From 9e3303ba335b15917fb0b225bd809c5141029370 Mon Sep 17 00:00:00 2001
From: Thomas Woerner <twoerner@redhat.com>
Date: Apr 22 2020 09:58:07 +0000
Subject: [PATCH 1/25] bind-9.16: Lowercase DNS_SSUMATCHTYPE_* -> dns_ssumatchtype_*


The extra defines for uppercase DNS_SSUMATCHTYPE_* have been removed.
Only the dns_ssumatchtype_t enum is there now.

---

diff --git a/src/acl.c b/src/acl.c
index 9ec9f91..5011761 100644
--- a/src/acl.c
+++ b/src/acl.c
@@ -105,33 +105,33 @@ get_match_type(const cfg_obj_t *obj, unsigned int *value)
 	}
 	str = cfg_obj_asstring(obj);
 
-	MATCH("name", DNS_SSUMATCHTYPE_NAME);
-	MATCH("subdomain", DNS_SSUMATCHTYPE_SUBDOMAIN);
-	MATCH("zonesub", DNS_SSUMATCHTYPE_SUBDOMAIN);
-	MATCH("wildcard", DNS_SSUMATCHTYPE_WILDCARD);
-	MATCH("self", DNS_SSUMATCHTYPE_SELF);
-#if defined(DNS_SSUMATCHTYPE_SELFSUB) && defined(DNS_SSUMATCHTYPE_SELFWILD)
-	MATCH("selfsub", DNS_SSUMATCHTYPE_SELFSUB);
-	MATCH("selfwild", DNS_SSUMATCHTYPE_SELFWILD);
+	MATCH("name", dns_ssumatchtype_name);
+	MATCH("subdomain", dns_ssumatchtype_subdomain);
+	MATCH("zonesub", dns_ssumatchtype_subdomain);
+	MATCH("wildcard", dns_ssumatchtype_wildcard);
+	MATCH("self", dns_ssumatchtype_self);
+#if defined(dns_ssumatchtype_selfSUB) && defined(dns_ssumatchtype_selfwild)
+	MATCH("selfsub", dns_ssumatchtype_selfSUB);
+	MATCH("selfwild", dns_ssumatchtype_selfwild);
 #endif
-#ifdef DNS_SSUMATCHTYPE_SELFMS
-	MATCH("ms-self", DNS_SSUMATCHTYPE_SELFMS);
+#ifdef dns_ssumatchtype_selfms
+	MATCH("ms-self", dns_ssumatchtype_selfms);
 #endif
-#ifdef DNS_SSUMATCHTYPE_SELFKRB5
-	MATCH("krb5-self", DNS_SSUMATCHTYPE_SELFKRB5);
+#ifdef dns_ssumatchtype_selfkrb5
+	MATCH("krb5-self", dns_ssumatchtype_selfkrb5);
 #endif
-#ifdef DNS_SSUMATCHTYPE_SUBDOMAINMS
-	MATCH("ms-subdomain", DNS_SSUMATCHTYPE_SUBDOMAINMS);
+#ifdef dns_ssumatchtype_subdomainms
+	MATCH("ms-subdomain", dns_ssumatchtype_subdomainms);
 #endif
-#ifdef DNS_SSUMATCHTYPE_SUBDOMAINKRB5
-	MATCH("krb5-subdomain", DNS_SSUMATCHTYPE_SUBDOMAINKRB5);
+#ifdef dns_ssumatchtype_subdomainkrb5
+	MATCH("krb5-subdomain", dns_ssumatchtype_subdomainkrb5);
 #endif
-#if defined(DNS_SSUMATCHTYPE_TCPSELF) && defined(DNS_SSUMATCHTYPE_6TO4SELF)
-	MATCH("tcp-self", DNS_SSUMATCHTYPE_TCPSELF);
-	MATCH("6to4-self", DNS_SSUMATCHTYPE_6TO4SELF);
+#if defined(dns_ssumatchtype_tcpself) && defined(dns_ssumatchtype_6to4self)
+	MATCH("tcp-self", dns_ssumatchtype_tcpself);
+	MATCH("6to4-self", dns_ssumatchtype_6to4self);
 #endif
-#if defined(DNS_SSUMATCHTYPE_EXTERNAL)
-	MATCH("external", DNS_SSUMATCHTYPE_EXTERNAL);
+#if defined(dns_ssumatchtype_external)
+	MATCH("external", dns_ssumatchtype_external);
 #endif
 
 	log_bug("unsupported match type '%s'", str);
@@ -313,7 +313,7 @@ acl_configure_zone_ssutable(const char *policy_str, dns_zone_t *zone)
 		/* Use zone name for 'zonesub' match type */
 		result = get_fixed_name(stmt, "name", &fname);
 		if (result == ISC_R_NOTFOUND &&
-		    match_type == DNS_SSUMATCHTYPE_SUBDOMAIN) {
+		    match_type == dns_ssumatchtype_subdomain) {
 			dns_fixedname_init(&fname);
 			CHECK(dns_name_copy(dns_zone_getorigin(zone),
 					    dns_fixedname_name(&fname),
@@ -324,7 +324,7 @@ acl_configure_zone_ssutable(const char *policy_str, dns_zone_t *zone)
 
 		CHECK(get_types(mctx, stmt, &types, &n));
 
-		if (match_type == DNS_SSUMATCHTYPE_WILDCARD &&
+		if (match_type == dns_ssumatchtype_wildcard &&
 		    !dns_name_iswildcard(dns_fixedname_name(&fname))) {
 			char name[DNS_NAME_FORMATSIZE];
 			dns_name_format(dns_fixedname_name(&fname), name,

From 0762cdacb42d4133721454fbf75ea28699bb26b0 Mon Sep 17 00:00:00 2001
From: Thomas Woerner <twoerner@redhat.com>
Date: Apr 22 2020 09:58:07 +0000
Subject: [PATCH 2/25] bind-9.16: cfg_parse_buffer changes


cfg_parse_buffer2 has been renamed to cfg_parse_buffer and
cfg_parse_buffer has two addtional parameters.

---

diff --git a/src/bindcfg.c b/src/bindcfg.c
index 5539dea..7844774 100644
--- a/src/bindcfg.c
+++ b/src/bindcfg.c
@@ -108,7 +108,7 @@ cfg_parse_strbuf(cfg_parser_t *parser, const char *string, cfg_type_t **type,
 	isc_buffer_init(&buffer, (char *)string, string_len);
 	isc_buffer_add(&buffer, string_len);
 
-	result = cfg_parse_buffer(parser, &buffer, *type, &ret);
+	result = cfg_parse_buffer(parser, &buffer, NULL, 0, *type, 0, &ret);
 
 	if (result == ISC_R_SUCCESS)
 		*objp = ret;
diff --git a/src/fwd.c b/src/fwd.c
index 7ac381b..6c715d4 100644
--- a/src/fwd.c
+++ b/src/fwd.c
@@ -182,8 +182,8 @@ fwd_print_list_buff(isc_mem_t *mctx, dns_forwarders_t *fwdrs,
 	list_len = fwd_list_len(fwdrs);
 	CHECK(fwd_list_gen_dummy_config_string(mctx,
 					       list_len, &dummy_fwdr_buf));
-	CHECK(cfg_parse_buffer(parser, dummy_fwdr_buf,
-			       cfg_type_forwarders, &forwarders_cfg));
+	CHECK(cfg_parse_buffer(parser, dummy_fwdr_buf, NULL, 0,
+			       cfg_type_forwarders, 0, &forwarders_cfg));
 
 	/* Walk through internal representation and cfg representation and copy
 	 * data from the internal one to cfg data structures.*/
diff --git a/src/settings.c b/src/settings.c
index 90c7e47..18eea14 100644
--- a/src/settings.c
+++ b/src/settings.c
@@ -686,8 +686,8 @@ setting_set_parse_conf(isc_mem_t *mctx, const char *name,
 	isc_buffer_add(&in_buf, len);
 
 	CHECK(cfg_parser_create(mctx, dns_lctx, &parser));
-	result = cfg_parse_buffer2(parser, &in_buf, name, cfg_type_conf,
-				   &config);
+	result = cfg_parse_buffer(parser, &in_buf, name, 0, cfg_type_conf, 0,
+				  &config);
 	if (result == ISC_R_SUCCESS) {
 		cfg_printx(config, CFG_PRINTER_XKEY, cfg_printer, log_buf);
 		cfg_obj_log(config, dns_lctx, ISC_LOG_DEBUG(10),

From 8d0d94597ed9b1ff24bc3b891504ae5f4db865ec Mon Sep 17 00:00:00 2001
From: Thomas Woerner <twoerner@redhat.com>
Date: Apr 22 2020 09:58:07 +0000
Subject: [PATCH 3/25] bind-9.16: isc_buffer_allocate is now void


isc_buffer_allocate is not returning a results anymore. according to
bind9: a038f77d92a857bc11750683c9317d70da6fcfdf isc_buffer_allocate is
void and can not fail anymore.

---

diff --git a/src/fwd.c b/src/fwd.c
index 6c715d4..ad27b28 100644
--- a/src/fwd.c
+++ b/src/fwd.c
@@ -86,7 +86,6 @@ fwd_list_len(dns_forwarders_t *fwdrs) {
 static isc_result_t
 fwd_list_gen_dummy_config_string(isc_mem_t *mctx, size_t list_len,
 				 isc_buffer_t **dummy_string) {
-	isc_result_t result;
 	const char prefix[] = "{ ";
 	const char suffix[] = "} // dummy string, please ignore";
 	const char fill[] = "127.0.0.1; ";
@@ -98,7 +97,9 @@ fwd_list_gen_dummy_config_string(isc_mem_t *mctx, size_t list_len,
 
 	REQUIRE(dummy_string != NULL && *dummy_string == NULL);
 
-	CHECK(isc_buffer_allocate(mctx, &output, target_size));
+	/* No CHECK here as isc_buffer_allocate is void and can not fail.
+	 *  See bind9: a038f77d92a857bc11750683c9317d70da6fcfdf */
+	isc_buffer_allocate(mctx, &output, target_size);
 	isc_buffer_putstr(output, prefix);
 	for (size_t i = 0; i < list_len; i++)
 		isc_buffer_putstr(output, fill);
@@ -106,11 +107,7 @@ fwd_list_gen_dummy_config_string(isc_mem_t *mctx, size_t list_len,
 	isc_buffer_putuint8(output, '\0');
 	*dummy_string = output;
 
-cleanup:
-	if (result != ISC_R_SUCCESS && output != NULL)
-		isc_buffer_free(&output);
-
-	return result;
+	return ISC_R_SUCCESS;
 }
 
