#

# Red Hat BIND package .spec file

#

%global PATCHVER P2

#%%global PREVER rc2

#%%global VERSION %{version}%{PREVER}

#%%global VERSION %{version}

%global VERSION %{version}-%{PATCHVER}

%{?!SDB:       %global SDB       1}

%{?!test:      %global test      0}

%{?!bind_uid:  %global bind_uid  25}

%{?!bind_gid:  %global bind_gid  25}

%{?!GSSTSIG:   %global GSSTSIG   1}

%if 0%{?rhel}

%{?!PKCS11:    %global PKCS11    0}

%else

%{?!PKCS11:    %global PKCS11    1}

%endif

%{?!DEVEL:     %global DEVEL     1}

%global        bind_dir          /var/named

%global        chroot_prefix     %{bind_dir}/chroot

#

Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server

Name:     bind

License:  ISC

Version:  9.9.3

Release:  16.%{?PATCHVER}%{?dist}

Epoch:    32

Url:      http://www.isc.org/products/BIND/

Buildroot:%{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)

Group:    System Environment/Daemons

#

Source:   ftp://ftp.isc.org/isc/bind9/%{VERSION}/bind-%{VERSION}.tar.gz

Source1:  named.sysconfig

Source3:  named.logrotate

Source4:  named.NetworkManager

Source7:  bind-9.3.1rc1-sdb_tools-Makefile.in

Source8:  dnszone.schema

Source12: README.sdb_pgsql

Source25: named.conf.sample

Source28: config-12.tar.bz2

Source30: ldap2zone.c

Source31: ldap2zone.1

Source32: named-sdb.8

Source33: zonetodb.1

Source34: zone2sqlite.1

Source35: bind.tmpfiles.d

Source36: trusted-key.key

Source37: named.service

Source38: named-chroot.service

Source39: named-sdb.service

Source40: named-sdb-chroot.service

Source41: setup-named-chroot.sh

Source42: generate-rndc-key.sh

# Common patches

Patch5:  bind-nonexec.patch

Patch10: bind-9.5-PIE.patch

Patch16: bind-9.3.2-redhat_doc.patch

Patch72: bind-9.5-dlz-64bit.patch

Patch87: bind-9.5-parallel-build.patch

Patch101:bind-96-old-api.patch

Patch102:bind-95-rh452060.patch

Patch106:bind93-rh490837.patch

Patch107:bind97-dist-pkcs11.patch

Patch109:bind97-rh478718.patch

Patch110:bind97-rh570851.patch

Patch111:bind97-exportlib.patch

Patch112:bind97-rh645544.patch

Patch119:bind97-rh693982.patch

Patch123:bind98-rh735103.patch

Patch124:nslookup-norec.patch

Patch125:bind99-buildfix.patch

Patch127:bind99-forward.patch

Patch130:bind-9.9.1-P2-dlz-libdb4.patch

Patch131:bind-9.9.1-P2-multlib-conflict.patch

Patch132:bind99-stat.patch

Patch133:bind99-rh640538.patch

Patch134:bind97-rh669163.patch

Patch136:rl-9.9.3-P2.patch

Patch137:bind99-rrl.patch

# Install dns/update.h header for bind-dyndb-ldap plugin

Patch138:bind-9.9.3-include-update-h.patch

Patch139:bind99-ISC-Bugs-34738.patch

# upstream patch [ISC-Bugs #34870]

Patch140:bind99-ISC-Bugs-34870-v3.patch

# upstream applied patch for [ISC-Bugs #35073]

Patch141:bind99-ISC-Bugs-35073.patch

Patch142:bind-9.9.4-CVE-2014-0591.patch

# [ISC-Bugs #35495]

Patch143:bind-99-ISC-Bugs-35495.patch

# [ISC-Bugs #35385]

Patch144:bind-99-ISC-Bugs-35385.patch

Patch145:bind99-CVE-2014-8500.patch

# SDB patches

Patch11: bind-9.3.2b2-sdbsrc.patch

Patch12: bind-9.5-sdb.patch

Patch62: bind-9.5-sdb-sqlite-bld.patch

# needs inpection

Patch17: bind-9.3.2b1-fix_sdb_ldap.patch

Patch104: bind-96-dyndb.patch

# IDN paches

Patch73: bind-9.5-libidn.patch

Patch83: bind-9.5-libidn2.patch

Patch85: bind-9.5-libidn3.patch

Patch94: bind95-rh461409.patch

Patch135:bind99-libidn4.patch

#

Requires(preun):  systemd

Requires(postun): systemd

Requires:       coreutils

Requires:       systemd-units

Requires(post): grep, systemd

Requires(pre):  shadow-utils

Requires:       bind-libs = %{epoch}:%{version}-%{release}

Obsoletes:      bind-config < 30:9.3.2-34.fc6

Provides:       bind-config = 30:9.3.2-34.fc6

Obsoletes:      caching-nameserver < 31:9.4.1-7.fc8

Provides:       caching-nameserver = 31:9.4.1-7.fc8

Obsoletes:      dnssec-conf < 1.27-2

Provides:       dnssec-conf = 1.27-1

BuildRequires:  openssl-devel, libtool, autoconf, pkgconfig, libcap-devel

BuildRequires:  libidn-devel, libxml2-devel

BuildRequires:  systemd-units

%if %{SDB}

BuildRequires:  openldap-devel, postgresql-devel, sqlite-devel, mysql-devel

BuildRequires:  db4-devel

%endif

%if %{test}

BuildRequires:  net-tools

%endif

%if %{GSSTSIG}

