bind9.16 package is retired on branch c10s for CS-2551

2024-10-02 16:18:55 +00:00 · 2024-10-02 16:18:55 +00:00 · 93f9fd3884
commit 93f9fd3884
parent aec75c660e
22 changed files with 4 additions and 4828 deletions
--- a/.gitignore
+++ b/.gitignore
@ -1,2 +0,0 @@
 SOURCES/bind-9.16.23.tar.xz
 /bind-9.16.23.tar.xz
--- a/README.md
+++ b/README.md
@ -0,0 +1,3 @@
 # Package Not Available
 This package is not available on CentOS Stream 10.
 It may be available on another branch.
--- a/bind-9.10-dist-native-pkcs11.patch
+++ b/bind-9.10-dist-native-pkcs11.patch
@ -1,550 +0,0 @@
 From 040227009453b3f0aa7914c7a6a94dc57ad5269b Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Thu, 21 Jan 2021 10:46:20 +0100
 Subject: [PATCH] Enable custom pkcs11 native build
 Share common parts like libisc, libcc and others. But provide native
 pkcs11 libraries as a new copy of libdns and libns.
 ---
 bin/Makefile.in                  |  2 +-
 bin/confgen/Makefile.in          |  2 +-
 bin/dnssec-pkcs11/Makefile.in    | 39 +++++++++++++++++---------------
 bin/named-pkcs11/Makefile.in     | 33 ++++++++++++++-------------
 configure.ac                     | 19 ++++++++++++++++
 lib/Makefile.in                  |  2 +-
 lib/dns-pkcs11/Makefile.in       | 22 +++++++++---------
 lib/dns-pkcs11/tests/Makefile.in |  8 +++----
 lib/ns-pkcs11/Makefile.in        | 26 ++++++++++-----------
 lib/ns-pkcs11/tests/Makefile.in  | 12 +++++-----
 make/includes.in                 |  7 ++++++
 11 files changed, 101 insertions(+), 71 deletions(-)
 diff --git a/bin/Makefile.in b/bin/Makefile.in
 index 9ad7f62..094775a 100644
 --- a/bin/Makefile.in
 +++ b/bin/Makefile.in
@@ -11,7 +11,7 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 -SUBDIRS =	named rndc dig delv dnssec tools nsupdate check confgen \
 +SUBDIRS =	named named-pkcs11 rndc dig delv dnssec dnssec-pkcs11 tools nsupdate check confgen \
 		@NZD_TOOLS@ @PYTHON_TOOLS@ @PKCS11_TOOLS@ plugins tests
 TARGETS =
 diff --git a/bin/confgen/Makefile.in b/bin/confgen/Makefile.in
 index c126bf3..1b7512d 100644
 --- a/bin/confgen/Makefile.in
 +++ b/bin/confgen/Makefile.in
@@ -22,7 +22,7 @@ VERSION=@BIND9_VERSION@
 CINCLUDES = -I${srcdir}/include ${ISC_INCLUDES} ${ISCCC_INCLUDES} \
 	${ISCCFG_INCLUDES} ${DNS_INCLUDES} ${BIND9_INCLUDES}
 -CDEFINES = @USE_PKCS11@
 +CDEFINES =
 CWARNINGS =
 ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
 diff --git a/bin/dnssec-pkcs11/Makefile.in b/bin/dnssec-pkcs11/Makefile.in
 index ace0e5a..e0f6a00 100644
 --- a/bin/dnssec-pkcs11/Makefile.in
 +++ b/bin/dnssec-pkcs11/Makefile.in
@@ -15,18 +15,18 @@ VERSION=@BIND9_VERSION@
 @BIND9_MAKE_INCLUDES@
 -CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} ${ISCCFG_INCLUDES} \
 +CINCLUDES =	${DNS_PKCS11_INCLUDES} ${ISC_INCLUDES} ${ISCCFG_INCLUDES} \
 		${OPENSSL_CFLAGS}
 -CDEFINES =	-DVERSION=\"${VERSION}\" -DNAMED_CONFFILE=\"${sysconfdir}/named.conf\"
 +CDEFINES =	-DVERSION=\"${VERSION}\" -DNAMED_CONFFILE=\"${sysconfdir}/named.conf\" -DUSE_PKCS11=1
 CWARNINGS =
 -DNSLIBS =	../../lib/dns/libdns.@A@ @NO_LIBTOOL_DNSLIBS@
 +DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ @NO_LIBTOOL_DNSLIBS@
 ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
 ISCLIBS =	../../lib/isc/libisc.@A@ @NO_LIBTOOL_ISCLIBS@
 ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @NO_LIBTOOL_ISCLIBS@
 -DNSDEPLIBS =	../../lib/dns/libdns.@A@
 +DNSDEPLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@
 ISCDEPLIBS =	../../lib/isc/libisc.@A@
 ISCCFGDEPLIBS =	../../lib/isccfg/libisccfg.@A@
@@ -36,12 +36,15 @@ LIBS =		${DNSLIBS} ${ISCCFGLIBS} ${ISCLIBS} @LIBS@
 NOSYMLIBS =	${DNSLIBS} ${ISCCFGLIBS} ${ISCNOSYMLIBS} @LIBS@
 +# Add suffix to all targets
 +EXEEXT =	-pkcs11@EXEEXT@
 +
 # Alphabetically
 -TARGETS =	dnssec-cds@EXEEXT@ dnssec-dsfromkey@EXEEXT@ \
 -		dnssec-importkey@EXEEXT@ dnssec-keyfromlabel@EXEEXT@ \
 -		dnssec-keygen@EXEEXT@ dnssec-revoke@EXEEXT@ \
 -		dnssec-settime@EXEEXT@ dnssec-signzone@EXEEXT@ \
 -		dnssec-verify@EXEEXT@
 +TARGETS =	dnssec-cds${EXEEXT} dnssec-dsfromkey${EXEEXT} \
 +		dnssec-importkey${EXEEXT} dnssec-keyfromlabel${EXEEXT} \
 +		dnssec-keygen${EXEEXT} dnssec-revoke${EXEEXT} \
 +		dnssec-settime${EXEEXT} dnssec-signzone${EXEEXT} \
 +		dnssec-verify${EXEEXT}
 OBJS =		dnssectool.@O@
@@ -52,19 +55,19 @@ SRCS =		dnssec-cds.c dnssec-dsfromkey.c dnssec-importkey.c \
 @BIND9_MAKE_RULES@
 -dnssec-cds@EXEEXT@: dnssec-cds.@O@ ${OBJS} ${DEPLIBS}
 +dnssec-cds-pkcs11@EXEEXT@: dnssec-cds.@O@ ${OBJS} ${DEPLIBS}
 	export BASEOBJS="dnssec-cds.@O@ ${OBJS}"; \
 	${FINALBUILDCMD}
 -dnssec-dsfromkey@EXEEXT@: dnssec-dsfromkey.@O@ ${OBJS} ${DEPLIBS}
 +dnssec-dsfromkey-pkcs11@EXEEXT@: dnssec-dsfromkey.@O@ ${OBJS} ${DEPLIBS}
 	export BASEOBJS="dnssec-dsfromkey.@O@ ${OBJS}"; \
 	${FINALBUILDCMD}
 -dnssec-keyfromlabel@EXEEXT@: dnssec-keyfromlabel.@O@ ${OBJS} ${DEPLIBS}
 +dnssec-keyfromlabel-pkcs11@EXEEXT@: dnssec-keyfromlabel.@O@ ${OBJS} ${DEPLIBS}
 	export BASEOBJS="dnssec-keyfromlabel.@O@ ${OBJS}"; \
 	${FINALBUILDCMD}
 -dnssec-keygen@EXEEXT@: dnssec-keygen.@O@ ${OBJS} ${DEPLIBS}
 +dnssec-keygen-pkcs11@EXEEXT@: dnssec-keygen.@O@ ${OBJS} ${DEPLIBS}
 	export BASEOBJS="dnssec-keygen.@O@ ${OBJS}"; \
 	${FINALBUILDCMD}
@@ -72,7 +75,7 @@ dnssec-signzone.@O@: dnssec-signzone.c
 	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} -DVERSION=\"${VERSION}\" \
 		-c ${srcdir}/dnssec-signzone.c
 -dnssec-signzone@EXEEXT@: dnssec-signzone.@O@ ${OBJS} ${DEPLIBS}
 +dnssec-signzone-pkcs11@EXEEXT@: dnssec-signzone.@O@ ${OBJS} ${DEPLIBS}
 	export BASEOBJS="dnssec-signzone.@O@ ${OBJS}"; \
 	${FINALBUILDCMD}
@@ -80,19 +83,19 @@ dnssec-verify.@O@: dnssec-verify.c
 	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} -DVERSION=\"${VERSION}\" \
 		-c ${srcdir}/dnssec-verify.c
 -dnssec-verify@EXEEXT@: dnssec-verify.@O@ ${OBJS} ${DEPLIBS}
 +dnssec-verify-pkcs11@EXEEXT@: dnssec-verify.@O@ ${OBJS} ${DEPLIBS}
 	export BASEOBJS="dnssec-verify.@O@ ${OBJS}"; \
 	${FINALBUILDCMD}
 -dnssec-revoke@EXEEXT@: dnssec-revoke.@O@ ${OBJS} ${DEPLIBS}
 +dnssec-revoke-pkcs11@EXEEXT@: dnssec-revoke.@O@ ${OBJS} ${DEPLIBS}
 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \
 	dnssec-revoke.@O@ ${OBJS} ${LIBS}
 -dnssec-settime@EXEEXT@: dnssec-settime.@O@ ${OBJS} ${DEPLIBS}
 +dnssec-settime-pkcs11@EXEEXT@: dnssec-settime.@O@ ${OBJS} ${DEPLIBS}
 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \
 	dnssec-settime.@O@ ${OBJS} ${LIBS}
 -dnssec-importkey@EXEEXT@: dnssec-importkey.@O@ ${OBJS} ${DEPLIBS}
 +dnssec-importkey-pkcs11@EXEEXT@: dnssec-importkey.@O@ ${OBJS} ${DEPLIBS}
 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \
 	dnssec-importkey.@O@ ${OBJS} ${LIBS}
 diff --git a/bin/named-pkcs11/Makefile.in b/bin/named-pkcs11/Makefile.in
 index 98125dd..518a75f 100644
 --- a/bin/named-pkcs11/Makefile.in
 +++ b/bin/named-pkcs11/Makefile.in
@@ -37,13 +37,14 @@ DBDRIVER_LIBS =
 DLZ_DRIVER_DIR =	${top_srcdir}/contrib/dlz/drivers
 -DLZDRIVER_OBJS =	@DLZ_DRIVER_OBJS@
 -DLZDRIVER_SRCS =	@DLZ_DRIVER_SRCS@
 -DLZDRIVER_INCLUDES =	@DLZ_DRIVER_INCLUDES@
 -DLZDRIVER_LIBS =	@DLZ_DRIVER_LIBS@
 +# Skip building on PKCS11 variant
 +DLZDRIVER_OBJS =
 +DLZDRIVER_SRCS =
 +DLZDRIVER_INCLUDES =
 +DLZDRIVER_LIBS =
 CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
 -		${NS_INCLUDES} ${DNS_INCLUDES} \
 +		${NS_PKCS11_INCLUDES} ${DNS_PKCS11_INCLUDES} \
 		${BIND9_INCLUDES} ${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} \
 		${ISC_INCLUDES} ${DLZDRIVER_INCLUDES} \
 		${DBDRIVER_INCLUDES} \
@@ -56,24 +57,24 @@ CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
 		${LIBXML2_CFLAGS} \
 		${MAXMINDDB_CFLAGS}
 -CDEFINES =      @CONTRIB_DLZ@
 +CDEFINES =
 CWARNINGS =
 -DNSLIBS =	../../lib/dns/libdns.@A@ @NO_LIBTOOL_DNSLIBS@
 +DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ @NO_LIBTOOL_DNSLIBS@
 ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
 ISCCCLIBS =	../../lib/isccc/libisccc.@A@
 ISCLIBS =	../../lib/isc/libisc.@A@ @NO_LIBTOOL_ISCLIBS@
 ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @NO_LIBTOOL_ISCLIBS@
 BIND9LIBS =	../../lib/bind9/libbind9.@A@
 -NSLIBS =	../../lib/ns/libns.@A@
 +NSLIBS =	../../lib/ns-pkcs11/libns-pkcs11.@A@
 -DNSDEPLIBS =	../../lib/dns/libdns.@A@
 +DNSDEPLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@
 ISCCFGDEPLIBS =	../../lib/isccfg/libisccfg.@A@
 ISCCCDEPLIBS =	../../lib/isccc/libisccc.@A@
 ISCDEPLIBS =	../../lib/isc/libisc.@A@
 BIND9DEPLIBS =	../../lib/bind9/libbind9.@A@
 -NSDEPLIBS =	../../lib/ns/libns.@A@
 +NSDEPLIBS =	../../lib/ns-pkcs11/libns-pkcs11.@A@
 DEPLIBS =	${NSDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
 		${ISCCFGDEPLIBS} ${ISCCCDEPLIBS} ${ISCDEPLIBS}
@@ -93,7 +94,7 @@ NOSYMLIBS =	${NSLIBS} ${DNSLIBS} ${BIND9LIBS} \
 SUBDIRS =	unix
 -TARGETS =	named@EXEEXT@ feature-test@EXEEXT@
 +TARGETS =	named-pkcs11@EXEEXT@ feature-test-pkcs11@EXEEXT@
 GEOIP2LINKOBJS = geoip.@O@
@@ -151,7 +152,7 @@ server.@O@: server.c
 		-DPRODUCT=\"${PRODUCT}\" \
 		-DVERSION=\"${VERSION}\" -c ${srcdir}/server.c
 -named@EXEEXT@: ${OBJS} ${DEPLIBS}
 +named-pkcs11@EXEEXT@: ${OBJS} ${DEPLIBS}
 	export MAKE_SYMTABLE="yes"; \
 	export BASEOBJS="${OBJS} ${UOBJS}"; \
 	${FINALBUILDCMD}
@@ -161,7 +162,7 @@ feature-test.@O@: ${top_srcdir}/bin/tests/system/feature-test.c
 	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} \
 		-c ${top_srcdir}/bin/tests/system/feature-test.c
 -feature-test@EXEEXT@: feature-test.@O@
 +feature-test-pkcs11@EXEEXT@: feature-test.@O@
 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} \
 		-o $@ feature-test.@O@ ${ISCLIBS} ${LIBS}
@@ -180,11 +181,11 @@ statschannel.@O@: bind9.xsl.h
 installdirs:
 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
 -install:: named@EXEEXT@ installdirs
 -	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named@EXEEXT@ ${DESTDIR}${sbindir}
 +install:: named-pkcs11@EXEEXT@ installdirs
 +	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named-pkcs11@EXEEXT@ ${DESTDIR}${sbindir}
 uninstall::
 -	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/named@EXEEXT@
 +	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/named-pkcs11@EXEEXT@
 @DLZ_DRIVER_RULES@
 diff --git a/configure.ac b/configure.ac
 index 032228b..64e3da0 100644
 --- a/configure.ac
 +++ b/configure.ac
@@ -1251,12 +1251,14 @@ AC_SUBST(USE_GSSAPI)
 AC_SUBST(DST_GSSAPI_INC)
 AC_SUBST(DNS_GSSAPI_LIBS)
 DNS_CRYPTO_LIBS="$DNS_GSSAPI_LIBS"
 +DNS_CRYPTO_PK11_LIBS="$DNS_GSSAPI_LIBS $DNS_CRYPTO_PK11_LIBS"
 #
 # Applications linking with libdns also need to link with these libraries.
 #
 AC_SUBST(DNS_CRYPTO_LIBS)
 +AC_SUBST(DNS_CRYPTO_PK11_LIBS)
 #
 # was --with-lmdb specified?
@@ -2327,6 +2329,8 @@ AC_SUBST(BIND9_DNS_BUILDINCLUDE)
 AC_SUBST(BIND9_NS_BUILDINCLUDE)
 AC_SUBST(BIND9_BIND9_BUILDINCLUDE)
 AC_SUBST(BIND9_IRS_BUILDINCLUDE)
 +AC_SUBST(BIND9_DNS_PKCS11_BUILDINCLUDE)
 +AC_SUBST(BIND9_NS_PKCS11_BUILDINCLUDE)
 if test "X$srcdir" != "X"; then
 	BIND9_ISC_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/isc/include"
 	BIND9_ISCCC_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/isccc/include"
@@ -2335,6 +2339,8 @@ if test "X$srcdir" != "X"; then
 	BIND9_NS_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/ns/include"
 	BIND9_BIND9_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/bind9/include"
 	BIND9_IRS_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/irs/include"
 +	BIND9_DNS_PKCS11_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/dns-pkcs11/include"
 +	BIND9_NS_PKCS11_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/ns-pkcs11/include"
 else
 	BIND9_ISC_BUILDINCLUDE=""
 	BIND9_ISCCC_BUILDINCLUDE=""
@@ -2343,6 +2349,8 @@ else
 	BIND9_NS_BUILDINCLUDE=""
 	BIND9_BIND9_BUILDINCLUDE=""
 	BIND9_IRS_BUILDINCLUDE=""
 +	BIND9_DNS_PKCS11_BUILDINCLUDE=""
 +	BIND9_NS_PKCS11_BUILDINCLUDE=""
 fi
 AC_SUBST_FILE(BIND9_MAKE_INCLUDES)
