127 changed files with 17424 additions and 26333 deletions
--- a/.bind.metadata
+++ b/.bind.metadata
@ -1,2 +1 @@
-4b45d15edc1e3b7902129ce27baec58a50d76b5c SOURCES/bind-9.11.36.tar.gz
-a164fcad1d64d6b5fab5034928cb7260f1fa8fdd SOURCES/random.data
+a10542aaabad60bbbb8d19efd43591c98c01c277 SOURCES/bind-9.16.50.tar.xz
--- a/.gitignore
+++ b/.gitignore
@ -1,2 +1 @@
-SOURCES/bind-9.11.36.tar.gz
-SOURCES/random.data
+SOURCES/bind-9.16.50.tar.xz
--- a/SOURCES/README.sdb_pgsql
+++ b/SOURCES/README.sdb_pgsql
@ -1,79 +0,0 @@
-			PGSQL BIND SDB driver
-
-The postgresql BIND SDB driver is of experimental status and should not be 
-used for production systems.
-
-Usage:
-
-o Use the named_sdb process ( put ENABLE_SDB=yes in /etc/sysconfig/named )
-
-o Edit your named.conf to contain a database zone, eg. :
-  
-zone "pgdb.net." IN {
-        type master;
-        database "pgsql  bind        pgdb     localhost pguser pgpasswd";
-        #                ^- DB name  ^-Table  ^-host    ^-user ^-password
-};
-
-o Create the database zone table
-  The table must contain the columns "name", "rdtype", and "rdata", and
-  is expected to contain a properly constructed zone.  The program "zonetodb"
-  creates such a table.
-  
-  zonetodb usage:
-    
-    zonetodb origin file dbname dbtable
-
-    where
-	origin : zone origin, eg "pgdb.net."
-	file   : master zone database file, eg. pgdb.net.db
-	dbname : name of postgresql database 
-        dbtable: name of table in database
-
-    Eg. to import this zone in the file 'pgdb.net.db' into the 'bind' database 
-        'pgdb' table:
-
---
-#pgdb.net.db:
-$TTL 1H
-@       SOA     localhost.      root.localhost. (       1
-                                                3H
-                                                1H
-                                                1W
-                                                1H )
-        NS      localhost.
-host1   A       192.168.2.1
-host2   A       192.168.2.2
-host3   A       192.168.2.3
-host4   A       192.168.2.4
-host5   A       192.168.2.5
-host6   A       192.168.2.6
-host7   A       192.168.2.7
---
-
-Issue this command as the pgsql user authorized to update the bind database:
- 
-# zonetodb pgdb.net. pgdb.net.db bind pgdb
-
-will create / update the pgdb table in the 'bind' db:
-
-$ psql -dbind -c 'select * from pgdb;'
-      name      | ttl  | rdtype |                        rdata
----------------+------+--------+-----------------------------------------------------
- pgdb.net       | 3600 | SOA    | localhost. root.localhost. 1 10800 3600 604800 3600
- pgdb.net       | 3600 | NS     | localhost.
- host1.pgdb.net | 3600 | A      | 192.168.2.1
- host2.pgdb.net | 3600 | A      | 192.168.2.2
- host3.pgdb.net | 3600 | A      | 192.168.2.3
- host4.pgdb.net | 3600 | A      | 192.168.2.4
- host5.pgdb.net | 3600 | A      | 192.168.2.5
- host6.pgdb.net | 3600 | A      | 192.168.2.6
- host7.pgdb.net | 3600 | A      | 192.168.2.7
-(9 rows)
-
-I've tested exactly the above configuration with bind-sdb-9.3.1+ and it works OK.
-
-NOTE: If you use pgsqldb SDB, ensure the postgresql service is started before the named
-      service .
-
-USE AT YOUR OWN RISK!
--- a/SOURCES/bind-9.10-dist-native-pkcs11.patch
+++ b/SOURCES/bind-9.10-dist-native-pkcs11.patch
@ -1,68 +1,107 @@
+From 040227009453b3f0aa7914c7a6a94dc57ad5269b Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Thu, 21 Jan 2021 10:46:20 +0100
+Subject: [PATCH] Enable custom pkcs11 native build
+
+Share common parts like libisc, libcc and others. But provide native
+pkcs11 libraries as a new copy of libdns and libns.
+---
+ bin/Makefile.in                  |  2 +-
+ bin/confgen/Makefile.in          |  2 +-
+ bin/dnssec-pkcs11/Makefile.in    | 39 +++++++++++++++++---------------
+ bin/named-pkcs11/Makefile.in     | 33 ++++++++++++++-------------
+ configure.ac                     | 19 ++++++++++++++++
+ lib/Makefile.in                  |  2 +-
+ lib/dns-pkcs11/Makefile.in       | 22 +++++++++---------
+ lib/dns-pkcs11/tests/Makefile.in |  8 +++----
+ lib/ns-pkcs11/Makefile.in        | 26 ++++++++++-----------
+ lib/ns-pkcs11/tests/Makefile.in  | 12 +++++-----
+ make/includes.in                 |  7 ++++++
+ 11 files changed, 101 insertions(+), 71 deletions(-)
+
 diff --git a/bin/Makefile.in b/bin/Makefile.in
-index a18b222..26a7e4e 100644
+index 9ad7f62..094775a 100644
 --- a/bin/Makefile.in
 +++ b/bin/Makefile.in
-@@ -11,8 +11,8 @@ srcdir =	@srcdir@
+@@ -11,7 +11,7 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 
 -SUBDIRS =	named rndc dig delv dnssec tools nsupdate check confgen \
-		@NZD_TOOLS@ @PYTHON_TOOLS@ @PKCS11_TOOLS@ tests
-+SUBDIRS =	named named-pkcs11 rndc dig delv dnssec dnssec-pkcs11 tools nsupdate \
-+		check confgen @NZD_TOOLS@ @PYTHON_TOOLS@ @PKCS11_TOOLS@ tests
+SUBDIRS =	named named-pkcs11 rndc dig delv dnssec dnssec-pkcs11 tools nsupdate check confgen \
+ 		@NZD_TOOLS@ @PYTHON_TOOLS@ @PKCS11_TOOLS@ plugins tests
 TARGETS =
 
- @BIND9_MAKE_RULES@
+diff --git a/bin/confgen/Makefile.in b/bin/confgen/Makefile.in
+index c126bf3..1b7512d 100644
+--- a/bin/confgen/Makefile.in
+++ b/bin/confgen/Makefile.in
+@@ -22,7 +22,7 @@ VERSION=@BIND9_VERSION@
+ CINCLUDES = -I${srcdir}/include ${ISC_INCLUDES} ${ISCCC_INCLUDES} \
+ 	${ISCCFG_INCLUDES} ${DNS_INCLUDES} ${BIND9_INCLUDES}
+ 
+-CDEFINES = @USE_PKCS11@
+CDEFINES =
+ CWARNINGS =
+ 
+ ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
 diff --git a/bin/dnssec-pkcs11/Makefile.in b/bin/dnssec-pkcs11/Makefile.in
-index 390aa0c..e59a118 100644
+index ace0e5a..e0f6a00 100644
 --- a/bin/dnssec-pkcs11/Makefile.in
 +++ b/bin/dnssec-pkcs11/Makefile.in
@@ -15,18 +15,18 @@ VERSION=@BIND9_VERSION@
 
 @BIND9_MAKE_INCLUDES@
 
-CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} @DST_OPENSSL_INC@
-+CINCLUDES =	${DNS_PKCS11_INCLUDES} ${ISC_PKCS11_INCLUDES}
+-CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} ${ISCCFG_INCLUDES} \
+CINCLUDES =	${DNS_PKCS11_INCLUDES} ${ISC_INCLUDES} ${ISCCFG_INCLUDES} \
+ 		${OPENSSL_CFLAGS}
 
-CDEFINES =	-DVERSION=\"${VERSION}\" @USE_PKCS11@ @PKCS11_ENGINE@ \
-		@CRYPTO@ -DPK11_LIB_LOCATION=\"@PKCS11_PROVIDER@\"
-+CDEFINES =	-DVERSION=\"${VERSION}\" @PKCS11_ENGINE@ \
-+		@CRYPTO_PK11@ -DPK11_LIB_LOCATION=\"@PKCS11_PROVIDER@\"
+-CDEFINES =	-DVERSION=\"${VERSION}\" -DNAMED_CONFFILE=\"${sysconfdir}/named.conf\"
+CDEFINES =	-DVERSION=\"${VERSION}\" -DNAMED_CONFFILE=\"${sysconfdir}/named.conf\" -DUSE_PKCS11=1
 CWARNINGS =
 
-DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
-ISCLIBS =	../../lib/isc/libisc.@A@
-ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@
-+DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
-+ISCLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
-+ISCNOSYMLIBS =	../../lib/isc-pkcs11/libisc-pkcs11-nosymtbl.@A@
+-DNSLIBS =	../../lib/dns/libdns.@A@ @NO_LIBTOOL_DNSLIBS@
+DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ @NO_LIBTOOL_DNSLIBS@
+ ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
+ ISCLIBS =	../../lib/isc/libisc.@A@ @NO_LIBTOOL_ISCLIBS@
+ ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @NO_LIBTOOL_ISCLIBS@
 
 -DNSDEPLIBS =	../../lib/dns/libdns.@A@
-ISCDEPLIBS =	../../lib/isc/libisc.@A@
 +DNSDEPLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@
-+ISCDEPLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
+ ISCDEPLIBS =	../../lib/isc/libisc.@A@
+ ISCCFGDEPLIBS =	../../lib/isccfg/libisccfg.@A@
 
- DEPLIBS =	${DNSDEPLIBS} ${ISCDEPLIBS}
+@@ -36,12 +36,15 @@ LIBS =		${DNSLIBS} ${ISCCFGLIBS} ${ISCLIBS} @LIBS@
 
-@@ -35,10 +35,10 @@ LIBS =		${DNSLIBS} ${ISCLIBS} @LIBS@
- NOSYMLIBS =	${DNSLIBS} ${ISCNOSYMLIBS} @LIBS@
+ NOSYMLIBS =	${DNSLIBS} ${ISCCFGLIBS} ${ISCNOSYMLIBS} @LIBS@
 
+# Add suffix to all targets
+EXEEXT =	-pkcs11@EXEEXT@
+
 # Alphabetically
-TARGETS =	dnssec-keygen@EXEEXT@ dnssec-signzone@EXEEXT@ \
-		dnssec-keyfromlabel@EXEEXT@ dnssec-dsfromkey@EXEEXT@ \
-		dnssec-revoke@EXEEXT@ dnssec-settime@EXEEXT@ \
-		dnssec-verify@EXEEXT@ dnssec-importkey@EXEEXT@
-+TARGETS =	dnssec-keygen-pkcs11@EXEEXT@ dnssec-signzone-pkcs11@EXEEXT@ \
-+		dnssec-keyfromlabel-pkcs11@EXEEXT@ dnssec-dsfromkey-pkcs11@EXEEXT@ \
-+		dnssec-revoke-pkcs11@EXEEXT@ dnssec-settime-pkcs11@EXEEXT@ \
-+		dnssec-verify-pkcs11@EXEEXT@ dnssec-importkey-pkcs11@EXEEXT@
+-TARGETS =	dnssec-cds@EXEEXT@ dnssec-dsfromkey@EXEEXT@ \
+-		dnssec-importkey@EXEEXT@ dnssec-keyfromlabel@EXEEXT@ \
+-		dnssec-keygen@EXEEXT@ dnssec-revoke@EXEEXT@ \
+-		dnssec-settime@EXEEXT@ dnssec-signzone@EXEEXT@ \
+-		dnssec-verify@EXEEXT@
+TARGETS =	dnssec-cds${EXEEXT} dnssec-dsfromkey${EXEEXT} \
+		dnssec-importkey${EXEEXT} dnssec-keyfromlabel${EXEEXT} \
+		dnssec-keygen${EXEEXT} dnssec-revoke${EXEEXT} \
+		dnssec-settime${EXEEXT} dnssec-signzone${EXEEXT} \
+		dnssec-verify${EXEEXT}
 
 OBJS =		dnssectool.@O@
 
-@@ -59,15 +59,15 @@ MANOBJS =	${MANPAGES} ${HTMLPAGES}
+@@ -52,19 +55,19 @@ SRCS =		dnssec-cds.c dnssec-dsfromkey.c dnssec-importkey.c \
 
 @BIND9_MAKE_RULES@
 
+-dnssec-cds@EXEEXT@: dnssec-cds.@O@ ${OBJS} ${DEPLIBS}
+dnssec-cds-pkcs11@EXEEXT@: dnssec-cds.@O@ ${OBJS} ${DEPLIBS}
+ 	export BASEOBJS="dnssec-cds.@O@ ${OBJS}"; \
+ 	${FINALBUILDCMD}
+ 
 -dnssec-dsfromkey@EXEEXT@: dnssec-dsfromkey.@O@ ${OBJS} ${DEPLIBS}
 +dnssec-dsfromkey-pkcs11@EXEEXT@: dnssec-dsfromkey.@O@ ${OBJS} ${DEPLIBS}
 	export BASEOBJS="dnssec-dsfromkey.@O@ ${OBJS}"; \
@ -78,7 +117,7 @@ index 390aa0c..e59a118 100644
 	export BASEOBJS="dnssec-keygen.@O@ ${OBJS}"; \
 	${FINALBUILDCMD}
 
-@@ -75,7 +75,7 @@ dnssec-signzone.@O@: dnssec-signzone.c
+@@ -72,7 +75,7 @@ dnssec-signzone.@O@: dnssec-signzone.c
 	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} -DVERSION=\"${VERSION}\" \
 		-c ${srcdir}/dnssec-signzone.c
 
@ -87,7 +126,7 @@ index 390aa0c..e59a118 100644
 	export BASEOBJS="dnssec-signzone.@O@ ${OBJS}"; \
 	${FINALBUILDCMD}
 
-@@ -83,19 +83,19 @@ dnssec-verify.@O@: dnssec-verify.c
+@@ -80,19 +83,19 @@ dnssec-verify.@O@: dnssec-verify.c
 	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} -DVERSION=\"${VERSION}\" \
 		-c ${srcdir}/dnssec-verify.c
 
@ -111,117 +150,70 @@ index 390aa0c..e59a118 100644
 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \
 	dnssec-importkey.@O@ ${OBJS} ${LIBS}
 
-@@ -106,16 +106,14 @@ docclean manclean maintainer-clean::
- 
- installdirs:
- 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
-	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
- 
- install-man8: ${MANPAGES}
- 	${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man8
- 
-install:: ${TARGETS} installdirs install-man8
-+install:: ${TARGETS} installdirs
- 	for t in ${TARGETS}; do ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} $$t ${DESTDIR}${sbindir} || exit 1; done
- 
- uninstall::
-	for m in ${MANPAGES}; do rm -f ${DESTDIR}${mandir}/man8/$$m || exit 1; done
- 	for t in ${TARGETS}; do ${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/$$t || exit 1; done
- 
- clean distclean::
-diff --git a/bin/dnssec/Makefile.in b/bin/dnssec/Makefile.in
-index 390aa0c..851a008 100644
--- a/bin/dnssec/Makefile.in
-+++ b/bin/dnssec/Makefile.in
-@@ -17,7 +17,7 @@ VERSION=@BIND9_VERSION@
- 
- CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} @DST_OPENSSL_INC@
- 
-CDEFINES =	-DVERSION=\"${VERSION}\" @USE_PKCS11@ @PKCS11_ENGINE@ \
-+CDEFINES =	-DVERSION=\"${VERSION}\" \
- 		@CRYPTO@ -DPK11_LIB_LOCATION=\"@PKCS11_PROVIDER@\"
- CWARNINGS =
- 
 diff --git a/bin/named-pkcs11/Makefile.in b/bin/named-pkcs11/Makefile.in
-index 277a0f5..52a6375 100644
+index 98125dd..518a75f 100644
 --- a/bin/named-pkcs11/Makefile.in
 +++ b/bin/named-pkcs11/Makefile.in
-@@ -43,27 +43,27 @@ DLZDRIVER_INCLUDES =	@DLZ_DRIVER_INCLUDES@
- DLZDRIVER_LIBS =	@DLZ_DRIVER_LIBS@
+@@ -37,13 +37,14 @@ DBDRIVER_LIBS =
+ 
+ DLZ_DRIVER_DIR =	${top_srcdir}/contrib/dlz/drivers
+ 
+-DLZDRIVER_OBJS =	@DLZ_DRIVER_OBJS@
+-DLZDRIVER_SRCS =	@DLZ_DRIVER_SRCS@
+-DLZDRIVER_INCLUDES =	@DLZ_DRIVER_INCLUDES@
+-DLZDRIVER_LIBS =	@DLZ_DRIVER_LIBS@
+# Skip building on PKCS11 variant
+DLZDRIVER_OBJS =
+DLZDRIVER_SRCS =
+DLZDRIVER_INCLUDES =
+DLZDRIVER_LIBS =
 
 CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
-		${LWRES_INCLUDES} ${DNS_INCLUDES} ${BIND9_INCLUDES} \
-		${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} ${ISC_INCLUDES} \
-+		${LWRES_INCLUDES} ${DNS_PKCS11_INCLUDES} ${BIND9_INCLUDES} \
-+		${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} ${ISC_PKCS11_INCLUDES} \
- 		${DLZDRIVER_INCLUDES} ${DBDRIVER_INCLUDES} ${MAXMINDDB_CFLAGS} \
- 		@DST_OPENSSL_INC@
+-		${NS_INCLUDES} ${DNS_INCLUDES} \
+		${NS_PKCS11_INCLUDES} ${DNS_PKCS11_INCLUDES} \
+ 		${BIND9_INCLUDES} ${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} \
+ 		${ISC_INCLUDES} ${DLZDRIVER_INCLUDES} \
+ 		${DBDRIVER_INCLUDES} \
+@@ -56,24 +57,24 @@ CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
+ 		${LIBXML2_CFLAGS} \
+ 		${MAXMINDDB_CFLAGS}
 
-CDEFINES =      @CONTRIB_DLZ@ @USE_PKCS11@ @PKCS11_ENGINE@ @CRYPTO@
-+CDEFINES =      @USE_PKCS11@ @PKCS11_ENGINE@ @CRYPTO_PK11@ @USE_GSSAPI@
+-CDEFINES =      @CONTRIB_DLZ@
+CDEFINES =
 
 CWARNINGS =
 
-DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
-+DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
+-DNSLIBS =	../../lib/dns/libdns.@A@ @NO_LIBTOOL_DNSLIBS@
+DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ @NO_LIBTOOL_DNSLIBS@
 ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
 ISCCCLIBS =	../../lib/isccc/libisccc.@A@
-ISCLIBS =	../../lib/isc/libisc.@A@
-ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@
-+ISCLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
-+ISCNOSYMLIBS =	../../lib/isc-pkcs11/libisc-pkcs11-nosymtbl.@A@
- LWRESLIBS =	../../lib/lwres/liblwres.@A@
+ ISCLIBS =	../../lib/isc/libisc.@A@ @NO_LIBTOOL_ISCLIBS@
+ ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @NO_LIBTOOL_ISCLIBS@
 BIND9LIBS =	../../lib/bind9/libbind9.@A@
+-NSLIBS =	../../lib/ns/libns.@A@
+NSLIBS =	../../lib/ns-pkcs11/libns-pkcs11.@A@
 
 -DNSDEPLIBS =	../../lib/dns/libdns.@A@
 +DNSDEPLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@
 ISCCFGDEPLIBS =	../../lib/isccfg/libisccfg.@A@
 ISCCCDEPLIBS =	../../lib/isccc/libisccc.@A@
-ISCDEPLIBS =	../../lib/isc/libisc.@A@
-+ISCDEPLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
- LWRESDEPLIBS =	../../lib/lwres/liblwres.@A@
+ ISCDEPLIBS =	../../lib/isc/libisc.@A@
 BIND9DEPLIBS =	../../lib/bind9/libbind9.@A@
+-NSDEPLIBS =	../../lib/ns/libns.@A@
+NSDEPLIBS =	../../lib/ns-pkcs11/libns-pkcs11.@A@
 
-@@ -72,15 +72,15 @@ DEPLIBS =	${LWRESDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
- 
- LIBS =		${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
- 		${ISCCFGLIBS} ${ISCCCLIBS} ${ISCLIBS} \
-		${DLZDRIVER_LIBS} ${DBDRIVER_LIBS} @LIBS@
-+		@LIBS@
- 
- NOSYMLIBS =	${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
- 		${ISCCFGLIBS} ${ISCCCLIBS} ${ISCNOSYMLIBS} \
-		${DLZDRIVER_LIBS} ${DBDRIVER_LIBS} @LIBS@
-+		@LIBS@
+ DEPLIBS =	${NSDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
+ 		${ISCCFGDEPLIBS} ${ISCCCDEPLIBS} ${ISCDEPLIBS}
+@@ -93,7 +94,7 @@ NOSYMLIBS =	${NSLIBS} ${DNSLIBS} ${BIND9LIBS} \
 
 SUBDIRS =	unix
 
-TARGETS =	named@EXEEXT@ lwresd@EXEEXT@
-+TARGETS =	named-pkcs11@EXEEXT@
+-TARGETS =	named@EXEEXT@ feature-test@EXEEXT@
+TARGETS =	named-pkcs11@EXEEXT@ feature-test-pkcs11@EXEEXT@
 
- GEOIPLINKOBJS = geoip.@O@
 GEOIP2LINKOBJS = geoip.@O@
-@@ -94,8 +94,7 @@ OBJS =		builtin.@O@ client.@O@ config.@O@ control.@O@ \
- 		tkeyconf.@O@ tsigconf.@O@ update.@O@ xfrout.@O@ \
- 		zoneconf.@O@ \
- 		lwaddr.@O@ lwresd.@O@ lwdclient.@O@ lwderror.@O@ lwdgabn.@O@ \
-		lwdgnba.@O@ lwdgrbn.@O@ lwdnoop.@O@ lwsearch.@O@ \
-		${DLZDRIVER_OBJS} ${DBDRIVER_OBJS}
-+        lwdgnba.@O@ lwdgrbn.@O@ lwdnoop.@O@ lwsearch.@O@
 
- UOBJS =		unix/os.@O@ unix/dlz_dlopen_driver.@O@
- 
-@@ -113,8 +112,7 @@ SRCS =		builtin.c client.c config.c control.c \
- 		tkeyconf.c tsigconf.c update.c xfrout.c \
- 		zoneconf.c \
- 		lwaddr.c lwresd.c lwdclient.c lwderror.c lwdgabn.c \
-		lwdgnba.c lwdgrbn.c lwdnoop.c lwsearch.c \
-		${DLZDRIVER_SRCS} ${DBDRIVER_SRCS}
-+        lwdgnba.c lwdgrbn.c lwdnoop.c lwsearch.c
- 
- MANPAGES =	named.8 lwresd.8 named.conf.5
- 
-@@ -154,14 +152,14 @@ server.@O@: server.c
+@@ -151,7 +152,7 @@ server.@O@: server.c
 		-DPRODUCT=\"${PRODUCT}\" \
 		-DVERSION=\"${VERSION}\" -c ${srcdir}/server.c
 
@ -230,77 +222,38 @@ index 277a0f5..52a6375 100644
 	export MAKE_SYMTABLE="yes"; \
 	export BASEOBJS="${OBJS} ${UOBJS}"; \
 	${FINALBUILDCMD}
+@@ -161,7 +162,7 @@ feature-test.@O@: ${top_srcdir}/bin/tests/system/feature-test.c
+ 	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} \
+ 		-c ${top_srcdir}/bin/tests/system/feature-test.c
 
-lwresd@EXEEXT@: named@EXEEXT@
-+lwresd@EXEEXT@: named-pkcs11@EXEEXT@
- 	rm -f lwresd@EXEEXT@
-	@LN@ named@EXEEXT@ lwresd@EXEEXT@
-+	@LN@ named-pkcs11@EXEEXT@ lwresd@EXEEXT@
+-feature-test@EXEEXT@: feature-test.@O@
+feature-test-pkcs11@EXEEXT@: feature-test.@O@
+ 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} \
+ 		-o $@ feature-test.@O@ ${ISCLIBS} ${LIBS}
 
- doc man:: ${MANOBJS}
+@@ -180,11 +181,11 @@ statschannel.@O@: bind9.xsl.h
+ installdirs:
+ 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
 
-@@ -192,16 +190,11 @@ install-man8: named.8 lwresd.8
- 
- install-man: install-man5 install-man8
- 
-install:: named@EXEEXT@ lwresd@EXEEXT@ installdirs install-man
+-install:: named@EXEEXT@ installdirs
 -	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named@EXEEXT@ ${DESTDIR}${sbindir}
-	(cd ${DESTDIR}${sbindir}; rm -f lwresd@EXEEXT@; @LN@ named@EXEEXT@ lwresd@EXEEXT@)
 +install:: named-pkcs11@EXEEXT@ installdirs
 +	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named-pkcs11@EXEEXT@ ${DESTDIR}${sbindir}
 
 uninstall::
-	rm -f ${DESTDIR}${mandir}/man5/named.conf.5
-	rm -f ${DESTDIR}${mandir}/man8/lwresd.8
-	rm -f ${DESTDIR}${mandir}/man8/named.8
-	rm -f ${DESTDIR}${sbindir}/lwresd@EXEEXT@
 -	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/named@EXEEXT@
 +	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/named-pkcs11@EXEEXT@
 
 @DLZ_DRIVER_RULES@
 
-diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
-index 277a0f5..0e00885 100644
--- a/bin/named/Makefile.in
-+++ b/bin/named/Makefile.in
-@@ -48,7 +48,7 @@ CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
- 		${DLZDRIVER_INCLUDES} ${DBDRIVER_INCLUDES} ${MAXMINDDB_CFLAGS} \
- 		@DST_OPENSSL_INC@
- 
-CDEFINES =      @CONTRIB_DLZ@ @USE_PKCS11@ @PKCS11_ENGINE@ @CRYPTO@
-+CDEFINES =      @CONTRIB_DLZ@ @USE_GSSAPI@ @CRYPTO@
- 
- CWARNINGS =
- 
-diff --git a/bin/pkcs11/Makefile.in b/bin/pkcs11/Makefile.in
-index 2c19e7e..8223d5e 100644
--- a/bin/pkcs11/Makefile.in
-+++ b/bin/pkcs11/Makefile.in
-@@ -13,13 +13,13 @@ top_srcdir =	@top_srcdir@
- 
- @BIND9_MAKE_INCLUDES@
- 
-CINCLUDES =	${ISC_INCLUDES}
-+CINCLUDES =	${ISC_PKCS11_INCLUDES}
- 
- CDEFINES =
- 
-ISCLIBS =	../../lib/isc/libisc.@A@ @ISC_OPENSSL_LIBS@
-+ISCLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@ @ISC_OPENSSL_LIBS@
- 
-ISCDEPLIBS =	../../lib/isc/libisc.@A@
-+ISCDEPLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
- 
- DEPLIBS =	${ISCDEPLIBS}
- 
 diff --git a/configure.ac b/configure.ac
-index 83cad4a..e1e1a32 100644
+index 032228b..64e3da0 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -1178,12 +1178,14 @@ AC_SUBST(USE_GSSAPI)
+@@ -1251,12 +1251,14 @@ AC_SUBST(USE_GSSAPI)
 AC_SUBST(DST_GSSAPI_INC)
 AC_SUBST(DNS_GSSAPI_LIBS)
- DNS_CRYPTO_LIBS="$DNS_GSSAPI_LIBS $DNS_CRYPTO_LIBS"
+ DNS_CRYPTO_LIBS="$DNS_GSSAPI_LIBS"
 +DNS_CRYPTO_PK11_LIBS="$DNS_GSSAPI_LIBS $DNS_CRYPTO_PK11_LIBS"
 
 #
@ -311,98 +264,47 @@ index 83cad4a..e1e1a32 100644
 +AC_SUBST(DNS_CRYPTO_PK11_LIBS)
 
 #
- # was --with-randomdev specified?
-@@ -1556,12 +1558,12 @@ AC_ARG_ENABLE(openssl-hash,
- AC_MSG_CHECKING(for OpenSSL library)
- OPENSSL_WARNING=
- openssldirs="/usr /usr/local /usr/local/ssl /opt/local /usr/pkg /usr/sfw"
-if test "yes" = "$want_native_pkcs11"
-then
-	use_openssl="native_pkcs11"
-	want_openssl_hash="no"
-	AC_MSG_RESULT(use of native PKCS11 instead)
-fi
-+#if test "yes" = "$want_native_pkcs11"
-+#then
-+#	use_openssl="native_pkcs11"
-+#	want_openssl_hash="no"
-+#	AC_MSG_RESULT(use of native PKCS11 instead)
-+#fi
- 
- if test "auto" = "$use_openssl"
- then
-@@ -1574,6 +1576,7 @@ then
- 		fi
- 	done
+ # was --with-lmdb specified?
+@@ -2327,6 +2329,8 @@ AC_SUBST(BIND9_DNS_BUILDINCLUDE)
+ AC_SUBST(BIND9_NS_BUILDINCLUDE)
+ AC_SUBST(BIND9_BIND9_BUILDINCLUDE)
+ AC_SUBST(BIND9_IRS_BUILDINCLUDE)
+AC_SUBST(BIND9_DNS_PKCS11_BUILDINCLUDE)
+AC_SUBST(BIND9_NS_PKCS11_BUILDINCLUDE)
+ if test "X$srcdir" != "X"; then
+ 	BIND9_ISC_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/isc/include"
+ 	BIND9_ISCCC_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/isccc/include"
+@@ -2335,6 +2339,8 @@ if test "X$srcdir" != "X"; then
+ 	BIND9_NS_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/ns/include"
+ 	BIND9_BIND9_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/bind9/include"
+ 	BIND9_IRS_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/irs/include"
+	BIND9_DNS_PKCS11_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/dns-pkcs11/include"
+	BIND9_NS_PKCS11_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/ns-pkcs11/include"
+ else
+ 	BIND9_ISC_BUILDINCLUDE=""
+ 	BIND9_ISCCC_BUILDINCLUDE=""
+@@ -2343,6 +2349,8 @@ else
+ 	BIND9_NS_BUILDINCLUDE=""
+ 	BIND9_BIND9_BUILDINCLUDE=""
+ 	BIND9_IRS_BUILDINCLUDE=""
+	BIND9_DNS_PKCS11_BUILDINCLUDE=""
+	BIND9_NS_PKCS11_BUILDINCLUDE=""
 fi
-+CRYPTO_PK11=""
- OPENSSL_ECDSA=""
- OPENSSL_GOST=""
- OPENSSL_ED25519=""
-@@ -1595,11 +1598,10 @@ case "$with_gost" in
- 		;;
- esac
 
-case "$use_openssl" in
-	native_pkcs11)
-		AC_MSG_RESULT(disabled because of native PKCS11)
-+if test "$want_native_pkcs11" = "yes"
-+then
- 		DST_OPENSSL_INC=""
-		CRYPTO="-DPKCS11CRYPTO"
-+		CRYPTO_PK11="-DPKCS11CRYPTO"
- 		CRYPTOLIB="pkcs11"
- 		OPENSSLECDSALINKOBJS=""
- 		OPENSSLECDSALINKSRCS=""
-@@ -1609,7 +1611,9 @@ case "$use_openssl" in
- 		OPENSSLGOSTLINKSRCS=""
- 		OPENSSLLINKOBJS=""
- 		OPENSSLLINKSRCS=""
-		;;
-+fi
-+
-+case "$use_openssl" in
- 	no)
- 		AC_MSG_RESULT(no)
- 		DST_OPENSSL_INC=""
-@@ -1641,7 +1645,7 @@ case "$use_openssl" in
- If you do not want OpenSSL, use --without-openssl])
- 		;;
- 	*)
-		if test "yes" = "$want_native_pkcs11"
-+		if false # test "yes" = "$want_native_pkcs11"
- 		then
- 			AC_MSG_RESULT()
- 			AC_MSG_ERROR([OpenSSL and native PKCS11 cannot be used together.])
-@@ -2077,6 +2081,7 @@ AC_SUBST(OPENSSL_ED25519)
- AC_SUBST(OPENSSL_GOST)
- 
- DNS_CRYPTO_LIBS="$DNS_CRYPTO_LIBS $DST_OPENSSL_LIBS"
-+DNS_CRYPTO_PK11_LIBS="$DNS_CRYPTO_LIBS"
- 
- ISC_PLATFORM_WANTAES="#undef ISC_PLATFORM_WANTAES"
- if test "yes" = "$with_aes"
-@@ -2363,6 +2368,7 @@ esac
- AC_SUBST(PKCS11LINKOBJS)
- AC_SUBST(PKCS11LINKSRCS)
- AC_SUBST(CRYPTO)
-+AC_SUBST(CRYPTO_PK11)
- AC_SUBST(PKCS11_ECDSA)
- AC_SUBST(PKCS11_GOST)
- AC_SUBST(PKCS11_ED25519)
-@@ -5491,8 +5497,11 @@ AC_CONFIG_FILES([
+ AC_SUBST_FILE(BIND9_MAKE_INCLUDES)
+@@ -2798,8 +2806,11 @@ AC_CONFIG_FILES([
 	bin/delv/Makefile
 	bin/dig/Makefile
 	bin/dnssec/Makefile
-+	bin/dnssec-pkcs11/Makefile	
+	bin/dnssec-pkcs11/Makefile
 	bin/named/Makefile
 	bin/named/unix/Makefile
 +	bin/named-pkcs11/Makefile
 +	bin/named-pkcs11/unix/Makefile
 	bin/nsupdate/Makefile
 	bin/pkcs11/Makefile
- 	bin/python/Makefile
-@@ -5565,6 +5574,10 @@ AC_CONFIG_FILES([
+ 	bin/plugins/Makefile
+@@ -2861,6 +2872,10 @@ AC_CONFIG_FILES([
 	lib/dns/include/dns/Makefile
 	lib/dns/include/dst/Makefile
 	lib/dns/tests/Makefile
@ -413,73 +315,54 @@ index 83cad4a..e1e1a32 100644
 	lib/irs/Makefile
 	lib/irs/include/Makefile
 	lib/irs/include/irs/Makefile
-@@ -5589,6 +5602,24 @@ AC_CONFIG_FILES([
- 	lib/isc/unix/include/Makefile
- 	lib/isc/unix/include/isc/Makefile
- 	lib/isc/unix/include/pkcs11/Makefile
-+	lib/isc-pkcs11/$arch/Makefile
-+	lib/isc-pkcs11/$arch/include/Makefile
-+	lib/isc-pkcs11/$arch/include/isc/Makefile
-+	lib/isc-pkcs11/$thread_dir/Makefile
-+	lib/isc-pkcs11/$thread_dir/include/Makefile
-+	lib/isc-pkcs11/$thread_dir/include/isc/Makefile
-+	lib/isc-pkcs11/Makefile
-+	lib/isc-pkcs11/include/Makefile
-+	lib/isc-pkcs11/include/isc/Makefile
-+	lib/isc-pkcs11/include/isc/platform.h
-+	lib/isc-pkcs11/include/pk11/Makefile
-+	lib/isc-pkcs11/include/pkcs11/Makefile
-+	lib/isc-pkcs11/tests/Makefile
-+	lib/isc-pkcs11/nls/Makefile
-+	lib/isc-pkcs11/unix/Makefile
-+	lib/isc-pkcs11/unix/include/Makefile
-+	lib/isc-pkcs11/unix/include/isc/Makefile
-+	lib/isc-pkcs11/unix/include/pkcs11/Makefile
- 	lib/isccc/Makefile
- 	lib/isccc/include/Makefile
- 	lib/isccc/include/isccc/Makefile
+@@ -2893,6 +2908,10 @@ AC_CONFIG_FILES([
+ 	lib/ns/include/Makefile
+ 	lib/ns/include/ns/Makefile
+ 	lib/ns/tests/Makefile
+	lib/ns-pkcs11/Makefile
+	lib/ns-pkcs11/include/Makefile
+	lib/ns-pkcs11/include/ns/Makefile
+	lib/ns-pkcs11/tests/Makefile
+ 	make/Makefile
+ 	make/mkdep
+ 	unit/unittest.sh
 diff --git a/lib/Makefile.in b/lib/Makefile.in
-index f089bea..3ed939b 100644
+index 833964e..058ba2f 100644
 --- a/lib/Makefile.in
 +++ b/lib/Makefile.in
@@ -15,7 +15,7 @@ top_srcdir =	@top_srcdir@
 # Attempt to disable parallel processing.
 .NOTPARALLEL:
 .NO_PARALLEL:
-SUBDIRS =	isc isccc dns isccfg bind9 lwres irs samples
-+SUBDIRS =	isc isc-pkcs11 isccc dns dns-pkcs11 isccfg bind9 lwres irs samples
+-SUBDIRS =	isc isccc dns ns isccfg bind9 irs
+SUBDIRS =	isc isccc dns dns-pkcs11 ns ns-pkcs11 isccfg bind9 irs
 TARGETS =
 
 @BIND9_MAKE_RULES@
 diff --git a/lib/dns-pkcs11/Makefile.in b/lib/dns-pkcs11/Makefile.in
-index 1d0f5df..98c9ba0 100644
+index 58bda3c..d6a45df 100644
 --- a/lib/dns-pkcs11/Makefile.in
 +++ b/lib/dns-pkcs11/Makefile.in
-@@ -24,17 +24,17 @@ VERSION=@BIND9_VERSION@
+@@ -22,7 +22,7 @@ VERSION=@BIND9_VERSION@
 
 @BIND9_MAKE_INCLUDES@
 
 -CINCLUDES =	-I. -I${top_srcdir}/lib/dns -Iinclude ${DNS_INCLUDES} \
-		${ISC_INCLUDES} ${MAXMINDDB_CFLAGS} \
 +CINCLUDES =	-I. -I${top_srcdir}/lib/dns-pkcs11 -Iinclude ${DNS_PKCS11_INCLUDES} \
-+		${ISC_PKCS11_INCLUDES} ${MAXMINDDB_CFLAGS} \
- 		@DST_OPENSSL_INC@ @DST_GSSAPI_INC@
+ 		${ISC_INCLUDES} \
+ 		${FSTRM_CFLAGS} \
+ 		${OPENSSL_CFLAGS} @DST_GSSAPI_INC@ \
+@@ -32,7 +32,7 @@ CINCLUDES =	-I. -I${top_srcdir}/lib/dns -Iinclude ${DNS_INCLUDES} \
+ 		${LMDB_CFLAGS} \
+ 		${MAXMINDDB_CFLAGS}
 
-CDEFINES =	-DUSE_MD5 @CRYPTO@ @USE_GSSAPI@
-+CDEFINES =	-DUSE_MD5 @CRYPTO_PK11@ @USE_GSSAPI@
+-CDEFINES =	@USE_GSSAPI@
+CDEFINES =	@USE_GSSAPI@ @USE_PKCS11@
 
 CWARNINGS =
 
-ISCLIBS =	../../lib/isc/libisc.@A@
-+ISCLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
- 
-ISCDEPLIBS =	../../lib/isc/libisc.@A@
-+ISCDEPLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
- 
- LIBS =		${MAXMINDDB_LIBS} @LIBS@
- 
-@@ -148,15 +148,15 @@ version.@O@: version.c
- 		-DLIBAGE=${LIBAGE} \
+@@ -135,15 +135,15 @@ version.@O@: version.c
+ 		-DMAPAPI=\"${MAPAPI}\" \
 		-c ${srcdir}/version.c
 
 -libdns.@SA@: ${OBJS}
@ -492,13 +375,13 @@ index 1d0f5df..98c9ba0 100644
 	${LIBTOOL_MODE_LINK} \
 -		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libdns.la -rpath ${libdir} \
 +		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libdns-pkcs11.la -rpath ${libdir} \
- 		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
+ 		-release "${VERSION}" \
 -		${OBJS} ${ISCLIBS} @DNS_CRYPTO_LIBS@ ${LIBS}
 +		${OBJS} ${ISCLIBS} @DNS_CRYPTO_PK11_LIBS@ ${LIBS}
 
 include: gen
 	${MAKE} include/dns/enumtype.h
-@@ -187,22 +187,22 @@ gen: gen.c
+@@ -174,22 +174,22 @@ gen: gen.c
 	${BUILD_CPPFLAGS} ${BUILD_LDFLAGS} -o $@ ${srcdir}/gen.c \
 	${BUILD_LIBS} ${LFS_LIBS}
 
@ -526,89 +409,142 @@ index 1d0f5df..98c9ba0 100644
 	rm -f gen code.h include/dns/enumtype.h include/dns/enumclass.h
 	rm -f include/dns/rdatastruct.h
 	rm -f dnstap.pb-c.c dnstap.pb-c.h
-diff --git a/lib/isc-pkcs11/Makefile.in b/lib/isc-pkcs11/Makefile.in
-index 7e3e9ce..58d7466 100644
--- a/lib/isc-pkcs11/Makefile.in
-+++ b/lib/isc-pkcs11/Makefile.in
-@@ -23,8 +23,8 @@ CINCLUDES =	-I${srcdir}/unix/include \
- 		-I${srcdir}/@ISC_THREAD_DIR@/include \
- 		-I${srcdir}/@ISC_ARCH_DIR@/include \
- 		-I./include \
-		-I${srcdir}/include ${DNS_INCLUDES} @ISC_OPENSSL_INC@
-CDEFINES =	@CRYPTO@ -DPK11_LIB_LOCATION=\"${PROVIDER}\"
-+		-I${srcdir}/include ${DNS_PKCS11_INCLUDES}
-+CDEFINES =	@CRYPTO_PK11@ -DPK11_LIB_LOCATION=\"${PROVIDER}\"
+diff --git a/lib/dns-pkcs11/tests/Makefile.in b/lib/dns-pkcs11/tests/Makefile.in
+index 3bb5e01..c96fe7d 100644
+--- a/lib/dns-pkcs11/tests/Makefile.in
+++ b/lib/dns-pkcs11/tests/Makefile.in
+@@ -15,15 +15,15 @@ VERSION=@BIND9_VERSION@
+ 
+ @BIND9_MAKE_INCLUDES@
+ 
+-CINCLUDES =	-I. -Iinclude ${DNS_INCLUDES} ${ISC_INCLUDES} \
+CINCLUDES =	-I. -Iinclude ${DNS_PKCS11_INCLUDES} ${ISC_INCLUDES} \
+ 		${FSTRM_CFLAGS} ${OPENSSL_CFLAGS} \
+ 		${PROTOBUF_C_CFLAGS} ${MAXMINDDB_CFLAGS} @CMOCKA_CFLAGS@
+-CDEFINES =	-DTESTS="\"${top_builddir}/lib/dns/tests/\""
+CDEFINES =	@USE_PKCS11@ -DTESTS="\"${top_builddir}/lib/dns-pkcs11/tests/\""
+ 
+ ISCLIBS =	../../isc/libisc.@A@ @NO_LIBTOOL_ISCLIBS@
+ ISCDEPLIBS =	../../isc/libisc.@A@
+-DNSLIBS =	../libdns.@A@ @NO_LIBTOOL_DNSLIBS@
+-DNSDEPLIBS =	../libdns.@A@
+DNSLIBS =	../libdns-pkcs11.@A@ @NO_LIBTOOL_DNSLIBS@
+DNSDEPLIBS =	../libdns-pkcs11.@A@
+ 
+ LIBS =		@LIBS@ @CMOCKA_LIBS@
+ 
+diff --git a/lib/ns-pkcs11/Makefile.in b/lib/ns-pkcs11/Makefile.in
+index bc683ce..7a9d2f2 100644
+--- a/lib/ns-pkcs11/Makefile.in
+++ b/lib/ns-pkcs11/Makefile.in
+@@ -16,12 +16,12 @@ VERSION=@BIND9_VERSION@
+ 
+ @BIND9_MAKE_INCLUDES@
+ 
+-CINCLUDES =	-I. -I${top_srcdir}/lib/ns -Iinclude \
+-		${NS_INCLUDES} ${DNS_INCLUDES} ${ISC_INCLUDES} \
+CINCLUDES =	-I. -I${top_srcdir}/lib/ns-pkcs11 -Iinclude \
+		${NS_PKCS11_INCLUDES} ${DNS_PKCS11_INCLUDES} ${ISC_INCLUDES} \
+ 		${OPENSSL_CFLAGS} @DST_GSSAPI_INC@ \
+ 		${FSTRM_CFLAGS}
+ 
+-CDEFINES =	-DNAMED_PLUGINDIR=\"${plugindir}\"
+CDEFINES =	@USE_PKCS11@ -DNAMED_PLUGINDIR=\"${plugindir}\"
+ 
 CWARNINGS =
 
- # Alphabetically
-@@ -107,40 +107,40 @@ version.@O@: version.c
- 		-DLIBAGE=${LIBAGE} \
+@@ -29,9 +29,9 @@ ISCLIBS =	../../lib/isc/libisc.@A@
+ 
+ ISCDEPLIBS =	../../lib/isc/libisc.@A@
+ 
+-DNSLIBS =	../../lib/dns/libdns.@A@ @NO_LIBTOOL_DNSLIBS@
+DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ @NO_LIBTOOL_DNSLIBS@
+ 
+-DNSDEPLIBS =	../../lib/dns/libdns.@A@
+DNSDEPLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@
+ 
+ LIBS =		@LIBS@
+ 
+@@ -60,28 +60,28 @@ version.@O@: version.c
+ 		-DMAJOR=\"${MAJOR}\" \
 		-c ${srcdir}/version.c
 
-libisc.@SA@: ${OBJS} ${SYMTBLOBJS}
-+libisc-pkcs11.@SA@: ${OBJS} ${SYMTBLOBJS}
- 	${AR} ${ARFLAGS} $@ ${OBJS} ${SYMTBLOBJS}
- 	${RANLIB} $@
- 
-libisc-nosymtbl.@SA@: ${OBJS}
-+libisc-pkcs11-nosymtbl.@SA@: ${OBJS}
+-libns.@SA@: ${OBJS}
+libns-pkcs11.@SA@: ${OBJS}
 	${AR} ${ARFLAGS} $@ ${OBJS}
 	${RANLIB} $@
 
-libisc.la: ${OBJS} ${SYMTBLOBJS}
-+libisc-pkcs11.la: ${OBJS} ${SYMTBLOBJS}
+-libns.la: ${OBJS}
+libns-pkcs11.la: ${OBJS}
 	${LIBTOOL_MODE_LINK} \
-		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisc.la -rpath ${libdir} \
-+		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisc-pkcs11.la -rpath ${libdir} \
- 		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
- 		${OBJS} ${SYMTBLOBJS} ${LIBS}
+-		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libns.la -rpath ${libdir} \
+		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libns-pkcs11.la -rpath ${libdir} \
+ 		-release "${VERSION}" \
+-		${OBJS} ${ISCLIBS} ${DNSLIBS} @DNS_CRYPTO_LIBS@ ${LIBS}
+		${OBJS} ${ISCLIBS} ${DNSLIBS} @DNS_CRYPTO_PK11_LIBS@ ${LIBS}
 
-libisc-nosymtbl.la: ${OBJS}
-+libisc-pkcs11-nosymtbl.la: ${OBJS}
- 	${LIBTOOL_MODE_LINK} \
-		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisc-nosymtbl.la -rpath ${libdir} \
-+		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisc-pkcs11-nosymtbl.la -rpath ${libdir} \
- 		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
- 		${OBJS} ${LIBS}
- 
-timestamp: libisc.@A@ libisc-nosymtbl.@A@
-+timestamp: libisc-pkcs11.@A@ libisc-pkcs11-nosymtbl.@A@
+-timestamp: libns.@A@
+timestamp: libns-pkcs11.@A@
 	touch timestamp
 
-testdirs: libisc.@A@ libisc-nosymtbl.@A@
-+testdirs: libisc-pkcs11.@A@ libisc-pkcs11-nosymtbl.@A@
- 
 installdirs:
 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${libdir}
 
 install:: timestamp installdirs
-	${LIBTOOL_MODE_INSTALL} ${INSTALL_LIBRARY} libisc.@A@ ${DESTDIR}${libdir}
-+	${LIBTOOL_MODE_INSTALL} ${INSTALL_LIBRARY} libisc-pkcs11.@A@ ${DESTDIR}${libdir}
+-	${LIBTOOL_MODE_INSTALL} ${INSTALL_LIBRARY} libns.@A@ \
+	${LIBTOOL_MODE_INSTALL} ${INSTALL_LIBRARY} libns-pkcs11.@A@ \
+ 		${DESTDIR}${libdir}
 
 uninstall::
-	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${libdir}/libisc.@A@
-+	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${libdir}/libisc-pkcs11.@A@
+-	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${libdir}/libns.@A@
+	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${libdir}/libns-pkcs11.@A@
 
 clean distclean::
-	rm -f libisc.@A@ libisc-nosymtbl.@A@ libisc.la \
-	libisc-nosymtbl.la timestamp
-+	rm -f libisc-pkcs11.@A@ libisc-pkcs11-nosymtbl.@A@ libisc-pkcs11.la \
-+	libisc-pkcs11-nosymtbl.la timestamp
+-	rm -f libns.@A@ timestamp
+	rm -f libns-pkcs11.@A@ timestamp
+diff --git a/lib/ns-pkcs11/tests/Makefile.in b/lib/ns-pkcs11/tests/Makefile.in
+index 4c3e694..c1b6d99 100644
+--- a/lib/ns-pkcs11/tests/Makefile.in
+++ b/lib/ns-pkcs11/tests/Makefile.in
+@@ -17,17 +17,17 @@ VERSION=@BIND9_VERSION@
+ 
+ WRAP_OPTIONS =	-Wl,--wrap=isc__nmhandle_detach -Wl,--wrap=isc__nmhandle_attach
+ 
+-CINCLUDES =	-I. -Iinclude ${NS_INCLUDES} ${DNS_INCLUDES} ${ISC_INCLUDES} \
+CINCLUDES =	-I. -Iinclude ${NS_PKCS11_INCLUDES} ${DNS_PKCS11_INCLUDES} ${ISC_INCLUDES} \
+ 		${OPENSSL_CFLAGS} \
+ 		@CMOCKA_CFLAGS@
+-CDEFINES =	-DTESTS="\"${top_builddir}/lib/ns/tests/\"" -DNAMED_PLUGINDIR=\"${plugindir}\"
+CDEFINES =	-DTESTS="\"${top_builddir}/lib/ns-pkcs11/tests/\"" -DNAMED_PLUGINDIR=\"${plugindir}\" @USE_PKCS11@
+ 
+ ISCLIBS =	../../isc/libisc.@A@ @NO_LIBTOOL_ISCLIBS@
+ ISCDEPLIBS =	../../isc/libisc.@A@
+-DNSLIBS =	../../dns/libdns.@A@ @NO_LIBTOOL_DNSLIBS@
+-DNSDEPLIBS =	../../dns/libdns.@A@
+-NSLIBS =	../libns.@A@
+-NSDEPLIBS =	../libns.@A@
+DNSLIBS =	../../dns-pkcs11/libdns-pkcs11.@A@ @NO_LIBTOOL_DNSLIBS@
+DNSDEPLIBS =	../../dns-pkcs11/libdns-pkcs11.@A@
+NSLIBS =	../libns-pkcs11.@A@
+NSDEPLIBS =	../libns-pkcs11.@A@
+ 
+ LIBS =		@LIBS@ @CMOCKA_LIBS@
+ 
 diff --git a/make/includes.in b/make/includes.in
-index 66efe68..966671f 100644
+index b8317d3..b73b0c4 100644
 --- a/make/includes.in
 +++ b/make/includes.in
-@@ -41,3 +41,13 @@ BIND9_INCLUDES = @BIND9_BIND9_BUILDINCLUDE@ \
+@@ -39,3 +39,10 @@ BIND9_INCLUDES = @BIND9_BIND9_BUILDINCLUDE@ \
 