BuildRequires:  krb5-devel

%endif

# Needed to regenerate dig.1 manpage

BuildRequires: docbook-style-xsl, libxslt

%description

BIND (Berkeley Internet Name Domain) is an implementation of the DNS

(Domain Name System) protocols. BIND includes a DNS server (named),

which resolves host names to IP addresses; a resolver library

(routines for applications to use when interfacing with DNS); and

tools for verifying that the DNS server is operating properly.

%if %{PKCS11}

%package pkcs11

Summary: Bind PKCS#11 tools for using DNSSEC

Group:   System Environment/Daemons

Requires: engine_pkcs11 opensc

#BuildRequires: opensc-devel

%description pkcs11

This is a set of PKCS#11 utilities that when used together create rsa

keys in a PKCS11 keystore, such as provided by opencryptoki. The keys

will have a label of "zone,zsk|ksk,xxx" and an id of the keytag in hex.

%endif

%if %{SDB}

%package sdb

Summary: BIND server with database backends and DLZ support

Group:   System Environment/Daemons

Requires: bind

Requires: systemd-units

%description sdb

BIND (Berkeley Internet Name Domain) is an implementation of the DNS

(Domain Name System) protocols. BIND includes a DNS server (named-sdb)

which has compiled-in SDB (Simplified Database Backend) which includes

support for using alternative Zone Databases stored in an LDAP server

(ldapdb), a postgreSQL database (pgsqldb), an sqlite database (sqlitedb),

or in the filesystem (dirdb), in addition to the standard in-memory RBT

(Red Black Tree) zone database. It also includes support for DLZ

(Dynamic Loadable Zones)

%endif

%package libs-lite

Summary:  Libraries for working with the DNS protocol

Group:    Applications/System

Obsoletes:bind-libbind-devel < 31:9.3.3-4.fc7

Provides: bind-libbind-devel = 31:9.3.3-4.fc7

Requires: bind-license = %{epoch}:%{version}-%{release}

%description libs-lite

Contains lite version of BIND suite libraries which are used by various

programs to work with DNS protocol.

%package libs

Summary: Libraries used by the BIND DNS packages

Group:    Applications/System

Requires: bind-license = %{epoch}:%{version}-%{release}

%description libs

Contains heavyweight version of BIND suite libraries used by both named DNS

server and utilities in bind-utils package.

%package license

Summary:  License of the BIND DNS suite

Group:    Applications/System

BuildArch:noarch

%description license

Contains license of the BIND DNS suite.

%package utils

Summary: Utilities for querying DNS name servers

Group:   Applications/System

%description utils

Bind-utils contains a collection of utilities for querying DNS (Domain

Name System) name servers to find out information about Internet

hosts. These tools will provide you with the IP addresses for given

host names, as well as other information about registered domains and

network addresses.

You should install bind-utils if you need to get information from DNS name

servers.

%if %{DEVEL}

%package devel

Summary:  Header files and libraries needed for BIND DNS development

Group:    Development/Libraries

Obsoletes:bind-libbind-devel < 31:9.3.3-4.fc7

Provides: bind-libbind-devel = 31:9.3.3-4.fc7

Requires: bind-libs = %{epoch}:%{version}-%{release}

%description devel

The bind-devel package contains full version of the header files and libraries

required for development with ISC BIND 9

%endif

%package lite-devel

Summary:  Lite version of header files and libraries needed for BIND DNS development

Group:    Development/Libraries

Requires: bind-libs-lite = %{epoch}:%{version}-%{release}

%description lite-devel

The bind-lite-devel package contains lite version of the header

files and libraries required for development with ISC BIND 9

%package chroot

Summary:        A chroot runtime environment for the ISC BIND DNS server, named(8)

Group:          System Environment/Daemons

Prefix:         %{chroot_prefix}

Requires(post): grep

Requires(preun):grep

Requires:       bind = %{epoch}:%{version}-%{release}

Requires:       systemd-units

%description chroot

This package contains a tree of files which can be used as a

chroot(2) jail for the named(8) program from the BIND package.

