import bind9.16-9.16.23-0.14.el8

2023-03-28 09:47:29 +00:00 · 2023-03-28 09:47:29 +00:00 · c4d889bc53
commit c4d889bc53
parent c840e6d84a
11 changed files with 1709 additions and 1 deletions
--- a/SOURCES/bind-9.16-CVE-2022-2795.patch
+++ b/SOURCES/bind-9.16-CVE-2022-2795.patch
@ -0,0 +1,60 @@
 From bf2ea6d8525bfd96a84dad221ba9e004adb710a8 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Micha=C5=82=20K=C4=99pie=C5=84?= <michal@isc.org>
 Date: Thu, 8 Sep 2022 11:11:30 +0200
 Subject: [PATCH] Bound the amount of work performed for delegations
 Limit the amount of database lookups that can be triggered in
 fctx_getaddresses() (i.e. when determining the name server addresses to
 query next) by setting a hard limit on the number of NS RRs processed
 for any delegation encountered.  Without any limit in place, named can
 be forced to perform large amounts of database lookups per each query
 received, which severely impacts resolver performance.
 The limit used (20) is an arbitrary value that is considered to be big
 enough for any sane DNS delegation.
 (cherry picked from commit 3a44097fd6c6c260765b628cd1d2c9cb7efb0b2a)
 ---
 lib/dns/resolver.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)
 diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
 index d2cf14bbc8..73a0ee9f77 100644
 --- a/lib/dns/resolver.c
 +++ b/lib/dns/resolver.c
@@ -195,6 +195,12 @@
  */
 #define NS_FAIL_LIMIT 4
 #define NS_RR_LIMIT   5
 +/*
 + * IP address lookups are performed for at most NS_PROCESSING_LIMIT NS RRs in
 + * any NS RRset encountered, to avoid excessive resource use while processing
 + * large delegations.
 + */
 +#define NS_PROCESSING_LIMIT 20
 /* Number of hash buckets for zone counters */
 #ifndef RES_DOMAIN_BUCKETS
@@ -3711,6 +3717,7 @@ fctx_getaddresses(fetchctx_t *fctx, bool badcache) {
 	bool need_alternate = false;
 	bool all_spilled = true;
 	unsigned int no_addresses = 0;
 +	unsigned int ns_processed = 0;
 	FCTXTRACE5("getaddresses", "fctx->depth=", fctx->depth);
@@ -3902,6 +3909,11 @@ normal_nses:
 		dns_rdata_reset(&rdata);
 		dns_rdata_freestruct(&ns);
 +
 +		if (++ns_processed >= NS_PROCESSING_LIMIT) {
 +			result = ISC_R_NOMORE;
 +			break;
 +		}
 	}
 	if (result != ISC_R_NOMORE) {
 		return (result);
 -- 
 2.37.3
--- a/SOURCES/bind-9.16-CVE-2022-3080.patch
+++ b/SOURCES/bind-9.16-CVE-2022-3080.patch
@ -0,0 +1,116 @@
 From 3bcd32572504ac9b92e3c6ec1e2cee3df3b68309 Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Tue, 20 Sep 2022 11:34:42 +0200
 Subject: [PATCH 2/4] Fix CVE-2022-3080
 5960.	[security]	Fix serve-stale crash that could happen when
 			stale-answer-client-timeout was set to 0 and there was
 			a stale CNAME in the cache for an incoming query.
 			(CVE-2022-3080) [GL #3517]
 ---
 lib/ns/include/ns/query.h |  1 +
 lib/ns/query.c            | 42 ++++++++++++++++++++++++---------------
 2 files changed, 27 insertions(+), 16 deletions(-)
 diff --git a/lib/ns/include/ns/query.h b/lib/ns/include/ns/query.h
 index 4d48cf6..34b3070 100644
 --- a/lib/ns/include/ns/query.h
 +++ b/lib/ns/include/ns/query.h
@@ -145,6 +145,7 @@ struct query_ctx {
 	bool authoritative;		    /* authoritative query? */
 	bool want_restart;		    /* CNAME chain or other
 					     * restart needed */
 +	bool		refresh_rrset;	    /* stale RRset refresh needed */
 	bool		need_wildcardproof; /* wildcard proof needed */
 	bool		nxrewrite;	    /* negative answer from RPZ */
 	bool		findcoveringnsec;   /* lookup covering NSEC */
 diff --git a/lib/ns/query.c b/lib/ns/query.c
 index 249321c..a450cb7 100644
 --- a/lib/ns/query.c
 +++ b/lib/ns/query.c
@@ -5686,7 +5686,6 @@ query_lookup(query_ctx_t *qctx) {
 	bool dbfind_stale = false;
 	bool stale_timeout = false;
 	bool stale_found = false;
 -	bool refresh_rrset = false;
 	bool stale_refresh_window = false;
 	CCTRACE(ISC_LOG_DEBUG(3), "query_lookup");
@@ -5868,8 +5867,7 @@ query_lookup(query_ctx_t *qctx) {
 					"%s stale answer used, an attempt to "
 					"refresh the RRset will still be made",
 					namebuf);
 -				refresh_rrset = STALE(qctx->rdataset);
 -				qctx->client->nodetach = refresh_rrset;
 +				qctx->refresh_rrset = STALE(qctx->rdataset);
 			}
 		} else {
 			/*
@@ -5907,17 +5905,6 @@ query_lookup(query_ctx_t *qctx) {
 	result = query_gotanswer(qctx, result);
 -	if (refresh_rrset) {
 -		/*
 -		 * If we reached this point then it means that we have found a
 -		 * stale RRset entry in cache and BIND is configured to allow
 -		 * queries to be answered with stale data if no active RRset
 -		 * is available, i.e. "stale-anwer-client-timeout 0". But, we
 -		 * still need to refresh the RRset.
 -		 */
 -		query_refresh_rrset(qctx);
 -	}
 -
 cleanup:
 	return (result);
 }
@@ -7737,11 +7724,14 @@ query_addanswer(query_ctx_t *qctx) {
 	/*
 	 * On normal lookups, clear any rdatasets that were added on a
 -	 * lookup due to stale-answer-client-timeout.
 +	 * lookup due to stale-answer-client-timeout. Do not clear if we
 +	 * are going to refresh the RRset, because the stale contents are
 +	 * prioritized.
 	 */
 	if (QUERY_STALEOK(&qctx->client->query) &&
 -	    !QUERY_STALETIMEOUT(&qctx->client->query))
 +	    !QUERY_STALETIMEOUT(&qctx->client->query) && !qctx->refresh_rrset)
 	{
 +		CCTRACE(ISC_LOG_DEBUG(3), "query_clear_stale");
 		query_clear_stale(qctx->client);
 		/*
 		 * We can clear the attribute to prevent redundant clearing
@@ -11457,9 +11447,29 @@ ns_query_done(query_ctx_t *qctx) {
 	/*
 	 * Client may have been detached after query_send(), so
 	 * we test and store the flag state here, for safety.
 +	 * If we are refreshing the RRSet, we must not detach from the client
 +	 * in the query_send(), so we need to override the flag.
 	 */
 +	if (qctx->refresh_rrset) {
 +		qctx->client->nodetach = true;
 +	}
 	nodetach = qctx->client->nodetach;
 	query_send(qctx->client);
 +
 +	if (qctx->refresh_rrset) {
 +		/*
 +		 * If we reached this point then it means that we have found a
 +		 * stale RRset entry in cache and BIND is configured to allow
 +		 * queries to be answered with stale data if no active RRset
 +		 * is available, i.e. "stale-anwer-client-timeout 0". But, we
 +		 * still need to refresh the RRset. To prevent adding duplicate
 +		 * RRsets, clear the RRsets from the message before doing the
 +		 * refresh.
 +		 */
 +		message_clearrdataset(qctx->client->message, 0);
 +		query_refresh_rrset(qctx);
 +	}
 +
 	if (!nodetach) {
 		qctx->detach_client = true;
 	}
 -- 
 2.37.3
--- a/SOURCES/bind-9.16-CVE-2022-3094-1.patch
+++ b/SOURCES/bind-9.16-CVE-2022-3094-1.patch
@ -0,0 +1,240 @@
 From 18036bb3f435eaa20d60093738c61e5da42a6cfe Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Thu, 1 Sep 2022 16:05:04 -0700
 Subject: [PATCH] add an update quota
 limit the number of simultaneous DNS UPDATE events that can be
 processed by adding a quota for update and update forwarding.
 this quota currently, arbitrarily, defaults to 100.
 also add a statistics counter to record when the update quota
 has been exceeded.
