diff --git a/server/bind/actions.py b/server/bind/actions.py index 88f1f7a240..124215ad65 100644 --- a/server/bind/actions.py +++ b/server/bind/actions.py @@ -20,13 +20,13 @@ shelltools.export("CPPFLAGS", "%s -DDIG_SIGCHASE" % get.CXXFLAGS()) def setup(): shelltools.makedirs("m4") # Fix PATHs in manpages - pisitools.dosed("bin/named/named.8", "/etc/named.conf", "/etc/bind/named.conf") - pisitools.dosed("bin/check/named-checkconf.8", "/etc/named.conf", "/etc/bind/named.conf") - pisitools.dosed("bin/rndc/rndc.8", "/etc/rndc.conf", "/etc/bind/rndc.conf") - pisitools.dosed("bin/rndc/rndc.8", "/etc/rndc.key", "/etc/bind/rndc.key") + # pisitools.dosed("bin/named/named.8", "/etc/named.conf", "/etc/bind/named.conf") + # pisitools.dosed("bin/check/named-checkconf.8", "/etc/named.conf", "/etc/bind/named.conf") + # pisitools.dosed("bin/rndc/rndc.8", "/etc/rndc.conf", "/etc/bind/rndc.conf") + # pisitools.dosed("bin/rndc/rndc.8", "/etc/rndc.key", "/etc/bind/rndc.key") # Adjust version - pisitools.dosed("version", "^RELEASEVER=.*$", "RELEASEVER=Pisi Linux-1.0") + # pisitools.dosed("version", "^RELEASEVER=.*$", "RELEASEVER=Pisi Linux-1.0") libtools.libtoolize("-cf") autotools.aclocal("-I m4") @@ -35,17 +35,26 @@ def setup(): autotools.configure("--localstatedir=/var \ --sysconfdir=/etc/bind \ --with-openssl \ - --with-libtool \ --with-pic \ - --with-randomdev=/dev/urandom \ --enable-linux-caps \ - --enable-threads \ --includedir=/usr/include/bind9 \ - --enable-ipv6 \ --enable-largefile \ --disable-static \ + --with-randomdev=/dev/urandom \ + --with-libtool \ + --enable-threads \ + --enable-ipv6 \ + --with-maxminddb \ + --with-tuning=large \ + --enable-fixed-rrset \ + --enable-full-report \ + --with-python=/usr/bin/python3 \ + NAMED_CONF=/etc/bind/named.conf \ + DRNDC_CONFFILE=/etc/bind/rndc.conf \ + DRNDC_KEYFILE=/etc/bind/rndc.key \ PYTHON=/usr/bin/python3") - + + pisitools.dosed("libtool", " -shared ", " -Wl,-O1,--as-needed -shared ") def build(): @@ -54,8 +63,10 @@ def build(): def install(): autotools.rawInstall("DESTDIR=%s" % get.installDIR()) + # pisitools.insinto("/etc/bind", "bin/tests/system/common/rndc.key") + # Prepare chroot jail - for d in ("dev", "etc/bind", "etc/pki/dnssec-keys", "lib/bind", "var/tmp", "var/log", "var/run/named", "var/named"): + for d in ("dev", "etc/bind", "etc/pki/dnssec-keys", "lib/bind", "var/tmp", "var/log", "var/run/named", "var/named", "etc/bind/rndc.key"): pisitools.dodir("%s/%s" % (CHROOT, d)) # At least drop a file in it @@ -73,7 +84,7 @@ def install(): pisitools.dosym(src, dest) # Documentation - pisitools.dodoc("CHANGES", "COPYRIGHT", "README") - pisitools.dodoc("doc/misc/*", "contrib/scripts/named-bootconf.sh", "contrib/scripts/nanny.pl") + pisitools.dodoc("CHANGES", "COPYRIGHT", "README*") + # pisitools.dodoc("doc/misc/*", "contrib/scripts/named-bootconf.sh", "contrib/scripts/nanny.pl") pisitools.dohtml("doc/arm/*") - pisitools.remove("/usr/share/doc/%s/Makefile*" % get.srcNAME()) + # pisitools.remove("/usr/share/doc/%s/Makefile*" % get.srcNAME()) diff --git a/server/bind/comar/bind_package.py b/server/bind/comar/bind_package.py index bdcf604da8..05d8047f72 100644 --- a/server/bind/comar/bind_package.py +++ b/server/bind/comar/bind_package.py @@ -16,8 +16,9 @@ directories = ("/var/named", \ def postInstall(fromVersion, fromRelease, toVersion, toRelease): if not os.path.exists("/etc/bind/rndc.key"): - os.system("/usr/sbin/rndc-confgen -r /dev/urandom -a -u named") + os.system("/usr/sbin/rndc-confgen -t /dev/urandom -a -u named") + # os.system("/usr/sbin/rndc-confgen -r /dev/urandom -a -u named") # Ownerships for d in directories: - os.system("chown %s:%s %s" % (UID, GID, d)) \ No newline at end of file + os.system("chown %s:%s %s" % (UID, GID, d)) diff --git a/server/bind/files/fedora/bind-9.11-fips-tests.patch b/server/bind/files/fedora/bind-9.11-fips-tests.patch new file mode 100644 index 0000000000..c02e8cc9fd --- /dev/null +++ b/server/bind/files/fedora/bind-9.11-fips-tests.patch @@ -0,0 +1,985 @@ +From 3446425cf03f2b5a7cbf6af47bd167f72e4135aa Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= +Date: Thu, 2 Aug 2018 23:46:45 +0200 +Subject: [PATCH] FIPS tests changes +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Squashed commit of the following: + +commit 09e5eb48698d4fef2fc1031870de86c553b6bfaa +Author: Petr Menšík +Date: Wed Mar 7 20:35:13 2018 +0100 + + Fix nsupdate test. Do not use md5 by default for rndc, skip gracefully md5 if not available. + +commit ab303db70082db76ecf36493d0b82ef3e8750cad +Author: Petr Menšík +Date: Wed Mar 7 18:11:10 2018 +0100 + + Changed root key to be RSASHA256 + + Change bad trusted key to be the same algorithm. + +commit 88ab07c0e14cc71247e1f9d11a1ea832b64c1ee8 +Author: Petr Menšík +Date: Wed Mar 7 16:56:17 2018 +0100 + + Change used key to not use hmac-md5 + + Fix upforwd test, do not use hmac-md5 + +commit aec891571626f053acfb4d0a247240cbc21a84e9 +Author: Petr Menšík +Date: Wed Mar 7 15:54:11 2018 +0100 + + Increase bitsize of DSA key to pass FIPS 140-2 mode. + +commit bca8e164fa0d9aff2f946b8b4eb0f1f7e0bf6696 +Author: Petr Menšík +Date: Wed Mar 7 15:41:08 2018 +0100 + + Fix tsig and rndc tests for disabled md5 + + Use hmac-sha256 instead of hmac-md5. + +commit 0d314c1ab6151aa13574a21ad22f28d3b7f42a67 +Author: Petr Menšík +Date: Wed Mar 7 13:21:00 2018 +0100 + + Add md5 availability detection to featuretest + +commit f389a918803e2853e4b55fed62765dc4a492e34f +Author: Petr Menšík +Date: Wed Mar 7 10:44:23 2018 +0100 + + Change tests to not use hmac-md5 algorithms if not required + + Use hmac-sha256 instead of default hmac-md5 for allow-query + +Use DEFAULT_HMAC configured variable +--- + bin/tests/system/acl/ns2/named1.conf.in | 4 +- + bin/tests/system/acl/ns2/named2.conf.in | 4 +- + bin/tests/system/acl/ns2/named3.conf.in | 6 +- + bin/tests/system/acl/ns2/named4.conf.in | 4 +- + bin/tests/system/acl/ns2/named5.conf.in | 4 +- + bin/tests/system/acl/tests.sh | 32 ++++----- + .../system/allow-query/ns2/named10.conf.in | 2 +- + .../system/allow-query/ns2/named11.conf.in | 4 +- + .../system/allow-query/ns2/named12.conf.in | 2 +- + .../system/allow-query/ns2/named30.conf.in | 2 +- + .../system/allow-query/ns2/named31.conf.in | 4 +- + .../system/allow-query/ns2/named32.conf.in | 2 +- + .../system/allow-query/ns2/named40.conf.in | 4 +- + bin/tests/system/allow-query/tests.sh | 18 ++--- + bin/tests/system/checkconf/bad-tsig.conf | 2 +- + bin/tests/system/checkconf/good.conf | 2 +- + bin/tests/system/cookie/ns1/named.conf.in | 2 +- + bin/tests/system/dnssec/ns4/named5.conf.in | 2 +- + bin/tests/system/feature-test.c | 14 ++++ + bin/tests/system/notify/ns5/named.conf.in | 6 +- + bin/tests/system/notify/tests.sh | 6 +- + bin/tests/system/nsupdate/ns1/named.conf.in | 2 +- + bin/tests/system/nsupdate/ns2/named.conf.in | 2 +- + bin/tests/system/nsupdate/ns9/named.conf.in | 2 +- + bin/tests/system/nsupdate/setup.sh | 6 +- + bin/tests/system/nsupdate/tests.sh | 9 ++- + bin/tests/system/rndc/ns2/named.conf.in | 2 +- + bin/tests/system/rndc/ns3/named.conf.in | 2 +- + bin/tests/system/rndc/setup.sh | 2 +- + bin/tests/system/rndc/tests.sh | 22 +++--- + bin/tests/system/tsig/ns1/named.conf.in | 10 +-- + bin/tests/system/tsig/ns1/rndc5.conf.in | 10 +++ + bin/tests/system/tsig/setup.sh | 5 ++ + bin/tests/system/tsig/tests.sh | 67 ++++++++++++------- + bin/tests/system/upforwd/ns1/named.conf.in | 2 +- + bin/tests/system/upforwd/tests.sh | 2 +- + 36 files changed, 161 insertions(+), 110 deletions(-) + create mode 100644 bin/tests/system/tsig/ns1/rndc5.conf.in + +diff --git a/bin/tests/system/acl/ns2/named1.conf.in b/bin/tests/system/acl/ns2/named1.conf.in +index 8787c6a..682ba97 100644 +--- a/bin/tests/system/acl/ns2/named1.conf.in ++++ b/bin/tests/system/acl/ns2/named1.conf.in +@@ -35,12 +35,12 @@ options { + }; + + key one { +- algorithm hmac-md5; ++ algorithm @DEFAULT_HMAC@; + secret "1234abcd8765"; + }; + + key two { +- algorithm hmac-md5; ++ algorithm @DEFAULT_HMAC@; + secret "1234abcd8765"; + }; + +diff --git a/bin/tests/system/acl/ns2/named2.conf.in b/bin/tests/system/acl/ns2/named2.conf.in +index a95b4c1..7b1cea6 100644 +--- a/bin/tests/system/acl/ns2/named2.conf.in ++++ b/bin/tests/system/acl/ns2/named2.conf.in +@@ -35,12 +35,12 @@ options { + }; + + key one { +- algorithm hmac-md5; ++ algorithm @DEFAULT_HMAC@; + secret "1234abcd8765"; + }; + + key two { +- algorithm hmac-md5; ++ algorithm @DEFAULT_HMAC@; + secret "1234abcd8765"; + }; + +diff --git a/bin/tests/system/acl/ns2/named3.conf.in b/bin/tests/system/acl/ns2/named3.conf.in +index 14cc3fe..6b35ba5 100644 +--- a/bin/tests/system/acl/ns2/named3.conf.in ++++ b/bin/tests/system/acl/ns2/named3.conf.in +@@ -35,17 +35,17 @@ options { + }; + + key one { +- algorithm hmac-md5; ++ algorithm @DEFAULT_HMAC@; + secret "1234abcd8765"; + }; + + key two { +- algorithm hmac-md5; ++ algorithm @DEFAULT_HMAC@; + secret "1234abcd8765"; + }; + + key three { +- algorithm hmac-md5; ++ algorithm @DEFAULT_HMAC@; + secret "1234abcd8765"; + }; + +diff --git a/bin/tests/system/acl/ns2/named4.conf.in b/bin/tests/system/acl/ns2/named4.conf.in +index 77cf110..b23a1ca 100644 +--- a/bin/tests/system/acl/ns2/named4.conf.in ++++ b/bin/tests/system/acl/ns2/named4.conf.in +@@ -35,12 +35,12 @@ options { + }; + + key one { +- algorithm hmac-md5; ++ algorithm @DEFAULT_HMAC@; + secret "1234abcd8765"; + }; + + key two { +- algorithm hmac-md5; ++ algorithm @DEFAULT_HMAC@; + secret "1234abcd8765"; + }; + +diff --git a/bin/tests/system/acl/ns2/named5.conf.in b/bin/tests/system/acl/ns2/named5.conf.in +index 5ccabf9..52791aa 100644 +--- a/bin/tests/system/acl/ns2/named5.conf.in ++++ b/bin/tests/system/acl/ns2/named5.conf.in +@@ -37,12 +37,12 @@ options { + }; + + key one { +- algorithm hmac-md5; ++ algorithm @DEFAULT_HMAC@; + secret "1234abcd8765"; + }; + + key two { +- algorithm hmac-md5; ++ algorithm @DEFAULT_HMAC@; + secret "1234abcd8765"; + }; + +diff --git a/bin/tests/system/acl/tests.sh b/bin/tests/system/acl/tests.sh +index ad98fa1..7a7ff4a 100644 +--- a/bin/tests/system/acl/tests.sh ++++ b/bin/tests/system/acl/tests.sh +@@ -23,14 +23,14 @@ echo_i "testing basic ACL processing" + # key "one" should fail + t=`expr $t + 1` + $DIG $DIGOPTS tsigzone. \ +- @10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 > dig.out.${t} ++ @10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t} + grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; } + + + # any other key should be fine + t=`expr $t + 1` + $DIG $DIGOPTS tsigzone. \ +- @10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t} ++ @10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t} + grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; } + + copy_setports ns2/named2.conf.in ns2/named.conf +@@ -40,18 +40,18 @@ sleep 5 + # prefix 10/8 should fail + t=`expr $t + 1` + $DIG $DIGOPTS tsigzone. \ +- @10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 > dig.out.${t} ++ @10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t} + grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; } + + # any other address should work, as long as it sends key "one" + t=`expr $t + 1` + $DIG $DIGOPTS tsigzone. \ +- @10.53.0.2 -b 127.0.0.1 axfr -y two:1234abcd8765 > dig.out.${t} ++ @10.53.0.2 -b 127.0.0.1 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t} + grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; } + + t=`expr $t + 1` + $DIG $DIGOPTS tsigzone. \ +- @10.53.0.2 -b 127.0.0.1 axfr -y one:1234abcd8765 > dig.out.${t} ++ @10.53.0.2 -b 127.0.0.1 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t} + grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; } + + echo_i "testing nested ACL processing" +@@ -63,31 +63,31 @@ sleep 5 + # should succeed + t=`expr $t + 1` + $DIG $DIGOPTS tsigzone. \ +- @10.53.0.2 -b 10.53.0.2 axfr -y two:1234abcd8765 > dig.out.${t} ++ @10.53.0.2 -b 10.53.0.2 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t} + grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; } + + # should succeed + t=`expr $t + 1` + $DIG $DIGOPTS tsigzone. \ +- @10.53.0.2 -b 10.53.0.2 axfr -y one:1234abcd8765 > dig.out.${t} ++ @10.53.0.2 -b 10.53.0.2 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t} + grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; } + + # should succeed + t=`expr $t + 1` + $DIG $DIGOPTS tsigzone. \ +- @10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t} ++ @10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t} + grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; } + + # should succeed + t=`expr $t + 1` + $DIG $DIGOPTS tsigzone. \ +- @10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t} ++ @10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t} + grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; } + + # but only one or the other should fail + t=`expr $t + 1` + $DIG $DIGOPTS tsigzone. \ +- @10.53.0.2 -b 127.0.0.1 axfr -y one:1234abcd8765 > dig.out.${t} ++ @10.53.0.2 -b 127.0.0.1 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t} + grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; } + + t=`expr $t + 1` +@@ -98,7 +98,7 @@ grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $tt failed" ; status=1 + # and other values? right out + t=`expr $t + 1` + $DIG $DIGOPTS tsigzone. \ +- @10.53.0.2 -b 127.0.0.1 axfr -y three:1234abcd8765 > dig.out.${t} ++ @10.53.0.2 -b 127.0.0.1 axfr -y hmac-sha256:three:1234abcd8765 > dig.out.${t} + grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; } + + # now we only allow 10.53.0.1 *and* key one, or 10.53.0.2 *and* key two +@@ -109,31 +109,31 @@ sleep 5 + # should succeed + t=`expr $t + 1` + $DIG $DIGOPTS tsigzone. \ +- @10.53.0.2 -b 10.53.0.2 axfr -y two:1234abcd8765 > dig.out.${t} ++ @10.53.0.2 -b 10.53.0.2 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t} + grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; } + + # should succeed + t=`expr $t + 1` + $DIG $DIGOPTS tsigzone. \ +- @10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 > dig.out.${t} ++ @10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t} + grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; } + + # should fail + t=`expr $t + 1` + $DIG $DIGOPTS tsigzone. \ +- @10.53.0.2 -b 10.53.0.2 axfr -y one:1234abcd8765 > dig.out.${t} ++ @10.53.0.2 -b 10.53.0.2 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t} + grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; } + + # should fail + t=`expr $t + 1` + $DIG $DIGOPTS tsigzone. \ +- @10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t} ++ @10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t} + grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; } + + # should fail + t=`expr $t + 1` + $DIG $DIGOPTS tsigzone. \ +- @10.53.0.2 -b 10.53.0.3 axfr -y one:1234abcd8765 > dig.out.