Based on the code from Jan "Yenya" Kasprzak <kas@fi.muni.cz>

%prep

%setup -q -n %{name}-%{VERSION}

# Common patches

%patch5 -p1 -b .nonexec

%patch10 -p1 -b .PIE

%patch16 -p1 -b .redhat_doc

%patch104 -p1 -b .dyndb

%ifnarch alpha ia64

%patch72 -p1 -b .64bit

%endif

%patch73 -p1 -b .libidn

%patch83 -p1 -b .libidn2

%patch85 -p1 -b .libidn3

%patch87 -p1 -b .parallel

%patch94 -p1 -b .rh461409

%patch102 -p1 -b .rh452060

%patch106 -p0 -b .rh490837

%patch107 -p1 -b .dist-pkcs11

%patch109 -p1 -b .rh478718

%patch110 -p1 -b .rh570851

%patch111 -p1 -b .exportlib

%patch112 -p1 -b .rh645544

%patch119 -p1 -b .rh693982

%patch123 -p1 -b .rh735103

pushd bin/dig

%patch124 -p0 -b .nslookup-norec

popd

%patch125 -p1 -b .buildfix

%patch127 -p1 -b .forward

%patch130 -p1 -b .libdb4

%patch131 -p1 -b .multlib-conflict

%patch136 -p0 -b .rl

%patch137 -p1 -b .rrl

%patch138 -p1 -b .update

%patch139 -p1 -b .journal

%patch140 -p1 -b .send_buffer

%patch141 -p1 -b .leak_35073

%patch142 -p1 -b .CVE-2014-0591

%patch143 -p1 -b .dlz_segfault

%patch144 -p1 -b .fetch_race_cond

%patch145 -p1 -b .CVE-2014-8500

%if %{SDB}

%patch101 -p1 -b .old-api

mkdir bin/named-sdb

cp -r bin/named/* bin/named-sdb

%patch11 -p1 -b .sdbsrc

# SDB ldap

cp -fp contrib/sdb/ldap/ldapdb.[ch] bin/named-sdb

# SDB postgreSQL

cp -fp contrib/sdb/pgsql/pgsqldb.[ch] bin/named-sdb

# SDB sqlite

cp -fp contrib/sdb/sqlite/sqlitedb.[ch] bin/named-sdb

# SDB Berkeley DB - needs to be ported to DB4!

#cp -fp contrib/sdb/bdb/bdb.[ch] bin/named_sdb

# SDB dir

cp -fp contrib/sdb/dir/dirdb.[ch] bin/named-sdb

# SDB tools

mkdir -p bin/sdb_tools

cp -fp %{SOURCE30} bin/sdb_tools/ldap2zone.c

cp -fp %{SOURCE7} bin/sdb_tools/Makefile.in

#cp -fp contrib/sdb/bdb/zone2bdb.c bin/sdb_tools

cp -fp contrib/sdb/ldap/{zone2ldap.1,zone2ldap.c} bin/sdb_tools

cp -fp contrib/sdb/pgsql/zonetodb.c bin/sdb_tools

cp -fp contrib/sdb/sqlite/zone2sqlite.c bin/sdb_tools

%patch12 -p1 -b .sdb

%endif

%if %{SDB}

%patch17 -p1 -b .fix_sdb_ldap

%endif

%if %{SDB}

%patch62 -p1 -b .sdb-sqlite-bld

%endif

%patch132 -p1 -b .stat

%patch133 -p1 -b .rh640538

%patch134 -p1 -b .rh669163

%patch135 -p1 -b .libidn4

# Sparc and s390 arches need to use -fPIE

%ifarch sparcv9 sparc64 s390 s390x

for i in bin/named{,-sdb}/{,unix}/Makefile.in; do

  sed -i 's|fpie|fPIE|g' $i

done

%endif

:;

