From 079eeddb247d8c7d05500d4af7ffb1ee77a4dd79 Mon Sep 17 00:00:00 2001
From: Petr Menšík <pemensik@redhat.com>
Date: Jun 29 2017 09:55:04 +0000
Subject: Merge branch 'f25' into f24


---

diff --git a/.gitignore b/.gitignore
index ab05118..0999da3 100644
--- a/.gitignore
+++ b/.gitignore
@@ -71,3 +71,4 @@ bind-9.7.2b1.tar.gz
 /bind-9.10.4-P6.tar.gz
 /config-16.tar.bz2
 /bind-9.10.4-P8.tar.gz
+/bind-9.10.5-P1.tar.gz
diff --git a/bind-9.10-dist-native-pkcs11.patch b/bind-9.10-dist-native-pkcs11.patch
index d531cc2..1cd165b 100644
--- a/bind-9.10-dist-native-pkcs11.patch
+++ b/bind-9.10-dist-native-pkcs11.patch
@@ -12,14 +12,14 @@ index e3aeffb..7654169 100644
  TARGETS =
  
 diff --git a/bin/dnssec-pkcs11/Makefile.in b/bin/dnssec-pkcs11/Makefile.in
-index 4f1bf90..b8dc6fe 100644
+index b444cd4..2b976fb 100644
 --- a/bin/dnssec-pkcs11/Makefile.in
 +++ b/bin/dnssec-pkcs11/Makefile.in
-@@ -23,18 +23,18 @@ top_srcdir =	@top_srcdir@
+@@ -23,18 +23,18 @@ VERSION=@BIND9_VERSION@
  
  @BIND9_MAKE_INCLUDES@
  
--CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES}
+-CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} @DST_OPENSSL_INC@
 +CINCLUDES =	${DNS_PKCS11_INCLUDES} ${ISC_PKCS11_INCLUDES}
  
  CDEFINES =	-DVERSION=\"${VERSION}\" @USE_PKCS11@ @PKCS11_ENGINE@ \
@@ -108,7 +108,7 @@ index 4f1bf90..b8dc6fe 100644
  	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \
  	dnssec-importkey.@O@ ${OBJS} ${LIBS}
  
-@@ -114,11 +114,9 @@ docclean manclean maintainer-clean::
+@@ -114,14 +114,11 @@ docclean manclean maintainer-clean::
  
  installdirs:
  	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
@@ -118,15 +118,18 @@ index 4f1bf90..b8dc6fe 100644
  	for t in ${TARGETS}; do ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} $$t ${DESTDIR}${sbindir}; done
 -	for m in ${MANPAGES}; do ${INSTALL_DATA} ${srcdir}/$$m ${DESTDIR}${mandir}/man8; done
  
+ uninstall::
+-	for m in ${MANPAGES}; do rm -f ${DESTDIR}${mandir}/man8/$$m ; done
+ 	for t in ${TARGETS}; do ${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/$$t ; done
+ 
  clean distclean::
- 	rm -f ${TARGETS}
 diff --git a/bin/dnssec/Makefile.in b/bin/dnssec/Makefile.in
-index 4f1bf90..e1132ea 100644
+index b444cd4..af51fd8 100644
 --- a/bin/dnssec/Makefile.in
 +++ b/bin/dnssec/Makefile.in
-@@ -25,7 +25,7 @@ top_srcdir =	@top_srcdir@
+@@ -25,7 +25,7 @@ VERSION=@BIND9_VERSION@
  
- CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES}
+ CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} @DST_OPENSSL_INC@
  
 -CDEFINES =	-DVERSION=\"${VERSION}\" @USE_PKCS11@ @PKCS11_ENGINE@ \
 +CDEFINES =	-DVERSION=\"${VERSION}\" \
@@ -134,7 +137,7 @@ index 4f1bf90..e1132ea 100644
  CWARNINGS =
  
 diff --git a/bin/named-pkcs11/Makefile.in b/bin/named-pkcs11/Makefile.in
-index 95e36c1..fb658e9 100644
+index 376fa69..2ec7f95 100644
 --- a/bin/named-pkcs11/Makefile.in
 +++ b/bin/named-pkcs11/Makefile.in
 @@ -47,26 +47,26 @@ DLZDRIVER_INCLUDES =	@DLZ_DRIVER_INCLUDES@
@@ -143,8 +146,8 @@ index 95e36c1..fb658e9 100644
  CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
 -		${LWRES_INCLUDES} ${DNS_INCLUDES} ${BIND9_INCLUDES} \
 -		${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} ${ISC_INCLUDES} \
-+		${LWRES_INCLUDES} ${DNS_PKCS11_INCLUDES} ${BIND9_INCLUDES} \
-+		${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} ${ISC_PKCS11_INCLUDES} \
++        ${LWRES_INCLUDES} ${DNS_PKCS11_INCLUDES} ${BIND9_INCLUDES} \
++        ${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} ${ISC_PKCS11_INCLUDES} \
  		${DLZDRIVER_INCLUDES} ${DBDRIVER_INCLUDES} @DST_OPENSSL_INC@
  
 -CDEFINES =      @CONTRIB_DLZ@ @USE_PKCS11@ @PKCS11_ENGINE@ @CRYPTO@
@@ -153,21 +156,21 @@ index 95e36c1..fb658e9 100644
  CWARNINGS =
  
 -DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
-+DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ @DNS_CRYPTO_LIBS@
++DNSLIBS =  ../../lib/dns-pkcs11/libdns-pkcs11.@A@ @DNS_CRYPTO_LIBS@
  ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
  ISCCCLIBS =	../../lib/isccc/libisccc.@A@
 -ISCLIBS =	../../lib/isc/libisc.@A@
-+ISCLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
++ISCLIBS =  ../../lib/isc-pkcs11/libisc-pkcs11.@A@
  ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@
  LWRESLIBS =	../../lib/lwres/liblwres.@A@
  BIND9LIBS =	../../lib/bind9/libbind9.@A@
  
 -DNSDEPLIBS =	../../lib/dns/libdns.@A@
-+DNSDEPLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@
++DNSDEPLIBS =   ../../lib/dns-pkcs11/libdns-pkcs11.@A@
  ISCCFGDEPLIBS =	../../lib/isccfg/libisccfg.@A@
  ISCCCDEPLIBS =	../../lib/isccc/libisccc.@A@
 -ISCDEPLIBS =	../../lib/isc/libisc.@A@
-+ISCDEPLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
++ISCDEPLIBS =   ../../lib/isc-pkcs11/libisc-pkcs11.@A@
  LWRESDEPLIBS =	../../lib/lwres/liblwres.@A@
  BIND9DEPLIBS =	../../lib/bind9/libbind9.@A@
  
@@ -181,12 +184,12 @@ index 95e36c1..fb658e9 100644
  NOSYMLIBS =	${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
  		${ISCCFGLIBS} ${ISCCCLIBS} ${ISCNOSYMLIBS} \
 -		${DLZDRIVER_LIBS} ${DBDRIVER_LIBS} @LIBS@
-+		@LIBS@
++        @LIBS@
  
  SUBDIRS =	unix
  
 -TARGETS =	named@EXEEXT@ lwresd@EXEEXT@
-+TARGETS =	named-pkcs11@EXEEXT@
++TARGETS =  named-pkcs11@EXEEXT@
  
  GEOIPLINKOBJS = geoip.@O@
  
@@ -196,7 +199,7 @@ index 95e36c1..fb658e9 100644
  		lwaddr.@O@ lwresd.@O@ lwdclient.@O@ lwderror.@O@ lwdgabn.@O@ \
 -		lwdgnba.@O@ lwdgrbn.@O@ lwdnoop.@O@ lwsearch.@O@ \
 -		${DLZDRIVER_OBJS} ${DBDRIVER_OBJS}
-+		lwdgnba.@O@ lwdgrbn.@O@ lwdnoop.@O@ lwsearch.@O@
++        lwdgnba.@O@ lwdgrbn.@O@ lwdnoop.@O@ lwsearch.@O@
  
  UOBJS =		unix/os.@O@ unix/dlz_dlopen_driver.@O@
  
@@ -206,7 +209,7 @@ index 95e36c1..fb658e9 100644
  		lwaddr.c lwresd.c lwdclient.c lwderror.c lwdgabn.c \
 -		lwdgnba.c lwdgrbn.c lwdnoop.c lwsearch.c \
 -		${DLZDRIVER_SRCS} ${DBDRIVER_SRCS}
-+		lwdgnba.c lwdgrbn.c lwdnoop.c lwsearch.c
++        lwdgnba.c lwdgrbn.c lwdnoop.c lwsearch.c
  
