBS =		${DNSLIBS} ${ISCLIBS} @LIBS@
- NOSYMLIBS =	${DNSLIBS} ${ISCNOSYMLIBS} @LIBS@
+ NOSYMLIBS =	${DNSLIBS} ${ISCCFGLIBS} ${ISCNOSYMLIBS} @LIBS@
  
++# Add suffix to all targets
++EXEEXT =	-pkcs11@EXEEXT@
++
  # Alphabetically
--TARGETS =	dnssec-keygen@EXEEXT@ dnssec-signzone@EXEEXT@ \
--		dnssec-keyfromlabel@EXEEXT@ dnssec-dsfromkey@EXEEXT@ \
--		dnssec-revoke@EXEEXT@ dnssec-settime@EXEEXT@ \
--		dnssec-verify@EXEEXT@ dnssec-importkey@EXEEXT@
-+TARGETS =	dnssec-keygen-pkcs11@EXEEXT@ dnssec-signzone-pkcs11@EXEEXT@ \
-+		dnssec-keyfromlabel-pkcs11@EXEEXT@ dnssec-dsfromkey-pkcs11@EXEEXT@ \
-+		dnssec-revoke-pkcs11@EXEEXT@ dnssec-settime-pkcs11@EXEEXT@ \
-+		dnssec-verify-pkcs11@EXEEXT@ dnssec-importkey-pkcs11@EXEEXT@
+-TARGETS =	dnssec-cds@EXEEXT@ dnssec-dsfromkey@EXEEXT@ \
+-		dnssec-importkey@EXEEXT@ dnssec-keyfromlabel@EXEEXT@ \
+-		dnssec-keygen@EXEEXT@ dnssec-revoke@EXEEXT@ \
+-		dnssec-settime@EXEEXT@ dnssec-signzone@EXEEXT@ \
+-		dnssec-verify@EXEEXT@
++TARGETS =	dnssec-cds${EXEEXT} dnssec-dsfromkey${EXEEXT} \
++		dnssec-importkey${EXEEXT} dnssec-keyfromlabel${EXEEXT} \
++		dnssec-keygen${EXEEXT} dnssec-revoke${EXEEXT} \
++		dnssec-settime${EXEEXT} dnssec-signzone${EXEEXT} \
++		dnssec-verify${EXEEXT}
  
  OBJS =		dnssectool.@O@
  
-@@ -59,15 +59,15 @@ MANOBJS =	${MANPAGES} ${HTMLPAGES}
+@@ -52,19 +55,19 @@ SRCS =		dnssec-cds.c dnssec-dsfromkey.c dnssec-importkey.c \
  
  @BIND9_MAKE_RULES@
  
+-dnssec-cds@EXEEXT@: dnssec-cds.@O@ ${OBJS} ${DEPLIBS}
++dnssec-cds-pkcs11@EXEEXT@: dnssec-cds.@O@ ${OBJS} ${DEPLIBS}
+ 	export BASEOBJS="dnssec-cds.@O@ ${OBJS}"; \
+ 	${FINALBUILDCMD}
+ 
 -dnssec-dsfromkey@EXEEXT@: dnssec-dsfromkey.@O@ ${OBJS} ${DEPLIBS}
 +dnssec-dsfromkey-pkcs11@EXEEXT@: dnssec-dsfromkey.@O@ ${OBJS} ${DEPLIBS}
  	export BASEOBJS="dnssec-dsfromkey.@O@ ${OBJS}"; \
@@ -78,7 +117,7 @@ index 390aa0c..e59a118 100644
  	export BASEOBJS="dnssec-keygen.@O@ ${OBJS}"; \
  	${FINALBUILDCMD}
  
-@@ -75,7 +75,7 @@ dnssec-signzone.@O@: dnssec-signzone.c
+@@ -72,7 +75,7 @@ dnssec-signzone.@O@: dnssec-signzone.c
  	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} -DVERSION=\"${VERSION}\" \
  		-c ${srcdir}/dnssec-signzone.c
  
@@ -87,7 +126,7 @@ index 390aa0c..e59a118 100644
  	export BASEOBJS="dnssec-signzone.@O@ ${OBJS}"; \
  	${FINALBUILDCMD}
  
-@@ -83,19 +83,19 @@ dnssec-verify.@O@: dnssec-verify.c
+@@ -80,19 +83,19 @@ dnssec-verify.@O@: dnssec-verify.c
  	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} -DVERSION=\"${VERSION}\" \
  		-c ${srcdir}/dnssec-verify.c
  
@@ -111,117 +150,70 @@ index 390aa0c..e59a118 100644
  	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \
  	dnssec-importkey.@O@ ${OBJS} ${LIBS}
  
-@@ -106,16 +106,14 @@ docclean manclean maintainer-clean::
- 
- installdirs:
- 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
--	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
- 
- install-man8: ${MANPAGES}
- 	${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man8
- 
--install:: ${TARGETS} installdirs install-man8
-+install:: ${TARGETS} installdirs
- 	for t in ${TARGETS}; do ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} $$t ${DESTDIR}${sbindir} || exit 1; done
- 
- uninstall::
--	for m in ${MANPAGES}; do rm -f ${DESTDIR}${mandir}/man8/$$m || exit 1; done
- 	for t in ${TARGETS}; do ${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/$$t || exit 1; done
- 
- clean distclean::
-diff --git a/bin/dnssec/Makefile.in b/bin/dnssec/Makefile.in
-index 390aa0c..851a008 100644
---- a/bin/dnssec/Makefile.in
-+++ b/bin/dnssec/Makefile.in
-@@ -17,7 +17,7 @@ VERSION=@BIND9_VERSION@
- 
- CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} @DST_OPENSSL_INC@
- 
--CDEFINES =	-DVERSION=\"${VERSION}\" @USE_PKCS11@ @PKCS11_ENGINE@ \
-+CDEFINES =	-DVERSION=\"${VERSION}\" \
- 		@CRYPTO@ -DPK11_LIB_LOCATION=\"@PKCS11_PROVIDER@\"
- CWARNINGS =
- 
 diff --git a/bin/named-pkcs11/Makefile.in b/bin/named-pkcs11/Makefile.in
-index 277a0f5..52a6375 100644
+index 98125dd..518a75f 100644
 --- a/bin/named-pkcs11/Makefile.in
 +++ b/bin/named-pkcs11/Makefile.in
-@@ -43,27 +43,27 @@ DLZDRIVER_INCLUDES =	@DLZ_DRIVER_INCLUDES@
- DLZDRIVER_LIBS =	@DLZ_DRIVER_LIBS@
+@@ -37,13 +37,14 @@ DBDRIVER_LIBS =
  
- CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
--		${LWRES_INCLUDES} ${DNS_INCLUDES} ${BIND9_INCLUDES} \
--		${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} ${ISC_INCLUDES} \
-+		${LWRES_INCLUDES} ${DNS_PKCS11_INCLUDES} ${BIND9_INCLUDES} \
-+		${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} ${ISC_PKCS11_INCLUDES} \
- 		${DLZDRIVER_INCLUDES} ${DBDRIVER_INCLUDES} ${MAXMINDDB_CFLAGS} \
- 		@DST_OPENSSL_INC@
+ DLZ_DRIVER_DIR =	${top_srcdir}/contrib/dlz/drivers
+ 
+-DLZDRIVER_OBJS =	@DLZ_DRIVER_OBJS@
+-DLZDRIVER_SRCS =	@DLZ_DRIVER_SRCS@
+-DLZDRIVER_INCLUDES =	@DLZ_DRIVER_INCLUDES@
+-DLZDRIVER_LIBS =	@DLZ_DRIVER_LIBS@
++# Skip building on PKCS11 variant
++DLZDRIVER_OBJS =
++DLZDRIVER_SRCS =
++DLZDRIVER_INCLUDES =
++DLZDRIVER_LIBS =
  
--CDEFINES =      @CONTRIB_DLZ@ @USE_PKCS11@ @PKCS11_ENGINE@ @CRYPTO@
-+CDEFINES =      @USE_PKCS11@ @PKCS11_ENGINE@ @CRYPTO_PK11@ @USE_GSSAPI@
+ CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
+-		${NS_INCLUDES} ${DNS_INCLUDES} \
++		${NS_PKCS11_INCLUDES} ${DNS_PKCS11_INCLUDES} \
+ 		${BIND9_INCLUDES} ${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} \
+ 		${ISC_INCLUDES} ${DLZDRIVER_INCLUDES} \
+ 		${DBDRIVER_INCLUDES} \
+@@ -56,24 +57,24 @@ CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
+ 		${LIBXML2_CFLAGS} \
+ 		${MAXMINDDB_CFLAGS}
+ 
+-CDEFINES =      @CONTRIB_DLZ@
++CDEFINES =
  
  CWARNINGS =
  
--DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
-+DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
+-DNSLIBS =	../../lib/dns/libdns.@A@ @NO_LIBTOOL_DNSLIBS@
++DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ @NO_LIBTOOL_DNSLIBS@
  ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
  ISCCCLIBS =	../../lib/isccc/libisccc.@A@
--ISCLIBS =	../../lib/isc/libisc.@A@
--ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@
-+ISCLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
-+ISCNOSYMLIBS =	../../lib/isc-pkcs11/libisc-pkcs11-nosymtbl.@A@
- LWRESLIBS =	../../lib/lwres/liblwres.@A@
+ ISCLIBS =	../../lib/isc/libisc.@A@ @NO_LIBTOOL_ISCLIBS@
+ ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @NO_LIBTOOL_ISCLIBS@
  BIND9LIBS =	../../lib/bind9/libbind9.@A@
+-NSLIBS =	../../lib/ns/libns.@A@
++NSLIBS =	../../lib/ns-pkcs11/libns-pkcs11.@A@
  