 TEST_INCLUDES = \
 	-I${top_srcdir}/lib/tests/include
 +
-+ISC_PKCS11_INCLUDES = @BIND9_ISC_BUILDINCLUDE@ \
-+	-I${top_srcdir}/lib/isc-pkcs11 \
-+	-I${top_srcdir}/lib/isc-pkcs11/include \
-+	-I${top_srcdir}/lib/isc-pkcs11/unix/include \
-+	-I${top_srcdir}/lib/isc-pkcs11/@ISC_THREAD_DIR@/include \
-+	-I${top_srcdir}/lib/isc-pkcs11/@ISC_ARCH_DIR@/include
-+
-+DNS_PKCS11_INCLUDES = @BIND9_DNS_BUILDINCLUDE@ \
+DNS_PKCS11_INCLUDES = @BIND9_DNS_PKCS11_BUILDINCLUDE@ \
 +	-I${top_srcdir}/lib/dns-pkcs11/include
+
+NS_PKCS11_INCLUDES = @BIND9_NS_PKCS11_BUILDINCLUDE@ \
+	-I${top_srcdir}/lib/ns-pkcs11/include
+
+-- 
+2.26.3
+
--- a/SOURCES/bind-9.10-sdb.patch
+++ b/SOURCES/bind-9.10-sdb.patch
@ -1,310 +0,0 @@
-diff --git a/bin/Makefile.in b/bin/Makefile.in
-index ce7a2da..4e6a824 100644
--- a/bin/Makefile.in
-+++ b/bin/Makefile.in
-@@ -11,8 +11,8 @@ srcdir =	@srcdir@
- VPATH =		@srcdir@
- top_srcdir =	@top_srcdir@
- 
-SUBDIRS =	named named-pkcs11 rndc dig delv dnssec dnssec-pkcs11 tools nsupdate \
-		check confgen @NZD_TOOLS@ @PYTHON_TOOLS@ @PKCS11_TOOLS@ tests
-+SUBDIRS =	named named-sdb named-pkcs11 rndc dig delv dnssec dnssec-pkcs11 tools nsupdate \
-+		check confgen @NZD_TOOLS@ @PYTHON_TOOLS@ @PKCS11_TOOLS@ sdb_tools tests
- TARGETS =
- 
- @BIND9_MAKE_RULES@
-diff --git a/bin/named-sdb/Makefile.in b/bin/named-sdb/Makefile.in
-index 03a72d5..4c1cb6d 100644
--- a/bin/named-sdb/Makefile.in
-+++ b/bin/named-sdb/Makefile.in
-@@ -30,10 +30,10 @@ VERSION=@BIND9_VERSION@
- #
- # Add database drivers here.
- #
-DBDRIVER_OBJS =
-DBDRIVER_SRCS =
-+DBDRIVER_OBJS =	ldapdb.@O@ pgsqldb.@O@ sqlitedb.@O@ dirdb.@O@
-+DBDRIVER_SRCS =	ldapdb.c pgsqldb.c sqlitedb.c dirdb.c
- DBDRIVER_INCLUDES =
-DBDRIVER_LIBS =
-+DBDRIVER_LIBS =	-lldap -llber -lsqlite3 -lpq
- 
- DLZ_DRIVER_DIR =	${top_srcdir}/contrib/dlz/drivers
- 
-@@ -80,7 +80,7 @@ NOSYMLIBS =	${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
- 
- SUBDIRS =	unix
- 
-TARGETS =	named@EXEEXT@ lwresd@EXEEXT@
-+TARGETS =	named-sdb@EXEEXT@
- 
- GEOIPLINKOBJS = geoip.@O@
- GEOIP2LINKOBJS = geoip.@O@
-@@ -154,7 +154,7 @@ server.@O@: server.c
- 		-DPRODUCT=\"${PRODUCT}\" \
- 		-DVERSION=\"${VERSION}\" -c ${srcdir}/server.c
- 
-named@EXEEXT@: ${OBJS} ${DEPLIBS}
-+named-sdb@EXEEXT@: ${OBJS} ${DEPLIBS}
- 	export MAKE_SYMTABLE="yes"; \
- 	export BASEOBJS="${OBJS} ${UOBJS}"; \
- 	${FINALBUILDCMD}
-@@ -181,8 +181,6 @@ statschannel.@O@: bind9.xsl.h
- 
- installdirs:
- 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
-	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man5
-	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
- 
- install-man5: named.conf.5
- 	${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man5
-@@ -192,16 +190,11 @@ install-man8: named.8 lwresd.8
- 
- install-man: install-man5 install-man8
- 
-install:: named@EXEEXT@ lwresd@EXEEXT@ installdirs install-man
-	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named@EXEEXT@ ${DESTDIR}${sbindir}
-	(cd ${DESTDIR}${sbindir}; rm -f lwresd@EXEEXT@; @LN@ named@EXEEXT@ lwresd@EXEEXT@)
-+install:: ${TARGETS} installdirs
-+	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named-sdb@EXEEXT@ ${DESTDIR}${sbindir}
- 
- uninstall::
-	rm -f ${DESTDIR}${mandir}/man5/named.conf.5
-	rm -f ${DESTDIR}${mandir}/man8/lwresd.8
-	rm -f ${DESTDIR}${mandir}/man8/named.8
-	rm -f ${DESTDIR}${sbindir}/lwresd@EXEEXT@
-	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/named@EXEEXT@
-+	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/named-sdb@EXEEXT@
- 
- @DLZ_DRIVER_RULES@
- 
-diff --git a/bin/named-sdb/main.c b/bin/named-sdb/main.c
-index c9fc3cc..148ebb3 100644
--- a/bin/named-sdb/main.c
-+++ b/bin/named-sdb/main.c
-@@ -97,6 +97,10 @@
-  * Include header files for database drivers here.
-  */
- /* #include "xxdb.h" */
-+#include "ldapdb.h"
-+#include "pgsqldb.h"
-+#include "sqlitedb.h"
-+#include "dirdb.h"
- 
- #ifdef CONTRIB_DLZ
- /*
-@@ -1134,6 +1138,11 @@ setup(void) {
- 		ns_main_earlyfatal("isc_app_start() failed: %s",
- 				   isc_result_totext(result));
- 
-+	ldapdb_clear();
-+	pgsqldb_clear();
-+	dirdb_clear();
-+	sqlitedb_clear();
-+
- 	isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
- 		      ISC_LOG_NOTICE, "starting %s %s%s%s <id:%s>",
- 		      ns_g_product, ns_g_version,
-@@ -1334,6 +1343,75 @@ setup(void) {
- 				   isc_result_totext(result));
- #endif
- 
-+        result = ldapdb_init();
-+        if (result != ISC_R_SUCCESS)
-+        {
-+            isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
-+                          ISC_LOG_ERROR, 
-+                          "SDB ldap module initialisation failed: %s.",
-+                          isc_result_totext(result)
-+                );
-+            isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
-+                          ISC_LOG_ERROR, 
-+                          "SDB ldap zone database will be unavailable."
-+                );
-+        }else
-+            isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
-+                          ISC_LOG_NOTICE, "SDB ldap zone database module loaded."
-+                         );
-+
-+        result = pgsqldb_init();
-+        if (result != ISC_R_SUCCESS)
-+        {
-+            isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
-+                          ISC_LOG_ERROR, 
-+                          "SDB pgsql module initialisation failed: %s.",
-+                          isc_result_totext(result)
-+                );
-+            isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
-+                          ISC_LOG_ERROR, 
-+                          "SDB pgsql zone database will be unavailable."
-+                );
-+        }else
-+            isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
-+                          ISC_LOG_NOTICE, "SDB postgreSQL DB zone database module loaded."
-+                         );
-+
-+        result = sqlitedb_init();
-+        if (result != ISC_R_SUCCESS)
-+        {
-+             isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
-+                          ISC_LOG_ERROR, 
-+                          "SDB sqlite3 module initialisation failed: %s.",
-+                          isc_result_totext(result)
-+                );
-+            isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
-+                          ISC_LOG_ERROR, 
-+                          "SDB sqlite3 zone database will be unavailable."
-+                );
-+        }else
-+            isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
-+                          ISC_LOG_NOTICE, "SDB sqlite3 DB zone database module loaded."
-+                         );
-+
-+        result = dirdb_init();
-+        if (result != ISC_R_SUCCESS)
-+        {
-+            isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
-+                          ISC_LOG_ERROR, 
-+                          "SDB directory DB module initialisation failed: %s.",
-+                          isc_result_totext(result)
-+                );
-+            isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
-+                          ISC_LOG_ERROR, 
-+                          "SDB directory DB zone database will be unavailable."
-+                );
-+        }else
-+            isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
-+                          ISC_LOG_NOTICE, "SDB directory DB zone database module loaded."
-+                         );
-+
-+
- 	ns_server_create(ns_g_mctx, &ns_g_server);
- 
- #ifdef HAVE_LIBSECCOMP
-@@ -1376,6 +1454,11 @@ cleanup(void) {
- 
- 	dns_name_destroy();
- 
-+	ldapdb_clear();
-+	pgsqldb_clear();
-+	sqlitedb_clear();
-+	dirdb_clear();
-+
- 	isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
- 		      ISC_LOG_NOTICE, "exiting");
- 	ns_log_shutdown();
-diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
-index 03a72d5..47cc046 100644
--- a/bin/named/Makefile.in
-+++ b/bin/named/Makefile.in
-@@ -45,10 +45,10 @@ DLZDRIVER_LIBS =	@DLZ_DRIVER_LIBS@
- CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
- 		${LWRES_INCLUDES} ${DNS_INCLUDES} ${BIND9_INCLUDES} \
- 		${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} ${ISC_INCLUDES} \
-		${DLZDRIVER_INCLUDES} ${DBDRIVER_INCLUDES} ${MAXMINDDB_CFLAGS} \
-+		${MAXMINDDB_CFLAGS} \
- 		@DST_OPENSSL_INC@
- 
-CDEFINES =      @CONTRIB_DLZ@ @USE_GSSAPI@ @CRYPTO@
-+CDEFINES =      @USE_GSSAPI@ @CRYPTO@
- 
- CWARNINGS =
- 
-@@ -72,11 +72,11 @@ DEPLIBS =	${LWRESDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
- 
- LIBS =		${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
- 		${ISCCFGLIBS} ${ISCCCLIBS} ${ISCLIBS} \
-		${DLZDRIVER_LIBS} ${DBDRIVER_LIBS} @LIBS@
-+		@LIBS@
- 
- NOSYMLIBS =	${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
- 		${ISCCFGLIBS} ${ISCCCLIBS} ${ISCNOSYMLIBS} \
-		${DLZDRIVER_LIBS} ${DBDRIVER_LIBS} @LIBS@
-+		@LIBS@
- 
- SUBDIRS =	unix
- 
-@@ -94,8 +94,7 @@ OBJS =		builtin.@O@ client.@O@ config.@O@ control.@O@ \
- 		tkeyconf.@O@ tsigconf.@O@ update.@O@ xfrout.@O@ \
- 		zoneconf.@O@ \
- 		lwaddr.@O@ lwresd.@O@ lwdclient.@O@ lwderror.@O@ lwdgabn.@O@ \
-		lwdgnba.@O@ lwdgrbn.@O@ lwdnoop.@O@ lwsearch.@O@ \
-		${DLZDRIVER_OBJS} ${DBDRIVER_OBJS}
-+		lwdgnba.@O@ lwdgrbn.@O@ lwdnoop.@O@ lwsearch.@O@
- 
- UOBJS =		unix/os.@O@ unix/dlz_dlopen_driver.@O@
- 
-@@ -113,8 +112,7 @@ SRCS =		builtin.c client.c config.c control.c \
- 		tkeyconf.c tsigconf.c update.c xfrout.c \
- 		zoneconf.c \
- 		lwaddr.c lwresd.c lwdclient.c lwderror.c lwdgabn.c \
-		lwdgnba.c lwdgrbn.c lwdnoop.c lwsearch.c \
-		${DLZDRIVER_SRCS} ${DBDRIVER_SRCS}
-+		lwdgnba.c lwdgrbn.c lwdnoop.c lwsearch.c
- 
- MANPAGES =	named.8 lwresd.8 named.conf.5
- 
-@@ -203,7 +201,5 @@ uninstall::
- 	rm -f ${DESTDIR}${sbindir}/lwresd@EXEEXT@
- 	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/named@EXEEXT@
- 
-@DLZ_DRIVER_RULES@
-
- named-symtbl.@O@: named-symtbl.c
- 	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} -c named-symtbl.c
-diff --git a/bin/sdb_tools/Makefile.in b/bin/sdb_tools/Makefile.in
-index c7e0868..95ab742 100644
--- a/bin/sdb_tools/Makefile.in
-+++ b/bin/sdb_tools/Makefile.in
-@@ -32,11 +32,11 @@ DEPLIBS =	${LWRESDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
- LIBS =		${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
- 		${ISCCFGLIBS} ${ISCCCLIBS} ${ISCLIBS} ${DBDRIVER_LIBS} @LIBS@
- 
-TARGETS =	zone2ldap@EXEEXT@ zonetodb@EXEEXT@
-+TARGETS =	zone2ldap@EXEEXT@ zonetodb@EXEEXT@ zone2sqlite@EXEEXT@
- 
-OBJS	=	zone2ldap.@O@ zonetodb.@O@
-+OBJS	=	zone2ldap.@O@ zonetodb.@O@ zone2sqlite.@O@
- 
-SRCS    =       zone2ldap.c zonetodb.c
-+SRCS    =       zone2ldap.c zonetodb.c zone2sqlite.c
- 
- MANPAGES =      zone2ldap.1
- 
-@@ -50,6 +50,9 @@ zone2ldap@EXEEXT@: zone2ldap.@O@ ${DEPLIBS}
- zonetodb@EXEEXT@: zonetodb.@O@  ${DEPLIBS}
- 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ zonetodb.@O@ -lpq ${LIBS}
- 
-+zone2sqlite@EXEEXT@: zone2sqlite.@O@  ${DEPLIBS}
-+	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${ALL_CFLAGS} ${LDFLAGS} -o $@ zone2sqlite.@O@ -lsqlite3 -lssl ${LIBS}
-+
- clean distclean manclean maintainer-clean::
- 	rm -f ${TARGETS} ${OBJS}
- 
-@@ -60,4 +63,5 @@ installdirs:
- install:: ${TARGETS} installdirs
- 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zone2ldap@EXEEXT@ ${DESTDIR}${sbindir}
- 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zonetodb@EXEEXT@  ${DESTDIR}${sbindir}
-+	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zone2sqlite@EXEEXT@ ${DESTDIR}${sbindir}
- 	${INSTALL_DATA} ${srcdir}/zone2ldap.1 ${DESTDIR}${mandir}/man1/zone2ldap.1
-diff --git a/configure.ac b/configure.ac
-index f85f45f..7d28c52 100644
--- a/configure.ac
-+++ b/configure.ac
-@@ -5400,6 +5400,8 @@ AC_CONFIG_FILES([
- 	bin/named/unix/Makefile
- 	bin/named-pkcs11/Makefile
- 	bin/named-pkcs11/unix/Makefile
-+	bin/named-sdb/Makefile
-+	bin/named-sdb/unix/Makefile
- 	bin/nsupdate/Makefile
- 	bin/pkcs11/Makefile
- 	bin/python/Makefile
-@@ -5424,6 +5426,7 @@ AC_CONFIG_FILES([
- 	bin/python/isc/tests/policy_test.py
- 	bin/python/isc/utils.py
- 	bin/rndc/Makefile
-+	bin/sdb_tools/Makefile
- 	bin/tests/Makefile
- 	bin/tests/headerdep_test.sh
- 	bin/tests/optional/Makefile
--- a/SOURCES/bind-9.10-use-of-strlcat.patch
+++ b/SOURCES/bind-9.10-use-of-strlcat.patch
@ -1,18 +0,0 @@
-diff --git a/bin/sdb_tools/zone2ldap.c b/bin/sdb_tools/zone2ldap.c
-index d56bc56..99c3314 100644
--- a/bin/sdb_tools/zone2ldap.c
-+++ b/bin/sdb_tools/zone2ldap.c
-@@ -817,11 +817,11 @@ build_dn_from_dc_list (char **dc_list, unsigned int ttl, int flag, char *zone)
-     }
- 
- 
-      strlcat (dn, tmp, sizeof (dn));
-+      strncat (dn, tmp, sizeof (dn) - strlen (dn));
-     }
- 
-   sprintf (tmp, "dc=%s", dc_list[0]);
-  strlcat (dn, tmp, sizeof (dn));
-+  strncat (dn, tmp, sizeof (dn) - strlen (dn));
- 
- 	    fflush(NULL);
-   return dn;
--- a/SOURCES/bind-9.11-CVE-2021-25220-test.patch
+++ b/SOURCES/bind-9.11-CVE-2021-25220-test.patch
--- a/SOURCES/bind-9.11-CVE-2021-25220.patch
+++ b/SOURCES/bind-9.11-CVE-2021-25220.patch
@ -1,254 +0,0 @@
-From 1f5cb247ecd20ba57c472138f94856aa83caf042 Mon Sep 17 00:00:00 2001
-From: Mark Andrews <marka@isc.org>
-Date: Tue, 1 Mar 2022 09:48:05 +1100
-Subject: [PATCH] Add additional name checks when using a forwarder
-
-When using a forwarder, check that the owner name of response
-records are within the bailiwick of the forwarded name space.
-
-(cherry picked from commit e8df2802ac62016ea68585893eb4310fc3329028)
-
-Check that the forward declaration is unchanged and not overridden
-
-If we are using a fowarder, in addition to checking that names to
-be cached are subdomains of the forwarded namespace, we must also
-check that there are no subsidiary forwarded namespaces which would
-take precedence. To be safe, we don't cache any responses if the
-forwarding configuration has changed since the query was sent.
-
-(cherry picked from commit 590f8698fc876d6d72f75cf35359e7546c3af972)
-
-Check cached names for possible "forward only" clause
-
-When caching additional and glue data *not* from a forwarder, we must
-check that there is no "forward only" clause covering the owner name
-that would take precedence.  Such names would normally be allowed by
-baliwick rules, but a "forward only" zone introduces a new baliwick
-scope.
-
-(cherry picked from commit 4a144fae16e70517be894a971cef1d085ee68ebe)
-
-Look for zones deeper than the current domain or forward name
-
-When caching glue, we need to ensure that there is no closer
-source of truth for the name. If the owner name for the glue
-record would be answered by a locally configured zone, do not
-cache.
-
-(cherry picked from commit 42f8c538d3fb9d075b98d82688aeb71621798754)
-
-Avoid use of compound literals
-
-Compound literals are not used in BIND 9.11, in order to ensure backward
-compatibility with ancient compilers.  Rework the relevant parts of the
-BIND 9.11 backport of the CVE-2021-25220 fix so that compound literals
-are not used.
-
-(cherry picked from commit d4b1efbcbd4dfb8c6ef303968992440c5bdeed15)
---
- lib/dns/resolver.c | 130 +++++++++++++++++++++++++++++++++++++++++++--
- 1 file changed, 125 insertions(+), 5 deletions(-)
-
-diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
-index c912f3aea8..2c68973899 100644
--- a/lib/dns/resolver.c
-+++ b/lib/dns/resolver.c
-@@ -63,6 +63,7 @@
- #include <dns/stats.h>
- #include <dns/tsig.h>
- #include <dns/validator.h>
-+#include <dns/zone.h>
- 
- #ifdef WANT_QUERYTRACE
- #define RTRACE(m)       isc_log_write(dns_lctx, \
-@@ -312,6 +313,8 @@ struct fetchctx {
- 	bool			ns_ttl_ok;
- 	uint32_t			ns_ttl;
- 	isc_counter_t *			qc;
-+	dns_fixedname_t			fwdfname;
-+	dns_name_t			*fwdname;
- 
- 	/*%
- 	 * The number of events we're waiting for.
-@@ -3393,6 +3396,7 @@ fctx_getaddresses(fetchctx_t *fctx, bool badcache) {
- 		if (result == ISC_R_SUCCESS) {
- 			fwd = ISC_LIST_HEAD(forwarders->fwdrs);
- 			fctx->fwdpolicy = forwarders->fwdpolicy;
-+			dns_name_copy(domain, fctx->fwdname, NULL);
- 			if (fctx->fwdpolicy == dns_fwdpolicy_only &&
- 			    isstrictsubdomain(domain, &fctx->domain)) {
- 				fcount_decr(fctx);
-@@ -4422,6 +4426,9 @@ fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type,
- 	fctx->restarts = 0;
- 	fctx->querysent = 0;
- 	fctx->referrals = 0;
-+
-+	fctx->fwdname = dns_fixedname_initname(&fctx->fwdfname);
-+
- 	TIME_NOW(&fctx->start);
- 	fctx->timeouts = 0;
- 	fctx->lamecount = 0;
-@@ -4480,8 +4487,10 @@ fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type,
- 		domain = dns_fixedname_initname(&fixed);
- 		result = dns_fwdtable_find2(fctx->res->view->fwdtable, fwdname,
- 					    domain, &forwarders);
-		if (result == ISC_R_SUCCESS)
-+		if (result == ISC_R_SUCCESS) {
- 			fctx->fwdpolicy = forwarders->fwdpolicy;
-+			dns_name_copy(domain, fctx->fwdname, NULL);
-+		}
- 
- 		if (fctx->fwdpolicy != dns_fwdpolicy_only) {
- 			/*
-@@ -6231,6 +6240,112 @@ mark_related(dns_name_t *name, dns_rdataset_t *rdataset,
- 		rdataset->attributes |= DNS_RDATASETATTR_EXTERNAL;
- }
- 
-+/*
-+ * Returns true if 'name' is external to the namespace for which
-+ * the server being queried can answer, either because it's not a
-+ * subdomain or because it's below a forward declaration or a
-+ * locally served zone.
-+ */
-+static inline bool
-+name_external(dns_name_t *name, dns_rdatatype_t type, fetchctx_t *fctx) {
-+	isc_result_t result;
-+	dns_forwarders_t *forwarders = NULL;
-+	dns_fixedname_t fixed, zfixed;
-+	dns_name_t *fname = dns_fixedname_initname(&fixed);
-+	dns_name_t *zfname = dns_fixedname_initname(&zfixed);
-+	dns_name_t *apex = NULL;
-+	dns_name_t suffix;
-+	dns_zone_t *zone = NULL;
-+	unsigned int labels;
-+	dns_namereln_t rel;
-+	/*
-+	 * The following two variables do not influence code flow; they are
-+	 * only necessary for calling dns_name_fullcompare().
-+	 */
-+	int _orderp = 0;
-+	unsigned int _nlabelsp = 0;
-+
-+	apex = ISFORWARDER(fctx->addrinfo) ? fctx->fwdname : &fctx->domain;
-+
-+	/*
-+	 * The name is outside the queried namespace.
-+	 */
-+	rel = dns_name_fullcompare(name, apex, &_orderp, &_nlabelsp);
-+	if (rel != dns_namereln_subdomain && rel != dns_namereln_equal) {
-+		return (true);
-+	}
-+
-+	/*
-+	 * If the record lives in the parent zone, adjust the name so we
-+	 * look for the correct zone or forward clause.
-+	 */
-+	labels = dns_name_countlabels(name);
-+	if (dns_rdatatype_atparent(type) && labels > 1U) {
-+		dns_name_init(&suffix, NULL);
-+		dns_name_getlabelsequence(name, 1, labels - 1, &suffix);
-+		name = &suffix;
-+	} else if (rel == dns_namereln_equal) {
-+		/* If 'name' is 'apex', no further checking is needed. */
-+		return (false);
-+	}
-+
-+	/*
-+	 * If there is a locally served zone between 'apex' and 'name'
-+	 * then don't cache.
-+	 */
-+	LOCK(&fctx->res->view->lock);
-+	if (fctx->res->view->zonetable != NULL) {
-+		unsigned int options = DNS_ZTFIND_NOEXACT;
-+		result = dns_zt_find(fctx->res->view->zonetable, name, options,
-+				     zfname, &zone);
-+		if (zone != NULL) {
-+			dns_zone_detach(&zone);
-+		}
-+		if (result == ISC_R_SUCCESS || result == DNS_R_PARTIALMATCH) {
-+			if (dns_name_fullcompare(zfname, apex, &_orderp,
-+						 &_nlabelsp) ==
-+			    dns_namereln_subdomain)
-+			{
-+				UNLOCK(&fctx->res->view->lock);
-+				return (true);
-+			}
-+		}
-+	}
-+	UNLOCK(&fctx->res->view->lock);
-+
-+	/*
-+	 * Look for a forward declaration below 'name'.
-+	 */
-+	result = dns_fwdtable_find2(fctx->res->view->fwdtable, name, fname,
-+				    &forwarders);
-+
-+	if (ISFORWARDER(fctx->addrinfo)) {
-+		/*
-+		 * See if the forwarder declaration is better.
-+		 */
-+		if (result == ISC_R_SUCCESS) {
-+			return (!dns_name_equal(fname, fctx->fwdname));
-+		}
-+
-+		/*
-+		 * If the lookup failed, the configuration must have
-+		 * changed: play it safe and don't cache.
-+		 */
-+		return (true);
-+	} else if (result == ISC_R_SUCCESS &&
-+		   forwarders->fwdpolicy == dns_fwdpolicy_only &&
-+		   !ISC_LIST_EMPTY(forwarders->fwdrs))
-+	{
-+		/*
-+		 * If 'name' is covered by a 'forward only' clause then we
-+		 * can't cache this repsonse.
-+		 */
-+		return (true);
-+	}
-+
-+	return (false);
-+}
-+
- static isc_result_t
- check_section(void *arg, dns_name_t *addname, dns_rdatatype_t type,
- 	      dns_section_t section)
-@@ -6259,7 +6374,7 @@ check_section(void *arg, dns_name_t *addname, dns_rdatatype_t type,
- 	result = dns_message_findname(rmessage, section, addname,
- 				      dns_rdatatype_any, 0, &name, NULL);
- 	if (result == ISC_R_SUCCESS) {
-		external = !dns_name_issubdomain(name, &fctx->domain);
-+		external = name_external(name, type, fctx);
- 		if (type == dns_rdatatype_a) {
- 			for (rdataset = ISC_LIST_HEAD(name->list);
- 			     rdataset != NULL;
-@@ -7141,6 +7256,13 @@ answer_response(fetchctx_t *fctx, dns_message_t *message) {
- 			break;
- 
- 		case dns_namereln_subdomain:
-+			/*
-+			 * Don't accept DNAME from parent namespace.
-+			 */
-+			if (name_external(name, dns_rdatatype_dname, fctx)) {
-+				continue;
-+			}
-+
- 			/*
- 			 * In-scope DNAME records must have at least
- 			 * as many labels as the domain being queried.
-@@ -7376,11 +7498,9 @@ answer_response(fetchctx_t *fctx, dns_message_t *message) {
- 	 */
- 	result = dns_message_firstname(message, DNS_SECTION_AUTHORITY);
- 	while (!done && result == ISC_R_SUCCESS) {
-		bool external;
- 		name = NULL;
- 		dns_message_currentname(message, DNS_SECTION_AUTHORITY, &name);
-		external = !dns_name_issubdomain(name, &fctx->domain);
-		if (!external) {
-+		if (!name_external(name, dns_rdatatype_ns, fctx)) {
- 			/*
- 			 * We expect to find NS or SIG NS rdatasets, and
- 			 * nothing else.
-- 
-2.34.1
-
--- a/SOURCES/bind-9.11-CVE-2022-2795.patch
+++ b/SOURCES/bind-9.11-CVE-2022-2795.patch
@ -1,61 +0,0 @@
-From 05cdbc1006cee6daaa29e5423976d56047d22461 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Micha=C5=82=20K=C4=99pie=C5=84?= <michal@isc.org>
-Date: Thu, 8 Sep 2022 11:11:30 +0200
-Subject: [PATCH] Bound the amount of work performed for delegations
-
-Limit the amount of database lookups that can be triggered in
-fctx_getaddresses() (i.e. when determining the name server addresses to
-query next) by setting a hard limit on the number of NS RRs processed
-for any delegation encountered.  Without any limit in place, named can
-be forced to perform large amounts of database lookups per each query
-received, which severely impacts resolver performance.
-
-The limit used (20) is an arbitrary value that is considered to be big
-enough for any sane DNS delegation.
-
-(cherry picked from commit 3a44097fd6c6c260765b628cd1d2c9cb7efb0b2a)
-(cherry picked from commit bf2ea6d8525bfd96a84dad221ba9e004adb710a8)
---
- lib/dns/resolver.c | 12 ++++++++++++
- 1 file changed, 12 insertions(+)
-
-diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
-index 8ae9a993bb..ac9a9ef5d0 100644
--- a/lib/dns/resolver.c
-+++ b/lib/dns/resolver.c
-@@ -180,6 +180,12 @@
-  */
- #define NS_FAIL_LIMIT 4
- #define NS_RR_LIMIT   5
-+/*
-+ * IP address lookups are performed for at most NS_PROCESSING_LIMIT NS RRs in
-+ * any NS RRset encountered, to avoid excessive resource use while processing
-+ * large delegations.
-+ */
-+#define NS_PROCESSING_LIMIT 20
- 
- /* Number of hash buckets for zone counters */
- #ifndef RES_DOMAIN_BUCKETS
-@@ -3318,6 +3324,7 @@ fctx_getaddresses(fetchctx_t *fctx, bool badcache) {
- 	bool need_alternate = false;
- 	bool all_spilled = true;
- 	unsigned int no_addresses = 0;
-+	unsigned int ns_processed = 0;
- 
- 	FCTXTRACE5("getaddresses", "fctx->depth=", fctx->depth);
- 
-@@ -3504,6 +3511,11 @@ fctx_getaddresses(fetchctx_t *fctx, bool badcache) {
- 
- 		dns_rdata_reset(&rdata);
- 		dns_rdata_freestruct(&ns);
-+
-+		if (++ns_processed >= NS_PROCESSING_LIMIT) {
-+			result = ISC_R_NOMORE;
-+			break;
-+		}
- 	}
- 	if (result != ISC_R_NOMORE) {
- 		return (result);
-- 
-2.37.3
-
--- a/SOURCES/bind-9.11-CVE-2023-2828-fixup.patch
+++ b/SOURCES/bind-9.11-CVE-2023-2828-fixup.patch
@ -1,46 +0,0 @@
-From 6c26ede8edcb700caca12c501c6c129801989526 Mon Sep 17 00:00:00 2001
-From: Mark Andrews <marka@isc.org>
-Date: Fri, 23 Feb 2024 10:12:47 +1100
-Subject: [PATCH] Do not use header_prev in expire_lru_headers
-
-dns__cacherbt_expireheader can unlink / free header_prev underneath
-it.  Use ISC_LIST_TAIL after calling dns__cacherbt_expireheader
-instead to get the next pointer to be processed.
-
-(cherry picked from commit 7ce2e86024f022decb2678963538515ca39ab4ab)
-(cherry picked from commit f88f21b7d890eb80097f4bd434fedb29c2f9ff63)
---
- lib/dns/rbtdb.c | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
-index cc40eaec60..ee59c1b18b 100644
--- a/lib/dns/rbtdb.c
-+++ b/lib/dns/rbtdb.c
-@@ -10667,19 +10667,19 @@ update_header(dns_rbtdb_t *rbtdb, rdatasetheader_t *header,
- static size_t
- expire_lru_headers(dns_rbtdb_t *rbtdb, unsigned int locknum, size_t purgesize,
- 		   bool tree_locked) {
-	rdatasetheader_t *header, *header_prev;
-+	rdatasetheader_t *header;
- 	size_t purged = 0;
- 
- 	for (header = ISC_LIST_TAIL(rbtdb->rdatasets[locknum]);
-	     header != NULL && purged <= purgesize; header = header_prev)
-+	     header != NULL && purged <= purgesize;
-+	     header = ISC_LIST_TAIL(rbtdb->rdatasets[locknum]))
- 	{
-		header_prev = ISC_LIST_PREV(header, link);
- 		/*
- 		 * Unlink the entry at this point to avoid checking it
- 		 * again even if it's currently used someone else and
- 		 * cannot be purged at this moment.  This entry won't be
- 		 * referenced any more (so unlinking is safe) since the
-		 * TTL was reset to 0.
-+		 * TTL will be reset to 0.
- 		 */
- 		ISC_LIST_UNLINK(rbtdb->rdatasets[locknum], header, link);
- 		size_t header_size = rdataset_size(header);
-- 
-2.43.2
-
--- a/SOURCES/bind-9.11-CVE-2023-2828.patch
+++ b/SOURCES/bind-9.11-CVE-2023-2828.patch
@ -1,193 +0,0 @@
-From f3aa755ba5ae5148dd0567357f8c538072e2eabc Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
-Date: Tue, 30 May 2023 08:46:17 +0200
-Subject: [PATCH] Improve RBT overmem cache cleaning
-
-When cache memory usage is over the configured cache size (overmem) and
-we are cleaning unused entries, it might not be enough to clean just two
-entries if the entries to be expired are smaller than the newly added
-rdata.  This could be abused by an attacker to cause a remote Denial of
-Service by possibly running out of the operating system memory.
-
-Currently, the addrdataset() tries to do a single TTL-based cleaning
-considering the serve-stale TTL and then optionally moves to overmem
-cleaning if we are in that condition.  Then the overmem_purge() tries to
-do another single TTL based cleaning from the TTL heap and then continue
-with LRU-based cleaning up to 2 entries cleaned.
-
-Squash the TTL-cleaning mechanism into single call from addrdataset(),
-but ignore the serve-stale TTL if we are currently overmem.
-
-Then instead of having a fixed number of entries to clean, pass the size
-of newly added rdatasetheader to the overmem_purge() function and
-cleanup at least the size of the newly added data.  This prevents the
-cache going over the configured memory limit (`max-cache-size`).
-
-Additionally, refactor the overmem_purge() function to reduce for-loop
-nesting for readability.
---
- lib/dns/rbtdb.c | 109 +++++++++++++++++++++++++++++-------------------
- 1 file changed, 67 insertions(+), 42 deletions(-)
-
-diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
-index 11203e4..cc40eae 100644
--- a/lib/dns/rbtdb.c
-+++ b/lib/dns/rbtdb.c
-@@ -834,7 +834,7 @@ static void update_header(dns_rbtdb_t *rbtdb, rdatasetheader_t *header,
- static void expire_header(dns_rbtdb_t *rbtdb, rdatasetheader_t *header,
- 			  bool tree_locked, expire_t reason);
- static void overmem_purge(dns_rbtdb_t *rbtdb, unsigned int locknum_start,
-			  isc_stdtime_t now, bool tree_locked);
-+			  size_t purgesize, bool tree_locked);
- static isc_result_t resign_insert(dns_rbtdb_t *rbtdb, int idx,
- 				  rdatasetheader_t *newheader);
- static void resign_delete(dns_rbtdb_t *rbtdb, rbtdb_version_t *version,
-@@ -6937,6 +6937,16 @@ addclosest(dns_rbtdb_t *rbtdb, rdatasetheader_t *newheader,
- 
- static dns_dbmethods_t zone_methods;
- 
-+static size_t
-+rdataset_size(rdatasetheader_t *header) {
-+	if (!NONEXISTENT(header)) {
-+		return (dns_rdataslab_size((unsigned char *)header,
-+					   sizeof(*header)));
-+	}
-+
-+	return (sizeof(*header));
-+}
-+
- static isc_result_t
- addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
- 	    isc_stdtime_t now, dns_rdataset_t *rdataset, unsigned int options,
-@@ -7091,7 +7101,8 @@ addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
- 	}
- 
- 	if (cache_is_overmem)
-		overmem_purge(rbtdb, rbtnode->locknum, now, tree_locked);
-+		overmem_purge(rbtdb, rbtnode->locknum, rdataset_size(newheader),
-+			      tree_locked);
- 
- 	NODE_LOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
- 		  isc_rwlocktype_write);
-@@ -7106,9 +7117,19 @@ addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
- 			cleanup_dead_nodes(rbtdb, rbtnode->locknum);
- 
- 		header = isc_heap_element(rbtdb->heaps[rbtnode->locknum], 1);
-		if (header && header->rdh_ttl < now - RBTDB_VIRTUAL)
-			expire_header(rbtdb, header, tree_locked,
-				      expire_ttl);
-+		if (header != NULL) {
-+			dns_ttl_t rdh_ttl = header->rdh_ttl;
-+
-+			/* Only account for stale TTL if cache is not overmem */
-+			if (!cache_is_overmem) {
-+				rdh_ttl += rbtdb->serve_stale_ttl;
-+			}
-+
-+			if (rdh_ttl < now - RBTDB_VIRTUAL) {
-+				expire_header(rbtdb, header, tree_locked,
-+					      expire_ttl);
-+			}
-+		}
- 
- 		/*
- 		 * If we've been holding a write lock on the tree just for
-@@ -10643,54 +10664,58 @@ update_header(dns_rbtdb_t *rbtdb, rdatasetheader_t *header,
- 	ISC_LIST_PREPEND(rbtdb->rdatasets[header->node->locknum], header, link);
- }
- 
-+static size_t
-+expire_lru_headers(dns_rbtdb_t *rbtdb, unsigned int locknum, size_t purgesize,
-+		   bool tree_locked) {
-+	rdatasetheader_t *header, *header_prev;
-+	size_t purged = 0;
-+
-+	for (header = ISC_LIST_TAIL(rbtdb->rdatasets[locknum]);
-+	     header != NULL && purged <= purgesize; header = header_prev)
-+	{
-+		header_prev = ISC_LIST_PREV(header, link);
-+		/*
-+		 * Unlink the entry at this point to avoid checking it
-+		 * again even if it's currently used someone else and
-+		 * cannot be purged at this moment.  This entry won't be
-+		 * referenced any more (so unlinking is safe) since the
-+		 * TTL was reset to 0.
-+		 */
-+		ISC_LIST_UNLINK(rbtdb->rdatasets[locknum], header, link);
-+		size_t header_size = rdataset_size(header);
-+		expire_header(rbtdb, header, tree_locked, expire_lru);
-+		purged += header_size;
-+	}
-+
-+	return (purged);
-+}
-+
- /*%
- * Purge some expired and/or stale (i.e. unused for some period) cache entries
- * under an overmem condition.  To recover from this condition quickly, up to
- * 2 entries will be purged.  This process is triggered while adding a new
- * entry, and we specifically avoid purging entries in the same LRU bucket as
- * the one to which the new entry will belong.  Otherwise, we might purge
- * entries of the same name of different RR types while adding RRsets from a
- * single response (consider the case where we're adding A and AAAA glue records
- * of the same NS name).
-+ * Purge some stale (i.e. unused for some period - LRU based cleaning) cache
-+ * entries under the overmem condition.  To recover from this condition quickly,
-+ * we cleanup entries up to the size of newly added rdata (passed as purgesize).
-+ *
-+ * This process is triggered while adding a new entry, and we specifically avoid
-+ * purging entries in the same LRU bucket as the one to which the new entry will
-+ * belong.  Otherwise, we might purge entries of the same name of different RR
-+ * types while adding RRsets from a single response (consider the case where
-+ * we're adding A and AAAA glue records of the same NS name).
-  */
- static void
-overmem_purge(dns_rbtdb_t *rbtdb, unsigned int locknum_start,
-	      isc_stdtime_t now, bool tree_locked)
-+overmem_purge(dns_rbtdb_t *rbtdb, unsigned int locknum_start, size_t purgesize,
-+	      bool tree_locked)
- {
-	rdatasetheader_t *header, *header_prev;
- 	unsigned int locknum;
-	int purgecount = 2;
-+	size_t purged = 0;
- 
- 	for (locknum = (locknum_start + 1) % rbtdb->node_lock_count;
-	     locknum != locknum_start && purgecount > 0;
-+	     locknum != locknum_start && purged <= purgesize;
- 	     locknum = (locknum + 1) % rbtdb->node_lock_count) {
- 		NODE_LOCK(&rbtdb->node_locks[locknum].lock,
- 			  isc_rwlocktype_write);
- 
-		header = isc_heap_element(rbtdb->heaps[locknum], 1);
-		if (header && header->rdh_ttl < now - RBTDB_VIRTUAL) {
-			expire_header(rbtdb, header, tree_locked,
-				      expire_ttl);
-			purgecount--;
-		}
-
-		for (header = ISC_LIST_TAIL(rbtdb->rdatasets[locknum]);
-		     header != NULL && purgecount > 0;
-		     header = header_prev) {
-			header_prev = ISC_LIST_PREV(header, link);
-			/*
-			 * Unlink the entry at this point to avoid checking it
-			 * again even if it's currently used someone else and
-			 * cannot be purged at this moment.  This entry won't be
-			 * referenced any more (so unlinking is safe) since the
-			 * TTL was reset to 0.
-			 */
-			ISC_LIST_UNLINK(rbtdb->rdatasets[locknum], header,
-					link);
-			expire_header(rbtdb, header, tree_locked,
-				      expire_lru);
-			purgecount--;
-		}
-+		purged += expire_lru_headers(rbtdb, locknum, purgesize - purged,
-+					     tree_locked);
- 
- 		NODE_UNLOCK(&rbtdb->node_locks[locknum].lock,
- 				    isc_rwlocktype_write);
-- 
-2.40.1
-
--- a/SOURCES/bind-9.11-CVE-2023-4408.patch
+++ b/SOURCES/bind-9.11-CVE-2023-4408.patch
--- a/SOURCES/bind-9.11-CVE-2023-50387-fixup.patch
+++ b/SOURCES/bind-9.11-CVE-2023-50387-fixup.patch
@ -1,64 +0,0 @@
-From f0fc9d7999a94da3d471c4e0a35b1f447f25eea6 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Mon, 26 Feb 2024 21:08:42 +0100
-Subject: [PATCH] Add normal task queue also to non-thread version
-
-Non-thread builds are used by us for dhcp package. Make it working
-again.
-
-Related to [GL #4424] and [GL #4459].
---
- lib/isc/task.c | 14 ++++++++------
- 1 file changed, 8 insertions(+), 6 deletions(-)
-
-diff --git a/lib/isc/task.c b/lib/isc/task.c
-index cc83269..5315b51 100644
--- a/lib/isc/task.c
-+++ b/lib/isc/task.c
-@@ -1115,7 +1115,7 @@ dispatch(isc__taskmgr_t *manager, isc_taskqueue_t qid) {
- 		}
- #else /* USE_WORKER_THREADS */
- 		if (total_dispatch_count >= DEFAULT_TASKMGR_QUANTUM ||
-		    empty_readyq(manager))
-+		    empty_readyq(manager, qid))
- 			break;
- #endif /* USE_WORKER_THREADS */
- 		XTHREADTRACE(isc_msgcat_get(isc_msgcat, ISC_MSGSET_TASK,
-@@ -1318,11 +1318,11 @@ dispatch(isc__taskmgr_t *manager, isc_taskqueue_t qid) {
- 	}
- 
- #ifndef USE_WORKER_THREADS
-	ISC_LIST_APPENDLIST(manager->ready_tasks, new_ready_tasks, ready_link);
-	ISC_LIST_APPENDLIST(manager->ready_priority_tasks, new_priority_tasks,
-+	ISC_LIST_APPENDLIST(manager->ready_tasks[qid], new_ready_tasks, ready_link);
-+	ISC_LIST_APPENDLIST(manager->ready_priority_tasks[qid], new_priority_tasks,
- 			    ready_priority_link);
- 	manager->tasks_ready += tasks_ready;
-	if (empty_readyq(manager))
-+	if (empty_readyq(manager, qid))
- 		manager->mode = isc_taskmgrmode_normal;
- #endif
- 
-@@ -1713,7 +1713,8 @@ isc__taskmgr_ready(isc_taskmgr_t *manager0) {
- 		return (false);
- 
- 	LOCK(&manager->lock);
-	is_ready = !empty_readyq(manager);
-+	is_ready = !empty_readyq(manager, isc_taskqueue_normal) ||
-+		   !empty_readyq(manager, isc_taskqueue_slow);
- 	UNLOCK(&manager->lock);
- 
- 	return (is_ready);
-@@ -1730,7 +1731,8 @@ isc__taskmgr_dispatch(isc_taskmgr_t *manager0) {
- 	if (manager == NULL)
- 		return (ISC_R_NOTFOUND);
- 
-	dispatch(manager);
-+	dispatch(manager, isc_taskqueue_normal);
-+	dispatch(manager, isc_taskqueue_slow);
- 
- 	return (ISC_R_SUCCESS);
- }
-- 
-2.43.2
-
--- a/SOURCES/bind-9.11-CVE-2023-50387.patch
+++ b/SOURCES/bind-9.11-CVE-2023-50387.patch
@ -1,737 +0,0 @@
-From 4c20ab54ec503f65d8ee0b863cbf41103d95130a Mon Sep 17 00:00:00 2001
-From: Mark Andrews <marka@isc.org>
-Date: Wed, 22 Nov 2023 16:59:03 +1100
-Subject: [PATCH] Fail the DNSSEC validation on the first failure
-
-Be more strict when encountering DNSSEC validation failures - fail on
-the first failure.  This will break domains that have DNSSEC signing
-keys with duplicate key ids, but this is something that's much easier
-to fix on the authoritative side, so we are just going to be strict
-on the resolver side where it is causing performance problems.
-
-(cherry picked from commit 8b7ecba9885e163c07c2dd3e1ceab79b2ba89e34)
-
-Add normal and slow task queues
-
-Split the task manager queues into normal and slow task queues, so we
-can move the tasks that blocks processing for a long time (like DNSSEC
-validation) into the slow queue which doesn't block fast
-operations (like responding from the cache).  This mitigates the whole
-class of KeyTrap-like issues.
-
-(cherry picked from commit db083a21726300916fa0b9fd8a433a796fedf636)
-
-Don't iterate from start every time we select new signing key
-
-Improve the selecting of the new signing key by remembering where
-we stopped the iteration and just continue from that place instead
-of iterating from the start over and over again each time.
-
-(cherry picked from commit 75faeefcab47e4f1e12b358525190b4be90f97de)
-
-Optimize selecting the signing key
-
-Don't parse the crypto data before parsing and matching the id and the
-algorithm.
-
-(cherry picked from commit b38552cca7200a72658e482f8407f57516efc5db)
-
-6322.	[security]	Specific DNS answers could cause a denial-of-service
-			condition due to DNS validation taking a long time.
-			(CVE-2023-50387) [GL #4424]
-
-			The same code change also addresses another problem:
-			preparing NSEC3 closest encloser proofs could exhaust
-			available CPU resources. (CVE-2023-50868) [GL #4459]
---
- lib/dns/dst_api.c               |  25 ++++--
- lib/dns/include/dns/validator.h |   1 +
- lib/dns/include/dst/dst.h       |   4 +
- lib/dns/resolver.c              |   2 +-
- lib/dns/validator.c             |  97 +++++++++-----------
- lib/dns/win32/libdns.def.in     |   1 +
- lib/isc/include/isc/task.h      |  11 ++-
- lib/isc/task.c                  | 153 ++++++++++++++++++++++----------
- 8 files changed, 186 insertions(+), 108 deletions(-)
-
-diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c
-index 2156384ec1..6bcd99796c 100644
--- a/lib/dns/dst_api.c
-+++ b/lib/dns/dst_api.c
-@@ -105,6 +105,7 @@ static isc_result_t	frombuffer(dns_name_t *name,
- 				   dns_rdataclass_t rdclass,
- 				   isc_buffer_t *source,
- 				   isc_mem_t *mctx,
-+				   bool no_rdata,
- 				   dst_key_t **keyp);
- 
- static isc_result_t	algorithm_status(unsigned int alg);
-@@ -764,6 +765,13 @@ isc_result_t
- dst_key_fromdns(dns_name_t *name, dns_rdataclass_t rdclass,
- 		isc_buffer_t *source, isc_mem_t *mctx, dst_key_t **keyp)
- {
-+	return (dst_key_fromdns_ex(name, rdclass, source, mctx, false, keyp));
-+}
-+
-+isc_result_t
-+dst_key_fromdns_ex(dns_name_t *name, dns_rdataclass_t rdclass,
-+		   isc_buffer_t *source, isc_mem_t *mctx, bool no_rdata,
-+		   dst_key_t **keyp) {
- 	uint8_t alg, proto;
- 	uint32_t flags, extflags;
- 	dst_key_t *key = NULL;
-@@ -792,7 +800,7 @@ dst_key_fromdns(dns_name_t *name, dns_rdataclass_t rdclass,
- 	}
- 
- 	result = frombuffer(name, alg, flags, proto, rdclass, source,
-			    mctx, &key);
-+			    mctx, no_rdata, &key);
- 	if (result != ISC_R_SUCCESS)
- 		return (result);
- 	key->key_id = id;
-@@ -814,7 +822,7 @@ dst_key_frombuffer(dns_name_t *name, unsigned int alg,
- 	REQUIRE(dst_initialized);
- 
- 	result = frombuffer(name, alg, flags, protocol, rdclass, source,
-			    mctx, &key);
-+			    mctx, false, &key);
- 	if (result != ISC_R_SUCCESS)
- 		return (result);
- 
-@@ -1915,7 +1923,8 @@ computeid(dst_key_t *key) {
- static isc_result_t
- frombuffer(dns_name_t *name, unsigned int alg, unsigned int flags,
- 	   unsigned int protocol, dns_rdataclass_t rdclass,
-	   isc_buffer_t *source, isc_mem_t *mctx, dst_key_t **keyp)
-+	   isc_buffer_t *source, isc_mem_t *mctx, bool no_rdata,
-+	   dst_key_t **keyp)
- {
- 	dst_key_t *key;
- 	isc_result_t ret;
-@@ -1940,10 +1949,12 @@ frombuffer(dns_name_t *name, unsigned int alg, unsigned int flags,
- 			return (DST_R_UNSUPPORTEDALG);
- 		}
- 
-		ret = key->func->fromdns(key, source);
-		if (ret != ISC_R_SUCCESS) {
-			dst_key_free(&key);
-			return (ret);
-+		if (!no_rdata) {
-+			ret = key->func->fromdns(key, source);
-+			if (ret != ISC_R_SUCCESS) {
-+				dst_key_free(&key);
-+				return (ret);
-+			}
- 		}
- 	}
- 
-diff --git a/lib/dns/include/dns/validator.h b/lib/dns/include/dns/validator.h
-index cc4478d6d4..b4bf8f29db 100644
--- a/lib/dns/include/dns/validator.h
-+++ b/lib/dns/include/dns/validator.h
-@@ -160,6 +160,7 @@ struct dns_validator {
- 	unsigned int			depth;
- 	unsigned int			authcount;
- 	unsigned int			authfail;
-+	bool				failed;
- 	isc_stdtime_t			start;
- };
- 
-diff --git a/lib/dns/include/dst/dst.h b/lib/dns/include/dst/dst.h
-index 180c841307..a8be2daf67 100644
--- a/lib/dns/include/dst/dst.h
-+++ b/lib/dns/include/dst/dst.h
-@@ -435,6 +435,10 @@ dst_key_tofile(const dst_key_t *key, int type, const char *directory);
-  */
- 
- isc_result_t
-+dst_key_fromdns_ex(dns_name_t *name, dns_rdataclass_t rdclass,
-+		   isc_buffer_t *source, isc_mem_t *mctx, bool no_rdata,
-+		   dst_key_t **keyp);
-+isc_result_t
- dst_key_fromdns(dns_name_t *name, dns_rdataclass_t rdclass,
- 		isc_buffer_t *source, isc_mem_t *mctx, dst_key_t **keyp);
- /*%<
-diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
-index 4f71f48039..487107614c 100644
--- a/lib/dns/resolver.c
-+++ b/lib/dns/resolver.c
-@@ -9267,7 +9267,7 @@ dns_resolver_create(dns_view_t *view,
- 		if (result != ISC_R_SUCCESS)
- 			goto cleanup_buckets;
- 		res->buckets[i].task = NULL;
-		result = isc_task_create(taskmgr, 0, &res->buckets[i].task);
-+		result = isc_task_create(taskmgr, ISC_TASK_QUANTUM_SLOW, &res->buckets[i].task);
- 		if (result != ISC_R_SUCCESS) {
- 			DESTROYLOCK(&res->buckets[i].lock);
- 			goto cleanup_buckets;
-diff --git a/lib/dns/validator.c b/lib/dns/validator.c
-index 2a5c3caa6a..0b257fe874 100644
--- a/lib/dns/validator.c
-+++ b/lib/dns/validator.c
-@@ -1207,6 +1207,12 @@ create_validator(dns_validator_t *val, dns_name_t *name, dns_rdatatype_t type,
-  * val->key at it.
-  *
-  * If val->key is non-NULL, this returns the next matching key.
-+ * If val->key is already non-NULL, start searching from the next position in
-+ * 'rdataset' to find the *next* key that could have signed 'siginfo', then
-+ * set val->key to that.
-+ *
-+ * Returns ISC_R_SUCCESS if a possible matching key has been found,
-+ * ISC_R_NOTFOUND if not. Any other value indicates error.
-  */
- static isc_result_t
- get_dst_key(dns_validator_t *val, dns_rdata_rrsig_t *siginfo,
-@@ -1216,54 +1222,59 @@ get_dst_key(dns_validator_t *val, dns_rdata_rrsig_t *siginfo,
- 	isc_buffer_t b;
- 	dns_rdata_t rdata = DNS_RDATA_INIT;
- 	dst_key_t *oldkey = val->key;
-	bool foundold;
-+	bool no_rdata = false;
- 
-	if (oldkey == NULL)
-		foundold = true;
-	else {
-		foundold = false;
-+	if (oldkey == NULL) {
-+		result = dns_rdataset_first(rdataset);
-+	} else {
-+		dst_key_free(&oldkey);
- 		val->key = NULL;
-+		result = dns_rdataset_next(rdataset);
-+	}
-+
-+	if (result != ISC_R_SUCCESS) {
-+		goto done;
- 	}
- 
-	result = dns_rdataset_first(rdataset);
-	if (result != ISC_R_SUCCESS)
-		goto failure;
- 	do {
- 		dns_rdataset_current(rdataset, &rdata);
- 
- 		isc_buffer_init(&b, rdata.data, rdata.length);
- 		isc_buffer_add(&b, rdata.length);
- 		INSIST(val->key == NULL);
-		result = dst_key_fromdns(&siginfo->signer, rdata.rdclass, &b,
-					 val->view->mctx, &val->key);
-+		result = dst_key_fromdns_ex(&siginfo->signer, rdata.rdclass, &b,
-+					    val->view->mctx, no_rdata,
-+					    &val->key);
- 		if (result == ISC_R_SUCCESS) {
- 			if (siginfo->algorithm ==
- 				    (dns_secalg_t)dst_key_alg(val->key) &&
- 			    siginfo->keyid ==
- 				    (dns_keytag_t)dst_key_id(val->key) &&
-+			    (dst_key_flags(val->key) & DNS_KEYFLAG_REVOKE) ==
-+				    0 &&
- 			    dst_key_iszonekey(val->key))
- 			{
-				if (foundold) {
-					/*
-					 * This is the key we're looking for.
-					 */
-					return (ISC_R_SUCCESS);
-				} else if (dst_key_compare(oldkey, val->key)) {
-					foundold = true;
-					dst_key_free(&oldkey);
-+				if (no_rdata) {
-+					/* Retry with full key */
-+					dns_rdata_reset(&rdata);
-+					dst_key_free(&val->key);
-+					no_rdata = false;
-+					continue;
- 				}
-+				/* This is the key we're looking for. */
-+				goto done;
- 			}
- 			dst_key_free(&val->key);
- 		}
- 		dns_rdata_reset(&rdata);
- 		result = dns_rdataset_next(rdataset);
-+		no_rdata = true;
- 	} while (result == ISC_R_SUCCESS);
-	if (result == ISC_R_NOMORE)
-		result = ISC_R_NOTFOUND;
- 
- failure:
-	if (oldkey != NULL)
-		dst_key_free(&oldkey);
-+done:
-+	if (result == ISC_R_NOMORE) {
-+		result = ISC_R_NOTFOUND;
-+	}
- 
- 	return (result);
- }
-@@ -1633,37 +1644,13 @@ validate(dns_validator_t *val, bool resume) {
- 			continue;
- 		}
- 
-		do {
-			vresult = verify(val, val->key, &rdata,
-					val->siginfo->keyid);
-			if (vresult == ISC_R_SUCCESS)
-				break;
-			if (val->keynode != NULL) {
-				dns_keynode_t *nextnode = NULL;
-				result = dns_keytable_findnextkeynode(
-							val->keytable,
-							val->keynode,
-							&nextnode);
-				dns_keytable_detachkeynode(val->keytable,
-							   &val->keynode);
-				val->keynode = nextnode;
-				if (result != ISC_R_SUCCESS) {
-					val->key = NULL;
-					break;
-				}
-				val->key = dns_keynode_key(val->keynode);
-				if (val->key == NULL)
-					break;
-			} else {
-				if (get_dst_key(val, val->siginfo, val->keyset)
-				    != ISC_R_SUCCESS)
-					break;
-			}
-		} while (1);
-		if (vresult != ISC_R_SUCCESS)
-+		vresult = verify(val, val->key, &rdata,
-+				val->siginfo->keyid);
-+		if (vresult != ISC_R_SUCCESS) {
-+			val->failed = true;
- 			validator_log(val, ISC_LOG_DEBUG(3),
- 				      "failed to verify rdataset");
-		else {
-+		} else {
- 			dns_rdataset_trimttl(event->rdataset,
- 					     event->sigrdataset,
- 					     val->siginfo, val->start,
-@@ -1700,9 +1687,13 @@ validate(dns_validator_t *val, bool resume) {
- 		} else {
- 			validator_log(val, ISC_LOG_DEBUG(3),
- 				      "verify failure: %s",
-				      isc_result_totext(result));
-+				      isc_result_totext(vresult));
- 			resume = false;
- 		}
-+		if (val->failed) {
-+			result = ISC_R_NOMORE;
-+			break;
-+		}
- 	}
- 	if (result != ISC_R_NOMORE) {
- 		validator_log(val, ISC_LOG_DEBUG(3),
-diff --git a/lib/dns/win32/libdns.def.in b/lib/dns/win32/libdns.def.in
-index f597049493..7320653439 100644
--- a/lib/dns/win32/libdns.def.in
-+++ b/lib/dns/win32/libdns.def.in
-@@ -1439,6 +1439,7 @@ dst_key_format
- dst_key_free
- dst_key_frombuffer
- dst_key_fromdns
-+dst_key_fromdns_ex
- dst_key_fromfile
- dst_key_fromgssapi
- dst_key_fromlabel
-diff --git a/lib/isc/include/isc/task.h b/lib/isc/include/isc/task.h
-index 28e5e25fc6..42f7763869 100644
--- a/lib/isc/include/isc/task.h
-+++ b/lib/isc/include/isc/task.h
-@@ -98,8 +98,15 @@ ISC_LANG_BEGINDECLS
-  ***/
- 
- typedef enum {
-		isc_taskmgrmode_normal = 0,
-		isc_taskmgrmode_privileged
-+	isc_taskqueue_normal = 0,
-+	isc_taskqueue_slow = 1,
-+} isc_taskqueue_t;
-+
-+#define ISC_TASK_QUANTUM_SLOW 1024
-+
-+typedef enum {
-+	isc_taskmgrmode_normal = 0,
-+	isc_taskmgrmode_privileged
- } isc_taskmgrmode_t;
- 
- /*% Task and task manager methods */
-diff --git a/lib/isc/task.c b/lib/isc/task.c
-index 048639350b..cc83269df2 100644
--- a/lib/isc/task.c
-+++ b/lib/isc/task.c
-@@ -107,6 +107,7 @@ struct isc__task {
- 	isc_eventlist_t			on_shutdown;
- 	unsigned int			nevents;
- 	unsigned int			quantum;
-+	unsigned int			qid;
- 	unsigned int			flags;
- 	isc_stdtime_t			now;
- 	isc_time_t			tnow;
-@@ -141,11 +142,11 @@ struct isc__taskmgr {
- 	/* Locked by task manager lock. */
- 	unsigned int			default_quantum;
- 	LIST(isc__task_t)		tasks;
-	isc__tasklist_t			ready_tasks;
-	isc__tasklist_t			ready_priority_tasks;
-+	isc__tasklist_t			ready_tasks[2];
-+	isc__tasklist_t			ready_priority_tasks[2];
- 	isc_taskmgrmode_t		mode;
- #ifdef ISC_PLATFORM_USETHREADS
-	isc_condition_t			work_available;
-+	isc_condition_t			work_available[2];
- 	isc_condition_t			exclusive_granted;
- 	isc_condition_t			paused;
- #endif /* ISC_PLATFORM_USETHREADS */
-@@ -247,13 +248,13 @@ isc_taskmgrmode_t
- isc__taskmgr_mode(isc_taskmgr_t *manager0);
- 
- static inline bool
-empty_readyq(isc__taskmgr_t *manager);
-+empty_readyq(isc__taskmgr_t *manager, isc_taskqueue_t qid);
- 
- static inline isc__task_t *
-pop_readyq(isc__taskmgr_t *manager);
-+pop_readyq(isc__taskmgr_t *manager, isc_taskqueue_t qid);
- 
- static inline void
-push_readyq(isc__taskmgr_t *manager, isc__task_t *task);
-+push_readyq(isc__taskmgr_t *manager, isc__task_t *task, isc_taskqueue_t qid);
- 
- static struct isc__taskmethods {
- 	isc_taskmethods_t methods;
-@@ -324,7 +325,8 @@ task_finished(isc__task_t *task) {
- 		 * any idle worker threads so they
- 		 * can exit.
- 		 */
-		BROADCAST(&manager->work_available);
-+		BROADCAST(&manager->work_available[isc_taskqueue_normal]);
-+		BROADCAST(&manager->work_available[isc_taskqueue_slow]);
- 	}
- #endif /* USE_WORKER_THREADS */
- 	UNLOCK(&manager->lock);
-@@ -364,7 +366,13 @@ isc__task_create(isc_taskmgr_t *manager0, unsigned int quantum,
- 	INIT_LIST(task->events);
- 	INIT_LIST(task->on_shutdown);
- 	task->nevents = 0;
-	task->quantum = quantum;
-+	if (quantum >= ISC_TASK_QUANTUM_SLOW) {
-+		task->qid = isc_taskqueue_slow;
-+		task->quantum = quantum - ISC_TASK_QUANTUM_SLOW;
-+	} else {
-+		task->qid = isc_taskqueue_normal;
-+		task->quantum = quantum;
-+	}
- 	task->flags = 0;
- 	task->now = 0;
- 	isc_time_settoepoch(&task->tnow);
-@@ -476,11 +484,11 @@ task_ready(isc__task_t *task) {
- 
- 	LOCK(&manager->lock);
- 	LOCK(&task->lock);
-	push_readyq(manager, task);
-+	push_readyq(manager, task, task->qid);
- 	UNLOCK(&task->lock);
- #ifdef USE_WORKER_THREADS
- 	if (manager->mode == isc_taskmgrmode_normal || has_privilege)
-		SIGNAL(&manager->work_available);
-+		SIGNAL(&manager->work_available[task->qid]);
- #endif /* USE_WORKER_THREADS */
- 	UNLOCK(&manager->lock);
- }
-@@ -961,13 +969,13 @@ isc__task_getcurrenttimex(isc_task_t *task0, isc_time_t *t) {
-  * Caller must hold the task manager lock.
-  */
- static inline bool
-empty_readyq(isc__taskmgr_t *manager) {
-+empty_readyq(isc__taskmgr_t *manager, isc_taskqueue_t qid) {
- 	isc__tasklist_t queue;
- 
- 	if (manager->mode == isc_taskmgrmode_normal)
-		queue = manager->ready_tasks;
-+		queue = manager->ready_tasks[qid];
- 	else
-		queue = manager->ready_priority_tasks;
-+		queue = manager->ready_priority_tasks[qid];
- 
- 	return (EMPTY(queue));
- }
-@@ -981,18 +989,18 @@ empty_readyq(isc__taskmgr_t *manager) {
-  * Caller must hold the task manager lock.
-  */
- static inline isc__task_t *
-pop_readyq(isc__taskmgr_t *manager) {
-+pop_readyq(isc__taskmgr_t *manager, isc_taskqueue_t qid) {
- 	isc__task_t *task;
- 
- 	if (manager->mode == isc_taskmgrmode_normal)
-		task = HEAD(manager->ready_tasks);
-+		task = HEAD(manager->ready_tasks[qid]);
- 	else
-		task = HEAD(manager->ready_priority_tasks);
-+		task = HEAD(manager->ready_priority_tasks[qid]);
- 
- 	if (task != NULL) {
-		DEQUEUE(manager->ready_tasks, task, ready_link);
-+		DEQUEUE(manager->ready_tasks[qid], task, ready_link);
- 		if (ISC_LINK_LINKED(task, ready_priority_link))
-			DEQUEUE(manager->ready_priority_tasks, task,
-+			DEQUEUE(manager->ready_priority_tasks[qid], task,
- 				ready_priority_link);
- 	}
- 
-@@ -1006,16 +1014,16 @@ pop_readyq(isc__taskmgr_t *manager) {
-  * Caller must hold the task manager lock.
-  */
- static inline void
-push_readyq(isc__taskmgr_t *manager, isc__task_t *task) {
-	ENQUEUE(manager->ready_tasks, task, ready_link);
-+push_readyq(isc__taskmgr_t *manager, isc__task_t *task, isc_taskqueue_t qid) {
-+	ENQUEUE(manager->ready_tasks[qid], task, ready_link);
- 	if ((task->flags & TASK_F_PRIVILEGED) != 0)
-		ENQUEUE(manager->ready_priority_tasks, task,
-+		ENQUEUE(manager->ready_priority_tasks[qid], task,
- 			ready_priority_link);
- 	manager->tasks_ready++;
- }
- 
- static void
-dispatch(isc__taskmgr_t *manager) {
-+dispatch(isc__taskmgr_t *manager, isc_taskqueue_t qid) {
- 	isc__task_t *task;
- #ifndef USE_WORKER_THREADS
- 	unsigned int total_dispatch_count = 0;
-@@ -1094,13 +1102,13 @@ dispatch(isc__taskmgr_t *manager) {
- 		 * If a pause has been requested, don't do any work
- 		 * until it's been released.
- 		 */
-		while ((empty_readyq(manager) || manager->pause_requested ||
-+		while ((empty_readyq(manager, qid) || manager->pause_requested ||
- 			manager->exclusive_requested) && !FINISHED(manager))
- 		{
- 			XTHREADTRACE(isc_msgcat_get(isc_msgcat,
- 						    ISC_MSGSET_GENERAL,
- 						    ISC_MSG_WAIT, "wait"));
-			WAIT(&manager->work_available, &manager->lock);
-+			WAIT(&manager->work_available[qid], &manager->lock);
- 			XTHREADTRACE(isc_msgcat_get(isc_msgcat,
- 						    ISC_MSGSET_TASK,
- 						    ISC_MSG_AWAKE, "awake"));
-@@ -1113,7 +1121,7 @@ dispatch(isc__taskmgr_t *manager) {
- 		XTHREADTRACE(isc_msgcat_get(isc_msgcat, ISC_MSGSET_TASK,
- 					    ISC_MSG_WORKING, "working"));
- 
-		task = pop_readyq(manager);
-+		task = pop_readyq(manager, qid);
- 		if (task != NULL) {
- 			unsigned int dispatch_count = 0;
- 			bool done = false;
-@@ -1278,7 +1286,7 @@ dispatch(isc__taskmgr_t *manager) {
- 				 */
- #ifdef USE_WORKER_THREADS
- 				LOCK(&task->lock);
-				push_readyq(manager, task);
-+				push_readyq(manager, task, qid);
- 				UNLOCK(&task->lock);
- #else
- 				ENQUEUE(new_ready_tasks, task, ready_link);
-@@ -1297,10 +1305,14 @@ dispatch(isc__taskmgr_t *manager) {
- 		 * we're stuck.  Automatically drop privileges at that
- 		 * point and continue with the regular ready queue.
- 		 */
-		if (manager->tasks_running == 0 && empty_readyq(manager)) {
-+		if (manager->tasks_running == 0 && empty_readyq(manager, isc_taskqueue_normal) && empty_readyq(manager, isc_taskqueue_slow)) {
- 			manager->mode = isc_taskmgrmode_normal;
-			if (!empty_readyq(manager))
-				BROADCAST(&manager->work_available);
-+			if (!empty_readyq(manager, isc_taskqueue_normal)) {
-+				BROADCAST(&manager->work_available[isc_taskqueue_normal]);
-+			}
-+			if (!empty_readyq(manager, isc_taskqueue_slow)) {
-+				BROADCAST(&manager->work_available[isc_taskqueue_slow]);
-+			}
- 		}
- #endif
- 	}
-@@ -1322,13 +1334,37 @@ static isc_threadresult_t
- #ifdef _WIN32
- WINAPI
- #endif
-run(void *uap) {
-+run_normal(void *uap) {
- 	isc__taskmgr_t *manager = uap;
- 
- 	XTHREADTRACE(isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL,
- 				    ISC_MSG_STARTING, "starting"));
- 
-	dispatch(manager);
-+	dispatch(manager, isc_taskqueue_normal);
-+
-+	XTHREADTRACE(isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL,
-+				    ISC_MSG_EXITING, "exiting"));
-+
-+#ifdef OPENSSL_LEAKS
-+	ERR_remove_state(0);
-+#endif
-+
-+	return ((isc_threadresult_t)0);
-+}
-+#endif /* USE_WORKER_THREADS */
-+
-+#ifdef USE_WORKER_THREADS
-+static isc_threadresult_t
-+#ifdef _WIN32
-+WINAPI
-+#endif
-+run_slow(void *uap) {
-+	isc__taskmgr_t *manager = uap;
-+
-+	XTHREADTRACE(isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL,
-+				    ISC_MSG_STARTING, "starting"));
-+
-+	dispatch(manager, isc_taskqueue_slow);
- 
- 	XTHREADTRACE(isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL,
- 				    ISC_MSG_EXITING, "exiting"));
-@@ -1347,7 +1383,8 @@ manager_free(isc__taskmgr_t *manager) {
- 
- #ifdef USE_WORKER_THREADS
- 	(void)isc_condition_destroy(&manager->exclusive_granted);
-	(void)isc_condition_destroy(&manager->work_available);
-+	(void)isc_condition_destroy(&manager->work_available[isc_taskqueue_normal]);
-+	(void)isc_condition_destroy(&manager->work_available[isc_taskqueue_slow]);
- 	(void)isc_condition_destroy(&manager->paused);
- 	isc_mem_free(manager->mctx, manager->threads);
- #endif /* USE_WORKER_THREADS */
-@@ -1414,12 +1451,20 @@ isc__taskmgr_create(isc_mem_t *mctx, unsigned int workers,
- #ifdef USE_WORKER_THREADS
- 	manager->workers = 0;
- 	manager->threads = isc_mem_allocate(mctx,
-					    workers * sizeof(isc_thread_t));
-+					    2 * workers * sizeof(isc_thread_t));
- 	if (manager->threads == NULL) {
- 		result = ISC_R_NOMEMORY;
- 		goto cleanup_lock;
- 	}
-	if (isc_condition_init(&manager->work_available) != ISC_R_SUCCESS) {
-+	if (isc_condition_init(&manager->work_available[isc_taskqueue_normal]) != ISC_R_SUCCESS) {
-+		UNEXPECTED_ERROR(__FILE__, __LINE__,
-+				 "isc_condition_init() %s",
-+				 isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL,
-+						ISC_MSG_FAILED, "failed"));
-+		result = ISC_R_UNEXPECTED;
-+		goto cleanup_threads;
-+	}
-+	if (isc_condition_init(&manager->work_available[isc_taskqueue_slow]) != ISC_R_SUCCESS) {
- 		UNEXPECTED_ERROR(__FILE__, __LINE__,
- 				 "isc_condition_init() %s",
- 				 isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL,
-@@ -1448,8 +1493,10 @@ isc__taskmgr_create(isc_mem_t *mctx, unsigned int workers,
- 		default_quantum = DEFAULT_DEFAULT_QUANTUM;
- 	manager->default_quantum = default_quantum;
- 	INIT_LIST(manager->tasks);
-	INIT_LIST(manager->ready_tasks);
-	INIT_LIST(manager->ready_priority_tasks);
-+	INIT_LIST(manager->ready_tasks[isc_taskqueue_normal]);
-+	INIT_LIST(manager->ready_tasks[isc_taskqueue_slow]);
-+	INIT_LIST(manager->ready_priority_tasks[isc_taskqueue_normal]);
-+	INIT_LIST(manager->ready_priority_tasks[isc_taskqueue_slow]);
- 	manager->tasks_running = 0;
- 	manager->tasks_ready = 0;
- 	manager->exclusive_requested = false;
-@@ -1465,7 +1512,19 @@ isc__taskmgr_create(isc_mem_t *mctx, unsigned int workers,
- 	 * Start workers.
- 	 */
- 	for (i = 0; i < workers; i++) {
-		if (isc_thread_create(run, manager,
-+		if (isc_thread_create(run_normal, manager,
-+				      &manager->threads[manager->workers]) ==
-+		    ISC_R_SUCCESS) {
-+			char name[21];	/* thread name limit on Linux */
-+			snprintf(name, sizeof(name), "isc-worker%04u", i);
-+			isc_thread_setname(manager->threads[manager->workers],
-+					   name);
-+			manager->workers++;
-+			started++;
-+		}
-+	}
-+	for (; i < workers * 2; i++) {
-+		if (isc_thread_create(run_slow, manager,
- 				      &manager->threads[manager->workers]) ==
- 		    ISC_R_SUCCESS) {
- 			char name[21];	/* thread name limit on Linux */
-@@ -1482,7 +1541,7 @@ isc__taskmgr_create(isc_mem_t *mctx, unsigned int workers,
- 		manager_free(manager);
- 		return (ISC_R_NOTHREADS);
- 	}
-	isc_thread_setconcurrency(workers);
-+	isc_thread_setconcurrency(workers * 2);
- #endif /* USE_WORKER_THREADS */
- #ifdef USE_SHARED_MANAGER
- 	manager->refs = 1;
-@@ -1497,7 +1556,8 @@ isc__taskmgr_create(isc_mem_t *mctx, unsigned int workers,
-  cleanup_exclusivegranted:
- 	(void)isc_condition_destroy(&manager->exclusive_granted);
-  cleanup_workavailable:
-	(void)isc_condition_destroy(&manager->work_available);
-+	(void)isc_condition_destroy(&manager->work_available[isc_taskqueue_slow]);
-+	(void)isc_condition_destroy(&manager->work_available[isc_taskqueue_normal]);
-  cleanup_threads:
- 	isc_mem_free(mctx, manager->threads);
-  cleanup_lock:
-@@ -1582,7 +1642,7 @@ isc__taskmgr_destroy(isc_taskmgr_t **managerp) {
- 	     task = NEXT(task, link)) {
- 		LOCK(&task->lock);
- 		if (task_shutdown(task))
-			push_readyq(manager, task);
-+			push_readyq(manager, task, task->qid);
- 		UNLOCK(&task->lock);
- 	}
- #ifdef USE_WORKER_THREADS
-@@ -1591,7 +1651,8 @@ isc__taskmgr_destroy(isc_taskmgr_t **managerp) {
- 	 * there's work left to do, and if there are already no tasks left
- 	 * it will cause the workers to see manager->exiting.
- 	 */
-	BROADCAST(&manager->work_available);
-+	BROADCAST(&manager->work_available[isc_taskqueue_normal]);
-+	BROADCAST(&manager->work_available[isc_taskqueue_slow]);
- 	UNLOCK(&manager->lock);
- 
- 	/*
-@@ -1693,7 +1754,8 @@ isc__taskmgr_resume(isc_taskmgr_t *manager0) {
- 	LOCK(&manager->lock);
- 	if (manager->pause_requested) {
- 		manager->pause_requested = false;
-		BROADCAST(&manager->work_available);
-+		BROADCAST(&manager->work_available[isc_taskqueue_normal]);
-+		BROADCAST(&manager->work_available[isc_taskqueue_slow]);
- 	}
- 	UNLOCK(&manager->lock);
- }
-@@ -1778,7 +1840,8 @@ isc__task_endexclusive(isc_task_t *task0) {
- 	LOCK(&manager->lock);
- 	REQUIRE(manager->exclusive_requested);
- 	manager->exclusive_requested = false;
-	BROADCAST(&manager->work_available);
-+	BROADCAST(&manager->work_available[isc_taskqueue_normal]);
-+	BROADCAST(&manager->work_available[isc_taskqueue_slow]);
- 	UNLOCK(&manager->lock);
- #else
- 	UNUSED(task0);
-@@ -1804,10 +1867,10 @@ isc__task_setprivilege(isc_task_t *task0, bool priv) {
- 
- 	LOCK(&manager->lock);
- 	if (priv && ISC_LINK_LINKED(task, ready_link))
-		ENQUEUE(manager->ready_priority_tasks, task,
-+		ENQUEUE(manager->ready_priority_tasks[task->qid], task,
- 			ready_priority_link);
- 	else if (!priv && ISC_LINK_LINKED(task, ready_priority_link))
-		DEQUEUE(manager->ready_priority_tasks, task,
-+		DEQUEUE(manager->ready_priority_tasks[task->qid], task,
- 			ready_priority_link);
- 	UNLOCK(&manager->lock);
- }
-- 
-2.43.2
-
--- a/SOURCES/bind-9.11-CVE-2024-1737-runtime-env.patch
+++ b/SOURCES/bind-9.11-CVE-2024-1737-runtime-env.patch
@ -1,133 +0,0 @@
-From 0a7909045f9e1bf74c1f0fd561a8ef5f55481e8f Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Mon, 29 Jul 2024 16:20:50 +0200
-Subject: [PATCH] Allow global runtime definition by DNS_RBTDB_MAX_RTYPES
-
-Modify rbtdb to not set it only at runtime, but allow setting that also
-in runtime via environment variable. It is still possible to modify
-default during the build define. In addition to it allows runtime change
-also. Can be positive number to set limit, 0 disabled the check.
-
-Similarly add also DNS_RDATASET_MAX_RECORDS to set maximum number of
-records for a single name. This must be positive number, 0 is no accepted.
-
-These replaces max-records-per-type and max-types-per-name in later
-versions. But can be configured only by environment and can be
-configured only globally, not in each view or zone.
---
- lib/dns/rbtdb.c     | 21 +++++++++++++++++++--
- lib/dns/rdataslab.c | 24 ++++++++++++++++++++++--
- 2 files changed, 41 insertions(+), 4 deletions(-)
-
-diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
-index a3cb8dc871..0104c3ee36 100644
--- a/lib/dns/rbtdb.c
-+++ b/lib/dns/rbtdb.c
-@@ -6320,15 +6320,29 @@ update_recordsandbytes(bool add, rbtdb_version_t *rbtversion,
- #define DNS_RBTDB_MAX_RTYPES 100
- #endif /* DNS_RBTDB_MAX_RTYPES */
- 
-+static uint32_t dns_g_rbtdb_max_rtypes = DNS_RBTDB_MAX_RTYPES;
-+
-+static void
-+init_max_rtypes(void) {
-+	/* Red Hat change, allow setting different max value by environment. */
-+	const char *max = getenv("DNS_RBTDB_MAX_RTYPES");
-+	if (max) {
-+		char *endp = NULL;
-+		long l = strtol(max, &endp, 10);
-+		if (max != endp && endp && !*endp && l >= 0)
-+			dns_g_rbtdb_max_rtypes = l;
-+	}
-+}
-+
- static bool
- overmaxtype(dns_rbtdb_t *rbtdb, uint32_t ntypes) {
- 	UNUSED(rbtdb);
- 
-	if (DNS_RBTDB_MAX_RTYPES == 0) {
-+	if (dns_g_rbtdb_max_rtypes == 0) {
- 		return (false);
- 	}
- 
-	return (ntypes >= DNS_RBTDB_MAX_RTYPES);
-+	return (ntypes >= dns_g_rbtdb_max_rtypes);
- }
- 
- static bool
-@@ -8831,6 +8845,8 @@ static dns_dbmethods_t cache_methods = {
- 	getservestalettl
- };
- 
-+static isc_once_t once_db = ISC_ONCE_INIT;
-+
- isc_result_t
- #ifdef DNS_RBTDB_VERSION64
- dns_rbtdb64_create
-@@ -8850,6 +8866,7 @@ dns_rbtdb_create
- 
- 	/* Keep the compiler happy. */
- 	UNUSED(driverarg);
-+	RUNTIME_CHECK(isc_once_do(&once_db, init_max_rtypes) == ISC_R_SUCCESS);
- 
- 	rbtdb = isc_mem_get(mctx, sizeof(*rbtdb));
- 	if (rbtdb == NULL)
-diff --git a/lib/dns/rdataslab.c b/lib/dns/rdataslab.c
-index 347b7d2ce8..9566f79671 100644
--- a/lib/dns/rdataslab.c
-+++ b/lib/dns/rdataslab.c
-@@ -17,6 +17,7 @@
- #include <stdlib.h>
- 
- #include <isc/mem.h>
-+#include <isc/once.h>
- #include <isc/region.h>
- #include <isc/string.h>		/* Required for HP/UX (and others?) */
- #include <isc/util.h>
-@@ -119,6 +120,23 @@ fillin_offsets(unsigned char *offsetbase, unsigned int *offsettable,
- #define DNS_RDATASET_MAX_RECORDS 100
- #endif /* DNS_RDATASET_MAX_RECORDS */
- 
-+static unsigned int dns_g_rdataset_max_records = DNS_RDATASET_MAX_RECORDS;
-+static isc_once_t once = ISC_ONCE_INIT;
-+
-+static void
-+init_max_records(void) {
-+	/* Red Hat change, allow setting different max value by environment. */
-+	const char *max = getenv("DNS_RDATASET_MAX_RECORDS");
-+	if (max) {
-+		char *endp = NULL;
-+		long l = strtol(max, &endp, 10);
-+		if (max != endp && endp && !*endp && l > 0)
-+			dns_g_rdataset_max_records = l;
-+	}
-+}
-+
-+
-+
- isc_result_t
- dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx,
- 			   isc_region_t *region, unsigned int reservelen)
-@@ -165,7 +183,9 @@ dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx,
- 		return (ISC_R_SUCCESS);
- 	}
- 
-	if (nitems > DNS_RDATASET_MAX_RECORDS) {
-+	RUNTIME_CHECK(isc_once_do(&once, init_max_records) == ISC_R_SUCCESS);
-+
-+	if (nitems > dns_g_rdataset_max_records) {
- 		return (DNS_R_TOOMANYRECORDS);
- 	}
- 
-@@ -662,7 +682,7 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab,
- #endif
- 	INSIST(ocount > 0 && ncount > 0);
- 
-	if (ocount + ncount > DNS_RDATASET_MAX_RECORDS) {
-+	if (ocount + ncount > dns_g_rdataset_max_records) {
- 		return (DNS_R_TOOMANYRECORDS);
- 	}
- 
-- 
-2.45.2
-
--- a/SOURCES/bind-9.11-CVE-2024-1737.patch
+++ b/SOURCES/bind-9.11-CVE-2024-1737.patch
@ -1,317 +0,0 @@
-From 71df06e2bf3da31c5d542fb33dbda67b21537322 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
-Date: Fri, 1 Mar 2024 08:26:07 +0100
-Subject: [PATCH] [9.11][CVE-2024-1737] Add a limit to the number of RRs in
- RRSets
-
-Add a limit to the number of RRs in RRSets
-
-Previously, the number of RRs in the RRSets were internally unlimited.
-As the data structure that holds the RRs is just a linked list, and
-there are places where we just walk through all of the RRs, adding an
-RRSet with huge number of RRs inside would slow down processing of said
-RRSets.
-
-The fix for end-of-life branches make the limit compile-time only for
-simplicity and the limit can be changed at the compile time by adding
-following define to CFLAGS:
-
-    -DDNS_RDATASET_MAX_RECORDS=<limit>
-
-(cherry picked from commit c5c4d00c38530390c9e1ae4c98b65fbbadfe9e5e)
-(cherry picked from commit 7f705778af729ada7fec36ac4b456c73329bd996)
-(cherry picked from commit b9b5485b22c364fb88c27aa04bad4c8f616da3fa)
-
-Add a limit to the number of RR types for single name
-
-Previously, the number of RR types for a single owner name was limited
-only by the maximum number of the types (64k).  As the data structure
-that holds the RR types for the database node is just a linked list, and
-there are places where we just walk through the whole list (again and
-again), adding a large number of RR types for a single owner named with
-would slow down processing of such name (database node).
-
-Add a hard-coded limit (100) to cap the number of the RR types for a single
-owner.  The limit can be changed at the compile time by adding following
-define to CFLAGS:
-
-    -DDNS_RBTDB_MAX_RTYPES=<limit>
-
-(cherry picked from commit 538b843d84f49ba5125ff545e3d0cf1c8434a8f2)
-(cherry picked from commit 3f10d6eff035702796ba82cd28b9f7cf9836e743)
-
-Optimize the slabheader placement for certain RRTypes
-
-Mark the infrastructure RRTypes as "priority" types and place them at
-the beginning of the rdataslab header data graph.  The non-priority
-types either go right after the priority types (if any).
-
-(cherry picked from commit 3ac482be7fd058d284e89873021339579fad0615)
-(cherry picked from commit 23a4652346fb2877d6246b1eebaa967969dbde16)
-
-[9.11][CVE-2024-1737 (part 2)] Be smarter about refusing to add many RR types to the database
-
-Expand the list of the priority types
-
-Add HTTPS, SVCB, SRV, PTR, NAPTR, DNSKEY and TXT records to the list of
-the priority types that are put at the beginning of the slabheader list
-for faster access and to avoid eviction when there are more types than
-the max-types-per-name limit.
-
-(cherry picked from commit b27c6bcce894786a8e082eafd59eccbf6f2731cb)
-(cherry picked from commit 3e0a67e4bdb253dae3a03a45c1aa117239a3313d)
-
-Be smarter about refusing to add many RR types to the database
-
-Instead of outright refusing to add new RR types to the cache, be a bit
-smarter:
-
-1. If the new header type is in our priority list, we always add either
-   positive or negative entry at the beginning of the list.
-
-2. If the new header type is negative entry, and we are over the limit,
-   we mark it as ancient immediately, so it gets evicted from the cache
-   as soon as possible.
-
-3. Otherwise add the new header after the priority headers (or at the
-   head of the list).
-
-4. If we are over the limit, evict the last entry on the normal header
-   list.
-
-(cherry picked from commit 57cd34441a1b4ecc9874a4a106c2c95b8d7a3120)
-(cherry picked from commit e4d7ce686bb38428eddc7e33b40057d68eca9a6e)
---
- configure           |   2 +-
- configure.ac        |   2 +-
- lib/dns/rbtdb.c     | 114 +++++++++++++++++++++++++++++++++++++++++++-
- lib/dns/rdataslab.c |  12 +++++
- 4 files changed, 126 insertions(+), 4 deletions(-)
-
-diff --git a/configure b/configure
-index e060e9d..6421c9b 100755
--- a/configure
-+++ b/configure
-@@ -12189,7 +12189,7 @@ fi
- XTARGETS=
- case "$enable_developer" in
- yes)
-	STD_CDEFINES="$STD_CDEFINES -DISC_LIST_CHECKINIT=1"
-+	STD_CDEFINES="$STD_CDEFINES -DISC_LIST_CHECKINIT=1 -DDNS_RDATASET_MAX_RECORDS=5000 -DDNS_RBTDB_MAX_RTYPES=5000"
- 	test "${enable_fixed_rrset+set}" = set || enable_fixed_rrset=yes
- 	test "${enable_querytrace+set}" = set || enable_querytrace=yes
- 	test "${enable_filter_aaaa+set}" = set || enable_filter_aaaa=yes
-diff --git a/configure.ac b/configure.ac
-index 83cad4a..1c35ce9 100644
--- a/configure.ac
-+++ b/configure.ac
-@@ -100,7 +100,7 @@ AC_ARG_ENABLE(developer,
- XTARGETS=
- case "$enable_developer" in
- yes)
-	STD_CDEFINES="$STD_CDEFINES -DISC_LIST_CHECKINIT=1"
-+	STD_CDEFINES="$STD_CDEFINES -DISC_LIST_CHECKINIT=1 -DDNS_RDATASET_MAX_RECORDS=5000 -DDNS_RBTDB_MAX_RTYPES=5000"
- 	test "${enable_fixed_rrset+set}" = set || enable_fixed_rrset=yes
- 	test "${enable_querytrace+set}" = set || enable_querytrace=yes
- 	test "${enable_filter_aaaa+set}" = set || enable_filter_aaaa=yes
-diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
-index ee59c1b..a2b2df7 100644
--- a/lib/dns/rbtdb.c
-+++ b/lib/dns/rbtdb.c
-@@ -1183,6 +1183,44 @@ set_ttl(dns_rbtdb_t *rbtdb, rdatasetheader_t *header, dns_ttl_t newttl) {
- 		isc_heap_decreased(heap, header->heap_index);
- }
- 
-+static bool
-+prio_type(rbtdb_rdatatype_t type) {
-+	switch (type) {
-+	case dns_rdatatype_soa:
-+	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_soa):
-+	case dns_rdatatype_a:
-+	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_a):
-+	case dns_rdatatype_mx:
-+	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_mx):
-+	case dns_rdatatype_aaaa:
-+	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_aaaa):
-+	case dns_rdatatype_nsec:
-+	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_nsec):
-+	case dns_rdatatype_nsec3:
-+	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_nsec3):
-+	case dns_rdatatype_ns:
-+	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_ns):
-+	case dns_rdatatype_ds:
-+	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_ds):
-+	case dns_rdatatype_cname:
-+	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_cname):
-+	case dns_rdatatype_dname:
-+	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_dname):
-+	case dns_rdatatype_dnskey:
-+	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_dnskey):
-+	case dns_rdatatype_srv:
-+	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_srv):
-+	case dns_rdatatype_txt:
-+	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_txt):
-+	case dns_rdatatype_ptr:
-+	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_ptr):
-+	case dns_rdatatype_naptr:
-+	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_naptr):
-+		return (true);
-+	}
-+	return (false);
-+}
-+
- /*%
-  * These functions allow the heap code to rank the priority of each
-  * element.  It returns true if v1 happens "sooner" than v2.
-@@ -6278,6 +6316,30 @@ update_recordsandbytes(bool add, rbtdb_version_t *rbtversion,
- 	RWUNLOCK(&rbtversion->rwlock, isc_rwlocktype_write);
- }
- 
-+#ifndef DNS_RBTDB_MAX_RTYPES
-+#define DNS_RBTDB_MAX_RTYPES 100
-+#endif /* DNS_RBTDB_MAX_RTYPES */
-+
-+static bool
-+overmaxtype(dns_rbtdb_t *rbtdb, uint32_t ntypes) {
-+	UNUSED(rbtdb);
-+
-+	if (DNS_RBTDB_MAX_RTYPES == 0) {
-+		return (false);
-+	}
-+
-+	return (ntypes >= DNS_RBTDB_MAX_RTYPES);
-+}
-+
-+static bool
-+prio_header(rdatasetheader_t *header) {
-+	if (NEGATIVE(header) && prio_type(RBTDB_RDATATYPE_EXT(header->type))) {
-+		return (true);
-+	}
-+
-+	return (prio_type(header->type));
-+}
-+
- /*
-  * write lock on rbtnode must be held.
-  */
-@@ -6288,6 +6350,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
- {
- 	rbtdb_changed_t *changed = NULL;
- 	rdatasetheader_t *topheader, *topheader_prev, *header, *sigheader;
-+	rdatasetheader_t *prioheader = NULL, *expireheader = NULL;
- 	unsigned char *merged;
- 	isc_result_t result;
- 	bool header_nx;
-@@ -6297,6 +6360,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
- 	rbtdb_rdatatype_t negtype, sigtype;
- 	dns_trust_t trust;
- 	int idx;
-+	uint32_t ntypes = 0;
- 
- 	/*
- 	 * Add an rdatasetheader_t to a node.
-@@ -6429,6 +6493,15 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
- 	for (topheader = rbtnode->data;
- 	     topheader != NULL;
- 	     topheader = topheader->next) {
-+		if (IS_CACHE(rbtdb) && ACTIVE(topheader, now)) {
-+			++ntypes;
-+			expireheader = topheader;
-+		} else if (!IS_CACHE(rbtdb)) {
-+			++ntypes;
-+		}
-+		if (prio_header(topheader)) {
-+			prioheader = topheader;
-+		}
- 		if (topheader->type == newheader->type ||
- 		    topheader->type == negtype)
- 			break;
-@@ -6792,9 +6865,46 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
- 			/*
- 			 * No rdatasets of the given type exist at the node.
- 			 */
-			newheader->next = rbtnode->data;
-+			if (!IS_CACHE(rbtdb) && overmaxtype(rbtdb, ntypes)) {
-+				free_rdataset(rbtdb, rbtdb->common.mctx,
-+					      newheader);
-+				return (ISC_R_QUOTA);
-+			}
-+
- 			newheader->down = NULL;
-			rbtnode->data = newheader;
-+
-+			if (prio_header(newheader)) {
-+				/* This is a priority type, prepend it */
-+				newheader->next = rbtnode->data;
-+				rbtnode->data = newheader;
-+			} else if (prioheader != NULL) {
-+				/* Append after the priority headers */
-+				newheader->next = prioheader->next;
-+				prioheader->next = newheader;
-+			} else {
-+				/* There were no priority headers */
-+				newheader->next = rbtnode->data;
-+				rbtnode->data = newheader;
-+			}
-+
-+			if (IS_CACHE(rbtdb) && overmaxtype(rbtdb, ntypes)) {
-+				if (expireheader == NULL) {
-+					expireheader = newheader;
-+				}
-+				if (NEGATIVE(newheader) &&
-+				    !prio_header(newheader))
-+				{
-+					/*
-+					 * Add the new non-priority negative
-+					 * header to the database only
-+					 * temporarily.
-+					 */
-+					expireheader = newheader;
-+				}
-+
-+				set_ttl(rbtdb, expireheader, 0);
-+				mark_header_ancient(rbtdb, expireheader);
-+			}
- 		}
- 	}
- 
-diff --git a/lib/dns/rdataslab.c b/lib/dns/rdataslab.c
-index b0f77b1..347b7d2 100644
--- a/lib/dns/rdataslab.c
-+++ b/lib/dns/rdataslab.c
-@@ -115,6 +115,10 @@ fillin_offsets(unsigned char *offsetbase, unsigned int *offsettable,
- }
- #endif
- 
-+#ifndef DNS_RDATASET_MAX_RECORDS
-+#define DNS_RDATASET_MAX_RECORDS 100
-+#endif /* DNS_RDATASET_MAX_RECORDS */
-+
- isc_result_t
- dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx,
- 			   isc_region_t *region, unsigned int reservelen)
-@@ -161,6 +165,10 @@ dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx,
- 		return (ISC_R_SUCCESS);
- 	}
- 
-+	if (nitems > DNS_RDATASET_MAX_RECORDS) {
-+		return (DNS_R_TOOMANYRECORDS);
-+	}
-+
- 	if (nitems > 0xffff)
- 		return (ISC_R_NOSPACE);
- 
-@@ -654,6 +662,10 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab,
- #endif
- 	INSIST(ocount > 0 && ncount > 0);
- 
-+	if (ocount + ncount > DNS_RDATASET_MAX_RECORDS) {
-+		return (DNS_R_TOOMANYRECORDS);
-+	}
-+
- #if DNS_RDATASET_FIXED
- 	oncount = ncount;
- #endif
-- 
-2.45.2
-
--- a/SOURCES/bind-9.11-CVE-2024-1975.patch
+++ b/SOURCES/bind-9.11-CVE-2024-1975.patch
@ -1,322 +0,0 @@
-From 5ff88892e43c049659a8a5aef8dfd56c3712daf0 Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Tue, 16 Jul 2024 19:49:09 +0200
-Subject: [PATCH] Resolve CVE-2024-1975
-
-6404.	[security]	Remove SIG(0) support from named as a countermeasure
-			for CVE-2024-1975. [GL #4480]
-
-Resolves: CVE-2024-1975
---
- bin/named/client.c                   |  7 +++
- bin/tests/system/tsiggss/authsock.pl |  5 ++
- bin/tests/system/tsiggss/tests.sh    | 12 ++--
- bin/tests/system/upforwd/tests.sh    | 21 ++++---
- doc/arm/Bv9ARM-book.xml              | 22 +++----
- lib/dns/message.c                    | 94 +++-------------------------
- 6 files changed, 49 insertions(+), 112 deletions(-)
-
-diff --git a/bin/named/client.c b/bin/named/client.c
-index 368bc94..ea121b3 100644
--- a/bin/named/client.c
-+++ b/bin/named/client.c
-@@ -3013,6 +3013,13 @@ client_request(isc_task_t *task, isc_event_t *event) {
- 		ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
- 			      NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(3),
- 			      "request is signed by a nonauthoritative key");
-+	} else if (result == DNS_R_NOTVERIFIEDYET &&
-+		   client->message->sig0 != NULL)
-+	{
-+		ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
-+			      NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(3),
-+			      "request has a SIG(0) signature but its support "
-+			      "was removed (CVE-2024-1975)");
- 	} else {
- 		char tsigrcode[64];
- 		isc_buffer_t b;
-diff --git a/bin/tests/system/tsiggss/authsock.pl b/bin/tests/system/tsiggss/authsock.pl
-index ab3833d..0b231ee 100644
--- a/bin/tests/system/tsiggss/authsock.pl
-+++ b/bin/tests/system/tsiggss/authsock.pl
-@@ -31,6 +31,10 @@ if (!defined($path)) {
- 	exit(1);
- }
- 
-+# Enable output autoflush so that it's not lost when the parent sends TERM.
-+select STDOUT;
-+$| = 1;
-+
- unlink($path);
- my $server = IO::Socket::UNIX->new(Local => $path, Type => SOCK_STREAM, Listen => 8) or
-     die "unable to create socket $path";
-@@ -53,6 +57,7 @@ if ($timeout != 0) {
- }
- 
- while (my $client = $server->accept()) {
-+	printf("accept()\n");
- 	$client->recv(my $buf, 8, 0);
- 	my ($version, $req_len) = unpack('N N', $buf);
- 
-diff --git a/bin/tests/system/tsiggss/tests.sh b/bin/tests/system/tsiggss/tests.sh
-index 456ce61..d0db388 100644
--- a/bin/tests/system/tsiggss/tests.sh
-+++ b/bin/tests/system/tsiggss/tests.sh
-@@ -116,7 +116,7 @@ status=$((status+ret))
- 
- echo_i "testing external update policy (CNAME) with auth sock ($n)"
- ret=0
-$PERL ./authsock.pl --type=CNAME --path=ns1/auth.sock --pidfile=authsock.pid --timeout=120 > /dev/null 2>&1 &
-+$PERL ./authsock.pl --type=CNAME --path=ns1/auth.sock --pidfile=authsock.pid --timeout=120 >authsock.log 2>&1 &
- sleep 1
- test_update $n testcname.example.nil. CNAME "86400 CNAME testdenied.example.nil" "testdenied" || ret=1
- n=$((n+1))
-@@ -130,17 +130,19 @@ n=$((n+1))
- if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
- status=$((status+ret))
- 
-echo_i "testing external policy with SIG(0) key ($n)"
-+echo_i "testing external policy with unsupported SIG(0) key ($n)"
- ret=0
-$NSUPDATE -R $RANDFILE -k ns1/Kkey.example.nil.*.private <<END > /dev/null 2>&1 || ret=1
-+$NSUPDATE -R $RANDFILE -k ns1/Kkey.example.nil.*.private <<END >nsupdate.out${n} 2>&1 || true
-+debug
- server 10.53.0.1 ${PORT}
- zone example.nil
- update add fred.example.nil 120 cname foo.bar.
- send
- END
-+# update must have failed - SIG(0) signer is not supported
- output=`$DIG $DIGOPTS +short cname fred.example.nil.`
-[ -n "$output" ] || ret=1
-[ $ret -eq 0 ] || echo_i "failed"
-+[ -n "$output" ] && ret=1
-+grep -F "signer=key.example.nil" authsock.log >/dev/null && ret=1
- n=$((n+1))
- if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
- status=$((status+ret))
-diff --git a/bin/tests/system/upforwd/tests.sh b/bin/tests/system/upforwd/tests.sh
-index ebc9ded..f5b89d4 100644
--- a/bin/tests/system/upforwd/tests.sh
-+++ b/bin/tests/system/upforwd/tests.sh
-@@ -181,19 +181,22 @@ n=`expr $n + 1`
- 
- if test -f keyname
- then
-	echo_i "checking update forwarding to with sig0 ($n)"
-+	echo_i "checking update forwarding to with sig0 (expected to fail) ($n)"
- 	ret=0
- 	keyname=`cat keyname`
-	$NSUPDATE -k $keyname.private -- - <<EOF
-	local 10.53.0.1
-	server 10.53.0.3 ${PORT}
-	zone example2
-	update add unsigned.example2. 600 A 10.10.10.1
-	update add unsigned.example2. 600 TXT Foo
-	send
-+	# SIG(0) is removed, update is expected to fail.
-+	{
-+	  $NSUPDATE -k $keyname.private -- - <<EOF
-+	  local 10.53.0.1
-+	  server 10.53.0.3 ${PORT}
-+	  zone example2
-+	  update add unsigned.example2. 600 A 10.10.10.1
-+	  update add unsigned.example2. 600 TXT Foo
-+	  send
- EOF
-+	} >nsupdate.out.$n 2>&1 && ret=1
- 	$DIG -p ${PORT} unsigned.example2 A @10.53.0.1 > dig.out.ns1.test$n
-	grep "status: NOERROR" dig.out.ns1.test$n > /dev/null || ret=1
-+	grep "status: NOERROR" dig.out.ns1.test$n >/dev/null && ret=1
- 	if [ $ret != 0 ] ; then echo_i "failed"; fi
- 	status=`expr $status + $ret`
- 	n=`expr $n + 1`
-diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
-index acf772b..563dced 100644
--- a/doc/arm/Bv9ARM-book.xml
-+++ b/doc/arm/Bv9ARM-book.xml
-@@ -2027,7 +2027,7 @@ allow-update { !{ !localnets; any; }; key host1-host2. ;};
- 	The TKEY process is initiated by a client or server by sending
- 	a query of type TKEY to a TKEY-aware server.  The query must include
- 	an appropriate KEY record in the additional section, and
-	must be signed using either TSIG or SIG(0) with a previously
-+	must be signed using TSIG with a previously
- 	established key.  The server's response, if successful,
- 	contains a TKEY record in its answer section.  After this transaction,
- 	both participants have enough information to calculate a
-@@ -2050,24 +2050,24 @@ allow-update { !{ !localnets; any; }; key host1-host2. ;};
-     <section xml:id="sig0"><info><title>SIG(0)</title></info>
- 
-       <para>
-	<acronym>BIND</acronym> partially supports DNSSEC SIG(0)
-+	<acronym>BIND</acronym> partially supported DNSSEC SIG(0)
- 	transaction signatures as specified in RFC 2535 and RFC 2931.
- 	SIG(0) uses public/private keys to authenticate messages.  Access control
-	is performed in the same manner as with TSIG keys; privileges can be
-+	were performed in the same manner as with TSIG keys; privileges can be
- 	granted or denied in ACL directives based on the key name.
-       </para>
-       <para>
-	When a SIG(0) signed message is received, it is only
-+	When a SIG(0) signed message were received, it were only
- 	verified if the key is known and trusted by the server. The
-	server does not attempt to recursively fetch or validate the
-+	server did not attempt to recursively fetch or validate the
- 	key.
-       </para>
-       <para>
-	SIG(0) signing of multiple-message TCP streams is not supported.
-+	SIG(0) signing of multiple-message TCP streams were not supported.
-       </para>
-       <para>
-	The only tool shipped with <acronym>BIND</acronym> 9 that
-	generates SIG(0) signed messages is <command>nsupdate</command>.
-+	Support for SIG(0) message verification was removed
-+	as part of the mitigation of CVE-2024-1975.
-       </para>
-     </section>
- 
-@@ -12655,7 +12655,7 @@ example.com. NS ns2.example.net.
- 	      either grants or denies permission for one or more
- 	      names in the zone to be updated by one or more
- 	      identities. Identity is determined by the key that
-	      signed the update request, using either TSIG or SIG(0).
-+	      signed the update request, using TSIG.
- 	      In most cases, <command>update-policy</command> rules
- 	      only apply to key-based identities.  There is no way
- 	      to specify update permissions based on client source
-@@ -12742,7 +12742,7 @@ example.com. NS ns2.example.net.
- 	    <para>
- 	      The <command>identity</command> field must be set to
- 	      a fully qualified domain name.  In most cases, this
-	      represents the name of the TSIG or SIG(0) key that must be
-+	      represents the name of the TSIG key that must be
- 	      used to sign the update request.  If the specified name is a
- 	      wildcard, it is subject to DNS wildcard expansion, and the
- 	      rule may apply to multiple identities.  When a TKEY exchange
-@@ -15952,7 +15952,7 @@ HOST-127.EXAMPLE. MX 0 .
- 	</para>
- 	<para>
- 	  ACLs match clients on the basis of up to three characteristics:
-	  1) The client's IP address; 2) the TSIG or SIG(0) key that was
-+	  1) The client's IP address; 2) the TSIG key that was
- 	  used to sign the request, if any; and 3) an address prefix
- 	  encoded in an EDNS Client-Subnet option, if any.
- 	</para>
-diff --git a/lib/dns/message.c b/lib/dns/message.c
-index a44eb2d..9ea2b9e 100644
--- a/lib/dns/message.c
-+++ b/lib/dns/message.c
-@@ -3373,103 +3373,23 @@ dns_message_dumpsig(dns_message_t *msg, char *txt1) {
- 
- isc_result_t
- dns_message_checksig(dns_message_t *msg, dns_view_t *view) {
-	isc_buffer_t b, msgb;
-+	isc_buffer_t msgb;
- 
- 	REQUIRE(DNS_MESSAGE_VALID(msg));
- 
-	if (msg->tsigkey == NULL && msg->tsig == NULL && msg->sig0 == NULL)
-+	if (msg->tsigkey == NULL && msg->tsig == NULL)
- 		return (ISC_R_SUCCESS);
- 
- 	INSIST(msg->saved.base != NULL);
- 	isc_buffer_init(&msgb, msg->saved.base, msg->saved.length);
- 	isc_buffer_add(&msgb, msg->saved.length);
-	if (msg->tsigkey != NULL || msg->tsig != NULL) {
- #ifdef SKAN_MSG_DEBUG
-		dns_message_dumpsig(msg, "dns_message_checksig#1");
-+	dns_message_dumpsig(msg, "dns_message_checksig#1");
- #endif
-		if (view != NULL)
-			return (dns_view_checksig(view, &msgb, msg));
-		else
-			return (dns_tsig_verify(&msgb, msg, NULL, NULL));
-	} else {
-		dns_rdata_t rdata = DNS_RDATA_INIT;
-		dns_rdata_sig_t sig;
-		dns_rdataset_t keyset;
-		isc_result_t result;
-
-		result = dns_rdataset_first(msg->sig0);
-		INSIST(result == ISC_R_SUCCESS);
-		dns_rdataset_current(msg->sig0, &rdata);
-
-		/*
-		 * This can occur when the message is a dynamic update, since
-		 * the rdata length checking is relaxed.  This should not
-		 * happen in a well-formed message, since the SIG(0) is only
-		 * looked for in the additional section, and the dynamic update
-		 * meta-records are in the prerequisite and update sections.
-		 */
-		if (rdata.length == 0)
-			return (ISC_R_UNEXPECTEDEND);
-
-		result = dns_rdata_tostruct(&rdata, &sig, msg->mctx);
-		if (result != ISC_R_SUCCESS)
-			return (result);
-
-		dns_rdataset_init(&keyset);
-		if (view == NULL)
-			return (DNS_R_KEYUNAUTHORIZED);
-		result = dns_view_simplefind(view, &sig.signer,
-					     dns_rdatatype_key /* SIG(0) */,
-					     0, 0, false, &keyset, NULL);
-
-		if (result != ISC_R_SUCCESS) {
-			/* XXXBEW Should possibly create a fetch here */
-			result = DNS_R_KEYUNAUTHORIZED;
-			goto freesig;
-		} else if (keyset.trust < dns_trust_secure) {
-			/* XXXBEW Should call a validator here */
-			result = DNS_R_KEYUNAUTHORIZED;
-			goto freesig;
-		}
-		result = dns_rdataset_first(&keyset);
-		INSIST(result == ISC_R_SUCCESS);
-		for (;
-		     result == ISC_R_SUCCESS;
-		     result = dns_rdataset_next(&keyset))
-		{
-			dst_key_t *key = NULL;
-
-			dns_rdata_reset(&rdata);
-			dns_rdataset_current(&keyset, &rdata);
-			isc_buffer_init(&b, rdata.data, rdata.length);
-			isc_buffer_add(&b, rdata.length);
-
-			result = dst_key_fromdns(&sig.signer, rdata.rdclass,
-						 &b, view->mctx, &key);
-			if (result != ISC_R_SUCCESS)
-				continue;
-			if (dst_key_alg(key) != sig.algorithm ||
-			    dst_key_id(key) != sig.keyid ||
-			    !(dst_key_proto(key) == DNS_KEYPROTO_DNSSEC ||
-			      dst_key_proto(key) == DNS_KEYPROTO_ANY))
-			{
-				dst_key_free(&key);
-				continue;
-			}
-			result = dns_dnssec_verifymessage(&msgb, msg, key);
-			dst_key_free(&key);
-			if (result == ISC_R_SUCCESS)
-				break;
-		}
-		if (result == ISC_R_NOMORE)
-			result = DNS_R_KEYUNAUTHORIZED;
-
- freesig:
-		if (dns_rdataset_isassociated(&keyset))
-			dns_rdataset_disassociate(&keyset);
-		dns_rdata_freestruct(&sig);
-		return (result);
-	}
-+	if (view != NULL)
-+		return (dns_view_checksig(view, &msgb, msg));
-+	else
-+		return (dns_tsig_verify(&msgb, msg, NULL, NULL));
- }
- 
- #define INDENT(sp) \
-- 
-2.45.2
-
--- a/SOURCES/bind-9.11-CVE-2025-40778.patch
+++ b/SOURCES/bind-9.11-CVE-2025-40778.patch
--- a/SOURCES/bind-9.11-CVE-2026-10723.patch
+++ b/SOURCES/bind-9.11-CVE-2026-10723.patch
@ -1,64 +0,0 @@
-From 6e7215866cf1b9d92b7cdbb5e1990f0f7581336a Mon Sep 17 00:00:00 2001
-From: Evan Hunt <each@isc.org>
-Date: Wed, 1 Jul 2026 23:24:09 -0700
-Subject: [PATCH] Check NSEC3 signer matches the owning zone
-
-When validating NSEC3 records, reject any signature whose signer field
-does not match the zone owning the NSEC3.
-
-This ensures that a child zone cannot impersonate its parent and forge
-NXDOMAIN responses for sibling domains.
-
-Fixes: isc-projects/bind9#5874
-
-(cherry picked from commit 6e5066bb1f0f12d090e8707adb7d6ccf74f8012b)
---
- lib/dns/dnssec.c | 19 +++++++++++++++++--
- lib/dns/result.c |  2 +-
- 2 files changed, 18 insertions(+), 3 deletions(-)
-
-diff --git a/lib/dns/dnssec.c b/lib/dns/dnssec.c
-index b6b2405..8dae801 100644
--- a/lib/dns/dnssec.c
-+++ b/lib/dns/dnssec.c
-@@ -428,10 +428,25 @@ dns_dnssec_verify3(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
- 	}
- 
- 	/*
-	 * NS, SOA and DNSSKEY records are signed by their owner.
-	 * DS records are signed by the parent.
-+	 * NS, SOA and DNSKEY records are signed by their owners.
-+	 * NSEC3 records are signed by the apex, exactly one level up
-+	 * from their owner names.
-+	 * DS records are signed by the parent zone.
- 	 */
- 	switch (set->type) {
-+	case dns_rdatatype_nsec3: {
-+		dns_name_t apex = DNS_NAME_INITEMPTY;
-+		labels = dns_name_countlabels(name);
-+		if (labels <= 1) {
-+			inc_stat(dns_dnssecstats_fail);
-+			return DNS_R_INVALIDNSEC3;
-+		}
-+		dns_name_split(name, labels - 1, NULL, &apex);
-+		if (!dns_name_equal(&apex, &sig.signer)) {
-+			inc_stat(dns_dnssecstats_fail);
-+			return DNS_R_SIGINVALID;
-+		}
-+	} break;
- 	case dns_rdatatype_ns:
- 	case dns_rdatatype_soa:
- 	case dns_rdatatype_dnskey:
-diff --git a/lib/dns/result.c b/lib/dns/result.c
-index 24aa01e..45ac114 100644
--- a/lib/dns/result.c
-+++ b/lib/dns/result.c
-@@ -148,7 +148,7 @@ static const char *text[DNS_R_NRESULTS] = {
- 	"covering NSEC record returned",       /*%< 101 DNS_R_COVERINGNSEC */
- 	"MX is an address",		       /*%< 102 DNS_R_MXISADDRESS */
- 	"duplicate query",		       /*%< 103 DNS_R_DUPLICATE */
-	"invalid NSEC3 owner name (wildcard)", /*%< 104 DNS_R_INVALIDNSEC3 */
-+	"invalid NSEC3 owner name",	       /*%< 104 DNS_R_INVALIDNSEC3 */
- 
- 	"not master",			       /*%< 105 DNS_R_NOTMASTER */
- 	"broken trust chain",		       /*%< 106 DNS_R_BROKENCHAIN */
--- a/SOURCES/bind-9.11-CVE-2026-11622.patch
+++ b/SOURCES/bind-9.11-CVE-2026-11622.patch
@ -1,318 +0,0 @@
-From a323885e23d763255a6abea0ae7752449c0c2cde Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@sury.org>
-Date: Tue, 23 Jun 2026 10:59:38 +0200
-Subject: [PATCH] Make the dns_slabheaders in the cache reference counted
-
-Instead of only reference counting the enclosing qpcnode, add the
-reference counting directly to the slabheaders.  The reference is
-incremented when an rdataset is bound to the header and decremented when
-the rdataset is disassociated, so a stale slabheader can be removed from
-the node's down chain as soon as its own reference count reaches zero,
-instead of waiting for the whole qpcnode to become unreferenced.
-
-Building on that, clean up the ancient headers eagerly: mark_ancient()
-is made idempotent, releases the header's own (container) reference and
-reaps the stale headers from the node's down chain as soon as their
-references reach zero.  A header evicted over the per-name type limit is
-expired only after the new rdataset has been bound, so the bind's
-increment always precedes mark_ancient()'s decrement.
-
-Because a header can now be reclaimed independently of its node, the
-rdataset iterators must keep the header they are positioned on alive:
-each iterator takes a reference on its current header and releases it
-when it advances or is destroyed.  Iteration otherwise stays lazy and
-re-reads the node on every step, so it still observes records added to
-the node while the iterator is live, as zone signing requires.
-
-The slab headers are shared with the zone databases, so the matching
-increment is added to every bind path.  The noqname/closest proofs hand
-out rdatasets backed by bare slabs that have no header, so they are
-given a separate dns_rdataproof_rdatasetmethods that leaves the
-reference count untouched.
-
-(cherry picked from commit 2dabf117e1264fd13fb33096f87e78a039fd1c6c)
---
- lib/dns/include/dns/rdataslab.h |   1 +
- lib/dns/rbtdb.c                 | 105 +++++++++++++++++++++++++++-----
- 2 files changed, 90 insertions(+), 16 deletions(-)
-
-diff --git a/lib/dns/include/dns/rdataslab.h b/lib/dns/include/dns/rdataslab.h
-index 40c40a8..f353f03 100644
--- a/lib/dns/include/dns/rdataslab.h
-+++ b/lib/dns/include/dns/rdataslab.h
-@@ -44,6 +44,7 @@
- #include <stdbool.h>
- 
- #include <isc/lang.h>
-+#include <isc/refcount.h>
- 
- #include <dns/types.h>
- 
-diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
-index 388ffdf..7ec553e 100644
--- a/lib/dns/rbtdb.c
-+++ b/lib/dns/rbtdb.c
-@@ -441,6 +441,7 @@ struct noqname {
- typedef struct acachectl acachectl_t;
- 
- typedef struct rdatasetheader {
-+	isc_refcount_t references;
- 	/*%
- 	 * Locked by the owning node's lock.
- 	 */
-@@ -1760,6 +1761,8 @@ init_rdataset(dns_rbtdb_t *rbtdb, rdatasetheader_t *h) {
- 	h->next_is_relative = 0;
- 	h->node_is_relative = 0;
- 
-+	isc_refcount_init(&h->references, 1);
-+
- #if TRACE_HEADER
- 	if (IS_CACHE(rbtdb) && rbtdb->common.rdclass == dns_rdataclass_in)
- 		fprintf(stderr, "initialized header: %p\n", h);
-@@ -1885,6 +1888,9 @@ rollback_node(dns_rbtnode_t *node, rbtdb_serial_t serial) {
- 		node->dirty = 1;
- }
- 
-+static void
-+clean_stale_headers(dns_rbtdb_t *rbtdb, isc_mem_t *mctx, rdatasetheader_t *top);
-+
- static inline void
- mark_header_ancient(dns_rbtdb_t *rbtdb, rdatasetheader_t *header) {
- 
-@@ -1897,26 +1903,37 @@ mark_header_ancient(dns_rbtdb_t *rbtdb, rdatasetheader_t *header) {
- 	header->attributes |= RDATASET_ATTR_ANCIENT;
- 	header->node->dirty = 1;
- 
-+	isc_refcount_decrement(&header->references, NULL);
-+
- 	/*
-	 * If we have not been counted then there is nothing to do.
-+	 * If this header has been counted, move it to the stale stats bucket.
- 	 */
-	if ((header->attributes & RDATASET_ATTR_STATCOUNT) == 0)
-		return;
-
-	if (EXISTS(header))
-+	if ((header->attributes & RDATASET_ATTR_STATCOUNT) != 0 &&
-+	    EXISTS(header))
-+	{
- 		update_rrsetstats(rbtdb, header, true);
-+	}
-+
-+	clean_stale_headers(rbtdb, rbtdb->common.mctx, header);
- }
- 
- static inline void
- clean_stale_headers(dns_rbtdb_t *rbtdb, isc_mem_t *mctx, rdatasetheader_t *top)
- {
- 	rdatasetheader_t *d, *down_next;
-+	rdatasetheader_t *down_parent = top;
- 
- 	for (d = top->down; d != NULL; d = down_next) {
- 		down_next = d->down;
-		free_rdataset(rbtdb, mctx, d);
-+		d->next = down_parent;
-+
-+		if (isc_refcount_current(&d->references) == 0) {
-+			free_rdataset(rbtdb, mctx, d);
-+			down_parent->down = down_next;
-+		} else {
-+			down_parent = d;
-+		}
- 	}
-	top->down = NULL;
- }
- 
- static inline void
-@@ -1932,6 +1949,7 @@ clean_cache_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node) {
- 	for (current = node->data; current != NULL; current = top_next) {
- 		top_next = current->next;
- 		clean_stale_headers(rbtdb, mctx, current);
-+		INSIST(current->down == NULL);
- 		/*
- 		 * If current is nonexistent or stale, we can clean it up.
- 		 */
-@@ -3469,6 +3487,8 @@ bind_rdataset(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node, rdatasetheader_t *header,
- 	if (rdataset == NULL)
- 		return;
- 
-+	isc_refcount_increment(&header->references, NULL);
-+
- 	new_reference(rbtdb, node, locktype);
- 
- 	INSIST(rdataset->methods == NULL);      /* We must be disassociated. */
-@@ -6386,6 +6406,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
- 	bool header_nx;
- 	bool newheader_nx;
- 	bool merge;
-+	bool do_expireheader = false;
- 	dns_rdatatype_t rdtype, covers;
- 	rbtdb_rdatatype_t negtype, sigtype;
- 	dns_trust_t trust;
-@@ -6918,6 +6939,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
- 			}
- 
- 			if (IS_CACHE(rbtdb) && overmaxtype(rbtdb, ntypes)) {
-+				do_expireheader = true;
- 				if (expireheader == NULL) {
- 					expireheader = newheader;
- 				}
-@@ -6931,9 +6953,6 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
- 					 */
- 					expireheader = newheader;
- 				}
-
-				set_ttl(rbtdb, expireheader, 0);
-				mark_header_ancient(rbtdb, expireheader);
- 			}
- 		}
- 	}
-@@ -6954,6 +6973,15 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
- 			      isc_rwlocktype_write, addedrdataset);
- 	}
- 
-+	/*
-+	 * We need to delay the expiration of the header until we are bound to
-+	 * it to prevent decrement-then-increment on the header references.
-+	 */
-+	if (do_expireheader) {
-+		set_ttl(rbtdb, expireheader, 0);
-+		mark_header_ancient(rbtdb, expireheader);
-+	}
-+
- 	return (ISC_R_SUCCESS);
- }
- 
-@@ -9228,6 +9256,12 @@ rdataset_disassociate(dns_rdataset_t *rdataset) {
- 	dns_db_t *db = rdataset->private1;
- 	dns_dbnode_t *node = rdataset->private2;
- 
-+	if (rdataset->methods == &rdataset_methods) {
-+		rdatasetheader_t *header = rdataset->private3;
-+		header--;
-+		isc_refcount_decrement(&header->references, NULL);
-+	}
-+
- 	detachnode(db, &node);
- }
- 
-@@ -9339,6 +9373,11 @@ rdataset_clone(dns_rdataset_t *source, dns_rdataset_t *target) {
- 	dns_dbnode_t *cloned_node = NULL;
- 
- 	attachnode(db, node, &cloned_node);
-+	if (source->methods == &rdataset_methods) {
-+		rdatasetheader_t *header = source->private3;
-+		header--;
-+		isc_refcount_increment(&header->references, NULL);
-+	}
- 	INSIST(!ISC_LINK_LINKED(target, link));
- 	*target = *source;
- 	ISC_LINK_INIT(target, link);
-@@ -9504,6 +9543,11 @@ rdatasetiter_destroy(dns_rdatasetiter_t **iteratorp) {
- 
- 	rbtiterator = (rbtdb_rdatasetiter_t *)(*iteratorp);
- 
-+	if (rbtiterator->current != NULL) {
-+		isc_refcount_decrement(&rbtiterator->current->references, NULL);
-+		rbtiterator->current = NULL;
-+	}
-+
- 	if (rbtiterator->common.version != NULL)
- 		closeversion(rbtiterator->common.db,
- 			     &rbtiterator->common.version, false);
-@@ -9561,9 +9605,18 @@ rdatasetiter_first(dns_rdatasetiter_t *iterator) {
- 			break;
- 	}
- 
-+	if (header != NULL) {
-+		isc_refcount_increment0(&header->references, NULL);
-+	}
-+
- 	NODE_UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
- 		    isc_rwlocktype_read);
- 
-+	if (rbtiterator->current != NULL) {
-+		isc_refcount_decrement(&rbtiterator->current->references, NULL);
-+		rbtiterator->current = NULL;
-+	}
-+
- 	rbtiterator->current = header;
- 
- 	if (header == NULL)
-@@ -9637,9 +9690,18 @@ rdatasetiter_next(dns_rdatasetiter_t *iterator) {
- 		}
- 	}
- 
-+	if (header != NULL) {
-+		isc_refcount_increment0(&header->references, NULL);
-+	}
-+
- 	NODE_UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
- 		    isc_rwlocktype_read);
- 
-+	if (rbtiterator->current != NULL) {
-+		isc_refcount_decrement(&rbtiterator->current->references, NULL);
-+		rbtiterator->current = NULL;
-+	}
-+
- 	rbtiterator->current = header;
- 
- 	if (header == NULL)
-@@ -10249,6 +10311,19 @@ rdataset_getadditional(dns_rdataset_t *rdataset, dns_rdatasetadditional_t type,
- 	return (result);
- }
- 
-+static void
-+free_acache_cbarg(isc_mem_t *mctx, acache_cbarg_t **cbargp) {
-+	acache_cbarg_t *cbarg;
-+
-+	REQUIRE(cbargp != NULL && *cbargp != NULL);
-+
-+	cbarg = *cbargp;
-+	isc_refcount_decrement(&cbarg->header->references, NULL);
-+	isc_mem_put(mctx, cbarg, sizeof(*cbarg));
-+
-+	*cbargp = NULL;
-+}
-+
- static void
- acache_callback(dns_acacheentry_t *entry, void **arg) {
- 	dns_rbtdb_t *rbtdb;
-@@ -10288,7 +10363,7 @@ acache_callback(dns_acacheentry_t *entry, void **arg) {
- 		acarray[count].entry = NULL;
- 		INSIST(acarray[count].cbarg == cbarg);
- 		acarray[count].cbarg = NULL;
-		isc_mem_put(rbtdb->common.mctx, cbarg, sizeof(acache_cbarg_t));
-+		free_acache_cbarg(rbtdb->common.mctx, &cbarg);
- 		dns_acache_detachentry(&entry);
- 	}
- 
-@@ -10317,9 +10392,7 @@ acache_cancelentry(isc_mem_t *mctx, dns_acacheentry_t *entry,
- 		dns_db_detach(&cbarg->db);
- 	}
- 
-	isc_mem_put(mctx, cbarg, sizeof(acache_cbarg_t));
-
-	*cbargp = NULL;
-+	free_acache_cbarg(mctx, cbargp);
- }
- 
- static isc_result_t
-@@ -10355,6 +10428,7 @@ rdataset_setadditional(dns_rdataset_t *rdataset, dns_rdatasetadditional_t type,
- 	newcbarg = isc_mem_get(rbtdb->common.mctx, sizeof(*newcbarg));
- 	if (newcbarg == NULL)
- 		return (ISC_R_NOMEMORY);
-+	isc_refcount_increment(&header->references, NULL);
- 	newcbarg->type = type;
- 	newcbarg->count = count;
- 	newcbarg->header = header;
-@@ -10448,8 +10522,7 @@ rdataset_setadditional(dns_rdataset_t *rdataset, dns_rdatasetadditional_t type,
- 		} else {
- 			dns_db_detachnode((dns_db_t *)rbtdb, &newcbarg->node);
- 			dns_db_detach(&newcbarg->db);
-			isc_mem_put(rbtdb->common.mctx, newcbarg,
-			    sizeof(*newcbarg));
-+			free_acache_cbarg(rbtdb->common.mctx, &newcbarg);
- 		}
- 	}
- 
--- a/SOURCES/bind-9.11-CVE-2026-11721-test.patch
+++ b/SOURCES/bind-9.11-CVE-2026-11721-test.patch
@ -1,168 +0,0 @@
-From 9c1f5b579a7a4c338be8319a40927c83a0b4f886 Mon Sep 17 00:00:00 2001
-From: Mark Andrews <marka@isc.org>
-Date: Tue, 14 Apr 2026 13:46:22 +1000
-Subject: [PATCH] Test RRSIG record parsing
-
-In particular test that labels and signer fields are consistent.
-
-(cherry picked from commit 5a95e64731afe63d348d272cc4d3b2f9847150c2)
-(cherry picked from commit 5f3b7aef42be50630ecc349a6dbc22acf96d7413)
-
-Fix failing dnssec-signzone -M sub-test
-
-Restore example.db to the default contents which does not result
-in too many records causing the test to fail.
-
-(cherry picked from commit 8b11c48ed044844e26eaaca4315868231014dbb7)
---
- bin/tests/system/dnssec/tests.sh |   1 +
- lib/dns/tests/rdata_test.c       | 114 +++++++++++++++++++++++++++++++
- 2 files changed, 115 insertions(+)
-
-diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh
-index 1eb97f42c5..e5cb97924e 100644
--- a/bin/tests/system/dnssec/tests.sh
-+++ b/bin/tests/system/dnssec/tests.sh
-@@ -1793,6 +1793,7 @@ echo_i "checking TTLs are capped by dnssec-signzone -M ($n)"
- ret=0
- (
- cd signer
-+cp example.db.in example.db
- $SIGNER -O full -f signer.out.8 -S -M 30 -o example example.db > /dev/null 2>&1
- ) || ret=1
- awk '/^;/ { next; } $2 > 30 { exit 1; }' signer/signer.out.8 || ret=1
-diff --git a/lib/dns/tests/rdata_test.c b/lib/dns/tests/rdata_test.c
-index fe01e48fa3..1cde60b1d8 100644
--- a/lib/dns/tests/rdata_test.c
-+++ b/lib/dns/tests/rdata_test.c
-@@ -2356,6 +2356,119 @@ rkey(void **state) {
- 		    dns_rdatatype_rkey, sizeof(dns_rdata_rkey_t));
- }
- 
-+static void
-+rrsig(void **state) {
-+	text_ok_t text_ok[] = {
-+		TEXT_VALID("SOA 8 0 86400 20260426170000 20260413160000 54393 "
-+			   ". "
-+			   "tFbcoVP8MnpecUquJ/aj+XeNgV7ts9GSHVkXaXRJrJ/"
-+			   "TEkOZApVG0F6E "
-+			   "9sYpxGk2ItweLL43ujioGj0HWwZDRR+vbur+O/"
-+			   "dIdheiig1VvU+9HXLi "
-+			   "QOViY9Kc64ixdyJhYCC5K+bO1qsHxd+"
-+			   "KJXOaxyHbqchYkDFy4PL6qftE "
-+			   "VaLkueRgjXgOsq/"
-+			   "NxvCXDgAa5xy0+3Sl0myxIs8rJ5KeXfJQFe7qxgaw "
-+			   "VjJsJTKw8neOTw2rQfLaigWu2LIWw+"
-+			   "IyVrLjZJdLqGkiLBGd1w4X3U12 "
-+			   "fFxoY3eqzNgBEtduoGKPZ/"
-+			   "NpP9cuKJORJ18283aV8hR4WO91VR0q1zcM jLwqUg=="),
-+		/* labels too short for signer */
-+		TEXT_INVALID("SOA 8 0 86400 20260426170000 20260413160000 "
-+			     "54393 example. "
-+			     "tFbcoVP8MnpecUquJ/aj+XeNgV7ts9GSHVkXaXRJrJ/"
-+			     "TEkOZApVG0F6E "
-+			     "9sYpxGk2ItweLL43ujioGj0HWwZDRR+vbur+O/"
-+			     "dIdheiig1VvU+9HXLi "
-+			     "QOViY9Kc64ixdyJhYCC5K+bO1qsHxd+"
-+			     "KJXOaxyHbqchYkDFy4PL6qftE "
-+			     "VaLkueRgjXgOsq/"
-+			     "NxvCXDgAa5xy0+3Sl0myxIs8rJ5KeXfJQFe7qxgaw "
-+			     "VjJsJTKw8neOTw2rQfLaigWu2LIWw+"
-+			     "IyVrLjZJdLqGkiLBGd1w4X3U12 "
-+			     "fFxoY3eqzNgBEtduoGKPZ/"
-+			     "NpP9cuKJORJ18283aV8hR4WO91VR0q1zcM jLwqUg=="),
-+		/*
-+		 * Sentinel.
-+		 */
-+		TEXT_SENTINEL()
-+	};
-+	wire_ok_t wire_ok[] = {
-+		WIRE_VALID(0x00, 0x06, 0x08, 0x00, 0x00, 0x01, 0x51, 0x80, 0x69,
-+			   0xee, 0x44, 0x90, 0x69, 0xdd, 0x13, 0x00, 0xd4, 0x79,
-+			   0x00, 0xb4, 0x56, 0xdc, 0xa1, 0x53, 0xfc, 0x32, 0x7a,
-+			   0x5e, 0x71, 0x4a, 0xae, 0x27, 0xf6, 0xa3, 0xf9, 0x77,
-+			   0x8d, 0x81, 0x5e, 0xed, 0xb3, 0xd1, 0x92, 0x1d, 0x59,
-+			   0x17, 0x69, 0x74, 0x49, 0xac, 0x9f, 0xd3, 0x12, 0x43,
-+			   0x99, 0x02, 0x95, 0x46, 0xd0, 0x5e, 0x84, 0xf6, 0xc6,
-+			   0x29, 0xc4, 0x69, 0x36, 0x22, 0xdc, 0x1e, 0x2c, 0xbe,
-+			   0x37, 0xba, 0x38, 0xa8, 0x1a, 0x3d, 0x07, 0x5b, 0x06,
-+			   0x43, 0x45, 0x1f, 0xaf, 0x6e, 0xea, 0xfe, 0x3b, 0xf7,
-+			   0x48, 0x76, 0x17, 0xa2, 0x8a, 0x0d, 0x55, 0xbd, 0x4f,
-+			   0xbd, 0x1d, 0x72, 0xe2, 0x40, 0xe5, 0x62, 0x63, 0xd2,
-+			   0x9c, 0xeb, 0x88, 0xb1, 0x77, 0x22, 0x61, 0x60, 0x20,
-+			   0xb9, 0x2b, 0xe6, 0xce, 0xd6, 0xab, 0x07, 0xc5, 0xdf,
-+			   0x8a, 0x25, 0x73, 0x9a, 0xc7, 0x21, 0xdb, 0xa9, 0xc8,
-+			   0x58, 0x90, 0x31, 0x72, 0xe0, 0xf2, 0xfa, 0xa9, 0xfb,
-+			   0x44, 0x55, 0xa2, 0xe4, 0xb9, 0xe4, 0x60, 0x8d, 0x78,
-+			   0x0e, 0xb2, 0xaf, 0xcd, 0xc6, 0xf0, 0x97, 0x0e, 0x00,
-+			   0x1a, 0xe7, 0x1c, 0xb4, 0xfb, 0x74, 0xa5, 0xd2, 0x6c,
-+			   0xb1, 0x22, 0xcf, 0x2b, 0x27, 0x92, 0x9e, 0x5d, 0xf2,
-+			   0x50, 0x15, 0xee, 0xea, 0xc6, 0x06, 0xb0, 0x56, 0x32,
-+			   0x6c, 0x25, 0x32, 0xb0, 0xf2, 0x77, 0x8e, 0x4f, 0x0d,
-+			   0xab, 0x41, 0xf2, 0xda, 0x8a, 0x05, 0xae, 0xd8, 0xb2,
-+			   0x16, 0xc3, 0xe2, 0x32, 0x56, 0xb2, 0xe3, 0x64, 0x97,
-+			   0x4b, 0xa8, 0x69, 0x22, 0x2c, 0x11, 0x9d, 0xd7, 0x0e,
-+			   0x17, 0xdd, 0x4d, 0x76, 0x7c, 0x5c, 0x68, 0x63, 0x77,
-+			   0xaa, 0xcc, 0xd8, 0x01, 0x12, 0xd7, 0x6e, 0xa0, 0x62,
-+			   0x8f, 0x67, 0xf3, 0x69, 0x3f, 0xd7, 0x2e, 0x28, 0x93,
-+			   0x91, 0x27, 0x5f, 0x36, 0xf3, 0x76, 0x95, 0xf2, 0x14,
-+			   0x78, 0x58, 0xef, 0x75, 0x55, 0x1d, 0x2a, 0xd7, 0x37,
-+			   0x0c, 0x8c, 0xbc, 0x2a, 0x52),
-+		/* labels too short for signer */
-+		WIRE_INVALID(
-+			0x00, 0x06, 0x08, 0x00, 0x00, 0x01, 0x51, 0x80, 0x69,
-+			0xee, 0x44, 0x90, 0x69, 0xdd, 0x13, 0x00, 0xd4, 0x79,
-+			0x07, 0x65, 0x78, 0x61, 0x6d, 0x70, 0x6c, 0x65, 0x00,
-+			0xb4, 0x56, 0xdc, 0xa1, 0x53, 0xfc, 0x32, 0x7a, 0x5e,
-+			0x71, 0x4a, 0xae, 0x27, 0xf6, 0xa3, 0xf9, 0x77, 0x8d,
-+			0x81, 0x5e, 0xed, 0xb3, 0xd1, 0x92, 0x1d, 0x59, 0x17,
-+			0x69, 0x74, 0x49, 0xac, 0x9f, 0xd3, 0x12, 0x43, 0x99,
-+			0x02, 0x95, 0x46, 0xd0, 0x5e, 0x84, 0xf6, 0xc6, 0x29,
-+			0xc4, 0x69, 0x36, 0x22, 0xdc, 0x1e, 0x2c, 0xbe, 0x37,
-+			0xba, 0x38, 0xa8, 0x1a, 0x3d, 0x07, 0x5b, 0x06, 0x43,
-+			0x45, 0x1f, 0xaf, 0x6e, 0xea, 0xfe, 0x3b, 0xf7, 0x48,
-+			0x76, 0x17, 0xa2, 0x8a, 0x0d, 0x55, 0xbd, 0x4f, 0xbd,
-+			0x1d, 0x72, 0xe2, 0x40, 0xe5, 0x62, 0x63, 0xd2, 0x9c,
-+			0xeb, 0x88, 0xb1, 0x77, 0x22, 0x61, 0x60, 0x20, 0xb9,
-+			0x2b, 0xe6, 0xce, 0xd6, 0xab, 0x07, 0xc5, 0xdf, 0x8a,
-+			0x25, 0x73, 0x9a, 0xc7, 0x21, 0xdb, 0xa9, 0xc8, 0x58,
-+			0x90, 0x31, 0x72, 0xe0, 0xf2, 0xfa, 0xa9, 0xfb, 0x44,
-+			0x55, 0xa2, 0xe4, 0xb9, 0xe4, 0x60, 0x8d, 0x78, 0x0e,
-+			0xb2, 0xaf, 0xcd, 0xc6, 0xf0, 0x97, 0x0e, 0x00, 0x1a,
-+			0xe7, 0x1c, 0xb4, 0xfb, 0x74, 0xa5, 0xd2, 0x6c, 0xb1,
-+			0x22, 0xcf, 0x2b, 0x27, 0x92, 0x9e, 0x5d, 0xf2, 0x50,
-+			0x15, 0xee, 0xea, 0xc6, 0x06, 0xb0, 0x56, 0x32, 0x6c,
-+			0x25, 0x32, 0xb0, 0xf2, 0x77, 0x8e, 0x4f, 0x0d, 0xab,
-+			0x41, 0xf2, 0xda, 0x8a, 0x05, 0xae, 0xd8, 0xb2, 0x16,
-+			0xc3, 0xe2, 0x32, 0x56, 0xb2, 0xe3, 0x64, 0x97, 0x4b,
-+			0xa8, 0x69, 0x22, 0x2c, 0x11, 0x9d, 0xd7, 0x0e, 0x17,
-+			0xdd, 0x4d, 0x76, 0x7c, 0x5c, 0x68, 0x63, 0x77, 0xaa,
-+			0xcc, 0xd8, 0x01, 0x12, 0xd7, 0x6e, 0xa0, 0x62, 0x8f,
-+			0x67, 0xf3, 0x69, 0x3f, 0xd7, 0x2e, 0x28, 0x93, 0x91,
-+			0x27, 0x5f, 0x36, 0xf3, 0x76, 0x95, 0xf2, 0x14, 0x78,
-+			0x58, 0xef, 0x75, 0x55, 0x1d, 0x2a, 0xd7, 0x37, 0x0c,
-+			0x8c, 0xbc, 0x2a, 0x52),
-+
-+		WIRE_SENTINEL()
-+	};
-+
-+	UNUSED(state);
-+
-+	check_rdata(text_ok, wire_ok, NULL, false, dns_rdataclass_in,
-+		    dns_rdatatype_rrsig, sizeof(dns_rdata_rrsig_t));
-+}
-+
- /* SSHFP RDATA manipulations */
- static void
- sshfp(void **state) {
-@@ -2867,6 +2980,7 @@ main(int argc, char **argv) {
- 		cmocka_unit_test_setup_teardown(nsec, _setup, _teardown),
- 		cmocka_unit_test_setup_teardown(nsec3, _setup, _teardown),
- 		cmocka_unit_test_setup_teardown(nxt, _setup, _teardown),
-+		cmocka_unit_test_setup_teardown(rrsig, _setup, _teardown),
- 		cmocka_unit_test_setup_teardown(sshfp, _setup, _teardown),
- 		cmocka_unit_test_setup_teardown(wks, _setup, _teardown),
- 		cmocka_unit_test_setup_teardown(rkey, _setup, _teardown),
-- 
-2.55.0
-
--- a/SOURCES/bind-9.11-CVE-2026-11721.patch
+++ b/SOURCES/bind-9.11-CVE-2026-11721.patch
@ -1,263 +0,0 @@
-From 78ac82303bc3dd9d426d21fb268a5ed362d5535a Mon Sep 17 00:00:00 2001
-From: Mark Andrews <marka@isc.org>
-Date: Tue, 14 Apr 2026 15:14:06 +1000
-Subject: [PATCH 1/2] Don't sign out of zone records in dnssec-signzone
-
-dnssec-signzone was signing extraneous records that were not within
-the namespace of the zone.  This no longer occurs.
-
-(cherry picked from commit e45c9af7051421fd370f20ba8325199c606223fd)
---
- bin/dnssec/dnssec-signzone.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c
-index 6567421..b7c8e55 100644
--- a/bin/dnssec/dnssec-signzone.c
-+++ b/bin/dnssec/dnssec-signzone.c
-@@ -1482,6 +1482,11 @@ assignwork(isc_task_t *task, isc_task_t *worker) {
- 			dns_db_detachnode(gdb, &node);
- 			goto next;
- 		}
-+		if (!dns_name_issubdomain(name, gorigin)) {
-+			dumpnode(name, node);
-+			dns_db_detachnode(gdb, &node);
-+			goto next;
-+		}
- 		/*
- 		 * Sort the zone data from the glue and out-of-zone data.
- 		 * For NSEC zones nodes with zone data have NSEC records.
-
-From 8c269a0269fdf12d5edd4698d08d663c6f64ddae Mon Sep 17 00:00:00 2001
-From: Mark Andrews <marka@isc.org>
-Date: Tue, 14 Apr 2026 12:24:33 +1000
-Subject: [PATCH 2/2] Invalid signed wildcard records were being accepted
-
-An RRSIG whose Labels field indicates fewer labels than its signer
-name requires was being accepted.  When such a record covers a
-wildcard, the validator reconstructs a wildcard owner name above the
-signer's zone and caches it as secure.  RFC 8198 cache synthesis
-(synth-from-dnssec) then serves that forged wildcard for unrelated
-names, poisoning the cache.
-
-These records are now rejected, both when an RRSIG is parsed and when
-its signature is verified.
-
-(cherry picked from commit 084ca5ee10515e461d46b63df9660b8394bc7de9)
---
- lib/dns/dnssec.c                 | 45 +++++++++++++++++++++++---------
- lib/dns/rdata/generic/rrsig_46.c | 37 +++++++++++++++++++-------
- 2 files changed, 60 insertions(+), 22 deletions(-)
-
-diff --git a/lib/dns/dnssec.c b/lib/dns/dnssec.c
-index b6b2405..2516a9a 100644
--- a/lib/dns/dnssec.c
-+++ b/lib/dns/dnssec.c
-@@ -142,11 +142,11 @@ dns_dnssec_keyfromrdata(dns_name_t *name, dns_rdata_t *rdata, isc_mem_t *mctx,
- 	isc_buffer_t b;
- 	isc_region_t r;
- 
-	INSIST(name != NULL);
-	INSIST(rdata != NULL);
-	INSIST(mctx != NULL);
-	INSIST(key != NULL);
-	INSIST(*key == NULL);
-+	REQUIRE(name != NULL);
-+	REQUIRE(rdata != NULL);
-+	REQUIRE(mctx != NULL);
-+	REQUIRE(key != NULL);
-+	REQUIRE(*key == NULL);
- 	REQUIRE(rdata->type == dns_rdatatype_key ||
- 		rdata->type == dns_rdatatype_dnskey);
- 
-@@ -200,12 +200,14 @@ dns_dnssec_sign(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
- 	isc_buffer_t *databuf = NULL;
- 	char data[256 + 8];
- 	uint32_t flags;
-+	unsigned int labels;
- 	unsigned int sigsize;
- 	dns_fixedname_t fnewname;
- 	dns_fixedname_t fsigner;
- 
- 	REQUIRE(name != NULL);
-	REQUIRE(dns_name_countlabels(name) <= 255);
-+	labels = dns_name_countlabels(name);
-+	REQUIRE(labels <= 255 && labels > 0);
- 	REQUIRE(set != NULL);
- 	REQUIRE(key != NULL);
- 	REQUIRE(inception != NULL);
-@@ -243,7 +245,7 @@ dns_dnssec_sign(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
- 
- 	sig.covered = set->type;
- 	sig.algorithm = dst_key_alg(key);
-	sig.labels = dns_name_countlabels(name) - 1;
-+	sig.labels = labels - 1;
- 	if (dns_name_iswildcard(name))
- 		sig.labels--;
- 	sig.originalttl = set->ttl;
-@@ -390,11 +392,14 @@ dns_dnssec_verify3(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
- 	isc_result_t ret;
- 	unsigned char data[300];
- 	dst_context_t *ctx = NULL;
-	int labels = 0;
- 	uint32_t flags;
-+	unsigned int labels;
-+	unsigned int siglabels;
- 	bool downcase = false;
- 
- 	REQUIRE(name != NULL);
-+	labels = dns_name_countlabels(name);
-+	REQUIRE(labels > 0);
- 	REQUIRE(set != NULL);
- 	REQUIRE(key != NULL);
- 	REQUIRE(mctx != NULL);
-@@ -407,6 +412,21 @@ dns_dnssec_verify3(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
- 	if (set->type != sig.covered)
- 		return (DNS_R_SIGINVALID);
- 
-+	/*
-+	 * The RRSIG labels field can't indicate fewer labels than the
-+	 * signer.  Also the labels shouldn't be greater than that of
-+	 * the owner name.
-+	 *
-+	 * sig.labels doesn't include the root label, so add 1 to account
-+	 * for it.
-+	 */
-+	siglabels = sig.labels + 1;
-+	if (siglabels < dns_name_countlabels(&sig.signer) || siglabels > labels)
-+	{
-+		inc_stat(dns_dnssecstats_fail);
-+		return DNS_R_SIGINVALID;
-+	}
-+
- 	if (isc_serial_lt(sig.timeexpire, sig.timesigned)) {
- 		inc_stat(dns_dnssecstats_fail);
- 		return (DNS_R_SIGINVALID);
-@@ -484,11 +504,10 @@ dns_dnssec_verify3(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
- 	 * If the name is an expanded wildcard, use the wildcard name.
- 	 */
- 	dns_fixedname_init(&fnewname);
-	labels = dns_name_countlabels(name) - 1;
- 	RUNTIME_CHECK(dns_name_downcase(name, dns_fixedname_name(&fnewname),
- 					NULL) == ISC_R_SUCCESS);
-	if (labels - sig.labels > 0)
-		dns_name_split(dns_fixedname_name(&fnewname), sig.labels + 1,
-+	if (labels > siglabels)
-+		dns_name_split(dns_fixedname_name(&fnewname), siglabels,
- 			       NULL, dns_fixedname_name(&fnewname));
- 
- 	dns_name_toregion(dns_fixedname_name(&fnewname), &r);
-@@ -497,7 +516,7 @@ dns_dnssec_verify3(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
- 	 * Create an envelope for each rdata: <name|type|class|ttl>.
- 	 */
- 	isc_buffer_init(&envbuf, data, sizeof(data));
-	if (labels - sig.labels > 0) {
-+	if (labels > siglabels) {
- 		isc_buffer_putuint8(&envbuf, 1);
- 		isc_buffer_putuint8(&envbuf, '*');
- 		memmove(data + 2, r.base, r.length);
-@@ -583,7 +602,7 @@ cleanup_struct:
- 	if (ret != ISC_R_SUCCESS)
- 		inc_stat(dns_dnssecstats_fail);
- 
-	if (ret == ISC_R_SUCCESS && labels - sig.labels > 0) {
-+	if (ret == ISC_R_SUCCESS && labels > siglabels) {
- 		if (wild != NULL)
- 			RUNTIME_CHECK(dns_name_concatenate(dns_wildcardname,
- 						 dns_fixedname_name(&fnewname),
-diff --git a/lib/dns/rdata/generic/rrsig_46.c b/lib/dns/rdata/generic/rrsig_46.c
-index 0d4df67..35a1b4c 100644
--- a/lib/dns/rdata/generic/rrsig_46.c
-+++ b/lib/dns/rdata/generic/rrsig_46.c
-@@ -21,12 +21,12 @@
- static inline isc_result_t
- fromtext_rrsig(ARGS_FROMTEXT) {
- 	isc_token_t token;
-	unsigned char c;
-+	unsigned char alg, labels;
- 	long i;
- 	dns_rdatatype_t covered;
-	char *e;
-+	char *e = NULL;
- 	isc_result_t result;
-	dns_name_t name;
-+	dns_name_t signer;
- 	isc_buffer_t buffer;
- 	uint32_t time_signed, time_expire;
- 
-@@ -57,8 +57,8 @@ fromtext_rrsig(ARGS_FROMTEXT) {
- 	 */
- 	RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_string,
- 				      false));
-	RETTOK(dns_secalg_fromtext(&c, &token.value.as_textregion));
-	RETERR(mem_tobuffer(target, &c, 1));
-+	RETTOK(dns_secalg_fromtext(&alg, &token.value.as_textregion));
-+	RETERR(mem_tobuffer(target, &alg, 1));
- 
- 	/*
- 	 * Labels.
-@@ -67,8 +67,8 @@ fromtext_rrsig(ARGS_FROMTEXT) {
- 				      false));
- 	if (token.value.as_ulong > 0xffU)
- 		RETTOK(ISC_R_RANGE);
-	c = (unsigned char)token.value.as_ulong;
-	RETERR(mem_tobuffer(target, &c, 1));
-+	labels = (unsigned char)token.value.as_ulong;
-+	RETERR(mem_tobuffer(target, &labels, 1));
- 
- 	/*
- 	 * Original ttl.
-@@ -131,11 +131,19 @@ fromtext_rrsig(ARGS_FROMTEXT) {
- 	 */
- 	RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_string,
- 				      false));
-	dns_name_init(&name, NULL);
-+	dns_name_init(&signer, NULL);
- 	buffer_fromregion(&buffer, &token.value.as_region);
- 	if (origin == NULL)
- 		origin = dns_rootname;
-	RETTOK(dns_name_fromtext(&name, &buffer, origin, options, target));
-+	RETTOK(dns_name_fromtext(&signer, &buffer, origin, options, target));
-+
-+	/*
-+	 * (RRSIG labels doesn't include the root label, so add one
-+	 * to normalize it before checking against the signer.)
-+	 */
-+	if ((unsigned int)(labels + 1) < dns_name_countlabels(&signer)) {
-+		RETTOK(ISC_R_RANGE);
-+	}
- 
- 	/*
- 	 * Sig.
-@@ -260,6 +268,7 @@ static inline isc_result_t
- fromwire_rrsig(ARGS_FROMWIRE) {
- 	isc_region_t sr;
- 	dns_name_t name;
-+	unsigned char labels;
- 
- 	REQUIRE(type == dns_rdatatype_rrsig);
- 
-@@ -281,6 +290,8 @@ fromwire_rrsig(ARGS_FROMWIRE) {
- 	if (sr.length < 18)
- 		return (ISC_R_UNEXPECTEDEND);
- 
-+	labels = sr.base[3];
-+
- 	isc_buffer_forward(source, 18);
- 	RETERR(mem_tobuffer(target, sr.base, 18));
- 
-@@ -290,6 +301,14 @@ fromwire_rrsig(ARGS_FROMWIRE) {
- 	dns_name_init(&name, NULL);
- 	RETERR(dns_name_fromwire(&name, source, dctx, options, target));
- 
-+	/*
-+	 * (RRSIG labels doesn't include the root label, so add one
-+	 * to normalize it before checking against the signer.)
-+	 */
-+	if ((unsigned int)(labels + 1) < dns_name_countlabels(&name)) {
-+		RETERR(DNS_R_FORMERR);
-+	}
-+
- 	/*
- 	 * Sig.
- 	 */
--- a/SOURCES/bind-9.11-CVE-2026-13204.patch
+++ b/SOURCES/bind-9.11-CVE-2026-13204.patch
@ -1,154 +0,0 @@
-From 0be245b5c7641533fff2f808d19730e9766a9a36 Mon Sep 17 00:00:00 2001
-From: Evan Hunt <each@isc.org>
-Date: Wed, 13 May 2026 20:45:57 -0700
-Subject: [PATCH] dns_rdataset_addnoqname() could find unsigned NSEC/NSEC3
-
-The dns_rdatalist addnoqname() implementation searches for the first
-NSEC or NSEC3 record in a message, then for the first RRSIG covering
-that type in the same message.  Previously, if no RRSIG for the type was
-found, the function accepted the unsigned record. Now, it will instead
-continue searching until an NSEC or NSEC3 that does have a matching
-signature is found.
-
-When this function is called from validated() in resolver.c, a
-non-success return code is now treated as an error instead of triggering
-an assertion failure.
-
-Fixes: isc-projects/bind9#5985
-(cherry picked from commit 57cba571ee31311e54d8a11cb38094d439f04e09)
---
- bin/named/query.c   |  4 +++-
- lib/dns/rbtdb.c     |  8 +++++---
- lib/dns/rdatalist.c | 36 +++++++++++++++++++++---------------
- lib/dns/resolver.c  |  4 +++-
- 4 files changed, 32 insertions(+), 20 deletions(-)
-
-diff --git a/bin/named/query.c b/bin/named/query.c
-index e023d74..083ce83 100644
--- a/bin/named/query.c
-+++ b/bin/named/query.c
-@@ -6198,7 +6198,9 @@ query_addnoqnameproof(ns_client_t *client, dns_rdataset_t *rdataset) {
- 		goto cleanup;
- 
- 	result = dns_rdataset_getnoqname(rdataset, fname, neg, negsig);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
-+	if (result != ISC_R_SUCCESS) {
-+		goto cleanup;
-+	}
- 
- 	query_addrrset(client, &fname, &neg, &negsig, dbuf,
- 		       DNS_SECTION_AUTHORITY);
-diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
-index 388ffdf..b7f21ac 100644
--- a/lib/dns/rbtdb.c
-+++ b/lib/dns/rbtdb.c
-@@ -6977,7 +6977,7 @@ static inline isc_result_t
- addnoqname(dns_rbtdb_t *rbtdb, rdatasetheader_t *newheader,
- 	   dns_rdataset_t *rdataset)
- {
-	struct noqname *noqname;
-+	struct noqname *noqname = NULL;
- 	isc_mem_t *mctx = rbtdb->common.mctx;
- 	dns_name_t name;
- 	dns_rdataset_t neg, negsig;
-@@ -6989,7 +6989,9 @@ addnoqname(dns_rbtdb_t *rbtdb, rdatasetheader_t *newheader,
- 	dns_rdataset_init(&negsig);
- 
- 	result = dns_rdataset_getnoqname(rdataset, &name, &neg, &negsig);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
-+	if (result != ISC_R_SUCCESS) {
-+		goto cleanup;
-+	}
- 
- 	noqname = isc_mem_get(mctx, sizeof(*noqname));
- 	if (noqname == NULL) {
-@@ -7021,7 +7023,7 @@ cleanup:
- 	dns_rdataset_disassociate(&negsig);
- 	if (noqname != NULL)
- 		free_noqname(mctx, &noqname);
-	return(result);
-+	return (result);
- }
- 
- static inline isc_result_t
-diff --git a/lib/dns/rdatalist.c b/lib/dns/rdatalist.c
-index cc2619c..687953c 100644
--- a/lib/dns/rdatalist.c
-+++ b/lib/dns/rdatalist.c
-@@ -196,6 +196,7 @@ isc__rdatalist_addnoqname(dns_rdataset_t *rdataset, dns_name_t *name) {
- 	dns_rdataset_t *neg = NULL;
- 	dns_rdataset_t *negsig = NULL;
- 	dns_rdataset_t *rdset;
-+	dns_rdataset_t *sigset;
- 	dns_ttl_t ttl;
- 
- 	REQUIRE(rdataset != NULL);
-@@ -204,26 +205,30 @@ isc__rdatalist_addnoqname(dns_rdataset_t *rdataset, dns_name_t *name) {
- 	     rdset != NULL;
- 	     rdset = ISC_LIST_NEXT(rdset, link))
- 	{
-		if (rdset->rdclass != rdataset->rdclass)
-+		if (rdset->rdclass != rdataset->rdclass ||
-+		    (rdset->type != dns_rdatatype_nsec &&
-+		     rdset->type != dns_rdatatype_nsec3))
-+		{
- 			continue;
-		if (rdset->type == dns_rdatatype_nsec ||
-		    rdset->type == dns_rdatatype_nsec3)
-			neg = rdset;
-+		}
-+
-+		for (sigset = ISC_LIST_HEAD(name->list); sigset != NULL;
-+		     sigset = ISC_LIST_NEXT(sigset, link))
-+		{
-+			if (sigset->type == dns_rdatatype_rrsig &&
-+			    sigset->covers == rdset->type)
-+			{
-+				neg = rdset;
-+				negsig = sigset;
-+				break;
-+			}
-+		}
- 	}
-	if (neg == NULL)
-		return (ISC_R_NOTFOUND);
- 
-	for (rdset = ISC_LIST_HEAD(name->list);
-	     rdset != NULL;
-	     rdset = ISC_LIST_NEXT(rdset, link))
-	{
-		if (rdset->type == dns_rdatatype_rrsig &&
-		    rdset->covers == neg->type)
-			negsig = rdset;
-+	if (neg == NULL || negsig == NULL) {
-+		return (ISC_R_NOTFOUND);
- 	}
- 
-	if (negsig == NULL)
-		return (ISC_R_NOTFOUND);
- 	/*
- 	 * Minimise ttl.
- 	 */
-@@ -235,6 +240,7 @@ isc__rdatalist_addnoqname(dns_rdataset_t *rdataset, dns_name_t *name) {
- 	rdataset->ttl = neg->ttl = negsig->ttl = ttl;
- 	rdataset->attributes |= DNS_RDATASETATTR_NOQNAME;
- 	rdataset->private6 = name;
-+
- 	return (ISC_R_SUCCESS);
- }
- 
-diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
-index 5331ea9..78553f6 100644
--- a/lib/dns/resolver.c
-+++ b/lib/dns/resolver.c
-@@ -5153,7 +5153,9 @@ validated(isc_task_t *task, isc_event_t *event) {
- 	if (vevent->proofs[DNS_VALIDATOR_NOQNAMEPROOF] != NULL) {
- 		result = dns_rdataset_addnoqname(vevent->rdataset,
- 				   vevent->proofs[DNS_VALIDATOR_NOQNAMEPROOF]);
-		RUNTIME_CHECK(result == ISC_R_SUCCESS);
-+		if (result != ISC_R_SUCCESS) {
-+			goto noanswer_response;
-+		}
- 		INSIST(vevent->sigrdataset != NULL);
- 		vevent->sigrdataset->ttl = vevent->rdataset->ttl;
- 		if (vevent->proofs[DNS_VALIDATOR_CLOSESTENCLOSER] != NULL) {
--- a/SOURCES/bind-9.11-CVE-2026-13321.patch
+++ b/SOURCES/bind-9.11-CVE-2026-13321.patch
@ -1,270 +0,0 @@
-From 338661714d508a810a903ae6fdaf522c9abc2d4b Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Ayd=C4=B1n=20Mercan?= <aydin@isc.org>
-Date: Thu, 7 May 2026 18:59:20 +0300
-Subject: [PATCH 1/2] Reject out-of-zone NSEC next owner names
-
-When verifying DNSSEC records, make sure that a next owner name of
-an NSEC record is a subdomain of the signer field.
-
-This follows the specification RFC 4034, section 4.1.1:
-
- Owner names of RRsets for which the given zone is not authoritative
- (such as glue records) MUST NOT be listed in the Next Domain Name
- unless at least one authoritative RRset exists at the same owner
- name.
-
-While the above paragraph is intended for glue records, it also
-applies to out-of-zone data.
-
-(cherry picked from commit 4065512d25b71605b9502bb69dfb903776d35aa9)
---
- lib/dns/dnssec.c             | 18 ++++++++++++++++++
- lib/dns/include/dns/dnssec.h |  6 ++++++
- 2 files changed, 24 insertions(+)
-
-diff --git a/lib/dns/dnssec.c b/lib/dns/dnssec.c
-index b6b2405fac..b9bd374ed6 100644
--- a/lib/dns/dnssec.c
-+++ b/lib/dns/dnssec.c
-@@ -380,8 +380,10 @@ dns_dnssec_verify3(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
- 		   bool ignoretime, unsigned int maxbits,
- 		   isc_mem_t *mctx, dns_rdata_t *sigrdata, dns_name_t *wild)
- {
-+	dns_rdata_nsec_t nsec;
- 	dns_rdata_rrsig_t sig;
- 	dns_fixedname_t fnewname;
-+	dns_rdata_t rdata = DNS_RDATA_INIT;
- 	isc_region_t r;
- 	isc_buffer_t envbuf;
- 	dns_rdata_t *rdatas;
-@@ -454,6 +456,22 @@ dns_dnssec_verify3(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
- 		break;
- 	}
- 
-+	/*
-+	 * Check for out of zone NSEC entries.
-+	 */
-+	if (set->type == dns_rdatatype_nsec) {
-+		if (dns_rdataset_first(set) != ISC_R_SUCCESS) {
-+			return (DNS_R_NOVALIDNSEC);
-+		}
-+		dns_rdataset_current(set, &rdata);
-+		if (dns_rdata_tostruct(&rdata, &nsec, NULL) != ISC_R_SUCCESS) {
-+			return (DNS_R_NOVALIDNSEC);
-+		}
-+		if (!dns_name_issubdomain(&nsec.next, &sig.signer)) {
-+			return (DNS_R_NOVALIDNSEC);
-+		}
-+	}
-+
- 	/*
- 	 * Is the key allowed to sign data?
- 	 */
-diff --git a/lib/dns/include/dns/dnssec.h b/lib/dns/include/dns/dnssec.h
-index 31e2586c9b..1f13a08181 100644
--- a/lib/dns/include/dns/dnssec.h
-+++ b/lib/dns/include/dns/dnssec.h
-@@ -138,6 +138,9 @@ dns_dnssec_verify3(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
-  *	this record, as this requires a resolver or database.
-  *	If 'ignoretime' is true, temporal validity will not be checked.
-  *
-+ *	If 'set' is of type NSEC, this function also verifies that the
-+ *	Next Name is a subdomain of the Signer's Name from 'sigrdata'.
-+ *
-  *	'maxbits' specifies the maximum number of rsa exponent bits accepted.
-  *
-  *	Requires:
-@@ -160,6 +163,9 @@ dns_dnssec_verify3(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
-  *\li		#DNS_R_KEYUNAUTHORIZED - the key cannot sign this data (either
-  *			it is not a zone key or its flags prevent
-  *			authentication)
-+ *
-+ *\li		#DNS_R_NOVALIDNSEC - the NSEC rdata is not valid
-+ *\li		#DNS_R_KEYUNAUTHORIZED - the key cannot sign this data
-  *\li		DST_R_*
-  */
- 
-
-From dfb91ca4a45092c414a41cb5640cf4710f7ba0e9 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Ayd=C4=B1n=20Mercan?= <aydin@isc.org>
-Date: Tue, 12 May 2026 14:54:09 +0300
-Subject: [PATCH 2/2] change dns_nsec_requiredtypespresent to dns_nsec_is_legal
-
-Change `dns_nsec_requiredtypespresent` to `dns_nsec_is_legal` as a
-function for checking multiple NSEC validity rules.
-
-Currently we now additionally check for out-of-zone NSEC entries.
-
-(cherry picked from commit be2a6a497312469890b552907d039d2de0b44ccc)
---
- lib/dns/include/dns/nsec.h | 18 ++++++++++++++
- lib/dns/nsec.c             | 37 +++++++++++++++++++++++++++
- lib/dns/resolver.c         | 51 ++++++++++++++++++++++++++++++++++++++
- 3 files changed, 106 insertions(+)
-
-diff --git a/lib/dns/include/dns/nsec.h b/lib/dns/include/dns/nsec.h
-index 4e12cbea75..8caead6a1e 100644
--- a/lib/dns/include/dns/nsec.h
-+++ b/lib/dns/include/dns/nsec.h
-@@ -106,6 +106,24 @@ dns_nsec_noexistnodata(dns_rdatatype_t type, dns_name_t *name,
-  * Return ISC_R_IGNORE when the NSEC is not the appropriate one.
-  */
- 
-+bool
-+dns_nsec_is_legal(dns_rdataset_t *rdataset, const dns_name_t *name);
-+/**<
-+ * \brief
-+ * Validates a rdataset of type NSEC.
-+ *
-+ * This functions checks for the following in the given rdataset:
-+ * \li All NSEC records have both NSEC and RRSIG present
-+ * \li All NSEC entries are under the `name`
-+ *
-+ * \par Requires:
-+ * \li	rdataset to be a NSEC rdataset.
-+ * \li  `name` is a valid dns_name_t
-+ *
-+ * \retval true if all the checks pass
-+ * \retval false otherwise
-+ */
-+
- ISC_LANG_ENDDECLS
- 
- #endif /* DNS_NSEC_H */
-diff --git a/lib/dns/nsec.c b/lib/dns/nsec.c
-index d90c38589e..fd4c529da0 100644
--- a/lib/dns/nsec.c
-+++ b/lib/dns/nsec.c
-@@ -21,6 +21,7 @@
- #include <isc/util.h>
- 
- #include <dns/db.h>
-+#include <dns/name.h>
- #include <dns/nsec.h>
- #include <dns/rdata.h>
- #include <dns/rdatalist.h>
-@@ -445,3 +446,39 @@ dns_nsec_noexistnodata(dns_rdatatype_t type, dns_name_t *name,
- 	*exists = false;
- 	return (ISC_R_SUCCESS);
- }
-+
-+bool
-+dns_nsec_is_legal(dns_rdataset_t *nsecset, const dns_name_t *name) {
-+	dns_rdataset_t rdataset;
-+	dns_rdata_nsec_t nsec;
-+	isc_result_t result;
-+	bool found = false;
-+
-+	REQUIRE(nsecset != NULL && nsecset->type == dns_rdatatype_nsec);
-+
-+	dns_rdataset_init(&rdataset);
-+	dns_rdataset_clone(nsecset, &rdataset);
-+
-+	for (result = dns_rdataset_first(&rdataset); result == ISC_R_SUCCESS;
-+	     result = dns_rdataset_next(&rdataset))
-+	{
-+		dns_rdata_t rdata = DNS_RDATA_INIT;
-+		dns_rdataset_current(&rdataset, &rdata);
-+
-+		/* must never fail */
-+		result = dns_rdata_tostruct(&rdata, &nsec, NULL);
-+		INSIST(result == ISC_R_SUCCESS);
-+
-+		if (!dns_name_issubdomain(&nsec.next, name) ||
-+		    !dns_nsec_typepresent(&rdata, dns_rdatatype_rrsig) ||
-+		    !dns_nsec_typepresent(&rdata, dns_rdatatype_nsec))
-+		{
-+			dns_rdataset_disassociate(&rdataset);
-+			return (false);
-+		}
-+
-+		found = true;
-+	}
-+	dns_rdataset_disassociate(&rdataset);
-+	return (found);
-+}
-diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
-index 0f16eadcdd..8ef35bb641 100644
--- a/lib/dns/resolver.c
-+++ b/lib/dns/resolver.c
-@@ -62,8 +62,10 @@
- #include <dns/rootns.h>
- #include <dns/stats.h>
- #include <dns/tsig.h>
-+#include <dns/types.h>
- #include <dns/validator.h>
-+#include <dns/view.h>
- #include <dns/zone.h>
- 
- #ifdef WANT_QUERYTRACE
- #define RTRACE(m)       isc_log_write(dns_lctx, \
-@@ -4879,6 +4881,36 @@ maybe_destroy(fetchctx_t *fctx, bool locked) {
- 	return (bucket_empty);
- }
- 
-+static bool
-+get_and_check_signer_name(dns_name_t *signer, dns_rdataset_t *sigrdataset) {
-+	dns_rdata_rrsig_t rrsig;
-+	isc_result_t result;
-+	dns_rdata_t rdata;
-+
-+	if (dns_rdataset_first(sigrdataset) != ISC_R_SUCCESS) {
-+		return false;
-+	}
-+
-+	rdata = (dns_rdata_t)DNS_RDATA_INIT;
-+	dns_rdataset_current(sigrdataset, &rdata);
-+	result = dns_rdata_tostruct(&rdata, &rrsig, NULL);
-+	INSIST(result == ISC_R_SUCCESS);
-+	dns_name_copy(&rrsig.signer, signer, NULL);
-+
-+	while (dns_rdataset_next(sigrdataset) == ISC_R_SUCCESS) {
-+		rdata = (dns_rdata_t)DNS_RDATA_INIT;
-+		dns_rdataset_current(sigrdataset, &rdata);
-+		result = dns_rdata_tostruct(&rdata, &rrsig, NULL);
-+		INSIST(result == ISC_R_SUCCESS);
-+
-+		if (!dns_name_equal(signer, &rrsig.signer)) {
-+			return false;
-+		}
-+	}
-+
-+	return true;
-+}
-+
- /*
-  * The validator has finished.
-  */
-@@ -4907,6 +4939,8 @@ validated(isc_task_t *task, isc_event_t *event) {
- 	unsigned options;
- 	uint32_t bucketnum;
- 	dns_message_t *rmessage = NULL;
-+	dns_fixedname_t fsigner;
-+	dns_name_t *signer = NULL;
- 
- 	UNUSED(task); /* for now */
- 
-@@ -5240,6 +5274,23 @@ validated(isc_task_t *task, isc_event_t *event) {
- 			if (sigrdataset == NULL ||
- 			    sigrdataset->trust != dns_trust_secure)
- 				continue;
-+			/*
-+			 * Don't cache if all the RRSIGs don't have the same
-+			 * signer.
-+			 */
-+			signer = dns_fixedname_initname(&fsigner);
-+			if (!get_and_check_signer_name(signer, sigrdataset)) {
-+				continue;
-+			}
-+			/*
-+			 * Don't cache NSEC if missing NSEC or RRSIG
-+			 * types.
-+			 */
-+			if (rdataset->type == dns_rdatatype_nsec &&
-+			    !dns_nsec_is_legal(rdataset, signer))
-+			{
-+				continue;
-+			}
- 			result = dns_db_findnode(fctx->cache, name, true,
- 						 &nsnode);
- 			if (result != ISC_R_SUCCESS)
--- a/SOURCES/bind-9.11-CVE-2026-5946.patch
+++ b/SOURCES/bind-9.11-CVE-2026-5946.patch
@ -1,512 +0,0 @@
-From de237c66c901b451e4957a28e0d953c57648eab9 Mon Sep 17 00:00:00 2001
-From: Evan Hunt <each@isc.org>
-Date: Tue, 3 Mar 2026 14:00:38 -0800
-Subject: [PATCH] Disable recursion for non-IN classes
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Force recursion off, and set allow-recursion/allow-recursion-on ACLs
-to none, for views with a class other than IN. Log a configuration
-warning if recursion is explicitly enabled for a non-IN view.
-
-This addresses YWH-PGM40640-74 and YWH-PGM40640-75 by preventing any
-attempt at recursive processing in a class-CHAOS view, ensuring that
-server addresses used for recursive queries and received in recursive
-responses are of the expected format.
-
-Fixes: isc-projects/bind9#5780
-Fixes: isc-projects/bind9#5781
-
-(cherry picked from commit 70532a37a1aec761e8a12444852866ce9d9d5fcc)
-(cherry picked from commit cf0d5a4e385525e21f2ae39098b1ab90c1137a2a)
-(cherry picked from commit c6b05d8449d94c74e85be70b822b7ad439abca40)
-
-Disable UPDATE and NOTIFY for non-IN classes
-
-Return NOTIMP for UPDATE and NOTIFY requests received for views with a
-class other than IN.  Only QUERY is now supported for non-IN views such
-as CHAOS.
-
-When running dns dns_rdata_tostruct() with types that are only defined
-for class IN, ensure that the class is correct before proceeding.
-
-Add an assertion that any zone being updated is of class IN. (Note
-that previously, a DLZ zone could have its class value set incorrectly
-to NONE; this has been fixed.)
-
-This addresses YWH-PGM40640-70 and YWH-PGM40640-73 (as well as any
-similar problems that might have occurred in the future) by minimizing
-the code paths that can be reached by rdata classes other than IN, so it
-is safe for the implementation to assume that rdatatypes that are only
-defined for class IN, such as SVCB or WKS, have been parsed and
-validated, and not accepted as unknown/opaque data.
-
-Fixes: isc-projects/bind9#5777
-Fixes: isc-projects/bind9#5779
-
-(cherry picked from commit 9ae24c32bec16c0f64225ef04f34670018bf0765)
-(cherry picked from commit a2ca2408b3ff031c426c5dc785f550c9d30bf4aa)
-(cherry picked from commit f107b702c4ff4a68042d0dad8384544dd99954a8)
-
-Validate DNS message CLASS early in request processing
-
-Reject requests with unsupported or misused CLASS values before
-further processing.  Only IN, CH, HS, RESERVED0 (for DNS Cookies),
-ANY (for TKEY negotiation), and NONE (for DNS UPDATE) are accepted;
-all other classes return NOTIMP.  Misuse of NONE or ANY outside
-their allowed contexts returns FORMERR.
-
-This adds further protection against bugs of the same general class
-as YWH-PGM40640-70 and YWH-PGM40640-73.
-
-(cherry picked from commit d41865a458b9ecd76be4097ac1bea1005cad72db)
-(cherry picked from commit 1c8016c91c3674929f87cbe7ad09f3670e05ad4e)
-(cherry picked from commit 6c50d4812c35fe982614cd53355c4048ab09267a)
-
-Reject meta-classes in UPDATE and NOTIFY messages
-
-NOTIFY and UPDATE messages must specify a data class in the
-QUESTION/ZONE section.  NONE and ANY are meta-classes and not
-appropriate here.  Return FORMERR if either is used.
-
-Rejecting messages with a query class of NONE addresses YWH-PGM40640-72,
-YWH-PGM40640-82, and YWH-PGM40640-83.  Rejecting messages with a query
-class of ANY addresses YWH-PGM40640-87, YWH-PGM40640-88, and
-YWH-PGM40640-117.
-
-Fixes: isc-projects/bind9#5778
-Fixes: isc-projects/bind9#5782
-Fixes: isc-projects/bind9#5783
-Fixes: isc-projects/bind9#5797
-Fixes: isc-projects/bind9#5798
-Fixes: isc-projects/bind9#5853
-
-(cherry picked from commit 7de5160517ae69196d1c323b8627b267cdd10761)
-(cherry picked from commit 3c44de9e6252ec1c7742ef02ecc0d6cbf1cde5e9)
-(cherry picked from commit f7d5fe628c220245a14397207893424f0b27ff53)
-
-Skip "deny-answer-address" for non-IN addresses
-
-Ensure that we don't attempt an ACL match for answer addresses
-when handling a class-CHAOS zone. This is an additional line of
-defense for YWH-PGM40640-74.
-
-(cherry picked from commit 4cd3d8e6d866143ddc62df821a1007bf3ee7f083)
-(cherry picked from commit fa60101e910346e64fa2a684b903fbcb84d8243b)
-(cherry picked from commit c01d298f53b0ffbf38bf19867f368f60a9ea4ecf)
-
-Pass empty string instead of NULL to ns_client_dumpmessage()
-
-The two new call sites added by the CLASS-validation work passed NULL
-as the reason, but ns_client_dumpmessage() bails out early on a NULL
-reason — so the message dump never happened. The intent was to dump
-the message and let the follow-up ns_client_log() carry the reason
-text, so pass "" to suppress the prefix without short-circuiting the
-dump.
-
-(cherry picked from commit 8af39c360407a92ef31bf233b9df760d1bb9fb5f)
-(cherry picked from commit 4d7e442c9aee72851f2b2d973273ebc92da42cf0)
-
-%RH
-Backport fixes.
---
- bin/named/client.c                | 56 +++++++++++++++++++++++++++++--
- bin/named/server.c                | 38 ++++++---------------
- bin/named/update.c                | 31 +++++++++--------
- bin/tests/system/unknown/tests.sh | 12 +++----
- lib/dns/adb.c                     |  2 +-
- lib/dns/message.c                 | 11 ++++++
- lib/dns/resolver.c                | 13 +++++--
- 7 files changed, 109 insertions(+), 54 deletions(-)
-
-diff --git a/bin/named/client.c b/bin/named/client.c
-index ea121b301e..6990e02b03 100644
--- a/bin/named/client.c
-+++ b/bin/named/client.c
-@@ -40,6 +40,7 @@
- #include <dns/dnstap.h>
- #include <dns/cache.h>
- #include <dns/edns.h>
-+#include <dns/enumclass.h>
- #include <dns/events.h>
- #include <dns/message.h>
- #include <dns/peer.h>
-@@ -2829,7 +2830,9 @@ client_request(isc_task_t *task, isc_event_t *event) {
- 			goto cleanup;
- 	}
- 
-	if (client->message->rdclass == 0) {
-+	char classbuf[DNS_RDATACLASS_FORMATSIZE];
-+	switch (client->message->rdclass) {
-+	case dns_rdataclass_reserved0:
- 		if ((client->attributes & NS_CLIENTATTR_WANTCOOKIE) != 0 &&
- 		    client->message->opcode == dns_opcode_query &&
- 		    client->message->counts[DNS_SECTION_QUESTION] == 0U)
-@@ -2851,6 +2854,44 @@ client_request(isc_task_t *task, isc_event_t *event) {
- 				      "message class could not be determined");
- 		ns_client_error(client, notimp ? DNS_R_NOTIMP : DNS_R_FORMERR);
- 		goto cleanup;
-+	case dns_rdataclass_in:
-+		break;
-+	case dns_rdataclass_chaos:
-+		break;
-+	case dns_rdataclass_hs:
-+		break;
-+	case dns_rdataclass_none:
-+		if (client->message->opcode != dns_opcode_update) {
-+			ns_client_dumpmessage(client,
-+					      "message class NONE can be only "
-+					      "used in DNS updates");
-+			ns_client_error(client, DNS_R_FORMERR);
-+			return;
-+		}
-+		break;
-+	case dns_rdataclass_any:
-+		/*
-+		 * Required for TKEY negotiation.
-+		 */
-+		if (client->message->tkey == 0) {
-+			ns_client_dumpmessage(client,
-+					      "message class ANY can be only "
-+					      "used for TKEY negotiation");
-+			ns_client_error(client, DNS_R_FORMERR);
-+			return;
-+		}
-+		break;
-+	default:
-+		dns_rdataclass_format(client->message->rdclass, classbuf,
-+				      sizeof(classbuf));
-+		ns_client_dumpmessage(client, "");
-+		ns_client_log(client, NS_LOGCATEGORY_CLIENT,
-+			      NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(1),
-+			      "message class could not be determined");
-+		ns_client_dumpmessage(client, "message class could not be "
-+					      "determined");
-+		ns_client_error(client, DNS_R_NOTIMP);
-+		goto cleanup;
- 	}
- 
- 	/*
-@@ -2969,7 +3010,7 @@ client_request(isc_task_t *task, isc_event_t *event) {
- 		ns_client_log(client, NS_LOGCATEGORY_CLIENT,
- 			      NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(1),
- 			      "no matching view in class '%s'", classname);
-		ns_client_dumpmessage(client, "no matching view in class");
-+		ns_client_dumpmessage(client, "");
- 		ns_client_error(client, notimp ? DNS_R_NOTIMP : DNS_R_REFUSED);
- 		goto cleanup;
- 	}
-@@ -3149,11 +3190,19 @@ client_request(isc_task_t *task, isc_event_t *event) {
- 		break;
- 	case dns_opcode_update:
- 		CTRACE("update");
-+		if (client->view->rdclass != dns_rdataclass_in) {
-+			ns_client_error(client, DNS_R_NOTIMP);
-+			break;
-+		}
- 		ns_client_settimeout(client, 60);
- 		ns_update_start(client, sigresult);
- 		break;
- 	case dns_opcode_notify:
- 		CTRACE("notify");
-+		if (client->view->rdclass != dns_rdataclass_in) {
-+			ns_client_error(client, DNS_R_NOTIMP);
-+			break;
-+		}
- 		ns_client_settimeout(client, 60);
- 		ns_notify_start(client);
- 		break;
-@@ -4241,8 +4290,9 @@ ns_client_dumpmessage(ns_client_t *client, const char *reason) {
- 	int len = 1024;
- 	isc_result_t result;
- 
-	if (!isc_log_wouldlog(ns_g_lctx, ISC_LOG_DEBUG(1)))
-+	if (!isc_log_wouldlog(ns_g_lctx, ISC_LOG_DEBUG(1)) || reason == NULL) {
- 		return;
-+	}
- 
- 	/*
- 	 * Note that these are multiline debug messages.  We want a newline
-diff --git a/bin/named/server.c b/bin/named/server.c
-index 2086e41ca9..be521f6cf2 100644
--- a/bin/named/server.c
-+++ b/bin/named/server.c
-@@ -1756,6 +1756,7 @@ dlzconfigure_callback(dns_view_t *view, dns_dlzdb_t *dlzdb, dns_zone_t *zone) {
- 	dns_rdataclass_t zclass = view->rdclass;
- 	isc_result_t result;
- 
-+	dns_zone_setclass(zone, zclass);
- 	result = dns_zonemgr_managezone(ns_g_server->zonemgr, zone);
- 	if (result != ISC_R_SUCCESS)
- 		return (result);
-@@ -4170,32 +4171,14 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
- 		CHECK(configure_alternates(config, view, alternates));
- 
- 	/*
-	 * We have default hints for class IN if we need them.
-+	 * We have default root hints for class IN if we need them.
-+	 * Each view gets its own rootdb so a priming response only
-+	 * writes into that view's copy.  Other classes don't support
-+	 * recursion and don't need hints.
- 	 */
- 	if (view->rdclass == dns_rdataclass_in && view->hints == NULL)
- 		dns_view_sethints(view, ns_g_server->in_roothints);
- 
-	/*
-	 * If we still have no hints, this is a non-IN view with no
-	 * "hints zone" configured.  Issue a warning, except if this
-	 * is a root server.  Root servers never need to consult
-	 * their hints, so it's no point requiring users to configure
-	 * them.
-	 */
-	if (view->hints == NULL) {
-		dns_zone_t *rootzone = NULL;
-		(void)dns_view_findzone(view, dns_rootname, &rootzone);
-		if (rootzone != NULL) {
-			dns_zone_detach(&rootzone);
-			need_hints = false;
-		}
-		if (need_hints)
-			isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
-				      NS_LOGMODULE_SERVER, ISC_LOG_WARNING,
-				      "no root hints for view '%s'",
-				      view->name);
-	}
-
- 	/*
- 	 * Configure the view's TSIG keys.
- 	 */
-@@ -4302,7 +4285,8 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
- 	obj = NULL;
- 	result = ns_config_get(maps, "recursion", &obj);
- 	INSIST(result == ISC_R_SUCCESS);
-	view->recursion = cfg_obj_asboolean(obj);
-+	view->recursion = (view->rdclass == dns_rdataclass_in &&
-+			   cfg_obj_asboolean(obj));
- 
- 	obj = NULL;
- 	result = ns_config_get(maps, "auth-nxdomain", &obj);
-@@ -4409,10 +4393,10 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
- 				 "allow-query-cache", NULL, actx,
- 				 ns_g_mctx, &view->cacheacl));
- 
-	if (strcmp(view->name, "_bind") != 0 &&
-	    view->rdclass != dns_rdataclass_chaos)
-	{
-		/* named.conf only */
-+	if (view->rdclass != dns_rdataclass_in) {
-+		dns_acl_none(ns_g_mctx, &view->recursionacl);
-+		dns_acl_none(ns_g_mctx, &view->recursiononacl);
-+	} else {
- 		CHECK(configure_view_acl(vconfig, config, NULL,
- 					 "allow-recursion", NULL, actx,
- 					 ns_g_mctx, &view->recursionacl));
-diff --git a/bin/named/update.c b/bin/named/update.c
-index 407ac38272..be469f8e91 100644
--- a/bin/named/update.c
-+++ b/bin/named/update.c
-@@ -1269,7 +1269,10 @@ replaces_p(dns_rdata_t *update_rr, dns_rdata_t *db_rr) {
- 		    dbsig.algorithm == updatesig.algorithm)
- 			return (true);
- 	}
-	if (db_rr->type == dns_rdatatype_wks) {
-+
-+	if (db_rr->rdclass == dns_rdataclass_in &&
-+	    db_rr->type == dns_rdatatype_wks)
-+	{
- 		/*
- 		 * Compare the address and protocol fields only.  These
- 		 * form the first five bytes of the RR data.  Do a
-@@ -1412,8 +1415,7 @@ add_rr_prepare_action(void *data, rr_t *rr) {
-  * 'rdata', and 'ttl', respectively.
-  */
- static void
-get_current_rr(dns_message_t *msg, dns_section_t section,
-	       dns_rdataclass_t zoneclass, dns_name_t **name,
-+get_current_rr(dns_message_t *msg, dns_section_t section, dns_name_t **name,
- 	       dns_rdata_t *rdata, dns_rdatatype_t *covers,
- 	       dns_ttl_t *ttl, dns_rdataclass_t *update_class)
- {
-@@ -1430,7 +1432,7 @@ get_current_rr(dns_message_t *msg, dns_section_t section,
- 	dns_rdataset_current(rdataset, rdata);
- 	INSIST(dns_rdataset_next(rdataset) == ISC_R_NOMORE);
- 	*update_class = rdata->rdclass;
-	rdata->rdclass = zoneclass;
-+	rdata->rdclass = dns_rdataclass_in;
- }
- 
- /*%
-@@ -1580,7 +1582,7 @@ send_update_event(ns_client_t *client, dns_zone_t *zone) {
- 		dns_rdata_t rdata = DNS_RDATA_INIT;
- 		dns_ttl_t ttl;
- 		dns_rdataclass_t update_class;
-		get_current_rr(request, DNS_SECTION_UPDATE, zoneclass,
-+		get_current_rr(request, DNS_SECTION_UPDATE,
- 			       &name, &rdata, &covers, &ttl, &update_class);
- 
- 		if (! dns_name_issubdomain(name, zonename))
-@@ -1812,6 +1814,9 @@ send_update_event(ns_client_t *client, dns_zone_t *zone) {
- 		CHECK(DNS_R_DROP);
- 	}
- 
-+	/* Updates are only supported for class IN. */
-+	INSIST(dns_zone_getclass(zone) == dns_rdataclass_in);
-+
- 	event = (update_event_t *)
- 		isc_event_allocate(client->mctx, client, DNS_EVENT_UPDATE,
- 				   update_action, NULL, sizeof(*event));
-@@ -2798,7 +2803,6 @@ update_action(isc_task_t *task, isc_event_t *event) {
- 	isc_mem_t *mctx = client->mctx;
- 	dns_rdatatype_t covers;
- 	dns_message_t *request = client->message;
-	dns_rdataclass_t zoneclass;
- 	dns_name_t *zonename = NULL;
- 	dns_ssutable_t *ssutable = NULL;
- 	dns_fixedname_t tmpnamefixed;
-@@ -2819,10 +2823,10 @@ update_action(isc_task_t *task, isc_event_t *event) {
- 
- 	CHECK(dns_zone_getdb(zone, &db));
- 	zonename = dns_db_origin(db);
-	zoneclass = dns_db_class(db);
- 	dns_zone_getssutable(zone, &ssutable);
- 	options = dns_zone_getoptions(zone);
- 
-+	INSIST(dns_zone_getclass(zone) == dns_rdataclass_in);
- 	/*
- 	 * Get old and new versions now that queryacl has been checked.
- 	 */
-@@ -2843,8 +2847,8 @@ update_action(isc_task_t *task, isc_event_t *event) {
- 		dns_rdataclass_t update_class;
- 		bool flag;
- 
-		get_current_rr(request, DNS_SECTION_PREREQUISITE, zoneclass,
-			       &name, &rdata, &covers, &ttl, &update_class);
-+		get_current_rr(request, DNS_SECTION_PREREQUISITE, &name, &rdata,
-+			       &covers, &ttl, &update_class);
- 
- 		if (ttl != 0)
- 			PREREQFAILC(DNS_R_FORMERR,
-@@ -2902,7 +2906,7 @@ update_action(isc_task_t *task, isc_event_t *event) {
- 						     "satisfied");
- 				}
- 			}
-		} else if (update_class == zoneclass) {
-+		} else if (update_class == dns_rdataclass_in) {
- 			/* "temp<rr.name, rr.type> += rr;" */
- 			result = temp_append(&temp, name, &rdata);
- 			if (result != ISC_R_SUCCESS) {
-@@ -2960,11 +2964,10 @@ update_action(isc_task_t *task, isc_event_t *event) {
- 		dns_rdataclass_t update_class;
- 		bool flag;
- 
-		get_current_rr(request, DNS_SECTION_UPDATE, zoneclass,
-			       &name, &rdata, &covers, &ttl, &update_class);
-
-		if (update_class == zoneclass) {
-+		get_current_rr(request, DNS_SECTION_UPDATE, &name,
-+			       &rdata, &covers, &ttl, &update_class);
- 
-+		if (update_class == dns_rdataclass_in) {
- 			/*
- 			 * RFC1123 doesn't allow MF and MD in master zones.
- 			 */
-diff --git a/bin/tests/system/unknown/tests.sh b/bin/tests/system/unknown/tests.sh
-index deb9a419ab..a6ceb7c69b 100644
--- a/bin/tests/system/unknown/tests.sh
-+++ b/bin/tests/system/unknown/tests.sh
-@@ -73,8 +73,8 @@ echo_i "querying for various representations of a CLASS10 TYPE1 record"
- for i in 1 2
- do
- 	ret=0
-	$DIG +short $DIGOPTS @10.53.0.1 a$i.example a class10 > dig.out || ret=1
-	echo '\# 4 0A000001' | $DIFF - dig.out || ret=1
-+	$DIG $DIGOPTS @10.53.0.1 a$i.example a class10 > dig.out || ret=1
-+        grep -q "NOTIMP" dig.out || ret=1
- 	if [ $ret != 0 ]
- 	then
- 		echo_i "#$i failed"
-@@ -86,8 +86,8 @@ echo_i "querying for various representations of a CLASS10 TXT record"
- for i in 1 2 3 4
- do
- 	ret=0
-	$DIG +short $DIGOPTS @10.53.0.1 txt$i.example txt class10 > dig.out || ret=1
-	echo '"hello"' | $DIFF - dig.out || ret=1
-+	$DIG $DIGOPTS @10.53.0.1 txt$i.example txt class10 > dig.out || ret=1
-+        grep -q "NOTIMP" dig.out || ret=1
- 	if [ $ret != 0 ]
- 	then
- 		echo_i "#$i failed"
-@@ -99,8 +99,8 @@ echo_i "querying for various representations of a CLASS10 TYPE123 record"
- for i in 1 2
- do
- 	ret=0
-	$DIG +short $DIGOPTS @10.53.0.1 unk$i.example type123 class10 > dig.out || ret=1
-	echo '\# 1 00' | $DIFF - dig.out || ret=1
-+	$DIG $DIGOPTS @10.53.0.1 unk$i.example type123 class10 > dig.out || ret=1
-+        grep -q "NOTIMP" dig.out || ret=1
- 	if [ $ret != 0 ]
- 	then
- 		echo_i "#$i failed"
-diff --git a/lib/dns/adb.c b/lib/dns/adb.c
-index e12c804f2b..25cfa32873 100644
--- a/lib/dns/adb.c
-+++ b/lib/dns/adb.c
-@@ -892,7 +892,7 @@ import_rdataset(dns_adbname_t *adbname, dns_rdataset_t *rdataset,
- 	INSIST(DNS_ADB_VALID(adb));
- 
- 	rdtype = rdataset->type;
-	INSIST((rdtype == dns_rdatatype_a) || (rdtype == dns_rdatatype_aaaa));
-+	REQUIRE(rdtype == dns_rdatatype_a || rdtype == dns_rdatatype_aaaa);
- 	if (rdtype == dns_rdatatype_a)
- 		findoptions = DNS_ADBFIND_INET;
- 	else
-diff --git a/lib/dns/message.c b/lib/dns/message.c
-index 5603bcadf9..f9e3163d71 100644
--- a/lib/dns/message.c
-+++ b/lib/dns/message.c
-@@ -1179,6 +1179,17 @@ getquestions(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
- 		rdtype = isc_buffer_getuint16(source);
- 		rdclass = isc_buffer_getuint16(source);
- 
-+		/*
-+		 * Notify and update messages need to specify the data class.
-+		 */
-+		if ((msg->opcode == dns_opcode_update ||
-+		     msg->opcode == dns_opcode_notify) &&
-+		    (rdclass == dns_rdataclass_none ||
-+		     rdclass == dns_rdataclass_any))
-+		{
-+			DO_ERROR(DNS_R_FORMERR);
-+		}
-+
- 		/*
- 		 * If this class is different than the one we already read,
- 		 * this is an error.
-diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
-index 1c704551aa..5331ea9dd2 100644
--- a/lib/dns/resolver.c
-+++ b/lib/dns/resolver.c
-@@ -6514,9 +6514,16 @@ is_answeraddress_allowed(dns_view_t *view, dns_name_t *name,
- 	}
- 
- 	/*
-	 * Otherwise, search the filter list for a match for each address
-	 * record.  If a match is found, the address should be filtered,
-	 * so should the entire answer.
-+	 * deny-answer-address doesn't apply to non-IN classes.
-+	 */
-+	if (rdataset->rdclass != dns_rdataclass_in) {
-+		return true;
-+	}
-+
-+	/*
-+	 * Otherwise, search the filter list for a match for each
-+	 * address record.  If a match is found, the address should be
-+	 * filtered, so should the entire answer.
- 	 */
- 	for (result = dns_rdataset_first(rdataset);
- 	     result == ISC_R_SUCCESS;
-- 
-2.54.0
-
--- a/SOURCES/bind-9.11-d-max-records-checkconf.patch
+++ b/SOURCES/bind-9.11-d-max-records-checkconf.patch
@ -1,61 +0,0 @@
-From 83f283c3aeae99570c9e4c20f10e92ba565fc4be Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Tue, 7 Oct 2025 16:18:03 +0200
-Subject: [PATCH] Implement settings limits also in named-checkconf
-
-Read and parse max-records-per-type and max-types-per-name options in
-case -z parameter is passed.
---
- bin/check/named-checkconf.c | 27 +++++++++++++++++++++++++--
- 1 file changed, 25 insertions(+), 2 deletions(-)
-
-diff --git a/bin/check/named-checkconf.c b/bin/check/named-checkconf.c
-index e5afd52..42ef76c 100644
--- a/bin/check/named-checkconf.c
-+++ b/bin/check/named-checkconf.c
-@@ -415,6 +415,24 @@ configure_zone(const char *vclass, const char *view,
- 	return (result);
- }
- 
-+/* Red Hat 9.11 specific extension. */
-+static void
-+configure_maxrecords(const cfg_obj_t *voptions)
-+{
-+	cfg_obj_t *obj;
-+	isc_result_t result;
-+
-+	obj = NULL;
-+	result = cfg_map_get(voptions, "max-records-per-type", &obj);
-+	if (result == ISC_R_SUCCESS)
-+		dns_db_setmaxrrperset(cfg_obj_asuint32(obj));
-+
-+	obj = NULL;
-+	result = cfg_map_get(voptions, "max-types-per-name", &obj);
-+	if (result == ISC_R_SUCCESS)
-+		dns_db_setmaxtypepername(cfg_obj_asuint32(obj));
-+}
-+
- /*% configure a view */
- static isc_result_t
- configure_view(const char *vclass, const char *view, const cfg_obj_t *config,
-@@ -431,10 +449,15 @@ configure_view(const char *vclass, const char *view, const cfg_obj_t *config,
- 		voptions = cfg_tuple_get(vconfig, "options");
- 
- 	zonelist = NULL;
-	if (voptions != NULL)
-+	if (voptions != NULL) {
- 		(void)cfg_map_get(voptions, "zone", &zonelist);
-	else
-+		configure_maxrecords(voptions);
-+	} else {
- 		(void)cfg_map_get(config, "zone", &zonelist);
-+		tresult = cfg_map_get(config, "options", &voptions);
-+		if (tresult == ISC_R_SUCCESS)
-+			configure_maxrecords(voptions);
-+	}
- 
- 	for (element = cfg_list_first(zonelist);
- 	     element != NULL;
-- 
-2.51.0
-
--- a/SOURCES/bind-9.11-d-max-records-per-type.patch
+++ b/SOURCES/bind-9.11-d-max-records-per-type.patch
@ -1,250 +0,0 @@
-From e0238189d03dc0a6b6092180ba52e74a26816422 Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Thu, 10 Jul 2025 17:31:35 +0200
-Subject: [PATCH] Minimalistic support for max-records-per-type option
-
-Just propagate the number to rbtdb in addition to environment. Make
-environment preferred of both used, because default configuration value
-would override already changed default.
-
-Allow also 0 value from the environment.
---
- bin/named/config.c              |  1 +
- bin/named/named.conf.docbook    |  1 +
- bin/named/server.c              |  9 +++++++++
- doc/arm/Bv9ARM-book.xml         | 18 ++++++++++++++++++
- lib/dns/db.c                    |  6 +++++-
- lib/dns/include/dns/db.h        | 10 ++++++++++
- lib/dns/include/dns/rdataslab.h |  6 ++++++
- lib/dns/rbtdb.c                 | 18 +++++++++++++++++-
- lib/dns/rbtdb.h                 | 10 ++++++++++
- lib/dns/rbtdb64.h               |  3 +++
- lib/isccfg/namedconf.c          |  1 +
- 11 files changed, 81 insertions(+), 2 deletions(-)
-
-diff --git a/bin/named/config.c b/bin/named/config.c
-index e3731cf..27cf9ee 100644
--- a/bin/named/config.c
-+++ b/bin/named/config.c
-@@ -243,6 +243,7 @@ options {\n\
- #	max-ixfr-log-size <obsolete>\n\
- 	max-journal-size unlimited;\n\
- 	max-records 0;\n\
-+	max-records-per-type 100;\n\
- 	max-refresh-time 2419200; /* 4 weeks */\n\
- 	max-retry-time 1209600; /* 2 weeks */\n\
- 	max-transfer-idle-in 60;\n\
-diff --git a/bin/named/named.conf.docbook b/bin/named/named.conf.docbook
-index 31fac33..d7934c7 100644
--- a/bin/named/named.conf.docbook
-+++ b/bin/named/named.conf.docbook
-@@ -338,6 +338,7 @@ options {
- 	max-journal-size ( unlimited | <replaceable>sizeval</replaceable> );
- 	max-ncache-ttl <replaceable>integer</replaceable>;
- 	max-records <replaceable>integer</replaceable>;
-+	max-records-per-type <replaceable>integer</replaceable>;
- 	max-recursion-depth <replaceable>integer</replaceable>;
- 	max-recursion-queries <replaceable>integer</replaceable>;
- 	max-refresh-time <replaceable>integer</replaceable>;
-diff --git a/bin/named/server.c b/bin/named/server.c
-index afdc4fa..2e88df7 100644
--- a/bin/named/server.c
-+++ b/bin/named/server.c
-@@ -4606,6 +4606,15 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
- 					cfg_obj_asuint32(obj),
- 					max_clients_per_query);
- 
-+	/*
-+	 * This is used for the cache and also as a default value
-+	 * for zone databases.
-+	 */
-+	obj = NULL;
-+	result = ns_config_get(maps, "max-records-per-type", &obj);
-+	INSIST(result == ISC_R_SUCCESS);
-+	dns_db_setmaxrrperset(cfg_obj_asuint32(obj));
-+
- 	obj = NULL;
- 	result = ns_config_get(maps, "max-recursion-depth", &obj);
- 	INSIST(result == ISC_R_SUCCESS);
-diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
-index 563dced..25acad0 100644
--- a/doc/arm/Bv9ARM-book.xml
-+++ b/doc/arm/Bv9ARM-book.xml
-@@ -8318,6 +8318,24 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
- 	      </listitem>
- 	    </varlistentry>
- 
-+	    <varlistentry>
-+	      <term><command>max-records-per-type</command></term>
-+	      <listitem>
-+		<para>
-+		This sets the maximum number of resource records that can be stored
-+		in an RRset in a database. Can be configured in <option>options</option>,
-+		only.
-+		</para>
-+
-+		<para>
-+		   If set to a positive value, any attempt to cache or to add to a zone
-+		   an RRset with more than the specified number of records will result in
-+		   a failure.  If set to 0, there is no cap on RRset size.  The default is
-+		   <literal>100</literal>.
-+		</para>
-+	      </listitem>
-+	    </varlistentry>
-+
- 	    <varlistentry>
- 	      <term><command>recursive-clients</command></term>
- 	      <listitem>
-diff --git a/lib/dns/db.c b/lib/dns/db.c
-index c581646..9e7632a 100644
--- a/lib/dns/db.c
-+++ b/lib/dns/db.c
-@@ -1130,7 +1130,6 @@ dns_db_nodefullname(dns_db_t *db, dns_dbnode_t *node, dns_name_t *name) {
- 		return (ISC_R_NOTIMPLEMENTED);
- 	return ((db->methods->nodefullname)(db, node, name));
- }
-
- isc_result_t
- dns_db_setservestalettl(dns_db_t *db, dns_ttl_t ttl)
- {
-@@ -1152,3 +1151,8 @@ dns_db_getservestalettl(dns_db_t *db, dns_ttl_t *ttl)
- 		return ((db->methods->getservestalettl)(db, ttl));
- 	return (ISC_R_NOTIMPLEMENTED);
- }
-+void
-+dns_db_setmaxrrperset(uint32_t maxrrperset) {
-+	dns_rbtdb_setmaxrrperset(maxrrperset);
-+	dns_rbtdb64_setmaxrrperset(maxrrperset);
-+}
-diff --git a/lib/dns/include/dns/db.h b/lib/dns/include/dns/db.h
-index 452770f..6357bfd 100644
--- a/lib/dns/include/dns/db.h
-+++ b/lib/dns/include/dns/db.h
-@@ -1718,6 +1718,16 @@ dns_db_getservestalettl(dns_db_t *db, dns_ttl_t *ttl);
-  * \li	#ISC_R_NOTIMPLEMENTED - Not supported by this DB implementation.
-  */
- 
-+void
-+dns_db_setmaxrrperset(uint32_t maxrrperset);
-+/*%<
-+ *     Sets the maximum number of records per rrset permitted in a database.
-+ *     0 implies unlimited.
-+ *
-+ * Returns:
-+ *\li  void
-+ */
-+
- ISC_LANG_ENDDECLS
- 
- #endif /* DNS_DB_H */
-diff --git a/lib/dns/include/dns/rdataslab.h b/lib/dns/include/dns/rdataslab.h
-index f38d539..40c40a8 100644
--- a/lib/dns/include/dns/rdataslab.h
-+++ b/lib/dns/include/dns/rdataslab.h
-@@ -173,6 +173,12 @@ dns_rdataslab_equalx(unsigned char *slab1, unsigned char *slab2,
-  *\li	true if the slabs are equal, #false otherwise.
-  */
- 
-+void
-+dns_rdataslab_setmaxrrperset(uint32_t maxrrperset);
-+/*%<
-+ * Set global limit of max-records-per-type value.
-+ */
-+
- ISC_LANG_ENDDECLS
- 
- #endif /* DNS_RDATASLAB_H */
-diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
-index 5263e7c..388ffdf 100644
--- a/lib/dns/rbtdb.c
-+++ b/lib/dns/rbtdb.c
-@@ -981,6 +981,7 @@ static bool match_header_version(rbtdb_file_header_t *header);
- /* Pad to 32 bytes */
- static char FILE_VERSION[32] = "\0";
- 
-+
- /*%
-  * 'init_count' is used to initialize 'newheader->count' which inturn
-  * is used to determine where in the cycle rrset-order cyclic starts.
-@@ -6321,6 +6322,19 @@ update_recordsandbytes(bool add, rbtdb_version_t *rbtversion,
- #endif /* DNS_RBTDB_MAX_RTYPES */
- 
- static uint32_t dns_g_rbtdb_max_rtypes = DNS_RBTDB_MAX_RTYPES;
-+static bool     dns_g_rbtdb_max_rtypes_fromenv = false;
-+void
-+#ifdef DNS_RBTDB_VERSION64
-+dns_rbtdb64_setmaxtypepername(uint32_t maxrrperset)
-+#else
-+dns_rbtdb_setmaxtypepername(uint32_t maxrrperset)
-+#endif
-+{
-+	if (!dns_g_rbtdb_max_rtypes_fromenv) {
-+		/* Make environment override configuration to avoid resetting to default value. */
-+		dns_g_rbtdb_max_rtypes = maxrrperset;
-+	}
-+}
- 
- static void
- init_max_rtypes(void) {
-@@ -6329,8 +6343,10 @@ init_max_rtypes(void) {
- 	if (max) {
- 		char *endp = NULL;
- 		long l = strtol(max, &endp, 10);
-		if (max != endp && endp && !*endp && l >= 0)
-+		if (max != endp && endp && !*endp) {
- 			dns_g_rbtdb_max_rtypes = l;
-+			dns_g_rbtdb_max_rtypes_fromenv = true;
-+		}
- 	}
- }
- 
-diff --git a/lib/dns/rbtdb.h b/lib/dns/rbtdb.h
-index cd84b5b..4f2d890 100644
--- a/lib/dns/rbtdb.h
-+++ b/lib/dns/rbtdb.h
-@@ -45,6 +45,16 @@ dns_rbtdb_create(isc_mem_t *mctx, dns_name_t *base, dns_dbtype_t type,
-  * \li argc == 0 or argv[0] is a valid memory context.
-  */
- 
-+void
-+dns_rbtdb_setmaxtypepername(uint32_t value);
-+/*%<
-+ *     Set the maximum permissible number of RR types per owner name.
-+ *     0 implies unlimited.
-+ *
-+ * Returns:
-+ *\li  void
-+ */
-+
- ISC_LANG_ENDDECLS
- 
- #endif /* DNS_RBTDB_H */
-diff --git a/lib/dns/rbtdb64.h b/lib/dns/rbtdb64.h
-index 33b0115..77ae5b0 100644
--- a/lib/dns/rbtdb64.h
-+++ b/lib/dns/rbtdb64.h
-@@ -32,6 +32,9 @@ dns_rbtdb64_create(isc_mem_t *mctx, dns_name_t *base, dns_dbtype_t type,
- 		   dns_rdataclass_t rdclass, unsigned int argc, char *argv[],
- 		   void *driverarg, dns_db_t **dbp);
- 
-+void
-+dns_rbtdb64_setmaxtypepername(uint32_t value);
-+
- ISC_LANG_ENDDECLS
- 
- #endif /* DNS_RBTDB64_H */
-diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
-index 667111c..fc46a64 100644
--- a/lib/isccfg/namedconf.c
-+++ b/lib/isccfg/namedconf.c
-@@ -1100,6 +1100,7 @@ options_clauses[] = {
- 	{ "lock-file", &cfg_type_qstringornone, 0 },
- 	{ "managed-keys-directory", &cfg_type_qstring, 0 },
- 	{ "match-mapped-addresses", &cfg_type_boolean, 0 },
-+	{ "max-records-per-type", &cfg_type_uint32, 0 },
- 	{ "max-rsa-exponent-size", &cfg_type_uint32, 0 },
- 	{ "memstatistics", &cfg_type_boolean, 0 },
- 	{ "memstatistics-file", &cfg_type_qstring, 0 },
-- 
-2.50.0
-
--- a/SOURCES/bind-9.11-d-max-types-per-name.patch
+++ b/SOURCES/bind-9.11-d-max-types-per-name.patch
@ -1,196 +0,0 @@
-From ba30ef9b8dbe3dacced19d80a8b27854a794b334 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
-Date: Sat, 25 May 2024 11:46:56 +0200
-Subject: [PATCH] Minimalistic support for max-types-per-name option
-
-Just add support for parsing of value from options to environment
-settable number. Keep environment value preferred, overriding
-configuration file value if present. Should avoid overriding environment
-set value by just default config value.
-
-Allow also value 0 from environment.
---
- bin/named/config.c           |  1 +
- bin/named/named.conf.docbook |  1 +
- bin/named/server.c           |  9 +++++++++
- doc/arm/Bv9ARM-book.xml      | 19 +++++++++++++++++++
- lib/dns/db.c                 | 12 ++++++++++--
- lib/dns/include/dns/db.h     |  9 +++++++++
- lib/dns/rdataslab.c          | 14 +++++++++++++-
- lib/isccfg/namedconf.c       |  1 +
- 8 files changed, 63 insertions(+), 3 deletions(-)
-
-diff --git a/bin/named/config.c b/bin/named/config.c
-index 27cf9ee..c4d44ef 100644
--- a/bin/named/config.c
-+++ b/bin/named/config.c
-@@ -246,6 +246,7 @@ options {\n\
- 	max-records-per-type 100;\n\
- 	max-refresh-time 2419200; /* 4 weeks */\n\
- 	max-retry-time 1209600; /* 2 weeks */\n\
-+	max-types-per-name 100;\n\
- 	max-transfer-idle-in 60;\n\
- 	max-transfer-idle-out 60;\n\
- 	max-transfer-time-in 120;\n\
-diff --git a/bin/named/named.conf.docbook b/bin/named/named.conf.docbook
-index d7934c7..a4b1d76 100644
--- a/bin/named/named.conf.docbook
-+++ b/bin/named/named.conf.docbook
-@@ -348,6 +348,7 @@ options {
- 	max-transfer-idle-out <replaceable>integer</replaceable>;
- 	max-transfer-time-in <replaceable>integer</replaceable>;
- 	max-transfer-time-out <replaceable>integer</replaceable>;
-+	max-types-per-name <replaceable>integer</replaceable>;
- 	max-udp-size <replaceable>integer</replaceable>;
- 	max-zone-ttl ( unlimited | <replaceable>ttlval</replaceable> );
- 	memstatistics <replaceable>boolean</replaceable>;
-diff --git a/bin/named/server.c b/bin/named/server.c
-index 2e88df7..2086e41 100644
--- a/bin/named/server.c
-+++ b/bin/named/server.c
-@@ -4615,6 +4615,15 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
- 	INSIST(result == ISC_R_SUCCESS);
- 	dns_db_setmaxrrperset(cfg_obj_asuint32(obj));
- 
-+	/*
-+	 * This is used for the cache and also as a default value
-+	 * for zone databases.
-+	 */
-+	obj = NULL;
-+	result = ns_config_get(maps, "max-types-per-name", &obj);
-+	INSIST(result == ISC_R_SUCCESS);
-+	dns_db_setmaxtypepername(cfg_obj_asuint32(obj));
-+
- 	obj = NULL;
- 	result = ns_config_get(maps, "max-recursion-depth", &obj);
- 	INSIST(result == ISC_R_SUCCESS);
-diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
-index 25acad0..70fd769 100644
--- a/doc/arm/Bv9ARM-book.xml
-+++ b/doc/arm/Bv9ARM-book.xml
-@@ -8336,6 +8336,25 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
- 	      </listitem>
- 	    </varlistentry>
- 
-+	    <varlistentry>
-+	      <term><command>max-types-per-name</command></term>
-+	      <listitem>
-+		<para>
-+		   This sets the maximum number of resource record types that can be stored
-+		   for a single owner name in a database. Can be configured in <option>options</option>
-+		   only.
-+		</para>
-+
-+		<para>
-+		   If set to a positive value, any attempt to cache or to add to a zone an owner
-+		   name with more than the specified number of resource record types will result
-+		   in a failure.  If set to 0, there is no cap on RR types number.  The default is
-+		   <literal>100</literal>.
-+		</para>
-+	      </listitem>
-+	    </varlistentry>
-+   
-+
- 	    <varlistentry>
- 	      <term><command>recursive-clients</command></term>
- 	      <listitem>
-diff --git a/lib/dns/db.c b/lib/dns/db.c
-index 9e7632a..b0f8960 100644
--- a/lib/dns/db.c
-+++ b/lib/dns/db.c
-@@ -35,6 +35,7 @@
- #include <dns/master.h>
- #include <dns/rdata.h>
- #include <dns/rdataset.h>
-+#include <dns/rdataslab.h>
- #include <dns/rdatasetiter.h>
- #include <dns/result.h>
- 
-@@ -1151,8 +1152,15 @@ dns_db_getservestalettl(dns_db_t *db, dns_ttl_t *ttl)
- 		return ((db->methods->getservestalettl)(db, ttl));
- 	return (ISC_R_NOTIMPLEMENTED);
- }
-+
-+/* Emulation of more complex changes later. */
- void
- dns_db_setmaxrrperset(uint32_t maxrrperset) {
-	dns_rbtdb_setmaxrrperset(maxrrperset);
-	dns_rbtdb64_setmaxrrperset(maxrrperset);
-+	dns_rdataslab_setmaxrrperset(maxrrperset);
-+}
-+
-+void
-+dns_db_setmaxtypepername(uint32_t value) {
-+	dns_rbtdb_setmaxtypepername(value);
-+	dns_rbtdb64_setmaxtypepername(value);
- }
-diff --git a/lib/dns/include/dns/db.h b/lib/dns/include/dns/db.h
-index 6357bfd..f6eae9b 100644
--- a/lib/dns/include/dns/db.h
-+++ b/lib/dns/include/dns/db.h
-@@ -1728,6 +1728,15 @@ dns_db_setmaxrrperset(uint32_t maxrrperset);
-  *\li  void
-  */
- 
-+void
-+dns_db_setmaxtypepername(uint32_t value);
-+/*%<
-+ * Set the maximum permissible number of RR types per owner name.
-+ *
-+ * If 'value' is nonzero, then any subsequent attempt to add an rdataset with a
-+ * RR type that would exceed the number of already stored RR types will return
-+ * ISC_R_NOSPACE.
-+ */
- ISC_LANG_ENDDECLS
- 
- #endif /* DNS_DB_H */
-diff --git a/lib/dns/rdataslab.c b/lib/dns/rdataslab.c
-index 9566f79..8ea9ef4 100644
--- a/lib/dns/rdataslab.c
-+++ b/lib/dns/rdataslab.c
-@@ -121,8 +121,18 @@ fillin_offsets(unsigned char *offsetbase, unsigned int *offsettable,
- #endif /* DNS_RDATASET_MAX_RECORDS */
- 
- static unsigned int dns_g_rdataset_max_records = DNS_RDATASET_MAX_RECORDS;
-+static bool dns_g_rdataset_max_records_fromenv = false;
- static isc_once_t once = ISC_ONCE_INIT;
- 
-+void
-+dns_rdataslab_setmaxrrperset(uint32_t maxrrperset)
-+{
-+	if (!dns_g_rdataset_max_records_fromenv) {
-+		/* Make environment override configuration to avoid resetting to default value. */
-+		dns_g_rdataset_max_records = maxrrperset;
-+	}
-+}
-+
- static void
- init_max_records(void) {
- 	/* Red Hat change, allow setting different max value by environment. */
-@@ -130,8 +140,10 @@ init_max_records(void) {
- 	if (max) {
- 		char *endp = NULL;
- 		long l = strtol(max, &endp, 10);
-		if (max != endp && endp && !*endp && l > 0)
-+		if (max != endp && endp && !*endp) {
- 			dns_g_rdataset_max_records = l;
-+			dns_g_rdataset_max_records_fromenv = true;
-+		}
- 	}
- }
- 
-diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
-index fc46a64..b80bb9c 100644
--- a/lib/isccfg/namedconf.c
-+++ b/lib/isccfg/namedconf.c
-@@ -1102,6 +1102,7 @@ options_clauses[] = {
- 	{ "match-mapped-addresses", &cfg_type_boolean, 0 },
- 	{ "max-records-per-type", &cfg_type_uint32, 0 },
- 	{ "max-rsa-exponent-size", &cfg_type_uint32, 0 },
-+	{ "max-types-per-name", &cfg_type_uint32, 0 },
- 	{ "memstatistics", &cfg_type_boolean, 0 },
- 	{ "memstatistics-file", &cfg_type_qstring, 0 },
- 	{ "multiple-cnames", &cfg_type_boolean, CFG_CLAUSEFLAG_OBSOLETE },
-- 
-2.50.0
-
--- a/SOURCES/bind-9.11-dhcp-time-monotonic.patch
+++ b/SOURCES/bind-9.11-dhcp-time-monotonic.patch
@ -1,171 +0,0 @@
-diff --git a/lib/isc/include/isc/result.h b/lib/isc/include/isc/result.h
-index 0389efa..149cde5 100644
--- a/lib/isc/include/isc/result.h
-+++ b/lib/isc/include/isc/result.h
-@@ -89,7 +89,8 @@
- #define ISC_R_DISCFULL			67	/*%< disc full */
- #define ISC_R_DEFAULT			68	/*%< default */
- #define ISC_R_IPV4PREFIX		69	/*%< IPv4 prefix */
-#define ISC_R_NRESULTS 			70
-+#define ISC_R_TIMESHIFTED               70      /*%< system time changed */
-+#define ISC_R_NRESULTS 			71
- 
- ISC_LANG_BEGINDECLS
- 
-diff --git a/lib/isc/include/isc/util.h b/lib/isc/include/isc/util.h
-index 973c348..cceeb5e 100644
--- a/lib/isc/include/isc/util.h
-+++ b/lib/isc/include/isc/util.h
-@@ -289,6 +289,10 @@ extern void mock_assert(const int result, const char* const expression,
-  * Time
-  */
- #define TIME_NOW(tp) 	RUNTIME_CHECK(isc_time_now((tp)) == ISC_R_SUCCESS)
-+#ifdef CLOCK_BOOTTIME
-+#define TIME_MONOTONIC(tp) 	RUNTIME_CHECK(isc_time_boottime((tp)) == ISC_R_SUCCESS)
-+#endif
-+
- 
- /*%
-  * Alignment
-diff --git a/lib/isc/result.c b/lib/isc/result.c
-index a9db132..f33fc6b 100644
--- a/lib/isc/result.c
-+++ b/lib/isc/result.c
-@@ -105,6 +105,7 @@ static const char *description[ISC_R_NRESULTS] = {
- 	"disc full",				/*%< 67 */
- 	"default",				/*%< 68 */
- 	"IPv4 prefix",				/*%< 69 */
-+	"time changed",                         /*%< 70 */
- };
- 
- static const char *identifier[ISC_R_NRESULTS] = {
-@@ -178,6 +179,7 @@ static const char *identifier[ISC_R_NRESULTS] = {
- 	"ISC_R_DISCFULL",
- 	"ISC_R_DEFAULT",
- 	"ISC_R_IPV4PREFIX",
-+	"ISC_R_TIMESHIFTED",
- };
- 
- #define ISC_RESULT_RESULTSET			2
-diff --git a/lib/isc/unix/app.c b/lib/isc/unix/app.c
-index a6e9882..286fe95 100644
--- a/lib/isc/unix/app.c
-+++ b/lib/isc/unix/app.c
-@@ -442,15 +442,47 @@ isc__app_ctxonrun(isc_appctx_t *ctx0, isc_mem_t *mctx, isc_task_t *task,
- static isc_result_t
- evloop(isc__appctx_t *ctx) {
- 	isc_result_t result;
-+        isc_time_t now;
-+#ifdef CLOCK_BOOTTIME
-+        isc_time_t monotonic;
-+        isc_uint64_t diff  = 0;
-+#else
-+        isc_time_t prev;
-+        TIME_NOW(&prev);
-+#endif
- 
- 	while (!ctx->want_shutdown) {
- 		int n;
-		isc_time_t when, now;
-+		isc_time_t when;
- 		struct timeval tv, *tvp;
- 		isc_socketwait_t *swait;
- 		bool readytasks;
- 		bool call_timer_dispatch = false;
- 
-+                uint64_t us; 
-+
-+#ifdef CLOCK_BOOTTIME
-+                // TBD macros for following three lines
-+                TIME_NOW(&now);
-+                TIME_MONOTONIC(&monotonic);
-+                INSIST(now.seconds > monotonic.seconds)
-+                us = isc_time_microdiff (&now, &monotonic);
-+                if (us < diff){
-+                  us = diff - us;
-+                  if (us > 1000000){ // ignoring shifts less than one second
-+                    return ISC_R_TIMESHIFTED;
-+                  };
-+                  diff = isc_time_microdiff (&now, &monotonic);
-+                } else {
-+                  diff = isc_time_microdiff (&now, &monotonic);
-+                  // not implemented
-+                }
-+#else
-+                TIME_NOW(&now);
-+                if (isc_time_compare (&now, &prev) < 0)
-+                  return ISC_R_TIMESHIFTED;
-+                TIME_NOW(&prev);
-+#endif
- 		/*
- 		 * Check the reload (or suspend) case first for exiting the
- 		 * loop as fast as possible in case:
-@@ -475,7 +507,6 @@ evloop(isc__appctx_t *ctx) {
- 			if (result != ISC_R_SUCCESS)
- 				tvp = NULL;
- 			else {
-				uint64_t us;
- 
- 				TIME_NOW(&now);
- 				us = isc_time_microdiff(&when, &now);
-diff --git a/lib/isc/unix/include/isc/time.h b/lib/isc/unix/include/isc/time.h
-index b864c29..5dd43c9 100644
--- a/lib/isc/unix/include/isc/time.h
-+++ b/lib/isc/unix/include/isc/time.h
-@@ -132,6 +132,26 @@ isc_time_isepoch(const isc_time_t *t);
-  *\li	't' is a valid pointer.
-  */
- 
-+#ifdef CLOCK_BOOTTIME
-+isc_result_t
-+isc_time_boottime(isc_time_t *t);
-+/*%<
-+ * Set 't' to monotonic time from previous boot
-+ * it's not affected by system time change. It also
-+ * includes the time system was suspended
-+ *
-+ * Requires:
-+ *\li	't' is a valid pointer.
-+ *
-+ * Returns:
-+ *
-+ *\li	Success
-+ *\li	Unexpected error
-+ *		Getting the time from the system failed.
-+ */
-+#endif /* CLOCK_BOOTTIME */
-+ 
-+
- isc_result_t
- isc_time_now(isc_time_t *t);
- /*%<
-diff --git a/lib/isc/unix/time.c b/lib/isc/unix/time.c
-index 8edc9df..fe0bb91 100644
--- a/lib/isc/unix/time.c
-+++ b/lib/isc/unix/time.c
-@@ -498,3 +498,25 @@ isc_time_formatISO8601ms(const isc_time_t *t, char *buf, unsigned int len) {
- 			 t->nanoseconds / NS_PER_MS);
- 	}
- }
-+
-+
-+#ifdef CLOCK_BOOTTIME
-+isc_result_t
-+isc_time_boottime(isc_time_t *t) {
-+  struct timespec ts;
-+  
-+  char strbuf[ISC_STRERRORSIZE];
-+
-+  if (clock_gettime (CLOCK_BOOTTIME, &ts) != 0){
-+    isc__strerror(errno, strbuf, sizeof(strbuf));
-+    UNEXPECTED_ERROR(__FILE__, __LINE__, "%s", strbuf);
-+    return (ISC_R_UNEXPECTED);    
-+  }
-+
-+  t->seconds = ts.tv_sec;
-+  t->nanoseconds = ts.tv_nsec;
-+
-+  return (ISC_R_SUCCESS);
-+  
-+};
-+#endif
--- a/SOURCES/bind-9.11-engine-pkcs11.patch
+++ b/SOURCES/bind-9.11-engine-pkcs11.patch
@ -1,27 +0,0 @@
-From 37f89ccfc439f8d86c401d9ae10e94e53b924961 Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Tue, 27 Aug 2019 20:39:59 +0200
-Subject: [PATCH] Do not set engine for native PKCS11
-
-It resets already set lib_path to pkcs11, which is invalid in native
-pkcs11 crypto. Engine has to be path to PKCS#11 module.
---
- bin/named/include/named/globals.h | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/bin/named/include/named/globals.h b/bin/named/include/named/globals.h
-index eda2214..2a611d5 100644
--- a/bin/named/include/named/globals.h
-+++ b/bin/named/include/named/globals.h
-@@ -160,7 +160,7 @@ EXTERN const char *		ns_g_defaultdnstap	INIT(NULL);
- 
- EXTERN const char *		ns_g_username		INIT(NULL);
- 
-#if defined(USE_PKCS11)
-+#if defined(USE_PKCS11) && !defined(PKCS11CRYPTO)
- EXTERN const char *		ns_g_engine		INIT(PKCS11_ENGINE);
- #else
- EXTERN const char *		ns_g_engine		INIT(NULL);
-- 
-2.20.1
-
--- a/SOURCES/bind-9.11-export-suffix.patch
+++ b/SOURCES/bind-9.11-export-suffix.patch
@ -1,39 +0,0 @@
-diff --git a/configure.ac b/configure.ac
-index c1bfd62..7c5ad51 100644
--- a/configure.ac
-+++ b/configure.ac
-@@ -5333,6 +5333,8 @@ AC_SUBST(BUILD_CPPFLAGS)
- AC_SUBST(BUILD_LDFLAGS)
- AC_SUBST(BUILD_LIBS)
- 
-+AC_SUBST(LIBDIR_SUFFIX)
-+
- #
- # Commands to run at the end of config.status.
- # Don't just put these into configure, it won't work right if somebody
-diff --git a/isc-config.sh.in b/isc-config.sh.in
-index b5e94ed..d2857e0 100644
--- a/isc-config.sh.in
-+++ b/isc-config.sh.in
-@@ -13,16 +13,17 @@ prefix=@prefix@
- exec_prefix=@exec_prefix@
- exec_prefix_set=
- includedir=@includedir@
-+libdir_suffix=@LIBDIR_SUFFIX@
- arch=$(uname -m)
- 
- case $arch in
- 	x86_64 | amd64 | sparc64 | s390x | ppc64)
-		libdir=/usr/lib64
-		sec_libdir=/usr/lib
-+		libdir=/usr/lib64${libdir_suffix}
-+		sec_libdir=/usr/lib${libdir_suffix}
- 		;;
- 	* )
-		libdir=/usr/lib
-		sec_libdir=/usr/lib64
-+		libdir=/usr/lib${libdir_suffix}
-+		sec_libdir=/usr/lib64${libdir_suffix}
- 		;;
- esac
- 
--- a/SOURCES/bind-9.11-fips-code-includes.patch
+++ b/SOURCES/bind-9.11-fips-code-includes.patch
@ -1,39 +0,0 @@
-From c928591eb2a3b17c5be0cad56c8e061ebba11a95 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Thu, 20 Dec 2018 11:52:12 +0100
-Subject: [PATCH] Fix implicit declaration warning
-
-isc_md5_available() function is not declared before its use. Include
-header providing it in files that use it.
---
- bin/tests/system/tkey/keydelete.c | 1 +
- lib/dns/tsig.c                    | 1 +
- 2 files changed, 2 insertions(+)
-
-diff --git a/bin/tests/system/tkey/keydelete.c b/bin/tests/system/tkey/keydelete.c
-index 4b5b901..a3dd450 100644
--- a/bin/tests/system/tkey/keydelete.c
-+++ b/bin/tests/system/tkey/keydelete.c
-@@ -21,6 +21,7 @@
- #include <isc/hash.h>
- #include <isc/log.h>
- #include <isc/mem.h>
-+#include <isc/md5.h>
- #include <isc/print.h>
- #include <isc/sockaddr.h>
- #include <isc/socket.h>
-diff --git a/lib/dns/tsig.c b/lib/dns/tsig.c
-index c37b235..7786801 100644
--- a/lib/dns/tsig.c
-+++ b/lib/dns/tsig.c
-@@ -18,6 +18,7 @@
- 
- #include <isc/buffer.h>
- #include <isc/mem.h>
-+#include <isc/md5.h>
- #include <isc/print.h>
- #include <isc/print.h>
- #include <isc/refcount.h>
-- 
-2.26.2
-
--- a/SOURCES/bind-9.11-fips-code.patch
+++ b/SOURCES/bind-9.11-fips-code.patch
--- a/SOURCES/bind-9.11-fips-disable.patch
+++ b/SOURCES/bind-9.11-fips-disable.patch
@ -1,121 +0,0 @@
-From 83b889c238282b210f874a3ad81bb56299767495 Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Mon, 5 Aug 2019 11:54:03 +0200
-Subject: [PATCH] Allow explicit disabling of autodisabled MD5
-
-Default security policy might include explicitly disabled RSAMD5
-algorithm. Current FIPS code automatically disables in FIPS mode. But if
-RSAMD5 is included in security policy, it fails to start, because that
-algorithm is not recognized. Allow it disabled, but fail on any
-other usage.
---
- bin/named/server.c |  4 ++--
- lib/bind9/check.c  |  4 ++++
- lib/dns/rcode.c    | 33 +++++++++++++++------------------
- 3 files changed, 21 insertions(+), 20 deletions(-)
-
-diff --git a/bin/named/server.c b/bin/named/server.c
-index 5b57371..51702ab 100644
--- a/bin/named/server.c
-+++ b/bin/named/server.c
-@@ -1547,12 +1547,12 @@ disable_algorithms(const cfg_obj_t *disabled, dns_resolver_t *resolver) {
- 		r.length = strlen(r.base);
- 
- 		result = dns_secalg_fromtext(&alg, &r);
-		if (result != ISC_R_SUCCESS) {
-+		if (result != ISC_R_SUCCESS && result != ISC_R_DISABLED) {
- 			uint8_t ui;
- 			result = isc_parse_uint8(&ui, r.base, 10);
- 			alg = ui;
- 		}
-		if (result != ISC_R_SUCCESS) {
-+		if (result != ISC_R_SUCCESS && result != ISC_R_DISABLED) {
- 			cfg_obj_log(cfg_listelt_value(element),
- 				    ns_g_lctx, ISC_LOG_ERROR,
- 				    "invalid algorithm");
-diff --git a/lib/bind9/check.c b/lib/bind9/check.c
-index e0803d4..8023784 100644
--- a/lib/bind9/check.c
-+++ b/lib/bind9/check.c
-@@ -302,6 +302,10 @@ disabled_algorithms(const cfg_obj_t *disabled, isc_log_t *logctx) {
- 		r.length = strlen(r.base);
- 
- 		tresult = dns_secalg_fromtext(&alg, &r);
-+		if (tresult == ISC_R_DISABLED) {
-+			// Recognize disabled algorithms, disable it explicitly
-+			tresult = ISC_R_SUCCESS;
-+		}
- 		if (tresult != ISC_R_SUCCESS) {
- 			cfg_obj_log(cfg_listelt_value(element), logctx,
- 				    ISC_LOG_ERROR, "invalid algorithm '%s'",
-diff --git a/lib/dns/rcode.c b/lib/dns/rcode.c
-index f51d548..c49b8d1 100644
--- a/lib/dns/rcode.c
-+++ b/lib/dns/rcode.c
-@@ -126,7 +126,6 @@
- #endif
- 
- #define SECALGNAMES \
-	MD5_SECALGNAMES \
- 	DH_SECALGNAMES \
- 	DSA_SECALGNAMES \
- 	{ DNS_KEYALG_ECC, "ECC", 0 }, \
-@@ -178,6 +177,7 @@ static struct tbl rcodes[] = { RCODENAMES ERCODENAMES };
- static struct tbl tsigrcodes[] = { RCODENAMES TSIGRCODENAMES };
- static struct tbl certs[] = { CERTNAMES };
- static struct tbl secalgs[] = { SECALGNAMES };
-+static struct tbl md5_secalgs[] = { MD5_SECALGNAMES };
- static struct tbl secprotos[] = { SECPROTONAMES };
- static struct tbl hashalgs[] = { HASHALGNAMES };
- static struct tbl dsdigests[] = { DSDIGESTNAMES };
-@@ -358,33 +358,30 @@ dns_cert_totext(dns_cert_t cert, isc_buffer_t *target) {
- 	return (dns_mnemonic_totext(cert, target, certs));
- }
- 
-static inline struct tbl *
-secalgs_tbl_start() {
-	struct tbl *algs = secalgs;
-
-#ifndef PK11_MD5_DISABLE
-	if (!isc_md5_available()) {
-		while (algs->name != NULL &&
-		       algs->value == DNS_KEYALG_RSAMD5)
-			++algs;
-	}
-#endif
-	return algs;
-}
-
- isc_result_t
- dns_secalg_fromtext(dns_secalg_t *secalgp, isc_textregion_t *source) {
- 	unsigned int value;
-+	isc_result_t result;
- 
-	RETERR(dns_mnemonic_fromtext(&value, source,
-	                             secalgs_tbl_start(), 0xff));
-+	result = dns_mnemonic_fromtext(&value, source,
-+	                               secalgs, 0xff);
-+	if (result != ISC_R_SUCCESS) {
-+		result = dns_mnemonic_fromtext(&value, source,
-+	                                       md5_secalgs, 0xff);
-+		if (result != ISC_R_SUCCESS) {
-+			return (result);
-+		} else if (!isc_md5_available()) {
-+			*secalgp = value;
-+			return (ISC_R_DISABLED);
-+		}
-+	}
- 	*secalgp = value;
- 	return (ISC_R_SUCCESS);
- }
- 
- isc_result_t
- dns_secalg_totext(dns_secalg_t secalg, isc_buffer_t *target) {
-	return (dns_mnemonic_totext(secalg, target, secalgs_tbl_start()));
-+	return (dns_mnemonic_totext(secalg, target, secalgs));
- }
- 
- void
-- 
-2.20.1
-
--- a/SOURCES/bind-9.11-fips-tests.patch
+++ b/SOURCES/bind-9.11-fips-tests.patch
--- a/SOURCES/bind-9.11-host-idn-disable.patch
+++ b/SOURCES/bind-9.11-host-idn-disable.patch
@ -1,92 +0,0 @@
-From ec50eff97c259b5bfbfa4e050d69fe7b39b0f15a Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Tue, 25 Sep 2018 18:08:46 +0200
-Subject: [PATCH] Disable IDN from environment as documented
-
-Manual page of host contained instructions to disable IDN processing
-when it was built with libidn2. When refactoring IDN support however,
-support for disabling IDN in host and nslookup was lost. Use also
-environment variable and document it for nslookup, host and dig.
-
-Support variable CHARSET=ASCII to disable IDN, supported in downstream
-RH patch since RHEL 5.
---
- bin/dig/dig.docbook      |  4 +++-
- bin/dig/dighost.c        |  5 +++++
- bin/dig/host.docbook     |  2 +-
- bin/dig/nslookup.docbook | 15 +++++++++++++++
- 4 files changed, 24 insertions(+), 2 deletions(-)
-
-diff --git a/bin/dig/dig.docbook b/bin/dig/dig.docbook
-index 5d19301..933af79 100644
--- a/bin/dig/dig.docbook
-+++ b/bin/dig/dig.docbook
-@@ -1312,7 +1312,9 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
-       reply from the server.
-       If you'd like to turn off the IDN support for some reason, use
-       parameters <parameter>+noidnin</parameter> and
-      <parameter>+noidnout</parameter>.
-+      <parameter>+noidnout</parameter> or define
-+      the <envar>IDN_DISABLE</envar> environment variable.
-+
-     </para>
-   </refsection>
- 
-diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
-index 5eabc1f..73aaab8 100644
--- a/bin/dig/dighost.c
-+++ b/bin/dig/dighost.c
-@@ -826,6 +826,11 @@ make_empty_lookup(void) {
- 	looknew->badcookie = true;
- #ifdef WITH_IDN_SUPPORT
- 	looknew->idnin = isatty(1)?(getenv("IDN_DISABLE") == NULL):false;
-+	if (looknew->idnin) {
-+		const char *charset = getenv("CHARSET");
-+		if (charset && !strcmp(charset, "ASCII"))
-+			looknew->idnin = false;
-+	}
- #else
- 	looknew->idnin = false;
- #endif
-diff --git a/bin/dig/host.docbook b/bin/dig/host.docbook
-index da0f8fb..9689b5a 100644
--- a/bin/dig/host.docbook
-+++ b/bin/dig/host.docbook
-@@ -379,7 +379,7 @@
-       <command>host</command> appropriately converts character encoding of
-       domain name before sending a request to DNS server or displaying a
-       reply from the server.
-      If you'd like to turn off the IDN support for some reason, defines
-+      If you'd like to turn off the IDN support for some reason, define
-       the <envar>IDN_DISABLE</envar> environment variable.
-       The IDN support is disabled if the variable is set when
-       <command>host</command> runs.
-diff --git a/bin/dig/nslookup.docbook b/bin/dig/nslookup.docbook
-index d46fc2d..6d7d181 100644
--- a/bin/dig/nslookup.docbook
-+++ b/bin/dig/nslookup.docbook
-@@ -495,6 +495,21 @@ nslookup -query=hinfo  -timeout=10
-     </para>
-   </refsection>
- 
-+  <refsection><info><title>IDN SUPPORT</title></info>
-+
-+    <para>
-+      If <command>nslookup</command> has been built with IDN (internationalized
-+      domain name) support, it can accept and display non-ASCII domain names.
-+      <command>nslookup</command> appropriately converts character encoding of
-+      domain name before sending a request to DNS server or displaying a
-+      reply from the server.
-+      If you'd like to turn off the IDN support for some reason, define
-+      the <envar>IDN_DISABLE</envar> environment variable.
-+      The IDN support is disabled if the variable is set when
-+      <command>nslookup</command> runs.
-+    </para>
-+  </refsection>
-+
-   <refsection><info><title>FILES</title></info>
- 
-     <para><filename>/etc/resolv.conf</filename>
-- 
-2.20.1
-
--- a/SOURCES/bind-9.11-json-c.patch
+++ b/SOURCES/bind-9.11-json-c.patch
@ -1,50 +0,0 @@
-From cb6d2019766a6c8c5516fd8859cedf0052f03293 Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Thu, 25 Jul 2019 11:37:57 +0200
-Subject: [PATCH] Skip support of jsoncpp
-
-Bind cannot be compiled when jsoncpp-devel is installed. Remove support
-for jsoncpp, use only json-c-devel. Bind 9.15 has already support for
--with-json-c, do not yet introduce it.
---
- configure.ac | 17 ++---------------
- 1 file changed, 2 insertions(+), 15 deletions(-)
-
-diff --git a/configure.ac b/configure.ac
-index 6d05337..5ce83b5 100644
--- a/configure.ac
-+++ b/configure.ac
-@@ -2594,15 +2594,7 @@ case "$use_libjson" in
- 	auto|yes)
- 		for d in /usr /usr/local /opt/local
- 		do
-			if test -f "${d}/include/json/json.h"
-			then
-				if test ${d} != /usr
-				then
-					libjson_cflags="-I ${d}/include"
-					LIBS="$LIBS -L${d}/lib"
-				fi
-				have_libjson="yes"
-			elif test -f "${d}/include/json-c/json.h"
-+			if test -f "${d}/include/json-c/json.h"
- 			then
- 				if test ${d} != /usr
- 				then
-@@ -2615,12 +2607,7 @@ case "$use_libjson" in
- 		done
- 		;;
- 	*)
-		if test -f "${use_libjson}/include/json/json.h"
-		then
-			libjson_cflags="-I${use_libjson}/include"
-			LIBS="$LIBS -L${use_libjson}/lib"
-			have_libjson="yes"
-		elif test -f "${use_libjson}/include/json-c/json.h"
-+		if test -f "${use_libjson}/include/json-c/json.h"
- 		then
- 			libjson_cflags="-I${use_libjson}/include"
- 			LIBS="$LIBS -L${use_libjson}/lib"
-- 
-2.20.1
-
--- a/SOURCES/bind-9.11-kyua-pkcs11.patch
+++ b/SOURCES/bind-9.11-kyua-pkcs11.patch
@ -1,4 +1,4 @@
-From a9b5785f174cf7fd74891fa64f6b69b9a9b55466 Mon Sep 17 00:00:00 2001
+From 1241f2005d08673c28a595c5a6cd61350b95a929 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Tue, 2 Jan 2018 18:13:07 +0100
 Subject: [PATCH] Fix pkcs11 variants atf tests
@ -7,19 +7,16 @@ Add dns-pkcs11 tests Makefile to configure