  MANPAGES =	named.8 lwresd.8 named.conf.5
  
@@ -219,27 +222,34 @@ index 95e36c1..fb658e9 100644
  	export MAKE_SYMTABLE="yes"; \
  	export BASEOBJS="${OBJS} ${UOBJS}"; \
  	${FINALBUILDCMD}
-@@ -171,15 +169,9 @@ statschannel.@O@: bind9.xsl.h
+@@ -171,22 +169,12 @@ statschannel.@O@: bind9.xsl.h
  
  installdirs:
  	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
 -	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man5
 -	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
--
+ 
 -install:: named@EXEEXT@ lwresd@EXEEXT@ installdirs
 -	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named@EXEEXT@ ${DESTDIR}${sbindir}
 -	(cd ${DESTDIR}${sbindir}; rm -f lwresd@EXEEXT@; @LN@ named@EXEEXT@ lwresd@EXEEXT@)
 -	${INSTALL_DATA} ${srcdir}/named.8 ${DESTDIR}${mandir}/man8
 -	${INSTALL_DATA} ${srcdir}/lwresd.8 ${DESTDIR}${mandir}/man8
 -	${INSTALL_DATA} ${srcdir}/named.conf.5 ${DESTDIR}${mandir}/man5
-+
 +install:: named-pkcs11@EXEEXT@ installdirs
 +	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named-pkcs11@EXEEXT@ ${DESTDIR}${sbindir}
  
+ uninstall::
+-	rm -f ${DESTDIR}${mandir}/man5/named.conf.5
+-	rm -f ${DESTDIR}${mandir}/man8/lwresd.8
+-	rm -f ${DESTDIR}${mandir}/man8/named.8
+-	rm -f ${DESTDIR}${sbindir}/lwresd@EXEEXT@
+-	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/named@EXEEXT@
++	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/named-pkcs11@EXEEXT@
+ 
  @DLZ_DRIVER_RULES@
  
 diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
-index 95e36c1..ba5ec3c 100644
+index 376fa69..bb00272 100644
 --- a/bin/named/Makefile.in
 +++ b/bin/named/Makefile.in
 @@ -51,7 +51,7 @@ CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
@@ -252,7 +262,7 @@ index 95e36c1..ba5ec3c 100644
  CWARNINGS =
  
 diff --git a/bin/pkcs11/Makefile.in b/bin/pkcs11/Makefile.in
-index dac3832..43d8241 100644
+index 18df193..b1fb753 100644
 --- a/bin/pkcs11/Makefile.in
 +++ b/bin/pkcs11/Makefile.in
 @@ -20,13 +20,13 @@ top_srcdir =	@top_srcdir@
@@ -273,10 +283,10 @@ index dac3832..43d8241 100644
  DEPLIBS =	${ISCDEPLIBS}
  
 diff --git a/configure.in b/configure.in
-index a28f773..8f3b8f4 100644
+index f9bbca6..1c9d8ff 100644
 --- a/configure.in
 +++ b/configure.in
-@@ -982,12 +982,14 @@ AC_SUBST(USE_GSSAPI)
+@@ -1109,12 +1109,14 @@ AC_SUBST(USE_GSSAPI)
  AC_SUBST(DST_GSSAPI_INC)
  AC_SUBST(DNS_GSSAPI_LIBS)
  DNS_CRYPTO_LIBS="$DNS_GSSAPI_LIBS $DNS_CRYPTO_LIBS"
@@ -291,33 +301,32 @@ index a28f773..8f3b8f4 100644
  
  #
  # was --with-randomdev specified?
-@@ -1383,10 +1385,10 @@ OPENSSL_WARNING=
+@@ -1511,11 +1513,11 @@ fi
+ AC_MSG_CHECKING(for OpenSSL library)
+ OPENSSL_WARNING=
  openssldirs="/usr /usr/local /usr/local/ssl /usr/pkg /usr/sfw"
- if test "$use_openssl" = "auto"
+-if test "yes" = "$want_native_pkcs11"
+-then
+-	use_openssl="native_pkcs11"
+-	AC_MSG_RESULT(use of native PKCS11 instead)
+-fi
++# if test "yes" = "$want_native_pkcs11"
++# then
++# 	use_openssl="native_pkcs11"
++# 	AC_MSG_RESULT(use of native PKCS11 instead)
++# fi
+ 
+ if test "auto" = "$use_openssl"
  then
--	if test "$want_native_pkcs11" = "yes"
--	then
--		use_openssl="native_pkcs11"
--	else
-+#	if test "$want_native_pkcs11" = "yes"
-+#	then
-+#		use_openssl="native_pkcs11"
-+#	else
- 		for d in $openssldirs
- 		do
- 			if test -f $d/include/openssl/opensslv.h
-@@ -1395,8 +1397,9 @@ then
- 				break
- 			fi
- 		done
--	fi
-+#	fi
+@@ -1528,6 +1530,7 @@ then
+ 		fi
+ 	done
  fi
 +CRYPTO_PK11=""
  OPENSSL_ECDSA=""
  OPENSSL_GOST=""
  gosttype="raw"
-@@ -1417,16 +1420,17 @@ case "$with_gost" in
+@@ -1548,16 +1551,17 @@ case "$with_gost" in
  		;;
  esac
  
@@ -340,32 +349,32 @@ index a28f773..8f3b8f4 100644
  	no)
  		AC_MSG_RESULT(no)
  		DST_OPENSSL_INC=""
-@@ -1448,11 +1452,11 @@ case "$use_openssl" in
+@@ -1579,11 +1583,11 @@ case "$use_openssl" in
  If you don't want OpenSSL, use --without-openssl])
  		;;
  	*)
--		if test "$want_native_pkcs11" = "yes"
+-		if test "yes" = "$want_native_pkcs11"
 -		then
 -                        AC_MSG_RESULT()
 -			AC_MSG_ERROR([OpenSSL and native PKCS11 cannot be used together.])
 -		fi
-+#		if test "$want_native_pkcs11" = "yes"
-+#		then
-+#                        AC_MSG_RESULT()
-+#			AC_MSG_ERROR([OpenSSL and native PKCS11 cannot be used together.])
-+#		fi
- 		if test "$use_openssl" = "yes"
++# 		if test "yes" = "$want_native_pkcs11"
++# 		then
++#                         AC_MSG_RESULT()
++# 			AC_MSG_ERROR([OpenSSL and native PKCS11 cannot be used together.])
++# 		fi
+ 		if test "yes" = "$use_openssl"
  		then
  			# User did not specify a path - guess it
-@@ -1776,6 +1780,7 @@ AC_SUBST(OPENSSL_ECDSA)
+@@ -1939,6 +1943,7 @@ AC_SUBST(OPENSSL_ECDSA)
  AC_SUBST(OPENSSL_GOST)
  
  DNS_CRYPTO_LIBS="$DNS_CRYPTO_LIBS $DST_OPENSSL_LIBS"
 +DNS_CRYPTO_PK11_LIBS="$DNS_CRYPTO_LIBS"
  
  ISC_PLATFORM_WANTAES="#undef ISC_PLATFORM_WANTAES"
- if test "$with_aes" = "yes"
-@@ -2047,6 +2052,7 @@ esac
+ if test "yes" = "$with_aes"
+@@ -2249,6 +2254,7 @@ esac
  AC_SUBST(PKCS11LINKOBJS)
  AC_SUBST(PKCS11LINKSRCS)
  AC_SUBST(CRYPTO)
@@ -373,7 +382,7 @@ index a28f773..8f3b8f4 100644
  AC_SUBST(PKCS11_ECDSA)
  AC_SUBST(PKCS11_GOST)
  AC_SUBST(PKCS11_TEST)
-@@ -4466,8 +4472,11 @@ AC_CONFIG_FILES([
+@@ -4890,8 +4896,11 @@ AC_CONFIG_FILES([
  	bin/delv/Makefile
  	bin/dig/Makefile
  	bin/dnssec/Makefile
@@ -385,7 +394,7 @@ index a28f773..8f3b8f4 100644
  	bin/nsupdate/Makefile
  	bin/pkcs11/Makefile
  	bin/python/Makefile
-@@ -4548,6 +4557,10 @@ AC_CONFIG_FILES([
+@@ -4984,6 +4993,10 @@ AC_CONFIG_FILES([
  	lib/dns/include/dns/Makefile
  	lib/dns/include/dst/Makefile
  	lib/dns/tests/Makefile
@@ -396,7 +405,7 @@ index a28f773..8f3b8f4 100644
  	lib/irs/Makefile
  	lib/irs/include/Makefile
  	lib/irs/include/irs/Makefile
-@@ -4571,6 +4584,24 @@ AC_CONFIG_FILES([
+@@ -5008,6 +5021,24 @@ AC_CONFIG_FILES([
  	lib/isc/unix/include/Makefile
  	lib/isc/unix/include/isc/Makefile
  	lib/isc/unix/include/pkcs11/Makefile
@@ -435,10 +444,10 @@ index 86302bd..318744f 100644
  