 -DNSDEPLIBS =	../../lib/dns/libdns.@A@
 +DNSDEPLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@
  ISCCFGDEPLIBS =	../../lib/isccfg/libisccfg.@A@
  ISCCCDEPLIBS =	../../lib/isccc/libisccc.@A@
--ISCDEPLIBS =	../../lib/isc/libisc.@A@
-+ISCDEPLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
- LWRESDEPLIBS =	../../lib/lwres/liblwres.@A@
+ ISCDEPLIBS =	../../lib/isc/libisc.@A@
  BIND9DEPLIBS =	../../lib/bind9/libbind9.@A@
+-NSDEPLIBS =	../../lib/ns/libns.@A@
++NSDEPLIBS =	../../lib/ns-pkcs11/libns-pkcs11.@A@
  
-@@ -72,15 +72,15 @@ DEPLIBS =	${LWRESDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
- 
- LIBS =		${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
- 		${ISCCFGLIBS} ${ISCCCLIBS} ${ISCLIBS} \
--		${DLZDRIVER_LIBS} ${DBDRIVER_LIBS} @LIBS@
-+		@LIBS@
- 
- NOSYMLIBS =	${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
- 		${ISCCFGLIBS} ${ISCCCLIBS} ${ISCNOSYMLIBS} \
--		${DLZDRIVER_LIBS} ${DBDRIVER_LIBS} @LIBS@
-+		@LIBS@
+ DEPLIBS =	${NSDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
+ 		${ISCCFGDEPLIBS} ${ISCCCDEPLIBS} ${ISCDEPLIBS}
+@@ -93,7 +94,7 @@ NOSYMLIBS =	${NSLIBS} ${DNSLIBS} ${BIND9LIBS} \
  
  SUBDIRS =	unix
  
--TARGETS =	named@EXEEXT@ lwresd@EXEEXT@
-+TARGETS =	named-pkcs11@EXEEXT@
+-TARGETS =	named@EXEEXT@ feature-test@EXEEXT@
++TARGETS =	named-pkcs11@EXEEXT@ feature-test-pkcs11@EXEEXT@
  
- GEOIPLINKOBJS = geoip.@O@
  GEOIP2LINKOBJS = geoip.@O@
-@@ -94,8 +94,7 @@ OBJS =		builtin.@O@ client.@O@ config.@O@ control.@O@ \
- 		tkeyconf.@O@ tsigconf.@O@ update.@O@ xfrout.@O@ \
- 		zoneconf.@O@ \
- 		lwaddr.@O@ lwresd.@O@ lwdclient.@O@ lwderror.@O@ lwdgabn.@O@ \
--		lwdgnba.@O@ lwdgrbn.@O@ lwdnoop.@O@ lwsearch.@O@ \
--		${DLZDRIVER_OBJS} ${DBDRIVER_OBJS}
-+        lwdgnba.@O@ lwdgrbn.@O@ lwdnoop.@O@ lwsearch.@O@
- 
- UOBJS =		unix/os.@O@ unix/dlz_dlopen_driver.@O@
- 
-@@ -113,8 +112,7 @@ SRCS =		builtin.c client.c config.c control.c \
- 		tkeyconf.c tsigconf.c update.c xfrout.c \
- 		zoneconf.c \
- 		lwaddr.c lwresd.c lwdclient.c lwderror.c lwdgabn.c \
--		lwdgnba.c lwdgrbn.c lwdnoop.c lwsearch.c \
--		${DLZDRIVER_SRCS} ${DBDRIVER_SRCS}
-+        lwdgnba.c lwdgrbn.c lwdnoop.c lwsearch.c
- 
- MANPAGES =	named.8 lwresd.8 named.conf.5
- 
-@@ -154,14 +152,14 @@ server.@O@: server.c
+ 
+@@ -151,7 +152,7 @@ server.@O@: server.c
  		-DPRODUCT=\"${PRODUCT}\" \
  		-DVERSION=\"${VERSION}\" -c ${srcdir}/server.c
  
@@ -230,77 +222,38 @@ index 277a0f5..52a6375 100644
  	export MAKE_SYMTABLE="yes"; \
  	export BASEOBJS="${OBJS} ${UOBJS}"; \
  	${FINALBUILDCMD}
+@@ -161,7 +162,7 @@ feature-test.@O@: ${top_srcdir}/bin/tests/system/feature-test.c
+ 	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} \
+ 		-c ${top_srcdir}/bin/tests/system/feature-test.c
  
--lwresd@EXEEXT@: named@EXEEXT@
-+lwresd@EXEEXT@: named-pkcs11@EXEEXT@
- 	rm -f lwresd@EXEEXT@
--	@LN@ named@EXEEXT@ lwresd@EXEEXT@
-+	@LN@ named-pkcs11@EXEEXT@ lwresd@EXEEXT@
- 
- doc man:: ${MANOBJS}
+-feature-test@EXEEXT@: feature-test.@O@
++feature-test-pkcs11@EXEEXT@: feature-test.@O@
+ 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} \
+ 		-o $@ feature-test.@O@ ${ISCLIBS} ${LIBS}
  
-@@ -192,16 +190,11 @@ install-man8: named.8 lwresd.8
- 
- install-man: install-man5 install-man8
+@@ -180,11 +181,11 @@ statschannel.@O@: bind9.xsl.h
+ installdirs:
+ 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
  
--install:: named@EXEEXT@ lwresd@EXEEXT@ installdirs install-man
+-install:: named@EXEEXT@ installdirs
 -	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named@EXEEXT@ ${DESTDIR}${sbindir}
--	(cd ${DESTDIR}${sbindir}; rm -f lwresd@EXEEXT@; @LN@ named@EXEEXT@ lwresd@EXEEXT@)
 +install:: named-pkcs11@EXEEXT@ installdirs
 +	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named-pkcs11@EXEEXT@ ${DESTDIR}${sbindir}
  
  uninstall::
--	rm -f ${DESTDIR}${mandir}/man5/named.conf.5
--	rm -f ${DESTDIR}${mandir}/man8/lwresd.8
--	rm -f ${DESTDIR}${mandir}/man8/named.8
--	rm -f ${DESTDIR}${sbindir}/lwresd@EXEEXT@
 -	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/named@EXEEXT@
 +	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/named-pkcs11@EXEEXT@
  
  @DLZ_DRIVER_RULES@
  
-diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
-index 277a0f5..0e00885 100644
---- a/bin/named/Makefile.in
-+++ b/bin/named/Makefile.in
-@@ -48,7 +48,7 @@ CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
- 		${DLZDRIVER_INCLUDES} ${DBDRIVER_INCLUDES} ${MAXMINDDB_CFLAGS} \
- 		@DST_OPENSSL_INC@
- 
--CDEFINES =      @CONTRIB_DLZ@ @USE_PKCS11@ @PKCS11_ENGINE@ @CRYPTO@
-+CDEFINES =      @CONTRIB_DLZ@ @USE_GSSAPI@ @CRYPTO@
- 
- CWARNINGS =
- 
-diff --git a/bin/pkcs11/Makefile.in b/bin/pkcs11/Makefile.in
-index 2c19e7e..8223d5e 100644
---- a/bin/pkcs11/Makefile.in
-+++ b/bin/pkcs11/Makefile.in
-@@ -13,13 +13,13 @@ top_srcdir =	@top_srcdir@
- 
- @BIND9_MAKE_INCLUDES@
- 
--CINCLUDES =	${ISC_INCLUDES}
-+CINCLUDES =	${ISC_PKCS11_INCLUDES}
- 
- CDEFINES =
- 
--ISCLIBS =	../../lib/isc/libisc.@A@ @ISC_OPENSSL_LIBS@
-+ISCLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@ @ISC_OPENSSL_LIBS@
- 
--ISCDEPLIBS =	../../lib/isc/libisc.@A@
-+ISCDEPLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
- 
- DEPLIBS =	${ISCDEPLIBS}
- 
 diff --git a/configure.ac b/configure.ac
-index 83cad4a..e1e1a32 100644
+index 032228b..64e3da0 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -1178,12 +1178,14 @@ AC_SUBST(USE_GSSAPI)
+@@ -1251,12 +1251,14 @@ AC_SUBST(USE_GSSAPI)
  AC_SUBST(DST_GSSAPI_INC)
  AC_SUBST(DNS_GSSAPI_LIBS)
- DNS_CRYPTO_LIBS="$DNS_GSSAPI_LIBS $DNS_CRYPTO_LIBS"
+ DNS_CRYPTO_LIBS="$DNS_GSSAPI_LIBS"
 +DNS_CRYPTO_PK11_LIBS="$DNS_GSSAPI_LIBS $DNS_CRYPTO_PK11_LIBS"
  