@@ -2798,8 +2806,11 @@ AC_CONFIG_FILES([
 	bin/delv/Makefile
 	bin/dig/Makefile
 	bin/dnssec/Makefile
 +	bin/dnssec-pkcs11/Makefile
 	bin/named/Makefile
 	bin/named/unix/Makefile
 +	bin/named-pkcs11/Makefile
 +	bin/named-pkcs11/unix/Makefile
 	bin/nsupdate/Makefile
 	bin/pkcs11/Makefile
 	bin/plugins/Makefile
@@ -2861,6 +2872,10 @@ AC_CONFIG_FILES([
 	lib/dns/include/dns/Makefile
 	lib/dns/include/dst/Makefile
 	lib/dns/tests/Makefile
 +	lib/dns-pkcs11/Makefile
 +	lib/dns-pkcs11/include/Makefile
 +	lib/dns-pkcs11/include/dns/Makefile
 +	lib/dns-pkcs11/include/dst/Makefile
 	lib/irs/Makefile
 	lib/irs/include/Makefile
 	lib/irs/include/irs/Makefile
@@ -2893,6 +2908,10 @@ AC_CONFIG_FILES([
 	lib/ns/include/Makefile
 	lib/ns/include/ns/Makefile
 	lib/ns/tests/Makefile
 +	lib/ns-pkcs11/Makefile
 +	lib/ns-pkcs11/include/Makefile
 +	lib/ns-pkcs11/include/ns/Makefile
 +	lib/ns-pkcs11/tests/Makefile
 	make/Makefile
 	make/mkdep
 	unit/unittest.sh
 diff --git a/lib/Makefile.in b/lib/Makefile.in
 index 833964e..058ba2f 100644
 --- a/lib/Makefile.in
 +++ b/lib/Makefile.in
@@ -15,7 +15,7 @@ top_srcdir =	@top_srcdir@
 # Attempt to disable parallel processing.
 .NOTPARALLEL:
 .NO_PARALLEL:
 -SUBDIRS =	isc isccc dns ns isccfg bind9 irs
 +SUBDIRS =	isc isccc dns dns-pkcs11 ns ns-pkcs11 isccfg bind9 irs
 TARGETS =
 @BIND9_MAKE_RULES@
 diff --git a/lib/dns-pkcs11/Makefile.in b/lib/dns-pkcs11/Makefile.in
 index 58bda3c..d6a45df 100644
 --- a/lib/dns-pkcs11/Makefile.in
 +++ b/lib/dns-pkcs11/Makefile.in
@@ -22,7 +22,7 @@ VERSION=@BIND9_VERSION@
 @BIND9_MAKE_INCLUDES@
 -CINCLUDES =	-I. -I${top_srcdir}/lib/dns -Iinclude ${DNS_INCLUDES} \
 +CINCLUDES =	-I. -I${top_srcdir}/lib/dns-pkcs11 -Iinclude ${DNS_PKCS11_INCLUDES} \
 		${ISC_INCLUDES} \
 		${FSTRM_CFLAGS} \
 		${OPENSSL_CFLAGS} @DST_GSSAPI_INC@ \
@@ -32,7 +32,7 @@ CINCLUDES =	-I. -I${top_srcdir}/lib/dns -Iinclude ${DNS_INCLUDES} \
 		${LMDB_CFLAGS} \
 		${MAXMINDDB_CFLAGS}
 -CDEFINES =	@USE_GSSAPI@
 +CDEFINES =	@USE_GSSAPI@ @USE_PKCS11@
 CWARNINGS =
@@ -135,15 +135,15 @@ version.@O@: version.c
 		-DMAPAPI=\"${MAPAPI}\" \
 		-c ${srcdir}/version.c
 -libdns.@SA@: ${OBJS}
 +libdns-pkcs11.@SA@: ${OBJS}
 	${AR} ${ARFLAGS} $@ ${OBJS}
 	${RANLIB} $@
 -libdns.la: ${OBJS}
 +libdns-pkcs11.la: ${OBJS}
 	${LIBTOOL_MODE_LINK} \
 -		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libdns.la -rpath ${libdir} \
 +		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libdns-pkcs11.la -rpath ${libdir} \
 		-release "${VERSION}" \
 -		${OBJS} ${ISCLIBS} @DNS_CRYPTO_LIBS@ ${LIBS}
 +		${OBJS} ${ISCLIBS} @DNS_CRYPTO_PK11_LIBS@ ${LIBS}
 include: gen
 	${MAKE} include/dns/enumtype.h
@@ -174,22 +174,22 @@ gen: gen.c
 	${BUILD_CPPFLAGS} ${BUILD_LDFLAGS} -o $@ ${srcdir}/gen.c \
 	${BUILD_LIBS} ${LFS_LIBS}
 -timestamp: include libdns.@A@
 +timestamp: include libdns-pkcs11.@A@
 	touch timestamp
 -testdirs: libdns.@A@
 +testdirs: libdns-pkcs11.@A@
 installdirs:
 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${libdir}
 install:: timestamp installdirs
 -	${LIBTOOL_MODE_INSTALL} ${INSTALL_LIBRARY} libdns.@A@ ${DESTDIR}${libdir}
 +	${LIBTOOL_MODE_INSTALL} ${INSTALL_LIBRARY} libdns-pkcs11.@A@ ${DESTDIR}${libdir}
 uninstall::
 -	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${libdir}/libdns.@A@
 +	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${libdir}/libdns-pkcs11.@A@
 clean distclean::
 -	rm -f libdns.@A@ timestamp
 +	rm -f libdns-pkcs11.@A@ timestamp
 	rm -f gen code.h include/dns/enumtype.h include/dns/enumclass.h
 	rm -f include/dns/rdatastruct.h
 	rm -f dnstap.pb-c.c dnstap.pb-c.h
 diff --git a/lib/dns-pkcs11/tests/Makefile.in b/lib/dns-pkcs11/tests/Makefile.in
 index 3bb5e01..c96fe7d 100644
 --- a/lib/dns-pkcs11/tests/Makefile.in
 +++ b/lib/dns-pkcs11/tests/Makefile.in
@@ -15,15 +15,15 @@ VERSION=@BIND9_VERSION@
 @BIND9_MAKE_INCLUDES@
 -CINCLUDES =	-I. -Iinclude ${DNS_INCLUDES} ${ISC_INCLUDES} \
 +CINCLUDES =	-I. -Iinclude ${DNS_PKCS11_INCLUDES} ${ISC_INCLUDES} \
 		${FSTRM_CFLAGS} ${OPENSSL_CFLAGS} \
 		${PROTOBUF_C_CFLAGS} ${MAXMINDDB_CFLAGS} @CMOCKA_CFLAGS@
 -CDEFINES =	-DTESTS="\"${top_builddir}/lib/dns/tests/\""
 +CDEFINES =	@USE_PKCS11@ -DTESTS="\"${top_builddir}/lib/dns-pkcs11/tests/\""
 ISCLIBS =	../../isc/libisc.@A@ @NO_LIBTOOL_ISCLIBS@
 ISCDEPLIBS =	../../isc/libisc.@A@
 -DNSLIBS =	../libdns.@A@ @NO_LIBTOOL_DNSLIBS@
 -DNSDEPLIBS =	../libdns.@A@
 +DNSLIBS =	../libdns-pkcs11.@A@ @NO_LIBTOOL_DNSLIBS@
 +DNSDEPLIBS =	../libdns-pkcs11.@A@
 LIBS =		@LIBS@ @CMOCKA_LIBS@
 diff --git a/lib/ns-pkcs11/Makefile.in b/lib/ns-pkcs11/Makefile.in
 index bc683ce..7a9d2f2 100644
 --- a/lib/ns-pkcs11/Makefile.in
 +++ b/lib/ns-pkcs11/Makefile.in
@@ -16,12 +16,12 @@ VERSION=@BIND9_VERSION@
 @BIND9_MAKE_INCLUDES@
 -CINCLUDES =	-I. -I${top_srcdir}/lib/ns -Iinclude \
 -		${NS_INCLUDES} ${DNS_INCLUDES} ${ISC_INCLUDES} \
 +CINCLUDES =	-I. -I${top_srcdir}/lib/ns-pkcs11 -Iinclude \
 +		${NS_PKCS11_INCLUDES} ${DNS_PKCS11_INCLUDES} ${ISC_INCLUDES} \
 		${OPENSSL_CFLAGS} @DST_GSSAPI_INC@ \
 		${FSTRM_CFLAGS}
 -CDEFINES =	-DNAMED_PLUGINDIR=\"${plugindir}\"
 +CDEFINES =	@USE_PKCS11@ -DNAMED_PLUGINDIR=\"${plugindir}\"
 CWARNINGS =
@@ -29,9 +29,9 @@ ISCLIBS =	../../lib/isc/libisc.@A@
 ISCDEPLIBS =	../../lib/isc/libisc.@A@
 -DNSLIBS =	../../lib/dns/libdns.@A@ @NO_LIBTOOL_DNSLIBS@
 +DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ @NO_LIBTOOL_DNSLIBS@
 -DNSDEPLIBS =	../../lib/dns/libdns.@A@
 +DNSDEPLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@
 LIBS =		@LIBS@
@@ -60,28 +60,28 @@ version.@O@: version.c
 		-DMAJOR=\"${MAJOR}\" \
 		-c ${srcdir}/version.c
 -libns.@SA@: ${OBJS}
 +libns-pkcs11.@SA@: ${OBJS}
 	${AR} ${ARFLAGS} $@ ${OBJS}
 	${RANLIB} $@
 -libns.la: ${OBJS}
 +libns-pkcs11.la: ${OBJS}
 	${LIBTOOL_MODE_LINK} \
 -		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libns.la -rpath ${libdir} \
 +		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libns-pkcs11.la -rpath ${libdir} \
 		-release "${VERSION}" \
 -		${OBJS} ${ISCLIBS} ${DNSLIBS} @DNS_CRYPTO_LIBS@ ${LIBS}
 +		${OBJS} ${ISCLIBS} ${DNSLIBS} @DNS_CRYPTO_PK11_LIBS@ ${LIBS}
 -timestamp: libns.@A@
 +timestamp: libns-pkcs11.@A@
 	touch timestamp
 installdirs:
 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${libdir}
 install:: timestamp installdirs
 -	${LIBTOOL_MODE_INSTALL} ${INSTALL_LIBRARY} libns.@A@ \
 +	${LIBTOOL_MODE_INSTALL} ${INSTALL_LIBRARY} libns-pkcs11.@A@ \
 		${DESTDIR}${libdir}
 uninstall::
 -	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${libdir}/libns.@A@
 +	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${libdir}/libns-pkcs11.@A@
 clean distclean::
 -	rm -f libns.@A@ timestamp
 +	rm -f libns-pkcs11.@A@ timestamp
 diff --git a/lib/ns-pkcs11/tests/Makefile.in b/lib/ns-pkcs11/tests/Makefile.in
 index 4c3e694..c1b6d99 100644
 --- a/lib/ns-pkcs11/tests/Makefile.in
 +++ b/lib/ns-pkcs11/tests/Makefile.in
@@ -17,17 +17,17 @@ VERSION=@BIND9_VERSION@
 WRAP_OPTIONS =	-Wl,--wrap=isc__nmhandle_detach -Wl,--wrap=isc__nmhandle_attach
 -CINCLUDES =	-I. -Iinclude ${NS_INCLUDES} ${DNS_INCLUDES} ${ISC_INCLUDES} \
 +CINCLUDES =	-I. -Iinclude ${NS_PKCS11_INCLUDES} ${DNS_PKCS11_INCLUDES} ${ISC_INCLUDES} \
 		${OPENSSL_CFLAGS} \
 		@CMOCKA_CFLAGS@
 -CDEFINES =	-DTESTS="\"${top_builddir}/lib/ns/tests/\"" -DNAMED_PLUGINDIR=\"${plugindir}\"
 +CDEFINES =	-DTESTS="\"${top_builddir}/lib/ns-pkcs11/tests/\"" -DNAMED_PLUGINDIR=\"${plugindir}\" @USE_PKCS11@
 ISCLIBS =	../../isc/libisc.@A@ @NO_LIBTOOL_ISCLIBS@
 ISCDEPLIBS =	../../isc/libisc.@A@
 -DNSLIBS =	../../dns/libdns.@A@ @NO_LIBTOOL_DNSLIBS@
 -DNSDEPLIBS =	../../dns/libdns.@A@
 -NSLIBS =	../libns.@A@
 -NSDEPLIBS =	../libns.@A@
 +DNSLIBS =	../../dns-pkcs11/libdns-pkcs11.@A@ @NO_LIBTOOL_DNSLIBS@
 +DNSDEPLIBS =	../../dns-pkcs11/libdns-pkcs11.@A@
 +NSLIBS =	../libns-pkcs11.@A@
 +NSDEPLIBS =	../libns-pkcs11.@A@
 LIBS =		@LIBS@ @CMOCKA_LIBS@
 diff --git a/make/includes.in b/make/includes.in
 index b8317d3..b73b0c4 100644
 --- a/make/includes.in
 +++ b/make/includes.in
@@ -39,3 +39,10 @@ BIND9_INCLUDES = @BIND9_BIND9_BUILDINCLUDE@ \
 TEST_INCLUDES = \
 	-I${top_srcdir}/lib/tests/include
 +
 +DNS_PKCS11_INCLUDES = @BIND9_DNS_PKCS11_BUILDINCLUDE@ \
 +	-I${top_srcdir}/lib/dns-pkcs11/include
 +
 +NS_PKCS11_INCLUDES = @BIND9_NS_PKCS11_BUILDINCLUDE@ \
 +	-I${top_srcdir}/lib/ns-pkcs11/include
 +
 -- 
 2.26.3
--- a/bind-9.11-feature-test-named.patch
+++ b/bind-9.11-feature-test-named.patch
@ -1,70 +0,0 @@
 From e9e7069ede766fa5c881517bdae74e2fc6682398 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Wed, 30 Jan 2019 14:37:17 +0100
 Subject: [PATCH] Create feature-test in source directory
 Feature-test tool is used in system tests to test compiled in changes.
 Because we build more variants of named with different configuration,
 compile feature-test for each of them this way.
 Make gsstsig test supported
 ---
 bin/named/Makefile.in       | 14 ++++++++++++--
 bin/tests/system/conf.sh.in |  2 +-
 2 files changed, 13 insertions(+), 3 deletions(-)
 diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
 index debb906adc..dd894fe934 100644
 --- a/bin/named/Makefile.in
 +++ b/bin/named/Makefile.in
@@ -56,7 +56,7 @@ CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
 		${LIBXML2_CFLAGS} \
 		${MAXMINDDB_CFLAGS}
 -CDEFINES =      @CONTRIB_DLZ@
 +CDEFINES =	@USE_GSSAPI@ @CONTRIB_DLZ@
 CWARNINGS =
@@ -93,7 +93,7 @@ NOSYMLIBS =	${NSLIBS} ${DNSLIBS} ${BIND9LIBS} \
 SUBDIRS =	unix
 -TARGETS =	named@EXEEXT@
 +TARGETS =	named@EXEEXT@ feature-test@EXEEXT@
 GEOIP2LINKOBJS = geoip.@O@
@@ -156,6 +156,16 @@ named@EXEEXT@: ${OBJS} ${DEPLIBS}
 	export BASEOBJS="${OBJS} ${UOBJS}"; \
 	${FINALBUILDCMD}
 +# Bit of hack, do not produce intermediate .o object for featuretest
 +feature-test.@O@: ${top_srcdir}/bin/tests/system/feature-test.c
 +	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} \
 +		-c ${top_srcdir}/bin/tests/system/feature-test.c
 +
 +feature-test@EXEEXT@: feature-test.@O@
 +	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} \
 +		-o $@ feature-test.@O@ ${ISCLIBS} ${LIBS}
 +
 +
 clean distclean maintainer-clean::
 	rm -f ${TARGETS} ${OBJS}
 diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
 index 9a61622143..f69c5be334 100644
 --- a/bin/tests/system/conf.sh.in
 +++ b/bin/tests/system/conf.sh.in
@@ -38,7 +38,7 @@ DELV=$TOP/bin/delv/delv
 DIG=$TOP/bin/dig/dig
 DNSTAPREAD=$TOP/bin/tools/dnstap-read
 DSFROMKEY=$TOP/bin/dnssec/dnssec-dsfromkey
 -FEATURETEST=$TOP/bin/tests/system/feature-test
 +FEATURETEST=$TOP/bin/named/feature-test
 FSTRM_CAPTURE=@FSTRM_CAPTURE@
 HOST=$TOP/bin/dig/host
 IMPORTKEY=$TOP/bin/dnssec/dnssec-importkey
 -- 
 2.45.2
--- a/bind-9.11-fips-tests.patch
+++ b/bind-9.11-fips-tests.patch
@ -1,959 +0,0 @@
 From 3f04cf343dbeb8819197702ce1be737e26e0638a Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 2 Aug 2018 23:46:45 +0200
 Subject: [PATCH] FIPS tests changes
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Squashed commit of the following:
 commit 09e5eb48698d4fef2fc1031870de86c553b6bfaa
 Author: Petr Menšík <pemensik@redhat.com>
 Date:   Wed Mar 7 20:35:13 2018 +0100
    Fix nsupdate test. Do not use md5 by default for rndc, skip gracefully md5 if not available.
 commit ab303db70082db76ecf36493d0b82ef3e8750cad
 Author: Petr Menšík <pemensik@redhat.com>
 Date:   Wed Mar 7 18:11:10 2018 +0100
    Changed root key to be RSASHA256
    Change bad trusted key to be the same algorithm.
 commit 88ab07c0e14cc71247e1f9d11a1ea832b64c1ee8
 Author: Petr Menšík <pemensik@redhat.com>
 Date:   Wed Mar 7 16:56:17 2018 +0100
    Change used key to not use hmac-md5
    Fix upforwd test, do not use hmac-md5
 commit aec891571626f053acfb4d0a247240cbc21a84e9
 Author: Petr Menšík <pemensik@redhat.com>
 Date:   Wed Mar 7 15:54:11 2018 +0100
    Increase bitsize of DSA key to pass FIPS 140-2 mode.
 commit bca8e164fa0d9aff2f946b8b4eb0f1f7e0bf6696
 Author: Petr Menšík <pemensik@redhat.com>
 Date:   Wed Mar 7 15:41:08 2018 +0100
    Fix tsig and rndc tests for disabled md5
    Use hmac-sha256 instead of hmac-md5.