 Add pkcs11 Kyuafile, fix dh_test to pass in pkcs11 mode
 ---
- configure.ac                     |  1 +
- lib/Kyuafile                     |  2 ++
- lib/dns-pkcs11/tests/Makefile.in | 10 +++++-----
- lib/dns-pkcs11/tests/dh_test.c   |  3 ++-
- lib/isc-pkcs11/tests/Makefile.in |  6 +++---
- lib/isc-pkcs11/tests/hash_test.c | 32 +++++++++++++++++++++++++-------
- 6 files changed, 38 insertions(+), 16 deletions(-)
+ configure.ac                   | 1 +
+ lib/Kyuafile                   | 2 ++
+ lib/dns-pkcs11/tests/dh_test.c | 3 ++-
+ 3 files changed, 5 insertions(+), 1 deletion(-)

 diff --git a/configure.ac b/configure.ac
-index 62ecf56..0940a7d 100644
+index d80ae31..0fb9328 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -5476,6 +5476,7 @@ AC_CONFIG_FILES([
+@@ -3090,6 +3090,7 @@ AC_CONFIG_FILES([
 	lib/dns-pkcs11/include/Makefile
 	lib/dns-pkcs11/include/dns/Makefile
 	lib/dns-pkcs11/include/dst/Makefile
@ -28,7 +25,7 @@ index 62ecf56..0940a7d 100644
 	lib/irs/include/Makefile
 	lib/irs/include/irs/Makefile
 diff --git a/lib/Kyuafile b/lib/Kyuafile
-index 7c8bab0..eec9564 100644
+index 39ce986..037e5ef 100644
 --- a/lib/Kyuafile
 +++ b/lib/Kyuafile
@@ -2,8 +2,10 @@ syntax(2)
@ -38,37 +35,15 @@ index 7c8bab0..eec9564 100644
 +include('dns-pkcs11/Kyuafile')
 include('irs/Kyuafile')
 include('isc/Kyuafile')
-+include('isc-pkcs11/Kyuafile')
 include('isccc/Kyuafile')
 include('isccfg/Kyuafile')
- include('lwres/Kyuafile')
-diff --git a/lib/dns-pkcs11/tests/Makefile.in b/lib/dns-pkcs11/tests/Makefile.in
-index 22a06a8..5df5b15 100644
--- a/lib/dns-pkcs11/tests/Makefile.in
-+++ b/lib/dns-pkcs11/tests/Makefile.in
-@@ -17,12 +17,12 @@ VERSION=@BIND9_VERSION@
- 
- CINCLUDES =	-I. -Iinclude ${DNS_INCLUDES} ${ISC_INCLUDES} \
- 		@DST_OPENSSL_INC@ ${MAXMINDDB_CFLAGS}
-CDEFINES =	@CRYPTO@ -DTESTS="\"${top_builddir}/lib/dns/tests/\""
-+CDEFINES =	@CRYPTO_PK11@ -DTESTS="\"${top_builddir}/lib/dns-pkcs11/tests/\""
- 
-ISCLIBS =	../../isc/libisc.@A@
-ISCDEPLIBS =	../../isc/libisc.@A@
-DNSLIBS =	../libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
-DNSDEPLIBS =	../libdns.@A@
-+ISCLIBS =	../../isc-pkcs11/libisc-pkcs11.@A@
-+ISCDEPLIBS =	../../isc-pkcs11/libisc-pkcs11.@A@
-+DNSLIBS =	../libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
-+DNSDEPLIBS =	../libdns-pkcs11.@A@
- 
- LIBS =		@LIBS@ @CMOCKA_LIBS@
- CFLAGS =	@CFLAGS@ @CMOCKA_CFLAGS@
+ include('ns/Kyuafile')
+include('ns-pkcs11/Kyuafile')
 diff --git a/lib/dns-pkcs11/tests/dh_test.c b/lib/dns-pkcs11/tests/dh_test.c
-index a5bf46c..9ff2b76 100644
+index 934e8fd..658d1af 100644
 --- a/lib/dns-pkcs11/tests/dh_test.c
 +++ b/lib/dns-pkcs11/tests/dh_test.c
-@@ -88,7 +88,8 @@ dh_computesecret(void **state) {
+@@ -87,7 +87,8 @@ dh_computesecret(void **state) {
 	result = dst_key_computesecret(key, key, &buf);
 	assert_int_equal(result, DST_R_NOTPRIVATEKEY);
 	result = key->func->computesecret(key, key, &buf);
@ -78,115 +53,6 @@ index a5bf46c..9ff2b76 100644
 
 	dst_key_free(&key);
 }
-diff --git a/lib/isc-pkcs11/tests/Makefile.in b/lib/isc-pkcs11/tests/Makefile.in
-index 36d2207..00dfbc9 100644
--- a/lib/isc-pkcs11/tests/Makefile.in
-+++ b/lib/isc-pkcs11/tests/Makefile.in
-@@ -16,10 +16,10 @@ VERSION=@BIND9_VERSION@
- @BIND9_MAKE_INCLUDES@
- 
- CINCLUDES =	-I. -Iinclude ${ISC_INCLUDES} @ISC_OPENSSL_INC@
-CDEFINES =	@CRYPTO@ -DTESTS="\"${top_builddir}/lib/isc/tests/\""
-+CDEFINES =	@CRYPTO_PK11@ -DTESTS="\"${top_builddir}/lib/isc-pkcs11/tests/\""
- 
-ISCLIBS =	../libisc.@A@ @ISC_OPENSSL_LIBS@
-ISCDEPLIBS =	../libisc.@A@
-+ISCLIBS =	../libisc-pkcs11.@A@ @ISC_OPENSSL_LIBS@
-+ISCDEPLIBS =	../libisc-pkcs11.@A@
- 
- LIBS =		@LIBS@ @CMOCKA_LIBS@
- CFLAGS =	@CFLAGS@ @CMOCKA_CFLAGS@
-diff --git a/lib/isc-pkcs11/tests/hash_test.c b/lib/isc-pkcs11/tests/hash_test.c
-index 4fafc38..5eb2be2 100644
--- a/lib/isc-pkcs11/tests/hash_test.c
-+++ b/lib/isc-pkcs11/tests/hash_test.c
-@@ -84,7 +84,7 @@ typedef struct hash_testcase {
- 
- typedef struct hash_test_key {
- 	const char *key;
-	const int len;
-+	const unsigned len;
- } hash_test_key_t;
- 
- /* non-hmac tests */
-@@ -955,8 +955,11 @@ isc_hmacsha1_test(void **state) {
- 	hash_test_key_t *test_key = test_keys;
- 
- 	while (testcase->input != NULL && testcase->result != NULL) {
-+		int len = ISC_MAX(test_key->len, ISC_SHA1_DIGESTLENGTH);
-+
-+		memset(buffer, 0, ISC_SHA1_DIGESTLENGTH);
- 		memmove(buffer, test_key->key, test_key->len);
-		isc_hmacsha1_init(&hmacsha1, buffer, test_key->len);
-+		isc_hmacsha1_init(&hmacsha1, buffer, len);
- 		isc_hmacsha1_update(&hmacsha1,
- 				    (const uint8_t *) testcase->input,
- 				    testcase->input_len);
-@@ -1115,8 +1118,11 @@ isc_hmacsha224_test(void **state) {
- 	hash_test_key_t *test_key = test_keys;
- 
- 	while (testcase->input != NULL && testcase->result != NULL) {
-+		int len = ISC_MAX(test_key->len, ISC_SHA224_DIGESTLENGTH);
-+
-+		memset(buffer, 0, ISC_SHA224_DIGESTLENGTH);
- 		memmove(buffer, test_key->key, test_key->len);
-		isc_hmacsha224_init(&hmacsha224, buffer, test_key->len);
-+		isc_hmacsha224_init(&hmacsha224, buffer, len);
- 		isc_hmacsha224_update(&hmacsha224,
- 				      (const uint8_t *) testcase->input,
- 				      testcase->input_len);
-@@ -1276,8 +1282,11 @@ isc_hmacsha256_test(void **state) {
- 	hash_test_key_t *test_key = test_keys;
- 
- 	while (testcase->input != NULL && testcase->result != NULL) {
-+		int len = ISC_MAX(test_key->len, ISC_SHA256_DIGESTLENGTH);
-+
-+		memset(buffer, 0, ISC_SHA256_DIGESTLENGTH);
- 		memmove(buffer, test_key->key, test_key->len);
-		isc_hmacsha256_init(&hmacsha256, buffer, test_key->len);
-+		isc_hmacsha256_init(&hmacsha256, buffer, len);
- 		isc_hmacsha256_update(&hmacsha256,
- 				      (const uint8_t *) testcase->input,
- 				      testcase->input_len);
-@@ -1443,8 +1452,11 @@ isc_hmacsha384_test(void **state) {
- 	hash_test_key_t *test_key = test_keys;
- 
- 	while (testcase->input != NULL && testcase->result != NULL) {
-+		int len = ISC_MAX(test_key->len, ISC_SHA384_DIGESTLENGTH);
-+
-+		memset(buffer, 0, ISC_SHA384_DIGESTLENGTH);
- 		memmove(buffer, test_key->key, test_key->len);
-		isc_hmacsha384_init(&hmacsha384, buffer, test_key->len);
-+		isc_hmacsha384_init(&hmacsha384, buffer, len);
- 		isc_hmacsha384_update(&hmacsha384,
- 				      (const uint8_t *) testcase->input,
- 				      testcase->input_len);
-@@ -1610,8 +1622,11 @@ isc_hmacsha512_test(void **state) {
- 	hash_test_key_t *test_key = test_keys;
- 
- 	while (testcase->input != NULL && testcase->result != NULL) {
-+		int len = ISC_MAX(test_key->len, ISC_SHA512_DIGESTLENGTH);
-+
-+		memset(buffer, 0, ISC_SHA512_DIGESTLENGTH);
- 		memmove(buffer, test_key->key, test_key->len);
-		isc_hmacsha512_init(&hmacsha512, buffer, test_key->len);
-+		isc_hmacsha512_init(&hmacsha512, buffer, len);
- 		isc_hmacsha512_update(&hmacsha512,
- 				      (const uint8_t *) testcase->input,
- 				      testcase->input_len);
-@@ -1754,8 +1769,11 @@ isc_hmacmd5_test(void **state) {
- 	hash_test_key_t *test_key = test_keys;
- 
- 	while (testcase->input != NULL && testcase->result != NULL) {
-+		int len = ISC_MAX(test_key->len, ISC_MD5_DIGESTLENGTH);
-+
-+		memset(buffer, 0, ISC_MD5_DIGESTLENGTH);
- 		memmove(buffer, test_key->key, test_key->len);
-		isc_hmacmd5_init(&hmacmd5, buffer, test_key->len);
-+		isc_hmacmd5_init(&hmacmd5, buffer, len);
- 		isc_hmacmd5_update(&hmacmd5,
- 				   (const uint8_t *) testcase->input,
- 				   testcase->input_len);
 -- 
-2.21.1
+2.20.1