  #
@@ -311,98 +264,47 @@ index 83cad4a..e1e1a32 100644
 +AC_SUBST(DNS_CRYPTO_PK11_LIBS)
  
  #
- # was --with-randomdev specified?
-@@ -1556,12 +1558,12 @@ AC_ARG_ENABLE(openssl-hash,
- AC_MSG_CHECKING(for OpenSSL library)
- OPENSSL_WARNING=
- openssldirs="/usr /usr/local /usr/local/ssl /opt/local /usr/pkg /usr/sfw"
--if test "yes" = "$want_native_pkcs11"
--then
--	use_openssl="native_pkcs11"
--	want_openssl_hash="no"
--	AC_MSG_RESULT(use of native PKCS11 instead)
--fi
-+#if test "yes" = "$want_native_pkcs11"
-+#then
-+#	use_openssl="native_pkcs11"
-+#	want_openssl_hash="no"
-+#	AC_MSG_RESULT(use of native PKCS11 instead)
-+#fi
- 
- if test "auto" = "$use_openssl"
- then
-@@ -1574,6 +1576,7 @@ then
- 		fi
- 	done
+ # was --with-lmdb specified?
+@@ -2327,6 +2329,8 @@ AC_SUBST(BIND9_DNS_BUILDINCLUDE)
+ AC_SUBST(BIND9_NS_BUILDINCLUDE)
+ AC_SUBST(BIND9_BIND9_BUILDINCLUDE)
+ AC_SUBST(BIND9_IRS_BUILDINCLUDE)
++AC_SUBST(BIND9_DNS_PKCS11_BUILDINCLUDE)
++AC_SUBST(BIND9_NS_PKCS11_BUILDINCLUDE)
+ if test "X$srcdir" != "X"; then
+ 	BIND9_ISC_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/isc/include"
+ 	BIND9_ISCCC_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/isccc/include"
+@@ -2335,6 +2339,8 @@ if test "X$srcdir" != "X"; then
+ 	BIND9_NS_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/ns/include"
+ 	BIND9_BIND9_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/bind9/include"
+ 	BIND9_IRS_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/irs/include"
++	BIND9_DNS_PKCS11_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/dns-pkcs11/include"
++	BIND9_NS_PKCS11_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/ns-pkcs11/include"
+ else
+ 	BIND9_ISC_BUILDINCLUDE=""
+ 	BIND9_ISCCC_BUILDINCLUDE=""
+@@ -2343,6 +2349,8 @@ else
+ 	BIND9_NS_BUILDINCLUDE=""
+ 	BIND9_BIND9_BUILDINCLUDE=""
+ 	BIND9_IRS_BUILDINCLUDE=""
++	BIND9_DNS_PKCS11_BUILDINCLUDE=""
++	BIND9_NS_PKCS11_BUILDINCLUDE=""
  fi
-+CRYPTO_PK11=""
- OPENSSL_ECDSA=""
- OPENSSL_GOST=""
- OPENSSL_ED25519=""
-@@ -1595,11 +1598,10 @@ case "$with_gost" in
- 		;;
- esac
- 
--case "$use_openssl" in
--	native_pkcs11)
--		AC_MSG_RESULT(disabled because of native PKCS11)
-+if test "$want_native_pkcs11" = "yes"
-+then
- 		DST_OPENSSL_INC=""
--		CRYPTO="-DPKCS11CRYPTO"
-+		CRYPTO_PK11="-DPKCS11CRYPTO"
- 		CRYPTOLIB="pkcs11"
- 		OPENSSLECDSALINKOBJS=""
- 		OPENSSLECDSALINKSRCS=""
-@@ -1609,7 +1611,9 @@ case "$use_openssl" in
- 		OPENSSLGOSTLINKSRCS=""
- 		OPENSSLLINKOBJS=""
- 		OPENSSLLINKSRCS=""
--		;;
-+fi
-+
-+case "$use_openssl" in
- 	no)
- 		AC_MSG_RESULT(no)
- 		DST_OPENSSL_INC=""
-@@ -1641,7 +1645,7 @@ case "$use_openssl" in
- If you do not want OpenSSL, use --without-openssl])
- 		;;
- 	*)
--		if test "yes" = "$want_native_pkcs11"
-+		if false # test "yes" = "$want_native_pkcs11"
- 		then
- 			AC_MSG_RESULT()
- 			AC_MSG_ERROR([OpenSSL and native PKCS11 cannot be used together.])
-@@ -2077,6 +2081,7 @@ AC_SUBST(OPENSSL_ED25519)
- AC_SUBST(OPENSSL_GOST)
- 
- DNS_CRYPTO_LIBS="$DNS_CRYPTO_LIBS $DST_OPENSSL_LIBS"
-+DNS_CRYPTO_PK11_LIBS="$DNS_CRYPTO_LIBS"
- 
- ISC_PLATFORM_WANTAES="#undef ISC_PLATFORM_WANTAES"
- if test "yes" = "$with_aes"
-@@ -2363,6 +2368,7 @@ esac
- AC_SUBST(PKCS11LINKOBJS)
- AC_SUBST(PKCS11LINKSRCS)
- AC_SUBST(CRYPTO)
-+AC_SUBST(CRYPTO_PK11)
- AC_SUBST(PKCS11_ECDSA)
- AC_SUBST(PKCS11_GOST)
- AC_SUBST(PKCS11_ED25519)
-@@ -5491,8 +5497,11 @@ AC_CONFIG_FILES([
+ 
+ AC_SUBST_FILE(BIND9_MAKE_INCLUDES)
+@@ -2798,8 +2806,11 @@ AC_CONFIG_FILES([
  	bin/delv/Makefile
  	bin/dig/Makefile
  	bin/dnssec/Makefile
-+	bin/dnssec-pkcs11/Makefile	
++	bin/dnssec-pkcs11/Makefile
  	bin/named/Makefile
  	bin/named/unix/Makefile
 +	bin/named-pkcs11/Makefile
 +	bin/named-pkcs11/unix/Makefile
  	bin/nsupdate/Makefile
  	bin/pkcs11/Makefile
- 	bin/python/Makefile
-@@ -5565,6 +5574,10 @@ AC_CONFIG_FILES([
+ 	bin/plugins/Makefile
+@@ -2861,6 +2872,10 @@ AC_CONFIG_FILES([
  	lib/dns/include/dns/Makefile
  	lib/dns/include/dst/Makefile
  	lib/dns/tests/Makefile
@@ -413,73 +315,54 @@ index 83cad4a..e1e1a32 100644
  	lib/irs/Makefile
  	lib/irs/include/Makefile
  	lib/irs/include/irs/Makefile
-@@ -5589,6 +5602,24 @@ AC_CONFIG_FILES([
- 	lib/isc/unix/include/Makefile
- 	lib/isc/unix/include/isc/Makefile
- 	lib/isc/unix/include/pkcs11/Makefile
-+	lib/isc-pkcs11/$arch/Makefile
-+	lib/isc-pkcs11/$arch/include/Makefile
-+	lib/isc-pkcs11/$arch/include/isc/Makefile
-+	lib/isc-pkcs11/$thread_dir/Makefile
-+	lib/isc-pkcs11/$thread_dir/include/Makefile
-+	lib/isc-pkcs11/$thread_dir/include/isc/Makefile
-+	lib/isc-pkcs11/Makefile
-+	lib/isc-pkcs11/include/Makefile
-+	lib/isc-pkcs11/include/isc/Makefile
-+	lib/isc-pkcs11/include/isc/platform.h
-+	lib/isc-pkcs11/include/pk11/Makefile
-+	lib/isc-pkcs11/include/pkcs11/Makefile
-+	lib/isc-pkcs11/tests/Makefile
-+	lib/isc-pkcs11/nls/Makefile
-+	lib/isc-pkcs11/unix/Makefile
-+	lib/isc-pkcs11/unix/include/Makefile
-+	lib/isc-pkcs11/unix/include/isc/Makefile
-+	lib/isc-pkcs11/unix/include/pkcs11/Makefile
- 	lib/isccc/Makefile
- 	lib/isccc/include/Makefile
- 	lib/isccc/include/isccc/Makefile
+@@ -2893,6 +2908,10 @@ AC_CONFIG_FILES([
+ 	lib/ns/include/Makefile
+ 	lib/ns/include/ns/Makefile
+ 	lib/ns/tests/Makefile
++	lib/ns-pkcs11/Makefile
++	lib/ns-pkcs11/include/Makefile
++	lib/ns-pkcs11/include/ns/Makefile
++	lib/ns-pkcs11/tests/Makefile
+ 	make/Makefile
+ 	make/mkdep
+ 	unit/unittest.sh
 diff --git a/lib/Makefile.in b/lib/Makefile.in
-index f089bea..3ed939b 100644
+index 833964e..058ba2f 100644
 --- a/lib/Makefile.in
 +++ b/lib/Makefile.in
 @@ -15,7 +15,7 @@ top_srcdir =	@top_srcdir@
  # Attempt to disable parallel processing.
  .NOTPARALLEL:
  .NO_PARALLEL:
--SUBDIRS =	isc isccc dns isccfg bind9 lwres irs samples
-+SUBDIRS =	isc isc-pkcs11 isccc dns dns-pkcs11 isccfg bind9 lwres irs samples
+-SUBDIRS =	isc isccc dns ns isccfg bind9 irs
++SUBDIRS =	isc isccc dns dns-pkcs11 ns ns-pkcs11 isccfg bind9 irs
  TARGETS =
  
  @BIND9_MAKE_RULES@
 diff --git a/lib/dns-pkcs11/Makefile.in b/lib/dns-pkcs11/Makefile.in
-index 1d0f5df..98c9ba0 100644
+index 58bda3c..d6a45df 100644
 --- a/lib/dns-pkcs11/Makefile.in
 +++ b/lib/dns-pkcs11/Makefile.in
-@@ -24,17 +24,17 @@ VERSION=@BIND9_VERSION@
+@@ -22,7 +22,7 @@ VERSION=@BIND9_VERSION@
  
  @BIND9_MAKE_INCLUDES@
  
 -CINCLUDES =	-I. -I${top_srcdir}/lib/dns -Iinclude ${DNS_INCLUDES} \
--		${ISC_INCLUDES} ${MAXMINDDB_CFLAGS} \
 +CINCLUDES =	-I. -I${top_srcdir}/lib/dns-pkcs11 -Iinclude ${DNS_PKCS11_INCLUDES} \
-+		${ISC_PKCS11_INCLUDES} ${MAXMINDDB_CFLAGS} \
- 		@DST_OPENSSL_INC@ @DST_GSSAPI_INC@
+ 		${ISC_INCLUDES} \
+ 		${FSTRM_CFLAGS} \
+ 		${OPENSSL_CFLAGS} @DST_GSSAPI_INC@ \
+@@ -32,7 +32,7 @@ CINCLUDES =	-I. -I${top_srcdir}/lib/dns -Iinclude ${DNS_INCLUDES} \
+ 		${LMDB_CFLAGS} \
+ 		${MAXMINDDB_CFLAGS}
  