 /**
@@ -122,7 +119,6 @@ cleanup:
 isc_result_t
 fwd_print_bracketed_values_buf(isc_mem_t *mctx, ldap_valuelist_t *values,
 			      isc_buffer_t **string) {
-	isc_result_t result;
 	ldap_value_t *value;
 	const char prefix[] = "{ ";
 	const char suffix[] = "}";
@@ -143,13 +139,14 @@ fwd_print_bracketed_values_buf(isc_mem_t *mctx, ldap_valuelist_t *values,
 	buffer_append_str(&tmp_buf, suffix, 2);
 
 	/* create and copy string from tmp to output buffer */
-	CHECK(isc_buffer_allocate(mctx, string, tmp_buf.used));
+        /* No CHECK here as isc_buffer_allocate is void and can not fail.
+         *  See bind9: a038f77d92a857bc11750683c9317d70da6fcfdf */
+	isc_buffer_allocate(mctx, string, tmp_buf.used);
 	isc_buffer_putmem(*string, isc_buffer_base(&tmp_buf), tmp_buf.used);
 
-cleanup:
 	if (tmp_buf.base != NULL)
 		isc_mem_put(mctx, tmp_buf.base, tmp_buf.length);
-	return result;
+	return ISC_R_SUCCESS;
 }
 
 isc_result_t
@@ -199,7 +196,7 @@ fwd_print_list_buff(isc_mem_t *mctx, dns_forwarders_t *fwdrs,
 	cfg_print(faddresses, buffer_append_str, &tmp_buf);
 
 	/* create and copy string from tmp to output buffer */
-	CHECK(isc_buffer_allocate(mctx, out_buf, tmp_buf.used));
+	isc_buffer_allocate(mctx, out_buf, tmp_buf.used);
 	isc_buffer_putmem(*out_buf, isc_buffer_base(&tmp_buf),
 			  isc_buffer_usedlength(&tmp_buf));
 
diff --git a/src/settings.c b/src/settings.c
index 18eea14..1d121af 100644
--- a/src/settings.c
+++ b/src/settings.c
@@ -577,7 +577,7 @@ cfg_printer(void *closure, const char *text, int textlen) {
 static isc_result_t
 settings_set_fill(const cfg_obj_t *config, settings_set_t *set)
 {
-	isc_result_t result;
+	isc_result_t result = ISC_R_SUCCESS;
 	setting_t *setting;
 	isc_buffer_t *buf_value = NULL;
 	const cfg_obj_t *cfg_value;
@@ -585,7 +585,8 @@ settings_set_fill(const cfg_obj_t *config, settings_set_t *set)
 
 	REQUIRE(cfg_obj_ismap(config) == true);
 
-	CHECK(isc_buffer_allocate(set->mctx, &buf_value, ISC_BUFFER_INCR));
+	/* isc_buffer_allocate can no longer fail */
+	isc_buffer_allocate(set->mctx, &buf_value, ISC_BUFFER_INCR);
 	isc_buffer_setautorealloc(buf_value, true);
 
 	for (setting = set->first_setting;
@@ -678,7 +679,8 @@ setting_set_parse_conf(isc_mem_t *mctx, const char *name,
 
 	REQUIRE(parameters != NULL);
 
-	CHECK(isc_buffer_allocate(mctx, &log_buf, ISC_BUFFER_INCR));
+	/* isc_buffer_allocate can no longer fail */
+	isc_buffer_allocate(mctx, &log_buf, ISC_BUFFER_INCR);
 	isc_buffer_setautorealloc(log_buf, true);
 
 	len = strlen(parameters);

From 7dedf686f3b38aaccff332d8813e36154b8eb69b Mon Sep 17 00:00:00 2001
From: Thomas Woerner <twoerner@redhat.com>
Date: Apr 22 2020 09:58:07 +0000
Subject: [PATCH 4/25] bind-9.16: Replace removed isc_string_ functions


The functions isc_string_copy, isc_string_printf, isc_string_append and
isc_string_printf_truncate have been removed in bind. The have been
replaced by normal c functions.

---

diff --git a/src/fs.c b/src/fs.c
index 61c46b5..bfe5524 100644
--- a/src/fs.c
+++ b/src/fs.c
@@ -79,7 +79,10 @@ fs_dirs_create(const char *path) {
 	char curr_path[PATH_MAX + 1];
 	char *end = NULL;
 
-	CHECK(isc_string_copy(curr_path, PATH_MAX, path));
+	/* isc_string_copy has been removed */
+	if (strlcpy(curr_path, path, PATH_MAX) >= PATH_MAX) {
+		return ISC_R_NOSPACE;
+	}
 
 	for (end = strchr(curr_path, '/');
 	     end != NULL;
diff --git a/src/ldap_convert.c b/src/ldap_convert.c
index 853ad37..93beff6 100644
--- a/src/ldap_convert.c
+++ b/src/ldap_convert.c
@@ -286,7 +286,8 @@ dns_to_ldap_dn_escape(isc_mem_t *mctx, const char * const dns_str, char ** ldap_
 			}
 			/* LDAP uses \xy escaping. "xy" represent two hexadecimal digits.*/
 			/* TODO: optimize to bit mask & rotate & dec->hex table? */
-			CHECK(isc_string_printf(esc_name + esc_idx, 4, "\\%02x", ascii_val));
+			/* isc_string_printf has been removed */
+			result = snprintf(esc_name + esc_idx, 4, "\\%02x", ascii_val);
 			esc_idx += 3; /* isc_string_printf wrote 4 bytes including '\0' */
 		}
 	}
@@ -430,24 +431,28 @@ isc_result_t
 rdatatype_to_ldap_attribute(dns_rdatatype_t rdtype, char *target,
 			    unsigned int size, bool unknown)
 {
-	isc_result_t result;
 	char rdtype_str[DNS_RDATATYPE_FORMATSIZE];
 
 	if (unknown) {
 		/* "UnknownRecord;TYPE65333" */
-		CHECK(isc_string_copy(target, size,
-				      LDAP_RDATATYPE_UNKNOWN_PREFIX));
+		/* isc_string_copy and isc_string_append have been removed */
+		if (strlcpy(target, LDAP_RDATATYPE_UNKNOWN_PREFIX, size)
+		    >= size)
+			return ISC_R_NOSPACE;
 		snprintf(rdtype_str, sizeof(rdtype_str), "TYPE%u", rdtype);
-		CHECK(isc_string_append(target, size, rdtype_str));
+		if (strlcat(target, rdtype_str, size) >= size)
+			return ISC_R_NOSPACE;
 	} else {
 		/* "ARecord" */
 		dns_rdatatype_format(rdtype, rdtype_str, DNS_RDATATYPE_FORMATSIZE);
-		CHECK(isc_string_copy(target, size, rdtype_str));
-		CHECK(isc_string_append(target, size, LDAP_RDATATYPE_SUFFIX));
+		/* isc_string_copy and isc_string_append have been removed */
+		if (strlcpy(target, rdtype_str, size) >= size)
+			return ISC_R_NOSPACE;
+		if (strlcat(target, LDAP_RDATATYPE_SUFFIX, size) >= size)
+			return ISC_R_NOSPACE;
 	}
 
-cleanup:
-	return result;
+	return ISC_R_SUCCESS;
 }
 
 /**
@@ -463,8 +468,9 @@ rdata_to_generic(dns_rdata_t *rdata, isc_buffer_t *target)
 	dns_rdata_toregion(rdata, &rdata_reg);
 	REQUIRE(rdata_reg.length <= 65535);
 
-	result = isc_string_printf(buf, sizeof(buf), "\\# %u", rdata_reg.length);
-	INSIST(result == ISC_R_SUCCESS);
+	/* isc_string_printf has been removed */
+	result = snprintf(buf, sizeof(buf), "\\# %u", rdata_reg.length);
+	RUNTIME_CHECK(result < sizeof(buf));
 	isc_buffer_putstr(target, buf);
 	if (rdata_reg.length != 0U) {
 		isc_buffer_putstr(target, " ");
diff --git a/src/ldap_helper.c b/src/ldap_helper.c
index 0a25bfb..3517ea3 100644
--- a/src/ldap_helper.c
+++ b/src/ldap_helper.c
@@ -445,7 +445,10 @@ validate_local_instance_settings(ldap_instance_t *inst, settings_set_t *set) {
 			  auth_method_str);
 		CLEANUP_WITH(ISC_R_FAILURE);
 	}
-	CHECK(isc_string_printf(print_buff, PRINT_BUFF_SIZE, "%u", auth_method_enum));
+	/* isc_string_printf has been removed */
+	result = snprintf(print_buff, PRINT_BUFF_SIZE, "%u", auth_method_enum);
+	RUNTIME_CHECK(result < PRINT_BUFF_SIZE);
+
 	CHECK(setting_set("auth_method_enum", inst->local_settings, print_buff));
 
 	/* check we have the right data when SASL/GSSAPI is selected */
@@ -555,16 +558,16 @@ new_ldap_instance(isc_mem_t *mctx, const char *db_name, const char *parameters,
 	ldap_inst->watcher = 0;
 	CHECK(sync_ctx_init(ldap_inst->mctx, ldap_inst, &ldap_inst->sctx));
 
-	isc_string_printf_truncate(settings_name, PRINT_BUFF_SIZE,
-				   SETTING_SET_NAME_LOCAL " for database %s",
-				   ldap_inst->db_name);
+	snprintf(settings_name, PRINT_BUFF_SIZE,
+		 SETTING_SET_NAME_LOCAL " for database %s",
+		 ldap_inst->db_name);
 	CHECK(settings_set_create(mctx, settings_local_default,
 	      sizeof(settings_local_default), settings_name,
 	      &settings_default_set, &ldap_inst->local_settings));
 
-	isc_string_printf_truncate(settings_name, PRINT_BUFF_SIZE,
-				   SETTING_SET_NAME_GLOBAL " for database %s",
-				   ldap_inst->db_name);
+	snprintf(settings_name, PRINT_BUFF_SIZE,
+		 SETTING_SET_NAME_GLOBAL " for database %s",
+		 ldap_inst->db_name);
 	CHECK(settings_set_create(mctx, settings_global_default,
 	      sizeof(settings_global_default), settings_name,
 	      ldap_inst->local_settings, &ldap_inst->global_settings));
@@ -629,13 +632,13 @@ new_ldap_instance(isc_mem_t *mctx, const char *db_name, const char *parameters,
 	CHECK(setting_get_str("server_id", ldap_inst->local_settings,
 			      &server_id));
 	if (strlen(server_id) == 0)
-		isc_string_printf_truncate(settings_name, PRINT_BUFF_SIZE,
-					   SETTING_SET_NAME_SERVER
-					   " for undefined server_id");
+		snprintf(settings_name, PRINT_BUFF_SIZE,
+			 SETTING_SET_NAME_SERVER " for undefined server_id");
+
 	else
-		isc_string_printf_truncate(settings_name, PRINT_BUFF_SIZE,
-					   SETTING_SET_NAME_SERVER
-					   " for server id %s", server_id);
+		snprintf(settings_name, PRINT_BUFF_SIZE,
+			 SETTING_SET_NAME_SERVER
+			 " for server id %s", server_id);
 