%build

export CFLAGS="$CFLAGS $RPM_OPT_FLAGS"

export CPPFLAGS="$CPPFLAGS -DDIG_SIGCHASE"

export STD_CDEFINES="$CPPFLAGS"

sed -i -e \

's/RELEASEVER=\(.*\)/RELEASEVER=\1-RedHat-%{version}-%{release}/' \

version

libtoolize -c -f; aclocal -I libtool.m4 --force; autoconf -f

%configure \

  --with-libtool \

  --localstatedir=/var \

  --enable-threads \

  --enable-ipv6 \

  --with-pic \

  --disable-static \

  --disable-openssl-version-check \

  --enable-exportlib \

  --with-export-libdir=%{_libdir} \

  --with-export-includedir=%{_includedir} \

  --includedir=%{_includedir}/bind9 \

%if %{PKCS11}

  --with-pkcs11=%{_libdir}/pkcs11/PKCS11_API.so \

%endif

%if %{SDB}

  --with-dlz-ldap=yes \

  --with-dlz-postgres=yes \

  --with-dlz-mysql=yes \

  --with-dlz-filesystem=yes \

  --with-dlz-bdb=yes \

%endif

%if %{GSSTSIG}

  --with-gssapi=yes \

  --disable-isc-spnego \

%endif

  --enable-fixed-rrset \

  --with-docbook-xsl=%{_datadir}/sgml/docbook/xsl-stylesheets \

;

make %{?_smp_mflags}

# Regenerate dig.1 manpage

pushd bin/dig

make man

popd

pushd bin/python

make man

popd

%if %{test}

%check

if [ "`whoami`" = 'root' ]; then

  set -e

  chmod -R a+rwX .

  pushd bin/tests

  pushd system

  ./ifconfig.sh up

  popd

  make test

  e=$?

  pushd system

  ./ifconfig.sh down

  popd

  popd

  if [ "$e" -ne 0 ]; then

    echo "ERROR: this build of BIND failed 'make test'. Aborting."

    exit $e;

  fi;

else

  echo 'only root can run the tests (they require an ifconfig).'

%endif

%install

rm -rf ${RPM_BUILD_ROOT}

# Build directory hierarchy

mkdir -p ${RPM_BUILD_ROOT}/etc/{logrotate.d,NetworkManager/dispatcher.d}

mkdir -p ${RPM_BUILD_ROOT}%{_libdir}/bind

mkdir -p ${RPM_BUILD_ROOT}/var/named/{slaves,data,dynamic}

mkdir -p ${RPM_BUILD_ROOT}%{_mandir}/{man1,man5,man8}

mkdir -p ${RPM_BUILD_ROOT}/run/named

mkdir -p ${RPM_BUILD_ROOT}/var/log

#chroot

mkdir -p ${RPM_BUILD_ROOT}/%{chroot_prefix}/{dev,etc,var,run/named}

mkdir -p ${RPM_BUILD_ROOT}/%{chroot_prefix}/var/{log,named,tmp}

# create symlink as it is on real filesystem

pushd ${RPM_BUILD_ROOT}/%{chroot_prefix}/var

ln -s ../run run

popd

mkdir -p ${RPM_BUILD_ROOT}/%{chroot_prefix}/etc/{pki/dnssec-keys,named}

mkdir -p ${RPM_BUILD_ROOT}/%{chroot_prefix}/%{_libdir}/bind

# these are required to prevent them being erased during upgrade of previous

# versions that included them (bug #130121):

touch ${RPM_BUILD_ROOT}/%{chroot_prefix}/dev/null

touch ${RPM_BUILD_ROOT}/%{chroot_prefix}/dev/random

touch ${RPM_BUILD_ROOT}/%{chroot_prefix}/dev/zero

touch ${RPM_BUILD_ROOT}/%{chroot_prefix}/etc/localtime

touch ${RPM_BUILD_ROOT}/%{chroot_prefix}/etc/named.conf

#end chroot

make DESTDIR=${RPM_BUILD_ROOT} install

# Remove unwanted files

rm -f ${RPM_BUILD_ROOT}/etc/bind.keys

# Systemd unit files

mkdir -p ${RPM_BUILD_ROOT}%{_unitdir}

install -m 644 %{SOURCE37} ${RPM_BUILD_ROOT}%{_unitdir}

install -m 644 %{SOURCE38} ${RPM_BUILD_ROOT}%{_unitdir}

%if %{SDB}

install -m 644 %{SOURCE39} ${RPM_BUILD_ROOT}%{_unitdir}

%endif

install -m 644 %{SOURCE40} ${RPM_BUILD_ROOT}%{_unitdir}

mkdir -p ${RPM_BUILD_ROOT}%{_libexecdir}

install -m 755 %{SOURCE41} ${RPM_BUILD_ROOT}%{_libexecdir}/setup-named-chroot.sh

install -m 755 %{SOURCE42} ${RPM_BUILD_ROOT}%{_libexecdir}/generate-rndc-key.sh

install -m 644 %SOURCE3 ${RPM_BUILD_ROOT}/etc/logrotate.d/named

install -m 755 %SOURCE4 ${RPM_BUILD_ROOT}/etc/NetworkManager/dispatcher.d/13-named

mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/sysconfig

install -m 644 %{SOURCE1} ${RPM_BUILD_ROOT}%{_sysconfdir}/sysconfig/named

%if %{SDB}

mkdir -p ${RPM_BUILD_ROOT}/etc/openldap/schema

install -m 644 %{SOURCE8} ${RPM_BUILD_ROOT}/etc/openldap/schema/dnszone.schema

install -m 644 %{SOURCE12} contrib/sdb/pgsql/

%endif

# Install isc/errno2result.h header

install -m 644 lib/isc/unix/errno2result.h ${RPM_BUILD_ROOT}%{_includedir}/isc

# Files required to run test-suite outside of build tree:

cp -fp config.h ${RPM_BUILD_ROOT}/%{_includedir}/bind9

cp -fp lib/dns/include/dns/forward.h ${RPM_BUILD_ROOT}/%{_includedir}/dns

cp -fp lib/isc/unix/include/isc/keyboard.h ${RPM_BUILD_ROOT}/%{_includedir}/isc

# Remove libtool .la files:

find ${RPM_BUILD_ROOT}/%{_libdir} -name '*.la' -exec '/bin/rm' '-f' '{}' ';';

# Remove -devel files out of buildroot if not needed

%if !%{DEVEL}

rm -f ${RPM_BUILD_ROOT}/%{_libdir}/bind9/*so

rm -rf ${RPM_BUILD_ROOT}/%{_includedir}/bind9

rm -f ${RPM_BUILD_ROOT}/%{_mandir}/man1/isc-config.sh.1*

rm -f ${RPM_BUILD_ROOT}/%{_mandir}/man3/lwres*

rm -f ${RPM_BUILD_ROOT}/%{_bindir}/isc-config.sh

%endif

# SDB manpages

%if %{SDB}

install -m 644 %{SOURCE31} ${RPM_BUILD_ROOT}%{_mandir}/man1/ldap2zone.1

install -m 644 %{SOURCE32} ${RPM_BUILD_ROOT}%{_mandir}/man8/named-sdb.8

install -m 644 %{SOURCE33} ${RPM_BUILD_ROOT}%{_mandir}/man1/zonetodb.1

install -m 644 %{SOURCE34} ${RPM_BUILD_ROOT}%{_mandir}/man1/zone2sqlite.1

%endif

# Ghost config files:

touch ${RPM_BUILD_ROOT}%{_localstatedir}/log/named.log

# configuration files:

tar -C ${RPM_BUILD_ROOT} -xjf %{SOURCE28}

touch ${RPM_BUILD_ROOT}/etc/rndc.key

touch ${RPM_BUILD_ROOT}/etc/rndc.conf

mkdir ${RPM_BUILD_ROOT}/etc/named

install -m 644 bind.keys ${RPM_BUILD_ROOT}/etc/named.iscdlv.key

install -m 644 %{SOURCE36} ${RPM_BUILD_ROOT}/etc/trusted-key.key

# sample bind configuration files for %%doc:

mkdir -p sample/etc sample/var/named/{data,slaves}

install -m 644 %{SOURCE25} sample/etc/named.conf

# Copy default configuration to %%doc to make it usable from system-config-bind

install -m 644 ${RPM_BUILD_ROOT}/etc/named.conf named.conf.default

install -m 644 ${RPM_BUILD_ROOT}/etc/named.rfc1912.zones sample/etc/named.rfc1912.zones

install -m 644 ${RPM_BUILD_ROOT}/var/named/{named.ca,named.localhost,named.loopback,named.empty}  sample/var/named

for f in my.internal.zone.db slaves/my.slave.internal.zone.db slaves/my.ddns.internal.zone.db my.external.zone.db; do 

  echo '@ in soa localhost. root 1 3H 15M 1W 1D

  ns localhost.' > sample/var/named/$f; 

done

:;

mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/tmpfiles.d

install -m 644 %{SOURCE35} ${RPM_BUILD_ROOT}%{_sysconfdir}/tmpfiles.d/named.conf

%pre

if [ "$1" -eq 1 ]; then

  /usr/sbin/groupadd -g %{bind_gid} -f -r named >/dev/null 2>&1 || :;