  @BIND9_MAKE_RULES@
 diff --git a/lib/dns-pkcs11/Makefile.in b/lib/dns-pkcs11/Makefile.in
-index 5f1ce56..830c0d5 100644
+index 249ea86..e4178b2 100644
 --- a/lib/dns-pkcs11/Makefile.in
 +++ b/lib/dns-pkcs11/Makefile.in
-@@ -28,16 +28,16 @@ top_srcdir =	@top_srcdir@
+@@ -32,16 +32,16 @@ VERSION=@BIND9_VERSION@
  
  USE_ISC_SPNEGO = @USE_ISC_SPNEGO@
  
@@ -460,7 +469,7 @@ index 5f1ce56..830c0d5 100644
  
  LIBS =		@LIBS@
  
-@@ -134,7 +134,7 @@ version.@O@: version.c
+@@ -138,7 +138,7 @@ version.@O@: version.c
  		-DLIBAGE=${LIBAGE} \
  		-c ${srcdir}/version.c
  
@@ -469,7 +478,7 @@ index 5f1ce56..830c0d5 100644
  	${AR} ${ARFLAGS} $@ ${OBJS}
  	${RANLIB} $@
  
-@@ -144,23 +144,23 @@ dynamic_db.@O@: dynamic_db.c
+@@ -148,26 +148,26 @@ dynamic_db.@O@: dynamic_db.c
  	-c ${srcdir}/dynamic_db.c
  
  
@@ -479,8 +488,7 @@ index 5f1ce56..830c0d5 100644
 -		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libdns.la -rpath ${libdir} \
 +		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libdns-pkcs11.la -rpath ${libdir} \
  		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
--		${OBJS} ${ISCLIBS} @DNS_CRYPTO_LIBS@ ${LIBS}
-+		${OBJS} ${ISCLIBS} @DNS_CRYPTO_PK11_LIBS@ ${LIBS}
+ 		${OBJS} ${ISCLIBS} @DNS_CRYPTO_LIBS@ ${LIBS}
  
 -timestamp: libdns.@A@
 +timestamp: libdns-pkcs11.@A@
@@ -493,14 +501,18 @@ index 5f1ce56..830c0d5 100644
 -	${LIBTOOL_MODE_INSTALL} ${INSTALL_LIBRARY} libdns.@A@ ${DESTDIR}${libdir}
 +	${LIBTOOL_MODE_INSTALL} ${INSTALL_LIBRARY} libdns-pkcs11.@A@ ${DESTDIR}${libdir}
  
+ uninstall::
+-	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${libdir}/libdns.@A@
++	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${libdir}/libdns-pkcs11.@A@
+ 
  clean distclean::
 -	rm -f libdns.@A@ timestamp
 +	rm -f libdns-pkcs11.@A@ timestamp
  	rm -f gen code.h include/dns/enumtype.h include/dns/enumclass.h
  	rm -f include/dns/rdatastruct.h
  
-@@ -190,7 +190,7 @@ code.h:	gen
- 	./gen -s ${srcdir} > code.h
+@@ -198,7 +198,7 @@ code.h:	gen
+ 	./gen -s ${srcdir} > code.h || { rm -f $@ ; exit 1; }
  
  gen: gen.c
 -	${BUILD_CC} ${BUILD_CFLAGS} -I${top_srcdir}/lib/isc/include \
@@ -509,10 +521,10 @@ index 5f1ce56..830c0d5 100644
  
  rbtdb64.@O@: rbtdb64.c rbtdb.c
 diff --git a/lib/isc-pkcs11/Makefile.in b/lib/isc-pkcs11/Makefile.in
-index e0b2038..0f919a9 100644
+index c52896e..de3b6f2 100644
 --- a/lib/isc-pkcs11/Makefile.in
 +++ b/lib/isc-pkcs11/Makefile.in
-@@ -31,8 +31,8 @@ CINCLUDES =	-I${srcdir}/unix/include \
+@@ -29,8 +29,8 @@ CINCLUDES =	-I${srcdir}/unix/include \
  		-I${srcdir}/@ISC_THREAD_DIR@/include \
  		-I${srcdir}/@ISC_ARCH_DIR@/include \
  		-I./include \
@@ -523,7 +535,7 @@ index e0b2038..0f919a9 100644
  CWARNINGS =
  
  # Alphabetically
-@@ -111,35 +111,35 @@ version.@O@: version.c
+@@ -110,38 +110,38 @@ version.@O@: version.c
  		-DLIBAGE=${LIBAGE} \
  		-c ${srcdir}/version.c
  
@@ -564,6 +576,10 @@ index e0b2038..0f919a9 100644
 -	${LIBTOOL_MODE_INSTALL} ${INSTALL_LIBRARY} libisc.@A@ ${DESTDIR}${libdir}
 +	${LIBTOOL_MODE_INSTALL} ${INSTALL_LIBRARY} libisc-pkcs11.@A@ ${DESTDIR}${libdir}
  
+ uninstall::
+-	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${libdir}/libisc.@A@
++	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${libdir}/libisc-pkcs11.@A@
+ 
  clean distclean::
 -	rm -f libisc.@A@ libisc-nosymtbl.@A@ libisc.la \
 -	libisc-nosymtbl.la timestamp
diff --git a/bind-9.10-dyndb.patch b/bind-9.10-dyndb.patch
index a644bc1..62cd969 100644
--- a/bind-9.10-dyndb.patch
+++ b/bind-9.10-dyndb.patch
@@ -1,5 +1,5 @@
 diff --git a/bin/named/main.c b/bin/named/main.c
-index 556db54..0051f9a 100644
+index 82ae231..8234744 100644
 --- a/bin/named/main.c
 +++ b/bin/named/main.c
 @@ -43,6 +43,7 @@
@@ -11,7 +11,7 @@ index 556db54..0051f9a 100644
  #include <dns/result.h>
  #include <dns/view.h>
 diff --git a/bin/named/server.c b/bin/named/server.c
-index 33483f8..3d2f1c6 100644
+index 57ec84f..acaad20 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
 @@ -68,6 +68,7 @@
@@ -20,9 +20,9 @@ index 33483f8..3d2f1c6 100644
  #include <dns/dlz.h>
 +#include <dns/dynamic_db.h>
  #include <dns/dns64.h>
+ #include <dns/events.h>
  #include <dns/forward.h>
- #include <dns/journal.h>
-@@ -1309,6 +1310,70 @@ configure_peer(const cfg_obj_t *cpeer, isc_mem_t *mctx, dns_peer_t **peerp) {
+@@ -1392,6 +1393,70 @@ configure_peer(const cfg_obj_t *cpeer, isc_mem_t *mctx, dns_peer_t **peerp) {
  	return (result);
  }
  
@@ -93,15 +93,15 @@ index 33483f8..3d2f1c6 100644
  static isc_result_t
  disable_algorithms(const cfg_obj_t *disabled, dns_resolver_t *resolver) {
  	isc_result_t result;
-@@ -2349,6 +2414,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
- 	const cfg_obj_t *dlz;
+@@ -2453,6 +2518,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
+ 	const cfg_obj_t *dlvobj = NULL;
  	unsigned int dlzargc;
  	char **dlzargv;
 +	const cfg_obj_t *dynamic_db_list;
  	const cfg_obj_t *disabled;
  	const cfg_obj_t *obj;
  #ifdef ENABLE_FETCHLIMIT
-@@ -3704,6 +3770,37 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
+@@ -3812,6 +3878,37 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
  		dns_view_setrootdelonly(view, ISC_FALSE);
  
