head	1.67;
access;
symbols
	pkgsrc-2026Q1:1.66.0.2
	pkgsrc-2026Q1-base:1.66
	pkgsrc-2025Q4:1.60.0.2
	pkgsrc-2025Q4-base:1.60
	pkgsrc-2025Q3:1.56.0.2
	pkgsrc-2025Q3-base:1.56
	pkgsrc-2025Q2:1.52.0.2
	pkgsrc-2025Q2-base:1.52
	pkgsrc-2025Q1:1.47.0.2
	pkgsrc-2025Q1-base:1.47
	pkgsrc-2024Q4:1.43.0.2
	pkgsrc-2024Q4-base:1.43
	pkgsrc-2024Q3:1.38.0.2
	pkgsrc-2024Q3-base:1.38
	pkgsrc-2024Q2:1.33.0.2
	pkgsrc-2024Q2-base:1.33
	pkgsrc-2024Q1:1.28.0.2
	pkgsrc-2024Q1-base:1.28
	pkgsrc-2023Q4:1.24.0.2
	pkgsrc-2023Q4-base:1.24
	pkgsrc-2023Q3:1.19.0.2
	pkgsrc-2023Q3-base:1.19
	pkgsrc-2023Q2:1.12.0.2
	pkgsrc-2023Q2-base:1.12
	pkgsrc-2023Q1:1.8.0.2
	pkgsrc-2023Q1-base:1.8
	pkgsrc-2022Q4:1.3.0.2
	pkgsrc-2022Q4-base:1.3;
locks; strict;
comment	@# @;


1.67
date	2026.04.01.21.55.55;	author taca;	state Exp;
branches;
next	1.66;
commitid	UvLKPIUt4kkgViAG;

1.66
date	2026.03.25.15.12.51;	author taca;	state Exp;
branches
	1.66.2.1;
next	1.65;
commitid	VjrTdXBo4SlXUmzG;

1.65
date	2026.03.01.06.51.06;	author taca;	state Exp;
branches;
next	1.64;
commitid	ZauB52l6UXJEUewG;

1.64
date	2026.02.18.17.15.23;	author taca;	state Exp;
branches;
next	1.63;
commitid	26GBW7G7cF7KISuG;

1.63
date	2026.01.21.13.54.20;	author taca;	state Exp;
branches;
next	1.62;
commitid	hbxpMkU5r5FzvgrG;

1.62
date	2026.01.14.12.57.35;	author wiz;	state Exp;
branches;
next	1.61;
commitid	mRVqLEyNYbwWpmqG;

1.61
date	2026.01.07.08.48.13;	author wiz;	state Exp;
branches;
next	1.60;
commitid	1wQ3ICD8eebefrpG;

1.60
date	2025.12.18.10.35.13;	author he;	state Exp;
branches
	1.60.2.1;
next	1.59;
commitid	00rhfTTr9gSKuSmG;

1.59
date	2025.11.20.10.17.19;	author he;	state Exp;
branches;
next	1.58;
commitid	JRaNbRpyvV3GihjG;

1.58
date	2025.10.22.14.32.26;	author taca;	state Exp;
branches;
next	1.57;
commitid	RBXFUbzboGjZDzfG;

1.57
date	2025.09.21.21.37.07;	author wiz;	state Exp;
branches;
next	1.56;
commitid	LZ9X7vvyU4ftZCbG;

1.56
date	2025.08.24.16.36.18;	author wiz;	state Exp;
branches
	1.56.2.1;
next	1.55;
commitid	wJOv3iyFVPY0e08G;

1.55
date	2025.08.24.08.56.59;	author taca;	state Exp;
branches;
next	1.54;
commitid	7QblYzfIKxavGX7G;

1.54
date	2025.07.16.14.48.02;	author taca;	state Exp;
branches;
next	1.53;
commitid	ncsPoDNBRejiSY2G;

1.53
date	2025.07.03.06.28.33;	author wiz;	state Exp;
branches;
next	1.52;
commitid	SQRUjRfmpeq7xg1G;

1.52
date	2025.05.21.13.24.35;	author taca;	state Exp;
branches
	1.52.2.1;
next	1.51;
commitid	tY8PBMXouSgDdMVF;

1.51
date	2025.04.19.07.58.08;	author wiz;	state Exp;
branches;
next	1.50;
commitid	8J0gu7BGAw8XqDRF;

1.50
date	2025.04.17.21.51.51;	author wiz;	state Exp;
branches;
next	1.49;
commitid	xcIXAVA292fk6sRF;

1.49
date	2025.04.16.14.53.56;	author taca;	state Exp;
branches;
next	1.48;
commitid	0jQCVSu4WrA1QhRF;

1.48
date	2025.04.13.15.52.09;	author taca;	state Exp;
branches;
next	1.47;
commitid	cHk5WT7WgxtYfUQF;

1.47
date	2025.02.19.14.40.05;	author taca;	state Exp;
branches;
next	1.46;
commitid	LiZai9aLs0ESy5KF;

1.46
date	2025.02.09.14.44.07;	author wiz;	state Exp;
branches;
next	1.45;
commitid	SkMxSaWBdCZ6UNIF;

1.45
date	2025.01.29.15.13.54;	author taca;	state Exp;
branches;
next	1.44;
commitid	7PR5Gg5d9GMiqoHF;

1.44
date	2024.12.26.23.57.21;	author adam;	state Exp;
branches;
next	1.43;
commitid	uSVIHBdlvVRFp4DF;

1.43
date	2024.12.13.17.29.56;	author taca;	state Exp;
branches
	1.43.2.1;
next	1.42;
commitid	H8NrEydbiahEGmBF;

1.42
date	2024.11.14.22.21.03;	author wiz;	state Exp;
branches;
next	1.41;
commitid	JmuDYqwL4erbdFxF;

1.41
date	2024.11.01.12.53.48;	author wiz;	state Exp;
branches;
next	1.40;
commitid	QB4Wk02mZPuBuWvF;

1.40
date	2024.11.01.00.53.01;	author wiz;	state Exp;
branches;
next	1.39;
commitid	QT27BdVP362gvSvF;

1.39
date	2024.10.21.13.24.45;	author taca;	state Exp;
branches;
next	1.38;
commitid	Iu1lHCGlzzQY1xuF;

1.38
date	2024.09.21.10.24.29;	author wiz;	state Exp;
branches;
next	1.37;
commitid	5cJzOpsKBnHZZEqF;

1.37
date	2024.09.18.16.10.02;	author taca;	state Exp;
branches;
next	1.36;
commitid	X9UnAyQtk47D0jqF;

1.36
date	2024.08.24.10.18.18;	author he;	state Exp;
branches;
next	1.35;
commitid	0oALJw8WjqwKR3nF;

1.35
date	2024.07.31.20.54.37;	author markd;	state Exp;
branches;
next	1.34;
commitid	NlmrEMbZDlQP92kF;

1.34
date	2024.07.23.13.50.32;	author taca;	state Exp;
branches;
next	1.33;
commitid	e2HTuaqV448n4YiF;

1.33
date	2024.05.29.16.33.49;	author adam;	state Exp;
branches
	1.33.2.1;
next	1.32;
commitid	n8aFyEjEVZA0JUbF;

1.32
date	2024.05.16.15.24.13;	author taca;	state Exp;
branches;
next	1.31;
commitid	QSZjMoqScpo2MeaF;

1.31
date	2024.04.20.14.02.39;	author taca;	state Exp;
branches;
next	1.30;
commitid	PlkX3wne0wIR9T6F;

1.30
date	2024.04.18.13.37.53;	author taca;	state Exp;
branches;
next	1.29;
commitid	ixc9lmIMrn945D6F;

1.29
date	2024.04.05.14.00.59;	author wiz;	state Exp;
branches;
next	1.28;
commitid	rk5q0M3dc1N8DX4F;

1.28
date	2024.03.20.14.59.15;	author taca;	state Exp;
branches
	1.28.2.1;
next	1.27;
commitid	4OR74FjgK154tU2F;

1.27
date	2024.02.13.13.50.39;	author taca;	state Exp;
branches;
next	1.26;
commitid	IKRGfiMkKk7hfhYE;

1.26
date	2024.01.30.18.29.19;	author adam;	state Exp;
branches;
next	1.25;
commitid	DUcJwa4dE7UMevWE;

1.25
date	2024.01.05.01.52.20;	author taca;	state Exp;
branches;
next	1.24;
commitid	2H6c6k2BfS8zwcTE;

1.24
date	2023.11.18.04.07.28;	author taca;	state Exp;
branches
	1.24.2.1;
next	1.23;
commitid	P8omBQsX1A2BO2NE;

1.23
date	2023.11.15.18.14.44;	author wiz;	state Exp;
branches;
next	1.22;
commitid	NOhTqnl0gAaTAJME;

1.22
date	2023.11.08.13.20.21;	author wiz;	state Exp;
branches;
next	1.21;
commitid	PsuHTklAIsF4bOLE;

1.21
date	2023.11.02.12.20.05;	author wiz;	state Exp;
branches;
next	1.20;
commitid	N5p8aLMMDOdr32LE;

1.20
date	2023.10.24.22.10.12;	author wiz;	state Exp;
branches;
next	1.19;
commitid	MTsrqKm6aGrQAVJE;

1.19
date	2023.09.20.13.37.16;	author taca;	state Exp;
branches;
next	1.18;
commitid	nFI0gqAMARSDRvFE;

1.18
date	2023.09.19.16.19.27;	author he;	state Exp;
branches;
next	1.17;
commitid	2HtYtnxINdb9NoFE;

1.17
date	2023.08.29.14.47.21;	author taca;	state Exp;
branches;
next	1.16;
commitid	LJRxR6nMHdpxXGCE;

1.16
date	2023.07.19.15.20.21;	author taca;	state Exp;
branches;
next	1.15;
commitid	NiXXTDFsrmJxsqxE;

1.15
date	2023.07.18.18.36.29;	author nia;	state Exp;
branches;
next	1.14;
commitid	RHsqmRdmBXQOzjxE;

1.14
date	2023.07.13.13.45.43;	author nia;	state Exp;
branches;
next	1.13;
commitid	4kRTXP8H4e6M7EwE;

1.13
date	2023.07.12.19.58.50;	author nia;	state Exp;
branches;
next	1.12;
commitid	XCMxQA1pLug1eywE;

1.12
date	2023.06.21.14.42.23;	author taca;	state Exp;
branches;
next	1.11;
commitid	Yro7Q5bisWQk9PtE;

1.11
date	2023.05.17.13.43.52;	author taca;	state Exp;
branches;
next	1.10;
commitid	BKAViSSEVmt1XjpE;

1.10
date	2023.04.24.13.48.06;	author taca;	state Exp;
branches;
next	1.9;
commitid	EaAvJVZLqkneImmE;

1.9
date	2023.04.19.08.11.01;	author adam;	state Exp;
branches;
next	1.8;
commitid	B8gCWhWtMX9vZGlE;

1.8
date	2023.03.17.13.58.59;	author taca;	state Exp;
branches
	1.8.2.1;
next	1.7;
commitid	ZYvThFIaXDgKZthE;

1.7
date	2023.02.16.13.37.16;	author taca;	state Exp;
branches;
next	1.6;
commitid	BvJUxBqAFlT6OKdE;

1.6
date	2023.02.08.00.13.44;	author taca;	state Exp;
branches;
next	1.5;
commitid	q98NuaQ2UfUcCEcE;

1.5
date	2023.01.13.05.31.52;	author sekiya;	state Exp;
branches;
next	1.4;
commitid	aOdYbk3vDGsadl9E;

1.4
date	2023.01.12.19.01.46;	author jperkin;	state Exp;
branches;
next	1.3;
commitid	3wKv9girq6QXIh9E;

1.3
date	2022.12.14.21.44.03;	author sekiya;	state Exp;
branches
	1.3.2.1;
next	1.2;
commitid	OQxQjPGJm7zXxz5E;

1.2
date	2022.12.12.22.07.04;	author sekiya;	state Exp;
branches;
next	1.1;
commitid	d66cJaIllF5eKj5E;

1.1
date	2022.12.11.01.57.55;	author sekiya;	state Exp;
branches;
next	;
commitid	h7zPtdhDkR9G555E;

1.66.2.1
date	2026.04.05.16.12.57;	author maya;	state Exp;
branches;
next	;
commitid	asyoy0PALF8GTMAG;

1.60.2.1
date	2026.01.24.03.03.23;	author maya;	state Exp;
branches;
next	;
commitid	j3yJQh1iOt5jOArG;

1.56.2.1
date	2025.10.23.02.15.17;	author maya;	state Exp;
branches;
next	;
commitid	T7L2HVOIVGS8xDfG;

1.52.2.1
date	2025.07.17.22.24.56;	author maya;	state Exp;
branches;
next	;
commitid	e1wRoyUmKpuqn93G;

1.43.2.1
date	2025.02.06.15.06.02;	author maya;	state Exp;
branches;
next	;
commitid	f6KHWr0VNK7I7qIF;

1.33.2.1
date	2024.07.28.13.17.32;	author spz;	state Exp;
branches;
next	;
commitid	repSiCJUwkE7JBjF;

1.28.2.1
date	2024.04.23.16.18.48;	author bsiegert;	state Exp;
branches;
next	;
commitid	qXnwRN1BAFXCOh7F;

1.24.2.1
date	2024.02.13.16.45.51;	author bsiegert;	state Exp;
branches;
next	;
commitid	LqoKb3tLLHapdiYE;

1.8.2.1
date	2023.06.26.09.34.44;	author bsiegert;	state Exp;
branches;
next	;
commitid	bkBuSWXOCfBRhruE;

1.3.2.1
date	2023.02.12.19.52.24;	author spz;	state Exp;
branches;
next	;
commitid	wEIDgliX3e3O0hdE;


desc
@@


1.67
log
@net/bind918: update to 9.18.48

9.18.48 (2026-04-01)

Security Fixes

* Fix crash when reconfiguring zone update policy during active updates.

  We fixed a crash that could occur when running rndc reconfig to change a
  zone's update policy (e.g., from allow-update to update-policy) while DNS
  UPDATE requests were being processed for that zone.

  ISC would like to thank Vitaly Simonovich for bringing this issue to our
  attention.  [GL #5817]

Bug Fixes

* Fix a crash triggered by rndc modzone on a zone from a configuration file.

* Calling rndc modzone on a zone that was configured in the configuration
  file caused a crash.  This has been fixed.  [GL #5800]

* Fix a crash triggered by rndc modzone on zone that already existed in NZF
  file.

  Calling rndc modzone didn't work properly for a zone that was configured
  in the configuration file.  It could crash if BIND 9 was built without
  LMDB or if there was already an NZF file for the zone.  This has been
  fixed.  [GL #5826]
@
text
@# $NetBSD: Makefile,v 1.66 2026/03/25 15:12:51 taca Exp $

DISTNAME=	bind-${BIND_VERSION}
PKGNAME=	${DISTNAME:S/-P/pl/}
CATEGORIES=	net
MASTER_SITES=	https://downloads.isc.org/isc/bind9/${BIND_VERSION}/
EXTRACT_SUFX=	.tar.xz

MAINTAINER=	pkgsrc-users@@NetBSD.org
HOMEPAGE=	https://www.isc.org/bind/
COMMENT=	Berkeley Internet Name Daemon implementation of DNS, version 9.18
LICENSE=	mpl-2.0

CONFLICTS+=	host-[0-9]*

MAKE_JOBS_SAFE=	no

BIND_VERSION=	9.18.48

BUILD_DEFS+=	BIND_DIR VARBASE

.include "options.mk"

USE_TOOLS+=		aclocal autoconf automake pax perl pkg-config
USE_LIBTOOL=		yes
# Requires support for C11 atomics.
USE_CC_FEATURES+=	c11
GNU_CONFIGURE=		yes
CHECK_FILES_SKIP=	bin/tests/system/system-test-driver.sh
MAKE_ENV+=		WRKDIR=${WRKDIR} PREFIX=${PREFIX}

.if ${OPSYS} == "Linux" && !exists(/usr/include/sys/capability.h)
CONFIGURE_ARGS+=		--disable-linux-caps
.endif

CONFIGURE_ARGS+=		--sysconfdir=${PKG_SYSCONFDIR}
CONFIGURE_ARGS+=		--localstatedir=${VARBASE}
CONFIGURE_ARGS+=		--with-openssl=${SSLBASE:Q}
CONFIGURE_ARGS.DragonFly+=	--disable-kqueue
CONFIGURE_ARGS.SunOS+=		--disable-epoll
CONFIGURE_ENV+=			ac_cv_path_SPHINX_BUILD=""

# Remove WRKDIR reference by modifying pkg-config related path.
SUBST_CLASSES+=		pkgconf
SUBST_STAGE.pkgconf=	pre-configure
SUBST_FILES.pkgconf=	configure.ac
SUBST_MESSAGE.pkgconf=	Fixing pkg-config path.
SUBST_VARS.pkgconf+=	BUILDLINK_DIR PREFIX TOOLS_DIR

BUILDLINK_TRANSFORM.SunOS+=	rm:-zrelax=transtls

PKG_GROUPS_VARS+=	BIND_GROUP
PKG_USERS_VARS=		BIND_USER

PKG_GROUPS=		${BIND_GROUP}
PKG_USERS=		${BIND_USER}:${BIND_GROUP}

PKG_GECOS.${BIND_USER}=	Named pseudo-user
PKG_HOME.${BIND_USER}=	${BIND_DIR}

DOCS=			OPTIONS.md README.md

FILES_SUBST+=		BIND_GROUP=${BIND_GROUP} \
			BIND_USER=${BIND_USER} PAX=${PAX:Q} \
			SSLBASE=${SSLBASE}
MESSAGE_SUBST+=		BIND_DIR=${BIND_DIR} BIND_USER=${BIND_USER}

DOCDIR=			share/doc/bind9

RCD_SCRIPTS=		named9
SMF_METHODS=		named

INSTALL_MAKE_FLAGS+=	sysconfdir=${PREFIX}/share/examples/bind9
CONF_FILES+=		share/examples/bind9/bind.keys \
			${PKG_SYSCONFDIR}/bind.keys

INSTALLATION_DIRS+=	${DOCDIR}

pre-configure:
	cd ${WRKSRC} && \
	rm -rf autom4te*.cache && \
	aclocal && \
	automake --include-deps --add-missing --copy && \
	autoconf -f

post-install:
.for f in ${DOCS}
	${INSTALL_DATA} ${WRKSRC}/${f} ${DESTDIR}${PREFIX}/${DOCDIR}
.endfor

.include "../../mk/atomic64.mk"
.include "../../www/nghttp2/buildlink3.mk"
.include "../../security/openssl/buildlink3.mk"
.include "../../devel/libuv/buildlink3.mk"
.include "../../devel/zlib/buildlink3.mk"
.include "../../mk/bsd.pkg.mk"
@


1.66
log
@net/bind918: update to 9.18.47

This is security release and from release announce:


Our March 2026 maintenance releases of BIND 9 are available and can be downloaded from the links below.  Packages and container images provided by ISC will be updated later today.