${t} ++ @10.53.0.2 -b 10.53.0.3 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t} + grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; } + + echo_i "testing allow-query-on ACL processing" +diff --git a/bin/tests/system/allow-query/ns2/named10.conf.in b/bin/tests/system/allow-query/ns2/named10.conf.in +index b91d19a..ae485e8 100644 +--- a/bin/tests/system/allow-query/ns2/named10.conf.in ++++ b/bin/tests/system/allow-query/ns2/named10.conf.in +@@ -12,7 +12,7 @@ + */ + + key one { +- algorithm hmac-md5; ++ algorithm @DEFAULT_HMAC@; + secret "1234abcd8765"; + }; + +diff --git a/bin/tests/system/allow-query/ns2/named11.conf.in b/bin/tests/system/allow-query/ns2/named11.conf.in +index 308c4ca..8a5e806 100644 +--- a/bin/tests/system/allow-query/ns2/named11.conf.in ++++ b/bin/tests/system/allow-query/ns2/named11.conf.in +@@ -12,12 +12,12 @@ + */ + + key one { +- algorithm hmac-md5; ++ algorithm @DEFAULT_HMAC@; + secret "1234abcd8765"; + }; + + key two { +- algorithm hmac-md5; ++ algorithm @DEFAULT_HMAC@; + secret "1234efgh8765"; + }; + +diff --git a/bin/tests/system/allow-query/ns2/named12.conf.in b/bin/tests/system/allow-query/ns2/named12.conf.in +index 6b0fe55..a10c6d0 100644 +--- a/bin/tests/system/allow-query/ns2/named12.conf.in ++++ b/bin/tests/system/allow-query/ns2/named12.conf.in +@@ -12,7 +12,7 @@ + */ + + key one { +- algorithm hmac-md5; ++ algorithm @DEFAULT_HMAC@; + secret "1234abcd8765"; + }; + +diff --git a/bin/tests/system/allow-query/ns2/named30.conf.in b/bin/tests/system/allow-query/ns2/named30.conf.in +index aefc474..52981a7 100644 +--- a/bin/tests/system/allow-query/ns2/named30.conf.in ++++ b/bin/tests/system/allow-query/ns2/named30.conf.in +@@ -12,7 +12,7 @@ + */ + + key one { +- algorithm hmac-md5; ++ algorithm @DEFAULT_HMAC@; + secret "1234abcd8765"; + }; + +diff --git a/bin/tests/system/allow-query/ns2/named31.conf.in b/bin/tests/system/allow-query/ns2/named31.conf.in +index 27eccc2..f627870 100644 +--- a/bin/tests/system/allow-query/ns2/named31.conf.in ++++ b/bin/tests/system/allow-query/ns2/named31.conf.in +@@ -12,12 +12,12 @@ + */ + + key one { +- algorithm hmac-md5; ++ algorithm @DEFAULT_HMAC@; + secret "1234abcd8765"; + }; + + key two { +- algorithm hmac-md5; ++ algorithm @DEFAULT_HMAC@; + secret "1234efgh8765"; + }; + +diff --git a/bin/tests/system/allow-query/ns2/named32.conf.in b/bin/tests/system/allow-query/ns2/named32.conf.in +index adbb203..6fd516b 100644 +--- a/bin/tests/system/allow-query/ns2/named32.conf.in ++++ b/bin/tests/system/allow-query/ns2/named32.conf.in +@@ -12,7 +12,7 @@ + */ + + key one { +- algorithm hmac-md5; ++ algorithm @DEFAULT_HMAC@; + secret "1234abcd8765"; + }; + +diff --git a/bin/tests/system/allow-query/ns2/named40.conf.in b/bin/tests/system/allow-query/ns2/named40.conf.in +index 364f94b..de37915 100644 +--- a/bin/tests/system/allow-query/ns2/named40.conf.in ++++ b/bin/tests/system/allow-query/ns2/named40.conf.in +@@ -16,12 +16,12 @@ acl accept { 10.53.0.2; }; + acl badaccept { 10.53.0.1; }; + + key one { +- algorithm hmac-md5; ++ algorithm @DEFAULT_HMAC@; + secret "1234abcd8765"; + }; + + key two { +- algorithm hmac-md5; ++ algorithm @DEFAULT_HMAC@; + secret "1234efgh8765"; + }; + +diff --git a/bin/tests/system/allow-query/tests.sh b/bin/tests/system/allow-query/tests.sh +index 01a13cf..3711c63 100644 +--- a/bin/tests/system/allow-query/tests.sh ++++ b/bin/tests/system/allow-query/tests.sh +@@ -201,7 +201,7 @@ rndc_reload ns2 10.53.0.2 + + echo_i "test $n: key allowed - query allowed" + ret=0 +-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1 ++$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1 + grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1 + grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1 + if [ $ret != 0 ]; then echo_i "failed"; fi +@@ -214,7 +214,7 @@ rndc_reload ns2 10.53.0.2 + + echo_i "test $n: key not allowed - query refused" + ret=0 +-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1 ++$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1 + grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1 + grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1 + grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1 +@@ -228,7 +228,7 @@ rndc_reload ns2 10.53.0.2 + + echo_i "test $n: key disallowed - query refused" + ret=0 +-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1 ++$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1 + grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1 + grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1 + grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1 +@@ -367,7 +367,7 @@ rndc_reload ns2 10.53.0.2 + + echo_i "test $n: views key allowed - query allowed" + ret=0 +-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1 ++$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1 + grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1 + grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1 + if [ $ret != 0 ]; then echo_i "failed"; fi +@@ -380,7 +380,7 @@ rndc_reload ns2 10.53.0.2 + + echo_i "test $n: views key not allowed - query refused" + ret=0 +-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1 ++$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1 + grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1 + grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1 + grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1 +@@ -394,7 +394,7 @@ rndc_reload ns2 10.53.0.2 + + echo_i "test $n: views key disallowed - query refused" + ret=0 +-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1 ++$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1 + grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1 + grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1 + grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1 +@@ -534,7 +534,7 @@ status=`expr $status + $ret` + n=`expr $n + 1` + echo_i "test $n: zone key allowed - query allowed" + ret=0 +-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.keyallow.example a > dig.out.ns2.$n || ret=1 ++$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.keyallow.example a > dig.out.ns2.$n || ret=1 + grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1 + grep '^a.keyallow.example' dig.out.ns2.$n > /dev/null || ret=1 + if [ $ret != 0 ]; then echo_i "failed"; fi +@@ -544,7 +544,7 @@ status=`expr $status + $ret` + n=`expr $n + 1` + echo_i "test $n: zone key not allowed - query refused" + ret=0 +-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y two:1234efgh8765 a.keyallow.example a > dig.out.ns2.$n || ret=1 ++$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:two:1234efgh8765 a.keyallow.example a > dig.out.ns2.$n || ret=1 + grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1 + grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1 + grep '^a.keyallow.example' dig.out.ns2.$n > /dev/null && ret=1 +@@ -555,7 +555,7 @@ status=`expr $status + $ret` + n=`expr $n + 1` + echo_i "test $n: zone key disallowed - query refused" + ret=0 +-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.keydisallow.example a > dig.out.ns2.$n || ret=1 ++$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.keydisallow.example a > dig.out.ns2.$n || ret=1 + grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1 + grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1 + grep '^a.keydisallow.example' dig.out.ns2.