import OL bind-9.11.36-16.el8_10.2

.bind.metadata

@@ -1,2 +1,2 @@
-ff6ad0d3f9282a77786e93eb889154008ef1ccdf SOURCES/bind-9.11.20.tar.gz
+4b45d15edc1e3b7902129ce27baec58a50d76b5c SOURCES/bind-9.11.36.tar.gz
 a164fcad1d64d6b5fab5034928cb7260f1fa8fdd SOURCES/random.data

.gitignore

@@ -1,2 +1,2 @@
-SOURCES/bind-9.11.20.tar.gz
+SOURCES/bind-9.11.36.tar.gz
 SOURCES/random.data

SOURCES/bind-9.10-dist-native-pkcs11.patch

@@ -1,5 +1,5 @@
 diff --git a/bin/Makefile.in b/bin/Makefile.in
-index f0c504a..ce7a2da 100644
+index a18b222..26a7e4e 100644
 --- a/bin/Makefile.in
 +++ b/bin/Makefile.in
 @@ -11,8 +11,8 @@ srcdir =	@srcdir@
@@ -14,7 +14,7 @@ index f0c504a..ce7a2da 100644
  
  @BIND9_MAKE_RULES@
 diff --git a/bin/dnssec-pkcs11/Makefile.in b/bin/dnssec-pkcs11/Makefile.in
-index 4b8ca13..32f4470 100644
+index 390aa0c..e59a118 100644
 --- a/bin/dnssec-pkcs11/Makefile.in
 +++ b/bin/dnssec-pkcs11/Makefile.in
 @@ -15,18 +15,18 @@ VERSION=@BIND9_VERSION@
@@ -130,7 +130,7 @@ index 4b8ca13..32f4470 100644
  
  clean distclean::
 diff --git a/bin/dnssec/Makefile.in b/bin/dnssec/Makefile.in
-index 4b8ca13..4175996 100644
+index 390aa0c..851a008 100644
 --- a/bin/dnssec/Makefile.in
 +++ b/bin/dnssec/Makefile.in
 @@ -17,7 +17,7 @@ VERSION=@BIND9_VERSION@
@@ -143,7 +143,7 @@ index 4b8ca13..4175996 100644
  CWARNINGS =
  
 diff --git a/bin/named-pkcs11/Makefile.in b/bin/named-pkcs11/Makefile.in
-index 3166368..a403941 100644
+index 277a0f5..52a6375 100644
 --- a/bin/named-pkcs11/Makefile.in
 +++ b/bin/named-pkcs11/Makefile.in
 @@ -43,27 +43,27 @@ DLZDRIVER_INCLUDES =	@DLZ_DRIVER_INCLUDES@
@@ -260,7 +260,7 @@ index 3166368..a403941 100644
  @DLZ_DRIVER_RULES@
  
 diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
-index 3166368..890574f 100644
+index 277a0f5..0e00885 100644
 --- a/bin/named/Makefile.in
 +++ b/bin/named/Makefile.in
 @@ -48,7 +48,7 @@ CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
@@ -273,10 +273,10 @@ index 3166368..890574f 100644
  CWARNINGS =
  
 diff --git a/bin/pkcs11/Makefile.in b/bin/pkcs11/Makefile.in
-index a058c91..d4b689a 100644
+index 2c19e7e..8223d5e 100644
 --- a/bin/pkcs11/Makefile.in
 +++ b/bin/pkcs11/Makefile.in
-@@ -15,13 +15,13 @@ top_srcdir =	@top_srcdir@
+@@ -13,13 +13,13 @@ top_srcdir =	@top_srcdir@
  
  @BIND9_MAKE_INCLUDES@
  
@@ -294,10 +294,10 @@ index a058c91..d4b689a 100644
  DEPLIBS =	${ISCDEPLIBS}
  
 diff --git a/configure.ac b/configure.ac
-index 9b7d778..59ba20b 100644
+index 83cad4a..e1e1a32 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -1139,12 +1139,14 @@ AC_SUBST(USE_GSSAPI)
+@@ -1178,12 +1178,14 @@ AC_SUBST(USE_GSSAPI)
  AC_SUBST(DST_GSSAPI_INC)
  AC_SUBST(DNS_GSSAPI_LIBS)
  DNS_CRYPTO_LIBS="$DNS_GSSAPI_LIBS $DNS_CRYPTO_LIBS"
@@ -312,24 +312,26 @@ index 9b7d778..59ba20b 100644
  
  #
  # was --with-randomdev specified?
-@@ -1494,11 +1496,11 @@ AC_ARG_ENABLE(openssl-hash,
+@@ -1556,12 +1558,12 @@ AC_ARG_ENABLE(openssl-hash,
  AC_MSG_CHECKING(for OpenSSL library)
  OPENSSL_WARNING=
  openssldirs="/usr /usr/local /usr/local/ssl /opt/local /usr/pkg /usr/sfw"
 -if test "yes" = "$want_native_pkcs11"
 -then
 -	use_openssl="native_pkcs11"
+-	want_openssl_hash="no"
 -	AC_MSG_RESULT(use of native PKCS11 instead)
 -fi
-+# if test "yes" = "$want_native_pkcs11"
-+# then
++#if test "yes" = "$want_native_pkcs11"
++#then
 +#	use_openssl="native_pkcs11"
++#	want_openssl_hash="no"
 +#	AC_MSG_RESULT(use of native PKCS11 instead)
-+# fi
++#fi
  
  if test "auto" = "$use_openssl"
  then
-@@ -1511,6 +1513,7 @@ then
+@@ -1574,6 +1576,7 @@ then
  		fi
  	done
  fi
@@ -337,7 +339,7 @@ index 9b7d778..59ba20b 100644
  OPENSSL_ECDSA=""
  OPENSSL_GOST=""
  OPENSSL_ED25519=""
-@@ -1532,11 +1535,10 @@ case "$with_gost" in
+@@ -1595,11 +1598,10 @@ case "$with_gost" in
  		;;
  esac
  
@@ -352,7 +354,7 @@ index 9b7d778..59ba20b 100644
  		CRYPTOLIB="pkcs11"
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
-@@ -1546,7 +1548,9 @@ case "$use_openssl" in
+@@ -1609,7 +1611,9 @@ case "$use_openssl" in
  		OPENSSLGOSTLINKSRCS=""
  		OPENSSLLINKOBJS=""
  		OPENSSLLINKSRCS=""
@@ -363,7 +365,7 @@ index 9b7d778..59ba20b 100644
  	no)
  		AC_MSG_RESULT(no)
  		DST_OPENSSL_INC=""
-@@ -1578,7 +1582,7 @@ case "$use_openssl" in
+@@ -1641,7 +1645,7 @@ case "$use_openssl" in
  If you do not want OpenSSL, use --without-openssl])
  		;;
  	*)
@@ -372,7 +374,7 @@ index 9b7d778..59ba20b 100644
  		then
  			AC_MSG_RESULT()
  			AC_MSG_ERROR([OpenSSL and native PKCS11 cannot be used together.])
-@@ -2006,6 +2010,7 @@ AC_SUBST(OPENSSL_ED25519)
+@@ -2077,6 +2081,7 @@ AC_SUBST(OPENSSL_ED25519)
  AC_SUBST(OPENSSL_GOST)
  
  DNS_CRYPTO_LIBS="$DNS_CRYPTO_LIBS $DST_OPENSSL_LIBS"
@@ -380,7 +382,7 @@ index 9b7d778..59ba20b 100644
  
  ISC_PLATFORM_WANTAES="#undef ISC_PLATFORM_WANTAES"
  if test "yes" = "$with_aes"
-@@ -2291,6 +2296,7 @@ esac
+@@ -2363,6 +2368,7 @@ esac
  AC_SUBST(PKCS11LINKOBJS)
  AC_SUBST(PKCS11LINKSRCS)
  AC_SUBST(CRYPTO)
@@ -388,7 +390,7 @@ index 9b7d778..59ba20b 100644
  AC_SUBST(PKCS11_ECDSA)
  AC_SUBST(PKCS11_GOST)
  AC_SUBST(PKCS11_ED25519)
-@@ -5405,8 +5411,11 @@ AC_CONFIG_FILES([
+@@ -5491,8 +5497,11 @@ AC_CONFIG_FILES([
  	bin/delv/Makefile
  	bin/dig/Makefile
  	bin/dnssec/Makefile
@@ -400,7 +402,7 @@ index 9b7d778..59ba20b 100644
  	bin/nsupdate/Makefile
  	bin/pkcs11/Makefile
  	bin/python/Makefile
-@@ -5479,6 +5488,10 @@ AC_CONFIG_FILES([
+@@ -5565,6 +5574,10 @@ AC_CONFIG_FILES([
  	lib/dns/include/dns/Makefile
  	lib/dns/include/dst/Makefile
  	lib/dns/tests/Makefile
@@ -411,7 +413,7 @@ index 9b7d778..59ba20b 100644
  	lib/irs/Makefile
  	lib/irs/include/Makefile
  	lib/irs/include/irs/Makefile
-@@ -5503,6 +5516,24 @@ AC_CONFIG_FILES([
+@@ -5589,6 +5602,24 @@ AC_CONFIG_FILES([
  	lib/isc/unix/include/Makefile
  	lib/isc/unix/include/isc/Makefile
  	lib/isc/unix/include/pkcs11/Makefile
@@ -437,7 +439,7 @@ index 9b7d778..59ba20b 100644
  	lib/isccc/include/Makefile
  	lib/isccc/include/isccc/Makefile
 diff --git a/lib/Makefile.in b/lib/Makefile.in
-index 81270a0..bcb5312 100644
+index f089bea..3ed939b 100644
 --- a/lib/Makefile.in
 +++ b/lib/Makefile.in
 @@ -15,7 +15,7 @@ top_srcdir =	@top_srcdir@
@@ -450,21 +452,21 @@ index 81270a0..bcb5312 100644
  
  @BIND9_MAKE_RULES@
 diff --git a/lib/dns-pkcs11/Makefile.in b/lib/dns-pkcs11/Makefile.in
-index 7f09bd6..c388d9e 100644
+index 1d0f5df..98c9ba0 100644
 --- a/lib/dns-pkcs11/Makefile.in
 +++ b/lib/dns-pkcs11/Makefile.in
-@@ -26,17 +26,16 @@ VERSION=@BIND9_VERSION@
+@@ -24,17 +24,17 @@ VERSION=@BIND9_VERSION@
  
- USE_ISC_SPNEGO = @USE_ISC_SPNEGO@
+ @BIND9_MAKE_INCLUDES@
  
 -CINCLUDES =	-I. -I${top_srcdir}/lib/dns -Iinclude ${DNS_INCLUDES} \
 -		${ISC_INCLUDES} ${MAXMINDDB_CFLAGS} \
--		@DST_OPENSSL_INC@ @DST_GSSAPI_INC@
 +CINCLUDES =	-I. -I${top_srcdir}/lib/dns-pkcs11 -Iinclude ${DNS_PKCS11_INCLUDES} \
-+		${ISC_PKCS11_INCLUDES} ${MAXMINDDB_CFLAGS} @DST_OPENSSL_INC@ @DST_GSSAPI_INC@
++		${ISC_PKCS11_INCLUDES} ${MAXMINDDB_CFLAGS} \
+ 		@DST_OPENSSL_INC@ @DST_GSSAPI_INC@
  
--CDEFINES =	-DUSE_MD5 @CRYPTO@ @USE_GSSAPI@ ${USE_ISC_SPNEGO}
-+CDEFINES =	-DUSE_MD5 @CRYPTO_PK11@ @USE_GSSAPI@ ${USE_ISC_SPNEGO}
+-CDEFINES =	-DUSE_MD5 @CRYPTO@ @USE_GSSAPI@
++CDEFINES =	-DUSE_MD5 @CRYPTO_PK11@ @USE_GSSAPI@
  
  CWARNINGS =
  
@@ -476,7 +478,7 @@ index 7f09bd6..c388d9e 100644
  
  LIBS =		${MAXMINDDB_LIBS} @LIBS@
  
-@@ -150,15 +149,15 @@ version.@O@: version.c
+@@ -148,15 +148,15 @@ version.@O@: version.c
  		-DLIBAGE=${LIBAGE} \
  		-c ${srcdir}/version.c
  
@@ -496,7 +498,7 @@ index 7f09bd6..c388d9e 100644
  
  include: gen
  	${MAKE} include/dns/enumtype.h
-@@ -189,22 +188,22 @@ gen: gen.c
+@@ -187,22 +187,22 @@ gen: gen.c
  	${BUILD_CPPFLAGS} ${BUILD_LDFLAGS} -o $@ ${srcdir}/gen.c \
  	${BUILD_LIBS} ${LFS_LIBS}
  
@@ -525,7 +527,7 @@ index 7f09bd6..c388d9e 100644
  	rm -f include/dns/rdatastruct.h
  	rm -f dnstap.pb-c.c dnstap.pb-c.h
 diff --git a/lib/isc-pkcs11/Makefile.in b/lib/isc-pkcs11/Makefile.in
-index 8ad54bb..a3ecdfb 100644
+index 7e3e9ce..58d7466 100644
 --- a/lib/isc-pkcs11/Makefile.in
 +++ b/lib/isc-pkcs11/Makefile.in
 @@ -23,8 +23,8 @@ CINCLUDES =	-I${srcdir}/unix/include \
@@ -539,7 +541,7 @@ index 8ad54bb..a3ecdfb 100644
  CWARNINGS =
  
  # Alphabetically
-@@ -103,40 +103,40 @@ version.@O@: version.c
+@@ -107,40 +107,40 @@ version.@O@: version.c
  		-DLIBAGE=${LIBAGE} \
  		-c ${srcdir}/version.c
  
@@ -593,10 +595,10 @@ index 8ad54bb..a3ecdfb 100644
 +	rm -f libisc-pkcs11.@A@ libisc-pkcs11-nosymtbl.@A@ libisc-pkcs11.la \
 +	libisc-pkcs11-nosymtbl.la timestamp
 diff --git a/make/includes.in b/make/includes.in
-index fa86ad1..3cfbe9f 100644
+index 66efe68..966671f 100644
 --- a/make/includes.in
 +++ b/make/includes.in
-@@ -43,3 +43,13 @@ BIND9_INCLUDES = @BIND9_BIND9_BUILDINCLUDE@ \
+@@ -41,3 +41,13 @@ BIND9_INCLUDES = @BIND9_BIND9_BUILDINCLUDE@ \
  
  TEST_INCLUDES = \
  	-I${top_srcdir}/lib/tests/include

SOURCES/bind-9.11-CVE-2020-8622.patch

@@ -1,57 +0,0 @@
-From c5a9fd85a19a63f88a5f17c7e6d074ee22364093 Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Tue, 18 Aug 2020 10:53:33 +0200
-Subject: [PATCH] Fix CVE-2020-8622
-
-5476.	[security]	It was possible to trigger an assertion failure when
-			verifying the response to a TSIG-signed request.
-			(CVE-2020-8622) [GL #2028]
----
- lib/dns/message.c | 24 +++++++++++++-----------
- 1 file changed, 13 insertions(+), 11 deletions(-)
-
-diff --git a/lib/dns/message.c b/lib/dns/message.c
-index d9e341a..7c813a5 100644
---- a/lib/dns/message.c
-+++ b/lib/dns/message.c
-@@ -1712,6 +1712,19 @@ dns_message_parse(dns_message_t *msg, isc_buffer_t *source,
- 	msg->header_ok = 0;
- 	msg->question_ok = 0;
- 
-+	if ((options & DNS_MESSAGEPARSE_CLONEBUFFER) == 0) {
-+		isc_buffer_usedregion(&origsource, &msg->saved);
-+	} else {
-+		msg->saved.length = isc_buffer_usedlength(&origsource);
-+		msg->saved.base = isc_mem_get(msg->mctx, msg->saved.length);
-+		if (msg->saved.base == NULL) {
-+			return (ISC_R_NOMEMORY);
-+		}
-+		memmove(msg->saved.base, isc_buffer_base(&origsource),
-+			msg->saved.length);
-+		msg->free_saved = 1;
-+	}
-+
- 	isc_buffer_remainingregion(source, &r);
- 	if (r.length < DNS_MESSAGE_HEADERLEN)
- 		return (ISC_R_UNEXPECTEDEND);
-@@ -1787,17 +1800,6 @@ dns_message_parse(dns_message_t *msg, isc_buffer_t *source,
- 	}
- 
-  truncated:
--	if ((options & DNS_MESSAGEPARSE_CLONEBUFFER) == 0)
--		isc_buffer_usedregion(&origsource, &msg->saved);
--	else {
--		msg->saved.length = isc_buffer_usedlength(&origsource);
--		msg->saved.base = isc_mem_get(msg->mctx, msg->saved.length);
--		if (msg->saved.base == NULL)
--			return (ISC_R_NOMEMORY);
--		memmove(msg->saved.base, isc_buffer_base(&origsource),
--			msg->saved.length);
--		msg->free_saved = 1;
--	}
- 
- 	if (ret == ISC_R_UNEXPECTEDEND && ignore_tc)
- 		return (DNS_R_RECOVERABLE);
--- 
-2.26.2
-

SOURCES/bind-9.11-CVE-2020-8623.patch

@@ -1,400 +0,0 @@
-From e8b7be1e1ff3e11bc8d592c3c8d6a0f0d69e9947 Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Tue, 18 Aug 2020 10:54:39 +0200
-Subject: [PATCH] Fix CVE-2020-8623
-
-5480.	[security]	When BIND 9 was compiled with native PKCS#11 support, it
-			was possible to trigger an assertion failure in code
-			determining the number of bits in the PKCS#11 RSA public
-			key with a specially crafted packet. (CVE-2020-8623)
-			[GL #2037]
----
- lib/dns/pkcs11dh_link.c         | 15 ++++++-
- lib/dns/pkcs11dsa_link.c        |  8 +++-
- lib/dns/pkcs11rsa_link.c        | 79 +++++++++++++++++++++++++--------
- lib/isc/include/pk11/internal.h |  3 +-
- lib/isc/pk11.c                  | 61 ++++++++++++++++---------
- 5 files changed, 121 insertions(+), 45 deletions(-)
-
-diff --git a/lib/dns/pkcs11dh_link.c b/lib/dns/pkcs11dh_link.c
-index e2b60ea..4cd8e32 100644
---- a/lib/dns/pkcs11dh_link.c
-+++ b/lib/dns/pkcs11dh_link.c
-@@ -748,6 +748,7 @@ pkcs11dh_fromdns(dst_key_t *key, isc_buffer_t *data) {
- 	CK_BYTE *prime = NULL, *base = NULL, *pub = NULL;
- 	CK_ATTRIBUTE *attr;
- 	int special = 0;
-+	unsigned int bits;
- 	isc_result_t result;
- 
- 	isc_buffer_remainingregion(data, &r);
-@@ -852,7 +853,11 @@ pkcs11dh_fromdns(dst_key_t *key, isc_buffer_t *data) {
- 	pub = r.base;
- 	isc_region_consume(&r, publen);
- 
--	key->key_size = pk11_numbits(prime, plen_);
-+	result = pk11_numbits(prime, plen_, &bits);
-+	if (result != ISC_R_SUCCESS) {
-+		goto cleanup;
-+	}
-+	key->key_size = bits;
- 
- 	dh->repr = (CK_ATTRIBUTE *) isc_mem_get(key->mctx, sizeof(*attr) * 3);
- 	if (dh->repr == NULL)
-@@ -1012,6 +1017,7 @@ pkcs11dh_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
- 	dst_private_t priv;
- 	isc_result_t ret;
- 	int i;
-+	unsigned int bits;
- 	pk11_object_t *dh = NULL;
- 	CK_ATTRIBUTE *attr;
- 	isc_mem_t *mctx;
-@@ -1082,7 +1088,12 @@ pkcs11dh_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
- 
- 	attr = pk11_attribute_bytype(dh, CKA_PRIME);
- 	INSIST(attr != NULL);
--	key->key_size = pk11_numbits(attr->pValue, attr->ulValueLen);
-+
-+	ret = pk11_numbits(attr->pValue, attr->ulValueLen, &bits);
-+	if (ret != ISC_R_SUCCESS) {
-+		goto err;
-+	}
-+	key->key_size = bits;
- 
- 	return (ISC_R_SUCCESS);
- 
-diff --git a/lib/dns/pkcs11dsa_link.c b/lib/dns/pkcs11dsa_link.c
-index 12d707a..24d4c14 100644
---- a/lib/dns/pkcs11dsa_link.c
-+++ b/lib/dns/pkcs11dsa_link.c
-@@ -983,6 +983,7 @@ pkcs11dsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
- 	dst_private_t priv;
- 	isc_result_t ret;
- 	int i;
-+	unsigned int bits;
- 	pk11_object_t *dsa = NULL;
- 	CK_ATTRIBUTE *attr;
- 	isc_mem_t *mctx = key->mctx;
-@@ -1072,7 +1073,12 @@ pkcs11dsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
- 
- 	attr = pk11_attribute_bytype(dsa, CKA_PRIME);
- 	INSIST(attr != NULL);
--	key->key_size = pk11_numbits(attr->pValue, attr->ulValueLen);
-+
-+	ret = pk11_numbits(attr->pValue, attr->ulValueLen, &bits);
-+	if (ret != ISC_R_SUCCESS) {
-+		goto err;
-+	}
-+	key->key_size = bits;
- 
- 	return (ISC_R_SUCCESS);
- 
-diff --git a/lib/dns/pkcs11rsa_link.c b/lib/dns/pkcs11rsa_link.c
-index 6c280bf..86e136a 100644
---- a/lib/dns/pkcs11rsa_link.c
-+++ b/lib/dns/pkcs11rsa_link.c
-@@ -337,6 +337,7 @@ pkcs11rsa_createctx_verify(dst_key_t *key, unsigned int maxbits,
- 		key->key_alg == DST_ALG_RSASHA256 ||
- 		key->key_alg == DST_ALG_RSASHA512);
- #endif
-+	REQUIRE(maxbits <= RSA_MAX_PUBEXP_BITS);
- 
- 	/*
- 	 * Reject incorrect RSA key lengths.
-@@ -381,6 +382,7 @@ pkcs11rsa_createctx_verify(dst_key_t *key, unsigned int maxbits,
- 	for (attr = pk11_attribute_first(rsa);
- 	     attr != NULL;
- 	     attr = pk11_attribute_next(rsa, attr))
-+	{
- 		switch (attr->type) {
- 		case CKA_MODULUS:
- 			INSIST(keyTemplate[5].type == attr->type);
-@@ -401,12 +403,16 @@ pkcs11rsa_createctx_verify(dst_key_t *key, unsigned int maxbits,
- 			memmove(keyTemplate[6].pValue, attr->pValue,
- 				attr->ulValueLen);
- 			keyTemplate[6].ulValueLen = attr->ulValueLen;
--			if (pk11_numbits(attr->pValue,
--					 attr->ulValueLen) > maxbits &&
--			    maxbits != 0)
-+			unsigned int bits;
-+			ret = pk11_numbits(attr->pValue, attr->ulValueLen,
-+					   &bits);
-+			if (ret != ISC_R_SUCCESS ||
-+			    (bits > maxbits && maxbits != 0)) {
- 				DST_RET(DST_R_VERIFYFAILURE);
-+			}
- 			break;
- 		}
-+	}
- 	pk11_ctx->object = CK_INVALID_HANDLE;
- 	pk11_ctx->ontoken = false;
- 	PK11_RET(pkcs_C_CreateObject,
-@@ -1086,6 +1092,7 @@ pkcs11rsa_verify(dst_context_t *dctx, const isc_region_t *sig) {
- 			keyTemplate[5].ulValueLen = attr->ulValueLen;
- 			break;
- 		case CKA_PUBLIC_EXPONENT:
-+			unsigned int bits;
- 			INSIST(keyTemplate[6].type == attr->type);
- 			keyTemplate[6].pValue = isc_mem_get(dctx->mctx,
- 							    attr->ulValueLen);
-@@ -1094,10 +1101,12 @@ pkcs11rsa_verify(dst_context_t *dctx, const isc_region_t *sig) {
- 			memmove(keyTemplate[6].pValue, attr->pValue,
- 				attr->ulValueLen);
- 			keyTemplate[6].ulValueLen = attr->ulValueLen;
--			if (pk11_numbits(attr->pValue,
--					 attr->ulValueLen)
--				> RSA_MAX_PUBEXP_BITS)
-+			ret = pk11_numbits(attr->pValue, attr->ulValueLen,
-+					   &bits);
-+			if (ret != ISC_R_SUCCESS || bits > RSA_MAX_PUBEXP_BITS)
-+			{
- 				DST_RET(DST_R_VERIFYFAILURE);
-+			}
- 			break;
- 		}
- 	pk11_ctx->object = CK_INVALID_HANDLE;
-@@ -1475,6 +1484,8 @@ pkcs11rsa_fromdns(dst_key_t *key, isc_buffer_t *data) {
- 	CK_BYTE *exponent = NULL, *modulus = NULL;
- 	CK_ATTRIBUTE *attr;
- 	unsigned int length;
-+	unsigned int bits;
-+	isc_result_t ret = ISC_R_SUCCESS;
- 
- 	isc_buffer_remainingregion(data, &r);
- 	if (r.length == 0)
-@@ -1492,9 +1503,7 @@ pkcs11rsa_fromdns(dst_key_t *key, isc_buffer_t *data) {
- 
- 	if (e_bytes == 0) {
- 		if (r.length < 2) {
--			isc_safe_memwipe(rsa, sizeof(*rsa));
--			isc_mem_put(key->mctx, rsa, sizeof(*rsa));
--			return (DST_R_INVALIDPUBLICKEY);
-+			DST_RET(DST_R_INVALIDPUBLICKEY);
- 		}
- 		e_bytes = (*r.base) << 8;
- 		isc_region_consume(&r, 1);
-@@ -1503,16 +1512,18 @@ pkcs11rsa_fromdns(dst_key_t *key, isc_buffer_t *data) {
- 	}
- 
- 	if (r.length < e_bytes) {
--		isc_safe_memwipe(rsa, sizeof(*rsa));
--		isc_mem_put(key->mctx, rsa, sizeof(*rsa));
--		return (DST_R_INVALIDPUBLICKEY);
-+		DST_RET(DST_R_INVALIDPUBLICKEY);
- 	}
- 	exponent = r.base;
- 	isc_region_consume(&r, e_bytes);
- 	modulus = r.base;
- 	mod_bytes = r.length;
- 
--	key->key_size = pk11_numbits(modulus, mod_bytes);
-+	ret = pk11_numbits(modulus, mod_bytes, &bits);
-+	if (ret != ISC_R_SUCCESS) {
-+		goto err;
-+	}
-+	key->key_size = bits;
- 
- 	isc_buffer_forward(data, length);
- 
-@@ -1562,9 +1573,12 @@ pkcs11rsa_fromdns(dst_key_t *key, isc_buffer_t *data) {
- 			    rsa->repr,
- 			    rsa->attrcnt * sizeof(*attr));
- 	}
-+	ret = ISC_R_NOMEMORY;
-+
-+    err:
- 	isc_safe_memwipe(rsa, sizeof(*rsa));
- 	isc_mem_put(key->mctx, rsa, sizeof(*rsa));
--	return (ISC_R_NOMEMORY);
-+	return (ret);
- }
- 
- static isc_result_t
-@@ -1743,6 +1757,7 @@ pkcs11rsa_fetch(dst_key_t *key, const char *engine, const char *label,
- 	pk11_object_t *pubrsa;
- 	pk11_context_t *pk11_ctx = NULL;
- 	isc_result_t ret;
-+	unsigned int bits;
- 
- 	if (label == NULL)
- 		return (DST_R_NOENGINE);
-@@ -1829,7 +1844,11 @@ pkcs11rsa_fetch(dst_key_t *key, const char *engine, const char *label,
- 
- 	attr = pk11_attribute_bytype(rsa, CKA_MODULUS);
- 	INSIST(attr != NULL);
--	key->key_size = pk11_numbits(attr->pValue, attr->ulValueLen);
-+	ret = pk11_numbits(attr->pValue, attr->ulValueLen, &bits);
-+	if (ret != ISC_R_SUCCESS) {
-+		goto err;
-+	}
-+	key->key_size = bits;
- 
- 	return (ISC_R_SUCCESS);
- 
-@@ -1915,6 +1934,7 @@ pkcs11rsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
- 	CK_ATTRIBUTE *attr;
- 	isc_mem_t *mctx = key->mctx;
- 	const char *engine = NULL, *label = NULL;
-+	unsigned int bits;
- 
- 	/* read private key file */
- 	ret = dst__privstruct_parse(key, DST_ALG_RSA, lexer, mctx, &priv);
-@@ -2058,12 +2078,22 @@ pkcs11rsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
- 
- 	attr = pk11_attribute_bytype(rsa, CKA_MODULUS);
- 	INSIST(attr != NULL);
--	key->key_size = pk11_numbits(attr->pValue, attr->ulValueLen);
-+	ret = pk11_numbits(attr->pValue, attr->ulValueLen, &bits);
-+	if (ret != ISC_R_SUCCESS) {
-+		goto err;
-+	}
-+	key->key_size = bits;
- 
- 	attr = pk11_attribute_bytype(rsa, CKA_PUBLIC_EXPONENT);
- 	INSIST(attr != NULL);
--	if (pk11_numbits(attr->pValue, attr->ulValueLen) > RSA_MAX_PUBEXP_BITS)
-+
-+	ret = pk11_numbits(attr->pValue, attr->ulValueLen, &bits);
-+	if (ret != ISC_R_SUCCESS) {
-+		goto err;
-+	}
-+	if (bits > RSA_MAX_PUBEXP_BITS) {
- 		DST_RET(ISC_R_RANGE);
-+	}
- 
- 	dst__privstruct_free(&priv, mctx);
- 	isc_safe_memwipe(&priv, sizeof(priv));
-@@ -2098,6 +2128,7 @@ pkcs11rsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
- 	pk11_context_t *pk11_ctx = NULL;
- 	isc_result_t ret;
- 	unsigned int i;
-+	unsigned int bits;
- 
- 	UNUSED(pin);
- 
-@@ -2192,12 +2223,22 @@ pkcs11rsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
- 
- 	attr = pk11_attribute_bytype(rsa, CKA_PUBLIC_EXPONENT);
- 	INSIST(attr != NULL);
--	if (pk11_numbits(attr->pValue, attr->ulValueLen) > RSA_MAX_PUBEXP_BITS)
-+
-+	ret = pk11_numbits(attr->pValue, attr->ulValueLen, &bits);
-+	if (ret != ISC_R_SUCCESS) {
-+		goto err;
-+	}
-+	if (bits > RSA_MAX_PUBEXP_BITS) {
- 		DST_RET(ISC_R_RANGE);
-+	}
- 
- 	attr = pk11_attribute_bytype(rsa, CKA_MODULUS);
- 	INSIST(attr != NULL);
--	key->key_size = pk11_numbits(attr->pValue, attr->ulValueLen);
-+	ret = pk11_numbits(attr->pValue, attr->ulValueLen, &bits);
-+	if (ret != ISC_R_SUCCESS) {
-+		goto err;
-+	}
-+	key->key_size = bits;
- 
- 	pk11_return_session(pk11_ctx);
- 	isc_safe_memwipe(pk11_ctx, sizeof(*pk11_ctx));
-diff --git a/lib/isc/include/pk11/internal.h b/lib/isc/include/pk11/internal.h
-index 603712a..b9680bc 100644
---- a/lib/isc/include/pk11/internal.h
-+++ b/lib/isc/include/pk11/internal.h
-@@ -27,7 +27,8 @@ void pk11_mem_put(void *ptr, size_t size);
- 
- CK_SLOT_ID pk11_get_best_token(pk11_optype_t optype);
- 
--unsigned int pk11_numbits(CK_BYTE_PTR data, unsigned int bytecnt);
-+isc_result_t
-+pk11_numbits(CK_BYTE_PTR data, unsigned int bytecnt, unsigned int *bits);
- 
- CK_ATTRIBUTE *pk11_attribute_first(const pk11_object_t *obj);
- 
-diff --git a/lib/isc/pk11.c b/lib/isc/pk11.c
-index 4b85527..9c450da 100644
---- a/lib/isc/pk11.c
-+++ b/lib/isc/pk11.c
-@@ -982,13 +982,15 @@ pk11_get_best_token(pk11_optype_t optype) {
- 	return (token->slotid);
- }
- 
--unsigned int
--pk11_numbits(CK_BYTE_PTR data, unsigned int bytecnt) {
-+isc_result_t
-+pk11_numbits(CK_BYTE_PTR data, unsigned int bytecnt, unsigned int *bits) {
- 	unsigned int bitcnt, i;
- 	CK_BYTE top;
- 
--	if (bytecnt == 0)
--		return (0);
-+	if (bytecnt == 0) {
-+		*bits = 0;
-+		return (ISC_R_SUCCESS);
-+	}
- 	bitcnt = bytecnt * 8;
- 	for (i = 0; i < bytecnt; i++) {
- 		top = data[i];
-@@ -996,26 +998,41 @@ pk11_numbits(CK_BYTE_PTR data, unsigned int bytecnt) {
- 			bitcnt -= 8;
- 			continue;
- 		}
--		if (top & 0x80)
--			return (bitcnt);
--		if (top & 0x40)
--			return (bitcnt - 1);
--		if (top & 0x20)
--			return (bitcnt - 2);
--		if (top & 0x10)
--			return (bitcnt - 3);
--		if (top & 0x08)
--			return (bitcnt - 4);
--		if (top & 0x04)
--			return (bitcnt - 5);
--		if (top & 0x02)
--			return (bitcnt - 6);
--		if (top & 0x01)
--			return (bitcnt - 7);
-+		if (top & 0x80) {
-+			*bits = bitcnt;
-+			return (ISC_R_SUCCESS);
-+		}
-+		if (top & 0x40) {
-+			*bits = bitcnt - 1;
-+			return (ISC_R_SUCCESS);
-+		}
-+		if (top & 0x20) {
-+			*bits = bitcnt - 2;
-+			return (ISC_R_SUCCESS);
-+		}
-+		if (top & 0x10) {
-+			*bits = bitcnt - 3;
-+			return (ISC_R_SUCCESS);
-+		}
-+		if (top & 0x08) {
-+			*bits = bitcnt - 4;
-+			return (ISC_R_SUCCESS);
-+		}
-+		if (top & 0x04) {
-+			*bits = bitcnt - 5;
-+			return (ISC_R_SUCCESS);
-+		}
-+		if (top & 0x02) {
-+			*bits = bitcnt - 6;
-+			return (ISC_R_SUCCESS);
-+		}
-+		if (top & 0x01) {
-+			*bits = bitcnt - 7;
-+			return (ISC_R_SUCCESS);
-+		}
- 		break;
- 	}
--	INSIST(0);
--	ISC_UNREACHABLE();
-+	return (ISC_R_RANGE);
- }
- 
- CK_ATTRIBUTE *
--- 
-2.26.2
-

SOURCES/bind-9.11-CVE-2020-8624-test.patch

@@ -1,152 +0,0 @@
-From 221fb11e658e7dea1be6dbfd25e149f2d131e4fb Mon Sep 17 00:00:00 2001
-From: Mark Andrews <marka@isc.org>
-Date: Wed, 29 Jul 2020 23:36:03 +1000
-Subject: [PATCH] Add a test for update-policy 'subdomain'
-
-The new test checks that 'update-policy subdomain' is properly enforced.
-
-(cherry picked from commit 393e8f643c02215fa4e6d4edf67be7d77085da0e)
-
-Add a test for update-policy 'zonesub'
-
-The new test checks that 'update-policy zonesub' is properly enforced.
-
-(cherry picked from commit 58e560beb50873c699f3431cf57e215dc645d7aa)
----
- bin/tests/system/nsupdate/ns1/named.conf.in | 12 +++++
- bin/tests/system/nsupdate/tests.sh          | 60 +++++++++++++++++++--
- 2 files changed, 68 insertions(+), 4 deletions(-)
-
-diff --git a/bin/tests/system/nsupdate/ns1/named.conf.in b/bin/tests/system/nsupdate/ns1/named.conf.in
-index 26b6b7c9ab..540a984842 100644
---- a/bin/tests/system/nsupdate/ns1/named.conf.in
-+++ b/bin/tests/system/nsupdate/ns1/named.conf.in
-@@ -36,6 +36,16 @@ key altkey {
- 	secret "1234abcd8765";
- };
- 
-+key restricted.example.nil {
-+	algorithm hmac-md5;
-+	secret "1234abcd8765";
-+};
-+
-+key zonesub-key.example.nil {
-+	algorithm hmac-md5;
-+	secret "1234subk8765";
-+};
-+
- include "ddns.key";
- 
- zone "example.nil" {
-@@ -44,7 +54,9 @@ zone "example.nil" {
- 	check-integrity no;
- 	check-mx ignore;
- 	update-policy {
-+		grant zonesub-key.example.nil zonesub TXT;
- 		grant ddns-key.example.nil subdomain example.nil ANY;
-+		grant restricted.example.nil subdomain restricted.example.nil ANY;
- 	};
- 	allow-transfer { any; };
- };
-diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh
-index b08c5220e7..5f09e8c5bf 100755
---- a/bin/tests/system/nsupdate/tests.sh
-+++ b/bin/tests/system/nsupdate/tests.sh
-@@ -428,7 +428,7 @@ EOF
- # this also proves that the server is still running.
- $DIG $DIGOPTS +tcp +noadd +nosea +nostat +noquest +nocmd +norec example.\
- 	@10.53.0.3 nsec3param > dig.out.ns3.$n || ret=1
--grep "ANSWER: 0" dig.out.ns3.$n > /dev/null || ret=1
-+grep "ANSWER: 0," dig.out.ns3.$n > /dev/null || ret=1
- grep "flags:[^;]* aa[ ;]" dig.out.ns3.$n > /dev/null || ret=1
- [ $ret = 0 ] || { echo_i "failed"; status=1; }
- 
-@@ -443,7 +443,7 @@ EOF
- 
- $DIG $DIGOPTS +tcp +noadd +nosea +nostat +noquest +nocmd +norec nsec3param.test.\
-         @10.53.0.3 nsec3param > dig.out.ns3.$n || ret=1
--grep "ANSWER: 1" dig.out.ns3.$n > /dev/null || ret=1
-+grep "ANSWER: 1," dig.out.ns3.$n > /dev/null || ret=1
- grep "3600.*NSEC3PARAM" dig.out.ns3.$n > /dev/null || ret=1
- grep "flags:[^;]* aa[ ;]" dig.out.ns3.$n > /dev/null || ret=1
- [ $ret = 0 ] || { echo_i "failed"; status=1; }
-@@ -460,7 +460,7 @@ EOF
- _ret=1
- for i in 0 1 2 3 4 5 6 7 8 9; do
- 	$DIG $DIGOPTS +tcp +norec +time=1 +tries=1 @10.53.0.3 nsec3param.test. NSEC3PARAM > dig.out.ns3.$n || _ret=1
--	if grep "ANSWER: 2" dig.out.ns3.$n > /dev/null; then
-+	if grep "ANSWER: 2," dig.out.ns3.$n > /dev/null; then
- 		_ret=0
- 		break
- 	fi
-@@ -485,7 +485,7 @@ EOF
- _ret=1
- for i in 0 1 2 3 4 5 6 7 8 9; do
- 	$DIG $DIGOPTS +tcp +norec +time=1 +tries=1 @10.53.0.3 nsec3param.test. NSEC3PARAM > dig.out.ns3.$n || _ret=1
--	if grep "ANSWER: 1" dig.out.ns3.$n > /dev/null; then
-+	if grep "ANSWER: 1," dig.out.ns3.$n > /dev/null; then
- 		_ret=0
- 		break
- 	fi
-@@ -631,6 +631,58 @@ then
- echo_i "failed"; status=1
- fi
- 
-+n=`expr $n + 1`
-+ret=0
-+echo_i "check that 'update-policy subdomain' is properly enforced ($n)"
-+# "restricted.example.nil" matches "grant ... subdomain restricted.example.nil"
-+# and thus this UPDATE should succeed.
-+$NSUPDATE -d <<END > nsupdate.out1-$n 2>&1 || ret=1
-+server 10.53.0.1 ${PORT}
-+key restricted.example.nil 1234abcd8765
-+update add restricted.example.nil 0 IN TXT everywhere.
-+send
-+END
-+$DIG $DIGOPTS +tcp @10.53.0.1 restricted.example.nil TXT > dig.out.1.test$n || ret=1
-+grep "TXT.*everywhere" dig.out.1.test$n > /dev/null || ret=1
-+# "example.nil" does not match "grant ... subdomain restricted.example.nil" and
-+# thus this UPDATE should fail.
-+$NSUPDATE -d <<END > nsupdate.out2-$n 2>&1 && ret=1
-+server 10.53.0.1 ${PORT}
-+key restricted.example.nil 1234abcd8765
-+update add example.nil 0 IN TXT everywhere.
-+send
-+END
-+$DIG $DIGOPTS +tcp @10.53.0.1 example.nil TXT > dig.out.2.test$n || ret=1
-+grep "TXT.*everywhere" dig.out.2.test$n > /dev/null && ret=1
-+[ $ret = 0 ] || { echo_i "failed"; status=1; }
-+
-+n=`expr $n + 1`
-+ret=0
-+echo_i "check that 'update-policy zonesub' is properly enforced ($n)"
-+# grant zonesub-key.example.nil zonesub TXT;
-+# the A record update should be rejected as it is not in the type list
-+$NSUPDATE -d <<END > nsupdate.out1-$n 2>&1 && ret=1
-+server 10.53.0.1 ${PORT}
-+key zonesub-key.example.nil 1234subk8765
-+update add zonesub.example.nil 0 IN A 1.2.3.4
-+send
-+END
-+$DIG $DIGOPTS +tcp @10.53.0.1 zonesub.example.nil A > dig.out.1.test$n || ret=1
-+grep "status: REFUSED" nsupdate.out1-$n > /dev/null || ret=1
-+grep "ANSWER: 0," dig.out.1.test$n > /dev/null || ret=1
-+# the TXT record update should be accepted as it is in the type list
-+$NSUPDATE -d <<END > nsupdate.out2-$n 2>&1 || ret=1
-+server 10.53.0.1 ${PORT}
-+key zonesub-key.example.nil 1234subk8765
-+update add zonesub.example.nil 0 IN TXT everywhere.
-+send
-+END
-+$DIG $DIGOPTS +tcp @10.53.0.1 zonesub.example.nil TXT > dig.out.2.test$n || ret=1
-+grep "status: REFUSED" nsupdate.out2-$n > /dev/null && ret=1
-+grep "ANSWER: 1," dig.out.2.test$n > /dev/null || ret=1
-+grep "TXT.*everywhere" dig.out.2.test$n > /dev/null || ret=1
-+[ $ret = 0 ] || { echo_i "failed"; status=1; }
-+
- n=`expr $n + 1`
- ret=0
- echo_i "check that changes to the DNSKEY RRset TTL do not have side effects ($n)"
--- 
-2.26.2
-

SOURCES/bind-9.11-CVE-2020-8624.patch

@@ -1,32 +0,0 @@
-From e2aae621408c7622d094f13a67b928f911a2793b Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Tue, 18 Aug 2020 10:55:50 +0200
-Subject: [PATCH] Fix CVE-2020-8624
-
-5481.	[security]	"update-policy" rules of type "subdomain" were
-			incorrectly treated as "zonesub" rules, which allowed
-			keys used in "subdomain" rules to update names outside
-			of the specified subdomains. The problem was fixed by
-			making sure "subdomain" rules are again processed as
-			described in the ARM. (CVE-2020-8624) [GL #2055]
----
- bin/named/zoneconf.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/bin/named/zoneconf.c b/bin/named/zoneconf.c
-index 55f191b..b77a07c 100644
---- a/bin/named/zoneconf.c
-+++ b/bin/named/zoneconf.c
-@@ -239,7 +239,8 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
- 
- 		str = cfg_obj_asstring(matchtype);
- 		CHECK(dns_ssu_mtypefromstring(str, &mtype));
--		if (mtype == dns_ssumatchtype_subdomain) {
-+		if (mtype == dns_ssumatchtype_subdomain &&
-+		    strcasecmp(str, "zonesub") == 0) {
- 			usezone = true;
- 		}
- 
--- 
-2.26.2
-

SOURCES/bind-9.11-CVE-2021-25220.patch

@@ -0,0 +1,254 @@
+From 1f5cb247ecd20ba57c472138f94856aa83caf042 Mon Sep 17 00:00:00 2001
+From: Mark Andrews <marka@isc.org>
+Date: Tue, 1 Mar 2022 09:48:05 +1100
+Subject: [PATCH] Add additional name checks when using a forwarder
+
+When using a forwarder, check that the owner name of response
+records are within the bailiwick of the forwarded name space.
+
+(cherry picked from commit e8df2802ac62016ea68585893eb4310fc3329028)
+
+Check that the forward declaration is unchanged and not overridden
+
+If we are using a fowarder, in addition to checking that names to
+be cached are subdomains of the forwarded namespace, we must also
+check that there are no subsidiary forwarded namespaces which would
+take precedence. To be safe, we don't cache any responses if the
+forwarding configuration has changed since the query was sent.
+
+(cherry picked from commit 590f8698fc876d6d72f75cf35359e7546c3af972)
+
+Check cached names for possible "forward only" clause
+
+When caching additional and glue data *not* from a forwarder, we must
+check that there is no "forward only" clause covering the owner name
+that would take precedence.  Such names would normally be allowed by
+baliwick rules, but a "forward only" zone introduces a new baliwick
+scope.
+
+(cherry picked from commit 4a144fae16e70517be894a971cef1d085ee68ebe)
+
+Look for zones deeper than the current domain or forward name
+
+When caching glue, we need to ensure that there is no closer
+source of truth for the name. If the owner name for the glue
+record would be answered by a locally configured zone, do not
+cache.
+
+(cherry picked from commit 42f8c538d3fb9d075b98d82688aeb71621798754)
+
+Avoid use of compound literals
+
+Compound literals are not used in BIND 9.11, in order to ensure backward
+compatibility with ancient compilers.  Rework the relevant parts of the
+BIND 9.11 backport of the CVE-2021-25220 fix so that compound literals
+are not used.
+
+(cherry picked from commit d4b1efbcbd4dfb8c6ef303968992440c5bdeed15)
+---
+ lib/dns/resolver.c | 130 +++++++++++++++++++++++++++++++++++++++++++--
+ 1 file changed, 125 insertions(+), 5 deletions(-)
+
+diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
+index c912f3aea8..2c68973899 100644
+--- a/lib/dns/resolver.c
++++ b/lib/dns/resolver.c
+@@ -63,6 +63,7 @@
+ #include <dns/stats.h>
+ #include <dns/tsig.h>
+ #include <dns/validator.h>
++#include <dns/zone.h>
+ 
+ #ifdef WANT_QUERYTRACE
+ #define RTRACE(m)       isc_log_write(dns_lctx, \
+@@ -312,6 +313,8 @@ struct fetchctx {
+ 	bool			ns_ttl_ok;
+ 	uint32_t			ns_ttl;
+ 	isc_counter_t *			qc;
++	dns_fixedname_t			fwdfname;
++	dns_name_t			*fwdname;
+ 
+ 	/*%
+ 	 * The number of events we're waiting for.
+@@ -3393,6 +3396,7 @@ fctx_getaddresses(fetchctx_t *fctx, bool badcache) {
+ 		if (result == ISC_R_SUCCESS) {
+ 			fwd = ISC_LIST_HEAD(forwarders->fwdrs);
+ 			fctx->fwdpolicy = forwarders->fwdpolicy;
++			dns_name_copy(domain, fctx->fwdname, NULL);
+ 			if (fctx->fwdpolicy == dns_fwdpolicy_only &&
+ 			    isstrictsubdomain(domain, &fctx->domain)) {
+ 				fcount_decr(fctx);
+@@ -4422,6 +4426,9 @@ fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type,
+ 	fctx->restarts = 0;
+ 	fctx->querysent = 0;
+ 	fctx->referrals = 0;
++
++	fctx->fwdname = dns_fixedname_initname(&fctx->fwdfname);
++
+ 	TIME_NOW(&fctx->start);
+ 	fctx->timeouts = 0;
+ 	fctx->lamecount = 0;
+@@ -4480,8 +4487,10 @@ fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type,
+ 		domain = dns_fixedname_initname(&fixed);
+ 		result = dns_fwdtable_find2(fctx->res->view->fwdtable, fwdname,
+ 					    domain, &forwarders);
+-		if (result == ISC_R_SUCCESS)
++		if (result == ISC_R_SUCCESS) {
+ 			fctx->fwdpolicy = forwarders->fwdpolicy;
++			dns_name_copy(domain, fctx->fwdname, NULL);
++		}
+ 
+ 		if (fctx->fwdpolicy != dns_fwdpolicy_only) {
+ 			/*
+@@ -6231,6 +6240,112 @@ mark_related(dns_name_t *name, dns_rdataset_t *rdataset,
+ 		rdataset->attributes |= DNS_RDATASETATTR_EXTERNAL;
+ }
+ 
++/*
++ * Returns true if 'name' is external to the namespace for which
++ * the server being queried can answer, either because it's not a
++ * subdomain or because it's below a forward declaration or a
++ * locally served zone.
++ */
++static inline bool
++name_external(dns_name_t *name, dns_rdatatype_t type, fetchctx_t *fctx) {
++	isc_result_t result;
++	dns_forwarders_t *forwarders = NULL;
++	dns_fixedname_t fixed, zfixed;
++	dns_name_t *fname = dns_fixedname_initname(&fixed);
++	dns_name_t *zfname = dns_fixedname_initname(&zfixed);
++	dns_name_t *apex = NULL;
++	dns_name_t suffix;
++	dns_zone_t *zone = NULL;
++	unsigned int labels;
++	dns_namereln_t rel;
++	/*
++	 * The following two variables do not influence code flow; they are
++	 * only necessary for calling dns_name_fullcompare().
++	 */
++	int _orderp = 0;
++	unsigned int _nlabelsp = 0;
++
++	apex = ISFORWARDER(fctx->addrinfo) ? fctx->fwdname : &fctx->domain;
++
++	/*
++	 * The name is outside the queried namespace.
++	 */
++	rel = dns_name_fullcompare(name, apex, &_orderp, &_nlabelsp);
++	if (rel != dns_namereln_subdomain && rel != dns_namereln_equal) {
++		return (true);
++	}
++
++	/*
++	 * If the record lives in the parent zone, adjust the name so we
++	 * look for the correct zone or forward clause.
++	 */
++	labels = dns_name_countlabels(name);
++	if (dns_rdatatype_atparent(type) && labels > 1U) {
++		dns_name_init(&suffix, NULL);
++		dns_name_getlabelsequence(name, 1, labels - 1, &suffix);
++		name = &suffix;
++	} else if (rel == dns_namereln_equal) {
++		/* If 'name' is 'apex', no further checking is needed. */
++		return (false);
++	}
++
++	/*
++	 * If there is a locally served zone between 'apex' and 'name'
++	 * then don't cache.
++	 */
++	LOCK(&fctx->res->view->lock);
++	if (fctx->res->view->zonetable != NULL) {
++		unsigned int options = DNS_ZTFIND_NOEXACT;
++		result = dns_zt_find(fctx->res->view->zonetable, name, options,
++				     zfname, &zone);
++		if (zone != NULL) {
++			dns_zone_detach(&zone);
++		}
++		if (result == ISC_R_SUCCESS || result == DNS_R_PARTIALMATCH) {
++			if (dns_name_fullcompare(zfname, apex, &_orderp,
++						 &_nlabelsp) ==
++			    dns_namereln_subdomain)
++			{
++				UNLOCK(&fctx->res->view->lock);
++				return (true);
++			}
++		}
++	}
++	UNLOCK(&fctx->res->view->lock);
++
++	/*
++	 * Look for a forward declaration below 'name'.
++	 */
++	result = dns_fwdtable_find2(fctx->res->view->fwdtable, name, fname,
++				    &forwarders);
++
++	if (ISFORWARDER(fctx->addrinfo)) {
++		/*
++		 * See if the forwarder declaration is better.
++		 */
++		if (result == ISC_R_SUCCESS) {
++			return (!dns_name_equal(fname, fctx->fwdname));
++		}
++
++		/*
++		 * If the lookup failed, the configuration must have
++		 * changed: play it safe and don't cache.
++		 */
++		return (true);
++	} else if (result == ISC_R_SUCCESS &&
++		   forwarders->fwdpolicy == dns_fwdpolicy_only &&
++		   !ISC_LIST_EMPTY(forwarders->fwdrs))
++	{
++		/*
++		 * If 'name' is covered by a 'forward only' clause then we
++		 * can't cache this repsonse.
++		 */
++		return (true);
++	}
++
++	return (false);
++}
++
+ static isc_result_t
+ check_section(void *arg, dns_name_t *addname, dns_rdatatype_t type,
+ 	      dns_section_t section)
+@@ -6259,7 +6374,7 @@ check_section(void *arg, dns_name_t *addname, dns_rdatatype_t type,
+ 	result = dns_message_findname(rmessage, section, addname,
+ 				      dns_rdatatype_any, 0, &name, NULL);
+ 	if (result == ISC_R_SUCCESS) {
+-		external = !dns_name_issubdomain(name, &fctx->domain);
++		external = name_external(name, type, fctx);
+ 		if (type == dns_rdatatype_a) {
+ 			for (rdataset = ISC_LIST_HEAD(name->list);
+ 			     rdataset != NULL;
+@@ -7141,6 +7256,13 @@ answer_response(fetchctx_t *fctx, dns_message_t *message) {
+ 			break;
+ 
+ 		case dns_namereln_subdomain:
++			/*
++			 * Don't accept DNAME from parent namespace.
++			 */
++			if (name_external(name, dns_rdatatype_dname, fctx)) {
++				continue;
++			}
++
+ 			/*
+ 			 * In-scope DNAME records must have at least
+ 			 * as many labels as the domain being queried.
+@@ -7376,11 +7498,9 @@ answer_response(fetchctx_t *fctx, dns_message_t *message) {
+ 	 */
+ 	result = dns_message_firstname(message, DNS_SECTION_AUTHORITY);
+ 	while (!done && result == ISC_R_SUCCESS) {
+-		bool external;
+ 		name = NULL;
+ 		dns_message_currentname(message, DNS_SECTION_AUTHORITY, &name);
+-		external = !dns_name_issubdomain(name, &fctx->domain);
+-		if (!external) {
++		if (!name_external(name, dns_rdatatype_ns, fctx)) {
+ 			/*
+ 			 * We expect to find NS or SIG NS rdatasets, and
+ 			 * nothing else.
+-- 
+2.34.1
+

