.bind9.16.metadata

@@ -1 +0,0 @@
-30cbd1f3e9d2d47d653498143334128aac1f8fc0 SOURCES/bind-9.16.23.tar.xz

.gitignore

@@ -1 +1,2 @@
 SOURCES/bind-9.16.23.tar.xz
+/bind-9.16.23.tar.xz

bind-9.11-feature-test-named.patch

@@ -1,4 +1,4 @@
-From e645046202006750f87531e21e3ff7c26fba3466 Mon Sep 17 00:00:00 2001
+From e9e7069ede766fa5c881517bdae74e2fc6682398 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Wed, 30 Jan 2019 14:37:17 +0100
 Subject: [PATCH] Create feature-test in source directory
@@ -6,16 +6,27 @@ Subject: [PATCH] Create feature-test in source directory
 Feature-test tool is used in system tests to test compiled in changes.
 Because we build more variants of named with different configuration,
 compile feature-test for each of them this way.
+
+Make gsstsig test supported
 ---
- bin/named/Makefile.in       | 12 +++++++++++-
+ bin/named/Makefile.in       | 14 ++++++++++++--
  bin/tests/system/conf.sh.in |  2 +-
- 2 files changed, 12 insertions(+), 2 deletions(-)
+ 2 files changed, 13 insertions(+), 3 deletions(-)
 
 diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
-index 37053a7..ed9add2 100644
+index debb906adc..dd894fe934 100644
 --- a/bin/named/Makefile.in
 +++ b/bin/named/Makefile.in
-@@ -91,7 +91,7 @@ NOSYMLIBS =	${NSLIBS} ${DNSLIBS} ${BIND9LIBS} \
+@@ -56,7 +56,7 @@ CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
+ 		${LIBXML2_CFLAGS} \
+ 		${MAXMINDDB_CFLAGS}
+ 
+-CDEFINES =      @CONTRIB_DLZ@
++CDEFINES =	@USE_GSSAPI@ @CONTRIB_DLZ@
+ 
+ CWARNINGS =
+ 
+@@ -93,7 +93,7 @@ NOSYMLIBS =	${NSLIBS} ${DNSLIBS} ${BIND9LIBS} \
  
  SUBDIRS =	unix
  
@@ -24,7 +35,7 @@ index 37053a7..ed9add2 100644
  
  GEOIP2LINKOBJS = geoip.@O@
  
-@@ -154,6 +154,16 @@ named@EXEEXT@: ${OBJS} ${DEPLIBS}
+@@ -156,6 +156,16 @@ named@EXEEXT@: ${OBJS} ${DEPLIBS}
  	export BASEOBJS="${OBJS} ${UOBJS}"; \
  	${FINALBUILDCMD}
  
@@ -42,10 +53,10 @@ index 37053a7..ed9add2 100644
  	rm -f ${TARGETS} ${OBJS}
  
 diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
-index 7934930..e84fde2 100644
+index 9a61622143..f69c5be334 100644
 --- a/bin/tests/system/conf.sh.in
 +++ b/bin/tests/system/conf.sh.in
-@@ -37,7 +37,7 @@ DELV=$TOP/bin/delv/delv
+@@ -38,7 +38,7 @@ DELV=$TOP/bin/delv/delv
  DIG=$TOP/bin/dig/dig
  DNSTAPREAD=$TOP/bin/tools/dnstap-read
  DSFROMKEY=$TOP/bin/dnssec/dnssec-dsfromkey
@@ -55,5 +66,5 @@ index 7934930..e84fde2 100644
  HOST=$TOP/bin/dig/host
  IMPORTKEY=$TOP/bin/dnssec/dnssec-importkey
 -- 
-2.26.2
+2.45.2
 

bind-9.16-CVE-2023-4408-test1.patch

@@ -0,0 +1,88 @@
+From d258422d3e653621ce6340ba9af0153f8d4e8c07 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
+Date: Sun, 11 Feb 2024 00:49:32 +0100
+Subject: [PATCH] Test case insensitive matching in isc_ht hash table
+ implementation
+
+The case insensitive matching in isc_ht was basically completely broken
+as only the hashvalue computation was case insensitive, but the key
+comparison was always case sensitive.
+
+Import only test part from upstream.
+
+(cherry picked from commit 175655b771fd17b06dfb8cfb29eaadf0f3b6a8b5)
+(cherry picked from upstream commit f493a8394102b0aeb101d5dc2f963004c8741175)
+---
+ lib/isc/tests/ht_test.c | 53 +++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 53 insertions(+)
+
+diff --git a/lib/isc/tests/ht_test.c b/lib/isc/tests/ht_test.c
+index 74d95c1..65502b5 100644
+--- a/lib/isc/tests/ht_test.c
++++ b/lib/isc/tests/ht_test.c
+@@ -334,9 +334,62 @@ isc_ht_iterator_test(void **state) {
+ 	test_ht_iterator();
+ }
+ 
++static void
++isc_ht_case(void **state) {
++	UNUSED(state);
++
++	isc_ht_t *ht = NULL;
++	void *f = NULL;
++	isc_result_t result = ISC_R_UNSET;
++
++	unsigned char lower[16] = { "test case" };
++	unsigned char same[16] = { "test case" };
++	unsigned char upper[16] = { "TEST CASE" };
++	unsigned char mixed[16] = { "tEsT CaSe" };
++
++	isc_ht_init(&ht, test_mctx, 8, ISC_HT_CASE_SENSITIVE);
++	assert_non_null(ht);
++
++	result = isc_ht_add(ht, lower, 16, (void *)lower);
++	assert_int_equal(result, ISC_R_SUCCESS);
++
++	result = isc_ht_add(ht, same, 16, (void *)same);
++	assert_int_equal(result, ISC_R_EXISTS);
++
++	result = isc_ht_add(ht, upper, 16, (void *)upper);
++	assert_int_equal(result, ISC_R_SUCCESS);
++
++	result = isc_ht_find(ht, mixed, 16, &f);
++	assert_int_equal(result, ISC_R_NOTFOUND);
++	assert_null(f);
++
++	isc_ht_destroy(&ht);
++	assert_null(ht);
++
++	isc_ht_init(&ht, test_mctx, 8, ISC_HT_CASE_INSENSITIVE);
++	assert_non_null(ht);
++
++	result = isc_ht_add(ht, lower, 16, (void *)lower);
++	assert_int_equal(result, ISC_R_SUCCESS);
++
++	result = isc_ht_add(ht, same, 16, (void *)same);
++	assert_int_equal(result, ISC_R_EXISTS);
++
++	result = isc_ht_add(ht, upper, 16, (void *)upper);
++	assert_int_equal(result, ISC_R_EXISTS);
++
++	result = isc_ht_find(ht, mixed, 16, &f);
++	assert_int_equal(result, ISC_R_SUCCESS);
++	assert_ptr_equal(f, &lower);
++
++	isc_ht_destroy(&ht);
++	assert_null(ht);
++}
++
+ int
+ main(void) {
+ 	const struct CMUnitTest tests[] = {
++		cmocka_unit_test(isc_ht_case),
+ 		cmocka_unit_test(isc_ht_20),
+ 		cmocka_unit_test(isc_ht_8),
+ 		cmocka_unit_test(isc_ht_1),
+-- 
+2.43.0
+