 (cherry picked from commit 7c47254a140c3e9cf383cda73c7b6a55c4782826)
 ---
 bin/named/bind9.xsl        |  4 +++-
 bin/named/bind9.xsl.h      |  6 +++++-
 bin/named/statschannel.c   |  5 +++--
 doc/arm/reference.rst      |  5 +++++
 lib/ns/include/ns/server.h |  1 +
 lib/ns/include/ns/stats.h  |  4 +++-
 lib/ns/server.c            |  2 ++
 lib/ns/update.c            | 37 ++++++++++++++++++++++++++++++++++++-
 8 files changed, 58 insertions(+), 6 deletions(-)
 diff --git a/bin/named/bind9.xsl b/bin/named/bind9.xsl
 index 5078115..194625b 100644
 --- a/bin/named/bind9.xsl
 +++ b/bin/named/bind9.xsl
@@ -12,7 +12,9 @@
 <xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns="http://www.w3.org/1999/xhtml" version="1.0">
   <xsl:output method="html" indent="yes" version="4.0"/>
 -  <xsl:template match="statistics[@version=&quot;3.11&quot;]">
 +  <!-- the version number **below** must match version in bin/named/statschannel.c -->
 +  <!-- don't forget to update "/xml/v<STATS_XML_VERSION_MAJOR>" in the HTTP endpoints listed below -->
 +  <xsl:template match="statistics[@version=&quot;3.11.1&quot;]">
     <html>
       <head>
         <script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js"></script>
 diff --git a/bin/named/bind9.xsl.h b/bin/named/bind9.xsl.h
 index e30f7f5..b182742 100644
 --- a/bin/named/bind9.xsl.h
 +++ b/bin/named/bind9.xsl.h
@@ -20,7 +20,11 @@ static char xslmsg[] =
 	"<xsl:stylesheet xmlns:xsl=\"http://www.w3.org/1999/XSL/Transform\" "
 	"xmlns=\"http://www.w3.org/1999/xhtml\" version=\"1.0\">\n"
 	" <xsl:output method=\"html\" indent=\"yes\" version=\"4.0\"/>\n"
 -	" <xsl:template match=\"statistics[@version=&quot;3.11&quot;]\">\n"
 +	" <!-- the version number **below** must match version in "
 +	"bin/named/statschannel.c -->\n"
 +	" <!-- don't forget to update \"/xml/v<STATS_XML_VERSION_MAJOR>\" in "
 +	"the HTTP endpoints listed below -->\n"
 +	" <xsl:template match=\"statistics[@version=&quot;3.11.1&quot;]\">\n"
 	" <html>\n"
 	" <head>\n"
 	" <script type=\"text/javascript\" "
 diff --git a/bin/named/statschannel.c b/bin/named/statschannel.c
 index 832ce93..7361ead 100644
 --- a/bin/named/statschannel.c
 +++ b/bin/named/statschannel.c
@@ -335,6 +335,7 @@ init_desc(void) {
 	SET_NSSTATDESC(reclimitdropped,
 		       "queries dropped due to recursive client limit",
 		       "RecLimitDropped");
 +	SET_NSSTATDESC(updatequota, "Update quota exceeded", "UpdateQuota");
 	INSIST(i == ns_statscounter_max);
@@ -2007,7 +2008,7 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,
 					      "href=\"/bind9.xsl\""));
 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "statistics"));
 	TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "version",
 -					 ISC_XMLCHAR "3.11"));
 +					 ISC_XMLCHAR "3.11.1"));
 	/* Set common fields for statistics dump */
 	dumparg.type = isc_statsformat_xml;
@@ -2876,7 +2877,7 @@ generatejson(named_server_t *server, size_t *msglen, const char **msg,
 	/*
 	 * These statistics are included no matter which URL we use.
 	 */
 -	obj = json_object_new_string("1.5");
 +	obj = json_object_new_string("1.5.1");
 	CHECKMEM(obj);
 	json_object_object_add(bindstats, "json-stats-version", obj);
 diff --git a/doc/arm/reference.rst b/doc/arm/reference.rst
 index 2d05aec..25c20d7 100644
 --- a/doc/arm/reference.rst
 +++ b/doc/arm/reference.rst
@@ -6705,6 +6705,11 @@ Name Server Statistics Counters
 ``UpdateBadPrereq``
     This indicates the number of dynamic updates rejected due to a prerequisite failure.
 +``UpdateQuota``
 +    This indicates the number of times a dynamic update or update
 +    forwarding request was rejected because the number of pending
 +    requests exceeded the update quota.
 +
 ``RateDropped``
     This indicates the number of responses dropped due to rate limits.
 diff --git a/lib/ns/include/ns/server.h b/lib/ns/include/ns/server.h
 index 6a1f345..0abb579 100644
 --- a/lib/ns/include/ns/server.h
 +++ b/lib/ns/include/ns/server.h
@@ -84,6 +84,7 @@ struct ns_server {
 	isc_quota_t recursionquota;
 	isc_quota_t tcpquota;
 	isc_quota_t xfroutquota;
 +	isc_quota_t updquota;
 	/*% Test options and other configurables */
 	uint32_t options;
 diff --git a/lib/ns/include/ns/stats.h b/lib/ns/include/ns/stats.h
 index 3c08799..95b15d0 100644
 --- a/lib/ns/include/ns/stats.h
 +++ b/lib/ns/include/ns/stats.h
@@ -106,7 +106,9 @@ enum {
 	ns_statscounter_reclimitdropped = 66,
 -	ns_statscounter_max = 67,
 +	ns_statscounter_updatequota = 67,
 +
 +	ns_statscounter_max = 68,
 };
 void
 diff --git a/lib/ns/server.c b/lib/ns/server.c
 index a970a28..540bc2e 100644
 --- a/lib/ns/server.c
 +++ b/lib/ns/server.c
@@ -52,6 +52,7 @@ ns_server_create(isc_mem_t *mctx, ns_matchview_t matchingview,
 	isc_quota_init(&sctx->xfroutquota, 10);
 	isc_quota_init(&sctx->tcpquota, 10);
 	isc_quota_init(&sctx->recursionquota, 100);
 +	isc_quota_init(&sctx->updquota, 100);
 	CHECKFATAL(dns_tkeyctx_create(mctx, &sctx->tkeyctx));
@@ -131,6 +132,7 @@ ns_server_detach(ns_server_t **sctxp) {
 			isc_mem_put(sctx->mctx, altsecret, sizeof(*altsecret));
 		}
 +		isc_quota_destroy(&sctx->updquota);
 		isc_quota_destroy(&sctx->recursionquota);
 		isc_quota_destroy(&sctx->tcpquota);
 		isc_quota_destroy(&sctx->xfroutquota);
 diff --git a/lib/ns/update.c b/lib/ns/update.c
 index 546b70a..1871438 100644
 --- a/lib/ns/update.c
 +++ b/lib/ns/update.c
@@ -1544,6 +1544,19 @@ send_update_event(ns_client_t *client, dns_zone_t *zone) {
 	update_event_t *event = NULL;
 	isc_task_t *zonetask = NULL;
 +	result = isc_quota_attach(&client->manager->sctx->updquota,
 +				  &(isc_quota_t *){ NULL });
 +	if (result != ISC_R_SUCCESS) {
 +		update_log(client, zone, LOGLEVEL_PROTOCOL,
 +			   "update failed: too many DNS UPDATEs queued (%s)",
 +			   isc_result_totext(result));
 +		ns_stats_increment(client->manager->sctx->nsstats,
 +				   ns_statscounter_updatequota);
 +		ns_client_drop(client, result);
 +		isc_nmhandle_detach(&client->reqhandle);
 +		return (DNS_R_DROP);
 +	}
 +
 	event = (update_event_t *)isc_event_allocate(
 		client->mctx, client, DNS_EVENT_UPDATE, update_action, NULL,
 		sizeof(*event));
@@ -1676,12 +1689,18 @@ failure:
 		       dns_zone_gettype(zone) == dns_zone_mirror);
 		inc_stats(client, zone, ns_statscounter_updaterej);
 	}
 +
 	/*
 	 * We failed without having sent an update event to the zone.
 	 * We are still in the client task context, so we can
 	 * simply give an error response without switching tasks.
 	 */
 -	respond(client, result);
 +	if (result == DNS_R_DROP) {
 +		ns_client_drop(client, result);
 +	} else {
 +		respond(client, result);
 +	}
 +
 	if (zone != NULL) {
 		dns_zone_detach(&zone);
 	}
@@ -3489,6 +3508,7 @@ updatedone_action(isc_task_t *task, isc_event_t *event) {
 	respond(client, uev->result);
 +	isc_quota_detach(&(isc_quota_t *){ &client->manager->sctx->updquota });
 	isc_event_free(&event);
 	isc_nmhandle_detach(&client->updatehandle);
 }
@@ -3505,6 +3525,8 @@ forward_fail(isc_task_t *task, isc_event_t *event) {
 	INSIST(client->nupdates > 0);
 	client->nupdates--;
 	respond(client, DNS_R_SERVFAIL);
 +
 +	isc_quota_detach(&(isc_quota_t *){ &client->manager->sctx->updquota });
 	isc_event_free(&event);
 	isc_nmhandle_detach(&client->updatehandle);
 }
@@ -3542,6 +3564,8 @@ forward_done(isc_task_t *task, isc_event_t *event) {
 	client->nupdates--;
 	ns_client_sendraw(client, uev->answer);
 	dns_message_detach(&uev->answer);
 +
 +	isc_quota_detach(&(isc_quota_t *){ &client->manager->sctx->updquota });
 	isc_event_free(&event);
 	isc_nmhandle_detach(&client->updatehandle);
 }
@@ -3576,6 +3600,17 @@ send_forward_event(ns_client_t *client, dns_zone_t *zone) {
 	update_event_t *event = NULL;
 	isc_task_t *zonetask = NULL;
 +	result = isc_quota_attach(&client->manager->sctx->updquota,
 +				  &(isc_quota_t *){ NULL });
 +	if (result != ISC_R_SUCCESS) {
 +		update_log(client, zone, LOGLEVEL_PROTOCOL,
 +			   "update failed: too many DNS UPDATEs queued (%s)",
 +			   isc_result_totext(result));
 +		ns_stats_increment(client->manager->sctx->nsstats,
 +				   ns_statscounter_updatequota);
 +		return (DNS_R_DROP);
 +	}
 +
 	event = (update_event_t *)isc_event_allocate(
 		client->mctx, client, DNS_EVENT_UPDATE, forward_action, NULL,
 		sizeof(*event));
 -- 
 2.39.2
--- a/SOURCES/bind-9.16-CVE-2022-3094-2.patch
+++ b/SOURCES/bind-9.16-CVE-2022-3094-2.patch
@ -0,0 +1,266 @@
 From 7fe2204a2e8952bf892e4a70fea2ef5167e1f509 Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Thu, 1 Sep 2022 16:22:46 -0700
 Subject: [PATCH] add a configuration option for the update quota
 add an "update-quota" option to configure the update quota.
