127 changed files with 17424 additions and 26333 deletions
--- a/.bind.metadata
+++ b/.bind.metadata
@ -1,2 +1 @@
-4b45d15edc1e3b7902129ce27baec58a50d76b5c SOURCES/bind-9.11.36.tar.gz
+a10542aaabad60bbbb8d19efd43591c98c01c277 SOURCES/bind-9.16.50.tar.xz
 a164fcad1d64d6b5fab5034928cb7260f1fa8fdd SOURCES/random.data
--- a/.gitignore
+++ b/.gitignore
@ -1,2 +1 @@
-SOURCES/bind-9.11.36.tar.gz
+SOURCES/bind-9.16.50.tar.xz
 SOURCES/random.data
--- a/SOURCES/README.sdb_pgsql
+++ b/SOURCES/README.sdb_pgsql
@ -1,79 +0,0 @@
 			PGSQL BIND SDB driver
 The postgresql BIND SDB driver is of experimental status and should not be 
 used for production systems.
 Usage:
 o Use the named_sdb process ( put ENABLE_SDB=yes in /etc/sysconfig/named )
 o Edit your named.conf to contain a database zone, eg. :
 zone "pgdb.net." IN {
        type master;
        database "pgsql  bind        pgdb     localhost pguser pgpasswd";
        #                ^- DB name  ^-Table  ^-host    ^-user ^-password
 };
 o Create the database zone table
  The table must contain the columns "name", "rdtype", and "rdata", and
  is expected to contain a properly constructed zone.  The program "zonetodb"
  creates such a table.
  zonetodb usage:
    zonetodb origin file dbname dbtable
    where
 	origin : zone origin, eg "pgdb.net."
 	file   : master zone database file, eg. pgdb.net.db
 	dbname : name of postgresql database 
        dbtable: name of table in database
    Eg. to import this zone in the file 'pgdb.net.db' into the 'bind' database 
        'pgdb' table:
 ---
 #pgdb.net.db:
 $TTL 1H
@       SOA     localhost.      root.localhost. (       1
                                                3H
                                                1H
                                                1W
                                                1H )
        NS      localhost.
 host1   A       192.168.2.1
 host2   A       192.168.2.2
 host3   A       192.168.2.3
 host4   A       192.168.2.4
 host5   A       192.168.2.5
 host6   A       192.168.2.6
 host7   A       192.168.2.7
 ---
 Issue this command as the pgsql user authorized to update the bind database:
 # zonetodb pgdb.net. pgdb.net.db bind pgdb
 will create / update the pgdb table in the 'bind' db:
 $ psql -dbind -c 'select * from pgdb;'
      name      | ttl  | rdtype |                        rdata
 ----------------+------+--------+-----------------------------------------------------
 pgdb.net       | 3600 | SOA    | localhost. root.localhost. 1 10800 3600 604800 3600
 pgdb.net       | 3600 | NS     | localhost.
 host1.pgdb.net | 3600 | A      | 192.168.2.1
 host2.pgdb.net | 3600 | A      | 192.168.2.2
 host3.pgdb.net | 3600 | A      | 192.168.2.3
 host4.pgdb.net | 3600 | A      | 192.168.2.4
 host5.pgdb.net | 3600 | A      | 192.168.2.5
 host6.pgdb.net | 3600 | A      | 192.168.2.6
 host7.pgdb.net | 3600 | A      | 192.168.2.7
 (9 rows)
 I've tested exactly the above configuration with bind-sdb-9.3.1+ and it works OK.
 NOTE: If you use pgsqldb SDB, ensure the postgresql service is started before the named
      service .
 USE AT YOUR OWN RISK!
--- a/SOURCES/bind-9.10-dist-native-pkcs11.patch
+++ b/SOURCES/bind-9.10-dist-native-pkcs11.patch
@ -1,68 +1,107 @@
 From 040227009453b3f0aa7914c7a6a94dc57ad5269b Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Thu, 21 Jan 2021 10:46:20 +0100
 Subject: [PATCH] Enable custom pkcs11 native build
 Share common parts like libisc, libcc and others. But provide native
 pkcs11 libraries as a new copy of libdns and libns.
 ---
 bin/Makefile.in                  |  2 +-
 bin/confgen/Makefile.in          |  2 +-
 bin/dnssec-pkcs11/Makefile.in    | 39 +++++++++++++++++---------------
 bin/named-pkcs11/Makefile.in     | 33 ++++++++++++++-------------
 configure.ac                     | 19 ++++++++++++++++
 lib/Makefile.in                  |  2 +-
 lib/dns-pkcs11/Makefile.in       | 22 +++++++++---------
 lib/dns-pkcs11/tests/Makefile.in |  8 +++----
 lib/ns-pkcs11/Makefile.in        | 26 ++++++++++-----------
 lib/ns-pkcs11/tests/Makefile.in  | 12 +++++-----
 make/includes.in                 |  7 ++++++
 11 files changed, 101 insertions(+), 71 deletions(-)
 diff --git a/bin/Makefile.in b/bin/Makefile.in
-index a18b222..26a7e4e 100644
+index 9ad7f62..094775a 100644
 --- a/bin/Makefile.in
 +++ b/bin/Makefile.in
-@@ -11,8 +11,8 @@ srcdir =	@srcdir@
+@@ -11,7 +11,7 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 -SUBDIRS =	named rndc dig delv dnssec tools nsupdate check confgen \
-		@NZD_TOOLS@ @PYTHON_TOOLS@ @PKCS11_TOOLS@ tests
+SUBDIRS =	named named-pkcs11 rndc dig delv dnssec dnssec-pkcs11 tools nsupdate check confgen \
-+SUBDIRS =	named named-pkcs11 rndc dig delv dnssec dnssec-pkcs11 tools nsupdate \
+ 		@NZD_TOOLS@ @PYTHON_TOOLS@ @PKCS11_TOOLS@ plugins tests
 +		check confgen @NZD_TOOLS@ @PYTHON_TOOLS@ @PKCS11_TOOLS@ tests
 TARGETS =
- @BIND9_MAKE_RULES@
+diff --git a/bin/confgen/Makefile.in b/bin/confgen/Makefile.in
 index c126bf3..1b7512d 100644
 --- a/bin/confgen/Makefile.in
 +++ b/bin/confgen/Makefile.in
@@ -22,7 +22,7 @@ VERSION=@BIND9_VERSION@
 CINCLUDES = -I${srcdir}/include ${ISC_INCLUDES} ${ISCCC_INCLUDES} \
 	${ISCCFG_INCLUDES} ${DNS_INCLUDES} ${BIND9_INCLUDES}
 -CDEFINES = @USE_PKCS11@
 +CDEFINES =
 CWARNINGS =
 ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
 diff --git a/bin/dnssec-pkcs11/Makefile.in b/bin/dnssec-pkcs11/Makefile.in
-index 390aa0c..e59a118 100644
+index ace0e5a..e0f6a00 100644
 --- a/bin/dnssec-pkcs11/Makefile.in
 +++ b/bin/dnssec-pkcs11/Makefile.in
@@ -15,18 +15,18 @@ VERSION=@BIND9_VERSION@
 @BIND9_MAKE_INCLUDES@
-CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} @DST_OPENSSL_INC@
+-CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} ${ISCCFG_INCLUDES} \
-+CINCLUDES =	${DNS_PKCS11_INCLUDES} ${ISC_PKCS11_INCLUDES}
+CINCLUDES =	${DNS_PKCS11_INCLUDES} ${ISC_INCLUDES} ${ISCCFG_INCLUDES} \
 		${OPENSSL_CFLAGS}
-CDEFINES =	-DVERSION=\"${VERSION}\" @USE_PKCS11@ @PKCS11_ENGINE@ \
+-CDEFINES =	-DVERSION=\"${VERSION}\" -DNAMED_CONFFILE=\"${sysconfdir}/named.conf\"
-		@CRYPTO@ -DPK11_LIB_LOCATION=\"@PKCS11_PROVIDER@\"
+CDEFINES =	-DVERSION=\"${VERSION}\" -DNAMED_CONFFILE=\"${sysconfdir}/named.conf\" -DUSE_PKCS11=1
 +CDEFINES =	-DVERSION=\"${VERSION}\" @PKCS11_ENGINE@ \
 +		@CRYPTO_PK11@ -DPK11_LIB_LOCATION=\"@PKCS11_PROVIDER@\"
 CWARNINGS =
-DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
+-DNSLIBS =	../../lib/dns/libdns.@A@ @NO_LIBTOOL_DNSLIBS@
-ISCLIBS =	../../lib/isc/libisc.@A@
+DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ @NO_LIBTOOL_DNSLIBS@
-ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@
+ ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
-+DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
+ ISCLIBS =	../../lib/isc/libisc.@A@ @NO_LIBTOOL_ISCLIBS@
-+ISCLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
+ ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @NO_LIBTOOL_ISCLIBS@
 +ISCNOSYMLIBS =	../../lib/isc-pkcs11/libisc-pkcs11-nosymtbl.@A@
 -DNSDEPLIBS =	../../lib/dns/libdns.@A@
 -ISCDEPLIBS =	../../lib/isc/libisc.@A@
 +DNSDEPLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@
-+ISCDEPLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
+ ISCDEPLIBS =	../../lib/isc/libisc.@A@
 ISCCFGDEPLIBS =	../../lib/isccfg/libisccfg.@A@
- DEPLIBS =	${DNSDEPLIBS} ${ISCDEPLIBS}
+@@ -36,12 +36,15 @@ LIBS =		${DNSLIBS} ${ISCCFGLIBS} ${ISCLIBS} @LIBS@
-@@ -35,10 +35,10 @@ LIBS =		${DNSLIBS} ${ISCLIBS} @LIBS@
+ NOSYMLIBS =	${DNSLIBS} ${ISCCFGLIBS} ${ISCNOSYMLIBS} @LIBS@
 NOSYMLIBS =	${DNSLIBS} ${ISCNOSYMLIBS} @LIBS@
 +# Add suffix to all targets
 +EXEEXT =	-pkcs11@EXEEXT@
 +
 # Alphabetically
-TARGETS =	dnssec-keygen@EXEEXT@ dnssec-signzone@EXEEXT@ \
+-TARGETS =	dnssec-cds@EXEEXT@ dnssec-dsfromkey@EXEEXT@ \
-		dnssec-keyfromlabel@EXEEXT@ dnssec-dsfromkey@EXEEXT@ \
+-		dnssec-importkey@EXEEXT@ dnssec-keyfromlabel@EXEEXT@ \
-		dnssec-revoke@EXEEXT@ dnssec-settime@EXEEXT@ \
+-		dnssec-keygen@EXEEXT@ dnssec-revoke@EXEEXT@ \
-		dnssec-verify@EXEEXT@ dnssec-importkey@EXEEXT@
+-		dnssec-settime@EXEEXT@ dnssec-signzone@EXEEXT@ \
-+TARGETS =	dnssec-keygen-pkcs11@EXEEXT@ dnssec-signzone-pkcs11@EXEEXT@ \
+-		dnssec-verify@EXEEXT@
-+		dnssec-keyfromlabel-pkcs11@EXEEXT@ dnssec-dsfromkey-pkcs11@EXEEXT@ \
+TARGETS =	dnssec-cds${EXEEXT} dnssec-dsfromkey${EXEEXT} \
-+		dnssec-revoke-pkcs11@EXEEXT@ dnssec-settime-pkcs11@EXEEXT@ \
+		dnssec-importkey${EXEEXT} dnssec-keyfromlabel${EXEEXT} \
-+		dnssec-verify-pkcs11@EXEEXT@ dnssec-importkey-pkcs11@EXEEXT@
+		dnssec-keygen${EXEEXT} dnssec-revoke${EXEEXT} \
 +		dnssec-settime${EXEEXT} dnssec-signzone${EXEEXT} \
 +		dnssec-verify${EXEEXT}
 OBJS =		dnssectool.@O@
-@@ -59,15 +59,15 @@ MANOBJS =	${MANPAGES} ${HTMLPAGES}
+@@ -52,19 +55,19 @@ SRCS =		dnssec-cds.c dnssec-dsfromkey.c dnssec-importkey.c \
 @BIND9_MAKE_RULES@
 -dnssec-cds@EXEEXT@: dnssec-cds.@O@ ${OBJS} ${DEPLIBS}
 +dnssec-cds-pkcs11@EXEEXT@: dnssec-cds.@O@ ${OBJS} ${DEPLIBS}
 	export BASEOBJS="dnssec-cds.@O@ ${OBJS}"; \
 	${FINALBUILDCMD}
 -dnssec-dsfromkey@EXEEXT@: dnssec-dsfromkey.@O@ ${OBJS} ${DEPLIBS}
 +dnssec-dsfromkey-pkcs11@EXEEXT@: dnssec-dsfromkey.@O@ ${OBJS} ${DEPLIBS}
 	export BASEOBJS="dnssec-dsfromkey.@O@ ${OBJS}"; \
@ -78,7 +117,7 @@ index 390aa0c..e59a118 100644
 	export BASEOBJS="dnssec-keygen.@O@ ${OBJS}"; \
 	${FINALBUILDCMD}
-@@ -75,7 +75,7 @@ dnssec-signzone.@O@: dnssec-signzone.c
+@@ -72,7 +75,7 @@ dnssec-signzone.@O@: dnssec-signzone.c
 	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} -DVERSION=\"${VERSION}\" \
 		-c ${srcdir}/dnssec-signzone.c
@ -87,7 +126,7 @@ index 390aa0c..e59a118 100644
 	export BASEOBJS="dnssec-signzone.@O@ ${OBJS}"; \
 	${FINALBUILDCMD}
-@@ -83,19 +83,19 @@ dnssec-verify.@O@: dnssec-verify.c
+@@ -80,19 +83,19 @@ dnssec-verify.@O@: dnssec-verify.c
 	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} -DVERSION=\"${VERSION}\" \
 		-c ${srcdir}/dnssec-verify.c
@ -111,117 +150,70 @@ index 390aa0c..e59a118 100644
 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \
 	dnssec-importkey.@O@ ${OBJS} ${LIBS}
@@ -106,16 +106,14 @@ docclean manclean maintainer-clean::
 installdirs:
 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
 -	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
 install-man8: ${MANPAGES}
 	${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man8
 -install:: ${TARGETS} installdirs install-man8
 +install:: ${TARGETS} installdirs
 	for t in ${TARGETS}; do ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} $$t ${DESTDIR}${sbindir} || exit 1; done
 uninstall::
 -	for m in ${MANPAGES}; do rm -f ${DESTDIR}${mandir}/man8/$$m || exit 1; done
 	for t in ${TARGETS}; do ${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/$$t || exit 1; done
 clean distclean::
 diff --git a/bin/dnssec/Makefile.in b/bin/dnssec/Makefile.in
 index 390aa0c..851a008 100644
 --- a/bin/dnssec/Makefile.in
 +++ b/bin/dnssec/Makefile.in
@@ -17,7 +17,7 @@ VERSION=@BIND9_VERSION@
 CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} @DST_OPENSSL_INC@
 -CDEFINES =	-DVERSION=\"${VERSION}\" @USE_PKCS11@ @PKCS11_ENGINE@ \
 +CDEFINES =	-DVERSION=\"${VERSION}\" \
 		@CRYPTO@ -DPK11_LIB_LOCATION=\"@PKCS11_PROVIDER@\"
 CWARNINGS =
 diff --git a/bin/named-pkcs11/Makefile.in b/bin/named-pkcs11/Makefile.in
-index 277a0f5..52a6375 100644
+index 98125dd..518a75f 100644
 --- a/bin/named-pkcs11/Makefile.in
 +++ b/bin/named-pkcs11/Makefile.in
-@@ -43,27 +43,27 @@ DLZDRIVER_INCLUDES =	@DLZ_DRIVER_INCLUDES@
+@@ -37,13 +37,14 @@ DBDRIVER_LIBS =
- DLZDRIVER_LIBS =	@DLZ_DRIVER_LIBS@
+ 
 DLZ_DRIVER_DIR =	${top_srcdir}/contrib/dlz/drivers
 -DLZDRIVER_OBJS =	@DLZ_DRIVER_OBJS@
 -DLZDRIVER_SRCS =	@DLZ_DRIVER_SRCS@
 -DLZDRIVER_INCLUDES =	@DLZ_DRIVER_INCLUDES@
 -DLZDRIVER_LIBS =	@DLZ_DRIVER_LIBS@
 +# Skip building on PKCS11 variant
 +DLZDRIVER_OBJS =
 +DLZDRIVER_SRCS =
 +DLZDRIVER_INCLUDES =
 +DLZDRIVER_LIBS =
 CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
-		${LWRES_INCLUDES} ${DNS_INCLUDES} ${BIND9_INCLUDES} \
+-		${NS_INCLUDES} ${DNS_INCLUDES} \
-		${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} ${ISC_INCLUDES} \
+		${NS_PKCS11_INCLUDES} ${DNS_PKCS11_INCLUDES} \
-+		${LWRES_INCLUDES} ${DNS_PKCS11_INCLUDES} ${BIND9_INCLUDES} \
+ 		${BIND9_INCLUDES} ${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} \
-+		${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} ${ISC_PKCS11_INCLUDES} \
+ 		${ISC_INCLUDES} ${DLZDRIVER_INCLUDES} \
- 		${DLZDRIVER_INCLUDES} ${DBDRIVER_INCLUDES} ${MAXMINDDB_CFLAGS} \
+ 		${DBDRIVER_INCLUDES} \
- 		@DST_OPENSSL_INC@
+@@ -56,24 +57,24 @@ CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
 		${LIBXML2_CFLAGS} \
 		${MAXMINDDB_CFLAGS}
-CDEFINES =      @CONTRIB_DLZ@ @USE_PKCS11@ @PKCS11_ENGINE@ @CRYPTO@
+-CDEFINES =      @CONTRIB_DLZ@
-+CDEFINES =      @USE_PKCS11@ @PKCS11_ENGINE@ @CRYPTO_PK11@ @USE_GSSAPI@
+CDEFINES =
 CWARNINGS =
-DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
+-DNSLIBS =	../../lib/dns/libdns.@A@ @NO_LIBTOOL_DNSLIBS@
-+DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
+DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ @NO_LIBTOOL_DNSLIBS@
 ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
 ISCCCLIBS =	../../lib/isccc/libisccc.@A@
-ISCLIBS =	../../lib/isc/libisc.@A@
+ ISCLIBS =	../../lib/isc/libisc.@A@ @NO_LIBTOOL_ISCLIBS@
-ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@
+ ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @NO_LIBTOOL_ISCLIBS@
 +ISCLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
 +ISCNOSYMLIBS =	../../lib/isc-pkcs11/libisc-pkcs11-nosymtbl.@A@
 LWRESLIBS =	../../lib/lwres/liblwres.@A@
 BIND9LIBS =	../../lib/bind9/libbind9.@A@
 -NSLIBS =	../../lib/ns/libns.@A@
 +NSLIBS =	../../lib/ns-pkcs11/libns-pkcs11.@A@
 -DNSDEPLIBS =	../../lib/dns/libdns.@A@
 +DNSDEPLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@
 ISCCFGDEPLIBS =	../../lib/isccfg/libisccfg.@A@
 ISCCCDEPLIBS =	../../lib/isccc/libisccc.@A@
-ISCDEPLIBS =	../../lib/isc/libisc.@A@
+ ISCDEPLIBS =	../../lib/isc/libisc.@A@
 +ISCDEPLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
 LWRESDEPLIBS =	../../lib/lwres/liblwres.@A@
 BIND9DEPLIBS =	../../lib/bind9/libbind9.@A@
 -NSDEPLIBS =	../../lib/ns/libns.@A@
 +NSDEPLIBS =	../../lib/ns-pkcs11/libns-pkcs11.@A@
-@@ -72,15 +72,15 @@ DEPLIBS =	${LWRESDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
+ DEPLIBS =	${NSDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
- 
+ 		${ISCCFGDEPLIBS} ${ISCCCDEPLIBS} ${ISCDEPLIBS}
- LIBS =		${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
+@@ -93,7 +94,7 @@ NOSYMLIBS =	${NSLIBS} ${DNSLIBS} ${BIND9LIBS} \
 		${ISCCFGLIBS} ${ISCCCLIBS} ${ISCLIBS} \
 -		${DLZDRIVER_LIBS} ${DBDRIVER_LIBS} @LIBS@
 +		@LIBS@
 NOSYMLIBS =	${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
 		${ISCCFGLIBS} ${ISCCCLIBS} ${ISCNOSYMLIBS} \
 -		${DLZDRIVER_LIBS} ${DBDRIVER_LIBS} @LIBS@
 +		@LIBS@
 SUBDIRS =	unix
-TARGETS =	named@EXEEXT@ lwresd@EXEEXT@
+-TARGETS =	named@EXEEXT@ feature-test@EXEEXT@
-+TARGETS =	named-pkcs11@EXEEXT@
+TARGETS =	named-pkcs11@EXEEXT@ feature-test-pkcs11@EXEEXT@
 GEOIPLINKOBJS = geoip.@O@
 GEOIP2LINKOBJS = geoip.@O@
@@ -94,8 +94,7 @@ OBJS =		builtin.@O@ client.@O@ config.@O@ control.@O@ \
 		tkeyconf.@O@ tsigconf.@O@ update.@O@ xfrout.@O@ \
 		zoneconf.@O@ \
 		lwaddr.@O@ lwresd.@O@ lwdclient.@O@ lwderror.@O@ lwdgabn.@O@ \
 -		lwdgnba.@O@ lwdgrbn.@O@ lwdnoop.@O@ lwsearch.@O@ \
 -		${DLZDRIVER_OBJS} ${DBDRIVER_OBJS}
 +        lwdgnba.@O@ lwdgrbn.@O@ lwdnoop.@O@ lwsearch.@O@
- UOBJS =		unix/os.@O@ unix/dlz_dlopen_driver.@O@
+@@ -151,7 +152,7 @@ server.@O@: server.c
@@ -113,8 +112,7 @@ SRCS =		builtin.c client.c config.c control.c \
 		tkeyconf.c tsigconf.c update.c xfrout.c \
 		zoneconf.c \
 		lwaddr.c lwresd.c lwdclient.c lwderror.c lwdgabn.c \
 -		lwdgnba.c lwdgrbn.c lwdnoop.c lwsearch.c \
 -		${DLZDRIVER_SRCS} ${DBDRIVER_SRCS}
 +        lwdgnba.c lwdgrbn.c lwdnoop.c lwsearch.c
 MANPAGES =	named.8 lwresd.8 named.conf.5
@@ -154,14 +152,14 @@ server.@O@: server.c
 		-DPRODUCT=\"${PRODUCT}\" \
 		-DVERSION=\"${VERSION}\" -c ${srcdir}/server.c
@ -230,77 +222,38 @@ index 277a0f5..52a6375 100644
 	export MAKE_SYMTABLE="yes"; \
 	export BASEOBJS="${OBJS} ${UOBJS}"; \
 	${FINALBUILDCMD}
@@ -161,7 +162,7 @@ feature-test.@O@: ${top_srcdir}/bin/tests/system/feature-test.c
 	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} \
 		-c ${top_srcdir}/bin/tests/system/feature-test.c
-lwresd@EXEEXT@: named@EXEEXT@
+-feature-test@EXEEXT@: feature-test.@O@
-+lwresd@EXEEXT@: named-pkcs11@EXEEXT@
+feature-test-pkcs11@EXEEXT@: feature-test.@O@
- 	rm -f lwresd@EXEEXT@
+ 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} \
-	@LN@ named@EXEEXT@ lwresd@EXEEXT@
+ 		-o $@ feature-test.@O@ ${ISCLIBS} ${LIBS}
 +	@LN@ named-pkcs11@EXEEXT@ lwresd@EXEEXT@
- doc man:: ${MANOBJS}
+@@ -180,11 +181,11 @@ statschannel.@O@: bind9.xsl.h
 installdirs:
 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
-@@ -192,16 +190,11 @@ install-man8: named.8 lwresd.8
+-install:: named@EXEEXT@ installdirs
 install-man: install-man5 install-man8
 -install:: named@EXEEXT@ lwresd@EXEEXT@ installdirs install-man
 -	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named@EXEEXT@ ${DESTDIR}${sbindir}
 -	(cd ${DESTDIR}${sbindir}; rm -f lwresd@EXEEXT@; @LN@ named@EXEEXT@ lwresd@EXEEXT@)
 +install:: named-pkcs11@EXEEXT@ installdirs
 +	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named-pkcs11@EXEEXT@ ${DESTDIR}${sbindir}
 uninstall::
 -	rm -f ${DESTDIR}${mandir}/man5/named.conf.5
 -	rm -f ${DESTDIR}${mandir}/man8/lwresd.8
 -	rm -f ${DESTDIR}${mandir}/man8/named.8
 -	rm -f ${DESTDIR}${sbindir}/lwresd@EXEEXT@
 -	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/named@EXEEXT@
 +	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/named-pkcs11@EXEEXT@
 @DLZ_DRIVER_RULES@
 diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
 index 277a0f5..0e00885 100644
 --- a/bin/named/Makefile.in
 +++ b/bin/named/Makefile.in
@@ -48,7 +48,7 @@ CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
 		${DLZDRIVER_INCLUDES} ${DBDRIVER_INCLUDES} ${MAXMINDDB_CFLAGS} \
 		@DST_OPENSSL_INC@
 -CDEFINES =      @CONTRIB_DLZ@ @USE_PKCS11@ @PKCS11_ENGINE@ @CRYPTO@
 +CDEFINES =      @CONTRIB_DLZ@ @USE_GSSAPI@ @CRYPTO@
 CWARNINGS =
 diff --git a/bin/pkcs11/Makefile.in b/bin/pkcs11/Makefile.in
 index 2c19e7e..8223d5e 100644
 --- a/bin/pkcs11/Makefile.in
 +++ b/bin/pkcs11/Makefile.in
@@ -13,13 +13,13 @@ top_srcdir =	@top_srcdir@
 @BIND9_MAKE_INCLUDES@
 -CINCLUDES =	${ISC_INCLUDES}
 +CINCLUDES =	${ISC_PKCS11_INCLUDES}
 CDEFINES =
 -ISCLIBS =	../../lib/isc/libisc.@A@ @ISC_OPENSSL_LIBS@
 +ISCLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@ @ISC_OPENSSL_LIBS@
 -ISCDEPLIBS =	../../lib/isc/libisc.@A@
 +ISCDEPLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
 DEPLIBS =	${ISCDEPLIBS}
 diff --git a/configure.ac b/configure.ac
-index 83cad4a..e1e1a32 100644
+index 032228b..64e3da0 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -1178,12 +1178,14 @@ AC_SUBST(USE_GSSAPI)
+@@ -1251,12 +1251,14 @@ AC_SUBST(USE_GSSAPI)
 AC_SUBST(DST_GSSAPI_INC)
 AC_SUBST(DNS_GSSAPI_LIBS)
- DNS_CRYPTO_LIBS="$DNS_GSSAPI_LIBS $DNS_CRYPTO_LIBS"
+ DNS_CRYPTO_LIBS="$DNS_GSSAPI_LIBS"
 +DNS_CRYPTO_PK11_LIBS="$DNS_GSSAPI_LIBS $DNS_CRYPTO_PK11_LIBS"
 #
@ -311,86 +264,35 @@ index 83cad4a..e1e1a32 100644
 +AC_SUBST(DNS_CRYPTO_PK11_LIBS)
 #
- # was --with-randomdev specified?
+ # was --with-lmdb specified?
-@@ -1556,12 +1558,12 @@ AC_ARG_ENABLE(openssl-hash,
+@@ -2327,6 +2329,8 @@ AC_SUBST(BIND9_DNS_BUILDINCLUDE)
- AC_MSG_CHECKING(for OpenSSL library)
+ AC_SUBST(BIND9_NS_BUILDINCLUDE)
- OPENSSL_WARNING=
+ AC_SUBST(BIND9_BIND9_BUILDINCLUDE)
- openssldirs="/usr /usr/local /usr/local/ssl /opt/local /usr/pkg /usr/sfw"
+ AC_SUBST(BIND9_IRS_BUILDINCLUDE)
-if test "yes" = "$want_native_pkcs11"
+AC_SUBST(BIND9_DNS_PKCS11_BUILDINCLUDE)
-then
+AC_SUBST(BIND9_NS_PKCS11_BUILDINCLUDE)
-	use_openssl="native_pkcs11"
+ if test "X$srcdir" != "X"; then
-	want_openssl_hash="no"
+ 	BIND9_ISC_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/isc/include"
-	AC_MSG_RESULT(use of native PKCS11 instead)
+ 	BIND9_ISCCC_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/isccc/include"
-fi
+@@ -2335,6 +2339,8 @@ if test "X$srcdir" != "X"; then
-+#if test "yes" = "$want_native_pkcs11"
+ 	BIND9_NS_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/ns/include"
-+#then
+ 	BIND9_BIND9_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/bind9/include"
-+#	use_openssl="native_pkcs11"
+ 	BIND9_IRS_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/irs/include"
-+#	want_openssl_hash="no"
+	BIND9_DNS_PKCS11_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/dns-pkcs11/include"
-+#	AC_MSG_RESULT(use of native PKCS11 instead)
+	BIND9_NS_PKCS11_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/ns-pkcs11/include"
-+#fi
+ else
- 
+ 	BIND9_ISC_BUILDINCLUDE=""
- if test "auto" = "$use_openssl"
+ 	BIND9_ISCCC_BUILDINCLUDE=""
- then
+@@ -2343,6 +2349,8 @@ else
-@@ -1574,6 +1576,7 @@ then
+ 	BIND9_NS_BUILDINCLUDE=""
 	BIND9_BIND9_BUILDINCLUDE=""
 	BIND9_IRS_BUILDINCLUDE=""
 +	BIND9_DNS_PKCS11_BUILDINCLUDE=""
 +	BIND9_NS_PKCS11_BUILDINCLUDE=""
 fi
 	done
 fi
 +CRYPTO_PK11=""
 OPENSSL_ECDSA=""
 OPENSSL_GOST=""
 OPENSSL_ED25519=""
@@ -1595,11 +1598,10 @@ case "$with_gost" in
 		;;
 esac
-case "$use_openssl" in
+ AC_SUBST_FILE(BIND9_MAKE_INCLUDES)
-	native_pkcs11)
+@@ -2798,8 +2806,11 @@ AC_CONFIG_FILES([
 -		AC_MSG_RESULT(disabled because of native PKCS11)
 +if test "$want_native_pkcs11" = "yes"
 +then
 		DST_OPENSSL_INC=""
 -		CRYPTO="-DPKCS11CRYPTO"
 +		CRYPTO_PK11="-DPKCS11CRYPTO"
 		CRYPTOLIB="pkcs11"
 		OPENSSLECDSALINKOBJS=""
 		OPENSSLECDSALINKSRCS=""
@@ -1609,7 +1611,9 @@ case "$use_openssl" in
 		OPENSSLGOSTLINKSRCS=""
 		OPENSSLLINKOBJS=""
 		OPENSSLLINKSRCS=""
 -		;;
 +fi
 +
 +case "$use_openssl" in
 	no)
 		AC_MSG_RESULT(no)
 		DST_OPENSSL_INC=""
@@ -1641,7 +1645,7 @@ case "$use_openssl" in
 If you do not want OpenSSL, use --without-openssl])
 		;;
 	*)
 -		if test "yes" = "$want_native_pkcs11"
 +		if false # test "yes" = "$want_native_pkcs11"
 		then
 			AC_MSG_RESULT()
 			AC_MSG_ERROR([OpenSSL and native PKCS11 cannot be used together.])
@@ -2077,6 +2081,7 @@ AC_SUBST(OPENSSL_ED25519)
 AC_SUBST(OPENSSL_GOST)
 DNS_CRYPTO_LIBS="$DNS_CRYPTO_LIBS $DST_OPENSSL_LIBS"
 +DNS_CRYPTO_PK11_LIBS="$DNS_CRYPTO_LIBS"
 ISC_PLATFORM_WANTAES="#undef ISC_PLATFORM_WANTAES"
 if test "yes" = "$with_aes"
@@ -2363,6 +2368,7 @@ esac
 AC_SUBST(PKCS11LINKOBJS)
 AC_SUBST(PKCS11LINKSRCS)
 AC_SUBST(CRYPTO)
 +AC_SUBST(CRYPTO_PK11)
 AC_SUBST(PKCS11_ECDSA)
 AC_SUBST(PKCS11_GOST)
 AC_SUBST(PKCS11_ED25519)
@@ -5491,8 +5497,11 @@ AC_CONFIG_FILES([
 	bin/delv/Makefile
 	bin/dig/Makefile
 	bin/dnssec/Makefile
@ -401,8 +303,8 @@ index 83cad4a..e1e1a32 100644
 +	bin/named-pkcs11/unix/Makefile
 	bin/nsupdate/Makefile
 	bin/pkcs11/Makefile
- 	bin/python/Makefile
+ 	bin/plugins/Makefile
-@@ -5565,6 +5574,10 @@ AC_CONFIG_FILES([
+@@ -2861,6 +2872,10 @@ AC_CONFIG_FILES([
 	lib/dns/include/dns/Makefile
 	lib/dns/include/dst/Makefile
 	lib/dns/tests/Makefile
@ -413,73 +315,54 @@ index 83cad4a..e1e1a32 100644
 	lib/irs/Makefile
 	lib/irs/include/Makefile
 	lib/irs/include/irs/Makefile
-@@ -5589,6 +5602,24 @@ AC_CONFIG_FILES([
+@@ -2893,6 +2908,10 @@ AC_CONFIG_FILES([
- 	lib/isc/unix/include/Makefile
+ 	lib/ns/include/Makefile
- 	lib/isc/unix/include/isc/Makefile
+ 	lib/ns/include/ns/Makefile
- 	lib/isc/unix/include/pkcs11/Makefile
+ 	lib/ns/tests/Makefile
-+	lib/isc-pkcs11/$arch/Makefile
+	lib/ns-pkcs11/Makefile
-+	lib/isc-pkcs11/$arch/include/Makefile
+	lib/ns-pkcs11/include/Makefile
-+	lib/isc-pkcs11/$arch/include/isc/Makefile
+	lib/ns-pkcs11/include/ns/Makefile
-+	lib/isc-pkcs11/$thread_dir/Makefile
+	lib/ns-pkcs11/tests/Makefile
-+	lib/isc-pkcs11/$thread_dir/include/Makefile
+ 	make/Makefile
-+	lib/isc-pkcs11/$thread_dir/include/isc/Makefile
+ 	make/mkdep
-+	lib/isc-pkcs11/Makefile
+ 	unit/unittest.sh
 +	lib/isc-pkcs11/include/Makefile
 +	lib/isc-pkcs11/include/isc/Makefile
 +	lib/isc-pkcs11/include/isc/platform.h
 +	lib/isc-pkcs11/include/pk11/Makefile
 +	lib/isc-pkcs11/include/pkcs11/Makefile
 +	lib/isc-pkcs11/tests/Makefile
 +	lib/isc-pkcs11/nls/Makefile
 +	lib/isc-pkcs11/unix/Makefile
 +	lib/isc-pkcs11/unix/include/Makefile
 +	lib/isc-pkcs11/unix/include/isc/Makefile
 +	lib/isc-pkcs11/unix/include/pkcs11/Makefile
 	lib/isccc/Makefile
 	lib/isccc/include/Makefile
 	lib/isccc/include/isccc/Makefile
 diff --git a/lib/Makefile.in b/lib/Makefile.in
-index f089bea..3ed939b 100644
+index 833964e..058ba2f 100644
 --- a/lib/Makefile.in
 +++ b/lib/Makefile.in
@@ -15,7 +15,7 @@ top_srcdir =	@top_srcdir@
 # Attempt to disable parallel processing.
 .NOTPARALLEL:
 .NO_PARALLEL:
-SUBDIRS =	isc isccc dns isccfg bind9 lwres irs samples
+-SUBDIRS =	isc isccc dns ns isccfg bind9 irs
-+SUBDIRS =	isc isc-pkcs11 isccc dns dns-pkcs11 isccfg bind9 lwres irs samples
+SUBDIRS =	isc isccc dns dns-pkcs11 ns ns-pkcs11 isccfg bind9 irs
 TARGETS =
 @BIND9_MAKE_RULES@
 diff --git a/lib/dns-pkcs11/Makefile.in b/lib/dns-pkcs11/Makefile.in
-index 1d0f5df..98c9ba0 100644
+index 58bda3c..d6a45df 100644
 --- a/lib/dns-pkcs11/Makefile.in
 +++ b/lib/dns-pkcs11/Makefile.in
-@@ -24,17 +24,17 @@ VERSION=@BIND9_VERSION@
+@@ -22,7 +22,7 @@ VERSION=@BIND9_VERSION@
 @BIND9_MAKE_INCLUDES@
 -CINCLUDES =	-I. -I${top_srcdir}/lib/dns -Iinclude ${DNS_INCLUDES} \
 -		${ISC_INCLUDES} ${MAXMINDDB_CFLAGS} \
 +CINCLUDES =	-I. -I${top_srcdir}/lib/dns-pkcs11 -Iinclude ${DNS_PKCS11_INCLUDES} \
-+		${ISC_PKCS11_INCLUDES} ${MAXMINDDB_CFLAGS} \
+ 		${ISC_INCLUDES} \
- 		@DST_OPENSSL_INC@ @DST_GSSAPI_INC@
+ 		${FSTRM_CFLAGS} \
 		${OPENSSL_CFLAGS} @DST_GSSAPI_INC@ \
@@ -32,7 +32,7 @@ CINCLUDES =	-I. -I${top_srcdir}/lib/dns -Iinclude ${DNS_INCLUDES} \
 		${LMDB_CFLAGS} \
 		${MAXMINDDB_CFLAGS}
-CDEFINES =	-DUSE_MD5 @CRYPTO@ @USE_GSSAPI@
+-CDEFINES =	@USE_GSSAPI@
-+CDEFINES =	-DUSE_MD5 @CRYPTO_PK11@ @USE_GSSAPI@
+CDEFINES =	@USE_GSSAPI@ @USE_PKCS11@
 CWARNINGS =
-ISCLIBS =	../../lib/isc/libisc.@A@
+@@ -135,15 +135,15 @@ version.@O@: version.c
-+ISCLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
+ 		-DMAPAPI=\"${MAPAPI}\" \
 -ISCDEPLIBS =	../../lib/isc/libisc.@A@
 +ISCDEPLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
 LIBS =		${MAXMINDDB_LIBS} @LIBS@
@@ -148,15 +148,15 @@ version.@O@: version.c
 		-DLIBAGE=${LIBAGE} \
 		-c ${srcdir}/version.c
 -libdns.@SA@: ${OBJS}
@ -492,13 +375,13 @@ index 1d0f5df..98c9ba0 100644
 	${LIBTOOL_MODE_LINK} \
 -		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libdns.la -rpath ${libdir} \
 +		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libdns-pkcs11.la -rpath ${libdir} \
- 		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
+ 		-release "${VERSION}" \
 -		${OBJS} ${ISCLIBS} @DNS_CRYPTO_LIBS@ ${LIBS}
 +		${OBJS} ${ISCLIBS} @DNS_CRYPTO_PK11_LIBS@ ${LIBS}
 include: gen
 	${MAKE} include/dns/enumtype.h
-@@ -187,22 +187,22 @@ gen: gen.c
+@@ -174,22 +174,22 @@ gen: gen.c
 	${BUILD_CPPFLAGS} ${BUILD_LDFLAGS} -o $@ ${srcdir}/gen.c \
 	${BUILD_LIBS} ${LFS_LIBS}
@ -526,89 +409,142 @@ index 1d0f5df..98c9ba0 100644
 	rm -f gen code.h include/dns/enumtype.h include/dns/enumclass.h
 	rm -f include/dns/rdatastruct.h
 	rm -f dnstap.pb-c.c dnstap.pb-c.h
-diff --git a/lib/isc-pkcs11/Makefile.in b/lib/isc-pkcs11/Makefile.in
+diff --git a/lib/dns-pkcs11/tests/Makefile.in b/lib/dns-pkcs11/tests/Makefile.in
-index 7e3e9ce..58d7466 100644
+index 3bb5e01..c96fe7d 100644
--- a/lib/isc-pkcs11/Makefile.in
+--- a/lib/dns-pkcs11/tests/Makefile.in
-+++ b/lib/isc-pkcs11/Makefile.in
+++ b/lib/dns-pkcs11/tests/Makefile.in
-@@ -23,8 +23,8 @@ CINCLUDES =	-I${srcdir}/unix/include \
+@@ -15,15 +15,15 @@ VERSION=@BIND9_VERSION@
- 		-I${srcdir}/@ISC_THREAD_DIR@/include \
+ 
- 		-I${srcdir}/@ISC_ARCH_DIR@/include \
+ @BIND9_MAKE_INCLUDES@
- 		-I./include \
+ 
-		-I${srcdir}/include ${DNS_INCLUDES} @ISC_OPENSSL_INC@
+-CINCLUDES =	-I. -Iinclude ${DNS_INCLUDES} ${ISC_INCLUDES} \
-CDEFINES =	@CRYPTO@ -DPK11_LIB_LOCATION=\"${PROVIDER}\"
+CINCLUDES =	-I. -Iinclude ${DNS_PKCS11_INCLUDES} ${ISC_INCLUDES} \
-+		-I${srcdir}/include ${DNS_PKCS11_INCLUDES}
+ 		${FSTRM_CFLAGS} ${OPENSSL_CFLAGS} \
-+CDEFINES =	@CRYPTO_PK11@ -DPK11_LIB_LOCATION=\"${PROVIDER}\"
+ 		${PROTOBUF_C_CFLAGS} ${MAXMINDDB_CFLAGS} @CMOCKA_CFLAGS@
 -CDEFINES =	-DTESTS="\"${top_builddir}/lib/dns/tests/\""
 +CDEFINES =	@USE_PKCS11@ -DTESTS="\"${top_builddir}/lib/dns-pkcs11/tests/\""
 ISCLIBS =	../../isc/libisc.@A@ @NO_LIBTOOL_ISCLIBS@
 ISCDEPLIBS =	../../isc/libisc.@A@
 -DNSLIBS =	../libdns.@A@ @NO_LIBTOOL_DNSLIBS@
 -DNSDEPLIBS =	../libdns.@A@
 +DNSLIBS =	../libdns-pkcs11.@A@ @NO_LIBTOOL_DNSLIBS@
 +DNSDEPLIBS =	../libdns-pkcs11.@A@
 LIBS =		@LIBS@ @CMOCKA_LIBS@
 diff --git a/lib/ns-pkcs11/Makefile.in b/lib/ns-pkcs11/Makefile.in
 index bc683ce..7a9d2f2 100644
 --- a/lib/ns-pkcs11/Makefile.in
 +++ b/lib/ns-pkcs11/Makefile.in
@@ -16,12 +16,12 @@ VERSION=@BIND9_VERSION@
 @BIND9_MAKE_INCLUDES@
 -CINCLUDES =	-I. -I${top_srcdir}/lib/ns -Iinclude \
 -		${NS_INCLUDES} ${DNS_INCLUDES} ${ISC_INCLUDES} \
 +CINCLUDES =	-I. -I${top_srcdir}/lib/ns-pkcs11 -Iinclude \
 +		${NS_PKCS11_INCLUDES} ${DNS_PKCS11_INCLUDES} ${ISC_INCLUDES} \
 		${OPENSSL_CFLAGS} @DST_GSSAPI_INC@ \
 		${FSTRM_CFLAGS}
 -CDEFINES =	-DNAMED_PLUGINDIR=\"${plugindir}\"
 +CDEFINES =	@USE_PKCS11@ -DNAMED_PLUGINDIR=\"${plugindir}\"
 CWARNINGS =
- # Alphabetically
+@@ -29,9 +29,9 @@ ISCLIBS =	../../lib/isc/libisc.@A@
-@@ -107,40 +107,40 @@ version.@O@: version.c
+ 
- 		-DLIBAGE=${LIBAGE} \
+ ISCDEPLIBS =	../../lib/isc/libisc.@A@
 -DNSLIBS =	../../lib/dns/libdns.@A@ @NO_LIBTOOL_DNSLIBS@
 +DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ @NO_LIBTOOL_DNSLIBS@
 -DNSDEPLIBS =	../../lib/dns/libdns.@A@
 +DNSDEPLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@
 LIBS =		@LIBS@
@@ -60,28 +60,28 @@ version.@O@: version.c
 		-DMAJOR=\"${MAJOR}\" \
 		-c ${srcdir}/version.c
-libisc.@SA@: ${OBJS} ${SYMTBLOBJS}
+-libns.@SA@: ${OBJS}
-+libisc-pkcs11.@SA@: ${OBJS} ${SYMTBLOBJS}
+libns-pkcs11.@SA@: ${OBJS}
 	${AR} ${ARFLAGS} $@ ${OBJS} ${SYMTBLOBJS}
 	${RANLIB} $@
 -libisc-nosymtbl.@SA@: ${OBJS}
 +libisc-pkcs11-nosymtbl.@SA@: ${OBJS}
 	${AR} ${ARFLAGS} $@ ${OBJS}
 	${RANLIB} $@
-libisc.la: ${OBJS} ${SYMTBLOBJS}
+-libns.la: ${OBJS}
-+libisc-pkcs11.la: ${OBJS} ${SYMTBLOBJS}
+libns-pkcs11.la: ${OBJS}
 	${LIBTOOL_MODE_LINK} \
-		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisc.la -rpath ${libdir} \
+-		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libns.la -rpath ${libdir} \
-+		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisc-pkcs11.la -rpath ${libdir} \
+		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libns-pkcs11.la -rpath ${libdir} \
- 		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
+ 		-release "${VERSION}" \
- 		${OBJS} ${SYMTBLOBJS} ${LIBS}
+-		${OBJS} ${ISCLIBS} ${DNSLIBS} @DNS_CRYPTO_LIBS@ ${LIBS}
 +		${OBJS} ${ISCLIBS} ${DNSLIBS} @DNS_CRYPTO_PK11_LIBS@ ${LIBS}
-libisc-nosymtbl.la: ${OBJS}
+-timestamp: libns.@A@
-+libisc-pkcs11-nosymtbl.la: ${OBJS}
+timestamp: libns-pkcs11.@A@
 	${LIBTOOL_MODE_LINK} \
 -		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisc-nosymtbl.la -rpath ${libdir} \
 +		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisc-pkcs11-nosymtbl.la -rpath ${libdir} \
 		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
 		${OBJS} ${LIBS}
 -timestamp: libisc.@A@ libisc-nosymtbl.@A@
 +timestamp: libisc-pkcs11.@A@ libisc-pkcs11-nosymtbl.@A@
 	touch timestamp
 -testdirs: libisc.@A@ libisc-nosymtbl.@A@
 +testdirs: libisc-pkcs11.@A@ libisc-pkcs11-nosymtbl.@A@
 installdirs:
 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${libdir}
 install:: timestamp installdirs
-	${LIBTOOL_MODE_INSTALL} ${INSTALL_LIBRARY} libisc.@A@ ${DESTDIR}${libdir}
+-	${LIBTOOL_MODE_INSTALL} ${INSTALL_LIBRARY} libns.@A@ \
-+	${LIBTOOL_MODE_INSTALL} ${INSTALL_LIBRARY} libisc-pkcs11.@A@ ${DESTDIR}${libdir}
+	${LIBTOOL_MODE_INSTALL} ${INSTALL_LIBRARY} libns-pkcs11.@A@ \
 		${DESTDIR}${libdir}
 uninstall::
-	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${libdir}/libisc.@A@
+-	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${libdir}/libns.@A@
-+	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${libdir}/libisc-pkcs11.@A@
+	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${libdir}/libns-pkcs11.@A@
 clean distclean::
-	rm -f libisc.@A@ libisc-nosymtbl.@A@ libisc.la \
+-	rm -f libns.@A@ timestamp
-	libisc-nosymtbl.la timestamp
+	rm -f libns-pkcs11.@A@ timestamp
-+	rm -f libisc-pkcs11.@A@ libisc-pkcs11-nosymtbl.@A@ libisc-pkcs11.la \
+diff --git a/lib/ns-pkcs11/tests/Makefile.in b/lib/ns-pkcs11/tests/Makefile.in
-+	libisc-pkcs11-nosymtbl.la timestamp
+index 4c3e694..c1b6d99 100644
 --- a/lib/ns-pkcs11/tests/Makefile.in
 +++ b/lib/ns-pkcs11/tests/Makefile.in
@@ -17,17 +17,17 @@ VERSION=@BIND9_VERSION@
 WRAP_OPTIONS =	-Wl,--wrap=isc__nmhandle_detach -Wl,--wrap=isc__nmhandle_attach
 -CINCLUDES =	-I. -Iinclude ${NS_INCLUDES} ${DNS_INCLUDES} ${ISC_INCLUDES} \
 +CINCLUDES =	-I. -Iinclude ${NS_PKCS11_INCLUDES} ${DNS_PKCS11_INCLUDES} ${ISC_INCLUDES} \
 		${OPENSSL_CFLAGS} \
 		@CMOCKA_CFLAGS@
 -CDEFINES =	-DTESTS="\"${top_builddir}/lib/ns/tests/\"" -DNAMED_PLUGINDIR=\"${plugindir}\"
 +CDEFINES =	-DTESTS="\"${top_builddir}/lib/ns-pkcs11/tests/\"" -DNAMED_PLUGINDIR=\"${plugindir}\" @USE_PKCS11@
 ISCLIBS =	../../isc/libisc.@A@ @NO_LIBTOOL_ISCLIBS@
 ISCDEPLIBS =	../../isc/libisc.@A@
 -DNSLIBS =	../../dns/libdns.@A@ @NO_LIBTOOL_DNSLIBS@
 -DNSDEPLIBS =	../../dns/libdns.@A@
 -NSLIBS =	../libns.@A@
 -NSDEPLIBS =	../libns.@A@
 +DNSLIBS =	../../dns-pkcs11/libdns-pkcs11.@A@ @NO_LIBTOOL_DNSLIBS@
 +DNSDEPLIBS =	../../dns-pkcs11/libdns-pkcs11.@A@
 +NSLIBS =	../libns-pkcs11.@A@
 +NSDEPLIBS =	../libns-pkcs11.@A@
 LIBS =		@LIBS@ @CMOCKA_LIBS@
 diff --git a/make/includes.in b/make/includes.in
-index 66efe68..966671f 100644
+index b8317d3..b73b0c4 100644
 --- a/make/includes.in
 +++ b/make/includes.in
-@@ -41,3 +41,13 @@ BIND9_INCLUDES = @BIND9_BIND9_BUILDINCLUDE@ \
+@@ -39,3 +39,10 @@ BIND9_INCLUDES = @BIND9_BIND9_BUILDINCLUDE@ \
 TEST_INCLUDES = \
 	-I${top_srcdir}/lib/tests/include
 +
-+ISC_PKCS11_INCLUDES = @BIND9_ISC_BUILDINCLUDE@ \
+DNS_PKCS11_INCLUDES = @BIND9_DNS_PKCS11_BUILDINCLUDE@ \
 +	-I${top_srcdir}/lib/isc-pkcs11 \
 +	-I${top_srcdir}/lib/isc-pkcs11/include \
 +	-I${top_srcdir}/lib/isc-pkcs11/unix/include \
 +	-I${top_srcdir}/lib/isc-pkcs11/@ISC_THREAD_DIR@/include \
 +	-I${top_srcdir}/lib/isc-pkcs11/@ISC_ARCH_DIR@/include
 +
 +DNS_PKCS11_INCLUDES = @BIND9_DNS_BUILDINCLUDE@ \
 +	-I${top_srcdir}/lib/dns-pkcs11/include
 +
 +NS_PKCS11_INCLUDES = @BIND9_NS_PKCS11_BUILDINCLUDE@ \
 +	-I${top_srcdir}/lib/ns-pkcs11/include
 +
 -- 
 2.26.3
--- a/SOURCES/bind-9.10-sdb.patch
+++ b/SOURCES/bind-9.10-sdb.patch
@ -1,310 +0,0 @@
 diff --git a/bin/Makefile.in b/bin/Makefile.in
 index ce7a2da..4e6a824 100644
 --- a/bin/Makefile.in
 +++ b/bin/Makefile.in
@@ -11,8 +11,8 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 -SUBDIRS =	named named-pkcs11 rndc dig delv dnssec dnssec-pkcs11 tools nsupdate \
 -		check confgen @NZD_TOOLS@ @PYTHON_TOOLS@ @PKCS11_TOOLS@ tests
 +SUBDIRS =	named named-sdb named-pkcs11 rndc dig delv dnssec dnssec-pkcs11 tools nsupdate \
 +		check confgen @NZD_TOOLS@ @PYTHON_TOOLS@ @PKCS11_TOOLS@ sdb_tools tests
 TARGETS =
 @BIND9_MAKE_RULES@
 diff --git a/bin/named-sdb/Makefile.in b/bin/named-sdb/Makefile.in
 index 03a72d5..4c1cb6d 100644
 --- a/bin/named-sdb/Makefile.in
 +++ b/bin/named-sdb/Makefile.in
@@ -30,10 +30,10 @@ VERSION=@BIND9_VERSION@
 #
 # Add database drivers here.
 #
 -DBDRIVER_OBJS =
 -DBDRIVER_SRCS =
 +DBDRIVER_OBJS =	ldapdb.@O@ pgsqldb.@O@ sqlitedb.@O@ dirdb.@O@
 +DBDRIVER_SRCS =	ldapdb.c pgsqldb.c sqlitedb.c dirdb.c
 DBDRIVER_INCLUDES =
 -DBDRIVER_LIBS =
 +DBDRIVER_LIBS =	-lldap -llber -lsqlite3 -lpq
 DLZ_DRIVER_DIR =	${top_srcdir}/contrib/dlz/drivers
@@ -80,7 +80,7 @@ NOSYMLIBS =	${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
 SUBDIRS =	unix
 -TARGETS =	named@EXEEXT@ lwresd@EXEEXT@
 +TARGETS =	named-sdb@EXEEXT@
 GEOIPLINKOBJS = geoip.@O@
 GEOIP2LINKOBJS = geoip.@O@
@@ -154,7 +154,7 @@ server.@O@: server.c
 		-DPRODUCT=\"${PRODUCT}\" \
 		-DVERSION=\"${VERSION}\" -c ${srcdir}/server.c
 -named@EXEEXT@: ${OBJS} ${DEPLIBS}
 +named-sdb@EXEEXT@: ${OBJS} ${DEPLIBS}
 	export MAKE_SYMTABLE="yes"; \
 	export BASEOBJS="${OBJS} ${UOBJS}"; \
 	${FINALBUILDCMD}
@@ -181,8 +181,6 @@ statschannel.@O@: bind9.xsl.h
 installdirs:
 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
 -	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man5
 -	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
 install-man5: named.conf.5
 	${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man5
@@ -192,16 +190,11 @@ install-man8: named.8 lwresd.8
 install-man: install-man5 install-man8
 -install:: named@EXEEXT@ lwresd@EXEEXT@ installdirs install-man
 -	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named@EXEEXT@ ${DESTDIR}${sbindir}
 -	(cd ${DESTDIR}${sbindir}; rm -f lwresd@EXEEXT@; @LN@ named@EXEEXT@ lwresd@EXEEXT@)
 +install:: ${TARGETS} installdirs
 +	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named-sdb@EXEEXT@ ${DESTDIR}${sbindir}
 uninstall::
 -	rm -f ${DESTDIR}${mandir}/man5/named.conf.5
 -	rm -f ${DESTDIR}${mandir}/man8/lwresd.8
 -	rm -f ${DESTDIR}${mandir}/man8/named.8
 -	rm -f ${DESTDIR}${sbindir}/lwresd@EXEEXT@
 -	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/named@EXEEXT@
 +	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/named-sdb@EXEEXT@
 @DLZ_DRIVER_RULES@
 diff --git a/bin/named-sdb/main.c b/bin/named-sdb/main.c
 index c9fc3cc..148ebb3 100644
 --- a/bin/named-sdb/main.c
 +++ b/bin/named-sdb/main.c
@@ -97,6 +97,10 @@
  * Include header files for database drivers here.
  */
 /* #include "xxdb.h" */
 +#include "ldapdb.h"
 +#include "pgsqldb.h"
 +#include "sqlitedb.h"
 +#include "dirdb.h"
 #ifdef CONTRIB_DLZ
 /*
@@ -1134,6 +1138,11 @@ setup(void) {
 		ns_main_earlyfatal("isc_app_start() failed: %s",
 				   isc_result_totext(result));
 +	ldapdb_clear();
 +	pgsqldb_clear();
 +	dirdb_clear();
 +	sqlitedb_clear();
 +
 	isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
 		      ISC_LOG_NOTICE, "starting %s %s%s%s <id:%s>",
 		      ns_g_product, ns_g_version,
@@ -1334,6 +1343,75 @@ setup(void) {
 				   isc_result_totext(result));
 #endif
 +        result = ldapdb_init();
 +        if (result != ISC_R_SUCCESS)
 +        {
 +            isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
 +                          ISC_LOG_ERROR, 
 +                          "SDB ldap module initialisation failed: %s.",
 +                          isc_result_totext(result)
 +                );
 +            isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
 +                          ISC_LOG_ERROR, 
 +                          "SDB ldap zone database will be unavailable."
 +                );
 +        }else
 +            isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
 +                          ISC_LOG_NOTICE, "SDB ldap zone database module loaded."
 +                         );
 +
 +        result = pgsqldb_init();
 +        if (result != ISC_R_SUCCESS)
 +        {
 +            isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
 +                          ISC_LOG_ERROR, 
 +                          "SDB pgsql module initialisation failed: %s.",
 +                          isc_result_totext(result)
 +                );
 +            isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
 +                          ISC_LOG_ERROR, 
 +                          "SDB pgsql zone database will be unavailable."
 +                );
 +        }else
 +            isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
 +                          ISC_LOG_NOTICE, "SDB postgreSQL DB zone database module loaded."
 +                         );
 +
 +        result = sqlitedb_init();
 +        if (result != ISC_R_SUCCESS)
 +        {
 +             isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
 +                          ISC_LOG_ERROR, 
 +                          "SDB sqlite3 module initialisation failed: %s.",
 +                          isc_result_totext(result)
 +                );
 +            isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
 +                          ISC_LOG_ERROR, 
 +                          "SDB sqlite3 zone database will be unavailable."
 +                );
 +        }else
 +            isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
 +                          ISC_LOG_NOTICE, "SDB sqlite3 DB zone database module loaded."
 +                         );
 +
 +        result = dirdb_init();
 +        if (result != ISC_R_SUCCESS)
 +        {
 +            isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
 +                          ISC_LOG_ERROR, 
 +                          "SDB directory DB module initialisation failed: %s.",
 +                          isc_result_totext(result)
 +                );
 +            isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
 +                          ISC_LOG_ERROR, 
 +                          "SDB directory DB zone database will be unavailable."
 +                );
 +        }else
 +            isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
 +                          ISC_LOG_NOTICE, "SDB directory DB zone database module loaded."
 +                         );
 +
 +
 	ns_server_create(ns_g_mctx, &ns_g_server);
 #ifdef HAVE_LIBSECCOMP
@@ -1376,6 +1454,11 @@ cleanup(void) {
 	dns_name_destroy();
 +	ldapdb_clear();
 +	pgsqldb_clear();
 +	sqlitedb_clear();
 +	dirdb_clear();
 +
 	isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
 		      ISC_LOG_NOTICE, "exiting");
 	ns_log_shutdown();
 diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
 index 03a72d5..47cc046 100644
 --- a/bin/named/Makefile.in
 +++ b/bin/named/Makefile.in
@@ -45,10 +45,10 @@ DLZDRIVER_LIBS =	@DLZ_DRIVER_LIBS@
 CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
 		${LWRES_INCLUDES} ${DNS_INCLUDES} ${BIND9_INCLUDES} \
 		${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} ${ISC_INCLUDES} \
 -		${DLZDRIVER_INCLUDES} ${DBDRIVER_INCLUDES} ${MAXMINDDB_CFLAGS} \
 +		${MAXMINDDB_CFLAGS} \
 		@DST_OPENSSL_INC@
 -CDEFINES =      @CONTRIB_DLZ@ @USE_GSSAPI@ @CRYPTO@
 +CDEFINES =      @USE_GSSAPI@ @CRYPTO@
 CWARNINGS =
@@ -72,11 +72,11 @@ DEPLIBS =	${LWRESDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
 LIBS =		${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
 		${ISCCFGLIBS} ${ISCCCLIBS} ${ISCLIBS} \
 -		${DLZDRIVER_LIBS} ${DBDRIVER_LIBS} @LIBS@
 +		@LIBS@
 NOSYMLIBS =	${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
 		${ISCCFGLIBS} ${ISCCCLIBS} ${ISCNOSYMLIBS} \
 -		${DLZDRIVER_LIBS} ${DBDRIVER_LIBS} @LIBS@
 +		@LIBS@
 SUBDIRS =	unix
@@ -94,8 +94,7 @@ OBJS =		builtin.@O@ client.@O@ config.@O@ control.@O@ \
 		tkeyconf.@O@ tsigconf.@O@ update.@O@ xfrout.@O@ \
 		zoneconf.@O@ \
 		lwaddr.@O@ lwresd.@O@ lwdclient.@O@ lwderror.@O@ lwdgabn.@O@ \
 -		lwdgnba.@O@ lwdgrbn.@O@ lwdnoop.@O@ lwsearch.@O@ \
 -		${DLZDRIVER_OBJS} ${DBDRIVER_OBJS}
 +		lwdgnba.@O@ lwdgrbn.@O@ lwdnoop.@O@ lwsearch.@O@
 UOBJS =		unix/os.@O@ unix/dlz_dlopen_driver.@O@
@@ -113,8 +112,7 @@ SRCS =		builtin.c client.c config.c control.c \
 		tkeyconf.c tsigconf.c update.c xfrout.c \
 		zoneconf.c \
 		lwaddr.c lwresd.c lwdclient.c lwderror.c lwdgabn.c \
 -		lwdgnba.c lwdgrbn.c lwdnoop.c lwsearch.c \
 -		${DLZDRIVER_SRCS} ${DBDRIVER_SRCS}
 +		lwdgnba.c lwdgrbn.c lwdnoop.c lwsearch.c
 MANPAGES =	named.8 lwresd.8 named.conf.5
@@ -203,7 +201,5 @@ uninstall::
 	rm -f ${DESTDIR}${sbindir}/lwresd@EXEEXT@
 	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/named@EXEEXT@
 -@DLZ_DRIVER_RULES@
 -
 named-symtbl.@O@: named-symtbl.c
 	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} -c named-symtbl.c
 diff --git a/bin/sdb_tools/Makefile.in b/bin/sdb_tools/Makefile.in
 index c7e0868..95ab742 100644
 --- a/bin/sdb_tools/Makefile.in
 +++ b/bin/sdb_tools/Makefile.in
@@ -32,11 +32,11 @@ DEPLIBS =	${LWRESDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
 LIBS =		${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
 		${ISCCFGLIBS} ${ISCCCLIBS} ${ISCLIBS} ${DBDRIVER_LIBS} @LIBS@
 -TARGETS =	zone2ldap@EXEEXT@ zonetodb@EXEEXT@
 +TARGETS =	zone2ldap@EXEEXT@ zonetodb@EXEEXT@ zone2sqlite@EXEEXT@
 -OBJS	=	zone2ldap.@O@ zonetodb.@O@
 +OBJS	=	zone2ldap.@O@ zonetodb.@O@ zone2sqlite.@O@
 -SRCS    =       zone2ldap.c zonetodb.c
 +SRCS    =       zone2ldap.c zonetodb.c zone2sqlite.c
 MANPAGES =      zone2ldap.1
@@ -50,6 +50,9 @@ zone2ldap@EXEEXT@: zone2ldap.@O@ ${DEPLIBS}
 zonetodb@EXEEXT@: zonetodb.@O@  ${DEPLIBS}
 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ zonetodb.@O@ -lpq ${LIBS}
 +zone2sqlite@EXEEXT@: zone2sqlite.@O@  ${DEPLIBS}
 +	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${ALL_CFLAGS} ${LDFLAGS} -o $@ zone2sqlite.@O@ -lsqlite3 -lssl ${LIBS}
 +
 clean distclean manclean maintainer-clean::
 	rm -f ${TARGETS} ${OBJS}
@@ -60,4 +63,5 @@ installdirs:
 install:: ${TARGETS} installdirs
 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zone2ldap@EXEEXT@ ${DESTDIR}${sbindir}
 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zonetodb@EXEEXT@  ${DESTDIR}${sbindir}
 +	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zone2sqlite@EXEEXT@ ${DESTDIR}${sbindir}
 	${INSTALL_DATA} ${srcdir}/zone2ldap.1 ${DESTDIR}${mandir}/man1/zone2ldap.1
 diff --git a/configure.ac b/configure.ac
 index f85f45f..7d28c52 100644
 --- a/configure.ac
 +++ b/configure.ac
@@ -5400,6 +5400,8 @@ AC_CONFIG_FILES([
 	bin/named/unix/Makefile
 	bin/named-pkcs11/Makefile
 	bin/named-pkcs11/unix/Makefile
 +	bin/named-sdb/Makefile
 +	bin/named-sdb/unix/Makefile
 	bin/nsupdate/Makefile
 	bin/pkcs11/Makefile
 	bin/python/Makefile
@@ -5424,6 +5426,7 @@ AC_CONFIG_FILES([
 	bin/python/isc/tests/policy_test.py
 	bin/python/isc/utils.py
 	bin/rndc/Makefile
 +	bin/sdb_tools/Makefile
 	bin/tests/Makefile
 	bin/tests/headerdep_test.sh
 	bin/tests/optional/Makefile
--- a/SOURCES/bind-9.10-use-of-strlcat.patch
+++ b/SOURCES/bind-9.10-use-of-strlcat.patch
@ -1,18 +0,0 @@
 diff --git a/bin/sdb_tools/zone2ldap.c b/bin/sdb_tools/zone2ldap.c
 index d56bc56..99c3314 100644
 --- a/bin/sdb_tools/zone2ldap.c
 +++ b/bin/sdb_tools/zone2ldap.c
@@ -817,11 +817,11 @@ build_dn_from_dc_list (char **dc_list, unsigned int ttl, int flag, char *zone)
     }
 -      strlcat (dn, tmp, sizeof (dn));
 +      strncat (dn, tmp, sizeof (dn) - strlen (dn));
     }
   sprintf (tmp, "dc=%s", dc_list[0]);
 -  strlcat (dn, tmp, sizeof (dn));
 +  strncat (dn, tmp, sizeof (dn) - strlen (dn));
 	    fflush(NULL);
   return dn;
--- a/SOURCES/bind-9.11-CVE-2021-25220-test.patch
+++ b/SOURCES/bind-9.11-CVE-2021-25220-test.patch
--- a/SOURCES/bind-9.11-CVE-2021-25220.patch
+++ b/SOURCES/bind-9.11-CVE-2021-25220.patch
@ -1,254 +0,0 @@
 From 1f5cb247ecd20ba57c472138f94856aa83caf042 Mon Sep 17 00:00:00 2001
 From: Mark Andrews <marka@isc.org>
 Date: Tue, 1 Mar 2022 09:48:05 +1100
 Subject: [PATCH] Add additional name checks when using a forwarder
 When using a forwarder, check that the owner name of response
 records are within the bailiwick of the forwarded name space.
 (cherry picked from commit e8df2802ac62016ea68585893eb4310fc3329028)
 Check that the forward declaration is unchanged and not overridden
 If we are using a fowarder, in addition to checking that names to
 be cached are subdomains of the forwarded namespace, we must also
 check that there are no subsidiary forwarded namespaces which would
 take precedence. To be safe, we don't cache any responses if the
 forwarding configuration has changed since the query was sent.
 (cherry picked from commit 590f8698fc876d6d72f75cf35359e7546c3af972)
 Check cached names for possible "forward only" clause
 When caching additional and glue data *not* from a forwarder, we must
 check that there is no "forward only" clause covering the owner name
 that would take precedence.  Such names would normally be allowed by
 baliwick rules, but a "forward only" zone introduces a new baliwick
 scope.
 (cherry picked from commit 4a144fae16e70517be894a971cef1d085ee68ebe)
 Look for zones deeper than the current domain or forward name
 When caching glue, we need to ensure that there is no closer
 source of truth for the name. If the owner name for the glue
 record would be answered by a locally configured zone, do not
 cache.
 (cherry picked from commit 42f8c538d3fb9d075b98d82688aeb71621798754)
 Avoid use of compound literals
 Compound literals are not used in BIND 9.11, in order to ensure backward
 compatibility with ancient compilers.  Rework the relevant parts of the
 BIND 9.11 backport of the CVE-2021-25220 fix so that compound literals
 are not used.
 (cherry picked from commit d4b1efbcbd4dfb8c6ef303968992440c5bdeed15)
 ---
 lib/dns/resolver.c | 130 +++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 125 insertions(+), 5 deletions(-)
 diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
 index c912f3aea8..2c68973899 100644
 --- a/lib/dns/resolver.c
 +++ b/lib/dns/resolver.c
@@ -63,6 +63,7 @@
 #include <dns/stats.h>
 #include <dns/tsig.h>
 #include <dns/validator.h>
 +#include <dns/zone.h>
 #ifdef WANT_QUERYTRACE
 #define RTRACE(m)       isc_log_write(dns_lctx, \
@@ -312,6 +313,8 @@ struct fetchctx {
 	bool			ns_ttl_ok;
 	uint32_t			ns_ttl;
 	isc_counter_t *			qc;
 +	dns_fixedname_t			fwdfname;
 +	dns_name_t			*fwdname;
 	/*%
 	 * The number of events we're waiting for.
@@ -3393,6 +3396,7 @@ fctx_getaddresses(fetchctx_t *fctx, bool badcache) {
 		if (result == ISC_R_SUCCESS) {
 			fwd = ISC_LIST_HEAD(forwarders->fwdrs);
 			fctx->fwdpolicy = forwarders->fwdpolicy;
 +			dns_name_copy(domain, fctx->fwdname, NULL);
 			if (fctx->fwdpolicy == dns_fwdpolicy_only &&
 			    isstrictsubdomain(domain, &fctx->domain)) {
 				fcount_decr(fctx);
@@ -4422,6 +4426,9 @@ fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type,
 	fctx->restarts = 0;
 	fctx->querysent = 0;
 	fctx->referrals = 0;
 +
 +	fctx->fwdname = dns_fixedname_initname(&fctx->fwdfname);
 +
 	TIME_NOW(&fctx->start);
 	fctx->timeouts = 0;
 	fctx->lamecount = 0;
@@ -4480,8 +4487,10 @@ fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type,
 		domain = dns_fixedname_initname(&fixed);
 		result = dns_fwdtable_find2(fctx->res->view->fwdtable, fwdname,
 					    domain, &forwarders);
 -		if (result == ISC_R_SUCCESS)
 +		if (result == ISC_R_SUCCESS) {
 			fctx->fwdpolicy = forwarders->fwdpolicy;
 +			dns_name_copy(domain, fctx->fwdname, NULL);
 +		}
 		if (fctx->fwdpolicy != dns_fwdpolicy_only) {
 			/*
@@ -6231,6 +6240,112 @@ mark_related(dns_name_t *name, dns_rdataset_t *rdataset,
 		rdataset->attributes |= DNS_RDATASETATTR_EXTERNAL;
 }
 +/*
 + * Returns true if 'name' is external to the namespace for which
 + * the server being queried can answer, either because it's not a
 + * subdomain or because it's below a forward declaration or a
 + * locally served zone.
 + */
 +static inline bool
 +name_external(dns_name_t *name, dns_rdatatype_t type, fetchctx_t *fctx) {
 +	isc_result_t result;
 +	dns_forwarders_t *forwarders = NULL;
 +	dns_fixedname_t fixed, zfixed;
 +	dns_name_t *fname = dns_fixedname_initname(&fixed);
 +	dns_name_t *zfname = dns_fixedname_initname(&zfixed);
 +	dns_name_t *apex = NULL;
 +	dns_name_t suffix;
 +	dns_zone_t *zone = NULL;
 +	unsigned int labels;
 +	dns_namereln_t rel;
 +	/*
 +	 * The following two variables do not influence code flow; they are
 +	 * only necessary for calling dns_name_fullcompare().
 +	 */
 +	int _orderp = 0;
 +	unsigned int _nlabelsp = 0;
 +
 +	apex = ISFORWARDER(fctx->addrinfo) ? fctx->fwdname : &fctx->domain;
 +
 +	/*
 +	 * The name is outside the queried namespace.
 +	 */
 +	rel = dns_name_fullcompare(name, apex, &_orderp, &_nlabelsp);
 +	if (rel != dns_namereln_subdomain && rel != dns_namereln_equal) {
 +		return (true);
 +	}
 +
 +	/*
 +	 * If the record lives in the parent zone, adjust the name so we
 +	 * look for the correct zone or forward clause.
 +	 */
 +	labels = dns_name_countlabels(name);
 +	if (dns_rdatatype_atparent(type) && labels > 1U) {
 +		dns_name_init(&suffix, NULL);
 +		dns_name_getlabelsequence(name, 1, labels - 1, &suffix);
 +		name = &suffix;
 +	} else if (rel == dns_namereln_equal) {
 +		/* If 'name' is 'apex', no further checking is needed. */
 +		return (false);
 +	}
 +
 +	/*
 +	 * If there is a locally served zone between 'apex' and 'name'
 +	 * then don't cache.
 +	 */
 +	LOCK(&fctx->res->view->lock);
 +	if (fctx->res->view->zonetable != NULL) {
 +		unsigned int options = DNS_ZTFIND_NOEXACT;
 +		result = dns_zt_find(fctx->res->view->zonetable, name, options,
 +				     zfname, &zone);
 +		if (zone != NULL) {
 +			dns_zone_detach(&zone);
 +		}
 +		if (result == ISC_R_SUCCESS || result == DNS_R_PARTIALMATCH) {
 +			if (dns_name_fullcompare(zfname, apex, &_orderp,
 +						 &_nlabelsp) ==
 +			    dns_namereln_subdomain)
 +			{
 +				UNLOCK(&fctx->res->view->lock);
 +				return (true);
 +			}
 +		}
 +	}
 +	UNLOCK(&fctx->res->view->lock);
 +
 +	/*
 +	 * Look for a forward declaration below 'name'.
 +	 */
 +	result = dns_fwdtable_find2(fctx->res->view->fwdtable, name, fname,
 +				    &forwarders);
 +
 +	if (ISFORWARDER(fctx->addrinfo)) {
 +		/*
 +		 * See if the forwarder declaration is better.
 +		 */
 +		if (result == ISC_R_SUCCESS) {
 +			return (!dns_name_equal(fname, fctx->fwdname));
 +		}
 +
 +		/*
 +		 * If the lookup failed, the configuration must have
 +		 * changed: play it safe and don't cache.
 +		 */
 +		return (true);
 +	} else if (result == ISC_R_SUCCESS &&
 +		   forwarders->fwdpolicy == dns_fwdpolicy_only &&
 +		   !ISC_LIST_EMPTY(forwarders->fwdrs))
 +	{
 +		/*
 +		 * If 'name' is covered by a 'forward only' clause then we
 +		 * can't cache this repsonse.
 +		 */
 +		return (true);
 +	}
 +
 +	return (false);
 +}
 +
 static isc_result_t
 check_section(void *arg, dns_name_t *addname, dns_rdatatype_t type,
 	      dns_section_t section)
@@ -6259,7 +6374,7 @@ check_section(void *arg, dns_name_t *addname, dns_rdatatype_t type,
 	result = dns_message_findname(rmessage, section, addname,
 				      dns_rdatatype_any, 0, &name, NULL);
 	if (result == ISC_R_SUCCESS) {
 -		external = !dns_name_issubdomain(name, &fctx->domain);
 +		external = name_external(name, type, fctx);
 		if (type == dns_rdatatype_a) {
 			for (rdataset = ISC_LIST_HEAD(name->list);
 			     rdataset != NULL;
@@ -7141,6 +7256,13 @@ answer_response(fetchctx_t *fctx, dns_message_t *message) {
 			break;
 		case dns_namereln_subdomain:
 +			/*
 +			 * Don't accept DNAME from parent namespace.
 +			 */
 +			if (name_external(name, dns_rdatatype_dname, fctx)) {
 +				continue;
 +			}
 +
 			/*
 			 * In-scope DNAME records must have at least
 			 * as many labels as the domain being queried.
@@ -7376,11 +7498,9 @@ answer_response(fetchctx_t *fctx, dns_message_t *message) {
 	 */
 	result = dns_message_firstname(message, DNS_SECTION_AUTHORITY);
 	while (!done && result == ISC_R_SUCCESS) {
 -		bool external;
 		name = NULL;
 		dns_message_currentname(message, DNS_SECTION_AUTHORITY, &name);
 -		external = !dns_name_issubdomain(name, &fctx->domain);
 -		if (!external) {
 +		if (!name_external(name, dns_rdatatype_ns, fctx)) {
 			/*
 			 * We expect to find NS or SIG NS rdatasets, and
 			 * nothing else.
 -- 
 2.34.1
--- a/SOURCES/bind-9.11-CVE-2022-2795.patch
+++ b/SOURCES/bind-9.11-CVE-2022-2795.patch
@ -1,61 +0,0 @@
 From 05cdbc1006cee6daaa29e5423976d56047d22461 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Micha=C5=82=20K=C4=99pie=C5=84?= <michal@isc.org>
 Date: Thu, 8 Sep 2022 11:11:30 +0200
 Subject: [PATCH] Bound the amount of work performed for delegations
 Limit the amount of database lookups that can be triggered in
 fctx_getaddresses() (i.e. when determining the name server addresses to
 query next) by setting a hard limit on the number of NS RRs processed
 for any delegation encountered.  Without any limit in place, named can
 be forced to perform large amounts of database lookups per each query
 received, which severely impacts resolver performance.
 The limit used (20) is an arbitrary value that is considered to be big
 enough for any sane DNS delegation.
 (cherry picked from commit 3a44097fd6c6c260765b628cd1d2c9cb7efb0b2a)
 (cherry picked from commit bf2ea6d8525bfd96a84dad221ba9e004adb710a8)
 ---
 lib/dns/resolver.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)
 diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
 index 8ae9a993bb..ac9a9ef5d0 100644
 --- a/lib/dns/resolver.c
 +++ b/lib/dns/resolver.c
@@ -180,6 +180,12 @@
  */
 #define NS_FAIL_LIMIT 4
 #define NS_RR_LIMIT   5
 +/*
 + * IP address lookups are performed for at most NS_PROCESSING_LIMIT NS RRs in
 + * any NS RRset encountered, to avoid excessive resource use while processing
 + * large delegations.
 + */
 +#define NS_PROCESSING_LIMIT 20
 /* Number of hash buckets for zone counters */
 #ifndef RES_DOMAIN_BUCKETS
@@ -3318,6 +3324,7 @@ fctx_getaddresses(fetchctx_t *fctx, bool badcache) {
 	bool need_alternate = false;
 	bool all_spilled = true;
 	unsigned int no_addresses = 0;
 +	unsigned int ns_processed = 0;
 	FCTXTRACE5("getaddresses", "fctx->depth=", fctx->depth);
@@ -3504,6 +3511,11 @@ fctx_getaddresses(fetchctx_t *fctx, bool badcache) {
 		dns_rdata_reset(&rdata);
 		dns_rdata_freestruct(&ns);
 +
 +		if (++ns_processed >= NS_PROCESSING_LIMIT) {
 +			result = ISC_R_NOMORE;
 +			break;
 +		}
 	}
 	if (result != ISC_R_NOMORE) {
 		return (result);
 -- 
 2.37.3
--- a/SOURCES/bind-9.11-CVE-2023-2828-fixup.patch
+++ b/SOURCES/bind-9.11-CVE-2023-2828-fixup.patch
@ -1,46 +0,0 @@
 From 6c26ede8edcb700caca12c501c6c129801989526 Mon Sep 17 00:00:00 2001
 From: Mark Andrews <marka@isc.org>
 Date: Fri, 23 Feb 2024 10:12:47 +1100
 Subject: [PATCH] Do not use header_prev in expire_lru_headers
 dns__cacherbt_expireheader can unlink / free header_prev underneath
 it.  Use ISC_LIST_TAIL after calling dns__cacherbt_expireheader
 instead to get the next pointer to be processed.
 (cherry picked from commit 7ce2e86024f022decb2678963538515ca39ab4ab)
 (cherry picked from commit f88f21b7d890eb80097f4bd434fedb29c2f9ff63)
 ---
 lib/dns/rbtdb.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)
 diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
 index cc40eaec60..ee59c1b18b 100644
 --- a/lib/dns/rbtdb.c
 +++ b/lib/dns/rbtdb.c
@@ -10667,19 +10667,19 @@ update_header(dns_rbtdb_t *rbtdb, rdatasetheader_t *header,
 static size_t
 expire_lru_headers(dns_rbtdb_t *rbtdb, unsigned int locknum, size_t purgesize,
 		   bool tree_locked) {
 -	rdatasetheader_t *header, *header_prev;
 +	rdatasetheader_t *header;
 	size_t purged = 0;
 	for (header = ISC_LIST_TAIL(rbtdb->rdatasets[locknum]);
 -	     header != NULL && purged <= purgesize; header = header_prev)
 +	     header != NULL && purged <= purgesize;
 +	     header = ISC_LIST_TAIL(rbtdb->rdatasets[locknum]))
 	{
 -		header_prev = ISC_LIST_PREV(header, link);
 		/*
 		 * Unlink the entry at this point to avoid checking it
 		 * again even if it's currently used someone else and
 		 * cannot be purged at this moment.  This entry won't be
 		 * referenced any more (so unlinking is safe) since the
 -		 * TTL was reset to 0.
 +		 * TTL will be reset to 0.
 		 */
 		ISC_LIST_UNLINK(rbtdb->rdatasets[locknum], header, link);
 		size_t header_size = rdataset_size(header);
 -- 
 2.43.2
--- a/SOURCES/bind-9.11-CVE-2023-2828.patch
+++ b/SOURCES/bind-9.11-CVE-2023-2828.patch
@ -1,193 +0,0 @@
 From f3aa755ba5ae5148dd0567357f8c538072e2eabc Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
 Date: Tue, 30 May 2023 08:46:17 +0200
 Subject: [PATCH] Improve RBT overmem cache cleaning
 When cache memory usage is over the configured cache size (overmem) and
 we are cleaning unused entries, it might not be enough to clean just two
 entries if the entries to be expired are smaller than the newly added
 rdata.  This could be abused by an attacker to cause a remote Denial of
 Service by possibly running out of the operating system memory.
 Currently, the addrdataset() tries to do a single TTL-based cleaning
 considering the serve-stale TTL and then optionally moves to overmem
 cleaning if we are in that condition.  Then the overmem_purge() tries to
 do another single TTL based cleaning from the TTL heap and then continue
 with LRU-based cleaning up to 2 entries cleaned.
 Squash the TTL-cleaning mechanism into single call from addrdataset(),
 but ignore the serve-stale TTL if we are currently overmem.
 Then instead of having a fixed number of entries to clean, pass the size
 of newly added rdatasetheader to the overmem_purge() function and
 cleanup at least the size of the newly added data.  This prevents the
 cache going over the configured memory limit (`max-cache-size`).
 Additionally, refactor the overmem_purge() function to reduce for-loop
 nesting for readability.
 ---
 lib/dns/rbtdb.c | 109 +++++++++++++++++++++++++++++-------------------
 1 file changed, 67 insertions(+), 42 deletions(-)
 diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
 index 11203e4..cc40eae 100644
 --- a/lib/dns/rbtdb.c
 +++ b/lib/dns/rbtdb.c
@@ -834,7 +834,7 @@ static void update_header(dns_rbtdb_t *rbtdb, rdatasetheader_t *header,
 static void expire_header(dns_rbtdb_t *rbtdb, rdatasetheader_t *header,
 			  bool tree_locked, expire_t reason);
 static void overmem_purge(dns_rbtdb_t *rbtdb, unsigned int locknum_start,
 -			  isc_stdtime_t now, bool tree_locked);
 +			  size_t purgesize, bool tree_locked);
 static isc_result_t resign_insert(dns_rbtdb_t *rbtdb, int idx,
 				  rdatasetheader_t *newheader);
 static void resign_delete(dns_rbtdb_t *rbtdb, rbtdb_version_t *version,
@@ -6937,6 +6937,16 @@ addclosest(dns_rbtdb_t *rbtdb, rdatasetheader_t *newheader,
 static dns_dbmethods_t zone_methods;
 +static size_t
 +rdataset_size(rdatasetheader_t *header) {
 +	if (!NONEXISTENT(header)) {
 +		return (dns_rdataslab_size((unsigned char *)header,
 +					   sizeof(*header)));
 +	}
 +
 +	return (sizeof(*header));
 +}
 +
 static isc_result_t
 addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 	    isc_stdtime_t now, dns_rdataset_t *rdataset, unsigned int options,
@@ -7091,7 +7101,8 @@ addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 	}
 	if (cache_is_overmem)
 -		overmem_purge(rbtdb, rbtnode->locknum, now, tree_locked);
 +		overmem_purge(rbtdb, rbtnode->locknum, rdataset_size(newheader),
 +			      tree_locked);
 	NODE_LOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
 		  isc_rwlocktype_write);
@@ -7106,9 +7117,19 @@ addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 			cleanup_dead_nodes(rbtdb, rbtnode->locknum);
 		header = isc_heap_element(rbtdb->heaps[rbtnode->locknum], 1);
 -		if (header && header->rdh_ttl < now - RBTDB_VIRTUAL)
 -			expire_header(rbtdb, header, tree_locked,
 -				      expire_ttl);
 +		if (header != NULL) {
 +			dns_ttl_t rdh_ttl = header->rdh_ttl;
 +
 +			/* Only account for stale TTL if cache is not overmem */
 +			if (!cache_is_overmem) {
 +				rdh_ttl += rbtdb->serve_stale_ttl;
 +			}
 +
 +			if (rdh_ttl < now - RBTDB_VIRTUAL) {
 +				expire_header(rbtdb, header, tree_locked,
 +					      expire_ttl);
 +			}
 +		}
 		/*
 		 * If we've been holding a write lock on the tree just for
@@ -10643,54 +10664,58 @@ update_header(dns_rbtdb_t *rbtdb, rdatasetheader_t *header,
 	ISC_LIST_PREPEND(rbtdb->rdatasets[header->node->locknum], header, link);
 }
 +static size_t
 +expire_lru_headers(dns_rbtdb_t *rbtdb, unsigned int locknum, size_t purgesize,
 +		   bool tree_locked) {
 +	rdatasetheader_t *header, *header_prev;
 +	size_t purged = 0;
 +
 +	for (header = ISC_LIST_TAIL(rbtdb->rdatasets[locknum]);
 +	     header != NULL && purged <= purgesize; header = header_prev)
 +	{
 +		header_prev = ISC_LIST_PREV(header, link);
 +		/*
 +		 * Unlink the entry at this point to avoid checking it
 +		 * again even if it's currently used someone else and
 +		 * cannot be purged at this moment.  This entry won't be
 +		 * referenced any more (so unlinking is safe) since the
 +		 * TTL was reset to 0.
 +		 */
 +		ISC_LIST_UNLINK(rbtdb->rdatasets[locknum], header, link);
 +		size_t header_size = rdataset_size(header);
 +		expire_header(rbtdb, header, tree_locked, expire_lru);
 +		purged += header_size;
 +	}
 +
 +	return (purged);
 +}
 +
 /*%
 - * Purge some expired and/or stale (i.e. unused for some period) cache entries
 - * under an overmem condition.  To recover from this condition quickly, up to
 - * 2 entries will be purged.  This process is triggered while adding a new
 - * entry, and we specifically avoid purging entries in the same LRU bucket as
 - * the one to which the new entry will belong.  Otherwise, we might purge
 - * entries of the same name of different RR types while adding RRsets from a
 - * single response (consider the case where we're adding A and AAAA glue records
 - * of the same NS name).
 + * Purge some stale (i.e. unused for some period - LRU based cleaning) cache
 + * entries under the overmem condition.  To recover from this condition quickly,
 + * we cleanup entries up to the size of newly added rdata (passed as purgesize).
 + *
 + * This process is triggered while adding a new entry, and we specifically avoid
 + * purging entries in the same LRU bucket as the one to which the new entry will
 + * belong.  Otherwise, we might purge entries of the same name of different RR
 + * types while adding RRsets from a single response (consider the case where
 + * we're adding A and AAAA glue records of the same NS name).
  */
 static void
 -overmem_purge(dns_rbtdb_t *rbtdb, unsigned int locknum_start,
 -	      isc_stdtime_t now, bool tree_locked)
 +overmem_purge(dns_rbtdb_t *rbtdb, unsigned int locknum_start, size_t purgesize,
 +	      bool tree_locked)
 {
 -	rdatasetheader_t *header, *header_prev;
 	unsigned int locknum;
 -	int purgecount = 2;
 +	size_t purged = 0;
 	for (locknum = (locknum_start + 1) % rbtdb->node_lock_count;
 -	     locknum != locknum_start && purgecount > 0;
 +	     locknum != locknum_start && purged <= purgesize;
 	     locknum = (locknum + 1) % rbtdb->node_lock_count) {
 		NODE_LOCK(&rbtdb->node_locks[locknum].lock,
 			  isc_rwlocktype_write);
 -		header = isc_heap_element(rbtdb->heaps[locknum], 1);
 -		if (header && header->rdh_ttl < now - RBTDB_VIRTUAL) {
 -			expire_header(rbtdb, header, tree_locked,
 -				      expire_ttl);
 -			purgecount--;
 -		}
 -
 -		for (header = ISC_LIST_TAIL(rbtdb->rdatasets[locknum]);
 -		     header != NULL && purgecount > 0;
 -		     header = header_prev) {
 -			header_prev = ISC_LIST_PREV(header, link);
 -			/*
 -			 * Unlink the entry at this point to avoid checking it
 -			 * again even if it's currently used someone else and
 -			 * cannot be purged at this moment.  This entry won't be
 -			 * referenced any more (so unlinking is safe) since the
 -			 * TTL was reset to 0.
 -			 */
 -			ISC_LIST_UNLINK(rbtdb->rdatasets[locknum], header,
 -					link);
 -			expire_header(rbtdb, header, tree_locked,
 -				      expire_lru);
 -			purgecount--;
 -		}
 +		purged += expire_lru_headers(rbtdb, locknum, purgesize - purged,
 +					     tree_locked);
 		NODE_UNLOCK(&rbtdb->node_locks[locknum].lock,
 				    isc_rwlocktype_write);
 -- 
 2.40.1
--- a/SOURCES/bind-9.11-CVE-2023-4408.patch
+++ b/SOURCES/bind-9.11-CVE-2023-4408.patch
--- a/SOURCES/bind-9.11-CVE-2023-50387-fixup.patch
+++ b/SOURCES/bind-9.11-CVE-2023-50387-fixup.patch
@ -1,64 +0,0 @@
 From f0fc9d7999a94da3d471c4e0a35b1f447f25eea6 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Mon, 26 Feb 2024 21:08:42 +0100
 Subject: [PATCH] Add normal task queue also to non-thread version
 Non-thread builds are used by us for dhcp package. Make it working
 again.
 Related to [GL #4424] and [GL #4459].
 ---
 lib/isc/task.c | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)
 diff --git a/lib/isc/task.c b/lib/isc/task.c
 index cc83269..5315b51 100644
 --- a/lib/isc/task.c
 +++ b/lib/isc/task.c
@@ -1115,7 +1115,7 @@ dispatch(isc__taskmgr_t *manager, isc_taskqueue_t qid) {
 		}
 #else /* USE_WORKER_THREADS */
 		if (total_dispatch_count >= DEFAULT_TASKMGR_QUANTUM ||
 -		    empty_readyq(manager))
 +		    empty_readyq(manager, qid))
 			break;
 #endif /* USE_WORKER_THREADS */
 		XTHREADTRACE(isc_msgcat_get(isc_msgcat, ISC_MSGSET_TASK,
@@ -1318,11 +1318,11 @@ dispatch(isc__taskmgr_t *manager, isc_taskqueue_t qid) {
 	}
 #ifndef USE_WORKER_THREADS
 -	ISC_LIST_APPENDLIST(manager->ready_tasks, new_ready_tasks, ready_link);
 -	ISC_LIST_APPENDLIST(manager->ready_priority_tasks, new_priority_tasks,
 +	ISC_LIST_APPENDLIST(manager->ready_tasks[qid], new_ready_tasks, ready_link);
 +	ISC_LIST_APPENDLIST(manager->ready_priority_tasks[qid], new_priority_tasks,
 			    ready_priority_link);
 	manager->tasks_ready += tasks_ready;
 -	if (empty_readyq(manager))
 +	if (empty_readyq(manager, qid))
 		manager->mode = isc_taskmgrmode_normal;
 #endif
@@ -1713,7 +1713,8 @@ isc__taskmgr_ready(isc_taskmgr_t *manager0) {
 		return (false);
 	LOCK(&manager->lock);
 -	is_ready = !empty_readyq(manager);
 +	is_ready = !empty_readyq(manager, isc_taskqueue_normal) ||
 +		   !empty_readyq(manager, isc_taskqueue_slow);
 	UNLOCK(&manager->lock);
 	return (is_ready);
@@ -1730,7 +1731,8 @@ isc__taskmgr_dispatch(isc_taskmgr_t *manager0) {
 	if (manager == NULL)
 		return (ISC_R_NOTFOUND);
 -	dispatch(manager);
 +	dispatch(manager, isc_taskqueue_normal);
 +	dispatch(manager, isc_taskqueue_slow);
 	return (ISC_R_SUCCESS);
 }
 -- 
 2.43.2
--- a/SOURCES/bind-9.11-CVE-2023-50387.patch
+++ b/SOURCES/bind-9.11-CVE-2023-50387.patch
@ -1,737 +0,0 @@
 From 4c20ab54ec503f65d8ee0b863cbf41103d95130a Mon Sep 17 00:00:00 2001
 From: Mark Andrews <marka@isc.org>
 Date: Wed, 22 Nov 2023 16:59:03 +1100
 Subject: [PATCH] Fail the DNSSEC validation on the first failure
 Be more strict when encountering DNSSEC validation failures - fail on
 the first failure.  This will break domains that have DNSSEC signing
 keys with duplicate key ids, but this is something that's much easier
 to fix on the authoritative side, so we are just going to be strict
 on the resolver side where it is causing performance problems.