  	/*
@@ -139,7 +139,7 @@ index 33483f8..3d2f1c6 100644
  	 * Setup automatic empty zones.  If recursion is off then
  	 * they are disabled by default.
  	 */
-@@ -5457,6 +5554,7 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -5745,6 +5842,7 @@ load_configuration(const char *filename, ns_server_t *server,
  		cfg_aclconfctx_detach(&ns_g_aclconfctx);
  	CHECK(cfg_aclconfctx_create(ns_g_mctx, &ns_g_aclconfctx));
  
@@ -147,7 +147,7 @@ index 33483f8..3d2f1c6 100644
  	/*
  	 * Parse the global default pseudo-config file.
  	 */
-@@ -6685,6 +6783,8 @@ shutdown_server(isc_task_t *task, isc_event_t *event) {
+@@ -6992,6 +7090,8 @@ shutdown_server(isc_task_t *task, isc_event_t *event) {
  			dns_view_detach(&view);
  	}
  
@@ -157,7 +157,7 @@ index 33483f8..3d2f1c6 100644
  		ISC_LIST_UNLINK(server->cachelist, nsc, link);
  		dns_cache_detach(&nsc->cache);
 diff --git a/lib/dns/Makefile.in b/lib/dns/Makefile.in
-index 4f3ef52..34973af 100644
+index deac1bc..249ea86 100644
 --- a/lib/dns/Makefile.in
 +++ b/lib/dns/Makefile.in
 @@ -65,7 +65,7 @@ GEOIPLINKOBJS = geoip.@O@
@@ -192,8 +192,9 @@ index 4f3ef52..34973af 100644
  	${LIBTOOL_MODE_LINK} \
  		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libdns.la -rpath ${libdir} \
 diff --git a/lib/dns/dynamic_db.c b/lib/dns/dynamic_db.c
-index e69de29..e32a3c8 100644
---- a/lib/dns/dynamic_db.c
+new file mode 100644
+index 0000000..e32a3c8
+--- /dev/null
 +++ b/lib/dns/dynamic_db.c
 @@ -0,0 +1,367 @@
 +/*
@@ -564,7 +565,7 @@ index e69de29..e32a3c8 100644
 +}
 +
 diff --git a/lib/dns/include/dns/Makefile.in b/lib/dns/include/dns/Makefile.in
-index aecf6f0..8e24b54 100644
+index eca8039..f098666 100644
 --- a/lib/dns/include/dns/Makefile.in
 +++ b/lib/dns/include/dns/Makefile.in
 @@ -23,7 +23,7 @@ VERSION=@BIND9_VERSION@
@@ -577,8 +578,9 @@ index aecf6f0..8e24b54 100644
  		ecdb.h events.h fixedname.h forward.h geoip.h iptable.h \
  		journal.h keydata.h keyflags.h keytable.h keyvalues.h \
 diff --git a/lib/dns/include/dns/dynamic_db.h b/lib/dns/include/dns/dynamic_db.h
-index e69de29..719fa0f 100644
---- a/lib/dns/include/dns/dynamic_db.h
+new file mode 100644
+index 0000000..719fa0f
+--- /dev/null
 +++ b/lib/dns/include/dns/dynamic_db.h
 @@ -0,0 +1,51 @@
 +/*
@@ -645,10 +647,10 @@ index 845be49..7b94ec6 100644
  ISC_LANG_BEGINDECLS
  
 diff --git a/lib/dns/include/dns/types.h b/lib/dns/include/dns/types.h
-index 00ba58e..b7fdead 100644
+index 964d40c..555e2aa 100644
 --- a/lib/dns/include/dns/types.h
 +++ b/lib/dns/include/dns/types.h
-@@ -64,6 +64,7 @@ typedef struct dns_dlzimplementation		dns_dlzimplementation_t;
+@@ -62,6 +62,7 @@ typedef struct dns_dlzimplementation		dns_dlzimplementation_t;
  typedef struct dns_dlzdb			dns_dlzdb_t;
  typedef ISC_LIST(dns_dlzdb_t)			dns_dlzdblist_t;
  typedef struct dns_sdlzimplementation		dns_sdlzimplementation_t;
@@ -669,7 +671,7 @@ index 377b03c..acef9e6 100644
  };
  
 diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
-index 67d65f0..bd348be 100644
+index 00f8640..60a6dec 100644
 --- a/lib/isccfg/namedconf.c
 +++ b/lib/isccfg/namedconf.c
 @@ -106,6 +106,7 @@ static cfg_type_t cfg_type_controls;
@@ -680,15 +682,15 @@ index 67d65f0..bd348be 100644
  static cfg_type_t cfg_type_ixfrdifftype;
  static cfg_type_t cfg_type_key;
  static cfg_type_t cfg_type_logfile;
-@@ -969,6 +970,7 @@ namedconf_or_view_clauses[] = {
- 	{ "key", &cfg_type_key, CFG_CLAUSEFLAG_MULTI },
- 	{ "zone", &cfg_type_zone, CFG_CLAUSEFLAG_MULTI },
+@@ -979,6 +980,7 @@ namedconf_clauses[] = {
+ static cfg_clausedef_t
+ namedconf_or_view_clauses[] = {
  	{ "dlz", &cfg_type_dlz, CFG_CLAUSEFLAG_MULTI },
 +	{ "dynamic-db", &cfg_type_dynamic_db, CFG_CLAUSEFLAG_MULTI },
- 	{ "server", &cfg_type_server, CFG_CLAUSEFLAG_MULTI },
- 	{ "trusted-keys", &cfg_type_dnsseckeys, CFG_CLAUSEFLAG_MULTI },
+ 	{ "key", &cfg_type_key, CFG_CLAUSEFLAG_MULTI },
  	{ "managed-keys", &cfg_type_managedkeys, CFG_CLAUSEFLAG_MULTI },
-@@ -2230,6 +2232,40 @@ static cfg_type_t cfg_type_dialuptype = {
+ 	{ "server", &cfg_type_server, CFG_CLAUSEFLAG_MULTI },
+@@ -2262,6 +2264,40 @@ static cfg_type_t cfg_type_dialuptype = {
  	&cfg_rep_string, dialup_enums
  };
  
@@ -728,4 +730,4 @@ index 67d65f0..bd348be 100644
 +
  static const char *notify_enums[] = { "explicit", "master-only", NULL };
  static isc_result_t
- parse_notify_type(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
+ parse_notify_type(cfg_parser_t *pctx, const cfg_type_t *type,
diff --git a/bind-9.10-sdb.patch b/bind-9.10-sdb.patch
index 3938b4b..b66e94d 100644
--- a/bind-9.10-sdb.patch
+++ b/bind-9.10-sdb.patch
@@ -14,10 +14,10 @@ index 7654169..b4c9c03 100644
  
  @BIND9_MAKE_RULES@
 diff --git a/bin/named-sdb/Makefile.in b/bin/named-sdb/Makefile.in
-index ba5ec3c..d7ac259 100644
+index bb00272..5d219ea 100644
 --- a/bin/named-sdb/Makefile.in
 +++ b/bin/named-sdb/Makefile.in
-@@ -34,10 +34,10 @@ top_srcdir =	@top_srcdir@
+@@ -34,10 +34,10 @@ VERSION=@BIND9_VERSION@
  #
  # Add database drivers here.
  #
@@ -66,10 +66,10 @@ index ba5ec3c..d7ac259 100644
 +install:: named-sdb@EXEEXT@ installdirs
 +	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named-sdb@EXEEXT@ ${DESTDIR}${sbindir}
  
- @DLZ_DRIVER_RULES@
- 
+ uninstall::
+ 	rm -f ${DESTDIR}${mandir}/man5/named.conf.5
 diff --git a/bin/named-sdb/main.c b/bin/named-sdb/main.c
-index 306295f..a7f3327 100644
+index 8234744..025eb77 100644
 --- a/bin/named-sdb/main.c
 +++ b/bin/named-sdb/main.c
 @@ -91,6 +91,10 @@
@@ -83,7 +83,7 @@ index 306295f..a7f3327 100644
  
  #ifdef CONTRIB_DLZ
  /*
-@@ -985,6 +989,11 @@ setup(void) {
+@@ -1003,6 +1007,11 @@ setup(void) {
  		ns_main_earlyfatal("isc_app_start() failed: %s",
  				   isc_result_totext(result));
  
@@ -95,7 +95,7 @@ index 306295f..a7f3327 100644
  	isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
  		      ISC_LOG_NOTICE, "starting %s %s%s%s <id:%s>%s",
  		      ns_g_product, ns_g_version,
-@@ -1099,6 +1108,75 @@ setup(void) {
+@@ -1120,6 +1129,75 @@ setup(void) {
  				   isc_result_totext(result));
  #endif
  