bind-9.16-CVE-2023-4408-test2.patch

@@ -0,0 +1,75 @@
+From aa1b0fc4b24d26233db30c85ae3609e54e9fa6d2 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
+Date: Sun, 11 Feb 2024 09:13:43 +0100
+Subject: [PATCH] Add a system test for mixed-case data for the same owner
+
+We were missing a test where a single owner name would have multiple
+types with a different case.  The generated RRSIGs and NSEC records will
+then have different case than the signed records and message parser have
+to cope with that and treat everything as the same owner.
+
+(cherry picked from commit a114042059ecbbc94ae0f604ca681323a75af480)
+(cherry picked from upstream commit b9c10a194da3358204f5ba7d91e55332db435614)
+---
+ bin/tests/system/dnssec/ns3/secure.example.db.in |  5 +++++
+ bin/tests/system/dnssec/ns3/sign.sh              |  4 +++-
+ bin/tests/system/dnssec/tests.sh                 | 15 +++++++++++++++
+ 3 files changed, 23 insertions(+), 1 deletion(-)
+
+diff --git a/bin/tests/system/dnssec/ns3/secure.example.db.in b/bin/tests/system/dnssec/ns3/secure.example.db.in
+index 27f2b24..599566e 100644
+--- a/bin/tests/system/dnssec/ns3/secure.example.db.in
++++ b/bin/tests/system/dnssec/ns3/secure.example.db.in
+@@ -45,3 +45,8 @@ rrsigonly		A	10.0.0.29
+ cnameandkey		CNAME	@
+ cnamenokey		CNAME	@
+ dnameandkey		DNAME	@
++
++mixedcase		A	10.0.0.30
++mixedCASE		TXT	"mixed case"
++MIXEDcase		AAAA	2002::
++mIxEdCaSe		LOC	37 52 56.788 N 121 54 55.02 W 1120m 10m 100m 10m
+diff --git a/bin/tests/system/dnssec/ns3/sign.sh b/bin/tests/system/dnssec/ns3/sign.sh
+index 80d412e..d94f382 100644
+--- a/bin/tests/system/dnssec/ns3/sign.sh
++++ b/bin/tests/system/dnssec/ns3/sign.sh
+@@ -86,7 +86,9 @@ keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone
+ 
+ cat "$infile" "$cnameandkey.key" "$dnameandkey.key" "$keyname.key" > "$zonefile"
+ 
+-"$SIGNER" -P -o "$zone" "$zonefile" > /dev/null
++"$SIGNER" -P -D -o "$zone" "$zonefile" >/dev/null
++cat "$zonefile" "$zonefile".signed >"$zonefile".tmp
++mv "$zonefile".tmp "$zonefile".signed
+ 
+ zone=bogus.example.
+ infile=bogus.example.db.in
+diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh
+index fe95c8d..0c03970 100644
+--- a/bin/tests/system/dnssec/tests.sh
++++ b/bin/tests/system/dnssec/tests.sh
+@@ -762,6 +762,21 @@ n=$((n+1))
+ test "$ret" -eq 0 || echo_i "failed"
+ status=$((status+ret))
+ 
++echo_i "checking mixed-case positive validation ($n)"
++ret=0
++for type in a txt aaaa loc; do
++  dig_with_opts +noauth mixedcase.secure.example. \
++    @10.53.0.3 $type >dig.out.$type.ns3.test$n || ret=1
++  dig_with_opts +noauth mixedcase.secure.example. \
++    @10.53.0.4 $type >dig.out.$type.ns4.test$n || ret=1
++  digcomp --lc dig.out.$type.ns3.test$n dig.out.$type.ns4.test$n || ret=1
++  grep "status: NOERROR" dig.out.$type.ns4.test$n >/dev/null || ret=1
++  grep "flags:.*ad.*QUERY" dig.out.$type.ns4.test$n >/dev/null || ret=1
++done
++n=$((n + 1))
++test "$ret" -eq 0 || echo_i "failed"
++status=$((status + ret))
++
+ echo_i "checking multi-stage positive validation NSEC/NSEC3 ($n)"
+ ret=0
+ dig_with_opts +noauth a.nsec3.example. \
+-- 
+2.43.0
+