 	CHECK(settings_set_create(mctx, settings_server_ldap_default,
 	      sizeof(settings_server_ldap_default), settings_name,
@@ -847,8 +850,9 @@ cleanup_zone_files(dns_zone_t *zone) {
 	namelen = strlen(filename);
 	if (namelen > 4 && strcmp(filename + namelen - 4, ".jnl") == 0)
 		namelen -= 4;
-	CHECK(isc_string_printf(bck_filename, sizeof(bck_filename),
-				"%.*s.jbk", namelen, filename));
+	result = snprintf(bck_filename, sizeof(bck_filename),
+			  "%.*s.jbk", namelen, filename);
+	RUNTIME_CHECK(result < sizeof(bck_filename));
 	CHECK(fs_file_remove(bck_filename));
 
 cleanup:
@@ -1717,7 +1721,8 @@ ldap_replace_serial(ldap_instance_t *inst, dns_name_t *zone,
 	change.mod_op = LDAP_MOD_REPLACE;
 	change.mod_type = "idnsSOAserial";
 	change.mod_values = values;
-	CHECK(isc_string_printf(serial_char, MAX_SERIAL_LENGTH, "%u", serial));
+	result = snprintf(serial_char, MAX_SERIAL_LENGTH, "%u", serial);
+	RUNTIME_CHECK(result < MAX_SERIAL_LENGTH);
 
 	CHECK(ldap_modify_do(inst, str_buf(dn), changep, false));
 
@@ -3287,7 +3292,10 @@ ldap_rdttl_to_ldapmod(isc_mem_t *mctx, dns_rdatalist_t *rdlist,
 
 	CHECK(ldap_mod_create(mctx, &change));
 	change->mod_op = LDAP_MOD_REPLACE;
-	CHECK(isc_string_copy(change->mod_type, LDAP_ATTR_FORMATSIZE, "dnsTTL"));
+	/* isc_string_copy has been removed */
+	if (strlcpy(change->mod_type, "dnsTTL", LDAP_ATTR_FORMATSIZE)
+	   >= LDAP_ATTR_FORMATSIZE)
+		return ISC_R_NOSPACE;
 
 	CHECKED_MEM_ALLOCATE(mctx, vals, 2 * sizeof(char *));
 	memset(vals, 0, 2 * sizeof(char *));
@@ -3314,7 +3322,7 @@ static isc_result_t ATTR_NONNULLS ATTR_CHECKRESULT
 modify_soa_record(ldap_instance_t *ldap_inst, const char *zone_dn,
 		  dns_rdata_t *rdata)
 {
-	isc_result_t result;
+	isc_result_t result = ISC_R_SUCCESS;
 	dns_rdata_soa_t soa;
 	LDAPMod change[5];
 	LDAPMod *changep[6] = {
@@ -3332,8 +3340,9 @@ modify_soa_record(ldap_instance_t *ldap_inst, const char *zone_dn,
 	change[index].mod_values = alloca(2 * sizeof(char *)); \
 	change[index].mod_values[0] = alloca(MAX_SOANUM_LENGTH); \
 	change[index].mod_values[1] = NULL; \
-	CHECK(isc_string_printf(change[index].mod_values[0], \
-		MAX_SOANUM_LENGTH, "%u", soa.name));
+	result = snprintf(change[index].mod_values[0],  \
+			  MAX_SOANUM_LENGTH, "%u", soa.name); \
+	RUNTIME_CHECK(result < MAX_SOANUM_LENGTH);
 
 	dns_rdata_tostruct(rdata, (void *)&soa, ldap_inst->mctx);
 
@@ -3347,7 +3356,6 @@ modify_soa_record(ldap_instance_t *ldap_inst, const char *zone_dn,
 
 	result = ldap_modify_do(ldap_inst, zone_dn, changep, false);
 
-cleanup:
 	return result;
 
 #undef MAX_SOANUM_LENGTH
@@ -3500,8 +3508,9 @@ remove_rdtype_from_ldap(dns_name_t *owner, dns_name_t *zone,
 		change[0]->mod_vals.modv_strvals = NULL;
 		CHECK(rdatatype_to_ldap_attribute(type, attr, sizeof(attr),
 						  unknown_type));
-		CHECK(isc_string_copy(change[0]->mod_type, LDAP_ATTR_FORMATSIZE,
-				      attr));
+		if (strlcpy(change[0]->mod_type, attr, LDAP_ATTR_FORMATSIZE)
+		    >= LDAP_ATTR_FORMATSIZE)
+			return ISC_R_NOSPACE;
 		CHECK(ldap_modify_do(ldap_inst, str_buf(dn), change, false));
 		ldap_mod_free(ldap_inst->mctx, &change[0]);
 		unknown_type = !unknown_type;
@@ -4620,14 +4629,17 @@ ldap_sync_doit(ldap_instance_t *inst, ldap_connection_t *conn,
 
 	/* request idnsServerConfig object only if server_id is specified */
 	CHECK(setting_get_str("server_id", inst->server_ldap_settings, &server_id));
-	if (strlen(server_id) == 0)
-		CHECK(isc_string_printf(filter, sizeof(filter), config_template,
-				        "", "", "", filter_objcs));
-	else
-		CHECK(isc_string_printf(filter, sizeof(filter), config_template,
-					"  (&(objectClass=idnsServerConfigObject)"
-				        "    (idnsServerId=", server_id, "))",
-					filter_objcs));
+	if (strlen(server_id) == 0) {
+		result = snprintf(filter, sizeof(filter), config_template,
+				  "", "", "", filter_objcs);
+		RUNTIME_CHECK(result < sizeof(filter));
+	} else {
+		result = snprintf(filter, sizeof(filter), config_template,
+				  "  (&(objectClass=idnsServerConfigObject)"
+				  "    (idnsServerId=", server_id, "))",
+				  filter_objcs);
+		RUNTIME_CHECK(result < sizeof(filter));
+	}
 
 	result = ldap_sync_prepare(inst, inst->server_ldap_settings,
 				   filter, conn, &ldap_sync);
diff --git a/src/settings.c b/src/settings.c
index 1d121af..87de0e5 100644
--- a/src/settings.c
+++ b/src/settings.c
@@ -281,7 +281,9 @@ set_value(isc_mem_t *mctx, const settings_set_t *set, setting_t *setting,
 			isc_mem_free(mctx, setting->value.value_char);
 		CHECKED_MEM_ALLOCATE(mctx, setting->value.value_char, len);
 		setting->is_dynamic = true;
-		CHECK(isc_string_copy(setting->value.value_char, len, value));
+		/* isc_string_copy has been removed */
+		if (strlcpy(setting->value.value_char, value, len) >= len)
+			return ISC_R_NOSPACE;
 		break;
 
 	case ST_UNSIGNED_INTEGER:
diff --git a/src/zone_register.c b/src/zone_register.c
index 96373cc..e31d5e8 100644
--- a/src/zone_register.c
+++ b/src/zone_register.c
@@ -280,9 +280,9 @@ create_zone_info(isc_mem_t * const mctx, dns_zone_t * const raw,
 		dns_zone_attach(secure, &zinfo->secure);
 
 	zinfo->settings = NULL;
-	isc_string_printf_truncate(settings_name, PRINT_BUFF_SIZE,
-				   SETTING_SET_NAME_ZONE " %s",
-				   dn);
+	/* isc_string_printf_truncate has been removed */
+	snprintf(settings_name, PRINT_BUFF_SIZE, SETTING_SET_NAME_ZONE " %s",
+		 dn);
 	CHECK(settings_set_create(mctx, zone_settings, sizeof(zone_settings),
 				  settings_name, global_settings,
 				  &zinfo->settings));

From 8a3ce9834f4cbe56822708d24823b7d1287cb31d Mon Sep 17 00:00:00 2001
From: Thomas Woerner <twoerner@redhat.com>
Date: Apr 22 2020 09:58:08 +0000
Subject: [PATCH 5/25] bind-9.16: isc_mutex_ fuctions are void and failures are fatal


The isc_mutex_ functions are now void and the failures are fatal.
RUNTIME_CHECK and CHECK are not used any more. There is no code right
now to handle the failures gracefully in bind-dyndb-ldap.

---

diff --git a/src/ldap_driver.c b/src/ldap_driver.c
index b9161fe..7e0d84c 100644
--- a/src/ldap_driver.c
+++ b/src/ldap_driver.c
@@ -153,8 +153,8 @@ cleanup:
 #endif
 	dns_db_detach(&ldapdb->rbtdb);
 	dns_name_free(&ldapdb->common.origin, ldapdb->common.mctx);
-	RUNTIME_CHECK(isc_mutex_destroy(&ldapdb->newversion_lock)
-		      == ISC_R_SUCCESS);
+	/* isc_mutex_destroy is failing fatal now */
+	isc_mutex_destroy(&ldapdb->newversion_lock);
 	isc_mem_putanddetach(&ldapdb->common.mctx, ldapdb, sizeof(*ldapdb));
 }
 
@@ -962,7 +962,8 @@ ldapdb_create(isc_mem_t *mctx, dns_name_t *name, dns_dbtype_t type,
 	ZERO_PTR(ldapdb);
 
 	isc_mem_attach(mctx, &ldapdb->common.mctx);
-	CHECK(isc_mutex_init(&ldapdb->newversion_lock));
+	/* isc_mutex_init and isc_condition_init failures are now fatal */
+	isc_mutex_init(&ldapdb->newversion_lock);
 	lock_ready = true;
 	dns_name_init(&ldapdb->common.origin, NULL);
 	isc_ondestroy_init(&ldapdb->common.ondest);
@@ -988,9 +989,10 @@ ldapdb_create(isc_mem_t *mctx, dns_name_t *name, dns_dbtype_t type,
 
 cleanup:
 	if (ldapdb != NULL) {
-		if (lock_ready == true)
-			RUNTIME_CHECK(isc_mutex_destroy(&ldapdb->newversion_lock)
-				      == ISC_R_SUCCESS);
+		if (lock_ready == true) {
+			/* isc_mutex_destroy errors are now fatal */
+			isc_mutex_destroy(&ldapdb->newversion_lock);
+		}
 		if (dns_name_dynamic(&ldapdb->common.origin))
 			dns_name_free(&ldapdb->common.origin, mctx);
 
diff --git a/src/ldap_helper.c b/src/ldap_helper.c
index 3517ea3..bedcfdf 100644
--- a/src/ldap_helper.c
+++ b/src/ldap_helper.c
@@ -659,7 +659,8 @@ new_ldap_instance(isc_mem_t *mctx, const char *db_name, const char *parameters,
 	CHECK(fwdr_create(ldap_inst->mctx, &ldap_inst->fwd_register));
 	CHECK(mldap_new(mctx, &ldap_inst->mldapdb));
 