@@ -171,7 +171,7 @@ index 306295f..a7f3327 100644
  	ns_server_create(ns_g_mctx, &ns_g_server);
  
  #ifdef HAVE_LIBSECCOMP
-@@ -1138,6 +1216,11 @@ cleanup(void) {
+@@ -1162,6 +1240,11 @@ cleanup(void) {
  
  	dns_name_destroy();
  
@@ -184,7 +184,7 @@ index 306295f..a7f3327 100644
  		      ISC_LOG_NOTICE, "exiting");
  	ns_log_shutdown();
 diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
-index ba5ec3c..2c88f46 100644
+index bb00272..5f3c342 100644
 --- a/bin/named/Makefile.in
 +++ b/bin/named/Makefile.in
 @@ -49,9 +49,9 @@ DLZDRIVER_LIBS =	@DLZ_DRIVER_LIBS@
@@ -233,16 +233,16 @@ index ba5ec3c..2c88f46 100644
  
  MANPAGES =	named.8 lwresd.8 named.conf.5
  
-@@ -181,7 +179,5 @@ install:: named@EXEEXT@ lwresd@EXEEXT@ installdirs
- 	${INSTALL_DATA} ${srcdir}/lwresd.8 ${DESTDIR}${mandir}/man8
- 	${INSTALL_DATA} ${srcdir}/named.conf.5 ${DESTDIR}${mandir}/man5
+@@ -188,7 +186,5 @@ uninstall::
+ 	rm -f ${DESTDIR}${sbindir}/lwresd@EXEEXT@
+ 	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/named@EXEEXT@
  
 -@DLZ_DRIVER_RULES@
 -
  named-symtbl.@O@: named-symtbl.c
  	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} -c named-symtbl.c
 diff --git a/bin/sdb_tools/Makefile.in b/bin/sdb_tools/Makefile.in
-index 7f3c5e2..b1bca66 100644
+index c7e0868..95ab742 100644
 --- a/bin/sdb_tools/Makefile.in
 +++ b/bin/sdb_tools/Makefile.in
 @@ -32,11 +32,11 @@ DEPLIBS =	${LWRESDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
@@ -277,10 +277,10 @@ index 7f3c5e2..b1bca66 100644
 +	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zone2sqlite@EXEEXT@ ${DESTDIR}${sbindir}
  	${INSTALL_DATA} ${srcdir}/zone2ldap.1 ${DESTDIR}${mandir}/man1/zone2ldap.1
 diff --git a/configure.in b/configure.in
-index 6dab9dc..f84d161 100644
+index 1c9d8ff..26cc6b6 100644
 --- a/configure.in
 +++ b/configure.in
-@@ -4686,12 +4686,15 @@ AC_CONFIG_FILES([
+@@ -4901,6 +4901,8 @@ AC_CONFIG_FILES([
  	bin/named/unix/Makefile
  	bin/named-pkcs11/Makefile
  	bin/named-pkcs11/unix/Makefile
@@ -289,8 +289,9 @@ index 6dab9dc..f84d161 100644
  	bin/nsupdate/Makefile
  	bin/pkcs11/Makefile
  	bin/python/Makefile
- 	bin/python/dnssec-checkds.py
- 	bin/python/dnssec-coverage.py
+@@ -4919,6 +4921,7 @@ AC_CONFIG_FILES([
+ 	bin/python/isc/keyzone.py
+ 	bin/python/isc/tests/dnskey_test.py
  	bin/rndc/Makefile
 +	bin/sdb_tools/Makefile
  	bin/tests/Makefile
diff --git a/bind-9.3.2b1-fix_sdb_ldap.patch b/bind-9.3.2b1-fix_sdb_ldap.patch
index 0ebae51..56e8d20 100644
--- a/bind-9.3.2b1-fix_sdb_ldap.patch
+++ b/bind-9.3.2b1-fix_sdb_ldap.patch
@@ -36,7 +36,7 @@ index 95ab742..6069f09 100644
  	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zone2sqlite@EXEEXT@ ${DESTDIR}${sbindir}
  	${INSTALL_DATA} ${srcdir}/zone2ldap.1 ${DESTDIR}${mandir}/man1/zone2ldap.1
 diff --git a/bin/sdb_tools/zone2ldap.c b/bin/sdb_tools/zone2ldap.c
-index 23dd873..d56bc56 100644
+index 9198ae6..3bb22bf 100644
 --- a/bin/sdb_tools/zone2ldap.c
 +++ b/bin/sdb_tools/zone2ldap.c
 @@ -26,6 +26,7 @@
@@ -45,9 +45,9 @@ index 23dd873..d56bc56 100644
  #include <isc/print.h>
 +#include <isc/hash.h>
  #include <isc/result.h>
+ #include <isc/string.h>
  
- #include <dns/db.h>
-@@ -65,6 +66,9 @@ ldap_info;
+@@ -66,6 +67,9 @@ ldap_info;
  /* usage Info */
  void usage (void);
  
@@ -57,7 +57,7 @@ index 23dd873..d56bc56 100644
  /* Add to the ldap dit */
  void add_ldap_values (ldap_info * ldinfo);
  
-@@ -81,7 +85,7 @@ char **hostname_to_dn_list (char *hostname, char *zone, unsigned int flags);
+@@ -82,7 +86,7 @@ char **hostname_to_dn_list (char *hostname, char *zone, unsigned int flags);
  int get_attr_list_size (char **tmp);
  
  /* Get a DN */
@@ -66,7 +66,7 @@ index 23dd873..d56bc56 100644
  
  /* Add to RR list */
  void add_to_rr_list (char *dn, char *name, char *type, char *data,
-@@ -103,11 +107,27 @@ void
+@@ -104,11 +108,27 @@ void
  init_ldap_conn ();
  void usage();
  
@@ -99,7 +99,7 @@ index 23dd873..d56bc56 100644
  LDAP *conn;
  unsigned int debug = 0;
  
-@@ -131,12 +151,12 @@ main (int argc, char **argv)
+@@ -132,12 +152,12 @@ main (int argc, char **argv)
    isc_result_t result;
    char *basedn;
    ldap_info *tmp;
@@ -115,7 +115,7 @@ index 23dd873..d56bc56 100644
    dns_fixedname_t fixedzone, fixedname;
    dns_rdataset_t rdataset;
    char **dc_list;
-@@ -149,7 +169,7 @@ main (int argc, char **argv)
+@@ -150,7 +170,7 @@ main (int argc, char **argv)
    extern char *optarg;
    extern int optind, opterr, optopt;
    int create_base = 0;
@@ -124,7 +124,7 @@ index 23dd873..d56bc56 100644
  
    if (argc < 2)
      {
-@@ -157,7 +177,7 @@ main (int argc, char **argv)
+@@ -158,7 +178,7 @@ main (int argc, char **argv)
        exit (-1);
      }
  
@@ -133,7 +133,7 @@ index 23dd873..d56bc56 100644
      {
        switch (topt)
  	{
-@@ -180,6 +200,9 @@ main (int argc, char **argv)
+@@ -181,6 +201,9 @@ main (int argc, char **argv)
  	  if (bindpw == NULL)
  	    fatal("strdup");
  	  break;
@@ -143,7 +143,7 @@ index 23dd873..d56bc56 100644
  	case 'b':
  	  ldapbase = strdup (optarg);
  	  if (ldapbase == NULL)
-@@ -301,27 +324,62 @@ main (int argc, char **argv)
+@@ -302,27 +325,62 @@ main (int argc, char **argv)
      {
        if (debug)
  	printf ("Creating base zone DN %s\n", argzone);
@@ -216,7 +216,7 @@ index 23dd873..d56bc56 100644
  		}
  	      else
  		{
-@@ -330,8 +388,13 @@ main (int argc, char **argv)
+@@ -331,8 +389,13 @@ main (int argc, char **argv)
  		  else
  		    sprintf (fullbasedn, "%s", ctmp);
  		}
@@ -230,7 +230,7 @@ index 23dd873..d56bc56 100644
  	    }
  
  	}
-@@ -409,14 +472,14 @@ generate_ldap (dns_name_t * dnsname, dns_rdata_t * rdata, unsigned int ttl)
+@@ -410,14 +473,14 @@ generate_ldap (dns_name_t * dnsname, dns_rdata_t * rdata, unsigned int ttl)
    isc_result_check (result, "dns_rdata_totext");
    data[isc_buffer_usedlength (&buff)] = 0;
  