--CDEFINES =	-DUSE_MD5 @CRYPTO@ @USE_GSSAPI@
-+CDEFINES =	-DUSE_MD5 @CRYPTO_PK11@ @USE_GSSAPI@
+-CDEFINES =	@USE_GSSAPI@
++CDEFINES =	@USE_GSSAPI@ @USE_PKCS11@
  
  CWARNINGS =
  
--ISCLIBS =	../../lib/isc/libisc.@A@
-+ISCLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
- 
--ISCDEPLIBS =	../../lib/isc/libisc.@A@
-+ISCDEPLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
- 
- LIBS =		${MAXMINDDB_LIBS} @LIBS@
- 
-@@ -148,15 +148,15 @@ version.@O@: version.c
- 		-DLIBAGE=${LIBAGE} \
+@@ -135,15 +135,15 @@ version.@O@: version.c
+ 		-DMAPAPI=\"${MAPAPI}\" \
  		-c ${srcdir}/version.c
  
 -libdns.@SA@: ${OBJS}
@@ -492,13 +375,13 @@ index 1d0f5df..98c9ba0 100644
  	${LIBTOOL_MODE_LINK} \
 -		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libdns.la -rpath ${libdir} \
 +		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libdns-pkcs11.la -rpath ${libdir} \
- 		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
+ 		-release "${VERSION}" \
 -		${OBJS} ${ISCLIBS} @DNS_CRYPTO_LIBS@ ${LIBS}
 +		${OBJS} ${ISCLIBS} @DNS_CRYPTO_PK11_LIBS@ ${LIBS}
  
  include: gen
  	${MAKE} include/dns/enumtype.h
-@@ -187,22 +187,22 @@ gen: gen.c
+@@ -174,22 +174,22 @@ gen: gen.c
  	${BUILD_CPPFLAGS} ${BUILD_LDFLAGS} -o $@ ${srcdir}/gen.c \
  	${BUILD_LIBS} ${LFS_LIBS}
  
@@ -526,89 +409,142 @@ index 1d0f5df..98c9ba0 100644
  	rm -f gen code.h include/dns/enumtype.h include/dns/enumclass.h
  	rm -f include/dns/rdatastruct.h
  	rm -f dnstap.pb-c.c dnstap.pb-c.h
-diff --git a/lib/isc-pkcs11/Makefile.in b/lib/isc-pkcs11/Makefile.in
-index 7e3e9ce..58d7466 100644
---- a/lib/isc-pkcs11/Makefile.in
-+++ b/lib/isc-pkcs11/Makefile.in
-@@ -23,8 +23,8 @@ CINCLUDES =	-I${srcdir}/unix/include \
- 		-I${srcdir}/@ISC_THREAD_DIR@/include \
- 		-I${srcdir}/@ISC_ARCH_DIR@/include \
- 		-I./include \
--		-I${srcdir}/include ${DNS_INCLUDES} @ISC_OPENSSL_INC@
--CDEFINES =	@CRYPTO@ -DPK11_LIB_LOCATION=\"${PROVIDER}\"
-+		-I${srcdir}/include ${DNS_PKCS11_INCLUDES}
-+CDEFINES =	@CRYPTO_PK11@ -DPK11_LIB_LOCATION=\"${PROVIDER}\"
+diff --git a/lib/dns-pkcs11/tests/Makefile.in b/lib/dns-pkcs11/tests/Makefile.in
+index 3bb5e01..c96fe7d 100644
+--- a/lib/dns-pkcs11/tests/Makefile.in
++++ b/lib/dns-pkcs11/tests/Makefile.in
+@@ -15,15 +15,15 @@ VERSION=@BIND9_VERSION@
+ 
+ @BIND9_MAKE_INCLUDES@
+ 
+-CINCLUDES =	-I. -Iinclude ${DNS_INCLUDES} ${ISC_INCLUDES} \
++CINCLUDES =	-I. -Iinclude ${DNS_PKCS11_INCLUDES} ${ISC_INCLUDES} \
+ 		${FSTRM_CFLAGS} ${OPENSSL_CFLAGS} \
+ 		${PROTOBUF_C_CFLAGS} ${MAXMINDDB_CFLAGS} @CMOCKA_CFLAGS@
+-CDEFINES =	-DTESTS="\"${top_builddir}/lib/dns/tests/\""
++CDEFINES =	@USE_PKCS11@ -DTESTS="\"${top_builddir}/lib/dns-pkcs11/tests/\""
+ 
+ ISCLIBS =	../../isc/libisc.@A@ @NO_LIBTOOL_ISCLIBS@
+ ISCDEPLIBS =	../../isc/libisc.@A@
+-DNSLIBS =	../libdns.@A@ @NO_LIBTOOL_DNSLIBS@
+-DNSDEPLIBS =	../libdns.@A@
++DNSLIBS =	../libdns-pkcs11.@A@ @NO_LIBTOOL_DNSLIBS@
++DNSDEPLIBS =	../libdns-pkcs11.@A@
+ 
+ LIBS =		@LIBS@ @CMOCKA_LIBS@
+ 
+diff --git a/lib/ns-pkcs11/Makefile.in b/lib/ns-pkcs11/Makefile.in
+index bc683ce..7a9d2f2 100644
+--- a/lib/ns-pkcs11/Makefile.in
++++ b/lib/ns-pkcs11/Makefile.in
+@@ -16,12 +16,12 @@ VERSION=@BIND9_VERSION@
+ 
+ @BIND9_MAKE_INCLUDES@
+ 
+-CINCLUDES =	-I. -I${top_srcdir}/lib/ns -Iinclude \
+-		${NS_INCLUDES} ${DNS_INCLUDES} ${ISC_INCLUDES} \
++CINCLUDES =	-I. -I${top_srcdir}/lib/ns-pkcs11 -Iinclude \
++		${NS_PKCS11_INCLUDES} ${DNS_PKCS11_INCLUDES} ${ISC_INCLUDES} \
+ 		${OPENSSL_CFLAGS} @DST_GSSAPI_INC@ \
+ 		${FSTRM_CFLAGS}
+ 
+-CDEFINES =	-DNAMED_PLUGINDIR=\"${plugindir}\"
++CDEFINES =	@USE_PKCS11@ -DNAMED_PLUGINDIR=\"${plugindir}\"
+ 
  CWARNINGS =
  
- # Alphabetically
-@@ -107,40 +107,40 @@ version.@O@: version.c
- 		-DLIBAGE=${LIBAGE} \
- 		-c ${srcdir}/version.c
+@@ -29,9 +29,9 @@ ISCLIBS =	../../lib/isc/libisc.@A@
  
--libisc.@SA@: ${OBJS} ${SYMTBLOBJS}
-+libisc-pkcs11.@SA@: ${OBJS} ${SYMTBLOBJS}
- 	${AR} ${ARFLAGS} $@ ${OBJS} ${SYMTBLOBJS}
- 	${RANLIB} $@
+ ISCDEPLIBS =	../../lib/isc/libisc.@A@
+ 
+-DNSLIBS =	../../lib/dns/libdns.@A@ @NO_LIBTOOL_DNSLIBS@
++DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ @NO_LIBTOOL_DNSLIBS@
  
--libisc-nosymtbl.@SA@: ${OBJS}
-+libisc-pkcs11-nosymtbl.@SA@: ${OBJS}
+-DNSDEPLIBS =	../../lib/dns/libdns.@A@
++DNSDEPLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@
+ 
+ LIBS =		@LIBS@
+ 
+@@ -60,28 +60,28 @@ version.@O@: version.c
+ 		-DMAJOR=\"${MAJOR}\" \
+ 		-c ${srcdir}/version.c
+ 
+-libns.@SA@: ${OBJS}
++libns-pkcs11.@SA@: ${OBJS}
  	${AR} ${ARFLAGS} $@ ${OBJS}
  	${RANLIB} $@
  
--libisc.la: ${OBJS} ${SYMTBLOBJS}
-+libisc-pkcs11.la: ${OBJS} ${SYMTBLOBJS}
- 	${LIBTOOL_MODE_LINK} \
--		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisc.la -rpath ${libdir} \
-+		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisc-pkcs11.la -rpath ${libdir} \
- 		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
- 		${OBJS} ${SYMTBLOBJS} ${LIBS}
- 
--libisc-nosymtbl.la: ${OBJS}
-+libisc-pkcs11-nosymtbl.la: ${OBJS}
+-libns.la: ${OBJS}
++libns-pkcs11.la: ${OBJS}
  	${LIBTOOL_MODE_LINK} \
--		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisc-nosymtbl.la -rpath ${libdir} \
-+		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisc-pkcs11-nosymtbl.la -rpath ${libdir} \
- 		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
- 		${OBJS} ${LIBS}
- 
--timestamp: libisc.@A@ libisc-nosymtbl.@A@
-+timestamp: libisc-pkcs11.@A@ libisc-pkcs11-nosymtbl.@A@
+-		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libns.la -rpath ${libdir} \
++		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libns-pkcs11.la -rpath ${libdir} \
+ 		-release "${VERSION}" \
+-		${OBJS} ${ISCLIBS} ${DNSLIBS} @DNS_CRYPTO_LIBS@ ${LIBS}
++		${OBJS} ${ISCLIBS} ${DNSLIBS} @DNS_CRYPTO_PK11_LIBS@ ${LIBS}
+ 
+-timestamp: libns.@A@
++timestamp: libns-pkcs11.@A@
  	touch timestamp
  