-	CHECK(isc_mutex_init(&ldap_inst->kinit_lock));
+	/* isc_mutex_init and isc_condition_init failures are now fatal */
+	isc_mutex_init(&ldap_inst->kinit_lock);
 
 	CHECK(ldap_pool_create(mctx, connections, &ldap_inst->pool));
 	CHECK(ldap_pool_connect(ldap_inst->pool, ldap_inst));
@@ -752,7 +753,8 @@ destroy_ldap_instance(ldap_instance_t **ldap_instp)
 	if (ldap_inst->task != NULL)
 		isc_task_detach(&ldap_inst->task);
 
-	DESTROYLOCK(&ldap_inst->kinit_lock);
+	/* isc_mutex_init and isc_condition_init failures are now fatal */
+	isc_mutex_destroy(&ldap_inst->kinit_lock);
 
 	settings_set_free(&ldap_inst->global_settings);
 	settings_set_free(&ldap_inst->local_settings);
@@ -785,11 +787,14 @@ new_ldap_connection(ldap_pool_t *pool, ldap_connection_t **ldap_connp)
 	CHECKED_MEM_GET_PTR(pool->mctx, ldap_conn);
 	ZERO_PTR(ldap_conn);
 
-	result = isc_mutex_init(&ldap_conn->lock);
-	if (result != ISC_R_SUCCESS) {
-		SAFE_MEM_PUT_PTR(pool->mctx, ldap_conn);
-		return result;
-	}
+	/* isc_mutex_init and isc_condition_init failures are now fatal */
+	isc_mutex_init(&ldap_conn->lock);
+	/*
+	 * if (result != ISC_R_SUCCESS) {
+	 *	SAFE_MEM_PUT_PTR(pool->mctx, ldap_conn);
+	 *	return result;
+	 * }
+	 */
 
 	isc_mem_attach(pool->mctx, &ldap_conn->mctx);
 
@@ -814,7 +819,8 @@ destroy_ldap_connection(ldap_connection_t **ldap_connp)
 	if (ldap_conn == NULL)
 		return;
 
-	DESTROYLOCK(&ldap_conn->lock);
+	 /* isc_mutex_init and isc_condition_init failures are now fatal */
+	isc_mutex_destroy(&ldap_conn->lock);
 	if (ldap_conn->handle != NULL)
 		ldap_unbind_ext_s(ldap_conn->handle, NULL, NULL);
 
diff --git a/src/metadb.c b/src/metadb.c
index 2a996e1..1f3c0ef 100644
--- a/src/metadb.c
+++ b/src/metadb.c
@@ -45,7 +45,8 @@ metadb_new(isc_mem_t *mctx, metadb_t **mdbp) {
 
 	isc_mem_attach(mctx, &mdb->mctx);
 
-	CHECK(isc_mutex_init(&mdb->newversion_lock));
+	/* isc_mutex_init and isc_condition_init failures are now fatal */
+	isc_mutex_init(&mdb->newversion_lock);
 	lock_ready = true;
 	CHECK(dns_db_create(mctx, "rbt", dns_rootname, dns_dbtype_zone,
 			    dns_rdataclass_in, 0, NULL, &mdb->rbtdb));
@@ -55,9 +56,10 @@ metadb_new(isc_mem_t *mctx, metadb_t **mdbp) {
 
 cleanup:
 	if (mdb != NULL) {
-		if (lock_ready == true)
-			RUNTIME_CHECK(isc_mutex_destroy(&mdb->newversion_lock)
-				      == ISC_R_SUCCESS);
+		if (lock_ready == true) {
+			/* isc_mutex_destroy errors are now fatal */
+			isc_mutex_destroy(&mdb->newversion_lock);
+		}
 		MEM_PUT_AND_DETACH(mdb);
 	}
 	return result;
@@ -79,7 +81,8 @@ metadb_destroy(metadb_t **mdbp) {
 	dns_db_dump(mdb->rbtdb, NULL, "/tmp/mdb.db");
 #endif
 	dns_db_detach(&mdb->rbtdb);
-	RUNTIME_CHECK(isc_mutex_destroy(&mdb->newversion_lock) == ISC_R_SUCCESS);
+	/* isc_mutex_destroy errors are now fatal */
+	isc_mutex_destroy(&mdb->newversion_lock);
 	MEM_PUT_AND_DETACH(mdb);
 
 	*mdbp = NULL;
diff --git a/src/semaphore.c b/src/semaphore.c
index d86019d..33ed59b 100644
--- a/src/semaphore.c
+++ b/src/semaphore.c
@@ -34,19 +34,21 @@ isc_interval_t conn_wait_timeout = { 3, 0 };
 isc_result_t
 semaphore_init(semaphore_t *sem, int value)
 {
-	isc_result_t result;
+	isc_result_t result = ISC_R_SUCCESS;
 
 	REQUIRE(sem != NULL);
 	REQUIRE(value > 0);
 
 	sem->value = value;
-	result = isc_mutex_init(&sem->mutex);
-	if (result != ISC_R_SUCCESS)
-		return result;
-
-	result = isc_condition_init(&sem->cond);
-	if (result != ISC_R_SUCCESS)
-		DESTROYLOCK(&sem->mutex);
+	/* isc_mutex_init and isc_condition_init failures are now fatal */
+	isc_mutex_init(&sem->mutex);
+	isc_condition_init(&sem->cond);
+	/*
+	 * if (result != ISC_R_SUCCESS) {
+	 *	// isc_mutex_destroy failures are now fatal
+	 *	isc_mutex_destroy(&sem->mutex);
+	 * }
+	 */
 
 	return result;
 }
@@ -62,8 +64,9 @@ semaphore_destroy(semaphore_t *sem)
 	if (sem == NULL)
 		return;
 
-	RUNTIME_CHECK(isc_mutex_destroy(&sem->mutex) == ISC_R_SUCCESS);
-	RUNTIME_CHECK(isc_condition_destroy(&sem->cond) == ISC_R_SUCCESS);
+	/* isc_mutex_destroy and isc_condition_destroy are now fatal */
+	isc_mutex_destroy(&sem->mutex);
+	isc_condition_destroy(&sem->cond);
 }
 
 /**
diff --git a/src/settings.c b/src/settings.c
index 87de0e5..a6a8583 100644
--- a/src/settings.c
+++ b/src/settings.c
@@ -495,8 +495,8 @@ settings_set_create(isc_mem_t *mctx, const setting_t default_settings[],
 	isc_mem_attach(mctx, &new_set->mctx);
 
 	CHECKED_MEM_GET_PTR(mctx, new_set->lock);
-	result = isc_mutex_init(new_set->lock);
-	INSIST(result == ISC_R_SUCCESS);
+	/* isc_mutex_init failures are now fatal */
+	isc_mutex_init(new_set->lock);
 
 	new_set->parent_set = parent_set;
 
@@ -533,7 +533,8 @@ settings_set_free(settings_set_t **set) {
 		mctx = (*set)->mctx;
 
 		if ((*set)->lock != NULL) {
-			DESTROYLOCK((*set)->lock);
+			/* isc_mutex_destroy failures are now fatal */
+			isc_mutex_destroy((*set)->lock);
 			SAFE_MEM_PUT_PTR(mctx, (*set)->lock);
 		}
 
diff --git a/src/syncrepl.c b/src/syncrepl.c
index 054d625..83d7357 100644
--- a/src/syncrepl.c
+++ b/src/syncrepl.c
@@ -277,9 +277,11 @@ sync_ctx_init(isc_mem_t *mctx, ldap_instance_t *inst, sync_ctx_t **sctxp) {
 
 	sctx->inst = inst;
 
-	CHECK(isc_mutex_init(&sctx->mutex));
+	/* isc_mutex_init failures are now fatal */
+	isc_mutex_init(&sctx->mutex);
 	lock_ready = true;
-	CHECK(isc_condition_init(&sctx->cond));
+	/* isc_mutex_init failures are now fatal */
+	isc_condition_init(&sctx->cond);
 	cond_ready = true;
 
 	/* refcount includes ldap_inst->task implicitly */
@@ -297,8 +299,10 @@ sync_ctx_init(isc_mem_t *mctx, ldap_instance_t *inst, sync_ctx_t **sctxp) {
 	return ISC_R_SUCCESS;
 
 cleanup:
-	if (lock_ready == true)
-		DESTROYLOCK(&sctx->mutex);
+	if (lock_ready == true) {
+		/* isc_mutex_destroy failures are now fatal */
+		isc_mutex_destroy(&sctx->mutex);
+	}
 	if (cond_ready == true)
 		RUNTIME_CHECK(isc_condition_destroy(&sctx->cond)
 			      == ISC_R_SUCCESS);
@@ -337,7 +341,8 @@ sync_ctx_free(sync_ctx_t **sctxp) {
 	isc_refcount_destroy(&sctx->task_cnt);
 	UNLOCK(&sctx->mutex);
 
-	DESTROYLOCK(&(*sctxp)->mutex);
+	/* isc_mutex_destroy is void now */
+	isc_mutex_destroy(&(*sctxp)->mutex);
 	MEM_PUT_AND_DETACH(*sctxp);
 }
 

From efe16bb543b3f31a25030b4c188b5a9d27f0b4e7 Mon Sep 17 00:00:00 2001
From: Thomas Woerner <twoerner@redhat.com>
Date: Apr 22 2020 09:58:08 +0000
Subject: [PATCH 6/25] bind-9.16: Use reworked isc_refcount_ functions


isc_refcount_increment and isc_refcount_decrement now are returning the
second parameter. isc_refcount_increment0 has been removed,
isc_refcount_increment is used now in this case.