SOURCES/bind-9.11-CVE-2022-2795.patch

@@ -0,0 +1,61 @@
+From 05cdbc1006cee6daaa29e5423976d56047d22461 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Micha=C5=82=20K=C4=99pie=C5=84?= <michal@isc.org>
+Date: Thu, 8 Sep 2022 11:11:30 +0200
+Subject: [PATCH] Bound the amount of work performed for delegations
+
+Limit the amount of database lookups that can be triggered in
+fctx_getaddresses() (i.e. when determining the name server addresses to
+query next) by setting a hard limit on the number of NS RRs processed
+for any delegation encountered.  Without any limit in place, named can
+be forced to perform large amounts of database lookups per each query
+received, which severely impacts resolver performance.
+
+The limit used (20) is an arbitrary value that is considered to be big
+enough for any sane DNS delegation.
+
+(cherry picked from commit 3a44097fd6c6c260765b628cd1d2c9cb7efb0b2a)
+(cherry picked from commit bf2ea6d8525bfd96a84dad221ba9e004adb710a8)
+---
+ lib/dns/resolver.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
+index 8ae9a993bb..ac9a9ef5d0 100644
+--- a/lib/dns/resolver.c
++++ b/lib/dns/resolver.c
+@@ -180,6 +180,12 @@
+  */
+ #define NS_FAIL_LIMIT 4
+ #define NS_RR_LIMIT   5
++/*
++ * IP address lookups are performed for at most NS_PROCESSING_LIMIT NS RRs in
++ * any NS RRset encountered, to avoid excessive resource use while processing
++ * large delegations.
++ */
++#define NS_PROCESSING_LIMIT 20
+ 
+ /* Number of hash buckets for zone counters */
+ #ifndef RES_DOMAIN_BUCKETS
+@@ -3318,6 +3324,7 @@ fctx_getaddresses(fetchctx_t *fctx, bool badcache) {
+ 	bool need_alternate = false;
+ 	bool all_spilled = true;
+ 	unsigned int no_addresses = 0;
++	unsigned int ns_processed = 0;
+ 
+ 	FCTXTRACE5("getaddresses", "fctx->depth=", fctx->depth);
+ 
+@@ -3504,6 +3511,11 @@ fctx_getaddresses(fetchctx_t *fctx, bool badcache) {
+ 
+ 		dns_rdata_reset(&rdata);
+ 		dns_rdata_freestruct(&ns);
++
++		if (++ns_processed >= NS_PROCESSING_LIMIT) {
++			result = ISC_R_NOMORE;
++			break;
++		}
+ 	}
+ 	if (result != ISC_R_NOMORE) {
+ 		return (result);
+-- 
+2.37.3
+

SOURCES/bind-9.11-CVE-2023-2828-fixup.patch

@@ -0,0 +1,46 @@
+From 6c26ede8edcb700caca12c501c6c129801989526 Mon Sep 17 00:00:00 2001
+From: Mark Andrews <marka@isc.org>
+Date: Fri, 23 Feb 2024 10:12:47 +1100
+Subject: [PATCH] Do not use header_prev in expire_lru_headers
+
+dns__cacherbt_expireheader can unlink / free header_prev underneath
+it.  Use ISC_LIST_TAIL after calling dns__cacherbt_expireheader
+instead to get the next pointer to be processed.
+
+(cherry picked from commit 7ce2e86024f022decb2678963538515ca39ab4ab)
+(cherry picked from commit f88f21b7d890eb80097f4bd434fedb29c2f9ff63)
+---
+ lib/dns/rbtdb.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
+index cc40eaec60..ee59c1b18b 100644
+--- a/lib/dns/rbtdb.c
++++ b/lib/dns/rbtdb.c
+@@ -10667,19 +10667,19 @@ update_header(dns_rbtdb_t *rbtdb, rdatasetheader_t *header,
+ static size_t
+ expire_lru_headers(dns_rbtdb_t *rbtdb, unsigned int locknum, size_t purgesize,
+ 		   bool tree_locked) {
+-	rdatasetheader_t *header, *header_prev;
++	rdatasetheader_t *header;
+ 	size_t purged = 0;
+ 
+ 	for (header = ISC_LIST_TAIL(rbtdb->rdatasets[locknum]);
+-	     header != NULL && purged <= purgesize; header = header_prev)
++	     header != NULL && purged <= purgesize;
++	     header = ISC_LIST_TAIL(rbtdb->rdatasets[locknum]))
+ 	{
+-		header_prev = ISC_LIST_PREV(header, link);
+ 		/*
+ 		 * Unlink the entry at this point to avoid checking it
+ 		 * again even if it's currently used someone else and
+ 		 * cannot be purged at this moment.  This entry won't be
+ 		 * referenced any more (so unlinking is safe) since the
+-		 * TTL was reset to 0.
++		 * TTL will be reset to 0.
+ 		 */
+ 		ISC_LIST_UNLINK(rbtdb->rdatasets[locknum], header, link);
+ 		size_t header_size = rdataset_size(header);
+-- 
+2.43.2
+

SOURCES/bind-9.11-CVE-2023-2828.patch

@@ -0,0 +1,193 @@
+From f3aa755ba5ae5148dd0567357f8c538072e2eabc Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
+Date: Tue, 30 May 2023 08:46:17 +0200
+Subject: [PATCH] Improve RBT overmem cache cleaning
+
+When cache memory usage is over the configured cache size (overmem) and
+we are cleaning unused entries, it might not be enough to clean just two
+entries if the entries to be expired are smaller than the newly added
+rdata.  This could be abused by an attacker to cause a remote Denial of
+Service by possibly running out of the operating system memory.
+
+Currently, the addrdataset() tries to do a single TTL-based cleaning
+considering the serve-stale TTL and then optionally moves to overmem
+cleaning if we are in that condition.  Then the overmem_purge() tries to
+do another single TTL based cleaning from the TTL heap and then continue
+with LRU-based cleaning up to 2 entries cleaned.
+
+Squash the TTL-cleaning mechanism into single call from addrdataset(),
+but ignore the serve-stale TTL if we are currently overmem.
+
+Then instead of having a fixed number of entries to clean, pass the size
+of newly added rdatasetheader to the overmem_purge() function and
+cleanup at least the size of the newly added data.  This prevents the
+cache going over the configured memory limit (`max-cache-size`).
+
+Additionally, refactor the overmem_purge() function to reduce for-loop
+nesting for readability.
+---
+ lib/dns/rbtdb.c | 109 +++++++++++++++++++++++++++++-------------------
+ 1 file changed, 67 insertions(+), 42 deletions(-)
+
+diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
+index 11203e4..cc40eae 100644
+--- a/lib/dns/rbtdb.c
++++ b/lib/dns/rbtdb.c
+@@ -834,7 +834,7 @@ static void update_header(dns_rbtdb_t *rbtdb, rdatasetheader_t *header,
+ static void expire_header(dns_rbtdb_t *rbtdb, rdatasetheader_t *header,
+ 			  bool tree_locked, expire_t reason);
+ static void overmem_purge(dns_rbtdb_t *rbtdb, unsigned int locknum_start,
+-			  isc_stdtime_t now, bool tree_locked);
++			  size_t purgesize, bool tree_locked);
+ static isc_result_t resign_insert(dns_rbtdb_t *rbtdb, int idx,
+ 				  rdatasetheader_t *newheader);
+ static void resign_delete(dns_rbtdb_t *rbtdb, rbtdb_version_t *version,
+@@ -6937,6 +6937,16 @@ addclosest(dns_rbtdb_t *rbtdb, rdatasetheader_t *newheader,
+ 
+ static dns_dbmethods_t zone_methods;
+ 
++static size_t
++rdataset_size(rdatasetheader_t *header) {
++	if (!NONEXISTENT(header)) {
++		return (dns_rdataslab_size((unsigned char *)header,
++					   sizeof(*header)));
++	}
++
++	return (sizeof(*header));
++}
++
+ static isc_result_t
+ addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
+ 	    isc_stdtime_t now, dns_rdataset_t *rdataset, unsigned int options,
+@@ -7091,7 +7101,8 @@ addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
+ 	}
+ 
+ 	if (cache_is_overmem)
+-		overmem_purge(rbtdb, rbtnode->locknum, now, tree_locked);
++		overmem_purge(rbtdb, rbtnode->locknum, rdataset_size(newheader),
++			      tree_locked);
+ 
+ 	NODE_LOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
+ 		  isc_rwlocktype_write);
+@@ -7106,9 +7117,19 @@ addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
+ 			cleanup_dead_nodes(rbtdb, rbtnode->locknum);
+ 
+ 		header = isc_heap_element(rbtdb->heaps[rbtnode->locknum], 1);
+-		if (header && header->rdh_ttl < now - RBTDB_VIRTUAL)
+-			expire_header(rbtdb, header, tree_locked,
+-				      expire_ttl);
++		if (header != NULL) {
++			dns_ttl_t rdh_ttl = header->rdh_ttl;
++
++			/* Only account for stale TTL if cache is not overmem */
++			if (!cache_is_overmem) {
++				rdh_ttl += rbtdb->serve_stale_ttl;
++			}
++
++			if (rdh_ttl < now - RBTDB_VIRTUAL) {
++				expire_header(rbtdb, header, tree_locked,
++					      expire_ttl);
++			}
++		}
+ 
+ 		/*
+ 		 * If we've been holding a write lock on the tree just for
+@@ -10643,54 +10664,58 @@ update_header(dns_rbtdb_t *rbtdb, rdatasetheader_t *header,
+ 	ISC_LIST_PREPEND(rbtdb->rdatasets[header->node->locknum], header, link);
+ }
+ 
++static size_t
++expire_lru_headers(dns_rbtdb_t *rbtdb, unsigned int locknum, size_t purgesize,
++		   bool tree_locked) {
++	rdatasetheader_t *header, *header_prev;
++	size_t purged = 0;
++
++	for (header = ISC_LIST_TAIL(rbtdb->rdatasets[locknum]);
++	     header != NULL && purged <= purgesize; header = header_prev)
++	{
++		header_prev = ISC_LIST_PREV(header, link);
++		/*
++		 * Unlink the entry at this point to avoid checking it
++		 * again even if it's currently used someone else and
++		 * cannot be purged at this moment.  This entry won't be
++		 * referenced any more (so unlinking is safe) since the
++		 * TTL was reset to 0.
++		 */
++		ISC_LIST_UNLINK(rbtdb->rdatasets[locknum], header, link);
++		size_t header_size = rdataset_size(header);
++		expire_header(rbtdb, header, tree_locked, expire_lru);
++		purged += header_size;
++	}
++
++	return (purged);
++}
++
+ /*%
+- * Purge some expired and/or stale (i.e. unused for some period) cache entries
+- * under an overmem condition.  To recover from this condition quickly, up to
+- * 2 entries will be purged.  This process is triggered while adding a new
+- * entry, and we specifically avoid purging entries in the same LRU bucket as
+- * the one to which the new entry will belong.  Otherwise, we might purge
+- * entries of the same name of different RR types while adding RRsets from a
+- * single response (consider the case where we're adding A and AAAA glue records
+- * of the same NS name).
++ * Purge some stale (i.e. unused for some period - LRU based cleaning) cache
++ * entries under the overmem condition.  To recover from this condition quickly,
++ * we cleanup entries up to the size of newly added rdata (passed as purgesize).
++ *
++ * This process is triggered while adding a new entry, and we specifically avoid
++ * purging entries in the same LRU bucket as the one to which the new entry will
++ * belong.  Otherwise, we might purge entries of the same name of different RR
++ * types while adding RRsets from a single response (consider the case where
++ * we're adding A and AAAA glue records of the same NS name).
+  */
+ static void
+-overmem_purge(dns_rbtdb_t *rbtdb, unsigned int locknum_start,
+-	      isc_stdtime_t now, bool tree_locked)
++overmem_purge(dns_rbtdb_t *rbtdb, unsigned int locknum_start, size_t purgesize,
++	      bool tree_locked)
+ {
+-	rdatasetheader_t *header, *header_prev;
+ 	unsigned int locknum;
+-	int purgecount = 2;
++	size_t purged = 0;
+ 
+ 	for (locknum = (locknum_start + 1) % rbtdb->node_lock_count;
+-	     locknum != locknum_start && purgecount > 0;
++	     locknum != locknum_start && purged <= purgesize;
+ 	     locknum = (locknum + 1) % rbtdb->node_lock_count) {
+ 		NODE_LOCK(&rbtdb->node_locks[locknum].lock,
+ 			  isc_rwlocktype_write);
+ 
+-		header = isc_heap_element(rbtdb->heaps[locknum], 1);
+-		if (header && header->rdh_ttl < now - RBTDB_VIRTUAL) {
+-			expire_header(rbtdb, header, tree_locked,
+-				      expire_ttl);
+-			purgecount--;
+-		}
+-
+-		for (header = ISC_LIST_TAIL(rbtdb->rdatasets[locknum]);
+-		     header != NULL && purgecount > 0;
+-		     header = header_prev) {
+-			header_prev = ISC_LIST_PREV(header, link);
+-			/*
+-			 * Unlink the entry at this point to avoid checking it
+-			 * again even if it's currently used someone else and
+-			 * cannot be purged at this moment.  This entry won't be
+-			 * referenced any more (so unlinking is safe) since the
+-			 * TTL was reset to 0.
+-			 */
+-			ISC_LIST_UNLINK(rbtdb->rdatasets[locknum], header,
+-					link);
+-			expire_header(rbtdb, header, tree_locked,
+-				      expire_lru);
+-			purgecount--;
+-		}
++		purged += expire_lru_headers(rbtdb, locknum, purgesize - purged,
++					     tree_locked);
+ 
+ 		NODE_UNLOCK(&rbtdb->node_locks[locknum].lock,
+ 				    isc_rwlocktype_write);
+-- 
+2.40.1
+

SOURCES/bind-9.11-CVE-2023-50387-fixup.patch

@@ -0,0 +1,64 @@
+From f0fc9d7999a94da3d471c4e0a35b1f447f25eea6 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
+Date: Mon, 26 Feb 2024 21:08:42 +0100
+Subject: [PATCH] Add normal task queue also to non-thread version
+
+Non-thread builds are used by us for dhcp package. Make it working
+again.
+
+Related to [GL #4424] and [GL #4459].
+---
+ lib/isc/task.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/lib/isc/task.c b/lib/isc/task.c
+index cc83269..5315b51 100644
+--- a/lib/isc/task.c
++++ b/lib/isc/task.c
+@@ -1115,7 +1115,7 @@ dispatch(isc__taskmgr_t *manager, isc_taskqueue_t qid) {
+ 		}
+ #else /* USE_WORKER_THREADS */
+ 		if (total_dispatch_count >= DEFAULT_TASKMGR_QUANTUM ||
+-		    empty_readyq(manager))
++		    empty_readyq(manager, qid))
+ 			break;
+ #endif /* USE_WORKER_THREADS */
+ 		XTHREADTRACE(isc_msgcat_get(isc_msgcat, ISC_MSGSET_TASK,
+@@ -1318,11 +1318,11 @@ dispatch(isc__taskmgr_t *manager, isc_taskqueue_t qid) {
+ 	}
+ 
+ #ifndef USE_WORKER_THREADS
+-	ISC_LIST_APPENDLIST(manager->ready_tasks, new_ready_tasks, ready_link);
+-	ISC_LIST_APPENDLIST(manager->ready_priority_tasks, new_priority_tasks,
++	ISC_LIST_APPENDLIST(manager->ready_tasks[qid], new_ready_tasks, ready_link);
++	ISC_LIST_APPENDLIST(manager->ready_priority_tasks[qid], new_priority_tasks,
+ 			    ready_priority_link);
+ 	manager->tasks_ready += tasks_ready;
+-	if (empty_readyq(manager))
++	if (empty_readyq(manager, qid))
+ 		manager->mode = isc_taskmgrmode_normal;
+ #endif
+ 
+@@ -1713,7 +1713,8 @@ isc__taskmgr_ready(isc_taskmgr_t *manager0) {
+ 		return (false);
+ 
+ 	LOCK(&manager->lock);
+-	is_ready = !empty_readyq(manager);
++	is_ready = !empty_readyq(manager, isc_taskqueue_normal) ||
++		   !empty_readyq(manager, isc_taskqueue_slow);
+ 	UNLOCK(&manager->lock);
+ 
+ 	return (is_ready);
+@@ -1730,7 +1731,8 @@ isc__taskmgr_dispatch(isc_taskmgr_t *manager0) {
+ 	if (manager == NULL)
+ 		return (ISC_R_NOTFOUND);
+ 
+-	dispatch(manager);
++	dispatch(manager, isc_taskqueue_normal);
++	dispatch(manager, isc_taskqueue_slow);
+ 
+ 	return (ISC_R_SUCCESS);
+ }
+-- 
+2.43.2
+

SOURCES/bind-9.11-CVE-2023-50387.patch

@@ -0,0 +1,737 @@
+From 4c20ab54ec503f65d8ee0b863cbf41103d95130a Mon Sep 17 00:00:00 2001
+From: Mark Andrews <marka@isc.org>
+Date: Wed, 22 Nov 2023 16:59:03 +1100
+Subject: [PATCH] Fail the DNSSEC validation on the first failure
+
+Be more strict when encountering DNSSEC validation failures - fail on
+the first failure.  This will break domains that have DNSSEC signing
+keys with duplicate key ids, but this is something that's much easier
+to fix on the authoritative side, so we are just going to be strict
+on the resolver side where it is causing performance problems.
+
+(cherry picked from commit 8b7ecba9885e163c07c2dd3e1ceab79b2ba89e34)
+
+Add normal and slow task queues
+
+Split the task manager queues into normal and slow task queues, so we
+can move the tasks that blocks processing for a long time (like DNSSEC
+validation) into the slow queue which doesn't block fast
+operations (like responding from the cache).  This mitigates the whole
+class of KeyTrap-like issues.
+
+(cherry picked from commit db083a21726300916fa0b9fd8a433a796fedf636)
+
+Don't iterate from start every time we select new signing key
+
+Improve the selecting of the new signing key by remembering where
+we stopped the iteration and just continue from that place instead
+of iterating from the start over and over again each time.
+
+(cherry picked from commit 75faeefcab47e4f1e12b358525190b4be90f97de)
+
+Optimize selecting the signing key
+
+Don't parse the crypto data before parsing and matching the id and the
+algorithm.
+
+(cherry picked from commit b38552cca7200a72658e482f8407f57516efc5db)
+
+6322.	[security]	Specific DNS answers could cause a denial-of-service
+			condition due to DNS validation taking a long time.
+			(CVE-2023-50387) [GL #4424]
+
+			The same code change also addresses another problem:
+			preparing NSEC3 closest encloser proofs could exhaust
+			available CPU resources. (CVE-2023-50868) [GL #4459]
+---
+ lib/dns/dst_api.c               |  25 ++++--
+ lib/dns/include/dns/validator.h |   1 +
+ lib/dns/include/dst/dst.h       |   4 +
+ lib/dns/resolver.c              |   2 +-
+ lib/dns/validator.c             |  97 +++++++++-----------
+ lib/dns/win32/libdns.def.in     |   1 +
+ lib/isc/include/isc/task.h      |  11 ++-
+ lib/isc/task.c                  | 153 ++++++++++++++++++++++----------
+ 8 files changed, 186 insertions(+), 108 deletions(-)
+
+diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c
+index 2156384ec1..6bcd99796c 100644
+--- a/lib/dns/dst_api.c
++++ b/lib/dns/dst_api.c
+@@ -105,6 +105,7 @@ static isc_result_t	frombuffer(dns_name_t *name,
+ 				   dns_rdataclass_t rdclass,
+ 				   isc_buffer_t *source,
+ 				   isc_mem_t *mctx,
++				   bool no_rdata,
+ 				   dst_key_t **keyp);
+ 
+ static isc_result_t	algorithm_status(unsigned int alg);
+@@ -764,6 +765,13 @@ isc_result_t
+ dst_key_fromdns(dns_name_t *name, dns_rdataclass_t rdclass,
+ 		isc_buffer_t *source, isc_mem_t *mctx, dst_key_t **keyp)
+ {
++	return (dst_key_fromdns_ex(name, rdclass, source, mctx, false, keyp));
++}
++
++isc_result_t
++dst_key_fromdns_ex(dns_name_t *name, dns_rdataclass_t rdclass,
++		   isc_buffer_t *source, isc_mem_t *mctx, bool no_rdata,
++		   dst_key_t **keyp) {
+ 	uint8_t alg, proto;
+ 	uint32_t flags, extflags;
+ 	dst_key_t *key = NULL;
+@@ -792,7 +800,7 @@ dst_key_fromdns(dns_name_t *name, dns_rdataclass_t rdclass,
+ 	}
+ 
+ 	result = frombuffer(name, alg, flags, proto, rdclass, source,
+-			    mctx, &key);
++			    mctx, no_rdata, &key);
+ 	if (result != ISC_R_SUCCESS)
+ 		return (result);
+ 	key->key_id = id;
+@@ -814,7 +822,7 @@ dst_key_frombuffer(dns_name_t *name, unsigned int alg,
+ 	REQUIRE(dst_initialized);
+ 
+ 	result = frombuffer(name, alg, flags, protocol, rdclass, source,
+-			    mctx, &key);
++			    mctx, false, &key);
+ 	if (result != ISC_R_SUCCESS)
+ 		return (result);
+ 
+@@ -1915,7 +1923,8 @@ computeid(dst_key_t *key) {
+ static isc_result_t
+ frombuffer(dns_name_t *name, unsigned int alg, unsigned int flags,
+ 	   unsigned int protocol, dns_rdataclass_t rdclass,
+-	   isc_buffer_t *source, isc_mem_t *mctx, dst_key_t **keyp)
++	   isc_buffer_t *source, isc_mem_t *mctx, bool no_rdata,
++	   dst_key_t **keyp)
+ {
+ 	dst_key_t *key;
+ 	isc_result_t ret;
+@@ -1940,10 +1949,12 @@ frombuffer(dns_name_t *name, unsigned int alg, unsigned int flags,
+ 			return (DST_R_UNSUPPORTEDALG);
+ 		}
+ 
+-		ret = key->func->fromdns(key, source);
+-		if (ret != ISC_R_SUCCESS) {
+-			dst_key_free(&key);
+-			return (ret);
++		if (!no_rdata) {
++			ret = key->func->fromdns(key, source);
++			if (ret != ISC_R_SUCCESS) {
++				dst_key_free(&key);
++				return (ret);
++			}
+ 		}
+ 	}
+ 
+diff --git a/lib/dns/include/dns/validator.h b/lib/dns/include/dns/validator.h
+index cc4478d6d4..b4bf8f29db 100644
+--- a/lib/dns/include/dns/validator.h
++++ b/lib/dns/include/dns/validator.h
+@@ -160,6 +160,7 @@ struct dns_validator {
+ 	unsigned int			depth;
+ 	unsigned int			authcount;
+ 	unsigned int			authfail;
++	bool				failed;
+ 	isc_stdtime_t			start;
+ };
+ 
+diff --git a/lib/dns/include/dst/dst.h b/lib/dns/include/dst/dst.h
+index 180c841307..a8be2daf67 100644
+--- a/lib/dns/include/dst/dst.h
++++ b/lib/dns/include/dst/dst.h
+@@ -435,6 +435,10 @@ dst_key_tofile(const dst_key_t *key, int type, const char *directory);
+  */
+ 
+ isc_result_t
++dst_key_fromdns_ex(dns_name_t *name, dns_rdataclass_t rdclass,
++		   isc_buffer_t *source, isc_mem_t *mctx, bool no_rdata,
++		   dst_key_t **keyp);
++isc_result_t
+ dst_key_fromdns(dns_name_t *name, dns_rdataclass_t rdclass,
+ 		isc_buffer_t *source, isc_mem_t *mctx, dst_key_t **keyp);
+ /*%<
+diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
+index 4f71f48039..487107614c 100644
+--- a/lib/dns/resolver.c
++++ b/lib/dns/resolver.c
+@@ -9267,7 +9267,7 @@ dns_resolver_create(dns_view_t *view,
+ 		if (result != ISC_R_SUCCESS)
+ 			goto cleanup_buckets;
+ 		res->buckets[i].task = NULL;
+-		result = isc_task_create(taskmgr, 0, &res->buckets[i].task);
++		result = isc_task_create(taskmgr, ISC_TASK_QUANTUM_SLOW, &res->buckets[i].task);
+ 		if (result != ISC_R_SUCCESS) {
+ 			DESTROYLOCK(&res->buckets[i].lock);
+ 			goto cleanup_buckets;
+diff --git a/lib/dns/validator.c b/lib/dns/validator.c
+index 2a5c3caa6a..0b257fe874 100644
+--- a/lib/dns/validator.c
++++ b/lib/dns/validator.c
+@@ -1207,6 +1207,12 @@ create_validator(dns_validator_t *val, dns_name_t *name, dns_rdatatype_t type,
+  * val->key at it.
+  *
+  * If val->key is non-NULL, this returns the next matching key.
++ * If val->key is already non-NULL, start searching from the next position in
++ * 'rdataset' to find the *next* key that could have signed 'siginfo', then
++ * set val->key to that.
++ *
++ * Returns ISC_R_SUCCESS if a possible matching key has been found,
++ * ISC_R_NOTFOUND if not. Any other value indicates error.
+  */
+ static isc_result_t
+ get_dst_key(dns_validator_t *val, dns_rdata_rrsig_t *siginfo,
+@@ -1216,54 +1222,59 @@ get_dst_key(dns_validator_t *val, dns_rdata_rrsig_t *siginfo,
+ 	isc_buffer_t b;
+ 	dns_rdata_t rdata = DNS_RDATA_INIT;
+ 	dst_key_t *oldkey = val->key;
+-	bool foundold;
++	bool no_rdata = false;
+ 
+-	if (oldkey == NULL)
+-		foundold = true;
+-	else {
+-		foundold = false;
++	if (oldkey == NULL) {
++		result = dns_rdataset_first(rdataset);
++	} else {
++		dst_key_free(&oldkey);
+ 		val->key = NULL;
++		result = dns_rdataset_next(rdataset);
++	}
++
++	if (result != ISC_R_SUCCESS) {
++		goto done;
+ 	}
+ 
+-	result = dns_rdataset_first(rdataset);
+-	if (result != ISC_R_SUCCESS)
+-		goto failure;
+ 	do {
+ 		dns_rdataset_current(rdataset, &rdata);
+ 
+ 		isc_buffer_init(&b, rdata.data, rdata.length);
+ 		isc_buffer_add(&b, rdata.length);
+ 		INSIST(val->key == NULL);
+-		result = dst_key_fromdns(&siginfo->signer, rdata.rdclass, &b,
+-					 val->view->mctx, &val->key);
++		result = dst_key_fromdns_ex(&siginfo->signer, rdata.rdclass, &b,
++					    val->view->mctx, no_rdata,
++					    &val->key);
+ 		if (result == ISC_R_SUCCESS) {
+ 			if (siginfo->algorithm ==
+ 				    (dns_secalg_t)dst_key_alg(val->key) &&
+ 			    siginfo->keyid ==
+ 				    (dns_keytag_t)dst_key_id(val->key) &&
++			    (dst_key_flags(val->key) & DNS_KEYFLAG_REVOKE) ==
++				    0 &&
+ 			    dst_key_iszonekey(val->key))
+ 			{
+-				if (foundold) {
+-					/*
+-					 * This is the key we're looking for.
+-					 */
+-					return (ISC_R_SUCCESS);
+-				} else if (dst_key_compare(oldkey, val->key)) {
+-					foundold = true;
+-					dst_key_free(&oldkey);
++				if (no_rdata) {
++					/* Retry with full key */
++					dns_rdata_reset(&rdata);
++					dst_key_free(&val->key);
++					no_rdata = false;
++					continue;
+ 				}
++				/* This is the key we're looking for. */
++				goto done;
+ 			}
+ 			dst_key_free(&val->key);
+ 		}
+ 		dns_rdata_reset(&rdata);
+ 		result = dns_rdataset_next(rdataset);
++		no_rdata = true;
+ 	} while (result == ISC_R_SUCCESS);
+-	if (result == ISC_R_NOMORE)
+-		result = ISC_R_NOTFOUND;
+ 
+- failure:
+-	if (oldkey != NULL)
+-		dst_key_free(&oldkey);
++done:
++	if (result == ISC_R_NOMORE) {
++		result = ISC_R_NOTFOUND;
++	}
+ 
+ 	return (result);
+ }
+@@ -1633,37 +1644,13 @@ validate(dns_validator_t *val, bool resume) {
+ 			continue;
+ 		}
+ 
+-		do {
+-			vresult = verify(val, val->key, &rdata,
+-					val->siginfo->keyid);
+-			if (vresult == ISC_R_SUCCESS)
+-				break;
+-			if (val->keynode != NULL) {
+-				dns_keynode_t *nextnode = NULL;
+-				result = dns_keytable_findnextkeynode(
+-							val->keytable,
+-							val->keynode,
+-							&nextnode);
+-				dns_keytable_detachkeynode(val->keytable,
+-							   &val->keynode);
+-				val->keynode = nextnode;
+-				if (result != ISC_R_SUCCESS) {
+-					val->key = NULL;
+-					break;
+-				}
+-				val->key = dns_keynode_key(val->keynode);
+-				if (val->key == NULL)
+-					break;
+-			} else {
+-				if (get_dst_key(val, val->siginfo, val->keyset)
+-				    != ISC_R_SUCCESS)
+-					break;
+-			}
+-		} while (1);
+-		if (vresult != ISC_R_SUCCESS)
++		vresult = verify(val, val->key, &rdata,
++				val->siginfo->keyid);
++		if (vresult != ISC_R_SUCCESS) {
++			val->failed = true;
+ 			validator_log(val, ISC_LOG_DEBUG(3),
+ 				      "failed to verify rdataset");
+-		else {
++		} else {
+ 			dns_rdataset_trimttl(event->rdataset,
+ 					     event->sigrdataset,
+ 					     val->siginfo, val->start,
+@@ -1700,9 +1687,13 @@ validate(dns_validator_t *val, bool resume) {
+ 		} else {
+ 			validator_log(val, ISC_LOG_DEBUG(3),
+ 				      "verify failure: %s",
+-				      isc_result_totext(result));
++				      isc_result_totext(vresult));
+ 			resume = false;
+ 		}
++		if (val->failed) {
++			result = ISC_R_NOMORE;
++			break;
++		}
+ 	}
+ 	if (result != ISC_R_NOMORE) {
+ 		validator_log(val, ISC_LOG_DEBUG(3),
+diff --git a/lib/dns/win32/libdns.def.in b/lib/dns/win32/libdns.def.in
+index f597049493..7320653439 100644
+--- a/lib/dns/win32/libdns.def.in
++++ b/lib/dns/win32/libdns.def.in
+@@ -1439,6 +1439,7 @@ dst_key_format
+ dst_key_free
+ dst_key_frombuffer
+ dst_key_fromdns
++dst_key_fromdns_ex
+ dst_key_fromfile
+ dst_key_fromgssapi
+ dst_key_fromlabel
+diff --git a/lib/isc/include/isc/task.h b/lib/isc/include/isc/task.h
+index 28e5e25fc6..42f7763869 100644
+--- a/lib/isc/include/isc/task.h
++++ b/lib/isc/include/isc/task.h
+@@ -98,8 +98,15 @@ ISC_LANG_BEGINDECLS
+  ***/
+ 
+ typedef enum {
+-		isc_taskmgrmode_normal = 0,
+-		isc_taskmgrmode_privileged
++	isc_taskqueue_normal = 0,
++	isc_taskqueue_slow = 1,
++} isc_taskqueue_t;
++
++#define ISC_TASK_QUANTUM_SLOW 1024
++
++typedef enum {
++	isc_taskmgrmode_normal = 0,
++	isc_taskmgrmode_privileged
+ } isc_taskmgrmode_t;
+ 
+ /*% Task and task manager methods */
+diff --git a/lib/isc/task.c b/lib/isc/task.c
+index 048639350b..cc83269df2 100644
+--- a/lib/isc/task.c
++++ b/lib/isc/task.c
+@@ -107,6 +107,7 @@ struct isc__task {
+ 	isc_eventlist_t			on_shutdown;
+ 	unsigned int			nevents;
+ 	unsigned int			quantum;
++	unsigned int			qid;
+ 	unsigned int			flags;
+ 	isc_stdtime_t			now;
+ 	isc_time_t			tnow;
+@@ -141,11 +142,11 @@ struct isc__taskmgr {
+ 	/* Locked by task manager lock. */
+ 	unsigned int			default_quantum;
+ 	LIST(isc__task_t)		tasks;
+-	isc__tasklist_t			ready_tasks;
+-	isc__tasklist_t			ready_priority_tasks;
++	isc__tasklist_t			ready_tasks[2];
++	isc__tasklist_t			ready_priority_tasks[2];
+ 	isc_taskmgrmode_t		mode;
+ #ifdef ISC_PLATFORM_USETHREADS
+-	isc_condition_t			work_available;
++	isc_condition_t			work_available[2];
+ 	isc_condition_t			exclusive_granted;
+ 	isc_condition_t			paused;
+ #endif /* ISC_PLATFORM_USETHREADS */
+@@ -247,13 +248,13 @@ isc_taskmgrmode_t
+ isc__taskmgr_mode(isc_taskmgr_t *manager0);
+ 
+ static inline bool
+-empty_readyq(isc__taskmgr_t *manager);
++empty_readyq(isc__taskmgr_t *manager, isc_taskqueue_t qid);
+ 
+ static inline isc__task_t *
+-pop_readyq(isc__taskmgr_t *manager);
++pop_readyq(isc__taskmgr_t *manager, isc_taskqueue_t qid);
+ 
+ static inline void
+-push_readyq(isc__taskmgr_t *manager, isc__task_t *task);
++push_readyq(isc__taskmgr_t *manager, isc__task_t *task, isc_taskqueue_t qid);
+ 
+ static struct isc__taskmethods {
+ 	isc_taskmethods_t methods;
+@@ -324,7 +325,8 @@ task_finished(isc__task_t *task) {
+ 		 * any idle worker threads so they
+ 		 * can exit.
+ 		 */
+-		BROADCAST(&manager->work_available);
++		BROADCAST(&manager->work_available[isc_taskqueue_normal]);
++		BROADCAST(&manager->work_available[isc_taskqueue_slow]);
+ 	}
+ #endif /* USE_WORKER_THREADS */
+ 	UNLOCK(&manager->lock);
+@@ -364,7 +366,13 @@ isc__task_create(isc_taskmgr_t *manager0, unsigned int quantum,
+ 	INIT_LIST(task->events);
+ 	INIT_LIST(task->on_shutdown);
+ 	task->nevents = 0;
+-	task->quantum = quantum;
++	if (quantum >= ISC_TASK_QUANTUM_SLOW) {
++		task->qid = isc_taskqueue_slow;
++		task->quantum = quantum - ISC_TASK_QUANTUM_SLOW;
++	} else {
++		task->qid = isc_taskqueue_normal;
++		task->quantum = quantum;
++	}
+ 	task->flags = 0;
+ 	task->now = 0;
+ 	isc_time_settoepoch(&task->tnow);
+@@ -476,11 +484,11 @@ task_ready(isc__task_t *task) {
+ 
+ 	LOCK(&manager->lock);
+ 	LOCK(&task->lock);
+-	push_readyq(manager, task);
++	push_readyq(manager, task, task->qid);
+ 	UNLOCK(&task->lock);
+ #ifdef USE_WORKER_THREADS
+ 	if (manager->mode == isc_taskmgrmode_normal || has_privilege)
+-		SIGNAL(&manager->work_available);
++		SIGNAL(&manager->work_available[task->qid]);
+ #endif /* USE_WORKER_THREADS */
+ 	UNLOCK(&manager->lock);
+ }
+@@ -961,13 +969,13 @@ isc__task_getcurrenttimex(isc_task_t *task0, isc_time_t *t) {
+  * Caller must hold the task manager lock.
+  */
+ static inline bool
+-empty_readyq(isc__taskmgr_t *manager) {
++empty_readyq(isc__taskmgr_t *manager, isc_taskqueue_t qid) {
+ 	isc__tasklist_t queue;
+ 
+ 	if (manager->mode == isc_taskmgrmode_normal)
+-		queue = manager->ready_tasks;
++		queue = manager->ready_tasks[qid];
+ 	else
+-		queue = manager->ready_priority_tasks;
++		queue = manager->ready_priority_tasks[qid];
+ 
+ 	return (EMPTY(queue));
+ }
+@@ -981,18 +989,18 @@ empty_readyq(isc__taskmgr_t *manager) {
+  * Caller must hold the task manager lock.
+  */
+ static inline isc__task_t *
+-pop_readyq(isc__taskmgr_t *manager) {
++pop_readyq(isc__taskmgr_t *manager, isc_taskqueue_t qid) {
+ 	isc__task_t *task;
+ 
+ 	if (manager->mode == isc_taskmgrmode_normal)
+-		task = HEAD(manager->ready_tasks);
++		task = HEAD(manager->ready_tasks[qid]);
+ 	else
+-		task = HEAD(manager->ready_priority_tasks);
++		task = HEAD(manager->ready_priority_tasks[qid]);
+ 
+ 	if (task != NULL) {
+-		DEQUEUE(manager->ready_tasks, task, ready_link);
++		DEQUEUE(manager->ready_tasks[qid], task, ready_link);
+ 		if (ISC_LINK_LINKED(task, ready_priority_link))
+-			DEQUEUE(manager->ready_priority_tasks, task,
++			DEQUEUE(manager->ready_priority_tasks[qid], task,
+ 				ready_priority_link);
+ 	}
+ 
+@@ -1006,16 +1014,16 @@ pop_readyq(isc__taskmgr_t *manager) {
+  * Caller must hold the task manager lock.
+  */
+ static inline void
+-push_readyq(isc__taskmgr_t *manager, isc__task_t *task) {
+-	ENQUEUE(manager->ready_tasks, task, ready_link);
++push_readyq(isc__taskmgr_t *manager, isc__task_t *task, isc_taskqueue_t qid) {
++	ENQUEUE(manager->ready_tasks[qid], task, ready_link);
+ 	if ((task->flags & TASK_F_PRIVILEGED) != 0)
+-		ENQUEUE(manager->ready_priority_tasks, task,
++		ENQUEUE(manager->ready_priority_tasks[qid], task,
+ 			ready_priority_link);
+ 	manager->tasks_ready++;
+ }
+ 
+ static void
+-dispatch(isc__taskmgr_t *manager) {
++dispatch(isc__taskmgr_t *manager, isc_taskqueue_t qid) {
+ 	isc__task_t *task;
+ #ifndef USE_WORKER_THREADS
+ 	unsigned int total_dispatch_count = 0;
+@@ -1094,13 +1102,13 @@ dispatch(isc__taskmgr_t *manager) {
+ 		 * If a pause has been requested, don't do any work
+ 		 * until it's been released.
+ 		 */
+-		while ((empty_readyq(manager) || manager->pause_requested ||
++		while ((empty_readyq(manager, qid) || manager->pause_requested ||
+ 			manager->exclusive_requested) && !FINISHED(manager))
+ 		{
+ 			XTHREADTRACE(isc_msgcat_get(isc_msgcat,
+ 						    ISC_MSGSET_GENERAL,
+ 						    ISC_MSG_WAIT, "wait"));
+-			WAIT(&manager->work_available, &manager->lock);
++			WAIT(&manager->work_available[qid], &manager->lock);
+ 			XTHREADTRACE(isc_msgcat_get(isc_msgcat,
+ 						    ISC_MSGSET_TASK,
+ 						    ISC_MSG_AWAKE, "awake"));
+@@ -1113,7 +1121,7 @@ dispatch(isc__taskmgr_t *manager) {
+ 		XTHREADTRACE(isc_msgcat_get(isc_msgcat, ISC_MSGSET_TASK,
+ 					    ISC_MSG_WORKING, "working"));
+ 
+-		task = pop_readyq(manager);
++		task = pop_readyq(manager, qid);
+ 		if (task != NULL) {
+ 			unsigned int dispatch_count = 0;
+ 			bool done = false;
+@@ -1278,7 +1286,7 @@ dispatch(isc__taskmgr_t *manager) {
+ 				 */
+ #ifdef USE_WORKER_THREADS
+ 				LOCK(&task->lock);
+-				push_readyq(manager, task);
++				push_readyq(manager, task, qid);
+ 				UNLOCK(&task->lock);
+ #else
+ 				ENQUEUE(new_ready_tasks, task, ready_link);
+@@ -1297,10 +1305,14 @@ dispatch(isc__taskmgr_t *manager) {
+ 		 * we're stuck.  Automatically drop privileges at that
+ 		 * point and continue with the regular ready queue.
+ 		 */
+-		if (manager->tasks_running == 0 && empty_readyq(manager)) {
++		if (manager->tasks_running == 0 && empty_readyq(manager, isc_taskqueue_normal) && empty_readyq(manager, isc_taskqueue_slow)) {
+ 			manager->mode = isc_taskmgrmode_normal;
+-			if (!empty_readyq(manager))
+-				BROADCAST(&manager->work_available);
++			if (!empty_readyq(manager, isc_taskqueue_normal)) {
++				BROADCAST(&manager->work_available[isc_taskqueue_normal]);
++			}
++			if (!empty_readyq(manager, isc_taskqueue_slow)) {
++				BROADCAST(&manager->work_available[isc_taskqueue_slow]);
++			}
+ 		}
+ #endif
+ 	}
+@@ -1322,13 +1334,37 @@ static isc_threadresult_t
+ #ifdef _WIN32
+ WINAPI
+ #endif
+-run(void *uap) {
++run_normal(void *uap) {
+ 	isc__taskmgr_t *manager = uap;
+ 
+ 	XTHREADTRACE(isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL,
+ 				    ISC_MSG_STARTING, "starting"));
+ 
+-	dispatch(manager);
++	dispatch(manager, isc_taskqueue_normal);
++
++	XTHREADTRACE(isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL,
++				    ISC_MSG_EXITING, "exiting"));
++
++#ifdef OPENSSL_LEAKS
++	ERR_remove_state(0);
++#endif
++
++	return ((isc_threadresult_t)0);
++}
++#endif /* USE_WORKER_THREADS */
++
++#ifdef USE_WORKER_THREADS
++static isc_threadresult_t
++#ifdef _WIN32
++WINAPI
++#endif
++run_slow(void *uap) {
++	isc__taskmgr_t *manager = uap;
++
++	XTHREADTRACE(isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL,
++				    ISC_MSG_STARTING, "starting"));
++
++	dispatch(manager, isc_taskqueue_slow);
+ 
+ 	XTHREADTRACE(isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL,
+ 				    ISC_MSG_EXITING, "exiting"));
+@@ -1347,7 +1383,8 @@ manager_free(isc__taskmgr_t *manager) {
+ 
+ #ifdef USE_WORKER_THREADS
+ 	(void)isc_condition_destroy(&manager->exclusive_granted);
+-	(void)isc_condition_destroy(&manager->work_available);
++	(void)isc_condition_destroy(&manager->work_available[isc_taskqueue_normal]);
++	(void)isc_condition_destroy(&manager->work_available[isc_taskqueue_slow]);
+ 	(void)isc_condition_destroy(&manager->paused);
+ 	isc_mem_free(manager->mctx, manager->threads);
+ #endif /* USE_WORKER_THREADS */
+@@ -1414,12 +1451,20 @@ isc__taskmgr_create(isc_mem_t *mctx, unsigned int workers,
+ #ifdef USE_WORKER_THREADS
+ 	manager->workers = 0;
+ 	manager->threads = isc_mem_allocate(mctx,
+-					    workers * sizeof(isc_thread_t));
++					    2 * workers * sizeof(isc_thread_t));
+ 	if (manager->threads == NULL) {
+ 		result = ISC_R_NOMEMORY;
+ 		goto cleanup_lock;
+ 	}
+-	if (isc_condition_init(&manager->work_available) != ISC_R_SUCCESS) {
++	if (isc_condition_init(&manager->work_available[isc_taskqueue_normal]) != ISC_R_SUCCESS) {
++		UNEXPECTED_ERROR(__FILE__, __LINE__,
++				 "isc_condition_init() %s",
++				 isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL,
++						ISC_MSG_FAILED, "failed"));
++		result = ISC_R_UNEXPECTED;
++		goto cleanup_threads;
++	}
++	if (isc_condition_init(&manager->work_available[isc_taskqueue_slow]) != ISC_R_SUCCESS) {
+ 		UNEXPECTED_ERROR(__FILE__, __LINE__,
+ 				 "isc_condition_init() %s",
+ 				 isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL,
+@@ -1448,8 +1493,10 @@ isc__taskmgr_create(isc_mem_t *mctx, unsigned int workers,
+ 		default_quantum = DEFAULT_DEFAULT_QUANTUM;
+ 	manager->default_quantum = default_quantum;
+ 	INIT_LIST(manager->tasks);
+-	INIT_LIST(manager->ready_tasks);
+-	INIT_LIST(manager->ready_priority_tasks);
++	INIT_LIST(manager->ready_tasks[isc_taskqueue_normal]);
++	INIT_LIST(manager->ready_tasks[isc_taskqueue_slow]);
++	INIT_LIST(manager->ready_priority_tasks[isc_taskqueue_normal]);
++	INIT_LIST(manager->ready_priority_tasks[isc_taskqueue_slow]);
+ 	manager->tasks_running = 0;
+ 	manager->tasks_ready = 0;
+ 	manager->exclusive_requested = false;
+@@ -1465,7 +1512,19 @@ isc__taskmgr_create(isc_mem_t *mctx, unsigned int workers,
+ 	 * Start workers.
+ 	 */
+ 	for (i = 0; i < workers; i++) {
+-		if (isc_thread_create(run, manager,
++		if (isc_thread_create(run_normal, manager,
++				      &manager->threads[manager->workers]) ==
++		    ISC_R_SUCCESS) {
++			char name[21];	/* thread name limit on Linux */
++			snprintf(name, sizeof(name), "isc-worker%04u", i);
++			isc_thread_setname(manager->threads[manager->workers],
++					   name);
++			manager->workers++;
++			started++;
++		}
++	}
++	for (; i < workers * 2; i++) {
++		if (isc_thread_create(run_slow, manager,
+ 				      &manager->threads[manager->workers]) ==
+ 		    ISC_R_SUCCESS) {
+ 			char name[21];	/* thread name limit on Linux */
+@@ -1482,7 +1541,7 @@ isc__taskmgr_create(isc_mem_t *mctx, unsigned int workers,
+ 		manager_free(manager);
+ 		return (ISC_R_NOTHREADS);
+ 	}
+-	isc_thread_setconcurrency(workers);
++	isc_thread_setconcurrency(workers * 2);
+ #endif /* USE_WORKER_THREADS */
+ #ifdef USE_SHARED_MANAGER
+ 	manager->refs = 1;
+@@ -1497,7 +1556,8 @@ isc__taskmgr_create(isc_mem_t *mctx, unsigned int workers,
+  cleanup_exclusivegranted:
+ 	(void)isc_condition_destroy(&manager->exclusive_granted);
+  cleanup_workavailable:
+-	(void)isc_condition_destroy(&manager->work_available);
++	(void)isc_condition_destroy(&manager->work_available[isc_taskqueue_slow]);
++	(void)isc_condition_destroy(&manager->work_available[isc_taskqueue_normal]);
+  cleanup_threads:
+ 	isc_mem_free(mctx, manager->threads);
+  cleanup_lock:
+@@ -1582,7 +1642,7 @@ isc__taskmgr_destroy(isc_taskmgr_t **managerp) {
+ 	     task = NEXT(task, link)) {
+ 		LOCK(&task->lock);
+ 		if (task_shutdown(task))
+-			push_readyq(manager, task);
++			push_readyq(manager, task, task->qid);
+ 		UNLOCK(&task->lock);
+ 	}
+ #ifdef USE_WORKER_THREADS
+@@ -1591,7 +1651,8 @@ isc__taskmgr_destroy(isc_taskmgr_t **managerp) {
+ 	 * there's work left to do, and if there are already no tasks left
+ 	 * it will cause the workers to see manager->exiting.
+ 	 */
+-	BROADCAST(&manager->work_available);
++	BROADCAST(&manager->work_available[isc_taskqueue_normal]);
++	BROADCAST(&manager->work_available[isc_taskqueue_slow]);
+ 	UNLOCK(&manager->lock);
+ 
+ 	/*
+@@ -1693,7 +1754,8 @@ isc__taskmgr_resume(isc_taskmgr_t *manager0) {
+ 	LOCK(&manager->lock);
+ 	if (manager->pause_requested) {
+ 		manager->pause_requested = false;
+-		BROADCAST(&manager->work_available);
++		BROADCAST(&manager->work_available[isc_taskqueue_normal]);
++		BROADCAST(&manager->work_available[isc_taskqueue_slow]);
+ 	}
+ 	UNLOCK(&manager->lock);
+ }
+@@ -1778,7 +1840,8 @@ isc__task_endexclusive(isc_task_t *task0) {
+ 	LOCK(&manager->lock);
+ 	REQUIRE(manager->exclusive_requested);
+ 	manager->exclusive_requested = false;
+-	BROADCAST(&manager->work_available);
++	BROADCAST(&manager->work_available[isc_taskqueue_normal]);
++	BROADCAST(&manager->work_available[isc_taskqueue_slow]);
+ 	UNLOCK(&manager->lock);
+ #else
+ 	UNUSED(task0);
+@@ -1804,10 +1867,10 @@ isc__task_setprivilege(isc_task_t *task0, bool priv) {
+ 
+ 	LOCK(&manager->lock);
+ 	if (priv && ISC_LINK_LINKED(task, ready_link))
+-		ENQUEUE(manager->ready_priority_tasks, task,
++		ENQUEUE(manager->ready_priority_tasks[task->qid], task,
+ 			ready_priority_link);
+ 	else if (!priv && ISC_LINK_LINKED(task, ready_priority_link))
+-		DEQUEUE(manager->ready_priority_tasks, task,
++		DEQUEUE(manager->ready_priority_tasks[task->qid], task,
+ 			ready_priority_link);
+ 	UNLOCK(&manager->lock);
+ }
+-- 
+2.43.2
+