--testdirs: libisc.@A@ libisc-nosymtbl.@A@
-+testdirs: libisc-pkcs11.@A@ libisc-pkcs11-nosymtbl.@A@
- 
  installdirs:
  	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${libdir}
  
  install:: timestamp installdirs
--	${LIBTOOL_MODE_INSTALL} ${INSTALL_LIBRARY} libisc.@A@ ${DESTDIR}${libdir}
-+	${LIBTOOL_MODE_INSTALL} ${INSTALL_LIBRARY} libisc-pkcs11.@A@ ${DESTDIR}${libdir}
+-	${LIBTOOL_MODE_INSTALL} ${INSTALL_LIBRARY} libns.@A@ \
++	${LIBTOOL_MODE_INSTALL} ${INSTALL_LIBRARY} libns-pkcs11.@A@ \
+ 		${DESTDIR}${libdir}
  
  uninstall::
--	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${libdir}/libisc.@A@
-+	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${libdir}/libisc-pkcs11.@A@
+-	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${libdir}/libns.@A@
++	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${libdir}/libns-pkcs11.@A@
  
  clean distclean::
--	rm -f libisc.@A@ libisc-nosymtbl.@A@ libisc.la \
--	libisc-nosymtbl.la timestamp
-+	rm -f libisc-pkcs11.@A@ libisc-pkcs11-nosymtbl.@A@ libisc-pkcs11.la \
-+	libisc-pkcs11-nosymtbl.la timestamp
+-	rm -f libns.@A@ timestamp
++	rm -f libns-pkcs11.@A@ timestamp
+diff --git a/lib/ns-pkcs11/tests/Makefile.in b/lib/ns-pkcs11/tests/Makefile.in
+index 4c3e694..c1b6d99 100644
+--- a/lib/ns-pkcs11/tests/Makefile.in
++++ b/lib/ns-pkcs11/tests/Makefile.in
+@@ -17,17 +17,17 @@ VERSION=@BIND9_VERSION@
+ 
+ WRAP_OPTIONS =	-Wl,--wrap=isc__nmhandle_detach -Wl,--wrap=isc__nmhandle_attach
+ 
+-CINCLUDES =	-I. -Iinclude ${NS_INCLUDES} ${DNS_INCLUDES} ${ISC_INCLUDES} \
++CINCLUDES =	-I. -Iinclude ${NS_PKCS11_INCLUDES} ${DNS_PKCS11_INCLUDES} ${ISC_INCLUDES} \
+ 		${OPENSSL_CFLAGS} \
+ 		@CMOCKA_CFLAGS@
+-CDEFINES =	-DTESTS="\"${top_builddir}/lib/ns/tests/\"" -DNAMED_PLUGINDIR=\"${plugindir}\"
++CDEFINES =	-DTESTS="\"${top_builddir}/lib/ns-pkcs11/tests/\"" -DNAMED_PLUGINDIR=\"${plugindir}\" @USE_PKCS11@
+ 
+ ISCLIBS =	../../isc/libisc.@A@ @NO_LIBTOOL_ISCLIBS@
+ ISCDEPLIBS =	../../isc/libisc.@A@
+-DNSLIBS =	../../dns/libdns.@A@ @NO_LIBTOOL_DNSLIBS@
+-DNSDEPLIBS =	../../dns/libdns.@A@
+-NSLIBS =	../libns.@A@
+-NSDEPLIBS =	../libns.@A@
++DNSLIBS =	../../dns-pkcs11/libdns-pkcs11.@A@ @NO_LIBTOOL_DNSLIBS@
++DNSDEPLIBS =	../../dns-pkcs11/libdns-pkcs11.@A@
++NSLIBS =	../libns-pkcs11.@A@
++NSDEPLIBS =	../libns-pkcs11.@A@
+ 
+ LIBS =		@LIBS@ @CMOCKA_LIBS@
+ 
 diff --git a/make/includes.in b/make/includes.in
-index 66efe68..966671f 100644
+index b8317d3..b73b0c4 100644
 --- a/make/includes.in
 +++ b/make/includes.in
-@@ -41,3 +41,13 @@ BIND9_INCLUDES = @BIND9_BIND9_BUILDINCLUDE@ \
+@@ -39,3 +39,10 @@ BIND9_INCLUDES = @BIND9_BIND9_BUILDINCLUDE@ \
  
  TEST_INCLUDES = \
  	-I${top_srcdir}/lib/tests/include
 +
-+ISC_PKCS11_INCLUDES = @BIND9_ISC_BUILDINCLUDE@ \
-+	-I${top_srcdir}/lib/isc-pkcs11 \
-+	-I${top_srcdir}/lib/isc-pkcs11/include \
-+	-I${top_srcdir}/lib/isc-pkcs11/unix/include \
-+	-I${top_srcdir}/lib/isc-pkcs11/@ISC_THREAD_DIR@/include \
-+	-I${top_srcdir}/lib/isc-pkcs11/@ISC_ARCH_DIR@/include
-+
-+DNS_PKCS11_INCLUDES = @BIND9_DNS_BUILDINCLUDE@ \
++DNS_PKCS11_INCLUDES = @BIND9_DNS_PKCS11_BUILDINCLUDE@ \
 +	-I${top_srcdir}/lib/dns-pkcs11/include
++
++NS_PKCS11_INCLUDES = @BIND9_NS_PKCS11_BUILDINCLUDE@ \
++	-I${top_srcdir}/lib/ns-pkcs11/include
++
+-- 
+2.26.3
+