 (cherry picked from commit f57758a7303ad0034ff2ff08eaaf2ef899630f19)
 ---
 bin/named/config.c                   | 1 +
 bin/named/named.conf.rst             | 9 +++++----
 bin/named/server.c                   | 1 +
 bin/tests/system/checkconf/good.conf | 1 +
 doc/arm/reference.rst                | 7 ++++++-
 doc/man/named.conf.5in               | 9 +++++----
 doc/misc/master.zoneopt.rst          | 2 +-
 doc/misc/options                     | 1 +
 doc/misc/options.active              | 1 +
 doc/misc/options.grammar.rst         | 3 ++-
 doc/misc/slave.zoneopt.rst           | 2 +-
 lib/isccfg/namedconf.c               | 1 +
 12 files changed, 26 insertions(+), 12 deletions(-)
 diff --git a/bin/named/config.c b/bin/named/config.c
 index 5fedee84d9..494147015f 100644
 --- a/bin/named/config.c
 +++ b/bin/named/config.c
@@ -130,6 +130,7 @@ options {\n\
 	transfers-out 10;\n\
 	transfers-per-ns 2;\n\
 	trust-anchor-telemetry yes;\n\
 +	update-quota 100;\n\
 \n\
 	/* view */\n\
 	allow-new-zones no;\n\
 diff --git a/bin/named/named.conf.rst b/bin/named/named.conf.rst
 index 27eed5ca3e..4c9f9a7370 100644
 --- a/bin/named/named.conf.rst
 +++ b/bin/named/named.conf.rst
@@ -179,7 +179,7 @@ OPTIONS
   	answer-cookie boolean;
   	attach-cache string;
   	auth-nxdomain boolean; // default changed
 -  	auto-dnssec ( allow | maintain | off );
 +  	auto-dnssec ( allow | maintain | off );// deprecated
   	automatic-interface-scan boolean;
   	avoid-v4-udp-ports { portrange; ... };
   	avoid-v6-udp-ports { portrange; ... };
@@ -446,6 +446,7 @@ OPTIONS
   	trust-anchor-telemetry boolean; // experimental
   	try-tcp-refresh boolean;
   	update-check-ksk boolean;
 +  	update-quota integer;
   	use-alt-transfer-source boolean;
   	use-v4-udp-ports { portrange; ... };
   	use-v6-udp-ports { portrange; ... };
@@ -584,7 +585,7 @@ VIEW
   	    * ) ] [ dscp integer ];
   	attach-cache string;
   	auth-nxdomain boolean; // default changed
 -  	auto-dnssec ( allow | maintain | off );
 +  	auto-dnssec ( allow | maintain | off );// deprecated
   	cache-file quoted_string;// deprecated
   	catalog-zones { zone string [ default-masters [ port integer ]
   	    [ dscp integer ] { ( remote-servers | ipv4_address [ port
@@ -859,7 +860,7 @@ VIEW
   		    integer | * ) ] [ dscp integer ];
   		alt-transfer-source-v6 ( ipv6_address | * ) [ port (
   		    integer | * ) ] [ dscp integer ];
 -  		auto-dnssec ( allow | maintain | off );
 +  		auto-dnssec ( allow | maintain | off );// deprecated
   		check-dup-records ( fail | warn | ignore );
   		check-integrity boolean;
   		check-mx ( fail | warn | ignore );
@@ -977,7 +978,7 @@ ZONE
   	    ] [ dscp integer ];
   	alt-transfer-source-v6 ( ipv6_address | * ) [ port ( integer |
   	    * ) ] [ dscp integer ];
 -  	auto-dnssec ( allow | maintain | off );
 +  	auto-dnssec ( allow | maintain | off );// deprecated
   	check-dup-records ( fail | warn | ignore );
   	check-integrity boolean;
   	check-mx ( fail | warn | ignore );
 diff --git a/bin/named/server.c b/bin/named/server.c
 index 20443ff8a9..78a21d62a2 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
@@ -8542,6 +8542,7 @@ load_configuration(const char *filename, named_server_t *server,
 	configure_server_quota(maps, "tcp-clients", &server->sctx->tcpquota);
 	configure_server_quota(maps, "recursive-clients",
 			       &server->sctx->recursionquota);
 +	configure_server_quota(maps, "update-quota", &server->sctx->updquota);
 	max = isc_quota_getmax(&server->sctx->recursionquota);
 	if (max > 1000) {
 diff --git a/bin/tests/system/checkconf/good.conf b/bin/tests/system/checkconf/good.conf
 index b1f7059acf..0ecdb68e95 100644
 --- a/bin/tests/system/checkconf/good.conf
 +++ b/bin/tests/system/checkconf/good.conf
@@ -75,6 +75,7 @@ options {
 	recursive-clients 3000;
 	serial-query-rate 100;
 	server-id none;
 +	update-quota 200;
 	check-names primary warn;
 	check-names secondary ignore;
 	max-cache-size 20000000000000;
 diff --git a/doc/arm/reference.rst b/doc/arm/reference.rst
 index 2603d60251..703663d0ba 100644
 --- a/doc/arm/reference.rst
 +++ b/doc/arm/reference.rst
@@ -3151,6 +3151,11 @@ system.
    value as ``tcp-keepalive-timeout``. This value can be updated at
    runtime by using ``rndc tcp-timeouts``.
 +``update-quota``
 +   This is the maximum number of simultaneous DNS UPDATE messages that
 +   the server will accept for updating local authoritiative zones or
 +   forwarding to a primary server. The default is ``100``.
 +
 .. _intervals:
 Periodic Task Intervals
@@ -6840,7 +6845,7 @@ Name Server Statistics Counters
 ``UpdateQuota``
     This indicates the number of times a dynamic update or update
     forwarding request was rejected because the number of pending
 -    requests exceeded the update quota.
 +    requests exceeded ``update-quota``.
 ``RateDropped``
     This indicates the number of responses dropped due to rate limits.
 diff --git a/doc/man/named.conf.5in b/doc/man/named.conf.5in
 index 4c46f47592..c87afa2881 100644
 --- a/doc/man/named.conf.5in
 +++ b/doc/man/named.conf.5in
@@ -231,7 +231,7 @@ options {
       answer\-cookie boolean;
       attach\-cache string;
       auth\-nxdomain boolean; // default changed
 -      auto\-dnssec ( allow | maintain | off );
 +      auto\-dnssec ( allow | maintain | off );// deprecated
       automatic\-interface\-scan boolean;
       avoid\-v4\-udp\-ports { portrange; ... };
       avoid\-v6\-udp\-ports { portrange; ... };
@@ -498,6 +498,7 @@ options {
       trust\-anchor\-telemetry boolean; // experimental
       try\-tcp\-refresh boolean;
       update\-check\-ksk boolean;
 +      update\-quota integer;
       use\-alt\-transfer\-source boolean;
       use\-v4\-udp\-ports { portrange; ... };
       use\-v6\-udp\-ports { portrange; ... };
@@ -668,7 +669,7 @@ view string [ class ] {
           * ) ] [ dscp integer ];
       attach\-cache string;
       auth\-nxdomain boolean; // default changed
 -      auto\-dnssec ( allow | maintain | off );
 +      auto\-dnssec ( allow | maintain | off );// deprecated
       cache\-file quoted_string;// deprecated
       catalog\-zones { zone string [ default\-masters [ port integer ]
           [ dscp integer ] { ( remote\-servers | ipv4_address [ port
@@ -943,7 +944,7 @@ view string [ class ] {
                   integer | * ) ] [ dscp integer ];
               alt\-transfer\-source\-v6 ( ipv6_address | * ) [ port (
                   integer | * ) ] [ dscp integer ];
 -              auto\-dnssec ( allow | maintain | off );
 +              auto\-dnssec ( allow | maintain | off );// deprecated
               check\-dup\-records ( fail | warn | ignore );
               check\-integrity boolean;
               check\-mx ( fail | warn | ignore );
@@ -1065,7 +1066,7 @@ zone string [ class ] {
           ] [ dscp integer ];
       alt\-transfer\-source\-v6 ( ipv6_address | * ) [ port ( integer |
           * ) ] [ dscp integer ];
 -      auto\-dnssec ( allow | maintain | off );
 +      auto\-dnssec ( allow | maintain | off );// deprecated
       check\-dup\-records ( fail | warn | ignore );
       check\-integrity boolean;
       check\-mx ( fail | warn | ignore );
 diff --git a/doc/misc/master.zoneopt.rst b/doc/misc/master.zoneopt.rst
 index 8fc7e1b4f0..346d59813e 100644
 --- a/doc/misc/master.zoneopt.rst
 +++ b/doc/misc/master.zoneopt.rst
@@ -20,7 +20,7 @@
   	also-notify [ port <integer> ] [ dscp <integer> ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ]; ... };
   	alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
   	alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
 -  	auto-dnssec ( allow | maintain | off );
 +  	auto-dnssec ( allow | maintain | off ); // deprecated
   	check-dup-records ( fail | warn | ignore );
   	check-integrity <boolean>;
   	check-mx ( fail | warn | ignore );
 diff --git a/doc/misc/options b/doc/misc/options
 index f57399499a..0dbcf101e1 100644
 --- a/doc/misc/options
 +++ b/doc/misc/options
@@ -404,6 +404,7 @@ options {
         trust-anchor-telemetry <boolean>; // experimental
         try-tcp-refresh <boolean>;
         update-check-ksk <boolean>;
 +        update-quota <integer>;
         use-alt-transfer-source <boolean>;
         use-id-pool <boolean>; // ancient
         use-ixfr <boolean>; // obsolete
 diff --git a/doc/misc/options.active b/doc/misc/options.active
 index 5fc1ab29f4..eb75a86eae 100644
 --- a/doc/misc/options.active
 +++ b/doc/misc/options.active
@@ -363,6 +363,7 @@ options {
         trust-anchor-telemetry <boolean>; // experimental
         try-tcp-refresh <boolean>;
         update-check-ksk <boolean>;