SOURCES/bind-9.11-CVE-2024-1737-runtime-env.patch

@@ -0,0 +1,133 @@
+From 0a7909045f9e1bf74c1f0fd561a8ef5f55481e8f Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Mon, 29 Jul 2024 16:20:50 +0200
+Subject: [PATCH] Allow global runtime definition by DNS_RBTDB_MAX_RTYPES
+
+Modify rbtdb to not set it only at runtime, but allow setting that also
+in runtime via environment variable. It is still possible to modify
+default during the build define. In addition to it allows runtime change
+also. Can be positive number to set limit, 0 disabled the check.
+
+Similarly add also DNS_RDATASET_MAX_RECORDS to set maximum number of
+records for a single name. This must be positive number, 0 is no accepted.
+
+These replaces max-records-per-type and max-types-per-name in later
+versions. But can be configured only by environment and can be
+configured only globally, not in each view or zone.
+---
+ lib/dns/rbtdb.c     | 21 +++++++++++++++++++--
+ lib/dns/rdataslab.c | 24 ++++++++++++++++++++++--
+ 2 files changed, 41 insertions(+), 4 deletions(-)
+
+diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
+index a3cb8dc871..0104c3ee36 100644
+--- a/lib/dns/rbtdb.c
++++ b/lib/dns/rbtdb.c
+@@ -6320,15 +6320,29 @@ update_recordsandbytes(bool add, rbtdb_version_t *rbtversion,
+ #define DNS_RBTDB_MAX_RTYPES 100
+ #endif /* DNS_RBTDB_MAX_RTYPES */
+ 
++static uint32_t dns_g_rbtdb_max_rtypes = DNS_RBTDB_MAX_RTYPES;
++
++static void
++init_max_rtypes(void) {
++	/* Red Hat change, allow setting different max value by environment. */
++	const char *max = getenv("DNS_RBTDB_MAX_RTYPES");
++	if (max) {
++		char *endp = NULL;
++		long l = strtol(max, &endp, 10);
++		if (max != endp && endp && !*endp && l >= 0)
++			dns_g_rbtdb_max_rtypes = l;
++	}
++}
++
+ static bool
+ overmaxtype(dns_rbtdb_t *rbtdb, uint32_t ntypes) {
+ 	UNUSED(rbtdb);
+ 
+-	if (DNS_RBTDB_MAX_RTYPES == 0) {
++	if (dns_g_rbtdb_max_rtypes == 0) {
+ 		return (false);
+ 	}
+ 
+-	return (ntypes >= DNS_RBTDB_MAX_RTYPES);
++	return (ntypes >= dns_g_rbtdb_max_rtypes);
+ }
+ 
+ static bool
+@@ -8831,6 +8845,8 @@ static dns_dbmethods_t cache_methods = {
+ 	getservestalettl
+ };
+ 
++static isc_once_t once_db = ISC_ONCE_INIT;
++
+ isc_result_t
+ #ifdef DNS_RBTDB_VERSION64
+ dns_rbtdb64_create
+@@ -8850,6 +8866,7 @@ dns_rbtdb_create
+ 
+ 	/* Keep the compiler happy. */
+ 	UNUSED(driverarg);
++	RUNTIME_CHECK(isc_once_do(&once_db, init_max_rtypes) == ISC_R_SUCCESS);
+ 
+ 	rbtdb = isc_mem_get(mctx, sizeof(*rbtdb));
+ 	if (rbtdb == NULL)
+diff --git a/lib/dns/rdataslab.c b/lib/dns/rdataslab.c
+index 347b7d2ce8..9566f79671 100644
+--- a/lib/dns/rdataslab.c
++++ b/lib/dns/rdataslab.c
+@@ -17,6 +17,7 @@
+ #include <stdlib.h>
+ 
+ #include <isc/mem.h>
++#include <isc/once.h>
+ #include <isc/region.h>
+ #include <isc/string.h>		/* Required for HP/UX (and others?) */
+ #include <isc/util.h>
+@@ -119,6 +120,23 @@ fillin_offsets(unsigned char *offsetbase, unsigned int *offsettable,
+ #define DNS_RDATASET_MAX_RECORDS 100
+ #endif /* DNS_RDATASET_MAX_RECORDS */
+ 
++static unsigned int dns_g_rdataset_max_records = DNS_RDATASET_MAX_RECORDS;
++static isc_once_t once = ISC_ONCE_INIT;
++
++static void
++init_max_records(void) {
++	/* Red Hat change, allow setting different max value by environment. */
++	const char *max = getenv("DNS_RDATASET_MAX_RECORDS");
++	if (max) {
++		char *endp = NULL;
++		long l = strtol(max, &endp, 10);
++		if (max != endp && endp && !*endp && l > 0)
++			dns_g_rdataset_max_records = l;
++	}
++}
++
++
++
+ isc_result_t
+ dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx,
+ 			   isc_region_t *region, unsigned int reservelen)
+@@ -165,7 +183,9 @@ dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx,
+ 		return (ISC_R_SUCCESS);
+ 	}
+ 
+-	if (nitems > DNS_RDATASET_MAX_RECORDS) {
++	RUNTIME_CHECK(isc_once_do(&once, init_max_records) == ISC_R_SUCCESS);
++
++	if (nitems > dns_g_rdataset_max_records) {
+ 		return (DNS_R_TOOMANYRECORDS);
+ 	}
+ 
+@@ -662,7 +682,7 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab,
+ #endif
+ 	INSIST(ocount > 0 && ncount > 0);
+ 
+-	if (ocount + ncount > DNS_RDATASET_MAX_RECORDS) {
++	if (ocount + ncount > dns_g_rdataset_max_records) {
+ 		return (DNS_R_TOOMANYRECORDS);
+ 	}
+ 
+-- 
+2.45.2
+

SOURCES/bind-9.11-CVE-2024-1737.patch

@@ -0,0 +1,317 @@
+From 71df06e2bf3da31c5d542fb33dbda67b21537322 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
+Date: Fri, 1 Mar 2024 08:26:07 +0100
+Subject: [PATCH] [9.11][CVE-2024-1737] Add a limit to the number of RRs in
+ RRSets
+
+Add a limit to the number of RRs in RRSets
+
+Previously, the number of RRs in the RRSets were internally unlimited.
+As the data structure that holds the RRs is just a linked list, and
+there are places where we just walk through all of the RRs, adding an
+RRSet with huge number of RRs inside would slow down processing of said
+RRSets.
+
+The fix for end-of-life branches make the limit compile-time only for
+simplicity and the limit can be changed at the compile time by adding
+following define to CFLAGS:
+
+    -DDNS_RDATASET_MAX_RECORDS=<limit>
+
+(cherry picked from commit c5c4d00c38530390c9e1ae4c98b65fbbadfe9e5e)
+(cherry picked from commit 7f705778af729ada7fec36ac4b456c73329bd996)
+(cherry picked from commit b9b5485b22c364fb88c27aa04bad4c8f616da3fa)
+
+Add a limit to the number of RR types for single name
+
+Previously, the number of RR types for a single owner name was limited
+only by the maximum number of the types (64k).  As the data structure
+that holds the RR types for the database node is just a linked list, and
+there are places where we just walk through the whole list (again and
+again), adding a large number of RR types for a single owner named with
+would slow down processing of such name (database node).
+
+Add a hard-coded limit (100) to cap the number of the RR types for a single
+owner.  The limit can be changed at the compile time by adding following
+define to CFLAGS:
+
+    -DDNS_RBTDB_MAX_RTYPES=<limit>
+
+(cherry picked from commit 538b843d84f49ba5125ff545e3d0cf1c8434a8f2)
+(cherry picked from commit 3f10d6eff035702796ba82cd28b9f7cf9836e743)
+
+Optimize the slabheader placement for certain RRTypes
+
+Mark the infrastructure RRTypes as "priority" types and place them at
+the beginning of the rdataslab header data graph.  The non-priority
+types either go right after the priority types (if any).
+
+(cherry picked from commit 3ac482be7fd058d284e89873021339579fad0615)
+(cherry picked from commit 23a4652346fb2877d6246b1eebaa967969dbde16)
+
+[9.11][CVE-2024-1737 (part 2)] Be smarter about refusing to add many RR types to the database
+
+Expand the list of the priority types
+
+Add HTTPS, SVCB, SRV, PTR, NAPTR, DNSKEY and TXT records to the list of
+the priority types that are put at the beginning of the slabheader list
+for faster access and to avoid eviction when there are more types than
+the max-types-per-name limit.
+
+(cherry picked from commit b27c6bcce894786a8e082eafd59eccbf6f2731cb)
+(cherry picked from commit 3e0a67e4bdb253dae3a03a45c1aa117239a3313d)
+
+Be smarter about refusing to add many RR types to the database
+
+Instead of outright refusing to add new RR types to the cache, be a bit
+smarter:
+
+1. If the new header type is in our priority list, we always add either
+   positive or negative entry at the beginning of the list.
+
+2. If the new header type is negative entry, and we are over the limit,
+   we mark it as ancient immediately, so it gets evicted from the cache
+   as soon as possible.
+
+3. Otherwise add the new header after the priority headers (or at the
+   head of the list).
+
+4. If we are over the limit, evict the last entry on the normal header
+   list.
+
+(cherry picked from commit 57cd34441a1b4ecc9874a4a106c2c95b8d7a3120)
+(cherry picked from commit e4d7ce686bb38428eddc7e33b40057d68eca9a6e)
+---
+ configure           |   2 +-
+ configure.ac        |   2 +-
+ lib/dns/rbtdb.c     | 114 +++++++++++++++++++++++++++++++++++++++++++-
+ lib/dns/rdataslab.c |  12 +++++
+ 4 files changed, 126 insertions(+), 4 deletions(-)
+
+diff --git a/configure b/configure
+index e060e9d..6421c9b 100755
+--- a/configure
++++ b/configure
+@@ -12189,7 +12189,7 @@ fi
+ XTARGETS=
+ case "$enable_developer" in
+ yes)
+-	STD_CDEFINES="$STD_CDEFINES -DISC_LIST_CHECKINIT=1"
++	STD_CDEFINES="$STD_CDEFINES -DISC_LIST_CHECKINIT=1 -DDNS_RDATASET_MAX_RECORDS=5000 -DDNS_RBTDB_MAX_RTYPES=5000"
+ 	test "${enable_fixed_rrset+set}" = set || enable_fixed_rrset=yes
+ 	test "${enable_querytrace+set}" = set || enable_querytrace=yes
+ 	test "${enable_filter_aaaa+set}" = set || enable_filter_aaaa=yes
+diff --git a/configure.ac b/configure.ac
+index 83cad4a..1c35ce9 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -100,7 +100,7 @@ AC_ARG_ENABLE(developer,
+ XTARGETS=
+ case "$enable_developer" in
+ yes)
+-	STD_CDEFINES="$STD_CDEFINES -DISC_LIST_CHECKINIT=1"
++	STD_CDEFINES="$STD_CDEFINES -DISC_LIST_CHECKINIT=1 -DDNS_RDATASET_MAX_RECORDS=5000 -DDNS_RBTDB_MAX_RTYPES=5000"
+ 	test "${enable_fixed_rrset+set}" = set || enable_fixed_rrset=yes
+ 	test "${enable_querytrace+set}" = set || enable_querytrace=yes
+ 	test "${enable_filter_aaaa+set}" = set || enable_filter_aaaa=yes
+diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
+index ee59c1b..a2b2df7 100644
+--- a/lib/dns/rbtdb.c
++++ b/lib/dns/rbtdb.c
+@@ -1183,6 +1183,44 @@ set_ttl(dns_rbtdb_t *rbtdb, rdatasetheader_t *header, dns_ttl_t newttl) {
+ 		isc_heap_decreased(heap, header->heap_index);
+ }
+ 
++static bool
++prio_type(rbtdb_rdatatype_t type) {
++	switch (type) {
++	case dns_rdatatype_soa:
++	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_soa):
++	case dns_rdatatype_a:
++	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_a):
++	case dns_rdatatype_mx:
++	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_mx):
++	case dns_rdatatype_aaaa:
++	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_aaaa):
++	case dns_rdatatype_nsec:
++	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_nsec):
++	case dns_rdatatype_nsec3:
++	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_nsec3):
++	case dns_rdatatype_ns:
++	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_ns):
++	case dns_rdatatype_ds:
++	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_ds):
++	case dns_rdatatype_cname:
++	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_cname):
++	case dns_rdatatype_dname:
++	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_dname):
++	case dns_rdatatype_dnskey:
++	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_dnskey):
++	case dns_rdatatype_srv:
++	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_srv):
++	case dns_rdatatype_txt:
++	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_txt):
++	case dns_rdatatype_ptr:
++	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_ptr):
++	case dns_rdatatype_naptr:
++	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_naptr):
++		return (true);
++	}
++	return (false);
++}
++
+ /*%
+  * These functions allow the heap code to rank the priority of each
+  * element.  It returns true if v1 happens "sooner" than v2.
+@@ -6278,6 +6316,30 @@ update_recordsandbytes(bool add, rbtdb_version_t *rbtversion,
+ 	RWUNLOCK(&rbtversion->rwlock, isc_rwlocktype_write);
+ }
+ 
++#ifndef DNS_RBTDB_MAX_RTYPES
++#define DNS_RBTDB_MAX_RTYPES 100
++#endif /* DNS_RBTDB_MAX_RTYPES */
++
++static bool
++overmaxtype(dns_rbtdb_t *rbtdb, uint32_t ntypes) {
++	UNUSED(rbtdb);
++
++	if (DNS_RBTDB_MAX_RTYPES == 0) {
++		return (false);
++	}
++
++	return (ntypes >= DNS_RBTDB_MAX_RTYPES);
++}
++
++static bool
++prio_header(rdatasetheader_t *header) {
++	if (NEGATIVE(header) && prio_type(RBTDB_RDATATYPE_EXT(header->type))) {
++		return (true);
++	}
++
++	return (prio_type(header->type));
++}
++
+ /*
+  * write lock on rbtnode must be held.
+  */
+@@ -6288,6 +6350,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+ {
+ 	rbtdb_changed_t *changed = NULL;
+ 	rdatasetheader_t *topheader, *topheader_prev, *header, *sigheader;
++	rdatasetheader_t *prioheader = NULL, *expireheader = NULL;
+ 	unsigned char *merged;
+ 	isc_result_t result;
+ 	bool header_nx;
+@@ -6297,6 +6360,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+ 	rbtdb_rdatatype_t negtype, sigtype;
+ 	dns_trust_t trust;
+ 	int idx;
++	uint32_t ntypes = 0;
+ 
+ 	/*
+ 	 * Add an rdatasetheader_t to a node.
+@@ -6429,6 +6493,15 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+ 	for (topheader = rbtnode->data;
+ 	     topheader != NULL;
+ 	     topheader = topheader->next) {
++		if (IS_CACHE(rbtdb) && ACTIVE(topheader, now)) {
++			++ntypes;
++			expireheader = topheader;
++		} else if (!IS_CACHE(rbtdb)) {
++			++ntypes;
++		}
++		if (prio_header(topheader)) {
++			prioheader = topheader;
++		}
+ 		if (topheader->type == newheader->type ||
+ 		    topheader->type == negtype)
+ 			break;
+@@ -6792,9 +6865,46 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+ 			/*
+ 			 * No rdatasets of the given type exist at the node.
+ 			 */
+-			newheader->next = rbtnode->data;
++			if (!IS_CACHE(rbtdb) && overmaxtype(rbtdb, ntypes)) {
++				free_rdataset(rbtdb, rbtdb->common.mctx,
++					      newheader);
++				return (ISC_R_QUOTA);
++			}
++
+ 			newheader->down = NULL;
+-			rbtnode->data = newheader;
++
++			if (prio_header(newheader)) {
++				/* This is a priority type, prepend it */
++				newheader->next = rbtnode->data;
++				rbtnode->data = newheader;
++			} else if (prioheader != NULL) {
++				/* Append after the priority headers */
++				newheader->next = prioheader->next;
++				prioheader->next = newheader;
++			} else {
++				/* There were no priority headers */
++				newheader->next = rbtnode->data;
++				rbtnode->data = newheader;
++			}
++
++			if (IS_CACHE(rbtdb) && overmaxtype(rbtdb, ntypes)) {
++				if (expireheader == NULL) {
++					expireheader = newheader;
++				}
++				if (NEGATIVE(newheader) &&
++				    !prio_header(newheader))
++				{
++					/*
++					 * Add the new non-priority negative
++					 * header to the database only
++					 * temporarily.
++					 */
++					expireheader = newheader;
++				}
++
++				set_ttl(rbtdb, expireheader, 0);
++				mark_header_ancient(rbtdb, expireheader);
++			}
+ 		}
+ 	}
+ 
+diff --git a/lib/dns/rdataslab.c b/lib/dns/rdataslab.c
+index b0f77b1..347b7d2 100644
+--- a/lib/dns/rdataslab.c
++++ b/lib/dns/rdataslab.c
+@@ -115,6 +115,10 @@ fillin_offsets(unsigned char *offsetbase, unsigned int *offsettable,
+ }
+ #endif
+ 
++#ifndef DNS_RDATASET_MAX_RECORDS
++#define DNS_RDATASET_MAX_RECORDS 100
++#endif /* DNS_RDATASET_MAX_RECORDS */
++
+ isc_result_t
+ dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx,
+ 			   isc_region_t *region, unsigned int reservelen)
+@@ -161,6 +165,10 @@ dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx,
+ 		return (ISC_R_SUCCESS);
+ 	}
+ 
++	if (nitems > DNS_RDATASET_MAX_RECORDS) {
++		return (DNS_R_TOOMANYRECORDS);
++	}
++
+ 	if (nitems > 0xffff)
+ 		return (ISC_R_NOSPACE);
+ 
+@@ -654,6 +662,10 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab,
+ #endif
+ 	INSIST(ocount > 0 && ncount > 0);
+ 
++	if (ocount + ncount > DNS_RDATASET_MAX_RECORDS) {
++		return (DNS_R_TOOMANYRECORDS);
++	}
++
+ #if DNS_RDATASET_FIXED
+ 	oncount = ncount;
+ #endif
+-- 
+2.45.2
+

SOURCES/bind-9.11-CVE-2024-1975.patch

@@ -0,0 +1,322 @@
+From 5ff88892e43c049659a8a5aef8dfd56c3712daf0 Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Tue, 16 Jul 2024 19:49:09 +0200
+Subject: [PATCH] Resolve CVE-2024-1975
+
+6404.	[security]	Remove SIG(0) support from named as a countermeasure
+			for CVE-2024-1975. [GL #4480]
+
+Resolves: CVE-2024-1975
+---
+ bin/named/client.c                   |  7 +++
+ bin/tests/system/tsiggss/authsock.pl |  5 ++
+ bin/tests/system/tsiggss/tests.sh    | 12 ++--
+ bin/tests/system/upforwd/tests.sh    | 21 ++++---
+ doc/arm/Bv9ARM-book.xml              | 22 +++----
+ lib/dns/message.c                    | 94 +++-------------------------
+ 6 files changed, 49 insertions(+), 112 deletions(-)
+
+diff --git a/bin/named/client.c b/bin/named/client.c
+index 368bc94..ea121b3 100644
+--- a/bin/named/client.c
++++ b/bin/named/client.c
+@@ -3013,6 +3013,13 @@ client_request(isc_task_t *task, isc_event_t *event) {
+ 		ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
+ 			      NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(3),
+ 			      "request is signed by a nonauthoritative key");
++	} else if (result == DNS_R_NOTVERIFIEDYET &&
++		   client->message->sig0 != NULL)
++	{
++		ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
++			      NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(3),
++			      "request has a SIG(0) signature but its support "
++			      "was removed (CVE-2024-1975)");
+ 	} else {
+ 		char tsigrcode[64];
+ 		isc_buffer_t b;
+diff --git a/bin/tests/system/tsiggss/authsock.pl b/bin/tests/system/tsiggss/authsock.pl
+index ab3833d..0b231ee 100644
+--- a/bin/tests/system/tsiggss/authsock.pl
++++ b/bin/tests/system/tsiggss/authsock.pl
+@@ -31,6 +31,10 @@ if (!defined($path)) {
+ 	exit(1);
+ }
+ 
++# Enable output autoflush so that it's not lost when the parent sends TERM.
++select STDOUT;
++$| = 1;
++
+ unlink($path);
+ my $server = IO::Socket::UNIX->new(Local => $path, Type => SOCK_STREAM, Listen => 8) or
+     die "unable to create socket $path";
+@@ -53,6 +57,7 @@ if ($timeout != 0) {
+ }
+ 
+ while (my $client = $server->accept()) {
++	printf("accept()\n");
+ 	$client->recv(my $buf, 8, 0);
+ 	my ($version, $req_len) = unpack('N N', $buf);
+ 
+diff --git a/bin/tests/system/tsiggss/tests.sh b/bin/tests/system/tsiggss/tests.sh
+index 456ce61..d0db388 100644
+--- a/bin/tests/system/tsiggss/tests.sh
++++ b/bin/tests/system/tsiggss/tests.sh
+@@ -116,7 +116,7 @@ status=$((status+ret))
+ 
+ echo_i "testing external update policy (CNAME) with auth sock ($n)"
+ ret=0
+-$PERL ./authsock.pl --type=CNAME --path=ns1/auth.sock --pidfile=authsock.pid --timeout=120 > /dev/null 2>&1 &
++$PERL ./authsock.pl --type=CNAME --path=ns1/auth.sock --pidfile=authsock.pid --timeout=120 >authsock.log 2>&1 &
+ sleep 1
+ test_update $n testcname.example.nil. CNAME "86400 CNAME testdenied.example.nil" "testdenied" || ret=1
+ n=$((n+1))
+@@ -130,17 +130,19 @@ n=$((n+1))
+ if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
+ status=$((status+ret))
+ 
+-echo_i "testing external policy with SIG(0) key ($n)"
++echo_i "testing external policy with unsupported SIG(0) key ($n)"
+ ret=0
+-$NSUPDATE -R $RANDFILE -k ns1/Kkey.example.nil.*.private <<END > /dev/null 2>&1 || ret=1
++$NSUPDATE -R $RANDFILE -k ns1/Kkey.example.nil.*.private <<END >nsupdate.out${n} 2>&1 || true
++debug
+ server 10.53.0.1 ${PORT}
+ zone example.nil
+ update add fred.example.nil 120 cname foo.bar.
+ send
+ END
++# update must have failed - SIG(0) signer is not supported
+ output=`$DIG $DIGOPTS +short cname fred.example.nil.`
+-[ -n "$output" ] || ret=1
+-[ $ret -eq 0 ] || echo_i "failed"
++[ -n "$output" ] && ret=1
++grep -F "signer=key.example.nil" authsock.log >/dev/null && ret=1
+ n=$((n+1))
+ if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
+ status=$((status+ret))
+diff --git a/bin/tests/system/upforwd/tests.sh b/bin/tests/system/upforwd/tests.sh
+index ebc9ded..f5b89d4 100644
+--- a/bin/tests/system/upforwd/tests.sh
++++ b/bin/tests/system/upforwd/tests.sh
+@@ -181,19 +181,22 @@ n=`expr $n + 1`
+ 
+ if test -f keyname
+ then
+-	echo_i "checking update forwarding to with sig0 ($n)"
++	echo_i "checking update forwarding to with sig0 (expected to fail) ($n)"
+ 	ret=0
+ 	keyname=`cat keyname`
+-	$NSUPDATE -k $keyname.private -- - <<EOF
+-	local 10.53.0.1
+-	server 10.53.0.3 ${PORT}
+-	zone example2
+-	update add unsigned.example2. 600 A 10.10.10.1
+-	update add unsigned.example2. 600 TXT Foo
+-	send
++	# SIG(0) is removed, update is expected to fail.
++	{
++	  $NSUPDATE -k $keyname.private -- - <<EOF
++	  local 10.53.0.1
++	  server 10.53.0.3 ${PORT}
++	  zone example2
++	  update add unsigned.example2. 600 A 10.10.10.1
++	  update add unsigned.example2. 600 TXT Foo
++	  send
+ EOF
++	} >nsupdate.out.$n 2>&1 && ret=1
+ 	$DIG -p ${PORT} unsigned.example2 A @10.53.0.1 > dig.out.ns1.test$n
+-	grep "status: NOERROR" dig.out.ns1.test$n > /dev/null || ret=1
++	grep "status: NOERROR" dig.out.ns1.test$n >/dev/null && ret=1
+ 	if [ $ret != 0 ] ; then echo_i "failed"; fi
+ 	status=`expr $status + $ret`
+ 	n=`expr $n + 1`
+diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
+index acf772b..563dced 100644
+--- a/doc/arm/Bv9ARM-book.xml
++++ b/doc/arm/Bv9ARM-book.xml
+@@ -2027,7 +2027,7 @@ allow-update { !{ !localnets; any; }; key host1-host2. ;};
+ 	The TKEY process is initiated by a client or server by sending
+ 	a query of type TKEY to a TKEY-aware server.  The query must include
+ 	an appropriate KEY record in the additional section, and
+-	must be signed using either TSIG or SIG(0) with a previously
++	must be signed using TSIG with a previously
+ 	established key.  The server's response, if successful,
+ 	contains a TKEY record in its answer section.  After this transaction,
+ 	both participants have enough information to calculate a
+@@ -2050,24 +2050,24 @@ allow-update { !{ !localnets; any; }; key host1-host2. ;};
+     <section xml:id="sig0"><info><title>SIG(0)</title></info>
+ 
+       <para>
+-	<acronym>BIND</acronym> partially supports DNSSEC SIG(0)
++	<acronym>BIND</acronym> partially supported DNSSEC SIG(0)
+ 	transaction signatures as specified in RFC 2535 and RFC 2931.
+ 	SIG(0) uses public/private keys to authenticate messages.  Access control
+-	is performed in the same manner as with TSIG keys; privileges can be
++	were performed in the same manner as with TSIG keys; privileges can be
+ 	granted or denied in ACL directives based on the key name.
+       </para>
+       <para>
+-	When a SIG(0) signed message is received, it is only
++	When a SIG(0) signed message were received, it were only
+ 	verified if the key is known and trusted by the server. The
+-	server does not attempt to recursively fetch or validate the
++	server did not attempt to recursively fetch or validate the
+ 	key.
+       </para>
+       <para>
+-	SIG(0) signing of multiple-message TCP streams is not supported.
++	SIG(0) signing of multiple-message TCP streams were not supported.
+       </para>
+       <para>
+-	The only tool shipped with <acronym>BIND</acronym> 9 that
+-	generates SIG(0) signed messages is <command>nsupdate</command>.
++	Support for SIG(0) message verification was removed
++	as part of the mitigation of CVE-2024-1975.
+       </para>
+     </section>
+ 
+@@ -12655,7 +12655,7 @@ example.com. NS ns2.example.net.
+ 	      either grants or denies permission for one or more
+ 	      names in the zone to be updated by one or more
+ 	      identities. Identity is determined by the key that
+-	      signed the update request, using either TSIG or SIG(0).
++	      signed the update request, using TSIG.
+ 	      In most cases, <command>update-policy</command> rules
+ 	      only apply to key-based identities.  There is no way
+ 	      to specify update permissions based on client source
+@@ -12742,7 +12742,7 @@ example.com. NS ns2.example.net.
+ 	    <para>
+ 	      The <command>identity</command> field must be set to
+ 	      a fully qualified domain name.  In most cases, this
+-	      represents the name of the TSIG or SIG(0) key that must be
++	      represents the name of the TSIG key that must be
+ 	      used to sign the update request.  If the specified name is a
+ 	      wildcard, it is subject to DNS wildcard expansion, and the
+ 	      rule may apply to multiple identities.  When a TKEY exchange
+@@ -15952,7 +15952,7 @@ HOST-127.EXAMPLE. MX 0 .
+ 	</para>
+ 	<para>
+ 	  ACLs match clients on the basis of up to three characteristics:
+-	  1) The client's IP address; 2) the TSIG or SIG(0) key that was
++	  1) The client's IP address; 2) the TSIG key that was
+ 	  used to sign the request, if any; and 3) an address prefix
+ 	  encoded in an EDNS Client-Subnet option, if any.
+ 	</para>
+diff --git a/lib/dns/message.c b/lib/dns/message.c
+index a44eb2d..9ea2b9e 100644
+--- a/lib/dns/message.c
++++ b/lib/dns/message.c
+@@ -3373,103 +3373,23 @@ dns_message_dumpsig(dns_message_t *msg, char *txt1) {
+ 
+ isc_result_t
+ dns_message_checksig(dns_message_t *msg, dns_view_t *view) {
+-	isc_buffer_t b, msgb;
++	isc_buffer_t msgb;
+ 
+ 	REQUIRE(DNS_MESSAGE_VALID(msg));
+ 
+-	if (msg->tsigkey == NULL && msg->tsig == NULL && msg->sig0 == NULL)
++	if (msg->tsigkey == NULL && msg->tsig == NULL)
+ 		return (ISC_R_SUCCESS);
+ 
+ 	INSIST(msg->saved.base != NULL);
+ 	isc_buffer_init(&msgb, msg->saved.base, msg->saved.length);
+ 	isc_buffer_add(&msgb, msg->saved.length);
+-	if (msg->tsigkey != NULL || msg->tsig != NULL) {
+ #ifdef SKAN_MSG_DEBUG
+-		dns_message_dumpsig(msg, "dns_message_checksig#1");
++	dns_message_dumpsig(msg, "dns_message_checksig#1");
+ #endif
+-		if (view != NULL)
+-			return (dns_view_checksig(view, &msgb, msg));
+-		else
+-			return (dns_tsig_verify(&msgb, msg, NULL, NULL));
+-	} else {
+-		dns_rdata_t rdata = DNS_RDATA_INIT;
+-		dns_rdata_sig_t sig;
+-		dns_rdataset_t keyset;
+-		isc_result_t result;
+-
+-		result = dns_rdataset_first(msg->sig0);
+-		INSIST(result == ISC_R_SUCCESS);
+-		dns_rdataset_current(msg->sig0, &rdata);
+-
+-		/*
+-		 * This can occur when the message is a dynamic update, since
+-		 * the rdata length checking is relaxed.  This should not
+-		 * happen in a well-formed message, since the SIG(0) is only
+-		 * looked for in the additional section, and the dynamic update
+-		 * meta-records are in the prerequisite and update sections.
+-		 */
+-		if (rdata.length == 0)
+-			return (ISC_R_UNEXPECTEDEND);
+-
+-		result = dns_rdata_tostruct(&rdata, &sig, msg->mctx);
+-		if (result != ISC_R_SUCCESS)
+-			return (result);
+-
+-		dns_rdataset_init(&keyset);
+-		if (view == NULL)
+-			return (DNS_R_KEYUNAUTHORIZED);
+-		result = dns_view_simplefind(view, &sig.signer,
+-					     dns_rdatatype_key /* SIG(0) */,
+-					     0, 0, false, &keyset, NULL);
+-
+-		if (result != ISC_R_SUCCESS) {
+-			/* XXXBEW Should possibly create a fetch here */
+-			result = DNS_R_KEYUNAUTHORIZED;
+-			goto freesig;
+-		} else if (keyset.trust < dns_trust_secure) {
+-			/* XXXBEW Should call a validator here */
+-			result = DNS_R_KEYUNAUTHORIZED;
+-			goto freesig;
+-		}
+-		result = dns_rdataset_first(&keyset);
+-		INSIST(result == ISC_R_SUCCESS);
+-		for (;
+-		     result == ISC_R_SUCCESS;
+-		     result = dns_rdataset_next(&keyset))
+-		{
+-			dst_key_t *key = NULL;
+-
+-			dns_rdata_reset(&rdata);
+-			dns_rdataset_current(&keyset, &rdata);
+-			isc_buffer_init(&b, rdata.data, rdata.length);
+-			isc_buffer_add(&b, rdata.length);
+-
+-			result = dst_key_fromdns(&sig.signer, rdata.rdclass,
+-						 &b, view->mctx, &key);
+-			if (result != ISC_R_SUCCESS)
+-				continue;
+-			if (dst_key_alg(key) != sig.algorithm ||
+-			    dst_key_id(key) != sig.keyid ||
+-			    !(dst_key_proto(key) == DNS_KEYPROTO_DNSSEC ||
+-			      dst_key_proto(key) == DNS_KEYPROTO_ANY))
+-			{
+-				dst_key_free(&key);
+-				continue;
+-			}
+-			result = dns_dnssec_verifymessage(&msgb, msg, key);
+-			dst_key_free(&key);
+-			if (result == ISC_R_SUCCESS)
+-				break;
+-		}
+-		if (result == ISC_R_NOMORE)
+-			result = DNS_R_KEYUNAUTHORIZED;
+-
+- freesig:
+-		if (dns_rdataset_isassociated(&keyset))
+-			dns_rdataset_disassociate(&keyset);
+-		dns_rdata_freestruct(&sig);
+-		return (result);
+-	}
++	if (view != NULL)
++		return (dns_view_checksig(view, &msgb, msg));
++	else
++		return (dns_tsig_verify(&msgb, msg, NULL, NULL));
+ }
+ 
+ #define INDENT(sp) \
+-- 
+2.45.2
+

SOURCES/bind-9.11-fips-code-includes.patch

@@ -1,4 +1,4 @@
-From 68baeb7211ba2fcd4eff53d987e9b70ba38294cb Mon Sep 17 00:00:00 2001
+From c928591eb2a3b17c5be0cad56c8e061ebba11a95 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 20 Dec 2018 11:52:12 +0100
 Subject: [PATCH] Fix implicit declaration warning
@@ -11,7 +11,7 @@ header providing it in files that use it.
  2 files changed, 2 insertions(+)
 
 diff --git a/bin/tests/system/tkey/keydelete.c b/bin/tests/system/tkey/keydelete.c
-index 36ee6c7..6051cd2 100644
+index 4b5b901..a3dd450 100644
 --- a/bin/tests/system/tkey/keydelete.c
 +++ b/bin/tests/system/tkey/keydelete.c
 @@ -21,6 +21,7 @@
@@ -23,7 +23,7 @@ index 36ee6c7..6051cd2 100644
  #include <isc/sockaddr.h>
  #include <isc/socket.h>
 diff --git a/lib/dns/tsig.c b/lib/dns/tsig.c
-index 70805bb..33870f3 100644
+index c37b235..7786801 100644
 --- a/lib/dns/tsig.c
 +++ b/lib/dns/tsig.c
 @@ -18,6 +18,7 @@
@@ -31,9 +31,9 @@ index 70805bb..33870f3 100644
  #include <isc/buffer.h>
  #include <isc/mem.h>
 +#include <isc/md5.h>
+ #include <isc/print.h>
  #include <isc/print.h>
  #include <isc/refcount.h>
- #include <isc/serial.h>
 -- 
-2.14.5
+2.26.2
 

SOURCES/bind-9.11-fips-tests.patch

@@ -1,4 +1,4 @@
-From c23daf334d5487fa53fef88c82312e439a2d8523 Mon Sep 17 00:00:00 2001
+From 1dc81c51cd5c70b783aab8b6156aec4cfedd6fe3 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 2 Aug 2018 23:46:45 +0200
 Subject: [PATCH] FIPS tests changes
@@ -80,7 +80,7 @@ Date:   Wed Mar 7 10:44:23 2018 +0100
  bin/tests/system/digdelv/tests.sh             | 20 +++---
  bin/tests/system/dlv/ns1/sign.sh              |  4 +-
  bin/tests/system/dlv/ns2/sign.sh              |  4 +-
- bin/tests/system/dlv/ns6/sign.sh              | 66 +++++++++---------
+ bin/tests/system/dlv/ns6/sign.sh              | 66 ++++++++++---------
  bin/tests/system/dnssec/ns2/sign.sh           |  8 +--
  bin/tests/system/dnssec/ns5/trusted.conf.bad  |  2 +-
  bin/tests/system/dnssec/tests.sh              |  4 +-
@@ -92,22 +92,21 @@ Date:   Wed Mar 7 10:44:23 2018 +0100
  bin/tests/system/nsupdate/ns1/named.conf.in   |  2 +-
  bin/tests/system/nsupdate/ns2/named.conf.in   |  2 +-
  bin/tests/system/nsupdate/setup.sh            |  7 +-
- bin/tests/system/nsupdate/tests.sh            | 11 ++-
+ bin/tests/system/nsupdate/tests.sh            | 11 +++-
  bin/tests/system/rndc/setup.sh                |  2 +-
  bin/tests/system/rndc/tests.sh                | 23 ++++---
- bin/tests/system/tsig/clean.sh                |  1 +
  bin/tests/system/tsig/ns1/named.conf.in       | 10 +--
+ bin/tests/system/tsig/ns1/rndc5.conf.in       | 10 +++
  bin/tests/system/tsig/setup.sh                |  5 ++
- bin/tests/system/tsig/tests.sh                | 67 ++++++++++++-------
+ bin/tests/system/tsig/tests.sh                | 65 +++++++++++-------
  bin/tests/system/tsiggss/setup.sh             |  2 +-
  bin/tests/system/upforwd/ns1/named.conf.in    |  2 +-
  bin/tests/system/upforwd/tests.sh             |  2 +-
- bin/tests/system/tsig/ns1/rndc5.conf.in | 10 +++
- 45 files changed, 232 insertions(+), 171 deletions(-)
+ 44 files changed, 230 insertions(+), 170 deletions(-)
  create mode 100644 bin/tests/system/tsig/ns1/rndc5.conf.in
 
 diff --git a/bin/tests/system/acl/ns2/named1.conf.in b/bin/tests/system/acl/ns2/named1.conf.in
-index 0ea6502..026db3f 100644
+index 9999ada..e3f8d0e 100644
 --- a/bin/tests/system/acl/ns2/named1.conf.in
 +++ b/bin/tests/system/acl/ns2/named1.conf.in
 @@ -33,12 +33,12 @@ options {
@@ -126,7 +125,7 @@ index 0ea6502..026db3f 100644
  };
  
 diff --git a/bin/tests/system/acl/ns2/named2.conf.in b/bin/tests/system/acl/ns2/named2.conf.in
-index b877880..d8f50be 100644
+index f8ec34e..d2d6ad3 100644
 --- a/bin/tests/system/acl/ns2/named2.conf.in
 +++ b/bin/tests/system/acl/ns2/named2.conf.in
 @@ -33,12 +33,12 @@ options {
@@ -145,7 +144,7 @@ index b877880..d8f50be 100644
  };
  
 diff --git a/bin/tests/system/acl/ns2/named3.conf.in b/bin/tests/system/acl/ns2/named3.conf.in
-index 0a95062..aa54088 100644
+index 2acb813..6a00344 100644
 --- a/bin/tests/system/acl/ns2/named3.conf.in
 +++ b/bin/tests/system/acl/ns2/named3.conf.in
 @@ -33,17 +33,17 @@ options {
@@ -170,7 +169,7 @@ index 0a95062..aa54088 100644
  };
  
 diff --git a/bin/tests/system/acl/ns2/named4.conf.in b/bin/tests/system/acl/ns2/named4.conf.in
-index 7cdcb6e..606a345 100644
+index bca3ee1..5913420 100644
 --- a/bin/tests/system/acl/ns2/named4.conf.in
 +++ b/bin/tests/system/acl/ns2/named4.conf.in
 @@ -33,12 +33,12 @@ options {
@@ -189,7 +188,7 @@ index 7cdcb6e..606a345 100644
  };
  
 diff --git a/bin/tests/system/acl/ns2/named5.conf.in b/bin/tests/system/acl/ns2/named5.conf.in
-index 4b4e050..0e679a8 100644
+index 9ef8171..5ae8d38 100644
 --- a/bin/tests/system/acl/ns2/named5.conf.in
 +++ b/bin/tests/system/acl/ns2/named5.conf.in
 @@ -34,12 +34,12 @@ options {
@@ -208,7 +207,7 @@ index 4b4e050..0e679a8 100644
  };
  
 diff --git a/bin/tests/system/acl/tests.sh b/bin/tests/system/acl/tests.sh
-index 09f31f2..f88f0d4 100644
+index 2ee34a0..a73a54e 100644
 --- a/bin/tests/system/acl/tests.sh
 +++ b/bin/tests/system/acl/tests.sh
 @@ -22,14 +22,14 @@ echo_i "testing basic ACL processing"
@@ -334,7 +333,7 @@ index 09f31f2..f88f0d4 100644
  
  echo_i "testing allow-query-on ACL processing"
 diff --git a/bin/tests/system/allow-query/ns2/named10.conf.in b/bin/tests/system/allow-query/ns2/named10.conf.in
-index 1569913..e9c5c2d 100644
+index a579f32..3b8f853 100644
 --- a/bin/tests/system/allow-query/ns2/named10.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named10.conf.in
 @@ -12,7 +12,7 @@
@@ -347,7 +346,7 @@ index 1569913..e9c5c2d 100644
  };
  
 diff --git a/bin/tests/system/allow-query/ns2/named11.conf.in b/bin/tests/system/allow-query/ns2/named11.conf.in
-index 18ac91c..2b1c873 100644
+index 166afa1..997ece9 100644
 --- a/bin/tests/system/allow-query/ns2/named11.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named11.conf.in
 @@ -12,12 +12,12 @@
@@ -366,7 +365,7 @@ index 18ac91c..2b1c873 100644
  };
  
 diff --git a/bin/tests/system/allow-query/ns2/named12.conf.in b/bin/tests/system/allow-query/ns2/named12.conf.in
-index b824844..dd48945 100644
+index 25271a5..a9cb65d 100644
 --- a/bin/tests/system/allow-query/ns2/named12.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named12.conf.in
 @@ -12,7 +12,7 @@
@@ -379,7 +378,7 @@ index b824844..dd48945 100644
  };
  
 diff --git a/bin/tests/system/allow-query/ns2/named30.conf.in b/bin/tests/system/allow-query/ns2/named30.conf.in
-index aeb1540..bfce58b 100644
+index c7c8254..f165e65 100644
 --- a/bin/tests/system/allow-query/ns2/named30.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named30.conf.in
 @@ -12,7 +12,7 @@
@@ -392,7 +391,7 @@ index aeb1540..bfce58b 100644
  };
  
 diff --git a/bin/tests/system/allow-query/ns2/named31.conf.in b/bin/tests/system/allow-query/ns2/named31.conf.in
-index d4b7432..e0f5252 100644
+index 567bbcc..4fd2035 100644
 --- a/bin/tests/system/allow-query/ns2/named31.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named31.conf.in
 @@ -12,12 +12,12 @@
@@ -411,7 +410,7 @@ index d4b7432..e0f5252 100644
  };
  
 diff --git a/bin/tests/system/allow-query/ns2/named32.conf.in b/bin/tests/system/allow-query/ns2/named32.conf.in
-index c025938..87afb3f 100644
+index b75161f..7b254e6 100644
 --- a/bin/tests/system/allow-query/ns2/named32.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named32.conf.in
 @@ -12,7 +12,7 @@
@@ -424,7 +423,7 @@ index c025938..87afb3f 100644
  };
  
 diff --git a/bin/tests/system/allow-query/ns2/named40.conf.in b/bin/tests/system/allow-query/ns2/named40.conf.in
-index d83b376..d726b94 100644
+index 9e17818..22f5001 100644
 --- a/bin/tests/system/allow-query/ns2/named40.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named40.conf.in
 @@ -16,12 +16,12 @@ acl accept { 10.53.0.2; };
@@ -443,7 +442,7 @@ index d83b376..d726b94 100644
  };
  
 diff --git a/bin/tests/system/allow-query/tests.sh b/bin/tests/system/allow-query/tests.sh
-index fb6059d..f960156 100644
+index 791a1a4..95cd971 100644
 --- a/bin/tests/system/allow-query/tests.sh
 +++ b/bin/tests/system/allow-query/tests.sh
 @@ -190,7 +190,7 @@ rndc_reload
@@ -528,7 +527,7 @@ index fb6059d..f960156 100644
  grep '^a.keydisallow.example' dig.out.ns2.$n > /dev/null && ret=1
  if [ $ret != 0 ]; then echo_i "failed"; fi
 diff --git a/bin/tests/system/catz/ns1/named.conf.in b/bin/tests/system/catz/ns1/named.conf.in
-index 74b7d37..c353766 100644
+index 6856ec7..0ac1fa3 100644
 --- a/bin/tests/system/catz/ns1/named.conf.in
 +++ b/bin/tests/system/catz/ns1/named.conf.in
 @@ -61,5 +61,5 @@ zone "catalog4.example" {
@@ -539,7 +538,7 @@ index 74b7d37..c353766 100644
 +	algorithm hmac-sha256;
  };
 diff --git a/bin/tests/system/catz/ns2/named.conf.in b/bin/tests/system/catz/ns2/named.conf.in
-index ee83efb..35ced08 100644
+index dd3a9dc..77b8d96 100644
 --- a/bin/tests/system/catz/ns2/named.conf.in
 +++ b/bin/tests/system/catz/ns2/named.conf.in
 @@ -70,5 +70,5 @@ zone "catalog4.example" {
@@ -550,7 +549,7 @@ index ee83efb..35ced08 100644
 +	algorithm hmac-sha256;
  };
 diff --git a/bin/tests/system/checkconf/bad-tsig.conf b/bin/tests/system/checkconf/bad-tsig.conf
-index 21be03e..e57c308 100644
+index 338dddb..90cd424 100644
 --- a/bin/tests/system/checkconf/bad-tsig.conf
 +++ b/bin/tests/system/checkconf/bad-tsig.conf
 @@ -11,7 +11,7 @@
@@ -563,10 +562,10 @@ index 21be03e..e57c308 100644
  };
  
 diff --git a/bin/tests/system/checkconf/good.conf b/bin/tests/system/checkconf/good.conf
-index 9ab35b3..486551a 100644
+index 2282f87..1359cf3 100644
 --- a/bin/tests/system/checkconf/good.conf
 +++ b/bin/tests/system/checkconf/good.conf
-@@ -153,6 +153,6 @@ dyndb "name" "library.so" {
+@@ -159,6 +159,6 @@ dyndb "name" "library.so" {
  	system;
  };
  key "mykey" {
@@ -575,7 +574,7 @@ index 9ab35b3..486551a 100644
  	secret "qwertyuiopasdfgh";
  };
 diff --git a/bin/tests/system/digdelv/ns2/example.db b/bin/tests/system/digdelv/ns2/example.db
-index f4e30f5..9f53e31 100644
+index b66207a..359b220 100644
 --- a/bin/tests/system/digdelv/ns2/example.db
 +++ b/bin/tests/system/digdelv/ns2/example.db
 @@ -38,12 +38,15 @@ foo			SSHFP	2 1 123456789abcdef67890123456789abcdef67890
@@ -601,10 +600,10 @@ index f4e30f5..9f53e31 100644
  ; TTL of 3 weeks
  weeks		1814400	A	10.53.0.2
 diff --git a/bin/tests/system/digdelv/tests.sh b/bin/tests/system/digdelv/tests.sh
-index ade45ce..d3aff24 100644
+index a3ebc31..0d9b9b8 100644
 --- a/bin/tests/system/digdelv/tests.sh
 +++ b/bin/tests/system/digdelv/tests.sh
-@@ -106,7 +106,7 @@ if [ -x "$DIG" ] ; then
+@@ -173,7 +173,7 @@ if [ -x "$DIG" ] ; then
    echo_i "checking dig +rrcomments works for DNSKEY($n)"
    ret=0
    $DIG $DIGOPTS +tcp @10.53.0.3 +rrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1
@@ -613,7 +612,7 @@ index ade45ce..d3aff24 100644
    check_ttl_range dig.out.test$n "DNSKEY" 300 || ret=1
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
-@@ -115,7 +115,7 @@ if [ -x "$DIG" ] ; then
+@@ -182,7 +182,7 @@ if [ -x "$DIG" ] ; then
    echo_i "checking dig +short +rrcomments works for DNSKEY ($n)"
    ret=0
    $DIG $DIGOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1
@@ -622,7 +621,7 @@ index ade45ce..d3aff24 100644
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
  
-@@ -123,7 +123,7 @@ if [ -x "$DIG" ] ; then
+@@ -190,7 +190,7 @@ if [ -x "$DIG" ] ; then
    echo_i "checking dig +short +nosplit works($n)"
    ret=0
    $DIG $DIGOPTS +tcp @10.53.0.3 +short +nosplit DNSKEY dnskey.example > dig.out.test$n || ret=1
@@ -631,7 +630,7 @@ index ade45ce..d3aff24 100644
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
  
-@@ -131,7 +131,7 @@ if [ -x "$DIG" ] ; then
+@@ -198,7 +198,7 @@ if [ -x "$DIG" ] ; then
    echo_i "checking dig +short +rrcomments works($n)"
    ret=0
    $DIG $DIGOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1
@@ -640,7 +639,7 @@ index ade45ce..d3aff24 100644
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
  
-@@ -148,7 +148,7 @@ if [ -x "$DIG" ] ; then
+@@ -215,7 +215,7 @@ if [ -x "$DIG" ] ; then
    echo_i "checking dig +short +rrcomments works($n)"
    ret=0
    $DIG $DIGOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1
@@ -649,7 +648,7 @@ index ade45ce..d3aff24 100644
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
  
-@@ -695,7 +695,7 @@ if [ -x ${DELV} ] ; then
+@@ -846,7 +846,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +rrcomments works for DNSKEY($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +rrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
@@ -658,7 +657,7 @@ index ade45ce..d3aff24 100644
    check_ttl_range delv.out.test$n "DNSKEY" 300 || ret=1
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
-@@ -704,7 +704,7 @@ if [ -x ${DELV} ] ; then
+@@ -855,7 +855,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +short +rrcomments works for DNSKEY ($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
@@ -667,7 +666,7 @@ index ade45ce..d3aff24 100644
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
  
-@@ -712,7 +712,7 @@ if [ -x ${DELV} ] ; then
+@@ -863,7 +863,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +short +rrcomments works ($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
@@ -676,7 +675,7 @@ index ade45ce..d3aff24 100644
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
  