bind-9.16-CVE-2023-50387.patch

@@ -0,0 +1,478 @@
+From c6e05ffc5fb784514ab54938867abaab41126c65 Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Mon, 12 Feb 2024 21:09:51 +0100
+Subject: [PATCH] Prevent increased CPU consumption in DNSSEC validator
+
+KeyTrap - Extreme CPU consumption in DNSSEC validator. Preparing an
+NSEC3 closest encloser proof can exhaust CPU resources.
+
+6322.	[security]	Specific DNS answers could cause a denial-of-service
+			condition due to DNS validation taking a long time.
+			(CVE-2023-50387) [GL #4424]
+
+Resolves: CVE-2023-50387 CVE-2023-50868
+---
+ lib/dns/dst_api.c               | 27 +++++++++----
+ lib/dns/include/dns/validator.h |  1 +
+ lib/dns/include/dst/dst.h       |  4 ++
+ lib/dns/resolver.c              |  4 +-
+ lib/dns/validator.c             | 67 +++++++++++++++------------------
+ lib/isc/include/isc/netmgr.h    |  3 ++
+ lib/isc/netmgr/netmgr-int.h     |  1 +
+ lib/isc/netmgr/netmgr.c         | 36 +++++++++++-------
+ lib/isc/netmgr/tcp.c            |  6 +--
+ lib/isc/netmgr/tcpdns.c         |  4 +-
+ lib/isc/netmgr/udp.c            |  6 +--
+ 11 files changed, 91 insertions(+), 68 deletions(-)
+
+diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c
+index 62600dd..3aafd7c 100644
+--- a/lib/dns/dst_api.c
++++ b/lib/dns/dst_api.c
+@@ -160,7 +160,8 @@ computeid(dst_key_t *key);
+ static isc_result_t
+ frombuffer(const dns_name_t *name, unsigned int alg, unsigned int flags,
+ 	   unsigned int protocol, dns_rdataclass_t rdclass,
+-	   isc_buffer_t *source, isc_mem_t *mctx, dst_key_t **keyp);
++	   isc_buffer_t *source, isc_mem_t *mctx, bool no_rdata,
++	   dst_key_t **keyp);
+ 
+ static isc_result_t
+ algorithm_status(unsigned int alg);
+@@ -745,6 +746,13 @@ dst_key_todns(const dst_key_t *key, isc_buffer_t *target) {
+ isc_result_t
+ dst_key_fromdns(const dns_name_t *name, dns_rdataclass_t rdclass,
+ 		isc_buffer_t *source, isc_mem_t *mctx, dst_key_t **keyp) {
++	return (dst_key_fromdns_ex(name, rdclass, source, mctx, false, keyp));
++}
++
++isc_result_t
++dst_key_fromdns_ex(const dns_name_t *name, dns_rdataclass_t rdclass,
++		   isc_buffer_t *source, isc_mem_t *mctx, bool no_rdata,
++		   dst_key_t **keyp) {
+ 	uint8_t alg, proto;
+ 	uint32_t flags, extflags;
+ 	dst_key_t *key = NULL;
+@@ -775,7 +783,7 @@ dst_key_fromdns(const dns_name_t *name, dns_rdataclass_t rdclass,
+ 	}
+ 
+ 	result = frombuffer(name, alg, flags, proto, rdclass, source, mctx,
+-			    &key);
++			    no_rdata, &key);
+ 	if (result != ISC_R_SUCCESS) {
+ 		return (result);
+ 	}
+@@ -796,7 +804,7 @@ dst_key_frombuffer(const dns_name_t *name, unsigned int alg, unsigned int flags,
+ 	REQUIRE(dst_initialized);
+ 
+ 	result = frombuffer(name, alg, flags, protocol, rdclass, source, mctx,
+-			    &key);
++			    false, &key);
+ 	if (result != ISC_R_SUCCESS) {
+ 		return (result);
+ 	}
+@@ -2288,7 +2296,8 @@ computeid(dst_key_t *key) {
+ static isc_result_t
+ frombuffer(const dns_name_t *name, unsigned int alg, unsigned int flags,
+ 	   unsigned int protocol, dns_rdataclass_t rdclass,
+-	   isc_buffer_t *source, isc_mem_t *mctx, dst_key_t **keyp) {
++	   isc_buffer_t *source, isc_mem_t *mctx, bool no_rdata,
++	   dst_key_t **keyp) {
+ 	dst_key_t *key;
+ 	isc_result_t ret;
+ 
+@@ -2313,10 +2322,12 @@ frombuffer(const dns_name_t *name, unsigned int alg, unsigned int flags,
+ 			return (DST_R_UNSUPPORTEDALG);
+ 		}
+ 
+-		ret = key->func->fromdns(key, source);
+-		if (ret != ISC_R_SUCCESS) {
+-			dst_key_free(&key);
+-			return (ret);
++		if (!no_rdata) {
++			ret = key->func->fromdns(key, source);
++			if (ret != ISC_R_SUCCESS) {
++				dst_key_free(&key);
++				return (ret);
++			}
+ 		}
+ 	}
+ 
+diff --git a/lib/dns/include/dns/validator.h b/lib/dns/include/dns/validator.h
+index 4744014..fe97e41 100644
+--- a/lib/dns/include/dns/validator.h
++++ b/lib/dns/include/dns/validator.h
+@@ -148,6 +148,7 @@ struct dns_validator {
+ 	unsigned int  authcount;
+ 	unsigned int  authfail;
+ 	isc_stdtime_t start;
++	bool	      failed;
+ };
+ 
+ /*%
+diff --git a/lib/dns/include/dst/dst.h b/lib/dns/include/dst/dst.h
+index f454ebb..36770b5 100644
+--- a/lib/dns/include/dst/dst.h
++++ b/lib/dns/include/dst/dst.h
+@@ -469,6 +469,10 @@ dst_key_tofile(const dst_key_t *key, int type, const char *directory);
+  */
+ 
+ isc_result_t
++dst_key_fromdns_ex(const dns_name_t *name, dns_rdataclass_t rdclass,
++		   isc_buffer_t *source, isc_mem_t *mctx, bool no_rdata,
++		   dst_key_t **keyp);
++isc_result_t
+ dst_key_fromdns(const dns_name_t *name, dns_rdataclass_t rdclass,
+ 		isc_buffer_t *source, isc_mem_t *mctx, dst_key_t **keyp);
+ /*%<
+diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
+index 7cbfbb2..be1d735 100644
+--- a/lib/dns/resolver.c
++++ b/lib/dns/resolver.c
+@@ -10613,8 +10613,8 @@ dns_resolver_create(dns_view_t *view, isc_taskmgr_t *taskmgr,
+ 		 * Since we have a pool of tasks we bind them to task queues
+ 		 * to spread the load evenly
+ 		 */
+-		result = isc_task_create_bound(taskmgr, 0,
+-					       &res->buckets[i].task, i);
++		result = isc_task_create_bound(
++			taskmgr, 0, &res->buckets[i].task, ISC_NM_TASK_SLOW(i));
+ 		if (result != ISC_R_SUCCESS) {
+ 			isc_mutex_destroy(&res->buckets[i].lock);
+ 			goto cleanup_buckets;
+diff --git a/lib/dns/validator.c b/lib/dns/validator.c
+index e54fc70..e416cc9 100644
+--- a/lib/dns/validator.c
++++ b/lib/dns/validator.c
+@@ -1098,8 +1098,8 @@ create_validator(dns_validator_t *val, dns_name_t *name, dns_rdatatype_t type,
+  * 'rdataset'.  If found, build a dst_key_t for it and point val->key at
+  * it.
+  *
+- * If val->key is already non-NULL, locate it in the rdataset and then
+- * search past it for the *next* key that could have signed 'siginfo', then
++ * If val->key is already non-NULL, start searching from the next position in
++ * 'rdataset' to find the *next* key that could have signed 'siginfo', then
+  * set val->key to that.
+  *
+  * Returns ISC_R_SUCCESS if a possible matching key has been found,
+@@ -1112,59 +1112,59 @@ select_signing_key(dns_validator_t *val, dns_rdataset_t *rdataset) {
+ 	isc_buffer_t b;
+ 	dns_rdata_t rdata = DNS_RDATA_INIT;
+ 	dst_key_t *oldkey = val->key;
+-	bool foundold;
++	bool no_rdata = false;
+ 
+ 	if (oldkey == NULL) {
+-		foundold = true;
++		result = dns_rdataset_first(rdataset);
+ 	} else {
+-		foundold = false;
++		dst_key_free(&oldkey);
+ 		val->key = NULL;
++		result = dns_rdataset_next(rdataset);
+ 	}
+-
+-	result = dns_rdataset_first(rdataset);
+ 	if (result != ISC_R_SUCCESS) {
+-		goto failure;
++		goto done;
+ 	}
++
+ 	do {
+ 		dns_rdataset_current(rdataset, &rdata);
+ 
+ 		isc_buffer_init(&b, rdata.data, rdata.length);
+ 		isc_buffer_add(&b, rdata.length);
+ 		INSIST(val->key == NULL);
+-		result = dst_key_fromdns(&siginfo->signer, rdata.rdclass, &b,
+-					 val->view->mctx, &val->key);
++		result = dst_key_fromdns_ex(&siginfo->signer, rdata.rdclass, &b,
++					    val->view->mctx, no_rdata,
++					    &val->key);
+ 		if (result == ISC_R_SUCCESS) {
+ 			if (siginfo->algorithm ==
+ 				    (dns_secalg_t)dst_key_alg(val->key) &&
+ 			    siginfo->keyid ==
+ 				    (dns_keytag_t)dst_key_id(val->key) &&
++			    (dst_key_flags(val->key) & DNS_KEYFLAG_REVOKE) ==
++				    0 &&
+ 			    dst_key_iszonekey(val->key))
+ 			{
+-				if (foundold) {
+-					/*
+-					 * This is the key we're looking for.
+-					 */
+-					return (ISC_R_SUCCESS);
+-				} else if (dst_key_compare(oldkey, val->key)) {
+-					foundold = true;
+-					dst_key_free(&oldkey);
++				if (no_rdata) {
++					/* Retry with full key */
++					dns_rdata_reset(&rdata);
++					dst_key_free(&val->key);
++					no_rdata = false;
++					continue;
+ 				}
++				/* This is the key we're looking for. */
++				goto done;
+ 			}
+ 			dst_key_free(&val->key);
+ 		}
+ 		dns_rdata_reset(&rdata);
+ 		result = dns_rdataset_next(rdataset);
++		no_rdata = true;
+ 	} while (result == ISC_R_SUCCESS);
+ 
++done:
+ 	if (result == ISC_R_NOMORE) {
+ 		result = ISC_R_NOTFOUND;
+ 	}
+ 
+-failure:
+-	if (oldkey != NULL) {
+-		dst_key_free(&oldkey);
+-	}
+-
+ 	return (result);
+ }
+ 
+@@ -1557,20 +1557,9 @@ validate_answer(dns_validator_t *val, bool resume) {
+ 			continue;
+ 		}
+ 
+-		do {
+-			isc_result_t tresult;