In addition to bug fixes and feature improvements, these releases also contain fixes for security vulnerabilities.  More information can be found in the following Security Advisories:

    https://kb.isc.org/docs/cve-2026-1519
    https://kb.isc.org/docs/cve-2026-3104
    https://kb.isc.org/docs/cve-2026-3119
    https://kb.isc.org/docs/cve-2026-3591

A link to each newly-released version follows.  Each release directory includes a complete source tarball, cryptographic signature, and release notes.  The release notes provide a summary of significant changes, and should be reviewed before upgrading.

  - Current supported stable branches:

    - 9.18.47  - https://downloads.isc.org/isc/bind9/9.18.47/
    - 9.20.21  - https://downloads.isc.org/isc/bind9/9.20.21/

  - Experimental development branch:

    - 9.21.20  - https://downloads.isc.org/isc/bind9/9.21.20/
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.65 2026/03/01 06:51:06 taca Exp $
d18 1
a18 1
BIND_VERSION=	9.18.47
@


1.66.2.1
log
@Pullup ticket #7070 - requested by taca
net/bind918: Security fix

Revisions pulled up:
- net/bind918/Makefile                                          1.67
- net/bind918/distinfo                                          1.39

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Wed Apr  1 21:55:55 UTC 2026

   Modified Files:
   	pkgsrc/net/bind918: Makefile distinfo

   Log Message:
   net/bind918: update to 9.18.48

   9.18.48 (2026-04-01)

   Security Fixes

   * Fix crash when reconfiguring zone update policy during active updates.

     We fixed a crash that could occur when running rndc reconfig to change a
     zone's update policy (e.g., from allow-update to update-policy) while DNS
     UPDATE requests were being processed for that zone.

     ISC would like to thank Vitaly Simonovich for bringing this issue to our
     attention.  [GL #5817]

   Bug Fixes

   * Fix a crash triggered by rndc modzone on a zone from a configuration file.

   * Calling rndc modzone on a zone that was configured in the configuration
     file caused a crash.  This has been fixed.  [GL #5800]

   * Fix a crash triggered by rndc modzone on zone that already existed in NZF
     file.

     Calling rndc modzone didn't work properly for a zone that was configured
     in the configuration file.  It could crash if BIND 9 was built without
     LMDB or if there was already an NZF file for the zone.  This has been
     fixed.  [GL #5826]
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.66 2026/03/25 15:12:51 taca Exp $
d18 1
a18 1
BIND_VERSION=	9.18.48
@


1.65
log
@net/bind918: update to 9.18.46

9.18.46 (2026-02-27)

Bug Fixes

* A stale answer could have been served in case of multiple upstream
  failures when following CNAME chains. This has been fixed. [GL #5751]
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.64 2026/02/18 17:15:23 taca Exp $
d18 1
a18 1
BIND_VERSION=	9.18.46
@


1.64
log
@net/bind918: update to 9.18.45

BIND 9.18.45 (2026-02-18)

Feature Changes

* Update requirements for system test suite.
* Python 3.10 or newer is now required for running the system test suite.
  The required Python packages and their version requirements are now
  tracked in the file bin/tests/system/requirements.txt.
  [GL #5690] [GL #5614]

Bug Fixes

* Fix implementation of BRID and HHIT record types. [GL #5710]
* Fix implementation of DSYNC record type. [GL #5711]
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.63 2026/01/21 13:54:20 taca Exp $
d18 1
a18 1
BIND_VERSION=	9.18.45
@


1.63
log
@net/bind918: update to 9.18.44

This release contains security fix, <https://kb.isc.org/docs/cve-2025-13878>.
9.18.44 (2026-01-21)


Security Fixes

* Fix incorrect length checks for BRID and HHIT records. (CVE-2025-13878)

* Malformed BRID and HHIT records could trigger an assertion failure. This
  has been fixed.

* ISC would like to thank Vlatko Kosturjak from Marlink Cyber for bringing
  this vulnerability to our attention.  [GL #5616]

Bug Fixes

* Allow glue in delegations with QTYPE=ANY.

* When a query for type ANY triggered a delegation response, all additional
  data was omitted from the response, including mandatory glue.  This has
  been fixed. [GL #5659]

Reconfiguring an NSEC3 opt-out zone to NSEC caused the zone to be invalid.

* A zone that was signed with NSEC3, had opt-out enabled, and was then
  reconfigured to use NSEC, was published with missing NSEC records.  This
  has been fixed.  [GL #5679]
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.62 2026/01/14 12:57:35 wiz Exp $
d18 1
a18 1
BIND_VERSION=	9.18.44
@


1.62
log
@*: recursive bump for abseil-20260107.0 shlib version bump
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.61 2026/01/07 08:48:13 wiz Exp $
a4 1
PKGREVISION=	2
d18 1
a18 1
BIND_VERSION=	9.18.43
@


1.61
log
@*: recursive bump for icu 78.1
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.60 2025/12/18 10:35:13 he Exp $
d5 1
a5 1
PKGREVISION=	1
@


1.60
log
@net/bind918: update to version 9.18.43.

Pkgsrc changes:
 * Bump version & re-compute checksums.
 * Adapt one of the patches.

Upstream changes:

Notes for BIND 9.18.43
----------------------

Bug Fixes
~~~~~~~~~

- Adding NSEC3 opt-out records could leave invalid records in chain.

  When creating an NSEC3 opt-out chain, a node in the chain could be
  removed too soon. The previous NSEC3 would therefore not be found,
  resulting in invalid NSEC3 records being left in the zone. This has
  been fixed. :gl:`#5671`

- ``AMTRELAY`` type 0 presentation format handling was wrong.

  :rfc:`8777` specifies a placeholder value of ``.`` for the gateway field
  when the gateway type is 0 (no gateway). This was not being checked
  for, nor was it emitted when displaying the record. This has been corrected.

  Instances of this record will need the placeholder period added to
  them when upgrading. :gl:`#5639`

OKed by maya@@ and wiz@@.
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.59 2025/11/20 10:17:19 he Exp $
d5 1
@


1.60.2.1
log
@Pullup ticket #7046 - requested by taca
net/bind918: Security fix

Revisions pulled up:
- net/bind918/Makefile                                          1.63
- net/bind918/distinfo                                          1.35

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Wed Jan 21 13:54:21 UTC 2026

   Modified Files:
   	pkgsrc/net/bind918: Makefile distinfo

   Log Message:
   net/bind918: update to 9.18.44

   This release contains security fix, <https://kb.isc.org/docs/cve-2025-13878>.
   9.18.44 (2026-01-21)

   Security Fixes

   * Fix incorrect length checks for BRID and HHIT records. (CVE-2025-13878)

   * Malformed BRID and HHIT records could trigger an assertion failure. This
     has been fixed.

   * ISC would like to thank Vlatko Kosturjak from Marlink Cyber for bringing
     this vulnerability to our attention.  [GL #5616]

   Bug Fixes

   * Allow glue in delegations with QTYPE=ANY.

   * When a query for type ANY triggered a delegation response, all additional
     data was omitted from the response, including mandatory glue.  This has
     been fixed. [GL #5659]

   Reconfiguring an NSEC3 opt-out zone to NSEC caused the zone to be invalid.

   * A zone that was signed with NSEC3, had opt-out enabled, and was then
     reconfigured to use NSEC, was published with missing NSEC records.  This
     has been fixed.  [GL #5679]
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.60 2025/12/18 10:35:13 he Exp $
d18 1
a18 1
BIND_VERSION=	9.18.44
@


1.59
log
@net/bind918: update BIND to version 9.18.42.

Pkgsrc changes:
 * version bump, checksum updates.

Upstream changes:

BIND 9.18.42
------------

Bug Fixes
~~~~~~~~~

- Skip unsupported algorithms when looking for signing key.
  ``2882dbfc803``

  A mix of supported and unsupported DNSSEC algorithms in the same zone
  could have caused validation failures. Ignore the DNSSEC keys with
  unsupported algorithm when looking for the signing keys. :gl:`#5622`
  :gl:`!11211`
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.58 2025/10/22 14:32:26 taca Exp $
d18 1
a18 1
BIND_VERSION=	9.18.42
@


1.58
log
@net/bind918: update to 9.18.41

BIND 9.18.41 (2025-10-22)

Security Fixes

* DNSSEC validation fails if matching but invalid DNSKEY is
  found. (CVE-2025-8677)

  Previously, if a matching but cryptographically invalid key was
  encountered during DNSSEC validation, the key was skipped and not counted
  towards validation failures.  named now treats such DNSSEC keys as hard
  failures and the DNSSEC validation fails immediately, instead of
  continuing with the next DNSKEYs in the RRset.

  ISC would like to thank Zuyao Xu and Xiang Li from the All-in-One Security
  and Privacy Laboratory at Nankai University for bringing this
  vulnerability to our attention.  [GL #5343]

* Address various spoofing attacks. (CVE-2025-40778)

  Previously, several issues could be exploited to poison a DNS cache with
  spoofed records for zones which were not DNSSEC-signed or if the resolver
  was configured to not do DNSSEC validation.  These issues were assigned
  CVE-2025-40778 and have now been fixed.

  As an additional layer of protection, named no longer accepts DNAME
  records or extraneous NS records in the AUTHORITY section unless these are
  received via spoofing-resistant transport (TCP, UDP with DNS cookies,
  TSIG, or SIG(0)).

  ISC would like to thank Yuxiao Wu, Yunyi Zhang, Baojun Liu, and Haixin
  Duan from Tsinghua University for bringing this vulnerability to our
  attention.  [GL #5414]

* Cache-poisoning due to weak pseudo-random number
  generator. (CVE-2025-40780)

  It was discovered during research for an upcoming academic paper that a
  xoshiro128** internal state can be recovered by an external 3rd party,
  allowing the prediction of UDP ports and DNS IDs in outgoing queries.
  This could lead to an attacker spoofing the DNS answers with great
  efficiency and poisoning the DNS cache.

  The internal random generator has been changed to a cryptographically
  secure pseudo-random generator.

  ISC would like to thank Prof.  Amit Klein and Omer Ben Simhon from Hebrew
  University of Jerusalem for bringing this vulnerability to our attention.
  [GL #5484]

New Features

* Support for parsing HHIT and BRID records has been added.

  [GL #5444]

Removed Features

* Deprecate the "tkey-domain" statement.

  Mark the tkey-domain statement as deprecated since it is only used by code
  implementing TKEY Mode 2 (Diffie-Hellman), which was removed from newer
  BIND 9 branches.  [GL #4204]

* Deprecate the "tkey-gssapi-credential" statement.

  The tkey-gssapi-keytab statement allows GSS-TSIG to be set up in a simpler
  and more reliable way than using the tkey-gssapi-credential statement and
  setting environment variables (e.g. KRB5_KTNAME).  Therefore, the
  tkey-gssapi-credential statement has been deprecated; tkey-gssapi-keytab
  should be used instead.

  For configurations currently using a combination of both
  tkey-gssapi-keytab and tkey-gssapi-credential, the latter should be
  dropped and the keytab pointed to by tkey-gssapi-keytab should now only
  contain the credential previously specified by tkey-gssapi-credential.
  [GL #4204]

Bug Fixes

* Prevent spurious SERVFAILs for certain 0-TTL resource records.

  Under certain circumstances, BIND 9 can return SERVFAIL when updating
  existing entries in the cache with new NS, A, AAAA, or DS records that
  have a TTL of zero.  [GL #5294]

* Missing DNSSEC information when CD bit is set in query.

  The RRSIGs for glue records were not being cached correctly for CD=1
  queries.  This has been fixed. [GL #5502]
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.57 2025/09/21 21:37:07 wiz Exp $
d18 1
a18 1
BIND_VERSION=	9.18.41
@


1.57
log
@*: reset maintainer
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.56 2025/08/24 16:36:18 wiz Exp $
a4 1
PKGREVISION=	1
d18 1
a18 1
BIND_VERSION=	9.18.39
@


1.56
log
@*: recursive bump for abseil 20250814.0
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.55 2025/08/24 08:56:59 taca Exp $
d10 1
a10 1
MAINTAINER=	sekiya@@NetBSD.org
@


1.56.2.1
log
@Pullup ticket #7023 - requested by taca
net/bind918: Security fix

Revisions pulled up:
- net/bind918/Makefile                                          1.58
- net/bind918/distinfo                                          1.32
- net/bind918/patches/patch-config.h.in                         1.2

---
   Module Name:	pkgsrc
   Committed By:	wiz
   Date:		Sun Sep 21 21:37:07 UTC 2025

   Modified Files:
   	pkgsrc/mail/getmail6: Makefile
   	pkgsrc/net/bind918: Makefile
   	pkgsrc/net/kea: Makefile

   Log Message:
   *: reset maintainer

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Wed Oct 22 14:32:26 UTC 2025

   Modified Files:
   	pkgsrc/net/bind918: Makefile distinfo
   	pkgsrc/net/bind918/patches: patch-config.h.in

   Log Message:
   net/bind918: update to 9.18.41

   BIND 9.18.41 (2025-10-22)

   Security Fixes

   * DNSSEC validation fails if matching but invalid DNSKEY is
     found. (CVE-2025-8677)

     Previously, if a matching but cryptographically invalid key was
     encountered during DNSSEC validation, the key was skipped and not counted
     towards validation failures.  named now treats such DNSSEC keys as hard
     failures and the DNSSEC validation fails immediately, instead of
     continuing with the next DNSKEYs in the RRset.

     ISC would like to thank Zuyao Xu and Xiang Li from the All-in-One Security
     and Privacy Laboratory at Nankai University for bringing this
     vulnerability to our attention.  [GL #5343]

   * Address various spoofing attacks. (CVE-2025-40778)

     Previously, several issues could be exploited to poison a DNS cache with
     spoofed records for zones which were not DNSSEC-signed or if the resolver
     was configured to not do DNSSEC validation.  These issues were assigned
     CVE-2025-40778 and have now been fixed.

     As an additional layer of protection, named no longer accepts DNAME
     records or extraneous NS records in the AUTHORITY section unless these are
     received via spoofing-resistant transport (TCP, UDP with DNS cookies,
     TSIG, or SIG(0)).

     ISC would like to thank Yuxiao Wu, Yunyi Zhang, Baojun Liu, and Haixin
     Duan from Tsinghua University for bringing this vulnerability to our
     attention.  [GL #5414]

   * Cache-poisoning due to weak pseudo-random number
     generator. (CVE-2025-40780)

     It was discovered during research for an upcoming academic paper that a
     xoshiro128** internal state can be recovered by an external 3rd party,
     allowing the prediction of UDP ports and DNS IDs in outgoing queries.
     This could lead to an attacker spoofing the DNS answers with great
     efficiency and poisoning the DNS cache.

     The internal random generator has been changed to a cryptographically
     secure pseudo-random generator.

     ISC would like to thank Prof.  Amit Klein and Omer Ben Simhon from Hebrew
     University of Jerusalem for bringing this vulnerability to our attention.
     [GL #5484]

   New Features

   * Support for parsing HHIT and BRID records has been added.

     [GL #5444]

   Removed Features

   * Deprecate the "tkey-domain" statement.