-@@ -720,7 +720,7 @@ if [ -x ${DELV} ] ; then
+@@ -871,7 +871,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +short +nosplit works ($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +short +nosplit DNSKEY dnskey.example > delv.out.test$n || ret=1
@@ -685,7 +684,7 @@ index ade45ce..d3aff24 100644
    if test `wc -l < delv.out.test$n` != 1 ; then ret=1 ; fi
    f=`awk '{print NF}' < delv.out.test$n`
    test "${f:-0}" -eq 14 || ret=1
-@@ -731,7 +731,7 @@ if [ -x ${DELV} ] ; then
+@@ -882,7 +882,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +short +nosplit +norrcomments works ($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +short +nosplit +norrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
@@ -695,7 +694,7 @@ index ade45ce..d3aff24 100644
    f=`awk '{print NF}' < delv.out.test$n`
    test "${f:-0}" -eq 4 || ret=1
 diff --git a/bin/tests/system/dlv/ns1/sign.sh b/bin/tests/system/dlv/ns1/sign.sh
-index 606e7cc..a3a0d60 100755
+index 14ca5db..3f522d0 100755
 --- a/bin/tests/system/dlv/ns1/sign.sh
 +++ b/bin/tests/system/dlv/ns1/sign.sh
 @@ -23,8 +23,8 @@ infile=root.db.in
@@ -710,7 +709,7 @@ index 606e7cc..a3a0d60 100755
  cat $infile $keyname1.key $keyname2.key >$zonefile
  
 diff --git a/bin/tests/system/dlv/ns2/sign.sh b/bin/tests/system/dlv/ns2/sign.sh
-index 9825c57..202c978 100755
+index d870798..b0ab372 100755
 --- a/bin/tests/system/dlv/ns2/sign.sh
 +++ b/bin/tests/system/dlv/ns2/sign.sh
 @@ -24,8 +24,8 @@ zonefile=druz.db
@@ -725,7 +724,7 @@ index 9825c57..202c978 100755
  cat $infile $keyname1.key $keyname2.key >$zonefile
  
 diff --git a/bin/tests/system/dlv/ns6/sign.sh b/bin/tests/system/dlv/ns6/sign.sh
-index 1e39862..4ed19ac 100755
+index ba39f90..f20a2dd 100755
 --- a/bin/tests/system/dlv/ns6/sign.sh
 +++ b/bin/tests/system/dlv/ns6/sign.sh
 @@ -16,13 +16,15 @@ SYSTESTDIR=dlv
@@ -912,7 +911,7 @@ index 1e39862..4ed19ac 100755
  cat $infile $keyname1.key $keyname2.key >$zonefile
  
 diff --git a/bin/tests/system/dnssec/ns2/sign.sh b/bin/tests/system/dnssec/ns2/sign.sh
-index 13fb924..1ffa279 100644
+index d401823..139c7ad 100644
 --- a/bin/tests/system/dnssec/ns2/sign.sh
 +++ b/bin/tests/system/dnssec/ns2/sign.sh
 @@ -126,8 +126,8 @@ zone=in-addr.arpa.
@@ -945,7 +944,7 @@ index 13fb924..1ffa279 100644
  cat $dlvinfile $dlvkeyname.key $dlvsetfile > $dlvzonefile
  
 diff --git a/bin/tests/system/dnssec/ns5/trusted.conf.bad b/bin/tests/system/dnssec/ns5/trusted.conf.bad
-index ed30460..e6b1126 100644
+index 75cf699..b4d848c 100644
 --- a/bin/tests/system/dnssec/ns5/trusted.conf.bad
 +++ b/bin/tests/system/dnssec/ns5/trusted.conf.bad
 @@ -10,5 +10,5 @@
@@ -956,10 +955,10 @@ index ed30460..e6b1126 100644
 +    "." 256 3 8 "AwEAAarwAdjV4gIhpBCjXVAScRFEx3co7k8smJdxrnqoGsl5NB7EZ9jRdgvCXbJn6v8y9jlNWVHvaC8ilhfhLh0A1vLWiWv4ijd/12xcnrY7xpG7Cu3YkxUxaXJ7Jdg/Iw1+9mGgXF1v4UbCIcw/3U3cxyk7OxYg+VSb5KBAQSR0upxV";
  };
 diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh
-index b31c1b4..a5e237b 100644
+index 30f7fc5..2f34b6d 100644
 --- a/bin/tests/system/dnssec/tests.sh
 +++ b/bin/tests/system/dnssec/tests.sh
-@@ -3235,8 +3235,8 @@ do
+@@ -3281,8 +3281,8 @@ do
  	   alg=`expr $alg + 1`
  	   continue;;
  	3) size="-b 512";;
@@ -971,7 +970,7 @@ index b31c1b4..a5e237b 100644
  	8) size="-b 512";;
  	10) size="-b 1024";;
 diff --git a/bin/tests/system/feature-test.c b/bin/tests/system/feature-test.c
-index c1249ed..20a3139 100644
+index 5e473ab..b08692e 100644
 --- a/bin/tests/system/feature-test.c
 +++ b/bin/tests/system/feature-test.c
 @@ -19,6 +19,7 @@
@@ -983,14 +982,14 @@ index c1249ed..20a3139 100644
  
  #ifdef WIN32
 @@ -47,6 +48,7 @@ usage() {
- 	fprintf(stderr, "	--have-geoip2\n");
- 	fprintf(stderr, "	--have-libxml2\n");
- 	fprintf(stderr, "	--ipv6only=no\n");
-+	fprintf(stderr, "       --md5\n");
- 	fprintf(stderr, "	--rpz-nsdname\n");
- 	fprintf(stderr, "	--rpz-nsip\n");
- 	fprintf(stderr, "	--with-idn\n");
-@@ -155,6 +157,18 @@ main(int argc, char **argv) {
+ 	fprintf(stderr, "\t--have-geoip\n");
+ 	fprintf(stderr, "\t--have-libxml2\n");
+ 	fprintf(stderr, "\t--ipv6only=no\n");
++	fprintf(stderr, "\t--md5\n");
+ 	fprintf(stderr, "\t--rpz-log-qtype-qclass\n");
+ 	fprintf(stderr, "\t--rpz-nsdname\n");
+ 	fprintf(stderr, "\t--rpz-nsip\n");
+@@ -194,6 +196,18 @@ main(int argc, char **argv) {
  #endif
  	}
  
@@ -1010,7 +1009,7 @@ index c1249ed..20a3139 100644
  #ifdef ENABLE_RPZ_NSIP
  		return (0);
 diff --git a/bin/tests/system/filter-aaaa/ns1/sign.sh b/bin/tests/system/filter-aaaa/ns1/sign.sh
-index f755581..4a7d890 100755
+index 479f98c..4d4a765 100755
 --- a/bin/tests/system/filter-aaaa/ns1/sign.sh
 +++ b/bin/tests/system/filter-aaaa/ns1/sign.sh
 @@ -21,8 +21,8 @@ infile=signed.db.in
@@ -1025,7 +1024,7 @@ index f755581..4a7d890 100755
  cat $infile $keyname1.key $keyname2.key >$zonefile
  
 diff --git a/bin/tests/system/filter-aaaa/ns4/sign.sh b/bin/tests/system/filter-aaaa/ns4/sign.sh
-index f755581..4a7d890 100755
+index 479f98c..4d4a765 100755
 --- a/bin/tests/system/filter-aaaa/ns4/sign.sh
 +++ b/bin/tests/system/filter-aaaa/ns4/sign.sh
 @@ -21,8 +21,8 @@ infile=signed.db.in
@@ -1040,7 +1039,7 @@ index f755581..4a7d890 100755
  cat $infile $keyname1.key $keyname2.key >$zonefile
  
 diff --git a/bin/tests/system/notify/ns5/named.conf.in b/bin/tests/system/notify/ns5/named.conf.in
-index cfcfe8f..0a1614d 100644
+index 157ef16..b802288 100644
 --- a/bin/tests/system/notify/ns5/named.conf.in
 +++ b/bin/tests/system/notify/ns5/named.conf.in
 @@ -10,17 +10,17 @@
@@ -1065,7 +1064,7 @@ index cfcfe8f..0a1614d 100644
  };
  
 diff --git a/bin/tests/system/notify/tests.sh b/bin/tests/system/notify/tests.sh
-index 1f6e6d0..c08bd25 100644
+index f9fd3f5..916af75 100644
 --- a/bin/tests/system/notify/tests.sh
 +++ b/bin/tests/system/notify/tests.sh
 @@ -212,16 +212,16 @@ ret=0
@@ -1089,7 +1088,7 @@ index 1f6e6d0..c08bd25 100644
  	grep "test string" dig.out.b.ns5.test$n > /dev/null &&
  	grep "test string" dig.out.c.ns5.test$n > /dev/null &&
 diff --git a/bin/tests/system/nsupdate/ns1/named.conf.in b/bin/tests/system/nsupdate/ns1/named.conf.in
-index 1d999ad..26b6b7c 100644
+index b0ded3a..cb80269 100644
 --- a/bin/tests/system/nsupdate/ns1/named.conf.in
 +++ b/bin/tests/system/nsupdate/ns1/named.conf.in
 @@ -32,7 +32,7 @@ controls {
@@ -1102,7 +1101,7 @@ index 1d999ad..26b6b7c 100644
  };
  
 diff --git a/bin/tests/system/nsupdate/ns2/named.conf.in b/bin/tests/system/nsupdate/ns2/named.conf.in
-index 4549184..cb7dccd 100644
+index e6e2382..b0a94e0 100644
 --- a/bin/tests/system/nsupdate/ns2/named.conf.in
 +++ b/bin/tests/system/nsupdate/ns2/named.conf.in
 @@ -33,7 +33,7 @@ controls {
@@ -1115,10 +1114,10 @@ index 4549184..cb7dccd 100644
  };
  
 diff --git a/bin/tests/system/nsupdate/setup.sh b/bin/tests/system/nsupdate/setup.sh
-index 21805c5..0d3d85c 100644
+index 2b3b154..8240c42 100644
 --- a/bin/tests/system/nsupdate/setup.sh
 +++ b/bin/tests/system/nsupdate/setup.sh
-@@ -58,7 +58,12 @@ EOF
+@@ -68,7 +68,12 @@ EOF
  
  $DDNSCONFGEN -q -r $RANDFILE -z example.nil > ns1/ddns.key
  
@@ -1133,10 +1132,10 @@ index 21805c5..0d3d85c 100644
  $DDNSCONFGEN -q -r $RANDFILE -a hmac-sha224 -k sha224-key -z keytests.nil > ns1/sha224.key
  $DDNSCONFGEN -q -r $RANDFILE -a hmac-sha256 -k sha256-key -z keytests.nil > ns1/sha256.key
 diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh
-index 4da4849..b3bc807 100755
+index 60cf7ee..f8994ff 100755
 --- a/bin/tests/system/nsupdate/tests.sh
 +++ b/bin/tests/system/nsupdate/tests.sh
-@@ -708,7 +708,14 @@ fi
+@@ -804,7 +804,14 @@ fi
  n=`expr $n + 1`
  ret=0
  echo_i "check TSIG key algorithms ($n)"
@@ -1152,7 +1151,7 @@ index 4da4849..b3bc807 100755
      $NSUPDATE -k ns1/${alg}.key <<END > /dev/null || ret=1
  server 10.53.0.1 ${PORT}
  update add ${alg}.keytests.nil. 600 A 10.10.10.3
-@@ -716,7 +723,7 @@ send
+@@ -812,7 +819,7 @@ send
  END
  done
  sleep 2
@@ -1162,10 +1161,10 @@ index 4da4849..b3bc807 100755
  done
  if [ $ret -ne 0 ]; then
 diff --git a/bin/tests/system/rndc/setup.sh b/bin/tests/system/rndc/setup.sh
-index 343869e..c30efb0 100644
+index 2eb2cd5..36f5114 100644
 --- a/bin/tests/system/rndc/setup.sh
 +++ b/bin/tests/system/rndc/setup.sh
-@@ -37,7 +37,7 @@ make_key () {
+@@ -35,7 +35,7 @@ make_key () {
              sed 's/allow { 10.53.0.4/allow { any/' >> ns4/named.conf
  }
  
@@ -1175,7 +1174,7 @@ index 343869e..c30efb0 100644
  make_key 3 ${EXTRAPORT3} hmac-sha224
  make_key 4 ${EXTRAPORT4} hmac-sha256
 diff --git a/bin/tests/system/rndc/tests.sh b/bin/tests/system/rndc/tests.sh
-index 57e066d..186a723 100644
+index 4e25e51..cb8934c 100644
 --- a/bin/tests/system/rndc/tests.sh
 +++ b/bin/tests/system/rndc/tests.sh
 @@ -348,15 +348,20 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -1208,17 +1207,8 @@ index 57e066d..186a723 100644
  
  n=`expr $n + 1`
  echo_i "testing rndc with hmac-sha1 ($n)"
-diff --git a/bin/tests/system/tsig/clean.sh b/bin/tests/system/tsig/clean.sh
-index 576ec70..cb7a852 100644
---- a/bin/tests/system/tsig/clean.sh
-+++ b/bin/tests/system/tsig/clean.sh
-@@ -20,3 +20,4 @@ rm -f */named.run
- rm -f ns*/named.lock
- rm -f Kexample.net.+163+*
- rm -f keygen.out?
-+rm -f ns1/named.conf
 diff --git a/bin/tests/system/tsig/ns1/named.conf.in b/bin/tests/system/tsig/ns1/named.conf.in
-index fbf30c6..f61657d 100644
+index 4905ffd..958d9fb 100644
 --- a/bin/tests/system/tsig/ns1/named.conf.in
 +++ b/bin/tests/system/tsig/ns1/named.conf.in
 @@ -21,10 +21,7 @@ options {
@@ -1245,11 +1235,27 @@ index fbf30c6..f61657d 100644
  
  key "sha1-trunc" {
  	secret "FrSt77yPTFx6hTs4i2tKLB9LmE0=";
+diff --git a/bin/tests/system/tsig/ns1/rndc5.conf.in b/bin/tests/system/tsig/ns1/rndc5.conf.in
+new file mode 100644
+index 0000000..0682194
+--- /dev/null
++++ b/bin/tests/system/tsig/ns1/rndc5.conf.in
+@@ -0,0 +1,10 @@
++# Conditionally included when support for MD5 is available
++key "md5" {
++	secret "97rnFx24Tfna4mHPfgnerA==";
++	algorithm hmac-md5;
++};
++
++key "md5-trunc" {
++	secret "97rnFx24Tfna4mHPfgnerA==";
++	algorithm hmac-md5-80;
++};
 diff --git a/bin/tests/system/tsig/setup.sh b/bin/tests/system/tsig/setup.sh
-index 4dd4a25..aa0f966 100644
+index f42aa79..bfcf4a6 100644
 --- a/bin/tests/system/tsig/setup.sh
 +++ b/bin/tests/system/tsig/setup.sh
-@@ -17,3 +17,8 @@ $SHELL clean.sh
+@@ -15,3 +15,8 @@ SYSTEMTESTTOP=..
  copy_setports ns1/named.conf.in ns1/named.conf
  
  test -r $RANDFILE || $GENRANDOM $RANDOMSIZE $RANDFILE
@@ -1259,7 +1265,7 @@ index 4dd4a25..aa0f966 100644
 +	cat ns1/rndc5.conf.in >> ns1/named.conf
 +fi
 diff --git a/bin/tests/system/tsig/tests.sh b/bin/tests/system/tsig/tests.sh
-index f731fa6..cade35b 100644
+index e0c2903..327fa50 100644
 --- a/bin/tests/system/tsig/tests.sh
 +++ b/bin/tests/system/tsig/tests.sh
 @@ -26,20 +26,25 @@ sha512="jI/Pa4qRu96t76Pns5Z/Ndxbn3QCkwcxLOgt9vgvnJw5wqTRvNyk3FtD6yIMd1dWVlqZ+Y4f
@@ -1273,13 +1279,6 @@ index f731fa6..cade35b 100644
 -if [ $ret -eq 1 ] ; then
 -	echo_i "failed"; status=1
 -fi
--
--echo_i "fetching using hmac-md5 (new form)"
--ret=0
--$DIG $DIGOPTS example.nil. -y "hmac-md5:md5:$md5" @10.53.0.1 soa > dig.out.md5.new || ret=1
--grep -i "md5.*TSIG.*NOERROR" dig.out.md5.new > /dev/null || ret=1
--if [ $ret -eq 1 ] ; then
--	echo_i "failed"; status=1
 +if $FEATURETEST --md5
 +then
 +	echo_i "fetching using hmac-md5 (old form)"
@@ -1289,7 +1288,13 @@ index f731fa6..cade35b 100644
 +	if [ $ret -eq 1 ] ; then
 +		echo_i "failed"; status=1
 +	fi
-+
+ 
+-echo_i "fetching using hmac-md5 (new form)"
+-ret=0
+-$DIG $DIGOPTS example.nil. -y "hmac-md5:md5:$md5" @10.53.0.1 soa > dig.out.md5.new || ret=1
+-grep -i "md5.*TSIG.*NOERROR" dig.out.md5.new > /dev/null || ret=1
+-if [ $ret -eq 1 ] ; then
+-	echo_i "failed"; status=1
 +	echo_i "fetching using hmac-md5 (new form)"
 +	ret=0
 +	$DIG $DIGOPTS example.nil. -y "hmac-md5:md5:$md5" @10.53.0.1 soa > dig.out.md5.new || ret=1
@@ -1351,10 +1356,10 @@ index f731fa6..cade35b 100644
  
  echo_i "fetching using hmac-sha1-80 (BADTRUNC)"
 diff --git a/bin/tests/system/tsiggss/setup.sh b/bin/tests/system/tsiggss/setup.sh
-index 0d21c7b..dbcb7b4 100644
+index f04c907..09da5f9 100644
 --- a/bin/tests/system/tsiggss/setup.sh
 +++ b/bin/tests/system/tsiggss/setup.sh
-@@ -18,5 +18,5 @@ test -r $RANDFILE || $GENRANDOM $RANDOMSIZE $RANDFILE
+@@ -16,5 +16,5 @@ test -r $RANDFILE || $GENRANDOM $RANDOMSIZE $RANDFILE
  
  copy_setports ns1/named.conf.in ns1/named.conf
  
@@ -1362,7 +1367,7 @@ index 0d21c7b..dbcb7b4 100644
 +key=`$KEYGEN -Cq -K ns1 -a DSA -b 1024 -r $RANDFILE -n HOST -T KEY key.example.nil.`
  cat ns1/example.nil.db.in ns1/${key}.key > ns1/example.nil.db
 diff --git a/bin/tests/system/upforwd/ns1/named.conf.in b/bin/tests/system/upforwd/ns1/named.conf.in
-index e0a30cd..6a77b1c 100644
+index 4ddd7a4..238f52a 100644
 --- a/bin/tests/system/upforwd/ns1/named.conf.in
 +++ b/bin/tests/system/upforwd/ns1/named.conf.in
 @@ -10,7 +10,7 @@
@@ -1375,7 +1380,7 @@ index e0a30cd..6a77b1c 100644
  };
  
 diff --git a/bin/tests/system/upforwd/tests.sh b/bin/tests/system/upforwd/tests.sh
-index b0694bb..9adae82 100644
+index 1cf8d3b..f4c3216 100644
 --- a/bin/tests/system/upforwd/tests.sh
 +++ b/bin/tests/system/upforwd/tests.sh
 @@ -68,7 +68,7 @@ if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
@@ -1387,22 +1392,6 @@ index b0694bb..9adae82 100644
  server 10.53.0.3 ${PORT}
  update add updated.example. 600 A 10.10.10.1
  update add updated.example. 600 TXT Foo
-diff --git a/bin/tests/system/tsig/ns1/rndc5.conf.in b/bin/tests/system/tsig/ns1/rndc5.conf.in
-new file mode 100644
-index 0000000..0682194
---- /dev/null
-+++ b/bin/tests/system/tsig/ns1/rndc5.conf.in
-@@ -0,0 +1,10 @@
-+# Conditionally included when support for MD5 is available
-+key "md5" {
-+	secret "97rnFx24Tfna4mHPfgnerA==";
-+	algorithm hmac-md5;
-+};
-+
-+key "md5-trunc" {
-+	secret "97rnFx24Tfna4mHPfgnerA==";
-+	algorithm hmac-md5-80;
-+};
 -- 
-2.20.1
+2.31.1
 

SOURCES/bind-9.11-rh1624100.patch

@@ -1,288 +0,0 @@
-From f27598743ab6e03271e26f23da4beba748d19c60 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@sury.org>
-Date: Wed, 25 Apr 2018 14:04:31 +0200
-Subject: [PATCH] Replace isc_safe routines with their OpenSSL counter parts
-
-(cherry picked from commit 66ba2fdad583d962a1f4971c85d58381f0849e4d)
-
-Remove isc_safe_memcompare, it's not needed anywhere and can't be replaced with CRYPTO_memcmp()
-
-(cherry picked from commit b105ccee68ccc3c18e6ea530063b3c8e5a42571c)
-
-Fix the isc_safe_memwipe() usage with (NULL, >0)
-
-(cherry picked from commit 083461d3329ff6f2410745848a926090586a9846)
----
- bin/dnssec/dnssec-signzone.c |  2 +-
- lib/dns/nsec3.c              |  4 +-
- lib/dns/spnego.c             |  4 +-
- lib/isc/Makefile.in          |  8 +---
- lib/isc/include/isc/safe.h   | 18 ++------
- lib/isc/safe.c               | 83 ------------------------------------
- lib/isc/tests/safe_test.c    | 18 --------
- 7 files changed, 11 insertions(+), 126 deletions(-)
- delete mode 100644 lib/isc/safe.c
-
-diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c
-index 6dded0c..a9c5557 100644
---- a/bin/dnssec/dnssec-signzone.c
-+++ b/bin/dnssec/dnssec-signzone.c
-@@ -784,7 +784,7 @@ hashlist_add_dns_name(hashlist_t *l, /*const*/ dns_name_t *name,
- 
- static int
- hashlist_comp(const void *a, const void *b) {
--	return (isc_safe_memcompare(a, b, hash_length + 1));
-+	return (memcmp(a, b, hash_length + 1));
- }
- 
- static void
-diff --git a/lib/dns/nsec3.c b/lib/dns/nsec3.c
-index 6ae7ca8..01426d6 100644
---- a/lib/dns/nsec3.c
-+++ b/lib/dns/nsec3.c
-@@ -1963,7 +1963,7 @@ dns_nsec3_noexistnodata(dns_rdatatype_t type, dns_name_t* name,
- 	 * Work out what this NSEC3 covers.
- 	 * Inside (<0) or outside (>=0).
- 	 */
--	scope = isc_safe_memcompare(owner, nsec3.next, nsec3.next_length);
-+	scope = memcmp(owner, nsec3.next, nsec3.next_length);
- 
- 	/*
- 	 * Prepare to compute all the hashes.
-@@ -1987,7 +1987,7 @@ dns_nsec3_noexistnodata(dns_rdatatype_t type, dns_name_t* name,
- 			return (ISC_R_IGNORE);
- 		}
- 
--		order = isc_safe_memcompare(hash, owner, length);
-+		order = memcmp(hash, owner, length);
- 		if (first && order == 0) {
- 			/*
- 			 * The hashes are the same.
-diff --git a/lib/dns/spnego.c b/lib/dns/spnego.c
-index ad77f24..670982a 100644
---- a/lib/dns/spnego.c
-+++ b/lib/dns/spnego.c
-@@ -371,7 +371,7 @@ gssapi_spnego_decapsulate(OM_uint32 *,
- 
- /* mod_auth_kerb.c */
- 
--static int
-+static isc_boolean_t
- cmp_gss_type(gss_buffer_t token, gss_OID gssoid)
- {
- 	unsigned char *p;
-@@ -395,7 +395,7 @@ cmp_gss_type(gss_buffer_t token, gss_OID gssoid)
- 	if (((OM_uint32) *p++) != gssoid->length)
- 		return (GSS_S_DEFECTIVE_TOKEN);
- 
--	return (isc_safe_memcompare(p, gssoid->elements, gssoid->length));
-+	return (!isc_safe_memequal(p, gssoid->elements, gssoid->length));
- }
- 
- /* accept_sec_context.c */
-diff --git a/lib/isc/Makefile.in b/lib/isc/Makefile.in
-index 149552a..8529a86 100644
---- a/lib/isc/Makefile.in
-+++ b/lib/isc/Makefile.in
-@@ -60,7 +60,7 @@ OBJS =		@ISC_EXTRA_OBJS@ @ISC_PK11_O@ @ISC_PK11_RESULT_O@ \
- 		parseint.@O@ portset.@O@ quota.@O@ radix.@O@ random.@O@ \
- 		ratelimiter.@O@ refcount.@O@ region.@O@ regex.@O@ result.@O@ \
- 		rwlock.@O@ \
--		safe.@O@ serial.@O@ siphash.@O@ sha1.@O@ sha2.@O@ sockaddr.@O@ stats.@O@ \
-+		serial.@O@ siphash.@O@ sha1.@O@ sha2.@O@ sockaddr.@O@ stats.@O@ \
- 		string.@O@ strtoul.@O@ symtab.@O@ task.@O@ taskpool.@O@ \
- 		tm.@O@ timer.@O@ utf8.@O@ version.@O@ \
- 		${UNIXOBJS} ${NLSOBJS} ${THREADOBJS}
-@@ -79,7 +79,7 @@ SRCS =		@ISC_EXTRA_SRCS@ @ISC_PK11_C@ @ISC_PK11_RESULT_C@ \
- 		netaddr.c netscope.c pool.c ondestroy.c \
- 		parseint.c portset.c quota.c radix.c random.c ${CHACHASRCS} \
- 		ratelimiter.c refcount.c region.c regex.c result.c rwlock.c \
--		safe.c serial.c siphash.c sha1.c sha2.c sockaddr.c stats.c string.c \
-+		serial.c siphash.c sha1.c sha2.c sockaddr.c stats.c string.c \
- 		strtoul.c symtab.c task.c taskpool.c timer.c \
- 		tm.c utf8.c version.c
- 
-@@ -95,10 +95,6 @@ TESTDIRS =	@UNITTESTS@
- 
- @BIND9_MAKE_RULES@
- 
--safe.@O@: safe.c
--	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} @CCNOOPT@ \
--		-c ${srcdir}/safe.c
--
- version.@O@: version.c
- 	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} \
- 		-DVERSION=\"${VERSION}\" \
-diff --git a/lib/isc/include/isc/safe.h b/lib/isc/include/isc/safe.h
-index 66ed08b..88b8f47 100644
---- a/lib/isc/include/isc/safe.h
-+++ b/lib/isc/include/isc/safe.h
-@@ -15,29 +15,19 @@
- 
- /*! \file isc/safe.h */
- 
--#include <stdbool.h>
--
--#include <isc/types.h>
--#include <stdlib.h>
-+#include <isc/lang.h>
-+#include <openssl/crypto.h>
- 
- ISC_LANG_BEGINDECLS
- 
--bool
--isc_safe_memequal(const void *s1, const void *s2, size_t n);
-+#define isc_safe_memequal(s1, s2, n) !CRYPTO_memcmp(s1, s2, n)
- /*%<
-  * Returns true iff. two blocks of memory are equal, otherwise
-  * false.
-  *
-  */
- 
--int
--isc_safe_memcompare(const void *b1, const void *b2, size_t len);
--/*%<
-- * Clone of libc memcmp() which is safe to differential timing attacks.
-- */
--
--void
--isc_safe_memwipe(void *ptr, size_t len);
-+#define isc_safe_memwipe(ptr, len) OPENSSL_cleanse(ptr, len)
- /*%<
-  * Clear the memory of length `len` pointed to by `ptr`.
-  *
-diff --git a/lib/isc/safe.c b/lib/isc/safe.c
-deleted file mode 100644
-index 7a464b6..0000000
---- a/lib/isc/safe.c
-+++ /dev/null
-@@ -1,83 +0,0 @@
--/*
-- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-- *
-- * This Source Code Form is subject to the terms of the Mozilla Public
-- * License, v. 2.0. If a copy of the MPL was not distributed with this
-- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
-- *
-- * See the COPYRIGHT file distributed with this work for additional
-- * information regarding copyright ownership.
-- */
--
--/*! \file */
--
--#include <config.h>
--
--#include <stdbool.h>
--
--#include <isc/safe.h>
--#include <isc/string.h>
--#include <isc/util.h>
--
--#ifdef WIN32
--#include <windows.h>
--#endif
--
--#ifdef _MSC_VER
--#pragma optimize("", off)
--#endif
--
--bool
--isc_safe_memequal(const void *s1, const void *s2, size_t n) {
--	uint8_t acc = 0;
--
--	if (n != 0U) {
--		const uint8_t *p1 = s1, *p2 = s2;
--
--		do {
--			acc |= *p1++ ^ *p2++;
--		} while (--n != 0U);
--	}
--	return (acc == 0);
--}
--
--
--int
--isc_safe_memcompare(const void *b1, const void *b2, size_t len) {
--	const unsigned char *p1 = b1, *p2 = b2;
--	size_t i;
--	int res = 0, done = 0;
--
--	for (i = 0; i < len; i++) {
--		/* lt is -1 if p1[i] < p2[i]; else 0. */
--		int lt = (p1[i] - p2[i]) >> CHAR_BIT;
--
--		/* gt is -1 if p1[i] > p2[i]; else 0. */
--		int gt = (p2[i] - p1[i]) >> CHAR_BIT;
--
--		/* cmp is 1 if p1[i] > p2[i]; -1 if p1[i] < p2[i]; else 0. */
--		int cmp = lt - gt;
--
--		/* set res = cmp if !done. */
--		res |= cmp & ~done;
--
--		/* set done if p1[i] != p2[i]. */
--		done |= lt | gt;
--	}
--
--	return (res);
--}
--
--void
--isc_safe_memwipe(void *ptr, size_t len) {
--	if (ISC_UNLIKELY(ptr == NULL || len == 0))
--		return;
--
--#ifdef WIN32
--	SecureZeroMemory(ptr, len);
--#elif HAVE_EXPLICIT_BZERO
--	explicit_bzero(ptr, len);
--#else
--	memset(ptr, 0, len);
--#endif
--}
-diff --git a/lib/isc/tests/safe_test.c b/lib/isc/tests/safe_test.c
-index 266ac75..60e9181 100644
---- a/lib/isc/tests/safe_test.c
-+++ b/lib/isc/tests/safe_test.c
-@@ -45,22 +45,6 @@ isc_safe_memequal_test(void **state) {
- 				       "\x00\x00\x00\x00", 4));
- }
- 
--/* test isc_safe_memcompare() */
--static void
--isc_safe_memcompare_test(void **state) {
--	UNUSED(state);
--
--	assert_int_equal(isc_safe_memcompare("test", "test", 4), 0);
--	assert_true(isc_safe_memcompare("test", "tesc", 4) > 0);
--	assert_true(isc_safe_memcompare("test", "tesy", 4) < 0);
--	assert_int_equal(isc_safe_memcompare("\x00\x00\x00\x00",
--					     "\x00\x00\x00\x00", 4), 0);
--	assert_true(isc_safe_memcompare("\x00\x00\x00\x00",
--					"\x00\x00\x00\x01", 4) < 0);
--	assert_true(isc_safe_memcompare("\x00\x00\x00\x02",
--					"\x00\x00\x00\x00", 4) > 0);
--}
--
- /* test isc_safe_memwipe() */
- static void
- isc_safe_memwipe_test(void **state) {
-@@ -69,7 +53,6 @@ isc_safe_memwipe_test(void **state) {
- 	/* These should pass. */
- 	isc_safe_memwipe(NULL, 0);
- 	isc_safe_memwipe((void *) -1, 0);
--	isc_safe_memwipe(NULL, 42);
- 
- 	/*
- 	 * isc_safe_memwipe(ptr, size) should function same as
-@@ -108,7 +91,6 @@ main(void) {
- 	const struct CMUnitTest tests[] = {
- 		cmocka_unit_test(isc_safe_memequal_test),
- 		cmocka_unit_test(isc_safe_memwipe_test),
--		cmocka_unit_test(isc_safe_memcompare_test),
- 	};
- 
- 	return (cmocka_run_group_tests(tests, NULL, NULL));
--- 
-2.26.2
-

SOURCES/bind-9.11-rh1859454.patch

@@ -1,31 +0,0 @@
-From 30753514ac06111da5b677fe7cdbafd696b1d620 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Wed, 22 Jul 2020 18:55:02 +0200
-Subject: [PATCH] Prevent crash on dst initialization failure
-
-server might be created, but not yet fully initialized, when fatal
-function is called. Check both server and task before attaching
-exclusive task.
-
-(cherry picked from commit c5e7152cf04f75d0fe00163f076f4cc3cafce259)
-(cherry picked from commit 35fbfaa4981333286437f26557db26863d4c5299)
----
- bin/named/server.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/bin/named/server.c b/bin/named/server.c
-index 3cd8daf99e..38780ad3d7 100644
---- a/bin/named/server.c
-+++ b/bin/named/server.c
-@@ -9341,7 +9341,7 @@ ns_server_destroy(ns_server_t **serverp) {
- 
- static void
- fatal(ns_server_t *server, const char *msg, isc_result_t result) {
--	if (server != NULL) {
-+	if (server != NULL && server->task != NULL) {
- 		/*
- 		 * Prevent races between the OpenSSL on_exit registered
- 		 * function and any other OpenSSL calls from other tasks
--- 
-2.26.2
-

SOURCES/bind-9.11-rh1980757.patch

@@ -0,0 +1,32 @@
+From a503519533eb375a5ce1f7566bfc153aac980d87 Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Fri, 9 Jul 2021 20:52:21 +0200
+Subject: [PATCH] Use proper entropy to initialize tsig keyname
+
+Random names used on GSS backed nsupdate can conflict in specific
+situations. That might include starting a lot of machines from
+containers, where they took all similar time to start. PID and timestamp
+would be similar and therefore randomness is quite low. Use entropy to
+generate more random identifier and reduce chance of conflict.
+---
+ bin/nsupdate/nsupdate.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
+index 458aa76..d9e5a2b 100644
+--- a/bin/nsupdate/nsupdate.c
++++ b/bin/nsupdate/nsupdate.c
+@@ -2941,7 +2941,9 @@ start_gssrequest(dns_name_t *master) {
+ 
+ 	keyname = dns_fixedname_initname(&fkname);
+ 
+-	isc_random_get(&val);
++	result = isc_entropy_getdata(entropy, &val, sizeof(val), NULL, 0);
++	if (result != ISC_R_SUCCESS)
++		isc_random_get(&val);
+ 	result = isc_string_printf(mykeystr, sizeof(mykeystr), "%u.sig-%s",
+ 				   val, namestr);
+ 	if (result != ISC_R_SUCCESS)
+-- 
+2.31.1
+

SOURCES/bind-9.11-rh2101712.patch

@@ -0,0 +1,232 @@
+From fff2960981a3294ac641968a17558c8d7eecf74d Mon Sep 17 00:00:00 2001
+From: Mark Andrews <marka@isc.org>
+Date: Wed, 24 Aug 2022 12:21:50 +1000
+Subject: [PATCH] Have dns_zt_apply lock the zone table
+
+There where a number of places where the zone table should have
+been locked, but wasn't, when dns_zt_apply was called.
+
+Added a isc_rwlocktype_t type parameter to dns_zt_apply and adjusted
+all calls to using it.  Removed locks in callers.
+
+Modified upstream commit for v9_11
+---
+ bin/named/server.c       | 11 ++++++-----
+ bin/named/statschannel.c |  8 ++++----
+ lib/dns/include/dns/zt.h |  4 ++--
+ lib/dns/tests/zt_test.c  |  3 ++-
+ lib/dns/view.c           |  3 ++-
+ lib/dns/zt.c             | 34 +++++++++++++++++++---------------
+ 6 files changed, 35 insertions(+), 28 deletions(-)
+
+diff --git a/bin/named/server.c b/bin/named/server.c
+index 9826588e6d..0b4b309461 100644
+--- a/bin/named/server.c
++++ b/bin/named/server.c
+@@ -8723,8 +8723,8 @@ load_configuration(const char *filename, ns_server_t *server,
+ 		    strcmp(view->name, "_bind") != 0)
+ 		{
+ 			dns_view_setviewrevert(view);
+-			(void)dns_zt_apply(view->zonetable, false,
+-					   removed, view);
++			(void)dns_zt_apply(view->zonetable, isc_rwlocktype_read,
++					   false, removed, view);
+ 		}
+ 		dns_view_detach(&view);
+ 	}
+@@ -10090,8 +10090,8 @@ add_view_tolist(struct dumpcontext *dctx, dns_view_t *view) {
+ 	ISC_LIST_INIT(vle->zonelist);
+ 	ISC_LIST_APPEND(dctx->viewlist, vle, link);
+ 	if (dctx->dumpzones)
+-		result = dns_zt_apply(view->zonetable, true,
+-				      add_zone_tolist, dctx);
++		result = dns_zt_apply(view->zonetable, isc_rwlocktype_read,
++				      true, add_zone_tolist, dctx);
+ 	return (result);
+ }
+ 
+@@ -11367,7 +11367,8 @@ ns_server_sync(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text) {
+ 		for (view = ISC_LIST_HEAD(server->viewlist);
+ 		     view != NULL;
+ 		     view = ISC_LIST_NEXT(view, link)) {
+-			result = dns_zt_apply(view->zonetable, false,
++			result = dns_zt_apply(view->zonetable,
++					      isc_rwlocktype_none, false,
+ 					      synczone, &cleanup);
+ 			if (result != ISC_R_SUCCESS &&
+ 			    tresult == ISC_R_SUCCESS)
+diff --git a/bin/named/statschannel.c b/bin/named/statschannel.c
+index 12ab048469..9828df0f4e 100644
+--- a/bin/named/statschannel.c
++++ b/bin/named/statschannel.c
+@@ -1833,8 +1833,8 @@ generatexml(ns_server_t *server, uint32_t flags,
+ 		if ((flags & STATS_XML_ZONES) != 0) {
+ 			TRY0(xmlTextWriterStartElement(writer,
+ 						       ISC_XMLCHAR "zones"));
+-			result = dns_zt_apply(view->zonetable, true,
+-					      zone_xmlrender, writer);
++			result = dns_zt_apply(view->zonetable, isc_rwlocktype_read,
++					      true, zone_xmlrender, writer);
+ 			if (result != ISC_R_SUCCESS)
+ 				goto error;
+ 			TRY0(xmlTextWriterEndElement(writer)); /* /zones */
+@@ -2489,8 +2489,8 @@ generatejson(ns_server_t *server, size_t *msglen,
+ 			CHECKMEM(za);
+ 
+ 			if ((flags & STATS_JSON_ZONES) != 0) {
+-				result = dns_zt_apply(view->zonetable, true,
+-						      zone_jsonrender, za);
++				result = dns_zt_apply(view->zonetable, isc_rwlocktype_read,
++						      true, zone_jsonrender, za);
+ 				if (result != ISC_R_SUCCESS) {
+ 					goto error;
+ 				}
+diff --git a/lib/dns/include/dns/zt.h b/lib/dns/include/dns/zt.h
+index e658e5bb67..94212250da 100644
+--- a/lib/dns/include/dns/zt.h
++++ b/lib/dns/include/dns/zt.h
+@@ -177,11 +177,11 @@ dns_zt_freezezones(dns_zt_t *zt, bool freeze);
+  */
+ 
+ isc_result_t
+-dns_zt_apply(dns_zt_t *zt, bool stop,
++dns_zt_apply(dns_zt_t *zt, isc_rwlocktype_t lock, bool stop,
+ 	     isc_result_t (*action)(dns_zone_t *, void *), void *uap);
+ 
+ isc_result_t
+-dns_zt_apply2(dns_zt_t *zt, bool stop, isc_result_t *sub,
++dns_zt_apply2(dns_zt_t *zt, isc_rwlocktype_t lock, bool stop, isc_result_t *sub,
+ 	      isc_result_t (*action)(dns_zone_t *, void *), void *uap);
+ /*%<
+  * Apply a given 'action' to all zone zones in the table.
+diff --git a/lib/dns/tests/zt_test.c b/lib/dns/tests/zt_test.c
+index 3f1e812d60..ee75303a50 100644
+--- a/lib/dns/tests/zt_test.c
++++ b/lib/dns/tests/zt_test.c
+@@ -145,7 +145,8 @@ apply(void **state) {
+ 	assert_non_null(view->zonetable);
+ 
+ 	assert_int_equal(nzones, 0);
+-	result = dns_zt_apply(view->zonetable, false, count_zone, &nzones);
++	result = dns_zt_apply2(view->zonetable, isc_rwlocktype_read, false, NULL,
++			      count_zone, &nzones);
+ 	assert_int_equal(result, ISC_R_SUCCESS);
+ 	assert_int_equal(nzones, 1);
+ 
+diff --git a/lib/dns/view.c b/lib/dns/view.c
+index f01b4dea0f..bd1ced2863 100644
+--- a/lib/dns/view.c
++++ b/lib/dns/view.c
+@@ -676,7 +676,8 @@ dns_view_dialup(dns_view_t *view) {
+ 	REQUIRE(DNS_VIEW_VALID(view));
+ 	REQUIRE(view->zonetable != NULL);
+ 
+-	(void)dns_zt_apply(view->zonetable, false, dialup, NULL);
++	(void)dns_zt_apply2(view->zonetable, isc_rwlocktype_read, false, NULL,
++			   dialup, NULL);
+ }
+ 
+ void
+diff --git a/lib/dns/zt.c b/lib/dns/zt.c
+index 3f12e247e0..af65740325 100644
+--- a/lib/dns/zt.c
++++ b/lib/dns/zt.c
+@@ -202,7 +202,8 @@ flush(dns_zone_t *zone, void *uap) {
+ static void
+ zt_destroy(dns_zt_t *zt) {
+ 	if (zt->flush) {
+-		(void)dns_zt_apply(zt, false, flush, NULL);
++		(void)dns_zt_apply(zt, isc_rwlocktype_none,
++				   false, flush, NULL);
+ 	}
+ 	isc_refcount_destroy(&zt->references);
+ 	dns_rbt_destroy(&zt->table);
+@@ -249,9 +250,7 @@ dns_zt_load(dns_zt_t *zt, bool stop) {
+ 
+ 	REQUIRE(VALID_ZT(zt));
+ 
+-	RWLOCK(&zt->rwlock, isc_rwlocktype_read);
+-	result = dns_zt_apply(zt, stop, load, NULL);
+-	RWUNLOCK(&zt->rwlock, isc_rwlocktype_read);
++	result = dns_zt_apply2(zt, isc_rwlocktype_read, stop, NULL, load, NULL);
+ 	return (result);
+ }
+ 
+@@ -293,7 +292,7 @@ dns_zt_asyncload2(dns_zt_t *zt, dns_zt_allloaded_t alldone, void *arg,
+ 	 * Prevent loads_pending going to zero while kicking off the loads.
+ 	 */
+ 	zt->loads_pending++;
+-	result = dns_zt_apply2(zt, false, NULL, asyncload, &params);
++	result = dns_zt_apply2(zt, isc_rwlocktype_none, false, NULL, asyncload, &params);
+ 	pending = --zt->loads_pending;
+ 	if (pending != 0) {
+ 		zt->loaddone = alldone;
+@@ -342,9 +341,7 @@ dns_zt_loadnew(dns_zt_t *zt, bool stop) {
+ 
+ 	REQUIRE(VALID_ZT(zt));
+ 
+-	RWLOCK(&zt->rwlock, isc_rwlocktype_read);
+-	result = dns_zt_apply(zt, stop, loadnew, NULL);
+-	RWUNLOCK(&zt->rwlock, isc_rwlocktype_read);
++	result = dns_zt_apply(zt, isc_rwlocktype_read, stop, loadnew, NULL);
+ 	return (result);
+ }
+ 
+@@ -366,9 +363,7 @@ dns_zt_freezezones(dns_zt_t *zt, bool freeze) {
+ 
+ 	REQUIRE(VALID_ZT(zt));
+ 
+-	RWLOCK(&zt->rwlock, isc_rwlocktype_read);
+-	result = dns_zt_apply2(zt, false, &tresult, freezezones, &freeze);
+-	RWUNLOCK(&zt->rwlock, isc_rwlocktype_read);
++	result = dns_zt_apply2(zt, isc_rwlocktype_read, false, &tresult, freezezones, &freeze);
+ 	if (tresult == ISC_R_NOTFOUND)
+ 		tresult = ISC_R_SUCCESS;
+ 	return ((result == ISC_R_SUCCESS) ? tresult : result);
+@@ -490,14 +485,14 @@ dns_zt_setviewrevert(dns_zt_t *zt) {
+ }
+ 
+ isc_result_t
+-dns_zt_apply(dns_zt_t *zt, bool stop,
++dns_zt_apply(dns_zt_t *zt, isc_rwlocktype_t lock, bool stop,
+ 	     isc_result_t (*action)(dns_zone_t *, void *), void *uap)
+ {
+-	return (dns_zt_apply2(zt, stop, NULL, action, uap));
++	return (dns_zt_apply2(zt, lock, stop, NULL, action, uap));
+ }
+ 
+ isc_result_t
+-dns_zt_apply2(dns_zt_t *zt, bool stop, isc_result_t *sub,
++dns_zt_apply2(dns_zt_t *zt, isc_rwlocktype_t lock, bool stop, isc_result_t *sub,
+ 	      isc_result_t (*action)(dns_zone_t *, void *), void *uap)
+ {
+ 	dns_rbtnode_t *node;
+@@ -508,6 +503,10 @@ dns_zt_apply2(dns_zt_t *zt, bool stop, isc_result_t *sub,
+ 	REQUIRE(VALID_ZT(zt));
+ 	REQUIRE(action != NULL);
+ 
++	if (lock != isc_rwlocktype_none) {
++		RWLOCK(&zt->rwlock, lock);
++	}
++
+ 	dns_rbtnodechain_init(&chain, zt->mctx);
+ 	result = dns_rbtnodechain_first(&chain, zt->table, NULL, NULL);
+ 	if (result == ISC_R_NOTFOUND) {
+@@ -538,8 +537,13 @@ dns_zt_apply2(dns_zt_t *zt, bool stop, isc_result_t *sub,
+ 
+  cleanup:
+ 	dns_rbtnodechain_invalidate(&chain);
+-	if (sub != NULL)
++	if (sub != NULL) {
+ 		*sub = tresult;
++	}
++
++	if (lock != isc_rwlocktype_none) {
++		RWUNLOCK(&zt->rwlock, lock);
++	}
+ 
+ 	return (result);
+ }
+-- 
+2.37.2
+

SOURCES/bind-9.11-rh2133889.patch

@@ -0,0 +1,26 @@
+From c8f5b31f0637315c1c45d0287f05fcad2250f40f Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Thu, 13 Oct 2022 15:35:46 +0200
+Subject: [PATCH] Add include to rwlocktype_t to dns/zt.h
+
+It got broken as part of bug #2101712 fix. Introduced new definition,
+which passes during bind build, but breaks bind-dyndb-ldap build.
+---
+ lib/dns/include/dns/zt.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/lib/dns/include/dns/zt.h b/lib/dns/include/dns/zt.h
+index 9421225..64c24d6 100644
+--- a/lib/dns/include/dns/zt.h
++++ b/lib/dns/include/dns/zt.h
+@@ -18,6 +18,7 @@
+ #include <stdbool.h>
+ 
+ #include <isc/lang.h>
++#include <isc/rwlock.h>
+ 
+ #include <dns/types.h>
+ 
+-- 
+2.37.3
+

SOURCES/bind-9.11-rt31459.patch

@@ -1,4 +1,4 @@
-From 5c29299e43db5a4e6f8b1b07af84dfe1687c4c2b Mon Sep 17 00:00:00 2001
+From 346683631ae0f83ad4f09a69cfa5e5c6ea49e5d9 Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Tue, 12 Sep 2017 19:05:46 -0700
 Subject: [PATCH] rebased rt31459c
@@ -53,7 +53,7 @@ Include new unit test
  create mode 100644 lib/dns/tests/dstrandom_test.c
 
 diff --git a/bin/confgen/keygen.c b/bin/confgen/keygen.c
-index 5015abb..295e16f 100644
+index 40cf74c..bd269e7 100644
 --- a/bin/confgen/keygen.c
 +++ b/bin/confgen/keygen.c
 @@ -165,6 +165,13 @@ generate_key(isc_mem_t *mctx, const char *randomfile, dns_secalg_t alg,
@@ -71,7 +71,7 @@ index 5015abb..295e16f 100644
  							     &entropy_source,
  							     randomfile,
 diff --git a/bin/dnssec/dnssec-dsfromkey.c b/bin/dnssec/dnssec-dsfromkey.c
-index d9d6bb9..de4b15f 100644
+index 4420f2d..9cb63a8 100644
 --- a/bin/dnssec/dnssec-dsfromkey.c
 +++ b/bin/dnssec/dnssec-dsfromkey.c
 @@ -498,14 +498,14 @@ main(int argc, char **argv) {
@@ -103,7 +103,7 @@ index d9d6bb9..de4b15f 100644
  	dns_name_destroy();
  	if (verbose > 10)
 diff --git a/bin/dnssec/dnssec-importkey.c b/bin/dnssec/dnssec-importkey.c
-index d65a514..04b3094 100644
+index dc9a293..52863a1 100644
 --- a/bin/dnssec/dnssec-importkey.c
 +++ b/bin/dnssec/dnssec-importkey.c
 @@ -404,14 +404,14 @@ main(int argc, char **argv) {
@@ -135,7 +135,7 @@ index d65a514..04b3094 100644
  	dns_name_destroy();
  	if (verbose > 10)
 diff --git a/bin/dnssec/dnssec-revoke.c b/bin/dnssec/dnssec-revoke.c
-index 7d82dbf..10f9359 100644
+index 0121a34..74a99b0 100644
 --- a/bin/dnssec/dnssec-revoke.c
 +++ b/bin/dnssec/dnssec-revoke.c
 @@ -184,14 +184,14 @@ main(int argc, char **argv) {
@@ -167,10 +167,10 @@ index 7d82dbf..10f9359 100644
  	if (verbose > 10)
  		isc_mem_stats(mctx, stdout);
 diff --git a/bin/dnssec/dnssec-settime.c b/bin/dnssec/dnssec-settime.c
-index 7afcaee..1cfa511 100644
+index f017895..2c568fc 100644
 --- a/bin/dnssec/dnssec-settime.c
 +++ b/bin/dnssec/dnssec-settime.c
-@@ -380,14 +380,14 @@ main(int argc, char **argv) {
+@@ -391,14 +391,14 @@ main(int argc, char **argv) {
  
  	if (ectx == NULL)
  		setup_entropy(mctx, NULL, &ectx);
@@ -188,7 +188,7 @@ index 7afcaee..1cfa511 100644
  	isc_entropy_stopcallbacksources(ectx);
  
  	if (predecessor != NULL) {
-@@ -672,8 +672,8 @@ main(int argc, char **argv) {
+@@ -683,8 +683,8 @@ main(int argc, char **argv) {
  	if (prevkey != NULL)
  		dst_key_free(&prevkey);
  	dst_key_free(&key);
@@ -199,10 +199,10 @@ index 7afcaee..1cfa511 100644
  	if (verbose > 10)
  		isc_mem_stats(mctx, stdout);
 diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c
-index 319a805..27ae4d4 100644
+index a097ac8..6567421 100644
 --- a/bin/dnssec/dnssec-signzone.c
 +++ b/bin/dnssec/dnssec-signzone.c
-@@ -3460,14 +3460,15 @@ main(int argc, char *argv[]) {
+@@ -3472,14 +3472,15 @@ main(int argc, char *argv[]) {
  	if (!pseudorandom)
  		eflags |= ISC_ENTROPY_GOODONLY;
  
@@ -222,7 +222,7 @@ index 319a805..27ae4d4 100644
  	isc_stdtime_get(&now);
  
  	if (startstr != NULL) {
-@@ -3879,8 +3880,8 @@ main(int argc, char *argv[]) {
+@@ -3896,8 +3897,8 @@ main(int argc, char *argv[]) {
  	dns_master_styledestroy(&dsstyle, mctx);
  
  	cleanup_logging(&log);
@@ -233,7 +233,7 @@ index 319a805..27ae4d4 100644
  	dns_name_destroy();
  	if (verbose > 10)
 diff --git a/bin/dnssec/dnssec-verify.c b/bin/dnssec/dnssec-verify.c
-index 4c293bf..3263cbc 100644
+index 087cd5d..07c7294 100644
 --- a/bin/dnssec/dnssec-verify.c
 +++ b/bin/dnssec/dnssec-verify.c
 @@ -281,15 +281,15 @@ main(int argc, char *argv[]) {
@@ -257,7 +257,7 @@ index 4c293bf..3263cbc 100644
  
  	rdclass = strtoclass(classname);
 diff --git a/bin/dnssec/dnssectool.c b/bin/dnssec/dnssectool.c
-index 618ec5b..5654435 100644
+index 7f045e8..2a0f9c6 100644
 --- a/bin/dnssec/dnssectool.c
 +++ b/bin/dnssec/dnssectool.c
 @@ -34,6 +34,7 @@
@@ -293,7 +293,7 @@ index 618ec5b..5654435 100644
  					   usekeyboard);
  
 diff --git a/bin/named/server.c b/bin/named/server.c
-index 4e503e5..f27071f 100644
+index 9826588..b3e3fc3 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
 @@ -36,6 +36,7 @@
@@ -304,7 +304,7 @@ index 4e503e5..f27071f 100644
  #include <isc/portset.h>
  #include <isc/print.h>
  #include <isc/random.h>
-@@ -8217,6 +8218,10 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8291,6 +8292,10 @@ load_configuration(const char *filename, ns_server_t *server,
  				      "no source of entropy found");
  		} else {
  			const char *randomdev = cfg_obj_asstring(obj);
@@ -315,7 +315,7 @@ index 4e503e5..f27071f 100644
  			int level = ISC_LOG_ERROR;
  			result = isc_entropy_createfilesource(ns_g_entropy,
  							      randomdev);
-@@ -8251,6 +8256,7 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8325,6 +8330,7 @@ load_configuration(const char *filename, ns_server_t *server,
  				}
  				isc_entropy_detach(&ns_g_fallbackentropy);
  			}
@@ -324,10 +324,10 @@ index 4e503e5..f27071f 100644
  		}
  
 diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
-index bbb3936..0286987 100644
+index 52b0274..23b69c9 100644
 --- a/bin/nsupdate/nsupdate.c
 +++ b/bin/nsupdate/nsupdate.c
-@@ -272,7 +272,8 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
+@@ -279,7 +279,8 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
  	if (*ectx == NULL) {
  		result = isc_entropy_create(mctx, ectx);
  		if (result != ISC_R_SUCCESS)
@@ -337,7 +337,7 @@ index bbb3936..0286987 100644
  		ISC_LIST_INIT(sources);
  	}
  