 (cherry picked from commit 8b7ecba9885e163c07c2dd3e1ceab79b2ba89e34)
 Add normal and slow task queues
 Split the task manager queues into normal and slow task queues, so we
 can move the tasks that blocks processing for a long time (like DNSSEC
 validation) into the slow queue which doesn't block fast
 operations (like responding from the cache).  This mitigates the whole
 class of KeyTrap-like issues.
 (cherry picked from commit db083a21726300916fa0b9fd8a433a796fedf636)
 Don't iterate from start every time we select new signing key
 Improve the selecting of the new signing key by remembering where
 we stopped the iteration and just continue from that place instead
 of iterating from the start over and over again each time.
 (cherry picked from commit 75faeefcab47e4f1e12b358525190b4be90f97de)
 Optimize selecting the signing key
 Don't parse the crypto data before parsing and matching the id and the
 algorithm.
 (cherry picked from commit b38552cca7200a72658e482f8407f57516efc5db)
 6322.	[security]	Specific DNS answers could cause a denial-of-service
 			condition due to DNS validation taking a long time.
 			(CVE-2023-50387) [GL #4424]
 			The same code change also addresses another problem:
 			preparing NSEC3 closest encloser proofs could exhaust
 			available CPU resources. (CVE-2023-50868) [GL #4459]
 ---
 lib/dns/dst_api.c               |  25 ++++--
 lib/dns/include/dns/validator.h |   1 +
 lib/dns/include/dst/dst.h       |   4 +
 lib/dns/resolver.c              |   2 +-
 lib/dns/validator.c             |  97 +++++++++-----------
 lib/dns/win32/libdns.def.in     |   1 +
 lib/isc/include/isc/task.h      |  11 ++-
 lib/isc/task.c                  | 153 ++++++++++++++++++++++----------
 8 files changed, 186 insertions(+), 108 deletions(-)
 diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c
 index 2156384ec1..6bcd99796c 100644
 --- a/lib/dns/dst_api.c
 +++ b/lib/dns/dst_api.c
@@ -105,6 +105,7 @@ static isc_result_t	frombuffer(dns_name_t *name,
 				   dns_rdataclass_t rdclass,
 				   isc_buffer_t *source,
 				   isc_mem_t *mctx,
 +				   bool no_rdata,
 				   dst_key_t **keyp);
 static isc_result_t	algorithm_status(unsigned int alg);
@@ -764,6 +765,13 @@ isc_result_t
 dst_key_fromdns(dns_name_t *name, dns_rdataclass_t rdclass,
 		isc_buffer_t *source, isc_mem_t *mctx, dst_key_t **keyp)
 {
 +	return (dst_key_fromdns_ex(name, rdclass, source, mctx, false, keyp));
 +}
 +
 +isc_result_t
 +dst_key_fromdns_ex(dns_name_t *name, dns_rdataclass_t rdclass,
 +		   isc_buffer_t *source, isc_mem_t *mctx, bool no_rdata,
 +		   dst_key_t **keyp) {
 	uint8_t alg, proto;
 	uint32_t flags, extflags;
 	dst_key_t *key = NULL;
@@ -792,7 +800,7 @@ dst_key_fromdns(dns_name_t *name, dns_rdataclass_t rdclass,
 	}
 	result = frombuffer(name, alg, flags, proto, rdclass, source,
 -			    mctx, &key);
 +			    mctx, no_rdata, &key);
 	if (result != ISC_R_SUCCESS)
 		return (result);
 	key->key_id = id;
@@ -814,7 +822,7 @@ dst_key_frombuffer(dns_name_t *name, unsigned int alg,
 	REQUIRE(dst_initialized);
 	result = frombuffer(name, alg, flags, protocol, rdclass, source,
 -			    mctx, &key);
 +			    mctx, false, &key);
 	if (result != ISC_R_SUCCESS)
 		return (result);
@@ -1915,7 +1923,8 @@ computeid(dst_key_t *key) {
 static isc_result_t
 frombuffer(dns_name_t *name, unsigned int alg, unsigned int flags,
 	   unsigned int protocol, dns_rdataclass_t rdclass,
 -	   isc_buffer_t *source, isc_mem_t *mctx, dst_key_t **keyp)
 +	   isc_buffer_t *source, isc_mem_t *mctx, bool no_rdata,
 +	   dst_key_t **keyp)
 {
 	dst_key_t *key;
 	isc_result_t ret;
@@ -1940,10 +1949,12 @@ frombuffer(dns_name_t *name, unsigned int alg, unsigned int flags,
 			return (DST_R_UNSUPPORTEDALG);
 		}
 -		ret = key->func->fromdns(key, source);
 -		if (ret != ISC_R_SUCCESS) {
 -			dst_key_free(&key);
 -			return (ret);
 +		if (!no_rdata) {
 +			ret = key->func->fromdns(key, source);
 +			if (ret != ISC_R_SUCCESS) {
 +				dst_key_free(&key);
 +				return (ret);
 +			}
 		}
 	}
 diff --git a/lib/dns/include/dns/validator.h b/lib/dns/include/dns/validator.h
 index cc4478d6d4..b4bf8f29db 100644
 --- a/lib/dns/include/dns/validator.h
 +++ b/lib/dns/include/dns/validator.h
@@ -160,6 +160,7 @@ struct dns_validator {
 	unsigned int			depth;
 	unsigned int			authcount;
 	unsigned int			authfail;
 +	bool				failed;
 	isc_stdtime_t			start;
 };
 diff --git a/lib/dns/include/dst/dst.h b/lib/dns/include/dst/dst.h
 index 180c841307..a8be2daf67 100644
 --- a/lib/dns/include/dst/dst.h
 +++ b/lib/dns/include/dst/dst.h
@@ -435,6 +435,10 @@ dst_key_tofile(const dst_key_t *key, int type, const char *directory);
  */
 isc_result_t
 +dst_key_fromdns_ex(dns_name_t *name, dns_rdataclass_t rdclass,
 +		   isc_buffer_t *source, isc_mem_t *mctx, bool no_rdata,
 +		   dst_key_t **keyp);
 +isc_result_t
 dst_key_fromdns(dns_name_t *name, dns_rdataclass_t rdclass,
 		isc_buffer_t *source, isc_mem_t *mctx, dst_key_t **keyp);
 /*%<
 diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
 index 4f71f48039..487107614c 100644
 --- a/lib/dns/resolver.c
 +++ b/lib/dns/resolver.c
@@ -9267,7 +9267,7 @@ dns_resolver_create(dns_view_t *view,
 		if (result != ISC_R_SUCCESS)
 			goto cleanup_buckets;
 		res->buckets[i].task = NULL;
 -		result = isc_task_create(taskmgr, 0, &res->buckets[i].task);
 +		result = isc_task_create(taskmgr, ISC_TASK_QUANTUM_SLOW, &res->buckets[i].task);
 		if (result != ISC_R_SUCCESS) {
 			DESTROYLOCK(&res->buckets[i].lock);
 			goto cleanup_buckets;
 diff --git a/lib/dns/validator.c b/lib/dns/validator.c
 index 2a5c3caa6a..0b257fe874 100644
 --- a/lib/dns/validator.c
 +++ b/lib/dns/validator.c
@@ -1207,6 +1207,12 @@ create_validator(dns_validator_t *val, dns_name_t *name, dns_rdatatype_t type,
  * val->key at it.
  *
  * If val->key is non-NULL, this returns the next matching key.
 + * If val->key is already non-NULL, start searching from the next position in
 + * 'rdataset' to find the *next* key that could have signed 'siginfo', then
 + * set val->key to that.
 + *
 + * Returns ISC_R_SUCCESS if a possible matching key has been found,
 + * ISC_R_NOTFOUND if not. Any other value indicates error.
  */
 static isc_result_t
 get_dst_key(dns_validator_t *val, dns_rdata_rrsig_t *siginfo,
@@ -1216,54 +1222,59 @@ get_dst_key(dns_validator_t *val, dns_rdata_rrsig_t *siginfo,
 	isc_buffer_t b;
 	dns_rdata_t rdata = DNS_RDATA_INIT;
 	dst_key_t *oldkey = val->key;
 -	bool foundold;
 +	bool no_rdata = false;
 -	if (oldkey == NULL)
 -		foundold = true;
 -	else {
 -		foundold = false;
 +	if (oldkey == NULL) {
 +		result = dns_rdataset_first(rdataset);
 +	} else {
 +		dst_key_free(&oldkey);
 		val->key = NULL;
 +		result = dns_rdataset_next(rdataset);
 +	}
 +
 +	if (result != ISC_R_SUCCESS) {
 +		goto done;
 	}
 -	result = dns_rdataset_first(rdataset);
 -	if (result != ISC_R_SUCCESS)
 -		goto failure;
 	do {
 		dns_rdataset_current(rdataset, &rdata);
 		isc_buffer_init(&b, rdata.data, rdata.length);
 		isc_buffer_add(&b, rdata.length);
 		INSIST(val->key == NULL);
 -		result = dst_key_fromdns(&siginfo->signer, rdata.rdclass, &b,
 -					 val->view->mctx, &val->key);
 +		result = dst_key_fromdns_ex(&siginfo->signer, rdata.rdclass, &b,
 +					    val->view->mctx, no_rdata,
 +					    &val->key);
 		if (result == ISC_R_SUCCESS) {
 			if (siginfo->algorithm ==
 				    (dns_secalg_t)dst_key_alg(val->key) &&
 			    siginfo->keyid ==
 				    (dns_keytag_t)dst_key_id(val->key) &&
 +			    (dst_key_flags(val->key) & DNS_KEYFLAG_REVOKE) ==
 +				    0 &&
 			    dst_key_iszonekey(val->key))
 			{
 -				if (foundold) {
 -					/*
 -					 * This is the key we're looking for.
 -					 */
 -					return (ISC_R_SUCCESS);
 -				} else if (dst_key_compare(oldkey, val->key)) {
 -					foundold = true;
 -					dst_key_free(&oldkey);
 +				if (no_rdata) {
 +					/* Retry with full key */
 +					dns_rdata_reset(&rdata);
 +					dst_key_free(&val->key);
 +					no_rdata = false;
 +					continue;
 				}
 +				/* This is the key we're looking for. */
 +				goto done;
 			}
 			dst_key_free(&val->key);
 		}
 		dns_rdata_reset(&rdata);
 		result = dns_rdataset_next(rdataset);
 +		no_rdata = true;
 	} while (result == ISC_R_SUCCESS);
 -	if (result == ISC_R_NOMORE)
 -		result = ISC_R_NOTFOUND;
 - failure:
 -	if (oldkey != NULL)
 -		dst_key_free(&oldkey);
 +done:
 +	if (result == ISC_R_NOMORE) {
 +		result = ISC_R_NOTFOUND;
 +	}
 	return (result);
 }
@@ -1633,37 +1644,13 @@ validate(dns_validator_t *val, bool resume) {
 			continue;
 		}
 -		do {
 -			vresult = verify(val, val->key, &rdata,
 -					val->siginfo->keyid);
 -			if (vresult == ISC_R_SUCCESS)
 -				break;
 -			if (val->keynode != NULL) {
 -				dns_keynode_t *nextnode = NULL;
 -				result = dns_keytable_findnextkeynode(
 -							val->keytable,
 -							val->keynode,
 -							&nextnode);
 -				dns_keytable_detachkeynode(val->keytable,
 -							   &val->keynode);
 -				val->keynode = nextnode;
 -				if (result != ISC_R_SUCCESS) {
 -					val->key = NULL;
 -					break;
 -				}
 -				val->key = dns_keynode_key(val->keynode);
 -				if (val->key == NULL)
 -					break;
 -			} else {
 -				if (get_dst_key(val, val->siginfo, val->keyset)
 -				    != ISC_R_SUCCESS)
 -					break;
 -			}
 -		} while (1);
 -		if (vresult != ISC_R_SUCCESS)
 +		vresult = verify(val, val->key, &rdata,
 +				val->siginfo->keyid);
 +		if (vresult != ISC_R_SUCCESS) {
 +			val->failed = true;
 			validator_log(val, ISC_LOG_DEBUG(3),
 				      "failed to verify rdataset");
 -		else {
 +		} else {
 			dns_rdataset_trimttl(event->rdataset,
 					     event->sigrdataset,
 					     val->siginfo, val->start,
@@ -1700,9 +1687,13 @@ validate(dns_validator_t *val, bool resume) {
 		} else {
 			validator_log(val, ISC_LOG_DEBUG(3),
 				      "verify failure: %s",
 -				      isc_result_totext(result));
 +				      isc_result_totext(vresult));
 			resume = false;
 		}
 +		if (val->failed) {
 +			result = ISC_R_NOMORE;
 +			break;
 +		}
 	}
 	if (result != ISC_R_NOMORE) {
 		validator_log(val, ISC_LOG_DEBUG(3),
 diff --git a/lib/dns/win32/libdns.def.in b/lib/dns/win32/libdns.def.in
 index f597049493..7320653439 100644
 --- a/lib/dns/win32/libdns.def.in
 +++ b/lib/dns/win32/libdns.def.in
@@ -1439,6 +1439,7 @@ dst_key_format
 dst_key_free
 dst_key_frombuffer
 dst_key_fromdns
 +dst_key_fromdns_ex
 dst_key_fromfile
 dst_key_fromgssapi
 dst_key_fromlabel
 diff --git a/lib/isc/include/isc/task.h b/lib/isc/include/isc/task.h
 index 28e5e25fc6..42f7763869 100644
 --- a/lib/isc/include/isc/task.h
 +++ b/lib/isc/include/isc/task.h
@@ -98,8 +98,15 @@ ISC_LANG_BEGINDECLS
  ***/
 typedef enum {
 -		isc_taskmgrmode_normal = 0,
 -		isc_taskmgrmode_privileged
 +	isc_taskqueue_normal = 0,
 +	isc_taskqueue_slow = 1,
 +} isc_taskqueue_t;
 +
 +#define ISC_TASK_QUANTUM_SLOW 1024
 +
 +typedef enum {
 +	isc_taskmgrmode_normal = 0,
 +	isc_taskmgrmode_privileged
 } isc_taskmgrmode_t;
 /*% Task and task manager methods */
 diff --git a/lib/isc/task.c b/lib/isc/task.c
 index 048639350b..cc83269df2 100644
 --- a/lib/isc/task.c
 +++ b/lib/isc/task.c
@@ -107,6 +107,7 @@ struct isc__task {
 	isc_eventlist_t			on_shutdown;
 	unsigned int			nevents;
 	unsigned int			quantum;
 +	unsigned int			qid;
 	unsigned int			flags;
 	isc_stdtime_t			now;
 	isc_time_t			tnow;
@@ -141,11 +142,11 @@ struct isc__taskmgr {
 	/* Locked by task manager lock. */
 	unsigned int			default_quantum;
 	LIST(isc__task_t)		tasks;
 -	isc__tasklist_t			ready_tasks;
 -	isc__tasklist_t			ready_priority_tasks;
 +	isc__tasklist_t			ready_tasks[2];
 +	isc__tasklist_t			ready_priority_tasks[2];
 	isc_taskmgrmode_t		mode;
 #ifdef ISC_PLATFORM_USETHREADS
 -	isc_condition_t			work_available;
 +	isc_condition_t			work_available[2];
 	isc_condition_t			exclusive_granted;
 	isc_condition_t			paused;
 #endif /* ISC_PLATFORM_USETHREADS */
@@ -247,13 +248,13 @@ isc_taskmgrmode_t
 isc__taskmgr_mode(isc_taskmgr_t *manager0);
 static inline bool
 -empty_readyq(isc__taskmgr_t *manager);
 +empty_readyq(isc__taskmgr_t *manager, isc_taskqueue_t qid);
 static inline isc__task_t *
 -pop_readyq(isc__taskmgr_t *manager);
 +pop_readyq(isc__taskmgr_t *manager, isc_taskqueue_t qid);
 static inline void
 -push_readyq(isc__taskmgr_t *manager, isc__task_t *task);
 +push_readyq(isc__taskmgr_t *manager, isc__task_t *task, isc_taskqueue_t qid);
 static struct isc__taskmethods {
 	isc_taskmethods_t methods;
@@ -324,7 +325,8 @@ task_finished(isc__task_t *task) {
 		 * any idle worker threads so they
 		 * can exit.
 		 */
 -		BROADCAST(&manager->work_available);
 +		BROADCAST(&manager->work_available[isc_taskqueue_normal]);
 +		BROADCAST(&manager->work_available[isc_taskqueue_slow]);
 	}
 #endif /* USE_WORKER_THREADS */
 	UNLOCK(&manager->lock);
@@ -364,7 +366,13 @@ isc__task_create(isc_taskmgr_t *manager0, unsigned int quantum,
 	INIT_LIST(task->events);
 	INIT_LIST(task->on_shutdown);
 	task->nevents = 0;
 -	task->quantum = quantum;
 +	if (quantum >= ISC_TASK_QUANTUM_SLOW) {
 +		task->qid = isc_taskqueue_slow;
 +		task->quantum = quantum - ISC_TASK_QUANTUM_SLOW;
 +	} else {
 +		task->qid = isc_taskqueue_normal;
 +		task->quantum = quantum;
 +	}
 	task->flags = 0;
 	task->now = 0;
 	isc_time_settoepoch(&task->tnow);
@@ -476,11 +484,11 @@ task_ready(isc__task_t *task) {
 	LOCK(&manager->lock);
 	LOCK(&task->lock);
 -	push_readyq(manager, task);
 +	push_readyq(manager, task, task->qid);
 	UNLOCK(&task->lock);
 #ifdef USE_WORKER_THREADS
 	if (manager->mode == isc_taskmgrmode_normal || has_privilege)
 -		SIGNAL(&manager->work_available);
 +		SIGNAL(&manager->work_available[task->qid]);
 #endif /* USE_WORKER_THREADS */
 	UNLOCK(&manager->lock);
 }
@@ -961,13 +969,13 @@ isc__task_getcurrenttimex(isc_task_t *task0, isc_time_t *t) {
  * Caller must hold the task manager lock.
  */
 static inline bool
 -empty_readyq(isc__taskmgr_t *manager) {
 +empty_readyq(isc__taskmgr_t *manager, isc_taskqueue_t qid) {
 	isc__tasklist_t queue;
 	if (manager->mode == isc_taskmgrmode_normal)
 -		queue = manager->ready_tasks;
 +		queue = manager->ready_tasks[qid];
 	else
 -		queue = manager->ready_priority_tasks;
 +		queue = manager->ready_priority_tasks[qid];
 	return (EMPTY(queue));
 }
@@ -981,18 +989,18 @@ empty_readyq(isc__taskmgr_t *manager) {
  * Caller must hold the task manager lock.
  */
 static inline isc__task_t *
 -pop_readyq(isc__taskmgr_t *manager) {
 +pop_readyq(isc__taskmgr_t *manager, isc_taskqueue_t qid) {
 	isc__task_t *task;
 	if (manager->mode == isc_taskmgrmode_normal)
 -		task = HEAD(manager->ready_tasks);
 +		task = HEAD(manager->ready_tasks[qid]);
 	else
 -		task = HEAD(manager->ready_priority_tasks);
 +		task = HEAD(manager->ready_priority_tasks[qid]);
 	if (task != NULL) {
 -		DEQUEUE(manager->ready_tasks, task, ready_link);
 +		DEQUEUE(manager->ready_tasks[qid], task, ready_link);
 		if (ISC_LINK_LINKED(task, ready_priority_link))
 -			DEQUEUE(manager->ready_priority_tasks, task,
 +			DEQUEUE(manager->ready_priority_tasks[qid], task,
 				ready_priority_link);
 	}
@@ -1006,16 +1014,16 @@ pop_readyq(isc__taskmgr_t *manager) {
  * Caller must hold the task manager lock.
  */
 static inline void
 -push_readyq(isc__taskmgr_t *manager, isc__task_t *task) {
 -	ENQUEUE(manager->ready_tasks, task, ready_link);
 +push_readyq(isc__taskmgr_t *manager, isc__task_t *task, isc_taskqueue_t qid) {
 +	ENQUEUE(manager->ready_tasks[qid], task, ready_link);
 	if ((task->flags & TASK_F_PRIVILEGED) != 0)
 -		ENQUEUE(manager->ready_priority_tasks, task,
 +		ENQUEUE(manager->ready_priority_tasks[qid], task,
 			ready_priority_link);
 	manager->tasks_ready++;
 }
 static void
 -dispatch(isc__taskmgr_t *manager) {
 +dispatch(isc__taskmgr_t *manager, isc_taskqueue_t qid) {
 	isc__task_t *task;
 #ifndef USE_WORKER_THREADS
 	unsigned int total_dispatch_count = 0;
@@ -1094,13 +1102,13 @@ dispatch(isc__taskmgr_t *manager) {
 		 * If a pause has been requested, don't do any work
 		 * until it's been released.
 		 */
 -		while ((empty_readyq(manager) || manager->pause_requested ||
 +		while ((empty_readyq(manager, qid) || manager->pause_requested ||
 			manager->exclusive_requested) && !FINISHED(manager))
 		{
 			XTHREADTRACE(isc_msgcat_get(isc_msgcat,
 						    ISC_MSGSET_GENERAL,
 						    ISC_MSG_WAIT, "wait"));
 -			WAIT(&manager->work_available, &manager->lock);
 +			WAIT(&manager->work_available[qid], &manager->lock);
 			XTHREADTRACE(isc_msgcat_get(isc_msgcat,
 						    ISC_MSGSET_TASK,
 						    ISC_MSG_AWAKE, "awake"));
@@ -1113,7 +1121,7 @@ dispatch(isc__taskmgr_t *manager) {
 		XTHREADTRACE(isc_msgcat_get(isc_msgcat, ISC_MSGSET_TASK,
 					    ISC_MSG_WORKING, "working"));
 -		task = pop_readyq(manager);
 +		task = pop_readyq(manager, qid);
 		if (task != NULL) {
 			unsigned int dispatch_count = 0;
 			bool done = false;
@@ -1278,7 +1286,7 @@ dispatch(isc__taskmgr_t *manager) {
 				 */
 #ifdef USE_WORKER_THREADS
 				LOCK(&task->lock);
 -				push_readyq(manager, task);
 +				push_readyq(manager, task, qid);
 				UNLOCK(&task->lock);
 #else
 				ENQUEUE(new_ready_tasks, task, ready_link);
@@ -1297,10 +1305,14 @@ dispatch(isc__taskmgr_t *manager) {
 		 * we're stuck.  Automatically drop privileges at that
 		 * point and continue with the regular ready queue.
 		 */
 -		if (manager->tasks_running == 0 && empty_readyq(manager)) {
 +		if (manager->tasks_running == 0 && empty_readyq(manager, isc_taskqueue_normal) && empty_readyq(manager, isc_taskqueue_slow)) {
 			manager->mode = isc_taskmgrmode_normal;
 -			if (!empty_readyq(manager))
 -				BROADCAST(&manager->work_available);
 +			if (!empty_readyq(manager, isc_taskqueue_normal)) {
 +				BROADCAST(&manager->work_available[isc_taskqueue_normal]);
 +			}
 +			if (!empty_readyq(manager, isc_taskqueue_slow)) {
 +				BROADCAST(&manager->work_available[isc_taskqueue_slow]);
 +			}
 		}
 #endif
 	}
@@ -1322,13 +1334,37 @@ static isc_threadresult_t
 #ifdef _WIN32
 WINAPI
 #endif
 -run(void *uap) {
 +run_normal(void *uap) {
 	isc__taskmgr_t *manager = uap;
 	XTHREADTRACE(isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL,
 				    ISC_MSG_STARTING, "starting"));
 -	dispatch(manager);
 +	dispatch(manager, isc_taskqueue_normal);
 +
 +	XTHREADTRACE(isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL,
 +				    ISC_MSG_EXITING, "exiting"));
 +
 +#ifdef OPENSSL_LEAKS
 +	ERR_remove_state(0);
 +#endif
 +
 +	return ((isc_threadresult_t)0);
 +}
 +#endif /* USE_WORKER_THREADS */
 +
 +#ifdef USE_WORKER_THREADS
 +static isc_threadresult_t
 +#ifdef _WIN32
 +WINAPI
 +#endif
 +run_slow(void *uap) {
 +	isc__taskmgr_t *manager = uap;
 +
 +	XTHREADTRACE(isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL,
 +				    ISC_MSG_STARTING, "starting"));
 +
 +	dispatch(manager, isc_taskqueue_slow);
 	XTHREADTRACE(isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL,
 				    ISC_MSG_EXITING, "exiting"));
@@ -1347,7 +1383,8 @@ manager_free(isc__taskmgr_t *manager) {
 #ifdef USE_WORKER_THREADS
 	(void)isc_condition_destroy(&manager->exclusive_granted);
 -	(void)isc_condition_destroy(&manager->work_available);
 +	(void)isc_condition_destroy(&manager->work_available[isc_taskqueue_normal]);
 +	(void)isc_condition_destroy(&manager->work_available[isc_taskqueue_slow]);
 	(void)isc_condition_destroy(&manager->paused);
 	isc_mem_free(manager->mctx, manager->threads);
 #endif /* USE_WORKER_THREADS */
@@ -1414,12 +1451,20 @@ isc__taskmgr_create(isc_mem_t *mctx, unsigned int workers,
 #ifdef USE_WORKER_THREADS
 	manager->workers = 0;
 	manager->threads = isc_mem_allocate(mctx,
 -					    workers * sizeof(isc_thread_t));
 +					    2 * workers * sizeof(isc_thread_t));
 	if (manager->threads == NULL) {
 		result = ISC_R_NOMEMORY;
 		goto cleanup_lock;
 	}
 -	if (isc_condition_init(&manager->work_available) != ISC_R_SUCCESS) {
 +	if (isc_condition_init(&manager->work_available[isc_taskqueue_normal]) != ISC_R_SUCCESS) {
 +		UNEXPECTED_ERROR(__FILE__, __LINE__,
 +				 "isc_condition_init() %s",
 +				 isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL,
 +						ISC_MSG_FAILED, "failed"));
 +		result = ISC_R_UNEXPECTED;
 +		goto cleanup_threads;
 +	}
 +	if (isc_condition_init(&manager->work_available[isc_taskqueue_slow]) != ISC_R_SUCCESS) {
 		UNEXPECTED_ERROR(__FILE__, __LINE__,
 				 "isc_condition_init() %s",
 				 isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL,
@@ -1448,8 +1493,10 @@ isc__taskmgr_create(isc_mem_t *mctx, unsigned int workers,
 		default_quantum = DEFAULT_DEFAULT_QUANTUM;
 	manager->default_quantum = default_quantum;
 	INIT_LIST(manager->tasks);
 -	INIT_LIST(manager->ready_tasks);
 -	INIT_LIST(manager->ready_priority_tasks);
 +	INIT_LIST(manager->ready_tasks[isc_taskqueue_normal]);
 +	INIT_LIST(manager->ready_tasks[isc_taskqueue_slow]);
 +	INIT_LIST(manager->ready_priority_tasks[isc_taskqueue_normal]);
 +	INIT_LIST(manager->ready_priority_tasks[isc_taskqueue_slow]);
 	manager->tasks_running = 0;
 	manager->tasks_ready = 0;
 	manager->exclusive_requested = false;
@@ -1465,7 +1512,19 @@ isc__taskmgr_create(isc_mem_t *mctx, unsigned int workers,
 	 * Start workers.
 	 */
 	for (i = 0; i < workers; i++) {
 -		if (isc_thread_create(run, manager,
 +		if (isc_thread_create(run_normal, manager,
 +				      &manager->threads[manager->workers]) ==
 +		    ISC_R_SUCCESS) {
 +			char name[21];	/* thread name limit on Linux */
 +			snprintf(name, sizeof(name), "isc-worker%04u", i);
 +			isc_thread_setname(manager->threads[manager->workers],
 +					   name);
 +			manager->workers++;
 +			started++;
 +		}
 +	}
 +	for (; i < workers * 2; i++) {
 +		if (isc_thread_create(run_slow, manager,
 				      &manager->threads[manager->workers]) ==
 		    ISC_R_SUCCESS) {
 			char name[21];	/* thread name limit on Linux */
@@ -1482,7 +1541,7 @@ isc__taskmgr_create(isc_mem_t *mctx, unsigned int workers,
 		manager_free(manager);
 		return (ISC_R_NOTHREADS);
 	}
 -	isc_thread_setconcurrency(workers);
 +	isc_thread_setconcurrency(workers * 2);
 #endif /* USE_WORKER_THREADS */
 #ifdef USE_SHARED_MANAGER
 	manager->refs = 1;
@@ -1497,7 +1556,8 @@ isc__taskmgr_create(isc_mem_t *mctx, unsigned int workers,
  cleanup_exclusivegranted:
 	(void)isc_condition_destroy(&manager->exclusive_granted);
  cleanup_workavailable:
 -	(void)isc_condition_destroy(&manager->work_available);
 +	(void)isc_condition_destroy(&manager->work_available[isc_taskqueue_slow]);
 +	(void)isc_condition_destroy(&manager->work_available[isc_taskqueue_normal]);
  cleanup_threads:
 	isc_mem_free(mctx, manager->threads);
  cleanup_lock:
@@ -1582,7 +1642,7 @@ isc__taskmgr_destroy(isc_taskmgr_t **managerp) {
 	     task = NEXT(task, link)) {
 		LOCK(&task->lock);
 		if (task_shutdown(task))
 -			push_readyq(manager, task);
 +			push_readyq(manager, task, task->qid);
 		UNLOCK(&task->lock);
 	}
 #ifdef USE_WORKER_THREADS
@@ -1591,7 +1651,8 @@ isc__taskmgr_destroy(isc_taskmgr_t **managerp) {
 	 * there's work left to do, and if there are already no tasks left
 	 * it will cause the workers to see manager->exiting.
 	 */
 -	BROADCAST(&manager->work_available);
 +	BROADCAST(&manager->work_available[isc_taskqueue_normal]);
 +	BROADCAST(&manager->work_available[isc_taskqueue_slow]);
 	UNLOCK(&manager->lock);
 	/*
@@ -1693,7 +1754,8 @@ isc__taskmgr_resume(isc_taskmgr_t *manager0) {
 	LOCK(&manager->lock);
 	if (manager->pause_requested) {
 		manager->pause_requested = false;
 -		BROADCAST(&manager->work_available);
 +		BROADCAST(&manager->work_available[isc_taskqueue_normal]);
 +		BROADCAST(&manager->work_available[isc_taskqueue_slow]);
 	}
 	UNLOCK(&manager->lock);
 }
@@ -1778,7 +1840,8 @@ isc__task_endexclusive(isc_task_t *task0) {
 	LOCK(&manager->lock);
 	REQUIRE(manager->exclusive_requested);
 	manager->exclusive_requested = false;
 -	BROADCAST(&manager->work_available);
 +	BROADCAST(&manager->work_available[isc_taskqueue_normal]);
 +	BROADCAST(&manager->work_available[isc_taskqueue_slow]);
 	UNLOCK(&manager->lock);
 #else
 	UNUSED(task0);
@@ -1804,10 +1867,10 @@ isc__task_setprivilege(isc_task_t *task0, bool priv) {
 	LOCK(&manager->lock);
 	if (priv && ISC_LINK_LINKED(task, ready_link))
 -		ENQUEUE(manager->ready_priority_tasks, task,
 +		ENQUEUE(manager->ready_priority_tasks[task->qid], task,
 			ready_priority_link);
 	else if (!priv && ISC_LINK_LINKED(task, ready_priority_link))
 -		DEQUEUE(manager->ready_priority_tasks, task,
 +		DEQUEUE(manager->ready_priority_tasks[task->qid], task,
 			ready_priority_link);
 	UNLOCK(&manager->lock);
 }
 -- 
 2.43.2
--- a/SOURCES/bind-9.11-CVE-2024-1737-runtime-env.patch
+++ b/SOURCES/bind-9.11-CVE-2024-1737-runtime-env.patch
@ -1,133 +0,0 @@
 From 0a7909045f9e1bf74c1f0fd561a8ef5f55481e8f Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Mon, 29 Jul 2024 16:20:50 +0200
 Subject: [PATCH] Allow global runtime definition by DNS_RBTDB_MAX_RTYPES
 Modify rbtdb to not set it only at runtime, but allow setting that also
 in runtime via environment variable. It is still possible to modify
 default during the build define. In addition to it allows runtime change
 also. Can be positive number to set limit, 0 disabled the check.
 Similarly add also DNS_RDATASET_MAX_RECORDS to set maximum number of
 records for a single name. This must be positive number, 0 is no accepted.
 These replaces max-records-per-type and max-types-per-name in later
 versions. But can be configured only by environment and can be
 configured only globally, not in each view or zone.
 ---
 lib/dns/rbtdb.c     | 21 +++++++++++++++++++--
 lib/dns/rdataslab.c | 24 ++++++++++++++++++++++--
 2 files changed, 41 insertions(+), 4 deletions(-)
 diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
 index a3cb8dc871..0104c3ee36 100644
 --- a/lib/dns/rbtdb.c
 +++ b/lib/dns/rbtdb.c
@@ -6320,15 +6320,29 @@ update_recordsandbytes(bool add, rbtdb_version_t *rbtversion,
 #define DNS_RBTDB_MAX_RTYPES 100
 #endif /* DNS_RBTDB_MAX_RTYPES */
 +static uint32_t dns_g_rbtdb_max_rtypes = DNS_RBTDB_MAX_RTYPES;
 +
 +static void
 +init_max_rtypes(void) {
 +	/* Red Hat change, allow setting different max value by environment. */
 +	const char *max = getenv("DNS_RBTDB_MAX_RTYPES");
 +	if (max) {
 +		char *endp = NULL;
 +		long l = strtol(max, &endp, 10);
 +		if (max != endp && endp && !*endp && l >= 0)
 +			dns_g_rbtdb_max_rtypes = l;
 +	}
 +}
 +
 static bool
 overmaxtype(dns_rbtdb_t *rbtdb, uint32_t ntypes) {
 	UNUSED(rbtdb);
 -	if (DNS_RBTDB_MAX_RTYPES == 0) {
 +	if (dns_g_rbtdb_max_rtypes == 0) {
 		return (false);
 	}
 -	return (ntypes >= DNS_RBTDB_MAX_RTYPES);
 +	return (ntypes >= dns_g_rbtdb_max_rtypes);
 }
 static bool
@@ -8831,6 +8845,8 @@ static dns_dbmethods_t cache_methods = {
 	getservestalettl
 };
 +static isc_once_t once_db = ISC_ONCE_INIT;
 +
 isc_result_t
 #ifdef DNS_RBTDB_VERSION64
 dns_rbtdb64_create
@@ -8850,6 +8866,7 @@ dns_rbtdb_create
 	/* Keep the compiler happy. */
 	UNUSED(driverarg);
 +	RUNTIME_CHECK(isc_once_do(&once_db, init_max_rtypes) == ISC_R_SUCCESS);
 	rbtdb = isc_mem_get(mctx, sizeof(*rbtdb));
 	if (rbtdb == NULL)
 diff --git a/lib/dns/rdataslab.c b/lib/dns/rdataslab.c
 index 347b7d2ce8..9566f79671 100644
 --- a/lib/dns/rdataslab.c
 +++ b/lib/dns/rdataslab.c
@@ -17,6 +17,7 @@
 #include <stdlib.h>
 #include <isc/mem.h>
 +#include <isc/once.h>
 #include <isc/region.h>
 #include <isc/string.h>		/* Required for HP/UX (and others?) */
 #include <isc/util.h>
@@ -119,6 +120,23 @@ fillin_offsets(unsigned char *offsetbase, unsigned int *offsettable,
 #define DNS_RDATASET_MAX_RECORDS 100
 #endif /* DNS_RDATASET_MAX_RECORDS */
 +static unsigned int dns_g_rdataset_max_records = DNS_RDATASET_MAX_RECORDS;
 +static isc_once_t once = ISC_ONCE_INIT;
 +
 +static void
 +init_max_records(void) {
 +	/* Red Hat change, allow setting different max value by environment. */
 +	const char *max = getenv("DNS_RDATASET_MAX_RECORDS");
 +	if (max) {
 +		char *endp = NULL;
 +		long l = strtol(max, &endp, 10);
 +		if (max != endp && endp && !*endp && l > 0)
 +			dns_g_rdataset_max_records = l;
 +	}
 +}
 +
 +
 +
 isc_result_t
 dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx,
 			   isc_region_t *region, unsigned int reservelen)
@@ -165,7 +183,9 @@ dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx,
 		return (ISC_R_SUCCESS);
 	}
 -	if (nitems > DNS_RDATASET_MAX_RECORDS) {
 +	RUNTIME_CHECK(isc_once_do(&once, init_max_records) == ISC_R_SUCCESS);
 +
 +	if (nitems > dns_g_rdataset_max_records) {
 		return (DNS_R_TOOMANYRECORDS);
 	}
@@ -662,7 +682,7 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab,
 #endif
 	INSIST(ocount > 0 && ncount > 0);
 -	if (ocount + ncount > DNS_RDATASET_MAX_RECORDS) {
 +	if (ocount + ncount > dns_g_rdataset_max_records) {
 		return (DNS_R_TOOMANYRECORDS);
 	}
 -- 
 2.45.2
--- a/SOURCES/bind-9.11-CVE-2024-1737.patch
+++ b/SOURCES/bind-9.11-CVE-2024-1737.patch
@ -1,317 +0,0 @@
 From 71df06e2bf3da31c5d542fb33dbda67b21537322 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
 Date: Fri, 1 Mar 2024 08:26:07 +0100
 Subject: [PATCH] [9.11][CVE-2024-1737] Add a limit to the number of RRs in
 RRSets
 Add a limit to the number of RRs in RRSets
 Previously, the number of RRs in the RRSets were internally unlimited.
 As the data structure that holds the RRs is just a linked list, and
 there are places where we just walk through all of the RRs, adding an
 RRSet with huge number of RRs inside would slow down processing of said
 RRSets.
 The fix for end-of-life branches make the limit compile-time only for
 simplicity and the limit can be changed at the compile time by adding
 following define to CFLAGS:
    -DDNS_RDATASET_MAX_RECORDS=<limit>
 (cherry picked from commit c5c4d00c38530390c9e1ae4c98b65fbbadfe9e5e)
 (cherry picked from commit 7f705778af729ada7fec36ac4b456c73329bd996)
 (cherry picked from commit b9b5485b22c364fb88c27aa04bad4c8f616da3fa)
 Add a limit to the number of RR types for single name
 Previously, the number of RR types for a single owner name was limited
 only by the maximum number of the types (64k).  As the data structure
 that holds the RR types for the database node is just a linked list, and
 there are places where we just walk through the whole list (again and
 again), adding a large number of RR types for a single owner named with
 would slow down processing of such name (database node).
 Add a hard-coded limit (100) to cap the number of the RR types for a single
 owner.  The limit can be changed at the compile time by adding following
 define to CFLAGS:
    -DDNS_RBTDB_MAX_RTYPES=<limit>
 (cherry picked from commit 538b843d84f49ba5125ff545e3d0cf1c8434a8f2)
 (cherry picked from commit 3f10d6eff035702796ba82cd28b9f7cf9836e743)
 Optimize the slabheader placement for certain RRTypes
 Mark the infrastructure RRTypes as "priority" types and place them at
 the beginning of the rdataslab header data graph.  The non-priority
 types either go right after the priority types (if any).
 (cherry picked from commit 3ac482be7fd058d284e89873021339579fad0615)
 (cherry picked from commit 23a4652346fb2877d6246b1eebaa967969dbde16)
 [9.11][CVE-2024-1737 (part 2)] Be smarter about refusing to add many RR types to the database
 Expand the list of the priority types
 Add HTTPS, SVCB, SRV, PTR, NAPTR, DNSKEY and TXT records to the list of
 the priority types that are put at the beginning of the slabheader list
 for faster access and to avoid eviction when there are more types than
 the max-types-per-name limit.
 (cherry picked from commit b27c6bcce894786a8e082eafd59eccbf6f2731cb)
 (cherry picked from commit 3e0a67e4bdb253dae3a03a45c1aa117239a3313d)
 Be smarter about refusing to add many RR types to the database
 Instead of outright refusing to add new RR types to the cache, be a bit
 smarter:
 1. If the new header type is in our priority list, we always add either
   positive or negative entry at the beginning of the list.
 2. If the new header type is negative entry, and we are over the limit,
   we mark it as ancient immediately, so it gets evicted from the cache
   as soon as possible.
 3. Otherwise add the new header after the priority headers (or at the
   head of the list).
 4. If we are over the limit, evict the last entry on the normal header
   list.
 (cherry picked from commit 57cd34441a1b4ecc9874a4a106c2c95b8d7a3120)
 (cherry picked from commit e4d7ce686bb38428eddc7e33b40057d68eca9a6e)
 ---
 configure           |   2 +-
 configure.ac        |   2 +-
 lib/dns/rbtdb.c     | 114 +++++++++++++++++++++++++++++++++++++++++++-
 lib/dns/rdataslab.c |  12 +++++
 4 files changed, 126 insertions(+), 4 deletions(-)
 diff --git a/configure b/configure
 index e060e9d..6421c9b 100755
 --- a/configure
 +++ b/configure
@@ -12189,7 +12189,7 @@ fi
 XTARGETS=
 case "$enable_developer" in
 yes)
 -	STD_CDEFINES="$STD_CDEFINES -DISC_LIST_CHECKINIT=1"
 +	STD_CDEFINES="$STD_CDEFINES -DISC_LIST_CHECKINIT=1 -DDNS_RDATASET_MAX_RECORDS=5000 -DDNS_RBTDB_MAX_RTYPES=5000"
 	test "${enable_fixed_rrset+set}" = set || enable_fixed_rrset=yes
 	test "${enable_querytrace+set}" = set || enable_querytrace=yes
 	test "${enable_filter_aaaa+set}" = set || enable_filter_aaaa=yes
 diff --git a/configure.ac b/configure.ac
 index 83cad4a..1c35ce9 100644
 --- a/configure.ac
 +++ b/configure.ac
@@ -100,7 +100,7 @@ AC_ARG_ENABLE(developer,
 XTARGETS=
 case "$enable_developer" in
 yes)
 -	STD_CDEFINES="$STD_CDEFINES -DISC_LIST_CHECKINIT=1"
 +	STD_CDEFINES="$STD_CDEFINES -DISC_LIST_CHECKINIT=1 -DDNS_RDATASET_MAX_RECORDS=5000 -DDNS_RBTDB_MAX_RTYPES=5000"
 	test "${enable_fixed_rrset+set}" = set || enable_fixed_rrset=yes
 	test "${enable_querytrace+set}" = set || enable_querytrace=yes
 	test "${enable_filter_aaaa+set}" = set || enable_filter_aaaa=yes
 diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
 index ee59c1b..a2b2df7 100644
 --- a/lib/dns/rbtdb.c
 +++ b/lib/dns/rbtdb.c
@@ -1183,6 +1183,44 @@ set_ttl(dns_rbtdb_t *rbtdb, rdatasetheader_t *header, dns_ttl_t newttl) {
 		isc_heap_decreased(heap, header->heap_index);
 }
 +static bool
 +prio_type(rbtdb_rdatatype_t type) {
 +	switch (type) {
 +	case dns_rdatatype_soa:
 +	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_soa):
 +	case dns_rdatatype_a:
 +	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_a):
 +	case dns_rdatatype_mx:
 +	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_mx):
 +	case dns_rdatatype_aaaa:
 +	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_aaaa):
 +	case dns_rdatatype_nsec:
 +	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_nsec):
 +	case dns_rdatatype_nsec3:
 +	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_nsec3):
 +	case dns_rdatatype_ns:
 +	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_ns):
 +	case dns_rdatatype_ds:
 +	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_ds):
 +	case dns_rdatatype_cname:
 +	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_cname):
 +	case dns_rdatatype_dname:
 +	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_dname):
 +	case dns_rdatatype_dnskey:
 +	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_dnskey):
 +	case dns_rdatatype_srv:
 +	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_srv):
 +	case dns_rdatatype_txt:
 +	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_txt):
 +	case dns_rdatatype_ptr:
 +	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_ptr):
 +	case dns_rdatatype_naptr:
 +	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_naptr):
 +		return (true);
 +	}
 +	return (false);
 +}
 +
 /*%
  * These functions allow the heap code to rank the priority of each
  * element.  It returns true if v1 happens "sooner" than v2.
@@ -6278,6 +6316,30 @@ update_recordsandbytes(bool add, rbtdb_version_t *rbtversion,
 	RWUNLOCK(&rbtversion->rwlock, isc_rwlocktype_write);
 }
 +#ifndef DNS_RBTDB_MAX_RTYPES
 +#define DNS_RBTDB_MAX_RTYPES 100
 +#endif /* DNS_RBTDB_MAX_RTYPES */
 +
 +static bool
 +overmaxtype(dns_rbtdb_t *rbtdb, uint32_t ntypes) {
 +	UNUSED(rbtdb);
 +
 +	if (DNS_RBTDB_MAX_RTYPES == 0) {
 +		return (false);
 +	}
 +
 +	return (ntypes >= DNS_RBTDB_MAX_RTYPES);
 +}
 +
 +static bool
 +prio_header(rdatasetheader_t *header) {
 +	if (NEGATIVE(header) && prio_type(RBTDB_RDATATYPE_EXT(header->type))) {
 +		return (true);
 +	}
 +
 +	return (prio_type(header->type));
 +}
 +
 /*
  * write lock on rbtnode must be held.
  */
@@ -6288,6 +6350,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
 {
 	rbtdb_changed_t *changed = NULL;
 	rdatasetheader_t *topheader, *topheader_prev, *header, *sigheader;
 +	rdatasetheader_t *prioheader = NULL, *expireheader = NULL;
 	unsigned char *merged;
 	isc_result_t result;
 	bool header_nx;
@@ -6297,6 +6360,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
 	rbtdb_rdatatype_t negtype, sigtype;
 	dns_trust_t trust;
 	int idx;
 +	uint32_t ntypes = 0;
 	/*
 	 * Add an rdatasetheader_t to a node.
@@ -6429,6 +6493,15 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
 	for (topheader = rbtnode->data;
 	     topheader != NULL;
 	     topheader = topheader->next) {
 +		if (IS_CACHE(rbtdb) && ACTIVE(topheader, now)) {
 +			++ntypes;
 +			expireheader = topheader;
 +		} else if (!IS_CACHE(rbtdb)) {
 +			++ntypes;
 +		}
 +		if (prio_header(topheader)) {
 +			prioheader = topheader;
 +		}
 		if (topheader->type == newheader->type ||
 		    topheader->type == negtype)
 			break;
@@ -6792,9 +6865,46 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
 			/*
 			 * No rdatasets of the given type exist at the node.
 			 */
 -			newheader->next = rbtnode->data;
 +			if (!IS_CACHE(rbtdb) && overmaxtype(rbtdb, ntypes)) {
 +				free_rdataset(rbtdb, rbtdb->common.mctx,
 +					      newheader);
 +				return (ISC_R_QUOTA);
 +			}
 +
 			newheader->down = NULL;
 -			rbtnode->data = newheader;
 +
 +			if (prio_header(newheader)) {
 +				/* This is a priority type, prepend it */
 +				newheader->next = rbtnode->data;
 +				rbtnode->data = newheader;
 +			} else if (prioheader != NULL) {
 +				/* Append after the priority headers */
 +				newheader->next = prioheader->next;
 +				prioheader->next = newheader;
 +			} else {
 +				/* There were no priority headers */
 +				newheader->next = rbtnode->data;
 +				rbtnode->data = newheader;
 +			}
 +
 +			if (IS_CACHE(rbtdb) && overmaxtype(rbtdb, ntypes)) {
 +				if (expireheader == NULL) {
 +					expireheader = newheader;
 +				}
 +				if (NEGATIVE(newheader) &&
 +				    !prio_header(newheader))
 +				{
 +					/*
 +					 * Add the new non-priority negative
 +					 * header to the database only
 +					 * temporarily.
 +					 */
 +					expireheader = newheader;
 +				}
 +
 +				set_ttl(rbtdb, expireheader, 0);
 +				mark_header_ancient(rbtdb, expireheader);
 +			}
 		}
 	}
 diff --git a/lib/dns/rdataslab.c b/lib/dns/rdataslab.c
 index b0f77b1..347b7d2 100644
 --- a/lib/dns/rdataslab.c
 +++ b/lib/dns/rdataslab.c
@@ -115,6 +115,10 @@ fillin_offsets(unsigned char *offsetbase, unsigned int *offsettable,
 }
 #endif
 +#ifndef DNS_RDATASET_MAX_RECORDS
 +#define DNS_RDATASET_MAX_RECORDS 100
 +#endif /* DNS_RDATASET_MAX_RECORDS */
 +
 isc_result_t
 dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx,
 			   isc_region_t *region, unsigned int reservelen)
@@ -161,6 +165,10 @@ dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx,
 		return (ISC_R_SUCCESS);
 	}
 +	if (nitems > DNS_RDATASET_MAX_RECORDS) {
 +		return (DNS_R_TOOMANYRECORDS);
 +	}
 +
 	if (nitems > 0xffff)
 		return (ISC_R_NOSPACE);
@@ -654,6 +662,10 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab,
 #endif
 	INSIST(ocount > 0 && ncount > 0);
 +	if (ocount + ncount > DNS_RDATASET_MAX_RECORDS) {
 +		return (DNS_R_TOOMANYRECORDS);
 +	}
 +
 #if DNS_RDATASET_FIXED
 	oncount = ncount;
 #endif
 -- 
 2.45.2
--- a/SOURCES/bind-9.11-CVE-2024-1975.patch
+++ b/SOURCES/bind-9.11-CVE-2024-1975.patch
@ -1,322 +0,0 @@
 From 5ff88892e43c049659a8a5aef8dfd56c3712daf0 Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Tue, 16 Jul 2024 19:49:09 +0200
 Subject: [PATCH] Resolve CVE-2024-1975
 6404.	[security]	Remove SIG(0) support from named as a countermeasure
 			for CVE-2024-1975. [GL #4480]
 Resolves: CVE-2024-1975
 ---
 bin/named/client.c                   |  7 +++
 bin/tests/system/tsiggss/authsock.pl |  5 ++
 bin/tests/system/tsiggss/tests.sh    | 12 ++--
 bin/tests/system/upforwd/tests.sh    | 21 ++++---
 doc/arm/Bv9ARM-book.xml              | 22 +++----
 lib/dns/message.c                    | 94 +++-------------------------
 6 files changed, 49 insertions(+), 112 deletions(-)
 diff --git a/bin/named/client.c b/bin/named/client.c
 index 368bc94..ea121b3 100644
 --- a/bin/named/client.c
 +++ b/bin/named/client.c
@@ -3013,6 +3013,13 @@ client_request(isc_task_t *task, isc_event_t *event) {
 		ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
 			      NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(3),
 			      "request is signed by a nonauthoritative key");
 +	} else if (result == DNS_R_NOTVERIFIEDYET &&
 +		   client->message->sig0 != NULL)
 +	{
 +		ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
 +			      NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(3),
 +			      "request has a SIG(0) signature but its support "
 +			      "was removed (CVE-2024-1975)");
 	} else {
 		char tsigrcode[64];
 		isc_buffer_t b;
 diff --git a/bin/tests/system/tsiggss/authsock.pl b/bin/tests/system/tsiggss/authsock.pl
 index ab3833d..0b231ee 100644
 --- a/bin/tests/system/tsiggss/authsock.pl
 +++ b/bin/tests/system/tsiggss/authsock.pl
@@ -31,6 +31,10 @@ if (!defined($path)) {
 	exit(1);
 }
 +# Enable output autoflush so that it's not lost when the parent sends TERM.
 +select STDOUT;
 +$| = 1;
 +
 unlink($path);
 my $server = IO::Socket::UNIX->new(Local => $path, Type => SOCK_STREAM, Listen => 8) or
     die "unable to create socket $path";
@@ -53,6 +57,7 @@ if ($timeout != 0) {
 }
 while (my $client = $server->accept()) {
 +	printf("accept()\n");
 	$client->recv(my $buf, 8, 0);
 	my ($version, $req_len) = unpack('N N', $buf);
 diff --git a/bin/tests/system/tsiggss/tests.sh b/bin/tests/system/tsiggss/tests.sh
 index 456ce61..d0db388 100644
 --- a/bin/tests/system/tsiggss/tests.sh
 +++ b/bin/tests/system/tsiggss/tests.sh
@@ -116,7 +116,7 @@ status=$((status+ret))
 echo_i "testing external update policy (CNAME) with auth sock ($n)"
 ret=0
 -$PERL ./authsock.pl --type=CNAME --path=ns1/auth.sock --pidfile=authsock.pid --timeout=120 > /dev/null 2>&1 &
 +$PERL ./authsock.pl --type=CNAME --path=ns1/auth.sock --pidfile=authsock.pid --timeout=120 >authsock.log 2>&1 &
 sleep 1
 test_update $n testcname.example.nil. CNAME "86400 CNAME testdenied.example.nil" "testdenied" || ret=1
 n=$((n+1))
@@ -130,17 +130,19 @@ n=$((n+1))
 if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 -echo_i "testing external policy with SIG(0) key ($n)"
 +echo_i "testing external policy with unsupported SIG(0) key ($n)"
 ret=0
 -$NSUPDATE -R $RANDFILE -k ns1/Kkey.example.nil.*.private <<END > /dev/null 2>&1 || ret=1
 +$NSUPDATE -R $RANDFILE -k ns1/Kkey.example.nil.*.private <<END >nsupdate.out${n} 2>&1 || true
 +debug
 server 10.53.0.1 ${PORT}
 zone example.nil
 update add fred.example.nil 120 cname foo.bar.
 send
 END
 +# update must have failed - SIG(0) signer is not supported
 output=`$DIG $DIGOPTS +short cname fred.example.nil.`
 -[ -n "$output" ] || ret=1
 -[ $ret -eq 0 ] || echo_i "failed"
 +[ -n "$output" ] && ret=1
 +grep -F "signer=key.example.nil" authsock.log >/dev/null && ret=1
 n=$((n+1))
 if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 diff --git a/bin/tests/system/upforwd/tests.sh b/bin/tests/system/upforwd/tests.sh
 index ebc9ded..f5b89d4 100644
 --- a/bin/tests/system/upforwd/tests.sh
 +++ b/bin/tests/system/upforwd/tests.sh
@@ -181,19 +181,22 @@ n=`expr $n + 1`
 if test -f keyname
 then
 -	echo_i "checking update forwarding to with sig0 ($n)"
 +	echo_i "checking update forwarding to with sig0 (expected to fail) ($n)"
 	ret=0
 	keyname=`cat keyname`
 -	$NSUPDATE -k $keyname.private -- - <<EOF
 -	local 10.53.0.1
 -	server 10.53.0.3 ${PORT}
 -	zone example2
 -	update add unsigned.example2. 600 A 10.10.10.1
 -	update add unsigned.example2. 600 TXT Foo
 -	send
 +	# SIG(0) is removed, update is expected to fail.
 +	{
 +	  $NSUPDATE -k $keyname.private -- - <<EOF
 +	  local 10.53.0.1
 +	  server 10.53.0.3 ${PORT}
 +	  zone example2
 +	  update add unsigned.example2. 600 A 10.10.10.1
 +	  update add unsigned.example2. 600 TXT Foo
 +	  send
 EOF
 +	} >nsupdate.out.$n 2>&1 && ret=1
 	$DIG -p ${PORT} unsigned.example2 A @10.53.0.1 > dig.out.ns1.test$n
 -	grep "status: NOERROR" dig.out.ns1.test$n > /dev/null || ret=1
 +	grep "status: NOERROR" dig.out.ns1.test$n >/dev/null && ret=1
 	if [ $ret != 0 ] ; then echo_i "failed"; fi
 	status=`expr $status + $ret`
 	n=`expr $n + 1`
 diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
 index acf772b..563dced 100644
 --- a/doc/arm/Bv9ARM-book.xml
 +++ b/doc/arm/Bv9ARM-book.xml
@@ -2027,7 +2027,7 @@ allow-update { !{ !localnets; any; }; key host1-host2. ;};
 	The TKEY process is initiated by a client or server by sending
 	a query of type TKEY to a TKEY-aware server.  The query must include
 	an appropriate KEY record in the additional section, and
 -	must be signed using either TSIG or SIG(0) with a previously
 +	must be signed using TSIG with a previously
 	established key.  The server's response, if successful,
 	contains a TKEY record in its answer section.  After this transaction,
 	both participants have enough information to calculate a
@@ -2050,24 +2050,24 @@ allow-update { !{ !localnets; any; }; key host1-host2. ;};
     <section xml:id="sig0"><info><title>SIG(0)</title></info>
       <para>
 -	<acronym>BIND</acronym> partially supports DNSSEC SIG(0)
 +	<acronym>BIND</acronym> partially supported DNSSEC SIG(0)
 	transaction signatures as specified in RFC 2535 and RFC 2931.
 	SIG(0) uses public/private keys to authenticate messages.  Access control
 -	is performed in the same manner as with TSIG keys; privileges can be
 +	were performed in the same manner as with TSIG keys; privileges can be
 	granted or denied in ACL directives based on the key name.
       </para>
       <para>
 -	When a SIG(0) signed message is received, it is only
 +	When a SIG(0) signed message were received, it were only
 	verified if the key is known and trusted by the server. The
 -	server does not attempt to recursively fetch or validate the
 +	server did not attempt to recursively fetch or validate the
 	key.
       </para>
       <para>
 -	SIG(0) signing of multiple-message TCP streams is not supported.
 +	SIG(0) signing of multiple-message TCP streams were not supported.
       </para>
       <para>
 -	The only tool shipped with <acronym>BIND</acronym> 9 that
 -	generates SIG(0) signed messages is <command>nsupdate</command>.
 +	Support for SIG(0) message verification was removed
 +	as part of the mitigation of CVE-2024-1975.
       </para>
     </section>
@@ -12655,7 +12655,7 @@ example.com. NS ns2.example.net.
 	      either grants or denies permission for one or more
 	      names in the zone to be updated by one or more
 	      identities. Identity is determined by the key that
 -	      signed the update request, using either TSIG or SIG(0).
 +	      signed the update request, using TSIG.
 	      In most cases, <command>update-policy</command> rules
 	      only apply to key-based identities.  There is no way
 	      to specify update permissions based on client source
@@ -12742,7 +12742,7 @@ example.com. NS ns2.example.net.
 	    <para>
 	      The <command>identity</command> field must be set to
 	      a fully qualified domain name.  In most cases, this
 -	      represents the name of the TSIG or SIG(0) key that must be
 +	      represents the name of the TSIG key that must be
 	      used to sign the update request.  If the specified name is a
 	      wildcard, it is subject to DNS wildcard expansion, and the
 	      rule may apply to multiple identities.  When a TKEY exchange
@@ -15952,7 +15952,7 @@ HOST-127.EXAMPLE. MX 0 .
 	</para>
 	<para>
 	  ACLs match clients on the basis of up to three characteristics:
 -	  1) The client's IP address; 2) the TSIG or SIG(0) key that was
 +	  1) The client's IP address; 2) the TSIG key that was
 	  used to sign the request, if any; and 3) an address prefix
 	  encoded in an EDNS Client-Subnet option, if any.
 	</para>
 diff --git a/lib/dns/message.c b/lib/dns/message.c
 index a44eb2d..9ea2b9e 100644
 --- a/lib/dns/message.c
 +++ b/lib/dns/message.c
@@ -3373,103 +3373,23 @@ dns_message_dumpsig(dns_message_t *msg, char *txt1) {
 isc_result_t
 dns_message_checksig(dns_message_t *msg, dns_view_t *view) {
 -	isc_buffer_t b, msgb;
 +	isc_buffer_t msgb;
 	REQUIRE(DNS_MESSAGE_VALID(msg));
 -	if (msg->tsigkey == NULL && msg->tsig == NULL && msg->sig0 == NULL)
 +	if (msg->tsigkey == NULL && msg->tsig == NULL)
 		return (ISC_R_SUCCESS);
 	INSIST(msg->saved.base != NULL);
 	isc_buffer_init(&msgb, msg->saved.base, msg->saved.length);
 	isc_buffer_add(&msgb, msg->saved.length);
 -	if (msg->tsigkey != NULL || msg->tsig != NULL) {
 #ifdef SKAN_MSG_DEBUG
 -		dns_message_dumpsig(msg, "dns_message_checksig#1");
 +	dns_message_dumpsig(msg, "dns_message_checksig#1");
 #endif
 -		if (view != NULL)
 -			return (dns_view_checksig(view, &msgb, msg));
 -		else
 -			return (dns_tsig_verify(&msgb, msg, NULL, NULL));
 -	} else {
 -		dns_rdata_t rdata = DNS_RDATA_INIT;
 -		dns_rdata_sig_t sig;
 -		dns_rdataset_t keyset;
 -		isc_result_t result;
 -
 -		result = dns_rdataset_first(msg->sig0);
 -		INSIST(result == ISC_R_SUCCESS);
 -		dns_rdataset_current(msg->sig0, &rdata);
 -
 -		/*
 -		 * This can occur when the message is a dynamic update, since
 -		 * the rdata length checking is relaxed.  This should not
 -		 * happen in a well-formed message, since the SIG(0) is only
 -		 * looked for in the additional section, and the dynamic update
 -		 * meta-records are in the prerequisite and update sections.
 -		 */
 -		if (rdata.length == 0)
 -			return (ISC_R_UNEXPECTEDEND);
 -
 -		result = dns_rdata_tostruct(&rdata, &sig, msg->mctx);
 -		if (result != ISC_R_SUCCESS)
 -			return (result);
 -
 -		dns_rdataset_init(&keyset);
 -		if (view == NULL)
 -			return (DNS_R_KEYUNAUTHORIZED);
 -		result = dns_view_simplefind(view, &sig.signer,
 -					     dns_rdatatype_key /* SIG(0) */,
 -					     0, 0, false, &keyset, NULL);
 -
 -		if (result != ISC_R_SUCCESS) {
 -			/* XXXBEW Should possibly create a fetch here */
 -			result = DNS_R_KEYUNAUTHORIZED;
 -			goto freesig;
 -		} else if (keyset.trust < dns_trust_secure) {
 -			/* XXXBEW Should call a validator here */
 -			result = DNS_R_KEYUNAUTHORIZED;
 -			goto freesig;
 -		}
 -		result = dns_rdataset_first(&keyset);
 -		INSIST(result == ISC_R_SUCCESS);
 -		for (;
 -		     result == ISC_R_SUCCESS;
 -		     result = dns_rdataset_next(&keyset))
 -		{
 -			dst_key_t *key = NULL;
 -
 -			dns_rdata_reset(&rdata);
 -			dns_rdataset_current(&keyset, &rdata);
 -			isc_buffer_init(&b, rdata.data, rdata.length);
 -			isc_buffer_add(&b, rdata.length);
 -
 -			result = dst_key_fromdns(&sig.signer, rdata.rdclass,
 -						 &b, view->mctx, &key);
 -			if (result != ISC_R_SUCCESS)
 -				continue;
 -			if (dst_key_alg(key) != sig.algorithm ||
 -			    dst_key_id(key) != sig.keyid ||
 -			    !(dst_key_proto(key) == DNS_KEYPROTO_DNSSEC ||
 -			      dst_key_proto(key) == DNS_KEYPROTO_ANY))
 -			{
 -				dst_key_free(&key);
 -				continue;
 -			}
 -			result = dns_dnssec_verifymessage(&msgb, msg, key);
 -			dst_key_free(&key);
 -			if (result == ISC_R_SUCCESS)
 -				break;
 -		}
 -		if (result == ISC_R_NOMORE)
 -			result = DNS_R_KEYUNAUTHORIZED;
 -
 - freesig:
 -		if (dns_rdataset_isassociated(&keyset))
 -			dns_rdataset_disassociate(&keyset);
 -		dns_rdata_freestruct(&sig);
 -		return (result);
 -	}
 +	if (view != NULL)
 +		return (dns_view_checksig(view, &msgb, msg));
 +	else
 +		return (dns_tsig_verify(&msgb, msg, NULL, NULL));
 }
 #define INDENT(sp) \
 -- 
 2.45.2
--- a/SOURCES/bind-9.11-CVE-2025-40778.patch
+++ b/SOURCES/bind-9.11-CVE-2025-40778.patch
--- a/SOURCES/bind-9.11-CVE-2026-10723.patch
+++ b/SOURCES/bind-9.11-CVE-2026-10723.patch
@ -1,64 +0,0 @@
 From 6e7215866cf1b9d92b7cdbb5e1990f0f7581336a Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Wed, 1 Jul 2026 23:24:09 -0700
 Subject: [PATCH] Check NSEC3 signer matches the owning zone
 When validating NSEC3 records, reject any signature whose signer field
 does not match the zone owning the NSEC3.
 This ensures that a child zone cannot impersonate its parent and forge
 NXDOMAIN responses for sibling domains.
 Fixes: isc-projects/bind9#5874
 (cherry picked from commit 6e5066bb1f0f12d090e8707adb7d6ccf74f8012b)
 ---
 lib/dns/dnssec.c | 19 +++++++++++++++++--
 lib/dns/result.c |  2 +-
 2 files changed, 18 insertions(+), 3 deletions(-)
 diff --git a/lib/dns/dnssec.c b/lib/dns/dnssec.c
 index b6b2405..8dae801 100644
 --- a/lib/dns/dnssec.c
 +++ b/lib/dns/dnssec.c
@@ -428,10 +428,25 @@ dns_dnssec_verify3(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
 	}
 	/*
 -	 * NS, SOA and DNSSKEY records are signed by their owner.
 -	 * DS records are signed by the parent.
 +	 * NS, SOA and DNSKEY records are signed by their owners.
 +	 * NSEC3 records are signed by the apex, exactly one level up
 +	 * from their owner names.
 +	 * DS records are signed by the parent zone.
 	 */
 	switch (set->type) {
 +	case dns_rdatatype_nsec3: {
 +		dns_name_t apex = DNS_NAME_INITEMPTY;
 +		labels = dns_name_countlabels(name);
 +		if (labels <= 1) {
 +			inc_stat(dns_dnssecstats_fail);
 +			return DNS_R_INVALIDNSEC3;
 +		}
 +		dns_name_split(name, labels - 1, NULL, &apex);
 +		if (!dns_name_equal(&apex, &sig.signer)) {
 +			inc_stat(dns_dnssecstats_fail);
 +			return DNS_R_SIGINVALID;
 +		}
 +	} break;
 	case dns_rdatatype_ns:
 	case dns_rdatatype_soa:
 	case dns_rdatatype_dnskey:
 diff --git a/lib/dns/result.c b/lib/dns/result.c
 index 24aa01e..45ac114 100644
 --- a/lib/dns/result.c
 +++ b/lib/dns/result.c
@@ -148,7 +148,7 @@ static const char *text[DNS_R_NRESULTS] = {
 	"covering NSEC record returned",       /*%< 101 DNS_R_COVERINGNSEC */
 	"MX is an address",		       /*%< 102 DNS_R_MXISADDRESS */
 	"duplicate query",		       /*%< 103 DNS_R_DUPLICATE */
 -	"invalid NSEC3 owner name (wildcard)", /*%< 104 DNS_R_INVALIDNSEC3 */
 +	"invalid NSEC3 owner name",	       /*%< 104 DNS_R_INVALIDNSEC3 */
 	"not master",			       /*%< 105 DNS_R_NOTMASTER */
 	"broken trust chain",		       /*%< 106 DNS_R_BROKENCHAIN */
--- a/SOURCES/bind-9.11-CVE-2026-11622.patch
+++ b/SOURCES/bind-9.11-CVE-2026-11622.patch
@ -1,318 +0,0 @@
 From a323885e23d763255a6abea0ae7752449c0c2cde Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@sury.org>
 Date: Tue, 23 Jun 2026 10:59:38 +0200
 Subject: [PATCH] Make the dns_slabheaders in the cache reference counted
 Instead of only reference counting the enclosing qpcnode, add the
 reference counting directly to the slabheaders.  The reference is
 incremented when an rdataset is bound to the header and decremented when
 the rdataset is disassociated, so a stale slabheader can be removed from
 the node's down chain as soon as its own reference count reaches zero,
 instead of waiting for the whole qpcnode to become unreferenced.
 Building on that, clean up the ancient headers eagerly: mark_ancient()
 is made idempotent, releases the header's own (container) reference and
 reaps the stale headers from the node's down chain as soon as their
 references reach zero.  A header evicted over the per-name type limit is
 expired only after the new rdataset has been bound, so the bind's
 increment always precedes mark_ancient()'s decrement.
 Because a header can now be reclaimed independently of its node, the
 rdataset iterators must keep the header they are positioned on alive:
 each iterator takes a reference on its current header and releases it
 when it advances or is destroyed.  Iteration otherwise stays lazy and
 re-reads the node on every step, so it still observes records added to
 the node while the iterator is live, as zone signing requires.
 The slab headers are shared with the zone databases, so the matching
 increment is added to every bind path.  The noqname/closest proofs hand
 out rdatasets backed by bare slabs that have no header, so they are
 given a separate dns_rdataproof_rdatasetmethods that leaves the
 reference count untouched.
 (cherry picked from commit 2dabf117e1264fd13fb33096f87e78a039fd1c6c)
 ---
 lib/dns/include/dns/rdataslab.h |   1 +
 lib/dns/rbtdb.c                 | 105 +++++++++++++++++++++++++++-----
 2 files changed, 90 insertions(+), 16 deletions(-)
 diff --git a/lib/dns/include/dns/rdataslab.h b/lib/dns/include/dns/rdataslab.h
 index 40c40a8..f353f03 100644
 --- a/lib/dns/include/dns/rdataslab.h
 +++ b/lib/dns/include/dns/rdataslab.h
@@ -44,6 +44,7 @@
 #include <stdbool.h>
 #include <isc/lang.h>
 +#include <isc/refcount.h>
 #include <dns/types.h>
 diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
 index 388ffdf..7ec553e 100644
 --- a/lib/dns/rbtdb.c
 +++ b/lib/dns/rbtdb.c
@@ -441,6 +441,7 @@ struct noqname {
 typedef struct acachectl acachectl_t;
 typedef struct rdatasetheader {
 +	isc_refcount_t references;
 	/*%
 	 * Locked by the owning node's lock.
 	 */
@@ -1760,6 +1761,8 @@ init_rdataset(dns_rbtdb_t *rbtdb, rdatasetheader_t *h) {
 	h->next_is_relative = 0;
 	h->node_is_relative = 0;
 +	isc_refcount_init(&h->references, 1);
 +
 #if TRACE_HEADER
 	if (IS_CACHE(rbtdb) && rbtdb->common.rdclass == dns_rdataclass_in)
 		fprintf(stderr, "initialized header: %p\n", h);
@@ -1885,6 +1888,9 @@ rollback_node(dns_rbtnode_t *node, rbtdb_serial_t serial) {
 		node->dirty = 1;
 }
 +static void
 +clean_stale_headers(dns_rbtdb_t *rbtdb, isc_mem_t *mctx, rdatasetheader_t *top);
 +
 static inline void
 mark_header_ancient(dns_rbtdb_t *rbtdb, rdatasetheader_t *header) {
@@ -1897,26 +1903,37 @@ mark_header_ancient(dns_rbtdb_t *rbtdb, rdatasetheader_t *header) {
 	header->attributes |= RDATASET_ATTR_ANCIENT;
 	header->node->dirty = 1;
 +	isc_refcount_decrement(&header->references, NULL);
 +
 	/*
 -	 * If we have not been counted then there is nothing to do.
 +	 * If this header has been counted, move it to the stale stats bucket.
 	 */
 -	if ((header->attributes & RDATASET_ATTR_STATCOUNT) == 0)
 -		return;
 -
 -	if (EXISTS(header))
 +	if ((header->attributes & RDATASET_ATTR_STATCOUNT) != 0 &&
 +	    EXISTS(header))
 +	{
 		update_rrsetstats(rbtdb, header, true);
 +	}
 +
 +	clean_stale_headers(rbtdb, rbtdb->common.mctx, header);
 }
 static inline void
 clean_stale_headers(dns_rbtdb_t *rbtdb, isc_mem_t *mctx, rdatasetheader_t *top)
 {
 	rdatasetheader_t *d, *down_next;
 +	rdatasetheader_t *down_parent = top;
 	for (d = top->down; d != NULL; d = down_next) {
 		down_next = d->down;
 -		free_rdataset(rbtdb, mctx, d);
 +		d->next = down_parent;
 +
 +		if (isc_refcount_current(&d->references) == 0) {
 +			free_rdataset(rbtdb, mctx, d);
 +			down_parent->down = down_next;
 +		} else {
 +			down_parent = d;
 +		}
 	}
 -	top->down = NULL;
 }
 static inline void
@@ -1932,6 +1949,7 @@ clean_cache_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node) {
 	for (current = node->data; current != NULL; current = top_next) {
 		top_next = current->next;
 		clean_stale_headers(rbtdb, mctx, current);
 +		INSIST(current->down == NULL);
 		/*
 		 * If current is nonexistent or stale, we can clean it up.
 		 */
@@ -3469,6 +3487,8 @@ bind_rdataset(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node, rdatasetheader_t *header,
 	if (rdataset == NULL)
 		return;
 +	isc_refcount_increment(&header->references, NULL);
 +
 	new_reference(rbtdb, node, locktype);
 	INSIST(rdataset->methods == NULL);      /* We must be disassociated. */
@@ -6386,6 +6406,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
 	bool header_nx;
 	bool newheader_nx;
 	bool merge;
 +	bool do_expireheader = false;
 	dns_rdatatype_t rdtype, covers;
 	rbtdb_rdatatype_t negtype, sigtype;
 	dns_trust_t trust;
@@ -6918,6 +6939,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
 			}
 			if (IS_CACHE(rbtdb) && overmaxtype(rbtdb, ntypes)) {
 +				do_expireheader = true;
 				if (expireheader == NULL) {
 					expireheader = newheader;
 				}
@@ -6931,9 +6953,6 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
 					 */
 					expireheader = newheader;
 				}
 -
 -				set_ttl(rbtdb, expireheader, 0);
 -				mark_header_ancient(rbtdb, expireheader);
 			}
 		}
 	}
@@ -6954,6 +6973,15 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
 			      isc_rwlocktype_write, addedrdataset);
 	}
 +	/*
 +	 * We need to delay the expiration of the header until we are bound to
 +	 * it to prevent decrement-then-increment on the header references.
 +	 */
 +	if (do_expireheader) {
 +		set_ttl(rbtdb, expireheader, 0);
 +		mark_header_ancient(rbtdb, expireheader);
 +	}
 +
 	return (ISC_R_SUCCESS);
 }
@@ -9228,6 +9256,12 @@ rdataset_disassociate(dns_rdataset_t *rdataset) {
 	dns_db_t *db = rdataset->private1;
 	dns_dbnode_t *node = rdataset->private2;
 +	if (rdataset->methods == &rdataset_methods) {
 +		rdatasetheader_t *header = rdataset->private3;
 +		header--;
 +		isc_refcount_decrement(&header->references, NULL);
 +	}
 +
 	detachnode(db, &node);
 }
@@ -9339,6 +9373,11 @@ rdataset_clone(dns_rdataset_t *source, dns_rdataset_t *target) {
 	dns_dbnode_t *cloned_node = NULL;
 	attachnode(db, node, &cloned_node);
 +	if (source->methods == &rdataset_methods) {
 +		rdatasetheader_t *header = source->private3;
 +		header--;
 +		isc_refcount_increment(&header->references, NULL);
 +	}
 	INSIST(!ISC_LINK_LINKED(target, link));
 	*target = *source;
 	ISC_LINK_INIT(target, link);
@@ -9504,6 +9543,11 @@ rdatasetiter_destroy(dns_rdatasetiter_t **iteratorp) {
 	rbtiterator = (rbtdb_rdatasetiter_t *)(*iteratorp);
 +	if (rbtiterator->current != NULL) {
 +		isc_refcount_decrement(&rbtiterator->current->references, NULL);
 +		rbtiterator->current = NULL;
 +	}
 +
 	if (rbtiterator->common.version != NULL)
 		closeversion(rbtiterator->common.db,
 			     &rbtiterator->common.version, false);
@@ -9561,9 +9605,18 @@ rdatasetiter_first(dns_rdatasetiter_t *iterator) {
 			break;
 	}
 +	if (header != NULL) {
 +		isc_refcount_increment0(&header->references, NULL);
 +	}
 +
 	NODE_UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
 		    isc_rwlocktype_read);
 +	if (rbtiterator->current != NULL) {
 +		isc_refcount_decrement(&rbtiterator->current->references, NULL);
 +		rbtiterator->current = NULL;
 +	}
 +
 	rbtiterator->current = header;
 	if (header == NULL)
@@ -9637,9 +9690,18 @@ rdatasetiter_next(dns_rdatasetiter_t *iterator) {
 		}
 	}
 +	if (header != NULL) {
 +		isc_refcount_increment0(&header->references, NULL);
 +	}
 +
 	NODE_UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
 		    isc_rwlocktype_read);
 +	if (rbtiterator->current != NULL) {
 +		isc_refcount_decrement(&rbtiterator->current->references, NULL);
 +		rbtiterator->current = NULL;
 +	}
 +
 	rbtiterator->current = header;
 	if (header == NULL)
@@ -10249,6 +10311,19 @@ rdataset_getadditional(dns_rdataset_t *rdataset, dns_rdatasetadditional_t type,
 	return (result);
 }
 +static void
 +free_acache_cbarg(isc_mem_t *mctx, acache_cbarg_t **cbargp) {
 +	acache_cbarg_t *cbarg;
 +
 +	REQUIRE(cbargp != NULL && *cbargp != NULL);
 +
 +	cbarg = *cbargp;
 +	isc_refcount_decrement(&cbarg->header->references, NULL);
 +	isc_mem_put(mctx, cbarg, sizeof(*cbarg));
 +
 +	*cbargp = NULL;
 +}
 +
 static void
 acache_callback(dns_acacheentry_t *entry, void **arg) {
 	dns_rbtdb_t *rbtdb;
@@ -10288,7 +10363,7 @@ acache_callback(dns_acacheentry_t *entry, void **arg) {
 		acarray[count].entry = NULL;
 		INSIST(acarray[count].cbarg == cbarg);
 		acarray[count].cbarg = NULL;
 -		isc_mem_put(rbtdb->common.mctx, cbarg, sizeof(acache_cbarg_t));
 +		free_acache_cbarg(rbtdb->common.mctx, &cbarg);
 		dns_acache_detachentry(&entry);
 	}
@@ -10317,9 +10392,7 @@ acache_cancelentry(isc_mem_t *mctx, dns_acacheentry_t *entry,
 		dns_db_detach(&cbarg->db);
 	}
 -	isc_mem_put(mctx, cbarg, sizeof(acache_cbarg_t));
 -
 -	*cbargp = NULL;
 +	free_acache_cbarg(mctx, cbargp);
 }
 static isc_result_t
@@ -10355,6 +10428,7 @@ rdataset_setadditional(dns_rdataset_t *rdataset, dns_rdatasetadditional_t type,
 	newcbarg = isc_mem_get(rbtdb->common.mctx, sizeof(*newcbarg));
 	if (newcbarg == NULL)
 		return (ISC_R_NOMEMORY);
 +	isc_refcount_increment(&header->references, NULL);
 	newcbarg->type = type;
 	newcbarg->count = count;
 	newcbarg->header = header;
@@ -10448,8 +10522,7 @@ rdataset_setadditional(dns_rdataset_t *rdataset, dns_rdatasetadditional_t type,
 		} else {
 			dns_db_detachnode((dns_db_t *)rbtdb, &newcbarg->node);
 			dns_db_detach(&newcbarg->db);
 -			isc_mem_put(rbtdb->common.mctx, newcbarg,
 -			    sizeof(*newcbarg));
 +			free_acache_cbarg(rbtdb->common.mctx, &newcbarg);
 		}
 	}
--- a/SOURCES/bind-9.11-CVE-2026-11721-test.patch
+++ b/SOURCES/bind-9.11-CVE-2026-11721-test.patch
@ -1,168 +0,0 @@
 From 9c1f5b579a7a4c338be8319a40927c83a0b4f886 Mon Sep 17 00:00:00 2001
 From: Mark Andrews <marka@isc.org>
 Date: Tue, 14 Apr 2026 13:46:22 +1000
 Subject: [PATCH] Test RRSIG record parsing
 In particular test that labels and signer fields are consistent.
 (cherry picked from commit 5a95e64731afe63d348d272cc4d3b2f9847150c2)
 (cherry picked from commit 5f3b7aef42be50630ecc349a6dbc22acf96d7413)
 Fix failing dnssec-signzone -M sub-test
 Restore example.db to the default contents which does not result
 in too many records causing the test to fail.
 (cherry picked from commit 8b11c48ed044844e26eaaca4315868231014dbb7)
 ---
 bin/tests/system/dnssec/tests.sh |   1 +
 lib/dns/tests/rdata_test.c       | 114 +++++++++++++++++++++++++++++++
 2 files changed, 115 insertions(+)
 diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh
 index 1eb97f42c5..e5cb97924e 100644
 --- a/bin/tests/system/dnssec/tests.sh
 +++ b/bin/tests/system/dnssec/tests.sh
@@ -1793,6 +1793,7 @@ echo_i "checking TTLs are capped by dnssec-signzone -M ($n)"
 ret=0
 (
 cd signer
 +cp example.db.in example.db
 $SIGNER -O full -f signer.out.8 -S -M 30 -o example example.db > /dev/null 2>&1
 ) || ret=1
 awk '/^;/ { next; } $2 > 30 { exit 1; }' signer/signer.out.8 || ret=1
 diff --git a/lib/dns/tests/rdata_test.c b/lib/dns/tests/rdata_test.c
 index fe01e48fa3..1cde60b1d8 100644
 --- a/lib/dns/tests/rdata_test.c
 +++ b/lib/dns/tests/rdata_test.c
@@ -2356,6 +2356,119 @@ rkey(void **state) {
 		    dns_rdatatype_rkey, sizeof(dns_rdata_rkey_t));
 }
 +static void
 +rrsig(void **state) {
 +	text_ok_t text_ok[] = {
 +		TEXT_VALID("SOA 8 0 86400 20260426170000 20260413160000 54393 "
 +			   ". "
 +			   "tFbcoVP8MnpecUquJ/aj+XeNgV7ts9GSHVkXaXRJrJ/"
 +			   "TEkOZApVG0F6E "
 +			   "9sYpxGk2ItweLL43ujioGj0HWwZDRR+vbur+O/"
 +			   "dIdheiig1VvU+9HXLi "
 +			   "QOViY9Kc64ixdyJhYCC5K+bO1qsHxd+"
 +			   "KJXOaxyHbqchYkDFy4PL6qftE "
 +			   "VaLkueRgjXgOsq/"
 +			   "NxvCXDgAa5xy0+3Sl0myxIs8rJ5KeXfJQFe7qxgaw "
 +			   "VjJsJTKw8neOTw2rQfLaigWu2LIWw+"
 +			   "IyVrLjZJdLqGkiLBGd1w4X3U12 "
 +			   "fFxoY3eqzNgBEtduoGKPZ/"
 +			   "NpP9cuKJORJ18283aV8hR4WO91VR0q1zcM jLwqUg=="),
 +		/* labels too short for signer */
 +		TEXT_INVALID("SOA 8 0 86400 20260426170000 20260413160000 "
 +			     "54393 example. "
 +			     "tFbcoVP8MnpecUquJ/aj+XeNgV7ts9GSHVkXaXRJrJ/"
 +			     "TEkOZApVG0F6E "
 +			     "9sYpxGk2ItweLL43ujioGj0HWwZDRR+vbur+O/"
 +			     "dIdheiig1VvU+9HXLi "
 +			     "QOViY9Kc64ixdyJhYCC5K+bO1qsHxd+"
 +			     "KJXOaxyHbqchYkDFy4PL6qftE "
 +			     "VaLkueRgjXgOsq/"
 +			     "NxvCXDgAa5xy0+3Sl0myxIs8rJ5KeXfJQFe7qxgaw "
 +			     "VjJsJTKw8neOTw2rQfLaigWu2LIWw+"
 +			     "IyVrLjZJdLqGkiLBGd1w4X3U12 "
 +			     "fFxoY3eqzNgBEtduoGKPZ/"
 +			     "NpP9cuKJORJ18283aV8hR4WO91VR0q1zcM jLwqUg=="),
 +		/*
 +		 * Sentinel.
 +		 */
 +		TEXT_SENTINEL()
 +	};
 +	wire_ok_t wire_ok[] = {
 +		WIRE_VALID(0x00, 0x06, 0x08, 0x00, 0x00, 0x01, 0x51, 0x80, 0x69,
 +			   0xee, 0x44, 0x90, 0x69, 0xdd, 0x13, 0x00, 0xd4, 0x79,
 +			   0x00, 0xb4, 0x56, 0xdc, 0xa1, 0x53, 0xfc, 0x32, 0x7a,
 +			   0x5e, 0x71, 0x4a, 0xae, 0x27, 0xf6, 0xa3, 0xf9, 0x77,
 +			   0x8d, 0x81, 0x5e, 0xed, 0xb3, 0xd1, 0x92, 0x1d, 0x59,
 +			   0x17, 0x69, 0x74, 0x49, 0xac, 0x9f, 0xd3, 0x12, 0x43,
 +			   0x99, 0x02, 0x95, 0x46, 0xd0, 0x5e, 0x84, 0xf6, 0xc6,
 +			   0x29, 0xc4, 0x69, 0x36, 0x22, 0xdc, 0x1e, 0x2c, 0xbe,
 +			   0x37, 0xba, 0x38, 0xa8, 0x1a, 0x3d, 0x07, 0x5b, 0x06,
 +			   0x43, 0x45, 0x1f, 0xaf, 0x6e, 0xea, 0xfe, 0x3b, 0xf7,
 +			   0x48, 0x76, 0x17, 0xa2, 0x8a, 0x0d, 0x55, 0xbd, 0x4f,
 +			   0xbd, 0x1d, 0x72, 0xe2, 0x40, 0xe5, 0x62, 0x63, 0xd2,
 +			   0x9c, 0xeb, 0x88, 0xb1, 0x77, 0x22, 0x61, 0x60, 0x20,
 +			   0xb9, 0x2b, 0xe6, 0xce, 0xd6, 0xab, 0x07, 0xc5, 0xdf,
 +			   0x8a, 0x25, 0x73, 0x9a, 0xc7, 0x21, 0xdb, 0xa9, 0xc8,
 +			   0x58, 0x90, 0x31, 0x72, 0xe0, 0xf2, 0xfa, 0xa9, 0xfb,
 +			   0x44, 0x55, 0xa2, 0xe4, 0xb9, 0xe4, 0x60, 0x8d, 0x78,
 +			   0x0e, 0xb2, 0xaf, 0xcd, 0xc6, 0xf0, 0x97, 0x0e, 0x00,
 +			   0x1a, 0xe7, 0x1c, 0xb4, 0xfb, 0x74, 0xa5, 0xd2, 0x6c,
 +			   0xb1, 0x22, 0xcf, 0x2b, 0x27, 0x92, 0x9e, 0x5d, 0xf2,
 +			   0x50, 0x15, 0xee, 0xea, 0xc6, 0x06, 0xb0, 0x56, 0x32,
 +			   0x6c, 0x25, 0x32, 0xb0, 0xf2, 0x77, 0x8e, 0x4f, 0x0d,
 +			   0xab, 0x41, 0xf2, 0xda, 0x8a, 0x05, 0xae, 0xd8, 0xb2,
 +			   0x16, 0xc3, 0xe2, 0x32, 0x56, 0xb2, 0xe3, 0x64, 0x97,
 +			   0x4b, 0xa8, 0x69, 0x22, 0x2c, 0x11, 0x9d, 0xd7, 0x0e,
 +			   0x17, 0xdd, 0x4d, 0x76, 0x7c, 0x5c, 0x68, 0x63, 0x77,
 +			   0xaa, 0xcc, 0xd8, 0x01, 0x12, 0xd7, 0x6e, 0xa0, 0x62,
 +			   0x8f, 0x67, 0xf3, 0x69, 0x3f, 0xd7, 0x2e, 0x28, 0x93,
 +			   0x91, 0x27, 0x5f, 0x36, 0xf3, 0x76, 0x95, 0xf2, 0x14,
 +			   0x78, 0x58, 0xef, 0x75, 0x55, 0x1d, 0x2a, 0xd7, 0x37,
 +			   0x0c, 0x8c, 0xbc, 0x2a, 0x52),
 +		/* labels too short for signer */
 +		WIRE_INVALID(
 +			0x00, 0x06, 0x08, 0x00, 0x00, 0x01, 0x51, 0x80, 0x69,
 +			0xee, 0x44, 0x90, 0x69, 0xdd, 0x13, 0x00, 0xd4, 0x79,
 +			0x07, 0x65, 0x78, 0x61, 0x6d, 0x70, 0x6c, 0x65, 0x00,
 +			0xb4, 0x56, 0xdc, 0xa1, 0x53, 0xfc, 0x32, 0x7a, 0x5e,
 +			0x71, 0x4a, 0xae, 0x27, 0xf6, 0xa3, 0xf9, 0x77, 0x8d,
 +			0x81, 0x5e, 0xed, 0xb3, 0xd1, 0x92, 0x1d, 0x59, 0x17,
 +			0x69, 0x74, 0x49, 0xac, 0x9f, 0xd3, 0x12, 0x43, 0x99,
 +			0x02, 0x95, 0x46, 0xd0, 0x5e, 0x84, 0xf6, 0xc6, 0x29,
 +			0xc4, 0x69, 0x36, 0x22, 0xdc, 0x1e, 0x2c, 0xbe, 0x37,
 +			0xba, 0x38, 0xa8, 0x1a, 0x3d, 0x07, 0x5b, 0x06, 0x43,
 +			0x45, 0x1f, 0xaf, 0x6e, 0xea, 0xfe, 0x3b, 0xf7, 0x48,
 +			0x76, 0x17, 0xa2, 0x8a, 0x0d, 0x55, 0xbd, 0x4f, 0xbd,
 +			0x1d, 0x72, 0xe2, 0x40, 0xe5, 0x62, 0x63, 0xd2, 0x9c,
 +			0xeb, 0x88, 0xb1, 0x77, 0x22, 0x61, 0x60, 0x20, 0xb9,
 +			0x2b, 0xe6, 0xce, 0xd6, 0xab, 0x07, 0xc5, 0xdf, 0x8a,
 +			0x25, 0x73, 0x9a, 0xc7, 0x21, 0xdb, 0xa9, 0xc8, 0x58,
 +			0x90, 0x31, 0x72, 0xe0, 0xf2, 0xfa, 0xa9, 0xfb, 0x44,
 +			0x55, 0xa2, 0xe4, 0xb9, 0xe4, 0x60, 0x8d, 0x78, 0x0e,
 +			0xb2, 0xaf, 0xcd, 0xc6, 0xf0, 0x97, 0x0e, 0x00, 0x1a,
 +			0xe7, 0x1c, 0xb4, 0xfb, 0x74, 0xa5, 0xd2, 0x6c, 0xb1,
 +			0x22, 0xcf, 0x2b, 0x27, 0x92, 0x9e, 0x5d, 0xf2, 0x50,
 +			0x15, 0xee, 0xea, 0xc6, 0x06, 0xb0, 0x56, 0x32, 0x6c,
 +			0x25, 0x32, 0xb0, 0xf2, 0x77, 0x8e, 0x4f, 0x0d, 0xab,
 +			0x41, 0xf2, 0xda, 0x8a, 0x05, 0xae, 0xd8, 0xb2, 0x16,
 +			0xc3, 0xe2, 0x32, 0x56, 0xb2, 0xe3, 0x64, 0x97, 0x4b,
 +			0xa8, 0x69, 0x22, 0x2c, 0x11, 0x9d, 0xd7, 0x0e, 0x17,
 +			0xdd, 0x4d, 0x76, 0x7c, 0x5c, 0x68, 0x63, 0x77, 0xaa,
 +			0xcc, 0xd8, 0x01, 0x12, 0xd7, 0x6e, 0xa0, 0x62, 0x8f,
 +			0x67, 0xf3, 0x69, 0x3f, 0xd7, 0x2e, 0x28, 0x93, 0x91,
 +			0x27, 0x5f, 0x36, 0xf3, 0x76, 0x95, 0xf2, 0x14, 0x78,
 +			0x58, 0xef, 0x75, 0x55, 0x1d, 0x2a, 0xd7, 0x37, 0x0c,
 +			0x8c, 0xbc, 0x2a, 0x52),
 +
 +		WIRE_SENTINEL()
 +	};
 +
 +	UNUSED(state);
 +
 +	check_rdata(text_ok, wire_ok, NULL, false, dns_rdataclass_in,
 +		    dns_rdatatype_rrsig, sizeof(dns_rdata_rrsig_t));
 +}
 +
 /* SSHFP RDATA manipulations */
 static void
 sshfp(void **state) {
@@ -2867,6 +2980,7 @@ main(int argc, char **argv) {
 		cmocka_unit_test_setup_teardown(nsec, _setup, _teardown),
 		cmocka_unit_test_setup_teardown(nsec3, _setup, _teardown),
 		cmocka_unit_test_setup_teardown(nxt, _setup, _teardown),
 +		cmocka_unit_test_setup_teardown(rrsig, _setup, _teardown),
 		cmocka_unit_test_setup_teardown(sshfp, _setup, _teardown),
 		cmocka_unit_test_setup_teardown(wks, _setup, _teardown),
 		cmocka_unit_test_setup_teardown(rkey, _setup, _teardown),
 -- 
 2.55.0
--- a/SOURCES/bind-9.11-CVE-2026-11721.patch
+++ b/SOURCES/bind-9.11-CVE-2026-11721.patch
@ -1,263 +0,0 @@
 From 78ac82303bc3dd9d426d21fb268a5ed362d5535a Mon Sep 17 00:00:00 2001
 From: Mark Andrews <marka@isc.org>
 Date: Tue, 14 Apr 2026 15:14:06 +1000
 Subject: [PATCH 1/2] Don't sign out of zone records in dnssec-signzone
 dnssec-signzone was signing extraneous records that were not within
 the namespace of the zone.  This no longer occurs.