     Mark the tkey-domain statement as deprecated since it is only used by code
     implementing TKEY Mode 2 (Diffie-Hellman), which was removed from newer
     BIND 9 branches.  [GL #4204]

   * Deprecate the "tkey-gssapi-credential" statement.

     The tkey-gssapi-keytab statement allows GSS-TSIG to be set up in a simpler
     and more reliable way than using the tkey-gssapi-credential statement and
     setting environment variables (e.g. KRB5_KTNAME).  Therefore, the
     tkey-gssapi-credential statement has been deprecated; tkey-gssapi-keytab
     should be used instead.

     For configurations currently using a combination of both
     tkey-gssapi-keytab and tkey-gssapi-credential, the latter should be
     dropped and the keytab pointed to by tkey-gssapi-keytab should now only
     contain the credential previously specified by tkey-gssapi-credential.
     [GL #4204]

   Bug Fixes

   * Prevent spurious SERVFAILs for certain 0-TTL resource records.

     Under certain circumstances, BIND 9 can return SERVFAIL when updating
     existing entries in the cache with new NS, A, AAAA, or DS records that
     have a TTL of zero.  [GL #5294]

   * Missing DNSSEC information when CD bit is set in query.

     The RRSIGs for glue records were not being cached correctly for CD=1
     queries.  This has been fixed. [GL #5502]
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.56 2025/08/24 16:36:18 wiz Exp $
d5 1
d10 1
a10 1
MAINTAINER=	pkgsrc-users@@NetBSD.org
d19 1
a19 1
BIND_VERSION=	9.18.41
@


1.55
log
@net/bind918: update to 9.18.39

BIND 9.18.39 (2025-08-20)

New Features

* Support for parsing the DSYNC record has been added.  [GL #5440]

Feature Changes

* Add deprecation warnings for RSASHA1, RSASHA1-NSEC3SHA1, and DS digest
  type 1.

  RSASHA1 and RSASHA1-NSEC-SHA1 DNSKEY algorithms have been deprecated by
  the IETF and should no longer be used for DNSSEC.  DS digest type 1 (SHA1)
  has also been deprecated in BIND 9.  Validators are now expected to treat
  these algorithms and digest as unknown, resulting in some zones being
  treated as insecure when they were previously treated as secure.  Warnings
  have been added to named and tools when these algorithms and this digest
  are being used for signing.

  Zones signed with RSASHA1 or RSASHA1-NSEC-SHA1 should be migrated to a
  different DNSKEY algorithm.

  Zones with DS or CDS records with digest type 1 (SHA1) should be updated
  to use a different digest type (e.g. SHA256) and the digest type 1 records
  should be removed.  [GL #5358]

Bug Fixes

* Clean enough memory when adding new ADB names/entries under memory
  pressure.

  The ADB memory cleaning is opportunistic even when BIND is under memory
  pressure (in the overmem condition).  The opportunistic LRU cleaning and
  overmem cleaning have been split, and the overmem cleaning always cleans
  up double of the newly allocated adbname/adbentry to ensure we never
  allocate more memory than the assigned limit.  [GL !10637]

* Rescan the interfaces again when reconfiguring the server.

  Previously on FreeBSD, the server did not listen on the configured
  localhost interfaces immediately, but only after the interface-interval
  period had passed.  After an earlier fix, the server would listen on the
  localhost after 60 minutes.

  Now, the interfaces are rescanned immediately after configuring the
  interface-interval value and begin listening on the localhost interface
  immediately.  [GL !10758]
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.54 2025/07/16 14:48:02 taca Exp $
d5 1
@


1.54
log
@net/bind918: update to 9.18.38

BIND 9.18.38 (2025-07-16)

This release contains fixes for security vulnerabilities
(CVE-2025-40776, CVE-2025-40777), about which more information is
provided in the following Security Advisories:

    https://kb.isc.org/docs/cve-2025-40776
    https://kb.isc.org/docs/cve-2025-40777

Security Fixes

* Fix an issue when some specific queries could remain unanswered with
  serve-stale enabled.

  When named was running with stale answers enabled and with the
  stale-answer-client-timeout configuration option set to 0, in certain
  situations it was possible that some queries could remain unanswered.
  This has been fixed.  [GL #5383]

New Features

* Add support for the CO flag to dig.

  Add support for Compact Denial of Existence to dig.  This includes showing
  the CO (Compact Answers OK) flag when displaying messages and adding an
  option to set the CO flag when making queries (dig +coflag).  [GL #5319]

Bug Fixes

* Correct the default interface-interval from 60s to 60m.

  When the interface-interval parser was changed from a uint32 parser to a
  duration parser, the default value stayed at plain number 60 which now
  means 60 seconds instead of 60 minutes.  The documentation also
  incorrectly states that the value is in minutes.  That has been fixed.
  [GL #5246]

* Fix a purge-keys bug when using multiple views of a zone.

  Previously, when a DNSSEC key was purged by one zone view, other zone
  views would return an error about missing key files.  This has been fixed.
  [GL #5315]
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.53 2025/07/03 06:28:33 wiz Exp $
d18 1
a18 1
BIND_VERSION=	9.18.38
@


1.53
log
@*: recursive bump for abseil shlib major change
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.52 2025/05/21 13:24:35 taca Exp $
a4 1
PKGREVISION=	1
d18 1
a18 1
BIND_VERSION=	9.18.37
@


1.52
log
@net/bind918: update to 9.18.37

This is not security release.

BIND 9.18.37 (2025-05-21)

* fix: test: Fix check_pid() in runtime system test on FreeBSD
* chg: doc: Add a note on pregenerating keys
* fix: dev: Unify the int32_t vs int_fast32_t when working with atomic types
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.51 2025/04/19 07:58:08 wiz Exp $
d5 1
@


1.52.2.1
log
@Pullup ticket #6990 - requested by taca
net/bind918: Security fix

Revisions pulled up:
- net/bind918/Makefile                                          1.54
- net/bind918/distinfo                                          1.30

---
   Module Name:    pkgsrc
   Committed By:   taca
   Date:           Wed Jul 16 14:48:02 UTC 2025

   Modified Files:
           pkgsrc/net/bind918: Makefile distinfo

   Log Message:
   net/bind918: update to 9.18.38

   BIND 9.18.38 (2025-07-16)

   This release contains fixes for security vulnerabilities
   (CVE-2025-40776, CVE-2025-40777), about which more information is
   provided in the following Security Advisories:

       https://kb.isc.org/docs/cve-2025-40776
       https://kb.isc.org/docs/cve-2025-40777

   Security Fixes

   * Fix an issue when some specific queries could remain unanswered with
     serve-stale enabled.

     When named was running with stale answers enabled and with the
     stale-answer-client-timeout configuration option set to 0, in certain
     situations it was possible that some queries could remain unanswered.
     This has been fixed.  [GL #5383]

   New Features

   * Add support for the CO flag to dig.

     Add support for Compact Denial of Existence to dig.  This includes showing
     the CO (Compact Answers OK) flag when displaying messages and adding an
     option to set the CO flag when making queries (dig +coflag).  [GL #5319]

   Bug Fixes

   * Correct the default interface-interval from 60s to 60m.

     When the interface-interval parser was changed from a uint32 parser to a
     duration parser, the default value stayed at plain number 60 which now
     means 60 seconds instead of 60 minutes.  The documentation also
     incorrectly states that the value is in minutes.  That has been fixed.
     [GL #5246]

   * Fix a purge-keys bug when using multiple views of a zone.

     Previously, when a DNSSEC key was purged by one zone view, other zone
     views would return an error about missing key files.  This has been fixed.
     [GL #5315]
@
text
@d1 1
a1 1
# $NetBSD$
d18 1
a18 1
BIND_VERSION=	9.18.38
@


1.51
log
@*: recursive bump for default Kerberos implementation switch
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.50 2025/04/17 21:51:51 wiz Exp $
a4 1
PKGREVISION=	2
d18 1
a18 1
BIND_VERSION=	9.18.36
@


1.50
log
@*: recursive bump for icu 77 and libxml2 2.14
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.49 2025/04/16 14:53:56 taca Exp $
d5 1
a5 1
PKGREVISION=	1
@


1.49
log
@net/bind918: update to 9.18.36

BIND 9.18.36 (2025-04-16)

Feature Changes

* Make TLS data processing more reliable in various network conditions.

  BIND now deciphers incoming TLS data before processing it, making it more
  similar to the handling of TCP.  This results in a more predictable
  behavior, particularly when reading from the stream is paused or resumed.
  Previously, this could result in an assertion failure when using XFR over
  TLS (XoT).  This has been fixed.  [GL #5247]

Bug Fixes

* Stop caching lack of EDNS support.

  named could falsely learn that a server did not support EDNS when a
  spoofed response was received; that subsequently prevented DNSSEC lookups
  from being made.  This has been fixed.  [GL #3949] [GL #5066]

* Fix resolver statistics counters for timed-out responses.

  When query responses timed out, the resolver could incorrectly increase
  the regular response counters, even if no response was received.  This has
  been fixed.  [GL #5193]

* Don't enforce NOAUTH/NOCONF flags in DNSKEYs.

  All DNSKEY keys are able to authenticate.  The DNS_KEYTYPE_NOAUTH (and
  DNS_KEYTYPE_NOCONF) flags were defined for the KEY rdata type, and are not
  applicable to DNSKEY.  Previously, however, because the DNSKEY
  implementation was built on top of KEY, the _NOAUTH flag prevented
  authentication in DNSKEYs as well.  This has been corrected.  [GL #5240]

* Fix inconsistency in CNAME/DNAME handling during resolution.

  Previously, in some cases, the resolver could return rdatasets of type
  CNAME or DNAME without the result code being set to DNS_R_CNAME or
  DNS_R_DNAME.  This could trigger an assertion failure.  This has been
  fixed.  [GL #5201]
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.48 2025/04/13 15:52:09 taca Exp $
d5 1
@


1.48
log
@net/bind918: update to 9.18.35

BIND 9.18.35 (2025/03/19)

Bug Fixes

* Fix deferred validation of unsigned DS and DNSKEY records.

  When processing a query with the "checking disabled" bit set (CD=1), named
  stores the invalidated result in the cache, marked "pending".  When the
  same query is sent with CD=0, the cached data is validated and either
  accepted as an answer, or ejected from the cache as invalid.  This
  deferred validation was not attempted for DS and DNSKEY records if they
  had no cached signatures, causing spurious validation failures.  The
  deferred validation is now completed in this scenario.

  Also, if deferred validation fails, the data is now re-queried to find out
  whether the zone has been corrected since the invalid data was cached.
  [GL #5066]

* Fix RPZ race condition during a reconfiguration.

  With RPZ in use, named could terminate unexpectedly because of a race
  condition when a reconfiguration command was received using rndc.  This
  has been fixed.  [GL #5146]

* "CNAME and other data check" not applied to all types.

  An incorrect optimization caused "CNAME and other data" errors not to be
  detected if certain types were at the same node as a CNAME.  This has been
  fixed.  [GL #5150]

* Remove NSEC/DS/NSEC3 RRSIG check from dns_message_parse().

  Previously, when parsing responses, named incorrectly rejected responses
  without matching RRSIG records for NSEC/DS/NSEC3 records in the authority
  section.  This rejection, if appropriate, should have been left for the
  validator to determine and has been fixed.  [GL #5185]
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.47 2025/02/19 14:40:05 taca Exp $
d18 1
a18 1
BIND_VERSION=	9.18.35
@


1.47
log
@net/bind918: update to 9.18.34

Notes for BIND 9.18.34

New Features

* Print the expiration time of the stale records.

  Print the expiration time of the stale RRsets in the cache dump.

Removed Features

* Remove –with-tuning=small/large configuration option.

  The configuration option –with-tuning has been removed as it is no longer
  required or desired.

Bug Fixes

* Fix rndc flushname for longer name server names.

  rndc flushname did not work for name server names longer than 16
  bytes. This has been fixed. [GL #3885]

* Recently expired records could be returned with a timestamp in future.

  Under rare circumstances, an RRSet that expired at the time of the query
  could be returned with a TTL in the future. This has been fixed.

  As a side effect, the expiration time of expired RRSets is no longer
  returned in a cache dump. [GL #5094]

* YAML string not terminated in negative response in delv.

  [GL #5098]

* Apply the memory limit only to ADB database items.

  Under heavy load, a resolver could exhaust the memory available for
  storing the information in the Address Database (ADB), effectively
  discarding previously stored information in the ADB.  The memory used to
  retrieve and provide information from the ADB is no longer subject to the
  same memory limits that are applied to

  the Address Database. [GL #5127]

* Avoid unnecessary locking in the zone/cache database.

  Lock contention among many worker threads referring to the same database
  node at the same time is now prevented.  This improves zone and cache
  database performance for any heavily contended database nodes. [GL #5130]

* Improve the resolver performance under attack.

  Previously, a remote client could force the DNS resolver component to
  consume memory faster than resources were cleaned up for the canceled
  resolver fetches, due to the recursive-clients limit.  If such a traffic
  pattern was sustained for a long period of time, the DNS server might
  eventually run out of the available memory.  This has been fixed.

  It should be noted that, under such a heavy attack, no outgoing DNS
  queries will be successful in BIND 9 versions both with and without the
  fix, as the generated traffic pattern will consume all the available slots
  for the recursive clients.
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.46 2025/02/09 14:44:07 wiz Exp $
d18 1
a18 1
BIND_VERSION=	9.18.34
@


1.46
log
@*: recursive bump for abseil 20250127.0
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.45 2025/01/29 15:13:54 taca Exp $
a4 1
PKGREVISION=	1
d18 1
a18 1
BIND_VERSION=	9.18.33
@


1.45
log
@net/bind918: update to 9.18.33

BIND 9.18.33 (2025-01-29)

Security Fixes

* DNS-over-HTTPS flooding fixes. (CVE-2024-12705)

  Fix DNS-over-HTTPS implementation issues that arise under heavy query
  load.  Optimize resource usage for named instances that accept queries
  over DNS-over-HTTPS.

  Previously, named processed all incoming HTTP/2 data at once, which could
  overwhelm the server, especially when dealing with clients that sent
  requests but did not wait for responses.  That has been fixed.  Now, named
  handles HTTP/2 data in smaller chunks and throttles reading until the
  remote side reads the response data.  It also throttles clients that send
  too many requests at once.

  In addition, named now evaluates excessive streams opened by clients that
  include no DNS data, which is considered "flooding."  It logs these
  clients and drops connections from them.  [GL #4795]

  In some cases, named could leave DNS-over-HTTPS connections in the
  CLOSE_WAIT state indefinitely.  That has also been fixed.  [GL #5083]

  ISC would like to thank Jean-François Billaud for his assistance with
  investigating this issue.

* Limit additional section processing for large RDATA sets. (CVE-2024-11187)

  When answering queries, don't add data to the additional section if the
  answer has more than 13 names in the RDATA.  This limits the number of
  lookups into the database(s) during a single client query, reducing the
  query-processing load.  [GL #5034]

  ISC would like to thank Toshifumi Sakaguchi for bringing this
  vulnerability to our attention.

New Features

* Add a new option to configure the maximum number of outgoing queries per
  client request.

  The configuration option max-query-count sets how many outgoing queries
  per client request are allowed.  The existing max-recursion-queries value
  is the number of permissible queries for a single name and is reset on
  every CNAME redirection.  This new option is a global limit on the client
  request.  The default is 200.

  The default for max-recursion-queries is changed from 32 to 50.  This
  allows named to send a few more queries while looking up a single name.
  [GL #4980] [GL #4921]

Bug Fixes

* Fix nsupdate hang when processing a large update.

  To mitigate DNS flood attacks over a single TCP connection, throttle the
  connection when the other side does not read the data.  Throttling should
  only occur on server-side sockets, but erroneously also happened for
  nsupdate, which acts as a client.  When nsupdate started throttling the
  connection, it never attempted to read again.  This has been fixed.  [GL
  #4910]

* Fix possible assertion failure when reloading server while processing
  update policy rules.  [GL #5006]

* Fix dnssec-signzone signing non-DNSKEY RRsets with revoked keys.

  dnssec-signzone was using revoked keys for signing RRsets other than
  DNSKEY.  This has been corrected.  [GL #5070]

* Fix improper handling of unknown directives in resolv.conf.

  The line after an unknown directive in resolv.conf could accidentally be
  skipped, potentially affecting dig, host, nslookup, nsupdate, or delv.
  This has been fixed.  [GL #5084].
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.44 2024/12/26 23:57:21 adam Exp $
d5 1
@


1.44
log
@revbump after devel/protobuf update
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.43 2024/12/13 17:29:56 taca Exp $
a4 1
PKGREVISION=	1
d18 1
a18 1
BIND_VERSION=	9.18.32
@


1.43
log
@net/bind918: update to 9.18.32

9.18.32 (2024-12-11)

New Features

* Update built-in bind.keys file with the new 2025 IANA root key.

* Add an initial-ds entry to bind.keys for the new root key, ID 38696, which
  is scheduled for publication in January 2025.  [GL #4896]

Removed Features

* Move contributed DLZ modules into a separate repository.  DLZ modules
  should not be used except in testing.