-@@ -281,6 +282,13 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
+@@ -288,6 +289,13 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
  		randomfile = NULL;
  	}
  
@@ -351,7 +351,7 @@ index bbb3936..0286987 100644
  	result = isc_entropy_usebestsource(*ectx, &source, randomfile,
  					   usekeyboard);
  
-@@ -979,11 +987,11 @@ setup_system(void) {
+@@ -990,11 +998,11 @@ setup_system(void) {
  		}
  	}
  
@@ -366,7 +366,7 @@ index bbb3936..0286987 100644
  	result = dns_dispatchmgr_create(gmctx, entropy, &dispatchmgr);
  	check_result(result, "dns_dispatchmgr_create");
 diff --git a/bin/tests/makejournal.c b/bin/tests/makejournal.c
-index 61a41b0..acc71a1 100644
+index 68b5e5a..cd54c8d 100644
 --- a/bin/tests/makejournal.c
 +++ b/bin/tests/makejournal.c
 @@ -102,12 +102,12 @@ main(int argc, char **argv) {
@@ -386,7 +386,7 @@ index 61a41b0..acc71a1 100644
  	isc_log_registercategories(lctx, categories);
  	isc_log_setcontext(lctx);
 diff --git a/bin/tests/system/pipelined/pipequeries.c b/bin/tests/system/pipelined/pipequeries.c
-index c6ab7f8..f0a6ff2 100644
+index e16ec11..95b65bf 100644
 --- a/bin/tests/system/pipelined/pipequeries.c
 +++ b/bin/tests/system/pipelined/pipequeries.c
 @@ -204,6 +204,7 @@ sendqueries(isc_task_t *task, isc_event_t *event) {
@@ -448,7 +448,7 @@ index c6ab7f8..f0a6ff2 100644
  
  	isc_log_destroy(&lctx);
 diff --git a/bin/tests/system/pipelined/tests.sh b/bin/tests/system/pipelined/tests.sh
-index 61f1ff7..ed1302a 100644
+index c0a99a2..0245527 100644
 --- a/bin/tests/system/pipelined/tests.sh
 +++ b/bin/tests/system/pipelined/tests.sh
 @@ -19,7 +19,7 @@ status=0
@@ -470,7 +470,7 @@ index 61f1ff7..ed1302a 100644
  $DIFF refb outputb || ret=1
  if [ $ret != 0 ]; then echo_i "failed"; fi
 diff --git a/bin/tests/system/rsabigexponent/bigkey.c b/bin/tests/system/rsabigexponent/bigkey.c
-index 4462f2e..f06268d 100644
+index abf12ed..fa5182c 100644
 --- a/bin/tests/system/rsabigexponent/bigkey.c
 +++ b/bin/tests/system/rsabigexponent/bigkey.c
 @@ -20,6 +20,7 @@
@@ -492,7 +492,7 @@ index 4462f2e..f06268d 100644
  					"../random.data",
  					ISC_ENTROPY_KEYBOARDNO),
 diff --git a/bin/tests/system/tkey/keycreate.c b/bin/tests/system/tkey/keycreate.c
-index 653c951..fe8698e 100644
+index 34360aa..3236968 100644
 --- a/bin/tests/system/tkey/keycreate.c
 +++ b/bin/tests/system/tkey/keycreate.c
 @@ -206,6 +206,7 @@ sendquery(isc_task_t *task, isc_event_t *event) {
@@ -561,10 +561,10 @@ index 653c951..fe8698e 100644
  
  	isc_mem_destroy(&mctx);
 diff --git a/bin/tests/system/tkey/keydelete.c b/bin/tests/system/tkey/keydelete.c
-index 70a40c3..2146f9b 100644
+index a3dd450..350723f 100644
 --- a/bin/tests/system/tkey/keydelete.c
 +++ b/bin/tests/system/tkey/keydelete.c
-@@ -136,6 +136,7 @@ sendquery(isc_task_t *task, isc_event_t *event) {
+@@ -137,6 +137,7 @@ sendquery(isc_task_t *task, isc_event_t *event) {
  int
  main(int argc, char **argv) {
  	char *keyname;
@@ -572,7 +572,7 @@ index 70a40c3..2146f9b 100644
  	isc_taskmgr_t *taskmgr;
  	isc_timermgr_t *timermgr;
  	isc_socketmgr_t *socketmgr;
-@@ -156,10 +157,21 @@ main(int argc, char **argv) {
+@@ -157,10 +158,21 @@ main(int argc, char **argv) {
  
  	RUNCHECK(isc_app_start());
  
@@ -594,7 +594,7 @@ index 70a40c3..2146f9b 100644
  	keyname = argv[1];
  
  	dns_result_register();
-@@ -169,14 +181,22 @@ main(int argc, char **argv) {
+@@ -170,14 +182,22 @@ main(int argc, char **argv) {
  
  	ectx = NULL;
  	RUNCHECK(isc_entropy_create(mctx, &ectx));
@@ -619,7 +619,7 @@ index 70a40c3..2146f9b 100644
  
  	taskmgr = NULL;
  	RUNCHECK(isc_taskmgr_create(mctx, 1, 0, &taskmgr));
-@@ -264,8 +284,8 @@ main(int argc, char **argv) {
+@@ -265,8 +285,8 @@ main(int argc, char **argv) {
  
  	isc_log_destroy(&log);
  
@@ -630,50 +630,50 @@ index 70a40c3..2146f9b 100644
  
  	isc_mem_destroy(&mctx);
 diff --git a/bin/tests/system/tkey/tests.sh b/bin/tests/system/tkey/tests.sh
-index 9f90dd7..fad6c83 100644
+index b265156..bcd60a6 100644
 --- a/bin/tests/system/tkey/tests.sh
 +++ b/bin/tests/system/tkey/tests.sh
 @@ -33,7 +33,7 @@ for owner in . foo.example.
  do
- 	echo "I:creating new key using owner name \"$owner\""
+ 	echo_i "creating new key using owner name \"$owner\" ($n)"
  	ret=0
 -	keyname=`$KEYCREATE $dhkeyname $owner` || ret=1
 +	keyname=`$KEYCREATE -r $RANDFILE $dhkeyname $owner` || ret=1
  	if [ $ret != 0 ]; then
- 		echo "I:failed"
- 		status=`expr $status + $ret`
-@@ -55,7 +55,7 @@ do
+ 		echo_i "failed"
+ 		status=$((status+ret))
+@@ -57,7 +57,7 @@ do
  
- 	echo "I:deleting new key"
+ 	echo_i "deleting new key ($n)"
  	ret=0
 -	$KEYDELETE $keyname || ret=1
 +	$KEYDELETE -r $RANDFILE $keyname || ret=1
  	if [ $ret != 0 ]; then
- 		echo "I:failed"
+ 		echo_i "failed"
  	fi
-@@ -75,7 +75,7 @@ done
+@@ -79,7 +79,7 @@ done
  
- echo "I:creating new key using owner name bar.example."
+ echo_i "creating new key using owner name bar.example. ($n)"
  ret=0
 -keyname=`$KEYCREATE $dhkeyname bar.example.` || ret=1
 +keyname=`$KEYCREATE -r $RANDFILE $dhkeyname bar.example.` || ret=1
  if [ $ret != 0 ]; then
-         echo "I:failed"
- 	status=`expr $status + $ret`
-@@ -116,7 +116,7 @@ status=`expr $status + $ret`
+         echo_i "failed"
+ 	status=$((status+ret))
+@@ -124,7 +124,7 @@ n=$((n+1))
  
- echo "I:recreating the bar.example. key"
+ echo_i "recreating the bar.example. key ($n)"
  ret=0
 -keyname=`$KEYCREATE $dhkeyname bar.example.` || ret=1
 +keyname=`$KEYCREATE -r $RANDFILE $dhkeyname bar.example.` || ret=1
  if [ $ret != 0 ]; then
-         echo "I:failed"
- 	status=`expr $status + $ret`
+         echo_i "failed"
+ 	status=$((status+ret))
 diff --git a/bin/tools/mdig.c b/bin/tools/mdig.c
-index bf6dbb6..0416b21 100644
+index 26fa609..fb34aa0 100644
 --- a/bin/tools/mdig.c
 +++ b/bin/tools/mdig.c
-@@ -1972,12 +1972,11 @@ main(int argc, char *argv[]) {
+@@ -2005,12 +2005,11 @@ main(int argc, char *argv[]) {
  
  	ectx = NULL;
  	RUNCHECK(isc_entropy_create(mctx, &ectx));
@@ -688,7 +688,7 @@ index bf6dbb6..0416b21 100644
  	parse_args(false, argc, argv);
  	if (server == NULL)
 diff --git a/configure b/configure
-index 6d05371..33689c9 100755
+index 368112f..e060e9d 100755
 --- a/configure
 +++ b/configure
 @@ -640,6 +640,7 @@ ac_includes_default="\
@@ -699,7 +699,7 @@ index 6d05371..33689c9 100755
  BUILD_LIBS
  BUILD_LDFLAGS
  BUILD_CPPFLAGS
-@@ -823,6 +824,7 @@ LIBXML2_CFLAGS
+@@ -822,6 +823,7 @@ LIBXML2_CFLAGS
  NZDTARGETS
  NZDSRCS
  NZD_TOOLS
@@ -707,7 +707,7 @@ index 6d05371..33689c9 100755
  PKCS11_TEST
  PKCS11_ED25519
  PKCS11_GOST
-@@ -1047,6 +1049,7 @@ with_eddsa
+@@ -1046,6 +1048,7 @@ with_eddsa
  with_aes
  enable_openssl_hash
  with_cc_alg
@@ -715,7 +715,7 @@ index 6d05371..33689c9 100755
  with_lmdb
  with_libxml2
  with_libjson
-@@ -1749,6 +1752,7 @@ Optional Features:
+@@ -1747,6 +1750,7 @@ Optional Features:
    --enable-threads        enable multithreading
    --enable-native-pkcs11  use native PKCS11 for all crypto [default=no]
    --enable-openssl-hash   use OpenSSL for hash functions [default=no]
@@ -723,7 +723,7 @@ index 6d05371..33689c9 100755
    --enable-largefile      64-bit file support
    --enable-backtrace      log stack backtrace on abort [default=yes]
    --enable-symtable       use internal symbol table for backtrace
-@@ -17144,6 +17148,7 @@ case "$use_openssl" in
+@@ -17204,6 +17208,7 @@ case "$use_openssl" in
  $as_echo "disabled because of native PKCS11" >&6; }
  		DST_OPENSSL_INC=""
  		CRYPTO="-DPKCS11CRYPTO"
@@ -731,7 +731,7 @@ index 6d05371..33689c9 100755
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -17158,6 +17163,7 @@ $as_echo "disabled because of native PKCS11" >&6; }
+@@ -17218,6 +17223,7 @@ $as_echo "disabled because of native PKCS11" >&6; }
  $as_echo "no" >&6; }
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -739,7 +739,7 @@ index 6d05371..33689c9 100755
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -17170,6 +17176,7 @@ $as_echo "no" >&6; }
+@@ -17230,6 +17236,7 @@ $as_echo "no" >&6; }
  	auto)
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -747,7 +747,7 @@ index 6d05371..33689c9 100755
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -17179,7 +17186,7 @@ $as_echo "no" >&6; }
+@@ -17239,7 +17246,7 @@ $as_echo "no" >&6; }
  		OPENSSLLINKOBJS=""
  		OPENSSLLINKSRCS=""
  		as_fn_error $? "OpenSSL was not found in any of $openssldirs; use --with-openssl=/path
@@ -756,7 +756,7 @@ index 6d05371..33689c9 100755
  		;;
  	*)
  		if test "yes" = "$want_native_pkcs11"
-@@ -17210,6 +17217,7 @@ $as_echo "not found" >&6; }
+@@ -17270,6 +17277,7 @@ $as_echo "not found" >&6; }
  			as_fn_error $? "\"$use_openssl/include/openssl/opensslv.h\" not found" "$LINENO" 5
  		fi
  		CRYPTO='-DOPENSSL'
@@ -764,7 +764,7 @@ index 6d05371..33689c9 100755
  		if test "/usr" = "$use_openssl"
  		then
  			DST_OPENSSL_INC=""
-@@ -17835,8 +17843,6 @@ fi
+@@ -17904,8 +17912,6 @@ fi
  # Use OpenSSL for hash functions
  #
  
@@ -773,7 +773,7 @@ index 6d05371..33689c9 100755
  ISC_PLATFORM_OPENSSLHASH="#undef ISC_PLATFORM_OPENSSLHASH"
  case $want_openssl_hash in
  	yes)
-@@ -18211,6 +18217,86 @@ if test "rt" = "$have_clock_gt"; then
+@@ -18280,6 +18286,86 @@ if test "rt" = "$have_clock_gt"; then
  	LIBS="-lrt $LIBS"
  fi
  
@@ -860,7 +860,7 @@ index 6d05371..33689c9 100755
  #
  # was --with-lmdb specified?
  #
-@@ -20441,9 +20527,12 @@ _ACEOF
+@@ -20556,9 +20642,12 @@ _ACEOF
  if ac_fn_c_try_compile "$LINENO"; then :
    { $as_echo "$as_me:${as_lineno-$LINENO}: result: size_t for buflen; int for flags" >&5
  $as_echo "size_t for buflen; int for flags" >&6; }
@@ -875,7 +875,7 @@ index 6d05371..33689c9 100755
  
  	 $as_echo "#define IRS_GETNAMEINFO_FLAGS_T int" >>confdefs.h
  
-@@ -21758,12 +21847,7 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
+@@ -21856,12 +21945,7 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
  ISC_PLATFORM_USESTDASM="#undef ISC_PLATFORM_USESTDASM"
  ISC_PLATFORM_USEMACASM="#undef ISC_PLATFORM_USEMACASM"
  if test "yes" = "$use_atomic"; then
@@ -889,7 +889,7 @@ index 6d05371..33689c9 100755
  # version HP92453-01 B.11.11.23709.GP, which incorrectly rejects
  # declarations like `int a3[[(sizeof (unsigned char)) >= 0]];'.
  # This bug is HP SR number 8606223364.
-@@ -21796,6 +21880,11 @@ cat >>confdefs.h <<_ACEOF
+@@ -21894,6 +21978,11 @@ cat >>confdefs.h <<_ACEOF
  _ACEOF
  
  
@@ -901,7 +901,7 @@ index 6d05371..33689c9 100755
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -21804,39 +21893,6 @@ _ACEOF
+@@ -21902,39 +21991,6 @@ _ACEOF
  		fi
  	;;
  	x86_64-*|amd64-*)
@@ -941,7 +941,7 @@ index 6d05371..33689c9 100755
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -21867,6 +21923,10 @@ $as_echo_n "checking architecture type for atomic operations... " >&6; }
+@@ -21965,6 +22021,10 @@ $as_echo_n "checking architecture type for atomic operations... " >&6; }
  $as_echo "$arch" >&6; }
  fi
  
@@ -952,7 +952,7 @@ index 6d05371..33689c9 100755
  if test "yes" = "$have_atomic"; then
  	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking compiler support for inline assembly code" >&5
  $as_echo_n "checking compiler support for inline assembly code... " >&6; }
-@@ -24421,6 +24481,30 @@ CFLAGS="$CFLAGS $SO_CFLAGS"
+@@ -24547,6 +24607,30 @@ CFLAGS="$CFLAGS $SO_CFLAGS"
  #
  dlzdir='${DLZ_DRIVER_DIR}'
  
@@ -983,7 +983,7 @@ index 6d05371..33689c9 100755
  #
  # Private autoconf macro to simplify configuring drivers:
  #
-@@ -24751,11 +24835,11 @@ $as_echo "no" >&6; }
+@@ -24877,11 +24961,11 @@ $as_echo "no" >&6; }
  $as_echo "using mysql with libs ${mysql_lib} and includes ${mysql_include}" >&6; }
  		;;
  	*)
@@ -998,7 +998,7 @@ index 6d05371..33689c9 100755
  		fi
  
  	CONTRIB_DLZ="$CONTRIB_DLZ -DDLZ_MYSQL"
-@@ -24840,7 +24924,7 @@ $as_echo "" >&6; }
+@@ -24966,7 +25050,7 @@ $as_echo "" >&6; }
  			# Check other locations for includes.
  			# Order is important (sigh).
  
@@ -1007,7 +1007,7 @@ index 6d05371..33689c9 100755
  			# include a blank element first
  			for d in "" $bdb_incdirs
  			do
-@@ -24865,57 +24949,9 @@ $as_echo "" >&6; }
+@@ -24991,57 +25075,9 @@ $as_echo "" >&6; }
  			bdb_libnames="db53 db-5.3 db51 db-5.1 db48 db-4.8 db47 db-4.7 db46 db-4.6 db45 db-4.5 db44 db-4.4 db43 db-4.3 db42 db-4.2 db41 db-4.1 db"
  			for d in $bdb_libnames
  			do
@@ -1067,7 +1067,7 @@ index 6d05371..33689c9 100755
  					break
  				fi
  			done
-@@ -25074,10 +25110,10 @@ $as_echo "no" >&6; }
+@@ -25200,10 +25236,10 @@ $as_echo "no" >&6; }
  		DLZ_DRIVER_INCLUDES="$DLZ_DRIVER_INCLUDES -I$use_dlz_ldap/include"
  		DLZ_DRIVER_LDAP_INCLUDES="-I$use_dlz_ldap/include"
  	fi
@@ -1081,7 +1081,7 @@ index 6d05371..33689c9 100755
  	fi
  
  
-@@ -25163,11 +25199,11 @@ fi
+@@ -25289,11 +25325,11 @@ fi
  		odbcdirs="/usr /usr/local /usr/pkg"
  		for d in $odbcdirs
  		do
@@ -1095,7 +1095,7 @@ index 6d05371..33689c9 100755
  				break
  			fi
  		done
-@@ -25442,6 +25478,8 @@ DNS_CRYPTO_LIBS="$NEWFLAGS"
+@@ -25568,6 +25604,8 @@ DNS_CRYPTO_LIBS="$NEWFLAGS"
  
  
  
@@ -1104,7 +1104,7 @@ index 6d05371..33689c9 100755
  #
  # Commands to run at the end of config.status.
  # Don't just put these into configure, it won't work right if somebody
-@@ -27819,6 +27857,8 @@ report() {
+@@ -27946,6 +27984,8 @@ report() {
  	    echo "    IPv6 support (--enable-ipv6)"
  	test "X$CRYPTO" = "X" -o "yes" = "$want_native_pkcs11" || \
  		echo "    OpenSSL cryptography/DNSSEC (--with-openssl)"
@@ -1113,7 +1113,7 @@ index 6d05371..33689c9 100755
  	test "X$PYTHON" = "X" || echo "    Python tools (--with-python)"
  	test "X$XMLSTATS" = "X" || echo "    XML statistics (--with-libxml2)"
  	test "X$JSONSTATS" = "X" || echo "    JSON statistics (--with-libjson)"
-@@ -27859,6 +27899,8 @@ report() {
+@@ -27986,6 +28026,8 @@ report() {
  	echo "    Very verbose query trace logging (--enable-querytrace)"
      test "no" = "$with_cmocka" || echo "    CMocka Unit Testing Framework (--with-cmocka)"
  
@@ -1122,7 +1122,7 @@ index 6d05371..33689c9 100755
      echo "    Dynamically loadable zone (DLZ) drivers:"
      test "no" = "$use_dlz_bdb" || \
  	echo "        Berkeley DB (--with-dlz-bdb)"
-@@ -27906,6 +27948,8 @@ report() {
+@@ -28033,6 +28075,8 @@ report() {
  	echo "    ECDSA algorithm support (--with-ecdsa)"
      test "X$CRYPTO" = "X" -o "yes" = "$OPENSSL_ED25519" -o "yes" = "$PKCS11_ED25519" || \
  	echo "    EDDSA algorithm support (--with-eddsa)"
@@ -1132,10 +1132,10 @@ index 6d05371..33689c9 100755
      test "yes" = "$enable_seccomp" || \
  	echo "    Use libseccomp system call filtering (--enable-seccomp)"
 diff --git a/configure.ac b/configure.ac
-index d10cde5..68bead8 100644
+index 11f41e8..fdcfc62 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -1550,6 +1550,7 @@ case "$use_openssl" in
+@@ -1600,6 +1600,7 @@ case "$use_openssl" in
  		AC_MSG_RESULT(disabled because of native PKCS11)
  		DST_OPENSSL_INC=""
  		CRYPTO="-DPKCS11CRYPTO"
@@ -1143,7 +1143,7 @@ index d10cde5..68bead8 100644
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -1563,6 +1564,7 @@ case "$use_openssl" in
+@@ -1613,6 +1614,7 @@ case "$use_openssl" in
  		AC_MSG_RESULT(no)
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -1151,7 +1151,7 @@ index d10cde5..68bead8 100644
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -1575,6 +1577,7 @@ case "$use_openssl" in
+@@ -1625,6 +1627,7 @@ case "$use_openssl" in
  	auto)
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -1159,7 +1159,7 @@ index d10cde5..68bead8 100644
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -1585,7 +1588,7 @@ case "$use_openssl" in
+@@ -1635,7 +1638,7 @@ case "$use_openssl" in
  		OPENSSLLINKSRCS=""
  		AC_MSG_ERROR(
  [OpenSSL was not found in any of $openssldirs; use --with-openssl=/path
@@ -1168,7 +1168,7 @@ index d10cde5..68bead8 100644
  		;;
  	*)
  		if test "yes" = "$want_native_pkcs11"
-@@ -1615,6 +1618,7 @@ If you don't want OpenSSL, use --without-openssl])
+@@ -1665,6 +1668,7 @@ If you don't want OpenSSL, use --without-openssl])
  			AC_MSG_ERROR(["$use_openssl/include/openssl/opensslv.h" not found])
  		fi
  		CRYPTO='-DOPENSSL'
@@ -1176,7 +1176,7 @@ index d10cde5..68bead8 100644
  		if test "/usr" = "$use_openssl"
  		then
  			DST_OPENSSL_INC=""
-@@ -2050,7 +2054,6 @@ fi
+@@ -2109,7 +2113,6 @@ fi
  # Use OpenSSL for hash functions
  #
  
@@ -1184,7 +1184,7 @@ index d10cde5..68bead8 100644
  ISC_PLATFORM_OPENSSLHASH="#undef ISC_PLATFORM_OPENSSLHASH"
  case $want_openssl_hash in
  	yes)
-@@ -2322,6 +2325,67 @@ if test "rt" = "$have_clock_gt"; then
+@@ -2381,6 +2384,67 @@ if test "rt" = "$have_clock_gt"; then
  	LIBS="-lrt $LIBS"
  fi
  
@@ -1252,7 +1252,7 @@ index d10cde5..68bead8 100644
  #
  # was --with-lmdb specified?
  #
-@@ -4098,12 +4162,12 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
+@@ -4174,12 +4238,12 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
  ISC_PLATFORM_USESTDASM="#undef ISC_PLATFORM_USESTDASM"
  ISC_PLATFORM_USEMACASM="#undef ISC_PLATFORM_USEMACASM"
  if test "yes" = "$use_atomic"; then
@@ -1266,7 +1266,7 @@ index d10cde5..68bead8 100644
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -4112,7 +4176,6 @@ if test "yes" = "$use_atomic"; then
+@@ -4188,7 +4252,6 @@ if test "yes" = "$use_atomic"; then
  		fi
  	;;
  	x86_64-*|amd64-*)
@@ -1274,7 +1274,7 @@ index d10cde5..68bead8 100644
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -5518,6 +5581,8 @@ report() {
+@@ -5622,6 +5685,8 @@ report() {
  	    echo "    IPv6 support (--enable-ipv6)"
  	test "X$CRYPTO" = "X" -o "yes" = "$want_native_pkcs11" || \
  		echo "    OpenSSL cryptography/DNSSEC (--with-openssl)"
@@ -1283,7 +1283,7 @@ index d10cde5..68bead8 100644
  	test "X$PYTHON" = "X" || echo "    Python tools (--with-python)"
  	test "X$XMLSTATS" = "X" || echo "    XML statistics (--with-libxml2)"
  	test "X$JSONSTATS" = "X" || echo "    JSON statistics (--with-libjson)"
-@@ -5558,6 +5623,8 @@ report() {
+@@ -5662,6 +5727,8 @@ report() {
  	echo "    Very verbose query trace logging (--enable-querytrace)"
      test "no" = "$with_cmocka" || echo "    CMocka Unit Testing Framework (--with-cmocka)"
  
@@ -1292,7 +1292,7 @@ index d10cde5..68bead8 100644
      echo "    Dynamically loadable zone (DLZ) drivers:"
      test "no" = "$use_dlz_bdb" || \
  	echo "        Berkeley DB (--with-dlz-bdb)"
-@@ -5605,6 +5672,8 @@ report() {
+@@ -5709,6 +5776,8 @@ report() {
  	echo "    ECDSA algorithm support (--with-ecdsa)"
      test "X$CRYPTO" = "X" -o "yes" = "$OPENSSL_ED25519" -o "yes" = "$PKCS11_ED25519" || \
  	echo "    EDDSA algorithm support (--with-eddsa)"
@@ -1302,7 +1302,7 @@ index d10cde5..68bead8 100644
      test "yes" = "$enable_seccomp" || \
  	echo "    Use libseccomp system call filtering (--enable-seccomp)"
 diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c
-index 65bf25d..1eccbe7 100644
+index 7a86506..aa54afc 100644
 --- a/lib/dns/dst_api.c
 +++ b/lib/dns/dst_api.c
 @@ -277,6 +277,12 @@ dst_lib_init2(isc_mem_t *mctx, isc_entropy_t *ectx,
@@ -1366,7 +1366,7 @@ index 65bf25d..1eccbe7 100644
  #endif
  }
 diff --git a/lib/dns/include/dst/dst.h b/lib/dns/include/dst/dst.h
-index 1924e74..6813c96 100644
+index 5b42ab4..3aba028 100644
 --- a/lib/dns/include/dst/dst.h
 +++ b/lib/dns/include/dst/dst.h
 @@ -159,6 +159,14 @@ dst_lib_destroy(void);
@@ -1385,10 +1385,10 @@ index 1924e74..6813c96 100644
  dst_algorithm_supported(unsigned int alg);
  /*%<
 diff --git a/lib/dns/lib.c b/lib/dns/lib.c
-index 304814b..60543c4 100644
+index d9417de..0dc935d 100644
 --- a/lib/dns/lib.c
 +++ b/lib/dns/lib.c
-@@ -18,6 +18,7 @@
+@@ -16,6 +16,7 @@
  #include <stdbool.h>
  #include <stddef.h>
  
@@ -1396,7 +1396,7 @@ index 304814b..60543c4 100644
  #include <isc/hash.h>
  #include <isc/mem.h>
  #include <isc/msgcat.h>
-@@ -78,6 +79,7 @@ static unsigned int references = 0;
+@@ -76,6 +77,7 @@ static unsigned int references = 0;
  static void
  initialize(void) {
  	isc_result_t result;
@@ -1404,7 +1404,7 @@ index 304814b..60543c4 100644
  
  	REQUIRE(initialize_done == false);
  
-@@ -88,11 +90,14 @@ initialize(void) {
+@@ -86,11 +88,14 @@ initialize(void) {
  	result = dns_ecdb_register(dns_g_mctx, &dbimp);
  	if (result != ISC_R_SUCCESS)
  		goto cleanup_mctx;
@@ -1421,7 +1421,7 @@ index 304814b..60543c4 100644
  	if (result != ISC_R_SUCCESS)
  		goto cleanup_hash;
  
-@@ -100,11 +105,17 @@ initialize(void) {
+@@ -98,11 +103,17 @@ initialize(void) {
  	if (result != ISC_R_SUCCESS)
  		goto cleanup_dst;
  
@@ -1440,7 +1440,7 @@ index 304814b..60543c4 100644
  	isc_hash_destroy();
    cleanup_db:
 diff --git a/lib/dns/openssl_link.c b/lib/dns/openssl_link.c
-index 13e838f..ffe0a69 100644
+index 1e57c71..3f4f822 100644
 --- a/lib/dns/openssl_link.c
 +++ b/lib/dns/openssl_link.c
 @@ -31,6 +31,7 @@
@@ -1624,7 +1624,7 @@ index 13e838f..ffe0a69 100644
  #endif /* OPENSSL */
  /*! \file */
 diff --git a/lib/dns/pkcs11.c b/lib/dns/pkcs11.c
-index 5a2c502..8eaef53 100644
+index 6b30309..20552fa 100644
 --- a/lib/dns/pkcs11.c
 +++ b/lib/dns/pkcs11.c
 @@ -13,12 +13,15 @@
@@ -1692,7 +1692,7 @@ index 937b548..f3c0e38 100644
  tap_test_program{name='gost_test'}
  tap_test_program{name='keytable_test'}
 diff --git a/lib/dns/tests/Makefile.in b/lib/dns/tests/Makefile.in
-index 90dc3a6..7671e1d 100644
+index 4126372..30cab17 100644
 --- a/lib/dns/tests/Makefile.in
 +++ b/lib/dns/tests/Makefile.in
 @@ -37,6 +37,7 @@ SRCS =		acl_test.c \
@@ -1845,10 +1845,10 @@ index 0000000..bd3d164
 +
 +#endif
 diff --git a/lib/dns/win32/libdns.def.in b/lib/dns/win32/libdns.def.in
-index 63be973..40b21fa 100644
+index 9c2ef79..f597049 100644
 --- a/lib/dns/win32/libdns.def.in
 +++ b/lib/dns/win32/libdns.def.in
-@@ -1485,6 +1485,13 @@ dst_lib_destroy
+@@ -1487,6 +1487,13 @@ dst_lib_destroy
  dst_lib_init
  dst_lib_init2
  dst_lib_initmsgcat
@@ -1863,7 +1863,7 @@ index 63be973..40b21fa 100644
  dst_region_computerid
  dst_result_register
 diff --git a/lib/isc/entropy.c b/lib/isc/entropy.c
-index 907e470..451544d 100644
+index 0c1f3ed..fdd17d7 100644
 --- a/lib/isc/entropy.c
 +++ b/lib/isc/entropy.c
 @@ -104,11 +104,15 @@ struct isc_entropy {
@@ -1921,7 +1921,7 @@ index 907e470..451544d 100644
 +	hook = myhook;
 +}
 diff --git a/lib/isc/include/isc/entropy.h b/lib/isc/include/isc/entropy.h
-index e8733db..c40a18c 100644
+index b5bc956..f32c9dc 100644
 --- a/lib/isc/include/isc/entropy.h
 +++ b/lib/isc/include/isc/entropy.h
 @@ -302,6 +302,18 @@ isc_entropy_usebestsource(isc_entropy_t *ectx, isc_entropysource_t **source,
@@ -1944,7 +1944,7 @@ index e8733db..c40a18c 100644
  
  #endif /* ISC_ENTROPY_H */
 diff --git a/lib/isc/include/isc/platform.h.in b/lib/isc/include/isc/platform.h.in
-index 61960f1..d22993d 100644
+index 2bf8758..f4c684e 100644
 --- a/lib/isc/include/isc/platform.h.in
 +++ b/lib/isc/include/isc/platform.h.in
 @@ -359,6 +359,11 @@
@@ -1960,10 +1960,10 @@ index 61960f1..d22993d 100644
   * Define if the hash functions must be provided by OpenSSL.
   */
 diff --git a/lib/isc/include/isc/types.h b/lib/isc/include/isc/types.h
-index da9d66f..4205400 100644
+index 3bdd54f..d5acd39 100644
 --- a/lib/isc/include/isc/types.h
 +++ b/lib/isc/include/isc/types.h
-@@ -97,6 +97,8 @@ typedef struct isc_time			isc_time_t;		/*%< Time */
+@@ -95,6 +95,8 @@ typedef struct isc_time			isc_time_t;		/*%< Time */
  typedef struct isc_timer		isc_timer_t;		/*%< Timer */
  typedef struct isc_timermgr		isc_timermgr_t;		/*%< Timer Manager */
  
@@ -1973,7 +1973,7 @@ index da9d66f..4205400 100644
  typedef int (*isc_sockfdwatch_t)(isc_task_t *, isc_socket_t *, void *, int);
  
 diff --git a/lib/isc/pk11.c b/lib/isc/pk11.c
-index 68aebdc..4b85527 100644
+index 227f807..4a63fdf 100644
 --- a/lib/isc/pk11.c
 +++ b/lib/isc/pk11.c
 @@ -321,14 +321,16 @@ pk11_rand_seed_fromfile(const char *randomfile) {
@@ -1999,7 +1999,7 @@ index 68aebdc..4b85527 100644
      cleanup:
  	if (stream != NULL)
 diff --git a/lib/isc/win32/include/isc/platform.h.in b/lib/isc/win32/include/isc/platform.h.in
-index 8ade705..fa72f9d 100644
+index 1f785e0..f9051c3 100644
 --- a/lib/isc/win32/include/isc/platform.h.in
 +++ b/lib/isc/win32/include/isc/platform.h.in
 @@ -73,6 +73,11 @@
@@ -2015,7 +2015,7 @@ index 8ade705..fa72f9d 100644
   * Define if the hash functions must be provided by OpenSSL.
   */
 diff --git a/win32utils/Configure b/win32utils/Configure
-index 79d682e..6c78cb2 100644
+index 7ac30fb..55b6c23 100644
 --- a/win32utils/Configure
 +++ b/win32utils/Configure
 @@ -382,6 +382,7 @@ my @substdefh = ("ALLOW_FILTER_AAAA",
@@ -2026,7 +2026,7 @@ index 79d682e..6c78cb2 100644
                   "ISC_PLATFORM_HAVEATOMICSTORE",
                   "ISC_PLATFORM_HAVEATOMICSTOREQ",
                   "ISC_PLATFORM_HAVECMPXCHG",
-@@ -517,7 +518,8 @@ my @allcond = (@substcond, "NOTYET", "NOLONGER");
+@@ -516,7 +517,8 @@ my @allcond = (@substcond, "NOTYET", "NOLONGER");
  
  # enable-xxx/disable-xxx
  
@@ -2035,16 +2035,16 @@ index 79d682e..6c78cb2 100644
 +                  "developer",
                    "fixed-rrset",
                    "intrinsics",
-                   "isc-spnego",
-@@ -580,6 +582,7 @@ my @help = (
+                   "native-pkcs11",
+@@ -578,6 +580,7 @@ my @help = (
  "\nOptional Features:\n",
  "  enable-intrinsics     enable intrinsic/atomic functions [default=yes]\n",
  "  enable-native-pkcs11  use native PKCS#11 for all crypto [default=no]\n",
 +"  enable-crypto-rand    use crypto provider for random [default=yes]\n",
  "  enable-openssl-hash   use OpenSSL for hash functions [default=yes]\n",
- "  enable-isc-spnego     use SPNEGO from lib/dns [default=yes]\n",
  "  enable-filter-aaaa    enable filtering of AAAA records [default=yes]\n",
-@@ -628,7 +631,9 @@ my $want_clean = "no";
+ "  enable-fixed-rrset    enable fixed rrset ordering [default=no]\n",
+@@ -625,7 +628,9 @@ my $want_clean = "no";
  my $want_unknown = "no";
  my $unknown_value;
  my $enable_intrinsics = "yes";
@@ -2053,8 +2053,8 @@ index 79d682e..6c78cb2 100644
 +my $enable_crypto_rand = "yes";
  my $enable_openssl_hash = "auto";
  my $enable_filter_aaaa = "yes";
- my $enable_isc_spnego = "yes";
-@@ -847,6 +852,10 @@ sub myenable {
+ my $enable_fixed_rrset = "no";
+@@ -844,6 +849,10 @@ sub myenable {
          if ($val =~ /^yes$/i) {
              $enable_native_pkcs11 = "yes";
          }
@@ -2065,7 +2065,7 @@ index 79d682e..6c78cb2 100644
      } elsif ($key =~ /^openssl-hash$/i) {
          if ($val =~ /^yes$/i) {
              $enable_openssl_hash = "yes";
-@@ -1153,6 +1162,11 @@ if ($verbose) {
+@@ -1146,6 +1155,11 @@ if ($verbose) {
      } else {
          print "native-pkcs11: disabled\n";
      }
@@ -2077,7 +2077,7 @@ index 79d682e..6c78cb2 100644
      if ($enable_openssl_hash eq "yes") {
          print "openssl-hash: enabled\n";
      } else {
-@@ -1510,6 +1524,7 @@ if ($enable_intrinsics eq "yes") {
+@@ -1498,6 +1512,7 @@ if ($enable_intrinsics eq "yes") {
  
  # enable-native-pkcs11
  if ($enable_native_pkcs11 eq "yes") {
@@ -2085,7 +2085,7 @@ index 79d682e..6c78cb2 100644
      if ($use_openssl eq "auto") {
          $use_openssl = "no";
      }
-@@ -1719,6 +1734,7 @@ if ($use_openssl eq "yes") {
+@@ -1707,6 +1722,7 @@ if ($use_openssl eq "yes") {
          $openssl_dll = File::Spec->catdir($openssl_path, "@dirlist[0]");
      }
  
@@ -2093,7 +2093,7 @@ index 79d682e..6c78cb2 100644
      $configcond{"OPENSSL"} = 1;
      $configdefd{"CRYPTO"} = "OPENSSL";
      $configvar{"OPENSSL_PATH"} = "$openssl_path";
-@@ -2290,6 +2306,15 @@ if ($use_aes eq "yes") {
+@@ -2278,6 +2294,15 @@ if ($use_aes eq "yes") {
  }
  
  
@@ -2109,7 +2109,7 @@ index 79d682e..6c78cb2 100644
  # enable-openssl-hash
  if ($enable_openssl_hash eq "yes") {
      if ($use_openssl eq "no") {
-@@ -3665,6 +3690,7 @@ exit 0;
+@@ -3650,6 +3675,7 @@ exit 0;
  #  --enable-developer partially supported
  #  --enable-newstats (9.9/9.9sub only)
  #  --enable-native-pkcs11 supported
@@ -2118,5 +2118,5 @@ index 79d682e..6c78cb2 100644
  #  --enable-openssl-hash supported
  #  --enable-threads included without a way to disable it
 -- 
-2.21.1
+2.31.1
 

SOURCES/bind-9.11-rt46047.patch

@@ -1,4 +1,4 @@
-From 344c19ad4b3f058e65a4b41650bb0ee20692cc5c Mon Sep 17 00:00:00 2001
+From af3b530773231f8cff6548e36962ad1f25e38c5d Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Thu, 28 Sep 2017 10:09:22 -0700
 Subject: [PATCH] completed and corrected the crypto-random change
@@ -45,13 +45,13 @@ Subject: [PATCH] completed and corrected the crypto-random change
  lib/dns/include/dst/dst.h                | 14 +++++-
  lib/dns/openssl_link.c                   |  3 +-
  lib/isc/include/isc/entropy.h            | 48 +++++++++++++++------
- lib/isc/include/isc/random.h             | 28 +++++++-----
+ lib/isc/include/isc/random.h             | 26 +++++++----
  lib/isccfg/namedconf.c                   |  2 +-
- 23 files changed, 240 insertions(+), 104 deletions(-)
+ 23 files changed, 240 insertions(+), 102 deletions(-)
  create mode 100644 doc/arm/notes-rh-changes.xml
 
 diff --git a/bin/confgen/keygen.c b/bin/confgen/keygen.c
-index 295e16f..0f79aa8 100644
+index bd269e7..1ac775f 100644
 --- a/bin/confgen/keygen.c
 +++ b/bin/confgen/keygen.c
 @@ -161,17 +161,15 @@ generate_key(isc_mem_t *mctx, const char *randomfile, dns_secalg_t alg,
@@ -78,7 +78,7 @@ index 295e16f..0f79aa8 100644
  							     &entropy_source,
  							     randomfile,
 diff --git a/bin/dnssec/dnssec-keygen.docbook b/bin/dnssec/dnssec-keygen.docbook
-index 1826919..96543fc 100644
+index bd19e1d..2c09b30 100644
 --- a/bin/dnssec/dnssec-keygen.docbook
 +++ b/bin/dnssec/dnssec-keygen.docbook
 @@ -349,15 +349,23 @@
@@ -114,7 +114,7 @@ index 1826919..96543fc 100644
  	</listitem>
        </varlistentry>
 diff --git a/bin/dnssec/dnssectool.c b/bin/dnssec/dnssectool.c
-index 5654435..24c0d5a 100644
+index 2a0f9c6..6fcd411 100644
 --- a/bin/dnssec/dnssectool.c
 +++ b/bin/dnssec/dnssectool.c
 @@ -241,18 +241,16 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
@@ -142,10 +142,10 @@ index 5654435..24c0d5a 100644
  					   usekeyboard);
  
 diff --git a/bin/named/client.c b/bin/named/client.c
-index 9a0d3c8..c573177 100644
+index 4a50ad9..4d140e8 100644
 --- a/bin/named/client.c
 +++ b/bin/named/client.c
-@@ -1765,7 +1765,8 @@ ns_client_addopt(ns_client_t *client, dns_message_t *message,
+@@ -1768,7 +1768,8 @@ ns_client_addopt(ns_client_t *client, dns_message_t *message,
  
  		isc_buffer_init(&buf, cookie, sizeof(cookie));
  		isc_stdtime_get(&now);
@@ -156,7 +156,7 @@ index 9a0d3c8..c573177 100644
  		compute_cookie(client, now, nonce, ns_g_server->secret, &buf);
  
 diff --git a/bin/named/config.c b/bin/named/config.c
-index dbdff64..63da4b0 100644
+index 9b343fa..5e663c6 100644
 --- a/bin/named/config.c
 +++ b/bin/named/config.c
 @@ -98,7 +98,9 @@ options {\n\
@@ -171,10 +171,10 @@ index dbdff64..63da4b0 100644
  #endif
  "	recursing-file \"named.recursing\";\n\
 diff --git a/bin/named/controlconf.c b/bin/named/controlconf.c
-index d955c2f..40621f2 100644
+index 9fdf49b..42128dc 100644
 --- a/bin/named/controlconf.c
 +++ b/bin/named/controlconf.c
-@@ -325,9 +325,10 @@ log_invalid(isccc_ccmsg_t *ccmsg, isc_result_t result) {
+@@ -327,9 +327,10 @@ log_invalid(isccc_ccmsg_t *ccmsg, isc_result_t result) {
  
  static void
  control_recvmessage(isc_task_t *task, isc_event_t *event) {
@@ -188,7 +188,7 @@ index d955c2f..40621f2 100644
  	isccc_sexpr_t *request = NULL;
  	isccc_sexpr_t *response = NULL;
  	uint32_t algorithm;
-@@ -338,16 +339,17 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
+@@ -340,16 +341,17 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
  	isc_buffer_t *text;
  	isc_result_t result;
  	isc_result_t eresult;
@@ -208,7 +208,7 @@ index d955c2f..40621f2 100644
  	algorithm = DST_ALG_UNKNOWN;
  	secret.rstart = NULL;
  	text = NULL;
-@@ -458,8 +460,11 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
+@@ -462,8 +464,11 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
  	 * Establish nonce.
  	 */
  	if (conn->nonce == 0) {
@@ -223,7 +223,7 @@ index d955c2f..40621f2 100644
  	} else
  		eresult = ns_control_docommand(request, listener->readonly, &text);
 diff --git a/bin/named/include/named/server.h b/bin/named/include/named/server.h
-index 3f96b7b..c92922e 100644
+index 4fd0194..0ba2627 100644
 --- a/bin/named/include/named/server.h
 +++ b/bin/named/include/named/server.h
 @@ -20,6 +20,7 @@
@@ -234,7 +234,7 @@ index 3f96b7b..c92922e 100644
  #include <isc/sockaddr.h>
  #include <isc/types.h>
  #include <isc/xml.h>
-@@ -134,6 +135,7 @@ struct ns_server {
+@@ -135,6 +136,7 @@ struct ns_server {
  	char *			lockfile;
  
  	uint16_t		transfer_tcp_message_size;
@@ -243,7 +243,7 @@ index 3f96b7b..c92922e 100644
  
  struct ns_altsecret {
 diff --git a/bin/named/interfacemgr.c b/bin/named/interfacemgr.c
-index 9dea7c1..272d300 100644
+index 93aac31..e12fad9 100644
 --- a/bin/named/interfacemgr.c
 +++ b/bin/named/interfacemgr.c
 @@ -17,6 +17,7 @@
@@ -255,22 +255,22 @@ index 9dea7c1..272d300 100644
  #include <isc/task.h>
  #include <isc/util.h>
 diff --git a/bin/named/query.c b/bin/named/query.c
-index 203f1e6..25eeced 100644
+index 58b5914..edf42d2 100644
 --- a/bin/named/query.c
 +++ b/bin/named/query.c
-@@ -19,6 +19,7 @@
- #include <isc/hex.h>
+@@ -20,6 +20,7 @@
  #include <isc/mem.h>
+ #include <isc/platform.h>
  #include <isc/print.h>
 +#include <isc/random.h>
  #include <isc/rwlock.h>
  #include <isc/serial.h>
  #include <isc/stats.h>
 diff --git a/bin/named/server.c b/bin/named/server.c
-index f27071f..f132c19 100644
+index b2ae57c..cca7fe8 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
-@@ -8210,21 +8210,32 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8279,21 +8279,32 @@ load_configuration(const char *filename, ns_server_t *server,
  	 * Open the source of entropy.
  	 */
  	if (first_time) {
@@ -312,7 +312,7 @@ index f27071f..f132c19 100644
  #ifdef PATH_RANDOMDEV
  			if (ns_g_fallbackentropy != NULL) {
  				level = ISC_LOG_INFO;
-@@ -8235,8 +8246,8 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8304,8 +8315,8 @@ load_configuration(const char *filename, ns_server_t *server,
  					      NS_LOGCATEGORY_GENERAL,
  					      NS_LOGMODULE_SERVER,
  					      level,
@@ -323,7 +323,7 @@ index f27071f..f132c19 100644
  					      randomdev,
  					      isc_result_totext(result));
  			}
-@@ -8256,7 +8267,6 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8325,7 +8336,6 @@ load_configuration(const char *filename, ns_server_t *server,
  				}
  				isc_entropy_detach(&ns_g_fallbackentropy);
  			}
@@ -331,7 +331,7 @@ index f27071f..f132c19 100644
  #endif
  		}
  
-@@ -9025,6 +9035,7 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
+@@ -9097,6 +9107,7 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
  	server->in_roothints = NULL;
  	server->blackholeacl = NULL;
  	server->keepresporder = NULL;
@@ -339,7 +339,7 @@ index f27071f..f132c19 100644
  
  	/* Must be first. */
  	CHECKFATAL(dst_lib_init2(ns_g_mctx, ns_g_entropy,
-@@ -9051,6 +9062,9 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
+@@ -9123,6 +9134,9 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
  	CHECKFATAL(dns_tkeyctx_create(ns_g_mctx, ns_g_entropy,
  				      &server->tkeyctx),
  		   "creating TKEY context");
@@ -349,7 +349,7 @@ index f27071f..f132c19 100644
  
  	/*
  	 * Setup the server task, which is responsible for coordinating
-@@ -9257,7 +9271,8 @@ ns_server_destroy(ns_server_t **serverp) {
+@@ -9329,7 +9343,8 @@ ns_server_destroy(ns_server_t **serverp) {
  
  	if (server->zonemgr != NULL)
  		dns_zonemgr_detach(&server->zonemgr);
@@ -359,7 +359,7 @@ index f27071f..f132c19 100644
  	if (server->tkeyctx != NULL)
  		dns_tkeyctx_destroy(&server->tkeyctx);
  
-@@ -13263,10 +13278,10 @@ newzone_cfgctx_destroy(void **cfgp) {
+@@ -13366,10 +13381,10 @@ newzone_cfgctx_destroy(void **cfgp) {
  
  static isc_result_t
  generate_salt(unsigned char *salt, size_t saltlen) {
@@ -372,7 +372,7 @@ index f27071f..f132c19 100644
  	} rnd;
  	unsigned char text[512 + 1];
  	isc_region_t r;
-@@ -13276,9 +13291,10 @@ generate_salt(unsigned char *salt, size_t saltlen) {
+@@ -13379,9 +13394,10 @@ generate_salt(unsigned char *salt, size_t saltlen) {
  	if (saltlen > 256U)
  		return (ISC_R_RANGE);
  
@@ -387,10 +387,10 @@ index f27071f..f132c19 100644
  	memmove(salt, rnd.rnd, saltlen);
  
 diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
-index 0286987..0376377 100644
+index 7f15cbc..458aa76 100644
 --- a/bin/nsupdate/nsupdate.c
 +++ b/bin/nsupdate/nsupdate.c
-@@ -283,9 +283,7 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
+@@ -289,9 +289,7 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
  	}
  
  #ifdef ISC_PLATFORM_CRYPTORANDOM
@@ -402,7 +402,7 @@ index 0286987..0376377 100644
  	}
  #endif
 diff --git a/bin/tests/system/pipelined/pipequeries.c b/bin/tests/system/pipelined/pipequeries.c
-index f0a6ff2..55064f6 100644
+index 95b65bf..7a81d4e 100644
 --- a/bin/tests/system/pipelined/pipequeries.c
 +++ b/bin/tests/system/pipelined/pipequeries.c
 @@ -280,9 +280,7 @@ main(int argc, char *argv[]) {
@@ -417,7 +417,7 @@ index f0a6ff2..55064f6 100644
  	}
  #endif
 diff --git a/bin/tests/system/tkey/keycreate.c b/bin/tests/system/tkey/keycreate.c
-index fe8698e..937fcc3 100644
+index 3236968..4fa77b6 100644
 --- a/bin/tests/system/tkey/keycreate.c
 +++ b/bin/tests/system/tkey/keycreate.c
 @@ -255,9 +255,7 @@ main(int argc, char *argv[]) {
@@ -432,7 +432,7 @@ index fe8698e..937fcc3 100644
  	}
  #endif
 diff --git a/bin/tests/system/tkey/keydelete.c b/bin/tests/system/tkey/keydelete.c
-index 2146f9b..64b8e74 100644
+index 43fb6b0..105e151 100644
 --- a/bin/tests/system/tkey/keydelete.c
 +++ b/bin/tests/system/tkey/keydelete.c
 @@ -171,6 +171,7 @@ main(int argc, char **argv) {
@@ -455,22 +455,22 @@ index 2146f9b..64b8e74 100644
  	}
  #endif
 diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
-index 93c7a08..bb1e81d 100644
+index ca98726..1f9df2c 100644
 --- a/doc/arm/Bv9ARM-book.xml
 +++ b/doc/arm/Bv9ARM-book.xml
-@@ -5081,22 +5081,45 @@ badresp:1,adberr:0,findfail:0,valfail:0]
+@@ -5034,22 +5034,45 @@ badresp:1,adberr:0,findfail:0,valfail:0]
  	    <term><command>random-device</command></term>
  	    <listitem>
  	      <para>
--		The source of entropy to be used by the server.  Entropy is
+-		This specifies a source of entropy to be used by the server.  Entropy is
 -		primarily needed
 -		for DNSSEC operations, such as TKEY transactions and dynamic
 -		update of signed
--		zones.  This options specifies the device (or file) from which
+-		zones.  This option specifies the device (or file) from which
 -		to read
--		entropy.  If this is a file, operations requiring entropy will
+-		entropy.  If it is a file, operations requiring entropy will
 -		fail when the
--		file has been exhausted.  If not specified, the default value
+-		file has been exhausted.  If <command>random-device</command> is not specified, the default value
 -		is
 -		<filename>/dev/random</filename>
 -		(or equivalent) when present, and none otherwise.  The
@@ -569,10 +569,10 @@ index 0000000..89a4961
 +</section>
 +
 diff --git a/doc/arm/notes.xml b/doc/arm/notes.xml
-index 589a347..052a0bd 100644
+index a5e42c0..f8cb1f9 100644
 --- a/doc/arm/notes.xml
 +++ b/doc/arm/notes.xml
-@@ -40,6 +40,7 @@
+@@ -47,6 +47,7 @@
    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-9.11.1.xml"/>
    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-9.11.0.xml"/>
  