  /usr/sbin/useradd  -u %{bind_uid} -r -N -M -g named -s /sbin/nologin -d /var/named -c Named named >/dev/null 2>&1 || :;

fi;

:;

%post

/sbin/ldconfig

%systemd_post named.service

if [ "$1" -eq 1 ]; then

  # Initial installation

  [ -x /sbin/restorecon ] && /sbin/restorecon /etc/rndc.* /etc/named.* >/dev/null 2>&1 ;

  # rndc.key has to have correct perms and ownership, CVE-2007-6283

  [ -e /etc/rndc.key ] && chown root:named /etc/rndc.key

  [ -e /etc/rndc.key ] && chmod 0640 /etc/rndc.key

fi

:;

%preun

# Package removal, not upgrade

%systemd_preun named.service

%postun

/sbin/ldconfig

# Package upgrade, not uninstall

%systemd_postun_with_restart named.service

%if %{SDB}

%post sdb

# Initial installation 

%systemd_post named-sdb.service

%preun sdb

# Package removal, not upgrade

%systemd_preun named-sdb.service

%postun sdb

# Package upgrade, not uninstall

%systemd_postun_with_restart named-sdb.service

%endif

%triggerpostun -n bind -- bind <= 32:9.5.0-20.b1

if [ "$1" -gt 0 ]; then

  [ -e /etc/rndc.key ] && chown root:named /etc/rndc.key

  [ -e /etc/rndc.key ] && chmod 0640 /etc/rndc.key

fi

:;

%triggerun -- bind < 32:9.9.0-0.6.rc1

/sbin/chkconfig --del named >/dev/null 2>&1 || :

/bin/systemctl try-restart named.service >/dev/null 2>&1 || :

%post libs -p /sbin/ldconfig

%postun libs -p /sbin/ldconfig

%post libs-lite -p /sbin/ldconfig

%postun libs-lite -p /sbin/ldconfig

%post chroot

%systemd_post named-chroot.service

%systemd_post named-sdb-chroot.service

if [ "$1" -gt 0 ]; then

  [ -e %{chroot_prefix}/dev/random ] || \

    /bin/mknod %{chroot_prefix}/dev/random c 1 8

  [ -e %{chroot_prefix}/dev/zero ] || \

    /bin/mknod %{chroot_prefix}/dev/zero c 1 5

  [ -e %{chroot_prefix}/dev/null ] || \

    /bin/mknod %{chroot_prefix}/dev/null c 1 3

  rm -f %{chroot_prefix}/etc/localtime

  cp /etc/localtime %{chroot_prefix}/etc/localtime

fi;

:;

%posttrans chroot

if [ -x /usr/sbin/selinuxenabled ] && /usr/sbin/selinuxenabled; then

  [ -x /sbin/restorecon ] && /sbin/restorecon %{chroot_prefix}/dev/* > /dev/null 2>&1;

fi;

:;

%preun chroot

%systemd_preun named-chroot.service 

%systemd_preun named-sdb-chroot.service 

if [ "$1" -eq 0 ]; then

  # Package removal, not upgrade

  rm -f %{chroot_prefix}/dev/{random,zero,null}

  rm -f %{chroot_prefix}/etc/localtime

fi

:;

%postun chroot

# Package upgrade, not uninstall

%systemd_postun_with_restart named-chroot.service

%systemd_postun_with_restart named-sdb-chroot.service

%clean

rm -rf ${RPM_BUILD_ROOT}

:;

%files

%defattr(-,root,root,-)