* The DLZ modules were not maintained, the DLZ interface itself is going to
  be scheduled for removal, and the DLZ interface is blocking.  Any module
  that blocks the query to the database blocks the whole server.

* The DLZ modules now live in
  https://gitlab.isc.org/isc-projects/dlz-modules repository.  [GL #4865]


Feature Changes

* Emit more helpful log messages for exceeding max-records-per-type.

* The new log message is emitted when adding or updating an RRset fails due
  to exceeding the max-records-per-type limit.  The log includes the owner
  name and type, corresponding zone name, and the limit value.  It will be
  emitted on loading a zone file, inbound zone transfer (both AXFR and
  IXFR), handling a DDNS update, or updating a cache DB.  It's especially
  helpful in the case of zone transfer, since the secondary side doesn't
  have direct access to the offending zone data.

* It could also be used for max-types-per-name, but this change doesn't
  implement it yet as it's much less likely to happen in practice.

* Harden key management when key files have become unavailable.

* Prior to doing key management, BIND 9 will check if the key files on disk
  match the expected keys.  If key files for previously observed keys have
  become unavailable, this will prevent the internal key manager from
  running.

Bug Fixes

* {&dns} is as valid as {?dns} in a SVCB's dohpath.

* dig failed to parse a valid SVCB record with a dohpath URI template
  containing a {&dns}, like "dohpath=/some/path?key=value{&dns}".  [GL
  #4922]

* Fix NSEC3 closest encloser lookup for names with empty non-terminals.

* A previous performance optimization for finding the NSEC3 closest encloser
  when generating authoritative responses could cause servers to return
  incorrect NSEC3 records in some cases.  This faulty optimization has been
  removed.  [GL #4950]

* dig options of the form [+-]option=<value> failed to display the value on
  the printed command line.  This has been fixed.  [GL #4993]

* Provide more visibility into TLS configuration errors by logging
  SSL_CTX_use_certificate_chain_file() and SSL_CTX_use_PrivateKey_file()
  errors individually.  [GL #5008]
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.42 2024/11/14 22:21:03 wiz Exp $
d5 1
@


1.43.2.1
log
@Pullup ticket #6938 - requested by taca
net/bind918: Security fix

Revisions pulled up:
- net/bind918/Makefile                                          1.44-1.45
- net/bind918/distinfo                                          1.25

---
   Module Name:	pkgsrc
   Committed By:	adam
   Date:		Thu Dec 26 23:57:23 UTC 2024

   Modified Files:
   	pkgsrc/audio/forked-daapd: Makefile
   	pkgsrc/audio/mixxx: Makefile
   	pkgsrc/audio/strawberry: Makefile
   	pkgsrc/audio/termusic: Makefile
   	pkgsrc/biology/plinkseq: Makefile
   	pkgsrc/chat/ekg: Makefile
   	pkgsrc/chat/libgadu: Makefile buildlink3.mk
   	pkgsrc/chat/mumble: Makefile
   	pkgsrc/databases/mysql80-cluster: Makefile
   	pkgsrc/databases/mysql80-server: Makefile
   	pkgsrc/databases/postgresql-postgis2: Makefile
   	pkgsrc/devel/compizconfig-backend-gconf: Makefile buildlink3.mk
   	pkgsrc/devel/libcompizconfig: Makefile buildlink3.mk
   	pkgsrc/devel/protobuf: buildlink3.mk
   	pkgsrc/devel/protobuf-c: Makefile buildlink3.mk
   	pkgsrc/devel/py-compizconfig: Makefile buildlink3.mk
   	pkgsrc/finance/bitcoin: Makefile
   	pkgsrc/geography/mapserver: Makefile
   	pkgsrc/geography/merkaartor: Makefile
   	pkgsrc/geography/qgis: Makefile
   	pkgsrc/graphics/digikam: Makefile
   	pkgsrc/graphics/opencv: Makefile buildlink3.mk
   	pkgsrc/graphics/opencv-contrib-face: Makefile buildlink3.mk
   	pkgsrc/graphics/py-Willow: Makefile
   	pkgsrc/misc/marble: Makefile
   	pkgsrc/multimedia/vlc: Makefile
   	pkgsrc/net/bind916: Makefile
   	pkgsrc/net/bind918: Makefile
   	pkgsrc/net/frr: Makefile
   	pkgsrc/net/kopete: Makefile
   	pkgsrc/net/mosh: Makefile
   	pkgsrc/net/ratman: Makefile
   	pkgsrc/net/unbound: Makefile
   	pkgsrc/sysutils/collectd-grpc: Makefile
   	pkgsrc/sysutils/collectd-pinba: Makefile
   	pkgsrc/sysutils/collectd-riemann: Makefile
   	pkgsrc/sysutils/collectd-write_prometheus: Makefile
   	pkgsrc/sysutils/riemann-client: Makefile
   	pkgsrc/wm/ccsm: Makefile

   Log Message:
   revbump after devel/protobuf update

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Wed Jan 29 15:13:54 UTC 2025

   Modified Files:
   	pkgsrc/net/bind918: Makefile distinfo

   Log Message:
   net/bind918: update to 9.18.33

   BIND 9.18.33 (2025-01-29)

   Security Fixes

   * DNS-over-HTTPS flooding fixes. (CVE-2024-12705)

     Fix DNS-over-HTTPS implementation issues that arise under heavy query=

     load.  Optimize resource usage for named instances that accept querie=
   s
     over DNS-over-HTTPS.

     Previously, named processed all incoming HTTP/2 data at once, which c=
   ould
     overwhelm the server, especially when dealing with clients that sent
     requests but did not wait for responses.  That has been fixed.  Now, =
   named
     handles HTTP/2 data in smaller chunks and throttles reading until the=

     remote side reads the response data.  It also throttles clients that =
   send
     too many requests at once.

     In addition, named now evaluates excessive streams opened by clients =
   that
     include no DNS data, which is considered "flooding."  It logs these
     clients and drops connections from them.  [GL #4795]

     In some cases, named could leave DNS-over-HTTPS connections in the
     CLOSE_WAIT state indefinitely.  That has also been fixed.  [GL #5083]=


     ISC would like to thank Jean-Fran=E7ois Billaud for his assistance wi=
   th
     investigating this issue.

   * Limit additional section processing for large RDATA sets. (CVE-2024-1=
   1187)

     When answering queries, don't add data to the additional section if t=
   he
     answer has more than 13 names in the RDATA.  This limits the number o=
   f
     lookups into the database(s) during a single client query, reducing t=
   he
     query-processing load.  [GL #5034]

     ISC would like to thank Toshifumi Sakaguchi for bringing this
     vulnerability to our attention.

   New Features

   * Add a new option to configure the maximum number of outgoing queries =
   per
     client request.

     The configuration option max-query-count sets how many outgoing queri=
   es
     per client request are allowed.  The existing max-recursion-queries v=
   alue
     is the number of permissible queries for a single name and is reset o=
   n
     every CNAME redirection.  This new option is a global limit on the cl=
   ient
     request.  The default is 200.

     The default for max-recursion-queries is changed from 32 to 50.  This=

     allows named to send a few more queries while looking up a single nam=
   e.
     [GL #4980] [GL #4921]

   Bug Fixes

   * Fix nsupdate hang when processing a large update.

     To mitigate DNS flood attacks over a single TCP connection, throttle =
   the
     connection when the other side does not read the data.  Throttling sh=
   ould
     only occur on server-side sockets, but erroneously also happened for
     nsupdate, which acts as a client.  When nsupdate started throttling t=
   he
     connection, it never attempted to read again.  This has been fixed.  =
   [GL
     #4910]

   * Fix possible assertion failure when reloading server while processing=

     update policy rules.  [GL #5006]

   * Fix dnssec-signzone signing non-DNSKEY RRsets with revoked keys.

     dnssec-signzone was using revoked keys for signing RRsets other than
     DNSKEY.  This has been corrected.  [GL #5070]

   * Fix improper handling of unknown directives in resolv.conf.

     The line after an unknown directive in resolv.conf could accidentally=
    be
     skipped, potentially affecting dig, host, nslookup, nsupdate, or delv=
   .=

     This has been fixed.  [GL #5084].
@
text
@d1 1
a1 1
# $NetBSD$
d18 1
a18 1
BIND_VERSION=	9.18.33
@


1.42
log
@*: recursive bump for icu 76 shlib major version bump
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.41 2024/11/01 12:53:48 wiz Exp $
a4 1
PKGREVISION=	3
d18 1
a18 1
BIND_VERSION=	9.18.31
d61 1
a61 1
DOCS=			CHANGES OPTIONS.md README.md
@


1.41
log
@*: revbump for icu downgrade
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.40 2024/11/01 00:53:01 wiz Exp $
d5 1
a5 1
PKGREVISION=	2
@


1.40
log
@*: recursive bump for icu 76.1 shlib bump
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.39 2024/10/21 13:24:45 taca Exp $
d5 1
a5 1
PKGREVISION=	1
@


1.39
log
@net/bind918: update to 9.18.31

9.18.31 (2024-10-16)

New Features

* Added WALLET type.

  Add the new record type WALLET (262).  This provides a mapping from a
  domain name to a cryptographic currency wallet.  Multiple mappings can
  exist if multiple records exist.  [GL #4947]

Feature Changes

* Allow IXFR-to-AXFR fallback on DNS_R_TOOMANYRECORDS.

  This change allows fallback from an IXFR failure to AXFR when the reason
  is DNS_R_TOOMANYRECORDS.  [GL #4928]

Bug Fixes

* Fix a statistics channel counter bug when "forward only" zones are used.

  When resolving a zone with a "forward only" policy, and finding out that
  all the forwarders were marked as "bad", the "ServerQuota" counter of the
  statistics channel was incorrectly increased.  This has been fixed.  [GL
  #1793]

* Fix a bug in the static-stub implementation.

  Static-stub addresses and addresses from other sources were being mixed
  together, resulting in static-stub queries going to addresses not
  specified in the configuration, or alternatively, static-stub addresses
  being used instead of the correct server addresses.  [GL #4850]

* Don't allow statistics-channels if libxml2 and libjson-c are not
  configured.

  When BIND 9 is not configured with the libxml2 and libjson-c libraries,
  the use of the statistics-channels option is a fatal error.  [GL #4895]

* Limit the outgoing UDP send queue size.

  If the operating system UDP queue got full and the outgoing UDP sending
  started to be delayed, BIND 9 could exhibit memory spikes as it tried to
  enqueue all the outgoing UDP messages.  It now tries to deliver the
  outgoing UDP messages synchronously; if that fails, it drops the outgoing
  DNS message that would get queued up and then timeout on the client side.
  [GL #4930]

* Do not set SO_INCOMING_CPU.

  Remove the SO_INCOMING_CPU setting as kernel scheduling performs better
  without constraints. [GL #4936]

Known Issues

* There are no new known issues with this release.  See above for a list of
  all known issues affecting this BIND 9 branch.
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.38 2024/09/21 10:24:29 wiz Exp $
d5 1
@


1.38
log
@*: recursive bump for protobuf 28.2

two static library became shared libraries - bump to be on the safe side
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.37 2024/09/18 16:10:02 taca Exp $
a4 1
PKGREVISION=	1
d18 1
a18 1
BIND_VERSION=	9.18.30
@


1.37
log
@net/bind918: update to 9.18.30

BIND 9.18.30 (2024-09-18)

New Features

* Print the full path of the working directory in startup log messages.

  named now prints its initial working directory during startup, and the
  changed working directory when loading or reloading its configuration
  file, if it has a valid directory option defined.  [GL #4731]

Feature Changes

* Follow the number of CPUs set by taskset/cpuset.

  Administrators may wish to constrain the set of cores that named runs on
  via the taskset, cpuset, or numactl programs (or equivalents on other
  OSes).

  If the admin has used taskset, named now automatically uses the given
  number of CPUs rather than the system-wide count. [GL #4884]

Bug Fixes

* Verification of the privacy of an EDDSA key was broken.

  The check could lead to an attempt to sign records with a public key,
  which could cause a segmentation failure (read of a NULL pointer) within
  OpenSSL.  This has been fixed. [GL #4855]

* Fix algorithm rollover bug when there are two keys with the same keytag.

  If there was an algorithm rollover and two keys of different algorithms
  shared the same keytags, there was the possibility that the check of
  whether the key matched a specific state could be performed against the
  wrong key.  This has been fixed by not only checking for the matching key
  tag but also the key algorithm.  [GL #4878]

Known Issues

* There are no new known issues with this release. See above for a list of
  all known issues affecting this BIND 9 branch.
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.36 2024/08/24 10:18:18 he Exp $
d5 1
@


1.36
log
@net/bind: update to version 9.18.29.

Pkgsrc changes:
 * None (just version + checksums)

Upstream changes:

BIND 9.18.29
------------

New Features
~~~~~~~~~~~~

- Tighten 'max-recursion-queries' and add 'max-query-restarts' option.
  ``fe3ae71e90``

  There were cases in resolver.c when the `max-recursion-queries` quota
  was ineffective. It was possible to craft zones that would cause a
  resolver to waste resources by sending excessive queries while
  attempting to resolve a name. This has been addressed by correcting
  errors in the implementation of `max-recursion-queries`, and by
  reducing the default value from 100 to 32.

  In addition, a new `max-query-restarts` option has been added which
  limits the number of times a recursive server will follow CNAME or
  DNAME records before terminating resolution. This was previously a
  hard-coded limit of 16, and now defaults to 11.   :gl:`#4741`
  :gl:`!9283`

- Generate changelog from git log. ``21a0b6aef7``

  Use a single source of truth, the git log, to generate the list of
  CHANGES. Use the .rst format and include it in the ARM for a quick
  reference with proper gitlab links to issues and merge requests.
  :gl:`#75` :gl:`!9181`

Feature Changes
~~~~~~~~~~~~~~~

- Use _exit() in the fatal() function. ``e4c483f45f``

  Since the fatal() isn't a correct but rather abrupt termination of the
  program, we want to skip the various atexit() calls because not all
  memory might be freed during fatal() call, etc.  Using _exit() instead
  of exit() has this effect - the program will end, but no destructors
  or atexit routines will be called. :gl:`!9263`

- Fix data race in clean_finds_at_name. ``541726871d``

  Stop updating `find.result_v4` and `find.result_v4` in
  `clean_finds_at_name`. The values are supposed to be
  static. :gl:`#4118` :gl:`!9198`