$n > /dev/null && ret=1 +diff --git a/bin/tests/system/checkconf/bad-tsig.conf b/bin/tests/system/checkconf/bad-tsig.conf +index 4af25b0..9f202d5 100644 +--- a/bin/tests/system/checkconf/bad-tsig.conf ++++ b/bin/tests/system/checkconf/bad-tsig.conf +@@ -13,7 +13,7 @@ + + /* Bad secret */ + key "badtsig" { +- algorithm hmac-md5; ++ algorithm hmac-sha256; + secret "jEdD+BPKg=="; + }; + +diff --git a/bin/tests/system/checkconf/good.conf b/bin/tests/system/checkconf/good.conf +index 93939ff..3f78622 100644 +--- a/bin/tests/system/checkconf/good.conf ++++ b/bin/tests/system/checkconf/good.conf +@@ -280,6 +280,6 @@ dyndb "name" "library.so" { + system; + }; + key "mykey" { +- algorithm "hmac-md5"; ++ algorithm "hmac-sha256"; + secret "qwertyuiopasdfgh"; + }; +diff --git a/bin/tests/system/cookie/ns1/named.conf.in b/bin/tests/system/cookie/ns1/named.conf.in +index 1304303..e9c28c6 100644 +--- a/bin/tests/system/cookie/ns1/named.conf.in ++++ b/bin/tests/system/cookie/ns1/named.conf.in +@@ -18,7 +18,7 @@ key rndc_key { + + key foo { + secret "aaaaaaaaaaaa"; +- algorithm hmac-sha256; ++ algorithm @DEFAULT_HMAC@; + }; + + server 10.53.0.10 { +diff --git a/bin/tests/system/dnssec/ns4/named5.conf.in b/bin/tests/system/dnssec/ns4/named5.conf.in +index f1b817a..e457062 100644 +--- a/bin/tests/system/dnssec/ns4/named5.conf.in ++++ b/bin/tests/system/dnssec/ns4/named5.conf.in +@@ -35,5 +35,5 @@ controls { + + key auth { + secret "1234abcd8765"; +- algorithm hmac-sha256; ++ algorithm @DEFAULT_HMAC@; + }; +diff --git a/bin/tests/system/feature-test.c b/bin/tests/system/feature-test.c +index b1adaed..3942df6 100644 +--- a/bin/tests/system/feature-test.c ++++ b/bin/tests/system/feature-test.c +@@ -17,6 +17,7 @@ + #include + #include + ++#include + #include + #include + #include +@@ -143,6 +144,19 @@ main(int argc, char **argv) { + #endif + } + ++ if (strcmp(argv[1], "--md5") == 0) { ++ unsigned char digest[ISC_MAX_MD_SIZE]; ++ const unsigned char test[] = "test"; ++ unsigned int size = sizeof(digest); ++ ++ if (isc_md(ISC_MD_MD5, test, sizeof(test), ++ digest, &size) == ISC_R_SUCCESS) { ++ return (0); ++ } else { ++ return (1); ++ } ++ } ++ + if (strcmp(argv[1], "--ipv6only=no") == 0) { + #if defined(IPPROTO_IPV6) && defined(IPV6_V6ONLY) + int s; +diff --git a/bin/tests/system/notify/ns5/named.conf.in b/bin/tests/system/notify/ns5/named.conf.in +index 5cab276..c0492e1 100644 +--- a/bin/tests/system/notify/ns5/named.conf.in ++++ b/bin/tests/system/notify/ns5/named.conf.in +@@ -12,17 +12,17 @@ + */ + + key "a" { +- algorithm "hmac-md5"; ++ algorithm "@DEFAULT_HMAC@"; + secret "aaaaaaaaaaaaaaaaaaaa"; + }; + + key "b" { +- algorithm "hmac-md5"; ++ algorithm "@DEFAULT_HMAC@"; + secret "bbbbbbbbbbbbbbbbbbbb"; + }; + + key "c" { +- algorithm "hmac-md5"; ++ algorithm "@DEFAULT_HMAC@"; + secret "cccccccccccccccccccc"; + }; + +diff --git a/bin/tests/system/notify/tests.sh b/bin/tests/system/notify/tests.sh +index 706b7fc..2565ab4 100644 +--- a/bin/tests/system/notify/tests.sh ++++ b/bin/tests/system/notify/tests.sh +@@ -179,7 +179,7 @@ test_start "checking notify to multiple views using tsig" + $NSUPDATE << EOF + server 10.53.0.5 ${PORT} + zone x21 +-key a aaaaaaaaaaaaaaaaaaaa ++key hmac-sha256:a aaaaaaaaaaaaaaaaaaaa + update add added.x21 0 in txt "test string" + send + EOF +@@ -187,9 +187,9 @@ fnb="dig.out.b.ns5.test$n" + fnc="dig.out.c.ns5.test$n" + for i in 1 2 3 4 5 6 7 8 9 + do +- dig_plus_opts added.x21. -y b:bbbbbbbbbbbbbbbbbbbb @10.53.0.5 \ ++ dig_plus_opts added.x21. -y hmac-sha256:b:bbbbbbbbbbbbbbbbbbbb @10.53.0.5 \ + txt > "$fnb" || ret=1 +- dig_plus_opts added.x21. -y c:cccccccccccccccccccc @10.53.0.5 \ ++ dig_plus_opts added.x21. -y hmac-sha256:c:cccccccccccccccccccc @10.53.0.5 \ + txt > "$fnc" || ret=1 + grep "test string" "$fnb" > /dev/null && + grep "test string" "$fnc" > /dev/null && +diff --git a/bin/tests/system/nsupdate/ns1/named.conf.in b/bin/tests/system/nsupdate/ns1/named.conf.in +index 2b67360..a734584 100644 +--- a/bin/tests/system/nsupdate/ns1/named.conf.in ++++ b/bin/tests/system/nsupdate/ns1/named.conf.in +@@ -39,7 +39,7 @@ controls { + }; + + key altkey { +- algorithm hmac-md5; ++ algorithm hmac-sha512; + secret "1234abcd8765"; + }; + +diff --git a/bin/tests/system/nsupdate/ns2/named.conf.in b/bin/tests/system/nsupdate/ns2/named.conf.in +index c85eef5..428b6b1 100644 +--- a/bin/tests/system/nsupdate/ns2/named.conf.in ++++ b/bin/tests/system/nsupdate/ns2/named.conf.in +@@ -34,7 +34,7 @@ controls { + }; + + key altkey { +- algorithm hmac-md5; ++ algorithm hmac-sha512; + secret "1234abcd8765"; + }; + +diff --git a/bin/tests/system/nsupdate/ns9/named.conf.in b/bin/tests/system/nsupdate/ns9/named.conf.in +index 6a7ff88..0b70745 100644 +--- a/bin/tests/system/nsupdate/ns9/named.conf.in ++++ b/bin/tests/system/nsupdate/ns9/named.conf.in +@@ -32,7 +32,7 @@ key rndc_key { + + key subkey { + secret "1234abcd8765"; +- algorithm hmac-sha256; ++ algorithm @DEFAULT_HMAC@; + }; + + controls { +diff --git a/bin/tests/system/nsupdate/setup.sh b/bin/tests/system/nsupdate/setup.sh +index 50056dc..a4a1a3f 100644 +--- a/bin/tests/system/nsupdate/setup.sh ++++ b/bin/tests/system/nsupdate/setup.sh +@@ -72,7 +72,11 @@ EOF + + $TSIGKEYGEN ddns-key.example.nil > ns1/ddns.key + +-$TSIGKEYGEN -a hmac-md5 md5-key > ns1/md5.key ++if $FEATURETEST --md5; then ++ $TSIGKEYGEN -a hmac-md5 md5-key > ns1/md5.key ++else ++ echo -n > ns1/md5.key ++fi + $TSIGKEYGEN -a hmac-sha1 sha1-key > ns1/sha1.key + $TSIGKEYGEN -a hmac-sha224 sha224-key > ns1/sha224.key + $TSIGKEYGEN -a hmac-sha256 sha256-key > ns1/sha256.key +diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh +index d612a22..9f18e57 100755 +--- a/bin/tests/system/nsupdate/tests.sh ++++ b/bin/tests/system/nsupdate/tests.sh +@@ -841,7 +841,12 @@ fi + n=$((n + 1)) + ret=0 + echo_i "check TSIG key algorithms (nsupdate -k) ($n)" +-for alg in md5 sha1 sha224 sha256 sha384 sha512; do ++MD5ALG='md5' ++if ! $FEATURETEST --md5; then ++ MD5ALG='' ++ echo_i "skipping disabled md5 algorithm" ++fi ++for alg in $MD5ALG sha1 sha224 sha256 sha384 sha512; do + $NSUPDATE -k ns1/${alg}.key < /dev/null || ret=1 + server 10.53.0.1 ${PORT} + update add ${alg}.keytests.nil. 600 A 10.10.10.3 +@@ -849,7 +854,7 @@ send + END + done + sleep 2 +-for alg in md5 sha1 sha224 sha256 sha384 sha512; do ++for alg in $ALGS; do + $DIG $DIGOPTS +short @10.53.0.1 ${alg}.keytests.nil | grep 10.10.10.3 > /dev/null 2>&1 || ret=1 + done + if [ $ret -ne 0 ]; then +diff --git a/bin/tests/system/rndc/ns2/named.conf.in b/bin/tests/system/rndc/ns2/named.conf.in +index 117a5f4..be1af25 100644 +--- a/bin/tests/system/rndc/ns2/named.conf.in ++++ b/bin/tests/system/rndc/ns2/named.conf.in +@@ -27,7 +27,7 @@ key rndc_key { + + key secondkey { + secret "abcd1234abcd8765"; +- algorithm hmac-sha256; ++ algorithm @DEFAULT_HMAC@; + }; + + controls { +diff --git a/bin/tests/system/rndc/ns3/named.conf.in b/bin/tests/system/rndc/ns3/named.conf.in +index 3078e90..fd97ca2 100644 +--- a/bin/tests/system/rndc/ns3/named.conf.in ++++ b/bin/tests/system/rndc/ns3/named.conf.in +@@ -25,7 +25,7 @@ key rndc_key { + + key secondkey { + secret "abcd1234abcd8765"; +- algorithm hmac-sha256; ++ algorithm @DEFAULT_HMAC@; + }; + + controls { +diff --git a/bin/tests/system/rndc/setup.sh b/bin/tests/system/rndc/setup.sh +index 5f638ef..85d6b73 100644 +--- a/bin/tests/system/rndc/setup.sh ++++ b/bin/tests/system/rndc/setup.sh +@@ -47,7 +47,7 @@ make_key () { + sed 's/allow { 10.53.0.4/allow { any/' >> ns4/named.conf + } + +-make_key 1 ${EXTRAPORT1} hmac-md5 ++$FEATURETEST --md5 && make_key 1 ${EXTRAPORT1} hmac-md5 + make_key 2 ${EXTRAPORT2} hmac-sha1 + make_key 3 ${EXTRAPORT3} hmac-sha224 + make_key 4 ${EXTRAPORT4} hmac-sha256 +diff --git a/bin/tests/system/rndc/tests.sh b/bin/tests/system/rndc/tests.sh +index e68428c..acbeb52 100644 +--- a/bin/tests/system/rndc/tests.sh ++++ b/bin/tests/system/rndc/tests.sh +@@ -350,15 +350,19 @@ if [ $ret != 0 ]; then echo_i "failed"; fi + status=$((status+ret)) + + n=$((n+1)) +-echo_i "testing rndc with hmac-md5 ($n)" +-ret=0 +-$RNDC -s 10.53.0.4 -p ${EXTRAPORT1} -c ns4/key1.conf status > /dev/null 2>&1 || ret=1 +-for i in 2 3 4 5 6 +-do +- $RNDC -s 10.53.0.4 -p ${EXTRAPORT1} -c ns4/key${i}.conf status > /dev/null 2>&1 && ret=1 +-done +-if [ $ret != 0 ]; then echo_i "failed"; fi +-status=$((status+ret)) ++if $FEATURETEST --md5; then ++ echo_i "testing rndc with hmac-md5 ($n)" ++ ret=0 ++ $RNDC -s 10.53.0.4 -p ${EXTRAPORT1} -c ns4/key1.conf status > /dev/null 2>&1 || ret=1 ++ for i in 2 3 4 5 6 ++ do ++ $RNDC -s 10.53.0.4 -p ${EXTRAPORT1} -c ns4/key${i}.conf status > /dev/null 2>&1 && ret=1 ++ done ++ if [ $ret != 0 ]; then echo_i "failed"; fi ++ status=$((status+ret)) ++else ++ echo_i "skipping rndc with hmac-md5 ($n)" ++fi + + n=$((n+1)) + echo_i "testing rndc with hmac-sha1 ($n)" +diff --git a/bin/tests/system/tsig/ns1/named.conf.in b/bin/tests/system/tsig/ns1/named.conf.in +index 76cf970..22637af 100644 +--- a/bin/tests/system/tsig/ns1/named.conf.in ++++ b/bin/tests/system/tsig/ns1/named.conf.in +@@ -23,10 +23,7 @@ options { + notify no; + }; + +-key "md5" { +- secret "97rnFx24Tfna4mHPfgnerA=="; +- algorithm hmac-md5; +-}; ++# md5 key appended by setup.sh at the end + + key "sha1" { + secret "FrSt77yPTFx6hTs4i2tKLB9LmE0="; +@@ -53,10 +50,7 @@ key "sha512" { + algorithm hmac-sha512; + }; + +-key "md5-trunc" { +- secret "97rnFx24Tfna4mHPfgnerA=="; +- algorithm hmac-md5-80; +-}; ++# md5-trunc key appended by setup.sh at the end + + key "sha1-trunc" { + secret "FrSt77yPTFx6hTs4i2tKLB9LmE0="; +diff --git a/bin/tests/system/tsig/ns1/rndc5.conf.in b/bin/tests/system/tsig/ns1/rndc5.conf.in +new file mode 100644 +index 0000000..0682194 +--- /dev/null ++++ b/bin/tests/system/tsig/ns1/rndc5.conf.in +@@ -0,0 +1,10 @@ ++# Conditionally included when support for MD5 is available ++key "md5" { ++ secret "97rnFx24Tfna4mHPfgnerA=="; ++ algorithm hmac-md5; ++}; ++ ++key "md5-trunc" { ++ secret "97rnFx24Tfna4mHPfgnerA=="; ++ algorithm hmac-md5-80; ++}; +diff --git a/bin/tests/system/tsig/setup.sh b/bin/tests/system/tsig/setup.sh +index 34cc73b..d51ff21 100644 +--- a/bin/tests/system/tsig/setup.sh ++++ b/bin/tests/system/tsig/setup.sh +@@ -16,3 +16,8 @@ + $SHELL clean.sh + + copy_setports ns1/named.conf.in ns1/named.conf ++ ++if $FEATURETEST --md5 ++then ++ cat ns1/rndc5.conf.in >> ns1/named.conf ++fi +diff --git a/bin/tests/system/tsig/tests.sh b/bin/tests/system/tsig/tests.sh +index 1067227..ee05e83 100644 +--- a/bin/tests/system/tsig/tests.sh ++++ b/bin/tests/system/tsig/tests.sh +@@ -27,20 +27,25 @@ sha512="jI/Pa4qRu96t76Pns5Z/Ndxbn3QCkwcxLOgt9vgvnJw5wqTRvNyk3FtD6yIMd1dWVlqZ+Y4f + + status=0 + +-echo_i "fetching using hmac-md5 (old form)" +-ret=0 +-$DIG $DIGOPTS example.nil. -y "md5:$md5" @10.53.0.1 soa > dig.out.md5.old || ret=1 +-grep -i "md5.*TSIG.*NOERROR" dig.out.md5.old > /dev/null || ret=1 +-if [ $ret -eq 1 ] ; then +- echo_i "failed"; status=1 +-fi +- +-echo_i "fetching using hmac-md5 (new form)" +-ret=0 +-$DIG $DIGOPTS example.nil. -y "hmac-md5:md5:$md5" @10.53.0.1 soa > dig.out.md5.new || ret=1 +-grep -i "md5.*TSIG.*NOERROR" dig.out.md5.new > /dev/null || ret=1 +-if [ $ret -eq 1 ] ; then +- echo_i "failed"; status=1 ++if $FEATURETEST --md5 ++then ++ echo_i "fetching using hmac-md5 (old form)" ++ ret=0 ++ $DIG $DIGOPTS example.nil. -y "md5:$md5" @10.53.0.1 soa > dig.out.md5.old || ret=1 ++ grep -i "md5.*TSIG.*NOERROR" dig.out.md5.old > /dev/null || ret=1 ++ if [ $ret -eq 1 ] ; then ++ echo_i "failed"; status=1 ++ fi ++ ++ echo_i "fetching using hmac-md5 (new form)" ++ ret=0 ++ $DIG $DIGOPTS example.nil. -y "hmac-md5:md5:$md5" @10.53.0.1 soa > dig.out.md5.new || ret=1 ++ grep -i "md5.*TSIG.*NOERROR" dig.out.md5.new > /dev/null || ret=1 ++ if [ $ret -eq 1 ] ; then ++ echo_i "failed"; status=1 ++ fi ++else ++ echo_i "skipping using hmac-md5" + fi + + echo_i "fetching using hmac-sha1" +@@ -88,12 +93,17 @@ fi + # Truncated TSIG + # + # +-echo_i "fetching using hmac-md5 (trunc)" +-ret=0 +-$DIG $DIGOPTS example.nil. -y "hmac-md5-80:md5-trunc:$md5" @10.53.0.1 soa > dig.out.md5.trunc || ret=1 +-grep -i "md5-trunc.*TSIG.*NOERROR" dig.out.md5.trunc > /dev/null || ret=1 +-if [ $ret -eq 1 ] ; then +- echo_i "failed"; status=1 ++if $FEATURETEST --md5 ++then ++ echo_i "fetching using hmac-md5 (trunc)" ++ ret=0 ++ $DIG $DIGOPTS example.nil. -y "hmac-md5-80:md5-trunc:$md5" @10.53.0.1 soa > dig.out.md5.trunc || ret=1 ++ grep -i "md5-trunc.*TSIG.*NOERROR" dig.out.md5.trunc > /dev/null || ret=1 ++ if [ $ret -eq 1 ] ; then ++ echo_i "failed"; status=1 ++ fi ++else ++ echo_i "skipping using hmac-md5 (trunc)" + fi + + echo_i "fetching using hmac-sha1 (trunc)" +@@ -142,12 +152,17 @@ fi + # Check for bad truncation. + # + # +-echo_i "fetching using hmac-md5-80 (BADTRUNC)" +-ret=0 +-$DIG $DIGOPTS example.nil. -y "hmac-md5-80:md5:$md5" @10.53.0.1 soa > dig.out.md5-80 || ret=1 +-grep -i "md5.*TSIG.*BADTRUNC" dig.out.md5-80 > /dev/null || ret=1 +-if [ $ret -eq 1 ] ; then +- echo_i "failed"; status=1 ++if $FEATURETEST --md5 ++then ++ echo_i "fetching using hmac-md5-80 (BADTRUNC)" ++ ret=0 ++ $DIG $DIGOPTS example.nil. -y "hmac-md5-80:md5:$md5" @10.53.0.1 soa > dig.out.md5-80 || ret=1 ++ grep -i "md5.*TSIG.*BADTRUNC" dig.out.md5-80 > /dev/null || ret=1 ++ if [ $ret -eq 1 ] ; then ++ echo_i "failed"; status=1 ++ fi ++else ++ echo_i "skipping using hmac-md5-80 (BADTRUNC)" + fi + + echo_i "fetching using hmac-sha1-80 (BADTRUNC)" +diff --git a/bin/tests/system/upforwd/ns1/named.conf.in b/bin/tests/system/upforwd/ns1/named.conf.in +index c2b57dd..ea744f8 100644 +--- a/bin/tests/system/upforwd/ns1/named.conf.in ++++ b/bin/tests/system/upforwd/ns1/named.conf.in +@@ -12,7 +12,7 @@ + */ + + key "update.example." { +- algorithm "hmac-md5"; ++ algorithm "@DEFAULT_HMAC@"; + secret "c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K"; + }; + +diff -Nuar a/bin/tests/system/upforwd/tests.sh b/bin/tests/system/upforwd/tests.sh +--- a/bin/tests/system/upforwd/tests.sh 2023-01-13 01:21:15.238402000 +0300 ++++ b/bin/tests/system/upforwd/tests.sh 2023-01-26 15:22:00.879249456 +0300 +@@ -80,7 +80,7 @@ + + echo_i "updating zone (signed) ($n)" + ret=0 +-$NSUPDATE -y update.example:c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K -- - < +Date: Wed, 14 Sep 2022 13:06:24 +0200 +Subject: [PATCH] Disable some often failing tests + +Make those tests skipped in default build, when CI=true environment is +set. It is not clear why they fail mostly on COPR, but they do fail +often. +--- + tests/isc/netmgr_test.