 commit 0d314c1ab6151aa13574a21ad22f28d3b7f42a67
 Author: Petr Menšík <pemensik@redhat.com>
 Date:   Wed Mar 7 13:21:00 2018 +0100
    Add md5 availability detection to featuretest
 commit f389a918803e2853e4b55fed62765dc4a492e34f
 Author: Petr Menšík <pemensik@redhat.com>
 Date:   Wed Mar 7 10:44:23 2018 +0100
    Change tests to not use hmac-md5 algorithms if not required
    Use hmac-sha256 instead of default hmac-md5 for allow-query
 ---
 bin/tests/system/acl/ns2/named1.conf.in       |  4 +-
 bin/tests/system/acl/ns2/named2.conf.in       |  4 +-
 bin/tests/system/acl/ns2/named3.conf.in       |  6 +-
 bin/tests/system/acl/ns2/named4.conf.in       |  4 +-
 bin/tests/system/acl/ns2/named5.conf.in       |  4 +-
 bin/tests/system/acl/tests.sh                 | 32 ++++-----
 .../system/allow-query/ns2/named10.conf.in    |  2 +-
 .../system/allow-query/ns2/named11.conf.in    |  4 +-
 .../system/allow-query/ns2/named12.conf.in    |  2 +-
 .../system/allow-query/ns2/named30.conf.in    |  2 +-
 .../system/allow-query/ns2/named31.conf.in    |  4 +-
 .../system/allow-query/ns2/named32.conf.in    |  2 +-
 .../system/allow-query/ns2/named40.conf.in    |  4 +-
 bin/tests/system/allow-query/tests.sh         | 18 ++---
 bin/tests/system/catz/ns1/named.conf.in       |  2 +-
 bin/tests/system/catz/ns2/named.conf.in       |  2 +-
 bin/tests/system/checkconf/bad-tsig.conf      |  2 +-
 bin/tests/system/checkconf/good.conf          |  2 +-
 bin/tests/system/feature-test.c               | 14 ++++
 bin/tests/system/notify/ns5/named.conf.in     |  6 +-
 bin/tests/system/notify/tests.sh              |  6 +-
 bin/tests/system/nsupdate/ns1/named.conf.in   |  2 +-
 bin/tests/system/nsupdate/ns2/named.conf.in   |  2 +-
 bin/tests/system/nsupdate/setup.sh            |  6 +-
 bin/tests/system/nsupdate/tests.sh            | 15 +++--
 bin/tests/system/rndc/setup.sh                |  2 +-
 bin/tests/system/rndc/tests.sh                | 23 ++++---
 bin/tests/system/tsig/ns1/named.conf.in       | 10 +--
 bin/tests/system/tsig/ns1/rndc5.conf.in       | 10 +++
 bin/tests/system/tsig/setup.sh                |  5 ++
 bin/tests/system/tsig/tests.sh                | 65 ++++++++++++-------
 bin/tests/system/upforwd/ns1/named.conf.in    |  2 +-
 bin/tests/system/upforwd/tests.sh             |  2 +-
 33 files changed, 162 insertions(+), 108 deletions(-)
 create mode 100644 bin/tests/system/tsig/ns1/rndc5.conf.in
 diff --git a/bin/tests/system/acl/ns2/named1.conf.in b/bin/tests/system/acl/ns2/named1.conf.in
 index 60f22e1..249f672 100644
 --- a/bin/tests/system/acl/ns2/named1.conf.in
 +++ b/bin/tests/system/acl/ns2/named1.conf.in
@@ -33,12 +33,12 @@ options {
 };
 key one {
 -	algorithm hmac-md5;
 +	algorithm hmac-sha256;
 	secret "1234abcd8765";
 };
 key two {
 -	algorithm hmac-md5;
 +	algorithm hmac-sha256;
 	secret "1234abcd8765";
 };
 diff --git a/bin/tests/system/acl/ns2/named2.conf.in b/bin/tests/system/acl/ns2/named2.conf.in
 index ada97bc..f82d858 100644
 --- a/bin/tests/system/acl/ns2/named2.conf.in
 +++ b/bin/tests/system/acl/ns2/named2.conf.in
@@ -33,12 +33,12 @@ options {
 };
 key one {
 -	algorithm hmac-md5;
 +	algorithm hmac-sha256;
 	secret "1234abcd8765";
 };
 key two {
 -	algorithm hmac-md5;
 +	algorithm hmac-sha256;
 	secret "1234abcd8765";
 };
 diff --git a/bin/tests/system/acl/ns2/named3.conf.in b/bin/tests/system/acl/ns2/named3.conf.in
 index 97684e4..de6a2e9 100644
 --- a/bin/tests/system/acl/ns2/named3.conf.in
 +++ b/bin/tests/system/acl/ns2/named3.conf.in
@@ -33,17 +33,17 @@ options {
 };
 key one {
 -	algorithm hmac-md5;
 +	algorithm hmac-sha256;
 	secret "1234abcd8765";
 };
 key two {
 -	algorithm hmac-md5;
 +	algorithm hmac-sha256;
 	secret "1234abcd8765";
 };
 key three {
 -	algorithm hmac-md5;
 +	algorithm hmac-sha256;
 	secret "1234abcd8765";
 };
 diff --git a/bin/tests/system/acl/ns2/named4.conf.in b/bin/tests/system/acl/ns2/named4.conf.in
 index 462b3fa..994b35c 100644
 --- a/bin/tests/system/acl/ns2/named4.conf.in
 +++ b/bin/tests/system/acl/ns2/named4.conf.in
@@ -33,12 +33,12 @@ options {
 };
 key one {
 -	algorithm hmac-md5;
 +	algorithm hmac-sha256;
 	secret "1234abcd8765";
 };
 key two {
 -	algorithm hmac-md5;
 +	algorithm hmac-sha256;
 	secret "1234abcd8765";
 };
 diff --git a/bin/tests/system/acl/ns2/named5.conf.in b/bin/tests/system/acl/ns2/named5.conf.in
 index 728da58..8f00d09 100644
 --- a/bin/tests/system/acl/ns2/named5.conf.in
 +++ b/bin/tests/system/acl/ns2/named5.conf.in
@@ -35,12 +35,12 @@ options {
 };
 key one {
 -	algorithm hmac-md5;
 +	algorithm hmac-sha256;
 	secret "1234abcd8765";
 };
 key two {
 -	algorithm hmac-md5;
 +	algorithm hmac-sha256;
 	secret "1234abcd8765";
 };
 diff --git a/bin/tests/system/acl/tests.sh b/bin/tests/system/acl/tests.sh
 index be59d64..13d5bdc 100644
 --- a/bin/tests/system/acl/tests.sh
 +++ b/bin/tests/system/acl/tests.sh
@@ -22,14 +22,14 @@ echo_i "testing basic ACL processing"
 # key "one" should fail
 t=`expr $t + 1`
 $DIG $DIGOPTS tsigzone. \
 -	@10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 > dig.out.${t}
 +	@10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}
 grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
 # any other key should be fine
 t=`expr $t + 1`
 $DIG $DIGOPTS tsigzone. \
 -	@10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t}
 +	@10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}
 grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
 copy_setports ns2/named2.conf.in ns2/named.conf
@@ -39,18 +39,18 @@ sleep 5
 # prefix 10/8 should fail
 t=`expr $t + 1`
 $DIG $DIGOPTS tsigzone. \
 -	@10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 > dig.out.${t}
 +	@10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}
 grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
 # any other address should work, as long as it sends key "one"
 t=`expr $t + 1`
 $DIG $DIGOPTS tsigzone. \
 -	@10.53.0.2 -b 127.0.0.1 axfr -y two:1234abcd8765 > dig.out.${t}
 +	@10.53.0.2 -b 127.0.0.1 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}
 grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
 t=`expr $t + 1`
 $DIG $DIGOPTS tsigzone. \
 -	@10.53.0.2 -b 127.0.0.1 axfr -y one:1234abcd8765 > dig.out.${t}
 +	@10.53.0.2 -b 127.0.0.1 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}
 grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
 echo_i "testing nested ACL processing"
@@ -62,31 +62,31 @@ sleep 5
 # should succeed
 t=`expr $t + 1`
 $DIG $DIGOPTS tsigzone. \
 -	@10.53.0.2 -b 10.53.0.2 axfr -y two:1234abcd8765 > dig.out.${t}
 +	@10.53.0.2 -b 10.53.0.2 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}
 grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
 # should succeed
 t=`expr $t + 1`
 $DIG $DIGOPTS tsigzone. \
 -	@10.53.0.2 -b 10.53.0.2 axfr -y one:1234abcd8765 > dig.out.${t}
 +	@10.53.0.2 -b 10.53.0.2 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}
 grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
 # should succeed
 t=`expr $t + 1`
 $DIG $DIGOPTS tsigzone. \
 -	@10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t}
 +	@10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}
 grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
 # should succeed
 t=`expr $t + 1`
 $DIG $DIGOPTS tsigzone. \
 -	@10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t}
 +	@10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}
 grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
 # but only one or the other should fail
 t=`expr $t + 1`
 $DIG $DIGOPTS tsigzone. \
 -	@10.53.0.2 -b 127.0.0.1 axfr -y one:1234abcd8765 > dig.out.${t}
 +	@10.53.0.2 -b 127.0.0.1 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}
 grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
 t=`expr $t + 1`
@@ -97,7 +97,7 @@ grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $tt failed" ; status=1
 # and other values? right out
 t=`expr $t + 1`
 $DIG $DIGOPTS tsigzone. \
 -	@10.53.0.2 -b 127.0.0.1 axfr -y three:1234abcd8765 > dig.out.${t}
 +	@10.53.0.2 -b 127.0.0.1 axfr -y hmac-sha256:three:1234abcd8765 > dig.out.${t}
 grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
 # now we only allow 10.53.0.1 *and* key one, or 10.53.0.2 *and* key two
@@ -108,31 +108,31 @@ sleep 5
 # should succeed
 t=`expr $t + 1`
 $DIG $DIGOPTS tsigzone. \
 -	@10.53.0.2 -b 10.53.0.2 axfr -y two:1234abcd8765 > dig.out.${t}
 +	@10.53.0.2 -b 10.53.0.2 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}
 grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
 # should succeed
 t=`expr $t + 1`
 $DIG $DIGOPTS tsigzone. \
 -	@10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 > dig.out.${t}
 +	@10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}
 grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
 # should fail
 t=`expr $t + 1`
 $DIG $DIGOPTS tsigzone. \
 -	@10.53.0.2 -b 10.53.0.2 axfr -y one:1234abcd8765 > dig.out.${t}
 +	@10.53.0.2 -b 10.53.0.2 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}
 grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
 # should fail
 t=`expr $t + 1`
 $DIG $DIGOPTS tsigzone. \
 -	@10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t}
 +	@10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}
 grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
 # should fail
 t=`expr $t + 1`
 $DIG $DIGOPTS tsigzone. \
 -	@10.53.0.2 -b 10.53.0.3 axfr -y one:1234abcd8765 > dig.out.${t}
 +	@10.53.0.2 -b 10.53.0.3 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}
 grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
 echo_i "testing allow-query-on ACL processing"
 diff --git a/bin/tests/system/allow-query/ns2/named10.conf.in b/bin/tests/system/allow-query/ns2/named10.conf.in
 index 7d43e36..f7b25f9 100644
 --- a/bin/tests/system/allow-query/ns2/named10.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named10.conf.in
@@ -10,7 +10,7 @@
  */
 key one {
 -	algorithm hmac-md5;
 +	algorithm hmac-sha256;
 	secret "1234abcd8765";
 };
 diff --git a/bin/tests/system/allow-query/ns2/named11.conf.in b/bin/tests/system/allow-query/ns2/named11.conf.in
 index 2952518..121557e 100644
 --- a/bin/tests/system/allow-query/ns2/named11.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named11.conf.in
@@ -10,12 +10,12 @@
  */
 key one {
 -	algorithm hmac-md5;
 +	algorithm hmac-sha256;
 	secret "1234abcd8765";
 };
 key two {
 -	algorithm hmac-md5;
 +	algorithm hmac-sha256;
 	secret "1234efgh8765";
 };
 diff --git a/bin/tests/system/allow-query/ns2/named12.conf.in b/bin/tests/system/allow-query/ns2/named12.conf.in
 index 0c01071..ceabbb5 100644
 --- a/bin/tests/system/allow-query/ns2/named12.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named12.conf.in
@@ -10,7 +10,7 @@
  */
 key one {
 -	algorithm hmac-md5;
 +	algorithm hmac-sha256;
 	secret "1234abcd8765";
 };
 diff --git a/bin/tests/system/allow-query/ns2/named30.conf.in b/bin/tests/system/allow-query/ns2/named30.conf.in
 index 4c17292..9cd9d1f 100644
 --- a/bin/tests/system/allow-query/ns2/named30.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named30.conf.in
@@ -10,7 +10,7 @@
  */
 key one {
 -	algorithm hmac-md5;
 +	algorithm hmac-sha256;
 	secret "1234abcd8765";
 };
 diff --git a/bin/tests/system/allow-query/ns2/named31.conf.in b/bin/tests/system/allow-query/ns2/named31.conf.in
 index a2690a4..f488730 100644
 --- a/bin/tests/system/allow-query/ns2/named31.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named31.conf.in
@@ -10,12 +10,12 @@
  */
 key one {
 -	algorithm hmac-md5;
 +	algorithm hmac-sha256;
 	secret "1234abcd8765";
 };
 key two {
 -	algorithm hmac-md5;
 +	algorithm hmac-sha256;
 	secret "1234efgh8765";
 };
 diff --git a/bin/tests/system/allow-query/ns2/named32.conf.in b/bin/tests/system/allow-query/ns2/named32.conf.in
 index a0708c8..51fa457 100644
 --- a/bin/tests/system/allow-query/ns2/named32.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named32.conf.in
@@ -10,7 +10,7 @@
  */
 key one {
 -	algorithm hmac-md5;
 +	algorithm hmac-sha256;
 	secret "1234abcd8765";
 };
 diff --git a/bin/tests/system/allow-query/ns2/named40.conf.in b/bin/tests/system/allow-query/ns2/named40.conf.in
 index 687768e..d24d6d2 100644
 --- a/bin/tests/system/allow-query/ns2/named40.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named40.conf.in
@@ -14,12 +14,12 @@ acl accept { 10.53.0.2; };
 acl badaccept { 10.53.0.1; };
 key one {
 -	algorithm hmac-md5;
 +	algorithm hmac-sha256;
 	secret "1234abcd8765";
 };
 key two {
 -	algorithm hmac-md5;
 +	algorithm hmac-sha256;
 	secret "1234efgh8765";
 };
 diff --git a/bin/tests/system/allow-query/tests.sh b/bin/tests/system/allow-query/tests.sh
 index fe40635..543c663 100644
 --- a/bin/tests/system/allow-query/tests.sh
 +++ b/bin/tests/system/allow-query/tests.sh
@@ -182,7 +182,7 @@ rndc_reload ns2 10.53.0.2
 echo_i "test $n: key allowed - query allowed"
 ret=0
 -$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
 +$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -195,7 +195,7 @@ rndc_reload ns2 10.53.0.2
 echo_i "test $n: key not allowed - query refused"
 ret=0
 -$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1
 +$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -208,7 +208,7 @@ rndc_reload ns2 10.53.0.2
 echo_i "test $n: key disallowed - query refused"
 ret=0
 -$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
 +$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -341,7 +341,7 @@ rndc_reload ns2 10.53.0.2
 echo_i "test $n: views key allowed - query allowed"
 ret=0
 -$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
 +$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -354,7 +354,7 @@ rndc_reload ns2 10.53.0.2
 echo_i "test $n: views key not allowed - query refused"
 ret=0
 -$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1
 +$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -367,7 +367,7 @@ rndc_reload ns2 10.53.0.2
 echo_i "test $n: views key disallowed - query refused"
 ret=0
 -$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
 +$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -500,7 +500,7 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo_i "test $n: zone key allowed - query allowed"
 ret=0
 -$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.keyallow.example a > dig.out.ns2.$n || ret=1
 +$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.keyallow.example a > dig.out.ns2.$n || ret=1
 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.keyallow.example' dig.out.ns2.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -510,7 +510,7 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo_i "test $n: zone key not allowed - query refused"
 ret=0
 -$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y two:1234efgh8765 a.keyallow.example a > dig.out.ns2.$n || ret=1
 +$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:two:1234efgh8765 a.keyallow.example a > dig.out.ns2.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.keyallow.example' dig.out.ns2.$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -520,7 +520,7 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo_i "test $n: zone key disallowed - query refused"
 ret=0
 -$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.keydisallow.example a > dig.out.ns2.$n || ret=1
 +$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.keydisallow.example a > dig.out.ns2.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.keydisallow.example' dig.out.ns2.$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 diff --git a/bin/tests/system/catz/ns1/named.conf.in b/bin/tests/system/catz/ns1/named.conf.in
 index 1218669..e62715e 100644
 --- a/bin/tests/system/catz/ns1/named.conf.in
 +++ b/bin/tests/system/catz/ns1/named.conf.in
@@ -61,5 +61,5 @@ zone "catalog4.example" {
 key tsig_key. {
 	secret "LSAnCU+Z";
 -	algorithm hmac-md5;
 +	algorithm hmac-sha256;
 };
 diff --git a/bin/tests/system/catz/ns2/named.conf.in b/bin/tests/system/catz/ns2/named.conf.in
 index 30333e6..4005152 100644
 --- a/bin/tests/system/catz/ns2/named.conf.in
 +++ b/bin/tests/system/catz/ns2/named.conf.in
@@ -70,5 +70,5 @@ zone "catalog4.example" {
 key tsig_key. {
 	secret "LSAnCU+Z";
 -	algorithm hmac-md5;
 +	algorithm hmac-sha256;
 };
 diff --git a/bin/tests/system/checkconf/bad-tsig.conf b/bin/tests/system/checkconf/bad-tsig.conf
 index 21be03e..e57c308 100644
 --- a/bin/tests/system/checkconf/bad-tsig.conf
 +++ b/bin/tests/system/checkconf/bad-tsig.conf
@@ -11,7 +11,7 @@
 /* Bad secret */
 key "badtsig" {
 -	algorithm hmac-md5;
 +	algorithm hmac-sha256;
 	secret "jEdD+BPKg==";
 };
 diff --git a/bin/tests/system/checkconf/good.conf b/bin/tests/system/checkconf/good.conf
 index e09b9e8..2e824b3 100644
 --- a/bin/tests/system/checkconf/good.conf
 +++ b/bin/tests/system/checkconf/good.conf
@@ -210,6 +210,6 @@ dyndb "name" "library.so" {
 	system;
 };
 key "mykey" {
 -	algorithm "hmac-md5";
 +	algorithm "hmac-sha256";
 	secret "qwertyuiopasdfgh";
 };
 diff --git a/bin/tests/system/feature-test.c b/bin/tests/system/feature-test.c
 index 877504f..577660a 100644
 --- a/bin/tests/system/feature-test.c
 +++ b/bin/tests/system/feature-test.c
@@ -14,6 +14,7 @@
 #include <string.h>
 #include <unistd.h>
 +#include <isc/md.h>
 #include <isc/net.h>
 #include <isc/print.h>
 #include <isc/util.h>
@@ -186,6 +187,19 @@ main(int argc, char **argv) {
 #endif /* ifdef DLZ_FILESYSTEM */
 	}
 +	if (strcmp(argv[1], "--md5") == 0) {
 +		unsigned char digest[ISC_MAX_MD_SIZE];
 +		const unsigned char test[] = "test";
 +		unsigned int size = sizeof(digest);
 +
 +		if (isc_md(ISC_MD_MD5, test, sizeof(test),
 +		           digest, &size) == ISC_R_SUCCESS) {
 +			return (0);
 +		} else {
 +			return (1);
 +		}
 +	}
 +
 	if (strcmp(argv[1], "--with-idn") == 0) {
 #ifdef HAVE_LIBIDN2
 		return (0);
 diff --git a/bin/tests/system/notify/ns5/named.conf.in b/bin/tests/system/notify/ns5/named.conf.in
 index 1ee8df4..2b75d9a 100644
 --- a/bin/tests/system/notify/ns5/named.conf.in
 +++ b/bin/tests/system/notify/ns5/named.conf.in
@@ -10,17 +10,17 @@
  */
 key "a" {
 -	algorithm "hmac-md5";
 +	algorithm "hmac-sha256";
 	secret "aaaaaaaaaaaaaaaaaaaa";
 };
 key "b" {
 -	algorithm "hmac-md5";
 +	algorithm "hmac-sha256";
 	secret "bbbbbbbbbbbbbbbbbbbb";
 };
 key "c" {
 -	algorithm "hmac-md5";
 +	algorithm "hmac-sha256";
 	secret "cccccccccccccccccccc";
 };
 diff --git a/bin/tests/system/notify/tests.sh b/bin/tests/system/notify/tests.sh
 index 3d7e0b7..ec4d9a7 100644
 --- a/bin/tests/system/notify/tests.sh
 +++ b/bin/tests/system/notify/tests.sh
@@ -212,16 +212,16 @@ ret=0
 $NSUPDATE << EOF
 server 10.53.0.5 ${PORT}
 zone x21
 -key a aaaaaaaaaaaaaaaaaaaa
 +key hmac-sha256:a aaaaaaaaaaaaaaaaaaaa
 update add added.x21 0 in txt "test string"
 send
 EOF
 for i in 1 2 3 4 5 6 7 8 9
 do
 -	$DIG $DIGOPTS added.x21. -y b:bbbbbbbbbbbbbbbbbbbb @10.53.0.5 \
 +	$DIG $DIGOPTS added.x21. -y hmac-sha256:b:bbbbbbbbbbbbbbbbbbbb @10.53.0.5 \
 		txt > dig.out.b.ns5.test$n || ret=1
 -	$DIG $DIGOPTS added.x21. -y c:cccccccccccccccccccc @10.53.0.5 \
 +	$DIG $DIGOPTS added.x21. -y hmac-sha256:c:cccccccccccccccccccc @10.53.0.5 \
 		txt > dig.out.c.ns5.test$n || ret=1
 	grep "test string" dig.out.b.ns5.test$n > /dev/null &&
 	grep "test string" dig.out.c.ns5.test$n > /dev/null &&
 diff --git a/bin/tests/system/nsupdate/ns1/named.conf.in b/bin/tests/system/nsupdate/ns1/named.conf.in
 index b51e700..436c97d 100644
 --- a/bin/tests/system/nsupdate/ns1/named.conf.in
 +++ b/bin/tests/system/nsupdate/ns1/named.conf.in
@@ -37,7 +37,7 @@ controls {
 };
 key altkey {
 -	algorithm hmac-md5;
 +	algorithm hmac-sha512;
 	secret "1234abcd8765";
 };
 diff --git a/bin/tests/system/nsupdate/ns2/named.conf.in b/bin/tests/system/nsupdate/ns2/named.conf.in
 index da6b3b4..c547e47 100644
 --- a/bin/tests/system/nsupdate/ns2/named.conf.in
 +++ b/bin/tests/system/nsupdate/ns2/named.conf.in
@@ -32,7 +32,7 @@ controls {
 };
 key altkey {
 -	algorithm hmac-md5;
 +	algorithm hmac-sha512;
 	secret "1234abcd8765";
 };
 diff --git a/bin/tests/system/nsupdate/setup.sh b/bin/tests/system/nsupdate/setup.sh
 index c055da3..4e1242b 100644
 --- a/bin/tests/system/nsupdate/setup.sh
 +++ b/bin/tests/system/nsupdate/setup.sh
@@ -56,7 +56,11 @@ EOF
 $DDNSCONFGEN -q -z example.nil > ns1/ddns.key
 -$DDNSCONFGEN -q -a hmac-md5 -k md5-key -z keytests.nil > ns1/md5.key
 +if $FEATURETEST --md5; then
 +	$DDNSCONFGEN -q -a hmac-md5 -k md5-key -z keytests.nil > ns1/md5.key
 +else
 +	echo -n > ns1/md5.key
 +fi
 $DDNSCONFGEN -q -a hmac-sha1 -k sha1-key -z keytests.nil > ns1/sha1.key
 $DDNSCONFGEN -q -a hmac-sha224 -k sha224-key -z keytests.nil > ns1/sha224.key
 $DDNSCONFGEN -q -a hmac-sha256 -k sha256-key -z keytests.nil > ns1/sha256.key
 diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh
 index b35d797..41c128e 100755
 --- a/bin/tests/system/nsupdate/tests.sh
 +++ b/bin/tests/system/nsupdate/tests.sh
@@ -797,7 +797,14 @@ fi
 n=`expr $n + 1`
 ret=0
 echo_i "check TSIG key algorithms (nsupdate -k) ($n)"
 -for alg in md5 sha1 sha224 sha256 sha384 sha512; do
 +if $FEATURETEST --md5
 +then
 +	ALGS="md5 sha1 sha224 sha256 sha384 sha512"
 +else
 +	ALGS="sha1 sha224 sha256 sha384 sha512"
 +	echo_i "skipping disabled md5 algorithm"
 +fi
 +for alg in $ALGS; do
     $NSUPDATE -k ns1/${alg}.key <<END > /dev/null || ret=1
 server 10.53.0.1 ${PORT}
 update add ${alg}.keytests.nil. 600 A 10.10.10.3
@@ -805,7 +812,7 @@ send
 END
 done
 sleep 2
 -for alg in md5 sha1 sha224 sha256 sha384 sha512; do
 +for alg in $ALGS; do
     $DIG $DIGOPTS +short @10.53.0.1 ${alg}.keytests.nil | grep 10.10.10.3 > /dev/null 2>&1 || ret=1
 done
 if [ $ret -ne 0 ]; then
@@ -816,7 +823,7 @@ fi
 n=`expr $n + 1`
 ret=0
 echo_i "check TSIG key algorithms (nsupdate -y) ($n)"
 -for alg in md5 sha1 sha224 sha256 sha384 sha512; do
 +for alg in $ALGS; do
     secret=$(sed -n 's/.*secret "\(.*\)";.*/\1/p' ns1/${alg}.key)
     $NSUPDATE -y "hmac-${alg}:${alg}-key:$secret" <<END > /dev/null || ret=1
 server 10.53.0.1 ${PORT}
@@ -825,7 +832,7 @@ send
 END
 done
 sleep 2
 -for alg in md5 sha1 sha224 sha256 sha384 sha512; do
 +for alg in $ALGS; do
     $DIG $DIGOPTS +short @10.53.0.1 ${alg}.keytests.nil | grep 10.10.10.50 > /dev/null 2>&1 || ret=1
 done
 if [ $ret -ne 0 ]; then
 diff --git a/bin/tests/system/rndc/setup.sh b/bin/tests/system/rndc/setup.sh
 index b59e7a7..04d5f5a 100644
 --- a/bin/tests/system/rndc/setup.sh
 +++ b/bin/tests/system/rndc/setup.sh
@@ -33,7 +33,7 @@ make_key () {
             sed 's/allow { 10.53.0.4/allow { any/' >> ns4/named.conf
 }
 -make_key 1 ${EXTRAPORT1} hmac-md5
 +$FEATURETEST --md5 && make_key 1 ${EXTRAPORT1} hmac-md5
 make_key 2 ${EXTRAPORT2} hmac-sha1
 make_key 3 ${EXTRAPORT3} hmac-sha224
 make_key 4 ${EXTRAPORT4} hmac-sha256
 diff --git a/bin/tests/system/rndc/tests.sh b/bin/tests/system/rndc/tests.sh
 index 9fd84ed..d0b188f 100644
 --- a/bin/tests/system/rndc/tests.sh
 +++ b/bin/tests/system/rndc/tests.sh
@@ -348,15 +348,20 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 n=`expr $n + 1`
 -echo_i "testing rndc with hmac-md5 ($n)"
 -ret=0
 -$RNDC -s 10.53.0.4 -p ${EXTRAPORT1} -c ns4/key1.conf status > /dev/null 2>&1 || ret=1
 -for i in 2 3 4 5 6
 -do
 -        $RNDC -s 10.53.0.4 -p ${EXTRAPORT1} -c ns4/key${i}.conf status > /dev/null 2>&1 && ret=1
 -done
 -if [ $ret != 0 ]; then echo_i "failed"; fi
 -status=`expr $status + $ret`
 +if $FEATURETEST --md5
 +then
 +	echo_i "testing rndc with hmac-md5 ($n)"
 +	ret=0
 +	$RNDC -s 10.53.0.4 -p ${EXTRAPORT1} -c ns4/key1.conf status > /dev/null 2>&1 || ret=1
 +	for i in 2 3 4 5 6
 +	do
 +		$RNDC -s 10.53.0.4 -p ${EXTRAPORT1} -c ns4/key${i}.conf status > /dev/null 2>&1 && ret=1
 +	done
 +	if [ $ret != 0 ]; then echo_i "failed"; fi
 +	status=`expr $status + $ret`
 +else
 +	echo_i "skipping rndc with hmac-md5 ($n)"
 +fi
 n=`expr $n + 1`
 echo_i "testing rndc with hmac-sha1 ($n)"
 diff --git a/bin/tests/system/tsig/ns1/named.conf.in b/bin/tests/system/tsig/ns1/named.conf.in
 index 3470c4f..cf539cd 100644
 --- a/bin/tests/system/tsig/ns1/named.conf.in
 +++ b/bin/tests/system/tsig/ns1/named.conf.in
@@ -21,10 +21,7 @@ options {
 	notify no;
 };
 -key "md5" {
 -	secret "97rnFx24Tfna4mHPfgnerA==";
 -	algorithm hmac-md5;
 -};
 +# md5 key appended by setup.sh at the end
 key "sha1" {
 	secret "FrSt77yPTFx6hTs4i2tKLB9LmE0=";
@@ -51,10 +48,7 @@ key "sha512" {
 	algorithm hmac-sha512;
 };
 -key "md5-trunc" {
 -	secret "97rnFx24Tfna4mHPfgnerA==";
 -	algorithm hmac-md5-80;
 -};
 +# md5-trunc key appended by setup.sh at the end
 key "sha1-trunc" {
 	secret "FrSt77yPTFx6hTs4i2tKLB9LmE0=";
 diff --git a/bin/tests/system/tsig/ns1/rndc5.conf.in b/bin/tests/system/tsig/ns1/rndc5.conf.in
 new file mode 100644
 index 0000000..0682194
 --- /dev/null
 +++ b/bin/tests/system/tsig/ns1/rndc5.conf.in
@@ -0,0 +1,10 @@
 +# Conditionally included when support for MD5 is available
 +key "md5" {
 +	secret "97rnFx24Tfna4mHPfgnerA==";
 +	algorithm hmac-md5;
 +};
 +
 +key "md5-trunc" {
 +	secret "97rnFx24Tfna4mHPfgnerA==";
 +	algorithm hmac-md5-80;
 +};
 diff --git a/bin/tests/system/tsig/setup.sh b/bin/tests/system/tsig/setup.sh
 index e3b4a45..ae21d04 100644
 --- a/bin/tests/system/tsig/setup.sh
 +++ b/bin/tests/system/tsig/setup.sh
@@ -15,3 +15,8 @@ SYSTEMTESTTOP=..