 (cherry picked from commit e45c9af7051421fd370f20ba8325199c606223fd)
 ---
 bin/dnssec/dnssec-signzone.c | 5 +++++
 1 file changed, 5 insertions(+)
 diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c
 index 6567421..b7c8e55 100644
 --- a/bin/dnssec/dnssec-signzone.c
 +++ b/bin/dnssec/dnssec-signzone.c
@@ -1482,6 +1482,11 @@ assignwork(isc_task_t *task, isc_task_t *worker) {
 			dns_db_detachnode(gdb, &node);
 			goto next;
 		}
 +		if (!dns_name_issubdomain(name, gorigin)) {
 +			dumpnode(name, node);
 +			dns_db_detachnode(gdb, &node);
 +			goto next;
 +		}
 		/*
 		 * Sort the zone data from the glue and out-of-zone data.
 		 * For NSEC zones nodes with zone data have NSEC records.
 From 8c269a0269fdf12d5edd4698d08d663c6f64ddae Mon Sep 17 00:00:00 2001
 From: Mark Andrews <marka@isc.org>
 Date: Tue, 14 Apr 2026 12:24:33 +1000
 Subject: [PATCH 2/2] Invalid signed wildcard records were being accepted
 An RRSIG whose Labels field indicates fewer labels than its signer
 name requires was being accepted.  When such a record covers a
 wildcard, the validator reconstructs a wildcard owner name above the
 signer's zone and caches it as secure.  RFC 8198 cache synthesis
 (synth-from-dnssec) then serves that forged wildcard for unrelated
 names, poisoning the cache.
 These records are now rejected, both when an RRSIG is parsed and when
 its signature is verified.
 (cherry picked from commit 084ca5ee10515e461d46b63df9660b8394bc7de9)
 ---
 lib/dns/dnssec.c                 | 45 +++++++++++++++++++++++---------
 lib/dns/rdata/generic/rrsig_46.c | 37 +++++++++++++++++++-------
 2 files changed, 60 insertions(+), 22 deletions(-)
 diff --git a/lib/dns/dnssec.c b/lib/dns/dnssec.c
 index b6b2405..2516a9a 100644
 --- a/lib/dns/dnssec.c
 +++ b/lib/dns/dnssec.c
@@ -142,11 +142,11 @@ dns_dnssec_keyfromrdata(dns_name_t *name, dns_rdata_t *rdata, isc_mem_t *mctx,
 	isc_buffer_t b;
 	isc_region_t r;
 -	INSIST(name != NULL);
 -	INSIST(rdata != NULL);
 -	INSIST(mctx != NULL);
 -	INSIST(key != NULL);
 -	INSIST(*key == NULL);
 +	REQUIRE(name != NULL);
 +	REQUIRE(rdata != NULL);
 +	REQUIRE(mctx != NULL);
 +	REQUIRE(key != NULL);
 +	REQUIRE(*key == NULL);
 	REQUIRE(rdata->type == dns_rdatatype_key ||
 		rdata->type == dns_rdatatype_dnskey);
@@ -200,12 +200,14 @@ dns_dnssec_sign(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
 	isc_buffer_t *databuf = NULL;
 	char data[256 + 8];
 	uint32_t flags;
 +	unsigned int labels;
 	unsigned int sigsize;
 	dns_fixedname_t fnewname;
 	dns_fixedname_t fsigner;
 	REQUIRE(name != NULL);
 -	REQUIRE(dns_name_countlabels(name) <= 255);
 +	labels = dns_name_countlabels(name);
 +	REQUIRE(labels <= 255 && labels > 0);
 	REQUIRE(set != NULL);
 	REQUIRE(key != NULL);
 	REQUIRE(inception != NULL);
@@ -243,7 +245,7 @@ dns_dnssec_sign(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
 	sig.covered = set->type;
 	sig.algorithm = dst_key_alg(key);
 -	sig.labels = dns_name_countlabels(name) - 1;
 +	sig.labels = labels - 1;
 	if (dns_name_iswildcard(name))
 		sig.labels--;
 	sig.originalttl = set->ttl;
@@ -390,11 +392,14 @@ dns_dnssec_verify3(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
 	isc_result_t ret;
 	unsigned char data[300];
 	dst_context_t *ctx = NULL;
 -	int labels = 0;
 	uint32_t flags;
 +	unsigned int labels;
 +	unsigned int siglabels;
 	bool downcase = false;
 	REQUIRE(name != NULL);
 +	labels = dns_name_countlabels(name);
 +	REQUIRE(labels > 0);
 	REQUIRE(set != NULL);
 	REQUIRE(key != NULL);
 	REQUIRE(mctx != NULL);
@@ -407,6 +412,21 @@ dns_dnssec_verify3(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
 	if (set->type != sig.covered)
 		return (DNS_R_SIGINVALID);
 +	/*
 +	 * The RRSIG labels field can't indicate fewer labels than the
 +	 * signer.  Also the labels shouldn't be greater than that of
 +	 * the owner name.
 +	 *
 +	 * sig.labels doesn't include the root label, so add 1 to account
 +	 * for it.
 +	 */
 +	siglabels = sig.labels + 1;
 +	if (siglabels < dns_name_countlabels(&sig.signer) || siglabels > labels)
 +	{
 +		inc_stat(dns_dnssecstats_fail);
 +		return DNS_R_SIGINVALID;
 +	}
 +
 	if (isc_serial_lt(sig.timeexpire, sig.timesigned)) {
 		inc_stat(dns_dnssecstats_fail);
 		return (DNS_R_SIGINVALID);
@@ -484,11 +504,10 @@ dns_dnssec_verify3(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
 	 * If the name is an expanded wildcard, use the wildcard name.
 	 */
 	dns_fixedname_init(&fnewname);
 -	labels = dns_name_countlabels(name) - 1;
 	RUNTIME_CHECK(dns_name_downcase(name, dns_fixedname_name(&fnewname),
 					NULL) == ISC_R_SUCCESS);
 -	if (labels - sig.labels > 0)
 -		dns_name_split(dns_fixedname_name(&fnewname), sig.labels + 1,
 +	if (labels > siglabels)
 +		dns_name_split(dns_fixedname_name(&fnewname), siglabels,
 			       NULL, dns_fixedname_name(&fnewname));
 	dns_name_toregion(dns_fixedname_name(&fnewname), &r);
@@ -497,7 +516,7 @@ dns_dnssec_verify3(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
 	 * Create an envelope for each rdata: <name|type|class|ttl>.
 	 */
 	isc_buffer_init(&envbuf, data, sizeof(data));
 -	if (labels - sig.labels > 0) {
 +	if (labels > siglabels) {
 		isc_buffer_putuint8(&envbuf, 1);
 		isc_buffer_putuint8(&envbuf, '*');
 		memmove(data + 2, r.base, r.length);
@@ -583,7 +602,7 @@ cleanup_struct:
 	if (ret != ISC_R_SUCCESS)
 		inc_stat(dns_dnssecstats_fail);
 -	if (ret == ISC_R_SUCCESS && labels - sig.labels > 0) {
 +	if (ret == ISC_R_SUCCESS && labels > siglabels) {
 		if (wild != NULL)
 			RUNTIME_CHECK(dns_name_concatenate(dns_wildcardname,
 						 dns_fixedname_name(&fnewname),
 diff --git a/lib/dns/rdata/generic/rrsig_46.c b/lib/dns/rdata/generic/rrsig_46.c
 index 0d4df67..35a1b4c 100644
 --- a/lib/dns/rdata/generic/rrsig_46.c
 +++ b/lib/dns/rdata/generic/rrsig_46.c
@@ -21,12 +21,12 @@
 static inline isc_result_t
 fromtext_rrsig(ARGS_FROMTEXT) {
 	isc_token_t token;
 -	unsigned char c;
 +	unsigned char alg, labels;
 	long i;
 	dns_rdatatype_t covered;
 -	char *e;
 +	char *e = NULL;
 	isc_result_t result;
 -	dns_name_t name;
 +	dns_name_t signer;
 	isc_buffer_t buffer;
 	uint32_t time_signed, time_expire;
@@ -57,8 +57,8 @@ fromtext_rrsig(ARGS_FROMTEXT) {
 	 */
 	RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_string,
 				      false));
 -	RETTOK(dns_secalg_fromtext(&c, &token.value.as_textregion));
 -	RETERR(mem_tobuffer(target, &c, 1));
 +	RETTOK(dns_secalg_fromtext(&alg, &token.value.as_textregion));
 +	RETERR(mem_tobuffer(target, &alg, 1));
 	/*
 	 * Labels.
@@ -67,8 +67,8 @@ fromtext_rrsig(ARGS_FROMTEXT) {
 				      false));
 	if (token.value.as_ulong > 0xffU)
 		RETTOK(ISC_R_RANGE);
 -	c = (unsigned char)token.value.as_ulong;
 -	RETERR(mem_tobuffer(target, &c, 1));
 +	labels = (unsigned char)token.value.as_ulong;
 +	RETERR(mem_tobuffer(target, &labels, 1));
 	/*
 	 * Original ttl.
@@ -131,11 +131,19 @@ fromtext_rrsig(ARGS_FROMTEXT) {
 	 */
 	RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_string,
 				      false));
 -	dns_name_init(&name, NULL);
 +	dns_name_init(&signer, NULL);
 	buffer_fromregion(&buffer, &token.value.as_region);
 	if (origin == NULL)
 		origin = dns_rootname;
 -	RETTOK(dns_name_fromtext(&name, &buffer, origin, options, target));
 +	RETTOK(dns_name_fromtext(&signer, &buffer, origin, options, target));
 +
 +	/*
 +	 * (RRSIG labels doesn't include the root label, so add one
 +	 * to normalize it before checking against the signer.)
 +	 */
 +	if ((unsigned int)(labels + 1) < dns_name_countlabels(&signer)) {
 +		RETTOK(ISC_R_RANGE);
 +	}
 	/*
 	 * Sig.
@@ -260,6 +268,7 @@ static inline isc_result_t
 fromwire_rrsig(ARGS_FROMWIRE) {
 	isc_region_t sr;
 	dns_name_t name;
 +	unsigned char labels;
 	REQUIRE(type == dns_rdatatype_rrsig);
@@ -281,6 +290,8 @@ fromwire_rrsig(ARGS_FROMWIRE) {
 	if (sr.length < 18)
 		return (ISC_R_UNEXPECTEDEND);
 +	labels = sr.base[3];
 +
 	isc_buffer_forward(source, 18);
 	RETERR(mem_tobuffer(target, sr.base, 18));
@@ -290,6 +301,14 @@ fromwire_rrsig(ARGS_FROMWIRE) {
 	dns_name_init(&name, NULL);
 	RETERR(dns_name_fromwire(&name, source, dctx, options, target));
 +	/*
 +	 * (RRSIG labels doesn't include the root label, so add one
 +	 * to normalize it before checking against the signer.)
 +	 */
 +	if ((unsigned int)(labels + 1) < dns_name_countlabels(&name)) {
 +		RETERR(DNS_R_FORMERR);
 +	}
 +
 	/*
 	 * Sig.
 	 */
--- a/SOURCES/bind-9.11-CVE-2026-13204.patch
+++ b/SOURCES/bind-9.11-CVE-2026-13204.patch
@ -1,154 +0,0 @@
 From 0be245b5c7641533fff2f808d19730e9766a9a36 Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Wed, 13 May 2026 20:45:57 -0700
 Subject: [PATCH] dns_rdataset_addnoqname() could find unsigned NSEC/NSEC3
 The dns_rdatalist addnoqname() implementation searches for the first
 NSEC or NSEC3 record in a message, then for the first RRSIG covering
 that type in the same message.  Previously, if no RRSIG for the type was
 found, the function accepted the unsigned record. Now, it will instead
 continue searching until an NSEC or NSEC3 that does have a matching
 signature is found.
 When this function is called from validated() in resolver.c, a
 non-success return code is now treated as an error instead of triggering
 an assertion failure.
 Fixes: isc-projects/bind9#5985
 (cherry picked from commit 57cba571ee31311e54d8a11cb38094d439f04e09)
 ---
 bin/named/query.c   |  4 +++-
 lib/dns/rbtdb.c     |  8 +++++---
 lib/dns/rdatalist.c | 36 +++++++++++++++++++++---------------
 lib/dns/resolver.c  |  4 +++-
 4 files changed, 32 insertions(+), 20 deletions(-)
 diff --git a/bin/named/query.c b/bin/named/query.c
 index e023d74..083ce83 100644
 --- a/bin/named/query.c
 +++ b/bin/named/query.c
@@ -6198,7 +6198,9 @@ query_addnoqnameproof(ns_client_t *client, dns_rdataset_t *rdataset) {
 		goto cleanup;
 	result = dns_rdataset_getnoqname(rdataset, fname, neg, negsig);
 -	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 +	if (result != ISC_R_SUCCESS) {
 +		goto cleanup;
 +	}
 	query_addrrset(client, &fname, &neg, &negsig, dbuf,
 		       DNS_SECTION_AUTHORITY);
 diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
 index 388ffdf..b7f21ac 100644
 --- a/lib/dns/rbtdb.c
 +++ b/lib/dns/rbtdb.c
@@ -6977,7 +6977,7 @@ static inline isc_result_t
 addnoqname(dns_rbtdb_t *rbtdb, rdatasetheader_t *newheader,
 	   dns_rdataset_t *rdataset)
 {
 -	struct noqname *noqname;
 +	struct noqname *noqname = NULL;
 	isc_mem_t *mctx = rbtdb->common.mctx;
 	dns_name_t name;
 	dns_rdataset_t neg, negsig;
@@ -6989,7 +6989,9 @@ addnoqname(dns_rbtdb_t *rbtdb, rdatasetheader_t *newheader,
 	dns_rdataset_init(&negsig);
 	result = dns_rdataset_getnoqname(rdataset, &name, &neg, &negsig);
 -	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 +	if (result != ISC_R_SUCCESS) {
 +		goto cleanup;
 +	}
 	noqname = isc_mem_get(mctx, sizeof(*noqname));
 	if (noqname == NULL) {
@@ -7021,7 +7023,7 @@ cleanup:
 	dns_rdataset_disassociate(&negsig);
 	if (noqname != NULL)
 		free_noqname(mctx, &noqname);
 -	return(result);
 +	return (result);
 }
 static inline isc_result_t
 diff --git a/lib/dns/rdatalist.c b/lib/dns/rdatalist.c
 index cc2619c..687953c 100644
 --- a/lib/dns/rdatalist.c
 +++ b/lib/dns/rdatalist.c
@@ -196,6 +196,7 @@ isc__rdatalist_addnoqname(dns_rdataset_t *rdataset, dns_name_t *name) {
 	dns_rdataset_t *neg = NULL;
 	dns_rdataset_t *negsig = NULL;
 	dns_rdataset_t *rdset;
 +	dns_rdataset_t *sigset;
 	dns_ttl_t ttl;
 	REQUIRE(rdataset != NULL);
@@ -204,26 +205,30 @@ isc__rdatalist_addnoqname(dns_rdataset_t *rdataset, dns_name_t *name) {
 	     rdset != NULL;
 	     rdset = ISC_LIST_NEXT(rdset, link))
 	{
 -		if (rdset->rdclass != rdataset->rdclass)
 +		if (rdset->rdclass != rdataset->rdclass ||
 +		    (rdset->type != dns_rdatatype_nsec &&
 +		     rdset->type != dns_rdatatype_nsec3))
 +		{
 			continue;
 -		if (rdset->type == dns_rdatatype_nsec ||
 -		    rdset->type == dns_rdatatype_nsec3)
 -			neg = rdset;
 +		}
 +
 +		for (sigset = ISC_LIST_HEAD(name->list); sigset != NULL;
 +		     sigset = ISC_LIST_NEXT(sigset, link))
 +		{
 +			if (sigset->type == dns_rdatatype_rrsig &&
 +			    sigset->covers == rdset->type)
 +			{
 +				neg = rdset;
 +				negsig = sigset;
 +				break;
 +			}
 +		}
 	}
 -	if (neg == NULL)
 -		return (ISC_R_NOTFOUND);
 -	for (rdset = ISC_LIST_HEAD(name->list);
 -	     rdset != NULL;
 -	     rdset = ISC_LIST_NEXT(rdset, link))
 -	{
 -		if (rdset->type == dns_rdatatype_rrsig &&
 -		    rdset->covers == neg->type)
 -			negsig = rdset;
 +	if (neg == NULL || negsig == NULL) {
 +		return (ISC_R_NOTFOUND);
 	}
 -	if (negsig == NULL)
 -		return (ISC_R_NOTFOUND);
 	/*
 	 * Minimise ttl.
 	 */
@@ -235,6 +240,7 @@ isc__rdatalist_addnoqname(dns_rdataset_t *rdataset, dns_name_t *name) {
 	rdataset->ttl = neg->ttl = negsig->ttl = ttl;
 	rdataset->attributes |= DNS_RDATASETATTR_NOQNAME;
 	rdataset->private6 = name;
 +
 	return (ISC_R_SUCCESS);
 }
 diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
 index 5331ea9..78553f6 100644
 --- a/lib/dns/resolver.c
 +++ b/lib/dns/resolver.c
@@ -5153,7 +5153,9 @@ validated(isc_task_t *task, isc_event_t *event) {
 	if (vevent->proofs[DNS_VALIDATOR_NOQNAMEPROOF] != NULL) {
 		result = dns_rdataset_addnoqname(vevent->rdataset,
 				   vevent->proofs[DNS_VALIDATOR_NOQNAMEPROOF]);
 -		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 +		if (result != ISC_R_SUCCESS) {
 +			goto noanswer_response;
 +		}
 		INSIST(vevent->sigrdataset != NULL);
 		vevent->sigrdataset->ttl = vevent->rdataset->ttl;
 		if (vevent->proofs[DNS_VALIDATOR_CLOSESTENCLOSER] != NULL) {
--- a/SOURCES/bind-9.11-CVE-2026-13321.patch
+++ b/SOURCES/bind-9.11-CVE-2026-13321.patch
@ -1,270 +0,0 @@
 From 338661714d508a810a903ae6fdaf522c9abc2d4b Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Ayd=C4=B1n=20Mercan?= <aydin@isc.org>
 Date: Thu, 7 May 2026 18:59:20 +0300
 Subject: [PATCH 1/2] Reject out-of-zone NSEC next owner names
 When verifying DNSSEC records, make sure that a next owner name of
 an NSEC record is a subdomain of the signer field.
 This follows the specification RFC 4034, section 4.1.1:
 Owner names of RRsets for which the given zone is not authoritative
 (such as glue records) MUST NOT be listed in the Next Domain Name
 unless at least one authoritative RRset exists at the same owner
 name.
 While the above paragraph is intended for glue records, it also
 applies to out-of-zone data.
 (cherry picked from commit 4065512d25b71605b9502bb69dfb903776d35aa9)
 ---
 lib/dns/dnssec.c             | 18 ++++++++++++++++++
 lib/dns/include/dns/dnssec.h |  6 ++++++
 2 files changed, 24 insertions(+)
 diff --git a/lib/dns/dnssec.c b/lib/dns/dnssec.c
 index b6b2405fac..b9bd374ed6 100644
 --- a/lib/dns/dnssec.c
 +++ b/lib/dns/dnssec.c
@@ -380,8 +380,10 @@ dns_dnssec_verify3(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
 		   bool ignoretime, unsigned int maxbits,
 		   isc_mem_t *mctx, dns_rdata_t *sigrdata, dns_name_t *wild)
 {
 +	dns_rdata_nsec_t nsec;
 	dns_rdata_rrsig_t sig;
 	dns_fixedname_t fnewname;
 +	dns_rdata_t rdata = DNS_RDATA_INIT;
 	isc_region_t r;
 	isc_buffer_t envbuf;
 	dns_rdata_t *rdatas;
@@ -454,6 +456,22 @@ dns_dnssec_verify3(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
 		break;
 	}
 +	/*
 +	 * Check for out of zone NSEC entries.
 +	 */
 +	if (set->type == dns_rdatatype_nsec) {
 +		if (dns_rdataset_first(set) != ISC_R_SUCCESS) {
 +			return (DNS_R_NOVALIDNSEC);
 +		}
 +		dns_rdataset_current(set, &rdata);
 +		if (dns_rdata_tostruct(&rdata, &nsec, NULL) != ISC_R_SUCCESS) {
 +			return (DNS_R_NOVALIDNSEC);
 +		}
 +		if (!dns_name_issubdomain(&nsec.next, &sig.signer)) {
 +			return (DNS_R_NOVALIDNSEC);
 +		}
 +	}
 +
 	/*
 	 * Is the key allowed to sign data?
 	 */
 diff --git a/lib/dns/include/dns/dnssec.h b/lib/dns/include/dns/dnssec.h
 index 31e2586c9b..1f13a08181 100644
 --- a/lib/dns/include/dns/dnssec.h
 +++ b/lib/dns/include/dns/dnssec.h
@@ -138,6 +138,9 @@ dns_dnssec_verify3(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
  *	this record, as this requires a resolver or database.
  *	If 'ignoretime' is true, temporal validity will not be checked.
  *
 + *	If 'set' is of type NSEC, this function also verifies that the
 + *	Next Name is a subdomain of the Signer's Name from 'sigrdata'.
 + *
  *	'maxbits' specifies the maximum number of rsa exponent bits accepted.
  *
  *	Requires:
@@ -160,6 +163,9 @@ dns_dnssec_verify3(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
  *\li		#DNS_R_KEYUNAUTHORIZED - the key cannot sign this data (either
  *			it is not a zone key or its flags prevent
  *			authentication)
 + *
 + *\li		#DNS_R_NOVALIDNSEC - the NSEC rdata is not valid
 + *\li		#DNS_R_KEYUNAUTHORIZED - the key cannot sign this data
  *\li		DST_R_*
  */
 From dfb91ca4a45092c414a41cb5640cf4710f7ba0e9 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Ayd=C4=B1n=20Mercan?= <aydin@isc.org>
 Date: Tue, 12 May 2026 14:54:09 +0300
 Subject: [PATCH 2/2] change dns_nsec_requiredtypespresent to dns_nsec_is_legal
 Change `dns_nsec_requiredtypespresent` to `dns_nsec_is_legal` as a
 function for checking multiple NSEC validity rules.
 Currently we now additionally check for out-of-zone NSEC entries.
 (cherry picked from commit be2a6a497312469890b552907d039d2de0b44ccc)
 ---
 lib/dns/include/dns/nsec.h | 18 ++++++++++++++
 lib/dns/nsec.c             | 37 +++++++++++++++++++++++++++
 lib/dns/resolver.c         | 51 ++++++++++++++++++++++++++++++++++++++
 3 files changed, 106 insertions(+)
 diff --git a/lib/dns/include/dns/nsec.h b/lib/dns/include/dns/nsec.h
 index 4e12cbea75..8caead6a1e 100644
 --- a/lib/dns/include/dns/nsec.h
 +++ b/lib/dns/include/dns/nsec.h
@@ -106,6 +106,24 @@ dns_nsec_noexistnodata(dns_rdatatype_t type, dns_name_t *name,
  * Return ISC_R_IGNORE when the NSEC is not the appropriate one.
  */
 +bool
 +dns_nsec_is_legal(dns_rdataset_t *rdataset, const dns_name_t *name);
 +/**<
 + * \brief
 + * Validates a rdataset of type NSEC.
 + *
 + * This functions checks for the following in the given rdataset:
 + * \li All NSEC records have both NSEC and RRSIG present
 + * \li All NSEC entries are under the `name`
 + *
 + * \par Requires:
 + * \li	rdataset to be a NSEC rdataset.
 + * \li  `name` is a valid dns_name_t
 + *
 + * \retval true if all the checks pass
 + * \retval false otherwise
 + */
 +
 ISC_LANG_ENDDECLS
 #endif /* DNS_NSEC_H */
 diff --git a/lib/dns/nsec.c b/lib/dns/nsec.c
 index d90c38589e..fd4c529da0 100644
 --- a/lib/dns/nsec.c
 +++ b/lib/dns/nsec.c
@@ -21,6 +21,7 @@
 #include <isc/util.h>
 #include <dns/db.h>
 +#include <dns/name.h>
 #include <dns/nsec.h>
 #include <dns/rdata.h>
 #include <dns/rdatalist.h>
@@ -445,3 +446,39 @@ dns_nsec_noexistnodata(dns_rdatatype_t type, dns_name_t *name,
 	*exists = false;
 	return (ISC_R_SUCCESS);
 }
 +
 +bool
 +dns_nsec_is_legal(dns_rdataset_t *nsecset, const dns_name_t *name) {
 +	dns_rdataset_t rdataset;
 +	dns_rdata_nsec_t nsec;
 +	isc_result_t result;
 +	bool found = false;
 +
 +	REQUIRE(nsecset != NULL && nsecset->type == dns_rdatatype_nsec);
 +
 +	dns_rdataset_init(&rdataset);
 +	dns_rdataset_clone(nsecset, &rdataset);
 +
 +	for (result = dns_rdataset_first(&rdataset); result == ISC_R_SUCCESS;
 +	     result = dns_rdataset_next(&rdataset))
 +	{
 +		dns_rdata_t rdata = DNS_RDATA_INIT;
 +		dns_rdataset_current(&rdataset, &rdata);
 +
 +		/* must never fail */
 +		result = dns_rdata_tostruct(&rdata, &nsec, NULL);
 +		INSIST(result == ISC_R_SUCCESS);
 +
 +		if (!dns_name_issubdomain(&nsec.next, name) ||
 +		    !dns_nsec_typepresent(&rdata, dns_rdatatype_rrsig) ||
 +		    !dns_nsec_typepresent(&rdata, dns_rdatatype_nsec))
 +		{
 +			dns_rdataset_disassociate(&rdataset);
 +			return (false);
 +		}
 +
 +		found = true;
 +	}
 +	dns_rdataset_disassociate(&rdataset);
 +	return (found);
 +}
 diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
 index 0f16eadcdd..8ef35bb641 100644
 --- a/lib/dns/resolver.c
 +++ b/lib/dns/resolver.c
@@ -62,8 +62,10 @@
 #include <dns/rootns.h>
 #include <dns/stats.h>
 #include <dns/tsig.h>
 +#include <dns/types.h>
 #include <dns/validator.h>
 +#include <dns/view.h>
 #include <dns/zone.h>
 #ifdef WANT_QUERYTRACE
 #define RTRACE(m)       isc_log_write(dns_lctx, \
@@ -4879,6 +4881,36 @@ maybe_destroy(fetchctx_t *fctx, bool locked) {
 	return (bucket_empty);
 }
 +static bool
 +get_and_check_signer_name(dns_name_t *signer, dns_rdataset_t *sigrdataset) {
 +	dns_rdata_rrsig_t rrsig;
 +	isc_result_t result;
 +	dns_rdata_t rdata;
 +
 +	if (dns_rdataset_first(sigrdataset) != ISC_R_SUCCESS) {
 +		return false;
 +	}
 +
 +	rdata = (dns_rdata_t)DNS_RDATA_INIT;
 +	dns_rdataset_current(sigrdataset, &rdata);
 +	result = dns_rdata_tostruct(&rdata, &rrsig, NULL);
 +	INSIST(result == ISC_R_SUCCESS);
 +	dns_name_copy(&rrsig.signer, signer, NULL);
 +
 +	while (dns_rdataset_next(sigrdataset) == ISC_R_SUCCESS) {
 +		rdata = (dns_rdata_t)DNS_RDATA_INIT;
 +		dns_rdataset_current(sigrdataset, &rdata);
 +		result = dns_rdata_tostruct(&rdata, &rrsig, NULL);
 +		INSIST(result == ISC_R_SUCCESS);
 +
 +		if (!dns_name_equal(signer, &rrsig.signer)) {
 +			return false;
 +		}
 +	}
 +
 +	return true;
 +}
 +
 /*
  * The validator has finished.
  */
@@ -4907,6 +4939,8 @@ validated(isc_task_t *task, isc_event_t *event) {
 	unsigned options;
 	uint32_t bucketnum;
 	dns_message_t *rmessage = NULL;
 +	dns_fixedname_t fsigner;
 +	dns_name_t *signer = NULL;
 	UNUSED(task); /* for now */
@@ -5240,6 +5274,23 @@ validated(isc_task_t *task, isc_event_t *event) {
 			if (sigrdataset == NULL ||
 			    sigrdataset->trust != dns_trust_secure)
 				continue;
 +			/*
 +			 * Don't cache if all the RRSIGs don't have the same
 +			 * signer.
 +			 */
 +			signer = dns_fixedname_initname(&fsigner);
 +			if (!get_and_check_signer_name(signer, sigrdataset)) {
 +				continue;
 +			}
 +			/*
 +			 * Don't cache NSEC if missing NSEC or RRSIG
 +			 * types.
 +			 */
 +			if (rdataset->type == dns_rdatatype_nsec &&
 +			    !dns_nsec_is_legal(rdataset, signer))
 +			{
 +				continue;
 +			}
 			result = dns_db_findnode(fctx->cache, name, true,
 						 &nsnode);
 			if (result != ISC_R_SUCCESS)
--- a/SOURCES/bind-9.11-CVE-2026-5946.patch
+++ b/SOURCES/bind-9.11-CVE-2026-5946.patch
@ -1,512 +0,0 @@
 From de237c66c901b451e4957a28e0d953c57648eab9 Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Tue, 3 Mar 2026 14:00:38 -0800
 Subject: [PATCH] Disable recursion for non-IN classes
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Force recursion off, and set allow-recursion/allow-recursion-on ACLs
 to none, for views with a class other than IN. Log a configuration
 warning if recursion is explicitly enabled for a non-IN view.
 This addresses YWH-PGM40640-74 and YWH-PGM40640-75 by preventing any
 attempt at recursive processing in a class-CHAOS view, ensuring that
 server addresses used for recursive queries and received in recursive
 responses are of the expected format.
 Fixes: isc-projects/bind9#5780
 Fixes: isc-projects/bind9#5781
 (cherry picked from commit 70532a37a1aec761e8a12444852866ce9d9d5fcc)
 (cherry picked from commit cf0d5a4e385525e21f2ae39098b1ab90c1137a2a)
 (cherry picked from commit c6b05d8449d94c74e85be70b822b7ad439abca40)
 Disable UPDATE and NOTIFY for non-IN classes
 Return NOTIMP for UPDATE and NOTIFY requests received for views with a
 class other than IN.  Only QUERY is now supported for non-IN views such
 as CHAOS.
 When running dns dns_rdata_tostruct() with types that are only defined
 for class IN, ensure that the class is correct before proceeding.
 Add an assertion that any zone being updated is of class IN. (Note
 that previously, a DLZ zone could have its class value set incorrectly
 to NONE; this has been fixed.)
 This addresses YWH-PGM40640-70 and YWH-PGM40640-73 (as well as any
 similar problems that might have occurred in the future) by minimizing
 the code paths that can be reached by rdata classes other than IN, so it
 is safe for the implementation to assume that rdatatypes that are only
 defined for class IN, such as SVCB or WKS, have been parsed and
 validated, and not accepted as unknown/opaque data.
 Fixes: isc-projects/bind9#5777
 Fixes: isc-projects/bind9#5779
 (cherry picked from commit 9ae24c32bec16c0f64225ef04f34670018bf0765)
 (cherry picked from commit a2ca2408b3ff031c426c5dc785f550c9d30bf4aa)
 (cherry picked from commit f107b702c4ff4a68042d0dad8384544dd99954a8)
 Validate DNS message CLASS early in request processing
 Reject requests with unsupported or misused CLASS values before
 further processing.  Only IN, CH, HS, RESERVED0 (for DNS Cookies),
 ANY (for TKEY negotiation), and NONE (for DNS UPDATE) are accepted;
 all other classes return NOTIMP.  Misuse of NONE or ANY outside
 their allowed contexts returns FORMERR.
 This adds further protection against bugs of the same general class
 as YWH-PGM40640-70 and YWH-PGM40640-73.
 (cherry picked from commit d41865a458b9ecd76be4097ac1bea1005cad72db)
 (cherry picked from commit 1c8016c91c3674929f87cbe7ad09f3670e05ad4e)
 (cherry picked from commit 6c50d4812c35fe982614cd53355c4048ab09267a)
 Reject meta-classes in UPDATE and NOTIFY messages
 NOTIFY and UPDATE messages must specify a data class in the
 QUESTION/ZONE section.  NONE and ANY are meta-classes and not
 appropriate here.  Return FORMERR if either is used.
 Rejecting messages with a query class of NONE addresses YWH-PGM40640-72,
 YWH-PGM40640-82, and YWH-PGM40640-83.  Rejecting messages with a query
 class of ANY addresses YWH-PGM40640-87, YWH-PGM40640-88, and
 YWH-PGM40640-117.
 Fixes: isc-projects/bind9#5778
 Fixes: isc-projects/bind9#5782
 Fixes: isc-projects/bind9#5783
 Fixes: isc-projects/bind9#5797
 Fixes: isc-projects/bind9#5798
 Fixes: isc-projects/bind9#5853
 (cherry picked from commit 7de5160517ae69196d1c323b8627b267cdd10761)
 (cherry picked from commit 3c44de9e6252ec1c7742ef02ecc0d6cbf1cde5e9)
 (cherry picked from commit f7d5fe628c220245a14397207893424f0b27ff53)
 Skip "deny-answer-address" for non-IN addresses
 Ensure that we don't attempt an ACL match for answer addresses
 when handling a class-CHAOS zone. This is an additional line of
 defense for YWH-PGM40640-74.
 (cherry picked from commit 4cd3d8e6d866143ddc62df821a1007bf3ee7f083)
 (cherry picked from commit fa60101e910346e64fa2a684b903fbcb84d8243b)
 (cherry picked from commit c01d298f53b0ffbf38bf19867f368f60a9ea4ecf)
 Pass empty string instead of NULL to ns_client_dumpmessage()
 The two new call sites added by the CLASS-validation work passed NULL
 as the reason, but ns_client_dumpmessage() bails out early on a NULL
 reason — so the message dump never happened. The intent was to dump
 the message and let the follow-up ns_client_log() carry the reason
 text, so pass "" to suppress the prefix without short-circuiting the
 dump.
 (cherry picked from commit 8af39c360407a92ef31bf233b9df760d1bb9fb5f)
 (cherry picked from commit 4d7e442c9aee72851f2b2d973273ebc92da42cf0)
 %RH
 Backport fixes.
 ---
 bin/named/client.c                | 56 +++++++++++++++++++++++++++++--
 bin/named/server.c                | 38 ++++++---------------
 bin/named/update.c                | 31 +++++++++--------
 bin/tests/system/unknown/tests.sh | 12 +++----
 lib/dns/adb.c                     |  2 +-
 lib/dns/message.c                 | 11 ++++++
 lib/dns/resolver.c                | 13 +++++--
 7 files changed, 109 insertions(+), 54 deletions(-)
 diff --git a/bin/named/client.c b/bin/named/client.c
 index ea121b301e..6990e02b03 100644
 --- a/bin/named/client.c
 +++ b/bin/named/client.c
@@ -40,6 +40,7 @@
 #include <dns/dnstap.h>
 #include <dns/cache.h>
 #include <dns/edns.h>
 +#include <dns/enumclass.h>
 #include <dns/events.h>
 #include <dns/message.h>
 #include <dns/peer.h>
@@ -2829,7 +2830,9 @@ client_request(isc_task_t *task, isc_event_t *event) {
 			goto cleanup;
 	}
 -	if (client->message->rdclass == 0) {
 +	char classbuf[DNS_RDATACLASS_FORMATSIZE];
 +	switch (client->message->rdclass) {
 +	case dns_rdataclass_reserved0:
 		if ((client->attributes & NS_CLIENTATTR_WANTCOOKIE) != 0 &&
 		    client->message->opcode == dns_opcode_query &&
 		    client->message->counts[DNS_SECTION_QUESTION] == 0U)
@@ -2851,6 +2854,44 @@ client_request(isc_task_t *task, isc_event_t *event) {
 				      "message class could not be determined");
 		ns_client_error(client, notimp ? DNS_R_NOTIMP : DNS_R_FORMERR);
 		goto cleanup;
 +	case dns_rdataclass_in:
 +		break;
 +	case dns_rdataclass_chaos:
 +		break;
 +	case dns_rdataclass_hs:
 +		break;
 +	case dns_rdataclass_none:
 +		if (client->message->opcode != dns_opcode_update) {
 +			ns_client_dumpmessage(client,
 +					      "message class NONE can be only "
 +					      "used in DNS updates");
 +			ns_client_error(client, DNS_R_FORMERR);
 +			return;
 +		}
 +		break;
 +	case dns_rdataclass_any:
 +		/*
 +		 * Required for TKEY negotiation.
 +		 */
 +		if (client->message->tkey == 0) {
 +			ns_client_dumpmessage(client,
 +					      "message class ANY can be only "
 +					      "used for TKEY negotiation");
 +			ns_client_error(client, DNS_R_FORMERR);
 +			return;
 +		}
 +		break;
 +	default:
 +		dns_rdataclass_format(client->message->rdclass, classbuf,
 +				      sizeof(classbuf));
 +		ns_client_dumpmessage(client, "");
 +		ns_client_log(client, NS_LOGCATEGORY_CLIENT,
 +			      NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(1),
 +			      "message class could not be determined");
 +		ns_client_dumpmessage(client, "message class could not be "
 +					      "determined");
 +		ns_client_error(client, DNS_R_NOTIMP);
 +		goto cleanup;
 	}
 	/*
@@ -2969,7 +3010,7 @@ client_request(isc_task_t *task, isc_event_t *event) {
 		ns_client_log(client, NS_LOGCATEGORY_CLIENT,
 			      NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(1),
 			      "no matching view in class '%s'", classname);
 -		ns_client_dumpmessage(client, "no matching view in class");
 +		ns_client_dumpmessage(client, "");
 		ns_client_error(client, notimp ? DNS_R_NOTIMP : DNS_R_REFUSED);
 		goto cleanup;
 	}
@@ -3149,11 +3190,19 @@ client_request(isc_task_t *task, isc_event_t *event) {
 		break;
 	case dns_opcode_update:
 		CTRACE("update");
 +		if (client->view->rdclass != dns_rdataclass_in) {
 +			ns_client_error(client, DNS_R_NOTIMP);
 +			break;
 +		}
 		ns_client_settimeout(client, 60);
 		ns_update_start(client, sigresult);
 		break;
 	case dns_opcode_notify:
 		CTRACE("notify");
 +		if (client->view->rdclass != dns_rdataclass_in) {
 +			ns_client_error(client, DNS_R_NOTIMP);
 +			break;
 +		}
 		ns_client_settimeout(client, 60);
 		ns_notify_start(client);
 		break;
@@ -4241,8 +4290,9 @@ ns_client_dumpmessage(ns_client_t *client, const char *reason) {
 	int len = 1024;
 	isc_result_t result;
 -	if (!isc_log_wouldlog(ns_g_lctx, ISC_LOG_DEBUG(1)))
 +	if (!isc_log_wouldlog(ns_g_lctx, ISC_LOG_DEBUG(1)) || reason == NULL) {
 		return;
 +	}
 	/*
 	 * Note that these are multiline debug messages.  We want a newline
 diff --git a/bin/named/server.c b/bin/named/server.c
 index 2086e41ca9..be521f6cf2 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
@@ -1756,6 +1756,7 @@ dlzconfigure_callback(dns_view_t *view, dns_dlzdb_t *dlzdb, dns_zone_t *zone) {
 	dns_rdataclass_t zclass = view->rdclass;
 	isc_result_t result;
 +	dns_zone_setclass(zone, zclass);
 	result = dns_zonemgr_managezone(ns_g_server->zonemgr, zone);
 	if (result != ISC_R_SUCCESS)
 		return (result);
@@ -4170,32 +4171,14 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 		CHECK(configure_alternates(config, view, alternates));
 	/*
 -	 * We have default hints for class IN if we need them.
 +	 * We have default root hints for class IN if we need them.
 +	 * Each view gets its own rootdb so a priming response only
 +	 * writes into that view's copy.  Other classes don't support
 +	 * recursion and don't need hints.
 	 */
 	if (view->rdclass == dns_rdataclass_in && view->hints == NULL)
 		dns_view_sethints(view, ns_g_server->in_roothints);
 -	/*
 -	 * If we still have no hints, this is a non-IN view with no
 -	 * "hints zone" configured.  Issue a warning, except if this
 -	 * is a root server.  Root servers never need to consult
 -	 * their hints, so it's no point requiring users to configure
 -	 * them.
 -	 */
 -	if (view->hints == NULL) {
 -		dns_zone_t *rootzone = NULL;
 -		(void)dns_view_findzone(view, dns_rootname, &rootzone);
 -		if (rootzone != NULL) {
 -			dns_zone_detach(&rootzone);
 -			need_hints = false;
 -		}
 -		if (need_hints)
 -			isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
 -				      NS_LOGMODULE_SERVER, ISC_LOG_WARNING,
 -				      "no root hints for view '%s'",
 -				      view->name);
 -	}
 -
 	/*
 	 * Configure the view's TSIG keys.
 	 */
@@ -4302,7 +4285,8 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	obj = NULL;
 	result = ns_config_get(maps, "recursion", &obj);
 	INSIST(result == ISC_R_SUCCESS);
 -	view->recursion = cfg_obj_asboolean(obj);
 +	view->recursion = (view->rdclass == dns_rdataclass_in &&
 +			   cfg_obj_asboolean(obj));
 	obj = NULL;
 	result = ns_config_get(maps, "auth-nxdomain", &obj);
@@ -4409,10 +4393,10 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 				 "allow-query-cache", NULL, actx,
 				 ns_g_mctx, &view->cacheacl));
 -	if (strcmp(view->name, "_bind") != 0 &&
 -	    view->rdclass != dns_rdataclass_chaos)
 -	{
 -		/* named.conf only */
 +	if (view->rdclass != dns_rdataclass_in) {
 +		dns_acl_none(ns_g_mctx, &view->recursionacl);
 +		dns_acl_none(ns_g_mctx, &view->recursiononacl);
 +	} else {
 		CHECK(configure_view_acl(vconfig, config, NULL,
 					 "allow-recursion", NULL, actx,
 					 ns_g_mctx, &view->recursionacl));
 diff --git a/bin/named/update.c b/bin/named/update.c
 index 407ac38272..be469f8e91 100644
 --- a/bin/named/update.c
 +++ b/bin/named/update.c
@@ -1269,7 +1269,10 @@ replaces_p(dns_rdata_t *update_rr, dns_rdata_t *db_rr) {
 		    dbsig.algorithm == updatesig.algorithm)
 			return (true);
 	}
 -	if (db_rr->type == dns_rdatatype_wks) {
 +
 +	if (db_rr->rdclass == dns_rdataclass_in &&
 +	    db_rr->type == dns_rdatatype_wks)
 +	{
 		/*
 		 * Compare the address and protocol fields only.  These
 		 * form the first five bytes of the RR data.  Do a
@@ -1412,8 +1415,7 @@ add_rr_prepare_action(void *data, rr_t *rr) {
  * 'rdata', and 'ttl', respectively.
  */
 static void
 -get_current_rr(dns_message_t *msg, dns_section_t section,
 -	       dns_rdataclass_t zoneclass, dns_name_t **name,
 +get_current_rr(dns_message_t *msg, dns_section_t section, dns_name_t **name,
 	       dns_rdata_t *rdata, dns_rdatatype_t *covers,
 	       dns_ttl_t *ttl, dns_rdataclass_t *update_class)
 {
@@ -1430,7 +1432,7 @@ get_current_rr(dns_message_t *msg, dns_section_t section,
 	dns_rdataset_current(rdataset, rdata);
 	INSIST(dns_rdataset_next(rdataset) == ISC_R_NOMORE);
 	*update_class = rdata->rdclass;
 -	rdata->rdclass = zoneclass;
 +	rdata->rdclass = dns_rdataclass_in;
 }
 /*%
@@ -1580,7 +1582,7 @@ send_update_event(ns_client_t *client, dns_zone_t *zone) {
 		dns_rdata_t rdata = DNS_RDATA_INIT;
 		dns_ttl_t ttl;
 		dns_rdataclass_t update_class;
 -		get_current_rr(request, DNS_SECTION_UPDATE, zoneclass,
 +		get_current_rr(request, DNS_SECTION_UPDATE,
 			       &name, &rdata, &covers, &ttl, &update_class);
 		if (! dns_name_issubdomain(name, zonename))
@@ -1812,6 +1814,9 @@ send_update_event(ns_client_t *client, dns_zone_t *zone) {
 		CHECK(DNS_R_DROP);
 	}
 +	/* Updates are only supported for class IN. */
 +	INSIST(dns_zone_getclass(zone) == dns_rdataclass_in);
 +
 	event = (update_event_t *)
 		isc_event_allocate(client->mctx, client, DNS_EVENT_UPDATE,
 				   update_action, NULL, sizeof(*event));
@@ -2798,7 +2803,6 @@ update_action(isc_task_t *task, isc_event_t *event) {
 	isc_mem_t *mctx = client->mctx;
 	dns_rdatatype_t covers;
 	dns_message_t *request = client->message;
 -	dns_rdataclass_t zoneclass;
 	dns_name_t *zonename = NULL;
 	dns_ssutable_t *ssutable = NULL;
 	dns_fixedname_t tmpnamefixed;
@@ -2819,10 +2823,10 @@ update_action(isc_task_t *task, isc_event_t *event) {
 	CHECK(dns_zone_getdb(zone, &db));
 	zonename = dns_db_origin(db);
 -	zoneclass = dns_db_class(db);
 	dns_zone_getssutable(zone, &ssutable);
 	options = dns_zone_getoptions(zone);
 +	INSIST(dns_zone_getclass(zone) == dns_rdataclass_in);
 	/*
 	 * Get old and new versions now that queryacl has been checked.
 	 */
@@ -2843,8 +2847,8 @@ update_action(isc_task_t *task, isc_event_t *event) {
 		dns_rdataclass_t update_class;
 		bool flag;
 -		get_current_rr(request, DNS_SECTION_PREREQUISITE, zoneclass,
 -			       &name, &rdata, &covers, &ttl, &update_class);
 +		get_current_rr(request, DNS_SECTION_PREREQUISITE, &name, &rdata,
 +			       &covers, &ttl, &update_class);
 		if (ttl != 0)
 			PREREQFAILC(DNS_R_FORMERR,
@@ -2902,7 +2906,7 @@ update_action(isc_task_t *task, isc_event_t *event) {
 						     "satisfied");
 				}
 			}
 -		} else if (update_class == zoneclass) {
 +		} else if (update_class == dns_rdataclass_in) {
 			/* "temp<rr.name, rr.type> += rr;" */
 			result = temp_append(&temp, name, &rdata);
 			if (result != ISC_R_SUCCESS) {
@@ -2960,11 +2964,10 @@ update_action(isc_task_t *task, isc_event_t *event) {
 		dns_rdataclass_t update_class;
 		bool flag;
 -		get_current_rr(request, DNS_SECTION_UPDATE, zoneclass,
 -			       &name, &rdata, &covers, &ttl, &update_class);
 -
 -		if (update_class == zoneclass) {
 +		get_current_rr(request, DNS_SECTION_UPDATE, &name,
 +			       &rdata, &covers, &ttl, &update_class);
 +		if (update_class == dns_rdataclass_in) {
 			/*
 			 * RFC1123 doesn't allow MF and MD in master zones.
 			 */
 diff --git a/bin/tests/system/unknown/tests.sh b/bin/tests/system/unknown/tests.sh
 index deb9a419ab..a6ceb7c69b 100644
 --- a/bin/tests/system/unknown/tests.sh
 +++ b/bin/tests/system/unknown/tests.sh
@@ -73,8 +73,8 @@ echo_i "querying for various representations of a CLASS10 TYPE1 record"
 for i in 1 2
 do
 	ret=0
 -	$DIG +short $DIGOPTS @10.53.0.1 a$i.example a class10 > dig.out || ret=1
 -	echo '\# 4 0A000001' | $DIFF - dig.out || ret=1
 +	$DIG $DIGOPTS @10.53.0.1 a$i.example a class10 > dig.out || ret=1
 +        grep -q "NOTIMP" dig.out || ret=1
 	if [ $ret != 0 ]
 	then
 		echo_i "#$i failed"
@@ -86,8 +86,8 @@ echo_i "querying for various representations of a CLASS10 TXT record"
 for i in 1 2 3 4
 do
 	ret=0
 -	$DIG +short $DIGOPTS @10.53.0.1 txt$i.example txt class10 > dig.out || ret=1
 -	echo '"hello"' | $DIFF - dig.out || ret=1
 +	$DIG $DIGOPTS @10.53.0.1 txt$i.example txt class10 > dig.out || ret=1
 +        grep -q "NOTIMP" dig.out || ret=1
 	if [ $ret != 0 ]
 	then
 		echo_i "#$i failed"
@@ -99,8 +99,8 @@ echo_i "querying for various representations of a CLASS10 TYPE123 record"
 for i in 1 2
 do
 	ret=0
 -	$DIG +short $DIGOPTS @10.53.0.1 unk$i.example type123 class10 > dig.out || ret=1
 -	echo '\# 1 00' | $DIFF - dig.out || ret=1
 +	$DIG $DIGOPTS @10.53.0.1 unk$i.example type123 class10 > dig.out || ret=1
 +        grep -q "NOTIMP" dig.out || ret=1
 	if [ $ret != 0 ]
 	then
 		echo_i "#$i failed"
 diff --git a/lib/dns/adb.c b/lib/dns/adb.c
 index e12c804f2b..25cfa32873 100644
 --- a/lib/dns/adb.c
 +++ b/lib/dns/adb.c
@@ -892,7 +892,7 @@ import_rdataset(dns_adbname_t *adbname, dns_rdataset_t *rdataset,
 	INSIST(DNS_ADB_VALID(adb));
 	rdtype = rdataset->type;
 -	INSIST((rdtype == dns_rdatatype_a) || (rdtype == dns_rdatatype_aaaa));
 +	REQUIRE(rdtype == dns_rdatatype_a || rdtype == dns_rdatatype_aaaa);
 	if (rdtype == dns_rdatatype_a)
 		findoptions = DNS_ADBFIND_INET;
 	else
 diff --git a/lib/dns/message.c b/lib/dns/message.c
 index 5603bcadf9..f9e3163d71 100644
 --- a/lib/dns/message.c
 +++ b/lib/dns/message.c
@@ -1179,6 +1179,17 @@ getquestions(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
 		rdtype = isc_buffer_getuint16(source);
 		rdclass = isc_buffer_getuint16(source);
 +		/*
 +		 * Notify and update messages need to specify the data class.
 +		 */
 +		if ((msg->opcode == dns_opcode_update ||
 +		     msg->opcode == dns_opcode_notify) &&
 +		    (rdclass == dns_rdataclass_none ||
 +		     rdclass == dns_rdataclass_any))
 +		{
 +			DO_ERROR(DNS_R_FORMERR);
 +		}
 +
 		/*
 		 * If this class is different than the one we already read,
 		 * this is an error.
 diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
 index 1c704551aa..5331ea9dd2 100644
 --- a/lib/dns/resolver.c
 +++ b/lib/dns/resolver.c
@@ -6514,9 +6514,16 @@ is_answeraddress_allowed(dns_view_t *view, dns_name_t *name,
 	}
 	/*
 -	 * Otherwise, search the filter list for a match for each address
 -	 * record.  If a match is found, the address should be filtered,
 -	 * so should the entire answer.
 +	 * deny-answer-address doesn't apply to non-IN classes.
 +	 */
 +	if (rdataset->rdclass != dns_rdataclass_in) {
 +		return true;
 +	}
 +
 +	/*
 +	 * Otherwise, search the filter list for a match for each
 +	 * address record.  If a match is found, the address should be
 +	 * filtered, so should the entire answer.
 	 */
 	for (result = dns_rdataset_first(rdataset);
 	     result == ISC_R_SUCCESS;
 -- 
 2.54.0
--- a/SOURCES/bind-9.11-d-max-records-checkconf.patch
+++ b/SOURCES/bind-9.11-d-max-records-checkconf.patch
@ -1,61 +0,0 @@
 From 83f283c3aeae99570c9e4c20f10e92ba565fc4be Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Tue, 7 Oct 2025 16:18:03 +0200
 Subject: [PATCH] Implement settings limits also in named-checkconf
 Read and parse max-records-per-type and max-types-per-name options in
 case -z parameter is passed.
 ---
 bin/check/named-checkconf.c | 27 +++++++++++++++++++++++++--
 1 file changed, 25 insertions(+), 2 deletions(-)
 diff --git a/bin/check/named-checkconf.c b/bin/check/named-checkconf.c
 index e5afd52..42ef76c 100644
 --- a/bin/check/named-checkconf.c
 +++ b/bin/check/named-checkconf.c
@@ -415,6 +415,24 @@ configure_zone(const char *vclass, const char *view,
 	return (result);
 }
 +/* Red Hat 9.11 specific extension. */
 +static void
 +configure_maxrecords(const cfg_obj_t *voptions)
 +{
 +	cfg_obj_t *obj;
 +	isc_result_t result;
 +
 +	obj = NULL;
 +	result = cfg_map_get(voptions, "max-records-per-type", &obj);
 +	if (result == ISC_R_SUCCESS)
 +		dns_db_setmaxrrperset(cfg_obj_asuint32(obj));
 +
 +	obj = NULL;
 +	result = cfg_map_get(voptions, "max-types-per-name", &obj);
 +	if (result == ISC_R_SUCCESS)
 +		dns_db_setmaxtypepername(cfg_obj_asuint32(obj));
 +}
 +
 /*% configure a view */
 static isc_result_t
 configure_view(const char *vclass, const char *view, const cfg_obj_t *config,
@@ -431,10 +449,15 @@ configure_view(const char *vclass, const char *view, const cfg_obj_t *config,
 		voptions = cfg_tuple_get(vconfig, "options");
 	zonelist = NULL;
 -	if (voptions != NULL)
 +	if (voptions != NULL) {
 		(void)cfg_map_get(voptions, "zone", &zonelist);
 -	else
 +		configure_maxrecords(voptions);
 +	} else {
 		(void)cfg_map_get(config, "zone", &zonelist);
 +		tresult = cfg_map_get(config, "options", &voptions);
 +		if (tresult == ISC_R_SUCCESS)
 +			configure_maxrecords(voptions);
 +	}
 	for (element = cfg_list_first(zonelist);
 	     element != NULL;
 -- 
 2.51.0
--- a/SOURCES/bind-9.11-d-max-records-per-type.patch
+++ b/SOURCES/bind-9.11-d-max-records-per-type.patch
@ -1,250 +0,0 @@
 From e0238189d03dc0a6b6092180ba52e74a26816422 Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Thu, 10 Jul 2025 17:31:35 +0200
 Subject: [PATCH] Minimalistic support for max-records-per-type option
 Just propagate the number to rbtdb in addition to environment. Make
 environment preferred of both used, because default configuration value
 would override already changed default.
 Allow also 0 value from the environment.
 ---
 bin/named/config.c              |  1 +
 bin/named/named.conf.docbook    |  1 +
 bin/named/server.c              |  9 +++++++++
 doc/arm/Bv9ARM-book.xml         | 18 ++++++++++++++++++
 lib/dns/db.c                    |  6 +++++-
 lib/dns/include/dns/db.h        | 10 ++++++++++
 lib/dns/include/dns/rdataslab.h |  6 ++++++
 lib/dns/rbtdb.c                 | 18 +++++++++++++++++-
 lib/dns/rbtdb.h                 | 10 ++++++++++
 lib/dns/rbtdb64.h               |  3 +++
 lib/isccfg/namedconf.c          |  1 +
 11 files changed, 81 insertions(+), 2 deletions(-)
 diff --git a/bin/named/config.c b/bin/named/config.c
 index e3731cf..27cf9ee 100644
 --- a/bin/named/config.c
 +++ b/bin/named/config.c
@@ -243,6 +243,7 @@ options {\n\
 #	max-ixfr-log-size <obsolete>\n\
 	max-journal-size unlimited;\n\
 	max-records 0;\n\
 +	max-records-per-type 100;\n\
 	max-refresh-time 2419200; /* 4 weeks */\n\
 	max-retry-time 1209600; /* 2 weeks */\n\
 	max-transfer-idle-in 60;\n\
 diff --git a/bin/named/named.conf.docbook b/bin/named/named.conf.docbook
 index 31fac33..d7934c7 100644
 --- a/bin/named/named.conf.docbook
 +++ b/bin/named/named.conf.docbook
@@ -338,6 +338,7 @@ options {
 	max-journal-size ( unlimited | <replaceable>sizeval</replaceable> );
 	max-ncache-ttl <replaceable>integer</replaceable>;
 	max-records <replaceable>integer</replaceable>;
 +	max-records-per-type <replaceable>integer</replaceable>;
 	max-recursion-depth <replaceable>integer</replaceable>;
 	max-recursion-queries <replaceable>integer</replaceable>;
 	max-refresh-time <replaceable>integer</replaceable>;
 diff --git a/bin/named/server.c b/bin/named/server.c
 index afdc4fa..2e88df7 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
@@ -4606,6 +4606,15 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 					cfg_obj_asuint32(obj),
 					max_clients_per_query);
 +	/*
 +	 * This is used for the cache and also as a default value
 +	 * for zone databases.
 +	 */
 +	obj = NULL;
 +	result = ns_config_get(maps, "max-records-per-type", &obj);
 +	INSIST(result == ISC_R_SUCCESS);
 +	dns_db_setmaxrrperset(cfg_obj_asuint32(obj));
 +
 	obj = NULL;
 	result = ns_config_get(maps, "max-recursion-depth", &obj);
 	INSIST(result == ISC_R_SUCCESS);
 diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
 index 563dced..25acad0 100644
 --- a/doc/arm/Bv9ARM-book.xml
 +++ b/doc/arm/Bv9ARM-book.xml
@@ -8318,6 +8318,24 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
 	      </listitem>
 	    </varlistentry>
 +	    <varlistentry>
 +	      <term><command>max-records-per-type</command></term>
 +	      <listitem>
 +		<para>
 +		This sets the maximum number of resource records that can be stored
 +		in an RRset in a database. Can be configured in <option>options</option>,
 +		only.
 +		</para>
 +
 +		<para>
 +		   If set to a positive value, any attempt to cache or to add to a zone
 +		   an RRset with more than the specified number of records will result in
 +		   a failure.  If set to 0, there is no cap on RRset size.  The default is
 +		   <literal>100</literal>.
 +		</para>
 +	      </listitem>
 +	    </varlistentry>
 +
 	    <varlistentry>
 	      <term><command>recursive-clients</command></term>
 	      <listitem>
 diff --git a/lib/dns/db.c b/lib/dns/db.c
 index c581646..9e7632a 100644
 --- a/lib/dns/db.c
 +++ b/lib/dns/db.c
@@ -1130,7 +1130,6 @@ dns_db_nodefullname(dns_db_t *db, dns_dbnode_t *node, dns_name_t *name) {
 		return (ISC_R_NOTIMPLEMENTED);
 	return ((db->methods->nodefullname)(db, node, name));
 }
 -
 isc_result_t
 dns_db_setservestalettl(dns_db_t *db, dns_ttl_t ttl)
 {
@@ -1152,3 +1151,8 @@ dns_db_getservestalettl(dns_db_t *db, dns_ttl_t *ttl)
 		return ((db->methods->getservestalettl)(db, ttl));
 	return (ISC_R_NOTIMPLEMENTED);
 }
 +void
 +dns_db_setmaxrrperset(uint32_t maxrrperset) {
 +	dns_rbtdb_setmaxrrperset(maxrrperset);
 +	dns_rbtdb64_setmaxrrperset(maxrrperset);
 +}
 diff --git a/lib/dns/include/dns/db.h b/lib/dns/include/dns/db.h
 index 452770f..6357bfd 100644
 --- a/lib/dns/include/dns/db.h
 +++ b/lib/dns/include/dns/db.h
@@ -1718,6 +1718,16 @@ dns_db_getservestalettl(dns_db_t *db, dns_ttl_t *ttl);
  * \li	#ISC_R_NOTIMPLEMENTED - Not supported by this DB implementation.
  */
 +void
 +dns_db_setmaxrrperset(uint32_t maxrrperset);
 +/*%<
 + *     Sets the maximum number of records per rrset permitted in a database.
 + *     0 implies unlimited.
 + *
 + * Returns:
 + *\li  void
 + */
 +
 ISC_LANG_ENDDECLS
 #endif /* DNS_DB_H */
 diff --git a/lib/dns/include/dns/rdataslab.h b/lib/dns/include/dns/rdataslab.h
 index f38d539..40c40a8 100644
 --- a/lib/dns/include/dns/rdataslab.h
 +++ b/lib/dns/include/dns/rdataslab.h
@@ -173,6 +173,12 @@ dns_rdataslab_equalx(unsigned char *slab1, unsigned char *slab2,
  *\li	true if the slabs are equal, #false otherwise.
  */
 +void
 +dns_rdataslab_setmaxrrperset(uint32_t maxrrperset);
 +/*%<
 + * Set global limit of max-records-per-type value.
 + */
 +
 ISC_LANG_ENDDECLS
 #endif /* DNS_RDATASLAB_H */
 diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
 index 5263e7c..388ffdf 100644
 --- a/lib/dns/rbtdb.c
 +++ b/lib/dns/rbtdb.c
@@ -981,6 +981,7 @@ static bool match_header_version(rbtdb_file_header_t *header);
 /* Pad to 32 bytes */
 static char FILE_VERSION[32] = "\0";
 +
 /*%
  * 'init_count' is used to initialize 'newheader->count' which inturn
  * is used to determine where in the cycle rrset-order cyclic starts.
@@ -6321,6 +6322,19 @@ update_recordsandbytes(bool add, rbtdb_version_t *rbtversion,
 #endif /* DNS_RBTDB_MAX_RTYPES */
 static uint32_t dns_g_rbtdb_max_rtypes = DNS_RBTDB_MAX_RTYPES;
 +static bool     dns_g_rbtdb_max_rtypes_fromenv = false;
 +void
 +#ifdef DNS_RBTDB_VERSION64
 +dns_rbtdb64_setmaxtypepername(uint32_t maxrrperset)
 +#else
 +dns_rbtdb_setmaxtypepername(uint32_t maxrrperset)
 +#endif
 +{
 +	if (!dns_g_rbtdb_max_rtypes_fromenv) {
 +		/* Make environment override configuration to avoid resetting to default value. */
 +		dns_g_rbtdb_max_rtypes = maxrrperset;
 +	}
 +}
 static void
 init_max_rtypes(void) {
@@ -6329,8 +6343,10 @@ init_max_rtypes(void) {
 	if (max) {
 		char *endp = NULL;
 		long l = strtol(max, &endp, 10);
 -		if (max != endp && endp && !*endp && l >= 0)
 +		if (max != endp && endp && !*endp) {
 			dns_g_rbtdb_max_rtypes = l;
 +			dns_g_rbtdb_max_rtypes_fromenv = true;
 +		}
 	}
 }
 diff --git a/lib/dns/rbtdb.h b/lib/dns/rbtdb.h
 index cd84b5b..4f2d890 100644
 --- a/lib/dns/rbtdb.h
 +++ b/lib/dns/rbtdb.h
@@ -45,6 +45,16 @@ dns_rbtdb_create(isc_mem_t *mctx, dns_name_t *base, dns_dbtype_t type,
  * \li argc == 0 or argv[0] is a valid memory context.
  */
 +void
 +dns_rbtdb_setmaxtypepername(uint32_t value);
 +/*%<
 + *     Set the maximum permissible number of RR types per owner name.
 + *     0 implies unlimited.
 + *
 + * Returns:
 + *\li  void
 + */
 +
 ISC_LANG_ENDDECLS
 #endif /* DNS_RBTDB_H */
 diff --git a/lib/dns/rbtdb64.h b/lib/dns/rbtdb64.h
 index 33b0115..77ae5b0 100644
 --- a/lib/dns/rbtdb64.h
 +++ b/lib/dns/rbtdb64.h
@@ -32,6 +32,9 @@ dns_rbtdb64_create(isc_mem_t *mctx, dns_name_t *base, dns_dbtype_t type,
 		   dns_rdataclass_t rdclass, unsigned int argc, char *argv[],
 		   void *driverarg, dns_db_t **dbp);
 +void
 +dns_rbtdb64_setmaxtypepername(uint32_t value);
 +
 ISC_LANG_ENDDECLS
 #endif /* DNS_RBTDB64_H */
 diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
 index 667111c..fc46a64 100644
 --- a/lib/isccfg/namedconf.c
 +++ b/lib/isccfg/namedconf.c
@@ -1100,6 +1100,7 @@ options_clauses[] = {
 	{ "lock-file", &cfg_type_qstringornone, 0 },
 	{ "managed-keys-directory", &cfg_type_qstring, 0 },
 	{ "match-mapped-addresses", &cfg_type_boolean, 0 },
 +	{ "max-records-per-type", &cfg_type_uint32, 0 },
 	{ "max-rsa-exponent-size", &cfg_type_uint32, 0 },
 	{ "memstatistics", &cfg_type_boolean, 0 },
 	{ "memstatistics-file", &cfg_type_qstring, 0 },
 -- 
 2.50.0
--- a/SOURCES/bind-9.11-d-max-types-per-name.patch
+++ b/SOURCES/bind-9.11-d-max-types-per-name.patch
@ -1,196 +0,0 @@
 From ba30ef9b8dbe3dacced19d80a8b27854a794b334 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
 Date: Sat, 25 May 2024 11:46:56 +0200
 Subject: [PATCH] Minimalistic support for max-types-per-name option
 Just add support for parsing of value from options to environment
 settable number. Keep environment value preferred, overriding
 configuration file value if present. Should avoid overriding environment
 set value by just default config value.
 Allow also value 0 from environment.
 ---
 bin/named/config.c           |  1 +
 bin/named/named.conf.docbook |  1 +
 bin/named/server.c           |  9 +++++++++
 doc/arm/Bv9ARM-book.xml      | 19 +++++++++++++++++++
 lib/dns/db.c                 | 12 ++++++++++--
 lib/dns/include/dns/db.h     |  9 +++++++++
 lib/dns/rdataslab.c          | 14 +++++++++++++-
 lib/isccfg/namedconf.c       |  1 +
 8 files changed, 63 insertions(+), 3 deletions(-)
 diff --git a/bin/named/config.c b/bin/named/config.c
 index 27cf9ee..c4d44ef 100644
 --- a/bin/named/config.c
 +++ b/bin/named/config.c
@@ -246,6 +246,7 @@ options {\n\
 	max-records-per-type 100;\n\
 	max-refresh-time 2419200; /* 4 weeks */\n\
 	max-retry-time 1209600; /* 2 weeks */\n\
 +	max-types-per-name 100;\n\
 	max-transfer-idle-in 60;\n\
 	max-transfer-idle-out 60;\n\
 	max-transfer-time-in 120;\n\
 diff --git a/bin/named/named.conf.docbook b/bin/named/named.conf.docbook
 index d7934c7..a4b1d76 100644
 --- a/bin/named/named.conf.docbook
 +++ b/bin/named/named.conf.docbook
@@ -348,6 +348,7 @@ options {
 	max-transfer-idle-out <replaceable>integer</replaceable>;
 	max-transfer-time-in <replaceable>integer</replaceable>;
 	max-transfer-time-out <replaceable>integer</replaceable>;
 +	max-types-per-name <replaceable>integer</replaceable>;
 	max-udp-size <replaceable>integer</replaceable>;
 	max-zone-ttl ( unlimited | <replaceable>ttlval</replaceable> );
 	memstatistics <replaceable>boolean</replaceable>;
 diff --git a/bin/named/server.c b/bin/named/server.c
 index 2e88df7..2086e41 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
@@ -4615,6 +4615,15 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	INSIST(result == ISC_R_SUCCESS);
 	dns_db_setmaxrrperset(cfg_obj_asuint32(obj));
 +	/*
 +	 * This is used for the cache and also as a default value
 +	 * for zone databases.
 +	 */
 +	obj = NULL;
 +	result = ns_config_get(maps, "max-types-per-name", &obj);
 +	INSIST(result == ISC_R_SUCCESS);
 +	dns_db_setmaxtypepername(cfg_obj_asuint32(obj));
 +
 	obj = NULL;
 	result = ns_config_get(maps, "max-recursion-depth", &obj);
 	INSIST(result == ISC_R_SUCCESS);
 diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
 index 25acad0..70fd769 100644
 --- a/doc/arm/Bv9ARM-book.xml
 +++ b/doc/arm/Bv9ARM-book.xml
@@ -8336,6 +8336,25 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
 	      </listitem>
 	    </varlistentry>
 +	    <varlistentry>
 +	      <term><command>max-types-per-name</command></term>
 +	      <listitem>
 +		<para>
 +		   This sets the maximum number of resource record types that can be stored
 +		   for a single owner name in a database. Can be configured in <option>options</option>
 +		   only.
 +		</para>
 +
 +		<para>
 +		   If set to a positive value, any attempt to cache or to add to a zone an owner
 +		   name with more than the specified number of resource record types will result
 +		   in a failure.  If set to 0, there is no cap on RR types number.  The default is
 +		   <literal>100</literal>.
 +		</para>
 +	      </listitem>
 +	    </varlistentry>
 +   
 +
 	    <varlistentry>
 	      <term><command>recursive-clients</command></term>
 	      <listitem>
 diff --git a/lib/dns/db.c b/lib/dns/db.c
 index 9e7632a..b0f8960 100644
 --- a/lib/dns/db.c
 +++ b/lib/dns/db.c
@@ -35,6 +35,7 @@
 #include <dns/master.h>
 #include <dns/rdata.h>
 #include <dns/rdataset.h>
 +#include <dns/rdataslab.h>
 #include <dns/rdatasetiter.h>
 #include <dns/result.h>
@@ -1151,8 +1152,15 @@ dns_db_getservestalettl(dns_db_t *db, dns_ttl_t *ttl)
 		return ((db->methods->getservestalettl)(db, ttl));
 	return (ISC_R_NOTIMPLEMENTED);
 }
 +
 +/* Emulation of more complex changes later. */
 void
 dns_db_setmaxrrperset(uint32_t maxrrperset) {
 -	dns_rbtdb_setmaxrrperset(maxrrperset);
 -	dns_rbtdb64_setmaxrrperset(maxrrperset);
 +	dns_rdataslab_setmaxrrperset(maxrrperset);
 +}
 +
 +void
 +dns_db_setmaxtypepername(uint32_t value) {
 +	dns_rbtdb_setmaxtypepername(value);
 +	dns_rbtdb64_setmaxtypepername(value);
 }
 diff --git a/lib/dns/include/dns/db.h b/lib/dns/include/dns/db.h
 index 6357bfd..f6eae9b 100644
 --- a/lib/dns/include/dns/db.h
 +++ b/lib/dns/include/dns/db.h
@@ -1728,6 +1728,15 @@ dns_db_setmaxrrperset(uint32_t maxrrperset);
  *\li  void
  */
 +void
 +dns_db_setmaxtypepername(uint32_t value);
 +/*%<
 + * Set the maximum permissible number of RR types per owner name.
 + *
 + * If 'value' is nonzero, then any subsequent attempt to add an rdataset with a
 + * RR type that would exceed the number of already stored RR types will return
 + * ISC_R_NOSPACE.
 + */
 ISC_LANG_ENDDECLS
 #endif /* DNS_DB_H */
 diff --git a/lib/dns/rdataslab.c b/lib/dns/rdataslab.c
 index 9566f79..8ea9ef4 100644
 --- a/lib/dns/rdataslab.c
 +++ b/lib/dns/rdataslab.c
@@ -121,8 +121,18 @@ fillin_offsets(unsigned char *offsetbase, unsigned int *offsettable,
 #endif /* DNS_RDATASET_MAX_RECORDS */
 static unsigned int dns_g_rdataset_max_records = DNS_RDATASET_MAX_RECORDS;
 +static bool dns_g_rdataset_max_records_fromenv = false;
 static isc_once_t once = ISC_ONCE_INIT;
 +void
 +dns_rdataslab_setmaxrrperset(uint32_t maxrrperset)
 +{
 +	if (!dns_g_rdataset_max_records_fromenv) {
 +		/* Make environment override configuration to avoid resetting to default value. */
 +		dns_g_rdataset_max_records = maxrrperset;
 +	}
 +}
 +
 static void
 init_max_records(void) {
 	/* Red Hat change, allow setting different max value by environment. */
@@ -130,8 +140,10 @@ init_max_records(void) {
 	if (max) {
 		char *endp = NULL;
 		long l = strtol(max, &endp, 10);
 -		if (max != endp && endp && !*endp && l > 0)
 +		if (max != endp && endp && !*endp) {
 			dns_g_rdataset_max_records = l;
 +			dns_g_rdataset_max_records_fromenv = true;
 +		}
 	}
 }
 diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
 index fc46a64..b80bb9c 100644
 --- a/lib/isccfg/namedconf.c
 +++ b/lib/isccfg/namedconf.c
@@ -1102,6 +1102,7 @@ options_clauses[] = {
 	{ "match-mapped-addresses", &cfg_type_boolean, 0 },
 	{ "max-records-per-type", &cfg_type_uint32, 0 },
 	{ "max-rsa-exponent-size", &cfg_type_uint32, 0 },
 +	{ "max-types-per-name", &cfg_type_uint32, 0 },
 	{ "memstatistics", &cfg_type_boolean, 0 },
 	{ "memstatistics-file", &cfg_type_qstring, 0 },
 	{ "multiple-cnames", &cfg_type_boolean, CFG_CLAUSEFLAG_OBSOLETE },
 -- 
 2.50.0
--- a/SOURCES/bind-9.11-dhcp-time-monotonic.patch
+++ b/SOURCES/bind-9.11-dhcp-time-monotonic.patch
@ -1,171 +0,0 @@
 diff --git a/lib/isc/include/isc/result.h b/lib/isc/include/isc/result.h
 index 0389efa..149cde5 100644
 --- a/lib/isc/include/isc/result.h
 +++ b/lib/isc/include/isc/result.h
@@ -89,7 +89,8 @@
 #define ISC_R_DISCFULL			67	/*%< disc full */
 #define ISC_R_DEFAULT			68	/*%< default */
 #define ISC_R_IPV4PREFIX		69	/*%< IPv4 prefix */
 -#define ISC_R_NRESULTS 			70
 +#define ISC_R_TIMESHIFTED               70      /*%< system time changed */
 +#define ISC_R_NRESULTS 			71
 ISC_LANG_BEGINDECLS
 diff --git a/lib/isc/include/isc/util.h b/lib/isc/include/isc/util.h
 index 973c348..cceeb5e 100644
 --- a/lib/isc/include/isc/util.h
 +++ b/lib/isc/include/isc/util.h
@@ -289,6 +289,10 @@ extern void mock_assert(const int result, const char* const expression,
  * Time
  */
 #define TIME_NOW(tp) 	RUNTIME_CHECK(isc_time_now((tp)) == ISC_R_SUCCESS)
 +#ifdef CLOCK_BOOTTIME
 +#define TIME_MONOTONIC(tp) 	RUNTIME_CHECK(isc_time_boottime((tp)) == ISC_R_SUCCESS)
 +#endif
 +
 /*%
  * Alignment
 diff --git a/lib/isc/result.c b/lib/isc/result.c
 index a9db132..f33fc6b 100644
 --- a/lib/isc/result.c
 +++ b/lib/isc/result.c
@@ -105,6 +105,7 @@ static const char *description[ISC_R_NRESULTS] = {
 	"disc full",				/*%< 67 */
 	"default",				/*%< 68 */
 	"IPv4 prefix",				/*%< 69 */
 +	"time changed",                         /*%< 70 */
 };
 static const char *identifier[ISC_R_NRESULTS] = {
@@ -178,6 +179,7 @@ static const char *identifier[ISC_R_NRESULTS] = {
 	"ISC_R_DISCFULL",
 	"ISC_R_DEFAULT",
 	"ISC_R_IPV4PREFIX",
 +	"ISC_R_TIMESHIFTED",
 };
 #define ISC_RESULT_RESULTSET			2
 diff --git a/lib/isc/unix/app.c b/lib/isc/unix/app.c
 index a6e9882..286fe95 100644
 --- a/lib/isc/unix/app.c
 +++ b/lib/isc/unix/app.c
@@ -442,15 +442,47 @@ isc__app_ctxonrun(isc_appctx_t *ctx0, isc_mem_t *mctx, isc_task_t *task,
 static isc_result_t
 evloop(isc__appctx_t *ctx) {
 	isc_result_t result;
 +        isc_time_t now;
 +#ifdef CLOCK_BOOTTIME
 +        isc_time_t monotonic;
 +        isc_uint64_t diff  = 0;
 +#else
 +        isc_time_t prev;
 +        TIME_NOW(&prev);
 +#endif
 	while (!ctx->want_shutdown) {
 		int n;
 -		isc_time_t when, now;
 +		isc_time_t when;
 		struct timeval tv, *tvp;
 		isc_socketwait_t *swait;
 		bool readytasks;
 		bool call_timer_dispatch = false;
 +                uint64_t us; 
 +
 +#ifdef CLOCK_BOOTTIME
 +                // TBD macros for following three lines
 +                TIME_NOW(&now);
 +                TIME_MONOTONIC(&monotonic);
 +                INSIST(now.seconds > monotonic.seconds)
 +                us = isc_time_microdiff (&now, &monotonic);
 +                if (us < diff){
 +                  us = diff - us;
 +                  if (us > 1000000){ // ignoring shifts less than one second
 +                    return ISC_R_TIMESHIFTED;
 +                  };
 +                  diff = isc_time_microdiff (&now, &monotonic);
 +                } else {
 +                  diff = isc_time_microdiff (&now, &monotonic);
 +                  // not implemented
 +                }
 +#else
 +                TIME_NOW(&now);
 +                if (isc_time_compare (&now, &prev) < 0)
 +                  return ISC_R_TIMESHIFTED;
 +                TIME_NOW(&prev);
 +#endif
 		/*
 		 * Check the reload (or suspend) case first for exiting the
 		 * loop as fast as possible in case:
@@ -475,7 +507,6 @@ evloop(isc__appctx_t *ctx) {
 			if (result != ISC_R_SUCCESS)
 				tvp = NULL;
 			else {
 -				uint64_t us;
 				TIME_NOW(&now);
 				us = isc_time_microdiff(&when, &now);
 diff --git a/lib/isc/unix/include/isc/time.h b/lib/isc/unix/include/isc/time.h
 index b864c29..5dd43c9 100644
 --- a/lib/isc/unix/include/isc/time.h
 +++ b/lib/isc/unix/include/isc/time.h
@@ -132,6 +132,26 @@ isc_time_isepoch(const isc_time_t *t);
  *\li	't' is a valid pointer.
  */
 +#ifdef CLOCK_BOOTTIME
 +isc_result_t
 +isc_time_boottime(isc_time_t *t);
 +/*%<
 + * Set 't' to monotonic time from previous boot
 + * it's not affected by system time change. It also
 + * includes the time system was suspended
 + *
 + * Requires:
 + *\li	't' is a valid pointer.
 + *
 + * Returns:
 + *
 + *\li	Success
 + *\li	Unexpected error
 + *		Getting the time from the system failed.
 + */
 +#endif /* CLOCK_BOOTTIME */
 + 
 +
 isc_result_t
 isc_time_now(isc_time_t *t);
 /*%<
 diff --git a/lib/isc/unix/time.c b/lib/isc/unix/time.c
 index 8edc9df..fe0bb91 100644
 --- a/lib/isc/unix/time.c
 +++ b/lib/isc/unix/time.c
@@ -498,3 +498,25 @@ isc_time_formatISO8601ms(const isc_time_t *t, char *buf, unsigned int len) {
 			 t->nanoseconds / NS_PER_MS);
 	}
 }
 +
 +
 +#ifdef CLOCK_BOOTTIME
 +isc_result_t
 +isc_time_boottime(isc_time_t *t) {
 +  struct timespec ts;
 +  
 +  char strbuf[ISC_STRERRORSIZE];
 +
 +  if (clock_gettime (CLOCK_BOOTTIME, &ts) != 0){
 +    isc__strerror(errno, strbuf, sizeof(strbuf));
 +    UNEXPECTED_ERROR(__FILE__, __LINE__, "%s", strbuf);
 +    return (ISC_R_UNEXPECTED);    
 +  }
 +
 +  t->seconds = ts.tv_sec;
 +  t->nanoseconds = ts.tv_nsec;
 +
 +  return (ISC_R_SUCCESS);
 +  
 +};
 +#endif
--- a/SOURCES/bind-9.11-engine-pkcs11.patch
+++ b/SOURCES/bind-9.11-engine-pkcs11.patch
@ -1,27 +0,0 @@
 From 37f89ccfc439f8d86c401d9ae10e94e53b924961 Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Tue, 27 Aug 2019 20:39:59 +0200
 Subject: [PATCH] Do not set engine for native PKCS11
 It resets already set lib_path to pkcs11, which is invalid in native
 pkcs11 crypto. Engine has to be path to PKCS#11 module.
 ---
 bin/named/include/named/globals.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/bin/named/include/named/globals.h b/bin/named/include/named/globals.h
 index eda2214..2a611d5 100644
 --- a/bin/named/include/named/globals.h
 +++ b/bin/named/include/named/globals.h
@@ -160,7 +160,7 @@ EXTERN const char *		ns_g_defaultdnstap	INIT(NULL);
 EXTERN const char *		ns_g_username		INIT(NULL);
 -#if defined(USE_PKCS11)
 +#if defined(USE_PKCS11) && !defined(PKCS11CRYPTO)
 EXTERN const char *		ns_g_engine		INIT(PKCS11_ENGINE);
 #else
 EXTERN const char *		ns_g_engine		INIT(NULL);
 -- 
 2.20.1
--- a/SOURCES/bind-9.11-export-suffix.patch
+++ b/SOURCES/bind-9.11-export-suffix.patch
@ -1,39 +0,0 @@
 diff --git a/configure.ac b/configure.ac
 index c1bfd62..7c5ad51 100644
 --- a/configure.ac
 +++ b/configure.ac
@@ -5333,6 +5333,8 @@ AC_SUBST(BUILD_CPPFLAGS)
 AC_SUBST(BUILD_LDFLAGS)
 AC_SUBST(BUILD_LIBS)
 +AC_SUBST(LIBDIR_SUFFIX)
 +
 #
 # Commands to run at the end of config.status.
 # Don't just put these into configure, it won't work right if somebody
 diff --git a/isc-config.sh.in b/isc-config.sh.in
 index b5e94ed..d2857e0 100644
 --- a/isc-config.sh.in
 +++ b/isc-config.sh.in
@@ -13,16 +13,17 @@ prefix=@prefix@
 exec_prefix=@exec_prefix@
 exec_prefix_set=
 includedir=@includedir@
 +libdir_suffix=@LIBDIR_SUFFIX@
 arch=$(uname -m)
 case $arch in
 	x86_64 | amd64 | sparc64 | s390x | ppc64)
 -		libdir=/usr/lib64
 -		sec_libdir=/usr/lib
 +		libdir=/usr/lib64${libdir_suffix}
 +		sec_libdir=/usr/lib${libdir_suffix}
 		;;
 	* )
 -		libdir=/usr/lib
 -		sec_libdir=/usr/lib64
 +		libdir=/usr/lib${libdir_suffix}
 +		sec_libdir=/usr/lib64${libdir_suffix}
 		;;
 esac
--- a/SOURCES/bind-9.11-fips-code-includes.patch
+++ b/SOURCES/bind-9.11-fips-code-includes.patch
@ -1,39 +0,0 @@
 From c928591eb2a3b17c5be0cad56c8e061ebba11a95 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 20 Dec 2018 11:52:12 +0100
 Subject: [PATCH] Fix implicit declaration warning
 isc_md5_available() function is not declared before its use. Include
 header providing it in files that use it.
 ---
 bin/tests/system/tkey/keydelete.c | 1 +
 lib/dns/tsig.c                    | 1 +
 2 files changed, 2 insertions(+)
 diff --git a/bin/tests/system/tkey/keydelete.c b/bin/tests/system/tkey/keydelete.c
 index 4b5b901..a3dd450 100644
 --- a/bin/tests/system/tkey/keydelete.c
 +++ b/bin/tests/system/tkey/keydelete.c
@@ -21,6 +21,7 @@
 #include <isc/hash.h>
 #include <isc/log.h>
 #include <isc/mem.h>
 +#include <isc/md5.h>
 #include <isc/print.h>
 #include <isc/sockaddr.h>
 #include <isc/socket.h>
 diff --git a/lib/dns/tsig.c b/lib/dns/tsig.c
 index c37b235..7786801 100644
 --- a/lib/dns/tsig.c
 +++ b/lib/dns/tsig.c
@@ -18,6 +18,7 @@
 #include <isc/buffer.h>
 #include <isc/mem.h>
 +#include <isc/md5.h>
 #include <isc/print.h>
 #include <isc/print.h>
 #include <isc/refcount.h>
 -- 
 2.26.2
--- a/SOURCES/bind-9.11-fips-code.patch
+++ b/SOURCES/bind-9.11-fips-code.patch
--- a/SOURCES/bind-9.11-fips-disable.patch
+++ b/SOURCES/bind-9.11-fips-disable.patch
@ -1,121 +0,0 @@
 From 83b889c238282b210f874a3ad81bb56299767495 Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Mon, 5 Aug 2019 11:54:03 +0200
 Subject: [PATCH] Allow explicit disabling of autodisabled MD5
 Default security policy might include explicitly disabled RSAMD5
 algorithm. Current FIPS code automatically disables in FIPS mode. But if
 RSAMD5 is included in security policy, it fails to start, because that
 algorithm is not recognized. Allow it disabled, but fail on any
 other usage.
 ---
 bin/named/server.c |  4 ++--
 lib/bind9/check.c  |  4 ++++
 lib/dns/rcode.c    | 33 +++++++++++++++------------------
 3 files changed, 21 insertions(+), 20 deletions(-)
 diff --git a/bin/named/server.c b/bin/named/server.c
 index 5b57371..51702ab 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
@@ -1547,12 +1547,12 @@ disable_algorithms(const cfg_obj_t *disabled, dns_resolver_t *resolver) {
 		r.length = strlen(r.base);
 		result = dns_secalg_fromtext(&alg, &r);
 -		if (result != ISC_R_SUCCESS) {
 +		if (result != ISC_R_SUCCESS && result != ISC_R_DISABLED) {
 			uint8_t ui;
 			result = isc_parse_uint8(&ui, r.base, 10);
 			alg = ui;
 		}
 -		if (result != ISC_R_SUCCESS) {
 +		if (result != ISC_R_SUCCESS && result != ISC_R_DISABLED) {
 			cfg_obj_log(cfg_listelt_value(element),
 				    ns_g_lctx, ISC_LOG_ERROR,
 				    "invalid algorithm");
 diff --git a/lib/bind9/check.c b/lib/bind9/check.c
 index e0803d4..8023784 100644
 --- a/lib/bind9/check.c
 +++ b/lib/bind9/check.c
@@ -302,6 +302,10 @@ disabled_algorithms(const cfg_obj_t *disabled, isc_log_t *logctx) {
 		r.length = strlen(r.base);
 		tresult = dns_secalg_fromtext(&alg, &r);
 +		if (tresult == ISC_R_DISABLED) {
 +			// Recognize disabled algorithms, disable it explicitly
 +			tresult = ISC_R_SUCCESS;
 +		}
 		if (tresult != ISC_R_SUCCESS) {
 			cfg_obj_log(cfg_listelt_value(element), logctx,
 				    ISC_LOG_ERROR, "invalid algorithm '%s'",
 diff --git a/lib/dns/rcode.c b/lib/dns/rcode.c
 index f51d548..c49b8d1 100644
 --- a/lib/dns/rcode.c
 +++ b/lib/dns/rcode.c
@@ -126,7 +126,6 @@
 #endif
 #define SECALGNAMES \
 -	MD5_SECALGNAMES \
 	DH_SECALGNAMES \
 	DSA_SECALGNAMES \
 	{ DNS_KEYALG_ECC, "ECC", 0 }, \
@@ -178,6 +177,7 @@ static struct tbl rcodes[] = { RCODENAMES ERCODENAMES };
 static struct tbl tsigrcodes[] = { RCODENAMES TSIGRCODENAMES };
 static struct tbl certs[] = { CERTNAMES };
 static struct tbl secalgs[] = { SECALGNAMES };
 +static struct tbl md5_secalgs[] = { MD5_SECALGNAMES };
 static struct tbl secprotos[] = { SECPROTONAMES };
 static struct tbl hashalgs[] = { HASHALGNAMES };
 static struct tbl dsdigests[] = { DSDIGESTNAMES };
@@ -358,33 +358,30 @@ dns_cert_totext(dns_cert_t cert, isc_buffer_t *target) {
 	return (dns_mnemonic_totext(cert, target, certs));
 }
 -static inline struct tbl *
 -secalgs_tbl_start() {
 -	struct tbl *algs = secalgs;
 -
 -#ifndef PK11_MD5_DISABLE
 -	if (!isc_md5_available()) {
 -		while (algs->name != NULL &&
 -		       algs->value == DNS_KEYALG_RSAMD5)
 -			++algs;
 -	}
 -#endif
 -	return algs;
 -}
 -
 isc_result_t
 dns_secalg_fromtext(dns_secalg_t *secalgp, isc_textregion_t *source) {
 	unsigned int value;
 +	isc_result_t result;
 -	RETERR(dns_mnemonic_fromtext(&value, source,
 -	                             secalgs_tbl_start(), 0xff));
 +	result = dns_mnemonic_fromtext(&value, source,
 +	                               secalgs, 0xff);
 +	if (result != ISC_R_SUCCESS) {
 +		result = dns_mnemonic_fromtext(&value, source,
 +	                                       md5_secalgs, 0xff);
 +		if (result != ISC_R_SUCCESS) {
 +			return (result);
 +		} else if (!isc_md5_available()) {
 +			*secalgp = value;
 +			return (ISC_R_DISABLED);
 +		}
 +	}
 	*secalgp = value;
 	return (ISC_R_SUCCESS);
 }
 isc_result_t
 dns_secalg_totext(dns_secalg_t secalg, isc_buffer_t *target) {
 -	return (dns_mnemonic_totext(secalg, target, secalgs_tbl_start()));
 +	return (dns_mnemonic_totext(secalg, target, secalgs));
 }
 void
 -- 
 2.20.1
--- a/SOURCES/bind-9.11-fips-tests.patch
+++ b/SOURCES/bind-9.11-fips-tests.patch
--- a/SOURCES/bind-9.11-host-idn-disable.patch
+++ b/SOURCES/bind-9.11-host-idn-disable.patch
@ -1,92 +0,0 @@
 From ec50eff97c259b5bfbfa4e050d69fe7b39b0f15a Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Tue, 25 Sep 2018 18:08:46 +0200
 Subject: [PATCH] Disable IDN from environment as documented
 Manual page of host contained instructions to disable IDN processing
 when it was built with libidn2. When refactoring IDN support however,
 support for disabling IDN in host and nslookup was lost. Use also
 environment variable and document it for nslookup, host and dig.
 Support variable CHARSET=ASCII to disable IDN, supported in downstream
 RH patch since RHEL 5.
 ---
 bin/dig/dig.docbook      |  4 +++-
 bin/dig/dighost.c        |  5 +++++
 bin/dig/host.docbook     |  2 +-
 bin/dig/nslookup.docbook | 15 +++++++++++++++
 4 files changed, 24 insertions(+), 2 deletions(-)
 diff --git a/bin/dig/dig.docbook b/bin/dig/dig.docbook
 index 5d19301..933af79 100644
 --- a/bin/dig/dig.docbook
 +++ b/bin/dig/dig.docbook
@@ -1312,7 +1312,9 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
       reply from the server.
       If you'd like to turn off the IDN support for some reason, use
       parameters <parameter>+noidnin</parameter> and
 -      <parameter>+noidnout</parameter>.
 +      <parameter>+noidnout</parameter> or define
 +      the <envar>IDN_DISABLE</envar> environment variable.
 +
     </para>
   </refsection>
 diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
 index 5eabc1f..73aaab8 100644
 --- a/bin/dig/dighost.c
 +++ b/bin/dig/dighost.c
@@ -826,6 +826,11 @@ make_empty_lookup(void) {
 	looknew->badcookie = true;
 #ifdef WITH_IDN_SUPPORT
 	looknew->idnin = isatty(1)?(getenv("IDN_DISABLE") == NULL):false;
 +	if (looknew->idnin) {
 +		const char *charset = getenv("CHARSET");
 +		if (charset && !strcmp(charset, "ASCII"))
 +			looknew->idnin = false;
 +	}
 #else
 	looknew->idnin = false;
 #endif
 diff --git a/bin/dig/host.docbook b/bin/dig/host.docbook
 index da0f8fb..9689b5a 100644
 --- a/bin/dig/host.docbook
 +++ b/bin/dig/host.docbook
@@ -379,7 +379,7 @@
       <command>host</command> appropriately converts character encoding of
       domain name before sending a request to DNS server or displaying a
       reply from the server.
 -      If you'd like to turn off the IDN support for some reason, defines
 +      If you'd like to turn off the IDN support for some reason, define
       the <envar>IDN_DISABLE</envar> environment variable.
       The IDN support is disabled if the variable is set when
       <command>host</command> runs.
 diff --git a/bin/dig/nslookup.docbook b/bin/dig/nslookup.docbook
 index d46fc2d..6d7d181 100644
 --- a/bin/dig/nslookup.docbook
 +++ b/bin/dig/nslookup.docbook
@@ -495,6 +495,21 @@ nslookup -query=hinfo  -timeout=10
     </para>
   </refsection>
 +  <refsection><info><title>IDN SUPPORT</title></info>
 +
 +    <para>
 +      If <command>nslookup</command> has been built with IDN (internationalized
 +      domain name) support, it can accept and display non-ASCII domain names.
 +      <command>nslookup</command> appropriately converts character encoding of
 +      domain name before sending a request to DNS server or displaying a
 +      reply from the server.
 +      If you'd like to turn off the IDN support for some reason, define
 +      the <envar>IDN_DISABLE</envar> environment variable.
 +      The IDN support is disabled if the variable is set when
 +      <command>nslookup</command> runs.