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/tests/isc/netmgr_test.c b/tests/isc/netmgr_test.c +index 94e4bf7..7f9629c 100644 +--- a/tests/isc/netmgr_test.c ++++ b/tests/isc/netmgr_test.c +@@ -1567,13 +1567,13 @@ stream_half_recv_half_send(void **state __attribute__((unused))) { + /* TCP */ + ISC_RUN_TEST_IMPL(tcp_noop) { stream_noop(state); } + +-ISC_RUN_TEST_IMPL(tcp_noresponse) { stream_noresponse(state); } ++ISC_RUN_TEST_IMPL(tcp_noresponse) { SKIP_IN_CI; stream_noresponse(state); } + + ISC_RUN_TEST_IMPL(tcp_timeout_recovery) { stream_timeout_recovery(state); } + + ISC_RUN_TEST_IMPL(tcp_recv_one) { stream_recv_one(state); } + +-ISC_RUN_TEST_IMPL(tcp_recv_two) { stream_recv_two(state); } ++ISC_RUN_TEST_IMPL(tcp_recv_two) { SKIP_IN_CI; stream_recv_two(state); } + + ISC_RUN_TEST_IMPL(tcp_recv_send) { + SKIP_IN_CI; +@@ -1623,6 +1623,7 @@ ISC_RUN_TEST_IMPL(tcp_recv_one_quota) { + } + + ISC_RUN_TEST_IMPL(tcp_recv_two_quota) { ++ SKIP_IN_CI; + atomic_store(&check_listener_quota, true); + stream_recv_two(state); + } +@@ -1836,6 +1837,7 @@ ISC_RUN_TEST_IMPL(tcpdns_recv_two) { + isc_result_t result = ISC_R_SUCCESS; + isc_nmsocket_t *listen_sock = NULL; + ++ SKIP_IN_CI; + atomic_store(&nsends, 2); + + result = isc_nm_listentcpdns(listen_nm, &tcp_listen_addr, +@@ -2095,6 +2097,7 @@ ISC_RUN_TEST_IMPL(tls_recv_one) { + } + + ISC_RUN_TEST_IMPL(tls_recv_two) { ++ SKIP_IN_CI; + stream_use_TLS = true; + stream_recv_two(state); + } +@@ -2160,6 +2163,7 @@ ISC_RUN_TEST_IMPL(tls_recv_one_quota) { + } + + ISC_RUN_TEST_IMPL(tls_recv_two_quota) { ++ SKIP_IN_CI; + stream_use_TLS = true; + atomic_store(&check_listener_quota, true); + stream_recv_two(state); +@@ -2395,6 +2399,7 @@ ISC_RUN_TEST_IMPL(tlsdns_recv_two) { + isc_result_t result = ISC_R_SUCCESS; + isc_nmsocket_t *listen_sock = NULL; + ++ SKIP_IN_CI; + atomic_store(&nsends, 2); + + result = isc_nm_listentlsdns(listen_nm, &tcp_listen_addr, +-- +2.37.2 + diff --git a/server/bind/files/fedora/bind-9.18-zt-include-rwlock.patch b/server/bind/files/fedora/bind-9.18-zt-include-rwlock.patch new file mode 100644 index 0000000000..ebe6a4fa4e --- /dev/null +++ b/server/bind/files/fedora/bind-9.18-zt-include-rwlock.patch @@ -0,0 +1,27 @@ +From 395d6fca2638129e1cc1f55ee4b3aa0dbba44dc0 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= +Date: Mon, 16 Jan 2023 11:45:31 +0100 +Subject: [PATCH] Include isc_rwlocktype_t type definition in zt.h + +After changes zt.h uses rwlock type, which is not enforced to be always +defined. Ensure full type definition is ready by including appropriate +header. +--- + lib/dns/include/dns/zt.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/lib/dns/include/dns/zt.h b/lib/dns/include/dns/zt.h +index 077b26ddea..037d0a9495 100644 +--- a/lib/dns/include/dns/zt.h ++++ b/lib/dns/include/dns/zt.h +@@ -18,6 +18,7 @@ + #include + + #include ++#include + + #include + +-- +2.39.0 + diff --git a/server/bind/files/fedora/bind-9.5-PIE.patch b/server/bind/files/fedora/bind-9.5-PIE.patch index a525b9b02d..1420cf3cf3 100644 --- a/server/bind/files/fedora/bind-9.5-PIE.patch +++ b/server/bind/files/fedora/bind-9.5-PIE.patch @@ -1,27 +1,17 @@ ---- bind-9.5.0b2/bin/named/Makefile.in.pie 2008-02-11 17:21:47.000000000 +0100 -+++ bind-9.5.0b2/bin/named/Makefile.in 2008-02-11 17:22:10.000000000 +0100 -@@ -100,8 +100,12 @@ HTMLPAGES = named.html lwresd.html named +diff --git a/bin/named/Makefile.am b/bin/named/Makefile.am +index 57a023b..085f2f7 100644 +--- a/bin/named/Makefile.am ++++ b/bin/named/Makefile.am +@@ -32,9 +32,12 @@ AM_CPPFLAGS += \ + endif HAVE_LIBXML2 - MANOBJS = ${MANPAGES} ${HTMLPAGES} + AM_CPPFLAGS += \ ++ -fpie \ + -DNAMED_LOCALSTATEDIR=\"${localstatedir}\" \ + -DNAMED_SYSCONFDIR=\"${sysconfdir}\" -+EXT_CFLAGS = -fpie ++AM_LDFLAGS += -pie -Wl,-z,relro,-z,now,-z,nodlopen,-z,noexecstack + - @BIND9_MAKE_RULES@ + sbin_PROGRAMS = named -+LDFLAGS += -pie -Wl,-z,relro,-z,now,-z,nodlopen,-z,noexecstack -+ - main.@O@: main.c - ${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} \ - -DVERSION=\"${VERSION}\" \ -diff -up bind-9.5.0b2/bin/named/unix/Makefile.in.pie bind-9.5.0b2/bin/named/unix/Makefile.in ---- bind-9.5.0b2/bin/named/unix/Makefile.in.pie 2008-02-11 17:22:21.000000000 +0100 -+++ bind-9.5.0b2/bin/named/unix/Makefile.in 2008-02-11 17:23:00.000000000 +0100 -@@ -19,6 +19,8 @@ srcdir = @srcdir@ - VPATH = @srcdir@ - top_srcdir = @top_srcdir@ - -+EXT_CFLAGS = -fpie -+ - @BIND9_MAKE_INCLUDES@ - - CINCLUDES = -I${srcdir}/include -I${srcdir}/../include \ + nodist_named_SOURCES = xsl.c diff --git a/server/bind/files/fedora/bind-9.5-parallel-build.patch b/server/bind/files/fedora/bind-9.5-parallel-build.patch deleted file mode 100644 index 53e34ca208..0000000000 --- a/server/bind/files/fedora/bind-9.5-parallel-build.patch +++ /dev/null @@ -1,14 +0,0 @@ -diff -up bind-9.5.0b1/lib/dns/Makefile.in.parallel bind-9.5.0b1/lib/dns/Makefile.in ---- bind-9.5.0b1/lib/dns/Makefile.in.parallel 2008-01-17 18:27:38.000000000 +0100 -+++ bind-9.5.0b1/lib/dns/Makefile.in 2008-01-17 18:27:45.000000000 +0100 -@@ -19,10 +19,6 @@ srcdir = @srcdir@ - VPATH = @srcdir@ - top_srcdir = @top_srcdir@ - --# Attempt to disable parallel processing. --.NOTPARALLEL: --.NO_PARALLEL: -- - @BIND9_VERSION@ - - @LIBDNS_API@ diff --git a/server/bind/files/fedora/bind-95-rh452060.patch b/server/bind/files/fedora/bind-95-rh452060.patch deleted file mode 100644 index 58808b0370..0000000000 --- a/server/bind/files/fedora/bind-95-rh452060.patch +++ /dev/null @@ -1,40 +0,0 @@ -diff -up bind-9.5.0-P2/bin/dig/dighost.c.rh452060 bind-9.5.0-P2/bin/dig/dighost.c ---- bind-9.5.0-P2/bin/dig/dighost.c.rh452060 2008-12-01 22:30:01.000000000 +0100 -+++ bind-9.5.0-P2/bin/dig/dighost.c 2008-12-01 22:30:07.000000000 +0100 -@@ -1280,6 +1280,12 @@ clear_query(dig_query_t *query) { - - debug("clear_query(%p)", query); - -+ if (query->waiting_senddone) { -+ debug("send_done not yet called"); -+ query->pending_free = ISC_TRUE; -+ return; -+ } -+ - lookup = query->lookup; - - if (lookup->current_query == query) -@@ -1301,10 +1307,7 @@ clear_query(dig_query_t *query) { - isc_mempool_put(commctx, query->recvspace); - isc_buffer_invalidate(&query->recvbuf); - isc_buffer_invalidate(&query->lengthbuf); -- if (query->waiting_senddone) -- query->pending_free = ISC_TRUE; -- else -- isc_mem_free(mctx, query); -+ isc_mem_free(mctx, query); - } - - /*% -@@ -2175,9 +2178,9 @@ send_done(isc_task_t *_task, isc_event_t - isc_event_free(&event); - - if (query->pending_free) -- isc_mem_free(mctx, query); -+ clear_query(query); - -- check_if_done(); -+ check_next_lookup(l); - UNLOCK_LOOKUP; - } - diff --git a/server/bind/files/fedora/bind-96-libtool2.patch b/server/bind/files/fedora/bind-96-libtool2.patch deleted file mode 100644 index 8ceba2f8b5..0000000000 --- a/server/bind/files/fedora/bind-96-libtool2.patch +++ /dev/null @@ -1,13 +0,0 @@ -diff -up bind-9.6.0b1/configure.in.libtool2 bind-9.6.0b1/configure.in ---- bind-9.6.0b1/configure.in.libtool2 2008-11-24 13:05:37.000000000 +0100 -+++ bind-9.6.0b1/configure.in 2008-11-24 13:05:56.000000000 +0100 -@@ -27,6 +27,8 @@ AC_CONFIG_SUBDIRS(lib/bind) - - AC_CONFIG_HEADER(config.h) - -+AC_CONFIG_MACRO_DIR([m4]) -+ - AC_CANONICAL_HOST - - AC_PROG_MAKE_SET -diff -up bind-9.6.0b1/Makefile.in.libtool2 bind-9.6.0b1/Makefile.in diff --git a/server/bind/files/fedora/bind-nonexec.patch b/server/bind/files/fedora/bind-nonexec.patch deleted file mode 100644 index 780ffed9d5..0000000000 --- a/server/bind/files/fedora/bind-nonexec.patch +++ /dev/null @@ -1,72 +0,0 @@ -diff -up bind-9.7.0rc2/lib/bind9/Makefile.in.nonexec bind-9.7.0rc2/lib/bind9/Makefile.in ---- bind-9.7.0rc2/lib/bind9/Makefile.in.nonexec 2009-12-06 00:31:40.000000000 +0100 -+++ bind-9.7.0rc2/lib/bind9/Makefile.in 2010-01-28 12:13:33.406696161 +0100 -@@ -78,7 +78,7 @@ installdirs: - $(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${libdir} - - install:: timestamp installdirs -- ${LIBTOOL_MODE_INSTALL} ${INSTALL_DATA} libbind9.