 $SHELL clean.sh
 copy_setports ns1/named.conf.in ns1/named.conf
 +
 +if $FEATURETEST --md5
 +then
 +	cat ns1/rndc5.conf.in >> ns1/named.conf
 +fi
 diff --git a/bin/tests/system/tsig/tests.sh b/bin/tests/system/tsig/tests.sh
 index 38d842a..668aa6f 100644
 --- a/bin/tests/system/tsig/tests.sh
 +++ b/bin/tests/system/tsig/tests.sh
@@ -26,20 +26,25 @@ sha512="jI/Pa4qRu96t76Pns5Z/Ndxbn3QCkwcxLOgt9vgvnJw5wqTRvNyk3FtD6yIMd1dWVlqZ+Y4f
 status=0
 -echo_i "fetching using hmac-md5 (old form)"
 -ret=0
 -$DIG $DIGOPTS example.nil. -y "md5:$md5" @10.53.0.1 soa > dig.out.md5.old || ret=1
 -grep -i "md5.*TSIG.*NOERROR" dig.out.md5.old > /dev/null || ret=1
 -if [ $ret -eq 1 ] ; then
 -	echo_i "failed"; status=1
 -fi
 +if $FEATURETEST --md5
 +then
 +	echo_i "fetching using hmac-md5 (old form)"
 +	ret=0
 +	$DIG $DIGOPTS example.nil. -y "md5:$md5" @10.53.0.1 soa > dig.out.md5.old || ret=1
 +	grep -i "md5.*TSIG.*NOERROR" dig.out.md5.old > /dev/null || ret=1
 +	if [ $ret -eq 1 ] ; then
 +		echo_i "failed"; status=1
 +	fi
 -echo_i "fetching using hmac-md5 (new form)"
 -ret=0
 -$DIG $DIGOPTS example.nil. -y "hmac-md5:md5:$md5" @10.53.0.1 soa > dig.out.md5.new || ret=1
 -grep -i "md5.*TSIG.*NOERROR" dig.out.md5.new > /dev/null || ret=1
 -if [ $ret -eq 1 ] ; then
 -	echo_i "failed"; status=1
 +	echo_i "fetching using hmac-md5 (new form)"
 +	ret=0
 +	$DIG $DIGOPTS example.nil. -y "hmac-md5:md5:$md5" @10.53.0.1 soa > dig.out.md5.new || ret=1
 +	grep -i "md5.*TSIG.*NOERROR" dig.out.md5.new > /dev/null || ret=1
 +	if [ $ret -eq 1 ] ; then
 +		echo_i "failed"; status=1
 +	fi
 +else
 +	echo_i "skipping using hmac-md5"
 fi
 echo_i "fetching using hmac-sha1"
@@ -87,12 +92,17 @@ fi
 #	Truncated TSIG
 #
 #
 -echo_i "fetching using hmac-md5 (trunc)"
 -ret=0
 -$DIG $DIGOPTS example.nil. -y "hmac-md5-80:md5-trunc:$md5" @10.53.0.1 soa > dig.out.md5.trunc || ret=1
 -grep -i "md5-trunc.*TSIG.*NOERROR" dig.out.md5.trunc > /dev/null || ret=1
 -if [ $ret -eq 1 ] ; then
 -	echo_i "failed"; status=1
 +if $FEATURETEST --md5
 +then
 +	echo_i "fetching using hmac-md5 (trunc)"
 +	ret=0
 +	$DIG $DIGOPTS example.nil. -y "hmac-md5-80:md5-trunc:$md5" @10.53.0.1 soa > dig.out.md5.trunc || ret=1
 +	grep -i "md5-trunc.*TSIG.*NOERROR" dig.out.md5.trunc > /dev/null || ret=1
 +	if [ $ret -eq 1 ] ; then
 +		echo_i "failed"; status=1
 +	fi
 +else
 +	echo_i "skipping using hmac-md5 (trunc)"
 fi
 echo_i "fetching using hmac-sha1 (trunc)"
@@ -141,12 +151,17 @@ fi
 #	Check for bad truncation.
 #
 #
 -echo_i "fetching using hmac-md5-80 (BADTRUNC)"
 -ret=0
 -$DIG $DIGOPTS example.nil. -y "hmac-md5-80:md5:$md5" @10.53.0.1 soa > dig.out.md5-80 || ret=1
 -grep -i "md5.*TSIG.*BADTRUNC" dig.out.md5-80 > /dev/null || ret=1
 -if [ $ret -eq 1 ] ; then
 -	echo_i "failed"; status=1
 +if $FEATURETEST --md5
 +then
 +	echo_i "fetching using hmac-md5-80 (BADTRUNC)" 
 +	ret=0
 +	$DIG $DIGOPTS example.nil. -y "hmac-md5-80:md5:$md5" @10.53.0.1 soa > dig.out.md5-80 || ret=1
 +	grep -i "md5.*TSIG.*BADTRUNC" dig.out.md5-80 > /dev/null || ret=1
 +	if [ $ret -eq 1 ] ; then
 +		echo_i "failed"; status=1
 +	fi
 +else
 +	echo_i "skipping using hmac-md5-80 (BADTRUNC)" 
 fi
 echo_i "fetching using hmac-sha1-80 (BADTRUNC)"
 diff --git a/bin/tests/system/upforwd/ns1/named.conf.in b/bin/tests/system/upforwd/ns1/named.conf.in
 index 3873c7c..b359a5a 100644
 --- a/bin/tests/system/upforwd/ns1/named.conf.in
 +++ b/bin/tests/system/upforwd/ns1/named.conf.in
@@ -10,7 +10,7 @@
  */
 key "update.example." {
 -	algorithm "hmac-md5";
 +	algorithm "hmac-sha256";
 	secret "c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K";
 };
 diff --git a/bin/tests/system/upforwd/tests.sh b/bin/tests/system/upforwd/tests.sh
 index a50c896..8062d68 100644
 --- a/bin/tests/system/upforwd/tests.sh
 +++ b/bin/tests/system/upforwd/tests.sh
@@ -79,7 +79,7 @@ if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
 echo_i "updating zone (signed) ($n)"
 ret=0
 -$NSUPDATE -y update.example:c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K -- - <<EOF || ret=1
 +$NSUPDATE -y hmac-sha256:update.example:c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K -- - <<EOF || ret=1
 server 10.53.0.3 ${PORT}
 update add updated.example. 600 A 10.10.10.1
 update add updated.example. 600 TXT Foo
 -- 
 2.26.2
--- a/bind-9.11-kyua-pkcs11.patch
+++ b/bind-9.11-kyua-pkcs11.patch
@ -1,58 +0,0 @@
 From 1241f2005d08673c28a595c5a6cd61350b95a929 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Tue, 2 Jan 2018 18:13:07 +0100
 Subject: [PATCH] Fix pkcs11 variants atf tests
 Add dns-pkcs11 tests Makefile to configure
 Add pkcs11 Kyuafile, fix dh_test to pass in pkcs11 mode
 ---
 configure.ac                   | 1 +
 lib/Kyuafile                   | 2 ++
 lib/dns-pkcs11/tests/dh_test.c | 3 ++-
 3 files changed, 5 insertions(+), 1 deletion(-)
 diff --git a/configure.ac b/configure.ac
 index d80ae31..0fb9328 100644
 --- a/configure.ac
 +++ b/configure.ac
@@ -3090,6 +3090,7 @@ AC_CONFIG_FILES([
 	lib/dns-pkcs11/include/Makefile
 	lib/dns-pkcs11/include/dns/Makefile
 	lib/dns-pkcs11/include/dst/Makefile
 +	lib/dns-pkcs11/tests/Makefile
 	lib/irs/Makefile
 	lib/irs/include/Makefile
 	lib/irs/include/irs/Makefile
 diff --git a/lib/Kyuafile b/lib/Kyuafile
 index 39ce986..037e5ef 100644
 --- a/lib/Kyuafile
 +++ b/lib/Kyuafile
@@ -2,8 +2,10 @@ syntax(2)
 test_suite('bind9')
 include('dns/Kyuafile')
 +include('dns-pkcs11/Kyuafile')
 include('irs/Kyuafile')
 include('isc/Kyuafile')
 include('isccc/Kyuafile')
 include('isccfg/Kyuafile')
 include('ns/Kyuafile')
 +include('ns-pkcs11/Kyuafile')
 diff --git a/lib/dns-pkcs11/tests/dh_test.c b/lib/dns-pkcs11/tests/dh_test.c
 index 934e8fd..658d1af 100644
 --- a/lib/dns-pkcs11/tests/dh_test.c
 +++ b/lib/dns-pkcs11/tests/dh_test.c
@@ -87,7 +87,8 @@ dh_computesecret(void **state) {
 	result = dst_key_computesecret(key, key, &buf);
 	assert_int_equal(result, DST_R_NOTPRIVATEKEY);
 	result = key->func->computesecret(key, key, &buf);
 -	assert_int_equal(result, DST_R_COMPUTESECRETFAILURE);
 +	/* PKCS11 variant gives different result, accept both */
 +	assert_true(result == DST_R_COMPUTESECRETFAILURE || result == DST_R_INVALIDPRIVATEKEY);
 	dst_key_free(&key);
 }
 -- 
 2.20.1
--- a/bind-9.11-rh1666814.patch
+++ b/bind-9.11-rh1666814.patch
@ -1,29 +0,0 @@
 From 0f03071080e7fa68433b322359d46abaca2cc5ad Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Wed, 16 Jan 2019 16:27:33 +0100
 Subject: [PATCH] Fix possible crash when loading corrupted file
 Some values passes internal triggers by coincidence. Fix the check and
 check also first_node_offset before even passing it further.
 ---
 lib/dns/rbt.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)
 diff --git a/lib/dns/rbt.c b/lib/dns/rbt.c
 index 5aee5f6..7f2c2d2 100644
 --- a/lib/dns/rbt.c
 +++ b/lib/dns/rbt.c
@@ -945,7 +945,9 @@ dns_rbt_deserialize_tree(void *base_address, size_t filesize,
 	rbt->root = (dns_rbtnode_t *)((char *)base_address + header_offset +
 				      header->first_node_offset);
 -	if ((header->nodecount * sizeof(dns_rbtnode_t)) > filesize) {
 +	if ((header->nodecount * sizeof(dns_rbtnode_t)) > filesize
 +	    || header->first_node_offset > filesize) {
 +
 		result = ISC_R_INVALIDFILE;
 		goto cleanup;
 	}
 -- 
 2.31.1
--- a/bind-9.11-tests-variants.patch
+++ b/bind-9.11-tests-variants.patch
@ -1,65 +0,0 @@
 From 607cec78382b016aad0fe041f2e1895b6896c647 Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Fri, 1 Mar 2019 15:48:20 +0100
 Subject: [PATCH] Make alternative named builds testable in system tests
 Red Hat has alternative variant builds of named, which are not ever
 tested by system tests. New variables make it relatively easy to test
 alternative variants.
 For sdb variant use:
 export NAMED_VARIANT=-sdb DNSSEC_VARIANT=
 For pkcs variant use:
 export NAMED_VARIANT=-pkcs11 DNSSEC_VARIANT=-pkcs11
 ---
 bin/tests/system/conf.sh.in | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)
 diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
 index d859909..9152f07 100644
 --- a/bin/tests/system/conf.sh.in
 +++ b/bin/tests/system/conf.sh.in
@@ -37,17 +37,17 @@ DDNSCONFGEN=$TOP/bin/confgen/ddns-confgen
 DELV=$TOP/bin/delv/delv
 DIG=$TOP/bin/dig/dig
 DNSTAPREAD=$TOP/bin/tools/dnstap-read
 -DSFROMKEY=$TOP/bin/dnssec/dnssec-dsfromkey
 -FEATURETEST=$TOP/bin/named/feature-test
 +DSFROMKEY=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-dsfromkey${DNSSEC_VARIANT}
 +FEATURETEST=$TOP/bin/named${NAMED_VARIANT}/feature-test${NAMED_VARIANT}
 FSTRM_CAPTURE=@FSTRM_CAPTURE@
 HOST=$TOP/bin/dig/host
 -IMPORTKEY=$TOP/bin/dnssec/dnssec-importkey
 +IMPORTKEY=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-importkey${DNSSEC_VARIANT}
 JOURNALPRINT=$TOP/bin/tools/named-journalprint
 -KEYFRLAB=$TOP/bin/dnssec/dnssec-keyfromlabel
 -KEYGEN=$TOP/bin/dnssec/dnssec-keygen
 +KEYFRLAB=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-keyfromlabel${DNSSEC_VARIANT}
 +KEYGEN=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-keygen${DNSSEC_VARIANT}
 KEYMGR=$TOP/bin/python/dnssec-keymgr
 MDIG=$TOP/bin/tools/mdig
 -NAMED=$TOP/bin/named/named
 +NAMED=$TOP/bin/named${NAMED_VARIANT}/named${NAMED_VARIANT}
 NSEC3HASH=$TOP/bin/tools/nsec3hash
 NSLOOKUP=$TOP/bin/dig/nslookup
 NSUPDATE=$TOP/bin/nsupdate/nsupdate
@@ -56,12 +56,12 @@ PK11DEL="$TOP/bin/pkcs11/pkcs11-destroy -s ${SLOT:-0} -p ${HSMPIN:-1234} -w 0"
 PK11GEN="$TOP/bin/pkcs11/pkcs11-keygen -q -s ${SLOT:-0} -p ${HSMPIN:-1234}"
 PK11LIST="$TOP/bin/pkcs11/pkcs11-list -s ${SLOT:-0} -p ${HSMPIN:-1234}"
 RESOLVE=$TOP/bin/tests/system/resolve
 -REVOKE=$TOP/bin/dnssec/dnssec-revoke
 +REVOKE=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-revoke${DNSSEC_VARIANT}
 RNDC=$TOP/bin/rndc/rndc
 RNDCCONFGEN=$TOP/bin/confgen/rndc-confgen
 RRCHECKER=$TOP/bin/tools/named-rrchecker
 -SETTIME=$TOP/bin/dnssec/dnssec-settime
 -SIGNER=$TOP/bin/dnssec/dnssec-signzone
 +SETTIME=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-settime${DNSSEC_VARIANT}
 +SIGNER=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-signzone${DNSSEC_VARIANT}
 TSIGKEYGEN=$TOP/bin/confgen/tsig-keygen
 VERIFY=$TOP/bin/dnssec/dnssec-verify
 WIRETEST=$TOP/bin/tests/wire_test
 -- 
 2.26.3
--- a/bind-9.14-config-pkcs11.patch
+++ b/bind-9.14-config-pkcs11.patch
@ -1,83 +0,0 @@
 From e6ab9c67f0a14adc23c1067e03a106da1b1651b7 Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Fri, 18 Oct 2019 21:30:52 +0200
 Subject: [PATCH] Move USE_PKCS11 and USE_OPENSSL out of config.h
 Building two variants with the same common code requires to unset
 USE_PKCS11 on part of build. That is not possible with config.h value.
 Move it as normal define to CDEFINES.