+-			vresult = verify(val, val->key, &rdata,
+-					 val->siginfo->keyid);
+-			if (vresult == ISC_R_SUCCESS) {
+-				break;
+-			}
+-
+-			tresult = select_signing_key(val, val->keyset);
+-			if (tresult != ISC_R_SUCCESS) {
+-				break;
+-			}
+-		} while (1);
++		vresult = verify(val, val->key, &rdata, val->siginfo->keyid);
+ 		if (vresult != ISC_R_SUCCESS) {
++			val->failed = true;
+ 			validator_log(val, ISC_LOG_DEBUG(3),
+ 				      "failed to verify rdataset");
+ 		} else {
+@@ -1607,9 +1596,13 @@ validate_answer(dns_validator_t *val, bool resume) {
+ 		} else {
+ 			validator_log(val, ISC_LOG_DEBUG(3),
+ 				      "verify failure: %s",
+-				      isc_result_totext(result));
++				      isc_result_totext(vresult));
+ 			resume = false;
+ 		}
++		if (val->failed) {
++			result = ISC_R_NOMORE;
++			break;
++		}
+ 	}
+ 	if (result != ISC_R_NOMORE) {
+ 		validator_log(val, ISC_LOG_DEBUG(3),
+diff --git a/lib/isc/include/isc/netmgr.h b/lib/isc/include/isc/netmgr.h
+index be9fd56..dfabdc8 100644
+--- a/lib/isc/include/isc/netmgr.h
++++ b/lib/isc/include/isc/netmgr.h
+@@ -455,6 +455,9 @@ isc_nm_tcpdnsconnect(isc_nm_t *mgr, isc_sockaddr_t *local, isc_sockaddr_t *peer,
+  * 'cb'.
+  */
+ 
++#define ISC_NM_TASK_SLOW_OFFSET -2
++#define ISC_NM_TASK_SLOW(i)	(ISC_NM_TASK_SLOW_OFFSET - 1 - i)
++
+ void
+ isc_nm_task_enqueue(isc_nm_t *mgr, isc_task_t *task, int threadid);
+ /*%<
+diff --git a/lib/isc/netmgr/netmgr-int.h b/lib/isc/netmgr/netmgr-int.h
+index f7b54f9..70bb32d 100644
+--- a/lib/isc/netmgr/netmgr-int.h
++++ b/lib/isc/netmgr/netmgr-int.h
+@@ -673,6 +673,7 @@ struct isc_nm {
+ #ifdef NETMGR_TRACE
+ 	ISC_LIST(isc_nmsocket_t) active_sockets;
+ #endif
++	int nlisteners;
+ };
+ 
+ typedef enum isc_nmsocket_type {
+diff --git a/lib/isc/netmgr/netmgr.c b/lib/isc/netmgr/netmgr.c
+index 0ed3182..898de41 100644
+--- a/lib/isc/netmgr/netmgr.c
++++ b/lib/isc/netmgr/netmgr.c
+@@ -269,31 +269,34 @@ isc__nm_winsock_destroy(void) {
+ #endif /* WIN32 */
+ 
+ static void
+-isc__nm_threadpool_initialize(uint32_t workers) {
++isc__nm_threadpool_initialize(uint32_t nworkers) {
+ 	char buf[11];
+ 	int r = uv_os_getenv("UV_THREADPOOL_SIZE", buf,
+ 			     &(size_t){ sizeof(buf) });
+ 	if (r == UV_ENOENT) {
+-		snprintf(buf, sizeof(buf), "%" PRIu32, workers);
++		snprintf(buf, sizeof(buf), "%" PRIu32, nworkers);
+ 		uv_os_setenv("UV_THREADPOOL_SIZE", buf);
+ 	}
+ }
+ 
+ void
+-isc__netmgr_create(isc_mem_t *mctx, uint32_t workers, isc_nm_t **netmgrp) {
++isc__netmgr_create(isc_mem_t *mctx, uint32_t nworkers, isc_nm_t **netmgrp) {
+ 	isc_nm_t *mgr = NULL;
+ 	char name[32];
+ 
+-	REQUIRE(workers > 0);
++	REQUIRE(nworkers > 0);
+ 
+ #ifdef WIN32
+ 	isc__nm_winsock_initialize();
+ #endif /* WIN32 */
+ 
+-	isc__nm_threadpool_initialize(workers);
++	isc__nm_threadpool_initialize(nworkers);
+ 
+ 	mgr = isc_mem_get(mctx, sizeof(*mgr));
+-	*mgr = (isc_nm_t){ .nworkers = workers };
++	*mgr = (isc_nm_t){
++		.nworkers = nworkers * 2,
++		.nlisteners = nworkers,
++	};
+ 
+ 	isc_mem_attach(mctx, &mgr->mctx);
+ 	isc_mutex_init(&mgr->lock);
+@@ -334,11 +337,12 @@ isc__netmgr_create(isc_mem_t *mctx, uint32_t workers, isc_nm_t **netmgrp) {
+ 	isc_mempool_associatelock(mgr->evpool, &mgr->evlock);
+ 	isc_mempool_setfillcount(mgr->evpool, 32);
+ 
+-	isc_barrier_init(&mgr->pausing, workers);
+-	isc_barrier_init(&mgr->resuming, workers);
++	isc_barrier_init(&mgr->pausing, mgr->nworkers);
++	isc_barrier_init(&mgr->resuming, mgr->nworkers);
+ 
+-	mgr->workers = isc_mem_get(mctx, workers * sizeof(isc__networker_t));
+-	for (size_t i = 0; i < workers; i++) {
++	mgr->workers = isc_mem_get(mctx,
++				   mgr->nworkers * sizeof(isc__networker_t));
++	for (int i = 0; i < mgr->nworkers; i++) {
+ 		int r;
+ 		isc__networker_t *worker = &mgr->workers[i];
+ 		*worker = (isc__networker_t){
+@@ -373,7 +377,7 @@ isc__netmgr_create(isc_mem_t *mctx, uint32_t workers, isc_nm_t **netmgrp) {
+ 		mgr->workers_running++;
+ 		isc_thread_create(nm_thread, &mgr->workers[i], &worker->thread);
+ 
+-		snprintf(name, sizeof(name), "isc-net-%04zu", i);
++		snprintf(name, sizeof(name), "isc-net-%04d", i);
+ 		isc_thread_setname(worker->thread, name);
+ 	}
+ 
+@@ -848,9 +852,15 @@ isc_nm_task_enqueue(isc_nm_t *nm, isc_task_t *task, int threadid) {
+ 	isc__networker_t *worker = NULL;
+ 
+ 	if (threadid == -1) {
+-		tid = (int)isc_random_uniform(nm->nworkers);
++		tid = (int)isc_random_uniform(nm->nlisteners);
++	} else if (threadid == ISC_NM_TASK_SLOW_OFFSET) {
++		tid = nm->nlisteners +
++		      (int)isc_random_uniform(nm->nworkers - nm->nlisteners);
++	} else if (threadid < ISC_NM_TASK_SLOW_OFFSET) {
++		tid = nm->nlisteners + (ISC_NM_TASK_SLOW(threadid) %
++					(nm->nworkers - nm->nlisteners));
+ 	} else {
+-		tid = threadid % nm->nworkers;
++		tid = threadid % nm->nlisteners;
+ 	}
+ 
+ 	worker = &nm->workers[tid];
+diff --git a/lib/isc/netmgr/tcp.c b/lib/isc/netmgr/tcp.c
+index 5cca9f5..83bd2e2 100644
+--- a/lib/isc/netmgr/tcp.c
++++ b/lib/isc/netmgr/tcp.c
+@@ -321,7 +321,7 @@ isc_nm_tcpconnect(isc_nm_t *mgr, isc_sockaddr_t *local, isc_sockaddr_t *peer,
+ 			isc__nm_connectcb(sock, req, result, false);
+ 		} else {
+ 			isc__nmsocket_clearcb(sock);
+-			sock->tid = isc_random_uniform(mgr->nworkers);
++			sock->tid = isc_random_uniform(mgr->nlisteners);
+ 			isc__nm_connectcb(sock, req, result, true);
+ 		}
+ 		atomic_store(&sock->closed, true);
+@@ -339,7 +339,7 @@ isc_nm_tcpconnect(isc_nm_t *mgr, isc_sockaddr_t *local, isc_sockaddr_t *peer,
+ 		isc__nm_put_netievent_tcpconnect(mgr, ievent);
+ 	} else {
+ 		atomic_init(&sock->active, false);
+-		sock->tid = isc_random_uniform(mgr->nworkers);
++		sock->tid = isc_random_uniform(mgr->nlisteners);
+ 		isc__nm_enqueue_ievent(&mgr->workers[sock->tid],
+ 				       (isc__netievent_t *)ievent);
+ 	}
+@@ -435,7 +435,7 @@ isc_nm_listentcp(isc_nm_t *mgr, isc_sockaddr_t *iface,
+ #if defined(WIN32)
+ 	sock->nchildren = 1;
+ #else
+-	sock->nchildren = mgr->nworkers;
++	sock->nchildren = mgr->nlisteners;
+ #endif
+ 	children_size = sock->nchildren * sizeof(sock->children[0]);
+ 	sock->children = isc_mem_get(mgr->mctx, children_size);
+diff --git a/lib/isc/netmgr/tcpdns.c b/lib/isc/netmgr/tcpdns.c
+index 188790c..7f13ab2 100644
+--- a/lib/isc/netmgr/tcpdns.c
++++ b/lib/isc/netmgr/tcpdns.c
+@@ -305,7 +305,7 @@ isc_nm_tcpdnsconnect(isc_nm_t *mgr, isc_sockaddr_t *local, isc_sockaddr_t *peer,
+ 		isc__nm_put_netievent_tcpdnsconnect(mgr, ievent);
+ 	} else {
+ 		atomic_init(&sock->active, false);
+-		sock->tid = isc_random_uniform(mgr->nworkers);
++		sock->tid = isc_random_uniform(mgr->nlisteners);
+ 		isc__nm_enqueue_ievent(&mgr->workers[sock->tid],
+ 				       (isc__netievent_t *)ievent);
+ 	}
+@@ -404,7 +404,7 @@ isc_nm_listentcpdns(isc_nm_t *mgr, isc_sockaddr_t *iface,
+ #if defined(WIN32)
+ 	sock->nchildren = 1;
+ #else
+-	sock->nchildren = mgr->nworkers;
++	sock->nchildren = mgr->nlisteners;
+ #endif
+ 	children_size = sock->nchildren * sizeof(sock->children[0]);
+ 	sock->children = isc_mem_get(mgr->mctx, children_size);
+diff --git a/lib/isc/netmgr/udp.c b/lib/isc/netmgr/udp.c
+index a91c425..f2e161c 100644
+--- a/lib/isc/netmgr/udp.c
++++ b/lib/isc/netmgr/udp.c
+@@ -126,7 +126,7 @@ isc_nm_listenudp(isc_nm_t *mgr, isc_sockaddr_t *iface, isc_nm_recv_cb_t cb,
+ 	uv_os_sock_t fd = -1;
+ 
+ 	/*
+-	 * We are creating mgr->nworkers duplicated sockets, one
++	 * We are creating mgr->nlisteners duplicated sockets, one
+ 	 * socket for each worker thread.
+ 	 */
+ 	sock = isc_mem_get(mgr->mctx, sizeof(isc_nmsocket_t));
+@@ -136,7 +136,7 @@ isc_nm_listenudp(isc_nm_t *mgr, isc_sockaddr_t *iface, isc_nm_recv_cb_t cb,
+ #if defined(WIN32)
+ 	sock->nchildren = 1;
+ #else
+-	sock->nchildren = mgr->nworkers;
++	sock->nchildren = mgr->nlisteners;
+ #endif
+ 
+ 	children_size = sock->nchildren * sizeof(sock->children[0]);
+@@ -795,7 +795,7 @@ isc_nm_udpconnect(isc_nm_t *mgr, isc_sockaddr_t *local, isc_sockaddr_t *peer,
+ 		isc__nm_put_netievent_udpconnect(mgr, event);
+ 	} else {
+ 		atomic_init(&sock->active, false);
+-		sock->tid = isc_random_uniform(mgr->nworkers);
++		sock->tid = isc_random_uniform(mgr->nlisteners);
+ 		isc__nm_enqueue_ievent(&mgr->workers[sock->tid],
+ 				       (isc__netievent_t *)event);
+ 	}
+-- 
+2.43.0
+