 +    </para>
 +  </refsection>
 +
   <refsection><info><title>FILES</title></info>
     <para><filename>/etc/resolv.conf</filename>
 -- 
 2.20.1
--- a/SOURCES/bind-9.11-json-c.patch
+++ b/SOURCES/bind-9.11-json-c.patch
@ -1,50 +0,0 @@
 From cb6d2019766a6c8c5516fd8859cedf0052f03293 Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Thu, 25 Jul 2019 11:37:57 +0200
 Subject: [PATCH] Skip support of jsoncpp
 Bind cannot be compiled when jsoncpp-devel is installed. Remove support
 for jsoncpp, use only json-c-devel. Bind 9.15 has already support for
 --with-json-c, do not yet introduce it.
 ---
 configure.ac | 17 ++---------------
 1 file changed, 2 insertions(+), 15 deletions(-)
 diff --git a/configure.ac b/configure.ac
 index 6d05337..5ce83b5 100644
 --- a/configure.ac
 +++ b/configure.ac
@@ -2594,15 +2594,7 @@ case "$use_libjson" in
 	auto|yes)
 		for d in /usr /usr/local /opt/local
 		do
 -			if test -f "${d}/include/json/json.h"
 -			then
 -				if test ${d} != /usr
 -				then
 -					libjson_cflags="-I ${d}/include"
 -					LIBS="$LIBS -L${d}/lib"
 -				fi
 -				have_libjson="yes"
 -			elif test -f "${d}/include/json-c/json.h"
 +			if test -f "${d}/include/json-c/json.h"
 			then
 				if test ${d} != /usr
 				then
@@ -2615,12 +2607,7 @@ case "$use_libjson" in
 		done
 		;;
 	*)
 -		if test -f "${use_libjson}/include/json/json.h"
 -		then
 -			libjson_cflags="-I${use_libjson}/include"
 -			LIBS="$LIBS -L${use_libjson}/lib"
 -			have_libjson="yes"
 -		elif test -f "${use_libjson}/include/json-c/json.h"
 +		if test -f "${use_libjson}/include/json-c/json.h"
 		then
 			libjson_cflags="-I${use_libjson}/include"
 			LIBS="$LIBS -L${use_libjson}/lib"
 -- 
 2.20.1
--- a/SOURCES/bind-9.11-kyua-pkcs11.patch
+++ b/SOURCES/bind-9.11-kyua-pkcs11.patch
@ -1,4 +1,4 @@
-From a9b5785f174cf7fd74891fa64f6b69b9a9b55466 Mon Sep 17 00:00:00 2001
+From 1241f2005d08673c28a595c5a6cd61350b95a929 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Tue, 2 Jan 2018 18:13:07 +0100
 Subject: [PATCH] Fix pkcs11 variants atf tests
@ -9,17 +9,14 @@ Add pkcs11 Kyuafile, fix dh_test to pass in pkcs11 mode
 ---
 configure.ac                   | 1 +
 lib/Kyuafile                   | 2 ++
 lib/dns-pkcs11/tests/Makefile.in | 10 +++++-----
 lib/dns-pkcs11/tests/dh_test.c | 3 ++-
- lib/isc-pkcs11/tests/Makefile.in |  6 +++---
+ 3 files changed, 5 insertions(+), 1 deletion(-)
 lib/isc-pkcs11/tests/hash_test.c | 32 +++++++++++++++++++++++++-------
 6 files changed, 38 insertions(+), 16 deletions(-)
 diff --git a/configure.ac b/configure.ac
-index 62ecf56..0940a7d 100644
+index d80ae31..0fb9328 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -5476,6 +5476,7 @@ AC_CONFIG_FILES([
+@@ -3090,6 +3090,7 @@ AC_CONFIG_FILES([
 	lib/dns-pkcs11/include/Makefile
 	lib/dns-pkcs11/include/dns/Makefile
 	lib/dns-pkcs11/include/dst/Makefile
@ -28,7 +25,7 @@ index 62ecf56..0940a7d 100644
 	lib/irs/include/Makefile
 	lib/irs/include/irs/Makefile
 diff --git a/lib/Kyuafile b/lib/Kyuafile
-index 7c8bab0..eec9564 100644
+index 39ce986..037e5ef 100644
 --- a/lib/Kyuafile
 +++ b/lib/Kyuafile
@@ -2,8 +2,10 @@ syntax(2)
@ -38,37 +35,15 @@ index 7c8bab0..eec9564 100644
 +include('dns-pkcs11/Kyuafile')
 include('irs/Kyuafile')
 include('isc/Kyuafile')
 +include('isc-pkcs11/Kyuafile')
 include('isccc/Kyuafile')
 include('isccfg/Kyuafile')
- include('lwres/Kyuafile')
+ include('ns/Kyuafile')
-diff --git a/lib/dns-pkcs11/tests/Makefile.in b/lib/dns-pkcs11/tests/Makefile.in
+include('ns-pkcs11/Kyuafile')
 index 22a06a8..5df5b15 100644
 --- a/lib/dns-pkcs11/tests/Makefile.in
 +++ b/lib/dns-pkcs11/tests/Makefile.in
@@ -17,12 +17,12 @@ VERSION=@BIND9_VERSION@
 CINCLUDES =	-I. -Iinclude ${DNS_INCLUDES} ${ISC_INCLUDES} \
 		@DST_OPENSSL_INC@ ${MAXMINDDB_CFLAGS}
 -CDEFINES =	@CRYPTO@ -DTESTS="\"${top_builddir}/lib/dns/tests/\""
 +CDEFINES =	@CRYPTO_PK11@ -DTESTS="\"${top_builddir}/lib/dns-pkcs11/tests/\""
 -ISCLIBS =	../../isc/libisc.@A@
 -ISCDEPLIBS =	../../isc/libisc.@A@
 -DNSLIBS =	../libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
 -DNSDEPLIBS =	../libdns.@A@
 +ISCLIBS =	../../isc-pkcs11/libisc-pkcs11.@A@
 +ISCDEPLIBS =	../../isc-pkcs11/libisc-pkcs11.@A@
 +DNSLIBS =	../libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
 +DNSDEPLIBS =	../libdns-pkcs11.@A@
 LIBS =		@LIBS@ @CMOCKA_LIBS@
 CFLAGS =	@CFLAGS@ @CMOCKA_CFLAGS@
 diff --git a/lib/dns-pkcs11/tests/dh_test.c b/lib/dns-pkcs11/tests/dh_test.c
-index a5bf46c..9ff2b76 100644
+index 934e8fd..658d1af 100644
 --- a/lib/dns-pkcs11/tests/dh_test.c
 +++ b/lib/dns-pkcs11/tests/dh_test.c
-@@ -88,7 +88,8 @@ dh_computesecret(void **state) {
+@@ -87,7 +87,8 @@ dh_computesecret(void **state) {
 	result = dst_key_computesecret(key, key, &buf);
 	assert_int_equal(result, DST_R_NOTPRIVATEKEY);
 	result = key->func->computesecret(key, key, &buf);
@ -78,115 +53,6 @@ index a5bf46c..9ff2b76 100644
 	dst_key_free(&key);
 }
 diff --git a/lib/isc-pkcs11/tests/Makefile.in b/lib/isc-pkcs11/tests/Makefile.in
 index 36d2207..00dfbc9 100644
 --- a/lib/isc-pkcs11/tests/Makefile.in
 +++ b/lib/isc-pkcs11/tests/Makefile.in
@@ -16,10 +16,10 @@ VERSION=@BIND9_VERSION@
 @BIND9_MAKE_INCLUDES@
 CINCLUDES =	-I. -Iinclude ${ISC_INCLUDES} @ISC_OPENSSL_INC@
 -CDEFINES =	@CRYPTO@ -DTESTS="\"${top_builddir}/lib/isc/tests/\""
 +CDEFINES =	@CRYPTO_PK11@ -DTESTS="\"${top_builddir}/lib/isc-pkcs11/tests/\""
 -ISCLIBS =	../libisc.@A@ @ISC_OPENSSL_LIBS@
 -ISCDEPLIBS =	../libisc.@A@
 +ISCLIBS =	../libisc-pkcs11.@A@ @ISC_OPENSSL_LIBS@
 +ISCDEPLIBS =	../libisc-pkcs11.@A@
 LIBS =		@LIBS@ @CMOCKA_LIBS@
 CFLAGS =	@CFLAGS@ @CMOCKA_CFLAGS@
 diff --git a/lib/isc-pkcs11/tests/hash_test.c b/lib/isc-pkcs11/tests/hash_test.c
 index 4fafc38..5eb2be2 100644
 --- a/lib/isc-pkcs11/tests/hash_test.c
 +++ b/lib/isc-pkcs11/tests/hash_test.c
@@ -84,7 +84,7 @@ typedef struct hash_testcase {
 typedef struct hash_test_key {
 	const char *key;
 -	const int len;
 +	const unsigned len;
 } hash_test_key_t;
 /* non-hmac tests */
@@ -955,8 +955,11 @@ isc_hmacsha1_test(void **state) {
 	hash_test_key_t *test_key = test_keys;
 	while (testcase->input != NULL && testcase->result != NULL) {
 +		int len = ISC_MAX(test_key->len, ISC_SHA1_DIGESTLENGTH);
 +
 +		memset(buffer, 0, ISC_SHA1_DIGESTLENGTH);
 		memmove(buffer, test_key->key, test_key->len);
 -		isc_hmacsha1_init(&hmacsha1, buffer, test_key->len);
 +		isc_hmacsha1_init(&hmacsha1, buffer, len);
 		isc_hmacsha1_update(&hmacsha1,
 				    (const uint8_t *) testcase->input,
 				    testcase->input_len);
@@ -1115,8 +1118,11 @@ isc_hmacsha224_test(void **state) {
 	hash_test_key_t *test_key = test_keys;
 	while (testcase->input != NULL && testcase->result != NULL) {
 +		int len = ISC_MAX(test_key->len, ISC_SHA224_DIGESTLENGTH);
 +
 +		memset(buffer, 0, ISC_SHA224_DIGESTLENGTH);
 		memmove(buffer, test_key->key, test_key->len);
 -		isc_hmacsha224_init(&hmacsha224, buffer, test_key->len);
 +		isc_hmacsha224_init(&hmacsha224, buffer, len);
 		isc_hmacsha224_update(&hmacsha224,
 				      (const uint8_t *) testcase->input,
 				      testcase->input_len);
@@ -1276,8 +1282,11 @@ isc_hmacsha256_test(void **state) {
 	hash_test_key_t *test_key = test_keys;
 	while (testcase->input != NULL && testcase->result != NULL) {
 +		int len = ISC_MAX(test_key->len, ISC_SHA256_DIGESTLENGTH);
 +
 +		memset(buffer, 0, ISC_SHA256_DIGESTLENGTH);
 		memmove(buffer, test_key->key, test_key->len);
 -		isc_hmacsha256_init(&hmacsha256, buffer, test_key->len);
 +		isc_hmacsha256_init(&hmacsha256, buffer, len);
 		isc_hmacsha256_update(&hmacsha256,
 				      (const uint8_t *) testcase->input,
 				      testcase->input_len);
@@ -1443,8 +1452,11 @@ isc_hmacsha384_test(void **state) {
 	hash_test_key_t *test_key = test_keys;
 	while (testcase->input != NULL && testcase->result != NULL) {
 +		int len = ISC_MAX(test_key->len, ISC_SHA384_DIGESTLENGTH);
 +
 +		memset(buffer, 0, ISC_SHA384_DIGESTLENGTH);
 		memmove(buffer, test_key->key, test_key->len);
 -		isc_hmacsha384_init(&hmacsha384, buffer, test_key->len);
 +		isc_hmacsha384_init(&hmacsha384, buffer, len);
 		isc_hmacsha384_update(&hmacsha384,
 				      (const uint8_t *) testcase->input,
 				      testcase->input_len);
@@ -1610,8 +1622,11 @@ isc_hmacsha512_test(void **state) {
 	hash_test_key_t *test_key = test_keys;
 	while (testcase->input != NULL && testcase->result != NULL) {
 +		int len = ISC_MAX(test_key->len, ISC_SHA512_DIGESTLENGTH);
 +
 +		memset(buffer, 0, ISC_SHA512_DIGESTLENGTH);
 		memmove(buffer, test_key->key, test_key->len);
 -		isc_hmacsha512_init(&hmacsha512, buffer, test_key->len);
 +		isc_hmacsha512_init(&hmacsha512, buffer, len);
 		isc_hmacsha512_update(&hmacsha512,
 				      (const uint8_t *) testcase->input,
 				      testcase->input_len);
@@ -1754,8 +1769,11 @@ isc_hmacmd5_test(void **state) {
 	hash_test_key_t *test_key = test_keys;
 	while (testcase->input != NULL && testcase->result != NULL) {
 +		int len = ISC_MAX(test_key->len, ISC_MD5_DIGESTLENGTH);
 +
 +		memset(buffer, 0, ISC_MD5_DIGESTLENGTH);
 		memmove(buffer, test_key->key, test_key->len);
 -		isc_hmacmd5_init(&hmacmd5, buffer, test_key->len);
 +		isc_hmacmd5_init(&hmacmd5, buffer, len);
 		isc_hmacmd5_update(&hmacmd5,
 				   (const uint8_t *) testcase->input,
 				   testcase->input_len);
 -- 
-2.21.1
+2.20.1
--- a/SOURCES/bind-9.11-oot-manual.patch
+++ b/SOURCES/bind-9.11-oot-manual.patch
@ -1,256 +0,0 @@
 From 8ca95f47231822df2b9c171a4da1e93ca5b748eb Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Wed, 25 Jul 2018 12:24:16 +0200
 Subject: [PATCH] Use make automatic variables to install updated manuals
 Make will choose modified manual from build directory or original from source
 directory automagically. Take advantage of install tool feature.
 Install all files in single command instead of iterating on each of them.
 ---
 bin/check/Makefile.in   |  8 +++++---
 bin/confgen/Makefile.in |  9 +++++----
 bin/delv/Makefile.in    |  6 ++++--
 bin/dig/Makefile.in     |  8 ++++----
 bin/dnssec/Makefile.in  |  6 ++++--
 bin/named/Makefile.in   | 13 +++++++++----
 bin/pkcs11/Makefile.in  |  9 ++++-----
 bin/python/Makefile.in  |  8 ++++----
 bin/tools/Makefile.in   | 25 +++++++++++++++----------
 9 files changed, 54 insertions(+), 38 deletions(-)
 diff --git a/bin/check/Makefile.in b/bin/check/Makefile.in
 index c124e80..1174f8d 100644
 --- a/bin/check/Makefile.in
 +++ b/bin/check/Makefile.in
@@ -83,12 +83,14 @@ installdirs:
 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
 -install:: named-checkconf@EXEEXT@ named-checkzone@EXEEXT@ installdirs
 +install-man8: ${MANPAGES}
 +	${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man8
 +	(cd ${DESTDIR}${mandir}/man8; rm -f named-compilezone.8; ${LINK_PROGRAM} named-checkzone.8 named-compilezone.8)
 +
 +install:: named-checkconf@EXEEXT@ named-checkzone@EXEEXT@ installdirs install-man8
 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named-checkconf@EXEEXT@ ${DESTDIR}${sbindir}
 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named-checkzone@EXEEXT@ ${DESTDIR}${sbindir}
 	(cd ${DESTDIR}${sbindir}; rm -f named-compilezone@EXEEXT@; ${LINK_PROGRAM} named-checkzone@EXEEXT@ named-compilezone@EXEEXT@)
 -	for m in ${MANPAGES}; do ${INSTALL_DATA} ${srcdir}/$$m ${DESTDIR}${mandir}/man8 || exit 1; done
 -	(cd ${DESTDIR}${mandir}/man8; rm -f named-compilezone.8; ${LINK_PROGRAM} named-checkzone.8 named-compilezone.8)
 uninstall::
 	rm -f ${DESTDIR}${mandir}/man8/named-compilezone.8
 diff --git a/bin/confgen/Makefile.in b/bin/confgen/Makefile.in
 index 87f13dd..7865c0c 100644
 --- a/bin/confgen/Makefile.in
 +++ b/bin/confgen/Makefile.in
@@ -95,13 +95,14 @@ installdirs:
 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
 -install:: rndc-confgen@EXEEXT@ ddns-confgen@EXEEXT@ installdirs
 +install-man8: rndc-confgen.8 ddns-confgen.8
 +	${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man8
 +	(cd ${DESTDIR}${mandir}/man8; rm -f tsig-keygen.8; ${LINK_PROGRAM} ddns-confgen.8 tsig-keygen.8)
 +
 +install:: rndc-confgen@EXEEXT@ ddns-confgen@EXEEXT@ installdirs install-man8
 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} rndc-confgen@EXEEXT@ ${DESTDIR}${sbindir}
 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} ddns-confgen@EXEEXT@ ${DESTDIR}${sbindir}
 -	${INSTALL_DATA} ${srcdir}/rndc-confgen.8 ${DESTDIR}${mandir}/man8
 -	${INSTALL_DATA} ${srcdir}/ddns-confgen.8 ${DESTDIR}${mandir}/man8
 	(cd ${DESTDIR}${sbindir}; rm -f tsig-keygen@EXEEXT@; ${LINK_PROGRAM} ddns-confgen@EXEEXT@ tsig-keygen@EXEEXT@)
 -	(cd ${DESTDIR}${mandir}/man8; rm -f tsig-keygen.8; ${LINK_PROGRAM} ddns-confgen.8 tsig-keygen.8)
 uninstall::
 	rm -f ${DESTDIR}${mandir}/man8/tsig-keygen.8
 diff --git a/bin/delv/Makefile.in b/bin/delv/Makefile.in
 index e2d2802..19361a8 100644
 --- a/bin/delv/Makefile.in
 +++ b/bin/delv/Makefile.in
@@ -63,10 +63,12 @@ installdirs:
 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${bindir}
 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man1
 -install:: delv@EXEEXT@ installdirs
 +install-man1: delv.1
 +	${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man1
 +
 +install:: delv@EXEEXT@ installdirs install-man1
 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} \
 		delv@EXEEXT@ ${DESTDIR}${bindir}
 -	${INSTALL_DATA} ${srcdir}/delv.1 ${DESTDIR}${mandir}/man1
 uninstall::
 	rm -f ${DESTDIR}${mandir}/man1/delv.1
 diff --git a/bin/dig/Makefile.in b/bin/dig/Makefile.in
 index a9830a9..d7ac0b6 100644
 --- a/bin/dig/Makefile.in
 +++ b/bin/dig/Makefile.in
@@ -91,16 +91,16 @@ installdirs:
 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${bindir}
 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man1
 -install:: dig@EXEEXT@ host@EXEEXT@ nslookup@EXEEXT@ installdirs
 +install-man1: ${MANPAGES}
 +	${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man1
 +
 +install:: dig@EXEEXT@ host@EXEEXT@ nslookup@EXEEXT@ installdirs install-man1
 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} \
 		dig@EXEEXT@ ${DESTDIR}${bindir}
 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} \
 		host@EXEEXT@ ${DESTDIR}${bindir}
 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} \
 		nslookup@EXEEXT@ ${DESTDIR}${bindir}
 -	for m in ${MANPAGES}; do \
 -		${INSTALL_DATA} ${srcdir}/$$m ${DESTDIR}${mandir}/man1 || exit 1; \
 -	done
 uninstall::
 	for m in ${MANPAGES}; do \
 diff --git a/bin/dnssec/Makefile.in b/bin/dnssec/Makefile.in
 index 2239ad1..ce0a177 100644
 --- a/bin/dnssec/Makefile.in
 +++ b/bin/dnssec/Makefile.in
@@ -110,9 +110,11 @@ installdirs:
 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
 -install:: ${TARGETS} installdirs
 +install-man8: ${MANPAGES}
 +	${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man8
 +
 +install:: ${TARGETS} installdirs install-man8
 	for t in ${TARGETS}; do ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} $$t ${DESTDIR}${sbindir} || exit 1; done
 -	for m in ${MANPAGES}; do ${INSTALL_DATA} ${srcdir}/$$m ${DESTDIR}${mandir}/man8 || exit 1; done
 uninstall::
 	for m in ${MANPAGES}; do rm -f ${DESTDIR}${mandir}/man8/$$m || exit 1; done
 diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
 index e1f85a9..d92bc9a 100644
 --- a/bin/named/Makefile.in
 +++ b/bin/named/Makefile.in
@@ -176,12 +176,17 @@ installdirs:
 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man5
 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
 -install:: named@EXEEXT@ lwresd@EXEEXT@ installdirs
 +install-man5: named.conf.5
 +	${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man5
 +
 +install-man8: named.8 lwresd.8
 +	${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man8
 +
 +install-man: install-man5 install-man8
 +
 +install:: named@EXEEXT@ lwresd@EXEEXT@ installdirs install-man
 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named@EXEEXT@ ${DESTDIR}${sbindir}
 	(cd ${DESTDIR}${sbindir}; rm -f lwresd@EXEEXT@; @LN@ named@EXEEXT@ lwresd@EXEEXT@)
 -	${INSTALL_DATA} ${srcdir}/named.8 ${DESTDIR}${mandir}/man8
 -	${INSTALL_DATA} ${srcdir}/lwresd.8 ${DESTDIR}${mandir}/man8
 -	${INSTALL_DATA} ${srcdir}/named.conf.5 ${DESTDIR}${mandir}/man5
 uninstall::
 	rm -f ${DESTDIR}${mandir}/man5/named.conf.5
 diff --git a/bin/pkcs11/Makefile.in b/bin/pkcs11/Makefile.in
 index ae90616..a058c91 100644
 --- a/bin/pkcs11/Makefile.in
 +++ b/bin/pkcs11/Makefile.in
@@ -71,7 +71,10 @@ installdirs:
 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
 -install:: ${TARGETS} installdirs
 +install-man8: ${MANPAGES}
 +	${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man8
 +
 +install:: ${TARGETS} installdirs install-man8
 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} pkcs11-list@EXEEXT@ \
 		${DESTDIR}${sbindir}
 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} pkcs11-destroy@EXEEXT@ \
@@ -80,10 +83,6 @@ install:: ${TARGETS} installdirs
 		${DESTDIR}${sbindir}
 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} pkcs11-tokens@EXEEXT@ \
 		${DESTDIR}${sbindir}
 -	${INSTALL_DATA} ${srcdir}/pkcs11-list.8 ${DESTDIR}${mandir}/man8
 -	${INSTALL_DATA} ${srcdir}/pkcs11-destroy.8 ${DESTDIR}${mandir}/man8
 -	${INSTALL_DATA} ${srcdir}/pkcs11-keygen.8 ${DESTDIR}${mandir}/man8
 -	${INSTALL_DATA} ${srcdir}/pkcs11-tokens.8 ${DESTDIR}${mandir}/man8
 uninstall::
 	rm -f ${DESTDIR}${mandir}/man8/pkcs11-tokens.8
 diff --git a/bin/python/Makefile.in b/bin/python/Makefile.in
 index aa678d4..064c404 100644
 --- a/bin/python/Makefile.in
 +++ b/bin/python/Makefile.in
@@ -47,13 +47,13 @@ installdirs:
 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
 -install:: ${TARGETS} installdirs
 +install-man8: ${MANPAGES}
 +	${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man8
 +
 +install:: ${TARGETS} installdirs install-man8
 	${INSTALL_SCRIPT} dnssec-checkds ${DESTDIR}${sbindir}
 	${INSTALL_SCRIPT} dnssec-coverage ${DESTDIR}${sbindir}
 	${INSTALL_SCRIPT} dnssec-keymgr ${DESTDIR}${sbindir}
 -	${INSTALL_DATA} ${srcdir}/dnssec-checkds.8 ${DESTDIR}${mandir}/man8
 -	${INSTALL_DATA} ${srcdir}/dnssec-coverage.8 ${DESTDIR}${mandir}/man8
 -	${INSTALL_DATA} ${srcdir}/dnssec-keymgr.8 ${DESTDIR}${mandir}/man8
 	if test -n "${PYTHON}" ; then \
 		if test -n "${DESTDIR}" ; then \
 			${PYTHON} ${srcdir}/setup.py install --root=${DESTDIR} --prefix=${prefix} @PYTHON_INSTALL_LIB@ ; \
 diff --git a/bin/tools/Makefile.in b/bin/tools/Makefile.in
 index 7bf2af4..c395bc7 100644
 --- a/bin/tools/Makefile.in
 +++ b/bin/tools/Makefile.in
@@ -119,17 +119,27 @@ installdirs:
 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man1
 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
 -nzd:
 +nzd-man: named-nzd2nzf.8
 +	${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man8
 +
 +nzd: nzd-man
 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named-nzd2nzf@EXEEXT@ \
 		${DESTDIR}${sbindir}
 -	${INSTALL_DATA} ${srcdir}/named-nzd2nzf.8 ${DESTDIR}${mandir}/man8
 -dnstap:
 +dnstap-man: dnstap-read.1
 +	${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man1
 +
 +dnstap: dnstap-man
 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} dnstap-read@EXEEXT@ \
 		${DESTDIR}${bindir}
 -	${INSTALL_DATA} ${srcdir}/dnstap-read.1 ${DESTDIR}${mandir}/man1
 -install:: ${TARGETS} installdirs @DNSTAP@ @NZD_TOOLS@
 +install-man1: arpaname.1 named-rrchecker.1 mdig.1
 +	${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man1
 +
 +install-man8: named-journalprint.8 nsec3hash.8
 +	${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man8
 +
 +install:: ${TARGETS} installdirs @DNSTAP@ @NZD_TOOLS@ install-man1 install-man8
 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} arpaname@EXEEXT@ \
 		${DESTDIR}${bindir}
 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named-journalprint@EXEEXT@ \
@@ -144,13 +154,8 @@ install:: ${TARGETS} installdirs @DNSTAP@ @NZD_TOOLS@
 		${DESTDIR}${sbindir}
 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} mdig@EXEEXT@ \
 		${DESTDIR}${bindir}
 -	${INSTALL_DATA} ${srcdir}/arpaname.1 ${DESTDIR}${mandir}/man1
 	${INSTALL_DATA} ${srcdir}/isc-hmac-fixup.8 ${DESTDIR}${mandir}/man8
 -	${INSTALL_DATA} ${srcdir}/named-journalprint.8 ${DESTDIR}${mandir}/man8
 -	${INSTALL_DATA} ${srcdir}/named-rrchecker.1 ${DESTDIR}${mandir}/man1
 -	${INSTALL_DATA} ${srcdir}/nsec3hash.8 ${DESTDIR}${mandir}/man8
 	${INSTALL_DATA} ${srcdir}/genrandom.8 ${DESTDIR}${mandir}/man8
 -	${INSTALL_DATA} ${srcdir}/mdig.1 ${DESTDIR}${mandir}/man1
 uninstall::
 	rm -f ${DESTDIR}${mandir}/man1/mdig.1
 -- 
 2.14.4
--- a/SOURCES/bind-9.11-pk11.patch
+++ b/SOURCES/bind-9.11-pk11.patch
@ -1,27 +0,0 @@
 diff --git a/lib/dns/dst_internal.h b/lib/dns/dst_internal.h
 index 640519a..fc40472 100644
 --- a/lib/dns/dst_internal.h
 +++ b/lib/dns/dst_internal.h
@@ -59,6 +59,9 @@
 #include <openssl/objects.h>
 #include <openssl/rsa.h>
 #endif
 +#if PKCS11CRYPTO
 +#include <pk11/pk11.h>
 +#endif
 ISC_LANG_BEGINDECLS
 diff --git a/lib/isc/include/pk11/internal.h b/lib/isc/include/pk11/internal.h
 index aa8907a..603712a 100644
 --- a/lib/isc/include/pk11/internal.h
 +++ b/lib/isc/include/pk11/internal.h
@@ -13,6 +13,8 @@
 #ifndef PK11_INTERNAL_H
 #define PK11_INTERNAL_H 1
 +#include <pk11/pk11.h>
 +
 /*! \file pk11/internal.h */
 ISC_LANG_BEGINDECLS
--- a/SOURCES/bind-9.11-rh1205168.patch
+++ b/SOURCES/bind-9.11-rh1205168.patch
@ -1,120 +0,0 @@
 From 90416594843a56550e40b11561807786219ce1c4 Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Mon, 11 Sep 2017 15:01:36 -0700
 Subject: [PATCH] remap getaddrinfo() to irs_getgetaddrinfo()
 The libirs version of getaddrinfo() cannot be called from within BIND9.
 fix prototypes
 ---
 lib/irs/include/irs/netdb.h.in | 94 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 94 insertions(+)
 diff --git a/lib/irs/include/irs/netdb.h.in b/lib/irs/include/irs/netdb.h.in
 index 23dcd37..f36113d 100644
 --- a/lib/irs/include/irs/netdb.h.in
 +++ b/lib/irs/include/irs/netdb.h.in
@@ -150,6 +150,100 @@ struct addrinfo {
 #define	NI_DGRAM	0x00000010
 /*
 + * Define to map into irs_ namespace.
 + */
 +
 +#define IRS_NAMESPACE
 +
 +#ifdef IRS_NAMESPACE
 +
 +/*
 + * Use our versions not the ones from the C library.
 + */
 +
 +#ifdef getnameinfo
 +#undef getnameinfo
 +#endif
 +#define getnameinfo irs_getnameinfo
 +
 +#ifdef getaddrinfo
 +#undef getaddrinfo
 +#endif
 +#define getaddrinfo irs_getaddrinfo
 +
 +#ifdef freeaddrinfo
 +#undef freeaddrinfo
 +#endif
 +#define freeaddrinfo irs_freeaddrinfo
 +
 +#ifdef gai_strerror
 +#undef gai_strerror
 +#endif
 +#define gai_strerror irs_gai_strerror
 +
 +#endif
 +
 +extern int getaddrinfo (const char *name,
 +			const char *service,
 +			const struct addrinfo *req,
 +			struct addrinfo **pai);
 +extern int getnameinfo (const struct sockaddr *sa,
 +			socklen_t salen, char *host,
 +			socklen_t hostlen, char *serv,
 +			socklen_t servlen, int flags);
 +extern void freeaddrinfo (struct addrinfo *ai);
 +extern const char *gai_strerror (int ecode);
 +
 +/*
 + * Define to map into irs_ namespace.
 + */
 +
 +#define IRS_NAMESPACE
 +
 +#ifdef IRS_NAMESPACE
 +
 +/*
 + * Use our versions not the ones from the C library.
 + */
 +
 +#ifdef getnameinfo
 +#undef getnameinfo
 +#endif
 +#define getnameinfo irs_getnameinfo
 +
 +#ifdef getaddrinfo
 +#undef getaddrinfo
 +#endif
 +#define getaddrinfo irs_getaddrinfo
 +
 +#ifdef freeaddrinfo
 +#undef freeaddrinfo
 +#endif
 +#define freeaddrinfo irs_freeaddrinfo
 +
 +#ifdef gai_strerror
 +#undef gai_strerror
 +#endif
 +#define gai_strerror irs_gai_strerror
 +
 +int
 +getaddrinfo(const char *hostname, const char *servname,
 +	    const struct addrinfo *hints, struct addrinfo **res);
 +
 +int
 +getnameinfo(const struct sockaddr *sa, IRS_GETNAMEINFO_SOCKLEN_T salen,
 +	    char *host, IRS_GETNAMEINFO_BUFLEN_T hostlen,
 +	    char *serv, IRS_GETNAMEINFO_BUFLEN_T servlen,
 +	    IRS_GETNAMEINFO_FLAGS_T flags);
 +
 +void freeaddrinfo (struct addrinfo *ai);
 +
 +IRS_GAISTRERROR_RETURN_T
 +gai_strerror(int ecode);
 +
 +#endif
 +
 +/*
  * Tell Emacs to use C mode on this file.
  * Local variables:
  * mode: c
 -- 
 2.9.5
--- a/SOURCES/bind-9.11-rh1410433.patch
+++ b/SOURCES/bind-9.11-rh1410433.patch
@ -1,16 +0,0 @@
 diff --git a/lib/dns/dyndb.c b/lib/dns/dyndb.c
 index 15561ce..e4449b0 100644
 --- a/lib/dns/dyndb.c
 +++ b/lib/dns/dyndb.c
@@ -133,8 +133,11 @@ load_library(isc_mem_t *mctx, const char *filename, const char *instname,
 		      instname, filename);
 	flags = RTLD_NOW|RTLD_LOCAL;
 +#if 0
 +	/* Shared global namespace is required for dns-pkcs11 library */
 #if defined(RTLD_DEEPBIND) && !__SANITIZE_ADDRESS__
 	flags |= RTLD_DEEPBIND;
 +#endif
 #endif
 	handle = dlopen(filename, flags);
--- a/SOURCES/bind-9.11-rh1666814.patch
+++ b/SOURCES/bind-9.11-rh1666814.patch
@ -0,0 +1,29 @@
 From 0f03071080e7fa68433b322359d46abaca2cc5ad Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Wed, 16 Jan 2019 16:27:33 +0100
 Subject: [PATCH] Fix possible crash when loading corrupted file
 Some values passes internal triggers by coincidence. Fix the check and
 check also first_node_offset before even passing it further.
 ---
 lib/dns/rbt.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)
 diff --git a/lib/dns/rbt.c b/lib/dns/rbt.c
 index 5aee5f6..7f2c2d2 100644
 --- a/lib/dns/rbt.c
 +++ b/lib/dns/rbt.c
@@ -945,7 +945,9 @@ dns_rbt_deserialize_tree(void *base_address, size_t filesize,
 	rbt->root = (dns_rbtnode_t *)((char *)base_address + header_offset +
 				      header->first_node_offset);
 -	if ((header->nodecount * sizeof(dns_rbtnode_t)) > filesize) {
 +	if ((header->nodecount * sizeof(dns_rbtnode_t)) > filesize
 +	    || header->first_node_offset > filesize) {
 +
 		result = ISC_R_INVALIDFILE;
 		goto cleanup;
 	}
 -- 
 2.31.1
--- a/SOURCES/bind-9.11-rh1668682.patch
+++ b/SOURCES/bind-9.11-rh1668682.patch
@ -1,37 +0,0 @@
 From 16c1bd61384e993fef13d7be88fdd34551a2b3ce Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Wed, 23 Jan 2019 20:12:51 +0100
 Subject: [PATCH] Use custom random generator only for bind build
 Do not test random entropy on startup when used by DHCP. On most cases
 random entropy is not even used by DHCP. In cases it is (LDAP SSL), fail
 whenever it is not available.
 Resolves: rhbz#1668682
 ---
 lib/dns/openssl_link.c | 2 ++
 1 file changed, 2 insertions(+)
 diff --git a/lib/dns/openssl_link.c b/lib/dns/openssl_link.c
 index 91e87d0..2551b0a 100644
 --- a/lib/dns/openssl_link.c
 +++ b/lib/dns/openssl_link.c
@@ -289,6 +289,7 @@ dst__openssl_init(const char *engine) {
 #endif
 #endif /* !defined(OPENSSL_NO_ENGINE) */
 +#ifdef ISC_PLATFORM_USETHREADS
 	/* Protect ourselves against unseeded PRNG */
 	if (RAND_status() != 1) {
 		FATAL_ERROR(__FILE__, __LINE__,
@@ -296,6 +297,7 @@ dst__openssl_init(const char *engine) {
 			    "cannot be initialized (see the `PRNG not "
 			    "seeded' message in the OpenSSL FAQ)");
 	}
 +#endif /* ISC_PLATFORM_USETHREADS */
 	return (ISC_R_SUCCESS);
 -- 
 2.20.1
--- a/SOURCES/bind-9.11-rh1980757.patch
+++ b/SOURCES/bind-9.11-rh1980757.patch
@ -1,32 +0,0 @@
 From a503519533eb375a5ce1f7566bfc153aac980d87 Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Fri, 9 Jul 2021 20:52:21 +0200
 Subject: [PATCH] Use proper entropy to initialize tsig keyname
 Random names used on GSS backed nsupdate can conflict in specific
 situations. That might include starting a lot of machines from
 containers, where they took all similar time to start. PID and timestamp
 would be similar and therefore randomness is quite low. Use entropy to
 generate more random identifier and reduce chance of conflict.
 ---
 bin/nsupdate/nsupdate.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)
 diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
 index 458aa76..d9e5a2b 100644
 --- a/bin/nsupdate/nsupdate.c
 +++ b/bin/nsupdate/nsupdate.c
@@ -2941,7 +2941,9 @@ start_gssrequest(dns_name_t *master) {
 	keyname = dns_fixedname_initname(&fkname);
 -	isc_random_get(&val);
 +	result = isc_entropy_getdata(entropy, &val, sizeof(val), NULL, 0);
 +	if (result != ISC_R_SUCCESS)
 +		isc_random_get(&val);
 	result = isc_string_printf(mykeystr, sizeof(mykeystr), "%u.sig-%s",
 				   val, namestr);
 	if (result != ISC_R_SUCCESS)
 -- 
 2.31.1
--- a/SOURCES/bind-9.11-rh2101712.patch
+++ b/SOURCES/bind-9.11-rh2101712.patch
@ -1,232 +0,0 @@
 From fff2960981a3294ac641968a17558c8d7eecf74d Mon Sep 17 00:00:00 2001
 From: Mark Andrews <marka@isc.org>
 Date: Wed, 24 Aug 2022 12:21:50 +1000
 Subject: [PATCH] Have dns_zt_apply lock the zone table
 There where a number of places where the zone table should have
 been locked, but wasn't, when dns_zt_apply was called.
 Added a isc_rwlocktype_t type parameter to dns_zt_apply and adjusted
 all calls to using it.  Removed locks in callers.
 Modified upstream commit for v9_11
 ---
 bin/named/server.c       | 11 ++++++-----
 bin/named/statschannel.c |  8 ++++----
 lib/dns/include/dns/zt.h |  4 ++--
 lib/dns/tests/zt_test.c  |  3 ++-
 lib/dns/view.c           |  3 ++-
 lib/dns/zt.c             | 34 +++++++++++++++++++---------------
 6 files changed, 35 insertions(+), 28 deletions(-)
 diff --git a/bin/named/server.c b/bin/named/server.c
 index 9826588e6d..0b4b309461 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
@@ -8723,8 +8723,8 @@ load_configuration(const char *filename, ns_server_t *server,
 		    strcmp(view->name, "_bind") != 0)
 		{
 			dns_view_setviewrevert(view);
 -			(void)dns_zt_apply(view->zonetable, false,
 -					   removed, view);
 +			(void)dns_zt_apply(view->zonetable, isc_rwlocktype_read,
 +					   false, removed, view);
 		}
 		dns_view_detach(&view);
 	}
@@ -10090,8 +10090,8 @@ add_view_tolist(struct dumpcontext *dctx, dns_view_t *view) {
 	ISC_LIST_INIT(vle->zonelist);
 	ISC_LIST_APPEND(dctx->viewlist, vle, link);
 	if (dctx->dumpzones)
 -		result = dns_zt_apply(view->zonetable, true,
 -				      add_zone_tolist, dctx);
 +		result = dns_zt_apply(view->zonetable, isc_rwlocktype_read,
 +				      true, add_zone_tolist, dctx);
 	return (result);
 }
@@ -11367,7 +11367,8 @@ ns_server_sync(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text) {
 		for (view = ISC_LIST_HEAD(server->viewlist);
 		     view != NULL;
 		     view = ISC_LIST_NEXT(view, link)) {
 -			result = dns_zt_apply(view->zonetable, false,
 +			result = dns_zt_apply(view->zonetable,
 +					      isc_rwlocktype_none, false,
 					      synczone, &cleanup);
 			if (result != ISC_R_SUCCESS &&
 			    tresult == ISC_R_SUCCESS)
 diff --git a/bin/named/statschannel.c b/bin/named/statschannel.c
 index 12ab048469..9828df0f4e 100644
 --- a/bin/named/statschannel.c
 +++ b/bin/named/statschannel.c
@@ -1833,8 +1833,8 @@ generatexml(ns_server_t *server, uint32_t flags,
 		if ((flags & STATS_XML_ZONES) != 0) {
 			TRY0(xmlTextWriterStartElement(writer,
 						       ISC_XMLCHAR "zones"));
 -			result = dns_zt_apply(view->zonetable, true,
 -					      zone_xmlrender, writer);
 +			result = dns_zt_apply(view->zonetable, isc_rwlocktype_read,
 +					      true, zone_xmlrender, writer);
 			if (result != ISC_R_SUCCESS)
 				goto error;
 			TRY0(xmlTextWriterEndElement(writer)); /* /zones */
@@ -2489,8 +2489,8 @@ generatejson(ns_server_t *server, size_t *msglen,
 			CHECKMEM(za);
 			if ((flags & STATS_JSON_ZONES) != 0) {
 -				result = dns_zt_apply(view->zonetable, true,
 -						      zone_jsonrender, za);
 +				result = dns_zt_apply(view->zonetable, isc_rwlocktype_read,
 +						      true, zone_jsonrender, za);
 				if (result != ISC_R_SUCCESS) {
 					goto error;
 				}
 diff --git a/lib/dns/include/dns/zt.h b/lib/dns/include/dns/zt.h
 index e658e5bb67..94212250da 100644
 --- a/lib/dns/include/dns/zt.h
 +++ b/lib/dns/include/dns/zt.h
@@ -177,11 +177,11 @@ dns_zt_freezezones(dns_zt_t *zt, bool freeze);
  */
 isc_result_t
 -dns_zt_apply(dns_zt_t *zt, bool stop,
 +dns_zt_apply(dns_zt_t *zt, isc_rwlocktype_t lock, bool stop,
 	     isc_result_t (*action)(dns_zone_t *, void *), void *uap);
 isc_result_t
 -dns_zt_apply2(dns_zt_t *zt, bool stop, isc_result_t *sub,
 +dns_zt_apply2(dns_zt_t *zt, isc_rwlocktype_t lock, bool stop, isc_result_t *sub,
 	      isc_result_t (*action)(dns_zone_t *, void *), void *uap);
 /*%<
  * Apply a given 'action' to all zone zones in the table.
 diff --git a/lib/dns/tests/zt_test.c b/lib/dns/tests/zt_test.c
 index 3f1e812d60..ee75303a50 100644
 --- a/lib/dns/tests/zt_test.c
 +++ b/lib/dns/tests/zt_test.c
@@ -145,7 +145,8 @@ apply(void **state) {
 	assert_non_null(view->zonetable);
 	assert_int_equal(nzones, 0);
 -	result = dns_zt_apply(view->zonetable, false, count_zone, &nzones);
 +	result = dns_zt_apply2(view->zonetable, isc_rwlocktype_read, false, NULL,
 +			      count_zone, &nzones);
 	assert_int_equal(result, ISC_R_SUCCESS);
 	assert_int_equal(nzones, 1);
 diff --git a/lib/dns/view.c b/lib/dns/view.c
 index f01b4dea0f..bd1ced2863 100644
 --- a/lib/dns/view.c
 +++ b/lib/dns/view.c
@@ -676,7 +676,8 @@ dns_view_dialup(dns_view_t *view) {
 	REQUIRE(DNS_VIEW_VALID(view));
 	REQUIRE(view->zonetable != NULL);
 -	(void)dns_zt_apply(view->zonetable, false, dialup, NULL);
 +	(void)dns_zt_apply2(view->zonetable, isc_rwlocktype_read, false, NULL,
 +			   dialup, NULL);
 }
 void
 diff --git a/lib/dns/zt.c b/lib/dns/zt.c
 index 3f12e247e0..af65740325 100644
 --- a/lib/dns/zt.c
 +++ b/lib/dns/zt.c
@@ -202,7 +202,8 @@ flush(dns_zone_t *zone, void *uap) {
 static void
 zt_destroy(dns_zt_t *zt) {
 	if (zt->flush) {
 -		(void)dns_zt_apply(zt, false, flush, NULL);
 +		(void)dns_zt_apply(zt, isc_rwlocktype_none,
 +				   false, flush, NULL);
 	}
 	isc_refcount_destroy(&zt->references);
 	dns_rbt_destroy(&zt->table);
@@ -249,9 +250,7 @@ dns_zt_load(dns_zt_t *zt, bool stop) {
 	REQUIRE(VALID_ZT(zt));
 -	RWLOCK(&zt->rwlock, isc_rwlocktype_read);
 -	result = dns_zt_apply(zt, stop, load, NULL);
 -	RWUNLOCK(&zt->rwlock, isc_rwlocktype_read);
 +	result = dns_zt_apply2(zt, isc_rwlocktype_read, stop, NULL, load, NULL);
 	return (result);
 }
@@ -293,7 +292,7 @@ dns_zt_asyncload2(dns_zt_t *zt, dns_zt_allloaded_t alldone, void *arg,
 	 * Prevent loads_pending going to zero while kicking off the loads.
 	 */
 	zt->loads_pending++;
 -	result = dns_zt_apply2(zt, false, NULL, asyncload, &params);
 +	result = dns_zt_apply2(zt, isc_rwlocktype_none, false, NULL, asyncload, &params);
 	pending = --zt->loads_pending;
 	if (pending != 0) {
 		zt->loaddone = alldone;
@@ -342,9 +341,7 @@ dns_zt_loadnew(dns_zt_t *zt, bool stop) {
 	REQUIRE(VALID_ZT(zt));
 -	RWLOCK(&zt->rwlock, isc_rwlocktype_read);
 -	result = dns_zt_apply(zt, stop, loadnew, NULL);
 -	RWUNLOCK(&zt->rwlock, isc_rwlocktype_read);
 +	result = dns_zt_apply(zt, isc_rwlocktype_read, stop, loadnew, NULL);
 	return (result);
 }
@@ -366,9 +363,7 @@ dns_zt_freezezones(dns_zt_t *zt, bool freeze) {
 	REQUIRE(VALID_ZT(zt));
 -	RWLOCK(&zt->rwlock, isc_rwlocktype_read);
 -	result = dns_zt_apply2(zt, false, &tresult, freezezones, &freeze);
 -	RWUNLOCK(&zt->rwlock, isc_rwlocktype_read);
 +	result = dns_zt_apply2(zt, isc_rwlocktype_read, false, &tresult, freezezones, &freeze);
 	if (tresult == ISC_R_NOTFOUND)
 		tresult = ISC_R_SUCCESS;
 	return ((result == ISC_R_SUCCESS) ? tresult : result);
@@ -490,14 +485,14 @@ dns_zt_setviewrevert(dns_zt_t *zt) {
 }
 isc_result_t
 -dns_zt_apply(dns_zt_t *zt, bool stop,
 +dns_zt_apply(dns_zt_t *zt, isc_rwlocktype_t lock, bool stop,
 	     isc_result_t (*action)(dns_zone_t *, void *), void *uap)
 {
 -	return (dns_zt_apply2(zt, stop, NULL, action, uap));
 +	return (dns_zt_apply2(zt, lock, stop, NULL, action, uap));
 }
 isc_result_t
 -dns_zt_apply2(dns_zt_t *zt, bool stop, isc_result_t *sub,
 +dns_zt_apply2(dns_zt_t *zt, isc_rwlocktype_t lock, bool stop, isc_result_t *sub,
 	      isc_result_t (*action)(dns_zone_t *, void *), void *uap)
 {
 	dns_rbtnode_t *node;
@@ -508,6 +503,10 @@ dns_zt_apply2(dns_zt_t *zt, bool stop, isc_result_t *sub,
 	REQUIRE(VALID_ZT(zt));
 	REQUIRE(action != NULL);
 +	if (lock != isc_rwlocktype_none) {
 +		RWLOCK(&zt->rwlock, lock);
 +	}
 +
 	dns_rbtnodechain_init(&chain, zt->mctx);
 	result = dns_rbtnodechain_first(&chain, zt->table, NULL, NULL);
 	if (result == ISC_R_NOTFOUND) {
@@ -538,8 +537,13 @@ dns_zt_apply2(dns_zt_t *zt, bool stop, isc_result_t *sub,
  cleanup:
 	dns_rbtnodechain_invalidate(&chain);
 -	if (sub != NULL)
 +	if (sub != NULL) {
 		*sub = tresult;
 +	}
 +
 +	if (lock != isc_rwlocktype_none) {
 +		RWUNLOCK(&zt->rwlock, lock);
 +	}
 	return (result);
 }
 -- 
 2.37.2
--- a/SOURCES/bind-9.11-rh2133889.patch
+++ b/SOURCES/bind-9.11-rh2133889.patch
@ -1,26 +0,0 @@
 From c8f5b31f0637315c1c45d0287f05fcad2250f40f Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Thu, 13 Oct 2022 15:35:46 +0200
 Subject: [PATCH] Add include to rwlocktype_t to dns/zt.h
 It got broken as part of bug #2101712 fix. Introduced new definition,
 which passes during bind build, but breaks bind-dyndb-ldap build.
 ---
 lib/dns/include/dns/zt.h | 1 +
 1 file changed, 1 insertion(+)
 diff --git a/lib/dns/include/dns/zt.h b/lib/dns/include/dns/zt.h
 index 9421225..64c24d6 100644
 --- a/lib/dns/include/dns/zt.h
 +++ b/lib/dns/include/dns/zt.h
@@ -18,6 +18,7 @@
 #include <stdbool.h>
 #include <isc/lang.h>
 +#include <isc/rwlock.h>
 #include <dns/types.h>
 -- 
 2.37.3
--- a/SOURCES/bind-9.11-rt31459.patch
+++ b/SOURCES/bind-9.11-rt31459.patch
--- a/SOURCES/bind-9.11-rt46047.patch
+++ b/SOURCES/bind-9.11-rt46047.patch
@ -1,780 +0,0 @@
 From af3b530773231f8cff6548e36962ad1f25e38c5d Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Thu, 28 Sep 2017 10:09:22 -0700
 Subject: [PATCH] completed and corrected the crypto-random change
 4724.	[func]		By default, BIND now uses the random number
 			functions provided by the crypto library (i.e.,
 			OpenSSL or a PKCS#11 provider) as a source of
 			randomness rather than /dev/random.  This is
 			suitable for virtual machine environments
 			which have limited entropy pools and lack
 			hardware random number generators.
 			This can be overridden by specifying another
 			entropy source via the "random-device" option
 			in named.conf, or via the -r command line option;
 			however, for functions requiring full cryptographic
 			strength, such as DNSSEC key generation, this
 			cannot be overridden. In particular, the -r
 			command line option no longer has any effect on
 			dnssec-keygen.
 			This can be disabled by building with
 			"configure --disable-crypto-rand".
 			[RT #31459] [RT #46047]
 ---
 bin/confgen/keygen.c                     | 12 +++---
 bin/dnssec/dnssec-keygen.docbook         | 24 +++++++----
 bin/dnssec/dnssectool.c                  | 12 +++---
 bin/named/client.c                       |  3 +-
 bin/named/config.c                       |  4 +-
 bin/named/controlconf.c                  | 19 +++++---
 bin/named/include/named/server.h         |  2 +
 bin/named/interfacemgr.c                 |  1 +
 bin/named/query.c                        |  1 +
 bin/named/server.c                       | 52 ++++++++++++++--------
 bin/nsupdate/nsupdate.c                  |  4 +-
 bin/tests/system/pipelined/pipequeries.c |  4 +-
 bin/tests/system/tkey/keycreate.c        |  4 +-
 bin/tests/system/tkey/keydelete.c        |  5 +--
 doc/arm/Bv9ARM-book.xml                  | 55 +++++++++++++++++-------
 doc/arm/notes-rh-changes.xml             | 42 ++++++++++++++++++
 doc/arm/notes.xml                        |  1 +
 lib/dns/dst_api.c                        |  4 +-
 lib/dns/include/dst/dst.h                | 14 +++++-
 lib/dns/openssl_link.c                   |  3 +-
 lib/isc/include/isc/entropy.h            | 48 +++++++++++++++------
 lib/isc/include/isc/random.h             | 26 +++++++----
 lib/isccfg/namedconf.c                   |  2 +-
 23 files changed, 240 insertions(+), 102 deletions(-)
 create mode 100644 doc/arm/notes-rh-changes.xml
 diff --git a/bin/confgen/keygen.c b/bin/confgen/keygen.c
 index bd269e7..1ac775f 100644
 --- a/bin/confgen/keygen.c
 +++ b/bin/confgen/keygen.c
@@ -161,17 +161,15 @@ generate_key(isc_mem_t *mctx, const char *randomfile, dns_secalg_t alg,
 	DO("create entropy context", isc_entropy_create(mctx, &ectx));
 -	if (randomfile != NULL && strcmp(randomfile, "keyboard") == 0) {
 -		randomfile = NULL;
 -		open_keyboard = ISC_ENTROPY_KEYBOARDYES;
 -	}
 #ifdef ISC_PLATFORM_CRYPTORANDOM
 -	if (randomfile != NULL &&
 -	    strcmp(randomfile, ISC_PLATFORM_CRYPTORANDOM) == 0) {
 -		randomfile = NULL;
 +	if (randomfile == NULL) {
 		isc_entropy_usehook(ectx, true);
 	}
 #endif
 +	if (randomfile != NULL && strcmp(randomfile, "keyboard") == 0) {
 +		randomfile = NULL;
 +		open_keyboard = ISC_ENTROPY_KEYBOARDYES;
 +	}
 	DO("start entropy source", isc_entropy_usebestsource(ectx,
 							     &entropy_source,
 							     randomfile,
 diff --git a/bin/dnssec/dnssec-keygen.docbook b/bin/dnssec/dnssec-keygen.docbook
 index bd19e1d..2c09b30 100644
 --- a/bin/dnssec/dnssec-keygen.docbook
 +++ b/bin/dnssec/dnssec-keygen.docbook
@@ -349,15 +349,23 @@
 	<term>-r <replaceable class="parameter">randomdev</replaceable></term>
 	<listitem>
 	  <para>
 -	    Specifies the source of randomness.  If the operating
 -	    system does not provide a <filename>/dev/random</filename>
 -	    or equivalent device, the default source of randomness
 -	    is keyboard input.  <filename>randomdev</filename>
 -	    specifies
 +	    Specifies a source of randomness.  Normally, when generating
 +	    DNSSEC keys, this option has no effect; the random number
 +	    generation function provided by the cryptographic library will
 +	    be used.
 +	  </para>
 +	  <para>
 +	    If that behavior is disabled at compile time, however,
 +	    the specified file will be used as entropy source
 +	    for key generation.  <filename>randomdev</filename> is
 	    the name of a character device or file containing random
 -	    data to be used instead of the default.  The special value
 -	    <filename>keyboard</filename> indicates that keyboard
 -	    input should be used.
 +	    data to be used.  The special value <filename>keyboard</filename>
 +	    indicates that keyboard input should be used.
 +	  </para>
 +	  <para>
 +	    The default is <filename>/dev/random</filename> if the
 +	    operating system provides it or an equivalent device;
 +	    if not, the default source of randomness is keyboard input.
 	  </para>
 	</listitem>
       </varlistentry>
 diff --git a/bin/dnssec/dnssectool.c b/bin/dnssec/dnssectool.c
 index 2a0f9c6..6fcd411 100644
 --- a/bin/dnssec/dnssectool.c
 +++ b/bin/dnssec/dnssectool.c
@@ -241,18 +241,16 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
 		ISC_LIST_INIT(sources);
 	}
 +#ifdef ISC_PLATFORM_CRYPTORANDOM
 +	if (randomfile == NULL) {
 +		isc_entropy_usehook(*ectx, true);
 +	}
 +#endif
 	if (randomfile != NULL && strcmp(randomfile, "keyboard") == 0) {
 		usekeyboard = ISC_ENTROPY_KEYBOARDYES;
 		randomfile = NULL;
 	}
 -#ifdef ISC_PLATFORM_CRYPTORANDOM
 -	if (randomfile != NULL &&
 -	    strcmp(randomfile, ISC_PLATFORM_CRYPTORANDOM) == 0) {
 -		randomfile = NULL;
 -		isc_entropy_usehook(*ectx, true);
 -	}
 -#endif
 	result = isc_entropy_usebestsource(*ectx, &source, randomfile,
 					   usekeyboard);
 diff --git a/bin/named/client.c b/bin/named/client.c
 index 4a50ad9..4d140e8 100644
 --- a/bin/named/client.c
 +++ b/bin/named/client.c
@@ -1768,7 +1768,8 @@ ns_client_addopt(ns_client_t *client, dns_message_t *message,
 		isc_buffer_init(&buf, cookie, sizeof(cookie));
 		isc_stdtime_get(&now);
 -		isc_random_get(&nonce);
 +		nonce = ((isc_rng_random(ns_g_server->rngctx) << 16) |
 +			 isc_rng_random(ns_g_server->rngctx));
 		compute_cookie(client, now, nonce, ns_g_server->secret, &buf);
 diff --git a/bin/named/config.c b/bin/named/config.c
 index 9b343fa..5e663c6 100644
 --- a/bin/named/config.c
 +++ b/bin/named/config.c
@@ -98,7 +98,9 @@ options {\n\
 #	pid-file \"" NS_LOCALSTATEDIR "/run/named/named.pid\"; /* or /lwresd.pid */\n\
 	port 53;\n\
 	prefetch 2 9;\n"
 -#ifdef PATH_RANDOMDEV
 +#if defined(ISC_PLATFORM_CRYPTORANDOM)
 +"	random-device none;\n"
 +#elif defined(PATH_RANDOMDEV)
 "	random-device \"" PATH_RANDOMDEV "\";\n"
 #endif
 "	recursing-file \"named.recursing\";\n\
 diff --git a/bin/named/controlconf.c b/bin/named/controlconf.c
 index 9fdf49b..42128dc 100644
 --- a/bin/named/controlconf.c
 +++ b/bin/named/controlconf.c
@@ -327,9 +327,10 @@ log_invalid(isccc_ccmsg_t *ccmsg, isc_result_t result) {
 static void
 control_recvmessage(isc_task_t *task, isc_event_t *event) {
 -	controlconnection_t *conn;
 -	controllistener_t *listener;
 -	controlkey_t *key;
 +	controlconnection_t *conn = NULL;
 +	controllistener_t *listener = NULL;
 +	ns_server_t *server = NULL;
 +	controlkey_t *key = NULL;
 	isccc_sexpr_t *request = NULL;
 	isccc_sexpr_t *response = NULL;
 	uint32_t algorithm;
@@ -340,16 +341,17 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
 	isc_buffer_t *text;
 	isc_result_t result;
 	isc_result_t eresult;
 -	isccc_sexpr_t *_ctrl;
 +	isccc_sexpr_t *_ctrl = NULL;
 	isccc_time_t sent;
 	isccc_time_t exp;
 	uint32_t nonce;
 -	isccc_sexpr_t *data;
 +	isccc_sexpr_t *data = NULL;
 	REQUIRE(event->ev_type == ISCCC_EVENT_CCMSG);
 	conn = event->ev_arg;
 	listener = conn->listener;
 +	server = listener->controls->server;
 	algorithm = DST_ALG_UNKNOWN;
 	secret.rstart = NULL;
 	text = NULL;
@@ -462,8 +464,11 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
 	 * Establish nonce.
 	 */
 	if (conn->nonce == 0) {
 -		while (conn->nonce == 0)
 -			isc_random_get(&conn->nonce);
 +		while (conn->nonce == 0) {
 +			uint16_t r1 = isc_rng_random(server->rngctx);
 +			uint16_t r2 = isc_rng_random(server->rngctx);
 +			conn->nonce = (r1 << 16) | r2;
 +		}
 		eresult = ISC_R_SUCCESS;
 	} else
 		eresult = ns_control_docommand(request, listener->readonly, &text);
 diff --git a/bin/named/include/named/server.h b/bin/named/include/named/server.h
 index 4fd0194..0ba2627 100644
 --- a/bin/named/include/named/server.h
 +++ b/bin/named/include/named/server.h
@@ -20,6 +20,7 @@
 #include <isc/log.h>
 #include <isc/magic.h>
 #include <isc/quota.h>
 +#include <isc/random.h>
 #include <isc/sockaddr.h>
 #include <isc/types.h>
 #include <isc/xml.h>
@@ -135,6 +136,7 @@ struct ns_server {
 	char *			lockfile;
 	uint16_t		transfer_tcp_message_size;
 +	isc_rng_t *		rngctx;
 };
 struct ns_altsecret {
 diff --git a/bin/named/interfacemgr.c b/bin/named/interfacemgr.c
 index 93aac31..e12fad9 100644
 --- a/bin/named/interfacemgr.c
 +++ b/bin/named/interfacemgr.c
@@ -17,6 +17,7 @@
 #include <isc/interfaceiter.h>
 #include <isc/os.h>
 +#include <isc/random.h>
 #include <isc/string.h>
 #include <isc/task.h>
 #include <isc/util.h>
 diff --git a/bin/named/query.c b/bin/named/query.c
 index 58b5914..edf42d2 100644
 --- a/bin/named/query.c
 +++ b/bin/named/query.c
@@ -20,6 +20,7 @@
 #include <isc/mem.h>
 #include <isc/platform.h>
 #include <isc/print.h>
 +#include <isc/random.h>
 #include <isc/rwlock.h>
 #include <isc/serial.h>
 #include <isc/stats.h>
 diff --git a/bin/named/server.c b/bin/named/server.c
 index b2ae57c..cca7fe8 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
@@ -8279,21 +8279,32 @@ load_configuration(const char *filename, ns_server_t *server,
 	 * Open the source of entropy.
 	 */
 	if (first_time) {
 +		const char *randomdev = NULL;
 +		int level = ISC_LOG_ERROR;
 		obj = NULL;
 		result = ns_config_get(maps, "random-device", &obj);
 -		if (result != ISC_R_SUCCESS) {
 +		if (result == ISC_R_SUCCESS) {
 +			if (!cfg_obj_isvoid(obj)) {
 +				level = ISC_LOG_INFO;
 +				randomdev = cfg_obj_asstring(obj);
 +			}
 +		}
 +		if (randomdev == NULL) {
 +#ifdef ISC_PLATFORM_CRYPTORANDOM
 +			isc_entropy_usehook(ns_g_entropy, true);
 +#else
 +			if ((obj != NULL) && !cfg_obj_isvoid(obj))
 +				level = ISC_LOG_INFO;
 			isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
 -				      NS_LOGMODULE_SERVER, ISC_LOG_INFO,
 +				      NS_LOGMODULE_SERVER, level,
 				      "no source of entropy found");
 +			if ((obj == NULL) || cfg_obj_isvoid(obj)) {
 +				CHECK(ISC_R_FAILURE);
 +			}
 +#endif
 		} else {
 -			const char *randomdev = cfg_obj_asstring(obj);
 -#ifdef ISC_PLATFORM_CRYPTORANDOM
 -			if (strcmp(randomdev, ISC_PLATFORM_CRYPTORANDOM) == 0)
 -				isc_entropy_usehook(ns_g_entropy, true);
 -#else
 -			int level = ISC_LOG_ERROR;
 			result = isc_entropy_createfilesource(ns_g_entropy,
 -							      randomdev);
 +			                                      randomdev);
 #ifdef PATH_RANDOMDEV
 			if (ns_g_fallbackentropy != NULL) {
 				level = ISC_LOG_INFO;
@@ -8304,8 +8315,8 @@ load_configuration(const char *filename, ns_server_t *server,
 					      NS_LOGCATEGORY_GENERAL,
 					      NS_LOGMODULE_SERVER,
 					      level,
 -					      "could not open entropy source "
 -					      "%s: %s",
 +					      "could not open "
 +					      "entropy source %s: %s",
 					      randomdev,
 					      isc_result_totext(result));
 			}
@@ -8325,7 +8336,6 @@ load_configuration(const char *filename, ns_server_t *server,
 				}
 				isc_entropy_detach(&ns_g_fallbackentropy);
 			}
 -#endif
 #endif
 		}
@@ -9097,6 +9107,7 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
 	server->in_roothints = NULL;
 	server->blackholeacl = NULL;
 	server->keepresporder = NULL;
 +	server->rngctx = NULL;
 	/* Must be first. */
 	CHECKFATAL(dst_lib_init2(ns_g_mctx, ns_g_entropy,
@@ -9123,6 +9134,9 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
 	CHECKFATAL(dns_tkeyctx_create(ns_g_mctx, ns_g_entropy,
 				      &server->tkeyctx),
 		   "creating TKEY context");
 +	server->rngctx = NULL;
 +	CHECKFATAL(isc_rng_create(ns_g_mctx, ns_g_entropy, &server->rngctx),
 +	           "creating random numbers context");
 	/*
 	 * Setup the server task, which is responsible for coordinating
@@ -9329,7 +9343,8 @@ ns_server_destroy(ns_server_t **serverp) {
 	if (server->zonemgr != NULL)
 		dns_zonemgr_detach(&server->zonemgr);
 -
 +	if (server->rngctx != NULL)
 +		isc_rng_detach(&server->rngctx);
 	if (server->tkeyctx != NULL)
 		dns_tkeyctx_destroy(&server->tkeyctx);
@@ -13366,10 +13381,10 @@ newzone_cfgctx_destroy(void **cfgp) {
 static isc_result_t
 generate_salt(unsigned char *salt, size_t saltlen) {
 -	int i, n;
 +	size_t i, n;
 	union {
 		unsigned char rnd[256];
 -		uint32_t rnd32[64];
 +		uint16_t rnd16[128];
 	} rnd;
 	unsigned char text[512 + 1];
 	isc_region_t r;
@@ -13379,9 +13394,10 @@ generate_salt(unsigned char *salt, size_t saltlen) {
 	if (saltlen > 256U)
 		return (ISC_R_RANGE);
 -	n = (int) (saltlen + sizeof(uint32_t) - 1) / sizeof(uint32_t);
 -	for (i = 0; i < n; i++)
 -		isc_random_get(&rnd.rnd32[i]);
 +	n = (saltlen + sizeof(uint16_t) - 1) / sizeof(uint16_t);
 +	for (i = 0; i < n; i++) {
 +		rnd.rnd16[i] = isc_rng_random(ns_g_server->rngctx);
 +	}
 	memmove(salt, rnd.rnd, saltlen);
 diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
 index 7f15cbc..458aa76 100644
 --- a/bin/nsupdate/nsupdate.c
 +++ b/bin/nsupdate/nsupdate.c
@@ -289,9 +289,7 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
 	}
 #ifdef ISC_PLATFORM_CRYPTORANDOM
 -	if (randomfile != NULL &&
 -	    strcmp(randomfile, ISC_PLATFORM_CRYPTORANDOM) == 0) {
 -		randomfile = NULL;
 +	if (randomfile == NULL) {
 		isc_entropy_usehook(*ectx, true);
 	}
 #endif
 diff --git a/bin/tests/system/pipelined/pipequeries.c b/bin/tests/system/pipelined/pipequeries.c
 index 95b65bf..7a81d4e 100644
 --- a/bin/tests/system/pipelined/pipequeries.c
 +++ b/bin/tests/system/pipelined/pipequeries.c
@@ -280,9 +280,7 @@ main(int argc, char *argv[]) {
 	ectx = NULL;
 	RUNCHECK(isc_entropy_create(mctx, &ectx));
 #ifdef ISC_PLATFORM_CRYPTORANDOM
 -	if (randomfile != NULL &&
 -	    strcmp(randomfile, ISC_PLATFORM_CRYPTORANDOM) == 0) {
 -		randomfile = NULL;
 +	if (randomfile == NULL) {
 		isc_entropy_usehook(ectx, true);
 	}
 #endif
 diff --git a/bin/tests/system/tkey/keycreate.c b/bin/tests/system/tkey/keycreate.c
 index 3236968..4fa77b6 100644
 --- a/bin/tests/system/tkey/keycreate.c
 +++ b/bin/tests/system/tkey/keycreate.c
@@ -255,9 +255,7 @@ main(int argc, char *argv[]) {
 	ectx = NULL;
 	RUNCHECK(isc_entropy_create(mctx, &ectx));
 #ifdef ISC_PLATFORM_CRYPTORANDOM
 -	if (randomfile != NULL &&
 -	    strcmp(randomfile, ISC_PLATFORM_CRYPTORANDOM) == 0) {
 -		randomfile = NULL;
 +	if (randomfile == NULL) {
 		isc_entropy_usehook(ectx, true);
 	}
 #endif
 diff --git a/bin/tests/system/tkey/keydelete.c b/bin/tests/system/tkey/keydelete.c
 index 43fb6b0..105e151 100644
 --- a/bin/tests/system/tkey/keydelete.c
 +++ b/bin/tests/system/tkey/keydelete.c
@@ -171,6 +171,7 @@ main(int argc, char **argv) {
 		randomfile = argv[2];
 		argv += 2;
 		argc -= 2;
 +		POST(argc);
 	}
 	keyname = argv[1];
@@ -182,9 +183,7 @@ main(int argc, char **argv) {
 	ectx = NULL;
 	RUNCHECK(isc_entropy_create(mctx, &ectx));
 #ifdef ISC_PLATFORM_CRYPTORANDOM
 -	if (randomfile != NULL &&
 -	    strcmp(randomfile, ISC_PLATFORM_CRYPTORANDOM) == 0) {
 -		randomfile = NULL;
 +	if (randomfile == NULL) {
 		isc_entropy_usehook(ectx, true);
 	}
 #endif
 diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
 index ca98726..1f9df2c 100644
 --- a/doc/arm/Bv9ARM-book.xml
 +++ b/doc/arm/Bv9ARM-book.xml
@@ -5034,22 +5034,45 @@ badresp:1,adberr:0,findfail:0,valfail:0]
 	    <term><command>random-device</command></term>
 	    <listitem>
 	      <para>
 -		This specifies a source of entropy to be used by the server.  Entropy is
 -		primarily needed
 -		for DNSSEC operations, such as TKEY transactions and dynamic
 -		update of signed
 -		zones.  This option specifies the device (or file) from which
 -		to read
 -		entropy.  If it is a file, operations requiring entropy will
 -		fail when the
 -		file has been exhausted.  If <command>random-device</command> is not specified, the default value
 -		is
 -		<filename>/dev/random</filename>
 -		(or equivalent) when present, and none otherwise.  The
 -		<command>random-device</command> option takes
 -		effect during
 -		the initial configuration load at server startup time and
 -		is ignored on subsequent reloads.
 +		Specifies a source of entropy to be used by the server.
 +		This is a device or file from which to read entropy.
 +		If it is a file, operations requiring entropy
 +		will fail when the file has been exhausted.
 +	      </para>
 +	      <para>
 +		Entropy is needed for cryptographic operations such as
 +		TKEY transactions, dynamic update of signed zones, and
 +		generation of TSIG session keys. It is also used for
 +		seeding and stirring the pseudo-random number generator,
 +		which is used for less critical functions requiring
 +		randomness such as generation of DNS message transaction
 +		ID's.
 +	      </para>
 +	      <para>
 +		If <command>random-device</command> is not specified, or
 +		if it is set to <literal>none</literal>, entropy will be
 +		read from the random number generation function supplied
 +		by the cryptographic library with which BIND was linked
 +		(i.e.  OpenSSL or a PKCS#11 provider).
 +	      </para>
 +	      <para>
 +		The <command>random-device</command> option takes
 +		effect during the initial configuration load at server
 +		startup time and is ignored on subsequent reloads.
 +	      </para>
 +	      <para>
 +		If BIND is built with
 +		<command>configure --disable-crypto-rand</command>, then
 +		entropy is <emphasis>not</emphasis> sourced from the
 +		cryptographic library. In this case, if
 +		<command>random-device</command> is not specified, the
 +		default value is the system random device,
 +		<filename>/dev/random</filename> or the equivalent.
 +		This default can be overridden with
 +		<command>configure --with-randomdev</command>.
 +		If no system random device exists, then no entropy source
 +		will be configured, and <command>named</command> will only
 +		be able to use pseudo-random numbers.
 	      </para>
 	    </listitem>
 	  </varlistentry>
 diff --git a/doc/arm/notes-rh-changes.xml b/doc/arm/notes-rh-changes.xml
 new file mode 100644
 index 0000000..89a4961
 --- /dev/null
 +++ b/doc/arm/notes-rh-changes.xml
@@ -0,0 +1,42 @@
 +<!--
 + - Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 + -
 + - This Source Code Form is subject to the terms of the Mozilla Public
 + - License, v. 2.0. If a copy of the MPL was not distributed with this
 + - file, You can obtain one at http://mozilla.org/MPL/2.0/.
 + -
 + - See the COPYRIGHT file distributed with this work for additional
 + - information regarding copyright ownership.
 +-->
 +
 +<section xml:id="relnotes_rh_changes"><info><title>Red Hat Specific Changes</title></info>
 +  <itemizedlist>
 +     <listitem>
 +      <para>
 +        By default, BIND now uses the random number generation functions
 +        in the cryptographic library (i.e., OpenSSL or a PKCS#11
 +        provider) as a source of high-quality randomness rather than
 +        <filename>/dev/random</filename>.  This is suitable for virtual
 +        machine environments, which may have limited entropy pools and
 +        lack hardware random number generators.
 +      </para>
 +      <para>
 +        This can be overridden by specifying another entropy source via
 +        the <command>random-device</command> option in
 +        <filename>named.conf</filename>, or via the <command>-r</command>
 +        command line option.  However, for functions requiring full
 +        cryptographic strength, such as DNSSEC key generation, this
 +        <emphasis>cannot</emphasis> be overridden. In particular, the
 +        <command>-r</command> command line option no longer has any
 +        effect on <command>dnssec-keygen</command>.
 +      </para>
 +      <para>
 +        This can be disabled by building with
 +        <command>configure --disable-crypto-rand</command>, in which
 +        case <filename>/dev/random</filename> will be the default
 +        entropy source.  [RT #31459] [RT #46047]
 +      </para>
 +    </listitem>
 +  </itemizedlist>
 +</section>
 +
 diff --git a/doc/arm/notes.xml b/doc/arm/notes.xml
 index a5e42c0..f8cb1f9 100644
 --- a/doc/arm/notes.xml
 +++ b/doc/arm/notes.xml
@@ -47,6 +47,7 @@
   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-9.11.1.xml"/>
   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-9.11.0.xml"/>
 +  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-rh-changes.xml"/>
   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-eol.xml"/>
   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-thankyou.xml"/>
 </section>
 diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c
 index aa54afc..2156384 100644
 --- a/lib/dns/dst_api.c
 +++ b/lib/dns/dst_api.c
@@ -2017,10 +2017,12 @@ dst__entropy_getdata(void *buf, unsigned int len, bool pseudo) {
 	else
 		flags |= ISC_ENTROPY_BLOCKING;
 #ifdef ISC_PLATFORM_CRYPTORANDOM
 +	/* get entropy directly from crypto provider */
 	return (dst_random_getdata(buf, len, NULL, flags));
 #else
 +	/* get entropy from entropy source or hook function */
 	return (isc_entropy_getdata(dst_entropy_pool, buf, len, NULL, flags));
 -#endif
 +#endif /* ISC_PLATFORM_CRYPTORANDOM */
 #endif /* PKCS11CRYPTO */
 }
 diff --git a/lib/dns/include/dst/dst.h b/lib/dns/include/dst/dst.h
 index 3aba028..180c841 100644
 --- a/lib/dns/include/dst/dst.h
 +++ b/lib/dns/include/dst/dst.h
@@ -163,8 +163,18 @@ isc_result_t
 dst_random_getdata(void *data, unsigned int length,
 		   unsigned int *returned, unsigned int flags);
 /*%<
 - * \brief Return data from the crypto random generator.
 - * Specialization of isc_entropy_getdata().
 + * Gets random data from the random generator provided by the
 + * crypto library, if BIND was built with --enable-crypto-rand.
 + *
 + * See isc_entropy_getdata() for parameter usage. Normally when
 + * this function is available, it will be set up as a hook in the
 + * entropy context, so that isc_entropy_getdata() is a front-end to
 + * this function.
 + *
 + * Returns:
 + * \li	ISC_R_SUCCESS on success
 + * \li	ISC_R_NOTIMPLEMENTED if BIND is built with --disable-crypto-rand
 + * \li	DST_R_OPENSSLFAILURE, DST_R_CRYPTOFAILURE, or other codes on error
  */
 bool
 diff --git a/lib/dns/openssl_link.c b/lib/dns/openssl_link.c
 index 3f4f822..cfdc757 100644
 --- a/lib/dns/openssl_link.c
 +++ b/lib/dns/openssl_link.c
@@ -484,7 +484,8 @@ dst__openssl_getengine(const char *engine) {
 isc_result_t
 dst_random_getdata(void *data, unsigned int length,
 -		   unsigned int *returned, unsigned int flags) {
 +		   unsigned int *returned, unsigned int flags)
 +{
 #ifdef ISC_PLATFORM_CRYPTORANDOM
 #ifndef DONT_REQUIRE_DST_LIB_INIT
 	INSIST(dst__memory_pool != NULL);
 diff --git a/lib/isc/include/isc/entropy.h b/lib/isc/include/isc/entropy.h
 index f32c9dc..bed276b 100644
 --- a/lib/isc/include/isc/entropy.h
 +++ b/lib/isc/include/isc/entropy.h
@@ -189,9 +189,8 @@ isc_entropy_createcallbacksource(isc_entropy_t *ent,
 /*!<
  * \brief Create an entropy source that is polled via a callback.
  *
 - * This would
 - * be used when keyboard input is used, or a GUI input method.  It can
 - * also be used to hook in any external entropy source.
 + * This would be used when keyboard input is used, or a GUI input method.
 + * It can also be used to hook in any external entropy source.
  *
  * Samples are added via isc_entropy_addcallbacksample(), below.
  * _addcallbacksample() is the only function which may be called from
@@ -232,15 +231,32 @@ isc_result_t
 isc_entropy_getdata(isc_entropy_t *ent, void *data, unsigned int length,
 		    unsigned int *returned, unsigned int flags);
 /*!<
 - * \brief Extract data from the entropy pool.  This may load the pool from various
 - * sources.
 + * \brief Get random data from entropy pool 'ent'.
  *
 - * Do this by stirring the pool and returning a part of hash as randomness.
 - * Note that no secrets are given away here since parts of the hash are
 - * xored together before returned.
 + * If a hook has been set up using isc_entropy_sethook() and
 + * isc_entropy_usehook(), then the hook function will be called to get
 + * random data.
  *
 - * Honor the request from the caller to only return good data, any data,
 - * etc.
 + * Otherwise, randomness is extracted from the entropy pool set up in BIND.
 + * This may cause the pool to be loaded from various sources. Ths is done
 + * by stirring the pool and returning a part of hash as randomness.
 + * (Note that no secrets are given away here since parts of the hash are
 + * XORed together before returning.)
 + *
 + * 'flags' may contain ISC_ENTROPY_GOODONLY, ISC_ENTROPY_PARTIAL, or
 + * ISC_ENTROPY_BLOCKING. These will be honored if the hook function is
 + * not in use. If it is, the flags will be passed to the hook function
 + * but it may ignore them.
 + *
 + * Up to 'length' bytes of randomness are retrieved and copied into 'data'.
 + * (If 'returned' is not NULL, and the number of bytes copied is less than
 + * 'length' - which may happen if ISC_ENTROPY_PARTIAL was used - then the
 + * number of bytes copied will be stored in *returned.)
 + *
 + * Returns:
 + * \li	ISC_R_SUCCESS on success
 + * \li	ISC_R_NOENTROPY if entropy pool is empty
 + * \li	other error codes are possible when a hook is in use
  */
 void
@@ -305,13 +321,21 @@ isc_entropy_usebestsource(isc_entropy_t *ectx, isc_entropysource_t **source,
 void
 isc_entropy_usehook(isc_entropy_t *ectx, bool onoff);
 /*!<
 - * \brief Mark/unmark the given entropy structure as being hooked.
 + * \brief Configure entropy context 'ectx' to use the hook function
 + *
 + * Sets the entropy context to call the hook function for random number
 + * generation, if such a function has been configured via
 + * isc_entropy_sethook(), whenever isc_entropy_getdata() is called.
  */
 void
 isc_entropy_sethook(isc_entropy_getdata_t myhook);
 /*!<
 - * \brief Set the getdata hook (e.g., for a crypto random generator).
 + * \brief Set the hook function.
 + *
 + * The hook function is a global value: only one hook function
 + * can be set in the system. Individual entropy contexts may be
 + * configured to use it, or not, by calling isc_entropy_usehook().
  */
 ISC_LANG_ENDDECLS
 diff --git a/lib/isc/include/isc/random.h b/lib/isc/include/isc/random.h
 index f38e80d..3cb1c56 100644
 --- a/lib/isc/include/isc/random.h
 +++ b/lib/isc/include/isc/random.h
@@ -19,13 +19,23 @@
 #include <isc/mutex.h>
 /*! \file isc/random.h
 - * \brief Implements a random state pool which will let the caller return a
 - * series of possibly non-reproducible random values.
 + * \brief Implements pseudo random number generators.
  *
 - * Note that the
 - * strength of these numbers is not all that high, and should not be
 - * used in cryptography functions.  It is useful for jittering values
 - * a bit here and there, such as timeouts, etc.
 + * Two pseudo-random number generators are implemented, in isc_random_*
 + * and isc_rng_*. Neither one is very strong; they should not be used
 + * in cryptography functions.
 + *
 + * isc_random_* is based on arc4random if it is available on the system.
 + * Otherwise it is based on the posix srand() and rand() functions.
 + * It is useful for jittering values a bit here and there, such as
 + * timeouts, etc, but should not be relied upon to generate
 + * unpredictable sequences (for example, when choosing transaction IDs).
 +  *
 + * isc_rng_* is based on ChaCha20, and is seeded and stirred from the
 + * system entropy source. It is stronger than isc_random_* and can
 + * be used for generating unpredictable sequences. It is still not as
 + * good as using system entropy directly (see entropy.h) and should not
 + * be used for cryptographic functions such as key generation.
  */
 ISC_LANG_BEGINDECLS
@@ -113,8 +123,8 @@ isc_rng_random(isc_rng_t *rngctx);
 uint16_t
 isc_rng_uniformrandom(isc_rng_t *rngctx, uint16_t upper_bound);
 /*%<
 - * Returns a uniformly distributed pseudo random 16-bit unsigned
 - * integer.
 + * Returns a uniformly distributed pseudo-random 16-bit unsigned integer
 + * less than 'upper_bound'.
  */
 ISC_LANG_ENDDECLS
 diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
 index e74c93b..212194e 100644
 --- a/lib/isccfg/namedconf.c
 +++ b/lib/isccfg/namedconf.c
@@ -1109,7 +1109,7 @@ options_clauses[] = {
 	{ "pid-file", &cfg_type_qstringornone, 0 },
 	{ "port", &cfg_type_uint32, 0 },
 	{ "querylog", &cfg_type_boolean, 0 },
 -	{ "random-device", &cfg_type_qstring, 0 },
 +	{ "random-device", &cfg_type_qstringornone, 0 },
 	{ "recursing-file", &cfg_type_qstring, 0 },
 	{ "recursive-clients", &cfg_type_uint32, 0 },
 	{ "reserved-sockets", &cfg_type_uint32, 0 },
 -- 
 2.26.2
--- a/SOURCES/bind-9.11-serve-stale.patch
+++ b/SOURCES/bind-9.11-serve-stale.patch
--- a/SOURCES/bind-9.11-stale-cache.patch
+++ b/SOURCES/bind-9.11-stale-cache.patch
@ -1,65 +0,0 @@
 From 8a7bff93037432fcfe8532752e89f150ea3030a4 Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Mon, 9 Oct 2023 19:00:12 +0200
 Subject: [PATCH] Do not keep stale records by default
 By default set max-stale-ttl to 0, unless stale-answer-enable yes. This
 were enabled by mistake when backporting fix for CVE-2023-2828. It
 causes increased cache usage on servers not wanting to serve stale
 records. Fix that by setting smart defaults based on stale answers
 enabled with possible manual tuning.
 ---
 bin/named/server.c | 25 +++++++++++++++++++------
 1 file changed, 19 insertions(+), 6 deletions(-)
 diff --git a/bin/named/server.c b/bin/named/server.c
 index 7af90d0..afdc4fa 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
@@ -3295,7 +3295,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	size_t max_acache_size;
 	size_t max_adb_size;
 	uint32_t lame_ttl, fail_ttl;
 -	uint32_t max_stale_ttl;
 +	uint32_t max_stale_ttl = 0;
 	dns_tsig_keyring_t *ring = NULL;
 	dns_view_t *pview = NULL;	/* Production view */
 	isc_mem_t *cmctx = NULL, *hmctx = NULL;
@@ -3739,16 +3739,29 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	if (view->maxncachettl > 7 * 24 * 3600)
 		view->maxncachettl = 7 * 24 * 3600;
 -	obj = NULL;
 -	result = ns_config_get(maps, "max-stale-ttl", &obj);
 -	INSIST(result == ISC_R_SUCCESS);
 -	max_stale_ttl = cfg_obj_asuint32(obj);
 -
 	obj = NULL;
 	result = ns_config_get(maps, "stale-answer-enable", &obj);
 	INSIST(result == ISC_R_SUCCESS);
 	view->staleanswersenable = cfg_obj_asboolean(obj);
 +	// RHEL-11785 -- set the stale-ttl to non-zero value only if enabled
 +	obj = NULL;
 +	if (view->staleanswersenable) {
 +		result = ns_config_get(maps, "max-stale-ttl", &obj);
 +		INSIST(result == ISC_R_SUCCESS);
 +		max_stale_ttl = cfg_obj_asuint32(obj);
 +		/*
 +		 * If 'stale-answer-enable' is false, max_stale_ttl is set
 +		 * to 0, meaning keeping stale RRsets in cache is disabled.
 +		 */
 +	} else {
 +		/* Do not use default value if stale is disabled,
 +		 * but allow manual overriding, like 'stale-cache-enable' */
 +		result = ns_config_get(optionmaps, "max-stale-ttl", &obj);
 +		if (result == ISC_R_SUCCESS)
 +			max_stale_ttl = cfg_obj_asuint32(obj);
 +	}
 +
 	result = dns_viewlist_find(&ns_g_server->viewlist, view->name,
 				   view->rdclass, &pview);
 	if (result == ISC_R_SUCCESS) {
 -- 
 2.41.0
--- a/SOURCES/bind-9.11-unit-disable-random.patch
+++ b/SOURCES/bind-9.11-unit-disable-random.patch
@ -1,30 +0,0 @@
 From 373f07148217a8e70e33446f5108fb42d1079ba6 Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Thu, 21 Feb 2019 22:42:27 +0100
 Subject: [PATCH] Disable random_test
 It fails too often on some architecture, failing the whole build along.
 Because it runs two times for pkcs11 and normal build and any of
 subtests can occasionally fail, stop it.
 It can be used again by defining 'unstable' variable in Kyuafile.
 ---
 lib/isc/tests/Kyuafile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/lib/isc/tests/Kyuafile b/lib/isc/tests/Kyuafile
 index 4cd2574..9df2340 100644
 --- a/lib/isc/tests/Kyuafile
 +++ b/lib/isc/tests/Kyuafile
@@ -19,7 +19,7 @@ tap_test_program{name='pool_test'}
 tap_test_program{name='print_test'}
 tap_test_program{name='queue_test'}
 tap_test_program{name='radix_test'}
 -tap_test_program{name='random_test'}
 +tap_test_program{name='random_test', required_configs='unstable'}
 tap_test_program{name='regex_test'}
 tap_test_program{name='result_test'}
 tap_test_program{name='safe_test'}
 -- 
 2.20.1
--- a/SOURCES/bind-9.11-zone2ldap.patch
+++ b/SOURCES/bind-9.11-zone2ldap.patch
@ -1,195 +0,0 @@
 From 9683a4d2524b870c4cee09259cb5eb7b8075a507 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Tue, 18 Dec 2018 16:06:26 +0100
 Subject: [PATCH] Make absolute hostname by dns API instead of strings
 Duplicate all strings in dc_list. Free allocated memory on each record.
 ---
 bin/sdb_tools/zone2ldap.c | 70 +++++++++++++++++++++++++--------------
 1 file changed, 45 insertions(+), 25 deletions(-)
 diff --git a/bin/sdb_tools/zone2ldap.c b/bin/sdb_tools/zone2ldap.c
 index d59936c..9ba73b8 100644
 --- a/bin/sdb_tools/zone2ldap.c
 +++ b/bin/sdb_tools/zone2ldap.c
@@ -84,6 +84,10 @@ int get_attr_list_size (char **tmp);
 /* Get a DN */
 char *build_dn_from_dc_list (char **dc_list, unsigned int ttl, int flag, char *zone);
 +/* Free a DN list */
 +static void
 +free_dc_list(char **dc_list);
 +
 /* Add to RR list */
 void add_to_rr_list (char *dn, char *name, char *type, char *data,
 		     unsigned int ttl, unsigned int flags);
@@ -120,6 +124,7 @@ static char dNSTTL            []="dNSTTL";
 static char zoneName          []="zoneName";
 static char dc                []="dc";
 static char sameZone          []="@";
 +static char dot               []=".";
 /* LDAPMod mod_values: */
 static char *objectClasses    []= { &(topClass[0]), &(dNSZoneClass[0]), NULL };
 static char *topObjectClasses []= { &(topClass[0]), &(dcObjectClass[0]), &(dNSZoneClass[0]), NULL };
@@ -391,6 +396,8 @@ main (int argc, char **argv)
 	    }
 	}
 +
 +        free_dc_list(dc_list);
     }
   else
     {
@@ -446,12 +453,18 @@ generate_ldap (dns_name_t * dnsname, dns_rdata_t * rdata, unsigned int ttl)
   char data[2048];
   char **dc_list;
   char *dn;
 +  size_t argzone_len;
 +  bool omit_dot;
   isc_buffer_t buff;
   isc_result_t result;
   isc_buffer_init (&buff, name, sizeof (name));
   result = dns_name_totext (dnsname, true, &buff);
 +  argzone_len = strlen(argzone);
 +  /* If argzone is absolute, output absolute name too */
 +  omit_dot = (!(argzone_len > 0 && argzone[argzone_len-1] == '.'));
 +  result = dns_name_totext (dnsname, omit_dot, &buff);
   isc_result_check (result, "dns_name_totext");
   name[isc_buffer_usedlength (&buff)] = 0;
@@ -473,6 +486,7 @@ generate_ldap (dns_name_t * dnsname, dns_rdata_t * rdata, unsigned int ttl)
     printf ("Adding %s (%s %s) to run queue list.\n", dn, type, data);
   add_to_rr_list (dn, dc_list[len], (char*)type, (char*)data, ttl, DNS_OBJECT);
 +  free_dc_list(dc_list);
 }
@@ -533,12 +547,9 @@ add_to_rr_list (char *dn, char *name, char *type,
       if (tmp->attrs == (LDAPMod **) NULL)
 	fatal("calloc");
 -      for (i = 0; i < (int)flags; i++)
 -	{
 -	  tmp->attrs[i] = (LDAPMod *) malloc (sizeof (LDAPMod));
 -	  if (tmp->attrs[i] == (LDAPMod *) NULL)
 -	    fatal("malloc");
 -	}
 +      tmp->attrs[0] = (LDAPMod *) malloc (sizeof (LDAPMod));
 +      if (tmp->attrs[0] == (LDAPMod *) NULL)
 +	  fatal("malloc");
       tmp->attrs[0]->mod_op = LDAP_MOD_ADD;
       tmp->attrs[0]->mod_type = objectClass;
@@ -554,9 +565,18 @@ add_to_rr_list (char *dn, char *name, char *type,
 	  return;
 	}
 +      for (i = 1; i < (int)flags-1; i++)
 +	{
 +	  tmp->attrs[i] = (LDAPMod *) malloc (sizeof (LDAPMod));
 +	  if (tmp->attrs[i] == (LDAPMod *) NULL)
 +	    fatal("malloc");
 +	}
 +      tmp->attrs[i] = NULL;
 +
 +
       tmp->attrs[1]->mod_op = LDAP_MOD_ADD;
       tmp->attrs[1]->mod_type = relativeDomainName;
 -      tmp->attrs[1]->mod_values = (char **) calloc (sizeof (char *), 2);
 +      tmp->attrs[1]->mod_values = (char **) calloc (sizeof (char *), 3);
       if (tmp->attrs[1]->mod_values == (char **)NULL)
 	fatal("calloc");
@@ -701,24 +721,16 @@ hostname_to_dn_list (char *hostname, char *zone, unsigned int flags)
 {
   char *tmp;
   int i = 0;
 +  int j = 0;
   char *hname=0L, *last=0L;
   int hlen=strlen(hostname), zlen=(strlen(zone));
 /*  printf("hostname: %s zone: %s\n",hostname, zone); */
 -  hname=0L;
   if(flags == DNS_OBJECT)
   {
 -      if( (zone[ zlen - 1 ] == '.') && (hostname[hlen - 1] != '.') )
 -      {
 -	  hname=(char*)malloc(hlen + 1);
 -	  hlen += 1;
 -	  sprintf(hname, "%s.", hostname);
 -	  hostname = hname;
 -      }
       if(strcmp(hostname, zone) == 0)
       {
 -	  if( hname == 0 )
 -	      hname=strdup(hostname);
 +	  hname= strdup(hostname);
 	  last = strdup(sameZone);
       }else
       {
@@ -726,8 +738,6 @@ hostname_to_dn_list (char *hostname, char *zone, unsigned int flags)
 	     ||( strcmp( hostname + (hlen - zlen), zone ) != 0)
 	    )
 	  {
 -	      if( hname != 0 )
 -		  free(hname);
 	      hname=(char*)malloc( hlen + zlen + 1);
 	      if( *zone == '.' )
 		  sprintf(hname, "%s%s", hostname, zone);
@@ -735,8 +745,7 @@ hostname_to_dn_list (char *hostname, char *zone, unsigned int flags)
 		  sprintf(hname,"%s",zone);
 	  }else
 	  {
 -	      if( hname == 0 )
 -		  hname = strdup(hostname);
 +	      hname = strdup(hostname);
 	  }
 	  last = hname;
       }
@@ -749,18 +758,21 @@ hostname_to_dn_list (char *hostname, char *zone, unsigned int flags)
   for (tmp = strrchr (hname, '.'); tmp != (char *) 0;
        tmp = strrchr (hname, '.'))