SOURCES/bind-9.10-sdb.patch

@@ -1,310 +0,0 @@
-diff --git a/bin/Makefile.in b/bin/Makefile.in
-index ce7a2da..4e6a824 100644
---- a/bin/Makefile.in
-+++ b/bin/Makefile.in
-@@ -11,8 +11,8 @@ srcdir =	@srcdir@
- VPATH =		@srcdir@
- top_srcdir =	@top_srcdir@
- 
--SUBDIRS =	named named-pkcs11 rndc dig delv dnssec dnssec-pkcs11 tools nsupdate \
--		check confgen @NZD_TOOLS@ @PYTHON_TOOLS@ @PKCS11_TOOLS@ tests
-+SUBDIRS =	named named-sdb named-pkcs11 rndc dig delv dnssec dnssec-pkcs11 tools nsupdate \
-+		check confgen @NZD_TOOLS@ @PYTHON_TOOLS@ @PKCS11_TOOLS@ sdb_tools tests
- TARGETS =
- 
- @BIND9_MAKE_RULES@
-diff --git a/bin/named-sdb/Makefile.in b/bin/named-sdb/Makefile.in
-index 03a72d5..4c1cb6d 100644
---- a/bin/named-sdb/Makefile.in
-+++ b/bin/named-sdb/Makefile.in
-@@ -30,10 +30,10 @@ VERSION=@BIND9_VERSION@
- #
- # Add database drivers here.
- #
--DBDRIVER_OBJS =
--DBDRIVER_SRCS =
-+DBDRIVER_OBJS =	ldapdb.@O@ pgsqldb.@O@ sqlitedb.@O@ dirdb.@O@
-+DBDRIVER_SRCS =	ldapdb.c pgsqldb.c sqlitedb.c dirdb.c
- DBDRIVER_INCLUDES =
--DBDRIVER_LIBS =
-+DBDRIVER_LIBS =	-lldap -llber -lsqlite3 -lpq
- 
- DLZ_DRIVER_DIR =	${top_srcdir}/contrib/dlz/drivers
- 
-@@ -80,7 +80,7 @@ NOSYMLIBS =	${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
- 
- SUBDIRS =	unix
- 
--TARGETS =	named@EXEEXT@ lwresd@EXEEXT@
-+TARGETS =	named-sdb@EXEEXT@
- 
- GEOIPLINKOBJS = geoip.@O@
- GEOIP2LINKOBJS = geoip.@O@
-@@ -154,7 +154,7 @@ server.@O@: server.c
- 		-DPRODUCT=\"${PRODUCT}\" \
- 		-DVERSION=\"${VERSION}\" -c ${srcdir}/server.c
- 
--named@EXEEXT@: ${OBJS} ${DEPLIBS}
-+named-sdb@EXEEXT@: ${OBJS} ${DEPLIBS}
- 	export MAKE_SYMTABLE="yes"; \
- 	export BASEOBJS="${OBJS} ${UOBJS}"; \
- 	${FINALBUILDCMD}
-@@ -181,8 +181,6 @@ statschannel.@O@: bind9.xsl.h
- 
- installdirs:
- 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
--	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man5
--	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
- 
- install-man5: named.conf.5
- 	${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man5
-@@ -192,16 +190,11 @@ install-man8: named.8 lwresd.8
- 
- install-man: install-man5 install-man8
- 
--install:: named@EXEEXT@ lwresd@EXEEXT@ installdirs install-man
--	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named@EXEEXT@ ${DESTDIR}${sbindir}
--	(cd ${DESTDIR}${sbindir}; rm -f lwresd@EXEEXT@; @LN@ named@EXEEXT@ lwresd@EXEEXT@)
-+install:: ${TARGETS} installdirs
-+	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named-sdb@EXEEXT@ ${DESTDIR}${sbindir}
- 
- uninstall::
--	rm -f ${DESTDIR}${mandir}/man5/named.conf.5
--	rm -f ${DESTDIR}${mandir}/man8/lwresd.8
--	rm -f ${DESTDIR}${mandir}/man8/named.8
--	rm -f ${DESTDIR}${sbindir}/lwresd@EXEEXT@
--	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/named@EXEEXT@
-+	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/named-sdb@EXEEXT@
- 
- @DLZ_DRIVER_RULES@
- 
-diff --git a/bin/named-sdb/main.c b/bin/named-sdb/main.c
-index c9fc3cc..148ebb3 100644
---- a/bin/named-sdb/main.c
-+++ b/bin/named-sdb/main.c
-@@ -97,6 +97,10 @@
-  * Include header files for database drivers here.
-  */
- /* #include "xxdb.h" */
-+#include "ldapdb.h"
-+#include "pgsqldb.h"
-+#include "sqlitedb.h"
-+#include "dirdb.h"
- 
- #ifdef CONTRIB_DLZ
- /*
-@@ -1134,6 +1138,11 @@ setup(void) {
- 		ns_main_earlyfatal("isc_app_start() failed: %s",
- 				   isc_result_totext(result));
- 
-+	ldapdb_clear();
-+	pgsqldb_clear();
-+	dirdb_clear();
-+	sqlitedb_clear();
-+
- 	isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
- 		      ISC_LOG_NOTICE, "starting %s %s%s%s <id:%s>",
- 		      ns_g_product, ns_g_version,
-@@ -1334,6 +1343,75 @@ setup(void) {
- 				   isc_result_totext(result));
- #endif
- 
-+        result = ldapdb_init();
-+        if (result != ISC_R_SUCCESS)
-+        {
-+            isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
-+                          ISC_LOG_ERROR, 
-+                          "SDB ldap module initialisation failed: %s.",
-+                          isc_result_totext(result)
-+                );
-+            isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
-+                          ISC_LOG_ERROR, 
-+                          "SDB ldap zone database will be unavailable."
-+                );
-+        }else
-+            isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
-+                          ISC_LOG_NOTICE, "SDB ldap zone database module loaded."
-+                         );
-+
-+        result = pgsqldb_init();
-+        if (result != ISC_R_SUCCESS)
-+        {
-+            isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
-+                          ISC_LOG_ERROR, 
-+                          "SDB pgsql module initialisation failed: %s.",
-+                          isc_result_totext(result)
-+                );
-+            isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
-+                          ISC_LOG_ERROR, 
-+                          "SDB pgsql zone database will be unavailable."
-+                );
-+        }else
-+            isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
-+                          ISC_LOG_NOTICE, "SDB postgreSQL DB zone database module loaded."
-+                         );
-+
-+        result = sqlitedb_init();
-+        if (result != ISC_R_SUCCESS)
-+        {
-+             isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
-+                          ISC_LOG_ERROR, 
-+                          "SDB sqlite3 module initialisation failed: %s.",
-+                          isc_result_totext(result)
-+                );
-+            isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
-+                          ISC_LOG_ERROR, 
-+                          "SDB sqlite3 zone database will be unavailable."
-+                );
-+        }else
-+            isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
-+                          ISC_LOG_NOTICE, "SDB sqlite3 DB zone database module loaded."
-+                         );
-+
-+        result = dirdb_init();
-+        if (result != ISC_R_SUCCESS)
-+        {
-+            isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
-+                          ISC_LOG_ERROR, 
-+                          "SDB directory DB module initialisation failed: %s.",
-+                          isc_result_totext(result)
-+                );
-+            isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
-+                          ISC_LOG_ERROR, 
-+                          "SDB directory DB zone database will be unavailable."
-+                );
-+        }else
-+            isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
-+                          ISC_LOG_NOTICE, "SDB directory DB zone database module loaded."
-+                         );
-+
-+
- 	ns_server_create(ns_g_mctx, &ns_g_server);
- 
- #ifdef HAVE_LIBSECCOMP
-@@ -1376,6 +1454,11 @@ cleanup(void) {
- 
- 	dns_name_destroy();
- 
-+	ldapdb_clear();
-+	pgsqldb_clear();
-+	sqlitedb_clear();
-+	dirdb_clear();
-+
- 	isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
- 		      ISC_LOG_NOTICE, "exiting");
- 	ns_log_shutdown();
-diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
-index 03a72d5..47cc046 100644
---- a/bin/named/Makefile.in
-+++ b/bin/named/Makefile.in
-@@ -45,10 +45,10 @@ DLZDRIVER_LIBS =	@DLZ_DRIVER_LIBS@
- CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
- 		${LWRES_INCLUDES} ${DNS_INCLUDES} ${BIND9_INCLUDES} \
- 		${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} ${ISC_INCLUDES} \
--		${DLZDRIVER_INCLUDES} ${DBDRIVER_INCLUDES} ${MAXMINDDB_CFLAGS} \
-+		${MAXMINDDB_CFLAGS} \
- 		@DST_OPENSSL_INC@
- 
--CDEFINES =      @CONTRIB_DLZ@ @USE_GSSAPI@ @CRYPTO@
-+CDEFINES =      @USE_GSSAPI@ @CRYPTO@
- 
- CWARNINGS =
- 
-@@ -72,11 +72,11 @@ DEPLIBS =	${LWRESDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
- 
- LIBS =		${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
- 		${ISCCFGLIBS} ${ISCCCLIBS} ${ISCLIBS} \
--		${DLZDRIVER_LIBS} ${DBDRIVER_LIBS} @LIBS@
-+		@LIBS@
- 
- NOSYMLIBS =	${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
- 		${ISCCFGLIBS} ${ISCCCLIBS} ${ISCNOSYMLIBS} \
--		${DLZDRIVER_LIBS} ${DBDRIVER_LIBS} @LIBS@
-+		@LIBS@
- 
- SUBDIRS =	unix
- 
-@@ -94,8 +94,7 @@ OBJS =		builtin.@O@ client.@O@ config.@O@ control.@O@ \
- 		tkeyconf.@O@ tsigconf.@O@ update.@O@ xfrout.@O@ \
- 		zoneconf.@O@ \
- 		lwaddr.@O@ lwresd.@O@ lwdclient.@O@ lwderror.@O@ lwdgabn.@O@ \
--		lwdgnba.@O@ lwdgrbn.@O@ lwdnoop.@O@ lwsearch.@O@ \
--		${DLZDRIVER_OBJS} ${DBDRIVER_OBJS}
-+		lwdgnba.@O@ lwdgrbn.@O@ lwdnoop.@O@ lwsearch.@O@
- 
- UOBJS =		unix/os.@O@ unix/dlz_dlopen_driver.@O@
- 
-@@ -113,8 +112,7 @@ SRCS =		builtin.c client.c config.c control.c \
- 		tkeyconf.c tsigconf.c update.c xfrout.c \
- 		zoneconf.c \
- 		lwaddr.c lwresd.c lwdclient.c lwderror.c lwdgabn.c \
--		lwdgnba.c lwdgrbn.c lwdnoop.c lwsearch.c \
--		${DLZDRIVER_SRCS} ${DBDRIVER_SRCS}
-+		lwdgnba.c lwdgrbn.c lwdnoop.c lwsearch.c
- 
- MANPAGES =	named.8 lwresd.8 named.conf.5
- 
-@@ -203,7 +201,5 @@ uninstall::
- 	rm -f ${DESTDIR}${sbindir}/lwresd@EXEEXT@
- 	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/named@EXEEXT@
- 
--@DLZ_DRIVER_RULES@
--
- named-symtbl.@O@: named-symtbl.c
- 	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} -c named-symtbl.c
-diff --git a/bin/sdb_tools/Makefile.in b/bin/sdb_tools/Makefile.in
-index c7e0868..95ab742 100644
---- a/bin/sdb_tools/Makefile.in
-+++ b/bin/sdb_tools/Makefile.in
-@@ -32,11 +32,11 @@ DEPLIBS =	${LWRESDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
- LIBS =		${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
- 		${ISCCFGLIBS} ${ISCCCLIBS} ${ISCLIBS} ${DBDRIVER_LIBS} @LIBS@
- 
--TARGETS =	zone2ldap@EXEEXT@ zonetodb@EXEEXT@
-+TARGETS =	zone2ldap@EXEEXT@ zonetodb@EXEEXT@ zone2sqlite@EXEEXT@
- 
--OBJS	=	zone2ldap.@O@ zonetodb.@O@
-+OBJS	=	zone2ldap.@O@ zonetodb.@O@ zone2sqlite.@O@
- 
--SRCS    =       zone2ldap.c zonetodb.c
-+SRCS    =       zone2ldap.c zonetodb.c zone2sqlite.c
- 
- MANPAGES =      zone2ldap.1
- 
-@@ -50,6 +50,9 @@ zone2ldap@EXEEXT@: zone2ldap.@O@ ${DEPLIBS}
- zonetodb@EXEEXT@: zonetodb.@O@  ${DEPLIBS}
- 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ zonetodb.@O@ -lpq ${LIBS}
- 
-+zone2sqlite@EXEEXT@: zone2sqlite.@O@  ${DEPLIBS}
-+	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${ALL_CFLAGS} ${LDFLAGS} -o $@ zone2sqlite.@O@ -lsqlite3 -lssl ${LIBS}
-+
- clean distclean manclean maintainer-clean::
- 	rm -f ${TARGETS} ${OBJS}
- 
-@@ -60,4 +63,5 @@ installdirs:
- install:: ${TARGETS} installdirs
- 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zone2ldap@EXEEXT@ ${DESTDIR}${sbindir}
- 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zonetodb@EXEEXT@  ${DESTDIR}${sbindir}
-+	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zone2sqlite@EXEEXT@ ${DESTDIR}${sbindir}
- 	${INSTALL_DATA} ${srcdir}/zone2ldap.1 ${DESTDIR}${mandir}/man1/zone2ldap.1
-diff --git a/configure.ac b/configure.ac
-index f85f45f..7d28c52 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -5400,6 +5400,8 @@ AC_CONFIG_FILES([
- 	bin/named/unix/Makefile
- 	bin/named-pkcs11/Makefile
- 	bin/named-pkcs11/unix/Makefile
-+	bin/named-sdb/Makefile
-+	bin/named-sdb/unix/Makefile
- 	bin/nsupdate/Makefile
- 	bin/pkcs11/Makefile
- 	bin/python/Makefile
-@@ -5424,6 +5426,7 @@ AC_CONFIG_FILES([
- 	bin/python/isc/tests/policy_test.py
- 	bin/python/isc/utils.py
- 	bin/rndc/Makefile
-+	bin/sdb_tools/Makefile
- 	bin/tests/Makefile
- 	bin/tests/headerdep_test.sh
- 	bin/tests/optional/Makefile