bind-9.16-CVE-2023-5517.patch

@@ -0,0 +1,111 @@
+From bef141d5795429cab745f29f7d080d1e2ea8f164 Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Mon, 12 Feb 2024 20:33:41 +0100
+Subject: [PATCH] Prevent assertion failure when nxdomain-redirect is used with
+ RFC 1918 reverse zones
+
+6316.	[security]	Specific queries could trigger an assertion check with
+			nxdomain-redirect enabled. (CVE-2023-5517) [GL #4281]
+---
+ lib/ns/query.c | 25 ++++++++++++-------------
+ 1 file changed, 12 insertions(+), 13 deletions(-)
+
+diff --git a/lib/ns/query.c b/lib/ns/query.c
+index 4fe3e30..cc1d179 100644
+--- a/lib/ns/query.c
++++ b/lib/ns/query.c
+@@ -453,10 +453,10 @@ static void
+ query_addnxrrsetnsec(query_ctx_t *qctx);
+ 
+ static isc_result_t
+-query_nxdomain(query_ctx_t *qctx, bool empty_wild);
++query_nxdomain(query_ctx_t *qctx, isc_result_t result);
+ 
+ static isc_result_t
+-query_redirect(query_ctx_t *qctx);
++query_redirect(query_ctx_t *qctx, isc_result_t result);
+ 
+ static isc_result_t
+ query_ncache(query_ctx_t *qctx, isc_result_t result);
+@@ -7262,8 +7262,7 @@ query_usestale(query_ctx_t *qctx, isc_result_t result) {
+  * result from the search.
+  */
+ static isc_result_t
+-query_gotanswer(query_ctx_t *qctx, isc_result_t res) {
+-	isc_result_t result = res;
++query_gotanswer(query_ctx_t *qctx, isc_result_t result) {
+ 	char errmsg[256];
+ 
+ 	CCTRACE(ISC_LOG_DEBUG(3), "query_gotanswer");
+@@ -7333,16 +7332,16 @@ root_key_sentinel:
+ 		return (query_nodata(qctx, DNS_R_NXRRSET));
+ 
+ 	case DNS_R_EMPTYWILD:
+-		return (query_nxdomain(qctx, true));
++		return (query_nxdomain(qctx, DNS_R_EMPTYWILD));
+ 
+ 	case DNS_R_NXDOMAIN:
+-		return (query_nxdomain(qctx, false));
++		return (query_nxdomain(qctx, DNS_R_NXDOMAIN));
+ 
+ 	case DNS_R_COVERINGNSEC:
+ 		return (query_coveringnsec(qctx));
+ 
+ 	case DNS_R_NCACHENXDOMAIN:
+-		result = query_redirect(qctx);
++		result = query_redirect(qctx, result);
+ 		if (result != ISC_R_COMPLETE) {
+ 			return (result);
+ 		}
+@@ -9155,10 +9154,10 @@ query_addnxrrsetnsec(query_ctx_t *qctx) {
+  * Handle NXDOMAIN and empty wildcard responses.
+  */
+ static isc_result_t
+-query_nxdomain(query_ctx_t *qctx, bool empty_wild) {
++query_nxdomain(query_ctx_t *qctx, isc_result_t result) {
+ 	dns_section_t section;
+ 	uint32_t ttl;
+-	isc_result_t result;
++	bool empty_wild = (result == DNS_R_EMPTYWILD);
+ 
+ 	CCTRACE(ISC_LOG_DEBUG(3), "query_nxdomain");
+ 
+@@ -9167,7 +9166,7 @@ query_nxdomain(query_ctx_t *qctx, bool empty_wild) {
+ 	INSIST(qctx->is_zone || REDIRECT(qctx->client));
+ 
+ 	if (!empty_wild) {
+-		result = query_redirect(qctx);
++		result = query_redirect(qctx, result);
+ 		if (result != ISC_R_COMPLETE) {
+ 			return (result);
+ 		}
+@@ -9253,7 +9252,7 @@ cleanup:
+  * redirecting, so query processing should continue past it.
+  */
+ static isc_result_t
+-query_redirect(query_ctx_t *qctx) {
++query_redirect(query_ctx_t *qctx, isc_result_t saved_result) {
+ 	isc_result_t result;
+ 
+ 	CCTRACE(ISC_LOG_DEBUG(3), "query_redirect");
+@@ -9294,7 +9293,7 @@ query_redirect(query_ctx_t *qctx) {
+ 		SAVE(qctx->client->query.redirect.rdataset, qctx->rdataset);
+ 		SAVE(qctx->client->query.redirect.sigrdataset,
+ 		     qctx->sigrdataset);
+-		qctx->client->query.redirect.result = DNS_R_NCACHENXDOMAIN;
++		qctx->client->query.redirect.result = saved_result;
+ 		dns_name_copynf(qctx->fname,
+ 				qctx->client->query.redirect.fname);
+ 		qctx->client->query.redirect.authoritative =
+@@ -9908,7 +9907,7 @@ query_coveringnsec(query_ctx_t *qctx) {
+ 	 * We now have the proof that we have an NXDOMAIN.  Apply
+ 	 * NXDOMAIN redirection if configured.
+ 	 */
+-	result = query_redirect(qctx);
++	result = query_redirect(qctx, DNS_R_COVERINGNSEC);
+ 	if (result != ISC_R_COMPLETE) {
+ 		redirected = true;
+ 		goto cleanup;
+-- 
+2.43.0
+

bind-9.16-CVE-2023-5679.patch

@@ -0,0 +1,37 @@
+From 61112d1ce39848e08ec133f280cf8f729cb70d16 Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Mon, 12 Feb 2024 20:41:43 +0100
+Subject: [PATCH] Prevent assertion failure if DNS64 and serve-stale is used
+
+Enabling both DNS64 and serve-stale may cause an assertion failure
+during recursive resolution.
+
+6317.	[security]	Restore DNS64 state when handling a serve-stale timeout.
+			(CVE-2023-5679) [GL #4334]
+
+Resolves: CVE-2023-5679
+---
+ lib/ns/query.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/lib/ns/query.c b/lib/ns/query.c
+index cc1d179..1993800 100644
+--- a/lib/ns/query.c
++++ b/lib/ns/query.c
+@@ -5983,6 +5983,13 @@ query_lookup_stale(ns_client_t *client) {
+ 	query_ctx_t qctx;
+ 
+ 	qctx_init(client, NULL, client->query.qtype, &qctx);
++	if (DNS64(client)) {
++		qctx.qtype = qctx.type = dns_rdatatype_a;
++		qctx.dns64 = true;
++	}
++	if (DNS64EXCLUDE(client)) {
++		qctx.dns64_exclude = true;
++	}
+ 	dns_db_attach(client->view->cachedb, &qctx.db);
+ 	client->query.attributes &= ~NS_QUERYATTR_RECURSIONOK;
+ 	client->query.dboptions |= DNS_DBFIND_STALETIMEOUT;
+-- 
+2.43.0
+

bind-9.16-CVE-2023-6516-test.patch

@@ -0,0 +1,52 @@
+From e91ab7758bed0cf3dcf8ed745f91063d7ec4011c Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Micha=C5=82=20K=C4=99pie=C5=84?= <michal@isc.org>
+Date: Thu, 4 Jan 2024 13:39:27 +0100
+Subject: [PATCH] Fix map offsets in the "masterformat" system test
+
+The "masterformat" system test attempts to check named-checkzone
+behavior when it is fed corrupt map-format zone files.  However, despite
+the RBTDB and RBT structures having evolved over the years, the offsets
+at which a valid map-format zone file is malformed by the "masterformat"
+test have not been updated accordingly, causing the relevant checks to
+introduce a different type of corruption than they were originally meant
+to cause:
+
+  - the "bad node header" check originally mangled the 'type' member of
+    the rdatasetheader_t structure for cname.example.nil,
+
+  - the "bad node data" check originally mangled the 'serial' and
+    'rdh_ttl' members of the rdatasetheader_t structure for
+    aaaa.example.nil.
+
+Update the offsets at which the map-format zone file is malformed at by
+the "masterformat" system test so that the relevant checks fulfill their
+original purpose again.
+---
+ bin/tests/system/masterformat/tests.sh | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/bin/tests/system/masterformat/tests.sh b/bin/tests/system/masterformat/tests.sh
+index 364a0d2..bb4e6ec 100755
+--- a/bin/tests/system/masterformat/tests.sh
++++ b/bin/tests/system/masterformat/tests.sh
+@@ -295,7 +295,7 @@ status=$((status+ret))
+ echo_i "checking corrupt map files fail to load (bad node header) ($n)"
+ ret=0
+ cp map.5 badmap
+-stomp badmap 2754 2 99
++stomp badmap 3706 2 99
+ $CHECKZONE -D -f map -F text -o text.5 example.nil badmap > /dev/null
+ [ $? = 1 ] || ret=1
+ n=$((n+1))
+@@ -305,7 +305,7 @@ status=$((status+ret))
+ echo_i "checking corrupt map files fail to load (bad node data) ($n)"
+ ret=0
+ cp map.5 badmap
+-stomp badmap 2897 5 127
++stomp badmap 3137 5 127
+ $CHECKZONE -D -f map -F text -o text.5 example.nil badmap > /dev/null
+ [ $? = 1 ] || ret=1
+ n=$((n+1))
+-- 
+2.44.0
+