 +        update-quota <integer>;
         use-alt-transfer-source <boolean>;
         use-v4-udp-ports { <portrange>; ... };
         use-v6-udp-ports { <portrange>; ... };
 diff --git a/doc/misc/options.grammar.rst b/doc/misc/options.grammar.rst
 index 438072c95c..beef35341a 100644
 --- a/doc/misc/options.grammar.rst
 +++ b/doc/misc/options.grammar.rst
@@ -33,7 +33,7 @@
   	answer-cookie <boolean>;
   	attach-cache <string>;
   	auth-nxdomain <boolean>; // default changed
 -  	auto-dnssec ( allow | maintain | off );
 +  	auto-dnssec ( allow | maintain | off ); // deprecated
   	automatic-interface-scan <boolean>;
   	avoid-v4-udp-ports { <portrange>; ... };
   	avoid-v6-udp-ports { <portrange>; ... };
@@ -300,6 +300,7 @@
   	trust-anchor-telemetry <boolean>; // experimental
   	try-tcp-refresh <boolean>;
   	update-check-ksk <boolean>;
 +  	update-quota <integer>;
   	use-alt-transfer-source <boolean>;
   	use-v4-udp-ports { <portrange>; ... };
   	use-v6-udp-ports { <portrange>; ... };
 diff --git a/doc/misc/slave.zoneopt.rst b/doc/misc/slave.zoneopt.rst
 index cc72dcbf67..468a7f4d9a 100644
 --- a/doc/misc/slave.zoneopt.rst
 +++ b/doc/misc/slave.zoneopt.rst
@@ -21,7 +21,7 @@
   	also-notify [ port <integer> ] [ dscp <integer> ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ]; ... };
   	alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
   	alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
 -  	auto-dnssec ( allow | maintain | off );
 +  	auto-dnssec ( allow | maintain | off ); // deprecated
   	check-names ( fail | warn | ignore );
   	database <string>;
   	dialup ( notify | notify-passive | passive | refresh | <boolean> );
 diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
 index 45de0196bf..6e63d86816 100644
 --- a/lib/isccfg/namedconf.c
 +++ b/lib/isccfg/namedconf.c
@@ -1267,6 +1267,7 @@ static cfg_clausedef_t options_clauses[] = {
 	{ "transfers-out", &cfg_type_uint32, 0 },
 	{ "transfers-per-ns", &cfg_type_uint32, 0 },
 	{ "treat-cr-as-space", &cfg_type_boolean, CFG_CLAUSEFLAG_ANCIENT },
 +	{ "update-quota", &cfg_type_uint32, 0 },
 	{ "use-id-pool", &cfg_type_boolean, CFG_CLAUSEFLAG_ANCIENT },
 	{ "use-ixfr", &cfg_type_boolean, CFG_CLAUSEFLAG_OBSOLETE },
 	{ "use-v4-udp-ports", &cfg_type_bracketed_portlist, 0 },
 -- 
 2.39.1
--- a/SOURCES/bind-9.16-CVE-2022-3094-3.patch
+++ b/SOURCES/bind-9.16-CVE-2022-3094-3.patch
@ -0,0 +1,470 @@
 From 93b8bd39145566053ad8b22cef597146e9175ea4 Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Tue, 8 Nov 2022 17:32:41 -0800
 Subject: [PATCH] move update ACL and update-policy checks before quota
 check allow-update, update-policy, and allow-update-forwarding before
 consuming quota slots, so that unauthorized clients can't fill the
 quota.
 (this moves the access check before the prerequisite check, which
 violates the precise wording of RFC 2136. however, RFC co-author Paul
 Vixie has stated that the RFC is mistaken on this point; it should have
 said that access checking must happen *no later than* the completion of
 prerequisite checks, not that it must happen exactly then.)
 (cherry picked from commit 964f559edb5036880b8e463b8f190b9007ee055d)
 ---
 lib/ns/update.c | 335 ++++++++++++++++++++++++++----------------------
 1 file changed, 181 insertions(+), 154 deletions(-)
 diff --git a/lib/ns/update.c b/lib/ns/update.c
 index 9a8c309..036184b 100644
 --- a/lib/ns/update.c
 +++ b/lib/ns/update.c
@@ -261,6 +261,9 @@ static void
 forward_done(isc_task_t *task, isc_event_t *event);
 static isc_result_t
 add_rr_prepare_action(void *data, rr_t *rr);
 +static isc_result_t
 +rr_exists(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
 +	  const dns_rdata_t *rdata, bool *flag);
 /**************************************************************************/
@@ -333,25 +336,26 @@ inc_stats(ns_client_t *client, dns_zone_t *zone, isc_statscounter_t counter) {
 static isc_result_t
 checkqueryacl(ns_client_t *client, dns_acl_t *queryacl, dns_name_t *zonename,
 	      dns_acl_t *updateacl, dns_ssutable_t *ssutable) {
 +	isc_result_t result;
 	char namebuf[DNS_NAME_FORMATSIZE];
 	char classbuf[DNS_RDATACLASS_FORMATSIZE];
 -	int level;
 -	isc_result_t result;
 +	bool update_possible =
 +		((updateacl != NULL && !dns_acl_isnone(updateacl)) ||
 +		 ssutable != NULL);
 	result = ns_client_checkaclsilent(client, NULL, queryacl, true);
 	if (result != ISC_R_SUCCESS) {
 +		int level = update_possible ? ISC_LOG_ERROR : ISC_LOG_INFO;
 +
 		dns_name_format(zonename, namebuf, sizeof(namebuf));
 		dns_rdataclass_format(client->view->rdclass, classbuf,
 				      sizeof(classbuf));
 -		level = (updateacl == NULL && ssutable == NULL) ? ISC_LOG_INFO
 -								: ISC_LOG_ERROR;
 -
 		ns_client_log(client, NS_LOGCATEGORY_UPDATE_SECURITY,
 			      NS_LOGMODULE_UPDATE, level,
 			      "update '%s/%s' denied due to allow-query",
 			      namebuf, classbuf);
 -	} else if (updateacl == NULL && ssutable == NULL) {
 +	} else if (!update_possible) {
 		dns_name_format(zonename, namebuf, sizeof(namebuf));
 		dns_rdataclass_format(client->view->rdclass, classbuf,
 				      sizeof(classbuf));
@@ -1543,6 +1547,156 @@ send_update_event(ns_client_t *client, dns_zone_t *zone) {
 	isc_result_t result = ISC_R_SUCCESS;
 	update_event_t *event = NULL;
 	isc_task_t *zonetask = NULL;
 +	dns_ssutable_t *ssutable = NULL;
 +	dns_message_t *request = client->message;
 +	dns_aclenv_t *env =
 +		ns_interfacemgr_getaclenv(client->manager->interface->mgr);
 +	dns_rdataclass_t zoneclass;
 +	dns_rdatatype_t covers;
 +	dns_name_t *zonename = NULL;
 +	dns_db_t *db = NULL;
 +	dns_dbversion_t *ver = NULL;
 +
 +	CHECK(dns_zone_getdb(zone, &db));
 +	zonename = dns_db_origin(db);
 +	zoneclass = dns_db_class(db);
 +	dns_zone_getssutable(zone, &ssutable);
 +	dns_db_currentversion(db, &ver);
 +
 +	/*
 +	 * Update message processing can leak record existence information
 +	 * so check that we are allowed to query this zone.  Additionally,
 +	 * if we would refuse all updates for this zone, we bail out here.
 +	 */
 +	CHECK(checkqueryacl(client, dns_zone_getqueryacl(zone),
 +			    dns_zone_getorigin(zone),
 +			    dns_zone_getupdateacl(zone), ssutable));
 +
 +	/*
 +	 * Check requestor's permissions.
 +	 */
 +	if (ssutable == NULL) {
 +		CHECK(checkupdateacl(client, dns_zone_getupdateacl(zone),
 +				     "update", dns_zone_getorigin(zone), false,
 +				     false));
 +	} else if (client->signer == NULL && !TCPCLIENT(client)) {
 +		CHECK(checkupdateacl(client, NULL, "update",
 +				     dns_zone_getorigin(zone), false, true));
 +	}
 +
 +	if (dns_zone_getupdatedisabled(zone)) {
 +		FAILC(DNS_R_REFUSED, "dynamic update temporarily disabled "
 +				     "because the zone is frozen.  Use "
 +				     "'rndc thaw' to re-enable updates.");
 +	}
 +
 +	/*
 +	 * Prescan the update section, checking for updates that
 +	 * are illegal or violate policy.
 +	 */
 +	for (result = dns_message_firstname(request, DNS_SECTION_UPDATE);
 +	     result == ISC_R_SUCCESS;
 +	     result = dns_message_nextname(request, DNS_SECTION_UPDATE))
 +	{
 +		dns_name_t *name = NULL;
 +		dns_rdata_t rdata = DNS_RDATA_INIT;
 +		dns_ttl_t ttl;
 +		dns_rdataclass_t update_class;
 +
 +		get_current_rr(request, DNS_SECTION_UPDATE, zoneclass, &name,
 +			       &rdata, &covers, &ttl, &update_class);
 +
 +		if (!dns_name_issubdomain(name, zonename)) {
 +			FAILC(DNS_R_NOTZONE, "update RR is outside zone");
 +		}
 +		if (update_class == zoneclass) {
 +			/*
 +			 * Check for meta-RRs.  The RFC2136 pseudocode says
 +			 * check for ANY|AXFR|MAILA|MAILB, but the text adds
 +			 * "or any other QUERY metatype"
 +			 */
 +			if (dns_rdatatype_ismeta(rdata.type)) {
 +				FAILC(DNS_R_FORMERR, "meta-RR in update");
 +			}
 +			result = dns_zone_checknames(zone, name, &rdata);
 +			if (result != ISC_R_SUCCESS) {
 +				FAIL(DNS_R_REFUSED);
 +			}
 +		} else if (update_class == dns_rdataclass_any) {
 +			if (ttl != 0 || rdata.length != 0 ||
 +			    (dns_rdatatype_ismeta(rdata.type) &&
 +			     rdata.type != dns_rdatatype_any))
 +			{
 +				FAILC(DNS_R_FORMERR, "meta-RR in update");
 +			}
 +		} else if (update_class == dns_rdataclass_none) {
 +			if (ttl != 0 || dns_rdatatype_ismeta(rdata.type)) {
 +				FAILC(DNS_R_FORMERR, "meta-RR in update");
 +			}
 +		} else {
 +			update_log(client, zone, ISC_LOG_WARNING,
 +				   "update RR has incorrect class %d",
 +				   update_class);
 +			FAIL(DNS_R_FORMERR);
 +		}
 +
 +		/*
 +		 * draft-ietf-dnsind-simple-secure-update-01 says
 +		 * "Unlike traditional dynamic update, the client
 +		 * is forbidden from updating NSEC records."