--- a/SOURCES/bind-9.11-oot-manual.patch
+++ b/SOURCES/bind-9.11-oot-manual.patch
@ -1,256 +0,0 @@
-From 8ca95f47231822df2b9c171a4da1e93ca5b748eb Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Wed, 25 Jul 2018 12:24:16 +0200
-Subject: [PATCH] Use make automatic variables to install updated manuals
-
-Make will choose modified manual from build directory or original from source
-directory automagically. Take advantage of install tool feature.
-Install all files in single command instead of iterating on each of them.
---
- bin/check/Makefile.in   |  8 +++++---
- bin/confgen/Makefile.in |  9 +++++----
- bin/delv/Makefile.in    |  6 ++++--
- bin/dig/Makefile.in     |  8 ++++----
- bin/dnssec/Makefile.in  |  6 ++++--
- bin/named/Makefile.in   | 13 +++++++++----
- bin/pkcs11/Makefile.in  |  9 ++++-----
- bin/python/Makefile.in  |  8 ++++----
- bin/tools/Makefile.in   | 25 +++++++++++++++----------
- 9 files changed, 54 insertions(+), 38 deletions(-)
-
-diff --git a/bin/check/Makefile.in b/bin/check/Makefile.in
-index c124e80..1174f8d 100644
--- a/bin/check/Makefile.in
-+++ b/bin/check/Makefile.in
-@@ -83,12 +83,14 @@ installdirs:
- 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
- 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
- 
-install:: named-checkconf@EXEEXT@ named-checkzone@EXEEXT@ installdirs
-+install-man8: ${MANPAGES}
-+	${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man8
-+	(cd ${DESTDIR}${mandir}/man8; rm -f named-compilezone.8; ${LINK_PROGRAM} named-checkzone.8 named-compilezone.8)
-+
-+install:: named-checkconf@EXEEXT@ named-checkzone@EXEEXT@ installdirs install-man8
- 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named-checkconf@EXEEXT@ ${DESTDIR}${sbindir}
- 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named-checkzone@EXEEXT@ ${DESTDIR}${sbindir}
- 	(cd ${DESTDIR}${sbindir}; rm -f named-compilezone@EXEEXT@; ${LINK_PROGRAM} named-checkzone@EXEEXT@ named-compilezone@EXEEXT@)
-	for m in ${MANPAGES}; do ${INSTALL_DATA} ${srcdir}/$$m ${DESTDIR}${mandir}/man8 || exit 1; done
-	(cd ${DESTDIR}${mandir}/man8; rm -f named-compilezone.8; ${LINK_PROGRAM} named-checkzone.8 named-compilezone.8)
- 
- uninstall::
- 	rm -f ${DESTDIR}${mandir}/man8/named-compilezone.8
-diff --git a/bin/confgen/Makefile.in b/bin/confgen/Makefile.in
-index 87f13dd..7865c0c 100644
--- a/bin/confgen/Makefile.in
-+++ b/bin/confgen/Makefile.in
-@@ -95,13 +95,14 @@ installdirs:
- 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
- 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
- 
-install:: rndc-confgen@EXEEXT@ ddns-confgen@EXEEXT@ installdirs
-+install-man8: rndc-confgen.8 ddns-confgen.8
-+	${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man8
-+	(cd ${DESTDIR}${mandir}/man8; rm -f tsig-keygen.8; ${LINK_PROGRAM} ddns-confgen.8 tsig-keygen.8)
-+
-+install:: rndc-confgen@EXEEXT@ ddns-confgen@EXEEXT@ installdirs install-man8
- 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} rndc-confgen@EXEEXT@ ${DESTDIR}${sbindir}
- 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} ddns-confgen@EXEEXT@ ${DESTDIR}${sbindir}
-	${INSTALL_DATA} ${srcdir}/rndc-confgen.8 ${DESTDIR}${mandir}/man8
-	${INSTALL_DATA} ${srcdir}/ddns-confgen.8 ${DESTDIR}${mandir}/man8
- 	(cd ${DESTDIR}${sbindir}; rm -f tsig-keygen@EXEEXT@; ${LINK_PROGRAM} ddns-confgen@EXEEXT@ tsig-keygen@EXEEXT@)
-	(cd ${DESTDIR}${mandir}/man8; rm -f tsig-keygen.8; ${LINK_PROGRAM} ddns-confgen.8 tsig-keygen.8)
- 
- uninstall::
- 	rm -f ${DESTDIR}${mandir}/man8/tsig-keygen.8
-diff --git a/bin/delv/Makefile.in b/bin/delv/Makefile.in
-index e2d2802..19361a8 100644
--- a/bin/delv/Makefile.in
-+++ b/bin/delv/Makefile.in
-@@ -63,10 +63,12 @@ installdirs:
- 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${bindir}
- 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man1
- 
-install:: delv@EXEEXT@ installdirs
-+install-man1: delv.1
-+	${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man1
-+
-+install:: delv@EXEEXT@ installdirs install-man1
- 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} \
- 		delv@EXEEXT@ ${DESTDIR}${bindir}
-	${INSTALL_DATA} ${srcdir}/delv.1 ${DESTDIR}${mandir}/man1
- 
- uninstall::
- 	rm -f ${DESTDIR}${mandir}/man1/delv.1
-diff --git a/bin/dig/Makefile.in b/bin/dig/Makefile.in
-index a9830a9..d7ac0b6 100644
--- a/bin/dig/Makefile.in
-+++ b/bin/dig/Makefile.in
-@@ -91,16 +91,16 @@ installdirs:
- 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${bindir}
- 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man1
- 
-install:: dig@EXEEXT@ host@EXEEXT@ nslookup@EXEEXT@ installdirs
-+install-man1: ${MANPAGES}
-+	${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man1
-+
-+install:: dig@EXEEXT@ host@EXEEXT@ nslookup@EXEEXT@ installdirs install-man1
- 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} \
- 		dig@EXEEXT@ ${DESTDIR}${bindir}
- 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} \
- 		host@EXEEXT@ ${DESTDIR}${bindir}
- 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} \
- 		nslookup@EXEEXT@ ${DESTDIR}${bindir}
-	for m in ${MANPAGES}; do \
-		${INSTALL_DATA} ${srcdir}/$$m ${DESTDIR}${mandir}/man1 || exit 1; \
-	done
- 
- uninstall::
- 	for m in ${MANPAGES}; do \
-diff --git a/bin/dnssec/Makefile.in b/bin/dnssec/Makefile.in
-index 2239ad1..ce0a177 100644
--- a/bin/dnssec/Makefile.in
-+++ b/bin/dnssec/Makefile.in
-@@ -110,9 +110,11 @@ installdirs:
- 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
- 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
- 
-install:: ${TARGETS} installdirs
-+install-man8: ${MANPAGES}
-+	${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man8
-+
-+install:: ${TARGETS} installdirs install-man8
- 	for t in ${TARGETS}; do ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} $$t ${DESTDIR}${sbindir} || exit 1; done
-	for m in ${MANPAGES}; do ${INSTALL_DATA} ${srcdir}/$$m ${DESTDIR}${mandir}/man8 || exit 1; done
- 
- uninstall::
- 	for m in ${MANPAGES}; do rm -f ${DESTDIR}${mandir}/man8/$$m || exit 1; done
-diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
-index e1f85a9..d92bc9a 100644
--- a/bin/named/Makefile.in
-+++ b/bin/named/Makefile.in
-@@ -176,12 +176,17 @@ installdirs:
- 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man5
- 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
- 
-install:: named@EXEEXT@ lwresd@EXEEXT@ installdirs
-+install-man5: named.conf.5
-+	${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man5
-+
-+install-man8: named.8 lwresd.8
-+	${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man8
-+
-+install-man: install-man5 install-man8
-+
-+install:: named@EXEEXT@ lwresd@EXEEXT@ installdirs install-man
- 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named@EXEEXT@ ${DESTDIR}${sbindir}
- 	(cd ${DESTDIR}${sbindir}; rm -f lwresd@EXEEXT@; @LN@ named@EXEEXT@ lwresd@EXEEXT@)
-	${INSTALL_DATA} ${srcdir}/named.8 ${DESTDIR}${mandir}/man8
-	${INSTALL_DATA} ${srcdir}/lwresd.8 ${DESTDIR}${mandir}/man8
-	${INSTALL_DATA} ${srcdir}/named.conf.5 ${DESTDIR}${mandir}/man5
- 
- uninstall::
- 	rm -f ${DESTDIR}${mandir}/man5/named.conf.5
-diff --git a/bin/pkcs11/Makefile.in b/bin/pkcs11/Makefile.in
-index ae90616..a058c91 100644
--- a/bin/pkcs11/Makefile.in
-+++ b/bin/pkcs11/Makefile.in
-@@ -71,7 +71,10 @@ installdirs:
- 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
- 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
- 
-install:: ${TARGETS} installdirs
-+install-man8: ${MANPAGES}
-+	${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man8
-+
-+install:: ${TARGETS} installdirs install-man8
- 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} pkcs11-list@EXEEXT@ \
- 		${DESTDIR}${sbindir}
- 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} pkcs11-destroy@EXEEXT@ \
-@@ -80,10 +83,6 @@ install:: ${TARGETS} installdirs
- 		${DESTDIR}${sbindir}
- 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} pkcs11-tokens@EXEEXT@ \
- 		${DESTDIR}${sbindir}
-	${INSTALL_DATA} ${srcdir}/pkcs11-list.8 ${DESTDIR}${mandir}/man8
-	${INSTALL_DATA} ${srcdir}/pkcs11-destroy.8 ${DESTDIR}${mandir}/man8
-	${INSTALL_DATA} ${srcdir}/pkcs11-keygen.8 ${DESTDIR}${mandir}/man8
-	${INSTALL_DATA} ${srcdir}/pkcs11-tokens.8 ${DESTDIR}${mandir}/man8
- 
- uninstall::
- 	rm -f ${DESTDIR}${mandir}/man8/pkcs11-tokens.8
-diff --git a/bin/python/Makefile.in b/bin/python/Makefile.in
-index aa678d4..064c404 100644
--- a/bin/python/Makefile.in
-+++ b/bin/python/Makefile.in
-@@ -47,13 +47,13 @@ installdirs:
- 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
- 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
- 
-install:: ${TARGETS} installdirs
-+install-man8: ${MANPAGES}
-+	${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man8
-+
-+install:: ${TARGETS} installdirs install-man8
- 	${INSTALL_SCRIPT} dnssec-checkds ${DESTDIR}${sbindir}
- 	${INSTALL_SCRIPT} dnssec-coverage ${DESTDIR}${sbindir}
- 	${INSTALL_SCRIPT} dnssec-keymgr ${DESTDIR}${sbindir}
-	${INSTALL_DATA} ${srcdir}/dnssec-checkds.8 ${DESTDIR}${mandir}/man8
-	${INSTALL_DATA} ${srcdir}/dnssec-coverage.8 ${DESTDIR}${mandir}/man8
-	${INSTALL_DATA} ${srcdir}/dnssec-keymgr.8 ${DESTDIR}${mandir}/man8
- 	if test -n "${PYTHON}" ; then \
- 		if test -n "${DESTDIR}" ; then \
- 			${PYTHON} ${srcdir}/setup.py install --root=${DESTDIR} --prefix=${prefix} @PYTHON_INSTALL_LIB@ ; \
-diff --git a/bin/tools/Makefile.in b/bin/tools/Makefile.in
-index 7bf2af4..c395bc7 100644
--- a/bin/tools/Makefile.in
-+++ b/bin/tools/Makefile.in
-@@ -119,17 +119,27 @@ installdirs:
- 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man1
- 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
- 
-nzd:
-+nzd-man: named-nzd2nzf.8
-+	${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man8
-+
-+nzd: nzd-man
- 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named-nzd2nzf@EXEEXT@ \
- 		${DESTDIR}${sbindir}
-	${INSTALL_DATA} ${srcdir}/named-nzd2nzf.8 ${DESTDIR}${mandir}/man8
- 
-dnstap:
-+dnstap-man: dnstap-read.1
-+	${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man1
-+
-+dnstap: dnstap-man
- 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} dnstap-read@EXEEXT@ \
- 		${DESTDIR}${bindir}
-	${INSTALL_DATA} ${srcdir}/dnstap-read.1 ${DESTDIR}${mandir}/man1
- 
-install:: ${TARGETS} installdirs @DNSTAP@ @NZD_TOOLS@
-+install-man1: arpaname.1 named-rrchecker.1 mdig.1
-+	${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man1
-+
-+install-man8: named-journalprint.8 nsec3hash.8
-+	${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man8
-+
-+install:: ${TARGETS} installdirs @DNSTAP@ @NZD_TOOLS@ install-man1 install-man8
- 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} arpaname@EXEEXT@ \
- 		${DESTDIR}${bindir}
- 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named-journalprint@EXEEXT@ \
-@@ -144,13 +154,8 @@ install:: ${TARGETS} installdirs @DNSTAP@ @NZD_TOOLS@
- 		${DESTDIR}${sbindir}
- 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} mdig@EXEEXT@ \
- 		${DESTDIR}${bindir}
-	${INSTALL_DATA} ${srcdir}/arpaname.1 ${DESTDIR}${mandir}/man1
- 	${INSTALL_DATA} ${srcdir}/isc-hmac-fixup.8 ${DESTDIR}${mandir}/man8
-	${INSTALL_DATA} ${srcdir}/named-journalprint.8 ${DESTDIR}${mandir}/man8
-	${INSTALL_DATA} ${srcdir}/named-rrchecker.1 ${DESTDIR}${mandir}/man1
-	${INSTALL_DATA} ${srcdir}/nsec3hash.8 ${DESTDIR}${mandir}/man8
- 	${INSTALL_DATA} ${srcdir}/genrandom.8 ${DESTDIR}${mandir}/man8
-	${INSTALL_DATA} ${srcdir}/mdig.1 ${DESTDIR}${mandir}/man1
- 
- uninstall::
- 	rm -f ${DESTDIR}${mandir}/man1/mdig.1
-- 
-2.14.4
-
--- a/SOURCES/bind-9.11-pk11.patch
+++ b/SOURCES/bind-9.11-pk11.patch
@ -1,27 +0,0 @@
-diff --git a/lib/dns/dst_internal.h b/lib/dns/dst_internal.h
-index 640519a..fc40472 100644
--- a/lib/dns/dst_internal.h
-+++ b/lib/dns/dst_internal.h
-@@ -59,6 +59,9 @@
- #include <openssl/objects.h>
- #include <openssl/rsa.h>
- #endif
-+#if PKCS11CRYPTO
-+#include <pk11/pk11.h>
-+#endif
- 
- ISC_LANG_BEGINDECLS
- 
-diff --git a/lib/isc/include/pk11/internal.h b/lib/isc/include/pk11/internal.h
-index aa8907a..603712a 100644
--- a/lib/isc/include/pk11/internal.h
-+++ b/lib/isc/include/pk11/internal.h
-@@ -13,6 +13,8 @@
- #ifndef PK11_INTERNAL_H
- #define PK11_INTERNAL_H 1
- 
-+#include <pk11/pk11.h>
-+
- /*! \file pk11/internal.h */
- 
- ISC_LANG_BEGINDECLS
--- a/SOURCES/bind-9.11-rh1205168.patch
+++ b/SOURCES/bind-9.11-rh1205168.patch
@ -1,120 +0,0 @@
-From 90416594843a56550e40b11561807786219ce1c4 Mon Sep 17 00:00:00 2001
-From: Evan Hunt <each@isc.org>
-Date: Mon, 11 Sep 2017 15:01:36 -0700
-Subject: [PATCH] remap getaddrinfo() to irs_getgetaddrinfo()
-
-The libirs version of getaddrinfo() cannot be called from within BIND9.
-
-fix prototypes
---
- lib/irs/include/irs/netdb.h.in | 94 ++++++++++++++++++++++++++++++++++++++++++
- 1 file changed, 94 insertions(+)
-
-diff --git a/lib/irs/include/irs/netdb.h.in b/lib/irs/include/irs/netdb.h.in
-index 23dcd37..f36113d 100644
--- a/lib/irs/include/irs/netdb.h.in
-+++ b/lib/irs/include/irs/netdb.h.in
-@@ -150,6 +150,100 @@ struct addrinfo {
- #define	NI_DGRAM	0x00000010
- 
- /*
-+ * Define to map into irs_ namespace.
-+ */
-+
-+#define IRS_NAMESPACE
-+
-+#ifdef IRS_NAMESPACE
-+
-+/*
-+ * Use our versions not the ones from the C library.
-+ */
-+
-+#ifdef getnameinfo
-+#undef getnameinfo
-+#endif
-+#define getnameinfo irs_getnameinfo
-+
-+#ifdef getaddrinfo
-+#undef getaddrinfo
-+#endif
-+#define getaddrinfo irs_getaddrinfo
-+
-+#ifdef freeaddrinfo
-+#undef freeaddrinfo
-+#endif
-+#define freeaddrinfo irs_freeaddrinfo
-+
-+#ifdef gai_strerror
-+#undef gai_strerror
-+#endif
-+#define gai_strerror irs_gai_strerror
-+
-+#endif
-+
-+extern int getaddrinfo (const char *name,
-+			const char *service,
-+			const struct addrinfo *req,
-+			struct addrinfo **pai);
-+extern int getnameinfo (const struct sockaddr *sa,
-+			socklen_t salen, char *host,
-+			socklen_t hostlen, char *serv,
-+			socklen_t servlen, int flags);
-+extern void freeaddrinfo (struct addrinfo *ai);
-+extern const char *gai_strerror (int ecode);
-+
-+/*
-+ * Define to map into irs_ namespace.
-+ */
-+
-+#define IRS_NAMESPACE
-+
-+#ifdef IRS_NAMESPACE
-+
-+/*
-+ * Use our versions not the ones from the C library.
-+ */
-+
-+#ifdef getnameinfo
-+#undef getnameinfo
-+#endif
-+#define getnameinfo irs_getnameinfo
-+
-+#ifdef getaddrinfo
-+#undef getaddrinfo
-+#endif
-+#define getaddrinfo irs_getaddrinfo
-+
-+#ifdef freeaddrinfo
-+#undef freeaddrinfo
-+#endif
-+#define freeaddrinfo irs_freeaddrinfo
-+
-+#ifdef gai_strerror
-+#undef gai_strerror
-+#endif
-+#define gai_strerror irs_gai_strerror
-+
-+int
-+getaddrinfo(const char *hostname, const char *servname,
-+	    const struct addrinfo *hints, struct addrinfo **res);
-+
-+int
-+getnameinfo(const struct sockaddr *sa, IRS_GETNAMEINFO_SOCKLEN_T salen,
-+	    char *host, IRS_GETNAMEINFO_BUFLEN_T hostlen,
-+	    char *serv, IRS_GETNAMEINFO_BUFLEN_T servlen,
-+	    IRS_GETNAMEINFO_FLAGS_T flags);
-+
-+void freeaddrinfo (struct addrinfo *ai);
-+
-+IRS_GAISTRERROR_RETURN_T
-+gai_strerror(int ecode);
-+
-+#endif
-+
-+/*
-  * Tell Emacs to use C mode on this file.
-  * Local variables:
-  * mode: c
-- 
-2.9.5
-
--- a/SOURCES/bind-9.11-rh1410433.patch
+++ b/SOURCES/bind-9.11-rh1410433.patch
@ -1,16 +0,0 @@
-diff --git a/lib/dns/dyndb.c b/lib/dns/dyndb.c
-index 15561ce..e4449b0 100644
--- a/lib/dns/dyndb.c
-+++ b/lib/dns/dyndb.c
-@@ -133,8 +133,11 @@ load_library(isc_mem_t *mctx, const char *filename, const char *instname,
- 		      instname, filename);
- 
- 	flags = RTLD_NOW|RTLD_LOCAL;
-+#if 0
-+	/* Shared global namespace is required for dns-pkcs11 library */
- #if defined(RTLD_DEEPBIND) && !__SANITIZE_ADDRESS__
- 	flags |= RTLD_DEEPBIND;
-+#endif
- #endif
- 
- 	handle = dlopen(filename, flags);
--- a/SOURCES/bind-9.11-rh1666814.patch
+++ b/SOURCES/bind-9.11-rh1666814.patch
@ -0,0 +1,29 @@
+From 0f03071080e7fa68433b322359d46abaca2cc5ad Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
+Date: Wed, 16 Jan 2019 16:27:33 +0100
+Subject: [PATCH] Fix possible crash when loading corrupted file
+
+Some values passes internal triggers by coincidence. Fix the check and
+check also first_node_offset before even passing it further.
+---
+ lib/dns/rbt.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/lib/dns/rbt.c b/lib/dns/rbt.c
+index 5aee5f6..7f2c2d2 100644
+--- a/lib/dns/rbt.c
+++ b/lib/dns/rbt.c
+@@ -945,7 +945,9 @@ dns_rbt_deserialize_tree(void *base_address, size_t filesize,
+ 	rbt->root = (dns_rbtnode_t *)((char *)base_address + header_offset +
+ 				      header->first_node_offset);
+ 
+-	if ((header->nodecount * sizeof(dns_rbtnode_t)) > filesize) {
+	if ((header->nodecount * sizeof(dns_rbtnode_t)) > filesize
+	    || header->first_node_offset > filesize) {
+
+ 		result = ISC_R_INVALIDFILE;
+ 		goto cleanup;
+ 	}
+-- 
+2.31.1
+
--- a/SOURCES/bind-9.11-rh1668682.patch
+++ b/SOURCES/bind-9.11-rh1668682.patch
@ -1,37 +0,0 @@
-From 16c1bd61384e993fef13d7be88fdd34551a2b3ce Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Wed, 23 Jan 2019 20:12:51 +0100
-Subject: [PATCH] Use custom random generator only for bind build
-
-Do not test random entropy on startup when used by DHCP. On most cases
-random entropy is not even used by DHCP. In cases it is (LDAP SSL), fail
-whenever it is not available.
-
-Resolves: rhbz#1668682
---
- lib/dns/openssl_link.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/lib/dns/openssl_link.c b/lib/dns/openssl_link.c
-index 91e87d0..2551b0a 100644
--- a/lib/dns/openssl_link.c
-+++ b/lib/dns/openssl_link.c
-@@ -289,6 +289,7 @@ dst__openssl_init(const char *engine) {
- #endif
- #endif /* !defined(OPENSSL_NO_ENGINE) */
- 
-+#ifdef ISC_PLATFORM_USETHREADS
- 	/* Protect ourselves against unseeded PRNG */
- 	if (RAND_status() != 1) {
- 		FATAL_ERROR(__FILE__, __LINE__,
-@@ -296,6 +297,7 @@ dst__openssl_init(const char *engine) {
- 			    "cannot be initialized (see the `PRNG not "
- 			    "seeded' message in the OpenSSL FAQ)");
- 	}
-+#endif /* ISC_PLATFORM_USETHREADS */
- 
- 	return (ISC_R_SUCCESS);
- 
-- 
-2.20.1
-
--- a/SOURCES/bind-9.11-rh1980757.patch
+++ b/SOURCES/bind-9.11-rh1980757.patch
@ -1,32 +0,0 @@
-From a503519533eb375a5ce1f7566bfc153aac980d87 Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Fri, 9 Jul 2021 20:52:21 +0200
-Subject: [PATCH] Use proper entropy to initialize tsig keyname
-
-Random names used on GSS backed nsupdate can conflict in specific
-situations. That might include starting a lot of machines from
-containers, where they took all similar time to start. PID and timestamp
-would be similar and therefore randomness is quite low. Use entropy to
-generate more random identifier and reduce chance of conflict.
---
- bin/nsupdate/nsupdate.c | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
-index 458aa76..d9e5a2b 100644
--- a/bin/nsupdate/nsupdate.c
-+++ b/bin/nsupdate/nsupdate.c
-@@ -2941,7 +2941,9 @@ start_gssrequest(dns_name_t *master) {
- 
- 	keyname = dns_fixedname_initname(&fkname);
- 
-	isc_random_get(&val);
-+	result = isc_entropy_getdata(entropy, &val, sizeof(val), NULL, 0);
-+	if (result != ISC_R_SUCCESS)
-+		isc_random_get(&val);
- 	result = isc_string_printf(mykeystr, sizeof(mykeystr), "%u.sig-%s",
- 				   val, namestr);
- 	if (result != ISC_R_SUCCESS)
-- 
-2.31.1
-
--- a/SOURCES/bind-9.11-rh2101712.patch
+++ b/SOURCES/bind-9.11-rh2101712.patch
@ -1,232 +0,0 @@
-From fff2960981a3294ac641968a17558c8d7eecf74d Mon Sep 17 00:00:00 2001
-From: Mark Andrews <marka@isc.org>
-Date: Wed, 24 Aug 2022 12:21:50 +1000
-Subject: [PATCH] Have dns_zt_apply lock the zone table
-
-There where a number of places where the zone table should have
-been locked, but wasn't, when dns_zt_apply was called.
-
-Added a isc_rwlocktype_t type parameter to dns_zt_apply and adjusted
-all calls to using it.  Removed locks in callers.
-
-Modified upstream commit for v9_11
---
- bin/named/server.c       | 11 ++++++-----
- bin/named/statschannel.c |  8 ++++----
- lib/dns/include/dns/zt.h |  4 ++--
- lib/dns/tests/zt_test.c  |  3 ++-
- lib/dns/view.c           |  3 ++-
- lib/dns/zt.c             | 34 +++++++++++++++++++---------------
- 6 files changed, 35 insertions(+), 28 deletions(-)
-
-diff --git a/bin/named/server.c b/bin/named/server.c
-index 9826588e6d..0b4b309461 100644
--- a/bin/named/server.c
-+++ b/bin/named/server.c
-@@ -8723,8 +8723,8 @@ load_configuration(const char *filename, ns_server_t *server,
- 		    strcmp(view->name, "_bind") != 0)
- 		{
- 			dns_view_setviewrevert(view);
-			(void)dns_zt_apply(view->zonetable, false,
-					   removed, view);
-+			(void)dns_zt_apply(view->zonetable, isc_rwlocktype_read,
-+					   false, removed, view);
- 		}
- 		dns_view_detach(&view);
- 	}
-@@ -10090,8 +10090,8 @@ add_view_tolist(struct dumpcontext *dctx, dns_view_t *view) {
- 	ISC_LIST_INIT(vle->zonelist);
- 	ISC_LIST_APPEND(dctx->viewlist, vle, link);
- 	if (dctx->dumpzones)
-		result = dns_zt_apply(view->zonetable, true,
-				      add_zone_tolist, dctx);
-+		result = dns_zt_apply(view->zonetable, isc_rwlocktype_read,
-+				      true, add_zone_tolist, dctx);
- 	return (result);
- }
- 
-@@ -11367,7 +11367,8 @@ ns_server_sync(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text) {
- 		for (view = ISC_LIST_HEAD(server->viewlist);
- 		     view != NULL;
- 		     view = ISC_LIST_NEXT(view, link)) {
-			result = dns_zt_apply(view->zonetable, false,
-+			result = dns_zt_apply(view->zonetable,
-+					      isc_rwlocktype_none, false,
- 					      synczone, &cleanup);
- 			if (result != ISC_R_SUCCESS &&
- 			    tresult == ISC_R_SUCCESS)
-diff --git a/bin/named/statschannel.c b/bin/named/statschannel.c
-index 12ab048469..9828df0f4e 100644
--- a/bin/named/statschannel.c
-+++ b/bin/named/statschannel.c
-@@ -1833,8 +1833,8 @@ generatexml(ns_server_t *server, uint32_t flags,
- 		if ((flags & STATS_XML_ZONES) != 0) {
- 			TRY0(xmlTextWriterStartElement(writer,
- 						       ISC_XMLCHAR "zones"));
-			result = dns_zt_apply(view->zonetable, true,
-					      zone_xmlrender, writer);
-+			result = dns_zt_apply(view->zonetable, isc_rwlocktype_read,
-+					      true, zone_xmlrender, writer);
- 			if (result != ISC_R_SUCCESS)
- 				goto error;
- 			TRY0(xmlTextWriterEndElement(writer)); /* /zones */
-@@ -2489,8 +2489,8 @@ generatejson(ns_server_t *server, size_t *msglen,
- 			CHECKMEM(za);
- 
- 			if ((flags & STATS_JSON_ZONES) != 0) {
-				result = dns_zt_apply(view->zonetable, true,
-						      zone_jsonrender, za);
-+				result = dns_zt_apply(view->zonetable, isc_rwlocktype_read,
-+						      true, zone_jsonrender, za);
- 				if (result != ISC_R_SUCCESS) {
- 					goto error;
- 				}
-diff --git a/lib/dns/include/dns/zt.h b/lib/dns/include/dns/zt.h
-index e658e5bb67..94212250da 100644
--- a/lib/dns/include/dns/zt.h
-+++ b/lib/dns/include/dns/zt.h
-@@ -177,11 +177,11 @@ dns_zt_freezezones(dns_zt_t *zt, bool freeze);
-  */
- 
- isc_result_t
-dns_zt_apply(dns_zt_t *zt, bool stop,
-+dns_zt_apply(dns_zt_t *zt, isc_rwlocktype_t lock, bool stop,
- 	     isc_result_t (*action)(dns_zone_t *, void *), void *uap);
- 
- isc_result_t
-dns_zt_apply2(dns_zt_t *zt, bool stop, isc_result_t *sub,
-+dns_zt_apply2(dns_zt_t *zt, isc_rwlocktype_t lock, bool stop, isc_result_t *sub,
- 	      isc_result_t (*action)(dns_zone_t *, void *), void *uap);
- /*%<
-  * Apply a given 'action' to all zone zones in the table.
-diff --git a/lib/dns/tests/zt_test.c b/lib/dns/tests/zt_test.c
-index 3f1e812d60..ee75303a50 100644
--- a/lib/dns/tests/zt_test.c
-+++ b/lib/dns/tests/zt_test.c
-@@ -145,7 +145,8 @@ apply(void **state) {
- 	assert_non_null(view->zonetable);
- 
- 	assert_int_equal(nzones, 0);
-	result = dns_zt_apply(view->zonetable, false, count_zone, &nzones);
-+	result = dns_zt_apply2(view->zonetable, isc_rwlocktype_read, false, NULL,
-+			      count_zone, &nzones);
- 	assert_int_equal(result, ISC_R_SUCCESS);
- 	assert_int_equal(nzones, 1);
- 
-diff --git a/lib/dns/view.c b/lib/dns/view.c
-index f01b4dea0f..bd1ced2863 100644
--- a/lib/dns/view.c
-+++ b/lib/dns/view.c
-@@ -676,7 +676,8 @@ dns_view_dialup(dns_view_t *view) {
- 	REQUIRE(DNS_VIEW_VALID(view));
- 	REQUIRE(view->zonetable != NULL);
- 
-	(void)dns_zt_apply(view->zonetable, false, dialup, NULL);
-+	(void)dns_zt_apply2(view->zonetable, isc_rwlocktype_read, false, NULL,
-+			   dialup, NULL);
- }
- 
- void
-diff --git a/lib/dns/zt.c b/lib/dns/zt.c
-index 3f12e247e0..af65740325 100644
--- a/lib/dns/zt.c
-+++ b/lib/dns/zt.c
-@@ -202,7 +202,8 @@ flush(dns_zone_t *zone, void *uap) {
- static void
- zt_destroy(dns_zt_t *zt) {
- 	if (zt->flush) {
-		(void)dns_zt_apply(zt, false, flush, NULL);
-+		(void)dns_zt_apply(zt, isc_rwlocktype_none,
-+				   false, flush, NULL);
- 	}
- 	isc_refcount_destroy(&zt->references);
- 	dns_rbt_destroy(&zt->table);
-@@ -249,9 +250,7 @@ dns_zt_load(dns_zt_t *zt, bool stop) {
- 
- 	REQUIRE(VALID_ZT(zt));
- 
-	RWLOCK(&zt->rwlock, isc_rwlocktype_read);
-	result = dns_zt_apply(zt, stop, load, NULL);
-	RWUNLOCK(&zt->rwlock, isc_rwlocktype_read);
-+	result = dns_zt_apply2(zt, isc_rwlocktype_read, stop, NULL, load, NULL);
- 	return (result);
- }
- 
-@@ -293,7 +292,7 @@ dns_zt_asyncload2(dns_zt_t *zt, dns_zt_allloaded_t alldone, void *arg,
- 	 * Prevent loads_pending going to zero while kicking off the loads.
- 	 */
- 	zt->loads_pending++;
-	result = dns_zt_apply2(zt, false, NULL, asyncload, &params);
-+	result = dns_zt_apply2(zt, isc_rwlocktype_none, false, NULL, asyncload, &params);
- 	pending = --zt->loads_pending;
- 	if (pending != 0) {
- 		zt->loaddone = alldone;
-@@ -342,9 +341,7 @@ dns_zt_loadnew(dns_zt_t *zt, bool stop) {
- 
- 	REQUIRE(VALID_ZT(zt));
- 
-	RWLOCK(&zt->rwlock, isc_rwlocktype_read);
-	result = dns_zt_apply(zt, stop, loadnew, NULL);
-	RWUNLOCK(&zt->rwlock, isc_rwlocktype_read);
-+	result = dns_zt_apply(zt, isc_rwlocktype_read, stop, loadnew, NULL);
- 	return (result);
- }
- 
-@@ -366,9 +363,7 @@ dns_zt_freezezones(dns_zt_t *zt, bool freeze) {
- 
- 	REQUIRE(VALID_ZT(zt));
- 
-	RWLOCK(&zt->rwlock, isc_rwlocktype_read);
-	result = dns_zt_apply2(zt, false, &tresult, freezezones, &freeze);
-	RWUNLOCK(&zt->rwlock, isc_rwlocktype_read);
-+	result = dns_zt_apply2(zt, isc_rwlocktype_read, false, &tresult, freezezones, &freeze);
- 	if (tresult == ISC_R_NOTFOUND)
- 		tresult = ISC_R_SUCCESS;
- 	return ((result == ISC_R_SUCCESS) ? tresult : result);
-@@ -490,14 +485,14 @@ dns_zt_setviewrevert(dns_zt_t *zt) {
- }
- 
- isc_result_t
-dns_zt_apply(dns_zt_t *zt, bool stop,
-+dns_zt_apply(dns_zt_t *zt, isc_rwlocktype_t lock, bool stop,
- 	     isc_result_t (*action)(dns_zone_t *, void *), void *uap)
- {
-	return (dns_zt_apply2(zt, stop, NULL, action, uap));
-+	return (dns_zt_apply2(zt, lock, stop, NULL, action, uap));
- }
- 
- isc_result_t
-dns_zt_apply2(dns_zt_t *zt, bool stop, isc_result_t *sub,
-+dns_zt_apply2(dns_zt_t *zt, isc_rwlocktype_t lock, bool stop, isc_result_t *sub,
- 	      isc_result_t (*action)(dns_zone_t *, void *), void *uap)
- {
- 	dns_rbtnode_t *node;
-@@ -508,6 +503,10 @@ dns_zt_apply2(dns_zt_t *zt, bool stop, isc_result_t *sub,
- 	REQUIRE(VALID_ZT(zt));
- 	REQUIRE(action != NULL);
- 
-+	if (lock != isc_rwlocktype_none) {
-+		RWLOCK(&zt->rwlock, lock);
-+	}
-+
- 	dns_rbtnodechain_init(&chain, zt->mctx);
- 	result = dns_rbtnodechain_first(&chain, zt->table, NULL, NULL);
- 	if (result == ISC_R_NOTFOUND) {
-@@ -538,8 +537,13 @@ dns_zt_apply2(dns_zt_t *zt, bool stop, isc_result_t *sub,
- 
-  cleanup:
- 	dns_rbtnodechain_invalidate(&chain);
-	if (sub != NULL)
-+	if (sub != NULL) {
- 		*sub = tresult;
-+	}
-+
-+	if (lock != isc_rwlocktype_none) {
-+		RWUNLOCK(&zt->rwlock, lock);
-+	}
- 
- 	return (result);
- }
-- 
-2.37.2
-
--- a/SOURCES/bind-9.11-rh2133889.patch
+++ b/SOURCES/bind-9.11-rh2133889.patch
@ -1,26 +0,0 @@
-From c8f5b31f0637315c1c45d0287f05fcad2250f40f Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Thu, 13 Oct 2022 15:35:46 +0200
-Subject: [PATCH] Add include to rwlocktype_t to dns/zt.h
-
-It got broken as part of bug #2101712 fix. Introduced new definition,
-which passes during bind build, but breaks bind-dyndb-ldap build.
---
- lib/dns/include/dns/zt.h | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/lib/dns/include/dns/zt.h b/lib/dns/include/dns/zt.h
-index 9421225..64c24d6 100644
--- a/lib/dns/include/dns/zt.h
-+++ b/lib/dns/include/dns/zt.h
-@@ -18,6 +18,7 @@
- #include <stdbool.h>
- 
- #include <isc/lang.h>
-+#include <isc/rwlock.h>
- 
- #include <dns/types.h>
- 
-- 
-2.37.3
-
--- a/SOURCES/bind-9.11-rt31459.patch
+++ b/SOURCES/bind-9.11-rt31459.patch
--- a/SOURCES/bind-9.11-rt46047.patch
+++ b/SOURCES/bind-9.11-rt46047.patch
@ -1,780 +0,0 @@
-From af3b530773231f8cff6548e36962ad1f25e38c5d Mon Sep 17 00:00:00 2001
-From: Evan Hunt <each@isc.org>
-Date: Thu, 28 Sep 2017 10:09:22 -0700
-Subject: [PATCH] completed and corrected the crypto-random change
-
-4724.	[func]		By default, BIND now uses the random number
-			functions provided by the crypto library (i.e.,
-			OpenSSL or a PKCS#11 provider) as a source of
-			randomness rather than /dev/random.  This is
-			suitable for virtual machine environments
-			which have limited entropy pools and lack
-			hardware random number generators.
-
-			This can be overridden by specifying another
-			entropy source via the "random-device" option
-			in named.conf, or via the -r command line option;
-			however, for functions requiring full cryptographic
-			strength, such as DNSSEC key generation, this
-			cannot be overridden. In particular, the -r
-			command line option no longer has any effect on
-			dnssec-keygen.
-
-			This can be disabled by building with
-			"configure --disable-crypto-rand".
-			[RT #31459] [RT #46047]
---
- bin/confgen/keygen.c                     | 12 +++---
- bin/dnssec/dnssec-keygen.docbook         | 24 +++++++----
- bin/dnssec/dnssectool.c                  | 12 +++---
- bin/named/client.c                       |  3 +-
- bin/named/config.c                       |  4 +-
- bin/named/controlconf.c                  | 19 +++++---
- bin/named/include/named/server.h         |  2 +
- bin/named/interfacemgr.c                 |  1 +
- bin/named/query.c                        |  1 +
- bin/named/server.c                       | 52 ++++++++++++++--------
- bin/nsupdate/nsupdate.c                  |  4 +-
- bin/tests/system/pipelined/pipequeries.c |  4 +-
- bin/tests/system/tkey/keycreate.c        |  4 +-
- bin/tests/system/tkey/keydelete.c        |  5 +--
- doc/arm/Bv9ARM-book.xml                  | 55 +++++++++++++++++-------
- doc/arm/notes-rh-changes.xml             | 42 ++++++++++++++++++
- doc/arm/notes.xml                        |  1 +
- lib/dns/dst_api.c                        |  4 +-
- lib/dns/include/dst/dst.h                | 14 +++++-
- lib/dns/openssl_link.c                   |  3 +-
- lib/isc/include/isc/entropy.h            | 48 +++++++++++++++------
- lib/isc/include/isc/random.h             | 26 +++++++----
- lib/isccfg/namedconf.c                   |  2 +-
- 23 files changed, 240 insertions(+), 102 deletions(-)
- create mode 100644 doc/arm/notes-rh-changes.xml
-
-diff --git a/bin/confgen/keygen.c b/bin/confgen/keygen.c
-index bd269e7..1ac775f 100644
--- a/bin/confgen/keygen.c
-+++ b/bin/confgen/keygen.c
-@@ -161,17 +161,15 @@ generate_key(isc_mem_t *mctx, const char *randomfile, dns_secalg_t alg,
- 
- 	DO("create entropy context", isc_entropy_create(mctx, &ectx));
- 
-	if (randomfile != NULL && strcmp(randomfile, "keyboard") == 0) {
-		randomfile = NULL;
-		open_keyboard = ISC_ENTROPY_KEYBOARDYES;
-	}
- #ifdef ISC_PLATFORM_CRYPTORANDOM
-	if (randomfile != NULL &&
-	    strcmp(randomfile, ISC_PLATFORM_CRYPTORANDOM) == 0) {
-		randomfile = NULL;
-+	if (randomfile == NULL) {
- 		isc_entropy_usehook(ectx, true);
- 	}
- #endif
-+	if (randomfile != NULL && strcmp(randomfile, "keyboard") == 0) {
-+		randomfile = NULL;
-+		open_keyboard = ISC_ENTROPY_KEYBOARDYES;
-+	}
- 	DO("start entropy source", isc_entropy_usebestsource(ectx,
- 							     &entropy_source,
- 							     randomfile,
-diff --git a/bin/dnssec/dnssec-keygen.docbook b/bin/dnssec/dnssec-keygen.docbook
-index bd19e1d..2c09b30 100644
--- a/bin/dnssec/dnssec-keygen.docbook
-+++ b/bin/dnssec/dnssec-keygen.docbook
-@@ -349,15 +349,23 @@
- 	<term>-r <replaceable class="parameter">randomdev</replaceable></term>
- 	<listitem>
- 	  <para>
-	    Specifies the source of randomness.  If the operating
-	    system does not provide a <filename>/dev/random</filename>
-	    or equivalent device, the default source of randomness
-	    is keyboard input.  <filename>randomdev</filename>
-	    specifies
-+	    Specifies a source of randomness.  Normally, when generating
-+	    DNSSEC keys, this option has no effect; the random number
-+	    generation function provided by the cryptographic library will
-+	    be used.
-+	  </para>
-+	  <para>
-+	    If that behavior is disabled at compile time, however,
-+	    the specified file will be used as entropy source
-+	    for key generation.  <filename>randomdev</filename> is
- 	    the name of a character device or file containing random
-	    data to be used instead of the default.  The special value
-	    <filename>keyboard</filename> indicates that keyboard
-	    input should be used.
-+	    data to be used.  The special value <filename>keyboard</filename>
-+	    indicates that keyboard input should be used.
-+	  </para>
-+	  <para>
-+	    The default is <filename>/dev/random</filename> if the
-+	    operating system provides it or an equivalent device;
-+	    if not, the default source of randomness is keyboard input.
- 	  </para>
- 	</listitem>
-       </varlistentry>
-diff --git a/bin/dnssec/dnssectool.c b/bin/dnssec/dnssectool.c
-index 2a0f9c6..6fcd411 100644
--- a/bin/dnssec/dnssectool.c
-+++ b/bin/dnssec/dnssectool.c
-@@ -241,18 +241,16 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
- 		ISC_LIST_INIT(sources);
- 	}
- 
-+#ifdef ISC_PLATFORM_CRYPTORANDOM
-+	if (randomfile == NULL) {
-+		isc_entropy_usehook(*ectx, true);
-+	}
-+#endif
- 	if (randomfile != NULL && strcmp(randomfile, "keyboard") == 0) {
- 		usekeyboard = ISC_ENTROPY_KEYBOARDYES;
- 		randomfile = NULL;
- 	}
- 
-#ifdef ISC_PLATFORM_CRYPTORANDOM
-	if (randomfile != NULL &&
-	    strcmp(randomfile, ISC_PLATFORM_CRYPTORANDOM) == 0) {
-		randomfile = NULL;
-		isc_entropy_usehook(*ectx, true);
-	}
-#endif
- 	result = isc_entropy_usebestsource(*ectx, &source, randomfile,
- 					   usekeyboard);
- 
-diff --git a/bin/named/client.c b/bin/named/client.c
-index 4a50ad9..4d140e8 100644
--- a/bin/named/client.c
-+++ b/bin/named/client.c
-@@ -1768,7 +1768,8 @@ ns_client_addopt(ns_client_t *client, dns_message_t *message,
- 
- 		isc_buffer_init(&buf, cookie, sizeof(cookie));
- 		isc_stdtime_get(&now);
-		isc_random_get(&nonce);
-+		nonce = ((isc_rng_random(ns_g_server->rngctx) << 16) |
-+			 isc_rng_random(ns_g_server->rngctx));
- 
- 		compute_cookie(client, now, nonce, ns_g_server->secret, &buf);
- 
-diff --git a/bin/named/config.c b/bin/named/config.c
-index 9b343fa..5e663c6 100644
--- a/bin/named/config.c
-+++ b/bin/named/config.c
-@@ -98,7 +98,9 @@ options {\n\
- #	pid-file \"" NS_LOCALSTATEDIR "/run/named/named.pid\"; /* or /lwresd.pid */\n\
- 	port 53;\n\
- 	prefetch 2 9;\n"
-#ifdef PATH_RANDOMDEV
-+#if defined(ISC_PLATFORM_CRYPTORANDOM)
-+"	random-device none;\n"
-+#elif defined(PATH_RANDOMDEV)
- "	random-device \"" PATH_RANDOMDEV "\";\n"
- #endif
- "	recursing-file \"named.recursing\";\n\
-diff --git a/bin/named/controlconf.c b/bin/named/controlconf.c
-index 9fdf49b..42128dc 100644
--- a/bin/named/controlconf.c
-+++ b/bin/named/controlconf.c
-@@ -327,9 +327,10 @@ log_invalid(isccc_ccmsg_t *ccmsg, isc_result_t result) {
- 
- static void
- control_recvmessage(isc_task_t *task, isc_event_t *event) {
-	controlconnection_t *conn;
-	controllistener_t *listener;
-	controlkey_t *key;
-+	controlconnection_t *conn = NULL;
-+	controllistener_t *listener = NULL;
-+	ns_server_t *server = NULL;
-+	controlkey_t *key = NULL;
- 	isccc_sexpr_t *request = NULL;
- 	isccc_sexpr_t *response = NULL;
- 	uint32_t algorithm;
-@@ -340,16 +341,17 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
- 	isc_buffer_t *text;
- 	isc_result_t result;
- 	isc_result_t eresult;
-	isccc_sexpr_t *_ctrl;
-+	isccc_sexpr_t *_ctrl = NULL;
- 	isccc_time_t sent;
- 	isccc_time_t exp;
- 	uint32_t nonce;
-	isccc_sexpr_t *data;
-+	isccc_sexpr_t *data = NULL;
- 
- 	REQUIRE(event->ev_type == ISCCC_EVENT_CCMSG);
- 
- 	conn = event->ev_arg;
- 	listener = conn->listener;
-+	server = listener->controls->server;
- 	algorithm = DST_ALG_UNKNOWN;
- 	secret.rstart = NULL;
- 	text = NULL;
-@@ -462,8 +464,11 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
- 	 * Establish nonce.
- 	 */
- 	if (conn->nonce == 0) {
-		while (conn->nonce == 0)
-			isc_random_get(&conn->nonce);
-+		while (conn->nonce == 0) {
-+			uint16_t r1 = isc_rng_random(server->rngctx);
-+			uint16_t r2 = isc_rng_random(server->rngctx);
-+			conn->nonce = (r1 << 16) | r2;
-+		}
- 		eresult = ISC_R_SUCCESS;
- 	} else
- 		eresult = ns_control_docommand(request, listener->readonly, &text);
-diff --git a/bin/named/include/named/server.h b/bin/named/include/named/server.h
-index 4fd0194..0ba2627 100644
--- a/bin/named/include/named/server.h
-+++ b/bin/named/include/named/server.h
-@@ -20,6 +20,7 @@
- #include <isc/log.h>
- #include <isc/magic.h>
- #include <isc/quota.h>
-+#include <isc/random.h>
- #include <isc/sockaddr.h>
- #include <isc/types.h>
- #include <isc/xml.h>
-@@ -135,6 +136,7 @@ struct ns_server {
- 	char *			lockfile;
- 
- 	uint16_t		transfer_tcp_message_size;
-+	isc_rng_t *		rngctx;
- };
- 
- struct ns_altsecret {
-diff --git a/bin/named/interfacemgr.c b/bin/named/interfacemgr.c
-index 93aac31..e12fad9 100644
--- a/bin/named/interfacemgr.c
-+++ b/bin/named/interfacemgr.c
-@@ -17,6 +17,7 @@
- 
- #include <isc/interfaceiter.h>
- #include <isc/os.h>
-+#include <isc/random.h>
- #include <isc/string.h>
- #include <isc/task.h>
- #include <isc/util.h>
-diff --git a/bin/named/query.c b/bin/named/query.c
-index 58b5914..edf42d2 100644
--- a/bin/named/query.c
-+++ b/bin/named/query.c
-@@ -20,6 +20,7 @@
- #include <isc/mem.h>
- #include <isc/platform.h>
- #include <isc/print.h>
-+#include <isc/random.h>
- #include <isc/rwlock.h>
- #include <isc/serial.h>
- #include <isc/stats.h>
-diff --git a/bin/named/server.c b/bin/named/server.c
-index b2ae57c..cca7fe8 100644
--- a/bin/named/server.c
-+++ b/bin/named/server.c
-@@ -8279,21 +8279,32 @@ load_configuration(const char *filename, ns_server_t *server,
- 	 * Open the source of entropy.
- 	 */
- 	if (first_time) {
-+		const char *randomdev = NULL;
-+		int level = ISC_LOG_ERROR;
- 		obj = NULL;
- 		result = ns_config_get(maps, "random-device", &obj);
-		if (result != ISC_R_SUCCESS) {
-+		if (result == ISC_R_SUCCESS) {
-+			if (!cfg_obj_isvoid(obj)) {
-+				level = ISC_LOG_INFO;
-+				randomdev = cfg_obj_asstring(obj);
-+			}
-+		}
-+		if (randomdev == NULL) {
-+#ifdef ISC_PLATFORM_CRYPTORANDOM
-+			isc_entropy_usehook(ns_g_entropy, true);
-+#else
-+			if ((obj != NULL) && !cfg_obj_isvoid(obj))
-+				level = ISC_LOG_INFO;
- 			isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
-				      NS_LOGMODULE_SERVER, ISC_LOG_INFO,
-+				      NS_LOGMODULE_SERVER, level,
- 				      "no source of entropy found");
-+			if ((obj == NULL) || cfg_obj_isvoid(obj)) {
-+				CHECK(ISC_R_FAILURE);
-+			}
-+#endif
- 		} else {
-			const char *randomdev = cfg_obj_asstring(obj);
-#ifdef ISC_PLATFORM_CRYPTORANDOM
-			if (strcmp(randomdev, ISC_PLATFORM_CRYPTORANDOM) == 0)
-				isc_entropy_usehook(ns_g_entropy, true);
-#else
-			int level = ISC_LOG_ERROR;
- 			result = isc_entropy_createfilesource(ns_g_entropy,
-							      randomdev);
-+			                                      randomdev);
- #ifdef PATH_RANDOMDEV
- 			if (ns_g_fallbackentropy != NULL) {
- 				level = ISC_LOG_INFO;
-@@ -8304,8 +8315,8 @@ load_configuration(const char *filename, ns_server_t *server,
- 					      NS_LOGCATEGORY_GENERAL,
- 					      NS_LOGMODULE_SERVER,
- 					      level,
-					      "could not open entropy source "
-					      "%s: %s",
-+					      "could not open "
-+					      "entropy source %s: %s",
- 					      randomdev,
- 					      isc_result_totext(result));
- 			}
-@@ -8325,7 +8336,6 @@ load_configuration(const char *filename, ns_server_t *server,
- 				}
- 				isc_entropy_detach(&ns_g_fallbackentropy);
- 			}
-#endif
- #endif
- 		}
- 
-@@ -9097,6 +9107,7 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
- 	server->in_roothints = NULL;
- 	server->blackholeacl = NULL;
- 	server->keepresporder = NULL;
-+	server->rngctx = NULL;
- 
- 	/* Must be first. */
- 	CHECKFATAL(dst_lib_init2(ns_g_mctx, ns_g_entropy,
-@@ -9123,6 +9134,9 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
- 	CHECKFATAL(dns_tkeyctx_create(ns_g_mctx, ns_g_entropy,
- 				      &server->tkeyctx),
- 		   "creating TKEY context");
-+	server->rngctx = NULL;
-+	CHECKFATAL(isc_rng_create(ns_g_mctx, ns_g_entropy, &server->rngctx),
-+	           "creating random numbers context");
- 
- 	/*
- 	 * Setup the server task, which is responsible for coordinating
-@@ -9329,7 +9343,8 @@ ns_server_destroy(ns_server_t **serverp) {
- 
- 	if (server->zonemgr != NULL)
- 		dns_zonemgr_detach(&server->zonemgr);
-
-+	if (server->rngctx != NULL)
-+		isc_rng_detach(&server->rngctx);
- 	if (server->tkeyctx != NULL)
- 		dns_tkeyctx_destroy(&server->tkeyctx);
- 
-@@ -13366,10 +13381,10 @@ newzone_cfgctx_destroy(void **cfgp) {
- 
- static isc_result_t
- generate_salt(unsigned char *salt, size_t saltlen) {
-	int i, n;
-+	size_t i, n;
- 	union {
- 		unsigned char rnd[256];
-		uint32_t rnd32[64];
-+		uint16_t rnd16[128];
- 	} rnd;
- 	unsigned char text[512 + 1];
- 	isc_region_t r;
-@@ -13379,9 +13394,10 @@ generate_salt(unsigned char *salt, size_t saltlen) {
- 	if (saltlen > 256U)
- 		return (ISC_R_RANGE);
- 
-	n = (int) (saltlen + sizeof(uint32_t) - 1) / sizeof(uint32_t);
-	for (i = 0; i < n; i++)
-		isc_random_get(&rnd.rnd32[i]);
-+	n = (saltlen + sizeof(uint16_t) - 1) / sizeof(uint16_t);
-+	for (i = 0; i < n; i++) {
-+		rnd.rnd16[i] = isc_rng_random(ns_g_server->rngctx);
-+	}
- 
- 	memmove(salt, rnd.rnd, saltlen);
- 
-diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
-index 7f15cbc..458aa76 100644
--- a/bin/nsupdate/nsupdate.c
-+++ b/bin/nsupdate/nsupdate.c
-@@ -289,9 +289,7 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
- 	}
- 
- #ifdef ISC_PLATFORM_CRYPTORANDOM
-	if (randomfile != NULL &&
-	    strcmp(randomfile, ISC_PLATFORM_CRYPTORANDOM) == 0) {
-		randomfile = NULL;
-+	if (randomfile == NULL) {
- 		isc_entropy_usehook(*ectx, true);
- 	}
- #endif
-diff --git a/bin/tests/system/pipelined/pipequeries.c b/bin/tests/system/pipelined/pipequeries.c
-index 95b65bf..7a81d4e 100644
--- a/bin/tests/system/pipelined/pipequeries.c
-+++ b/bin/tests/system/pipelined/pipequeries.c
-@@ -280,9 +280,7 @@ main(int argc, char *argv[]) {
- 	ectx = NULL;
- 	RUNCHECK(isc_entropy_create(mctx, &ectx));
- #ifdef ISC_PLATFORM_CRYPTORANDOM
-	if (randomfile != NULL &&
-	    strcmp(randomfile, ISC_PLATFORM_CRYPTORANDOM) == 0) {
-		randomfile = NULL;
-+	if (randomfile == NULL) {
- 		isc_entropy_usehook(ectx, true);
- 	}
- #endif
-diff --git a/bin/tests/system/tkey/keycreate.c b/bin/tests/system/tkey/keycreate.c
-index 3236968..4fa77b6 100644
--- a/bin/tests/system/tkey/keycreate.c
-+++ b/bin/tests/system/tkey/keycreate.c
-@@ -255,9 +255,7 @@ main(int argc, char *argv[]) {
- 	ectx = NULL;
- 	RUNCHECK(isc_entropy_create(mctx, &ectx));
- #ifdef ISC_PLATFORM_CRYPTORANDOM
-	if (randomfile != NULL &&
-	    strcmp(randomfile, ISC_PLATFORM_CRYPTORANDOM) == 0) {
-		randomfile = NULL;
-+	if (randomfile == NULL) {
- 		isc_entropy_usehook(ectx, true);
- 	}
- #endif
-diff --git a/bin/tests/system/tkey/keydelete.c b/bin/tests/system/tkey/keydelete.c
-index 43fb6b0..105e151 100644
--- a/bin/tests/system/tkey/keydelete.c
-+++ b/bin/tests/system/tkey/keydelete.c
-@@ -171,6 +171,7 @@ main(int argc, char **argv) {
- 		randomfile = argv[2];
- 		argv += 2;
- 		argc -= 2;
-+		POST(argc);
- 	}
- 	keyname = argv[1];
- 
-@@ -182,9 +183,7 @@ main(int argc, char **argv) {
- 	ectx = NULL;
- 	RUNCHECK(isc_entropy_create(mctx, &ectx));
- #ifdef ISC_PLATFORM_CRYPTORANDOM
-	if (randomfile != NULL &&
-	    strcmp(randomfile, ISC_PLATFORM_CRYPTORANDOM) == 0) {
-		randomfile = NULL;
-+	if (randomfile == NULL) {
- 		isc_entropy_usehook(ectx, true);
- 	}
- #endif
-diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
-index ca98726..1f9df2c 100644
--- a/doc/arm/Bv9ARM-book.xml
-+++ b/doc/arm/Bv9ARM-book.xml
-@@ -5034,22 +5034,45 @@ badresp:1,adberr:0,findfail:0,valfail:0]
- 	    <term><command>random-device</command></term>
- 	    <listitem>
- 	      <para>
-		This specifies a source of entropy to be used by the server.  Entropy is
-		primarily needed
-		for DNSSEC operations, such as TKEY transactions and dynamic
-		update of signed
-		zones.  This option specifies the device (or file) from which
-		to read
-		entropy.  If it is a file, operations requiring entropy will
-		fail when the
-		file has been exhausted.  If <command>random-device</command> is not specified, the default value
-		is
-		<filename>/dev/random</filename>
-		(or equivalent) when present, and none otherwise.  The
-		<command>random-device</command> option takes
-		effect during
-		the initial configuration load at server startup time and
-		is ignored on subsequent reloads.
-+		Specifies a source of entropy to be used by the server.
-+		This is a device or file from which to read entropy.
-+		If it is a file, operations requiring entropy
-+		will fail when the file has been exhausted.
-+	      </para>
-+	      <para>
-+		Entropy is needed for cryptographic operations such as
-+		TKEY transactions, dynamic update of signed zones, and
-+		generation of TSIG session keys. It is also used for
-+		seeding and stirring the pseudo-random number generator,
-+		which is used for less critical functions requiring
-+		randomness such as generation of DNS message transaction
-+		ID's.
-+	      </para>
-+	      <para>
-+		If <command>random-device</command> is not specified, or
-+		if it is set to <literal>none</literal>, entropy will be
-+		read from the random number generation function supplied
-+		by the cryptographic library with which BIND was linked
-+		(i.e.  OpenSSL or a PKCS#11 provider).
-+	      </para>
-+	      <para>
-+		The <command>random-device</command> option takes
-+		effect during the initial configuration load at server
-+		startup time and is ignored on subsequent reloads.
-+	      </para>
-+	      <para>
-+		If BIND is built with
-+		<command>configure --disable-crypto-rand</command>, then
-+		entropy is <emphasis>not</emphasis> sourced from the
-+		cryptographic library. In this case, if
-+		<command>random-device</command> is not specified, the
-+		default value is the system random device,
-+		<filename>/dev/random</filename> or the equivalent.
-+		This default can be overridden with
-+		<command>configure --with-randomdev</command>.
-+		If no system random device exists, then no entropy source
-+		will be configured, and <command>named</command> will only
-+		be able to use pseudo-random numbers.
- 	      </para>
- 	    </listitem>
- 	  </varlistentry>
-diff --git a/doc/arm/notes-rh-changes.xml b/doc/arm/notes-rh-changes.xml
-new file mode 100644
-index 0000000..89a4961
--- /dev/null
-+++ b/doc/arm/notes-rh-changes.xml
-@@ -0,0 +1,42 @@
-+<!--
-+ - Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-+ -
-+ - This Source Code Form is subject to the terms of the Mozilla Public
-+ - License, v. 2.0. If a copy of the MPL was not distributed with this
-+ - file, You can obtain one at http://mozilla.org/MPL/2.0/.
-+ -
-+ - See the COPYRIGHT file distributed with this work for additional
-+ - information regarding copyright ownership.
-+-->
-+
-+<section xml:id="relnotes_rh_changes"><info><title>Red Hat Specific Changes</title></info>
-+  <itemizedlist>
-+     <listitem>
-+      <para>
-+        By default, BIND now uses the random number generation functions
-+        in the cryptographic library (i.e., OpenSSL or a PKCS#11
-+        provider) as a source of high-quality randomness rather than
-+        <filename>/dev/random</filename>.  This is suitable for virtual
-+        machine environments, which may have limited entropy pools and
-+        lack hardware random number generators.
-+      </para>
-+      <para>
-+        This can be overridden by specifying another entropy source via
-+        the <command>random-device</command> option in
-+        <filename>named.conf</filename>, or via the <command>-r</command>
-+        command line option.  However, for functions requiring full
-+        cryptographic strength, such as DNSSEC key generation, this
-+        <emphasis>cannot</emphasis> be overridden. In particular, the
-+        <command>-r</command> command line option no longer has any
-+        effect on <command>dnssec-keygen</command>.
-+      </para>
-+      <para>
-+        This can be disabled by building with
-+        <command>configure --disable-crypto-rand</command>, in which
-+        case <filename>/dev/random</filename> will be the default
-+        entropy source.  [RT #31459] [RT #46047]
-+      </para>
-+    </listitem>
-+  </itemizedlist>
-+</section>
-+
-diff --git a/doc/arm/notes.xml b/doc/arm/notes.xml
-index a5e42c0..f8cb1f9 100644
--- a/doc/arm/notes.xml
-+++ b/doc/arm/notes.xml
-@@ -47,6 +47,7 @@
-   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-9.11.1.xml"/>
-   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-9.11.0.xml"/>
- 
-+  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-rh-changes.xml"/>
-   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-eol.xml"/>
-   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-thankyou.xml"/>
- </section>
-diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c
-index aa54afc..2156384 100644
--- a/lib/dns/dst_api.c
-+++ b/lib/dns/dst_api.c
-@@ -2017,10 +2017,12 @@ dst__entropy_getdata(void *buf, unsigned int len, bool pseudo) {
- 	else
- 		flags |= ISC_ENTROPY_BLOCKING;
- #ifdef ISC_PLATFORM_CRYPTORANDOM
-+	/* get entropy directly from crypto provider */
- 	return (dst_random_getdata(buf, len, NULL, flags));
- #else
-+	/* get entropy from entropy source or hook function */
- 	return (isc_entropy_getdata(dst_entropy_pool, buf, len, NULL, flags));
-#endif
-+#endif /* ISC_PLATFORM_CRYPTORANDOM */
- #endif /* PKCS11CRYPTO */
- }
- 
-diff --git a/lib/dns/include/dst/dst.h b/lib/dns/include/dst/dst.h
-index 3aba028..180c841 100644
--- a/lib/dns/include/dst/dst.h
-+++ b/lib/dns/include/dst/dst.h
-@@ -163,8 +163,18 @@ isc_result_t
- dst_random_getdata(void *data, unsigned int length,
- 		   unsigned int *returned, unsigned int flags);
- /*%<
- * \brief Return data from the crypto random generator.
- * Specialization of isc_entropy_getdata().
-+ * Gets random data from the random generator provided by the
-+ * crypto library, if BIND was built with --enable-crypto-rand.
-+ *
-+ * See isc_entropy_getdata() for parameter usage. Normally when
-+ * this function is available, it will be set up as a hook in the
-+ * entropy context, so that isc_entropy_getdata() is a front-end to
-+ * this function.
-+ *
-+ * Returns:
-+ * \li	ISC_R_SUCCESS on success
-+ * \li	ISC_R_NOTIMPLEMENTED if BIND is built with --disable-crypto-rand
-+ * \li	DST_R_OPENSSLFAILURE, DST_R_CRYPTOFAILURE, or other codes on error
-  */
- 
- bool
-diff --git a/lib/dns/openssl_link.c b/lib/dns/openssl_link.c
-index 3f4f822..cfdc757 100644
--- a/lib/dns/openssl_link.c
-+++ b/lib/dns/openssl_link.c
-@@ -484,7 +484,8 @@ dst__openssl_getengine(const char *engine) {
- 
- isc_result_t
- dst_random_getdata(void *data, unsigned int length,
-		   unsigned int *returned, unsigned int flags) {
-+		   unsigned int *returned, unsigned int flags)
-+{
- #ifdef ISC_PLATFORM_CRYPTORANDOM
- #ifndef DONT_REQUIRE_DST_LIB_INIT
- 	INSIST(dst__memory_pool != NULL);
-diff --git a/lib/isc/include/isc/entropy.h b/lib/isc/include/isc/entropy.h
-index f32c9dc..bed276b 100644
--- a/lib/isc/include/isc/entropy.h
-+++ b/lib/isc/include/isc/entropy.h
-@@ -189,9 +189,8 @@ isc_entropy_createcallbacksource(isc_entropy_t *ent,
- /*!<
-  * \brief Create an entropy source that is polled via a callback.
-  *
- * This would
- * be used when keyboard input is used, or a GUI input method.  It can
- * also be used to hook in any external entropy source.
-+ * This would be used when keyboard input is used, or a GUI input method.
-+ * It can also be used to hook in any external entropy source.
-  *
-  * Samples are added via isc_entropy_addcallbacksample(), below.
-  * _addcallbacksample() is the only function which may be called from
-@@ -232,15 +231,32 @@ isc_result_t
- isc_entropy_getdata(isc_entropy_t *ent, void *data, unsigned int length,
- 		    unsigned int *returned, unsigned int flags);
- /*!<
- * \brief Extract data from the entropy pool.  This may load the pool from various
- * sources.
-+ * \brief Get random data from entropy pool 'ent'.
-  *
- * Do this by stirring the pool and returning a part of hash as randomness.
- * Note that no secrets are given away here since parts of the hash are
- * xored together before returned.
-+ * If a hook has been set up using isc_entropy_sethook() and
-+ * isc_entropy_usehook(), then the hook function will be called to get
-+ * random data.
-  *
- * Honor the request from the caller to only return good data, any data,
- * etc.
-+ * Otherwise, randomness is extracted from the entropy pool set up in BIND.
-+ * This may cause the pool to be loaded from various sources. Ths is done
-+ * by stirring the pool and returning a part of hash as randomness.
-+ * (Note that no secrets are given away here since parts of the hash are
-+ * XORed together before returning.)
-+ *
-+ * 'flags' may contain ISC_ENTROPY_GOODONLY, ISC_ENTROPY_PARTIAL, or
-+ * ISC_ENTROPY_BLOCKING. These will be honored if the hook function is
-+ * not in use. If it is, the flags will be passed to the hook function
-+ * but it may ignore them.
-+ *
-+ * Up to 'length' bytes of randomness are retrieved and copied into 'data'.
-+ * (If 'returned' is not NULL, and the number of bytes copied is less than
-+ * 'length' - which may happen if ISC_ENTROPY_PARTIAL was used - then the
-+ * number of bytes copied will be stored in *returned.)
-+ *
-+ * Returns:
-+ * \li	ISC_R_SUCCESS on success
-+ * \li	ISC_R_NOENTROPY if entropy pool is empty
-+ * \li	other error codes are possible when a hook is in use
-  */
- 
- void
-@@ -305,13 +321,21 @@ isc_entropy_usebestsource(isc_entropy_t *ectx, isc_entropysource_t **source,
- void
- isc_entropy_usehook(isc_entropy_t *ectx, bool onoff);
- /*!<
- * \brief Mark/unmark the given entropy structure as being hooked.
-+ * \brief Configure entropy context 'ectx' to use the hook function
-+ *
-+ * Sets the entropy context to call the hook function for random number
-+ * generation, if such a function has been configured via
-+ * isc_entropy_sethook(), whenever isc_entropy_getdata() is called.
-  */
- 
- void
- isc_entropy_sethook(isc_entropy_getdata_t myhook);
- /*!<
- * \brief Set the getdata hook (e.g., for a crypto random generator).
-+ * \brief Set the hook function.
-+ *
-+ * The hook function is a global value: only one hook function
-+ * can be set in the system. Individual entropy contexts may be
-+ * configured to use it, or not, by calling isc_entropy_usehook().
-  */
- 
- ISC_LANG_ENDDECLS
-diff --git a/lib/isc/include/isc/random.h b/lib/isc/include/isc/random.h
-index f38e80d..3cb1c56 100644
--- a/lib/isc/include/isc/random.h
-+++ b/lib/isc/include/isc/random.h
-@@ -19,13 +19,23 @@
- #include <isc/mutex.h>
- 
- /*! \file isc/random.h
- * \brief Implements a random state pool which will let the caller return a
- * series of possibly non-reproducible random values.
-+ * \brief Implements pseudo random number generators.
-  *
- * Note that the
- * strength of these numbers is not all that high, and should not be
- * used in cryptography functions.  It is useful for jittering values
- * a bit here and there, such as timeouts, etc.
-+ * Two pseudo-random number generators are implemented, in isc_random_*
-+ * and isc_rng_*. Neither one is very strong; they should not be used
-+ * in cryptography functions.
-+ *
-+ * isc_random_* is based on arc4random if it is available on the system.
-+ * Otherwise it is based on the posix srand() and rand() functions.
-+ * It is useful for jittering values a bit here and there, such as
-+ * timeouts, etc, but should not be relied upon to generate
-+ * unpredictable sequences (for example, when choosing transaction IDs).
-+  *
-+ * isc_rng_* is based on ChaCha20, and is seeded and stirred from the
-+ * system entropy source. It is stronger than isc_random_* and can
-+ * be used for generating unpredictable sequences. It is still not as
-+ * good as using system entropy directly (see entropy.h) and should not
-+ * be used for cryptographic functions such as key generation.
-  */
- 
- ISC_LANG_BEGINDECLS
-@@ -113,8 +123,8 @@ isc_rng_random(isc_rng_t *rngctx);
- uint16_t
- isc_rng_uniformrandom(isc_rng_t *rngctx, uint16_t upper_bound);
- /*%<
- * Returns a uniformly distributed pseudo random 16-bit unsigned
- * integer.
-+ * Returns a uniformly distributed pseudo-random 16-bit unsigned integer
-+ * less than 'upper_bound'.
-  */
- 
- ISC_LANG_ENDDECLS
-diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
-index e74c93b..212194e 100644
--- a/lib/isccfg/namedconf.c
-+++ b/lib/isccfg/namedconf.c
-@@ -1109,7 +1109,7 @@ options_clauses[] = {
- 	{ "pid-file", &cfg_type_qstringornone, 0 },
- 	{ "port", &cfg_type_uint32, 0 },
- 	{ "querylog", &cfg_type_boolean, 0 },
-	{ "random-device", &cfg_type_qstring, 0 },
-+	{ "random-device", &cfg_type_qstringornone, 0 },
- 	{ "recursing-file", &cfg_type_qstring, 0 },
- 	{ "recursive-clients", &cfg_type_uint32, 0 },
- 	{ "reserved-sockets", &cfg_type_uint32, 0 },
-- 
-2.26.2
-
--- a/SOURCES/bind-9.11-serve-stale.patch
+++ b/SOURCES/bind-9.11-serve-stale.patch
--- a/SOURCES/bind-9.11-stale-cache.patch
+++ b/SOURCES/bind-9.11-stale-cache.patch
@ -1,65 +0,0 @@
-From 8a7bff93037432fcfe8532752e89f150ea3030a4 Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Mon, 9 Oct 2023 19:00:12 +0200
-Subject: [PATCH] Do not keep stale records by default
-
-By default set max-stale-ttl to 0, unless stale-answer-enable yes. This
-were enabled by mistake when backporting fix for CVE-2023-2828. It
-causes increased cache usage on servers not wanting to serve stale
-records. Fix that by setting smart defaults based on stale answers
-enabled with possible manual tuning.
---
- bin/named/server.c | 25 +++++++++++++++++++------
- 1 file changed, 19 insertions(+), 6 deletions(-)
-
-diff --git a/bin/named/server.c b/bin/named/server.c
-index 7af90d0..afdc4fa 100644
--- a/bin/named/server.c
-+++ b/bin/named/server.c
-@@ -3295,7 +3295,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
- 	size_t max_acache_size;
- 	size_t max_adb_size;
- 	uint32_t lame_ttl, fail_ttl;
-	uint32_t max_stale_ttl;
-+	uint32_t max_stale_ttl = 0;
- 	dns_tsig_keyring_t *ring = NULL;
- 	dns_view_t *pview = NULL;	/* Production view */
- 	isc_mem_t *cmctx = NULL, *hmctx = NULL;
-@@ -3739,16 +3739,29 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
- 	if (view->maxncachettl > 7 * 24 * 3600)
- 		view->maxncachettl = 7 * 24 * 3600;
- 
-	obj = NULL;
-	result = ns_config_get(maps, "max-stale-ttl", &obj);
-	INSIST(result == ISC_R_SUCCESS);
-	max_stale_ttl = cfg_obj_asuint32(obj);
-
- 	obj = NULL;
- 	result = ns_config_get(maps, "stale-answer-enable", &obj);
- 	INSIST(result == ISC_R_SUCCESS);
- 	view->staleanswersenable = cfg_obj_asboolean(obj);
- 
-+	// RHEL-11785 -- set the stale-ttl to non-zero value only if enabled
-+	obj = NULL;
-+	if (view->staleanswersenable) {
-+		result = ns_config_get(maps, "max-stale-ttl", &obj);
-+		INSIST(result == ISC_R_SUCCESS);
-+		max_stale_ttl = cfg_obj_asuint32(obj);
-+		/*
-+		 * If 'stale-answer-enable' is false, max_stale_ttl is set
-+		 * to 0, meaning keeping stale RRsets in cache is disabled.
-+		 */
-+	} else {
-+		/* Do not use default value if stale is disabled,
-+		 * but allow manual overriding, like 'stale-cache-enable' */
-+		result = ns_config_get(optionmaps, "max-stale-ttl", &obj);
-+		if (result == ISC_R_SUCCESS)
-+			max_stale_ttl = cfg_obj_asuint32(obj);
-+	}
-+
- 	result = dns_viewlist_find(&ns_g_server->viewlist, view->name,
- 				   view->rdclass, &pview);
- 	if (result == ISC_R_SUCCESS) {
-- 
-2.41.0
-
--- a/SOURCES/bind-9.11-unit-disable-random.patch
+++ b/SOURCES/bind-9.11-unit-disable-random.patch
@ -1,30 +0,0 @@
-From 373f07148217a8e70e33446f5108fb42d1079ba6 Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Thu, 21 Feb 2019 22:42:27 +0100
-Subject: [PATCH] Disable random_test
-
-It fails too often on some architecture, failing the whole build along.
-Because it runs two times for pkcs11 and normal build and any of
-subtests can occasionally fail, stop it.
-
-It can be used again by defining 'unstable' variable in Kyuafile.
---
- lib/isc/tests/Kyuafile | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/lib/isc/tests/Kyuafile b/lib/isc/tests/Kyuafile
-index 4cd2574..9df2340 100644
--- a/lib/isc/tests/Kyuafile
-+++ b/lib/isc/tests/Kyuafile
-@@ -19,7 +19,7 @@ tap_test_program{name='pool_test'}
- tap_test_program{name='print_test'}
- tap_test_program{name='queue_test'}
- tap_test_program{name='radix_test'}
-tap_test_program{name='random_test'}
-+tap_test_program{name='random_test', required_configs='unstable'}
- tap_test_program{name='regex_test'}
- tap_test_program{name='result_test'}
- tap_test_program{name='safe_test'}
-- 
-2.20.1
-
--- a/SOURCES/bind-9.11-zone2ldap.patch
+++ b/SOURCES/bind-9.11-zone2ldap.patch
@ -1,195 +0,0 @@
-From 9683a4d2524b870c4cee09259cb5eb7b8075a507 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Tue, 18 Dec 2018 16:06:26 +0100
-Subject: [PATCH] Make absolute hostname by dns API instead of strings
-
-Duplicate all strings in dc_list. Free allocated memory on each record.
---
- bin/sdb_tools/zone2ldap.c | 70 +++++++++++++++++++++++++--------------
- 1 file changed, 45 insertions(+), 25 deletions(-)
-
-diff --git a/bin/sdb_tools/zone2ldap.c b/bin/sdb_tools/zone2ldap.c
-index d59936c..9ba73b8 100644
--- a/bin/sdb_tools/zone2ldap.c
-+++ b/bin/sdb_tools/zone2ldap.c
-@@ -84,6 +84,10 @@ int get_attr_list_size (char **tmp);
- /* Get a DN */
- char *build_dn_from_dc_list (char **dc_list, unsigned int ttl, int flag, char *zone);
- 
-+/* Free a DN list */
-+static void
-+free_dc_list(char **dc_list);
-+
- /* Add to RR list */
- void add_to_rr_list (char *dn, char *name, char *type, char *data,
- 		     unsigned int ttl, unsigned int flags);
-@@ -120,6 +124,7 @@ static char dNSTTL            []="dNSTTL";
- static char zoneName          []="zoneName";
- static char dc                []="dc";
- static char sameZone          []="@";
-+static char dot               []=".";
- /* LDAPMod mod_values: */
- static char *objectClasses    []= { &(topClass[0]), &(dNSZoneClass[0]), NULL };
- static char *topObjectClasses []= { &(topClass[0]), &(dcObjectClass[0]), &(dNSZoneClass[0]), NULL };
-@@ -391,6 +396,8 @@ main (int argc, char **argv)
- 	    }
- 
- 	}
-+
-+        free_dc_list(dc_list);
-     }
-   else
-     {
-@@ -446,12 +453,18 @@ generate_ldap (dns_name_t * dnsname, dns_rdata_t * rdata, unsigned int ttl)
-   char data[2048];
-   char **dc_list;
-   char *dn;
-+  size_t argzone_len;
-+  bool omit_dot;
- 
-   isc_buffer_t buff;
-   isc_result_t result;
- 
-   isc_buffer_init (&buff, name, sizeof (name));
-   result = dns_name_totext (dnsname, true, &buff);
-+  argzone_len = strlen(argzone);
-+  /* If argzone is absolute, output absolute name too */
-+  omit_dot = (!(argzone_len > 0 && argzone[argzone_len-1] == '.'));
-+  result = dns_name_totext (dnsname, omit_dot, &buff);
-   isc_result_check (result, "dns_name_totext");
-   name[isc_buffer_usedlength (&buff)] = 0;
- 
-@@ -473,6 +486,7 @@ generate_ldap (dns_name_t * dnsname, dns_rdata_t * rdata, unsigned int ttl)
-     printf ("Adding %s (%s %s) to run queue list.\n", dn, type, data);
- 
-   add_to_rr_list (dn, dc_list[len], (char*)type, (char*)data, ttl, DNS_OBJECT);
-+  free_dc_list(dc_list);
- }
- 
- 
-@@ -533,12 +547,9 @@ add_to_rr_list (char *dn, char *name, char *type,
-       if (tmp->attrs == (LDAPMod **) NULL)
- 	fatal("calloc");
- 
-      for (i = 0; i < (int)flags; i++)
-	{
-	  tmp->attrs[i] = (LDAPMod *) malloc (sizeof (LDAPMod));
-	  if (tmp->attrs[i] == (LDAPMod *) NULL)
-	    fatal("malloc");
-	}
-+      tmp->attrs[0] = (LDAPMod *) malloc (sizeof (LDAPMod));
-+      if (tmp->attrs[0] == (LDAPMod *) NULL)
-+	  fatal("malloc");
-       tmp->attrs[0]->mod_op = LDAP_MOD_ADD;
-       tmp->attrs[0]->mod_type = objectClass;
- 
-@@ -554,9 +565,18 @@ add_to_rr_list (char *dn, char *name, char *type,
- 	  return;
- 	}
- 
-+      for (i = 1; i < (int)flags-1; i++)
-+	{
-+	  tmp->attrs[i] = (LDAPMod *) malloc (sizeof (LDAPMod));
-+	  if (tmp->attrs[i] == (LDAPMod *) NULL)
-+	    fatal("malloc");
-+	}
-+      tmp->attrs[i] = NULL;
-+
-+
-       tmp->attrs[1]->mod_op = LDAP_MOD_ADD;
-       tmp->attrs[1]->mod_type = relativeDomainName;
-      tmp->attrs[1]->mod_values = (char **) calloc (sizeof (char *), 2);
-+      tmp->attrs[1]->mod_values = (char **) calloc (sizeof (char *), 3);
- 
-       if (tmp->attrs[1]->mod_values == (char **)NULL)
- 	fatal("calloc");
-@@ -701,24 +721,16 @@ hostname_to_dn_list (char *hostname, char *zone, unsigned int flags)
- {
-   char *tmp;
-   int i = 0;
-+  int j = 0;
-   char *hname=0L, *last=0L;
-   int hlen=strlen(hostname), zlen=(strlen(zone));
- 
- /*  printf("hostname: %s zone: %s\n",hostname, zone); */
-  hname=0L;
-   if(flags == DNS_OBJECT)
-   {
-      if( (zone[ zlen - 1 ] == '.') && (hostname[hlen - 1] != '.') )
-      {
-	  hname=(char*)malloc(hlen + 1);
-	  hlen += 1;
-	  sprintf(hname, "%s.", hostname);
-	  hostname = hname;
-      }
-       if(strcmp(hostname, zone) == 0)
-       {
-	  if( hname == 0 )
-	      hname=strdup(hostname);
-+	  hname= strdup(hostname);
- 	  last = strdup(sameZone);
-       }else
-       {
-@@ -726,8 +738,6 @@ hostname_to_dn_list (char *hostname, char *zone, unsigned int flags)
- 	     ||( strcmp( hostname + (hlen - zlen), zone ) != 0)
- 	    )
- 	  {
-	      if( hname != 0 )
-		  free(hname);
- 	      hname=(char*)malloc( hlen + zlen + 1);
- 	      if( *zone == '.' )
- 		  sprintf(hname, "%s%s", hostname, zone);
-@@ -735,8 +745,7 @@ hostname_to_dn_list (char *hostname, char *zone, unsigned int flags)
- 		  sprintf(hname,"%s",zone);
- 	  }else
- 	  {
-	      if( hname == 0 )
-		  hname = strdup(hostname);
-+	      hname = strdup(hostname);
- 	  }
- 	  last = hname;
-       }
-@@ -749,18 +758,21 @@ hostname_to_dn_list (char *hostname, char *zone, unsigned int flags)
-   for (tmp = strrchr (hname, '.'); tmp != (char *) 0;
-        tmp = strrchr (hname, '.'))
-   {
-      if( *( tmp + 1 ) != '\0' )
-+      tmp[0] = '\0';
-+      if( tmp[1] != '\0' )
-       {
-	  *tmp = '\0';
- 	  dn_buffer[i++] = ++tmp;
-       }else
-       { /* trailing '.' ! */
-	  dn_buffer[i++] = strdup(".");
-	  *tmp = '\0';
-+	  dn_buffer[i++] = dot;
- 	  if( tmp == hname )
- 	      break;
-       }
-   }
-+  for (j=0; j<i; j++)
-+  {
-+      dn_buffer[j] = strdup(dn_buffer[j]);
-+  }
-   if( ( last != hname ) && (tmp != hname) )
-       dn_buffer[i++] = hname;
-   dn_buffer[i++] = last;
-@@ -820,6 +832,14 @@ build_dn_from_dc_list (char **dc_list, unsigned int ttl, int flag, char *zone)
-   return dn;
- }
- 
-+static void
-+free_dc_list(char **dc_list)
-+{
-+    for (; *dc_list; dc_list++) {
-+        free(*dc_list);
-+	*dc_list=NULL;
-+    }
-+}
- 
- /* Initialize LDAP Conn */
- void
-- 
-2.21.1
-
--- a/SOURCES/bind-9.14-config-pkcs11.patch
+++ b/SOURCES/bind-9.14-config-pkcs11.patch
@ -0,0 +1,83 @@
+From e6ab9c67f0a14adc23c1067e03a106da1b1651b7 Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Fri, 18 Oct 2019 21:30:52 +0200
+Subject: [PATCH] Move USE_PKCS11 and USE_OPENSSL out of config.h
+
+Building two variants with the same common code requires to unset
+USE_PKCS11 on part of build. That is not possible with config.h value.
+Move it as normal define to CDEFINES.
+---
+ bin/confgen/Makefile.in |  2 +-
+ configure.ac            |  8 ++++++--
+ lib/dns/dst_internal.h  | 12 +++++++++---
+ 3 files changed, 16 insertions(+), 6 deletions(-)
+
+diff --git a/bin/confgen/Makefile.in b/bin/confgen/Makefile.in
+index 1b7512d..c126bf3 100644
+--- a/bin/confgen/Makefile.in
+++ b/bin/confgen/Makefile.in
+@@ -22,7 +22,7 @@ VERSION=@BIND9_VERSION@
+ CINCLUDES = -I${srcdir}/include ${ISC_INCLUDES} ${ISCCC_INCLUDES} \
+ 	${ISCCFG_INCLUDES} ${DNS_INCLUDES} ${BIND9_INCLUDES}
+ 
+-CDEFINES =
+CDEFINES = @USE_PKCS11@
+ CWARNINGS =
+ 
+ ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
+diff --git a/configure.ac b/configure.ac
+index f5483fe..08a7d8a 100644
+--- a/configure.ac
+++ b/configure.ac
+@@ -935,10 +935,14 @@ AC_SUBST([PKCS11_TEST])
+ AC_SUBST([PKCS11_TOOLS])
+ AC_SUBST([PKCS11_MANS])
+ 
+USE_PKCS11='-DUSE_PKCS11=0'
+USE_OPENSSL='-DUSE_OPENSSL=0'
+ AC_SUBST([CRYPTO])
+ AS_CASE([$CRYPTO],
+-	[pkcs11],[AC_DEFINE([USE_PKCS11], [1], [define if PKCS11 is used for Public-Key Cryptography])],
+-	[AC_DEFINE([USE_OPENSSL], [1], [define if OpenSSL is used for Public-Key Cryptography])])
+	[pkcs11],[USE_PKCS11='-DUSE_PKCS11=1'],
+	[USE_OPENSSL='-DUSE_OPENSSL=1'])
+AC_SUBST(USE_PKCS11)
+AC_SUBST(USE_OPENSSL)
+ 
+ # preparation for automake
+ # AM_CONDITIONAL([PKCS11_TOOLS], [test "$with_native_pkcs11" = "yes"])
+diff --git a/lib/dns/dst_internal.h b/lib/dns/dst_internal.h
+index 2c3b4a3..55e9dc4 100644
+--- a/lib/dns/dst_internal.h
+++ b/lib/dns/dst_internal.h
+@@ -38,6 +38,13 @@
+ #include <isc/stdtime.h>
+ #include <isc/types.h>
+ 
+#ifndef USE_PKCS11
+#define USE_PKCS11 0
+#endif
+#ifndef USE_OPENSSL
+#define USE_OPENSSL (! USE_PKCS11)
+#endif
+
+ #if USE_PKCS11
+ #include <pk11/pk11.h>
+ #include <pk11/site.h>
+@@ -116,11 +123,10 @@ struct dst_key {
+ 		void *generic;
+ 		dns_gss_ctx_id_t gssctx;
+ 		DH *dh;
+-#if USE_OPENSSL
+-		EVP_PKEY *pkey;
+-#endif /* if USE_OPENSSL */
+ #if USE_PKCS11
+ 		pk11_object_t *pkey;
+#else
+		EVP_PKEY *pkey;
+ #endif /* if USE_PKCS11 */
+ 		dst_hmac_key_t *hmac_key;
+ 	} keydata; /*%< pointer to key in crypto pkg fmt */
+-- 
+2.26.2
+
--- a/SOURCES/bind-9.15-resolver-ntasks.patch
+++ b/SOURCES/bind-9.15-resolver-ntasks.patch
@ -1,58 +0,0 @@
-From 6d6acf236841da5c2511f8afcd3e4a89af4c5658 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Witold=20Kr=C4=99cicki?= <wpk@isc.org>
-Date: Fri, 14 Feb 2020 09:18:48 +0100
-Subject: [PATCH] Use RESOLVER_NTASKS_PERCPU - 32 for regular tuning, 8 for
- small
-
-Modify original upstream commit 0d80266f7e3, add high limit of used
-tasks. Minimum would be lower on machines with few cpus, but maximum
-would stay unchanged. Should prevent negatives of this change.
-
-Signed-off-by: Petr Mensik <pemensik@redhat.com>
---
- bin/named/server.c | 12 ++++++++----
- 1 file changed, 8 insertions(+), 4 deletions(-)
-
-diff --git a/bin/named/server.c b/bin/named/server.c
-index 39b1124..94b4daa 100644
--- a/bin/named/server.c
-+++ b/bin/named/server.c
-@@ -148,11 +148,13 @@
- #endif
- 
- #ifdef TUNE_LARGE
-#define RESOLVER_NTASKS 523
-+#define RESOLVER_NTASKS_MAX 523
-+#define RESOLVER_NTASKS_PERCPU 32
- #define UDPBUFFERS 32768
- #define EXCLBUFFERS 32768
- #else
-#define RESOLVER_NTASKS 31
-+#define RESOLVER_NTASKS_MAX 31
-+#define RESOLVER_NTASKS_PERCPU 8
- #define UDPBUFFERS 1000
- #define EXCLBUFFERS 4096
- #endif /* TUNE_LARGE */
-@@ -3318,7 +3320,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
- 	ns_cache_t *nsc;
- 	bool zero_no_soattl;
- 	dns_acl_t *clients = NULL, *mapped = NULL, *excluded = NULL;
-	unsigned int query_timeout, ndisp;
-+	unsigned int query_timeout, ndisp, ntasks;
- 	bool old_rpz_ok = false;
- 	isc_dscp_t dscp4 = -1, dscp6 = -1;
- 	dns_dyndbctx_t *dctx = NULL;
-@@ -3926,7 +3928,9 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
- 	dns_view_setresquerystats(view, resquerystats);
- 
- 	ndisp = 4 * ISC_MIN(ns_g_udpdisp, MAX_UDP_DISPATCH);
-	CHECK(dns_view_createresolver(view, ns_g_taskmgr, RESOLVER_NTASKS,
-+	ntasks = ISC_MIN(RESOLVER_NTASKS_PERCPU * ns_g_cpus,
-+		         RESOLVER_NTASKS_MAX);
-+	CHECK(dns_view_createresolver(view, ns_g_taskmgr, ntasks,
- 				      ndisp, ns_g_socketmgr, ns_g_timermgr,
- 				      resopts, ns_g_dispatchmgr,
- 				      dispatch4, dispatch6));
-- 
-2.34.1
-
--- a/SOURCES/bind-9.16-CVE-2022-3094-1.patch
+++ b/SOURCES/bind-9.16-CVE-2022-3094-1.patch
@ -1,240 +0,0 @@
-From 128b3b676eb9413b4d25fb29c560895cfbbfa92e Mon Sep 17 00:00:00 2001
-From: Evan Hunt <each@isc.org>
-Date: Thu, 1 Sep 2022 16:05:04 -0700
-Subject: [PATCH] add an update quota
-
-limit the number of simultaneous DNS UPDATE events that can be
-processed by adding a quota for update and update forwarding.
-this quota currently, arbitrarily, defaults to 100.
-
-also add a statistics counter to record when the update quota
-has been exceeded.
-
-(cherry picked from commit 7c47254a140c3e9cf383cda73c7b6a55c4782826)
---
- bin/named/bind9.xsl              |  2 +-
- bin/named/bind9.xsl.h            |  8 +++++++-
- bin/named/include/named/server.h |  7 ++++++-
- bin/named/server.c               |  3 +++
- bin/named/statschannel.c         |  5 +++--
- bin/named/update.c               | 34 +++++++++++++++++++++++++++++++-
- doc/arm/Bv9ARM-book.xml          | 15 ++++++++++++++
- 7 files changed, 68 insertions(+), 6 deletions(-)
-
-diff --git a/bin/named/bind9.xsl b/bin/named/bind9.xsl
-index 9a1c6ff..85fd4c4 100644
--- a/bin/named/bind9.xsl
-+++ b/bin/named/bind9.xsl
-@@ -12,7 +12,7 @@
- 
- <xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns="http://www.w3.org/1999/xhtml" version="1.0">
-   <xsl:output method="html" indent="yes" version="4.0"/>
-  <xsl:template match="statistics[@version=&quot;3.8&quot;]">
-+  <xsl:template match="statistics[@version=&quot;3.8.1&quot;]">
-     <html>
-       <head>
-         <script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js"></script>
-diff --git a/bin/named/bind9.xsl.h b/bin/named/bind9.xsl.h
-index 9ce8cd7..5e0a892 100644
--- a/bin/named/bind9.xsl.h
-+++ b/bin/named/bind9.xsl.h
-@@ -17,7 +17,13 @@ static char xslmsg[] =
- 	"\n"
- 	"<xsl:stylesheet xmlns:xsl=\"http://www.w3.org/1999/XSL/Transform\" xmlns=\"http://www.w3.org/1999/xhtml\" version=\"1.0\">\n"
- 	" <xsl:output method=\"html\" indent=\"yes\" version=\"4.0\"/>\n"
-	" <xsl:template match=\"statistics[@version=&quot;3.8&quot;]\">\n"
-+#if 0
-+	" <!-- the version number **below** must match version in "
-+	"bin/named/statschannel.c -->\n"
-+	" <!-- don't forget to update \"/xml/v<STATS_XML_VERSION_MAJOR>\" in "
-+	"the HTTP endpoints listed below -->\n"
-+#endif
-+	" <xsl:template match=\"statistics[@version=&quot;3.8.1&quot;]\">\n"
- 	" <html>\n"
- 	" <head>\n"
- 	" <script type=\"text/javascript\" src=\"https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js\"></script>\n"
-diff --git a/bin/named/include/named/server.h b/bin/named/include/named/server.h
-index 08a02dc..259acc7 100644
--- a/bin/named/include/named/server.h
-+++ b/bin/named/include/named/server.h
-@@ -137,6 +137,9 @@ struct ns_server {
- 
- 	uint16_t		transfer_tcp_message_size;
- 	isc_rng_t *		rngctx;
-+
-+/* CVE-2022-3094 */
-+	isc_quota_t		updquota;
- };
- 
- struct ns_altsecret {
-@@ -230,7 +233,9 @@ enum {
- 	dns_nsstatscounter_trystale = 59,
- 	dns_nsstatscounter_usedstale = 60,
- 
-	dns_nsstatscounter_max = 61
-+	dns_nsstatscounter_updatequota = 61,
-+
-+	dns_nsstatscounter_max = 62
- };
- 
- /*%
-diff --git a/bin/named/server.c b/bin/named/server.c
-index 2d2fa0e..f09b895 100644
--- a/bin/named/server.c
-+++ b/bin/named/server.c
-@@ -9143,6 +9143,8 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
- 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
- 	result = isc_quota_init(&server->recursionquota, 100);
- 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
-+	result = isc_quota_init(&server->updquota, 100);
-+	RUNTIME_CHECK(result == ISC_R_SUCCESS);
- 
- 	result = dns_aclenv_init(mctx, &server->aclenv);
- 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
-@@ -9410,6 +9412,7 @@ ns_server_destroy(ns_server_t **serverp) {
- 
- 	dns_aclenv_destroy(&server->aclenv);
- 
-+	isc_quota_destroy(&server->updquota);
- 	isc_quota_destroy(&server->recursionquota);
- 	isc_quota_destroy(&server->tcpquota);
- 	isc_quota_destroy(&server->xfroutquota);
-diff --git a/bin/named/statschannel.c b/bin/named/statschannel.c
-index 56a9c21..1e8723c 100644
--- a/bin/named/statschannel.c
-+++ b/bin/named/statschannel.c
-@@ -300,6 +300,7 @@ init_desc(void) {
- 	SET_NSSTATDESC(reclimitdropped,
- 		       "queries dropped due to recursive client limit",
- 		       "RecLimitDropped");
-+	SET_NSSTATDESC(updatequota, "Update quota exceeded", "UpdateQuota");
- 	SET_NSSTATDESC(trystale,
- 		       "attempts to use stale cache data after lookup failure",
- 		       "QryTryStale");
-@@ -1546,7 +1547,7 @@ generatexml(ns_server_t *server, uint32_t flags,
- 			ISC_XMLCHAR "type=\"text/xsl\" href=\"/bind9.xsl\""));
- 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "statistics"));
- 	TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "version",
-					 ISC_XMLCHAR "3.8"));
-+					 ISC_XMLCHAR "3.8.1"));
- 
- 	/* Set common fields for statistics dump */
- 	dumparg.type = isc_statsformat_xml;
-@@ -2303,7 +2304,7 @@ generatejson(ns_server_t *server, size_t *msglen,
- 	/*
- 	 * These statistics are included no matter which URL we use.
- 	 */
-	obj = json_object_new_string("1.2");
-+	obj = json_object_new_string("1.2.1");
- 	CHECKMEM(obj);
- 	json_object_object_add(bindstats, "json-stats-version", obj);
- 
-diff --git a/bin/named/update.c b/bin/named/update.c
-index 6ad7d27..dccc543 100644
--- a/bin/named/update.c
-+++ b/bin/named/update.c
-@@ -1526,6 +1526,17 @@ send_update_event(ns_client_t *client, dns_zone_t *zone) {
- 	isc_task_t *zonetask = NULL;
- 	ns_client_t *evclient;
- 
-+	result = isc_quota_attach(&ns_g_server->updquota,
-+				  &(isc_quota_t *){ NULL });
-+	if (result != ISC_R_SUCCESS) {
-+		update_log(client, zone, LOGLEVEL_PROTOCOL,
-+			   "update failed: too many DNS UPDATEs queued (%s)",
-+			   isc_result_totext(result));
-+		isc_stats_increment(ns_g_server->nsstats,
-+				    dns_nsstatscounter_updatequota);
-+		CHECK(DNS_R_DROP);
-+	}
-+
- 	event = (update_event_t *)
- 		isc_event_allocate(client->mctx, client, DNS_EVENT_UPDATE,
- 				   update_action, NULL, sizeof(*event));
-@@ -1652,7 +1663,12 @@ ns_update_start(ns_client_t *client, isc_result_t sigresult) {
- 	 * We are still in the client task context, so we can
- 	 * simply give an error response without switching tasks.
- 	 */
-	respond(client, result);
-+	if (result == DNS_R_DROP) {
-+		ns_client_next(client, result);
-+	} else {
-+		respond(client, result);
-+	}
-+
- 	if (zone != NULL)
- 		dns_zone_detach(&zone);
- }
-@@ -3385,6 +3401,7 @@ updatedone_action(isc_task_t *task, isc_event_t *event) {
- 		dns_zone_detach(&uev->zone);
- 	client->nupdates--;
- 	respond(client, uev->result);
-+	isc_quota_detach(&(isc_quota_t *){ &ns_g_server->updquota });
- 	isc_event_free(&event);
- 	ns_client_detach(&client);
- }
-@@ -3402,6 +3419,8 @@ forward_fail(isc_task_t *task, isc_event_t *event) {
- 	INSIST(client->nupdates > 0);
- 	client->nupdates--;
- 	respond(client, DNS_R_SERVFAIL);
-+
-+	isc_quota_detach(&(isc_quota_t *){ &ns_g_server->updquota });
- 	isc_event_free(&event);
- 	ns_client_detach(&client);
- }
-@@ -3439,6 +3458,8 @@ forward_done(isc_task_t *task, isc_event_t *event) {
- 	client->nupdates--;
- 	ns_client_sendraw(client, uev->answer);
- 	dns_message_detach(&uev->answer);
-+
-+	isc_quota_detach(&(isc_quota_t *){ &ns_g_server->updquota });
- 	isc_event_free(&event);
- 	ns_client_detach(&client);
- }
-@@ -3472,6 +3493,17 @@ send_forward_event(ns_client_t *client, dns_zone_t *zone) {
- 	isc_task_t *zonetask = NULL;
- 	ns_client_t *evclient;
- 
-+	result = isc_quota_attach(&ns_g_server->updquota,
-+				  &(isc_quota_t *){ NULL });
-+	if (result != ISC_R_SUCCESS) {
-+		update_log(client, zone, LOGLEVEL_PROTOCOL,
-+			   "update failed: too many DNS UPDATEs queued (%s)",
-+			   isc_result_totext(result));
-+		isc_stats_increment(ns_g_server->nsstats,
-+				    dns_nsstatscounter_updatequota);
-+		return (DNS_R_DROP);
-+	}
-+
- 	/*
- 	 * This may take some time so replace this client.
- 	 */
-diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
-index c17f168..9aca6d7 100644
--- a/doc/arm/Bv9ARM-book.xml
-+++ b/doc/arm/Bv9ARM-book.xml
-@@ -15105,6 +15105,21 @@ HOST-127.EXAMPLE. MX 0 .
- 		      </para>
- 		    </entry>
- 		  </row>
-+		  <row rowsep="0">
-+		    <entry colname="1">
-+		      <para><command>UpdateQuota</command></para>
-+		    </entry>
-+		    <entry colname="2">
-+		      <para><command/></para>
-+		    </entry>
-+		    <entry colname="3">
-+		      <para>
-+			This indicates the number of times a dynamic update or update
-+			forwarding request was rejected because the number of pending
-+			requests exceeded the update quota.
-+		      </para>
-+		    </entry>
-+		  </row>
- 		  <row rowsep="0">
- 		    <entry colname="1">
- 		      <para><command>RateDropped</command></para>
-- 
-2.39.2
-
--- a/SOURCES/bind-9.16-CVE-2022-3094-2.patch
+++ b/SOURCES/bind-9.16-CVE-2022-3094-2.patch
@ -1,136 +0,0 @@
-From d9a03233c6ea11f20c2fbeca87b763673859f8b2 Mon Sep 17 00:00:00 2001
-From: Evan Hunt <each@isc.org>
-Date: Thu, 1 Sep 2022 16:22:46 -0700
-Subject: [PATCH] add a configuration option for the update quota
-
-add an "update-quota" option to configure the update quota.
-
-(cherry picked from commit f57758a7303ad0034ff2ff08eaaf2ef899630f19)
---
- bin/named/config.c                   |  1 +
- bin/named/named.conf.docbook         |  2 ++
- bin/named/server.c                   |  1 +
- bin/tests/system/checkconf/good.conf |  1 +
- doc/arm/Bv9ARM-book.xml              | 11 +++++++++++
- doc/arm/options.grammar.xml          |  1 +
- doc/misc/options                     |  1 +
- lib/isccfg/namedconf.c               |  1 +
- 8 files changed, 19 insertions(+)
-
-diff --git a/bin/named/config.c b/bin/named/config.c
-index 62d1e88..e3731cf 100644
--- a/bin/named/config.c
-+++ b/bin/named/config.c
-@@ -134,6 +134,7 @@ options {\n\
- 	transfers-per-ns 2;\n\
- #	treat-cr-as-space <obsolete>;\n\
- 	trust-anchor-telemetry yes;\n\
-+	update-quota 100;\n\
- #	use-id-pool <obsolete>;\n\
- #	use-ixfr <obsolete>;\n\
- \n\
-diff --git a/bin/named/named.conf.docbook b/bin/named/named.conf.docbook
-index 6565fce..5842cb5 100644
--- a/bin/named/named.conf.docbook
-+++ b/bin/named/named.conf.docbook
-@@ -455,6 +455,7 @@ options {
- 	trust-anchor-telemetry <replaceable>boolean</replaceable>; // experimental
- 	try-tcp-refresh <replaceable>boolean</replaceable>;
- 	update-check-ksk <replaceable>boolean</replaceable>;
-+	update-quota <replaceable>integer</replaceable>;
- 	use-alt-transfer-source <replaceable>boolean</replaceable>;
- 	use-v4-udp-ports { <replaceable>portrange</replaceable>; ... };
- 	use-v6-udp-ports { <replaceable>portrange</replaceable>; ... };
-@@ -864,6 +865,7 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
- 		type ( delegation-only | forward | hint | master | redirect
- 		    | slave | static-stub | stub );
- 		update-check-ksk <replaceable>boolean</replaceable>;
-+		update-quota <replaceable>integer</replaceable>;
- 		update-policy ( local | { ( deny | grant ) <replaceable>string</replaceable> (
- 		    6to4-self | external | krb5-self | krb5-selfsub |
- 		    krb5-subdomain | ms-self | ms-selfsub | ms-subdomain |
-diff --git a/bin/named/server.c b/bin/named/server.c
-index f09b895..7af90d0 100644
--- a/bin/named/server.c
-+++ b/bin/named/server.c
-@@ -7792,6 +7792,7 @@ load_configuration(const char *filename, ns_server_t *server,
- 	configure_server_quota(maps, "tcp-clients", &server->tcpquota);
- 	configure_server_quota(maps, "recursive-clients",
- 			       &server->recursionquota);
-+	configure_server_quota(maps, "update-quota", &server->updquota);
- 
- 	if (server->recursionquota.max > 1000) {
- 		int margin = ISC_MAX(100, ns_g_cpus + 1);
-diff --git a/bin/tests/system/checkconf/good.conf b/bin/tests/system/checkconf/good.conf
-index 1359cf3..5d9b292 100644
--- a/bin/tests/system/checkconf/good.conf
-+++ b/bin/tests/system/checkconf/good.conf
-@@ -63,6 +63,7 @@ options {
- 	serial-queries 10;
- 	serial-query-rate 100;
- 	server-id none;
-+	update-quota 200;
- 	max-cache-size 20000000000000;
- 	nta-lifetime 604800;
- 	nta-recheck 604800;
-diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
-index 9aca6d7..acf772b 100644
--- a/doc/arm/Bv9ARM-book.xml
-+++ b/doc/arm/Bv9ARM-book.xml
-@@ -8599,6 +8599,17 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
- 	      </listitem>
- 	    </varlistentry>
- 
-+	    <varlistentry>
-+	      <term><command>update-quota</command></term>
-+	      <listitem>
-+		<para>
-+		This is the maximum number of simultaneous DNS UPDATE messages that
-+		the server will accept for updating local authoritiative zones or
-+			forwarding to a primary server. The default is <userinput>100</userinput>.
-+		</para>
-+	      </listitem>
-+	    </varlistentry>
-+
- 	  </variablelist>
- 
- 	</section>
-diff --git a/doc/arm/options.grammar.xml b/doc/arm/options.grammar.xml
-index 793ac0b..1d17ea8 100644
--- a/doc/arm/options.grammar.xml
-+++ b/doc/arm/options.grammar.xml
-@@ -277,6 +277,7 @@
- 	<command>trust-anchor-telemetry</command> <replaceable>boolean</replaceable>; // experimental
- 	<command>try-tcp-refresh</command> <replaceable>boolean</replaceable>;
- 	<command>update-check-ksk</command> <replaceable>boolean</replaceable>;
-+	<command>update-quota</command> <replaceable>integer</replaceable>;
- 	<command>use-alt-transfer-source</command> <replaceable>boolean</replaceable>;
- 	<command>use-v4-udp-ports</command> { <replaceable>portrange</replaceable>; ... };
- 	<command>use-v6-udp-ports</command> { <replaceable>portrange</replaceable>; ... };
-diff --git a/doc/misc/options b/doc/misc/options
-index fde93c7..e6d6ba6 100644
--- a/doc/misc/options
-+++ b/doc/misc/options
-@@ -357,6 +357,7 @@ options {
-         trust-anchor-telemetry <boolean>; // experimental
-         try-tcp-refresh <boolean>;
-         update-check-ksk <boolean>;
-+        update-quota <integer>;
-         use-alt-transfer-source <boolean>;
-         use-id-pool <boolean>; // obsolete
-         use-ixfr <boolean>; // obsolete
-diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
-index b562f95..667111c 100644
--- a/lib/isccfg/namedconf.c
-+++ b/lib/isccfg/namedconf.c
-@@ -1136,6 +1136,7 @@ options_clauses[] = {
- 	{ "transfers-out", &cfg_type_uint32, 0 },
- 	{ "transfers-per-ns", &cfg_type_uint32, 0 },
- 	{ "treat-cr-as-space", &cfg_type_boolean, CFG_CLAUSEFLAG_OBSOLETE },
-+	{ "update-quota", &cfg_type_uint32, 0 },
- 	{ "use-id-pool", &cfg_type_boolean, CFG_CLAUSEFLAG_OBSOLETE },
- 	{ "use-ixfr", &cfg_type_boolean, CFG_CLAUSEFLAG_OBSOLETE },
- 	{ "use-v4-udp-ports", &cfg_type_bracketed_portlist, 0 },
-- 
-2.39.2
-
--- a/SOURCES/bind-9.16-CVE-2022-3094-3.patch
+++ b/SOURCES/bind-9.16-CVE-2022-3094-3.patch
@ -1,553 +0,0 @@
-From cba333b262b7ee0034a66cc93cf27f6c4918eea2 Mon Sep 17 00:00:00 2001
-From: Evan Hunt <each@isc.org>
-Date: Tue, 8 Nov 2022 17:32:41 -0800
-Subject: [PATCH] move update ACL and update-policy checks before quota
-
-check allow-update, update-policy, and allow-update-forwarding before
-consuming quota slots, so that unauthorized clients can't fill the
-quota.
-
-(this moves the access check before the prerequisite check, which
-violates the precise wording of RFC 2136. however, RFC co-author Paul
-Vixie has stated that the RFC is mistaken on this point; it should have
-said that access checking must happen *no later than* the completion of
-prerequisite checks, not that it must happen exactly then.)
-
-(cherry picked from commit 964f559edb5036880b8e463b8f190b9007ee055d)
---
- bin/named/update.c | 440 ++++++++++++++++++++++++++++++---------------
- 1 file changed, 298 insertions(+), 142 deletions(-)
-
-diff --git a/bin/named/update.c b/bin/named/update.c
-index 8853ee7..4d1fe78 100644
--- a/bin/named/update.c
-+++ b/bin/named/update.c
-@@ -251,6 +251,9 @@ static void updatedone_action(isc_task_t *task, isc_event_t *event);
- static isc_result_t send_forward_event(ns_client_t *client, dns_zone_t *zone);
- static void forward_done(isc_task_t *task, isc_event_t *event);
- static isc_result_t add_rr_prepare_action(void *data, rr_t *rr);
-+static isc_result_t
-+rr_exists(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
-+	  const dns_rdata_t *rdata, bool *flag);
- 
- /**************************************************************************/
- 
-@@ -328,23 +331,24 @@ checkqueryacl(ns_client_t *client, dns_acl_t *queryacl, dns_name_t *zonename,
- {
- 	char namebuf[DNS_NAME_FORMATSIZE];
- 	char classbuf[DNS_RDATACLASS_FORMATSIZE];
-	int level;
- 	isc_result_t result;
-+	bool update_possible =
-+		((updateacl != NULL && !dns_acl_isnone(updateacl)) ||
-+		 ssutable != NULL);
- 
- 	result = ns_client_checkaclsilent(client, NULL, queryacl, true);
- 	if (result != ISC_R_SUCCESS) {
-+		int level = update_possible ? ISC_LOG_ERROR : ISC_LOG_INFO;
-+
- 		dns_name_format(zonename, namebuf, sizeof(namebuf));
- 		dns_rdataclass_format(client->view->rdclass, classbuf,
- 				      sizeof(classbuf));
- 
-		level = (updateacl == NULL && ssutable == NULL) ?
-				ISC_LOG_INFO : ISC_LOG_ERROR;
-
- 		ns_client_log(client, NS_LOGCATEGORY_UPDATE_SECURITY,
- 			      NS_LOGMODULE_UPDATE, level,
- 			      "update '%s/%s' denied due to allow-query",
- 			      namebuf, classbuf);
-	} else if (updateacl == NULL && ssutable == NULL) {
-+	} else if (!update_possible) {
- 		dns_name_format(zonename, namebuf, sizeof(namebuf));
- 		dns_rdataclass_format(client->view->rdclass, classbuf,
- 				      sizeof(classbuf));
-@@ -1525,6 +1529,277 @@ send_update_event(ns_client_t *client, dns_zone_t *zone) {
- 	update_event_t *event = NULL;
- 	isc_task_t *zonetask = NULL;
- 	ns_client_t *evclient;
-+#if 1
-+	dns_ssutable_t *ssutable = NULL;
-+	dns_message_t *request = client->message;
-+	dns_rdataclass_t zoneclass;
-+	dns_rdatatype_t covers;
-+	dns_name_t *zonename = NULL;
-+	dns_db_t *db = NULL;
-+	dns_dbversion_t *ver = NULL;
-+
-+	CHECK(dns_zone_getdb(zone, &db));
-+	zonename = dns_db_origin(db);
-+	zoneclass = dns_db_class(db);
-+	dns_zone_getssutable(zone, &ssutable);
-+	dns_db_currentversion(db, &ver);
-+
-+	/*
-+	 * Update message processing can leak record existence information
-+	 * so check that we are allowed to query this zone.  Additionally,
-+	 * if we would refuse all updates for this zone, we bail out here.
-+	 */
-+	CHECK(checkqueryacl(client, dns_zone_getqueryacl(zone),
-+			    dns_zone_getorigin(zone),
-+			    dns_zone_getupdateacl(zone), ssutable));
-+
-+	/*
-+	 * Check requestor's permissions.
-+	 */
-+	if (ssutable == NULL)
-+		CHECK(checkupdateacl(client, dns_zone_getupdateacl(zone),
-+				     "update", zonename, false, false));
-+	else if (client->signer == NULL && !TCPCLIENT(client))
-+		CHECK(checkupdateacl(client, NULL, "update", zonename,
-+				     false, true));
-+
-+	if (dns_zone_getupdatedisabled(zone))
-+		FAILC(DNS_R_REFUSED, "dynamic update temporarily disabled "
-+				     "because the zone is frozen.  Use "
-+				     "'rndc thaw' to re-enable updates.");
-+
-+	/*
-+	 * Perform the Update Section Prescan.
-+	 */
-+
-+	for (result = dns_message_firstname(request, DNS_SECTION_UPDATE);
-+	     result == ISC_R_SUCCESS;
-+	     result = dns_message_nextname(request, DNS_SECTION_UPDATE))
-+	{
-+		dns_name_t *name = NULL;
-+		dns_rdata_t rdata = DNS_RDATA_INIT;
-+		dns_ttl_t ttl;
-+		dns_rdataclass_t update_class;
-+		get_current_rr(request, DNS_SECTION_UPDATE, zoneclass,
-+			       &name, &rdata, &covers, &ttl, &update_class);
-+
-+		if (! dns_name_issubdomain(name, zonename))
-+			FAILC(DNS_R_NOTZONE,
-+			      "update RR is outside zone");
-+		if (update_class == zoneclass) {
-+			/*
-+			 * Check for meta-RRs.  The RFC2136 pseudocode says
-+			 * check for ANY|AXFR|MAILA|MAILB, but the text adds
-+			 * "or any other QUERY metatype"
-+			 */
-+			if (dns_rdatatype_ismeta(rdata.type)) {
-+				FAILC(DNS_R_FORMERR,
-+				      "meta-RR in update");
-+			}
-+			result = dns_zone_checknames(zone, name, &rdata);
-+			if (result != ISC_R_SUCCESS)
-+				FAIL(DNS_R_REFUSED);
-+		} else if (update_class == dns_rdataclass_any) {
-+			if (ttl != 0 || rdata.length != 0 ||
-+			    (dns_rdatatype_ismeta(rdata.type) &&
-+			     rdata.type != dns_rdatatype_any))
-+				FAILC(DNS_R_FORMERR,
-+				      "meta-RR in update");
-+		} else if (update_class == dns_rdataclass_none) {
-+			if (ttl != 0 ||
-+			    dns_rdatatype_ismeta(rdata.type))
-+				FAILC(DNS_R_FORMERR,
-+				      "meta-RR in update");
-+		} else {
-+			update_log(client, zone, ISC_LOG_WARNING,
-+				   "update RR has incorrect class %d",
-+				   update_class);
-+			FAIL(DNS_R_FORMERR);
-+		}
-+
-+		/*
-+		 * draft-ietf-dnsind-simple-secure-update-01 says
-+		 * "Unlike traditional dynamic update, the client
-+		 * is forbidden from updating NSEC records."
-+		 */
-+		if (rdata.type == dns_rdatatype_nsec3) {
-+			FAILC(DNS_R_REFUSED,
-+			      "explicit NSEC3 updates are not allowed "
-+			      "in secure zones");
-+		} else if (rdata.type == dns_rdatatype_nsec) {
-+			FAILC(DNS_R_REFUSED,
-+			      "explicit NSEC updates are not allowed "
-+			      "in secure zones");
-+		} else if (rdata.type == dns_rdatatype_rrsig &&
-+			   !dns_name_equal(name, zonename)) {
-+			FAILC(DNS_R_REFUSED,
-+			      "explicit RRSIG updates are currently "
-+			      "not supported in secure zones except "
-+			      "at the apex");
-+		}
-+
-+		if (ssutable != NULL) {
-+			isc_netaddr_t netaddr;
-+			dst_key_t *tsigkey = NULL;
-+			isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
-+
-+			if (client->message->tsigkey != NULL)
-+				tsigkey = client->message->tsigkey->key;
-+
-+			if (rdata.type != dns_rdatatype_any) {
-+				if (!dns_ssutable_checkrules2
-+				    (ssutable, client->signer, name, &netaddr,
-+				     TCPCLIENT(client),
-+				     &ns_g_server->aclenv,
-+				     rdata.type, tsigkey))
-+				{
-+					FAILC(DNS_R_REFUSED,
-+					      "rejected by secure update");
-+				}
-+			} else {
-+				if (!ssu_checkall(db, ver, name, ssutable,
-+						  client->signer,
-+						  &netaddr,
-+						  TCPCLIENT(client),
-+						  tsigkey))
-+				{
-+					FAILC(DNS_R_REFUSED,
-+					      "rejected by secure update");
-+				}
-+			}
-+		}
-+	}
-+	if (result != ISC_R_NOMORE)
-+		FAIL(result);
-+
-+	update_log(client, zone, LOGLEVEL_DEBUG,
-+		   "update section prescan OK");
-+#if 0
-+	if (ssutable == NULL) {
-+		CHECK(checkupdateacl(client, dns_zone_getupdateacl(zone),
-+						// zonename
-+				     "update", dns_zone_getorigin(zone), false,
-+				     false));
-+	} else if (client->signer == NULL && !TCPCLIENT(client)) {
-+		CHECK(checkupdateacl(client, NULL, "update",
-+				     dns_zone_getorigin(zone), false, true));
-+	}
-+
-+	if (dns_zone_getupdatedisabled(zone)) {
-+		FAILC(DNS_R_REFUSED, "dynamic update temporarily disabled "
-+				     "because the zone is frozen.  Use "
-+				     "'rndc thaw' to re-enable updates.");
-+	}
-+
-+	/*
-+	 * Prescan the update section, checking for updates that
-+	 * are illegal or violate policy.
-+	 */
-+	for (result = dns_message_firstname(request, DNS_SECTION_UPDATE);
-+	     result == ISC_R_SUCCESS;
-+	     result = dns_message_nextname(request, DNS_SECTION_UPDATE))
-+	{
-+		dns_name_t *name = NULL;
-+		dns_rdata_t rdata = DNS_RDATA_INIT;
-+		dns_ttl_t ttl;
-+		dns_rdataclass_t update_class;
-+
-+		get_current_rr(request, DNS_SECTION_UPDATE, zoneclass, &name,
-+			       &rdata, &covers, &ttl, &update_class);
-+
-+		if (!dns_name_issubdomain(name, zonename)) {
-+			FAILC(DNS_R_NOTZONE, "update RR is outside zone");
-+		}
-+		if (update_class == zoneclass) {
-+			/*
-+			 * Check for meta-RRs.  The RFC2136 pseudocode says
-+			 * check for ANY|AXFR|MAILA|MAILB, but the text adds
-+			 * "or any other QUERY metatype"
-+			 */
-+			if (dns_rdatatype_ismeta(rdata.type)) {
-+				FAILC(DNS_R_FORMERR, "meta-RR in update");
-+			}
-+			result = dns_zone_checknames(zone, name, &rdata);
-+			if (result != ISC_R_SUCCESS) {
-+				FAIL(DNS_R_REFUSED);
-+			}
-+		} else if (update_class == dns_rdataclass_any) {
-+			if (ttl != 0 || rdata.length != 0 ||
-+			    (dns_rdatatype_ismeta(rdata.type) &&
-+			     rdata.type != dns_rdatatype_any))
-+			{
-+				FAILC(DNS_R_FORMERR, "meta-RR in update");
-+			}
-+		} else if (update_class == dns_rdataclass_none) {
-+			if (ttl != 0 || dns_rdatatype_ismeta(rdata.type)) {
-+				FAILC(DNS_R_FORMERR, "meta-RR in update");
-+			}
-+		} else {
-+			update_log(client, zone, ISC_LOG_WARNING,
-+				   "update RR has incorrect class %d",
-+				   update_class);
-+			FAIL(DNS_R_FORMERR);
-+		}
-+
-+		/*
-+		 * draft-ietf-dnsind-simple-secure-update-01 says
-+		 * "Unlike traditional dynamic update, the client
-+		 * is forbidden from updating NSEC records."
-+		 */
-+		if (rdata.type == dns_rdatatype_nsec3) {
-+			FAILC(DNS_R_REFUSED, "explicit NSEC3 updates are not "
-+					     "allowed "
-+					     "in secure zones");
-+		} else if (rdata.type == dns_rdatatype_nsec) {
-+			FAILC(DNS_R_REFUSED, "explicit NSEC updates are not "
-+					     "allowed "
-+					     "in secure zones");
-+		} else if (rdata.type == dns_rdatatype_rrsig &&
-+			   !dns_name_equal(name, zonename))
-+		{
-+			FAILC(DNS_R_REFUSED, "explicit RRSIG updates are "
-+					     "currently "
-+					     "not supported in secure zones "
-+					     "except "
-+					     "at the apex");
-+		}
-+
-+		if (ssutable != NULL) {
-+			isc_netaddr_t netaddr;
-+			dst_key_t *tsigkey = NULL;
-+			isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
-+
-+			if (client->message->tsigkey != NULL) {
-+				tsigkey = client->message->tsigkey->key;
-+			}
-+
-+			if (rdata.type != dns_rdatatype_any) {
-+				if (!dns_ssutable_checkrules(
-+					    ssutable, client->signer, name,
-+					    &netaddr, TCPCLIENT(client), env,
-+					    rdata.type, tsigkey))
-+				{
-+					FAILC(DNS_R_REFUSED, "rejected by "
-+							     "secure update");
-+				}
-+			} else {
-+				if (!ssu_checkall(db, ver, name, ssutable,
-+						  client->signer, &netaddr, env,
-+						  TCPCLIENT(client), tsigkey))
-+				{
-+					FAILC(DNS_R_REFUSED, "rejected by "
-+							     "secure update");
-+				}
-+			}
-+		}
-+	}
-+	if (result != ISC_R_NOMORE) {
-+		FAIL(result);
-+	}
-+
-+	update_log(client, zone, LOGLEVEL_DEBUG, "update section prescan OK");
-+#endif
-+#endif
- 
- 	result = isc_quota_attach(&ns_g_server->updquota,
- 				  &(isc_quota_t *){ NULL });
-@@ -1558,6 +1833,15 @@ send_update_event(ns_client_t *client, dns_zone_t *zone) {
-  failure:
- 	if (event != NULL)
- 		isc_event_free(ISC_EVENT_PTR(&event));
-+	if (db != NULL) {
-+		dns_db_closeversion(db, &ver, false);
-+		dns_db_detach(&db);
-+	}
-+
-+	if (ssutable != NULL) {
-+		dns_ssutable_detach(&ssutable);
-+	}
-+
- 	return (result);
- }
- 
-@@ -1644,9 +1928,6 @@ ns_update_start(ns_client_t *client, isc_result_t sigresult) {
- 		CHECK(send_update_event(client, zone));
- 		break;
- 	case dns_zone_slave:
-		CHECK(checkupdateacl(client, dns_zone_getforwardacl(zone),
-				     "update forwarding", zonename, true,
-				     false));
- 		CHECK(send_forward_event(client, zone));
- 		break;
- 	default:
-@@ -1656,7 +1937,6 @@ ns_update_start(ns_client_t *client, isc_result_t sigresult) {
- 
-  failure:
- 	if (result == DNS_R_REFUSED) {
-		INSIST(dns_zone_gettype(zone) == dns_zone_slave);
- 		inc_stats(zone, dns_nsstatscounter_updaterej);
- 	}
- 	/*
-@@ -2520,7 +2800,7 @@ update_action(isc_task_t *task, isc_event_t *event) {
- 	dns_rdatatype_t covers;
- 	dns_message_t *request = client->message;
- 	dns_rdataclass_t zoneclass;
-	dns_name_t *zonename;
-+	dns_name_t *zonename = NULL;
- 	dns_ssutable_t *ssutable = NULL;
- 	dns_fixedname_t tmpnamefixed;
- 	dns_name_t *tmpname = NULL;
-@@ -2542,14 +2822,7 @@ update_action(isc_task_t *task, isc_event_t *event) {
- 	zonename = dns_db_origin(db);
- 	zoneclass = dns_db_class(db);
- 	dns_zone_getssutable(zone, &ssutable);
-
-	/*
-	 * Update message processing can leak record existence information
-	 * so check that we are allowed to query this zone.  Additionally
-	 * if we would refuse all updates for this zone we bail out here.
-	 */
-	CHECK(checkqueryacl(client, dns_zone_getqueryacl(zone), zonename,
-			    dns_zone_getupdateacl(zone), ssutable));
-+	options = dns_zone_getoptions(zone);
- 
- 	/*
- 	 * Get old and new versions now that queryacl has been checked.
-@@ -2673,134 +2946,10 @@ update_action(isc_task_t *task, isc_event_t *event) {
- 	update_log(client, zone, LOGLEVEL_DEBUG,
- 		   "prerequisites are OK");
- 
-	/*
-	 * Check Requestor's Permissions.  It seems a bit silly to do this
-	 * only after prerequisite testing, but that is what RFC2136 says.
-	 */
-	if (ssutable == NULL)
-		CHECK(checkupdateacl(client, dns_zone_getupdateacl(zone),
-				     "update", zonename, false, false));
-	else if (client->signer == NULL && !TCPCLIENT(client))
-		CHECK(checkupdateacl(client, NULL, "update", zonename,
-				     false, true));
-
-	if (dns_zone_getupdatedisabled(zone))
-		FAILC(DNS_R_REFUSED, "dynamic update temporarily disabled "
-				     "because the zone is frozen.  Use "
-				     "'rndc thaw' to re-enable updates.");
-
-	/*
-	 * Perform the Update Section Prescan.
-	 */
-
-	for (result = dns_message_firstname(request, DNS_SECTION_UPDATE);
-	     result == ISC_R_SUCCESS;
-	     result = dns_message_nextname(request, DNS_SECTION_UPDATE))
-	{
-		dns_name_t *name = NULL;
-		dns_rdata_t rdata = DNS_RDATA_INIT;
-		dns_ttl_t ttl;
-		dns_rdataclass_t update_class;
-		get_current_rr(request, DNS_SECTION_UPDATE, zoneclass,
-			       &name, &rdata, &covers, &ttl, &update_class);
-
-		if (! dns_name_issubdomain(name, zonename))
-			FAILC(DNS_R_NOTZONE,
-			      "update RR is outside zone");
-		if (update_class == zoneclass) {