@@ -248,7 +248,7 @@ index 23dd873..d56bc56 100644
  }
  
  
-@@ -456,7 +519,8 @@ add_to_rr_list (char *dn, char *name, char *type,
+@@ -457,7 +520,8 @@ add_to_rr_list (char *dn, char *name, char *type,
    int attrlist;
    char ldap_type_buffer[128];
    char charttl[64];
@@ -258,7 +258,7 @@ index 23dd873..d56bc56 100644
  
    if ((tmp = locate_by_dn (dn)) == NULL)
      {
-@@ -483,13 +547,13 @@ add_to_rr_list (char *dn, char *name, char *type,
+@@ -484,13 +548,13 @@ add_to_rr_list (char *dn, char *name, char *type,
  	    fatal("malloc");
  	}
        tmp->attrs[0]->mod_op = LDAP_MOD_ADD;
@@ -275,7 +275,7 @@ index 23dd873..d56bc56 100644
  	  tmp->attrs[1] = NULL;
  	  tmp->attrcnt = 2;
  	  tmp->next = ldap_info_base;
-@@ -498,7 +562,7 @@ add_to_rr_list (char *dn, char *name, char *type,
+@@ -499,7 +563,7 @@ add_to_rr_list (char *dn, char *name, char *type,
  	}
  
        tmp->attrs[1]->mod_op = LDAP_MOD_ADD;
@@ -284,7 +284,7 @@ index 23dd873..d56bc56 100644
        tmp->attrs[1]->mod_values = (char **) calloc (sizeof (char *), 2);
  
        if (tmp->attrs[1]->mod_values == (char **)NULL)
-@@ -527,7 +591,7 @@ add_to_rr_list (char *dn, char *name, char *type,
+@@ -528,7 +592,7 @@ add_to_rr_list (char *dn, char *name, char *type,
  	 fatal("strdup");
  
        tmp->attrs[3]->mod_op = LDAP_MOD_ADD;
@@ -293,7 +293,7 @@ index 23dd873..d56bc56 100644
        tmp->attrs[3]->mod_values = (char **) calloc (sizeof (char *), 2);
  
        if (tmp->attrs[3]->mod_values == (char **)NULL)
-@@ -540,14 +604,25 @@ add_to_rr_list (char *dn, char *name, char *type,
+@@ -541,14 +605,25 @@ add_to_rr_list (char *dn, char *name, char *type,
        if (tmp->attrs[3]->mod_values[0] == NULL)
  	 fatal("strdup");
  
@@ -321,7 +321,7 @@ index 23dd873..d56bc56 100644
        tmp->attrs[4]->mod_values[1] = NULL;
  
        tmp->attrs[5] = NULL;
-@@ -558,7 +633,7 @@ add_to_rr_list (char *dn, char *name, char *type,
+@@ -559,7 +634,7 @@ add_to_rr_list (char *dn, char *name, char *type,
    else
      {
  
@@ -330,7 +330,7 @@ index 23dd873..d56bc56 100644
  	{
  	  sprintf (ldap_type_buffer, "%sRecord", type);
  	  if (!strncmp
-@@ -632,44 +707,70 @@ char **
+@@ -633,44 +708,70 @@ char **
  hostname_to_dn_list (char *hostname, char *zone, unsigned int flags)
  {
    char *tmp;
@@ -438,7 +438,7 @@ index 23dd873..d56bc56 100644
    dn_buffer[i] = NULL;
  
    return dn_buffer;
-@@ -681,24 +782,32 @@ hostname_to_dn_list (char *hostname, char *zone, unsigned int flags)
+@@ -682,24 +783,32 @@ hostname_to_dn_list (char *hostname, char *zone, unsigned int flags)
   * exception of "@"/SOA. */
  
  char *
@@ -475,7 +475,7 @@ index 23dd873..d56bc56 100644
        else
  	      sprintf(tmp,"dc=%s,", dc_list[x]);
      }
-@@ -724,6 +833,7 @@ void
+@@ -725,6 +834,7 @@ void
  init_ldap_conn ()
  {
    int result;
@@ -483,7 +483,7 @@ index 23dd873..d56bc56 100644
    conn = ldap_open (ldapsystem, LDAP_PORT);
    if (conn == NULL)
      {
-@@ -733,7 +843,7 @@ init_ldap_conn ()
+@@ -734,7 +844,7 @@ init_ldap_conn ()
      }
  
    result = ldap_simple_bind_s (conn, binddn, bindpw);
@@ -492,7 +492,7 @@ index 23dd873..d56bc56 100644
  }
  
  /* Like isc_result_check, only for LDAP */
-@@ -750,8 +860,6 @@ ldap_result_check (const char *msg, char *dn, int err)
+@@ -751,8 +861,6 @@ ldap_result_check (const char *msg, char *dn, int err)
      }
  }
  
@@ -501,7 +501,7 @@ index 23dd873..d56bc56 100644
  /* For running the ldap_info run queue. */
  void
  add_ldap_values (ldap_info * ldinfo)
-@@ -759,14 +867,14 @@ add_ldap_values (ldap_info * ldinfo)
+@@ -760,14 +868,14 @@ add_ldap_values (ldap_info * ldinfo)
    int result;
    char dnbuffer[1024];
  
@@ -518,7 +518,7 @@ index 23dd873..d56bc56 100644
  }
  
  
-@@ -777,5 +885,5 @@ void
+@@ -778,5 +886,5 @@ void
  usage ()
  {
    fprintf (stderr,
diff --git a/bind-95-rh452060.patch b/bind-95-rh452060.patch
index 58808b0..dac3a8d 100644
--- a/bind-95-rh452060.patch
+++ b/bind-95-rh452060.patch
@@ -1,10 +1,12 @@
-diff -up bind-9.5.0-P2/bin/dig/dighost.c.rh452060 bind-9.5.0-P2/bin/dig/dighost.c
---- bind-9.5.0-P2/bin/dig/dighost.c.rh452060	2008-12-01 22:30:01.000000000 +0100
-+++ bind-9.5.0-P2/bin/dig/dighost.c	2008-12-01 22:30:07.000000000 +0100
-@@ -1280,6 +1280,12 @@ clear_query(dig_query_t *query) {
- 
- 	debug("clear_query(%p)", query);
+diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
+index f657c30..ff9a2d2 100644
+--- a/bin/dig/dighost.c
++++ b/bin/dig/dighost.c
+@@ -1694,6 +1694,13 @@ clear_query(dig_query_t *query) {
  
+ 	if (query->timer != NULL)
+ 		isc_timer_detach(&query->timer);
++
 +	if (query->waiting_senddone) {
 +		debug("send_done not yet called");
 +		query->pending_free = ISC_TRUE;
@@ -14,7 +16,7 @@ diff -up bind-9.5.0-P2/bin/dig/dighost.c.rh452060 bind-9.5.0-P2/bin/dig/dighost.
  	lookup = query->lookup;
  
  	if (lookup->current_query == query)
-@@ -1301,10 +1307,7 @@ clear_query(dig_query_t *query) {
+@@ -1719,10 +1726,7 @@ clear_query(dig_query_t *query) {
  	isc_mempool_put(commctx, query->recvspace);
  	isc_buffer_invalidate(&query->recvbuf);
  	isc_buffer_invalidate(&query->lengthbuf);
@@ -26,7 +28,7 @@ diff -up bind-9.5.0-P2/bin/dig/dighost.c.rh452060 bind-9.5.0-P2/bin/dig/dighost.
  }
  
  /*%
-@@ -2175,9 +2178,9 @@ send_done(isc_task_t *_task, isc_event_t
+@@ -2811,9 +2815,9 @@ send_done(isc_task_t *_task, isc_event_t *event) {
  	isc_event_free(&event);
  
  	if (query->pending_free)
diff --git a/bind-99-libidn.patch b/bind-99-libidn.patch
index a03cc96..6dbb80f 100644
--- a/bind-99-libidn.patch
+++ b/bind-99-libidn.patch
@@ -1,8 +1,8 @@
 diff --git a/bin/dig/Makefile.in b/bin/dig/Makefile.in
-index 5e9febc..b1861a5 100644
+index ff341d1..f4ea5d6 100644
 --- a/bin/dig/Makefile.in
 +++ b/bin/dig/Makefile.in
-@@ -48,10 +48,10 @@ DEPLIBS =	${DNSDEPLIBS} ${BIND9DEPLIBS} ${ISCDEPLIBS} \
+@@ -49,10 +49,10 @@ DEPLIBS =	${DNSDEPLIBS} ${BIND9DEPLIBS} ${ISCDEPLIBS} \
  		${ISCCFGDEPLIBS} ${LWRESDEPLIBS}
  