Bug Fixes
~~~~~~~~~

- Reconfigure catz member zones during named reconfiguration.
  ``944d0dc942``

  During a reconfiguration named wasn't reconfiguring catalog zones'
  member zones. This has been fixed. :gl:`#4733`

- Disassociate the SSL object from the cached SSL_SESSION.
  ``64fde41253``

  When the SSL object was destroyed, it would invalidate all SSL_SESSION
  objects including the cached, but not yet used, TLS session objects.

  Properly disassociate the SSL object from the SSL_SESSION before we
  store it in the TLS session cache, so we can later destroy it without
  invalidating the cached TLS sessions. :gl:`#4834` :gl:`!9279`

- Attach/detach to the listening child socket when accepting TLS.
  ``3ead47daff``

  When TLS connection (TLSstream) connection was accepted, the children
  listening socket was not attached to sock->server and thus it could
  have been freed before all the accepted connections were actually
  closed.

  In turn, this would cause us to call isc_tls_free() too soon - causing
  cascade errors in pending SSL_read_ex() in the accepted connections.

  Properly attach and detach the children listening socket when
  accepting and closing the server connections. :gl:`#4833` :gl:`!9278`

- Make hypothesis optional for system tests. ``0d1953d7a8``

  Ensure that system tests can be executed without Python hypothesis
  package. :gl:`#4831` :gl:`!9268`

- Don't loop indefinitely when isc_task quantum is 'unlimited'
  ``674420df64``

  Don't run more events than already scheduled.  If the quantum is set
  to a high value, the task_run() would execute already scheduled, and
  all new events that result from running event->ev_action().

  Setting quantum to a number of scheduled events will postpone events
  scheduled after we enter the loop here to the next task_run()
  invocation. :gl:`!9257`

- Raise the log level of priming failures. ``c948babeeb``

  When a priming query is complete, it's currently logged at level
  ISC_LOG_DEBUG(1), regardless of success or failure. We are now raising
  it to ISC_LOG_NOTICE in the case of failure. [GL #3516] :gl:`#3516`
  :gl:`!9251`

- Add a compatibility shim for older libuv versions (< 1.19.0)
  ``61ff983f00``

  The uv_stream_get_write_queue_size() is supported only in relatively
  newer versions of libuv (1.19.0 or higher).  Provide a compatibility
  shim for this function , so BIND 9 can be built in environments with
  older libuv version.

- Remove extra newline from yaml output. ``1222dbe9f9``

  I split this into two commits, one for the actual newline removal, and
  one for issues I found, ruining the yaml output when some errors were
  outputted.

- CID 498025 and CID 498031: Overflowed constant INTEGER_OVERFLOW.
  ``bbdd888b8e``

  Add INSIST to fail if the multiplication would cause the variables to
  overflow. :gl:`#4798` :gl:`!9230`

- Remove unnecessary operations. ``2374a1a2bd``

  Decrementing optlen immediately before calling continue is unneccesary
  and inconsistent with the rest of dns_message_pseudosectiontoyaml and
  dns_message_pseudosectiontotext.  Coverity was also reporting an
  impossible false positive overflow of optlen (CID 499061). :gl:`!9224`

- Fix generation of 6to4-self name expansion from IPv4 address.
  ``df55c15ebb``

  The period between the most significant nibble of the encoded IPv4
  address and the 2.0.0.2.IP6.ARPA suffix was missing resulting in the
  wrong name being checked. Add system test for 6to4-self
  implementation. :gl:`#4766` :gl:`!9218`

- Fix false QNAME minimisation error being reported. ``4984afc80c``

  Remove the false positive "success resolving" log message when QNAME
  minimisation is in effect and the final result is NXDOMAIN.
  :gl:`#4784` :gl:`!9216`

- Dig +yaml was producing unexpected and/or invalid YAML output.
  ``2db62a4dba``

  :gl:`#4796` :gl:`!9214`

- SVBC alpn text parsing failed to reject zero length alpn.
  ``8f7be89052``

  :gl:`#4775` :gl:`!9210`

- Return SERVFAIL for a too long CNAME chain. ``f7de909b98``

  When cutting a long CNAME chain, named was returning NOERROR  instead
  of SERVFAIL (alongside with a partial answer). This has been fixed.
  :gl:`#4449` :gl:`!9204`

- Properly calculate the amount of system memory. ``9faf355a5c``

  On 32 bit machines isc_meminfo_totalphys could return an incorrect
  value. :gl:`#4799` :gl:`!9200`

- Update key lifetime and metadata after dnssec-policy reconfig.
  ``2107a64ee6``

  Adjust key state and timing metadata if dnssec-policy key lifetime
  configuration is updated, so that it also affects existing keys.
  :gl:`#4677` :gl:`!9192`

- Fix dig +timeout argument when using +https. ``381d6246d6``

  The +timeout argument was not used on DoH connections. This has been
  fixed.  :gl:`#4806` :gl:`!9161`
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.35 2024/07/31 20:54:37 markd Exp $
d18 1
a18 1
BIND_VERSION=	9.18.29
@


1.35
log
@bind918: dont accidentally find sphinx
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.34 2024/07/23 13:50:32 taca Exp $
d18 1
a18 1
BIND_VERSION=	9.18.28
@


1.34
log
@net/bind918: update to 9.18.28

9.18.28 (2024-07-23)

6404.	[security]	Remove SIG(0) support from named as a countermeasure
			for CVE-2024-1975. [GL #4480]

6403.	[security]	qctx-zversion was not being cleared when it should have
			been leading to an assertion failure if it needed to be
			reused. (CVE-2024-4076) [GL #4507]

6401.	[security]	An excessively large number of rrtypes per owner can
			slow down database query processing, so a limit has been
			placed on the number of rrtypes that can be stored per
			owner (node) in a cache or zone database. This is
			configured with the new "max-rrtypes-per-name" option,
			and defaults to 100. (CVE-2024-1737)
			[GL #3403] [GL #4548]

6400.	[security]	Excessively large rdatasets can slow down database
			query processing, so a limit has been placed on the
			number of records that can be stored per rdataset
			in a cache or zone database. This is configured
			with the new "max-records-per-type" option, and
			defaults to 100. (CVE-2024-1737)
			[GL #497] [GL #3405]

6399.	[security]	Malicious DNS client that sends many queries over
			TCP but never reads responses can cause server to
			respond slowly or not respond at all for other
			clients. (CVE-2024-0760) [GL #4481]

6398.	[bug]		Fix potential data races in our DoH implementation
			related to HTTP/2 session object management and
			endpoints set object management after reconfiguration.
			We would like to thank Dzintars and Ivo from nic.lv
			for bringing this to our attention. [GL #4473]

6397.	[bug]		Clear DNS_FETCHOPT_TRYSTALE_ONTIMEOUT when looking for
			parent NS records needed to get the DS result.
			[GL #4661]

6395.	[bug]		Handle ISC_R_HOSTDOWN and ISC_R_NETDOWN in resolver.c.
			[GL #4736]

6394.	[bug]		Named's -4 and -6 options now apply to zone primaries,
			also-notify and parental-agents.  Report when a zone
			has these options configured but does not have an IPv4
			or IPv6 address listed respectively. [GL #3472]

6393.	[func]		Deal with uv_tcp_close_reset() error return codes
			more gracefully. [GL #4708]

6392.	[bug]		Use a completely new memory context when flushing the
			cache. [GL #2744]

6391.	[bug]		TCP client statistics could sometimes fail to decrease
			when accepting client connection fails. [GL #4742]

6390.	[bug]		Fix a data race in isc_task_purgeevent(). [GL !8937]

6389.	[bug]		dnssec-verify and dnssec-signzone could fail if there
			was an obscured DNSKEY RRset at a delegatation.
			[GL #4517]

6388.	[bug]		Prevent an assertion failure caused by passing NULL to
			dns_dispatch_resume() when a dns_request times out close
			to view shutdown. [GL #4719]

6386.	[bug]		When shutting down catzs->view could point to freed
			memory. Obtain a reference to the view to prevent this.
			[GL #4502]

6385.	[func]		Relax SVCB alias mode checks to allow parameters.
			[GL #4704]

6384.	[bug]		Remove infinite loop when including a directory in a
			zone file. [GL #4357]

6383.	[bug]		Address an infinite loop in $GENERATE when a negative
			value was converted in nibble mode. [GL #4353]

6382.	[bug]		Fix RPZ response's SOA record TTL, which was incorrectly
			set to 1 if 'add-soa' is used. [GL #3323]
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.33 2024/05/29 16:33:49 adam Exp $
d41 1
@


1.33
log
@revbump after icu and protobuf updates
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.32 2024/05/16 15:24:13 taca Exp $
a4 1
PKGREVISION=	1
d18 1
a18 1
BIND_VERSION=	9.18.27
@


1.33.2.1
log
@Pullup ticket #6882 - requested by taca
net/bind918: security update

Revisions pulled up:
- net/bind918/Makefile                                          1.34
- net/bind918/buildlink3.mk                                     1.3
- net/bind918/distinfo                                          1.20
- net/bind918/options.mk                                        1.3-1.4

-------------------------------------------------------------------
   Module Name:	pkgsrc
   Committed By:	adam
   Date:		Mon Jul 22 18:09:01 UTC 2024

   Modified Files:
   	pkgsrc/net/bind918: buildlink3.mk options.mk

   Log Message:
   bind918: use gssapi as an option; that fixes builds when krb5-config is installed but not buildlinked


   To generate a diff of this commit:
   cvs rdiff -u -r1.2 -r1.3 pkgsrc/net/bind918/buildlink3.mk \
       pkgsrc/net/bind918/options.mk

-------------------------------------------------------------------
   Module Name:	pkgsrc
   Committed By:	adam
   Date:		Mon Jul 22 19:07:58 UTC 2024

   Modified Files:
   	pkgsrc/net/bind918: options.mk

   Log Message:
   bind918: use KRB5_CONFIG


   To generate a diff of this commit:
   cvs rdiff -u -r1.3 -r1.4 pkgsrc/net/bind918/options.mk

-------------------------------------------------------------------
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Tue Jul 23 13:50:32 UTC 2024

   Modified Files:
   	pkgsrc/net/bind918: Makefile distinfo

   Log Message:
   net/bind918: update to 9.18.28

   9.18.28 (2024-07-23)

   6404.	[security]	Remove SIG(0) support from named as a countermeasure
   			for CVE-2024-1975. [GL #4480]

   6403.	[security]	qctx-zversion was not being cleared when it should have
   			been leading to an assertion failure if it needed to be
   			reused. (CVE-2024-4076) [GL #4507]

   6401.	[security]	An excessively large number of rrtypes per owner can
   			slow down database query processing, so a limit has been
   			placed on the number of rrtypes that can be stored per
   			owner (node) in a cache or zone database. This is
   			configured with the new "max-rrtypes-per-name" option,
   			and defaults to 100. (CVE-2024-1737)
   			[GL #3403] [GL #4548]

   6400.	[security]	Excessively large rdatasets can slow down database
   			query processing, so a limit has been placed on the
   			number of records that can be stored per rdataset
   			in a cache or zone database. This is configured
   			with the new "max-records-per-type" option, and
   			defaults to 100. (CVE-2024-1737)
   			[GL #497] [GL #3405]

   6399.	[security]	Malicious DNS client that sends many queries over
   			TCP but never reads responses can cause server to
   			respond slowly or not respond at all for other
   			clients. (CVE-2024-0760) [GL #4481]

   6398.	[bug]		Fix potential data races in our DoH implementation
   			related to HTTP/2 session object management and
   			endpoints set object management after reconfiguration.
   			We would like to thank Dzintars and Ivo from nic.lv
   			for bringing this to our attention. [GL #4473]

   6397.	[bug]		Clear DNS_FETCHOPT_TRYSTALE_ONTIMEOUT when looking for
   			parent NS records needed to get the DS result.
   			[GL #4661]

   6395.	[bug]		Handle ISC_R_HOSTDOWN and ISC_R_NETDOWN in resolver.c.
   			[GL #4736]

   6394.	[bug]		Named's -4 and -6 options now apply to zone primaries,
   			also-notify and parental-agents.  Report when a zone
   			has these options configured but does not have an IPv4
   			or IPv6 address listed respectively. [GL #3472]

   6393.	[func]		Deal with uv_tcp_close_reset() error return codes
   			more gracefully. [GL #4708]

   6392.	[bug]		Use a completely new memory context when flushing the
   			cache. [GL #2744]

   6391.	[bug]		TCP client statistics could sometimes fail to decrease
   			when accepting client connection fails. [GL #4742]

   6390.	[bug]		Fix a data race in isc_task_purgeevent(). [GL !8937]

   6389.	[bug]		dnssec-verify and dnssec-signzone could fail if there
   			was an obscured DNSKEY RRset at a delegatation.
   			[GL #4517]

   6388.	[bug]		Prevent an assertion failure caused by passing NULL to
   			dns_dispatch_resume() when a dns_request times out close
   			to view shutdown. [GL #4719]

   6386.	[bug]		When shutting down catzs->view could point to freed
   			memory. Obtain a reference to the view to prevent this.
   			[GL #4502]

   6385.	[func]		Relax SVCB alias mode checks to allow parameters.
   			[GL #4704]

   6384.	[bug]		Remove infinite loop when including a directory in a
   			zone file. [GL #4357]

   6383.	[bug]		Address an infinite loop in $GENERATE when a negative
   			value was converted in nibble mode. [GL #4353]

   6382.	[bug]		Fix RPZ response's SOA record TTL, which was incorrectly
   			set to 1 if 'add-soa' is used. [GL #3323]


   To generate a diff of this commit:
   cvs rdiff -u -r1.33 -r1.34 pkgsrc/net/bind918/Makefile
   cvs rdiff -u -r1.19 -r1.20 pkgsrc/net/bind918/distinfo
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.33 2024/05/29 16:33:49 adam Exp $
d5 1
d19 1
a19 1
BIND_VERSION=	9.18.28
@


1.32
log
@net/bind918: update to 9.18.27

9.18.27 (2024-05-15)

6374.	[bug]		Skip to next RRSIG if signature has expired or is in
			the future rather than failing immediately. [GL #4586]

6372.	[func]		Implement signature jitter for dnssec-policy. [GL #4554]
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.31 2024/04/20 14:02:39 taca Exp $
d5 1
@


1.31
log
@net/bind918: fix blocklist handling

Apply change of revision 1.21 in NetBSD base which fixed PR bin/58170.

Bump PKGREVISION.
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.30 2024/04/18 13:37:53 taca Exp $
a4 1
PKGREVISION=	1
d18 1
a18 1
BIND_VERSION=	9.18.26
@


1.30
log
@net/bind918: update to 9.18.62

9.18.26 (2024-04-17)

6364.	[protocol]	Add RESOLVER.ARPA to the built in empty zones.
			[GL #4580]

6363.	[bug]		dig/mdig +ednsflags=<non-zero-value> did not re-enable
			EDNS if it had been disabled. [GL #4641]

6361.	[bug]		Some invalid ISO 8601 durations were accepted
			erroneously. [GL #4624]

6360.	[bug]		Don't return static-stub synthesised NS RRset.
			[GL #4608]

6359.	[bug]		Fix bug in Depends (keymgr_dep) function. [GL #4552]

6351.	[protocol]	Support for the RESINFO record type has been added.
			[GL #4413]

6346.	[bug]		Cleaned up several minor bugs in the RBTDB dbiterator
			implementation. [GL !8741]

6345.	[bug]		Added missing dns_rdataset_disassociate calls in
			validator.c:findnsec3proofs. [GL #4571]

6340.	[test]		Fix incorrectly reported errors when running tests
			with `make test` on platforms with older pytest.
			[GL #4560]

6338.	[func]		Optimize slabheader placement, so the infrastructure
			records are put in the beginning of the slabheader
			linked list. [GL !8675]

6334.	[doc]		Improve ARM parental-agents definition. [GL #4531]

6333.	[bug]		Fix the DNS_GETDB_STALEFIRST flag, which was defined
			incorrectly in lib/ns/query.c. [GL !8683]

6330.	[doc]		Update ZSK minimum lifetime documentation in ARM, also
			depends on signing delay. [GL #4510]

6328.	[func]		Add workaround to enforce dynamic linker to pull
			jemalloc earlier than libc to ensure all memory
			allocations are done via jemalloc. [GL #4404]

6326.	[bug]		Changes to "listen-on" statements were ignored on
			reconfiguration unless the port or interface address was
			changed, making it impossible to change a related
			listener transport type. Thanks to Thomas Amgarten.
			[GL #4518] [GL #4528]

6325.	[func]		Expose the TCP client count in statistics channel.
			[GL #4425]

6324.	[bug]		Fix a possible crash in 'dig +nssearch +nofail' and
			'host -C' commands when one of the name servers returns
			SERVFAIL. [GL #4508]

6313.	[bug]		When dnssec-policy is in effect the DNSKEY's TTLs in
			the zone where not being updated to match the policy.
			This lead to failures when DNSKEYs where updated as the
			TTLs mismatched. [GL #4466]
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.29 2024/04/05 14:00:59 wiz Exp $
d5 1
@


1.29
log
@*: recursive bump for protobuf 26.1
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.28 2024/03/20 14:59:15 taca Exp $
a4 1
PKGREVISION=	1
d18 1
a18 1
BIND_VERSION=	9.18.25