-			/*
-			 * Check for meta-RRs.  The RFC2136 pseudocode says
-			 * check for ANY|AXFR|MAILA|MAILB, but the text adds
-			 * "or any other QUERY metatype"
-			 */
-			if (dns_rdatatype_ismeta(rdata.type)) {
-				FAILC(DNS_R_FORMERR,
-				      "meta-RR in update");
-			}
-			result = dns_zone_checknames(zone, name, &rdata);
-			if (result != ISC_R_SUCCESS)
-				FAIL(DNS_R_REFUSED);
-		} else if (update_class == dns_rdataclass_any) {
-			if (ttl != 0 || rdata.length != 0 ||
-			    (dns_rdatatype_ismeta(rdata.type) &&
-			     rdata.type != dns_rdatatype_any))
-				FAILC(DNS_R_FORMERR,
-				      "meta-RR in update");
-		} else if (update_class == dns_rdataclass_none) {
-			if (ttl != 0 ||
-			    dns_rdatatype_ismeta(rdata.type))
-				FAILC(DNS_R_FORMERR,
-				      "meta-RR in update");
-		} else {
-			update_log(client, zone, ISC_LOG_WARNING,
-				   "update RR has incorrect class %d",
-				   update_class);
-			FAIL(DNS_R_FORMERR);
-		}
-
-		/*
-		 * draft-ietf-dnsind-simple-secure-update-01 says
-		 * "Unlike traditional dynamic update, the client
-		 * is forbidden from updating NSEC records."
-		 */
-		if (rdata.type == dns_rdatatype_nsec3) {
-			FAILC(DNS_R_REFUSED,
-			      "explicit NSEC3 updates are not allowed "
-			      "in secure zones");
-		} else if (rdata.type == dns_rdatatype_nsec) {
-			FAILC(DNS_R_REFUSED,
-			      "explicit NSEC updates are not allowed "
-			      "in secure zones");
-		} else if (rdata.type == dns_rdatatype_rrsig &&
-			   !dns_name_equal(name, zonename)) {
-			FAILC(DNS_R_REFUSED,
-			      "explicit RRSIG updates are currently "
-			      "not supported in secure zones except "
-			      "at the apex");
-		}
-
-		if (ssutable != NULL) {
-			isc_netaddr_t netaddr;
-			dst_key_t *tsigkey = NULL;
-			isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
-
-			if (client->message->tsigkey != NULL)
-				tsigkey = client->message->tsigkey->key;
-
-			if (rdata.type != dns_rdatatype_any) {
-				if (!dns_ssutable_checkrules2
-				    (ssutable, client->signer, name, &netaddr,
-				     TCPCLIENT(client),
-				     &ns_g_server->aclenv,
-				     rdata.type, tsigkey))
-				{
-					FAILC(DNS_R_REFUSED,
-					      "rejected by secure update");
-				}
-			} else {
-				if (!ssu_checkall(db, ver, name, ssutable,
-						  client->signer,
-						  &netaddr,
-						  TCPCLIENT(client),
-						  tsigkey))
-				{
-					FAILC(DNS_R_REFUSED,
-					      "rejected by secure update");
-				}
-			}
-		}
-	}
-	if (result != ISC_R_NOMORE)
-		FAIL(result);
-
-	update_log(client, zone, LOGLEVEL_DEBUG,
-		   "update section prescan OK");
-
- 	/*
- 	 * Process the Update Section.
- 	 */
- 
-	options = dns_zone_getoptions(zone);
- 	options2 = dns_zone_getoptions2(zone);
- 	for (result = dns_message_firstname(request, DNS_SECTION_UPDATE);
- 	     result == ISC_R_SUCCESS;
-@@ -3494,6 +3643,13 @@ send_forward_event(ns_client_t *client, dns_zone_t *zone) {
- 	isc_task_t *zonetask = NULL;
- 	ns_client_t *evclient;
- 
-+	result = checkupdateacl(client, dns_zone_getforwardacl(zone),
-+				"update forwarding", dns_zone_getorigin(zone),
-+				true, false);
-+	if (result != ISC_R_SUCCESS) {
-+		return (result);
-+	}
-+
- 	result = isc_quota_attach(&ns_g_server->updquota,
- 				  &(isc_quota_t *){ NULL });
- 	if (result != ISC_R_SUCCESS) {
-- 
-2.39.2
-
--- a/SOURCES/bind-9.16-CVE-2022-3094-test.patch
+++ b/SOURCES/bind-9.16-CVE-2022-3094-test.patch
@ -1,266 +0,0 @@
-From 3d84c651f823cb90b73fd736d32ad6de57b11610 Mon Sep 17 00:00:00 2001
-From: Evan Hunt <each@isc.org>
-Date: Wed, 9 Nov 2022 21:56:16 -0800
-Subject: [PATCH] test failure conditions
-
-verify that updates are refused when the client is disallowed by
-allow-query, and update forwarding is refused when the client is
-is disallowed by update-forwarding.
-
-verify that "too many DNS UPDATEs" appears in the log file when too
-many simultaneous updates are processing.
-
-(cherry picked from commit b91339b80e5b82a56622c93cc1e3cca2d0c11bc0)
---
- bin/tests/system/nsupdate/ns1/named.conf.in   |  2 +
- bin/tests/system/nsupdate/tests.sh            | 28 +++++++++++++
- bin/tests/system/upforwd/clean.sh             |  2 +
- .../ns3/{named.conf.in => named1.conf.in}     |  7 +++-
- bin/tests/system/upforwd/ns3/named2.conf.in   | 41 +++++++++++++++++++
- bin/tests/system/upforwd/setup.sh             |  2 +-
- bin/tests/system/upforwd/tests.sh             | 40 ++++++++++++++++++
- 7 files changed, 120 insertions(+), 2 deletions(-)
- rename bin/tests/system/upforwd/ns3/{named.conf.in => named1.conf.in} (85%)
- create mode 100644 bin/tests/system/upforwd/ns3/named2.conf.in
-
-diff --git a/bin/tests/system/nsupdate/ns1/named.conf.in b/bin/tests/system/nsupdate/ns1/named.conf.in
-index cb80269..228ad6a 100644
--- a/bin/tests/system/nsupdate/ns1/named.conf.in
-+++ b/bin/tests/system/nsupdate/ns1/named.conf.in
-@@ -20,6 +20,7 @@ options {
- 	listen-on-v6 { none; };
- 	recursion no;
- 	notify yes;
-+	update-quota 1;
- };
- 
- key rndc_key {
-@@ -76,6 +77,7 @@ zone "other.nil" {
- 	check-integrity no;
- 	check-mx warn;
- 	update-policy local;
-+	allow-query { !10.53.0.2; any; };
- 	allow-query-on { 10.53.0.1; 127.0.0.1; };
- 	allow-transfer { any; };
- };
-diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh
-index f8994ff..4cabf8d 100755
--- a/bin/tests/system/nsupdate/tests.sh
-+++ b/bin/tests/system/nsupdate/tests.sh
-@@ -1069,6 +1069,34 @@ END
- grep "NSEC3PARAM has excessive iterations (> 150)" nsupdate.out-$n >/dev/null || ret=1
- [ $ret = 0 ] || { echo_i "failed"; status=1; }
- 
-+n=$((n + 1))
-+ret=0
-+echo_i "check that update is rejected if query is not allowed ($n)"
-+{
-+  $NSUPDATE -d <<END
-+  local 10.53.0.2
-+  server 10.53.0.1 ${PORT}
-+  update add reject.other.nil 3600 IN TXT Whatever
-+  send
-+END
-+} > nsupdate.out.test$n 2>&1
-+grep 'status: REFUSED' nsupdate.out.test$n > /dev/null || ret=1
-+[ $ret = 0 ] || { echo_i "failed"; status=1; }
-+
-+n=$((n + 1))
-+ret=0
-+echo_i "check that update is rejected if quota is exceeded ($n)"
-+for loop in 1 2 3 4 5 6 7 8 9 10; do
-+{
-+  $NSUPDATE -l -p ${PORT} -k ns1/session.key > nsupdate.out.test$n-${loop} 2>&1 <<END
-+  update add txt-$loop.other.nil 3600 IN TXT Whatever
-+  send
-+END
-+} &
-+done
-+wait_for_log 10 "too many DNS UPDATEs queued" ns1/named.run || ret=1
-+[ $ret = 0 ] || { echo_i "failed"; status=1; }
-+
- if $FEATURETEST --gssapi ; then
-   n=`expr $n + 1`
-   ret=0
-diff --git a/bin/tests/system/upforwd/clean.sh b/bin/tests/system/upforwd/clean.sh
-index 15cf423..832c727 100644
--- a/bin/tests/system/upforwd/clean.sh
-+++ b/bin/tests/system/upforwd/clean.sh
-@@ -24,3 +24,5 @@ rm -f Ksig0.example2.*
- rm -f keyname
- rm -f ns*/named.lock
- rm -f ns1/example2.db
-+rm -f nsupdate.out.*
-+rm -f ns*/named.run.prev
-diff --git a/bin/tests/system/upforwd/ns3/named.conf.in b/bin/tests/system/upforwd/ns3/named1.conf.in
-similarity index 85%
-rename from bin/tests/system/upforwd/ns3/named.conf.in
-rename to bin/tests/system/upforwd/ns3/named1.conf.in
-index e81cd1a..83a490f 100644
--- a/bin/tests/system/upforwd/ns3/named.conf.in
-+++ b/bin/tests/system/upforwd/ns3/named1.conf.in
-@@ -22,10 +22,15 @@ options {
- 	notify yes;
- };
- 
-+include "../../common/rndc.key";
-+controls {
-+	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-+};
-+
- zone "example" {
- 	type slave;
- 	file "example.bk";
-	allow-update-forwarding { any; };
-+	allow-update-forwarding { 10.53.0.1; };
- 	masters { 10.53.0.1; };
- };
- 
-diff --git a/bin/tests/system/upforwd/ns3/named2.conf.in b/bin/tests/system/upforwd/ns3/named2.conf.in
-new file mode 100644
-index 0000000..992cd69
--- /dev/null
-+++ b/bin/tests/system/upforwd/ns3/named2.conf.in
-@@ -0,0 +1,41 @@
-+/*
-+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-+ *
-+ * SPDX-License-Identifier: MPL-2.0
-+ *
-+ * This Source Code Form is subject to the terms of the Mozilla Public
-+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
-+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
-+ *
-+ * See the COPYRIGHT file distributed with this work for additional
-+ * information regarding copyright ownership.
-+ */
-+
-+options {
-+	query-source address 10.53.0.3;
-+	notify-source 10.53.0.3;
-+	transfer-source 10.53.0.3;
-+	port @PORT@;
-+	pid-file "named.pid";
-+	listen-on { 10.53.0.3; };
-+	listen-on-v6 { none; };
-+	recursion no;
-+	notify yes;
-+	update-quota 1;
-+};
-+
-+key rndc_key {
-+	secret "1234abcd8765";
-+	algorithm hmac-sha256;
-+};
-+
-+controls {
-+	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-+};
-+
-+zone "example" {
-+	type slave;
-+	file "example.bk";
-+	allow-update-forwarding { any; };
-+	masters { 10.53.0.1; };
-+};
-diff --git a/bin/tests/system/upforwd/setup.sh b/bin/tests/system/upforwd/setup.sh
-index 74c7ba3..928902b 100644
--- a/bin/tests/system/upforwd/setup.sh
-+++ b/bin/tests/system/upforwd/setup.sh
-@@ -17,7 +17,7 @@ cp -f ns3/nomaster.db ns3/nomaster1.db
- 
- copy_setports ns1/named.conf.in ns1/named.conf
- copy_setports ns2/named.conf.in ns2/named.conf
-copy_setports ns3/named.conf.in ns3/named.conf
-+copy_setports ns3/named1.conf.in ns3/named.conf
- 
- #
- # SIG(0) required cryptographic support which may not be configured.
-diff --git a/bin/tests/system/upforwd/tests.sh b/bin/tests/system/upforwd/tests.sh
-index f4c3216..ebc9ded 100644
--- a/bin/tests/system/upforwd/tests.sh
-+++ b/bin/tests/system/upforwd/tests.sh
-@@ -17,6 +17,7 @@ SYSTEMTESTTOP=..
- . $SYSTEMTESTTOP/conf.sh
- 
- DIGOPTS="+tcp +noadd +nosea +nostat +noquest +nocomm +nocmd -p ${PORT}"
-+RNDCCMD="$RNDC -c $SYSTEMTESTTOP/common/rndc.conf -p ${CONTROLPORT} -s"
- 
- status=0
- n=1
-@@ -69,6 +70,7 @@ if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
- echo_i "updating zone (signed) ($n)"
- ret=0
- $NSUPDATE -y hmac-sha256:update.example:c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K -- - <<EOF || ret=1
-+local 10.53.0.1
- server 10.53.0.3 ${PORT}
- update add updated.example. 600 A 10.10.10.1
- update add updated.example. 600 TXT Foo
-@@ -116,6 +118,7 @@ n=`expr $n + 1`
- echo_i "updating zone (unsigned) ($n)"
- ret=0
- $NSUPDATE -- - <<EOF || ret=1
-+local 10.53.0.1
- server 10.53.0.3 ${PORT}
- update add unsigned.example. 600 A 10.10.10.1
- update add unsigned.example. 600 TXT Foo
-@@ -161,6 +164,7 @@ while [ $count -lt 5 -a $ret -eq 0 ]
- do
- (
- $NSUPDATE -- - <<EOF 
-+local 10.53.0.1
- server 10.53.0.3 ${PORT}
- zone nomaster
- update add unsigned.nomaster. 600 A 10.10.10.1
-@@ -181,6 +185,7 @@ then
- 	ret=0
- 	keyname=`cat keyname`
- 	$NSUPDATE -k $keyname.private -- - <<EOF
-+	local 10.53.0.1
- 	server 10.53.0.3 ${PORT}
- 	zone example2
- 	update add unsigned.example2. 600 A 10.10.10.1
-@@ -194,5 +199,40 @@ EOF
- 	n=`expr $n + 1`
- fi
- 
-+echo_i "attempting an update that should be rejected by ACL ($n)"
-+ret=0
-+{
-+        $NSUPDATE -- - << EOF
-+        local 10.53.0.2
-+        server 10.53.0.3 ${PORT}
-+        update add another.unsigned.example. 600 A 10.10.10.2
-+        update add another.unsigned.example. 600 TXT Bar
-+        send
-+EOF
-+} > nsupdate.out.$n 2>&1
-+grep REFUSED nsupdate.out.$n > /dev/null || ret=1
-+if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
-+n=`expr $n + 1`
-+
-+n=$((n + 1))
-+ret=0
-+echo_i "attempting updates that should exceed quota ($n)"
-+# lower the update quota to 1.
-+copy_setports ns3/named2.conf.in ns3/named.conf
-+$RNDCCMD 10.53.0.3 reconfig
-+nextpart ns3/named.run > /dev/null
-+for loop in 1 2 3 4 5 6 7 8 9 10; do
-+{
-+  $NSUPDATE -- - > /dev/null 2>&1 <<END
-+  local 10.53.0.1
-+  server 10.53.0.3 ${PORT}
-+  update add txt-$loop.unsigned.example 300 IN TXT Whatever
-+  send
-+END
-+} &
-+done
-+wait_for_log 10 "too many DNS UPDATEs queued" ns3/named.run || ret=1
-+[ $ret = 0 ] || { echo_i "failed"; status=1; }
-+
- echo_i "exit status: $status"
- [ $status -eq 0 ] || exit 1
-- 
-2.39.2
-
--- a/SOURCES/bind-9.16-CVE-2022-38177.patch
+++ b/SOURCES/bind-9.16-CVE-2022-38177.patch
@ -1,27 +0,0 @@
-From 0095b8a6b09173ab5eb48611dc0233d2a6337dc1 Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Tue, 20 Sep 2022 11:21:45 +0200
-Subject: [PATCH] Fix CVE-2022-38177
-
-5961.	[security]	Fix memory leak in ECDSA verify processing.
-			(CVE-2022-38177) [GL #3487]
---
- lib/dns/opensslecdsa_link.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/lib/dns/opensslecdsa_link.c b/lib/dns/opensslecdsa_link.c
-index 83b5b51..7576e04 100644
--- a/lib/dns/opensslecdsa_link.c
-+++ b/lib/dns/opensslecdsa_link.c
-@@ -224,7 +224,7 @@ opensslecdsa_verify(dst_context_t *dctx, const isc_region_t *sig) {
- 		siglen = DNS_SIG_ECDSA384SIZE;
- 
- 	if (sig->length != siglen)
-		return (DST_R_VERIFYFAILURE);
-+		DST_RET(DST_R_VERIFYFAILURE);
- 
- 	if (!EVP_DigestFinal_ex(evp_md_ctx, digest, &dgstlen))
- 		DST_RET (dst__openssl_toresult3(dctx->category,
-- 
-2.37.3
-
--- a/SOURCES/bind-9.16-CVE-2022-38178.patch
+++ b/SOURCES/bind-9.16-CVE-2022-38178.patch
@ -1,27 +0,0 @@
-From bb68864bf05d29df644427ec841bc3db6a336519 Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Tue, 20 Sep 2022 11:22:47 +0200
-Subject: [PATCH] Fix CVE-2022-38178
-
-5962.	[security]	Fix memory leak in EdDSA verify processing.
-			(CVE-2022-38178) [GL #3487]
---
- lib/dns/openssleddsa_link.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/lib/dns/openssleddsa_link.c b/lib/dns/openssleddsa_link.c
-index 8b115ec..4f3c2a8 100644
--- a/lib/dns/openssleddsa_link.c
-+++ b/lib/dns/openssleddsa_link.c
-@@ -325,7 +325,7 @@ openssleddsa_verify(dst_context_t *dctx, const isc_region_t *sig) {
- 		siglen = DNS_SIG_ED448SIZE;
- 
- 	if (sig->length != siglen)
-		return (DST_R_VERIFYFAILURE);
-+		DST_RET(DST_R_VERIFYFAILURE);
- 
- 	isc_buffer_usedregion(buf, &tbsreg);
- 
-- 
-2.37.3
-
--- a/SOURCES/bind-9.16-CVE-2023-3341.patch
+++ b/SOURCES/bind-9.16-CVE-2023-3341.patch
@ -1,166 +0,0 @@
-From 3883ec072e5feed1237dc864854ab95ded7302d6 Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Tue, 19 Sep 2023 13:14:52 +0200
-Subject: [PATCH] Backport of CVE-2023-3341 fix
-
-Taken from BIND 9.16.44 change.
---
- lib/isccc/cc.c                   | 36 +++++++++++++++++++++++---------
- lib/isccc/include/isccc/result.h |  4 +++-
- lib/isccc/result.c               |  4 +++-
- 3 files changed, 32 insertions(+), 12 deletions(-)
-
-diff --git a/lib/isccc/cc.c b/lib/isccc/cc.c
-index 463a053..a54e60c 100644
--- a/lib/isccc/cc.c
-+++ b/lib/isccc/cc.c
-@@ -53,6 +53,10 @@
- 
- #define MAX_TAGS		256
- #define DUP_LIFETIME		900
-+#ifndef ISCCC_MAXDEPTH
-+#define ISCCC_MAXDEPTH \
-+	10 /* Big enough for rndc which just sends a string each way. */
-+#endif
- 
- typedef isccc_sexpr_t *sexpr_ptr;
- 
-@@ -573,19 +577,23 @@ verify(isccc_sexpr_t *alist, unsigned char *data, unsigned int length,
- 
- static isc_result_t
- table_fromwire(isccc_region_t *source, isccc_region_t *secret,
-	       uint32_t algorithm, isccc_sexpr_t **alistp);
-+	       uint32_t algorithm, unsigned int depth, isccc_sexpr_t **alistp);
- 
- static isc_result_t
-list_fromwire(isccc_region_t *source, isccc_sexpr_t **listp);
-+list_fromwire(isccc_region_t *source, unsigned int depth, isccc_sexpr_t **listp);
- 
- static isc_result_t
-value_fromwire(isccc_region_t *source, isccc_sexpr_t **valuep) {
-+value_fromwire(isccc_region_t *source, unsigned int depth, isccc_sexpr_t **valuep) {
- 	unsigned int msgtype;
- 	uint32_t len;
- 	isccc_sexpr_t *value;
- 	isccc_region_t active;
- 	isc_result_t result;
- 
-+	if (depth > ISCCC_MAXDEPTH) {
-+		return (ISCCC_R_MAXDEPTH);
-+	}
-+
- 	if (REGION_SIZE(*source) < 1 + 4)
- 		return (ISC_R_UNEXPECTEDEND);
- 	GET8(msgtype, source->rstart);
-@@ -603,9 +611,9 @@ value_fromwire(isccc_region_t *source, isccc_sexpr_t **valuep) {
- 		} else
- 			result = ISC_R_NOMEMORY;
- 	} else if (msgtype == ISCCC_CCMSGTYPE_TABLE)
-		result = table_fromwire(&active, NULL, 0, valuep);
-+		result = table_fromwire(&active, NULL, 0, depth + 1, valuep);
- 	else if (msgtype == ISCCC_CCMSGTYPE_LIST)
-		result = list_fromwire(&active, valuep);
-+		result = list_fromwire(&active, depth + 1, valuep);
- 	else
- 		result = ISCCC_R_SYNTAX;
- 
-@@ -614,7 +622,7 @@ value_fromwire(isccc_region_t *source, isccc_sexpr_t **valuep) {
- 
- static isc_result_t
- table_fromwire(isccc_region_t *source, isccc_region_t *secret,
-	       uint32_t algorithm, isccc_sexpr_t **alistp)
-+	       uint32_t algorithm, unsigned int depth, isccc_sexpr_t **alistp)
- {
- 	char key[256];
- 	uint32_t len;
-@@ -625,6 +633,10 @@ table_fromwire(isccc_region_t *source, isccc_region_t *secret,
- 
- 	REQUIRE(alistp != NULL && *alistp == NULL);
- 
-+	if (depth > ISCCC_MAXDEPTH) {
-+		return (ISCCC_R_MAXDEPTH);
-+	}
-+
- 	checksum_rstart = NULL;
- 	first_tag = true;
- 	alist = isccc_alist_create();
-@@ -640,7 +652,7 @@ table_fromwire(isccc_region_t *source, isccc_region_t *secret,
- 		GET_MEM(key, len, source->rstart);
- 		key[len] = '\0';	/* Ensure NUL termination. */
- 		value = NULL;
-		result = value_fromwire(source, &value);
-+		result = value_fromwire(source, depth + 1, &value);
- 		if (result != ISC_R_SUCCESS)
- 			goto bad;
- 		if (isccc_alist_define(alist, key, value) == NULL) {
-@@ -673,14 +685,18 @@ table_fromwire(isccc_region_t *source, isccc_region_t *secret,
- }
- 
- static isc_result_t
-list_fromwire(isccc_region_t *source, isccc_sexpr_t **listp) {
-+list_fromwire(isccc_region_t *source, unsigned int depth, isccc_sexpr_t **listp) {
- 	isccc_sexpr_t *list, *value;
- 	isc_result_t result;
- 
-+	if (depth > ISCCC_MAXDEPTH) {
-+		return (ISCCC_R_MAXDEPTH);
-+	}
-+
- 	list = NULL;
- 	while (!REGION_EMPTY(*source)) {
- 		value = NULL;
-		result = value_fromwire(source, &value);
-+		result = value_fromwire(source, depth + 1, &value);
- 		if (result != ISC_R_SUCCESS) {
- 			isccc_sexpr_free(&list);
- 			return (result);
-@@ -711,7 +727,7 @@ isccc_cc_fromwire(isccc_region_t *source, isccc_sexpr_t **alistp,
- 	if (version != 1)
- 		return (ISCCC_R_UNKNOWNVERSION);
- 
-	return (table_fromwire(source, secret, algorithm, alistp));
-+	return (table_fromwire(source, secret, algorithm, 0, alistp));
- }
- 
- static isc_result_t
-diff --git a/lib/isccc/include/isccc/result.h b/lib/isccc/include/isccc/result.h
-index 6c79dd7..b30b08a 100644
--- a/lib/isccc/include/isccc/result.h
-+++ b/lib/isccc/include/isccc/result.h
-@@ -47,8 +47,10 @@
- #define ISCCC_R_CLOCKSKEW		(ISC_RESULTCLASS_ISCCC + 4)
- /*% Duplicate */
- #define ISCCC_R_DUPLICATE		(ISC_RESULTCLASS_ISCCC + 5)
-+/*% Maximum recursion depth */
-+#define ISCCC_R_MAXDEPTH		(ISC_RESULTCLASS_ISCCC + 6)
- 
-#define ISCCC_R_NRESULTS 		6	/*%< Number of results */
-+#define ISCCC_R_NRESULTS 		7	/*%< Number of results */
- 
- ISC_LANG_BEGINDECLS
- 
-diff --git a/lib/isccc/result.c b/lib/isccc/result.c
-index 8419bbb..a3a3b9a 100644
--- a/lib/isccc/result.c
-+++ b/lib/isccc/result.c
-@@ -40,7 +40,8 @@ static const char *text[ISCCC_R_NRESULTS] = {
- 	"bad auth",				/* 3 */
- 	"expired",				/* 4 */
- 	"clock skew",				/* 5 */
-	"duplicate"				/* 6 */
-+	"duplicate",				/* 6 */
-+	"max depth",				/* 7 */
- };
- 
- static const char *ids[ISCCC_R_NRESULTS] = {
-@@ -50,6 +51,7 @@ static const char *ids[ISCCC_R_NRESULTS] = {
- 	"ISCCC_R_EXPIRED",
- 	"ISCCC_R_CLOCKSKEW",
- 	"ISCCC_R_DUPLICATE",
-+	"ISCCC_R_MAXDEPTH"
- };
- 
- #define ISCCC_RESULT_RESULTSET			2
-- 
-2.41.0
-
--- a/SOURCES/bind-9.16-CVE-2024-1737-records-test.patch
+++ b/SOURCES/bind-9.16-CVE-2024-1737-records-test.patch
--- a/SOURCES/bind-9.16-CVE-2024-1737-records.patch
+++ b/SOURCES/bind-9.16-CVE-2024-1737-records.patch
--- a/SOURCES/bind-9.16-CVE-2024-1737-types-test.patch
+++ b/SOURCES/bind-9.16-CVE-2024-1737-types-test.patch
--- a/SOURCES/bind-9.16-CVE-2024-1737-types.patch
+++ b/SOURCES/bind-9.16-CVE-2024-1737-types.patch
@ -0,0 +1,582 @@
+From 06236a2d32c1d8f29208321d276e742f9259efd2 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
+Date: Sat, 25 May 2024 11:46:56 +0200
+Subject: [PATCH] Add a limit to the number of RR types for single name
+
+Previously, the number of RR types for a single owner name was limited
+only by the maximum number of the types (64k).  As the data structure
+that holds the RR types for the database node is just a linked list, and
+there are places where we just walk through the whole list (again and
+again), adding a large number of RR types for a single owner named with
+would slow down processing of such name (database node).
+
+Add a configurable limit to cap the number of the RR types for a single
+owner.  This is enforced at the database (rbtdb, qpzone, qpcache) level
+and configured with new max-types-per-name configuration option that
+can be configured globally, per-view and per-zone.
+
+(cherry picked from commit 00d16211d6368b99f070c1182d8c76b3798ca1db)
+(cherry picked from commit 89f1779bc28b27adbd00325b974ede7a683f8632)
+
+fix a memory leak that could occur when signing
+
+when signatures were not added because of too many types already
+existing at a node, the diff was not being cleaned up; this led to
+a memory leak being reported at shutdown.
+
+(cherry picked from commit 2825bdb1ae5be801e7ed603ba2455ed9a308f1f7)
+(cherry picked from commit a080317de0efb7f6ffa12415a863729d416007d5)
+
+Be smarter about refusing to add many RR types to the database
+
+Instead of outright refusing to add new RR types to the cache, be a bit
+smarter:
+
+1. If the new header type is in our priority list, we always add either
+   positive or negative entry at the beginning of the list.
+
+2. If the new header type is negative entry, and we are over the limit,
+   we mark it as ancient immediately, so it gets evicted from the cache
+   as soon as possible.
+
+3. Otherwise add the new header after the priority headers (or at the
+   head of the list).
+
+4. If we are over the limit, evict the last entry on the normal header
+   list.
+
+(cherry picked from commit 57cd34441a1b4ecc9874a4a106c2c95b8d7a3120)
+(cherry picked from commit 92a680a3ef708281267e4fd7b1e62b57c929447b)
+
+Log error when update fails
+
+The new "too many records" error can make an update fail without the
+error being logged. This commit fixes that.
+
+(cherry picked from commit 558923e5405894cf976d102f0d246a28bdbb400c)
+(cherry picked from commit d72adf4b927d83a2a0ff8e431b911ec1df7aeb88)
+---
+ bin/named/config.c                 |  1 +
+ bin/named/server.c                 |  9 +++++++++
+ bin/named/zoneconf.c               |  8 ++++++++
+ bin/tests/system/dyndb/driver/db.c |  3 ++-
+ doc/arm/reference.rst              | 12 ++++++++++++
+ lib/dns/cache.c                    | 12 ++++++++++++
+ lib/dns/db.c                       |  9 +++++++++
+ lib/dns/dnsrps.c                   |  3 ++-
+ lib/dns/ecdb.c                     |  3 ++-
+ lib/dns/include/dns/cache.h        |  6 ++++++
+ lib/dns/include/dns/db.h           | 11 +++++++++++
+ lib/dns/include/dns/view.h         |  7 +++++++
+ lib/dns/include/dns/zone.h         | 13 +++++++++++++
+ lib/dns/rbtdb.c                    | 28 +++++++++++++++++-----------
+ lib/dns/sdb.c                      |  3 ++-
+ lib/dns/sdlz.c                     |  3 ++-
+ lib/dns/view.c                     | 10 ++++++++++
+ lib/dns/zone.c                     | 16 ++++++++++++++++
+ lib/isccfg/namedconf.c             |  3 +++
+ lib/ns/update.c                    | 15 ++++++++++++---
+ 20 files changed, 156 insertions(+), 19 deletions(-)
+
+diff --git a/bin/named/config.c b/bin/named/config.c
+index 72dec1a..ec48840 100644
+--- a/bin/named/config.c
+++ b/bin/named/config.c
+@@ -229,6 +229,7 @@ options {\n\
+ 	max-records-per-type 100;\n\
+ 	max-refresh-time 2419200; /* 4 weeks */\n\
+ 	max-retry-time 1209600; /* 2 weeks */\n\
+	max-types-per-name 100;\n\
+ 	max-transfer-idle-in 60;\n\
+ 	max-transfer-idle-out 60;\n\
+ 	max-transfer-time-in 120;\n\
+diff --git a/bin/named/server.c b/bin/named/server.c
+index f550814..c68b8d1 100644
+--- a/bin/named/server.c
+++ b/bin/named/server.c
+@@ -5461,6 +5461,15 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
+ 	INSIST(result == ISC_R_SUCCESS);
+ 	dns_view_setmaxrrperset(view, cfg_obj_asuint32(obj));
+ 
+	/*
+	 * This is used for the cache and also as a default value
+	 * for zone databases.
+	 */
+	obj = NULL;
+	result = named_config_get(maps, "max-types-per-name", &obj);
+	INSIST(result == ISC_R_SUCCESS);
+	dns_view_setmaxtypepername(view, cfg_obj_asuint32(obj));
+
+ 	obj = NULL;
+ 	result = named_config_get(maps, "max-recursion-depth", &obj);
+ 	INSIST(result == ISC_R_SUCCESS);
+diff --git a/bin/named/zoneconf.c b/bin/named/zoneconf.c
+index 81f6879..821e6a1 100644
+--- a/bin/named/zoneconf.c
+++ b/bin/named/zoneconf.c
+@@ -1080,6 +1080,14 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
+ 		dns_zone_setmaxrrperset(zone, 0);
+ 	}
+ 
+	obj = NULL;
+	result = named_config_get(maps, "max-types-per-name", &obj);
+	INSIST(result == ISC_R_SUCCESS && obj != NULL);
+	dns_zone_setmaxtypepername(mayberaw, cfg_obj_asuint32(obj));
+	if (zone != mayberaw) {
+		dns_zone_setmaxtypepername(zone, 0);
+	}
+
+ 	if (raw != NULL && filename != NULL) {
+ #define SIGNED ".signed"
+ 		size_t signedlen = strlen(filename) + sizeof(SIGNED);
+diff --git a/bin/tests/system/dyndb/driver/db.c b/bin/tests/system/dyndb/driver/db.c
+index 727268f..398589a 100644
+--- a/bin/tests/system/dyndb/driver/db.c
+++ b/bin/tests/system/dyndb/driver/db.c
+@@ -623,7 +623,8 @@ static dns_dbmethods_t sampledb_methods = {
+ 	NULL, /* getservestalerefresh */
+ 	NULL, /* setgluecachestats */
+ 	NULL, /* adjusthashsize */
+-	NULL  /* setmaxrrperset */
+	NULL, /* setmaxrrperset */
+	NULL  /* setmaxtypepername */
+ };
+ 
+ /* Auxiliary driver functions. */
+diff --git a/doc/arm/reference.rst b/doc/arm/reference.rst
+index fbd8edb..0ce2d1f 100644
+--- a/doc/arm/reference.rst
+++ b/doc/arm/reference.rst
+@@ -2957,6 +2957,18 @@ system.
+    a failure.  If set to 0, there is no cap on RRset size.  The default is
+    100.
+ 
+``max-types-per-name``
+   This sets the maximum number of resource record types that can be stored
+   for a single owner name in a database. When configured in ``options``
+   or ``view``, it controls the cache database, and also sets
+   the default value for zone databases, which can be overridden by setting
+   it at the ``zone`` level
+
+   If set to a positive value, any attempt to cache or to add to a zone an owner
+   name with more than the specified number of resource record types will result
+   in a failure.  If set to 0, there is no cap on RR types number.  The default is
+   100.
+   
+ ``recursive-clients``
+    This sets the maximum number (a "hard quota") of simultaneous recursive lookups
+    the server performs on behalf of clients. The default is
+diff --git a/lib/dns/cache.c b/lib/dns/cache.c
+index 8cb442b..125cfdc 100644
+--- a/lib/dns/cache.c
+++ b/lib/dns/cache.c
+@@ -153,6 +153,7 @@ struct dns_cache {
+ 	/* Access to the on-disk cache file is also locked by 'filelock'. */
+ 
+ 	uint32_t maxrrperset;
+	uint32_t maxtypepername;
+ };
+ 
+ /***
+@@ -187,6 +188,7 @@ cache_create_db(dns_cache_t *cache, dns_db_t **db) {
+ 
+ 	dns_db_setservestalettl(*db, cache->serve_stale_ttl);
+ 	dns_db_setmaxrrperset(*db, cache->maxrrperset);
+	dns_db_setmaxtypepername(*db, cache->maxtypepername);
+ 
+ 	if (cache->taskmgr == NULL) {
+ 		return (ISC_R_SUCCESS);
+@@ -1329,6 +1331,16 @@ dns_cache_setmaxrrperset(dns_cache_t *cache, uint32_t value) {
+ 	}
+ }
+ 
+void
+dns_cache_setmaxtypepername(dns_cache_t *cache, uint32_t value) {
+	REQUIRE(VALID_CACHE(cache));
+
+	cache->maxtypepername = value;
+	if (cache->db != NULL) {
+		dns_db_setmaxtypepername(cache->db, value);
+	}
+}
+
+ /*
+  * XXX: Much of the following code has been copied in from statschannel.c.
+  * We should refactor this into a generic function in stats.c that can be
+diff --git a/lib/dns/db.c b/lib/dns/db.c
+index a575d62..1f19016 100644
+--- a/lib/dns/db.c
+++ b/lib/dns/db.c
+@@ -1146,3 +1146,12 @@ dns_db_setmaxrrperset(dns_db_t *db, uint32_t value) {
+ 		(db->methods->setmaxrrperset)(db, value);
+ 	}
+ }
+
+void
+dns_db_setmaxtypepername(dns_db_t *db, uint32_t value) {
+	REQUIRE(DNS_DB_VALID(db));
+
+	if (db->methods->setmaxtypepername != NULL) {
+		(db->methods->setmaxtypepername)(db, value);
+	}
+}
+diff --git a/lib/dns/dnsrps.c b/lib/dns/dnsrps.c
+index f4d9bae..43c28ae 100644
+--- a/lib/dns/dnsrps.c
+++ b/lib/dns/dnsrps.c
+@@ -976,7 +976,8 @@ static dns_dbmethods_t rpsdb_db_methods = {
+ 	NULL, /* getservestalerefresh */
+ 	NULL, /* setgluecachestats */
+ 	NULL, /* adjusthashsize */
+-	NULL  /* setmaxrrperset */
+	NULL, /* setmaxrrperset */
+	NULL  /* setmaxtypepername */
+ };
+ 
+ static dns_rdatasetmethods_t rpsdb_rdataset_methods = {
+diff --git a/lib/dns/ecdb.c b/lib/dns/ecdb.c
+index 42a1248..3e562d8 100644
+--- a/lib/dns/ecdb.c
+++ b/lib/dns/ecdb.c
+@@ -564,7 +564,8 @@ static dns_dbmethods_t ecdb_methods = {
+ 	NULL, /* getservestalerefresh */
+ 	NULL, /* setgluecachestats */
+ 	NULL, /* adjusthashsize */
+-	NULL  /* setmaxrrperset */
+	NULL, /* setmaxrrperset */
+	NULL  /* setmaxtypepername */
+ };
+ 
+ static isc_result_t
+diff --git a/lib/dns/include/dns/cache.h b/lib/dns/include/dns/cache.h
+index 34539eb..eb6f1e9 100644
+--- a/lib/dns/include/dns/cache.h
+++ b/lib/dns/include/dns/cache.h
+@@ -340,6 +340,12 @@ dns_cache_setmaxrrperset(dns_cache_t *cache, uint32_t value);
+  * Set the maximum resource records per RRSet that can be cached.
+  */
+ 
+void
+dns_cache_setmaxtypepername(dns_cache_t *cache, uint32_t value);
+/*%<
+ * Set the maximum resource record types per owner name that can be cached.
+ */
+
+ #ifdef HAVE_LIBXML2
+ int
+ dns_cache_renderxml(dns_cache_t *cache, void *writer0);
+diff --git a/lib/dns/include/dns/db.h b/lib/dns/include/dns/db.h
+index e0d17f2..3c6c7f2 100644
+--- a/lib/dns/include/dns/db.h
+++ b/lib/dns/include/dns/db.h
+@@ -185,6 +185,7 @@ typedef struct dns_dbmethods {
+ 	isc_result_t (*setgluecachestats)(dns_db_t *db, isc_stats_t *stats);
+ 	isc_result_t (*adjusthashsize)(dns_db_t *db, size_t size);
+ 	void (*setmaxrrperset)(dns_db_t *db, uint32_t value);
+	void (*setmaxtypepername)(dns_db_t *db, uint32_t value);
+ } dns_dbmethods_t;
+ 
+ typedef isc_result_t (*dns_dbcreatefunc_t)(isc_mem_t	    *mctx,
+@@ -1804,6 +1805,16 @@ dns_db_setmaxrrperset(dns_db_t *db, uint32_t value);
+  * is nonzero, then any subsequent attempt to add an rdataset with
+  * more than 'value' RRs will return ISC_R_NOSPACE.
+  */
+
+void
+dns_db_setmaxtypepername(dns_db_t *db, uint32_t value);
+/*%<
+ * Set the maximum permissible number of RR types per owner name.
+ *
+ * If 'value' is nonzero, then any subsequent attempt to add an rdataset with a
+ * RR type that would exceed the number of already stored RR types will return
+ * ISC_R_NOSPACE.
+ */
+ ISC_LANG_ENDDECLS
+ 
+ #endif /* DNS_DB_H */
+diff --git a/lib/dns/include/dns/view.h b/lib/dns/include/dns/view.h
+index b7cf663..4151c11 100644
+--- a/lib/dns/include/dns/view.h
+++ b/lib/dns/include/dns/view.h
+@@ -189,6 +189,7 @@ struct dns_view {
+ 	uint32_t	  fail_ttl;
+ 	dns_badcache_t	 *failcache;
+ 	uint32_t	  maxrrperset;
+	uint32_t	  maxtypepername;
+ 
+ 	/*
+ 	 * Configurable data for server use only,
+@@ -1361,6 +1362,12 @@ dns_view_setmaxrrperset(dns_view_t *view, uint32_t value);
+  * Set the maximum resource records per RRSet that can be cached.
+  */
+ 
+void
+dns_view_setmaxtypepername(dns_view_t *view, uint32_t value);
+/*%<
+ * Set the maximum resource record types per owner name that can be cached.
+ */
+
+ ISC_LANG_ENDDECLS
+ 
+ #endif /* DNS_VIEW_H */
+diff --git a/lib/dns/include/dns/zone.h b/lib/dns/include/dns/zone.h
+index a98b28f..d893dd2 100644
+--- a/lib/dns/include/dns/zone.h
+++ b/lib/dns/include/dns/zone.h
+@@ -358,6 +358,19 @@ dns_zone_setmaxrrperset(dns_zone_t *zone, uint32_t maxrrperset);
+  *\li	void
+  */
+ 
+void
+dns_zone_setmaxtypepername(dns_zone_t *zone, uint32_t maxtypepername);
+/*%<
+ * 	Sets the maximum number of resource record types per owner name
+ *	permitted in a zone.  0 implies unlimited.
+ *
+ * Requires:
+ *\li	'zone' to be valid initialised zone.
+ *
+ * Returns:
+ *\li	void
+ */
+
+ void
+ dns_zone_setmaxttl(dns_zone_t *zone, uint32_t maxttl);
+ /*%<
+diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
+index e8de346..c2cd63e 100644
+--- a/lib/dns/rbtdb.c
+++ b/lib/dns/rbtdb.c
+@@ -497,6 +497,7 @@ struct dns_rbtdb {
+ 	rbtdb_serial_t least_serial;
+ 	rbtdb_serial_t next_serial;
+ 	uint32_t maxrrperset;
+	uint32_t maxtypepername;
+ 	rbtdb_version_t *current_version;
+ 	rbtdb_version_t *future_version;
+ 	rbtdb_versionlist_t open_versions;
+@@ -6259,19 +6260,13 @@ update_recordsandxfrsize(bool add, rbtdb_version_t *rbtversion,
+ 	RWUNLOCK(&rbtversion->rwlock, isc_rwlocktype_write);
+ }
+ 
+-#ifndef DNS_RBTDB_MAX_RTYPES
+-#define DNS_RBTDB_MAX_RTYPES 100
+-#endif /* DNS_RBTDB_MAX_RTYPES */
+-
+ static bool
+ overmaxtype(dns_rbtdb_t *rbtdb, uint32_t ntypes) {
+-	UNUSED(rbtdb);
+-
+-	if (DNS_RBTDB_MAX_RTYPES == 0) {
+	if (rbtdb->maxtypepername == 0) {
+ 		return (false);
+ 	}
+ 
+-	return (ntypes >= DNS_RBTDB_MAX_RTYPES);
+	return (ntypes >= rbtdb->maxtypepername);
+ }
+ 
+ static bool
+@@ -6809,7 +6804,7 @@ find_header:
+ 			if (!IS_CACHE(rbtdb) && overmaxtype(rbtdb, ntypes)) {
+ 				free_rdataset(rbtdb, rbtdb->common.mctx,
+ 					      newheader);
+-				return (ISC_R_QUOTA);
+				return (DNS_R_TOOMANYRECORDS);
+ 			}
+ 
+ 			newheader->down = NULL;
+@@ -8627,6 +8622,15 @@ setmaxrrperset(dns_db_t *db, uint32_t maxrrperset) {
+ 	rbtdb->maxrrperset = maxrrperset;
+ }
+ 
+static void
+setmaxtypepername(dns_db_t *db, uint32_t maxtypepername) {
+	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
+
+	REQUIRE(VALID_RBTDB(rbtdb));
+
+	rbtdb->maxtypepername = maxtypepername;
+}
+
+ static dns_stats_t *
+ getrrsetstats(dns_db_t *db) {
+ 	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
+@@ -8751,7 +8755,8 @@ static dns_dbmethods_t zone_methods = { attach,
+ 					NULL, /* getservestalerefresh */
+ 					setgluecachestats,
+ 					adjusthashsize,
+-					setmaxrrperset };
+					setmaxrrperset,
+					setmaxtypepername };
+ 
+ static dns_dbmethods_t cache_methods = { attach,
+ 					 detach,
+@@ -8804,7 +8809,8 @@ static dns_dbmethods_t cache_methods = { attach,
+ 					 getservestalerefresh,
+ 					 NULL,
+ 					 adjusthashsize,
+-					 setmaxrrperset };
+					 setmaxrrperset,
+					 setmaxtypepername };
+ 
+ isc_result_t
+ dns_rbtdb_create(isc_mem_t *mctx, const dns_name_t *origin, dns_dbtype_t type,
+diff --git a/lib/dns/sdb.c b/lib/dns/sdb.c
+index 282c327..4438091 100644
+--- a/lib/dns/sdb.c
+++ b/lib/dns/sdb.c
+@@ -1320,7 +1320,8 @@ static dns_dbmethods_t sdb_methods = {
+ 	NULL, /* getservestalerefresh */
+ 	NULL, /* setgluecachestats */
+ 	NULL, /* adjusthashsize */
+-	NULL  /* setmaxrrperset */
+	NULL, /* setmaxrrperset */
+	NULL  /* setmaxtypepername */
+ };
+ 
+ static isc_result_t
+diff --git a/lib/dns/sdlz.c b/lib/dns/sdlz.c
+index 299c7d8..a8556df 100644
+--- a/lib/dns/sdlz.c
+++ b/lib/dns/sdlz.c
+@@ -1293,7 +1293,8 @@ static dns_dbmethods_t sdlzdb_methods = {
+ 	NULL, /* getservestalerefresh */
+ 	NULL, /* setgluecachestats */
+ 	NULL, /* adjusthashsize */
+-	NULL  /* setmaxrrperset */
+	NULL, /* setmaxrrperset */
+	NULL  /* setmaxtypepername */
+ };
+ 
+ /*
+diff --git a/lib/dns/view.c b/lib/dns/view.c
+index 9f5daf7..0de880d 100644
+--- a/lib/dns/view.c
+++ b/lib/dns/view.c
+@@ -873,6 +873,7 @@ dns_view_setcache(dns_view_t *view, dns_cache_t *cache, bool shared) {
+ 	INSIST(DNS_DB_VALID(view->cachedb));
+ 
+ 	dns_cache_setmaxrrperset(view->cache, view->maxrrperset);
+	dns_cache_setmaxtypepername(view->cache, view->maxtypepername);
+ }
+ 
+ bool
+@@ -2651,3 +2652,12 @@ dns_view_setmaxrrperset(dns_view_t *view, uint32_t value) {
+ 		dns_cache_setmaxrrperset(view->cache, value);
+ 	}
+ }
+
+void
+dns_view_setmaxtypepername(dns_view_t *view, uint32_t value) {
+	REQUIRE(DNS_VIEW_VALID(view));
+	view->maxtypepername = value;
+	if (view->cache != NULL) {
+		dns_cache_setmaxtypepername(view->cache, value);
+	}
+}
+diff --git a/lib/dns/zone.c b/lib/dns/zone.c
+index 301f440..ae5ef43 100644
+--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
+@@ -308,6 +308,7 @@ struct dns_zone {
+ 
+ 	uint32_t maxrecords;
+ 	uint32_t maxrrperset;
+	uint32_t maxtypepername;
+ 
+ 	isc_sockaddr_t *masters;
+ 	isc_dscp_t *masterdscps;
+@@ -10060,6 +10061,7 @@ cleanup:
+ 	}
+ 
+ 	dns_diff_clear(&_sig_diff);
+	dns_diff_clear(&post_diff);
+ 
+ 	for (i = 0; i < nkeys; i++) {
+ 		dst_key_free(&zone_keys[i]);
+@@ -12319,6 +12321,16 @@ dns_zone_setmaxrrperset(dns_zone_t *zone, uint32_t val) {
+ 	}
+ }
+ 
+void
+dns_zone_setmaxtypepername(dns_zone_t *zone, uint32_t val) {
+	REQUIRE(DNS_ZONE_VALID(zone));
+
+	zone->maxtypepername = val;
+	if (zone->db != NULL) {
+		dns_db_setmaxtypepername(zone->db, val);
+	}
+}
+
+ static bool
+ notify_isqueued(dns_zone_t *zone, unsigned int flags, dns_name_t *name,
+ 		isc_sockaddr_t *addr, dns_tsigkey_t *key) {
+@@ -14733,6 +14745,8 @@ ns_query(dns_zone_t *zone, dns_rdataset_t *soardataset, dns_stub_t *stub) {
+ 			}
+ 			dns_db_settask(stub->db, zone->task, zone->task);
+ 			dns_db_setmaxrrperset(stub->db, zone->maxrrperset);
+			dns_db_setmaxtypepername(stub->db,
+						 zone->maxtypepername);
+ 		}
+ 
+ 		result = dns_db_newversion(stub->db, &stub->version);
+@@ -17476,6 +17490,7 @@ zone_replacedb(dns_zone_t *zone, dns_db_t *db, bool dump) {
+ 	zone_attachdb(zone, db);
+ 	dns_db_settask(zone->db, zone->task, zone->task);
+ 	dns_db_setmaxrrperset(zone->db, zone->maxrrperset);
+	dns_db_setmaxtypepername(zone->db, zone->maxtypepername);
+ 	DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_LOADED | DNS_ZONEFLG_NEEDNOTIFY);
+ 	return (ISC_R_SUCCESS);
+ 
+@@ -23659,6 +23674,7 @@ dns_zone_makedb(dns_zone_t *zone, dns_db_t **dbp) {
+ 
+ 	dns_db_settask(db, zone->task, zone->task);
+ 	dns_db_setmaxrrperset(db, zone->maxrrperset);
+	dns_db_setmaxtypepername(db, zone->maxtypepername);
+ 
+ 	*dbp = db;
+ 
+diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
+index ffe22b3..69525dc 100644
+--- a/lib/isccfg/namedconf.c
+++ b/lib/isccfg/namedconf.c
+@@ -2244,6 +2244,9 @@ static cfg_clausedef_t zone_clauses[] = {
+ 	{ "max-records-per-type", &cfg_type_uint32,
+ 	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR |
+ 		  CFG_ZONE_STUB | CFG_ZONE_STATICSTUB | CFG_ZONE_REDIRECT },
+	{ "max-types-per-name", &cfg_type_uint32,
+	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR |
+		  CFG_ZONE_STUB | CFG_ZONE_STATICSTUB | CFG_ZONE_REDIRECT },
+ 	{ "max-refresh-time", &cfg_type_uint32,
+ 	  CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR | CFG_ZONE_STUB },
+ 	{ "max-retry-time", &cfg_type_uint32,
+diff --git a/lib/ns/update.c b/lib/ns/update.c
+index 4e51cdc..d9cea2c 100644
+--- a/lib/ns/update.c
+++ b/lib/ns/update.c
+@@ -3136,9 +3136,18 @@ update_action(isc_task_t *task, isc_event_t *event) {
+ 						dns_diff_clear(&ctx.add_diff);
+ 						goto failure;
+ 					}
+-					CHECK(update_one_rr(db, ver, &diff,
+-							    DNS_DIFFOP_ADD,
+-							    name, ttl, &rdata));
+					result = update_one_rr(
+						db, ver, &diff, DNS_DIFFOP_ADD,
+						name, ttl, &rdata);
+					if (result != ISC_R_SUCCESS) {
+						update_log(client, zone,
+							   LOGLEVEL_PROTOCOL,
+							   "adding an RR "
+							   "failed: %s",
+							   isc_result_totext(
+								   result));
+						goto failure;
+					}
+ 				}
+ 			}
+ 		} else if (update_class == dns_rdataclass_any) {
+-- 
+2.51.1
+
--- a/SOURCES/bind-9.16-CVE-2024-1737.patch
+++ b/SOURCES/bind-9.16-CVE-2024-1737.patch
@ -0,0 +1,360 @@
+From aed0e33be79d1d1b133208846d943503c4f2e6a8 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
+Date: Fri, 1 Mar 2024 08:26:07 +0100
+Subject: [PATCH] Add a limit to the number of RRs in RRSets
+
+Previously, the number of RRs in the RRSets were internally unlimited.
+As the data structure that holds the RRs is just a linked list, and
+there are places where we just walk through all of the RRs, adding an
+RRSet with huge number of RRs inside would slow down processing of said
+RRSets.
+
+The fix for end-of-life branches make the limit compile-time only for
+simplicity and the limit can be changed at the compile time by adding
+following define to CFLAGS:
+
+    -DDNS_RDATASET_MAX_RECORDS=<limit>
+
+(cherry picked from commit c5c4d00c38530390c9e1ae4c98b65fbbadfe9e5e)
+(cherry picked from commit fdabf4b9570a60688f9f7d1e88d885f7a3718bca)
+
+Add a limit to the number of RR types for single name
+
+Previously, the number of RR types for a single owner name was limited
+only by the maximum number of the types (64k).  As the data structure
+that holds the RR types for the database node is just a linked list, and
+there are places where we just walk through the whole list (again and
+again), adding a large number of RR types for a single owner named with
+would slow down processing of such name (database node).
+
+Add a hard-coded limit (100) to cap the number of the RR types for a single
+owner.  The limit can be changed at the compile time by adding following
+define to CFLAGS:
+
+    -DDNS_RBTDB_MAX_RTYPES=<limit>
+
+(cherry picked from commit dfcadc2085c8844b5836aff2b5ea51fb60c34868)
+
+Optimize the slabheader placement for certain RRTypes
+
+Mark the infrastructure RRTypes as "priority" types and place them at
+the beginning of the rdataslab header data graph.  The non-priority
+types either go right after the priority types (if any).
+
+(cherry picked from commit 3ac482be7fd058d284e89873021339579fad0615)
+(cherry picked from commit 8ef414a7f38a04cfc11df44adaedaf3126fa3878)
+
+Expand the list of the priority types
+
+Add HTTPS, SVCB, SRV, PTR, NAPTR, DNSKEY and TXT records to the list of
+the priority types that are put at the beginning of the slabheader list
+for faster access and to avoid eviction when there are more types than
+the max-types-per-name limit.
+
+(cherry picked from commit b27c6bcce894786a8e082eafd59eccbf6f2731cb)
+(cherry picked from commit d56d2a32b861e81c2aaaabd309c4c58b629ede32)
+
+Make the resolver qtype ANY test order agnostic
+
+Instead of relying on a specific order of the RR types in the databases
+pick the first RR type as returned from the cache.
+
+(cherry picked from commit 58f660cf2b800963fa649bc9823a626009db3a7e)
+(cherry picked from commit c5ebda6deb0997dc520b26fa0639891459de5cb6)
+
+Be smarter about refusing to add many RR types to the database
+
+Instead of outright refusing to add new RR types to the cache, be a bit
+smarter:
+
+1. If the new header type is in our priority list, we always add either
+   positive or negative entry at the beginning of the list.
+
+2. If the new header type is negative entry, and we are over the limit,
+   we mark it as ancient immediately, so it gets evicted from the cache
+   as soon as possible.
+
+3. Otherwise add the new header after the priority headers (or at the
+   head of the list).
+
+4. If we are over the limit, evict the last entry on the normal header
+   list.
+
+(cherry picked from commit 57cd34441a1b4ecc9874a4a106c2c95b8d7a3120)
+(cherry picked from commit 26c9da5f2857b72077c17e06ac79f068c63782cc)
+---
+ bin/tests/system/resolver/tests.sh |  9 ++--
+ configure                          |  2 +-
+ configure.ac                       |  2 +-
+ lib/dns/rbtdb.c                    | 83 +++++++++++++++++++++++++++++-
+ lib/dns/rdataslab.c                | 12 +++++
+ lib/dns/zone.c                     | 13 -----
+ 6 files changed, 100 insertions(+), 21 deletions(-)
+
+diff --git a/bin/tests/system/resolver/tests.sh b/bin/tests/system/resolver/tests.sh
+index fc05635e31..09fff0dd13 100755
+--- a/bin/tests/system/resolver/tests.sh
+++ b/bin/tests/system/resolver/tests.sh
+@@ -596,18 +596,17 @@ n=$((n + 1))
+ echo_i "check prefetch qtype * (${n})"
+ ret=0
+ dig_with_opts @10.53.0.5 fetchall.tld any >dig.out.1.${n} || ret=1
+-ttl1=$(awk '/"A" "short" "ttl"/ { print $2 - 3 }' dig.out.1.${n})
+ttl1=$(awk '/^fetchall.tld/ { print $2 - 3; exit }' dig.out.1.${n})
+ # sleep so we are in prefetch range
+ sleep "${ttl1:-0}"
+ # trigger prefetch
+ dig_with_opts @10.53.0.5 fetchall.tld any >dig.out.2.${n} || ret=1
+-ttl2=$(awk '/"A" "short" "ttl"/ { print $2 }' dig.out.2.${n})
+ttl2=$(awk '/^fetchall.tld/ { print $2; exit }' dig.out.2.${n})
+ sleep 1
+-# check that prefetch occurred;
+-# note that only one record is prefetched, which is the AAAA record in this case,
+# note that only the first record is prefetched,
+ # because of the order of the records in the cache
+ dig_with_opts @10.53.0.5 fetchall.tld any >dig.out.3.${n} || ret=1
+-ttl3=$(awk '/::1/ { print $2 }' dig.out.3.${n})
+ttl3=$(awk '/^fetchall.tld/ { print $2; exit }' dig.out.3.${n})
+ test "${ttl3:-0}" -gt "${ttl2:-1}" || ret=1
+ if [ $ret != 0 ]; then echo_i "failed"; fi
+ status=$((status + ret))
+diff --git a/configure b/configure
+index 1b436d63eb..835cd94dff 100755
+--- a/configure
+++ b/configure
+@@ -12341,7 +12341,7 @@ fi
+ 
+ XTARGETS=
+ if test "$enable_developer" = "yes"; then :
+-  STD_CDEFINES="$STD_CDEFINES -DISC_MEM_DEFAULTFILL=1 -DISC_LIST_CHECKINIT=1"
+  STD_CDEFINES="$STD_CDEFINES -DISC_MEM_DEFAULTFILL=1 -DISC_LIST_CHECKINIT=1 -DDNS_RDATASET_MAX_RECORDS=5000 -DDNS_RBTDB_MAX_RTYPES=5000"
+        test "${enable_fixed_rrset+set}" = set || enable_fixed_rrset=yes
+        test "${enable_querytrace+set}" = set || enable_querytrace=yes
+        test "${with_cmocka+set}" = set || with_cmocka=yes
+diff --git a/configure.ac b/configure.ac
+index fb6f172eae..6db42501a2 100644
+--- a/configure.ac
+++ b/configure.ac
+@@ -96,7 +96,7 @@ AC_ARG_ENABLE([developer],
+ 
+ XTARGETS=
+ AS_IF([test "$enable_developer" = "yes"],
+-      [STD_CDEFINES="$STD_CDEFINES -DISC_MEM_DEFAULTFILL=1 -DISC_LIST_CHECKINIT=1"
+      [STD_CDEFINES="$STD_CDEFINES -DISC_MEM_DEFAULTFILL=1 -DISC_LIST_CHECKINIT=1 -DDNS_RDATASET_MAX_RECORDS=5000 -DDNS_RBTDB_MAX_RTYPES=5000"
+        test "${enable_fixed_rrset+set}" = set || enable_fixed_rrset=yes
+        test "${enable_querytrace+set}" = set || enable_querytrace=yes
+        test "${with_cmocka+set}" = set || with_cmocka=yes
+diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
+index 3f06545aa1..d4c1829c26 100644
+--- a/lib/dns/rbtdb.c
+++ b/lib/dns/rbtdb.c
+@@ -990,6 +990,8 @@ prio_type(rbtdb_rdatatype_t type) {
+ 	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_soa):
+ 	case dns_rdatatype_a:
+ 	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_a):
+	case dns_rdatatype_mx:
+	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_mx):
+ 	case dns_rdatatype_aaaa:
+ 	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_aaaa):
+ 	case dns_rdatatype_nsec:
+@@ -1002,6 +1004,22 @@ prio_type(rbtdb_rdatatype_t type) {
+ 	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_ds):
+ 	case dns_rdatatype_cname:
+ 	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_cname):
+	case dns_rdatatype_dname:
+	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_dname):
+	case dns_rdatatype_svcb:
+	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_svcb):
+	case dns_rdatatype_https:
+	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_https):
+	case dns_rdatatype_dnskey:
+	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_dnskey):
+	case dns_rdatatype_srv:
+	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_srv):
+	case dns_rdatatype_txt:
+	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_txt):
+	case dns_rdatatype_ptr:
+	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_ptr):
+	case dns_rdatatype_naptr:
+	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_naptr):
+ 		return (true);
+ 	}
+ 	return (false);
+@@ -6240,6 +6258,30 @@ update_recordsandxfrsize(bool add, rbtdb_version_t *rbtversion,
+ 	RWUNLOCK(&rbtversion->rwlock, isc_rwlocktype_write);
+ }
+ 
+#ifndef DNS_RBTDB_MAX_RTYPES
+#define DNS_RBTDB_MAX_RTYPES 100
+#endif /* DNS_RBTDB_MAX_RTYPES */
+
+static bool
+overmaxtype(dns_rbtdb_t *rbtdb, uint32_t ntypes) {
+	UNUSED(rbtdb);
+
+	if (DNS_RBTDB_MAX_RTYPES == 0) {
+		return (false);
+	}
+
+	return (ntypes >= DNS_RBTDB_MAX_RTYPES);
+}
+
+static bool
+prio_header(rdatasetheader_t *header) {
+	if (NEGATIVE(header) && prio_type(RBTDB_RDATATYPE_EXT(header->type))) {
+		return (true);
+	}
+
+	return (prio_type(header->type));
+}
+
+ /*
+  * write lock on rbtnode must be held.
+  */
+@@ -6251,7 +6293,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, const dns_name_t *nodename,
+ 	rbtdb_changed_t *changed = NULL;
+ 	rdatasetheader_t *topheader = NULL, *topheader_prev = NULL;
+ 	rdatasetheader_t *header = NULL, *sigheader = NULL;
+-	rdatasetheader_t *prioheader = NULL;
+	rdatasetheader_t *prioheader = NULL, *expireheader = NULL;
+ 	unsigned char *merged = NULL;
+ 	isc_result_t result;
+ 	bool header_nx;
+@@ -6261,6 +6303,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, const dns_name_t *nodename,
+ 	rbtdb_rdatatype_t negtype, sigtype;
+ 	dns_trust_t trust;
+ 	int idx;
+	uint32_t ntypes = 0;
+ 
+ 	/*
+ 	 * Add an rdatasetheader_t to a node.
+@@ -6336,6 +6379,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, const dns_name_t *nodename,
+ 			{
+ 				if (topheader->type == sigtype) {
+ 					sigheader = topheader;
+					break;
+ 				}
+ 			}
+ 			negtype = RBTDB_RDATATYPE_VALUE(covers, 0);
+@@ -6398,6 +6442,12 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, const dns_name_t *nodename,
+ 	for (topheader = rbtnode->data; topheader != NULL;
+ 	     topheader = topheader->next)
+ 	{
+		if (IS_CACHE(rbtdb) && ACTIVE(topheader, now)) {
+			++ntypes;
+			expireheader = topheader;
+		} else if (!IS_CACHE(rbtdb)) {
+			++ntypes;
+		}
+ 		if (prio_type(topheader->type)) {
+ 			prioheader = topheader;
+ 		}
+@@ -6755,6 +6805,12 @@ find_header:
+ 			/*
+ 			 * No rdatasets of the given type exist at the node.
+ 			 */
+			if (!IS_CACHE(rbtdb) && overmaxtype(rbtdb, ntypes)) {
+				free_rdataset(rbtdb, rbtdb->common.mctx,
+					      newheader);
+				return (ISC_R_QUOTA);
+			}
+
+ 			newheader->down = NULL;
+ 
+ 			if (prio_type(newheader->type)) {
+@@ -6770,6 +6826,31 @@ find_header:
+ 				newheader->next = rbtnode->data;
+ 				rbtnode->data = newheader;
+ 			}
+
+			if (IS_CACHE(rbtdb) && overmaxtype(rbtdb, ntypes)) {
+				if (expireheader == NULL) {
+					expireheader = newheader;
+				}
+				if (NEGATIVE(newheader) &&
+				    !prio_header(newheader))
+				{
+					/*
+					 * Add the new non-priority negative
+					 * header to the database only
+					 * temporarily.
+					 */
+					expireheader = newheader;
+				}
+
+				set_ttl(rbtdb, expireheader, 0);
+				mark_header_ancient(rbtdb, expireheader);
+				/*
+				 * FIXME: In theory, we should mark the RRSIG
+				 * and the header at the same time, but there is
+				 * no direct link between those two header, so
+				 * we would have to check the whole list again.
+				 */
+			}
+ 		}
+ 	}
+ 
+diff --git a/lib/dns/rdataslab.c b/lib/dns/rdataslab.c
+index 14c43818b8..d74e84ce4a 100644
+--- a/lib/dns/rdataslab.c
+++ b/lib/dns/rdataslab.c
+@@ -112,6 +112,10 @@ fillin_offsets(unsigned char *offsetbase, unsigned int *offsettable,
+ }
+ #endif /* if DNS_RDATASET_FIXED */
+ 
+#ifndef DNS_RDATASET_MAX_RECORDS
+#define DNS_RDATASET_MAX_RECORDS 100
+#endif /* DNS_RDATASET_MAX_RECORDS */
+
+ isc_result_t
+ dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx,
+ 			   isc_region_t *region, unsigned int reservelen) {
+@@ -156,6 +160,10 @@ dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx,
+ 		return (ISC_R_SUCCESS);
+ 	}
+ 
+	if (nitems > DNS_RDATASET_MAX_RECORDS) {
+		return (DNS_R_TOOMANYRECORDS);
+	}
+
+ 	if (nitems > 0xffff) {
+ 		return (ISC_R_NOSPACE);
+ 	}
+@@ -524,6 +532,10 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab,
+ #endif /* if DNS_RDATASET_FIXED */
+ 	INSIST(ocount > 0 && ncount > 0);
+ 
+	if (ocount + ncount > DNS_RDATASET_MAX_RECORDS) {
+		return (DNS_R_TOOMANYRECORDS);
+	}
+
+ #if DNS_RDATASET_FIXED
+ 	oncount = ncount;
+ #endif /* if DNS_RDATASET_FIXED */
+diff --git a/lib/dns/zone.c b/lib/dns/zone.c
+index b457095907..53da95a7d7 100644
+--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
+@@ -2316,19 +2316,6 @@ zone_load(dns_zone_t *zone, unsigned int flags, bool locked) {
+ 			      isc_result_totext(result));
+ 		goto cleanup;
+ 	}
+-	dns_db_settask(db, zone->task, zone->task);
+-
+-	if (zone->type == dns_zone_primary ||
+-	    zone->type == dns_zone_secondary || zone->type == dns_zone_mirror)
+-	{
+-		result = dns_db_setgluecachestats(db, zone->gluecachestats);
+-		if (result == ISC_R_NOTIMPLEMENTED) {
+-			result = ISC_R_SUCCESS;
+-		}
+-		if (result != ISC_R_SUCCESS) {
+-			goto cleanup;
+-		}
+-	}
+ 
+ 	if (!dns_db_ispersistent(db)) {
+ 		if (zone->masterfile != NULL) {
+-- 
+2.53.0
+
--- a/SOURCES/bind-9.16-CVE-2024-1975.patch
+++ b/SOURCES/bind-9.16-CVE-2024-1975.patch
@ -0,0 +1,320 @@
+From ec67f14dc90e17acf08708e53a2166e0554b25ca Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Tue, 16 Jul 2024 19:49:09 +0200
+Subject: [PATCH] Resolve CVE-2024-1975
+
+6404.	[security]	Remove SIG(0) support from named as a countermeasure
+			for CVE-2024-1975. [GL #4480]
+
+Resolves: CVE-2024-1975
+---
+ bin/tests/system/tsiggss/authsock.pl |  5 ++
+ bin/tests/system/tsiggss/tests.sh    | 12 ++--
+ bin/tests/system/upforwd/tests.sh    | 21 +++---
+ doc/arm/general.rst                  |  6 +-
+ doc/arm/reference.rst                |  4 +-
+ doc/arm/security.rst                 |  4 +-
+ lib/dns/message.c                    | 99 ++--------------------------
+ lib/ns/client.c                      |  7 ++
+ 8 files changed, 43 insertions(+), 115 deletions(-)
+
+diff --git a/bin/tests/system/tsiggss/authsock.pl b/bin/tests/system/tsiggss/authsock.pl
+index d629c65..b3888fb 100644
+--- a/bin/tests/system/tsiggss/authsock.pl
+++ b/bin/tests/system/tsiggss/authsock.pl
+@@ -33,6 +33,10 @@ if (!defined($path)) {
+ 	exit(1);
+ }
+ 
+# Enable output autoflush so that it's not lost when the parent sends TERM.
+select STDOUT;
+$| = 1;
+
+ unlink($path);
+ my $server = IO::Socket::UNIX->new(Local => $path, Type => SOCK_STREAM, Listen => 8) or
+     die "unable to create socket $path";
+@@ -55,6 +59,7 @@ if ($timeout != 0) {
+ }
+ 
+ while (my $client = $server->accept()) {
+	printf("accept()\n");
+ 	$client->recv(my $buf, 8, 0);
+ 	my ($version, $req_len) = unpack('N N', $buf);
+ 
+diff --git a/bin/tests/system/tsiggss/tests.sh b/bin/tests/system/tsiggss/tests.sh
+index a665703..34b8c89 100644
+--- a/bin/tests/system/tsiggss/tests.sh
+++ b/bin/tests/system/tsiggss/tests.sh
+@@ -116,7 +116,7 @@ status=$((status + ret))
+ 
+ echo_i "testing external update policy (CNAME) with auth sock ($n)"
+ ret=0
+-$PERL ./authsock.pl --type=CNAME --path=ns1/auth.sock --pidfile=authsock.pid --timeout=120 >/dev/null 2>&1 &
+$PERL ./authsock.pl --type=CNAME --path=ns1/auth.sock --pidfile=authsock.pid --timeout=120 >authsock.log 2>&1 &
+ sleep 1
+ test_update $n testcname.example.nil. CNAME "86400 CNAME testdenied.example.nil" "testdenied" || ret=1
+ n=$((n + 1))
+@@ -130,17 +130,19 @@ n=$((n + 1))
+ if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
+ status=$((status + ret))
+ 
+-echo_i "testing external policy with SIG(0) key ($n)"
+echo_i "testing external policy with unsupported SIG(0) key ($n)"
+ ret=0
+-$NSUPDATE -k ns1/Kkey.example.nil.*.private <<END >/dev/null 2>&1 || ret=1
+$NSUPDATE -d -k ns1/Kkey.example.nil.*.private <<END >nsupdate.out${n} 2>&1 || true
+debug
+ server 10.53.0.1 ${PORT}
+ zone example.nil
+ update add fred.example.nil 120 cname foo.bar.
+ send
+ END
+ output=$($DIG $DIGOPTS +short cname fred.example.nil.)
+-[ -n "$output" ] || ret=1
+-[ $ret -eq 0 ] || echo_i "failed"
+# update must have failed - SIG(0) signer is not supported
+[ -n "$output" ] && ret=1
+grep -F "signer=key.example.nil" authsock.log >/dev/null && ret=1
+ n=$((n + 1))
+ if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
+ status=$((status + ret))
+diff --git a/bin/tests/system/upforwd/tests.sh b/bin/tests/system/upforwd/tests.sh
+index 063e28d..0947166 100644
+--- a/bin/tests/system/upforwd/tests.sh
+++ b/bin/tests/system/upforwd/tests.sh
+@@ -262,19 +262,22 @@ if $FEATURETEST --enable-dnstap; then
+ fi
+ 
+ if test -f keyname; then
+-  echo_i "checking update forwarding to with sig0 ($n)"
+  echo_i "checking update forwarding to with sig0 (expected to fail) ($n)"
+   ret=0
+   keyname=$(cat keyname)
+-  $NSUPDATE -k $keyname.private -- - <<EOF
+-	local 10.53.0.1
+-	server 10.53.0.3 ${PORT}
+-	zone example2
+-	update add unsigned.example2. 600 A 10.10.10.1
+-	update add unsigned.example2. 600 TXT Foo
+-	send
+	# SIG(0) is removed, update is expected to fail.
+	{
+	  $NSUPDATE -k $keyname.private -- - <<EOF
+	  local 10.53.0.1
+	  server 10.53.0.3 ${PORT}
+	  zone example2
+	  update add unsigned.example2. 600 A 10.10.10.1
+	  update add unsigned.example2. 600 TXT Foo
+	  send
+ EOF
+	} >nsupdate.out.$n 2>&1 && ret=1
+   $DIG -p ${PORT} unsigned.example2 A @10.53.0.1 >dig.out.ns1.test$n || ret=1
+-  grep "status: NOERROR" dig.out.ns1.test$n >/dev/null || ret=1
+  grep "status: NOERROR" dig.out.ns1.test$n >/dev/null && ret=1
+   if [ $ret != 0 ]; then echo_i "failed"; fi
+   status=$(expr $status + $ret)
+   n=$(expr $n + 1)
+diff --git a/doc/arm/general.rst b/doc/arm/general.rst
+index d7b7c20..59f9e6b 100644
+--- a/doc/arm/general.rst
+++ b/doc/arm/general.rst
+@@ -367,10 +367,8 @@ Notes
+ .. [#rfc1035_2] CLASS ANY queries are not supported. This is considered a
+    feature.
+ 
+-.. [#rfc2931] When receiving a query signed with a SIG(0), the server is
+-   only able to verify the signature if it has the key in its local
+-   authoritative data; it cannot do recursion or validation to
+-   retrieve unknown keys.
+.. [#rfc2931] Support for SIG(0) message verification was removed
+   as part of the mitigation of CVE-2024-1975.
+ 
+ .. [#rfc2874] Compliance is with loading and serving of A6 records only.
+    A6 records were moved to the experimental category by :rfc:`3363`.
+diff --git a/doc/arm/reference.rst b/doc/arm/reference.rst
+index ecc84d4..f982e0a 100644
+--- a/doc/arm/reference.rst
+++ b/doc/arm/reference.rst
+@@ -5900,7 +5900,7 @@ The ``update-policy`` clause allows more fine-grained control over which
+ updates are allowed. It specifies a set of rules, in which each rule
+ either grants or denies permission for one or more names in the zone to
+ be updated by one or more identities. Identity is determined by the key
+-that signed the update request, using either TSIG or SIG(0). In most
+that signed the update request, using either TSIG. In most
+ cases, ``update-policy`` rules only apply to key-based identities. There
+ is no way to specify update permissions based on the client source address.
+ 
+@@ -5957,7 +5957,7 @@ field), and the type of the record to be updated matches the ``types``
+ field. Details for each rule type are described below.
+ 
+ The ``identity`` field must be set to a fully qualified domain name. In
+-most cases, this represents the name of the TSIG or SIG(0) key that
+most cases, this represents the name of the TSIG key that
+ must be used to sign the update request. If the specified name is a
+ wildcard, it is subject to DNS wildcard expansion, and the rule may
+ apply to multiple identities. When a TKEY exchange has been used to
+diff --git a/doc/arm/security.rst b/doc/arm/security.rst
+index 817ebd0..92b1668 100644
+--- a/doc/arm/security.rst
+++ b/doc/arm/security.rst
+@@ -83,7 +83,7 @@ Limiting access to the server by outside parties can help prevent
+ spoofing and denial of service (DoS) attacks against the server.
+ 
+ ACLs match clients on the basis of up to three characteristics: 1) The
+-client's IP address; 2) the TSIG or SIG(0) key that was used to sign the
+client's IP address; 2) the TSIG key that was used to sign the
+ request, if any; and 3) an address prefix encoded in an EDNS
+ Client-Subnet option, if any.
+ 
+@@ -124,7 +124,7 @@ and no queries at all from the networks specified in ``bogusnets``.
+ 
+ In addition to network addresses and prefixes, which are matched against
+ the source address of the DNS request, ACLs may include ``key``
+-elements, which specify the name of a TSIG or SIG(0) key.
+elements, which specify the name of a TSIG key.
+ 
+ When BIND 9 is built with GeoIP support, ACLs can also be used for
+ geographic access restrictions. This is done by specifying an ACL
+diff --git a/lib/dns/message.c b/lib/dns/message.c
+index 22aa552..12331ab 100644
+--- a/lib/dns/message.c
+++ b/lib/dns/message.c
+@@ -3301,111 +3301,24 @@ dns_message_dumpsig(dns_message_t *msg, char *txt1) {
+ 
+ isc_result_t
+ dns_message_checksig(dns_message_t *msg, dns_view_t *view) {
+-	isc_buffer_t b, msgb;
+	isc_buffer_t msgb;
+ 
+ 	REQUIRE(DNS_MESSAGE_VALID(msg));
+ 
+-	if (msg->tsigkey == NULL && msg->tsig == NULL && msg->sig0 == NULL) {
+	if (msg->tsigkey == NULL && msg->tsig == NULL) {
+ 		return (ISC_R_SUCCESS);
+ 	}
+ 
+ 	INSIST(msg->saved.base != NULL);
+ 	isc_buffer_init(&msgb, msg->saved.base, msg->saved.length);
+ 	isc_buffer_add(&msgb, msg->saved.length);
+-	if (msg->tsigkey != NULL || msg->tsig != NULL) {
+ #ifdef SKAN_MSG_DEBUG
+-		dns_message_dumpsig(msg, "dns_message_checksig#1");
+	dns_message_dumpsig(msg, "dns_message_checksig#1");
+ #endif /* ifdef SKAN_MSG_DEBUG */
+-		if (view != NULL) {
+-			return (dns_view_checksig(view, &msgb, msg));
+-		} else {
+-			return (dns_tsig_verify(&msgb, msg, NULL, NULL));
+-		}
+	if (view != NULL) {
+		return (dns_view_checksig(view, &msgb, msg));
+ 	} else {
+-		dns_rdata_t rdata = DNS_RDATA_INIT;
+-		dns_rdata_sig_t sig;
+-		dns_rdataset_t keyset;
+-		isc_result_t result;
+-
+-		result = dns_rdataset_first(msg->sig0);
+-		INSIST(result == ISC_R_SUCCESS);
+-		dns_rdataset_current(msg->sig0, &rdata);
+-
+-		/*
+-		 * This can occur when the message is a dynamic update, since
+-		 * the rdata length checking is relaxed.  This should not
+-		 * happen in a well-formed message, since the SIG(0) is only
+-		 * looked for in the additional section, and the dynamic update
+-		 * meta-records are in the prerequisite and update sections.
+-		 */
+-		if (rdata.length == 0) {
+-			return (ISC_R_UNEXPECTEDEND);
+-		}
+-
+-		result = dns_rdata_tostruct(&rdata, &sig, NULL);
+-		if (result != ISC_R_SUCCESS) {
+-			return (result);
+-		}
+-
+-		dns_rdataset_init(&keyset);
+-		if (view == NULL) {
+-			result = DNS_R_KEYUNAUTHORIZED;
+-			goto freesig;
+-		}
+-		result = dns_view_simplefind(view, &sig.signer,
+-					     dns_rdatatype_key /* SIG(0) */, 0,
+-					     0, false, &keyset, NULL);
+-
+-		if (result != ISC_R_SUCCESS) {
+-			/* XXXBEW Should possibly create a fetch here */
+-			result = DNS_R_KEYUNAUTHORIZED;
+-			goto freesig;
+-		} else if (keyset.trust < dns_trust_secure) {
+-			/* XXXBEW Should call a validator here */
+-			result = DNS_R_KEYUNAUTHORIZED;
+-			goto freesig;
+-		}
+-		result = dns_rdataset_first(&keyset);
+-		INSIST(result == ISC_R_SUCCESS);
+-		for (; result == ISC_R_SUCCESS;
+-		     result = dns_rdataset_next(&keyset))
+-		{
+-			dst_key_t *key = NULL;
+-
+-			dns_rdata_reset(&rdata);
+-			dns_rdataset_current(&keyset, &rdata);
+-			isc_buffer_init(&b, rdata.data, rdata.length);
+-			isc_buffer_add(&b, rdata.length);
+-
+-			result = dst_key_fromdns(&sig.signer, rdata.rdclass, &b,
+-						 view->mctx, &key);
+-			if (result != ISC_R_SUCCESS) {
+-				continue;
+-			}
+-			if (dst_key_alg(key) != sig.algorithm ||
+-			    dst_key_id(key) != sig.keyid ||
+-			    !(dst_key_proto(key) == DNS_KEYPROTO_DNSSEC ||
+-			      dst_key_proto(key) == DNS_KEYPROTO_ANY))
+-			{
+-				dst_key_free(&key);
+-				continue;
+-			}
+-			result = dns_dnssec_verifymessage(&msgb, msg, key);
+-			dst_key_free(&key);
+-			if (result == ISC_R_SUCCESS) {
+-				break;
+-			}
+-		}
+-		if (result == ISC_R_NOMORE) {
+-			result = DNS_R_KEYUNAUTHORIZED;
+-		}
+-
+-	freesig:
+-		if (dns_rdataset_isassociated(&keyset)) {
+-			dns_rdataset_disassociate(&keyset);
+-		}
+-		dns_rdata_freestruct(&sig);
+-		return (result);
+		return (dns_tsig_verify(&msgb, msg, NULL, NULL));
+ 	}
+ }
+ 
+diff --git a/lib/ns/client.c b/lib/ns/client.c
+index d4ce000..2679a5e 100644
+--- a/lib/ns/client.c
+++ b/lib/ns/client.c
+@@ -2041,6 +2041,13 @@ ns__client_request(isc_nmhandle_t *handle, isc_result_t eresult,
+ 		ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
+ 			      NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(3),
+ 			      "request is signed by a nonauthoritative key");
+	} else if (result == DNS_R_NOTVERIFIEDYET &&
+		   client->message->sig0 != NULL)
+	{
+		ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
+			      NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(3),
+			      "request has a SIG(0) signature but its support "
+			      "was removed (CVE-2024-1975)");
+ 	} else {
+ 		char tsigrcode[64];
+ 		isc_buffer_t b;
+-- 
+2.51.1
+
--- a/SOURCES/bind-9.16-CVE-2025-40778.patch
+++ b/SOURCES/bind-9.16-CVE-2025-40778.patch
@ -0,0 +1,786 @@
+From 3f033e9822a08c02cb146c4e996ed6edfbea4636 Mon Sep 17 00:00:00 2001
+From: Evan Hunt <each@isc.org>
+Date: Mon, 29 Sep 2025 21:46:59 -0700
+Subject: [PATCH] Tighten restrictions on caching NS RRsets in authority
+ section
+
+To prevent certain spoofing attacks, a new check has been added
+to the existing rules for whether NS data can be cached: the owner
+name of the NS RRset must be an ancestor of the name being queried.
+
+(cherry picked from commit fa153f791f9324bf84abf8d259e11c0531fe6e25)
+(cherry picked from commit 2f0f44d493c382a7f0a3adfe7c4976b18a3d480b)
+
+Further restrict addresses that are cached when processing referrals
+
+Use the owner name of the NS record as the bailwick apex name
+when determining which additional records to cache, rather than
+the name of the delegating zone (or a parent thereof).
+
+Modified resolver.c
+
+(cherry picked from commit a41054e9e606a61f1b3c8bc0c54e2f1059347165)
+(cherry picked from commit 50479358efdf432d690415131b74b5df158a9d69)
+
+Retry lookups with unsigned DNAME over TCP
+
+To prevent spoofed unsigned DNAME responses being accepted retry
+response with unsigned DNAMEs over TCP if the response is not TSIG
+signed or there isn't a good DNS CLIENT COOKIE.
+
+To prevent test failures, this required adding TCP support to the
+ans3 and ans4 servers in the chain system test.
+
+(cherry picked from commit 2e40705c06831988106335ed77db3cf924d431f6)
+(cherry picked from commit 33a7db1fe964e55b76b4ac003ecc56cc67028bd9)
+---
+ bin/tests/system/chain/ans3/ans.pl | 143 -------------------
+ bin/tests/system/chain/ans3/ans.py | 217 +++++++++++++++++++++++++++++
+ bin/tests/system/chain/ans4/ans.py |  57 ++++++--
+ lib/dns/include/dns/message.h      |   8 ++
+ lib/dns/message.c                  |  12 ++
+ lib/dns/resolver.c                 | 112 ++++++++++++---
+ 6 files changed, 376 insertions(+), 173 deletions(-)
+ delete mode 100644 bin/tests/system/chain/ans3/ans.pl
+ create mode 100644 bin/tests/system/chain/ans3/ans.py
+
+diff --git a/bin/tests/system/chain/ans3/ans.pl b/bin/tests/system/chain/ans3/ans.pl
+deleted file mode 100644
+index e42240be63..0000000000
+--- a/bin/tests/system/chain/ans3/ans.pl
+++ /dev/null
+@@ -1,143 +0,0 @@
+-#!/usr/bin/env perl
+-
+-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+-#
+-# SPDX-License-Identifier: MPL-2.0
+-#
+-# This Source Code Form is subject to the terms of the Mozilla Public
+-# License, v. 2.0.  If a copy of the MPL was not distributed with this
+-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+-#
+-# See the COPYRIGHT file distributed with this work for additional
+-# information regarding copyright ownership.
+-
+-use strict;
+-use warnings;
+-
+-use IO::File;
+-use Getopt::Long;
+-use Net::DNS::Nameserver;
+-
+-my $pidf = new IO::File "ans.pid", "w" or die "cannot open pid file: $!";
+-print $pidf "$$\n" or die "cannot write pid file: $!";
+-$pidf->close or die "cannot close pid file: $!";
+-sub rmpid { unlink "ans.pid"; exit 1; };
+-sub term { };
+-
+-$SIG{INT} = \&rmpid;
+-if ($Net::DNS::VERSION > 1.41) {
+-    $SIG{TERM} = \&term;
+-} else {
+-    $SIG{TERM} = \&rmpid;
+-}
+-
+-my $localaddr = "10.53.0.3";
+-
+-my $localport = int($ENV{'PORT'});
+-if (!$localport) { $localport = 5300; }
+-
+-my $verbose = 0;
+-my $ttl = 60;
+-my $zone = "example.broken";
+-my $nsname = "ns3.$zone";
+-my $synth = "synth-then-dname.$zone";
+-my $synth2 = "synth2-then-dname.$zone";
+-
+-sub reply_handler {
+-    my ($qname, $qclass, $qtype, $peerhost, $query, $conn) = @_;
+-    my ($rcode, @ans, @auth, @add);
+-
+-    print ("request: $qname/$qtype\n");
+-    STDOUT->flush();
+-
+-    if ($qname eq "example.broken") {
+-        if ($qtype eq "SOA") {
+-	    my $rr = new Net::DNS::RR("$qname $ttl $qclass SOA . . 0 0 0 0 0");
+-	    push @ans, $rr;
+-        } elsif ($qtype eq "NS") {
+-	    my $rr = new Net::DNS::RR("$qname $ttl $qclass NS $nsname");
+-	    push @ans, $rr;
+-	    $rr = new Net::DNS::RR("$nsname $ttl $qclass A $localaddr");
+-	    push @add, $rr;
+-        }
+-        $rcode = "NOERROR";
+-    } elsif ($qname eq "cname-to-$synth2") {
+-        my $rr = new Net::DNS::RR("$qname $ttl $qclass CNAME name.$synth2");
+-	push @ans, $rr;
+-        $rr = new Net::DNS::RR("name.$synth2 $ttl $qclass CNAME name");
+-	push @ans, $rr;
+-        $rr = new Net::DNS::RR("$synth2 $ttl $qclass DNAME .");
+-	push @ans, $rr;
+-	$rcode = "NOERROR";
+-    } elsif ($qname eq "$synth" || $qname eq "$synth2") {
+-	if ($qtype eq "DNAME") {
+-	    my $rr = new Net::DNS::RR("$qname $ttl $qclass DNAME .");
+-	    push @ans, $rr;
+-	}
+-	$rcode = "NOERROR";
+-    } elsif ($qname eq "name.$synth") {
+-	my $rr = new Net::DNS::RR("$qname $ttl $qclass CNAME name.");
+-	push @ans, $rr;
+-	$rr = new Net::DNS::RR("$synth $ttl $qclass DNAME .");
+-	push @ans, $rr;
+-	$rcode = "NOERROR";
+-    } elsif ($qname eq "name.$synth2") {
+-	my $rr = new Net::DNS::RR("$qname $ttl $qclass CNAME name.");
+-	push @ans, $rr;
+-	$rr = new Net::DNS::RR("$synth2 $ttl $qclass DNAME .");
+-	push @ans, $rr;
+-	$rcode = "NOERROR";
+-    # The following three code branches referring to the "example.dname"
+-    # zone are necessary for the resolver variant of the CVE-2021-25215
+-    # regression test to work.  A named instance cannot be used for
+-    # serving the DNAME records below as a version of BIND vulnerable to
+-    # CVE-2021-25215 would crash while answering the queries asked by
+-    # the tested resolver.
+-    } elsif ($qname eq "ns3.example.dname") {
+-	if ($qtype eq "A") {
+-		my $rr = new Net::DNS::RR("$qname $ttl $qclass A 10.53.0.3");
+-		push @ans, $rr;
+-	}
+-	if ($qtype eq "AAAA") {
+-		my $rr = new Net::DNS::RR("example.dname. $ttl $qclass SOA . . 0 0 0 0 $ttl");
+-		push @auth, $rr;
+-	}
+-	$rcode = "NOERROR";
+-    } elsif ($qname eq "self.example.self.example.dname") {
+-	my $rr = new Net::DNS::RR("self.example.dname. $ttl $qclass DNAME dname.");
+-	push @ans, $rr;
+-	$rr = new Net::DNS::RR("$qname $ttl $qclass CNAME self.example.dname.");
+-	push @ans, $rr;
+-	$rcode = "NOERROR";
+-    } elsif ($qname eq "self.example.dname") {
+-	if ($qtype eq "DNAME") {
+-		my $rr = new Net::DNS::RR("$qname $ttl $qclass DNAME dname.");
+-		push @ans, $rr;
+-	}
+-	$rcode = "NOERROR";
+-    } else {
+-	$rcode = "REFUSED";
+-    }
+-    return ($rcode, \@ans, \@auth, \@add, { aa => 1 });
+-}
+-
+-GetOptions(
+-    'port=i' => \$localport,
+-    'verbose!' => \$verbose,
+-);
+-
+-my $ns = Net::DNS::Nameserver->new(
+-    LocalAddr => $localaddr,
+-    LocalPort => $localport,
+-    ReplyHandler => \&reply_handler,
+-    Verbose => $verbose,
+-);
+-
+-if ($Net::DNS::VERSION >= 1.42) {
+-    $ns->start_server();
+-    select(undef, undef, undef, undef);
+-    $ns->stop_server();
+-    unlink "ans.pid";
+-} else {
+-    $ns->main_loop;
+-}
+diff --git a/bin/tests/system/chain/ans3/ans.py b/bin/tests/system/chain/ans3/ans.py
+new file mode 100644
+index 0000000000..0a031c1145
+--- /dev/null
+++ b/bin/tests/system/chain/ans3/ans.py
+@@ -0,0 +1,217 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+############################################################################
+# ans.py: See README.anspy for details.
+############################################################################
+
+from __future__ import print_function
+import os
+import sys
+import signal
+import socket
+import select
+from datetime import datetime, timedelta
+import functools
+
+import dns, dns.message, dns.query
+from dns.rdatatype import *
+from dns.rdataclass import *
+from dns.rcode import *
+from dns.name import *
+
+
+############################################################################
+# Respond to a DNS query.
+############################################################################
+def create_response(msg):
+    ttl = 60
+    zone = "example.broken."
+    nsname = f"ns3.{zone}"
+    synth = f"synth-then-dname.{zone}"
+    synth2 = f"synth2-then-dname.{zone}"
+
+    m = dns.message.from_wire(msg)
+    qname = m.question[0].name.to_text()
+
+    # prepare the response and convert to wire format
+    r = dns.message.make_response(m)
+
+    # get qtype
+    rrtype = m.question[0].rdtype
+    qtype = dns.rdatatype.to_text(rrtype)
+    print(f"request: {qname}/{qtype}")
+
+    rcode = "NOERROR"
+    if qname == zone:
+        if qtype == "SOA":
+            r.answer.append(dns.rrset.from_text(qname, ttl, IN, SOA, ". . 0 0 0 0 0"))
+        elif qtype == "NS":
+            r.answer.append(dns.rrset.from_text(qname, ttl, IN, NS, nsname))
+            r.additional.append(dns.rrset.from_text(nsname, ttl, IN, A, ip4))
+    elif qname == f"cname-to-{synth2}":
+        r.answer.append(dns.rrset.from_text(qname, ttl, IN, CNAME, f"name.{synth2}"))
+        r.answer.append(dns.rrset.from_text(f"name.{synth2}", ttl, IN, CNAME, "name."))
+        r.answer.append(dns.rrset.from_text(synth2, ttl, IN, DNAME, "."))
+    elif qname == f"{synth}" or qname == f"{synth2}":
+        if qtype == "DNAME":
+            r.answer.append(dns.rrset.from_text(qname, ttl, IN, DNAME, "."))
+    elif qname == f"name.{synth}":
+        r.answer.append(dns.rrset.from_text(qname, ttl, IN, CNAME, "name."))
+        r.answer.append(dns.rrset.from_text(synth, ttl, IN, DNAME, "."))
+    elif qname == f"name.{synth2}":
+        r.answer.append(dns.rrset.from_text(qname, ttl, IN, CNAME, "name."))
+        r.answer.append(dns.rrset.from_text(synth2, ttl, IN, DNAME, "."))
+    elif qname == "ns3.example.dname.":
+        # This and the next two code branches referring to the "example.dname"
+        # zone are necessary for the resolver variant of the CVE-2021-25215
+        # regression test to work.  A named instance cannot be used for
+        # serving the DNAME records below as a version of BIND vulnerable to
+        # CVE-2021-25215 would crash while answering the queries asked by
+        # the tested resolver.
+        if qtype == "A":
+            r.answer.append(dns.rrset.from_text(qname, ttl, IN, A, ip4))
+        elif qtype == "AAAA":
+            r.authority.append(
+                dns.rrset.from_text("example.dname.", ttl, IN, SOA, ". . 0 0 0 0 0")
+            )
+    elif qname == "self.example.self..example.dname.":
+        r.answer.append(
+            dns.rrset.from_text("self.example.dname.", ttl, IN, DNAME, "dname.")
+        )
+        r.answer.append(
+            dns.rrset.from_text(qname, ttl, IN, CNAME, "self.example.dname.")
+        )
+    elif qname == "self.example.dname.":
+        if qtype == "DNAME":
+            r.answer.append(dns.rrset.from_text(qname, ttl, IN, DNAME, "dname."))
+    else:
+        rcode = "REFUSED"
+
+    r.flags |= dns.flags.AA
+    r.use_edns()
+    return r.to_wire()
+
+
+def sigterm(signum, frame):
+    print("Shutting down now...")
+    os.remove("ans.pid")
+    running = False
+    sys.exit(0)
+
+
+############################################################################
+# Main
+#
+# Set up responder and control channel, open the pid file, and start
+# the main loop, listening for queries on the query channel or commands
+# on the control channel and acting on them.
+############################################################################
+ip4 = "10.53.0.3"
+ip6 = "fd92:7065:b8e:ffff::3"
+
+try:
+    port = int(os.environ["PORT"])
+except:
+    port = 5300
+
+query4_udp = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+query4_udp.bind((ip4, port))
+
+query4_tcp = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+query4_tcp.bind((ip4, port))
+query4_tcp.listen(1)
+query4_tcp.settimeout(1)
+
+havev6 = True
+try:
+    query6_udp = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM)
+    try:
+        query6_udp.bind((ip6, port))
+    except:
+        query6_udp.close()
+        havev6 = False
+
+    query6_tcp = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+    try:
+        query6_tcp.bind((ip4, port))
+        query6_tcp.listen(1)
+        query6_tcp.settimeout(1)
+    except:
+        query6_tcp.close()
+        havev6 = False
+except:
+    havev6 = False
+
+signal.signal(signal.SIGTERM, sigterm)
+
+f = open("ans.pid", "w")
+pid = os.getpid()
+print(pid, file=f)
+f.close()
+
+running = True
+
+print("Listening on %s port %d" % (ip4, port))
+if havev6:
+    print("Listening on %s port %d" % (ip6, port))
+print("Ctrl-c to quit")
+
+if havev6:
+    input = [query4_udp, query4_tcp, query6_udp, query6_tcp]
+else:
+    input = [query4_udp, query4_tcp]
+
+while running:
+    try:
+        inputready, outputready, exceptready = select.select(input, [], [])
+    except select.error as e:
+        break
+    except socket.error as e:
+        break
+    except KeyboardInterrupt:
+        break
+
+    for s in inputready:
+        if s == query4_udp or s == query6_udp:
+            print("Query received on %s" % (ip4 if s == query4_udp else ip6))
+            # Handle incoming queries
+            msg = s.recvfrom(65535)
+            rsp = create_response(msg[0])
+            if rsp:
+                s.sendto(rsp, msg[1])
+        elif s == query4_tcp or s == query6_tcp:
+            try:
+                conn, _ = s.accept()
+                if s == query4_tcp or s == query6_tcp:
+                    print(
+                        "TCP Query received on %s" % (ip4 if s == query4_tcp else ip6),
+                        end=" ",
+                    )
+                # get TCP message length
+                msg = conn.recv(2)
+                if len(msg) != 2:
+                    print("couldn't read TCP message length")
+                    continue
+                length = struct.unpack(">H", msg[:2])[0]
+                msg = conn.recv(length)
+                if len(msg) != length:
+                    print("couldn't read TCP message")
+                    continue
+                rsp = create_response(msg)
+                if rsp:
+                    conn.send(struct.pack(">H", len(rsp)))
+                    conn.send(rsp)
+                conn.close()
+            except socket.error as e:
+                print("error: %s" % str(e))
+    if not running:
+        break
+diff --git a/bin/tests/system/chain/ans4/ans.py b/bin/tests/system/chain/ans4/ans.py
+index 839067faa5..66f0193cac 100755
+--- a/bin/tests/system/chain/ans4/ans.py
+++ b/bin/tests/system/chain/ans4/ans.py
+@@ -316,16 +316,30 @@ try:
+ except:
+     ctrlport = 5300
+ 
+-query4_socket = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+-query4_socket.bind((ip4, port))
+query4_udp = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+query4_udp.bind((ip4, port))
+
+query4_tcp = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+query4_tcp.bind((ip4, port))
+query4_tcp.listen(1)
+query4_tcp.settimeout(1)
+ 
+ havev6 = True
+ try:
+-    query6_socket = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM)
+    query6_udp = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM)
+    try:
+        query6_udp.bind((ip6, port))
+    except:
+        query6_udp.close()
+        havev6 = False
+
+    query6_tcp = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+     try:
+-        query6_socket.bind((ip6, port))
+        query6_tcp.bind((ip4, port))
+        query6_tcp.listen(1)
+        query6_tcp.settimeout(1)
+     except:
+-        query6_socket.close()
+        query6_tcp.close()
+         havev6 = False
+ except:
+     havev6 = False
+@@ -350,9 +364,9 @@ print("Control channel on %s port %d" % (ip4, ctrlport))
+ print("Ctrl-c to quit")
+ 
+ if havev6:
+-    input = [query4_socket, query6_socket, ctrl_socket]
+    input = [query4_udp, query4_tcp, query6_udp, query6_tcp, ctrl_socket]
+ else:
+-    input = [query4_socket, ctrl_socket]
+    input = [query4_udp, query4_tcp, ctrl_socket]
+ 
+ while running:
+     try:
+@@ -375,12 +389,37 @@ while running:
+                     break
+                 ctl_channel(msg)
+             conn.close()
+-        if s == query4_socket or s == query6_socket:
+-            print("Query received on %s" % (ip4 if s == query4_socket else ip6))
+        elif s == query4_udp or s == query6_udp:
+            print("Query received on %s" % (ip4 if s == query4_udp else ip6))
+             # Handle incoming queries
+             msg = s.recvfrom(65535)
+             rsp = create_response(msg[0])
+             if rsp:
+                 s.sendto(rsp, msg[1])
+        elif s == query4_tcp or s == query6_tcp:
+            try:
+                conn, _ = s.accept()
+                if s == query4_tcp or s == query6_tcp:
+                    print(
+                        "TCP Query received on %s" % (ip4 if s == query4_tcp else ip6),
+                        end=" ",
+                    )
+                # get TCP message length
+                msg = conn.recv(2)
+                if len(msg) != 2:
+                    print("couldn't read TCP message length")
+                    continue
+                length = struct.unpack(">H", msg[:2])[0]
+                msg = conn.recv(length)
+                if len(msg) != length:
+                    print("couldn't read TCP message")
+                    continue
+                rsp = create_response(msg)
+                if rsp:
+                    conn.send(struct.pack(">H", len(rsp)))
+                    conn.send(rsp)
+                conn.close()
+            except socket.error as e:
+                print("error: %s" % str(e))
+     if not running:
+         break
+diff --git a/lib/dns/include/dns/message.h b/lib/dns/include/dns/message.h
+index ea45742439..f564e1e5ef 100644
+--- a/lib/dns/include/dns/message.h
+++ b/lib/dns/include/dns/message.h
+@@ -235,6 +235,7 @@ struct dns_message {
+ 	unsigned int cc_bad	      : 1;
+ 	unsigned int tkey	      : 1;
+ 	unsigned int rdclass_set      : 1;
+	unsigned int has_dname	      : 1;
+ 
+ 	unsigned int opt_reserved;
+ 	unsigned int sig_reserved;
+@@ -1451,4 +1452,11 @@ dns_message_clonebuffer(dns_message_t *msg);
+  * \li   msg be a valid message.
+  */
+ 
+bool
+dns_message_hasdname(dns_message_t *msg);
+/*%<
+ * Return whether a DNAME was detected in the ANSWER section of a QUERY
+ * message when it was parsed.
+ */
+
+ ISC_LANG_ENDDECLS
+diff --git a/lib/dns/message.c b/lib/dns/message.c
+index 22aa552f3f..c3f86fdbe0 100644
+--- a/lib/dns/message.c
+++ b/lib/dns/message.c
+@@ -442,6 +442,7 @@ msginit(dns_message_t *m) {
+ 	m->cc_bad = 0;
+ 	m->tkey = 0;
+ 	m->rdclass_set = 0;
+	m->has_dname = 0;
+ 	m->querytsig = NULL;
+ 	m->indent.string = "\t";
+ 	m->indent.count = 0;
+@@ -1727,6 +1728,11 @@ getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
+ 			 */
+ 			msg->tsigname->attributes |= DNS_NAMEATTR_NOCOMPRESS;
+ 			free_name = false;
+		} else if (rdtype == dns_rdatatype_dname &&
+			   sectionid == DNS_SECTION_ANSWER &&
+			   msg->opcode == dns_opcode_query)
+		{
+			msg->has_dname = 1;
+ 		}
+ 		rdataset = NULL;
+ 
+@@ -4857,3 +4863,9 @@ dns_message_clonebuffer(dns_message_t *msg) {
+ 		msg->free_query = 1;
+ 	}
+ }
+
+bool
+dns_message_hasdname(dns_message_t *msg) {
+	REQUIRE(DNS_MESSAGE_VALID(msg));
+	return msg->has_dname;
+}
+diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
+index 0952624689..cf6a55163a 100644
+--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
+@@ -758,6 +758,7 @@ typedef struct respctx {
+ 	bool get_nameservers; /* get a new NS rrset at
+ 			       * zone cut? */
+ 	bool resend;	      /* resend this query? */
+	bool secured;	      /* message was signed or had a valid cookie */
+ 	bool nextitem;	      /* invalid response; keep
+ 			       * listening for the correct one */
+ 	bool truncated;	      /* response was truncated */
+@@ -7154,7 +7155,8 @@ mark_related(dns_name_t *name, dns_rdataset_t *rdataset, bool external,
+  * locally served zone.
+  */
+ static bool
+-name_external(const dns_name_t *name, dns_rdatatype_t type, fetchctx_t *fctx) {
+name_external(const dns_name_t *name, dns_rdatatype_t type, respctx_t *rctx) {
+	fetchctx_t *fctx = rctx->fctx;
+ 	isc_result_t result;
+ 	dns_forwarders_t *forwarders = NULL;
+ 	dns_fixedname_t fixed, zfixed;
+@@ -7167,7 +7169,7 @@ name_external(const dns_name_t *name, dns_rdatatype_t type, fetchctx_t *fctx) {
+ 	dns_namereln_t rel;
+ 
+ 	apex = (ISDUALSTACK(fctx->addrinfo) || !ISFORWARDER(fctx->addrinfo))
+-		       ? &fctx->domain
+		       ? rctx->ns_name != NULL ? rctx->ns_name : &fctx->domain
+ 		       : fctx->fwdname;
+ 
+ 	/*
+@@ -7276,7 +7278,7 @@ check_section(void *arg, const dns_name_t *addname, dns_rdatatype_t type,
+ 	result = dns_message_findname(rctx->query->rmessage, section, addname,
+ 				      dns_rdatatype_any, 0, &name, NULL);
+ 	if (result == ISC_R_SUCCESS) {
+-		external = name_external(name, type, fctx);
+		external = name_external(name, type, rctx);
+ 		if (type == dns_rdatatype_a) {
+ 			for (rdataset = ISC_LIST_HEAD(name->list);
+ 			     rdataset != NULL;
+@@ -7888,6 +7890,47 @@ betterreferral(respctx_t *rctx) {
+ 	return (false);
+ }
+ 
+static bool
+rctx_need_tcpretry(respctx_t *rctx) {
+	resquery_t *query = rctx->query;
+	if ((rctx->retryopts & DNS_FETCHOPT_TCP) != 0) {
+		/* TCP is already in the retry flags */
+		return false;
+	}
+
+	/*
+	 * If the message was secured, no need to continue.
+	 */
+	if (rctx->secured) {
+		return false;
+	}
+
+	/*
+	 * Currently the only extra reason why we might need to
+	 * retry a UDP response over TCP is a DNAME in the message.
+	 */
+	if (dns_message_hasdname(query->rmessage)) {
+		return true;
+	}
+
+	return false;
+}
+
+static isc_result_t
+rctx_tcpretry(respctx_t *rctx) {
+	/*
+	 * Do we need to retry a UDP response over TCP?
+	 */
+	if (rctx_need_tcpretry(rctx)) {
+		rctx->retryopts |= DNS_FETCHOPT_TCP;
+		rctx->resend = true;
+		rctx_done(rctx, ISC_R_SUCCESS);
+		return ISC_R_COMPLETE;
+	}
+
+	return ISC_R_SUCCESS;
+}
+
+ /*
+  * resquery_response():
+  * Handles responses received in response to iterative queries sent by
+@@ -8046,6 +8089,11 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
+ 		break;
+ 	}
+ 
+	/*
+	 * The dispatcher should ensure we only get responses with QR set.
+	 */
+	INSIST((query->rmessage->flags & DNS_MESSAGEFLAG_QR) != 0);
+
+ 	/*
+ 	 * If the message is signed, check the signature.  If not, this
+ 	 * returns success anyway.
+@@ -8063,9 +8111,16 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
+ 	}
+ 
+ 	/*
+-	 * The dispatcher should ensure we only get responses with QR set.
+	 * Remember whether this message was signed or had a
+	 * valid client cookie; if not, we may need to retry over
+	 * TCP later.
+ 	 */
+-	INSIST((query->rmessage->flags & DNS_MESSAGEFLAG_QR) != 0);
+	if (query->rmessage->cc_ok || query->rmessage->tsig != NULL ||
+	    query->rmessage->sig0 != NULL)
+	{
+		rctx.secured = true;
+	}
+
+ 	/*
+ 	 * INSIST() that the message comes from the place we sent it to,
+ 	 * since the dispatch code should ensure this.
+@@ -8079,10 +8134,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
+ 	 * This may be a misconfigured anycast server or an attempt to send
+ 	 * a spoofed response.  Skip if we have a valid tsig.
+ 	 */
+-	if (dns_message_gettsig(query->rmessage, NULL) == NULL &&
+-	    !query->rmessage->cc_ok && !query->rmessage->cc_bad &&
+-	    (rctx.retryopts & DNS_FETCHOPT_TCP) == 0)
+-	{
+	if (!rctx.secured && (rctx.retryopts & DNS_FETCHOPT_TCP) == 0) {
+ 		unsigned char cookie[COOKIE_BUFFER_SIZE];
+ 		if (dns_adb_getcookie(fctx->adb, query->addrinfo, cookie,
+ 				      sizeof(cookie)) > CLIENT_COOKIE_SIZE)
+@@ -8108,6 +8160,17 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
+ 		 */
+ 	}
+ 
+	/*
+	 * Check whether we need to retry over TCP for some other reason.
+	 */
+	result = rctx_tcpretry(&rctx);
+	if (result == ISC_R_COMPLETE) {
+		return;
+	}
+
+	/*
+	 * Check for EDNS issues.
+	 */
+ 	rctx_edns(&rctx);
+ 
+ 	/*
+@@ -8836,8 +8899,8 @@ rctx_answer_positive(respctx_t *rctx) {
+ 	}
+ 
+ 	/*
+-	 * Cache records in the authority section, if
+-	 * there are any suitable for caching.
+	 * Cache records in the authority section, if there are
+	 * any suitable for caching.
+ 	 */
+ 	rctx_authority_positive(rctx);
+ 
+@@ -8909,7 +8972,7 @@ rctx_answer_scan(respctx_t *rctx) {
+ 			/*
+ 			 * Don't accept DNAME from parent namespace.
+ 			 */
+-			if (name_external(name, dns_rdatatype_dname, fctx)) {
+			if (name_external(name, dns_rdatatype_dname, rctx)) {
+ 				continue;
+ 			}
+ 
+@@ -9208,14 +9271,14 @@ rctx_answer_dname(respctx_t *rctx) {
+ 
+ /*
+  * rctx_authority_positive():
+- * Examine the records in the authority section (if there are any) for a
+- * positive answer.  We expect the names for all rdatasets in this section
+- * to be subdomains of the domain being queried; any that are not are
+- * skipped.  We expect to find only *one* owner name; any names
+- * after the first one processed are ignored. We expect to find only
+- * rdatasets of type NS, RRSIG, or SIG; all others are ignored. Whatever
+- * remains can be cached at trust level authauthority or additional
+- * (depending on whether the AA bit was set on the answer).
+ * If a positive answer was received over TCP or secured with a cookie
+ * or TSIG, examine the authority section.  We expect names for all
+ * rdatasets in this section to be subdomains of the domain being queried;
+ * any that are not are skipped.  We expect to find only *one* owner name;
+ * any names after the first one processed are ignored. We expect to find
+ * only rdatasets of type NS; all others are ignored. Whatever remains can
+ * be cached at trust level authauthority or additional (depending on
+ * whether the AA bit was set on the answer).
+  */
+ static void
+ rctx_authority_positive(respctx_t *rctx) {
+@@ -9223,6 +9286,11 @@ rctx_authority_positive(respctx_t *rctx) {
+ 	bool done = false;
+ 	isc_result_t result;
+ 
+	/* If it's spoofable, don't cache it. */
+	if (!rctx->secured && (rctx->query->options & DNS_FETCHOPT_TCP) == 0) {
+		return;
+	}
+
+ 	result = dns_message_firstname(rctx->query->rmessage,
+ 				       DNS_SECTION_AUTHORITY);
+ 	while (!done && result == ISC_R_SUCCESS) {
+@@ -9231,7 +9299,9 @@ rctx_authority_positive(respctx_t *rctx) {
+ 		dns_message_currentname(rctx->query->rmessage,
+ 					DNS_SECTION_AUTHORITY, &name);
+ 
+-		if (!name_external(name, dns_rdatatype_ns, fctx)) {
+		if (!name_external(name, dns_rdatatype_ns, rctx) &&
+		    dns_name_issubdomain(&fctx->name, name))
+		{
+ 			dns_rdataset_t *rdataset = NULL;
+ 
+ 			/*
+-- 
+2.53.0
+
--- a/SOURCES/bind-9.16-CVE-2025-40780.patch
+++ b/SOURCES/bind-9.16-CVE-2025-40780.patch
@ -0,0 +1,303 @@
+From 6254679e5250a9f0d6079ec082cffdad4315372d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
+Date: Tue, 19 Aug 2025 19:22:18 +0200
+Subject: [PATCH] Use cryptographically-secure pseudo-random generator
+ everywhere
+
+It was discovered in an upcoming academic paper that a xoshiro128**
+internal state can be recovered by an external 3rd party allowing to
+predict UDP ports and DNS IDs in the outgoing queries.  This could lead
+to an attacker spoofing the DNS answers with great efficiency and
+poisoning the DNS cache.
+
+Change the internal random generator to system CSPRNG with buffering to
+avoid excessive syscalls.
+
+Thanks Omer Ben Simhon and Amit Klein of Hebrew University of Jerusalem
+for responsibly reporting this to us.  Very cool research!
+
+(cherry picked from commit cffcab9d5f3e709002f331b72498fcc229786ae2)
+(cherry picked from commit d9b5ef342916462bfd63391831d96afc80c12df3)
+---
+ lib/isc/include/isc/os.h     |   5 +
+ lib/isc/include/isc/random.h |   2 +-
+ lib/isc/random.c             | 181 ++++++++++++++++++-----------------
+ lib/isc/tests/random_test.c  |   4 +-
+ 4 files changed, 102 insertions(+), 90 deletions(-)
+
+diff --git a/lib/isc/include/isc/os.h b/lib/isc/include/isc/os.h
+index ce7615a0e3..5def473d2b 100644
+--- a/lib/isc/include/isc/os.h
+++ b/lib/isc/include/isc/os.h
+@@ -18,6 +18,11 @@
+ 
+ ISC_LANG_BEGINDECLS
+ 
+/*%<
+ * Hardcode the L1 cacheline size of the CPU to 64.
+ */
+#define ISC_OS_CACHELINE_SIZE 64
+
+ unsigned int
+ isc_os_ncpus(void);
+ /*%<
+diff --git a/lib/isc/include/isc/random.h b/lib/isc/include/isc/random.h
+index 556e74754a..2c16472a5d 100644
+--- a/lib/isc/include/isc/random.h
+++ b/lib/isc/include/isc/random.h
+@@ -18,7 +18,7 @@
+ #include <isc/types.h>
+ 
+ /*! \file isc/random.h
+- * \brief Implements wrapper around a non-cryptographically secure
+ * \brief Implements wrapper around a cryptographically secure
+  * pseudo-random number generator.
+  *
+  */
+diff --git a/lib/isc/random.c b/lib/isc/random.c
+index 753453ff3c..717e1f0dcd 100644
+--- a/lib/isc/random.c
+++ b/lib/isc/random.c
+@@ -29,131 +29,136 @@
+  */
+ 
+ #include <inttypes.h>
+-#include <stdlib.h>
+-#include <string.h>
+-#include <unistd.h>
+#include <stdio.h>
+ 
+-#include <isc/once.h>
+#include <isc/os.h>
+ #include <isc/platform.h>
+ #include <isc/random.h>
+-#include <isc/result.h>
+ #include <isc/thread.h>
+-#include <isc/types.h>
+ #include <isc/util.h>
+ 
+ #include "entropy_private.h"
+ 
+-/*
+- * The specific implementation for PRNG is included as a C file
+- * that has to provide a static variable named seed, and a function
+- * uint32_t next(void) that provides next random number.
+- *
+- * The implementation must be thread-safe.
+- */
+-
+-/*
+- * Two contestants have been considered: the xoroshiro family of the
+- * functions by Villa&Blackman, and PCG by O'Neill.  After
+- * consideration, the xoshiro128starstar function has been chosen as
+- * the uint32_t random number provider because it is very fast and has
+- * good enough properties for our usage pattern.
+- */
+-#include "xoshiro128starstar.c"
+#define ISC_RANDOM_BUFSIZE (ISC_OS_CACHELINE_SIZE / sizeof(uint32_t))
+ 
+-ISC_THREAD_LOCAL isc_once_t isc_random_once = ISC_ONCE_INIT;
+ISC_THREAD_LOCAL uint32_t isc__random_pool[ISC_RANDOM_BUFSIZE];
+ISC_THREAD_LOCAL size_t isc__random_pos = ISC_RANDOM_BUFSIZE;
+ 
+-static void
+-isc_random_initialize(void) {
+-	int useed[4] = { 0, 0, 0, 1 };
+static uint32_t
+random_u32(void) {
+ #if FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
+ 	/*
+-	 * Set a constant seed to help in problem reproduction should fuzzing
+-	 * find a crash or a hang.  The seed array must be non-zero else
+-	 * xoshiro128starstar will generate an infinite series of zeroes.
+	 * A fixed stream of numbers helps with problem reproduction when
+	 * fuzzing.  The first result needs to be non-zero as expected by
+	 * random_test.c (it starts with ISC_RANDOM_BUFSIZE, see above).
+ 	 */
+-#else  /* if FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION */
+-	isc_entropy_get(useed, sizeof(useed));
+	return (uint32_t)(isc__random_pos++);
+ #endif /* if FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION */
+-	memmove(seed, useed, sizeof(seed));
+
+	if (isc__random_pos == ISC_RANDOM_BUFSIZE) {
+		isc_entropy_get(isc__random_pool, sizeof(isc__random_pool));
+		isc__random_pos = 0;
+	}
+
+	return isc__random_pool[isc__random_pos++];
+ }
+ 
+ uint8_t
+ isc_random8(void) {
+-	RUNTIME_CHECK(isc_once_do(&isc_random_once, isc_random_initialize) ==
+-		      ISC_R_SUCCESS);
+-	return (next() & 0xff);
+	return (uint8_t)random_u32();
+ }
+ 
+ uint16_t
+ isc_random16(void) {
+-	RUNTIME_CHECK(isc_once_do(&isc_random_once, isc_random_initialize) ==
+-		      ISC_R_SUCCESS);
+-	return (next() & 0xffff);
+	return (uint16_t)random_u32();
+ }
+ 
+ uint32_t
+ isc_random32(void) {
+-	RUNTIME_CHECK(isc_once_do(&isc_random_once, isc_random_initialize) ==
+-		      ISC_R_SUCCESS);
+-	return (next());
+	return random_u32();
+ }
+ 
+ void
+ isc_random_buf(void *buf, size_t buflen) {
+-	int i;
+-	uint32_t r;
+	REQUIRE(buflen == 0 || buf != NULL);
+ 
+-	REQUIRE(buf != NULL);
+-	REQUIRE(buflen > 0);
+-
+-	RUNTIME_CHECK(isc_once_do(&isc_random_once, isc_random_initialize) ==
+-		      ISC_R_SUCCESS);
+-
+-	for (i = 0; i + sizeof(r) <= buflen; i += sizeof(r)) {
+-		r = next();
+-		memmove((uint8_t *)buf + i, &r, sizeof(r));
+	if (buf == NULL || buflen == 0) {
+		return;
+ 	}
+-	r = next();
+-	memmove((uint8_t *)buf + i, &r, buflen % sizeof(r));
+-	return;
+
+	isc_entropy_get(buf, buflen);
+ }
+ 
+ uint32_t
+-isc_random_uniform(uint32_t upper_bound) {
+-	/* Copy of arc4random_uniform from OpenBSD */
+-	uint32_t r, min;
+-
+-	RUNTIME_CHECK(isc_once_do(&isc_random_once, isc_random_initialize) ==
+-		      ISC_R_SUCCESS);
+-
+-	if (upper_bound < 2) {
+-		return (0);
+-	}
+-
+-#if (ULONG_MAX > 0xffffffffUL)
+-	min = 0x100000000UL % upper_bound;
+-#else  /* if (ULONG_MAX > 0xffffffffUL) */
+-	/* Calculate (2**32 % upper_bound) avoiding 64-bit math */
+-	if (upper_bound > 0x80000000) {
+-		min = 1 + ~upper_bound; /* 2**32 - upper_bound */
+-	} else {
+-		/* (2**32 - (x * 2)) % x == 2**32 % x when x <= 2**31 */
+-		min = ((0xffffffff - (upper_bound * 2)) + 1) % upper_bound;
+-	}
+-#endif /* if (ULONG_MAX > 0xffffffffUL) */
+-
+isc_random_uniform(uint32_t limit) {
+ 	/*
+-	 * This could theoretically loop forever but each retry has
+-	 * p > 0.5 (worst case, usually far better) of selecting a
+-	 * number inside the range we need, so it should rarely need
+-	 * to re-roll.
+	 * Daniel Lemire's nearly-divisionless unbiased bounded random numbers.
+	 *
+	 * https://lemire.me/blog/?p=17551
+	 *
+	 * The raw random number generator `next()` returns a 32-bit value.
+	 * We do a 64-bit multiply `next() * limit` and treat the product as a
+	 * 32.32 fixed-point value less than the limit. Our result will be the
+	 * integer part (upper 32 bits), and we will use the fraction part
+	 * (lower 32 bits) to determine whether or not we need to resample.
+ 	 */
+-	for (;;) {
+-		r = next();
+-		if (r >= min) {
+-			break;
+	uint64_t num = (uint64_t)random_u32() * (uint64_t)limit;
+	/*
+	 * In the fast path, we avoid doing a division in most cases by
+	 * comparing the fraction part of `num` with the limit, which is
+	 * a slight over-estimate for the exact resample threshold.
+	 */
+	if ((uint32_t)(num) < limit) {
+		/*
+		 * We are in the slow path where we re-do the approximate test
+		 * more accurately. The exact threshold for the resample loop
+		 * is the remainder after dividing the raw RNG limit `1 << 32`
+		 * by the caller's limit. We use a trick to calculate it
+		 * within 32 bits:
+		 *
+		 *     (1 << 32) % limit
+		 * == ((1 << 32) - limit) % limit
+		 * ==  (uint32_t)(-limit) % limit
+		 *
+		 * This division is safe: we know that `limit` is strictly
+		 * greater than zero because of the slow-path test above.
+		 */
+		uint32_t residue = (uint32_t)(-limit) % limit;
+		/*
+		 * Unless we get one of `N = (1 << 32) - residue` valid
+		 * values, we reject the sample. This `N` is a multiple of
+		 * `limit`, so our results will be unbiased; and `N` is the
+		 * largest multiple that fits in 32 bits, so rejections are as
+		 * rare as possible.
+		 *
+		 * There are `limit` possible values for the integer part of
+		 * our fixed-point number. Each one corresponds to `N/limit`
+		 * or `N/limit + 1` possible fraction parts. For our result to
+		 * be unbiased, every possible integer part must have the same
+		 * number of possible valid fraction parts. So, when we get
+		 * the superfluous value in the `N/limit + 1` cases, we need
+		 * to reject and resample.
+		 *
+		 * Because of the multiplication, the possible values in the
+		 * fraction part are equally spaced by `limit`, with varying
+		 * gaps at each end of the fraction's 32-bit range. We will
+		 * choose a range of size `N` (a multiple of `limit`) into
+		 * which valid fraction values must fall, with the rest of the
+		 * 32-bit range covered by the `residue`. Lemire's paper says
+		 * that exactly `N/limit` possible values spaced apart by
+		 * `limit` will fit into our size `N` valid range, regardless
+		 * of the size of the end gaps, the phase alignment of the
+		 * values, or the position of the range.
+		 *
+		 * So, when a fraction value falls in the `residue` outside
+		 * our valid range, it is superfluous, and we resample.
+		 */
+		while ((uint32_t)(num) < residue) {
+			num = (uint64_t)random_u32() * (uint64_t)limit;
+ 		}
+ 	}
+-
+-	return (r % upper_bound);
+	/*
+	 * Return the integer part (upper 32 bits).
+	 */
+	return (uint32_t)(num >> 32);
+ }
+diff --git a/lib/isc/tests/random_test.c b/lib/isc/tests/random_test.c
+index 7161cd96a9..f47137d3ac 100644
+--- a/lib/isc/tests/random_test.c
+++ b/lib/isc/tests/random_test.c
+@@ -345,7 +345,9 @@ random_test(pvalue_func_t *func, isc_random_func test_func) {
+ 			}
+ 			break;
+ 		case ISC_RANDOM_BYTES:
+-			isc_random_buf(values, sizeof(values));
+			for (i = 0; i < ARRAY_SIZE(values); i++) {
+				values[i] = isc_random32();
+			}
+ 			break;
+ 		case ISC_RANDOM_UNIFORM:
+ 			uniform_values = (uint16_t *)values;
+-- 
+2.51.1
+
--- a/SOURCES/bind-9.16-CVE-2026-1519.patch
+++ b/SOURCES/bind-9.16-CVE-2026-1519.patch
@ -1,4 +1,4 @@
-From 19b300cadcc265af7f6cdee16a32b5a5d9139b38 Mon Sep 17 00:00:00 2001
+From 16c75b53b9f76011ae64378046f66dc0c2ad7526 Mon Sep 17 00:00:00 2001
 From: Matthijs Mekking <matthijs@isc.org>
 Date: Tue, 3 Mar 2026 10:40:36 +0100
 Subject: [PATCH] Check iterations in isdelegation()
@ -9,7 +9,7 @@ by marking the answer with trust level "answer", indicating that they
 did not validate, but could be cached as insecure.