 +		 */
 +		if (rdata.type == dns_rdatatype_nsec3) {
 +			FAILC(DNS_R_REFUSED, "explicit NSEC3 updates are not "
 +					     "allowed "
 +					     "in secure zones");
 +		} else if (rdata.type == dns_rdatatype_nsec) {
 +			FAILC(DNS_R_REFUSED, "explicit NSEC updates are not "
 +					     "allowed "
 +					     "in secure zones");
 +		} else if (rdata.type == dns_rdatatype_rrsig &&
 +			   !dns_name_equal(name, zonename))
 +		{
 +			FAILC(DNS_R_REFUSED, "explicit RRSIG updates are "
 +					     "currently "
 +					     "not supported in secure zones "
 +					     "except "
 +					     "at the apex");
 +		}
 +
 +		if (ssutable != NULL) {
 +			isc_netaddr_t netaddr;
 +			dst_key_t *tsigkey = NULL;
 +			isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
 +
 +			if (client->message->tsigkey != NULL) {
 +				tsigkey = client->message->tsigkey->key;
 +			}
 +
 +			if (rdata.type != dns_rdatatype_any) {
 +				if (!dns_ssutable_checkrules(
 +					    ssutable, client->signer, name,
 +					    &netaddr, TCPCLIENT(client), env,
 +					    rdata.type, tsigkey))
 +				{
 +					FAILC(DNS_R_REFUSED, "rejected by "
 +							     "secure update");
 +				}
 +			} else {
 +				if (!ssu_checkall(db, ver, name, ssutable,
 +						  client->signer, &netaddr, env,
 +						  TCPCLIENT(client), tsigkey))
 +				{
 +					FAILC(DNS_R_REFUSED, "rejected by "
 +							     "secure update");
 +				}
 +			}
 +		}
 +	}
 +	if (result != ISC_R_NOMORE) {
 +		FAIL(result);
 +	}
 +
 +	update_log(client, zone, LOGLEVEL_DEBUG, "update section prescan OK");
 	result = isc_quota_attach(&client->manager->sctx->updquota,
 				  &(isc_quota_t *){ NULL });
@@ -1552,9 +1706,7 @@ send_update_event(ns_client_t *client, dns_zone_t *zone) {
 			   isc_result_totext(result));
 		ns_stats_increment(client->manager->sctx->nsstats,
 				   ns_statscounter_updatequota);
 -		ns_client_drop(client, result);
 -		isc_nmhandle_detach(&client->reqhandle);
 -		return (DNS_R_DROP);
 +		CHECK(DNS_R_DROP);
 	}
 	event = (update_event_t *)isc_event_allocate(
@@ -1571,6 +1723,16 @@ send_update_event(ns_client_t *client, dns_zone_t *zone) {
 	dns_zone_gettask(zone, &zonetask);
 	isc_task_send(zonetask, ISC_EVENT_PTR(&event));
 +failure:
 +	if (db != NULL) {
 +		dns_db_closeversion(db, &ver, false);
 +		dns_db_detach(&db);
 +	}
 +
 +	if (ssutable != NULL) {
 +		dns_ssutable_detach(&ssutable);
 +	}
 +
 	return (result);
 }
@@ -1671,9 +1833,6 @@ ns_update_start(ns_client_t *client, isc_nmhandle_t *handle,
 		break;
 	case dns_zone_secondary:
 	case dns_zone_mirror:
 -		CHECK(checkupdateacl(client, dns_zone_getforwardacl(zone),
 -				     "update forwarding", zonename, true,
 -				     false));
 		CHECK(send_forward_event(client, zone));
 		break;
 	default:
@@ -1685,8 +1844,6 @@ ns_update_start(ns_client_t *client, isc_nmhandle_t *handle,
 failure:
 	if (result == DNS_R_REFUSED) {
 -		INSIST(dns_zone_gettype(zone) == dns_zone_secondary ||
 -		       dns_zone_gettype(zone) == dns_zone_mirror);
 		inc_stats(client, zone, ns_statscounter_updaterej);
 	}
@@ -2578,7 +2735,7 @@ update_action(isc_task_t *task, isc_event_t *event) {
 	dns_rdatatype_t covers;
 	dns_message_t *request = client->message;
 	dns_rdataclass_t zoneclass;
 -	dns_name_t *zonename;
 +	dns_name_t *zonename = NULL;
 	dns_ssutable_t *ssutable = NULL;
 	dns_fixedname_t tmpnamefixed;
 	dns_name_t *tmpname = NULL;
@@ -2590,8 +2747,6 @@ update_action(isc_task_t *task, isc_event_t *event) {
 	dns_ttl_t maxttl = 0;
 	uint32_t maxrecords;
 	uint64_t records;
 -	dns_aclenv_t *env =
 -		ns_interfacemgr_getaclenv(client->manager->interface->mgr);
 	INSIST(event->ev_type == DNS_EVENT_UPDATE);
@@ -2602,14 +2757,7 @@ update_action(isc_task_t *task, isc_event_t *event) {
 	zonename = dns_db_origin(db);
 	zoneclass = dns_db_class(db);
 	dns_zone_getssutable(zone, &ssutable);
 -
 -	/*
 -	 * Update message processing can leak record existence information
 -	 * so check that we are allowed to query this zone.  Additionally
 -	 * if we would refuse all updates for this zone we bail out here.
 -	 */
 -	CHECK(checkqueryacl(client, dns_zone_getqueryacl(zone), zonename,
 -			    dns_zone_getupdateacl(zone), ssutable));
 +	options = dns_zone_getoptions(zone);
 	/*
 	 * Get old and new versions now that queryacl has been checked.
@@ -2745,135 +2893,10 @@ update_action(isc_task_t *task, isc_event_t *event) {
 	update_log(client, zone, LOGLEVEL_DEBUG, "prerequisites are OK");
 -	/*
 -	 * Check Requestor's Permissions.  It seems a bit silly to do this
 -	 * only after prerequisite testing, but that is what RFC2136 says.
 -	 */
 -	if (ssutable == NULL) {
 -		CHECK(checkupdateacl(client, dns_zone_getupdateacl(zone),
 -				     "update", zonename, false, false));
 -	} else if (client->signer == NULL && !TCPCLIENT(client)) {
 -		CHECK(checkupdateacl(client, NULL, "update", zonename, false,
 -				     true));
 -	}
 -
 -	if (dns_zone_getupdatedisabled(zone)) {
 -		FAILC(DNS_R_REFUSED, "dynamic update temporarily disabled "
 -				     "because the zone is frozen.  Use "
 -				     "'rndc thaw' to re-enable updates.");
 -	}
 -
 -	/*
 -	 * Perform the Update Section Prescan.
 -	 */
 -
 -	for (result = dns_message_firstname(request, DNS_SECTION_UPDATE);
 -	     result == ISC_R_SUCCESS;
 -	     result = dns_message_nextname(request, DNS_SECTION_UPDATE))
 -	{
 -		dns_name_t *name = NULL;
 -		dns_rdata_t rdata = DNS_RDATA_INIT;
 -		dns_ttl_t ttl;
 -		dns_rdataclass_t update_class;
 -		get_current_rr(request, DNS_SECTION_UPDATE, zoneclass, &name,
 -			       &rdata, &covers, &ttl, &update_class);
 -
 -		if (!dns_name_issubdomain(name, zonename)) {
 -			FAILC(DNS_R_NOTZONE, "update RR is outside zone");
 -		}
 -		if (update_class == zoneclass) {
 -			/*
 -			 * Check for meta-RRs.  The RFC2136 pseudocode says
 -			 * check for ANY|AXFR|MAILA|MAILB, but the text adds
 -			 * "or any other QUERY metatype"
 -			 */
 -			if (dns_rdatatype_ismeta(rdata.type)) {
 -				FAILC(DNS_R_FORMERR, "meta-RR in update");
 -			}
 -			result = dns_zone_checknames(zone, name, &rdata);
 -			if (result != ISC_R_SUCCESS) {
 -				FAIL(DNS_R_REFUSED);
 -			}
 -		} else if (update_class == dns_rdataclass_any) {
 -			if (ttl != 0 || rdata.length != 0 ||
 -			    (dns_rdatatype_ismeta(rdata.type) &&
 -			     rdata.type != dns_rdatatype_any))
 -			{
 -				FAILC(DNS_R_FORMERR, "meta-RR in update");
 -			}
 -		} else if (update_class == dns_rdataclass_none) {
 -			if (ttl != 0 || dns_rdatatype_ismeta(rdata.type)) {
 -				FAILC(DNS_R_FORMERR, "meta-RR in update");
 -			}
 -		} else {
 -			update_log(client, zone, ISC_LOG_WARNING,
 -				   "update RR has incorrect class %d",
 -				   update_class);
 -			FAIL(DNS_R_FORMERR);
 -		}
 -
 -		/*
 -		 * draft-ietf-dnsind-simple-secure-update-01 says
 -		 * "Unlike traditional dynamic update, the client
 -		 * is forbidden from updating NSEC records."