 ---
 bin/confgen/Makefile.in |  2 +-
 configure.ac            |  8 ++++++--
 lib/dns/dst_internal.h  | 12 +++++++++---
 3 files changed, 16 insertions(+), 6 deletions(-)
 diff --git a/bin/confgen/Makefile.in b/bin/confgen/Makefile.in
 index 1b7512d..c126bf3 100644
 --- a/bin/confgen/Makefile.in
 +++ b/bin/confgen/Makefile.in
@@ -22,7 +22,7 @@ VERSION=@BIND9_VERSION@
 CINCLUDES = -I${srcdir}/include ${ISC_INCLUDES} ${ISCCC_INCLUDES} \
 	${ISCCFG_INCLUDES} ${DNS_INCLUDES} ${BIND9_INCLUDES}
 -CDEFINES =
 +CDEFINES = @USE_PKCS11@
 CWARNINGS =
 ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
 diff --git a/configure.ac b/configure.ac
 index f5483fe..08a7d8a 100644
 --- a/configure.ac
 +++ b/configure.ac
@@ -935,10 +935,14 @@ AC_SUBST([PKCS11_TEST])
 AC_SUBST([PKCS11_TOOLS])
 AC_SUBST([PKCS11_MANS])
 +USE_PKCS11='-DUSE_PKCS11=0'
 +USE_OPENSSL='-DUSE_OPENSSL=0'
 AC_SUBST([CRYPTO])
 AS_CASE([$CRYPTO],
 -	[pkcs11],[AC_DEFINE([USE_PKCS11], [1], [define if PKCS11 is used for Public-Key Cryptography])],
 -	[AC_DEFINE([USE_OPENSSL], [1], [define if OpenSSL is used for Public-Key Cryptography])])
 +	[pkcs11],[USE_PKCS11='-DUSE_PKCS11=1'],
 +	[USE_OPENSSL='-DUSE_OPENSSL=1'])
 +AC_SUBST(USE_PKCS11)
 +AC_SUBST(USE_OPENSSL)
 # preparation for automake
 # AM_CONDITIONAL([PKCS11_TOOLS], [test "$with_native_pkcs11" = "yes"])
 diff --git a/lib/dns/dst_internal.h b/lib/dns/dst_internal.h
 index 2c3b4a3..55e9dc4 100644
 --- a/lib/dns/dst_internal.h
 +++ b/lib/dns/dst_internal.h
@@ -38,6 +38,13 @@
 #include <isc/stdtime.h>
 #include <isc/types.h>
 +#ifndef USE_PKCS11
 +#define USE_PKCS11 0
 +#endif
 +#ifndef USE_OPENSSL
 +#define USE_OPENSSL (! USE_PKCS11)
 +#endif
 +
 #if USE_PKCS11
 #include <pk11/pk11.h>
 #include <pk11/site.h>
@@ -116,11 +123,10 @@ struct dst_key {
 		void *generic;
 		dns_gss_ctx_id_t gssctx;
 		DH *dh;
 -#if USE_OPENSSL
 -		EVP_PKEY *pkey;
 -#endif /* if USE_OPENSSL */
 #if USE_PKCS11
 		pk11_object_t *pkey;
 +#else
 +		EVP_PKEY *pkey;
 #endif /* if USE_PKCS11 */
 		dst_hmac_key_t *hmac_key;
 	} keydata; /*%< pointer to key in crypto pkg fmt */
 -- 
 2.26.2
--- a/bind-9.16-CVE-2021-25220-test.patch
+++ b/bind-9.16-CVE-2021-25220-test.patch
--- a/bind-9.16-CVE-2021-25220.patch
+++ b/bind-9.16-CVE-2021-25220.patch
@ -1,251 +0,0 @@
 From 5b2798e01346cd77741873091babf6c4a3128449 Mon Sep 17 00:00:00 2001
 From: Mark Andrews <marka@isc.org>
 Date: Wed, 19 Jan 2022 17:38:18 +1100
 Subject: [PATCH] Add additional name checks when using a forwarder
 When using a forwarder, check that the owner name of response
 records are within the bailiwick of the forwarded name space.
 (cherry picked from commit 24155213be59faad17f0215ecf73ea49ab781e5b)
 Check that the forward declaration is unchanged and not overridden
 If we are using a fowarder, in addition to checking that names to
 be cached are subdomains of the forwarded namespace, we must also
 check that there are no subsidiary forwarded namespaces which would
 take precedence. To be safe, we don't cache any responses if the
 forwarding configuration has changed since the query was sent.
 (cherry picked from commit 3fc7accd88cd0890f8f57bb13765876774298ba3)
 Check cached names for possible "forward only" clause
 When caching additional and glue data *not* from a forwarder, we must
 check that there is no "forward only" clause covering the owner name
 that would take precedence.  Such names would normally be allowed by
 baliwick rules, but a "forward only" zone introduces a new baliwick
 scope.
 (cherry picked from commit ea06552a3d1fed56f7d3a13710e084ec79797b78)
 Look for zones deeper than the current domain or forward name
 When caching glue, we need to ensure that there is no closer
 source of truth for the name. If the owner name for the glue
 record would be answered by a locally configured zone, do not
 cache.
 (cherry picked from commit 71b24210542730355149130770deea3e58d8527a)
 ---
 lib/dns/resolver.c | 128 +++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 123 insertions(+), 5 deletions(-)
 diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
 index a7bc661bb7..7603a07b7b 100644
 --- a/lib/dns/resolver.c
 +++ b/lib/dns/resolver.c
@@ -63,6 +63,8 @@
 #include <dns/stats.h>
 #include <dns/tsig.h>
 #include <dns/validator.h>
 +#include <dns/zone.h>
 +
 #ifdef WANT_QUERYTRACE
 #define RTRACE(m)                                                             \
 	isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,                     \
@@ -337,6 +339,8 @@ struct fetchctx {
 	dns_fetch_t *qminfetch;
 	dns_rdataset_t qminrrset;
 	dns_name_t qmindcname;
 +	dns_fixedname_t fwdfname;
 +	dns_name_t *fwdname;
 	/*%
 	 * The number of events we're waiting for.
@@ -3764,6 +3768,7 @@ fctx_getaddresses(fetchctx_t *fctx, bool badcache) {
 		if (result == ISC_R_SUCCESS) {
 			fwd = ISC_LIST_HEAD(forwarders->fwdrs);
 			fctx->fwdpolicy = forwarders->fwdpolicy;
 +			dns_name_copynf(domain, fctx->fwdname);
 			if (fctx->fwdpolicy == dns_fwdpolicy_only &&
 			    isstrictsubdomain(domain, &fctx->domain))
 			{
@@ -5153,6 +5158,9 @@ fctx_create(dns_resolver_t *res, const dns_name_t *name, dns_rdatatype_t type,
 	fctx->restarts = 0;
 	fctx->querysent = 0;
 	fctx->referrals = 0;
 +
 +	fctx->fwdname = dns_fixedname_initname(&fctx->fwdfname);
 +
 	TIME_NOW(&fctx->start);
 	fctx->timeouts = 0;
 	fctx->lamecount = 0;
@@ -5215,6 +5223,7 @@ fctx_create(dns_resolver_t *res, const dns_name_t *name, dns_rdatatype_t type,
 					   fname, &forwarders);
 		if (result == ISC_R_SUCCESS) {
 			fctx->fwdpolicy = forwarders->fwdpolicy;
 +			dns_name_copynf(fname, fctx->fwdname);
 		}
 		if (fctx->fwdpolicy != dns_fwdpolicy_only) {
@@ -7118,6 +7127,107 @@ mark_related(dns_name_t *name, dns_rdataset_t *rdataset, bool external,
 	}
 }
 +/*
 + * Returns true if 'name' is external to the namespace for which
 + * the server being queried can answer, either because it's not a
 + * subdomain or because it's below a forward declaration or a
 + * locally served zone.
 + */
 +static inline bool
 +name_external(const dns_name_t *name, dns_rdatatype_t type, fetchctx_t *fctx) {
 +	isc_result_t result;
 +	dns_forwarders_t *forwarders = NULL;
 +	dns_fixedname_t fixed, zfixed;
 +	dns_name_t *fname = dns_fixedname_initname(&fixed);
 +	dns_name_t *zfname = dns_fixedname_initname(&zfixed);
 +	dns_name_t *apex = NULL;
 +	dns_name_t suffix;
 +	dns_zone_t *zone = NULL;
 +	unsigned int labels;
 +	dns_namereln_t rel;
 +
 +	apex = ISFORWARDER(fctx->addrinfo) ? fctx->fwdname : &fctx->domain;
 +
 +	/*
 +	 * The name is outside the queried namespace.
 +	 */
 +	rel = dns_name_fullcompare(name, apex, &(int){ 0 },
 +				   &(unsigned int){ 0U });
 +	if (rel != dns_namereln_subdomain && rel != dns_namereln_equal) {
 +		return (true);
 +	}
 +
 +	/*
 +	 * If the record lives in the parent zone, adjust the name so we
 +	 * look for the correct zone or forward clause.
 +	 */
 +	labels = dns_name_countlabels(name);
 +	if (dns_rdatatype_atparent(type) && labels > 1U) {
 +		dns_name_init(&suffix, NULL);
 +		dns_name_getlabelsequence(name, 1, labels - 1, &suffix);
 +		name = &suffix;
 +	} else if (rel == dns_namereln_equal) {
 +		/* If 'name' is 'apex', no further checking is needed. */
 +		return (false);
 +	}
 +
 +	/*
 +	 * If there is a locally served zone between 'apex' and 'name'
 +	 * then don't cache.
 +	 */
 +	LOCK(&fctx->res->view->lock);
 +	if (fctx->res->view->zonetable != NULL) {
 +		unsigned int options = DNS_ZTFIND_NOEXACT | DNS_ZTFIND_MIRROR;
 +		result = dns_zt_find(fctx->res->view->zonetable, name, options,
 +				     zfname, &zone);
 +		if (zone != NULL) {
 +			dns_zone_detach(&zone);
 +		}
 +		if (result == ISC_R_SUCCESS || result == DNS_R_PARTIALMATCH) {
 +			if (dns_name_fullcompare(zfname, apex, &(int){ 0 },
 +						 &(unsigned int){ 0U }) ==
 +			    dns_namereln_subdomain)
 +			{
 +				UNLOCK(&fctx->res->view->lock);
 +				return (true);
 +			}
 +		}
 +	}
 +	UNLOCK(&fctx->res->view->lock);
 +
 +	/*
 +	 * Look for a forward declaration below 'name'.
 +	 */
 +	result = dns_fwdtable_find(fctx->res->view->fwdtable, name, fname,
 +				   &forwarders);
 +
 +	if (ISFORWARDER(fctx->addrinfo)) {
 +		/*
 +		 * See if the forwarder declaration is better.
 +		 */
 +		if (result == ISC_R_SUCCESS) {
 +			return (!dns_name_equal(fname, fctx->fwdname));
 +		}
 +
 +		/*
 +		 * If the lookup failed, the configuration must have
 +		 * changed: play it safe and don't cache.
 +		 */
 +		return (true);
 +	} else if (result == ISC_R_SUCCESS &&
 +		   forwarders->fwdpolicy == dns_fwdpolicy_only &&
 +		   !ISC_LIST_EMPTY(forwarders->fwdrs))
 +	{
 +		/*
 +		 * If 'name' is covered by a 'forward only' clause then we
 +		 * can't cache this repsonse.
 +		 */
 +		return (true);
 +	}
 +
 +	return (false);
 +}
 +
 static isc_result_t
 check_section(void *arg, const dns_name_t *addname, dns_rdatatype_t type,
 	      dns_section_t section) {
@@ -7144,7 +7254,7 @@ check_section(void *arg, const dns_name_t *addname, dns_rdatatype_t type,
 	result = dns_message_findname(rctx->query->rmessage, section, addname,
 				      dns_rdatatype_any, 0, &name, NULL);
 	if (result == ISC_R_SUCCESS) {
 -		external = !dns_name_issubdomain(name, &fctx->domain);
 +		external = name_external(name, type, fctx);
 		if (type == dns_rdatatype_a) {
 			for (rdataset = ISC_LIST_HEAD(name->list);
 			     rdataset != NULL;
@@ -8768,6 +8878,13 @@ rctx_answer_scan(respctx_t *rctx) {
 			break;
 		case dns_namereln_subdomain:
 +			/*
 +			 * Don't accept DNAME from parent namespace.
 +			 */
 +			if (name_external(name, dns_rdatatype_dname, fctx)) {
 +				continue;
 +			}
 +
 			/*
 			 * In-scope DNAME records must have at least
 			 * as many labels as the domain being queried.
@@ -9081,13 +9198,11 @@ rctx_authority_positive(respctx_t *rctx) {
 				       DNS_SECTION_AUTHORITY);
 	while (!done && result == ISC_R_SUCCESS) {
 		dns_name_t *name = NULL;
 -		bool external;
 		dns_message_currentname(rctx->query->rmessage,
 					DNS_SECTION_AUTHORITY, &name);
 -		external = !dns_name_issubdomain(name, &fctx->domain);
 -		if (!external) {
 +		if (!name_external(name, dns_rdatatype_ns, fctx)) {
 			dns_rdataset_t *rdataset = NULL;
 			/*
@@ -9474,7 +9589,10 @@ rctx_authority_dnssec(respctx_t *rctx) {
 		}
 		if (!dns_name_issubdomain(name, &fctx->domain)) {
 -			/* Invalid name found; preserve it for logging later */
 +			/*
 +			 * Invalid name found; preserve it for logging
 +			 * later.
 +			 */
 			rctx->found_name = name;
 			rctx->found_type = ISC_LIST_HEAD(name->list)->type;
 			continue;
 -- 
 2.34.1
--- a/bind-9.16-CVE-2022-0396.patch
+++ b/bind-9.16-CVE-2022-0396.patch
@ -1,81 +0,0 @@
 From 33064cd077cf6fa386f0a5a840c2161868da7b3a Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
 Date: Tue, 8 Feb 2022 12:42:34 +0100
 Subject: [PATCH] Run .closehandle_cb asynchrounosly in nmhandle_detach_cb()
 When sock->closehandle_cb is set, we need to run nmhandle_detach_cb()
 asynchronously to ensure correct order of multiple packets processing in
 the isc__nm_process_sock_buffer().  When not run asynchronously, it
 would cause:
  a) out-of-order processing of the return codes from processbuffer();
  b) stack growth because the next TCP DNS message read callback will
     be called from within the current TCP DNS message read callback.
 The sock->closehandle_cb is set to isc__nm_resume_processing() for TCP
 sockets which calls isc__nm_process_sock_buffer().  If the read callback
 (called from isc__nm_process_sock_buffer()->processbuffer()) doesn't
 attach to the nmhandle (f.e. because it wants to drop the processing or
 we send the response directly via uv_try_write()), the
 isc__nm_resume_processing() (via .closehandle_cb) would call
 isc__nm_process_sock_buffer() recursively.
 The below shortened code path shows how the stack can grow:
 1: ns__client_request(handle, ...);
 2: isc_nm_tcpdns_sequential(handle);
 3: ns_query_start(client, handle);
 4:   query_lookup(qctx);
 5:     query_send(qctcx->client);
 6:       isc__nmhandle_detach(&client->reqhandle);
 7:         nmhandle_detach_cb(&handle);
 8:           sock->closehandle_cb(sock); // isc__nm_resume_processing
 9:             isc__nm_process_sock_buffer(sock);
 10:               processbuffer(sock); // isc__nm_tcpdns_processbuffer
 11:                 isc_nmhandle_attach(req->handle, &handle);
 12:                 isc__nm_readcb(sock, req, ISC_R_SUCCESS);
 13:                   isc__nm_async_readcb(NULL, ...);
 14:                     uvreq->cb.recv(...); // ns__client_request
 Instead, if 'sock->closehandle_cb' is set, we need to run detach the
 handle asynchroniously in 'isc__nmhandle_detach', so that on line 8 in
 the code flow above does not start this recursion. This ensures the
 correct order when processing multiple packets in the function
 'isc__nm_process_sock_buffer()' and prevents the stack growth.
 When not run asynchronously, the out-of-order processing leaves the
 first TCP socket open until all requests on the stream have been
 processed.
 If the pipelining is disabled on the TCP via `keep-response-order`
 configuration option, named would keep the first socket in lingering
 CLOSE_WAIT state when the client sends an incomplete packet and then
 closes the connection from the client side.
 (cherry picked from commit afee2b5a7bc933a2d987907fc327a9f118fdbd17)
 ---
 lib/isc/netmgr/netmgr.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)
 diff --git a/lib/isc/netmgr/netmgr.c b/lib/isc/netmgr/netmgr.c
 index 3283eb6e4f..0ed3182fb6 100644
 --- a/lib/isc/netmgr/netmgr.c
 +++ b/lib/isc/netmgr/netmgr.c
@@ -1746,8 +1746,12 @@ isc__nmhandle_detach(isc_nmhandle_t **handlep FLARG) {
 	handle = *handlep;
 	*handlep = NULL;
 +	/*
 +	 * If the closehandle_cb is set, it needs to run asynchronously to
 +	 * ensure correct ordering of the isc__nm_process_sock_buffer().
 +	 */
 	sock = handle->sock;
 -	if (sock->tid == isc_nm_tid()) {
 +	if (sock->tid == isc_nm_tid() && sock->closehandle_cb == NULL) {
 		nmhandle_detach_cb(&handle FLARG_PASS);
 	} else {
 		isc__netievent_detach_t *event =
 -- 
 2.34.1
--- a/bind-9.16-CVE-2022-2795.patch
+++ b/bind-9.16-CVE-2022-2795.patch
@ -1,60 +0,0 @@
 From bf2ea6d8525bfd96a84dad221ba9e004adb710a8 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Micha=C5=82=20K=C4=99pie=C5=84?= <michal@isc.org>
 Date: Thu, 8 Sep 2022 11:11:30 +0200
 Subject: [PATCH] Bound the amount of work performed for delegations
 Limit the amount of database lookups that can be triggered in
 fctx_getaddresses() (i.e. when determining the name server addresses to
 query next) by setting a hard limit on the number of NS RRs processed
 for any delegation encountered.  Without any limit in place, named can
 be forced to perform large amounts of database lookups per each query
 received, which severely impacts resolver performance.
 The limit used (20) is an arbitrary value that is considered to be big
 enough for any sane DNS delegation.
 (cherry picked from commit 3a44097fd6c6c260765b628cd1d2c9cb7efb0b2a)
 ---
 lib/dns/resolver.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)
 diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
 index d2cf14bbc8..73a0ee9f77 100644
 --- a/lib/dns/resolver.c
 +++ b/lib/dns/resolver.c
@@ -195,6 +195,12 @@
  */
 #define NS_FAIL_LIMIT 4
 #define NS_RR_LIMIT   5
 +/*
 + * IP address lookups are performed for at most NS_PROCESSING_LIMIT NS RRs in
 + * any NS RRset encountered, to avoid excessive resource use while processing
 + * large delegations.
 + */
 +#define NS_PROCESSING_LIMIT 20
 /* Number of hash buckets for zone counters */
 #ifndef RES_DOMAIN_BUCKETS
@@ -3711,6 +3717,7 @@ fctx_getaddresses(fetchctx_t *fctx, bool badcache) {
 	bool need_alternate = false;
 	bool all_spilled = true;
 	unsigned int no_addresses = 0;
 +	unsigned int ns_processed = 0;
 	FCTXTRACE5("getaddresses", "fctx->depth=", fctx->depth);
@@ -3902,6 +3909,11 @@ normal_nses:
 		dns_rdata_reset(&rdata);
 		dns_rdata_freestruct(&ns);
 +
 +		if (++ns_processed >= NS_PROCESSING_LIMIT) {
 +			result = ISC_R_NOMORE;
 +			break;
 +		}
 	}
 	if (result != ISC_R_NOMORE) {
 		return (result);
 -- 
 2.37.3
--- a/bind-9.16-CVE-2022-3080.patch
+++ b/bind-9.16-CVE-2022-3080.patch
@ -1,116 +0,0 @@
 From 3bcd32572504ac9b92e3c6ec1e2cee3df3b68309 Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Tue, 20 Sep 2022 11:34:42 +0200
 Subject: [PATCH 2/4] Fix CVE-2022-3080
 5960.	[security]	Fix serve-stale crash that could happen when
 			stale-answer-client-timeout was set to 0 and there was
 			a stale CNAME in the cache for an incoming query.
 			(CVE-2022-3080) [GL #3517]
 ---
 lib/ns/include/ns/query.h |  1 +
 lib/ns/query.c            | 42 ++++++++++++++++++++++++---------------
 2 files changed, 27 insertions(+), 16 deletions(-)
 diff --git a/lib/ns/include/ns/query.h b/lib/ns/include/ns/query.h
 index 4d48cf6..34b3070 100644
 --- a/lib/ns/include/ns/query.h
 +++ b/lib/ns/include/ns/query.h
@@ -145,6 +145,7 @@ struct query_ctx {
 	bool authoritative;		    /* authoritative query? */
 	bool want_restart;		    /* CNAME chain or other
 					     * restart needed */
 +	bool		refresh_rrset;	    /* stale RRset refresh needed */
 	bool		need_wildcardproof; /* wildcard proof needed */
 	bool		nxrewrite;	    /* negative answer from RPZ */
 	bool		findcoveringnsec;   /* lookup covering NSEC */
 diff --git a/lib/ns/query.c b/lib/ns/query.c
 index 249321c..a450cb7 100644
 --- a/lib/ns/query.c
 +++ b/lib/ns/query.c
@@ -5686,7 +5686,6 @@ query_lookup(query_ctx_t *qctx) {
 	bool dbfind_stale = false;
 	bool stale_timeout = false;
 	bool stale_found = false;
 -	bool refresh_rrset = false;
 	bool stale_refresh_window = false;
 	CCTRACE(ISC_LOG_DEBUG(3), "query_lookup");
@@ -5868,8 +5867,7 @@ query_lookup(query_ctx_t *qctx) {
 					"%s stale answer used, an attempt to "
 					"refresh the RRset will still be made",
 					namebuf);
 -				refresh_rrset = STALE(qctx->rdataset);
 -				qctx->client->nodetach = refresh_rrset;
 +				qctx->refresh_rrset = STALE(qctx->rdataset);
 			}
 		} else {
 			/*
@@ -5907,17 +5905,6 @@ query_lookup(query_ctx_t *qctx) {
 	result = query_gotanswer(qctx, result);
 -	if (refresh_rrset) {
 -		/*
 -		 * If we reached this point then it means that we have found a
 -		 * stale RRset entry in cache and BIND is configured to allow
 -		 * queries to be answered with stale data if no active RRset
 -		 * is available, i.e. "stale-anwer-client-timeout 0". But, we
 -		 * still need to refresh the RRset.