 (cherry picked from commit 988040a5e02f86f4a8cdb0704e8d501f9082a89c)
-(cherry picked from commit 0d8f3d0b22fb23c5a9138cc48e72ef8ab3d603df)
+(cherry picked from commit 0e636fb6c21a165b1bab67636d6f380f20e8b012)

 Don't verify already trusted rdatasets

@ -17,7 +17,7 @@ If we already marked an rdataset as secure (or it has even stronger
 trust), there is no need to cryptographically verify it again.

 (cherry picked from commit 0ec08c212022d08c9717f2bc6bd3e8ebd6f034ce)
-(cherry picked from commit e1d47d57e4cb496a8b64ea292467cd05a769d1e6)
+(cherry picked from commit e307735073b207a2e1635703511df55f6583d18e)

 Check RRset trust in validate_neg_rrset()

@ -27,30 +27,29 @@ before). This check was missing prior to validating negative response
 data.

 (cherry picked from commit 6ca67f65cd685cf8699540a852c1e3775bd48d64)
-(cherry picked from commit fe40620f47ce7cc10aca33b3d4f0a840f53f708d)
+(cherry picked from commit 5828874d13870bce651eb84fdfc95d581f66927c)
 ---
- lib/dns/include/dns/types.h |  2 +-
- lib/dns/validator.c         | 96 +++++++++++++++++++++++++++++++------
- 2 files changed, 82 insertions(+), 16 deletions(-)
+ lib/dns/include/dns/types.h |  1 +
+ lib/dns/validator.c         | 89 ++++++++++++++++++++++++++++---------
+ 2 files changed, 70 insertions(+), 20 deletions(-)

 diff --git a/lib/dns/include/dns/types.h b/lib/dns/include/dns/types.h
-index 934a641118..1b0f2b71a0 100644
+index 8781875651..8878ac7bd9 100644
 --- a/lib/dns/include/dns/types.h
 +++ b/lib/dns/include/dns/types.h
-@@ -357,7 +357,7 @@ enum {
- 					 (x) == dns_trust_pending_additional)
- #define DNS_TRUST_GLUE(x)		((x) == dns_trust_glue)
- #define DNS_TRUST_ANSWER(x)		((x) == dns_trust_answer)
-
-+#define DNS_TRUST_SECURE(x)		((x) >= dns_trust_secure)
+@@ -354,6 +354,7 @@ enum {
+ 	((x) == dns_trust_additional || (x) == dns_trust_pending_additional)
+ #define DNS_TRUST_GLUE(x)   ((x) == dns_trust_glue)
+ #define DNS_TRUST_ANSWER(x) ((x) == dns_trust_answer)
+#define DNS_TRUST_SECURE(x) ((x) >= dns_trust_secure)
 
 /*%
  * Name checking severities.
 diff --git a/lib/dns/validator.c b/lib/dns/validator.c
-index 0b257fe874..5bc7bec951 100644
+index e416cc9b5c..d571539a7d 100644
 --- a/lib/dns/validator.c
 +++ b/lib/dns/validator.c
-@@ -262,12 +262,25 @@ dlv_algorithm_supported(dns_validator_t *val) {
+@@ -249,12 +249,25 @@ exit_check(dns_validator_t *val) {
 }
 
 /*%
@ -74,36 +73,35 @@ index 0b257fe874..5bc7bec951 100644
  */
 -static bool
 -isdelegation(dns_name_t *name, dns_rdataset_t *rdataset,
-	     isc_result_t dbresult)
+-	     isc_result_t dbresult) {
 +static isc_result_t
 +isdelegation(dns_validator_t *val, dns_name_t *name, dns_rdataset_t *rdataset,
-+	     isc_result_t dbresult, const char *caller)
- {
+	     isc_result_t dbresult, const char *caller) {
 	dns_fixedname_t fixed;
 	dns_label_t hashlabel;
-@@ -295,7 +308,7 @@ isdelegation(dns_name_t *name, dns_rdataset_t *rdataset,
- 		if (result == ISC_R_NOTFOUND)
+ 	dns_name_t nsec3name;
+@@ -282,7 +295,7 @@ isdelegation(dns_name_t *name, dns_rdataset_t *rdataset,
 			goto trynsec3;
- 		if (result != ISC_R_SUCCESS)
+ 		}
+ 		if (result != ISC_R_SUCCESS) {
 -			return (false);
 +			return (ISC_R_NOTFOUND);
+ 		}
 	}
 
- 	INSIST(set.type == dns_rdatatype_nsec);
-@@ -308,7 +321,7 @@ isdelegation(dns_name_t *name, dns_rdataset_t *rdataset,
+@@ -296,7 +309,7 @@ isdelegation(dns_name_t *name, dns_rdataset_t *rdataset,
 		dns_rdata_reset(&rdata);
 	}
 	dns_rdataset_disassociate(&set);
 -	return (found);
 +	return (found ? ISC_R_SUCCESS : ISC_R_NOTFOUND);
 
-  trynsec3:
+ trynsec3:
 	/*
-@@ -345,18 +358,33 @@ isdelegation(dns_name_t *name, dns_rdataset_t *rdataset,
- 			(void)dns_rdata_tostruct(&rdata, &nsec3, NULL);
- 			if (nsec3.hash != 1)
+@@ -332,6 +345,18 @@ trynsec3:
+ 			if (nsec3.hash != 1) {
 				continue;
-+
+ 			}
 +			/*
 +			 * If there are too many iterations assume bad things
 +			 * are happening and bail out early. Treat as if the
@ -116,26 +114,20 @@ index 0b257fe874..5bc7bec951 100644
 +				dns_rdataset_disassociate(&set);
 +				return (ISC_R_SUCCESS);
 +			}
-+
- 			length = isc_iterated_hash(hash, nsec3.hash,
- 						   nsec3.iterations, nsec3.salt,
- 						   nsec3.salt_length,
- 						   name->ndata, name->length);
- 			if (length != isc_buffer_usedlength(&buffer))
- 				continue;
-+
- 			order = memcmp(hash, owner, length);
- 			if (order == 0) {
+ 			length = isc_iterated_hash(
+ 				hash, nsec3.hash, nsec3.iterations, nsec3.salt,
+ 				nsec3.salt_length, name->ndata, name->length);
+@@ -343,7 +368,7 @@ trynsec3:
 				found = dns_nsec3_typepresent(&rdata,
 							      dns_rdatatype_ns);
 				dns_rdataset_disassociate(&set);
 -				return (found);
 +				return (found ? ISC_R_SUCCESS : ISC_R_NOTFOUND);
 			}
- 			if ((nsec3.flags & DNS_NSEC3FLAG_OPTOUT) == 0)
+ 			if ((nsec3.flags & DNS_NSEC3FLAG_OPTOUT) == 0) {
 				continue;
-@@ -370,12 +398,12 @@ isdelegation(dns_name_t *name, dns_rdataset_t *rdataset,
- 					memcmp(hash, nsec3.next, length) < 0)))
+@@ -359,12 +384,12 @@ trynsec3:
+ 			      memcmp(hash, nsec3.next, length) < 0)))
 			{
 				dns_rdataset_disassociate(&set);
 -				return (true);
@ -149,17 +141,20 @@ index 0b257fe874..5bc7bec951 100644
 }
 
 /*%
-@@ -597,7 +625,8 @@ dsfetched2(isc_task_t *task, isc_event_t *event) {
- 		 */
- 		tname = dns_fixedname_name(&devent->foundname);
- 		if (eresult != DNS_R_CNAME &&
-		    isdelegation(tname, &val->frdataset, eresult)) {
-+		    isdelegation(val, tname, &val->frdataset, eresult,
-+				 "dsfetched2") == ISC_R_SUCCESS) {
- 			if (val->mustbesecure) {
- 				validator_log(val, ISC_LOG_WARNING,
- 					      "must be secure failure, no DS"
-@@ -754,10 +783,13 @@ dsvalidated(isc_task_t *task, isc_event_t *event) {
+@@ -576,8 +601,10 @@ fetch_callback_ds(isc_task_t *task, isc_event_t *event) {
+ 		} else if (eresult == DNS_R_SERVFAIL) {
+ 			goto unexpected;
+ 		} else if (eresult != DNS_R_CNAME &&
+-			   isdelegation(dns_fixedname_name(&devent->foundname),
+-					&val->frdataset, eresult))
+			   isdelegation(val,
+					dns_fixedname_name(&devent->foundname),
+					&val->frdataset, eresult,
+					"fetch_callback_ds") == ISC_R_SUCCESS)
+ 		{
+ 			/*
+ 			 * Failed to find a DS while trying to prove
+@@ -736,10 +763,13 @@ validator_callback_ds(isc_task_t *task, isc_event_t *event) {
 			      dns_trust_totext(val->frdataset.trust));
 		have_dsset = (val->frdataset.type == dns_rdatatype_ds);
 		name = dns_fixedname_name(&val->fname);
@ -167,14 +162,14 @@ index 0b257fe874..5bc7bec951 100644
 		if ((val->attributes & VALATTR_INSECURITY) != 0 &&
 		    val->frdataset.covers == dns_rdatatype_ds &&
 		    NEGATIVE(&val->frdataset) &&
-		    isdelegation(name, &val->frdataset, DNS_R_NCACHENXRRSET)) {
+-		    isdelegation(name, &val->frdataset, DNS_R_NCACHENXRRSET))
 +		    isdelegation(val, name, &val->frdataset,
 +				 DNS_R_NCACHENXRRSET,
-+				 "dsvalidated") == ISC_R_SUCCESS) {
- 			if (val->mustbesecure) {
- 				validator_log(val, ISC_LOG_WARNING,
- 					      "must be secure failure, no DS "
-@@ -1524,6 +1556,13 @@ verify(dns_validator_t *val, dst_key_t *key, dns_rdata_t *rdata,
+				 "validator_callback_ds") == ISC_R_SUCCESS)
+ 		{
+ 			result = markanswer(val, "validator_callback_ds",
+ 					    "no DS and this is a delegation");
+@@ -1433,6 +1463,13 @@ verify(dns_validator_t *val, dst_key_t *key, dns_rdata_t *rdata,
 	bool ignore = false;
 	dns_name_t *wild;
 
@ -187,75 +182,69 @@ index 0b257fe874..5bc7bec951 100644
 +
 	val->attributes |= VALATTR_TRIEDVERIFY;
 	wild = dns_fixedname_initname(&fixed);
-  again:
-@@ -2714,6 +2753,19 @@ validate_authority(dns_validator_t *val, bool resume) {
- 							dns_rdatatype_soa))
- 					continue;
- 			}
-+
-+			if (rdataset->type != dns_rdatatype_nsec &&
-+			    DNS_TRUST_SECURE(rdataset->trust))
-+			{
-+				/*
-+				 * The negative response data is already
-+				 * verified. We skip NSEC records, because
-+				 * they require special processing in
-+				 * authvalidated().
-+				 */
-+				continue;
-+			}
-+
- 			val->currentset = rdataset;
- 			result = create_validator(val, name, rdataset->type,
- 						  rdataset, sigrdataset,
-@@ -2791,6 +2843,18 @@ validate_ncache(dns_validator_t *val, bool resume) {
- 						dns_rdatatype_soa))
- 				continue;
+ again:
+@@ -2355,6 +2392,17 @@ validate_neg_rrset(dns_validator_t *val, dns_name_t *name,
 		}
+ 	}
+ 
+	if (rdataset->type != dns_rdatatype_nsec &&
+	    DNS_TRUST_SECURE(rdataset->trust))
+	{
+		/*
+		 * The negative response data is already verified.
+		 * We skip NSEC records, because they require special
+		 * processing in validator_callback_nsec().
+		 */
+		return DNS_R_CONTINUE;
+	}
 +
-+		if (rdataset->type != dns_rdatatype_nsec &&
-+		    DNS_TRUST_SECURE(rdataset->trust))
-+		{
-+			/*
-+			 * The negative response data is already verified.
-+			 * We skip NSEC records, because they require special
-+			 * processing in authvalidated().
-+			 */
-+			continue;
-+		}
-+
- 		val->currentset = rdataset;
- 		result = create_validator(val, name, rdataset->type,
- 					  rdataset, sigrdataset,
-@@ -2842,7 +2906,8 @@ nsecvalidate(dns_validator_t *val, bool resume) {
+ 	val->currentset = rdataset;
+ 	result = create_validator(val, name, rdataset->type, rdataset,
+ 				  sigrdataset, validator_callback_nsec,
+@@ -2464,11 +2512,9 @@ validate_ncache(dns_validator_t *val, bool resume) {
+ 		}
+ 
+ 		result = validate_neg_rrset(val, name, rdataset, sigrdataset);
+-		if (result == DNS_R_CONTINUE) {
+-			continue;
+		if (result != DNS_R_CONTINUE) {
+			return (result);
+ 		}
+-
+-		return (result);
+ 	}
+ 	if (result == ISC_R_NOMORE) {
+ 		result = ISC_R_SUCCESS;
+@@ -2517,7 +2563,8 @@ validate_nx(dns_validator_t *val, bool resume) {
 			result = findnsec3proofs(val);
 			if (result == DNS_R_NSEC3ITERRANGE) {
 				validator_log(val, ISC_LOG_DEBUG(3),
 -					      "too many iterations");
 +					      "%s: too many iterations",
 +					      __func__);
- 				markanswer(val, "validate_nx (3)");
+ 				markanswer(val, "validate_nx (3)", NULL);
 				return (ISC_R_SUCCESS);
 			}
-@@ -2877,7 +2942,7 @@ nsecvalidate(dns_validator_t *val, bool resume) {
+@@ -2553,7 +2600,7 @@ validate_nx(dns_validator_t *val, bool resume) {
 		result = findnsec3proofs(val);
 		if (result == DNS_R_NSEC3ITERRANGE) {
 			validator_log(val, ISC_LOG_DEBUG(3),
 -				      "too many iterations");
 +				      "%s: too many iterations", __func__);
- 			markanswer(val, "validate_nx (4)");
+ 			markanswer(val, "validate_nx (4)", NULL);
 			return (ISC_R_SUCCESS);
 		}
-@@ -3463,7 +3528,8 @@ proveunsecure(dns_validator_t *val, bool have_ds, bool resume)
- 				result = DNS_R_NOVALIDSIG;
- 				goto out;
- 			}
-			if (isdelegation(tname, &val->frdataset, result)) {
-+			if (isdelegation(val, tname, &val->frdataset, result,
-+					 "proveunsecure") == ISC_R_SUCCESS) {
- 				if (val->mustbesecure) {
- 					validator_log(val, ISC_LOG_WARNING,
- 						      "must be secure failure, "
+@@ -2770,7 +2817,9 @@ seek_ds(dns_validator_t *val, isc_result_t *resp) {
+ 			return (ISC_R_COMPLETE);
+ 		}
+ 
+-		if (isdelegation(tname, &val->frdataset, result)) {
+		result = isdelegation(val, tname, &val->frdataset, result,
+				      "seek_ds");
+		if (result == ISC_R_SUCCESS) {
+ 			*resp = markanswer(val, "proveunsecure (4)",
+ 					   "this is a delegation");
+ 			return (ISC_R_COMPLETE);
 -- 
 2.53.0

--- a/SOURCES/bind-9.16-CVE-2026-3039.patch
+++ b/SOURCES/bind-9.16-CVE-2026-3039.patch
@ -1,4 +1,4 @@
-From 7c2afb490391a308733da1c37730328477bd80d3 Mon Sep 17 00:00:00 2001
+From c824f5e341094edc653f64e730a7471d31f9cc14 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
 Date: Wed, 18 Mar 2026 00:10:35 +0100
 Subject: [PATCH] Fix GSS-API context leak in TKEY negotiation
@ -19,7 +19,7 @@ completes in a single round, so rejecting continuation does not
 affect real-world deployments.  See RFC 3645 Section 4.1.3.

 (cherry picked from commit 3883058bf284de2889e4e3676767e58ad91a0ae3)
-(cherry picked from commit e3c74f19c6b3b29ec649062f95bf1df5688a0799)
+(cherry picked from commit 58c646c4b95efcda759cf194a534290eef38135e)

 Fix output token and GSS context leaks in TKEY/GSS-API error paths

@ -33,20 +33,20 @@ token, GSS context, and TSIG key are all freed consistently by the
 existing cleanup block.