 -		 */
 -		if (rdata.type == dns_rdatatype_nsec3) {
 -			FAILC(DNS_R_REFUSED, "explicit NSEC3 updates are not "
 -					     "allowed "
 -					     "in secure zones");
 -		} else if (rdata.type == dns_rdatatype_nsec) {
 -			FAILC(DNS_R_REFUSED, "explicit NSEC updates are not "
 -					     "allowed "
 -					     "in secure zones");
 -		} else if (rdata.type == dns_rdatatype_rrsig &&
 -			   !dns_name_equal(name, zonename)) {
 -			FAILC(DNS_R_REFUSED, "explicit RRSIG updates are "
 -					     "currently "
 -					     "not supported in secure zones "
 -					     "except "
 -					     "at the apex");
 -		}
 -
 -		if (ssutable != NULL) {
 -			isc_netaddr_t netaddr;
 -			dst_key_t *tsigkey = NULL;
 -			isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
 -
 -			if (client->message->tsigkey != NULL) {
 -				tsigkey = client->message->tsigkey->key;
 -			}
 -
 -			if (rdata.type != dns_rdatatype_any) {
 -				if (!dns_ssutable_checkrules(
 -					    ssutable, client->signer, name,
 -					    &netaddr, TCPCLIENT(client), env,
 -					    rdata.type, tsigkey))
 -				{
 -					FAILC(DNS_R_REFUSED, "rejected by "
 -							     "secure update");
 -				}
 -			} else {
 -				if (!ssu_checkall(db, ver, name, ssutable,
 -						  client->signer, &netaddr, env,
 -						  TCPCLIENT(client), tsigkey))
 -				{
 -					FAILC(DNS_R_REFUSED, "rejected by "
 -							     "secure update");
 -				}
 -			}
 -		}
 -	}
 -	if (result != ISC_R_NOMORE) {
 -		FAIL(result);
 -	}
 -
 -	update_log(client, zone, LOGLEVEL_DEBUG, "update section prescan OK");
 -
 	/*
 	 * Process the Update Section.
 	 */
 -	options = dns_zone_getoptions(zone);
 	for (result = dns_message_firstname(request, DNS_SECTION_UPDATE);
 	     result == ISC_R_SUCCESS;
 	     result = dns_message_nextname(request, DNS_SECTION_UPDATE))
@@ -3307,10 +3330,7 @@ update_action(isc_task_t *task, isc_event_t *event) {
 			if (result == ISC_R_SUCCESS && records > maxrecords) {
 				update_log(client, zone, ISC_LOG_ERROR,
 					   "records in zone (%" PRIu64 ") "
 -					   "exceeds"
 -					   " max-"
 -					   "records"
 -					   " (%u)",
 +					   "exceeds max-records (%u)",
 					   records, maxrecords);
 				result = DNS_R_TOOMANYRECORDS;
 				goto failure;
@@ -3601,6 +3621,13 @@ send_forward_event(ns_client_t *client, dns_zone_t *zone) {
 	update_event_t *event = NULL;
 	isc_task_t *zonetask = NULL;
 +	result = checkupdateacl(client, dns_zone_getforwardacl(zone),
 +				"update forwarding", dns_zone_getorigin(zone),
 +				true, false);
 +	if (result != ISC_R_SUCCESS) {
 +		return (result);
 +	}
 +
 	result = isc_quota_attach(&client->manager->sctx->updquota,
 				  &(isc_quota_t *){ NULL });
 	if (result != ISC_R_SUCCESS) {
 -- 
 2.39.1
--- a/SOURCES/bind-9.16-CVE-2022-3094-test.patch
+++ b/SOURCES/bind-9.16-CVE-2022-3094-test.patch
@ -0,0 +1,272 @@
 From 54e281c11ee13eabc3c51d6391a58fc90836000c Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Wed, 9 Nov 2022 21:56:16 -0800
 Subject: [PATCH] test failure conditions
 verify that updates are refused when the client is disallowed by
 allow-query, and update forwarding is refused when the client is
 is disallowed by update-forwarding.
 verify that "too many DNS UPDATEs" appears in the log file when too
 many simultaneous updates are processing.
 (cherry picked from commit b91339b80e5b82a56622c93cc1e3cca2d0c11bc0)
 ---
 bin/tests/system/nsupdate/ns1/named.conf.in   |  2 +
 bin/tests/system/nsupdate/tests.sh            | 28 +++++++++++++
 bin/tests/system/upforwd/clean.sh             |  2 +
 .../ns3/{named.conf.in => named1.conf.in}     | 13 ++++--
 bin/tests/system/upforwd/ns3/named2.conf.in   | 41 +++++++++++++++++++
 bin/tests/system/upforwd/setup.sh             |  2 +-
 bin/tests/system/upforwd/tests.sh             | 39 ++++++++++++++++++
 7 files changed, 123 insertions(+), 4 deletions(-)
 rename bin/tests/system/upforwd/ns3/{named.conf.in => named1.conf.in} (78%)
 create mode 100644 bin/tests/system/upforwd/ns3/named2.conf.in
 diff --git a/bin/tests/system/nsupdate/ns1/named.conf.in b/bin/tests/system/nsupdate/ns1/named.conf.in
 index 436c97d..83fe884 100644
 --- a/bin/tests/system/nsupdate/ns1/named.conf.in
 +++ b/bin/tests/system/nsupdate/ns1/named.conf.in
@@ -21,6 +21,7 @@ options {
 	recursion no;
 	notify yes;
 	minimal-responses no;
 +	update-quota 1;
 };
 acl named-acl {
@@ -81,6 +82,7 @@ zone "other.nil" {
 	check-integrity no;
 	check-mx warn;
 	update-policy local;
 +	allow-query { !10.53.0.2; any; };
 	allow-query-on { 10.53.0.1; 127.0.0.1; };
 	allow-transfer { any; };
 };
 diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh
 index b5f562f..13ba577 100755
 --- a/bin/tests/system/nsupdate/tests.sh
 +++ b/bin/tests/system/nsupdate/tests.sh
@@ -1268,6 +1268,34 @@ END
 grep "NSEC3PARAM has excessive iterations (> 150)" nsupdate.out-$n >/dev/null || ret=1
 [ $ret = 0 ] || { echo_i "failed"; status=1; }
 +n=$((n + 1))
 +ret=0
 +echo_i "check that update is rejected if query is not allowed ($n)"
 +{
 +  $NSUPDATE -d <<END
 +  local 10.53.0.2
 +  server 10.53.0.1 ${PORT}
 +  update add reject.other.nil 3600 IN TXT Whatever
 +  send
 +END
 +} > nsupdate.out.test$n 2>&1
 +grep 'failed: REFUSED' nsupdate.out.test$n > /dev/null || ret=1
 +[ $ret = 0 ] || { echo_i "failed"; status=1; }
 +
 +n=$((n + 1))
 +ret=0
 +echo_i "check that update is rejected if quota is exceeded ($n)"
 +for loop in 1 2 3 4 5 6 7 8 9 10; do
 +{
 +  $NSUPDATE -4 -l -p ${PORT} -k ns1/session.key > /dev/null 2>&1 <<END
 +  update add txt-$loop.other.nil 3600 IN TXT Whatever
 +  send
 +END
 +} &
 +done
 +wait_for_log 10 "too many DNS UPDATEs queued" ns1/named.run || ret=1
 +[ $ret = 0 ] || { echo_i "failed"; status=1; }
 +
 if ! $FEATURETEST --gssapi ; then
   echo_i "SKIPPED: GSSAPI tests"
 else
 diff --git a/bin/tests/system/upforwd/clean.sh b/bin/tests/system/upforwd/clean.sh
 index 2025252..12311df 100644
 --- a/bin/tests/system/upforwd/clean.sh
 +++ b/bin/tests/system/upforwd/clean.sh
@@ -29,3 +29,5 @@ rm -f keyname keyname.err
 rm -f ns*/named.lock
 rm -f ns1/example2.db
 rm -f ns*/managed-keys.bind*
 +rm -f nsupdate.out.*
 +rm -f ns*/named.run.prev
 diff --git a/bin/tests/system/upforwd/ns3/named.conf.in b/bin/tests/system/upforwd/ns3/named1.conf.in
 similarity index 78%
 rename from bin/tests/system/upforwd/ns3/named.conf.in
 rename to bin/tests/system/upforwd/ns3/named1.conf.in
 index 7bd13d3..2f690ff 100644
 --- a/bin/tests/system/upforwd/ns3/named.conf.in
 +++ b/bin/tests/system/upforwd/ns3/named1.conf.in
@@ -28,20 +28,27 @@ key rndc_key {
 };
 controls {
 -        inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
 +	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
 };
 zone "example" {
 	type secondary;
 	file "example.bk";
 -	allow-update-forwarding { any; };
 +	allow-update-forwarding { 10.53.0.1; };
 	primaries { 10.53.0.1; };
 };
 zone "example2" {
 	type secondary;
 	file "example2.bk";
 -	allow-update-forwarding { any; };
 +	allow-update-forwarding { 10.53.0.1; };
 +	primaries { 10.53.0.1; };
 +};
 +
 +zone "example3" {
 +	type secondary;
 +	file "example3.bk";
 +	allow-update-forwarding { 10.53.0.1; };
 	primaries { 10.53.0.1; };
 };
 diff --git a/bin/tests/system/upforwd/ns3/named2.conf.in b/bin/tests/system/upforwd/ns3/named2.conf.in
 new file mode 100644
 index 0000000..e15459a
 --- /dev/null
 +++ b/bin/tests/system/upforwd/ns3/named2.conf.in
@@ -0,0 +1,41 @@
 +/*
 + * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 + *
 + * SPDX-License-Identifier: MPL-2.0
 + *
 + * This Source Code Form is subject to the terms of the Mozilla Public
 + * License, v. 2.0.  If a copy of the MPL was not distributed with this
 + * file, you can obtain one at https://mozilla.org/MPL/2.0/.