@@ -581,7 +581,7 @@ index 589a347..052a0bd 100644
    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-thankyou.xml"/>
  </section>
 diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c
-index 1eccbe7..1933993 100644
+index aa54afc..2156384 100644
 --- a/lib/dns/dst_api.c
 +++ b/lib/dns/dst_api.c
 @@ -2017,10 +2017,12 @@ dst__entropy_getdata(void *buf, unsigned int len, bool pseudo) {
@@ -599,7 +599,7 @@ index 1eccbe7..1933993 100644
  }
  
 diff --git a/lib/dns/include/dst/dst.h b/lib/dns/include/dst/dst.h
-index 6813c96..665574d 100644
+index 3aba028..180c841 100644
 --- a/lib/dns/include/dst/dst.h
 +++ b/lib/dns/include/dst/dst.h
 @@ -163,8 +163,18 @@ isc_result_t
@@ -624,7 +624,7 @@ index 6813c96..665574d 100644
  
  bool
 diff --git a/lib/dns/openssl_link.c b/lib/dns/openssl_link.c
-index ffe0a69..5e48686 100644
+index 3f4f822..cfdc757 100644
 --- a/lib/dns/openssl_link.c
 +++ b/lib/dns/openssl_link.c
 @@ -484,7 +484,8 @@ dst__openssl_getengine(const char *engine) {
@@ -638,7 +638,7 @@ index ffe0a69..5e48686 100644
  #ifndef DONT_REQUIRE_DST_LIB_INIT
  	INSIST(dst__memory_pool != NULL);
 diff --git a/lib/isc/include/isc/entropy.h b/lib/isc/include/isc/entropy.h
-index c40a18c..c7cb17d 100644
+index f32c9dc..bed276b 100644
 --- a/lib/isc/include/isc/entropy.h
 +++ b/lib/isc/include/isc/entropy.h
 @@ -189,9 +189,8 @@ isc_entropy_createcallbacksource(isc_entropy_t *ent,
@@ -718,26 +718,21 @@ index c40a18c..c7cb17d 100644
  
  ISC_LANG_ENDDECLS
 diff --git a/lib/isc/include/isc/random.h b/lib/isc/include/isc/random.h
-index f8aed34..17c551b 100644
+index f38e80d..3cb1c56 100644
 --- a/lib/isc/include/isc/random.h
 +++ b/lib/isc/include/isc/random.h
-@@ -9,8 +9,6 @@
-  * information regarding copyright ownership.
-  */
- 
--/* $Id: random.h,v 1.20 2009/01/17 23:47:43 tbox Exp $ */
--
- #ifndef ISC_RANDOM_H
- #define ISC_RANDOM_H 1
- 
-@@ -21,13 +19,23 @@
+@@ -19,13 +19,23 @@
  #include <isc/mutex.h>
  
  /*! \file isc/random.h
 - * \brief Implements a random state pool which will let the caller return a
 - * series of possibly non-reproducible random values.
 + * \brief Implements pseudo random number generators.
-+ *
+  *
+- * Note that the
+- * strength of these numbers is not all that high, and should not be
+- * used in cryptography functions.  It is useful for jittering values
+- * a bit here and there, such as timeouts, etc.
 + * Two pseudo-random number generators are implemented, in isc_random_*
 + * and isc_rng_*. Neither one is very strong; they should not be used
 + * in cryptography functions.
@@ -747,11 +742,7 @@ index f8aed34..17c551b 100644
 + * It is useful for jittering values a bit here and there, such as
 + * timeouts, etc, but should not be relied upon to generate
 + * unpredictable sequences (for example, when choosing transaction IDs).
-  *
-- * Note that the
-- * strength of these numbers is not all that high, and should not be
-- * used in cryptography functions.  It is useful for jittering values
-- * a bit here and there, such as timeouts, etc.
++  *
 + * isc_rng_* is based on ChaCha20, and is seeded and stirred from the
 + * system entropy source. It is stronger than isc_random_* and can
 + * be used for generating unpredictable sequences. It is still not as
@@ -760,7 +751,7 @@ index f8aed34..17c551b 100644
   */
  
  ISC_LANG_BEGINDECLS
-@@ -115,8 +123,8 @@ isc_rng_random(isc_rng_t *rngctx);
+@@ -113,8 +123,8 @@ isc_rng_random(isc_rng_t *rngctx);
  uint16_t
  isc_rng_uniformrandom(isc_rng_t *rngctx, uint16_t upper_bound);
  /*%<
@@ -772,7 +763,7 @@ index f8aed34..17c551b 100644
  
  ISC_LANG_ENDDECLS
 diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
-index 1c45d5c..91693b5 100644
+index e74c93b..212194e 100644
 --- a/lib/isccfg/namedconf.c
 +++ b/lib/isccfg/namedconf.c
 @@ -1109,7 +1109,7 @@ options_clauses[] = {
@@ -785,5 +776,5 @@ index 1c45d5c..91693b5 100644
  	{ "recursive-clients", &cfg_type_uint32, 0 },
  	{ "reserved-sockets", &cfg_type_uint32, 0 },
 -- 
-2.21.1
+2.26.2
 

SOURCES/bind-9.11-serve-stale.patch

@@ -1,4 +1,4 @@
-From 521fc8dcc0ac064ae8bc521418f5b03f0ceec657 Mon Sep 17 00:00:00 2001
+From d55a57427ee696dec51149950478394e43019607 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 7 Nov 2019 14:31:03 +0100
 Subject: [PATCH] Implement serve-stale in 9.11
@@ -240,7 +240,7 @@ Signed-off-by: Petr Menšík <pemensik@redhat.com>
  bin/tests/system/serve-stale/prereq.sh        |  38 ++
  bin/tests/system/serve-stale/setup.sh         |  13 +
  bin/tests/system/serve-stale/tests.sh         | 536 ++++++++++++++++++
- doc/arm/Bv9ARM-book.xml                       |  69 ++-
+ doc/arm/Bv9ARM-book.xml                       |  77 ++-
  doc/arm/logging-categories.xml                |  11 +
  doc/arm/notes-rh-changes.xml                  |  14 +-
  doc/misc/options                              |  10 +
@@ -263,7 +263,7 @@ Signed-off-by: Petr Menšík <pemensik@redhat.com>
  lib/dns/tests/db_test.c                       | 198 ++++++-
  lib/dns/view.c                                |   3 +
  lib/isccfg/namedconf.c                        |   5 +
- 48 files changed, 2122 insertions(+), 102 deletions(-)
+ 48 files changed, 2126 insertions(+), 106 deletions(-)
  create mode 100644 bin/tests/system/serve-stale/.gitignore
  create mode 100644 bin/tests/system/serve-stale/ans2/ans.pl.in
  create mode 100644 bin/tests/system/serve-stale/clean.sh
@@ -276,7 +276,7 @@ Signed-off-by: Petr Menšík <pemensik@redhat.com>
  create mode 100755 bin/tests/system/serve-stale/tests.sh
 
 diff --git a/bin/named/config.c b/bin/named/config.c
-index 63da4b0..b598f9b 100644
+index 9e071bb..d2cd3bc 100644
 --- a/bin/named/config.c
 +++ b/bin/named/config.c
 @@ -182,13 +182,14 @@ options {\n\
@@ -291,7 +291,7 @@ index 63da4b0..b598f9b 100644
  	max-clients-per-query 100;\n\
  	max-ncache-ttl 10800; /* 3 hours */\n\
  	max-recursion-depth 7;\n\
- 	max-recursion-queries 75;\n\
+ 	max-recursion-queries 100;\n\
 +	max-stale-ttl 604800; /* 1 week */\n\
  	message-compression yes;\n\
  #	min-roots <obsolete>;\n\
@@ -312,7 +312,7 @@ index 63da4b0..b598f9b 100644
  	transfer-format many-answers;\n\
  	v6-bias 50;\n\
 diff --git a/bin/named/control.c b/bin/named/control.c
-index df23c26..8b79850 100644
+index 23620b4..0756c73 100644
 --- a/bin/named/control.c
 +++ b/bin/named/control.c
 @@ -282,6 +282,8 @@ ns_control_docommand(isccc_sexpr_t *message, bool readonly,
@@ -325,10 +325,10 @@ index df23c26..8b79850 100644
  		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
  			      NS_LOGMODULE_CONTROL, ISC_LOG_WARNING,
 diff --git a/bin/named/include/named/control.h b/bin/named/include/named/control.h
-index 8705fdd..1634154 100644
+index 56bad8d..37403f1 100644
 --- a/bin/named/include/named/control.h
 +++ b/bin/named/include/named/control.h
-@@ -69,6 +69,7 @@
+@@ -67,6 +67,7 @@
  #define NS_COMMAND_MKEYS	"managed-keys"
  #define NS_COMMAND_DNSTAPREOPEN	"dnstap-reopen"
  #define NS_COMMAND_DNSTAP	"dnstap"
@@ -337,10 +337,10 @@ index 8705fdd..1634154 100644
  isc_result_t
  ns_controls_create(ns_server_t *server, ns_controls_t **ctrlsp);
 diff --git a/bin/named/include/named/log.h b/bin/named/include/named/log.h
-index 56bfcd4..cd8db60 100644
+index 76e3a51..0d1d985 100644
 --- a/bin/named/include/named/log.h
 +++ b/bin/named/include/named/log.h
-@@ -32,6 +32,7 @@
+@@ -30,6 +30,7 @@
  #define NS_LOGCATEGORY_UPDATE_SECURITY	(&ns_g_categories[6])
  #define NS_LOGCATEGORY_QUERY_ERRORS	(&ns_g_categories[7])
  #define NS_LOGCATEGORY_TAT		(&ns_g_categories[8])
@@ -349,7 +349,7 @@ index 56bfcd4..cd8db60 100644
  /*
   * Backwards compatibility.
 diff --git a/bin/named/include/named/query.h b/bin/named/include/named/query.h
-index 9661f56..445b578 100644
+index ef1b172..53c052b 100644
 --- a/bin/named/include/named/query.h
 +++ b/bin/named/include/named/query.h
 @@ -35,6 +35,18 @@ typedef struct ns_dbversion {
@@ -389,10 +389,10 @@ index 9661f56..445b578 100644
  	bool root_key_sentinel_is_ta;
  	bool root_key_sentinel_not_ta;
 diff --git a/bin/named/include/named/server.h b/bin/named/include/named/server.h
-index c92922e..588bf2d 100644
+index 0ba2627..08a02dc 100644
 --- a/bin/named/include/named/server.h
 +++ b/bin/named/include/named/server.h
-@@ -226,7 +226,10 @@ enum {
+@@ -227,7 +227,10 @@ enum {
  
  	dns_nsstatscounter_reclimitdropped = 58,
  
@@ -404,7 +404,7 @@ index c92922e..588bf2d 100644
  };
  
  /*%
-@@ -765,4 +768,12 @@ ns_server_mkeys(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text);
+@@ -766,4 +769,12 @@ ns_server_mkeys(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text);
  isc_result_t
  ns_server_dnstap(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text);
  
@@ -418,7 +418,7 @@ index c92922e..588bf2d 100644
 +		     isc_buffer_t **text);
  #endif /* NAMED_SERVER_H */
 diff --git a/bin/named/log.c b/bin/named/log.c
-index 3aa25e9..12f178b 100644
+index acfa766..ea6f114 100644
 --- a/bin/named/log.c
 +++ b/bin/named/log.c
 @@ -38,6 +38,7 @@ static isc_logcategory_t categories[] = {
@@ -430,10 +430,10 @@ index 3aa25e9..12f178b 100644
  };
  
 diff --git a/bin/named/query.c b/bin/named/query.c
-index 25eeced..162e4ea 100644
+index b14f081..a95f5ad 100644
 --- a/bin/named/query.c
 +++ b/bin/named/query.c
-@@ -125,10 +125,14 @@
+@@ -149,10 +149,14 @@ last_cmpxchg(isc_stdtime_t *x, isc_stdtime_t *e, isc_stdtime_t r) {
  #define REDIRECT(c)		(((c)->query.attributes & \
  				  NS_QUERYATTR_REDIRECT) != 0)
  
@@ -449,7 +449,7 @@ index 25eeced..162e4ea 100644
  #ifdef WANT_QUERYTRACE
  static inline void
  client_trace(ns_client_t *client, int level, const char *message) {
-@@ -217,6 +221,10 @@ static bool
+@@ -241,6 +245,10 @@ static bool
  rpz_ck_dnssec(ns_client_t *client, isc_result_t qresult,
  	      dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset);
  
@@ -460,7 +460,7 @@ index 25eeced..162e4ea 100644
  /*%
   * Increment query statistics counters.
   */
-@@ -470,6 +478,7 @@ query_reset(ns_client_t *client, bool everything) {
+@@ -494,6 +502,7 @@ query_reset(ns_client_t *client, bool everything) {
  	client->query.isreferral = false;
  	client->query.dns64_options = 0;
  	client->query.dns64_ttl = UINT32_MAX;
@@ -468,8 +468,8 @@ index 25eeced..162e4ea 100644
  	client->query.root_key_sentinel_keyid = 0;
  	client->query.root_key_sentinel_is_ta = false;
  	client->query.root_key_sentinel_not_ta = false;
-@@ -4254,6 +4263,54 @@ query_prefetch(ns_client_t *client, dns_name_t *qname,
- 	dns_rdataset_clearprefetch(rdataset);
+@@ -4305,6 +4314,54 @@ log_quota(ns_client_t *client, isc_stdtime_t *last, isc_stdtime_t now,
+ 	}
  }
  
 +/*%
@@ -523,7 +523,7 @@ index 25eeced..162e4ea 100644
  static isc_result_t
  query_recurse(ns_client_t *client, dns_rdatatype_t qtype, dns_name_t *qname,
  	      dns_name_t *qdomain, dns_rdataset_t *nameservers,
-@@ -4263,6 +4320,19 @@ query_recurse(ns_client_t *client, dns_rdatatype_t qtype, dns_name_t *qname,
+@@ -4314,6 +4371,19 @@ query_recurse(ns_client_t *client, dns_rdatatype_t qtype, dns_name_t *qname,
  	dns_rdataset_t *rdataset, *sigrdataset;
  	isc_sockaddr_t *peeraddr;
  
@@ -543,7 +543,7 @@ index 25eeced..162e4ea 100644
  	if (!resuming)
  		inc_stats(client, dns_nsstatscounter_recursion);
  
-@@ -6780,6 +6850,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
+@@ -6821,6 +6891,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
  	int line = -1;
  	bool dns64_exclude, dns64, rpz;
  	bool nxrewrite = false;
@@ -551,7 +551,7 @@ index 25eeced..162e4ea 100644
  	bool redirected = false;
  	dns_clientinfomethods_t cm;
  	dns_clientinfo_t ci;
-@@ -7089,6 +7160,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
+@@ -7130,6 +7201,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
  		type = qtype;
  
   restart:
@@ -559,7 +559,7 @@ index 25eeced..162e4ea 100644
  	CTRACE(ISC_LOG_DEBUG(3), "query_find: restart");
  	want_restart = false;
  	authoritative = false;
-@@ -7233,6 +7305,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
+@@ -7274,6 +7346,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
  	}
  
   db_find:
@@ -567,7 +567,7 @@ index 25eeced..162e4ea 100644
  	CTRACE(ISC_LOG_DEBUG(3), "query_find: db_find");
  	/*
  	 * We'll need some resources...
-@@ -7290,6 +7363,35 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
+@@ -7331,6 +7404,35 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
  	if (!is_zone)
  		dns_cache_updatestats(client->view->cache, result);
  
@@ -603,7 +603,7 @@ index 25eeced..162e4ea 100644
   resume:
  	CTRACE(ISC_LOG_DEBUG(3), "query_find: resume");
  
-@@ -7635,6 +7737,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
+@@ -7676,6 +7778,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
  		 * The cache doesn't even have the root NS.  Get them from
  		 * the hints DB.
  		 */
@@ -611,7 +611,7 @@ index 25eeced..162e4ea 100644
  		INSIST(!is_zone);
  		if (db != NULL)
  			dns_db_detach(&db);
-@@ -7697,12 +7800,14 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
+@@ -7738,12 +7841,14 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
  		 */
  		/* FALLTHROUGH */
  	case DNS_R_DELEGATION:
@@ -626,7 +626,7 @@ index 25eeced..162e4ea 100644
  			if (!RECURSIONOK(client) &&
  			    (options & DNS_GETDB_NOEXACT) != 0 &&
  			    qtype == dns_rdatatype_ds) {
-@@ -8089,6 +8194,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
+@@ -8130,6 +8235,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
  						       false, true);
  			}
  		}
@@ -634,7 +634,7 @@ index 25eeced..162e4ea 100644
  		if (dns_rdataset_isassociated(rdataset)) {
  			/*
  			 * If we've got a NSEC record, we need to save the
-@@ -8409,7 +8515,8 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
+@@ -8450,7 +8556,8 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
  		/*
  		 * If we have a zero ttl from the cache refetch it.
  		 */
@@ -644,7 +644,7 @@ index 25eeced..162e4ea 100644
  		    RECURSIONOK(client))
  		{
  			if (dns_rdataset_isassociated(rdataset))
-@@ -8627,7 +8734,11 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
+@@ -8676,7 +8783,11 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
  			 "query_find: unexpected error after resuming: %s",
  			 isc_result_totext(result));
  		CTRACE(ISC_LOG_ERROR, errmsg);
@@ -657,7 +657,7 @@ index 25eeced..162e4ea 100644
  		goto cleanup;
  	}
  
-@@ -8883,7 +8994,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
+@@ -8932,7 +9043,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
  		/*
  		 * If we have a zero ttl from the cache refetch it.
  		 */
@@ -666,7 +666,7 @@ index 25eeced..162e4ea 100644
  		    RECURSIONOK(client))
  		{
  			if (dns_rdataset_isassociated(rdataset))
-@@ -8894,6 +9005,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
+@@ -8943,6 +9054,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
  			if (node != NULL)
  				dns_db_detachnode(db, &node);
  
@@ -674,7 +674,7 @@ index 25eeced..162e4ea 100644
  			INSIST(!REDIRECT(client));
  			result = query_recurse(client, qtype,
  					       client->query.qname,
-@@ -9174,6 +9286,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
+@@ -9223,6 +9335,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
  				       dns_fixedname_name(&wildcardname),
  				       true, false);
   cleanup:
@@ -682,7 +682,7 @@ index 25eeced..162e4ea 100644
  	CTRACE(ISC_LOG_DEBUG(3), "query_find: cleanup");
  	/*
  	 * General cleanup.
-@@ -9230,6 +9343,49 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
+@@ -9279,6 +9392,49 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
  		goto restart;
  	}
  
@@ -733,7 +733,7 @@ index 25eeced..162e4ea 100644
  	    (!PARTIALANSWER(client) || WANTRECURSION(client)
  	     || eresult == DNS_R_DROP)) {
 diff --git a/bin/named/server.c b/bin/named/server.c
-index 1f23cf0..1fa836f 100644
+index 2bdf690..3a5ba91 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
 @@ -1720,7 +1720,8 @@ static bool
@@ -843,7 +843,7 @@ index 1f23cf0..1fa836f 100644
  	/*
  	 * Set supported DNSSEC algorithms.
  	 */
-@@ -14456,3 +14500,132 @@ ns_server_dnstap(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text) {
+@@ -14559,3 +14603,132 @@ ns_server_dnstap(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text) {
  	return (ISC_R_NOTIMPLEMENTED);
  #endif
  }
@@ -977,7 +977,7 @@ index 1f23cf0..1fa836f 100644
 +	return (result);
 +}
 diff --git a/bin/named/statschannel.c b/bin/named/statschannel.c
-index 4b8d972..8c68737 100644
+index 12ab048..4938c03 100644
 --- a/bin/named/statschannel.c
 +++ b/bin/named/statschannel.c
 @@ -300,6 +300,12 @@ init_desc(void) {
@@ -994,7 +994,7 @@ index 4b8d972..8c68737 100644
  
  	/* Initialize resolver statistics */
 diff --git a/bin/rndc/rndc.c b/bin/rndc/rndc.c
-index 8083654..d519983 100644
+index 0acfe3a..2c21c1d 100644
 --- a/bin/rndc/rndc.c
 +++ b/bin/rndc/rndc.c
 @@ -160,6 +160,8 @@ command is one of the following:\n\
@@ -1007,7 +1007,7 @@ index 8083654..d519983 100644
  		Print a zone's configuration.\n\
    sign zone [class [view]]\n\
 diff --git a/bin/rndc/rndc.docbook b/bin/rndc/rndc.docbook
-index e14a17e..eaf32d3 100644
+index 159ded9..12a7208 100644
 --- a/bin/rndc/rndc.docbook
 +++ b/bin/rndc/rndc.docbook
 @@ -689,6 +689,25 @@
@@ -1037,7 +1037,7 @@ index e14a17e..eaf32d3 100644
  	<term><userinput>secroots <optional>-</optional> <optional><replaceable>view ...</replaceable></optional></userinput></term>
  	<listitem>
 diff --git a/bin/tests/system/chain/prereq.sh b/bin/tests/system/chain/prereq.sh
-index f3f1939..9ff3f07 100644
+index 23bedcd..43385de 100644
 --- a/bin/tests/system/chain/prereq.sh
 +++ b/bin/tests/system/chain/prereq.sh
 @@ -48,3 +48,10 @@ else
@@ -1052,7 +1052,7 @@ index f3f1939..9ff3f07 100644
 +    exit 1
 +fi
 diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
-index 22749b9..a247fd5 100644
+index f6412f6..26c8901 100644
 --- a/bin/tests/system/conf.sh.in
 +++ b/bin/tests/system/conf.sh.in
 @@ -128,7 +128,7 @@ PARALLELDIRS="dnssec rpzrecurse \
@@ -2039,10 +2039,10 @@ index 0000000..201c996
 +echo "I:exit status: $status"
 +[ $status -eq 0 ] || exit 1
 diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
-index bb1e81d..6dbbfad 100644
+index 99c8680..5fbabfe 100644
 --- a/doc/arm/Bv9ARM-book.xml
 +++ b/doc/arm/Bv9ARM-book.xml
-@@ -4381,6 +4381,9 @@ badresp:1,adberr:0,findfail:0,valfail:0]
+@@ -4336,6 +4336,9 @@ badresp:1,adberr:0,findfail:0,valfail:0]
  	  statement in the <filename>named.conf</filename> file:
  	</para>
  	<xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="options.grammar.xml"/>
@@ -2052,7 +2052,7 @@ index bb1e81d..6dbbfad 100644
        </section>
  
        <section xml:id="options"><info><title><command>options</command> Statement Definition and
-@@ -4474,6 +4477,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
+@@ -4429,6 +4432,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
  		  <command>dnssec-validation</command>,
  		  <command>max-cache-ttl</command>,
  		  <command>max-ncache-ttl</command>,
@@ -2060,7 +2060,7 @@ index bb1e81d..6dbbfad 100644
  		  <command>max-cache-size</command>, and
  		  <command>zero-no-soa-ttl</command>.
  		</para>
-@@ -5485,7 +5489,6 @@ options {
+@@ -5438,7 +5442,6 @@ options {
  	    </listitem>
  	  </varlistentry>
  
@@ -2068,7 +2068,7 @@ index bb1e81d..6dbbfad 100644
  	  <varlistentry>
  	    <term><command>max-zone-ttl</command></term>
  	    <listitem>
-@@ -5521,6 +5524,21 @@ options {
+@@ -5474,6 +5477,21 @@ options {
  	    </listitem>
  	  </varlistentry>
  
@@ -2090,7 +2090,7 @@ index bb1e81d..6dbbfad 100644
  	  <varlistentry>
  	    <term><command>serial-update-method</command></term>
  	    <listitem>
-@@ -6280,6 +6298,22 @@ options {
+@@ -6227,6 +6245,22 @@ options {
  	      </listitem>
  	    </varlistentry>
  
@@ -2113,31 +2113,34 @@ index bb1e81d..6dbbfad 100644
  	    <varlistentry>
  	      <term><command>nocookie-udp-size</command></term>
  	      <listitem>
-@@ -7501,14 +7535,20 @@ options {
+@@ -7449,13 +7483,19 @@ options {
  	      <term><command>resolver-query-timeout</command></term>
  	      <listitem>
  		<para>
--		  The amount of time in seconds that the resolver
-+		  The amount of time in milliseconds that the resolver
- 		  will spend attempting to resolve a recursive
- 		  query before failing.  The default and minimum
+-		  This is the amount of time in seconds that the
+-		  resolver spends attempting to resolve a recursive
+-		  query before failing.  The default and minimum
 -		  is <literal>10</literal> and the maximum is
 -		  <literal>30</literal>.  Setting it to
+-		  <literal>0</literal> results in the default
+-		  being used.
++		  The amount of time in milliseconds that the resolver
++ 		  will spend attempting to resolve a recursive
++ 		  query before failing.  The default and minimum
 +		  is <literal>10000</literal> and the maximum is
 +		  <literal>30000</literal>.  Setting it to
- 		  <literal>0</literal> will result in the default
- 		  being used.
- 		</para>
++ 		  <literal>0</literal> will result in the default
++ 		  being used.
++ 		</para>
 +		<para>
 +		  This value was originally specified in seconds.
 +		  Values less than or equal to 300 will be be treated
 +		  as seconds and converted to milliseconds before
 +		  applying the above limits.
-+		</para>
+ 		</para>
  	      </listitem>
  	    </varlistentry>
- 	  </variablelist>
-@@ -8994,6 +9034,27 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
+@@ -9016,6 +9056,27 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
  	      </listitem>
  	    </varlistentry>
  
@@ -2166,7 +2169,7 @@ index bb1e81d..6dbbfad 100644
  	      <term><command>min-roots</command></term>
  	      <listitem>
 diff --git a/doc/arm/logging-categories.xml b/doc/arm/logging-categories.xml
-index 181def7..59f6afb 100644
+index 56d05e8..098342b 100644
 --- a/doc/arm/logging-categories.xml
 +++ b/doc/arm/logging-categories.xml
 @@ -311,6 +311,17 @@
@@ -2278,7 +2281,7 @@ index e11beed..fde93c7 100644
          topology { <address_match_element>; ... }; // not implemented
          transfer-format ( many-answers | one-answer );
 diff --git a/lib/bind9/check.c b/lib/bind9/check.c
-index eaac5ba..a89d78f 100644
+index bf769fe..6c57fa4 100644
 --- a/lib/bind9/check.c
 +++ b/lib/bind9/check.c
 @@ -99,7 +99,8 @@ check_orderent(const cfg_obj_t *ent, isc_log_t *logctx) {
@@ -2522,7 +2525,7 @@ index eaac5ba..a89d78f 100644
  }
  
 diff --git a/lib/dns/cache.c b/lib/dns/cache.c
-index 4701ff8..97e427a 100644
+index 2965a4f..617737a 100644
 --- a/lib/dns/cache.c
 +++ b/lib/dns/cache.c
 @@ -138,6 +138,7 @@ struct dns_cache {
@@ -2592,7 +2595,7 @@ index 4701ff8..97e427a 100644
   * The cleaner task is shutting down; do the necessary cleanup.
   */
 diff --git a/lib/dns/db.c b/lib/dns/db.c
-index ee3e00d..576aa65 100644
+index a28a566..c581646 100644
 --- a/lib/dns/db.c
 +++ b/lib/dns/db.c
 @@ -1130,3 +1130,25 @@ dns_db_nodefullname(dns_db_t *db, dns_dbnode_t *node, dns_name_t *name) {
@@ -2622,7 +2625,7 @@ index ee3e00d..576aa65 100644
 +	return (ISC_R_NOTIMPLEMENTED);
 +}
 diff --git a/lib/dns/ecdb.c b/lib/dns/ecdb.c
-index 47994ea..23bfe7d 100644
+index fc94ccf..76d0417 100644
 --- a/lib/dns/ecdb.c
 +++ b/lib/dns/ecdb.c
 @@ -588,7 +588,9 @@ static dns_dbmethods_t ecdb_methods = {
@@ -2637,7 +2640,7 @@ index 47994ea..23bfe7d 100644
  
  static isc_result_t
 diff --git a/lib/dns/include/dns/cache.h b/lib/dns/include/dns/cache.h
-index 62797db..714b78e 100644
+index ab4b0b5..e158014 100644
 --- a/lib/dns/include/dns/cache.h
 +++ b/lib/dns/include/dns/cache.h
 @@ -260,6 +260,27 @@ dns_cache_getcachesize(dns_cache_t *cache);
@@ -2669,7 +2672,7 @@ index 62797db..714b78e 100644
  dns_cache_flush(dns_cache_t *cache);
  /*%<
 diff --git a/lib/dns/include/dns/db.h b/lib/dns/include/dns/db.h
-index 6f0eed0..e3917f2 100644
+index 96f3a8f..452770f 100644
 --- a/lib/dns/include/dns/db.h
 +++ b/lib/dns/include/dns/db.h
 @@ -195,6 +195,8 @@ typedef struct dns_dbmethods {
@@ -2729,7 +2732,7 @@ index 6f0eed0..e3917f2 100644
  
  #endif /* DNS_DB_H */
 diff --git a/lib/dns/include/dns/rdataset.h b/lib/dns/include/dns/rdataset.h
-index 5295d8e..97071ed 100644
+index ed9119a..710e97c 100644
 --- a/lib/dns/include/dns/rdataset.h
 +++ b/lib/dns/include/dns/rdataset.h
 @@ -128,6 +128,7 @@ struct dns_rdataset {
@@ -2783,7 +2786,7 @@ index 5295d8e..97071ed 100644
  /*%
   * _OMITDNSSEC:
 diff --git a/lib/dns/include/dns/resolver.h b/lib/dns/include/dns/resolver.h
-index 0b66c75..4b4b6bd 100644
+index 7b3c047..bd7d225 100644
 --- a/lib/dns/include/dns/resolver.h
 +++ b/lib/dns/include/dns/resolver.h
 @@ -547,9 +547,12 @@ dns_resolver_getmustbesecure(dns_resolver_t *resolver, dns_name_t *name);
@@ -2852,12 +2855,12 @@ index 0b66c75..4b4b6bd 100644
  dns_resolver_getoptions(dns_resolver_t *resolver);
  
 diff --git a/lib/dns/include/dns/types.h b/lib/dns/include/dns/types.h
-index 567e8a8..7bf2b60 100644
+index 2468e3c..934a641 100644
 --- a/lib/dns/include/dns/types.h
 +++ b/lib/dns/include/dns/types.h
-@@ -385,6 +385,12 @@ typedef enum {
- 	dns_updatemethod_date
- } dns_updatemethod_t;
+@@ -390,6 +390,12 @@ typedef struct {
+ 	size_t      count;
+ } dns_indent_t;
  
 +typedef enum {
 +	dns_stale_answer_no,
@@ -2869,7 +2872,7 @@ index 567e8a8..7bf2b60 100644
   * Functions.
   */
 diff --git a/lib/dns/include/dns/view.h b/lib/dns/include/dns/view.h
-index c849dec..647ca2a 100644
+index 53f1db1..96148c7 100644
 --- a/lib/dns/include/dns/view.h
 +++ b/lib/dns/include/dns/view.h
 @@ -229,6 +229,9 @@ struct dns_view {
@@ -2883,7 +2886,7 @@ index c849dec..647ca2a 100644
  
  #define DNS_VIEW_MAGIC			ISC_MAGIC('V','i','e','w')
 diff --git a/lib/dns/master.c b/lib/dns/master.c
-index 8edd732..8c9f00e 100644
+index 7d26b81..36999b5 100644
 --- a/lib/dns/master.c
 +++ b/lib/dns/master.c
 @@ -1948,12 +1948,18 @@ load_text(dns_loadctx_t *lctx) {
@@ -2910,7 +2913,7 @@ index 8edd732..8c9f00e 100644
  
  		/*
 diff --git a/lib/dns/masterdump.c b/lib/dns/masterdump.c
-index 13d1a3e..873b694 100644
+index fa839a0..91b3cab 100644
 --- a/lib/dns/masterdump.c
 +++ b/lib/dns/masterdump.c
 @@ -81,6 +81,9 @@ struct dns_master_style {
@@ -2979,10 +2982,10 @@ index 13d1a3e..873b694 100644
  			RUNTIME_CHECK(result == ISC_R_SUCCESS);
  			isc_buffer_usedregion(&buffer, &r);
 diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
-index 02f2c84..fda991d 100644
+index 3a60bcf..8ea4d47 100644
 --- a/lib/dns/rbtdb.c
 +++ b/lib/dns/rbtdb.c
-@@ -490,6 +490,7 @@ typedef ISC_LIST(rdatasetheader_t)      rdatasetheaderlist_t;
+@@ -511,6 +511,7 @@ typedef ISC_LIST(rdatasetheader_t)      rdatasetheaderlist_t;
  typedef ISC_LIST(dns_rbtnode_t)         rbtnodelist_t;
  
  #define RDATASET_ATTR_NONEXISTENT       0x0001
@@ -2990,7 +2993,7 @@ index 02f2c84..fda991d 100644
  #define RDATASET_ATTR_STALE             0x0002
  #define RDATASET_ATTR_IGNORE            0x0004
  #define RDATASET_ATTR_RETAIN            0x0008
-@@ -502,6 +503,8 @@ typedef ISC_LIST(dns_rbtnode_t)         rbtnodelist_t;
+@@ -523,6 +524,8 @@ typedef ISC_LIST(dns_rbtnode_t)         rbtnodelist_t;
  #define RDATASET_ATTR_CASESET           0x0400
  #define RDATASET_ATTR_ZEROTTL           0x0800
  #define RDATASET_ATTR_CASEFULLYLOWER    0x1000
@@ -2999,7 +3002,7 @@ index 02f2c84..fda991d 100644
  
  typedef struct acache_cbarg {
  	dns_rdatasetadditional_t        type;
-@@ -552,6 +555,8 @@ struct acachectl {
+@@ -573,6 +576,8 @@ struct acachectl {
  	(((header)->attributes & RDATASET_ATTR_ZEROTTL) != 0)
  #define CASEFULLYLOWER(header) \
  	(((header)->attributes & RDATASET_ATTR_CASEFULLYLOWER) != 0)
@@ -3008,7 +3011,7 @@ index 02f2c84..fda991d 100644
  
  
  #define ACTIVE(header, now) \
-@@ -611,6 +616,12 @@ typedef enum {
+@@ -632,6 +637,12 @@ typedef enum {
  	expire_flush
  } expire_t;
  
@@ -3021,7 +3024,7 @@ index 02f2c84..fda991d 100644
  typedef struct rbtdb_version {
  	/* Not locked */
  	rbtdb_serial_t                  serial;
-@@ -678,6 +689,12 @@ struct dns_rbtdb {
+@@ -699,6 +710,12 @@ struct dns_rbtdb {
  	dns_dbnode_t                    *soanode;
  	dns_dbnode_t                    *nsnode;
  
@@ -3034,7 +3037,7 @@ index 02f2c84..fda991d 100644
  	/*
  	 * This is a linked list used to implement the LRU cache.  There will
  	 * be node_lock_count linked lists here.  Nodes in bucket 1 will be
-@@ -721,6 +738,8 @@ struct dns_rbtdb {
+@@ -742,6 +759,8 @@ struct dns_rbtdb {
  #define RBTDB_ATTR_LOADED               0x01
  #define RBTDB_ATTR_LOADING              0x02
  
@@ -3043,7 +3046,7 @@ index 02f2c84..fda991d 100644
  /*%
   * Search Context
   */
-@@ -1791,15 +1810,15 @@ rollback_node(dns_rbtnode_t *node, rbtdb_serial_t serial) {
+@@ -1816,15 +1835,15 @@ rollback_node(dns_rbtnode_t *node, rbtdb_serial_t serial) {
  }
  
  static inline void
@@ -3063,7 +3066,7 @@ index 02f2c84..fda991d 100644
  	header->node->dirty = 1;
  
  	/*
-@@ -1840,8 +1859,8 @@ clean_cache_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node) {
+@@ -1865,8 +1884,8 @@ clean_cache_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node) {
  		/*
  		 * If current is nonexistent or stale, we can clean it up.
  		 */
@@ -3074,7 +3077,7 @@ index 02f2c84..fda991d 100644
  			if (top_prev != NULL)
  				top_prev->next = current->next;
  			else
-@@ -2086,6 +2105,80 @@ delete_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node) {
+@@ -2111,6 +2130,80 @@ delete_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node) {
  	}
  }
  
@@ -3155,7 +3158,7 @@ index 02f2c84..fda991d 100644
  /*
   * Caller must be holding the node lock.
   */
-@@ -3313,6 +3406,12 @@ bind_rdataset(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
+@@ -3343,6 +3436,12 @@ bind_rdataset(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node, rdatasetheader_t *header,
  		rdataset->attributes |= DNS_RDATASETATTR_OPTOUT;
  	if (PREFETCH(header))
  		rdataset->attributes |= DNS_RDATASETATTR_PREFETCH;
@@ -3168,7 +3171,7 @@ index 02f2c84..fda991d 100644
  	rdataset->private1 = rbtdb;
  	rdataset->private2 = node;
  	raw = (unsigned char *)header + sizeof(*header);
-@@ -4653,6 +4752,19 @@ check_stale_header(dns_rbtnode_t *node, rdatasetheader_t *header,
+@@ -4698,6 +4797,19 @@ check_stale_header(dns_rbtnode_t *node, rdatasetheader_t *header,
  #endif
  
  	if (!ACTIVE(header, search->now)) {
@@ -3188,7 +3191,7 @@ index 02f2c84..fda991d 100644
  		/*
  		 * This rdataset is stale.  If no one else is using the
  		 * node, we can clean it up right now, otherwise we mark
-@@ -4692,7 +4804,7 @@ check_stale_header(dns_rbtnode_t *node, rdatasetheader_t *header,
+@@ -4737,7 +4849,7 @@ check_stale_header(dns_rbtnode_t *node, rdatasetheader_t *header,
  					node->data = header->next;
  				free_rdataset(search->rbtdb, mctx, header);
  			} else {
@@ -3197,7 +3200,7 @@ index 02f2c84..fda991d 100644
  				*header_prev = header;
  			}
  		} else
-@@ -5130,7 +5242,7 @@ cache_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
+@@ -5178,7 +5290,7 @@ cache_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
  				       &locktype, lock, &search,
  				       &header_prev)) {
  			/* Do nothing. */
@@ -3206,7 +3209,7 @@ index 02f2c84..fda991d 100644
  			/*
  			 * We now know that there is at least one active
  			 * non-stale rdataset at this node.
-@@ -5608,7 +5720,7 @@ expirenode(dns_db_t *db, dns_dbnode_t *node, isc_stdtime_t now) {
+@@ -5661,7 +5773,7 @@ expirenode(dns_db_t *db, dns_dbnode_t *node, isc_stdtime_t now) {
  			 * refcurrent(rbtnode) must be non-zero.  This is so
  			 * because 'node' is an argument to the function.
  			 */
@@ -3215,7 +3218,7 @@ index 02f2c84..fda991d 100644
  			if (log)
  				isc_log_write(dns_lctx, category, module,
  					      level, "overmem cache: stale %s",
-@@ -5616,7 +5728,7 @@ expirenode(dns_db_t *db, dns_dbnode_t *node, isc_stdtime_t now) {
+@@ -5669,7 +5781,7 @@ expirenode(dns_db_t *db, dns_dbnode_t *node, isc_stdtime_t now) {
  		} else if (force_expire) {
  			if (! RETAIN(header)) {
  				set_ttl(rbtdb, header, 0);
@@ -3224,7 +3227,7 @@ index 02f2c84..fda991d 100644
  			} else if (log) {
  				isc_log_write(dns_lctx, category, module,
  					      level, "overmem cache: "
-@@ -5873,9 +5985,9 @@ cache_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
+@@ -5928,9 +6040,9 @@ cache_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
  				 * non-zero.  This is so because 'node' is an
  				 * argument to the function.
  				 */
@@ -3236,7 +3239,7 @@ index 02f2c84..fda991d 100644
  			if (header->type == matchtype)
  				found = header;
  			else if (header->type == RBTDB_RDATATYPE_NCACHEANY ||
-@@ -6167,7 +6279,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+@@ -6232,7 +6344,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
  				     topheader = topheader->next)
  				{
  					set_ttl(rbtdb, topheader, 0);
@@ -3245,7 +3248,7 @@ index 02f2c84..fda991d 100644
  				}
  				goto find_header;
  			}
-@@ -6225,7 +6337,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+@@ -6293,7 +6405,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
  				 * ncache entry.
  				 */
  				set_ttl(rbtdb, topheader, 0);
@@ -3254,7 +3257,7 @@ index 02f2c84..fda991d 100644
  				topheader = NULL;
  				goto find_header;
  			}
-@@ -6263,8 +6375,11 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+@@ -6331,8 +6443,11 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
  		}
  
  		/*
@@ -3268,7 +3271,7 @@ index 02f2c84..fda991d 100644
  		 */
  		if (rbtversion == NULL && trust < header->trust &&
  		    (ACTIVE(header, now) || header_nx)) {
-@@ -6293,6 +6408,10 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+@@ -6362,6 +6477,10 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
  
  			if ((options & DNS_DBADD_EXACT) != 0)
  				flags |= DNS_RDATASLAB_EXACT;
@@ -3279,7 +3282,7 @@ index 02f2c84..fda991d 100644
  			if ((options & DNS_DBADD_EXACTTTL) != 0 &&
  			     newheader->rdh_ttl != header->rdh_ttl)
  					result = DNS_R_NOTEXACT;
-@@ -6336,11 +6455,12 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+@@ -6405,11 +6524,12 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
  			}
  		}
  		/*
@@ -3297,7 +3300,7 @@ index 02f2c84..fda991d 100644
  		 */
  		if (IS_CACHE(rbtdb) && ACTIVE(header, now) &&
  		    header->type == dns_rdatatype_ns &&
-@@ -6511,10 +6631,10 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+@@ -6582,10 +6702,10 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
  				changed->dirty = true;
  			if (rbtversion == NULL) {
  				set_ttl(rbtdb, header, 0);
@@ -3310,7 +3313,7 @@ index 02f2c84..fda991d 100644
  				}
  			}
  			if (rbtversion != NULL && !header_nx) {
-@@ -8331,6 +8451,30 @@ nodefullname(dns_db_t *db, dns_dbnode_t *node, dns_name_t *name) {
+@@ -8436,6 +8556,30 @@ nodefullname(dns_db_t *db, dns_dbnode_t *node, dns_name_t *name) {
  	return (result);
  }
  
@@ -3341,7 +3344,7 @@ index 02f2c84..fda991d 100644
  static dns_dbmethods_t zone_methods = {
  	attach,
  	detach,
-@@ -8376,7 +8520,9 @@ static dns_dbmethods_t zone_methods = {
+@@ -8481,7 +8625,9 @@ static dns_dbmethods_t zone_methods = {
  	NULL,
  	hashsize,
  	nodefullname,
@@ -3352,7 +3355,7 @@ index 02f2c84..fda991d 100644
  };
  
  static dns_dbmethods_t cache_methods = {
-@@ -8424,7 +8570,9 @@ static dns_dbmethods_t cache_methods = {
+@@ -8529,7 +8675,9 @@ static dns_dbmethods_t cache_methods = {
  	setcachestats,
  	hashsize,
  	nodefullname,
@@ -3363,7 +3366,7 @@ index 02f2c84..fda991d 100644
  };
  
  isc_result_t
-@@ -8695,7 +8843,7 @@ dns_rbtdb_create
+@@ -8800,7 +8948,7 @@ dns_rbtdb_create
  	rbtdb->rpzs = NULL;
  	rbtdb->load_rpzs = NULL;
  	rbtdb->rpz_num = DNS_RPZ_INVALID_NUM;
@@ -3372,7 +3375,7 @@ index 02f2c84..fda991d 100644
  	/*
  	 * Version Initialization.
  	 */
-@@ -9113,7 +9261,8 @@ rdatasetiter_first(dns_rdatasetiter_t *iterator) {
+@@ -9218,7 +9366,8 @@ rdatasetiter_first(dns_rdatasetiter_t *iterator) {
  				 * rdatasets to work.
  				 */
  				if (NONEXISTENT(header) ||
@@ -3382,7 +3385,7 @@ index 02f2c84..fda991d 100644
  					header = NULL;
  				break;
  			} else
-@@ -10322,7 +10471,7 @@ static inline bool
+@@ -10427,7 +10576,7 @@ static inline bool
  need_headerupdate(rdatasetheader_t *header, isc_stdtime_t now) {
  	if ((header->attributes &
  	     (RDATASET_ATTR_NONEXISTENT |
@@ -3391,7 +3394,7 @@ index 02f2c84..fda991d 100644
  	      RDATASET_ATTR_ZEROTTL)) != 0)
  		return (false);
  
-@@ -10428,7 +10577,7 @@ expire_header(dns_rbtdb_t *rbtdb, rdatasetheader_t *header,
+@@ -10533,7 +10682,7 @@ expire_header(dns_rbtdb_t *rbtdb, rdatasetheader_t *header,
  	      bool tree_locked, expire_t reason)
  {
  	set_ttl(rbtdb, header, 0);
@@ -3401,7 +3404,7 @@ index 02f2c84..fda991d 100644
  	/*
  	 * Caller must hold the node (write) lock.
 diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
-index 337a2f3..24e14d2 100644
+index 49ec49c..2de70a6 100644
 --- a/lib/dns/resolver.c
 +++ b/lib/dns/resolver.c
 @@ -141,16 +141,17 @@
@@ -3434,7 +3437,7 @@ index 337a2f3..24e14d2 100644
  #endif
  
  /* The default maximum number of recursions to follow before giving up. */
-@@ -515,6 +516,11 @@ struct dns_resolver {
+@@ -529,6 +530,11 @@ struct dns_resolver {
  	dns_fetch_t *			primefetch;
  	/* Locked by nlock. */
  	unsigned int			nfctx;
@@ -3446,7 +3449,7 @@ index 337a2f3..24e14d2 100644
  };
  
  #define RES_MAGIC			ISC_MAGIC('R', 'e', 's', '!')
-@@ -1625,14 +1631,12 @@ fctx_setretryinterval(fetchctx_t *fctx, unsigned int rtt) {
+@@ -1650,14 +1656,12 @@ fctx_setretryinterval(fetchctx_t *fctx, unsigned int rtt) {
  	unsigned int seconds;
  	unsigned int us;
  
@@ -3465,7 +3468,7 @@ index 337a2f3..24e14d2 100644
  
  	/*
  	 * Add a fudge factor to the expected rtt based on the current
-@@ -4494,7 +4498,8 @@ fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type,
+@@ -4542,7 +4546,8 @@ fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type,
  	/*
  	 * Compute an expiration time for the entire fetch.
  	 */
@@ -3475,7 +3478,7 @@ index 337a2f3..24e14d2 100644
  	iresult = isc_time_nowplusinterval(&fctx->expires, &interval);
  	if (iresult != ISC_R_SUCCESS) {
  		UNEXPECTED_ERROR(__FILE__, __LINE__,
-@@ -8983,6 +8988,8 @@ dns_resolver_create(dns_view_t *view,
+@@ -9105,6 +9110,8 @@ dns_resolver_create(dns_view_t *view,
  	res->spillattimer = NULL;
  	res->zspill = 0;
  	res->zero_no_soa_ttl = false;
@@ -3484,7 +3487,7 @@ index 337a2f3..24e14d2 100644
  	res->query_timeout = DEFAULT_QUERY_TIMEOUT;
  	res->maxdepth = DEFAULT_RECURSION_DEPTH;
  	res->maxqueries = DEFAULT_MAX_QUERIES;
-@@ -10317,17 +10324,20 @@ dns_resolver_gettimeout(dns_resolver_t *resolver) {
+@@ -10439,17 +10446,20 @@ dns_resolver_gettimeout(dns_resolver_t *resolver) {
  }
  
  void
@@ -3513,7 +3516,7 @@ index 337a2f3..24e14d2 100644
  }
  
  void
-@@ -10424,3 +10434,34 @@ dns_resolver_getquotaresponse(dns_resolver_t *resolver, dns_quotatype_t which)
+@@ -10546,3 +10556,34 @@ dns_resolver_getquotaresponse(dns_resolver_t *resolver, dns_quotatype_t which)
  
  	return (resolver->quotaresp[which]);
  }
@@ -3549,10 +3552,10 @@ index 337a2f3..24e14d2 100644
 +	resolver->nonbackofftries = tries;
 +}
 diff --git a/lib/dns/sdb.c b/lib/dns/sdb.c
-index d4c8c67..ee9be79 100644
+index 477bb74..09cf932 100644
 --- a/lib/dns/sdb.c
 +++ b/lib/dns/sdb.c
-@@ -1368,7 +1368,9 @@ static dns_dbmethods_t sdb_methods = {
+@@ -1370,7 +1370,9 @@ static dns_dbmethods_t sdb_methods = {
  	NULL,			/* setcachestats */
  	NULL,			/* hashsize */
  	NULL,			/* nodefullname */
@@ -3564,7 +3567,7 @@ index d4c8c67..ee9be79 100644
  
  static isc_result_t
 diff --git a/lib/dns/sdlz.c b/lib/dns/sdlz.c
-index 0b9620c..331992e 100644
+index 037d74a..9218fed 100644
 --- a/lib/dns/sdlz.c
 +++ b/lib/dns/sdlz.c
 @@ -1336,7 +1336,9 @@ static dns_dbmethods_t sdlzdb_methods = {
@@ -3579,7 +3582,7 @@ index 0b9620c..331992e 100644
  
  /*
 diff --git a/lib/dns/tests/db_test.c b/lib/dns/tests/db_test.c
-index 2849775..812f750 100644
+index bc1cc3f..60fdb81 100644
 --- a/lib/dns/tests/db_test.c
 +++ b/lib/dns/tests/db_test.c
 @@ -28,8 +28,9 @@
@@ -3810,7 +3813,7 @@ index 2849775..812f750 100644
  						_setup, _teardown),
  		cmocka_unit_test_setup_teardown(dbtype_test,
 diff --git a/lib/dns/view.c b/lib/dns/view.c
-index 0fca1d9..55ede81 100644
+index a7ba613..a644c5f 100644
 --- a/lib/dns/view.c
 +++ b/lib/dns/view.c
 @@ -229,6 +229,9 @@ dns_view_create(isc_mem_t *mctx, dns_rdataclass_t rdclass,
@@ -3824,7 +3827,7 @@ index 0fca1d9..55ede81 100644
  	view->maxbits = 0;
  	view->v4_aaaa = dns_aaaa_ok;
 diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
-index 91693b5..5771774 100644
+index 212194e..b562f95 100644
 --- a/lib/isccfg/namedconf.c
 +++ b/lib/isccfg/namedconf.c
 @@ -1778,6 +1778,7 @@ view_clauses[] = {
@@ -3855,5 +3858,5 @@ index 91693b5..5771774 100644
  	{ "topology", &cfg_type_bracketed_aml, CFG_CLAUSEFLAG_NOTIMP },
  	{ "transfer-format", &cfg_type_transferformat, 0 },
 -- 
-2.21.1
+2.26.2
 