   {
 -      if( *( tmp + 1 ) != '\0' )
 +      tmp[0] = '\0';
 +      if( tmp[1] != '\0' )
       {
 -	  *tmp = '\0';
 	  dn_buffer[i++] = ++tmp;
       }else
       { /* trailing '.' ! */
 -	  dn_buffer[i++] = strdup(".");
 -	  *tmp = '\0';
 +	  dn_buffer[i++] = dot;
 	  if( tmp == hname )
 	      break;
       }
   }
 +  for (j=0; j<i; j++)
 +  {
 +      dn_buffer[j] = strdup(dn_buffer[j]);
 +  }
   if( ( last != hname ) && (tmp != hname) )
       dn_buffer[i++] = hname;
   dn_buffer[i++] = last;
@@ -820,6 +832,14 @@ build_dn_from_dc_list (char **dc_list, unsigned int ttl, int flag, char *zone)
   return dn;
 }
 +static void
 +free_dc_list(char **dc_list)
 +{
 +    for (; *dc_list; dc_list++) {
 +        free(*dc_list);
 +	*dc_list=NULL;
 +    }
 +}
 /* Initialize LDAP Conn */
 void
 -- 
 2.21.1
--- a/SOURCES/bind-9.14-config-pkcs11.patch
+++ b/SOURCES/bind-9.14-config-pkcs11.patch
@ -0,0 +1,83 @@
 From e6ab9c67f0a14adc23c1067e03a106da1b1651b7 Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Fri, 18 Oct 2019 21:30:52 +0200
 Subject: [PATCH] Move USE_PKCS11 and USE_OPENSSL out of config.h
 Building two variants with the same common code requires to unset
 USE_PKCS11 on part of build. That is not possible with config.h value.
 Move it as normal define to CDEFINES.
 ---
 bin/confgen/Makefile.in |  2 +-
 configure.ac            |  8 ++++++--
 lib/dns/dst_internal.h  | 12 +++++++++---
 3 files changed, 16 insertions(+), 6 deletions(-)
 diff --git a/bin/confgen/Makefile.in b/bin/confgen/Makefile.in
 index 1b7512d..c126bf3 100644
 --- a/bin/confgen/Makefile.in
 +++ b/bin/confgen/Makefile.in
@@ -22,7 +22,7 @@ VERSION=@BIND9_VERSION@
 CINCLUDES = -I${srcdir}/include ${ISC_INCLUDES} ${ISCCC_INCLUDES} \
 	${ISCCFG_INCLUDES} ${DNS_INCLUDES} ${BIND9_INCLUDES}
 -CDEFINES =
 +CDEFINES = @USE_PKCS11@
 CWARNINGS =
 ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
 diff --git a/configure.ac b/configure.ac
 index f5483fe..08a7d8a 100644
 --- a/configure.ac
 +++ b/configure.ac
@@ -935,10 +935,14 @@ AC_SUBST([PKCS11_TEST])
 AC_SUBST([PKCS11_TOOLS])
 AC_SUBST([PKCS11_MANS])
 +USE_PKCS11='-DUSE_PKCS11=0'
 +USE_OPENSSL='-DUSE_OPENSSL=0'
 AC_SUBST([CRYPTO])
 AS_CASE([$CRYPTO],
 -	[pkcs11],[AC_DEFINE([USE_PKCS11], [1], [define if PKCS11 is used for Public-Key Cryptography])],
 -	[AC_DEFINE([USE_OPENSSL], [1], [define if OpenSSL is used for Public-Key Cryptography])])
 +	[pkcs11],[USE_PKCS11='-DUSE_PKCS11=1'],
 +	[USE_OPENSSL='-DUSE_OPENSSL=1'])
 +AC_SUBST(USE_PKCS11)
 +AC_SUBST(USE_OPENSSL)
 # preparation for automake
 # AM_CONDITIONAL([PKCS11_TOOLS], [test "$with_native_pkcs11" = "yes"])
 diff --git a/lib/dns/dst_internal.h b/lib/dns/dst_internal.h
 index 2c3b4a3..55e9dc4 100644
 --- a/lib/dns/dst_internal.h
 +++ b/lib/dns/dst_internal.h
@@ -38,6 +38,13 @@
 #include <isc/stdtime.h>
 #include <isc/types.h>
 +#ifndef USE_PKCS11
 +#define USE_PKCS11 0
 +#endif
 +#ifndef USE_OPENSSL
 +#define USE_OPENSSL (! USE_PKCS11)
 +#endif
 +
 #if USE_PKCS11
 #include <pk11/pk11.h>
 #include <pk11/site.h>
@@ -116,11 +123,10 @@ struct dst_key {
 		void *generic;
 		dns_gss_ctx_id_t gssctx;
 		DH *dh;
 -#if USE_OPENSSL
 -		EVP_PKEY *pkey;
 -#endif /* if USE_OPENSSL */
 #if USE_PKCS11
 		pk11_object_t *pkey;
 +#else
 +		EVP_PKEY *pkey;
 #endif /* if USE_PKCS11 */
 		dst_hmac_key_t *hmac_key;
 	} keydata; /*%< pointer to key in crypto pkg fmt */
 -- 
 2.26.2
--- a/SOURCES/bind-9.15-resolver-ntasks.patch
+++ b/SOURCES/bind-9.15-resolver-ntasks.patch
@ -1,58 +0,0 @@
 From 6d6acf236841da5c2511f8afcd3e4a89af4c5658 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Witold=20Kr=C4=99cicki?= <wpk@isc.org>
 Date: Fri, 14 Feb 2020 09:18:48 +0100
 Subject: [PATCH] Use RESOLVER_NTASKS_PERCPU - 32 for regular tuning, 8 for
 small
 Modify original upstream commit 0d80266f7e3, add high limit of used
 tasks. Minimum would be lower on machines with few cpus, but maximum
 would stay unchanged. Should prevent negatives of this change.
 Signed-off-by: Petr Mensik <pemensik@redhat.com>
 ---
 bin/named/server.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)
 diff --git a/bin/named/server.c b/bin/named/server.c
 index 39b1124..94b4daa 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
@@ -148,11 +148,13 @@
 #endif
 #ifdef TUNE_LARGE
 -#define RESOLVER_NTASKS 523
 +#define RESOLVER_NTASKS_MAX 523
 +#define RESOLVER_NTASKS_PERCPU 32
 #define UDPBUFFERS 32768
 #define EXCLBUFFERS 32768
 #else
 -#define RESOLVER_NTASKS 31
 +#define RESOLVER_NTASKS_MAX 31
 +#define RESOLVER_NTASKS_PERCPU 8
 #define UDPBUFFERS 1000
 #define EXCLBUFFERS 4096
 #endif /* TUNE_LARGE */
@@ -3318,7 +3320,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	ns_cache_t *nsc;
 	bool zero_no_soattl;
 	dns_acl_t *clients = NULL, *mapped = NULL, *excluded = NULL;
 -	unsigned int query_timeout, ndisp;
 +	unsigned int query_timeout, ndisp, ntasks;
 	bool old_rpz_ok = false;
 	isc_dscp_t dscp4 = -1, dscp6 = -1;
 	dns_dyndbctx_t *dctx = NULL;
@@ -3926,7 +3928,9 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	dns_view_setresquerystats(view, resquerystats);
 	ndisp = 4 * ISC_MIN(ns_g_udpdisp, MAX_UDP_DISPATCH);
 -	CHECK(dns_view_createresolver(view, ns_g_taskmgr, RESOLVER_NTASKS,
 +	ntasks = ISC_MIN(RESOLVER_NTASKS_PERCPU * ns_g_cpus,
 +		         RESOLVER_NTASKS_MAX);
 +	CHECK(dns_view_createresolver(view, ns_g_taskmgr, ntasks,
 				      ndisp, ns_g_socketmgr, ns_g_timermgr,
 				      resopts, ns_g_dispatchmgr,
 				      dispatch4, dispatch6));
 -- 
 2.34.1
--- a/SOURCES/bind-9.16-CVE-2022-3094-1.patch
+++ b/SOURCES/bind-9.16-CVE-2022-3094-1.patch
@ -1,240 +0,0 @@
 From 128b3b676eb9413b4d25fb29c560895cfbbfa92e Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Thu, 1 Sep 2022 16:05:04 -0700
 Subject: [PATCH] add an update quota
 limit the number of simultaneous DNS UPDATE events that can be
 processed by adding a quota for update and update forwarding.
 this quota currently, arbitrarily, defaults to 100.
 also add a statistics counter to record when the update quota
 has been exceeded.
 (cherry picked from commit 7c47254a140c3e9cf383cda73c7b6a55c4782826)
 ---
 bin/named/bind9.xsl              |  2 +-
 bin/named/bind9.xsl.h            |  8 +++++++-
 bin/named/include/named/server.h |  7 ++++++-
 bin/named/server.c               |  3 +++
 bin/named/statschannel.c         |  5 +++--
 bin/named/update.c               | 34 +++++++++++++++++++++++++++++++-
 doc/arm/Bv9ARM-book.xml          | 15 ++++++++++++++
 7 files changed, 68 insertions(+), 6 deletions(-)
 diff --git a/bin/named/bind9.xsl b/bin/named/bind9.xsl
 index 9a1c6ff..85fd4c4 100644
 --- a/bin/named/bind9.xsl
 +++ b/bin/named/bind9.xsl
@@ -12,7 +12,7 @@
 <xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns="http://www.w3.org/1999/xhtml" version="1.0">
   <xsl:output method="html" indent="yes" version="4.0"/>
 -  <xsl:template match="statistics[@version=&quot;3.8&quot;]">
 +  <xsl:template match="statistics[@version=&quot;3.8.1&quot;]">
     <html>
       <head>
         <script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js"></script>
 diff --git a/bin/named/bind9.xsl.h b/bin/named/bind9.xsl.h
 index 9ce8cd7..5e0a892 100644
 --- a/bin/named/bind9.xsl.h
 +++ b/bin/named/bind9.xsl.h
@@ -17,7 +17,13 @@ static char xslmsg[] =
 	"\n"
 	"<xsl:stylesheet xmlns:xsl=\"http://www.w3.org/1999/XSL/Transform\" xmlns=\"http://www.w3.org/1999/xhtml\" version=\"1.0\">\n"
 	" <xsl:output method=\"html\" indent=\"yes\" version=\"4.0\"/>\n"
 -	" <xsl:template match=\"statistics[@version=&quot;3.8&quot;]\">\n"
 +#if 0
 +	" <!-- the version number **below** must match version in "
 +	"bin/named/statschannel.c -->\n"
 +	" <!-- don't forget to update \"/xml/v<STATS_XML_VERSION_MAJOR>\" in "
 +	"the HTTP endpoints listed below -->\n"
 +#endif
 +	" <xsl:template match=\"statistics[@version=&quot;3.8.1&quot;]\">\n"
 	" <html>\n"
 	" <head>\n"
 	" <script type=\"text/javascript\" src=\"https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js\"></script>\n"
 diff --git a/bin/named/include/named/server.h b/bin/named/include/named/server.h
 index 08a02dc..259acc7 100644
 --- a/bin/named/include/named/server.h
 +++ b/bin/named/include/named/server.h
@@ -137,6 +137,9 @@ struct ns_server {
 	uint16_t		transfer_tcp_message_size;
 	isc_rng_t *		rngctx;
 +
 +/* CVE-2022-3094 */
 +	isc_quota_t		updquota;
 };
 struct ns_altsecret {
@@ -230,7 +233,9 @@ enum {
 	dns_nsstatscounter_trystale = 59,
 	dns_nsstatscounter_usedstale = 60,
 -	dns_nsstatscounter_max = 61
 +	dns_nsstatscounter_updatequota = 61,
 +
 +	dns_nsstatscounter_max = 62
 };
 /*%
 diff --git a/bin/named/server.c b/bin/named/server.c
 index 2d2fa0e..f09b895 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
@@ -9143,6 +9143,8 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 	result = isc_quota_init(&server->recursionquota, 100);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 +	result = isc_quota_init(&server->updquota, 100);
 +	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 	result = dns_aclenv_init(mctx, &server->aclenv);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
@@ -9410,6 +9412,7 @@ ns_server_destroy(ns_server_t **serverp) {
 	dns_aclenv_destroy(&server->aclenv);
 +	isc_quota_destroy(&server->updquota);
 	isc_quota_destroy(&server->recursionquota);
 	isc_quota_destroy(&server->tcpquota);
 	isc_quota_destroy(&server->xfroutquota);
 diff --git a/bin/named/statschannel.c b/bin/named/statschannel.c
 index 56a9c21..1e8723c 100644
 --- a/bin/named/statschannel.c
 +++ b/bin/named/statschannel.c
@@ -300,6 +300,7 @@ init_desc(void) {
 	SET_NSSTATDESC(reclimitdropped,
 		       "queries dropped due to recursive client limit",
 		       "RecLimitDropped");
 +	SET_NSSTATDESC(updatequota, "Update quota exceeded", "UpdateQuota");
 	SET_NSSTATDESC(trystale,
 		       "attempts to use stale cache data after lookup failure",
 		       "QryTryStale");
@@ -1546,7 +1547,7 @@ generatexml(ns_server_t *server, uint32_t flags,
 			ISC_XMLCHAR "type=\"text/xsl\" href=\"/bind9.xsl\""));
 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "statistics"));
 	TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "version",
 -					 ISC_XMLCHAR "3.8"));
 +					 ISC_XMLCHAR "3.8.1"));
 	/* Set common fields for statistics dump */
 	dumparg.type = isc_statsformat_xml;
@@ -2303,7 +2304,7 @@ generatejson(ns_server_t *server, size_t *msglen,
 	/*
 	 * These statistics are included no matter which URL we use.
 	 */
 -	obj = json_object_new_string("1.2");
 +	obj = json_object_new_string("1.2.1");
 	CHECKMEM(obj);
 	json_object_object_add(bindstats, "json-stats-version", obj);
 diff --git a/bin/named/update.c b/bin/named/update.c
 index 6ad7d27..dccc543 100644
 --- a/bin/named/update.c
 +++ b/bin/named/update.c
@@ -1526,6 +1526,17 @@ send_update_event(ns_client_t *client, dns_zone_t *zone) {
 	isc_task_t *zonetask = NULL;
 	ns_client_t *evclient;
 +	result = isc_quota_attach(&ns_g_server->updquota,
 +				  &(isc_quota_t *){ NULL });
 +	if (result != ISC_R_SUCCESS) {
 +		update_log(client, zone, LOGLEVEL_PROTOCOL,
 +			   "update failed: too many DNS UPDATEs queued (%s)",
 +			   isc_result_totext(result));
 +		isc_stats_increment(ns_g_server->nsstats,
 +				    dns_nsstatscounter_updatequota);
 +		CHECK(DNS_R_DROP);
 +	}
 +
 	event = (update_event_t *)
 		isc_event_allocate(client->mctx, client, DNS_EVENT_UPDATE,
 				   update_action, NULL, sizeof(*event));
@@ -1652,7 +1663,12 @@ ns_update_start(ns_client_t *client, isc_result_t sigresult) {
 	 * We are still in the client task context, so we can
 	 * simply give an error response without switching tasks.
 	 */
 -	respond(client, result);
 +	if (result == DNS_R_DROP) {
 +		ns_client_next(client, result);
 +	} else {
 +		respond(client, result);
 +	}
 +
 	if (zone != NULL)
 		dns_zone_detach(&zone);
 }
@@ -3385,6 +3401,7 @@ updatedone_action(isc_task_t *task, isc_event_t *event) {
 		dns_zone_detach(&uev->zone);
 	client->nupdates--;
 	respond(client, uev->result);
 +	isc_quota_detach(&(isc_quota_t *){ &ns_g_server->updquota });
 	isc_event_free(&event);
 	ns_client_detach(&client);
 }
@@ -3402,6 +3419,8 @@ forward_fail(isc_task_t *task, isc_event_t *event) {
 	INSIST(client->nupdates > 0);
 	client->nupdates--;
 	respond(client, DNS_R_SERVFAIL);
 +
 +	isc_quota_detach(&(isc_quota_t *){ &ns_g_server->updquota });
 	isc_event_free(&event);
 	ns_client_detach(&client);
 }
@@ -3439,6 +3458,8 @@ forward_done(isc_task_t *task, isc_event_t *event) {
 	client->nupdates--;
 	ns_client_sendraw(client, uev->answer);
 	dns_message_detach(&uev->answer);
 +
 +	isc_quota_detach(&(isc_quota_t *){ &ns_g_server->updquota });
 	isc_event_free(&event);
 	ns_client_detach(&client);
 }
@@ -3472,6 +3493,17 @@ send_forward_event(ns_client_t *client, dns_zone_t *zone) {
 	isc_task_t *zonetask = NULL;
 	ns_client_t *evclient;
 +	result = isc_quota_attach(&ns_g_server->updquota,
 +				  &(isc_quota_t *){ NULL });
 +	if (result != ISC_R_SUCCESS) {
 +		update_log(client, zone, LOGLEVEL_PROTOCOL,
 +			   "update failed: too many DNS UPDATEs queued (%s)",
 +			   isc_result_totext(result));
 +		isc_stats_increment(ns_g_server->nsstats,
 +				    dns_nsstatscounter_updatequota);
 +		return (DNS_R_DROP);
 +	}
 +
 	/*
 	 * This may take some time so replace this client.
 	 */
 diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
 index c17f168..9aca6d7 100644
 --- a/doc/arm/Bv9ARM-book.xml
 +++ b/doc/arm/Bv9ARM-book.xml
@@ -15105,6 +15105,21 @@ HOST-127.EXAMPLE. MX 0 .
 		      </para>
 		    </entry>
 		  </row>
 +		  <row rowsep="0">
 +		    <entry colname="1">
 +		      <para><command>UpdateQuota</command></para>
 +		    </entry>
 +		    <entry colname="2">
 +		      <para><command/></para>
 +		    </entry>
 +		    <entry colname="3">
 +		      <para>
 +			This indicates the number of times a dynamic update or update
 +			forwarding request was rejected because the number of pending
 +			requests exceeded the update quota.
 +		      </para>
 +		    </entry>
 +		  </row>
 		  <row rowsep="0">
 		    <entry colname="1">
 		      <para><command>RateDropped</command></para>
 -- 
 2.39.2
--- a/SOURCES/bind-9.16-CVE-2022-3094-2.patch
+++ b/SOURCES/bind-9.16-CVE-2022-3094-2.patch
@ -1,136 +0,0 @@
 From d9a03233c6ea11f20c2fbeca87b763673859f8b2 Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Thu, 1 Sep 2022 16:22:46 -0700
 Subject: [PATCH] add a configuration option for the update quota
 add an "update-quota" option to configure the update quota.
 (cherry picked from commit f57758a7303ad0034ff2ff08eaaf2ef899630f19)
 ---
 bin/named/config.c                   |  1 +
 bin/named/named.conf.docbook         |  2 ++
 bin/named/server.c                   |  1 +
 bin/tests/system/checkconf/good.conf |  1 +
 doc/arm/Bv9ARM-book.xml              | 11 +++++++++++
 doc/arm/options.grammar.xml          |  1 +
 doc/misc/options                     |  1 +
 lib/isccfg/namedconf.c               |  1 +
 8 files changed, 19 insertions(+)
 diff --git a/bin/named/config.c b/bin/named/config.c
 index 62d1e88..e3731cf 100644
 --- a/bin/named/config.c
 +++ b/bin/named/config.c
@@ -134,6 +134,7 @@ options {\n\
 	transfers-per-ns 2;\n\
 #	treat-cr-as-space <obsolete>;\n\
 	trust-anchor-telemetry yes;\n\
 +	update-quota 100;\n\
 #	use-id-pool <obsolete>;\n\
 #	use-ixfr <obsolete>;\n\
 \n\
 diff --git a/bin/named/named.conf.docbook b/bin/named/named.conf.docbook
 index 6565fce..5842cb5 100644
 --- a/bin/named/named.conf.docbook
 +++ b/bin/named/named.conf.docbook
@@ -455,6 +455,7 @@ options {
 	trust-anchor-telemetry <replaceable>boolean</replaceable>; // experimental
 	try-tcp-refresh <replaceable>boolean</replaceable>;
 	update-check-ksk <replaceable>boolean</replaceable>;
 +	update-quota <replaceable>integer</replaceable>;
 	use-alt-transfer-source <replaceable>boolean</replaceable>;
 	use-v4-udp-ports { <replaceable>portrange</replaceable>; ... };
 	use-v6-udp-ports { <replaceable>portrange</replaceable>; ... };
@@ -864,6 +865,7 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 		type ( delegation-only | forward | hint | master | redirect
 		    | slave | static-stub | stub );
 		update-check-ksk <replaceable>boolean</replaceable>;
 +		update-quota <replaceable>integer</replaceable>;
 		update-policy ( local | { ( deny | grant ) <replaceable>string</replaceable> (
 		    6to4-self | external | krb5-self | krb5-selfsub |
 		    krb5-subdomain | ms-self | ms-selfsub | ms-subdomain |
 diff --git a/bin/named/server.c b/bin/named/server.c
 index f09b895..7af90d0 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
@@ -7792,6 +7792,7 @@ load_configuration(const char *filename, ns_server_t *server,
 	configure_server_quota(maps, "tcp-clients", &server->tcpquota);
 	configure_server_quota(maps, "recursive-clients",
 			       &server->recursionquota);
 +	configure_server_quota(maps, "update-quota", &server->updquota);
 	if (server->recursionquota.max > 1000) {
 		int margin = ISC_MAX(100, ns_g_cpus + 1);
 diff --git a/bin/tests/system/checkconf/good.conf b/bin/tests/system/checkconf/good.conf
 index 1359cf3..5d9b292 100644
 --- a/bin/tests/system/checkconf/good.conf
 +++ b/bin/tests/system/checkconf/good.conf
@@ -63,6 +63,7 @@ options {
 	serial-queries 10;
 	serial-query-rate 100;
 	server-id none;
 +	update-quota 200;
 	max-cache-size 20000000000000;
 	nta-lifetime 604800;
 	nta-recheck 604800;
 diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
 index 9aca6d7..acf772b 100644
 --- a/doc/arm/Bv9ARM-book.xml
 +++ b/doc/arm/Bv9ARM-book.xml
@@ -8599,6 +8599,17 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
 	      </listitem>
 	    </varlistentry>
 +	    <varlistentry>
 +	      <term><command>update-quota</command></term>
 +	      <listitem>
 +		<para>
 +		This is the maximum number of simultaneous DNS UPDATE messages that
 +		the server will accept for updating local authoritiative zones or
 +			forwarding to a primary server. The default is <userinput>100</userinput>.
 +		</para>
 +	      </listitem>
 +	    </varlistentry>
 +
 	  </variablelist>
 	</section>
 diff --git a/doc/arm/options.grammar.xml b/doc/arm/options.grammar.xml
 index 793ac0b..1d17ea8 100644
 --- a/doc/arm/options.grammar.xml
 +++ b/doc/arm/options.grammar.xml
@@ -277,6 +277,7 @@
 	<command>trust-anchor-telemetry</command> <replaceable>boolean</replaceable>; // experimental
 	<command>try-tcp-refresh</command> <replaceable>boolean</replaceable>;
 	<command>update-check-ksk</command> <replaceable>boolean</replaceable>;
 +	<command>update-quota</command> <replaceable>integer</replaceable>;
 	<command>use-alt-transfer-source</command> <replaceable>boolean</replaceable>;
 	<command>use-v4-udp-ports</command> { <replaceable>portrange</replaceable>; ... };
 	<command>use-v6-udp-ports</command> { <replaceable>portrange</replaceable>; ... };
 diff --git a/doc/misc/options b/doc/misc/options
 index fde93c7..e6d6ba6 100644
 --- a/doc/misc/options
 +++ b/doc/misc/options
@@ -357,6 +357,7 @@ options {
         trust-anchor-telemetry <boolean>; // experimental
         try-tcp-refresh <boolean>;
         update-check-ksk <boolean>;
 +        update-quota <integer>;
         use-alt-transfer-source <boolean>;
         use-id-pool <boolean>; // obsolete
         use-ixfr <boolean>; // obsolete
 diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
 index b562f95..667111c 100644
 --- a/lib/isccfg/namedconf.c
 +++ b/lib/isccfg/namedconf.c
@@ -1136,6 +1136,7 @@ options_clauses[] = {
 	{ "transfers-out", &cfg_type_uint32, 0 },
 	{ "transfers-per-ns", &cfg_type_uint32, 0 },
 	{ "treat-cr-as-space", &cfg_type_boolean, CFG_CLAUSEFLAG_OBSOLETE },
 +	{ "update-quota", &cfg_type_uint32, 0 },
 	{ "use-id-pool", &cfg_type_boolean, CFG_CLAUSEFLAG_OBSOLETE },
 	{ "use-ixfr", &cfg_type_boolean, CFG_CLAUSEFLAG_OBSOLETE },
 	{ "use-v4-udp-ports", &cfg_type_bracketed_portlist, 0 },
 -- 
 2.39.2
--- a/SOURCES/bind-9.16-CVE-2022-3094-3.patch
+++ b/SOURCES/bind-9.16-CVE-2022-3094-3.patch
@ -1,553 +0,0 @@
 From cba333b262b7ee0034a66cc93cf27f6c4918eea2 Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Tue, 8 Nov 2022 17:32:41 -0800
 Subject: [PATCH] move update ACL and update-policy checks before quota
 check allow-update, update-policy, and allow-update-forwarding before
 consuming quota slots, so that unauthorized clients can't fill the
 quota.
 (this moves the access check before the prerequisite check, which
 violates the precise wording of RFC 2136. however, RFC co-author Paul
 Vixie has stated that the RFC is mistaken on this point; it should have
 said that access checking must happen *no later than* the completion of
 prerequisite checks, not that it must happen exactly then.)
 (cherry picked from commit 964f559edb5036880b8e463b8f190b9007ee055d)
 ---
 bin/named/update.c | 440 ++++++++++++++++++++++++++++++---------------
 1 file changed, 298 insertions(+), 142 deletions(-)
 diff --git a/bin/named/update.c b/bin/named/update.c
 index 8853ee7..4d1fe78 100644
 --- a/bin/named/update.c
 +++ b/bin/named/update.c
@@ -251,6 +251,9 @@ static void updatedone_action(isc_task_t *task, isc_event_t *event);
 static isc_result_t send_forward_event(ns_client_t *client, dns_zone_t *zone);
 static void forward_done(isc_task_t *task, isc_event_t *event);
 static isc_result_t add_rr_prepare_action(void *data, rr_t *rr);
 +static isc_result_t
 +rr_exists(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
 +	  const dns_rdata_t *rdata, bool *flag);
 /**************************************************************************/
@@ -328,23 +331,24 @@ checkqueryacl(ns_client_t *client, dns_acl_t *queryacl, dns_name_t *zonename,
 {
 	char namebuf[DNS_NAME_FORMATSIZE];
 	char classbuf[DNS_RDATACLASS_FORMATSIZE];
 -	int level;
 	isc_result_t result;
 +	bool update_possible =
 +		((updateacl != NULL && !dns_acl_isnone(updateacl)) ||
 +		 ssutable != NULL);
 	result = ns_client_checkaclsilent(client, NULL, queryacl, true);
 	if (result != ISC_R_SUCCESS) {
 +		int level = update_possible ? ISC_LOG_ERROR : ISC_LOG_INFO;
 +
 		dns_name_format(zonename, namebuf, sizeof(namebuf));
 		dns_rdataclass_format(client->view->rdclass, classbuf,
 				      sizeof(classbuf));
 -		level = (updateacl == NULL && ssutable == NULL) ?
 -				ISC_LOG_INFO : ISC_LOG_ERROR;
 -
 		ns_client_log(client, NS_LOGCATEGORY_UPDATE_SECURITY,
 			      NS_LOGMODULE_UPDATE, level,
 			      "update '%s/%s' denied due to allow-query",
 			      namebuf, classbuf);
 -	} else if (updateacl == NULL && ssutable == NULL) {
 +	} else if (!update_possible) {
 		dns_name_format(zonename, namebuf, sizeof(namebuf));
 		dns_rdataclass_format(client->view->rdclass, classbuf,
 				      sizeof(classbuf));
@@ -1525,6 +1529,277 @@ send_update_event(ns_client_t *client, dns_zone_t *zone) {
 	update_event_t *event = NULL;
 	isc_task_t *zonetask = NULL;
 	ns_client_t *evclient;
 +#if 1
 +	dns_ssutable_t *ssutable = NULL;
 +	dns_message_t *request = client->message;
 +	dns_rdataclass_t zoneclass;
 +	dns_rdatatype_t covers;
 +	dns_name_t *zonename = NULL;
 +	dns_db_t *db = NULL;
 +	dns_dbversion_t *ver = NULL;
 +
 +	CHECK(dns_zone_getdb(zone, &db));
 +	zonename = dns_db_origin(db);
 +	zoneclass = dns_db_class(db);
 +	dns_zone_getssutable(zone, &ssutable);
 +	dns_db_currentversion(db, &ver);
 +
 +	/*
 +	 * Update message processing can leak record existence information
 +	 * so check that we are allowed to query this zone.  Additionally,
 +	 * if we would refuse all updates for this zone, we bail out here.
 +	 */
 +	CHECK(checkqueryacl(client, dns_zone_getqueryacl(zone),
 +			    dns_zone_getorigin(zone),
 +			    dns_zone_getupdateacl(zone), ssutable));
 +
 +	/*
 +	 * Check requestor's permissions.
 +	 */
 +	if (ssutable == NULL)
 +		CHECK(checkupdateacl(client, dns_zone_getupdateacl(zone),
 +				     "update", zonename, false, false));
 +	else if (client->signer == NULL && !TCPCLIENT(client))
 +		CHECK(checkupdateacl(client, NULL, "update", zonename,
 +				     false, true));
 +
 +	if (dns_zone_getupdatedisabled(zone))
 +		FAILC(DNS_R_REFUSED, "dynamic update temporarily disabled "
 +				     "because the zone is frozen.  Use "
 +				     "'rndc thaw' to re-enable updates.");
 +
 +	/*
 +	 * Perform the Update Section Prescan.
 +	 */
 +
 +	for (result = dns_message_firstname(request, DNS_SECTION_UPDATE);
 +	     result == ISC_R_SUCCESS;
 +	     result = dns_message_nextname(request, DNS_SECTION_UPDATE))
 +	{
 +		dns_name_t *name = NULL;
 +		dns_rdata_t rdata = DNS_RDATA_INIT;
 +		dns_ttl_t ttl;
 +		dns_rdataclass_t update_class;
 +		get_current_rr(request, DNS_SECTION_UPDATE, zoneclass,
 +			       &name, &rdata, &covers, &ttl, &update_class);
 +
 +		if (! dns_name_issubdomain(name, zonename))
 +			FAILC(DNS_R_NOTZONE,
 +			      "update RR is outside zone");
 +		if (update_class == zoneclass) {
 +			/*
 +			 * Check for meta-RRs.  The RFC2136 pseudocode says
 +			 * check for ANY|AXFR|MAILA|MAILB, but the text adds
 +			 * "or any other QUERY metatype"
 +			 */
 +			if (dns_rdatatype_ismeta(rdata.type)) {
 +				FAILC(DNS_R_FORMERR,
 +				      "meta-RR in update");
 +			}
 +			result = dns_zone_checknames(zone, name, &rdata);
 +			if (result != ISC_R_SUCCESS)
 +				FAIL(DNS_R_REFUSED);
 +		} else if (update_class == dns_rdataclass_any) {
 +			if (ttl != 0 || rdata.length != 0 ||
 +			    (dns_rdatatype_ismeta(rdata.type) &&
 +			     rdata.type != dns_rdatatype_any))
 +				FAILC(DNS_R_FORMERR,
 +				      "meta-RR in update");
 +		} else if (update_class == dns_rdataclass_none) {
 +			if (ttl != 0 ||
 +			    dns_rdatatype_ismeta(rdata.type))
 +				FAILC(DNS_R_FORMERR,
 +				      "meta-RR in update");
 +		} else {
 +			update_log(client, zone, ISC_LOG_WARNING,
 +				   "update RR has incorrect class %d",
 +				   update_class);
 +			FAIL(DNS_R_FORMERR);
 +		}
 +
 +		/*
 +		 * draft-ietf-dnsind-simple-secure-update-01 says
 +		 * "Unlike traditional dynamic update, the client
 +		 * is forbidden from updating NSEC records."
 +		 */
 +		if (rdata.type == dns_rdatatype_nsec3) {
 +			FAILC(DNS_R_REFUSED,
 +			      "explicit NSEC3 updates are not allowed "
 +			      "in secure zones");
 +		} else if (rdata.type == dns_rdatatype_nsec) {
 +			FAILC(DNS_R_REFUSED,
 +			      "explicit NSEC updates are not allowed "
 +			      "in secure zones");
 +		} else if (rdata.type == dns_rdatatype_rrsig &&
 +			   !dns_name_equal(name, zonename)) {
 +			FAILC(DNS_R_REFUSED,
 +			      "explicit RRSIG updates are currently "
 +			      "not supported in secure zones except "
 +			      "at the apex");
 +		}
 +
 +		if (ssutable != NULL) {
 +			isc_netaddr_t netaddr;
 +			dst_key_t *tsigkey = NULL;
 +			isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
 +
 +			if (client->message->tsigkey != NULL)
 +				tsigkey = client->message->tsigkey->key;
 +
 +			if (rdata.type != dns_rdatatype_any) {
 +				if (!dns_ssutable_checkrules2
 +				    (ssutable, client->signer, name, &netaddr,
 +				     TCPCLIENT(client),
 +				     &ns_g_server->aclenv,
 +				     rdata.type, tsigkey))
 +				{
 +					FAILC(DNS_R_REFUSED,
 +					      "rejected by secure update");
 +				}
 +			} else {
 +				if (!ssu_checkall(db, ver, name, ssutable,
 +						  client->signer,
 +						  &netaddr,
 +						  TCPCLIENT(client),
 +						  tsigkey))
 +				{
 +					FAILC(DNS_R_REFUSED,
 +					      "rejected by secure update");
 +				}
 +			}
 +		}
 +	}
 +	if (result != ISC_R_NOMORE)
 +		FAIL(result);
 +
 +	update_log(client, zone, LOGLEVEL_DEBUG,
 +		   "update section prescan OK");
 +#if 0
 +	if (ssutable == NULL) {
 +		CHECK(checkupdateacl(client, dns_zone_getupdateacl(zone),
 +						// zonename
 +				     "update", dns_zone_getorigin(zone), false,
 +				     false));
 +	} else if (client->signer == NULL && !TCPCLIENT(client)) {
 +		CHECK(checkupdateacl(client, NULL, "update",
 +				     dns_zone_getorigin(zone), false, true));
 +	}
 +
 +	if (dns_zone_getupdatedisabled(zone)) {
 +		FAILC(DNS_R_REFUSED, "dynamic update temporarily disabled "
 +				     "because the zone is frozen.  Use "
 +				     "'rndc thaw' to re-enable updates.");
 +	}
 +
 +	/*
 +	 * Prescan the update section, checking for updates that
 +	 * are illegal or violate policy.
 +	 */
 +	for (result = dns_message_firstname(request, DNS_SECTION_UPDATE);
 +	     result == ISC_R_SUCCESS;
 +	     result = dns_message_nextname(request, DNS_SECTION_UPDATE))
 +	{
 +		dns_name_t *name = NULL;
 +		dns_rdata_t rdata = DNS_RDATA_INIT;
 +		dns_ttl_t ttl;
 +		dns_rdataclass_t update_class;
 +
 +		get_current_rr(request, DNS_SECTION_UPDATE, zoneclass, &name,
 +			       &rdata, &covers, &ttl, &update_class);
 +
 +		if (!dns_name_issubdomain(name, zonename)) {
 +			FAILC(DNS_R_NOTZONE, "update RR is outside zone");
 +		}
 +		if (update_class == zoneclass) {
 +			/*
 +			 * Check for meta-RRs.  The RFC2136 pseudocode says
 +			 * check for ANY|AXFR|MAILA|MAILB, but the text adds
 +			 * "or any other QUERY metatype"
 +			 */
 +			if (dns_rdatatype_ismeta(rdata.type)) {
 +				FAILC(DNS_R_FORMERR, "meta-RR in update");
 +			}
 +			result = dns_zone_checknames(zone, name, &rdata);
 +			if (result != ISC_R_SUCCESS) {
 +				FAIL(DNS_R_REFUSED);
 +			}
 +		} else if (update_class == dns_rdataclass_any) {
 +			if (ttl != 0 || rdata.length != 0 ||
 +			    (dns_rdatatype_ismeta(rdata.type) &&
 +			     rdata.type != dns_rdatatype_any))
 +			{
 +				FAILC(DNS_R_FORMERR, "meta-RR in update");
 +			}
 +		} else if (update_class == dns_rdataclass_none) {
 +			if (ttl != 0 || dns_rdatatype_ismeta(rdata.type)) {
 +				FAILC(DNS_R_FORMERR, "meta-RR in update");
 +			}
 +		} else {
 +			update_log(client, zone, ISC_LOG_WARNING,
 +				   "update RR has incorrect class %d",
 +				   update_class);
 +			FAIL(DNS_R_FORMERR);
 +		}
 +
 +		/*
 +		 * draft-ietf-dnsind-simple-secure-update-01 says
 +		 * "Unlike traditional dynamic update, the client
 +		 * is forbidden from updating NSEC records."
 +		 */
 +		if (rdata.type == dns_rdatatype_nsec3) {
 +			FAILC(DNS_R_REFUSED, "explicit NSEC3 updates are not "
 +					     "allowed "
 +					     "in secure zones");
 +		} else if (rdata.type == dns_rdatatype_nsec) {
 +			FAILC(DNS_R_REFUSED, "explicit NSEC updates are not "
 +					     "allowed "
 +					     "in secure zones");
 +		} else if (rdata.type == dns_rdatatype_rrsig &&
 +			   !dns_name_equal(name, zonename))
 +		{
 +			FAILC(DNS_R_REFUSED, "explicit RRSIG updates are "
 +					     "currently "
 +					     "not supported in secure zones "
 +					     "except "
 +					     "at the apex");
 +		}
 +
 +		if (ssutable != NULL) {
 +			isc_netaddr_t netaddr;
 +			dst_key_t *tsigkey = NULL;
 +			isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
 +
 +			if (client->message->tsigkey != NULL) {
 +				tsigkey = client->message->tsigkey->key;
 +			}
 +
 +			if (rdata.type != dns_rdatatype_any) {
 +				if (!dns_ssutable_checkrules(
 +					    ssutable, client->signer, name,
 +					    &netaddr, TCPCLIENT(client), env,
 +					    rdata.type, tsigkey))
 +				{
 +					FAILC(DNS_R_REFUSED, "rejected by "
 +							     "secure update");
 +				}
 +			} else {
 +				if (!ssu_checkall(db, ver, name, ssutable,
 +						  client->signer, &netaddr, env,
 +						  TCPCLIENT(client), tsigkey))
 +				{
 +					FAILC(DNS_R_REFUSED, "rejected by "
 +							     "secure update");
 +				}
 +			}
 +		}
 +	}
 +	if (result != ISC_R_NOMORE) {
 +		FAIL(result);
 +	}
 +
 +	update_log(client, zone, LOGLEVEL_DEBUG, "update section prescan OK");
 +#endif
 +#endif
 	result = isc_quota_attach(&ns_g_server->updquota,
 				  &(isc_quota_t *){ NULL });
@@ -1558,6 +1833,15 @@ send_update_event(ns_client_t *client, dns_zone_t *zone) {
  failure:
 	if (event != NULL)
 		isc_event_free(ISC_EVENT_PTR(&event));
 +	if (db != NULL) {
 +		dns_db_closeversion(db, &ver, false);
 +		dns_db_detach(&db);
 +	}
 +
 +	if (ssutable != NULL) {
 +		dns_ssutable_detach(&ssutable);
 +	}
 +
 	return (result);
 }
@@ -1644,9 +1928,6 @@ ns_update_start(ns_client_t *client, isc_result_t sigresult) {
 		CHECK(send_update_event(client, zone));
 		break;
 	case dns_zone_slave:
 -		CHECK(checkupdateacl(client, dns_zone_getforwardacl(zone),
 -				     "update forwarding", zonename, true,
 -				     false));
 		CHECK(send_forward_event(client, zone));
 		break;
 	default:
@@ -1656,7 +1937,6 @@ ns_update_start(ns_client_t *client, isc_result_t sigresult) {
  failure:
 	if (result == DNS_R_REFUSED) {
 -		INSIST(dns_zone_gettype(zone) == dns_zone_slave);
 		inc_stats(zone, dns_nsstatscounter_updaterej);
 	}
 	/*
@@ -2520,7 +2800,7 @@ update_action(isc_task_t *task, isc_event_t *event) {
 	dns_rdatatype_t covers;
 	dns_message_t *request = client->message;
 	dns_rdataclass_t zoneclass;
 -	dns_name_t *zonename;
 +	dns_name_t *zonename = NULL;
 	dns_ssutable_t *ssutable = NULL;
 	dns_fixedname_t tmpnamefixed;
 	dns_name_t *tmpname = NULL;
@@ -2542,14 +2822,7 @@ update_action(isc_task_t *task, isc_event_t *event) {
 	zonename = dns_db_origin(db);
 	zoneclass = dns_db_class(db);
 	dns_zone_getssutable(zone, &ssutable);
 -
 -	/*
 -	 * Update message processing can leak record existence information
 -	 * so check that we are allowed to query this zone.  Additionally
 -	 * if we would refuse all updates for this zone we bail out here.
 -	 */
 -	CHECK(checkqueryacl(client, dns_zone_getqueryacl(zone), zonename,
 -			    dns_zone_getupdateacl(zone), ssutable));
 +	options = dns_zone_getoptions(zone);
 	/*
 	 * Get old and new versions now that queryacl has been checked.
@@ -2673,134 +2946,10 @@ update_action(isc_task_t *task, isc_event_t *event) {
 	update_log(client, zone, LOGLEVEL_DEBUG,
 		   "prerequisites are OK");
 -	/*
 -	 * Check Requestor's Permissions.  It seems a bit silly to do this
 -	 * only after prerequisite testing, but that is what RFC2136 says.
 -	 */
 -	if (ssutable == NULL)
 -		CHECK(checkupdateacl(client, dns_zone_getupdateacl(zone),
 -				     "update", zonename, false, false));
 -	else if (client->signer == NULL && !TCPCLIENT(client))
 -		CHECK(checkupdateacl(client, NULL, "update", zonename,
 -				     false, true));
 -
 -	if (dns_zone_getupdatedisabled(zone))
 -		FAILC(DNS_R_REFUSED, "dynamic update temporarily disabled "
 -				     "because the zone is frozen.  Use "
 -				     "'rndc thaw' to re-enable updates.");
 -
 -	/*
 -	 * Perform the Update Section Prescan.
 -	 */
 -
 -	for (result = dns_message_firstname(request, DNS_SECTION_UPDATE);
 -	     result == ISC_R_SUCCESS;
 -	     result = dns_message_nextname(request, DNS_SECTION_UPDATE))
 -	{
 -		dns_name_t *name = NULL;
 -		dns_rdata_t rdata = DNS_RDATA_INIT;
 -		dns_ttl_t ttl;
 -		dns_rdataclass_t update_class;
 -		get_current_rr(request, DNS_SECTION_UPDATE, zoneclass,
 -			       &name, &rdata, &covers, &ttl, &update_class);
 -
 -		if (! dns_name_issubdomain(name, zonename))
 -			FAILC(DNS_R_NOTZONE,
 -			      "update RR is outside zone");
 -		if (update_class == zoneclass) {
 -			/*
 -			 * Check for meta-RRs.  The RFC2136 pseudocode says
 -			 * check for ANY|AXFR|MAILA|MAILB, but the text adds
 -			 * "or any other QUERY metatype"
 -			 */
 -			if (dns_rdatatype_ismeta(rdata.type)) {
 -				FAILC(DNS_R_FORMERR,
 -				      "meta-RR in update");
 -			}
 -			result = dns_zone_checknames(zone, name, &rdata);
 -			if (result != ISC_R_SUCCESS)
 -				FAIL(DNS_R_REFUSED);
 -		} else if (update_class == dns_rdataclass_any) {
 -			if (ttl != 0 || rdata.length != 0 ||
 -			    (dns_rdatatype_ismeta(rdata.type) &&
 -			     rdata.type != dns_rdatatype_any))
 -				FAILC(DNS_R_FORMERR,
 -				      "meta-RR in update");
 -		} else if (update_class == dns_rdataclass_none) {
 -			if (ttl != 0 ||
 -			    dns_rdatatype_ismeta(rdata.type))
 -				FAILC(DNS_R_FORMERR,
 -				      "meta-RR in update");
 -		} else {
 -			update_log(client, zone, ISC_LOG_WARNING,
 -				   "update RR has incorrect class %d",
 -				   update_class);
 -			FAIL(DNS_R_FORMERR);
 -		}
 -
 -		/*
 -		 * draft-ietf-dnsind-simple-secure-update-01 says
 -		 * "Unlike traditional dynamic update, the client
 -		 * is forbidden from updating NSEC records."
 -		 */
 -		if (rdata.type == dns_rdatatype_nsec3) {
 -			FAILC(DNS_R_REFUSED,
 -			      "explicit NSEC3 updates are not allowed "
 -			      "in secure zones");
 -		} else if (rdata.type == dns_rdatatype_nsec) {
 -			FAILC(DNS_R_REFUSED,
 -			      "explicit NSEC updates are not allowed "
 -			      "in secure zones");
 -		} else if (rdata.type == dns_rdatatype_rrsig &&
 -			   !dns_name_equal(name, zonename)) {
 -			FAILC(DNS_R_REFUSED,
 -			      "explicit RRSIG updates are currently "
 -			      "not supported in secure zones except "
 -			      "at the apex");
 -		}
 -
 -		if (ssutable != NULL) {
 -			isc_netaddr_t netaddr;
 -			dst_key_t *tsigkey = NULL;
 -			isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
 -
 -			if (client->message->tsigkey != NULL)
 -				tsigkey = client->message->tsigkey->key;
 -
 -			if (rdata.type != dns_rdatatype_any) {
 -				if (!dns_ssutable_checkrules2
 -				    (ssutable, client->signer, name, &netaddr,
 -				     TCPCLIENT(client),
 -				     &ns_g_server->aclenv,
 -				     rdata.type, tsigkey))
 -				{
 -					FAILC(DNS_R_REFUSED,
 -					      "rejected by secure update");
 -				}
 -			} else {
 -				if (!ssu_checkall(db, ver, name, ssutable,
 -						  client->signer,
 -						  &netaddr,
 -						  TCPCLIENT(client),
 -						  tsigkey))
 -				{
 -					FAILC(DNS_R_REFUSED,
 -					      "rejected by secure update");
 -				}
 -			}
 -		}
 -	}
 -	if (result != ISC_R_NOMORE)
 -		FAIL(result);
 -
 -	update_log(client, zone, LOGLEVEL_DEBUG,
 -		   "update section prescan OK");
 -
 	/*
 	 * Process the Update Section.
 	 */
 -	options = dns_zone_getoptions(zone);
 	options2 = dns_zone_getoptions2(zone);
 	for (result = dns_message_firstname(request, DNS_SECTION_UPDATE);
 	     result == ISC_R_SUCCESS;
@@ -3494,6 +3643,13 @@ send_forward_event(ns_client_t *client, dns_zone_t *zone) {
 	isc_task_t *zonetask = NULL;
 	ns_client_t *evclient;
 +	result = checkupdateacl(client, dns_zone_getforwardacl(zone),
 +				"update forwarding", dns_zone_getorigin(zone),
 +				true, false);
 +	if (result != ISC_R_SUCCESS) {
 +		return (result);
 +	}
 +
 	result = isc_quota_attach(&ns_g_server->updquota,
 				  &(isc_quota_t *){ NULL });
 	if (result != ISC_R_SUCCESS) {
 -- 
 2.39.2
--- a/SOURCES/bind-9.16-CVE-2022-3094-test.patch
+++ b/SOURCES/bind-9.16-CVE-2022-3094-test.patch
@ -1,266 +0,0 @@
 From 3d84c651f823cb90b73fd736d32ad6de57b11610 Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Wed, 9 Nov 2022 21:56:16 -0800
 Subject: [PATCH] test failure conditions
 verify that updates are refused when the client is disallowed by
 allow-query, and update forwarding is refused when the client is
 is disallowed by update-forwarding.
 verify that "too many DNS UPDATEs" appears in the log file when too
 many simultaneous updates are processing.
 (cherry picked from commit b91339b80e5b82a56622c93cc1e3cca2d0c11bc0)
 ---
 bin/tests/system/nsupdate/ns1/named.conf.in   |  2 +
 bin/tests/system/nsupdate/tests.sh            | 28 +++++++++++++
 bin/tests/system/upforwd/clean.sh             |  2 +
 .../ns3/{named.conf.in => named1.conf.in}     |  7 +++-
 bin/tests/system/upforwd/ns3/named2.conf.in   | 41 +++++++++++++++++++
 bin/tests/system/upforwd/setup.sh             |  2 +-
 bin/tests/system/upforwd/tests.sh             | 40 ++++++++++++++++++
 7 files changed, 120 insertions(+), 2 deletions(-)
 rename bin/tests/system/upforwd/ns3/{named.conf.in => named1.conf.in} (85%)
 create mode 100644 bin/tests/system/upforwd/ns3/named2.conf.in
 diff --git a/bin/tests/system/nsupdate/ns1/named.conf.in b/bin/tests/system/nsupdate/ns1/named.conf.in
 index cb80269..228ad6a 100644
 --- a/bin/tests/system/nsupdate/ns1/named.conf.in
 +++ b/bin/tests/system/nsupdate/ns1/named.conf.in
@@ -20,6 +20,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	notify yes;
 +	update-quota 1;
 };
 key rndc_key {
@@ -76,6 +77,7 @@ zone "other.nil" {
 	check-integrity no;
 	check-mx warn;
 	update-policy local;
 +	allow-query { !10.53.0.2; any; };
 	allow-query-on { 10.53.0.1; 127.0.0.1; };
 	allow-transfer { any; };
 };
 diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh
 index f8994ff..4cabf8d 100755
 --- a/bin/tests/system/nsupdate/tests.sh
 +++ b/bin/tests/system/nsupdate/tests.sh
@@ -1069,6 +1069,34 @@ END
 grep "NSEC3PARAM has excessive iterations (> 150)" nsupdate.out-$n >/dev/null || ret=1
 [ $ret = 0 ] || { echo_i "failed"; status=1; }
 +n=$((n + 1))
 +ret=0
 +echo_i "check that update is rejected if query is not allowed ($n)"
 +{
 +  $NSUPDATE -d <<END
 +  local 10.53.0.2
 +  server 10.53.0.1 ${PORT}
 +  update add reject.other.nil 3600 IN TXT Whatever
 +  send
 +END
 +} > nsupdate.out.test$n 2>&1
 +grep 'status: REFUSED' nsupdate.out.test$n > /dev/null || ret=1
 +[ $ret = 0 ] || { echo_i "failed"; status=1; }
 +
 +n=$((n + 1))
 +ret=0
 +echo_i "check that update is rejected if quota is exceeded ($n)"
 +for loop in 1 2 3 4 5 6 7 8 9 10; do
 +{
 +  $NSUPDATE -l -p ${PORT} -k ns1/session.key > nsupdate.out.test$n-${loop} 2>&1 <<END
 +  update add txt-$loop.other.nil 3600 IN TXT Whatever
 +  send
 +END
 +} &
 +done
 +wait_for_log 10 "too many DNS UPDATEs queued" ns1/named.run || ret=1
 +[ $ret = 0 ] || { echo_i "failed"; status=1; }
 +
 if $FEATURETEST --gssapi ; then
   n=`expr $n + 1`
   ret=0
 diff --git a/bin/tests/system/upforwd/clean.sh b/bin/tests/system/upforwd/clean.sh
 index 15cf423..832c727 100644
 --- a/bin/tests/system/upforwd/clean.sh
 +++ b/bin/tests/system/upforwd/clean.sh
@@ -24,3 +24,5 @@ rm -f Ksig0.example2.*
 rm -f keyname
 rm -f ns*/named.lock
 rm -f ns1/example2.db
 +rm -f nsupdate.out.*
 +rm -f ns*/named.run.prev
 diff --git a/bin/tests/system/upforwd/ns3/named.conf.in b/bin/tests/system/upforwd/ns3/named1.conf.in
 similarity index 85%
 rename from bin/tests/system/upforwd/ns3/named.conf.in
 rename to bin/tests/system/upforwd/ns3/named1.conf.in
 index e81cd1a..83a490f 100644
 --- a/bin/tests/system/upforwd/ns3/named.conf.in
 +++ b/bin/tests/system/upforwd/ns3/named1.conf.in
@@ -22,10 +22,15 @@ options {
 	notify yes;
 };
 +include "../../common/rndc.key";
 +controls {
 +	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
 +};
 +
 zone "example" {
 	type slave;
 	file "example.bk";
 -	allow-update-forwarding { any; };
 +	allow-update-forwarding { 10.53.0.1; };
 	masters { 10.53.0.1; };
 };
 diff --git a/bin/tests/system/upforwd/ns3/named2.conf.in b/bin/tests/system/upforwd/ns3/named2.conf.in
 new file mode 100644
 index 0000000..992cd69
 --- /dev/null
 +++ b/bin/tests/system/upforwd/ns3/named2.conf.in
@@ -0,0 +1,41 @@
 +/*
 + * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 + *
 + * SPDX-License-Identifier: MPL-2.0
 + *
 + * This Source Code Form is subject to the terms of the Mozilla Public
 + * License, v. 2.0.  If a copy of the MPL was not distributed with this
 + * file, you can obtain one at https://mozilla.org/MPL/2.0/.
 + *
 + * See the COPYRIGHT file distributed with this work for additional
 + * information regarding copyright ownership.
 + */
 +
 +options {
 +	query-source address 10.53.0.3;
 +	notify-source 10.53.0.3;
 +	transfer-source 10.53.0.3;
 +	port @PORT@;
 +	pid-file "named.pid";
 +	listen-on { 10.53.0.3; };
 +	listen-on-v6 { none; };
 +	recursion no;
 +	notify yes;
 +	update-quota 1;
 +};
 +
 +key rndc_key {
 +	secret "1234abcd8765";
 +	algorithm hmac-sha256;
 +};
 +
 +controls {
 +	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
 +};
 +
 +zone "example" {
 +	type slave;
 +	file "example.bk";
 +	allow-update-forwarding { any; };
 +	masters { 10.53.0.1; };
 +};
 diff --git a/bin/tests/system/upforwd/setup.sh b/bin/tests/system/upforwd/setup.sh
 index 74c7ba3..928902b 100644
 --- a/bin/tests/system/upforwd/setup.sh
 +++ b/bin/tests/system/upforwd/setup.sh
@@ -17,7 +17,7 @@ cp -f ns3/nomaster.db ns3/nomaster1.db
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
 -copy_setports ns3/named.conf.in ns3/named.conf
 +copy_setports ns3/named1.conf.in ns3/named.conf
 #
 # SIG(0) required cryptographic support which may not be configured.
 diff --git a/bin/tests/system/upforwd/tests.sh b/bin/tests/system/upforwd/tests.sh
 index f4c3216..ebc9ded 100644
 --- a/bin/tests/system/upforwd/tests.sh
 +++ b/bin/tests/system/upforwd/tests.sh
@@ -17,6 +17,7 @@ SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh
 DIGOPTS="+tcp +noadd +nosea +nostat +noquest +nocomm +nocmd -p ${PORT}"
 +RNDCCMD="$RNDC -c $SYSTEMTESTTOP/common/rndc.conf -p ${CONTROLPORT} -s"
 status=0
 n=1
@@ -69,6 +70,7 @@ if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
 echo_i "updating zone (signed) ($n)"
 ret=0
 $NSUPDATE -y hmac-sha256:update.example:c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K -- - <<EOF || ret=1
 +local 10.53.0.1
 server 10.53.0.3 ${PORT}
 update add updated.example. 600 A 10.10.10.1
 update add updated.example. 600 TXT Foo
@@ -116,6 +118,7 @@ n=`expr $n + 1`
 echo_i "updating zone (unsigned) ($n)"
 ret=0
 $NSUPDATE -- - <<EOF || ret=1
 +local 10.53.0.1
 server 10.53.0.3 ${PORT}
 update add unsigned.example. 600 A 10.10.10.1
 update add unsigned.example. 600 TXT Foo
@@ -161,6 +164,7 @@ while [ $count -lt 5 -a $ret -eq 0 ]
 do
 (
 $NSUPDATE -- - <<EOF 
 +local 10.53.0.1
 server 10.53.0.3 ${PORT}
 zone nomaster
 update add unsigned.nomaster. 600 A 10.10.10.1
@@ -181,6 +185,7 @@ then
 	ret=0
 	keyname=`cat keyname`
 	$NSUPDATE -k $keyname.private -- - <<EOF
 +	local 10.53.0.1
 	server 10.53.0.3 ${PORT}
 	zone example2
 	update add unsigned.example2. 600 A 10.10.10.1
@@ -194,5 +199,40 @@ EOF
 	n=`expr $n + 1`
 fi
 +echo_i "attempting an update that should be rejected by ACL ($n)"
 +ret=0
 +{
 +        $NSUPDATE -- - << EOF
 +        local 10.53.0.2
 +        server 10.53.0.3 ${PORT}
 +        update add another.unsigned.example. 600 A 10.10.10.2
 +        update add another.unsigned.example. 600 TXT Bar
 +        send
 +EOF
 +} > nsupdate.out.$n 2>&1
 +grep REFUSED nsupdate.out.$n > /dev/null || ret=1
 +if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
 +n=`expr $n + 1`
 +
 +n=$((n + 1))
 +ret=0
 +echo_i "attempting updates that should exceed quota ($n)"
 +# lower the update quota to 1.
 +copy_setports ns3/named2.conf.in ns3/named.conf
 +$RNDCCMD 10.53.0.3 reconfig
 +nextpart ns3/named.run > /dev/null
 +for loop in 1 2 3 4 5 6 7 8 9 10; do
 +{
 +  $NSUPDATE -- - > /dev/null 2>&1 <<END
 +  local 10.53.0.1
 +  server 10.53.0.3 ${PORT}
 +  update add txt-$loop.unsigned.example 300 IN TXT Whatever
 +  send
 +END
 +} &
 +done
 +wait_for_log 10 "too many DNS UPDATEs queued" ns3/named.run || ret=1
 +[ $ret = 0 ] || { echo_i "failed"; status=1; }
 +
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
 -- 
 2.39.2
--- a/SOURCES/bind-9.16-CVE-2022-38177.patch
+++ b/SOURCES/bind-9.16-CVE-2022-38177.patch
@ -1,27 +0,0 @@
 From 0095b8a6b09173ab5eb48611dc0233d2a6337dc1 Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Tue, 20 Sep 2022 11:21:45 +0200
 Subject: [PATCH] Fix CVE-2022-38177
 5961.	[security]	Fix memory leak in ECDSA verify processing.
 			(CVE-2022-38177) [GL #3487]
 ---
 lib/dns/opensslecdsa_link.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/lib/dns/opensslecdsa_link.c b/lib/dns/opensslecdsa_link.c
 index 83b5b51..7576e04 100644
 --- a/lib/dns/opensslecdsa_link.c
 +++ b/lib/dns/opensslecdsa_link.c
@@ -224,7 +224,7 @@ opensslecdsa_verify(dst_context_t *dctx, const isc_region_t *sig) {
 		siglen = DNS_SIG_ECDSA384SIZE;
 	if (sig->length != siglen)
 -		return (DST_R_VERIFYFAILURE);
 +		DST_RET(DST_R_VERIFYFAILURE);
 	if (!EVP_DigestFinal_ex(evp_md_ctx, digest, &dgstlen))
 		DST_RET (dst__openssl_toresult3(dctx->category,
 -- 
 2.37.3
--- a/SOURCES/bind-9.16-CVE-2022-38178.patch
+++ b/SOURCES/bind-9.16-CVE-2022-38178.patch
@ -1,27 +0,0 @@
 From bb68864bf05d29df644427ec841bc3db6a336519 Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Tue, 20 Sep 2022 11:22:47 +0200
 Subject: [PATCH] Fix CVE-2022-38178
 5962.	[security]	Fix memory leak in EdDSA verify processing.
 			(CVE-2022-38178) [GL #3487]
 ---
 lib/dns/openssleddsa_link.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/lib/dns/openssleddsa_link.c b/lib/dns/openssleddsa_link.c
 index 8b115ec..4f3c2a8 100644
 --- a/lib/dns/openssleddsa_link.c
 +++ b/lib/dns/openssleddsa_link.c
@@ -325,7 +325,7 @@ openssleddsa_verify(dst_context_t *dctx, const isc_region_t *sig) {
 		siglen = DNS_SIG_ED448SIZE;
 	if (sig->length != siglen)
 -		return (DST_R_VERIFYFAILURE);
 +		DST_RET(DST_R_VERIFYFAILURE);
 	isc_buffer_usedregion(buf, &tbsreg);
 -- 
 2.37.3
--- a/SOURCES/bind-9.16-CVE-2023-3341.patch
+++ b/SOURCES/bind-9.16-CVE-2023-3341.patch
@ -1,166 +0,0 @@
 From 3883ec072e5feed1237dc864854ab95ded7302d6 Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Tue, 19 Sep 2023 13:14:52 +0200
 Subject: [PATCH] Backport of CVE-2023-3341 fix
 Taken from BIND 9.16.44 change.
 ---
 lib/isccc/cc.c                   | 36 +++++++++++++++++++++++---------
 lib/isccc/include/isccc/result.h |  4 +++-
 lib/isccc/result.c               |  4 +++-
 3 files changed, 32 insertions(+), 12 deletions(-)
 diff --git a/lib/isccc/cc.c b/lib/isccc/cc.c
 index 463a053..a54e60c 100644
 --- a/lib/isccc/cc.c
 +++ b/lib/isccc/cc.c
@@ -53,6 +53,10 @@
 #define MAX_TAGS		256
 #define DUP_LIFETIME		900
 +#ifndef ISCCC_MAXDEPTH
 +#define ISCCC_MAXDEPTH \
 +	10 /* Big enough for rndc which just sends a string each way. */
 +#endif
 typedef isccc_sexpr_t *sexpr_ptr;
@@ -573,19 +577,23 @@ verify(isccc_sexpr_t *alist, unsigned char *data, unsigned int length,
 static isc_result_t
 table_fromwire(isccc_region_t *source, isccc_region_t *secret,
 -	       uint32_t algorithm, isccc_sexpr_t **alistp);
 +	       uint32_t algorithm, unsigned int depth, isccc_sexpr_t **alistp);
 static isc_result_t
 -list_fromwire(isccc_region_t *source, isccc_sexpr_t **listp);
 +list_fromwire(isccc_region_t *source, unsigned int depth, isccc_sexpr_t **listp);
 static isc_result_t
 -value_fromwire(isccc_region_t *source, isccc_sexpr_t **valuep) {
 +value_fromwire(isccc_region_t *source, unsigned int depth, isccc_sexpr_t **valuep) {
 	unsigned int msgtype;
 	uint32_t len;
 	isccc_sexpr_t *value;
 	isccc_region_t active;
 	isc_result_t result;
 +	if (depth > ISCCC_MAXDEPTH) {
 +		return (ISCCC_R_MAXDEPTH);
 +	}
 +
 	if (REGION_SIZE(*source) < 1 + 4)
 		return (ISC_R_UNEXPECTEDEND);
 	GET8(msgtype, source->rstart);
@@ -603,9 +611,9 @@ value_fromwire(isccc_region_t *source, isccc_sexpr_t **valuep) {
 		} else
 			result = ISC_R_NOMEMORY;
 	} else if (msgtype == ISCCC_CCMSGTYPE_TABLE)
 -		result = table_fromwire(&active, NULL, 0, valuep);
 +		result = table_fromwire(&active, NULL, 0, depth + 1, valuep);
 	else if (msgtype == ISCCC_CCMSGTYPE_LIST)
 -		result = list_fromwire(&active, valuep);
 +		result = list_fromwire(&active, depth + 1, valuep);
 	else
 		result = ISCCC_R_SYNTAX;
@@ -614,7 +622,7 @@ value_fromwire(isccc_region_t *source, isccc_sexpr_t **valuep) {
 static isc_result_t
 table_fromwire(isccc_region_t *source, isccc_region_t *secret,
 -	       uint32_t algorithm, isccc_sexpr_t **alistp)
 +	       uint32_t algorithm, unsigned int depth, isccc_sexpr_t **alistp)
 {
 	char key[256];
 	uint32_t len;
@@ -625,6 +633,10 @@ table_fromwire(isccc_region_t *source, isccc_region_t *secret,
 	REQUIRE(alistp != NULL && *alistp == NULL);
 +	if (depth > ISCCC_MAXDEPTH) {
 +		return (ISCCC_R_MAXDEPTH);
 +	}
 +
 	checksum_rstart = NULL;
 	first_tag = true;
 	alist = isccc_alist_create();
@@ -640,7 +652,7 @@ table_fromwire(isccc_region_t *source, isccc_region_t *secret,
 		GET_MEM(key, len, source->rstart);
 		key[len] = '\0';	/* Ensure NUL termination. */
 		value = NULL;
 -		result = value_fromwire(source, &value);
 +		result = value_fromwire(source, depth + 1, &value);
 		if (result != ISC_R_SUCCESS)
 			goto bad;
 		if (isccc_alist_define(alist, key, value) == NULL) {
@@ -673,14 +685,18 @@ table_fromwire(isccc_region_t *source, isccc_region_t *secret,
 }
 static isc_result_t
 -list_fromwire(isccc_region_t *source, isccc_sexpr_t **listp) {
 +list_fromwire(isccc_region_t *source, unsigned int depth, isccc_sexpr_t **listp) {
 	isccc_sexpr_t *list, *value;
 	isc_result_t result;
 +	if (depth > ISCCC_MAXDEPTH) {
 +		return (ISCCC_R_MAXDEPTH);
 +	}
 +
 	list = NULL;
 	while (!REGION_EMPTY(*source)) {
 		value = NULL;
 -		result = value_fromwire(source, &value);
 +		result = value_fromwire(source, depth + 1, &value);
 		if (result != ISC_R_SUCCESS) {
 			isccc_sexpr_free(&list);
 			return (result);
@@ -711,7 +727,7 @@ isccc_cc_fromwire(isccc_region_t *source, isccc_sexpr_t **alistp,
 	if (version != 1)
 		return (ISCCC_R_UNKNOWNVERSION);
 -	return (table_fromwire(source, secret, algorithm, alistp));
 +	return (table_fromwire(source, secret, algorithm, 0, alistp));
 }
 static isc_result_t
 diff --git a/lib/isccc/include/isccc/result.h b/lib/isccc/include/isccc/result.h
 index 6c79dd7..b30b08a 100644
 --- a/lib/isccc/include/isccc/result.h
 +++ b/lib/isccc/include/isccc/result.h
@@ -47,8 +47,10 @@
 #define ISCCC_R_CLOCKSKEW		(ISC_RESULTCLASS_ISCCC + 4)
 /*% Duplicate */
 #define ISCCC_R_DUPLICATE		(ISC_RESULTCLASS_ISCCC + 5)
 +/*% Maximum recursion depth */
 +#define ISCCC_R_MAXDEPTH		(ISC_RESULTCLASS_ISCCC + 6)
 -#define ISCCC_R_NRESULTS 		6	/*%< Number of results */
 +#define ISCCC_R_NRESULTS 		7	/*%< Number of results */
 ISC_LANG_BEGINDECLS
 diff --git a/lib/isccc/result.c b/lib/isccc/result.c
 index 8419bbb..a3a3b9a 100644
 --- a/lib/isccc/result.c
 +++ b/lib/isccc/result.c
@@ -40,7 +40,8 @@ static const char *text[ISCCC_R_NRESULTS] = {
 	"bad auth",				/* 3 */
 	"expired",				/* 4 */
 	"clock skew",				/* 5 */
 -	"duplicate"				/* 6 */
 +	"duplicate",				/* 6 */
 +	"max depth",				/* 7 */
 };
 static const char *ids[ISCCC_R_NRESULTS] = {
@@ -50,6 +51,7 @@ static const char *ids[ISCCC_R_NRESULTS] = {
 	"ISCCC_R_EXPIRED",
 	"ISCCC_R_CLOCKSKEW",
 	"ISCCC_R_DUPLICATE",
 +	"ISCCC_R_MAXDEPTH"
 };
 #define ISCCC_RESULT_RESULTSET			2
 -- 
 2.41.0
--- a/SOURCES/bind-9.16-CVE-2024-1737-records-test.patch
+++ b/SOURCES/bind-9.16-CVE-2024-1737-records-test.patch
--- a/SOURCES/bind-9.16-CVE-2024-1737-records.patch
+++ b/SOURCES/bind-9.16-CVE-2024-1737-records.patch
--- a/SOURCES/bind-9.16-CVE-2024-1737-types-test.patch
+++ b/SOURCES/bind-9.16-CVE-2024-1737-types-test.patch
--- a/SOURCES/bind-9.16-CVE-2024-1737-types.patch
+++ b/SOURCES/bind-9.16-CVE-2024-1737-types.patch
@ -0,0 +1,582 @@
 From 06236a2d32c1d8f29208321d276e742f9259efd2 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
 Date: Sat, 25 May 2024 11:46:56 +0200
 Subject: [PATCH] Add a limit to the number of RR types for single name
 Previously, the number of RR types for a single owner name was limited
 only by the maximum number of the types (64k).  As the data structure
 that holds the RR types for the database node is just a linked list, and
 there are places where we just walk through the whole list (again and
 again), adding a large number of RR types for a single owner named with
 would slow down processing of such name (database node).
 Add a configurable limit to cap the number of the RR types for a single
 owner.  This is enforced at the database (rbtdb, qpzone, qpcache) level
 and configured with new max-types-per-name configuration option that
 can be configured globally, per-view and per-zone.
 (cherry picked from commit 00d16211d6368b99f070c1182d8c76b3798ca1db)
 (cherry picked from commit 89f1779bc28b27adbd00325b974ede7a683f8632)
 fix a memory leak that could occur when signing
 when signatures were not added because of too many types already
 existing at a node, the diff was not being cleaned up; this led to
 a memory leak being reported at shutdown.
 (cherry picked from commit 2825bdb1ae5be801e7ed603ba2455ed9a308f1f7)
 (cherry picked from commit a080317de0efb7f6ffa12415a863729d416007d5)
 Be smarter about refusing to add many RR types to the database
 Instead of outright refusing to add new RR types to the cache, be a bit
 smarter:
 1. If the new header type is in our priority list, we always add either
   positive or negative entry at the beginning of the list.
 2. If the new header type is negative entry, and we are over the limit,
   we mark it as ancient immediately, so it gets evicted from the cache
   as soon as possible.
 3. Otherwise add the new header after the priority headers (or at the
   head of the list).
 4. If we are over the limit, evict the last entry on the normal header
   list.
 (cherry picked from commit 57cd34441a1b4ecc9874a4a106c2c95b8d7a3120)
 (cherry picked from commit 92a680a3ef708281267e4fd7b1e62b57c929447b)
 Log error when update fails
 The new "too many records" error can make an update fail without the
 error being logged. This commit fixes that.
 (cherry picked from commit 558923e5405894cf976d102f0d246a28bdbb400c)
 (cherry picked from commit d72adf4b927d83a2a0ff8e431b911ec1df7aeb88)
 ---
 bin/named/config.c                 |  1 +
 bin/named/server.c                 |  9 +++++++++
 bin/named/zoneconf.c               |  8 ++++++++
 bin/tests/system/dyndb/driver/db.c |  3 ++-
 doc/arm/reference.rst              | 12 ++++++++++++
 lib/dns/cache.c                    | 12 ++++++++++++
 lib/dns/db.c                       |  9 +++++++++
 lib/dns/dnsrps.c                   |  3 ++-
 lib/dns/ecdb.c                     |  3 ++-
 lib/dns/include/dns/cache.h        |  6 ++++++
 lib/dns/include/dns/db.h           | 11 +++++++++++
 lib/dns/include/dns/view.h         |  7 +++++++
 lib/dns/include/dns/zone.h         | 13 +++++++++++++
 lib/dns/rbtdb.c                    | 28 +++++++++++++++++-----------
 lib/dns/sdb.c                      |  3 ++-
 lib/dns/sdlz.c                     |  3 ++-
 lib/dns/view.c                     | 10 ++++++++++
 lib/dns/zone.c                     | 16 ++++++++++++++++
 lib/isccfg/namedconf.c             |  3 +++
 lib/ns/update.c                    | 15 ++++++++++++---
 20 files changed, 156 insertions(+), 19 deletions(-)
 diff --git a/bin/named/config.c b/bin/named/config.c
 index 72dec1a..ec48840 100644
 --- a/bin/named/config.c
 +++ b/bin/named/config.c
@@ -229,6 +229,7 @@ options {\n\
 	max-records-per-type 100;\n\
 	max-refresh-time 2419200; /* 4 weeks */\n\
 	max-retry-time 1209600; /* 2 weeks */\n\
 +	max-types-per-name 100;\n\
 	max-transfer-idle-in 60;\n\
 	max-transfer-idle-out 60;\n\
 	max-transfer-time-in 120;\n\
 diff --git a/bin/named/server.c b/bin/named/server.c
 index f550814..c68b8d1 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
@@ -5461,6 +5461,15 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	INSIST(result == ISC_R_SUCCESS);
 	dns_view_setmaxrrperset(view, cfg_obj_asuint32(obj));
 +	/*
 +	 * This is used for the cache and also as a default value
 +	 * for zone databases.
 +	 */
 +	obj = NULL;
 +	result = named_config_get(maps, "max-types-per-name", &obj);
 +	INSIST(result == ISC_R_SUCCESS);
 +	dns_view_setmaxtypepername(view, cfg_obj_asuint32(obj));
 +
 	obj = NULL;
 	result = named_config_get(maps, "max-recursion-depth", &obj);
 	INSIST(result == ISC_R_SUCCESS);
 diff --git a/bin/named/zoneconf.c b/bin/named/zoneconf.c
 index 81f6879..821e6a1 100644
 --- a/bin/named/zoneconf.c
 +++ b/bin/named/zoneconf.c
@@ -1080,6 +1080,14 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		dns_zone_setmaxrrperset(zone, 0);
 	}
 +	obj = NULL;
 +	result = named_config_get(maps, "max-types-per-name", &obj);
 +	INSIST(result == ISC_R_SUCCESS && obj != NULL);
 +	dns_zone_setmaxtypepername(mayberaw, cfg_obj_asuint32(obj));
 +	if (zone != mayberaw) {
 +		dns_zone_setmaxtypepername(zone, 0);
 +	}
 +
 	if (raw != NULL && filename != NULL) {
 #define SIGNED ".signed"
 		size_t signedlen = strlen(filename) + sizeof(SIGNED);
 diff --git a/bin/tests/system/dyndb/driver/db.c b/bin/tests/system/dyndb/driver/db.c
 index 727268f..398589a 100644
 --- a/bin/tests/system/dyndb/driver/db.c
 +++ b/bin/tests/system/dyndb/driver/db.c
@@ -623,7 +623,8 @@ static dns_dbmethods_t sampledb_methods = {
 	NULL, /* getservestalerefresh */
 	NULL, /* setgluecachestats */
 	NULL, /* adjusthashsize */
 -	NULL  /* setmaxrrperset */
 +	NULL, /* setmaxrrperset */
 +	NULL  /* setmaxtypepername */
 };
 /* Auxiliary driver functions. */
 diff --git a/doc/arm/reference.rst b/doc/arm/reference.rst
 index fbd8edb..0ce2d1f 100644
 --- a/doc/arm/reference.rst
 +++ b/doc/arm/reference.rst
@@ -2957,6 +2957,18 @@ system.
    a failure.  If set to 0, there is no cap on RRset size.  The default is
    100.
 +``max-types-per-name``
 +   This sets the maximum number of resource record types that can be stored
 +   for a single owner name in a database. When configured in ``options``
 +   or ``view``, it controls the cache database, and also sets
 +   the default value for zone databases, which can be overridden by setting
 +   it at the ``zone`` level
 +
 +   If set to a positive value, any attempt to cache or to add to a zone an owner
 +   name with more than the specified number of resource record types will result
 +   in a failure.  If set to 0, there is no cap on RR types number.  The default is
 +   100.
 +   
 ``recursive-clients``
    This sets the maximum number (a "hard quota") of simultaneous recursive lookups
    the server performs on behalf of clients. The default is
 diff --git a/lib/dns/cache.c b/lib/dns/cache.c
 index 8cb442b..125cfdc 100644
 --- a/lib/dns/cache.c
 +++ b/lib/dns/cache.c
@@ -153,6 +153,7 @@ struct dns_cache {
 	/* Access to the on-disk cache file is also locked by 'filelock'. */
 	uint32_t maxrrperset;
 +	uint32_t maxtypepername;
 };
 /***
@@ -187,6 +188,7 @@ cache_create_db(dns_cache_t *cache, dns_db_t **db) {
 	dns_db_setservestalettl(*db, cache->serve_stale_ttl);
 	dns_db_setmaxrrperset(*db, cache->maxrrperset);
 +	dns_db_setmaxtypepername(*db, cache->maxtypepername);
 	if (cache->taskmgr == NULL) {
 		return (ISC_R_SUCCESS);
@@ -1329,6 +1331,16 @@ dns_cache_setmaxrrperset(dns_cache_t *cache, uint32_t value) {
 	}
 }
 +void
 +dns_cache_setmaxtypepername(dns_cache_t *cache, uint32_t value) {
 +	REQUIRE(VALID_CACHE(cache));
 +
 +	cache->maxtypepername = value;
 +	if (cache->db != NULL) {
 +		dns_db_setmaxtypepername(cache->db, value);
 +	}
 +}
 +
 /*
  * XXX: Much of the following code has been copied in from statschannel.c.
  * We should refactor this into a generic function in stats.c that can be
 diff --git a/lib/dns/db.c b/lib/dns/db.c
 index a575d62..1f19016 100644
 --- a/lib/dns/db.c
 +++ b/lib/dns/db.c
@@ -1146,3 +1146,12 @@ dns_db_setmaxrrperset(dns_db_t *db, uint32_t value) {
 		(db->methods->setmaxrrperset)(db, value);
 	}
 }
 +
 +void
 +dns_db_setmaxtypepername(dns_db_t *db, uint32_t value) {
 +	REQUIRE(DNS_DB_VALID(db));
 +
 +	if (db->methods->setmaxtypepername != NULL) {
 +		(db->methods->setmaxtypepername)(db, value);
 +	}
 +}
 diff --git a/lib/dns/dnsrps.c b/lib/dns/dnsrps.c
 index f4d9bae..43c28ae 100644
 --- a/lib/dns/dnsrps.c
 +++ b/lib/dns/dnsrps.c
@@ -976,7 +976,8 @@ static dns_dbmethods_t rpsdb_db_methods = {
 	NULL, /* getservestalerefresh */
 	NULL, /* setgluecachestats */
 	NULL, /* adjusthashsize */
 -	NULL  /* setmaxrrperset */
 +	NULL, /* setmaxrrperset */
 +	NULL  /* setmaxtypepername */
 };
 static dns_rdatasetmethods_t rpsdb_rdataset_methods = {
 diff --git a/lib/dns/ecdb.c b/lib/dns/ecdb.c
 index 42a1248..3e562d8 100644
 --- a/lib/dns/ecdb.c
 +++ b/lib/dns/ecdb.c
@@ -564,7 +564,8 @@ static dns_dbmethods_t ecdb_methods = {
 	NULL, /* getservestalerefresh */
 	NULL, /* setgluecachestats */
 	NULL, /* adjusthashsize */
 -	NULL  /* setmaxrrperset */
 +	NULL, /* setmaxrrperset */
 +	NULL  /* setmaxtypepername */
 };
 static isc_result_t
 diff --git a/lib/dns/include/dns/cache.h b/lib/dns/include/dns/cache.h
 index 34539eb..eb6f1e9 100644
 --- a/lib/dns/include/dns/cache.h
 +++ b/lib/dns/include/dns/cache.h
@@ -340,6 +340,12 @@ dns_cache_setmaxrrperset(dns_cache_t *cache, uint32_t value);
  * Set the maximum resource records per RRSet that can be cached.
  */
 +void
 +dns_cache_setmaxtypepername(dns_cache_t *cache, uint32_t value);
 +/*%<
 + * Set the maximum resource record types per owner name that can be cached.
 + */
 +
 #ifdef HAVE_LIBXML2
 int
 dns_cache_renderxml(dns_cache_t *cache, void *writer0);
 diff --git a/lib/dns/include/dns/db.h b/lib/dns/include/dns/db.h
 index e0d17f2..3c6c7f2 100644
 --- a/lib/dns/include/dns/db.h
 +++ b/lib/dns/include/dns/db.h
@@ -185,6 +185,7 @@ typedef struct dns_dbmethods {
 	isc_result_t (*setgluecachestats)(dns_db_t *db, isc_stats_t *stats);
 	isc_result_t (*adjusthashsize)(dns_db_t *db, size_t size);
 	void (*setmaxrrperset)(dns_db_t *db, uint32_t value);
 +	void (*setmaxtypepername)(dns_db_t *db, uint32_t value);
 } dns_dbmethods_t;
 typedef isc_result_t (*dns_dbcreatefunc_t)(isc_mem_t	    *mctx,
@@ -1804,6 +1805,16 @@ dns_db_setmaxrrperset(dns_db_t *db, uint32_t value);
  * is nonzero, then any subsequent attempt to add an rdataset with
  * more than 'value' RRs will return ISC_R_NOSPACE.
  */
 +
 +void
 +dns_db_setmaxtypepername(dns_db_t *db, uint32_t value);
 +/*%<
 + * Set the maximum permissible number of RR types per owner name.
 + *
 + * If 'value' is nonzero, then any subsequent attempt to add an rdataset with a
 + * RR type that would exceed the number of already stored RR types will return
 + * ISC_R_NOSPACE.
 + */
 ISC_LANG_ENDDECLS
 #endif /* DNS_DB_H */
 diff --git a/lib/dns/include/dns/view.h b/lib/dns/include/dns/view.h
 index b7cf663..4151c11 100644
 --- a/lib/dns/include/dns/view.h
 +++ b/lib/dns/include/dns/view.h
@@ -189,6 +189,7 @@ struct dns_view {
 	uint32_t	  fail_ttl;
 	dns_badcache_t	 *failcache;
 	uint32_t	  maxrrperset;
 +	uint32_t	  maxtypepername;
 	/*
 	 * Configurable data for server use only,
@@ -1361,6 +1362,12 @@ dns_view_setmaxrrperset(dns_view_t *view, uint32_t value);
  * Set the maximum resource records per RRSet that can be cached.
  */
 +void
 +dns_view_setmaxtypepername(dns_view_t *view, uint32_t value);
 +/*%<
 + * Set the maximum resource record types per owner name that can be cached.
 + */
 +
 ISC_LANG_ENDDECLS
 #endif /* DNS_VIEW_H */
 diff --git a/lib/dns/include/dns/zone.h b/lib/dns/include/dns/zone.h
 index a98b28f..d893dd2 100644
 --- a/lib/dns/include/dns/zone.h
 +++ b/lib/dns/include/dns/zone.h
@@ -358,6 +358,19 @@ dns_zone_setmaxrrperset(dns_zone_t *zone, uint32_t maxrrperset);
  *\li	void
  */
 +void
 +dns_zone_setmaxtypepername(dns_zone_t *zone, uint32_t maxtypepername);
 +/*%<
 + * 	Sets the maximum number of resource record types per owner name
 + *	permitted in a zone.  0 implies unlimited.
 + *
 + * Requires:
 + *\li	'zone' to be valid initialised zone.
 + *
 + * Returns:
 + *\li	void
 + */
 +
 void
 dns_zone_setmaxttl(dns_zone_t *zone, uint32_t maxttl);
 /*%<
 diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
 index e8de346..c2cd63e 100644
 --- a/lib/dns/rbtdb.c
 +++ b/lib/dns/rbtdb.c
@@ -497,6 +497,7 @@ struct dns_rbtdb {
 	rbtdb_serial_t least_serial;
 	rbtdb_serial_t next_serial;
 	uint32_t maxrrperset;
 +	uint32_t maxtypepername;
 	rbtdb_version_t *current_version;
 	rbtdb_version_t *future_version;
 	rbtdb_versionlist_t open_versions;
@@ -6259,19 +6260,13 @@ update_recordsandxfrsize(bool add, rbtdb_version_t *rbtversion,
 	RWUNLOCK(&rbtversion->rwlock, isc_rwlocktype_write);
 }
 -#ifndef DNS_RBTDB_MAX_RTYPES
 -#define DNS_RBTDB_MAX_RTYPES 100
 -#endif /* DNS_RBTDB_MAX_RTYPES */
 -
 static bool
 overmaxtype(dns_rbtdb_t *rbtdb, uint32_t ntypes) {
 -	UNUSED(rbtdb);
 -
 -	if (DNS_RBTDB_MAX_RTYPES == 0) {
 +	if (rbtdb->maxtypepername == 0) {
 		return (false);
 	}
 -	return (ntypes >= DNS_RBTDB_MAX_RTYPES);
 +	return (ntypes >= rbtdb->maxtypepername);
 }
 static bool
@@ -6809,7 +6804,7 @@ find_header:
 			if (!IS_CACHE(rbtdb) && overmaxtype(rbtdb, ntypes)) {
 				free_rdataset(rbtdb, rbtdb->common.mctx,
 					      newheader);
 -				return (ISC_R_QUOTA);
 +				return (DNS_R_TOOMANYRECORDS);
 			}
 			newheader->down = NULL;
@@ -8627,6 +8622,15 @@ setmaxrrperset(dns_db_t *db, uint32_t maxrrperset) {
 	rbtdb->maxrrperset = maxrrperset;
 }
 +static void
 +setmaxtypepername(dns_db_t *db, uint32_t maxtypepername) {
 +	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
 +
 +	REQUIRE(VALID_RBTDB(rbtdb));
 +
 +	rbtdb->maxtypepername = maxtypepername;
 +}
 +
 static dns_stats_t *
 getrrsetstats(dns_db_t *db) {
 	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
@@ -8751,7 +8755,8 @@ static dns_dbmethods_t zone_methods = { attach,
 					NULL, /* getservestalerefresh */
 					setgluecachestats,
 					adjusthashsize,
 -					setmaxrrperset };
 +					setmaxrrperset,
 +					setmaxtypepername };
 static dns_dbmethods_t cache_methods = { attach,
 					 detach,
@@ -8804,7 +8809,8 @@ static dns_dbmethods_t cache_methods = { attach,
 					 getservestalerefresh,
 					 NULL,
 					 adjusthashsize,
 -					 setmaxrrperset };
 +					 setmaxrrperset,
 +					 setmaxtypepername };
 isc_result_t
 dns_rbtdb_create(isc_mem_t *mctx, const dns_name_t *origin, dns_dbtype_t type,
 diff --git a/lib/dns/sdb.c b/lib/dns/sdb.c
 index 282c327..4438091 100644
 --- a/lib/dns/sdb.c
 +++ b/lib/dns/sdb.c
@@ -1320,7 +1320,8 @@ static dns_dbmethods_t sdb_methods = {
 	NULL, /* getservestalerefresh */
 	NULL, /* setgluecachestats */
 	NULL, /* adjusthashsize */
 -	NULL  /* setmaxrrperset */
 +	NULL, /* setmaxrrperset */
 +	NULL  /* setmaxtypepername */
 };
 static isc_result_t
 diff --git a/lib/dns/sdlz.c b/lib/dns/sdlz.c
 index 299c7d8..a8556df 100644
 --- a/lib/dns/sdlz.c
 +++ b/lib/dns/sdlz.c
@@ -1293,7 +1293,8 @@ static dns_dbmethods_t sdlzdb_methods = {
 	NULL, /* getservestalerefresh */
 	NULL, /* setgluecachestats */
 	NULL, /* adjusthashsize */
 -	NULL  /* setmaxrrperset */
 +	NULL, /* setmaxrrperset */
 +	NULL  /* setmaxtypepername */
 };
 /*
 diff --git a/lib/dns/view.c b/lib/dns/view.c
 index 9f5daf7..0de880d 100644
 --- a/lib/dns/view.c
 +++ b/lib/dns/view.c
@@ -873,6 +873,7 @@ dns_view_setcache(dns_view_t *view, dns_cache_t *cache, bool shared) {
 	INSIST(DNS_DB_VALID(view->cachedb));
 	dns_cache_setmaxrrperset(view->cache, view->maxrrperset);
 +	dns_cache_setmaxtypepername(view->cache, view->maxtypepername);
 }
 bool
@@ -2651,3 +2652,12 @@ dns_view_setmaxrrperset(dns_view_t *view, uint32_t value) {
 		dns_cache_setmaxrrperset(view->cache, value);
 	}
 }
 +
 +void
 +dns_view_setmaxtypepername(dns_view_t *view, uint32_t value) {
 +	REQUIRE(DNS_VIEW_VALID(view));
 +	view->maxtypepername = value;
 +	if (view->cache != NULL) {
 +		dns_cache_setmaxtypepername(view->cache, value);
 +	}
 +}
 diff --git a/lib/dns/zone.c b/lib/dns/zone.c
 index 301f440..ae5ef43 100644
 --- a/lib/dns/zone.c
 +++ b/lib/dns/zone.c
@@ -308,6 +308,7 @@ struct dns_zone {
 	uint32_t maxrecords;
 	uint32_t maxrrperset;
 +	uint32_t maxtypepername;
 	isc_sockaddr_t *masters;
 	isc_dscp_t *masterdscps;
@@ -10060,6 +10061,7 @@ cleanup:
 	}
 	dns_diff_clear(&_sig_diff);
 +	dns_diff_clear(&post_diff);
 	for (i = 0; i < nkeys; i++) {
 		dst_key_free(&zone_keys[i]);
@@ -12319,6 +12321,16 @@ dns_zone_setmaxrrperset(dns_zone_t *zone, uint32_t val) {
 	}
 }
 +void
 +dns_zone_setmaxtypepername(dns_zone_t *zone, uint32_t val) {
 +	REQUIRE(DNS_ZONE_VALID(zone));
 +
 +	zone->maxtypepername = val;
 +	if (zone->db != NULL) {
 +		dns_db_setmaxtypepername(zone->db, val);
 +	}
 +}
 +
 static bool
 notify_isqueued(dns_zone_t *zone, unsigned int flags, dns_name_t *name,
 		isc_sockaddr_t *addr, dns_tsigkey_t *key) {
@@ -14733,6 +14745,8 @@ ns_query(dns_zone_t *zone, dns_rdataset_t *soardataset, dns_stub_t *stub) {
 			}
 			dns_db_settask(stub->db, zone->task, zone->task);
 			dns_db_setmaxrrperset(stub->db, zone->maxrrperset);
 +			dns_db_setmaxtypepername(stub->db,
 +						 zone->maxtypepername);
 		}
 		result = dns_db_newversion(stub->db, &stub->version);
@@ -17476,6 +17490,7 @@ zone_replacedb(dns_zone_t *zone, dns_db_t *db, bool dump) {
 	zone_attachdb(zone, db);
 	dns_db_settask(zone->db, zone->task, zone->task);
 	dns_db_setmaxrrperset(zone->db, zone->maxrrperset);
 +	dns_db_setmaxtypepername(zone->db, zone->maxtypepername);
 	DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_LOADED | DNS_ZONEFLG_NEEDNOTIFY);
 	return (ISC_R_SUCCESS);
@@ -23659,6 +23674,7 @@ dns_zone_makedb(dns_zone_t *zone, dns_db_t **dbp) {
 	dns_db_settask(db, zone->task, zone->task);
 	dns_db_setmaxrrperset(db, zone->maxrrperset);
 +	dns_db_setmaxtypepername(db, zone->maxtypepername);
 	*dbp = db;
 diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
 index ffe22b3..69525dc 100644
 --- a/lib/isccfg/namedconf.c
 +++ b/lib/isccfg/namedconf.c
@@ -2244,6 +2244,9 @@ static cfg_clausedef_t zone_clauses[] = {
 	{ "max-records-per-type", &cfg_type_uint32,
 	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR |
 		  CFG_ZONE_STUB | CFG_ZONE_STATICSTUB | CFG_ZONE_REDIRECT },
 +	{ "max-types-per-name", &cfg_type_uint32,
 +	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR |
 +		  CFG_ZONE_STUB | CFG_ZONE_STATICSTUB | CFG_ZONE_REDIRECT },
 	{ "max-refresh-time", &cfg_type_uint32,
 	  CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR | CFG_ZONE_STUB },
 	{ "max-retry-time", &cfg_type_uint32,
 diff --git a/lib/ns/update.c b/lib/ns/update.c
 index 4e51cdc..d9cea2c 100644
 --- a/lib/ns/update.c
 +++ b/lib/ns/update.c
@@ -3136,9 +3136,18 @@ update_action(isc_task_t *task, isc_event_t *event) {
 						dns_diff_clear(&ctx.add_diff);
 						goto failure;
 					}
 -					CHECK(update_one_rr(db, ver, &diff,
 -							    DNS_DIFFOP_ADD,
 -							    name, ttl, &rdata));
 +					result = update_one_rr(
 +						db, ver, &diff, DNS_DIFFOP_ADD,
 +						name, ttl, &rdata);
 +					if (result != ISC_R_SUCCESS) {
 +						update_log(client, zone,
 +							   LOGLEVEL_PROTOCOL,
 +							   "adding an RR "
 +							   "failed: %s",
 +							   isc_result_totext(
 +								   result));
 +						goto failure;
 +					}
 				}
 			}
 		} else if (update_class == dns_rdataclass_any) {
 -- 
 2.51.1
--- a/SOURCES/bind-9.16-CVE-2024-1737.patch
+++ b/SOURCES/bind-9.16-CVE-2024-1737.patch
@ -0,0 +1,360 @@
 From aed0e33be79d1d1b133208846d943503c4f2e6a8 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
 Date: Fri, 1 Mar 2024 08:26:07 +0100
 Subject: [PATCH] Add a limit to the number of RRs in RRSets
 Previously, the number of RRs in the RRSets were internally unlimited.
 As the data structure that holds the RRs is just a linked list, and
 there are places where we just walk through all of the RRs, adding an
 RRSet with huge number of RRs inside would slow down processing of said
 RRSets.