 + *
 + * See the COPYRIGHT file distributed with this work for additional
 + * information regarding copyright ownership.
 + */
 +
 +options {
 +	query-source address 10.53.0.3;
 +	notify-source 10.53.0.3;
 +	transfer-source 10.53.0.3;
 +	port @PORT@;
 +	pid-file "named.pid";
 +	listen-on { 10.53.0.3; };
 +	listen-on-v6 { none; };
 +	recursion no;
 +	notify yes;
 +	update-quota 1;
 +};
 +
 +key rndc_key {
 +	secret "1234abcd8765";
 +        algorithm hmac-sha256;
 +};
 +
 +controls {
 +	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
 +};
 +
 +zone "example" {
 +	type secondary;
 +	file "example.bk";
 +	allow-update-forwarding { any; };
 +	primaries { 10.53.0.1; };
 +};
 diff --git a/bin/tests/system/upforwd/setup.sh b/bin/tests/system/upforwd/setup.sh
 index e748078..88ab28d 100644
 --- a/bin/tests/system/upforwd/setup.sh
 +++ b/bin/tests/system/upforwd/setup.sh
@@ -17,7 +17,7 @@ cp -f ns3/nomaster.db ns3/nomaster1.db
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
 -copy_setports ns3/named.conf.in ns3/named.conf
 +copy_setports ns3/named1.conf.in ns3/named.conf
 if $FEATURETEST --enable-dnstap
 then
 diff --git a/bin/tests/system/upforwd/tests.sh b/bin/tests/system/upforwd/tests.sh
 index 8062d68..20fc46f 100644
 --- a/bin/tests/system/upforwd/tests.sh
 +++ b/bin/tests/system/upforwd/tests.sh
@@ -80,6 +80,7 @@ if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
 echo_i "updating zone (signed) ($n)"
 ret=0
 $NSUPDATE -y hmac-sha256:update.example:c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K -- - <<EOF || ret=1
 +local 10.53.0.1
 server 10.53.0.3 ${PORT}
 update add updated.example. 600 A 10.10.10.1
 update add updated.example. 600 TXT Foo
@@ -138,6 +139,7 @@ fi
 echo_i "updating zone (unsigned) ($n)"
 ret=0
 $NSUPDATE -- - <<EOF || ret=1
 +local 10.53.0.1
 server 10.53.0.3 ${PORT}
 update add unsigned.example. 600 A 10.10.10.1
 update add unsigned.example. 600 TXT Foo
@@ -194,6 +196,7 @@ while [ $count -lt 5 -a $ret -eq 0 ]
 do
 (
 $NSUPDATE -- - <<EOF 
 +local 10.53.0.1
 server 10.53.0.3 ${PORT}
 zone nomaster
 update add unsigned.nomaster. 600 A 10.10.10.1
@@ -225,6 +228,7 @@ then
 	ret=0
 	keyname=`cat keyname`
 	$NSUPDATE -k $keyname.private -- - <<EOF
 +	local 10.53.0.1
 	server 10.53.0.3 ${PORT}
 	zone example2
 	update add unsigned.example2. 600 A 10.10.10.1
@@ -249,5 +253,40 @@ EOF
 	fi
 fi
 +echo_i "attempting an update that should be rejected by ACL ($n)"
 +ret=0
 +{
 +        $NSUPDATE -- - << EOF
 +        local 10.53.0.2
 +        server 10.53.0.3 ${PORT}
 +        update add another.unsigned.example. 600 A 10.10.10.2
 +        update add another.unsigned.example. 600 TXT Bar
 +        send
 +EOF
 +} > nsupdate.out.$n 2>&1
 +grep REFUSED nsupdate.out.$n > /dev/null || ret=1
 +if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
 +n=`expr $n + 1`
 +
 +n=$((n + 1))
 +ret=0
 +echo_i "attempting updates that should exceed quota ($n)"
 +# lower the update quota to 1.
 +copy_setports ns3/named2.conf.in ns3/named.conf
 +rndc_reconfig ns3 10.53.0.3
 +nextpart ns3/named.run > /dev/null
 +for loop in 1 2 3 4 5 6 7 8 9 10; do
 +{
 +  $NSUPDATE -- - > /dev/null 2>&1 <<END
 +  local 10.53.0.1
 +  server 10.53.0.3 ${PORT}
 +  update add txt-$loop.unsigned.example 300 IN TXT Whatever
 +  send
 +END
 +} &
 +done
 +wait_for_log 10 "too many DNS UPDATEs queued" ns3/named.run || ret=1
 +[ $ret = 0 ] || { echo_i "failed"; status=1; }
 +
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
 -- 
 2.39.2
--- a/SOURCES/bind-9.16-CVE-2022-3736.patch
+++ b/SOURCES/bind-9.16-CVE-2022-3736.patch
@ -0,0 +1,53 @@
 From 1b6590eafce064cbf70f5afc2fe4d6f1bfdc3804 Mon Sep 17 00:00:00 2001
 From: Mark Andrews <marka@isc.org>
 Date: Thu, 27 Oct 2022 13:22:11 +1100
 Subject: [PATCH] Move the mapping of SIG and RRSIG to ANY
 dns_db_findext() asserts if RRSIG is passed to it and
 query_lookup_stale() failed to map RRSIG to ANY to prevent this.  To
 avoid cases like this in the future, move the mapping of SIG and RRSIG
 to ANY for qctx->type to qctx_init().
 (cherry picked from commit 56eae064183488bcf7ff08c3edf59f2e1742c1b6)
 ---
 lib/ns/query.c | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)
 diff --git a/lib/ns/query.c b/lib/ns/query.c
 index a450cb7..f66bab4 100644
 --- a/lib/ns/query.c
 +++ b/lib/ns/query.c
@@ -5103,6 +5103,15 @@ qctx_init(ns_client_t *client, dns_fetchevent_t **eventp, dns_rdatatype_t qtype,
 	qctx->result = ISC_R_SUCCESS;
 	qctx->findcoveringnsec = qctx->view->synthfromdnssec;
 +	/*
 +	 * If it's an RRSIG or SIG query, we'll iterate the node.
 +	 */
 +	if (qctx->qtype == dns_rdatatype_rrsig ||
 +	    qctx->qtype == dns_rdatatype_sig)
 +	{
 +		qctx->type = dns_rdatatype_any;
 +	}
 +
 	CALL_HOOK_NORETURN(NS_QUERY_QCTX_INITIALIZED, qctx);
 }
@@ -5243,14 +5252,6 @@ query_setup(ns_client_t *client, dns_rdatatype_t qtype) {
 	CALL_HOOK(NS_QUERY_SETUP, &qctx);
 -	/*
 -	 * If it's a SIG query, we'll iterate the node.
 -	 */
 -	if (qctx.qtype == dns_rdatatype_rrsig ||
 -	    qctx.qtype == dns_rdatatype_sig) {
 -		qctx.type = dns_rdatatype_any;
 -	}
 -
 	/*
 	 * Check SERVFAIL cache
 	 */
 -- 
 2.39.1
--- a/SOURCES/bind-9.16-CVE-2022-38177.patch
+++ b/SOURCES/bind-9.16-CVE-2022-38177.patch
@ -0,0 +1,27 @@
 From df8222fb189708199a185f73543b6e0602c1c72f Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Tue, 20 Sep 2022 11:21:45 +0200
 Subject: [PATCH 3/4] Fix CVE-2022-38177
 5961.	[security]	Fix memory leak in ECDSA verify processing.
 			(CVE-2022-38177) [GL #3487]
 ---
 lib/dns/opensslecdsa_link.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/lib/dns/opensslecdsa_link.c b/lib/dns/opensslecdsa_link.c
 index ce4c8c4..3847896 100644
 --- a/lib/dns/opensslecdsa_link.c
 +++ b/lib/dns/opensslecdsa_link.c
@@ -228,7 +228,7 @@ opensslecdsa_verify(dst_context_t *dctx, const isc_region_t *sig) {
 	}
 	if (sig->length != siglen) {
 -		return (DST_R_VERIFYFAILURE);
 +		DST_RET(DST_R_VERIFYFAILURE);
 	}
 	if (!EVP_DigestFinal_ex(evp_md_ctx, digest, &dgstlen)) {
 -- 
 2.37.3
--- a/SOURCES/bind-9.16-CVE-2022-38178.patch
+++ b/SOURCES/bind-9.16-CVE-2022-38178.patch
@ -0,0 +1,32 @@
 From 132ef295b8407f91e6922f4dfc4f30f1790b61c5 Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Tue, 20 Sep 2022 11:22:47 +0200
 Subject: [PATCH 4/4] Fix CVE-2022-38178
 5962.	[security]	Fix memory leak in EdDSA verify processing.