SOURCES/bind-9.10-use-of-strlcat.patch

@@ -1,18 +0,0 @@
-diff --git a/bin/sdb_tools/zone2ldap.c b/bin/sdb_tools/zone2ldap.c
-index d56bc56..99c3314 100644
---- a/bin/sdb_tools/zone2ldap.c
-+++ b/bin/sdb_tools/zone2ldap.c
-@@ -817,11 +817,11 @@ build_dn_from_dc_list (char **dc_list, unsigned int ttl, int flag, char *zone)
-     }
- 
- 
--      strlcat (dn, tmp, sizeof (dn));
-+      strncat (dn, tmp, sizeof (dn) - strlen (dn));
-     }
- 
-   sprintf (tmp, "dc=%s", dc_list[0]);
--  strlcat (dn, tmp, sizeof (dn));
-+  strncat (dn, tmp, sizeof (dn) - strlen (dn));
- 
- 	    fflush(NULL);
-   return dn;

SOURCES/bind-9.11-dhcp-time-monotonic.patch

@@ -1,171 +0,0 @@
-diff --git a/lib/isc/include/isc/result.h b/lib/isc/include/isc/result.h
-index 0389efa..149cde5 100644
---- a/lib/isc/include/isc/result.h
-+++ b/lib/isc/include/isc/result.h
-@@ -89,7 +89,8 @@
- #define ISC_R_DISCFULL			67	/*%< disc full */
- #define ISC_R_DEFAULT			68	/*%< default */
- #define ISC_R_IPV4PREFIX		69	/*%< IPv4 prefix */
--#define ISC_R_NRESULTS 			70
-+#define ISC_R_TIMESHIFTED               70      /*%< system time changed */
-+#define ISC_R_NRESULTS 			71
- 
- ISC_LANG_BEGINDECLS
- 
-diff --git a/lib/isc/include/isc/util.h b/lib/isc/include/isc/util.h
-index 973c348..cceeb5e 100644
---- a/lib/isc/include/isc/util.h
-+++ b/lib/isc/include/isc/util.h
-@@ -289,6 +289,10 @@ extern void mock_assert(const int result, const char* const expression,
-  * Time
-  */
- #define TIME_NOW(tp) 	RUNTIME_CHECK(isc_time_now((tp)) == ISC_R_SUCCESS)
-+#ifdef CLOCK_BOOTTIME
-+#define TIME_MONOTONIC(tp) 	RUNTIME_CHECK(isc_time_boottime((tp)) == ISC_R_SUCCESS)
-+#endif
-+
- 
- /*%
-  * Alignment
-diff --git a/lib/isc/result.c b/lib/isc/result.c
-index a9db132..f33fc6b 100644
---- a/lib/isc/result.c
-+++ b/lib/isc/result.c
-@@ -105,6 +105,7 @@ static const char *description[ISC_R_NRESULTS] = {
- 	"disc full",				/*%< 67 */
- 	"default",				/*%< 68 */
- 	"IPv4 prefix",				/*%< 69 */
-+	"time changed",                         /*%< 70 */
- };
- 
- static const char *identifier[ISC_R_NRESULTS] = {
-@@ -178,6 +179,7 @@ static const char *identifier[ISC_R_NRESULTS] = {
- 	"ISC_R_DISCFULL",
- 	"ISC_R_DEFAULT",
- 	"ISC_R_IPV4PREFIX",
-+	"ISC_R_TIMESHIFTED",
- };
- 
- #define ISC_RESULT_RESULTSET			2
-diff --git a/lib/isc/unix/app.c b/lib/isc/unix/app.c
-index a6e9882..286fe95 100644
---- a/lib/isc/unix/app.c
-+++ b/lib/isc/unix/app.c
-@@ -442,15 +442,47 @@ isc__app_ctxonrun(isc_appctx_t *ctx0, isc_mem_t *mctx, isc_task_t *task,
- static isc_result_t
- evloop(isc__appctx_t *ctx) {
- 	isc_result_t result;
-+        isc_time_t now;
-+#ifdef CLOCK_BOOTTIME
-+        isc_time_t monotonic;
-+        isc_uint64_t diff  = 0;
-+#else
-+        isc_time_t prev;
-+        TIME_NOW(&prev);
-+#endif
- 
- 	while (!ctx->want_shutdown) {
- 		int n;
--		isc_time_t when, now;
-+		isc_time_t when;
- 		struct timeval tv, *tvp;
- 		isc_socketwait_t *swait;
- 		bool readytasks;
- 		bool call_timer_dispatch = false;
- 
-+                uint64_t us; 
-+
-+#ifdef CLOCK_BOOTTIME
-+                // TBD macros for following three lines
-+                TIME_NOW(&now);
-+                TIME_MONOTONIC(&monotonic);
-+                INSIST(now.seconds > monotonic.seconds)
-+                us = isc_time_microdiff (&now, &monotonic);
-+                if (us < diff){
-+                  us = diff - us;
-+                  if (us > 1000000){ // ignoring shifts less than one second
-+                    return ISC_R_TIMESHIFTED;
-+                  };
-+                  diff = isc_time_microdiff (&now, &monotonic);
-+                } else {
-+                  diff = isc_time_microdiff (&now, &monotonic);
-+                  // not implemented
-+                }
-+#else
-+                TIME_NOW(&now);
-+                if (isc_time_compare (&now, &prev) < 0)
-+                  return ISC_R_TIMESHIFTED;
-+                TIME_NOW(&prev);
-+#endif
- 		/*
- 		 * Check the reload (or suspend) case first for exiting the
- 		 * loop as fast as possible in case:
-@@ -475,7 +507,6 @@ evloop(isc__appctx_t *ctx) {
- 			if (result != ISC_R_SUCCESS)
- 				tvp = NULL;
- 			else {
--				uint64_t us;
- 
- 				TIME_NOW(&now);
- 				us = isc_time_microdiff(&when, &now);
-diff --git a/lib/isc/unix/include/isc/time.h b/lib/isc/unix/include/isc/time.h
-index b864c29..5dd43c9 100644
---- a/lib/isc/unix/include/isc/time.h
-+++ b/lib/isc/unix/include/isc/time.h
-@@ -132,6 +132,26 @@ isc_time_isepoch(const isc_time_t *t);
-  *\li	't' is a valid pointer.
-  */
- 
-+#ifdef CLOCK_BOOTTIME
-+isc_result_t
-+isc_time_boottime(isc_time_t *t);
-+/*%<
-+ * Set 't' to monotonic time from previous boot
-+ * it's not affected by system time change. It also
-+ * includes the time system was suspended
-+ *
-+ * Requires:
-+ *\li	't' is a valid pointer.
-+ *
-+ * Returns:
-+ *
-+ *\li	Success
-+ *\li	Unexpected error
-+ *		Getting the time from the system failed.
-+ */
-+#endif /* CLOCK_BOOTTIME */
-+ 
-+
- isc_result_t
- isc_time_now(isc_time_t *t);
- /*%<
-diff --git a/lib/isc/unix/time.c b/lib/isc/unix/time.c
-index 8edc9df..fe0bb91 100644
---- a/lib/isc/unix/time.c
-+++ b/lib/isc/unix/time.c
-@@ -498,3 +498,25 @@ isc_time_formatISO8601ms(const isc_time_t *t, char *buf, unsigned int len) {
- 			 t->nanoseconds / NS_PER_MS);
- 	}
- }
-+
-+
-+#ifdef CLOCK_BOOTTIME
-+isc_result_t
-+isc_time_boottime(isc_time_t *t) {
-+  struct timespec ts;
-+  
-+  char strbuf[ISC_STRERRORSIZE];
-+
-+  if (clock_gettime (CLOCK_BOOTTIME, &ts) != 0){
-+    isc__strerror(errno, strbuf, sizeof(strbuf));
-+    UNEXPECTED_ERROR(__FILE__, __LINE__, "%s", strbuf);
-+    return (ISC_R_UNEXPECTED);    
-+  }
-+
-+  t->seconds = ts.tv_sec;
-+  t->nanoseconds = ts.tv_nsec;
-+
-+  return (ISC_R_SUCCESS);
-+  
-+};
-+#endif

SOURCES/bind-9.11-engine-pkcs11.patch

@@ -1,27 +0,0 @@
-From 37f89ccfc439f8d86c401d9ae10e94e53b924961 Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Tue, 27 Aug 2019 20:39:59 +0200
-Subject: [PATCH] Do not set engine for native PKCS11
-
-It resets already set lib_path to pkcs11, which is invalid in native
-pkcs11 crypto. Engine has to be path to PKCS#11 module.
----
- bin/named/include/named/globals.h | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/bin/named/include/named/globals.h b/bin/named/include/named/globals.h
-index eda2214..2a611d5 100644
---- a/bin/named/include/named/globals.h
-+++ b/bin/named/include/named/globals.h
-@@ -160,7 +160,7 @@ EXTERN const char *		ns_g_defaultdnstap	INIT(NULL);
- 
- EXTERN const char *		ns_g_username		INIT(NULL);
- 
--#if defined(USE_PKCS11)
-+#if defined(USE_PKCS11) && !defined(PKCS11CRYPTO)
- EXTERN const char *		ns_g_engine		INIT(PKCS11_ENGINE);
- #else
- EXTERN const char *		ns_g_engine		INIT(NULL);
--- 
-2.20.1
-