SOURCES/bind-9.11-stale-cache.patch

@@ -0,0 +1,65 @@
+From 8a7bff93037432fcfe8532752e89f150ea3030a4 Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Mon, 9 Oct 2023 19:00:12 +0200
+Subject: [PATCH] Do not keep stale records by default
+
+By default set max-stale-ttl to 0, unless stale-answer-enable yes. This
+were enabled by mistake when backporting fix for CVE-2023-2828. It
+causes increased cache usage on servers not wanting to serve stale
+records. Fix that by setting smart defaults based on stale answers
+enabled with possible manual tuning.
+---
+ bin/named/server.c | 25 +++++++++++++++++++------
+ 1 file changed, 19 insertions(+), 6 deletions(-)
+
+diff --git a/bin/named/server.c b/bin/named/server.c
+index 7af90d0..afdc4fa 100644
+--- a/bin/named/server.c
++++ b/bin/named/server.c
+@@ -3295,7 +3295,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
+ 	size_t max_acache_size;
+ 	size_t max_adb_size;
+ 	uint32_t lame_ttl, fail_ttl;
+-	uint32_t max_stale_ttl;
++	uint32_t max_stale_ttl = 0;
+ 	dns_tsig_keyring_t *ring = NULL;
+ 	dns_view_t *pview = NULL;	/* Production view */
+ 	isc_mem_t *cmctx = NULL, *hmctx = NULL;
+@@ -3739,16 +3739,29 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
+ 	if (view->maxncachettl > 7 * 24 * 3600)
+ 		view->maxncachettl = 7 * 24 * 3600;
+ 
+-	obj = NULL;
+-	result = ns_config_get(maps, "max-stale-ttl", &obj);
+-	INSIST(result == ISC_R_SUCCESS);
+-	max_stale_ttl = cfg_obj_asuint32(obj);
+-
+ 	obj = NULL;
+ 	result = ns_config_get(maps, "stale-answer-enable", &obj);
+ 	INSIST(result == ISC_R_SUCCESS);
+ 	view->staleanswersenable = cfg_obj_asboolean(obj);
+ 
++	// RHEL-11785 -- set the stale-ttl to non-zero value only if enabled
++	obj = NULL;
++	if (view->staleanswersenable) {
++		result = ns_config_get(maps, "max-stale-ttl", &obj);
++		INSIST(result == ISC_R_SUCCESS);
++		max_stale_ttl = cfg_obj_asuint32(obj);
++		/*
++		 * If 'stale-answer-enable' is false, max_stale_ttl is set
++		 * to 0, meaning keeping stale RRsets in cache is disabled.
++		 */
++	} else {
++		/* Do not use default value if stale is disabled,
++		 * but allow manual overriding, like 'stale-cache-enable' */
++		result = ns_config_get(optionmaps, "max-stale-ttl", &obj);
++		if (result == ISC_R_SUCCESS)
++			max_stale_ttl = cfg_obj_asuint32(obj);
++	}
++
+ 	result = dns_viewlist_find(&ns_g_server->viewlist, view->name,
+ 				   view->rdclass, &pview);
+ 	if (result == ISC_R_SUCCESS) {
+-- 
+2.41.0
+

SOURCES/bind-9.15-resolver-ntasks.patch

@@ -0,0 +1,58 @@
+From 6d6acf236841da5c2511f8afcd3e4a89af4c5658 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Witold=20Kr=C4=99cicki?= <wpk@isc.org>
+Date: Fri, 14 Feb 2020 09:18:48 +0100
+Subject: [PATCH] Use RESOLVER_NTASKS_PERCPU - 32 for regular tuning, 8 for
+ small
+
+Modify original upstream commit 0d80266f7e3, add high limit of used
+tasks. Minimum would be lower on machines with few cpus, but maximum
+would stay unchanged. Should prevent negatives of this change.
+
+Signed-off-by: Petr Mensik <pemensik@redhat.com>
+---
+ bin/named/server.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/bin/named/server.c b/bin/named/server.c
+index 39b1124..94b4daa 100644
+--- a/bin/named/server.c
++++ b/bin/named/server.c
+@@ -148,11 +148,13 @@
+ #endif
+ 
+ #ifdef TUNE_LARGE
+-#define RESOLVER_NTASKS 523
++#define RESOLVER_NTASKS_MAX 523
++#define RESOLVER_NTASKS_PERCPU 32
+ #define UDPBUFFERS 32768
+ #define EXCLBUFFERS 32768
+ #else
+-#define RESOLVER_NTASKS 31
++#define RESOLVER_NTASKS_MAX 31
++#define RESOLVER_NTASKS_PERCPU 8
+ #define UDPBUFFERS 1000
+ #define EXCLBUFFERS 4096
+ #endif /* TUNE_LARGE */
+@@ -3318,7 +3320,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
+ 	ns_cache_t *nsc;
+ 	bool zero_no_soattl;
+ 	dns_acl_t *clients = NULL, *mapped = NULL, *excluded = NULL;
+-	unsigned int query_timeout, ndisp;
++	unsigned int query_timeout, ndisp, ntasks;
+ 	bool old_rpz_ok = false;
+ 	isc_dscp_t dscp4 = -1, dscp6 = -1;
+ 	dns_dyndbctx_t *dctx = NULL;
+@@ -3926,7 +3928,9 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
+ 	dns_view_setresquerystats(view, resquerystats);
+ 
+ 	ndisp = 4 * ISC_MIN(ns_g_udpdisp, MAX_UDP_DISPATCH);
+-	CHECK(dns_view_createresolver(view, ns_g_taskmgr, RESOLVER_NTASKS,
++	ntasks = ISC_MIN(RESOLVER_NTASKS_PERCPU * ns_g_cpus,
++		         RESOLVER_NTASKS_MAX);
++	CHECK(dns_view_createresolver(view, ns_g_taskmgr, ntasks,
+ 				      ndisp, ns_g_socketmgr, ns_g_timermgr,
+ 				      resopts, ns_g_dispatchmgr,
+ 				      dispatch4, dispatch6));
+-- 
+2.34.1
+

SOURCES/bind-9.16-CVE-2022-3094-1.patch

@@ -0,0 +1,240 @@
+From 128b3b676eb9413b4d25fb29c560895cfbbfa92e Mon Sep 17 00:00:00 2001
+From: Evan Hunt <each@isc.org>
+Date: Thu, 1 Sep 2022 16:05:04 -0700
+Subject: [PATCH] add an update quota
+
+limit the number of simultaneous DNS UPDATE events that can be
+processed by adding a quota for update and update forwarding.
+this quota currently, arbitrarily, defaults to 100.
+
+also add a statistics counter to record when the update quota
+has been exceeded.
+
+(cherry picked from commit 7c47254a140c3e9cf383cda73c7b6a55c4782826)
+---
+ bin/named/bind9.xsl              |  2 +-
+ bin/named/bind9.xsl.h            |  8 +++++++-
+ bin/named/include/named/server.h |  7 ++++++-
+ bin/named/server.c               |  3 +++
+ bin/named/statschannel.c         |  5 +++--
+ bin/named/update.c               | 34 +++++++++++++++++++++++++++++++-
+ doc/arm/Bv9ARM-book.xml          | 15 ++++++++++++++
+ 7 files changed, 68 insertions(+), 6 deletions(-)
+
+diff --git a/bin/named/bind9.xsl b/bin/named/bind9.xsl
+index 9a1c6ff..85fd4c4 100644
+--- a/bin/named/bind9.xsl
++++ b/bin/named/bind9.xsl
+@@ -12,7 +12,7 @@
+ 
+ <xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns="http://www.w3.org/1999/xhtml" version="1.0">
+   <xsl:output method="html" indent="yes" version="4.0"/>
+-  <xsl:template match="statistics[@version=&quot;3.8&quot;]">
++  <xsl:template match="statistics[@version=&quot;3.8.1&quot;]">
+     <html>
+       <head>
+         <script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js"></script>
+diff --git a/bin/named/bind9.xsl.h b/bin/named/bind9.xsl.h
+index 9ce8cd7..5e0a892 100644
+--- a/bin/named/bind9.xsl.h
++++ b/bin/named/bind9.xsl.h
+@@ -17,7 +17,13 @@ static char xslmsg[] =
+ 	"\n"
+ 	"<xsl:stylesheet xmlns:xsl=\"http://www.w3.org/1999/XSL/Transform\" xmlns=\"http://www.w3.org/1999/xhtml\" version=\"1.0\">\n"
+ 	" <xsl:output method=\"html\" indent=\"yes\" version=\"4.0\"/>\n"
+-	" <xsl:template match=\"statistics[@version=&quot;3.8&quot;]\">\n"
++#if 0
++	" <!-- the version number **below** must match version in "
++	"bin/named/statschannel.c -->\n"
++	" <!-- don't forget to update \"/xml/v<STATS_XML_VERSION_MAJOR>\" in "
++	"the HTTP endpoints listed below -->\n"
++#endif
++	" <xsl:template match=\"statistics[@version=&quot;3.8.1&quot;]\">\n"
+ 	" <html>\n"
+ 	" <head>\n"
+ 	" <script type=\"text/javascript\" src=\"https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js\"></script>\n"
+diff --git a/bin/named/include/named/server.h b/bin/named/include/named/server.h
+index 08a02dc..259acc7 100644
+--- a/bin/named/include/named/server.h
++++ b/bin/named/include/named/server.h
+@@ -137,6 +137,9 @@ struct ns_server {
+ 
+ 	uint16_t		transfer_tcp_message_size;
+ 	isc_rng_t *		rngctx;
++
++/* CVE-2022-3094 */
++	isc_quota_t		updquota;
+ };
+ 
+ struct ns_altsecret {
+@@ -230,7 +233,9 @@ enum {
+ 	dns_nsstatscounter_trystale = 59,
+ 	dns_nsstatscounter_usedstale = 60,
+ 
+-	dns_nsstatscounter_max = 61
++	dns_nsstatscounter_updatequota = 61,
++
++	dns_nsstatscounter_max = 62
+ };
+ 
+ /*%
+diff --git a/bin/named/server.c b/bin/named/server.c
+index 2d2fa0e..f09b895 100644
+--- a/bin/named/server.c
++++ b/bin/named/server.c
+@@ -9143,6 +9143,8 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
+ 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
+ 	result = isc_quota_init(&server->recursionquota, 100);
+ 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
++	result = isc_quota_init(&server->updquota, 100);
++	RUNTIME_CHECK(result == ISC_R_SUCCESS);
+ 
+ 	result = dns_aclenv_init(mctx, &server->aclenv);
+ 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
+@@ -9410,6 +9412,7 @@ ns_server_destroy(ns_server_t **serverp) {
+ 
+ 	dns_aclenv_destroy(&server->aclenv);
+ 
++	isc_quota_destroy(&server->updquota);
+ 	isc_quota_destroy(&server->recursionquota);
+ 	isc_quota_destroy(&server->tcpquota);
+ 	isc_quota_destroy(&server->xfroutquota);
+diff --git a/bin/named/statschannel.c b/bin/named/statschannel.c
+index 56a9c21..1e8723c 100644
+--- a/bin/named/statschannel.c
++++ b/bin/named/statschannel.c
+@@ -300,6 +300,7 @@ init_desc(void) {
+ 	SET_NSSTATDESC(reclimitdropped,
+ 		       "queries dropped due to recursive client limit",
+ 		       "RecLimitDropped");
++	SET_NSSTATDESC(updatequota, "Update quota exceeded", "UpdateQuota");
+ 	SET_NSSTATDESC(trystale,
+ 		       "attempts to use stale cache data after lookup failure",
+ 		       "QryTryStale");
+@@ -1546,7 +1547,7 @@ generatexml(ns_server_t *server, uint32_t flags,
+ 			ISC_XMLCHAR "type=\"text/xsl\" href=\"/bind9.xsl\""));
+ 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "statistics"));
+ 	TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "version",
+-					 ISC_XMLCHAR "3.8"));
++					 ISC_XMLCHAR "3.8.1"));
+ 
+ 	/* Set common fields for statistics dump */
+ 	dumparg.type = isc_statsformat_xml;
+@@ -2303,7 +2304,7 @@ generatejson(ns_server_t *server, size_t *msglen,
+ 	/*
+ 	 * These statistics are included no matter which URL we use.
+ 	 */
+-	obj = json_object_new_string("1.2");
++	obj = json_object_new_string("1.2.1");
+ 	CHECKMEM(obj);
+ 	json_object_object_add(bindstats, "json-stats-version", obj);
+ 
+diff --git a/bin/named/update.c b/bin/named/update.c
+index 6ad7d27..dccc543 100644
+--- a/bin/named/update.c
++++ b/bin/named/update.c
+@@ -1526,6 +1526,17 @@ send_update_event(ns_client_t *client, dns_zone_t *zone) {
+ 	isc_task_t *zonetask = NULL;
+ 	ns_client_t *evclient;
+ 
++	result = isc_quota_attach(&ns_g_server->updquota,
++				  &(isc_quota_t *){ NULL });
++	if (result != ISC_R_SUCCESS) {
++		update_log(client, zone, LOGLEVEL_PROTOCOL,
++			   "update failed: too many DNS UPDATEs queued (%s)",
++			   isc_result_totext(result));
++		isc_stats_increment(ns_g_server->nsstats,
++				    dns_nsstatscounter_updatequota);
++		CHECK(DNS_R_DROP);
++	}
++
+ 	event = (update_event_t *)
+ 		isc_event_allocate(client->mctx, client, DNS_EVENT_UPDATE,
+ 				   update_action, NULL, sizeof(*event));
+@@ -1652,7 +1663,12 @@ ns_update_start(ns_client_t *client, isc_result_t sigresult) {
+ 	 * We are still in the client task context, so we can
+ 	 * simply give an error response without switching tasks.
+ 	 */
+-	respond(client, result);
++	if (result == DNS_R_DROP) {
++		ns_client_next(client, result);
++	} else {
++		respond(client, result);
++	}
++
+ 	if (zone != NULL)
+ 		dns_zone_detach(&zone);
+ }
+@@ -3385,6 +3401,7 @@ updatedone_action(isc_task_t *task, isc_event_t *event) {
+ 		dns_zone_detach(&uev->zone);
+ 	client->nupdates--;
+ 	respond(client, uev->result);
++	isc_quota_detach(&(isc_quota_t *){ &ns_g_server->updquota });
+ 	isc_event_free(&event);
+ 	ns_client_detach(&client);
+ }
+@@ -3402,6 +3419,8 @@ forward_fail(isc_task_t *task, isc_event_t *event) {
+ 	INSIST(client->nupdates > 0);
+ 	client->nupdates--;
+ 	respond(client, DNS_R_SERVFAIL);
++
++	isc_quota_detach(&(isc_quota_t *){ &ns_g_server->updquota });
+ 	isc_event_free(&event);
+ 	ns_client_detach(&client);
+ }
+@@ -3439,6 +3458,8 @@ forward_done(isc_task_t *task, isc_event_t *event) {
+ 	client->nupdates--;
+ 	ns_client_sendraw(client, uev->answer);
+ 	dns_message_detach(&uev->answer);
++
++	isc_quota_detach(&(isc_quota_t *){ &ns_g_server->updquota });
+ 	isc_event_free(&event);
+ 	ns_client_detach(&client);
+ }
+@@ -3472,6 +3493,17 @@ send_forward_event(ns_client_t *client, dns_zone_t *zone) {
+ 	isc_task_t *zonetask = NULL;
+ 	ns_client_t *evclient;
+ 
++	result = isc_quota_attach(&ns_g_server->updquota,
++				  &(isc_quota_t *){ NULL });
++	if (result != ISC_R_SUCCESS) {
++		update_log(client, zone, LOGLEVEL_PROTOCOL,
++			   "update failed: too many DNS UPDATEs queued (%s)",
++			   isc_result_totext(result));
++		isc_stats_increment(ns_g_server->nsstats,
++				    dns_nsstatscounter_updatequota);
++		return (DNS_R_DROP);
++	}
++
+ 	/*
+ 	 * This may take some time so replace this client.
+ 	 */
+diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
+index c17f168..9aca6d7 100644
+--- a/doc/arm/Bv9ARM-book.xml
++++ b/doc/arm/Bv9ARM-book.xml
+@@ -15105,6 +15105,21 @@ HOST-127.EXAMPLE. MX 0 .
+ 		      </para>
+ 		    </entry>
+ 		  </row>
++		  <row rowsep="0">
++		    <entry colname="1">
++		      <para><command>UpdateQuota</command></para>
++		    </entry>
++		    <entry colname="2">
++		      <para><command/></para>
++		    </entry>
++		    <entry colname="3">
++		      <para>
++			This indicates the number of times a dynamic update or update
++			forwarding request was rejected because the number of pending
++			requests exceeded the update quota.
++		      </para>
++		    </entry>
++		  </row>
+ 		  <row rowsep="0">
+ 		    <entry colname="1">
+ 		      <para><command>RateDropped</command></para>
+-- 
+2.39.2
+

SOURCES/bind-9.16-CVE-2022-3094-2.patch

@@ -0,0 +1,136 @@
+From d9a03233c6ea11f20c2fbeca87b763673859f8b2 Mon Sep 17 00:00:00 2001
+From: Evan Hunt <each@isc.org>
+Date: Thu, 1 Sep 2022 16:22:46 -0700
+Subject: [PATCH] add a configuration option for the update quota
+
+add an "update-quota" option to configure the update quota.
+
+(cherry picked from commit f57758a7303ad0034ff2ff08eaaf2ef899630f19)
+---
+ bin/named/config.c                   |  1 +
+ bin/named/named.conf.docbook         |  2 ++
+ bin/named/server.c                   |  1 +
+ bin/tests/system/checkconf/good.conf |  1 +
+ doc/arm/Bv9ARM-book.xml              | 11 +++++++++++
+ doc/arm/options.grammar.xml          |  1 +
+ doc/misc/options                     |  1 +
+ lib/isccfg/namedconf.c               |  1 +
+ 8 files changed, 19 insertions(+)
+
+diff --git a/bin/named/config.c b/bin/named/config.c
+index 62d1e88..e3731cf 100644
+--- a/bin/named/config.c
++++ b/bin/named/config.c
+@@ -134,6 +134,7 @@ options {\n\
+ 	transfers-per-ns 2;\n\
+ #	treat-cr-as-space <obsolete>;\n\
+ 	trust-anchor-telemetry yes;\n\
++	update-quota 100;\n\
+ #	use-id-pool <obsolete>;\n\
+ #	use-ixfr <obsolete>;\n\
+ \n\
+diff --git a/bin/named/named.conf.docbook b/bin/named/named.conf.docbook
+index 6565fce..5842cb5 100644
+--- a/bin/named/named.conf.docbook
++++ b/bin/named/named.conf.docbook
+@@ -455,6 +455,7 @@ options {
+ 	trust-anchor-telemetry <replaceable>boolean</replaceable>; // experimental
+ 	try-tcp-refresh <replaceable>boolean</replaceable>;
+ 	update-check-ksk <replaceable>boolean</replaceable>;
++	update-quota <replaceable>integer</replaceable>;
+ 	use-alt-transfer-source <replaceable>boolean</replaceable>;
+ 	use-v4-udp-ports { <replaceable>portrange</replaceable>; ... };
+ 	use-v6-udp-ports { <replaceable>portrange</replaceable>; ... };
+@@ -864,6 +865,7 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
+ 		type ( delegation-only | forward | hint | master | redirect
+ 		    | slave | static-stub | stub );
+ 		update-check-ksk <replaceable>boolean</replaceable>;
++		update-quota <replaceable>integer</replaceable>;
+ 		update-policy ( local | { ( deny | grant ) <replaceable>string</replaceable> (
+ 		    6to4-self | external | krb5-self | krb5-selfsub |
+ 		    krb5-subdomain | ms-self | ms-selfsub | ms-subdomain |
+diff --git a/bin/named/server.c b/bin/named/server.c
+index f09b895..7af90d0 100644
+--- a/bin/named/server.c
++++ b/bin/named/server.c
+@@ -7792,6 +7792,7 @@ load_configuration(const char *filename, ns_server_t *server,
+ 	configure_server_quota(maps, "tcp-clients", &server->tcpquota);
+ 	configure_server_quota(maps, "recursive-clients",
+ 			       &server->recursionquota);
++	configure_server_quota(maps, "update-quota", &server->updquota);
+ 
+ 	if (server->recursionquota.max > 1000) {
+ 		int margin = ISC_MAX(100, ns_g_cpus + 1);
+diff --git a/bin/tests/system/checkconf/good.conf b/bin/tests/system/checkconf/good.conf
+index 1359cf3..5d9b292 100644
+--- a/bin/tests/system/checkconf/good.conf
++++ b/bin/tests/system/checkconf/good.conf
+@@ -63,6 +63,7 @@ options {
+ 	serial-queries 10;
+ 	serial-query-rate 100;
+ 	server-id none;
++	update-quota 200;
+ 	max-cache-size 20000000000000;
+ 	nta-lifetime 604800;
+ 	nta-recheck 604800;
+diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
+index 9aca6d7..acf772b 100644
+--- a/doc/arm/Bv9ARM-book.xml
++++ b/doc/arm/Bv9ARM-book.xml
+@@ -8599,6 +8599,17 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
+ 	      </listitem>
+ 	    </varlistentry>
+ 
++	    <varlistentry>
++	      <term><command>update-quota</command></term>
++	      <listitem>
++		<para>
++		This is the maximum number of simultaneous DNS UPDATE messages that
++		the server will accept for updating local authoritiative zones or
++			forwarding to a primary server. The default is <userinput>100</userinput>.
++		</para>
++	      </listitem>
++	    </varlistentry>
++
+ 	  </variablelist>
+ 
+ 	</section>
+diff --git a/doc/arm/options.grammar.xml b/doc/arm/options.grammar.xml
+index 793ac0b..1d17ea8 100644
+--- a/doc/arm/options.grammar.xml
++++ b/doc/arm/options.grammar.xml
+@@ -277,6 +277,7 @@
+ 	<command>trust-anchor-telemetry</command> <replaceable>boolean</replaceable>; // experimental
+ 	<command>try-tcp-refresh</command> <replaceable>boolean</replaceable>;
+ 	<command>update-check-ksk</command> <replaceable>boolean</replaceable>;
++	<command>update-quota</command> <replaceable>integer</replaceable>;
+ 	<command>use-alt-transfer-source</command> <replaceable>boolean</replaceable>;
+ 	<command>use-v4-udp-ports</command> { <replaceable>portrange</replaceable>; ... };
+ 	<command>use-v6-udp-ports</command> { <replaceable>portrange</replaceable>; ... };
+diff --git a/doc/misc/options b/doc/misc/options
+index fde93c7..e6d6ba6 100644
+--- a/doc/misc/options
++++ b/doc/misc/options
+@@ -357,6 +357,7 @@ options {
+         trust-anchor-telemetry <boolean>; // experimental
+         try-tcp-refresh <boolean>;
+         update-check-ksk <boolean>;
++        update-quota <integer>;
+         use-alt-transfer-source <boolean>;
+         use-id-pool <boolean>; // obsolete
+         use-ixfr <boolean>; // obsolete
+diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
+index b562f95..667111c 100644
+--- a/lib/isccfg/namedconf.c
++++ b/lib/isccfg/namedconf.c
+@@ -1136,6 +1136,7 @@ options_clauses[] = {
+ 	{ "transfers-out", &cfg_type_uint32, 0 },
+ 	{ "transfers-per-ns", &cfg_type_uint32, 0 },
+ 	{ "treat-cr-as-space", &cfg_type_boolean, CFG_CLAUSEFLAG_OBSOLETE },
++	{ "update-quota", &cfg_type_uint32, 0 },
+ 	{ "use-id-pool", &cfg_type_boolean, CFG_CLAUSEFLAG_OBSOLETE },
+ 	{ "use-ixfr", &cfg_type_boolean, CFG_CLAUSEFLAG_OBSOLETE },
+ 	{ "use-v4-udp-ports", &cfg_type_bracketed_portlist, 0 },
+-- 
+2.39.2
+

SOURCES/bind-9.16-CVE-2022-3094-3.patch

@@ -0,0 +1,553 @@
+From cba333b262b7ee0034a66cc93cf27f6c4918eea2 Mon Sep 17 00:00:00 2001
+From: Evan Hunt <each@isc.org>
+Date: Tue, 8 Nov 2022 17:32:41 -0800
+Subject: [PATCH] move update ACL and update-policy checks before quota
+
+check allow-update, update-policy, and allow-update-forwarding before
+consuming quota slots, so that unauthorized clients can't fill the
+quota.
+
+(this moves the access check before the prerequisite check, which
+violates the precise wording of RFC 2136. however, RFC co-author Paul
+Vixie has stated that the RFC is mistaken on this point; it should have
+said that access checking must happen *no later than* the completion of
+prerequisite checks, not that it must happen exactly then.)
+
+(cherry picked from commit 964f559edb5036880b8e463b8f190b9007ee055d)
+---
+ bin/named/update.c | 440 ++++++++++++++++++++++++++++++---------------
+ 1 file changed, 298 insertions(+), 142 deletions(-)
+
+diff --git a/bin/named/update.c b/bin/named/update.c
+index 8853ee7..4d1fe78 100644
+--- a/bin/named/update.c
++++ b/bin/named/update.c
+@@ -251,6 +251,9 @@ static void updatedone_action(isc_task_t *task, isc_event_t *event);
+ static isc_result_t send_forward_event(ns_client_t *client, dns_zone_t *zone);
+ static void forward_done(isc_task_t *task, isc_event_t *event);
+ static isc_result_t add_rr_prepare_action(void *data, rr_t *rr);
++static isc_result_t
++rr_exists(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
++	  const dns_rdata_t *rdata, bool *flag);
+ 
+ /**************************************************************************/
+ 
+@@ -328,23 +331,24 @@ checkqueryacl(ns_client_t *client, dns_acl_t *queryacl, dns_name_t *zonename,
+ {
+ 	char namebuf[DNS_NAME_FORMATSIZE];
+ 	char classbuf[DNS_RDATACLASS_FORMATSIZE];
+-	int level;
+ 	isc_result_t result;
++	bool update_possible =
++		((updateacl != NULL && !dns_acl_isnone(updateacl)) ||
++		 ssutable != NULL);
+ 
+ 	result = ns_client_checkaclsilent(client, NULL, queryacl, true);
+ 	if (result != ISC_R_SUCCESS) {
++		int level = update_possible ? ISC_LOG_ERROR : ISC_LOG_INFO;
++
+ 		dns_name_format(zonename, namebuf, sizeof(namebuf));
+ 		dns_rdataclass_format(client->view->rdclass, classbuf,
+ 				      sizeof(classbuf));
+ 
+-		level = (updateacl == NULL && ssutable == NULL) ?
+-				ISC_LOG_INFO : ISC_LOG_ERROR;
+-
+ 		ns_client_log(client, NS_LOGCATEGORY_UPDATE_SECURITY,
+ 			      NS_LOGMODULE_UPDATE, level,
+ 			      "update '%s/%s' denied due to allow-query",
+ 			      namebuf, classbuf);
+-	} else if (updateacl == NULL && ssutable == NULL) {
++	} else if (!update_possible) {
+ 		dns_name_format(zonename, namebuf, sizeof(namebuf));
+ 		dns_rdataclass_format(client->view->rdclass, classbuf,
+ 				      sizeof(classbuf));
+@@ -1525,6 +1529,277 @@ send_update_event(ns_client_t *client, dns_zone_t *zone) {
+ 	update_event_t *event = NULL;
+ 	isc_task_t *zonetask = NULL;
+ 	ns_client_t *evclient;
++#if 1
++	dns_ssutable_t *ssutable = NULL;
++	dns_message_t *request = client->message;
++	dns_rdataclass_t zoneclass;
++	dns_rdatatype_t covers;
++	dns_name_t *zonename = NULL;
++	dns_db_t *db = NULL;
++	dns_dbversion_t *ver = NULL;
++
++	CHECK(dns_zone_getdb(zone, &db));
++	zonename = dns_db_origin(db);
++	zoneclass = dns_db_class(db);
++	dns_zone_getssutable(zone, &ssutable);
++	dns_db_currentversion(db, &ver);
++
++	/*
++	 * Update message processing can leak record existence information
++	 * so check that we are allowed to query this zone.  Additionally,
++	 * if we would refuse all updates for this zone, we bail out here.
++	 */
++	CHECK(checkqueryacl(client, dns_zone_getqueryacl(zone),
++			    dns_zone_getorigin(zone),
++			    dns_zone_getupdateacl(zone), ssutable));
++
++	/*
++	 * Check requestor's permissions.
++	 */
++	if (ssutable == NULL)
++		CHECK(checkupdateacl(client, dns_zone_getupdateacl(zone),
++				     "update", zonename, false, false));
++	else if (client->signer == NULL && !TCPCLIENT(client))
++		CHECK(checkupdateacl(client, NULL, "update", zonename,
++				     false, true));
++
++	if (dns_zone_getupdatedisabled(zone))
++		FAILC(DNS_R_REFUSED, "dynamic update temporarily disabled "
++				     "because the zone is frozen.  Use "
++				     "'rndc thaw' to re-enable updates.");
++
++	/*
++	 * Perform the Update Section Prescan.
++	 */
++
++	for (result = dns_message_firstname(request, DNS_SECTION_UPDATE);
++	     result == ISC_R_SUCCESS;
++	     result = dns_message_nextname(request, DNS_SECTION_UPDATE))
++	{
++		dns_name_t *name = NULL;
++		dns_rdata_t rdata = DNS_RDATA_INIT;
++		dns_ttl_t ttl;
++		dns_rdataclass_t update_class;
++		get_current_rr(request, DNS_SECTION_UPDATE, zoneclass,
++			       &name, &rdata, &covers, &ttl, &update_class);
++
++		if (! dns_name_issubdomain(name, zonename))
++			FAILC(DNS_R_NOTZONE,
++			      "update RR is outside zone");
++		if (update_class == zoneclass) {
++			/*
++			 * Check for meta-RRs.  The RFC2136 pseudocode says
++			 * check for ANY|AXFR|MAILA|MAILB, but the text adds
++			 * "or any other QUERY metatype"
++			 */
++			if (dns_rdatatype_ismeta(rdata.type)) {
++				FAILC(DNS_R_FORMERR,
++				      "meta-RR in update");
++			}
++			result = dns_zone_checknames(zone, name, &rdata);
++			if (result != ISC_R_SUCCESS)
++				FAIL(DNS_R_REFUSED);
++		} else if (update_class == dns_rdataclass_any) {
++			if (ttl != 0 || rdata.length != 0 ||
++			    (dns_rdatatype_ismeta(rdata.type) &&
++			     rdata.type != dns_rdatatype_any))
++				FAILC(DNS_R_FORMERR,
++				      "meta-RR in update");
++		} else if (update_class == dns_rdataclass_none) {
++			if (ttl != 0 ||
++			    dns_rdatatype_ismeta(rdata.type))
++				FAILC(DNS_R_FORMERR,
++				      "meta-RR in update");
++		} else {
++			update_log(client, zone, ISC_LOG_WARNING,
++				   "update RR has incorrect class %d",
++				   update_class);
++			FAIL(DNS_R_FORMERR);
++		}
++
++		/*
++		 * draft-ietf-dnsind-simple-secure-update-01 says
++		 * "Unlike traditional dynamic update, the client
++		 * is forbidden from updating NSEC records."
++		 */
++		if (rdata.type == dns_rdatatype_nsec3) {
++			FAILC(DNS_R_REFUSED,
++			      "explicit NSEC3 updates are not allowed "
++			      "in secure zones");
++		} else if (rdata.type == dns_rdatatype_nsec) {
++			FAILC(DNS_R_REFUSED,
++			      "explicit NSEC updates are not allowed "
++			      "in secure zones");
++		} else if (rdata.type == dns_rdatatype_rrsig &&
++			   !dns_name_equal(name, zonename)) {
++			FAILC(DNS_R_REFUSED,
++			      "explicit RRSIG updates are currently "
++			      "not supported in secure zones except "
++			      "at the apex");
++		}
++
++		if (ssutable != NULL) {
++			isc_netaddr_t netaddr;
++			dst_key_t *tsigkey = NULL;
++			isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
++
++			if (client->message->tsigkey != NULL)
++				tsigkey = client->message->tsigkey->key;
++
++			if (rdata.type != dns_rdatatype_any) {
++				if (!dns_ssutable_checkrules2
++				    (ssutable, client->signer, name, &netaddr,
++				     TCPCLIENT(client),
++				     &ns_g_server->aclenv,
++				     rdata.type, tsigkey))
++				{
++					FAILC(DNS_R_REFUSED,
++					      "rejected by secure update");
++				}
++			} else {
++				if (!ssu_checkall(db, ver, name, ssutable,
++						  client->signer,
++						  &netaddr,
++						  TCPCLIENT(client),
++						  tsigkey))
++				{
++					FAILC(DNS_R_REFUSED,
++					      "rejected by secure update");
++				}
++			}
++		}
++	}
++	if (result != ISC_R_NOMORE)
++		FAIL(result);
++
++	update_log(client, zone, LOGLEVEL_DEBUG,
++		   "update section prescan OK");
++#if 0
++	if (ssutable == NULL) {
++		CHECK(checkupdateacl(client, dns_zone_getupdateacl(zone),
++						// zonename
++				     "update", dns_zone_getorigin(zone), false,
++				     false));
++	} else if (client->signer == NULL && !TCPCLIENT(client)) {
++		CHECK(checkupdateacl(client, NULL, "update",
++				     dns_zone_getorigin(zone), false, true));
++	}
++
++	if (dns_zone_getupdatedisabled(zone)) {
++		FAILC(DNS_R_REFUSED, "dynamic update temporarily disabled "
++				     "because the zone is frozen.  Use "
++				     "'rndc thaw' to re-enable updates.");
++	}
++
++	/*
++	 * Prescan the update section, checking for updates that
++	 * are illegal or violate policy.
++	 */
++	for (result = dns_message_firstname(request, DNS_SECTION_UPDATE);
++	     result == ISC_R_SUCCESS;
++	     result = dns_message_nextname(request, DNS_SECTION_UPDATE))
++	{
++		dns_name_t *name = NULL;
++		dns_rdata_t rdata = DNS_RDATA_INIT;
++		dns_ttl_t ttl;
++		dns_rdataclass_t update_class;
++
++		get_current_rr(request, DNS_SECTION_UPDATE, zoneclass, &name,
++			       &rdata, &covers, &ttl, &update_class);
++
++		if (!dns_name_issubdomain(name, zonename)) {
++			FAILC(DNS_R_NOTZONE, "update RR is outside zone");
++		}
++		if (update_class == zoneclass) {
++			/*
++			 * Check for meta-RRs.  The RFC2136 pseudocode says
++			 * check for ANY|AXFR|MAILA|MAILB, but the text adds
++			 * "or any other QUERY metatype"
++			 */
++			if (dns_rdatatype_ismeta(rdata.type)) {
++				FAILC(DNS_R_FORMERR, "meta-RR in update");
++			}
++			result = dns_zone_checknames(zone, name, &rdata);
++			if (result != ISC_R_SUCCESS) {
++				FAIL(DNS_R_REFUSED);
++			}
++		} else if (update_class == dns_rdataclass_any) {
++			if (ttl != 0 || rdata.length != 0 ||
++			    (dns_rdatatype_ismeta(rdata.type) &&
++			     rdata.type != dns_rdatatype_any))
++			{
++				FAILC(DNS_R_FORMERR, "meta-RR in update");
++			}
++		} else if (update_class == dns_rdataclass_none) {
++			if (ttl != 0 || dns_rdatatype_ismeta(rdata.type)) {
++				FAILC(DNS_R_FORMERR, "meta-RR in update");
++			}
++		} else {
++			update_log(client, zone, ISC_LOG_WARNING,
++				   "update RR has incorrect class %d",
++				   update_class);
++			FAIL(DNS_R_FORMERR);
++		}
++
++		/*
++		 * draft-ietf-dnsind-simple-secure-update-01 says
++		 * "Unlike traditional dynamic update, the client
++		 * is forbidden from updating NSEC records."
++		 */
++		if (rdata.type == dns_rdatatype_nsec3) {
++			FAILC(DNS_R_REFUSED, "explicit NSEC3 updates are not "
++					     "allowed "
++					     "in secure zones");
++		} else if (rdata.type == dns_rdatatype_nsec) {
++			FAILC(DNS_R_REFUSED, "explicit NSEC updates are not "
++					     "allowed "
++					     "in secure zones");
++		} else if (rdata.type == dns_rdatatype_rrsig &&
++			   !dns_name_equal(name, zonename))
++		{
++			FAILC(DNS_R_REFUSED, "explicit RRSIG updates are "
++					     "currently "
++					     "not supported in secure zones "
++					     "except "
++					     "at the apex");
++		}
++
++		if (ssutable != NULL) {
++			isc_netaddr_t netaddr;
++			dst_key_t *tsigkey = NULL;
++			isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
++
++			if (client->message->tsigkey != NULL) {
++				tsigkey = client->message->tsigkey->key;
++			}
++
++			if (rdata.type != dns_rdatatype_any) {
++				if (!dns_ssutable_checkrules(
++					    ssutable, client->signer, name,
++					    &netaddr, TCPCLIENT(client), env,
++					    rdata.type, tsigkey))
++				{
++					FAILC(DNS_R_REFUSED, "rejected by "
++							     "secure update");
++				}
++			} else {
++				if (!ssu_checkall(db, ver, name, ssutable,
++						  client->signer, &netaddr, env,
++						  TCPCLIENT(client), tsigkey))
++				{
++					FAILC(DNS_R_REFUSED, "rejected by "
++							     "secure update");
++				}
++			}
++		}
++	}
++	if (result != ISC_R_NOMORE) {
++		FAIL(result);
++	}
++
++	update_log(client, zone, LOGLEVEL_DEBUG, "update section prescan OK");
++#endif
++#endif
+ 
+ 	result = isc_quota_attach(&ns_g_server->updquota,
+ 				  &(isc_quota_t *){ NULL });
+@@ -1558,6 +1833,15 @@ send_update_event(ns_client_t *client, dns_zone_t *zone) {
+  failure:
+ 	if (event != NULL)
+ 		isc_event_free(ISC_EVENT_PTR(&event));
++	if (db != NULL) {
++		dns_db_closeversion(db, &ver, false);
++		dns_db_detach(&db);
++	}
++
++	if (ssutable != NULL) {
++		dns_ssutable_detach(&ssutable);
++	}
++
+ 	return (result);
+ }
+ 
+@@ -1644,9 +1928,6 @@ ns_update_start(ns_client_t *client, isc_result_t sigresult) {
+ 		CHECK(send_update_event(client, zone));
+ 		break;
+ 	case dns_zone_slave:
+-		CHECK(checkupdateacl(client, dns_zone_getforwardacl(zone),
+-				     "update forwarding", zonename, true,
+-				     false));
+ 		CHECK(send_forward_event(client, zone));
+ 		break;
+ 	default:
+@@ -1656,7 +1937,6 @@ ns_update_start(ns_client_t *client, isc_result_t sigresult) {
+ 
+  failure:
+ 	if (result == DNS_R_REFUSED) {
+-		INSIST(dns_zone_gettype(zone) == dns_zone_slave);
+ 		inc_stats(zone, dns_nsstatscounter_updaterej);
+ 	}
+ 	/*
+@@ -2520,7 +2800,7 @@ update_action(isc_task_t *task, isc_event_t *event) {
+ 	dns_rdatatype_t covers;
+ 	dns_message_t *request = client->message;
+ 	dns_rdataclass_t zoneclass;
+-	dns_name_t *zonename;
++	dns_name_t *zonename = NULL;
+ 	dns_ssutable_t *ssutable = NULL;
+ 	dns_fixedname_t tmpnamefixed;
+ 	dns_name_t *tmpname = NULL;
+@@ -2542,14 +2822,7 @@ update_action(isc_task_t *task, isc_event_t *event) {
+ 	zonename = dns_db_origin(db);
+ 	zoneclass = dns_db_class(db);
+ 	dns_zone_getssutable(zone, &ssutable);
+-
+-	/*
+-	 * Update message processing can leak record existence information
+-	 * so check that we are allowed to query this zone.  Additionally
+-	 * if we would refuse all updates for this zone we bail out here.
+-	 */
+-	CHECK(checkqueryacl(client, dns_zone_getqueryacl(zone), zonename,
+-			    dns_zone_getupdateacl(zone), ssutable));
++	options = dns_zone_getoptions(zone);
+ 
+ 	/*
+ 	 * Get old and new versions now that queryacl has been checked.
+@@ -2673,134 +2946,10 @@ update_action(isc_task_t *task, isc_event_t *event) {
+ 	update_log(client, zone, LOGLEVEL_DEBUG,
+ 		   "prerequisites are OK");
+ 
+-	/*
+-	 * Check Requestor's Permissions.  It seems a bit silly to do this
+-	 * only after prerequisite testing, but that is what RFC2136 says.
+-	 */
+-	if (ssutable == NULL)
+-		CHECK(checkupdateacl(client, dns_zone_getupdateacl(zone),
+-				     "update", zonename, false, false));
+-	else if (client->signer == NULL && !TCPCLIENT(client))
+-		CHECK(checkupdateacl(client, NULL, "update", zonename,
+-				     false, true));
+-
+-	if (dns_zone_getupdatedisabled(zone))
+-		FAILC(DNS_R_REFUSED, "dynamic update temporarily disabled "
+-				     "because the zone is frozen.  Use "
+-				     "'rndc thaw' to re-enable updates.");
+-
+-	/*
+-	 * Perform the Update Section Prescan.
+-	 */
+-
+-	for (result = dns_message_firstname(request, DNS_SECTION_UPDATE);
+-	     result == ISC_R_SUCCESS;
+-	     result = dns_message_nextname(request, DNS_SECTION_UPDATE))
+-	{
+-		dns_name_t *name = NULL;
+-		dns_rdata_t rdata = DNS_RDATA_INIT;
+-		dns_ttl_t ttl;
+-		dns_rdataclass_t update_class;
+-		get_current_rr(request, DNS_SECTION_UPDATE, zoneclass,
+-			       &name, &rdata, &covers, &ttl, &update_class);
+-
+-		if (! dns_name_issubdomain(name, zonename))
+-			FAILC(DNS_R_NOTZONE,
+-			      "update RR is outside zone");
+-		if (update_class == zoneclass) {
+-			/*
+-			 * Check for meta-RRs.  The RFC2136 pseudocode says
+-			 * check for ANY|AXFR|MAILA|MAILB, but the text adds
+-			 * "or any other QUERY metatype"
+-			 */
+-			if (dns_rdatatype_ismeta(rdata.type)) {
+-				FAILC(DNS_R_FORMERR,
+-				      "meta-RR in update");
+-			}
+-			result = dns_zone_checknames(zone, name, &rdata);
+-			if (result != ISC_R_SUCCESS)
+-				FAIL(DNS_R_REFUSED);
+-		} else if (update_class == dns_rdataclass_any) {
+-			if (ttl != 0 || rdata.length != 0 ||
+-			    (dns_rdatatype_ismeta(rdata.type) &&
+-			     rdata.type != dns_rdatatype_any))
+-				FAILC(DNS_R_FORMERR,
+-				      "meta-RR in update");
+-		} else if (update_class == dns_rdataclass_none) {
+-			if (ttl != 0 ||
+-			    dns_rdatatype_ismeta(rdata.type))
+-				FAILC(DNS_R_FORMERR,
+-				      "meta-RR in update");
+-		} else {
+-			update_log(client, zone, ISC_LOG_WARNING,
+-				   "update RR has incorrect class %d",
+-				   update_class);
+-			FAIL(DNS_R_FORMERR);
+-		}
+-
+-		/*
+-		 * draft-ietf-dnsind-simple-secure-update-01 says
+-		 * "Unlike traditional dynamic update, the client
+-		 * is forbidden from updating NSEC records."
+-		 */
+-		if (rdata.type == dns_rdatatype_nsec3) {
+-			FAILC(DNS_R_REFUSED,
+-			      "explicit NSEC3 updates are not allowed "
+-			      "in secure zones");
+-		} else if (rdata.type == dns_rdatatype_nsec) {
+-			FAILC(DNS_R_REFUSED,
+-			      "explicit NSEC updates are not allowed "
+-			      "in secure zones");
+-		} else if (rdata.type == dns_rdatatype_rrsig &&
+-			   !dns_name_equal(name, zonename)) {
+-			FAILC(DNS_R_REFUSED,
+-			      "explicit RRSIG updates are currently "
+-			      "not supported in secure zones except "
+-			      "at the apex");
+-		}
+-
+-		if (ssutable != NULL) {
+-			isc_netaddr_t netaddr;
+-			dst_key_t *tsigkey = NULL;
+-			isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
+-
+-			if (client->message->tsigkey != NULL)
+-				tsigkey = client->message->tsigkey->key;
+-
+-			if (rdata.type != dns_rdatatype_any) {
+-				if (!dns_ssutable_checkrules2
+-				    (ssutable, client->signer, name, &netaddr,
+-				     TCPCLIENT(client),
+-				     &ns_g_server->aclenv,
+-				     rdata.type, tsigkey))
+-				{
+-					FAILC(DNS_R_REFUSED,
+-					      "rejected by secure update");
+-				}
+-			} else {
+-				if (!ssu_checkall(db, ver, name, ssutable,
+-						  client->signer,
+-						  &netaddr,
+-						  TCPCLIENT(client),
+-						  tsigkey))
+-				{
+-					FAILC(DNS_R_REFUSED,
+-					      "rejected by secure update");
+-				}
+-			}
+-		}
+-	}
+-	if (result != ISC_R_NOMORE)
+-		FAIL(result);
+-
+-	update_log(client, zone, LOGLEVEL_DEBUG,
+-		   "update section prescan OK");
+-
+ 	/*
+ 	 * Process the Update Section.
+ 	 */
+ 
+-	options = dns_zone_getoptions(zone);
+ 	options2 = dns_zone_getoptions2(zone);
+ 	for (result = dns_message_firstname(request, DNS_SECTION_UPDATE);
+ 	     result == ISC_R_SUCCESS;
+@@ -3494,6 +3643,13 @@ send_forward_event(ns_client_t *client, dns_zone_t *zone) {
+ 	isc_task_t *zonetask = NULL;
+ 	ns_client_t *evclient;
+ 
++	result = checkupdateacl(client, dns_zone_getforwardacl(zone),
++				"update forwarding", dns_zone_getorigin(zone),
++				true, false);
++	if (result != ISC_R_SUCCESS) {
++		return (result);
++	}
++
+ 	result = isc_quota_attach(&ns_g_server->updquota,
+ 				  &(isc_quota_t *){ NULL });
+ 	if (result != ISC_R_SUCCESS) {
+-- 
+2.39.2
+

SOURCES/bind-9.16-CVE-2022-3094-test.patch

@@ -0,0 +1,266 @@
+From 3d84c651f823cb90b73fd736d32ad6de57b11610 Mon Sep 17 00:00:00 2001
+From: Evan Hunt <each@isc.org>
+Date: Wed, 9 Nov 2022 21:56:16 -0800
+Subject: [PATCH] test failure conditions
+
+verify that updates are refused when the client is disallowed by
+allow-query, and update forwarding is refused when the client is
+is disallowed by update-forwarding.
+
+verify that "too many DNS UPDATEs" appears in the log file when too
+many simultaneous updates are processing.
+
+(cherry picked from commit b91339b80e5b82a56622c93cc1e3cca2d0c11bc0)
+---
+ bin/tests/system/nsupdate/ns1/named.conf.in   |  2 +
+ bin/tests/system/nsupdate/tests.sh            | 28 +++++++++++++
+ bin/tests/system/upforwd/clean.sh             |  2 +
+ .../ns3/{named.conf.in => named1.conf.in}     |  7 +++-
+ bin/tests/system/upforwd/ns3/named2.conf.in   | 41 +++++++++++++++++++
+ bin/tests/system/upforwd/setup.sh             |  2 +-
+ bin/tests/system/upforwd/tests.sh             | 40 ++++++++++++++++++
+ 7 files changed, 120 insertions(+), 2 deletions(-)
+ rename bin/tests/system/upforwd/ns3/{named.conf.in => named1.conf.in} (85%)
+ create mode 100644 bin/tests/system/upforwd/ns3/named2.conf.in
+
+diff --git a/bin/tests/system/nsupdate/ns1/named.conf.in b/bin/tests/system/nsupdate/ns1/named.conf.in
+index cb80269..228ad6a 100644
+--- a/bin/tests/system/nsupdate/ns1/named.conf.in
++++ b/bin/tests/system/nsupdate/ns1/named.conf.in
+@@ -20,6 +20,7 @@ options {
+ 	listen-on-v6 { none; };
+ 	recursion no;
+ 	notify yes;
++	update-quota 1;
+ };
+ 
+ key rndc_key {
+@@ -76,6 +77,7 @@ zone "other.nil" {
+ 	check-integrity no;
+ 	check-mx warn;
+ 	update-policy local;
++	allow-query { !10.53.0.2; any; };
+ 	allow-query-on { 10.53.0.1; 127.0.0.1; };
+ 	allow-transfer { any; };
+ };
+diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh
+index f8994ff..4cabf8d 100755
+--- a/bin/tests/system/nsupdate/tests.sh
++++ b/bin/tests/system/nsupdate/tests.sh
+@@ -1069,6 +1069,34 @@ END
+ grep "NSEC3PARAM has excessive iterations (> 150)" nsupdate.out-$n >/dev/null || ret=1
+ [ $ret = 0 ] || { echo_i "failed"; status=1; }
+ 
++n=$((n + 1))
++ret=0
++echo_i "check that update is rejected if query is not allowed ($n)"
++{
++  $NSUPDATE -d <<END
++  local 10.53.0.2
++  server 10.53.0.1 ${PORT}
++  update add reject.other.nil 3600 IN TXT Whatever
++  send
++END
++} > nsupdate.out.test$n 2>&1
++grep 'status: REFUSED' nsupdate.out.test$n > /dev/null || ret=1
++[ $ret = 0 ] || { echo_i "failed"; status=1; }
++
++n=$((n + 1))
++ret=0
++echo_i "check that update is rejected if quota is exceeded ($n)"
++for loop in 1 2 3 4 5 6 7 8 9 10; do
++{
++  $NSUPDATE -l -p ${PORT} -k ns1/session.key > nsupdate.out.test$n-${loop} 2>&1 <<END
++  update add txt-$loop.other.nil 3600 IN TXT Whatever
++  send
++END
++} &
++done
++wait_for_log 10 "too many DNS UPDATEs queued" ns1/named.run || ret=1
++[ $ret = 0 ] || { echo_i "failed"; status=1; }
++
+ if $FEATURETEST --gssapi ; then
+   n=`expr $n + 1`
+   ret=0
+diff --git a/bin/tests/system/upforwd/clean.sh b/bin/tests/system/upforwd/clean.sh
+index 15cf423..832c727 100644
+--- a/bin/tests/system/upforwd/clean.sh
++++ b/bin/tests/system/upforwd/clean.sh
+@@ -24,3 +24,5 @@ rm -f Ksig0.example2.*
+ rm -f keyname
+ rm -f ns*/named.lock
+ rm -f ns1/example2.db
++rm -f nsupdate.out.*
++rm -f ns*/named.run.prev
+diff --git a/bin/tests/system/upforwd/ns3/named.conf.in b/bin/tests/system/upforwd/ns3/named1.conf.in
+similarity index 85%
+rename from bin/tests/system/upforwd/ns3/named.conf.in
+rename to bin/tests/system/upforwd/ns3/named1.conf.in
+index e81cd1a..83a490f 100644
+--- a/bin/tests/system/upforwd/ns3/named.conf.in
++++ b/bin/tests/system/upforwd/ns3/named1.conf.in
+@@ -22,10 +22,15 @@ options {
+ 	notify yes;
+ };
+ 
++include "../../common/rndc.key";
++controls {
++	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
++};
++
+ zone "example" {
+ 	type slave;
+ 	file "example.bk";
+-	allow-update-forwarding { any; };
++	allow-update-forwarding { 10.53.0.1; };
+ 	masters { 10.53.0.1; };
+ };
+ 
+diff --git a/bin/tests/system/upforwd/ns3/named2.conf.in b/bin/tests/system/upforwd/ns3/named2.conf.in
+new file mode 100644
+index 0000000..992cd69
+--- /dev/null
++++ b/bin/tests/system/upforwd/ns3/named2.conf.in
+@@ -0,0 +1,41 @@
++/*
++ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
++ *
++ * SPDX-License-Identifier: MPL-2.0
++ *
++ * This Source Code Form is subject to the terms of the Mozilla Public
++ * License, v. 2.0.  If a copy of the MPL was not distributed with this
++ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
++ *
++ * See the COPYRIGHT file distributed with this work for additional
++ * information regarding copyright ownership.
++ */
++
++options {
++	query-source address 10.53.0.3;
++	notify-source 10.53.0.3;
++	transfer-source 10.53.0.3;
++	port @PORT@;
++	pid-file "named.pid";
++	listen-on { 10.53.0.3; };
++	listen-on-v6 { none; };
++	recursion no;
++	notify yes;
++	update-quota 1;
++};
++
++key rndc_key {
++	secret "1234abcd8765";
++	algorithm hmac-sha256;
++};
++
++controls {
++	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
++};
++
++zone "example" {
++	type slave;
++	file "example.bk";
++	allow-update-forwarding { any; };
++	masters { 10.53.0.1; };
++};
+diff --git a/bin/tests/system/upforwd/setup.sh b/bin/tests/system/upforwd/setup.sh
+index 74c7ba3..928902b 100644
+--- a/bin/tests/system/upforwd/setup.sh
++++ b/bin/tests/system/upforwd/setup.sh
+@@ -17,7 +17,7 @@ cp -f ns3/nomaster.db ns3/nomaster1.db
+ 
+ copy_setports ns1/named.conf.in ns1/named.conf
+ copy_setports ns2/named.conf.in ns2/named.conf
+-copy_setports ns3/named.conf.in ns3/named.conf
++copy_setports ns3/named1.conf.in ns3/named.conf
+ 
+ #
+ # SIG(0) required cryptographic support which may not be configured.
+diff --git a/bin/tests/system/upforwd/tests.sh b/bin/tests/system/upforwd/tests.sh
+index f4c3216..ebc9ded 100644
+--- a/bin/tests/system/upforwd/tests.sh
++++ b/bin/tests/system/upforwd/tests.sh
+@@ -17,6 +17,7 @@ SYSTEMTESTTOP=..
+ . $SYSTEMTESTTOP/conf.sh
+ 
+ DIGOPTS="+tcp +noadd +nosea +nostat +noquest +nocomm +nocmd -p ${PORT}"
++RNDCCMD="$RNDC -c $SYSTEMTESTTOP/common/rndc.conf -p ${CONTROLPORT} -s"
+ 
+ status=0
+ n=1
+@@ -69,6 +70,7 @@ if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
+ echo_i "updating zone (signed) ($n)"
+ ret=0
+ $NSUPDATE -y hmac-sha256:update.example:c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K -- - <<EOF || ret=1
++local 10.53.0.1
+ server 10.53.0.3 ${PORT}
+ update add updated.example. 600 A 10.10.10.1
+ update add updated.example. 600 TXT Foo
+@@ -116,6 +118,7 @@ n=`expr $n + 1`
+ echo_i "updating zone (unsigned) ($n)"
+ ret=0
+ $NSUPDATE -- - <<EOF || ret=1
++local 10.53.0.1
+ server 10.53.0.3 ${PORT}
+ update add unsigned.example. 600 A 10.10.10.1
+ update add unsigned.example. 600 TXT Foo
+@@ -161,6 +164,7 @@ while [ $count -lt 5 -a $ret -eq 0 ]
+ do
+ (
+ $NSUPDATE -- - <<EOF 
++local 10.53.0.1
+ server 10.53.0.3 ${PORT}
+ zone nomaster
+ update add unsigned.nomaster. 600 A 10.10.10.1
+@@ -181,6 +185,7 @@ then
+ 	ret=0
+ 	keyname=`cat keyname`
+ 	$NSUPDATE -k $keyname.private -- - <<EOF
++	local 10.53.0.1
+ 	server 10.53.0.3 ${PORT}
+ 	zone example2
+ 	update add unsigned.example2. 600 A 10.10.10.1
+@@ -194,5 +199,40 @@ EOF
+ 	n=`expr $n + 1`
+ fi
+ 
++echo_i "attempting an update that should be rejected by ACL ($n)"
++ret=0
++{
++        $NSUPDATE -- - << EOF
++        local 10.53.0.2
++        server 10.53.0.3 ${PORT}
++        update add another.unsigned.example. 600 A 10.10.10.2
++        update add another.unsigned.example. 600 TXT Bar
++        send
++EOF
++} > nsupdate.out.$n 2>&1
++grep REFUSED nsupdate.out.$n > /dev/null || ret=1
++if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
++n=`expr $n + 1`
++
++n=$((n + 1))
++ret=0
++echo_i "attempting updates that should exceed quota ($n)"
++# lower the update quota to 1.
++copy_setports ns3/named2.conf.in ns3/named.conf
++$RNDCCMD 10.53.0.3 reconfig
++nextpart ns3/named.run > /dev/null
++for loop in 1 2 3 4 5 6 7 8 9 10; do
++{
++  $NSUPDATE -- - > /dev/null 2>&1 <<END
++  local 10.53.0.1
++  server 10.53.0.3 ${PORT}
++  update add txt-$loop.unsigned.example 300 IN TXT Whatever
++  send
++END
++} &
++done
++wait_for_log 10 "too many DNS UPDATEs queued" ns3/named.run || ret=1
++[ $ret = 0 ] || { echo_i "failed"; status=1; }
++
+ echo_i "exit status: $status"
+ [ $status -eq 0 ] || exit 1
+-- 
+2.39.2
+