@


1.28
log
@net/bind918: update to 9.18.25

9.18.25 (2024-03-20)

6356.	[bug]		Create the pruning task in the dns_cache_flush(), so
			the cache pruning still works after the flush.
			[GL #4621]

6353.	[bug]		Improve the TTL-based cleaning by removing the expired
			headers from the heap, so they don't block the next
			cleaning round and clean more than a single item for
			each new addition to the RBTDB. [GL #4591]

6352.	[bug]		Revert change 6319 and decrease lock contention during
			RBTDB tree pruning by not cleaning up nodes recursively
			within a single prune_tree() call. [GL #4596]

6350.	[bug]		Address use after free in expire_lru_headers. [GL #4495]
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.27 2024/02/13 13:50:39 taca Exp $
d5 1
@


1.28.2.1
log
@Pullup ticket #6851 - requested by taca
net/bind918: blocklist handling fix (PR bin/58170)

Revisions pulled up:
- net/bind918/Makefile                                          1.29-1.31
- net/bind918/distinfo                                          1.17-1.18
- net/bind918/patches/patch-lib_ns_query.c                      1.2

---
   Module Name:	pkgsrc
   Committed By:	wiz
   Date:		Fri Apr  5 14:01:01 UTC 2024

   Modified Files:
   	pkgsrc/audio/forked-daapd: Makefile
   	pkgsrc/audio/mixxx: Makefile
   	pkgsrc/audio/strawberry: Makefile
   	pkgsrc/audio/termusic: Makefile
   	pkgsrc/biology/plinkseq: Makefile
   	pkgsrc/chat/ekg: Makefile
   	pkgsrc/chat/libgadu: Makefile buildlink3.mk
   	pkgsrc/chat/mumble: Makefile
   	pkgsrc/databases/mysql80-server: Makefile
   	pkgsrc/databases/postgresql-postgis2: Makefile
   	pkgsrc/devel/compizconfig-backend-gconf: Makefile buildlink3.mk
   	pkgsrc/devel/libcompizconfig: Makefile buildlink3.mk
   	pkgsrc/devel/protobuf: buildlink3.mk
   	pkgsrc/devel/protobuf-c: Makefile buildlink3.mk
   	pkgsrc/devel/py-compizconfig: Makefile buildlink3.mk
   	pkgsrc/finance/bitcoin: Makefile
   	pkgsrc/geography/qgis: Makefile
   	pkgsrc/graphics/digikam: Makefile
   	pkgsrc/graphics/opencv: Makefile buildlink3.mk
   	pkgsrc/graphics/opencv-contrib-face: Makefile buildlink3.mk
   	pkgsrc/graphics/py-Willow: Makefile
   	pkgsrc/misc/marble: Makefile
   	pkgsrc/multimedia/vlc: Makefile
   	pkgsrc/net/bind916: Makefile
   	pkgsrc/net/bind918: Makefile
   	pkgsrc/net/frr: Makefile
   	pkgsrc/net/grpc: Makefile buildlink3.mk
   	pkgsrc/net/kopete: Makefile
   	pkgsrc/net/mosh: Makefile
   	pkgsrc/net/py-grpcio: Makefile
   	pkgsrc/net/py-grpcio-tools: Makefile
   	pkgsrc/net/qt6-qtgrpc: Makefile buildlink3.mk
   	pkgsrc/net/ratman: Makefile
   	pkgsrc/net/unbound: Makefile
   	pkgsrc/sysutils/collectd-grpc: Makefile
   	pkgsrc/sysutils/collectd-pinba: Makefile
   	pkgsrc/sysutils/collectd-riemann: Makefile
   	pkgsrc/sysutils/collectd-write_prometheus: Makefile
   	pkgsrc/sysutils/riemann-client: Makefile
   	pkgsrc/wm/ccsm: Makefile

   Log Message:
   *: recursive bump for protobuf 26.1

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Thu Apr 18 13:37:53 UTC 2024

   Modified Files:
   	pkgsrc/net/bind918: Makefile distinfo

   Log Message:
   net/bind918: update to 9.18.62

   9.18.26 (2024-04-17)

   6364.	[protocol]	Add RESOLVER.ARPA to the built in empty zones.
   			[GL #4580]

   6363.	[bug]		dig/mdig +ednsflags=<non-zero-value> did not re-enable
   			EDNS if it had been disabled. [GL #4641]

   6361.	[bug]		Some invalid ISO 8601 durations were accepted
   			erroneously. [GL #4624]

   6360.	[bug]		Don't return static-stub synthesised NS RRset.
   			[GL #4608]

   6359.	[bug]		Fix bug in Depends (keymgr_dep) function. [GL #4552]

   6351.	[protocol]	Support for the RESINFO record type has been added.
   			[GL #4413]

   6346.	[bug]		Cleaned up several minor bugs in the RBTDB dbiterator
   			implementation. [GL !8741]

   6345.	[bug]		Added missing dns_rdataset_disassociate calls in
   			validator.c:findnsec3proofs. [GL #4571]

   6340.	[test]		Fix incorrectly reported errors when running tests
   			with `make test` on platforms with older pytest.
   			[GL #4560]

   6338.	[func]		Optimize slabheader placement, so the infrastructure
   			records are put in the beginning of the slabheader
   			linked list. [GL !8675]

   6334.	[doc]		Improve ARM parental-agents definition. [GL #4531]

   6333.	[bug]		Fix the DNS_GETDB_STALEFIRST flag, which was defined
   			incorrectly in lib/ns/query.c. [GL !8683]

   6330.	[doc]		Update ZSK minimum lifetime documentation in ARM, also
   			depends on signing delay. [GL #4510]

   6328.	[func]		Add workaround to enforce dynamic linker to pull
   			jemalloc earlier than libc to ensure all memory
   			allocations are done via jemalloc. [GL #4404]

   6326.	[bug]		Changes to "listen-on" statements were ignored on
   			reconfiguration unless the port or interface address was
   			changed, making it impossible to change a related
   			listener transport type. Thanks to Thomas Amgarten.
   			[GL #4518] [GL #4528]

   6325.	[func]		Expose the TCP client count in statistics channel.
   			[GL #4425]

   6324.	[bug]		Fix a possible crash in 'dig +nssearch +nofail' and
   			'host -C' commands when one of the name servers returns
   			SERVFAIL. [GL #4508]

   6313.	[bug]		When dnssec-policy is in effect the DNSKEY's TTLs in
   			the zone where not being updated to match the policy.
   			This lead to failures when DNSKEYs where updated as the
   			TTLs mismatched. [GL #4466]

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Sat Apr 20 14:02:40 UTC 2024

   Modified Files:
   	pkgsrc/net/bind918: Makefile distinfo
   	pkgsrc/net/bind918/patches: patch-lib_ns_query.c

   Log Message:
   net/bind918: fix blocklist handling

   Apply change of revision 1.21 in NetBSD base which fixed PR bin/58170.

   Bump PKGREVISION.
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.28 2024/03/20 14:59:15 taca Exp $
a4 1
PKGREVISION=	1
d18 1
a18 1
BIND_VERSION=	9.18.26
@


1.27
log
@net/bind918: update to 9.18.24

9.18.24 (2024-02-13)

	--- 9.18.24 released ---

6343.	[bug]		Fix case insensitive setting for isc_ht hashtable.
			[GL #4568]

	--- 9.18.23 released ---

6322.	[security]	Specific DNS answers could cause a denial-of-service
			condition due to DNS validation taking a long time.
			(CVE-2023-50387) [GL #4424]

6321.	[security]	Change 6315 inadvertently introduced regressions that
			could cause named to crash. [GL #4234]

6320.	[bug]		Under some circumstances, the DoT code in client
			mode could process more than one message at a time when
			that was not expected. That has been fixed. [GL #4487]

	--- 9.18.22 released ---

6319.	[func]		Limit isc_task_send() overhead for RBTDB tree pruning.
			[GL #4383]

6317.	[security]	Restore DNS64 state when handling a serve-stale timeout.
			(CVE-2023-5679) [GL #4334]

6316.	[security]	Specific queries could trigger an assertion check with
			nxdomain-redirect enabled. (CVE-2023-5517) [GL #4281]

6315.	[security]	Speed up parsing of DNS messages with many different
			names. (CVE-2023-4408) [GL #4234]

6314.	[bug]		Address race conditions in dns_tsigkey_find().
			[GL #4182]

6312.	[bug]		Conversion from NSEC3 signed to NSEC signed could
			temporarily put the zone into a state where it was
			treated as unsigned until the NSEC chain was built.
			Additionally conversion from one set of NSEC3 parameters
			to another could also temporarily put the zone into a
			state where it was treated as unsigned until the new
			NSEC3 chain was built. [GL #1794] [GL #4495]

6310.	[bug]		Memory leak in zone.c:sign_zone. When named signed a
			zone it could leak dst_keys due to a misplaced
			'continue'. [GL #4488]

6306.	[func]		Log more details about the cause of "not exact" errors.
			[GL #4500]

6304.	[bug]		The wrong time was being used to determine what RRSIGs
			where to be generated when dnssec-policy was in use.
			[GL #4494]

6302.	[func]		The "trust-anchor-telemetry" statement is no longer
			marked as experimental. This silences a relevant log
			message that was emitted even when the feature was
			explicitly disabled. [GL #4497]

6300.	[bug]		Fix statistics export to use full 64 bit signed numbers
			instead of truncating values to unsigned 32 bits.
			[GL #4467]

6299.	[port]		NetBSD has added 'hmac' to libc which collides with our
			use of 'hmac'. [GL #4478]
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.26 2024/01/30 18:29:19 adam Exp $
d18 1
a18 1
BIND_VERSION=	9.18.24
@


1.26
log
@revbump for devel/abseil
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.25 2024/01/05 01:52:20 taca Exp $
a4 1
PKGREVISION=	1
d18 1
a18 1
BIND_VERSION=	9.18.21
@


1.25
log
@net/bind918: update to 9.18.21

9.18.21 (2023-12-20)

6297.	[bug]		Improve LRU cleaning behaviour. [GL #4448]

6296.	[func]		The "resolver-nonbackoff-tries" and
			"resolver-retry-interval" options are deprecated;
			a warning will be logged if they are used. [GL #4405]

6294.	[bug]		BIND might sometimes crash after startup or
			re-configuration when one 'tls' entry is used multiple
			times to connect to remote servers due to initialisation
			attempts from contexts of multiple threads. That has
			been fixed. [GL #4464]

6290.	[bug]		Dig +yaml will now report "no servers could be reached"
			also for UDP setup failure when no other servers or
			tries are left. [GL #1229]

6287.	[bug]		Recognize escapes when reading the public key from file.
			[GL !8502]

6286.	[bug]		Dig +yaml will now report "no servers could be reached"
			on TCP connection failure as well as for UDP timeouts.
			[GL #4396]

6282.	[func]		Deprecate AES-based DNS cookies. [GL #4421]
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.24 2023/11/18 04:07:28 taca Exp $
d5 1
@


1.24
log
@net/bind918: updte to 9.18.20

Note: B.ROOT-SERVERS.NET's addresses will be changed November 27, 2023.

9.18.20 (2023-11-15)

6280.	[bug]		Fix missing newlines in the output of "rndc nta -dump".
			[GL !8454]

6277.	[bug]		Take into account local authoritative zones when
			falling back to serve-stale. [GL #4355]

6275.	[bug]		Fix assertion failure when using lock-file configuration
			option together -X argument to named. [GL #4386]

6274.	[bug]		The 'lock-file' file was being removed when it
			shouldn't have been making it ineffective if named was
			started 3 or more times. [GL #4387]

6271.	[bug]		Fix a shutdown race in dns__catz_update_cb(). [GL #4381]

6269.	[maint]		B.ROOT-SERVERS.NET addresses are now 170.247.170.2 and
			2801:1b8:10::b. [GL #4101]

6267.	[func]		The timeouts for resending zone refresh queries over UDP
			were lowered to enable named to more quickly determine
			that a primary is down. [GL #4260]

6265.	[bug]		Don't schedule resign operations on the raw version
			of an inline-signing zone. [GL #4350]

6261.	[bug]		Fix a possible assertion failure on an error path in
			resolver.c:fctx_query(), when using an uninitialized
			link. [GL #4331]

6254.	[cleanup]	Add semantic patch to do an explicit cast from char
			to unsigned char in ctype.h class of functions.
			[GL #4327]

6252.	[test]		Python system tests have to be executed by invoking
			pytest directly. Executing them with the legacy test
			runner is no longer supported. [GL #4250]

6250.	[bug]		The wrong covered value was being set by
			dns_ncache_current for RRSIG records in the returned
			rdataset structure. This resulted in TYPE0 being
			reported as the covered value of the RRSIG when dumping
			the cache contents. [GL #4314]
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.23 2023/11/15 18:14:44 wiz Exp $
d18 1
a18 1
BIND_VERSION=	9.18.20
@


1.24.2.1
log
@Pullup ticket #6835 - requested by taca
net/bind918: security fix

Revisions pulled up:
- net/bind918/Makefile                                          1.25-1.27
- net/bind918/buildlink3.mk                                     1.2
- net/bind918/distinfo                                          1.14-1.15
- net/bind918/patches/patch-lib_dns_rbtdb.c                     1.2
- net/bind918/patches/patch-lib_isc_netmgr_netmgr.c             1.2

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Fri Jan  5 01:52:20 UTC 2024

   Modified Files:
   	pkgsrc/net/bind918: Makefile distinfo

   Log Message:
   net/bind918: update to 9.18.21

   9.18.21 (2023-12-20)

   6297.	[bug]		Improve LRU cleaning behaviour. [GL #4448]

   6296.	[func]		The "resolver-nonbackoff-tries" and
   			"resolver-retry-interval" options are deprecated;
   			a warning will be logged if they are used. [GL #4405]

   6294.	[bug]		BIND might sometimes crash after startup or
   			re-configuration when one 'tls' entry is used multiple
   			times to connect to remote servers due to initialisation
   			attempts from contexts of multiple threads. That has
   			been fixed. [GL #4464]

   6290.	[bug]		Dig +yaml will now report "no servers could be reached"
   			also for UDP setup failure when no other servers or
   			tries are left. [GL #1229]

   6287.	[bug]		Recognize escapes when reading the public key from file.
   			[GL !8502]

   6286.	[bug]		Dig +yaml will now report "no servers could be reached"
   			on TCP connection failure as well as for UDP timeouts.
   			[GL #4396]

   6282.	[func]		Deprecate AES-based DNS cookies. [GL #4421]

---
   Module Name:	pkgsrc
   Committed By:	adam
   Date:		Tue Jan 30 18:29:21 UTC 2024

   Modified Files:
   	pkgsrc/audio/libilbc: Makefile
   	pkgsrc/audio/termusic: Makefile
   	pkgsrc/biology/plinkseq: Makefile
   	pkgsrc/chat/ekg: Makefile
   	pkgsrc/chat/libgadu: Makefile buildlink3.mk
   	pkgsrc/databases/postgresql-postgis2: Makefile
   	pkgsrc/devel/abseil: buildlink3.mk
   	pkgsrc/devel/compizconfig-backend-gconf: Makefile buildlink3.mk
   	pkgsrc/devel/cre2: Makefile
   	pkgsrc/devel/libcompizconfig: Makefile buildlink3.mk
   	pkgsrc/devel/protobuf: Makefile buildlink3.mk
   	pkgsrc/devel/protobuf-c: Makefile buildlink3.mk
   	pkgsrc/devel/py-compizconfig: Makefile buildlink3.mk
   	pkgsrc/devel/re2: Makefile buildlink3.mk
   	pkgsrc/graphics/opencv: Makefile buildlink3.mk
   	pkgsrc/graphics/opencv-contrib-face: Makefile buildlink3.mk
   	pkgsrc/graphics/py-Willow: Makefile
   	pkgsrc/inputmethod/fcitx5-mozc: Makefile
   	pkgsrc/misc/libreoffice: Makefile
   	pkgsrc/net/bind916: Makefile
   	pkgsrc/net/bind918: Makefile
   	pkgsrc/net/dnsdist: Makefile
   	pkgsrc/net/frr: Makefile
   	pkgsrc/net/grpc: Makefile buildlink3.mk
   	pkgsrc/net/mosh: Makefile
   	pkgsrc/net/py-grpcio: Makefile
   	pkgsrc/net/py-grpcio-tools: Makefile
   	pkgsrc/net/qt6-qtgrpc: Makefile buildlink3.mk
   	pkgsrc/net/ratman: Makefile
   	pkgsrc/net/unbound: Makefile
   	pkgsrc/sysutils/collectd-grpc: Makefile
   	pkgsrc/sysutils/collectd-pinba: Makefile
   	pkgsrc/sysutils/collectd-riemann: Makefile
   	pkgsrc/sysutils/collectd-write_prometheus: Makefile
   	pkgsrc/sysutils/riemann-client: Makefile
   	pkgsrc/wm/ccsm: Makefile

   Log Message:
   revbump for devel/abseil

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Fri Jan  5 01:53:35 UTC 2024

   Modified Files:
   	pkgsrc/net/bind918: buildlink3.mk

   Log Message:
   net/bind918: fix BUILDLINK_ABI_DEPENDS

   We have 9.8.21 but not yet 9.18.30nb1.

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Tue Feb 13 13:50:39 UTC 2024

   Modified Files:
   	pkgsrc/net/bind918: Makefile distinfo
   	pkgsrc/net/bind918/patches: patch-lib_dns_rbtdb.c
   	    patch-lib_isc_netmgr_netmgr.c

   Log Message:
   net/bind918: update to 9.18.24

   9.18.24 (2024-02-13)

   	--- 9.18.24 released ---

   6343.	[bug]		Fix case insensitive setting for isc_ht hashtable.
   			[GL #4568]

   	--- 9.18.23 released ---

   6322.	[security]	Specific DNS answers could cause a denial-of-service
   			condition due to DNS validation taking a long time.
   			(CVE-2023-50387) [GL #4424]

   6321.	[security]	Change 6315 inadvertently introduced regressions that
   			could cause named to crash. [GL #4234]

   6320.	[bug]		Under some circumstances, the DoT code in client
   			mode could process more than one message at a time when
   			that was not expected. That has been fixed. [GL #4487]

   	--- 9.18.22 released ---

   6319.	[func]		Limit isc_task_send() overhead for RBTDB tree pruning.
   			[GL #4383]

   6317.	[security]	Restore DNS64 state when handling a serve-stale timeout.
   			(CVE-2023-5679) [GL #4334]

   6316.	[security]	Specific queries could trigger an assertion check with
   			nxdomain-redirect enabled. (CVE-2023-5517) [GL #4281]

   6315.	[security]	Speed up parsing of DNS messages with many different
   			names. (CVE-2023-4408) [GL #4234]

   6314.	[bug]		Address race conditions in dns_tsigkey_find().
   			[GL #4182]

   6312.	[bug]		Conversion from NSEC3 signed to NSEC signed could
   			temporarily put the zone into a state where it was
   			treated as unsigned until the NSEC chain was built.