 The fix for end-of-life branches make the limit compile-time only for
 simplicity and the limit can be changed at the compile time by adding
 following define to CFLAGS:
    -DDNS_RDATASET_MAX_RECORDS=<limit>
 (cherry picked from commit c5c4d00c38530390c9e1ae4c98b65fbbadfe9e5e)
 (cherry picked from commit fdabf4b9570a60688f9f7d1e88d885f7a3718bca)
 Add a limit to the number of RR types for single name
 Previously, the number of RR types for a single owner name was limited
 only by the maximum number of the types (64k).  As the data structure
 that holds the RR types for the database node is just a linked list, and
 there are places where we just walk through the whole list (again and
 again), adding a large number of RR types for a single owner named with
 would slow down processing of such name (database node).
 Add a hard-coded limit (100) to cap the number of the RR types for a single
 owner.  The limit can be changed at the compile time by adding following
 define to CFLAGS:
    -DDNS_RBTDB_MAX_RTYPES=<limit>
 (cherry picked from commit dfcadc2085c8844b5836aff2b5ea51fb60c34868)
 Optimize the slabheader placement for certain RRTypes
 Mark the infrastructure RRTypes as "priority" types and place them at
 the beginning of the rdataslab header data graph.  The non-priority
 types either go right after the priority types (if any).
 (cherry picked from commit 3ac482be7fd058d284e89873021339579fad0615)
 (cherry picked from commit 8ef414a7f38a04cfc11df44adaedaf3126fa3878)
 Expand the list of the priority types
 Add HTTPS, SVCB, SRV, PTR, NAPTR, DNSKEY and TXT records to the list of
 the priority types that are put at the beginning of the slabheader list
 for faster access and to avoid eviction when there are more types than
 the max-types-per-name limit.
 (cherry picked from commit b27c6bcce894786a8e082eafd59eccbf6f2731cb)
 (cherry picked from commit d56d2a32b861e81c2aaaabd309c4c58b629ede32)
 Make the resolver qtype ANY test order agnostic
 Instead of relying on a specific order of the RR types in the databases
 pick the first RR type as returned from the cache.
 (cherry picked from commit 58f660cf2b800963fa649bc9823a626009db3a7e)
 (cherry picked from commit c5ebda6deb0997dc520b26fa0639891459de5cb6)
 Be smarter about refusing to add many RR types to the database
 Instead of outright refusing to add new RR types to the cache, be a bit
 smarter:
 1. If the new header type is in our priority list, we always add either
   positive or negative entry at the beginning of the list.
 2. If the new header type is negative entry, and we are over the limit,
   we mark it as ancient immediately, so it gets evicted from the cache
   as soon as possible.
 3. Otherwise add the new header after the priority headers (or at the
   head of the list).
 4. If we are over the limit, evict the last entry on the normal header
   list.
 (cherry picked from commit 57cd34441a1b4ecc9874a4a106c2c95b8d7a3120)
 (cherry picked from commit 26c9da5f2857b72077c17e06ac79f068c63782cc)
 ---
 bin/tests/system/resolver/tests.sh |  9 ++--
 configure                          |  2 +-
 configure.ac                       |  2 +-
 lib/dns/rbtdb.c                    | 83 +++++++++++++++++++++++++++++-
 lib/dns/rdataslab.c                | 12 +++++
 lib/dns/zone.c                     | 13 -----
 6 files changed, 100 insertions(+), 21 deletions(-)
 diff --git a/bin/tests/system/resolver/tests.sh b/bin/tests/system/resolver/tests.sh
 index fc05635e31..09fff0dd13 100755
 --- a/bin/tests/system/resolver/tests.sh
 +++ b/bin/tests/system/resolver/tests.sh
@@ -596,18 +596,17 @@ n=$((n + 1))
 echo_i "check prefetch qtype * (${n})"
 ret=0
 dig_with_opts @10.53.0.5 fetchall.tld any >dig.out.1.${n} || ret=1
 -ttl1=$(awk '/"A" "short" "ttl"/ { print $2 - 3 }' dig.out.1.${n})
 +ttl1=$(awk '/^fetchall.tld/ { print $2 - 3; exit }' dig.out.1.${n})
 # sleep so we are in prefetch range
 sleep "${ttl1:-0}"
 # trigger prefetch
 dig_with_opts @10.53.0.5 fetchall.tld any >dig.out.2.${n} || ret=1
 -ttl2=$(awk '/"A" "short" "ttl"/ { print $2 }' dig.out.2.${n})
 +ttl2=$(awk '/^fetchall.tld/ { print $2; exit }' dig.out.2.${n})
 sleep 1
 -# check that prefetch occurred;
 -# note that only one record is prefetched, which is the AAAA record in this case,
 +# note that only the first record is prefetched,
 # because of the order of the records in the cache
 dig_with_opts @10.53.0.5 fetchall.tld any >dig.out.3.${n} || ret=1
 -ttl3=$(awk '/::1/ { print $2 }' dig.out.3.${n})
 +ttl3=$(awk '/^fetchall.tld/ { print $2; exit }' dig.out.3.${n})
 test "${ttl3:-0}" -gt "${ttl2:-1}" || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
 diff --git a/configure b/configure
 index 1b436d63eb..835cd94dff 100755
 --- a/configure
 +++ b/configure
@@ -12341,7 +12341,7 @@ fi
 XTARGETS=
 if test "$enable_developer" = "yes"; then :
 -  STD_CDEFINES="$STD_CDEFINES -DISC_MEM_DEFAULTFILL=1 -DISC_LIST_CHECKINIT=1"
 +  STD_CDEFINES="$STD_CDEFINES -DISC_MEM_DEFAULTFILL=1 -DISC_LIST_CHECKINIT=1 -DDNS_RDATASET_MAX_RECORDS=5000 -DDNS_RBTDB_MAX_RTYPES=5000"
        test "${enable_fixed_rrset+set}" = set || enable_fixed_rrset=yes
        test "${enable_querytrace+set}" = set || enable_querytrace=yes
        test "${with_cmocka+set}" = set || with_cmocka=yes
 diff --git a/configure.ac b/configure.ac
 index fb6f172eae..6db42501a2 100644
 --- a/configure.ac
 +++ b/configure.ac
@@ -96,7 +96,7 @@ AC_ARG_ENABLE([developer],
 XTARGETS=
 AS_IF([test "$enable_developer" = "yes"],
 -      [STD_CDEFINES="$STD_CDEFINES -DISC_MEM_DEFAULTFILL=1 -DISC_LIST_CHECKINIT=1"
 +      [STD_CDEFINES="$STD_CDEFINES -DISC_MEM_DEFAULTFILL=1 -DISC_LIST_CHECKINIT=1 -DDNS_RDATASET_MAX_RECORDS=5000 -DDNS_RBTDB_MAX_RTYPES=5000"
        test "${enable_fixed_rrset+set}" = set || enable_fixed_rrset=yes
        test "${enable_querytrace+set}" = set || enable_querytrace=yes
        test "${with_cmocka+set}" = set || with_cmocka=yes
 diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
 index 3f06545aa1..d4c1829c26 100644
 --- a/lib/dns/rbtdb.c
 +++ b/lib/dns/rbtdb.c
@@ -990,6 +990,8 @@ prio_type(rbtdb_rdatatype_t type) {
 	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_soa):
 	case dns_rdatatype_a:
 	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_a):
 +	case dns_rdatatype_mx:
 +	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_mx):
 	case dns_rdatatype_aaaa:
 	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_aaaa):
 	case dns_rdatatype_nsec:
@@ -1002,6 +1004,22 @@ prio_type(rbtdb_rdatatype_t type) {
 	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_ds):
 	case dns_rdatatype_cname:
 	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_cname):
 +	case dns_rdatatype_dname:
 +	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_dname):
 +	case dns_rdatatype_svcb:
 +	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_svcb):
 +	case dns_rdatatype_https:
 +	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_https):
 +	case dns_rdatatype_dnskey:
 +	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_dnskey):
 +	case dns_rdatatype_srv:
 +	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_srv):
 +	case dns_rdatatype_txt:
 +	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_txt):
 +	case dns_rdatatype_ptr:
 +	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_ptr):
 +	case dns_rdatatype_naptr:
 +	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_naptr):
 		return (true);
 	}
 	return (false);
@@ -6240,6 +6258,30 @@ update_recordsandxfrsize(bool add, rbtdb_version_t *rbtversion,
 	RWUNLOCK(&rbtversion->rwlock, isc_rwlocktype_write);
 }
 +#ifndef DNS_RBTDB_MAX_RTYPES
 +#define DNS_RBTDB_MAX_RTYPES 100
 +#endif /* DNS_RBTDB_MAX_RTYPES */
 +
 +static bool
 +overmaxtype(dns_rbtdb_t *rbtdb, uint32_t ntypes) {
 +	UNUSED(rbtdb);
 +
 +	if (DNS_RBTDB_MAX_RTYPES == 0) {
 +		return (false);
 +	}
 +
 +	return (ntypes >= DNS_RBTDB_MAX_RTYPES);
 +}
 +
 +static bool
 +prio_header(rdatasetheader_t *header) {
 +	if (NEGATIVE(header) && prio_type(RBTDB_RDATATYPE_EXT(header->type))) {
 +		return (true);
 +	}
 +
 +	return (prio_type(header->type));
 +}
 +
 /*
  * write lock on rbtnode must be held.
  */
@@ -6251,7 +6293,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, const dns_name_t *nodename,
 	rbtdb_changed_t *changed = NULL;
 	rdatasetheader_t *topheader = NULL, *topheader_prev = NULL;
 	rdatasetheader_t *header = NULL, *sigheader = NULL;
 -	rdatasetheader_t *prioheader = NULL;
 +	rdatasetheader_t *prioheader = NULL, *expireheader = NULL;
 	unsigned char *merged = NULL;
 	isc_result_t result;
 	bool header_nx;
@@ -6261,6 +6303,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, const dns_name_t *nodename,
 	rbtdb_rdatatype_t negtype, sigtype;
 	dns_trust_t trust;
 	int idx;
 +	uint32_t ntypes = 0;
 	/*
 	 * Add an rdatasetheader_t to a node.
@@ -6336,6 +6379,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, const dns_name_t *nodename,
 			{
 				if (topheader->type == sigtype) {
 					sigheader = topheader;
 +					break;
 				}
 			}
 			negtype = RBTDB_RDATATYPE_VALUE(covers, 0);
@@ -6398,6 +6442,12 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, const dns_name_t *nodename,
 	for (topheader = rbtnode->data; topheader != NULL;
 	     topheader = topheader->next)
 	{
 +		if (IS_CACHE(rbtdb) && ACTIVE(topheader, now)) {
 +			++ntypes;
 +			expireheader = topheader;
 +		} else if (!IS_CACHE(rbtdb)) {
 +			++ntypes;
 +		}
 		if (prio_type(topheader->type)) {
 			prioheader = topheader;
 		}
@@ -6755,6 +6805,12 @@ find_header:
 			/*
 			 * No rdatasets of the given type exist at the node.
 			 */
 +			if (!IS_CACHE(rbtdb) && overmaxtype(rbtdb, ntypes)) {
 +				free_rdataset(rbtdb, rbtdb->common.mctx,
 +					      newheader);
 +				return (ISC_R_QUOTA);
 +			}
 +
 			newheader->down = NULL;
 			if (prio_type(newheader->type)) {
@@ -6770,6 +6826,31 @@ find_header:
 				newheader->next = rbtnode->data;
 				rbtnode->data = newheader;
 			}
 +
 +			if (IS_CACHE(rbtdb) && overmaxtype(rbtdb, ntypes)) {
 +				if (expireheader == NULL) {
 +					expireheader = newheader;
 +				}
 +				if (NEGATIVE(newheader) &&
 +				    !prio_header(newheader))
 +				{
 +					/*
 +					 * Add the new non-priority negative
 +					 * header to the database only
 +					 * temporarily.
 +					 */
 +					expireheader = newheader;
 +				}
 +
 +				set_ttl(rbtdb, expireheader, 0);
 +				mark_header_ancient(rbtdb, expireheader);
 +				/*
 +				 * FIXME: In theory, we should mark the RRSIG
 +				 * and the header at the same time, but there is
 +				 * no direct link between those two header, so
 +				 * we would have to check the whole list again.
 +				 */
 +			}
 		}
 	}
 diff --git a/lib/dns/rdataslab.c b/lib/dns/rdataslab.c
 index 14c43818b8..d74e84ce4a 100644
 --- a/lib/dns/rdataslab.c
 +++ b/lib/dns/rdataslab.c
@@ -112,6 +112,10 @@ fillin_offsets(unsigned char *offsetbase, unsigned int *offsettable,
 }
 #endif /* if DNS_RDATASET_FIXED */
 +#ifndef DNS_RDATASET_MAX_RECORDS
 +#define DNS_RDATASET_MAX_RECORDS 100
 +#endif /* DNS_RDATASET_MAX_RECORDS */
 +
 isc_result_t
 dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx,
 			   isc_region_t *region, unsigned int reservelen) {
@@ -156,6 +160,10 @@ dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx,
 		return (ISC_R_SUCCESS);
 	}
 +	if (nitems > DNS_RDATASET_MAX_RECORDS) {
 +		return (DNS_R_TOOMANYRECORDS);
 +	}
 +
 	if (nitems > 0xffff) {
 		return (ISC_R_NOSPACE);
 	}
@@ -524,6 +532,10 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab,
 #endif /* if DNS_RDATASET_FIXED */
 	INSIST(ocount > 0 && ncount > 0);
 +	if (ocount + ncount > DNS_RDATASET_MAX_RECORDS) {
 +		return (DNS_R_TOOMANYRECORDS);
 +	}
 +
 #if DNS_RDATASET_FIXED
 	oncount = ncount;
 #endif /* if DNS_RDATASET_FIXED */
 diff --git a/lib/dns/zone.c b/lib/dns/zone.c
 index b457095907..53da95a7d7 100644
 --- a/lib/dns/zone.c
 +++ b/lib/dns/zone.c
@@ -2316,19 +2316,6 @@ zone_load(dns_zone_t *zone, unsigned int flags, bool locked) {
 			      isc_result_totext(result));
 		goto cleanup;
 	}
 -	dns_db_settask(db, zone->task, zone->task);
 -
 -	if (zone->type == dns_zone_primary ||
 -	    zone->type == dns_zone_secondary || zone->type == dns_zone_mirror)
 -	{
 -		result = dns_db_setgluecachestats(db, zone->gluecachestats);
 -		if (result == ISC_R_NOTIMPLEMENTED) {
 -			result = ISC_R_SUCCESS;
 -		}
 -		if (result != ISC_R_SUCCESS) {
 -			goto cleanup;
 -		}
 -	}
 	if (!dns_db_ispersistent(db)) {
 		if (zone->masterfile != NULL) {
 -- 
 2.53.0
--- a/SOURCES/bind-9.16-CVE-2024-1975.patch
+++ b/SOURCES/bind-9.16-CVE-2024-1975.patch
@ -0,0 +1,320 @@
 From ec67f14dc90e17acf08708e53a2166e0554b25ca Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Tue, 16 Jul 2024 19:49:09 +0200
 Subject: [PATCH] Resolve CVE-2024-1975
 6404.	[security]	Remove SIG(0) support from named as a countermeasure
 			for CVE-2024-1975. [GL #4480]
 Resolves: CVE-2024-1975
 ---
 bin/tests/system/tsiggss/authsock.pl |  5 ++
 bin/tests/system/tsiggss/tests.sh    | 12 ++--
 bin/tests/system/upforwd/tests.sh    | 21 +++---
 doc/arm/general.rst                  |  6 +-
 doc/arm/reference.rst                |  4 +-
 doc/arm/security.rst                 |  4 +-
 lib/dns/message.c                    | 99 ++--------------------------
 lib/ns/client.c                      |  7 ++
 8 files changed, 43 insertions(+), 115 deletions(-)
 diff --git a/bin/tests/system/tsiggss/authsock.pl b/bin/tests/system/tsiggss/authsock.pl
 index d629c65..b3888fb 100644
 --- a/bin/tests/system/tsiggss/authsock.pl
 +++ b/bin/tests/system/tsiggss/authsock.pl
@@ -33,6 +33,10 @@ if (!defined($path)) {
 	exit(1);
 }
 +# Enable output autoflush so that it's not lost when the parent sends TERM.
 +select STDOUT;
 +$| = 1;
 +
 unlink($path);
 my $server = IO::Socket::UNIX->new(Local => $path, Type => SOCK_STREAM, Listen => 8) or
     die "unable to create socket $path";
@@ -55,6 +59,7 @@ if ($timeout != 0) {
 }
 while (my $client = $server->accept()) {
 +	printf("accept()\n");
 	$client->recv(my $buf, 8, 0);
 	my ($version, $req_len) = unpack('N N', $buf);
 diff --git a/bin/tests/system/tsiggss/tests.sh b/bin/tests/system/tsiggss/tests.sh
 index a665703..34b8c89 100644
 --- a/bin/tests/system/tsiggss/tests.sh
 +++ b/bin/tests/system/tsiggss/tests.sh
@@ -116,7 +116,7 @@ status=$((status + ret))
 echo_i "testing external update policy (CNAME) with auth sock ($n)"
 ret=0
 -$PERL ./authsock.pl --type=CNAME --path=ns1/auth.sock --pidfile=authsock.pid --timeout=120 >/dev/null 2>&1 &
 +$PERL ./authsock.pl --type=CNAME --path=ns1/auth.sock --pidfile=authsock.pid --timeout=120 >authsock.log 2>&1 &
 sleep 1
 test_update $n testcname.example.nil. CNAME "86400 CNAME testdenied.example.nil" "testdenied" || ret=1
 n=$((n + 1))
@@ -130,17 +130,19 @@ n=$((n + 1))
 if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
 -echo_i "testing external policy with SIG(0) key ($n)"
 +echo_i "testing external policy with unsupported SIG(0) key ($n)"
 ret=0
 -$NSUPDATE -k ns1/Kkey.example.nil.*.private <<END >/dev/null 2>&1 || ret=1
 +$NSUPDATE -d -k ns1/Kkey.example.nil.*.private <<END >nsupdate.out${n} 2>&1 || true
 +debug
 server 10.53.0.1 ${PORT}
 zone example.nil
 update add fred.example.nil 120 cname foo.bar.
 send
 END
 output=$($DIG $DIGOPTS +short cname fred.example.nil.)
 -[ -n "$output" ] || ret=1
 -[ $ret -eq 0 ] || echo_i "failed"
 +# update must have failed - SIG(0) signer is not supported
 +[ -n "$output" ] && ret=1
 +grep -F "signer=key.example.nil" authsock.log >/dev/null && ret=1
 n=$((n + 1))
 if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
 diff --git a/bin/tests/system/upforwd/tests.sh b/bin/tests/system/upforwd/tests.sh
 index 063e28d..0947166 100644
 --- a/bin/tests/system/upforwd/tests.sh
 +++ b/bin/tests/system/upforwd/tests.sh
@@ -262,19 +262,22 @@ if $FEATURETEST --enable-dnstap; then
 fi
 if test -f keyname; then
 -  echo_i "checking update forwarding to with sig0 ($n)"
 +  echo_i "checking update forwarding to with sig0 (expected to fail) ($n)"
   ret=0
   keyname=$(cat keyname)
 -  $NSUPDATE -k $keyname.private -- - <<EOF
 -	local 10.53.0.1
 -	server 10.53.0.3 ${PORT}
 -	zone example2
 -	update add unsigned.example2. 600 A 10.10.10.1
 -	update add unsigned.example2. 600 TXT Foo
 -	send
 +	# SIG(0) is removed, update is expected to fail.
 +	{
 +	  $NSUPDATE -k $keyname.private -- - <<EOF
 +	  local 10.53.0.1
 +	  server 10.53.0.3 ${PORT}
 +	  zone example2
 +	  update add unsigned.example2. 600 A 10.10.10.1
 +	  update add unsigned.example2. 600 TXT Foo
 +	  send
 EOF
 +	} >nsupdate.out.$n 2>&1 && ret=1
   $DIG -p ${PORT} unsigned.example2 A @10.53.0.1 >dig.out.ns1.test$n || ret=1
 -  grep "status: NOERROR" dig.out.ns1.test$n >/dev/null || ret=1
 +  grep "status: NOERROR" dig.out.ns1.test$n >/dev/null && ret=1
   if [ $ret != 0 ]; then echo_i "failed"; fi
   status=$(expr $status + $ret)
   n=$(expr $n + 1)
 diff --git a/doc/arm/general.rst b/doc/arm/general.rst
 index d7b7c20..59f9e6b 100644
 --- a/doc/arm/general.rst
 +++ b/doc/arm/general.rst
@@ -367,10 +367,8 @@ Notes
 .. [#rfc1035_2] CLASS ANY queries are not supported. This is considered a
    feature.
 -.. [#rfc2931] When receiving a query signed with a SIG(0), the server is
 -   only able to verify the signature if it has the key in its local
 -   authoritative data; it cannot do recursion or validation to
 -   retrieve unknown keys.
 +.. [#rfc2931] Support for SIG(0) message verification was removed
 +   as part of the mitigation of CVE-2024-1975.
 .. [#rfc2874] Compliance is with loading and serving of A6 records only.
    A6 records were moved to the experimental category by :rfc:`3363`.
 diff --git a/doc/arm/reference.rst b/doc/arm/reference.rst
 index ecc84d4..f982e0a 100644
 --- a/doc/arm/reference.rst
 +++ b/doc/arm/reference.rst
@@ -5900,7 +5900,7 @@ The ``update-policy`` clause allows more fine-grained control over which
 updates are allowed. It specifies a set of rules, in which each rule
 either grants or denies permission for one or more names in the zone to
 be updated by one or more identities. Identity is determined by the key
 -that signed the update request, using either TSIG or SIG(0). In most
 +that signed the update request, using either TSIG. In most
 cases, ``update-policy`` rules only apply to key-based identities. There
 is no way to specify update permissions based on the client source address.
@@ -5957,7 +5957,7 @@ field), and the type of the record to be updated matches the ``types``
 field. Details for each rule type are described below.
 The ``identity`` field must be set to a fully qualified domain name. In
 -most cases, this represents the name of the TSIG or SIG(0) key that
 +most cases, this represents the name of the TSIG key that
 must be used to sign the update request. If the specified name is a
 wildcard, it is subject to DNS wildcard expansion, and the rule may
 apply to multiple identities. When a TKEY exchange has been used to
 diff --git a/doc/arm/security.rst b/doc/arm/security.rst
 index 817ebd0..92b1668 100644
 --- a/doc/arm/security.rst
 +++ b/doc/arm/security.rst
@@ -83,7 +83,7 @@ Limiting access to the server by outside parties can help prevent
 spoofing and denial of service (DoS) attacks against the server.
 ACLs match clients on the basis of up to three characteristics: 1) The
 -client's IP address; 2) the TSIG or SIG(0) key that was used to sign the
 +client's IP address; 2) the TSIG key that was used to sign the
 request, if any; and 3) an address prefix encoded in an EDNS
 Client-Subnet option, if any.
@@ -124,7 +124,7 @@ and no queries at all from the networks specified in ``bogusnets``.
 In addition to network addresses and prefixes, which are matched against
 the source address of the DNS request, ACLs may include ``key``
 -elements, which specify the name of a TSIG or SIG(0) key.
 +elements, which specify the name of a TSIG key.
 When BIND 9 is built with GeoIP support, ACLs can also be used for
 geographic access restrictions. This is done by specifying an ACL
 diff --git a/lib/dns/message.c b/lib/dns/message.c
 index 22aa552..12331ab 100644
 --- a/lib/dns/message.c
 +++ b/lib/dns/message.c
@@ -3301,111 +3301,24 @@ dns_message_dumpsig(dns_message_t *msg, char *txt1) {
 isc_result_t
 dns_message_checksig(dns_message_t *msg, dns_view_t *view) {
 -	isc_buffer_t b, msgb;
 +	isc_buffer_t msgb;
 	REQUIRE(DNS_MESSAGE_VALID(msg));
 -	if (msg->tsigkey == NULL && msg->tsig == NULL && msg->sig0 == NULL) {
 +	if (msg->tsigkey == NULL && msg->tsig == NULL) {
 		return (ISC_R_SUCCESS);
 	}
 	INSIST(msg->saved.base != NULL);
 	isc_buffer_init(&msgb, msg->saved.base, msg->saved.length);
 	isc_buffer_add(&msgb, msg->saved.length);
 -	if (msg->tsigkey != NULL || msg->tsig != NULL) {
 #ifdef SKAN_MSG_DEBUG
 -		dns_message_dumpsig(msg, "dns_message_checksig#1");
 +	dns_message_dumpsig(msg, "dns_message_checksig#1");
 #endif /* ifdef SKAN_MSG_DEBUG */
 -		if (view != NULL) {
 -			return (dns_view_checksig(view, &msgb, msg));
 -		} else {
 -			return (dns_tsig_verify(&msgb, msg, NULL, NULL));
 -		}
 +	if (view != NULL) {
 +		return (dns_view_checksig(view, &msgb, msg));
 	} else {
 -		dns_rdata_t rdata = DNS_RDATA_INIT;
 -		dns_rdata_sig_t sig;
 -		dns_rdataset_t keyset;
 -		isc_result_t result;
 -
 -		result = dns_rdataset_first(msg->sig0);
 -		INSIST(result == ISC_R_SUCCESS);
 -		dns_rdataset_current(msg->sig0, &rdata);
 -
 -		/*
 -		 * This can occur when the message is a dynamic update, since
 -		 * the rdata length checking is relaxed.  This should not
 -		 * happen in a well-formed message, since the SIG(0) is only
 -		 * looked for in the additional section, and the dynamic update
 -		 * meta-records are in the prerequisite and update sections.
 -		 */
 -		if (rdata.length == 0) {
 -			return (ISC_R_UNEXPECTEDEND);
 -		}
 -
 -		result = dns_rdata_tostruct(&rdata, &sig, NULL);
 -		if (result != ISC_R_SUCCESS) {
 -			return (result);
 -		}
 -
 -		dns_rdataset_init(&keyset);
 -		if (view == NULL) {
 -			result = DNS_R_KEYUNAUTHORIZED;
 -			goto freesig;
 -		}
 -		result = dns_view_simplefind(view, &sig.signer,
 -					     dns_rdatatype_key /* SIG(0) */, 0,
 -					     0, false, &keyset, NULL);
 -
 -		if (result != ISC_R_SUCCESS) {
 -			/* XXXBEW Should possibly create a fetch here */
 -			result = DNS_R_KEYUNAUTHORIZED;
 -			goto freesig;
 -		} else if (keyset.trust < dns_trust_secure) {
 -			/* XXXBEW Should call a validator here */
 -			result = DNS_R_KEYUNAUTHORIZED;
 -			goto freesig;
 -		}
 -		result = dns_rdataset_first(&keyset);
 -		INSIST(result == ISC_R_SUCCESS);
 -		for (; result == ISC_R_SUCCESS;
 -		     result = dns_rdataset_next(&keyset))
 -		{
 -			dst_key_t *key = NULL;
 -
 -			dns_rdata_reset(&rdata);
 -			dns_rdataset_current(&keyset, &rdata);
 -			isc_buffer_init(&b, rdata.data, rdata.length);
 -			isc_buffer_add(&b, rdata.length);
 -
 -			result = dst_key_fromdns(&sig.signer, rdata.rdclass, &b,
 -						 view->mctx, &key);
 -			if (result != ISC_R_SUCCESS) {
 -				continue;
 -			}
 -			if (dst_key_alg(key) != sig.algorithm ||
 -			    dst_key_id(key) != sig.keyid ||
 -			    !(dst_key_proto(key) == DNS_KEYPROTO_DNSSEC ||
 -			      dst_key_proto(key) == DNS_KEYPROTO_ANY))
 -			{
 -				dst_key_free(&key);
 -				continue;
 -			}
 -			result = dns_dnssec_verifymessage(&msgb, msg, key);
 -			dst_key_free(&key);
 -			if (result == ISC_R_SUCCESS) {
 -				break;
 -			}
 -		}
 -		if (result == ISC_R_NOMORE) {
 -			result = DNS_R_KEYUNAUTHORIZED;
 -		}
 -
 -	freesig:
 -		if (dns_rdataset_isassociated(&keyset)) {
 -			dns_rdataset_disassociate(&keyset);
 -		}
 -		dns_rdata_freestruct(&sig);
 -		return (result);
 +		return (dns_tsig_verify(&msgb, msg, NULL, NULL));
 	}
 }
 diff --git a/lib/ns/client.c b/lib/ns/client.c
 index d4ce000..2679a5e 100644
 --- a/lib/ns/client.c
 +++ b/lib/ns/client.c
@@ -2041,6 +2041,13 @@ ns__client_request(isc_nmhandle_t *handle, isc_result_t eresult,
 		ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
 			      NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(3),
 			      "request is signed by a nonauthoritative key");
 +	} else if (result == DNS_R_NOTVERIFIEDYET &&
 +		   client->message->sig0 != NULL)
 +	{
 +		ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
 +			      NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(3),
 +			      "request has a SIG(0) signature but its support "
 +			      "was removed (CVE-2024-1975)");
 	} else {
 		char tsigrcode[64];
 		isc_buffer_t b;
 -- 
 2.51.1
--- a/SOURCES/bind-9.16-CVE-2025-40778.patch
+++ b/SOURCES/bind-9.16-CVE-2025-40778.patch
@ -0,0 +1,786 @@
 From 3f033e9822a08c02cb146c4e996ed6edfbea4636 Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Mon, 29 Sep 2025 21:46:59 -0700
 Subject: [PATCH] Tighten restrictions on caching NS RRsets in authority
 section
 To prevent certain spoofing attacks, a new check has been added
 to the existing rules for whether NS data can be cached: the owner
 name of the NS RRset must be an ancestor of the name being queried.
 (cherry picked from commit fa153f791f9324bf84abf8d259e11c0531fe6e25)
 (cherry picked from commit 2f0f44d493c382a7f0a3adfe7c4976b18a3d480b)
 Further restrict addresses that are cached when processing referrals
 Use the owner name of the NS record as the bailwick apex name
 when determining which additional records to cache, rather than
 the name of the delegating zone (or a parent thereof).
 Modified resolver.c
 (cherry picked from commit a41054e9e606a61f1b3c8bc0c54e2f1059347165)
 (cherry picked from commit 50479358efdf432d690415131b74b5df158a9d69)
 Retry lookups with unsigned DNAME over TCP
 To prevent spoofed unsigned DNAME responses being accepted retry
 response with unsigned DNAMEs over TCP if the response is not TSIG
 signed or there isn't a good DNS CLIENT COOKIE.
 To prevent test failures, this required adding TCP support to the
 ans3 and ans4 servers in the chain system test.
 (cherry picked from commit 2e40705c06831988106335ed77db3cf924d431f6)
 (cherry picked from commit 33a7db1fe964e55b76b4ac003ecc56cc67028bd9)
 ---
 bin/tests/system/chain/ans3/ans.pl | 143 -------------------
 bin/tests/system/chain/ans3/ans.py | 217 +++++++++++++++++++++++++++++
 bin/tests/system/chain/ans4/ans.py |  57 ++++++--
 lib/dns/include/dns/message.h      |   8 ++
 lib/dns/message.c                  |  12 ++
 lib/dns/resolver.c                 | 112 ++++++++++++---
 6 files changed, 376 insertions(+), 173 deletions(-)
 delete mode 100644 bin/tests/system/chain/ans3/ans.pl
 create mode 100644 bin/tests/system/chain/ans3/ans.py
 diff --git a/bin/tests/system/chain/ans3/ans.pl b/bin/tests/system/chain/ans3/ans.pl
 deleted file mode 100644
 index e42240be63..0000000000
 --- a/bin/tests/system/chain/ans3/ans.pl
 +++ /dev/null
@@ -1,143 +0,0 @@
 -#!/usr/bin/env perl
 -
 -# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 -#
 -# SPDX-License-Identifier: MPL-2.0
 -#
 -# This Source Code Form is subject to the terms of the Mozilla Public
 -# License, v. 2.0.  If a copy of the MPL was not distributed with this
 -# file, you can obtain one at https://mozilla.org/MPL/2.0/.
 -#
 -# See the COPYRIGHT file distributed with this work for additional
 -# information regarding copyright ownership.
 -
 -use strict;
 -use warnings;
 -
 -use IO::File;
 -use Getopt::Long;
 -use Net::DNS::Nameserver;
 -
 -my $pidf = new IO::File "ans.pid", "w" or die "cannot open pid file: $!";
 -print $pidf "$$\n" or die "cannot write pid file: $!";
 -$pidf->close or die "cannot close pid file: $!";
 -sub rmpid { unlink "ans.pid"; exit 1; };
 -sub term { };
 -
 -$SIG{INT} = \&rmpid;
 -if ($Net::DNS::VERSION > 1.41) {
 -    $SIG{TERM} = \&term;
 -} else {
 -    $SIG{TERM} = \&rmpid;
 -}
 -
 -my $localaddr = "10.53.0.3";
 -
 -my $localport = int($ENV{'PORT'});
 -if (!$localport) { $localport = 5300; }
 -
 -my $verbose = 0;
 -my $ttl = 60;
 -my $zone = "example.broken";
 -my $nsname = "ns3.$zone";
 -my $synth = "synth-then-dname.$zone";
 -my $synth2 = "synth2-then-dname.$zone";
 -
 -sub reply_handler {
 -    my ($qname, $qclass, $qtype, $peerhost, $query, $conn) = @_;
 -    my ($rcode, @ans, @auth, @add);
 -
 -    print ("request: $qname/$qtype\n");
 -    STDOUT->flush();
 -
 -    if ($qname eq "example.broken") {
 -        if ($qtype eq "SOA") {
 -	    my $rr = new Net::DNS::RR("$qname $ttl $qclass SOA . . 0 0 0 0 0");
 -	    push @ans, $rr;
 -        } elsif ($qtype eq "NS") {
 -	    my $rr = new Net::DNS::RR("$qname $ttl $qclass NS $nsname");
 -	    push @ans, $rr;
 -	    $rr = new Net::DNS::RR("$nsname $ttl $qclass A $localaddr");
 -	    push @add, $rr;
 -        }
 -        $rcode = "NOERROR";
 -    } elsif ($qname eq "cname-to-$synth2") {
 -        my $rr = new Net::DNS::RR("$qname $ttl $qclass CNAME name.$synth2");
 -	push @ans, $rr;
 -        $rr = new Net::DNS::RR("name.$synth2 $ttl $qclass CNAME name");
 -	push @ans, $rr;
 -        $rr = new Net::DNS::RR("$synth2 $ttl $qclass DNAME .");
 -	push @ans, $rr;
 -	$rcode = "NOERROR";
 -    } elsif ($qname eq "$synth" || $qname eq "$synth2") {
 -	if ($qtype eq "DNAME") {
 -	    my $rr = new Net::DNS::RR("$qname $ttl $qclass DNAME .");
 -	    push @ans, $rr;
 -	}
 -	$rcode = "NOERROR";
 -    } elsif ($qname eq "name.$synth") {
 -	my $rr = new Net::DNS::RR("$qname $ttl $qclass CNAME name.");
 -	push @ans, $rr;
 -	$rr = new Net::DNS::RR("$synth $ttl $qclass DNAME .");
 -	push @ans, $rr;
 -	$rcode = "NOERROR";
 -    } elsif ($qname eq "name.$synth2") {
 -	my $rr = new Net::DNS::RR("$qname $ttl $qclass CNAME name.");
 -	push @ans, $rr;
 -	$rr = new Net::DNS::RR("$synth2 $ttl $qclass DNAME .");
 -	push @ans, $rr;
 -	$rcode = "NOERROR";
 -    # The following three code branches referring to the "example.dname"
 -    # zone are necessary for the resolver variant of the CVE-2021-25215
 -    # regression test to work.  A named instance cannot be used for
 -    # serving the DNAME records below as a version of BIND vulnerable to
 -    # CVE-2021-25215 would crash while answering the queries asked by
 -    # the tested resolver.
 -    } elsif ($qname eq "ns3.example.dname") {
 -	if ($qtype eq "A") {
 -		my $rr = new Net::DNS::RR("$qname $ttl $qclass A 10.53.0.3");
 -		push @ans, $rr;
 -	}
 -	if ($qtype eq "AAAA") {
 -		my $rr = new Net::DNS::RR("example.dname. $ttl $qclass SOA . . 0 0 0 0 $ttl");
 -		push @auth, $rr;
 -	}
 -	$rcode = "NOERROR";
 -    } elsif ($qname eq "self.example.self.example.dname") {
 -	my $rr = new Net::DNS::RR("self.example.dname. $ttl $qclass DNAME dname.");
 -	push @ans, $rr;
 -	$rr = new Net::DNS::RR("$qname $ttl $qclass CNAME self.example.dname.");
 -	push @ans, $rr;
 -	$rcode = "NOERROR";
 -    } elsif ($qname eq "self.example.dname") {
 -	if ($qtype eq "DNAME") {
 -		my $rr = new Net::DNS::RR("$qname $ttl $qclass DNAME dname.");
 -		push @ans, $rr;
 -	}
 -	$rcode = "NOERROR";
 -    } else {
 -	$rcode = "REFUSED";
 -    }
 -    return ($rcode, \@ans, \@auth, \@add, { aa => 1 });
 -}
 -
 -GetOptions(
 -    'port=i' => \$localport,
 -    'verbose!' => \$verbose,
 -);
 -
 -my $ns = Net::DNS::Nameserver->new(
 -    LocalAddr => $localaddr,
 -    LocalPort => $localport,
 -    ReplyHandler => \&reply_handler,
 -    Verbose => $verbose,
 -);
 -
 -if ($Net::DNS::VERSION >= 1.42) {
 -    $ns->start_server();
 -    select(undef, undef, undef, undef);
 -    $ns->stop_server();
 -    unlink "ans.pid";
 -} else {
 -    $ns->main_loop;
 -}
 diff --git a/bin/tests/system/chain/ans3/ans.py b/bin/tests/system/chain/ans3/ans.py
 new file mode 100644
 index 0000000000..0a031c1145
 --- /dev/null
 +++ b/bin/tests/system/chain/ans3/ans.py
@@ -0,0 +1,217 @@
 +# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 +#
 +# SPDX-License-Identifier: MPL-2.0
 +#
 +# This Source Code Form is subject to the terms of the Mozilla Public
 +# License, v. 2.0.  If a copy of the MPL was not distributed with this
 +# file, you can obtain one at https://mozilla.org/MPL/2.0/.
 +#
 +# See the COPYRIGHT file distributed with this work for additional
 +# information regarding copyright ownership.
 +
 +############################################################################
 +# ans.py: See README.anspy for details.
 +############################################################################
 +
 +from __future__ import print_function
 +import os
 +import sys
 +import signal
 +import socket
 +import select
 +from datetime import datetime, timedelta
 +import functools
 +
 +import dns, dns.message, dns.query
 +from dns.rdatatype import *
 +from dns.rdataclass import *
 +from dns.rcode import *
 +from dns.name import *
 +
 +
 +############################################################################
 +# Respond to a DNS query.
 +############################################################################
 +def create_response(msg):
 +    ttl = 60
 +    zone = "example.broken."
 +    nsname = f"ns3.{zone}"
 +    synth = f"synth-then-dname.{zone}"
 +    synth2 = f"synth2-then-dname.{zone}"
 +
 +    m = dns.message.from_wire(msg)
 +    qname = m.question[0].name.to_text()
 +
 +    # prepare the response and convert to wire format
 +    r = dns.message.make_response(m)
 +
 +    # get qtype
 +    rrtype = m.question[0].rdtype
 +    qtype = dns.rdatatype.to_text(rrtype)
 +    print(f"request: {qname}/{qtype}")
 +
 +    rcode = "NOERROR"
 +    if qname == zone:
 +        if qtype == "SOA":
 +            r.answer.append(dns.rrset.from_text(qname, ttl, IN, SOA, ". . 0 0 0 0 0"))
 +        elif qtype == "NS":
 +            r.answer.append(dns.rrset.from_text(qname, ttl, IN, NS, nsname))
 +            r.additional.append(dns.rrset.from_text(nsname, ttl, IN, A, ip4))
 +    elif qname == f"cname-to-{synth2}":
 +        r.answer.append(dns.rrset.from_text(qname, ttl, IN, CNAME, f"name.{synth2}"))
 +        r.answer.append(dns.rrset.from_text(f"name.{synth2}", ttl, IN, CNAME, "name."))
 +        r.answer.append(dns.rrset.from_text(synth2, ttl, IN, DNAME, "."))
 +    elif qname == f"{synth}" or qname == f"{synth2}":
 +        if qtype == "DNAME":
 +            r.answer.append(dns.rrset.from_text(qname, ttl, IN, DNAME, "."))
 +    elif qname == f"name.{synth}":
 +        r.answer.append(dns.rrset.from_text(qname, ttl, IN, CNAME, "name."))
 +        r.answer.append(dns.rrset.from_text(synth, ttl, IN, DNAME, "."))
 +    elif qname == f"name.{synth2}":
 +        r.answer.append(dns.rrset.from_text(qname, ttl, IN, CNAME, "name."))
 +        r.answer.append(dns.rrset.from_text(synth2, ttl, IN, DNAME, "."))
 +    elif qname == "ns3.example.dname.":
 +        # This and the next two code branches referring to the "example.dname"
 +        # zone are necessary for the resolver variant of the CVE-2021-25215
 +        # regression test to work.  A named instance cannot be used for
 +        # serving the DNAME records below as a version of BIND vulnerable to
 +        # CVE-2021-25215 would crash while answering the queries asked by
 +        # the tested resolver.
 +        if qtype == "A":
 +            r.answer.append(dns.rrset.from_text(qname, ttl, IN, A, ip4))
 +        elif qtype == "AAAA":
 +            r.authority.append(
 +                dns.rrset.from_text("example.dname.", ttl, IN, SOA, ". . 0 0 0 0 0")
 +            )
 +    elif qname == "self.example.self..example.dname.":
 +        r.answer.append(
 +            dns.rrset.from_text("self.example.dname.", ttl, IN, DNAME, "dname.")
 +        )
 +        r.answer.append(
 +            dns.rrset.from_text(qname, ttl, IN, CNAME, "self.example.dname.")
 +        )
 +    elif qname == "self.example.dname.":
 +        if qtype == "DNAME":
 +            r.answer.append(dns.rrset.from_text(qname, ttl, IN, DNAME, "dname."))
 +    else:
 +        rcode = "REFUSED"
 +
 +    r.flags |= dns.flags.AA
 +    r.use_edns()
 +    return r.to_wire()
 +
 +
 +def sigterm(signum, frame):
 +    print("Shutting down now...")
 +    os.remove("ans.pid")
 +    running = False
 +    sys.exit(0)
 +
 +
 +############################################################################
 +# Main
 +#
 +# Set up responder and control channel, open the pid file, and start
 +# the main loop, listening for queries on the query channel or commands
 +# on the control channel and acting on them.
 +############################################################################
 +ip4 = "10.53.0.3"
 +ip6 = "fd92:7065:b8e:ffff::3"
 +
 +try:
 +    port = int(os.environ["PORT"])
 +except:
 +    port = 5300
 +
 +query4_udp = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
 +query4_udp.bind((ip4, port))
 +
 +query4_tcp = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 +query4_tcp.bind((ip4, port))
 +query4_tcp.listen(1)
 +query4_tcp.settimeout(1)
 +
 +havev6 = True
 +try:
 +    query6_udp = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM)
 +    try:
 +        query6_udp.bind((ip6, port))
 +    except:
 +        query6_udp.close()
 +        havev6 = False
 +
 +    query6_tcp = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 +    try:
 +        query6_tcp.bind((ip4, port))
 +        query6_tcp.listen(1)
 +        query6_tcp.settimeout(1)
 +    except:
 +        query6_tcp.close()
 +        havev6 = False
 +except:
 +    havev6 = False
 +
 +signal.signal(signal.SIGTERM, sigterm)
 +
 +f = open("ans.pid", "w")
 +pid = os.getpid()
 +print(pid, file=f)
 +f.close()
 +
 +running = True
 +
 +print("Listening on %s port %d" % (ip4, port))
 +if havev6:
 +    print("Listening on %s port %d" % (ip6, port))
 +print("Ctrl-c to quit")
 +
 +if havev6:
 +    input = [query4_udp, query4_tcp, query6_udp, query6_tcp]
 +else:
 +    input = [query4_udp, query4_tcp]
 +
 +while running:
 +    try:
 +        inputready, outputready, exceptready = select.select(input, [], [])
 +    except select.error as e:
 +        break
 +    except socket.error as e:
 +        break
 +    except KeyboardInterrupt:
 +        break
 +
 +    for s in inputready:
 +        if s == query4_udp or s == query6_udp:
 +            print("Query received on %s" % (ip4 if s == query4_udp else ip6))
 +            # Handle incoming queries
 +            msg = s.recvfrom(65535)
 +            rsp = create_response(msg[0])
 +            if rsp:
 +                s.sendto(rsp, msg[1])
 +        elif s == query4_tcp or s == query6_tcp:
 +            try:
 +                conn, _ = s.accept()
 +                if s == query4_tcp or s == query6_tcp:
 +                    print(
 +                        "TCP Query received on %s" % (ip4 if s == query4_tcp else ip6),
 +                        end=" ",
 +                    )
 +                # get TCP message length
 +                msg = conn.recv(2)
 +                if len(msg) != 2:
 +                    print("couldn't read TCP message length")
 +                    continue
 +                length = struct.unpack(">H", msg[:2])[0]
 +                msg = conn.recv(length)
 +                if len(msg) != length:
 +                    print("couldn't read TCP message")
 +                    continue
 +                rsp = create_response(msg)
 +                if rsp:
 +                    conn.send(struct.pack(">H", len(rsp)))
 +                    conn.send(rsp)
 +                conn.close()
 +            except socket.error as e:
 +                print("error: %s" % str(e))
 +    if not running:
 +        break
 diff --git a/bin/tests/system/chain/ans4/ans.py b/bin/tests/system/chain/ans4/ans.py
 index 839067faa5..66f0193cac 100755
 --- a/bin/tests/system/chain/ans4/ans.py
 +++ b/bin/tests/system/chain/ans4/ans.py
@@ -316,16 +316,30 @@ try:
 except:
     ctrlport = 5300
 -query4_socket = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
 -query4_socket.bind((ip4, port))
 +query4_udp = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
 +query4_udp.bind((ip4, port))
 +
 +query4_tcp = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 +query4_tcp.bind((ip4, port))
 +query4_tcp.listen(1)
 +query4_tcp.settimeout(1)
 havev6 = True
 try:
 -    query6_socket = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM)
 +    query6_udp = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM)
 +    try:
 +        query6_udp.bind((ip6, port))
 +    except:
 +        query6_udp.close()
 +        havev6 = False
 +
 +    query6_tcp = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
     try:
 -        query6_socket.bind((ip6, port))
 +        query6_tcp.bind((ip4, port))
 +        query6_tcp.listen(1)
 +        query6_tcp.settimeout(1)
     except:
 -        query6_socket.close()
 +        query6_tcp.close()
         havev6 = False
 except:
     havev6 = False
@@ -350,9 +364,9 @@ print("Control channel on %s port %d" % (ip4, ctrlport))
 print("Ctrl-c to quit")
 if havev6:
 -    input = [query4_socket, query6_socket, ctrl_socket]
 +    input = [query4_udp, query4_tcp, query6_udp, query6_tcp, ctrl_socket]
 else:
 -    input = [query4_socket, ctrl_socket]
 +    input = [query4_udp, query4_tcp, ctrl_socket]
 while running:
     try:
@@ -375,12 +389,37 @@ while running:
                     break
                 ctl_channel(msg)
             conn.close()
 -        if s == query4_socket or s == query6_socket:
 -            print("Query received on %s" % (ip4 if s == query4_socket else ip6))
 +        elif s == query4_udp or s == query6_udp:
 +            print("Query received on %s" % (ip4 if s == query4_udp else ip6))
             # Handle incoming queries
             msg = s.recvfrom(65535)
             rsp = create_response(msg[0])
             if rsp:
                 s.sendto(rsp, msg[1])
 +        elif s == query4_tcp or s == query6_tcp:
 +            try:
 +                conn, _ = s.accept()
 +                if s == query4_tcp or s == query6_tcp:
 +                    print(
 +                        "TCP Query received on %s" % (ip4 if s == query4_tcp else ip6),
 +                        end=" ",
 +                    )
 +                # get TCP message length
 +                msg = conn.recv(2)
 +                if len(msg) != 2:
 +                    print("couldn't read TCP message length")
 +                    continue
 +                length = struct.unpack(">H", msg[:2])[0]
 +                msg = conn.recv(length)
 +                if len(msg) != length:
 +                    print("couldn't read TCP message")
 +                    continue
 +                rsp = create_response(msg)
 +                if rsp:
 +                    conn.send(struct.pack(">H", len(rsp)))
 +                    conn.send(rsp)
 +                conn.close()
 +            except socket.error as e:
 +                print("error: %s" % str(e))
     if not running:
         break
 diff --git a/lib/dns/include/dns/message.h b/lib/dns/include/dns/message.h
 index ea45742439..f564e1e5ef 100644
 --- a/lib/dns/include/dns/message.h
 +++ b/lib/dns/include/dns/message.h
@@ -235,6 +235,7 @@ struct dns_message {
 	unsigned int cc_bad	      : 1;
 	unsigned int tkey	      : 1;
 	unsigned int rdclass_set      : 1;
 +	unsigned int has_dname	      : 1;
 	unsigned int opt_reserved;
 	unsigned int sig_reserved;
@@ -1451,4 +1452,11 @@ dns_message_clonebuffer(dns_message_t *msg);
  * \li   msg be a valid message.
  */
 +bool
 +dns_message_hasdname(dns_message_t *msg);
 +/*%<
 + * Return whether a DNAME was detected in the ANSWER section of a QUERY
 + * message when it was parsed.
 + */
 +
 ISC_LANG_ENDDECLS
 diff --git a/lib/dns/message.c b/lib/dns/message.c
 index 22aa552f3f..c3f86fdbe0 100644
 --- a/lib/dns/message.c
 +++ b/lib/dns/message.c
@@ -442,6 +442,7 @@ msginit(dns_message_t *m) {
 	m->cc_bad = 0;
 	m->tkey = 0;
 	m->rdclass_set = 0;
 +	m->has_dname = 0;
 	m->querytsig = NULL;
 	m->indent.string = "\t";
 	m->indent.count = 0;
@@ -1727,6 +1728,11 @@ getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
 			 */
 			msg->tsigname->attributes |= DNS_NAMEATTR_NOCOMPRESS;
 			free_name = false;
 +		} else if (rdtype == dns_rdatatype_dname &&
 +			   sectionid == DNS_SECTION_ANSWER &&
 +			   msg->opcode == dns_opcode_query)
 +		{
 +			msg->has_dname = 1;
 		}
 		rdataset = NULL;
@@ -4857,3 +4863,9 @@ dns_message_clonebuffer(dns_message_t *msg) {
 		msg->free_query = 1;
 	}
 }
 +
 +bool
 +dns_message_hasdname(dns_message_t *msg) {
 +	REQUIRE(DNS_MESSAGE_VALID(msg));
 +	return msg->has_dname;
 +}
 diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
 index 0952624689..cf6a55163a 100644
 --- a/lib/dns/resolver.c
 +++ b/lib/dns/resolver.c
@@ -758,6 +758,7 @@ typedef struct respctx {
 	bool get_nameservers; /* get a new NS rrset at
 			       * zone cut? */
 	bool resend;	      /* resend this query? */
 +	bool secured;	      /* message was signed or had a valid cookie */
 	bool nextitem;	      /* invalid response; keep
 			       * listening for the correct one */
 	bool truncated;	      /* response was truncated */
@@ -7154,7 +7155,8 @@ mark_related(dns_name_t *name, dns_rdataset_t *rdataset, bool external,
  * locally served zone.
  */
 static bool
 -name_external(const dns_name_t *name, dns_rdatatype_t type, fetchctx_t *fctx) {
 +name_external(const dns_name_t *name, dns_rdatatype_t type, respctx_t *rctx) {
 +	fetchctx_t *fctx = rctx->fctx;
 	isc_result_t result;
 	dns_forwarders_t *forwarders = NULL;
 	dns_fixedname_t fixed, zfixed;
@@ -7167,7 +7169,7 @@ name_external(const dns_name_t *name, dns_rdatatype_t type, fetchctx_t *fctx) {
 	dns_namereln_t rel;
 	apex = (ISDUALSTACK(fctx->addrinfo) || !ISFORWARDER(fctx->addrinfo))
 -		       ? &fctx->domain
 +		       ? rctx->ns_name != NULL ? rctx->ns_name : &fctx->domain
 		       : fctx->fwdname;
 	/*
@@ -7276,7 +7278,7 @@ check_section(void *arg, const dns_name_t *addname, dns_rdatatype_t type,
 	result = dns_message_findname(rctx->query->rmessage, section, addname,
 				      dns_rdatatype_any, 0, &name, NULL);
 	if (result == ISC_R_SUCCESS) {
 -		external = name_external(name, type, fctx);
 +		external = name_external(name, type, rctx);
 		if (type == dns_rdatatype_a) {
 			for (rdataset = ISC_LIST_HEAD(name->list);
 			     rdataset != NULL;
@@ -7888,6 +7890,47 @@ betterreferral(respctx_t *rctx) {
 	return (false);
 }
 +static bool
 +rctx_need_tcpretry(respctx_t *rctx) {
 +	resquery_t *query = rctx->query;
 +	if ((rctx->retryopts & DNS_FETCHOPT_TCP) != 0) {
 +		/* TCP is already in the retry flags */
 +		return false;
 +	}
 +
 +	/*
 +	 * If the message was secured, no need to continue.
 +	 */
 +	if (rctx->secured) {
 +		return false;
 +	}
 +
 +	/*
 +	 * Currently the only extra reason why we might need to
 +	 * retry a UDP response over TCP is a DNAME in the message.
 +	 */
 +	if (dns_message_hasdname(query->rmessage)) {
 +		return true;
 +	}
 +
 +	return false;
 +}
 +
 +static isc_result_t
 +rctx_tcpretry(respctx_t *rctx) {
 +	/*
 +	 * Do we need to retry a UDP response over TCP?
 +	 */
 +	if (rctx_need_tcpretry(rctx)) {
 +		rctx->retryopts |= DNS_FETCHOPT_TCP;
 +		rctx->resend = true;
 +		rctx_done(rctx, ISC_R_SUCCESS);
 +		return ISC_R_COMPLETE;
 +	}
 +
 +	return ISC_R_SUCCESS;
 +}
 +
 /*
  * resquery_response():
  * Handles responses received in response to iterative queries sent by
@@ -8046,6 +8089,11 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 		break;
 	}
 +	/*
 +	 * The dispatcher should ensure we only get responses with QR set.
 +	 */
 +	INSIST((query->rmessage->flags & DNS_MESSAGEFLAG_QR) != 0);
 +
 	/*
 	 * If the message is signed, check the signature.  If not, this
 	 * returns success anyway.
@@ -8063,9 +8111,16 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 	}
 	/*
 -	 * The dispatcher should ensure we only get responses with QR set.
 +	 * Remember whether this message was signed or had a
 +	 * valid client cookie; if not, we may need to retry over
 +	 * TCP later.
 	 */
 -	INSIST((query->rmessage->flags & DNS_MESSAGEFLAG_QR) != 0);
 +	if (query->rmessage->cc_ok || query->rmessage->tsig != NULL ||
 +	    query->rmessage->sig0 != NULL)
 +	{
 +		rctx.secured = true;
 +	}
 +
 	/*
 	 * INSIST() that the message comes from the place we sent it to,
 	 * since the dispatch code should ensure this.
@@ -8079,10 +8134,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 	 * This may be a misconfigured anycast server or an attempt to send
 	 * a spoofed response.  Skip if we have a valid tsig.
 	 */
 -	if (dns_message_gettsig(query->rmessage, NULL) == NULL &&
 -	    !query->rmessage->cc_ok && !query->rmessage->cc_bad &&
 -	    (rctx.retryopts & DNS_FETCHOPT_TCP) == 0)
 -	{
 +	if (!rctx.secured && (rctx.retryopts & DNS_FETCHOPT_TCP) == 0) {
 		unsigned char cookie[COOKIE_BUFFER_SIZE];
 		if (dns_adb_getcookie(fctx->adb, query->addrinfo, cookie,
 				      sizeof(cookie)) > CLIENT_COOKIE_SIZE)
@@ -8108,6 +8160,17 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 		 */
 	}
 +	/*
 +	 * Check whether we need to retry over TCP for some other reason.
 +	 */
 +	result = rctx_tcpretry(&rctx);
 +	if (result == ISC_R_COMPLETE) {
 +		return;
 +	}
 +
 +	/*
 +	 * Check for EDNS issues.
 +	 */
 	rctx_edns(&rctx);
 	/*
@@ -8836,8 +8899,8 @@ rctx_answer_positive(respctx_t *rctx) {
 	}
 	/*
 -	 * Cache records in the authority section, if
 -	 * there are any suitable for caching.
 +	 * Cache records in the authority section, if there are
 +	 * any suitable for caching.
 	 */
 	rctx_authority_positive(rctx);
@@ -8909,7 +8972,7 @@ rctx_answer_scan(respctx_t *rctx) {
 			/*
 			 * Don't accept DNAME from parent namespace.
 			 */
 -			if (name_external(name, dns_rdatatype_dname, fctx)) {
 +			if (name_external(name, dns_rdatatype_dname, rctx)) {
 				continue;
 			}
@@ -9208,14 +9271,14 @@ rctx_answer_dname(respctx_t *rctx) {
 /*
  * rctx_authority_positive():
 - * Examine the records in the authority section (if there are any) for a
 - * positive answer.  We expect the names for all rdatasets in this section
 - * to be subdomains of the domain being queried; any that are not are
 - * skipped.  We expect to find only *one* owner name; any names
 - * after the first one processed are ignored. We expect to find only
 - * rdatasets of type NS, RRSIG, or SIG; all others are ignored. Whatever
 - * remains can be cached at trust level authauthority or additional
 - * (depending on whether the AA bit was set on the answer).
 + * If a positive answer was received over TCP or secured with a cookie
 + * or TSIG, examine the authority section.  We expect names for all
 + * rdatasets in this section to be subdomains of the domain being queried;
 + * any that are not are skipped.  We expect to find only *one* owner name;
 + * any names after the first one processed are ignored. We expect to find
 + * only rdatasets of type NS; all others are ignored. Whatever remains can
 + * be cached at trust level authauthority or additional (depending on
 + * whether the AA bit was set on the answer).
  */
 static void
 rctx_authority_positive(respctx_t *rctx) {
@@ -9223,6 +9286,11 @@ rctx_authority_positive(respctx_t *rctx) {
 	bool done = false;
 	isc_result_t result;
 +	/* If it's spoofable, don't cache it. */
 +	if (!rctx->secured && (rctx->query->options & DNS_FETCHOPT_TCP) == 0) {
 +		return;
 +	}
 +
 	result = dns_message_firstname(rctx->query->rmessage,
 				       DNS_SECTION_AUTHORITY);
 	while (!done && result == ISC_R_SUCCESS) {
@@ -9231,7 +9299,9 @@ rctx_authority_positive(respctx_t *rctx) {
 		dns_message_currentname(rctx->query->rmessage,
 					DNS_SECTION_AUTHORITY, &name);
 -		if (!name_external(name, dns_rdatatype_ns, fctx)) {
 +		if (!name_external(name, dns_rdatatype_ns, rctx) &&
 +		    dns_name_issubdomain(&fctx->name, name))
 +		{
 			dns_rdataset_t *rdataset = NULL;
 			/*
 -- 
 2.53.0
--- a/SOURCES/bind-9.16-CVE-2025-40780.patch
+++ b/SOURCES/bind-9.16-CVE-2025-40780.patch
@ -0,0 +1,303 @@
 From 6254679e5250a9f0d6079ec082cffdad4315372d Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
 Date: Tue, 19 Aug 2025 19:22:18 +0200
 Subject: [PATCH] Use cryptographically-secure pseudo-random generator
 everywhere
 It was discovered in an upcoming academic paper that a xoshiro128**
 internal state can be recovered by an external 3rd party allowing to
 predict UDP ports and DNS IDs in the outgoing queries.  This could lead
 to an attacker spoofing the DNS answers with great efficiency and
 poisoning the DNS cache.
 Change the internal random generator to system CSPRNG with buffering to
 avoid excessive syscalls.
 Thanks Omer Ben Simhon and Amit Klein of Hebrew University of Jerusalem
 for responsibly reporting this to us.  Very cool research!
 (cherry picked from commit cffcab9d5f3e709002f331b72498fcc229786ae2)
 (cherry picked from commit d9b5ef342916462bfd63391831d96afc80c12df3)
 ---
 lib/isc/include/isc/os.h     |   5 +
 lib/isc/include/isc/random.h |   2 +-
 lib/isc/random.c             | 181 ++++++++++++++++++-----------------
 lib/isc/tests/random_test.c  |   4 +-
 4 files changed, 102 insertions(+), 90 deletions(-)
 diff --git a/lib/isc/include/isc/os.h b/lib/isc/include/isc/os.h
 index ce7615a0e3..5def473d2b 100644
 --- a/lib/isc/include/isc/os.h
 +++ b/lib/isc/include/isc/os.h
@@ -18,6 +18,11 @@
 ISC_LANG_BEGINDECLS
 +/*%<
 + * Hardcode the L1 cacheline size of the CPU to 64.
 + */
 +#define ISC_OS_CACHELINE_SIZE 64
 +
 unsigned int
 isc_os_ncpus(void);
 /*%<
 diff --git a/lib/isc/include/isc/random.h b/lib/isc/include/isc/random.h
 index 556e74754a..2c16472a5d 100644
 --- a/lib/isc/include/isc/random.h
 +++ b/lib/isc/include/isc/random.h
@@ -18,7 +18,7 @@
 #include <isc/types.h>
 /*! \file isc/random.h
 - * \brief Implements wrapper around a non-cryptographically secure
 + * \brief Implements wrapper around a cryptographically secure
  * pseudo-random number generator.
  *
  */
 diff --git a/lib/isc/random.c b/lib/isc/random.c
 index 753453ff3c..717e1f0dcd 100644
 --- a/lib/isc/random.c
 +++ b/lib/isc/random.c
@@ -29,131 +29,136 @@
  */
 #include <inttypes.h>
 -#include <stdlib.h>
 -#include <string.h>
 -#include <unistd.h>
 +#include <stdio.h>
 -#include <isc/once.h>
 +#include <isc/os.h>
 #include <isc/platform.h>
 #include <isc/random.h>
 -#include <isc/result.h>
 #include <isc/thread.h>
 -#include <isc/types.h>
 #include <isc/util.h>
 #include "entropy_private.h"
 -/*
 - * The specific implementation for PRNG is included as a C file
 - * that has to provide a static variable named seed, and a function
 - * uint32_t next(void) that provides next random number.
 - *
 - * The implementation must be thread-safe.
 - */
 -
 -/*
 - * Two contestants have been considered: the xoroshiro family of the
 - * functions by Villa&Blackman, and PCG by O'Neill.  After
 - * consideration, the xoshiro128starstar function has been chosen as
 - * the uint32_t random number provider because it is very fast and has
 - * good enough properties for our usage pattern.
 - */
 -#include "xoshiro128starstar.c"
 +#define ISC_RANDOM_BUFSIZE (ISC_OS_CACHELINE_SIZE / sizeof(uint32_t))
 -ISC_THREAD_LOCAL isc_once_t isc_random_once = ISC_ONCE_INIT;
 +ISC_THREAD_LOCAL uint32_t isc__random_pool[ISC_RANDOM_BUFSIZE];
 +ISC_THREAD_LOCAL size_t isc__random_pos = ISC_RANDOM_BUFSIZE;
 -static void
 -isc_random_initialize(void) {
 -	int useed[4] = { 0, 0, 0, 1 };
 +static uint32_t
 +random_u32(void) {
 #if FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
 	/*
 -	 * Set a constant seed to help in problem reproduction should fuzzing
 -	 * find a crash or a hang.  The seed array must be non-zero else
 -	 * xoshiro128starstar will generate an infinite series of zeroes.
 +	 * A fixed stream of numbers helps with problem reproduction when
 +	 * fuzzing.  The first result needs to be non-zero as expected by
 +	 * random_test.c (it starts with ISC_RANDOM_BUFSIZE, see above).
 	 */
 -#else  /* if FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION */
 -	isc_entropy_get(useed, sizeof(useed));
 +	return (uint32_t)(isc__random_pos++);
 #endif /* if FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION */
 -	memmove(seed, useed, sizeof(seed));
 +
 +	if (isc__random_pos == ISC_RANDOM_BUFSIZE) {
 +		isc_entropy_get(isc__random_pool, sizeof(isc__random_pool));
 +		isc__random_pos = 0;
 +	}
 +
 +	return isc__random_pool[isc__random_pos++];
 }
 uint8_t
 isc_random8(void) {
 -	RUNTIME_CHECK(isc_once_do(&isc_random_once, isc_random_initialize) ==
 -		      ISC_R_SUCCESS);
 -	return (next() & 0xff);
 +	return (uint8_t)random_u32();
 }
 uint16_t
 isc_random16(void) {
 -	RUNTIME_CHECK(isc_once_do(&isc_random_once, isc_random_initialize) ==
 -		      ISC_R_SUCCESS);
 -	return (next() & 0xffff);
 +	return (uint16_t)random_u32();
 }
 uint32_t
 isc_random32(void) {
 -	RUNTIME_CHECK(isc_once_do(&isc_random_once, isc_random_initialize) ==
 -		      ISC_R_SUCCESS);
 -	return (next());
 +	return random_u32();
 }
 void
 isc_random_buf(void *buf, size_t buflen) {
 -	int i;
 -	uint32_t r;
 +	REQUIRE(buflen == 0 || buf != NULL);
 -	REQUIRE(buf != NULL);
 -	REQUIRE(buflen > 0);
 -
 -	RUNTIME_CHECK(isc_once_do(&isc_random_once, isc_random_initialize) ==
 -		      ISC_R_SUCCESS);
 -
 -	for (i = 0; i + sizeof(r) <= buflen; i += sizeof(r)) {
 -		r = next();
 -		memmove((uint8_t *)buf + i, &r, sizeof(r));
 +	if (buf == NULL || buflen == 0) {
 +		return;
 	}
 -	r = next();
 -	memmove((uint8_t *)buf + i, &r, buflen % sizeof(r));
 -	return;
 +
 +	isc_entropy_get(buf, buflen);
 }
 uint32_t
 -isc_random_uniform(uint32_t upper_bound) {
 -	/* Copy of arc4random_uniform from OpenBSD */
 -	uint32_t r, min;
 -
 -	RUNTIME_CHECK(isc_once_do(&isc_random_once, isc_random_initialize) ==
 -		      ISC_R_SUCCESS);
 -
 -	if (upper_bound < 2) {
 -		return (0);
 -	}
 -
 -#if (ULONG_MAX > 0xffffffffUL)
 -	min = 0x100000000UL % upper_bound;
 -#else  /* if (ULONG_MAX > 0xffffffffUL) */
 -	/* Calculate (2**32 % upper_bound) avoiding 64-bit math */
 -	if (upper_bound > 0x80000000) {
 -		min = 1 + ~upper_bound; /* 2**32 - upper_bound */
 -	} else {
 -		/* (2**32 - (x * 2)) % x == 2**32 % x when x <= 2**31 */
 -		min = ((0xffffffff - (upper_bound * 2)) + 1) % upper_bound;
 -	}
 -#endif /* if (ULONG_MAX > 0xffffffffUL) */
 -
 +isc_random_uniform(uint32_t limit) {
 	/*
 -	 * This could theoretically loop forever but each retry has
 -	 * p > 0.5 (worst case, usually far better) of selecting a
 -	 * number inside the range we need, so it should rarely need
 -	 * to re-roll.
 +	 * Daniel Lemire's nearly-divisionless unbiased bounded random numbers.
 +	 *
 +	 * https://lemire.me/blog/?p=17551
 +	 *
 +	 * The raw random number generator `next()` returns a 32-bit value.
 +	 * We do a 64-bit multiply `next() * limit` and treat the product as a
 +	 * 32.32 fixed-point value less than the limit. Our result will be the
 +	 * integer part (upper 32 bits), and we will use the fraction part
 +	 * (lower 32 bits) to determine whether or not we need to resample.
 	 */
 -	for (;;) {
 -		r = next();
 -		if (r >= min) {
 -			break;
 +	uint64_t num = (uint64_t)random_u32() * (uint64_t)limit;
 +	/*
 +	 * In the fast path, we avoid doing a division in most cases by
 +	 * comparing the fraction part of `num` with the limit, which is
 +	 * a slight over-estimate for the exact resample threshold.
 +	 */
 +	if ((uint32_t)(num) < limit) {
 +		/*
 +		 * We are in the slow path where we re-do the approximate test
 +		 * more accurately. The exact threshold for the resample loop
 +		 * is the remainder after dividing the raw RNG limit `1 << 32`
 +		 * by the caller's limit. We use a trick to calculate it
 +		 * within 32 bits:
 +		 *
 +		 *     (1 << 32) % limit
 +		 * == ((1 << 32) - limit) % limit
 +		 * ==  (uint32_t)(-limit) % limit
 +		 *
 +		 * This division is safe: we know that `limit` is strictly
 +		 * greater than zero because of the slow-path test above.
 +		 */
 +		uint32_t residue = (uint32_t)(-limit) % limit;
 +		/*
 +		 * Unless we get one of `N = (1 << 32) - residue` valid
 +		 * values, we reject the sample. This `N` is a multiple of
 +		 * `limit`, so our results will be unbiased; and `N` is the
 +		 * largest multiple that fits in 32 bits, so rejections are as
 +		 * rare as possible.
 +		 *
 +		 * There are `limit` possible values for the integer part of
 +		 * our fixed-point number. Each one corresponds to `N/limit`
 +		 * or `N/limit + 1` possible fraction parts. For our result to
 +		 * be unbiased, every possible integer part must have the same
 +		 * number of possible valid fraction parts. So, when we get
 +		 * the superfluous value in the `N/limit + 1` cases, we need
 +		 * to reject and resample.
 +		 *
 +		 * Because of the multiplication, the possible values in the
 +		 * fraction part are equally spaced by `limit`, with varying
 +		 * gaps at each end of the fraction's 32-bit range. We will
 +		 * choose a range of size `N` (a multiple of `limit`) into
 +		 * which valid fraction values must fall, with the rest of the
 +		 * 32-bit range covered by the `residue`. Lemire's paper says
 +		 * that exactly `N/limit` possible values spaced apart by
 +		 * `limit` will fit into our size `N` valid range, regardless
 +		 * of the size of the end gaps, the phase alignment of the
 +		 * values, or the position of the range.
 +		 *
 +		 * So, when a fraction value falls in the `residue` outside
 +		 * our valid range, it is superfluous, and we resample.
 +		 */
 +		while ((uint32_t)(num) < residue) {
 +			num = (uint64_t)random_u32() * (uint64_t)limit;
 		}
 	}
 -
 -	return (r % upper_bound);
 +	/*
 +	 * Return the integer part (upper 32 bits).
 +	 */
 +	return (uint32_t)(num >> 32);
 }
 diff --git a/lib/isc/tests/random_test.c b/lib/isc/tests/random_test.c
 index 7161cd96a9..f47137d3ac 100644
 --- a/lib/isc/tests/random_test.c
 +++ b/lib/isc/tests/random_test.c
@@ -345,7 +345,9 @@ random_test(pvalue_func_t *func, isc_random_func test_func) {
 			}
 			break;
 		case ISC_RANDOM_BYTES:
 -			isc_random_buf(values, sizeof(values));
 +			for (i = 0; i < ARRAY_SIZE(values); i++) {
 +				values[i] = isc_random32();
 +			}
 			break;
 		case ISC_RANDOM_UNIFORM:
 			uniform_values = (uint16_t *)values;
 -- 
 2.51.1
--- a/SOURCES/bind-9.16-CVE-2026-1519.patch
+++ b/SOURCES/bind-9.16-CVE-2026-1519.patch
@ -1,4 +1,4 @@
-From 19b300cadcc265af7f6cdee16a32b5a5d9139b38 Mon Sep 17 00:00:00 2001
+From 16c75b53b9f76011ae64378046f66dc0c2ad7526 Mon Sep 17 00:00:00 2001
 From: Matthijs Mekking <matthijs@isc.org>
 Date: Tue, 3 Mar 2026 10:40:36 +0100
 Subject: [PATCH] Check iterations in isdelegation()
@ -9,7 +9,7 @@ by marking the answer with trust level "answer", indicating that they
 did not validate, but could be cached as insecure.
 (cherry picked from commit 988040a5e02f86f4a8cdb0704e8d501f9082a89c)
-(cherry picked from commit 0d8f3d0b22fb23c5a9138cc48e72ef8ab3d603df)
+(cherry picked from commit 0e636fb6c21a165b1bab67636d6f380f20e8b012)
 Don't verify already trusted rdatasets
@ -17,7 +17,7 @@ If we already marked an rdataset as secure (or it has even stronger
 trust), there is no need to cryptographically verify it again.
 (cherry picked from commit 0ec08c212022d08c9717f2bc6bd3e8ebd6f034ce)
-(cherry picked from commit e1d47d57e4cb496a8b64ea292467cd05a769d1e6)
+(cherry picked from commit e307735073b207a2e1635703511df55f6583d18e)
 Check RRset trust in validate_neg_rrset()
@ -27,30 +27,29 @@ before). This check was missing prior to validating negative response
 data.
 (cherry picked from commit 6ca67f65cd685cf8699540a852c1e3775bd48d64)
-(cherry picked from commit fe40620f47ce7cc10aca33b3d4f0a840f53f708d)
+(cherry picked from commit 5828874d13870bce651eb84fdfc95d581f66927c)
 ---
- lib/dns/include/dns/types.h |  2 +-
+ lib/dns/include/dns/types.h |  1 +
- lib/dns/validator.c         | 96 +++++++++++++++++++++++++++++++------
+ lib/dns/validator.c         | 89 ++++++++++++++++++++++++++++---------
- 2 files changed, 82 insertions(+), 16 deletions(-)
+ 2 files changed, 70 insertions(+), 20 deletions(-)
 diff --git a/lib/dns/include/dns/types.h b/lib/dns/include/dns/types.h
-index 934a641118..1b0f2b71a0 100644
+index 8781875651..8878ac7bd9 100644
 --- a/lib/dns/include/dns/types.h
 +++ b/lib/dns/include/dns/types.h
-@@ -357,7 +357,7 @@ enum {
+@@ -354,6 +354,7 @@ enum {
- 					 (x) == dns_trust_pending_additional)
+ 	((x) == dns_trust_additional || (x) == dns_trust_pending_additional)
 #define DNS_TRUST_GLUE(x)   ((x) == dns_trust_glue)
 #define DNS_TRUST_ANSWER(x) ((x) == dns_trust_answer)
 -
 +#define DNS_TRUST_SECURE(x) ((x) >= dns_trust_secure)
 /*%
  * Name checking severities.
 diff --git a/lib/dns/validator.c b/lib/dns/validator.c
-index 0b257fe874..5bc7bec951 100644
+index e416cc9b5c..d571539a7d 100644
 --- a/lib/dns/validator.c
 +++ b/lib/dns/validator.c
-@@ -262,12 +262,25 @@ dlv_algorithm_supported(dns_validator_t *val) {
+@@ -249,12 +249,25 @@ exit_check(dns_validator_t *val) {
 }
 /*%
@ -74,23 +73,23 @@ index 0b257fe874..5bc7bec951 100644
  */
 -static bool
 -isdelegation(dns_name_t *name, dns_rdataset_t *rdataset,
-	     isc_result_t dbresult)
+-	     isc_result_t dbresult) {
 +static isc_result_t
 +isdelegation(dns_validator_t *val, dns_name_t *name, dns_rdataset_t *rdataset,
-+	     isc_result_t dbresult, const char *caller)
+	     isc_result_t dbresult, const char *caller) {
 {
 	dns_fixedname_t fixed;
 	dns_label_t hashlabel;
-@@ -295,7 +308,7 @@ isdelegation(dns_name_t *name, dns_rdataset_t *rdataset,
+ 	dns_name_t nsec3name;
- 		if (result == ISC_R_NOTFOUND)
+@@ -282,7 +295,7 @@ isdelegation(dns_name_t *name, dns_rdataset_t *rdataset,
 			goto trynsec3;
- 		if (result != ISC_R_SUCCESS)
+ 		}
 		if (result != ISC_R_SUCCESS) {
 -			return (false);
 +			return (ISC_R_NOTFOUND);
 		}
 	}
- 	INSIST(set.type == dns_rdatatype_nsec);
+@@ -296,7 +309,7 @@ isdelegation(dns_name_t *name, dns_rdataset_t *rdataset,
@@ -308,7 +321,7 @@ isdelegation(dns_name_t *name, dns_rdataset_t *rdataset,
 		dns_rdata_reset(&rdata);
 	}
 	dns_rdataset_disassociate(&set);
@ -99,11 +98,10 @@ index 0b257fe874..5bc7bec951 100644
 trynsec3:
 	/*
-@@ -345,18 +358,33 @@ isdelegation(dns_name_t *name, dns_rdataset_t *rdataset,
+@@ -332,6 +345,18 @@ trynsec3:
- 			(void)dns_rdata_tostruct(&rdata, &nsec3, NULL);
+ 			if (nsec3.hash != 1) {
 			if (nsec3.hash != 1)
 				continue;
-+
+ 			}
 +			/*
 +			 * If there are too many iterations assume bad things
 +			 * are happening and bail out early. Treat as if the
@ -116,25 +114,19 @@ index 0b257fe874..5bc7bec951 100644
 +				dns_rdataset_disassociate(&set);
 +				return (ISC_R_SUCCESS);
 +			}
-+
+ 			length = isc_iterated_hash(
- 			length = isc_iterated_hash(hash, nsec3.hash,
+ 				hash, nsec3.hash, nsec3.iterations, nsec3.salt,
- 						   nsec3.iterations, nsec3.salt,
+ 				nsec3.salt_length, name->ndata, name->length);
- 						   nsec3.salt_length,
+@@ -343,7 +368,7 @@ trynsec3:
 						   name->ndata, name->length);
 			if (length != isc_buffer_usedlength(&buffer))
 				continue;
 +
 			order = memcmp(hash, owner, length);
 			if (order == 0) {
 				found = dns_nsec3_typepresent(&rdata,
 							      dns_rdatatype_ns);
 				dns_rdataset_disassociate(&set);
 -				return (found);
 +				return (found ? ISC_R_SUCCESS : ISC_R_NOTFOUND);
 			}
- 			if ((nsec3.flags & DNS_NSEC3FLAG_OPTOUT) == 0)
+ 			if ((nsec3.flags & DNS_NSEC3FLAG_OPTOUT) == 0) {
 				continue;
-@@ -370,12 +398,12 @@ isdelegation(dns_name_t *name, dns_rdataset_t *rdataset,
+@@ -359,12 +384,12 @@ trynsec3:
 			      memcmp(hash, nsec3.next, length) < 0)))
 			{
 				dns_rdataset_disassociate(&set);
@ -149,17 +141,20 @@ index 0b257fe874..5bc7bec951 100644
 }
 /*%
-@@ -597,7 +625,8 @@ dsfetched2(isc_task_t *task, isc_event_t *event) {
+@@ -576,8 +601,10 @@ fetch_callback_ds(isc_task_t *task, isc_event_t *event) {
- 		 */
+ 		} else if (eresult == DNS_R_SERVFAIL) {
- 		tname = dns_fixedname_name(&devent->foundname);
+ 			goto unexpected;
- 		if (eresult != DNS_R_CNAME &&
+ 		} else if (eresult != DNS_R_CNAME &&
-		    isdelegation(tname, &val->frdataset, eresult)) {
+-			   isdelegation(dns_fixedname_name(&devent->foundname),
-+		    isdelegation(val, tname, &val->frdataset, eresult,
+-					&val->frdataset, eresult))
-+				 "dsfetched2") == ISC_R_SUCCESS) {
+			   isdelegation(val,
- 			if (val->mustbesecure) {
+					dns_fixedname_name(&devent->foundname),
- 				validator_log(val, ISC_LOG_WARNING,
+					&val->frdataset, eresult,
- 					      "must be secure failure, no DS"
+					"fetch_callback_ds") == ISC_R_SUCCESS)
-@@ -754,10 +783,13 @@ dsvalidated(isc_task_t *task, isc_event_t *event) {
+ 		{
 			/*
 			 * Failed to find a DS while trying to prove
@@ -736,10 +763,13 @@ validator_callback_ds(isc_task_t *task, isc_event_t *event) {
 			      dns_trust_totext(val->frdataset.trust));
 		have_dsset = (val->frdataset.type == dns_rdatatype_ds);
 		name = dns_fixedname_name(&val->fname);
@ -167,14 +162,14 @@ index 0b257fe874..5bc7bec951 100644
 		if ((val->attributes & VALATTR_INSECURITY) != 0 &&
 		    val->frdataset.covers == dns_rdatatype_ds &&
 		    NEGATIVE(&val->frdataset) &&
-		    isdelegation(name, &val->frdataset, DNS_R_NCACHENXRRSET)) {
+-		    isdelegation(name, &val->frdataset, DNS_R_NCACHENXRRSET))
 +		    isdelegation(val, name, &val->frdataset,
 +				 DNS_R_NCACHENXRRSET,
-+				 "dsvalidated") == ISC_R_SUCCESS) {
+				 "validator_callback_ds") == ISC_R_SUCCESS)
- 			if (val->mustbesecure) {
+ 		{
- 				validator_log(val, ISC_LOG_WARNING,
+ 			result = markanswer(val, "validator_callback_ds",
- 					      "must be secure failure, no DS "
+ 					    "no DS and this is a delegation");
-@@ -1524,6 +1556,13 @@ verify(dns_validator_t *val, dst_key_t *key, dns_rdata_t *rdata,
+@@ -1433,6 +1463,13 @@ verify(dns_validator_t *val, dst_key_t *key, dns_rdata_t *rdata,
 	bool ignore = false;
 	dns_name_t *wild;
@ -188,74 +183,68 @@ index 0b257fe874..5bc7bec951 100644
 	val->attributes |= VALATTR_TRIEDVERIFY;
 	wild = dns_fixedname_initname(&fixed);
 again:
-@@ -2714,6 +2753,19 @@ validate_authority(dns_validator_t *val, bool resume) {
+@@ -2355,6 +2392,17 @@ validate_neg_rrset(dns_validator_t *val, dns_name_t *name,
 							dns_rdatatype_soa))
 					continue;
 		}
 +
 +			if (rdataset->type != dns_rdatatype_nsec &&
 +			    DNS_TRUST_SECURE(rdataset->trust))
 +			{
 +				/*
 +				 * The negative response data is already
 +				 * verified. We skip NSEC records, because
 +				 * they require special processing in
 +				 * authvalidated().
 +				 */
 +				continue;
 +			}
 +
 			val->currentset = rdataset;
 			result = create_validator(val, name, rdataset->type,
 						  rdataset, sigrdataset,
@@ -2791,6 +2843,18 @@ validate_ncache(dns_validator_t *val, bool resume) {
 						dns_rdatatype_soa))
 				continue;
 	}
-+
+ 
 +	if (rdataset->type != dns_rdatatype_nsec &&
 +	    DNS_TRUST_SECURE(rdataset->trust))
 +	{
 +		/*
 +		 * The negative response data is already verified.
 +		 * We skip NSEC records, because they require special
-+			 * processing in authvalidated().
+		 * processing in validator_callback_nsec().
 +		 */
-+			continue;
+		return DNS_R_CONTINUE;
 +	}
 +
 	val->currentset = rdataset;
- 		result = create_validator(val, name, rdataset->type,
+ 	result = create_validator(val, name, rdataset->type, rdataset,
- 					  rdataset, sigrdataset,
+ 				  sigrdataset, validator_callback_nsec,
-@@ -2842,7 +2906,8 @@ nsecvalidate(dns_validator_t *val, bool resume) {
+@@ -2464,11 +2512,9 @@ validate_ncache(dns_validator_t *val, bool resume) {
 		}
 		result = validate_neg_rrset(val, name, rdataset, sigrdataset);
 -		if (result == DNS_R_CONTINUE) {
 -			continue;
 +		if (result != DNS_R_CONTINUE) {
 +			return (result);
 		}
 -
 -		return (result);
 	}
 	if (result == ISC_R_NOMORE) {
 		result = ISC_R_SUCCESS;
@@ -2517,7 +2563,8 @@ validate_nx(dns_validator_t *val, bool resume) {
 			result = findnsec3proofs(val);
 			if (result == DNS_R_NSEC3ITERRANGE) {
 				validator_log(val, ISC_LOG_DEBUG(3),
 -					      "too many iterations");
 +					      "%s: too many iterations",
 +					      __func__);
- 				markanswer(val, "validate_nx (3)");
+ 				markanswer(val, "validate_nx (3)", NULL);
 				return (ISC_R_SUCCESS);
 			}
-@@ -2877,7 +2942,7 @@ nsecvalidate(dns_validator_t *val, bool resume) {
+@@ -2553,7 +2600,7 @@ validate_nx(dns_validator_t *val, bool resume) {
 		result = findnsec3proofs(val);
 		if (result == DNS_R_NSEC3ITERRANGE) {
 			validator_log(val, ISC_LOG_DEBUG(3),
 -				      "too many iterations");
 +				      "%s: too many iterations", __func__);
- 			markanswer(val, "validate_nx (4)");
+ 			markanswer(val, "validate_nx (4)", NULL);
 			return (ISC_R_SUCCESS);
 		}
-@@ -3463,7 +3528,8 @@ proveunsecure(dns_validator_t *val, bool have_ds, bool resume)
+@@ -2770,7 +2817,9 @@ seek_ds(dns_validator_t *val, isc_result_t *resp) {
- 				result = DNS_R_NOVALIDSIG;
+ 			return (ISC_R_COMPLETE);
 				goto out;
 		}
 -		if (isdelegation(tname, &val->frdataset, result)) {
-+			if (isdelegation(val, tname, &val->frdataset, result,
+		result = isdelegation(val, tname, &val->frdataset, result,
-+					 "proveunsecure") == ISC_R_SUCCESS) {
+				      "seek_ds");
- 				if (val->mustbesecure) {
+		if (result == ISC_R_SUCCESS) {
- 					validator_log(val, ISC_LOG_WARNING,
+ 			*resp = markanswer(val, "proveunsecure (4)",
- 						      "must be secure failure, "
+ 					   "this is a delegation");
 			return (ISC_R_COMPLETE);
 -- 
 2.53.0
--- a/SOURCES/bind-9.16-CVE-2026-3039.patch
+++ b/SOURCES/bind-9.16-CVE-2026-3039.patch
@ -1,4 +1,4 @@
-From 7c2afb490391a308733da1c37730328477bd80d3 Mon Sep 17 00:00:00 2001
+From c824f5e341094edc653f64e730a7471d31f9cc14 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
 Date: Wed, 18 Mar 2026 00:10:35 +0100
 Subject: [PATCH] Fix GSS-API context leak in TKEY negotiation
@ -19,7 +19,7 @@ completes in a single round, so rejecting continuation does not
 affect real-world deployments.  See RFC 3645 Section 4.1.3.
 (cherry picked from commit 3883058bf284de2889e4e3676767e58ad91a0ae3)
-(cherry picked from commit e3c74f19c6b3b29ec649062f95bf1df5688a0799)
+(cherry picked from commit 58c646c4b95efcda759cf194a534290eef38135e)
 Fix output token and GSS context leaks in TKEY/GSS-API error paths
@ -33,20 +33,20 @@ token, GSS context, and TSIG key are all freed consistently by the
 existing cleanup block.
 (cherry picked from commit f2240d2d06a1a68b622bd6b00a52c6fe4274426d)
-(cherry picked from commit f2f1c0cb244a6d9e2fd8550a38bd2465856abce3)
+(cherry picked from commit 7eef47ce676672f65b4988b1b5c086c4f30a9b70)
 ---
- lib/dns/gssapictx.c          | 127 ++++++++++++++++++++---------------
+ lib/dns/gssapictx.c          | 124 +++++++++++++++++++----------------
 lib/dns/include/dst/gssapi.h |  17 ++---
- lib/dns/tkey.c               |  50 +++++++-------
+ lib/dns/tkey.c               |  52 +++++++--------
- 3 files changed, 104 insertions(+), 90 deletions(-)
+ 3 files changed, 98 insertions(+), 95 deletions(-)
 diff --git a/lib/dns/gssapictx.c b/lib/dns/gssapictx.c
-index 482c25e1cc..a58c3071d4 100644
+index b0c62497a5..2a78169869 100644
 --- a/lib/dns/gssapictx.c
 +++ b/lib/dns/gssapictx.c
-@@ -594,7 +594,14 @@ dst_gssapi_initctx(dns_name_t *name, isc_buffer_t *intoken,
+@@ -606,7 +606,14 @@ dst_gssapi_initctx(const dns_name_t *name, isc_buffer_t *intoken,
- 				    0, NULL, gintokenp,
+ 		GSS_SPNEGO_MECHANISM, flags, 0, NULL, gintokenp, NULL,
- 				    NULL, &gouttoken, &ret_flags, NULL);
+ 		&gouttoken, &ret_flags, NULL);
 -	if (gret != GSS_S_COMPLETE && gret != GSS_S_CONTINUE_NEEDED) {
 +	switch (gret) {
@ -58,36 +58,31 @@ index 482c25e1cc..a58c3071d4 100644
 +		break;
 +	default:
 		gss_err_message(mctx, gret, minor, err_message);
- 		if (err_message != NULL && *err_message != NULL)
+ 		if (err_message != NULL && *err_message != NULL) {
 			gss_log(3, "Failure initiating security context: %s",
-@@ -619,14 +626,10 @@ dst_gssapi_initctx(dns_name_t *name, isc_buffer_t *intoken,
+@@ -632,12 +639,6 @@ dst_gssapi_initctx(const dns_name_t *name, isc_buffer_t *intoken,
 		RETERR(isc_buffer_copyregion(outtoken, &r));
 	}
-	if (gret == GSS_S_COMPLETE)
+-	if (gret == GSS_S_COMPLETE) {
 -		result = ISC_R_SUCCESS;
-	else
+-	} else {
 -		result = DNS_R_CONTINUE;
 -	}
 -
- out:
+ out:
-	if (gouttoken.length != 0U)
+ 	if (gouttoken.length != 0U) {
 +out:
 +	if (gouttoken.length != 0U) {
 		(void)gss_release_buffer(&minor, &gouttoken);
-+	}
+@@ -648,7 +649,7 @@ out:
- 	(void)gss_release_name(&minor, &gname);
+ 
 	return (result);
 }
@@ -634,7 +637,7 @@ dst_gssapi_initctx(dns_name_t *name, isc_buffer_t *intoken,
 isc_result_t
- dst_gssapi_acceptctx(gss_cred_id_t cred,
+ dst_gssapi_acceptctx(dns_gss_cred_id_t cred, const char *gssapi_keytab,
 		     const char *gssapi_keytab,
 -		     isc_region_t *intoken, isc_buffer_t **outtoken,
 +		     isc_region_t *intoken, isc_buffer_t **outtokenp,
- 		     gss_ctx_id_t *ctxout, dns_name_t *principal,
+ 		     dns_gss_ctx_id_t *ctxout, dns_name_t *principal,
 		     isc_mem_t *mctx) {
 	isc_region_t r;
-@@ -647,15 +650,11 @@ dst_gssapi_acceptctx(gss_cred_id_t cred,
+@@ -661,16 +662,11 @@ dst_gssapi_acceptctx(dns_gss_cred_id_t cred, const char *gssapi_keytab,
 	isc_result_t result;
 	char buf[1024];
@ -97,15 +92,16 @@ index 482c25e1cc..a58c3071d4 100644
 	REGION_TO_GBUFFER(*intoken, gintoken);
-	if (*ctxout == NULL)
+-	if (*ctxout == NULL) {
 -		context = GSS_C_NO_CONTEXT;
-	else
+-	} else {
 -		context = *ctxout;
 -	}
 -
 	if (gssapi_keytab != NULL) {
 #if defined(ISC_PLATFORM_GSSAPI_KRB5_HEADER) || defined(WIN32)
 		gret = gsskrb5_register_acceptor_identity(gssapi_keytab);
-@@ -697,8 +696,15 @@ dst_gssapi_acceptctx(gss_cred_id_t cred,
+@@ -715,8 +711,15 @@ dst_gssapi_acceptctx(dns_gss_cred_id_t cred, const char *gssapi_keytab,
 	switch (gret) {
 	case GSS_S_COMPLETE:
@ -122,7 +118,7 @@ index 482c25e1cc..a58c3071d4 100644
 	case GSS_S_DEFECTIVE_TOKEN:
 	case GSS_S_DEFECTIVE_CREDENTIAL:
 	case GSS_S_BAD_SIG:
-@@ -711,7 +717,7 @@ dst_gssapi_acceptctx(gss_cred_id_t cred,
+@@ -729,7 +732,7 @@ dst_gssapi_acceptctx(dns_gss_cred_id_t cred, const char *gssapi_keytab,
 	case GSS_S_BAD_MECH:
 	case GSS_S_FAILURE:
 		result = DNS_R_INVALIDTKEY;
@ -131,13 +127,13 @@ index 482c25e1cc..a58c3071d4 100644
 	default:
 		gss_log(3, "failed gss_accept_sec_context: %s",
 			gss_error_tostring(gret, minor, buf, sizeof(buf)));
-@@ -722,55 +728,70 @@ dst_gssapi_acceptctx(gss_cred_id_t cred,
+@@ -740,59 +743,70 @@ dst_gssapi_acceptctx(dns_gss_cred_id_t cred, const char *gssapi_keytab,
 	}
 	if (gouttoken.length > 0U) {
-		RETERR(isc_buffer_allocate(mctx, outtoken,
+-		isc_buffer_allocate(mctx, outtoken,
-+		RETERR(isc_buffer_allocate(mctx, outtokenp,
+		isc_buffer_allocate(mctx, outtokenp,
- 					   (unsigned int)gouttoken.length));
+ 				    (unsigned int)gouttoken.length);
 		GBUFFER_TO_REGION(gouttoken, r);
 -		RETERR(isc_buffer_copyregion(*outtoken, &r));
 +		result = isc_buffer_copyregion(*outtokenp, &r);
@ -151,8 +147,8 @@ index 482c25e1cc..a58c3071d4 100644
 -		gret = gss_display_name(&minor, gname, &gnamebuf, NULL);
 -		if (gret != GSS_S_COMPLETE) {
 -			gss_log(3, "failed gss_display_name: %s",
-				gss_error_tostring(gret, minor,
+-				gss_error_tostring(gret, minor, buf,
-						   buf, sizeof(buf)));
+-						   sizeof(buf)));
 -			RETERR(ISC_R_FAILURE);
 -		}
 +	INSIST(gret == GSS_S_COMPLETE);
@ -165,7 +161,9 @@ index 482c25e1cc..a58c3071d4 100644
 -		 */
 -		if (gnamebuf.length > 0U &&
 -		    ((char *)gnamebuf.value)[gnamebuf.length - 1] == '\0')
 -		{
 -			gnamebuf.length--;
 -		}
 +	gret = gss_display_name(&minor, gname, &gnamebuf, NULL);
 +	if (gret != GSS_S_COMPLETE) {
 +		gss_log(3, "failed gss_display_name: %s",
@ -194,30 +192,30 @@ index 482c25e1cc..a58c3071d4 100644
 +	gss_log(3, "gss-api source name (accept) is %.*s", (int)gnamebuf.length,
 +		(char *)gnamebuf.value);
-		RETERR(dns_name_fromtext(principal, &namebuf, dns_rootname,
+-		RETERR(dns_name_fromtext(principal, &namebuf, dns_rootname, 0,
-					 0, NULL));
+-					 NULL));
 +	GBUFFER_TO_REGION(gnamebuf, r);
 +	isc_buffer_init(&namebuf, r.base, r.length);
 +	isc_buffer_add(&namebuf, r.length);
 -		if (gnamebuf.length != 0U) {
 -			gret = gss_release_buffer(&minor, &gnamebuf);
-			if (gret != GSS_S_COMPLETE)
+-			if (gret != GSS_S_COMPLETE) {
 -				gss_log(3, "failed gss_release_buffer: %s",
 -					gss_error_tostring(gret, minor, buf,
 -							   sizeof(buf)));
 -			}
-	} else
+-		}
 -	} else {
 -		result = DNS_R_CONTINUE;
 +	result = dns_name_fromtext(principal, &namebuf, dns_rootname, 0, NULL);
 +	if (result != ISC_R_SUCCESS) {
 +		goto out;
-+	}
+ 	}
 	*ctxout = context;
- out:
+ out:
 +out:
 +	if (result != ISC_R_SUCCESS && *outtokenp != NULL) {
 +		isc_buffer_free(outtokenp);
 +	}
@ -237,17 +235,17 @@ index 482c25e1cc..a58c3071d4 100644
 +
 	if (gname != NULL) {
 		gret = gss_release_name(&minor, &gname);
- 		if (gret != GSS_S_COMPLETE)
+ 		if (gret != GSS_S_COMPLETE) {
 diff --git a/lib/dns/include/dst/gssapi.h b/lib/dns/include/dst/gssapi.h
-index 8e31587871..bf1c4c959a 100644
+index 10f8467aef..92dad43440 100644
 --- a/lib/dns/include/dst/gssapi.h
 +++ b/lib/dns/include/dst/gssapi.h
-@@ -126,20 +126,17 @@ dst_gssapi_acceptctx(gss_cred_id_t cred,
+@@ -113,20 +113,17 @@ dst_gssapi_acceptctx(dns_gss_cred_id_t cred, const char *gssapi_keytab,
  *		   generated by gss_accept_sec_context() to be sent to the
  *		   initiator
  *      'context'  is a valid pointer to receive the generated context handle.