---

diff --git a/src/ldap_driver.c b/src/ldap_driver.c
index 7e0d84c..4c82af7 100644
--- a/src/ldap_driver.c
+++ b/src/ldap_driver.c
@@ -118,7 +118,8 @@ attach(dns_db_t *source, dns_db_t **targetp)
 
 	REQUIRE(VALID_LDAPDB(ldapdb));
 
-	isc_refcount_increment(&ldapdb->refs, NULL);
+	/* isc_refcount_increment only has one argument now */
+	isc_refcount_increment(&ldapdb->refs);
 	*targetp = source;
 }
 
@@ -167,7 +168,8 @@ detach(dns_db_t **dbp)
 
 	REQUIRE(VALID_LDAPDB(ldapdb));
 
-	isc_refcount_decrement(&ldapdb->refs, &refs);
+	/* isc_refcount_decrement only has one argument now */
+	refs = isc_refcount_decrement(&ldapdb->refs);
 
 	if (refs == 0)
 		free_ldapdb(ldapdb);
diff --git a/src/ldap_helper.c b/src/ldap_helper.c
index bedcfdf..0c5a149 100644
--- a/src/ldap_helper.c
+++ b/src/ldap_helper.c
@@ -4839,7 +4839,7 @@ ldap_instance_isexiting(ldap_instance_t *ldap_inst)
  * (if it is even possible). */
 void
 ldap_instance_taint(ldap_instance_t *ldap_inst) {
-	isc_refcount_increment0(&ldap_inst->errors, NULL);
+	isc_refcount_increment(&ldap_inst->errors);
 }
 
 bool
@@ -4870,7 +4870,8 @@ isc_result_t
 ldap_instance_untaint_finish(ldap_instance_t *ldap_inst, unsigned int count) {
 	unsigned int remaining = 0;
 	while (count > 0) {
-		isc_refcount_decrement(&ldap_inst->errors, &remaining);
+		/* isc_refcount_decrement now has one parameter */
+		remaining = isc_refcount_decrement(&ldap_inst->errors);
 		count--;
 	}
 	if (remaining != 0)
diff --git a/src/mldap.c b/src/mldap.c
index 51df185..1cd5f33 100644
--- a/src/mldap.c
+++ b/src/mldap.c
@@ -107,7 +107,7 @@ mldap_closeversion(mldapdb_t *mldap, bool commit) {
 void mldap_cur_generation_bump(mldapdb_t *mldap) {
 	REQUIRE(mldap != NULL);
 
-	isc_refcount_increment0(&mldap->generation, NULL);
+	isc_refcount_increment0(&mldap->generation);
 }
 
 /*
diff --git a/src/syncrepl.c b/src/syncrepl.c
index 83d7357..b17fafa 100644
--- a/src/syncrepl.c
+++ b/src/syncrepl.c
@@ -209,7 +209,8 @@ barrier_decrement(isc_task_t *task, isc_event_t *event) {
 	REQUIRE(event != NULL);
 
 	bev = (sync_barrierev_t *)event;
-	isc_refcount_decrement(&bev->sctx->task_cnt, &cnt);
+	/* isc_refcount_decrement now has one parameter */
+	cnt = isc_refcount_decrement(&bev->sctx->task_cnt);
 	if (cnt == 0) {
 		log_debug(1, "sync_barrier_wait(): barrier reached");
 		LOCK(&bev->sctx->mutex);
@@ -334,7 +335,7 @@ sync_ctx_free(sync_ctx_t **sctxp) {
 		next_taskel = NEXT(taskel, link);
 		UNLINK(sctx->tasks, taskel, link);
 		isc_task_detach(&taskel->task);
-		isc_refcount_decrement(&sctx->task_cnt, NULL);
+		isc_refcount_decrement(&sctx->task_cnt);
 		SAFE_MEM_PUT_PTR(sctx->mctx, taskel);
 	}
 	RUNTIME_CHECK(isc_condition_destroy(&sctx->cond) == ISC_R_SUCCESS);
@@ -465,7 +466,7 @@ sync_task_add(sync_ctx_t *sctx, isc_task_t *task) {
 	LOCK(&sctx->mutex);
 	REQUIRE(sctx->state == sync_configinit || sctx->state == sync_datainit);
 	ISC_LIST_APPEND(sctx->tasks, newel, link);
-	isc_refcount_increment0(&sctx->task_cnt, &cnt);
+	cnt = isc_refcount_increment0(&sctx->task_cnt);
 	UNLOCK(&sctx->mutex);
 
 	log_debug(2, "adding task %p to syncrepl list; %u tasks in list",

From 121310675178c6bc3006b1fed1f2da4ace1696dc Mon Sep 17 00:00:00 2001
From: Thomas Woerner <twoerner@redhat.com>
Date: Apr 22 2020 09:58:08 +0000
Subject: [PATCH 7/25] bind-9.16: isc_thread_ functions are void and failures are fatal


isc_thread_create and isc_thread_join are now void and failures are fatal.
There is no code right now to handle the failures gracefully in
bind-dyndb-ldap.

---

diff --git a/src/ldap_helper.c b/src/ldap_helper.c
index 0c5a149..729f2af 100644
--- a/src/ldap_helper.c
+++ b/src/ldap_helper.c
@@ -670,13 +670,16 @@ new_ldap_instance(isc_mem_t *mctx, const char *db_name, const char *parameters,
 			      mctx, &ldap_inst->db_imp));
 
 	/* Start the watcher thread */
-	result = isc_thread_create(ldap_syncrepl_watcher, ldap_inst,
-				   &ldap_inst->watcher);
-	if (result != ISC_R_SUCCESS) {
-		ldap_inst->watcher = 0;
-		log_error("Failed to create syncrepl watcher thread");
-		goto cleanup;
-	}
+	/* isc_thread_create assert internally on failure */
+	isc_thread_create(ldap_syncrepl_watcher, ldap_inst,
+			  &ldap_inst->watcher);
+	/*
+	 * if (result != ISC_R_SUCCESS) {
+	 *	ldap_inst->watcher = 0;
+	 *	log_error("Failed to create syncrepl watcher thread");
+	 *	goto cleanup;
+	 * }
+	 */
 
 cleanup:
 	if (forwarders_list != NULL)
@@ -718,8 +721,8 @@ ldap_syncrepl_watcher_shutdown(ldap_instance_t *ldap_inst)
 				  "(already terminated?)");
 	}
 
-	RUNTIME_CHECK(isc_thread_join(ldap_inst->watcher, NULL)
-		      == ISC_R_SUCCESS);
+	/* isc_thread_join assert internally on failure */
+	isc_thread_join(ldap_inst->watcher, NULL);
 }
 
 void

From 242f304820f4aee20714733611fe490e34147ebc Mon Sep 17 00:00:00 2001
From: Thomas Woerner <twoerner@redhat.com>
Date: Apr 22 2020 09:58:08 +0000
Subject: [PATCH 8/25] bind-9.16: Remove isc_ondestroy_init


The whole ondestroy callback mechanism has been unused and removed from
bind.

---

diff --git a/src/ldap_driver.c b/src/ldap_driver.c
index 4c82af7..1ff0c13 100644
--- a/src/ldap_driver.c
+++ b/src/ldap_driver.c
@@ -968,7 +968,8 @@ ldapdb_create(isc_mem_t *mctx, dns_name_t *name, dns_dbtype_t type,
 	isc_mutex_init(&ldapdb->newversion_lock);
 	lock_ready = true;
 	dns_name_init(&ldapdb->common.origin, NULL);
-	isc_ondestroy_init(&ldapdb->common.ondest);
+	/* Remove whole unused ondestroy callback mechanism */
+	/* isc_ondestroy_init(&ldapdb->common.ondest); */
 
 	ldapdb->common.magic = DNS_DB_MAGIC;
 	ldapdb->common.impmagic = LDAPDB_MAGIC;

From 788a28d281c48cddb3b008a10b373b6017bb556f Mon Sep 17 00:00:00 2001
From: Thomas Woerner <twoerner@redhat.com>
Date: Apr 22 2020 09:58:08 +0000
Subject: [PATCH 9/25] bind-9.16: Handle dns_db_rpz_ deprecations


dns_db_rpz_attach has been deprecated. It has been replaced by alternative
code. dns_db_rpz_ready has been depreacted, it has been commented out.

---

diff --git a/src/ldap_driver.c b/src/ldap_driver.c
index 1ff0c13..e127e38 100644
--- a/src/ldap_driver.c
+++ b/src/ldap_driver.c
@@ -30,6 +30,7 @@
 #include <dns/result.h>
 #include <dns/soa.h>
 #include <dns/types.h>
+#include <dns/rpz.h>
 
 #include <string.h> /* For memcpy */
 
@@ -747,15 +748,22 @@ getrrsetstats(dns_db_t *db) {
 }
 
 void
-rpz_attach(dns_db_t *db, dns_rpz_zones_t *rpzs, dns_rpz_num_t rpz_num)
+rpz_attach(dns_db_t *db, void *void_rpzs, uint8_t rpz_num)
 {
 	ldapdb_t *ldapdb = (ldapdb_t *) db;
+	dns_rpz_zones_t *rpzs = (dns_rpz_zones_t *) void_rpzs;
+	isc_result_t result;
 
 	REQUIRE(VALID_LDAPDB(ldapdb));
 
-	dns_db_rpz_attach(ldapdb->rbtdb, rpzs, rpz_num);
+	rpzs->zones[rpz_num]->db_registered = true;
+	result = dns_db_updatenotify_register(ldapdb->rbtdb,
+					      dns_rpz_dbupdate_callback,
+					      rpzs->zones[rpz_num]);
+	REQUIRE(result == ISC_R_SUCCESS);
 }
 
+/*
 isc_result_t
 rpz_ready(dns_db_t *db)
 {
@@ -765,6 +773,7 @@ rpz_ready(dns_db_t *db)
 
 	return dns_db_rpz_ready(ldapdb->rbtdb);
 }
+*/
 
 static isc_result_t
 findnodeext(dns_db_t *db, dns_name_t *name,
@@ -864,7 +873,7 @@ static dns_dbmethods_t ldapdb_methods = {
 	isdnssec,
 	getrrsetstats,
 	rpz_attach,
-	rpz_ready,
+	NULL, /* rpz_ready */
 	findnodeext,
 	findext,
 	setcachestats,

From 1e85003f178575125592633984ac15641b4a7991 Mon Sep 17 00:00:00 2001
From: Thomas Woerner <twoerner@redhat.com>
Date: Apr 22 2020 09:58:08 +0000
Subject: [PATCH 10/25] bind-9.16: STATIC_ASSERT is now provided by isc/util.h


STATIC_ASSERT is now provided by isc/util.h, therefore the defines in
src/util.h have been removed.

---

diff --git a/src/util.h b/src/util.h
index b69c9b7..63ec058 100644
--- a/src/util.h
+++ b/src/util.h
@@ -136,19 +136,7 @@ extern bool verbose_checks; /* from settings.c */
  * and this notice are preserved. This code is offered as-is,
  * without any warranty.
  */
-#define ASSERT_CONCAT_(a, b) a##b
-#define ASSERT_CONCAT(a, b) ASSERT_CONCAT_(a, b)
-/* These can't be used after statements in c89. */
-#ifdef __COUNTER__
-  #define STATIC_ASSERT(e, m) \
-    ;enum { ASSERT_CONCAT(static_assert_, __COUNTER__) = 1/(!!(e)) }
-#else
-  /* This can't be used twice on the same line so ensure if using in headers
-   * that the headers are not included twice (by wrapping in #ifndef...#endif)
-   * Note it doesn't cause an issue when used on same line of separate modules
-   * compiled with gcc -combine -fwhole-program.  */
-  #define STATIC_ASSERT(e, m) \
-    ;enum { ASSERT_CONCAT(assert_line_, __LINE__) = 1/(!!(e)) }
-#endif
+
+/* STATIC_ASSERT is now provided by isc/util.h */
 
 #endif /* !_LD_UTIL_H_ */

From bbb7a2e659dfaad1c779f84dddaa224a353d0eb7 Mon Sep 17 00:00:00 2001
From: Thomas Woerner <twoerner@redhat.com>
Date: Apr 22 2020 09:58:08 +0000
Subject: [PATCH 11/25] bind-9.16: Use const for dns_name_t root name


dns_name_t root name needs to be const now.