  LIBS =		${LWRESLIBS} ${BIND9LIBS} ${ISCCFGLIBS} \
@@ -15,7 +15,7 @@ index 5e9febc..b1861a5 100644
  
  SUBDIRS =
  
-@@ -69,6 +69,8 @@ HTMLPAGES =	dig.html host.html nslookup.html
+@@ -70,6 +70,8 @@ HTMLPAGES =	dig.html host.html nslookup.html
  
  MANOBJS =	${MANPAGES} ${HTMLPAGES}
  
@@ -25,10 +25,10 @@ index 5e9febc..b1861a5 100644
  
  dig@EXEEXT@: dig.@O@ dighost.@O@ ${UOBJS} ${DEPLIBS}
 diff --git a/bin/dig/dig.docbook b/bin/dig/dig.docbook
-index c54d677..1079421 100644
+index 577d6d0..f73dc3e 100644
 --- a/bin/dig/dig.docbook
 +++ b/bin/dig/dig.docbook
-@@ -1170,8 +1170,8 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
+@@ -1186,8 +1186,8 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
        <command>dig</command> appropriately converts character encoding of
        domain name before sending a request to DNS server or displaying a
        reply from the server.
@@ -40,7 +40,7 @@ index c54d677..1079421 100644
        <command>dig</command> runs.
      </para>
 diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
-index 3ca7cb9..f11884e 100644
+index 7eedcb7..b66778e 100644
 --- a/bin/dig/dighost.c
 +++ b/bin/dig/dighost.c
 @@ -44,6 +44,11 @@
@@ -55,7 +55,7 @@ index 3ca7cb9..f11884e 100644
  #include <dns/byaddr.h>
  #ifdef DIG_SIGCHASE
  #include <dns/callbacks.h>
-@@ -168,6 +173,14 @@ static void		idn_check_result(idn_result_t r, const char *msg);
+@@ -170,6 +175,14 @@ static void		idn_check_result(idn_result_t r, const char *msg);
  int  idnoptions	= 0;
  #endif
  
@@ -70,7 +70,7 @@ index 3ca7cb9..f11884e 100644
  isc_socket_t *keep = NULL;
  isc_sockaddr_t keepaddr;
  
-@@ -1404,8 +1417,15 @@ setup_system(void) {
+@@ -1420,8 +1433,15 @@ setup_system(void) {
  
  #ifdef WITH_IDN
  	initialize_idn();
@@ -87,7 +87,7 @@ index 3ca7cb9..f11884e 100644
  	if (keyfile[0] != 0)
  		setup_file_key();
  	else if (keysecret[0] != 0)
-@@ -2191,12 +2211,14 @@ setup_lookup(dig_lookup_t *lookup) {
+@@ -2207,8 +2227,11 @@ setup_lookup(dig_lookup_t *lookup) {
  	idn_result_t mr;
  	char utf8_textname[MXNAME], utf8_origin[MXNAME], idn_textname[MXNAME];
  #endif
@@ -97,14 +97,10 @@ index 3ca7cb9..f11884e 100644
  
 -#ifdef WITH_IDN
 +#if defined (WITH_IDN) || defined (WITH_LIBIDN)
- 	result = dns_name_settotextfilter(output_filter);
+ 	result = dns_name_settotextfilter(lookup->idnout ?
+ 					  output_filter : NULL);
  	check_result(result, "dns_name_settotextfilter");
- #endif
--
- 	REQUIRE(lookup != NULL);
- 	INSIST(!free_now);
- 
-@@ -2233,6 +2255,14 @@ setup_lookup(dig_lookup_t *lookup) {
+@@ -2250,6 +2273,14 @@ setup_lookup(dig_lookup_t *lookup) {
  	mr = idn_encodename(IDN_LOCALCONV | IDN_DELIMMAP, lookup->textname,
  			    utf8_textname, sizeof(utf8_textname));
  	idn_check_result(mr, "convert textname to UTF-8");
@@ -119,7 +115,7 @@ index 3ca7cb9..f11884e 100644
  #endif
  
  	/*
-@@ -2245,15 +2275,11 @@ setup_lookup(dig_lookup_t *lookup) {
+@@ -2262,15 +2293,11 @@ setup_lookup(dig_lookup_t *lookup) {
  	if (lookup->new_search) {
  #ifdef WITH_IDN
  		if ((count_dots(utf8_textname) >= ndots) || !usesearch) {
@@ -138,7 +134,7 @@ index 3ca7cb9..f11884e 100644
  			lookup->origin = NULL; /* Force abs lookup */
  			lookup->done_as_is = ISC_TRUE;
  			lookup->need_search = usesearch;
-@@ -2261,7 +2287,6 @@ setup_lookup(dig_lookup_t *lookup) {
+@@ -2278,7 +2305,6 @@ setup_lookup(dig_lookup_t *lookup) {
  			lookup->origin = ISC_LIST_HEAD(search_list);
  			lookup->need_search = ISC_FALSE;
  		}
@@ -146,7 +142,7 @@ index 3ca7cb9..f11884e 100644
  	}
  
  #ifdef WITH_IDN
-@@ -2278,6 +2303,20 @@ setup_lookup(dig_lookup_t *lookup) {
+@@ -2295,6 +2321,20 @@ setup_lookup(dig_lookup_t *lookup) {
  			    IDN_IDNCONV | IDN_LENCHECK, utf8_textname,
  			    idn_textname, sizeof(idn_textname));
  	idn_check_result(mr, "convert UTF-8 textname to IDN encoding");
@@ -167,7 +163,7 @@ index 3ca7cb9..f11884e 100644
  #else
  	if (lookup->origin != NULL) {
  		debug("trying origin %s", lookup->origin->origin);
-@@ -2348,6 +2387,13 @@ setup_lookup(dig_lookup_t *lookup) {
+@@ -2365,6 +2405,13 @@ setup_lookup(dig_lookup_t *lookup) {
  			result = dns_name_fromtext(lookup->name, &b,
  						   dns_rootname, 0,
  						   &lookup->namebuf);
@@ -179,9 +175,9 @@ index 3ca7cb9..f11884e 100644
 +						   dns_rootname, 0,
 +						   &lookup->namebuf);
  #else
- 			len = strlen(lookup->textname);
+ 			len = (unsigned int) strlen(lookup->textname);
  			isc_buffer_init(&b, lookup->textname, len);
-@@ -4227,7 +4273,7 @@ destroy_libs(void) {
+@@ -4279,7 +4326,7 @@ destroy_libs(void) {
  	void * ptr;
  	dig_message_t *chase_msg;
  #endif
@@ -190,7 +186,7 @@ index 3ca7cb9..f11884e 100644
  	isc_result_t result;
  #endif
  
-@@ -4268,6 +4314,10 @@ destroy_libs(void) {
+@@ -4320,6 +4367,10 @@ destroy_libs(void) {
  	result = dns_name_settotextfilter(NULL);
  	check_result(result, "dns_name_settotextfilter");
  #endif
@@ -201,7 +197,7 @@ index 3ca7cb9..f11884e 100644
  	dns_name_destroy();
  
  	if (commctx != NULL) {
-@@ -4453,6 +4503,97 @@ idn_check_result(idn_result_t r, const char *msg) {
+@@ -4505,6 +4556,97 @@ idn_check_result(idn_result_t r, const char *msg) {
  	}
  }
  #endif /* WITH_IDN */
diff --git a/bind.spec b/bind.spec
index 3844ba5..b63666f 100644
--- a/bind.spec
+++ b/bind.spec
@@ -2,7 +2,7 @@
 # Red Hat BIND package .spec file
 #
 
-%global PATCHVER P8
+%global PATCHVER P1
 #%%global PREVER rc1
 %global VERSION %{version}%{?PREVER}%{?PATCHVER:-%{PATCHVER}}
 