 (cherry picked from commit f2240d2d06a1a68b622bd6b00a52c6fe4274426d)
-(cherry picked from commit f2f1c0cb244a6d9e2fd8550a38bd2465856abce3)
+(cherry picked from commit 7eef47ce676672f65b4988b1b5c086c4f30a9b70)
 ---
- lib/dns/gssapictx.c          | 127 ++++++++++++++++++++---------------
+ lib/dns/gssapictx.c          | 124 +++++++++++++++++++----------------
 lib/dns/include/dst/gssapi.h |  17 ++---
- lib/dns/tkey.c               |  50 +++++++-------
- 3 files changed, 104 insertions(+), 90 deletions(-)
+ lib/dns/tkey.c               |  52 +++++++--------
+ 3 files changed, 98 insertions(+), 95 deletions(-)

 diff --git a/lib/dns/gssapictx.c b/lib/dns/gssapictx.c
-index 482c25e1cc..a58c3071d4 100644
+index b0c62497a5..2a78169869 100644
 --- a/lib/dns/gssapictx.c
 +++ b/lib/dns/gssapictx.c
-@@ -594,7 +594,14 @@ dst_gssapi_initctx(dns_name_t *name, isc_buffer_t *intoken,
- 				    0, NULL, gintokenp,
- 				    NULL, &gouttoken, &ret_flags, NULL);
+@@ -606,7 +606,14 @@ dst_gssapi_initctx(const dns_name_t *name, isc_buffer_t *intoken,
+ 		GSS_SPNEGO_MECHANISM, flags, 0, NULL, gintokenp, NULL,
+ 		&gouttoken, &ret_flags, NULL);
 
 -	if (gret != GSS_S_COMPLETE && gret != GSS_S_CONTINUE_NEEDED) {
 +	switch (gret) {
@ -58,36 +58,31 @@ index 482c25e1cc..a58c3071d4 100644
 +		break;
 +	default:
 		gss_err_message(mctx, gret, minor, err_message);
- 		if (err_message != NULL && *err_message != NULL)
+ 		if (err_message != NULL && *err_message != NULL) {
 			gss_log(3, "Failure initiating security context: %s",
-@@ -619,14 +626,10 @@ dst_gssapi_initctx(dns_name_t *name, isc_buffer_t *intoken,
+@@ -632,12 +639,6 @@ dst_gssapi_initctx(const dns_name_t *name, isc_buffer_t *intoken,
 		RETERR(isc_buffer_copyregion(outtoken, &r));
 	}
 
-	if (gret == GSS_S_COMPLETE)
+-	if (gret == GSS_S_COMPLETE) {
 -		result = ISC_R_SUCCESS;
-	else
+-	} else {
 -		result = DNS_R_CONTINUE;
+-	}
 -
- out:
-	if (gouttoken.length != 0U)
-+out:
-+	if (gouttoken.length != 0U) {
+ out:
+ 	if (gouttoken.length != 0U) {
 		(void)gss_release_buffer(&minor, &gouttoken);
-+	}
- 	(void)gss_release_name(&minor, &gname);
- 	return (result);
- }
-@@ -634,7 +637,7 @@ dst_gssapi_initctx(dns_name_t *name, isc_buffer_t *intoken,
+@@ -648,7 +649,7 @@ out:
+ 
 isc_result_t
- dst_gssapi_acceptctx(gss_cred_id_t cred,
- 		     const char *gssapi_keytab,
+ dst_gssapi_acceptctx(dns_gss_cred_id_t cred, const char *gssapi_keytab,
 -		     isc_region_t *intoken, isc_buffer_t **outtoken,
 +		     isc_region_t *intoken, isc_buffer_t **outtokenp,
- 		     gss_ctx_id_t *ctxout, dns_name_t *principal,
+ 		     dns_gss_ctx_id_t *ctxout, dns_name_t *principal,
 		     isc_mem_t *mctx) {
 	isc_region_t r;
-@@ -647,15 +650,11 @@ dst_gssapi_acceptctx(gss_cred_id_t cred,
+@@ -661,16 +662,11 @@ dst_gssapi_acceptctx(dns_gss_cred_id_t cred, const char *gssapi_keytab,
 	isc_result_t result;
 	char buf[1024];
 
@ -97,15 +92,16 @@ index 482c25e1cc..a58c3071d4 100644
 
 	REGION_TO_GBUFFER(*intoken, gintoken);
 
-	if (*ctxout == NULL)
+-	if (*ctxout == NULL) {
 -		context = GSS_C_NO_CONTEXT;
-	else
+-	} else {
 -		context = *ctxout;
+-	}
 -
 	if (gssapi_keytab != NULL) {
 #if defined(ISC_PLATFORM_GSSAPI_KRB5_HEADER) || defined(WIN32)
 		gret = gsskrb5_register_acceptor_identity(gssapi_keytab);
-@@ -697,8 +696,15 @@ dst_gssapi_acceptctx(gss_cred_id_t cred,
+@@ -715,8 +711,15 @@ dst_gssapi_acceptctx(dns_gss_cred_id_t cred, const char *gssapi_keytab,
 
 	switch (gret) {
 	case GSS_S_COMPLETE:
@ -122,22 +118,22 @@ index 482c25e1cc..a58c3071d4 100644
 	case GSS_S_DEFECTIVE_TOKEN:
 	case GSS_S_DEFECTIVE_CREDENTIAL:
 	case GSS_S_BAD_SIG:
-@@ -711,7 +717,7 @@ dst_gssapi_acceptctx(gss_cred_id_t cred,
+@@ -729,7 +732,7 @@ dst_gssapi_acceptctx(dns_gss_cred_id_t cred, const char *gssapi_keytab,
 	case GSS_S_BAD_MECH:
 	case GSS_S_FAILURE:
 		result = DNS_R_INVALIDTKEY;
-		/* fall through */
+-	/* fall through */
 +		/* FALLTHROUGH */
 	default:
 		gss_log(3, "failed gss_accept_sec_context: %s",
 			gss_error_tostring(gret, minor, buf, sizeof(buf)));
-@@ -722,55 +728,70 @@ dst_gssapi_acceptctx(gss_cred_id_t cred,
+@@ -740,59 +743,70 @@ dst_gssapi_acceptctx(dns_gss_cred_id_t cred, const char *gssapi_keytab,
 	}
 
 	if (gouttoken.length > 0U) {
-		RETERR(isc_buffer_allocate(mctx, outtoken,
-+		RETERR(isc_buffer_allocate(mctx, outtokenp,
- 					   (unsigned int)gouttoken.length));
+-		isc_buffer_allocate(mctx, outtoken,
+		isc_buffer_allocate(mctx, outtokenp,
+ 				    (unsigned int)gouttoken.length);
 		GBUFFER_TO_REGION(gouttoken, r);
 -		RETERR(isc_buffer_copyregion(*outtoken, &r));
 +		result = isc_buffer_copyregion(*outtokenp, &r);
@ -151,8 +147,8 @@ index 482c25e1cc..a58c3071d4 100644
 -		gret = gss_display_name(&minor, gname, &gnamebuf, NULL);
 -		if (gret != GSS_S_COMPLETE) {
 -			gss_log(3, "failed gss_display_name: %s",
-				gss_error_tostring(gret, minor,
-						   buf, sizeof(buf)));
+-				gss_error_tostring(gret, minor, buf,
+-						   sizeof(buf)));
 -			RETERR(ISC_R_FAILURE);
 -		}
 +	INSIST(gret == GSS_S_COMPLETE);
@ -165,7 +161,9 @@ index 482c25e1cc..a58c3071d4 100644
 -		 */
 -		if (gnamebuf.length > 0U &&
 -		    ((char *)gnamebuf.value)[gnamebuf.length - 1] == '\0')
+-		{
 -			gnamebuf.length--;
+-		}
 +	gret = gss_display_name(&minor, gname, &gnamebuf, NULL);
 +	if (gret != GSS_S_COMPLETE) {
 +		gss_log(3, "failed gss_display_name: %s",
@ -194,30 +192,30 @@ index 482c25e1cc..a58c3071d4 100644
 +	gss_log(3, "gss-api source name (accept) is %.*s", (int)gnamebuf.length,
 +		(char *)gnamebuf.value);
 
-		RETERR(dns_name_fromtext(principal, &namebuf, dns_rootname,
-					 0, NULL));
+-		RETERR(dns_name_fromtext(principal, &namebuf, dns_rootname, 0,
+-					 NULL));
 +	GBUFFER_TO_REGION(gnamebuf, r);
 +	isc_buffer_init(&namebuf, r.base, r.length);
 +	isc_buffer_add(&namebuf, r.length);
 
 -		if (gnamebuf.length != 0U) {
 -			gret = gss_release_buffer(&minor, &gnamebuf);
-			if (gret != GSS_S_COMPLETE)
+-			if (gret != GSS_S_COMPLETE) {
 -				gss_log(3, "failed gss_release_buffer: %s",
 -					gss_error_tostring(gret, minor, buf,
 -							   sizeof(buf)));
+-			}
 -		}
-	} else
+-	} else {
 -		result = DNS_R_CONTINUE;
 +	result = dns_name_fromtext(principal, &namebuf, dns_rootname, 0, NULL);
 +	if (result != ISC_R_SUCCESS) {
 +		goto out;
-+	}
+ 	}
 
 	*ctxout = context;
 
- out:
-+out:
+ out:
 +	if (result != ISC_R_SUCCESS && *outtokenp != NULL) {
 +		isc_buffer_free(outtokenp);
 +	}
@ -237,17 +235,17 @@ index 482c25e1cc..a58c3071d4 100644
 +
 	if (gname != NULL) {
 		gret = gss_release_name(&minor, &gname);
- 		if (gret != GSS_S_COMPLETE)
+ 		if (gret != GSS_S_COMPLETE) {
 diff --git a/lib/dns/include/dst/gssapi.h b/lib/dns/include/dst/gssapi.h
-index 8e31587871..bf1c4c959a 100644
+index 10f8467aef..92dad43440 100644
 --- a/lib/dns/include/dst/gssapi.h
 +++ b/lib/dns/include/dst/gssapi.h
-@@ -126,20 +126,17 @@ dst_gssapi_acceptctx(gss_cred_id_t cred,
+@@ -113,20 +113,17 @@ dst_gssapi_acceptctx(dns_gss_cred_id_t cred, const char *gssapi_keytab,
  *		   generated by gss_accept_sec_context() to be sent to the
  *		   initiator
  *      'context'  is a valid pointer to receive the generated context handle.
 - *                 On the initial call, it should be a pointer to NULL, which
- *		   will be allocated as a gss_ctx_id_t.  Subsequent calls
+- *		   will be allocated as a dns_gss_ctx_id_t.  Subsequent calls
 - *		   should pass in the handle generated on the first call.
 - *		   Call dst_gssapi_releasecred to delete the context and free
 - *		   the memory.
@ -271,10 +269,10 @@ index 8e31587871..bf1c4c959a 100644
 
 isc_result_t
 diff --git a/lib/dns/tkey.c b/lib/dns/tkey.c
-index ae7a76cd3d..03bf521ee6 100644
+index b4f12a0831..e7800113d9 100644
 --- a/lib/dns/tkey.c
 +++ b/lib/dns/tkey.c
-@@ -503,18 +503,9 @@ process_gsstkey(dns_message_t *msg, dns_name_t *name, dns_rdata_tkey_t *tkeyin,
+@@ -529,19 +529,9 @@ process_gsstkey(dns_message_t *msg, dns_name_t *name, dns_rdata_tkey_t *tkeyin,
 		return (ISC_R_SUCCESS);
 	}
 
@ -287,29 +285,32 @@ index ae7a76cd3d..03bf521ee6 100644
 	intoken.length = tkeyin->keylen;
 
 -	result = dns_tsigkey_find(&tsigkey, name, &tkeyin->algorithm, ring);
-	if (result == ISC_R_SUCCESS)
+-	if (result == ISC_R_SUCCESS) {
 -		gss_ctx = dst_key_getgssctx(tsigkey->key);
+-	}
 -
 	principal = dns_fixedname_initname(&fixed);
 
 	/*
-@@ -523,25 +514,27 @@ process_gsstkey(dns_message_t *msg, dns_name_t *name, dns_rdata_tkey_t *tkeyin,
+@@ -550,28 +540,27 @@ process_gsstkey(dns_message_t *msg, dns_name_t *name, dns_rdata_tkey_t *tkeyin,
 	result = dst_gssapi_acceptctx(tctx->gsscred, tctx->gssapi_keytab,
- 				      &intoken, &outtoken, &gss_ctx,
- 				      principal, tctx->mctx);
+ 				      &intoken, &outtoken, &gss_ctx, principal,
+ 				      tctx->mctx);
 -	if (result == DNS_R_INVALIDTKEY) {
-		if (tsigkey != NULL)
+-		if (tsigkey != NULL) {
 -			dns_tsigkey_detach(&tsigkey);
+-		}
 +	if (result != ISC_R_SUCCESS) {
 		tkeyout->error = dns_tsigerror_badkey;
-		tkey_log("process_gsstkey(): dns_tsigerror_badkey");    /* XXXSRA */
+-		tkey_log("process_gsstkey(): dns_tsigerror_badkey"); /* XXXSRA
+-								      */
 -		return (ISC_R_SUCCESS);
 -	}
-	if (result != DNS_R_CONTINUE && result != ISC_R_SUCCESS)
+-	if (result != DNS_R_CONTINUE && result != ISC_R_SUCCESS) {
 +		tkey_log("process_gsstkey(): dns_tsigerror_badkey");
 +		result = ISC_R_SUCCESS;
 		goto failure;
-+	}
+ 	}
 +
 	/*
 -	 * XXXDCL Section 4.1.3: Limit GSS_S_CONTINUE_NEEDED to 10 times.
@ -332,7 +333,7 @@ index ae7a76cd3d..03bf521ee6 100644
 	} else if (tsigkey == NULL) {
 #ifdef GSSAPI
 		OM_uint32 gret, minor, lifetime;
-@@ -612,6 +605,10 @@ process_gsstkey(dns_message_t *msg, dns_name_t *name, dns_rdata_tkey_t *tkeyin,
+@@ -634,6 +623,10 @@ process_gsstkey(dns_message_t *msg, dns_name_t *name, dns_rdata_tkey_t *tkeyin,
 	return (ISC_R_SUCCESS);
 
 failure:
@ -340,15 +341,15 @@ index ae7a76cd3d..03bf521ee6 100644
 +		dst_gssapi_deletectx(tctx->mctx, &gss_ctx);
 +	}
 +
- 	if (tsigkey != NULL)
+ 	if (tsigkey != NULL) {
 		dns_tsigkey_detach(&tsigkey);
- 
-@@ -621,10 +618,10 @@ failure:
- 	if (outtoken != NULL)
+ 	}
+@@ -646,10 +639,10 @@ failure:
 		isc_buffer_free(&outtoken);
+ 	}
 
-	tkey_log("process_gsstkey(): %s",
-		isc_result_totext(result));	/* XXXSRA */
+-	tkey_log("process_gsstkey(): %s", isc_result_totext(result)); /* XXXSRA
+-								       */
 -
 -	return (result);
 +	if (result != ISC_R_SUCCESS) {
@ -358,8 +359,8 @@ index ae7a76cd3d..03bf521ee6 100644
 }
 
 static isc_result_t
-@@ -1521,9 +1518,8 @@ dns_tkey_gssnegotiate(dns_message_t *qmsg, dns_message_t *rmsg,
- 				  &dstkey, NULL));
+@@ -1558,9 +1551,8 @@ dns_tkey_gssnegotiate(dns_message_t *qmsg, dns_message_t *rmsg,
+ 				  NULL));
 
 	/*
 -	 * XXXSRA This seems confused.  If we got CONTINUE from initctx,
@ -369,7 +370,7 @@ index ae7a76cd3d..03bf521ee6 100644
 +	 * Create the TSIG key from the established context.
 	 */
 
- 	RETERR(dns_tsigkey_createfromkey(tkeyname,
+ 	RETERR(dns_tsigkey_createfromkey(
 -- 
 2.54.0