SOURCES/bind-9.16-CVE-2022-38177.patch

@@ -0,0 +1,27 @@
+From 0095b8a6b09173ab5eb48611dc0233d2a6337dc1 Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Tue, 20 Sep 2022 11:21:45 +0200
+Subject: [PATCH] Fix CVE-2022-38177
+
+5961.	[security]	Fix memory leak in ECDSA verify processing.
+			(CVE-2022-38177) [GL #3487]
+---
+ lib/dns/opensslecdsa_link.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/dns/opensslecdsa_link.c b/lib/dns/opensslecdsa_link.c
+index 83b5b51..7576e04 100644
+--- a/lib/dns/opensslecdsa_link.c
++++ b/lib/dns/opensslecdsa_link.c
+@@ -224,7 +224,7 @@ opensslecdsa_verify(dst_context_t *dctx, const isc_region_t *sig) {
+ 		siglen = DNS_SIG_ECDSA384SIZE;
+ 
+ 	if (sig->length != siglen)
+-		return (DST_R_VERIFYFAILURE);
++		DST_RET(DST_R_VERIFYFAILURE);
+ 
+ 	if (!EVP_DigestFinal_ex(evp_md_ctx, digest, &dgstlen))
+ 		DST_RET (dst__openssl_toresult3(dctx->category,
+-- 
+2.37.3
+

SOURCES/bind-9.16-CVE-2022-38178.patch

@@ -0,0 +1,27 @@
+From bb68864bf05d29df644427ec841bc3db6a336519 Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Tue, 20 Sep 2022 11:22:47 +0200
+Subject: [PATCH] Fix CVE-2022-38178
+
+5962.	[security]	Fix memory leak in EdDSA verify processing.
+			(CVE-2022-38178) [GL #3487]
+---
+ lib/dns/openssleddsa_link.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/dns/openssleddsa_link.c b/lib/dns/openssleddsa_link.c
+index 8b115ec..4f3c2a8 100644
+--- a/lib/dns/openssleddsa_link.c
++++ b/lib/dns/openssleddsa_link.c
+@@ -325,7 +325,7 @@ openssleddsa_verify(dst_context_t *dctx, const isc_region_t *sig) {
+ 		siglen = DNS_SIG_ED448SIZE;
+ 
+ 	if (sig->length != siglen)
+-		return (DST_R_VERIFYFAILURE);
++		DST_RET(DST_R_VERIFYFAILURE);
+ 
+ 	isc_buffer_usedregion(buf, &tbsreg);
+ 
+-- 
+2.37.3
+

SOURCES/bind-9.16-CVE-2023-3341.patch

@@ -0,0 +1,166 @@
+From 3883ec072e5feed1237dc864854ab95ded7302d6 Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Tue, 19 Sep 2023 13:14:52 +0200
+Subject: [PATCH] Backport of CVE-2023-3341 fix
+
+Taken from BIND 9.16.44 change.
+---
+ lib/isccc/cc.c                   | 36 +++++++++++++++++++++++---------
+ lib/isccc/include/isccc/result.h |  4 +++-
+ lib/isccc/result.c               |  4 +++-
+ 3 files changed, 32 insertions(+), 12 deletions(-)
+
+diff --git a/lib/isccc/cc.c b/lib/isccc/cc.c
+index 463a053..a54e60c 100644
+--- a/lib/isccc/cc.c
++++ b/lib/isccc/cc.c
+@@ -53,6 +53,10 @@
+ 
+ #define MAX_TAGS		256
+ #define DUP_LIFETIME		900
++#ifndef ISCCC_MAXDEPTH
++#define ISCCC_MAXDEPTH \
++	10 /* Big enough for rndc which just sends a string each way. */
++#endif
+ 
+ typedef isccc_sexpr_t *sexpr_ptr;
+ 
+@@ -573,19 +577,23 @@ verify(isccc_sexpr_t *alist, unsigned char *data, unsigned int length,
+ 
+ static isc_result_t
+ table_fromwire(isccc_region_t *source, isccc_region_t *secret,
+-	       uint32_t algorithm, isccc_sexpr_t **alistp);
++	       uint32_t algorithm, unsigned int depth, isccc_sexpr_t **alistp);
+ 
+ static isc_result_t
+-list_fromwire(isccc_region_t *source, isccc_sexpr_t **listp);
++list_fromwire(isccc_region_t *source, unsigned int depth, isccc_sexpr_t **listp);
+ 
+ static isc_result_t
+-value_fromwire(isccc_region_t *source, isccc_sexpr_t **valuep) {
++value_fromwire(isccc_region_t *source, unsigned int depth, isccc_sexpr_t **valuep) {
+ 	unsigned int msgtype;
+ 	uint32_t len;
+ 	isccc_sexpr_t *value;
+ 	isccc_region_t active;
+ 	isc_result_t result;
+ 
++	if (depth > ISCCC_MAXDEPTH) {
++		return (ISCCC_R_MAXDEPTH);
++	}
++
+ 	if (REGION_SIZE(*source) < 1 + 4)
+ 		return (ISC_R_UNEXPECTEDEND);
+ 	GET8(msgtype, source->rstart);
+@@ -603,9 +611,9 @@ value_fromwire(isccc_region_t *source, isccc_sexpr_t **valuep) {
+ 		} else
+ 			result = ISC_R_NOMEMORY;
+ 	} else if (msgtype == ISCCC_CCMSGTYPE_TABLE)
+-		result = table_fromwire(&active, NULL, 0, valuep);
++		result = table_fromwire(&active, NULL, 0, depth + 1, valuep);
+ 	else if (msgtype == ISCCC_CCMSGTYPE_LIST)
+-		result = list_fromwire(&active, valuep);
++		result = list_fromwire(&active, depth + 1, valuep);
+ 	else
+ 		result = ISCCC_R_SYNTAX;
+ 
+@@ -614,7 +622,7 @@ value_fromwire(isccc_region_t *source, isccc_sexpr_t **valuep) {
+ 
+ static isc_result_t
+ table_fromwire(isccc_region_t *source, isccc_region_t *secret,
+-	       uint32_t algorithm, isccc_sexpr_t **alistp)
++	       uint32_t algorithm, unsigned int depth, isccc_sexpr_t **alistp)
+ {
+ 	char key[256];
+ 	uint32_t len;
+@@ -625,6 +633,10 @@ table_fromwire(isccc_region_t *source, isccc_region_t *secret,
+ 
+ 	REQUIRE(alistp != NULL && *alistp == NULL);
+ 
++	if (depth > ISCCC_MAXDEPTH) {
++		return (ISCCC_R_MAXDEPTH);
++	}
++
+ 	checksum_rstart = NULL;
+ 	first_tag = true;
+ 	alist = isccc_alist_create();
+@@ -640,7 +652,7 @@ table_fromwire(isccc_region_t *source, isccc_region_t *secret,
+ 		GET_MEM(key, len, source->rstart);
+ 		key[len] = '\0';	/* Ensure NUL termination. */
+ 		value = NULL;
+-		result = value_fromwire(source, &value);
++		result = value_fromwire(source, depth + 1, &value);
+ 		if (result != ISC_R_SUCCESS)
+ 			goto bad;
+ 		if (isccc_alist_define(alist, key, value) == NULL) {
+@@ -673,14 +685,18 @@ table_fromwire(isccc_region_t *source, isccc_region_t *secret,
+ }
+ 
+ static isc_result_t
+-list_fromwire(isccc_region_t *source, isccc_sexpr_t **listp) {
++list_fromwire(isccc_region_t *source, unsigned int depth, isccc_sexpr_t **listp) {
+ 	isccc_sexpr_t *list, *value;
+ 	isc_result_t result;
+ 
++	if (depth > ISCCC_MAXDEPTH) {
++		return (ISCCC_R_MAXDEPTH);
++	}
++
+ 	list = NULL;
+ 	while (!REGION_EMPTY(*source)) {
+ 		value = NULL;
+-		result = value_fromwire(source, &value);
++		result = value_fromwire(source, depth + 1, &value);
+ 		if (result != ISC_R_SUCCESS) {
+ 			isccc_sexpr_free(&list);
+ 			return (result);
+@@ -711,7 +727,7 @@ isccc_cc_fromwire(isccc_region_t *source, isccc_sexpr_t **alistp,
+ 	if (version != 1)
+ 		return (ISCCC_R_UNKNOWNVERSION);
+ 
+-	return (table_fromwire(source, secret, algorithm, alistp));
++	return (table_fromwire(source, secret, algorithm, 0, alistp));
+ }
+ 
+ static isc_result_t
+diff --git a/lib/isccc/include/isccc/result.h b/lib/isccc/include/isccc/result.h
+index 6c79dd7..b30b08a 100644
+--- a/lib/isccc/include/isccc/result.h
++++ b/lib/isccc/include/isccc/result.h
+@@ -47,8 +47,10 @@
+ #define ISCCC_R_CLOCKSKEW		(ISC_RESULTCLASS_ISCCC + 4)
+ /*% Duplicate */
+ #define ISCCC_R_DUPLICATE		(ISC_RESULTCLASS_ISCCC + 5)
++/*% Maximum recursion depth */
++#define ISCCC_R_MAXDEPTH		(ISC_RESULTCLASS_ISCCC + 6)
+ 
+-#define ISCCC_R_NRESULTS 		6	/*%< Number of results */
++#define ISCCC_R_NRESULTS 		7	/*%< Number of results */
+ 
+ ISC_LANG_BEGINDECLS
+ 
+diff --git a/lib/isccc/result.c b/lib/isccc/result.c
+index 8419bbb..a3a3b9a 100644
+--- a/lib/isccc/result.c
++++ b/lib/isccc/result.c
+@@ -40,7 +40,8 @@ static const char *text[ISCCC_R_NRESULTS] = {
+ 	"bad auth",				/* 3 */
+ 	"expired",				/* 4 */
+ 	"clock skew",				/* 5 */
+-	"duplicate"				/* 6 */
++	"duplicate",				/* 6 */
++	"max depth",				/* 7 */
+ };
+ 
+ static const char *ids[ISCCC_R_NRESULTS] = {
+@@ -50,6 +51,7 @@ static const char *ids[ISCCC_R_NRESULTS] = {
+ 	"ISCCC_R_EXPIRED",
+ 	"ISCCC_R_CLOCKSKEW",
+ 	"ISCCC_R_DUPLICATE",
++	"ISCCC_R_MAXDEPTH"
+ };
+ 
+ #define ISCCC_RESULT_RESULTSET			2
+-- 
+2.41.0
+

SOURCES/bind-9.16-update-b.root-servers.net.patch

@@ -0,0 +1,31 @@
+From 4e595a6b961e73af43350833109ccba0950119f9 Mon Sep 17 00:00:00 2001
+From: Mark Andrews <marka@isc.org>
+Date: Thu, 12 Oct 2023 10:19:38 +1100
+Subject: [PATCH] Update b.root-servers.net IP addresses
+
+This covers both root hints and the default primaries for the root
+zone mirror.  The official change date is Nov 27, 2023.
+
+(cherry picked from commit 2ca2f7e9852a3d6e93f065c01ea4679f723688f7)
+---
+ lib/dns/rootns.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/lib/dns/rootns.c b/lib/dns/rootns.c
+index 9653f3b..d6ff76e 100644
+--- a/lib/dns/rootns.c
++++ b/lib/dns/rootns.c
+@@ -56,8 +56,8 @@ static char root_ns[] =
+ ".                       518400  IN      NS      M.ROOT-SERVERS.NET.\n"
+ "A.ROOT-SERVERS.NET.     3600000 IN      A       198.41.0.4\n"
+ "A.ROOT-SERVERS.NET.     3600000 IN      AAAA    2001:503:BA3E::2:30\n"
+-"B.ROOT-SERVERS.NET.     3600000 IN      A       199.9.14.201\n"
+-"B.ROOT-SERVERS.NET.     3600000 IN      AAAA    2001:500:200::b\n"
++"B.ROOT-SERVERS.NET.     3600000 IN      A       170.247.170.2\n"
++"B.ROOT-SERVERS.NET.     3600000 IN      AAAA    2801:1b8:10::b\n"
+ "C.ROOT-SERVERS.NET.     3600000 IN      A       192.33.4.12\n"
+ "C.ROOT-SERVERS.NET.     3600000 IN      AAAA    2001:500:2::c\n"
+ "D.ROOT-SERVERS.NET.     3600000 IN      A       199.7.91.13\n"
+-- 
+2.43.0
+

SOURCES/bind-9.3.2-redhat_doc.patch

@@ -1,62 +1,98 @@
-diff --git a/bin/named/named.8 b/bin/named/named.8
-index cd990a9..890be36 100644
---- a/bin/named/named.8
-+++ b/bin/named/named.8
-@@ -358,6 +358,57 @@ The default configuration file\&.
- /var/run/named/named\&.pid
- .RS 4
- The default process\-id file\&.
-+.PP
-+.SH "NOTES"
-+.PP
-+.TP
-+\fBRed Hat SELinux BIND Security Profile:\fR
-+.PP
-+By default, Red Hat ships BIND with the most secure SELinux policy
-+that will not prevent normal BIND operation and will prevent exploitation
-+of all known BIND security vulnerabilities . See the selinux(8) man page
-+for information about SElinux.
-+.PP
-+It is not necessary to run named in a chroot environment if the Red Hat
-+SELinux policy for named is enabled. When enabled, this policy is far
-+more secure than a chroot environment. Users are recommended to enable
-+SELinux and remove the bind-chroot package.
-+.PP
-+With this extra security comes some restrictions:
-+.PP
-+By default, the SELinux policy does not allow named to write any master
-+zone database files. Only the root user may create files in the $ROOTDIR/var/named
-+zone database file directory (the options { "directory" } option), where
-+$ROOTDIR is set in /etc/sysconfig/named.
-+.PP
-+The "named" group must be granted read privelege to
-+these files in order for named to be enabled to read them.
-+.PP
-+Any file created in the zone database file directory is automatically assigned
-+the SELinux file context named_zone_t .
-+.PP
-+By default, SELinux prevents any role from modifying named_zone_t files; this
-+means that files in the zone database directory cannot be modified by dynamic
-+DNS (DDNS) updates or zone transfers.
-+.PP
-+The Red Hat BIND distribution and SELinux policy creates three directories where
-+named is allowed to create and modify files: /var/named/slaves, /var/named/dynamic
-+/var/named/data. By placing files you want named to modify, such as
-+slave or DDNS updateable zone files and database / statistics dump files in
-+these directories, named will work normally and no further operator action is
-+required. Files in these directories are automatically assigned the 'named_cache_t'
-+file context, which SELinux allows named to write.
-+.PP
-+\fBRed Hat BIND SDB support:\fR
-+.PP
-+Red Hat ships named with compiled in Simplified Database Backend modules that ISC
-+provides in the "contrib/sdb" directory. Install bind-sdb package if you want use them
-+.PP
-+The SDB modules for LDAP, PostGreSQL, DirDB and SQLite are compiled into named-sdb.
-+.PP
-+See the documentation for the various SDB modules in /usr/share/doc/bind-sdb-*/ .
-+.br
-+.PP
- .RE
- .SH "SEE ALSO"
- .PP
+From facdbb0f2a266c6a3a1fa823afaa09cbd3fc38a5 Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Thu, 26 Nov 2020 12:13:10 +0100
+Subject: [PATCH] Note specific Red Hat changes in manual page
+
+Change docbook template instead of generated manual page. Remove
+system-config-bind reference, package were discontinued.
+---
+ bin/named/named.docbook | 73 +++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 73 insertions(+)
+
+diff --git a/bin/named/named.docbook b/bin/named/named.docbook
+index 7e743a9..802bec3 100644
+--- a/bin/named/named.docbook
++++ b/bin/named/named.docbook
+@@ -516,6 +516,79 @@
+ 
+   </refsection>
+ 
++  <refsection><info><title>NOTES</title></info>
++    <refsection><info><title>Red Hat SELinux BIND Security Profile</title></info>
++
++    <para>
++    By default, Red Hat ships BIND with the most secure SELinux policy
++    that will not prevent normal BIND operation and will prevent exploitation
++    of all known BIND security vulnerabilities . See the selinux(8) man page
++    for information about SElinux.
++    </para>
++
++    <para>
++    It is not necessary to run named in a chroot environment if the Red Hat
++    SELinux policy for named is enabled. When enabled, this policy is far
++    more secure than a chroot environment. Users are recommended to enable
++    SELinux and remove the bind-chroot package.
++    </para>
++
++    <para>
++    With this extra security comes some restrictions:
++    </para>
++
++    <para>
++    By default, the SELinux policy allows named to write any master
++    zone database files. Only the root user may create files in the $ROOTDIR/var/named
++    zone database file directory (the options { "directory" } option), where
++    $ROOTDIR is set in /etc/sysconfig/named.
++    </para>
++
++    <para>
++    The "named" group must be granted read privelege to
++    these files in order for named to be enabled to read them.
++    </para>
++
++    <para>
++    Any file created in the zone database file directory is automatically assigned
++    the SELinux file context named_zone_t .
++    </para>
++
++    <para>
++    By default, SELinux prevents any role from modifying named_zone_t files; this
++    means that files in the zone database directory cannot be modified by dynamic
++    DNS (DDNS) updates or zone transfers.
++    </para>
++
++    <para>
++    The Red Hat BIND distribution and SELinux policy creates three directories where
++    named is allowed to create and modify files: /var/named/slaves, /var/named/dynamic
++    /var/named/data. By placing files you want named to modify, such as
++    slave or DDNS updateable zone files and database / statistics dump files in
++    these directories, named will work normally and no further operator action is
++    required. Files in these directories are automatically assigned the 'named_cache_t'
++    file context, which SELinux allows named to write.
++    </para>
++    </refsection>
++
++    <refsection><info><title>Red Hat BIND SDB support</title></info>
++
++    <para>
++    Red Hat ships named with compiled in Simplified Database Backend modules that ISC
++    provides in the "contrib/sdb" directory. Install bind-sdb package if you want use them.
++    </para>
++
++    <para>
++    The SDB modules for LDAP, PostGreSQL, DirDB and SQLite are compiled into <command>named-sdb</command>.
++    </para>
++
++    <para>
++    See the documentation for the various SDB modules in /usr/share/doc/bind-sdb-*/ .
++    </para>
++    </refsection>
++
++  </refsection>
++
+   <refsection><info><title>SEE ALSO</title></info>
+ 
+     <para><citetitle>RFC 1033</citetitle>,
+-- 
+2.26.2
+

SOURCES/named-chroot.files

@@ -18,6 +18,7 @@
 /usr/lib/bind
 /usr/share/GeoIP
 /run/named
+/proc/sys/net/ipv4/ip_local_port_range
 # Warning: the order is important
 # If a directory containing $ROOTDIR is listed here,
 # it MUST be listed last. (/var/named contains /var/named/chroot)

SOURCES/named.root

@@ -1,13 +1,13 @@
 
-; <<>> DiG 9.11.3-RedHat-9.11.3-3.fc27 <<>> +bufsize=1200 +norec @a.root-servers.net
-; (2 servers found)
+; <<>> DiG 9.18.20 <<>> -4 +tcp +norec +nostats @d.root-servers.net
+; (1 server found)
 ;; global options: +cmd
 ;; Got answer:
-;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 46900
+;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 47286
 ;; flags: qr aa; QUERY: 1, ANSWER: 13, AUTHORITY: 0, ADDITIONAL: 27
 
 ;; OPT PSEUDOSECTION:
-; EDNS: version: 0, flags:; udp: 1472
+; EDNS: version: 0, flags:; udp: 1450
 ;; QUESTION SECTION:
 ;.				IN	NS
 
@@ -28,7 +28,7 @@
 
 ;; ADDITIONAL SECTION:
 a.root-servers.net.	518400	IN	A	198.41.0.4
-b.root-servers.net.	518400	IN	A	199.9.14.201
+b.root-servers.net.	518400	IN	A	170.247.170.2
 c.root-servers.net.	518400	IN	A	192.33.4.12
 d.root-servers.net.	518400	IN	A	199.7.91.13
 e.root-servers.net.	518400	IN	A	192.203.230.10
@@ -41,7 +41,7 @@ k.root-servers.net.	518400	IN	A	193.0.14.129
 l.root-servers.net.	518400	IN	A	199.7.83.42
 m.root-servers.net.	518400	IN	A	202.12.27.33
 a.root-servers.net.	518400	IN	AAAA	2001:503:ba3e::2:30
-b.root-servers.net.	518400	IN	AAAA	2001:500:200::b
+b.root-servers.net.	518400	IN	AAAA	2801:1b8:10::b
 c.root-servers.net.	518400	IN	AAAA	2001:500:2::c
 d.root-servers.net.	518400	IN	AAAA	2001:500:2d::d
 e.root-servers.net.	518400	IN	AAAA	2001:500:a8::e
@@ -54,8 +54,3 @@ k.root-servers.net.	518400	IN	AAAA	2001:7fd::1
 l.root-servers.net.	518400	IN	AAAA	2001:500:9f::42
 m.root-servers.net.	518400	IN	AAAA	2001:dc3::35
 
-;; Query time: 24 msec
-;; SERVER: 198.41.0.4#53(198.41.0.4)
-;; WHEN: Thu Apr 05 15:57:34 CEST 2018
-;; MSG SIZE  rcvd: 811
-

SPECS/bind.spec

@@ -15,13 +15,15 @@
 # it is not possible to build the package without PKCS11 sub-package
 # due to extensive changes to Makefiles
 %bcond_without PKCS11
-%bcond_without DEVEL
+%bcond_without JSON
 %bcond_with    LMDB
+%bcond_without DNSTAP
 %bcond_with    DLZ
 %bcond_without EXPORT_LIBS
 %bcond_without BDB
 # Legacy GeoIP support
 %bcond_with    GEOIP
+%bcond_with    DOC
 %if 0%{?fedora} >= 28 || 0%{?rhel} >= 8
 %bcond_without UNITTEST
 %else
@@ -37,6 +39,7 @@
 
 %{?!bind_uid:  %global bind_uid  25}
 %{?!bind_gid:  %global bind_gid  25}
+%{!?_pkgdocdir:%global _pkgdocdir %{_docdir}/%{name}-%{version}}
 %global        bind_dir          /var/named
 %global        chroot_prefix     %{bind_dir}/chroot
 %if %{with SDB}
@@ -44,7 +47,7 @@
 %endif
 %global        chroot_create_directories /dev /run/named %{_localstatedir}/{log,named,tmp} \\\
                                          %{_sysconfdir}/{crypto-policies/back-ends,pki/dnssec-keys,named} \\\
-                                         %{_libdir}/bind %{_datadir}/GeoIP
+                                         %{_libdir}/bind %{_datadir}/GeoIP %{_datadir}/GeoIP /proc/sys/net/ipv4
 
 ## The order of libs is important. See lib/Makefile.in for details
 %define bind_export_libs isc dns isccfg irs
@@ -56,20 +59,20 @@
 #
 
 # lib*.so.X versions of selected libraries
-%global sover_dns 1110
-%global sover_isc 1105
+%global sover_dns 1115
+%global sover_isc 1107
 %global sover_irs 161
 %global sover_isccfg 163
 
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.11.20
-Release:  5%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Version:  9.11.36
+Release:  16%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}.2
 Epoch:    32
-Url:      http://www.isc.org/products/BIND/
+Url:      https://www.isc.org/downloads/bind/
 #
-Source:   https://ftp.isc.org/isc/bind9/%{BINDVERSION}/bind-%{BINDVERSION}.tar.gz
+Source:   https://downloads.isc.org/isc/bind9/%{BINDVERSION}/bind-%{BINDVERSION}.tar.gz
 Source1:  named.sysconfig
 Source3:  named.logrotate
 Source7:  bind-9.3.1rc1-sdb_tools-Makefile.in
@@ -137,10 +140,6 @@ Patch154:bind-9.11-oot-manual.patch
 Patch155:bind-9.11-pk11.patch
 Patch156:bind-9.11-fips-code.patch
 Patch157:bind-9.11-fips-tests.patch
-# commit 66ba2fdad583d962a1f4971c85d58381f0849e4d
-# commit b105ccee68ccc3c18e6ea530063b3c8e5a42571c
-# commit 083461d3329ff6f2410745848a926090586a9846
-Patch158:bind-9.11-rh1624100.patch
 Patch159:bind-9.11-host-idn-disable.patch
 Patch164:bind-9.11-fips-code-includes.patch
 # [RT #31459] commit 06a8051d2476fb526fe6960832209392c763a9af
@@ -155,14 +154,49 @@ Patch174:bind-9.11-fips-disable.patch
 Patch175:bind-9.11-json-c.patch
 Patch177:bind-9.11-serve-stale.patch
 Patch178:bind-9.11-dhcp-time-monotonic.patch
-Patch179:bind-9.11-rh1859454.patch
-# https://gitlab.isc.org/isc-projects/bind9/commit/ae9af802b5e7169c55cc5ef04dcfbded351c743d
-Patch180:bind-9.11-CVE-2020-8622.patch
-# https://gitlab.isc.org/isc-projects/bind9/commit/0660b022fc6130dda2a27d6164fc7decdcabce8d
-Patch181:bind-9.11-CVE-2020-8623.patch
-# https://gitlab.isc.org/isc-projects/bind9/commit/8e919cf6e47c4f52612069ac0868f8caa5089e74
-Patch182:bind-9.11-CVE-2020-8624.patch
-Patch183:bind-9.11-CVE-2020-8624-test.patch
+# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/5253
+Patch183:bind-9.11-rh1980757.patch
+# modified, https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/3067
+Patch184: bind-9.15-resolver-ntasks.patch
+Patch185: bind-9.11-CVE-2021-25220.patch
+Patch186: bind-9.11-CVE-2021-25220-test.patch
+Patch188: bind-9.16-CVE-2022-38177.patch
+Patch189: bind-9.16-CVE-2022-38178.patch
+# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/6695
+Patch190: bind-9.11-rh2101712.patch
+Patch191: bind-9.11-CVE-2022-2795.patch
+# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/7376
+Patch192: bind-9.11-rh2133889.patch
+# https://gitlab.isc.org/isc-projects/bind9/commit/82185f4f80d2fa39a4569f6740cb360ffff8f5c4
+Patch193: bind-9.16-CVE-2022-3094-1.patch
+Patch194: bind-9.16-CVE-2022-3094-2.patch
+Patch195: bind-9.16-CVE-2022-3094-3.patch
+Patch196: bind-9.16-CVE-2022-3094-test.patch
+# https://gitlab.isc.org/isc-projects/bind9/commit/f1d9e9ee3859976f403914d20ad2a10855343702
+Patch197: bind-9.11-CVE-2023-2828.patch
+Patch198: bind-9.16-CVE-2023-3341.patch
+# https://issues.redhat.com/browse/RHEL-11785, downstream
+Patch199: bind-9.11-stale-cache.patch
+# https://gitlab.isc.org/isc-projects/bind9/commit/8924adca613ca9daea63786563cce6fdbd742c56
+Patch200: bind-9.16-update-b.root-servers.net.patch
+# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/8768
+Patch201: bind-9.11-CVE-2023-4408.patch
+# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/8769
+Patch202: bind-9.11-CVE-2023-50387.patch
+# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/8778
+Patch203: bind-9.11-CVE-2023-2828-fixup.patch
+# addition to patch 200
+Patch204: bind-9.11-CVE-2023-50387-fixup.patch
+# https://gitlab.isc.org/isc-projects/bind9/commit/225f2861920b8f8d42a0ea6c34dd1faa93aa8726
+Patch205: bind-9.11-CVE-2024-1975.patch
+# https://gitlab.isc.org/isc-projects/bind9/commit/3e0a67e4bdb253dae3a03a45c1aa117239a3313d
+# https://gitlab.isc.org/isc-projects/bind9/commit/e4d7ce686bb38428eddc7e33b40057d68eca9a6e
+# https://gitlab.isc.org/isc-projects/bind9/commit/b9b5485b22c364fb88c27aa04bad4c8f616da3fa
+# https://gitlab.isc.org/isc-projects/bind9/commit/3f10d6eff035702796ba82cd28b9f7cf9836e743
+# https://gitlab.isc.org/isc-projects/bind9/commit/23a4652346fb2877d6246b1eebaa967969dbde16
+Patch206: bind-9.11-CVE-2024-1737.patch
+# RH downstream, allow changing by environment
+Patch208: bind-9.11-CVE-2024-1737-runtime-env.patch
 
 # SDB patches
 Patch11: bind-9.3.2b2-sdbsrc.patch
@@ -188,6 +222,12 @@ Obsoletes:      caching-nameserver < 31:9.4.1-7.fc8
 Provides:       caching-nameserver = 31:9.4.1-7.fc8
 Obsoletes:      dnssec-conf < 1.27-2
 Provides:       dnssec-conf = 1.27-2
+# Fixes of CVE-2023-50387 and CVE-2023-50868 caused ABI change
+# Enforce updated rebuild is accepted only
+Conflicts:      bind-dyndb-ldap < 11.6-5
+Conflicts:      dhcp-client < 12:4.3.6-50
+Conflicts:      dhcp-server < 12:4.3.6-50
+Conflicts:      dhcp-relay  < 12:4.3.6-50
 BuildRequires:  gcc, make
 BuildRequires:  openssl-devel, libtool, autoconf, pkgconfig, libcap-devel
 BuildRequires:  libidn2-devel, libxml2-devel
@@ -206,7 +246,7 @@ BuildRequires:  libdb-devel
 # make unit dependencies
 BuildRequires:  libcmocka-devel kyua
 %endif
-%if %{with PKCS11}
+%if %{with PKCS11} && (%{with UNITTEST} || %{with SYSTEMTEST})
 BuildRequires:  softhsm
 %endif
 %if %{with SYSTEMTEST}
@@ -221,12 +261,18 @@ BuildRequires:  krb5-devel
 %if %{with LMDB}
 BuildRequires:  lmdb-devel
 %endif
+%if %{with JSON}
+BuildRequires:  json-c-devel
+%endif
 %if %{with GEOIP}
 BuildRequires:  GeoIP-devel
 %endif
 %if %{with GEOIP2}
 BuildRequires:  libmaxminddb-devel
 %endif
+%if %{with DNSTAP}
+BuildRequires:  fstrm-devel protobuf-c-devel
+%endif
 # Needed to regenerate dig.1 manpage
 BuildRequires:  docbook-style-xsl, libxslt
 %if %{with TSAN}
@@ -248,7 +294,6 @@ Requires: bind%{?_isa} = %{epoch}:%{version}-%{release}
 Requires: bind-libs%{?_isa} = %{epoch}:%{version}-%{release}
 Requires: bind-libs-lite%{?_isa} = %{epoch}:%{version}-%{release}
 Requires: bind-pkcs11-libs%{?_isa} = %{epoch}:%{version}-%{release}
-Recommends: softhsm
 
 %description pkcs11
 This is a version of BIND server built with native PKCS#11 functionality.
@@ -345,7 +390,6 @@ network addresses.
 You should install bind-utils if you need to get information from DNS name
 servers.
 
-%if %{with DEVEL}
 %package devel
 Summary:  Header files and libraries needed for BIND DNS development
 Obsoletes:bind-libbind-devel < 31:9.3.3-4.fc7
@@ -356,12 +400,25 @@ Requires: bind-lite-devel%{?_isa} = %{epoch}:%{version}-%{release}
 %description devel
 The bind-devel package contains full version of the header files and libraries
 required for development with ISC BIND 9
-%endif
 
 %package lite-devel
 Summary:  Lite version of header files and libraries needed for BIND DNS development
 Requires: bind-libs-lite%{?_isa} = %{epoch}:%{version}-%{release}
 Requires: openssl-devel%{?_isa} libxml2-devel%{?_isa}
+# Not required by headers, but "isc-config.sh --libs isc" requires it
+Requires: libcap-devel%{?_isa}
+%if %{with GSSTSIG}
+Requires: krb5-devel%{?_isa}
+%endif
+%if %{with LMDB}
+Requires: lmdb-devel%{?_isa}
+%endif
+%if %{with JSON}
+Requires:  json-c-devel%{?_isa}
+%endif
+%if %{with DNSTAP}
+Requires:  fstrm-devel%{?_isa} protobuf-c-devel%{?_isa}
+%endif
 
 %description lite-devel
 The bind-lite-devel package contains lite version of the header
@@ -455,6 +512,25 @@ BuildArch: noarch
 %description -n python3-bind
 This package provides a module which allows commands to be sent to rndc directly from Python programs.
 
+%if %{with DOC}
+%package doc
+Summary:   BIND 9 Administrator Reference Manual
+Requires:  bind-license = %{epoch}:%{version}-%{release}
+BuildArch: noarch
+
+%description doc
+BIND (Berkeley Internet Name Domain) is an implementation of the DNS
+(Domain Name System) protocols. BIND includes a DNS server (named),
+which resolves host names to IP addresses; a resolver library
+(routines for applications to use when interfacing with DNS); and
+tools for verifying that the DNS server is operating properly.
+
+This package contains BIND 9 Administrator Reference Manual
+in HTML and PDF format.
+%end
+
+%endif
+
 %if %{with EXPORT_LIBS}
 %package export-libs
 Summary:   ISC libs for DHCP application
@@ -510,7 +586,6 @@ are used for building ISC DHCP.
 %patch155 -p1 -b .pk11-internal
 %patch156 -p1 -b .fips-code
 %patch157 -p1 -b .fips-tests
-%patch158 -p1 -b .rh1624100
 %patch159 -p1 -b .host-idn-disable
 %patch164 -p1 -b .fips-includes
 %patch165 -p1 -b .rt31459
@@ -521,23 +596,52 @@ are used for building ISC DHCP.
 %patch175 -p1 -b .json-c
 %patch177 -p1 -b .serve-stale
 %patch178 -p1 -b .time-monotonic
-%patch179 -p1 -b .rh1859454
-%patch180 -p1 -b .CVE-2020-8622
-%patch181 -p1 -b .CVE-2020-8623
-%patch182 -p1 -b .CVE-2020-8624
-%patch183 -p1 -b .CVE-2020-8624-test
+%patch183 -p1 -b .rh1980757
+%patch184 -p1 -b .rh2030239
+%patch185 -p1 -b .CVE-2021-25220
+%patch186 -p1 -b .CVE-2021-25220-test
+%patch188 -p1 -b .CVE-2022-38177
+%patch189 -p1 -b .CVE-2022-38178
+%patch190 -p1 -b .rh2101712
+%patch191 -p1 -b .CVE-2022-2795
+%patch192 -p1 -b .rh2133889
+%patch193 -p1 -b .CVE-2022-3094
+%patch194 -p1 -b .CVE-2022-3094
+%patch195 -p1 -b .CVE-2022-3094
+%patch196 -p1 -b .CVE-2022-3094-test
+%patch197 -p1 -b .CVE-2023-2828
+%patch198 -p1 -b .CVE-2023-3341
+%patch199 -p1 -b .RHEL-11785
+%patch200 -p1 -b .b.root-servers.net
+%patch201 -p1 -b .CVE-2023-4408
+%patch202 -p1 -b .CVE-2023-50387+50868
+%patch203 -p1 -b .CVE-2023-2828-fixup
+%patch204 -p1 -b .CVE-2023-50387-fixup
+%patch205 -p1 -b .CVE-2024-1975
+%patch206 -p1 -b .CVE-2024-1737
+%patch208 -p1 -b .CVE-2024-1737-env
 
 mkdir lib/dns/tests/testdata/dstrandom
 cp -a %{SOURCE50} lib/dns/tests/testdata/dstrandom/random.data
 
+# Avoid having [FIXME: manual] on top of generated manual pages
+# Alternative approach due missing docbook5 style sheets.
+# Remove namespace, so docbook is threated as version 4.
+# Spaces should be fine.
+# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/4524
+find bin lib/lwres/man -name '*.docbook' -exec \
+  sed -e 's|<refmiscinfo>BIND9|<refmiscinfo class="manual">BIND9|' \
+      -e 's|xmlns="http://docbook.org/ns/docbook"\sversion="5.0"\s||' \
+      -i '{}' ';'
+
 %if %{with PKCS11}
+%patch150 -p1 -b .engine-pkcs11
 cp -r bin/named{,-pkcs11}
 cp -r bin/dnssec{,-pkcs11}
 cp -r lib/isc{,-pkcs11}
 cp -r lib/dns{,-pkcs11}
 %patch136 -p1 -b .dist_pkcs11
 %patch149 -p1 -b .kyua-pkcs11
-%patch150 -p1 -b .engine-pkcs11
 %endif
 
 %if %{with SDB}
@@ -658,6 +762,14 @@ export LIBDIR_SUFFIX
 %else
   --with-lmdb=no \
 %endif
+%if %{with JSON}
+  --with-libjson \
+%endif
+%if %{with DNSTAP}
+  --enable-dnstap \
+%else
+  --disable-dnstap \
+%endif
 %if %{with UNITTEST}
   --with-cmocka \
 %endif
@@ -665,6 +777,15 @@ export LIBDIR_SUFFIX
   --with-docbook-xsl=%{_datadir}/sgml/docbook/xsl-stylesheets \
   --enable-full-report \
 ;
+%if %{with DNSTAP}
+  pushd lib
+  SRCLIB="../../../lib"
+  (cd dns && ln -s ${SRCLIB}/dns/dnstap.proto)
+%if %{with PKCS11}
+  (cd dns-pkcs11 && ln -s ${SRCLIB}/dns-pkcs11/dnstap.proto)
+%endif
+  popd
+%endif
 make %{?_smp_mflags}
 
 ### FIXME hack!!!
@@ -682,6 +803,11 @@ pushd bin/python
 make man
 popd
 
+%if %{with DOC}
+  # Does not work. Use upstream generated documentation instead.
+  # make doc
+%endif
+
 %if %{with DLZ}
   pushd contrib/dlz
   pushd modules
@@ -782,7 +908,7 @@ sed -e "/^\s*include(/ d" -e 's/^-- use //' \
 %endif
 
 %check
-%if %{with PKCS11}
+%if %{with PKCS11} && (%{with UNITTEST} || %{with SYSTEMTEST})
   # Tests require initialization of pkcs11 token
   export SOFTHSM2_CONF="`pwd`/softhsm2.conf"
   sh %{SOURCE48} "${SOFTHSM2_CONF}" "`pwd`/softhsm-tokens"
@@ -967,14 +1093,6 @@ popd
 # Remove libtool .la files:
 find ${RPM_BUILD_ROOT}/%{_libdir} -name '*.la' -exec '/bin/rm' '-f' '{}' ';';
 
-# Remove -devel files out of buildroot if not needed
-%if !%{with DEVEL}
-rm -f ${RPM_BUILD_ROOT}/%{_libdir}/bind9/*so
-rm -rf ${RPM_BUILD_ROOT}/%{_includedir}/bind9
-rm -f ${RPM_BUILD_ROOT}/%{_mandir}/man1/isc-config.sh.1*
-rm -f ${RPM_BUILD_ROOT}/%{_mandir}/man3/lwres*
-rm -f ${RPM_BUILD_ROOT}/%{_bindir}/isc-config.sh
-%endif
 
 # SDB manpages
 %if %{with SDB}
@@ -1000,6 +1118,11 @@ ln -s dnssec-verify.8.gz dnssec-verify-pkcs11.8.gz
 popd
 %endif
 
+%if %{with DOC}
+mkdir -p ${RPM_BUILD_ROOT}%{_pkgdocdir}
+cp -a doc/arm/*.html doc/arm/*.pdf ${RPM_BUILD_ROOT}%{_pkgdocdir}
+%endif
+
 # Ghost config files:
 touch ${RPM_BUILD_ROOT}%{_localstatedir}/log/named.log
 
@@ -1225,8 +1348,10 @@ rm -rf ${RPM_BUILD_ROOT}
 %{_mandir}/man8/rndc-confgen.8*
 %{_mandir}/man8/named-journalprint.8*
 %doc CHANGES README named.conf.default
-%doc doc/arm/*html doc/arm/*pdf
 %doc sample/
+%if %{without DOC}
+%doc doc/arm/*.html doc/arm/*.pdf
+%endif
 
 # Hide configuration
 %defattr(0640,root,named,0750)
@@ -1305,9 +1430,17 @@ rm -rf ${RPM_BUILD_ROOT}
 %{_sbindir}/isc-hmac-fixup
 %{_sbindir}/named-checkzone
 %{_sbindir}/named-compilezone
+%if %{with DNSTAP}
+%{_bindir}/dnstap-read
+%{_mandir}/man1/dnstap-read.1*
+%endif
 %if %{with LMDB}
 %{_sbindir}/named-nzd2nzf
 %endif
+%if %{with DNSTAP}
+%{_bindir}/dnstap-read
+%{_mandir}/man1/dnstap-read.1*
+%endif
 %{_mandir}/man1/host.1*
 %{_mandir}/man1/nsupdate.1*
 %{_mandir}/man1/dig.1*
@@ -1330,7 +1463,6 @@ rm -rf ${RPM_BUILD_ROOT}
 %endif
 %{_sysconfdir}/trusted-key.key
 
-%if %{with DEVEL}
 %files devel
 %{_libdir}/libbind9.so
 %{_libdir}/libisccc.so
@@ -1344,7 +1476,6 @@ rm -rf ${RPM_BUILD_ROOT}
 %{_mandir}/man3/lwres*
 %{_bindir}/isc-config.sh
 %{_bindir}/bind9-config
-%endif
 
 %files lite-devel
 %{_libdir}/libdns.so
@@ -1387,6 +1518,7 @@ rm -rf ${RPM_BUILD_ROOT}
 %dir %{chroot_prefix}/%{_libdir}
 %dir %{chroot_prefix}/%{_libdir}/bind
 %dir %{chroot_prefix}/%{_datadir}/GeoIP
+%{chroot_prefix}/proc
 %defattr(0660,root,named,01770)
 %dir %{chroot_prefix}%{_localstatedir}/named
 %defattr(0660,named,named,0770)
@@ -1532,8 +1664,115 @@ rm -rf ${RPM_BUILD_ROOT}
 %{python3_sitelib}/*.egg-info
 %{python3_sitelib}/isc/
 
+%if %{with DOC}
+%files doc
+%dir %{_pkgdocdir}
+%doc %{_pkgdocdir}/*.html
+%doc %{_pkgdocdir}/*.pdf
+%endif
 
 %changelog
+* Tue Aug 06 2024 Petr Menšík <pemensik@redhat.com> - 32:9.11.36-16.2
+- Rebuild after CI change
+
+* Thu Jul 18 2024 Petr Menšík <pemensik@redhat.com> - 32:9.11.36-16.1
+- Resolve CVE-2024-1975
+- Resolve CVE-2024-1737
+- Add ability to change runtime limits for max types and records per name
+
+* Mon Apr 15 2024 Petr Menšík <pemensik@redhat.com> - 32:9.11.36-16
+- Ensure incompatible dhcp is not accepted
+
+* Fri Apr 12 2024 Petr Menšík <pemensik@redhat.com> - 32:9.11.36-15
+- Ensure incompatible bind-dyndb-ldap is not accepted
+
+* Mon Feb 26 2024 Petr Menšík <pemensik@redhat.com> - 32:9.11.36-14
+- Speed up parsing of DNS messages with many different names (CVE-2023-4408)
+- Prevent increased CPU consumption in DNSSEC validator (CVE-2023-50387 CVE-2023-50868)
+- Do not use header_prev in expire_lru_headers
+
+* Thu Dec 07 2023 Petr Menšík <pemensik@redhat.com> - 32:9.11.36-13
+- Update addresses of b.root-servers.net (RHEL-18449)
+
+* Mon Oct 09 2023 Petr Menšík <pemensik@redhat.com> - 32:9.11.36-12
+- Disable caching of stale records by default (RHEL-11785)
+
+* Tue Sep 19 2023 Petr Menšík <pemensik@redhat.com> - 32:9.11.36-11
+- Prevent exahustion of memory from control channel (CVE-2023-3341)
+
+* Thu Jun 22 2023 Petr Menšík <pemensik@redhat.com> - 32:9.11.36-10
+- Prevent the cache going over the configured limit (CVE-2023-2828)
+
+* Wed Feb 08 2023 Petr Menšík <pemensik@redhat.com> - 32:9.11.36-9
+- Prevent flooding with UPDATE requests (CVE-2022-3094)
+- include upstream test for that change
+
+* Thu Oct 13 2022 Petr Menšík <pemensik@redhat.com> - 32:9.11.36-8
+- Correct regression preventing bind-dyndb-ldap build (#2133889)
+
+* Thu Sep 29 2022 Petr Menšík <pemensik@redhat.com> - 32:9.11.36-7
+- Prevent excessive resource use while processing large delegations.
+  (CVE-2022-2795)
+
+* Thu Sep 22 2022 Petr Menšík <pemensik@redhat.com> - 32:9.11.36-6
+- Prevent freeing zone during statistics rendering (#2101712)
+
+* Thu Sep 22 2022 Petr Menšík <pemensik@redhat.com> - 32:9.11.36-5
+- Fix memory leak in ECDSA verify processing (CVE-2022-38177)
+- Fix memory leak in EdDSA verify processing (CVE-2022-38178)
+
+* Wed Apr 13 2022 Petr Menšík <pemensik@redhat.com> - 32:9.11.36-4
+- Tighten cache protection against record from forwarders (CVE-2021-25220)
+- Include test of forwarders
+
+* Thu Feb 10 2022 Petr Menšík <pemensik@redhat.com> - 32:9.11.36-2
+- Reduce memory used per-view on machine with few processors (#2030239)
+
+* Tue Dec 21 2021 Petr Menšík <pemensik@redhat.com> - 32:9.11.36-2
+- Rebuilt on a new side-tag (#2013993)
+
+* Mon Nov 01 2021 Petr Menšík <pemensik@redhat.com> - 32:9.11.36-1
+- Update to 9.11.36
+
+* Mon Nov 01 2021 Petr Menšík <pemensik@redhat.com> - 32:9.11.26-9
+- Correct tsig system test
+
+* Wed Oct 13 2021 Petr Menšík <pemensik@redhat.com> - 32:9.11.26-8
+- Propagate ephemeral port ranges to chroot (#1950714)
+
+* Tue Aug 24 2021 Petr Menšík <pemensik@redhat.com> - 32:9.11.26-7
+- Do not request softhsm from bind-pkcs11, it is only in modular build
+  (#1934035)
+
+* Fri Jul 09 2021 Petr Menšík <pemensik@redhat.com> - 32:9.11.26-6
+- Use random entropy to generate unique TKEY identifiers (#1980916)
+
+* Fri May 07 2021 Petr Menšík <pemensik@redhat.com> - 32:9.11.26-5
+- Fix possible assertion failure isc_refcount_current == 0 in free_rbtdb
+  (#1953056)
+
+* Tue Apr 27 2021 Petr Menšík <pemensik@redhat.com> - 32:9.11.26-4
+- Possible assertion failure on DNAME processing (CVE-2021-25215)
+- Insufficient IXFR checks could lead to assertion failure (CVE-2021-25214)
+
+* Mon Feb 15 2021 Petr Menšík <pemensik@redhat.com> - 32:9.11.26-3
+- Fix off-by-one bug in ISC SPNEGO implementation (CVE-2020-8625)
+
+* Tue Jan 05 2021 Petr Menšík <pemensik@redhat.com> - 32:9.11.26-2
+- Add DNSTAP support (#1854148), new dnstap-read tool
+- Add JSON support in statistics-channel (#1899257)
+
+* Mon Jan 04 2021 Petr Menšík <pemensik@redhat.com> - 32:9.11.26-1
+- Update to 9.11.26
+
+* Thu Nov 26 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.25-1
+- Update to 9.11.25
+- Require libcap from devel package
+- Fix crash on NTA recheck failure (#1893761)
+
+* Fri Sep 25 2020 Tomas Korbar <tkorbar@redhat.com> - 32:9.11.20-6
+- Do not ignore RPZ wildcard passthru (#1876492)
+
 * Tue Aug 18 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.20-5
 - Fix tsig-request verify (CVE-2020-8622)
 - Prevent PKCS11 daemon crash on crafted packet (CVE-2020-8623)