bind-9.16-CVE-2023-6516.patch

@@ -0,0 +1,283 @@
+From 6e08fef24d7ba491228a4083ea0f0e33253a1043 Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Mon, 12 Feb 2024 20:48:57 +0100
+Subject: [PATCH] Specific recursive query patterns may lead to an
+ out-of-memory condition
+
+6319.	[security]	Query patterns that continuously triggered cache
+			database maintenance could exhaust all available memory
+			on the host running named. (CVE-2023-6516) [GL #4383]
+
+Resolves: CVE-2023-6516
+---
+ lib/dns/include/dns/rbt.h |   6 ++
+ lib/dns/mapapi            |   2 +-
+ lib/dns/rbt.c             |   1 +
+ lib/dns/rbtdb.c           | 149 +++++++++++++++++++++++++-------------
+ 4 files changed, 107 insertions(+), 51 deletions(-)
+
+diff --git a/lib/dns/include/dns/rbt.h b/lib/dns/include/dns/rbt.h
+index b67e602..69655b0 100644
+--- a/lib/dns/include/dns/rbt.h
++++ b/lib/dns/include/dns/rbt.h
+@@ -164,6 +164,12 @@ struct dns_rbtnode {
+ 	uint16_t       locknum; /* note that this is not in the bitfield */
+ 	isc_refcount_t references;
+ 	/*@}*/
++
++	/*%
++	 * This linked list is used to store nodes from which tree pruning can
++	 * be started.
++	 */
++	ISC_LINK(dns_rbtnode_t) prunelink;
+ };
+ 
+ typedef isc_result_t (*dns_rbtfindcallback_t)(dns_rbtnode_t *node,
+diff --git a/lib/dns/mapapi b/lib/dns/mapapi
+index 1b502d3..a46e190 100644
+--- a/lib/dns/mapapi
++++ b/lib/dns/mapapi
+@@ -13,4 +13,4 @@
+ # Whenever releasing a new major release of BIND9, set this value
+ # back to 1.0 when releasing the first alpha.  Map files are *never*
+ # compatible across major releases.
+-MAPAPI=3.0
++MAPAPI=4.0
+diff --git a/lib/dns/rbt.c b/lib/dns/rbt.c
+index 7f2c2d2..a220368 100644
+--- a/lib/dns/rbt.c
++++ b/lib/dns/rbt.c
+@@ -2283,6 +2283,7 @@ create_node(isc_mem_t *mctx, const dns_name_t *name, dns_rbtnode_t **nodep) {
+ 	HASHVAL(node) = 0;
+ 
+ 	ISC_LINK_INIT(node, deadlink);
++	ISC_LINK_INIT(node, prunelink);
+ 
+ 	LOCKNUM(node) = 0;
+ 	WILD(node) = 0;
+diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
+index 75f97f5..2707507 100644
+--- a/lib/dns/rbtdb.c
++++ b/lib/dns/rbtdb.c
+@@ -515,6 +515,10 @@ struct dns_rbtdb {
+ 	 */
+ 	rbtnodelist_t *deadnodes;
+ 
++	/* List of nodes from which recursive tree pruning can be started from.
++	 * Locked by tree_lock. */
++	rbtnodelist_t prunenodes;
++
+ 	/*
+ 	 * Heaps.  These are used for TTL based expiry in a cache,
+ 	 * or for zone resigning in a zone DB.  hmctx is the memory
+@@ -1060,6 +1064,7 @@ free_rbtdb(dns_rbtdb_t *rbtdb, bool log, isc_event_t *event) {
+ 	unsigned int i;
+ 	isc_result_t result;
+ 	char buf[DNS_NAME_FORMATSIZE];
++	dns_rbtnode_t *node = NULL;
+ 	dns_rbt_t **treep;
+ 	isc_time_t start;
+ 	dns_dbonupdatelistener_t *listener, *listener_next;
+@@ -1086,8 +1091,6 @@ free_rbtdb(dns_rbtdb_t *rbtdb, bool log, isc_event_t *event) {
+ 	 * the overhead of unlinking all nodes here should be negligible.
+ 	 */
+ 	for (i = 0; i < rbtdb->node_lock_count; i++) {
+-		dns_rbtnode_t *node;
+-
+ 		node = ISC_LIST_HEAD(rbtdb->deadnodes[i]);
+ 		while (node != NULL) {
+ 			ISC_LIST_UNLINK(rbtdb->deadnodes[i], node, deadlink);
+@@ -1095,6 +1098,12 @@ free_rbtdb(dns_rbtdb_t *rbtdb, bool log, isc_event_t *event) {
+ 		}
+ 	}
+ 
++	node = ISC_LIST_HEAD(rbtdb->prunenodes);
++	while (node != NULL) {
++		ISC_LIST_UNLINK(rbtdb->prunenodes, node, prunelink);
++		node = ISC_LIST_HEAD(rbtdb->prunenodes);
++	}
++
+ 	if (event == NULL) {
+ 		rbtdb->quantum = (rbtdb->task != NULL) ? 100 : 0;
+ 	}
+@@ -1934,19 +1943,32 @@ is_leaf(dns_rbtnode_t *node) {
+ 		node->left == NULL && node->right == NULL);
+ }
+ 
++/*%
++ * The tree lock must be held when this function is called as it reads and
++ * updates rbtdb->prunenodes.
++ */
+ static inline void
+ send_to_prune_tree(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
+ 		   isc_rwlocktype_t locktype) {
+-	isc_event_t *ev;
+-	dns_db_t *db;
++	bool pruning_queued = (ISC_LIST_HEAD(rbtdb->prunenodes) != NULL);
++
++	INSIST(locktype == isc_rwlocktype_write);
+ 
+-	ev = isc_event_allocate(rbtdb->common.mctx, NULL, DNS_EVENT_RBTPRUNE,
+-				prune_tree, node, sizeof(isc_event_t));
+ 	new_reference(rbtdb, node, locktype);
+-	db = NULL;
+-	attach((dns_db_t *)rbtdb, &db);
+-	ev->ev_sender = db;
+-	isc_task_send(rbtdb->task, &ev);
++	INSIST(!ISC_LINK_LINKED(node, prunelink));
++	ISC_LIST_APPEND(rbtdb->prunenodes, node, prunelink);
++
++	if (!pruning_queued) {
++		isc_event_t *ev = NULL;
++		dns_db_t *db = NULL;
++
++		attach((dns_db_t *)rbtdb, &db);
++
++		ev = isc_event_allocate(rbtdb->common.mctx, NULL,
++					DNS_EVENT_RBTPRUNE, prune_tree, db,
++					sizeof(isc_event_t));
++		isc_task_send(rbtdb->task, &ev);
++	}
+ }
+ 
+ /*%
+@@ -2220,17 +2242,26 @@ restore_locks:
+ }
+ 
+ /*
+- * Prune the tree by recursively cleaning-up single leaves.  In the worst
+- * case, the number of iteration is the number of tree levels, which is at
+- * most the maximum number of domain name labels, i.e, 127.  In practice, this
+- * should be much smaller (only a few times), and even the worst case would be
+- * acceptable for a single event.
++ * Prune the tree by recursively cleaning up single leaves.  Go through all
++ * nodes stored in the rbtdb->prunenodes list; for each of them, in the worst
++ * case, it will be necessary to traverse a number of tree levels equal to the
++ * maximum legal number of domain name labels (127); in practice, the number of
++ * tree levels to traverse will virtually always be much smaller (a few levels
++ * at most).  While holding the tree lock throughout this entire operation is
++ * less than ideal, so is splitting the latter up by queueing a separate
++ * prune_tree() run for each node to start pruning from (as queueing requires
++ * allocating memory and can therefore potentially be exploited to exhaust
++ * available memory).  Also note that actually freeing up the memory used by
++ * RBTDB nodes (which is what this function does) is essential to keeping cache
++ * memory use in check, so since the tree lock needs to be acquired anyway,
++ * freeing as many nodes as possible before the tree lock gets released is
++ * prudent.
+  */
+ static void
+ prune_tree(isc_task_t *task, isc_event_t *event) {
+-	dns_rbtdb_t *rbtdb = event->ev_sender;
+-	dns_rbtnode_t *node = event->ev_arg;
+-	dns_rbtnode_t *parent;
++	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)event->ev_arg;
++	dns_rbtnode_t *node = NULL;
++	dns_rbtnode_t *parent = NULL;
+ 	unsigned int locknum;
+ 
+ 	UNUSED(task);
+@@ -2238,44 +2269,60 @@ prune_tree(isc_task_t *task, isc_event_t *event) {
+ 	isc_event_free(&event);
+ 
+ 	RWLOCK(&rbtdb->tree_lock, isc_rwlocktype_write);
+-	locknum = node->locknum;
+-	NODE_LOCK(&rbtdb->node_locks[locknum].lock, isc_rwlocktype_write);
+-	do {
+-		parent = node->parent;
+-		decrement_reference(rbtdb, node, 0, isc_rwlocktype_write,
+-				    isc_rwlocktype_write, true);
+ 
+-		if (parent != NULL && parent->down == NULL) {
+-			/*
+-			 * node was the only down child of the parent and has
+-			 * just been removed.  We'll then need to examine the
+-			 * parent.  Keep the lock if possible; otherwise,
+-			 * release the old lock and acquire one for the parent.
+-			 */
+-			if (parent->locknum != locknum) {
+-				NODE_UNLOCK(&rbtdb->node_locks[locknum].lock,
+-					    isc_rwlocktype_write);
+-				locknum = parent->locknum;
+-				NODE_LOCK(&rbtdb->node_locks[locknum].lock,
+-					  isc_rwlocktype_write);
++	while ((node = ISC_LIST_HEAD(rbtdb->prunenodes)) != NULL) {
++		locknum = node->locknum;
++		NODE_LOCK(&rbtdb->node_locks[locknum].lock,
++			  isc_rwlocktype_write);
++		do {
++			if (ISC_LINK_LINKED(node, prunelink)) {
++				ISC_LIST_UNLINK(rbtdb->prunenodes, node,
++						prunelink);
+ 			}
+ 
+-			/*
+-			 * We need to gain a reference to the node before
+-			 * decrementing it in the next iteration.
+-			 */
+-			if (ISC_LINK_LINKED(parent, deadlink)) {
+-				ISC_LIST_UNLINK(rbtdb->deadnodes[locknum],
++			parent = node->parent;
++			decrement_reference(rbtdb, node, 0,
++					    isc_rwlocktype_write,
++					    isc_rwlocktype_write, true);
++
++			if (parent != NULL && parent->down == NULL) {
++				/*
++				 * node was the only down child of the parent
++				 * and has just been removed.  We'll then need
++				 * to examine the parent.  Keep the lock if
++				 * possible; otherwise, release the old lock and
++				 * acquire one for the parent.
++				 */
++				if (parent->locknum != locknum) {
++					NODE_UNLOCK(
++						&rbtdb->node_locks[locknum].lock,
++						isc_rwlocktype_write);
++					locknum = parent->locknum;
++					NODE_LOCK(
++						&rbtdb->node_locks[locknum].lock,
++						isc_rwlocktype_write);
++				}
++
++				/*
++				 * We need to gain a reference to the node
++				 * before decrementing it in the next iteration.
++				 */
++				if (ISC_LINK_LINKED(parent, deadlink)) {
++					ISC_LIST_UNLINK(
++						rbtdb->deadnodes[locknum],
+ 						parent, deadlink);
++				}
++				new_reference(rbtdb, parent,
++					      isc_rwlocktype_write);
++			} else {
++				parent = NULL;
+ 			}
+-			new_reference(rbtdb, parent, isc_rwlocktype_write);
+-		} else {
+-			parent = NULL;
+-		}
+ 
+-		node = parent;
+-	} while (node != NULL);
+-	NODE_UNLOCK(&rbtdb->node_locks[locknum].lock, isc_rwlocktype_write);
++			node = parent;
++		} while (node != NULL);
++		NODE_UNLOCK(&rbtdb->node_locks[locknum].lock,
++			    isc_rwlocktype_write);
++	}
+ 	RWUNLOCK(&rbtdb->tree_lock, isc_rwlocktype_write);
+ 
+ 	detach((dns_db_t **)&rbtdb);
+@@ -8726,6 +8773,8 @@ dns_rbtdb_create(isc_mem_t *mctx, const dns_name_t *origin, dns_dbtype_t type,
+ 		ISC_LIST_INIT(rbtdb->deadnodes[i]);
+ 	}
+ 
++	ISC_LIST_INIT(rbtdb->prunenodes);
++
+ 	rbtdb->active = rbtdb->node_lock_count;
+ 
+ 	for (i = 0; i < (int)(rbtdb->node_lock_count); i++) {
+-- 
+2.43.0
+