 -		 */
 -		query_refresh_rrset(qctx);
 -	}
 -
 cleanup:
 	return (result);
 }
@@ -7737,11 +7724,14 @@ query_addanswer(query_ctx_t *qctx) {
 	/*
 	 * On normal lookups, clear any rdatasets that were added on a
 -	 * lookup due to stale-answer-client-timeout.
 +	 * lookup due to stale-answer-client-timeout. Do not clear if we
 +	 * are going to refresh the RRset, because the stale contents are
 +	 * prioritized.
 	 */
 	if (QUERY_STALEOK(&qctx->client->query) &&
 -	    !QUERY_STALETIMEOUT(&qctx->client->query))
 +	    !QUERY_STALETIMEOUT(&qctx->client->query) && !qctx->refresh_rrset)
 	{
 +		CCTRACE(ISC_LOG_DEBUG(3), "query_clear_stale");
 		query_clear_stale(qctx->client);
 		/*
 		 * We can clear the attribute to prevent redundant clearing
@@ -11457,9 +11447,29 @@ ns_query_done(query_ctx_t *qctx) {
 	/*
 	 * Client may have been detached after query_send(), so
 	 * we test and store the flag state here, for safety.
 +	 * If we are refreshing the RRSet, we must not detach from the client
 +	 * in the query_send(), so we need to override the flag.
 	 */
 +	if (qctx->refresh_rrset) {
 +		qctx->client->nodetach = true;
 +	}
 	nodetach = qctx->client->nodetach;
 	query_send(qctx->client);
 +
 +	if (qctx->refresh_rrset) {
 +		/*
 +		 * If we reached this point then it means that we have found a
 +		 * stale RRset entry in cache and BIND is configured to allow
 +		 * queries to be answered with stale data if no active RRset
 +		 * is available, i.e. "stale-anwer-client-timeout 0". But, we
 +		 * still need to refresh the RRset. To prevent adding duplicate
 +		 * RRsets, clear the RRsets from the message before doing the
 +		 * refresh.
 +		 */
 +		message_clearrdataset(qctx->client->message, 0);
 +		query_refresh_rrset(qctx);
 +	}
 +
 	if (!nodetach) {
 		qctx->detach_client = true;
 	}
 -- 
 2.37.3
--- a/bind-9.16-CVE-2022-3094-1.patch
+++ b/bind-9.16-CVE-2022-3094-1.patch
@ -1,240 +0,0 @@
 From 18036bb3f435eaa20d60093738c61e5da42a6cfe Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Thu, 1 Sep 2022 16:05:04 -0700
 Subject: [PATCH] add an update quota
 limit the number of simultaneous DNS UPDATE events that can be
 processed by adding a quota for update and update forwarding.
 this quota currently, arbitrarily, defaults to 100.
 also add a statistics counter to record when the update quota
 has been exceeded.
 (cherry picked from commit 7c47254a140c3e9cf383cda73c7b6a55c4782826)
 ---
 bin/named/bind9.xsl        |  4 +++-
 bin/named/bind9.xsl.h      |  6 +++++-
 bin/named/statschannel.c   |  5 +++--
 doc/arm/reference.rst      |  5 +++++
 lib/ns/include/ns/server.h |  1 +
 lib/ns/include/ns/stats.h  |  4 +++-
 lib/ns/server.c            |  2 ++
 lib/ns/update.c            | 37 ++++++++++++++++++++++++++++++++++++-
 8 files changed, 58 insertions(+), 6 deletions(-)
 diff --git a/bin/named/bind9.xsl b/bin/named/bind9.xsl
 index 5078115..194625b 100644
 --- a/bin/named/bind9.xsl
 +++ b/bin/named/bind9.xsl
@@ -12,7 +12,9 @@
 <xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns="http://www.w3.org/1999/xhtml" version="1.0">
   <xsl:output method="html" indent="yes" version="4.0"/>
 -  <xsl:template match="statistics[@version=&quot;3.11&quot;]">
 +  <!-- the version number **below** must match version in bin/named/statschannel.c -->
 +  <!-- don't forget to update "/xml/v<STATS_XML_VERSION_MAJOR>" in the HTTP endpoints listed below -->
 +  <xsl:template match="statistics[@version=&quot;3.11.1&quot;]">
     <html>
       <head>
         <script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js"></script>
 diff --git a/bin/named/bind9.xsl.h b/bin/named/bind9.xsl.h
 index e30f7f5..b182742 100644
 --- a/bin/named/bind9.xsl.h
 +++ b/bin/named/bind9.xsl.h
@@ -20,7 +20,11 @@ static char xslmsg[] =
 	"<xsl:stylesheet xmlns:xsl=\"http://www.w3.org/1999/XSL/Transform\" "
 	"xmlns=\"http://www.w3.org/1999/xhtml\" version=\"1.0\">\n"
 	" <xsl:output method=\"html\" indent=\"yes\" version=\"4.0\"/>\n"
 -	" <xsl:template match=\"statistics[@version=&quot;3.11&quot;]\">\n"
 +	" <!-- the version number **below** must match version in "
 +	"bin/named/statschannel.c -->\n"
 +	" <!-- don't forget to update \"/xml/v<STATS_XML_VERSION_MAJOR>\" in "
 +	"the HTTP endpoints listed below -->\n"
 +	" <xsl:template match=\"statistics[@version=&quot;3.11.1&quot;]\">\n"
 	" <html>\n"
 	" <head>\n"
 	" <script type=\"text/javascript\" "
 diff --git a/bin/named/statschannel.c b/bin/named/statschannel.c
 index 832ce93..7361ead 100644
 --- a/bin/named/statschannel.c
 +++ b/bin/named/statschannel.c
@@ -335,6 +335,7 @@ init_desc(void) {
 	SET_NSSTATDESC(reclimitdropped,
 		       "queries dropped due to recursive client limit",
 		       "RecLimitDropped");
 +	SET_NSSTATDESC(updatequota, "Update quota exceeded", "UpdateQuota");
 	INSIST(i == ns_statscounter_max);
@@ -2007,7 +2008,7 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,
 					      "href=\"/bind9.xsl\""));
 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "statistics"));
 	TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "version",
 -					 ISC_XMLCHAR "3.11"));
 +					 ISC_XMLCHAR "3.11.1"));
 	/* Set common fields for statistics dump */
 	dumparg.type = isc_statsformat_xml;
@@ -2876,7 +2877,7 @@ generatejson(named_server_t *server, size_t *msglen, const char **msg,
 	/*
 	 * These statistics are included no matter which URL we use.
 	 */
 -	obj = json_object_new_string("1.5");
 +	obj = json_object_new_string("1.5.1");
 	CHECKMEM(obj);
 	json_object_object_add(bindstats, "json-stats-version", obj);
 diff --git a/doc/arm/reference.rst b/doc/arm/reference.rst
 index 2d05aec..25c20d7 100644
 --- a/doc/arm/reference.rst
 +++ b/doc/arm/reference.rst
@@ -6705,6 +6705,11 @@ Name Server Statistics Counters
 ``UpdateBadPrereq``
     This indicates the number of dynamic updates rejected due to a prerequisite failure.
 +``UpdateQuota``
 +    This indicates the number of times a dynamic update or update
 +    forwarding request was rejected because the number of pending
 +    requests exceeded the update quota.
 +
 ``RateDropped``
     This indicates the number of responses dropped due to rate limits.
 diff --git a/lib/ns/include/ns/server.h b/lib/ns/include/ns/server.h
 index 6a1f345..0abb579 100644
 --- a/lib/ns/include/ns/server.h
 +++ b/lib/ns/include/ns/server.h
@@ -84,6 +84,7 @@ struct ns_server {
 	isc_quota_t recursionquota;
 	isc_quota_t tcpquota;
 	isc_quota_t xfroutquota;
 +	isc_quota_t updquota;
 	/*% Test options and other configurables */
 	uint32_t options;
 diff --git a/lib/ns/include/ns/stats.h b/lib/ns/include/ns/stats.h
 index 3c08799..95b15d0 100644
 --- a/lib/ns/include/ns/stats.h
 +++ b/lib/ns/include/ns/stats.h
@@ -106,7 +106,9 @@ enum {
 	ns_statscounter_reclimitdropped = 66,
 -	ns_statscounter_max = 67,
 +	ns_statscounter_updatequota = 67,
 +
 +	ns_statscounter_max = 68,
 };
 void
 diff --git a/lib/ns/server.c b/lib/ns/server.c
 index a970a28..540bc2e 100644
 --- a/lib/ns/server.c
 +++ b/lib/ns/server.c
@@ -52,6 +52,7 @@ ns_server_create(isc_mem_t *mctx, ns_matchview_t matchingview,
 	isc_quota_init(&sctx->xfroutquota, 10);
 	isc_quota_init(&sctx->tcpquota, 10);
 	isc_quota_init(&sctx->recursionquota, 100);
 +	isc_quota_init(&sctx->updquota, 100);
 	CHECKFATAL(dns_tkeyctx_create(mctx, &sctx->tkeyctx));
@@ -131,6 +132,7 @@ ns_server_detach(ns_server_t **sctxp) {
 			isc_mem_put(sctx->mctx, altsecret, sizeof(*altsecret));
 		}
 +		isc_quota_destroy(&sctx->updquota);
 		isc_quota_destroy(&sctx->recursionquota);
 		isc_quota_destroy(&sctx->tcpquota);
 		isc_quota_destroy(&sctx->xfroutquota);
 diff --git a/lib/ns/update.c b/lib/ns/update.c
 index 546b70a..1871438 100644
 --- a/lib/ns/update.c
 +++ b/lib/ns/update.c
@@ -1544,6 +1544,19 @@ send_update_event(ns_client_t *client, dns_zone_t *zone) {
 	update_event_t *event = NULL;
 	isc_task_t *zonetask = NULL;
 +	result = isc_quota_attach(&client->manager->sctx->updquota,
 +				  &(isc_quota_t *){ NULL });
 +	if (result != ISC_R_SUCCESS) {
 +		update_log(client, zone, LOGLEVEL_PROTOCOL,
 +			   "update failed: too many DNS UPDATEs queued (%s)",
 +			   isc_result_totext(result));
 +		ns_stats_increment(client->manager->sctx->nsstats,
 +				   ns_statscounter_updatequota);
 +		ns_client_drop(client, result);
 +		isc_nmhandle_detach(&client->reqhandle);
 +		return (DNS_R_DROP);
 +	}
 +
 	event = (update_event_t *)isc_event_allocate(
 		client->mctx, client, DNS_EVENT_UPDATE, update_action, NULL,
 		sizeof(*event));
@@ -1676,12 +1689,18 @@ failure:
 		       dns_zone_gettype(zone) == dns_zone_mirror);
 		inc_stats(client, zone, ns_statscounter_updaterej);
 	}
 +
 	/*
 	 * We failed without having sent an update event to the zone.
 	 * We are still in the client task context, so we can
 	 * simply give an error response without switching tasks.
 	 */
 -	respond(client, result);
 +	if (result == DNS_R_DROP) {
 +		ns_client_drop(client, result);
 +	} else {
 +		respond(client, result);
 +	}
 +
 	if (zone != NULL) {
 		dns_zone_detach(&zone);
 	}
@@ -3489,6 +3508,7 @@ updatedone_action(isc_task_t *task, isc_event_t *event) {
 	respond(client, uev->result);
 +	isc_quota_detach(&(isc_quota_t *){ &client->manager->sctx->updquota });
 	isc_event_free(&event);
 	isc_nmhandle_detach(&client->updatehandle);
 }
@@ -3505,6 +3525,8 @@ forward_fail(isc_task_t *task, isc_event_t *event) {
 	INSIST(client->nupdates > 0);
 	client->nupdates--;
 	respond(client, DNS_R_SERVFAIL);
 +
 +	isc_quota_detach(&(isc_quota_t *){ &client->manager->sctx->updquota });
 	isc_event_free(&event);
 	isc_nmhandle_detach(&client->updatehandle);
 }
@@ -3542,6 +3564,8 @@ forward_done(isc_task_t *task, isc_event_t *event) {
 	client->nupdates--;
 	ns_client_sendraw(client, uev->answer);
 	dns_message_detach(&uev->answer);
 +
 +	isc_quota_detach(&(isc_quota_t *){ &client->manager->sctx->updquota });
 	isc_event_free(&event);
 	isc_nmhandle_detach(&client->updatehandle);
 }
@@ -3576,6 +3600,17 @@ send_forward_event(ns_client_t *client, dns_zone_t *zone) {
 	update_event_t *event = NULL;
 	isc_task_t *zonetask = NULL;
 +	result = isc_quota_attach(&client->manager->sctx->updquota,
 +				  &(isc_quota_t *){ NULL });
 +	if (result != ISC_R_SUCCESS) {
 +		update_log(client, zone, LOGLEVEL_PROTOCOL,
 +			   "update failed: too many DNS UPDATEs queued (%s)",
 +			   isc_result_totext(result));
 +		ns_stats_increment(client->manager->sctx->nsstats,
 +				   ns_statscounter_updatequota);
 +		return (DNS_R_DROP);
 +	}
 +
 	event = (update_event_t *)isc_event_allocate(
 		client->mctx, client, DNS_EVENT_UPDATE, forward_action, NULL,
 		sizeof(*event));
 -- 
 2.39.2
--- a/bind-9.16-CVE-2022-3094-2.patch
+++ b/bind-9.16-CVE-2022-3094-2.patch
@ -1,266 +0,0 @@
 From 7fe2204a2e8952bf892e4a70fea2ef5167e1f509 Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Thu, 1 Sep 2022 16:22:46 -0700
 Subject: [PATCH] add a configuration option for the update quota
 add an "update-quota" option to configure the update quota.
 (cherry picked from commit f57758a7303ad0034ff2ff08eaaf2ef899630f19)
 ---
 bin/named/config.c                   | 1 +
 bin/named/named.conf.rst             | 9 +++++----
 bin/named/server.c                   | 1 +
 bin/tests/system/checkconf/good.conf | 1 +
 doc/arm/reference.rst                | 7 ++++++-
 doc/man/named.conf.5in               | 9 +++++----
 doc/misc/master.zoneopt.rst          | 2 +-
 doc/misc/options                     | 1 +
 doc/misc/options.active              | 1 +
 doc/misc/options.grammar.rst         | 3 ++-
 doc/misc/slave.zoneopt.rst           | 2 +-
 lib/isccfg/namedconf.c               | 1 +
 12 files changed, 26 insertions(+), 12 deletions(-)
 diff --git a/bin/named/config.c b/bin/named/config.c
 index 5fedee84d9..494147015f 100644
 --- a/bin/named/config.c
 +++ b/bin/named/config.c
@@ -130,6 +130,7 @@ options {\n\
 	transfers-out 10;\n\
 	transfers-per-ns 2;\n\
 	trust-anchor-telemetry yes;\n\
 +	update-quota 100;\n\
 \n\
 	/* view */\n\
 	allow-new-zones no;\n\
 diff --git a/bin/named/named.conf.rst b/bin/named/named.conf.rst
 index 27eed5ca3e..4c9f9a7370 100644
 --- a/bin/named/named.conf.rst
 +++ b/bin/named/named.conf.rst
@@ -179,7 +179,7 @@ OPTIONS
   	answer-cookie boolean;
   	attach-cache string;
   	auth-nxdomain boolean; // default changed
 -  	auto-dnssec ( allow | maintain | off );
 +  	auto-dnssec ( allow | maintain | off );// deprecated
   	automatic-interface-scan boolean;
   	avoid-v4-udp-ports { portrange; ... };
   	avoid-v6-udp-ports { portrange; ... };
@@ -446,6 +446,7 @@ OPTIONS
   	trust-anchor-telemetry boolean; // experimental
   	try-tcp-refresh boolean;
   	update-check-ksk boolean;
 +  	update-quota integer;
   	use-alt-transfer-source boolean;
   	use-v4-udp-ports { portrange; ... };
   	use-v6-udp-ports { portrange; ... };
@@ -584,7 +585,7 @@ VIEW
   	    * ) ] [ dscp integer ];
   	attach-cache string;
   	auth-nxdomain boolean; // default changed
 -  	auto-dnssec ( allow | maintain | off );
 +  	auto-dnssec ( allow | maintain | off );// deprecated
   	cache-file quoted_string;// deprecated
   	catalog-zones { zone string [ default-masters [ port integer ]
   	    [ dscp integer ] { ( remote-servers | ipv4_address [ port
@@ -859,7 +860,7 @@ VIEW
   		    integer | * ) ] [ dscp integer ];
   		alt-transfer-source-v6 ( ipv6_address | * ) [ port (
   		    integer | * ) ] [ dscp integer ];
 -  		auto-dnssec ( allow | maintain | off );
 +  		auto-dnssec ( allow | maintain | off );// deprecated
   		check-dup-records ( fail | warn | ignore );
   		check-integrity boolean;
   		check-mx ( fail | warn | ignore );
@@ -977,7 +978,7 @@ ZONE
   	    ] [ dscp integer ];
   	alt-transfer-source-v6 ( ipv6_address | * ) [ port ( integer |
   	    * ) ] [ dscp integer ];
 -  	auto-dnssec ( allow | maintain | off );
 +  	auto-dnssec ( allow | maintain | off );// deprecated
   	check-dup-records ( fail | warn | ignore );
   	check-integrity boolean;
   	check-mx ( fail | warn | ignore );
 diff --git a/bin/named/server.c b/bin/named/server.c
 index 20443ff8a9..78a21d62a2 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
@@ -8542,6 +8542,7 @@ load_configuration(const char *filename, named_server_t *server,
 	configure_server_quota(maps, "tcp-clients", &server->sctx->tcpquota);
 	configure_server_quota(maps, "recursive-clients",
 			       &server->sctx->recursionquota);
 +	configure_server_quota(maps, "update-quota", &server->sctx->updquota);
 	max = isc_quota_getmax(&server->sctx->recursionquota);
 	if (max > 1000) {
 diff --git a/bin/tests/system/checkconf/good.conf b/bin/tests/system/checkconf/good.conf
 index b1f7059acf..0ecdb68e95 100644
 --- a/bin/tests/system/checkconf/good.conf
 +++ b/bin/tests/system/checkconf/good.conf
@@ -75,6 +75,7 @@ options {
 	recursive-clients 3000;
 	serial-query-rate 100;
 	server-id none;
 +	update-quota 200;
 	check-names primary warn;
 	check-names secondary ignore;
 	max-cache-size 20000000000000;
 diff --git a/doc/arm/reference.rst b/doc/arm/reference.rst
 index 2603d60251..703663d0ba 100644
 --- a/doc/arm/reference.rst
 +++ b/doc/arm/reference.rst
@@ -3151,6 +3151,11 @@ system.
    value as ``tcp-keepalive-timeout``. This value can be updated at
    runtime by using ``rndc tcp-timeouts``.
 +``update-quota``
 +   This is the maximum number of simultaneous DNS UPDATE messages that
 +   the server will accept for updating local authoritiative zones or
 +   forwarding to a primary server. The default is ``100``.
 +
 .. _intervals:
 Periodic Task Intervals
@@ -6840,7 +6845,7 @@ Name Server Statistics Counters
 ``UpdateQuota``
     This indicates the number of times a dynamic update or update
     forwarding request was rejected because the number of pending
 -    requests exceeded the update quota.
 +    requests exceeded ``update-quota``.