   			Additionally conversion from one set of NSEC3 parameters
   			to another could also temporarily put the zone into a
   			state where it was treated as unsigned until the new
   			NSEC3 chain was built. [GL #1794] [GL #4495]

   6310.	[bug]		Memory leak in zone.c:sign_zone. When named signed a
   			zone it could leak dst_keys due to a misplaced
   			'continue'. [GL #4488]

   6306.	[func]		Log more details about the cause of "not exact" errors.
   			[GL #4500]

   6304.	[bug]		The wrong time was being used to determine what RRSIGs
   			where to be generated when dnssec-policy was in use.
   			[GL #4494]

   6302.	[func]		The "trust-anchor-telemetry" statement is no longer
   			marked as experimental. This silences a relevant log
   			message that was emitted even when the feature was
   			explicitly disabled. [GL #4497]

   6300.	[bug]		Fix statistics export to use full 64 bit signed numbers
   			instead of truncating values to unsigned 32 bits.
   			[GL #4467]

   6299.	[port]		NetBSD has added 'hmac' to libc which collides with our
   			use of 'hmac'. [GL #4478]
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.24 2023/11/18 04:07:28 taca Exp $
d18 1
a18 1
BIND_VERSION=	9.18.24
@


1.23
log
@*: bump for protobuf 25
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.22 2023/11/08 13:20:21 wiz Exp $
a4 1
PKGREVISION=	4
d18 1
a18 1
BIND_VERSION=	9.18.19
@


1.22
log
@*: recursive bump for icu 74.1
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.21 2023/11/02 12:20:05 wiz Exp $
d5 1
a5 1
PKGREVISION=	3
@


1.21
log
@*: recursive bump for protobuf
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.20 2023/10/24 22:10:12 wiz Exp $
d5 1
a5 1
PKGREVISION=	2
@


1.20
log
@*: bump for openssl 3
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.19 2023/09/20 13:37:16 taca Exp $
d5 1
a5 1
PKGREVISION=	1
@


1.19
log
@net/bind918: update to 9.18.19

9.18.19 (2023-09-20)

6246.	[security]	Fix use-after-free error in TLS DNS code when sending
			data. (CVE-2023-4236) [GL #4242]

6245.	[security]	Limit the amount of recursion that can be performed
			by isccc_cc_fromwire. (CVE-2023-3341) [GL #4152]

6244.	[bug]		Adjust log levels on malformed messages to NOTICE when
			transferring in a zone. [GL #4290]

6241.	[bug]		Take into account the possibility of partial TLS writes
			in TLS DNS code. That helps to prevent DNS messages
			corruption on long DNS over TLS streams. [GL #4255]

6240.	[bug]		Use dedicated per-worker thread jemalloc memory
			arenas for send buffers allocation to reduce memory
			consumption and avoid lock contention. [GL #4038]

6239.	[func]		Deprecate the 'dnssec-must-be-secure' option.
			[GL #3700]

6237.	[bug]		Address memory leaks due to not clearing OpenSSL error
			stack. [GL #4159]

6235.	[doc]		Clarify BIND 9 time formats. [GL #4266]

6234.	[bug]		Restore stale-refresh-time value after flushing the
			cache. [GL #4278]

6232.	[bug]		Following the introduction of krb5-subdomain-self-rhs
			and ms-subdomain-self-rhs update rules, removal of
			nonexistent PTR and SRV records via UPDATE could fail.
			[GL #4280]

6231.	[func]		Make nsupdate honor -v for SOA requests if the server
			is specified. [GL #1181]

6230.	[bug]		Prevent an unnecessary query restart if a synthesized
			CNAME target points to the CNAME owner. [GL #3835]

6227.	[bug]		Check the statistics-channel HTTP Content-length
			to prevent negative or overflowing values from
			causing a crash. [GL #4125]

6224.	[bug]		Check the If-Modified-Since value length to prevent
			out-of-bounds write. [GL #4124]
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.18 2023/09/19 16:19:27 he Exp $
d5 1
@


1.18
log
@net/bind918: update HOMEPAGE to the place the previous version redirects to.
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.17 2023/08/29 14:47:21 taca Exp $
d18 1
a18 1
BIND_VERSION=	9.18.18
@


1.17
log
@net/bind918: update to 9.18.18

--- 9.18.18 released ---

6220.	[func]		Deprecate the 'dialup' and 'heartbeat-interval'
			options. [GL #3700]

6219.	[bug]		Ignore 'max-zone-ttl' on 'dnssec-policy insecure'.
			[GL #4032]

6215.	[protocol]	Return REFUSED to GSS-API TKEY requests if GSS-API
			support is not configured. [GL #4225]

6213.	[bug]		Mark a primary server as temporarily unreachable if the
			TCP connection attempt times out. [GL #4215]

6212.	[bug]		Don't process detach and close netmgr events when
			the netmgr has been paused. [GL #4200]
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.16 2023/07/19 15:20:21 taca Exp $
d10 1
a10 1
HOMEPAGE=	https://www.isc.org/software/bind/
@


1.16
log
@net/bind918: update to 9.18.17

9.18.17 released

6206.	[bug]		Add shutdown checks in dns_catz_dbupdate_callback() to
			avoid a race with dns_catz_shutdown_catzs(). [GL #4171]

6205.	[bug]		Restore support to read legacy HMAC-MD5 K file pairs.
			[GL #4154]

6204.	[bug]		Use NS records for relaxed QNAME-minimization mode.
			This reduces the number of queries named makes when
			resolving, as it allows the non-existence of NS RRsets
			at non-referral nodes to be cached in addition to the
			referrals that are normally cached. [GL #3325]

6200.	[bug]		Fix nslookup erroneously reporting a timeout when the
			input is delayed. [GL #4044]

6199.	[bug]		Improve HTTP Connection: header protocol conformance
			in the statistics channel. [GL #4126]

6198.	[func]		Remove the holes in the isc_result_t enum to compact
			the isc_result tables. [GL #4149]

6197.	[bug]		Fix a data race between the dns_zone and dns_catz
			modules when registering/unregistering a database
			update notification callback for a catalog zone.
			[GL #4132]

6196.	[cleanup]	Report "permission denied" instead of "unexpected error"
			when trying to update a zone file on a read-only file
			system. Thanks to Midnight Veil. [GL #4134]

6193.	[bug]		Fix a catz db update notification callback registration
			logic error, which could crash named when receiving an
			AXFR update for a catalog zone while the previous update
			process of the catalog zone was already running.
			[GL #4136]

6166.	[func]		Retry without DNS COOKIE on FORMERR if it appears that
			the FORMERR was due to the presence of a DNS COOKIE
			option. [GL #4049]
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.15 2023/07/18 18:36:29 nia Exp $
d18 1
a18 1
BIND_VERSION=	9.18.17
@


1.15
log
@net: Adapt packages to USE_(CC|CXX)_FEATURES where possible
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.14 2023/07/13 13:45:43 nia Exp $
d18 1
a18 1
BIND_VERSION=	9.18.16
@


1.14
log
@*: remove all instances of GCC_REQD where my name is the most recent in
"cvs annotate" (part 1)

Hopefully this commit can be reviewed later if a better replacement
for GCC_REQD is committed.
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.13 2023/07/12 19:58:50 nia Exp $
d26 2
@


1.13
log
@bind918: Require at least GCC 4.9 for stdatomic.h.
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.12 2023/06/21 14:42:23 taca Exp $
a15 3
# GCC 4.9 added support for C11 atomics.
GCC_REQD+=	4.9

@


1.12
log
@net/bind918: update to 9.18.16

9.18.16 (2023-06-21)

Security release:

- CVE-2023-2828
- CVE-2023-2911

6192.	[security]	A query that prioritizes stale data over lookup
			triggers a fetch to refresh the stale data in cache.
			If the fetch is aborted for exceeding the recursion
			quota, it was possible for 'named' to enter an infinite
			callback loop and crash due to stack overflow. This has
			been fixed. (CVE-2023-2911) [GL #4089]

6190.	[security]	Improve the overmem cleaning process to prevent the
			cache going over the configured limit. (CVE-2023-2828)
			[GL #4055]

6188.	[performance]	Reduce memory consumption by allocating properly
			sized send buffers for stream-based transports.
			[GL #4038]

6186.	[bug]		Fix a 'clients-per-query' miscalculation bug. When the
			'stale-answer-enable' options was enabled and the
			'stale-answer-client-timeout' option was enabled and
			larger than 0, named was taking two places from the
			'clients-per-query' limit for each client and was
			failing to gradually auto-tune its value, as configured.
			[GL #4074]

6185.	[func]		Add "ClientQuota" statistics channel counter, which
			indicates the number of the resolver's spilled queries
			due to reaching the clients per query quota. [GL !7978]

6183.	[bug]		Fix a serve-stale bug where a delegation from cache
			could be returned to the client. [GL #3950]

6182.	[cleanup]	Remove configure checks for epoll, kqueue and
			/dev/poll. [GL #4098]

6181.	[func]		The "tkey-dhkey" option has been deprecated; a
			warning will be logged when it is used. In a future
			release, Diffie-Hellman TKEY mode will be removed.
			[GL #3905]

6180.	[bug]		The session key object could be incorrectly added
			to multiple different views' keyrings. [GL #4079]

6179.	[bug]		Fix an interfacemgr use-after-free error in
			zoneconf.c:isself(). [GL #3765]

6176.	[test]		Add support for using pytest & pytest-xdist to
			execute the system test suite. [GL #3978]

6174.	[bug]		BIND could get stuck on reconfiguration when a
			'listen' statement for HTTP is removed from the
			configuration. That has been fixed. [GL #4071]

6173.	[bug]		Properly process extra "nameserver" lines in
			resolv.conf otherwise the next line is not properly
			processed. [GL #4066]

6169.	[bug]		named could crash when deleting inline-signing zones
			with "rndc delzone". [GL #4054]

6165.	[bug]		Fix a logic error in dighost.c which could call the
			dighost_shutdown() callback twice and cause problems
			if the callback function was not idempotent. [GL #4039]
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.11 2023/05/17 13:43:52 taca Exp $
d16 3
@


1.11
log
@net/bind918: update to 9.18.15

	--- 9.18.15 released ---

6164.	[bug]		Set the rndc idle read timeout back to 60 seconds,
			from the netmgr default of 30 seconds, in order to
			match the behavior of 9.16 and earlier. [GL #4046]

6161.	[bug]		Fix log file rotation when using absolute path as
			file. [GL #3991]

6157.	[bug]		When removing delegations in an OPTOUT range
			empty-non-terminal NSEC3 records generated by
			those delegations were not removed. [GL #4027]

6156.	[bug]		Reimplement the maximum and idle timeouts for incoming
			zone tranfers. [GL #4004]

6155.	[bug]		Treat ISC_R_INVALIDPROTO as a networking error
			in the dispatch code to avoid retrying with the
			same server. [GL #4005]

6152.	[bug]		In dispatch, honour the configured source-port
			selection when UDP connection fails with address
			in use error.

			Also treat ISC_R_NOPERM same as ISC_R_ADDRINUSE.
			[GL #3986]

6149.	[test]		As a workaround, include an OpenSSL header file before
			including cmocka.h in the unit tests, because OpenSSL
			3.1.0 uses __attribute__(malloc), conflicting with a
			redefined malloc in cmocka.h. [GL #4000]
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.10 2023/04/24 13:48:06 taca Exp $
d18 1
a18 1
BIND_VERSION=	9.18.15
@


1.10
log
@net/bind918: update to 9.18.14

pkgsrc change: reduce some pkglint warnings.


--- 9.18.14 released ---

6145.	[bug]		Fix a possible use-after-free bug in the
			dns__catz_done_cb() function. [GL #3997]

6143.	[bug]		A reference counting problem on the error path in
			the xfrin_connect_done() might cause an assertion
			failure on shutdown.  [GL #3989]

6142.	[bug]		Reduce the number of dns_dnssec_verify calls made
			determining if revoked keys needs to be removed from
			the trust anchors. [GL #3981]

6141.	[bug]		Fix several issues in nsupdate timeout handling and
			update the -t option's documentation. [GL #3674]

6138.	[doc]		Fix the DF-flag documentation on the outgoing
			UDP packets. [GL #3710]

6136.	[cleanup]	Remove the isc_fsaccess API in favor of creating
			temporary file first and atomically replace the key
			with non-truncated content. [GL #3982]

6132.	[doc]		Remove a dead link in the DNSSEC guide. [GL #3967]

6129.	[cleanup]	Value stored to 'source' during its initialization is
			never read. [GL #3965]

6128.	[bug]		Fix an omission in an earlier commit to avoid a race
			between the 'dns__catz_update_cb()' and
			'dns_catz_dbupdate_callback()' functions. [GL #3968]

6126.	[cleanup]	Deprecate zone type "delegation-only" and the
			"delegation-only" and "root-delegation-only"
			options. [GL #3953]

6125.	[bug]		Hold a catz reference while the update process is
			running, so that the catalog zone is not destroyed
			during shutdown until the update process is finished or
			properly canceled by the activated 'shuttingdown' flag.
			[GL #3955]

6124.	[bug]		When changing from a NSEC3 capable DNSSEC algorithm to
			an NSEC3 incapable DNSSEC algorithm using KASP the zone
			could sometimes be incompletely signed. [GL #3937]

6121.	[bug]		Fix BIND and dig zone transfer hanging when
			downloading large zones over TLS from a primary server,
			especially over unstable connections. [GL #3867]
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.9 2023/04/19 08:11:01 adam Exp $
d18 1
a18 1
BIND_VERSION=	9.18.14
@


1.9
log
@revbump after textproc/icu update
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.8 2023/03/17 13:58:59 taca Exp $
a4 1
PKGREVISION=	1
d18 1
a18 1
BIND_VERSION=	9.18.13
@


1.8
log
@net/bind918: update to 9.18.13

--- 9.18.13 released ---

6120.	[bug]		Use two pairs of dns_db_t and dns_dbversion_t in a
			catalog zone structure to avoid a race between the
			dns__catz_update_cb() and dns_catz_dbupdate_callback()
			functions. [GL #3907]

6119.	[bug]		Make sure to revert the reconfigured zones to the
			previous version of the view, when the new view
			reconfiguration fails during the configuration of
			one of the configured zones. [GL #3911]

6116.	[bug]		Fix error path cleanup issues in dns_catz_new_zones()
			and dns_catz_new_zone() functions. [GL #3900]

6115.	[bug]		Unregister db update notify callback before detaching
			from the previous db inside the catz update notify
			callback. [GL #3777]

6114.	[func]		Run the catalog zone update process on the offload
			threads. [GL #3881]

6113.	[func]		Add shutdown signaling for catalog zones. [GL !7571]

6112.	[func]		Add reference count tracing for dns_catz_zone_t and
			dns_catz_zones_t. [GL !7570]

6105.	[bug]		Detach 'rpzs' and 'catzs' from the previous view in
			configure_rpz() and configure_catz(), respectively,
			just after attaching it to the new view. [GL #3880]

6098.	[test]		Don't test HMAC-MD5 when not supported by libcrypto.
			[GL #3871]

6096.	[bug]		Fix RPZ reference counting error on shutdown in
			dns__rpz_timer_cb(). [GL #3866]

6095.	[test]		Test various 'islands of trust' configurations when
			using managed keys. [GL #3662]

6094.	[bug]		Building against (or running with) libuv versions
			1.35.0 and 1.36.0 is now a fatal error.  The rules for
			mixing and matching compile-time and run-time libuv
			versions have been tightened for libuv versions between
			1.35.0 and 1.40.0. [GL #3840]

6092.	[bug]		dnssec-cds failed to cleanup properly. [GL #3831]

6089.	[bug]		Source ports configured for query-source,
			transfer-source, etc, were being ignored. (This
			feature is deprecated, but it is not yet removed,
			so the bug still needed fixing.) [GL #3790]
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.7 2023/02/16 13:37:16 taca Exp $
d5 1
@


1.8.2.1
log
@Pullup ticket #6764 - requested by taca
net/bind918: security fix

Revisions pulled up:
- net/bind918/Makefile                                          1.10-1.12
- net/bind918/PLIST                                             1.4
- net/bind918/distinfo                                          1.7-1.9
- net/bind918/options.mk                                        1.2

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Mon Apr 24 13:48:06 UTC 2023

   Modified Files:
   	pkgsrc/net/bind918: Makefile PLIST distinfo options.mk

   Log Message:
   net/bind918: update to 9.18.14

   pkgsrc change: reduce some pkglint warnings.

   --- 9.18.14 released ---

   6145.	[bug]		Fix a possible use-after-free bug in the
   			dns__catz_done_cb() function. [GL #3997]

   6143.	[bug]		A reference counting problem on the error path in
   			the xfrin_connect_done() might cause an assertion
   			failure on shutdown.  [GL #3989]

   6142.	[bug]		Reduce the number of dns_dnssec_verify calls made
   			determining if revoked keys needs to be removed from
   			the trust anchors. [GL #3981]

   6141.	[bug]		Fix several issues in nsupdate timeout handling and
   			update the -t option's documentation. [GL #3674]

   6138.	[doc]		Fix the DF-flag documentation on the outgoing
   			UDP packets. [GL #3710]

   6136.	[cleanup]	Remove the isc_fsaccess API in favor of creating
   			temporary file first and atomically replace the key