bind-9.16-CVE-2024-1737-records-test2.patch

@@ -0,0 +1,27 @@
+From 7bc5e5abf5a3cd66f11cc649b6ecf4c39c92bd9e Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Fri, 9 Aug 2024 12:32:20 +0200
+Subject: [PATCH] fixup! Add test for not-loading and not-transfering huge
+ RRSets
+
+---
+ bin/tests/system/conf.sh.common | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/bin/tests/system/conf.sh.common b/bin/tests/system/conf.sh.common
+index 9fab00f..e617595 100644
+--- a/bin/tests/system/conf.sh.common
++++ b/bin/tests/system/conf.sh.common
+@@ -301,6 +301,9 @@ DISABLED_ALGORITHM=ECDSAP384SHA384
+ DISABLED_ALGORITHM_NUMBER=14
+ DISABLED_BITS=384
+ 
++# Default HMAC algorithm.
++export DEFAULT_HMAC=hmac-sha256
++
+ #
+ # Useful functions in test scripts
+ #
+-- 
+2.45.2
+

bind-9.16-CVE-2024-1737-types.patch

@@ -0,0 +1,582 @@
+From a1c95d5fa479ac722f0cf758c494a37ffe1508c0 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
+Date: Sat, 25 May 2024 11:46:56 +0200
+Subject: [PATCH] Add a limit to the number of RR types for single name
+
+Previously, the number of RR types for a single owner name was limited
+only by the maximum number of the types (64k).  As the data structure
+that holds the RR types for the database node is just a linked list, and
+there are places where we just walk through the whole list (again and
+again), adding a large number of RR types for a single owner named with
+would slow down processing of such name (database node).
+
+Add a configurable limit to cap the number of the RR types for a single
+owner.  This is enforced at the database (rbtdb, qpzone, qpcache) level
+and configured with new max-types-per-name configuration option that
+can be configured globally, per-view and per-zone.
+
+(cherry picked from commit 00d16211d6368b99f070c1182d8c76b3798ca1db)
+(cherry picked from commit 89f1779bc28b27adbd00325b974ede7a683f8632)
+
+fix a memory leak that could occur when signing
+
+when signatures were not added because of too many types already
+existing at a node, the diff was not being cleaned up; this led to
+a memory leak being reported at shutdown.
+
+(cherry picked from commit 2825bdb1ae5be801e7ed603ba2455ed9a308f1f7)
+(cherry picked from commit a080317de0efb7f6ffa12415a863729d416007d5)
+
+Be smarter about refusing to add many RR types to the database
+
+Instead of outright refusing to add new RR types to the cache, be a bit
+smarter:
+
+1. If the new header type is in our priority list, we always add either
+   positive or negative entry at the beginning of the list.
+
+2. If the new header type is negative entry, and we are over the limit,
+   we mark it as ancient immediately, so it gets evicted from the cache
+   as soon as possible.
+
+3. Otherwise add the new header after the priority headers (or at the
+   head of the list).
+
+4. If we are over the limit, evict the last entry on the normal header
+   list.
+
+(cherry picked from commit 57cd34441a1b4ecc9874a4a106c2c95b8d7a3120)
+(cherry picked from commit 92a680a3ef708281267e4fd7b1e62b57c929447b)
+
+Log error when update fails
+
+The new "too many records" error can make an update fail without the
+error being logged. This commit fixes that.
+
+(cherry picked from commit 558923e5405894cf976d102f0d246a28bdbb400c)
+(cherry picked from commit d72adf4b927d83a2a0ff8e431b911ec1df7aeb88)
+---
+ bin/named/config.c                 |  1 +
+ bin/named/server.c                 |  9 +++++++++
+ bin/named/zoneconf.c               |  8 ++++++++
+ bin/tests/system/dyndb/driver/db.c |  3 ++-
+ doc/arm/reference.rst              | 12 ++++++++++++
+ lib/dns/cache.c                    | 12 ++++++++++++
+ lib/dns/db.c                       |  9 +++++++++
+ lib/dns/dnsrps.c                   |  3 ++-
+ lib/dns/ecdb.c                     |  3 ++-
+ lib/dns/include/dns/cache.h        |  6 ++++++
+ lib/dns/include/dns/db.h           | 11 +++++++++++
+ lib/dns/include/dns/view.h         |  7 +++++++
+ lib/dns/include/dns/zone.h         | 13 +++++++++++++
+ lib/dns/rbtdb.c                    | 28 +++++++++++++++++-----------
+ lib/dns/sdb.c                      |  3 ++-
+ lib/dns/sdlz.c                     |  3 ++-
+ lib/dns/view.c                     | 10 ++++++++++
+ lib/dns/zone.c                     | 16 ++++++++++++++++
+ lib/isccfg/namedconf.c             |  3 +++
+ lib/ns/update.c                    | 15 ++++++++++++---
+ 20 files changed, 156 insertions(+), 19 deletions(-)
+
+diff --git a/bin/named/config.c b/bin/named/config.c
+index 9cba6f588b..c9888ada65 100644
+--- a/bin/named/config.c
++++ b/bin/named/config.c
+@@ -218,6 +218,7 @@ options {\n\
+ 	max-records-per-type 100;\n\
+ 	max-refresh-time 2419200; /* 4 weeks */\n\
+ 	max-retry-time 1209600; /* 2 weeks */\n\
++	max-types-per-name 100;\n\
+ 	max-transfer-idle-in 60;\n\
+ 	max-transfer-idle-out 60;\n\
+ 	max-transfer-time-in 120;\n\
+diff --git a/bin/named/server.c b/bin/named/server.c
+index 7bf5f2664d..4cc69b54a1 100644
+--- a/bin/named/server.c
++++ b/bin/named/server.c
+@@ -5427,6 +5427,15 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
+ 	INSIST(result == ISC_R_SUCCESS);
+ 	dns_view_setmaxrrperset(view, cfg_obj_asuint32(obj));
+ 
++	/*
++	 * This is used for the cache and also as a default value
++	 * for zone databases.
++	 */
++	obj = NULL;
++	result = named_config_get(maps, "max-types-per-name", &obj);
++	INSIST(result == ISC_R_SUCCESS);
++	dns_view_setmaxtypepername(view, cfg_obj_asuint32(obj));
++
+ 	obj = NULL;
+ 	result = named_config_get(maps, "max-recursion-depth", &obj);
+ 	INSIST(result == ISC_R_SUCCESS);
+diff --git a/bin/named/zoneconf.c b/bin/named/zoneconf.c
+index ae5cc656ee..f6e8c64866 100644
+--- a/bin/named/zoneconf.c
++++ b/bin/named/zoneconf.c
+@@ -1100,6 +1100,14 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
+ 		dns_zone_setmaxrrperset(zone, 0);
+ 	}
+ 
++	obj = NULL;
++	result = named_config_get(maps, "max-types-per-name", &obj);
++	INSIST(result == ISC_R_SUCCESS && obj != NULL);
++	dns_zone_setmaxtypepername(mayberaw, cfg_obj_asuint32(obj));
++	if (zone != mayberaw) {
++		dns_zone_setmaxtypepername(zone, 0);
++	}
++
+ 	if (raw != NULL && filename != NULL) {
+ #define SIGNED ".signed"
+ 		size_t signedlen = strlen(filename) + sizeof(SIGNED);
+diff --git a/bin/tests/system/dyndb/driver/db.c b/bin/tests/system/dyndb/driver/db.c
+index 6725a3bacd..c95fc8212b 100644
+--- a/bin/tests/system/dyndb/driver/db.c
++++ b/bin/tests/system/dyndb/driver/db.c
+@@ -593,7 +593,8 @@ static dns_dbmethods_t sampledb_methods = {
+ 	NULL, /* getservestalerefresh */
+ 	NULL, /* setgluecachestats */
+ 	NULL, /* adjusthashsize */
+-	NULL  /* setmaxrrperset */
++	NULL, /* setmaxrrperset */