@@ -24,8 +24,8 @@
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  ISC
-Version:  9.10.4
-Release:  4%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Version:  9.10.5
+Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      http://www.isc.org/products/BIND/
 Buildroot:%{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
@@ -70,7 +70,6 @@ Patch110:bind97-rh570851.patch
 Patch112:bind97-rh645544.patch
 Patch119:bind97-rh693982.patch
 Patch123:bind98-rh735103.patch
-Patch125:bind99-buildfix.patch
 Patch130:bind-9.9.1-P2-dlz-libdb.patch
 Patch131:bind-9.9.1-P2-multlib-conflict.patch
 Patch133:bind99-rh640538.patch
@@ -228,6 +227,7 @@ Contains license of the BIND DNS suite.
 Summary: Utilities for querying DNS name servers
 Group:   Applications/System
 Requires: bind-libs%{?_isa} = %{epoch}:%{version}-%{release}
+Requires: python3-bind = %{epoch}:%{version}-%{release}
 
 %description utils
 Bind-utils contains a collection of utilities for querying DNS (Domain
@@ -290,6 +290,16 @@ chroot(2) jail for the named-sdb(8) program from the BIND package.
 Based on the code from Jan "Yenya" Kasprzak <kas@fi.muni.cz>
 %endif
 
+%package -n python3-bind
+Summary:	A module allowing rndc commands to be sent from Python programs
+Group:		Applications/System
+Requires:	bind-license = %{epoch}:%{version}-%{release}
+Requires: 	python3
+BuildArch:	noarch
+%{?python_provide:%python_provide python3-bind}
+
+%description -n python3-bind
+This package provides a module which allows commands to be sent to rndc directly from Python programs.
 
 %prep
 %setup -q -n %{name}-%{VERSION}
@@ -308,9 +318,9 @@ Based on the code from Jan "Yenya" Kasprzak <kas@fi.muni.cz>
 %patch110 -p1 -b .rh570851
 %patch112 -p1 -b .rh645544
 %patch119 -p1 -b .rh693982
-%patch125 -p1 -b .buildfix
 %patch130 -p1 -b .libdb
 %patch131 -p1 -b .multlib-conflict
+%patch138 -p1 -b .rh1236087
 
 %if %{PKCS11}
 cp -r bin/named{,-pkcs11}
@@ -346,7 +356,6 @@ cp -fp contrib/sdb/sqlite/zone2sqlite.c bin/sdb_tools
 %patch12 -p1 -b .sdb
 %patch17 -p1 -b .fix_sdb_ldap
 %patch137 -p1 -b .strlcat_fix
-%patch138 -p1 -b .rh1236087
 %endif
 
 %patch133 -p1 -b .rh640538
@@ -764,7 +773,7 @@ rm -rf ${RPM_BUILD_ROOT}
 %{_unitdir}/named-setup-rndc.service
 %{_sbindir}/named-journalprint
 %{_sbindir}/named-checkconf
-%{_sbindir}/named-rrchecker
+%{_bindir}/named-rrchecker
 %{_sbindir}/lwresd
 %{_sbindir}/named
 %{_sbindir}/rndc*
@@ -836,10 +845,10 @@ rm -rf ${RPM_BUILD_ROOT}
 
 %files libs-lite
 %defattr(-,root,root,-)
-%{_libdir}/libdns.so.165*
+%{_libdir}/libdns.so.170*
 %{_libdir}/libirs.so.141*
-%{_libdir}/libisc.so.160*
-%{_libdir}/libisccfg.so.140*
+%{_libdir}/libisc.so.170*
+%{_libdir}/libisccfg.so.144*
 
 %files license
 %defattr(-,root,root,-)
@@ -853,7 +862,7 @@ rm -rf ${RPM_BUILD_ROOT}
 %{_bindir}/host
 %{_bindir}/nslookup
 %{_bindir}/nsupdate
-%{_sbindir}/arpaname
+%{_bindir}/arpaname
 %{_sbindir}/ddns-confgen
 %{_sbindir}/genrandom
 %{_sbindir}/nsec3hash
@@ -995,8 +1004,8 @@ rm -rf ${RPM_BUILD_ROOT}
 
 %files pkcs11-libs
 %defattr(-,root,root,-)
-%{_libdir}/libdns-pkcs11.so.165*
-%{_libdir}/libisc-pkcs11.so.160*
+%{_libdir}/libdns-pkcs11.so.170*
+%{_libdir}/libisc-pkcs11.so.170*
 
 %files pkcs11-devel
 %defattr(-,root,root,-)
@@ -1006,9 +1015,18 @@ rm -rf ${RPM_BUILD_ROOT}
 %{_libdir}/libisc-pkcs11.so
 %endif
 
+%files -n python3-bind
+%defattr(-,root,root,-)
+%{python3_sitelib}/*py*
+%{python3_sitelib}/isc/*py
+%{python3_sitelib}/isc/__pycache__/*py*
 
 %changelog
-* Mon Apr 24 2017 Petr Menšík <pemensik@redhat.com> - 32:9.10.4-4.P8
+* Fri Jun 16 2017 Petr Menšík <pemensik@redhat.com> - 32:9.10.5-1.P1
+- Update to 9.10.5-P1
+- named-rrchecker and arpaname moved to /usr/bin
+- dnssec-checkds and dnssec-coverage require python3-bind
+
 - Fix queries for TKEY in nsupdate, when using GSSAPI (#1236087)
 
 * Thu Apr 13 2017 Petr Menšík <pemensik@redhat.com> - 32:9.10.4-3.P8
diff --git a/bind97-rh478718.patch b/bind97-rh478718.patch
index 51f5674..e0094aa 100644
--- a/bind97-rh478718.patch
+++ b/bind97-rh478718.patch
@@ -1,8 +1,8 @@
 diff --git a/configure.in b/configure.in
-index b79aab0..da67ad5 100644
+index 97d9d15..999040d 100644
 --- a/configure.in
 +++ b/configure.in
-@@ -3774,6 +3774,10 @@ if test "$use_atomic" = "yes"; then
+@@ -4041,6 +4041,10 @@ if test "yes" = "$use_atomic"; then
  	AC_MSG_RESULT($arch)
  fi
  
@@ -10,14 +10,14 @@ index b79aab0..da67ad5 100644
 +	AC_MSG_ERROR([XADDQ present but disabled by Fedora patch!])
 +fi
 +
- if test "$have_atomic" = "yes"; then
+ if test "yes" = "$have_atomic"; then
  	AC_MSG_CHECKING([compiler support for inline assembly code])
  
 diff --git a/lib/isc/include/isc/platform.h.in b/lib/isc/include/isc/platform.h.in
-index 2c6e2a5..bf34499 100644
+index 24b61db..28f49c8 100644
 --- a/lib/isc/include/isc/platform.h.in
 +++ b/lib/isc/include/isc/platform.h.in
-@@ -285,7 +285,11 @@
+@@ -286,7 +286,11 @@
   * If the "xaddq" operation (64bit xadd) is available on this architecture,
   * ISC_PLATFORM_HAVEXADDQ will be defined.
   */
diff --git a/bind99-buildfix.patch b/bind99-buildfix.patch
deleted file mode 100644
index 8ff5c44..0000000
--- a/bind99-buildfix.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/bin/tests/system/Makefile.in b/bin/tests/system/Makefile.in
-index bdfd72a..706290c 100644
---- a/bin/tests/system/Makefile.in
-+++ b/bin/tests/system/Makefile.in
-@@ -19,7 +19,7 @@ top_srcdir =	@top_srcdir@
- 
- @BIND9_MAKE_INCLUDES@
- 
--SUBDIRS =	builtin dlzexternal fetchlimit filter-aaaa geoip lwresd rpz rsabigexponent statistics tkey tsiggss
-+SUBDIRS =	builtin fetchlimit filter-aaaa geoip lwresd rpz rsabigexponent statistics tkey tsiggss
- TARGETS =
- 
- @BIND9_MAKE_RULES@
diff --git a/sources b/sources
index 4f9b790..3ac96a0 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
 SHA512 (config-16.tar.bz2) = 983e0a8de3bb0c16fb21331894cc97ea516233796158eb5d1c932608227b31889496d0467c3e43953bf504dbf8b5f19210d2c9f8e0e3742aea2c7609245bf3f7
-SHA512 (bind-9.10.4-P8.tar.gz) = cdda6e92a27cd1c6624dea92aa9f81b32088ec227dc4c3133f72cfb3ebf1bef29ba8908e6167232bca7cb6a00851646a694102749669cadd9137eebfaa202fd1
+SHA512 (bind-9.10.5-P1.tar.gz) = 198cb799908917ce93e1dd790669bfe58defad30878788efd9c5856963da9005fe89f82a40b3ba4bbf74a7013aa48b22356048382f5dc7675287092d28445417