 ``RateDropped``
     This indicates the number of responses dropped due to rate limits.
 diff --git a/doc/man/named.conf.5in b/doc/man/named.conf.5in
 index 4c46f47592..c87afa2881 100644
 --- a/doc/man/named.conf.5in
 +++ b/doc/man/named.conf.5in
@@ -231,7 +231,7 @@ options {
       answer\-cookie boolean;
       attach\-cache string;
       auth\-nxdomain boolean; // default changed
 -      auto\-dnssec ( allow | maintain | off );
 +      auto\-dnssec ( allow | maintain | off );// deprecated
       automatic\-interface\-scan boolean;
       avoid\-v4\-udp\-ports { portrange; ... };
       avoid\-v6\-udp\-ports { portrange; ... };
@@ -498,6 +498,7 @@ options {
       trust\-anchor\-telemetry boolean; // experimental
       try\-tcp\-refresh boolean;
       update\-check\-ksk boolean;
 +      update\-quota integer;
       use\-alt\-transfer\-source boolean;
       use\-v4\-udp\-ports { portrange; ... };
       use\-v6\-udp\-ports { portrange; ... };
@@ -668,7 +669,7 @@ view string [ class ] {
           * ) ] [ dscp integer ];
       attach\-cache string;
       auth\-nxdomain boolean; // default changed
 -      auto\-dnssec ( allow | maintain | off );
 +      auto\-dnssec ( allow | maintain | off );// deprecated
       cache\-file quoted_string;// deprecated
       catalog\-zones { zone string [ default\-masters [ port integer ]
           [ dscp integer ] { ( remote\-servers | ipv4_address [ port
@@ -943,7 +944,7 @@ view string [ class ] {
                   integer | * ) ] [ dscp integer ];
               alt\-transfer\-source\-v6 ( ipv6_address | * ) [ port (
                   integer | * ) ] [ dscp integer ];
 -              auto\-dnssec ( allow | maintain | off );
 +              auto\-dnssec ( allow | maintain | off );// deprecated
               check\-dup\-records ( fail | warn | ignore );
               check\-integrity boolean;
               check\-mx ( fail | warn | ignore );
@@ -1065,7 +1066,7 @@ zone string [ class ] {
           ] [ dscp integer ];
       alt\-transfer\-source\-v6 ( ipv6_address | * ) [ port ( integer |
           * ) ] [ dscp integer ];
 -      auto\-dnssec ( allow | maintain | off );
 +      auto\-dnssec ( allow | maintain | off );// deprecated
       check\-dup\-records ( fail | warn | ignore );
       check\-integrity boolean;
       check\-mx ( fail | warn | ignore );
 diff --git a/doc/misc/master.zoneopt.rst b/doc/misc/master.zoneopt.rst
 index 8fc7e1b4f0..346d59813e 100644
 --- a/doc/misc/master.zoneopt.rst
 +++ b/doc/misc/master.zoneopt.rst
@@ -20,7 +20,7 @@
   	also-notify [ port <integer> ] [ dscp <integer> ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ]; ... };
   	alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
   	alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
 -  	auto-dnssec ( allow | maintain | off );
 +  	auto-dnssec ( allow | maintain | off ); // deprecated
   	check-dup-records ( fail | warn | ignore );
   	check-integrity <boolean>;
   	check-mx ( fail | warn | ignore );
 diff --git a/doc/misc/options b/doc/misc/options
 index f57399499a..0dbcf101e1 100644
 --- a/doc/misc/options
 +++ b/doc/misc/options
@@ -404,6 +404,7 @@ options {
         trust-anchor-telemetry <boolean>; // experimental
         try-tcp-refresh <boolean>;
         update-check-ksk <boolean>;
 +        update-quota <integer>;
         use-alt-transfer-source <boolean>;
         use-id-pool <boolean>; // ancient
         use-ixfr <boolean>; // obsolete
 diff --git a/doc/misc/options.active b/doc/misc/options.active
 index 5fc1ab29f4..eb75a86eae 100644
 --- a/doc/misc/options.active
 +++ b/doc/misc/options.active
@@ -363,6 +363,7 @@ options {
         trust-anchor-telemetry <boolean>; // experimental
         try-tcp-refresh <boolean>;
         update-check-ksk <boolean>;
 +        update-quota <integer>;
         use-alt-transfer-source <boolean>;
         use-v4-udp-ports { <portrange>; ... };
         use-v6-udp-ports { <portrange>; ... };
 diff --git a/doc/misc/options.grammar.rst b/doc/misc/options.grammar.rst
 index 438072c95c..beef35341a 100644
 --- a/doc/misc/options.grammar.rst
 +++ b/doc/misc/options.grammar.rst
@@ -33,7 +33,7 @@
   	answer-cookie <boolean>;
   	attach-cache <string>;
   	auth-nxdomain <boolean>; // default changed
 -  	auto-dnssec ( allow | maintain | off );
 +  	auto-dnssec ( allow | maintain | off ); // deprecated
   	automatic-interface-scan <boolean>;
   	avoid-v4-udp-ports { <portrange>; ... };
   	avoid-v6-udp-ports { <portrange>; ... };
@@ -300,6 +300,7 @@
   	trust-anchor-telemetry <boolean>; // experimental
   	try-tcp-refresh <boolean>;
   	update-check-ksk <boolean>;
 +  	update-quota <integer>;
   	use-alt-transfer-source <boolean>;
   	use-v4-udp-ports { <portrange>; ... };
   	use-v6-udp-ports { <portrange>; ... };
 diff --git a/doc/misc/slave.zoneopt.rst b/doc/misc/slave.zoneopt.rst
 index cc72dcbf67..468a7f4d9a 100644
 --- a/doc/misc/slave.zoneopt.rst
 +++ b/doc/misc/slave.zoneopt.rst
@@ -21,7 +21,7 @@
   	also-notify [ port <integer> ] [ dscp <integer> ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ]; ... };
   	alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
   	alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
 -  	auto-dnssec ( allow | maintain | off );
 +  	auto-dnssec ( allow | maintain | off ); // deprecated
   	check-names ( fail | warn | ignore );
   	database <string>;
   	dialup ( notify | notify-passive | passive | refresh | <boolean> );
 diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
 index 45de0196bf..6e63d86816 100644
 --- a/lib/isccfg/namedconf.c
 +++ b/lib/isccfg/namedconf.c
@@ -1267,6 +1267,7 @@ static cfg_clausedef_t options_clauses[] = {
 	{ "transfers-out", &cfg_type_uint32, 0 },
 	{ "transfers-per-ns", &cfg_type_uint32, 0 },
 	{ "treat-cr-as-space", &cfg_type_boolean, CFG_CLAUSEFLAG_ANCIENT },
 +	{ "update-quota", &cfg_type_uint32, 0 },
 	{ "use-id-pool", &cfg_type_boolean, CFG_CLAUSEFLAG_ANCIENT },
 	{ "use-ixfr", &cfg_type_boolean, CFG_CLAUSEFLAG_OBSOLETE },
 	{ "use-v4-udp-ports", &cfg_type_bracketed_portlist, 0 },
 -- 
 2.39.1
--- a/bind-9.16-CVE-2022-3094-3.patch
+++ b/bind-9.16-CVE-2022-3094-3.patch
@ -1,470 +0,0 @@
 From 93b8bd39145566053ad8b22cef597146e9175ea4 Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Tue, 8 Nov 2022 17:32:41 -0800
 Subject: [PATCH] move update ACL and update-policy checks before quota
 check allow-update, update-policy, and allow-update-forwarding before
 consuming quota slots, so that unauthorized clients can't fill the
 quota.
 (this moves the access check before the prerequisite check, which
 violates the precise wording of RFC 2136. however, RFC co-author Paul
 Vixie has stated that the RFC is mistaken on this point; it should have
 said that access checking must happen *no later than* the completion of
 prerequisite checks, not that it must happen exactly then.)
 (cherry picked from commit 964f559edb5036880b8e463b8f190b9007ee055d)
 ---
 lib/ns/update.c | 335 ++++++++++++++++++++++++++----------------------
 1 file changed, 181 insertions(+), 154 deletions(-)
 diff --git a/lib/ns/update.c b/lib/ns/update.c
 index 9a8c309..036184b 100644
 --- a/lib/ns/update.c
 +++ b/lib/ns/update.c
@@ -261,6 +261,9 @@ static void
 forward_done(isc_task_t *task, isc_event_t *event);
 static isc_result_t
 add_rr_prepare_action(void *data, rr_t *rr);
 +static isc_result_t
 +rr_exists(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
 +	  const dns_rdata_t *rdata, bool *flag);
 /**************************************************************************/
@@ -333,25 +336,26 @@ inc_stats(ns_client_t *client, dns_zone_t *zone, isc_statscounter_t counter) {
 static isc_result_t
 checkqueryacl(ns_client_t *client, dns_acl_t *queryacl, dns_name_t *zonename,
 	      dns_acl_t *updateacl, dns_ssutable_t *ssutable) {
 +	isc_result_t result;
 	char namebuf[DNS_NAME_FORMATSIZE];
 	char classbuf[DNS_RDATACLASS_FORMATSIZE];
 -	int level;
 -	isc_result_t result;
 +	bool update_possible =
 +		((updateacl != NULL && !dns_acl_isnone(updateacl)) ||
 +		 ssutable != NULL);
 	result = ns_client_checkaclsilent(client, NULL, queryacl, true);
 	if (result != ISC_R_SUCCESS) {
 +		int level = update_possible ? ISC_LOG_ERROR : ISC_LOG_INFO;
 +
 		dns_name_format(zonename, namebuf, sizeof(namebuf));
 		dns_rdataclass_format(client->view->rdclass, classbuf,
 				      sizeof(classbuf));
 -		level = (updateacl == NULL && ssutable == NULL) ? ISC_LOG_INFO
 -								: ISC_LOG_ERROR;
 -
 		ns_client_log(client, NS_LOGCATEGORY_UPDATE_SECURITY,
 			      NS_LOGMODULE_UPDATE, level,
 			      "update '%s/%s' denied due to allow-query",
 			      namebuf, classbuf);
 -	} else if (updateacl == NULL && ssutable == NULL) {
 +	} else if (!update_possible) {
 		dns_name_format(zonename, namebuf, sizeof(namebuf));
 		dns_rdataclass_format(client->view->rdclass, classbuf,
 				      sizeof(classbuf));
@@ -1543,6 +1547,156 @@ send_update_event(ns_client_t *client, dns_zone_t *zone) {
 	isc_result_t result = ISC_R_SUCCESS;
 	update_event_t *event = NULL;
 	isc_task_t *zonetask = NULL;
 +	dns_ssutable_t *ssutable = NULL;
 +	dns_message_t *request = client->message;
 +	dns_aclenv_t *env =
 +		ns_interfacemgr_getaclenv(client->manager->interface->mgr);
 +	dns_rdataclass_t zoneclass;
 +	dns_rdatatype_t covers;
 +	dns_name_t *zonename = NULL;
 +	dns_db_t *db = NULL;
 +	dns_dbversion_t *ver = NULL;
 +
 +	CHECK(dns_zone_getdb(zone, &db));
 +	zonename = dns_db_origin(db);
 +	zoneclass = dns_db_class(db);
 +	dns_zone_getssutable(zone, &ssutable);
 +	dns_db_currentversion(db, &ver);
 +
 +	/*
 +	 * Update message processing can leak record existence information
 +	 * so check that we are allowed to query this zone.  Additionally,
 +	 * if we would refuse all updates for this zone, we bail out here.
 +	 */
 +	CHECK(checkqueryacl(client, dns_zone_getqueryacl(zone),
 +			    dns_zone_getorigin(zone),
 +			    dns_zone_getupdateacl(zone), ssutable));
 +
 +	/*
 +	 * Check requestor's permissions.
 +	 */
 +	if (ssutable == NULL) {
 +		CHECK(checkupdateacl(client, dns_zone_getupdateacl(zone),
 +				     "update", dns_zone_getorigin(zone), false,
 +				     false));
 +	} else if (client->signer == NULL && !TCPCLIENT(client)) {
 +		CHECK(checkupdateacl(client, NULL, "update",
 +				     dns_zone_getorigin(zone), false, true));
 +	}
 +
 +	if (dns_zone_getupdatedisabled(zone)) {
 +		FAILC(DNS_R_REFUSED, "dynamic update temporarily disabled "
 +				     "because the zone is frozen.  Use "
 +				     "'rndc thaw' to re-enable updates.");
 +	}
 +
 +	/*
 +	 * Prescan the update section, checking for updates that
 +	 * are illegal or violate policy.
 +	 */
 +	for (result = dns_message_firstname(request, DNS_SECTION_UPDATE);
 +	     result == ISC_R_SUCCESS;
 +	     result = dns_message_nextname(request, DNS_SECTION_UPDATE))
 +	{
 +		dns_name_t *name = NULL;
 +		dns_rdata_t rdata = DNS_RDATA_INIT;
 +		dns_ttl_t ttl;
 +		dns_rdataclass_t update_class;
 +
 +		get_current_rr(request, DNS_SECTION_UPDATE, zoneclass, &name,
 +			       &rdata, &covers, &ttl, &update_class);
 +
 +		if (!dns_name_issubdomain(name, zonename)) {
 +			FAILC(DNS_R_NOTZONE, "update RR is outside zone");
 +		}
 +		if (update_class == zoneclass) {
 +			/*
 +			 * Check for meta-RRs.  The RFC2136 pseudocode says
 +			 * check for ANY|AXFR|MAILA|MAILB, but the text adds
 +			 * "or any other QUERY metatype"
 +			 */
 +			if (dns_rdatatype_ismeta(rdata.type)) {
 +				FAILC(DNS_R_FORMERR, "meta-RR in update");
 +			}
 +			result = dns_zone_checknames(zone, name, &rdata);
 +			if (result != ISC_R_SUCCESS) {
 +				FAIL(DNS_R_REFUSED);
 +			}
 +		} else if (update_class == dns_rdataclass_any) {
 +			if (ttl != 0 || rdata.length != 0 ||
 +			    (dns_rdatatype_ismeta(rdata.type) &&
 +			     rdata.type != dns_rdatatype_any))
 +			{
 +				FAILC(DNS_R_FORMERR, "meta-RR in update");
 +			}
 +		} else if (update_class == dns_rdataclass_none) {
 +			if (ttl != 0 || dns_rdatatype_ismeta(rdata.type)) {
 +				FAILC(DNS_R_FORMERR, "meta-RR in update");
 +			}
 +		} else {
 +			update_log(client, zone, ISC_LOG_WARNING,
 +				   "update RR has incorrect class %d",
 +				   update_class);
 +			FAIL(DNS_R_FORMERR);
 +		}
 +
 +		/*
 +		 * draft-ietf-dnsind-simple-secure-update-01 says
 +		 * "Unlike traditional dynamic update, the client
 +		 * is forbidden from updating NSEC records."
 +		 */
 +		if (rdata.type == dns_rdatatype_nsec3) {
 +			FAILC(DNS_R_REFUSED, "explicit NSEC3 updates are not "
 +					     "allowed "
 +					     "in secure zones");
 +		} else if (rdata.type == dns_rdatatype_nsec) {
 +			FAILC(DNS_R_REFUSED, "explicit NSEC updates are not "
 +					     "allowed "
 +					     "in secure zones");
 +		} else if (rdata.type == dns_rdatatype_rrsig &&
 +			   !dns_name_equal(name, zonename))
 +		{
 +			FAILC(DNS_R_REFUSED, "explicit RRSIG updates are "
 +					     "currently "
 +					     "not supported in secure zones "
 +					     "except "
 +					     "at the apex");
 +		}
 +
 +		if (ssutable != NULL) {
 +			isc_netaddr_t netaddr;
 +			dst_key_t *tsigkey = NULL;
 +			isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
 +
 +			if (client->message->tsigkey != NULL) {
 +				tsigkey = client->message->tsigkey->key;
 +			}
 +
 +			if (rdata.type != dns_rdatatype_any) {
 +				if (!dns_ssutable_checkrules(
 +					    ssutable, client->signer, name,
 +					    &netaddr, TCPCLIENT(client), env,
 +					    rdata.type, tsigkey))
 +				{
 +					FAILC(DNS_R_REFUSED, "rejected by "
 +							     "secure update");
 +				}
 +			} else {
 +				if (!ssu_checkall(db, ver, name, ssutable,
 +						  client->signer, &netaddr, env,
 +						  TCPCLIENT(client), tsigkey))
 +				{
 +					FAILC(DNS_R_REFUSED, "rejected by "
 +							     "secure update");
 +				}
 +			}
 +		}
 +	}
 +	if (result != ISC_R_NOMORE) {
 +		FAIL(result);
 +	}
 +
 +	update_log(client, zone, LOGLEVEL_DEBUG, "update section prescan OK");
 	result = isc_quota_attach(&client->manager->sctx->updquota,
 				  &(isc_quota_t *){ NULL });
@@ -1552,9 +1706,7 @@ send_update_event(ns_client_t *client, dns_zone_t *zone) {
 			   isc_result_totext(result));
 		ns_stats_increment(client->manager->sctx->nsstats,
 				   ns_statscounter_updatequota);
 -		ns_client_drop(client, result);
 -		isc_nmhandle_detach(&client->reqhandle);
 -		return (DNS_R_DROP);
 +		CHECK(DNS_R_DROP);
 	}
 	event = (update_event_t *)isc_event_allocate(
@@ -1571,6 +1723,16 @@ send_update_event(ns_client_t *client, dns_zone_t *zone) {
 	dns_zone_gettask(zone, &zonetask);
 	isc_task_send(zonetask, ISC_EVENT_PTR(&event));
 +failure:
 +	if (db != NULL) {
 +		dns_db_closeversion(db, &ver, false);
 +		dns_db_detach(&db);
 +	}
 +
 +	if (ssutable != NULL) {
 +		dns_ssutable_detach(&ssutable);
 +	}
 +
 	return (result);
 }
@@ -1671,9 +1833,6 @@ ns_update_start(ns_client_t *client, isc_nmhandle_t *handle,
 		break;
 	case dns_zone_secondary:
 	case dns_zone_mirror:
 -		CHECK(checkupdateacl(client, dns_zone_getforwardacl(zone),
 -				     "update forwarding", zonename, true,
 -				     false));
 		CHECK(send_forward_event(client, zone));
 		break;
 	default:
@@ -1685,8 +1844,6 @@ ns_update_start(ns_client_t *client, isc_nmhandle_t *handle,
 failure:
 	if (result == DNS_R_REFUSED) {
 -		INSIST(dns_zone_gettype(zone) == dns_zone_secondary ||
 -		       dns_zone_gettype(zone) == dns_zone_mirror);
 		inc_stats(client, zone, ns_statscounter_updaterej);
 	}
@@ -2578,7 +2735,7 @@ update_action(isc_task_t *task, isc_event_t *event) {
 	dns_rdatatype_t covers;
 	dns_message_t *request = client->message;
 	dns_rdataclass_t zoneclass;
 -	dns_name_t *zonename;
 +	dns_name_t *zonename = NULL;
 	dns_ssutable_t *ssutable = NULL;
 	dns_fixedname_t tmpnamefixed;
 	dns_name_t *tmpname = NULL;
@@ -2590,8 +2747,6 @@ update_action(isc_task_t *task, isc_event_t *event) {
 	dns_ttl_t maxttl = 0;
 	uint32_t maxrecords;
 	uint64_t records;
 -	dns_aclenv_t *env =
 -		ns_interfacemgr_getaclenv(client->manager->interface->mgr);
 	INSIST(event->ev_type == DNS_EVENT_UPDATE);
@@ -2602,14 +2757,7 @@ update_action(isc_task_t *task, isc_event_t *event) {
 	zonename = dns_db_origin(db);
 	zoneclass = dns_db_class(db);
 	dns_zone_getssutable(zone, &ssutable);
 -
 -	/*
 -	 * Update message processing can leak record existence information
 -	 * so check that we are allowed to query this zone.  Additionally
 -	 * if we would refuse all updates for this zone we bail out here.
 -	 */
 -	CHECK(checkqueryacl(client, dns_zone_getqueryacl(zone), zonename,
 -			    dns_zone_getupdateacl(zone), ssutable));
 +	options = dns_zone_getoptions(zone);
 	/*
 	 * Get old and new versions now that queryacl has been checked.
@@ -2745,135 +2893,10 @@ update_action(isc_task_t *task, isc_event_t *event) {
 	update_log(client, zone, LOGLEVEL_DEBUG, "prerequisites are OK");
 -	/*
 -	 * Check Requestor's Permissions.  It seems a bit silly to do this
 -	 * only after prerequisite testing, but that is what RFC2136 says.
 -	 */
 -	if (ssutable == NULL) {
 -		CHECK(checkupdateacl(client, dns_zone_getupdateacl(zone),
 -				     "update", zonename, false, false));
 -	} else if (client->signer == NULL && !TCPCLIENT(client)) {
 -		CHECK(checkupdateacl(client, NULL, "update", zonename, false,
 -				     true));
 -	}
 -
 -	if (dns_zone_getupdatedisabled(zone)) {
 -		FAILC(DNS_R_REFUSED, "dynamic update temporarily disabled "
 -				     "because the zone is frozen.  Use "
 -				     "'rndc thaw' to re-enable updates.");
 -	}
 -
 -	/*
 -	 * Perform the Update Section Prescan.