---

diff --git a/src/empty_zones.c b/src/empty_zones.c
index e9027d5..4022f83 100644
--- a/src/empty_zones.c
+++ b/src/empty_zones.c
@@ -226,7 +226,7 @@ empty_zone_search_stop(empty_zone_search_t *iter) {
  * @returns @see empty_zone_search_next
  */
 isc_result_t
-empty_zone_search_init(empty_zone_search_t *iter, dns_name_t *qname,
+empty_zone_search_init(empty_zone_search_t *iter, const dns_name_t *qname,
                        dns_zt_t *ztable) {
 	isc_result_t result;
 
@@ -298,7 +298,7 @@ cleanup:
  *    it failed and user configured policy != only.
  */
 isc_result_t
-empty_zone_handle_conflicts(dns_name_t *name, dns_zt_t *zonetable,
+empty_zone_handle_conflicts(const dns_name_t *name, dns_zt_t *zonetable,
 			    bool warn_only)
 {
 	isc_result_t result;
diff --git a/src/empty_zones.h b/src/empty_zones.h
index 024904e..83a8a24 100644
--- a/src/empty_zones.h
+++ b/src/empty_zones.h
@@ -21,11 +21,11 @@ void
 empty_zone_search_stop(empty_zone_search_t *iter) ATTR_NONNULLS;
 
 isc_result_t
-empty_zone_search_init(empty_zone_search_t *iter, dns_name_t *qname,
+empty_zone_search_init(empty_zone_search_t *iter, const dns_name_t *qname,
 		       dns_zt_t *ztable) ATTR_NONNULLS ATTR_CHECKRESULT;
 
 isc_result_t
-empty_zone_handle_conflicts(dns_name_t *name, dns_zt_t *zonetable,
+empty_zone_handle_conflicts(const dns_name_t *name, dns_zt_t *zonetable,
 			    bool warn_only) ATTR_NONNULLS ATTR_CHECKRESULT;
 
 /* Trigger to execute empty_zone_handle_conflicts() for dns_rootname. */
diff --git a/src/fwd.c b/src/fwd.c
index ad27b28..37e55e9 100644
--- a/src/fwd.c
+++ b/src/fwd.c
@@ -491,7 +491,7 @@ cleanup:
  */
 isc_result_t
 fwd_configure_zone(const settings_set_t *set, ldap_instance_t *inst,
-		   dns_name_t *name)
+		   const dns_name_t *name)
 {
 	isc_result_t result;
 	isc_mem_t *mctx = NULL;
@@ -604,7 +604,7 @@ cleanup:
 }
 
 isc_result_t
-fwd_delete_table(dns_view_t *view, dns_name_t *name,
+fwd_delete_table(dns_view_t *view, const dns_name_t *name,
 		 const char *msg_obj_type, const char *logname) {
 	isc_result_t result;
 
diff --git a/src/fwd.h b/src/fwd.h
index 8416d95..9567c83 100644
--- a/src/fwd.h
+++ b/src/fwd.h
@@ -26,11 +26,11 @@ fwd_parse_ldap(ldap_entry_t *entry, settings_set_t *set)
 	       ATTR_NONNULLS ATTR_CHECKRESULT;
 
 isc_result_t
-fwd_configure_zone(const settings_set_t *set, ldap_instance_t *inst, dns_name_t *name)
+fwd_configure_zone(const settings_set_t *set, ldap_instance_t *inst, const dns_name_t *name)
 		   ATTR_NONNULLS ATTR_CHECKRESULT;
 
 isc_result_t
-fwd_delete_table(dns_view_t *view, dns_name_t *name,
+fwd_delete_table(dns_view_t *view, const dns_name_t *name,
 		 const char *msg_obj_type, const char *logname)
 		 ATTR_NONNULLS ATTR_CHECKRESULT;
 
diff --git a/src/ldap_driver.c b/src/ldap_driver.c
index e127e38..bd46877 100644
--- a/src/ldap_driver.c
+++ b/src/ldap_driver.c
@@ -325,7 +325,7 @@ closeversion(dns_db_t *db, dns_dbversion_t **versionp, bool commit)
 }
 
 static isc_result_t
-findnode(dns_db_t *db, dns_name_t *name, bool create,
+findnode(dns_db_t *db, const dns_name_t *name, bool create,
 	 dns_dbnode_t **nodep)
 {
 	ldapdb_t *ldapdb = (ldapdb_t *) db;
@@ -336,7 +336,7 @@ findnode(dns_db_t *db, dns_name_t *name, bool create,
 }
 
 static isc_result_t
-find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
+find(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
      dns_rdatatype_t type, unsigned int options, isc_stdtime_t now,
      dns_dbnode_t **nodep, dns_name_t *foundname, dns_rdataset_t *rdataset,
      dns_rdataset_t *sigrdataset)
@@ -350,7 +350,7 @@ find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
 }
 
 static isc_result_t
-findzonecut(dns_db_t *db, dns_name_t *name, unsigned int options,
+findzonecut(dns_db_t *db, const dns_name_t *name, unsigned int options,
 	    isc_stdtime_t now, dns_dbnode_t **nodep, dns_name_t *foundname,
 	    dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset)
 {
@@ -686,7 +686,7 @@ getnsec3parameters(dns_db_t *db, dns_dbversion_t *version,
 }
 
 static isc_result_t
-findnsec3node(dns_db_t *db, dns_name_t *name, bool create,
+findnsec3node(dns_db_t *db, const dns_name_t *name, bool create,
 	      dns_dbnode_t **nodep)
 {
 	ldapdb_t *ldapdb = (ldapdb_t *) db;
@@ -776,7 +776,7 @@ rpz_ready(dns_db_t *db)
 */
 
 static isc_result_t
-findnodeext(dns_db_t *db, dns_name_t *name,
+findnodeext(dns_db_t *db, const dns_name_t *name,
 		   bool create, dns_clientinfomethods_t *methods,
 		   dns_clientinfo_t *clientinfo, dns_dbnode_t **nodep)
 {
@@ -789,7 +789,7 @@ findnodeext(dns_db_t *db, dns_name_t *name,
 }
 
 static isc_result_t
-findext(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
+findext(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
 	       dns_rdatatype_t type, unsigned int options, isc_stdtime_t now,
 	       dns_dbnode_t **nodep, dns_name_t *foundname,
 	       dns_clientinfomethods_t *methods, dns_clientinfo_t *clientinfo,
@@ -929,7 +929,7 @@ dns_ns_buildrdata(dns_name_t *origin, dns_name_t *ns_name,
  * @param[in] argv [0] is database instance name
  */
 isc_result_t
-ldapdb_associate(isc_mem_t *mctx, dns_name_t *name, dns_dbtype_t type,
+ldapdb_associate(isc_mem_t *mctx, const dns_name_t *name, dns_dbtype_t type,
 		 dns_rdataclass_t rdclass, unsigned int argc, char *argv[],
 		 void *driverarg, dns_db_t **dbp) {
 
diff --git a/src/ldap_driver.h b/src/ldap_driver.h
index 62d50f6..5a21524 100644
--- a/src/ldap_driver.h
+++ b/src/ldap_driver.h
@@ -23,7 +23,7 @@ ldapdb_create(isc_mem_t *mctx, dns_name_t *name, dns_dbtype_t type,
 	      ATTR_NONNULL(1,2,5,6);
 
 isc_result_t
-ldapdb_associate(isc_mem_t *mctx, dns_name_t *name, dns_dbtype_t type,
+ldapdb_associate(isc_mem_t *mctx, const dns_name_t *name, dns_dbtype_t type,
 		 dns_rdataclass_t rdclass, unsigned int argc, char *argv[],
 		 void *driverarg, dns_db_t **dbp) ATTR_NONNULL(1,2,7,8);
 dns_db_t *
diff --git a/src/zone_register.c b/src/zone_register.c
index e31d5e8..205c7cd 100644
--- a/src/zone_register.c
+++ b/src/zone_register.c
@@ -341,7 +341,9 @@ delete_zone_info(void *arg1, void *arg2)
  * @pre Zone registed is locked.
  */
 static isc_result_t
-getzinfo(zone_register_t * const zr, dns_name_t *name, zone_info_t **zinfo) {
+getzinfo(zone_register_t * const zr, const dns_name_t *name,
+	 zone_info_t **zinfo)
+{
 	isc_result_t result;
 	void *data = NULL;
 
@@ -438,8 +440,8 @@ cleanup:
  * Either ldapdbp or rbtdbp can be NULL.
  */
 isc_result_t
-zr_get_zone_dbs(zone_register_t *zr, dns_name_t *name, dns_db_t **ldapdbp,
-		dns_db_t **rbtdbp)
+zr_get_zone_dbs(zone_register_t *zr, const dns_name_t *name,
+		dns_db_t **ldapdbp, dns_db_t **rbtdbp)
 {
 	isc_result_t result;
 	zone_info_t *zinfo = NULL;
@@ -539,7 +541,8 @@ zr_get_zone_ptr(zone_register_t * const zr, dns_name_t * const name,
  * 'set'.
  */
 isc_result_t
-zr_get_zone_settings(zone_register_t *zr, dns_name_t *name, settings_set_t **set)
+zr_get_zone_settings(zone_register_t *zr, const dns_name_t *name,
+	             settings_set_t **set)
 {
 	isc_result_t result;
 	zone_info_t *zinfo = NULL;
diff --git a/src/zone_register.h b/src/zone_register.h
index 699f8ca..9d13bb6 100644
--- a/src/zone_register.h
+++ b/src/zone_register.h
@@ -28,7 +28,7 @@ isc_result_t
 zr_del_zone(zone_register_t *zr, dns_name_t *origin) ATTR_NONNULLS ATTR_CHECKRESULT;
 
 isc_result_t
-zr_get_zone_dbs(zone_register_t *zr, dns_name_t *name, dns_db_t **ldapdbp,
+zr_get_zone_dbs(zone_register_t *zr, const dns_name_t *name, dns_db_t **ldapdbp,
 		dns_db_t **rbtdbp) ATTR_NONNULL(1, 2) ATTR_CHECKRESULT;
 
 isc_result_t
@@ -40,7 +40,7 @@ zr_get_zone_ptr(zone_register_t * const zr, dns_name_t * const name,
 		ATTR_NONNULL(1,2,3) ATTR_CHECKRESULT;
 
 isc_result_t
-zr_get_zone_settings(zone_register_t *zr, dns_name_t *name, settings_set_t **set) ATTR_NONNULLS ATTR_CHECKRESULT;
+zr_get_zone_settings(zone_register_t *zr, const dns_name_t *name, settings_set_t **set) ATTR_NONNULLS ATTR_CHECKRESULT;
 
 isc_result_t
 zr_get_zone_path(isc_mem_t *mctx, settings_set_t *settings,

From 060c96c60e507122035ca3161bb03573f26716dc Mon Sep 17 00:00:00 2001
From: Thomas Woerner <twoerner@redhat.com>
Date: Apr 22 2020 09:58:08 +0000
Subject: [PATCH 12/25] bind-9.16: dns_view_flushcache has an additional parameter


Because of the libdns refactoring there is only one version of
dns_view_flushcache now. Therefore there is the additional parameter
fixuponly now.