SOURCES/bind-9.11-export-suffix.patch

@@ -1,39 +0,0 @@
-diff --git a/configure.ac b/configure.ac
-index c1bfd62..7c5ad51 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -5333,6 +5333,8 @@ AC_SUBST(BUILD_CPPFLAGS)
- AC_SUBST(BUILD_LDFLAGS)
- AC_SUBST(BUILD_LIBS)
- 
-+AC_SUBST(LIBDIR_SUFFIX)
-+
- #
- # Commands to run at the end of config.status.
- # Don't just put these into configure, it won't work right if somebody
-diff --git a/isc-config.sh.in b/isc-config.sh.in
-index b5e94ed..d2857e0 100644
---- a/isc-config.sh.in
-+++ b/isc-config.sh.in
-@@ -13,16 +13,17 @@ prefix=@prefix@
- exec_prefix=@exec_prefix@
- exec_prefix_set=
- includedir=@includedir@
-+libdir_suffix=@LIBDIR_SUFFIX@
- arch=$(uname -m)
- 
- case $arch in
- 	x86_64 | amd64 | sparc64 | s390x | ppc64)
--		libdir=/usr/lib64
--		sec_libdir=/usr/lib
-+		libdir=/usr/lib64${libdir_suffix}
-+		sec_libdir=/usr/lib${libdir_suffix}
- 		;;
- 	* )
--		libdir=/usr/lib
--		sec_libdir=/usr/lib64
-+		libdir=/usr/lib${libdir_suffix}
-+		sec_libdir=/usr/lib64${libdir_suffix}
- 		;;
- esac
- 

SOURCES/bind-9.11-feature-test-named.patch

@@ -0,0 +1,59 @@
+From e645046202006750f87531e21e3ff7c26fba3466 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
+Date: Wed, 30 Jan 2019 14:37:17 +0100
+Subject: [PATCH] Create feature-test in source directory
+
+Feature-test tool is used in system tests to test compiled in changes.
+Because we build more variants of named with different configuration,
+compile feature-test for each of them this way.
+---
+ bin/named/Makefile.in       | 12 +++++++++++-
+ bin/tests/system/conf.sh.in |  2 +-
+ 2 files changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
+index 37053a7..ed9add2 100644
+--- a/bin/named/Makefile.in
++++ b/bin/named/Makefile.in
+@@ -91,7 +91,7 @@ NOSYMLIBS =	${NSLIBS} ${DNSLIBS} ${BIND9LIBS} \
+ 
+ SUBDIRS =	unix
+ 
+-TARGETS =	named@EXEEXT@
++TARGETS =	named@EXEEXT@ feature-test@EXEEXT@
+ 
+ GEOIP2LINKOBJS = geoip.@O@
+ 
+@@ -154,6 +154,16 @@ named@EXEEXT@: ${OBJS} ${DEPLIBS}
+ 	export BASEOBJS="${OBJS} ${UOBJS}"; \
+ 	${FINALBUILDCMD}
+ 
++# Bit of hack, do not produce intermediate .o object for featuretest
++feature-test.@O@: ${top_srcdir}/bin/tests/system/feature-test.c
++	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} \
++		-c ${top_srcdir}/bin/tests/system/feature-test.c
++
++feature-test@EXEEXT@: feature-test.@O@
++	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} \
++		-o $@ feature-test.@O@ ${ISCLIBS} ${LIBS}
++
++
+ clean distclean maintainer-clean::
+ 	rm -f ${TARGETS} ${OBJS}
+ 
+diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
+index 7934930..e84fde2 100644
+--- a/bin/tests/system/conf.sh.in
++++ b/bin/tests/system/conf.sh.in
+@@ -37,7 +37,7 @@ DELV=$TOP/bin/delv/delv
+ DIG=$TOP/bin/dig/dig
+ DNSTAPREAD=$TOP/bin/tools/dnstap-read
+ DSFROMKEY=$TOP/bin/dnssec/dnssec-dsfromkey
+-FEATURETEST=$TOP/bin/tests/system/feature-test
++FEATURETEST=$TOP/bin/named/feature-test
+ FSTRM_CAPTURE=@FSTRM_CAPTURE@
+ HOST=$TOP/bin/dig/host
+ IMPORTKEY=$TOP/bin/dnssec/dnssec-importkey
+-- 
+2.26.2
+

SOURCES/bind-9.11-fips-code-includes.patch

@@ -1,39 +0,0 @@
-From c928591eb2a3b17c5be0cad56c8e061ebba11a95 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Thu, 20 Dec 2018 11:52:12 +0100
-Subject: [PATCH] Fix implicit declaration warning
-
-isc_md5_available() function is not declared before its use. Include
-header providing it in files that use it.
----
- bin/tests/system/tkey/keydelete.c | 1 +
- lib/dns/tsig.c                    | 1 +
- 2 files changed, 2 insertions(+)
-
-diff --git a/bin/tests/system/tkey/keydelete.c b/bin/tests/system/tkey/keydelete.c
-index 4b5b901..a3dd450 100644
---- a/bin/tests/system/tkey/keydelete.c
-+++ b/bin/tests/system/tkey/keydelete.c
-@@ -21,6 +21,7 @@
- #include <isc/hash.h>
- #include <isc/log.h>
- #include <isc/mem.h>
-+#include <isc/md5.h>
- #include <isc/print.h>
- #include <isc/sockaddr.h>
- #include <isc/socket.h>
-diff --git a/lib/dns/tsig.c b/lib/dns/tsig.c
-index c37b235..7786801 100644
---- a/lib/dns/tsig.c
-+++ b/lib/dns/tsig.c
-@@ -18,6 +18,7 @@
- 
- #include <isc/buffer.h>
- #include <isc/mem.h>
-+#include <isc/md5.h>
- #include <isc/print.h>
- #include <isc/print.h>
- #include <isc/refcount.h>
--- 
-2.26.2
-

SOURCES/bind-9.11-fips-disable.patch

@@ -1,121 +0,0 @@
-From 83b889c238282b210f874a3ad81bb56299767495 Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Mon, 5 Aug 2019 11:54:03 +0200
-Subject: [PATCH] Allow explicit disabling of autodisabled MD5
-
-Default security policy might include explicitly disabled RSAMD5
-algorithm. Current FIPS code automatically disables in FIPS mode. But if
-RSAMD5 is included in security policy, it fails to start, because that
-algorithm is not recognized. Allow it disabled, but fail on any
-other usage.
----
- bin/named/server.c |  4 ++--
- lib/bind9/check.c  |  4 ++++
- lib/dns/rcode.c    | 33 +++++++++++++++------------------
- 3 files changed, 21 insertions(+), 20 deletions(-)
-
-diff --git a/bin/named/server.c b/bin/named/server.c
-index 5b57371..51702ab 100644
---- a/bin/named/server.c
-+++ b/bin/named/server.c
-@@ -1547,12 +1547,12 @@ disable_algorithms(const cfg_obj_t *disabled, dns_resolver_t *resolver) {
- 		r.length = strlen(r.base);
- 
- 		result = dns_secalg_fromtext(&alg, &r);
--		if (result != ISC_R_SUCCESS) {
-+		if (result != ISC_R_SUCCESS && result != ISC_R_DISABLED) {
- 			uint8_t ui;
- 			result = isc_parse_uint8(&ui, r.base, 10);
- 			alg = ui;
- 		}
--		if (result != ISC_R_SUCCESS) {
-+		if (result != ISC_R_SUCCESS && result != ISC_R_DISABLED) {
- 			cfg_obj_log(cfg_listelt_value(element),
- 				    ns_g_lctx, ISC_LOG_ERROR,
- 				    "invalid algorithm");
-diff --git a/lib/bind9/check.c b/lib/bind9/check.c
-index e0803d4..8023784 100644
---- a/lib/bind9/check.c
-+++ b/lib/bind9/check.c
-@@ -302,6 +302,10 @@ disabled_algorithms(const cfg_obj_t *disabled, isc_log_t *logctx) {
- 		r.length = strlen(r.base);
- 
- 		tresult = dns_secalg_fromtext(&alg, &r);
-+		if (tresult == ISC_R_DISABLED) {
-+			// Recognize disabled algorithms, disable it explicitly
-+			tresult = ISC_R_SUCCESS;
-+		}
- 		if (tresult != ISC_R_SUCCESS) {
- 			cfg_obj_log(cfg_listelt_value(element), logctx,
- 				    ISC_LOG_ERROR, "invalid algorithm '%s'",
-diff --git a/lib/dns/rcode.c b/lib/dns/rcode.c
-index f51d548..c49b8d1 100644
---- a/lib/dns/rcode.c
-+++ b/lib/dns/rcode.c
-@@ -126,7 +126,6 @@
- #endif
- 
- #define SECALGNAMES \
--	MD5_SECALGNAMES \
- 	DH_SECALGNAMES \
- 	DSA_SECALGNAMES \
- 	{ DNS_KEYALG_ECC, "ECC", 0 }, \
-@@ -178,6 +177,7 @@ static struct tbl rcodes[] = { RCODENAMES ERCODENAMES };
- static struct tbl tsigrcodes[] = { RCODENAMES TSIGRCODENAMES };
- static struct tbl certs[] = { CERTNAMES };
- static struct tbl secalgs[] = { SECALGNAMES };
-+static struct tbl md5_secalgs[] = { MD5_SECALGNAMES };
- static struct tbl secprotos[] = { SECPROTONAMES };
- static struct tbl hashalgs[] = { HASHALGNAMES };
- static struct tbl dsdigests[] = { DSDIGESTNAMES };
-@@ -358,33 +358,30 @@ dns_cert_totext(dns_cert_t cert, isc_buffer_t *target) {
- 	return (dns_mnemonic_totext(cert, target, certs));
- }
- 
--static inline struct tbl *
--secalgs_tbl_start() {
--	struct tbl *algs = secalgs;
--
--#ifndef PK11_MD5_DISABLE
--	if (!isc_md5_available()) {