%{_libdir}/bind

%config(noreplace) %verify(not md5 size mtime) %{_sysconfdir}/sysconfig/named

%config(noreplace) %attr(0644,root,named) %{_sysconfdir}/named.iscdlv.key

%config(noreplace) %attr(0644,root,named) %{_sysconfdir}/named.root.key

%{_sysconfdir}/tmpfiles.d/named.conf

%{_unitdir}/named.service

%{_sysconfdir}/NetworkManager/dispatcher.d/13-named

%{_sbindir}/arpaname

%{_sbindir}/ddns-confgen

%{_sbindir}/genrandom

%{_sbindir}/named-journalprint

%{_sbindir}/nsec3hash

%{_sbindir}/dnssec*

%{_sbindir}/named-check*

%{_sbindir}/lwresd

%{_sbindir}/named

%{_sbindir}/rndc*

%{_sbindir}/named-compilezone

%{_sbindir}/isc-hmac-fixup

%{_libexecdir}/generate-rndc-key.sh

%{_mandir}/man1/arpaname.1*

%{_mandir}/man5/named.conf.5*

%{_mandir}/man5/rndc.conf.5*

%{_mandir}/man8/rndc.8*

%{_mandir}/man8/named.8*

%{_mandir}/man8/lwresd.8*

%{_mandir}/man8/dnssec*.8*

%{_mandir}/man8/named-checkconf.8*

%{_mandir}/man8/named-checkzone.8*

%{_mandir}/man8/named-compilezone.8*

%{_mandir}/man8/rndc-confgen.8*

%{_mandir}/man8/ddns-confgen.8*

%{_mandir}/man8/genrandom.8*

%{_mandir}/man8/named-journalprint.8*

%{_mandir}/man8/nsec3hash.8*

%{_mandir}/man8/isc-hmac-fixup.8*

%doc CHANGES README named.conf.default

%doc doc/arm/*html doc/arm/*pdf

%doc sample/

# Hide configuration

%defattr(0640,root,named,0750)

%dir %{_sysconfdir}/named

%dir %{_localstatedir}/named

%config(noreplace) %verify(not link) %{_sysconfdir}/named.conf

%config(noreplace) %verify(not link) %{_sysconfdir}/named.rfc1912.zones

%config %verify(not link) %{_localstatedir}/named/named.ca

%config %verify(not link) %{_localstatedir}/named/named.localhost

%config %verify(not link) %{_localstatedir}/named/named.loopback

%config %verify(not link) %{_localstatedir}/named/named.empty

%defattr(0660,named,named,0770)

%dir %{_localstatedir}/named/slaves

%dir %{_localstatedir}/named/data

%dir %{_localstatedir}/named/dynamic

%ghost %{_localstatedir}/log/named.log

%defattr(0640,root,named,0750)

%ghost %config(noreplace) %{_sysconfdir}/rndc.key

# ^- rndc.key now created on first install only if it does not exist

# %%verify(not size,not md5) %%config(noreplace) %%attr(0640,root,named) /etc/rndc.conf

# ^- Let the named internal default rndc.conf be used -

#    rndc.conf not required unless it differs from default.

%ghost %config(noreplace) %{_sysconfdir}/rndc.conf

# ^- The default rndc.conf which uses rndc.key is in named's default internal config -

#    so rndc.conf is not necessary.

%config(noreplace) %{_sysconfdir}/logrotate.d/named

%defattr(-,named,named,-)

%dir /run/named

%if %{SDB}

%files sdb

%defattr(-,root,root,-)

%{_unitdir}/named-sdb.service

%{_mandir}/man1/zone2ldap.1*

%{_mandir}/man1/ldap2zone.1*

%{_mandir}/man1/zonetodb.1*

%{_mandir}/man1/zone2sqlite.1*

%{_mandir}/man8/named-sdb.8*

%doc contrib/sdb/ldap/README.ldap contrib/sdb/ldap/INSTALL.ldap contrib/sdb/pgsql/README.sdb_pgsql

%dir %{_sysconfdir}/openldap/schema

%config(noreplace) %{_sysconfdir}/openldap/schema/dnszone.schema

%{_sbindir}/named-sdb

%{_sbindir}/zone2ldap

%{_sbindir}/ldap2zone

%{_sbindir}/zonetodb

%{_sbindir}/zone2sqlite

%endif

%files libs

%defattr(-,root,root,-)

%{_libdir}/*so.*

%exclude %{_libdir}/*export.so.*

%files libs-lite

%defattr(-,root,root,-)

%{_libdir}/*export.so.*

%files license

%defattr(-,root,root,-)

%doc COPYRIGHT

%files utils

%defattr(-,root,root,-)

%{_bindir}/dig

%{_bindir}/host

%{_bindir}/nslookup

%{_bindir}/nsupdate

%{_mandir}/man1/host.1*

%{_mandir}/man1/nsupdate.1*

%{_mandir}/man1/dig.1*

%{_mandir}/man1/nslookup.1*

%{_sysconfdir}/trusted-key.key

%if %{DEVEL}

%files devel

%defattr(-,root,root,-)

%{_libdir}/*so

%exclude %{_libdir}/*export.so

%{_includedir}/bind9

%{_mandir}/man1/isc-config.sh.1*

%{_mandir}/man3/lwres*

%{_bindir}/isc-config.sh

%endif

%files lite-devel

%defattr(-,root,root,-)