 			(CVE-2022-38178) [GL #3487]
 ---
 lib/dns/openssleddsa_link.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
 diff --git a/lib/dns/openssleddsa_link.c b/lib/dns/openssleddsa_link.c
 index 6a6a74d..3157011 100644
 --- a/lib/dns/openssleddsa_link.c
 +++ b/lib/dns/openssleddsa_link.c
@@ -234,11 +234,11 @@ openssleddsa_verify(dst_context_t *dctx, const isc_region_t *sig) {
 	}
 #endif /* if HAVE_OPENSSL_ED448 */
 	if (siglen == 0) {
 -		return (ISC_R_NOTIMPLEMENTED);
 +		DST_RET(ISC_R_NOTIMPLEMENTED);
 	}
 	if (sig->length != siglen) {
 -		return (DST_R_VERIFYFAILURE);
 +		DST_RET(DST_R_VERIFYFAILURE);
 	}
 	isc_buffer_usedregion(buf, &tbsreg);
 -- 
 2.37.3
--- a/SOURCES/bind-9.16-CVE-2022-3924.patch
+++ b/SOURCES/bind-9.16-CVE-2022-3924.patch
@ -0,0 +1,128 @@
 From 20424b3bfe8d3fae92c11a30e79aeffd26dc2891 Mon Sep 17 00:00:00 2001
 From: Aram Sargsyan <aram@isc.org>
 Date: Mon, 14 Nov 2022 12:18:06 +0000
 Subject: [PATCH] Cancel all fetch events in dns_resolver_cancelfetch()
 Although 'dns_fetch_t' fetch can have two associated events, one for
 each of 'DNS_EVENT_FETCHDONE' and 'DNS_EVENT_TRYSTALE' types, the
 dns_resolver_cancelfetch() function is designed in a way that it
 expects only one existing event, which it must cancel, and when it
 happens so that 'stale-answer-client-timeout' is enabled and there
 are two events, only one of them is canceled, and it results in an
 assertion in dns_resolver_destroyfetch(), when it finds a dangling
 event.
 Change the logic of dns_resolver_cancelfetch() function so that it
 cancels both the events (if they exist), and in the right order.
 (cherry picked from commit ec2098ca35039e4f81fd0aa7c525eb960b8f47bf)
 ---
 lib/dns/resolver.c | 53 +++++++++++++++++++++++++++++++++++-----------
 lib/ns/query.c     |  4 +++-
 2 files changed, 44 insertions(+), 13 deletions(-)
 diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
 index 18585b5..7cbfbb2 100644
 --- a/lib/dns/resolver.c
 +++ b/lib/dns/resolver.c
@@ -11254,8 +11254,9 @@ void
 dns_resolver_cancelfetch(dns_fetch_t *fetch) {
 	fetchctx_t *fctx;
 	dns_resolver_t *res;
 -	dns_fetchevent_t *event, *next_event;
 -	isc_task_t *etask;
 +	dns_fetchevent_t *event = NULL;
 +	dns_fetchevent_t *event_trystale = NULL;
 +	dns_fetchevent_t *event_fetchdone = NULL;
 	REQUIRE(DNS_FETCH_VALID(fetch));
 	fctx = fetch->private;
@@ -11267,32 +11268,60 @@ dns_resolver_cancelfetch(dns_fetch_t *fetch) {
 	LOCK(&res->buckets[fctx->bucketnum].lock);
 	/*
 -	 * Find the completion event for this fetch (as opposed
 +	 * Find the events for this fetch (as opposed
 	 * to those for other fetches that have joined the same
 -	 * fctx) and send it with result = ISC_R_CANCELED.
 +	 * fctx) and send them with result = ISC_R_CANCELED.
 	 */
 -	event = NULL;
 	if (fctx->state != fetchstate_done) {
 +		dns_fetchevent_t *next_event = NULL;
 		for (event = ISC_LIST_HEAD(fctx->events); event != NULL;
 		     event = next_event) {
 			next_event = ISC_LIST_NEXT(event, ev_link);
 			if (event->fetch == fetch) {
 				ISC_LIST_UNLINK(fctx->events, event, ev_link);
 -				break;
 +				switch (event->ev_type) {
 +				case DNS_EVENT_TRYSTALE:
 +					INSIST(event_trystale == NULL);
 +					event_trystale = event;
 +					break;
 +				case DNS_EVENT_FETCHDONE:
 +					INSIST(event_fetchdone == NULL);
 +					event_fetchdone = event;
 +					break;
 +				default:
 +					ISC_UNREACHABLE();
 +				}
 +				if (event_trystale != NULL &&
 +				    event_fetchdone != NULL)
 +				{
 +					break;
 +				}
 			}
 		}
 	}
 -	if (event != NULL) {
 -		etask = event->ev_sender;
 -		event->ev_sender = fctx;
 -		event->result = ISC_R_CANCELED;
 -		isc_task_sendanddetach(&etask, ISC_EVENT_PTR(&event));
 +
 +	/*
 +	 * The "trystale" event must be sent before the "fetchdone" event,
 +	 * because the latter clears the "recursing" query attribute, which is
 +	 * required by both events (handled by the same callback function).
 +	 */
 +	if (event_trystale != NULL) {
 +		isc_task_t *etask = event_trystale->ev_sender;
 +		event_trystale->ev_sender = fctx;
 +		event_trystale->result = ISC_R_CANCELED;
 +		isc_task_sendanddetach(&etask, ISC_EVENT_PTR(&event_trystale));
 	}
 +	if (event_fetchdone != NULL) {
 +		isc_task_t *etask = event_fetchdone->ev_sender;
 +		event_fetchdone->ev_sender = fctx;
 +		event_fetchdone->result = ISC_R_CANCELED;
 +		isc_task_sendanddetach(&etask, ISC_EVENT_PTR(&event_fetchdone));
 + 	}
 +
 	/*
 	 * The fctx continues running even if no fetches remain;
 	 * the answer is still cached.
 	 */
 -
 	UNLOCK(&res->buckets[fctx->bucketnum].lock);
 }
 diff --git a/lib/ns/query.c b/lib/ns/query.c
 index f66bab4..4f61374 100644
 --- a/lib/ns/query.c
 +++ b/lib/ns/query.c
@@ -6021,7 +6021,9 @@ fetch_callback(isc_task_t *task, isc_event_t *event) {
 	CTRACE(ISC_LOG_DEBUG(3), "fetch_callback");
 	if (event->ev_type == DNS_EVENT_TRYSTALE) {
 -		query_lookup_stale(client);
 +		if (devent->result != ISC_R_CANCELED) {
 +			query_lookup_stale(client);
 +		}
 		isc_event_free(ISC_EVENT_PTR(&event));
 		return;
 	}
 -- 
 2.39.1
--- a/SPECS/bind9.16.spec
+++ b/SPECS/bind9.16.spec
@ -57,7 +57,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind9.16
 License:  MPLv2.0
 Version:  9.16.23
-Release:  0.9%{?dist}
+Release:  0.14%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@ -111,6 +111,21 @@ Patch171:bind-9.11-tests-variants.patch
 Patch172:bind-9.16-CVE-2022-0396.patch
 Patch173:bind-9.16-CVE-2021-25220.patch
 Patch174:bind-9.16-CVE-2021-25220-test.patch
 Patch175:bind-9.16-CVE-2022-3080.patch
 Patch176:bind-9.16-CVE-2022-38177.patch
 Patch177:bind-9.16-CVE-2022-38178.patch
 # https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/6793
 # https://gitlab.isc.org/isc-projects/bind9/commit/bf2ea6d8525bfd96a84dad221ba9e004adb710a8
 Patch178:bind-9.16-CVE-2022-2795.patch
 # https://gitlab.isc.org/isc-projects/bind9/commit/82185f4f80d2fa39a4569f6740cb360ffff8f5c4
 Patch182: bind-9.16-CVE-2022-3094-1.patch
 Patch183: bind-9.16-CVE-2022-3094-2.patch
 Patch184: bind-9.16-CVE-2022-3094-3.patch
 Patch185: bind-9.16-CVE-2022-3094-test.patch
 # https://gitlab.isc.org/isc-projects/bind9/commit/ea79385990c564eb478c286c089ea7ed15520690
 Patch186: bind-9.16-CVE-2022-3736.patch
 # https://gitlab.isc.org/isc-projects/bind9/commit/b4a65aaea19762a3712932aa2270e8a833fbde22
 Patch187: bind-9.16-CVE-2022-3924.patch
 %{?systemd_ordering}
 Requires:       coreutils
@ -412,6 +427,16 @@ in HTML and PDF format.
 %patch172 -p1 -b .CVE-2022-0396
 %patch173 -p1 -b .CVE-2021-25220
 %patch174 -p1 -b .CVE-2021-25220-test
 %patch175 -p1 -b .CVE-2022-3080
 %patch176 -p1 -b .CVE-2022-38177
 %patch177 -p1 -b .CVE-2022-38178
 %patch178 -p1 -b .CVE-2022-2795
 %patch182 -p1 -b .CVE-2022-3094
 %patch183 -p1 -b .CVE-2022-3094
 %patch184 -p1 -b .CVE-2022-3094
 %patch185 -p1 -b .CVE-2022-3094-test
 %patch186 -p1 -b .CVE-2022-3736
 %patch187 -p1 -b .CVE-2022-3924
 %if %{with PKCS11}
 %patch135 -p1 -b .config-pkcs11
@ -1131,6 +1156,25 @@ fi;
 %endif
 %changelog
 * Sat Feb 25 2023 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-0.14
 - Handle subtle difference between upstream and rhel (CVE-2022-3094)
 * Wed Feb 08 2023 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-0.13
 - Prevent flooding with UPDATE requests (CVE-2022-3094)
 - Handle RRSIG queries when server-stale is active (CVE-2022-3736)
 - Fix crash when soft-quota is reached and serve-stale is active (CVE-2022-3924)
 * Tue Dec 20 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-0.12
 - Include bind9.16-dnssec-utils in public repository (#2115322)
 * Tue Oct 04 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-0.11
 - Bound the amount of work performed for delegations (CVE-2022-2795)
 * Thu Sep 22 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-0.10
 - Fix possible serve-stale related crash (CVE-2022-3080)
 - Fix memory leak in ECDSA verify processing (CVE-2022-38177)
 - Fix memory leak in EdDSA verify processing (CVE-2022-38178)
 * Mon Apr 11 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-0.9
 - Tighten cache protection against record from forwarders (CVE-2021-25220)
 - Include test of forwarders