   			with non-truncated content. [GL #3982]

   6132.	[doc]		Remove a dead link in the DNSSEC guide. [GL #3967]

   6129.	[cleanup]	Value stored to 'source' during its initialization is
   			never read. [GL #3965]

   6128.	[bug]		Fix an omission in an earlier commit to avoid a race
   			between the 'dns__catz_update_cb()' and
   			'dns_catz_dbupdate_callback()' functions. [GL #3968]

   6126.	[cleanup]	Deprecate zone type "delegation-only" and the
   			"delegation-only" and "root-delegation-only"
   			options. [GL #3953]

   6125.	[bug]		Hold a catz reference while the update process is
   			running, so that the catalog zone is not destroyed
   			during shutdown until the update process is finished or
   			properly canceled by the activated 'shuttingdown' flag.
   			[GL #3955]

   6124.	[bug]		When changing from a NSEC3 capable DNSSEC algorithm to
   			an NSEC3 incapable DNSSEC algorithm using KASP the zone
   			could sometimes be incompletely signed. [GL #3937]

   6121.	[bug]		Fix BIND and dig zone transfer hanging when
   			downloading large zones over TLS from a primary server,
   			especially over unstable connections. [GL #3867]

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Wed May 17 13:43:52 UTC 2023

   Modified Files:
   	pkgsrc/net/bind918: Makefile distinfo

   Log Message:
   net/bind918: update to 9.18.15

   	--- 9.18.15 released ---

   6164.	[bug]		Set the rndc idle read timeout back to 60 seconds,
   			from the netmgr default of 30 seconds, in order to
   			match the behavior of 9.16 and earlier. [GL #4046]

   6161.	[bug]		Fix log file rotation when using absolute path as
   			file. [GL #3991]

   6157.	[bug]		When removing delegations in an OPTOUT range
   			empty-non-terminal NSEC3 records generated by
   			those delegations were not removed. [GL #4027]

   6156.	[bug]		Reimplement the maximum and idle timeouts for incoming
   			zone tranfers. [GL #4004]

   6155.	[bug]		Treat ISC_R_INVALIDPROTO as a networking error
   			in the dispatch code to avoid retrying with the
   			same server. [GL #4005]

   6152.	[bug]		In dispatch, honour the configured source-port
   			selection when UDP connection fails with address
   			in use error.

   			Also treat ISC_R_NOPERM same as ISC_R_ADDRINUSE.
   			[GL #3986]

   6149.	[test]		As a workaround, include an OpenSSL header file before
   			including cmocka.h in the unit tests, because OpenSSL
   			3.1.0 uses __attribute__(malloc), conflicting with a
   			redefined malloc in cmocka.h. [GL #4000]

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Wed Jun 21 14:42:23 UTC 2023

   Modified Files:
   	pkgsrc/net/bind918: Makefile distinfo

   Log Message:
   net/bind918: update to 9.18.16

   9.18.16 (2023-06-21)

   Security release:

   - CVE-2023-2828
   - CVE-2023-2911

   6192.	[security]	A query that prioritizes stale data over lookup
   			triggers a fetch to refresh the stale data in cache.
   			If the fetch is aborted for exceeding the recursion
   			quota, it was possible for 'named' to enter an infinite
   			callback loop and crash due to stack overflow. This has
   			been fixed. (CVE-2023-2911) [GL #4089]

   6190.	[security]	Improve the overmem cleaning process to prevent the
   			cache going over the configured limit. (CVE-2023-2828)
   			[GL #4055]

   6188.	[performance]	Reduce memory consumption by allocating properly
   			sized send buffers for stream-based transports.
   			[GL #4038]

   6186.	[bug]		Fix a 'clients-per-query' miscalculation bug. When the
   			'stale-answer-enable' options was enabled and the
   			'stale-answer-client-timeout' option was enabled and
   			larger than 0, named was taking two places from the
   			'clients-per-query' limit for each client and was
   			failing to gradually auto-tune its value, as configured.
   			[GL #4074]

   6185.	[func]		Add "ClientQuota" statistics channel counter, which
   			indicates the number of the resolver's spilled queries
   			due to reaching the clients per query quota. [GL !7978]

   6183.	[bug]		Fix a serve-stale bug where a delegation from cache
   			could be returned to the client. [GL #3950]

   6182.	[cleanup]	Remove configure checks for epoll, kqueue and
   			/dev/poll. [GL #4098]

   6181.	[func]		The "tkey-dhkey" option has been deprecated; a
   			warning will be logged when it is used. In a future
   			release, Diffie-Hellman TKEY mode will be removed.
   			[GL #3905]

   6180.	[bug]		The session key object could be incorrectly added
   			to multiple different views' keyrings. [GL #4079]

   6179.	[bug]		Fix an interfacemgr use-after-free error in
   			zoneconf.c:isself(). [GL #3765]

   6176.	[test]		Add support for using pytest & pytest-xdist to
   			execute the system test suite. [GL #3978]

   6174.	[bug]		BIND could get stuck on reconfiguration when a
   			'listen' statement for HTTP is removed from the
   			configuration. That has been fixed. [GL #4071]

   6173.	[bug]		Properly process extra "nameserver" lines in
   			resolv.conf otherwise the next line is not properly
   			processed. [GL #4066]

   6169.	[bug]		named could crash when deleting inline-signing zones
   			with "rndc delzone". [GL #4054]

   6165.	[bug]		Fix a logic error in dighost.c which could call the
   			dighost_shutdown() callback twice and cause problems
   			if the callback function was not idempotent. [GL #4039]
@
text
@d1 1
a1 1
# $NetBSD$
d18 1
a18 1
BIND_VERSION=	9.18.16
@


1.7
log
@net/bind918: update to 9.18.12

	--- 9.18.12 released ---

6083.	[bug]		Fix DNSRPS-enabled builds as they were inadvertently
			broken by change 6042. [GL #3827]

6082.	[test]		fuzz/dns_message_checksig leaked memory when shutting
			down. [GL #3828]

6081.	[bug]		Handle primary server address lookup failures in
			nsupdate more gracefully. [GL #3830]

6080.	[bug]		'named -V' leaked memory. [GL #3829]

6079.	[bug]		Force set the DS state after a 'rdnc dnssec -checkds'
			command. [GL #3822]

6075.	[bug]		Add missing node lock when setting node->wild in
			add_wildcard_magic. [GL #3799]

6074.	[func]		Refactor the isc_nm_xfr_allowed() function to return
			isc_result_t instead of boolean. [GL #3808]

6073.	[bug]		Set RD=1 on DS requests to parental-agents. [GL #3783]

6072.	[bug]		Avoid the OpenSSL lock contention when initializing
			Message Digest Contexts by using explicit algorithm
			fetching, initializing static contexts for every
			supported algorithms, and initializing the new context
			by copying the static copy. [GL #3795]

6071.	[func]		The use of "port" when configuring query-source,
			transfer-source, notify-source and parental-source
			addresses has been deprecated, along with the
			use-v[46]-udp-ports and avoid-v[46]-udp-ports
			options. A warning will be logged when these
			options are used. In a future release, they
			will be removed. [GL #3781]


6069.	[bug]		Detach from the view in zone_shutdown() to
			release the memory held by the dead view
			early. [GL #3801]

6068.	[bug]		Downloading a zone via TLS from a server which does
			not negotiate "dot" ALPN token could crash BIND
			on shutdown. That has been fixed. [GL #3767]
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.6 2023/02/08 00:13:44 taca Exp $
d18 1
a18 1
BIND_VERSION=	9.18.12
@


1.6
log
@net/bind918: update to 9.18.11

Approved by MAINTAINER (sekiya@@).

	--- 9.18.11 released ---

6067.	[security]	Fix serve-stale crash when recursive clients soft quota
			is reached. (CVE-2022-3924) [GL #3619]

6066.	[security]	Handle RRSIG lookups when serve-stale is active.
			(CVE-2022-3736) [GL #3622]

6064.	[security]	An UPDATE message flood could cause named to exhaust all
			available memory. This flaw was addressed by adding a
			new "update-quota" statement that controls the number of
			simultaneous UPDATE messages that can be processed or
			forwarded. The default is 100. A stats counter has been
			added to record events when the update quota is
			exceeded, and the XML and JSON statistics version
			numbers have been updated. (CVE-2022-3094) [GL #3523]

6062.	[func]		The DSCP implementation, which has been
			nonfunctional for some time, is now marked as
			obsolete and the implementation has been removed.
			Configuring DSCP values in named.conf has no
			effect, and a warning will be logged that
			the feature should no longer be used. [GL #3773]

6061.	[bug]		Fix unexpected "Prohibited" extended DNS error
			on allow-recursion. [GL #3743]

6060.	[bug]		Fix a use-after-free bug in dns_zonemgr_releasezone()
			by detaching from the zone manager outside of the write
			lock. [GL #3768]

6059.	[bug]		In some serve stale scenarios, like when following an
			expired CNAME record, named could return SERVFAIL if the
			previous request wasn't successful. Consider non-stale
			data when in serve-stale mode. [GL #3678]

6058.	[bug]		Prevent named from crashing when "rndc delzone"
			attempts to delete a zone added by a catalog zone.
			[GL #3745]

6053.	[bug]		Fix an ADB quota management bug in resolver. [GL #3752]

6051.	[bug]		Improve thread safety in the dns_dispatch unit.
			[GL #3178] [GL #3636]

6050.	[bug]		Changes to the RPZ response-policy min-update-interval
			and add-soa options now take effect as expected when
			named is reconfigured. [GL #3740]

6049.	[bug]		Exclude ABD hashtables from the ADB memory
			overmem checks and don't clean ADB names
			and ADB entries used in the last 10 seconds
			(ADB_CACHE_MINIMUM). [GL #3739]

6048.	[bug]		Fix a log message error in dns_catz_update_from_db(),
			where serials with values of 2^31 or larger were logged
			incorrectly as negative numbers. [GL #3742]

6047.	[bug]		Try the next server instead of trying the same
			server again on an outgoing query timeout.
			[GL #3637]

6046.	[bug]		TLS session resumption might lead to handshake
			failures when client certificates are used for
			authentication (Mutual TLS).  This has been fixed.
			[GL #3725]

6045.	[cleanup]	The list of supported DNSSEC algorithms changed log
			level from "warning" to "notice" to match named's other
			startup messages. [GL !7217]

6044.	[bug]		There was an "RSASHA236" typo in a log message.
			[GL !7206]

5830.	[func]		Implement incremental resizing of isc_ht hash tables to
			perform the rehashing gradually. The catalog zone
			implementation has been optimized to work with hundreds
			of thousands of member zones. [GL #3212] [GL #3744]
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.5 2023/01/13 05:31:52 sekiya Exp $
d18 1
a18 1
BIND_VERSION=	9.18.11
@


1.5
log
@Python is only needed for tests, so remove the dependency.

Pointed out by tnn@@ and john@@

Bump package revision.
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.4 2023/01/12 19:01:46 jperkin Exp $
a4 1
PKGREVISION=	3
d18 1
a18 1
BIND_VERSION=	9.18.9
@


1.4
log
@bind918: Fix path to named-checkconf.

It moved since 9.16 from sbin to bin.  Bump PKGREVISION.
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.3 2022/12/14 21:44:03 sekiya Exp $
d5 1
a5 1
PKGREVISION=	2
a89 1
.include "../../lang/python310/buildlink3.mk"
@


1.3
log
@Fix MASTER_SITE, which was weirdly botched between test and commit.  No
functional code change.

Reported by jklos@@.
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.2 2022/12/12 22:07:04 sekiya Exp $
d5 1
a5 1
PKGREVISION=	1
@


1.3.2.1
log
@Pullup ticket #6736 - requested by taca
net/bind918: security update

Revisions pulled up:
- net/bind918/Makefile                                          1.6
- net/bind918/PLIST                                             1.2
- net/bind918/distinfo                                          1.4
- net/bind918/patches/patch-bin_tests_system_keyfromlabel_tests.sh deleted
- net/bind918/patches/patch-lib_isc_siphash.c                   1.2
- net/bind918/patches/patch-lib_isc_time.c                      1.2
- net/bind918/patches/patch-lib_ns_update.c                     1.2

-------------------------------------------------------------------
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Wed Feb  8 00:13:44 UTC 2023

   Modified Files:
   	pkgsrc/net/bind918: Makefile PLIST distinfo
   	pkgsrc/net/bind918/patches: patch-lib_isc_siphash.c
   	    patch-lib_isc_time.c patch-lib_ns_update.c
   Removed Files:
   	pkgsrc/net/bind918/patches:
   	    patch-bin_tests_system_keyfromlabel_tests.sh

   Log Message:
   net/bind918: update to 9.18.11

   Approved by MAINTAINER (sekiya@@).

   	--- 9.18.11 released ---

   6067.	[security]	Fix serve-stale crash when recursive clients soft quota
   			is reached. (CVE-2022-3924) [GL #3619]

   6066.	[security]	Handle RRSIG lookups when serve-stale is active.
   			(CVE-2022-3736) [GL #3622]

   6064.	[security]	An UPDATE message flood could cause named to exhaust all
   			available memory. This flaw was addressed by adding a
   			new "update-quota" statement that controls the number of
   			simultaneous UPDATE messages that can be processed or
   			forwarded. The default is 100. A stats counter has been
   			added to record events when the update quota is
   			exceeded, and the XML and JSON statistics version
   			numbers have been updated. (CVE-2022-3094) [GL #3523]

   6062.	[func]		The DSCP implementation, which has been
   			nonfunctional for some time, is now marked as
   			obsolete and the implementation has been removed.
   			Configuring DSCP values in named.conf has no
   			effect, and a warning will be logged that
   			the feature should no longer be used. [GL #3773]

   6061.	[bug]		Fix unexpected "Prohibited" extended DNS error
   			on allow-recursion. [GL #3743]

   6060.	[bug]		Fix a use-after-free bug in dns_zonemgr_releasezone()
   			by detaching from the zone manager outside of the write
   			lock. [GL #3768]

   6059.	[bug]		In some serve stale scenarios, like when following an
   			expired CNAME record, named could return SERVFAIL if the
   			previous request wasn't successful. Consider non-stale
   			data when in serve-stale mode. [GL #3678]

   6058.	[bug]		Prevent named from crashing when "rndc delzone"
   			attempts to delete a zone added by a catalog zone.
   			[GL #3745]

   6053.	[bug]		Fix an ADB quota management bug in resolver. [GL #3752]

   6051.	[bug]		Improve thread safety in the dns_dispatch unit.
   			[GL #3178] [GL #3636]

   6050.	[bug]		Changes to the RPZ response-policy min-update-interval
   			and add-soa options now take effect as expected when
   			named is reconfigured. [GL #3740]

   6049.	[bug]		Exclude ABD hashtables from the ADB memory
   			overmem checks and don't clean ADB names
   			and ADB entries used in the last 10 seconds
   			(ADB_CACHE_MINIMUM). [GL #3739]

   6048.	[bug]		Fix a log message error in dns_catz_update_from_db(),
   			where serials with values of 2^31 or larger were logged
   			incorrectly as negative numbers. [GL #3742]

   6047.	[bug]		Try the next server instead of trying the same
   			server again on an outgoing query timeout.
   			[GL #3637]

   6046.	[bug]		TLS session resumption might lead to handshake
   			failures when client certificates are used for
   			authentication (Mutual TLS).  This has been fixed.
   			[GL #3725]

   6045.	[cleanup]	The list of supported DNSSEC algorithms changed log
   			level from "warning" to "notice" to match named's other
   			startup messages. [GL !7217]

   6044.	[bug]		There was an "RSASHA236" typo in a log message.
   			[GL !7206]

   5830.	[func]		Implement incremental resizing of isc_ht hash tables to
   			perform the rehashing gradually. The catalog zone
   			implementation has been optimized to work with hundreds
   			of thousands of member zones. [GL #3212] [GL #3744]


   To generate a diff of this commit:
   cvs rdiff -u -r1.5 -r1.6 pkgsrc/net/bind918/Makefile
   cvs rdiff -u -r1.1 -r1.2 pkgsrc/net/bind918/PLIST
   cvs rdiff -u -r1.3 -r1.4 pkgsrc/net/bind918/distinfo
   cvs rdiff -u -r1.1 -r0 \
       pkgsrc/net/bind918/patches/patch-bin_tests_system_keyfromlabel_tests.sh
   cvs rdiff -u -r1.1 -r1.2 pkgsrc/net/bind918/patches/patch-lib_isc_siphash.c \
       pkgsrc/net/bind918/patches/patch-lib_isc_time.c \
       pkgsrc/net/bind918/patches/patch-lib_ns_update.c
@
text
@d1 1
a1 1
# $NetBSD$
d5 1
d19 1
a19 1
BIND_VERSION=	9.18.11
@


1.2
log
@Fix build for PKG_DEVELOPER=yes (from taca@@)

Bump pkgsrc version.
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.1 2022/12/11 01:57:55 sekiya Exp $
d7 1
a7 1
MASTER_SITES=	https://downloads.isc.org/isc/bind9/${BIND_VERSION}/${DISTNAME}${EXTRACT_SUFX}
@


1.1
log
@Add net/bind918
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.50 2022/11/23 16:20:48 adam Exp $
a3 1
#PKGNAME=	bind-9.18
d5 1
a5 1
#PKGREVISION=	1
d7 1
a7 1
MASTER_SITES=	ftp://ftp.isc.org/isc/bind9/${BIND_VERSION}/
d41 7
@