---

diff --git a/src/fwd.c b/src/fwd.c
index 37e55e9..f2aa426 100644
--- a/src/fwd.c
+++ b/src/fwd.c
@@ -579,7 +579,7 @@ fwd_configure_zone(const settings_set_t *set, ldap_instance_t *inst,
 		CHECK(dns_fwdtable_addfwd(view->fwdtable, name, &fwdrs,
 					  fwdpolicy));
 	}
-	dns_view_flushcache(view);
+	dns_view_flushcache(view, false);
 	run_exclusive_exit(inst, lock_state);
 	lock_state = ISC_R_IGNORE; /* prevent double-unlock */
 	log_debug(5, "%s %s: forwarder table was updated: %s",

From 7c79245ac3112c54c4afdeb64b9f2bd2e86ba272 Mon Sep 17 00:00:00 2001
From: Thomas Woerner <twoerner@redhat.com>
Date: Apr 22 2020 09:58:08 +0000
Subject: [PATCH 13/25] bind-9.16: dns_rbtnodechain_init has only one parameter


dns_rbtnodechain_init has been simplified by removing the unnecessary
'mctx' parameter.

---

diff --git a/src/rbt_helper.c b/src/rbt_helper.c
index f610b07..2333d96 100644
--- a/src/rbt_helper.c
+++ b/src/rbt_helper.c
@@ -91,7 +91,7 @@ rbt_iter_first(isc_mem_t *mctx, dns_rbt_t *rbt, isc_rwlock_t *rwlock,
 	ZERO_PTR(iter);
 
 	isc_mem_attach(mctx, &iter->mctx);
-	dns_rbtnodechain_init(&iter->chain, mctx);
+	dns_rbtnodechain_init(&iter->chain);
 	iter->rbt = rbt;
 	iter->rwlock = rwlock;
 	iter->locktype = isc_rwlocktype_read;

From 6e8112c282df5f5dd3bdd3d044a6ee827cb4ad05 Mon Sep 17 00:00:00 2001
From: Thomas Woerner <twoerner@redhat.com>
Date: Apr 22 2020 09:58:08 +0000
Subject: [PATCH 14/25] bind-9.16: isc_refcount_t is now atomic_uint_fast32_t only


isc_refcount_t is now using the fixed type atomic_uint_fast32_t. It is not
a struct anymore.

---

diff --git a/src/mldap.c b/src/mldap.c
index 1cd5f33..eb72537 100644
--- a/src/mldap.c
+++ b/src/mldap.c
@@ -118,17 +118,12 @@ void mldap_cur_generation_bump(mldapdb_t *mldap) {
  * isc_refcount_t abstractions and returns underlying type used for storing the
  * reference counter value.
  */
-STATIC_ASSERT((uint32_t)
-		(typeof(((isc_refcount_t *)0)->refs))
-		-1
-	      == 0xFFFFFFFF, \
-	      "negative isc_refcount_t cannot be properly shortened to 32 bits");
 
-STATIC_ASSERT((uint32_t)
-		(typeof(((isc_refcount_t *)0)->refs))
-		0x90ABCDEF12345678
-	      == 0x12345678, \
-	      "positive isc_refcount_t cannot be properly shortened to 32 bits");
+/* isc_refcount_t is simply atomic_uint_fast32_t now */
+STATIC_ASSERT((uint32_t)((isc_refcount_t) -1) == 0xFFFFFFFF, \
+	      "negative isc_refcount_t cannot be properly shortened to 32 bits");
+STATIC_ASSERT((uint32_t)((isc_refcount_t) 0x90ABCDEF12345678) == 0x12345678, \
+	      "negative isc_refcount_t cannot be properly shortened to 32 bits");
 
 /**
  * Get current MetaLDAP generation number.

From 90faeea98c11d1d491ebb679e4786dc327ce4321 Mon Sep 17 00:00:00 2001
From: Thomas Woerner <twoerner@redhat.com>
Date: Apr 22 2020 09:58:08 +0000
Subject: [PATCH 15/25] bind-9.16: dns_zone_setdbtype is now void


dns_zone_setdbtype is now void as it could no longer return anything.
Calls to it no longer check for a result.

---

diff --git a/src/ldap_helper.c b/src/ldap_helper.c
index 729f2af..0876961 100644
--- a/src/ldap_helper.c
+++ b/src/ldap_helper.c
@@ -1003,8 +1003,9 @@ create_zone(ldap_instance_t * const inst, const char * const dn,
 	dns_zone_setclass(raw, dns_rdataclass_in);
 	dns_zone_settype(raw, dns_zone_master);
 	/* dns_zone_setview(raw, view); */
-	CHECK(dns_zone_setdbtype(raw, sizeof(ldap_argv)/sizeof(ldap_argv[0]),
-				 ldap_argv));
+	/* dns_zone_setdbtype is now void as it could no longer return */
+	dns_zone_setdbtype(raw, sizeof(ldap_argv)/sizeof(ldap_argv[0]),
+			   ldap_argv);
 	CHECK(configure_paths(inst->mctx, inst, raw, false));
 
 	if (want_secure == false) {
@@ -1016,7 +1017,9 @@ create_zone(ldap_instance_t * const inst, const char * const dn,
 		dns_zone_setclass(secure, dns_rdataclass_in);
 		dns_zone_settype(secure, dns_zone_master);
 		/* dns_zone_setview(secure, view); */
-		CHECK(dns_zone_setdbtype(secure, 1, rbt_argv));
+		/* dns_zone_setdbtype is now void as it could no longer
+		 * return */
+		dns_zone_setdbtype(secure, 1, rbt_argv);
 		CHECK(dns_zonemgr_managezone(inst->zmgr, secure));
 		CHECK(dns_zone_link(secure, raw));
 		dns_zone_rekey(secure, true);

From a165d7b2d21664d936522e7078fedc18dee1b977 Mon Sep 17 00:00:00 2001
From: Thomas Woerner <twoerner@redhat.com>
Date: Apr 22 2020 09:58:08 +0000
Subject: [PATCH 16/25] bind-9.16: Use dns_zone_getserial instead of dns_zone_getserial2


Because of the libdns refactoring there is only one version of
dns_zone_getserial now.

---

diff --git a/src/ldap_helper.c b/src/ldap_helper.c
index 0876961..0ccba9c 100644
--- a/src/ldap_helper.c
+++ b/src/ldap_helper.c
@@ -1083,11 +1083,11 @@ load_zone(dns_zone_t *zone, bool log) {
 		zone = NULL;
 	}
 
-	CHECK(dns_zone_getserial2(raw, &serial));
+	CHECK(dns_zone_getserial(raw, &serial));
 	if (log == true)
 		dns_zone_log(raw, ISC_LOG_INFO, "loaded serial %u", serial);
 	if (zone != NULL) {
-		result = dns_zone_getserial2(zone, &serial);
+		result = dns_zone_getserial(zone, &serial);
 		if (result == ISC_R_SUCCESS && log == true)
 			dns_zone_log(zone, ISC_LOG_INFO, "loaded serial %u",
 				     serial);
@@ -3994,7 +3994,7 @@ update_restart:
 	/* Check if the zone is loaded or not.
 	 * No other function above returns DNS_R_NOTLOADED. */
 	if (sync_state == sync_finished)
-		result = dns_zone_getserial2(raw, &serial);
+		result = dns_zone_getserial(raw, &serial);
 
 cleanup:
 #ifdef RBTDB_DEBUG
@@ -4031,7 +4031,7 @@ cleanup:
 				     "caused by change in %s",
 				     ldap_entry_logname(entry));
 			zone_reloaded = true;
-			result = dns_zone_getserial2(raw, &serial);
+			result = dns_zone_getserial(raw, &serial);
 			if (result == ISC_R_SUCCESS)
 				goto update_restart;
 		} else {

From 04f01ef40dad57325f6ef3a99699b025f9bc69a0 Mon Sep 17 00:00:00 2001
From: Thomas Woerner <twoerner@redhat.com>
Date: Apr 22 2020 09:58:08 +0000
Subject: [PATCH 17/25] bind-9.16: Use dns_byaddr_createptrname instead of dns_byaddr_createptrname2


Because of the libdns refactoring there is only one version of
dns_byaddr_createptrname.

---

diff --git a/src/syncptr.c b/src/syncptr.c
index 0c3743d..a0a9ff2 100644
--- a/src/syncptr.c
+++ b/src/syncptr.c
@@ -134,7 +134,7 @@ sync_ptr_find(dns_zt_t *zonetable, zone_register_t *zone_register, const int af,
 	 * @example
 	 * 192.168.0.1 -> 1.0.168.192.in-addr.arpa
 	 */
-	CHECK(dns_byaddr_createptrname2(&isc_ip, 0, ptr_name));
+	CHECK(dns_byaddr_createptrname(&isc_ip, 0, ptr_name));
 
 	/* Find an active zone containing owner name of the PTR record. */
 	result = dns_zt_find(zonetable, ptr_name, 0, NULL, zone);

From 18b0ee6d530d08c360230ad80273be0710a8feeb Mon Sep 17 00:00:00 2001
From: Thomas Woerner <twoerner@redhat.com>
Date: Apr 22 2020 09:58:08 +0000
Subject: [PATCH 18/25] bind-9.16: cfg_print_grammar has additional parameter


bind9 changelog: update docbook grammar, removing dnssec-looksaide

---

diff --git a/src/settings.c b/src/settings.c
index a6a8583..4dbcc91 100644
--- a/src/settings.c
+++ b/src/settings.c
@@ -705,7 +705,7 @@ setting_set_parse_conf(isc_mem_t *mctx, const char *name,
 		log_error("configuration for dyndb instance '%s' "
 			  "(starting in file %s on line %lu) is invalid",
 			  name, file, line);
-		cfg_print_grammar(cfg_type_conf, cfg_printer, log_buf);
+		cfg_print_grammar(cfg_type_conf, 0, cfg_printer, log_buf);
 		log_info("expected grammar:\n"
 			 "%.*s", isc_buffer_usedlength(log_buf),
 			 (char *)isc_buffer_base(log_buf));

From 1552cf997218a9822d931e7f797ec9b9fc083d90 Mon Sep 17 00:00:00 2001
From: Thomas Woerner <twoerner@redhat.com>
Date: Apr 22 2020 09:58:08 +0000
Subject: [PATCH 19/25] bind-9.16: dns_fwdtable_find has additional parameter


dns_fwdtable_find has the additional parameter foundname now.