@A@ ${DESTDIR}${libdir} -+ ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} libbind9.@A@ ${DESTDIR}${libdir} - - clean distclean:: - rm -f libbind9.@A@ timestamp -diff -up bind-9.7.0rc2/lib/dns/Makefile.in.nonexec bind-9.7.0rc2/lib/dns/Makefile.in ---- bind-9.7.0rc2/lib/dns/Makefile.in.nonexec 2009-12-06 00:31:40.000000000 +0100 -+++ bind-9.7.0rc2/lib/dns/Makefile.in 2010-01-28 12:13:33.406696161 +0100 -@@ -131,7 +131,7 @@ installdirs: - $(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${libdir} - - install:: timestamp installdirs -- ${LIBTOOL_MODE_INSTALL} ${INSTALL_DATA} libdns.@A@ ${DESTDIR}${libdir} -+ ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} libdns.@A@ ${DESTDIR}${libdir} - - clean distclean:: - rm -f libdns.@A@ timestamp -diff -up bind-9.7.0rc2/lib/isccc/Makefile.in.nonexec bind-9.7.0rc2/lib/isccc/Makefile.in ---- bind-9.7.0rc2/lib/isccc/Makefile.in.nonexec 2009-12-06 00:31:41.000000000 +0100 -+++ bind-9.7.0rc2/lib/isccc/Makefile.in 2010-01-28 12:13:33.406696161 +0100 -@@ -80,7 +80,7 @@ installdirs: - $(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${libdir} - - install:: timestamp installdirs -- ${LIBTOOL_MODE_INSTALL} ${INSTALL_DATA} libisccc.@A@ ${DESTDIR}${libdir} -+ ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} libisccc.@A@ ${DESTDIR}${libdir} - - clean distclean:: - rm -f libisccc.@A@ timestamp -diff -up bind-9.7.0rc2/lib/isccfg/Makefile.in.nonexec bind-9.7.0rc2/lib/isccfg/Makefile.in ---- bind-9.7.0rc2/lib/isccfg/Makefile.in.nonexec 2009-12-06 00:31:41.000000000 +0100 -+++ bind-9.7.0rc2/lib/isccfg/Makefile.in 2010-01-28 12:13:33.406696161 +0100 -@@ -77,7 +77,7 @@ installdirs: - $(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${libdir} - - install:: timestamp installdirs -- ${LIBTOOL_MODE_INSTALL} ${INSTALL_DATA} libisccfg.@A@ ${DESTDIR}${libdir} -+ ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} libisccfg.@A@ ${DESTDIR}${libdir} - - clean distclean:: - rm -f libisccfg.@A@ timestamp -diff -up bind-9.7.0rc2/lib/isc/Makefile.in.nonexec bind-9.7.0rc2/lib/isc/Makefile.in ---- bind-9.7.0rc2/lib/isc/Makefile.in.nonexec 2009-12-18 05:09:55.000000000 +0100 -+++ bind-9.7.0rc2/lib/isc/Makefile.in 2010-01-28 12:13:53.566696766 +0100 -@@ -121,7 +121,7 @@ installdirs: - $(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${libdir} - - install:: timestamp installdirs -- ${LIBTOOL_MODE_INSTALL} ${INSTALL_DATA} libisc.@A@ ${DESTDIR}${libdir} -+ ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} libisc.@A@ ${DESTDIR}${libdir} - - clean distclean:: - rm -f libisc.@A@ libisc-nosymtbl.@A@ libisc.la \ -diff -up bind-9.7.0rc2/lib/lwres/Makefile.in.nonexec bind-9.7.0rc2/lib/lwres/Makefile.in ---- bind-9.7.0rc2/lib/lwres/Makefile.in.nonexec 2007-06-20 01:47:22.000000000 +0200 -+++ bind-9.7.0rc2/lib/lwres/Makefile.in 2010-01-28 12:13:33.406696161 +0100 -@@ -78,7 +78,7 @@ installdirs: - $(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${libdir} - - install:: timestamp installdirs -- ${LIBTOOL_MODE_INSTALL} ${INSTALL_DATA} liblwres.@A@ ${DESTDIR}${libdir} -+ ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} liblwres.@A@ ${DESTDIR}${libdir} - - clean distclean:: - rm -f liblwres.@A@ liblwres.la timestamp diff --git a/server/bind/files/fedora/bind93-rh490837.patch b/server/bind/files/fedora/bind93-rh490837.patch deleted file mode 100644 index 230d7a707d..0000000000 --- a/server/bind/files/fedora/bind93-rh490837.patch +++ /dev/null @@ -1,95 +0,0 @@ -? patch -? lib/isc/lex.c.rh490837 -Index: lib/isc/lex.c -=================================================================== -RCS file: /var/snap/bind9/lib/isc/lex.c,v -retrieving revision 1.86 -diff -p -u -r1.86 lex.c ---- lib/isc/lex.c 17 Sep 2007 09:56:29 -0000 1.86 -+++ lib/isc/lex.c 6 Apr 2009 13:24:15 -0000 -@@ -425,17 +425,14 @@ isc_lex_gettoken(isc_lex_t *lex, unsigne - if (source->is_file) { - stream = source->input; - --#if defined(HAVE_FLOCKFILE) && defined(HAVE_GETCUNLOCKED) -- c = getc_unlocked(stream); --#else -- c = getc(stream); --#endif -- if (c == EOF) { -- if (ferror(stream)) { -- source->result = ISC_R_IOERROR; -- result = source->result; -+ result = isc_stdio_fgetc(stream, &c); -+ -+ if (result != ISC_R_SUCCESS) { -+ if (result != ISC_R_EOF) { -+ source->result = result; - goto done; - } -+ - source->at_eof = ISC_TRUE; - } - } else { -Index: lib/isc/include/isc/stdio.h -=================================================================== -RCS file: /var/snap/bind9/lib/isc/include/isc/stdio.h,v -retrieving revision 1.13 -diff -p -u -r1.13 stdio.h ---- lib/isc/include/isc/stdio.h 19 Jun 2007 23:47:18 -0000 1.13 -+++ lib/isc/include/isc/stdio.h 6 Apr 2009 13:24:15 -0000 -@@ -72,6 +72,9 @@ isc_stdio_sync(FILE *f); - * direct counterpart in the stdio library. - */ - -+isc_result_t -+isc_stdio_fgetc(FILE *f, int *ret); -+ - ISC_LANG_ENDDECLS - - #endif /* ISC_STDIO_H */ -Index: lib/isc/unix/errno2result.c -=================================================================== -RCS file: /var/snap/bind9/lib/isc/unix/errno2result.c,v -retrieving revision 1.17 -diff -p -u -r1.17 errno2result.c ---- lib/isc/unix/errno2result.c 19 Jun 2007 23:47:18 -0000 1.17 -+++ lib/isc/unix/errno2result.c 6 Apr 2009 13:24:15 -0000 -@@ -43,6 +43,7 @@ isc__errno2result(int posixerrno) { - case EINVAL: /* XXX sometimes this is not for files */ - case ENAMETOOLONG: - case EBADF: -+ case EISDIR: - return (ISC_R_INVALIDFILE); - case ENOENT: - return (ISC_R_FILENOTFOUND); -Index: lib/isc/unix/stdio.c -=================================================================== -RCS file: /var/snap/bind9/lib/isc/unix/stdio.c,v -retrieving revision 1.8 -diff -p -u -r1.8 stdio.c ---- lib/isc/unix/stdio.c 19 Jun 2007 23:47:18 -0000 1.8 -+++ lib/isc/unix/stdio.c 6 Apr 2009 13:24:15 -0000 -@@ -115,3 +115,22 @@ isc_stdio_sync(FILE *f) { - return (isc__errno2result(errno)); - } - -+isc_result_t -+isc_stdio_fgetc(FILE *f, int *ret) { -+ int r; -+ isc_result_t result = ISC_R_SUCCESS; -+ -+#if defined(HAVE_FLOCKFILE) && defined(HAVE_GETCUNLOCKED) -+ r = fgetc_unlocked(f); -+#else -+ r = fgets(f); -+#endif -+ -+ if (r == EOF) -+ result = ferror(f) ? isc__errno2result(errno) : ISC_R_EOF; -+ -+ *ret = r; -+ -+ return result; -+} -+ diff --git a/server/bind/files/fedora/bind97-rh478718.patch b/server/bind/files/fedora/bind97-rh478718.patch deleted file mode 100644 index c6ea596ed8..0000000000 --- a/server/bind/files/fedora/bind97-rh478718.patch +++ /dev/null @@ -1,30 +0,0 @@ -diff -up bind-9.7.0/configure.in.rh478718 bind-9.7.0/configure.in ---- bind-9.7.0/configure.in.rh478718 2010-03-01 14:50:02.331207076 +0100 -+++ bind-9.7.0/configure.in 2010-03-01 14:50:21.501207488 +0100 -@@ -2540,6 +2540,10 @@ main() { - AC_MSG_RESULT($arch) - fi - -+if test ! "$arch" = "x86_64" -a "$have_xaddq" = "yes"; then -+ AC_MSG_ERROR([XADDQ present but disabled by Fedora patch!]) -+fi -+ - if test "$have_atomic" = "yes"; then - AC_MSG_CHECKING([compiler support for inline assembly code]) - -diff -up bind-9.7.0/lib/isc/include/isc/platform.h.in.rh478718 bind-9.7.0/lib/isc/include/isc/platform.h.in ---- bind-9.7.0/lib/isc/include/isc/platform.h.in.rh478718 2010-03-01 14:50:31.421207522 +0100 -+++ bind-9.7.0/lib/isc/include/isc/platform.h.in 2010-03-01 14:50:40.313707286 +0100 -@@ -255,7 +255,11 @@ - * If the "xaddq" operation (64bit xadd) is available on this architecture, - * ISC_PLATFORM_HAVEXADDQ will be defined. - */ --@ISC_PLATFORM_HAVEXADDQ@ -+#ifdef __x86_64__ -+#define ISC_PLATFORM_HAVEXADDQ 1 -+#else -+#undef ISC_PLATFORM_HAVEXADDQ -+#endif - - /* - * If the "atomic swap" operation is available on this architecture, diff --git a/server/bind/files/fedora/bind97-rh645544.patch b/server/bind/files/fedora/bind97-rh645544.patch deleted file mode 100644 index 8b9c4e386c..0000000000 --- a/server/bind/files/fedora/bind97-rh645544.patch +++ /dev/null @@ -1,30 +0,0 @@ -diff -up bind-9.7.2-P2/lib/dns/resolver.c.rh645544 bind-9.7.2-P2/lib/dns/resolver.c ---- bind-9.7.2-P2/lib/dns/resolver.c.rh645544 2010-11-08 14:32:12.254896255 +0100 -+++ bind-9.7.2-P2/lib/dns/resolver.c 2010-11-08 14:33:18.674869633 +0100 -@@ -1097,7 +1097,7 @@ log_edns(fetchctx_t *fctx) { - - dns_name_format(&fctx->domain, domainbuf, sizeof(domainbuf)); - isc_log_write(dns_lctx, DNS_LOGCATEGORY_EDNS_DISABLED, -- DNS_LOGMODULE_RESOLVER, ISC_LOG_INFO, -+ DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(1), - "success resolving '%s' (in '%s'?) after %s", - fctx->info, domainbuf, fctx->reason); - -@@ -3795,7 +3795,7 @@ log_lame(fetchctx_t *fctx, dns_adbaddrin - dns_name_format(&fctx->domain, domainbuf, sizeof(domainbuf)); - isc_sockaddr_format(&addrinfo->sockaddr, addrbuf, sizeof(addrbuf)); - isc_log_write(dns_lctx, DNS_LOGCATEGORY_LAME_SERVERS, -- DNS_LOGMODULE_RESOLVER, ISC_LOG_INFO, -+ DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(1), - "lame server resolving '%s' (in '%s'?): %s", - namebuf, domainbuf, addrbuf); - } -@@ -3822,7 +3822,7 @@ log_formerr(fetchctx_t *fctx, const char - } - - isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, -- DNS_LOGMODULE_RESOLVER, ISC_LOG_NOTICE, -+ DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(1), - "DNS format error from %s resolving %s%s%s: %s", - nsbuf, fctx->info, clmsg, clbuf, msgbuf); - } diff --git a/server/bind/files/fedora/bind97-rh693982.patch b/server/bind/files/fedora/bind97-rh693982.patch deleted file mode 100644 index 2e8904735c..0000000000 --- a/server/bind/files/fedora/bind97-rh693982.patch +++ /dev/null @@ -1,125 +0,0 @@ - - - -bind.git - bind - - - - - - -
- - - - -
-summaryrefslogtreecommitdiffstats
- - - -
-
-
path: root/bind97-rh693982.patch
blob: 57bf8122b0d96d08e6899bdf4cdd06f946a60b09 (plain) - - -
1
-2
-3
-4
-5
-6
-7
-8
-9
-10
-11
-12
-13
-14
-15
-16
-17
-18
-19
-20
-21
-22
-23
-24
-25
-26
-27
-28
-29
-30
-31
-32
-33
-34
-35
-
diff -up bind-9.7.3-P3/bin/named/server.c.rh693982 bind-9.7.3-P3/bin/named/server.c
---- bind-9.7.3-P3/bin/named/server.c.rh693982	2011-08-12 17:18:55.611978110 +0200
-+++ bind-9.7.3-P3/bin/named/server.c	2011-08-12 17:19:36.009975303 +0200
-@@ -4444,15 +4444,6 @@ load_configuration(const char *filename,
- 		ns_os_changeuser();
- 
- 	/*
--	 * Check that the working directory is writable.
--	 */
--	if (access(".", W_OK) != 0) {
--		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
--			      NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
--			      "the working directory is not writable");
--	}
--
--	/*
- 	 * Configure the logging system.
- 	 *
- 	 * Do this after changing UID to make sure that any log
-@@ -4498,6 +4489,15 @@ load_configuration(const char *filename,
- 	}
- 
- 	/*
-+	 * Check that the working directory is writable.
-+	 */
-+	if (access(".", W_OK) != 0) {
-+		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
-+			      NS_LOGMODULE_SERVER, ISC_LOG_DEBUG(1),
-+			      "the working directory is not writable");
-+	}
-+
-+	/*
- 	 * Set the default value of the query logging flag depending
- 	 * whether a "queries" category has been defined.  This is
- 	 * a disgusting hack, but we need to do this for BIND 8
-
-
-
generated by cgit v0.9.2 at 2013-11-16 11:15:04 (GMT)
-
- - diff --git a/server/bind/files/fedora/bind99-rh640538.patch b/server/bind/files/fedora/bind99-rh640538.patch deleted file mode 100644 index 5066a1450a..0000000000 --- a/server/bind/files/fedora/bind99-rh640538.patch +++ /dev/null @@ -1,44 +0,0 @@ -diff --git a/bin/dig/dig.docbook b/bin/dig/dig.docbook -index 1079421..f11abd1 100644 ---- a/bin/dig/dig.docbook -+++ b/bin/dig/dig.docbook -@@ -1177,6 +1177,39 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr - - - -+ RETURN CODES -+ -+ Dig return codes are: -+ -+ -+ -+ 0: Everything went well, including things like NXDOMAIN -+ -+ -+ -+ -+ 1: Usage error -+ -+ -+ -+ -+ 8: Couldn't open batch file -+ -+ -+ -+ -+ 9: No reply from server -+ -+ -+ -+ -+ 10: Internal error -+ -+ -+ -+ -+ -+ - FILES - - /etc/resolv.conf diff --git a/server/bind/files/lfs/bind-9.12.0-use_iproute2-1.patch b/server/bind/files/lfs/bind-9.12.0-use_iproute2-1.patch deleted file mode 100644 index fc6bfba706..0000000000 --- a/server/bind/files/lfs/bind-9.12.0-use_iproute2-1.patch +++ /dev/null @@ -1,36 +0,0 @@ -Submitted By: Bruce Dubbs -Date: 2011-11-16 -Origin: DJ Lucas -Initial Package Version: 9.10.3 -Description: allow use of ip command instead of ifconfig for test suite -Upstream Status: Not applicable - -diff -Naur bind-9.10.3.orig/bin/tests/system/ifconfig.sh bind-9.10.3/bin/tests/system/ifconfig.sh ---- bind-9.10.3.orig/bin/tests/system/ifconfig.sh 2015-09-09 04:23:40.000000000 +0200 -+++ bind-9.10.3/bin/tests/system/ifconfig.sh 2015-09-26 17:59:04.456649396 +0200 -@@ -97,8 +97,10 @@ - fi - ;; - *-*-linux*) -- ifconfig lo:$int 10.53.0.$ns up netmask 255.255.255.0 -- ifconfig lo inet6 add fd92:7065:b8e:ffff::$ns/64 -+ #ifconfig lo:$int 10.53.0.$ns up netmask 255.255.255.0 -+ #ifconfig lo inet6 add fd92:7065:b8e:ffff::$ns/64 -+ ip addr add 10.53.0.$ns/24 label lo:$int dev lo -+ ip addr add fd92:7065:b8e:ffff::$ns/64 label lo:$int6 dev lo - ;; - *-unknown-freebsd*) - ifconfig lo0 10.53.0.$ns alias netmask 0xffffffff -@@ -178,8 +180,10 @@ - fi - ;; - *-*-linux*) -- ifconfig lo:$int 10.53.0.$ns down -- ifconfig lo inet6 del fd92:7065:b8e:ffff::$ns/64 -+ #ifconfig lo:$int 10.53.0.$ns down -+ #ifconfig lo inet6 del fd92:7065:b8e:ffff::$ns/64 -+ ip addr del 10.53.0.$ns/24 label lo:$int dev lo -+ ip addr del fd92:7065:b8e:ffff::$ns/64 label lo:$int6 dev lo - ;; - *-unknown-freebsd*) - ifconfig lo0 10.53.0.$ns delete diff --git a/server/bind/pspec.xml b/server/bind/pspec.xml index 8f072ca39f..e53ad8145c 100644 --- a/server/bind/pspec.xml +++ b/server/bind/pspec.xml @@ -12,7 +12,7 @@ service The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server bind is an implementation of the DNS protocols, bind includes a DNS server (named), a resolver library and tools for verifying that the DNS server is operating properly. - ftp://ftp.isc.org/isc/bind9/9.14.9/bind-9.14.9.tar.gz + ftp://ftp.isc.org/isc/bind9/9.18.11/bind-9.18.11.tar.xz openssl-devel libxml2-devel @@ -27,19 +27,10 @@ nslookup-pisilinux.patch fedora/bind-9.5-PIE.patch - - - - - - fedora/bind97-rh645544.patch - fedora/bind99-rh640538.patch - + + fedora/bind-9.18-zt-include-rwlock.patch + fedora/bind-9.18-unittest-netmgr-unstable.patch + fedora/bind-9.11-fips-tests.patch @@ -148,6 +139,13 @@ + + 2023-01-25 + 9.18.11 + Version bump. + Mustafa Cinasal + muscnsl@gmail.com + 2020-01-15 9.14.9