++	NULL  /* setmaxtypepername */
+ };
+ 
+ /* Auxiliary driver functions. */
+diff --git a/doc/arm/reference.rst b/doc/arm/reference.rst
+index b1983ef30d..a8a3c7911d 100644
+--- a/doc/arm/reference.rst
++++ b/doc/arm/reference.rst
+@@ -2902,6 +2902,18 @@ system.
+    a failure.  If set to 0, there is no cap on RRset size.  The default is
+    100.
+ 
++``max-types-per-name``
++   This sets the maximum number of resource record types that can be stored
++   for a single owner name in a database. When configured in ``options``
++   or ``view``, it controls the cache database, and also sets
++   the default value for zone databases, which can be overridden by setting
++   it at the ``zone`` level
++
++   If set to a positive value, any attempt to cache or to add to a zone an owner
++   name with more than the specified number of resource record types will result
++   in a failure.  If set to 0, there is no cap on RR types number.  The default is
++   100.
++   
+ ``recursive-clients``
+    This sets the maximum number (a "hard quota") of simultaneous recursive lookups
+    the server performs on behalf of clients. The default is
+diff --git a/lib/dns/cache.c b/lib/dns/cache.c
+index 9f0412dbe7..0b474fc313 100644
+--- a/lib/dns/cache.c
++++ b/lib/dns/cache.c
+@@ -150,6 +150,7 @@ struct dns_cache {
+ 	/* Access to the on-disk cache file is also locked by 'filelock'. */
+ 
+ 	uint32_t maxrrperset;
++	uint32_t maxtypepername;
+ };
+ 
+ /***
+@@ -178,6 +179,7 @@ cache_create_db(dns_cache_t *cache, dns_db_t **db) {
+ 	if (result == ISC_R_SUCCESS) {
+ 		dns_db_setservestalettl(*db, cache->serve_stale_ttl);
+ 	dns_db_setmaxrrperset(*db, cache->maxrrperset);
++	dns_db_setmaxtypepername(*db, cache->maxtypepername);
+ 	}
+ 	return (result);
+ }
+@@ -1290,6 +1292,16 @@ dns_cache_setmaxrrperset(dns_cache_t *cache, uint32_t value) {
+ 	}
+ }
+ 
++void
++dns_cache_setmaxtypepername(dns_cache_t *cache, uint32_t value) {
++	REQUIRE(VALID_CACHE(cache));
++
++	cache->maxtypepername = value;
++	if (cache->db != NULL) {
++		dns_db_setmaxtypepername(cache->db, value);
++	}
++}
++
+ /*
+  * XXX: Much of the following code has been copied in from statschannel.c.
+  * We should refactor this into a generic function in stats.c that can be
+diff --git a/lib/dns/db.c b/lib/dns/db.c
+index 8439265a7f..18583d41c2 100644
+--- a/lib/dns/db.c
++++ b/lib/dns/db.c
+@@ -1131,3 +1131,12 @@ dns_db_setmaxrrperset(dns_db_t *db, uint32_t value) {
+ 		(db->methods->setmaxrrperset)(db, value);
+ 	}
+ }
++
++void
++dns_db_setmaxtypepername(dns_db_t *db, uint32_t value) {
++	REQUIRE(DNS_DB_VALID(db));
++
++	if (db->methods->setmaxtypepername != NULL) {
++		(db->methods->setmaxtypepername)(db, value);
++	}
++}
+diff --git a/lib/dns/dnsrps.c b/lib/dns/dnsrps.c
+index 539090d1bd..e1a1b21a8b 100644
+--- a/lib/dns/dnsrps.c
++++ b/lib/dns/dnsrps.c
+@@ -971,7 +971,8 @@ static dns_dbmethods_t rpsdb_db_methods = {
+ 	NULL, /* getservestalerefresh */
+ 	NULL, /* setgluecachestats */
+ 	NULL, /* adjusthashsize */
+-	NULL  /* setmaxrrperset */
++	NULL, /* setmaxrrperset */
++	NULL  /* setmaxtypepername */
+ };
+ 
+ static dns_rdatasetmethods_t rpsdb_rdataset_methods = {
+diff --git a/lib/dns/ecdb.c b/lib/dns/ecdb.c
+index bab5da5503..27d03b4e3a 100644
+--- a/lib/dns/ecdb.c
++++ b/lib/dns/ecdb.c
+@@ -560,7 +560,8 @@ static dns_dbmethods_t ecdb_methods = {
+ 	NULL, /* getservestalerefresh */
+ 	NULL, /* setgluecachestats */
+ 	NULL, /* adjusthashsize */
+-	NULL  /* setmaxrrperset */
++	NULL, /* setmaxrrperset */
++	NULL  /* setmaxtypepername */
+ };
+ 
+ static isc_result_t
+diff --git a/lib/dns/include/dns/cache.h b/lib/dns/include/dns/cache.h
+index 3fa2a891e0..72de21600a 100644
+--- a/lib/dns/include/dns/cache.h
++++ b/lib/dns/include/dns/cache.h
+@@ -343,6 +343,12 @@ dns_cache_setmaxrrperset(dns_cache_t *cache, uint32_t value);
+  * Set the maximum resource records per RRSet that can be cached.
+  */
+ 
++void
++dns_cache_setmaxtypepername(dns_cache_t *cache, uint32_t value);
++/*%<
++ * Set the maximum resource record types per owner name that can be cached.
++ */
++
+ #ifdef HAVE_LIBXML2
+ int
+ dns_cache_renderxml(dns_cache_t *cache, void *writer0);
+diff --git a/lib/dns/include/dns/db.h b/lib/dns/include/dns/db.h
+index 732bfe473d..411881d48a 100644
+--- a/lib/dns/include/dns/db.h
++++ b/lib/dns/include/dns/db.h
+@@ -183,6 +183,7 @@ typedef struct dns_dbmethods {
+ 	isc_result_t (*setgluecachestats)(dns_db_t *db, isc_stats_t *stats);
+ 	isc_result_t (*adjusthashsize)(dns_db_t *db, size_t size);
+ 	void (*setmaxrrperset)(dns_db_t *db, uint32_t value);
++	void (*setmaxtypepername)(dns_db_t *db, uint32_t value);
+ } dns_dbmethods_t;
+ 
+ typedef isc_result_t (*dns_dbcreatefunc_t)(isc_mem_t	     *mctx,
+@@ -1791,6 +1792,16 @@ dns_db_setmaxrrperset(dns_db_t *db, uint32_t value);
+  * is nonzero, then any subsequent attempt to add an rdataset with
+  * more than 'value' RRs will return ISC_R_NOSPACE.
+  */
++
++void
++dns_db_setmaxtypepername(dns_db_t *db, uint32_t value);
++/*%<
++ * Set the maximum permissible number of RR types per owner name.
++ *
++ * If 'value' is nonzero, then any subsequent attempt to add an rdataset with a
++ * RR type that would exceed the number of already stored RR types will return
++ * ISC_R_NOSPACE.
++ */
+ ISC_LANG_ENDDECLS
+ 
+ #endif /* DNS_DB_H */
+diff --git a/lib/dns/include/dns/view.h b/lib/dns/include/dns/view.h
+index 0d502f4dd2..0a72f58e98 100644
+--- a/lib/dns/include/dns/view.h
++++ b/lib/dns/include/dns/view.h
+@@ -187,6 +187,7 @@ struct dns_view {
+ 	uint32_t	  fail_ttl;
+ 	dns_badcache_t   *failcache;
+ 	uint32_t	  maxrrperset;
++	uint32_t	  maxtypepername;
+ 
+ 	/*
+ 	 * Configurable data for server use only,
+@@ -1346,6 +1347,12 @@ dns_view_setmaxrrperset(dns_view_t *view, uint32_t value);
+  * Set the maximum resource records per RRSet that can be cached.
+  */
+ 
++void
++dns_view_setmaxtypepername(dns_view_t *view, uint32_t value);
++/*%<
++ * Set the maximum resource record types per owner name that can be cached.
++ */
++
+ ISC_LANG_ENDDECLS
+ 
+ #endif /* DNS_VIEW_H */
+diff --git a/lib/dns/include/dns/zone.h b/lib/dns/include/dns/zone.h
+index e902043357..6fca11f3fd 100644
+--- a/lib/dns/include/dns/zone.h
++++ b/lib/dns/include/dns/zone.h
+@@ -356,6 +356,19 @@ dns_zone_setmaxrrperset(dns_zone_t *zone, uint32_t maxrrperset);
+  *\li	void
+  */
+ 
++void
++dns_zone_setmaxtypepername(dns_zone_t *zone, uint32_t maxtypepername);
++/*%<
++ * 	Sets the maximum number of resource record types per owner name
++ *	permitted in a zone.  0 implies unlimited.
++ *
++ * Requires:
++ *\li	'zone' to be valid initialised zone.
++ *
++ * Returns:
++ *\li	void
++ */