--- a/SOURCES/bind-9.16-CVE-2026-5946.patch
+++ b/SOURCES/bind-9.16-CVE-2026-5946.patch
@ -0,0 +1,719 @@
+From fdadded4959eec655fded3ddfeacec47d2250274 Mon Sep 17 00:00:00 2001
+From: Evan Hunt <each@isc.org>
+Date: Tue, 3 Mar 2026 14:00:38 -0800
+Subject: [PATCH] Disable recursion for non-IN classes
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Force recursion off, and set allow-recursion/allow-recursion-on ACLs
+to none, for views with a class other than IN. Log a configuration
+warning if recursion is explicitly enabled for a non-IN view.
+
+This addresses YWH-PGM40640-74 and YWH-PGM40640-75 by preventing any
+attempt at recursive processing in a class-CHAOS view, ensuring that
+server addresses used for recursive queries and received in recursive
+responses are of the expected format.
+
+Fixes: isc-projects/bind9#5780
+Fixes: isc-projects/bind9#5781
+
+(cherry picked from commit 70532a37a1aec761e8a12444852866ce9d9d5fcc)
+(cherry picked from commit cf0d5a4e385525e21f2ae39098b1ab90c1137a2a)
+(cherry picked from commit e577560f65dbc6109fca8a597d16568a1cd8987c)
+
+Disable UPDATE and NOTIFY for non-IN classes
+
+Return NOTIMP for UPDATE and NOTIFY requests received for views with a
+class other than IN.  Only QUERY is now supported for non-IN views such
+as CHAOS.
+
+When running dns dns_rdata_tostruct() with types that are only defined
+for class IN, ensure that the class is correct before proceeding.
+
+Add an assertion that any zone being updated is of class IN. (Note
+that previously, a DLZ zone could have its class value set incorrectly
+to NONE; this has been fixed.)
+
+This addresses YWH-PGM40640-70 and YWH-PGM40640-73 (as well as any
+similar problems that might have occurred in the future) by minimizing
+the code paths that can be reached by rdata classes other than IN, so it
+is safe for the implementation to assume that rdatatypes that are only
+defined for class IN, such as SVCB or WKS, have been parsed and
+validated, and not accepted as unknown/opaque data.
+
+Fixes: isc-projects/bind9#5777
+Fixes: isc-projects/bind9#5779
+
+(cherry picked from commit 9ae24c32bec16c0f64225ef04f34670018bf0765)
+(cherry picked from commit a2ca2408b3ff031c426c5dc785f550c9d30bf4aa)
+(cherry picked from commit bec30ad70d17e36241df9da259bb2ac85b3c3435)
+
+Validate DNS message CLASS early in request processing
+
+Reject requests with unsupported or misused CLASS values before
+further processing.  Only IN, CH, HS, RESERVED0 (for DNS Cookies),
+ANY (for TKEY negotiation), and NONE (for DNS UPDATE) are accepted;
+all other classes return NOTIMP.  Misuse of NONE or ANY outside
+their allowed contexts returns FORMERR.
+
+This adds further protection against bugs of the same general class
+as YWH-PGM40640-70 and YWH-PGM40640-73.
+
+(cherry picked from commit d41865a458b9ecd76be4097ac1bea1005cad72db)
+(cherry picked from commit 1c8016c91c3674929f87cbe7ad09f3670e05ad4e)
+(cherry picked from commit 986533b5ae8e855e23430bd7f6af7552d82e0ece)
+
+Reject meta-classes in UPDATE and NOTIFY messages
+
+NOTIFY and UPDATE messages must specify a data class in the
+QUESTION/ZONE section.  NONE and ANY are meta-classes and not
+appropriate here.  Return FORMERR if either is used.
+
+Rejecting messages with a query class of NONE addresses YWH-PGM40640-72,
+YWH-PGM40640-82, and YWH-PGM40640-83.  Rejecting messages with a query
+class of ANY addresses YWH-PGM40640-87, YWH-PGM40640-88, and
+YWH-PGM40640-117.
+
+Fixes: isc-projects/bind9#5778
+Fixes: isc-projects/bind9#5782
+Fixes: isc-projects/bind9#5783
+Fixes: isc-projects/bind9#5797
+Fixes: isc-projects/bind9#5798
+Fixes: isc-projects/bind9#5853
+
+(cherry picked from commit 7de5160517ae69196d1c323b8627b267cdd10761)
+(cherry picked from commit 3c44de9e6252ec1c7742ef02ecc0d6cbf1cde5e9)
+(cherry picked from commit e7468f6be6dc98f86508627f4f333b6d09d2ac31)
+
+Skip "deny-answer-address" for non-IN addresses
+
+Ensure that we don't attempt an ACL match for answer addresses
+when handling a class-CHAOS zone. This is an additional line of
+defense for YWH-PGM40640-74.
+
+(cherry picked from commit 4cd3d8e6d866143ddc62df821a1007bf3ee7f083)
+(cherry picked from commit fa60101e910346e64fa2a684b903fbcb84d8243b)
+(cherry picked from commit e60ee54f7d650783d3b6dd7fdd749c64c6593353)
+
+Pass empty string instead of NULL to ns_client_dumpmessage()
+
+The two new call sites added by the CLASS-validation work passed NULL
+as the reason, but ns_client_dumpmessage() bails out early on a NULL
+reason — so the message dump never happened. The intent was to dump
+the message and let the follow-up ns_client_log() carry the reason
+text, so pass "" to suppress the prefix without short-circuiting the
+dump.
+
+(cherry picked from commit 8af39c360407a92ef31bf233b9df760d1bb9fb5f)
+(cherry picked from commit cd3a72e414d35c2ae573f4faea1148a95db7d5ff)
+
+%RH
+fixed resolver, checkconf test
+---
+ bin/named/server.c                            | 42 ++++--------
+ bin/tests/system/checkconf/tests.sh           | 14 +++-
+ .../checkconf/warn-chaos-recursion.conf       | 25 ++++++++
+ bin/tests/system/resolver/tests.sh            |  8 ++-
+ bin/tests/system/unknown/tests.sh             | 12 ++--
+ lib/bind9/check.c                             | 22 ++++++-
+ lib/dns/adb.c                                 |  3 +-
+ lib/dns/message.c                             | 11 ++++
+ lib/dns/resolver.c                            | 13 +++-
+ lib/ns/client.c                               | 64 ++++++++++++++++---
+ lib/ns/update.c                               | 38 +++++------
+ 11 files changed, 177 insertions(+), 75 deletions(-)
+ create mode 100644 bin/tests/system/checkconf/warn-chaos-recursion.conf
+
+diff --git a/bin/named/server.c b/bin/named/server.c
+index 098e21d0ac..9e33dc6349 100644
+--- a/bin/named/server.c
+++ b/bin/named/server.c
+@@ -1932,10 +1932,12 @@ dlzconfigure_callback(dns_view_t *view, dns_dlzdb_t *dlzdb, dns_zone_t *zone) {
+ 	dns_rdataclass_t zclass = view->rdclass;
+ 	isc_result_t result;
+ 
+	dns_zone_setclass(zone, zclass);
+ 	result = dns_zonemgr_managezone(named_g_server->zonemgr, zone);
+ 	if (result != ISC_R_SUCCESS) {
+ 		return (result);
+ 	}
+
+ 	dns_zone_setstats(zone, named_g_server->zonestats);
+ 
+ 	return (named_zone_configure_writeable_dlz(dlzdb, zone, zclass,
+@@ -4215,6 +4217,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
+ 	obj = NULL;
+ 	result = named_config_get(maps, "max-cache-size", &obj);
+ 	INSIST(result == ISC_R_SUCCESS);
+
+ 	/*
+ 	 * If "-T maxcachesize=..." is in effect, it overrides any other
+ 	 * "max-cache-size" setting found in configuration, either implicit or
+@@ -4965,34 +4968,15 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
+ 	}
+ 
+ 	/*
+-	 * We have default hints for class IN if we need them.
+	 * We have default root hints for class IN if we need them.
+	 * Each view gets its own rootdb so a priming response only
+	 * writes into that view's copy.  Other classes don't support
+	 * recursion and don't need hints.
+ 	 */
+ 	if (view->rdclass == dns_rdataclass_in && view->hints == NULL) {
+ 		dns_view_sethints(view, named_g_server->in_roothints);
+ 	}
+ 
+-	/*
+-	 * If we still have no hints, this is a non-IN view with no
+-	 * "hints zone" configured.  Issue a warning, except if this
+-	 * is a root server.  Root servers never need to consult
+-	 * their hints, so it's no point requiring users to configure
+-	 * them.
+-	 */
+-	if (view->hints == NULL) {
+-		dns_zone_t *rootzone = NULL;
+-		(void)dns_view_findzone(view, dns_rootname, &rootzone);
+-		if (rootzone != NULL) {
+-			dns_zone_detach(&rootzone);
+-			need_hints = false;
+-		}
+-		if (need_hints) {
+-			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+-				      NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
+-				      "no root hints for view '%s'",
+-				      view->name);
+-		}
+-	}
+-
+ 	/*
+ 	 * Configure the view's TSIG keys.
+ 	 */
+@@ -5102,7 +5086,8 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
+ 	obj = NULL;
+ 	result = named_config_get(maps, "recursion", &obj);
+ 	INSIST(result == ISC_R_SUCCESS);
+-	view->recursion = cfg_obj_asboolean(obj);
+	view->recursion = (view->rdclass == dns_rdataclass_in &&
+			   cfg_obj_asboolean(obj));
+ 
+ 	obj = NULL;
+ 	result = named_config_get(maps, "qname-minimization", &obj);
+@@ -5201,14 +5186,13 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
+ 	CHECK(configure_view_acl(vconfig, config, NULL, "allow-query-cache-on",
+ 				 NULL, actx, named_g_mctx, &view->cacheonacl));
+ 
+-	if (strcmp(view->name, "_bind") != 0 &&
+-	    view->rdclass != dns_rdataclass_chaos)
+-	{
+-		/* named.conf only */
+	if (view->rdclass != dns_rdataclass_in) {
+		dns_acl_none(named_g_mctx, &view->recursionacl);
+		dns_acl_none(named_g_mctx, &view->recursiononacl);
+	} else {
+ 		CHECK(configure_view_acl(vconfig, config, NULL,
+ 					 "allow-recursion", NULL, actx,
+ 					 named_g_mctx, &view->recursionacl));
+-		/* named.conf only */
+ 		CHECK(configure_view_acl(vconfig, config, NULL,
+ 					 "allow-recursion-on", NULL, actx,
+ 					 named_g_mctx, &view->recursiononacl));
+diff --git a/bin/tests/system/checkconf/tests.sh b/bin/tests/system/checkconf/tests.sh
+index c8f883e38d..34d2aebf24 100644
+--- a/bin/tests/system/checkconf/tests.sh
+++ b/bin/tests/system/checkconf/tests.sh
+@@ -481,7 +481,8 @@ $CHECKCONF -l good.conf \
+   | grep -v "is not implemented" \
+   | grep -v "is not recommended" \
+   | grep -v "no longer exists" \
+-  | grep -v "is obsolete" >checkconf.out$n || ret=1
+  | grep -v "is obsolete" \
+  | grep -v "recursion will be disabled" >checkconf.out$n || ret=1
+ diff good.zonelist checkconf.out$n >diff.out$n || ret=1
+ if [ $ret -ne 0 ]; then
+   echo_i "failed"
+@@ -763,5 +764,16 @@ status=$(expr $status + $ret)
+ 
+ rmdir keys
+ 
+n=$((n + 1))
+echo_i "check 'recursion yes;' is warned and disabled in a non-IN view ($n)"
+ret=0
+$CHECKCONF warn-chaos-recursion.conf >checkconf.out$n 2>&1 || ret=1
+grep -F "recursion will be disabled" checkconf.out$n >/dev/null || ret=1
+if [ $ret != 0 ]; then
+  echo_i "failed"
+  ret=1
+fi
+status=$((status + ret))
+
+ echo_i "exit status: $status"
+ [ $status -eq 0 ] || exit 1
+diff --git a/bin/tests/system/checkconf/warn-chaos-recursion.conf b/bin/tests/system/checkconf/warn-chaos-recursion.conf
+new file mode 100644
+index 0000000000..e384533c0a
+--- /dev/null
+++ b/bin/tests/system/checkconf/warn-chaos-recursion.conf
+@@ -0,0 +1,25 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	directory ".";
+};
+
+view chaos ch {
+        match-clients { any; };
+        recursion yes;
+        zone "." {
+                type hint;
+                file "chaos.hints";
+        };
+};
+diff --git a/bin/tests/system/resolver/tests.sh b/bin/tests/system/resolver/tests.sh
+index fc05635e31..6e1fdaddfa 100755
+--- a/bin/tests/system/resolver/tests.sh
+++ b/bin/tests/system/resolver/tests.sh
+@@ -897,10 +897,12 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
+ status=$((status + ret))
+ 
+ n=$((n + 1))
+-echo_i "checking NXDOMAIN is returned when querying non existing domain in CH class ($n)"
+echo_i "checking REFUSED is returned when querying non existing domain in CH class ($n)"
+ ret=0
+-dig_with_opts @10.53.0.1 id.hostname txt ch >dig.ns1.out.${n} || ret=1
+-grep "status: NXDOMAIN" dig.ns1.out.${n} >/dev/null || ret=1
+dig_with_opts @10.53.0.1 hostname.chaostest txt ch >dig.ns1.out.1.${n} || ret=1
+grep "status: NOERROR" dig.ns1.out.1.${n} >/dev/null || ret=1
+dig_with_opts @10.53.0.1 id.hostname txt ch >dig.ns1.out.2.${n} || ret=1
+grep "status: REFUSED" dig.ns1.out.2.${n} >/dev/null || ret=1
+ if [ $ret != 0 ]; then echo_i "failed"; fi
+ status=$((status + ret))
+ 
+diff --git a/bin/tests/system/unknown/tests.sh b/bin/tests/system/unknown/tests.sh
+index b14548a039..092ae2d308 100644
+--- a/bin/tests/system/unknown/tests.sh
+++ b/bin/tests/system/unknown/tests.sh
+@@ -75,8 +75,8 @@ n=$((n + 1))
+ echo_i "querying for various representations of a CLASS10 TYPE1 record ($n)"
+ for i in 1 2; do
+   ret=0
+-  $DIG +short $DIGOPTS @10.53.0.1 a$i.example a class10 >dig.out.$i.test$n || ret=1
+-  echo '\# 4 0A000001' | $DIFF - dig.out.$i.test$n || ret=1
+  $DIG $DIGOPTS @10.53.0.1 a$i.example a class10 >dig.out.$i.test$n || ret=1
+  grep -q "NOTIMP" dig.out.$i.test$n || ret=1
+   if [ $ret != 0 ]; then
+     echo_i "#$i failed"
+   fi
+@@ -87,8 +87,8 @@ n=$((n + 1))
+ echo_i "querying for various representations of a CLASS10 TXT record ($n)"
+ for i in 1 2 3 4; do
+   ret=0
+-  $DIG +short $DIGOPTS @10.53.0.1 txt$i.example txt class10 >dig.out.$i.test$n || ret=1
+-  echo '"hello"' | $DIFF - dig.out.$i.test$n || ret=1
+  $DIG $DIGOPTS @10.53.0.1 txt$i.example txt class10 >dig.out.$i.test$n || ret=1
+  grep -q "NOTIMP" dig.out.$i.test$n || ret=1
+   if [ $ret != 0 ]; then
+     echo_i "#$i failed"
+   fi
+@@ -99,8 +99,8 @@ n=$((n + 1))
+ echo_i "querying for various representations of a CLASS10 TYPE123 record ($n)"
+ for i in 1 2; do
+   ret=0
+-  $DIG +short $DIGOPTS @10.53.0.1 unk$i.example type123 class10 >dig.out.$i.test$n || ret=1
+-  echo '\# 1 00' | $DIFF - dig.out.$i.test$n || ret=1
+  $DIG $DIGOPTS @10.53.0.1 unk$i.example type123 class10 >dig.out.$i.test$n || ret=1
+  grep -q "NOTIMP" dig.out.$i.test$n || ret=1
+   if [ $ret != 0 ]; then
+     echo_i "#$i failed"
+   fi
+diff --git a/lib/bind9/check.c b/lib/bind9/check.c
+index ee64543ab8..9935b8a8f3 100644
+--- a/lib/bind9/check.c
+++ b/lib/bind9/check.c
+@@ -2292,13 +2292,17 @@ check_mirror_zone_notify(const cfg_obj_t *zoptions, const char *znamestr,
+  */
+ static bool
+ check_recursion(const cfg_obj_t *config, const cfg_obj_t *voptions,
+-		const cfg_obj_t *goptions, isc_log_t *logctx,
+-		cfg_aclconfctx_t *actx, isc_mem_t *mctx) {
+		dns_rdataclass_t vclass, const cfg_obj_t *goptions,
+		isc_log_t *logctx, cfg_aclconfctx_t *actx, isc_mem_t *mctx) {
+ 	dns_acl_t *acl = NULL;
+ 	const cfg_obj_t *obj;
+ 	isc_result_t result;
+ 	bool retval = true;
+ 
+	if (vclass != dns_rdataclass_in) {
+		return false;
+	}
+
+ 	/*
+ 	 * Check the "recursion" option first.
+ 	 */
+@@ -2878,7 +2882,8 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
+ 	 * contradicts the purpose of the former.
+ 	 */
+ 	if (ztype == CFG_ZONE_MIRROR &&
+-	    !check_recursion(config, voptions, goptions, logctx, actx, mctx))
+	    !check_recursion(config, voptions, zclass, goptions, logctx, actx,
+			     mctx))
+ 	{
+ 		cfg_obj_log(zoptions, logctx, ISC_LOG_ERROR,
+ 			    "zone '%s': mirror zones cannot be used if "
+@@ -4631,6 +4636,17 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *voptions,
+ 
+ 	cfg_aclconfctx_create(mctx, &actx);
+ 
+	if (vclass != dns_rdataclass_in) {
+		if (check_recursion(config, voptions, dns_rdataclass_in,
+				    options, logctx, actx, mctx))
+		{
+			cfg_obj_log(opts, logctx, ISC_LOG_WARNING,
+				    "recursion will be disabled for "
+				    "non-IN view '%s'",
+				    viewname);
+		}
+	}
+
+ 	if (voptions != NULL) {
+ 		(void)cfg_map_get(voptions, "zone", &zones);
+ 	} else {
+diff --git a/lib/dns/adb.c b/lib/dns/adb.c
+index 6f98feca45..a97239570b 100644
+--- a/lib/dns/adb.c
+++ b/lib/dns/adb.c
+@@ -926,7 +926,8 @@ import_rdataset(dns_adbname_t *adbname, dns_rdataset_t *rdataset,
+ 	INSIST(DNS_ADB_VALID(adb));
+ 
+ 	rdtype = rdataset->type;
+-	INSIST((rdtype == dns_rdatatype_a) || (rdtype == dns_rdatatype_aaaa));
+	REQUIRE(rdtype == dns_rdatatype_a || rdtype == dns_rdatatype_aaaa);
+
+ 	if (rdtype == dns_rdatatype_a) {
+ 		findoptions = DNS_ADBFIND_INET;
+ 	} else {
+diff --git a/lib/dns/message.c b/lib/dns/message.c
+index 22aa552f3f..ba374c4336 100644
+--- a/lib/dns/message.c
+++ b/lib/dns/message.c
+@@ -1087,6 +1087,17 @@ getquestions(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
+ 		rdtype = isc_buffer_getuint16(source);
+ 		rdclass = isc_buffer_getuint16(source);
+ 
+		/*
+		 * Notify and update messages need to specify the data class.
+		 */
+		if ((msg->opcode == dns_opcode_update ||
+		     msg->opcode == dns_opcode_notify) &&
+		    (rdclass == dns_rdataclass_none ||
+		     rdclass == dns_rdataclass_any))
+		{
+			DO_ERROR(DNS_R_FORMERR);
+		}
+
+ 		/*
+ 		 * If this class is different than the one we already read,
+ 		 * this is an error.
+diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
+index 0952624689..0d7d0735db 100644
+--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
+@@ -7367,9 +7367,16 @@ is_answeraddress_allowed(dns_view_t *view, dns_name_t *name,
+ 	}
+ 
+ 	/*
+-	 * Otherwise, search the filter list for a match for each address
+-	 * record.  If a match is found, the address should be filtered,
+-	 * so should the entire answer.
+	 * deny-answer-address doesn't apply to non-IN classes.
+	 */
+	if (rdataset->rdclass != dns_rdataclass_in) {
+		return true;
+	}
+
+	/*
+	 * Otherwise, search the filter list for a match for each
+	 * address record.  If a match is found, the address should be
+	 * filtered, so should the entire answer.
+ 	 */
+ 	for (result = dns_rdataset_first(rdataset); result == ISC_R_SUCCESS;
+ 	     result = dns_rdataset_next(rdataset))
+diff --git a/lib/ns/client.c b/lib/ns/client.c
+index d4ce000be8..b1e1d6c0b9 100644
+--- a/lib/ns/client.c
+++ b/lib/ns/client.c
+@@ -43,6 +43,7 @@
+ #include <dns/dispatch.h>
+ #include <dns/dnstap.h>
+ #include <dns/edns.h>
+#include <dns/enumclass.h>
+ #include <dns/events.h>
+ #include <dns/message.h>
+ #include <dns/peer.h>
+@@ -1933,7 +1934,9 @@ ns__client_request(isc_nmhandle_t *handle, isc_result_t eresult,
+ 		}
+ 	}
+ 
+-	if (client->message->rdclass == 0) {
+	char classbuf[DNS_RDATACLASS_FORMATSIZE];
+	switch (client->message->rdclass) {
+	case dns_rdataclass_reserved0:
+ 		if ((client->attributes & NS_CLIENTATTR_WANTCOOKIE) != 0 &&
+ 		    client->message->opcode == dns_opcode_query &&
+ 		    client->message->counts[DNS_SECTION_QUESTION] == 0U)
+@@ -1954,12 +1957,49 @@ ns__client_request(isc_nmhandle_t *handle, isc_result_t eresult,
+ 			return;
+ 		}
+ 
+		ns_client_dumpmessage(client,
+				      "message class could not be determined");
+		ns_client_error(client, notimp ? DNS_R_NOTIMP : DNS_R_FORMERR);
+		isc_task_unpause(client->task);
+		return;
+	case dns_rdataclass_in:
+		break;
+	case dns_rdataclass_chaos:
+		break;
+	case dns_rdataclass_hs:
+		break;
+	case dns_rdataclass_none:
+		if (client->message->opcode != dns_opcode_update) {
+			ns_client_dumpmessage(client,
+					      "message class NONE can be only "
+					      "used in DNS updates");
+			ns_client_error(client, DNS_R_FORMERR);
+			isc_task_unpause(client->task);
+			return;
+		}
+		break;
+	case dns_rdataclass_any:
+		/*
+		 * Required for TKEY negotiation.
+		 */
+		if (client->message->tkey == 0) {
+			ns_client_dumpmessage(client,
+					      "message class ANY can be only "
+					      "used for TKEY negotiation");
+			ns_client_error(client, DNS_R_FORMERR);
+			isc_task_unpause(client->task);
+			return;
+		}
+		break;
+	default:
+		dns_rdataclass_format(client->message->rdclass, classbuf,
+				      sizeof(classbuf));
+		ns_client_dumpmessage(client, "");
+ 		ns_client_log(client, NS_LOGCATEGORY_CLIENT,
+ 			      NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(1),
+-			      "message class could not be determined");
+-		ns_client_dumpmessage(client, "message class could not be "
+-					      "determined");
+-		ns_client_error(client, notimp ? DNS_R_NOTIMP : DNS_R_FORMERR);
+			      "invalid message class: %s", classbuf);
+
+		ns_client_error(client, DNS_R_NOTIMP);
+ 		isc_task_unpause(client->task);
+ 		return;
+ 	}
+@@ -1998,7 +2038,7 @@ ns__client_request(isc_nmhandle_t *handle, isc_result_t eresult,
+ 		ns_client_log(client, NS_LOGCATEGORY_CLIENT,
+ 			      NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(1),
+ 			      "no matching view in class '%s'", classname);
+-		ns_client_dumpmessage(client, "no matching view in class");
+		ns_client_dumpmessage(client, "");
+ 		ns_client_error(client, notimp ? DNS_R_NOTIMP : DNS_R_REFUSED);
+ 		isc_task_unpause(client->task);
+ 		return;
+@@ -2175,6 +2215,10 @@ ns__client_request(isc_nmhandle_t *handle, isc_result_t eresult,
+ 		break;
+ 	case dns_opcode_update:
+ 		CTRACE("update");
+		if (client->view->rdclass != dns_rdataclass_in) {
+			ns_client_error(client, DNS_R_NOTIMP);
+			break;
+		}
+ #ifdef HAVE_DNSTAP
+ 		dns_dt_send(client->view, DNS_DTTYPE_UQ, &client->peeraddr,
+ 			    &client->destsockaddr, TCP_CLIENT(client), NULL,
+@@ -2185,6 +2229,10 @@ ns__client_request(isc_nmhandle_t *handle, isc_result_t eresult,
+ 		break;
+ 	case dns_opcode_notify:
+ 		CTRACE("notify");
+		if (client->view->rdclass != dns_rdataclass_in) {
+			ns_client_error(client, DNS_R_NOTIMP);
+			break;
+		}
+ 		ns_client_settimeout(client, 60);
+ 		ns_notify_start(client, handle);
+ 		break;
+@@ -2276,7 +2324,7 @@ ns__client_setup(ns_client_t *client, ns_clientmgr_t *mgr, bool new) {
+ 	 * The caller is responsible for that.
+ 	 */
+ 
+-	REQUIRE(NS_CLIENT_VALID(client) || (new &&client != NULL));
+	REQUIRE(NS_CLIENT_VALID(client) || (new && client != NULL));
+ 	REQUIRE(VALID_MANAGER(mgr) || !new);
+ 
+ 	if (new) {
+@@ -2735,7 +2783,7 @@ ns_client_dumpmessage(ns_client_t *client, const char *reason) {
+ 	int len = 1024;
+ 	isc_result_t result;
+ 
+-	if (!isc_log_wouldlog(ns_lctx, ISC_LOG_DEBUG(1))) {
+	if (!isc_log_wouldlog(ns_lctx, ISC_LOG_DEBUG(1)) || reason == NULL) {
+ 		return;
+ 	}
+ 
+diff --git a/lib/ns/update.c b/lib/ns/update.c
+index 4e51cdcb77..2792058099 100644
+--- a/lib/ns/update.c
+++ b/lib/ns/update.c
+@@ -1294,7 +1294,10 @@ replaces_p(dns_rdata_t *update_rr, dns_rdata_t *db_rr) {
+ 			return (true);
+ 		}
+ 	}
+-	if (db_rr->type == dns_rdatatype_wks) {
+
+	if (db_rr->rdclass == dns_rdataclass_in &&
+	    db_rr->type == dns_rdatatype_wks)
+	{
+ 		/*
+ 		 * Compare the address and protocol fields only.  These
+ 		 * form the first five bytes of the RR data.  Do a
+@@ -1438,8 +1441,7 @@ failure:
+  * 'rdata', and 'ttl', respectively.
+  */
+ static void
+-get_current_rr(dns_message_t *msg, dns_section_t section,
+-	       dns_rdataclass_t zoneclass, dns_name_t **name,
+get_current_rr(dns_message_t *msg, dns_section_t section, dns_name_t **name,
+ 	       dns_rdata_t *rdata, dns_rdatatype_t *covers, dns_ttl_t *ttl,
+ 	       dns_rdataclass_t *update_class) {
+ 	dns_rdataset_t *rdataset;
+@@ -1455,7 +1457,7 @@ get_current_rr(dns_message_t *msg, dns_section_t section,
+ 	dns_rdataset_current(rdataset, rdata);
+ 	INSIST(dns_rdataset_next(rdataset) == ISC_R_NOMORE);
+ 	*update_class = rdata->rdclass;
+-	rdata->rdclass = zoneclass;
+	rdata->rdclass = dns_rdataclass_in;
+ }
+ 
+ /*%
+@@ -1557,7 +1559,6 @@ send_update_event(ns_client_t *client, dns_zone_t *zone) {
+ 	dns_message_t *request = client->message;
+ 	dns_aclenv_t *env =
+ 		ns_interfacemgr_getaclenv(client->manager->interface->mgr);
+-	dns_rdataclass_t zoneclass;
+ 	dns_rdatatype_t covers;
+ 	dns_name_t *zonename = NULL;
+ 	dns_db_t *db = NULL;
+@@ -1565,10 +1566,12 @@ send_update_event(ns_client_t *client, dns_zone_t *zone) {
+ 
+ 	CHECK(dns_zone_getdb(zone, &db));
+ 	zonename = dns_db_origin(db);
+-	zoneclass = dns_db_class(db);
+ 	dns_zone_getssutable(zone, &ssutable);
+ 	dns_db_currentversion(db, &ver);
+ 
+	/* Updates are only supported for class IN. */
+	INSIST(dns_zone_getclass(zone) == dns_rdataclass_in);
+
+ 	/*
+ 	 * Update message processing can leak record existence information
+ 	 * so check that we are allowed to query this zone.  Additionally,
+@@ -1609,13 +1612,13 @@ send_update_event(ns_client_t *client, dns_zone_t *zone) {
+ 		dns_ttl_t ttl;
+ 		dns_rdataclass_t update_class;
+ 
+-		get_current_rr(request, DNS_SECTION_UPDATE, zoneclass, &name,
+		get_current_rr(request, DNS_SECTION_UPDATE, &name,
+ 			       &rdata, &covers, &ttl, &update_class);
+ 
+ 		if (!dns_name_issubdomain(name, zonename)) {
+ 			FAILC(DNS_R_NOTZONE, "update RR is outside zone");
+ 		}
+-		if (update_class == zoneclass) {
+		if (update_class == dns_rdataclass_in) {
+ 			/*
+ 			 * Check for meta-RRs.  The RFC2136 pseudocode says
+ 			 * check for ANY|AXFR|MAILA|MAILB, but the text adds
+@@ -2755,9 +2758,7 @@ update_action(isc_task_t *task, isc_event_t *event) {
+ 	isc_mem_t *mctx = client->mctx;
+ 	dns_rdatatype_t covers;
+ 	dns_message_t *request = client->message;
+-	dns_rdataclass_t zoneclass;
+ 	dns_name_t *zonename = NULL;
+-	dns_ssutable_t *ssutable = NULL;
+ 	dns_fixedname_t tmpnamefixed;
+ 	dns_name_t *tmpname = NULL;
+ 	dns_zoneopt_t options;
+@@ -2776,10 +2777,9 @@ update_action(isc_task_t *task, isc_event_t *event) {
+ 
+ 	CHECK(dns_zone_getdb(zone, &db));
+ 	zonename = dns_db_origin(db);
+-	zoneclass = dns_db_class(db);
+-	dns_zone_getssutable(zone, &ssutable);
+ 	options = dns_zone_getoptions(zone);
+ 
+	INSIST(dns_zone_getclass(zone) == dns_rdataclass_in);
+ 	/*
+ 	 * Get old and new versions now that queryacl has been checked.
+ 	 */
+@@ -2800,8 +2800,8 @@ update_action(isc_task_t *task, isc_event_t *event) {
+ 		dns_rdataclass_t update_class;
+ 		bool flag;
+ 
+-		get_current_rr(request, DNS_SECTION_PREREQUISITE, zoneclass,
+-			       &name, &rdata, &covers, &ttl, &update_class);
+		get_current_rr(request, DNS_SECTION_PREREQUISITE, &name, &rdata,
+			       &covers, &ttl, &update_class);
+ 
+ 		if (ttl != 0) {
+ 			PREREQFAILC(DNS_R_FORMERR, "prerequisite TTL is not "
+@@ -2868,7 +2868,7 @@ update_action(isc_task_t *task, isc_event_t *event) {
+ 						     "satisfied");
+ 				}
+ 			}
+-		} else if (update_class == zoneclass) {
+		} else if (update_class == dns_rdataclass_in) {
+ 			/* "temp<rr.name, rr.type> += rr;" */
+ 			result = temp_append(&temp, name, &rdata);
+ 			if (result != ISC_R_SUCCESS) {
+@@ -2927,10 +2927,10 @@ update_action(isc_task_t *task, isc_event_t *event) {
+ 		dns_rdataclass_t update_class;
+ 		bool flag;
+ 
+-		get_current_rr(request, DNS_SECTION_UPDATE, zoneclass, &name,
+		get_current_rr(request, DNS_SECTION_UPDATE, &name,
+ 			       &rdata, &covers, &ttl, &update_class);
+ 
+-		if (update_class == zoneclass) {
+		if (update_class == dns_rdataclass_in) {
+ 			/*
+ 			 * RFC1123 doesn't allow MF and MD in master zones.
+ 			 */
+@@ -3507,10 +3507,6 @@ common:
+ 		dns_db_detach(&db);
+ 	}
+ 
+-	if (ssutable != NULL) {
+-		dns_ssutable_detach(&ssutable);
+-	}
+-
+ 	isc_task_detach(&task);
+ 	uev->result = result;
+ 	if (zone != NULL) {
+-- 
+2.55.0
+
--- a/SOURCES/bind-9.16-RH-inline-signing.patch
+++ b/SOURCES/bind-9.16-RH-inline-signing.patch
@ -0,0 +1,70 @@
+From fb3761d9b1ca804fd6c2acabe42745f9ee79bac0 Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Thu, 18 Jul 2024 19:36:04 +0200
+Subject: [PATCH] Do not block start if inline-signing and dyn. updates are not
+ set
+
+Attempts to modify behaviour done in 9.16.33. It requires explicit
+specification of inline-signing yes for any zone, which has specified
+dnssec-policy. For primary zones also when  allow-update and
+update-policy are disabled. Turn it into warning only on RHEL builds,
+do not prevent starting of named.
+
+That should roughly emulate error message present on 9.16.23:
+'inline-signing;' cannot be set to 'no' if dnssec-policy is also set on
+a non-dynamic DNS zone.
+
+But point a link into upstream KB article in any case. This has appeared
+only when inline-signing were specified in a zone block. For that case
+make it still fatal, but with new message.
+
+https://downloads.isc.org/isc/bind9/9.16.50/doc/arm/html/notes.html#known-issues
+
+Related to upstream commit 30fceec069ae0942749e6aa783f67756e82fcaae.
+---
+ lib/bind9/check.c | 18 +++++++++++++++---
+ 1 file changed, 15 insertions(+), 3 deletions(-)
+
+diff --git a/lib/bind9/check.c b/lib/bind9/check.c
+index ee64543..01c03d3 100644
+--- a/lib/bind9/check.c
+++ b/lib/bind9/check.c
+@@ -2951,20 +2951,32 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
+ 		}
+ 
+ 		if (has_dnssecpolicy) {
+			/* Red Hat downstream change. Warn only about inline-signing
+			 * if inline-signing is not present in zone definition.
+			 * But fail hard if present, but disabled, like before. */
+ 			if (!ddns && !signing) {
+-				cfg_obj_log(kasp, logctx, ISC_LOG_ERROR,
+-					    "'inline-signing yes;' must also "
+				const char *verb = "should";
+				int log_lvl = ISC_LOG_WARNING;
+
+				if (res1 == ISC_R_SUCCESS) {
+					verb = "must";
+					log_lvl = ISC_LOG_ERROR;
+					result = ISC_R_FAILURE;
+				}
+
+				cfg_obj_log(kasp, logctx, log_lvl,
+					    "'inline-signing yes;' %s also "
+ 					    "be configured explicitly for "
+ 					    "zones using dnssec-policy%s. See "
+ 					    "https://kb.isc.org/docs/"
+ 					    "dnssec-policy-requires-dynamic-"
+ 					    "dns-or-inline-signing",
+					    verb,
+ 					    (ztype == CFG_ZONE_PRIMARY)
+ 						    ? " without a configured "
+ 						      "'allow-update' or "
+ 						      "'update-policy'"
+ 						    : "");
+-				result = ISC_R_FAILURE;
+ 			}
+ 		}
+ 
+-- 
+2.45.2
+
--- a/SOURCES/bind-9.16-python-isc-distutils.patch
+++ b/SOURCES/bind-9.16-python-isc-distutils.patch
@ -0,0 +1,34 @@
+From ebedaa79b93dfcb4f41169095ae02f59dedb3fa1 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
+Date: Tue, 2 Dec 2025 17:29:59 +0100
+Subject: [PATCH] Swap order of tried setuptools providers
+
+Older distutils.core will generate only a single file, not whole
+directory. That is needed for upgrade test. For newer distributions,
+setuptools should still work.
+
+To keep backward compatibility with 9.16.23, prefer distutils.
+---
+ bin/python/setup.py | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/bin/python/setup.py b/bin/python/setup.py
+index 4440b74..dc96561 100644
+--- a/bin/python/setup.py
+++ b/bin/python/setup.py
+@@ -10,10 +10,10 @@
+ # information regarding copyright ownership.
+ 
+ try:
+-    from setuptools import setup
+-except ImportError:
+     # pylint: disable=deprecated-module
+     from distutils.core import setup
+except ImportError:
+    from setuptools import setup
+ 
+ setup(
+     name="isc",
+-- 
+2.52.0
+
--- a/SOURCES/bind-9.16-redhat_doc.patch
+++ b/SOURCES/bind-9.16-redhat_doc.patch
@ -0,0 +1,60 @@
+From 3a161af91bffcd457586ab466e32ac8484028763 Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Wed, 17 Jun 2020 23:17:13 +0200
+Subject: [PATCH] Update man named with Red Hat specifics
+
+This is almost unmodified text and requires revalidation. Some of those
+statements are no longer correct.
+---
+ bin/named/named.rst | 35 +++++++++++++++++++++++++++++++++++
+ 1 file changed, 35 insertions(+)
+
+diff --git a/bin/named/named.rst b/bin/named/named.rst
+index 6fd8f87..3cd6350 100644
+--- a/bin/named/named.rst
+++ b/bin/named/named.rst
+@@ -228,6 +228,41 @@ Files
+ ``/var/run/named/named.pid``
+    The default process-id file.
+ 
+Notes
+~~~~~
+
+**Red Hat SELinux BIND Security Profile:**
+
+By default, Red Hat ships BIND with the most secure SELinux policy
+that will not prevent normal BIND operation and will prevent exploitation
+of all known BIND security vulnerabilities. See the selinux(8) man page
+for information about SElinux.
+
+It is not necessary to run named in a chroot environment if the Red Hat
+SELinux policy for named is enabled. When enabled, this policy is far
+more secure than a chroot environment. Users are recommended to enable
+SELinux and remove the bind-chroot package.
+
+*With this extra security comes some restrictions:*
+
+By default, the SELinux policy does not allow named to write outside directory
+/var/named. That directory used to be read-only for named, but write access is
+enabled by default now.
+
+The "named" group must be granted read privelege to
+these files in order for named to be enabled to read them.
+Any file updated by named must be writeable by named user or named group.
+
+Any file created in the zone database file directory is automatically assigned
+the SELinux file context *named_zone_t* .
+
+The Red Hat BIND distribution and SELinux policy creates three directories where
+named were allowed to create and modify files: */var/named/slaves*, */var/named/dynamic*
+*/var/named/data*. The service is able to write and file under */var/named* with appropriate
+permissions. They are used for better organisation of zones and backward compatibility.
+Files in these directories are automatically assigned the '*named_cache_t*'
+file context, which SELinux always allows named to write.
+
+ See Also
+ ~~~~~~~~
+ 
+-- 
+2.26.2
+
--- a/SOURCES/bind-9.16-remove-openssl-api-level-check-for-engine.patch
+++ b/SOURCES/bind-9.16-remove-openssl-api-level-check-for-engine.patch
@ -0,0 +1,35 @@
+From 68c631cf8dc67cb315d738a55a97fff26c0818e7 Mon Sep 17 00:00:00 2001
+From: Fedor Vorobev <fvorobev@redhat.com>
+Date: Thu, 23 Jul 2026 10:55:42 +0200
+Subject: [PATCH] Remove OPENSSL_API_LEVEL < 30000 check from an engine check.
+
+It was added in 5f8ac682c9912aaf564595f73f777672743f56aa upstream
+commit, which was a cherry pick from a newer version of bind. As this is
+the only instance of OPENSSL_API_LEVEL < 30000 within bind 9.16.50, I
+believe it was done in error.
+
+This check was preventing bind from finding the OpenSSL engine for RSA
+algorithms. `dnssec-keyfromlabel` would error out with 'no engine'
+whenever an RSA algorithm was used.
+
+Resolves: RHEL-213788
+---
+ lib/dns/opensslrsa_link.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/dns/opensslrsa_link.c b/lib/dns/opensslrsa_link.c
+index 09412c58b5..81ce6cc7cb 100644
+--- a/lib/dns/opensslrsa_link.c
+++ b/lib/dns/opensslrsa_link.c
+@@ -931,7 +931,7 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
+ 
+ 	for (i = 0; i < priv.nelements; i++) {
+ 		switch (priv.elements[i].tag) {
+-#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000
+#if !defined(OPENSSL_NO_ENGINE)
+ 		case TAG_RSA_ENGINE:
+ 			engine = (char *)priv.elements[i].data;
+ 			break;
+-- 
+2.55.0
+
--- a/SOURCES/bind-9.16-update-b.root-servers.net.patch
+++ b/SOURCES/bind-9.16-update-b.root-servers.net.patch
@ -1,31 +0,0 @@
-From 4e595a6b961e73af43350833109ccba0950119f9 Mon Sep 17 00:00:00 2001
-From: Mark Andrews <marka@isc.org>
-Date: Thu, 12 Oct 2023 10:19:38 +1100
-Subject: [PATCH] Update b.root-servers.net IP addresses
-
-This covers both root hints and the default primaries for the root
-zone mirror.  The official change date is Nov 27, 2023.
-
-(cherry picked from commit 2ca2f7e9852a3d6e93f065c01ea4679f723688f7)
---
- lib/dns/rootns.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/lib/dns/rootns.c b/lib/dns/rootns.c
-index 9653f3b..d6ff76e 100644
--- a/lib/dns/rootns.c
-+++ b/lib/dns/rootns.c
-@@ -56,8 +56,8 @@ static char root_ns[] =
- ".                       518400  IN      NS      M.ROOT-SERVERS.NET.\n"
- "A.ROOT-SERVERS.NET.     3600000 IN      A       198.41.0.4\n"
- "A.ROOT-SERVERS.NET.     3600000 IN      AAAA    2001:503:BA3E::2:30\n"
-"B.ROOT-SERVERS.NET.     3600000 IN      A       199.9.14.201\n"
-"B.ROOT-SERVERS.NET.     3600000 IN      AAAA    2001:500:200::b\n"
-+"B.ROOT-SERVERS.NET.     3600000 IN      A       170.247.170.2\n"
-+"B.ROOT-SERVERS.NET.     3600000 IN      AAAA    2801:1b8:10::b\n"
- "C.ROOT-SERVERS.NET.     3600000 IN      A       192.33.4.12\n"
- "C.ROOT-SERVERS.NET.     3600000 IN      AAAA    2001:500:2::c\n"
- "D.ROOT-SERVERS.NET.     3600000 IN      A       199.7.91.13\n"
-- 
-2.43.0
-
--- a/SOURCES/bind-9.16.50.tar.xz.asc
+++ b/SOURCES/bind-9.16.50.tar.xz.asc
@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABCgAdFiEEcGtsKGIOdvkdEfffUQpkKgbFLOwFAmYP/t0ACgkQUQpkKgbF
+LOzyew/9HC8SiGcokr7K7inFoW3ftPkOL2yKVcsA345uxMF8Tf9q1s5GVAZSRFTA
+WsunUb5iz//5s7QGXvSf05xLRgY5kKhLd0YywW4jscy8YssQvXol3ZK6VEhA5uVe
+7mHJu8+00DiHv4gBXmJMS/+przeykNTZk/u10cIeanUgWKYqt/uMGYrycttsiRaI
+wob7DSEwK0qu7zX6pKPEKVwzchdLK9O9aXr23SJaoDAn7UqKRN+s4b7pEPOqjDaF
+liGp74AZagGji7Me5rESS8NkfQmiZ/bgcwYrUC/mWDA/K4ClCFKTUZQ6Lfnwlxjo
+263myX3tAHuZ5LruLsCRFiRrSiknoUQDwEcx/Z2eZBYjpXwcaKnavT9UUbnzN+jI
+QZcDypRvzYNPneqDor9ak3/MJWoDqdoEOkTbxjQQXy3j9Pj4CZsjp4lRCEcmIQoA
+8nkQ3dFcKkjJg//N5GCk0m7LlBbZYLaxDyRLa/doYYXd9t2HXMsFN6aPiQCRV+sY
+xrT9mHDJHwjyIqTh0ufPkLIBJdsqDaloSsFayL6WzFWCTOUNGkMkgnZxqLQeLQ4y
+JV/XW0q0At4GM4VqrFx9I3YbEdXpcfF6KdfijLmYGY29JPB0Tz5tN58wl94E1gtq
+A155o0v14/2r8gTb0y3X3dbXUCMGvVXHhLEEgTDgElhUDBXzc9k=
+=syDr
+-----END PGP SIGNATURE-----
--- a/SOURCES/bind-9.18-CVE-2024-11187-pre-test.patch
+++ b/SOURCES/bind-9.18-CVE-2024-11187-pre-test.patch
@ -1,4 +1,4 @@
-From 8a9b9ff5a8b2443f7df4f60397ad215931ba44f1 Mon Sep 17 00:00:00 2001
+From 1e3d6c2862cb7911fdd01b9d69a8599b462b797c Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
 Date: Tue, 7 Jan 2025 15:22:40 +0100
 Subject: [PATCH] Isolate using the -T noaa flag only for part of the resolver
@ -14,72 +14,55 @@ system test.

 (cherry picked from commit e51d4d3b88af00d6667f2055087ebfc47fb3107c)
 ---
- bin/tests/system/conf.sh.in              | 12 ++++++++++++
- bin/tests/system/resolver/ns4/named.noaa |  5 -----
+ bin/tests/system/resolver/ns4/named.noaa | 12 ------------
 bin/tests/system/resolver/tests.sh       |  8 ++++++++
- 3 files changed, 20 insertions(+), 5 deletions(-)
+ 2 files changed, 8 insertions(+), 12 deletions(-)
 delete mode 100644 bin/tests/system/resolver/ns4/named.noaa

-diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
-index 06852f5..f77f7de 100644
--- a/bin/tests/system/conf.sh.in
-+++ b/bin/tests/system/conf.sh.in
-@@ -305,6 +305,18 @@ digcomp() {
-     return $result
- }
- 
-+start_server() {
-+    $PERL "$SYSTEMTESTTOP/start.pl" "$SYSTESTDIR" "$@"
-+}
-+
-+stop_server() {
-+    $PERL "$SYSTEMTESTTOP/stop.pl" "$SYSTESTDIR" "$@"
-+}
-+
-+send() {
-+    $PERL "$SYSTEMTESTTOP/send.pl" "$@"
-+}
-+
- #
- # Useful functions in test scripts
- #
 diff --git a/bin/tests/system/resolver/ns4/named.noaa b/bin/tests/system/resolver/ns4/named.noaa
 deleted file mode 100644
-index 3b121ad..0000000
+index be78cc2c94..0000000000
 --- a/bin/tests/system/resolver/ns4/named.noaa
 +++ /dev/null
-@@ -1,5 +0,0 @@
+@@ -1,12 +0,0 @@
 -Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 -
-See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
+-SPDX-License-Identifier: MPL-2.0
+-
+-This Source Code Form is subject to the terms of the Mozilla Public
+-License, v. 2.0.  If a copy of the MPL was not distributed with this
+-file, you can obtain one at https://mozilla.org/MPL/2.0/.
+-
+-See the COPYRIGHT file distributed with this work for additional
+-information regarding copyright ownership.
 -
 -Add -T noaa.
 diff --git a/bin/tests/system/resolver/tests.sh b/bin/tests/system/resolver/tests.sh
-index 6eb52fe..bf37467 100755
+index d9121d9ae5..29562c2db0 100755
 --- a/bin/tests/system/resolver/tests.sh
 +++ b/bin/tests/system/resolver/tests.sh
-@@ -281,6 +281,10 @@ done
+@@ -309,6 +309,10 @@ done
 if [ $ret != 0 ]; then echo_i "failed"; fi
- status=`expr $status + $ret`
+ status=$((status + ret))
 
 +stop_server ns4
 +touch ns4/named.noaa
 +start_server --noclean --restart --port ${PORT} ns4 || ret=1
 +
- n=`expr $n + 1`
+ n=$((n + 1))
 echo_i "RT21594 regression test check setup ($n)"
 ret=0
-@@ -317,6 +321,10 @@ grep "status: NXDOMAIN" dig.ns5.out.${n} > /dev/null || ret=1
+@@ -345,6 +349,10 @@ grep "status: NXDOMAIN" dig.ns5.out.${n} >/dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
- status=`expr $status + $ret`
+ status=$((status + ret))
 
 +stop_server ns4
 +rm ns4/named.noaa
 +start_server --noclean --restart --port ${PORT} ns4 || ret=1
 +
- n=`expr $n + 1`
+ n=$((n + 1))
 echo_i "check that replacement of additional data by a negative cache no data entry clears the additional RRSIGs ($n)"
 ret=0
 -- 
-2.48.1
+2.53.0

--- a/SOURCES/bind-9.18-CVE-2024-11187.patch
+++ b/SOURCES/bind-9.18-CVE-2024-11187.patch
@ -1,4 +1,4 @@
-From ca6c3446ef07d89fd3a28b6979d947af2ab5754f Mon Sep 17 00:00:00 2001
+From 0f9d817ca87207f2695560645e12478477d345a5 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
 Date: Thu, 14 Nov 2024 10:37:29 +0100
 Subject: [PATCH] Limit the additional processing for large RDATA sets
@ -14,78 +14,40 @@ answer to ANY is already big enough.
 (cherry picked from commit a1982cf1bb95c818aa7b58988b5611dec80f2408)
 PatchNumber: 47
 ---
- bin/named/query.c                    | 14 ++++++++------
 bin/tests/system/additional/tests.sh |  2 +-
 lib/dns/include/dns/rdataset.h       | 12 ++++++++++++
- lib/dns/rdataset.c                   | 12 ++++++++++++
- 4 files changed, 33 insertions(+), 7 deletions(-)
+ lib/dns/rbtdb.c                      |  2 +-
+ lib/dns/rdataset.c                   | 11 +++++++++++
+ lib/ns/query.c                       | 15 ++++++++++-----
+ 5 files changed, 35 insertions(+), 7 deletions(-)

-diff --git a/bin/named/query.c b/bin/named/query.c
-index 51a29a8..e023d74 100644
--- a/bin/named/query.c
-+++ b/bin/named/query.c
-@@ -1835,9 +1835,10 @@ query_addadditional(void *arg, dns_name_t *name, dns_rdatatype_t qtype) {
- 		 * section, it's helpful if we add the SRV additional data
- 		 * as well.
- 		 */
-		eresult = dns_rdataset_additionaldata(trdataset,
-						      query_addadditional,
-						      client);
-+		eresult = dns_rdataset_additionaldata2(trdataset,
-+						       query_addadditional,
-+						       client,
-+						       DNS_RDATASET_MAXADDITIONAL);
- 	}
- 
-  cleanup:
-@@ -2432,7 +2433,7 @@ query_addrdataset(ns_client_t *client, dns_name_t *fname,
- 						       rdataset->rdclass);
- 	rdataset->attributes |= DNS_RDATASETATTR_LOADORDER;
- 
-	if (NOADDITIONAL(client))
-+	if (NOADDITIONAL(client) || client->query.qtype == dns_rdatatype_any)
- 		return;
- 
- 	/*
-@@ -2442,8 +2443,9 @@ query_addrdataset(ns_client_t *client, dns_name_t *fname,
- 	 */
- 	additionalctx.client = client;
- 	additionalctx.rdataset = rdataset;
-	(void)dns_rdataset_additionaldata(rdataset, query_addadditional2,
-					  &additionalctx);
-+	(void)dns_rdataset_additionaldata2(rdataset, query_addadditional2,
-+					   &additionalctx,
-+					   DNS_RDATASET_MAXADDITIONAL);
- 	CTRACE(ISC_LOG_DEBUG(3), "query_addrdataset: done");
- }
- 
 diff --git a/bin/tests/system/additional/tests.sh b/bin/tests/system/additional/tests.sh
-index 6400723..a33cc8a 100644
+index 3701790..4281238 100644
 --- a/bin/tests/system/additional/tests.sh
 +++ b/bin/tests/system/additional/tests.sh
-@@ -261,7 +261,7 @@ n=`expr $n + 1`
+@@ -278,7 +278,7 @@ n=$(expr $n + 1)
 echo_i "testing with 'minimal-any no;' ($n)"
 ret=0
- $DIG $DIGOPTS -t ANY www.rt.example @10.53.0.1 > dig.out.$n || ret=1
-grep "ANSWER: 3, AUTHORITY: 1, ADDITIONAL: 2" dig.out.$n > /dev/null || ret=1
-+grep "ANSWER: 3, AUTHORITY: 1, ADDITIONAL: 1" dig.out.$n > /dev/null || ret=1
- if [ $ret -eq 1 ] ; then
-     echo_i "failed"; status=`expr status + 1`
- fi
+ $DIG $DIGOPTS -t ANY www.rt.example @10.53.0.1 >dig.out.$n || ret=1
+-grep "ANSWER: 3, AUTHORITY: 2, ADDITIONAL: 2" dig.out.$n >/dev/null || ret=1
+grep "ANSWER: 3, AUTHORITY: 2, ADDITIONAL: 1" dig.out.$n > /dev/null || ret=1
+ if [ $ret -eq 1 ]; then
+   echo_i "failed"
+   status=$((status + 1))
 diff --git a/lib/dns/include/dns/rdataset.h b/lib/dns/include/dns/rdataset.h
-index 710e97c..b3532f6 100644
+index de3f638..85c081e 100644
 --- a/lib/dns/include/dns/rdataset.h
 +++ b/lib/dns/include/dns/rdataset.h
-@@ -53,6 +53,8 @@
- #include <dns/types.h>
+@@ -55,6 +55,8 @@
 #include <dns/rdatastruct.h>
+ #include <dns/types.h>
 
 +#define DNS_RDATASET_MAXADDITIONAL 13
 +
 ISC_LANG_BEGINDECLS
 
 typedef enum {
-@@ -501,13 +503,23 @@ dns_rdataset_additionaldata(dns_rdataset_t *rdataset,
+@@ -465,13 +467,23 @@ dns_rdataset_additionaldata(dns_rdataset_t	    *rdataset,
  *\li	If a call to dns_rdata_additionaldata() is not successful, the
  *	result returned will be the result of dns_rdataset_additionaldata().
  *
@ -109,33 +71,45 @@ index 710e97c..b3532f6 100644
 isc_result_t
 dns_rdataset_getnoqname(dns_rdataset_t *rdataset, dns_name_t *name,
 			dns_rdataset_t *neg, dns_rdataset_t *negsig);
+diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
+index c2cd63e..b1efa0b 100644
+--- a/lib/dns/rbtdb.c
+++ b/lib/dns/rbtdb.c
+@@ -10632,7 +10632,7 @@ no_glue:
+ 	maybe_rehash_gluetable(rbtversion);
+ 	idx = hash_32(hash, rbtversion->glue_table_bits);
+ 
+-	(void)dns_rdataset_additionaldata(rdataset, glue_nsdname_cb, &ctx);
+	(void)dns_rdataset_additionaldata2(rdataset, glue_nsdname_cb, &ctx, 0);
+ 
+ 	cur = isc_mem_get(rbtdb->common.mctx, sizeof(*cur));
+ 
 diff --git a/lib/dns/rdataset.c b/lib/dns/rdataset.c
-index b42dea5..5160acf 100644
+index 221d7f8..0f83d1f 100644
 --- a/lib/dns/rdataset.c
 +++ b/lib/dns/rdataset.c
-@@ -28,6 +28,7 @@
+@@ -29,6 +29,7 @@
 #include <dns/ncache.h>
 #include <dns/rdata.h>
 #include <dns/rdataset.h>
 +#include <dns/result.h>
 
 static const char *trustnames[] = {
- 	"none",
-@@ -608,6 +609,13 @@ dns_rdataset_towire(dns_rdataset_t *rdataset,
+ 	"none",		  "pending-additional",
+@@ -579,6 +580,12 @@ dns_rdataset_towire(dns_rdataset_t *rdataset, const dns_name_t *owner_name,
 isc_result_t
 dns_rdataset_additionaldata(dns_rdataset_t *rdataset,
- 			    dns_additionaldatafunc_t add, void *arg)
-+{
+ 			    dns_additionaldatafunc_t add, void *arg) {
 +	return dns_rdataset_additionaldata2(rdataset, add, arg, 0);
 +}
 +
 +isc_result_t
 +dns_rdataset_additionaldata2(dns_rdataset_t *rdataset,
-+			    dns_additionaldatafunc_t add, void *arg, size_t limit)
- {
+			    dns_additionaldatafunc_t add, void *arg, size_t limit) {
 	dns_rdata_t rdata = DNS_RDATA_INIT;
 	isc_result_t result;
-@@ -620,6 +628,10 @@ dns_rdataset_additionaldata(dns_rdataset_t *rdataset,
+ 
+@@ -590,6 +597,10 @@ dns_rdataset_additionaldata(dns_rdataset_t *rdataset,
 	REQUIRE(DNS_RDATASET_VALID(rdataset));
 	REQUIRE((rdataset->attributes & DNS_RDATASETATTR_QUESTION) == 0);
 
@ -144,8 +118,55 @@ index b42dea5..5160acf 100644
 +	}
 +
 	result = dns_rdataset_first(rdataset);
- 	if (result != ISC_R_SUCCESS)
+ 	if (result != ISC_R_SUCCESS) {
 		return (result);
+diff --git a/lib/ns/query.c b/lib/ns/query.c
+index ec9bf5b..b31857c 100644
+--- a/lib/ns/query.c
+++ b/lib/ns/query.c
+@@ -2047,8 +2047,9 @@ addname:
+ 	 * This cannot go more than MAX_RESTARTS levels deep.
+ 	 */
+ 	if (trdataset != NULL && dns_rdatatype_followadditional(type)) {
+-		eresult = dns_rdataset_additionaldata(
+-			trdataset, query_additional_cb, qctx);
+		eresult = dns_rdataset_additionaldata2(
+			trdataset, query_additional_cb, qctx,
+			DNS_RDATASET_MAXADDITIONAL);
+ 	}
+ 
+ cleanup:
+@@ -2139,7 +2140,8 @@ regular:
+ 	 * Add other additional data if needed.
+ 	 * We don't care if dns_rdataset_additionaldata() fails.
+ 	 */
+-	(void)dns_rdataset_additionaldata(rdataset, query_additional_cb, qctx);
+	(void)dns_rdataset_additionaldata2(rdataset, query_additional_cb,
+					   qctx, DNS_RDATASET_MAXADDITIONAL);
+ 	CTRACE(ISC_LOG_DEBUG(3), "query_additional: done");
+ }
+ 
+@@ -2165,7 +2167,8 @@ query_addrrset(query_ctx_t *qctx, dns_name_t **namep,
+ 	 * To the current response for 'client', add the answer RRset
+ 	 * '*rdatasetp' and an optional signature set '*sigrdatasetp', with
+ 	 * owner name '*namep', to section 'section', unless they are
+-	 * already there.  Also add any pertinent additional data.
+	 * already there.  Also add any pertinent additional data, unless
+	 * the query was for type ANY.
+ 	 *
+ 	 * If 'dbuf' is not NULL, then '*namep' is the name whose data is
+ 	 * stored in 'dbuf'.  In this case, query_addrrset() guarantees that
+@@ -2220,7 +2223,9 @@ query_addrrset(query_ctx_t *qctx, dns_name_t **namep,
+ 	 */
+ 	query_addtoname(mname, rdataset);
+ 	query_setorder(qctx, mname, rdataset);
+-	query_additional(qctx, rdataset);
+	if (qctx->qtype != dns_rdatatype_any) {
+		query_additional(qctx, rdataset);
+	}
+ 
+ 	/*
+ 	 * Note: we only add SIGs if we've added the type they cover, so
 -- 
-2.48.1
+2.51.1

--- a/SOURCES/bind-9.18-CVE-2024-4076.patch
+++ b/SOURCES/bind-9.18-CVE-2024-4076.patch
@ -0,0 +1,29 @@
+From 274463c5b71db87a615694889da23837ba48db9a Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Tue, 16 Jul 2024 19:49:26 +0200
+Subject: [PATCH] Resolve CVE-2024-4076
+
+6403.	[security]	qctx-zversion was not being cleared when it should have
+			been leading to an assertion failure if it needed to be
+			reused. (CVE-2024-4076) [GL #4507]
+
+Resolves: CVE-2024-4076
+---
+ lib/ns/query.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/lib/ns/query.c b/lib/ns/query.c
+index 537d332..be4cbb6 100644
+--- a/lib/ns/query.c
+++ b/lib/ns/query.c
+@@ -5325,6 +5325,7 @@ qctx_freedata(query_ctx_t *qctx) {
+ 		ns_client_releasename(qctx->client, &qctx->zfname);
+ 		dns_db_detachnode(qctx->zdb, &qctx->znode);
+ 		dns_db_detach(&qctx->zdb);
+		qctx->zversion = NULL;
+ 	}
+ 
+ 	if (qctx->event != NULL && !qctx->client->nodetach) {
+-- 
+2.45.2
+
--- a/SOURCES/bind-9.18-configurable-additional-records.patch
+++ b/SOURCES/bind-9.18-configurable-additional-records.patch
@ -0,0 +1,168 @@
+From bddd8950ff3d82d503dfb64e67d24ce364e5a5af Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Mon, 16 Jun 2025 19:36:13 +0200
+Subject: [PATCH] Support runtime configurable limit of additional records
+
+Use environment variable NAMED_MAXADDITIONAL to change default built-in
+limit. Uses environment variable to avoid the need to support the variable
+option in the more recent versions and after upgrades.
+
+Use debug 1 verbosity for logging parsed limit at the start, but not
+changing production logs.
+---
+ bin/named/main.c           |  5 +++++
+ bin/named/named.rst        |  9 +++++++++
+ lib/ns/include/ns/server.h | 13 +++++++++++++
+ lib/ns/query.c             |  4 ++--
+ lib/ns/server.c            | 25 +++++++++++++++++++++++++
+ 5 files changed, 54 insertions(+), 2 deletions(-)
+
+diff --git a/bin/named/main.c b/bin/named/main.c
+index f62f82c..0de658a 100644
+--- a/bin/named/main.c
+++ b/bin/named/main.c
+@@ -1327,6 +1327,11 @@ setup(void) {
+ 	if (sigvalinsecs) {
+ 		ns_server_setoption(sctx, NS_SERVER_SIGVALINSECS, true);
+ 	}
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_SERVER, ISC_LOG_DEBUG(1),
+		      "using max %u additional records",
+		      ns_server_getmaxadditionalrecords(sctx));
+
+ }
+ 
+ static void
+diff --git a/bin/named/named.rst b/bin/named/named.rst
+index 3cd6350..06af140 100644
+--- a/bin/named/named.rst
+++ b/bin/named/named.rst
+@@ -228,6 +228,15 @@ Files
+ ``/var/run/named/named.pid``
+    The default process-id file.
+ 
+Environment
+~~~~~~~~~~~
+
+NAMED_MAXADDITIONAL
+    Red Hat specific extension. Accepts numeric value of maximal NS
+    records, which would get fetched additional addresses. Default
+    value is 13. Allows runtime configurable limit introduced in
+    CVE-2024-11187 fixes.
+
+ Notes
+ ~~~~~
+ 
+diff --git a/lib/ns/include/ns/server.h b/lib/ns/include/ns/server.h
+index 0abb579..4864ba4 100644
+--- a/lib/ns/include/ns/server.h
+++ b/lib/ns/include/ns/server.h
+@@ -122,6 +122,8 @@ struct ns_server {
+ 	isc_stats_t *tcpoutstats4;
+ 	isc_stats_t *tcpinstats6;
+ 	isc_stats_t *tcpoutstats6;
+
+	unsigned int max_additional_records;
+ };
+ 
+ struct ns_altsecret {
+@@ -166,6 +168,17 @@ ns_server_setserverid(ns_server_t *sctx, const char *serverid);
+  *\li	'sctx' is valid.
+  */
+ 
+unsigned int
+ns_server_getmaxadditionalrecords(ns_server_t *sctx);
+/*%<
+ *	Returns the maximal number of records with additional addresses
+ *	provided.
+ *
+ * Requires:
+ *\li	'sctx' is valid.
+ */
+
+
+ void
+ ns_server_setoption(ns_server_t *sctx, unsigned int option, bool value);
+ /*%<
+diff --git a/lib/ns/query.c b/lib/ns/query.c
+index ce1d710..37893e2 100644
+--- a/lib/ns/query.c
+++ b/lib/ns/query.c
+@@ -2032,7 +2032,7 @@ addname:
+ 	if (trdataset != NULL && dns_rdatatype_followadditional(type)) {
+ 		eresult = dns_rdataset_additionaldata2(
+ 			trdataset, query_additional_cb, qctx,
+-			DNS_RDATASET_MAXADDITIONAL);
+			client->sctx->max_additional_records);
+ 	}
+ 
+ cleanup:
+@@ -2124,7 +2124,7 @@ regular:
+ 	 * We don't care if dns_rdataset_additionaldata() fails.
+ 	 */
+ 	(void)dns_rdataset_additionaldata2(rdataset, query_additional_cb,
+-					   qctx, DNS_RDATASET_MAXADDITIONAL);
+					   qctx, client->sctx->max_additional_records);
+ 	CTRACE(ISC_LOG_DEBUG(3), "query_additional: done");
+ }
+ 
+diff --git a/lib/ns/server.c b/lib/ns/server.c
+index 540bc2e..0a4abb3 100644
+--- a/lib/ns/server.c
+++ b/lib/ns/server.c
+@@ -17,6 +17,7 @@
+ #include <isc/stats.h>
+ #include <isc/util.h>
+ 
+#include <dns/rdataset.h>
+ #include <dns/stats.h>
+ #include <dns/tkey.h>
+ 
+@@ -33,6 +34,22 @@
+ 		RUNTIME_CHECK(result == ISC_R_SUCCESS); \
+ 	} while (0)
+ 
+/*
+ * CVE-2024-11187 introduced a limit on maximal number of records,
+ * for which additional records would be fetched. Make this limit
+ * configurable runtime only by environment.
+ */
+static size_t
+initialize_maxadditional(void) {
+	const char *limits;
+
+	limits = getenv("NAMED_MAXADDITIONAL");
+	if (limits != NULL) {
+		return strtol(limits, NULL, 10);
+	}
+	return DNS_RDATASET_MAXADDITIONAL;
+}
+
+ isc_result_t
+ ns_server_create(isc_mem_t *mctx, ns_matchview_t matchingview,
+ 		 ns_server_t **sctxp) {
+@@ -90,6 +107,7 @@ ns_server_create(isc_mem_t *mctx, ns_matchview_t matchingview,
+ 
+ 	sctx->udpsize = 1232;
+ 	sctx->transfer_tcp_message_size = 20480;
+	sctx->max_additional_records = initialize_maxadditional();
+ 
+ 	sctx->fuzztype = isc_fuzz_none;
+ 	sctx->fuzznotify = NULL;
+@@ -213,6 +231,13 @@ ns_server_setserverid(ns_server_t *sctx, const char *serverid) {
+ 	return (ISC_R_SUCCESS);
+ }
+ 
+unsigned int
+ns_server_getmaxadditionalrecords(ns_server_t *sctx) {
+	REQUIRE(SCTX_VALID(sctx));
+
+	return sctx->max_additional_records;
+}
+
+ void
+ ns_server_setoption(ns_server_t *sctx, unsigned int option, bool value) {
+ 	REQUIRE(SCTX_VALID(sctx));
+-- 
+2.49.0
+
--- a/SOURCES/bind-9.18-dig-idn-input-always-test.patch
+++ b/SOURCES/bind-9.18-dig-idn-input-always-test.patch
@ -0,0 +1,83 @@
+From 77105c4738a07c48d2cf52fc1fcb1c7b2eb50661 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
+Date: Tue, 16 Sep 2025 11:46:03 +0200
+Subject: [PATCH] Fix expectations on idna system test
+
+IDNA tests always redirect output into the file. That means its
+behaviour has changed and is now processing IDN input by default and
+just disables IDN output by default.
+
+New behaviour when redirected is the same as +idnin +noidnout, but does
+not fail hard on input errors.
+
+bind 9.16 version.
+---
+ bin/tests/system/idna/tests.sh | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/bin/tests/system/idna/tests.sh b/bin/tests/system/idna/tests.sh
+index 8c2826f..5b8ddd1 100644
+--- a/bin/tests/system/idna/tests.sh
+++ b/bin/tests/system/idna/tests.sh
+@@ -187,7 +187,7 @@ idna_enabled_test() {
+   # Note that ASCII characters are converted to lower-case.
+ 
+   text="Checking valid non-ASCII label"
+-  idna_test "$text" "" "München" "M\195\188nchen."
+  idna_test "$text" "" "München" "xn--mnchen-3ya."
+   idna_test "$text" "+noidnin +noidnout" "München" "M\195\188nchen."
+   idna_test "$text" "+noidnin +idnout" "München" "M\195\188nchen."
+   idna_test "$text" "+idnin   +noidnout" "München" "xn--mnchen-3ya."
+@@ -211,7 +211,7 @@ idna_enabled_test() {
+   # for the valid U-label.
+ 
+   text="Checking that non-transitional IDNA processing is used"
+-  idna_test "$text" "" "faß.de" "fa\195\159.de."
+  idna_test "$text" "" "faß.de" "xn--fa-hia.de."
+   idna_test "$text" "+noidnin +noidnout" "faß.de" "fa\195\159.de."
+   idna_test "$text" "+noidnin +idnout" "faß.de" "fa\195\159.de."
+   idna_test "$text" "+idnin   +noidnout" "faß.de" "xn--fa-hia.de."
+@@ -221,7 +221,7 @@ idna_enabled_test() {
+   # onto the Greek sigma character ("σ") in IDNA2003.
+ 
+   text="Second check that non-transitional IDNA processing is used"
+-  idna_test "$text" "" "βόλος.com" "\206\178\207\140\206\187\206\191\207\130.com."
+  idna_test "$text" "" "βόλος.com" "xn--nxasmm1c.com."
+   idna_test "$text" "+noidnin +noidnout" "βόλος.com" "\206\178\207\140\206\187\206\191\207\130.com."
+   idna_test "$text" "+noidnin +idnout" "βόλος.com" "\206\178\207\140\206\187\206\191\207\130.com."
+   idna_test "$text" "+idnin   +noidnout" "βόλος.com" "xn--nxasmm1c.com."
+@@ -281,7 +281,7 @@ idna_enabled_test() {
+   idna_test "$text" "" "xn--xx" "xn--xx."
+   idna_test "$text" "+noidnin +noidnout" "xn--xx" "xn--xx."
+   idna_fail "$text" "+noidnin   +idnout" "xn--xx"
+-  idna_fail "$text" "+idnin   +noidnout" "xn--xx"
+  idna_test "$text" "+idnin   +noidnout" "xn--xx" "xn--xx."
+   idna_fail "$text" "+idnin     +idnout" "xn--xx"
+ 
+   # Fake A-label - the string does not translate to anything.
+@@ -290,7 +290,7 @@ idna_enabled_test() {
+   idna_test "$text" "" "xn--ahahah" "xn--ahahah."
+   idna_test "$text" "+noidnin +noidnout" "xn--ahahah" "xn--ahahah."
+   idna_fail "$text" "+noidnin   +idnout" "xn--ahahah"
+-  idna_fail "$text" "+idnin   +noidnout" "xn--ahahah"
+  idna_test "$text" "+idnin   +noidnout" "xn--ahahah" "xn--ahahah."
+   idna_fail "$text" "+idnin     +idnout" "xn--ahahah"
+ 
+   # Too long a label. The punycode string is too long (at 64 characters).
+@@ -317,11 +317,11 @@ idna_enabled_test() {
+   # The +[no]idnout options should not have any effect on the test.
+ 
+   text="Checking invalid input U-label"
+-  idna_test "$text" "" "√.com" "\226\136\154.com."
+  idna_test "$text" "" "√.com" "xn--19g.com."
+   idna_test "$text" "+noidnin +noidnout" "√.com" "\226\136\154.com."
+   idna_test "$text" "+noidnin +idnout" "√.com" "\226\136\154.com."
+   idna_test "$text" "+idnin   +noidnout" "√.com" "xn--19g.com."
+-  idna_test "$text" "+idnin   +idnout" "√.com" "√.com."
+  idna_test "$text" "+idnin   +idnout"   "√.com" "√.com."
+ 
+   # Tests of a valid unicode string but an invalid U-label (output)
+   #
+-- 
+2.51.1
+
--- a/SOURCES/bind-9.18-dig-idn-input-always.patch
+++ b/SOURCES/bind-9.18-dig-idn-input-always.patch
@ -0,0 +1,102 @@
+From cd5e88407380c5ced9a51736f0c2d679d053e188 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
+Date: Wed, 6 Nov 2024 21:29:47 +0100
+Subject: [PATCH] Allow always IDN input in dig
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Even when stdout is non-interactive terminal, allow unicode characters
+to be encoded into ACE form. Still disable IDN output, but unless
+noidnin or IDN_DISABLE=1 env is detected, consider input as locale
+defined name.
+
+Provides more isolated change, which issue #3527 introduced similar
+behavior into 9.19 with more changes.
+
+Ignore input IDN errors when stdout is not terminal
+
+Attempt to prevent visible regressions when enabling IDN on input
+always. Instead of new hard failures preventing IDN decoding of input
+name just use original input.
+
+Should make the change backward compatible. When on interactive terminal
+behave the same way as before and emit hard errors. Become more
+forgiving in scripts where stdout leads to script. Decoding output is
+not enabled there and if input decoding fails, just use input as it was.
+
+Change dig manual +idnin
+
+Note in manual IDN input is always enabled. But it silently ignores
+errors when stdout is not a terminal to prevent regressions.
+
+Signed-off-by: Petr Menšík <pemensik@redhat.com>
+---
+ bin/dig/dig.rst   |  6 +++---
+ bin/dig/dighost.c | 19 +++++++++++++++----
+ 2 files changed, 18 insertions(+), 7 deletions(-)
+
+diff --git a/bin/dig/dig.rst b/bin/dig/dig.rst
+index d27b1fd..3a9f9c6 100644
+--- a/bin/dig/dig.rst
+++ b/bin/dig/dig.rst
+@@ -348,9 +348,9 @@ abbreviation is unambiguous; for example, ``+cd`` is equivalent to
+    This option processes [or does not process] IDN domain names on input. This requires
+    ``IDN SUPPORT`` to have been enabled at compile time.
+ 
+-   The default is to process IDN input when standard output is a tty.
+-   The IDN processing on input is disabled when ``dig`` output is redirected
+-   to files, pipes, and other non-tty file descriptors.
+   The default is to process IDN input. The input IDN processing errors are ignored
+   when :program:`dig` output is redirected to files, pipes, and other non-tty file
+   descriptors.
+ 
+ ``+[no]idnout``
+    This option converts [or does not convert] puny code on output. This requires
+diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
+index ac7e1fb..9555e63 100644
+--- a/bin/dig/dighost.c
+++ b/bin/dig/dighost.c
+@@ -622,6 +622,9 @@ clone_server_list(dig_serverlist_t src, dig_serverlist_t *dest) {
+ dig_lookup_t *
+ make_empty_lookup(void) {
+ 	dig_lookup_t *looknew;
+#ifdef HAVE_LIBIDN2
+	bool idn_allowed = (getenv("IDN_DISABLE") == NULL);
+#endif
+ 
+ 	debug("make_empty_lookup()");
+ 
+@@ -673,8 +676,8 @@ make_empty_lookup(void) {
+ 	looknew->qr = false;
+ 	looknew->accept_reply_unexpected_src = false;
+ #ifdef HAVE_LIBIDN2
+-	looknew->idnin = isatty(1) ? (getenv("IDN_DISABLE") == NULL) : false;
+-	looknew->idnout = looknew->idnin;
+	looknew->idnin = idn_allowed;
+	looknew->idnout = isatty(1) && idn_allowed;
+ #else  /* ifdef HAVE_LIBIDN2 */
+ 	looknew->idnin = false;
+ 	looknew->idnout = false;
+@@ -4497,8 +4500,16 @@ idn_locale_to_ace(const char *src, char *dst, size_t dstlen) {
+ 		res = idn2_to_ascii_lz(src, &ascii_src, IDN2_TRANSITIONAL);
+ 	}
+ 	if (res != IDN2_OK) {
+-		fatal("'%s' is not a legal IDNA2008 name (%s), use +noidnin",
+-		      src, idn2_strerror(res));
+		if (isatty(1)) {
+			fatal("'%s' is not a legal IDNA2008 name (%s), use +noidnin",
+			      src, idn2_strerror(res));
+		} else {
+			/* In case of non-terminal output silently ignore errors
+			 * in IDN input decoding. */
+			(void)strlcpy(dst, src, dstlen);
+			resetlocale(LC_ALL);
+			return;
+		}
+ 	}
+ 
+ 	/*
+-- 
+2.51.1
+
--- a/SOURCES/bind-9.18-fix-dig-hanging-issue.patch
+++ b/SOURCES/bind-9.18-fix-dig-hanging-issue.patch
@ -0,0 +1,173 @@
+diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
+index ac7e1fb55b..9f1a05ea10 100644
+--- a/bin/dig/dighost.c
+++ b/bin/dig/dighost.c
+@@ -1571,6 +1571,31 @@ check_if_done(void) {
+ 	}
+ }
+ 
+
+/*%
+ * Check if we're done with all the queries in the lookup, except for
+ * the `except_q` query (can be NULL if no exception is required).
+ * Expects `l` to be a valid and locked lookup.
+ */
+static bool
+check_if_queries_done(dig_lookup_t *l, dig_query_t *except_q) {
+	dig_query_t *q = ISC_LIST_HEAD(l->q);
+
+	debug("check_if_queries_done(%p)", l);
+
+	while (q != NULL) {
+		if (!q->started || q->waiting_connect || q->waiting_senddone || q->pending_free) {
+			if (!q->canceled && q != except_q) {
+				debug("there is a pending query %p", q);
+				return (false);
+			}
+		}
+		q = ISC_LIST_NEXT(q, link);
+	}
+
+	return (true);
+}
+
+ /*%
+  * Clear out a query when we're done with it.  WARNING: This routine
+  * WILL invalidate the query pointer.
+@@ -2557,12 +2582,13 @@ setup_lookup(dig_lookup_t *lookup) {
+ 		query->waiting_senddone = false;
+ 		query->pending_free = false;
+ 		query->recv_made = false;
+-		query->first_pass = true;
+		query->started = false;
+ 		query->first_soa_rcvd = false;
+ 		query->second_rr_rcvd = false;
+ 		query->first_repeat_rcvd = false;
+ 		query->warn_id = true;
+ 		query->timedout = false;
+		query->canceled = false;
+ 		query->first_rr_serial = 0;
+ 		query->second_rr_serial = 0;
+ 		query->servname = serv->servername;
+@@ -2660,6 +2686,7 @@ cancel_lookup(dig_lookup_t *lookup) {
+ 	while (query != NULL) {
+ 		REQUIRE(DIG_VALID_QUERY(query));
+ 		next = ISC_LIST_NEXT(query, link);
+		query->canceled = true;
+ 		if (query->sock != NULL) {
+ 			isc_socket_cancel(query->sock, global_task,
+ 					  ISC_SOCKCANCEL_ALL);
+@@ -2902,6 +2929,12 @@ send_udp(dig_query_t *query) {
+ 			return;
+ 		}
+ 
+		query->started = true;
+		if (atomic_load(&cancel_now)) {
+			return;
+		}
+		INSIST(!free_now);
+
+ 		result = isc_socket_create(socketmgr,
+ 					   isc_sockaddr_pf(&query->sockaddr),
+ 					   isc_sockettype_udp, &query->sock);
+@@ -3028,6 +3061,10 @@ connect_timeout(isc_task_t *task, isc_event_t *event) {
+ 				clear_query(query);
+ 			}
+ 		}
+		if (check_if_queries_done(l, query)) {
+			cancel_lookup(l);
+			check_next_lookup(l);
+		}
+ 		UNLOCK_LOOKUP;
+ 		return;
+ 	}
+@@ -3283,6 +3320,14 @@ connect_done(isc_task_t *task, isc_event_t *event) {
+ 	query = sevent->ev_arg;
+ 	REQUIRE(DIG_VALID_QUERY(query));
+ 
+	query->started = true;
+
+	if (atomic_load(&cancel_now)) {
+		return;
+	}
+
+	INSIST(!free_now);
+
+ 	INSIST(query->waiting_connect);
+ 
+ 	query->waiting_connect = false;
+@@ -4004,6 +4049,9 @@ recv_done(isc_task_t *task, isc_event_t *event) {
+ 						 : "recursion not available",
+ 					 query->servname);
+ 			clear_query(query);
+			if (check_if_queries_done(l, query)) {
+				cancel_lookup(l);
+			}
+ 			check_next_lookup(l);
+ 			dns_message_detach(&msg);
+ 			isc_event_free(&event);
+@@ -4129,7 +4177,12 @@ recv_done(isc_task_t *task, isc_event_t *event) {
+ 				l->trace_root = false;
+ 				usesearch = false;
+ 			} else {
+				/*
+				 * This is a query in the followup lookup
+				 */
+ 				dighost_printmessage(query, &b, msg, true);
+
+				docancel = check_if_queries_done(l, query);
+ 			}
+ 		}
+ 	}
+@@ -4309,6 +4362,7 @@ cancel_all(void) {
+ 			nq = ISC_LIST_NEXT(q, link);
+ 			debug("canceling pending query %p, belonging to %p", q,
+ 			      current_lookup);
+			q->canceled = true;
+ 			if (q->sock != NULL) {
+ 				isc_socket_cancel(q->sock, NULL,
+ 						  ISC_SOCKCANCEL_ALL);
+@@ -4322,6 +4376,7 @@ cancel_all(void) {
+ 			nq = ISC_LIST_NEXT(q, clink);
+ 			debug("canceling connecting query %p, belonging to %p",
+ 			      q, current_lookup);
+			q->canceled = true;
+ 			if (q->sock != NULL) {
+ 				isc_socket_cancel(q->sock, NULL,
+ 						  ISC_SOCKCANCEL_ALL);
+diff --git a/bin/dig/include/dig/dig.h b/bin/dig/include/dig/dig.h
+index 8bf9613db3..d7eb49963c 100644
+--- a/bin/dig/include/dig/dig.h
+++ b/bin/dig/include/dig/dig.h
+@@ -168,9 +168,9 @@ struct dig_lookup {
+ struct dig_query {
+ 	unsigned int  magic;
+ 	dig_lookup_t *lookup;
+-	bool waiting_connect, pending_free, waiting_senddone, first_pass,
+	bool waiting_connect, pending_free, waiting_senddone, started,
+ 		first_soa_rcvd, second_rr_rcvd, first_repeat_rcvd, recv_made,
+-		warn_id, timedout;
+		warn_id, timedout, canceled;
+ 	uint32_t      first_rr_serial;
+ 	uint32_t      second_rr_serial;
+ 	uint32_t      msg_count;
+diff --git a/bin/tests/system/digdelv/tests.sh b/bin/tests/system/digdelv/tests.sh
+index fd7b383608..13044f4102 100644
+--- a/bin/tests/system/digdelv/tests.sh
+++ b/bin/tests/system/digdelv/tests.sh
+@@ -1040,6 +1040,15 @@ if [ -x "$DIG" ]; then
+   if [ $ret -ne 0 ]; then echo_i "failed"; fi
+   status=$((status + ret))
+ 
+  # See [GL #3248] for more information
+  n=$((n+1))
+  echo_i "check that dig correctly refuses to use a server with a IPv4 mapped IPv6 address after failing with a regular IP address ($n)"
+  ret=0
+  dig_with_opts +nomapped @10.53.0.8 @::ffff:10.53.0.8 a.example > dig.out.test$n 2>&1 || ret=1
+  grep -F ";; Skipping mapped address" dig.out.test$n > /dev/null || ret=1
+  grep -F ";; No acceptable nameservers" dig.out.test$n > /dev/null || ret=1
+  if [ $ret -ne 0 ]; then echo_i "failed"; fi
+  status=$((status+ret))
+ else
+   echo_i "$DIG is needed, so skipping these dig tests"
+ fi
--- a/SOURCES/bind-9.18-fix-qmin-test.patch
+++ b/SOURCES/bind-9.18-fix-qmin-test.patch
@ -0,0 +1,31 @@
+From e4b0698dc5e98b951050299c28be94514427688b Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
+Date: Tue, 18 Jun 2024 08:56:18 +0200
+Subject: [PATCH] Use LC_ALL to override all system locales
+
+The system tests were overriding the local locale by setting LANG to C.
+This does not override the locale in case there are individual LC_<*>
+variables like LC_CTYPE explicitly set.
+
+Use LC_ALL=C instead which is the proper way of overriding all currently
+set locales.
+---
+ bin/tests/system/conf.sh.common | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/bin/tests/system/conf.sh.common b/bin/tests/system/conf.sh.common
+index a91c0d9f4e..2b0bc20896 100644
+--- a/bin/tests/system/conf.sh.common
+++ b/bin/tests/system/conf.sh.common
+@@ -20,7 +20,7 @@ testsock6() {
+ 	fi
+ }
+ 
+-export LANG=C
+export LC_ALL=C
+ 
+ . ${TOP}/version
+ 
+-- 
+2.53.0
+
--- a/SOURCES/bind-9.18-partial-additional-records.patch
+++ b/SOURCES/bind-9.18-partial-additional-records.patch
@ -0,0 +1,54 @@
+From 9140eac85cda21fa86f2768f7ccaf6800776c726 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
+Date: Thu, 19 Jun 2025 19:51:43 +0200
+Subject: [PATCH] Limit number of additional records fetched
+
+Limit number of started fetches for additional zone instead of doing
+none. Keep limit of NS filled with additional records, but present at
+least some if possible.
+
+Might help broken implementations relying on receiving addresses in the
+response for NS query in authoritative zone.
+---
+ lib/dns/rdataset.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/lib/dns/rdataset.c b/lib/dns/rdataset.c
+index ffe6163..cfdb7d5 100644
+--- a/lib/dns/rdataset.c
+++ b/lib/dns/rdataset.c
+@@ -586,6 +586,7 @@ dns_rdataset_additionaldata2(dns_rdataset_t *rdataset,
+ 			    dns_additionaldatafunc_t add, void *arg, size_t limit) {
+ 	dns_rdata_t rdata = DNS_RDATA_INIT;
+ 	isc_result_t result;
+	size_t n = 0;
+ 
+ 	/*
+ 	 * For each rdata in rdataset, call 'add' for each name and type in the
+@@ -595,10 +596,6 @@ dns_rdataset_additionaldata2(dns_rdataset_t *rdataset,
+ 	REQUIRE(DNS_RDATASET_VALID(rdataset));
+ 	REQUIRE((rdataset->attributes & DNS_RDATASETATTR_QUESTION) == 0);
+ 
+-	if (limit != 0 && dns_rdataset_count(rdataset) > limit) {
+-		return DNS_R_TOOMANYRECORDS;
+-	}
+-
+ 	result = dns_rdataset_first(rdataset);
+ 	if (result != ISC_R_SUCCESS) {
+ 		return (result);
+@@ -608,7 +605,11 @@ dns_rdataset_additionaldata2(dns_rdataset_t *rdataset,
+ 		dns_rdataset_current(rdataset, &rdata);
+ 		result = dns_rdata_additionaldata(&rdata, add, arg);
+ 		if (result == ISC_R_SUCCESS) {
+-			result = dns_rdataset_next(rdataset);
+			if (limit != 0 && ++n >= limit) {
+				result = DNS_R_TOOMANYRECORDS;
+			} else {
+				result = dns_rdataset_next(rdataset);
+			}
+ 		}
+ 		dns_rdata_reset(&rdata);
+ 	} while (result == ISC_R_SUCCESS);
+-- 
+2.49.0
+
--- a/SOURCES/bind-9.18-query-fname-relative.patch
+++ b/SOURCES/bind-9.18-query-fname-relative.patch
@ -0,0 +1,90 @@
+From 5bc7cd7a7b9c37e5c70ccf74c5485a02411aaef5 Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Fri, 25 Apr 2025 02:00:00 +0200
+Subject: [PATCH] Insert additional checks ensuring name is not relative
+
+Mitigation for crashes put in various places, where obviously relative
+uninitialized name must not appear. This seems unnecessary once true
+cause were identified, but may prevent similar places.
+---
+ lib/ns/query.c | 35 +++++++++++++++++++++++++++++++++++
+ 1 file changed, 35 insertions(+)
+
+diff --git a/lib/ns/query.c b/lib/ns/query.c
+index 11d2520..7e8a4d2 100644
+--- a/lib/ns/query.c
+++ b/lib/ns/query.c
+@@ -2203,6 +2203,20 @@ regular:
+ 	CTRACE(ISC_LOG_DEBUG(3), "query_additional: done");
+ }
+ 
+static void
+log_query_relative(query_ctx_t *qctx, const char *func, const dns_name_t *name) {
+	if (isc_log_wouldlog(ns_lctx, ISC_LOG_DEBUG(1))) {
+		char namebuf[DNS_NAME_FORMATSIZE] = "!";
+		dns_name_format(name, namebuf, sizeof(namebuf));
+		ns_client_log(
+			qctx->client, NS_LOGCATEGORY_CLIENT, NS_LOGMODULE_QUERY,
+			ISC_LOG_DEBUG(1),
+			"%s: fname=%s leading to relative name, aborting query.",
+			func, namebuf
+		);
+	}
+}
+
+ static void
+ query_addrrset(query_ctx_t *qctx, dns_name_t **namep,
+ 	       dns_rdataset_t **rdatasetp, dns_rdataset_t **sigrdatasetp,
+@@ -2275,6 +2289,11 @@ query_addrrset(query_ctx_t *qctx, dns_name_t **namep,
+ 		client->query.attributes &= ~NS_QUERYATTR_SECURE;
+ 	}
+ 
+	if (!qctx->is_zone && mname && !dns_name_isabsolute(mname)) {
+		log_query_relative(qctx, "query_addrrset", mname);
+		QUERY_ERROR(qctx, DNS_R_SERVFAIL);
+		return;
+	}
+ 	/*
+ 	 * Update message name, set rdataset order, and do additional
+ 	 * section processing if needed.
+@@ -8074,6 +8093,11 @@ query_respond_any(query_ctx_t *qctx) {
+ 							     : qctx->tname;
+ 				query_prefetch(qctx->client, name,
+ 					       qctx->rdataset);
+				if (name && !dns_name_isabsolute(name)) {
+					log_query_relative(qctx, "query_respond_any", name);
+					result = DNS_R_DROP;
+					break;
+				}
+ 			}
+ 
+ 			/*
+@@ -10696,6 +10720,11 @@ query_cname(query_ctx_t *qctx) {
+ 
+ 	if (!qctx->is_zone && RECURSIONOK(qctx->client)) {
+ 		query_prefetch(qctx->client, qctx->fname, qctx->rdataset);
+		if (qctx->fname && !dns_name_isabsolute(qctx->fname)) {
+			log_query_relative(qctx, "query_cname", qctx->fname);
+			QUERY_ERROR(qctx, DNS_R_SERVFAIL);
+			return (ns_query_done(qctx));
+		}
+ 	}
+ 
+ 	query_addrrset(qctx, &qctx->fname, &qctx->rdataset, sigrdatasetp,
+@@ -10801,7 +10830,13 @@ query_dname(query_ctx_t *qctx) {
+ 
+ 	if (!qctx->is_zone && RECURSIONOK(qctx->client)) {
+ 		query_prefetch(qctx->client, qctx->fname, qctx->rdataset);
+		if (qctx->fname && !dns_name_isabsolute(qctx->fname)) {
+			log_query_relative(qctx, "query_dname", qctx->fname);
+			QUERY_ERROR(qctx, DNS_R_SERVFAIL);
+			return (ns_query_done(qctx));
+		}
+ 	}
+
+ 	query_addrrset(qctx, &qctx->fname, &qctx->rdataset, sigrdatasetp,
+ 		       qctx->dbuf, DNS_SECTION_ANSWER);
+ 
+-- 
+2.49.0
+
--- a/SOURCES/bind-9.20-robust-key-rollovers.patch
+++ b/SOURCES/bind-9.20-robust-key-rollovers.patch
@ -0,0 +1,97 @@
+diff --git a/lib/dns/keymgr.c b/lib/dns/keymgr.c
+index 6c04682004..8eda1535a0 100644
+--- a/lib/dns/keymgr.c
+++ b/lib/dns/keymgr.c
+@@ -1154,19 +1154,18 @@ static bool
+ keymgr_transition_allowed(dns_dnsseckeylist_t *keyring, dns_dnsseckey_t *key,
+ 			  int type, dst_key_state_t next_state,
+ 			  bool secure_to_insecure) {
+	bool rule1a, rule1b, rule2a, rule2b, rule3a, rule3b;
+	rule1a = keymgr_have_ds(keyring, key, type, NA, secure_to_insecure);
+	rule1b = keymgr_have_ds(keyring, key, type, next_state, secure_to_insecure);
+	rule2a = keymgr_have_dnskey(keyring, key, type, NA);
+	rule2b = keymgr_have_dnskey(keyring, key, type, next_state);
+	rule3a = keymgr_have_rrsig(keyring, key, type, NA);
+	rule3b = keymgr_have_rrsig(keyring, key, type, next_state);
+
+ 	/* Debug logging. */
+ 	if (isc_log_wouldlog(dns_lctx, ISC_LOG_DEBUG(1))) {
+-		bool rule1a, rule1b, rule2a, rule2b, rule3a, rule3b;
+ 		char keystr[DST_KEY_FORMATSIZE];
+ 		dst_key_format(key->key, keystr, sizeof(keystr));
+-		rule1a = keymgr_have_ds(keyring, key, type, NA,
+-					secure_to_insecure);
+-		rule1b = keymgr_have_ds(keyring, key, type, next_state,
+-					secure_to_insecure);
+-		rule2a = keymgr_have_dnskey(keyring, key, type, NA);
+-		rule2b = keymgr_have_dnskey(keyring, key, type, next_state);
+-		rule3a = keymgr_have_rrsig(keyring, key, type, NA);
+-		rule3b = keymgr_have_rrsig(keyring, key, type, next_state);
+ 		isc_log_write(
+ 			dns_lctx, DNS_LOGCATEGORY_DNSSEC, DNS_LOGMODULE_DNSSEC,
+ 			ISC_LOG_DEBUG(1),
+@@ -1179,30 +1178,40 @@ keymgr_transition_allowed(dns_dnsseckeylist_t *keyring, dns_dnsseckey_t *key,
+ 			rule3a ? "true" : "false", rule3b ? "true" : "false");
+ 	}
+ 
+-	return (
+-		/*
+-		 * Rule 1: There must be a DS at all times.
+-		 * First check the current situation: if the rule check fails,
+-		 * we allow the transition to attempt to move us out of the
+-		 * invalid state.  If the rule check passes, also check if
+-		 * the next state is also still a valid situation.
+-		 */
+-		(!keymgr_have_ds(keyring, key, type, NA, secure_to_insecure) ||
+-		 keymgr_have_ds(keyring, key, type, next_state,
+-				secure_to_insecure)) &&
+-		/*
+-		 * Rule 2: There must be a DNSKEY at all times.  Again, first
+-		 * check the current situation, then assess the next state.
+-		 */
+-		(!keymgr_have_dnskey(keyring, key, type, NA) ||
+-		 keymgr_have_dnskey(keyring, key, type, next_state)) &&
+-		/*
+-		 * Rule 3: There must be RRSIG records at all times. Again,
+-		 * first check the current situation, then assess the next
+-		 * state.
+-		 */
+-		(!keymgr_have_rrsig(keyring, key, type, NA) ||
+-		 keymgr_have_rrsig(keyring, key, type, next_state)));
+	/*
+	 * Rule checking:
+	 * First check the current situation: if the rule check fails,
+	 * we allow the transition to attempt to move us out of the
+	 * invalid state.  If the rule check passes, also check if
+	 * the next state is also still a valid situation.
+	 */
+	char keystr2[DST_KEY_FORMATSIZE];
+	dst_key_format(key->key, keystr2, sizeof(keystr2));
+
+	/*
+	 * Rule 1: There must be a DS at all times.
+	 */
+	if (!rule1a && !rule1b && next_state == UNRETENTIVE) {
+		return false;
+	}
+	/*
+	 * Rule 2: There must be a DNSKEY at all times.  Again, first
+	 * check the current situation, then assess the next state.
+	 */
+	if (!rule2a && !rule2b && next_state == UNRETENTIVE) {
+		return false;
+	}
+	/*
+	 * Rule 3: There must be RRSIG records at all times. Again,
+	 * first check the current situation, then assess the next
+	 * state.
+	 */
+	if (!rule3a && !rule3b && next_state == UNRETENTIVE) {
+		return false;
+	}
+
+	return (!rule1a || rule1b) && (!rule2a || rule2b) &&
+		   (!rule3a || rule3b);
+ }
+ 
+ /*
--- a/SOURCES/bind-9.20-stale-cname-tests.patch
+++ b/SOURCES/bind-9.20-stale-cname-tests.patch
@ -0,0 +1,92 @@
+diff --git a/bin/tests/system/serve-stale/ns1/stale.test.db b/bin/tests/system/serve-stale/ns1/stale.test.db
+index d389e7c6a6..128fb25a10 100644
+--- a/bin/tests/system/serve-stale/ns1/stale.test.db
+++ b/bin/tests/system/serve-stale/ns1/stale.test.db
+@@ -17,3 +17,11 @@ cname1.stale.test.	1	CNAME	a1.stale.test.
+ a1.stale.test.		1	A	192.0.2.1
+ cname2.stale.test.	1	CNAME	a2.stale.test.
+ a2.stale.test.		300	A	192.0.2.2
+
+cname-a1		1	CNAME	cname-a2
+cname-a2		300	CNAME	cname-a3
+cname-a3		300	A	192.0.2.1
+
+cname-b1		300	CNAME	cname-b2
+cname-b2		1	CNAME	cname-b3
+cname-b3		1	A	192.0.2.2
+diff --git a/bin/tests/system/serve-stale/tests.sh b/bin/tests/system/serve-stale/tests.sh
+index 0ae32f22c1..925e5086eb 100755
+--- a/bin/tests/system/serve-stale/tests.sh
+++ b/bin/tests/system/serve-stale/tests.sh
+@@ -2163,6 +2163,71 @@ if [ $ret != 0 ]; then
+ fi
+ status=$((status + ret))
+ 
+# New CNAME scenario (GL #5243)
+n=$((n + 1))
+echo_i "prime cache cname-a1.stale.test A (stale-answer-client-timeout 0) ($n)"
+ret=0
+$DIG -p ${PORT} @10.53.0.3 cname-a1.stale.test A >dig.out.test$n || ret=1
+grep "status: NOERROR" dig.out.test$n >/dev/null || ret=1
+grep "ANSWER: 3," dig.out.test$n >/dev/null || ret=1
+grep "cname-a1\.stale\.test\..*1.*IN.*CNAME.*cname-a2\.stale\.test\." dig.out.test$n >/dev/null || ret=1
+grep "cname-a2\.stale\.test\..*300.*IN.*CNAME.*cname-a3\.stale\.test\." dig.out.test$n >/dev/null || ret=1
+grep "cname-a3\.stale\.test\..*300.*IN.*A.*192\.0\.2\.1" dig.out.test$n >/dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "prime cache cname-b1.stale.test A (stale-answer-client-timeout 0) ($n)"
+ret=0
+$DIG -p ${PORT} @10.53.0.3 cname-b1.stale.test A >dig.out.test$n || ret=1
+grep "status: NOERROR" dig.out.test$n >/dev/null || ret=1
+grep "ANSWER: 3," dig.out.test$n >/dev/null || ret=1
+grep "cname-b1\.stale\.test\..*300.*IN.*CNAME.*cname-b2\.stale\.test\." dig.out.test$n >/dev/null || ret=1
+grep "cname-b2\.stale\.test\..*1.*IN.*CNAME.*cname-b3\.stale\.test\." dig.out.test$n >/dev/null || ret=1
+grep "cname-b3\.stale\.test\..*1.*IN.*A.*192\.0\.2\.2" dig.out.test$n >/dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+# Allow RRset to become stale.
+sleep 1
+
+n=$((n + 1))
+ret=0
+echo_i "check stale cname-a1.stale.test A comes from cache (stale-answer-client-timeout 0) ($n)"
+nextpart ns3/named.run >/dev/null
+$DIG -p ${PORT} @10.53.0.3 cname-a1.stale.test A >dig.out.test$n || ret=1
+wait_for_log 5 "cname-a1.stale.test A stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
+# Other records in chain are still good, so do not attempt a refresh
+grep "cname-a2.stale.test A stale answer used, an attempt to refresh the RRset" ns3/named.run && ret=1
+grep "cname-a3.stale.test A stale answer used, an attempt to refresh the RRset" ns3/named.run && ret=1
+# Check answer
+grep "status: NOERROR" dig.out.test$n >/dev/null || ret=1
+grep "ANSWER: 3," dig.out.test$n >/dev/null || ret=1
+grep "cname-a1\.stale\.test\..*3.*IN.*CNAME.*cname-a2\.stale\.test\." dig.out.test$n >/dev/null || ret=1
+grep "cname-a2\.stale\.test\..*29[0-9].*IN.*CNAME.*cname-a3\.stale\.test\." dig.out.test$n >/dev/null || ret=1
+grep "cname-a3\.stale\.test\..*29[0-9].*IN.*A.*192\.0\.2\.1" dig.out.test$n >/dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n + 1))
+ret=0
+echo_i "check stale cname-b1.stale.test A comes from cache (stale-answer-client-timeout 0) ($n)"
+nextpart ns3/named.run >/dev/null
+$DIG -p ${PORT} @10.53.0.3 cname-b1.stale.test A >dig.out.test$n || ret=1
+wait_for_log 5 "cname-b2.stale.test A stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
+# The next one in the chain (cname-b3.stale.test) is likely not logged because
+# there is already a refresh in progress. And the first record in the chain is
+# still good, so do not attempt a refresh.
+grep "cname-b1.stale.test A stale answer used, an attempt to refresh the RRset" ns3/named.run && ret=1
+# Check answer
+grep "status: NOERROR" dig.out.test$n >/dev/null || ret=1
+grep "ANSWER: 3," dig.out.test$n >/dev/null || ret=1
+grep "cname-b1\.stale\.test\..*29[0-9].*IN.*CNAME.*cname-b2\.stale\.test\." dig.out.test$n >/dev/null || ret=1
+grep "cname-b2\.stale\.test\..*3.*IN.*CNAME.*cname-b3\.stale\.test\." dig.out.test$n >/dev/null || ret=1
+grep "cname-b3\.stale\.test\..*3.*IN.*A.*192\.0\.2\.2" dig.out.test$n >/dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+ ####################################################################
+ # Test for stale-answer-client-timeout 0 and stale-refresh-time 4. #
+ ####################################################################
--- a/SOURCES/bind-9.20-stale-cname.patch
+++ b/SOURCES/bind-9.20-stale-cname.patch
@ -0,0 +1,707 @@
+diff --git a/bin/tests/system/serve-stale/tests.sh b/bin/tests/system/serve-stale/tests.sh
+index d767769ad8..0ae32f22c1 100755
+--- a/bin/tests/system/serve-stale/tests.sh
+++ b/bin/tests/system/serve-stale/tests.sh
+@@ -1965,7 +1965,7 @@ ret=0
+ echo_i "check stale nodata.example TXT comes from cache (stale-answer-client-timeout 0) ($n)"
+ nextpart ns3/named.run >/dev/null
+ $DIG -p ${PORT} @10.53.0.3 nodata.example TXT >dig.out.test$n || ret=1
+-wait_for_log 5 "nodata.example stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
+wait_for_log 5 "nodata.example TXT stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
+ grep "status: NOERROR" dig.out.test$n >/dev/null || ret=1
+ grep "ANSWER: 0," dig.out.test$n >/dev/null || ret=1
+ grep "example\..*3.*IN.*SOA" dig.out.test$n >/dev/null || ret=1
+@@ -1977,7 +1977,7 @@ ret=0
+ echo_i "check stale data.example TXT comes from cache (stale-answer-client-timeout 0) ($n)"
+ nextpart ns3/named.run >/dev/null
+ $DIG -p ${PORT} @10.53.0.3 data.example TXT >dig.out.test$n || ret=1
+-wait_for_log 5 "data.example stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
+wait_for_log 5 "data.example TXT stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
+ grep "status: NOERROR" dig.out.test$n >/dev/null || ret=1
+ grep "ANSWER: 1," dig.out.test$n >/dev/null || ret=1
+ grep "data\.example\..*3.*IN.*TXT.*A text record with a 2 second ttl" dig.out.test$n >/dev/null || ret=1
+@@ -2105,7 +2105,7 @@ ret=0
+ echo_i "check stale cname1.stale.test A comes from cache (stale-answer-client-timeout 0) ($n)"
+ nextpart ns3/named.run >/dev/null
+ $DIG -p ${PORT} @10.53.0.3 cname1.stale.test A >dig.out.test$n || ret=1
+-wait_for_log 5 "cname1.stale.test stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
+wait_for_log 5 "cname1.stale.test A stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
+ grep "status: NOERROR" dig.out.test$n >/dev/null || ret=1
+ grep "ANSWER: 2," dig.out.test$n >/dev/null || ret=1
+ grep "cname1\.stale\.test\..*3.*IN.*CNAME.*a1\.stale\.test\." dig.out.test$n >/dev/null || ret=1
+@@ -2143,7 +2143,7 @@ ret=0
+ echo_i "check stale cname2.stale.test A comes from cache (stale-answer-client-timeout 0) ($n)"
+ nextpart ns3/named.run >/dev/null
+ $DIG -p ${PORT} @10.53.0.3 cname2.stale.test A >dig.out.test$n || ret=1
+-wait_for_log 5 "cname2.stale.test stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
+wait_for_log 5 "cname2.stale.test A stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
+ grep "status: NOERROR" dig.out.test$n >/dev/null || ret=1
+ grep "ANSWER: 2," dig.out.test$n >/dev/null || ret=1
+ grep "cname2\.stale\.test\..*3.*IN.*CNAME.*a2\.stale\.test\." dig.out.test$n >/dev/null || ret=1
+@@ -2219,7 +2219,7 @@ ret=0
+ echo_i "check stale data.example TXT comes from cache (stale-answer-client-timeout 0 stale-refresh-time 4) ($n)"
+ nextpart ns3/named.run >/dev/null
+ $DIG -p ${PORT} @10.53.0.3 data.example TXT >dig.out.test$n || ret=1
+-wait_for_log 5 "data.example stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
+wait_for_log 5 "data.example TXT stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
+ grep "status: NOERROR" dig.out.test$n >/dev/null || ret=1
+ grep "ANSWER: 1," dig.out.test$n >/dev/null || ret=1
+ grep "data\.example\..*3.*IN.*TXT.*A text record with a 2 second ttl" dig.out.test$n >/dev/null || ret=1
+@@ -2262,7 +2262,7 @@ ret=0
+ echo_i "check stale data.example TXT comes from cache (stale-answer-client-timeout 0 stale-refresh-time 4) ($n)"
+ nextpart ns3/named.run >/dev/null
+ $DIG -p ${PORT} @10.53.0.3 data.example TXT >dig.out.test$n || ret=1
+-wait_for_log 5 "data.example stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
+wait_for_log 5 "data.example TXT stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
+ grep "status: NOERROR" dig.out.test$n >/dev/null || ret=1
+ grep "ANSWER: 1," dig.out.test$n >/dev/null || ret=1
+ grep "data\.example\..*3.*IN.*TXT.*A text record with a 2 second ttl" dig.out.test$n >/dev/null || ret=1
+@@ -2273,7 +2273,7 @@ status=$((status + ret))
+ n=$((n + 1))
+ ret=0
+ echo_i "wait until resolver query times out, activating stale-refresh-time"
+-wait_for_log 15 "data.example resolver failure, stale answer used" ns3/named.run || ret=1
+wait_for_log 15 "data.example/TXT stale refresh failed: timed out" ns3/named.run || ret=1
+ if [ $ret != 0 ]; then echo_i "failed"; fi
+ status=$((status + ret))
+ 
+@@ -2322,7 +2322,7 @@ n=$((n + 1))
+ ret=0
+ echo_i "check stale data.example TXT comes from cache (stale-answer-client-timeout 0 stale-refresh-time 4) ($n)"
+ $DIG -p ${PORT} @10.53.0.3 data.example TXT >dig.out.test$n || ret=1
+-wait_for_log 5 "data.example stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
+wait_for_log 5 "data.example TXT stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
+ grep "status: NOERROR" dig.out.test$n >/dev/null || ret=1
+ grep "ANSWER: 1," dig.out.test$n >/dev/null || ret=1
+ grep "data\.example\..*3.*IN.*TXT.*A text record with a 2 second ttl" dig.out.test$n >/dev/null || ret=1
+diff --git a/lib/dns/include/dns/rdataset.h b/lib/dns/include/dns/rdataset.h
+index de3f638f89..38d1d65ed2 100644
+--- a/lib/dns/include/dns/rdataset.h
+++ b/lib/dns/include/dns/rdataset.h
+@@ -193,7 +193,7 @@ struct dns_rdataset {
+ #define DNS_RDATASETATTR_STALE	      0x01000000
+ #define DNS_RDATASETATTR_ANCIENT      0x02000000
+ #define DNS_RDATASETATTR_STALE_WINDOW 0x04000000
+-#define DNS_RDATASETATTR_STALE_ADDED  0x08000000
+#define DNS_RDATASETATTR_KEEPCASE     0x10000000
+ 
+ /*%
+  * _OMITDNSSEC:
+diff --git a/lib/ns/include/ns/client.h b/lib/ns/include/ns/client.h
+index d1e2fde407..a50332e656 100644
+--- a/lib/ns/include/ns/client.h
+++ b/lib/ns/include/ns/client.h
+@@ -192,6 +192,7 @@ struct ns_client {
+ 					   (query, update, notify) */
+ 	isc_nmhandle_t *fetchhandle;	/* Waiting for recursive fetch */
+ 	isc_nmhandle_t *prefetchhandle; /* Waiting for prefetch / rpzfetch */
+	isc_nmhandle_t *stalerefreshhandle;
+ 	isc_nmhandle_t *updatehandle;	/* Waiting for update callback */
+ 	unsigned char  *tcpbuf;
+ 	dns_message_t  *message;
+diff --git a/lib/ns/include/ns/query.h b/lib/ns/include/ns/query.h
+index be0dadd509..9c96c45138 100644
+--- a/lib/ns/include/ns/query.h
+++ b/lib/ns/include/ns/query.h
+@@ -68,6 +68,7 @@ struct ns_query {
+ 	isc_mutex_t	 fetchlock;
+ 	dns_fetch_t	*fetch;
+ 	dns_fetch_t	*prefetch;
+	dns_fetch_t	*stalerefresh;
+ 	dns_rpz_st_t	*rpz_st;
+ 	isc_bufferlist_t namebufs;
+ 	ISC_LIST(ns_dbversion_t) activeversions;
+@@ -118,7 +119,6 @@ struct ns_query {
+ #define NS_QUERYATTR_RRL_CHECKED     0x010000
+ #define NS_QUERYATTR_REDIRECT	     0x020000
+ #define NS_QUERYATTR_ANSWERED	     0x040000
+-#define NS_QUERYATTR_STALEOK	     0x080000
+ #define NS_QUERYATTR_STALEPENDING    0x100000
+ 
+ typedef struct query_ctx query_ctx_t;
+@@ -147,7 +147,6 @@ struct query_ctx {
+ 	bool authoritative;		    /* authoritative query? */
+ 	bool want_restart;		    /* CNAME chain or other
+ 					     * restart needed */
+-	bool		refresh_rrset;	    /* stale RRset refresh needed */
+ 	bool		need_wildcardproof; /* wildcard proof needed */
+ 	bool		nxrewrite;	    /* negative answer from RPZ */
+ 	bool		findcoveringnsec;   /* lookup covering NSEC */
+diff --git a/lib/ns/query.c b/lib/ns/query.c
+index 1290c308af..4ea63caf37 100644
+--- a/lib/ns/query.c
+++ b/lib/ns/query.c
+@@ -142,9 +142,6 @@
+ #define QUERY_STALEPENDING(q) \
+ 	(((q)->attributes & NS_QUERYATTR_STALEPENDING) != 0)
+ 
+-/*% Does the query allow stale data in the response? */
+-#define QUERY_STALEOK(q) (((q)->attributes & NS_QUERYATTR_STALEOK) != 0)
+-
+ /*% Does the query wants to check for stale RRset due to a timeout? */
+ #define QUERY_STALETIMEOUT(q) (((q)->dboptions & DNS_DBFIND_STALETIMEOUT) != 0)
+ 
+@@ -242,6 +239,15 @@ static void
+ log_noexistnodata(void *val, int level, const char *fmt, ...)
+ 	ISC_FORMAT_PRINTF(3, 4);
+ 
+static isc_result_t
+qctx_prepare_buffers(query_ctx_t *qctx, isc_buffer_t *buffer);
+
+static void
+qctx_freedata(query_ctx_t *qctx);
+
+static void
+qctx_destroy(query_ctx_t *qctx);
+
+ /*
+  * Return the hooktable in use with 'qctx', or if there isn't one
+  * set, return the default hooktable.
+@@ -497,9 +503,6 @@ query_addwildcardproof(query_ctx_t *qctx, bool ispositive, bool nodata);
+ static void
+ query_addauth(query_ctx_t *qctx);
+ 
+-static void
+-query_clear_stale(ns_client_t *client);
+-
+ /*
+  * Increment query statistics counters.
+  */
+@@ -801,6 +804,7 @@ ns_query_init(ns_client_t *client) {
+ 
+ 	client->query.fetch = NULL;
+ 	client->query.prefetch = NULL;
+	client->query.stalerefresh = NULL;
+ 	client->query.authdb = NULL;
+ 	client->query.authzone = NULL;
+ 	client->query.authdbset = false;
+@@ -2186,10 +2190,6 @@ query_addrrset(query_ctx_t *qctx, dns_name_t **namep,
+ 		if ((rdataset->attributes & DNS_RDATASETATTR_REQUIRED) != 0) {
+ 			mrdataset->attributes |= DNS_RDATASETATTR_REQUIRED;
+ 		}
+-		if ((rdataset->attributes & DNS_RDATASETATTR_STALE_ADDED) != 0)
+-		{
+-			mrdataset->attributes |= DNS_RDATASETATTR_STALE_ADDED;
+-		}
+ 		return;
+ 	} else if (result == DNS_R_NXDOMAIN) {
+ 		/*
+@@ -2475,6 +2475,85 @@ free_devent(ns_client_t *client, isc_event_t **eventp,
+ 	isc_event_free(eventp);
+ }
+ 
+static void
+stale_refresh_aftermath(ns_client_t *client, isc_result_t result) {
+	dns_db_t *db = NULL;
+	unsigned int dboptions;
+	isc_buffer_t buffer;
+	query_ctx_t qctx;
+	dns_clientinfomethods_t cm;
+	dns_clientinfo_t ci;
+	char namebuf[DNS_NAME_FORMATSIZE];
+	char typebuf[DNS_RDATATYPE_FORMATSIZE];
+
+	/*
+	 * If refreshing a stale RRset failed, we need to set the
+	 * stale-refresh-time window, so that on future requests for this
+	 * RRset the stale entry may be used immediately.
+	 */
+	switch (result) {
+	case ISC_R_SUCCESS:
+	case DNS_R_GLUE:
+	case DNS_R_ZONECUT:
+	case ISC_R_NOTFOUND:
+	case DNS_R_DELEGATION:
+	case DNS_R_EMPTYNAME:
+	case DNS_R_NXRRSET:
+	case DNS_R_EMPTYWILD:
+	case DNS_R_NXDOMAIN:
+	case DNS_R_COVERINGNSEC:
+	case DNS_R_NCACHENXDOMAIN:
+	case DNS_R_NCACHENXRRSET:
+	case DNS_R_CNAME:
+	case DNS_R_DNAME:
+		break;
+	default:
+		dns_name_format(client->query.qname, namebuf, sizeof(namebuf));
+		dns_rdatatype_format(client->query.qtype, typebuf,
+				     sizeof(typebuf));
+		ns_client_log(client, NS_LOGCATEGORY_SERVE_STALE,
+			      NS_LOGMODULE_QUERY, ISC_LOG_NOTICE,
+			      "%s/%s stale refresh failed: timed out", namebuf,
+			      typebuf);
+
+		/*
+		 * Set up a short lived query context, solely to set the
+		 * last refresh failure time on the RRset in the cache
+		 * database, starting the stale-refresh-time window for it.
+		 * This is a condensed form of query_lookup().
+		 */
+		isc_stdtime_get(&client->now);
+		client->query.attributes &= ~NS_QUERYATTR_RECURSIONOK;
+		qctx_init(client, NULL, 0, &qctx);
+
+		dns_clientinfomethods_init(&cm, ns_client_sourceip);
+		dns_clientinfo_init(&ci, qctx.client, HAVEECS(qctx.client) ? &qctx.client->ecs : NULL, NULL);
+
+		result = qctx_prepare_buffers(&qctx, &buffer);
+		if (result != ISC_R_SUCCESS) {
+			goto cleanup;
+		}
+
+		dboptions = qctx.client->query.dboptions;
+		dboptions |= DNS_DBFIND_STALEOK;
+		dboptions |= DNS_DBFIND_STALESTART;
+
+		dns_db_attach(qctx.client->view->cachedb, &db);
+		(void)dns_db_findext(db, qctx.client->query.qname, NULL,
+				     qctx.client->query.qtype, dboptions,
+				     qctx.client->now, &qctx.node, qctx.fname,
+				     &cm, &ci, qctx.rdataset, qctx.sigrdataset);
+		if (qctx.node != NULL) {
+			dns_db_detachnode(db, &qctx.node);
+		}
+		dns_db_detach(&db);
+
+	cleanup:
+		qctx_freedata(&qctx);
+		qctx_destroy(&qctx);
+	}
+}
+
+ static void
+ prefetch_done(isc_task_t *task, isc_event_t *event) {
+ 	dns_fetchevent_t *devent = (dns_fetchevent_t *)event;
+@@ -2509,6 +2588,133 @@ prefetch_done(isc_task_t *task, isc_event_t *event) {
+ 	isc_nmhandle_detach(&client->prefetchhandle);
+ }
+ 
+static void
+refresh_done(isc_task_t *task, isc_event_t *event) {
+	dns_fetchevent_t *devent = (dns_fetchevent_t *)event;
+	ns_client_t *client;
+
+	UNUSED(task);
+
+	REQUIRE(event->ev_type == DNS_EVENT_FETCHDONE);
+	client = devent->ev_arg;
+	REQUIRE(NS_CLIENT_VALID(client));
+	REQUIRE(task == client->task);
+
+	CTRACE(ISC_LOG_DEBUG(3), "refresh_done");
+
+	LOCK(&client->query.fetchlock);
+	if (client->query.stalerefresh != NULL) {
+		INSIST(devent->fetch == client->query.stalerefresh);
+		client->query.stalerefresh = NULL;
+	}
+	UNLOCK(&client->query.fetchlock);
+
+	stale_refresh_aftermath(client, devent->result);
+
+	if (client->recursionquota != NULL) {
+		isc_quota_detach(&client->recursionquota);
+		ns_stats_decrement(client->sctx->nsstats,
+				   ns_statscounter_recursclients);
+	}
+
+	free_devent(client, &event, &devent);
+	isc_nmhandle_detach(&client->stalerefreshhandle);
+}
+
+static void
+query_stale_refresh(ns_client_t *client, dns_name_t *qname,
+					dns_rdataset_t *rdataset) {
+	isc_result_t result;
+	isc_sockaddr_t *peeraddr;
+	dns_rdataset_t *tmprdataset;
+	unsigned int options;
+
+	CTRACE(ISC_LOG_DEBUG(3), "query_stale_refresh");
+
+	bool stale_refresh_window = false;
+	bool stale_rrset = true;
+
+	if (rdataset != NULL) {
+		stale_refresh_window =
+			(STALE_WINDOW(rdataset) &&
+			(client->query.dboptions & DNS_DBFIND_STALEENABLED) != 0);
+		stale_rrset = STALE(rdataset);
+	}
+
+	if (client->query.stalerefresh != NULL ||
+		(client->query.dboptions & DNS_DBFIND_STALETIMEOUT) == 0 ||
+		!stale_rrset || stale_refresh_window)
+	{
+		return;
+	}
+
+	char namebuf[DNS_NAME_FORMATSIZE];
+	char typebuf[DNS_RDATATYPE_FORMATSIZE];
+	dns_name_format(qname, namebuf, sizeof(namebuf));
+	dns_rdatatype_format(client->query.qtype, typebuf, sizeof(typebuf));
+	isc_log_write(ns_lctx, NS_LOGCATEGORY_SERVE_STALE, NS_LOGMODULE_QUERY,
+			ISC_LOG_INFO,
+			"%s %s stale answer used, an attempt "
+			"to refresh the RRset will still be "
+			"made",
+			namebuf, typebuf);
+
+	client->query.dboptions &= ~(DNS_DBFIND_STALETIMEOUT |
+				     DNS_DBFIND_STALEOK |
+				     DNS_DBFIND_STALEENABLED);
+
+	if (client->recursionquota == NULL) {
+		result = isc_quota_attach(&client->sctx->recursionquota,
+					  &client->recursionquota);
+		switch (result) {
+			case ISC_R_SUCCESS:
+				ns_stats_increment(client->sctx->nsstats,
+						   ns_statscounter_recursclients);
+				break;
+			case ISC_R_SOFTQUOTA:
+				isc_quota_detach(&client->recursionquota);
+				FALLTHROUGH;
+			default:
+				return;
+		}
+	}
+
+	tmprdataset = ns_client_newrdataset(client);
+	if (tmprdataset == NULL) {
+		return;
+	}
+
+	if (!TCP(client)) {
+		peeraddr = &client->peeraddr;
+	} else {
+		peeraddr = NULL;
+	}
+
+	isc_nmhandle_attach(client->handle, &client->stalerefreshhandle);
+	options = client->query.fetchoptions;
+	result = dns_resolver_createfetch(
+		client->view->resolver, qname, client->query.qtype, NULL, NULL, NULL,
+		peeraddr, client->message->id, options, 0, NULL, client->task,
+		refresh_done, client, tmprdataset, NULL,
+		&client->query.stalerefresh);
+	if (result != ISC_R_SUCCESS) {
+		ns_client_putrdataset(client, &tmprdataset);
+		isc_nmhandle_detach(&client->stalerefreshhandle);
+	}
+}
+
+static void
+query_stale_refresh_ncache(ns_client_t *client) {
+	dns_name_t *qname;
+
+	if (client->query.origqname != NULL) {
+		qname = client->query.origqname;
+	} else {
+		qname = client->query.qname;
+	}
+	query_stale_refresh(client, qname, NULL);
+}
+
+ static void
+ query_prefetch(ns_client_t *client, dns_name_t *qname,
+ 	       dns_rdataset_t *rdataset) {
+@@ -2524,6 +2730,7 @@ query_prefetch(ns_client_t *client, dns_name_t *qname,
+ 	    rdataset->ttl > client->view->prefetch_trigger ||
+ 	    (rdataset->attributes & DNS_RDATASETATTR_PREFETCH) == 0)
+ 	{
+		query_stale_refresh(client, qname, rdataset);
+ 		return;
+ 	}
+ 
+@@ -2568,6 +2775,7 @@ query_prefetch(ns_client_t *client, dns_name_t *qname,
+ 
+ 	dns_rdataset_clearprefetch(rdataset);
+ 	ns_stats_increment(client->sctx->nsstats, ns_statscounter_prefetch);
+	return;
+ }
+ 
+ static void
+@@ -5696,55 +5904,6 @@ error:
+ 	return (ISC_R_NOMEMORY);
+ }
+ 
+-/*
+- * Setup a new query context for resolving a query.
+- *
+- * This function is only called if both these conditions are met:
+- *    1. BIND is configured with stale-answer-client-timeout 0.
+- *    2. A stale RRset is found in cache during initial query
+- *       database lookup.
+- *
+- * We continue with this function for refreshing/resolving an RRset
+- * after answering a client with stale data.
+- */
+-static void
+-query_refresh_rrset(query_ctx_t *orig_qctx) {
+-	isc_buffer_t buffer;
+-	query_ctx_t qctx;
+-
+-	REQUIRE(orig_qctx != NULL);
+-	REQUIRE(orig_qctx->client != NULL);
+-
+-	qctx_copy(orig_qctx, &qctx);
+-	qctx.client->query.dboptions &= ~(DNS_DBFIND_STALETIMEOUT |
+-					  DNS_DBFIND_STALEOK |
+-					  DNS_DBFIND_STALEENABLED);
+-	qctx.client->nodetach = false;
+-
+-	/*
+-	 * We'll need some resources...
+-	 */
+-	if (qctx_prepare_buffers(&qctx, &buffer) != ISC_R_SUCCESS) {
+-		dns_db_detach(&qctx.db);
+-		qctx_destroy(&qctx);
+-		return;
+-	}
+-
+-	/*
+-	 * Pretend we didn't find anything in cache.
+-	 */
+-	(void)query_gotanswer(&qctx, ISC_R_NOTFOUND);
+-
+-	if (qctx.fname != NULL) {
+-		ns_client_releasename(qctx.client, &qctx.fname);
+-	}
+-	if (qctx.rdataset != NULL) {
+-		ns_client_putrdataset(qctx.client, &qctx.rdataset);
+-	}
+-
+-	qctx_destroy(&qctx);
+-}
+-
+ /*%
+  * Depending on the db lookup result, we can respond to the
+  * client this stale answer.
+@@ -5814,7 +5973,7 @@ query_lookup(query_ctx_t *qctx) {
+ 		rpzqname = qctx->client->query.qname;
+ 	}
+ 
+-	if ((qctx->options & DNS_GETDB_STALEFIRST) != 0) {
+	if ((qctx->options & DNS_GETDB_STALEFIRST) != 0 && !qctx->is_zone) {
+ 		/*
+ 		 * If DNS_GETDB_STALEFIRST is set, it means that a stale
+ 		 * RRset may be returned as part of this lookup. An attempt
+@@ -5824,19 +5983,19 @@ query_lookup(query_ctx_t *qctx) {
+ 		qctx->client->query.dboptions |= DNS_DBFIND_STALETIMEOUT;
+ 	}
+ 
+-	dboptions = qctx->client->query.dboptions;
+-	if (!qctx->is_zone && qctx->findcoveringnsec &&
+-	    (qctx->type != dns_rdatatype_null || !dns_name_istat(rpzqname)))
+-	{
+-		dboptions |= DNS_DBFIND_COVERINGNSEC;
+-	}
+-
+ 	(void)dns_db_getservestalerefresh(qctx->client->view->cachedb,
+ 					  &stale_refresh);
+ 	if (stale_refresh > 0 &&
+ 	    dns_view_staleanswerenabled(qctx->client->view))
+ 	{
+-		dboptions |= DNS_DBFIND_STALEENABLED;
+		qctx->client->query.dboptions |= DNS_DBFIND_STALEENABLED;
+	}
+
+	dboptions = qctx->client->query.dboptions;
+	if (!qctx->is_zone && qctx->findcoveringnsec &&
+		(qctx->type != dns_rdatatype_null || !dns_name_istat(rpzqname)))
+	{
+		dboptions |= DNS_DBFIND_COVERINGNSEC;
+ 	}
+ 
+ 	result = dns_db_findext(qctx->db, rpzqname, qctx->version, qctx->type,
+@@ -5971,20 +6130,7 @@ query_lookup(query_ctx_t *qctx) {
+ 				 * Immediately return the stale answer, start a
+ 				 * resolver fetch to refresh the data in cache.
+ 				 */
+-				isc_log_write(
+-					ns_lctx, NS_LOGCATEGORY_SERVE_STALE,
+-					NS_LOGMODULE_QUERY, ISC_LOG_INFO,
+-					"%s stale answer used, an attempt to "
+-					"refresh the RRset will still be made",
+-					namebuf);
+-
+-				qctx->refresh_rrset = STALE(qctx->rdataset);
+-
+-				/*
+-				 * If we are refreshing the RRSet, we must not
+-				 * detach from the client in query_send().
+-				 */
+-				qctx->client->nodetach = qctx->refresh_rrset;
+				qctx->client->nodetach = false;
+ 			}
+ 		} else {
+ 			/*
+@@ -6014,76 +6160,12 @@ query_lookup(query_ctx_t *qctx) {
+ 		}
+ 	}
+ 
+-	if (stale_timeout && (answer_found || stale_found)) {
+-		/*
+-		 * Mark RRsets that we are adding to the client message on a
+-		 * lookup during 'stale-answer-client-timeout', so we can
+-		 * clean it up if needed when we resume from recursion.
+-		 */
+-		qctx->client->query.attributes |= NS_QUERYATTR_STALEOK;
+-		qctx->rdataset->attributes |= DNS_RDATASETATTR_STALE_ADDED;
+-	}
+-
+ 	result = query_gotanswer(qctx, result);
+ 
+ cleanup:
+ 	return (result);
+ }
+ 
+-/*
+- * Clear all rdatasets from the message that are in the given section and
+- * that have the 'attr' attribute set.
+- */
+-static void
+-message_clearrdataset(dns_message_t *msg, unsigned int attr) {
+-	unsigned int i;
+-	dns_name_t *name, *next_name;
+-	dns_rdataset_t *rds, *next_rds;
+-
+-	/*
+-	 * Clean up name lists by calling the rdataset disassociate function.
+-	 */
+-	for (i = DNS_SECTION_ANSWER; i < DNS_SECTION_MAX; i++) {
+-		name = ISC_LIST_HEAD(msg->sections[i]);
+-		while (name != NULL) {
+-			next_name = ISC_LIST_NEXT(name, link);
+-
+-			rds = ISC_LIST_HEAD(name->list);
+-			while (rds != NULL) {
+-				next_rds = ISC_LIST_NEXT(rds, link);
+-				if ((rds->attributes & attr) != attr) {
+-					rds = next_rds;
+-					continue;
+-				}
+-				ISC_LIST_UNLINK(name->list, rds, link);
+-				INSIST(dns_rdataset_isassociated(rds));
+-				dns_rdataset_disassociate(rds);
+-				isc_mempool_put(msg->rdspool, rds);
+-				rds = next_rds;
+-			}
+-
+-			if (ISC_LIST_EMPTY(name->list)) {
+-				ISC_LIST_UNLINK(msg->sections[i], name, link);
+-				if (dns_name_dynamic(name)) {
+-					dns_name_free(name, msg->mctx);
+-				}
+-				isc_mempool_put(msg->namepool, name);
+-			}
+-
+-			name = next_name;
+-		}
+-	}
+-}
+-
+-/*
+- * Clear any rdatasets from the client's message that were added on a lookup
+- * due to a client timeout.
+- */
+-static void
+-query_clear_stale(ns_client_t *client) {
+-	message_clearrdataset(client->message, DNS_RDATASETATTR_STALE_ADDED);
+-}
+-
+ /*
+  * Create a new query context with the sole intent of looking up for a stale
+  * RRset in cache. If an entry is found, we mark the original query as
+@@ -6163,6 +6245,7 @@ fetch_callback(isc_task_t *task, isc_event_t *event) {
+ 	}
+ 	client->query.fetchoptions &= ~DNS_FETCHOPT_TRYSTALE_ONTIMEOUT;
+ 	client->query.dboptions &= ~DNS_DBFIND_STALETIMEOUT;
+	client->query.dboptions &= ~DNS_DBFIND_STALEENABLED;
+ 	client->nodetach = false;
+ 
+ 	LOCK(&client->query.fetchlock);
+@@ -7303,14 +7386,6 @@ query_usestale(query_ctx_t *qctx, isc_result_t result) {
+ 		return (false);
+ 	}
+ 
+-	if (qctx->refresh_rrset) {
+-		/*
+-		 * This is a refreshing query, we have already prioritized
+-		 * stale data, so don't enable serve-stale again.
+-		 */
+-		return (false);
+-	}
+-
+ 	if (result == DNS_R_DUPLICATE || result == DNS_R_DROP ||
+ 	    result == ISC_R_ALREADYRUNNING)
+ 	{
+@@ -7842,24 +7917,6 @@ query_addanswer(query_ctx_t *qctx) {
+ 
+ 	CALL_HOOK(NS_QUERY_ADDANSWER_BEGIN, qctx);
+ 
+-	/*
+-	 * On normal lookups, clear any rdatasets that were added on a
+-	 * lookup due to stale-answer-client-timeout. Do not clear if we
+-	 * are going to refresh the RRset, because the stale contents are
+-	 * prioritized.
+-	 */
+-	if (QUERY_STALEOK(&qctx->client->query) &&
+-	    !QUERY_STALETIMEOUT(&qctx->client->query) && !qctx->refresh_rrset)
+-	{
+-		CCTRACE(ISC_LOG_DEBUG(3), "query_clear_stale");
+-		query_clear_stale(qctx->client);
+-		/*
+-		 * We can clear the attribute to prevent redundant clearing
+-		 * in subsequent lookups.
+-		 */
+-		qctx->client->query.attributes &= ~NS_QUERYATTR_STALEOK;
+-	}
+-
+ 	if (qctx->dns64) {
+ 		result = query_dns64(qctx);
+ 		qctx->noqname = NULL;
+@@ -7893,9 +7950,7 @@ query_addanswer(query_ctx_t *qctx) {
+ 		query_filter64(qctx);
+ 		ns_client_putrdataset(qctx->client, &qctx->rdataset);
+ 	} else {
+-		if (!qctx->is_zone && RECURSIONOK(qctx->client) &&
+-		    !QUERY_STALETIMEOUT(&qctx->client->query))
+-		{
+		if (!qctx->is_zone && RECURSIONOK(qctx->client)) {
+ 			query_prefetch(qctx->client, qctx->fname,
+ 				       qctx->rdataset);
+ 		}
+@@ -10138,6 +10193,10 @@ query_ncache(query_ctx_t *qctx, isc_result_t result) {
+ 		}
+ 	}
+ 
+	if (!qctx->is_zone && RECURSIONOK(qctx->client)) {
+		query_stale_refresh_ncache(qctx->client);
+	}
+
+ 	return (query_nodata(qctx, result));
+ 
+ cleanup:
+@@ -11589,20 +11648,6 @@ ns_query_done(query_ctx_t *qctx) {
+ 	nodetach = qctx->client->nodetach;
+ 	query_send(qctx->client);
+ 
+-	if (qctx->refresh_rrset) {
+-		/*
+-		 * If we reached this point then it means that we have found a
+-		 * stale RRset entry in cache and BIND is configured to allow
+-		 * queries to be answered with stale data if no active RRset
+-		 * is available, i.e. "stale-anwer-client-timeout 0". But, we
+-		 * still need to refresh the RRset. To prevent adding duplicate
+-		 * RRsets, clear the RRsets from the message before doing the
+-		 * refresh.
+-		 */
+-		message_clearrdataset(qctx->client->message, 0);
+-		query_refresh_rrset(qctx);
+-	}
+-
+ 	if (!nodetach) {
+ 		qctx->detach_client = true;
+ 	}
--- a/SOURCES/bind-9.21-resume-qmin-cname.patch
+++ b/SOURCES/bind-9.21-resume-qmin-cname.patch
@ -0,0 +1,44 @@
+From dc97bfa842b9f0d59db075bdcade599f3767f1ba Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Tue, 3 Jun 2025 21:00:58 +0200
+Subject: [PATCH] Handle CNAME and DNAME in resume_min in a special way
+
+When authoritative zone is loaded when query minimization query for the
+same zone is already pending, it might receive unexpected result codes.
+
+Normally DNS_R_CNAME would follow to query_cname after processing sent
+events, but dns_view_findzonecut does not fill CNAME target into
+event->foundevent. Usual lookup via query_lookup would always have that
+filled.
+
+Ideally we would restart the query with unmodified search name, if
+unexpected change from recursing to local zone cut were detected. Until
+dns_view_findzonecut is modified to export zone/cache source of the cut,
+at least fail queries which went into unexpected state.
+---
+ lib/dns/resolver.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
+index be1d735..ad0a1b8 100644
+--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
+@@ -4508,6 +4508,15 @@ resume_qmin(isc_task_t *task, isc_event_t *event) {
+ 	if (result == DNS_R_NXDOMAIN) {
+ 		result = DNS_R_SERVFAIL;
+ 	}
+	/*
+	 * CNAME or DNAME means zone were added with that record
+	 * after the start of query minimization queries. It means
+	 * we do not have initialized correct hevent->foundname
+	 * and have to fail.
+	 */
+	if (result == DNS_R_CNAME || result == DNS_R_DNAME) {
+		result = DNS_R_SERVFAIL;
+	}
+ 
+ 	if (result != ISC_R_SUCCESS) {
+ 		fctx_done(fctx, result, __LINE__);
+-- 
+2.49.0
+
--- a/SOURCES/bind-9.3.1rc1-sdb_tools-Makefile.in
+++ b/SOURCES/bind-9.3.1rc1-sdb_tools-Makefile.in
@ -1,63 +0,0 @@
-srcdir     =	@srcdir@
-VPATH      =	@srcdir@
-top_srcdir =	@top_srcdir@
-
-VERSION=@BIND9_VERSION@
-
-@BIND9_MAKE_INCLUDES@
-
-CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include \
-		${LWRES_INCLUDES} ${DNS_INCLUDES} ${BIND9_INCLUDES} \
-		${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} ${ISC_INCLUDES}
-
-CDEFINES =	-DBIND9
-
-DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
-ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
-ISCCCLIBS =	../../lib/isccc/libisccc.@A@
-ISCLIBS =	../../lib/isc/libisc.@A@
-LWRESLIBS =	../../lib/lwres/liblwres.@A@
-BIND9LIBS =	../../lib/bind9/libbind9.@A@
-
-DNSDEPLIBS =	../../lib/dns/libdns.@A@
-ISCCFGDEPLIBS =	../../lib/isccfg/libisccfg.@A@
-ISCCCDEPLIBS =	../../lib/isccc/libisccc.@A@
-ISCDEPLIBS =	../../lib/isc/libisc.@A@
-LWRESDEPLIBS =	../../lib/lwres/liblwres.@A@
-BIND9DEPLIBS =	../../lib/bind9/libbind9.@A@
-
-DEPLIBS =	${LWRESDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
-		${ISCCFGDEPLIBS} ${ISCCCDEPLIBS} ${ISCDEPLIBS}
-
-LIBS =		${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
-		${ISCCFGLIBS} ${ISCCCLIBS} ${ISCLIBS} ${DBDRIVER_LIBS} @LIBS@
-
-TARGETS =	zone2ldap@EXEEXT@ zonetodb@EXEEXT@
-
-OBJS	=	zone2ldap.@O@ zonetodb.@O@
-
-SRCS    =       zone2ldap.c zonetodb.c
-
-MANPAGES =      zone2ldap.1
-
-EXT_CFLAGS =
-
-@BIND9_MAKE_RULES@
-
-zone2ldap@EXEEXT@: zone2ldap.@O@ ${DEPLIBS}
-	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ zone2ldap.@O@ -lldap -llber ${LIBS}
-
-zonetodb@EXEEXT@: zonetodb.@O@  ${DEPLIBS}
-	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ zonetodb.@O@ -lpq ${LIBS}
-
-clean distclean manclean maintainer-clean::
-	rm -f ${TARGETS} ${OBJS}
-
-installdirs:
-	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
-	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man1
-
-install:: ${TARGETS} installdirs
-	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zone2ldap@EXEEXT@ ${DESTDIR}${sbindir}
-	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zonetodb@EXEEXT@  ${DESTDIR}${sbindir}
-	${INSTALL_DATA} ${srcdir}/zone2ldap.1 ${DESTDIR}${mandir}/man1/zone2ldap.1
--- a/SOURCES/bind-9.3.2-redhat_doc.patch
+++ b/SOURCES/bind-9.3.2-redhat_doc.patch
@ -1,98 +0,0 @@
-From facdbb0f2a266c6a3a1fa823afaa09cbd3fc38a5 Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Thu, 26 Nov 2020 12:13:10 +0100
-Subject: [PATCH] Note specific Red Hat changes in manual page
-
-Change docbook template instead of generated manual page. Remove
-system-config-bind reference, package were discontinued.
---
- bin/named/named.docbook | 73 +++++++++++++++++++++++++++++++++++++++++
- 1 file changed, 73 insertions(+)
-
-diff --git a/bin/named/named.docbook b/bin/named/named.docbook
-index 7e743a9..802bec3 100644
--- a/bin/named/named.docbook
-+++ b/bin/named/named.docbook
-@@ -516,6 +516,79 @@
- 
-   </refsection>
- 
-+  <refsection><info><title>NOTES</title></info>
-+    <refsection><info><title>Red Hat SELinux BIND Security Profile</title></info>
-+
-+    <para>
-+    By default, Red Hat ships BIND with the most secure SELinux policy
-+    that will not prevent normal BIND operation and will prevent exploitation
-+    of all known BIND security vulnerabilities . See the selinux(8) man page
-+    for information about SElinux.
-+    </para>
-+
-+    <para>
-+    It is not necessary to run named in a chroot environment if the Red Hat
-+    SELinux policy for named is enabled. When enabled, this policy is far
-+    more secure than a chroot environment. Users are recommended to enable
-+    SELinux and remove the bind-chroot package.
-+    </para>
-+
-+    <para>
-+    With this extra security comes some restrictions:
-+    </para>
-+
-+    <para>
-+    By default, the SELinux policy allows named to write any master
-+    zone database files. Only the root user may create files in the $ROOTDIR/var/named
-+    zone database file directory (the options { "directory" } option), where
-+    $ROOTDIR is set in /etc/sysconfig/named.
-+    </para>
-+
-+    <para>
-+    The "named" group must be granted read privelege to
-+    these files in order for named to be enabled to read them.
-+    </para>
-+
-+    <para>
-+    Any file created in the zone database file directory is automatically assigned
-+    the SELinux file context named_zone_t .
-+    </para>
-+
-+    <para>
-+    By default, SELinux prevents any role from modifying named_zone_t files; this
-+    means that files in the zone database directory cannot be modified by dynamic
-+    DNS (DDNS) updates or zone transfers.
-+    </para>
-+
-+    <para>
-+    The Red Hat BIND distribution and SELinux policy creates three directories where
-+    named is allowed to create and modify files: /var/named/slaves, /var/named/dynamic
-+    /var/named/data. By placing files you want named to modify, such as
-+    slave or DDNS updateable zone files and database / statistics dump files in
-+    these directories, named will work normally and no further operator action is
-+    required. Files in these directories are automatically assigned the 'named_cache_t'
-+    file context, which SELinux allows named to write.
-+    </para>
-+    </refsection>
-+
-+    <refsection><info><title>Red Hat BIND SDB support</title></info>
-+
-+    <para>
-+    Red Hat ships named with compiled in Simplified Database Backend modules that ISC
-+    provides in the "contrib/sdb" directory. Install bind-sdb package if you want use them.
-+    </para>
-+
-+    <para>
-+    The SDB modules for LDAP, PostGreSQL, DirDB and SQLite are compiled into <command>named-sdb</command>.
-+    </para>
-+
-+    <para>
-+    See the documentation for the various SDB modules in /usr/share/doc/bind-sdb-*/ .
-+    </para>
-+    </refsection>
-+
-+  </refsection>
-+
-   <refsection><info><title>SEE ALSO</title></info>
- 
-     <para><citetitle>RFC 1033</citetitle>,
-- 
-2.26.2
-
--- a/SOURCES/bind-9.3.2b1-fix_sdb_ldap.patch
+++ b/SOURCES/bind-9.3.2b1-fix_sdb_ldap.patch
@ -1,511 +0,0 @@
-diff --git a/bin/sdb_tools/Makefile.in b/bin/sdb_tools/Makefile.in
-index 95ab742..5059a17 100644
--- a/bin/sdb_tools/Makefile.in
-+++ b/bin/sdb_tools/Makefile.in
-@@ -32,11 +32,11 @@ DEPLIBS =	${LWRESDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
- LIBS =		${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
- 		${ISCCFGLIBS} ${ISCCCLIBS} ${ISCLIBS} ${DBDRIVER_LIBS} @LIBS@
- 
-TARGETS =	zone2ldap@EXEEXT@ zonetodb@EXEEXT@ zone2sqlite@EXEEXT@
-+TARGETS =	zone2ldap@EXEEXT@ zonetodb@EXEEXT@ zone2sqlite@EXEEXT@ ldap2zone@EXEEXT@
- 
-OBJS	=	zone2ldap.@O@ zonetodb.@O@ zone2sqlite.@O@
-+OBJS	=	zone2ldap.@O@ zonetodb.@O@ zone2sqlite.@O@ ldap2zone.@O@
- 
-SRCS    =       zone2ldap.c zonetodb.c zone2sqlite.c
-+SRCS    =       zone2ldap.c zonetodb.c zone2sqlite.c ldap2zone.c
- 
- MANPAGES =      zone2ldap.1
- 
-@@ -47,6 +47,9 @@ EXT_CFLAGS =
- zone2ldap@EXEEXT@: zone2ldap.@O@ ${DEPLIBS}
- 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ zone2ldap.@O@ -lldap -llber ${LIBS}
- 
-+ldap2zone@EXEEXT@: ldap2zone.@O@ ${DEPLIBS}
-+	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${ALL_CFLAGS} ${LDFLAGS} -o $@ ldap2zone.@O@ -lldap -llber ${LIBS}
-+
- zonetodb@EXEEXT@: zonetodb.@O@  ${DEPLIBS}
- 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ zonetodb.@O@ -lpq ${LIBS}
- 
-@@ -64,4 +67,5 @@ install:: ${TARGETS} installdirs
- 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zone2ldap@EXEEXT@ ${DESTDIR}${sbindir}
- 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zonetodb@EXEEXT@  ${DESTDIR}${sbindir}
- 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zone2sqlite@EXEEXT@ ${DESTDIR}${sbindir}
-+	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} ldap2zone@EXEEXT@ ${DESTDIR}${sbindir}
- 	${INSTALL_DATA} ${srcdir}/zone2ldap.1 ${DESTDIR}${mandir}/man1/zone2ldap.1
-diff --git a/bin/sdb_tools/zone2ldap.c b/bin/sdb_tools/zone2ldap.c
-index e0e9207..d59936c 100644
--- a/bin/sdb_tools/zone2ldap.c
-+++ b/bin/sdb_tools/zone2ldap.c
-@@ -73,7 +73,7 @@ void add_ldap_values (ldap_info * ldinfo);
- void init_ldap_conn (void);
- 
- /* Ldap error checking */
-void ldap_result_check (const char *msg, char *dn, int err);
-+void ldap_result_check (const char *msg, const char *dn, int err);
- 
- /* Put a hostname into a char ** array */
- char **hostname_to_dn_list (char *hostname, char *zone, unsigned int flags);
-@@ -82,7 +82,7 @@ char **hostname_to_dn_list (char *hostname, char *zone, unsigned int flags);
- int get_attr_list_size (char **tmp);
- 
- /* Get a DN */
-char *build_dn_from_dc_list (char **dc_list, unsigned int ttl, int flag);
-+char *build_dn_from_dc_list (char **dc_list, unsigned int ttl, int flag, char *zone);
- 
- /* Add to RR list */
- void add_to_rr_list (char *dn, char *name, char *type, char *data,
-@@ -104,11 +104,26 @@ void
- init_ldap_conn ();
- void usage();
- 
-char *argzone, *ldapbase, *binddn, *bindpw = NULL;
-const char *ldapsystem = "localhost";
-static const char *objectClasses[] =
-  { "top", "dNSZone", NULL };
-static const char *topObjectClasses[] = { "top", NULL };
-+static char *argzone, *ldapbase, *binddn, *bindpw = NULL;
-+
-+/* these are needed to placate gcc4's const-ness const-ernations : */
-+static char localhost[] = "localhost";
-+static char *ldapsystem=&(localhost[0]);
-+/* dnszone schema class names: */
-+static char topClass    [] ="top";
-+static char dNSZoneClass[] ="dNSZone";
-+static char objectClass [] ="objectClass";
-+static char dcObjectClass[]="dcObject";
-+/* dnszone schema attribute names: */
-+static char relativeDomainName[]="relativeDomainName";
-+static char dNSTTL            []="dNSTTL";
-+static char zoneName          []="zoneName";
-+static char dc                []="dc";
-+static char sameZone          []="@";
-+/* LDAPMod mod_values: */
-+static char *objectClasses    []= { &(topClass[0]), &(dNSZoneClass[0]), NULL };
-+static char *topObjectClasses []= { &(topClass[0]), &(dcObjectClass[0]), &(dNSZoneClass[0]), NULL };
-+static char *dn_buffer      [64]={NULL};
- LDAP *conn;
- unsigned int debug = 0;
- 
-@@ -120,7 +135,7 @@ static void
- fatal(const char *msg) {
-   perror(msg);
-   if (conn != NULL)
-    ldap_unbind_s(conn);
-+    ldap_unbind_ext_s(conn, NULL, NULL);
-   exit(1);
- }
- 
-@@ -132,12 +147,13 @@ main (int argc, char **argv)
-   isc_result_t result;
-   char *basedn;
-   ldap_info *tmp;
-  LDAPMod *base_attrs[2];
-  LDAPMod base;
-+  LDAPMod *base_attrs[5];
-+  LDAPMod base, dcBase, znBase, rdnBase;
-   isc_buffer_t buff;
-   char *zonefile=0L;
-   char fullbasedn[1024];
-   char *ctmp;
-+  char *zn, *dcp[2], *znp[2], *rdn[2];
-   dns_fixedname_t fixedzone, fixedname;
-   dns_rdataset_t rdataset;
-   char **dc_list;
-@@ -150,7 +166,7 @@ main (int argc, char **argv)
-   extern char *optarg;
-   extern int optind, opterr, optopt;
-   int create_base = 0;
-  int topt;
-+  int topt, dcn, zdn, znlen;
- 
-   if (argc < 2)
-     {
-@@ -158,7 +174,7 @@ main (int argc, char **argv)
-       exit (-1);
-     }
- 
-  while ((topt = getopt (argc, argv, "D:w:b:z:f:h:?dcv")) != -1)
-+  while ((topt = getopt (argc, argv, "D:Ww:b:z:f:h:?dcv")) != -1)
-     {
-       switch (topt)
- 	{
-@@ -181,6 +197,9 @@ main (int argc, char **argv)
- 	  if (bindpw == NULL)
- 	    fatal("strdup");
- 	  break;
-+	case 'W':
-+	  bindpw = getpass("Enter LDAP Password: ");
-+	  break;
- 	case 'b':
- 	  ldapbase = strdup (optarg);
- 	  if (ldapbase == NULL)
-@@ -302,17 +321,51 @@ main (int argc, char **argv)
- 	printf ("Creating base zone DN %s\n", argzone);
- 
-       dc_list = hostname_to_dn_list (argzone, argzone, DNS_TOP);
-      basedn = build_dn_from_dc_list (dc_list, 0, NO_SPEC);
-+      basedn = build_dn_from_dc_list (dc_list, 0, NO_SPEC, argzone);
-+      if (debug)
-+	printf ("base DN %s\n", basedn);
- 
-      for (ctmp = &basedn[strlen (basedn)]; ctmp >= &basedn[0]; ctmp--)
-+      for (ctmp = &basedn[strlen (basedn)], dcn=0; ctmp >= &basedn[0]; ctmp--)
- 	{
- 	  if ((*ctmp == ',') || (ctmp == &basedn[0]))
- 	    {
- 	      base.mod_op = LDAP_MOD_ADD;
-	      base.mod_type = (char*)"objectClass";
-+	      base.mod_type = objectClass;
- 	      base.mod_values = (char**)topObjectClasses;
- 	      base_attrs[0] = (void*)&base;
-	      base_attrs[1] = NULL;
-+
-+	      dcBase.mod_op = LDAP_MOD_ADD;
-+	      dcBase.mod_type = dc;
-+	      dcp[0]=dc_list[dcn];
-+	      dcp[1]=0L;
-+	      dcBase.mod_values=dcp;
-+	      base_attrs[1] = (void*)&dcBase;
-+
-+	      znBase.mod_op = LDAP_MOD_ADD;
-+	      znBase.mod_type = zoneName;
-+	      for( zdn = dcn, znlen = 0; zdn >= 0; zdn-- )
-+		  znlen += strlen(dc_list[zdn])+1;
-+	      znp[0] = (char*)malloc(znlen+1);
-+	      znp[1] = 0L;
-+	      for( zdn = dcn, zn=znp[0]; zdn >= 0; zdn-- )
-+		  zn+=sprintf(zn,"%s%s",dc_list[zdn],
-+			      ((zdn > 0) && (*(dc_list[zdn-1])!='.')) ? "." : ""
-+		             );
-+
-+	      znBase.mod_values = znp;
-+	      base_attrs[2] = (void*)&znBase;
-+
-+	      rdnBase.mod_op = LDAP_MOD_ADD;
-+	      rdnBase.mod_type = relativeDomainName;
-+	      rdn[0] = strdup(sameZone);
-+	      rdn[1] = 0L;
-+	      rdnBase.mod_values = rdn;
-+	      base_attrs[3] = (void*)&rdnBase;
-+
-+	      dcn++;
-+
-+	      base.mod_values = topObjectClasses;
-+	      base_attrs[4] = NULL;
- 
- 	      if (ldapbase)
- 		{
-@@ -329,6 +382,10 @@ main (int argc, char **argv)
- 		  else
- 		    sprintf (fullbasedn, "%s", ctmp);
- 		}
-+
-+	      if( debug )
-+		  printf("Full base dn: %s\n", fullbasedn);
-+
- 	      result = ldap_add_s (conn, fullbasedn, base_attrs);
- 	      ldap_result_check ("initial ldap_add_s", fullbasedn, result);
- 	    }
-@@ -408,14 +465,14 @@ generate_ldap (dns_name_t * dnsname, dns_rdata_t * rdata, unsigned int ttl)
-   isc_result_check (result, "dns_rdata_totext");
-   data[isc_buffer_usedlength (&buff)] = 0;
- 
-  dc_list = hostname_to_dn_list (name, argzone, DNS_OBJECT);
-+  dc_list = hostname_to_dn_list ((char*)name, argzone, DNS_OBJECT);
-   len = (get_attr_list_size (dc_list) - 2);
-  dn = build_dn_from_dc_list (dc_list, ttl, WI_SPEC);
-+  dn = build_dn_from_dc_list (dc_list, ttl, WI_SPEC, argzone);
- 
-   if (debug)
-     printf ("Adding %s (%s %s) to run queue list.\n", dn, type, data);
- 
-  add_to_rr_list (dn, dc_list[len], type, data, ttl, DNS_OBJECT);
-+  add_to_rr_list (dn, dc_list[len], (char*)type, (char*)data, ttl, DNS_OBJECT);
- }
- 
- 
-@@ -455,7 +512,8 @@ add_to_rr_list (char *dn, char *name, char *type,
-   int attrlist;
-   char ldap_type_buffer[128];
-   char charttl[64];
-
-+  char *zn;
-+  int znlen;
- 
-   if ((tmp = locate_by_dn (dn)) == NULL)
-     {
-@@ -482,10 +540,10 @@ add_to_rr_list (char *dn, char *name, char *type,
- 	    fatal("malloc");
- 	}
-       tmp->attrs[0]->mod_op = LDAP_MOD_ADD;
-      tmp->attrs[0]->mod_type = (char*)"objectClass";
-+      tmp->attrs[0]->mod_type = objectClass;
- 
-       if (flags == DNS_OBJECT)
-	tmp->attrs[0]->mod_values = (char**)objectClasses;
-+	tmp->attrs[0]->mod_values = objectClasses;
-       else
- 	{
- 	  tmp->attrs[0]->mod_values = (char**)topObjectClasses;
-@@ -497,7 +555,7 @@ add_to_rr_list (char *dn, char *name, char *type,
- 	}
- 
-       tmp->attrs[1]->mod_op = LDAP_MOD_ADD;
-      tmp->attrs[1]->mod_type = (char*)"relativeDomainName";
-+      tmp->attrs[1]->mod_type = relativeDomainName;
-       tmp->attrs[1]->mod_values = (char **) calloc (sizeof (char *), 2);
- 
-       if (tmp->attrs[1]->mod_values == (char **)NULL)
-@@ -526,7 +584,7 @@ add_to_rr_list (char *dn, char *name, char *type,
- 	 fatal("strdup");
- 
-       tmp->attrs[3]->mod_op = LDAP_MOD_ADD;
-      tmp->attrs[3]->mod_type = (char*)"dNSTTL";
-+      tmp->attrs[3]->mod_type = dNSTTL;
-       tmp->attrs[3]->mod_values = (char **) calloc (sizeof (char *), 2);
- 
-       if (tmp->attrs[3]->mod_values == (char **)NULL)
-@@ -539,14 +597,25 @@ add_to_rr_list (char *dn, char *name, char *type,
-       if (tmp->attrs[3]->mod_values[0] == NULL)
- 	 fatal("strdup");
- 
-+      znlen=strlen(gbl_zone);
-+      if ( gbl_zone[znlen-1] == '.' )
-+      { /* ldapdb MUST search by relative zone name */
-+	  zn = (char*)malloc(znlen);
-+	  memcpy(zn, gbl_zone, znlen-1);
-+	  zn[znlen-1]='\0';
-+      }else
-+      {
-+	  zn = gbl_zone;
-+      }
-+
-       tmp->attrs[4]->mod_op = LDAP_MOD_ADD;
-      tmp->attrs[4]->mod_type = (char*)"zoneName";
-+      tmp->attrs[4]->mod_type = zoneName;
-       tmp->attrs[4]->mod_values = (char **)calloc(sizeof(char *), 2);
- 
-       if (tmp->attrs[4]->mod_values == (char **)NULL)
- 	 fatal("calloc");
- 
-      tmp->attrs[4]->mod_values[0] = gbl_zone;
-+      tmp->attrs[4]->mod_values[0] = zn;
-       tmp->attrs[4]->mod_values[1] = NULL;
- 
-       tmp->attrs[5] = NULL;
-@@ -557,7 +626,7 @@ add_to_rr_list (char *dn, char *name, char *type,
-   else
-     {
- 
-      for (i = 0; tmp->attrs[i] != NULL; i++)
-+	for (i = 0; tmp->attrs[i] != NULL; i++)
- 	{
- 	  sprintf (ldap_type_buffer, "%sRecord", type);
- 	  if (!strncmp
-@@ -631,44 +700,70 @@ char **
- hostname_to_dn_list (char *hostname, char *zone, unsigned int flags)
- {
-   char *tmp;
-  static char *dn_buffer[64];
-   int i = 0;
-  char *zname;
-  char *hnamebuff;
-
-  zname = strdup (hostname);
-  if (zname == NULL)
-	fatal("strdup");
-
-  if (flags == DNS_OBJECT)
-    {
-
-      if (strlen (zname) != strlen (zone))
-	{
-	  tmp = &zname[strlen (zname) - strlen (zone)];
-	  *--tmp = '\0';
-	  hnamebuff = strdup (zname);
-	  if (hnamebuff == NULL)
-		fatal("strdup");
-	  zname = ++tmp;
-	}
-      else
-	hnamebuff = (char*)"@";
-    }
-  else
-    {
-      zname = zone;
-      hnamebuff = NULL;
-    }
-
-  for (tmp = strrchr (zname, '.'); tmp != (char *) 0;
-       tmp = strrchr (zname, '.'))
-    {
-      *tmp++ = '\0';
-      dn_buffer[i++] = tmp;
-    }
-  dn_buffer[i++] = zname;
-  dn_buffer[i++] = hnamebuff;
-+  char *hname=0L, *last=0L;
-+  int hlen=strlen(hostname), zlen=(strlen(zone));
-+
-+/*  printf("hostname: %s zone: %s\n",hostname, zone); */
-+  hname=0L;
-+  if(flags == DNS_OBJECT)
-+  {
-+      if( (zone[ zlen - 1 ] == '.') && (hostname[hlen - 1] != '.') )
-+      {
-+	  hname=(char*)malloc(hlen + 1);
-+	  hlen += 1;
-+	  sprintf(hname, "%s.", hostname);
-+	  hostname = hname;
-+      }
-+      if(strcmp(hostname, zone) == 0)
-+      {
-+	  if( hname == 0 )
-+	      hname=strdup(hostname);
-+	  last = strdup(sameZone);
-+      }else
-+      {
-+	  if(  (hlen < zlen)
-+	     ||( strcmp( hostname + (hlen - zlen), zone ) != 0)
-+	    )
-+	  {
-+	      if( hname != 0 )
-+		  free(hname);
-+	      hname=(char*)malloc( hlen + zlen + 1);
-+	      if( *zone == '.' )
-+		  sprintf(hname, "%s%s", hostname, zone);
-+	      else
-+		  sprintf(hname,"%s",zone);
-+	  }else
-+	  {
-+	      if( hname == 0 )
-+		  hname = strdup(hostname);
-+	  }
-+	  last = hname;
-+      }
-+  }else
-+  { /* flags == DNS_TOP */
-+      hname = strdup(zone);
-+      last = hname;
-+  }
-+
-+  for (tmp = strrchr (hname, '.'); tmp != (char *) 0;
-+       tmp = strrchr (hname, '.'))
-+  {
-+      if( *( tmp + 1 ) != '\0' )
-+      {
-+	  *tmp = '\0';
-+	  dn_buffer[i++] = ++tmp;
-+      }else
-+      { /* trailing '.' ! */
-+	  dn_buffer[i++] = strdup(".");
-+	  *tmp = '\0';
-+	  if( tmp == hname )
-+	      break;
-+      }
-+  }
-+  if( ( last != hname ) && (tmp != hname) )
-+      dn_buffer[i++] = hname;
-+  dn_buffer[i++] = last;
-   dn_buffer[i] = NULL;
- 
-   return dn_buffer;
-@@ -680,30 +775,38 @@ hostname_to_dn_list (char *hostname, char *zone, unsigned int flags)
-  * exception of "@"/SOA. */
- 
- char *
-build_dn_from_dc_list (char **dc_list, unsigned int ttl, int flag)
-+build_dn_from_dc_list (char **dc_list, unsigned int ttl, int flag, char *zone)
- {
-   int size;
-  int x;
-  static char dn[1024];
-  char tmp[128];
-+  int x, znlen;
-+  static char dn[DNS_NAME_MAXTEXT*3/2];
-+  char tmp[DNS_NAME_MAXTEXT*3/2];
-+  char zn[DNS_NAME_MAXTEXT+1];
- 
-   bzero (tmp, sizeof (tmp));
-   bzero (dn, sizeof (dn));
-   size = get_attr_list_size (dc_list);
-+  znlen = strlen(zone);
-+  if ( zone[znlen-1] == '.' )
-+  { /* ldapdb MUST search by relative zone name */
-+      memcpy(&(zn[0]),zone,znlen-1);
-+      zn[znlen-1]='\0';
-+      zone = zn;
-+  }
-   for (x = size - 2; x > 0; x--)
-     {
-     if (flag == WI_SPEC)
-     {
-       if (x == (size - 2) && (strncmp (dc_list[x], "@", 1) == 0) && (ttl))
-	sprintf (tmp, "relativeDomainName=%s + dNSTTL=%u,", dc_list[x], ttl);
-+	snprintf (tmp, sizeof(tmp), "zoneName=%s + relativeDomainName=%s,", zone, dc_list[x]);
-       else if (x == (size - 2))
-	      sprintf(tmp, "relativeDomainName=%s,",dc_list[x]);
-+	      snprintf(tmp, sizeof(tmp), "zoneName=%s + relativeDomainName=%s,", zone, dc_list[x]);
-       else
-	      sprintf(tmp,"dc=%s,", dc_list[x]);
-+	      snprintf(tmp, sizeof(tmp), "dc=%s,", dc_list[x]);
-     }
-     else
-     {
-	    sprintf(tmp, "dc=%s,", dc_list[x]);
-+	    snprintf(tmp, sizeof(tmp), "dc=%s,", dc_list[x]);
-     }
- 
- 
-@@ -732,19 +835,18 @@ init_ldap_conn ()
-     }
- 
-   result = ldap_simple_bind_s (conn, binddn, bindpw);
-  ldap_result_check ("ldap_simple_bind_s", (char*)"LDAP Bind", result);
-+  ldap_result_check ("ldap_simple_bind_s", "LDAP Bind", result);
- }
- 
- /* Like isc_result_check, only for LDAP */
- void
-ldap_result_check (const char *msg, char *dn, int err)
-+ldap_result_check (const char *msg, const char *dn, int err)
- {
-   if ((err != LDAP_SUCCESS) && (err != LDAP_ALREADY_EXISTS))
-     {
-      fprintf(stderr, "Error while adding %s (%s):\n",
-		      dn, msg);
-      ldap_perror (conn, dn);
-      ldap_unbind_s (conn);
-+      fprintf(stderr, "Error while adding %s (%s):\n%s",
-+		      dn, msg, ldap_err2string(err));
-+      ldap_unbind_ext_s (conn, NULL, NULL);
-       exit (-1);
-     }
- }
-@@ -758,16 +860,15 @@ add_ldap_values (ldap_info * ldinfo)
-   int result;
-   char dnbuffer[1024];
- 
-
-   if (ldapbase != NULL)
-     sprintf (dnbuffer, "%s,%s", ldinfo->dn, ldapbase);
-   else
-     sprintf (dnbuffer, "%s", ldinfo->dn);
- 
-   result = ldap_add_s (conn, dnbuffer, ldinfo->attrs);
-  ldap_result_check ("ldap_add_s", dnbuffer, result);
-}
-+    ldap_result_check ("ldap_add_s", dnbuffer, result);
- 
-+}
- 
- 
- 
-@@ -776,5 +877,5 @@ void
- usage ()
- {
-   fprintf (stderr,
-	   "zone2ldap -D [BIND DN] -w [BIND PASSWORD] -b [BASE DN] -z [ZONE] -f [ZONE FILE] -h [LDAP HOST] "
-+	   "zone2ldap -D [BIND DN] [-w BIND PASSWORD | -W:prompt] -b [BASE DN] -z [ZONE] -f [ZONE FILE] -h [LDAP HOST] "
- 	   "[-c Create LDAP Base structure][-d Debug Output (lots !)] \n ");}
--- a/SOURCES/bind-9.3.2b2-sdbsrc.patch
+++ b/SOURCES/bind-9.3.2b2-sdbsrc.patch
@ -1,230 +0,0 @@
-diff --git a/contrib/sdb/bdb/bdb.c b/contrib/sdb/bdb/bdb.c
-index 23594bb..b3c6619 100644
--- a/contrib/sdb/bdb/bdb.c
-+++ b/contrib/sdb/bdb/bdb.c
-@@ -43,7 +43,7 @@
- #include <dns/lib.h>
- #include <dns/ttl.h>
- 
-#include <named/bdb.h>
-+#include "bdb.h"
- #include <named/globals.h>
- #include <named/config.h>
- 
-diff --git a/contrib/sdb/ldap/zone2ldap.c b/contrib/sdb/ldap/zone2ldap.c
-index 07c89bc..23dd873 100644
--- a/contrib/sdb/ldap/zone2ldap.c
-+++ b/contrib/sdb/ldap/zone2ldap.c
-@@ -63,16 +63,16 @@ typedef struct LDAP_INFO
- ldap_info;
- 
- /* usage Info */
-void usage ();
-+void usage (void);
- 
- /* Add to the ldap dit */
- void add_ldap_values (ldap_info * ldinfo);
- 
- /* Init an ldap connection */
-void init_ldap_conn ();
-+void init_ldap_conn (void);
- 
- /* Ldap error checking */
-void ldap_result_check (char *msg, char *dn, int err);
-+void ldap_result_check (const char *msg, char *dn, int err);
- 
- /* Put a hostname into a char ** array */
- char **hostname_to_dn_list (char *hostname, char *zone, unsigned int flags);
-@@ -88,7 +88,7 @@ void add_to_rr_list (char *dn, char *name, char *type, char *data,
- 		     unsigned int ttl, unsigned int flags);
- 
- /* Error checking */
-void isc_result_check (isc_result_t res, char *errorstr);
-+void isc_result_check (isc_result_t res, const char *errorstr);
- 
- /* Generate LDIF Format files */
- void generate_ldap (dns_name_t * dnsname, dns_rdata_t * rdata,
-@@ -97,11 +97,17 @@ void generate_ldap (dns_name_t * dnsname, dns_rdata_t * rdata,
- /* head pointer to the list */
- ldap_info *ldap_info_base = NULL;
- 
-+ldap_info *
-+locate_by_dn (char *dn);
-+void
-+init_ldap_conn ();
-+void usage();
-+
- char *argzone, *ldapbase, *binddn, *bindpw = NULL;
-char *ldapsystem = "localhost";
-static char *objectClasses[] =
-+const char *ldapsystem = "localhost";
-+static const char *objectClasses[] =
-   { "top", "dNSZone", NULL };
-static char *topObjectClasses[] = { "top", NULL };
-+static const char *topObjectClasses[] = { "top", NULL };
- LDAP *conn;
- unsigned int debug = 0;
- 
-@@ -128,7 +134,7 @@ main (int argc, char **argv)
-   LDAPMod *base_attrs[2];
-   LDAPMod base;
-   isc_buffer_t buff;
-  char *zonefile;
-+  char *zonefile=0L;
-   char fullbasedn[1024];
-   char *ctmp;
-   dns_fixedname_t fixedzone, fixedname;
-@@ -304,9 +310,9 @@ main (int argc, char **argv)
- 	  if ((*ctmp == ',') || (ctmp == &basedn[0]))
- 	    {
- 	      base.mod_op = LDAP_MOD_ADD;
-	      base.mod_type = "objectClass";
-	      base.mod_values = topObjectClasses;
-	      base_attrs[0] = &base;
-+	      base.mod_type = (char*)"objectClass";
-+	      base.mod_values = (char**)topObjectClasses;
-+	      base_attrs[0] = (void*)&base;
- 	      base_attrs[1] = NULL;
- 
- 	      if (ldapbase)
-@@ -363,7 +369,7 @@ main (int argc, char **argv)
-  * I should probably rename this function, as not to cause any
-  * confusion with the isc* routines. Will exit on error. */
- void
-isc_result_check (isc_result_t res, char *errorstr)
-+isc_result_check (isc_result_t res, const char *errorstr)
- {
-   if (res != ISC_R_SUCCESS)
-     {
-@@ -470,20 +476,20 @@ add_to_rr_list (char *dn, char *name, char *type,
-       if (tmp->attrs == (LDAPMod **) NULL)
- 	fatal("calloc");
- 
-      for (i = 0; i < flags; i++)
-+      for (i = 0; i < (int)flags; i++)
- 	{
- 	  tmp->attrs[i] = (LDAPMod *) malloc (sizeof (LDAPMod));
- 	  if (tmp->attrs[i] == (LDAPMod *) NULL)
- 	    fatal("malloc");
- 	}
-       tmp->attrs[0]->mod_op = LDAP_MOD_ADD;
-      tmp->attrs[0]->mod_type = "objectClass";
-+      tmp->attrs[0]->mod_type = (char*)"objectClass";
- 
-       if (flags == DNS_OBJECT)
-	tmp->attrs[0]->mod_values = objectClasses;
-+	tmp->attrs[0]->mod_values = (char**)objectClasses;
-       else
- 	{
-	  tmp->attrs[0]->mod_values = topObjectClasses;
-+	  tmp->attrs[0]->mod_values = (char**)topObjectClasses;
- 	  tmp->attrs[1] = NULL;
- 	  tmp->attrcnt = 2;
- 	  tmp->next = ldap_info_base;
-@@ -492,7 +498,7 @@ add_to_rr_list (char *dn, char *name, char *type,
- 	}
- 
-       tmp->attrs[1]->mod_op = LDAP_MOD_ADD;
-      tmp->attrs[1]->mod_type = "relativeDomainName";
-+      tmp->attrs[1]->mod_type = (char*)"relativeDomainName";
-       tmp->attrs[1]->mod_values = (char **) calloc (sizeof (char *), 2);
- 
-       if (tmp->attrs[1]->mod_values == (char **)NULL)
-@@ -521,7 +527,7 @@ add_to_rr_list (char *dn, char *name, char *type,
- 	 fatal("strdup");
- 
-       tmp->attrs[3]->mod_op = LDAP_MOD_ADD;
-      tmp->attrs[3]->mod_type = "dNSTTL";
-+      tmp->attrs[3]->mod_type = (char*)"dNSTTL";
-       tmp->attrs[3]->mod_values = (char **) calloc (sizeof (char *), 2);
- 
-       if (tmp->attrs[3]->mod_values == (char **)NULL)
-@@ -535,7 +541,7 @@ add_to_rr_list (char *dn, char *name, char *type,
- 	 fatal("strdup");
- 
-       tmp->attrs[4]->mod_op = LDAP_MOD_ADD;
-      tmp->attrs[4]->mod_type = "zoneName";
-+      tmp->attrs[4]->mod_type = (char*)"zoneName";
-       tmp->attrs[4]->mod_values = (char **)calloc(sizeof(char *), 2);
- 
-       if (tmp->attrs[4]->mod_values == (char **)NULL)
-@@ -648,7 +654,7 @@ hostname_to_dn_list (char *hostname, char *zone, unsigned int flags)
- 	  zname = ++tmp;
- 	}
-       else
-	hnamebuff = "@";
-+	hnamebuff = (char*)"@";
-     }
-   else
-     {
-@@ -727,12 +733,12 @@ init_ldap_conn ()
-     }
- 
-   result = ldap_simple_bind_s (conn, binddn, bindpw);
-  ldap_result_check ("ldap_simple_bind_s", "LDAP Bind", result);
-+  ldap_result_check ("ldap_simple_bind_s", (char*)"LDAP Bind", result);
- }
- 
- /* Like isc_result_check, only for LDAP */
- void
-ldap_result_check (char *msg, char *dn, int err)
-+ldap_result_check (const char *msg, char *dn, int err)
- {
-   if ((err != LDAP_SUCCESS) && (err != LDAP_ALREADY_EXISTS))
-     {
-diff --git a/contrib/sdb/pgsql/pgsqldb.c b/contrib/sdb/pgsql/pgsqldb.c
-index 50d3cba..516eb9f 100644
--- a/contrib/sdb/pgsql/pgsqldb.c
-+++ b/contrib/sdb/pgsql/pgsqldb.c
-@@ -23,7 +23,7 @@
- #include <string.h>
- #include <stdlib.h>
- 
-#include <pgsql/libpq-fe.h>
-+#include <libpq-fe.h>
- 
- #include <isc/mem.h>
- #include <isc/print.h>
-diff --git a/contrib/sdb/pgsql/zonetodb.c b/contrib/sdb/pgsql/zonetodb.c
-index b8f5912..ff2d135 100644
--- a/contrib/sdb/pgsql/zonetodb.c
-+++ b/contrib/sdb/pgsql/zonetodb.c
-@@ -37,7 +37,7 @@
- #include <dns/rdatatype.h>
- #include <dns/result.h>
- 
-#include <pgsql/libpq-fe.h>
-+#include <libpq-fe.h>
- 
- /*
-  * Generate a PostgreSQL table from a zone.
-@@ -54,6 +54,9 @@ char *dbname, *dbtable;
- char str[10240];
- 
- void
-+closeandexit(int status);
-+
-+void
- closeandexit(int status) {
- 	if (conn != NULL)
- 		PQfinish(conn);
-@@ -61,6 +64,9 @@ closeandexit(int status) {
- }
- 
- void
-+check_result(isc_result_t result, const char *message);
-+
-+void
- check_result(isc_result_t result, const char *message) {
- 	if (result != ISC_R_SUCCESS) {
- 		fprintf(stderr, "%s: %s\n", message,
-@@ -84,7 +90,8 @@ quotestring(const unsigned char *source, unsigned char *dest) {
- 	}
- 	*dest++ = 0;
- }
-
-+void
-+addrdata(dns_name_t *name, dns_ttl_t ttl, dns_rdata_t *rdata);
- void
- addrdata(dns_name_t *name, dns_ttl_t ttl, dns_rdata_t *rdata) {
- 	unsigned char namearray[DNS_NAME_MAXTEXT + 1];
--- a/SOURCES/bind-9.5-PIE.patch
+++ b/SOURCES/bind-9.5-PIE.patch
@ -1,8 +1,10 @@
--- bind-9.5.0b2/bin/named/Makefile.in.pie	2008-02-11 17:21:47.000000000 +0100
-+++ bind-9.5.0b2/bin/named/Makefile.in	2008-02-11 17:22:10.000000000 +0100
-@@ -100,8 +100,12 @@ HTMLPAGES =	named.html lwresd.html named
- 
- MANOBJS =	${MANPAGES} ${HTMLPAGES}
+diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
+index eb622d1..37053a7 100644
+--- a/bin/named/Makefile.in
+++ b/bin/named/Makefile.in
+@@ -117,8 +117,12 @@ SRCS =		builtin.c config.c control.c \
+ 		tkeyconf.c tsigconf.c zoneconf.c \
+ 		${DLZDRIVER_SRCS} ${DBDRIVER_SRCS}
 
 +EXT_CFLAGS = -fpie
 +
@ -13,10 +15,11 @@
 main.@O@: main.c
 	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} \
 		-DVERSION=\"${VERSION}\" \
-diff -up bind-9.5.0b2/bin/named/unix/Makefile.in.pie bind-9.5.0b2/bin/named/unix/Makefile.in
--- bind-9.5.0b2/bin/named/unix/Makefile.in.pie	2008-02-11 17:22:21.000000000 +0100
-+++ bind-9.5.0b2/bin/named/unix/Makefile.in	2008-02-11 17:23:00.000000000 +0100
-@@ -19,6 +19,8 @@ srcdir =	@srcdir@
+diff --git a/bin/named/unix/Makefile.in b/bin/named/unix/Makefile.in
+index fd9ca8d..f1c102c 100644
+--- a/bin/named/unix/Makefile.in
+++ b/bin/named/unix/Makefile.in
+@@ -11,6 +11,8 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 
--- a/SOURCES/bind-9.9.1-P2-multlib-conflict.patch
+++ b/SOURCES/bind-9.9.1-P2-multlib-conflict.patch
@ -1,54 +0,0 @@
-diff --git a/config.h.in b/config.h.in
-index 4ecaa8f..2f65ccc 100644
--- a/config.h.in
-+++ b/config.h.in
-@@ -600,7 +600,7 @@ int sigwait(const unsigned int *set, int *sig);
- #undef PREFER_GOSTASN1
- 
- /* The size of `void *', as computed by sizeof. */
-#undef SIZEOF_VOID_P
-+/* #undef SIZEOF_VOID_P */
- 
- /* Define to 1 if you have the ANSI C header files. */
- #undef STDC_HEADERS
-diff --git a/isc-config.sh.in b/isc-config.sh.in
-index a8a0a89..b5e94ed 100644
--- a/isc-config.sh.in
-+++ b/isc-config.sh.in
-@@ -13,7 +13,18 @@ prefix=@prefix@
- exec_prefix=@exec_prefix@
- exec_prefix_set=
- includedir=@includedir@
-libdir=@libdir@
-+arch=$(uname -m)
-+
-+case $arch in
-+	x86_64 | amd64 | sparc64 | s390x | ppc64)
-+		libdir=/usr/lib64
-+		sec_libdir=/usr/lib
-+		;;
-+	* )
-+		libdir=/usr/lib
-+		sec_libdir=/usr/lib64
-+		;;
-+esac
- 
- usage()
- {
-@@ -132,6 +143,16 @@ if test x"$echo_libs" = x"true"; then
- 	if test x"${exec_prefix_set}" = x"true"; then
- 		libs="-L${exec_prefix}/lib"
- 	else
-+		if [ ! -x $libdir/libisc.so ] ; then
-+			if [ ! -x $sec_libdir/libisc.so ] ; then
-+				echo "Error: ISC libs not found in $libdir"
-+				if [ -d $sec_libdir ] ; then
-+					echo "Error: ISC libs not found in $sec_libdir"
-+				fi
-+				exit 1
-+			fi
-+			libdir=$sec_libdir
-+		fi
- 		libs="-L${libdir}"
- 	fi
- 	if test x"$libirs" = x"true" ; then
--- a/SOURCES/bind-95-rh452060.patch
+++ b/SOURCES/bind-95-rh452060.patch
@ -1,42 +0,0 @@
-diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
-index c06c804..e75b8b7 100644
--- a/bin/dig/dighost.c
-+++ b/bin/dig/dighost.c
-@@ -1816,6 +1816,13 @@ clear_query(dig_query_t *query) {
- 
- 	if (query->timer != NULL)
- 		isc_timer_detach(&query->timer);
-+
-+	if (query->waiting_senddone) {
-+		debug("send_done not yet called");
-+		query->pending_free = true;
-+		return;
-+	}
-+
- 	lookup = query->lookup;
- 
- 	if (lookup->current_query == query)
-@@ -1841,10 +1848,7 @@ clear_query(dig_query_t *query) {
- 	isc_mempool_put(commctx, query->recvspace);
- 	isc_buffer_invalidate(&query->recvbuf);
- 	isc_buffer_invalidate(&query->lengthbuf);
-	if (query->waiting_senddone)
-		query->pending_free = true;
-	else
-		isc_mem_free(mctx, query);
-+	isc_mem_free(mctx, query);
- }
- 
- /*%
-@@ -2895,9 +2899,9 @@ send_done(isc_task_t *_task, isc_event_t *event) {
- 	isc_event_free(&event);
- 
- 	if (query->pending_free)
-		isc_mem_free(mctx, query);
-+		clear_query(query);
- 
-	check_if_done();
-+	check_next_lookup(l);
- 	UNLOCK_LOOKUP;
- }
- 
--- a/Show More
+++ b/Show More