 - *                 On the initial call, it should be a pointer to NULL, which
- *		   will be allocated as a gss_ctx_id_t.  Subsequent calls
+- *		   will be allocated as a dns_gss_ctx_id_t.  Subsequent calls
 - *		   should pass in the handle generated on the first call.
 - *		   Call dst_gssapi_releasecred to delete the context and free
 - *		   the memory.
@ -271,10 +269,10 @@ index 8e31587871..bf1c4c959a 100644
 isc_result_t
 diff --git a/lib/dns/tkey.c b/lib/dns/tkey.c
-index ae7a76cd3d..03bf521ee6 100644
+index b4f12a0831..e7800113d9 100644
 --- a/lib/dns/tkey.c
 +++ b/lib/dns/tkey.c
-@@ -503,18 +503,9 @@ process_gsstkey(dns_message_t *msg, dns_name_t *name, dns_rdata_tkey_t *tkeyin,
+@@ -529,19 +529,9 @@ process_gsstkey(dns_message_t *msg, dns_name_t *name, dns_rdata_tkey_t *tkeyin,
 		return (ISC_R_SUCCESS);
 	}
@ -287,29 +285,32 @@ index ae7a76cd3d..03bf521ee6 100644
 	intoken.length = tkeyin->keylen;
 -	result = dns_tsigkey_find(&tsigkey, name, &tkeyin->algorithm, ring);
-	if (result == ISC_R_SUCCESS)
+-	if (result == ISC_R_SUCCESS) {
 -		gss_ctx = dst_key_getgssctx(tsigkey->key);
 -	}
 -
 	principal = dns_fixedname_initname(&fixed);
 	/*
-@@ -523,25 +514,27 @@ process_gsstkey(dns_message_t *msg, dns_name_t *name, dns_rdata_tkey_t *tkeyin,
+@@ -550,28 +540,27 @@ process_gsstkey(dns_message_t *msg, dns_name_t *name, dns_rdata_tkey_t *tkeyin,
 	result = dst_gssapi_acceptctx(tctx->gsscred, tctx->gssapi_keytab,
- 				      &intoken, &outtoken, &gss_ctx,
+ 				      &intoken, &outtoken, &gss_ctx, principal,
- 				      principal, tctx->mctx);
+ 				      tctx->mctx);
 -	if (result == DNS_R_INVALIDTKEY) {
-		if (tsigkey != NULL)
+-		if (tsigkey != NULL) {
 -			dns_tsigkey_detach(&tsigkey);
 -		}
 +	if (result != ISC_R_SUCCESS) {
 		tkeyout->error = dns_tsigerror_badkey;
-		tkey_log("process_gsstkey(): dns_tsigerror_badkey");    /* XXXSRA */
+-		tkey_log("process_gsstkey(): dns_tsigerror_badkey"); /* XXXSRA
 -								      */
 -		return (ISC_R_SUCCESS);
 -	}
-	if (result != DNS_R_CONTINUE && result != ISC_R_SUCCESS)
+-	if (result != DNS_R_CONTINUE && result != ISC_R_SUCCESS) {
 +		tkey_log("process_gsstkey(): dns_tsigerror_badkey");
 +		result = ISC_R_SUCCESS;
 		goto failure;
-+	}
+ 	}
 +
 	/*
 -	 * XXXDCL Section 4.1.3: Limit GSS_S_CONTINUE_NEEDED to 10 times.
@ -332,7 +333,7 @@ index ae7a76cd3d..03bf521ee6 100644
 	} else if (tsigkey == NULL) {
 #ifdef GSSAPI
 		OM_uint32 gret, minor, lifetime;
-@@ -612,6 +605,10 @@ process_gsstkey(dns_message_t *msg, dns_name_t *name, dns_rdata_tkey_t *tkeyin,
+@@ -634,6 +623,10 @@ process_gsstkey(dns_message_t *msg, dns_name_t *name, dns_rdata_tkey_t *tkeyin,
 	return (ISC_R_SUCCESS);
 failure:
@ -340,15 +341,15 @@ index ae7a76cd3d..03bf521ee6 100644
 +		dst_gssapi_deletectx(tctx->mctx, &gss_ctx);
 +	}
 +
- 	if (tsigkey != NULL)
+ 	if (tsigkey != NULL) {
 		dns_tsigkey_detach(&tsigkey);
- 
+ 	}
-@@ -621,10 +618,10 @@ failure:
+@@ -646,10 +639,10 @@ failure:
 	if (outtoken != NULL)
 		isc_buffer_free(&outtoken);
 	}
-	tkey_log("process_gsstkey(): %s",
+-	tkey_log("process_gsstkey(): %s", isc_result_totext(result)); /* XXXSRA
-		isc_result_totext(result));	/* XXXSRA */
+-								       */
 -
 -	return (result);
 +	if (result != ISC_R_SUCCESS) {
@ -358,8 +359,8 @@ index ae7a76cd3d..03bf521ee6 100644
 }
 static isc_result_t
-@@ -1521,9 +1518,8 @@ dns_tkey_gssnegotiate(dns_message_t *qmsg, dns_message_t *rmsg,
+@@ -1558,9 +1551,8 @@ dns_tkey_gssnegotiate(dns_message_t *qmsg, dns_message_t *rmsg,
- 				  &dstkey, NULL));
+ 				  NULL));
 	/*
 -	 * XXXSRA This seems confused.  If we got CONTINUE from initctx,
@ -369,7 +370,7 @@ index ae7a76cd3d..03bf521ee6 100644
 +	 * Create the TSIG key from the established context.
 	 */
- 	RETERR(dns_tsigkey_createfromkey(tkeyname,
+ 	RETERR(dns_tsigkey_createfromkey(
 -- 
 2.54.0
--- a/SOURCES/bind-9.16-CVE-2026-5946.patch
+++ b/SOURCES/bind-9.16-CVE-2026-5946.patch
@ -0,0 +1,719 @@
 From fdadded4959eec655fded3ddfeacec47d2250274 Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Tue, 3 Mar 2026 14:00:38 -0800
 Subject: [PATCH] Disable recursion for non-IN classes
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Force recursion off, and set allow-recursion/allow-recursion-on ACLs
 to none, for views with a class other than IN. Log a configuration
 warning if recursion is explicitly enabled for a non-IN view.
 This addresses YWH-PGM40640-74 and YWH-PGM40640-75 by preventing any
 attempt at recursive processing in a class-CHAOS view, ensuring that
 server addresses used for recursive queries and received in recursive
 responses are of the expected format.
 Fixes: isc-projects/bind9#5780
 Fixes: isc-projects/bind9#5781
 (cherry picked from commit 70532a37a1aec761e8a12444852866ce9d9d5fcc)
 (cherry picked from commit cf0d5a4e385525e21f2ae39098b1ab90c1137a2a)
 (cherry picked from commit e577560f65dbc6109fca8a597d16568a1cd8987c)
 Disable UPDATE and NOTIFY for non-IN classes
 Return NOTIMP for UPDATE and NOTIFY requests received for views with a
 class other than IN.  Only QUERY is now supported for non-IN views such
 as CHAOS.
 When running dns dns_rdata_tostruct() with types that are only defined
 for class IN, ensure that the class is correct before proceeding.
 Add an assertion that any zone being updated is of class IN. (Note
 that previously, a DLZ zone could have its class value set incorrectly
 to NONE; this has been fixed.)
 This addresses YWH-PGM40640-70 and YWH-PGM40640-73 (as well as any
 similar problems that might have occurred in the future) by minimizing
 the code paths that can be reached by rdata classes other than IN, so it
 is safe for the implementation to assume that rdatatypes that are only
 defined for class IN, such as SVCB or WKS, have been parsed and
 validated, and not accepted as unknown/opaque data.
 Fixes: isc-projects/bind9#5777
 Fixes: isc-projects/bind9#5779
 (cherry picked from commit 9ae24c32bec16c0f64225ef04f34670018bf0765)
 (cherry picked from commit a2ca2408b3ff031c426c5dc785f550c9d30bf4aa)
 (cherry picked from commit bec30ad70d17e36241df9da259bb2ac85b3c3435)
 Validate DNS message CLASS early in request processing
 Reject requests with unsupported or misused CLASS values before
 further processing.  Only IN, CH, HS, RESERVED0 (for DNS Cookies),
 ANY (for TKEY negotiation), and NONE (for DNS UPDATE) are accepted;
 all other classes return NOTIMP.  Misuse of NONE or ANY outside
 their allowed contexts returns FORMERR.
 This adds further protection against bugs of the same general class
 as YWH-PGM40640-70 and YWH-PGM40640-73.
 (cherry picked from commit d41865a458b9ecd76be4097ac1bea1005cad72db)
 (cherry picked from commit 1c8016c91c3674929f87cbe7ad09f3670e05ad4e)
 (cherry picked from commit 986533b5ae8e855e23430bd7f6af7552d82e0ece)
 Reject meta-classes in UPDATE and NOTIFY messages
 NOTIFY and UPDATE messages must specify a data class in the
 QUESTION/ZONE section.  NONE and ANY are meta-classes and not
 appropriate here.  Return FORMERR if either is used.
 Rejecting messages with a query class of NONE addresses YWH-PGM40640-72,
 YWH-PGM40640-82, and YWH-PGM40640-83.  Rejecting messages with a query
 class of ANY addresses YWH-PGM40640-87, YWH-PGM40640-88, and
 YWH-PGM40640-117.
 Fixes: isc-projects/bind9#5778
 Fixes: isc-projects/bind9#5782
 Fixes: isc-projects/bind9#5783
 Fixes: isc-projects/bind9#5797
 Fixes: isc-projects/bind9#5798
 Fixes: isc-projects/bind9#5853
 (cherry picked from commit 7de5160517ae69196d1c323b8627b267cdd10761)
 (cherry picked from commit 3c44de9e6252ec1c7742ef02ecc0d6cbf1cde5e9)
 (cherry picked from commit e7468f6be6dc98f86508627f4f333b6d09d2ac31)
 Skip "deny-answer-address" for non-IN addresses
 Ensure that we don't attempt an ACL match for answer addresses
 when handling a class-CHAOS zone. This is an additional line of
 defense for YWH-PGM40640-74.
 (cherry picked from commit 4cd3d8e6d866143ddc62df821a1007bf3ee7f083)
 (cherry picked from commit fa60101e910346e64fa2a684b903fbcb84d8243b)
 (cherry picked from commit e60ee54f7d650783d3b6dd7fdd749c64c6593353)
 Pass empty string instead of NULL to ns_client_dumpmessage()
 The two new call sites added by the CLASS-validation work passed NULL
 as the reason, but ns_client_dumpmessage() bails out early on a NULL
 reason — so the message dump never happened. The intent was to dump
 the message and let the follow-up ns_client_log() carry the reason
 text, so pass "" to suppress the prefix without short-circuiting the
 dump.
 (cherry picked from commit 8af39c360407a92ef31bf233b9df760d1bb9fb5f)
 (cherry picked from commit cd3a72e414d35c2ae573f4faea1148a95db7d5ff)
 %RH
 fixed resolver, checkconf test
 ---
 bin/named/server.c                            | 42 ++++--------
 bin/tests/system/checkconf/tests.sh           | 14 +++-
 .../checkconf/warn-chaos-recursion.conf       | 25 ++++++++
 bin/tests/system/resolver/tests.sh            |  8 ++-
 bin/tests/system/unknown/tests.sh             | 12 ++--
 lib/bind9/check.c                             | 22 ++++++-
 lib/dns/adb.c                                 |  3 +-
 lib/dns/message.c                             | 11 ++++
 lib/dns/resolver.c                            | 13 +++-
 lib/ns/client.c                               | 64 ++++++++++++++++---
 lib/ns/update.c                               | 38 +++++------
 11 files changed, 177 insertions(+), 75 deletions(-)
 create mode 100644 bin/tests/system/checkconf/warn-chaos-recursion.conf
 diff --git a/bin/named/server.c b/bin/named/server.c
 index 098e21d0ac..9e33dc6349 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
@@ -1932,10 +1932,12 @@ dlzconfigure_callback(dns_view_t *view, dns_dlzdb_t *dlzdb, dns_zone_t *zone) {
 	dns_rdataclass_t zclass = view->rdclass;
 	isc_result_t result;
 +	dns_zone_setclass(zone, zclass);
 	result = dns_zonemgr_managezone(named_g_server->zonemgr, zone);
 	if (result != ISC_R_SUCCESS) {
 		return (result);
 	}
 +
 	dns_zone_setstats(zone, named_g_server->zonestats);
 	return (named_zone_configure_writeable_dlz(dlzdb, zone, zclass,
@@ -4215,6 +4217,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	obj = NULL;
 	result = named_config_get(maps, "max-cache-size", &obj);
 	INSIST(result == ISC_R_SUCCESS);
 +
 	/*
 	 * If "-T maxcachesize=..." is in effect, it overrides any other
 	 * "max-cache-size" setting found in configuration, either implicit or
@@ -4965,34 +4968,15 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	}
 	/*
 -	 * We have default hints for class IN if we need them.
 +	 * We have default root hints for class IN if we need them.
 +	 * Each view gets its own rootdb so a priming response only
 +	 * writes into that view's copy.  Other classes don't support
 +	 * recursion and don't need hints.
 	 */
 	if (view->rdclass == dns_rdataclass_in && view->hints == NULL) {
 		dns_view_sethints(view, named_g_server->in_roothints);
 	}
 -	/*
 -	 * If we still have no hints, this is a non-IN view with no
 -	 * "hints zone" configured.  Issue a warning, except if this
 -	 * is a root server.  Root servers never need to consult
 -	 * their hints, so it's no point requiring users to configure
 -	 * them.
 -	 */
 -	if (view->hints == NULL) {
 -		dns_zone_t *rootzone = NULL;
 -		(void)dns_view_findzone(view, dns_rootname, &rootzone);
 -		if (rootzone != NULL) {
 -			dns_zone_detach(&rootzone);
 -			need_hints = false;
 -		}
 -		if (need_hints) {
 -			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 -				      NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
 -				      "no root hints for view '%s'",
 -				      view->name);
 -		}
 -	}
 -
 	/*
 	 * Configure the view's TSIG keys.
 	 */
@@ -5102,7 +5086,8 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	obj = NULL;
 	result = named_config_get(maps, "recursion", &obj);
 	INSIST(result == ISC_R_SUCCESS);
 -	view->recursion = cfg_obj_asboolean(obj);
 +	view->recursion = (view->rdclass == dns_rdataclass_in &&
 +			   cfg_obj_asboolean(obj));
 	obj = NULL;
 	result = named_config_get(maps, "qname-minimization", &obj);
@@ -5201,14 +5186,13 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	CHECK(configure_view_acl(vconfig, config, NULL, "allow-query-cache-on",
 				 NULL, actx, named_g_mctx, &view->cacheonacl));
 -	if (strcmp(view->name, "_bind") != 0 &&
 -	    view->rdclass != dns_rdataclass_chaos)
 -	{
 -		/* named.conf only */
 +	if (view->rdclass != dns_rdataclass_in) {
 +		dns_acl_none(named_g_mctx, &view->recursionacl);
 +		dns_acl_none(named_g_mctx, &view->recursiononacl);
 +	} else {
 		CHECK(configure_view_acl(vconfig, config, NULL,
 					 "allow-recursion", NULL, actx,
 					 named_g_mctx, &view->recursionacl));
 -		/* named.conf only */
 		CHECK(configure_view_acl(vconfig, config, NULL,
 					 "allow-recursion-on", NULL, actx,
 					 named_g_mctx, &view->recursiononacl));
 diff --git a/bin/tests/system/checkconf/tests.sh b/bin/tests/system/checkconf/tests.sh
 index c8f883e38d..34d2aebf24 100644
 --- a/bin/tests/system/checkconf/tests.sh
 +++ b/bin/tests/system/checkconf/tests.sh
@@ -481,7 +481,8 @@ $CHECKCONF -l good.conf \
   | grep -v "is not implemented" \
   | grep -v "is not recommended" \
   | grep -v "no longer exists" \
 -  | grep -v "is obsolete" >checkconf.out$n || ret=1
 +  | grep -v "is obsolete" \
 +  | grep -v "recursion will be disabled" >checkconf.out$n || ret=1
 diff good.zonelist checkconf.out$n >diff.out$n || ret=1
 if [ $ret -ne 0 ]; then
   echo_i "failed"
@@ -763,5 +764,16 @@ status=$(expr $status + $ret)
 rmdir keys
 +n=$((n + 1))
 +echo_i "check 'recursion yes;' is warned and disabled in a non-IN view ($n)"
 +ret=0
 +$CHECKCONF warn-chaos-recursion.conf >checkconf.out$n 2>&1 || ret=1
 +grep -F "recursion will be disabled" checkconf.out$n >/dev/null || ret=1
 +if [ $ret != 0 ]; then
 +  echo_i "failed"
 +  ret=1
 +fi
 +status=$((status + ret))
 +
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
 diff --git a/bin/tests/system/checkconf/warn-chaos-recursion.conf b/bin/tests/system/checkconf/warn-chaos-recursion.conf
 new file mode 100644
 index 0000000000..e384533c0a
 --- /dev/null
 +++ b/bin/tests/system/checkconf/warn-chaos-recursion.conf
@@ -0,0 +1,25 @@
 +/*
 + * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 + *
 + * SPDX-License-Identifier: MPL-2.0
 + *
 + * This Source Code Form is subject to the terms of the Mozilla Public
 + * License, v. 2.0.  If a copy of the MPL was not distributed with this
 + * file, you can obtain one at https://mozilla.org/MPL/2.0/.
 + *
 + * See the COPYRIGHT file distributed with this work for additional
 + * information regarding copyright ownership.
 + */
 +
 +options {
 +	directory ".";
 +};
 +
 +view chaos ch {
 +        match-clients { any; };
 +        recursion yes;
 +        zone "." {
 +                type hint;
 +                file "chaos.hints";
 +        };
 +};
 diff --git a/bin/tests/system/resolver/tests.sh b/bin/tests/system/resolver/tests.sh
 index fc05635e31..6e1fdaddfa 100755
 --- a/bin/tests/system/resolver/tests.sh
 +++ b/bin/tests/system/resolver/tests.sh
@@ -897,10 +897,12 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
 n=$((n + 1))
 -echo_i "checking NXDOMAIN is returned when querying non existing domain in CH class ($n)"
 +echo_i "checking REFUSED is returned when querying non existing domain in CH class ($n)"
 ret=0
 -dig_with_opts @10.53.0.1 id.hostname txt ch >dig.ns1.out.${n} || ret=1
 -grep "status: NXDOMAIN" dig.ns1.out.${n} >/dev/null || ret=1
 +dig_with_opts @10.53.0.1 hostname.chaostest txt ch >dig.ns1.out.1.${n} || ret=1
 +grep "status: NOERROR" dig.ns1.out.1.${n} >/dev/null || ret=1
 +dig_with_opts @10.53.0.1 id.hostname txt ch >dig.ns1.out.2.${n} || ret=1
 +grep "status: REFUSED" dig.ns1.out.2.${n} >/dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
 diff --git a/bin/tests/system/unknown/tests.sh b/bin/tests/system/unknown/tests.sh
 index b14548a039..092ae2d308 100644
 --- a/bin/tests/system/unknown/tests.sh
 +++ b/bin/tests/system/unknown/tests.sh
@@ -75,8 +75,8 @@ n=$((n + 1))
 echo_i "querying for various representations of a CLASS10 TYPE1 record ($n)"
 for i in 1 2; do
   ret=0
 -  $DIG +short $DIGOPTS @10.53.0.1 a$i.example a class10 >dig.out.$i.test$n || ret=1
 -  echo '\# 4 0A000001' | $DIFF - dig.out.$i.test$n || ret=1
 +  $DIG $DIGOPTS @10.53.0.1 a$i.example a class10 >dig.out.$i.test$n || ret=1
 +  grep -q "NOTIMP" dig.out.$i.test$n || ret=1
   if [ $ret != 0 ]; then
     echo_i "#$i failed"
   fi
@@ -87,8 +87,8 @@ n=$((n + 1))
 echo_i "querying for various representations of a CLASS10 TXT record ($n)"
 for i in 1 2 3 4; do
   ret=0
 -  $DIG +short $DIGOPTS @10.53.0.1 txt$i.example txt class10 >dig.out.$i.test$n || ret=1
 -  echo '"hello"' | $DIFF - dig.out.$i.test$n || ret=1
 +  $DIG $DIGOPTS @10.53.0.1 txt$i.example txt class10 >dig.out.$i.test$n || ret=1
 +  grep -q "NOTIMP" dig.out.$i.test$n || ret=1
   if [ $ret != 0 ]; then
     echo_i "#$i failed"
   fi
@@ -99,8 +99,8 @@ n=$((n + 1))
 echo_i "querying for various representations of a CLASS10 TYPE123 record ($n)"
 for i in 1 2; do
   ret=0
 -  $DIG +short $DIGOPTS @10.53.0.1 unk$i.example type123 class10 >dig.out.$i.test$n || ret=1
 -  echo '\# 1 00' | $DIFF - dig.out.$i.test$n || ret=1
 +  $DIG $DIGOPTS @10.53.0.1 unk$i.example type123 class10 >dig.out.$i.test$n || ret=1
 +  grep -q "NOTIMP" dig.out.$i.test$n || ret=1
   if [ $ret != 0 ]; then
     echo_i "#$i failed"
   fi
 diff --git a/lib/bind9/check.c b/lib/bind9/check.c
 index ee64543ab8..9935b8a8f3 100644
 --- a/lib/bind9/check.c
 +++ b/lib/bind9/check.c
@@ -2292,13 +2292,17 @@ check_mirror_zone_notify(const cfg_obj_t *zoptions, const char *znamestr,
  */
 static bool
 check_recursion(const cfg_obj_t *config, const cfg_obj_t *voptions,
 -		const cfg_obj_t *goptions, isc_log_t *logctx,
 -		cfg_aclconfctx_t *actx, isc_mem_t *mctx) {
 +		dns_rdataclass_t vclass, const cfg_obj_t *goptions,
 +		isc_log_t *logctx, cfg_aclconfctx_t *actx, isc_mem_t *mctx) {
 	dns_acl_t *acl = NULL;
 	const cfg_obj_t *obj;
 	isc_result_t result;
 	bool retval = true;
 +	if (vclass != dns_rdataclass_in) {
 +		return false;
 +	}
 +
 	/*
 	 * Check the "recursion" option first.
 	 */
@@ -2878,7 +2882,8 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 	 * contradicts the purpose of the former.
 	 */
 	if (ztype == CFG_ZONE_MIRROR &&
 -	    !check_recursion(config, voptions, goptions, logctx, actx, mctx))
 +	    !check_recursion(config, voptions, zclass, goptions, logctx, actx,
 +			     mctx))
 	{
 		cfg_obj_log(zoptions, logctx, ISC_LOG_ERROR,
 			    "zone '%s': mirror zones cannot be used if "
@@ -4631,6 +4636,17 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *voptions,
 	cfg_aclconfctx_create(mctx, &actx);
 +	if (vclass != dns_rdataclass_in) {
 +		if (check_recursion(config, voptions, dns_rdataclass_in,
 +				    options, logctx, actx, mctx))
 +		{
 +			cfg_obj_log(opts, logctx, ISC_LOG_WARNING,
 +				    "recursion will be disabled for "
 +				    "non-IN view '%s'",
 +				    viewname);
 +		}
 +	}
 +
 	if (voptions != NULL) {
 		(void)cfg_map_get(voptions, "zone", &zones);
 	} else {
 diff --git a/lib/dns/adb.c b/lib/dns/adb.c
 index 6f98feca45..a97239570b 100644
 --- a/lib/dns/adb.c
 +++ b/lib/dns/adb.c
@@ -926,7 +926,8 @@ import_rdataset(dns_adbname_t *adbname, dns_rdataset_t *rdataset,
 	INSIST(DNS_ADB_VALID(adb));
 	rdtype = rdataset->type;
 -	INSIST((rdtype == dns_rdatatype_a) || (rdtype == dns_rdatatype_aaaa));
 +	REQUIRE(rdtype == dns_rdatatype_a || rdtype == dns_rdatatype_aaaa);
 +
 	if (rdtype == dns_rdatatype_a) {
 		findoptions = DNS_ADBFIND_INET;
 	} else {
 diff --git a/lib/dns/message.c b/lib/dns/message.c
 index 22aa552f3f..ba374c4336 100644
 --- a/lib/dns/message.c
 +++ b/lib/dns/message.c
@@ -1087,6 +1087,17 @@ getquestions(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
 		rdtype = isc_buffer_getuint16(source);
 		rdclass = isc_buffer_getuint16(source);
 +		/*
 +		 * Notify and update messages need to specify the data class.
 +		 */
 +		if ((msg->opcode == dns_opcode_update ||
 +		     msg->opcode == dns_opcode_notify) &&
 +		    (rdclass == dns_rdataclass_none ||
 +		     rdclass == dns_rdataclass_any))
 +		{
 +			DO_ERROR(DNS_R_FORMERR);
 +		}
 +
 		/*
 		 * If this class is different than the one we already read,
 		 * this is an error.
 diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
 index 0952624689..0d7d0735db 100644
 --- a/lib/dns/resolver.c
 +++ b/lib/dns/resolver.c
@@ -7367,9 +7367,16 @@ is_answeraddress_allowed(dns_view_t *view, dns_name_t *name,
 	}
 	/*
 -	 * Otherwise, search the filter list for a match for each address
 -	 * record.  If a match is found, the address should be filtered,
 -	 * so should the entire answer.
 +	 * deny-answer-address doesn't apply to non-IN classes.
 +	 */
 +	if (rdataset->rdclass != dns_rdataclass_in) {
 +		return true;
 +	}
 +
 +	/*
 +	 * Otherwise, search the filter list for a match for each
 +	 * address record.  If a match is found, the address should be
 +	 * filtered, so should the entire answer.
 	 */
 	for (result = dns_rdataset_first(rdataset); result == ISC_R_SUCCESS;
 	     result = dns_rdataset_next(rdataset))
 diff --git a/lib/ns/client.c b/lib/ns/client.c
 index d4ce000be8..b1e1d6c0b9 100644
 --- a/lib/ns/client.c
 +++ b/lib/ns/client.c
@@ -43,6 +43,7 @@
 #include <dns/dispatch.h>
 #include <dns/dnstap.h>
 #include <dns/edns.h>
 +#include <dns/enumclass.h>
 #include <dns/events.h>
 #include <dns/message.h>
 #include <dns/peer.h>
@@ -1933,7 +1934,9 @@ ns__client_request(isc_nmhandle_t *handle, isc_result_t eresult,
 		}
 	}
 -	if (client->message->rdclass == 0) {
 +	char classbuf[DNS_RDATACLASS_FORMATSIZE];
 +	switch (client->message->rdclass) {
 +	case dns_rdataclass_reserved0:
 		if ((client->attributes & NS_CLIENTATTR_WANTCOOKIE) != 0 &&
 		    client->message->opcode == dns_opcode_query &&
 		    client->message->counts[DNS_SECTION_QUESTION] == 0U)
@@ -1954,12 +1957,49 @@ ns__client_request(isc_nmhandle_t *handle, isc_result_t eresult,
 			return;
 		}
 +		ns_client_dumpmessage(client,
 +				      "message class could not be determined");
 +		ns_client_error(client, notimp ? DNS_R_NOTIMP : DNS_R_FORMERR);
 +		isc_task_unpause(client->task);
 +		return;
 +	case dns_rdataclass_in:
 +		break;
 +	case dns_rdataclass_chaos:
 +		break;
 +	case dns_rdataclass_hs:
 +		break;
 +	case dns_rdataclass_none:
 +		if (client->message->opcode != dns_opcode_update) {
 +			ns_client_dumpmessage(client,
 +					      "message class NONE can be only "
 +					      "used in DNS updates");
 +			ns_client_error(client, DNS_R_FORMERR);
 +			isc_task_unpause(client->task);
 +			return;
 +		}
 +		break;
 +	case dns_rdataclass_any:
 +		/*
 +		 * Required for TKEY negotiation.
 +		 */
 +		if (client->message->tkey == 0) {
 +			ns_client_dumpmessage(client,
 +					      "message class ANY can be only "
 +					      "used for TKEY negotiation");
 +			ns_client_error(client, DNS_R_FORMERR);
 +			isc_task_unpause(client->task);
 +			return;
 +		}
 +		break;
 +	default:
 +		dns_rdataclass_format(client->message->rdclass, classbuf,
 +				      sizeof(classbuf));
 +		ns_client_dumpmessage(client, "");
 		ns_client_log(client, NS_LOGCATEGORY_CLIENT,
 			      NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(1),
 -			      "message class could not be determined");
 -		ns_client_dumpmessage(client, "message class could not be "
 -					      "determined");
 -		ns_client_error(client, notimp ? DNS_R_NOTIMP : DNS_R_FORMERR);
 +			      "invalid message class: %s", classbuf);
 +
 +		ns_client_error(client, DNS_R_NOTIMP);
 		isc_task_unpause(client->task);
 		return;
 	}
@@ -1998,7 +2038,7 @@ ns__client_request(isc_nmhandle_t *handle, isc_result_t eresult,
 		ns_client_log(client, NS_LOGCATEGORY_CLIENT,
 			      NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(1),
 			      "no matching view in class '%s'", classname);
 -		ns_client_dumpmessage(client, "no matching view in class");
 +		ns_client_dumpmessage(client, "");
 		ns_client_error(client, notimp ? DNS_R_NOTIMP : DNS_R_REFUSED);
 		isc_task_unpause(client->task);
 		return;
@@ -2175,6 +2215,10 @@ ns__client_request(isc_nmhandle_t *handle, isc_result_t eresult,
 		break;
 	case dns_opcode_update:
 		CTRACE("update");
 +		if (client->view->rdclass != dns_rdataclass_in) {
 +			ns_client_error(client, DNS_R_NOTIMP);
 +			break;
 +		}
 #ifdef HAVE_DNSTAP
 		dns_dt_send(client->view, DNS_DTTYPE_UQ, &client->peeraddr,
 			    &client->destsockaddr, TCP_CLIENT(client), NULL,
@@ -2185,6 +2229,10 @@ ns__client_request(isc_nmhandle_t *handle, isc_result_t eresult,
 		break;
 	case dns_opcode_notify:
 		CTRACE("notify");
 +		if (client->view->rdclass != dns_rdataclass_in) {
 +			ns_client_error(client, DNS_R_NOTIMP);
 +			break;
 +		}
 		ns_client_settimeout(client, 60);
 		ns_notify_start(client, handle);
 		break;
@@ -2276,7 +2324,7 @@ ns__client_setup(ns_client_t *client, ns_clientmgr_t *mgr, bool new) {
 	 * The caller is responsible for that.
 	 */
 -	REQUIRE(NS_CLIENT_VALID(client) || (new &&client != NULL));
 +	REQUIRE(NS_CLIENT_VALID(client) || (new && client != NULL));
 	REQUIRE(VALID_MANAGER(mgr) || !new);
 	if (new) {
@@ -2735,7 +2783,7 @@ ns_client_dumpmessage(ns_client_t *client, const char *reason) {
 	int len = 1024;
 	isc_result_t result;
 -	if (!isc_log_wouldlog(ns_lctx, ISC_LOG_DEBUG(1))) {
 +	if (!isc_log_wouldlog(ns_lctx, ISC_LOG_DEBUG(1)) || reason == NULL) {
 		return;
 	}
 diff --git a/lib/ns/update.c b/lib/ns/update.c
 index 4e51cdcb77..2792058099 100644
 --- a/lib/ns/update.c
 +++ b/lib/ns/update.c
@@ -1294,7 +1294,10 @@ replaces_p(dns_rdata_t *update_rr, dns_rdata_t *db_rr) {
 			return (true);
 		}
 	}
 -	if (db_rr->type == dns_rdatatype_wks) {
 +
 +	if (db_rr->rdclass == dns_rdataclass_in &&
 +	    db_rr->type == dns_rdatatype_wks)
 +	{
 		/*
 		 * Compare the address and protocol fields only.  These
 		 * form the first five bytes of the RR data.  Do a
@@ -1438,8 +1441,7 @@ failure:
  * 'rdata', and 'ttl', respectively.
  */
 static void
 -get_current_rr(dns_message_t *msg, dns_section_t section,
 -	       dns_rdataclass_t zoneclass, dns_name_t **name,
 +get_current_rr(dns_message_t *msg, dns_section_t section, dns_name_t **name,
 	       dns_rdata_t *rdata, dns_rdatatype_t *covers, dns_ttl_t *ttl,
 	       dns_rdataclass_t *update_class) {
 	dns_rdataset_t *rdataset;
@@ -1455,7 +1457,7 @@ get_current_rr(dns_message_t *msg, dns_section_t section,
 	dns_rdataset_current(rdataset, rdata);
 	INSIST(dns_rdataset_next(rdataset) == ISC_R_NOMORE);
 	*update_class = rdata->rdclass;
 -	rdata->rdclass = zoneclass;
 +	rdata->rdclass = dns_rdataclass_in;
 }
 /*%
@@ -1557,7 +1559,6 @@ send_update_event(ns_client_t *client, dns_zone_t *zone) {
 	dns_message_t *request = client->message;
 	dns_aclenv_t *env =
 		ns_interfacemgr_getaclenv(client->manager->interface->mgr);
 -	dns_rdataclass_t zoneclass;
 	dns_rdatatype_t covers;
 	dns_name_t *zonename = NULL;
 	dns_db_t *db = NULL;
@@ -1565,10 +1566,12 @@ send_update_event(ns_client_t *client, dns_zone_t *zone) {
 	CHECK(dns_zone_getdb(zone, &db));
 	zonename = dns_db_origin(db);
 -	zoneclass = dns_db_class(db);
 	dns_zone_getssutable(zone, &ssutable);
 	dns_db_currentversion(db, &ver);
 +	/* Updates are only supported for class IN. */
 +	INSIST(dns_zone_getclass(zone) == dns_rdataclass_in);
 +
 	/*
 	 * Update message processing can leak record existence information
 	 * so check that we are allowed to query this zone.  Additionally,
@@ -1609,13 +1612,13 @@ send_update_event(ns_client_t *client, dns_zone_t *zone) {
 		dns_ttl_t ttl;
 		dns_rdataclass_t update_class;
 -		get_current_rr(request, DNS_SECTION_UPDATE, zoneclass, &name,
 +		get_current_rr(request, DNS_SECTION_UPDATE, &name,
 			       &rdata, &covers, &ttl, &update_class);
 		if (!dns_name_issubdomain(name, zonename)) {
 			FAILC(DNS_R_NOTZONE, "update RR is outside zone");
 		}
 -		if (update_class == zoneclass) {
 +		if (update_class == dns_rdataclass_in) {
 			/*
 			 * Check for meta-RRs.  The RFC2136 pseudocode says
 			 * check for ANY|AXFR|MAILA|MAILB, but the text adds
@@ -2755,9 +2758,7 @@ update_action(isc_task_t *task, isc_event_t *event) {
 	isc_mem_t *mctx = client->mctx;
 	dns_rdatatype_t covers;
 	dns_message_t *request = client->message;
 -	dns_rdataclass_t zoneclass;
 	dns_name_t *zonename = NULL;
 -	dns_ssutable_t *ssutable = NULL;
 	dns_fixedname_t tmpnamefixed;
 	dns_name_t *tmpname = NULL;
 	dns_zoneopt_t options;
@@ -2776,10 +2777,9 @@ update_action(isc_task_t *task, isc_event_t *event) {
 	CHECK(dns_zone_getdb(zone, &db));
 	zonename = dns_db_origin(db);
 -	zoneclass = dns_db_class(db);
 -	dns_zone_getssutable(zone, &ssutable);
 	options = dns_zone_getoptions(zone);
 +	INSIST(dns_zone_getclass(zone) == dns_rdataclass_in);
 	/*
 	 * Get old and new versions now that queryacl has been checked.
 	 */
@@ -2800,8 +2800,8 @@ update_action(isc_task_t *task, isc_event_t *event) {
 		dns_rdataclass_t update_class;
 		bool flag;
 -		get_current_rr(request, DNS_SECTION_PREREQUISITE, zoneclass,
 -			       &name, &rdata, &covers, &ttl, &update_class);
 +		get_current_rr(request, DNS_SECTION_PREREQUISITE, &name, &rdata,
 +			       &covers, &ttl, &update_class);
 		if (ttl != 0) {
 			PREREQFAILC(DNS_R_FORMERR, "prerequisite TTL is not "
@@ -2868,7 +2868,7 @@ update_action(isc_task_t *task, isc_event_t *event) {
 						     "satisfied");
 				}
 			}
 -		} else if (update_class == zoneclass) {
 +		} else if (update_class == dns_rdataclass_in) {
 			/* "temp<rr.name, rr.type> += rr;" */
 			result = temp_append(&temp, name, &rdata);
 			if (result != ISC_R_SUCCESS) {
@@ -2927,10 +2927,10 @@ update_action(isc_task_t *task, isc_event_t *event) {
 		dns_rdataclass_t update_class;
 		bool flag;
 -		get_current_rr(request, DNS_SECTION_UPDATE, zoneclass, &name,
 +		get_current_rr(request, DNS_SECTION_UPDATE, &name,
 			       &rdata, &covers, &ttl, &update_class);
 -		if (update_class == zoneclass) {
 +		if (update_class == dns_rdataclass_in) {
 			/*
 			 * RFC1123 doesn't allow MF and MD in master zones.
 			 */
@@ -3507,10 +3507,6 @@ common:
 		dns_db_detach(&db);
 	}
 -	if (ssutable != NULL) {
 -		dns_ssutable_detach(&ssutable);
 -	}
 -
 	isc_task_detach(&task);
 	uev->result = result;
 	if (zone != NULL) {
 -- 
 2.55.0
--- a/SOURCES/bind-9.16-RH-inline-signing.patch
+++ b/SOURCES/bind-9.16-RH-inline-signing.patch
@ -0,0 +1,70 @@
 From fb3761d9b1ca804fd6c2acabe42745f9ee79bac0 Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Thu, 18 Jul 2024 19:36:04 +0200
 Subject: [PATCH] Do not block start if inline-signing and dyn. updates are not
 set
 Attempts to modify behaviour done in 9.16.33. It requires explicit
 specification of inline-signing yes for any zone, which has specified
 dnssec-policy. For primary zones also when  allow-update and
 update-policy are disabled. Turn it into warning only on RHEL builds,
 do not prevent starting of named.
 That should roughly emulate error message present on 9.16.23:
 'inline-signing;' cannot be set to 'no' if dnssec-policy is also set on
 a non-dynamic DNS zone.
 But point a link into upstream KB article in any case. This has appeared
 only when inline-signing were specified in a zone block. For that case
 make it still fatal, but with new message.
 https://downloads.isc.org/isc/bind9/9.16.50/doc/arm/html/notes.html#known-issues
 Related to upstream commit 30fceec069ae0942749e6aa783f67756e82fcaae.
 ---
 lib/bind9/check.c | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)
 diff --git a/lib/bind9/check.c b/lib/bind9/check.c
 index ee64543..01c03d3 100644
 --- a/lib/bind9/check.c
 +++ b/lib/bind9/check.c
@@ -2951,20 +2951,32 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 		}
 		if (has_dnssecpolicy) {
 +			/* Red Hat downstream change. Warn only about inline-signing
 +			 * if inline-signing is not present in zone definition.
 +			 * But fail hard if present, but disabled, like before. */
 			if (!ddns && !signing) {
 -				cfg_obj_log(kasp, logctx, ISC_LOG_ERROR,
 -					    "'inline-signing yes;' must also "
 +				const char *verb = "should";
 +				int log_lvl = ISC_LOG_WARNING;
 +
 +				if (res1 == ISC_R_SUCCESS) {
 +					verb = "must";
 +					log_lvl = ISC_LOG_ERROR;
 +					result = ISC_R_FAILURE;
 +				}
 +
 +				cfg_obj_log(kasp, logctx, log_lvl,
 +					    "'inline-signing yes;' %s also "
 					    "be configured explicitly for "
 					    "zones using dnssec-policy%s. See "
 					    "https://kb.isc.org/docs/"
 					    "dnssec-policy-requires-dynamic-"
 					    "dns-or-inline-signing",
 +					    verb,
 					    (ztype == CFG_ZONE_PRIMARY)
 						    ? " without a configured "
 						      "'allow-update' or "
 						      "'update-policy'"
 						    : "");
 -				result = ISC_R_FAILURE;
 			}
 		}
 -- 
 2.45.2
--- a/SOURCES/bind-9.16-python-isc-distutils.patch
+++ b/SOURCES/bind-9.16-python-isc-distutils.patch
@ -0,0 +1,34 @@
 From ebedaa79b93dfcb4f41169095ae02f59dedb3fa1 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Tue, 2 Dec 2025 17:29:59 +0100
 Subject: [PATCH] Swap order of tried setuptools providers
 Older distutils.core will generate only a single file, not whole
 directory. That is needed for upgrade test. For newer distributions,
 setuptools should still work.
 To keep backward compatibility with 9.16.23, prefer distutils.
 ---
 bin/python/setup.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
 diff --git a/bin/python/setup.py b/bin/python/setup.py
 index 4440b74..dc96561 100644
 --- a/bin/python/setup.py
 +++ b/bin/python/setup.py
@@ -10,10 +10,10 @@
 # information regarding copyright ownership.
 try:
 -    from setuptools import setup
 -except ImportError:
     # pylint: disable=deprecated-module
     from distutils.core import setup
 +except ImportError:
 +    from setuptools import setup
 setup(
     name="isc",
 -- 
 2.52.0
--- a/SOURCES/bind-9.16-redhat_doc.patch
+++ b/SOURCES/bind-9.16-redhat_doc.patch
@ -0,0 +1,60 @@
 From 3a161af91bffcd457586ab466e32ac8484028763 Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Wed, 17 Jun 2020 23:17:13 +0200
 Subject: [PATCH] Update man named with Red Hat specifics
 This is almost unmodified text and requires revalidation. Some of those
 statements are no longer correct.
 ---
 bin/named/named.rst | 35 +++++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)
 diff --git a/bin/named/named.rst b/bin/named/named.rst
 index 6fd8f87..3cd6350 100644
 --- a/bin/named/named.rst
 +++ b/bin/named/named.rst
@@ -228,6 +228,41 @@ Files
 ``/var/run/named/named.pid``
    The default process-id file.
 +Notes
 +~~~~~
 +
 +**Red Hat SELinux BIND Security Profile:**
 +
 +By default, Red Hat ships BIND with the most secure SELinux policy
 +that will not prevent normal BIND operation and will prevent exploitation
 +of all known BIND security vulnerabilities. See the selinux(8) man page
 +for information about SElinux.
 +
 +It is not necessary to run named in a chroot environment if the Red Hat
 +SELinux policy for named is enabled. When enabled, this policy is far
 +more secure than a chroot environment. Users are recommended to enable
 +SELinux and remove the bind-chroot package.
 +
 +*With this extra security comes some restrictions:*
 +
 +By default, the SELinux policy does not allow named to write outside directory
 +/var/named. That directory used to be read-only for named, but write access is
 +enabled by default now.
 +
 +The "named" group must be granted read privelege to
 +these files in order for named to be enabled to read them.
 +Any file updated by named must be writeable by named user or named group.
 +
 +Any file created in the zone database file directory is automatically assigned
 +the SELinux file context *named_zone_t* .
 +
 +The Red Hat BIND distribution and SELinux policy creates three directories where
 +named were allowed to create and modify files: */var/named/slaves*, */var/named/dynamic*
 +*/var/named/data*. The service is able to write and file under */var/named* with appropriate
 +permissions. They are used for better organisation of zones and backward compatibility.
 +Files in these directories are automatically assigned the '*named_cache_t*'
 +file context, which SELinux always allows named to write.
 +
 See Also
 ~~~~~~~~
 -- 
 2.26.2
--- a/SOURCES/bind-9.16-remove-openssl-api-level-check-for-engine.patch
+++ b/SOURCES/bind-9.16-remove-openssl-api-level-check-for-engine.patch
@ -0,0 +1,35 @@
 From 68c631cf8dc67cb315d738a55a97fff26c0818e7 Mon Sep 17 00:00:00 2001
 From: Fedor Vorobev <fvorobev@redhat.com>
 Date: Thu, 23 Jul 2026 10:55:42 +0200
 Subject: [PATCH] Remove OPENSSL_API_LEVEL < 30000 check from an engine check.
 It was added in 5f8ac682c9912aaf564595f73f777672743f56aa upstream
 commit, which was a cherry pick from a newer version of bind. As this is
 the only instance of OPENSSL_API_LEVEL < 30000 within bind 9.16.50, I
 believe it was done in error.
 This check was preventing bind from finding the OpenSSL engine for RSA
 algorithms. `dnssec-keyfromlabel` would error out with 'no engine'
 whenever an RSA algorithm was used.
 Resolves: RHEL-213788
 ---
 lib/dns/opensslrsa_link.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/lib/dns/opensslrsa_link.c b/lib/dns/opensslrsa_link.c
 index 09412c58b5..81ce6cc7cb 100644
 --- a/lib/dns/opensslrsa_link.c
 +++ b/lib/dns/opensslrsa_link.c
@@ -931,7 +931,7 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
 	for (i = 0; i < priv.nelements; i++) {
 		switch (priv.elements[i].tag) {
 -#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000
 +#if !defined(OPENSSL_NO_ENGINE)
 		case TAG_RSA_ENGINE:
 			engine = (char *)priv.elements[i].data;
 			break;
 -- 
 2.55.0
--- a/SOURCES/bind-9.16-update-b.root-servers.net.patch
+++ b/SOURCES/bind-9.16-update-b.root-servers.net.patch
@ -1,31 +0,0 @@
 From 4e595a6b961e73af43350833109ccba0950119f9 Mon Sep 17 00:00:00 2001
 From: Mark Andrews <marka@isc.org>
 Date: Thu, 12 Oct 2023 10:19:38 +1100
 Subject: [PATCH] Update b.root-servers.net IP addresses
 This covers both root hints and the default primaries for the root
 zone mirror.  The official change date is Nov 27, 2023.
 (cherry picked from commit 2ca2f7e9852a3d6e93f065c01ea4679f723688f7)
 ---
 lib/dns/rootns.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
 diff --git a/lib/dns/rootns.c b/lib/dns/rootns.c
 index 9653f3b..d6ff76e 100644
 --- a/lib/dns/rootns.c
 +++ b/lib/dns/rootns.c
@@ -56,8 +56,8 @@ static char root_ns[] =
 ".                       518400  IN      NS      M.ROOT-SERVERS.NET.\n"
 "A.ROOT-SERVERS.NET.     3600000 IN      A       198.41.0.4\n"
 "A.ROOT-SERVERS.NET.     3600000 IN      AAAA    2001:503:BA3E::2:30\n"
 -"B.ROOT-SERVERS.NET.     3600000 IN      A       199.9.14.201\n"
 -"B.ROOT-SERVERS.NET.     3600000 IN      AAAA    2001:500:200::b\n"
 +"B.ROOT-SERVERS.NET.     3600000 IN      A       170.247.170.2\n"
 +"B.ROOT-SERVERS.NET.     3600000 IN      AAAA    2801:1b8:10::b\n"
 "C.ROOT-SERVERS.NET.     3600000 IN      A       192.33.4.12\n"
 "C.ROOT-SERVERS.NET.     3600000 IN      AAAA    2001:500:2::c\n"
 "D.ROOT-SERVERS.NET.     3600000 IN      A       199.7.91.13\n"
 -- 
 2.43.0
--- a/SOURCES/bind-9.16.50.tar.xz.asc
+++ b/SOURCES/bind-9.16.50.tar.xz.asc
@ -0,0 +1,16 @@
 -----BEGIN PGP SIGNATURE-----
 iQIzBAABCgAdFiEEcGtsKGIOdvkdEfffUQpkKgbFLOwFAmYP/t0ACgkQUQpkKgbF
 LOzyew/9HC8SiGcokr7K7inFoW3ftPkOL2yKVcsA345uxMF8Tf9q1s5GVAZSRFTA
 WsunUb5iz//5s7QGXvSf05xLRgY5kKhLd0YywW4jscy8YssQvXol3ZK6VEhA5uVe
 7mHJu8+00DiHv4gBXmJMS/+przeykNTZk/u10cIeanUgWKYqt/uMGYrycttsiRaI
 wob7DSEwK0qu7zX6pKPEKVwzchdLK9O9aXr23SJaoDAn7UqKRN+s4b7pEPOqjDaF
 liGp74AZagGji7Me5rESS8NkfQmiZ/bgcwYrUC/mWDA/K4ClCFKTUZQ6Lfnwlxjo
 263myX3tAHuZ5LruLsCRFiRrSiknoUQDwEcx/Z2eZBYjpXwcaKnavT9UUbnzN+jI
 QZcDypRvzYNPneqDor9ak3/MJWoDqdoEOkTbxjQQXy3j9Pj4CZsjp4lRCEcmIQoA
 8nkQ3dFcKkjJg//N5GCk0m7LlBbZYLaxDyRLa/doYYXd9t2HXMsFN6aPiQCRV+sY
 xrT9mHDJHwjyIqTh0ufPkLIBJdsqDaloSsFayL6WzFWCTOUNGkMkgnZxqLQeLQ4y
 JV/XW0q0At4GM4VqrFx9I3YbEdXpcfF6KdfijLmYGY29JPB0Tz5tN58wl94E1gtq
 A155o0v14/2r8gTb0y3X3dbXUCMGvVXHhLEEgTDgElhUDBXzc9k=
 =syDr
 -----END PGP SIGNATURE-----
--- a/SOURCES/bind-9.18-CVE-2024-11187-pre-test.patch
+++ b/SOURCES/bind-9.18-CVE-2024-11187-pre-test.patch
@ -1,4 +1,4 @@
-From 8a9b9ff5a8b2443f7df4f60397ad215931ba44f1 Mon Sep 17 00:00:00 2001
+From 1e3d6c2862cb7911fdd01b9d69a8599b462b797c Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
 Date: Tue, 7 Jan 2025 15:22:40 +0100
 Subject: [PATCH] Isolate using the -T noaa flag only for part of the resolver
@ -14,72 +14,55 @@ system test.
 (cherry picked from commit e51d4d3b88af00d6667f2055087ebfc47fb3107c)
 ---
- bin/tests/system/conf.sh.in              | 12 ++++++++++++
+ bin/tests/system/resolver/ns4/named.noaa | 12 ------------
 bin/tests/system/resolver/ns4/named.noaa |  5 -----
 bin/tests/system/resolver/tests.sh       |  8 ++++++++
- 3 files changed, 20 insertions(+), 5 deletions(-)
+ 2 files changed, 8 insertions(+), 12 deletions(-)
 delete mode 100644 bin/tests/system/resolver/ns4/named.noaa
 diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
 index 06852f5..f77f7de 100644
 --- a/bin/tests/system/conf.sh.in
 +++ b/bin/tests/system/conf.sh.in
@@ -305,6 +305,18 @@ digcomp() {
     return $result
 }
 +start_server() {
 +    $PERL "$SYSTEMTESTTOP/start.pl" "$SYSTESTDIR" "$@"
 +}
 +
 +stop_server() {
 +    $PERL "$SYSTEMTESTTOP/stop.pl" "$SYSTESTDIR" "$@"
 +}
 +
 +send() {
 +    $PERL "$SYSTEMTESTTOP/send.pl" "$@"
 +}
 +
 #
 # Useful functions in test scripts
 #
 diff --git a/bin/tests/system/resolver/ns4/named.noaa b/bin/tests/system/resolver/ns4/named.noaa
 deleted file mode 100644
-index 3b121ad..0000000
+index be78cc2c94..0000000000
 --- a/bin/tests/system/resolver/ns4/named.noaa
 +++ /dev/null
-@@ -1,5 +0,0 @@
+@@ -1,12 +0,0 @@
 -Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 -
-See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
+-SPDX-License-Identifier: MPL-2.0
 -
 -This Source Code Form is subject to the terms of the Mozilla Public
 -License, v. 2.0.  If a copy of the MPL was not distributed with this
 -file, you can obtain one at https://mozilla.org/MPL/2.0/.
 -
 -See the COPYRIGHT file distributed with this work for additional
 -information regarding copyright ownership.
 -
 -Add -T noaa.
 diff --git a/bin/tests/system/resolver/tests.sh b/bin/tests/system/resolver/tests.sh
-index 6eb52fe..bf37467 100755
+index d9121d9ae5..29562c2db0 100755
 --- a/bin/tests/system/resolver/tests.sh
 +++ b/bin/tests/system/resolver/tests.sh
-@@ -281,6 +281,10 @@ done
+@@ -309,6 +309,10 @@ done
 if [ $ret != 0 ]; then echo_i "failed"; fi
- status=`expr $status + $ret`
+ status=$((status + ret))
 +stop_server ns4
 +touch ns4/named.noaa
 +start_server --noclean --restart --port ${PORT} ns4 || ret=1
 +
- n=`expr $n + 1`
+ n=$((n + 1))
 echo_i "RT21594 regression test check setup ($n)"
 ret=0
-@@ -317,6 +321,10 @@ grep "status: NXDOMAIN" dig.ns5.out.${n} > /dev/null || ret=1
+@@ -345,6 +349,10 @@ grep "status: NXDOMAIN" dig.ns5.out.${n} >/dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
- status=`expr $status + $ret`
+ status=$((status + ret))
 +stop_server ns4
 +rm ns4/named.noaa
 +start_server --noclean --restart --port ${PORT} ns4 || ret=1
 +
- n=`expr $n + 1`
+ n=$((n + 1))
 echo_i "check that replacement of additional data by a negative cache no data entry clears the additional RRSIGs ($n)"
 ret=0
 -- 
-2.48.1
+2.53.0
--- a/SOURCES/bind-9.18-CVE-2024-11187.patch
+++ b/SOURCES/bind-9.18-CVE-2024-11187.patch
@ -1,4 +1,4 @@
-From ca6c3446ef07d89fd3a28b6979d947af2ab5754f Mon Sep 17 00:00:00 2001
+From 0f9d817ca87207f2695560645e12478477d345a5 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
 Date: Thu, 14 Nov 2024 10:37:29 +0100
 Subject: [PATCH] Limit the additional processing for large RDATA sets
@ -14,78 +14,40 @@ answer to ANY is already big enough.
 (cherry picked from commit a1982cf1bb95c818aa7b58988b5611dec80f2408)
 PatchNumber: 47
 ---
 bin/named/query.c                    | 14 ++++++++------
 bin/tests/system/additional/tests.sh |  2 +-
 lib/dns/include/dns/rdataset.h       | 12 ++++++++++++
- lib/dns/rdataset.c                   | 12 ++++++++++++
+ lib/dns/rbtdb.c                      |  2 +-
- 4 files changed, 33 insertions(+), 7 deletions(-)
+ lib/dns/rdataset.c                   | 11 +++++++++++
-
+ lib/ns/query.c                       | 15 ++++++++++-----
-diff --git a/bin/named/query.c b/bin/named/query.c
+ 5 files changed, 35 insertions(+), 7 deletions(-)
 index 51a29a8..e023d74 100644
 --- a/bin/named/query.c
 +++ b/bin/named/query.c
@@ -1835,9 +1835,10 @@ query_addadditional(void *arg, dns_name_t *name, dns_rdatatype_t qtype) {
 		 * section, it's helpful if we add the SRV additional data
 		 * as well.
 		 */
 -		eresult = dns_rdataset_additionaldata(trdataset,
 -						      query_addadditional,
 -						      client);
 +		eresult = dns_rdataset_additionaldata2(trdataset,
 +						       query_addadditional,
 +						       client,
 +						       DNS_RDATASET_MAXADDITIONAL);
 	}
  cleanup:
@@ -2432,7 +2433,7 @@ query_addrdataset(ns_client_t *client, dns_name_t *fname,
 						       rdataset->rdclass);
 	rdataset->attributes |= DNS_RDATASETATTR_LOADORDER;
 -	if (NOADDITIONAL(client))
 +	if (NOADDITIONAL(client) || client->query.qtype == dns_rdatatype_any)
 		return;
 	/*
@@ -2442,8 +2443,9 @@ query_addrdataset(ns_client_t *client, dns_name_t *fname,
 	 */
 	additionalctx.client = client;
 	additionalctx.rdataset = rdataset;
 -	(void)dns_rdataset_additionaldata(rdataset, query_addadditional2,
 -					  &additionalctx);
 +	(void)dns_rdataset_additionaldata2(rdataset, query_addadditional2,
 +					   &additionalctx,
 +					   DNS_RDATASET_MAXADDITIONAL);
 	CTRACE(ISC_LOG_DEBUG(3), "query_addrdataset: done");
 }
 diff --git a/bin/tests/system/additional/tests.sh b/bin/tests/system/additional/tests.sh
-index 6400723..a33cc8a 100644
+index 3701790..4281238 100644
 --- a/bin/tests/system/additional/tests.sh
 +++ b/bin/tests/system/additional/tests.sh
-@@ -261,7 +261,7 @@ n=`expr $n + 1`
+@@ -278,7 +278,7 @@ n=$(expr $n + 1)
 echo_i "testing with 'minimal-any no;' ($n)"
 ret=0
 $DIG $DIGOPTS -t ANY www.rt.example @10.53.0.1 >dig.out.$n || ret=1
-grep "ANSWER: 3, AUTHORITY: 1, ADDITIONAL: 2" dig.out.$n > /dev/null || ret=1
+-grep "ANSWER: 3, AUTHORITY: 2, ADDITIONAL: 2" dig.out.$n >/dev/null || ret=1
-+grep "ANSWER: 3, AUTHORITY: 1, ADDITIONAL: 1" dig.out.$n > /dev/null || ret=1
+grep "ANSWER: 3, AUTHORITY: 2, ADDITIONAL: 1" dig.out.$n > /dev/null || ret=1
 if [ $ret -eq 1 ]; then
-     echo_i "failed"; status=`expr status + 1`
+   echo_i "failed"
- fi
+   status=$((status + 1))
 diff --git a/lib/dns/include/dns/rdataset.h b/lib/dns/include/dns/rdataset.h
-index 710e97c..b3532f6 100644
+index de3f638..85c081e 100644
 --- a/lib/dns/include/dns/rdataset.h
 +++ b/lib/dns/include/dns/rdataset.h
-@@ -53,6 +53,8 @@
+@@ -55,6 +55,8 @@
 #include <dns/types.h>
 #include <dns/rdatastruct.h>
 #include <dns/types.h>
 +#define DNS_RDATASET_MAXADDITIONAL 13
 +
 ISC_LANG_BEGINDECLS
 typedef enum {
-@@ -501,13 +503,23 @@ dns_rdataset_additionaldata(dns_rdataset_t *rdataset,
+@@ -465,13 +467,23 @@ dns_rdataset_additionaldata(dns_rdataset_t	    *rdataset,
  *\li	If a call to dns_rdata_additionaldata() is not successful, the
  *	result returned will be the result of dns_rdataset_additionaldata().
  *
@ -109,33 +71,45 @@ index 710e97c..b3532f6 100644
 isc_result_t
 dns_rdataset_getnoqname(dns_rdataset_t *rdataset, dns_name_t *name,
 			dns_rdataset_t *neg, dns_rdataset_t *negsig);
 diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
 index c2cd63e..b1efa0b 100644
 --- a/lib/dns/rbtdb.c
 +++ b/lib/dns/rbtdb.c
@@ -10632,7 +10632,7 @@ no_glue:
 	maybe_rehash_gluetable(rbtversion);
 	idx = hash_32(hash, rbtversion->glue_table_bits);
 -	(void)dns_rdataset_additionaldata(rdataset, glue_nsdname_cb, &ctx);
 +	(void)dns_rdataset_additionaldata2(rdataset, glue_nsdname_cb, &ctx, 0);
 	cur = isc_mem_get(rbtdb->common.mctx, sizeof(*cur));
 diff --git a/lib/dns/rdataset.c b/lib/dns/rdataset.c
-index b42dea5..5160acf 100644
+index 221d7f8..0f83d1f 100644
 --- a/lib/dns/rdataset.c
 +++ b/lib/dns/rdataset.c
-@@ -28,6 +28,7 @@
+@@ -29,6 +29,7 @@
 #include <dns/ncache.h>
 #include <dns/rdata.h>
 #include <dns/rdataset.h>
 +#include <dns/result.h>
 static const char *trustnames[] = {
- 	"none",
+ 	"none",		  "pending-additional",
-@@ -608,6 +609,13 @@ dns_rdataset_towire(dns_rdataset_t *rdataset,
+@@ -579,6 +580,12 @@ dns_rdataset_towire(dns_rdataset_t *rdataset, const dns_name_t *owner_name,
 isc_result_t
 dns_rdataset_additionaldata(dns_rdataset_t *rdataset,
- 			    dns_additionaldatafunc_t add, void *arg)
+ 			    dns_additionaldatafunc_t add, void *arg) {
 +{
 +	return dns_rdataset_additionaldata2(rdataset, add, arg, 0);
 +}
 +
 +isc_result_t
 +dns_rdataset_additionaldata2(dns_rdataset_t *rdataset,
-+			    dns_additionaldatafunc_t add, void *arg, size_t limit)
+			    dns_additionaldatafunc_t add, void *arg, size_t limit) {
 {
 	dns_rdata_t rdata = DNS_RDATA_INIT;
 	isc_result_t result;
-@@ -620,6 +628,10 @@ dns_rdataset_additionaldata(dns_rdataset_t *rdataset,
+ 
@@ -590,6 +597,10 @@ dns_rdataset_additionaldata(dns_rdataset_t *rdataset,
 	REQUIRE(DNS_RDATASET_VALID(rdataset));
 	REQUIRE((rdataset->attributes & DNS_RDATASETATTR_QUESTION) == 0);
@ -144,8 +118,55 @@ index b42dea5..5160acf 100644
 +	}
 +
 	result = dns_rdataset_first(rdataset);
- 	if (result != ISC_R_SUCCESS)
+ 	if (result != ISC_R_SUCCESS) {
 		return (result);
-- 
+diff --git a/lib/ns/query.c b/lib/ns/query.c
-2.48.1
+index ec9bf5b..b31857c 100644
 --- a/lib/ns/query.c
 +++ b/lib/ns/query.c
@@ -2047,8 +2047,9 @@ addname:
 	 * This cannot go more than MAX_RESTARTS levels deep.
 	 */
 	if (trdataset != NULL && dns_rdatatype_followadditional(type)) {
 -		eresult = dns_rdataset_additionaldata(
 -			trdataset, query_additional_cb, qctx);
 +		eresult = dns_rdataset_additionaldata2(
 +			trdataset, query_additional_cb, qctx,
 +			DNS_RDATASET_MAXADDITIONAL);
 	}
 cleanup:
@@ -2139,7 +2140,8 @@ regular:
 	 * Add other additional data if needed.
 	 * We don't care if dns_rdataset_additionaldata() fails.
 	 */
 -	(void)dns_rdataset_additionaldata(rdataset, query_additional_cb, qctx);
 +	(void)dns_rdataset_additionaldata2(rdataset, query_additional_cb,
 +					   qctx, DNS_RDATASET_MAXADDITIONAL);
 	CTRACE(ISC_LOG_DEBUG(3), "query_additional: done");
 }
@@ -2165,7 +2167,8 @@ query_addrrset(query_ctx_t *qctx, dns_name_t **namep,
 	 * To the current response for 'client', add the answer RRset
 	 * '*rdatasetp' and an optional signature set '*sigrdatasetp', with
 	 * owner name '*namep', to section 'section', unless they are
 -	 * already there.  Also add any pertinent additional data.
 +	 * already there.  Also add any pertinent additional data, unless
 +	 * the query was for type ANY.
 	 *
 	 * If 'dbuf' is not NULL, then '*namep' is the name whose data is
 	 * stored in 'dbuf'.  In this case, query_addrrset() guarantees that
@@ -2220,7 +2223,9 @@ query_addrrset(query_ctx_t *qctx, dns_name_t **namep,
 	 */
 	query_addtoname(mname, rdataset);
 	query_setorder(qctx, mname, rdataset);
 -	query_additional(qctx, rdataset);
 +	if (qctx->qtype != dns_rdatatype_any) {
 +		query_additional(qctx, rdataset);
 +	}
 	/*
 	 * Note: we only add SIGs if we've added the type they cover, so
 -- 
 2.51.1
--- a/SOURCES/bind-9.18-CVE-2024-4076.patch
+++ b/SOURCES/bind-9.18-CVE-2024-4076.patch
@ -0,0 +1,29 @@
 From 274463c5b71db87a615694889da23837ba48db9a Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Tue, 16 Jul 2024 19:49:26 +0200
 Subject: [PATCH] Resolve CVE-2024-4076
 6403.	[security]	qctx-zversion was not being cleared when it should have
 			been leading to an assertion failure if it needed to be
 			reused. (CVE-2024-4076) [GL #4507]
 Resolves: CVE-2024-4076
 ---
 lib/ns/query.c | 1 +
 1 file changed, 1 insertion(+)
 diff --git a/lib/ns/query.c b/lib/ns/query.c
 index 537d332..be4cbb6 100644
 --- a/lib/ns/query.c
 +++ b/lib/ns/query.c
@@ -5325,6 +5325,7 @@ qctx_freedata(query_ctx_t *qctx) {
 		ns_client_releasename(qctx->client, &qctx->zfname);
 		dns_db_detachnode(qctx->zdb, &qctx->znode);
 		dns_db_detach(&qctx->zdb);
 +		qctx->zversion = NULL;
 	}
 	if (qctx->event != NULL && !qctx->client->nodetach) {
 -- 
 2.45.2
--- a/SOURCES/bind-9.18-configurable-additional-records.patch
+++ b/SOURCES/bind-9.18-configurable-additional-records.patch
@ -0,0 +1,168 @@
 From bddd8950ff3d82d503dfb64e67d24ce364e5a5af Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Mon, 16 Jun 2025 19:36:13 +0200
 Subject: [PATCH] Support runtime configurable limit of additional records
 Use environment variable NAMED_MAXADDITIONAL to change default built-in
 limit. Uses environment variable to avoid the need to support the variable
 option in the more recent versions and after upgrades.
 Use debug 1 verbosity for logging parsed limit at the start, but not
 changing production logs.
 ---
 bin/named/main.c           |  5 +++++
 bin/named/named.rst        |  9 +++++++++
 lib/ns/include/ns/server.h | 13 +++++++++++++
 lib/ns/query.c             |  4 ++--
 lib/ns/server.c            | 25 +++++++++++++++++++++++++
 5 files changed, 54 insertions(+), 2 deletions(-)
 diff --git a/bin/named/main.c b/bin/named/main.c
 index f62f82c..0de658a 100644
 --- a/bin/named/main.c
 +++ b/bin/named/main.c
@@ -1327,6 +1327,11 @@ setup(void) {
 	if (sigvalinsecs) {
 		ns_server_setoption(sctx, NS_SERVER_SIGVALINSECS, true);
 	}
 +	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 +		      NAMED_LOGMODULE_SERVER, ISC_LOG_DEBUG(1),
 +		      "using max %u additional records",
 +		      ns_server_getmaxadditionalrecords(sctx));
 +
 }
 static void
 diff --git a/bin/named/named.rst b/bin/named/named.rst
 index 3cd6350..06af140 100644
 --- a/bin/named/named.rst
 +++ b/bin/named/named.rst
@@ -228,6 +228,15 @@ Files
 ``/var/run/named/named.pid``
    The default process-id file.
 +Environment
 +~~~~~~~~~~~
 +
 +NAMED_MAXADDITIONAL
 +    Red Hat specific extension. Accepts numeric value of maximal NS
 +    records, which would get fetched additional addresses. Default
 +    value is 13. Allows runtime configurable limit introduced in
 +    CVE-2024-11187 fixes.
 +
 Notes
 ~~~~~
 diff --git a/lib/ns/include/ns/server.h b/lib/ns/include/ns/server.h
 index 0abb579..4864ba4 100644
 --- a/lib/ns/include/ns/server.h
 +++ b/lib/ns/include/ns/server.h
@@ -122,6 +122,8 @@ struct ns_server {
 	isc_stats_t *tcpoutstats4;
 	isc_stats_t *tcpinstats6;
 	isc_stats_t *tcpoutstats6;
 +
 +	unsigned int max_additional_records;
 };
 struct ns_altsecret {
@@ -166,6 +168,17 @@ ns_server_setserverid(ns_server_t *sctx, const char *serverid);
  *\li	'sctx' is valid.
  */
 +unsigned int
 +ns_server_getmaxadditionalrecords(ns_server_t *sctx);
 +/*%<
 + *	Returns the maximal number of records with additional addresses
 + *	provided.
 + *
 + * Requires:
 + *\li	'sctx' is valid.
 + */
 +
 +
 void
 ns_server_setoption(ns_server_t *sctx, unsigned int option, bool value);
 /*%<
 diff --git a/lib/ns/query.c b/lib/ns/query.c
 index ce1d710..37893e2 100644
 --- a/lib/ns/query.c
 +++ b/lib/ns/query.c
@@ -2032,7 +2032,7 @@ addname:
 	if (trdataset != NULL && dns_rdatatype_followadditional(type)) {
 		eresult = dns_rdataset_additionaldata2(
 			trdataset, query_additional_cb, qctx,
 -			DNS_RDATASET_MAXADDITIONAL);
 +			client->sctx->max_additional_records);
 	}
 cleanup:
@@ -2124,7 +2124,7 @@ regular:
 	 * We don't care if dns_rdataset_additionaldata() fails.
 	 */
 	(void)dns_rdataset_additionaldata2(rdataset, query_additional_cb,
 -					   qctx, DNS_RDATASET_MAXADDITIONAL);
 +					   qctx, client->sctx->max_additional_records);
 	CTRACE(ISC_LOG_DEBUG(3), "query_additional: done");
 }
 diff --git a/lib/ns/server.c b/lib/ns/server.c
 index 540bc2e..0a4abb3 100644
 --- a/lib/ns/server.c
 +++ b/lib/ns/server.c
@@ -17,6 +17,7 @@
 #include <isc/stats.h>
 #include <isc/util.h>
 +#include <dns/rdataset.h>
 #include <dns/stats.h>
 #include <dns/tkey.h>
@@ -33,6 +34,22 @@
 		RUNTIME_CHECK(result == ISC_R_SUCCESS); \
 	} while (0)
 +/*
 + * CVE-2024-11187 introduced a limit on maximal number of records,
 + * for which additional records would be fetched. Make this limit
 + * configurable runtime only by environment.
 + */
 +static size_t
 +initialize_maxadditional(void) {
 +	const char *limits;
 +
 +	limits = getenv("NAMED_MAXADDITIONAL");
 +	if (limits != NULL) {
 +		return strtol(limits, NULL, 10);
 +	}
 +	return DNS_RDATASET_MAXADDITIONAL;
 +}
 +
 isc_result_t
 ns_server_create(isc_mem_t *mctx, ns_matchview_t matchingview,
 		 ns_server_t **sctxp) {
@@ -90,6 +107,7 @@ ns_server_create(isc_mem_t *mctx, ns_matchview_t matchingview,
 	sctx->udpsize = 1232;
 	sctx->transfer_tcp_message_size = 20480;
 +	sctx->max_additional_records = initialize_maxadditional();
 	sctx->fuzztype = isc_fuzz_none;
 	sctx->fuzznotify = NULL;
@@ -213,6 +231,13 @@ ns_server_setserverid(ns_server_t *sctx, const char *serverid) {
 	return (ISC_R_SUCCESS);
 }
 +unsigned int
 +ns_server_getmaxadditionalrecords(ns_server_t *sctx) {
 +	REQUIRE(SCTX_VALID(sctx));
 +
 +	return sctx->max_additional_records;
 +}
 +
 void
 ns_server_setoption(ns_server_t *sctx, unsigned int option, bool value) {
 	REQUIRE(SCTX_VALID(sctx));
 -- 
 2.49.0
--- a/SOURCES/bind-9.18-dig-idn-input-always-test.patch
+++ b/SOURCES/bind-9.18-dig-idn-input-always-test.patch
@ -0,0 +1,83 @@
 From 77105c4738a07c48d2cf52fc1fcb1c7b2eb50661 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Tue, 16 Sep 2025 11:46:03 +0200
 Subject: [PATCH] Fix expectations on idna system test
 IDNA tests always redirect output into the file. That means its
 behaviour has changed and is now processing IDN input by default and
 just disables IDN output by default.
 New behaviour when redirected is the same as +idnin +noidnout, but does
 not fail hard on input errors.
 bind 9.16 version.
 ---
 bin/tests/system/idna/tests.sh | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)
 diff --git a/bin/tests/system/idna/tests.sh b/bin/tests/system/idna/tests.sh
 index 8c2826f..5b8ddd1 100644
 --- a/bin/tests/system/idna/tests.sh
 +++ b/bin/tests/system/idna/tests.sh
@@ -187,7 +187,7 @@ idna_enabled_test() {
   # Note that ASCII characters are converted to lower-case.
   text="Checking valid non-ASCII label"
 -  idna_test "$text" "" "München" "M\195\188nchen."
 +  idna_test "$text" "" "München" "xn--mnchen-3ya."
   idna_test "$text" "+noidnin +noidnout" "München" "M\195\188nchen."
   idna_test "$text" "+noidnin +idnout" "München" "M\195\188nchen."
   idna_test "$text" "+idnin   +noidnout" "München" "xn--mnchen-3ya."
@@ -211,7 +211,7 @@ idna_enabled_test() {
   # for the valid U-label.
   text="Checking that non-transitional IDNA processing is used"
 -  idna_test "$text" "" "faß.de" "fa\195\159.de."
 +  idna_test "$text" "" "faß.de" "xn--fa-hia.de."
   idna_test "$text" "+noidnin +noidnout" "faß.de" "fa\195\159.de."
   idna_test "$text" "+noidnin +idnout" "faß.de" "fa\195\159.de."
   idna_test "$text" "+idnin   +noidnout" "faß.de" "xn--fa-hia.de."
@@ -221,7 +221,7 @@ idna_enabled_test() {
   # onto the Greek sigma character ("σ") in IDNA2003.
   text="Second check that non-transitional IDNA processing is used"
 -  idna_test "$text" "" "βόλος.com" "\206\178\207\140\206\187\206\191\207\130.com."
 +  idna_test "$text" "" "βόλος.com" "xn--nxasmm1c.com."
   idna_test "$text" "+noidnin +noidnout" "βόλος.com" "\206\178\207\140\206\187\206\191\207\130.com."
   idna_test "$text" "+noidnin +idnout" "βόλος.com" "\206\178\207\140\206\187\206\191\207\130.com."
   idna_test "$text" "+idnin   +noidnout" "βόλος.com" "xn--nxasmm1c.com."
@@ -281,7 +281,7 @@ idna_enabled_test() {
   idna_test "$text" "" "xn--xx" "xn--xx."
   idna_test "$text" "+noidnin +noidnout" "xn--xx" "xn--xx."
   idna_fail "$text" "+noidnin   +idnout" "xn--xx"
 -  idna_fail "$text" "+idnin   +noidnout" "xn--xx"
 +  idna_test "$text" "+idnin   +noidnout" "xn--xx" "xn--xx."
   idna_fail "$text" "+idnin     +idnout" "xn--xx"
   # Fake A-label - the string does not translate to anything.
@@ -290,7 +290,7 @@ idna_enabled_test() {
   idna_test "$text" "" "xn--ahahah" "xn--ahahah."
   idna_test "$text" "+noidnin +noidnout" "xn--ahahah" "xn--ahahah."
   idna_fail "$text" "+noidnin   +idnout" "xn--ahahah"
 -  idna_fail "$text" "+idnin   +noidnout" "xn--ahahah"
 +  idna_test "$text" "+idnin   +noidnout" "xn--ahahah" "xn--ahahah."
   idna_fail "$text" "+idnin     +idnout" "xn--ahahah"
   # Too long a label. The punycode string is too long (at 64 characters).
@@ -317,11 +317,11 @@ idna_enabled_test() {
   # The +[no]idnout options should not have any effect on the test.
   text="Checking invalid input U-label"
 -  idna_test "$text" "" "√.com" "\226\136\154.com."
 +  idna_test "$text" "" "√.com" "xn--19g.com."
   idna_test "$text" "+noidnin +noidnout" "√.com" "\226\136\154.com."
   idna_test "$text" "+noidnin +idnout" "√.com" "\226\136\154.com."
   idna_test "$text" "+idnin   +noidnout" "√.com" "xn--19g.com."
 -  idna_test "$text" "+idnin   +idnout" "√.com" "√.com."
 +  idna_test "$text" "+idnin   +idnout"   "√.com" "√.com."
   # Tests of a valid unicode string but an invalid U-label (output)
   #
 -- 
 2.51.1
--- a/SOURCES/bind-9.18-dig-idn-input-always.patch
+++ b/SOURCES/bind-9.18-dig-idn-input-always.patch
@ -0,0 +1,102 @@
 From cd5e88407380c5ced9a51736f0c2d679d053e188 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Wed, 6 Nov 2024 21:29:47 +0100
 Subject: [PATCH] Allow always IDN input in dig
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Even when stdout is non-interactive terminal, allow unicode characters
 to be encoded into ACE form. Still disable IDN output, but unless
 +noidnin or IDN_DISABLE=1 env is detected, consider input as locale
 defined name.
 Provides more isolated change, which issue #3527 introduced similar
 behavior into 9.19 with more changes.
 Ignore input IDN errors when stdout is not terminal
 Attempt to prevent visible regressions when enabling IDN on input
 always. Instead of new hard failures preventing IDN decoding of input
 name just use original input.
 Should make the change backward compatible. When on interactive terminal
 behave the same way as before and emit hard errors. Become more
 forgiving in scripts where stdout leads to script. Decoding output is
 not enabled there and if input decoding fails, just use input as it was.
 Change dig manual +idnin
 Note in manual IDN input is always enabled. But it silently ignores
 errors when stdout is not a terminal to prevent regressions.
 Signed-off-by: Petr Menšík <pemensik@redhat.com>
 ---
 bin/dig/dig.rst   |  6 +++---
 bin/dig/dighost.c | 19 +++++++++++++++----
 2 files changed, 18 insertions(+), 7 deletions(-)
 diff --git a/bin/dig/dig.rst b/bin/dig/dig.rst
 index d27b1fd..3a9f9c6 100644
 --- a/bin/dig/dig.rst
 +++ b/bin/dig/dig.rst
@@ -348,9 +348,9 @@ abbreviation is unambiguous; for example, ``+cd`` is equivalent to
    This option processes [or does not process] IDN domain names on input. This requires
    ``IDN SUPPORT`` to have been enabled at compile time.
 -   The default is to process IDN input when standard output is a tty.
 -   The IDN processing on input is disabled when ``dig`` output is redirected
 -   to files, pipes, and other non-tty file descriptors.
 +   The default is to process IDN input. The input IDN processing errors are ignored
 +   when :program:`dig` output is redirected to files, pipes, and other non-tty file
 +   descriptors.
 ``+[no]idnout``
    This option converts [or does not convert] puny code on output. This requires
 diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
 index ac7e1fb..9555e63 100644
 --- a/bin/dig/dighost.c
 +++ b/bin/dig/dighost.c
@@ -622,6 +622,9 @@ clone_server_list(dig_serverlist_t src, dig_serverlist_t *dest) {
 dig_lookup_t *
 make_empty_lookup(void) {
 	dig_lookup_t *looknew;
 +#ifdef HAVE_LIBIDN2
 +	bool idn_allowed = (getenv("IDN_DISABLE") == NULL);
 +#endif
 	debug("make_empty_lookup()");
@@ -673,8 +676,8 @@ make_empty_lookup(void) {
 	looknew->qr = false;
 	looknew->accept_reply_unexpected_src = false;
 #ifdef HAVE_LIBIDN2
 -	looknew->idnin = isatty(1) ? (getenv("IDN_DISABLE") == NULL) : false;
 -	looknew->idnout = looknew->idnin;
 +	looknew->idnin = idn_allowed;
 +	looknew->idnout = isatty(1) && idn_allowed;
 #else  /* ifdef HAVE_LIBIDN2 */
 	looknew->idnin = false;
 	looknew->idnout = false;
@@ -4497,8 +4500,16 @@ idn_locale_to_ace(const char *src, char *dst, size_t dstlen) {
 		res = idn2_to_ascii_lz(src, &ascii_src, IDN2_TRANSITIONAL);
 	}
 	if (res != IDN2_OK) {
 -		fatal("'%s' is not a legal IDNA2008 name (%s), use +noidnin",
 -		      src, idn2_strerror(res));
 +		if (isatty(1)) {
 +			fatal("'%s' is not a legal IDNA2008 name (%s), use +noidnin",
 +			      src, idn2_strerror(res));
 +		} else {
 +			/* In case of non-terminal output silently ignore errors
 +			 * in IDN input decoding. */
 +			(void)strlcpy(dst, src, dstlen);
 +			resetlocale(LC_ALL);
 +			return;
 +		}
 	}
 	/*
 -- 
 2.51.1
--- a/SOURCES/bind-9.18-fix-dig-hanging-issue.patch
+++ b/SOURCES/bind-9.18-fix-dig-hanging-issue.patch
@ -0,0 +1,173 @@
 diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
 index ac7e1fb55b..9f1a05ea10 100644
 --- a/bin/dig/dighost.c
 +++ b/bin/dig/dighost.c
@@ -1571,6 +1571,31 @@ check_if_done(void) {
 	}
 }
 +
 +/*%
 + * Check if we're done with all the queries in the lookup, except for
 + * the `except_q` query (can be NULL if no exception is required).
 + * Expects `l` to be a valid and locked lookup.
 + */
 +static bool
 +check_if_queries_done(dig_lookup_t *l, dig_query_t *except_q) {
 +	dig_query_t *q = ISC_LIST_HEAD(l->q);
 +
 +	debug("check_if_queries_done(%p)", l);
 +
 +	while (q != NULL) {
 +		if (!q->started || q->waiting_connect || q->waiting_senddone || q->pending_free) {
 +			if (!q->canceled && q != except_q) {
 +				debug("there is a pending query %p", q);
 +				return (false);
 +			}
 +		}
 +		q = ISC_LIST_NEXT(q, link);
 +	}
 +
 +	return (true);
 +}
 +
 /*%
  * Clear out a query when we're done with it.  WARNING: This routine
  * WILL invalidate the query pointer.
@@ -2557,12 +2582,13 @@ setup_lookup(dig_lookup_t *lookup) {
 		query->waiting_senddone = false;
 		query->pending_free = false;
 		query->recv_made = false;
 -		query->first_pass = true;
 +		query->started = false;
 		query->first_soa_rcvd = false;
 		query->second_rr_rcvd = false;
 		query->first_repeat_rcvd = false;
 		query->warn_id = true;
 		query->timedout = false;
 +		query->canceled = false;
 		query->first_rr_serial = 0;
 		query->second_rr_serial = 0;
 		query->servname = serv->servername;
@@ -2660,6 +2686,7 @@ cancel_lookup(dig_lookup_t *lookup) {
 	while (query != NULL) {
 		REQUIRE(DIG_VALID_QUERY(query));
 		next = ISC_LIST_NEXT(query, link);
 +		query->canceled = true;
 		if (query->sock != NULL) {
 			isc_socket_cancel(query->sock, global_task,
 					  ISC_SOCKCANCEL_ALL);
@@ -2902,6 +2929,12 @@ send_udp(dig_query_t *query) {
 			return;
 		}
 +		query->started = true;
 +		if (atomic_load(&cancel_now)) {
 +			return;
 +		}
 +		INSIST(!free_now);
 +
 		result = isc_socket_create(socketmgr,
 					   isc_sockaddr_pf(&query->sockaddr),
 					   isc_sockettype_udp, &query->sock);
@@ -3028,6 +3061,10 @@ connect_timeout(isc_task_t *task, isc_event_t *event) {
 				clear_query(query);
 			}
 		}
 +		if (check_if_queries_done(l, query)) {
 +			cancel_lookup(l);
 +			check_next_lookup(l);
 +		}
 		UNLOCK_LOOKUP;
 		return;
 	}
@@ -3283,6 +3320,14 @@ connect_done(isc_task_t *task, isc_event_t *event) {
 	query = sevent->ev_arg;
 	REQUIRE(DIG_VALID_QUERY(query));
 +	query->started = true;
 +
 +	if (atomic_load(&cancel_now)) {
 +		return;
 +	}
 +
 +	INSIST(!free_now);
 +
 	INSIST(query->waiting_connect);
 	query->waiting_connect = false;
@@ -4004,6 +4049,9 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 						 : "recursion not available",
 					 query->servname);
 			clear_query(query);
 +			if (check_if_queries_done(l, query)) {
 +				cancel_lookup(l);
 +			}
 			check_next_lookup(l);
 			dns_message_detach(&msg);
 			isc_event_free(&event);
@@ -4129,7 +4177,12 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 				l->trace_root = false;
 				usesearch = false;
 			} else {
 +				/*
 +				 * This is a query in the followup lookup
 +				 */
 				dighost_printmessage(query, &b, msg, true);
 +
 +				docancel = check_if_queries_done(l, query);
 			}
 		}
 	}
@@ -4309,6 +4362,7 @@ cancel_all(void) {
 			nq = ISC_LIST_NEXT(q, link);
 			debug("canceling pending query %p, belonging to %p", q,
 			      current_lookup);
 +			q->canceled = true;
 			if (q->sock != NULL) {
 				isc_socket_cancel(q->sock, NULL,
 						  ISC_SOCKCANCEL_ALL);
@@ -4322,6 +4376,7 @@ cancel_all(void) {
 			nq = ISC_LIST_NEXT(q, clink);
 			debug("canceling connecting query %p, belonging to %p",
 			      q, current_lookup);
 +			q->canceled = true;
 			if (q->sock != NULL) {
 				isc_socket_cancel(q->sock, NULL,
 						  ISC_SOCKCANCEL_ALL);
 diff --git a/bin/dig/include/dig/dig.h b/bin/dig/include/dig/dig.h
 index 8bf9613db3..d7eb49963c 100644
 --- a/bin/dig/include/dig/dig.h
 +++ b/bin/dig/include/dig/dig.h
@@ -168,9 +168,9 @@ struct dig_lookup {
 struct dig_query {
 	unsigned int  magic;
 	dig_lookup_t *lookup;
 -	bool waiting_connect, pending_free, waiting_senddone, first_pass,
 +	bool waiting_connect, pending_free, waiting_senddone, started,
 		first_soa_rcvd, second_rr_rcvd, first_repeat_rcvd, recv_made,
 -		warn_id, timedout;
 +		warn_id, timedout, canceled;
 	uint32_t      first_rr_serial;
 	uint32_t      second_rr_serial;
 	uint32_t      msg_count;
 diff --git a/bin/tests/system/digdelv/tests.sh b/bin/tests/system/digdelv/tests.sh
 index fd7b383608..13044f4102 100644
 --- a/bin/tests/system/digdelv/tests.sh
 +++ b/bin/tests/system/digdelv/tests.sh
@@ -1040,6 +1040,15 @@ if [ -x "$DIG" ]; then
   if [ $ret -ne 0 ]; then echo_i "failed"; fi
   status=$((status + ret))
 +  # See [GL #3248] for more information
 +  n=$((n+1))
 +  echo_i "check that dig correctly refuses to use a server with a IPv4 mapped IPv6 address after failing with a regular IP address ($n)"
 +  ret=0
 +  dig_with_opts +nomapped @10.53.0.8 @::ffff:10.53.0.8 a.example > dig.out.test$n 2>&1 || ret=1
 +  grep -F ";; Skipping mapped address" dig.out.test$n > /dev/null || ret=1
 +  grep -F ";; No acceptable nameservers" dig.out.test$n > /dev/null || ret=1
 +  if [ $ret -ne 0 ]; then echo_i "failed"; fi
 +  status=$((status+ret))
 else
   echo_i "$DIG is needed, so skipping these dig tests"
 fi
--- a/SOURCES/bind-9.18-fix-qmin-test.patch
+++ b/SOURCES/bind-9.18-fix-qmin-test.patch
@ -0,0 +1,31 @@
 From e4b0698dc5e98b951050299c28be94514427688b Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
 Date: Tue, 18 Jun 2024 08:56:18 +0200
 Subject: [PATCH] Use LC_ALL to override all system locales
 The system tests were overriding the local locale by setting LANG to C.
 This does not override the locale in case there are individual LC_<*>
 variables like LC_CTYPE explicitly set.
 Use LC_ALL=C instead which is the proper way of overriding all currently
 set locales.
 ---
 bin/tests/system/conf.sh.common | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/bin/tests/system/conf.sh.common b/bin/tests/system/conf.sh.common
 index a91c0d9f4e..2b0bc20896 100644
 --- a/bin/tests/system/conf.sh.common
 +++ b/bin/tests/system/conf.sh.common
@@ -20,7 +20,7 @@ testsock6() {
 	fi
 }
 -export LANG=C
 +export LC_ALL=C
 . ${TOP}/version
 -- 
 2.53.0
--- a/SOURCES/bind-9.18-partial-additional-records.patch
+++ b/SOURCES/bind-9.18-partial-additional-records.patch
@ -0,0 +1,54 @@
 From 9140eac85cda21fa86f2768f7ccaf6800776c726 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 19 Jun 2025 19:51:43 +0200
 Subject: [PATCH] Limit number of additional records fetched
 Limit number of started fetches for additional zone instead of doing
 none. Keep limit of NS filled with additional records, but present at
 least some if possible.
 Might help broken implementations relying on receiving addresses in the
 response for NS query in authoritative zone.
 ---
 lib/dns/rdataset.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)
 diff --git a/lib/dns/rdataset.c b/lib/dns/rdataset.c
 index ffe6163..cfdb7d5 100644
 --- a/lib/dns/rdataset.c
 +++ b/lib/dns/rdataset.c
@@ -586,6 +586,7 @@ dns_rdataset_additionaldata2(dns_rdataset_t *rdataset,
 			    dns_additionaldatafunc_t add, void *arg, size_t limit) {
 	dns_rdata_t rdata = DNS_RDATA_INIT;
 	isc_result_t result;
 +	size_t n = 0;
 	/*
 	 * For each rdata in rdataset, call 'add' for each name and type in the
@@ -595,10 +596,6 @@ dns_rdataset_additionaldata2(dns_rdataset_t *rdataset,
 	REQUIRE(DNS_RDATASET_VALID(rdataset));
 	REQUIRE((rdataset->attributes & DNS_RDATASETATTR_QUESTION) == 0);
 -	if (limit != 0 && dns_rdataset_count(rdataset) > limit) {
 -		return DNS_R_TOOMANYRECORDS;
 -	}
 -
 	result = dns_rdataset_first(rdataset);
 	if (result != ISC_R_SUCCESS) {
 		return (result);
@@ -608,7 +605,11 @@ dns_rdataset_additionaldata2(dns_rdataset_t *rdataset,
 		dns_rdataset_current(rdataset, &rdata);
 		result = dns_rdata_additionaldata(&rdata, add, arg);
 		if (result == ISC_R_SUCCESS) {
 -			result = dns_rdataset_next(rdataset);
 +			if (limit != 0 && ++n >= limit) {
 +				result = DNS_R_TOOMANYRECORDS;
 +			} else {
 +				result = dns_rdataset_next(rdataset);
 +			}
 		}
 		dns_rdata_reset(&rdata);
 	} while (result == ISC_R_SUCCESS);
 -- 
 2.49.0
--- a/SOURCES/bind-9.18-query-fname-relative.patch
+++ b/SOURCES/bind-9.18-query-fname-relative.patch
@ -0,0 +1,90 @@
 From 5bc7cd7a7b9c37e5c70ccf74c5485a02411aaef5 Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Fri, 25 Apr 2025 02:00:00 +0200
 Subject: [PATCH] Insert additional checks ensuring name is not relative
 Mitigation for crashes put in various places, where obviously relative
 uninitialized name must not appear. This seems unnecessary once true
 cause were identified, but may prevent similar places.