%{_libdir}/*export.so

%{_includedir}/dns

%{_includedir}/dst

%{_includedir}/irs

%{_includedir}/isc

%{_includedir}/isccfg

%files chroot

%defattr(-,root,root,-)

%{_unitdir}/named-chroot.service

%{_unitdir}/named-sdb-chroot.service

%{_libexecdir}/setup-named-chroot.sh

%ghost %{chroot_prefix}/dev/null

%ghost %{chroot_prefix}/dev/random

%ghost %{chroot_prefix}/dev/zero

%ghost %{chroot_prefix}/etc/localtime

%defattr(0640,root,named,0750)

%dir %{chroot_prefix}

%dir %{chroot_prefix}/dev

%dir %{chroot_prefix}/etc

%dir %{chroot_prefix}/etc/named

%dir %{chroot_prefix}/etc/pki

%dir %{chroot_prefix}/etc/pki/dnssec-keys

%dir %{chroot_prefix}/var

%dir %{chroot_prefix}/run

%dir %{chroot_prefix}/var/named

%dir %{chroot_prefix}/%{_libdir}/bind

%ghost %config(noreplace) %{chroot_prefix}/etc/named.conf

%defattr(0660,named,named,0770)

%dir %{chroot_prefix}/run/named

%dir %{chroot_prefix}/var/tmp

%dir %{chroot_prefix}/var/log

%{chroot_prefix}/var/run

%dir %{chroot_prefix}/usr

%dir %{chroot_prefix}/%{_libdir}

%if %{PKCS11}

%files pkcs11

%defattr(-,root,root,-)

%doc COPYRIGHT

%{_sbindir}/pkcs11-destroy

%{_sbindir}/pkcs11-keygen

%{_sbindir}/pkcs11-list

%{_mandir}/man8/pkcs11*

%endif

%changelog

* Wed Dec 10 2014 Tomas Hozza <thozza@redhat.com> 32:9.9.3-16.P2

- Fix CVE-2014-8500 (#1171913)

* Wed Mar 05 2014 Tomas Hozza <thozza@redhat.tom> 32:9.9.3-15.P2

- dlz_dlopen driver could return the wrong error leading to a segfault (#1052781)

- Fix race condition when freeing fetch object (ISC-Bugs #35385)

* Tue Jan 14 2014 Tomas Hozza <thozza@redhat.com> 32:9.9.3-14.P2

- Fix CVE-2014-0591

* Thu Nov 28 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.3-13.P2

- Fixed memory leak in nsupdate if 'realm' was used multiple times (#984687)

* Thu Oct 31 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.3-12.P2

- Correct the upstream patch for #794940

* Wed Oct 30 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.3-11.P2

- Use upstream version of patch for previously fixed #794940

- Create symlink /var/named/chroot/var/run -> /var/named/chroot/run

- Added session-keyfile statement into default named.conf since we use /run/named

* Fri Oct 18 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.3-10.P2

- Fix race condition on send buffers in dighost.c (#794940)

* Tue Oct 08 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.3-9.P2

- install isc/errno2result.h header

* Tue Sep 10 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.3-8.P2

- Fix [ISC-Bugs #34738] dns_journal_open() returns a pointer to stack

* Fri Aug 16 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.3-7.P2

- Don't generate rndc.key if there exists rndc.conf

* Fri Aug 16 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.3-6.P2

- don't install named-sdb.service if SDB macro is defined to zero

* Sun Jul 28 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.3-5.P2

- update to 9.9.3-P2 (fix for CVE-2013-4854)

- update RRL patch to 9.9.3-P2-rl.13207.22

* Thu Jul 18 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.3-4.P1

- Fix script for setting up chroot so it unmounts everything successfully

* Wed Jun 05 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.3-3.P1

- update to 9.9.3-P1 (fix for CVE-2013-3919)

- update RRL patch to 9.9.3-P1-rl.156.01

* Mon Jun 03 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.3-2

- bump release to prevent update path issues

* Mon Jun 03 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.3-1

- update to 9.9.3

- install dns/update.h header

- update RRL patch to the latest version 9.9.3-rl.150.20

* Fri May 17 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.3-0.7.rc2

- Fix segfault in host/nslookup (#878139)

* Mon May 13 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.3-0.6.rc2

- update to 9.9.3rc2

- part of bind97-exportlib.patch not needed any more

- bind-9.9.1-P2-multlib-conflict.patch modified to reflect latest source

- rl-9.9.3rc1.patch -> rl-9.9.3rc2.patch

- bind99-opts.patch merged

* Fri May 03 2013 Tomas Hozza <thozza@redhat.com> 32:9.9.3-0.5.rc1