---

diff --git a/src/ldap_helper.c b/src/ldap_helper.c
index 0ccba9c..9dc83d1 100644
--- a/src/ldap_helper.c
+++ b/src/ldap_helper.c
@@ -579,7 +579,7 @@ new_ldap_instance(isc_mem_t *mctx, const char *db_name, const char *parameters,
 	/* copy global forwarders setting for configuration roll back in
 	 * configure_zone_forwarders() */
 	result = dns_fwdtable_find(ldap_inst->view->fwdtable, dns_rootname,
-				   &named_conf_forwarders);
+				   NULL, &named_conf_forwarders);
 	if (result == ISC_R_SUCCESS) {
 		/* Copy forwarding config from named.conf into local_settings */
 		CHECK(fwd_print_list_buff(mctx, named_conf_forwarders,

From 51042a2c6906704878f9b1218cdf210b97350ea3 Mon Sep 17 00:00:00 2001
From: Thomas Woerner <twoerner@redhat.com>
Date: Apr 22 2020 09:58:08 +0000
Subject: [PATCH 20/25] bins-9.16: dns_zone_setfile has additional parameters


Because of the libdns refactoring there is only one version of
dns_zone_setfile with addtional parameters format and style.

dns_masterformat_text and dns_master_style_default are used as the
default.

---

diff --git a/src/ldap_helper.c b/src/ldap_helper.c
index 9dc83d1..d45a8d6 100644
--- a/src/ldap_helper.c
+++ b/src/ldap_helper.c
@@ -954,7 +954,8 @@ configure_paths(isc_mem_t *mctx, ldap_instance_t *inst, dns_zone_t *zone,
 	CHECK(zr_get_zone_path(mctx, ldap_instance_getsettings_local(inst),
 			       dns_zone_getorigin(zone),
 			       (issecure ? "signed" : "raw"), &file_name));
-	CHECK(dns_zone_setfile(zone, str_buf(file_name)));
+	CHECK(dns_zone_setfile(zone, str_buf(file_name), dns_masterformat_text,
+			       &dns_master_style_default));
 	if (issecure == true) {
 		CHECK(zr_get_zone_path(mctx,
 				       ldap_instance_getsettings_local(inst),

From 83983d09b0288ed1c6962f1d0094fa2e87e8e902 Mon Sep 17 00:00:00 2001
From: Thomas Woerner <twoerner@redhat.com>
Date: Apr 22 2020 09:58:08 +0000
Subject: [PATCH 21/25] bind-9.16: dns_zone_load has additional parameter


rndc reconfig should not touch already loaded zones, some refactoring of dns
_{zone,view,zt}_{async,}load happened in bind9.

---

diff --git a/src/ldap_helper.c b/src/ldap_helper.c
index d45a8d6..33d8b28 100644
--- a/src/ldap_helper.c
+++ b/src/ldap_helper.c
@@ -1072,7 +1072,7 @@ load_zone(dns_zone_t *zone, bool log) {
 	uint32_t serial;
 	dns_zone_t *raw = NULL;
 
-	result = dns_zone_load(zone);
+	result = dns_zone_load(zone, false);
 	if (result != ISC_R_SUCCESS && result != DNS_R_UPTODATE
 	    && result != DNS_R_DYNAMIC && result != DNS_R_CONTINUE)
 		goto cleanup;

From 0c81e5196955ec484edfca5d4ef12f502d16838b Mon Sep 17 00:00:00 2001
From: Thomas Woerner <twoerner@redhat.com>
Date: Apr 22 2020 09:58:08 +0000
Subject: [PATCH 22/25] bind-9.16: findzonecut and dns_db_findzonecut has additional parameter


bind9 commit:
QNAME miminimization should create a separate fetch context for each fetch -
this makes the cache more efficient and eliminates duplicates queries.

---

diff --git a/src/ldap_driver.c b/src/ldap_driver.c
index bd46877..84ac821 100644
--- a/src/ldap_driver.c
+++ b/src/ldap_driver.c
@@ -352,14 +352,15 @@ find(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
 static isc_result_t
 findzonecut(dns_db_t *db, const dns_name_t *name, unsigned int options,
 	    isc_stdtime_t now, dns_dbnode_t **nodep, dns_name_t *foundname,
-	    dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset)
+	    dns_name_t *dcname, dns_rdataset_t *rdataset,
+	    dns_rdataset_t *sigrdataset)
 {
 	ldapdb_t *ldapdb = (ldapdb_t *) db;
 
 	REQUIRE(VALID_LDAPDB(ldapdb));
 
 	return dns_db_findzonecut(ldapdb->rbtdb, name, options, now, nodep,
-				  foundname, rdataset, sigrdataset);
+				  foundname, dcname, rdataset, sigrdataset);
 }
 
 static void

From b9fbd0efe3299c76e81616334771baf7fb2d5497 Mon Sep 17 00:00:00 2001
From: Thomas Woerner <twoerner@redhat.com>
Date: Apr 22 2020 09:58:08 +0000
Subject: [PATCH 23/25] bind-9.16: dns_dbmethods_t has three more entries


setservestalettl and getservestalettl has been added to be able to allow
named to provide stale cached answers when the authoritative server is
under attack.

setgluecachestats has been added to add statistics for glue cache usage.

---

diff --git a/src/ldap_driver.c b/src/ldap_driver.c
index 84ac821..83a1b78 100644
--- a/src/ldap_driver.c
+++ b/src/ldap_driver.c
@@ -881,6 +881,9 @@ static dns_dbmethods_t ldapdb_methods = {
 	hashsize,
 	nodefullname,
 	NULL, // getsize method not implemented (related BZ1353563)
+	NULL, /* setservestalettl */
+	NULL, /* getservestalettl */
+	NULL /* setgluecachestats */
 };
 
 isc_result_t ATTR_NONNULLS

From 3e73da1db35301daa78ba1f32ef39e001a084b63 Mon Sep 17 00:00:00 2001
From: Thomas Woerner <twoerner@redhat.com>
Date: Apr 22 2020 09:58:08 +0000
Subject: [PATCH 24/25] isc-bind 9.16: Temporary define HAVE_TLS and HAVE_THREAD_LOCAL


As the isc-bind is not containing the config.h file, HAVE_TLS and
HAVE_THREAD_LOCAL are not defined, but they are needed to be able to
include isc/thread.h.

---

diff --git a/src/ldap_helper.c b/src/ldap_helper.c
index 33d8b28..b6fca3e 100644
--- a/src/ldap_helper.c
+++ b/src/ldap_helper.c
@@ -3,6 +3,8 @@
  */
 
 #include "config.h"
+#define HAVE_TLS 1
+#define HAVE_THREAD_LOCAL 1
 
 #include <dns/dyndb.h>
 #include <dns/diff.h>

From 581177d5f2f2816e89d1c8a49a81623368083cbc Mon Sep 17 00:00:00 2001
From: Thomas Woerner <twoerner@redhat.com>
Date: Apr 24 2020 08:38:00 +0000
Subject: [PATCH 25/25] bind-9.16: Use dns_name_copynf(...) for RUNTIME_CHECK(dns_name_copy(..., NULL))


This is bind9 upstream change c2dad0dcb2523a7711380e4409144745231b5282

Replace RUNTIME_CHECK(dns_name_copy(..., NULL)) with dns_name_copynf()

Use the semantic patch from the previous commit to replace all the calls to
dns_name_copy() with NULL as third argument with dns_name_copynf().

---

diff --git a/src/empty_zones.c b/src/empty_zones.c
index 4022f83..24a344e 100644
--- a/src/empty_zones.c
+++ b/src/empty_zones.c
@@ -228,13 +228,11 @@ empty_zone_search_stop(empty_zone_search_t *iter) {
 isc_result_t
 empty_zone_search_init(empty_zone_search_t *iter, const dns_name_t *qname,
                        dns_zt_t *ztable) {
-	isc_result_t result;
-
 	REQUIRE(iter != NULL);
 	REQUIRE(dns_name_isabsolute(qname));
 
 	INIT_BUFFERED_NAME(iter->qname);
-	CHECK(dns_name_copy(qname, &iter->qname, NULL));
+	dns_name_copynf(qname, &iter->qname);
 
 	INIT_BUFFERED_NAME(iter->ezname);
 	iter->nextidx = 0;
@@ -243,9 +241,6 @@ empty_zone_search_init(empty_zone_search_t *iter, const dns_name_t *qname,
 	dns_zt_attach(ztable, &iter->zonetable);
 
 	return empty_zone_search_next(iter);
-
-cleanup:
-	return result;
 }
 
 /**
diff --git a/src/ldap_convert.c b/src/ldap_convert.c
index 93beff6..9a67256 100644
--- a/src/ldap_convert.c
+++ b/src/ldap_convert.c
@@ -131,7 +131,7 @@ dn_to_dnsname(isc_mem_t *mctx, const char *dn_str, dns_name_t *target,
 	} else if (idx == 1) { /* zone only */
 		if (iszone != NULL)
 			*iszone = true;
-		CHECK(dns_name_copy(dns_rootname, &origin, NULL));
+		dns_name_copynf(dns_rootname, &origin);
 		CHECK(dns_name_fromtext(&name, &name_buf, dns_rootname, 0, NULL));
 	} else if (idx == 2) { /* owner and zone */
 		if (iszone != NULL)
diff --git a/src/mldap.c b/src/mldap.c
index eb72537..b87fe30 100644
--- a/src/mldap.c
+++ b/src/mldap.c
@@ -322,8 +322,8 @@ mldap_dnsname_get(metadb_node_t *node, dns_name_t *fqdn, dns_name_t *zone) {
 	CHECK(metadb_rdataset_get(node, dns_rdatatype_rp, &rdataset));
 	dns_rdataset_current(&rdataset, &rdata);
 	CHECK(dns_rdata_tostruct(&rdata, &rp, NULL));
-	CHECK(dns_name_copy(&rp.mail, fqdn, NULL));
-	CHECK(dns_name_copy(&rp.text, zone, NULL));
+	dns_name_copynf(&rp.mail, fqdn);
+	dns_name_copynf(&rp.text, zone);
 
 cleanup:
 	if (dns_rdataset_isassociated(&rdataset))
diff --git a/src/syncptr.c b/src/syncptr.c
index a0a9ff2..eca4458 100644
--- a/src/syncptr.c
+++ b/src/syncptr.c
@@ -399,7 +399,7 @@ sync_ptr_init(isc_mem_t *mctx, dns_zt_t * zonetable,
 	isc_mem_attach(mctx, &ev->mctx);
 	INIT_BUFFERED_NAME(ev->a_name);
 	INIT_BUFFERED_NAME(ev->ptr_name);
-	CHECK(dns_name_copy(a_name, &ev->a_name, NULL));
+	dns_name_copynf(a_name, &ev->a_name);
 	ev->mod_op = mod_op;
 	strncpy(ev->ip_str, ip_str, sizeof(ev->ip_str));
 	ev->ip_str[sizeof(ev->ip_str) - 1] = '\0';