From d494ea81506dcdc2ba9967853ac179245929b68b Mon Sep 17 00:00:00 2001
From: Fedor Vorobev <fvorobev@redhat.com>
Date: Thu, 6 Aug 2026 16:04:06 +0200
Subject: [PATCH] Update to 1.26.0

Resolves: RHEL-212799
Resolves: RHEL-212811
---
 sources                                    |  4 +-
 unbound-1.26.0-disabled-ipsecmod-fix.patch | 48 ++++++++++++++++++++++
 unbound.spec                               |  9 +++-
 3 files changed, 58 insertions(+), 3 deletions(-)
 create mode 100644 unbound-1.26.0-disabled-ipsecmod-fix.patch

diff --git a/sources b/sources
index e5856eb..e8b51b4 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (unbound-1.25.1.tar.gz) = a536ff1d9b637e4ffa46ab498919ddf089b4498e65c748748c4920a6da52e1f5bacfbba9ac1dc47798d168e2ea64a7ae7ea2a581464d1fcabae241a6e38c8d13
-SHA512 (unbound-1.25.1.tar.gz.asc) = 307ce54a35c47e19dda75154424fe8e35382605cb3541ab2c16f567e28c44cfcace5aa14ca8c18d272647b8ef70cfc75f51c27cb0587bc51bd82d074380825aa
+SHA512 (unbound-1.26.0.tar.gz) = d061a4fd89b83e9e2c122b4479547f86548856710c801df01ce0aff8f0b4df9a61760cb7418b8ba7c79d504e6af49d7affc480f0730890bc818709007a931efd
+SHA512 (unbound-1.26.0.tar.gz.asc) = 9df080db5b74faeed42b8d03ca420aa9c276677f77472b0c02408fe2ca8c09e83667f11ff3349d379c1710aebadd0ff5d684cb993b855511031eade41bd0cb28
diff --git a/unbound-1.26.0-disabled-ipsecmod-fix.patch b/unbound-1.26.0-disabled-ipsecmod-fix.patch
new file mode 100644
index 0000000..55148c8
--- /dev/null
+++ b/unbound-1.26.0-disabled-ipsecmod-fix.patch
@@ -0,0 +1,48 @@
+From f63771f3afe8a5d1f9bbb89030937e9393366dea Mon Sep 17 00:00:00 2001
+From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
+Date: Thu, 6 Aug 2026 09:46:18 +0200
+Subject: [PATCH] - Fix #1487: regression in 1.26.0, ipsecmod is now always
+ partly enabled.
+
+---
+ ipsecmod/ipsecmod.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/unbound-1.26.0/ipsecmod/ipsecmod.c b/unbound-1.26.0/ipsecmod/ipsecmod.c
+index d1c0d44..71b42f1 100644
+--- a/unbound-1.26.0/ipsecmod/ipsecmod.c
++++ b/unbound-1.26.0/ipsecmod/ipsecmod.c
+@@ -59,6 +59,11 @@
+ static int
+ ipsecmod_apply_cfg(struct ipsecmod_env* ipsecmod_env, struct config_file* cfg)
+ {
++	if(cfg->ipsecmod_whitelist &&
++		!ipsecmod_whitelist_apply_cfg(ipsecmod_env, cfg))
++		return 0;
++	if(!cfg->ipsecmod_enabled)
++		return 1;
+ 	if(!cfg->ipsecmod_hook || (cfg->ipsecmod_hook && !cfg->ipsecmod_hook[0])) {
+ 		log_err("ipsecmod: missing ipsecmod-hook.");
+ 		return 0;
+@@ -68,9 +73,6 @@ ipsecmod_apply_cfg(struct ipsecmod_env* ipsecmod_env, struct config_file* cfg)
+ 			cfg->ipsecmod_hook, strerror(errno));
+ 		return 0;
+ 	}
+-	if(cfg->ipsecmod_whitelist &&
+-		!ipsecmod_whitelist_apply_cfg(ipsecmod_env, cfg))
+-		return 0;
+ 	return 1;
+ }
+ 
+@@ -626,6 +628,8 @@ ipsecmod_inform_super(struct module_qstate* qstate, int id,
+ 		verbose(VERB_ALGO, "super has no ipsecmod state");
+ 		return;
+ 	}
++	if(!siq->enabled)
++		return;
+ 
+ 	if(qstate->return_msg) {
+ 		struct ub_packed_rrset_key* rrset_key = reply_find_answer_rrset(
+-- 
+2.55.0
+
diff --git a/unbound.spec b/unbound.spec
index 8eefbc9..66d4530 100644
--- a/unbound.spec
+++ b/unbound.spec
@@ -30,7 +30,7 @@
 
 Summary: Validating, recursive, and caching DNS(SEC) resolver
 Name: unbound
-Version: 1.25.1
+Version: 1.26.0
 Release: 1%{?extra_version:.%{extra_version}}%{?dist}
 License: BSD
 Url: https://nlnetlabs.nl/projects/unbound/
@@ -64,6 +64,10 @@ Source27: tmpfiles-unbound-libs.conf
 
 # Downstream configuration changes
 Patch1: unbound-fedora-config.patch
+# https://github.com/NLnetLabs/unbound/commit/8b33c5d7ffb82d442f3d19021588449cd6b02a17
+# Will likely be included in unbound-1.26.1.
+Patch2: unbound-1.26.0-disabled-ipsecmod-fix.patch
+
 
 BuildRequires: gcc
 BuildRequires: make
@@ -508,6 +512,9 @@ popd
 %{_prefix}/lib/dracut/modules.d/99unbound
 
 %changelog
+* Thu Aug 06 2026 Fedor Vorobev <fvorobev@redhat.com> - 1.26.0-1
+- Update to 1.26.0
+
 * Thu Jul 02 2026 Fedor Vorobev <fvorobev@redhat.com> - 1.25.1-1
 - Update to 1.25.1 (RHEL-187020)
 - Fixes 11 CVEs: 6 Important, 5 Moderate.