 ---
 lib/ns/query.c | 35 +++++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)
 diff --git a/lib/ns/query.c b/lib/ns/query.c
 index 11d2520..7e8a4d2 100644
 --- a/lib/ns/query.c
 +++ b/lib/ns/query.c
@@ -2203,6 +2203,20 @@ regular:
 	CTRACE(ISC_LOG_DEBUG(3), "query_additional: done");
 }
 +static void
 +log_query_relative(query_ctx_t *qctx, const char *func, const dns_name_t *name) {
 +	if (isc_log_wouldlog(ns_lctx, ISC_LOG_DEBUG(1))) {
 +		char namebuf[DNS_NAME_FORMATSIZE] = "!";
 +		dns_name_format(name, namebuf, sizeof(namebuf));
 +		ns_client_log(
 +			qctx->client, NS_LOGCATEGORY_CLIENT, NS_LOGMODULE_QUERY,
 +			ISC_LOG_DEBUG(1),
 +			"%s: fname=%s leading to relative name, aborting query.",
 +			func, namebuf
 +		);
 +	}
 +}
 +
 static void
 query_addrrset(query_ctx_t *qctx, dns_name_t **namep,
 	       dns_rdataset_t **rdatasetp, dns_rdataset_t **sigrdatasetp,
@@ -2275,6 +2289,11 @@ query_addrrset(query_ctx_t *qctx, dns_name_t **namep,
 		client->query.attributes &= ~NS_QUERYATTR_SECURE;
 	}
 +	if (!qctx->is_zone && mname && !dns_name_isabsolute(mname)) {
 +		log_query_relative(qctx, "query_addrrset", mname);
 +		QUERY_ERROR(qctx, DNS_R_SERVFAIL);
 +		return;
 +	}
 	/*
 	 * Update message name, set rdataset order, and do additional
 	 * section processing if needed.
@@ -8074,6 +8093,11 @@ query_respond_any(query_ctx_t *qctx) {
 							     : qctx->tname;
 				query_prefetch(qctx->client, name,
 					       qctx->rdataset);
 +				if (name && !dns_name_isabsolute(name)) {
 +					log_query_relative(qctx, "query_respond_any", name);
 +					result = DNS_R_DROP;
 +					break;
 +				}
 			}
 			/*
@@ -10696,6 +10720,11 @@ query_cname(query_ctx_t *qctx) {
 	if (!qctx->is_zone && RECURSIONOK(qctx->client)) {
 		query_prefetch(qctx->client, qctx->fname, qctx->rdataset);
 +		if (qctx->fname && !dns_name_isabsolute(qctx->fname)) {
 +			log_query_relative(qctx, "query_cname", qctx->fname);
 +			QUERY_ERROR(qctx, DNS_R_SERVFAIL);
 +			return (ns_query_done(qctx));
 +		}
 	}
 	query_addrrset(qctx, &qctx->fname, &qctx->rdataset, sigrdatasetp,
@@ -10801,7 +10830,13 @@ query_dname(query_ctx_t *qctx) {
 	if (!qctx->is_zone && RECURSIONOK(qctx->client)) {
 		query_prefetch(qctx->client, qctx->fname, qctx->rdataset);
 +		if (qctx->fname && !dns_name_isabsolute(qctx->fname)) {
 +			log_query_relative(qctx, "query_dname", qctx->fname);
 +			QUERY_ERROR(qctx, DNS_R_SERVFAIL);
 +			return (ns_query_done(qctx));
 +		}
 	}
 +
 	query_addrrset(qctx, &qctx->fname, &qctx->rdataset, sigrdatasetp,
 		       qctx->dbuf, DNS_SECTION_ANSWER);
 -- 
 2.49.0
--- a/SOURCES/bind-9.20-robust-key-rollovers.patch
+++ b/SOURCES/bind-9.20-robust-key-rollovers.patch
@ -0,0 +1,97 @@
 diff --git a/lib/dns/keymgr.c b/lib/dns/keymgr.c
 index 6c04682004..8eda1535a0 100644
 --- a/lib/dns/keymgr.c
 +++ b/lib/dns/keymgr.c
@@ -1154,19 +1154,18 @@ static bool
 keymgr_transition_allowed(dns_dnsseckeylist_t *keyring, dns_dnsseckey_t *key,
 			  int type, dst_key_state_t next_state,
 			  bool secure_to_insecure) {
 +	bool rule1a, rule1b, rule2a, rule2b, rule3a, rule3b;
 +	rule1a = keymgr_have_ds(keyring, key, type, NA, secure_to_insecure);
 +	rule1b = keymgr_have_ds(keyring, key, type, next_state, secure_to_insecure);
 +	rule2a = keymgr_have_dnskey(keyring, key, type, NA);
 +	rule2b = keymgr_have_dnskey(keyring, key, type, next_state);
 +	rule3a = keymgr_have_rrsig(keyring, key, type, NA);
 +	rule3b = keymgr_have_rrsig(keyring, key, type, next_state);
 +
 	/* Debug logging. */
 	if (isc_log_wouldlog(dns_lctx, ISC_LOG_DEBUG(1))) {
 -		bool rule1a, rule1b, rule2a, rule2b, rule3a, rule3b;
 		char keystr[DST_KEY_FORMATSIZE];
 		dst_key_format(key->key, keystr, sizeof(keystr));
 -		rule1a = keymgr_have_ds(keyring, key, type, NA,
 -					secure_to_insecure);
 -		rule1b = keymgr_have_ds(keyring, key, type, next_state,
 -					secure_to_insecure);
 -		rule2a = keymgr_have_dnskey(keyring, key, type, NA);
 -		rule2b = keymgr_have_dnskey(keyring, key, type, next_state);
 -		rule3a = keymgr_have_rrsig(keyring, key, type, NA);
 -		rule3b = keymgr_have_rrsig(keyring, key, type, next_state);
 		isc_log_write(
 			dns_lctx, DNS_LOGCATEGORY_DNSSEC, DNS_LOGMODULE_DNSSEC,
 			ISC_LOG_DEBUG(1),
@@ -1179,30 +1178,40 @@ keymgr_transition_allowed(dns_dnsseckeylist_t *keyring, dns_dnsseckey_t *key,
 			rule3a ? "true" : "false", rule3b ? "true" : "false");
 	}
 -	return (
 -		/*
 -		 * Rule 1: There must be a DS at all times.
 -		 * First check the current situation: if the rule check fails,
 -		 * we allow the transition to attempt to move us out of the
 -		 * invalid state.  If the rule check passes, also check if
 -		 * the next state is also still a valid situation.
 -		 */
 -		(!keymgr_have_ds(keyring, key, type, NA, secure_to_insecure) ||
 -		 keymgr_have_ds(keyring, key, type, next_state,
 -				secure_to_insecure)) &&
 -		/*
 -		 * Rule 2: There must be a DNSKEY at all times.  Again, first
 -		 * check the current situation, then assess the next state.
 -		 */
 -		(!keymgr_have_dnskey(keyring, key, type, NA) ||
 -		 keymgr_have_dnskey(keyring, key, type, next_state)) &&
 -		/*
 -		 * Rule 3: There must be RRSIG records at all times. Again,
 -		 * first check the current situation, then assess the next
 -		 * state.
 -		 */
 -		(!keymgr_have_rrsig(keyring, key, type, NA) ||
 -		 keymgr_have_rrsig(keyring, key, type, next_state)));
 +	/*
 +	 * Rule checking:
 +	 * First check the current situation: if the rule check fails,
 +	 * we allow the transition to attempt to move us out of the
 +	 * invalid state.  If the rule check passes, also check if
 +	 * the next state is also still a valid situation.
 +	 */
 +	char keystr2[DST_KEY_FORMATSIZE];
 +	dst_key_format(key->key, keystr2, sizeof(keystr2));
 +
 +	/*
 +	 * Rule 1: There must be a DS at all times.
 +	 */
 +	if (!rule1a && !rule1b && next_state == UNRETENTIVE) {
 +		return false;
 +	}
 +	/*
 +	 * Rule 2: There must be a DNSKEY at all times.  Again, first
 +	 * check the current situation, then assess the next state.
 +	 */
 +	if (!rule2a && !rule2b && next_state == UNRETENTIVE) {
 +		return false;
 +	}
 +	/*
 +	 * Rule 3: There must be RRSIG records at all times. Again,
 +	 * first check the current situation, then assess the next
 +	 * state.
 +	 */
 +	if (!rule3a && !rule3b && next_state == UNRETENTIVE) {
 +		return false;
 +	}
 +
 +	return (!rule1a || rule1b) && (!rule2a || rule2b) &&
 +		   (!rule3a || rule3b);
 }
 /*
--- a/SOURCES/bind-9.20-stale-cname-tests.patch
+++ b/SOURCES/bind-9.20-stale-cname-tests.patch
@ -0,0 +1,92 @@
 diff --git a/bin/tests/system/serve-stale/ns1/stale.test.db b/bin/tests/system/serve-stale/ns1/stale.test.db
 index d389e7c6a6..128fb25a10 100644
 --- a/bin/tests/system/serve-stale/ns1/stale.test.db
 +++ b/bin/tests/system/serve-stale/ns1/stale.test.db
@@ -17,3 +17,11 @@ cname1.stale.test.	1	CNAME	a1.stale.test.
 a1.stale.test.		1	A	192.0.2.1
 cname2.stale.test.	1	CNAME	a2.stale.test.
 a2.stale.test.		300	A	192.0.2.2
 +
 +cname-a1		1	CNAME	cname-a2
 +cname-a2		300	CNAME	cname-a3
 +cname-a3		300	A	192.0.2.1
 +
 +cname-b1		300	CNAME	cname-b2
 +cname-b2		1	CNAME	cname-b3
 +cname-b3		1	A	192.0.2.2
 diff --git a/bin/tests/system/serve-stale/tests.sh b/bin/tests/system/serve-stale/tests.sh
 index 0ae32f22c1..925e5086eb 100755
 --- a/bin/tests/system/serve-stale/tests.sh
 +++ b/bin/tests/system/serve-stale/tests.sh
@@ -2163,6 +2163,71 @@ if [ $ret != 0 ]; then
 fi
 status=$((status + ret))
 +# New CNAME scenario (GL #5243)
 +n=$((n + 1))
 +echo_i "prime cache cname-a1.stale.test A (stale-answer-client-timeout 0) ($n)"
 +ret=0
 +$DIG -p ${PORT} @10.53.0.3 cname-a1.stale.test A >dig.out.test$n || ret=1
 +grep "status: NOERROR" dig.out.test$n >/dev/null || ret=1
 +grep "ANSWER: 3," dig.out.test$n >/dev/null || ret=1
 +grep "cname-a1\.stale\.test\..*1.*IN.*CNAME.*cname-a2\.stale\.test\." dig.out.test$n >/dev/null || ret=1
 +grep "cname-a2\.stale\.test\..*300.*IN.*CNAME.*cname-a3\.stale\.test\." dig.out.test$n >/dev/null || ret=1
 +grep "cname-a3\.stale\.test\..*300.*IN.*A.*192\.0\.2\.1" dig.out.test$n >/dev/null || ret=1
 +if [ $ret != 0 ]; then echo_i "failed"; fi
 +status=$((status + ret))
 +
 +n=$((n + 1))
 +echo_i "prime cache cname-b1.stale.test A (stale-answer-client-timeout 0) ($n)"
 +ret=0
 +$DIG -p ${PORT} @10.53.0.3 cname-b1.stale.test A >dig.out.test$n || ret=1
 +grep "status: NOERROR" dig.out.test$n >/dev/null || ret=1
 +grep "ANSWER: 3," dig.out.test$n >/dev/null || ret=1
 +grep "cname-b1\.stale\.test\..*300.*IN.*CNAME.*cname-b2\.stale\.test\." dig.out.test$n >/dev/null || ret=1
 +grep "cname-b2\.stale\.test\..*1.*IN.*CNAME.*cname-b3\.stale\.test\." dig.out.test$n >/dev/null || ret=1
 +grep "cname-b3\.stale\.test\..*1.*IN.*A.*192\.0\.2\.2" dig.out.test$n >/dev/null || ret=1
 +if [ $ret != 0 ]; then echo_i "failed"; fi
 +status=$((status + ret))
 +
 +# Allow RRset to become stale.
 +sleep 1
 +
 +n=$((n + 1))
 +ret=0
 +echo_i "check stale cname-a1.stale.test A comes from cache (stale-answer-client-timeout 0) ($n)"
 +nextpart ns3/named.run >/dev/null
 +$DIG -p ${PORT} @10.53.0.3 cname-a1.stale.test A >dig.out.test$n || ret=1
 +wait_for_log 5 "cname-a1.stale.test A stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
 +# Other records in chain are still good, so do not attempt a refresh
 +grep "cname-a2.stale.test A stale answer used, an attempt to refresh the RRset" ns3/named.run && ret=1
 +grep "cname-a3.stale.test A stale answer used, an attempt to refresh the RRset" ns3/named.run && ret=1
 +# Check answer
 +grep "status: NOERROR" dig.out.test$n >/dev/null || ret=1
 +grep "ANSWER: 3," dig.out.test$n >/dev/null || ret=1
 +grep "cname-a1\.stale\.test\..*3.*IN.*CNAME.*cname-a2\.stale\.test\." dig.out.test$n >/dev/null || ret=1
 +grep "cname-a2\.stale\.test\..*29[0-9].*IN.*CNAME.*cname-a3\.stale\.test\." dig.out.test$n >/dev/null || ret=1
 +grep "cname-a3\.stale\.test\..*29[0-9].*IN.*A.*192\.0\.2\.1" dig.out.test$n >/dev/null || ret=1
 +if [ $ret != 0 ]; then echo_i "failed"; fi
 +status=$((status + ret))
 +
 +n=$((n + 1))
 +ret=0
 +echo_i "check stale cname-b1.stale.test A comes from cache (stale-answer-client-timeout 0) ($n)"
 +nextpart ns3/named.run >/dev/null
 +$DIG -p ${PORT} @10.53.0.3 cname-b1.stale.test A >dig.out.test$n || ret=1
 +wait_for_log 5 "cname-b2.stale.test A stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
 +# The next one in the chain (cname-b3.stale.test) is likely not logged because
 +# there is already a refresh in progress. And the first record in the chain is
 +# still good, so do not attempt a refresh.
 +grep "cname-b1.stale.test A stale answer used, an attempt to refresh the RRset" ns3/named.run && ret=1
 +# Check answer
 +grep "status: NOERROR" dig.out.test$n >/dev/null || ret=1
 +grep "ANSWER: 3," dig.out.test$n >/dev/null || ret=1
 +grep "cname-b1\.stale\.test\..*29[0-9].*IN.*CNAME.*cname-b2\.stale\.test\." dig.out.test$n >/dev/null || ret=1
 +grep "cname-b2\.stale\.test\..*3.*IN.*CNAME.*cname-b3\.stale\.test\." dig.out.test$n >/dev/null || ret=1
 +grep "cname-b3\.stale\.test\..*3.*IN.*A.*192\.0\.2\.2" dig.out.test$n >/dev/null || ret=1
 +if [ $ret != 0 ]; then echo_i "failed"; fi
 +status=$((status + ret))
 +
 ####################################################################
 # Test for stale-answer-client-timeout 0 and stale-refresh-time 4. #
 ####################################################################
--- a/SOURCES/bind-9.20-stale-cname.patch
+++ b/SOURCES/bind-9.20-stale-cname.patch
@ -0,0 +1,707 @@
 diff --git a/bin/tests/system/serve-stale/tests.sh b/bin/tests/system/serve-stale/tests.sh
 index d767769ad8..0ae32f22c1 100755
 --- a/bin/tests/system/serve-stale/tests.sh
 +++ b/bin/tests/system/serve-stale/tests.sh
@@ -1965,7 +1965,7 @@ ret=0
 echo_i "check stale nodata.example TXT comes from cache (stale-answer-client-timeout 0) ($n)"
 nextpart ns3/named.run >/dev/null
 $DIG -p ${PORT} @10.53.0.3 nodata.example TXT >dig.out.test$n || ret=1
 -wait_for_log 5 "nodata.example stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
 +wait_for_log 5 "nodata.example TXT stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
 grep "status: NOERROR" dig.out.test$n >/dev/null || ret=1
 grep "ANSWER: 0," dig.out.test$n >/dev/null || ret=1
 grep "example\..*3.*IN.*SOA" dig.out.test$n >/dev/null || ret=1
@@ -1977,7 +1977,7 @@ ret=0
 echo_i "check stale data.example TXT comes from cache (stale-answer-client-timeout 0) ($n)"
 nextpart ns3/named.run >/dev/null
 $DIG -p ${PORT} @10.53.0.3 data.example TXT >dig.out.test$n || ret=1
 -wait_for_log 5 "data.example stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
 +wait_for_log 5 "data.example TXT stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
 grep "status: NOERROR" dig.out.test$n >/dev/null || ret=1
 grep "ANSWER: 1," dig.out.test$n >/dev/null || ret=1
 grep "data\.example\..*3.*IN.*TXT.*A text record with a 2 second ttl" dig.out.test$n >/dev/null || ret=1
@@ -2105,7 +2105,7 @@ ret=0
 echo_i "check stale cname1.stale.test A comes from cache (stale-answer-client-timeout 0) ($n)"
 nextpart ns3/named.run >/dev/null
 $DIG -p ${PORT} @10.53.0.3 cname1.stale.test A >dig.out.test$n || ret=1
 -wait_for_log 5 "cname1.stale.test stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
 +wait_for_log 5 "cname1.stale.test A stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
 grep "status: NOERROR" dig.out.test$n >/dev/null || ret=1
 grep "ANSWER: 2," dig.out.test$n >/dev/null || ret=1
 grep "cname1\.stale\.test\..*3.*IN.*CNAME.*a1\.stale\.test\." dig.out.test$n >/dev/null || ret=1
@@ -2143,7 +2143,7 @@ ret=0
 echo_i "check stale cname2.stale.test A comes from cache (stale-answer-client-timeout 0) ($n)"
 nextpart ns3/named.run >/dev/null
 $DIG -p ${PORT} @10.53.0.3 cname2.stale.test A >dig.out.test$n || ret=1
 -wait_for_log 5 "cname2.stale.test stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
 +wait_for_log 5 "cname2.stale.test A stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
 grep "status: NOERROR" dig.out.test$n >/dev/null || ret=1
 grep "ANSWER: 2," dig.out.test$n >/dev/null || ret=1
 grep "cname2\.stale\.test\..*3.*IN.*CNAME.*a2\.stale\.test\." dig.out.test$n >/dev/null || ret=1
@@ -2219,7 +2219,7 @@ ret=0
 echo_i "check stale data.example TXT comes from cache (stale-answer-client-timeout 0 stale-refresh-time 4) ($n)"
 nextpart ns3/named.run >/dev/null
 $DIG -p ${PORT} @10.53.0.3 data.example TXT >dig.out.test$n || ret=1
 -wait_for_log 5 "data.example stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
 +wait_for_log 5 "data.example TXT stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
 grep "status: NOERROR" dig.out.test$n >/dev/null || ret=1
 grep "ANSWER: 1," dig.out.test$n >/dev/null || ret=1
 grep "data\.example\..*3.*IN.*TXT.*A text record with a 2 second ttl" dig.out.test$n >/dev/null || ret=1
@@ -2262,7 +2262,7 @@ ret=0
 echo_i "check stale data.example TXT comes from cache (stale-answer-client-timeout 0 stale-refresh-time 4) ($n)"
 nextpart ns3/named.run >/dev/null
 $DIG -p ${PORT} @10.53.0.3 data.example TXT >dig.out.test$n || ret=1
 -wait_for_log 5 "data.example stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
 +wait_for_log 5 "data.example TXT stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
 grep "status: NOERROR" dig.out.test$n >/dev/null || ret=1
 grep "ANSWER: 1," dig.out.test$n >/dev/null || ret=1
 grep "data\.example\..*3.*IN.*TXT.*A text record with a 2 second ttl" dig.out.test$n >/dev/null || ret=1
@@ -2273,7 +2273,7 @@ status=$((status + ret))
 n=$((n + 1))
 ret=0
 echo_i "wait until resolver query times out, activating stale-refresh-time"
 -wait_for_log 15 "data.example resolver failure, stale answer used" ns3/named.run || ret=1
 +wait_for_log 15 "data.example/TXT stale refresh failed: timed out" ns3/named.run || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
@@ -2322,7 +2322,7 @@ n=$((n + 1))
 ret=0
 echo_i "check stale data.example TXT comes from cache (stale-answer-client-timeout 0 stale-refresh-time 4) ($n)"
 $DIG -p ${PORT} @10.53.0.3 data.example TXT >dig.out.test$n || ret=1
 -wait_for_log 5 "data.example stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
 +wait_for_log 5 "data.example TXT stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
 grep "status: NOERROR" dig.out.test$n >/dev/null || ret=1
 grep "ANSWER: 1," dig.out.test$n >/dev/null || ret=1
 grep "data\.example\..*3.*IN.*TXT.*A text record with a 2 second ttl" dig.out.test$n >/dev/null || ret=1
 diff --git a/lib/dns/include/dns/rdataset.h b/lib/dns/include/dns/rdataset.h
 index de3f638f89..38d1d65ed2 100644
 --- a/lib/dns/include/dns/rdataset.h
 +++ b/lib/dns/include/dns/rdataset.h
@@ -193,7 +193,7 @@ struct dns_rdataset {
 #define DNS_RDATASETATTR_STALE	      0x01000000
 #define DNS_RDATASETATTR_ANCIENT      0x02000000
 #define DNS_RDATASETATTR_STALE_WINDOW 0x04000000
 -#define DNS_RDATASETATTR_STALE_ADDED  0x08000000
 +#define DNS_RDATASETATTR_KEEPCASE     0x10000000
 /*%
  * _OMITDNSSEC:
 diff --git a/lib/ns/include/ns/client.h b/lib/ns/include/ns/client.h
 index d1e2fde407..a50332e656 100644
 --- a/lib/ns/include/ns/client.h
 +++ b/lib/ns/include/ns/client.h
@@ -192,6 +192,7 @@ struct ns_client {
 					   (query, update, notify) */
 	isc_nmhandle_t *fetchhandle;	/* Waiting for recursive fetch */
 	isc_nmhandle_t *prefetchhandle; /* Waiting for prefetch / rpzfetch */
 +	isc_nmhandle_t *stalerefreshhandle;
 	isc_nmhandle_t *updatehandle;	/* Waiting for update callback */
 	unsigned char  *tcpbuf;
 	dns_message_t  *message;
 diff --git a/lib/ns/include/ns/query.h b/lib/ns/include/ns/query.h
 index be0dadd509..9c96c45138 100644
 --- a/lib/ns/include/ns/query.h
 +++ b/lib/ns/include/ns/query.h
@@ -68,6 +68,7 @@ struct ns_query {
 	isc_mutex_t	 fetchlock;
 	dns_fetch_t	*fetch;
 	dns_fetch_t	*prefetch;
 +	dns_fetch_t	*stalerefresh;
 	dns_rpz_st_t	*rpz_st;
 	isc_bufferlist_t namebufs;
 	ISC_LIST(ns_dbversion_t) activeversions;
@@ -118,7 +119,6 @@ struct ns_query {
 #define NS_QUERYATTR_RRL_CHECKED     0x010000
 #define NS_QUERYATTR_REDIRECT	     0x020000
 #define NS_QUERYATTR_ANSWERED	     0x040000
 -#define NS_QUERYATTR_STALEOK	     0x080000
 #define NS_QUERYATTR_STALEPENDING    0x100000
 typedef struct query_ctx query_ctx_t;
@@ -147,7 +147,6 @@ struct query_ctx {
 	bool authoritative;		    /* authoritative query? */
 	bool want_restart;		    /* CNAME chain or other
 					     * restart needed */
 -	bool		refresh_rrset;	    /* stale RRset refresh needed */
 	bool		need_wildcardproof; /* wildcard proof needed */
 	bool		nxrewrite;	    /* negative answer from RPZ */
 	bool		findcoveringnsec;   /* lookup covering NSEC */
 diff --git a/lib/ns/query.c b/lib/ns/query.c
 index 1290c308af..4ea63caf37 100644
 --- a/lib/ns/query.c
 +++ b/lib/ns/query.c
@@ -142,9 +142,6 @@
 #define QUERY_STALEPENDING(q) \
 	(((q)->attributes & NS_QUERYATTR_STALEPENDING) != 0)
 -/*% Does the query allow stale data in the response? */
 -#define QUERY_STALEOK(q) (((q)->attributes & NS_QUERYATTR_STALEOK) != 0)
 -
 /*% Does the query wants to check for stale RRset due to a timeout? */
 #define QUERY_STALETIMEOUT(q) (((q)->dboptions & DNS_DBFIND_STALETIMEOUT) != 0)
@@ -242,6 +239,15 @@ static void
 log_noexistnodata(void *val, int level, const char *fmt, ...)
 	ISC_FORMAT_PRINTF(3, 4);
 +static isc_result_t
 +qctx_prepare_buffers(query_ctx_t *qctx, isc_buffer_t *buffer);
 +
 +static void
 +qctx_freedata(query_ctx_t *qctx);
 +
 +static void
 +qctx_destroy(query_ctx_t *qctx);
 +
 /*
  * Return the hooktable in use with 'qctx', or if there isn't one
  * set, return the default hooktable.
@@ -497,9 +503,6 @@ query_addwildcardproof(query_ctx_t *qctx, bool ispositive, bool nodata);
 static void
 query_addauth(query_ctx_t *qctx);
 -static void
 -query_clear_stale(ns_client_t *client);
 -
 /*
  * Increment query statistics counters.
  */
@@ -801,6 +804,7 @@ ns_query_init(ns_client_t *client) {
 	client->query.fetch = NULL;
 	client->query.prefetch = NULL;
 +	client->query.stalerefresh = NULL;
 	client->query.authdb = NULL;
 	client->query.authzone = NULL;
 	client->query.authdbset = false;
@@ -2186,10 +2190,6 @@ query_addrrset(query_ctx_t *qctx, dns_name_t **namep,
 		if ((rdataset->attributes & DNS_RDATASETATTR_REQUIRED) != 0) {
 			mrdataset->attributes |= DNS_RDATASETATTR_REQUIRED;
 		}
 -		if ((rdataset->attributes & DNS_RDATASETATTR_STALE_ADDED) != 0)
 -		{
 -			mrdataset->attributes |= DNS_RDATASETATTR_STALE_ADDED;
 -		}
 		return;
 	} else if (result == DNS_R_NXDOMAIN) {
 		/*
@@ -2475,6 +2475,85 @@ free_devent(ns_client_t *client, isc_event_t **eventp,
 	isc_event_free(eventp);
 }
 +static void
 +stale_refresh_aftermath(ns_client_t *client, isc_result_t result) {
 +	dns_db_t *db = NULL;
 +	unsigned int dboptions;
 +	isc_buffer_t buffer;
 +	query_ctx_t qctx;
 +	dns_clientinfomethods_t cm;
 +	dns_clientinfo_t ci;
 +	char namebuf[DNS_NAME_FORMATSIZE];
 +	char typebuf[DNS_RDATATYPE_FORMATSIZE];
 +
 +	/*
 +	 * If refreshing a stale RRset failed, we need to set the
 +	 * stale-refresh-time window, so that on future requests for this
 +	 * RRset the stale entry may be used immediately.
 +	 */
 +	switch (result) {
 +	case ISC_R_SUCCESS:
 +	case DNS_R_GLUE:
 +	case DNS_R_ZONECUT:
 +	case ISC_R_NOTFOUND:
 +	case DNS_R_DELEGATION:
 +	case DNS_R_EMPTYNAME:
 +	case DNS_R_NXRRSET:
 +	case DNS_R_EMPTYWILD:
 +	case DNS_R_NXDOMAIN:
 +	case DNS_R_COVERINGNSEC:
 +	case DNS_R_NCACHENXDOMAIN:
 +	case DNS_R_NCACHENXRRSET:
 +	case DNS_R_CNAME:
 +	case DNS_R_DNAME:
 +		break;
 +	default:
 +		dns_name_format(client->query.qname, namebuf, sizeof(namebuf));
 +		dns_rdatatype_format(client->query.qtype, typebuf,
 +				     sizeof(typebuf));
 +		ns_client_log(client, NS_LOGCATEGORY_SERVE_STALE,
 +			      NS_LOGMODULE_QUERY, ISC_LOG_NOTICE,
 +			      "%s/%s stale refresh failed: timed out", namebuf,
 +			      typebuf);
 +
 +		/*
 +		 * Set up a short lived query context, solely to set the
 +		 * last refresh failure time on the RRset in the cache
 +		 * database, starting the stale-refresh-time window for it.
 +		 * This is a condensed form of query_lookup().
 +		 */
 +		isc_stdtime_get(&client->now);
 +		client->query.attributes &= ~NS_QUERYATTR_RECURSIONOK;
 +		qctx_init(client, NULL, 0, &qctx);
 +
 +		dns_clientinfomethods_init(&cm, ns_client_sourceip);
 +		dns_clientinfo_init(&ci, qctx.client, HAVEECS(qctx.client) ? &qctx.client->ecs : NULL, NULL);
 +
 +		result = qctx_prepare_buffers(&qctx, &buffer);
 +		if (result != ISC_R_SUCCESS) {
 +			goto cleanup;
 +		}
 +
 +		dboptions = qctx.client->query.dboptions;
 +		dboptions |= DNS_DBFIND_STALEOK;
 +		dboptions |= DNS_DBFIND_STALESTART;
 +
 +		dns_db_attach(qctx.client->view->cachedb, &db);
 +		(void)dns_db_findext(db, qctx.client->query.qname, NULL,
 +				     qctx.client->query.qtype, dboptions,
 +				     qctx.client->now, &qctx.node, qctx.fname,
 +				     &cm, &ci, qctx.rdataset, qctx.sigrdataset);
 +		if (qctx.node != NULL) {
 +			dns_db_detachnode(db, &qctx.node);
 +		}
 +		dns_db_detach(&db);
 +
 +	cleanup:
 +		qctx_freedata(&qctx);
 +		qctx_destroy(&qctx);
 +	}
 +}
 +
 static void
 prefetch_done(isc_task_t *task, isc_event_t *event) {
 	dns_fetchevent_t *devent = (dns_fetchevent_t *)event;
@@ -2509,6 +2588,133 @@ prefetch_done(isc_task_t *task, isc_event_t *event) {
 	isc_nmhandle_detach(&client->prefetchhandle);
 }
 +static void
 +refresh_done(isc_task_t *task, isc_event_t *event) {
 +	dns_fetchevent_t *devent = (dns_fetchevent_t *)event;
 +	ns_client_t *client;
 +
 +	UNUSED(task);
 +
 +	REQUIRE(event->ev_type == DNS_EVENT_FETCHDONE);
 +	client = devent->ev_arg;
 +	REQUIRE(NS_CLIENT_VALID(client));
 +	REQUIRE(task == client->task);
 +
 +	CTRACE(ISC_LOG_DEBUG(3), "refresh_done");
 +
 +	LOCK(&client->query.fetchlock);
 +	if (client->query.stalerefresh != NULL) {
 +		INSIST(devent->fetch == client->query.stalerefresh);
 +		client->query.stalerefresh = NULL;
 +	}
 +	UNLOCK(&client->query.fetchlock);
 +
 +	stale_refresh_aftermath(client, devent->result);
 +
 +	if (client->recursionquota != NULL) {
 +		isc_quota_detach(&client->recursionquota);
 +		ns_stats_decrement(client->sctx->nsstats,
 +				   ns_statscounter_recursclients);
 +	}
 +
 +	free_devent(client, &event, &devent);
 +	isc_nmhandle_detach(&client->stalerefreshhandle);
 +}
 +
 +static void
 +query_stale_refresh(ns_client_t *client, dns_name_t *qname,
 +					dns_rdataset_t *rdataset) {
 +	isc_result_t result;
 +	isc_sockaddr_t *peeraddr;
 +	dns_rdataset_t *tmprdataset;
 +	unsigned int options;
 +
 +	CTRACE(ISC_LOG_DEBUG(3), "query_stale_refresh");
 +
 +	bool stale_refresh_window = false;
 +	bool stale_rrset = true;
 +
 +	if (rdataset != NULL) {
 +		stale_refresh_window =
 +			(STALE_WINDOW(rdataset) &&
 +			(client->query.dboptions & DNS_DBFIND_STALEENABLED) != 0);
 +		stale_rrset = STALE(rdataset);
 +	}
 +
 +	if (client->query.stalerefresh != NULL ||
 +		(client->query.dboptions & DNS_DBFIND_STALETIMEOUT) == 0 ||
 +		!stale_rrset || stale_refresh_window)
 +	{
 +		return;
 +	}
 +
 +	char namebuf[DNS_NAME_FORMATSIZE];
 +	char typebuf[DNS_RDATATYPE_FORMATSIZE];
 +	dns_name_format(qname, namebuf, sizeof(namebuf));
 +	dns_rdatatype_format(client->query.qtype, typebuf, sizeof(typebuf));
 +	isc_log_write(ns_lctx, NS_LOGCATEGORY_SERVE_STALE, NS_LOGMODULE_QUERY,
 +			ISC_LOG_INFO,
 +			"%s %s stale answer used, an attempt "
 +			"to refresh the RRset will still be "
 +			"made",
 +			namebuf, typebuf);
 +
 +	client->query.dboptions &= ~(DNS_DBFIND_STALETIMEOUT |
 +				     DNS_DBFIND_STALEOK |
 +				     DNS_DBFIND_STALEENABLED);
 +
 +	if (client->recursionquota == NULL) {
 +		result = isc_quota_attach(&client->sctx->recursionquota,
 +					  &client->recursionquota);
 +		switch (result) {
 +			case ISC_R_SUCCESS:
 +				ns_stats_increment(client->sctx->nsstats,
 +						   ns_statscounter_recursclients);
 +				break;
 +			case ISC_R_SOFTQUOTA:
 +				isc_quota_detach(&client->recursionquota);
 +				FALLTHROUGH;
 +			default:
 +				return;
 +		}
 +	}
 +
 +	tmprdataset = ns_client_newrdataset(client);
 +	if (tmprdataset == NULL) {
 +		return;
 +	}
 +
 +	if (!TCP(client)) {
 +		peeraddr = &client->peeraddr;
 +	} else {
 +		peeraddr = NULL;
 +	}
 +
 +	isc_nmhandle_attach(client->handle, &client->stalerefreshhandle);
 +	options = client->query.fetchoptions;
 +	result = dns_resolver_createfetch(
 +		client->view->resolver, qname, client->query.qtype, NULL, NULL, NULL,
 +		peeraddr, client->message->id, options, 0, NULL, client->task,
 +		refresh_done, client, tmprdataset, NULL,
 +		&client->query.stalerefresh);
 +	if (result != ISC_R_SUCCESS) {
 +		ns_client_putrdataset(client, &tmprdataset);
 +		isc_nmhandle_detach(&client->stalerefreshhandle);
 +	}
 +}
 +
 +static void
 +query_stale_refresh_ncache(ns_client_t *client) {
 +	dns_name_t *qname;
 +
 +	if (client->query.origqname != NULL) {
 +		qname = client->query.origqname;
 +	} else {
 +		qname = client->query.qname;
 +	}
 +	query_stale_refresh(client, qname, NULL);
 +}
 +
 static void
 query_prefetch(ns_client_t *client, dns_name_t *qname,
 	       dns_rdataset_t *rdataset) {
@@ -2524,6 +2730,7 @@ query_prefetch(ns_client_t *client, dns_name_t *qname,
 	    rdataset->ttl > client->view->prefetch_trigger ||
 	    (rdataset->attributes & DNS_RDATASETATTR_PREFETCH) == 0)
 	{
 +		query_stale_refresh(client, qname, rdataset);
 		return;
 	}
@@ -2568,6 +2775,7 @@ query_prefetch(ns_client_t *client, dns_name_t *qname,
 	dns_rdataset_clearprefetch(rdataset);
 	ns_stats_increment(client->sctx->nsstats, ns_statscounter_prefetch);
 +	return;
 }
 static void
@@ -5696,55 +5904,6 @@ error:
 	return (ISC_R_NOMEMORY);
 }
 -/*
 - * Setup a new query context for resolving a query.
 - *
 - * This function is only called if both these conditions are met:
 - *    1. BIND is configured with stale-answer-client-timeout 0.
 - *    2. A stale RRset is found in cache during initial query
 - *       database lookup.
 - *
 - * We continue with this function for refreshing/resolving an RRset
 - * after answering a client with stale data.
 - */
 -static void
 -query_refresh_rrset(query_ctx_t *orig_qctx) {
 -	isc_buffer_t buffer;
 -	query_ctx_t qctx;
 -
 -	REQUIRE(orig_qctx != NULL);
 -	REQUIRE(orig_qctx->client != NULL);
 -
 -	qctx_copy(orig_qctx, &qctx);
 -	qctx.client->query.dboptions &= ~(DNS_DBFIND_STALETIMEOUT |
 -					  DNS_DBFIND_STALEOK |
 -					  DNS_DBFIND_STALEENABLED);
 -	qctx.client->nodetach = false;
 -
 -	/*
 -	 * We'll need some resources...
 -	 */
 -	if (qctx_prepare_buffers(&qctx, &buffer) != ISC_R_SUCCESS) {
 -		dns_db_detach(&qctx.db);
 -		qctx_destroy(&qctx);
 -		return;
 -	}
 -
 -	/*
 -	 * Pretend we didn't find anything in cache.
 -	 */
 -	(void)query_gotanswer(&qctx, ISC_R_NOTFOUND);
 -
 -	if (qctx.fname != NULL) {
 -		ns_client_releasename(qctx.client, &qctx.fname);
 -	}
 -	if (qctx.rdataset != NULL) {
 -		ns_client_putrdataset(qctx.client, &qctx.rdataset);
 -	}
 -
 -	qctx_destroy(&qctx);
 -}
 -
 /*%
  * Depending on the db lookup result, we can respond to the
  * client this stale answer.
@@ -5814,7 +5973,7 @@ query_lookup(query_ctx_t *qctx) {
 		rpzqname = qctx->client->query.qname;
 	}
 -	if ((qctx->options & DNS_GETDB_STALEFIRST) != 0) {
 +	if ((qctx->options & DNS_GETDB_STALEFIRST) != 0 && !qctx->is_zone) {
 		/*
 		 * If DNS_GETDB_STALEFIRST is set, it means that a stale
 		 * RRset may be returned as part of this lookup. An attempt
@@ -5824,19 +5983,19 @@ query_lookup(query_ctx_t *qctx) {
 		qctx->client->query.dboptions |= DNS_DBFIND_STALETIMEOUT;
 	}
 -	dboptions = qctx->client->query.dboptions;
 -	if (!qctx->is_zone && qctx->findcoveringnsec &&
 -	    (qctx->type != dns_rdatatype_null || !dns_name_istat(rpzqname)))
 -	{
 -		dboptions |= DNS_DBFIND_COVERINGNSEC;
 -	}
 -
 	(void)dns_db_getservestalerefresh(qctx->client->view->cachedb,
 					  &stale_refresh);
 	if (stale_refresh > 0 &&
 	    dns_view_staleanswerenabled(qctx->client->view))
 	{
 -		dboptions |= DNS_DBFIND_STALEENABLED;
 +		qctx->client->query.dboptions |= DNS_DBFIND_STALEENABLED;
 +	}
 +
 +	dboptions = qctx->client->query.dboptions;
 +	if (!qctx->is_zone && qctx->findcoveringnsec &&
 +		(qctx->type != dns_rdatatype_null || !dns_name_istat(rpzqname)))
 +	{
 +		dboptions |= DNS_DBFIND_COVERINGNSEC;
 	}
 	result = dns_db_findext(qctx->db, rpzqname, qctx->version, qctx->type,
@@ -5971,20 +6130,7 @@ query_lookup(query_ctx_t *qctx) {
 				 * Immediately return the stale answer, start a
 				 * resolver fetch to refresh the data in cache.
 				 */
 -				isc_log_write(
 -					ns_lctx, NS_LOGCATEGORY_SERVE_STALE,
 -					NS_LOGMODULE_QUERY, ISC_LOG_INFO,
 -					"%s stale answer used, an attempt to "
 -					"refresh the RRset will still be made",
 -					namebuf);
 -
 -				qctx->refresh_rrset = STALE(qctx->rdataset);
 -
 -				/*
 -				 * If we are refreshing the RRSet, we must not
 -				 * detach from the client in query_send().
 -				 */
 -				qctx->client->nodetach = qctx->refresh_rrset;
 +				qctx->client->nodetach = false;
 			}
 		} else {
 			/*
@@ -6014,76 +6160,12 @@ query_lookup(query_ctx_t *qctx) {
 		}
 	}
 -	if (stale_timeout && (answer_found || stale_found)) {
 -		/*
 -		 * Mark RRsets that we are adding to the client message on a
 -		 * lookup during 'stale-answer-client-timeout', so we can
 -		 * clean it up if needed when we resume from recursion.
 -		 */
 -		qctx->client->query.attributes |= NS_QUERYATTR_STALEOK;
 -		qctx->rdataset->attributes |= DNS_RDATASETATTR_STALE_ADDED;
 -	}
 -
 	result = query_gotanswer(qctx, result);
 cleanup:
 	return (result);
 }
 -/*
 - * Clear all rdatasets from the message that are in the given section and
 - * that have the 'attr' attribute set.
 - */
 -static void
 -message_clearrdataset(dns_message_t *msg, unsigned int attr) {
 -	unsigned int i;
 -	dns_name_t *name, *next_name;
 -	dns_rdataset_t *rds, *next_rds;
 -
 -	/*
 -	 * Clean up name lists by calling the rdataset disassociate function.
 -	 */
 -	for (i = DNS_SECTION_ANSWER; i < DNS_SECTION_MAX; i++) {
 -		name = ISC_LIST_HEAD(msg->sections[i]);
 -		while (name != NULL) {
 -			next_name = ISC_LIST_NEXT(name, link);
 -
 -			rds = ISC_LIST_HEAD(name->list);
 -			while (rds != NULL) {
 -				next_rds = ISC_LIST_NEXT(rds, link);
 -				if ((rds->attributes & attr) != attr) {
 -					rds = next_rds;
 -					continue;
 -				}
 -				ISC_LIST_UNLINK(name->list, rds, link);
 -				INSIST(dns_rdataset_isassociated(rds));
 -				dns_rdataset_disassociate(rds);
 -				isc_mempool_put(msg->rdspool, rds);
 -				rds = next_rds;
 -			}
 -
 -			if (ISC_LIST_EMPTY(name->list)) {
 -				ISC_LIST_UNLINK(msg->sections[i], name, link);
 -				if (dns_name_dynamic(name)) {
 -					dns_name_free(name, msg->mctx);
 -				}
 -				isc_mempool_put(msg->namepool, name);
 -			}
 -
 -			name = next_name;
 -		}
 -	}
 -}
 -
 -/*
 - * Clear any rdatasets from the client's message that were added on a lookup
 - * due to a client timeout.
 - */
 -static void
 -query_clear_stale(ns_client_t *client) {
 -	message_clearrdataset(client->message, DNS_RDATASETATTR_STALE_ADDED);
 -}
 -
 /*
  * Create a new query context with the sole intent of looking up for a stale
  * RRset in cache. If an entry is found, we mark the original query as
@@ -6163,6 +6245,7 @@ fetch_callback(isc_task_t *task, isc_event_t *event) {
 	}
 	client->query.fetchoptions &= ~DNS_FETCHOPT_TRYSTALE_ONTIMEOUT;
 	client->query.dboptions &= ~DNS_DBFIND_STALETIMEOUT;
 +	client->query.dboptions &= ~DNS_DBFIND_STALEENABLED;
 	client->nodetach = false;
 	LOCK(&client->query.fetchlock);
@@ -7303,14 +7386,6 @@ query_usestale(query_ctx_t *qctx, isc_result_t result) {
 		return (false);
 	}
 -	if (qctx->refresh_rrset) {
 -		/*
 -		 * This is a refreshing query, we have already prioritized
 -		 * stale data, so don't enable serve-stale again.
 -		 */
 -		return (false);
 -	}
 -
 	if (result == DNS_R_DUPLICATE || result == DNS_R_DROP ||
 	    result == ISC_R_ALREADYRUNNING)
 	{
@@ -7842,24 +7917,6 @@ query_addanswer(query_ctx_t *qctx) {
 	CALL_HOOK(NS_QUERY_ADDANSWER_BEGIN, qctx);
 -	/*
 -	 * On normal lookups, clear any rdatasets that were added on a
 -	 * lookup due to stale-answer-client-timeout. Do not clear if we
 -	 * are going to refresh the RRset, because the stale contents are
 -	 * prioritized.
 -	 */
 -	if (QUERY_STALEOK(&qctx->client->query) &&
 -	    !QUERY_STALETIMEOUT(&qctx->client->query) && !qctx->refresh_rrset)
 -	{
 -		CCTRACE(ISC_LOG_DEBUG(3), "query_clear_stale");
 -		query_clear_stale(qctx->client);
 -		/*
 -		 * We can clear the attribute to prevent redundant clearing
 -		 * in subsequent lookups.
 -		 */
 -		qctx->client->query.attributes &= ~NS_QUERYATTR_STALEOK;
 -	}
 -
 	if (qctx->dns64) {
 		result = query_dns64(qctx);
 		qctx->noqname = NULL;
@@ -7893,9 +7950,7 @@ query_addanswer(query_ctx_t *qctx) {
 		query_filter64(qctx);
 		ns_client_putrdataset(qctx->client, &qctx->rdataset);
 	} else {
 -		if (!qctx->is_zone && RECURSIONOK(qctx->client) &&
 -		    !QUERY_STALETIMEOUT(&qctx->client->query))
 -		{
 +		if (!qctx->is_zone && RECURSIONOK(qctx->client)) {
 			query_prefetch(qctx->client, qctx->fname,
 				       qctx->rdataset);
 		}
@@ -10138,6 +10193,10 @@ query_ncache(query_ctx_t *qctx, isc_result_t result) {
 		}
 	}
 +	if (!qctx->is_zone && RECURSIONOK(qctx->client)) {
 +		query_stale_refresh_ncache(qctx->client);
 +	}
 +
 	return (query_nodata(qctx, result));
 cleanup:
@@ -11589,20 +11648,6 @@ ns_query_done(query_ctx_t *qctx) {
 	nodetach = qctx->client->nodetach;
 	query_send(qctx->client);
 -	if (qctx->refresh_rrset) {
 -		/*
 -		 * If we reached this point then it means that we have found a
 -		 * stale RRset entry in cache and BIND is configured to allow
 -		 * queries to be answered with stale data if no active RRset
 -		 * is available, i.e. "stale-anwer-client-timeout 0". But, we
 -		 * still need to refresh the RRset. To prevent adding duplicate
 -		 * RRsets, clear the RRsets from the message before doing the
 -		 * refresh.
 -		 */
 -		message_clearrdataset(qctx->client->message, 0);
 -		query_refresh_rrset(qctx);
 -	}
 -
 	if (!nodetach) {
 		qctx->detach_client = true;
 	}
--- a/SOURCES/bind-9.21-resume-qmin-cname.patch
+++ b/SOURCES/bind-9.21-resume-qmin-cname.patch
@ -0,0 +1,44 @@
 From dc97bfa842b9f0d59db075bdcade599f3767f1ba Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Tue, 3 Jun 2025 21:00:58 +0200
 Subject: [PATCH] Handle CNAME and DNAME in resume_min in a special way
 When authoritative zone is loaded when query minimization query for the
 same zone is already pending, it might receive unexpected result codes.
 Normally DNS_R_CNAME would follow to query_cname after processing sent
 events, but dns_view_findzonecut does not fill CNAME target into
 event->foundevent. Usual lookup via query_lookup would always have that
 filled.
 Ideally we would restart the query with unmodified search name, if
 unexpected change from recursing to local zone cut were detected. Until
 dns_view_findzonecut is modified to export zone/cache source of the cut,
 at least fail queries which went into unexpected state.
 ---
 lib/dns/resolver.c | 9 +++++++++
 1 file changed, 9 insertions(+)
 diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
 index be1d735..ad0a1b8 100644
 --- a/lib/dns/resolver.c
 +++ b/lib/dns/resolver.c
@@ -4508,6 +4508,15 @@ resume_qmin(isc_task_t *task, isc_event_t *event) {
 	if (result == DNS_R_NXDOMAIN) {
 		result = DNS_R_SERVFAIL;
 	}
 +	/*
 +	 * CNAME or DNAME means zone were added with that record
 +	 * after the start of query minimization queries. It means
 +	 * we do not have initialized correct hevent->foundname
 +	 * and have to fail.
 +	 */
 +	if (result == DNS_R_CNAME || result == DNS_R_DNAME) {
 +		result = DNS_R_SERVFAIL;
 +	}
 	if (result != ISC_R_SUCCESS) {
 		fctx_done(fctx, result, __LINE__);
 -- 
 2.49.0
--- a/SOURCES/bind-9.3.1rc1-sdb_tools-Makefile.in
+++ b/SOURCES/bind-9.3.1rc1-sdb_tools-Makefile.in
@ -1,63 +0,0 @@
 srcdir     =	@srcdir@
 VPATH      =	@srcdir@
 top_srcdir =	@top_srcdir@
 VERSION=@BIND9_VERSION@
@BIND9_MAKE_INCLUDES@
 CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include \
 		${LWRES_INCLUDES} ${DNS_INCLUDES} ${BIND9_INCLUDES} \
 		${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} ${ISC_INCLUDES}
 CDEFINES =	-DBIND9
 DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
 ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
 ISCCCLIBS =	../../lib/isccc/libisccc.@A@
 ISCLIBS =	../../lib/isc/libisc.@A@
 LWRESLIBS =	../../lib/lwres/liblwres.@A@
 BIND9LIBS =	../../lib/bind9/libbind9.@A@
 DNSDEPLIBS =	../../lib/dns/libdns.@A@
 ISCCFGDEPLIBS =	../../lib/isccfg/libisccfg.@A@
 ISCCCDEPLIBS =	../../lib/isccc/libisccc.@A@
 ISCDEPLIBS =	../../lib/isc/libisc.@A@
 LWRESDEPLIBS =	../../lib/lwres/liblwres.@A@
 BIND9DEPLIBS =	../../lib/bind9/libbind9.@A@
 DEPLIBS =	${LWRESDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
 		${ISCCFGDEPLIBS} ${ISCCCDEPLIBS} ${ISCDEPLIBS}
 LIBS =		${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
 		${ISCCFGLIBS} ${ISCCCLIBS} ${ISCLIBS} ${DBDRIVER_LIBS} @LIBS@
 TARGETS =	zone2ldap@EXEEXT@ zonetodb@EXEEXT@
 OBJS	=	zone2ldap.@O@ zonetodb.@O@
 SRCS    =       zone2ldap.c zonetodb.c
 MANPAGES =      zone2ldap.1
 EXT_CFLAGS =
@BIND9_MAKE_RULES@
 zone2ldap@EXEEXT@: zone2ldap.@O@ ${DEPLIBS}
 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ zone2ldap.@O@ -lldap -llber ${LIBS}
 zonetodb@EXEEXT@: zonetodb.@O@  ${DEPLIBS}
 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ zonetodb.@O@ -lpq ${LIBS}
 clean distclean manclean maintainer-clean::
 	rm -f ${TARGETS} ${OBJS}
 installdirs:
 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man1
 install:: ${TARGETS} installdirs
 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zone2ldap@EXEEXT@ ${DESTDIR}${sbindir}
 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zonetodb@EXEEXT@  ${DESTDIR}${sbindir}
 	${INSTALL_DATA} ${srcdir}/zone2ldap.1 ${DESTDIR}${mandir}/man1/zone2ldap.1
--- a/SOURCES/bind-9.3.2-redhat_doc.patch
+++ b/SOURCES/bind-9.3.2-redhat_doc.patch
@ -1,98 +0,0 @@
 From facdbb0f2a266c6a3a1fa823afaa09cbd3fc38a5 Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Thu, 26 Nov 2020 12:13:10 +0100
 Subject: [PATCH] Note specific Red Hat changes in manual page
 Change docbook template instead of generated manual page. Remove
 system-config-bind reference, package were discontinued.
 ---
 bin/named/named.docbook | 73 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 73 insertions(+)
 diff --git a/bin/named/named.docbook b/bin/named/named.docbook
 index 7e743a9..802bec3 100644
 --- a/bin/named/named.docbook
 +++ b/bin/named/named.docbook
@@ -516,6 +516,79 @@
   </refsection>
 +  <refsection><info><title>NOTES</title></info>
 +    <refsection><info><title>Red Hat SELinux BIND Security Profile</title></info>
 +
 +    <para>
 +    By default, Red Hat ships BIND with the most secure SELinux policy
 +    that will not prevent normal BIND operation and will prevent exploitation
 +    of all known BIND security vulnerabilities . See the selinux(8) man page
 +    for information about SElinux.
 +    </para>
 +
 +    <para>
 +    It is not necessary to run named in a chroot environment if the Red Hat
 +    SELinux policy for named is enabled. When enabled, this policy is far
 +    more secure than a chroot environment. Users are recommended to enable
 +    SELinux and remove the bind-chroot package.
 +    </para>
 +
 +    <para>
 +    With this extra security comes some restrictions:
 +    </para>
 +
 +    <para>
 +    By default, the SELinux policy allows named to write any master
 +    zone database files. Only the root user may create files in the $ROOTDIR/var/named
 +    zone database file directory (the options { "directory" } option), where
 +    $ROOTDIR is set in /etc/sysconfig/named.
 +    </para>
 +
 +    <para>
 +    The "named" group must be granted read privelege to
 +    these files in order for named to be enabled to read them.
 +    </para>
 +
 +    <para>
 +    Any file created in the zone database file directory is automatically assigned
 +    the SELinux file context named_zone_t .
 +    </para>
 +
 +    <para>
 +    By default, SELinux prevents any role from modifying named_zone_t files; this
 +    means that files in the zone database directory cannot be modified by dynamic
 +    DNS (DDNS) updates or zone transfers.
 +    </para>
 +
 +    <para>
 +    The Red Hat BIND distribution and SELinux policy creates three directories where
 +    named is allowed to create and modify files: /var/named/slaves, /var/named/dynamic
 +    /var/named/data. By placing files you want named to modify, such as
 +    slave or DDNS updateable zone files and database / statistics dump files in
 +    these directories, named will work normally and no further operator action is
 +    required. Files in these directories are automatically assigned the 'named_cache_t'
 +    file context, which SELinux allows named to write.
 +    </para>
 +    </refsection>
 +
 +    <refsection><info><title>Red Hat BIND SDB support</title></info>
 +
 +    <para>
 +    Red Hat ships named with compiled in Simplified Database Backend modules that ISC
 +    provides in the "contrib/sdb" directory. Install bind-sdb package if you want use them.
 +    </para>
 +
 +    <para>
 +    The SDB modules for LDAP, PostGreSQL, DirDB and SQLite are compiled into <command>named-sdb</command>.
 +    </para>
 +
 +    <para>
 +    See the documentation for the various SDB modules in /usr/share/doc/bind-sdb-*/ .
 +    </para>
 +    </refsection>
 +
 +  </refsection>
 +
   <refsection><info><title>SEE ALSO</title></info>
     <para><citetitle>RFC 1033</citetitle>,
 -- 
 2.26.2
--- a/SOURCES/bind-9.3.2b1-fix_sdb_ldap.patch
+++ b/SOURCES/bind-9.3.2b1-fix_sdb_ldap.patch
@ -1,511 +0,0 @@
 diff --git a/bin/sdb_tools/Makefile.in b/bin/sdb_tools/Makefile.in
 index 95ab742..5059a17 100644
 --- a/bin/sdb_tools/Makefile.in
 +++ b/bin/sdb_tools/Makefile.in
@@ -32,11 +32,11 @@ DEPLIBS =	${LWRESDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
 LIBS =		${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
 		${ISCCFGLIBS} ${ISCCCLIBS} ${ISCLIBS} ${DBDRIVER_LIBS} @LIBS@
 -TARGETS =	zone2ldap@EXEEXT@ zonetodb@EXEEXT@ zone2sqlite@EXEEXT@
 +TARGETS =	zone2ldap@EXEEXT@ zonetodb@EXEEXT@ zone2sqlite@EXEEXT@ ldap2zone@EXEEXT@
 -OBJS	=	zone2ldap.@O@ zonetodb.@O@ zone2sqlite.@O@
 +OBJS	=	zone2ldap.@O@ zonetodb.@O@ zone2sqlite.@O@ ldap2zone.@O@
 -SRCS    =       zone2ldap.c zonetodb.c zone2sqlite.c
 +SRCS    =       zone2ldap.c zonetodb.c zone2sqlite.c ldap2zone.c
 MANPAGES =      zone2ldap.1
@@ -47,6 +47,9 @@ EXT_CFLAGS =
 zone2ldap@EXEEXT@: zone2ldap.@O@ ${DEPLIBS}
 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ zone2ldap.@O@ -lldap -llber ${LIBS}
 +ldap2zone@EXEEXT@: ldap2zone.@O@ ${DEPLIBS}
 +	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${ALL_CFLAGS} ${LDFLAGS} -o $@ ldap2zone.@O@ -lldap -llber ${LIBS}
 +
 zonetodb@EXEEXT@: zonetodb.@O@  ${DEPLIBS}
 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ zonetodb.@O@ -lpq ${LIBS}
@@ -64,4 +67,5 @@ install:: ${TARGETS} installdirs
 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zone2ldap@EXEEXT@ ${DESTDIR}${sbindir}
 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zonetodb@EXEEXT@  ${DESTDIR}${sbindir}
 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zone2sqlite@EXEEXT@ ${DESTDIR}${sbindir}
 +	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} ldap2zone@EXEEXT@ ${DESTDIR}${sbindir}
 	${INSTALL_DATA} ${srcdir}/zone2ldap.1 ${DESTDIR}${mandir}/man1/zone2ldap.1
 diff --git a/bin/sdb_tools/zone2ldap.c b/bin/sdb_tools/zone2ldap.c
 index e0e9207..d59936c 100644
 --- a/bin/sdb_tools/zone2ldap.c
 +++ b/bin/sdb_tools/zone2ldap.c
@@ -73,7 +73,7 @@ void add_ldap_values (ldap_info * ldinfo);
 void init_ldap_conn (void);
 /* Ldap error checking */
 -void ldap_result_check (const char *msg, char *dn, int err);
 +void ldap_result_check (const char *msg, const char *dn, int err);
 /* Put a hostname into a char ** array */
 char **hostname_to_dn_list (char *hostname, char *zone, unsigned int flags);
@@ -82,7 +82,7 @@ char **hostname_to_dn_list (char *hostname, char *zone, unsigned int flags);
 int get_attr_list_size (char **tmp);
 /* Get a DN */
 -char *build_dn_from_dc_list (char **dc_list, unsigned int ttl, int flag);
 +char *build_dn_from_dc_list (char **dc_list, unsigned int ttl, int flag, char *zone);
 /* Add to RR list */
 void add_to_rr_list (char *dn, char *name, char *type, char *data,
@@ -104,11 +104,26 @@ void
 init_ldap_conn ();
 void usage();
 -char *argzone, *ldapbase, *binddn, *bindpw = NULL;
 -const char *ldapsystem = "localhost";
 -static const char *objectClasses[] =
 -  { "top", "dNSZone", NULL };
 -static const char *topObjectClasses[] = { "top", NULL };
 +static char *argzone, *ldapbase, *binddn, *bindpw = NULL;
 +
 +/* these are needed to placate gcc4's const-ness const-ernations : */
 +static char localhost[] = "localhost";
 +static char *ldapsystem=&(localhost[0]);
 +/* dnszone schema class names: */
 +static char topClass    [] ="top";
 +static char dNSZoneClass[] ="dNSZone";
 +static char objectClass [] ="objectClass";
 +static char dcObjectClass[]="dcObject";
 +/* dnszone schema attribute names: */
 +static char relativeDomainName[]="relativeDomainName";
 +static char dNSTTL            []="dNSTTL";
 +static char zoneName          []="zoneName";
 +static char dc                []="dc";
 +static char sameZone          []="@";
 +/* LDAPMod mod_values: */
 +static char *objectClasses    []= { &(topClass[0]), &(dNSZoneClass[0]), NULL };
 +static char *topObjectClasses []= { &(topClass[0]), &(dcObjectClass[0]), &(dNSZoneClass[0]), NULL };
 +static char *dn_buffer      [64]={NULL};
 LDAP *conn;
 unsigned int debug = 0;
@@ -120,7 +135,7 @@ static void
 fatal(const char *msg) {
   perror(msg);
   if (conn != NULL)
 -    ldap_unbind_s(conn);
 +    ldap_unbind_ext_s(conn, NULL, NULL);
   exit(1);
 }
@@ -132,12 +147,13 @@ main (int argc, char **argv)
   isc_result_t result;
   char *basedn;
   ldap_info *tmp;
 -  LDAPMod *base_attrs[2];
 -  LDAPMod base;
 +  LDAPMod *base_attrs[5];
 +  LDAPMod base, dcBase, znBase, rdnBase;
   isc_buffer_t buff;
   char *zonefile=0L;
   char fullbasedn[1024];
   char *ctmp;
 +  char *zn, *dcp[2], *znp[2], *rdn[2];
   dns_fixedname_t fixedzone, fixedname;
   dns_rdataset_t rdataset;
   char **dc_list;
@@ -150,7 +166,7 @@ main (int argc, char **argv)
   extern char *optarg;
   extern int optind, opterr, optopt;
   int create_base = 0;
 -  int topt;
 +  int topt, dcn, zdn, znlen;
   if (argc < 2)
     {
@@ -158,7 +174,7 @@ main (int argc, char **argv)
       exit (-1);
     }
 -  while ((topt = getopt (argc, argv, "D:w:b:z:f:h:?dcv")) != -1)
 +  while ((topt = getopt (argc, argv, "D:Ww:b:z:f:h:?dcv")) != -1)
     {
       switch (topt)
 	{
@@ -181,6 +197,9 @@ main (int argc, char **argv)
 	  if (bindpw == NULL)
 	    fatal("strdup");
 	  break;
 +	case 'W':
 +	  bindpw = getpass("Enter LDAP Password: ");
 +	  break;
 	case 'b':
 	  ldapbase = strdup (optarg);
 	  if (ldapbase == NULL)
@@ -302,17 +321,51 @@ main (int argc, char **argv)
 	printf ("Creating base zone DN %s\n", argzone);
       dc_list = hostname_to_dn_list (argzone, argzone, DNS_TOP);
 -      basedn = build_dn_from_dc_list (dc_list, 0, NO_SPEC);
 +      basedn = build_dn_from_dc_list (dc_list, 0, NO_SPEC, argzone);
 +      if (debug)
 +	printf ("base DN %s\n", basedn);
 -      for (ctmp = &basedn[strlen (basedn)]; ctmp >= &basedn[0]; ctmp--)
 +      for (ctmp = &basedn[strlen (basedn)], dcn=0; ctmp >= &basedn[0]; ctmp--)
 	{
 	  if ((*ctmp == ',') || (ctmp == &basedn[0]))
 	    {
 	      base.mod_op = LDAP_MOD_ADD;
 -	      base.mod_type = (char*)"objectClass";
 +	      base.mod_type = objectClass;
 	      base.mod_values = (char**)topObjectClasses;
 	      base_attrs[0] = (void*)&base;
 -	      base_attrs[1] = NULL;
 +
 +	      dcBase.mod_op = LDAP_MOD_ADD;
 +	      dcBase.mod_type = dc;
 +	      dcp[0]=dc_list[dcn];
 +	      dcp[1]=0L;
 +	      dcBase.mod_values=dcp;
 +	      base_attrs[1] = (void*)&dcBase;
 +
 +	      znBase.mod_op = LDAP_MOD_ADD;
 +	      znBase.mod_type = zoneName;
 +	      for( zdn = dcn, znlen = 0; zdn >= 0; zdn-- )
 +		  znlen += strlen(dc_list[zdn])+1;
 +	      znp[0] = (char*)malloc(znlen+1);
 +	      znp[1] = 0L;
 +	      for( zdn = dcn, zn=znp[0]; zdn >= 0; zdn-- )
 +		  zn+=sprintf(zn,"%s%s",dc_list[zdn],
 +			      ((zdn > 0) && (*(dc_list[zdn-1])!='.')) ? "." : ""
 +		             );
 +
 +	      znBase.mod_values = znp;
 +	      base_attrs[2] = (void*)&znBase;
 +
 +	      rdnBase.mod_op = LDAP_MOD_ADD;
 +	      rdnBase.mod_type = relativeDomainName;
 +	      rdn[0] = strdup(sameZone);
 +	      rdn[1] = 0L;
 +	      rdnBase.mod_values = rdn;
 +	      base_attrs[3] = (void*)&rdnBase;
 +
 +	      dcn++;
 +
 +	      base.mod_values = topObjectClasses;
 +	      base_attrs[4] = NULL;
 	      if (ldapbase)
 		{
@@ -329,6 +382,10 @@ main (int argc, char **argv)
 		  else
 		    sprintf (fullbasedn, "%s", ctmp);
 		}
 +
 +	      if( debug )
 +		  printf("Full base dn: %s\n", fullbasedn);
 +
 	      result = ldap_add_s (conn, fullbasedn, base_attrs);
 	      ldap_result_check ("initial ldap_add_s", fullbasedn, result);
 	    }
@@ -408,14 +465,14 @@ generate_ldap (dns_name_t * dnsname, dns_rdata_t * rdata, unsigned int ttl)
   isc_result_check (result, "dns_rdata_totext");
   data[isc_buffer_usedlength (&buff)] = 0;
 -  dc_list = hostname_to_dn_list (name, argzone, DNS_OBJECT);
 +  dc_list = hostname_to_dn_list ((char*)name, argzone, DNS_OBJECT);
   len = (get_attr_list_size (dc_list) - 2);
 -  dn = build_dn_from_dc_list (dc_list, ttl, WI_SPEC);
 +  dn = build_dn_from_dc_list (dc_list, ttl, WI_SPEC, argzone);
   if (debug)
     printf ("Adding %s (%s %s) to run queue list.\n", dn, type, data);
 -  add_to_rr_list (dn, dc_list[len], type, data, ttl, DNS_OBJECT);
 +  add_to_rr_list (dn, dc_list[len], (char*)type, (char*)data, ttl, DNS_OBJECT);
 }
@@ -455,7 +512,8 @@ add_to_rr_list (char *dn, char *name, char *type,
   int attrlist;
   char ldap_type_buffer[128];
   char charttl[64];
 -
 +  char *zn;
 +  int znlen;
   if ((tmp = locate_by_dn (dn)) == NULL)
     {
@@ -482,10 +540,10 @@ add_to_rr_list (char *dn, char *name, char *type,
 	    fatal("malloc");
 	}
       tmp->attrs[0]->mod_op = LDAP_MOD_ADD;
 -      tmp->attrs[0]->mod_type = (char*)"objectClass";
 +      tmp->attrs[0]->mod_type = objectClass;
       if (flags == DNS_OBJECT)
 -	tmp->attrs[0]->mod_values = (char**)objectClasses;
 +	tmp->attrs[0]->mod_values = objectClasses;
       else
 	{
 	  tmp->attrs[0]->mod_values = (char**)topObjectClasses;
@@ -497,7 +555,7 @@ add_to_rr_list (char *dn, char *name, char *type,
 	}
       tmp->attrs[1]->mod_op = LDAP_MOD_ADD;
 -      tmp->attrs[1]->mod_type = (char*)"relativeDomainName";
 +      tmp->attrs[1]->mod_type = relativeDomainName;
       tmp->attrs[1]->mod_values = (char **) calloc (sizeof (char *), 2);
       if (tmp->attrs[1]->mod_values == (char **)NULL)
@@ -526,7 +584,7 @@ add_to_rr_list (char *dn, char *name, char *type,
 	 fatal("strdup");
       tmp->attrs[3]->mod_op = LDAP_MOD_ADD;
 -      tmp->attrs[3]->mod_type = (char*)"dNSTTL";
 +      tmp->attrs[3]->mod_type = dNSTTL;
       tmp->attrs[3]->mod_values = (char **) calloc (sizeof (char *), 2);
       if (tmp->attrs[3]->mod_values == (char **)NULL)
@@ -539,14 +597,25 @@ add_to_rr_list (char *dn, char *name, char *type,
       if (tmp->attrs[3]->mod_values[0] == NULL)
 	 fatal("strdup");
 +      znlen=strlen(gbl_zone);
 +      if ( gbl_zone[znlen-1] == '.' )
 +      { /* ldapdb MUST search by relative zone name */
 +	  zn = (char*)malloc(znlen);
 +	  memcpy(zn, gbl_zone, znlen-1);
 +	  zn[znlen-1]='\0';
 +      }else
 +      {
 +	  zn = gbl_zone;
 +      }
 +
       tmp->attrs[4]->mod_op = LDAP_MOD_ADD;
 -      tmp->attrs[4]->mod_type = (char*)"zoneName";
 +      tmp->attrs[4]->mod_type = zoneName;
       tmp->attrs[4]->mod_values = (char **)calloc(sizeof(char *), 2);
       if (tmp->attrs[4]->mod_values == (char **)NULL)
 	 fatal("calloc");
 -      tmp->attrs[4]->mod_values[0] = gbl_zone;
 +      tmp->attrs[4]->mod_values[0] = zn;
       tmp->attrs[4]->mod_values[1] = NULL;
       tmp->attrs[5] = NULL;
@@ -557,7 +626,7 @@ add_to_rr_list (char *dn, char *name, char *type,
   else
     {
 -      for (i = 0; tmp->attrs[i] != NULL; i++)
 +	for (i = 0; tmp->attrs[i] != NULL; i++)
 	{
 	  sprintf (ldap_type_buffer, "%sRecord", type);
 	  if (!strncmp
@@ -631,44 +700,70 @@ char **
 hostname_to_dn_list (char *hostname, char *zone, unsigned int flags)
 {
   char *tmp;
 -  static char *dn_buffer[64];
   int i = 0;
 -  char *zname;
 -  char *hnamebuff;
 -
 -  zname = strdup (hostname);
 -  if (zname == NULL)
 -	fatal("strdup");
 -
 -  if (flags == DNS_OBJECT)
 -    {
 -
 -      if (strlen (zname) != strlen (zone))
 -	{
 -	  tmp = &zname[strlen (zname) - strlen (zone)];
 -	  *--tmp = '\0';
 -	  hnamebuff = strdup (zname);
 -	  if (hnamebuff == NULL)
 -		fatal("strdup");
 -	  zname = ++tmp;
 -	}
 -      else
 -	hnamebuff = (char*)"@";
 -    }
 -  else
 -    {
 -      zname = zone;
 -      hnamebuff = NULL;
 -    }
 -
 -  for (tmp = strrchr (zname, '.'); tmp != (char *) 0;
 -       tmp = strrchr (zname, '.'))
 -    {
 -      *tmp++ = '\0';
 -      dn_buffer[i++] = tmp;
 -    }
 -  dn_buffer[i++] = zname;
 -  dn_buffer[i++] = hnamebuff;
 +  char *hname=0L, *last=0L;
 +  int hlen=strlen(hostname), zlen=(strlen(zone));
 +
 +/*  printf("hostname: %s zone: %s\n",hostname, zone); */
 +  hname=0L;
 +  if(flags == DNS_OBJECT)
 +  {
 +      if( (zone[ zlen - 1 ] == '.') && (hostname[hlen - 1] != '.') )
 +      {
 +	  hname=(char*)malloc(hlen + 1);
 +	  hlen += 1;
 +	  sprintf(hname, "%s.", hostname);
 +	  hostname = hname;
 +      }
 +      if(strcmp(hostname, zone) == 0)
 +      {
 +	  if( hname == 0 )
 +	      hname=strdup(hostname);
 +	  last = strdup(sameZone);
 +      }else
 +      {
 +	  if(  (hlen < zlen)
 +	     ||( strcmp( hostname + (hlen - zlen), zone ) != 0)
 +	    )
 +	  {
 +	      if( hname != 0 )
 +		  free(hname);
 +	      hname=(char*)malloc( hlen + zlen + 1);
 +	      if( *zone == '.' )
 +		  sprintf(hname, "%s%s", hostname, zone);
 +	      else
 +		  sprintf(hname,"%s",zone);
 +	  }else
 +	  {
 +	      if( hname == 0 )
 +		  hname = strdup(hostname);
 +	  }
 +	  last = hname;
 +      }
 +  }else
 +  { /* flags == DNS_TOP */
 +      hname = strdup(zone);
 +      last = hname;
 +  }
 +
 +  for (tmp = strrchr (hname, '.'); tmp != (char *) 0;
 +       tmp = strrchr (hname, '.'))
 +  {
 +      if( *( tmp + 1 ) != '\0' )
 +      {
 +	  *tmp = '\0';
 +	  dn_buffer[i++] = ++tmp;
 +      }else
 +      { /* trailing '.' ! */
 +	  dn_buffer[i++] = strdup(".");
 +	  *tmp = '\0';
 +	  if( tmp == hname )
 +	      break;
 +      }
 +  }
 +  if( ( last != hname ) && (tmp != hname) )
 +      dn_buffer[i++] = hname;
 +  dn_buffer[i++] = last;
   dn_buffer[i] = NULL;
   return dn_buffer;
@@ -680,30 +775,38 @@ hostname_to_dn_list (char *hostname, char *zone, unsigned int flags)
  * exception of "@"/SOA. */
 char *
 -build_dn_from_dc_list (char **dc_list, unsigned int ttl, int flag)
 +build_dn_from_dc_list (char **dc_list, unsigned int ttl, int flag, char *zone)
 {
   int size;
 -  int x;
 -  static char dn[1024];
 -  char tmp[128];
 +  int x, znlen;
 +  static char dn[DNS_NAME_MAXTEXT*3/2];
 +  char tmp[DNS_NAME_MAXTEXT*3/2];
 +  char zn[DNS_NAME_MAXTEXT+1];
   bzero (tmp, sizeof (tmp));
   bzero (dn, sizeof (dn));
   size = get_attr_list_size (dc_list);
 +  znlen = strlen(zone);
 +  if ( zone[znlen-1] == '.' )
 +  { /* ldapdb MUST search by relative zone name */
 +      memcpy(&(zn[0]),zone,znlen-1);
 +      zn[znlen-1]='\0';
 +      zone = zn;
 +  }
   for (x = size - 2; x > 0; x--)
     {
     if (flag == WI_SPEC)
     {
       if (x == (size - 2) && (strncmp (dc_list[x], "@", 1) == 0) && (ttl))
 -	sprintf (tmp, "relativeDomainName=%s + dNSTTL=%u,", dc_list[x], ttl);
 +	snprintf (tmp, sizeof(tmp), "zoneName=%s + relativeDomainName=%s,", zone, dc_list[x]);
       else if (x == (size - 2))
 -	      sprintf(tmp, "relativeDomainName=%s,",dc_list[x]);
 +	      snprintf(tmp, sizeof(tmp), "zoneName=%s + relativeDomainName=%s,", zone, dc_list[x]);
       else
 -	      sprintf(tmp,"dc=%s,", dc_list[x]);
 +	      snprintf(tmp, sizeof(tmp), "dc=%s,", dc_list[x]);
     }
     else
     {
 -	    sprintf(tmp, "dc=%s,", dc_list[x]);
 +	    snprintf(tmp, sizeof(tmp), "dc=%s,", dc_list[x]);
     }
@@ -732,19 +835,18 @@ init_ldap_conn ()
     }
   result = ldap_simple_bind_s (conn, binddn, bindpw);
 -  ldap_result_check ("ldap_simple_bind_s", (char*)"LDAP Bind", result);
 +  ldap_result_check ("ldap_simple_bind_s", "LDAP Bind", result);
 }
 /* Like isc_result_check, only for LDAP */
 void
 -ldap_result_check (const char *msg, char *dn, int err)
 +ldap_result_check (const char *msg, const char *dn, int err)
 {
   if ((err != LDAP_SUCCESS) && (err != LDAP_ALREADY_EXISTS))
     {
 -      fprintf(stderr, "Error while adding %s (%s):\n",
 -		      dn, msg);
 -      ldap_perror (conn, dn);
 -      ldap_unbind_s (conn);
 +      fprintf(stderr, "Error while adding %s (%s):\n%s",
 +		      dn, msg, ldap_err2string(err));
 +      ldap_unbind_ext_s (conn, NULL, NULL);
       exit (-1);
     }
 }
@@ -758,16 +860,15 @@ add_ldap_values (ldap_info * ldinfo)
   int result;
   char dnbuffer[1024];
 -
   if (ldapbase != NULL)
     sprintf (dnbuffer, "%s,%s", ldinfo->dn, ldapbase);
   else
     sprintf (dnbuffer, "%s", ldinfo->dn);
   result = ldap_add_s (conn, dnbuffer, ldinfo->attrs);
 -  ldap_result_check ("ldap_add_s", dnbuffer, result);
 -}
 +    ldap_result_check ("ldap_add_s", dnbuffer, result);
 +}
@@ -776,5 +877,5 @@ void
 usage ()
 {
   fprintf (stderr,
 -	   "zone2ldap -D [BIND DN] -w [BIND PASSWORD] -b [BASE DN] -z [ZONE] -f [ZONE FILE] -h [LDAP HOST] "
 +	   "zone2ldap -D [BIND DN] [-w BIND PASSWORD | -W:prompt] -b [BASE DN] -z [ZONE] -f [ZONE FILE] -h [LDAP HOST] "
 	   "[-c Create LDAP Base structure][-d Debug Output (lots !)] \n ");}
--- a/SOURCES/bind-9.3.2b2-sdbsrc.patch
+++ b/SOURCES/bind-9.3.2b2-sdbsrc.patch
@ -1,230 +0,0 @@
 diff --git a/contrib/sdb/bdb/bdb.c b/contrib/sdb/bdb/bdb.c
 index 23594bb..b3c6619 100644
 --- a/contrib/sdb/bdb/bdb.c
 +++ b/contrib/sdb/bdb/bdb.c
@@ -43,7 +43,7 @@
 #include <dns/lib.h>
 #include <dns/ttl.h>
 -#include <named/bdb.h>
 +#include "bdb.h"
 #include <named/globals.h>
 #include <named/config.h>
 diff --git a/contrib/sdb/ldap/zone2ldap.c b/contrib/sdb/ldap/zone2ldap.c
 index 07c89bc..23dd873 100644
 --- a/contrib/sdb/ldap/zone2ldap.c
 +++ b/contrib/sdb/ldap/zone2ldap.c
@@ -63,16 +63,16 @@ typedef struct LDAP_INFO
 ldap_info;
 /* usage Info */
 -void usage ();
 +void usage (void);
 /* Add to the ldap dit */
 void add_ldap_values (ldap_info * ldinfo);
 /* Init an ldap connection */
 -void init_ldap_conn ();
 +void init_ldap_conn (void);
 /* Ldap error checking */
 -void ldap_result_check (char *msg, char *dn, int err);
 +void ldap_result_check (const char *msg, char *dn, int err);
 /* Put a hostname into a char ** array */
 char **hostname_to_dn_list (char *hostname, char *zone, unsigned int flags);
@@ -88,7 +88,7 @@ void add_to_rr_list (char *dn, char *name, char *type, char *data,
 		     unsigned int ttl, unsigned int flags);
 /* Error checking */
 -void isc_result_check (isc_result_t res, char *errorstr);
 +void isc_result_check (isc_result_t res, const char *errorstr);
 /* Generate LDIF Format files */
 void generate_ldap (dns_name_t * dnsname, dns_rdata_t * rdata,
@@ -97,11 +97,17 @@ void generate_ldap (dns_name_t * dnsname, dns_rdata_t * rdata,
 /* head pointer to the list */
 ldap_info *ldap_info_base = NULL;
 +ldap_info *
 +locate_by_dn (char *dn);
 +void
 +init_ldap_conn ();
 +void usage();
 +
 char *argzone, *ldapbase, *binddn, *bindpw = NULL;
 -char *ldapsystem = "localhost";
 -static char *objectClasses[] =
 +const char *ldapsystem = "localhost";
 +static const char *objectClasses[] =
   { "top", "dNSZone", NULL };
 -static char *topObjectClasses[] = { "top", NULL };
 +static const char *topObjectClasses[] = { "top", NULL };
 LDAP *conn;
 unsigned int debug = 0;
@@ -128,7 +134,7 @@ main (int argc, char **argv)
   LDAPMod *base_attrs[2];
   LDAPMod base;
   isc_buffer_t buff;
 -  char *zonefile;
 +  char *zonefile=0L;
   char fullbasedn[1024];
   char *ctmp;
   dns_fixedname_t fixedzone, fixedname;
@@ -304,9 +310,9 @@ main (int argc, char **argv)
 	  if ((*ctmp == ',') || (ctmp == &basedn[0]))
 	    {
 	      base.mod_op = LDAP_MOD_ADD;
 -	      base.mod_type = "objectClass";
 -	      base.mod_values = topObjectClasses;
 -	      base_attrs[0] = &base;
 +	      base.mod_type = (char*)"objectClass";
 +	      base.mod_values = (char**)topObjectClasses;
 +	      base_attrs[0] = (void*)&base;
 	      base_attrs[1] = NULL;
 	      if (ldapbase)
@@ -363,7 +369,7 @@ main (int argc, char **argv)
  * I should probably rename this function, as not to cause any
  * confusion with the isc* routines. Will exit on error. */
 void
 -isc_result_check (isc_result_t res, char *errorstr)
 +isc_result_check (isc_result_t res, const char *errorstr)
 {
   if (res != ISC_R_SUCCESS)
     {
@@ -470,20 +476,20 @@ add_to_rr_list (char *dn, char *name, char *type,
       if (tmp->attrs == (LDAPMod **) NULL)
 	fatal("calloc");
 -      for (i = 0; i < flags; i++)
 +      for (i = 0; i < (int)flags; i++)
 	{
 	  tmp->attrs[i] = (LDAPMod *) malloc (sizeof (LDAPMod));
 	  if (tmp->attrs[i] == (LDAPMod *) NULL)
 	    fatal("malloc");
 	}
       tmp->attrs[0]->mod_op = LDAP_MOD_ADD;
 -      tmp->attrs[0]->mod_type = "objectClass";
 +      tmp->attrs[0]->mod_type = (char*)"objectClass";
       if (flags == DNS_OBJECT)
 -	tmp->attrs[0]->mod_values = objectClasses;
 +	tmp->attrs[0]->mod_values = (char**)objectClasses;
       else
 	{
 -	  tmp->attrs[0]->mod_values = topObjectClasses;
 +	  tmp->attrs[0]->mod_values = (char**)topObjectClasses;
 	  tmp->attrs[1] = NULL;
 	  tmp->attrcnt = 2;
 	  tmp->next = ldap_info_base;
@@ -492,7 +498,7 @@ add_to_rr_list (char *dn, char *name, char *type,
 	}
       tmp->attrs[1]->mod_op = LDAP_MOD_ADD;
 -      tmp->attrs[1]->mod_type = "relativeDomainName";
 +      tmp->attrs[1]->mod_type = (char*)"relativeDomainName";
       tmp->attrs[1]->mod_values = (char **) calloc (sizeof (char *), 2);
       if (tmp->attrs[1]->mod_values == (char **)NULL)
@@ -521,7 +527,7 @@ add_to_rr_list (char *dn, char *name, char *type,
 	 fatal("strdup");
       tmp->attrs[3]->mod_op = LDAP_MOD_ADD;
 -      tmp->attrs[3]->mod_type = "dNSTTL";
 +      tmp->attrs[3]->mod_type = (char*)"dNSTTL";
       tmp->attrs[3]->mod_values = (char **) calloc (sizeof (char *), 2);
       if (tmp->attrs[3]->mod_values == (char **)NULL)
@@ -535,7 +541,7 @@ add_to_rr_list (char *dn, char *name, char *type,
 	 fatal("strdup");
       tmp->attrs[4]->mod_op = LDAP_MOD_ADD;
 -      tmp->attrs[4]->mod_type = "zoneName";
 +      tmp->attrs[4]->mod_type = (char*)"zoneName";
       tmp->attrs[4]->mod_values = (char **)calloc(sizeof(char *), 2);
       if (tmp->attrs[4]->mod_values == (char **)NULL)
@@ -648,7 +654,7 @@ hostname_to_dn_list (char *hostname, char *zone, unsigned int flags)
 	  zname = ++tmp;
 	}
       else
 -	hnamebuff = "@";
 +	hnamebuff = (char*)"@";
     }
   else
     {
@@ -727,12 +733,12 @@ init_ldap_conn ()
     }
   result = ldap_simple_bind_s (conn, binddn, bindpw);
 -  ldap_result_check ("ldap_simple_bind_s", "LDAP Bind", result);
 +  ldap_result_check ("ldap_simple_bind_s", (char*)"LDAP Bind", result);
 }
 /* Like isc_result_check, only for LDAP */
 void
 -ldap_result_check (char *msg, char *dn, int err)
 +ldap_result_check (const char *msg, char *dn, int err)
 {
   if ((err != LDAP_SUCCESS) && (err != LDAP_ALREADY_EXISTS))
     {
 diff --git a/contrib/sdb/pgsql/pgsqldb.c b/contrib/sdb/pgsql/pgsqldb.c
 index 50d3cba..516eb9f 100644
 --- a/contrib/sdb/pgsql/pgsqldb.c
 +++ b/contrib/sdb/pgsql/pgsqldb.c
@@ -23,7 +23,7 @@
 #include <string.h>
 #include <stdlib.h>
 -#include <pgsql/libpq-fe.h>
 +#include <libpq-fe.h>
 #include <isc/mem.h>
 #include <isc/print.h>
 diff --git a/contrib/sdb/pgsql/zonetodb.c b/contrib/sdb/pgsql/zonetodb.c
 index b8f5912..ff2d135 100644
 --- a/contrib/sdb/pgsql/zonetodb.c
 +++ b/contrib/sdb/pgsql/zonetodb.c
@@ -37,7 +37,7 @@
 #include <dns/rdatatype.h>
 #include <dns/result.h>
 -#include <pgsql/libpq-fe.h>
 +#include <libpq-fe.h>
 /*
  * Generate a PostgreSQL table from a zone.
@@ -54,6 +54,9 @@ char *dbname, *dbtable;
 char str[10240];
 void
 +closeandexit(int status);
 +
 +void
 closeandexit(int status) {
 	if (conn != NULL)
 		PQfinish(conn);
@@ -61,6 +64,9 @@ closeandexit(int status) {
 }
 void
 +check_result(isc_result_t result, const char *message);
 +
 +void
 check_result(isc_result_t result, const char *message) {
 	if (result != ISC_R_SUCCESS) {
 		fprintf(stderr, "%s: %s\n", message,
@@ -84,7 +90,8 @@ quotestring(const unsigned char *source, unsigned char *dest) {
 	}
 	*dest++ = 0;
 }
 -
 +void
 +addrdata(dns_name_t *name, dns_ttl_t ttl, dns_rdata_t *rdata);
 void
 addrdata(dns_name_t *name, dns_ttl_t ttl, dns_rdata_t *rdata) {
 	unsigned char namearray[DNS_NAME_MAXTEXT + 1];
--- a/SOURCES/bind-9.5-PIE.patch
+++ b/SOURCES/bind-9.5-PIE.patch
@ -1,8 +1,10 @@
--- bind-9.5.0b2/bin/named/Makefile.in.pie	2008-02-11 17:21:47.000000000 +0100
+diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
-+++ bind-9.5.0b2/bin/named/Makefile.in	2008-02-11 17:22:10.000000000 +0100
+index eb622d1..37053a7 100644
-@@ -100,8 +100,12 @@ HTMLPAGES =	named.html lwresd.html named
+--- a/bin/named/Makefile.in
- 
+++ b/bin/named/Makefile.in
- MANOBJS =	${MANPAGES} ${HTMLPAGES}
+@@ -117,8 +117,12 @@ SRCS =		builtin.c config.c control.c \
 		tkeyconf.c tsigconf.c zoneconf.c \
 		${DLZDRIVER_SRCS} ${DBDRIVER_SRCS}
 +EXT_CFLAGS = -fpie
 +
@ -13,10 +15,11 @@
 main.@O@: main.c
 	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} \
 		-DVERSION=\"${VERSION}\" \
-diff -up bind-9.5.0b2/bin/named/unix/Makefile.in.pie bind-9.5.0b2/bin/named/unix/Makefile.in
+diff --git a/bin/named/unix/Makefile.in b/bin/named/unix/Makefile.in
--- bind-9.5.0b2/bin/named/unix/Makefile.in.pie	2008-02-11 17:22:21.000000000 +0100
+index fd9ca8d..f1c102c 100644
-+++ bind-9.5.0b2/bin/named/unix/Makefile.in	2008-02-11 17:23:00.000000000 +0100
+--- a/bin/named/unix/Makefile.in
-@@ -19,6 +19,8 @@ srcdir =	@srcdir@
+++ b/bin/named/unix/Makefile.in
@@ -11,6 +11,8 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
--- a/SOURCES/bind-9.9.1-P2-multlib-conflict.patch
+++ b/SOURCES/bind-9.9.1-P2-multlib-conflict.patch
@ -1,54 +0,0 @@
 diff --git a/config.h.in b/config.h.in
 index 4ecaa8f..2f65ccc 100644
 --- a/config.h.in
 +++ b/config.h.in
@@ -600,7 +600,7 @@ int sigwait(const unsigned int *set, int *sig);
 #undef PREFER_GOSTASN1
 /* The size of `void *', as computed by sizeof. */
 -#undef SIZEOF_VOID_P
 +/* #undef SIZEOF_VOID_P */
 /* Define to 1 if you have the ANSI C header files. */
 #undef STDC_HEADERS
 diff --git a/isc-config.sh.in b/isc-config.sh.in
 index a8a0a89..b5e94ed 100644
 --- a/isc-config.sh.in
 +++ b/isc-config.sh.in
@@ -13,7 +13,18 @@ prefix=@prefix@
 exec_prefix=@exec_prefix@
 exec_prefix_set=
 includedir=@includedir@
 -libdir=@libdir@
 +arch=$(uname -m)
 +
 +case $arch in
 +	x86_64 | amd64 | sparc64 | s390x | ppc64)
 +		libdir=/usr/lib64
 +		sec_libdir=/usr/lib
 +		;;
 +	* )
 +		libdir=/usr/lib
 +		sec_libdir=/usr/lib64
 +		;;
 +esac
 usage()
 {
@@ -132,6 +143,16 @@ if test x"$echo_libs" = x"true"; then
 	if test x"${exec_prefix_set}" = x"true"; then
 		libs="-L${exec_prefix}/lib"
 	else
 +		if [ ! -x $libdir/libisc.so ] ; then
 +			if [ ! -x $sec_libdir/libisc.so ] ; then
 +				echo "Error: ISC libs not found in $libdir"
 +				if [ -d $sec_libdir ] ; then
 +					echo "Error: ISC libs not found in $sec_libdir"
 +				fi
 +				exit 1
 +			fi
 +			libdir=$sec_libdir
 +		fi
 		libs="-L${libdir}"
 	fi
 	if test x"$libirs" = x"true" ; then
--- a/SOURCES/bind-95-rh452060.patch
+++ b/SOURCES/bind-95-rh452060.patch
@ -1,42 +0,0 @@
 diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
 index c06c804..e75b8b7 100644
 --- a/bin/dig/dighost.c
 +++ b/bin/dig/dighost.c
@@ -1816,6 +1816,13 @@ clear_query(dig_query_t *query) {
 	if (query->timer != NULL)
 		isc_timer_detach(&query->timer);
 +
 +	if (query->waiting_senddone) {
 +		debug("send_done not yet called");
 +		query->pending_free = true;
 +		return;
 +	}
 +
 	lookup = query->lookup;
 	if (lookup->current_query == query)
@@ -1841,10 +1848,7 @@ clear_query(dig_query_t *query) {
 	isc_mempool_put(commctx, query->recvspace);
 	isc_buffer_invalidate(&query->recvbuf);
 	isc_buffer_invalidate(&query->lengthbuf);
 -	if (query->waiting_senddone)
 -		query->pending_free = true;
 -	else
 -		isc_mem_free(mctx, query);
 +	isc_mem_free(mctx, query);
 }
 /*%
@@ -2895,9 +2899,9 @@ send_done(isc_task_t *_task, isc_event_t *event) {
 	isc_event_free(&event);
 	if (query->pending_free)
 -		isc_mem_free(mctx, query);
 +		clear_query(query);
 -	check_if_done();
 +	check_next_lookup(l);
 	UNLOCK_LOOKUP;
 }
--- a/Show More
+++ b/Show More
`@ -1,2 +1 @@`
	`4b45d15edc1e3b7902129ce27baec58a50d76b5c SOURCES/bind-9.11.36.tar.gz`	`a10542aaabad60bbbb8d19efd43591c98c01c277 SOURCES/bind-9.16.50.tar.xz`
	`a164fcad1d64d6b5fab5034928cb7260f1fa8fdd SOURCES/random.data`
`@ -1,2 +1 @@`
	`SOURCES/bind-9.11.36.tar.gz`	`SOURCES/bind-9.16.50.tar.xz`
	`SOURCES/random.data`