 -	 */
 -
 -	for (result = dns_message_firstname(request, DNS_SECTION_UPDATE);
 -	     result == ISC_R_SUCCESS;
 -	     result = dns_message_nextname(request, DNS_SECTION_UPDATE))
 -	{
 -		dns_name_t *name = NULL;
 -		dns_rdata_t rdata = DNS_RDATA_INIT;
 -		dns_ttl_t ttl;
 -		dns_rdataclass_t update_class;
 -		get_current_rr(request, DNS_SECTION_UPDATE, zoneclass, &name,
 -			       &rdata, &covers, &ttl, &update_class);
 -
 -		if (!dns_name_issubdomain(name, zonename)) {
 -			FAILC(DNS_R_NOTZONE, "update RR is outside zone");
 -		}
 -		if (update_class == zoneclass) {
 -			/*
 -			 * Check for meta-RRs.  The RFC2136 pseudocode says
 -			 * check for ANY|AXFR|MAILA|MAILB, but the text adds
 -			 * "or any other QUERY metatype"
 -			 */
 -			if (dns_rdatatype_ismeta(rdata.type)) {
 -				FAILC(DNS_R_FORMERR, "meta-RR in update");
 -			}
 -			result = dns_zone_checknames(zone, name, &rdata);
 -			if (result != ISC_R_SUCCESS) {
 -				FAIL(DNS_R_REFUSED);
 -			}
 -		} else if (update_class == dns_rdataclass_any) {
 -			if (ttl != 0 || rdata.length != 0 ||
 -			    (dns_rdatatype_ismeta(rdata.type) &&
 -			     rdata.type != dns_rdatatype_any))
 -			{
 -				FAILC(DNS_R_FORMERR, "meta-RR in update");
 -			}
 -		} else if (update_class == dns_rdataclass_none) {
 -			if (ttl != 0 || dns_rdatatype_ismeta(rdata.type)) {
 -				FAILC(DNS_R_FORMERR, "meta-RR in update");
 -			}
 -		} else {
 -			update_log(client, zone, ISC_LOG_WARNING,
 -				   "update RR has incorrect class %d",
 -				   update_class);
 -			FAIL(DNS_R_FORMERR);
 -		}
 -
 -		/*
 -		 * draft-ietf-dnsind-simple-secure-update-01 says
 -		 * "Unlike traditional dynamic update, the client
 -		 * is forbidden from updating NSEC records."
 -		 */
 -		if (rdata.type == dns_rdatatype_nsec3) {
 -			FAILC(DNS_R_REFUSED, "explicit NSEC3 updates are not "
 -					     "allowed "
 -					     "in secure zones");
 -		} else if (rdata.type == dns_rdatatype_nsec) {
 -			FAILC(DNS_R_REFUSED, "explicit NSEC updates are not "
 -					     "allowed "
 -					     "in secure zones");
 -		} else if (rdata.type == dns_rdatatype_rrsig &&
 -			   !dns_name_equal(name, zonename)) {
 -			FAILC(DNS_R_REFUSED, "explicit RRSIG updates are "
 -					     "currently "
 -					     "not supported in secure zones "
 -					     "except "
 -					     "at the apex");
 -		}
 -
 -		if (ssutable != NULL) {
 -			isc_netaddr_t netaddr;
 -			dst_key_t *tsigkey = NULL;
 -			isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
 -
 -			if (client->message->tsigkey != NULL) {
 -				tsigkey = client->message->tsigkey->key;
 -			}
 -
 -			if (rdata.type != dns_rdatatype_any) {
 -				if (!dns_ssutable_checkrules(
 -					    ssutable, client->signer, name,
 -					    &netaddr, TCPCLIENT(client), env,
 -					    rdata.type, tsigkey))
 -				{
 -					FAILC(DNS_R_REFUSED, "rejected by "
 -							     "secure update");
 -				}
 -			} else {
 -				if (!ssu_checkall(db, ver, name, ssutable,
 -						  client->signer, &netaddr, env,
 -						  TCPCLIENT(client), tsigkey))
 -				{
 -					FAILC(DNS_R_REFUSED, "rejected by "
 -							     "secure update");
 -				}
 -			}
 -		}
 -	}
 -	if (result != ISC_R_NOMORE) {
 -		FAIL(result);
 -	}
 -
 -	update_log(client, zone, LOGLEVEL_DEBUG, "update section prescan OK");
 -
 	/*
 	 * Process the Update Section.
 	 */
 -	options = dns_zone_getoptions(zone);
 	for (result = dns_message_firstname(request, DNS_SECTION_UPDATE);
 	     result == ISC_R_SUCCESS;
 	     result = dns_message_nextname(request, DNS_SECTION_UPDATE))
@@ -3307,10 +3330,7 @@ update_action(isc_task_t *task, isc_event_t *event) {
 			if (result == ISC_R_SUCCESS && records > maxrecords) {
 				update_log(client, zone, ISC_LOG_ERROR,
 					   "records in zone (%" PRIu64 ") "
 -					   "exceeds"
 -					   " max-"
 -					   "records"
 -					   " (%u)",
 +					   "exceeds max-records (%u)",
 					   records, maxrecords);
 				result = DNS_R_TOOMANYRECORDS;
 				goto failure;
@@ -3601,6 +3621,13 @@ send_forward_event(ns_client_t *client, dns_zone_t *zone) {
 	update_event_t *event = NULL;
 	isc_task_t *zonetask = NULL;
 +	result = checkupdateacl(client, dns_zone_getforwardacl(zone),
 +				"update forwarding", dns_zone_getorigin(zone),
 +				true, false);
 +	if (result != ISC_R_SUCCESS) {
 +		return (result);
 +	}
 +
 	result = isc_quota_attach(&client->manager->sctx->updquota,
 				  &(isc_quota_t *){ NULL });
 	if (result != ISC_R_SUCCESS) {
 -- 
 2.39.1
--- a/bind-9.16-CVE-2022-3094-test.patch
+++ b/bind-9.16-CVE-2022-3094-test.patch
@ -1,272 +0,0 @@
 From 54e281c11ee13eabc3c51d6391a58fc90836000c Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Wed, 9 Nov 2022 21:56:16 -0800
 Subject: [PATCH] test failure conditions
 verify that updates are refused when the client is disallowed by
 allow-query, and update forwarding is refused when the client is
 is disallowed by update-forwarding.
 verify that "too many DNS UPDATEs" appears in the log file when too
 many simultaneous updates are processing.
 (cherry picked from commit b91339b80e5b82a56622c93cc1e3cca2d0c11bc0)
 ---
 bin/tests/system/nsupdate/ns1/named.conf.in   |  2 +
 bin/tests/system/nsupdate/tests.sh            | 28 +++++++++++++
 bin/tests/system/upforwd/clean.sh             |  2 +
 .../ns3/{named.conf.in => named1.conf.in}     | 13 ++++--
 bin/tests/system/upforwd/ns3/named2.conf.in   | 41 +++++++++++++++++++
 bin/tests/system/upforwd/setup.sh             |  2 +-
 bin/tests/system/upforwd/tests.sh             | 39 ++++++++++++++++++
 7 files changed, 123 insertions(+), 4 deletions(-)
 rename bin/tests/system/upforwd/ns3/{named.conf.in => named1.conf.in} (78%)
 create mode 100644 bin/tests/system/upforwd/ns3/named2.conf.in
 diff --git a/bin/tests/system/nsupdate/ns1/named.conf.in b/bin/tests/system/nsupdate/ns1/named.conf.in
 index 436c97d..83fe884 100644
 --- a/bin/tests/system/nsupdate/ns1/named.conf.in
 +++ b/bin/tests/system/nsupdate/ns1/named.conf.in
@@ -21,6 +21,7 @@ options {
 	recursion no;
 	notify yes;
 	minimal-responses no;
 +	update-quota 1;
 };
 acl named-acl {
@@ -81,6 +82,7 @@ zone "other.nil" {
 	check-integrity no;
 	check-mx warn;
 	update-policy local;
 +	allow-query { !10.53.0.2; any; };
 	allow-query-on { 10.53.0.1; 127.0.0.1; };
 	allow-transfer { any; };
 };
 diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh
 index b5f562f..13ba577 100755
 --- a/bin/tests/system/nsupdate/tests.sh
 +++ b/bin/tests/system/nsupdate/tests.sh
@@ -1268,6 +1268,34 @@ END
 grep "NSEC3PARAM has excessive iterations (> 150)" nsupdate.out-$n >/dev/null || ret=1
 [ $ret = 0 ] || { echo_i "failed"; status=1; }
 +n=$((n + 1))
 +ret=0
 +echo_i "check that update is rejected if query is not allowed ($n)"
 +{
 +  $NSUPDATE -d <<END
 +  local 10.53.0.2
 +  server 10.53.0.1 ${PORT}
 +  update add reject.other.nil 3600 IN TXT Whatever
 +  send
 +END
 +} > nsupdate.out.test$n 2>&1
 +grep 'failed: REFUSED' nsupdate.out.test$n > /dev/null || ret=1
 +[ $ret = 0 ] || { echo_i "failed"; status=1; }
 +
 +n=$((n + 1))
 +ret=0
 +echo_i "check that update is rejected if quota is exceeded ($n)"
 +for loop in 1 2 3 4 5 6 7 8 9 10; do
 +{
 +  $NSUPDATE -4 -l -p ${PORT} -k ns1/session.key > /dev/null 2>&1 <<END
 +  update add txt-$loop.other.nil 3600 IN TXT Whatever
 +  send
 +END
 +} &
 +done
 +wait_for_log 10 "too many DNS UPDATEs queued" ns1/named.run || ret=1
 +[ $ret = 0 ] || { echo_i "failed"; status=1; }
 +
 if ! $FEATURETEST --gssapi ; then
   echo_i "SKIPPED: GSSAPI tests"
 else
 diff --git a/bin/tests/system/upforwd/clean.sh b/bin/tests/system/upforwd/clean.sh
 index 2025252..12311df 100644
 --- a/bin/tests/system/upforwd/clean.sh
 +++ b/bin/tests/system/upforwd/clean.sh
@@ -29,3 +29,5 @@ rm -f keyname keyname.err
 rm -f ns*/named.lock
 rm -f ns1/example2.db
 rm -f ns*/managed-keys.bind*
 +rm -f nsupdate.out.*
 +rm -f ns*/named.run.prev
 diff --git a/bin/tests/system/upforwd/ns3/named.conf.in b/bin/tests/system/upforwd/ns3/named1.conf.in
 similarity index 78%
 rename from bin/tests/system/upforwd/ns3/named.conf.in
 rename to bin/tests/system/upforwd/ns3/named1.conf.in
 index 7bd13d3..2f690ff 100644
 --- a/bin/tests/system/upforwd/ns3/named.conf.in
 +++ b/bin/tests/system/upforwd/ns3/named1.conf.in
@@ -28,20 +28,27 @@ key rndc_key {
 };
 controls {
 -        inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
 +	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
 };
 zone "example" {
 	type secondary;
 	file "example.bk";
 -	allow-update-forwarding { any; };
 +	allow-update-forwarding { 10.53.0.1; };
 	primaries { 10.53.0.1; };
 };
 zone "example2" {
 	type secondary;
 	file "example2.bk";
 -	allow-update-forwarding { any; };
 +	allow-update-forwarding { 10.53.0.1; };
 +	primaries { 10.53.0.1; };
 +};
 +
 +zone "example3" {
 +	type secondary;
 +	file "example3.bk";
 +	allow-update-forwarding { 10.53.0.1; };
 	primaries { 10.53.0.1; };
 };
 diff --git a/bin/tests/system/upforwd/ns3/named2.conf.in b/bin/tests/system/upforwd/ns3/named2.conf.in
 new file mode 100644
 index 0000000..e15459a
 --- /dev/null
 +++ b/bin/tests/system/upforwd/ns3/named2.conf.in
@@ -0,0 +1,41 @@
 +/*
 + * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 + *
 + * SPDX-License-Identifier: MPL-2.0
 + *
 + * This Source Code Form is subject to the terms of the Mozilla Public
 + * License, v. 2.0.  If a copy of the MPL was not distributed with this
 + * file, you can obtain one at https://mozilla.org/MPL/2.0/.
 + *
 + * See the COPYRIGHT file distributed with this work for additional
 + * information regarding copyright ownership.
 + */
 +
 +options {
 +	query-source address 10.53.0.3;
 +	notify-source 10.53.0.3;
 +	transfer-source 10.53.0.3;
 +	port @PORT@;
 +	pid-file "named.pid";
 +	listen-on { 10.53.0.3; };
 +	listen-on-v6 { none; };
 +	recursion no;
 +	notify yes;
 +	update-quota 1;
 +};
 +
 +key rndc_key {
 +	secret "1234abcd8765";
 +        algorithm hmac-sha256;
 +};
 +
 +controls {
 +	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
 +};
 +
 +zone "example" {
 +	type secondary;
 +	file "example.bk";
 +	allow-update-forwarding { any; };
 +	primaries { 10.53.0.1; };
 +};
 diff --git a/bin/tests/system/upforwd/setup.sh b/bin/tests/system/upforwd/setup.sh
 index e748078..88ab28d 100644
 --- a/bin/tests/system/upforwd/setup.sh
 +++ b/bin/tests/system/upforwd/setup.sh
@@ -17,7 +17,7 @@ cp -f ns3/nomaster.db ns3/nomaster1.db
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
 -copy_setports ns3/named.conf.in ns3/named.conf
 +copy_setports ns3/named1.conf.in ns3/named.conf
 if $FEATURETEST --enable-dnstap
 then
 diff --git a/bin/tests/system/upforwd/tests.sh b/bin/tests/system/upforwd/tests.sh
 index 8062d68..20fc46f 100644
 --- a/bin/tests/system/upforwd/tests.sh
 +++ b/bin/tests/system/upforwd/tests.sh
@@ -80,6 +80,7 @@ if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
 echo_i "updating zone (signed) ($n)"
 ret=0
 $NSUPDATE -y hmac-sha256:update.example:c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K -- - <<EOF || ret=1
 +local 10.53.0.1
 server 10.53.0.3 ${PORT}
 update add updated.example. 600 A 10.10.10.1
 update add updated.example. 600 TXT Foo
@@ -138,6 +139,7 @@ fi
 echo_i "updating zone (unsigned) ($n)"
 ret=0
 $NSUPDATE -- - <<EOF || ret=1
 +local 10.53.0.1
 server 10.53.0.3 ${PORT}
 update add unsigned.example. 600 A 10.10.10.1
 update add unsigned.example. 600 TXT Foo
@@ -194,6 +196,7 @@ while [ $count -lt 5 -a $ret -eq 0 ]
 do
 (
 $NSUPDATE -- - <<EOF 
 +local 10.53.0.1
 server 10.53.0.3 ${PORT}
 zone nomaster
 update add unsigned.nomaster. 600 A 10.10.10.1
@@ -225,6 +228,7 @@ then
 	ret=0
 	keyname=`cat keyname`
 	$NSUPDATE -k $keyname.private -- - <<EOF
 +	local 10.53.0.1
 	server 10.53.0.3 ${PORT}
 	zone example2
 	update add unsigned.example2. 600 A 10.10.10.1
@@ -249,5 +253,40 @@ EOF
 	fi
 fi
 +echo_i "attempting an update that should be rejected by ACL ($n)"
 +ret=0
 +{
 +        $NSUPDATE -- - << EOF
 +        local 10.53.0.2
 +        server 10.53.0.3 ${PORT}
 +        update add another.unsigned.example. 600 A 10.10.10.2
 +        update add another.unsigned.example. 600 TXT Bar
 +        send
 +EOF
 +} > nsupdate.out.$n 2>&1
 +grep REFUSED nsupdate.out.$n > /dev/null || ret=1
 +if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
 +n=`expr $n + 1`
 +
 +n=$((n + 1))
 +ret=0
 +echo_i "attempting updates that should exceed quota ($n)"
 +# lower the update quota to 1.
 +copy_setports ns3/named2.conf.in ns3/named.conf
 +rndc_reconfig ns3 10.53.0.3
 +nextpart ns3/named.run > /dev/null
 +for loop in 1 2 3 4 5 6 7 8 9 10; do
 +{
 +  $NSUPDATE -- - > /dev/null 2>&1 <<END
 +  local 10.53.0.1
 +  server 10.53.0.3 ${PORT}
 +  update add txt-$loop.unsigned.example 300 IN TXT Whatever
 +  send
 +END
 +} &
 +done
 +wait_for_log 10 "too many DNS UPDATEs queued" ns3/named.run || ret=1
 +[ $ret = 0 ] || { echo_i "failed"; status=1; }
 +
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
 -- 
 2.39.2
--- a/bind-9.16-CVE-2022-3736.patch
+++ b/bind-9.16-CVE-2022-3736.patch
@ -1,53 +0,0 @@
 From 1b6590eafce064cbf70f5afc2fe4d6f1bfdc3804 Mon Sep 17 00:00:00 2001
 From: Mark Andrews <marka@isc.org>
 Date: Thu, 27 Oct 2022 13:22:11 +1100
 Subject: [PATCH] Move the mapping of SIG and RRSIG to ANY
 dns_db_findext() asserts if RRSIG is passed to it and
 query_lookup_stale() failed to map RRSIG to ANY to prevent this.  To
 avoid cases like this in the future, move the mapping of SIG and RRSIG
 to ANY for qctx->type to qctx_init().
 (cherry picked from commit 56eae064183488bcf7ff08c3edf59f2e1742c1b6)
 ---
 lib/ns/query.c | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)
 diff --git a/lib/ns/query.c b/lib/ns/query.c
 index a450cb7..f66bab4 100644
 --- a/lib/ns/query.c
 +++ b/lib/ns/query.c
@@ -5103,6 +5103,15 @@ qctx_init(ns_client_t *client, dns_fetchevent_t **eventp, dns_rdatatype_t qtype,
 	qctx->result = ISC_R_SUCCESS;
 	qctx->findcoveringnsec = qctx->view->synthfromdnssec;
 +	/*
 +	 * If it's an RRSIG or SIG query, we'll iterate the node.
 +	 */
 +	if (qctx->qtype == dns_rdatatype_rrsig ||
 +	    qctx->qtype == dns_rdatatype_sig)
 +	{
 +		qctx->type = dns_rdatatype_any;
 +	}
 +
 	CALL_HOOK_NORETURN(NS_QUERY_QCTX_INITIALIZED, qctx);
 }
@@ -5243,14 +5252,6 @@ query_setup(ns_client_t *client, dns_rdatatype_t qtype) {
 	CALL_HOOK(NS_QUERY_SETUP, &qctx);
 -	/*
 -	 * If it's a SIG query, we'll iterate the node.
 -	 */
 -	if (qctx.qtype == dns_rdatatype_rrsig ||
 -	    qctx.qtype == dns_rdatatype_sig) {
 -		qctx.type = dns_rdatatype_any;
 -	}
 -
 	/*
 	 * Check SERVFAIL cache
 	 */
 -- 
 2.39.1
--- a/bind-9.16-CVE-2022-38177.patch
+++ b/bind-9.16-CVE-2022-38177.patch
@ -1,27 +0,0 @@
 From df8222fb189708199a185f73543b6e0602c1c72f Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Tue, 20 Sep 2022 11:21:45 +0200
 Subject: [PATCH 3/4] Fix CVE-2022-38177
 5961.	[security]	Fix memory leak in ECDSA verify processing.
 			(CVE-2022-38177) [GL #3487]
 ---
 lib/dns/opensslecdsa_link.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/lib/dns/opensslecdsa_link.c b/lib/dns/opensslecdsa_link.c
 index ce4c8c4..3847896 100644
 --- a/lib/dns/opensslecdsa_link.c
 +++ b/lib/dns/opensslecdsa_link.c
@@ -228,7 +228,7 @@ opensslecdsa_verify(dst_context_t *dctx, const isc_region_t *sig) {
 	}
 	if (sig->length != siglen) {
 -		return (DST_R_VERIFYFAILURE);
 +		DST_RET(DST_R_VERIFYFAILURE);
 	}
 	if (!EVP_DigestFinal_ex(evp_md_ctx, digest, &dgstlen)) {
 -- 
 2.37.3
--- a/bind-9.16-CVE-2022-38178.patch
+++ b/bind-9.16-CVE-2022-38178.patch
@ -1,32 +0,0 @@
 From 132ef295b8407f91e6922f4dfc4f30f1790b61c5 Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Tue, 20 Sep 2022 11:22:47 +0200
 Subject: [PATCH 4/4] Fix CVE-2022-38178
 5962.	[security]	Fix memory leak in EdDSA verify processing.
 			(CVE-2022-38178) [GL #3487]
 ---
 lib/dns/openssleddsa_link.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
 diff --git a/lib/dns/openssleddsa_link.c b/lib/dns/openssleddsa_link.c
 index 6a6a74d..3157011 100644
 --- a/lib/dns/openssleddsa_link.c
 +++ b/lib/dns/openssleddsa_link.c
@@ -234,11 +234,11 @@ openssleddsa_verify(dst_context_t *dctx, const isc_region_t *sig) {
 	}
 #endif /* if HAVE_OPENSSL_ED448 */
 	if (siglen == 0) {
 -		return (ISC_R_NOTIMPLEMENTED);
 +		DST_RET(ISC_R_NOTIMPLEMENTED);
 	}
 	if (sig->length != siglen) {
 -		return (DST_R_VERIFYFAILURE);
 +		DST_RET(DST_R_VERIFYFAILURE);
 	}
 	isc_buffer_usedregion(buf, &tbsreg);
 -- 
 2.37.3
--- a/dead.package
+++ b/dead.package
@ -0,0 +1 @@
 bind9.16 package is retired on branch c10s for CS-2551
		`@ -1,2 +0,0 @@`
			`SOURCES/bind-9.16.23.tar.xz`
			`/bind-9.16.23.tar.xz`
		`@ -0,0 +1 @@`
							`bind9.16 package is retired on branch c10s for CS-2551`